diff --git a/AndroidTestTemplate.xml b/AndroidTestTemplate.xml
index 4fb4bf9..8332422 100644
--- a/AndroidTestTemplate.xml
+++ b/AndroidTestTemplate.xml
@@ -24,7 +24,8 @@
     </target_preparer>
   <target_preparer class="com.android.tradefed.targetprep.RunCommandTargetPreparer">
     <option name="run-command" value="settings put global ble_scan_always_enabled 0" />
-    <option name="run-command" value="svc bluetooth disable" />
+    <option name="run-command" value="cmd bluetooth_manager disable" />
+    <option name="run-command" value="cmd bluetooth_manager wait-for-state:STATE_OFF" />
   </target_preparer>
   <target_preparer class="com.android.tradefed.targetprep.FolderSaver">
     <option name="device-path" value="/data/vendor/ssrdump" />
@@ -38,6 +39,7 @@
   <!-- Only run tests in MTS if the Bluetooth Mainline module is installed. -->
   <object type="module_controller"
           class="com.android.tradefed.testtype.suite.module.MainlineTestModuleController">
-      <option name="mainline-module-package-name" value="com.google.android.bluetooth" />
+      <option name="mainline-module-package-name" value="com.android.btservices" />
+      <option name="mainline-module-package-name" value="com.google.android.btservices" />
   </object>
 </configuration>
diff --git a/TEST_MAPPING b/TEST_MAPPING
old mode 100755
new mode 100644
index 69a0709..c1b9e29
--- a/TEST_MAPPING
+++ b/TEST_MAPPING
@@ -1,69 +1,220 @@
 {
-  "postsubmit" : [
+  "presubmit": [
+    // android_test targets
     {
-      "name" : "bluetooth_test_common"
+      "name": "CtsBluetoothTestCases"
     },
     {
-      "name" : "bluetoothtbd_test"
+      "name": "BluetoothInstrumentationTests"
     },
     {
-      "name" : "net_test_audio_a2dp_hw"
+      "name": "GoogleBluetoothInstrumentationTests"
     },
     {
-      "name" : "net_test_avrcp"
+      "name": "FrameworkBluetoothTests"
     },
     {
-      "name" : "net_test_btcore"
+      "name": "ServiceBluetoothTests"
+    },
+    // device only tests
+    // Broken
+    //{
+    //  "name": "bluetooth-test-audio-hal-interface"
+    //},
+    {
+      "name": "net_test_audio_a2dp_hw"
     },
     {
-      "name" : "net_test_btif"
+      "name": "net_test_audio_hearing_aid_hw"
+    },
+    // TODO (b/267212763)
+    // {
+    //   "name": "net_test_bluetooth"
+    // },
+    // {
+    //   "name": "net_test_bta"
+    // },
+    // {
+    //   "name": "net_test_btif"
+    // },
+    {
+      "name": "net_test_btif_hf_client_service"
     },
     {
-      "name" : "net_test_btif_profile_queue"
+      "name": "net_test_btif_profile_queue"
     },
     {
-      "name" : "net_test_btpackets"
+      "name": "net_test_device"
     },
     {
-      "name" : "net_test_device"
+      "name": "net_test_gatt_conn_multiplexing"
+    },
+    // TODO (b/267212763)
+    // {
+    //   "name": "net_test_hci"
+    // },
+    {
+      "name": "net_test_hf_client_add_record"
+    },
+    // TODO (b/267212763)
+    // {
+    //   "name": "net_test_stack"
+    // },
+    {
+      "name": "net_test_stack_ad_parser"
     },
     {
-      "name" : "net_test_eatt"
+      "name": "net_test_stack_multi_adv"
+    },
+    // go/a-unit-tests tests (unit_test: true)
+    // Thoses test run on the host in the CI automatically.
+    // Run the one that are available on the device on the
+    // device as well
+    // TODO (b/267212763)
+    // {
+    //   "name": "bluetooth_csis_test"
+    // },
+    {
+      "name": "bluetooth_flatbuffer_tests"
+    },
+    // TODO (b/267212763)
+    // {
+    //   "name": "bluetooth_groups_test"
+    // },
+    // {
+    //   "name": "bluetooth_has_test"
+    // },
+    {
+      "name": "bluetooth_hh_test"
+    },
+    // TODO (b/267212763)
+    // {
+    //   "name": "bluetooth_le_audio_client_test"
+    // },
+    {
+      "name": "bluetooth_le_audio_test"
     },
     {
-      "name" : "net_test_hci"
+      "name": "bluetooth_packet_parser_test"
+    },
+    // TODO (b/267212763)
+    // {
+    //   "name": "bluetooth_test_broadcaster"
+    // },
+    // {
+    //   "name": "bluetooth_test_broadcaster_state_machine"
+    // },
+    {
+      "name": "bluetooth_test_common"
     },
     {
-      "name" : "net_test_performance"
+      "name": "bluetooth_test_gd_unit"
     },
     {
-      "name" : "net_test_stack"
+      "name": "bluetooth_test_sdp"
+    },
+    // TODO (b/267212763)
+    // {
+    //   "name": "bluetooth_vc_test"
+    // },
+    // {
+    //   "name": "bluetoothtbd_test"
+    // },
+    // {
+    //   "name": "bt_host_test_bta"
+    // },
+    {
+      "name": "libaptx_enc_tests"
     },
     {
-      "name" : "net_test_stack_ad_parser"
+      "name": "libaptxhd_enc_tests"
     },
     {
-      "name" : "net_test_stack_multi_adv"
+      "name": "net_test_avrcp"
     },
     {
-      "name" : "net_test_stack_rfcomm"
+      "name": "net_test_btcore"
     },
     {
-      "name" : "net_test_stack_smp"
+      "name": "net_test_btif_config_cache"
+    },
+    // TODO (b/267212763)
+    // {
+    //   "name": "net_test_btif_hh"
+    // },
+    {
+      "name": "net_test_btif_rc"
+    },
+    // TODO (b/267212763)
+    // {
+    //   "name": "net_test_btif_stack"
+    // },
+    {
+      "name": "net_test_btm_iso"
     },
     {
-      "name" : "net_test_types"
-    }
-  ],
-  "presubmit" : [
-    {
-      "name" : "net_test_hf_client_add_record"
+      "name": "net_test_btpackets"
     },
     {
-      "name" : "net_test_btif_hf_client_service"
+      "name": "net_test_eatt"
     },
     {
-      "name" : "net_test_stack_btm"
+      "name": "net_test_hci_fragmenter_native"
+    },
+    {
+      "name": "net_test_main_shim"
+    },
+    {
+      "name": "net_test_osi"
+    },
+    {
+      "name": "net_test_performance"
+    },
+    {
+      "name": "net_test_stack_a2dp_native"
+    },
+    {
+      "name": "net_test_stack_acl"
+    },
+    {
+      "name": "net_test_stack_avdtp"
+    },
+    // TODO (b/267212763)
+    // {
+    //   "name": "net_test_stack_btm"
+    // },
+    {
+      "name": "net_test_stack_btu"
+    },
+    {
+      "name": "net_test_stack_gatt"
+    },
+    {
+      "name": "net_test_stack_gatt_native"
+    },
+    {
+      "name": "net_test_stack_gatt_sr_hash_native"
+    },
+    {
+      "name": "net_test_stack_hci"
+    },
+    {
+      "name": "net_test_stack_hid"
+    },
+    {
+      "name": "net_test_stack_l2cap"
+    },
+    {
+      "name": "net_test_stack_rfcomm"
+    },
+    {
+      "name": "net_test_stack_sdp"
+    },
+    {
+      "name": "net_test_stack_smp"
+    },
+    {
+      "name": "net_test_types"
     }
   ]
 }
diff --git a/android/BluetoothLegacyMigration/Android.bp b/android/BluetoothLegacyMigration/Android.bp
new file mode 100644
index 0000000..b755fa0
--- /dev/null
+++ b/android/BluetoothLegacyMigration/Android.bp
@@ -0,0 +1,14 @@
+package {
+    // See: http://go/android-license-faq
+    default_applicable_licenses: ["Android-Apache-2.0"],
+}
+
+android_app {
+    name: "BluetoothLegacyMigration",
+
+    srcs: [ "BluetoothLegacyMigration.kt" ],
+
+    // Must match Bluetooth.apk certificate because of sharedUserId
+    certificate: ":com.android.bluetooth.certificate",
+    platform_apis: true,
+}
diff --git a/android/BluetoothLegacyMigration/AndroidManifest.xml b/android/BluetoothLegacyMigration/AndroidManifest.xml
new file mode 100644
index 0000000..86989f9
--- /dev/null
+++ b/android/BluetoothLegacyMigration/AndroidManifest.xml
@@ -0,0 +1,20 @@
+<manifest xmlns:android="http://schemas.android.com/apk/res/android"
+    package="com.android.bluetooth"
+    android:sharedUserId="android.uid.bluetooth">
+
+    <!-- This "legacy" instance is retained on the device to preserve the
+        database contents before Bluetooth was migrated into a Mainline module.
+        This ensures that we can migrate information to new folder app -->
+<application
+    android:icon="@mipmap/bt_share"
+    android:allowBackup="false"
+    android:label="Bluetooth Legacy">
+        <provider
+            android:name="com.google.android.bluetooth.BluetoothLegacyMigration"
+            android:authorities="bluetooth_legacy.provider"
+            android:directBootAware="true"
+            android:exported="false"
+            android:permission="android.permission.BLUETOOTH_PRIVILEGED"
+            />
+    </application>
+</manifest>
diff --git a/android/BluetoothLegacyMigration/BluetoothLegacyMigration.kt b/android/BluetoothLegacyMigration/BluetoothLegacyMigration.kt
new file mode 100644
index 0000000..9c88a06
--- /dev/null
+++ b/android/BluetoothLegacyMigration/BluetoothLegacyMigration.kt
@@ -0,0 +1,259 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package com.google.android.bluetooth
+
+import android.content.ContentProvider
+import android.content.ContentValues
+import android.content.Context
+import android.content.UriMatcher
+import android.database.Cursor
+import android.database.sqlite.SQLiteDatabase
+import android.net.Uri
+import android.os.Bundle
+import android.util.Log
+
+/**
+ * Define an implementation of ContentProvider for the Bluetooth migration
+ */
+class BluetoothLegacyMigration: ContentProvider() {
+    companion object {
+        private const val TAG = "BluetoothLegacyMigration"
+
+        private const val AUTHORITY = "bluetooth_legacy.provider"
+
+        private const val START_LEGACY_MIGRATION_CALL = "start_legacy_migration"
+        private const val FINISH_LEGACY_MIGRATION_CALL = "finish_legacy_migration"
+
+        private const val PHONEBOOK_ACCESS_PERMISSION = "phonebook_access_permission"
+        private const val MESSAGE_ACCESS_PERMISSION = "message_access_permission"
+        private const val SIM_ACCESS_PERMISSION = "sim_access_permission"
+
+        private const val VOLUME_MAP = "bluetooth_volume_map"
+
+        private const val OPP = "OPPMGR"
+        private const val BLUETOOTH_OPP_CHANNEL = "btopp_channels"
+        private const val BLUETOOTH_OPP_NAME = "btopp_names"
+
+        private const val BLUETOOTH_SIGNED_DEFAULT = "com.google.android.bluetooth_preferences"
+
+        private const val KEY_LIST = "key_list"
+
+        private enum class UriId(
+            val fileName: String,
+            val handler: (ctx: Context) -> DatabaseHandler
+        ) {
+            BLUETOOTH(BluetoothDatabase.DATABASE_NAME, ::BluetoothDatabase),
+            OPP(OppDatabase.DATABASE_NAME, ::OppDatabase),
+        }
+
+        private val URI_MATCHER = UriMatcher(UriMatcher.NO_MATCH).apply {
+            UriId.values().map { addURI(AUTHORITY, it.fileName, it.ordinal) }
+        }
+
+        private fun putObjectInBundle(bundle: Bundle, key: String, obj: Any?) {
+            when (obj) {
+                is Boolean -> bundle.putBoolean(key, obj)
+                is Int -> bundle.putInt(key, obj)
+                is Long -> bundle.putLong(key, obj)
+                is String -> bundle.putString(key, obj)
+                null -> throw UnsupportedOperationException("null type is not handled")
+                else -> throw UnsupportedOperationException("${obj.javaClass.simpleName}: type is not handled")
+            }
+        }
+    }
+
+    private lateinit var mContext: Context
+
+    /**
+     * Always return true, indicating that the
+     * provider loaded correctly.
+     */
+    override fun onCreate(): Boolean {
+        mContext = context!!.createDeviceProtectedStorageContext()
+        return true
+    }
+
+    /**
+     * Use a content URI to get database name associated
+     *
+     * @param uri Content uri
+     * @return A {@link Cursor} containing the results of the query.
+     */
+    override fun getType(uri: Uri): String {
+        val database = UriId.values().firstOrNull { it.ordinal == URI_MATCHER.match(uri) }
+            ?: throw UnsupportedOperationException("This Uri is not supported: $uri")
+        return database.fileName
+    }
+
+    /**
+     * Use a content URI to get information about a database
+     *
+     * @param uri Content uri
+     * @param projection unused
+     * @param selection unused
+     * @param selectionArgs unused
+     * @param sortOrder unused
+     * @return A {@link Cursor} containing the results of the query.
+     *
+     */
+    @Override
+    override fun query(
+        uri: Uri,
+        projection: Array<String>?,
+        selection: String?,
+        selectionArgs: Array<String>?,
+        sortOrder: String?
+    ): Cursor? {
+        val database = UriId.values().firstOrNull { it.ordinal == URI_MATCHER.match(uri) }
+            ?: throw UnsupportedOperationException("This Uri is not supported: $uri")
+        return database.handler(mContext).toCursor()
+    }
+
+    /**
+     * insert() is not supported
+     */
+    override fun insert(uri: Uri, values: ContentValues?): Uri? {
+        throw UnsupportedOperationException()
+    }
+
+    /**
+     * delete() is not supported
+     */
+    override fun delete(uri: Uri, selection: String?, selectionArgs: Array<String>?): Int {
+        throw UnsupportedOperationException()
+    }
+
+    /**
+     * update() is not supported
+     */
+    override fun update(
+        uri: Uri, values: ContentValues?, selection: String?, selectionArgs: Array<String>?
+    ): Int {
+        throw UnsupportedOperationException()
+    }
+
+    abstract class MigrationHandler {
+        abstract fun toBundle(): Bundle?
+        abstract fun delete()
+    }
+
+    private class SharedPreferencesHandler(private val ctx: Context, private val key: String) :
+        MigrationHandler() {
+
+        override fun toBundle(): Bundle? {
+            val pref = ctx.getSharedPreferences(key, Context.MODE_PRIVATE)
+            if (pref.all.isEmpty()) {
+                Log.d(TAG, "No migration needed for shared preference: $key")
+                return null
+            }
+            val bundle = Bundle()
+            val keys = arrayListOf<String>()
+            for (e in pref.all) {
+                keys += e.key
+                putObjectInBundle(bundle, e.key, e.value)
+            }
+            bundle.putStringArrayList(KEY_LIST, keys)
+            Log.d(TAG, "SharedPreferences migrating ${keys.size} key(s) from $key")
+            return bundle
+        }
+
+        override fun delete() {
+            ctx.deleteSharedPreferences(key)
+            Log.d(TAG, "$key: SharedPreferences deleted")
+        }
+    }
+
+    abstract class DatabaseHandler(private val ctx: Context, private val dbName: String) :
+        MigrationHandler() {
+
+        abstract val sql: String
+
+        fun toCursor(): Cursor? {
+            val databasePath = ctx.getDatabasePath(dbName)
+            if (!databasePath.exists()) {
+                Log.d(TAG, "No migration needed for database: $dbName")
+                return null
+            }
+            val db = SQLiteDatabase.openDatabase(
+                databasePath,
+                SQLiteDatabase.OpenParams.Builder().addOpenFlags(SQLiteDatabase.OPEN_READONLY)
+                    .build()
+            )
+            return db.rawQuery(sql, null)
+        }
+
+        override fun toBundle(): Bundle? {
+            throw UnsupportedOperationException()
+        }
+
+        override fun delete() {
+            val databasePath = ctx.getDatabasePath(dbName)
+            databasePath.delete()
+            Log.d(TAG, "$dbName: database deleted")
+        }
+    }
+
+    private class BluetoothDatabase(ctx: Context) : DatabaseHandler(ctx, DATABASE_NAME) {
+        companion object {
+            const val DATABASE_NAME = "bluetooth_db"
+        }
+        private val dbTable = "metadata"
+        override val sql = "select * from $dbTable"
+    }
+
+    private class OppDatabase(ctx: Context) : DatabaseHandler(ctx, DATABASE_NAME) {
+        companion object {
+            const val DATABASE_NAME = "btopp.db"
+        }
+        private val dbTable = "btopp"
+        override val sql = "select * from $dbTable"
+    }
+
+    /**
+     * Fetch legacy data describe by {@code arg} and perform {@code method} action on it
+     *
+     * @param method Action to perform. One of START_LEGACY_MIGRATION_CALL|FINISH_LEGACY_MIGRATION_CALL
+     * @param arg item on witch to perform the action specified by {@code method}
+     * @param extras unused
+     * @return A {@link Bundle} containing the results of the query.
+     */
+    override fun call(method: String, arg: String?, extras: Bundle?): Bundle? {
+        val migrationHandler = when (arg) {
+            OPP,
+            VOLUME_MAP,
+            BLUETOOTH_OPP_NAME,
+            BLUETOOTH_OPP_CHANNEL,
+            SIM_ACCESS_PERMISSION,
+            MESSAGE_ACCESS_PERMISSION,
+            PHONEBOOK_ACCESS_PERMISSION -> SharedPreferencesHandler(mContext, arg)
+            BLUETOOTH_SIGNED_DEFAULT -> {
+                val key = mContext.packageName + "_preferences"
+                SharedPreferencesHandler(mContext, key)
+            }
+            BluetoothDatabase.DATABASE_NAME -> BluetoothDatabase(mContext)
+            OppDatabase.DATABASE_NAME -> OppDatabase(mContext)
+            else -> throw UnsupportedOperationException()
+        }
+        return when (method) {
+            START_LEGACY_MIGRATION_CALL -> migrationHandler.toBundle()
+            FINISH_LEGACY_MIGRATION_CALL -> {
+                migrationHandler.delete()
+                return null
+            }
+            else -> throw UnsupportedOperationException()
+        }
+    }
+}
diff --git a/android/BluetoothLegacyMigration/OWNERS b/android/BluetoothLegacyMigration/OWNERS
new file mode 100644
index 0000000..8f5c903
--- /dev/null
+++ b/android/BluetoothLegacyMigration/OWNERS
@@ -0,0 +1,8 @@
+# Reviewers for /android/BluetoothLegacyMigration
+
+eruffieux@google.com
+rahulsabnis@google.com
+sattiraju@google.com
+siyuanh@google.com
+wescande@google.com
+zachoverflow@google.com
diff --git a/android/BluetoothLegacyMigration/res/mipmap-anydpi/bt_share.xml b/android/BluetoothLegacyMigration/res/mipmap-anydpi/bt_share.xml
new file mode 100644
index 0000000..ff00b0d
--- /dev/null
+++ b/android/BluetoothLegacyMigration/res/mipmap-anydpi/bt_share.xml
@@ -0,0 +1,28 @@
+<!--
+   Copyright (C) 2022 The Android Open Source Project
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+        http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License
+  -->
+<adaptive-icon xmlns:android="http://schemas.android.com/apk/res/android">
+  <foreground>
+    <inset
+      android:drawable="@*android:drawable/ic_bluetooth_share_icon"
+      android:insetTop="25%"
+      android:insetRight="25%"
+      android:insetBottom="25%"
+      android:insetLeft="25%" />
+  </foreground>
+  <background>
+    <color android:color="#e9ddd4" />
+  </background>
+</adaptive-icon>
diff --git a/android/app/Android.bp b/android/app/Android.bp
index 90f39fd..2e71dcc 100644
--- a/android/app/Android.bp
+++ b/android/app/Android.bp
@@ -69,12 +69,6 @@
         "libbluetooth",
         "libc++fs",
     ],
-    cflags: [
-        "-Wall",
-        "-Werror",
-        "-Wextra",
-        "-Wno-unused-parameter",
-    ],
     sanitize: {
         scs: true,
     },
@@ -114,7 +108,7 @@
     static_libs: [
         "android.hardware.radio-V1.0-java",
         "androidx.core_core",
-        "androidx.legacy_legacy-support-v4",
+        "androidx.media_media",
         "androidx.lifecycle_lifecycle-livedata",
         "androidx.room_room-runtime",
         "androidx.annotation_annotation",
diff --git a/android/app/AndroidManifest.xml b/android/app/AndroidManifest.xml
index 8ed18e2..9484744 100644
--- a/android/app/AndroidManifest.xml
+++ b/android/app/AndroidManifest.xml
@@ -76,6 +76,7 @@
     <uses-permission android:name="android.permission.HIDE_OVERLAY_WINDOWS"/>
     <uses-permission android:name="android.permission.QUERY_AUDIO_STATE"/>
     <uses-permission android:name="android.permission.POST_NOTIFICATIONS"/>
+    <uses-permission android:name="android.permission.WRITE_SECURITY_LOG"/>
 
     <uses-sdk android:minSdkVersion="14"/>
 
diff --git a/android/app/jni/com_android_bluetooth_btservice_AdapterService.cpp b/android/app/jni/com_android_bluetooth_btservice_AdapterService.cpp
index ba69e74..f25e208 100644
--- a/android/app/jni/com_android_bluetooth_btservice_AdapterService.cpp
+++ b/android/app/jni/com_android_bluetooth_btservice_AdapterService.cpp
@@ -1810,6 +1810,35 @@
   return true;
 }
 
+static void metadataChangedNative(JNIEnv* env, jobject obj, jbyteArray address,
+                                  jint key, jbyteArray value) {
+  ALOGV("%s", __func__);
+  if (!sBluetoothInterface) return;
+  jbyte* addr = env->GetByteArrayElements(address, nullptr);
+  if (addr == nullptr) {
+    jniThrowIOException(env, EINVAL);
+    return;
+  }
+  RawAddress addr_obj = {};
+  addr_obj.FromOctets((uint8_t*)addr);
+
+  if (value == NULL) {
+    ALOGE("metadataChangedNative() ignoring NULL array");
+    return;
+  }
+
+  uint16_t len = (uint16_t)env->GetArrayLength(value);
+  jbyte* p_value = env->GetByteArrayElements(value, NULL);
+  if (p_value == NULL) return;
+
+  std::vector<uint8_t> val_vec(reinterpret_cast<uint8_t*>(p_value),
+                               reinterpret_cast<uint8_t*>(p_value + len));
+  env->ReleaseByteArrayElements(value, p_value, 0);
+
+  sBluetoothInterface->metadata_changed(addr_obj, key, std::move(val_vec));
+  return;
+}
+
 static JNINativeMethod sMethods[] = {
     /* name, signature, funcPtr */
     {"classInitNative", "()V", (void*)classInitNative},
@@ -1852,6 +1881,7 @@
     {"requestMaximumTxDataLengthNative", "([B)V",
      (void*)requestMaximumTxDataLengthNative},
     {"allowLowLatencyAudioNative", "(Z[B)Z", (void*)allowLowLatencyAudioNative},
+    {"metadataChangedNative", "([BI[B)V", (void*)metadataChangedNative},
 };
 
 int register_com_android_bluetooth_btservice_AdapterService(JNIEnv* env) {
diff --git a/android/app/jni/com_android_bluetooth_gatt.cpp b/android/app/jni/com_android_bluetooth_gatt.cpp
index 963eb56..03517fc 100644
--- a/android/app/jni/com_android_bluetooth_gatt.cpp
+++ b/android/app/jni/com_android_bluetooth_gatt.cpp
@@ -199,8 +199,9 @@
  */
 
 void btgattc_register_app_cb(int status, int clientIf, const Uuid& app_uuid) {
+  std::shared_lock<std::shared_mutex> lock(callbacks_mutex);
   CallbackEnv sCallbackEnv(__func__);
-  if (!sCallbackEnv.valid()) return;
+  if (!sCallbackEnv.valid() || !mCallbacksObj) return;
   sCallbackEnv->CallVoidMethod(mCallbacksObj, method_onClientRegistered, status,
                                clientIf, UUID_PARAMS(app_uuid));
 }
@@ -212,8 +213,9 @@
                             uint16_t periodic_adv_int,
                             std::vector<uint8_t> adv_data,
                             RawAddress* original_bda) {
+  std::shared_lock<std::shared_mutex> lock(callbacks_mutex);
   CallbackEnv sCallbackEnv(__func__);
-  if (!sCallbackEnv.valid()) return;
+  if (!sCallbackEnv.valid() || !mCallbacksObj) return;
 
   ScopedLocalRef<jstring> address(sCallbackEnv.get(),
                                   bdaddr2newjstr(sCallbackEnv.get(), bda));
@@ -233,8 +235,9 @@
 
 void btgattc_open_cb(int conn_id, int status, int clientIf,
                      const RawAddress& bda) {
+  std::shared_lock<std::shared_mutex> lock(callbacks_mutex);
   CallbackEnv sCallbackEnv(__func__);
-  if (!sCallbackEnv.valid()) return;
+  if (!sCallbackEnv.valid() || !mCallbacksObj) return;
 
   ScopedLocalRef<jstring> address(sCallbackEnv.get(),
                                   bdaddr2newjstr(sCallbackEnv.get(), &bda));
@@ -244,8 +247,9 @@
 
 void btgattc_close_cb(int conn_id, int status, int clientIf,
                       const RawAddress& bda) {
+  std::shared_lock<std::shared_mutex> lock(callbacks_mutex);
   CallbackEnv sCallbackEnv(__func__);
-  if (!sCallbackEnv.valid()) return;
+  if (!sCallbackEnv.valid() || !mCallbacksObj) return;
 
   ScopedLocalRef<jstring> address(sCallbackEnv.get(),
                                   bdaddr2newjstr(sCallbackEnv.get(), &bda));
@@ -254,8 +258,9 @@
 }
 
 void btgattc_search_complete_cb(int conn_id, int status) {
+  std::shared_lock<std::shared_mutex> lock(callbacks_mutex);
   CallbackEnv sCallbackEnv(__func__);
-  if (!sCallbackEnv.valid()) return;
+  if (!sCallbackEnv.valid() || !mCallbacksObj) return;
 
   sCallbackEnv->CallVoidMethod(mCallbacksObj, method_onSearchCompleted, conn_id,
                                status);
@@ -263,16 +268,18 @@
 
 void btgattc_register_for_notification_cb(int conn_id, int registered,
                                           int status, uint16_t handle) {
+  std::shared_lock<std::shared_mutex> lock(callbacks_mutex);
   CallbackEnv sCallbackEnv(__func__);
-  if (!sCallbackEnv.valid()) return;
+  if (!sCallbackEnv.valid() || !mCallbacksObj) return;
 
   sCallbackEnv->CallVoidMethod(mCallbacksObj, method_onRegisterForNotifications,
                                conn_id, status, registered, handle);
 }
 
 void btgattc_notify_cb(int conn_id, const btgatt_notify_params_t& p_data) {
+  std::shared_lock<std::shared_mutex> lock(callbacks_mutex);
   CallbackEnv sCallbackEnv(__func__);
-  if (!sCallbackEnv.valid()) return;
+  if (!sCallbackEnv.valid() || !mCallbacksObj) return;
 
   ScopedLocalRef<jstring> address(
       sCallbackEnv.get(), bdaddr2newjstr(sCallbackEnv.get(), &p_data.bda));
@@ -288,8 +295,9 @@
 
 void btgattc_read_characteristic_cb(int conn_id, int status,
                                     btgatt_read_params_t* p_data) {
+  std::shared_lock<std::shared_mutex> lock(callbacks_mutex);
   CallbackEnv sCallbackEnv(__func__);
-  if (!sCallbackEnv.valid()) return;
+  if (!sCallbackEnv.valid() || !mCallbacksObj) return;
 
   ScopedLocalRef<jbyteArray> jb(sCallbackEnv.get(), NULL);
   if (status == 0) {  // Success
@@ -308,8 +316,9 @@
 
 void btgattc_write_characteristic_cb(int conn_id, int status, uint16_t handle,
                                      uint16_t len, const uint8_t* value) {
+  std::shared_lock<std::shared_mutex> lock(callbacks_mutex);
   CallbackEnv sCallbackEnv(__func__);
-  if (!sCallbackEnv.valid()) return;
+  if (!sCallbackEnv.valid() || !mCallbacksObj) return;
 
   ScopedLocalRef<jbyteArray> jb(sCallbackEnv.get(), NULL);
   jb.reset(sCallbackEnv->NewByteArray(len));
@@ -319,8 +328,9 @@
 }
 
 void btgattc_execute_write_cb(int conn_id, int status) {
+  std::shared_lock<std::shared_mutex> lock(callbacks_mutex);
   CallbackEnv sCallbackEnv(__func__);
-  if (!sCallbackEnv.valid()) return;
+  if (!sCallbackEnv.valid() || !mCallbacksObj) return;
 
   sCallbackEnv->CallVoidMethod(mCallbacksObj, method_onExecuteCompleted,
                                conn_id, status);
@@ -328,8 +338,9 @@
 
 void btgattc_read_descriptor_cb(int conn_id, int status,
                                 const btgatt_read_params_t& p_data) {
+  std::shared_lock<std::shared_mutex> lock(callbacks_mutex);
   CallbackEnv sCallbackEnv(__func__);
-  if (!sCallbackEnv.valid()) return;
+  if (!sCallbackEnv.valid() || !mCallbacksObj) return;
 
   ScopedLocalRef<jbyteArray> jb(sCallbackEnv.get(), NULL);
   if (p_data.value.len != 0) {
@@ -346,8 +357,9 @@
 
 void btgattc_write_descriptor_cb(int conn_id, int status, uint16_t handle,
                                  uint16_t len, const uint8_t* value) {
+  std::shared_lock<std::shared_mutex> lock(callbacks_mutex);
   CallbackEnv sCallbackEnv(__func__);
-  if (!sCallbackEnv.valid()) return;
+  if (!sCallbackEnv.valid() || !mCallbacksObj) return;
 
   ScopedLocalRef<jbyteArray> jb(sCallbackEnv.get(), NULL);
   jb.reset(sCallbackEnv->NewByteArray(len));
@@ -358,8 +370,9 @@
 
 void btgattc_remote_rssi_cb(int client_if, const RawAddress& bda, int rssi,
                             int status) {
+  std::shared_lock<std::shared_mutex> lock(callbacks_mutex);
   CallbackEnv sCallbackEnv(__func__);
-  if (!sCallbackEnv.valid()) return;
+  if (!sCallbackEnv.valid() || !mCallbacksObj) return;
 
   ScopedLocalRef<jstring> address(sCallbackEnv.get(),
                                   bdaddr2newjstr(sCallbackEnv.get(), &bda));
@@ -369,23 +382,26 @@
 }
 
 void btgattc_configure_mtu_cb(int conn_id, int status, int mtu) {
+  std::shared_lock<std::shared_mutex> lock(callbacks_mutex);
   CallbackEnv sCallbackEnv(__func__);
-  if (!sCallbackEnv.valid()) return;
+  if (!sCallbackEnv.valid() || !mCallbacksObj) return;
   sCallbackEnv->CallVoidMethod(mCallbacksObj, method_onConfigureMTU, conn_id,
                                status, mtu);
 }
 
 void btgattc_congestion_cb(int conn_id, bool congested) {
+  std::shared_lock<std::shared_mutex> lock(callbacks_mutex);
   CallbackEnv sCallbackEnv(__func__);
-  if (!sCallbackEnv.valid()) return;
+  if (!sCallbackEnv.valid() || !mCallbacksObj) return;
   sCallbackEnv->CallVoidMethod(mCallbacksObj, method_onClientCongestion,
                                conn_id, congested);
 }
 
 void btgattc_batchscan_reports_cb(int client_if, int status, int report_format,
                                   int num_records, std::vector<uint8_t> data) {
+  std::shared_lock<std::shared_mutex> lock(callbacks_mutex);
   CallbackEnv sCallbackEnv(__func__);
-  if (!sCallbackEnv.valid()) return;
+  if (!sCallbackEnv.valid() || !mCallbacksObj) return;
   ScopedLocalRef<jbyteArray> jb(sCallbackEnv.get(),
                                 sCallbackEnv->NewByteArray(data.size()));
   sCallbackEnv->SetByteArrayRegion(jb.get(), 0, data.size(),
@@ -396,15 +412,17 @@
 }
 
 void btgattc_batchscan_threshold_cb(int client_if) {
+  std::shared_lock<std::shared_mutex> lock(callbacks_mutex);
   CallbackEnv sCallbackEnv(__func__);
-  if (!sCallbackEnv.valid()) return;
+  if (!sCallbackEnv.valid() || !mCallbacksObj) return;
   sCallbackEnv->CallVoidMethod(mCallbacksObj,
                                method_onBatchScanThresholdCrossed, client_if);
 }
 
 void btgattc_track_adv_event_cb(btgatt_track_adv_info_t* p_adv_track_info) {
+  std::shared_lock<std::shared_mutex> lock(callbacks_mutex);
   CallbackEnv sCallbackEnv(__func__);
-  if (!sCallbackEnv.valid()) return;
+  if (!sCallbackEnv.valid() || !mCallbacksObj) return;
 
   ScopedLocalRef<jstring> address(
       sCallbackEnv.get(),
@@ -506,8 +524,9 @@
 
 void btgattc_get_gatt_db_cb(int conn_id, const btgatt_db_element_t* db,
                             int count) {
+  std::shared_lock<std::shared_mutex> lock(callbacks_mutex);
   CallbackEnv sCallbackEnv(__func__);
-  if (!sCallbackEnv.valid()) return;
+  if (!sCallbackEnv.valid() || !mCallbacksObj) return;
 
   jclass arrayListclazz = sCallbackEnv->FindClass("java/util/ArrayList");
   ScopedLocalRef<jobject> array(
@@ -525,8 +544,9 @@
 
 void btgattc_phy_updated_cb(int conn_id, uint8_t tx_phy, uint8_t rx_phy,
                             uint8_t status) {
+  std::shared_lock<std::shared_mutex> lock(callbacks_mutex);
   CallbackEnv sCallbackEnv(__func__);
-  if (!sCallbackEnv.valid()) return;
+  if (!sCallbackEnv.valid() || !mCallbacksObj) return;
 
   sCallbackEnv->CallVoidMethod(mCallbacksObj, method_onClientPhyUpdate, conn_id,
                                tx_phy, rx_phy, status);
@@ -534,16 +554,18 @@
 
 void btgattc_conn_updated_cb(int conn_id, uint16_t interval, uint16_t latency,
                              uint16_t timeout, uint8_t status) {
+  std::shared_lock<std::shared_mutex> lock(callbacks_mutex);
   CallbackEnv sCallbackEnv(__func__);
-  if (!sCallbackEnv.valid()) return;
+  if (!sCallbackEnv.valid() || !mCallbacksObj) return;
 
   sCallbackEnv->CallVoidMethod(mCallbacksObj, method_onClientConnUpdate,
                                conn_id, interval, latency, timeout, status);
 }
 
 void btgattc_service_changed_cb(int conn_id) {
+  std::shared_lock<std::shared_mutex> lock(callbacks_mutex);
   CallbackEnv sCallbackEnv(__func__);
-  if (!sCallbackEnv.valid()) return;
+  if (!sCallbackEnv.valid() || !mCallbacksObj) return;
 
   sCallbackEnv->CallVoidMethod(mCallbacksObj, method_onServiceChanged, conn_id);
 }
@@ -583,16 +605,18 @@
  */
 
 void btgatts_register_app_cb(int status, int server_if, const Uuid& uuid) {
+  std::shared_lock<std::shared_mutex> lock(callbacks_mutex);
   CallbackEnv sCallbackEnv(__func__);
-  if (!sCallbackEnv.valid()) return;
+  if (!sCallbackEnv.valid() || !mCallbacksObj) return;
   sCallbackEnv->CallVoidMethod(mCallbacksObj, method_onServerRegistered, status,
                                server_if, UUID_PARAMS(uuid));
 }
 
 void btgatts_connection_cb(int conn_id, int server_if, int connected,
                            const RawAddress& bda) {
+  std::shared_lock<std::shared_mutex> lock(callbacks_mutex);
   CallbackEnv sCallbackEnv(__func__);
-  if (!sCallbackEnv.valid()) return;
+  if (!sCallbackEnv.valid() || !mCallbacksObj) return;
 
   ScopedLocalRef<jstring> address(sCallbackEnv.get(),
                                   bdaddr2newjstr(sCallbackEnv.get(), &bda));
@@ -603,8 +627,9 @@
 void btgatts_service_added_cb(int status, int server_if,
                               const btgatt_db_element_t* service,
                               size_t service_count) {
+  std::shared_lock<std::shared_mutex> lock(callbacks_mutex);
   CallbackEnv sCallbackEnv(__func__);
-  if (!sCallbackEnv.valid()) return;
+  if (!sCallbackEnv.valid() || !mCallbacksObj) return;
 
   jclass arrayListclazz = sCallbackEnv->FindClass("java/util/ArrayList");
   ScopedLocalRef<jobject> array(
@@ -620,15 +645,17 @@
 }
 
 void btgatts_service_stopped_cb(int status, int server_if, int srvc_handle) {
+  std::shared_lock<std::shared_mutex> lock(callbacks_mutex);
   CallbackEnv sCallbackEnv(__func__);
-  if (!sCallbackEnv.valid()) return;
+  if (!sCallbackEnv.valid() || !mCallbacksObj) return;
   sCallbackEnv->CallVoidMethod(mCallbacksObj, method_onServiceStopped, status,
                                server_if, srvc_handle);
 }
 
 void btgatts_service_deleted_cb(int status, int server_if, int srvc_handle) {
+  std::shared_lock<std::shared_mutex> lock(callbacks_mutex);
   CallbackEnv sCallbackEnv(__func__);
-  if (!sCallbackEnv.valid()) return;
+  if (!sCallbackEnv.valid() || !mCallbacksObj) return;
   sCallbackEnv->CallVoidMethod(mCallbacksObj, method_onServiceDeleted, status,
                                server_if, srvc_handle);
 }
@@ -637,8 +664,9 @@
                                             const RawAddress& bda,
                                             int attr_handle, int offset,
                                             bool is_long) {
+  std::shared_lock<std::shared_mutex> lock(callbacks_mutex);
   CallbackEnv sCallbackEnv(__func__);
-  if (!sCallbackEnv.valid()) return;
+  if (!sCallbackEnv.valid() || !mCallbacksObj) return;
 
   ScopedLocalRef<jstring> address(sCallbackEnv.get(),
                                   bdaddr2newjstr(sCallbackEnv.get(), &bda));
@@ -650,8 +678,9 @@
 void btgatts_request_read_descriptor_cb(int conn_id, int trans_id,
                                         const RawAddress& bda, int attr_handle,
                                         int offset, bool is_long) {
+  std::shared_lock<std::shared_mutex> lock(callbacks_mutex);
   CallbackEnv sCallbackEnv(__func__);
-  if (!sCallbackEnv.valid()) return;
+  if (!sCallbackEnv.valid() || !mCallbacksObj) return;
 
   ScopedLocalRef<jstring> address(sCallbackEnv.get(),
                                   bdaddr2newjstr(sCallbackEnv.get(), &bda));
@@ -666,8 +695,9 @@
                                              bool need_rsp, bool is_prep,
                                              const uint8_t* value,
                                              size_t length) {
+  std::shared_lock<std::shared_mutex> lock(callbacks_mutex);
   CallbackEnv sCallbackEnv(__func__);
-  if (!sCallbackEnv.valid()) return;
+  if (!sCallbackEnv.valid() || !mCallbacksObj) return;
 
   ScopedLocalRef<jstring> address(sCallbackEnv.get(),
                                   bdaddr2newjstr(sCallbackEnv.get(), &bda));
@@ -685,8 +715,9 @@
                                          int offset, bool need_rsp,
                                          bool is_prep, const uint8_t* value,
                                          size_t length) {
+  std::shared_lock<std::shared_mutex> lock(callbacks_mutex);
   CallbackEnv sCallbackEnv(__func__);
-  if (!sCallbackEnv.valid()) return;
+  if (!sCallbackEnv.valid() || !mCallbacksObj) return;
 
   ScopedLocalRef<jstring> address(sCallbackEnv.get(),
                                   bdaddr2newjstr(sCallbackEnv.get(), &bda));
@@ -701,8 +732,9 @@
 
 void btgatts_request_exec_write_cb(int conn_id, int trans_id,
                                    const RawAddress& bda, int exec_write) {
+  std::shared_lock<std::shared_mutex> lock(callbacks_mutex);
   CallbackEnv sCallbackEnv(__func__);
-  if (!sCallbackEnv.valid()) return;
+  if (!sCallbackEnv.valid() || !mCallbacksObj) return;
 
   ScopedLocalRef<jstring> address(sCallbackEnv.get(),
                                   bdaddr2newjstr(sCallbackEnv.get(), &bda));
@@ -711,37 +743,42 @@
 }
 
 void btgatts_response_confirmation_cb(int status, int handle) {
+  std::shared_lock<std::shared_mutex> lock(callbacks_mutex);
   CallbackEnv sCallbackEnv(__func__);
-  if (!sCallbackEnv.valid()) return;
+  if (!sCallbackEnv.valid() || !mCallbacksObj) return;
   sCallbackEnv->CallVoidMethod(mCallbacksObj, method_onResponseSendCompleted,
                                status, handle);
 }
 
 void btgatts_indication_sent_cb(int conn_id, int status) {
+  std::shared_lock<std::shared_mutex> lock(callbacks_mutex);
   CallbackEnv sCallbackEnv(__func__);
-  if (!sCallbackEnv.valid()) return;
+  if (!sCallbackEnv.valid() || !mCallbacksObj) return;
   sCallbackEnv->CallVoidMethod(mCallbacksObj, method_onNotificationSent,
                                conn_id, status);
 }
 
 void btgatts_congestion_cb(int conn_id, bool congested) {
+  std::shared_lock<std::shared_mutex> lock(callbacks_mutex);
   CallbackEnv sCallbackEnv(__func__);
-  if (!sCallbackEnv.valid()) return;
+  if (!sCallbackEnv.valid() || !mCallbacksObj) return;
   sCallbackEnv->CallVoidMethod(mCallbacksObj, method_onServerCongestion,
                                conn_id, congested);
 }
 
 void btgatts_mtu_changed_cb(int conn_id, int mtu) {
+  std::shared_lock<std::shared_mutex> lock(callbacks_mutex);
   CallbackEnv sCallbackEnv(__func__);
-  if (!sCallbackEnv.valid()) return;
+  if (!sCallbackEnv.valid() || !mCallbacksObj) return;
   sCallbackEnv->CallVoidMethod(mCallbacksObj, method_onServerMtuChanged,
                                conn_id, mtu);
 }
 
 void btgatts_phy_updated_cb(int conn_id, uint8_t tx_phy, uint8_t rx_phy,
                             uint8_t status) {
+  std::shared_lock<std::shared_mutex> lock(callbacks_mutex);
   CallbackEnv sCallbackEnv(__func__);
-  if (!sCallbackEnv.valid()) return;
+  if (!sCallbackEnv.valid() || !mCallbacksObj) return;
 
   sCallbackEnv->CallVoidMethod(mCallbacksObj, method_onServerPhyUpdate, conn_id,
                                tx_phy, rx_phy, status);
@@ -749,8 +786,9 @@
 
 void btgatts_conn_updated_cb(int conn_id, uint16_t interval, uint16_t latency,
                              uint16_t timeout, uint8_t status) {
+  std::shared_lock<std::shared_mutex> lock(callbacks_mutex);
   CallbackEnv sCallbackEnv(__func__);
-  if (!sCallbackEnv.valid()) return;
+  if (!sCallbackEnv.valid() || !mCallbacksObj) return;
 
   sCallbackEnv->CallVoidMethod(mCallbacksObj, method_onServerConnUpdate,
                                conn_id, interval, latency, timeout, status);
@@ -890,15 +928,17 @@
 
   void OnScannerRegistered(const Uuid app_uuid, uint8_t scannerId,
                            uint8_t status) {
+    std::shared_lock<std::shared_mutex> lock(callbacks_mutex);
     CallbackEnv sCallbackEnv(__func__);
-    if (!sCallbackEnv.valid()) return;
+    if (!sCallbackEnv.valid() || !mCallbacksObj) return;
     sCallbackEnv->CallVoidMethod(mCallbacksObj, method_onScannerRegistered,
                                  status, scannerId, UUID_PARAMS(app_uuid));
   }
 
   void OnSetScannerParameterComplete(uint8_t scannerId, uint8_t status) {
+    std::shared_lock<std::shared_mutex> lock(callbacks_mutex);
     CallbackEnv sCallbackEnv(__func__);
-    if (!sCallbackEnv.valid()) return;
+    if (!sCallbackEnv.valid() || !mCallbacksObj) return;
     sCallbackEnv->CallVoidMethod(
         mCallbacksObj, method_onScanParamSetupCompleted, status, scannerId);
   }
@@ -907,8 +947,9 @@
                     uint8_t primary_phy, uint8_t secondary_phy,
                     uint8_t advertising_sid, int8_t tx_power, int8_t rssi,
                     uint16_t periodic_adv_int, std::vector<uint8_t> adv_data) {
+    std::shared_lock<std::shared_mutex> lock(callbacks_mutex);
     CallbackEnv sCallbackEnv(__func__);
-    if (!sCallbackEnv.valid()) return;
+    if (!sCallbackEnv.valid() || !mCallbacksObj) return;
 
     ScopedLocalRef<jstring> address(sCallbackEnv.get(),
                                     bdaddr2newjstr(sCallbackEnv.get(), &bda));
@@ -932,8 +973,9 @@
   }
 
   void OnTrackAdvFoundLost(AdvertisingTrackInfo track_info) {
+    std::shared_lock<std::shared_mutex> lock(callbacks_mutex);
     CallbackEnv sCallbackEnv(__func__);
-    if (!sCallbackEnv.valid()) return;
+    if (!sCallbackEnv.valid() || !mCallbacksObj) return;
 
     ScopedLocalRef<jstring> address(
         sCallbackEnv.get(),
@@ -973,8 +1015,9 @@
 
   void OnBatchScanReports(int client_if, int status, int report_format,
                           int num_records, std::vector<uint8_t> data) {
+    std::shared_lock<std::shared_mutex> lock(callbacks_mutex);
     CallbackEnv sCallbackEnv(__func__);
-    if (!sCallbackEnv.valid()) return;
+    if (!sCallbackEnv.valid() || !mCallbacksObj) return;
     ScopedLocalRef<jbyteArray> jb(sCallbackEnv.get(),
                                   sCallbackEnv->NewByteArray(data.size()));
     sCallbackEnv->SetByteArrayRegion(jb.get(), 0, data.size(),
@@ -986,8 +1029,9 @@
   }
 
   void OnBatchScanThresholdCrossed(int client_if) {
+    std::shared_lock<std::shared_mutex> lock(callbacks_mutex);
     CallbackEnv sCallbackEnv(__func__);
-    if (!sCallbackEnv.valid()) return;
+    if (!sCallbackEnv.valid() || !mCallbacksObj) return;
     sCallbackEnv->CallVoidMethod(mCallbacksObj,
                                  method_onBatchScanThresholdCrossed, client_if);
   }
@@ -996,6 +1040,7 @@
                              uint8_t sid, uint8_t address_type,
                              RawAddress address, uint8_t phy,
                              uint16_t interval) override {
+    std::shared_lock<std::shared_mutex> lock(callbacks_mutex);
     CallbackEnv sCallbackEnv(__func__);
     if (!sCallbackEnv.valid()) return;
     if (!mPeriodicScanCallbacksObj) {
@@ -1013,8 +1058,9 @@
   void OnPeriodicSyncReport(uint16_t sync_handle, int8_t tx_power, int8_t rssi,
                             uint8_t data_status,
                             std::vector<uint8_t> data) override {
+    std::shared_lock<std::shared_mutex> lock(callbacks_mutex);
     CallbackEnv sCallbackEnv(__func__);
-    if (!sCallbackEnv.valid()) return;
+    if (!sCallbackEnv.valid() || !mPeriodicScanCallbacksObj) return;
 
     ScopedLocalRef<jbyteArray> jb(sCallbackEnv.get(),
                                   sCallbackEnv->NewByteArray(data.size()));
@@ -1027,8 +1073,9 @@
   }
 
   void OnPeriodicSyncLost(uint16_t sync_handle) override {
+    std::shared_lock<std::shared_mutex> lock(callbacks_mutex);
     CallbackEnv sCallbackEnv(__func__);
-    if (!sCallbackEnv.valid()) return;
+    if (!sCallbackEnv.valid() || !mPeriodicScanCallbacksObj) return;
 
     sCallbackEnv->CallVoidMethod(mPeriodicScanCallbacksObj, method_onSyncLost,
                                  sync_handle);
@@ -1036,6 +1083,7 @@
 
   void OnPeriodicSyncTransferred(int pa_source, uint8_t status,
                                  RawAddress address) override {
+    std::shared_lock<std::shared_mutex> lock(callbacks_mutex);
     CallbackEnv sCallbackEnv(__func__);
     if (!sCallbackEnv.valid()) return;
     if (!mPeriodicScanCallbacksObj) {
@@ -1168,6 +1216,7 @@
 static const bt_interface_t* btIf;
 
 static void initializeNative(JNIEnv* env, jobject object) {
+  std::unique_lock<std::shared_mutex> lock(callbacks_mutex);
   if (btIf) return;
 
   btIf = getBluetoothInterface();
@@ -1210,6 +1259,8 @@
 }
 
 static void cleanupNative(JNIEnv* env, jobject object) {
+  std::unique_lock<std::shared_mutex> lock(callbacks_mutex);
+
   if (!btIf) return;
 
   if (sGattIf != NULL) {
@@ -1250,8 +1301,9 @@
 
 void btgattc_register_scanner_cb(const Uuid& app_uuid, uint8_t scannerId,
                                  uint8_t status) {
+  std::shared_lock<std::shared_mutex> lock(callbacks_mutex);
   CallbackEnv sCallbackEnv(__func__);
-  if (!sCallbackEnv.valid()) return;
+  if (!sCallbackEnv.valid() || !mCallbacksObj) return;
   sCallbackEnv->CallVoidMethod(mCallbacksObj, method_onScannerRegistered,
                                status, scannerId, UUID_PARAMS(app_uuid));
 }
@@ -1305,8 +1357,9 @@
 
 static void readClientPhyCb(uint8_t clientIf, RawAddress bda, uint8_t tx_phy,
                             uint8_t rx_phy, uint8_t status) {
+  std::shared_lock<std::shared_mutex> lock(callbacks_mutex);
   CallbackEnv sCallbackEnv(__func__);
-  if (!sCallbackEnv.valid()) return;
+  if (!sCallbackEnv.valid() || !mCallbacksObj) return;
 
   ScopedLocalRef<jstring> address(sCallbackEnv.get(),
                                   bdaddr2newjstr(sCallbackEnv.get(), &bda));
@@ -1451,8 +1504,9 @@
 }
 
 void set_scan_params_cmpl_cb(int client_if, uint8_t status) {
+  std::shared_lock<std::shared_mutex> lock(callbacks_mutex);
   CallbackEnv sCallbackEnv(__func__);
-  if (!sCallbackEnv.valid()) return;
+  if (!sCallbackEnv.valid() || !mCallbacksObj) return;
   sCallbackEnv->CallVoidMethod(mCallbacksObj, method_onScanParamSetupCompleted,
                                status, client_if);
 }
@@ -1468,8 +1522,9 @@
 
 void scan_filter_param_cb(uint8_t client_if, uint8_t avbl_space, uint8_t action,
                           uint8_t status) {
+  std::shared_lock<std::shared_mutex> lock(callbacks_mutex);
   CallbackEnv sCallbackEnv(__func__);
-  if (!sCallbackEnv.valid()) return;
+  if (!sCallbackEnv.valid() || !mCallbacksObj) return;
   sCallbackEnv->CallVoidMethod(mCallbacksObj,
                                method_onScanFilterParamsConfigured, action,
                                status, client_if, avbl_space);
@@ -1547,8 +1602,9 @@
 static void scan_filter_cfg_cb(uint8_t client_if, uint8_t filt_type,
                                uint8_t avbl_space, uint8_t action,
                                uint8_t status) {
+  std::shared_lock<std::shared_mutex> lock(callbacks_mutex);
   CallbackEnv sCallbackEnv(__func__);
-  if (!sCallbackEnv.valid()) return;
+  if (!sCallbackEnv.valid() || !mCallbacksObj) return;
   sCallbackEnv->CallVoidMethod(mCallbacksObj, method_onScanFilterConfig, action,
                                status, client_if, filt_type, avbl_space);
 }
@@ -1587,6 +1643,7 @@
   jfieldID nameFid = env->GetFieldID(entryClazz, "name", "Ljava/lang/String;");
   jfieldID companyFid = env->GetFieldID(entryClazz, "company", "I");
   jfieldID companyMaskFid = env->GetFieldID(entryClazz, "company_mask", "I");
+  jfieldID adTypeFid = env->GetFieldID(entryClazz, "ad_type", "I");
   jfieldID dataFid = env->GetFieldID(entryClazz, "data", "[B");
   jfieldID dataMaskFid = env->GetFieldID(entryClazz, "data_mask", "[B");
 
@@ -1657,6 +1714,8 @@
 
     curr.company_mask = env->GetIntField(current.get(), companyMaskFid);
 
+    curr.ad_type = env->GetByteField(current.get(), adTypeFid);
+
     ScopedLocalRef<jbyteArray> data(
         env, (jbyteArray)env->GetObjectField(current.get(), dataFid));
     if (data.get() != NULL) {
@@ -1694,8 +1753,9 @@
 }
 
 void scan_enable_cb(uint8_t client_if, uint8_t action, uint8_t status) {
+  std::shared_lock<std::shared_mutex> lock(callbacks_mutex);
   CallbackEnv sCallbackEnv(__func__);
-  if (!sCallbackEnv.valid()) return;
+  if (!sCallbackEnv.valid() || !mCallbacksObj) return;
   sCallbackEnv->CallVoidMethod(mCallbacksObj, method_onScanFilterEnableDisabled,
                                action, status, client_if);
 }
@@ -1726,8 +1786,9 @@
 }
 
 void batchscan_cfg_storage_cb(uint8_t client_if, uint8_t status) {
+  std::shared_lock<std::shared_mutex> lock(callbacks_mutex);
   CallbackEnv sCallbackEnv(__func__);
-  if (!sCallbackEnv.valid()) return;
+  if (!sCallbackEnv.valid() || !mCallbacksObj) return;
   sCallbackEnv->CallVoidMethod(
       mCallbacksObj, method_onBatchScanStorageConfigured, status, client_if);
 }
@@ -1743,8 +1804,9 @@
 }
 
 void batchscan_enable_cb(uint8_t client_if, uint8_t status) {
+  std::shared_lock<std::shared_mutex> lock(callbacks_mutex);
   CallbackEnv sCallbackEnv(__func__);
-  if (!sCallbackEnv.valid()) return;
+  if (!sCallbackEnv.valid() || !mCallbacksObj) return;
   sCallbackEnv->CallVoidMethod(mCallbacksObj, method_onBatchScanStartStopped,
                                0 /* unused */, status, client_if);
 }
@@ -1817,8 +1879,9 @@
 
 static void readServerPhyCb(uint8_t serverIf, RawAddress bda, uint8_t tx_phy,
                             uint8_t rx_phy, uint8_t status) {
+  std::shared_lock<std::shared_mutex> lock(callbacks_mutex);
   CallbackEnv sCallbackEnv(__func__);
-  if (!sCallbackEnv.valid()) return;
+  if (!sCallbackEnv.valid() || !mCallbacksObj) return;
 
   ScopedLocalRef<jstring> address(sCallbackEnv.get(),
                                   bdaddr2newjstr(sCallbackEnv.get(), &bda));
@@ -1961,7 +2024,6 @@
     if (env->GetArrayLength(val) < BTGATT_MAX_ATTR_LEN) {
       response.attr_value.len = (uint16_t)env->GetArrayLength(val);
     } else {
-      android_errorWriteLog(0x534e4554, "78787521");
       response.attr_value.len = BTGATT_MAX_ATTR_LEN;
     }
 
@@ -1997,7 +2059,7 @@
 }
 
 static void advertiseInitializeNative(JNIEnv* env, jobject object) {
-  std::shared_lock<std::shared_mutex> lock(callbacks_mutex);
+  std::unique_lock<std::shared_mutex> lock(callbacks_mutex);
   if (mAdvertiseCallbacksObj != NULL) {
     ALOGW("Cleaning up Advertise callback object");
     env->DeleteGlobalRef(mAdvertiseCallbacksObj);
@@ -2008,7 +2070,7 @@
 }
 
 static void advertiseCleanupNative(JNIEnv* env, jobject object) {
-  std::shared_lock<std::shared_mutex> lock(callbacks_mutex);
+  std::unique_lock<std::shared_mutex> lock(callbacks_mutex);
   if (mAdvertiseCallbacksObj != NULL) {
     env->DeleteGlobalRef(mAdvertiseCallbacksObj);
     mAdvertiseCallbacksObj = NULL;
@@ -2097,8 +2159,9 @@
 
 static void ble_advertising_set_started_cb(int reg_id, uint8_t advertiser_id,
                                            int8_t tx_power, uint8_t status) {
+  std::shared_lock<std::shared_mutex> lock(callbacks_mutex);
   CallbackEnv sCallbackEnv(__func__);
-  if (!sCallbackEnv.valid()) return;
+  if (!sCallbackEnv.valid() || !mAdvertiseCallbacksObj) return;
   sCallbackEnv->CallVoidMethod(mAdvertiseCallbacksObj,
                                method_onAdvertisingSetStarted, reg_id,
                                advertiser_id, tx_power, status);
@@ -2106,8 +2169,9 @@
 
 static void ble_advertising_set_timeout_cb(uint8_t advertiser_id,
                                            uint8_t status) {
+  std::shared_lock<std::shared_mutex> lock(callbacks_mutex);
   CallbackEnv sCallbackEnv(__func__);
-  if (!sCallbackEnv.valid()) return;
+  if (!sCallbackEnv.valid() || !mAdvertiseCallbacksObj) return;
   sCallbackEnv->CallVoidMethod(mAdvertiseCallbacksObj,
                                method_onAdvertisingEnabled, advertiser_id,
                                false, status);
@@ -2157,8 +2221,9 @@
 
 static void getOwnAddressCb(uint8_t advertiser_id, uint8_t address_type,
                             RawAddress address) {
+  std::shared_lock<std::shared_mutex> lock(callbacks_mutex);
   CallbackEnv sCallbackEnv(__func__);
-  if (!sCallbackEnv.valid()) return;
+  if (!sCallbackEnv.valid() || !mAdvertiseCallbacksObj) return;
 
   ScopedLocalRef<jstring> addr(sCallbackEnv.get(),
                                bdaddr2newjstr(sCallbackEnv.get(), &address));
@@ -2175,15 +2240,17 @@
 
 static void callJniCallback(jmethodID method, uint8_t advertiser_id,
                             uint8_t status) {
+  std::shared_lock<std::shared_mutex> lock(callbacks_mutex);
   CallbackEnv sCallbackEnv(__func__);
-  if (!sCallbackEnv.valid()) return;
+  if (!sCallbackEnv.valid() || !mAdvertiseCallbacksObj) return;
   sCallbackEnv->CallVoidMethod(mAdvertiseCallbacksObj, method, advertiser_id,
                                status);
 }
 
 static void enableSetCb(uint8_t advertiser_id, bool enable, uint8_t status) {
+  std::shared_lock<std::shared_mutex> lock(callbacks_mutex);
   CallbackEnv sCallbackEnv(__func__);
-  if (!sCallbackEnv.valid()) return;
+  if (!sCallbackEnv.valid() || !mAdvertiseCallbacksObj) return;
   sCallbackEnv->CallVoidMethod(mAdvertiseCallbacksObj,
                                method_onAdvertisingEnabled, advertiser_id,
                                enable, status);
@@ -2221,8 +2288,9 @@
 
 static void setAdvertisingParametersNativeCb(uint8_t advertiser_id,
                                              uint8_t status, int8_t tx_power) {
+  std::shared_lock<std::shared_mutex> lock(callbacks_mutex);
   CallbackEnv sCallbackEnv(__func__);
-  if (!sCallbackEnv.valid()) return;
+  if (!sCallbackEnv.valid() || !mAdvertiseCallbacksObj) return;
   sCallbackEnv->CallVoidMethod(mAdvertiseCallbacksObj,
                                method_onAdvertisingParametersUpdated,
                                advertiser_id, tx_power, status);
@@ -2265,8 +2333,9 @@
 
 static void enablePeriodicSetCb(uint8_t advertiser_id, bool enable,
                                 uint8_t status) {
+  std::shared_lock<std::shared_mutex> lock(callbacks_mutex);
   CallbackEnv sCallbackEnv(__func__);
-  if (!sCallbackEnv.valid()) return;
+  if (!sCallbackEnv.valid() || !mAdvertiseCallbacksObj) return;
   sCallbackEnv->CallVoidMethod(mAdvertiseCallbacksObj,
                                method_onPeriodicAdvertisingEnabled,
                                advertiser_id, enable, status);
@@ -2292,6 +2361,7 @@
 }
 
 static void periodicScanInitializeNative(JNIEnv* env, jobject object) {
+  std::unique_lock<std::shared_mutex> lock(callbacks_mutex);
   if (mPeriodicScanCallbacksObj != NULL) {
     ALOGW("Cleaning up periodic scan callback object");
     env->DeleteGlobalRef(mPeriodicScanCallbacksObj);
@@ -2302,6 +2372,7 @@
 }
 
 static void periodicScanCleanupNative(JNIEnv* env, jobject object) {
+  std::unique_lock<std::shared_mutex> lock(callbacks_mutex);
   if (mPeriodicScanCallbacksObj != NULL) {
     env->DeleteGlobalRef(mPeriodicScanCallbacksObj);
     mPeriodicScanCallbacksObj = NULL;
diff --git a/android/app/jni/com_android_bluetooth_hfp.cpp b/android/app/jni/com_android_bluetooth_hfp.cpp
index fffaf8c..61be15f 100644
--- a/android/app/jni/com_android_bluetooth_hfp.cpp
+++ b/android/app/jni/com_android_bluetooth_hfp.cpp
@@ -181,7 +181,6 @@
 
     char null_str[] = "";
     if (!sCallbackEnv.isValidUtf(number)) {
-      android_errorWriteLog(0x534e4554, "109838537");
       ALOGE("%s: number is not a valid UTF string.", __func__);
       number = null_str;
     }
@@ -325,7 +324,6 @@
 
     char null_str[] = "";
     if (!sCallbackEnv.isValidUtf(at_string)) {
-      android_errorWriteLog(0x534e4554, "109838537");
       ALOGE("%s: at_string is not a valid UTF string.", __func__);
       at_string = null_str;
     }
@@ -361,7 +359,6 @@
 
     char null_str[] = "";
     if (!sCallbackEnv.isValidUtf(at_string)) {
-      android_errorWriteLog(0x534e4554, "109838537");
       ALOGE("%s: at_string is not a valid UTF string.", __func__);
       at_string = null_str;
     }
diff --git a/android/app/jni/com_android_bluetooth_hfpclient.cpp b/android/app/jni/com_android_bluetooth_hfpclient.cpp
index c3e0c98..da4dff9 100644
--- a/android/app/jni/com_android_bluetooth_hfpclient.cpp
+++ b/android/app/jni/com_android_bluetooth_hfpclient.cpp
@@ -170,7 +170,6 @@
 
   const char null_str[] = "";
   if (!sCallbackEnv.isValidUtf(name)) {
-    android_errorWriteLog(0x534e4554, "109838537");
     ALOGE("%s: name is not a valid UTF string.", __func__);
     name = null_str;
   }
@@ -246,7 +245,6 @@
 
   const char null_str[] = "";
   if (!sCallbackEnv.isValidUtf(number)) {
-    android_errorWriteLog(0x534e4554, "109838537");
     ALOGE("%s: number is not a valid UTF string.", __func__);
     number = null_str;
   }
@@ -267,7 +265,6 @@
 
   const char null_str[] = "";
   if (!sCallbackEnv.isValidUtf(number)) {
-    android_errorWriteLog(0x534e4554, "109838537");
     ALOGE("%s: number is not a valid UTF string.", __func__);
     number = null_str;
   }
@@ -292,7 +289,6 @@
 
   const char null_str[] = "";
   if (!sCallbackEnv.isValidUtf(number)) {
-    android_errorWriteLog(0x534e4554, "109838537");
     ALOGE("%s: number is not a valid UTF string.", __func__);
     number = null_str;
   }
@@ -338,7 +334,6 @@
 
   const char null_str[] = "";
   if (!sCallbackEnv.isValidUtf(name)) {
-    android_errorWriteLog(0x534e4554, "109838537");
     ALOGE("%s: name is not a valid UTF string.", __func__);
     name = null_str;
   }
@@ -372,7 +367,6 @@
 
   const char null_str[] = "";
   if (!sCallbackEnv.isValidUtf(number)) {
-    android_errorWriteLog(0x534e4554, "109838537");
     ALOGE("%s: number is not a valid UTF string.", __func__);
     number = null_str;
   }
@@ -885,6 +879,37 @@
   return (status == BT_STATUS_SUCCESS) ? JNI_TRUE : JNI_FALSE;
 }
 
+static jboolean sendAndroidAtNative(JNIEnv* env, jobject object,
+                                    jbyteArray address, jstring arg_str) {
+  std::shared_lock<std::shared_mutex> lock(interface_mutex);
+  if (!sBluetoothHfpClientInterface) return JNI_FALSE;
+
+  jbyte* addr = env->GetByteArrayElements(address, NULL);
+  if (!addr) {
+    jniThrowIOException(env, EINVAL);
+    return JNI_FALSE;
+  }
+
+  const char* arg = NULL;
+  if (arg_str != NULL) {
+    arg = env->GetStringUTFChars(arg_str, NULL);
+  }
+
+  bt_status_t status = sBluetoothHfpClientInterface->send_android_at(
+      (const RawAddress*)addr, arg);
+
+  if (status != BT_STATUS_SUCCESS) {
+    ALOGE("FAILED to control volume, status: %d", status);
+  }
+
+  if (arg != NULL) {
+    env->ReleaseStringUTFChars(arg_str, arg);
+  }
+
+  env->ReleaseByteArrayElements(address, addr, 0);
+  return (status == BT_STATUS_SUCCESS) ? JNI_TRUE : JNI_FALSE;
+}
+
 static JNINativeMethod sMethods[] = {
     {"classInitNative", "()V", (void*)classInitNative},
     {"initializeNative", "()V", (void*)initializeNative},
@@ -909,6 +934,8 @@
     {"requestLastVoiceTagNumberNative", "([B)Z",
      (void*)requestLastVoiceTagNumberNative},
     {"sendATCmdNative", "([BIIILjava/lang/String;)Z", (void*)sendATCmdNative},
+    {"sendAndroidAtNative", "([BLjava/lang/String;)Z",
+     (void*)sendAndroidAtNative},
 };
 
 int register_com_android_bluetooth_hfpclient(JNIEnv* env) {
diff --git a/android/app/jni/com_android_bluetooth_le_audio.cpp b/android/app/jni/com_android_bluetooth_le_audio.cpp
index 3980d1c..58544df 100644
--- a/android/app/jni/com_android_bluetooth_le_audio.cpp
+++ b/android/app/jni/com_android_bluetooth_le_audio.cpp
@@ -532,6 +532,16 @@
   sLeAudioClientInterface->SetCcidInformation(ccid, contextType);
 }
 
+static void setInCallNative(JNIEnv* env, jobject object, jboolean inCall) {
+  std::shared_lock<std::shared_timed_mutex> lock(interface_mutex);
+  if (!sLeAudioClientInterface) {
+    LOG(ERROR) << __func__ << ": Failed to get the Bluetooth LeAudio Interface";
+    return;
+  }
+
+  sLeAudioClientInterface->SetInCall(inCall);
+}
+
 static JNINativeMethod sMethods[] = {
     {"classInitNative", "()V", (void*)classInitNative},
     {"initNative", "([Landroid/bluetooth/BluetoothLeAudioCodecConfig;)V",
@@ -547,6 +557,7 @@
      "BluetoothLeAudioCodecConfig;)V",
      (void*)setCodecConfigPreferenceNative},
     {"setCcidInformationNative", "(II)V", (void*)setCcidInformationNative},
+    {"setInCallNative", "(Z)V", (void*)setInCallNative},
 };
 
 /* Le Audio Broadcaster */
@@ -594,7 +605,7 @@
                             (const jbyte*)&kv_pair.first);
     offset += 1;
     // Value
-    env->SetByteArrayRegion(raw_metadata, offset, 1,
+    env->SetByteArrayRegion(raw_metadata, offset, kv_pair.second.size(),
                             (const jbyte*)kv_pair.second.data());
     offset += kv_pair.second.size();
   }
@@ -828,7 +839,19 @@
     return nullptr;
   }
 
-  ScopedLocalRef<jbyteArray> code(env, env->NewByteArray(sizeof(RawAddress)));
+  // Skip the leading null char bytes
+  int nativeCodeSize = 16;
+  int nativeCodeLeadingZeros = 0;
+  if (broadcast_metadata.broadcast_code) {
+    auto& nativeCode = broadcast_metadata.broadcast_code.value();
+    nativeCodeLeadingZeros =
+        std::find_if(nativeCode.cbegin(), nativeCode.cend(),
+                     [](int x) { return x != 0x00; }) -
+        nativeCode.cbegin();
+    nativeCodeSize = nativeCode.size() - nativeCodeLeadingZeros;
+  }
+
+  ScopedLocalRef<jbyteArray> code(env, env->NewByteArray(nativeCodeSize));
   if (!code.get()) {
     LOG(ERROR) << "Failed to create new jbyteArray for the broadcast code";
     return nullptr;
@@ -836,8 +859,10 @@
 
   if (broadcast_metadata.broadcast_code) {
     env->SetByteArrayRegion(
-        code.get(), 0, sizeof(RawAddress),
-        (jbyte*)broadcast_metadata.broadcast_code.value().data());
+        code.get(), 0, nativeCodeSize,
+        (const jbyte*)broadcast_metadata.broadcast_code->data() +
+            nativeCodeLeadingZeros);
+    CHECK(!env->ExceptionCheck());
   }
 
   return env->NewObject(
@@ -1130,9 +1155,19 @@
   std::shared_lock<std::shared_timed_mutex> lock(sBroadcasterInterfaceMutex);
   if (!sLeAudioBroadcasterInterface) return;
 
-  std::array<uint8_t, 16> code_array;
-  if (broadcast_code)
-    env->GetByteArrayRegion(broadcast_code, 0, 16, (jbyte*)code_array.data());
+  std::array<uint8_t, 16> code_array{0};
+  if (broadcast_code) {
+    jsize size = env->GetArrayLength(broadcast_code);
+    if (size > 16) {
+      ALOGE("%s: broadcast code to long", __func__);
+      return;
+    }
+
+    // Padding with zeros on LSB positions if code is shorter than 16 octets
+    env->GetByteArrayRegion(
+        broadcast_code, 0, size,
+        (jbyte*)code_array.data() + code_array.size() - size);
+  }
 
   jbyte* meta = env->GetByteArrayElements(metadata, nullptr);
   sLeAudioBroadcasterInterface->CreateBroadcast(
diff --git a/android/app/res/layout/bluetooth_map_settings.xml b/android/app/res/layout/bluetooth_map_settings.xml
index f256a02..0c7e3b3 100644
--- a/android/app/res/layout/bluetooth_map_settings.xml
+++ b/android/app/res/layout/bluetooth_map_settings.xml
@@ -17,7 +17,7 @@
 -->
 <LinearLayout xmlns:android="http://schemas.android.com/apk/res/android"
     xmlns:tools="http://schemas.android.com/tools"
-    android:id="@+id/bluetooth_map_settings_liniar_layout"
+    android:id="@+id/bluetooth_map_settings_linear_layout"
     android:layout_width="match_parent"
     android:layout_height="match_parent"
     android:orientation="vertical"
diff --git a/android/app/res/values-af/strings.xml b/android/app/res/values-af/strings.xml
index 6e5004c..91613ca 100644
--- a/android/app/res/values-af/strings.xml
+++ b/android/app/res/values-af/strings.xml
@@ -128,4 +128,10 @@
     <string name="a2dp_sink_mbs_label" msgid="6035366346569127155">"Bluetooth-oudio"</string>
     <string name="bluetooth_opp_file_limit_exceeded" msgid="6612109860149473930">"Lêers groter as 4 GB kan nie oorgedra word nie"</string>
     <string name="bluetooth_connect_action" msgid="2319449093046720209">"Koppel aan Bluetooth"</string>
+    <string name="bluetooth_enabled_apm_title" msgid="6914461147844949044">"Bluetooth is aan in vliegtuigmodus"</string>
+    <string name="bluetooth_enabled_apm_message" msgid="8409900562494838113">"As jy Bluetooth aangeskakel hou, sal jou foon onthou om dit aan te hou wanneer jy weer in vliegtuigmodus is"</string>
+    <string name="bluetooth_stays_on_title" msgid="39720820955212918">"Bluetooth bly aan"</string>
+    <string name="bluetooth_stays_on_message" msgid="7142453371222249965">"Jou foon onthou om Bluetooth aangeskakel te hou in vliegtuigmodus. Skakel Bluetooth af as jy nie wil hê dit moet aan bly nie."</string>
+    <string name="bluetooth_and_wifi_stays_on_title" msgid="5821932798860821244">"Wi-fi en Bluetooth bly aan"</string>
+    <string name="bluetooth_and_wifi_stays_on_message" msgid="2390749828997719812">"Jou foon onthou om wi‑fi en Bluetooth aan te hou in vliegtuigmodus. Skakel wi-fi en Bluetooth af as jy nie wil het hulle moet aan bly nie."</string>
 </resources>
diff --git a/android/app/res/values-am/strings.xml b/android/app/res/values-am/strings.xml
index 75c88d0..e75ee5d 100644
--- a/android/app/res/values-am/strings.xml
+++ b/android/app/res/values-am/strings.xml
@@ -128,4 +128,10 @@
     <string name="a2dp_sink_mbs_label" msgid="6035366346569127155">"የብሉቱዝ ኦዲዮ"</string>
     <string name="bluetooth_opp_file_limit_exceeded" msgid="6612109860149473930">"ከ4 ጊባ በላይ የሆኑ ፋይሎች ሊዛወሩ አይችሉም"</string>
     <string name="bluetooth_connect_action" msgid="2319449093046720209">"ከብሉቱዝ ጋር ተገናኝ"</string>
+    <string name="bluetooth_enabled_apm_title" msgid="6914461147844949044">"ብሉቱዝ በአውሮፕላን ሁነታ ላይ በርቷል"</string>
+    <string name="bluetooth_enabled_apm_message" msgid="8409900562494838113">"ብሉቱዝን አብርተው ካቆዩ በቀጣይ ጊዜ በአውሮፕላን ሁነታ ውስጥ ሲሆኑ ስልክዎ እሱን አብርቶ ማቆየቱን ያስታውሳል"</string>
+    <string name="bluetooth_stays_on_title" msgid="39720820955212918">"ብሉቱዝ በርቶ ይቆያል"</string>
+    <string name="bluetooth_stays_on_message" msgid="7142453371222249965">"ስልክዎ ብሉቱዝን በአውሮፕላን ሁነታ ውስጥ አብርቶ ማቆየትን ያስታውሳል። በርቶ እንዲቆይ ካልፈለጉ ብሉቱዝን ያጥፉት።"</string>
+    <string name="bluetooth_and_wifi_stays_on_title" msgid="5821932798860821244">"Wi-Fi እና ብሉቱዝ በርተው ይቆያሉ"</string>
+    <string name="bluetooth_and_wifi_stays_on_message" msgid="2390749828997719812">"ስልክዎ Wi-Fiን እና ብሉቱዝን በአውሮፕላን ሁነታ ውስጥ አብርቶ ማቆየትን ያስታውሳል። በርተው እንዲቆዩ ካልፈለጉ Wi-Fi እና ብሉቱዝን ያጥፏቸው።"</string>
 </resources>
diff --git a/android/app/res/values-ar/strings.xml b/android/app/res/values-ar/strings.xml
index 423bd41..f101cfa 100644
--- a/android/app/res/values-ar/strings.xml
+++ b/android/app/res/values-ar/strings.xml
@@ -128,4 +128,10 @@
     <string name="a2dp_sink_mbs_label" msgid="6035366346569127155">"بث صوتي عبر البلوتوث"</string>
     <string name="bluetooth_opp_file_limit_exceeded" msgid="6612109860149473930">"يتعذّر نقل الملفات التي يزيد حجمها عن 4 غيغابايت"</string>
     <string name="bluetooth_connect_action" msgid="2319449093046720209">"الاتصال ببلوتوث"</string>
+    <string name="bluetooth_enabled_apm_title" msgid="6914461147844949044">"تقنية البلوتوث مفعّلة في \"وضع الطيران\""</string>
+    <string name="bluetooth_enabled_apm_message" msgid="8409900562494838113">"إذا واصلت تفعيل تقنية البلوتوث، سيتذكر هاتفك إبقاءها مفعَّلة في المرة القادمة التي تفعِّل فيها \"وضع الطيران\"."</string>
+    <string name="bluetooth_stays_on_title" msgid="39720820955212918">"تظل تقنية البلوتوث مفعّلة"</string>
+    <string name="bluetooth_stays_on_message" msgid="7142453371222249965">"يتذكر هاتفك الاحتفاظ بتقنية البلوتوث مفعَّلة في \"وضع الطيران\". يمكنك إيقاف تقنية البلوتوث إذا لم تكن تريد مواصلة تفعيلها."</string>
+    <string name="bluetooth_and_wifi_stays_on_title" msgid="5821932798860821244">"‏تظل شبكة Wi‑Fi وتقنية البلوتوث مفعَّلتَين."</string>
+    <string name="bluetooth_and_wifi_stays_on_message" msgid="2390749828997719812">"‏يتذكر هاتفك الاحتفاظ بشبكة Wi‑Fi وتقنية البلوتوث مفعَّلتَين في \"وضع الطيران\". يمكنك إيقاف شبكة Wi‑Fi وتقنية البلوتوث إذا لم تكن تريد مواصلة تفعيلهما."</string>
 </resources>
diff --git a/android/app/res/values-as/strings.xml b/android/app/res/values-as/strings.xml
index 847be12..526c3f0 100644
--- a/android/app/res/values-as/strings.xml
+++ b/android/app/res/values-as/strings.xml
@@ -17,7 +17,7 @@
 <resources xmlns:android="http://schemas.android.com/apk/res/android"
     xmlns:xliff="urn:oasis:names:tc:xliff:document:1.2">
     <string name="permlab_bluetoothShareManager" msgid="5297865456717871041">"ডাউনল’ড মেনেজাৰ এক্সেছ কৰিব পাৰে।"</string>
-    <string name="permdesc_bluetoothShareManager" msgid="1588034776955941477">"এপটোক BluetoothShare মেনেজাৰ ব্যৱহাৰ কৰি ফাইল স্থানান্তৰ কৰিবলৈ অনুমতি দিয়ে।"</string>
+    <string name="permdesc_bluetoothShareManager" msgid="1588034776955941477">"এপ্‌টোক BluetoothShare মেনেজাৰ ব্যৱহাৰ কৰি ফাইল স্থানান্তৰ কৰিবলৈ অনুমতি দিয়ে।"</string>
     <string name="permlab_bluetoothAcceptlist" msgid="5785922051395856524">"ব্লুটুথ ডিভাইচ এক্সেছ কৰাৰ স্বীকৃতি দিয়ে।"</string>
     <string name="permdesc_bluetoothAcceptlist" msgid="259308920158011885">"এপ্‌টোক এটা ব্লুটুথ ডিভাইচ অস্থায়ীৰূপে স্বীকাৰ কৰাৰ অনুমতি দিয়ে যিয়ে ডিভাইচটোক ব্যৱহাৰকাৰীৰ নিশ্চিতিকৰণৰ অবিহনেই ইয়ালৈ ফাইল পঠিওৱাৰ অনুমতি দিয়ে।"</string>
     <string name="bt_share_picker_label" msgid="7464438494743777696">"ব্লুটুথ"</string>
@@ -86,7 +86,7 @@
     <string name="bt_sm_2_1_nosdcard" msgid="288667514869424273">"ফাইলটো ছেভ কৰিব পৰাকৈ ইউএছবি ষ্ট’ৰেজত পৰ্যাপ্ত খালী ঠাই নাই।"</string>
     <string name="bt_sm_2_1_default" msgid="5070195264206471656">"ফাইলটো ছেভ কৰিব পৰাকৈ এছডি কাৰ্ডখনত পৰ্যাপ্ত খালী ঠাই নাই।"</string>
     <string name="bt_sm_2_2" msgid="6200119660562110560">"ইমান খালী ঠাইৰ দৰকাৰ: <xliff:g id="SIZE">%1$s</xliff:g>"</string>
-    <string name="ErrorTooManyRequests" msgid="5049670841391761475">"বহুত বেছি অনুৰোধৰ ওপৰত প্ৰক্ৰিয়া চলি আছে৷ পিছত আকৌ চেষ্টা কৰক৷"</string>
+    <string name="ErrorTooManyRequests" msgid="5049670841391761475">"বহুত বেছি অনুৰোধৰ ওপৰত প্ৰক্ৰিয়া চলি আছে৷ পাছত আকৌ চেষ্টা কৰক৷"</string>
     <string name="status_pending" msgid="4781040740237733479">"ফাইলৰ স্থানান্তৰণ এতিয়ালৈকে আৰম্ভ হোৱা নাই।"</string>
     <string name="status_running" msgid="7419075903776657351">"ফাইলৰ স্থানান্তৰণ চলি আছে।"</string>
     <string name="status_success" msgid="7963589000098719541">"ফাইলৰ স্থানান্তৰণৰ কাৰ্য সফলতাৰে সম্পন্ন কৰা হ’ল।"</string>
@@ -128,4 +128,10 @@
     <string name="a2dp_sink_mbs_label" msgid="6035366346569127155">"ব্লুটুথ অডিঅ\'"</string>
     <string name="bluetooth_opp_file_limit_exceeded" msgid="6612109860149473930">"৪ জি. বি. তকৈ ডাঙৰ ফাইল স্থানান্তৰ কৰিব নোৱাৰি"</string>
     <string name="bluetooth_connect_action" msgid="2319449093046720209">"ব্লুটুথৰ সৈতে সংযোগ কৰক"</string>
+    <string name="bluetooth_enabled_apm_title" msgid="6914461147844949044">"এয়াৰপ্লেন ম’ডত ব্লুটুথ অন হৈ থাকিব"</string>
+    <string name="bluetooth_enabled_apm_message" msgid="8409900562494838113">"আপুনি যদি ব্লুটুথ অন কৰি ৰাখে, পৰৱৰ্তী সময়ত আপুনি এয়াৰপ্লেন ম’ড ব্যৱহাৰ কৰিলে আপোনাৰ ফ’নটোৱে এয়া অন কৰি ৰাখিবলৈ মনত ৰাখিব"</string>
+    <string name="bluetooth_stays_on_title" msgid="39720820955212918">"ব্লুটুথ অন হৈ থাকে"</string>
+    <string name="bluetooth_stays_on_message" msgid="7142453371222249965">"আপোনাৰ ফ’নটোৱে এয়াৰপ্লেন ম’ডত ব্লুটুথ অন ৰাখিবলৈ মনত ৰাখে। আপুনি যদি ব্লুটুথ অন হৈ থকাটো নিবিচাৰে, তেন্তে ইয়াক অফ কৰক।"</string>
+    <string name="bluetooth_and_wifi_stays_on_title" msgid="5821932798860821244">"ৱাই-ফাই আৰু ব্লুটুথ অন হৈ থাকে"</string>
+    <string name="bluetooth_and_wifi_stays_on_message" msgid="2390749828997719812">"আপোনাৰ ফ’নটোৱে এয়াৰপ্লেন ম’ডত ৱাই-ফাই আৰু ব্লুটুথ অন ৰাখিবলৈ মনত ৰাখে। আপুনি ৱাই-ফাই আৰু ব্লুটুথ অন হৈ থকাটো নিবিচাৰিলে সেইবোৰ অফ কৰক।"</string>
 </resources>
diff --git a/android/app/res/values-az/strings.xml b/android/app/res/values-az/strings.xml
index 9556992..0791d10 100644
--- a/android/app/res/values-az/strings.xml
+++ b/android/app/res/values-az/strings.xml
@@ -128,4 +128,10 @@
     <string name="a2dp_sink_mbs_label" msgid="6035366346569127155">"Bluetooth audio"</string>
     <string name="bluetooth_opp_file_limit_exceeded" msgid="6612109860149473930">"4GB-dən böyük olan faylları köçürmək mümkün deyil"</string>
     <string name="bluetooth_connect_action" msgid="2319449093046720209">"Bluetooth\'a qoşulun"</string>
+    <string name="bluetooth_enabled_apm_title" msgid="6914461147844949044">"Bluetooth təyyarə rejimində aktivdir"</string>
+    <string name="bluetooth_enabled_apm_message" msgid="8409900562494838113">"Bluetooth\'u aktiv saxlasanız, növbəti dəfə təyyarə rejimində olduqda telefonunuz onu aktiv saxlayacaq"</string>
+    <string name="bluetooth_stays_on_title" msgid="39720820955212918">"Bluetooth aktiv qalacaq"</string>
+    <string name="bluetooth_stays_on_message" msgid="7142453371222249965">"Telefonunuz təyyarə rejimində Bluetooth\'u aktiv saxlayacaq. Aktiv qalmasını istəmirsinizsə, Bluetooth\'u deaktiv edin."</string>
+    <string name="bluetooth_and_wifi_stays_on_title" msgid="5821932798860821244">"Wi-Fi və Bluetooth aktiv qalır"</string>
+    <string name="bluetooth_and_wifi_stays_on_message" msgid="2390749828997719812">"Telefonunuz təyyarə rejimində Wi‑Fi və Bluetooth\'u aktiv saxlayacaq. Aktiv qalmasını istəmirsinizsə, Wi-Fi və Bluetooth\'u deaktiv edin."</string>
 </resources>
diff --git a/android/app/res/values-b+sr+Latn/strings.xml b/android/app/res/values-b+sr+Latn/strings.xml
index 92f8423..2590f7d 100644
--- a/android/app/res/values-b+sr+Latn/strings.xml
+++ b/android/app/res/values-b+sr+Latn/strings.xml
@@ -128,4 +128,10 @@
     <string name="a2dp_sink_mbs_label" msgid="6035366346569127155">"Bluetooth audio"</string>
     <string name="bluetooth_opp_file_limit_exceeded" msgid="6612109860149473930">"Ne mogu da se prenose datoteke veće od 4 GB"</string>
     <string name="bluetooth_connect_action" msgid="2319449093046720209">"Poveži sa Bluetooth-om"</string>
+    <string name="bluetooth_enabled_apm_title" msgid="6914461147844949044">"Bluetooth je uključen u režimu rada u avionu"</string>
+    <string name="bluetooth_enabled_apm_message" msgid="8409900562494838113">"Ako odlučite da ne isključujete Bluetooth, telefon će zapamtiti da ga ne isključuje sledeći put kada budete u režimu rada u avionu"</string>
+    <string name="bluetooth_stays_on_title" msgid="39720820955212918">"Bluetooth se ne isključuje"</string>
+    <string name="bluetooth_stays_on_message" msgid="7142453371222249965">"Telefon pamti da ne treba da isključuje Bluetooth u režimu rada u avionu. Isključite Bluetooth ako ne želite da ostane uključen."</string>
+    <string name="bluetooth_and_wifi_stays_on_title" msgid="5821932798860821244">"WiFi i Bluetooth ostaju uključeni"</string>
+    <string name="bluetooth_and_wifi_stays_on_message" msgid="2390749828997719812">"Telefon pamti da ne treba da isključuje WiFi i Bluetooth u režimu rada u avionu. Isključite WiFi i Bluetooth ako ne želite da ostanu uključeni."</string>
 </resources>
diff --git a/android/app/res/values-be/strings.xml b/android/app/res/values-be/strings.xml
index ed72ab6..434757a 100644
--- a/android/app/res/values-be/strings.xml
+++ b/android/app/res/values-be/strings.xml
@@ -128,4 +128,10 @@
     <string name="a2dp_sink_mbs_label" msgid="6035366346569127155">"Bluetooth-аўдыя"</string>
     <string name="bluetooth_opp_file_limit_exceeded" msgid="6612109860149473930">"Немагчыма перадаць файлы, большыя за 4 ГБ"</string>
     <string name="bluetooth_connect_action" msgid="2319449093046720209">"Падключыцца да Bluetooth"</string>
+    <string name="bluetooth_enabled_apm_title" msgid="6914461147844949044">"У рэжыме палёту Bluetooth уключаны"</string>
+    <string name="bluetooth_enabled_apm_message" msgid="8409900562494838113">"Калі вы не выключыце Bluetooth, падчас наступнага пераходу ў рэжым палёту тэлефон будзе захоўваць яго ўключаным"</string>
+    <string name="bluetooth_stays_on_title" msgid="39720820955212918">"Bluetooth застаецца ўключаным"</string>
+    <string name="bluetooth_stays_on_message" msgid="7142453371222249965">"На тэлефоне ў рэжыме палёту Bluetooth застанецца ўключаным, але вы можаце выключыць яго."</string>
+    <string name="bluetooth_and_wifi_stays_on_title" msgid="5821932798860821244">"Wi-Fi і Bluetooth застаюцца ўключанымі"</string>
+    <string name="bluetooth_and_wifi_stays_on_message" msgid="2390749828997719812">"На тэлефоне ў рэжыме палёту сетка Wi‑Fi і Bluetooth будуць заставацца ўключанымі, але вы можаце выключыць іх."</string>
 </resources>
diff --git a/android/app/res/values-bg/strings.xml b/android/app/res/values-bg/strings.xml
index b2d6742..882c273 100644
--- a/android/app/res/values-bg/strings.xml
+++ b/android/app/res/values-bg/strings.xml
@@ -128,4 +128,10 @@
     <string name="a2dp_sink_mbs_label" msgid="6035366346569127155">"Аудио през Bluetooth"</string>
     <string name="bluetooth_opp_file_limit_exceeded" msgid="6612109860149473930">"Файловете с размер над 4 ГБ не могат да бъдат прехвърлени"</string>
     <string name="bluetooth_connect_action" msgid="2319449093046720209">"Свързване с Bluetooth"</string>
+    <string name="bluetooth_enabled_apm_title" msgid="6914461147844949044">"Функцията за Bluetooth е включена в самолетния режим"</string>
+    <string name="bluetooth_enabled_apm_message" msgid="8409900562494838113">"Ако не изключите функцията за Bluetooth, телефонът ви ще я остави активна следващия път, когато използвате самолетния режим"</string>
+    <string name="bluetooth_stays_on_title" msgid="39720820955212918">"Функцията за Bluetooth няма да се изключи"</string>
+    <string name="bluetooth_stays_on_message" msgid="7142453371222249965">"Функцията за Bluetooth ще бъде включена, докато телефонът ви е в самолетен режим. Ако не искате това, изключете я."</string>
+    <string name="bluetooth_and_wifi_stays_on_title" msgid="5821932798860821244">"Функциите за Wi-Fi и Bluetooth няма да бъдат изключени"</string>
+    <string name="bluetooth_and_wifi_stays_on_message" msgid="2390749828997719812">"Функциите за Wi‑Fi и Bluetooth ще бъдат включени, докато телефонът ви е в самолетен режим. Ако не искате това, изключете ги."</string>
 </resources>
diff --git a/android/app/res/values-bn/strings.xml b/android/app/res/values-bn/strings.xml
index c85dbf3..7e35d1e 100644
--- a/android/app/res/values-bn/strings.xml
+++ b/android/app/res/values-bn/strings.xml
@@ -128,4 +128,10 @@
     <string name="a2dp_sink_mbs_label" msgid="6035366346569127155">"ব্লুটুথ অডিও"</string>
     <string name="bluetooth_opp_file_limit_exceeded" msgid="6612109860149473930">"৪GB থেকে বড় ফটো ট্রান্সফার করা যাবে না"</string>
     <string name="bluetooth_connect_action" msgid="2319449093046720209">"ব্লুটুথের সাথে কানেক্ট করুন"</string>
+    <string name="bluetooth_enabled_apm_title" msgid="6914461147844949044">"\'বিমান মোড\'-এ থাকাকালীন ব্লুটুথ চালু থাকে"</string>
+    <string name="bluetooth_enabled_apm_message" msgid="8409900562494838113">"আপনি ওয়াই-ফাই চালু রাখলে, আপনি এরপর \'বিমান মোডে\' থাকলে আপনার ফোন এটি চালু রাখবে"</string>
+    <string name="bluetooth_stays_on_title" msgid="39720820955212918">"ব্লুটুথ চালু থাকে"</string>
+    <string name="bluetooth_stays_on_message" msgid="7142453371222249965">"\'বিমান মোড\'-এ থাকাকালীন আপনার ফোন ব্লুটুথ চালু রাখে। আপনি ব্লুটুথ চালু না রাখতে চাইলে এটি বন্ধ করুন।"</string>
+    <string name="bluetooth_and_wifi_stays_on_title" msgid="5821932798860821244">"ওয়াই-ফাই ও ব্লুটুথ চালু থাকে"</string>
+    <string name="bluetooth_and_wifi_stays_on_message" msgid="2390749828997719812">"\'বিমান মোড\'-এ থাকাকালীন আপনার ফোন ওয়াই-ফাই ও ব্লুটুথ চালু রাখে। আপনি যদি ওয়াই-ফাই এবং ব্লুটুথ চালু রাখতে না চান, সেগুলি বন্ধ করে দিন।"</string>
 </resources>
diff --git a/android/app/res/values-bs/strings.xml b/android/app/res/values-bs/strings.xml
index c4fadb0..8c57a62 100644
--- a/android/app/res/values-bs/strings.xml
+++ b/android/app/res/values-bs/strings.xml
@@ -128,4 +128,10 @@
     <string name="a2dp_sink_mbs_label" msgid="6035366346569127155">"Bluetooth Audio"</string>
     <string name="bluetooth_opp_file_limit_exceeded" msgid="6612109860149473930">"Nije moguće prenijeti fajlove veće od 4 GB"</string>
     <string name="bluetooth_connect_action" msgid="2319449093046720209">"Poveži se na Bluetooth"</string>
+    <string name="bluetooth_enabled_apm_title" msgid="6914461147844949044">"Bluetooth je uključen u načinu rada u avionu"</string>
+    <string name="bluetooth_enabled_apm_message" msgid="8409900562494838113">"Ako ostavite Bluetooth uključenim, telefon će zapamtiti da ga ostavi uključenog sljedeći put kada budete u načinu rada u avionu"</string>
+    <string name="bluetooth_stays_on_title" msgid="39720820955212918">"Bluetooth ostaje uključen"</string>
+    <string name="bluetooth_stays_on_message" msgid="7142453371222249965">"Telefon pamti da Bluetooth treba biti uključen u načinu rada u avionu. Isključite Bluetooth ako ne želite da ostane uključen."</string>
+    <string name="bluetooth_and_wifi_stays_on_title" msgid="5821932798860821244">"WiFi i Bluetooth ostaju uključeni"</string>
+    <string name="bluetooth_and_wifi_stays_on_message" msgid="2390749828997719812">"Telefon pamti da WiFi i Bluetooth trebaju biti uključeni u načinu rada u avionu. Isključite WiFi i Bluetooth ako ne želite da ostanu uključeni."</string>
 </resources>
diff --git a/android/app/res/values-ca/strings.xml b/android/app/res/values-ca/strings.xml
index b5ec842..46e1afa 100644
--- a/android/app/res/values-ca/strings.xml
+++ b/android/app/res/values-ca/strings.xml
@@ -128,4 +128,10 @@
     <string name="a2dp_sink_mbs_label" msgid="6035366346569127155">"Àudio per Bluetooth"</string>
     <string name="bluetooth_opp_file_limit_exceeded" msgid="6612109860149473930">"No es poden transferir fitxers més grans de 4 GB"</string>
     <string name="bluetooth_connect_action" msgid="2319449093046720209">"Connecta el Bluetooth"</string>
+    <string name="bluetooth_enabled_apm_title" msgid="6914461147844949044">"El Bluetooth està activat en mode d\'avió"</string>
+    <string name="bluetooth_enabled_apm_message" msgid="8409900562494838113">"Si tens activat el Bluetooth, el telèfon recordarà mantenir-lo així la pròxima vegada que utilitzis el mode d\'avió"</string>
+    <string name="bluetooth_stays_on_title" msgid="39720820955212918">"El Bluetooth es mantindrà activat"</string>
+    <string name="bluetooth_stays_on_message" msgid="7142453371222249965">"El telèfon recorda mantenir el Bluetooth activat en mode d\'avió. Desactiva el Bluetooth si no vols que es quedi activat."</string>
+    <string name="bluetooth_and_wifi_stays_on_title" msgid="5821932798860821244">"La Wi‑Fi i el Bluetooth es mantenen activats"</string>
+    <string name="bluetooth_and_wifi_stays_on_message" msgid="2390749828997719812">"El telèfon recorda mantenir la Wi‑Fi i el Bluetooth activats en mode d\'avió. Desactiva la Wi‑Fi i el Bluetooth si no vols que es quedin activats."</string>
 </resources>
diff --git a/android/app/res/values-cs/strings.xml b/android/app/res/values-cs/strings.xml
index 5352a25..33f3bfc 100644
--- a/android/app/res/values-cs/strings.xml
+++ b/android/app/res/values-cs/strings.xml
@@ -128,4 +128,10 @@
     <string name="a2dp_sink_mbs_label" msgid="6035366346569127155">"Bluetooth Audio"</string>
     <string name="bluetooth_opp_file_limit_exceeded" msgid="6612109860149473930">"Soubory větší než 4 GB nelze přenést"</string>
     <string name="bluetooth_connect_action" msgid="2319449093046720209">"Připojit k Bluetooth"</string>
+    <string name="bluetooth_enabled_apm_title" msgid="6914461147844949044">"Zapnutý Bluetooth v režimu Letadlo"</string>
+    <string name="bluetooth_enabled_apm_message" msgid="8409900562494838113">"Pokud Bluetooth necháte zapnutý, telefon si zapamatuje, že ho má příště v režimu Letadlo ponechat zapnutý"</string>
+    <string name="bluetooth_stays_on_title" msgid="39720820955212918">"Bluetooth zůstane zapnutý"</string>
+    <string name="bluetooth_stays_on_message" msgid="7142453371222249965">"Telefon si pamatuje, že má v režimu Letadlo ponechat zapnutý Bluetooth. Pokud nechcete, aby Bluetooth zůstal zapnutý, vypněte ho."</string>
+    <string name="bluetooth_and_wifi_stays_on_title" msgid="5821932798860821244">"Wi-Fi a Bluetooth zůstávají zapnuté"</string>
+    <string name="bluetooth_and_wifi_stays_on_message" msgid="2390749828997719812">"Telefon si pamatuje, že má v režimu Letadlo ponechat zapnutou Wi-Fi a Bluetooth. Pokud nechcete, aby Wi-Fi a Bluetooth zůstaly zapnuté, vypněte je."</string>
 </resources>
diff --git a/android/app/res/values-da/strings.xml b/android/app/res/values-da/strings.xml
index 15881ed..b3ac49d 100644
--- a/android/app/res/values-da/strings.xml
+++ b/android/app/res/values-da/strings.xml
@@ -128,4 +128,10 @@
     <string name="a2dp_sink_mbs_label" msgid="6035366346569127155">"Bluetooth-lyd"</string>
     <string name="bluetooth_opp_file_limit_exceeded" msgid="6612109860149473930">"File, der er større end 4 GB, kan ikke overføres"</string>
     <string name="bluetooth_connect_action" msgid="2319449093046720209">"Opret forbindelse til Bluetooth"</string>
+    <string name="bluetooth_enabled_apm_title" msgid="6914461147844949044">"Bluetooth er aktiveret i flytilstand"</string>
+    <string name="bluetooth_enabled_apm_message" msgid="8409900562494838113">"Hvis du holder Bluetooth aktiveret, sørger din telefon for, at Bluetooth forbliver aktiveret, næste gang du sætter den til flytilstand"</string>
+    <string name="bluetooth_stays_on_title" msgid="39720820955212918">"Bluetooth forbliver aktiveret"</string>
+    <string name="bluetooth_stays_on_message" msgid="7142453371222249965">"Din telefon beholder Bluetooth aktiveret i flytilstand. Deaktiver Bluetooth, hvis du ikke vil have, at det forbliver aktiveret."</string>
+    <string name="bluetooth_and_wifi_stays_on_title" msgid="5821932798860821244">"Wi-Fi og Bluetooth forbliver aktiveret"</string>
+    <string name="bluetooth_and_wifi_stays_on_message" msgid="2390749828997719812">"Din telefon husker at holde Wi-Fi og Bluetooth aktiveret i flytilstand. Deaktiver Wi-Fi og Bluetooth, hvis du ikke vil have, at de forbliver aktiveret."</string>
 </resources>
diff --git a/android/app/res/values-de/strings.xml b/android/app/res/values-de/strings.xml
index f432967..82283c3 100644
--- a/android/app/res/values-de/strings.xml
+++ b/android/app/res/values-de/strings.xml
@@ -128,4 +128,10 @@
     <string name="a2dp_sink_mbs_label" msgid="6035366346569127155">"Bluetooth-Audio"</string>
     <string name="bluetooth_opp_file_limit_exceeded" msgid="6612109860149473930">"Dateien mit mehr als 4 GB können nicht übertragen werden"</string>
     <string name="bluetooth_connect_action" msgid="2319449093046720209">"Mit Bluetooth verbinden"</string>
+    <string name="bluetooth_enabled_apm_title" msgid="6914461147844949044">"Bluetooth im Flugmodus eingeschaltet"</string>
+    <string name="bluetooth_enabled_apm_message" msgid="8409900562494838113">"Wenn du Bluetooth nicht ausschaltest, bleibt es eingeschaltet, wenn du das nächste Mal in den Flugmodus wechselst"</string>
+    <string name="bluetooth_stays_on_title" msgid="39720820955212918">"Bluetooth bleibt aktiviert"</string>
+    <string name="bluetooth_stays_on_message" msgid="7142453371222249965">"Auf deinem Smartphone bleibt Bluetooth im Flugmodus eingeschaltet. Schalte Bluetooth aus, wenn du das nicht möchtest."</string>
+    <string name="bluetooth_and_wifi_stays_on_title" msgid="5821932798860821244">"WLAN und Bluetooth bleiben eingeschaltet"</string>
+    <string name="bluetooth_and_wifi_stays_on_message" msgid="2390749828997719812">"Auf deinem Smartphone bleiben WLAN und Bluetooth im Flugmodus eingeschaltet. Schalte sie aus, wenn du das nicht möchtest."</string>
 </resources>
diff --git a/android/app/res/values-el/strings.xml b/android/app/res/values-el/strings.xml
index 1b6ef58..6afca1f 100644
--- a/android/app/res/values-el/strings.xml
+++ b/android/app/res/values-el/strings.xml
@@ -128,4 +128,10 @@
     <string name="a2dp_sink_mbs_label" msgid="6035366346569127155">"Ήχος Bluetooth"</string>
     <string name="bluetooth_opp_file_limit_exceeded" msgid="6612109860149473930">"Δεν είναι δυνατή η μεταφορά αρχείων που ξεπερνούν τα 4 GB"</string>
     <string name="bluetooth_connect_action" msgid="2319449093046720209">"Σύνδεση σε Bluetooth"</string>
+    <string name="bluetooth_enabled_apm_title" msgid="6914461147844949044">"Bluetooth ενεργοποιημένο σε λειτουργία πτήσης"</string>
+    <string name="bluetooth_enabled_apm_message" msgid="8409900562494838113">"Αν διατηρήσετε το Bluetooth ενεργοποιημένο, το τηλέφωνό σας θα θυμάται να το διατηρήσει ενεργοποιημένο την επόμενη φορά που θα βρεθεί σε λειτουργία πτήσης"</string>
+    <string name="bluetooth_stays_on_title" msgid="39720820955212918">"Το Bluetooth παραμένει ενεργό"</string>
+    <string name="bluetooth_stays_on_message" msgid="7142453371222249965">"Το τηλέφωνο θυμάται να διατηρεί ενεργοποιημένο το Bluetooth σε λειτουργία πτήσης. Απενεργοποιήστε το Bluetooth αν δεν θέλετε να παραμένει ενεργοποιημένο."</string>
+    <string name="bluetooth_and_wifi_stays_on_title" msgid="5821932798860821244">"Το Wi-Fi και το Bluetooth παραμένουν ενεργοποιημένα"</string>
+    <string name="bluetooth_and_wifi_stays_on_message" msgid="2390749828997719812">"Το τηλέφωνο θυμάται να διατηρεί ενεργοποιημένο το Wi‑Fi και το Bluetooth σε λειτουργία πτήσης. Απενεργοποιήστε το Wi-Fi και το Bluetooth αν δεν θέλετε να παραμένουν ενεργοποιημένα."</string>
 </resources>
diff --git a/android/app/res/values-en-rAU/strings.xml b/android/app/res/values-en-rAU/strings.xml
index 266667f..724d1e6 100644
--- a/android/app/res/values-en-rAU/strings.xml
+++ b/android/app/res/values-en-rAU/strings.xml
@@ -128,4 +128,10 @@
     <string name="a2dp_sink_mbs_label" msgid="6035366346569127155">"Bluetooth audio"</string>
     <string name="bluetooth_opp_file_limit_exceeded" msgid="6612109860149473930">"Files bigger than 4 GB cannot be transferred"</string>
     <string name="bluetooth_connect_action" msgid="2319449093046720209">"Connect to Bluetooth"</string>
+    <string name="bluetooth_enabled_apm_title" msgid="6914461147844949044">"Bluetooth on in aeroplane mode"</string>
+    <string name="bluetooth_enabled_apm_message" msgid="8409900562494838113">"If you keep Bluetooth on, your phone will remember to keep it on the next time that you\'re in aeroplane mode"</string>
+    <string name="bluetooth_stays_on_title" msgid="39720820955212918">"Bluetooth stays on"</string>
+    <string name="bluetooth_stays_on_message" msgid="7142453371222249965">"Your phone remembers to keep Bluetooth on in aeroplane mode. Turn off Bluetooth if you don\'t want it to stay on."</string>
+    <string name="bluetooth_and_wifi_stays_on_title" msgid="5821932798860821244">"Wi-Fi and Bluetooth stay on"</string>
+    <string name="bluetooth_and_wifi_stays_on_message" msgid="2390749828997719812">"Your phone remembers to keep Wi-Fi and Bluetooth on in aeroplane mode. Turn off Wi-Fi and Bluetooth if you don\'t want them to stay on."</string>
 </resources>
diff --git a/android/app/res/values-en-rCA/strings.xml b/android/app/res/values-en-rCA/strings.xml
index 89e7e55..c812cee 100644
--- a/android/app/res/values-en-rCA/strings.xml
+++ b/android/app/res/values-en-rCA/strings.xml
@@ -17,8 +17,8 @@
 <resources xmlns:android="http://schemas.android.com/apk/res/android"
     xmlns:xliff="urn:oasis:names:tc:xliff:document:1.2">
     <string name="permlab_bluetoothShareManager" msgid="5297865456717871041">"Access download manager."</string>
-    <string name="permdesc_bluetoothShareManager" msgid="1588034776955941477">"Allows the application to access the Bluetooth Share manager and to use it to transfer files."</string>
-    <string name="permlab_bluetoothAcceptlist" msgid="5785922051395856524">"Acceptlist Bluetooth device access."</string>
+    <string name="permdesc_bluetoothShareManager" msgid="1588034776955941477">"Allows the app to access the BluetoothShare manager and use it to transfer files."</string>
+    <string name="permlab_bluetoothAcceptlist" msgid="5785922051395856524">"Acceptlist bluetooth device access."</string>
     <string name="permdesc_bluetoothAcceptlist" msgid="259308920158011885">"Allows the app to temporarily acceptlist a Bluetooth device, allowing that device to send files to this device without user confirmation."</string>
     <string name="bt_share_picker_label" msgid="7464438494743777696">"Bluetooth"</string>
     <string name="unknown_device" msgid="2317679521750821654">"Unknown device"</string>
@@ -87,13 +87,13 @@
     <string name="bt_sm_2_1_default" msgid="5070195264206471656">"There isn\'t enough space on the SD card to save the file."</string>
     <string name="bt_sm_2_2" msgid="6200119660562110560">"Space needed: <xliff:g id="SIZE">%1$s</xliff:g>"</string>
     <string name="ErrorTooManyRequests" msgid="5049670841391761475">"Too many requests are being processed. Try again later."</string>
-    <string name="status_pending" msgid="4781040740237733479">"File transfer not started yet"</string>
+    <string name="status_pending" msgid="4781040740237733479">"File transfer not started yet."</string>
     <string name="status_running" msgid="7419075903776657351">"File transfer is ongoing."</string>
     <string name="status_success" msgid="7963589000098719541">"File transfer completed successfully."</string>
     <string name="status_not_accept" msgid="1165798802740579658">"Content isn\'t supported."</string>
     <string name="status_forbidden" msgid="4017060451358837245">"Transfer forbidden by target device."</string>
-    <string name="status_canceled" msgid="8441679418717978515">"Transfer cancelled by user."</string>
-    <string name="status_file_error" msgid="5379018888714679311">"Storage issue"</string>
+    <string name="status_canceled" msgid="8441679418717978515">"Transfer canceled by user."</string>
+    <string name="status_file_error" msgid="5379018888714679311">"Storage issue."</string>
     <string name="status_no_sd_card_nosdcard" msgid="6445646484924125975">"No USB storage."</string>
     <string name="status_no_sd_card_default" msgid="8878262565692541241">"No SD card. Insert an SD card to save transferred files."</string>
     <string name="status_connection_error" msgid="8253709700568062220">"Connection unsuccessful."</string>
@@ -115,17 +115,23 @@
     <string name="transfer_menu_open" msgid="5193344638774400131">"Open"</string>
     <string name="transfer_menu_clear" msgid="7213491281898188730">"Clear from list"</string>
     <string name="transfer_clear_dlg_title" msgid="128904516163257225">"Clear"</string>
-    <string name="bluetooth_a2dp_sink_queue_name" msgid="7521243473328258997">"Now playing"</string>
+    <string name="bluetooth_a2dp_sink_queue_name" msgid="7521243473328258997">"Now Playing"</string>
     <string name="bluetooth_map_settings_save" msgid="8309113239113961550">"Save"</string>
     <string name="bluetooth_map_settings_cancel" msgid="3374494364625947793">"Cancel"</string>
-    <string name="bluetooth_map_settings_intro" msgid="4748160773998753325">"Select the accounts that you want to share through Bluetooth. You still have to accept any access to the accounts when connecting."</string>
+    <string name="bluetooth_map_settings_intro" msgid="4748160773998753325">"Select the accounts you want to share through Bluetooth. You still have to accept any access to the accounts when connecting."</string>
     <string name="bluetooth_map_settings_count" msgid="183013143617807702">"Slots left:"</string>
-    <string name="bluetooth_map_settings_app_icon" msgid="3501432663809664982">"Application icon"</string>
-    <string name="bluetooth_map_settings_title" msgid="4226030082708590023">"Bluetooth message sharing settings"</string>
+    <string name="bluetooth_map_settings_app_icon" msgid="3501432663809664982">"Application Icon"</string>
+    <string name="bluetooth_map_settings_title" msgid="4226030082708590023">"Bluetooth Message Sharing Settings"</string>
     <string name="bluetooth_map_settings_no_account_slots_left" msgid="755024228476065757">"Cannot select account. 0 slots left"</string>
     <string name="bluetooth_connected" msgid="5687474377090799447">"Bluetooth audio connected"</string>
     <string name="bluetooth_disconnected" msgid="6841396291728343534">"Bluetooth audio disconnected"</string>
-    <string name="a2dp_sink_mbs_label" msgid="6035366346569127155">"Bluetooth audio"</string>
-    <string name="bluetooth_opp_file_limit_exceeded" msgid="6612109860149473930">"Files bigger than 4 GB cannot be transferred"</string>
+    <string name="a2dp_sink_mbs_label" msgid="6035366346569127155">"Bluetooth Audio"</string>
+    <string name="bluetooth_opp_file_limit_exceeded" msgid="6612109860149473930">"Files bigger than 4GB cannot be transferred"</string>
     <string name="bluetooth_connect_action" msgid="2319449093046720209">"Connect to Bluetooth"</string>
+    <string name="bluetooth_enabled_apm_title" msgid="6914461147844949044">"Bluetooth on in Airplane mode"</string>
+    <string name="bluetooth_enabled_apm_message" msgid="8409900562494838113">"If you keep Bluetooth on, your phone will remember to keep it on the next time you\'re in Airplane mode"</string>
+    <string name="bluetooth_stays_on_title" msgid="39720820955212918">"Bluetooth stays on"</string>
+    <string name="bluetooth_stays_on_message" msgid="7142453371222249965">"Your phone remembers to keep Bluetooth on in Airplane mode. Turn off Bluetooth if you don\'t want it to stay on."</string>
+    <string name="bluetooth_and_wifi_stays_on_title" msgid="5821932798860821244">"Wi-Fi and Bluetooth stay on"</string>
+    <string name="bluetooth_and_wifi_stays_on_message" msgid="2390749828997719812">"Your phone remembers to keep Wi-Fi and Bluetooth on in Airplane mode. Turn off Wi-Fi and Bluetooth if you don\'t want them to stay on."</string>
 </resources>
diff --git a/android/app/res/values-en-rCA/strings_pbap.xml b/android/app/res/values-en-rCA/strings_pbap.xml
index c7b8dc8..eb205ce 100644
--- a/android/app/res/values-en-rCA/strings_pbap.xml
+++ b/android/app/res/values-en-rCA/strings_pbap.xml
@@ -4,11 +4,11 @@
     <string name="pbap_session_key_dialog_title" msgid="5103201901254778256">"Type session key for %1$s"</string>
     <string name="pbap_session_key_dialog_header" msgid="5073165544713355581">"Bluetooth session key required"</string>
     <string name="pbap_acceptance_timeout_message" msgid="3071798915563151284">"There was time out to accept connection with %1$s"</string>
-    <string name="pbap_authentication_timeout_message" msgid="2089914949828656737">"There was a timeout to input session key with %1$s"</string>
+    <string name="pbap_authentication_timeout_message" msgid="2089914949828656737">"There was time out to input session key with %1$s"</string>
     <string name="auth_notif_ticker" msgid="7344125635314034621">"Obex authentication request"</string>
-    <string name="auth_notif_title" msgid="6639277119990416473">"Session key"</string>
+    <string name="auth_notif_title" msgid="6639277119990416473">"Session Key"</string>
     <string name="auth_notif_message" msgid="7044369885874418693">"Type session key for %1$s"</string>
-    <string name="defaultname" msgid="6200530814398805541">"Car Kit"</string>
+    <string name="defaultname" msgid="6200530814398805541">"Carkit"</string>
     <string name="unknownName" msgid="6755061296103155293">"Unknown name"</string>
     <string name="localPhoneName" msgid="9119254982537191352">"My name"</string>
     <string name="defaultnumber" msgid="5348816189286607406">"000000"</string>
diff --git a/android/app/res/values-en-rCA/strings_sap.xml b/android/app/res/values-en-rCA/strings_sap.xml
index 29288d1..0656641 100644
--- a/android/app/res/values-en-rCA/strings_sap.xml
+++ b/android/app/res/values-en-rCA/strings_sap.xml
@@ -2,7 +2,7 @@
 <resources xmlns:android="http://schemas.android.com/apk/res/android"
     xmlns:xliff="urn:oasis:names:tc:xliff:document:1.2">
     <string name="bluetooth_sap_notif_title" msgid="7854456947435963346">"Bluetooth SIM access"</string>
-    <string name="bluetooth_sap_notif_ticker" msgid="7295825445933648498">"Bluetooth SIM access"</string>
+    <string name="bluetooth_sap_notif_ticker" msgid="7295825445933648498">"Bluetooth SIM Access"</string>
     <string name="bluetooth_sap_notif_message" msgid="1004269289836361678">"Request client to disconnect?"</string>
     <string name="bluetooth_sap_notif_disconnecting" msgid="6041257463440623400">"Waiting for client to disconnect"</string>
     <string name="bluetooth_sap_notif_disconnect_button" msgid="3059012556387692616">"Disconnect"</string>
diff --git a/android/app/res/values-en-rGB/strings.xml b/android/app/res/values-en-rGB/strings.xml
index 266667f..724d1e6 100644
--- a/android/app/res/values-en-rGB/strings.xml
+++ b/android/app/res/values-en-rGB/strings.xml
@@ -128,4 +128,10 @@
     <string name="a2dp_sink_mbs_label" msgid="6035366346569127155">"Bluetooth audio"</string>
     <string name="bluetooth_opp_file_limit_exceeded" msgid="6612109860149473930">"Files bigger than 4 GB cannot be transferred"</string>
     <string name="bluetooth_connect_action" msgid="2319449093046720209">"Connect to Bluetooth"</string>
+    <string name="bluetooth_enabled_apm_title" msgid="6914461147844949044">"Bluetooth on in aeroplane mode"</string>
+    <string name="bluetooth_enabled_apm_message" msgid="8409900562494838113">"If you keep Bluetooth on, your phone will remember to keep it on the next time that you\'re in aeroplane mode"</string>
+    <string name="bluetooth_stays_on_title" msgid="39720820955212918">"Bluetooth stays on"</string>
+    <string name="bluetooth_stays_on_message" msgid="7142453371222249965">"Your phone remembers to keep Bluetooth on in aeroplane mode. Turn off Bluetooth if you don\'t want it to stay on."</string>
+    <string name="bluetooth_and_wifi_stays_on_title" msgid="5821932798860821244">"Wi-Fi and Bluetooth stay on"</string>
+    <string name="bluetooth_and_wifi_stays_on_message" msgid="2390749828997719812">"Your phone remembers to keep Wi-Fi and Bluetooth on in aeroplane mode. Turn off Wi-Fi and Bluetooth if you don\'t want them to stay on."</string>
 </resources>
diff --git a/android/app/res/values-en-rIN/strings.xml b/android/app/res/values-en-rIN/strings.xml
index 266667f..724d1e6 100644
--- a/android/app/res/values-en-rIN/strings.xml
+++ b/android/app/res/values-en-rIN/strings.xml
@@ -128,4 +128,10 @@
     <string name="a2dp_sink_mbs_label" msgid="6035366346569127155">"Bluetooth audio"</string>
     <string name="bluetooth_opp_file_limit_exceeded" msgid="6612109860149473930">"Files bigger than 4 GB cannot be transferred"</string>
     <string name="bluetooth_connect_action" msgid="2319449093046720209">"Connect to Bluetooth"</string>
+    <string name="bluetooth_enabled_apm_title" msgid="6914461147844949044">"Bluetooth on in aeroplane mode"</string>
+    <string name="bluetooth_enabled_apm_message" msgid="8409900562494838113">"If you keep Bluetooth on, your phone will remember to keep it on the next time that you\'re in aeroplane mode"</string>
+    <string name="bluetooth_stays_on_title" msgid="39720820955212918">"Bluetooth stays on"</string>
+    <string name="bluetooth_stays_on_message" msgid="7142453371222249965">"Your phone remembers to keep Bluetooth on in aeroplane mode. Turn off Bluetooth if you don\'t want it to stay on."</string>
+    <string name="bluetooth_and_wifi_stays_on_title" msgid="5821932798860821244">"Wi-Fi and Bluetooth stay on"</string>
+    <string name="bluetooth_and_wifi_stays_on_message" msgid="2390749828997719812">"Your phone remembers to keep Wi-Fi and Bluetooth on in aeroplane mode. Turn off Wi-Fi and Bluetooth if you don\'t want them to stay on."</string>
 </resources>
diff --git a/android/app/res/values-en-rXC/strings.xml b/android/app/res/values-en-rXC/strings.xml
index a47fdcd..d925306 100644
--- a/android/app/res/values-en-rXC/strings.xml
+++ b/android/app/res/values-en-rXC/strings.xml
@@ -128,4 +128,10 @@
     <string name="a2dp_sink_mbs_label" msgid="6035366346569127155">"‎‏‎‎‎‎‎‏‎‏‏‏‎‎‎‎‎‏‎‎‎‎‎‏‏‏‎‏‏‏‏‏‏‏‎‏‎‎‏‏‏‏‎‎‎‎‎‏‏‏‏‎‏‏‎‏‏‎‏‏‎‏‏‏‎‎‏‎‏‎‎‎‏‎‎‏‏‎‎‏‏‎‎‏‎‏‎‎‏‏‏‏‎‎‏‏‎Bluetooth Audio‎‏‎‎‏‎"</string>
     <string name="bluetooth_opp_file_limit_exceeded" msgid="6612109860149473930">"‎‏‎‎‎‎‎‏‎‏‏‏‎‎‎‎‎‏‎‎‎‎‎‏‏‏‎‏‏‏‏‏‏‏‎‏‏‎‏‏‏‏‎‎‎‎‏‎‏‏‏‎‏‏‏‎‏‏‏‎‎‎‏‎‏‎‏‎‎‏‏‎‎‎‎‏‎‎‎‏‎‎‏‏‎‎‏‎‏‎‎‎‏‎‏‎‎Files bigger than 4GB cannot be transferred‎‏‎‎‏‎"</string>
     <string name="bluetooth_connect_action" msgid="2319449093046720209">"‎‏‎‎‎‎‎‏‎‏‏‏‎‎‎‎‎‏‎‎‎‎‎‏‏‏‎‏‏‏‏‏‎‏‎‎‎‎‎‎‎‏‏‎‎‎‎‎‏‎‏‎‏‏‎‏‎‏‎‏‎‎‏‎‏‎‎‎‎‎‏‏‎‏‎‎‏‏‎‏‏‎‏‎‏‏‎‏‏‎‏‎‎‎‏‎Connect to Bluetooth‎‏‎‎‏‎"</string>
+    <string name="bluetooth_enabled_apm_title" msgid="6914461147844949044">"‎‏‎‎‎‎‎‏‎‏‏‏‎‎‎‎‎‏‎‎‎‎‎‏‏‏‎‏‏‏‏‏‏‏‎‏‏‏‏‏‏‏‏‏‎‏‎‏‎‎‎‏‏‎‎‏‏‏‎‎‎‏‏‏‏‎‎‏‎‎‏‎‏‎‎‎‏‎‎‏‏‎‏‏‎‏‎‎‎‎‏‏‎‏‎‎‎Bluetooth on in airplane mode‎‏‎‎‏‎"</string>
+    <string name="bluetooth_enabled_apm_message" msgid="8409900562494838113">"‎‏‎‎‎‎‎‏‎‏‏‏‎‎‎‎‎‏‎‎‎‎‎‏‏‏‎‏‏‏‏‏‏‏‏‏‎‏‎‎‏‎‏‏‎‏‎‏‏‏‏‏‏‎‎‎‎‎‎‎‎‎‎‏‎‎‎‎‎‏‏‏‏‏‎‏‏‏‎‎‏‏‎‏‎‏‎‏‎‏‏‎‎‎‎‏‎If you keep Bluetooth on, your phone will remember to keep it on the next time you\'re in airplane mode‎‏‎‎‏‎"</string>
+    <string name="bluetooth_stays_on_title" msgid="39720820955212918">"‎‏‎‎‎‎‎‏‎‏‏‏‎‎‎‎‎‏‎‎‎‎‎‏‏‏‎‏‏‏‎‎‎‏‎‎‎‏‏‎‏‎‎‎‏‏‏‎‏‏‏‏‎‎‎‎‎‎‏‎‎‏‏‏‏‎‎‏‏‏‎‎‎‏‏‏‎‏‏‎‎‎‏‏‏‎‏‏‎‎Bluetooth stays on‎‏‎‎‏‎"</string>
+    <string name="bluetooth_stays_on_message" msgid="7142453371222249965">"‎‏‎‎‎‎‎‏‎‏‏‏‎‎‎‎‎‏‎‎‎‎‎‏‏‏‎‏‏‏‏‏‏‏‏‎‎‎‏‏‎‎‎‏‏‏‏‏‎‎‎‏‎‏‏‏‎‏‏‏‏‏‏‏‏‎‏‏‎‎‎‎‎‏‏‏‏‏‏‎‎‏‎‏‎‎‎‏‏‏‏‎‏‏‎‏‎Your phone remembers to keep Bluetooth on in airplane mode. Turn off Bluetooth if you don\'t want it to stay on.‎‏‎‎‏‎"</string>
+    <string name="bluetooth_and_wifi_stays_on_title" msgid="5821932798860821244">"‎‏‎‎‎‎‎‏‎‏‏‏‎‎‎‎‎‏‎‎‎‎‎‏‏‏‎‏‏‏‏‏‏‏‎‏‎‎‎‎‏‏‎‎‏‎‏‏‏‎‏‎‏‎‎‏‎‎‎‎‏‎‎‎‏‏‎‏‏‏‏‎‎‏‎‎‏‎‏‏‏‎‎‎‎‎‏‎‏‏‏‏‏‏‎‎‎Wi-Fi and Bluetooth stay on‎‏‎‎‏‎"</string>
+    <string name="bluetooth_and_wifi_stays_on_message" msgid="2390749828997719812">"‎‏‎‎‎‎‎‏‎‏‏‏‎‎‎‎‎‏‎‎‎‎‎‏‏‏‎‏‏‏‏‏‎‏‎‎‎‎‏‎‎‏‎‏‏‎‏‏‎‏‎‎‏‏‎‎‏‎‎‏‏‎‏‏‎‎‎‎‎‎‎‎‎‏‏‏‏‎‎‎‎‏‎‎‏‏‏‎‎‎‎‎‏‎‎‎Your phone remembers to keep Wi-Fi and Bluetooth on in airplane mode. Turn off Wi-Fi and Bluetooth if you don\'t want them to stay on.‎‏‎‎‏‎"</string>
 </resources>
diff --git a/android/app/res/values-es-rUS/strings.xml b/android/app/res/values-es-rUS/strings.xml
index d71996e..89d6b57 100644
--- a/android/app/res/values-es-rUS/strings.xml
+++ b/android/app/res/values-es-rUS/strings.xml
@@ -128,4 +128,10 @@
     <string name="a2dp_sink_mbs_label" msgid="6035366346569127155">"Audio Bluetooth"</string>
     <string name="bluetooth_opp_file_limit_exceeded" msgid="6612109860149473930">"No se pueden transferir los archivos de más de 4 GB"</string>
     <string name="bluetooth_connect_action" msgid="2319449093046720209">"Conectarse a Bluetooth"</string>
+    <string name="bluetooth_enabled_apm_title" msgid="6914461147844949044">"Bluetooth activado en modo de avión"</string>
+    <string name="bluetooth_enabled_apm_message" msgid="8409900562494838113">"Si mantienes el Bluetooth activado, el teléfono lo dejará activado la próxima vez que actives el modo de avión"</string>
+    <string name="bluetooth_stays_on_title" msgid="39720820955212918">"El Bluetooth permanece activado"</string>
+    <string name="bluetooth_stays_on_message" msgid="7142453371222249965">"El teléfono dejará activado el Bluetooth en el modo de avión. Desactívalo si no quieres que permanezca activado."</string>
+    <string name="bluetooth_and_wifi_stays_on_title" msgid="5821932798860821244">"El Wi-Fi y el Bluetooth permanecen activados"</string>
+    <string name="bluetooth_and_wifi_stays_on_message" msgid="2390749828997719812">"El teléfono dejará activado el Wi-Fi y el Bluetooth en el modo de avión. Si no quieres que permanezcan activados, desactívalos."</string>
 </resources>
diff --git a/android/app/res/values-es/strings.xml b/android/app/res/values-es/strings.xml
index dcfe458..be8fb70 100644
--- a/android/app/res/values-es/strings.xml
+++ b/android/app/res/values-es/strings.xml
@@ -128,4 +128,10 @@
     <string name="a2dp_sink_mbs_label" msgid="6035366346569127155">"Audio por Bluetooth"</string>
     <string name="bluetooth_opp_file_limit_exceeded" msgid="6612109860149473930">"No se pueden transferir archivos de más de 4 GB"</string>
     <string name="bluetooth_connect_action" msgid="2319449093046720209">"Conectarse a un dispositivo Bluetooth"</string>
+    <string name="bluetooth_enabled_apm_title" msgid="6914461147844949044">"Bluetooth activado en modo Avión"</string>
+    <string name="bluetooth_enabled_apm_message" msgid="8409900562494838113">"Si dejas el Bluetooth activado, tu teléfono se acordará de mantenerlo así la próxima vez que uses el modo Avión"</string>
+    <string name="bluetooth_stays_on_title" msgid="39720820955212918">"El Bluetooth permanece activado"</string>
+    <string name="bluetooth_stays_on_message" msgid="7142453371222249965">"Tu teléfono se acordará de mantener activado el Bluetooth en modo Avión. Desactiva el Bluetooth si no quieres que permanezca activado."</string>
+    <string name="bluetooth_and_wifi_stays_on_title" msgid="5821932798860821244">"El Wi-Fi y el Bluetooth permanecen activados"</string>
+    <string name="bluetooth_and_wifi_stays_on_message" msgid="2390749828997719812">"Tu teléfono se acordará de mantener activados el Wi-Fi y el Bluetooth en modo Avión. Desactívalos si no quieres que permanezcan activados."</string>
 </resources>
diff --git a/android/app/res/values-et/strings.xml b/android/app/res/values-et/strings.xml
index f4c8c87..12b4e55 100644
--- a/android/app/res/values-et/strings.xml
+++ b/android/app/res/values-et/strings.xml
@@ -128,4 +128,10 @@
     <string name="a2dp_sink_mbs_label" msgid="6035366346569127155">"Bluetoothi heli"</string>
     <string name="bluetooth_opp_file_limit_exceeded" msgid="6612109860149473930">"Faile, mis on üle 4 GB, ei saa üle kanda"</string>
     <string name="bluetooth_connect_action" msgid="2319449093046720209">"Ühenda Bluetoothiga"</string>
+    <string name="bluetooth_enabled_apm_title" msgid="6914461147844949044">"Bluetooth on lennukirežiimis sisse lülitatud"</string>
+    <string name="bluetooth_enabled_apm_message" msgid="8409900562494838113">"Kui hoiate Bluetoothi sisselülitatuna, jätab telefon teie valiku meelde ja kasutab seda järgmisel korral lennukirežiimi aktiveerimisel."</string>
+    <string name="bluetooth_stays_on_title" msgid="39720820955212918">"Bluetooth jääb sisselülitatuks"</string>
+    <string name="bluetooth_stays_on_message" msgid="7142453371222249965">"Teie telefon hoiab Bluetoothi lennukirežiimis sisselülitatuna. Lülitage Bluetooth välja, kui te ei soovi, et see oleks sisse lülitatud."</string>
+    <string name="bluetooth_and_wifi_stays_on_title" msgid="5821932798860821244">"WiFi ja Bluetoothi jäävad sisselülitatuks"</string>
+    <string name="bluetooth_and_wifi_stays_on_message" msgid="2390749828997719812">"Teie telefon hoiab WiFi ja Bluetoothi lennukirežiimis sisselülitatuna. Lülitage WiFi ja Bluetooth välja, kui te ei soovi, et need oleksid sisse lülitatud."</string>
 </resources>
diff --git a/android/app/res/values-eu/strings.xml b/android/app/res/values-eu/strings.xml
index 149917e..872bbac 100644
--- a/android/app/res/values-eu/strings.xml
+++ b/android/app/res/values-eu/strings.xml
@@ -128,4 +128,10 @@
     <string name="a2dp_sink_mbs_label" msgid="6035366346569127155">"Bluetooth bidezko audioa"</string>
     <string name="bluetooth_opp_file_limit_exceeded" msgid="6612109860149473930">"Ezin dira transferitu 4 GB baino gehiagoko fitxategiak"</string>
     <string name="bluetooth_connect_action" msgid="2319449093046720209">"Konektatu Bluetoothera"</string>
+    <string name="bluetooth_enabled_apm_title" msgid="6914461147844949044">"Bluetootha aktibatuta mantentzen da hegaldi moduan"</string>
+    <string name="bluetooth_enabled_apm_message" msgid="8409900562494838113">"Bluetootha aktibatuta utziz gero, hura aktibatuta mantentzeaz gogoratuko da telefonoa hegaldi modua erabiltzen duzun hurrengoan"</string>
+    <string name="bluetooth_stays_on_title" msgid="39720820955212918">"Bluetootha aktibatuta mantenduko da"</string>
+    <string name="bluetooth_stays_on_message" msgid="7142453371222249965">"Hegaldi moduan, Bluetootha aktibatuta mantentzeaz gogoratzen da telefonoa. Halakorik nahi ez baduzu, desaktiba ezazu zuk zeuk."</string>
+    <string name="bluetooth_and_wifi_stays_on_title" msgid="5821932798860821244">"Wifia eta Bluetootha aktibatuta mantentzen dira"</string>
+    <string name="bluetooth_and_wifi_stays_on_message" msgid="2390749828997719812">"Hegaldi moduan, wifia eta Bluetootha aktibatuta mantentzeaz gogoratzen da telefonoa. Halakorik nahi ez baduzu, desaktiba itzazu zuk zeuk."</string>
 </resources>
diff --git a/android/app/res/values-fa/strings.xml b/android/app/res/values-fa/strings.xml
index 7fe21bd..d2507b1 100644
--- a/android/app/res/values-fa/strings.xml
+++ b/android/app/res/values-fa/strings.xml
@@ -128,4 +128,10 @@
     <string name="a2dp_sink_mbs_label" msgid="6035366346569127155">"بلوتوث‌ صوتی"</string>
     <string name="bluetooth_opp_file_limit_exceeded" msgid="6612109860149473930">"فایل‌های بزرگ‌تر از ۴ گیگابایت نمی‌توانند منتقل شوند"</string>
     <string name="bluetooth_connect_action" msgid="2319449093046720209">"اتصال به بلوتوث"</string>
+    <string name="bluetooth_enabled_apm_title" msgid="6914461147844949044">"بلوتوث در «حالت هواپیما» روشن باشد"</string>
+    <string name="bluetooth_enabled_apm_message" msgid="8409900562494838113">"اگر بلوتوث را روشن نگه دارید، تلفنتان به‌یاد خواهد داشت تا دفعه بعدی که در «حالت هواپیما» هستید آن را روشن نگه دارد"</string>
+    <string name="bluetooth_stays_on_title" msgid="39720820955212918">"بلوتوث روشن بماند"</string>
+    <string name="bluetooth_stays_on_message" msgid="7142453371222249965">"تلفنتان به‌یاد می‌آورد که بلوتوث را در «حالت هواپیما» روشن نگه دارد. اگر نمی‌خواهید بلوتوث روشن بماند، آن را خاموش کنید."</string>
+    <string name="bluetooth_and_wifi_stays_on_title" msgid="5821932798860821244">"‏‫Wi-Fi و بلوتوث روشن بماند"</string>
+    <string name="bluetooth_and_wifi_stays_on_message" msgid="2390749828997719812">"‏تلفنتان به‌یاد می‌آورد که Wi-Fi و بلوتوث را در «حالت هواپیما» روشن نگه دارد. اگر نمی‌خواهید Wi-Fi و بلوتوث روشن بمانند، آن‌ها را خاموش کنید."</string>
 </resources>
diff --git a/android/app/res/values-fi/strings.xml b/android/app/res/values-fi/strings.xml
index 75c005f..bc3550f 100644
--- a/android/app/res/values-fi/strings.xml
+++ b/android/app/res/values-fi/strings.xml
@@ -128,4 +128,10 @@
     <string name="a2dp_sink_mbs_label" msgid="6035366346569127155">"Bluetooth-ääni"</string>
     <string name="bluetooth_opp_file_limit_exceeded" msgid="6612109860149473930">"Yli 4 Gt:n kokoisia tiedostoja ei voi siirtää."</string>
     <string name="bluetooth_connect_action" msgid="2319449093046720209">"Muodosta Bluetooth-yhteys"</string>
+    <string name="bluetooth_enabled_apm_title" msgid="6914461147844949044">"Bluetooth päällä lentokonetilassa"</string>
+    <string name="bluetooth_enabled_apm_message" msgid="8409900562494838113">"Jos pidät Bluetooth-yhteyden päällä, puhelin pitää sen päällä, kun seuraavan kerran olet lentokonetilassa"</string>
+    <string name="bluetooth_stays_on_title" msgid="39720820955212918">"Bluetooth pysyy päällä"</string>
+    <string name="bluetooth_stays_on_message" msgid="7142453371222249965">"Puhelimen Bluetooth pysyy päällä lentokonetilassa. Voit halutessasi laittaa Bluetooth-yhteyden pois päältä."</string>
+    <string name="bluetooth_and_wifi_stays_on_title" msgid="5821932798860821244">"Wi-Fi ja Bluetooth pysyvät päällä"</string>
+    <string name="bluetooth_and_wifi_stays_on_message" msgid="2390749828997719812">"Puhelimen Wi-Fi-yhteys ja Bluetooth pysyvät päällä lentokonetilassa. Voit halutessasi laittaa ne pois päältä."</string>
 </resources>
diff --git a/android/app/res/values-fr-rCA/strings.xml b/android/app/res/values-fr-rCA/strings.xml
index 1bc3d20..1977da0 100644
--- a/android/app/res/values-fr-rCA/strings.xml
+++ b/android/app/res/values-fr-rCA/strings.xml
@@ -128,4 +128,10 @@
     <string name="a2dp_sink_mbs_label" msgid="6035366346569127155">"Audio Bluetooth"</string>
     <string name="bluetooth_opp_file_limit_exceeded" msgid="6612109860149473930">"Les fichiers dépassant 4 Go ne peuvent pas être transférés"</string>
     <string name="bluetooth_connect_action" msgid="2319449093046720209">"Connexion au Bluetooth"</string>
+    <string name="bluetooth_enabled_apm_title" msgid="6914461147844949044">"Bluetooth activé en mode Avion"</string>
+    <string name="bluetooth_enabled_apm_message" msgid="8409900562494838113">"Si vous laissez le Bluetooth activé, votre téléphone se souviendra qu\'il doit le laisser activé la prochaine fois que vous serez en mode Avion"</string>
+    <string name="bluetooth_stays_on_title" msgid="39720820955212918">"Le Bluetooth reste activé"</string>
+    <string name="bluetooth_stays_on_message" msgid="7142453371222249965">"Votre téléphone se souvient de garder le Bluetooth activé en mode Avion. Désactivez le Bluetooth si vous ne souhaitez pas qu\'il reste activé."</string>
+    <string name="bluetooth_and_wifi_stays_on_title" msgid="5821932798860821244">"Le Wi-Fi et le Bluetooth restent activés"</string>
+    <string name="bluetooth_and_wifi_stays_on_message" msgid="2390749828997719812">"Votre téléphone se souvient de garder le Wi-Fi et le Bluetooth activés en mode Avion. Désactivez le Wi-Fi et le Bluetooth si vous ne souhaitez pas qu\'ils restent activés."</string>
 </resources>
diff --git a/android/app/res/values-fr/strings.xml b/android/app/res/values-fr/strings.xml
index 333b95e..48a84dc 100644
--- a/android/app/res/values-fr/strings.xml
+++ b/android/app/res/values-fr/strings.xml
@@ -128,4 +128,10 @@
     <string name="a2dp_sink_mbs_label" msgid="6035366346569127155">"Audio Bluetooth"</string>
     <string name="bluetooth_opp_file_limit_exceeded" msgid="6612109860149473930">"Impossible de transférer les fichiers supérieurs à 4 Go"</string>
     <string name="bluetooth_connect_action" msgid="2319449093046720209">"Se connecter au Bluetooth"</string>
+    <string name="bluetooth_enabled_apm_title" msgid="6914461147844949044">"Bluetooth activé en mode Avion"</string>
+    <string name="bluetooth_enabled_apm_message" msgid="8409900562494838113">"Si vous laissez le Bluetooth activé, votre téléphone s\'en souviendra et le Bluetooth restera activé la prochaine fois que vous serez en mode Avion"</string>
+    <string name="bluetooth_stays_on_title" msgid="39720820955212918">"Le Bluetooth reste activé"</string>
+    <string name="bluetooth_stays_on_message" msgid="7142453371222249965">"Le Bluetooth restera activé en mode Avion. Vous pouvez le désactiver si vous le souhaitez."</string>
+    <string name="bluetooth_and_wifi_stays_on_title" msgid="5821932798860821244">"Le Wi-Fi et le Bluetooth restent activés"</string>
+    <string name="bluetooth_and_wifi_stays_on_message" msgid="2390749828997719812">"Le Wi‑Fi et le Bluetooth de votre téléphone resteront activés en mode Avion. Vous pouvez les désactivez si vous le souhaitez."</string>
 </resources>
diff --git a/android/app/res/values-gl/strings.xml b/android/app/res/values-gl/strings.xml
index a9b54c3..d46049d 100644
--- a/android/app/res/values-gl/strings.xml
+++ b/android/app/res/values-gl/strings.xml
@@ -128,4 +128,10 @@
     <string name="a2dp_sink_mbs_label" msgid="6035366346569127155">"Audio por Bluetooth"</string>
     <string name="bluetooth_opp_file_limit_exceeded" msgid="6612109860149473930">"Non se poden transferir ficheiros de máis de 4 GB"</string>
     <string name="bluetooth_connect_action" msgid="2319449093046720209">"Conectar ao Bluetooth"</string>
+    <string name="bluetooth_enabled_apm_title" msgid="6914461147844949044">"Bluetooth activado no modo avión"</string>
+    <string name="bluetooth_enabled_apm_message" msgid="8409900562494838113">"Se mantés o Bluetooth activado, o teléfono lembrará que ten que deixalo nese estado a próxima vez que esteas no modo avión"</string>
+    <string name="bluetooth_stays_on_title" msgid="39720820955212918">"O Bluetooth permanece activado"</string>
+    <string name="bluetooth_stays_on_message" msgid="7142453371222249965">"O teu teléfono lembrará manter o Bluetooth activado no modo avión. Se non queres que permaneza nese estado, desactívao."</string>
+    <string name="bluetooth_and_wifi_stays_on_title" msgid="5821932798860821244">"A wifi e o Bluetooth permanecen activados"</string>
+    <string name="bluetooth_and_wifi_stays_on_message" msgid="2390749828997719812">"O teu teléfono lembrará manter a wifi e o Bluetooth activados no modo avión. Se non queres que permanezan nese estado, desactívaos."</string>
 </resources>
diff --git a/android/app/res/values-gu/strings.xml b/android/app/res/values-gu/strings.xml
index 3653a8a..1832689 100644
--- a/android/app/res/values-gu/strings.xml
+++ b/android/app/res/values-gu/strings.xml
@@ -128,4 +128,10 @@
     <string name="a2dp_sink_mbs_label" msgid="6035366346569127155">"બ્લૂટૂથ ઑડિઓ"</string>
     <string name="bluetooth_opp_file_limit_exceeded" msgid="6612109860149473930">"4GB કરતા મોટી ફાઇલ ટ્રાન્સફર કરી શકાતી નથી"</string>
     <string name="bluetooth_connect_action" msgid="2319449093046720209">"બ્લૂટૂથ સાથે કનેક્ટ કરો"</string>
+    <string name="bluetooth_enabled_apm_title" msgid="6914461147844949044">"એરપ્લેન મોડમાં બ્લૂટૂથ ચાલુ છે"</string>
+    <string name="bluetooth_enabled_apm_message" msgid="8409900562494838113">"જો તમે બ્લૂટૂથ ચાલુ રાખો, તો તમે જ્યારે આગલી વખતે એરપ્લેન મોડ પર જશો, ત્યારે તમારો ફોન તેને ચાલુ રાખવાનું યાદ રાખશે"</string>
+    <string name="bluetooth_stays_on_title" msgid="39720820955212918">"બ્લૂટૂથ ચાલુ રહેશે"</string>
+    <string name="bluetooth_stays_on_message" msgid="7142453371222249965">"તમારો ફોન બ્લૂટૂથને એરપ્લેન મોડમાં ચાલુ રાખવાનું યાદ રાખે છે. જો તમે બ્લૂટૂથ ચાલુ રાખવા માગતા ન હો, તો તેને બંધ કરો."</string>
+    <string name="bluetooth_and_wifi_stays_on_title" msgid="5821932798860821244">"વાઇ-ફાઇ અને બ્લૂટૂથ ચાલુ રહે છે"</string>
+    <string name="bluetooth_and_wifi_stays_on_message" msgid="2390749828997719812">"તમારો ફોન વાઇ-ફાઇ અને બ્લૂટૂથને એરપ્લેન મોડમાં ચાલુ રાખવાનું યાદ રાખે છે. જો તમે વાઇ-ફાઇ અને બ્લૂટૂથ ચાલુ રાખવા માગતા ન હો, તો તેને બંધ કરો."</string>
 </resources>
diff --git a/android/app/res/values-hi/strings.xml b/android/app/res/values-hi/strings.xml
index 99dab10..df6c33d 100644
--- a/android/app/res/values-hi/strings.xml
+++ b/android/app/res/values-hi/strings.xml
@@ -128,4 +128,10 @@
     <string name="a2dp_sink_mbs_label" msgid="6035366346569127155">"ब्लूटूथ ऑडियो"</string>
     <string name="bluetooth_opp_file_limit_exceeded" msgid="6612109860149473930">"4 जीबी से बड़ी फ़ाइलें ट्रांसफ़र नहीं की जा सकतीं"</string>
     <string name="bluetooth_connect_action" msgid="2319449093046720209">"ब्लूटूथ से कनेक्ट करें"</string>
+    <string name="bluetooth_enabled_apm_title" msgid="6914461147844949044">"हवाई जहाज़ मोड में ब्लूटूथ चालू है"</string>
+    <string name="bluetooth_enabled_apm_message" msgid="8409900562494838113">"ब्लूटूथ चालू रखने पर आपका फ़ोन, अगली बार हवाई जहाज़ मोड चालू होने पर भी ब्लूटूथ चालू रखेगा"</string>
+    <string name="bluetooth_stays_on_title" msgid="39720820955212918">"ब्लूटूथ चालू रहता है"</string>
+    <string name="bluetooth_stays_on_message" msgid="7142453371222249965">"हवाई जहाज़ मोड में भी, आपका फ़ोन ब्लूटूथ चालू रखता है. अगर ब्लूटूथ चालू नहीं रखना है, तो उसे बंद कर दें."</string>
+    <string name="bluetooth_and_wifi_stays_on_title" msgid="5821932798860821244">"वाई-फ़ाई और ब्लूटूथ चालू रहते हैं"</string>
+    <string name="bluetooth_and_wifi_stays_on_message" msgid="2390749828997719812">"हवाई जहाज़ मोड में भी, आपका फ़ोन वाई-फ़ाई और ब्लूटूथ को चालू रखता है. अगर आपको वाई-फ़ाई और ब्लूटूथ चालू नहीं रखना है, तो उन्हें बंद कर दें."</string>
 </resources>
diff --git a/android/app/res/values-hr/strings.xml b/android/app/res/values-hr/strings.xml
index fc136d7..69df521 100644
--- a/android/app/res/values-hr/strings.xml
+++ b/android/app/res/values-hr/strings.xml
@@ -128,4 +128,10 @@
     <string name="a2dp_sink_mbs_label" msgid="6035366346569127155">"Bluetooth Audio"</string>
     <string name="bluetooth_opp_file_limit_exceeded" msgid="6612109860149473930">"Datoteke veće od 4 GB ne mogu se prenijeti"</string>
     <string name="bluetooth_connect_action" msgid="2319449093046720209">"Povezivanje s Bluetoothom"</string>
+    <string name="bluetooth_enabled_apm_title" msgid="6914461147844949044">"Bluetooth je uključen u načinu rada u zrakoplovu"</string>
+    <string name="bluetooth_enabled_apm_message" msgid="8409900562494838113">"Ako Bluetooth ostane uključen, telefon će zapamtiti da treba ostati uključen u načinu rada u zrakoplovu"</string>
+    <string name="bluetooth_stays_on_title" msgid="39720820955212918">"Bluetooth ostaje uključen"</string>
+    <string name="bluetooth_stays_on_message" msgid="7142453371222249965">"Telefon će zapamtiti da Bluetooth treba ostati uključen u načinu rada u zrakoplovu. Isključite Bluetooth ako ne želite da ostane uključen."</string>
+    <string name="bluetooth_and_wifi_stays_on_title" msgid="5821932798860821244">"Wi-Fi i Bluetooth ostat će uključeni"</string>
+    <string name="bluetooth_and_wifi_stays_on_message" msgid="2390749828997719812">"Telefon će zapamtiti da Wi‑Fi i Bluetooth trebaju ostati uključeni u načinu rada u zrakoplovu. Uključite Wi-Fi i Bluetooth ako ne želite da ostanu uključeni."</string>
 </resources>
diff --git a/android/app/res/values-hu/strings.xml b/android/app/res/values-hu/strings.xml
index c14d9b0..4b1c451 100644
--- a/android/app/res/values-hu/strings.xml
+++ b/android/app/res/values-hu/strings.xml
@@ -128,4 +128,10 @@
     <string name="a2dp_sink_mbs_label" msgid="6035366346569127155">"Bluetooth audió"</string>
     <string name="bluetooth_opp_file_limit_exceeded" msgid="6612109860149473930">"A 4 GB-nál nagyobb fájlokat nem lehet átvinni"</string>
     <string name="bluetooth_connect_action" msgid="2319449093046720209">"Csatlakozás Bluetooth-eszközhöz"</string>
+    <string name="bluetooth_enabled_apm_title" msgid="6914461147844949044">"Bluetooth bekapcsolva Repülős üzemmódban"</string>
+    <string name="bluetooth_enabled_apm_message" msgid="8409900562494838113">"Ha bekapcsolva tartja a Bluetootht, a telefon emlékezni fog arra, hogy a következő alkalommal, amikor Repülős üzemmódban van, bekapcsolva tartsa a funkciót."</string>
+    <string name="bluetooth_stays_on_title" msgid="39720820955212918">"A Bluetooth bekapcsolva marad"</string>
+    <string name="bluetooth_stays_on_message" msgid="7142453371222249965">"A telefon bekapcsolva tartja a Bluetootht Repülős üzemmódban. Kapcsolja ki a Bluetootht, ha nem szeretné, hogy bekapcsolva maradjon."</string>
+    <string name="bluetooth_and_wifi_stays_on_title" msgid="5821932798860821244">"A Wi-Fi és a Bluetooth bekapcsolva marad"</string>
+    <string name="bluetooth_and_wifi_stays_on_message" msgid="2390749828997719812">"A telefon bekapcsolva tartja a Wi‑Fi-t és a Bluetootht Repülős üzemmódban. Ha nem szeretné, hogy bekapcsolva maradjon a Wi-Fi és a Bluetooth, kapcsolja ki őket."</string>
 </resources>
diff --git a/android/app/res/values-hy/strings.xml b/android/app/res/values-hy/strings.xml
index f0881cc..28d1cab 100644
--- a/android/app/res/values-hy/strings.xml
+++ b/android/app/res/values-hy/strings.xml
@@ -128,4 +128,10 @@
     <string name="a2dp_sink_mbs_label" msgid="6035366346569127155">"Bluetooth աուդիո"</string>
     <string name="bluetooth_opp_file_limit_exceeded" msgid="6612109860149473930">"4 ԳԲ-ից մեծ ֆայլերը հնարավոր չէ փոխանցել"</string>
     <string name="bluetooth_connect_action" msgid="2319449093046720209">"Միանալ Bluetooth-ին"</string>
+    <string name="bluetooth_enabled_apm_title" msgid="6914461147844949044">"Bluetooth-ը միացված է ավիառեժիմում"</string>
+    <string name="bluetooth_enabled_apm_message" msgid="8409900562494838113">"Եթե Bluetooth-ը միացված թողնեք, հաջորդ անգամ այն ավտոմատ միացված կմնա ավիառեժիմում"</string>
+    <string name="bluetooth_stays_on_title" msgid="39720820955212918">"Bluetooth-ը կմնա միացված"</string>
+    <string name="bluetooth_stays_on_message" msgid="7142453371222249965">"Ավիառեժիմում Bluetooth-ը միացված կմնա։ Ցանկության դեպքում կարող եք անջատել Bluetooth-ը։"</string>
+    <string name="bluetooth_and_wifi_stays_on_title" msgid="5821932798860821244">"Wi-Fi-ը և Bluetooth-ը մնում են միացված"</string>
+    <string name="bluetooth_and_wifi_stays_on_message" msgid="2390749828997719812">"Ավիառեժիմում Wi-Fi-ը և Bluetooth-ը միացված կմնան։ Ցանկության դեպքում կարող եք անջատել Wi-Fi-ը և Bluetooth-ը։"</string>
 </resources>
diff --git a/android/app/res/values-in/strings.xml b/android/app/res/values-in/strings.xml
index cf40fc6..f9a8987 100644
--- a/android/app/res/values-in/strings.xml
+++ b/android/app/res/values-in/strings.xml
@@ -128,4 +128,10 @@
     <string name="a2dp_sink_mbs_label" msgid="6035366346569127155">"Bluetooth Audio"</string>
     <string name="bluetooth_opp_file_limit_exceeded" msgid="6612109860149473930">"File yang berukuran lebih dari 4GB tidak dapat ditransfer"</string>
     <string name="bluetooth_connect_action" msgid="2319449093046720209">"Hubungkan ke Bluetooth"</string>
+    <string name="bluetooth_enabled_apm_title" msgid="6914461147844949044">"Bluetooth aktif dalam mode pesawat"</string>
+    <string name="bluetooth_enabled_apm_message" msgid="8409900562494838113">"Jika Bluetooth tetap diaktifkan, ponsel akan ingat untuk tetap mengaktifkannya saat berikutnya ponsel Anda disetel ke mode pesawat"</string>
+    <string name="bluetooth_stays_on_title" msgid="39720820955212918">"Bluetooth tetap aktif"</string>
+    <string name="bluetooth_stays_on_message" msgid="7142453371222249965">"Ponsel akan mengingat untuk tetap mengaktifkan Bluetooth dalam mode pesawat. Nonaktifkan jika Anda tidak ingin Bluetooth terus aktif."</string>
+    <string name="bluetooth_and_wifi_stays_on_title" msgid="5821932798860821244">"Wi-Fi dan Bluetooth tetap aktif"</string>
+    <string name="bluetooth_and_wifi_stays_on_message" msgid="2390749828997719812">"Ponsel akan mengingat untuk tetap mengaktifkan Wi-Fi dan Bluetooth dalam mode pesawat. Nonaktifkan jika Anda tidak ingin Wi-Fi dan Bluetooth terus aktif."</string>
 </resources>
diff --git a/android/app/res/values-is/strings.xml b/android/app/res/values-is/strings.xml
index 5ca4de3..36f077f 100644
--- a/android/app/res/values-is/strings.xml
+++ b/android/app/res/values-is/strings.xml
@@ -128,4 +128,10 @@
     <string name="a2dp_sink_mbs_label" msgid="6035366346569127155">"Bluetooth-hljóð"</string>
     <string name="bluetooth_opp_file_limit_exceeded" msgid="6612109860149473930">"Ekki er hægt að flytja skrár sem eru stærri en 4 GB"</string>
     <string name="bluetooth_connect_action" msgid="2319449093046720209">"Tengjast við Bluetooth"</string>
+    <string name="bluetooth_enabled_apm_title" msgid="6914461147844949044">"Kveikt á Bluetooth í flugstillingu"</string>
+    <string name="bluetooth_enabled_apm_message" msgid="8409900562494838113">"Ef þú hefur kveikt á Bluetooth mun síminn muna að hafa kveikt á því næst þegar þú stillir á flugstillingu"</string>
+    <string name="bluetooth_stays_on_title" msgid="39720820955212918">"Áfram kveikt á Bluetooth"</string>
+    <string name="bluetooth_stays_on_message" msgid="7142453371222249965">"Síminn man að hafa kveikt á Bluetooth í flugstillingu. Slökktu á Bluetooth ef þú vilt ekki hafa kveikt á því."</string>
+    <string name="bluetooth_and_wifi_stays_on_title" msgid="5821932798860821244">"Áfram verður kveikt á Wi-Fi og Bluetooth"</string>
+    <string name="bluetooth_and_wifi_stays_on_message" msgid="2390749828997719812">"Síminn man að hafa kveikt á Wi-Fi og Bluetooth í flugstillingu. Slökktu á Wi-Fi og Bluetooth ef þú vilt ekki hafa kveikt á þessu."</string>
 </resources>
diff --git a/android/app/res/values-it/strings.xml b/android/app/res/values-it/strings.xml
index bab5e54..b9b8a65 100644
--- a/android/app/res/values-it/strings.xml
+++ b/android/app/res/values-it/strings.xml
@@ -128,4 +128,10 @@
     <string name="a2dp_sink_mbs_label" msgid="6035366346569127155">"Audio Bluetooth"</string>
     <string name="bluetooth_opp_file_limit_exceeded" msgid="6612109860149473930">"Impossibile trasferire file con dimensioni superiori a 4 GB"</string>
     <string name="bluetooth_connect_action" msgid="2319449093046720209">"Connettiti a Bluetooth"</string>
+    <string name="bluetooth_enabled_apm_title" msgid="6914461147844949044">"Bluetooth attivo in modalità aereo"</string>
+    <string name="bluetooth_enabled_apm_message" msgid="8409900562494838113">"Se tieni attivo il Bluetooth, il telefono ricorderà di tenerlo attivo la prossima volta che sarai in modalità aereo"</string>
+    <string name="bluetooth_stays_on_title" msgid="39720820955212918">"Il Bluetooth rimane attivo"</string>
+    <string name="bluetooth_stays_on_message" msgid="7142453371222249965">"Il telefono memorizza che deve tenere attivo il Bluetooth in modalità aereo. Disattiva il Bluetooth se non vuoi tenerlo attivo."</string>
+    <string name="bluetooth_and_wifi_stays_on_title" msgid="5821932798860821244">"Wi-Fi e Bluetooth rimangono attivi"</string>
+    <string name="bluetooth_and_wifi_stays_on_message" msgid="2390749828997719812">"Il telefono memorizza che deve tenere attivi il Wi‑Fi e il Bluetooth in modalità aereo. Disattiva il Wi-Fi e il Bluetooth se non vuoi tenerli attivi."</string>
 </resources>
diff --git a/android/app/res/values-iw/strings.xml b/android/app/res/values-iw/strings.xml
index ad24f44..51def83 100644
--- a/android/app/res/values-iw/strings.xml
+++ b/android/app/res/values-iw/strings.xml
@@ -109,8 +109,8 @@
     <string name="transfer_clear_dlg_msg" msgid="586117930961007311">"כל הפריטים ינוקו מהרשימה."</string>
     <string name="outbound_noti_title" msgid="2045560896819618979">"‏שיתוף Bluetooth: נשלחו קבצים"</string>
     <string name="inbound_noti_title" msgid="3730993443609581977">"‏שיתוף Bluetooth: התקבלו קבצים"</string>
-    <string name="noti_caption_unsuccessful" msgid="6679288016450410835">"{count,plural, =1{# נכשל}two{# נכשלו}many{# נכשלו}other{# נכשלו}}"</string>
-    <string name="noti_caption_success" msgid="7652777514009569713">"{count,plural, =1{‏# הצליח, %1$s}two{‏# הצליחו, %1$s}many{‏# הצליחו, %1$s}other{‏# הצליחו, %1$s}}"</string>
+    <string name="noti_caption_unsuccessful" msgid="6679288016450410835">"{count,plural, =1{# נכשל}one{# נכשלו}two{# נכשלו}other{# נכשלו}}"</string>
+    <string name="noti_caption_success" msgid="7652777514009569713">"{count,plural, =1{‏# הצליח, %1$s}one{‏# הצליחו, %1$s}two{‏# הצליחו, %1$s}other{‏# הצליחו, %1$s}}"</string>
     <string name="transfer_menu_clear_all" msgid="3014459758656427076">"ניקוי רשימה"</string>
     <string name="transfer_menu_open" msgid="5193344638774400131">"פתיחה"</string>
     <string name="transfer_menu_clear" msgid="7213491281898188730">"ניקוי מהרשימה"</string>
@@ -128,4 +128,10 @@
     <string name="a2dp_sink_mbs_label" msgid="6035366346569127155">"‏אודיו Bluetooth"</string>
     <string name="bluetooth_opp_file_limit_exceeded" msgid="6612109860149473930">"‏לא ניתן להעביר קבצים שגדולים מ-4GB"</string>
     <string name="bluetooth_connect_action" msgid="2319449093046720209">"‏התחברות באמצעות Bluetooth"</string>
+    <string name="bluetooth_enabled_apm_title" msgid="6914461147844949044">"‏חיבור ה-Bluetooth מופעל במצב טיסה"</string>
+    <string name="bluetooth_enabled_apm_message" msgid="8409900562494838113">"‏אם חיבור ה-Bluetooth נשאר מופעל, הטלפון יזכור להשאיר אותו מופעל בפעם הבאה שהוא יועבר למצב טיסה"</string>
+    <string name="bluetooth_stays_on_title" msgid="39720820955212918">"‏Bluetooth יישאר מופעל"</string>
+    <string name="bluetooth_stays_on_message" msgid="7142453371222249965">"‏חיבור ה-Bluetooth בטלפון יישאר מופעל במצב טיסה. אפשר להשבית את ה-Bluetooth אם לא רוצים שהוא יפעל."</string>
+    <string name="bluetooth_and_wifi_stays_on_title" msgid="5821932798860821244">"‏חיבורי ה-Wi‑Fi וה-Bluetooth יישארו מופעלים"</string>
+    <string name="bluetooth_and_wifi_stays_on_message" msgid="2390749828997719812">"‏חיבורי ה-Wi‑Fi וה-Bluetooth בטלפון יישארו מופעלים במצב טיסה. אפשר להשבית את ה-Wi-Fi וה-Bluetooth אם לא רוצים שהם יפעלו."</string>
 </resources>
diff --git a/android/app/res/values-ja/strings.xml b/android/app/res/values-ja/strings.xml
index 0708903..fc4fe4a 100644
--- a/android/app/res/values-ja/strings.xml
+++ b/android/app/res/values-ja/strings.xml
@@ -128,4 +128,10 @@
     <string name="a2dp_sink_mbs_label" msgid="6035366346569127155">"Bluetooth オーディオ"</string>
     <string name="bluetooth_opp_file_limit_exceeded" msgid="6612109860149473930">"4 GB を超えるファイルは転送できません"</string>
     <string name="bluetooth_connect_action" msgid="2319449093046720209">"Bluetooth に接続する"</string>
+    <string name="bluetooth_enabled_apm_title" msgid="6914461147844949044">"機内モードで Bluetooth を ON にする"</string>
+    <string name="bluetooth_enabled_apm_message" msgid="8409900562494838113">"Bluetooth を ON にしておくと、次に機内モードになったときも ON のままになります"</string>
+    <string name="bluetooth_stays_on_title" msgid="39720820955212918">"Bluetooth を ON にしておく"</string>
+    <string name="bluetooth_stays_on_message" msgid="7142453371222249965">"機内モードでも、スマートフォンの Bluetooth は ON のままになります。Bluetooth を ON にしたくない場合は OFF にしてください。"</string>
+    <string name="bluetooth_and_wifi_stays_on_title" msgid="5821932798860821244">"Wi-Fi と Bluetooth を ON のままにする"</string>
+    <string name="bluetooth_and_wifi_stays_on_message" msgid="2390749828997719812">"機内モードでも、スマートフォンの Wi-Fi と Bluetooth は ON のままになります。Wi-Fi と Bluetooth を ON にしたくない場合は OFF にしてください。"</string>
 </resources>
diff --git a/android/app/res/values-ka/strings.xml b/android/app/res/values-ka/strings.xml
index 592eb4f..42eb4e4 100644
--- a/android/app/res/values-ka/strings.xml
+++ b/android/app/res/values-ka/strings.xml
@@ -128,4 +128,10 @@
     <string name="a2dp_sink_mbs_label" msgid="6035366346569127155">"Bluetooth აუდიო"</string>
     <string name="bluetooth_opp_file_limit_exceeded" msgid="6612109860149473930">"4 გბაიტზე დიდი მოცულობის ფაილების გადატანა ვერ მოხერხდება"</string>
     <string name="bluetooth_connect_action" msgid="2319449093046720209">"Bluetooth-თან დაკავშირება"</string>
+    <string name="bluetooth_enabled_apm_title" msgid="6914461147844949044">"Bluetooth ჩართულია თვითმფრინავის რეჟიმში"</string>
+    <string name="bluetooth_enabled_apm_message" msgid="8409900562494838113">"თუ Bluetooth-ს ჩართულს დატოვებთ, თქვენი ტელეფონი დაიმახსოვრებს და ჩართულს დატოვებს მას, როდესაც შემდეგ ჯერზე თვითმფრინავის რეჟიმში იქნებით"</string>
+    <string name="bluetooth_stays_on_title" msgid="39720820955212918">"Bluetooth რᲩება Ჩართული"</string>
+    <string name="bluetooth_stays_on_message" msgid="7142453371222249965">"თქვენს ტელეფონს ემახსოვრება, რომ Bluetooth ჩართული უნდა იყოს თვითმფრინავის რეჟიმში. გამორთეთ Bluetooth, თუ არ გსურთ, რომ ის ჩართული იყოს."</string>
+    <string name="bluetooth_and_wifi_stays_on_title" msgid="5821932798860821244">"Wi-Fi და Bluetooth ჩართული დარჩება"</string>
+    <string name="bluetooth_and_wifi_stays_on_message" msgid="2390749828997719812">"თქვენს ტელეფონს ემახსოვრება, რომ Wi‑Fi და Bluetooth ჩართული უნდა იყოს თვითმფრინავის რეჟიმში. გამორთეთ Wi-Fi და Bluetooth, თუ არ გსურთ, რომ ისინი ჩართული იყოს."</string>
 </resources>
diff --git a/android/app/res/values-kk/strings.xml b/android/app/res/values-kk/strings.xml
index 9913e3b..d807e04 100644
--- a/android/app/res/values-kk/strings.xml
+++ b/android/app/res/values-kk/strings.xml
@@ -90,7 +90,7 @@
     <string name="status_pending" msgid="4781040740237733479">"Файлды аудару әлі басталған жоқ."</string>
     <string name="status_running" msgid="7419075903776657351">"Файлды аудару орындалуда."</string>
     <string name="status_success" msgid="7963589000098719541">"Файлды аудару сәтті орындалды."</string>
-    <string name="status_not_accept" msgid="1165798802740579658">"Мазмұн қолдауы жоқ."</string>
+    <string name="status_not_accept" msgid="1165798802740579658">"Контент қолдауы жоқ."</string>
     <string name="status_forbidden" msgid="4017060451358837245">"Аударуға қабылдайтын құрылғы тыйым салды."</string>
     <string name="status_canceled" msgid="8441679418717978515">"Тасымалды пайдаланушы тоқтатты."</string>
     <string name="status_file_error" msgid="5379018888714679311">"Жад ақаулығы."</string>
@@ -128,4 +128,10 @@
     <string name="a2dp_sink_mbs_label" msgid="6035366346569127155">"Bluetooth aудиосы"</string>
     <string name="bluetooth_opp_file_limit_exceeded" msgid="6612109860149473930">"Көлемі 4 ГБ-тан асатын файлдар тасымалданбайды"</string>
     <string name="bluetooth_connect_action" msgid="2319449093046720209">"Bluetooth-қа қосылу"</string>
+    <string name="bluetooth_enabled_apm_title" msgid="6914461147844949044">"Bluetooth ұшақ режимінде қосулы"</string>
+    <string name="bluetooth_enabled_apm_message" msgid="8409900562494838113">"Bluetooth-ты қосулы қалдырсаңыз, келесі жолы ұшақ режиміне ауысқанда да ол қосылып тұрады."</string>
+    <string name="bluetooth_stays_on_title" msgid="39720820955212918">"Bluetooth қосулы болады"</string>
+    <string name="bluetooth_stays_on_message" msgid="7142453371222249965">"Bluetooth ұшақ режимінде қосылып тұрады. Қаласаңыз, оны өшіріп қоюыңызға болады."</string>
+    <string name="bluetooth_and_wifi_stays_on_title" msgid="5821932798860821244">"Wi-Fi мен Bluetooth қосулы тұрады"</string>
+    <string name="bluetooth_and_wifi_stays_on_message" msgid="2390749828997719812">"Wi‑Fi мен Bluetooth ұшақ режимінде қосылып тұрады. Қаласаңыз, оларды өшіріп қоюыңызға болады."</string>
 </resources>
diff --git a/android/app/res/values-km/strings.xml b/android/app/res/values-km/strings.xml
index abf6466..822765b 100644
--- a/android/app/res/values-km/strings.xml
+++ b/android/app/res/values-km/strings.xml
@@ -128,4 +128,10 @@
     <string name="a2dp_sink_mbs_label" msgid="6035366346569127155">"សំឡេងប៊្លូធូស"</string>
     <string name="bluetooth_opp_file_limit_exceeded" msgid="6612109860149473930">"ឯកសារ​ដែល​មាន​ទំហំ​ធំ​ជាង 4 GB មិន​អាចផ្ទេរ​បាន​ទេ"</string>
     <string name="bluetooth_connect_action" msgid="2319449093046720209">"ភ្ជាប់​ប៊្លូធូស"</string>
+    <string name="bluetooth_enabled_apm_title" msgid="6914461147844949044">"បើកប៊្លូធូស​នៅក្នុង​មុខងារពេលជិះយន្តហោះ"</string>
+    <string name="bluetooth_enabled_apm_message" msgid="8409900562494838113">"ប្រសិនបើអ្នក​បើកប៊្លូធូស នោះទូរសព្ទ​របស់អ្នកនឹង​ចាំថាត្រូវបើកវា នៅលើកក្រោយ​ដែលអ្នកស្ថិតក្នុង​មុខងារពេលជិះយន្តហោះ"</string>
+    <string name="bluetooth_stays_on_title" msgid="39720820955212918">"ប៊្លូធូសបន្តបើក"</string>
+    <string name="bluetooth_stays_on_message" msgid="7142453371222249965">"ទូរសព្ទរបស់អ្នក​ចាំថាត្រូវបើកប៊្លូធូស​នៅក្នុង​មុខងារពេលជិះយន្តហោះ។ បិទប៊្លូធូស ប្រសិនបើអ្នក​មិនចង់បើកទេ។"</string>
+    <string name="bluetooth_and_wifi_stays_on_title" msgid="5821932798860821244">"Wi-Fi និងប៊្លូធូស​បន្តបើក"</string>
+    <string name="bluetooth_and_wifi_stays_on_message" msgid="2390749828997719812">"ទូរសព្ទរបស់អ្នក​ចាំថាត្រូវបើក Wi-Fi និងប៊្លូធូស​នៅក្នុង​មុខងារពេលជិះយន្តហោះ។ បិទ Wi-Fi និង​ប៊្លូធូស ប្រសិនបើអ្នក​មិនចង់បើកទេ។"</string>
 </resources>
diff --git a/android/app/res/values-kn/strings.xml b/android/app/res/values-kn/strings.xml
index 156f83a..e9d376d 100644
--- a/android/app/res/values-kn/strings.xml
+++ b/android/app/res/values-kn/strings.xml
@@ -128,4 +128,10 @@
     <string name="a2dp_sink_mbs_label" msgid="6035366346569127155">"ಬ್ಲೂಟೂತ್‌ ಆಡಿಯೋ"</string>
     <string name="bluetooth_opp_file_limit_exceeded" msgid="6612109860149473930">"4GB ಗಿಂತ ದೊಡ್ಡದಾದ ಫೈಲ್‌ಗಳನ್ನು ವರ್ಗಾಯಿಸಲು ಸಾಧ್ಯವಿಲ್ಲ"</string>
     <string name="bluetooth_connect_action" msgid="2319449093046720209">"ಬ್ಲೂಟೂತ್‌ಗೆ ಕನೆಕ್ಟ್ ಮಾಡಿ"</string>
+    <string name="bluetooth_enabled_apm_title" msgid="6914461147844949044">"ಏರ್‌ಪ್ಲೇನ್ ಮೋಡ್‌ನಲ್ಲಿ ಬ್ಲೂಟೂತ್ ಆನ್ ಆಗಿದೆ"</string>
+    <string name="bluetooth_enabled_apm_message" msgid="8409900562494838113">"ನೀವು ಬ್ಲೂಟೂತ್ ಆನ್ ಆಗಿರಿಸಿದರೆ, ಮುಂದಿನ ಬಾರಿ ನೀವು ಏರ್‌ಪ್ಲೇನ್ ಮೋಡ್‌ನಲ್ಲಿರುವಾಗ ಅದನ್ನು ಆನ್ ಆಗಿರಿಸಿಕೊಳ್ಳುವುದನ್ನು ನಿಮ್ಮ ಫೋನ್ ನೆನಪಿಸಿಕೊಳ್ಳುತ್ತದೆ"</string>
+    <string name="bluetooth_stays_on_title" msgid="39720820955212918">"ಬ್ಲೂಟೂತ್ ಆನ್ ಆಗಿರುತ್ತದೆ"</string>
+    <string name="bluetooth_stays_on_message" msgid="7142453371222249965">"ಏರ್‌ಪ್ಲೇನ್ ಮೋಡ್‌ನಲ್ಲಿ ಬ್ಲೂಟೂತ್ ಆನ್ ಆಗಿರಿಸಿಕೊಳ್ಳುವುದನ್ನು ನಿಮ್ಮ ಫೋನ್ ನೆನಪಿಸಿಕೊಳ್ಳುತ್ತದೆ. ಬ್ಲೂಟೂತ್ ಆನ್ ಆಗಿರಿಸಲು ನೀವು ಬಯಸದಿದ್ದರೆ ಅದನ್ನು ಆಫ್ ಮಾಡಿ."</string>
+    <string name="bluetooth_and_wifi_stays_on_title" msgid="5821932798860821244">"ವೈ-ಫೈ ಮತ್ತು ಬ್ಲೂಟೂತ್ ಆನ್ ಆಗಿರುತ್ತದೆ"</string>
+    <string name="bluetooth_and_wifi_stays_on_message" msgid="2390749828997719812">"ಏರ್‌ಪ್ಲೇನ್ ಮೋಡ್‌ನಲ್ಲಿ ವೈಫೈ ಮತ್ತು ಬ್ಲೂಟೂತ್ ಆನ್ ಆಗಿರಿಸಿಕೊಳ್ಳುವುದನ್ನು ನಿಮ್ಮ ಫೋನ್ ನೆನಪಿಸಿಕೊಳ್ಳುತ್ತದೆ. ವೈಫೈ ಮತ್ತು ಬ್ಲೂಟೂತ್ ಆನ್ ಆಗಿರಿಸಲು ನೀವು ಬಯಸದಿದ್ದರೆ ಅವುಗಳನ್ನು ಆಫ್ ಮಾಡಿ."</string>
 </resources>
diff --git a/android/app/res/values-ko/strings.xml b/android/app/res/values-ko/strings.xml
index 964103a..4a9c63f 100644
--- a/android/app/res/values-ko/strings.xml
+++ b/android/app/res/values-ko/strings.xml
@@ -128,4 +128,10 @@
     <string name="a2dp_sink_mbs_label" msgid="6035366346569127155">"블루투스 오디오"</string>
     <string name="bluetooth_opp_file_limit_exceeded" msgid="6612109860149473930">"4GB보다 큰 파일은 전송할 수 없습니다"</string>
     <string name="bluetooth_connect_action" msgid="2319449093046720209">"블루투스에 연결"</string>
+    <string name="bluetooth_enabled_apm_title" msgid="6914461147844949044">"비행기 모드에서 블루투스 사용 설정"</string>
+    <string name="bluetooth_enabled_apm_message" msgid="8409900562494838113">"블루투스를 켜진 상태로 유지하면 다음에 비행기 모드를 사용할 때도 블루투스 연결이 유지됩니다."</string>
+    <string name="bluetooth_stays_on_title" msgid="39720820955212918">"블루투스가 켜진 상태로 유지됨"</string>
+    <string name="bluetooth_stays_on_message" msgid="7142453371222249965">"휴대전화가 비행기 모드에서 블루투스를 켜진 상태로 유지합니다. 유지하지 않으려면 블루투스를 사용 중지하세요."</string>
+    <string name="bluetooth_and_wifi_stays_on_title" msgid="5821932798860821244">"Wi-Fi 및 블루투스 계속 사용"</string>
+    <string name="bluetooth_and_wifi_stays_on_message" msgid="2390749828997719812">"휴대전화가 비행기 모드에서 Wi-Fi 및 블루투스를 켜진 상태로 유지합니다. 유지하지 않으려면 Wi-Fi와 블루투스를 사용 중지하세요."</string>
 </resources>
diff --git a/android/app/res/values-ky/strings.xml b/android/app/res/values-ky/strings.xml
index 3aa9af4..014f3c5 100644
--- a/android/app/res/values-ky/strings.xml
+++ b/android/app/res/values-ky/strings.xml
@@ -121,11 +121,17 @@
     <string name="bluetooth_map_settings_intro" msgid="4748160773998753325">"Bluetooth аркылуу бөлүшө турган аккаунттарды тандаңыз. Туташкан сайын аккаунттарга кирүүгө уруксат берип турушуңуз керек."</string>
     <string name="bluetooth_map_settings_count" msgid="183013143617807702">"Калган көзөнөктөр:"</string>
     <string name="bluetooth_map_settings_app_icon" msgid="3501432663809664982">"Колдонмонун сүрөтчөсү"</string>
-    <string name="bluetooth_map_settings_title" msgid="4226030082708590023">"Bluetooth билдирүү бөлүшүү жөндөөлөрү"</string>
+    <string name="bluetooth_map_settings_title" msgid="4226030082708590023">"Bluetooth билдирүү бөлүшүү параметрлери"</string>
     <string name="bluetooth_map_settings_no_account_slots_left" msgid="755024228476065757">"Аккаунт тандалбай жатат: 0 орун калды"</string>
     <string name="bluetooth_connected" msgid="5687474377090799447">"Bluetooth аудио туташты"</string>
     <string name="bluetooth_disconnected" msgid="6841396291728343534">"Bluetooth аудио ажыратылды"</string>
     <string name="a2dp_sink_mbs_label" msgid="6035366346569127155">"Bluetooth аудио"</string>
     <string name="bluetooth_opp_file_limit_exceeded" msgid="6612109860149473930">"4Гб чоң файлдарды өткөрүү мүмкүн эмес"</string>
     <string name="bluetooth_connect_action" msgid="2319449093046720209">"Bluetooth\'га туташуу"</string>
+    <string name="bluetooth_enabled_apm_title" msgid="6914461147844949044">"Учак режиминде Bluetooth күйүк"</string>
+    <string name="bluetooth_enabled_apm_message" msgid="8409900562494838113">"Эгер Bluetooth күйүк бойдон калса, кийинки жолу учак режимине өткөнүңүздө телефонуңуз аны эстеп калат"</string>
+    <string name="bluetooth_stays_on_title" msgid="39720820955212918">"Bluetooth күйүк бойдон калат"</string>
+    <string name="bluetooth_stays_on_message" msgid="7142453371222249965">"Телефонуңуз учак режиминде Bluetooth\'га туташкан бойдон калат. Кааласаңыз, Bluetooth\'ду өчүрүп койсоңуз болот."</string>
+    <string name="bluetooth_and_wifi_stays_on_title" msgid="5821932798860821244">"Wi-Fi менен Bluetooth күйүк бойдон калат"</string>
+    <string name="bluetooth_and_wifi_stays_on_message" msgid="2390749828997719812">"Телефонуңуз учак режиминде Wi‑Fi\'га жана Bluetooth\'га туташкан бойдон калат. Кааласаңыз, Wi-Fi менен Bluetooth\'ду өчүрүп койсоңуз болот."</string>
 </resources>
diff --git a/android/app/res/values-lo/strings.xml b/android/app/res/values-lo/strings.xml
index b1eb096..0dcbeb7 100644
--- a/android/app/res/values-lo/strings.xml
+++ b/android/app/res/values-lo/strings.xml
@@ -128,4 +128,10 @@
     <string name="a2dp_sink_mbs_label" msgid="6035366346569127155">"ສຽງ Bluetooth"</string>
     <string name="bluetooth_opp_file_limit_exceeded" msgid="6612109860149473930">"ບໍ່ສາມາດໂອນຍ້າຍໄຟລ໌ທີ່ໃຫຍກວ່າ 4GB ໄດ້"</string>
     <string name="bluetooth_connect_action" msgid="2319449093046720209">"ເຊື່ອມຕໍ່ກັບ Bluetooth"</string>
+    <string name="bluetooth_enabled_apm_title" msgid="6914461147844949044">"ເປີດ Bluetooth ໃນໂໝດຢູ່ໃນຍົນ"</string>
+    <string name="bluetooth_enabled_apm_message" msgid="8409900562494838113">"ຫາກທ່ານເປີດ Bluetooth ປະໄວ້, ໂທລະສັບຂອງທ່ານຈະຈື່ວ່າຕ້ອງເປີດ Wi‑Fi ໃນເທື່ອຕໍ່ໄປທີ່ທ່ານຢູ່ໃນໂໝດຢູ່ໃນຍົນ"</string>
+    <string name="bluetooth_stays_on_title" msgid="39720820955212918">"Bluetooth ເປີດຢູ່"</string>
+    <string name="bluetooth_stays_on_message" msgid="7142453371222249965">"ໂທລະສັບຂອງທ່ານຈື່ວ່າຈະຕ້ອງເປີດ Bluetooth ປະໄວ້ໃນໂໝດຢູ່ໃນຍົນ. ປິດ Bluetooth ຫາກທ່ານບໍ່ຕ້ອງການໃຫ້ເປີດປະໄວ້."</string>
+    <string name="bluetooth_and_wifi_stays_on_title" msgid="5821932798860821244">"Wi-Fi ແລະ Bluetooth ຈະເປີດປະໄວ້"</string>
+    <string name="bluetooth_and_wifi_stays_on_message" msgid="2390749828997719812">"ໂທລະສັບຂອງທ່ານຈື່ວ່າຈະຕ້ອງເປີດ Wi-Fi ແລະ Bluetooth ປະໄວ້ໃນໂໝດຢູ່ໃນຍົນ. ປິດ Wi-Fi ແລະ Bluetooth ຫາກທ່ານບໍ່ຕ້ອງການໃຫ້ເປີດປະໄວ້."</string>
 </resources>
diff --git a/android/app/res/values-lt/strings.xml b/android/app/res/values-lt/strings.xml
index d29f103..f7972c0 100644
--- a/android/app/res/values-lt/strings.xml
+++ b/android/app/res/values-lt/strings.xml
@@ -128,4 +128,10 @@
     <string name="a2dp_sink_mbs_label" msgid="6035366346569127155">"„Bluetooth“ garsas"</string>
     <string name="bluetooth_opp_file_limit_exceeded" msgid="6612109860149473930">"Negalima perkelti didesnių nei 4 GB failų"</string>
     <string name="bluetooth_connect_action" msgid="2319449093046720209">"Prisijungti prie „Bluetooth“"</string>
+    <string name="bluetooth_enabled_apm_title" msgid="6914461147844949044">"„Bluetooth“ ryšys įjungtas lėktuvo režimu"</string>
+    <string name="bluetooth_enabled_apm_message" msgid="8409900562494838113">"Jei paliksite „Bluetooth“ ryšį įjungtą, telefonas, prisimins palikti jį įjungtą, kai kitą kartą įjungsite lėktuvo režimą"</string>
+    <string name="bluetooth_stays_on_title" msgid="39720820955212918">"„Bluetooth“ liks įjungtas"</string>
+    <string name="bluetooth_stays_on_message" msgid="7142453371222249965">"Telefonas prisimena, kad naudojant lėktuvo režimą reikia palikti įjungtą „Bluetooth“ ryšį. Išjunkite „Bluetooth“, jei nenorite, kad jis liktų įjungtas."</string>
+    <string name="bluetooth_and_wifi_stays_on_title" msgid="5821932798860821244">"„Wi‑Fi“ ir „Bluetooth“ ryšys lieka įjungtas"</string>
+    <string name="bluetooth_and_wifi_stays_on_message" msgid="2390749828997719812">"Telefonas prisimena, kad lėktuvo režimu reikia palikti įjungtą „Wi‑Fi“ ir „Bluetooth“ ryšį. Išjunkite „Wi-Fi“ ir „Bluetooth“, jei nenorite, kad jie liktų įjungti."</string>
 </resources>
diff --git a/android/app/res/values-lv/strings.xml b/android/app/res/values-lv/strings.xml
index a250dcf..9f82823 100644
--- a/android/app/res/values-lv/strings.xml
+++ b/android/app/res/values-lv/strings.xml
@@ -128,4 +128,10 @@
     <string name="a2dp_sink_mbs_label" msgid="6035366346569127155">"Bluetooth audio"</string>
     <string name="bluetooth_opp_file_limit_exceeded" msgid="6612109860149473930">"Nevar pārsūtīt failus, kas lielāki par 4 GB."</string>
     <string name="bluetooth_connect_action" msgid="2319449093046720209">"Izveidot savienojumu ar Bluetooth"</string>
+    <string name="bluetooth_enabled_apm_title" msgid="6914461147844949044">"Tehnoloģija Bluetooth lidojuma režīmā paliek ieslēgta"</string>
+    <string name="bluetooth_enabled_apm_message" msgid="8409900562494838113">"Ja Bluetooth savienojums paliks ieslēgts, tālrunī tas paliks ieslēgts arī nākamreiz, kad ieslēgsiet lidojuma režīmu."</string>
+    <string name="bluetooth_stays_on_title" msgid="39720820955212918">"Bluetooth savienojums joprojām ir ieslēgts"</string>
+    <string name="bluetooth_stays_on_message" msgid="7142453371222249965">"Lidojuma režīmā tālrunī joprojām būs ieslēgts Bluetooth savienojums. Izslēdziet Bluetooth savienojumu, ja nevēlaties, lai tas paliktu ieslēgts."</string>
+    <string name="bluetooth_and_wifi_stays_on_title" msgid="5821932798860821244">"Wi-Fi savienojums un tehnoloģija Bluetooth paliek ieslēgta"</string>
+    <string name="bluetooth_and_wifi_stays_on_message" msgid="2390749828997719812">"Lidojuma režīmā tālrunī joprojām būs ieslēgti Wi-Fi un Bluetooth savienojumi. Izslēdziet Wi-Fi un Bluetooth savienojumus, ja nevēlaties, lai tie paliktu ieslēgti."</string>
 </resources>
diff --git a/android/app/res/values-mk/strings.xml b/android/app/res/values-mk/strings.xml
index ee0b200..b580d37 100644
--- a/android/app/res/values-mk/strings.xml
+++ b/android/app/res/values-mk/strings.xml
@@ -128,4 +128,10 @@
     <string name="a2dp_sink_mbs_label" msgid="6035366346569127155">"Аудио преку Bluetooth"</string>
     <string name="bluetooth_opp_file_limit_exceeded" msgid="6612109860149473930">"Не може да се пренесуваат датотеки поголеми од 4 GB"</string>
     <string name="bluetooth_connect_action" msgid="2319449093046720209">"Поврзи се со Bluetooth"</string>
+    <string name="bluetooth_enabled_apm_title" msgid="6914461147844949044">"Вклучен Bluetooth во авионски режим"</string>
+    <string name="bluetooth_enabled_apm_message" msgid="8409900562494838113">"Ако го оставите Bluetooth вклучен, телефонот ќе запомни да го остави вклучен до следниот пат кога ќе бидете во авионски режим"</string>
+    <string name="bluetooth_stays_on_title" msgid="39720820955212918">"Bluetooth останува вклучен"</string>
+    <string name="bluetooth_stays_on_message" msgid="7142453371222249965">"Телефонот помни да го задржи Bluetooth вклучен во авионски режим. Исклучете го Bluetooth ако не сакате да остане вклучен."</string>
+    <string name="bluetooth_and_wifi_stays_on_title" msgid="5821932798860821244">"Wi-Fi и Bluetooth остануваат вклучени"</string>
+    <string name="bluetooth_and_wifi_stays_on_message" msgid="2390749828997719812">"Телефонот помни да ги задржи Wi‑Fi и Bluetooth вклучени во авионски режим. Исклучете ги Wi-Fi и Bluetooth ако не сакате да бидат вклучени."</string>
 </resources>
diff --git a/android/app/res/values-ml/strings.xml b/android/app/res/values-ml/strings.xml
index 25f1a12..e511d2c 100644
--- a/android/app/res/values-ml/strings.xml
+++ b/android/app/res/values-ml/strings.xml
@@ -128,4 +128,10 @@
     <string name="a2dp_sink_mbs_label" msgid="6035366346569127155">"Bluetooth ഓഡിയോ"</string>
     <string name="bluetooth_opp_file_limit_exceeded" msgid="6612109860149473930">"4GB-യിൽ കൂടുതലുള്ള ഫയലുകൾ കൈമാറാനാവില്ല"</string>
     <string name="bluetooth_connect_action" msgid="2319449093046720209">"Bluetooth-ലേക്ക് കണക്‌റ്റ് ചെയ്യുക"</string>
+    <string name="bluetooth_enabled_apm_title" msgid="6914461147844949044">"ഫ്ലൈറ്റ് മോഡിൽ Bluetooth ഓണാണ്"</string>
+    <string name="bluetooth_enabled_apm_message" msgid="8409900562494838113">"Bluetooth ഓണാക്കി വച്ചാൽ, അടുത്ത തവണ നിങ്ങൾ ഫ്ലൈറ്റ് മോഡിൽ ആയിരിക്കുമ്പോൾ നിങ്ങളുടെ ഫോൺ അത് ഓണാക്കി വയ്ക്കാൻ ഓർക്കും"</string>
+    <string name="bluetooth_stays_on_title" msgid="39720820955212918">"Bluetooth ഓണാക്കിയ നിലയിൽ തുടരും"</string>
+    <string name="bluetooth_stays_on_message" msgid="7142453371222249965">"ഫ്ലൈറ്റ് മോഡിലായിരിക്കുമ്പോൾ Bluetooth ഓണാക്കി വയ്ക്കാൻ നിങ്ങളുടെ ഫോൺ ഓർമ്മിക്കുന്നു. Bluetooth ഓണാക്കി വയ്ക്കാൻ താൽപ്പര്യമില്ലെങ്കിൽ അത് ഓഫാക്കുക."</string>
+    <string name="bluetooth_and_wifi_stays_on_title" msgid="5821932798860821244">"വൈഫൈ, Bluetooth എന്നിവ ഓണായ നിലയിൽ തുടരും"</string>
+    <string name="bluetooth_and_wifi_stays_on_message" msgid="2390749828997719812">"ഫ്ലൈറ്റ് മോഡിലായിരിക്കുമ്പോൾ വൈഫൈ, Bluetooth എന്നിവ ഓണാക്കി വയ്ക്കാൻ നിങ്ങളുടെ ഫോൺ ഓർമ്മിക്കുന്നു. വൈഫൈ, Bluetooth എന്നിവ ഓണാക്കി വയ്‌ക്കാൻ താൽപ്പര്യമില്ലെങ്കിൽ അവ ഓഫാക്കുക."</string>
 </resources>
diff --git a/android/app/res/values-mn/strings.xml b/android/app/res/values-mn/strings.xml
index 6eaec12..0eb7701 100644
--- a/android/app/res/values-mn/strings.xml
+++ b/android/app/res/values-mn/strings.xml
@@ -128,4 +128,10 @@
     <string name="a2dp_sink_mbs_label" msgid="6035366346569127155">"Bluetooth Аудио"</string>
     <string name="bluetooth_opp_file_limit_exceeded" msgid="6612109860149473930">"4ГБ-с дээш хэмжээтэй файлыг шилжүүлэх боломжгүй"</string>
     <string name="bluetooth_connect_action" msgid="2319449093046720209">"Bluetooth-тэй холбогдох"</string>
+    <string name="bluetooth_enabled_apm_title" msgid="6914461147844949044">"Нислэгийн горимд Bluetooth асаалттай"</string>
+    <string name="bluetooth_enabled_apm_message" msgid="8409900562494838113">"Хэрэв та Bluetooth-г асаалттай байлгавал таныг дараагийн удаа нислэгийн горимд байх үед утас тань үүнийг асаалттай байлгахыг санана"</string>
+    <string name="bluetooth_stays_on_title" msgid="39720820955212918">"Bluetooth асаалттай хэвээр байна"</string>
+    <string name="bluetooth_stays_on_message" msgid="7142453371222249965">"Таны утас Bluetooth-г нислэгийн горимд асаалттай байлгахыг санана. Хэрэв та асаалттай байлгахыг хүсэхгүй байгаа бол Bluetooth-г унтрааж болно."</string>
+    <string name="bluetooth_and_wifi_stays_on_title" msgid="5821932798860821244">"Wi-Fi болон Bluetooth асаалттай хэвээр байна"</string>
+    <string name="bluetooth_and_wifi_stays_on_message" msgid="2390749828997719812">"Таны утас Wi-Fi болон Bluetooth-г нислэгийн горимд асаалттай байлгахыг санана. Хэрэв та асаалттай байлгахыг хүсэхгүй байгаа бол Wi-Fi болон Bluetooth-г унтрааж болно."</string>
 </resources>
diff --git a/android/app/res/values-mr/strings.xml b/android/app/res/values-mr/strings.xml
index 956aeb7..ade0759 100644
--- a/android/app/res/values-mr/strings.xml
+++ b/android/app/res/values-mr/strings.xml
@@ -128,4 +128,10 @@
     <string name="a2dp_sink_mbs_label" msgid="6035366346569127155">"ब्लूटूथ ऑडिओ"</string>
     <string name="bluetooth_opp_file_limit_exceeded" msgid="6612109860149473930">"4 GB हून मोठ्या फाइल ट्रान्सफर करता येणार नाहीत"</string>
     <string name="bluetooth_connect_action" msgid="2319449093046720209">"ब्लूटूथशी कनेक्ट करा"</string>
+    <string name="bluetooth_enabled_apm_title" msgid="6914461147844949044">"विमान मोडमध्ये ब्लूटूथ सुरू आहे"</string>
+    <string name="bluetooth_enabled_apm_message" msgid="8409900562494838113">"तुम्ही ब्लूटूथ सुरू ठेवल्यास, पुढील वेळी विमान मोडमध्ये असाल, तेव्हा तुमचा फोन ते सुरू ठेवण्याचे लक्षात ठेवेल"</string>
+    <string name="bluetooth_stays_on_title" msgid="39720820955212918">"ब्लूटूथ सुरू राहते"</string>
+    <string name="bluetooth_stays_on_message" msgid="7142453371222249965">"तुमचा फोन विमान मोडमध्ये ब्लूटूथ सुरू ठेवण्याचे लक्षात ठेवतो. तुम्हाला ब्लूटूथ सुरू ठेवायचे नसल्यास ते बंद करा."</string>
+    <string name="bluetooth_and_wifi_stays_on_title" msgid="5821932798860821244">"वाय-फाय आणि ब्लूटूथ सुरू राहते"</string>
+    <string name="bluetooth_and_wifi_stays_on_message" msgid="2390749828997719812">"तुमचा फोन विमान मोडमध्ये वाय-फाय आणि ब्लूटूथ सुरू ठेवण्याचे लक्षात ठेवतो. तुम्हाला वाय-फाय आणि ब्लूटूथ सुरू ठेवायचे नसल्यास ते बंद करा."</string>
 </resources>
diff --git a/android/app/res/values-ms/strings.xml b/android/app/res/values-ms/strings.xml
index b79a9c3..07d1f3a 100644
--- a/android/app/res/values-ms/strings.xml
+++ b/android/app/res/values-ms/strings.xml
@@ -128,4 +128,10 @@
     <string name="a2dp_sink_mbs_label" msgid="6035366346569127155">"Audio Bluetooth"</string>
     <string name="bluetooth_opp_file_limit_exceeded" msgid="6612109860149473930">"Fail lebih besar daripada 4GB tidak boleh dipindahkan"</string>
     <string name="bluetooth_connect_action" msgid="2319449093046720209">"Sambung ke Bluetooth"</string>
+    <string name="bluetooth_enabled_apm_title" msgid="6914461147844949044">"Bluetooth dihidupkan dalam mod pesawat"</string>
+    <string name="bluetooth_enabled_apm_message" msgid="8409900562494838113">"Jika anda terus menghidupkan Bluetooth, telefon anda akan ingat untuk membiarkan Bluetooth hidup pada kali seterusnya telefon anda berada dalam mod pesawat"</string>
+    <string name="bluetooth_stays_on_title" msgid="39720820955212918">"Bluetooth kekal dihidupkan"</string>
+    <string name="bluetooth_stays_on_message" msgid="7142453371222249965">"Telefon anda diingatkan untuk terus menghidupkan Bluetooth dalam mod pesawat. Matikan Bluetooth jika anda tidak mahu Bluetooth sentiasa hidup."</string>
+    <string name="bluetooth_and_wifi_stays_on_title" msgid="5821932798860821244">"Wi-Fi dan Bluetooth kekal dihidupkan"</string>
+    <string name="bluetooth_and_wifi_stays_on_message" msgid="2390749828997719812">"Telefon anda diingatkan untuk terus menghidupkan Wi-Fi dan Bluetooth dalam mod pesawat. Matikan Wi-Fi dan Bluetooth jika anda tidak mahu Wi-Fi dan Bluetooth sentiasa hidup."</string>
 </resources>
diff --git a/android/app/res/values-my/strings.xml b/android/app/res/values-my/strings.xml
index 692d1c0..b7c523d 100644
--- a/android/app/res/values-my/strings.xml
+++ b/android/app/res/values-my/strings.xml
@@ -128,4 +128,10 @@
     <string name="a2dp_sink_mbs_label" msgid="6035366346569127155">"ဘလူးတုသ် အသံ"</string>
     <string name="bluetooth_opp_file_limit_exceeded" msgid="6612109860149473930">"4GB ထက်ပိုကြီးသည့် ဖိုင်များကို လွှဲပြောင်းမရနိုင်ပါ"</string>
     <string name="bluetooth_connect_action" msgid="2319449093046720209">"ဘလူးတုသ်သို့ ချိတ်ဆက်ရန်"</string>
+    <string name="bluetooth_enabled_apm_title" msgid="6914461147844949044">"လေယာဉ်ပျံမုဒ်တွင် ဘလူးတုသ် ပွင့်နေသည်"</string>
+    <string name="bluetooth_enabled_apm_message" msgid="8409900562494838113">"ဘလူးတုသ် ဆက်ဖွင့်ထားပါက နောက်တစ်ကြိမ်လေယာဉ်ပျံမုဒ် သုံးချိန်တွင် ၎င်းဆက်ဖွင့်ရန် သင့်ဖုန်းက မှတ်ထားမည်။"</string>
+    <string name="bluetooth_stays_on_title" msgid="39720820955212918">"ဘလူးတုသ် ဆက်ပွင့်နေသည်"</string>
+    <string name="bluetooth_stays_on_message" msgid="7142453371222249965">"လေယာဉ်ပျံမုဒ်သုံးစဉ် ဘလူးတုသ် ဆက်ဖွင့်ထားရန် သင့်ဖုန်းက မှတ်မိသည်။ ဘလူးတုသ် ဆက်ဖွင့်မထားလိုပါက ပိတ်နိုင်သည်။"</string>
+    <string name="bluetooth_and_wifi_stays_on_title" msgid="5821932798860821244">"Wi-Fi နှင့် ဘလူးတုသ် ဆက်ဖွင့်ထားသည်"</string>
+    <string name="bluetooth_and_wifi_stays_on_message" msgid="2390749828997719812">"လေယာဉ်ပျံမုဒ်သုံးစဉ် Wi-Fi နှင့် ဘလူးတုသ် ဆက်ဖွင့်ထားရန် သင့်ဖုန်းက မှတ်မိသည်။ Wi-Fi နှင့် ဘလူးတုသ် ဆက်ဖွင့်မထားလိုပါက ပိတ်နိုင်သည်။"</string>
 </resources>
diff --git a/android/app/res/values-nb/strings.xml b/android/app/res/values-nb/strings.xml
index 91f1b1f..8c97581 100644
--- a/android/app/res/values-nb/strings.xml
+++ b/android/app/res/values-nb/strings.xml
@@ -128,4 +128,10 @@
     <string name="a2dp_sink_mbs_label" msgid="6035366346569127155">"Bluetooth-lyd"</string>
     <string name="bluetooth_opp_file_limit_exceeded" msgid="6612109860149473930">"Filer som er større enn 4 GB, kan ikke overføres"</string>
     <string name="bluetooth_connect_action" msgid="2319449093046720209">"Koble til Bluetooth"</string>
+    <string name="bluetooth_enabled_apm_title" msgid="6914461147844949044">"Bluetooth er på i flymodus"</string>
+    <string name="bluetooth_enabled_apm_message" msgid="8409900562494838113">"Hvis du lar Bluetooth være på, husker telefonen dette til den neste gangen du bruker flymodus"</string>
+    <string name="bluetooth_stays_on_title" msgid="39720820955212918">"Bluetooth blir værende på"</string>
+    <string name="bluetooth_stays_on_message" msgid="7142453371222249965">"Telefonen husker at Bluetooth skal være på i flymodus. Slå av Bluetooth hvis du ikke vil at det skal være på."</string>
+    <string name="bluetooth_and_wifi_stays_on_title" msgid="5821932798860821244">"Wifi og Bluetooth holdes påslått"</string>
+    <string name="bluetooth_and_wifi_stays_on_message" msgid="2390749828997719812">"Telefonen husker at wifi og Bluetooth skal være på i flymodus. Slå av wifi og Bluetooth hvis du ikke vil at de skal være på."</string>
 </resources>
diff --git a/android/app/res/values-ne/strings.xml b/android/app/res/values-ne/strings.xml
index a2b029a..67e0bf8 100644
--- a/android/app/res/values-ne/strings.xml
+++ b/android/app/res/values-ne/strings.xml
@@ -128,4 +128,10 @@
     <string name="a2dp_sink_mbs_label" msgid="6035366346569127155">"ब्लुटुथको अडियो"</string>
     <string name="bluetooth_opp_file_limit_exceeded" msgid="6612109860149473930">"४ जि.बि. भन्दा ठूला फाइलहरूलाई स्थानान्तरण गर्न सकिँदैन"</string>
     <string name="bluetooth_connect_action" msgid="2319449093046720209">"ब्लुटुथमा कनेक्ट गर्नुहोस्"</string>
+    <string name="bluetooth_enabled_apm_title" msgid="6914461147844949044">"हवाइजहाज मोडमा ब्लुटुथ अन राखियोस्"</string>
+    <string name="bluetooth_enabled_apm_message" msgid="8409900562494838113">"तपाईंले ब्लुटुथ अन राखिराख्नुभयो भने तपाईंले आफ्नो फोन अर्को पटक हवाइजहाज मोडमा लैजाँदा तपाईंको फोनले ब्लुटुथ अन राख्नु पर्ने कुरा याद गर्छ"</string>
+    <string name="bluetooth_stays_on_title" msgid="39720820955212918">"ब्लुटुथ अन रहन्छ"</string>
+    <string name="bluetooth_stays_on_message" msgid="7142453371222249965">"तपाईंको फोन अर्को पटक हवाइजहाज मोडमा लैजाँदा तपाईंको फोनले ब्लुटुथ अन राख्नु पर्ने कुरा याद गर्छ तपाईं ब्लुटुथ अन भइनरहोस् भन्ने चाहनुहुन्छ भने ब्लुटुथ अफ गर्नुहोस्।"</string>
+    <string name="bluetooth_and_wifi_stays_on_title" msgid="5821932798860821244">"Wi-Fi र ब्लुटुथ अन रहिरहने छन्"</string>
+    <string name="bluetooth_and_wifi_stays_on_message" msgid="2390749828997719812">"हवाइजहाज मोडमा पनि तपाईंको फोनको Wi-Fi र ब्लुटुथ अन नै रहिरहने छन्। तपाईं Wi-Fi र ब्लुटुथ अन भइनरहोस् भन्ने चाहनुहुन्छ भने तिनलाई अफ गर्नुहोस्।"</string>
 </resources>
diff --git a/android/app/res/values-nl/strings.xml b/android/app/res/values-nl/strings.xml
index f8cfb8b..83493b1 100644
--- a/android/app/res/values-nl/strings.xml
+++ b/android/app/res/values-nl/strings.xml
@@ -128,4 +128,10 @@
     <string name="a2dp_sink_mbs_label" msgid="6035366346569127155">"Bluetooth-audio"</string>
     <string name="bluetooth_opp_file_limit_exceeded" msgid="6612109860149473930">"Bestanden groter dan 4 GB kunnen niet worden overgedragen"</string>
     <string name="bluetooth_connect_action" msgid="2319449093046720209">"Verbinding maken met bluetooth"</string>
+    <string name="bluetooth_enabled_apm_title" msgid="6914461147844949044">"Bluetooth aan in de vliegtuigmodus"</string>
+    <string name="bluetooth_enabled_apm_message" msgid="8409900562494838113">"Als je bluetooth laat aanstaan, onthoudt je telefoon dit en blijft bluetooth aanstaan als je de vliegtuigmodus weer aanzet"</string>
+    <string name="bluetooth_stays_on_title" msgid="39720820955212918">"Bluetooth blijft aan"</string>
+    <string name="bluetooth_stays_on_message" msgid="7142453371222249965">"Bluetooth op je telefoon blijft aan in de vliegtuigmodus. Zet bluetooth uit als je niet wilt dat dit aan blijft."</string>
+    <string name="bluetooth_and_wifi_stays_on_title" msgid="5821932798860821244">"Wifi en bluetooth blijven aan"</string>
+    <string name="bluetooth_and_wifi_stays_on_message" msgid="2390749828997719812">"Wifi en bluetooth op je telefoon blijven aan in de vliegtuigmodus. Zet wifi en bluetooth uit als je niet wilt dat ze aan blijven."</string>
 </resources>
diff --git a/android/app/res/values-or/strings.xml b/android/app/res/values-or/strings.xml
index 206bde2..66ecc7d 100644
--- a/android/app/res/values-or/strings.xml
+++ b/android/app/res/values-or/strings.xml
@@ -19,7 +19,7 @@
     <string name="permlab_bluetoothShareManager" msgid="5297865456717871041">"ଡାଉନଲୋଡ ମ୍ୟାନେଜର୍‌କୁ ଆକ୍ସେସ୍‌ କରନ୍ତୁ।"</string>
     <string name="permdesc_bluetoothShareManager" msgid="1588034776955941477">"BluetoothShare ମ୍ୟାନେଜର୍‌ ଆକ୍ସେସ୍‌ କରି ଫାଇଲ୍‌ଗୁଡ଼ିକ ଟ୍ରାନ୍ସଫର୍‌ କରିବାକୁ ବ୍ୟବହାର କରିବା ପାଇଁ ଆପ୍‌କୁ ଅନୁମତି ଦିଅନ୍ତୁ।"</string>
     <string name="permlab_bluetoothAcceptlist" msgid="5785922051395856524">"ବ୍ଲୁଟୁଥ୍ ଡିଭାଇସର ଆକ୍ସେସକୁ ଗ୍ରହଣ-ସୂଚୀରେ ରଖନ୍ତୁ।"</string>
-    <string name="permdesc_bluetoothAcceptlist" msgid="259308920158011885">"ଏକ ବ୍ଲୁଟୁଥ୍ ଡିଭାଇସକୁ ଅସ୍ଥାୟୀ ଭାବେ ଗ୍ରହଣ-ସୂଚୀରେ ରଖିବାକୁ ଆପଟିକୁ ଅନୁମତି ଦେଇଥାଏ, ଯାହା ଦ୍ୱାରା ଉପଯୋଗକର୍ତ୍ତାଙ୍କ ସୁନିଶ୍ଚିତକରଣ ବିନା ଏହି ଡିଭାଇସକୁ ଫାଇଲ୍ ପଠାଇବା ପାଇଁ ସେହି ଡିଭାଇସକୁ ଅନୁମତି ମିଳିଥାଏ।"</string>
+    <string name="permdesc_bluetoothAcceptlist" msgid="259308920158011885">"ଏକ ବ୍ଲୁଟୁଥ ଡିଭାଇସକୁ ଅସ୍ଥାୟୀ ଭାବେ ଗ୍ରହଣ-ସୂଚୀରେ ରଖିବାକୁ ଆପଟିକୁ ଅନୁମତି ଦେଇଥାଏ, ଯାହା ଦ୍ୱାରା ୟୁଜରଙ୍କ ସୁନିଶ୍ଚିତକରଣ ବିନା ଏହି ଡିଭାଇସକୁ ଫାଇଲ ପଠାଇବା ପାଇଁ ସେହି ଡିଭାଇସକୁ ଅନୁମତି ମିଳିଥାଏ।"</string>
     <string name="bt_share_picker_label" msgid="7464438494743777696">"ବ୍ଲୁଟୁଥ"</string>
     <string name="unknown_device" msgid="2317679521750821654">"ଅଜଣା ଡିଭାଇସ୍"</string>
     <string name="unknownNumber" msgid="1245183329830158661">"ଅଜଣା"</string>
@@ -92,7 +92,7 @@
     <string name="status_success" msgid="7963589000098719541">"ଫାଇଲ୍‌ ଟ୍ରାନ୍ସଫର୍‌ ସଫଳତାପୂର୍ବକ ସମ୍ପୂର୍ଣ୍ଣ ହେଲା।"</string>
     <string name="status_not_accept" msgid="1165798802740579658">"କଣ୍ଟେଣ୍ଟ ସପୋର୍ଟ କରୁନାହିଁ।"</string>
     <string name="status_forbidden" msgid="4017060451358837245">"ଟାର୍ଗେଟ୍‌ ଡିଭାଇସ୍‌ ଦ୍ୱାରା ଟ୍ରାନ୍ସଫର୍‌ ପ୍ରତିବନ୍ଧିତ କରାଯାଇଛି।"</string>
-    <string name="status_canceled" msgid="8441679418717978515">"ୟୁଜର୍‌ଙ୍କ ଦ୍ୱାରା ଟ୍ରାନ୍ସଫର୍‌ କ୍ୟାନ୍ସଲ୍‌ କରାଗଲା।"</string>
+    <string name="status_canceled" msgid="8441679418717978515">"ୟୁଜରଙ୍କ ଦ୍ୱାରା ଟ୍ରାନ୍ସଫର କେନ୍ସଲ କରାଯାଇଛି।"</string>
     <string name="status_file_error" msgid="5379018888714679311">"ଷ୍ଟୋରେଜ୍‌ ସମସ୍ୟା।"</string>
     <string name="status_no_sd_card_nosdcard" msgid="6445646484924125975">"କୌଣସି USB ଷ୍ଟୋରେଜ୍‌ ନାହିଁ।"</string>
     <string name="status_no_sd_card_default" msgid="8878262565692541241">"କୌଣସି SD କାର୍ଡ ନାହିଁ। ଟ୍ରାନ୍ସଫର୍‌ କରାଯାଇଥିବା ଫାଇଲ୍‌ଗୁଡ଼ିକୁ ସେଭ୍‌ କରିବା ପାଇଁ ଗୋଟିଏ SD କାର୍ଡ ଭର୍ତ୍ତି କରନ୍ତୁ।"</string>
@@ -128,4 +128,10 @@
     <string name="a2dp_sink_mbs_label" msgid="6035366346569127155">"ବ୍ଲୁଟୂଥ୍‍‌ ଅଡିଓ"</string>
     <string name="bluetooth_opp_file_limit_exceeded" msgid="6612109860149473930">"4GBରୁ ବଡ଼ ଫାଇଲ୍‌ଗୁଡ଼ିକୁ ଟ୍ରାନ୍ସଫର୍‌ କରାଯାଇପାରିବ ନାହିଁ"</string>
     <string name="bluetooth_connect_action" msgid="2319449093046720209">"ବ୍ଲୁଟୁଥ୍ ସହ ସଂଯୋଗ କରନ୍ତୁ"</string>
+    <string name="bluetooth_enabled_apm_title" msgid="6914461147844949044">"ଏୟାରପ୍ଲେନ ମୋଡରେ ବ୍ଲୁଟୁଥ ଚାଲୁ ଅଛି"</string>
+    <string name="bluetooth_enabled_apm_message" msgid="8409900562494838113">"ଯଦି ଆପଣ ବ୍ଲୁଟୁଥକୁ ଚାଲୁ ରଖନ୍ତି, ତେବେ ଆପଣ ପରବର୍ତ୍ତୀ ଥର ଏୟାରପ୍ଲେନ ମୋଡରେ ଥିବା ସମୟରେ ଆପଣଙ୍କ ଫୋନ ଏହାକୁ ଚାଲୁ ରଖିବା ପାଇଁ ମନେ ରଖିବ"</string>
+    <string name="bluetooth_stays_on_title" msgid="39720820955212918">"ବ୍ଲୁଟୁଥ ଚାଲୁ ରହେ"</string>
+    <string name="bluetooth_stays_on_message" msgid="7142453371222249965">"ଆପଣଙ୍କ ଫୋନ ଏୟାରପ୍ଲେନ ମୋଡରେ ବ୍ଲୁଟୁଥକୁ ଚାଲୁ ରଖିବା ପାଇଁ ମନେ ରଖେ। ଯଦି ଆପଣ ବ୍ଲୁଟୁଥ ଚାଲୁ ରଖିବାକୁ ଚାହାଁନ୍ତି ନାହିଁ ତେବେ ଏହାକୁ ବନ୍ଦ କରନ୍ତୁ।"</string>
+    <string name="bluetooth_and_wifi_stays_on_title" msgid="5821932798860821244">"ୱାଇ-ଫାଇ ଏବଂ ବ୍ଲୁଟୁଥ ଚାଲୁ ରହେ"</string>
+    <string name="bluetooth_and_wifi_stays_on_message" msgid="2390749828997719812">"ଆପଣଙ୍କ ଫୋନ ଏୟାରପ୍ଲେନ ମୋଡରେ ୱାଇ-ଫାଇ ଏବଂ ବ୍ଲୁଟୁଥକୁ ଚାଲୁ ରଖିବା ପାଇଁ ମନେ ରଖେ। ଯଦି ଆପଣ ୱାଇ-ଫାଇ ଏବଂ ବ୍ଲୁଟୁଥ ଚାଲୁ ରଖିବାକୁ ଚାହାଁନ୍ତି ନାହିଁ ତେବେ ସେଗୁଡ଼ିକୁ ବନ୍ଦ କରନ୍ତୁ।"</string>
 </resources>
diff --git a/android/app/res/values-pa/strings.xml b/android/app/res/values-pa/strings.xml
index 8c0f291..13570e1 100644
--- a/android/app/res/values-pa/strings.xml
+++ b/android/app/res/values-pa/strings.xml
@@ -128,4 +128,10 @@
     <string name="a2dp_sink_mbs_label" msgid="6035366346569127155">"ਬਲੂਟੁੱਥ  ਆਡੀਓ"</string>
     <string name="bluetooth_opp_file_limit_exceeded" msgid="6612109860149473930">"4GB ਤੋਂ ਜ਼ਿਆਦਾ ਵੱਡੀਆਂ ਫ਼ਾਈਲਾਂ ਨੂੰ ਟ੍ਰਾਂਸਫ਼ਰ ਨਹੀਂ ਕੀਤਾ ਜਾ ਸਕਦਾ"</string>
     <string name="bluetooth_connect_action" msgid="2319449093046720209">"ਬਲੂਟੁੱਥ ਨਾਲ ਕਨੈਕਟ ਕਰੋ"</string>
+    <string name="bluetooth_enabled_apm_title" msgid="6914461147844949044">"ਹਵਾਈ-ਜਹਾਜ਼ ਮੋਡ ਵਿੱਚ ਬਲੂਟੁੱਥ ਚਾਲੂ ਹੈ"</string>
+    <string name="bluetooth_enabled_apm_message" msgid="8409900562494838113">"ਜੇ ਤੁਸੀਂ ਬਲੂਟੁੱਥ ਨੂੰ ਚਾਲੂ ਰੱਖਦੇ ਹੋ, ਤਾਂ ਅਗਲੀ ਵਾਰ ਤੁਹਾਡਾ ਫ਼ੋਨ ਹਵਾਈ-ਜਹਾਜ਼ ਮੋਡ ਵਿੱਚ ਹੋਣ \'ਤੇ ਤੁਹਾਡਾ ਫ਼ੋਨ ਇਸਨੂੰ ਚਾਲੂ ਰੱਖਣਾ ਯਾਦ ਰੱਖੇਗਾ"</string>
+    <string name="bluetooth_stays_on_title" msgid="39720820955212918">"ਬਲੂਟੁੱਥ ਚਾਲੂ ਰਹਿੰਦਾ ਹੈ"</string>
+    <string name="bluetooth_stays_on_message" msgid="7142453371222249965">"ਤੁਹਾਡਾ ਫ਼ੋਨ ਹਵਾਈ-ਜਹਾਜ਼ ਮੋਡ ਵਿੱਚ ਬਲੂਟੁੱਥ ਨੂੰ ਚਾਲੂ ਰੱਖਣਾ ਯਾਦ ਰੱਖਦਾ ਹੈ। ਜੇ ਤੁਸੀਂ ਇਸਨੂੰ ਚਾਲੂ ਨਹੀਂ ਰੱਖਣਾ ਚਾਹੁੰਦੇ, ਤਾਂ ਬਲੂਟੁੱਥ ਨੂੰ ਬੰਦ ਕਰੋ।"</string>
+    <string name="bluetooth_and_wifi_stays_on_title" msgid="5821932798860821244">"ਵਾਈ-ਫਾਈ ਅਤੇ ਬਲੂਟੁੱਥ ਚਾਲੂ ਰਹਿੰਦੇ ਹਨ"</string>
+    <string name="bluetooth_and_wifi_stays_on_message" msgid="2390749828997719812">"ਤੁਹਾਡਾ ਫ਼ੋਨ ਹਵਾਈ-ਜਹਾਜ਼ ਮੋਡ ਵਿੱਚ ਵਾਈ-ਫਾਈ ਅਤੇ ਬਲੂਟੁੱਥ ਨੂੰ ਚਾਲੂ ਰੱਖਣਾ ਯਾਦ ਰੱਖਦਾ ਹੈ। ਜੇ ਤੁਸੀਂ ਇਨ੍ਹਾਂ ਨੂੰ ਚਾਲੂ ਨਹੀਂ ਰੱਖਣਾ ਚਾਹੁੰਦੇ, ਤਾਂ ਵਾਈ-ਫਾਈ ਅਤੇ ਬਲੂਟੁੱਥ ਨੂੰ ਬੰਦ ਕਰੋ।"</string>
 </resources>
diff --git a/android/app/res/values-pl/strings.xml b/android/app/res/values-pl/strings.xml
index 129805a..eca2def 100644
--- a/android/app/res/values-pl/strings.xml
+++ b/android/app/res/values-pl/strings.xml
@@ -128,4 +128,10 @@
     <string name="a2dp_sink_mbs_label" msgid="6035366346569127155">"Dźwięk Bluetooth"</string>
     <string name="bluetooth_opp_file_limit_exceeded" msgid="6612109860149473930">"Nie można przenieść plików przekraczających 4 GB"</string>
     <string name="bluetooth_connect_action" msgid="2319449093046720209">"Nawiązywanie połączeń przez Bluetooth"</string>
+    <string name="bluetooth_enabled_apm_title" msgid="6914461147844949044">"Bluetooth włączony w trybie samolotowym"</string>
+    <string name="bluetooth_enabled_apm_message" msgid="8409900562494838113">"Jeśli pozostawisz włączony Bluetooth, telefon zachowa się podobnie przy kolejnym przejściu w tryb samolotowy"</string>
+    <string name="bluetooth_stays_on_title" msgid="39720820955212918">"Bluetooth pozostanie włączony"</string>
+    <string name="bluetooth_stays_on_message" msgid="7142453371222249965">"Bluetooth na telefonie pozostaje włączony w trybie samolotowym. Wyłącz Bluetooth, jeśli nie chcesz, żeby pozostawał włączony."</string>
+    <string name="bluetooth_and_wifi_stays_on_title" msgid="5821932798860821244">"Wi-Fi i Bluetooth pozostają włączone"</string>
+    <string name="bluetooth_and_wifi_stays_on_message" msgid="2390749828997719812">"Wi-Fi i Bluetooth na telefonie pozostają włączone w trybie samolotowym. Wyłącz Wi-Fi i Bluetooth, jeśli nie chcesz, żeby funkcje te pozostawały włączone."</string>
 </resources>
diff --git a/android/app/res/values-pt-rPT/strings.xml b/android/app/res/values-pt-rPT/strings.xml
index 524a95b..4469a01 100644
--- a/android/app/res/values-pt-rPT/strings.xml
+++ b/android/app/res/values-pt-rPT/strings.xml
@@ -128,4 +128,10 @@
     <string name="a2dp_sink_mbs_label" msgid="6035366346569127155">"Áudio Bluetooth"</string>
     <string name="bluetooth_opp_file_limit_exceeded" msgid="6612109860149473930">"Não é possível transferir os ficheiros com mais de 4 GB."</string>
     <string name="bluetooth_connect_action" msgid="2319449093046720209">"Ligar ao Bluetooth"</string>
+    <string name="bluetooth_enabled_apm_title" msgid="6914461147844949044">"Bluetooth ativado no modo de avião"</string>
+    <string name="bluetooth_enabled_apm_message" msgid="8409900562494838113">"Se mantiver o Bluetooth ativado, o telemóvel vai lembrar-se de o manter ativado da próxima vez que estiver no modo de avião"</string>
+    <string name="bluetooth_stays_on_title" msgid="39720820955212918">"O Bluetooth mantém-se ativado"</string>
+    <string name="bluetooth_stays_on_message" msgid="7142453371222249965">"O seu telemóvel mantém o Bluetooth ativado no modo de avião. Desative o Bluetooth se não quiser que fique ativado."</string>
+    <string name="bluetooth_and_wifi_stays_on_title" msgid="5821932798860821244">"O Wi-Fi e o Bluetooth mantêm-se ativados"</string>
+    <string name="bluetooth_and_wifi_stays_on_message" msgid="2390749828997719812">"O seu telemóvel mantém o Wi-Fi e o Bluetooth ativados no modo de avião. Desative o Wi-Fi e o Bluetooth se não quiser que fiquem ativados."</string>
 </resources>
diff --git a/android/app/res/values-pt/strings.xml b/android/app/res/values-pt/strings.xml
index 8473c60..612ef7c 100644
--- a/android/app/res/values-pt/strings.xml
+++ b/android/app/res/values-pt/strings.xml
@@ -128,4 +128,10 @@
     <string name="a2dp_sink_mbs_label" msgid="6035366346569127155">"Áudio Bluetooth"</string>
     <string name="bluetooth_opp_file_limit_exceeded" msgid="6612109860149473930">"Não é possível transferir arquivos maiores que 4 GB"</string>
     <string name="bluetooth_connect_action" msgid="2319449093046720209">"Conectar ao Bluetooth"</string>
+    <string name="bluetooth_enabled_apm_title" msgid="6914461147844949044">"Bluetooth ativado no modo avião"</string>
+    <string name="bluetooth_enabled_apm_message" msgid="8409900562494838113">"Se você escolher manter o Bluetooth ativado, essa configuração vai ser aplicada na próxima vez que usar o modo avião"</string>
+    <string name="bluetooth_stays_on_title" msgid="39720820955212918">"O Bluetooth fica ativado"</string>
+    <string name="bluetooth_stays_on_message" msgid="7142453371222249965">"O smartphone vai manter o Bluetooth ativado no modo avião. Ele pode ser desativado manualmente se você preferir."</string>
+    <string name="bluetooth_and_wifi_stays_on_title" msgid="5821932798860821244">"O Wi-Fi e o Bluetooth ficam ativados"</string>
+    <string name="bluetooth_and_wifi_stays_on_message" msgid="2390749828997719812">"O smartphone vai manter o Wi-Fi e o Bluetooth ativados no modo avião. Eles podem ser desativados manualmente se você preferir."</string>
 </resources>
diff --git a/android/app/res/values-ro/strings.xml b/android/app/res/values-ro/strings.xml
index c987e6d..61bfb10 100644
--- a/android/app/res/values-ro/strings.xml
+++ b/android/app/res/values-ro/strings.xml
@@ -128,4 +128,10 @@
     <string name="a2dp_sink_mbs_label" msgid="6035366346569127155">"Audio prin Bluetooth"</string>
     <string name="bluetooth_opp_file_limit_exceeded" msgid="6612109860149473930">"Fișierele mai mari de 4 GB nu pot fi transferate"</string>
     <string name="bluetooth_connect_action" msgid="2319449093046720209">"Conectează-te la Bluetooth"</string>
+    <string name="bluetooth_enabled_apm_title" msgid="6914461147844949044">"Bluetooth activat în modul Avion"</string>
+    <string name="bluetooth_enabled_apm_message" msgid="8409900562494838113">"Dacă păstrezi Bluetooth activat, telefonul tău va reține să-l păstreze activat data viitoare când ești în modul Avion"</string>
+    <string name="bluetooth_stays_on_title" msgid="39720820955212918">"Bluetooth rămâne activat"</string>
+    <string name="bluetooth_stays_on_message" msgid="7142453371222249965">"Telefonul reține să păstreze Bluetooth activat în modul Avion. Dezactivează Bluetooth dacă nu vrei să rămână activat."</string>
+    <string name="bluetooth_and_wifi_stays_on_title" msgid="5821932798860821244">"Wi-Fi și Bluetooth rămân activate"</string>
+    <string name="bluetooth_and_wifi_stays_on_message" msgid="2390749828997719812">"Telefonul reține să păstreze funcțiile Wi-Fi și Bluetooth activate în modul Avion. Dezactivează Wi-Fi și Bluetooth dacă nu vrei să rămână activate."</string>
 </resources>
diff --git a/android/app/res/values-ru/strings.xml b/android/app/res/values-ru/strings.xml
index 7f206e4..d1e42c8 100644
--- a/android/app/res/values-ru/strings.xml
+++ b/android/app/res/values-ru/strings.xml
@@ -128,4 +128,10 @@
     <string name="a2dp_sink_mbs_label" msgid="6035366346569127155">"Звук через Bluetooth"</string>
     <string name="bluetooth_opp_file_limit_exceeded" msgid="6612109860149473930">"Можно перенести только файлы размером до 4 ГБ."</string>
     <string name="bluetooth_connect_action" msgid="2319449093046720209">"Подключиться по Bluetooth"</string>
+    <string name="bluetooth_enabled_apm_title" msgid="6914461147844949044">"Функция Bluetooth будет включена в режиме полета"</string>
+    <string name="bluetooth_enabled_apm_message" msgid="8409900562494838113">"Если не отключить функцию Bluetooth, в следующий раз она останется включенной в режиме полета."</string>
+    <string name="bluetooth_stays_on_title" msgid="39720820955212918">"Функция Bluetooth остается включенной"</string>
+    <string name="bluetooth_stays_on_message" msgid="7142453371222249965">"Функция Bluetooth останется включенной в режиме полета. Вы можете отключить ее, если хотите."</string>
+    <string name="bluetooth_and_wifi_stays_on_title" msgid="5821932798860821244">"Функции Wi‑Fi и Bluetooth остаются включенными"</string>
+    <string name="bluetooth_and_wifi_stays_on_message" msgid="2390749828997719812">"Wi‑Fi и Bluetooth останутся включенными в режиме полета. Вы можете отключить их, если хотите."</string>
 </resources>
diff --git a/android/app/res/values-si/strings.xml b/android/app/res/values-si/strings.xml
index 615227e..4da6645 100644
--- a/android/app/res/values-si/strings.xml
+++ b/android/app/res/values-si/strings.xml
@@ -128,4 +128,10 @@
     <string name="a2dp_sink_mbs_label" msgid="6035366346569127155">"බ්ලූටූත් ශ්‍රව්‍යය"</string>
     <string name="bluetooth_opp_file_limit_exceeded" msgid="6612109860149473930">"4GBට වඩා විශාල ගොනු මාරු කළ නොහැකිය"</string>
     <string name="bluetooth_connect_action" msgid="2319449093046720209">"බ්ලූටූත් වෙත සබඳින්න"</string>
+    <string name="bluetooth_enabled_apm_title" msgid="6914461147844949044">"අහස්යානා ආකාරයේ බ්ලූටූත් ක්‍රියාත්මකයි"</string>
+    <string name="bluetooth_enabled_apm_message" msgid="8409900562494838113">"ඔබ බ්ලූටූත් ක්‍රියාත්මක කර තබා ගන්නේ නම්, ඔබ අහස්යානා ආකාරයේ සිටින මීළඟ වතාවේ එය ක්‍රියාත්මක කිරීමට ඔබේ දුරකථනයට මතක තිබෙනු ඇත."</string>
+    <string name="bluetooth_stays_on_title" msgid="39720820955212918">"බ්ලූටූත් ක්‍රියාත්මකව පවතී"</string>
+    <string name="bluetooth_stays_on_message" msgid="7142453371222249965">"ඔබේ දුරකථනයට අහස්යානා ආකාරයේ බ්ලූටූත් ක්‍රියාත්මකව තබා ගැනීමට මතකයි. ඔබට බ්ලූටූත් ක්‍රියාත්මක වීමට අවශ්‍ය නොවේ නම් එය ක්‍රියාවිරහිත කරන්න."</string>
+    <string name="bluetooth_and_wifi_stays_on_title" msgid="5821932798860821244">"Wi-Fi සහ බ්ලූටූත් ක්‍රියාත්මකව පවතී"</string>
+    <string name="bluetooth_and_wifi_stays_on_message" msgid="2390749828997719812">"ඔබේ දුරකථනයට අහස්යානා ආකාරයේ Wi-Fi සහ බ්ලූටූත් ක්‍රියාත්මකව තබා ගැනීමට මතකයි. Wi-Fi සහ බ්ලූටූත් ඒවා ක්‍රියාත්මක වීමට ඔබට අවශ්‍ය නැතිනම් ක්‍රියා විරහිත කරන්න."</string>
 </resources>
diff --git a/android/app/res/values-sk/strings.xml b/android/app/res/values-sk/strings.xml
index 1f42788..fa4a7d4 100644
--- a/android/app/res/values-sk/strings.xml
+++ b/android/app/res/values-sk/strings.xml
@@ -128,4 +128,10 @@
     <string name="a2dp_sink_mbs_label" msgid="6035366346569127155">"Bluetooth Audio"</string>
     <string name="bluetooth_opp_file_limit_exceeded" msgid="6612109860149473930">"Súbory väčšie ako 4 GB sa nedajú preniesť"</string>
     <string name="bluetooth_connect_action" msgid="2319449093046720209">"Pripojiť k zariadeniu Bluetooth"</string>
+    <string name="bluetooth_enabled_apm_title" msgid="6914461147844949044">"Rozhranie Bluetooth bude v režime v lietadle zapnuté"</string>
+    <string name="bluetooth_enabled_apm_message" msgid="8409900562494838113">"Ak ponecháte rozhranie Bluetooth zapnuté, váš telefón si zapamätá, že ho má ponechať zapnuté pri ďalšom aktivovaní režimu v lietadle"</string>
+    <string name="bluetooth_stays_on_title" msgid="39720820955212918">"Rozhranie Bluetooth zostane zapnuté"</string>
+    <string name="bluetooth_stays_on_message" msgid="7142453371222249965">"Telefón si pamätá, aby v režime v lietadle nevypínal rozhranie Bluetooth. Ak ho nechcete ponechať zapnuté, vypnite ho."</string>
+    <string name="bluetooth_and_wifi_stays_on_title" msgid="5821932798860821244">"Wi‑Fi a Bluetooth zostanú zapnuté"</string>
+    <string name="bluetooth_and_wifi_stays_on_message" msgid="2390749828997719812">"Telefón si pamätá, aby v režime v lietadle nevypínal Wi‑Fi ani Bluetooth. Ak ich nechcete ponechať zapnuté, vypnite ich."</string>
 </resources>
diff --git a/android/app/res/values-sl/strings.xml b/android/app/res/values-sl/strings.xml
index 845d321..ac1de2b 100644
--- a/android/app/res/values-sl/strings.xml
+++ b/android/app/res/values-sl/strings.xml
@@ -128,4 +128,10 @@
     <string name="a2dp_sink_mbs_label" msgid="6035366346569127155">"Zvok prek Bluetootha"</string>
     <string name="bluetooth_opp_file_limit_exceeded" msgid="6612109860149473930">"Datotek, večjih od 4 GB, ni mogoče prenesti"</string>
     <string name="bluetooth_connect_action" msgid="2319449093046720209">"Povezovanje z Bluetoothom"</string>
+    <string name="bluetooth_enabled_apm_title" msgid="6914461147844949044">"Bluetooth je vklopljen v načinu za letalo"</string>
+    <string name="bluetooth_enabled_apm_message" msgid="8409900562494838113">"Če pustite Bluetooth vklopljen, bo telefon ob naslednjem preklopu na način za letalo pustil Bluetooth vklopljen."</string>
+    <string name="bluetooth_stays_on_title" msgid="39720820955212918">"Bluetooth ostane vklopljen"</string>
+    <string name="bluetooth_stays_on_message" msgid="7142453371222249965">"Telefon v načinu za letalo pusti Bluetooth vklopljen. Če ne želite, da ostane vklopljen, izklopite vmesnik Bluetooth."</string>
+    <string name="bluetooth_and_wifi_stays_on_title" msgid="5821932798860821244">"Wi-Fi in Bluetooth ostaneta vklopljena"</string>
+    <string name="bluetooth_and_wifi_stays_on_message" msgid="2390749828997719812">"Telefon v načinu za letalo pusti Wi-Fi in Bluetooth vklopljena. Če ne želite, da Wi-Fi in Bluetooth ostaneta vklopljena, ju izklopite."</string>
 </resources>
diff --git a/android/app/res/values-sq/strings.xml b/android/app/res/values-sq/strings.xml
index 2d1a4b8..e084c92 100644
--- a/android/app/res/values-sq/strings.xml
+++ b/android/app/res/values-sq/strings.xml
@@ -128,4 +128,10 @@
     <string name="a2dp_sink_mbs_label" msgid="6035366346569127155">"Audioja e \"bluetooth-it\""</string>
     <string name="bluetooth_opp_file_limit_exceeded" msgid="6612109860149473930">"Skedarët më të mëdhenj se 4 GB nuk mund të transferohen"</string>
     <string name="bluetooth_connect_action" msgid="2319449093046720209">"Lidhu me Bluetooth"</string>
+    <string name="bluetooth_enabled_apm_title" msgid="6914461147844949044">"Bluetooth-i aktiv në modalitetin e aeroplanit"</string>
+    <string name="bluetooth_enabled_apm_message" msgid="8409900562494838113">"Nëse e mban Bluetooth-in të aktivizuar, telefoni yt do të kujtohet ta mbajë atë të aktivizuar herën tjetër kur të jesh në modalitetin e aeroplanit"</string>
+    <string name="bluetooth_stays_on_title" msgid="39720820955212918">"Bluetooth qëndron i aktivizuar"</string>
+    <string name="bluetooth_stays_on_message" msgid="7142453371222249965">"Telefoni yt kujtohet që ta mbajë Bluetooth-in të aktivizuar në modalitetin e aeroplanit. Çaktivizo Bluetooth-in nëse nuk dëshiron që të qëndrojë i aktivizuar."</string>
+    <string name="bluetooth_and_wifi_stays_on_title" msgid="5821932798860821244">"Wi-Fi dhe Bluetooth-i qëndrojnë aktivë"</string>
+    <string name="bluetooth_and_wifi_stays_on_message" msgid="2390749828997719812">"Telefoni yt kujtohet që ta mbajë Wi-Fi dhe Bluetooth-in të aktivizuar në modalitetin e aeroplanit. Çaktivizo Wi-Fi dhe Bluetooth-in nëse nuk dëshiron që të qëndrojnë aktivë."</string>
 </resources>
diff --git a/android/app/res/values-sr/strings.xml b/android/app/res/values-sr/strings.xml
index b9e05b3..b709208 100644
--- a/android/app/res/values-sr/strings.xml
+++ b/android/app/res/values-sr/strings.xml
@@ -128,4 +128,10 @@
     <string name="a2dp_sink_mbs_label" msgid="6035366346569127155">"Bluetooth аудио"</string>
     <string name="bluetooth_opp_file_limit_exceeded" msgid="6612109860149473930">"Не могу да се преносе датотеке веће од 4 GB"</string>
     <string name="bluetooth_connect_action" msgid="2319449093046720209">"Повежи са Bluetooth-ом"</string>
+    <string name="bluetooth_enabled_apm_title" msgid="6914461147844949044">"Bluetooth је укључен у режиму рада у авиону"</string>
+    <string name="bluetooth_enabled_apm_message" msgid="8409900562494838113">"Ако одлучите да не искључујете Bluetooth, телефон ће запамтити да га не искључује следећи пут када будете у режиму рада у авиону"</string>
+    <string name="bluetooth_stays_on_title" msgid="39720820955212918">"Bluetooth се не искључује"</string>
+    <string name="bluetooth_stays_on_message" msgid="7142453371222249965">"Телефон памти да не треба да искључује Bluetooth у режиму рада у авиону. Искључите Bluetooth ако не желите да остане укључен."</string>
+    <string name="bluetooth_and_wifi_stays_on_title" msgid="5821932798860821244">"WiFi и Bluetooth остају укључени"</string>
+    <string name="bluetooth_and_wifi_stays_on_message" msgid="2390749828997719812">"Телефон памти да не треба да искључује WiFi и Bluetooth у режиму рада у авиону. Искључите WiFi и Bluetooth ако не желите да остану укључени."</string>
 </resources>
diff --git a/android/app/res/values-sv/strings.xml b/android/app/res/values-sv/strings.xml
index 5c11c0b..e8f951e 100644
--- a/android/app/res/values-sv/strings.xml
+++ b/android/app/res/values-sv/strings.xml
@@ -128,4 +128,10 @@
     <string name="a2dp_sink_mbs_label" msgid="6035366346569127155">"Bluetooth-ljud"</string>
     <string name="bluetooth_opp_file_limit_exceeded" msgid="6612109860149473930">"Det går inte att överföra filer som är större än 4 GB"</string>
     <string name="bluetooth_connect_action" msgid="2319449093046720209">"Anslut till Bluetooth"</string>
+    <string name="bluetooth_enabled_apm_title" msgid="6914461147844949044">"Håll Bluetooth aktiverat i flygplansläge"</string>
+    <string name="bluetooth_enabled_apm_message" msgid="8409900562494838113">"Om du håller wifi aktiverat kommer telefonen ihåg att hålla det aktiverat nästa gång du använder flygplansläge."</string>
+    <string name="bluetooth_stays_on_title" msgid="39720820955212918">"Bluetooth förblir aktiverat"</string>
+    <string name="bluetooth_stays_on_message" msgid="7142453371222249965">"Telefonen kommer ihåg att hålla Bluetooth aktiverat i flygplansläge. Inaktivera Bluetooth om du inte vill att det ska hållas aktiverat."</string>
+    <string name="bluetooth_and_wifi_stays_on_title" msgid="5821932798860821244">"Wifi och Bluetooth ska vara aktiverade"</string>
+    <string name="bluetooth_and_wifi_stays_on_message" msgid="2390749828997719812">"Telefonen kommer ihåg att hålla wifi och Bluetooth aktiverade i flygplansläge. Du kan inaktivera wifi och Bluetooth om du inte vill hålla dem aktiverade."</string>
 </resources>
diff --git a/android/app/res/values-sw/strings.xml b/android/app/res/values-sw/strings.xml
index 6b109a7..d3f5875 100644
--- a/android/app/res/values-sw/strings.xml
+++ b/android/app/res/values-sw/strings.xml
@@ -128,4 +128,10 @@
     <string name="a2dp_sink_mbs_label" msgid="6035366346569127155">"Sauti ya Bluetooth"</string>
     <string name="bluetooth_opp_file_limit_exceeded" msgid="6612109860149473930">"Haiwezi kutuma faili zinazozidi GB 4"</string>
     <string name="bluetooth_connect_action" msgid="2319449093046720209">"Unganisha kwenye Bluetooth"</string>
+    <string name="bluetooth_enabled_apm_title" msgid="6914461147844949044">"Bluetooth itawashwa katika hali ya ndegeni"</string>
+    <string name="bluetooth_enabled_apm_message" msgid="8409900562494838113">"Usipozima Bluetooth, simu yako itakumbuka kuiwasha wakati mwingine unapokuwa katika hali ya ndegeni"</string>
+    <string name="bluetooth_stays_on_title" msgid="39720820955212918">"Bluetooth itaendelea kuwaka"</string>
+    <string name="bluetooth_stays_on_message" msgid="7142453371222249965">"Simu yako itaendelea kuwasha Bluetooth katika hali ya ndegeni. Zima Bluetooth iwapo hutaki iendelee kuwaka."</string>
+    <string name="bluetooth_and_wifi_stays_on_title" msgid="5821932798860821244">"Wi-Fi na Bluetooth zitaendelea kuwaka"</string>
+    <string name="bluetooth_and_wifi_stays_on_message" msgid="2390749828997719812">"Simu yako itaendelea kuwasha Wi-Fi na Bluetooth ukiwa katika hali ya ndegeni. Zima Wi-Fi na Bluetooth ikiwa hutaki ziendelee kuwaka."</string>
 </resources>
diff --git a/android/app/res/values-ta/strings.xml b/android/app/res/values-ta/strings.xml
index e46cb87..0cd15af 100644
--- a/android/app/res/values-ta/strings.xml
+++ b/android/app/res/values-ta/strings.xml
@@ -128,4 +128,10 @@
     <string name="a2dp_sink_mbs_label" msgid="6035366346569127155">"புளூடூத் ஆடியோ"</string>
     <string name="bluetooth_opp_file_limit_exceeded" msgid="6612109860149473930">"4ஜி.பை.க்கு மேலிருக்கும் ஃபைல்களை இடமாற்ற முடியாது"</string>
     <string name="bluetooth_connect_action" msgid="2319449093046720209">"புளூடூத் உடன் இணை"</string>
+    <string name="bluetooth_enabled_apm_title" msgid="6914461147844949044">"விமானப் பயன்முறையில் புளூடூத்தை இயக்குதல்"</string>
+    <string name="bluetooth_enabled_apm_message" msgid="8409900562494838113">"புளூடூத்தை இயக்கத்தில் வைத்திருந்தால், அடுத்த முறை நீங்கள் விமானப் பயன்முறையைப் பயன்படுத்தும்போது உங்கள் மொபைல் புளூடூத்தை இயக்கத்தில் வைக்கும்"</string>
+    <string name="bluetooth_stays_on_title" msgid="39720820955212918">"புளூடூத் இயக்கத்திலேயே இருக்கும்"</string>
+    <string name="bluetooth_stays_on_message" msgid="7142453371222249965">"விமானப் பயன்முறையில் புளூடூத்தை உங்கள் மொபைல் இயக்கத்திலேயே வைத்திருக்கும். புளூடூத்தை இயக்க விரும்பவில்லை என்றால் அதை முடக்கவும்."</string>
+    <string name="bluetooth_and_wifi_stays_on_title" msgid="5821932798860821244">"வைஃபையும் புளூடூத்தும் இயக்கத்திலேயே இருத்தல்"</string>
+    <string name="bluetooth_and_wifi_stays_on_message" msgid="2390749828997719812">"விமானப் பயன்முறையில் வைஃபையையும் புளூடூத்தையும் உங்கள் மொபைல் இயக்கத்திலேயே வைத்திருக்கும். வைஃபை மற்றும் புளூடூத்தை இயக்க விரும்பவில்லை என்றால் அவற்றை முடக்கவும்."</string>
 </resources>
diff --git a/android/app/res/values-te/strings.xml b/android/app/res/values-te/strings.xml
index 6e8024e..e50dbf1 100644
--- a/android/app/res/values-te/strings.xml
+++ b/android/app/res/values-te/strings.xml
@@ -28,8 +28,8 @@
     <string name="bt_enable_title" msgid="4484289159118416315"></string>
     <string name="bt_enable_line1" msgid="8429910585843481489">"బ్లూటూత్ సేవలను ఉపయోగించడానికి, మీరు తప్పనిసరిగా ముందుగా బ్లూటూత్‌ను ప్రారంభించాలి."</string>
     <string name="bt_enable_line2" msgid="1466367120348920892">"ఇప్పుడే బ్లూటూత్‌ను ప్రారంభించాలా?"</string>
-    <string name="bt_enable_cancel" msgid="6770180540581977614">"రద్దు చేయి"</string>
-    <string name="bt_enable_ok" msgid="4224374055813566166">"ప్రారంభించు"</string>
+    <string name="bt_enable_cancel" msgid="6770180540581977614">"రద్దు చేయండి"</string>
+    <string name="bt_enable_ok" msgid="4224374055813566166">"ప్రారంభించండి"</string>
     <string name="incoming_file_confirm_title" msgid="938251186275547290">"ఫైల్ బదిలీ"</string>
     <string name="incoming_file_confirm_content" msgid="6573502088511901157">"ఇన్‌కమింగ్ ఫైల్‌ను ఆమోదించాలా?"</string>
     <string name="incoming_file_confirm_cancel" msgid="9205906062663982692">"తిరస్కరిస్తున్నాను"</string>
@@ -72,7 +72,7 @@
     <string name="upload_fail_cancel" msgid="1632528037932779727">"మూసివేయి"</string>
     <string name="bt_error_btn_ok" msgid="2802751202009957372">"సరే"</string>
     <string name="unknown_file" msgid="3719981572107052685">"తెలియని ఫైల్"</string>
-    <string name="unknown_file_desc" msgid="9185609398960437760">"ఈ రకమైన ఫైల్‌ను నిర్వహించడానికి యాప్ ఏదీ లేదు. \n"</string>
+    <string name="unknown_file_desc" msgid="9185609398960437760">"ఈ రకమైన ఫైల్‌ను మేనేజ్ చేయడానికి యాప్ ఏదీ లేదు. \n"</string>
     <string name="not_exist_file" msgid="5097565588949092486">"ఫైల్ లేదు"</string>
     <string name="not_exist_file_desc" msgid="250802392160941265">"ఫైల్ ఉనికిలో లేదు. \n"</string>
     <string name="enabling_progress_title" msgid="5262637688863903594">"దయచేసి వేచి ఉండండి..."</string>
@@ -93,8 +93,8 @@
     <string name="status_not_accept" msgid="1165798802740579658">"కంటెంట్‌కు మద్దతు లేదు."</string>
     <string name="status_forbidden" msgid="4017060451358837245">"లక్ష్య పరికరం బదిలీని నిషేధించింది."</string>
     <string name="status_canceled" msgid="8441679418717978515">"వినియోగదారు బదిలీని రద్దు చేశారు."</string>
-    <string name="status_file_error" msgid="5379018888714679311">"నిల్వ సమస్య."</string>
-    <string name="status_no_sd_card_nosdcard" msgid="6445646484924125975">"USB నిల్వ లేదు."</string>
+    <string name="status_file_error" msgid="5379018888714679311">"స్టోరేజ్‌ సమస్య."</string>
+    <string name="status_no_sd_card_nosdcard" msgid="6445646484924125975">"USB స్టోరేజ్‌ లేదు."</string>
     <string name="status_no_sd_card_default" msgid="8878262565692541241">"SD కార్డు లేదు. బదిలీ చేయబడిన ఫైళ్లను సేవ్ చేయడానికి SD కార్డుని చొప్పించండి."</string>
     <string name="status_connection_error" msgid="8253709700568062220">"కనెక్షన్ విఫలమైంది."</string>
     <string name="status_protocol_error" msgid="3231573735130475654">"రిక్వెస్ట్‌ సరిగ్గా నిర్వహించబడదు."</string>
@@ -116,8 +116,8 @@
     <string name="transfer_menu_clear" msgid="7213491281898188730">"లిస్ట్‌ నుండి క్లియర్ చేయండి"</string>
     <string name="transfer_clear_dlg_title" msgid="128904516163257225">"క్లియర్ చేయండి"</string>
     <string name="bluetooth_a2dp_sink_queue_name" msgid="7521243473328258997">"ప్రస్తుతం ప్లే అవుతున్నవి"</string>
-    <string name="bluetooth_map_settings_save" msgid="8309113239113961550">"సేవ్ చేయి"</string>
-    <string name="bluetooth_map_settings_cancel" msgid="3374494364625947793">"రద్దు చేయి"</string>
+    <string name="bluetooth_map_settings_save" msgid="8309113239113961550">"సేవ్ చేయండి"</string>
+    <string name="bluetooth_map_settings_cancel" msgid="3374494364625947793">"రద్దు చేయండి"</string>
     <string name="bluetooth_map_settings_intro" msgid="4748160773998753325">"మీరు బ్లూటూత్ ద్వారా షేర్ చేయాలనుకునే ఖాతాలను ఎంచుకోండి. మీరు ఇప్పటికీ కనెక్ట్ చేస్తున్నప్పుడు ఖాతాలకు అందించే ఏ యాక్సెస్‌నైనా ఆమోదించాల్సి ఉంటుంది."</string>
     <string name="bluetooth_map_settings_count" msgid="183013143617807702">"మిగిలిన స్లాట్‌లు:"</string>
     <string name="bluetooth_map_settings_app_icon" msgid="3501432663809664982">"యాప్‌ చిహ్నం"</string>
@@ -128,4 +128,10 @@
     <string name="a2dp_sink_mbs_label" msgid="6035366346569127155">"బ్లూటూత్ ఆడియో"</string>
     <string name="bluetooth_opp_file_limit_exceeded" msgid="6612109860149473930">"4GB కన్నా పెద్ద ఫైళ్లు బదిలీ చేయబడవు"</string>
     <string name="bluetooth_connect_action" msgid="2319449093046720209">"బ్లూటూత్‌కు కనెక్ట్ చేయి"</string>
+    <string name="bluetooth_enabled_apm_title" msgid="6914461147844949044">"విమానం మోడ్‌లో బ్లూటూత్ ఆన్ చేయబడింది"</string>
+    <string name="bluetooth_enabled_apm_message" msgid="8409900562494838113">"మీరు బ్లూటూత్‌ను ఆన్‌లో ఉంచినట్లయితే, మీరు తదుపరిసారి విమానం మోడ్‌లో ఉన్నప్పుడు దాన్ని ఆన్‌లో ఉంచాలని మీ ఫోన్ గుర్తుంచుకుంటుంది"</string>
+    <string name="bluetooth_stays_on_title" msgid="39720820955212918">"బ్లూటూత్ ఆన్‌లో ఉంటుంది"</string>
+    <string name="bluetooth_stays_on_message" msgid="7142453371222249965">"విమానం మోడ్‌లో బ్లూటూత్ ఆన్‌లో ఉంచాలని మీ ఫోన్ గుర్తుంచుకుంటుంది. బ్లూటూత్ ఆన్‌లో ఉండకూడదనుకుంటే దాన్ని ఆఫ్ చేయండి."</string>
+    <string name="bluetooth_and_wifi_stays_on_title" msgid="5821932798860821244">"Wi-Fi, బ్లూటూత్ ఆన్‌లో ఉంటాయి"</string>
+    <string name="bluetooth_and_wifi_stays_on_message" msgid="2390749828997719812">"మీ ఫోన్ విమానం మోడ్‌లో Wi‑Fiని, బ్లూటూత్‌ని ఆన్‌లో ఉంచాలని గుర్తుంచుకుంటుంది. Wi-Fi, బ్లూటూత్ ఆన్‌లో ఉండకూడదనుకుంటే వాటిని ఆఫ్ చేయండి."</string>
 </resources>
diff --git a/android/app/res/values-th/strings.xml b/android/app/res/values-th/strings.xml
index 5477f24f..a39afb5 100644
--- a/android/app/res/values-th/strings.xml
+++ b/android/app/res/values-th/strings.xml
@@ -128,4 +128,10 @@
     <string name="a2dp_sink_mbs_label" msgid="6035366346569127155">"Bluetooth Audio"</string>
     <string name="bluetooth_opp_file_limit_exceeded" msgid="6612109860149473930">"โอนไฟล์ที่มีขนาดใหญ่กว่า 4 GB ไม่ได้"</string>
     <string name="bluetooth_connect_action" msgid="2319449093046720209">"เชื่อมต่อบลูทูธ"</string>
+    <string name="bluetooth_enabled_apm_title" msgid="6914461147844949044">"บลูทูธเปิดอยู่ในโหมดบนเครื่องบิน"</string>
+    <string name="bluetooth_enabled_apm_message" msgid="8409900562494838113">"หากเปิดบลูทูธไว้ โทรศัพท์จะจำว่าต้องเปิดบลูทูธในครั้งถัดไปที่คุณอยู่ในโหมดบนเครื่องบิน"</string>
+    <string name="bluetooth_stays_on_title" msgid="39720820955212918">"บลูทูธเปิดอยู่"</string>
+    <string name="bluetooth_stays_on_message" msgid="7142453371222249965">"โทรศัพท์จำว่าจะต้องเปิดบลูทูธไว้ในโหมดบนเครื่องบิน ปิดบลูทูธหากคุณไม่ต้องการให้เปิดไว้"</string>
+    <string name="bluetooth_and_wifi_stays_on_title" msgid="5821932798860821244">"Wi-Fi และบลูทูธยังเปิดอยู่"</string>
+    <string name="bluetooth_and_wifi_stays_on_message" msgid="2390749828997719812">"โทรศัพท์จำว่าจะต้องเปิด Wi-Fi และบลูทูธไว้ในโหมดบนเครื่องบิน ปิด Wi-Fi และบลูทูธหากคุณไม่ต้องการให้เปิดไว้"</string>
 </resources>
diff --git a/android/app/res/values-tl/strings.xml b/android/app/res/values-tl/strings.xml
index d4c7e1e..b84dc9a 100644
--- a/android/app/res/values-tl/strings.xml
+++ b/android/app/res/values-tl/strings.xml
@@ -128,4 +128,10 @@
     <string name="a2dp_sink_mbs_label" msgid="6035366346569127155">"Bluetooth Audio"</string>
     <string name="bluetooth_opp_file_limit_exceeded" msgid="6612109860149473930">"Hindi maililipat ang mga file na mas malaki sa 4GB"</string>
     <string name="bluetooth_connect_action" msgid="2319449093046720209">"Kumonekta sa Bluetooth"</string>
+    <string name="bluetooth_enabled_apm_title" msgid="6914461147844949044">"Naka-on ang Bluetooth sa airplane mode"</string>
+    <string name="bluetooth_enabled_apm_message" msgid="8409900562494838113">"Kung papanatilihin mong naka-on ang Bluetooth, tatandaan ng iyong telepono na panatilihin itong naka-on sa susunod na nasa airplane mode ka"</string>
+    <string name="bluetooth_stays_on_title" msgid="39720820955212918">"Mananatiling naka-on ang Bluetooth"</string>
+    <string name="bluetooth_stays_on_message" msgid="7142453371222249965">"Tinatandaan ng iyong telepono na panatilihing naka-on ang Bluetooth habang nasa airplane mode. I-off ang Bluetooth kung ayaw mo itong manatiling naka-on."</string>
+    <string name="bluetooth_and_wifi_stays_on_title" msgid="5821932798860821244">"Mananatiling naka-on ang Wi-Fi at Bluetooth"</string>
+    <string name="bluetooth_and_wifi_stays_on_message" msgid="2390749828997719812">"Tinatandaan ng iyong telepono na panatilihing naka-on ang Wi-Fi at Bluetooth habang nasa airplane mode. I-off ang Wi-Fi at Bluetooth kung ayaw mong manatiling naka-on ang mga ito."</string>
 </resources>
diff --git a/android/app/res/values-tr/strings.xml b/android/app/res/values-tr/strings.xml
index f622f2f..c3c6575 100644
--- a/android/app/res/values-tr/strings.xml
+++ b/android/app/res/values-tr/strings.xml
@@ -128,4 +128,10 @@
     <string name="a2dp_sink_mbs_label" msgid="6035366346569127155">"Bluetooth Ses"</string>
     <string name="bluetooth_opp_file_limit_exceeded" msgid="6612109860149473930">"4 GB\'tan büyük dosyalar aktarılamaz"</string>
     <string name="bluetooth_connect_action" msgid="2319449093046720209">"Bluetooth\'a bağlan"</string>
+    <string name="bluetooth_enabled_apm_title" msgid="6914461147844949044">"Uçak modundayken Bluetooth açık"</string>
+    <string name="bluetooth_enabled_apm_message" msgid="8409900562494838113">"Kablosuz bağlantıyı açık tutarsanız telefonunuz, daha sonra tekrar uçak modunda olduğunuzda kablosuz bağlantıyı açık tutar"</string>
+    <string name="bluetooth_stays_on_title" msgid="39720820955212918">"Bluetooth açık kalır"</string>
+    <string name="bluetooth_stays_on_message" msgid="7142453371222249965">"Telefonunuz, uçak modundayken Bluetooth\'u açık tutmayı hatırlar. Açık kalmasını istemiyorsanız Bluetooth\'u kapatın."</string>
+    <string name="bluetooth_and_wifi_stays_on_title" msgid="5821932798860821244">"Kablosuz bağlantı ve Bluetooth açık kalır"</string>
+    <string name="bluetooth_and_wifi_stays_on_message" msgid="2390749828997719812">"Telefonunuz, uçak modundayken kablosuz bağlantıyı ve Bluetooth\'u açık tutmayı hatırlar. Açık kalmasını istemiyorsanız kablosuz bağlantıyı ve Bluetooth\'u kapatın."</string>
 </resources>
diff --git a/android/app/res/values-uk/strings.xml b/android/app/res/values-uk/strings.xml
index b00400e..4290e6a 100644
--- a/android/app/res/values-uk/strings.xml
+++ b/android/app/res/values-uk/strings.xml
@@ -128,4 +128,10 @@
     <string name="a2dp_sink_mbs_label" msgid="6035366346569127155">"Bluetooth Audio"</string>
     <string name="bluetooth_opp_file_limit_exceeded" msgid="6612109860149473930">"Не можна перенести файли, більші за 4 ГБ"</string>
     <string name="bluetooth_connect_action" msgid="2319449093046720209">"Підключитися до Bluetooth"</string>
+    <string name="bluetooth_enabled_apm_title" msgid="6914461147844949044">"Bluetooth увімкнено в режимі польоту"</string>
+    <string name="bluetooth_enabled_apm_message" msgid="8409900562494838113">"Якщо ви не вимкнете Bluetooth на телефоні, ця функція залишатиметься ввімкненою під час наступного використання режиму польоту"</string>
+    <string name="bluetooth_stays_on_title" msgid="39720820955212918">"Bluetooth не буде вимкнено"</string>
+    <string name="bluetooth_stays_on_message" msgid="7142453371222249965">"У режимі польоту функція Bluetooth на телефоні залишатиметься ввімкненою. За бажання її можна вимкнути."</string>
+    <string name="bluetooth_and_wifi_stays_on_title" msgid="5821932798860821244">"Wi-Fi і Bluetooth залишаються ввімкненими"</string>
+    <string name="bluetooth_and_wifi_stays_on_message" msgid="2390749828997719812">"У режимі польоту функції Wi-Fi і Bluetooth на телефоні залишатимуться ввімкненими. За бажання їх можна вимкнути."</string>
 </resources>
diff --git a/android/app/res/values-ur/strings.xml b/android/app/res/values-ur/strings.xml
index 0cfee4c..fdbffdc 100644
--- a/android/app/res/values-ur/strings.xml
+++ b/android/app/res/values-ur/strings.xml
@@ -128,4 +128,10 @@
     <string name="a2dp_sink_mbs_label" msgid="6035366346569127155">"بلوٹوتھ آڈیو"</string>
     <string name="bluetooth_opp_file_limit_exceeded" msgid="6612109860149473930">"‏4GB سے بڑی فائلیں منتقل نہیں کی جا سکتیں"</string>
     <string name="bluetooth_connect_action" msgid="2319449093046720209">"بلوٹوتھ سے منسلک کریں"</string>
+    <string name="bluetooth_enabled_apm_title" msgid="6914461147844949044">"ہوائی جہاز وضع میں بلوٹوتھ آن ہے"</string>
+    <string name="bluetooth_enabled_apm_message" msgid="8409900562494838113">"اگر آپ بلوٹوتھ کو آن رکھتے ہیں تو آپ کا فون آپ کے اگلی مرتبہ ہوائی جہاز وضع میں ہونے پر اسے آن رکھنا یاد رکھے گا"</string>
+    <string name="bluetooth_stays_on_title" msgid="39720820955212918">"بلوٹوتھ آن رہتا ہے"</string>
+    <string name="bluetooth_stays_on_message" msgid="7142453371222249965">"آپ کا فون ہوائی جہاز وضع میں بلوٹوتھ کو آن رکھنا یاد رکھتا ہے۔ اگر آپ نہیں چاہتے ہیں کہ بلوٹوتھ آن رہے تو اسے آف کریں۔"</string>
+    <string name="bluetooth_and_wifi_stays_on_title" msgid="5821932798860821244">"‏Wi-Fi اور بلوٹوتھ آن رہنے دیں"</string>
+    <string name="bluetooth_and_wifi_stays_on_message" msgid="2390749828997719812">"‏آپ کا فون ہوائی جہاز وضع میں Wi-Fi اور بلوٹوتھ کو آن رکھنا یاد رکھتا ہے۔ اگر آپ نہیں چاہتے ہیں کہ Wi-Fi اور بلوٹوتھ آن رہیں تو انہیں آف کریں۔"</string>
 </resources>
diff --git a/android/app/res/values-uz/strings.xml b/android/app/res/values-uz/strings.xml
index a4aa29b..8b857fa 100644
--- a/android/app/res/values-uz/strings.xml
+++ b/android/app/res/values-uz/strings.xml
@@ -128,4 +128,10 @@
     <string name="a2dp_sink_mbs_label" msgid="6035366346569127155">"Bluetooth orqali ovoz"</string>
     <string name="bluetooth_opp_file_limit_exceeded" msgid="6612109860149473930">"4 GBdan katta hajmli videolar o‘tkazilmaydi"</string>
     <string name="bluetooth_connect_action" msgid="2319449093046720209">"Bluetoothga ulanish"</string>
+    <string name="bluetooth_enabled_apm_title" msgid="6914461147844949044">"Bluetooth parvoz rejimida yoniq"</string>
+    <string name="bluetooth_enabled_apm_message" msgid="8409900562494838113">"Bluetooth yoniq qolsa, telefon keyingi safar parvoz rejimida ham uni yoniq qoldiradi."</string>
+    <string name="bluetooth_stays_on_title" msgid="39720820955212918">"Bluetooth yoniq turadi"</string>
+    <string name="bluetooth_stays_on_message" msgid="7142453371222249965">"Telefoningiz parvoz rejimida Bluetooth yoqilganini eslab qoladi. Yoniq qolmasligi uchun Bluetooth aloqasini oʻchiring."</string>
+    <string name="bluetooth_and_wifi_stays_on_title" msgid="5821932798860821244">"Wi-Fi va Bluetooth yoniq qoladi"</string>
+    <string name="bluetooth_and_wifi_stays_on_message" msgid="2390749828997719812">"Telefoningiz parvoz rejimida Wi‑Fi va Bluetooth yoqilganini eslab qoladi. Yoniq qolmasligi uchun Wi-Fi va Bluetooth aloqasini oʻchiring."</string>
 </resources>
diff --git a/android/app/res/values-vi/strings.xml b/android/app/res/values-vi/strings.xml
index 53de8c7..f061077 100644
--- a/android/app/res/values-vi/strings.xml
+++ b/android/app/res/values-vi/strings.xml
@@ -128,4 +128,10 @@
     <string name="a2dp_sink_mbs_label" msgid="6035366346569127155">"Âm thanh Bluetooth"</string>
     <string name="bluetooth_opp_file_limit_exceeded" msgid="6612109860149473930">"Không thể chuyển những tệp lớn hơn 4 GB"</string>
     <string name="bluetooth_connect_action" msgid="2319449093046720209">"Kết nối với Bluetooth"</string>
+    <string name="bluetooth_enabled_apm_title" msgid="6914461147844949044">"Bluetooth đang bật ở chế độ trên máy bay"</string>
+    <string name="bluetooth_enabled_apm_message" msgid="8409900562494838113">"Nếu bạn không tắt Bluetooth, điện thoại sẽ luôn bật Bluetooth vào lần tiếp theo bạn dùng chế độ trên máy bay"</string>
+    <string name="bluetooth_stays_on_title" msgid="39720820955212918">"Bluetooth luôn bật"</string>
+    <string name="bluetooth_stays_on_message" msgid="7142453371222249965">"Điện thoại của bạn sẽ luôn bật Bluetooth ở chế độ trên máy bay. Nếu không muốn như vậy thì bạn có thể tắt Bluetooth."</string>
+    <string name="bluetooth_and_wifi_stays_on_title" msgid="5821932798860821244">"Wi-Fi và Bluetooth vẫn đang bật"</string>
+    <string name="bluetooth_and_wifi_stays_on_message" msgid="2390749828997719812">"Điện thoại của bạn sẽ luôn bật Wi-Fi và Bluetooth ở chế độ trên máy bay. Tắt Wi-Fi và Bluetooth nếu bạn không muốn tiếp tục bật."</string>
 </resources>
diff --git a/android/app/res/values-zh-rCN/strings.xml b/android/app/res/values-zh-rCN/strings.xml
index 4133a31..0eda938 100644
--- a/android/app/res/values-zh-rCN/strings.xml
+++ b/android/app/res/values-zh-rCN/strings.xml
@@ -109,8 +109,8 @@
     <string name="transfer_clear_dlg_msg" msgid="586117930961007311">"所有内容都将从列表中清除。"</string>
     <string name="outbound_noti_title" msgid="2045560896819618979">"蓝牙共享：已发送文件"</string>
     <string name="inbound_noti_title" msgid="3730993443609581977">"蓝牙共享：已接收文件"</string>
-    <string name="noti_caption_unsuccessful" msgid="6679288016450410835">"{count,plural, =1{# 个文件发送失败。}other{# 个文件发送失败。}}"</string>
-    <string name="noti_caption_success" msgid="7652777514009569713">"{count,plural, =1{# 个文件发送成功，%1$s}other{# 个文件发送成功，%1$s}}"</string>
+    <string name="noti_caption_unsuccessful" msgid="6679288016450410835">"{count,plural, =1{# 个文件传输失败。}other{# 个文件传输失败。}}"</string>
+    <string name="noti_caption_success" msgid="7652777514009569713">"{count,plural, =1{# 个文件传输成功，%1$s}other{# 个文件传输成功，%1$s}}"</string>
     <string name="transfer_menu_clear_all" msgid="3014459758656427076">"清除列表"</string>
     <string name="transfer_menu_open" msgid="5193344638774400131">"打开"</string>
     <string name="transfer_menu_clear" msgid="7213491281898188730">"从列表中清除"</string>
@@ -128,4 +128,10 @@
     <string name="a2dp_sink_mbs_label" msgid="6035366346569127155">"蓝牙音频"</string>
     <string name="bluetooth_opp_file_limit_exceeded" msgid="6612109860149473930">"无法传输 4GB 以上的文件"</string>
     <string name="bluetooth_connect_action" msgid="2319449093046720209">"连接到蓝牙"</string>
+    <string name="bluetooth_enabled_apm_title" msgid="6914461147844949044">"在飞行模式下蓝牙保持开启状态"</string>
+    <string name="bluetooth_enabled_apm_message" msgid="8409900562494838113">"如果您不关闭蓝牙，那么您下次进入飞行模式时手机将记住保持开启蓝牙"</string>
+    <string name="bluetooth_stays_on_title" msgid="39720820955212918">"蓝牙保持开启状态"</string>
+    <string name="bluetooth_stays_on_message" msgid="7142453371222249965">"在飞行模式下手机将记住保持开启蓝牙。如果您不想保持开启和蓝牙，请关闭蓝牙。"</string>
+    <string name="bluetooth_and_wifi_stays_on_title" msgid="5821932798860821244">"WLAN 和蓝牙保持开启状态"</string>
+    <string name="bluetooth_and_wifi_stays_on_message" msgid="2390749828997719812">"在飞行模式下手机将记住保持开启 WLAN 和蓝牙。如果您不想保持开启 WLAN 和蓝牙，请关闭 WLAN 和蓝牙。"</string>
 </resources>
diff --git a/android/app/res/values-zh-rHK/strings.xml b/android/app/res/values-zh-rHK/strings.xml
index cd33c81..cce5f3e 100644
--- a/android/app/res/values-zh-rHK/strings.xml
+++ b/android/app/res/values-zh-rHK/strings.xml
@@ -128,4 +128,10 @@
     <string name="a2dp_sink_mbs_label" msgid="6035366346569127155">"藍牙音訊"</string>
     <string name="bluetooth_opp_file_limit_exceeded" msgid="6612109860149473930">"無法轉移 4 GB 以上的檔案"</string>
     <string name="bluetooth_connect_action" msgid="2319449093046720209">"連接藍牙"</string>
+    <string name="bluetooth_enabled_apm_title" msgid="6914461147844949044">"在飛航模式中保持藍牙開啟"</string>
+    <string name="bluetooth_enabled_apm_message" msgid="8409900562494838113">"如果您不關閉藍牙，下次手機進入飛行模式時，藍牙將保持開啟"</string>
+    <string name="bluetooth_stays_on_title" msgid="39720820955212918">"保持藍牙連線"</string>
+    <string name="bluetooth_stays_on_message" msgid="7142453371222249965">"手機會記得在飛行模式下保持藍牙開啟。如果您不希望保持開啟，請關閉藍牙。"</string>
+    <string name="bluetooth_and_wifi_stays_on_title" msgid="5821932798860821244">"Wi-Fi 和藍牙保持開啟"</string>
+    <string name="bluetooth_and_wifi_stays_on_message" msgid="2390749828997719812">"手機會記得在飛行模式下保持 Wi-Fi 及藍牙開啟。如果您不希望保持開啟，請關閉 Wi-Fi 及藍牙。"</string>
 </resources>
diff --git a/android/app/res/values-zh-rTW/strings.xml b/android/app/res/values-zh-rTW/strings.xml
index a5c5b8e..cbaadb2 100644
--- a/android/app/res/values-zh-rTW/strings.xml
+++ b/android/app/res/values-zh-rTW/strings.xml
@@ -128,4 +128,10 @@
     <string name="a2dp_sink_mbs_label" msgid="6035366346569127155">"藍牙音訊"</string>
     <string name="bluetooth_opp_file_limit_exceeded" msgid="6612109860149473930">"無法轉移大於 4GB 的檔案"</string>
     <string name="bluetooth_connect_action" msgid="2319449093046720209">"使用藍牙連線"</string>
+    <string name="bluetooth_enabled_apm_title" msgid="6914461147844949044">"在飛航模式下保持藍牙開啟狀態"</string>
+    <string name="bluetooth_enabled_apm_message" msgid="8409900562494838113">"如果不關閉藍牙，下次手機進入飛航模式時，藍牙將保持開啟"</string>
+    <string name="bluetooth_stays_on_title" msgid="39720820955212918">"藍牙會保持開啟狀態"</string>
+    <string name="bluetooth_stays_on_message" msgid="7142453371222249965">"手機會記得在飛航模式下保持藍牙開啟。如果不要保持開啟，請關閉藍牙。"</string>
+    <string name="bluetooth_and_wifi_stays_on_title" msgid="5821932798860821244">"Wi-Fi 和藍牙會保持開啟狀態"</string>
+    <string name="bluetooth_and_wifi_stays_on_message" msgid="2390749828997719812">"手機會記得在飛航模式下保持 Wi-Fi 和藍牙開啟。如果不要保持開啟，請關閉 Wi-Fi 和藍牙。"</string>
 </resources>
diff --git a/android/app/res/values-zu/strings.xml b/android/app/res/values-zu/strings.xml
index 18c798f..c4c03cd 100644
--- a/android/app/res/values-zu/strings.xml
+++ b/android/app/res/values-zu/strings.xml
@@ -128,4 +128,10 @@
     <string name="a2dp_sink_mbs_label" msgid="6035366346569127155">"Umsindo we-Bluetooth"</string>
     <string name="bluetooth_opp_file_limit_exceeded" msgid="6612109860149473930">"Amafayela amakhulu kuno-4GB awakwazi ukudluliselwa"</string>
     <string name="bluetooth_connect_action" msgid="2319449093046720209">"Xhumeka ku-Bluetooth"</string>
+    <string name="bluetooth_enabled_apm_title" msgid="6914461147844949044">"I-Bluetooth ivuliwe kumodi yendiza"</string>
+    <string name="bluetooth_enabled_apm_message" msgid="8409900562494838113">"Uma ugcina i-Wi‑Fi ivuliwe, ifoni yakho izokhumbula ukuyigcina ivuliwe ngesikhathi esilandelayo uma ukumodi yendiza."</string>
+    <string name="bluetooth_stays_on_title" msgid="39720820955212918">"I-Bluetooth ihlala ivuliwe"</string>
+    <string name="bluetooth_stays_on_message" msgid="7142453371222249965">"Ifoni yakho ikhumbula ukugcina i-Bluetooth ivuliwe kumodi yendiza. Vala i-Bluetooth uma ungafuni ukuthi ihlale ivuliwe."</string>
+    <string name="bluetooth_and_wifi_stays_on_title" msgid="5821932798860821244">"I-Wi-Fi ne-Bluetooth kuhlala kuvuliwe"</string>
+    <string name="bluetooth_and_wifi_stays_on_message" msgid="2390749828997719812">"Ifoni yakho ikhumbula ukugcina i-Wi-Fi ne-Bluetooth kuvuliwe kumodi yendiza. Vala i-Wi-Fi ne-Bluetooth uma ungafuni ukuthi ihlale ivuliwe."</string>
 </resources>
diff --git a/android/app/res/values/config.xml b/android/app/res/values/config.xml
index 8e8c755..1e062b5 100644
--- a/android/app/res/values/config.xml
+++ b/android/app/res/values/config.xml
@@ -33,6 +33,34 @@
     <integer name="gatt_low_power_min_interval">80</integer>
     <integer name="gatt_low_power_max_interval">100</integer>
 
+    <!-- min/max connection intervals/latencies for companion devices -->
+    <!-- Primary companion -->
+    <integer name="gatt_high_priority_min_interval_primary">6</integer>
+    <integer name="gatt_high_priority_max_interval_primary">8</integer>
+    <integer name="gatt_high_priority_latency_primary">45</integer>
+
+    <integer name="gatt_balanced_priority_min_interval_primary">6</integer>
+    <integer name="gatt_balanced_priority_max_interval_primary">10</integer>
+    <integer name="gatt_balanced_priority_latency_primary">120</integer>
+
+    <integer name="gatt_low_power_min_interval_primary">8</integer>
+    <integer name="gatt_low_power_max_interval_primary">10</integer>
+    <integer name="gatt_low_power_latency_primary">150</integer>
+
+    <!-- Secondary companion -->
+    <integer name="gatt_high_priority_min_interval_secondary">6</integer>
+    <integer name="gatt_high_priority_max_interval_secondary">6</integer>
+    <integer name="gatt_high_priority_latency_secondary">0</integer>
+
+    <integer name="gatt_balanced_priority_min_interval_secondary">12</integer>
+    <integer name="gatt_balanced_priority_max_interval_secondary">12</integer>
+    <integer name="gatt_balanced_priority_latency_secondary">30</integer>
+
+    <integer name="gatt_low_power_min_interval_secondary">80</integer>
+    <integer name="gatt_low_power_max_interval_secondary">100</integer>
+    <integer name="gatt_low_power_latency_secondary">15</integer>
+    <!-- ============================================================ -->
+
     <!-- Specifies latency parameters for high priority, balanced and low power
          GATT configurations. These values represents the number of packets a
          peripheral device is allowed to skip. -->
@@ -62,11 +90,8 @@
     <!-- For enabling browsed cover art with the AVRCP Controller Cover Artwork feature -->
     <bool name="avrcp_controller_cover_art_browsed_images">false</bool>
 
-    <!-- For enabling the hfp client connection service -->
-    <bool name="hfp_client_connection_service_enabled">false</bool>
-
     <!-- For supporting emergency call through the hfp client connection service  -->
-    <bool name="hfp_client_connection_service_support_emergency_call">false</bool>
+    <bool name="hfp_client_connection_service_support_emergency_call">true</bool>
 
     <!-- Enabling autoconnect over pan -->
     <bool name="config_bluetooth_pan_enable_autoconnect">false</bool>
@@ -85,6 +110,7 @@
     <integer name="a2dp_source_codec_priority_aptx_hd">4001</integer>
     <integer name="a2dp_source_codec_priority_ldac">5001</integer>
     <integer name="a2dp_source_codec_priority_lc3">6001</integer>
+    <integer name="a2dp_source_codec_priority_opus">7001</integer>
 
     <!-- For enabling the AVRCP Target Cover Artowrk feature-->
     <bool name="avrcp_target_enable_cover_art">true</bool>
diff --git a/android/app/res/values/strings.xml b/android/app/res/values/strings.xml
index cc48922..46b9ad4 100644
--- a/android/app/res/values/strings.xml
+++ b/android/app/res/values/strings.xml
@@ -248,4 +248,10 @@
     <string name="a2dp_sink_mbs_label">Bluetooth Audio</string>
     <string name="bluetooth_opp_file_limit_exceeded">Files bigger than 4GB cannot be transferred</string>
     <string name="bluetooth_connect_action">Connect to Bluetooth</string>
+    <string name="bluetooth_enabled_apm_title">Bluetooth on in airplane mode</string>
+    <string name="bluetooth_enabled_apm_message">If you keep Bluetooth on, your phone will remember to keep it on the next time you\'re in airplane mode</string>
+    <string name="bluetooth_stays_on_title">Bluetooth stays on</string>
+    <string name="bluetooth_stays_on_message">Your phone remembers to keep Bluetooth on in airplane mode. Turn off Bluetooth if you don\'t want it to stay on.</string>
+    <string name="bluetooth_and_wifi_stays_on_title">Wi-Fi and Bluetooth stay on</string>
+    <string name="bluetooth_and_wifi_stays_on_message">Your phone remembers to keep Wi-Fi and Bluetooth on in airplane mode. Turn off Wi-Fi and Bluetooth if you don\'t want them to stay on.</string>
 </resources>
diff --git a/android/app/res/values/styles.xml b/android/app/res/values/styles.xml
index 91f402d..ea94695 100644
--- a/android/app/res/values/styles.xml
+++ b/android/app/res/values/styles.xml
@@ -31,7 +31,7 @@
         <item name="android:paddingTop">10dip</item>
         <item name="android:textAlignment">viewStart</item>
         <item name="android:textAppearance">@android:style/TextAppearance.Material.Body1</item>
-        <item name="android:textColor">@*android:color/secondary_text_default_material_light</item>
+        <item name="android:textColor">?android:attr/textColorSecondary</item>
     </style>
 
     <style name="file_transfer_item_content">
@@ -42,7 +42,7 @@
         <item name="android:paddingBottom">10dip</item>
         <item name="android:textAlignment">viewStart</item>
         <item name="android:textAppearance">@android:style/TextAppearance.Material.Subhead</item>
-        <item name="android:textColor">@*android:color/primary_text_default_material_light</item>
+        <item name="android:textColor">?android:attr/textColorPrimary</item>
     </style>
 
     <style name="dialog" parent="android:style/Theme.Material.Light.Dialog.Alert" />
diff --git a/android/app/src/com/android/bluetooth/AlertActivity.java b/android/app/src/com/android/bluetooth/AlertActivity.java
index 8583173..cb5e15e 100644
--- a/android/app/src/com/android/bluetooth/AlertActivity.java
+++ b/android/app/src/com/android/bluetooth/AlertActivity.java
@@ -27,6 +27,9 @@
 import android.view.ViewGroup;
 import android.view.Window;
 import android.view.accessibility.AccessibilityEvent;
+import android.widget.Button;
+
+import com.android.internal.annotations.VisibleForTesting;
 
 /**
  * An activity that follows the visual style of an AlertDialog.
@@ -119,6 +122,11 @@
         mAlert.getButton(identifier).setEnabled(enable);
     }
 
+    @VisibleForTesting
+    public Button getButton(int identifier) {
+        return mAlert.getButton(identifier);
+    }
+
     @Override
     protected void onDestroy() {
         if (mAlert != null) {
diff --git a/android/app/src/com/android/bluetooth/BluetoothMethodProxy.java b/android/app/src/com/android/bluetooth/BluetoothMethodProxy.java
new file mode 100644
index 0000000..00cf686
--- /dev/null
+++ b/android/app/src/com/android/bluetooth/BluetoothMethodProxy.java
@@ -0,0 +1,243 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth;
+
+import android.annotation.NonNull;
+import android.annotation.RequiresPermission;
+import android.bluetooth.BluetoothAdapter;
+import android.bluetooth.BluetoothDevice;
+import android.bluetooth.le.PeriodicAdvertisingCallback;
+import android.bluetooth.le.PeriodicAdvertisingManager;
+import android.bluetooth.le.ScanResult;
+import android.content.ContentProviderClient;
+import android.content.ContentResolver;
+import android.content.ContentValues;
+import android.content.Context;
+import android.content.Intent;
+import android.content.res.AssetFileDescriptor;
+import android.database.Cursor;
+import android.net.Uri;
+import android.os.Bundle;
+import android.os.CancellationSignal;
+import android.os.Handler;
+import android.os.ParcelFileDescriptor;
+import android.provider.Telephony;
+import android.util.Log;
+
+import com.android.bluetooth.gatt.AppAdvertiseStats;
+import com.android.bluetooth.gatt.ContextMap;
+import com.android.bluetooth.gatt.GattService;
+import com.android.internal.annotations.VisibleForTesting;
+import com.android.obex.HeaderSet;
+
+import java.io.FileNotFoundException;
+import java.io.IOException;
+import java.io.InputStream;
+import java.util.Set;
+
+/**
+ * Proxy class for method calls to help with unit testing
+ */
+public class BluetoothMethodProxy {
+    private static final String TAG = BluetoothMethodProxy.class.getSimpleName();
+    private static final Object INSTANCE_LOCK = new Object();
+    private static BluetoothMethodProxy sInstance;
+
+    private BluetoothMethodProxy() {
+    }
+
+    /**
+     * Get the singleton instance of proxy
+     *
+     * @return the singleton instance, guaranteed not null
+     */
+    public static BluetoothMethodProxy getInstance() {
+        synchronized (INSTANCE_LOCK) {
+            if (sInstance == null) {
+                sInstance = new BluetoothMethodProxy();
+            }
+        }
+        return sInstance;
+    }
+
+    /**
+     * Allow unit tests to substitute BluetoothPbapMethodCallProxy with a test instance
+     *
+     * @param proxy a test instance of the BluetoothPbapMethodCallProxy
+     */
+    @VisibleForTesting
+    public static void setInstanceForTesting(BluetoothMethodProxy proxy) {
+        Utils.enforceInstrumentationTestMode();
+        synchronized (INSTANCE_LOCK) {
+            Log.d(TAG, "setInstanceForTesting(), set to " + proxy);
+            sInstance = proxy;
+        }
+    }
+
+    /**
+     * Proxies {@link ContentResolver#query(Uri, String[], String, String[], String)}.
+     */
+    public Cursor contentResolverQuery(ContentResolver contentResolver, final Uri contentUri,
+            final String[] projection, final String selection, final String[] selectionArgs,
+            final String sortOrder) {
+        return contentResolver.query(contentUri, projection, selection, selectionArgs, sortOrder);
+    }
+
+    /**
+     * Proxies {@link ContentResolver#query(Uri, String[], Bundle, CancellationSignal)}.
+     */
+    public Cursor contentResolverQuery(ContentResolver contentResolver, final Uri contentUri,
+            final String[] projection, final Bundle queryArgs,
+            final CancellationSignal cancellationSignal) {
+        return contentResolver.query(contentUri, projection, queryArgs, cancellationSignal);
+    }
+
+    /**
+     * Proxies {@link ContentResolver#insert(Uri, ContentValues)}.
+     */
+    public Uri contentResolverInsert(ContentResolver contentResolver, final Uri contentUri,
+            final ContentValues contentValues) {
+        return contentResolver.insert(contentUri, contentValues);
+    }
+
+    /**
+     * Proxies {@link ContentResolver#update(Uri, ContentValues, String, String[])}.
+     */
+    public int contentResolverUpdate(ContentResolver contentResolver, final Uri contentUri,
+            final ContentValues contentValues, String where, String[] selectionArgs) {
+        return contentResolver.update(contentUri, contentValues, where, selectionArgs);
+    }
+
+    /**
+     * Proxies {@link ContentResolver#delete(Uri, String, String[])}.
+     */
+    public int contentResolverDelete(ContentResolver contentResolver, final Uri url,
+            final String where,
+            final String[] selectionArgs) {
+        return contentResolver.delete(url, where, selectionArgs);
+    }
+
+    /**
+     * Proxies {@link BluetoothAdapter#isEnabled()}.
+     */
+    public boolean bluetoothAdapterIsEnabled(BluetoothAdapter adapter) {
+        return adapter.isEnabled();
+    }
+
+    /**
+     * Proxies {@link ContentResolver#openFileDescriptor(Uri, String)}.
+     */
+    public ParcelFileDescriptor contentResolverOpenFileDescriptor(ContentResolver contentResolver,
+            final Uri uri, final String mode) throws FileNotFoundException {
+        return contentResolver.openFileDescriptor(uri, mode);
+    }
+
+    /**
+     * Proxies {@link ContentResolver#openAssetFileDescriptor(Uri, String)}.
+     */
+    public AssetFileDescriptor contentResolverOpenAssetFileDescriptor(
+            ContentResolver contentResolver, final Uri uri, final String mode)
+            throws FileNotFoundException {
+        return contentResolver.openAssetFileDescriptor(uri, mode);
+    }
+
+    /**
+     * Proxies {@link ContentResolver#openInputStream(Uri)}.
+     */
+    public InputStream contentResolverOpenInputStream(ContentResolver contentResolver,
+            final Uri uri) throws FileNotFoundException {
+        return contentResolver.openInputStream(uri);
+    }
+
+    /**
+     * Proxies {@link ContentResolver#acquireUnstableContentProviderClient(String)}.
+     */
+    public ContentProviderClient contentResolverAcquireUnstableContentProviderClient(
+            ContentResolver contentResolver, @NonNull String name) {
+        return contentResolver.acquireUnstableContentProviderClient(name);
+    }
+
+    /**
+     * Proxies {@link Context#sendBroadcast(Intent)}.
+     */
+    public void contextSendBroadcast(Context context, @RequiresPermission Intent intent) {
+        context.sendBroadcast(intent);
+    }
+
+    /**
+     * Proxies {@link Handler#sendEmptyMessage(int)}}.
+     */
+    public boolean handlerSendEmptyMessage(Handler handler, final int what) {
+        return handler.sendEmptyMessage(what);
+    }
+
+    /**
+     * Proxies {@link HeaderSet#getHeader}.
+     */
+    public Object getHeader(HeaderSet headerSet, int headerId) throws IOException {
+        return headerSet.getHeader(headerId);
+    }
+
+    /**
+     * Proxies {@link Context#getSystemService(Class)}.
+     */
+    public <T> T getSystemService(Context context, Class<T> serviceClass) {
+        return context.getSystemService(serviceClass);
+    }
+
+    /**
+     * Proxies {@link Telephony.Threads#getOrCreateThreadId(Context, Set <String>)}.
+     */
+    public long telephonyGetOrCreateThreadId(Context context, Set<String> recipients) {
+        return Telephony.Threads.getOrCreateThreadId(context, recipients);
+    }
+
+    /**
+     * Proxies {@link PeriodicAdvertisingManager#registerSync(ScanResult, int, int,
+     * PeriodicAdvertisingCallback, Handler)}.
+     */
+    public void periodicAdvertisingManagerRegisterSync(PeriodicAdvertisingManager manager,
+            ScanResult scanResult, int skip, int timeout,
+            PeriodicAdvertisingCallback callback, Handler handler) {
+        manager.registerSync(scanResult, skip, timeout, callback, handler);
+    }
+
+    /**
+     * Proxies {@link PeriodicAdvertisingManager#transferSync}.
+     */
+    public void periodicAdvertisingManagerTransferSync(PeriodicAdvertisingManager manager,
+            BluetoothDevice bda, int serviceData, int syncHandle) {
+        manager.transferSync(bda, serviceData, syncHandle);
+    }
+
+    /**
+     * Proxies {@link PeriodicAdvertisingManager#transferSetInfo}.
+     */
+    public void periodicAdvertisingManagerTransferSetInfo(
+            PeriodicAdvertisingManager manager, BluetoothDevice bda, int serviceData,
+            int advHandle, PeriodicAdvertisingCallback callback) {
+        manager.transferSetInfo(bda, serviceData, advHandle, callback);
+    }
+
+    /**
+     * Proxies {@link AppAdvertiseStats}.
+     */
+    public AppAdvertiseStats createAppAdvertiseStats(int appUid, int id, String name,
+            ContextMap map, GattService service) {
+        return new AppAdvertiseStats(appUid, id, name, map, service);
+    }
+}
diff --git a/android/app/src/com/android/bluetooth/ObexAppParameters.java b/android/app/src/com/android/bluetooth/ObexAppParameters.java
new file mode 100644
index 0000000..80a3645
--- /dev/null
+++ b/android/app/src/com/android/bluetooth/ObexAppParameters.java
@@ -0,0 +1,182 @@
+/*
+ * Copyright (C) 2014 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth;
+
+import com.android.obex.HeaderSet;
+
+import java.io.IOException;
+import java.nio.ByteBuffer;
+import java.util.HashMap;
+import java.util.Map;
+
+public final class ObexAppParameters {
+
+    private final HashMap<Byte, byte[]> mParams;
+
+    public ObexAppParameters() {
+        mParams = new HashMap<Byte, byte[]>();
+    }
+
+    public ObexAppParameters(byte[] raw) {
+        mParams = new HashMap<Byte, byte[]>();
+
+        if (raw != null) {
+            for (int i = 0; i < raw.length; ) {
+                if (raw.length - i < 2) {
+                    break;
+                }
+
+                byte tag = raw[i++];
+                byte len = raw[i++];
+
+                if (raw.length - i - len < 0) {
+                    break;
+                }
+
+                byte[] val = new byte[len];
+
+                System.arraycopy(raw, i, val, 0, len);
+                this.add(tag, val);
+
+                i += len;
+            }
+        }
+    }
+
+    public static ObexAppParameters fromHeaderSet(HeaderSet headerset) {
+        try {
+            byte[] raw = (byte[]) headerset.getHeader(HeaderSet.APPLICATION_PARAMETER);
+            return new ObexAppParameters(raw);
+        } catch (IOException e) {
+            // won't happen
+        }
+
+        return null;
+    }
+
+    public byte[] getHeader() {
+        int length = 0;
+
+        for (Map.Entry<Byte, byte[]> entry : mParams.entrySet()) {
+            length += (entry.getValue().length + 2);
+        }
+
+        byte[] ret = new byte[length];
+
+        int idx = 0;
+        for (Map.Entry<Byte, byte[]> entry : mParams.entrySet()) {
+            length = entry.getValue().length;
+
+            ret[idx++] = entry.getKey();
+            ret[idx++] = (byte) length;
+            System.arraycopy(entry.getValue(), 0, ret, idx, length);
+            idx += length;
+        }
+
+        return ret;
+    }
+
+    public void addToHeaderSet(HeaderSet headerset) {
+        if (mParams.size() > 0) {
+            headerset.setHeader(HeaderSet.APPLICATION_PARAMETER, getHeader());
+        }
+    }
+
+    public boolean exists(byte tag) {
+        return mParams.containsKey(tag);
+    }
+
+    public void add(byte tag, byte val) {
+        byte[] bval = ByteBuffer.allocate(1).put(val).array();
+        mParams.put(tag, bval);
+    }
+
+    public void add(byte tag, short val) {
+        byte[] bval = ByteBuffer.allocate(2).putShort(val).array();
+        mParams.put(tag, bval);
+    }
+
+    public void add(byte tag, int val) {
+        byte[] bval = ByteBuffer.allocate(4).putInt(val).array();
+        mParams.put(tag, bval);
+    }
+
+    public void add(byte tag, long val) {
+        byte[] bval = ByteBuffer.allocate(8).putLong(val).array();
+        mParams.put(tag, bval);
+    }
+
+    public void add(byte tag, String val) {
+        byte[] bval = val.getBytes();
+        mParams.put(tag, bval);
+    }
+
+    public void add(byte tag, byte[] bval) {
+        mParams.put(tag, bval);
+    }
+
+    public byte getByte(byte tag) {
+        byte[] bval = mParams.get(tag);
+
+        if (bval == null || bval.length < 1) {
+            return 0;
+        }
+
+        return ByteBuffer.wrap(bval).get();
+    }
+
+    public short getShort(byte tag) {
+        byte[] bval = mParams.get(tag);
+
+        if (bval == null || bval.length < 2) {
+            return 0;
+        }
+
+        return ByteBuffer.wrap(bval).getShort();
+    }
+
+    public int getInt(byte tag) {
+        byte[] bval = mParams.get(tag);
+
+        if (bval == null || bval.length < 4) {
+            return 0;
+        }
+
+        return ByteBuffer.wrap(bval).getInt();
+    }
+
+    public String getString(byte tag) {
+        byte[] bval = mParams.get(tag);
+
+        if (bval == null) {
+            return null;
+        }
+
+        return new String(bval);
+    }
+
+    public byte[] getByteArray(byte tag) {
+        byte[] bval = mParams.get(tag);
+
+        return bval;
+    }
+
+    @Override
+    public String toString() {
+        return mParams.toString();
+    }
+}
diff --git a/android/app/src/com/android/bluetooth/Utils.java b/android/app/src/com/android/bluetooth/Utils.java
index abe63ba..b22b3aa 100644
--- a/android/app/src/com/android/bluetooth/Utils.java
+++ b/android/app/src/com/android/bluetooth/Utils.java
@@ -373,9 +373,12 @@
      */
     public static boolean isPackageNameAccurate(Context context, String callingPackage,
             int callingUid) {
+        UserHandle callingUser = UserHandle.getUserHandleForUid(callingUid);
+
         // Verifies the integrity of the calling package name
         try {
-            int packageUid = context.getPackageManager().getPackageUid(callingPackage, 0);
+            int packageUid = context.createContextAsUser(callingUser, 0)
+                    .getPackageManager().getPackageUid(callingPackage, 0);
             if (packageUid != callingUid) {
                 Log.e(TAG, "isPackageNameAccurate: App with package name " + callingPackage
                         + " is UID " + packageUid + " but caller is " + callingUid);
@@ -424,8 +427,6 @@
                 "Need DUMP permission");
     }
 
-    /**
-     */
     public static AttributionSource getCallingAttributionSource(Context context) {
         int callingUid = Binder.getCallingUid();
         if (callingUid == android.os.Process.ROOT_UID) {
@@ -460,6 +461,9 @@
     @SuppressLint("AndroidFrameworkRequiresPermission")
     private static boolean checkPermissionForDataDelivery(Context context, String permission,
             AttributionSource attributionSource, String message) {
+        if (isInstrumentationTestMode()) {
+            return true;
+        }
         // STOPSHIP(b/188391719): enable this security enforcement
         // attributionSource.enforceCallingUid();
         AttributionSource currentAttribution = new AttributionSource
@@ -617,7 +621,7 @@
         return false;
     }
 
-    public static boolean checkCallerIsSystemOrActiveUser() {
+    private static boolean checkCallerIsSystemOrActiveUser() {
         int callingUid = Binder.getCallingUid();
         UserHandle callingUser = UserHandle.getUserHandleForUid(callingUid);
 
@@ -638,7 +642,7 @@
         return checkCallerIsSystemOrActiveUser(tag + "." + method + "()");
     }
 
-    public static boolean checkCallerIsSystemOrActiveOrManagedUser(Context context) {
+    private static boolean checkCallerIsSystemOrActiveOrManagedUser(Context context) {
         if (context == null) {
             return checkCallerIsSystemOrActiveUser();
         }
@@ -666,6 +670,9 @@
     }
 
     public static boolean checkCallerIsSystemOrActiveOrManagedUser(Context context, String tag) {
+        if (isInstrumentationTestMode()) {
+            return true;
+        }
         final boolean res = checkCallerIsSystemOrActiveOrManagedUser(context);
         if (!res) {
             Log.w(TAG, tag + " - Not allowed for"
@@ -1001,7 +1008,8 @@
         }
         values.put(Telephony.Sms.ERROR_CODE, 0);
 
-        return 1 == context.getContentResolver().update(uri, values, null, null);
+        return 1 == BluetoothMethodProxy.getInstance().contentResolverUpdate(
+                context.getContentResolver(), uri, values, null, null);
     }
 
     /**
diff --git a/android/app/src/com/android/bluetooth/a2dp/A2dpCodecConfig.java b/android/app/src/com/android/bluetooth/a2dp/A2dpCodecConfig.java
index 3084aaa..0b1c16b 100644
--- a/android/app/src/com/android/bluetooth/a2dp/A2dpCodecConfig.java
+++ b/android/app/src/com/android/bluetooth/a2dp/A2dpCodecConfig.java
@@ -37,6 +37,9 @@
     private static final boolean DBG = true;
     private static final String TAG = "A2dpCodecConfig";
 
+    // TODO(b/240635097): remove in U
+    private static final int SOURCE_CODEC_TYPE_OPUS = 6;
+
     private Context mContext;
     private A2dpNativeInterface mA2dpNativeInterface;
 
@@ -53,6 +56,8 @@
             BluetoothCodecConfig.CODEC_PRIORITY_DEFAULT;
     private @CodecPriority int mA2dpSourceCodecPriorityLc3 =
             BluetoothCodecConfig.CODEC_PRIORITY_DEFAULT;
+    private @CodecPriority int mA2dpSourceCodecPriorityOpus =
+            BluetoothCodecConfig.CODEC_PRIORITY_DEFAULT;
 
     private BluetoothCodecConfig[] mCodecConfigOffloading = new BluetoothCodecConfig[0];
 
@@ -243,6 +248,16 @@
             mA2dpSourceCodecPriorityLc3 = value;
         }
 
+        try {
+            value = resources.getInteger(R.integer.a2dp_source_codec_priority_opus);
+        } catch (NotFoundException e) {
+            value = BluetoothCodecConfig.CODEC_PRIORITY_DEFAULT;
+        }
+        if ((value >= BluetoothCodecConfig.CODEC_PRIORITY_DISABLED) && (value
+                < BluetoothCodecConfig.CODEC_PRIORITY_HIGHEST)) {
+            mA2dpSourceCodecPriorityOpus = value;
+        }
+
         BluetoothCodecConfig codecConfig;
         BluetoothCodecConfig[] codecConfigArray =
                 new BluetoothCodecConfig[6];
@@ -272,8 +287,9 @@
                 .build();
         codecConfigArray[4] = codecConfig;
         codecConfig = new BluetoothCodecConfig.Builder()
-                .setCodecType(BluetoothCodecConfig.SOURCE_CODEC_TYPE_LC3)
-                .setCodecPriority(mA2dpSourceCodecPriorityLc3)
+                // TODO(b/240635097): update in U
+                .setCodecType(SOURCE_CODEC_TYPE_OPUS)
+                .setCodecPriority(mA2dpSourceCodecPriorityOpus)
                 .build();
         codecConfigArray[5] = codecConfig;
 
@@ -282,14 +298,16 @@
 
     public void switchCodecByBufferSize(
             BluetoothDevice device, boolean isLowLatency, int currentCodecType) {
-        if ((isLowLatency && currentCodecType == BluetoothCodecConfig.SOURCE_CODEC_TYPE_LC3)
-        || (!isLowLatency && currentCodecType != BluetoothCodecConfig.SOURCE_CODEC_TYPE_LC3)) {
+        // TODO(b/240635097): update in U
+        if ((isLowLatency && currentCodecType == SOURCE_CODEC_TYPE_OPUS)
+                || (!isLowLatency && currentCodecType != SOURCE_CODEC_TYPE_OPUS)) {
             return;
         }
         BluetoothCodecConfig[] codecConfigArray = assignCodecConfigPriorities();
         for (int i = 0; i < codecConfigArray.length; i++){
             BluetoothCodecConfig codecConfig = codecConfigArray[i];
-            if (codecConfig.getCodecType() == BluetoothCodecConfig.SOURCE_CODEC_TYPE_LC3) {
+            // TODO(b/240635097): update in U
+            if (codecConfig.getCodecType() == SOURCE_CODEC_TYPE_OPUS) {
                 if (isLowLatency) {
                     codecConfig.setCodecPriority(BluetoothCodecConfig.CODEC_PRIORITY_HIGHEST);
                 } else {
diff --git a/android/app/src/com/android/bluetooth/a2dp/A2dpService.java b/android/app/src/com/android/bluetooth/a2dp/A2dpService.java
index c152741..7ca6166 100644
--- a/android/app/src/com/android/bluetooth/a2dp/A2dpService.java
+++ b/android/app/src/com/android/bluetooth/a2dp/A2dpService.java
@@ -71,6 +71,9 @@
     private static final boolean DBG = true;
     private static final String TAG = "A2dpService";
 
+    // TODO(b/240635097): remove in U
+    private static final int SOURCE_CODEC_TYPE_OPUS = 6;
+
     private static A2dpService sA2dpService;
 
     private AdapterService mAdapterService;
@@ -103,7 +106,6 @@
     boolean mA2dpOffloadEnabled = false;
 
     private BroadcastReceiver mBondStateChangedReceiver;
-    private BroadcastReceiver mConnectionStateChangedReceiver;
 
     public static boolean isEnabled() {
         return BluetoothProperties.isProfileA2dpSourceEnabled().orElse(false);
@@ -166,10 +168,6 @@
         filter.addAction(BluetoothDevice.ACTION_BOND_STATE_CHANGED);
         mBondStateChangedReceiver = new BondStateChangedReceiver();
         registerReceiver(mBondStateChangedReceiver, filter);
-        filter = new IntentFilter();
-        filter.addAction(BluetoothA2dp.ACTION_CONNECTION_STATE_CHANGED);
-        mConnectionStateChangedReceiver = new ConnectionStateChangedReceiver();
-        registerReceiver(mConnectionStateChangedReceiver, filter);
 
         // Step 8: Mark service as started
         setA2dpService(this);
@@ -205,8 +203,6 @@
         setA2dpService(null);
 
         // Step 7: Unregister broadcast receivers
-        unregisterReceiver(mConnectionStateChangedReceiver);
-        mConnectionStateChangedReceiver = null;
         unregisterReceiver(mBondStateChangedReceiver);
         mBondStateChangedReceiver = null;
 
@@ -490,6 +486,20 @@
                 if (mActiveDevice == null) return;
                 previousActiveDevice = mActiveDevice;
             }
+
+            int prevActiveConnectionState = getConnectionState(previousActiveDevice);
+
+            // As per b/202602952, if we remove the active device due to a disconnection,
+            // we need to check if another device is connected and set it active instead.
+            // Calling this before any other active related calls has the same effect as
+            // a classic active device switch.
+            BluetoothDevice fallbackdevice = getFallbackDevice();
+            if (fallbackdevice != null && prevActiveConnectionState
+                    != BluetoothProfile.STATE_CONNECTED) {
+                setActiveDevice(fallbackdevice);
+                return;
+            }
+
             // This needs to happen before we inform the audio manager that the device
             // disconnected. Please see comment in updateAndBroadcastActiveDevice() for why.
             updateAndBroadcastActiveDevice(null);
@@ -499,7 +509,7 @@
             // device, the user has explicitly switched the output to the local device and music
             // should continue playing. Otherwise, the remote device has been indeed disconnected
             // and audio should be suspended before switching the output to the local device.
-            boolean stopAudio = forceStopPlayingAudio || (getConnectionState(previousActiveDevice)
+            boolean stopAudio = forceStopPlayingAudio || (prevActiveConnectionState
                         != BluetoothProfile.STATE_CONNECTED);
             mAudioManager.handleBluetoothActiveDeviceChanged(null, previousActiveDevice,
                     BluetoothProfileConnectionInfo.createA2dpInfo(!stopAudio, -1));
@@ -586,6 +596,7 @@
             // This needs to happen before we inform the audio manager that the device
             // disconnected. Please see comment in updateAndBroadcastActiveDevice() for why.
             updateAndBroadcastActiveDevice(device);
+            updateLowLatencyAudioSupport(device);
 
             BluetoothDevice newActiveDevice = null;
             synchronized (mStateMachines) {
@@ -805,6 +816,7 @@
             Log.e(TAG, "enableOptionalCodecs: Codec status is null");
             return;
         }
+        updateLowLatencyAudioSupport(device);
         mA2dpCodecConfig.enableOptionalCodecs(device, codecStatus.getCodecConfig());
     }
 
@@ -835,6 +847,7 @@
             Log.e(TAG, "disableOptionalCodecs: Codec status is null");
             return;
         }
+        updateLowLatencyAudioSupport(device);
         mA2dpCodecConfig.disableOptionalCodecs(device, codecStatus.getCodecConfig());
     }
 
@@ -1194,7 +1207,35 @@
         }
     }
 
-    private void connectionStateChanged(BluetoothDevice device, int fromState, int toState) {
+    /**
+     *  Check for low-latency codec support and inform AdapterService
+     *
+     *  @param device device whose audio low latency will be allowed or disallowed
+     */
+    @VisibleForTesting
+    public void updateLowLatencyAudioSupport(BluetoothDevice device) {
+        synchronized (mStateMachines) {
+            A2dpStateMachine sm = mStateMachines.get(device);
+            if (sm == null) {
+                return;
+            }
+            BluetoothCodecStatus codecStatus = sm.getCodecStatus();
+            boolean lowLatencyAudioAllow = false;
+            BluetoothCodecConfig lowLatencyCodec = new BluetoothCodecConfig.Builder()
+                    .setCodecType(SOURCE_CODEC_TYPE_OPUS) // remove in U
+                    .build();
+
+            if (codecStatus != null
+                    && codecStatus.isCodecConfigSelectable(lowLatencyCodec)
+                    && getOptionalCodecsEnabled(device)
+                            == BluetoothA2dp.OPTIONAL_CODECS_PREF_ENABLED) {
+                lowLatencyAudioAllow = true;
+            }
+            mAdapterService.allowLowLatencyAudio(lowLatencyAudioAllow, device);
+        }
+    }
+
+    void connectionStateChanged(BluetoothDevice device, int fromState, int toState) {
         if ((device == null) || (fromState == toState)) {
             return;
         }
@@ -1221,24 +1262,13 @@
     }
 
     /**
-     * Receiver for processing device connection state changes.
-     *
-     * <ul>
-     * <li> Update codec support per device when device is (re)connected
-     * <li> Delete the state machine instance if the device is disconnected and unbond
-     * </ul>
+     * Retrieves the most recently connected device in the A2DP connected devices list.
      */
-    private class ConnectionStateChangedReceiver extends BroadcastReceiver {
-        @Override
-        public void onReceive(Context context, Intent intent) {
-            if (!BluetoothA2dp.ACTION_CONNECTION_STATE_CHANGED.equals(intent.getAction())) {
-                return;
-            }
-            BluetoothDevice device = intent.getParcelableExtra(BluetoothDevice.EXTRA_DEVICE);
-            int toState = intent.getIntExtra(BluetoothProfile.EXTRA_STATE, -1);
-            int fromState = intent.getIntExtra(BluetoothProfile.EXTRA_PREVIOUS_STATE, -1);
-            connectionStateChanged(device, fromState, toState);
-        }
+    public BluetoothDevice getFallbackDevice() {
+        DatabaseManager dbManager = mAdapterService.getDatabase();
+        return dbManager != null ? dbManager
+            .getMostRecentlyConnectedDevicesInList(getConnectedDevices())
+            : null;
     }
 
     /**
@@ -1251,8 +1281,11 @@
 
         @RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)
         private A2dpService getService(AttributionSource source) {
-            if (!Utils.checkCallerIsSystemOrActiveUser(TAG)
-                    || !Utils.checkServiceAvailable(mService, TAG)
+            if (Utils.isInstrumentationTestMode()) {
+                return mService;
+            }
+            if (!Utils.checkServiceAvailable(mService, TAG)
+                    || !Utils.checkCallerIsSystemOrActiveOrManagedUser(mService, TAG)
                     || !Utils.checkConnectPermissionForDataDelivery(mService, source, TAG)) {
                 return null;
             }
@@ -1641,6 +1674,9 @@
     }
 
     public void switchCodecByBufferSize(BluetoothDevice device, boolean isLowLatency) {
+        if (getOptionalCodecsEnabled(device) != BluetoothA2dp.OPTIONAL_CODECS_PREF_ENABLED) {
+            return;
+        }
         mA2dpCodecConfig.switchCodecByBufferSize(
                 device, isLowLatency, getCodecStatus(device).getCodecConfig().getCodecType());
     }
diff --git a/android/app/src/com/android/bluetooth/a2dp/A2dpStateMachine.java b/android/app/src/com/android/bluetooth/a2dp/A2dpStateMachine.java
index f14ccac..11d33ad 100644
--- a/android/app/src/com/android/bluetooth/a2dp/A2dpStateMachine.java
+++ b/android/app/src/com/android/bluetooth/a2dp/A2dpStateMachine.java
@@ -76,6 +76,9 @@
     private static final boolean DBG = true;
     private static final String TAG = "A2dpStateMachine";
 
+    // TODO(b/240635097): remove in U
+    private static final int SOURCE_CODEC_TYPE_OPUS = 6;
+
     static final int CONNECT = 1;
     static final int DISCONNECT = 2;
     @VisibleForTesting
@@ -480,6 +483,7 @@
             // codecs (perhaps it's had a firmware update, etc.) and save that state if
             // it differs from what we had saved before.
             mA2dpService.updateOptionalCodecsSupport(mDevice);
+            mA2dpService.updateLowLatencyAudioSupport(mDevice);
             broadcastConnectionState(mConnectionState, mLastConnectionState);
             // Upon connected, the audio starts out as stopped
             broadcastAudioState(BluetoothA2dp.STATE_NOT_PLAYING,
@@ -652,6 +656,7 @@
             // for this codec change event.
             mA2dpService.updateOptionalCodecsSupport(mDevice);
         }
+        mA2dpService.updateLowLatencyAudioSupport(mDevice);
         if (mA2dpOffloadEnabled) {
             boolean update = false;
             BluetoothCodecConfig newCodecConfig = mCodecStatus.getCodecConfig();
@@ -666,6 +671,13 @@
                     && (prevCodecConfig.getCodecSpecific1()
                         != newCodecConfig.getCodecSpecific1())) {
                 update = true;
+            } else if ((newCodecConfig.getCodecType()
+                        == SOURCE_CODEC_TYPE_OPUS) // TODO(b/240635097): update in U
+                    && (prevCodecConfig != null)
+                    // check framesize field
+                    && (prevCodecConfig.getCodecSpecific1()
+                        != newCodecConfig.getCodecSpecific1())) {
+                update = true;
             }
             if (update) {
                 mA2dpService.codecConfigUpdated(mDevice, mCodecStatus, false);
@@ -689,6 +701,7 @@
         intent.putExtra(BluetoothDevice.EXTRA_DEVICE, mDevice);
         intent.addFlags(Intent.FLAG_RECEIVER_REGISTERED_ONLY_BEFORE_BOOT
                         | Intent.FLAG_RECEIVER_INCLUDE_BACKGROUND);
+        mA2dpService.connectionStateChanged(mDevice, prevState, newState);
         mA2dpService.sendBroadcast(intent, BLUETOOTH_CONNECT,
                 Utils.getTempAllowlistBroadcastOptions());
     }
diff --git a/android/app/src/com/android/bluetooth/a2dpsink/A2dpSinkService.java b/android/app/src/com/android/bluetooth/a2dpsink/A2dpSinkService.java
index 52cbd21..5c945d7 100644
--- a/android/app/src/com/android/bluetooth/a2dpsink/A2dpSinkService.java
+++ b/android/app/src/com/android/bluetooth/a2dpsink/A2dpSinkService.java
@@ -190,14 +190,18 @@
     }
 
     //Binder object: Must be static class or memory leak may occur
-    private static class A2dpSinkServiceBinder extends IBluetoothA2dpSink.Stub
+    @VisibleForTesting
+    static class A2dpSinkServiceBinder extends IBluetoothA2dpSink.Stub
             implements IProfileServiceBinder {
         private A2dpSinkService mService;
 
         @RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)
         private A2dpSinkService getService(AttributionSource source) {
-            if (!Utils.checkCallerIsSystemOrActiveUser(TAG)
-                    || !Utils.checkServiceAvailable(mService, TAG)
+            if (Utils.isInstrumentationTestMode()) {
+                return mService;
+            }
+            if (!Utils.checkServiceAvailable(mService, TAG)
+                    || !Utils.checkCallerIsSystemOrActiveOrManagedUser(mService, TAG)
                     || !Utils.checkConnectPermissionForDataDelivery(mService, source, TAG)) {
                 return null;
             }
diff --git a/android/app/src/com/android/bluetooth/audio_util/MediaPlayerList.java b/android/app/src/com/android/bluetooth/audio_util/MediaPlayerList.java
index 1eebe99..97df3ce 100644
--- a/android/app/src/com/android/bluetooth/audio_util/MediaPlayerList.java
+++ b/android/app/src/com/android/bluetooth/audio_util/MediaPlayerList.java
@@ -31,6 +31,7 @@
 import android.media.session.PlaybackState;
 import android.os.Handler;
 import android.os.Looper;
+import android.os.SystemProperties;
 import android.text.TextUtils;
 import android.util.Log;
 import android.view.KeyEvent;
@@ -146,10 +147,45 @@
                 mContext.getMainExecutor(), mMediaKeyEventSessionChangedListener);
     }
 
+    private void constructCurrentPlayers() {
+        // Construct the list of current players
+        d("Initializing list of current media players");
+        List<android.media.session.MediaController> controllers =
+                mMediaSessionManager.getActiveSessions(null);
+
+        for (android.media.session.MediaController controller : controllers) {
+            addMediaPlayer(controller);
+        }
+
+        // If there were any active players and we don't already have one due to the Media
+        // Framework Callbacks then set the highest priority one to active
+        if (mActivePlayerId == 0 && mMediaPlayers.size() > 0) {
+            String packageName = mMediaSessionManager.getMediaKeyEventSessionPackageName();
+            if (!TextUtils.isEmpty(packageName) && haveMediaPlayer(packageName)) {
+                Log.i(TAG, "Set active player to MediaKeyEvent session = " + packageName);
+                setActivePlayer(mMediaPlayerIds.get(packageName));
+            } else {
+                Log.i(TAG, "Set active player to first default");
+                setActivePlayer(1);
+            }
+        }
+    }
+
     public void init(MediaUpdateCallback callback) {
         Log.v(TAG, "Initializing MediaPlayerList");
         mCallback = callback;
 
+        if (!SystemProperties.getBoolean("bluetooth.avrcp.browsable_media_player.enabled", true)) {
+            // Allow to disable BrowsablePlayerConnector with systemproperties.
+            // This is useful when for watches because:
+            //   1. It is not a regular use case
+            //   2. Registering to all players is a very loading task
+
+            Log.i(TAG, "init: without Browsable Player");
+            constructCurrentPlayers();
+            return;
+        }
+
         // Build the list of browsable players and afterwards, build the list of media players
         Intent intent = new Intent(android.service.media.MediaBrowserService.SERVICE_INTERFACE);
         List<ResolveInfo> playerList =
@@ -185,27 +221,7 @@
                             });
                 }
 
-                // Construct the list of current players
-                d("Initializing list of current media players");
-                List<android.media.session.MediaController> controllers =
-                        mMediaSessionManager.getActiveSessions(null);
-
-                for (android.media.session.MediaController controller : controllers) {
-                    addMediaPlayer(controller);
-                }
-
-                // If there were any active players and we don't already have one due to the Media
-                // Framework Callbacks then set the highest priority one to active
-                if (mActivePlayerId == 0 && mMediaPlayers.size() > 0) {
-                    String packageName = mMediaSessionManager.getMediaKeyEventSessionPackageName();
-                    if (!TextUtils.isEmpty(packageName) && haveMediaPlayer(packageName)) {
-                        Log.i(TAG, "Set active player to MediaKeyEvent session = " + packageName);
-                        setActivePlayer(mMediaPlayerIds.get(packageName));
-                    } else {
-                        Log.i(TAG, "Set active player to first default");
-                        setActivePlayer(1);
-                    }
-                }
+                constructCurrentPlayers();
             });
     }
 
diff --git a/android/app/src/com/android/bluetooth/avrcp/AvrcpTargetService.java b/android/app/src/com/android/bluetooth/avrcp/AvrcpTargetService.java
index c440d86..47f325c 100644
--- a/android/app/src/com/android/bluetooth/avrcp/AvrcpTargetService.java
+++ b/android/app/src/com/android/bluetooth/avrcp/AvrcpTargetService.java
@@ -509,11 +509,8 @@
 
         @Override
         public void sendVolumeChanged(int volume) {
-            if (!Utils.callerIsSystemOrActiveUser(TAG, "sendVolumeChanged")) {
-                return;
-            }
-
-            if (mService == null) {
+            if (mService == null
+                    || !Utils.checkCallerIsSystemOrActiveOrManagedUser(mService, TAG)) {
                 return;
             }
 
diff --git a/android/app/src/com/android/bluetooth/avrcp/AvrcpVolumeManager.java b/android/app/src/com/android/bluetooth/avrcp/AvrcpVolumeManager.java
index d0cfa58..5cf76bd 100644
--- a/android/app/src/com/android/bluetooth/avrcp/AvrcpVolumeManager.java
+++ b/android/app/src/com/android/bluetooth/avrcp/AvrcpVolumeManager.java
@@ -29,6 +29,7 @@
 import android.util.Log;
 
 import com.android.bluetooth.audio_util.BTAudioEventLogger;
+import com.android.internal.annotations.VisibleForTesting;
 
 import java.util.HashMap;
 import java.util.Map;
@@ -42,7 +43,9 @@
     private static final String VOLUME_MAP = "bluetooth_volume_map";
     private static final String VOLUME_REJECTLIST = "absolute_volume_rejectlist";
     private static final String VOLUME_CHANGE_LOG_TITLE = "Volume Events";
-    private static final int AVRCP_MAX_VOL = 127;
+
+    @VisibleForTesting
+    static final int AVRCP_MAX_VOL = 127;
     private static final int STREAM_MUSIC = AudioManager.STREAM_MUSIC;
     private static final int VOLUME_CHANGE_LOGGER_SIZE = 30;
     private static int sDeviceMaxVolume = 0;
diff --git a/android/app/src/com/android/bluetooth/avrcpcontroller/AvrcpBipClient.java b/android/app/src/com/android/bluetooth/avrcpcontroller/AvrcpBipClient.java
index 4f943bb..3f46b44 100644
--- a/android/app/src/com/android/bluetooth/avrcpcontroller/AvrcpBipClient.java
+++ b/android/app/src/com/android/bluetooth/avrcpcontroller/AvrcpBipClient.java
@@ -26,6 +26,7 @@
 import android.util.Log;
 
 import com.android.bluetooth.BluetoothObexTransport;
+import com.android.internal.annotations.VisibleForTesting;
 import com.android.obex.ClientSession;
 import com.android.obex.HeaderSet;
 import com.android.obex.ResponseCodes;
@@ -229,7 +230,8 @@
     /**
      * Update our client's connection state and notify of the new status
      */
-    private void setConnectionState(int state) {
+    @VisibleForTesting
+    void setConnectionState(int state) {
         int oldState = -1;
         synchronized (this) {
             oldState = mState;
@@ -428,7 +430,8 @@
         }
     }
 
-    private String getStateName() {
+    @VisibleForTesting
+    String getStateName() {
         int state = getState();
         switch (state) {
             case BluetoothProfile.STATE_DISCONNECTED:
diff --git a/android/app/src/com/android/bluetooth/avrcpcontroller/AvrcpControllerService.java b/android/app/src/com/android/bluetooth/avrcpcontroller/AvrcpControllerService.java
index c9fd66f..91efbe6 100755
--- a/android/app/src/com/android/bluetooth/avrcpcontroller/AvrcpControllerService.java
+++ b/android/app/src/com/android/bluetooth/avrcpcontroller/AvrcpControllerService.java
@@ -23,7 +23,6 @@
 import android.bluetooth.BluetoothProfile;
 import android.bluetooth.IBluetoothAvrcpController;
 import android.content.AttributionSource;
-import android.content.ComponentName;
 import android.content.Intent;
 import android.support.v4.media.MediaBrowserCompat.MediaItem;
 import android.support.v4.media.session.PlaybackStateCompat;
@@ -36,6 +35,7 @@
 import com.android.bluetooth.a2dpsink.A2dpSinkService;
 import com.android.bluetooth.btservice.AdapterService;
 import com.android.bluetooth.btservice.ProfileService;
+import com.android.internal.annotations.VisibleForTesting;
 import com.android.modules.utils.SynchronousResultReceiver;
 
 import java.util.ArrayList;
@@ -68,7 +68,8 @@
     private static final byte JNI_PLAY_STATUS_PLAYING = 0x01;
     private static final byte JNI_PLAY_STATUS_PAUSED = 0x02;
     private static final byte JNI_PLAY_STATUS_FWD_SEEK = 0x03;
-    private static final byte JNI_PLAY_STATUS_REV_SEEK = 0x04;
+    @VisibleForTesting
+    static final byte JNI_PLAY_STATUS_REV_SEEK = 0x04;
     private static final byte JNI_PLAY_STATUS_ERROR = -1;
 
     /* Folder/Media Item scopes.
@@ -174,6 +175,7 @@
         for (AvrcpControllerStateMachine stateMachine : mDeviceStateMap.values()) {
             stateMachine.quitNow();
         }
+        mDeviceStateMap.clear();
 
         sService = null;
         sBrowseTree = null;
@@ -202,7 +204,8 @@
     /**
      * Set the current active device, notify devices of activity status
      */
-    private boolean setActiveDevice(BluetoothDevice device) {
+    @VisibleForTesting
+    boolean setActiveDevice(BluetoothDevice device) {
         A2dpSinkService a2dpSinkService = A2dpSinkService.getA2dpSinkService();
         if (a2dpSinkService == null) {
             return false;
@@ -278,7 +281,8 @@
         }
     }
 
-    private void refreshContents(BrowseTree.BrowseNode node) {
+    @VisibleForTesting
+    void refreshContents(BrowseTree.BrowseNode node) {
         BluetoothDevice device = node.getDevice();
         if (device == null) {
             return;
@@ -360,14 +364,18 @@
     }
 
     //Binder object: Must be static class or memory leak may occur
-    private static class AvrcpControllerServiceBinder extends IBluetoothAvrcpController.Stub
+    @VisibleForTesting
+    static class AvrcpControllerServiceBinder extends IBluetoothAvrcpController.Stub
             implements IProfileServiceBinder {
         private AvrcpControllerService mService;
 
         @RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)
         private AvrcpControllerService getService(AttributionSource source) {
-            if (!Utils.checkCallerIsSystemOrActiveUser(TAG)
-                    || !Utils.checkServiceAvailable(mService, TAG)
+            if (Utils.isInstrumentationTestMode()) {
+                return mService;
+            }
+            if (!Utils.checkServiceAvailable(mService, TAG)
+                    || !Utils.checkCallerIsSystemOrActiveOrManagedUser(mService, TAG)
                     || !Utils.checkConnectPermissionForDataDelivery(mService, source, TAG)) {
                 return null;
             }
@@ -468,14 +476,16 @@
 
     /* JNI API*/
     // Called by JNI when a passthrough key was received.
-    private void handlePassthroughRsp(int id, int keyState, byte[] address) {
+    @VisibleForTesting
+    void handlePassthroughRsp(int id, int keyState, byte[] address) {
         if (DBG) {
             Log.d(TAG, "passthrough response received as: key: " + id
-                    + " state: " + keyState + "address:" + address);
+                    + " state: " + keyState + "address:" + Arrays.toString(address));
         }
     }
 
-    private void handleGroupNavigationRsp(int id, int keyState) {
+    @VisibleForTesting
+    void handleGroupNavigationRsp(int id, int keyState) {
         if (DBG) {
             Log.d(TAG, "group navigation response received as: key: " + id + " state: "
                     + keyState);
@@ -483,17 +493,14 @@
     }
 
     // Called by JNI when a device has connected or disconnected.
-    private synchronized void onConnectionStateChanged(boolean remoteControlConnected,
+    @VisibleForTesting
+    synchronized void onConnectionStateChanged(boolean remoteControlConnected,
             boolean browsingConnected, byte[] address) {
         BluetoothDevice device = BluetoothAdapter.getDefaultAdapter().getRemoteDevice(address);
         if (DBG) {
             Log.d(TAG, "onConnectionStateChanged " + remoteControlConnected + " "
                     + browsingConnected + device);
         }
-        if (device == null) {
-            Log.e(TAG, "onConnectionStateChanged Device is null");
-            return;
-        }
 
         StackEvent event =
                 StackEvent.connectionStateChanged(remoteControlConnected, browsingConnected);
@@ -513,12 +520,14 @@
     }
 
     // Called by JNI to notify Avrcp of features supported by the Remote device.
-    private void getRcFeatures(byte[] address, int features) {
+    @VisibleForTesting
+    void getRcFeatures(byte[] address, int features) {
         /* Do Nothing. */
     }
 
     // Called by JNI to notify Avrcp of a remote device's Cover Art PSM
-    private void getRcPsm(byte[] address, int psm) {
+    @VisibleForTesting
+    void getRcPsm(byte[] address, int psm) {
         BluetoothDevice device = BluetoothAdapter.getDefaultAdapter().getRemoteDevice(address);
         if (DBG) Log.d(TAG, "getRcPsm(device=" + device + ", psm=" + psm + ")");
         AvrcpControllerStateMachine stateMachine = getOrCreateStateMachine(device);
@@ -529,12 +538,14 @@
     }
 
     // Called by JNI
-    private void setPlayerAppSettingRsp(byte[] address, byte accepted) {
+    @VisibleForTesting
+    void setPlayerAppSettingRsp(byte[] address, byte accepted) {
         /* Do Nothing. */
     }
 
     // Called by JNI when remote wants to receive absolute volume notifications.
-    private synchronized void handleRegisterNotificationAbsVol(byte[] address, byte label) {
+    @VisibleForTesting
+    synchronized void handleRegisterNotificationAbsVol(byte[] address, byte label) {
         if (DBG) {
             Log.d(TAG, "handleRegisterNotificationAbsVol");
         }
@@ -547,7 +558,8 @@
     }
 
     // Called by JNI when remote wants to set absolute volume.
-    private synchronized void handleSetAbsVolume(byte[] address, byte absVol, byte label) {
+    @VisibleForTesting
+    synchronized void handleSetAbsVolume(byte[] address, byte absVol, byte label) {
         if (DBG) {
             Log.d(TAG, "handleSetAbsVolume ");
         }
@@ -560,7 +572,8 @@
     }
 
     // Called by JNI when a track changes and local AvrcpController is registered for updates.
-    private synchronized void onTrackChanged(byte[] address, byte numAttributes, int[] attributes,
+    @VisibleForTesting
+    synchronized void onTrackChanged(byte[] address, byte numAttributes, int[] attributes,
             String[] attribVals) {
         if (DBG) {
             Log.d(TAG, "onTrackChanged");
@@ -587,7 +600,8 @@
     }
 
     // Called by JNI periodically based upon timer to update play position
-    private synchronized void onPlayPositionChanged(byte[] address, int songLen,
+    @VisibleForTesting
+    synchronized void onPlayPositionChanged(byte[] address, int songLen,
             int currSongPosition) {
         if (DBG) {
             Log.d(TAG, "onPlayPositionChanged pos " + currSongPosition);
@@ -602,7 +616,8 @@
     }
 
     // Called by JNI on changes of play status
-    private synchronized void onPlayStatusChanged(byte[] address, byte playStatus) {
+    @VisibleForTesting
+    synchronized void onPlayStatusChanged(byte[] address, byte playStatus) {
         if (DBG) {
             Log.d(TAG, "onPlayStatusChanged " + playStatus);
         }
@@ -616,7 +631,8 @@
     }
 
     // Called by JNI to report remote Player's capabilities
-    private synchronized void handlePlayerAppSetting(byte[] address, byte[] playerAttribRsp,
+    @VisibleForTesting
+    synchronized void handlePlayerAppSetting(byte[] address, byte[] playerAttribRsp,
             int rspLen) {
         if (DBG) {
             Log.d(TAG, "handlePlayerAppSetting rspLen = " + rspLen);
@@ -632,7 +648,8 @@
         }
     }
 
-    private synchronized void onPlayerAppSettingChanged(byte[] address, byte[] playerAttribRsp,
+    @VisibleForTesting
+    synchronized void onPlayerAppSettingChanged(byte[] address, byte[] playerAttribRsp,
             int rspLen) {
         if (DBG) {
             Log.d(TAG, "onPlayerAppSettingChanged ");
@@ -649,7 +666,8 @@
         }
     }
 
-    private void onAvailablePlayerChanged(byte[] address) {
+    @VisibleForTesting
+    void onAvailablePlayerChanged(byte[] address) {
         if (DBG) {
             Log.d(TAG," onAvailablePlayerChanged");
         }
@@ -712,7 +730,8 @@
             int[] attrIds, String[] attrVals) {
         if (VDBG) {
             Log.d(TAG, "createFromNativeMediaItem uid: " + uid + " type: " + type + " name: " + name
-                    + " attrids: " + attrIds + " attrVals: " + attrVals);
+                    + " attrids: " + Arrays.toString(attrIds)
+                    + " attrVals: " + Arrays.toString(attrVals));
         }
 
         BluetoothDevice device = BluetoothAdapter.getDefaultAdapter().getRemoteDevice(address);
@@ -750,10 +769,10 @@
     AvrcpPlayer createFromNativePlayerItem(byte[] address, int id, String name,
             byte[] transportFlags, int playStatus, int playerType) {
         if (VDBG) {
-            Log.d(TAG,
-                    "createFromNativePlayerItem name: " + name + " transportFlags "
-                            + transportFlags + " play status " + playStatus + " player type "
-                            + playerType);
+            Log.d(TAG, "createFromNativePlayerItem name: " + name
+                    + " transportFlags " + Arrays.toString(transportFlags)
+                    + " play status " + playStatus
+                    + " player type " + playerType);
         }
         BluetoothDevice device = BluetoothAdapter.getDefaultAdapter().getRemoteDevice(address);
         AvrcpPlayer.Builder apb = new AvrcpPlayer.Builder();
@@ -766,7 +785,8 @@
         return apb.build();
     }
 
-    private void handleChangeFolderRsp(byte[] address, int count) {
+    @VisibleForTesting
+    void handleChangeFolderRsp(byte[] address, int count) {
         if (DBG) {
             Log.d(TAG, "handleChangeFolderRsp count: " + count);
         }
@@ -778,7 +798,8 @@
         }
     }
 
-    private void handleSetBrowsedPlayerRsp(byte[] address, int items, int depth) {
+    @VisibleForTesting
+    void handleSetBrowsedPlayerRsp(byte[] address, int items, int depth) {
         if (DBG) {
             Log.d(TAG, "handleSetBrowsedPlayerRsp depth: " + depth);
         }
@@ -791,7 +812,8 @@
         }
     }
 
-    private void handleSetAddressedPlayerRsp(byte[] address, int status) {
+    @VisibleForTesting
+    void handleSetAddressedPlayerRsp(byte[] address, int status) {
         if (DBG) {
             Log.d(TAG, "handleSetAddressedPlayerRsp status: " + status);
         }
@@ -804,7 +826,8 @@
         }
     }
 
-    private void handleAddressedPlayerChanged(byte[] address, int id) {
+    @VisibleForTesting
+    void handleAddressedPlayerChanged(byte[] address, int id) {
         if (DBG) {
             Log.d(TAG, "handleAddressedPlayerChanged id: " + id);
         }
@@ -817,7 +840,8 @@
         }
     }
 
-    private void handleNowPlayingContentChanged(byte[] address) {
+    @VisibleForTesting
+    void handleNowPlayingContentChanged(byte[] address) {
         if (DBG) {
             Log.d(TAG, "handleNowPlayingContentChanged");
         }
diff --git a/android/app/src/com/android/bluetooth/avrcpcontroller/BrowseTree.java b/android/app/src/com/android/bluetooth/avrcpcontroller/BrowseTree.java
index 508c68c..ecfd441 100644
--- a/android/app/src/com/android/bluetooth/avrcpcontroller/BrowseTree.java
+++ b/android/app/src/com/android/bluetooth/avrcpcontroller/BrowseTree.java
@@ -23,6 +23,8 @@
 
 import com.android.bluetooth.Utils;
 
+import com.google.common.annotations.VisibleForTesting;
+
 import java.util.ArrayList;
 import java.util.HashMap;
 import java.util.HashSet;
@@ -57,7 +59,8 @@
     public static final String PLAYER_PREFIX = "PLAYER";
 
     // Static instance of Folder ID <-> Folder Instance (for navigation purposes)
-    private final HashMap<String, BrowseNode> mBrowseMap = new HashMap<String, BrowseNode>();
+    @VisibleForTesting
+    final HashMap<String, BrowseNode> mBrowseMap = new HashMap<String, BrowseNode>();
     private BrowseNode mCurrentBrowseNode;
     private BrowseNode mCurrentBrowsedPlayer;
     private BrowseNode mCurrentAddressedPlayer;
diff --git a/android/app/src/com/android/bluetooth/avrcpcontroller/PlayerApplicationSettings.java b/android/app/src/com/android/bluetooth/avrcpcontroller/PlayerApplicationSettings.java
index 362548e..90446b3 100644
--- a/android/app/src/com/android/bluetooth/avrcpcontroller/PlayerApplicationSettings.java
+++ b/android/app/src/com/android/bluetooth/avrcpcontroller/PlayerApplicationSettings.java
@@ -20,6 +20,8 @@
 import android.util.Log;
 import android.util.SparseArray;
 
+import com.android.internal.annotations.VisibleForTesting;
+
 import java.util.ArrayList;
 
 /*
@@ -39,20 +41,28 @@
     private static final byte JNI_EQUALIZER_STATUS_OFF = 0x01;
     private static final byte JNI_EQUALIZER_STATUS_ON = 0x02;
 
-    private static final byte JNI_REPEAT_STATUS_OFF = 0x01;
-    private static final byte JNI_REPEAT_STATUS_SINGLE_TRACK_REPEAT = 0x02;
-    private static final byte JNI_REPEAT_STATUS_ALL_TRACK_REPEAT = 0x03;
-    private static final byte JNI_REPEAT_STATUS_GROUP_REPEAT = 0x04;
+    @VisibleForTesting
+    static final byte JNI_REPEAT_STATUS_OFF = 0x01;
+    @VisibleForTesting
+    static final byte JNI_REPEAT_STATUS_SINGLE_TRACK_REPEAT = 0x02;
+    @VisibleForTesting
+    static final byte JNI_REPEAT_STATUS_ALL_TRACK_REPEAT = 0x03;
+    @VisibleForTesting
+    static final byte JNI_REPEAT_STATUS_GROUP_REPEAT = 0x04;
 
-    private static final byte JNI_SHUFFLE_STATUS_OFF = 0x01;
-    private static final byte JNI_SHUFFLE_STATUS_ALL_TRACK_SHUFFLE = 0x02;
-    private static final byte JNI_SHUFFLE_STATUS_GROUP_SHUFFLE = 0x03;
+    @VisibleForTesting
+    static final byte JNI_SHUFFLE_STATUS_OFF = 0x01;
+    @VisibleForTesting
+    static final byte JNI_SHUFFLE_STATUS_ALL_TRACK_SHUFFLE = 0x02;
+    @VisibleForTesting
+    static final byte JNI_SHUFFLE_STATUS_GROUP_SHUFFLE = 0x03;
 
     private static final byte JNI_SCAN_STATUS_OFF = 0x01;
     private static final byte JNI_SCAN_STATUS_ALL_TRACK_SCAN = 0x02;
     private static final byte JNI_SCAN_STATUS_GROUP_SCAN = 0x03;
 
-    private static final byte JNI_STATUS_INVALID = -1;
+    @VisibleForTesting
+    static final byte JNI_STATUS_INVALID = -1;
 
     /*
      * Hash map of current settings.
@@ -123,7 +133,8 @@
     }
 
     // Convert a native Attribute Id/Value pair into the AVRCP equivalent value.
-    private static int mapAttribIdValtoAvrcpPlayerSetting(byte attribId, byte attribVal) {
+    @VisibleForTesting
+    static int mapAttribIdValtoAvrcpPlayerSetting(byte attribId, byte attribVal) {
         if (attribId == REPEAT_STATUS) {
             switch (attribVal) {
                 case JNI_REPEAT_STATUS_ALL_TRACK_REPEAT:
diff --git a/android/app/src/com/android/bluetooth/avrcpcontroller/bip/RequestGetImage.java b/android/app/src/com/android/bluetooth/avrcpcontroller/bip/RequestGetImage.java
index d6fcabf..fc5f499 100644
--- a/android/app/src/com/android/bluetooth/avrcpcontroller/bip/RequestGetImage.java
+++ b/android/app/src/com/android/bluetooth/avrcpcontroller/bip/RequestGetImage.java
@@ -16,6 +16,7 @@
 
 package com.android.bluetooth.avrcpcontroller;
 
+import com.android.internal.annotations.VisibleForTesting;
 import com.android.obex.ClientSession;
 import com.android.obex.HeaderSet;
 
@@ -29,7 +30,8 @@
 public class RequestGetImage extends BipRequest {
     // Expected inputs
     private final String mImageHandle;
-    private final BipImageDescriptor mImageDescriptor;
+    @VisibleForTesting
+    final BipImageDescriptor mImageDescriptor;
 
     // Expected return type
     private static final String TYPE = "x-bt/img-img";
diff --git a/android/app/src/com/android/bluetooth/bas/BatteryService.java b/android/app/src/com/android/bluetooth/bas/BatteryService.java
index 43b4e76..71a5e64 100644
--- a/android/app/src/com/android/bluetooth/bas/BatteryService.java
+++ b/android/app/src/com/android/bluetooth/bas/BatteryService.java
@@ -214,6 +214,7 @@
             BatteryStateMachine sm = getOrCreateStateMachine(device);
             if (sm == null) {
                 Log.e(TAG, "Cannot connect to " + device + " : no state machine");
+                return false;
             }
             sm.sendMessage(BatteryStateMachine.CONNECT);
         }
@@ -527,9 +528,12 @@
         @RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)
         private BatteryService getService(AttributionSource source) {
             BatteryService service = mServiceRef.get();
+            if (Utils.isInstrumentationTestMode()) {
+                return service;
+            }
 
-            if (!Utils.checkCallerIsSystemOrActiveUser(TAG)
-                    || !Utils.checkServiceAvailable(service, TAG)
+            if (!Utils.checkServiceAvailable(service, TAG)
+                    || !Utils.checkCallerIsSystemOrActiveOrManagedUser(service, TAG)
                     || !Utils.checkConnectPermissionForDataDelivery(service, source, TAG)) {
                 return null;
             }
diff --git a/android/app/src/com/android/bluetooth/bas/BatteryStateMachine.java b/android/app/src/com/android/bluetooth/bas/BatteryStateMachine.java
index 878c71e..394f417 100644
--- a/android/app/src/com/android/bluetooth/bas/BatteryStateMachine.java
+++ b/android/app/src/com/android/bluetooth/bas/BatteryStateMachine.java
@@ -18,7 +18,7 @@
 
 import static android.bluetooth.BluetoothDevice.PHY_LE_1M_MASK;
 import static android.bluetooth.BluetoothDevice.PHY_LE_2M_MASK;
-import static android.bluetooth.BluetoothDevice.TRANSPORT_AUTO;
+import static android.bluetooth.BluetoothDevice.TRANSPORT_LE;
 
 import android.bluetooth.BluetoothDevice;
 import android.bluetooth.BluetoothGatt;
@@ -233,7 +233,7 @@
             mBluetoothGatt.close();
         }
         mBluetoothGatt = mDevice.connectGatt(service, /*autoConnect=*/false,
-                mGattCallback, TRANSPORT_AUTO, /*opportunistic=*/true,
+                mGattCallback, TRANSPORT_LE, /*opportunistic=*/true,
                 PHY_LE_1M_MASK | PHY_LE_2M_MASK, getHandler());
         return mBluetoothGatt != null;
     }
diff --git a/android/app/src/com/android/bluetooth/bass_client/BaseData.java b/android/app/src/com/android/bluetooth/bass_client/BaseData.java
index ac547c3..c76987e 100755
--- a/android/app/src/com/android/bluetooth/bass_client/BaseData.java
+++ b/android/app/src/com/android/bluetooth/bass_client/BaseData.java
@@ -104,9 +104,9 @@
             presentationDelay = new byte[3];
             codecId = new byte[5];
             codecConfigLength = 0;
-            codecConfigInfo = null;
+            codecConfigInfo = new byte[0];
             metaDataLength = 0;
-            metaData = null;
+            metaData = new byte[0];
             numSubGroups = 0;
             bisIndices = null;
             index = (byte) 0xFF;
diff --git a/android/app/src/com/android/bluetooth/bass_client/BassClientService.java b/android/app/src/com/android/bluetooth/bass_client/BassClientService.java
index 584d173..53c5c34 100755
--- a/android/app/src/com/android/bluetooth/bass_client/BassClientService.java
+++ b/android/app/src/com/android/bluetooth/bass_client/BassClientService.java
@@ -22,6 +22,7 @@
 
 import android.bluetooth.BluetoothAdapter;
 import android.bluetooth.BluetoothDevice;
+import android.bluetooth.BluetoothLeBroadcastAssistant;
 import android.bluetooth.BluetoothLeBroadcastMetadata;
 import android.bluetooth.BluetoothLeBroadcastReceiveState;
 import android.bluetooth.BluetoothProfile;
@@ -34,7 +35,10 @@
 import android.bluetooth.le.ScanRecord;
 import android.bluetooth.le.ScanResult;
 import android.bluetooth.le.ScanSettings;
+import android.content.BroadcastReceiver;
+import android.content.Context;
 import android.content.Intent;
+import android.content.IntentFilter;
 import android.os.Handler;
 import android.os.HandlerThread;
 import android.os.Looper;
@@ -44,20 +48,25 @@
 import android.os.RemoteException;
 import android.sysprop.BluetoothProperties;
 import android.util.Log;
+import android.util.Pair;
 
 import com.android.bluetooth.Utils;
 import com.android.bluetooth.btservice.AdapterService;
 import com.android.bluetooth.btservice.ProfileService;
+import com.android.bluetooth.btservice.ServiceFactory;
 import com.android.bluetooth.btservice.storage.DatabaseManager;
+import com.android.bluetooth.csip.CsipSetCoordinatorService;
+import com.android.bluetooth.le_audio.LeAudioService;
 import com.android.internal.annotations.VisibleForTesting;
 
-import java.nio.ByteBuffer;
 import java.util.ArrayList;
 import java.util.Collections;
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
 import java.util.Objects;
+import java.util.Optional;
+import java.util.concurrent.ConcurrentHashMap;
 
 /**
  * Broacast Assistant Scan Service
@@ -73,6 +82,11 @@
     private final Object mSearchScanCallbackLock = new Object();
     private final Map<Integer, ScanResult> mScanBroadcasts = new HashMap<>();
 
+    private final Map<BluetoothDevice, List<Pair<Integer, Object>>> mPendingGroupOp =
+            new ConcurrentHashMap<>();
+    private final Map<BluetoothDevice, List<Integer>> mGroupManagedSources =
+            new ConcurrentHashMap<>();
+
     private HandlerThread mStateMachinesThread;
     private HandlerThread mCallbackHandlerThread;
     private AdapterService mAdapterService;
@@ -92,6 +106,10 @@
     private Map<BluetoothDevice, PeriodicAdvertisementResult> mPeriodicAdvertisementResultMap;
     private ScanCallback mSearchScanCallback;
     private Callbacks mCallbacks;
+    private BroadcastReceiver mIntentReceiver;
+
+    @VisibleForTesting
+    ServiceFactory mServiceFactory = new ServiceFactory();
 
     public static boolean isEnabled() {
         return BluetoothProperties.isProfileBapBroadcastAssistEnabled().orElse(false);
@@ -186,8 +204,8 @@
     }
 
     void setActiveSyncedSource(BluetoothDevice scanDelegator, BluetoothDevice sourceDevice) {
-        log("setActiveSyncedSource: scanDelegator" + scanDelegator
-                + ":: sourceDevice:" + sourceDevice);
+        log("setActiveSyncedSource, scanDelegator: " + scanDelegator + ", sourceDevice: " +
+            sourceDevice);
         if (sourceDevice == null) {
             mActiveSourceMap.remove(scanDelegator);
         } else {
@@ -230,6 +248,36 @@
         mCallbackHandlerThread = new HandlerThread(TAG);
         mCallbackHandlerThread.start();
         mCallbacks = new Callbacks(mCallbackHandlerThread.getLooper());
+
+        IntentFilter filter = new IntentFilter();
+        filter.addAction(BluetoothDevice.ACTION_BOND_STATE_CHANGED);
+        filter.addAction(BluetoothLeBroadcastAssistant.ACTION_CONNECTION_STATE_CHANGED);
+        mIntentReceiver = new BroadcastReceiver() {
+            @Override
+            public void onReceive(Context context, Intent intent) {
+                String action = intent.getAction();
+
+                if (action.equals(BluetoothDevice.ACTION_BOND_STATE_CHANGED)) {
+                    int state = intent.getIntExtra(BluetoothDevice.EXTRA_BOND_STATE,
+                            BluetoothDevice.ERROR);
+                    BluetoothDevice device =
+                            intent.getParcelableExtra(BluetoothDevice.EXTRA_DEVICE);
+                    Objects.requireNonNull(device,
+                            "ACTION_BOND_STATE_CHANGED with no EXTRA_DEVICE");
+                    bondStateChanged(device, state);
+
+                } else if (action.equals(
+                            BluetoothLeBroadcastAssistant.ACTION_CONNECTION_STATE_CHANGED)) {
+                    BluetoothDevice device =
+                            intent.getParcelableExtra(BluetoothDevice.EXTRA_DEVICE);
+                    int toState = intent.getIntExtra(BluetoothProfile.EXTRA_STATE, -1);
+                    int fromState = intent.getIntExtra(BluetoothProfile.EXTRA_PREVIOUS_STATE, -1);
+                    connectionStateChanged(device, fromState, toState);
+                }
+            }
+        };
+        registerReceiver(mIntentReceiver, filter, Context.RECEIVER_NOT_EXPORTED);
+
         setBassClientService(this);
         mBassUtils = new BassUtils(this);
         // Saving PSync stuff for future addition
@@ -261,6 +309,12 @@
             mStateMachinesThread.quitSafely();
             mStateMachinesThread = null;
         }
+
+        if (mIntentReceiver != null) {
+            unregisterReceiver(mIntentReceiver);
+            mIntentReceiver = null;
+        }
+
         setBassClientService(null);
         if (mDeviceToSyncHandleMap != null) {
             mDeviceToSyncHandleMap.clear();
@@ -274,6 +328,9 @@
             mBassUtils.cleanUp();
             mBassUtils = null;
         }
+        if (mPendingGroupOp != null) {
+            mPendingGroupOp.clear();
+        }
         return true;
     }
 
@@ -312,6 +369,156 @@
         sService = instance;
     }
 
+    private void enqueueSourceGroupOp(BluetoothDevice sink, Integer msgId, Object obj) {
+        log("enqueueSourceGroupOp device: " + sink + ", msgId: " + msgId);
+
+        if (!mPendingGroupOp.containsKey(sink)) {
+            mPendingGroupOp.put(sink, new ArrayList());
+        }
+        mPendingGroupOp.get(sink).add(new Pair<Integer, Object>(msgId, obj));
+    }
+
+    private boolean isSuccess(int status) {
+        boolean ret = false;
+        switch (status) {
+            case BluetoothStatusCodes.REASON_LOCAL_APP_REQUEST:
+            case BluetoothStatusCodes.REASON_LOCAL_STACK_REQUEST:
+            case BluetoothStatusCodes.REASON_REMOTE_REQUEST:
+            case BluetoothStatusCodes.REASON_SYSTEM_POLICY:
+                ret = true;
+                break;
+            default:
+                break;
+        }
+        return ret;
+    }
+
+    private void checkForPendingGroupOpRequest(BluetoothDevice sink, int reason, int reqMsg,
+            Object obj) {
+        log("checkForPendingGroupOpRequest device: " + sink + ", reason: " + reason
+                + ", reqMsg: " + reqMsg);
+
+        List<Pair<Integer, Object>> operations = mPendingGroupOp.get(sink);
+        if (operations == null) {
+            return;
+        }
+
+        switch (reqMsg) {
+            case BassClientStateMachine.ADD_BCAST_SOURCE:
+                if (obj == null) {
+                    return;
+                }
+                // Identify the operation by operation type and broadcastId
+                if (isSuccess(reason)) {
+                    BluetoothLeBroadcastReceiveState sourceState =
+                            (BluetoothLeBroadcastReceiveState) obj;
+                    boolean removed = operations.removeIf(m ->
+                            (m.first.equals(BassClientStateMachine.ADD_BCAST_SOURCE))
+                            && (sourceState.getBroadcastId()
+                                    == ((BluetoothLeBroadcastMetadata) m.second).getBroadcastId()));
+                    if (removed) {
+                        setSourceGroupManaged(sink, sourceState.getSourceId(), true);
+
+                    }
+                } else {
+                    BluetoothLeBroadcastMetadata metadata = (BluetoothLeBroadcastMetadata) obj;
+                    operations.removeIf(m ->
+                            (m.first.equals(BassClientStateMachine.ADD_BCAST_SOURCE))
+                            && (metadata.getBroadcastId()
+                                    == ((BluetoothLeBroadcastMetadata) m.second).getBroadcastId()));
+                }
+                break;
+            case BassClientStateMachine.REMOVE_BCAST_SOURCE:
+                // Identify the operation by operation type and sourceId
+                Integer sourceId = (Integer) obj;
+                operations.removeIf(m ->
+                        m.first.equals(BassClientStateMachine.REMOVE_BCAST_SOURCE)
+                        && (sourceId.equals((Integer) m.second)));
+                setSourceGroupManaged(sink, sourceId, false);
+                break;
+            default:
+                break;
+        }
+    }
+
+    private void setSourceGroupManaged(BluetoothDevice sink, int sourceId, boolean isGroupOp) {
+        log("setSourceGroupManaged device: " + sink);
+        if (isGroupOp) {
+            if (!mGroupManagedSources.containsKey(sink)) {
+                mGroupManagedSources.put(sink, new ArrayList<>());
+            }
+            mGroupManagedSources.get(sink).add(sourceId);
+        } else {
+            List<Integer> sources = mGroupManagedSources.get(sink);
+            if (sources != null) {
+                sources.removeIf(e -> e.equals(sourceId));
+            }
+        }
+    }
+
+    private Pair<BluetoothLeBroadcastMetadata, Map<BluetoothDevice, Integer>>
+            getGroupManagedDeviceSources(BluetoothDevice sink, Integer sourceId) {
+        log("getGroupManagedDeviceSources device: " + sink + " sourceId: " + sourceId);
+        Map map = new HashMap<BluetoothDevice, Integer>();
+
+        if (mGroupManagedSources.containsKey(sink)
+                && mGroupManagedSources.get(sink).contains(sourceId)) {
+            BassClientStateMachine stateMachine = getOrCreateStateMachine(sink);
+            BluetoothLeBroadcastMetadata metadata =
+                    stateMachine.getCurrentBroadcastMetadata(sourceId);
+            if (metadata != null) {
+                int broadcastId = metadata.getBroadcastId();
+
+                for (BluetoothDevice device: getTargetDeviceList(sink, true)) {
+                    List<BluetoothLeBroadcastReceiveState> sources =
+                            getOrCreateStateMachine(device).getAllSources();
+
+                    // For each device, find the source ID having this broadcast ID
+                    Optional<BluetoothLeBroadcastReceiveState> receiver = sources.stream()
+                            .filter(e -> e.getBroadcastId() == broadcastId)
+                            .findAny();
+                    if (receiver.isPresent()) {
+                        map.put(device, receiver.get().getSourceId());
+                    } else {
+                        // Put invalid source ID if the remote doesn't have it
+                        map.put(device, BassConstants.INVALID_SOURCE_ID);
+                    }
+                }
+                return new Pair<BluetoothLeBroadcastMetadata,
+                        Map<BluetoothDevice, Integer>>(metadata, map);
+            } else {
+                Log.e(TAG, "Couldn't find broadcast metadata for device: "
+                        + sink.getAnonymizedAddress() + ", and sourceId:" + sourceId);
+            }
+        }
+
+        // Just put this single device if this source is not group managed
+        map.put(sink, sourceId);
+        return new Pair<BluetoothLeBroadcastMetadata, Map<BluetoothDevice, Integer>>(null, map);
+    }
+
+    private List<BluetoothDevice> getTargetDeviceList(BluetoothDevice device, boolean isGroupOp) {
+        if (isGroupOp) {
+            CsipSetCoordinatorService csipClient = mServiceFactory.getCsipSetCoordinatorService();
+            if (csipClient != null) {
+                // Check for coordinated set of devices in the context of CAP
+                List<BluetoothDevice> csipDevices = csipClient.getGroupDevicesOrdered(device,
+                        BluetoothUuid.CAP);
+                if (!csipDevices.isEmpty()) {
+                    return csipDevices;
+                } else {
+                    Log.w(TAG, "CSIP group is empty.");
+                }
+            } else {
+                Log.e(TAG, "CSIP service is null. No grouping information available.");
+            }
+        }
+
+        List<BluetoothDevice> devices = new ArrayList<>();
+        devices.add(device);
+        return devices;
+    }
+
     private boolean isValidBroadcastSourceAddition(
             BluetoothDevice device, BluetoothLeBroadcastMetadata metaData) {
         boolean retval = true;
@@ -385,6 +592,71 @@
         return sService;
     }
 
+    private void removeStateMachine(BluetoothDevice device) {
+        synchronized (mStateMachines) {
+            BassClientStateMachine sm = mStateMachines.get(device);
+            if (sm == null) {
+                Log.w(TAG, "removeStateMachine: device " + device
+                        + " does not have a state machine");
+                return;
+            }
+            log("removeStateMachine: removing state machine for device: " + device);
+            sm.doQuit();
+            sm.cleanup();
+            mStateMachines.remove(device);
+        }
+
+        // Cleanup device cache
+        mPendingGroupOp.remove(device);
+        mGroupManagedSources.remove(device);
+        mActiveSourceMap.remove(device);
+        mDeviceToSyncHandleMap.remove(device);
+        mPeriodicAdvertisementResultMap.remove(device);
+    }
+
+    synchronized void connectionStateChanged(BluetoothDevice device, int fromState,
+                                             int toState) {
+        if ((device == null) || (fromState == toState)) {
+            Log.e(TAG, "connectionStateChanged: unexpected invocation. device=" + device
+                    + " fromState=" + fromState + " toState=" + toState);
+            return;
+        }
+
+        // Check if the device is disconnected - if unbond, remove the state machine
+        if (toState == BluetoothProfile.STATE_DISCONNECTED) {
+            mPendingGroupOp.remove(device);
+
+            int bondState = mAdapterService.getBondState(device);
+            if (bondState == BluetoothDevice.BOND_NONE) {
+                log("Unbonded " + device + ". Removing state machine");
+                removeStateMachine(device);
+            }
+        }
+    }
+
+    @VisibleForTesting
+    void bondStateChanged(BluetoothDevice device, int bondState) {
+        log("Bond state changed for device: " + device + " state: " + bondState);
+
+        // Remove state machine if the bonding for a device is removed
+        if (bondState != BluetoothDevice.BOND_NONE) {
+            return;
+        }
+
+        synchronized (mStateMachines) {
+            BassClientStateMachine sm = mStateMachines.get(device);
+            if (sm == null) {
+                return;
+            }
+            if (sm.getConnectionState() != BluetoothProfile.STATE_DISCONNECTED) {
+                Log.i(TAG, "Disconnecting device because it was unbonded.");
+                disconnect(device);
+                return;
+            }
+            removeStateMachine(device);
+        }
+    }
+
     /**
      * Connects the bass profile to the passed in device
      *
@@ -399,8 +671,8 @@
             Log.e(TAG, "connect: device is null");
             return false;
         }
-        if (getConnectionPolicy(device) == BluetoothProfile.CONNECTION_POLICY_UNKNOWN) {
-            Log.e(TAG, "connect: unknown connection policy");
+        if (getConnectionPolicy(device) == BluetoothProfile.CONNECTION_POLICY_FORBIDDEN) {
+            Log.e(TAG, "connect: connection policy set to forbidden");
             return false;
         }
         synchronized (mStateMachines) {
@@ -756,36 +1028,71 @@
             boolean isGroupOp) {
         log("addSource: device: " + sink + " sourceMetadata" + sourceMetadata
                 + " isGroupOp" + isGroupOp);
-        BassClientStateMachine stateMachine = getOrCreateStateMachine(sink);
-        if (sourceMetadata == null || stateMachine == null) {
-            log("Error bad parameters: sourceMetadata = " + sourceMetadata);
-            mCallbacks.notifySourceAddFailed(sink, sourceMetadata,
-                    BluetoothStatusCodes.ERROR_BAD_PARAMETERS);
+
+        List<BluetoothDevice> devices = getTargetDeviceList(sink, isGroupOp);
+        // Don't coordinate it as a group if there's no group or there is one device only
+        if (devices.size() < 2) {
+            isGroupOp = false;
+        }
+
+        if (sourceMetadata == null) {
+            log("addSource: Error bad parameter: sourceMetadata cannot be null");
+            for (BluetoothDevice device : devices) {
+                mCallbacks.notifySourceAddFailed(device, sourceMetadata,
+                        BluetoothStatusCodes.ERROR_BAD_PARAMETERS);
+            }
             return;
         }
-        if (getConnectionState(sink) != BluetoothProfile.STATE_CONNECTED) {
-            log("addSource: device is not connected");
-            mCallbacks.notifySourceAddFailed(sink, sourceMetadata,
-                    BluetoothStatusCodes.ERROR_REMOTE_LINK_ERROR);
-            return;
+
+        byte[] code = sourceMetadata.getBroadcastCode();
+        for (BluetoothDevice device : devices) {
+            BassClientStateMachine stateMachine = getOrCreateStateMachine(device);
+            if (stateMachine == null) {
+                log("addSource: Error bad parameter: no state machine for " + device);
+                mCallbacks.notifySourceAddFailed(device, sourceMetadata,
+                        BluetoothStatusCodes.ERROR_BAD_PARAMETERS);
+                continue;
+            }
+            if (getConnectionState(device) != BluetoothProfile.STATE_CONNECTED) {
+                log("addSource: device is not connected");
+                mCallbacks.notifySourceAddFailed(device, sourceMetadata,
+                        BluetoothStatusCodes.ERROR_REMOTE_LINK_ERROR);
+                continue;
+            }
+            if (stateMachine.hasPendingSourceOperation()) {
+                throw new IllegalStateException("addSource: source operation already pending");
+            }
+            if (!hasRoomForBroadcastSourceAddition(device)) {
+                log("addSource: device has no room");
+                mCallbacks.notifySourceAddFailed(device, sourceMetadata,
+                        BluetoothStatusCodes.ERROR_REMOTE_NOT_ENOUGH_RESOURCES);
+                continue;
+            }
+            if (!isValidBroadcastSourceAddition(device, sourceMetadata)) {
+                log("addSource: not a valid broadcast source addition");
+                mCallbacks.notifySourceAddFailed(device, sourceMetadata,
+                        BluetoothStatusCodes.ERROR_LE_BROADCAST_ASSISTANT_DUPLICATE_ADDITION);
+                continue;
+            }
+            if ((code != null) && (code.length != 0)) {
+                if ((code.length > 16) || (code.length < 4)) {
+                    log("Invalid broadcast code length: " + code.length
+                            + ", should be between 4 and 16 octets");
+                    mCallbacks.notifySourceAddFailed(device, sourceMetadata,
+                            BluetoothStatusCodes.ERROR_BAD_PARAMETERS);
+                    continue;
+                }
+            }
+
+            if (isGroupOp) {
+                enqueueSourceGroupOp(device, BassClientStateMachine.ADD_BCAST_SOURCE,
+                        sourceMetadata);
+            }
+
+            Message message = stateMachine.obtainMessage(BassClientStateMachine.ADD_BCAST_SOURCE);
+            message.obj = sourceMetadata;
+            stateMachine.sendMessage(message);
         }
-        if (stateMachine.hasPendingSourceOperation()) {
-            throw new IllegalStateException("addSource: source operation already pending");
-        }
-        if (!hasRoomForBroadcastSourceAddition(sink)) {
-            log("addSource: device has no room");
-            mCallbacks.notifySourceAddFailed(sink, sourceMetadata,
-                    BluetoothStatusCodes.ERROR_REMOTE_NOT_ENOUGH_RESOURCES);
-            return;
-        }
-        if (!isValidBroadcastSourceAddition(sink, sourceMetadata)) {
-            mCallbacks.notifySourceAddFailed(sink, sourceMetadata,
-                    BluetoothStatusCodes.ERROR_LE_BROADCAST_ASSISTANT_DUPLICATE_ADDITION);
-            return;
-        }
-        Message message = stateMachine.obtainMessage(BassClientStateMachine.ADD_BCAST_SOURCE);
-        message.obj = sourceMetadata;
-        stateMachine.sendMessage(message);
     }
 
     /**
@@ -799,30 +1106,61 @@
     public void modifySource(BluetoothDevice sink, int sourceId,
             BluetoothLeBroadcastMetadata updatedMetadata) {
         log("modifySource: device: " + sink + " sourceId " + sourceId);
-        BassClientStateMachine stateMachine = getOrCreateStateMachine(sink);
-        if (sourceId == BassConstants.INVALID_SOURCE_ID
-                    || updatedMetadata == null
-                    || stateMachine == null) {
-            log("Error bad parameters: sourceId = " + sourceId
-                    + " updatedMetadata = " + updatedMetadata);
-            mCallbacks.notifySourceModifyFailed(sink, sourceId,
-                    BluetoothStatusCodes.ERROR_BAD_PARAMETERS);
+
+        Map<BluetoothDevice, Integer> devices = getGroupManagedDeviceSources(sink, sourceId).second;
+        if (updatedMetadata == null) {
+            log("modifySource: Error bad parameters: updatedMetadata cannot be null");
+            for (BluetoothDevice device : devices.keySet()) {
+                mCallbacks.notifySourceModifyFailed(device, sourceId,
+                        BluetoothStatusCodes.ERROR_BAD_PARAMETERS);
+            }
             return;
         }
-        if (getConnectionState(sink) != BluetoothProfile.STATE_CONNECTED) {
-            log("modifySource: device is not connected");
-            mCallbacks.notifySourceModifyFailed(sink, sourceId,
-                    BluetoothStatusCodes.ERROR_REMOTE_LINK_ERROR);
-            return;
+
+        byte[] code = updatedMetadata.getBroadcastCode();
+        for (Map.Entry<BluetoothDevice, Integer> deviceSourceIdPair : devices.entrySet()) {
+            BluetoothDevice device = deviceSourceIdPair.getKey();
+            Integer deviceSourceId = deviceSourceIdPair.getValue();
+            BassClientStateMachine stateMachine = getOrCreateStateMachine(device);
+            if (updatedMetadata == null || stateMachine == null) {
+                log("modifySource: Error bad parameters: sourceId = " + deviceSourceId
+                        + " updatedMetadata = " + updatedMetadata);
+                mCallbacks.notifySourceModifyFailed(device, sourceId,
+                        BluetoothStatusCodes.ERROR_BAD_PARAMETERS);
+                continue;
+            }
+            if (deviceSourceId == BassConstants.INVALID_SOURCE_ID) {
+                log("modifySource: no such sourceId for device: " + device);
+                mCallbacks.notifySourceModifyFailed(device, sourceId,
+                        BluetoothStatusCodes.ERROR_LE_BROADCAST_ASSISTANT_INVALID_SOURCE_ID);
+                continue;
+            }
+            if (getConnectionState(device) != BluetoothProfile.STATE_CONNECTED) {
+                log("modifySource: device is not connected");
+                mCallbacks.notifySourceModifyFailed(device, sourceId,
+                        BluetoothStatusCodes.ERROR_REMOTE_LINK_ERROR);
+                continue;
+            }
+            if ((code != null) && (code.length != 0)) {
+                if ((code.length > 16) || (code.length < 4)) {
+                    log("Invalid broadcast code length: " + code.length
+                            + ", should be between 4 and 16 octets");
+                    mCallbacks.notifySourceModifyFailed(device, sourceId,
+                            BluetoothStatusCodes.ERROR_BAD_PARAMETERS);
+                    continue;
+                }
+            }
+            if (stateMachine.hasPendingSourceOperation()) {
+                throw new IllegalStateException("modifySource: source operation already pending");
+            }
+
+            Message message =
+                    stateMachine.obtainMessage(BassClientStateMachine.UPDATE_BCAST_SOURCE);
+            message.arg1 = deviceSourceId;
+            message.arg2 = BluetoothLeBroadcastReceiveState.PA_SYNC_STATE_INVALID;
+            message.obj = updatedMetadata;
+            stateMachine.sendMessage(message);
         }
-        if (stateMachine.hasPendingSourceOperation()) {
-            throw new IllegalStateException("modifySource: source operation already pending");
-        }
-        Message message = stateMachine.obtainMessage(BassClientStateMachine.UPDATE_BCAST_SOURCE);
-        message.arg1 = sourceId;
-        message.arg2 = BluetoothLeBroadcastReceiveState.PA_SYNC_STATE_INVALID;
-        message.obj = updatedMetadata;
-        stateMachine.sendMessage(message);
     }
 
     /**
@@ -833,39 +1171,62 @@
      * @param sourceId source ID as delivered in onSourceAdded
      */
     public void removeSource(BluetoothDevice sink, int sourceId) {
-        log("removeSource: device = " + sink
-                + "sourceId " + sourceId);
-        BassClientStateMachine stateMachine = getOrCreateStateMachine(sink);
-        if (sourceId == BassConstants.INVALID_SOURCE_ID
-                || stateMachine == null) {
-            log("removeSource: Error bad parameters: sourceId = " + sourceId);
-            mCallbacks.notifySourceRemoveFailed(sink, sourceId,
-                    BluetoothStatusCodes.ERROR_BAD_PARAMETERS);
-            return;
-        }
-        if (getConnectionState(sink) != BluetoothProfile.STATE_CONNECTED) {
-            log("removeSource: device is not connected");
-            mCallbacks.notifySourceRemoveFailed(sink, sourceId,
-                    BluetoothStatusCodes.ERROR_REMOTE_LINK_ERROR);
-            return;
-        }
-        BluetoothLeBroadcastReceiveState recvState =
-                stateMachine.getBroadcastReceiveStateForSourceId(sourceId);
-        BluetoothLeBroadcastMetadata metaData =
-                stateMachine.getCurrentBroadcastMetadata(sourceId);
-        if (metaData != null && recvState != null && recvState.getPaSyncState() ==
-                BluetoothLeBroadcastReceiveState.PA_SYNC_STATE_SYNCHRONIZED) {
-            log("Force source to lost PA sync");
-            Message message = stateMachine.obtainMessage(
-                    BassClientStateMachine.UPDATE_BCAST_SOURCE);
-            message.arg1 = sourceId;
-            message.arg2 = BluetoothLeBroadcastReceiveState.PA_SYNC_STATE_IDLE;
-            message.obj = metaData;
+        log("removeSource: device = " + sink + "sourceId " + sourceId);
+
+        Map<BluetoothDevice, Integer> devices = getGroupManagedDeviceSources(sink, sourceId).second;
+        for (Map.Entry<BluetoothDevice, Integer> deviceSourceIdPair : devices.entrySet()) {
+            BluetoothDevice device = deviceSourceIdPair.getKey();
+            Integer deviceSourceId = deviceSourceIdPair.getValue();
+            BassClientStateMachine stateMachine = getOrCreateStateMachine(device);
+            if (stateMachine == null) {
+                log("removeSource: Error bad parameters: device = " + device);
+                mCallbacks.notifySourceRemoveFailed(device, sourceId,
+                        BluetoothStatusCodes.ERROR_BAD_PARAMETERS);
+                continue;
+            }
+            if (deviceSourceId == BassConstants.INVALID_SOURCE_ID) {
+                log("removeSource: no such sourceId for device: " + device);
+                mCallbacks.notifySourceRemoveFailed(device, sourceId,
+                        BluetoothStatusCodes.ERROR_LE_BROADCAST_ASSISTANT_INVALID_SOURCE_ID);
+                continue;
+            }
+            if (getConnectionState(device) != BluetoothProfile.STATE_CONNECTED) {
+                log("removeSource: device is not connected");
+                mCallbacks.notifySourceRemoveFailed(device, sourceId,
+                        BluetoothStatusCodes.ERROR_REMOTE_LINK_ERROR);
+                continue;
+            }
+
+            BluetoothLeBroadcastReceiveState recvState =
+                    stateMachine.getBroadcastReceiveStateForSourceId(sourceId);
+            BluetoothLeBroadcastMetadata metaData =
+                    stateMachine.getCurrentBroadcastMetadata(sourceId);
+            if (metaData != null && recvState != null && recvState.getPaSyncState()
+                    == BluetoothLeBroadcastReceiveState.PA_SYNC_STATE_SYNCHRONIZED) {
+                log("Force source to lost PA sync");
+                Message message = stateMachine.obtainMessage(
+                        BassClientStateMachine.UPDATE_BCAST_SOURCE);
+                message.arg1 = sourceId;
+                message.arg2 = BluetoothLeBroadcastReceiveState.PA_SYNC_STATE_IDLE;
+                /* Pending remove set. Remove source once not synchronized to PA */
+                message.obj = metaData;
+                stateMachine.sendMessage(message);
+
+                continue;
+            }
+
+            Message message =
+                    stateMachine.obtainMessage(BassClientStateMachine.REMOVE_BCAST_SOURCE);
+            message.arg1 = deviceSourceId;
             stateMachine.sendMessage(message);
         }
-        Message message = stateMachine.obtainMessage(BassClientStateMachine.REMOVE_BCAST_SOURCE);
-        message.arg1 = sourceId;
-        stateMachine.sendMessage(message);
+
+        for (Map.Entry<BluetoothDevice, Integer> deviceSourceIdPair : devices.entrySet()) {
+            BluetoothDevice device = deviceSourceIdPair.getKey();
+            Integer deviceSourceId = deviceSourceIdPair.getValue();
+            enqueueSourceGroupOp(device, BassClientStateMachine.REMOVE_BCAST_SOURCE,
+                    Integer.valueOf(deviceSourceId));
+        }
     }
 
     /**
@@ -902,6 +1263,25 @@
         return stateMachine.getMaximumSourceCapacity();
     }
 
+    boolean isLocalBroadcast(BluetoothLeBroadcastMetadata metaData) {
+        if (metaData == null) {
+            return false;
+        }
+
+        LeAudioService leAudioService = mServiceFactory.getLeAudioService();
+        if (leAudioService == null) {
+            return false;
+        }
+
+        boolean wasFound = leAudioService.getAllBroadcastMetadata()
+                .stream()
+                .anyMatch(meta -> {
+                    return meta.getSourceAdvertisingSid() == metaData.getSourceAdvertisingSid();
+                });
+        log("isLocalBroadcast=" + wasFound);
+        return wasFound;
+    }
+
     static void log(String msg) {
         if (BassConstants.BASS_DBG) {
             Log.d(TAG, msg);
@@ -940,8 +1320,37 @@
             mCallbacks.unregister(callback);
         }
 
+        private void checkForPendingGroupOpRequest(Message msg) {
+            if (sService == null) {
+                Log.e(TAG, "Service is null");
+                return;
+            }
+
+            final int reason = msg.arg1;
+            BluetoothDevice sink;
+
+            switch (msg.what) {
+                case MSG_SOURCE_ADDED:
+                case MSG_SOURCE_ADDED_FAILED:
+                    ObjParams param = (ObjParams) msg.obj;
+                    sink = (BluetoothDevice) param.mObj1;
+                    sService.checkForPendingGroupOpRequest(sink, reason,
+                            BassClientStateMachine.ADD_BCAST_SOURCE, param.mObj2);
+                    break;
+                case MSG_SOURCE_REMOVED:
+                case MSG_SOURCE_REMOVED_FAILED:
+                    sink = (BluetoothDevice) msg.obj;
+                    sService.checkForPendingGroupOpRequest(sink, reason,
+                            BassClientStateMachine.REMOVE_BCAST_SOURCE, Integer.valueOf(msg.arg2));
+                    break;
+                default:
+                    break;
+            }
+        }
+
         @Override
         public void handleMessage(Message msg) {
+            checkForPendingGroupOpRequest(msg);
             final int n = mCallbacks.beginBroadcast();
             for (int i = 0; i < n; i++) {
                 final IBluetoothLeBroadcastAssistantCallback callback =
@@ -988,7 +1397,9 @@
                     callback.onSourceFound((BluetoothLeBroadcastMetadata) msg.obj);
                     break;
                 case MSG_SOURCE_ADDED:
-                    callback.onSourceAdded((BluetoothDevice) msg.obj, sourceId, reason);
+                    param = (ObjParams) msg.obj;
+                    sink = (BluetoothDevice) param.mObj1;
+                    callback.onSourceAdded(sink, sourceId, reason);
                     break;
                 case MSG_SOURCE_ADDED_FAILED:
                     param = (ObjParams) msg.obj;
@@ -1004,10 +1415,12 @@
                     callback.onSourceModifyFailed((BluetoothDevice) msg.obj, sourceId, reason);
                     break;
                 case MSG_SOURCE_REMOVED:
-                    callback.onSourceRemoved((BluetoothDevice) msg.obj, sourceId, reason);
+                    sink = (BluetoothDevice) msg.obj;
+                    callback.onSourceRemoved(sink, sourceId, reason);
                     break;
                 case MSG_SOURCE_REMOVED_FAILED:
-                    callback.onSourceRemoveFailed((BluetoothDevice) msg.obj, sourceId, reason);
+                    sink = (BluetoothDevice) msg.obj;
+                    callback.onSourceRemoveFailed(sink, sourceId, reason);
                     break;
                 case MSG_RECEIVESTATE_CHANGED:
                     param = (ObjParams) msg.obj;
@@ -1042,8 +1455,10 @@
             obtainMessage(MSG_SOURCE_FOUND, 0, 0, source).sendToTarget();
         }
 
-        void notifySourceAdded(BluetoothDevice sink, int sourceId, int reason) {
-            obtainMessage(MSG_SOURCE_ADDED, reason, sourceId, sink).sendToTarget();
+        void notifySourceAdded(BluetoothDevice sink, BluetoothLeBroadcastReceiveState recvState,
+                int reason) {
+            ObjParams param = new ObjParams(sink, recvState);
+            obtainMessage(MSG_SOURCE_ADDED, reason, 0, param).sendToTarget();
         }
 
         void notifySourceAddFailed(BluetoothDevice sink, BluetoothLeBroadcastMetadata source,
@@ -1079,11 +1494,14 @@
     @VisibleForTesting
     static class BluetoothLeBroadcastAssistantBinder extends IBluetoothLeBroadcastAssistant.Stub
             implements IProfileServiceBinder {
-        private BassClientService mService;
+        BassClientService mService;
 
         private BassClientService getService() {
-            if (!Utils.checkCallerIsSystemOrActiveUser(TAG)
-                    || !Utils.checkServiceAvailable(mService, TAG)) {
+            if (Utils.isInstrumentationTestMode()) {
+                return mService;
+            }
+            if (!Utils.checkServiceAvailable(mService, TAG)
+                    || !Utils.checkCallerIsSystemOrActiveOrManagedUser(mService, TAG)) {
                 return null;
             }
             return mService;
diff --git a/android/app/src/com/android/bluetooth/bass_client/BassClientStateMachine.java b/android/app/src/com/android/bluetooth/bass_client/BassClientStateMachine.java
index 1e30480..f8e8388 100755
--- a/android/app/src/com/android/bluetooth/bass_client/BassClientStateMachine.java
+++ b/android/app/src/com/android/bluetooth/bass_client/BassClientStateMachine.java
@@ -14,50 +14,11 @@
  * limitations under the License.
  */
 
-/**
- * Bluetooth Bassclient StateMachine. There is one instance per remote device.
- *  - "Disconnected" and "Connected" are steady states.
- *  - "Connecting" and "Disconnecting" are transient states until the
- *     connection / disconnection is completed.
- *  - "ConnectedProcessing" is an intermediate state to ensure, there is only
- *    one Gatt transaction from the profile at any point of time
- *
- *
- *                        (Disconnected)
- *                           |       ^
- *                   CONNECT |       | DISCONNECTED
- *                           V       |
- *                 (Connecting)<--->(Disconnecting)
- *                           |       ^
- *                 CONNECTED |       | DISCONNECT
- *                           V       |
- *                          (Connected)
- *                           |       ^
- *                 GATT_TXN  |       | GATT_TXN_DONE/GATT_TXN_TIMEOUT
- *                           V       |
- *                          (ConnectedProcessing)
- * NOTES:
- *  - If state machine is in "Connecting" state and the remote device sends
- *    DISCONNECT request, the state machine transitions to "Disconnecting" state.
- *  - Similarly, if the state machine is in "Disconnecting" state and the remote device
- *    sends CONNECT request, the state machine transitions to "Connecting" state.
- *  - Whenever there is any Gatt Write/read, State machine will moved "ConnectedProcessing" and
- *    all other requests (add, update, remove source) operations will be deferred in
- *    "ConnectedProcessing" state
- *  - Once the gatt transaction is done (or after a specified timeout of no response),
- *    State machine will move back to "Connected" and try to process the deferred requests
- *    as needed
- *
- *                    DISCONNECT
- *    (Connecting) ---------------> (Disconnecting)
- *                 <---------------
- *                      CONNECT
- *
- */
 package com.android.bluetooth.bass_client;
 
 import static android.Manifest.permission.BLUETOOTH_CONNECT;
 
+import android.annotation.Nullable;
 import android.bluetooth.BluetoothAdapter;
 import android.bluetooth.BluetoothDevice;
 import android.bluetooth.BluetoothGatt;
@@ -87,6 +48,7 @@
 import android.provider.DeviceConfig;
 import android.util.Log;
 
+import com.android.bluetooth.BluetoothMethodProxy;
 import com.android.bluetooth.Utils;
 import com.android.bluetooth.btservice.ProfileService;
 import com.android.bluetooth.btservice.ServiceFactory;
@@ -94,26 +56,28 @@
 import com.android.internal.util.State;
 import com.android.internal.util.StateMachine;
 
+import java.io.ByteArrayOutputStream;
 import java.io.FileDescriptor;
 import java.io.PrintWriter;
 import java.io.StringWriter;
-import java.nio.ByteBuffer;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Collection;
 import java.util.HashMap;
 import java.util.Iterator;
 import java.util.List;
-import java.util.Locale;
 import java.util.Map;
 import java.util.Scanner;
+import java.util.UUID;
 import java.util.stream.IntStream;
 
 @VisibleForTesting
 public class BassClientStateMachine extends StateMachine {
     private static final String TAG = "BassClientStateMachine";
-    private static final byte[] REMOTE_SCAN_STOP = {00};
-    private static final byte[] REMOTE_SCAN_START = {01};
+    @VisibleForTesting
+    static final byte[] REMOTE_SCAN_STOP = {00};
+    @VisibleForTesting
+    static final byte[] REMOTE_SCAN_START = {01};
     private static final byte OPCODE_ADD_SOURCE = 0x02;
     private static final byte OPCODE_UPDATE_SOURCE = 0x03;
     private static final byte OPCODE_SET_BCAST_PIN = 0x04;
@@ -137,6 +101,10 @@
     static final int PSYNC_ACTIVE_TIMEOUT = 14;
     static final int CONNECT_TIMEOUT = 15;
 
+    // NOTE: the value is not "final" - it is modified in the unit tests
+    @VisibleForTesting
+    private int mConnectTimeoutMs;
+
     /*key is combination of sourceId, Address and advSid for this hashmap*/
     private final Map<Integer, BluetoothLeBroadcastReceiveState>
             mBluetoothLeBroadcastReceiveStates =
@@ -145,48 +113,65 @@
     private final Disconnected mDisconnected = new Disconnected();
     private final Connected mConnected = new Connected();
     private final Connecting mConnecting = new Connecting();
-    private final Disconnecting mDisconnecting = new Disconnecting();
     private final ConnectedProcessing mConnectedProcessing = new ConnectedProcessing();
-    private final List<BluetoothGattCharacteristic> mBroadcastCharacteristics =
+    @VisibleForTesting
+    final List<BluetoothGattCharacteristic> mBroadcastCharacteristics =
             new ArrayList<BluetoothGattCharacteristic>();
-    private final BluetoothDevice mDevice;
+    @VisibleForTesting
+    BluetoothDevice mDevice;
 
     private boolean mIsAllowedList = false;
     private int mLastConnectionState = -1;
-    private boolean mMTUChangeRequested = false;
-    private boolean mDiscoveryInitiated = false;
-    private BassClientService mService;
-    private BluetoothGatt mBluetoothGatt = null;
-
-    private BluetoothGattCharacteristic mBroadcastScanControlPoint;
+    @VisibleForTesting
+    boolean mMTUChangeRequested = false;
+    @VisibleForTesting
+    boolean mDiscoveryInitiated = false;
+    @VisibleForTesting
+    BassClientService mService;
+    @VisibleForTesting
+    BluetoothGattCharacteristic mBroadcastScanControlPoint;
     private boolean mFirstTimeBisDiscovery = false;
     private int mPASyncRetryCounter = 0;
     private ScanResult mScanRes = null;
-    private int mNumOfBroadcastReceiverStates = 0;
+    @VisibleForTesting
+    int mNumOfBroadcastReceiverStates = 0;
     private BluetoothAdapter mBluetoothAdapter =
             BluetoothAdapter.getDefaultAdapter();
     private ServiceFactory mFactory = new ServiceFactory();
-    private int mPendingOperation = -1;
-    private byte mPendingSourceId = -1;
-    private BluetoothLeBroadcastMetadata mPendingMetadata = null;
+    @VisibleForTesting
+    int mPendingOperation = -1;
+    @VisibleForTesting
+    byte mPendingSourceId = -1;
+    @VisibleForTesting
+    BluetoothLeBroadcastMetadata mPendingMetadata = null;
     private BluetoothLeBroadcastReceiveState mSetBroadcastPINRcvState = null;
-    private boolean mSetBroadcastCodePending = false;
+    @VisibleForTesting
+    boolean mSetBroadcastCodePending = false;
+    private final Map<Integer, Boolean> mPendingRemove = new HashMap();
     // Psync and PAST interfaces
     private PeriodicAdvertisingManager mPeriodicAdvManager;
     private boolean mAutoAssist = false;
-    private boolean mAutoTriggered = false;
-    private boolean mNoStopScanOffload = false;
+    @VisibleForTesting
+    boolean mAutoTriggered = false;
+    @VisibleForTesting
+    boolean mNoStopScanOffload = false;
     private boolean mDefNoPAS = false;
     private boolean mForceSB = false;
     private int mBroadcastSourceIdLength = 3;
-    private byte mNextSourceId = 0;
+    @VisibleForTesting
+    byte mNextSourceId = 0;
+    private boolean mAllowReconnect = false;
+    @VisibleForTesting
+    BluetoothGattTestableWrapper mBluetoothGatt = null;
+    BluetoothGattCallback mGattCallback = null;
 
-    BassClientStateMachine(BluetoothDevice device, BassClientService svc, Looper looper) {
+    BassClientStateMachine(BluetoothDevice device, BassClientService svc, Looper looper,
+            int connectTimeoutMs) {
         super(TAG + "(" + device.toString() + ")", looper);
         mDevice = device;
         mService = svc;
+        mConnectTimeoutMs = connectTimeoutMs;
         addState(mDisconnected);
-        addState(mDisconnecting);
         addState(mConnected);
         addState(mConnecting);
         addState(mConnectedProcessing);
@@ -209,7 +194,8 @@
     static BassClientStateMachine make(BluetoothDevice device,
             BassClientService svc, Looper looper) {
         Log.d(TAG, "make for device " + device);
-        BassClientStateMachine BassclientSm = new BassClientStateMachine(device, svc, looper);
+        BassClientStateMachine BassclientSm = new BassClientStateMachine(device, svc, looper,
+                BassConstants.CONNECT_TIMEOUT_MS);
         BassclientSm.start();
         return BassclientSm;
     }
@@ -238,11 +224,13 @@
             mBluetoothGatt.disconnect();
             mBluetoothGatt.close();
             mBluetoothGatt = null;
+            mGattCallback = null;
         }
         mPendingOperation = -1;
         mPendingSourceId = -1;
         mPendingMetadata = null;
         mCurrentMetadata.clear();
+        mPendingRemove.clear();
     }
 
     Boolean hasPendingSourceOperation() {
@@ -262,6 +250,18 @@
         }
     }
 
+    boolean isPendingRemove(Integer sourceId) {
+        return mPendingRemove.getOrDefault(sourceId, false);
+    }
+
+    private void setPendingRemove(Integer sourceId, boolean remove) {
+        if (remove) {
+            mPendingRemove.put(sourceId, remove);
+        } else {
+            mPendingRemove.remove(sourceId);
+        }
+    }
+
     BluetoothLeBroadcastReceiveState getBroadcastReceiveStateForSourceDevice(
             BluetoothDevice srcDevice) {
         List<BluetoothLeBroadcastReceiveState> currentSources = getAllSources();
@@ -326,7 +326,8 @@
         Map<ParcelUuid, byte[]> bmsAdvDataMap = record.getServiceData();
         if (bmsAdvDataMap != null) {
             for (Map.Entry<ParcelUuid, byte[]> entry : bmsAdvDataMap.entrySet()) {
-                log("ParcelUUid = " + entry.getKey() + ", Value = " + entry.getValue());
+                log("ParcelUUid = " + entry.getKey() + ", Value = "
+                        + Arrays.toString(entry.getValue()));
             }
         }
         byte[] advData = record.getServiceData(BassConstants.BASIC_AUDIO_UUID);
@@ -350,14 +351,15 @@
         mPASyncRetryCounter = 1;
         // Cache Scan res for Retrys
         mScanRes = scanRes;
-        /*This is an override case
-        if Previous sync is still active, cancel It
-        But don't stop the Scan offload as we still trying to assist remote*/
+        /*This is an override case if Previous sync is still active, cancel It, but don't stop the
+         * Scan offload as we still trying to assist remote
+         */
         mNoStopScanOffload = true;
         cancelActiveSync(null);
         try {
-            mPeriodicAdvManager.registerSync(scanRes, 0,
-                    BassConstants.PSYNC_TIMEOUT, mPeriodicAdvCallback);
+            BluetoothMethodProxy.getInstance().periodicAdvertisingManagerRegisterSync(
+                    mPeriodicAdvManager, scanRes, 0, BassConstants.PSYNC_TIMEOUT,
+                    mPeriodicAdvCallback, null);
         } catch (IllegalArgumentException ex) {
             Log.w(TAG, "registerSync:IllegalArgumentException");
             Message message = obtainMessage(STOP_SCAN_OFFLOAD);
@@ -389,16 +391,10 @@
 
     private void cancelActiveSync(BluetoothDevice sourceDev) {
         log("cancelActiveSync");
-        boolean isCancelSyncNeeded = false;
         BluetoothDevice activeSyncedSrc = mService.getActiveSyncedSource(mDevice);
-        if (activeSyncedSrc != null) {
-            if (sourceDev == null) {
-                isCancelSyncNeeded = true;
-            } else if (activeSyncedSrc.equals(sourceDev)) {
-                isCancelSyncNeeded = true;
-            }
-        }
-        if (isCancelSyncNeeded) {
+
+        /* Stop sync if there is some running */
+        if (activeSyncedSrc != null && (sourceDev == null || activeSyncedSrc.equals(sourceDev))) {
             removeMessages(PSYNC_ACTIVE_TIMEOUT);
             try {
                 log("calling unregisterSync");
@@ -461,6 +457,7 @@
             int broadcastId = result.getBroadcastId();
             log("broadcast ID: " + broadcastId);
             metaData.setBroadcastId(broadcastId);
+            metaData.setSourceAdvertisingSid(result.getAdvSid());
         }
         return metaData.build();
     }
@@ -476,11 +473,12 @@
                         int skip,
                         int timeout,
                         int status) {
-                    log("onSyncEstablished syncHandle" + syncHandle
-                            + "device" + device
-                            + "advertisingSid" + advertisingSid
-                            + "skip" + skip + "timeout" + timeout
-                            + "status" + status);
+                    log("onSyncEstablished syncHandle: " + syncHandle
+                            + ", device: " + device
+                            + ", advertisingSid: " + advertisingSid
+                            + ", skip: " + skip
+                            + ", timeout: " + timeout
+                            + ", status: " + status);
                     if (status == BluetoothGatt.GATT_SUCCESS) {
                         // updates syncHandle, advSid
                         mService.updatePeriodicAdvertisementResultMap(
@@ -494,7 +492,7 @@
                                 BassConstants.PSYNC_ACTIVE_TIMEOUT_MS);
                         mService.setActiveSyncedSource(mDevice, device);
                     } else {
-                        log("failed to sync to PA" + mPASyncRetryCounter);
+                        log("failed to sync to PA: " + mPASyncRetryCounter);
                         mScanRes = null;
                         if (!mAutoTriggered) {
                             Message message = obtainMessage(STOP_SCAN_OFFLOAD);
@@ -535,7 +533,8 @@
         mService.getCallbacks().notifyReceiveStateChanged(mDevice, sourceId, state);
     }
 
-    private static boolean isEmpty(final byte[] data) {
+    @VisibleForTesting
+    static boolean isEmpty(final byte[] data) {
         return IntStream.range(0, data.length).parallel().allMatch(i -> data[i] == 0);
     }
 
@@ -564,15 +563,31 @@
                             & (~BassConstants.ADV_ADDRESS_DONT_MATCHES_EXT_ADV_ADDRESS);
                     serviceData = serviceData
                             & (~BassConstants.ADV_ADDRESS_DONT_MATCHES_SOURCE_ADV_ADDRESS);
-                    log("Initiate PAST for :" + mDevice + "syncHandle:" +  syncHandle
+                    log("Initiate PAST for: " + mDevice + ", syncHandle: " +  syncHandle
                             + "serviceData" + serviceData);
-                    mPeriodicAdvManager.transferSync(mDevice, serviceData, syncHandle);
+                    BluetoothMethodProxy.getInstance().periodicAdvertisingManagerTransferSync(
+                            mPeriodicAdvManager, mDevice, serviceData, syncHandle);
                 }
             } else {
-                Log.e(TAG, "There is no valid sync handle for this Source");
-                if (mAutoAssist) {
-                    //initiate Auto Assist procedure for this device
-                    mService.getBassUtils().triggerAutoAssist(recvState);
+                if (mService.isLocalBroadcast(mPendingMetadata)) {
+                    int advHandle = mPendingMetadata.getSourceAdvertisingSid();
+                    serviceData = 0x000000FF & recvState.getSourceId();
+                    serviceData = serviceData << 8;
+                    // Address we set in the Source Address can differ from the address in the air
+                    serviceData = serviceData
+                            | BassConstants.ADV_ADDRESS_DONT_MATCHES_SOURCE_ADV_ADDRESS;
+                    log("Initiate local broadcast PAST for: " + mDevice
+                            + ", advSID/Handle: " +  advHandle
+                            + ", serviceData: " + serviceData);
+                    BluetoothMethodProxy.getInstance().periodicAdvertisingManagerTransferSetInfo(
+                            mPeriodicAdvManager, mDevice, serviceData, advHandle,
+                            mPeriodicAdvCallback);
+                } else {
+                    Log.e(TAG, "There is no valid sync handle for this Source");
+                    if (mAutoAssist) {
+                        // Initiate Auto Assist procedure for this device
+                        mService.getBassUtils().triggerAutoAssist(recvState);
+                    }
                 }
             }
         } else if (state == BluetoothLeBroadcastReceiveState.PA_SYNC_STATE_SYNCHRONIZED
@@ -591,10 +606,17 @@
                 && mSetBroadcastCodePending) {
             log("Update the Broadcast now");
             Message m = obtainMessage(BassClientStateMachine.SET_BCAST_CODE);
-            m.obj = mSetBroadcastPINRcvState;
+
+            /* Use cached receiver state if previousely didn't finished setting broadcast code or
+             * use current receiver state if this is a first check and update
+             */
+            if (mSetBroadcastPINRcvState != null) {
+                m.obj = mSetBroadcastPINRcvState;
+            } else {
+                m.obj = recvState;
+            }
+
             sendMessage(m);
-            mSetBroadcastCodePending = false;
-            mSetBroadcastPINRcvState = null;
         }
     }
 
@@ -662,7 +684,6 @@
                         badBroadcastCode,
                         0,
                         BassConstants.BCAST_RCVR_STATE_BADCODE_SIZE);
-                badBroadcastCode = reverseBytes(badBroadcastCode);
                 badBroadcastCodeLen = BassConstants.BCAST_RCVR_STATE_BADCODE_SIZE;
             }
             byte numSubGroups = receiverState[BassConstants.BCAST_RCVR_STATE_BADCODE_START_IDX
@@ -677,10 +698,7 @@
                 System.arraycopy(receiverState, offset, audioSyncIndex, 0,
                         BassConstants.BCAST_RCVR_STATE_BIS_SYNC_SIZE);
                 offset += BassConstants.BCAST_RCVR_STATE_BIS_SYNC_SIZE;
-                log("BIS index byte array: ");
-                BassUtils.printByteArray(audioSyncIndex);
-                ByteBuffer wrapped = ByteBuffer.wrap(reverseBytes(audioSyncIndex));
-                audioSyncState.add((long) wrapped.getInt());
+                audioSyncState.add((long) Utils.byteArrayToInt(audioSyncIndex));
 
                 byte metaDataLength = receiverState[offset++];
                 if (metaDataLength > 0) {
@@ -688,8 +706,9 @@
                     byte[] metaData = new byte[metaDataLength];
                     System.arraycopy(receiverState, offset, metaData, 0, metaDataLength);
                     offset += metaDataLength;
-                    metaData = reverseBytes(metaData);
                     metadataList.add(BluetoothLeAudioContentMetadata.fromRawBytes(metaData));
+                } else {
+                    metadataList.add(BluetoothLeAudioContentMetadata.fromRawBytes(new byte[0]));
                 }
             }
             byte[] broadcastIdBytes = new byte[mBroadcastSourceIdLength];
@@ -709,10 +728,8 @@
                     BassConstants.BCAST_RCVR_STATE_SRC_ADDR_SIZE);
             byte sourceAddressType = receiverState[BassConstants
                     .BCAST_RCVR_STATE_SRC_ADDR_TYPE_IDX];
-            byte[] revAddress = reverseBytes(sourceAddress);
-            String address = String.format(Locale.US, "%02X:%02X:%02X:%02X:%02X:%02X",
-                    revAddress[0], revAddress[1], revAddress[2],
-                    revAddress[3], revAddress[4], revAddress[5]);
+            BassUtils.reverse(sourceAddress);
+            String address = Utils.getAddressStringFromByte(sourceAddress);
             BluetoothDevice device = btAdapter.getRemoteLeDevice(
                     address, sourceAddressType);
             byte sourceAdvSid = receiverState[BassConstants.BCAST_RCVR_STATE_SRC_ADV_SID_IDX];
@@ -728,6 +745,18 @@
                     numSubGroups,
                     audioSyncState,
                     metadataList);
+            log("Receiver state: "
+                    + "\n\tSource ID: " + sourceId
+                    + "\n\tSource Address Type: " + (int) sourceAddressType
+                    + "\n\tDevice: " + device
+                    + "\n\tSource Adv SID: " + sourceAdvSid
+                    + "\n\tBroadcast ID: " + broadcastId
+                    + "\n\tMetadata Sync State: " + (int) metaDataSyncState
+                    + "\n\tEncryption Status: " + (int) encryptionStatus
+                    + "\n\tBad Broadcast Code: " + Arrays.toString(badBroadcastCode)
+                    + "\n\tNumber Of Subgroups: " + numSubGroups
+                    + "\n\tAudio Sync State: " + audioSyncState
+                    + "\n\tMetadata: " + metadataList);
         }
         return recvState;
     }
@@ -737,9 +766,11 @@
         log("processBroadcastReceiverState: characteristic:" + characteristic);
         BluetoothLeBroadcastReceiveState recvState = parseBroadcastReceiverState(
                 receiverState);
-        if (recvState == null || recvState.getSourceId() == -1) {
-            log("Null recvState or processBroadcastReceiverState: invalid index: "
-                    + recvState.getSourceId());
+        if (recvState == null) {
+            log("processBroadcastReceiverState: Null recvState");
+            return;
+        } else if (recvState.getSourceId() == -1) {
+            log("processBroadcastReceiverState: invalid index: " + recvState.getSourceId());
             return;
         }
         BluetoothLeBroadcastReceiveState oldRecvState =
@@ -761,8 +792,8 @@
             if (oldRecvState.getSourceDevice() == null
                     || oldRecvState.getSourceDevice().getAddress().equals(emptyBluetoothDevice)) {
                 log("New Source Addition");
-                mService.getCallbacks().notifySourceAdded(mDevice,
-                        recvState.getSourceId(), BluetoothStatusCodes.REASON_LOCAL_APP_REQUEST);
+                mService.getCallbacks().notifySourceAdded(mDevice, recvState,
+                        BluetoothStatusCodes.REASON_LOCAL_APP_REQUEST);
                 if (mPendingMetadata != null) {
                     setCurrentBroadcastMetadata(recvState.getSourceId(), mPendingMetadata);
                 }
@@ -785,6 +816,12 @@
                             recvState.getSourceId(), BluetoothStatusCodes.REASON_LOCAL_APP_REQUEST);
                     checkAndUpdateBroadcastCode(recvState);
                     processPASyncState(recvState);
+
+                    if (isPendingRemove(recvState.getSourceId())) {
+                        Message message = obtainMessage(REMOVE_BCAST_SOURCE);
+                        message.arg1 = recvState.getSourceId();
+                        sendMessage(message);
+                    }
                 }
             }
         }
@@ -793,159 +830,182 @@
 
     // Implements callback methods for GATT events that the app cares about.
     // For example, connection change and services discovered.
-    private final BluetoothGattCallback mGattCallback =
-            new BluetoothGattCallback() {
-                @Override
-                public void onConnectionStateChange(BluetoothGatt gatt, int status, int newState) {
-                    boolean isStateChanged = false;
-                    log("onConnectionStateChange : Status=" + status + "newState" + newState);
-                    if (newState == BluetoothProfile.STATE_CONNECTED
-                            && getConnectionState() != BluetoothProfile.STATE_CONNECTED) {
-                        isStateChanged = true;
-                        Log.w(TAG, "Bassclient Connected from Disconnected state: " + mDevice);
-                        if (mService.okToConnect(mDevice)) {
-                            log("Bassclient Connected to: " + mDevice);
-                            if (mBluetoothGatt != null) {
-                                log("Attempting to start service discovery:"
-                                        + mBluetoothGatt.discoverServices());
-                                mDiscoveryInitiated = true;
-                            }
-                        } else if (mBluetoothGatt != null) {
-                            // Reject the connection
-                            Log.w(TAG, "Bassclient Connect request rejected: " + mDevice);
-                            mBluetoothGatt.disconnect();
-                            mBluetoothGatt.close();
-                            mBluetoothGatt = null;
-                            // force move to disconnected
-                            newState = BluetoothProfile.STATE_DISCONNECTED;
-                        }
-                    } else if (newState == BluetoothProfile.STATE_DISCONNECTED
-                            && getConnectionState() != BluetoothProfile.STATE_DISCONNECTED) {
-                        isStateChanged = true;
-                        log("Disconnected from Bass GATT server.");
+    final class GattCallback extends BluetoothGattCallback {
+        @Override
+        public void onConnectionStateChange(BluetoothGatt gatt, int status, int newState) {
+            boolean isStateChanged = false;
+            log("onConnectionStateChange : Status=" + status + "newState" + newState);
+            if (newState == BluetoothProfile.STATE_CONNECTED
+                    && getConnectionState() != BluetoothProfile.STATE_CONNECTED) {
+                isStateChanged = true;
+                Log.w(TAG, "Bassclient Connected from Disconnected state: " + mDevice);
+                if (mService.okToConnect(mDevice)) {
+                    log("Bassclient Connected to: " + mDevice);
+                    if (mBluetoothGatt != null) {
+                        log("Attempting to start service discovery:"
+                                + mBluetoothGatt.discoverServices());
+                        mDiscoveryInitiated = true;
                     }
-                    if (isStateChanged) {
-                        Message m = obtainMessage(CONNECTION_STATE_CHANGED);
-                        m.obj = newState;
-                        sendMessage(m);
-                    }
+                } else if (mBluetoothGatt != null) {
+                    // Reject the connection
+                    Log.w(TAG, "Bassclient Connect request rejected: " + mDevice);
+                    mBluetoothGatt.disconnect();
+                    mBluetoothGatt.close();
+                    mBluetoothGatt = null;
+                    // force move to disconnected
+                    newState = BluetoothProfile.STATE_DISCONNECTED;
                 }
+            } else if (newState == BluetoothProfile.STATE_DISCONNECTED
+                    && getConnectionState() != BluetoothProfile.STATE_DISCONNECTED) {
+                isStateChanged = true;
+                log("Disconnected from Bass GATT server.");
+            }
+            if (isStateChanged) {
+                Message m = obtainMessage(CONNECTION_STATE_CHANGED);
+                m.obj = newState;
+                sendMessage(m);
+            }
+        }
 
-                @Override
-                public void onServicesDiscovered(BluetoothGatt gatt, int status) {
-                    log("onServicesDiscovered:" + status);
-                    if (mDiscoveryInitiated) {
-                        mDiscoveryInitiated = false;
-                        if (status == BluetoothGatt.GATT_SUCCESS && mBluetoothGatt != null) {
-                            mBluetoothGatt.requestMtu(BassConstants.BASS_MAX_BYTES);
-                            mMTUChangeRequested = true;
-                        } else {
-                            Log.w(TAG, "onServicesDiscovered received: "
-                                    + status + "mBluetoothGatt" + mBluetoothGatt);
-                        }
-                    } else {
-                        log("remote initiated callback");
-                    }
+        @Override
+        public void onServicesDiscovered(BluetoothGatt gatt, int status) {
+            log("onServicesDiscovered:" + status);
+            if (mDiscoveryInitiated) {
+                mDiscoveryInitiated = false;
+                if (status == BluetoothGatt.GATT_SUCCESS && mBluetoothGatt != null) {
+                    mBluetoothGatt.requestMtu(BassConstants.BASS_MAX_BYTES);
+                    mMTUChangeRequested = true;
+                } else {
+                    Log.w(TAG, "onServicesDiscovered received: "
+                            + status + "mBluetoothGatt" + mBluetoothGatt);
                 }
+            } else {
+                log("remote initiated callback");
+            }
+        }
 
-                @Override
-                public void onCharacteristicRead(
-                        BluetoothGatt gatt,
-                        BluetoothGattCharacteristic characteristic,
-                        int status) {
-                    log("onCharacteristicRead:: status: " + status + "char:" + characteristic);
-                    if (status == BluetoothGatt.GATT_SUCCESS && characteristic.getUuid()
-                            .equals(BassConstants.BASS_BCAST_RECEIVER_STATE)) {
-                        log("onCharacteristicRead: BASS_BCAST_RECEIVER_STATE: status" + status);
-                        logByteArray("Received ", characteristic.getValue(), 0,
-                                characteristic.getValue().length);
-                        if (characteristic.getValue() == null) {
-                            Log.e(TAG, "Remote receiver state is NULL");
-                            return;
-                        }
-                        processBroadcastReceiverState(characteristic.getValue(), characteristic);
-                    }
-                    // switch to receiving notifications after initial characteristic read
-                    BluetoothGattDescriptor desc = characteristic
-                            .getDescriptor(BassConstants.CLIENT_CHARACTERISTIC_CONFIG);
-                    if (mBluetoothGatt != null && desc != null) {
-                        log("Setting the value for Desc");
-                        mBluetoothGatt.setCharacteristicNotification(characteristic, true);
-                        desc.setValue(BluetoothGattDescriptor.ENABLE_NOTIFICATION_VALUE);
-                        mBluetoothGatt.writeDescriptor(desc);
-                    } else {
-                        Log.w(TAG, "CCC for " + characteristic + "seem to be not present");
-                        // at least move the SM to stable state
-                        Message m = obtainMessage(GATT_TXN_PROCESSED);
-                        m.arg1 = status;
-                        sendMessage(m);
-                    }
+        @Override
+        public void onCharacteristicRead(
+                BluetoothGatt gatt,
+                BluetoothGattCharacteristic characteristic,
+                int status) {
+            log("onCharacteristicRead:: status: " + status + "char:" + characteristic);
+            if (status == BluetoothGatt.GATT_SUCCESS && characteristic.getUuid()
+                    .equals(BassConstants.BASS_BCAST_RECEIVER_STATE)) {
+                log("onCharacteristicRead: BASS_BCAST_RECEIVER_STATE: status" + status);
+                if (characteristic.getValue() == null) {
+                    Log.e(TAG, "Remote receiver state is NULL");
+                    return;
                 }
+                logByteArray("Received ", characteristic.getValue(), 0,
+                        characteristic.getValue().length);
+                processBroadcastReceiverState(characteristic.getValue(), characteristic);
+            }
+            // switch to receiving notifications after initial characteristic read
+            BluetoothGattDescriptor desc = characteristic
+                    .getDescriptor(BassConstants.CLIENT_CHARACTERISTIC_CONFIG);
+            if (mBluetoothGatt != null && desc != null) {
+                log("Setting the value for Desc");
+                mBluetoothGatt.setCharacteristicNotification(characteristic, true);
+                desc.setValue(BluetoothGattDescriptor.ENABLE_NOTIFICATION_VALUE);
+                mBluetoothGatt.writeDescriptor(desc);
+            } else {
+                Log.w(TAG, "CCC for " + characteristic + "seem to be not present");
+                // at least move the SM to stable state
+                Message m = obtainMessage(GATT_TXN_PROCESSED);
+                m.arg1 = status;
+                sendMessage(m);
+            }
+        }
 
-                @Override
-                public void onDescriptorWrite(
-                        BluetoothGatt gatt, BluetoothGattDescriptor descriptor, int status) {
-                    log("onDescriptorWrite");
-                    if (status == BluetoothGatt.GATT_SUCCESS
-                            && descriptor.getUuid()
-                            .equals(BassConstants.CLIENT_CHARACTERISTIC_CONFIG)) {
-                        log("CCC write resp");
-                    }
+        @Override
+        public void onDescriptorWrite(
+                BluetoothGatt gatt, BluetoothGattDescriptor descriptor, int status) {
+            log("onDescriptorWrite");
+            if (status == BluetoothGatt.GATT_SUCCESS
+                    && descriptor.getUuid()
+                    .equals(BassConstants.CLIENT_CHARACTERISTIC_CONFIG)) {
+                log("CCC write resp");
+            }
 
-                    // Move the SM to connected so further reads happens
-                    Message m = obtainMessage(GATT_TXN_PROCESSED);
-                    m.arg1 = status;
-                    sendMessage(m);
+            // Move the SM to connected so further reads happens
+            Message m = obtainMessage(GATT_TXN_PROCESSED);
+            m.arg1 = status;
+            sendMessage(m);
+        }
+
+        @Override
+        public void onMtuChanged(BluetoothGatt gatt, int mtu, int status) {
+            log("onMtuChanged: mtu:" + mtu);
+            if (mMTUChangeRequested && mBluetoothGatt != null) {
+                acquireAllBassChars();
+                mMTUChangeRequested = false;
+            } else {
+                log("onMtuChanged is remote initiated trigger, mBluetoothGatt:"
+                        + mBluetoothGatt);
+            }
+        }
+
+        @Override
+        public void onCharacteristicChanged(
+                BluetoothGatt gatt, BluetoothGattCharacteristic characteristic) {
+            log("onCharacteristicChanged :: " + characteristic.getUuid().toString());
+            if (characteristic.getUuid().equals(BassConstants.BASS_BCAST_RECEIVER_STATE)) {
+                log("onCharacteristicChanged is rcvr State :: "
+                        + characteristic.getUuid().toString());
+                if (characteristic.getValue() == null) {
+                    Log.e(TAG, "Remote receiver state is NULL");
+                    return;
                 }
+                logByteArray("onCharacteristicChanged: Received ",
+                        characteristic.getValue(),
+                        0,
+                        characteristic.getValue().length);
+                processBroadcastReceiverState(characteristic.getValue(), characteristic);
+            }
+        }
 
-                @Override
-                public void onMtuChanged(BluetoothGatt gatt, int mtu, int status) {
-                    log("onMtuChanged: mtu:" + mtu);
-                    if (mMTUChangeRequested && mBluetoothGatt != null) {
-                        acquireAllBassChars();
-                        mMTUChangeRequested = false;
-                    } else {
-                        log("onMtuChanged is remote initiated trigger, mBluetoothGatt:"
-                                + mBluetoothGatt);
-                    }
-                }
+        @Override
+        public void onCharacteristicWrite(
+                BluetoothGatt gatt,
+                BluetoothGattCharacteristic characteristic,
+                int status) {
+            log("onCharacteristicWrite: " + characteristic.getUuid().toString()
+                    + "status:" + status);
+            if (status == 0
+                    && characteristic.getUuid()
+                    .equals(BassConstants.BASS_BCAST_AUDIO_SCAN_CTRL_POINT)) {
+                log("BASS_BCAST_AUDIO_SCAN_CTRL_POINT is written successfully");
+            }
+            Message m = obtainMessage(GATT_TXN_PROCESSED);
+            m.arg1 = status;
+            sendMessage(m);
+        }
+    }
 
-                @Override
-                public void onCharacteristicChanged(
-                        BluetoothGatt gatt, BluetoothGattCharacteristic characteristic) {
-                    log("onCharacteristicChanged :: " + characteristic.getUuid().toString());
-                    if (characteristic.getUuid().equals(BassConstants.BASS_BCAST_RECEIVER_STATE)) {
-                        log("onCharacteristicChanged is rcvr State :: "
-                                + characteristic.getUuid().toString());
-                        if (characteristic.getValue() == null) {
-                            Log.e(TAG, "Remote receiver state is NULL");
-                            return;
-                        }
-                        logByteArray("onCharacteristicChanged: Received ",
-                                characteristic.getValue(),
-                                0,
-                                characteristic.getValue().length);
-                        processBroadcastReceiverState(characteristic.getValue(), characteristic);
-                    }
-                }
+    /**
+     * Connects to the GATT server of the device.
+     *
+     * @return {@code true} if it successfully connects to the GATT server.
+     */
+    @VisibleForTesting(visibility = VisibleForTesting.Visibility.PACKAGE)
+    public boolean connectGatt(Boolean autoConnect) {
+        if (mGattCallback == null) {
+            mGattCallback = new GattCallback();
+        }
 
-                @Override
-                public void onCharacteristicWrite(
-                        BluetoothGatt gatt,
-                        BluetoothGattCharacteristic characteristic,
-                        int status) {
-                    log("onCharacteristicWrite: " + characteristic.getUuid().toString()
-                            + "status:" + status);
-                    if (status == 0
-                            && characteristic.getUuid()
-                            .equals(BassConstants.BASS_BCAST_AUDIO_SCAN_CTRL_POINT)) {
-                        log("BASS_BCAST_AUDIO_SCAN_CTRL_POINT is written successfully");
-                    }
-                    Message m = obtainMessage(GATT_TXN_PROCESSED);
-                    m.arg1 = status;
-                    sendMessage(m);
-                }
-            };
+        BluetoothGatt gatt = mDevice.connectGatt(mService, autoConnect,
+                mGattCallback, BluetoothDevice.TRANSPORT_LE,
+                (BluetoothDevice.PHY_LE_1M_MASK
+                        | BluetoothDevice.PHY_LE_2M_MASK
+                        | BluetoothDevice.PHY_LE_CODED_MASK), null);
+
+        if (gatt != null) {
+            mBluetoothGatt = new BluetoothGattTestableWrapper(gatt);
+        }
+
+        return mBluetoothGatt != null;
+    }
 
     /**
      * getAllSources
@@ -1000,6 +1060,7 @@
         mPendingOperation = -1;
         mPendingMetadata = null;
         mCurrentMetadata.clear();
+        mPendingRemove.clear();
     }
 
     @VisibleForTesting
@@ -1018,12 +1079,8 @@
                         mDevice, mLastConnectionState, BluetoothProfile.STATE_DISCONNECTED);
                 if (mLastConnectionState != BluetoothProfile.STATE_DISCONNECTED) {
                     // Reconnect in background if not disallowed by the service
-                    if (mService.okToConnect(mDevice)) {
-                        mBluetoothGatt = mDevice.connectGatt(mService, true,
-                                mGattCallback, BluetoothDevice.TRANSPORT_LE,
-                                (BluetoothDevice.PHY_LE_1M_MASK
-                                        | BluetoothDevice.PHY_LE_2M_MASK
-                                        | BluetoothDevice.PHY_LE_CODED_MASK), null);
+                    if (mService.okToConnect(mDevice) && mAllowReconnect) {
+                        connectGatt(false);
                     }
                 }
             }
@@ -1049,20 +1106,16 @@
                         mBluetoothGatt.close();
                         mBluetoothGatt = null;
                     }
-                    mBluetoothGatt = mDevice.connectGatt(mService, mIsAllowedList,
-                            mGattCallback, BluetoothDevice.TRANSPORT_LE, false,
-                            (BluetoothDevice.PHY_LE_1M_MASK
-                                    | BluetoothDevice.PHY_LE_2M_MASK
-                                    | BluetoothDevice.PHY_LE_CODED_MASK), null);
-                    if (mBluetoothGatt == null) {
-                        Log.e(TAG, "Disconnected: error connecting to " + mDevice);
-                        break;
-                    } else {
+                    mAllowReconnect = true;
+                    if (connectGatt(mIsAllowedList)) {
                         transitionTo(mConnecting);
+                    } else {
+                        Log.e(TAG, "Disconnected: error connecting to " + mDevice);
                     }
                     break;
                 case DISCONNECT:
                     // Disconnect if there's an ongoing background connection
+                    mAllowReconnect = false;
                     if (mBluetoothGatt != null) {
                         log("Cancelling the background connection to " + mDevice);
                         mBluetoothGatt.disconnect();
@@ -1099,7 +1152,7 @@
         public void enter() {
             log("Enter Connecting(" + mDevice + "): "
                     + messageWhatToString(getCurrentMessage().what));
-            sendMessageDelayed(CONNECT_TIMEOUT, mDevice, BassConstants.CONNECT_TIMEOUT_MS);
+            sendMessageDelayed(CONNECT_TIMEOUT, mDevice, mConnectTimeoutMs);
             broadcastConnectionState(
                     mDevice, mLastConnectionState, BluetoothProfile.STATE_CONNECTING);
         }
@@ -1159,112 +1212,83 @@
         }
     }
 
-    private byte[] reverseBytes(byte[] a) {
-        for (int i = 0; i < a.length / 2; i++) {
-            byte tmp = a[i];
-            a[i] = a[a.length - i - 1];
-            a[a.length - i - 1] = tmp;
+    private static int getBisSyncFromChannelPreference(
+                List<BluetoothLeBroadcastChannel> channels) {
+        int bisSync = 0;
+        for (BluetoothLeBroadcastChannel channel : channels) {
+            if (channel.isSelected()) {
+                if (channel.getChannelIndex() == 0) {
+                    Log.e(TAG, "getBisSyncFromChannelPreference: invalid channel index=0");
+                    continue;
+                }
+                bisSync |= 1 << (channel.getChannelIndex() - 1);
+            }
         }
-        return a;
-    }
 
-    private byte[] bluetoothAddressToBytes(String s) {
-        log("BluetoothAddressToBytes: input string:" + s);
-        String[] splits = s.split(":");
-        byte[] addressBytes = new byte[6];
-        for (int i = 0; i < 6; i++) {
-            int hexValue = Integer.parseInt(splits[i], 16);
-            log("hexValue:" + hexValue);
-            addressBytes[i] = (byte) hexValue;
-        }
-        return addressBytes;
+        return bisSync;
     }
 
     private byte[] convertMetadataToAddSourceByteArray(BluetoothLeBroadcastMetadata metaData) {
-        log("Get PeriodicAdvertisementResult for :" + metaData.getSourceDevice());
-        BluetoothDevice broadcastSource = metaData.getSourceDevice();
-        PeriodicAdvertisementResult paRes =
-                mService.getPeriodicAdvertisementResult(broadcastSource);
-        if (paRes == null) {
-            Log.e(TAG, "No matching psync, scan res for this addition");
-            mService.getCallbacks().notifySourceAddFailed(
-                    mDevice, metaData, BluetoothStatusCodes.ERROR_UNKNOWN);
-            return null;
-        }
-        // populate metadata from BASE levelOne
-        BaseData base = mService.getBase(paRes.getSyncHandle());
-        if (base == null) {
-            Log.e(TAG, "No valid base data populated for this device");
-            mService.getCallbacks().notifySourceAddFailed(
-                    mDevice, metaData, BluetoothStatusCodes.ERROR_UNKNOWN);
-            return null;
-        }
-        int numSubGroups = base.getNumberOfSubgroupsofBIG();
-        byte[] metaDataLength = new byte[numSubGroups];
-        int totalMetadataLength = 0;
-        for (int i = 0; i < numSubGroups; i++) {
-            if (base.getMetadata(i) == null) {
-                Log.w(TAG, "no valid metadata from BASE");
-                metaDataLength[i] = 0;
-            } else {
-                metaDataLength[i] = (byte) base.getMetadata(i).length;
-                log("metaDataLength updated:" + metaDataLength[i]);
-            }
-            totalMetadataLength = totalMetadataLength + metaDataLength[i];
-        }
-        byte[] res = new byte[ADD_SOURCE_FIXED_LENGTH
-                + numSubGroups * 5 + totalMetadataLength];
-        int offset = 0;
+        ByteArrayOutputStream stream = new ByteArrayOutputStream();
+        BluetoothDevice advSource = metaData.getSourceDevice();
+
         // Opcode
-        res[offset++] = OPCODE_ADD_SOURCE;
+        stream.write(OPCODE_ADD_SOURCE);
+
         // Advertiser_Address_Type
-        if (paRes.getAddressType() != (byte) BassConstants.INVALID_ADV_ADDRESS_TYPE) {
-            res[offset++] = (byte) paRes.getAddressType();
-        } else {
-            res[offset++] = (byte) BassConstants.BROADCAST_ASSIST_ADDRESS_TYPE_PUBLIC;
-        }
-        String address = broadcastSource.getAddress();
-        byte[] addrByteVal = bluetoothAddressToBytes(address);
-        log("Address bytes: " + Arrays.toString(addrByteVal));
-        byte[] revAddress = reverseBytes(addrByteVal);
-        log("reverse Address bytes: " + Arrays.toString(revAddress));
+        stream.write(metaData.getSourceAddressType());
+
         // Advertiser_Address
-        System.arraycopy(revAddress, 0, res, offset, 6);
-        offset += 6;
+        byte[] bcastSourceAddr = Utils.getBytesFromAddress(advSource.getAddress());
+        BassUtils.reverse(bcastSourceAddr);
+        stream.write(bcastSourceAddr, 0, 6);
+        log("Address bytes: " + advSource.getAddress());
+
         // Advertising_SID
-        res[offset++] = (byte) paRes.getAdvSid();
-        log("mBroadcastId: " + paRes.getBroadcastId());
+        stream.write(metaData.getSourceAdvertisingSid());
+
         // Broadcast_ID
-        res[offset++] = (byte) (paRes.getBroadcastId() & 0x00000000000000FF);
-        res[offset++] = (byte) ((paRes.getBroadcastId() & 0x000000000000FF00) >>> 8);
-        res[offset++] = (byte) ((paRes.getBroadcastId() & 0x0000000000FF0000) >>> 16);
+        stream.write(metaData.getBroadcastId() & 0x00000000000000FF);
+        stream.write((metaData.getBroadcastId() & 0x000000000000FF00) >>> 8);
+        stream.write((metaData.getBroadcastId() & 0x0000000000FF0000) >>> 16);
+        log("mBroadcastId: " + metaData.getBroadcastId());
+
         // PA_Sync
         if (!mDefNoPAS) {
-            res[offset++] = (byte) (0x01);
+            stream.write(0x01);
         } else {
             log("setting PA sync to ZERO");
-            res[offset++] = (byte) 0x00;
+            stream.write(0x00);
         }
+
         // PA_Interval
-        res[offset++] = (byte) (paRes.getAdvInterval() & 0x00000000000000FF);
-        res[offset++] = (byte) ((paRes.getAdvInterval() & 0x000000000000FF00) >>> 8);
+        stream.write((metaData.getPaSyncInterval() & 0x00000000000000FF));
+        stream.write((metaData.getPaSyncInterval() & 0x000000000000FF00) >>> 8);
+
         // Num_Subgroups
-        res[offset++] = base.getNumberOfSubgroupsofBIG();
-        for (int i = 0; i < base.getNumberOfSubgroupsofBIG(); i++) {
+        List<BluetoothLeBroadcastSubgroup> subGroups = metaData.getSubgroups();
+        stream.write(metaData.getSubgroups().size());
+
+        for (BluetoothLeBroadcastSubgroup subGroup : subGroups) {
             // BIS_Sync
-            res[offset++] = (byte) 0xFF;
-            res[offset++] = (byte) 0xFF;
-            res[offset++] = (byte) 0xFF;
-            res[offset++] = (byte) 0xFF;
-            // Metadata_Length
-            res[offset++] = metaDataLength[i];
-            if (metaDataLength[i] != 0) {
-                byte[] revMetadata = reverseBytes(base.getMetadata(i));
-                // Metadata
-                System.arraycopy(revMetadata, 0, res, offset, metaDataLength[i]);
+            int bisSync = getBisSyncFromChannelPreference(subGroup.getChannels());
+            if (bisSync == 0) {
+                bisSync = 0xFFFFFFFF;
             }
-            offset = offset + metaDataLength[i];
+            stream.write(bisSync & 0x00000000000000FF);
+            stream.write((bisSync & 0x000000000000FF00) >>> 8);
+            stream.write((bisSync & 0x0000000000FF0000) >>> 16);
+            stream.write((bisSync & 0x00000000FF000000) >>> 24);
+
+            // Metadata_Length
+            BluetoothLeAudioContentMetadata metadata = subGroup.getContentMetadata();
+            stream.write(metadata.getRawMetadata().length);
+
+            // Metadata
+            stream.write(metadata.getRawMetadata(), 0, metadata.getRawMetadata().length);
         }
+
+        byte[] res = stream.toByteArray();
         log("ADD_BCAST_SOURCE in Bytes");
         BassUtils.printByteArray(res);
         return res;
@@ -1337,15 +1361,6 @@
         return res;
     }
 
-    private byte[] convertAsciitoValues(byte[] val) {
-        byte[] ret = new byte[val.length];
-        for (int i = 0; i < val.length; i++) {
-            ret[i] = (byte) (val[i] - (byte) '0');
-        }
-        log("convertAsciitoValues: returns:" + Arrays.toString(val));
-        return ret;
-    }
-
     private byte[] convertRecvStateToSetBroadcastCodeByteArray(
             BluetoothLeBroadcastReceiveState recvState) {
         byte[] res = new byte[BassConstants.PIN_CODE_CMD_LEN];
@@ -1362,10 +1377,8 @@
                     + recvState.getSourceId());
             return null;
         }
-        // Can Keep as ASCII as is
-        String reversePIN = new StringBuffer(new String(metaData.getBroadcastCode()))
-                .reverse().toString();
-        byte[] actualPIN = reversePIN.getBytes();
+        // Broadcast Code
+        byte[] actualPIN = metaData.getBroadcastCode();
         if (actualPIN == null) {
             Log.e(TAG, "actual PIN is null");
             return null;
@@ -1373,6 +1386,8 @@
             log("byte array broadcast Code:" + Arrays.toString(actualPIN));
             log("pinLength:" + actualPIN.length);
             // Broadcast_Code, Fill the PIN code in the Last Position
+            // This effectively adds padding zeros to LSB positions when the broadcast code
+            // is shorter than 16 octets
             System.arraycopy(
                     actualPIN, 0, res,
                     (BassConstants.PIN_CODE_CMD_LEN - actualPIN.length), actualPIN.length);
@@ -1398,8 +1413,7 @@
                 continue;
             }
             if (sourceId == state.getSourceId() && state.getBigEncryptionState()
-                    == BluetoothLeBroadcastReceiveState
-                    .BIG_ENCRYPTION_STATE_CODE_REQUIRED) {
+                    == BluetoothLeBroadcastReceiveState.BIG_ENCRYPTION_STATE_CODE_REQUIRED) {
                 retval = true;
                 break;
             }
@@ -1417,6 +1431,12 @@
             removeDeferredMessages(CONNECT);
             if (mLastConnectionState == BluetoothProfile.STATE_CONNECTED) {
                 log("CONNECTED->CONNECTED: Ignore");
+                // Broadcast for testing purpose only
+                if (Utils.isInstrumentationTestMode()) {
+                    Intent intent = new Intent("android.bluetooth.bass_client.NOTIFY_TEST");
+                    mService.sendBroadcast(intent, BLUETOOTH_CONNECT,
+                            Utils.getTempAllowlistBroadcastOptions());
+                }
             } else {
                 broadcastConnectionState(mDevice, mLastConnectionState,
                         BluetoothProfile.STATE_CONNECTED);
@@ -1440,6 +1460,7 @@
                     break;
                 case DISCONNECT:
                     log("Disconnecting from " + mDevice);
+                    mAllowReconnect = false;
                     if (mBluetoothGatt != null) {
                         mBluetoothGatt.disconnect();
                         mBluetoothGatt.close();
@@ -1509,6 +1530,9 @@
                         mBluetoothGatt.writeCharacteristic(mBroadcastScanControlPoint);
                         mPendingOperation = message.what;
                         mPendingMetadata = metaData;
+                        if (metaData.isEncrypted() && (metaData.getBroadcastCode() != null)) {
+                            mSetBroadcastCodePending = true;
+                        }
                         transitionTo(mConnectedProcessing);
                         sendMessageDelayed(GATT_TXN_TIMEOUT, BassConstants.GATT_TXN_TIMEOUT_MS);
                     } else {
@@ -1533,6 +1557,12 @@
                         mBluetoothGatt.writeCharacteristic(mBroadcastScanControlPoint);
                         mPendingOperation = message.what;
                         mPendingSourceId = (byte) sourceId;
+                        if (paSync == BluetoothLeBroadcastReceiveState.PA_SYNC_STATE_IDLE) {
+                            setPendingRemove(sourceId, true);
+                        }
+                        if (metaData.isEncrypted() && (metaData.getBroadcastCode() != null)) {
+                            mSetBroadcastCodePending = true;
+                        }
                         mPendingMetadata = metaData;
                         transitionTo(mConnectedProcessing);
                         sendMessageDelayed(GATT_TXN_TIMEOUT, BassConstants.GATT_TXN_TIMEOUT_MS);
@@ -1545,7 +1575,6 @@
                 case SET_BCAST_CODE:
                     BluetoothLeBroadcastReceiveState recvState =
                             (BluetoothLeBroadcastReceiveState) message.obj;
-                    sourceId = message.arg2;
                     log("SET_BCAST_CODE metaData: " + recvState);
                     if (!isItRightTimeToUpdateBroadcastPin((byte) recvState.getSourceId())) {
                         mSetBroadcastCodePending = true;
@@ -1565,17 +1594,22 @@
                             mPendingSourceId = (byte) recvState.getSourceId();
                             transitionTo(mConnectedProcessing);
                             sendMessageDelayed(GATT_TXN_TIMEOUT, BassConstants.GATT_TXN_TIMEOUT_MS);
+                            mSetBroadcastCodePending = false;
+                            mSetBroadcastPINRcvState = null;
                         }
                     }
                     break;
                 case REMOVE_BCAST_SOURCE:
                     byte sid = (byte) message.arg1;
-                    log("Removing Broadcast source: audioSource:" + "sourceId:"
-                            + sid);
+                    log("Removing Broadcast source, sourceId: " + sid);
                     byte[] removeSourceInfo = new byte[2];
                     removeSourceInfo[0] = OPCODE_REMOVE_SOURCE;
                     removeSourceInfo[1] = sid;
                     if (mBluetoothGatt != null && mBroadcastScanControlPoint != null) {
+                        if (isPendingRemove((int) sid)) {
+                            setPendingRemove((int) sid, false);
+                        }
+
                         mBroadcastScanControlPoint.setValue(removeSourceInfo);
                         mBluetoothGatt.writeCharacteristic(mBroadcastScanControlPoint);
                         mPendingOperation = message.what;
@@ -1661,15 +1695,28 @@
         }
     }
 
+    // public for testing, but private for non-testing
     @VisibleForTesting
     class ConnectedProcessing extends State {
         @Override
         public void enter() {
             log("Enter ConnectedProcessing(" + mDevice + "): "
                     + messageWhatToString(getCurrentMessage().what));
+
+            // Broadcast for testing purpose only
+            if (Utils.isInstrumentationTestMode()) {
+                Intent intent = new Intent("android.bluetooth.bass_client.NOTIFY_TEST");
+                mService.sendBroadcast(intent, BLUETOOTH_CONNECT,
+                        Utils.getTempAllowlistBroadcastOptions());
+            }
         }
         @Override
         public void exit() {
+            /* Pending Metadata will be used to bond with source ID in receiver state notify */
+            if (mPendingOperation == REMOVE_BCAST_SOURCE) {
+                    mPendingMetadata = null;
+            }
+
             log("Exit ConnectedProcessing(" + mDevice + "): "
                     + messageWhatToString(getCurrentMessage().what));
         }
@@ -1683,6 +1730,7 @@
                     break;
                 case DISCONNECT:
                     Log.w(TAG, "DISCONNECT requested!: " + mDevice);
+                    mAllowReconnect = false;
                     if (mBluetoothGatt != null) {
                         mBluetoothGatt.disconnect();
                         mBluetoothGatt.close();
@@ -1723,7 +1771,7 @@
                     transitionTo(mConnected);
                     break;
                 case GATT_TXN_TIMEOUT:
-                    log("GATT transaction timedout for" + mDevice);
+                    log("GATT transaction timeout for" + mDevice);
                     sendPendingCallbacks(
                             mPendingOperation,
                             BluetoothStatusCodes.ERROR_UNKNOWN);
@@ -1749,67 +1797,6 @@
         }
     }
 
-    @VisibleForTesting
-    class Disconnecting extends State {
-        @Override
-        public void enter() {
-            log("Enter Disconnecting(" + mDevice + "): "
-                    + messageWhatToString(getCurrentMessage().what));
-            sendMessageDelayed(CONNECT_TIMEOUT, mDevice, BassConstants.CONNECT_TIMEOUT_MS);
-            broadcastConnectionState(
-                    mDevice, mLastConnectionState, BluetoothProfile.STATE_DISCONNECTING);
-        }
-
-        @Override
-        public void exit() {
-            log("Exit Disconnecting(" + mDevice + "): "
-                    + messageWhatToString(getCurrentMessage().what));
-            removeMessages(CONNECT_TIMEOUT);
-            mLastConnectionState = BluetoothProfile.STATE_DISCONNECTING;
-        }
-
-        @Override
-        public boolean processMessage(Message message) {
-            log("Disconnecting process message(" + mDevice + "): "
-                    + messageWhatToString(message.what));
-            switch (message.what) {
-                case CONNECT:
-                    log("Disconnecting to " + mDevice);
-                    log("deferring this connection request " + mDevice);
-                    deferMessage(message);
-                    break;
-                case DISCONNECT:
-                    Log.w(TAG, "Already disconnecting: DISCONNECT ignored: " + mDevice);
-                    break;
-                case CONNECTION_STATE_CHANGED:
-                    int state = (int) message.obj;
-                    Log.w(TAG, "Disconnecting: connection state changed:" + state);
-                    if (state == BluetoothProfile.STATE_CONNECTED) {
-                        Log.e(TAG, "should never happen from this state");
-                        transitionTo(mConnected);
-                    } else {
-                        Log.w(TAG, "disconnection successful to " + mDevice);
-                        cancelActiveSync(null);
-                        transitionTo(mDisconnected);
-                    }
-                    break;
-                case CONNECT_TIMEOUT:
-                    Log.w(TAG, "CONNECT_TIMEOUT");
-                    BluetoothDevice device = (BluetoothDevice) message.obj;
-                    if (!mDevice.equals(device)) {
-                        Log.e(TAG, "Unknown device timeout " + device);
-                        break;
-                    }
-                    transitionTo(mDisconnected);
-                    break;
-                default:
-                    log("Disconnecting: not handled message:" + message.what);
-                    return NOT_HANDLED;
-            }
-            return HANDLED;
-        }
-    }
-
     void broadcastConnectionState(BluetoothDevice device, int fromState, int toState) {
         log("broadcastConnectionState " + device + ": " + fromState + "->" + toState);
         if (fromState == BluetoothProfile.STATE_CONNECTED
@@ -1836,9 +1823,6 @@
             case "Disconnected":
                 log("Disconnected");
                 return BluetoothProfile.STATE_DISCONNECTED;
-            case "Disconnecting":
-                log("Disconnecting");
-                return BluetoothProfile.STATE_DISCONNECTING;
             case "Connecting":
                 log("Connecting");
                 return BluetoothProfile.STATE_CONNECTING;
@@ -1900,22 +1884,6 @@
         return Integer.toString(what);
     }
 
-    private static String profileStateToString(int state) {
-        switch (state) {
-            case BluetoothProfile.STATE_DISCONNECTED:
-                return "DISCONNECTED";
-            case BluetoothProfile.STATE_CONNECTING:
-                return "CONNECTING";
-            case BluetoothProfile.STATE_CONNECTED:
-                return "CONNECTED";
-            case BluetoothProfile.STATE_DISCONNECTING:
-                return "DISCONNECTING";
-            default:
-                break;
-        }
-        return Integer.toString(state);
-    }
-
     /**
      * Dump info
      */
@@ -1954,4 +1922,81 @@
         }
         Log.d(TAG, builder.toString());
     }
+
+    /** Mockable wrapper of {@link BluetoothGatt}. */
+    @VisibleForTesting
+    public static class BluetoothGattTestableWrapper {
+        public final BluetoothGatt mWrappedBluetoothGatt;
+
+        BluetoothGattTestableWrapper(BluetoothGatt bluetoothGatt) {
+            mWrappedBluetoothGatt = bluetoothGatt;
+        }
+
+        /** See {@link BluetoothGatt#getServices()}. */
+        public List<BluetoothGattService> getServices() {
+            return mWrappedBluetoothGatt.getServices();
+        }
+
+        /** See {@link BluetoothGatt#getService(UUID)}. */
+        @Nullable
+        public BluetoothGattService getService(UUID uuid) {
+            return mWrappedBluetoothGatt.getService(uuid);
+        }
+
+        /** See {@link BluetoothGatt#discoverServices()}. */
+        public boolean discoverServices() {
+            return mWrappedBluetoothGatt.discoverServices();
+        }
+
+        /**
+         * See {@link BluetoothGatt#readCharacteristic(
+         * BluetoothGattCharacteristic)}.
+         */
+        public boolean readCharacteristic(BluetoothGattCharacteristic characteristic) {
+            return mWrappedBluetoothGatt.readCharacteristic(characteristic);
+        }
+
+        /**
+         * See {@link BluetoothGatt#writeCharacteristic(
+         * BluetoothGattCharacteristic, byte[], int)} .
+         */
+        public boolean writeCharacteristic(BluetoothGattCharacteristic characteristic) {
+            return mWrappedBluetoothGatt.writeCharacteristic(characteristic);
+        }
+
+        /** See {@link BluetoothGatt#readDescriptor(BluetoothGattDescriptor)}. */
+        public boolean readDescriptor(BluetoothGattDescriptor descriptor) {
+            return mWrappedBluetoothGatt.readDescriptor(descriptor);
+        }
+
+        /**
+         * See {@link BluetoothGatt#writeDescriptor(BluetoothGattDescriptor,
+         * byte[])}.
+         */
+        public boolean writeDescriptor(BluetoothGattDescriptor descriptor) {
+            return mWrappedBluetoothGatt.writeDescriptor(descriptor);
+        }
+
+        /** See {@link BluetoothGatt#requestMtu(int)}. */
+        public boolean requestMtu(int mtu) {
+            return mWrappedBluetoothGatt.requestMtu(mtu);
+        }
+
+        /** See {@link BluetoothGatt#setCharacteristicNotification}. */
+        public boolean setCharacteristicNotification(
+                BluetoothGattCharacteristic characteristic, boolean enable) {
+            return mWrappedBluetoothGatt.setCharacteristicNotification(characteristic, enable);
+        }
+
+        /** See {@link BluetoothGatt#disconnect()}. */
+        public void disconnect() {
+            mWrappedBluetoothGatt.disconnect();
+        }
+
+        /** See {@link BluetoothGatt#close()}. */
+        public void close() {
+            mWrappedBluetoothGatt.close();
+        }
+    }
+
 }
diff --git a/android/app/src/com/android/bluetooth/bass_client/BassUtils.java b/android/app/src/com/android/bluetooth/bass_client/BassUtils.java
index 42f88ca..2850192 100755
--- a/android/app/src/com/android/bluetooth/bass_client/BassUtils.java
+++ b/android/app/src/com/android/bluetooth/bass_client/BassUtils.java
@@ -141,4 +141,13 @@
             log("array[" + i + "] :" + Byte.toUnsignedInt(array[i]));
         }
     }
+
+    static void reverse(byte[] address) {
+        int len = address.length;
+        for (int i = 0; i < len / 2; ++i) {
+            byte b = address[i];
+            address[i] = address[len - 1 - i];
+            address[len - 1 - i] = b;
+        }
+    }
 }
diff --git a/android/app/src/com/android/bluetooth/btservice/ActiveDeviceManager.java b/android/app/src/com/android/bluetooth/btservice/ActiveDeviceManager.java
index 61fbb24..03160d4 100644
--- a/android/app/src/com/android/bluetooth/btservice/ActiveDeviceManager.java
+++ b/android/app/src/com/android/bluetooth/btservice/ActiveDeviceManager.java
@@ -21,10 +21,12 @@
 import android.bluetooth.BluetoothA2dp;
 import android.bluetooth.BluetoothAdapter;
 import android.bluetooth.BluetoothDevice;
+import android.bluetooth.BluetoothHapClient;
 import android.bluetooth.BluetoothHeadset;
 import android.bluetooth.BluetoothHearingAid;
 import android.bluetooth.BluetoothLeAudio;
 import android.bluetooth.BluetoothProfile;
+import android.bluetooth.BluetoothSinkAudioPolicy;
 import android.content.BroadcastReceiver;
 import android.content.Context;
 import android.content.Intent;
@@ -39,19 +41,22 @@
 import android.util.Log;
 
 import com.android.bluetooth.a2dp.A2dpService;
+import com.android.bluetooth.btservice.storage.DatabaseManager;
 import com.android.bluetooth.hearingaid.HearingAidService;
 import com.android.bluetooth.hfp.HeadsetService;
 import com.android.bluetooth.le_audio.LeAudioService;
 import com.android.internal.annotations.VisibleForTesting;
 
-import java.util.LinkedList;
+import java.util.ArrayList;
 import java.util.List;
 import java.util.Objects;
 
 /**
  * The active device manager is responsible for keeping track of the
- * connected A2DP/HFP/AVRCP/HearingAid devices and select which device is
+ * connected A2DP/HFP/AVRCP/HearingAid/LE audio devices and select which device is
  * active (for each profile).
+ * The active device manager selects a fallback device when the currently active device
+ * is disconnected, and it selects BT devices that are lastly activated one.
  *
  * Current policy (subject to change):
  * 1) If the maximum number of connected devices is one, the manager doesn't
@@ -65,24 +70,24 @@
  *    - BluetoothA2dp.ACTION_ACTIVE_DEVICE_CHANGED for A2DP
  *    - BluetoothHeadset.ACTION_ACTIVE_DEVICE_CHANGED for HFP
  *    - BluetoothHearingAid.ACTION_ACTIVE_DEVICE_CHANGED for HearingAid
+ *    - BluetoothLeAudio.ACTION_LE_AUDIO_ACTIVE_DEVICE_CHANGED for LE audio
  *    If such broadcast is received (e.g., triggered indirectly by user
- *    action on the UI), the device in the received broacast is marked
+ *    action on the UI), the device in the received broadcast is marked
  *    as the current active device for that profile.
- * 5) If there is a HearingAid active device, then A2DP and HFP active devices
- *    must be set to null (i.e., A2DP and HFP cannot have active devices).
- *    The reason is because A2DP or HFP cannot be used together with HearingAid.
+ * 5) If there is a HearingAid active device, then A2DP, HFP and LE audio active devices
+ *    must be set to null (i.e., A2DP, HFP and LE audio cannot have active devices).
+ *    The reason is that A2DP, HFP or LE audio cannot be used together with HearingAid.
  * 6) If there are no connected devices (e.g., during startup, or after all
  *    devices have been disconnected, the active device per profile
- *    (A2DP/HFP/HearingAid) is selected as follows:
+ *    (A2DP/HFP/HearingAid/LE audio) is selected as follows:
  * 6.1) The last connected HearingAid device is selected as active.
- *      If there is an active A2DP or HFP device, those must be set to null.
- * 6.2) The last connected A2DP or HFP device is selected as active.
+ *      If there is an active A2DP, HFP or LE audio device, those must be set to null.
+ * 6.2) The last connected A2DP, HFP or LE audio device is selected as active.
  *      However, if there is an active HearingAid device, then the
- *      A2DP or HFP active device is not set (must remain null).
+ *      A2DP, HFP, or LE audio active device is not set (must remain null).
  * 7) If the currently active device (per profile) is disconnected, the
  *    Active Device Manager just marks that the profile has no active device,
- *    but does not attempt to select a new one. Currently, the expectation is
- *    that the user will explicitly select the new active device.
+ *    and the lastly activated BT device that is still connected would be selected.
  * 8) If there is already an active device, and the corresponding
  *    ACTION_ACTIVE_DEVICE_CHANGED broadcast is received, the device
  *    contained in the broadcast is marked as active. However, if
@@ -90,7 +95,7 @@
  *    as having no active device.
  * 9) If a wired audio device is connected, the audio output is switched
  *    by the Audio Framework itself to that device. We detect this here,
- *    and the active device for each profile (A2DP/HFP/HearingAid) is set
+ *    and the active device for each profile (A2DP/HFP/HearingAid/LE audio) is set
  *    to null to reflect the output device state change. However, if the
  *    wired audio device is disconnected, we don't do anything explicit
  *    and apply the default behavior instead:
@@ -113,8 +118,12 @@
     private static final int MESSAGE_A2DP_ACTION_ACTIVE_DEVICE_CHANGED = 3;
     private static final int MESSAGE_HFP_ACTION_CONNECTION_STATE_CHANGED = 4;
     private static final int MESSAGE_HFP_ACTION_ACTIVE_DEVICE_CHANGED = 5;
-    private static final int MESSAGE_HEARING_AID_ACTION_ACTIVE_DEVICE_CHANGED = 6;
-    private static final int MESSAGE_LE_AUDIO_ACTION_ACTIVE_DEVICE_CHANGED = 7;
+    private static final int MESSAGE_HEARING_AID_ACTION_CONNECTION_STATE_CHANGED = 6;
+    private static final int MESSAGE_HEARING_AID_ACTION_ACTIVE_DEVICE_CHANGED = 7;
+    private static final int MESSAGE_LE_AUDIO_ACTION_CONNECTION_STATE_CHANGED = 8;
+    private static final int MESSAGE_LE_AUDIO_ACTION_ACTIVE_DEVICE_CHANGED = 9;
+    private static final int MESSAGE_HAP_ACTION_CONNECTION_STATE_CHANGED = 10;
+    private static final int MESSAGE_HAP_ACTION_ACTIVE_DEVICE_CHANGED = 11;
 
     private final AdapterService mAdapterService;
     private final ServiceFactory mFactory;
@@ -123,12 +132,17 @@
     private final AudioManager mAudioManager;
     private final AudioManagerAudioDeviceCallback mAudioManagerAudioDeviceCallback;
 
-    private final List<BluetoothDevice> mA2dpConnectedDevices = new LinkedList<>();
-    private final List<BluetoothDevice> mHfpConnectedDevices = new LinkedList<>();
+    private final List<BluetoothDevice> mA2dpConnectedDevices = new ArrayList<>();
+    private final List<BluetoothDevice> mHfpConnectedDevices = new ArrayList<>();
+    private final List<BluetoothDevice> mHearingAidConnectedDevices = new ArrayList<>();
+    private final List<BluetoothDevice> mLeAudioConnectedDevices = new ArrayList<>();
+    private final List<BluetoothDevice> mLeHearingAidConnectedDevices = new ArrayList<>();
+    private List<BluetoothDevice> mPendingLeHearingAidActiveDevice = new ArrayList<>();
     private BluetoothDevice mA2dpActiveDevice = null;
     private BluetoothDevice mHfpActiveDevice = null;
     private BluetoothDevice mHearingAidActiveDevice = null;
     private BluetoothDevice mLeAudioActiveDevice = null;
+    private BluetoothDevice mLeHearingAidActiveDevice = null;
 
     // Broadcast receiver for all changes
     private final BroadcastReceiver mReceiver = new BroadcastReceiver() {
@@ -142,32 +156,48 @@
             switch (action) {
                 case BluetoothAdapter.ACTION_STATE_CHANGED:
                     mHandler.obtainMessage(MESSAGE_ADAPTER_ACTION_STATE_CHANGED,
-                                           intent).sendToTarget();
+                            intent).sendToTarget();
                     break;
                 case BluetoothA2dp.ACTION_CONNECTION_STATE_CHANGED:
                     mHandler.obtainMessage(MESSAGE_A2DP_ACTION_CONNECTION_STATE_CHANGED,
-                                           intent).sendToTarget();
+                            intent).sendToTarget();
                     break;
                 case BluetoothA2dp.ACTION_ACTIVE_DEVICE_CHANGED:
                     mHandler.obtainMessage(MESSAGE_A2DP_ACTION_ACTIVE_DEVICE_CHANGED,
-                                           intent).sendToTarget();
+                            intent).sendToTarget();
                     break;
                 case BluetoothHeadset.ACTION_CONNECTION_STATE_CHANGED:
                     mHandler.obtainMessage(MESSAGE_HFP_ACTION_CONNECTION_STATE_CHANGED,
-                                           intent).sendToTarget();
+                            intent).sendToTarget();
                     break;
                 case BluetoothHeadset.ACTION_ACTIVE_DEVICE_CHANGED:
                     mHandler.obtainMessage(MESSAGE_HFP_ACTION_ACTIVE_DEVICE_CHANGED,
-                        intent).sendToTarget();
+                            intent).sendToTarget();
+                    break;
+                case BluetoothHearingAid.ACTION_CONNECTION_STATE_CHANGED:
+                    mHandler.obtainMessage(MESSAGE_HEARING_AID_ACTION_CONNECTION_STATE_CHANGED,
+                            intent).sendToTarget();
                     break;
                 case BluetoothHearingAid.ACTION_ACTIVE_DEVICE_CHANGED:
                     mHandler.obtainMessage(MESSAGE_HEARING_AID_ACTION_ACTIVE_DEVICE_CHANGED,
                             intent).sendToTarget();
                     break;
+                case BluetoothLeAudio.ACTION_LE_AUDIO_CONNECTION_STATE_CHANGED:
+                    mHandler.obtainMessage(MESSAGE_LE_AUDIO_ACTION_CONNECTION_STATE_CHANGED,
+                            intent).sendToTarget();
+                    break;
                 case BluetoothLeAudio.ACTION_LE_AUDIO_ACTIVE_DEVICE_CHANGED:
                     mHandler.obtainMessage(MESSAGE_LE_AUDIO_ACTION_ACTIVE_DEVICE_CHANGED,
                             intent).sendToTarget();
                     break;
+                case BluetoothHapClient.ACTION_HAP_CONNECTION_STATE_CHANGED:
+                    mHandler.obtainMessage(MESSAGE_HAP_ACTION_CONNECTION_STATE_CHANGED,
+                            intent).sendToTarget();
+                    break;
+                case BluetoothHapClient.ACTION_HAP_DEVICE_AVAILABLE:
+                    mHandler.obtainMessage(MESSAGE_HAP_ACTION_ACTIVE_DEVICE_CHANGED,
+                            intent).sendToTarget();
+                    break;
                 default:
                     Log.e(TAG, "Received unexpected intent, action=" + action);
                     break;
@@ -217,10 +247,10 @@
                             break;      // The device is already connected
                         }
                         mA2dpConnectedDevices.add(device);
-                        if (mHearingAidActiveDevice == null && mLeAudioActiveDevice == null) {
+                        if (mHearingAidActiveDevice == null && mLeHearingAidActiveDevice == null) {
                             // New connected device: select it as active
                             setA2dpActiveDevice(device);
-                            break;
+                            setLeAudioActiveDevice(null);
                         }
                         break;
                     }
@@ -233,7 +263,10 @@
                         }
                         mA2dpConnectedDevices.remove(device);
                         if (Objects.equals(mA2dpActiveDevice, device)) {
-                            setA2dpActiveDevice(null);
+                            if (mA2dpConnectedDevices.isEmpty()) {
+                                setA2dpActiveDevice(null);
+                            }
+                            setFallbackDeviceActive();
                         }
                     }
                 }
@@ -251,6 +284,9 @@
                         setHearingAidActiveDevice(null);
                         setLeAudioActiveDevice(null);
                     }
+                    if (mHfpConnectedDevices.contains(device)) {
+                        setHfpActiveDevice(device);
+                    }
                     // Just assign locally the new value
                     mA2dpActiveDevice = device;
                 }
@@ -277,10 +313,10 @@
                             break;      // The device is already connected
                         }
                         mHfpConnectedDevices.add(device);
-                        if (mHearingAidActiveDevice == null && mLeAudioActiveDevice == null) {
+                        if (mHearingAidActiveDevice == null && mLeHearingAidActiveDevice == null) {
                             // New connected device: select it as active
                             setHfpActiveDevice(device);
-                            break;
+                            setLeAudioActiveDevice(null);
                         }
                         break;
                     }
@@ -293,7 +329,10 @@
                         }
                         mHfpConnectedDevices.remove(device);
                         if (Objects.equals(mHfpActiveDevice, device)) {
-                            setHfpActiveDevice(null);
+                            if (mHfpConnectedDevices.isEmpty()) {
+                                setHfpActiveDevice(null);
+                            }
+                            setFallbackDeviceActive();
                         }
                     }
                 }
@@ -311,11 +350,58 @@
                         setHearingAidActiveDevice(null);
                         setLeAudioActiveDevice(null);
                     }
+                    if (mA2dpConnectedDevices.contains(device)) {
+                        setA2dpActiveDevice(device);
+                    }
                     // Just assign locally the new value
                     mHfpActiveDevice = device;
                 }
                 break;
 
+                case MESSAGE_HEARING_AID_ACTION_CONNECTION_STATE_CHANGED: {
+                    Intent intent = (Intent) msg.obj;
+                    BluetoothDevice device =
+                            intent.getParcelableExtra(BluetoothDevice.EXTRA_DEVICE);
+                    int prevState = intent.getIntExtra(BluetoothProfile.EXTRA_PREVIOUS_STATE, -1);
+                    int nextState = intent.getIntExtra(BluetoothProfile.EXTRA_STATE, -1);
+                    if (prevState == nextState) {
+                        // Nothing has changed
+                        break;
+                    }
+                    if (nextState == BluetoothProfile.STATE_CONNECTED) {
+                        // Device connected
+                        if (DBG) {
+                            Log.d(TAG, "handleMessage(MESSAGE_HEARING_AID_ACTION_CONNECTION_STATE"
+                                    + "_CHANGED): device " + device + " connected");
+                        }
+                        if (mHearingAidConnectedDevices.contains(device)) {
+                            break;      // The device is already connected
+                        }
+                        mHearingAidConnectedDevices.add(device);
+                        // New connected device: select it as active
+                        setHearingAidActiveDevice(device);
+                        setA2dpActiveDevice(null);
+                        setHfpActiveDevice(null);
+                        setLeAudioActiveDevice(null);
+                        break;
+                    }
+                    if (prevState == BluetoothProfile.STATE_CONNECTED) {
+                        // Device disconnected
+                        if (DBG) {
+                            Log.d(TAG, "handleMessage(MESSAGE_HEARING_AID_ACTION_CONNECTION_STATE"
+                                    + "_CHANGED): device " + device + " disconnected");
+                        }
+                        mHearingAidConnectedDevices.remove(device);
+                        if (Objects.equals(mHearingAidActiveDevice, device)) {
+                            if (mHearingAidConnectedDevices.isEmpty()) {
+                                setHearingAidActiveDevice(null);
+                            }
+                            setFallbackDeviceActive();
+                        }
+                    }
+                }
+                break;
+
                 case MESSAGE_HEARING_AID_ACTION_ACTIVE_DEVICE_CHANGED: {
                     Intent intent = (Intent) msg.obj;
                     BluetoothDevice device =
@@ -334,10 +420,65 @@
                 }
                 break;
 
+                case MESSAGE_LE_AUDIO_ACTION_CONNECTION_STATE_CHANGED: {
+                    Intent intent = (Intent) msg.obj;
+                    BluetoothDevice device =
+                            intent.getParcelableExtra(BluetoothDevice.EXTRA_DEVICE);
+                    int prevState = intent.getIntExtra(BluetoothProfile.EXTRA_PREVIOUS_STATE, -1);
+                    int nextState = intent.getIntExtra(BluetoothProfile.EXTRA_STATE, -1);
+                    if (prevState == nextState) {
+                        // Nothing has changed
+                        break;
+                    }
+                    if (nextState == BluetoothProfile.STATE_CONNECTED) {
+                        // Device connected
+                        if (DBG) {
+                            Log.d(TAG, "handleMessage(MESSAGE_LE_AUDIO_ACTION_CONNECTION_STATE"
+                                    + "_CHANGED): device " + device + " connected");
+                        }
+                        if (mLeAudioConnectedDevices.contains(device)) {
+                            break;      // The device is already connected
+                        }
+                        mLeAudioConnectedDevices.add(device);
+                        if (mHearingAidActiveDevice == null && mLeHearingAidActiveDevice == null
+                                && mPendingLeHearingAidActiveDevice.isEmpty()) {
+                            // New connected device: select it as active
+                            setLeAudioActiveDevice(device);
+                            setA2dpActiveDevice(null);
+                            setHfpActiveDevice(null);
+                        } else if (mPendingLeHearingAidActiveDevice.contains(device)) {
+                            setLeHearingAidActiveDevice(device);
+                            setHearingAidActiveDevice(null);
+                            setA2dpActiveDevice(null);
+                            setHfpActiveDevice(null);
+                        }
+                        break;
+                    }
+                    if (prevState == BluetoothProfile.STATE_CONNECTED) {
+                        // Device disconnected
+                        if (DBG) {
+                            Log.d(TAG, "handleMessage(MESSAGE_LE_AUDIO_ACTION_CONNECTION_STATE"
+                                    + "_CHANGED): device " + device + " disconnected");
+                        }
+                        mLeAudioConnectedDevices.remove(device);
+                        mLeHearingAidConnectedDevices.remove(device);
+                        if (Objects.equals(mLeAudioActiveDevice, device)) {
+                            if (mLeAudioConnectedDevices.isEmpty()) {
+                                setLeAudioActiveDevice(null);
+                            }
+                            setFallbackDeviceActive();
+                        }
+                    }
+                }
+                break;
+
                 case MESSAGE_LE_AUDIO_ACTION_ACTIVE_DEVICE_CHANGED: {
                     Intent intent = (Intent) msg.obj;
                     BluetoothDevice device =
                             intent.getParcelableExtra(BluetoothDevice.EXTRA_DEVICE);
+                    if (device != null && !mLeAudioConnectedDevices.contains(device)) {
+                        mLeAudioConnectedDevices.add(device);
+                    }
                     if (DBG) {
                         Log.d(TAG, "handleMessage(MESSAGE_LE_AUDIO_ACTION_ACTIVE_DEVICE_CHANGED): "
                                 + "device= " + device);
@@ -351,6 +492,75 @@
                     mLeAudioActiveDevice = device;
                 }
                 break;
+
+                case MESSAGE_HAP_ACTION_CONNECTION_STATE_CHANGED: {
+                    Intent intent = (Intent) msg.obj;
+                    BluetoothDevice device =
+                            intent.getParcelableExtra(BluetoothDevice.EXTRA_DEVICE);
+                    int prevState = intent.getIntExtra(BluetoothProfile.EXTRA_PREVIOUS_STATE, -1);
+                    int nextState = intent.getIntExtra(BluetoothProfile.EXTRA_STATE, -1);
+                    if (prevState == nextState) {
+                        // Nothing has changed
+                        break;
+                    }
+                    if (nextState == BluetoothProfile.STATE_CONNECTED) {
+                        // Device connected
+                        if (DBG) {
+                            Log.d(TAG, "handleMessage(MESSAGE_HAP_ACTION_CONNECTION_STATE"
+                                    + "_CHANGED): device " + device + " connected");
+                        }
+                        if (mLeHearingAidConnectedDevices.contains(device)) {
+                            break;      // The device is already connected
+                        }
+                        mLeHearingAidConnectedDevices.add(device);
+                        if (!mLeAudioConnectedDevices.contains(device)) {
+                            mPendingLeHearingAidActiveDevice.add(device);
+                        } else if (Objects.equals(mLeAudioActiveDevice, device)) {
+                            mLeHearingAidActiveDevice = device;
+                        } else {
+                            // New connected device: select it as active
+                            setLeHearingAidActiveDevice(device);
+                            setHearingAidActiveDevice(null);
+                            setA2dpActiveDevice(null);
+                            setHfpActiveDevice(null);
+                        }
+                        break;
+                    }
+                    if (prevState == BluetoothProfile.STATE_CONNECTED) {
+                        // Device disconnected
+                        if (DBG) {
+                            Log.d(TAG, "handleMessage(MESSAGE_HAP_ACTION_CONNECTION_STATE"
+                                    + "_CHANGED): device " + device + " disconnected");
+                        }
+                        mLeHearingAidConnectedDevices.remove(device);
+                        mPendingLeHearingAidActiveDevice.remove(device);
+                        if (Objects.equals(mLeHearingAidActiveDevice, device)) {
+                            mLeHearingAidActiveDevice = null;
+                        }
+                    }
+                }
+                break;
+
+                case MESSAGE_HAP_ACTION_ACTIVE_DEVICE_CHANGED: {
+                    Intent intent = (Intent) msg.obj;
+                    BluetoothDevice device =
+                            intent.getParcelableExtra(BluetoothDevice.EXTRA_DEVICE);
+                    if (device != null && !mLeHearingAidConnectedDevices.contains(device)) {
+                        mLeHearingAidConnectedDevices.add(device);
+                    }
+                    if (DBG) {
+                        Log.d(TAG, "handleMessage(MESSAGE_HAP_ACTION_ACTIVE_DEVICE_CHANGED): "
+                                + "device= " + device);
+                    }
+                    // Just assign locally the new value
+                    if (device != null && !Objects.equals(mLeHearingAidActiveDevice, device)) {
+                        setA2dpActiveDevice(null);
+                        setHfpActiveDevice(null);
+                        setHearingAidActiveDevice(null);
+                    }
+                    mLeHearingAidActiveDevice = mLeAudioActiveDevice = device;
+                }
+                break;
             }
         }
     }
@@ -418,8 +628,12 @@
         filter.addAction(BluetoothA2dp.ACTION_ACTIVE_DEVICE_CHANGED);
         filter.addAction(BluetoothHeadset.ACTION_CONNECTION_STATE_CHANGED);
         filter.addAction(BluetoothHeadset.ACTION_ACTIVE_DEVICE_CHANGED);
+        filter.addAction(BluetoothHearingAid.ACTION_CONNECTION_STATE_CHANGED);
         filter.addAction(BluetoothHearingAid.ACTION_ACTIVE_DEVICE_CHANGED);
+        filter.addAction(BluetoothLeAudio.ACTION_LE_AUDIO_CONNECTION_STATE_CHANGED);
         filter.addAction(BluetoothLeAudio.ACTION_LE_AUDIO_ACTIVE_DEVICE_CHANGED);
+        filter.addAction(BluetoothHapClient.ACTION_HAP_CONNECTION_STATE_CHANGED);
+        filter.addAction(BluetoothHapClient.ACTION_HAP_DEVICE_AVAILABLE);
         mAdapterService.registerReceiver(mReceiver, filter);
 
         mAudioManager.registerAudioDeviceCallback(mAudioManagerAudioDeviceCallback, mHandler);
@@ -476,10 +690,14 @@
         if (headsetService == null) {
             return;
         }
-        if (!headsetService.setActiveDevice(device)) {
-            return;
+        BluetoothSinkAudioPolicy audioPolicy = headsetService.getHfpCallAudioPolicy(device);
+        if (audioPolicy == null || audioPolicy.getActiveDevicePolicyAfterConnection()
+                != BluetoothSinkAudioPolicy.POLICY_NOT_ALLOWED) {
+            if (!headsetService.setActiveDevice(device)) {
+                return;
+            }
+            mHfpActiveDevice = device;
         }
-        mHfpActiveDevice = device;
     }
 
     private void setHearingAidActiveDevice(BluetoothDevice device) {
@@ -508,6 +726,133 @@
             return;
         }
         mLeAudioActiveDevice = device;
+        if (device == null) {
+            mLeHearingAidActiveDevice = null;
+            mPendingLeHearingAidActiveDevice.remove(device);
+        }
+    }
+
+    private void setLeHearingAidActiveDevice(BluetoothDevice device) {
+        if (!Objects.equals(mLeAudioActiveDevice, device)) {
+            setLeAudioActiveDevice(device);
+        }
+        if (Objects.equals(mLeAudioActiveDevice, device)) {
+            // setLeAudioActiveDevice succeed
+            mLeHearingAidActiveDevice = device;
+            mPendingLeHearingAidActiveDevice.remove(device);
+        }
+    }
+
+    private void setFallbackDeviceActive() {
+        if (DBG) {
+            Log.d(TAG, "setFallbackDeviceActive");
+        }
+        DatabaseManager dbManager = mAdapterService.getDatabase();
+        if (dbManager == null) {
+            return;
+        }
+        List<BluetoothDevice> connectedHearingAidDevices = new ArrayList<>();
+        if (!mHearingAidConnectedDevices.isEmpty()) {
+            connectedHearingAidDevices.addAll(mHearingAidConnectedDevices);
+        }
+        if (!mLeHearingAidConnectedDevices.isEmpty()) {
+            connectedHearingAidDevices.addAll(mLeHearingAidConnectedDevices);
+        }
+        if (!connectedHearingAidDevices.isEmpty()) {
+            BluetoothDevice device =
+                    dbManager.getMostRecentlyConnectedDevicesInList(connectedHearingAidDevices);
+            if (device != null) {
+                if (mHearingAidConnectedDevices.contains(device)) {
+                    if (DBG) {
+                        Log.d(TAG, "set hearing aid device active: " + device);
+                    }
+                    setHearingAidActiveDevice(device);
+                    setA2dpActiveDevice(null);
+                    setHfpActiveDevice(null);
+                    setLeAudioActiveDevice(null);
+                } else {
+                    if (DBG) {
+                        Log.d(TAG, "set LE hearing aid device active: " + device);
+                    }
+                    setLeHearingAidActiveDevice(device);
+                    setHearingAidActiveDevice(null);
+                    setA2dpActiveDevice(null);
+                    setHfpActiveDevice(null);
+                }
+                return;
+            }
+        }
+
+        A2dpService a2dpService = mFactory.getA2dpService();
+        BluetoothDevice a2dpFallbackDevice = null;
+        if (a2dpService != null) {
+            a2dpFallbackDevice = a2dpService.getFallbackDevice();
+        }
+
+        HeadsetService headsetService = mFactory.getHeadsetService();
+        BluetoothDevice headsetFallbackDevice = null;
+        if (headsetService != null) {
+            headsetFallbackDevice = headsetService.getFallbackDevice();
+        }
+
+        List<BluetoothDevice> connectedDevices = new ArrayList<>();
+        connectedDevices.addAll(mLeAudioConnectedDevices);
+        switch (mAudioManager.getMode()) {
+            case AudioManager.MODE_NORMAL:
+                if (a2dpFallbackDevice != null) {
+                    connectedDevices.add(a2dpFallbackDevice);
+                }
+                break;
+            case AudioManager.MODE_RINGTONE:
+                if (headsetFallbackDevice != null && headsetService.isInbandRingingEnabled()) {
+                    connectedDevices.add(headsetFallbackDevice);
+                }
+                break;
+            default:
+                if (headsetFallbackDevice != null) {
+                    connectedDevices.add(headsetFallbackDevice);
+                }
+        }
+        BluetoothDevice device = dbManager.getMostRecentlyConnectedDevicesInList(connectedDevices);
+        if (device != null) {
+            if (mAudioManager.getMode() == AudioManager.MODE_NORMAL) {
+                if (Objects.equals(a2dpFallbackDevice, device)) {
+                    if (DBG) {
+                        Log.d(TAG, "set A2DP device active: " + device);
+                    }
+                    setA2dpActiveDevice(device);
+                    if (headsetFallbackDevice != null) {
+                        setHfpActiveDevice(device);
+                        setLeAudioActiveDevice(null);
+                    }
+                } else {
+                    if (DBG) {
+                        Log.d(TAG, "set LE audio device active: " + device);
+                    }
+                    setLeAudioActiveDevice(device);
+                    setA2dpActiveDevice(null);
+                    setHfpActiveDevice(null);
+                }
+            } else {
+                if (Objects.equals(headsetFallbackDevice, device)) {
+                    if (DBG) {
+                        Log.d(TAG, "set HFP device active: " + device);
+                    }
+                    setHfpActiveDevice(device);
+                    if (a2dpFallbackDevice != null) {
+                        setA2dpActiveDevice(a2dpFallbackDevice);
+                        setLeAudioActiveDevice(null);
+                    }
+                } else {
+                    if (DBG) {
+                        Log.d(TAG, "set LE audio device active: " + device);
+                    }
+                    setLeAudioActiveDevice(device);
+                    setA2dpActiveDevice(null);
+                    setHfpActiveDevice(null);
+                }
+            }
+        }
     }
 
     private void resetState() {
@@ -517,8 +862,15 @@
         mHfpConnectedDevices.clear();
         mHfpActiveDevice = null;
 
+        mHearingAidConnectedDevices.clear();
         mHearingAidActiveDevice = null;
+
+        mLeAudioConnectedDevices.clear();
         mLeAudioActiveDevice = null;
+
+        mLeHearingAidConnectedDevices.clear();
+        mLeHearingAidActiveDevice = null;
+        mPendingLeHearingAidActiveDevice.clear();
     }
 
     @VisibleForTesting
diff --git a/android/app/src/com/android/bluetooth/btservice/AdapterApp.java b/android/app/src/com/android/bluetooth/btservice/AdapterApp.java
index 0c22c7c..99e3f4f 100644
--- a/android/app/src/com/android/bluetooth/btservice/AdapterApp.java
+++ b/android/app/src/com/android/bluetooth/btservice/AdapterApp.java
@@ -52,6 +52,11 @@
         if (DBG) {
             Log.d(TAG, "onCreate");
         }
+        try {
+            DataMigration.run(this);
+        } catch (Exception e) {
+            Log.e(TAG, "Migration failure: ", e);
+        }
         Config.init(this);
     }
 
diff --git a/android/app/src/com/android/bluetooth/btservice/AdapterProperties.java b/android/app/src/com/android/bluetooth/btservice/AdapterProperties.java
index ad7739c..0226349 100644
--- a/android/app/src/com/android/bluetooth/btservice/AdapterProperties.java
+++ b/android/app/src/com/android/bluetooth/btservice/AdapterProperties.java
@@ -55,6 +55,8 @@
 import com.android.bluetooth.Utils;
 import com.android.bluetooth.btservice.RemoteDevices.DeviceProperties;
 
+import com.google.common.collect.EvictingQueue;
+
 import java.io.FileDescriptor;
 import java.io.PrintWriter;
 import java.util.ArrayList;
@@ -91,6 +93,9 @@
     private CopyOnWriteArrayList<BluetoothDevice> mBondedDevices =
             new CopyOnWriteArrayList<BluetoothDevice>();
 
+    private static final int SCAN_MODE_CHANGES_MAX_SIZE = 10;
+    private EvictingQueue<String> mScanModeChanges;
+
     private int mProfilesConnecting, mProfilesConnected, mProfilesDisconnecting;
     private final HashMap<Integer, Pair<Integer, Integer>> mProfileConnectionState =
             new HashMap<>();
@@ -200,6 +205,7 @@
     AdapterProperties(AdapterService service) {
         mService = service;
         mAdapter = BluetoothAdapter.getDefaultAdapter();
+        mScanModeChanges = EvictingQueue.create(SCAN_MODE_CHANGES_MAX_SIZE);
         invalidateBluetoothCaches();
     }
 
@@ -254,6 +260,7 @@
         }
         mService = null;
         mBondedDevices.clear();
+        mScanModeChanges.clear();
         invalidateBluetoothCaches();
     }
 
@@ -389,15 +396,28 @@
     /**
      * Set the local adapter property - scanMode
      *
-     * @param scanMode the ScanMode to set
+     * @param scanMode the ScanMode to set, valid values are: {
+     *     BluetoothAdapter.SCAN_MODE_NONE,
+     *     BluetoothAdapter.SCAN_MODE_CONNECTABLE,
+     *     BluetoothAdapter.SCAN_MODE_CONNECTABLE_DISCOVERABLE,
+     *   }
      */
     boolean setScanMode(int scanMode) {
+        addScanChangeLog(scanMode);
         synchronized (mObject) {
             return mService.setAdapterPropertyNative(AbstractionLayer.BT_PROPERTY_ADAPTER_SCAN_MODE,
-                    Utils.intToByteArray(scanMode));
+                    Utils.intToByteArray(AdapterService.convertScanModeToHal(scanMode)));
         }
     }
 
+    private void addScanChangeLog(int scanMode) {
+        String time = Utils.getLocalTimeString();
+        String uidPid = Utils.getUidPidString();
+        String scanModeString = dumpScanMode(scanMode);
+
+        mScanModeChanges.add(time + " (" + uidPid + ") " + scanModeString);
+    }
+
     /**
      * @return the mUuids
      */
@@ -691,16 +711,18 @@
         BluetoothDevice device = connIntent.getParcelableExtra(BluetoothDevice.EXTRA_DEVICE);
         int prevState = connIntent.getIntExtra(BluetoothProfile.EXTRA_PREVIOUS_STATE, -1);
         int state = connIntent.getIntExtra(BluetoothProfile.EXTRA_STATE, -1);
+        int metricId = mService.getMetricId(device);
         if (state == BluetoothProfile.STATE_CONNECTING) {
             BluetoothStatsLog.write(BluetoothStatsLog.BLUETOOTH_DEVICE_NAME_REPORTED,
-                    mService.getMetricId(device), device.getName());
+                    metricId, device.getName());
+            MetricsLogger.getInstance().logSanitizedBluetoothDeviceName(metricId, device.getName());
         }
         Log.d(TAG,
                 "PROFILE_CONNECTION_STATE_CHANGE: profile=" + profile + ", device=" + device + ", "
                         + prevState + " -> " + state);
         BluetoothStatsLog.write(BluetoothStatsLog.BLUETOOTH_CONNECTION_STATE_CHANGED, state,
                 0 /* deprecated */, profile, mService.obfuscateAddress(device),
-                mService.getMetricId(device), 0);
+                metricId, 0, -1);
 
         if (!isNormalStateTransition(prevState, state)) {
             Log.w(TAG,
@@ -1073,7 +1095,7 @@
             mProfilesConnecting = 0;
             mProfilesDisconnecting = 0;
             // adapterPropertyChangedCallback has already been received.  Set the scan mode.
-            setScanMode(AbstractionLayer.BT_SCAN_MODE_CONNECTABLE);
+            setScanMode(BluetoothAdapter.SCAN_MODE_CONNECTABLE);
             // This keeps NV up-to date on first-boot after flash.
             setDiscoverableTimeout(mDiscoverableTimeout);
         }
@@ -1083,7 +1105,7 @@
         // Sequence BLE_ON to STATE_OFF - that is _complete_ OFF state.
         debugLog("onBleDisable");
         // Set the scan_mode to NONE (no incoming connections).
-        setScanMode(AbstractionLayer.BT_SCAN_MODE_NONE);
+        setScanMode(BluetoothAdapter.SCAN_MODE_NONE);
     }
 
     void discoveryStateChangeCallback(int state) {
@@ -1136,6 +1158,12 @@
             }
         }
         writer.println(sb.toString());
+
+        writer.println("  " + "Scan Mode Changes:");
+        for (String log : mScanModeChanges) {
+            writer.println("    " + log);
+        }
+
     }
 
     private String dumpDeviceType(int deviceType) {
diff --git a/android/app/src/com/android/bluetooth/btservice/AdapterService.java b/android/app/src/com/android/bluetooth/btservice/AdapterService.java
index 1f3268b..7e36914 100644
--- a/android/app/src/com/android/bluetooth/btservice/AdapterService.java
+++ b/android/app/src/com/android/bluetooth/btservice/AdapterService.java
@@ -21,7 +21,6 @@
 import static android.text.format.DateUtils.SECOND_IN_MILLIS;
 
 import static com.android.bluetooth.Utils.callerIsSystemOrActiveOrManagedUser;
-import static com.android.bluetooth.Utils.callerIsSystemOrActiveUser;
 import static com.android.bluetooth.Utils.enforceBluetoothPrivilegedPermission;
 import static com.android.bluetooth.Utils.enforceCdmAssociation;
 import static com.android.bluetooth.Utils.enforceDumpPermission;
@@ -51,6 +50,7 @@
 import android.bluetooth.BluetoothProtoEnums;
 import android.bluetooth.BluetoothSap;
 import android.bluetooth.BluetoothServerSocket;
+import android.bluetooth.BluetoothSinkAudioPolicy;
 import android.bluetooth.BluetoothSocket;
 import android.bluetooth.BluetoothStatusCodes;
 import android.bluetooth.BluetoothUuid;
@@ -169,6 +169,7 @@
     private static final int MIN_OFFLOADED_FILTERS = 10;
     private static final int MIN_OFFLOADED_SCAN_STORAGE_BYTES = 1024;
     private static final Duration PENDING_SOCKET_HANDOFF_TIMEOUT = Duration.ofMinutes(1);
+    private static final Duration GENERATE_LOCAL_OOB_DATA_TIMEOUT = Duration.ofSeconds(2);
 
     private final Object mEnergyInfoLock = new Object();
     private int mStackReportedState;
@@ -204,11 +205,11 @@
     static final String LOCAL_MAC_ADDRESS_PERM = android.Manifest.permission.LOCAL_MAC_ADDRESS;
     static final String RECEIVE_MAP_PERM = android.Manifest.permission.RECEIVE_BLUETOOTH_MAP;
 
-    private static final String PHONEBOOK_ACCESS_PERMISSION_PREFERENCE_FILE =
+    static final String PHONEBOOK_ACCESS_PERMISSION_PREFERENCE_FILE =
             "phonebook_access_permission";
-    private static final String MESSAGE_ACCESS_PERMISSION_PREFERENCE_FILE =
+    static final String MESSAGE_ACCESS_PERMISSION_PREFERENCE_FILE =
             "message_access_permission";
-    private static final String SIM_ACCESS_PERMISSION_PREFERENCE_FILE = "sim_access_permission";
+    static final String SIM_ACCESS_PERMISSION_PREFERENCE_FILE = "sim_access_permission";
 
     private static final int CONTROLLER_ENERGY_UPDATE_TIMEOUT_MILLIS = 30;
 
@@ -262,7 +263,8 @@
     }
 
     private BluetoothAdapter mAdapter;
-    private AdapterProperties mAdapterProperties;
+    @VisibleForTesting
+    AdapterProperties mAdapterProperties;
     private AdapterState mAdapterStateMachine;
     private BondStateMachine mBondStateMachine;
     private JniCallbacks mJniCallbacks;
@@ -299,6 +301,7 @@
     private ActiveDeviceManager mActiveDeviceManager;
     private DatabaseManager mDatabaseManager;
     private SilenceDeviceManager mSilenceDeviceManager;
+    private CompanionManager mBtCompanionManager;
     private AppOpsManager mAppOps;
 
     private BluetoothSocketManagerBinder mBluetoothSocketManagerBinder;
@@ -440,6 +443,7 @@
                         getAdapterPropertyNative(AbstractionLayer.BT_PROPERTY_LOCAL_IO_CAPS_BLE);
                         getAdapterPropertyNative(AbstractionLayer.BT_PROPERTY_DYNAMIC_AUDIO_BUFFER);
                         mAdapterStateMachine.sendMessage(AdapterState.BREDR_STARTED);
+                        mBtCompanionManager.loadCompanionInfo();
                     }
                     break;
                 case BluetoothAdapter.STATE_OFF:
@@ -541,6 +545,8 @@
                 Looper.getMainLooper());
         mSilenceDeviceManager.start();
 
+        mBtCompanionManager = new CompanionManager(this, new ServiceFactory());
+
         mBluetoothSocketManagerBinder = new BluetoothSocketManagerBinder(this);
 
         mActivityAttributionService = new ActivityAttributionService();
@@ -711,7 +717,7 @@
     void stopProfileServices() {
         // Make sure to stop classic background tasks now
         cancelDiscoveryNative();
-        mAdapterProperties.setScanMode(AbstractionLayer.BT_SCAN_MODE_NONE);
+        mAdapterProperties.setScanMode(BluetoothAdapter.SCAN_MODE_NONE);
 
         Class[] supportedProfileServices = Config.getSupportedProfiles();
         // TODO(b/228875190): GATT is assumed supported. If we support no profiles then just move on
@@ -749,8 +755,9 @@
             nonSupportedProfiles.add(BassClientService.class);
         }
 
-        if (isLeAudioBroadcastSourceSupported()) {
-            Config.addSupportedProfile(BluetoothProfile.LE_AUDIO_BROADCAST);
+        if (!isLeAudioBroadcastSourceSupported()) {
+            Config.updateSupportedProfileMask(
+                    false, LeAudioService.class, BluetoothProfile.LE_AUDIO_BROADCAST);
         }
 
         if (!nonSupportedProfiles.isEmpty()) {
@@ -1360,7 +1367,8 @@
     }
 
     @BluetoothAdapter.RfcommListenerResult
-    private int stopRfcommListener(ParcelUuid uuid, AttributionSource attributionSource) {
+    @VisibleForTesting
+    int stopRfcommListener(ParcelUuid uuid, AttributionSource attributionSource) {
         RfcommListenerData listenerData = mBluetoothServerSockets.get(uuid.getUuid());
 
         if (listenerData == null) {
@@ -1379,7 +1387,8 @@
         return listenerData.closeServerAndPendingSockets(mHandler);
     }
 
-    private IncomingRfcommSocketInfo retrievePendingSocketForServiceRecord(
+    @VisibleForTesting
+    IncomingRfcommSocketInfo retrievePendingSocketForServiceRecord(
             ParcelUuid uuid, AttributionSource attributionSource) {
         IncomingRfcommSocketInfo socketInfo = new IncomingRfcommSocketInfo();
 
@@ -1547,11 +1556,38 @@
         }
     }
 
-    private boolean isAvailable() {
+    @VisibleForTesting
+    boolean isAvailable() {
         return !mCleaningUp;
     }
 
     /**
+     *  Get an metadata of given device and key
+     *
+     *  @param device Bluetooth device
+     *  @param key Metadata key
+     *  @param value Metadata value
+     *  @return if metadata is set successfully
+     */
+    public boolean setMetadata(BluetoothDevice device, int key, byte[] value) {
+        if (value == null || value.length > BluetoothDevice.METADATA_MAX_LENGTH) {
+            return false;
+        }
+        return mDatabaseManager.setCustomMeta(device, key, value);
+    }
+
+    /**
+     *  Get an metadata of given device and key
+     *
+     *  @param device Bluetooth device
+     *  @param key Metadata key
+     *  @return value of given device and key combination
+     */
+    public byte[] getMetadata(BluetoothDevice device, int key) {
+        return mDatabaseManager.getCustomMeta(device, key);
+    }
+
+    /**
      * Handlers for incoming service calls
      */
     private AdapterServiceBinder mBinder;
@@ -1617,7 +1653,7 @@
         }
         private boolean enable(boolean quietMode, AttributionSource attributionSource) {
             AdapterService service = getService();
-            if (service == null || !callerIsSystemOrActiveUser(TAG, "enable")
+            if (service == null || !callerIsSystemOrActiveOrManagedUser(service, TAG, "enable")
                     || !Utils.checkConnectPermissionForDataDelivery(
                             service, attributionSource, "AdapterService enable")) {
                 return false;
@@ -1636,7 +1672,7 @@
         }
         private boolean disable(AttributionSource attributionSource) {
             AdapterService service = getService();
-            if (service == null || !callerIsSystemOrActiveUser(TAG, "disable")
+            if (service == null || !callerIsSystemOrActiveOrManagedUser(service, TAG, "disable")
                     || !Utils.checkConnectPermissionForDataDelivery(
                             service, attributionSource, "AdapterService disable")) {
                 return false;
@@ -1685,7 +1721,7 @@
         }
         private List<ParcelUuid> getUuids(AttributionSource attributionSource) {
             AdapterService service = getService();
-            if (service == null || !callerIsSystemOrActiveUser(TAG, "getUuids")
+            if (service == null || !callerIsSystemOrActiveOrManagedUser(service, TAG, "getUuids")
                     || !Utils.checkConnectPermissionForDataDelivery(
                             service, attributionSource, "AdapterService getUuids")) {
                 return new ArrayList<>();
@@ -1708,7 +1744,8 @@
         }
         public String getIdentityAddress(String address) {
             AdapterService service = getService();
-            if (service == null || !callerIsSystemOrActiveUser(TAG, "getIdentityAddress")
+            if (service == null
+                    || !callerIsSystemOrActiveOrManagedUser(service, TAG, "getIdentityAddress")
                     || !Utils.checkConnectPermissionForDataDelivery(
                             service, Utils.getCallingAttributionSource(mService),
                                 "AdapterService getIdentityAddress")) {
@@ -1728,7 +1765,7 @@
         }
         private String getName(AttributionSource attributionSource) {
             AdapterService service = getService();
-            if (service == null || !callerIsSystemOrActiveUser(TAG, "getName")
+            if (service == null || !callerIsSystemOrActiveOrManagedUser(service, TAG, "getName")
                     || !Utils.checkConnectPermissionForDataDelivery(
                             service, attributionSource, "AdapterService getName")) {
                 return null;
@@ -1748,7 +1785,9 @@
         }
         private int getNameLengthForAdvertise(AttributionSource attributionSource) {
             AdapterService service = getService();
-            if (service == null || !callerIsSystemOrActiveUser(TAG, "getNameLengthForAdvertise")
+            if (service == null
+                    || !callerIsSystemOrActiveOrManagedUser(service,
+                            TAG, "getNameLengthForAdvertise")
                     || !Utils.checkAdvertisePermissionForDataDelivery(
                             service, attributionSource, TAG)) {
                 return -1;
@@ -1768,7 +1807,7 @@
         }
         private boolean setName(String name, AttributionSource attributionSource) {
             AdapterService service = getService();
-            if (service == null || !callerIsSystemOrActiveUser(TAG, "setName")
+            if (service == null || !callerIsSystemOrActiveOrManagedUser(service, TAG, "setName")
                     || !Utils.checkConnectPermissionForDataDelivery(
                             service, attributionSource, "AdapterService setName")) {
                 return false;
@@ -1788,7 +1827,8 @@
         }
         private BluetoothClass getBluetoothClass(AttributionSource attributionSource) {
             AdapterService service = getService();
-            if (service == null || !callerIsSystemOrActiveUser(TAG, "getBluetoothClass")
+            if (service == null
+                    || !callerIsSystemOrActiveOrManagedUser(service, TAG, "getBluetoothClass")
                     || !Utils.checkConnectPermissionForDataDelivery(
                             service, attributionSource, "AdapterSource getBluetoothClass")) {
                 return null;
@@ -1809,7 +1849,7 @@
         private boolean setBluetoothClass(BluetoothClass bluetoothClass, AttributionSource source) {
             AdapterService service = getService();
             if (service == null
-                    || !Utils.checkCallerIsSystemOrActiveUser(TAG)
+                    || !callerIsSystemOrActiveOrManagedUser(service, TAG, "setBluetoothClass")
                     || !Utils.checkConnectPermissionForDataDelivery(service, source, TAG)) {
                 return false;
             }
@@ -1836,7 +1876,8 @@
         }
         private int getIoCapability(AttributionSource attributionSource) {
             AdapterService service = getService();
-            if (service == null || !callerIsSystemOrActiveUser(TAG, "getIoCapability")
+            if (service == null
+                    || !callerIsSystemOrActiveOrManagedUser(service, TAG, "getIoCapability")
                     || !Utils.checkConnectPermissionForDataDelivery(
                             service, attributionSource, "AdapterService getIoCapability")) {
                 return BluetoothAdapter.IO_CAPABILITY_UNKNOWN;
@@ -1857,7 +1898,7 @@
         private boolean setIoCapability(int capability, AttributionSource source) {
             AdapterService service = getService();
             if (service == null
-                    || !Utils.checkCallerIsSystemOrActiveUser(TAG)
+                    || !callerIsSystemOrActiveOrManagedUser(service, TAG, "setIoCapability")
                     || !Utils.checkConnectPermissionForDataDelivery(service, source, TAG)) {
                 return false;
             }
@@ -1882,7 +1923,8 @@
         }
         private int getLeIoCapability(AttributionSource attributionSource) {
             AdapterService service = getService();
-            if (service == null || !callerIsSystemOrActiveUser(TAG, "getLeIoCapability")
+            if (service == null
+                    || !callerIsSystemOrActiveOrManagedUser(service, TAG, "getLeIoCapability")
                     || !Utils.checkConnectPermissionForDataDelivery(
                             service, attributionSource, "AdapterService getLeIoCapability")) {
                 return BluetoothAdapter.IO_CAPABILITY_UNKNOWN;
@@ -1903,7 +1945,7 @@
         private boolean setLeIoCapability(int capability, AttributionSource source) {
             AdapterService service = getService();
             if (service == null
-                    || !Utils.checkCallerIsSystemOrActiveUser(TAG)
+                    || !callerIsSystemOrActiveOrManagedUser(service, TAG, "setLeIoCapability")
                     || !Utils.checkConnectPermissionForDataDelivery(service, source, TAG)) {
                 return false;
             }
@@ -1948,14 +1990,15 @@
         }
         private int setScanMode(int mode, AttributionSource attributionSource) {
             AdapterService service = getService();
-            if (service == null || !callerIsSystemOrActiveUser(TAG, "setScanMode")
+            if (service == null
+                    || !callerIsSystemOrActiveOrManagedUser(service, TAG, "setScanMode")
                     || !Utils.checkScanPermissionForDataDelivery(
                             service, attributionSource, "AdapterService setScanMode")) {
                 return BluetoothStatusCodes.ERROR_MISSING_BLUETOOTH_SCAN_PERMISSION;
             }
             enforceBluetoothPrivilegedPermission(service);
 
-            return service.mAdapterProperties.setScanMode(convertScanModeToHal(mode))
+            return service.mAdapterProperties.setScanMode(mode)
                     ? BluetoothStatusCodes.SUCCESS : BluetoothStatusCodes.ERROR_UNKNOWN;
         }
 
@@ -1970,7 +2013,8 @@
         }
         private long getDiscoverableTimeout(AttributionSource attributionSource) {
             AdapterService service = getService();
-            if (service == null || !callerIsSystemOrActiveUser(TAG, "getDiscoverableTimeout")
+            if (service == null
+                    || !callerIsSystemOrActiveOrManagedUser(service, TAG, "getDiscoverableTimeout")
                     || !Utils.checkScanPermissionForDataDelivery(
                             service, attributionSource, "AdapterService getDiscoverableTimeout")) {
                 return -1;
@@ -1990,7 +2034,8 @@
         }
         private int setDiscoverableTimeout(long timeout, AttributionSource attributionSource) {
             AdapterService service = getService();
-            if (service == null || !callerIsSystemOrActiveUser(TAG, "setDiscoverableTimeout")
+            if (service == null
+                    || !callerIsSystemOrActiveOrManagedUser(service, TAG, "setDiscoverableTimeout")
                     || !Utils.checkScanPermissionForDataDelivery(
                             service, attributionSource, "AdapterService setDiscoverableTimeout")) {
                 return BluetoothStatusCodes.ERROR_MISSING_BLUETOOTH_SCAN_PERMISSION;
@@ -2011,7 +2056,8 @@
         }
         private boolean startDiscovery(AttributionSource attributionSource) {
             AdapterService service = getService();
-            if (service == null || !callerIsSystemOrActiveUser(TAG, "startDiscovery")) {
+            if (service == null
+                    || !callerIsSystemOrActiveOrManagedUser(service, TAG, "startDiscovery")) {
                 return false;
             }
 
@@ -2033,7 +2079,8 @@
         }
         private boolean cancelDiscovery(AttributionSource attributionSource) {
             AdapterService service = getService();
-            if (service == null || !callerIsSystemOrActiveUser(TAG, "cancelDiscovery")
+            if (service == null
+                    || !callerIsSystemOrActiveOrManagedUser(service, TAG, "cancelDiscovery")
                     || !Utils.checkScanPermissionForDataDelivery(
                             service, attributionSource, "AdapterService cancelDiscovery")) {
                 return false;
@@ -2075,7 +2122,7 @@
         private long getDiscoveryEndMillis(AttributionSource source) {
             AdapterService service = getService();
             if (service == null
-                    || !Utils.checkCallerIsSystemOrActiveUser(TAG)
+                    || !callerIsSystemOrActiveOrManagedUser(service, TAG, "getDiscoveryEndMillis")
                     || !Utils.checkConnectPermissionForDataDelivery(service, source, TAG)) {
                 return -1;
             }
@@ -2209,7 +2256,8 @@
         private boolean cancelBondProcess(
                 BluetoothDevice device, AttributionSource attributionSource) {
             AdapterService service = getService();
-            if (service == null || !callerIsSystemOrActiveUser(TAG, "cancelBondProcess")
+            if (service == null
+                    || !callerIsSystemOrActiveOrManagedUser(service, TAG, "cancelBondProcess")
                     || !Utils.checkConnectPermissionForDataDelivery(
                             service, attributionSource, "AdapterService cancelBondProcess")) {
                 return false;
@@ -2236,7 +2284,8 @@
         }
         private boolean removeBond(BluetoothDevice device, AttributionSource attributionSource) {
             AdapterService service = getService();
-            if (service == null || !callerIsSystemOrActiveUser(TAG, "removeBond")
+            if (service == null
+                    || !callerIsSystemOrActiveOrManagedUser(service, TAG, "removeBond")
                     || !Utils.checkConnectPermissionForDataDelivery(
                             service, attributionSource, "AdapterService removeBond")) {
                 return false;
@@ -2311,7 +2360,7 @@
                 AttributionSource source) {
             AdapterService service = getService();
             if (service == null
-                    || !Utils.checkCallerIsSystemOrActiveOrManagedUser(service, TAG)
+                    || !callerIsSystemOrActiveOrManagedUser(service, TAG, "generateLocalOobData")
                     || !Utils.checkConnectPermissionForDataDelivery(service, source, TAG)) {
                 return;
             }
@@ -2402,7 +2451,7 @@
                 AttributionSource source) {
             AdapterService service = getService();
             if (service == null
-                    || !Utils.checkCallerIsSystemOrActiveUser(TAG)
+                    || !callerIsSystemOrActiveOrManagedUser(service, TAG, "removeActiveDevice")
                     || !Utils.checkConnectPermissionForDataDelivery(service, source, TAG)) {
                 return false;
             }
@@ -2422,7 +2471,7 @@
                 AttributionSource source) {
             AdapterService service = getService();
             if (service == null
-                    || !Utils.checkCallerIsSystemOrActiveUser(TAG)
+                    || !callerIsSystemOrActiveOrManagedUser(service, TAG, "setActiveDevice")
                     || !Utils.checkConnectPermissionForDataDelivery(service, source, TAG)) {
                 return false;
             }
@@ -2445,7 +2494,7 @@
                 AttributionSource source) {
             AdapterService service = getService();
             if (service == null
-                    || !Utils.checkCallerIsSystemOrActiveUser(TAG)
+                    || !callerIsSystemOrActiveOrManagedUser(service, TAG, "getActiveDevices")
                     || !Utils.checkConnectPermissionForDataDelivery(service, source, TAG)) {
                 return new ArrayList<>();
             }
@@ -2470,7 +2519,7 @@
             if (service == null) {
                 return BluetoothStatusCodes.ERROR_BLUETOOTH_NOT_ENABLED;
             }
-            if (!callerIsSystemOrActiveUser(TAG, "connectAllEnabledProfiles")) {
+            if (!callerIsSystemOrActiveOrManagedUser(service, TAG, "connectAllEnabledProfiles")) {
                 return BluetoothStatusCodes.ERROR_BLUETOOTH_NOT_ALLOWED;
             }
             if (device == null) {
@@ -2509,7 +2558,8 @@
             if (service == null) {
                 return BluetoothStatusCodes.ERROR_BLUETOOTH_NOT_ENABLED;
             }
-            if (!callerIsSystemOrActiveUser(TAG, "disconnectAllEnabledProfiles")) {
+            if (!callerIsSystemOrActiveOrManagedUser(service,
+                    TAG, "disconnectAllEnabledProfiles")) {
                 return BluetoothStatusCodes.ERROR_BLUETOOTH_NOT_ALLOWED;
             }
             if (device == null) {
@@ -2624,7 +2674,7 @@
             if (service == null) {
                 return BluetoothStatusCodes.ERROR_BLUETOOTH_NOT_ENABLED;
             }
-            if (!callerIsSystemOrActiveUser(TAG, "setRemoteAlias")) {
+            if (!callerIsSystemOrActiveOrManagedUser(service, TAG, "setRemoteAlias")) {
                 return BluetoothStatusCodes.ERROR_BLUETOOTH_NOT_ALLOWED;
             }
             if (name != null && name.isEmpty()) {
@@ -2743,7 +2793,8 @@
         private boolean setPin(BluetoothDevice device, boolean accept, int len, byte[] pinCode,
                 AttributionSource attributionSource) {
             AdapterService service = getService();
-            if (service == null || !callerIsSystemOrActiveUser(TAG, "setPin")
+            if (service == null
+                    || !callerIsSystemOrActiveOrManagedUser(service, TAG, "setPin")
                     || !Utils.checkConnectPermissionForDataDelivery(
                             service, attributionSource, "AdapterService setPin")) {
                 return false;
@@ -2778,7 +2829,8 @@
         private boolean setPasskey(BluetoothDevice device, boolean accept, int len, byte[] passkey,
                 AttributionSource attributionSource) {
             AdapterService service = getService();
-            if (service == null || !callerIsSystemOrActiveUser(TAG, "setPasskey")
+            if (service == null
+                    || !callerIsSystemOrActiveOrManagedUser(service, TAG, "setPasskey")
                     || !Utils.checkConnectPermissionForDataDelivery(
                             service, attributionSource, "AdapterService setPasskey")) {
                 return false;
@@ -2814,7 +2866,7 @@
                 AttributionSource source) {
             AdapterService service = getService();
             if (service == null
-                    || !Utils.checkCallerIsSystemOrActiveUser(TAG)
+                    || !callerIsSystemOrActiveOrManagedUser(service, TAG, "setPairingConfirmation")
                     || !Utils.checkConnectPermissionForDataDelivery(service, source, TAG)) {
                 return false;
             }
@@ -2845,7 +2897,7 @@
         private boolean getSilenceMode(BluetoothDevice device, AttributionSource source) {
             AdapterService service = getService();
             if (service == null
-                    || !Utils.checkCallerIsSystemOrActiveUser(TAG)
+                    || !callerIsSystemOrActiveOrManagedUser(service, TAG, "getSilenceMode")
                     || !Utils.checkConnectPermissionForDataDelivery(service, source, TAG)) {
                 return false;
             }
@@ -2868,7 +2920,7 @@
                 AttributionSource source) {
             AdapterService service = getService();
             if (service == null
-                    || !Utils.checkCallerIsSystemOrActiveUser(TAG)
+                    || !callerIsSystemOrActiveOrManagedUser(service, TAG, "setSilenceMode")
                     || !Utils.checkConnectPermissionForDataDelivery(service, source, TAG)) {
                 return false;
             }
@@ -2891,7 +2943,9 @@
         private int getPhonebookAccessPermission(
                 BluetoothDevice device, AttributionSource attributionSource) {
             AdapterService service = getService();
-            if (service == null || !callerIsSystemOrActiveUser(TAG, "getPhonebookAccessPermission")
+            if (service == null
+                    || !callerIsSystemOrActiveOrManagedUser(
+                            service, TAG, "getPhonebookAccessPermission")
                     || !Utils.checkConnectPermissionForDataDelivery(
                     service, attributionSource, "AdapterService getPhonebookAccessPermission")) {
                 return BluetoothDevice.ACCESS_UNKNOWN;
@@ -2913,7 +2967,8 @@
                 AttributionSource source) {
             AdapterService service = getService();
             if (service == null
-                    || !Utils.checkCallerIsSystemOrActiveUser(TAG)
+                    || !callerIsSystemOrActiveOrManagedUser(service,
+                            TAG, "setPhonebookAccessPermission")
                     || !Utils.checkConnectPermissionForDataDelivery(service, source, TAG)) {
                 return false;
             }
@@ -2936,7 +2991,9 @@
         private int getMessageAccessPermission(
                 BluetoothDevice device, AttributionSource attributionSource) {
             AdapterService service = getService();
-            if (service == null || !callerIsSystemOrActiveUser(TAG, "getMessageAccessPermission")
+            if (service == null
+                    || !callerIsSystemOrActiveOrManagedUser(service,
+                            TAG, "getMessageAccessPermission")
                     || !Utils.checkConnectPermissionForDataDelivery(
                     service, attributionSource, "AdapterService getMessageAccessPermission")) {
                 return BluetoothDevice.ACCESS_UNKNOWN;
@@ -2958,7 +3015,8 @@
                 AttributionSource source) {
             AdapterService service = getService();
             if (service == null
-                    || !Utils.checkCallerIsSystemOrActiveUser(TAG)
+                    || !callerIsSystemOrActiveOrManagedUser(service,
+                            TAG, "setMessageAccessPermission")
                     || !Utils.checkConnectPermissionForDataDelivery(service, source, TAG)) {
                 return false;
             }
@@ -2981,7 +3039,9 @@
         private int getSimAccessPermission(
                 BluetoothDevice device, AttributionSource attributionSource) {
             AdapterService service = getService();
-            if (service == null || !callerIsSystemOrActiveUser(TAG, "getSimAccessPermission")
+            if (service == null
+                    || !callerIsSystemOrActiveOrManagedUser(service,
+                            TAG, "getSimAccessPermission")
                     || !Utils.checkConnectPermissionForDataDelivery(
                             service, attributionSource, "AdapterService getSimAccessPermission")) {
                 return BluetoothDevice.ACCESS_UNKNOWN;
@@ -3003,7 +3063,7 @@
                 AttributionSource source) {
             AdapterService service = getService();
             if (service == null
-                    || !Utils.checkCallerIsSystemOrActiveUser(TAG)
+                    || !callerIsSystemOrActiveOrManagedUser(service, TAG, "setSimAccessPermission")
                     || !Utils.checkConnectPermissionForDataDelivery(service, source, TAG)) {
                 return false;
             }
@@ -3036,7 +3096,8 @@
         private boolean sdpSearch(
                 BluetoothDevice device, ParcelUuid uuid, AttributionSource attributionSource) {
             AdapterService service = getService();
-            if (service == null || !callerIsSystemOrActiveUser(TAG, "sdpSearch")
+            if (service == null
+                    || !callerIsSystemOrActiveOrManagedUser(service, TAG, "sdpSearch")
                     || !Utils.checkConnectPermissionForDataDelivery(
                             service, attributionSource, "AdapterService sdpSearch")) {
                 return false;
@@ -3060,7 +3121,8 @@
         }
         private int getBatteryLevel(BluetoothDevice device, AttributionSource attributionSource) {
             AdapterService service = getService();
-            if (service == null || !callerIsSystemOrActiveUser(TAG, "getBatteryLevel")
+            if (service == null
+                    || !callerIsSystemOrActiveOrManagedUser(service, TAG, "getBatteryLevel")
                     || !Utils.checkConnectPermissionForDataDelivery(
                             service, attributionSource, "AdapterService getBatteryLevel")) {
                 return BluetoothDevice.BATTERY_LEVEL_UNKNOWN;
@@ -3140,6 +3202,10 @@
                 service.mBluetoothKeystoreService.factoryReset();
             }
 
+            if (service.mBtCompanionManager != null) {
+                service.mBtCompanionManager.factoryReset();
+            }
+
             return service.factoryResetNative();
         }
 
@@ -3156,7 +3222,8 @@
                 AttributionSource source) {
             AdapterService service = getService();
             if (service == null
-                    || !Utils.checkCallerIsSystemOrActiveUser(TAG)
+                    || !callerIsSystemOrActiveOrManagedUser(service,
+                            TAG, "registerBluetoothConnectionCallback")
                     || !Utils.checkConnectPermissionForDataDelivery(service, source, TAG)) {
                 return false;
             }
@@ -3178,7 +3245,8 @@
                 IBluetoothConnectionCallback callback, AttributionSource source) {
             AdapterService service = getService();
             if (service == null
-                    || !Utils.checkCallerIsSystemOrActiveUser(TAG)
+                    || !callerIsSystemOrActiveOrManagedUser(service,
+                            TAG, "unregisterBluetoothConnectionCallback")
                     || !Utils.checkConnectPermissionForDataDelivery(service, source, TAG)) {
                 return false;
             }
@@ -3200,7 +3268,7 @@
         void registerCallback(IBluetoothCallback callback, AttributionSource source) {
             AdapterService service = getService();
             if (service == null
-                    || !Utils.checkCallerIsSystemOrActiveUser(TAG)
+                    || !callerIsSystemOrActiveOrManagedUser(service, TAG, "registerCallback")
                     || !Utils.checkConnectPermissionForDataDelivery(service, source, TAG)) {
                 return;
             }
@@ -3224,7 +3292,7 @@
         void unregisterCallback(IBluetoothCallback callback, AttributionSource source) {
             AdapterService service = getService();
             if (service == null || service.mCallbacks == null
-                    || !Utils.checkCallerIsSystemOrActiveUser(TAG)
+                    || !callerIsSystemOrActiveOrManagedUser(service, TAG, "unregisterCallback")
                     || !Utils.checkConnectPermissionForDataDelivery(service, source, TAG)) {
                 return;
             }
@@ -3399,7 +3467,8 @@
                 return BluetoothStatusCodes.ERROR_BLUETOOTH_NOT_ENABLED;
             }
 
-            if (service.isLeAudioBroadcastSourceSupported()) {
+            long supportBitMask = Config.getSupportedProfilesBitMask();
+            if ((supportBitMask & (1 << BluetoothProfile.LE_AUDIO_BROADCAST)) != 0) {
                 return BluetoothStatusCodes.FEATURE_SUPPORTED;
             }
 
@@ -3499,7 +3568,8 @@
                 BluetoothDevice device, AttributionSource source) {
             AdapterService service = getService();
             if (service == null
-                    || !Utils.checkCallerIsSystemOrActiveUser(TAG)
+                    || !callerIsSystemOrActiveOrManagedUser(service,
+                            TAG, "registerMetadataListener")
                     || !Utils.checkConnectPermissionForDataDelivery(service, source, TAG)) {
                 return false;
             }
@@ -3534,7 +3604,8 @@
                 AttributionSource source) {
             AdapterService service = getService();
             if (service == null
-                    || !Utils.checkCallerIsSystemOrActiveUser(TAG)
+                    || !callerIsSystemOrActiveOrManagedUser(service,
+                            TAG, "unregisterMetadataListener")
                     || !Utils.checkConnectPermissionForDataDelivery(service, source, TAG)) {
                 return false;
             }
@@ -3563,7 +3634,7 @@
                 AttributionSource source) {
             AdapterService service = getService();
             if (service == null
-                    || !Utils.checkCallerIsSystemOrActiveUser(TAG)
+                    || !callerIsSystemOrActiveOrManagedUser(service, TAG, "setMetadata")
                     || !Utils.checkConnectPermissionForDataDelivery(service, source, TAG)) {
                 return false;
             }
@@ -3589,7 +3660,7 @@
                 AttributionSource source) {
             AdapterService service = getService();
             if (service == null
-                    || !Utils.checkCallerIsSystemOrActiveUser(TAG)
+                    || !callerIsSystemOrActiveOrManagedUser(service, TAG, "getMetadata")
                     || !Utils.checkConnectPermissionForDataDelivery(service, source, TAG)) {
                 return null;
             }
@@ -3600,6 +3671,76 @@
         }
 
         @Override
+        public void isRequestAudioPolicyAsSinkSupported(BluetoothDevice device,
+                AttributionSource source, SynchronousResultReceiver receiver) {
+            try {
+                receiver.send(isRequestAudioPolicyAsSinkSupported(device, source));
+            } catch (RuntimeException e) {
+                receiver.propagateException(e);
+            }
+        }
+        private int isRequestAudioPolicyAsSinkSupported(BluetoothDevice device,
+                AttributionSource source) {
+            AdapterService service = getService();
+            if (service == null
+                    || !callerIsSystemOrActiveOrManagedUser(service, TAG,
+                        "isRequestAudioPolicyAsSinkSupported")
+                    || !Utils.checkConnectPermissionForDataDelivery(service, source, TAG)) {
+                return BluetoothStatusCodes.FEATURE_NOT_CONFIGURED;
+            }
+            enforceBluetoothPrivilegedPermission(service);
+            return service.isRequestAudioPolicyAsSinkSupported(device);
+        }
+
+        @Override
+        public void requestAudioPolicyAsSink(BluetoothDevice device,
+                BluetoothSinkAudioPolicy policies, AttributionSource source,
+                SynchronousResultReceiver receiver) {
+            try {
+                receiver.send(requestAudioPolicyAsSink(device, policies, source));
+            } catch (RuntimeException e) {
+                receiver.propagateException(e);
+            }
+        }
+        private int requestAudioPolicyAsSink(BluetoothDevice device,
+                BluetoothSinkAudioPolicy policies, AttributionSource source) {
+            AdapterService service = getService();
+            if (service == null) {
+                return BluetoothStatusCodes.ERROR_BLUETOOTH_NOT_ENABLED;
+            } else if (!callerIsSystemOrActiveOrManagedUser(service,
+                    TAG, "requestAudioPolicyAsSink")) {
+                return BluetoothStatusCodes.ERROR_BLUETOOTH_NOT_ALLOWED;
+            } else if (!Utils.checkConnectPermissionForDataDelivery(
+                    service, source, TAG)) {
+                return BluetoothStatusCodes.ERROR_MISSING_BLUETOOTH_CONNECT_PERMISSION;
+            }
+            enforceBluetoothPrivilegedPermission(service);
+            return service.requestAudioPolicyAsSink(device, policies);
+        }
+
+        @Override
+        public void getRequestedAudioPolicyAsSink(BluetoothDevice device,
+                AttributionSource source, SynchronousResultReceiver receiver) {
+            try {
+                receiver.send(getRequestedAudioPolicyAsSink(device, source));
+            } catch (RuntimeException e) {
+                receiver.propagateException(e);
+            }
+        }
+        private BluetoothSinkAudioPolicy getRequestedAudioPolicyAsSink(BluetoothDevice device,
+                AttributionSource source) {
+            AdapterService service = getService();
+            if (service == null
+                    || !callerIsSystemOrActiveOrManagedUser(service,
+                            TAG, "getRequestedAudioPolicyAsSink")
+                    || !Utils.checkConnectPermissionForDataDelivery(service, source, TAG)) {
+                return null;
+            }
+            enforceBluetoothPrivilegedPermission(service);
+            return service.getRequestedAudioPolicyAsSink(device);
+        }
+
+        @Override
         public void requestActivityInfo(IBluetoothActivityEnergyInfoListener listener,
                     AttributionSource source) {
             BluetoothActivityEnergyInfo info = reportActivityInfo(source);
@@ -3623,7 +3764,7 @@
         void onLeServiceUp(AttributionSource source) {
             AdapterService service = getService();
             if (service == null
-                    || !Utils.checkCallerIsSystemOrActiveUser(TAG)
+                    || !callerIsSystemOrActiveOrManagedUser(service, TAG, "onLeServiceUp")
                     || !Utils.checkConnectPermissionForDataDelivery(service, source, TAG)) {
                 return;
             }
@@ -3646,7 +3787,7 @@
         void onBrEdrDown(AttributionSource source) {
             AdapterService service = getService();
             if (service == null
-                    || !Utils.checkCallerIsSystemOrActiveUser(TAG)
+                    || !callerIsSystemOrActiveOrManagedUser(service, TAG, "onBrEdrDown")
                     || !Utils.checkConnectPermissionForDataDelivery(service, source, TAG)) {
                 return;
             }
@@ -3686,7 +3827,7 @@
         private boolean allowLowLatencyAudio(boolean allowed, BluetoothDevice device) {
             AdapterService service = getService();
             if (service == null
-                    || !Utils.checkCallerIsSystemOrActiveUser(TAG)
+                    || !callerIsSystemOrActiveOrManagedUser(service, TAG, "allowLowLatencyAudio")
                     || !Utils.checkConnectPermissionForDataDelivery(
                             service, Utils.getCallingAttributionSource(service),
                                 "AdapterService allowLowLatencyAudio")) {
@@ -3716,7 +3857,7 @@
                 AttributionSource attributionSource) {
             AdapterService service = getService();
             if (service == null
-                    || !Utils.checkCallerIsSystemOrActiveUser(TAG)
+                    || !callerIsSystemOrActiveOrManagedUser(service, TAG, "startRfcommListener")
                     || !Utils.checkConnectPermissionForDataDelivery(
                             service, attributionSource, "AdapterService startRfcommListener")) {
                 return BluetoothStatusCodes.ERROR_BLUETOOTH_NOT_ALLOWED;
@@ -3741,7 +3882,7 @@
         private int stopRfcommListener(ParcelUuid uuid, AttributionSource attributionSource) {
             AdapterService service = getService();
             if (service == null
-                    || !Utils.checkCallerIsSystemOrActiveUser(TAG)
+                    || !callerIsSystemOrActiveOrManagedUser(service, TAG, "stopRfcommListener")
                     || !Utils.checkConnectPermissionForDataDelivery(
                             service, attributionSource, "AdapterService stopRfcommListener")) {
                 return BluetoothStatusCodes.ERROR_BLUETOOTH_NOT_ALLOWED;
@@ -3767,7 +3908,8 @@
                 ParcelUuid uuid, AttributionSource attributionSource) {
             AdapterService service = getService();
             if (service == null
-                    || !Utils.checkCallerIsSystemOrActiveUser(TAG)
+                    || !callerIsSystemOrActiveOrManagedUser(service,
+                            TAG, "retrievePendingSocketForServiceRecord")
                     || !Utils.checkConnectPermissionForDataDelivery(
                             service, attributionSource,
                             "AdapterService retrievePendingSocketForServiceRecord")) {
@@ -3831,7 +3973,8 @@
         return mAdapterProperties.getName().length();
     }
 
-    private static boolean isValidIoCapability(int capability) {
+    @VisibleForTesting
+    static boolean isValidIoCapability(int capability) {
         if (capability < 0 || capability >= BluetoothAdapter.IO_CAPABILITY_MAX) {
             Log.e(TAG, "Invalid IO capability value - " + capability);
             return false;
@@ -3999,15 +4142,31 @@
         if (mOobDataCallbackQueue.peek() != null) {
             try {
                 callback.onError(BluetoothStatusCodes.ERROR_ANOTHER_ACTIVE_OOB_REQUEST);
-                return;
             } catch (RemoteException e) {
                 Log.e(TAG, "Failed to make callback", e);
             }
+            return;
         }
         mOobDataCallbackQueue.offer(callback);
+        mHandler.postDelayed(() -> removeFromOobDataCallbackQueue(callback),
+                GENERATE_LOCAL_OOB_DATA_TIMEOUT.toMillis());
         generateLocalOobDataNative(transport);
     }
 
+    private synchronized void removeFromOobDataCallbackQueue(IBluetoothOobDataCallback callback) {
+        if (callback == null) {
+            return;
+        }
+
+        if (mOobDataCallbackQueue.peek() == callback) {
+            try {
+                mOobDataCallbackQueue.poll().onError(BluetoothStatusCodes.ERROR_UNKNOWN);
+            } catch (RemoteException e) {
+                Log.e(TAG, "Failed to make OobDataCallback to remove callback from queue", e);
+            }
+        }
+    }
+
     /* package */ synchronized void notifyOobDataCallback(int transport, OobData oobData) {
         if (mOobDataCallbackQueue.peek() == null) {
             Log.e(TAG, "Failed to make callback, no callback exists");
@@ -4215,8 +4374,8 @@
                 Log.e(TAG, "getActiveDevices: LeAudioService is null");
                 } else {
                     activeDevices = mLeAudioService.getActiveDevices();
-                    Log.i(TAG, "getActiveDevices: LeAudio devices: Out["
-                            + activeDevices.get(0) + "] - In[" + activeDevices.get(1) + "]");
+                    Log.i(TAG, "getActiveDevices: LeAudio devices: Lead["
+                            + activeDevices.get(0) + "] - member_1[" + activeDevices.get(1) + "]");
                 }
                 break;
             default:
@@ -4369,95 +4528,131 @@
             return BluetoothStatusCodes.ERROR_BLUETOOTH_NOT_ENABLED;
         }
 
-        if (mA2dpService != null && mA2dpService.getConnectionState(device)
-                == BluetoothProfile.STATE_CONNECTED) {
+        if (mA2dpService != null && (mA2dpService.getConnectionState(device)
+                == BluetoothProfile.STATE_CONNECTED
+                || mA2dpService.getConnectionState(device)
+                == BluetoothProfile.STATE_CONNECTING)) {
             Log.i(TAG, "disconnectAllEnabledProfiles: Disconnecting A2dp");
             mA2dpService.disconnect(device);
         }
-        if (mA2dpSinkService != null && mA2dpSinkService.getConnectionState(device)
-                == BluetoothProfile.STATE_CONNECTED) {
+        if (mA2dpSinkService != null && (mA2dpSinkService.getConnectionState(device)
+                == BluetoothProfile.STATE_CONNECTED
+                || mA2dpSinkService.getConnectionState(device)
+                == BluetoothProfile.STATE_CONNECTING)) {
             Log.i(TAG, "disconnectAllEnabledProfiles: Disconnecting A2dp Sink");
             mA2dpSinkService.disconnect(device);
         }
-        if (mHeadsetService != null && mHeadsetService.getConnectionState(device)
-                == BluetoothProfile.STATE_CONNECTED) {
+        if (mHeadsetService != null && (mHeadsetService.getConnectionState(device)
+                == BluetoothProfile.STATE_CONNECTED
+                ||  mHeadsetService.getConnectionState(device)
+                == BluetoothProfile.STATE_CONNECTING)) {
             Log.i(TAG,
                     "disconnectAllEnabledProfiles: Disconnecting Headset Profile");
             mHeadsetService.disconnect(device);
         }
-        if (mHeadsetClientService != null && mHeadsetClientService.getConnectionState(device)
-                == BluetoothProfile.STATE_CONNECTED) {
+        if (mHeadsetClientService != null && (mHeadsetClientService.getConnectionState(device)
+                == BluetoothProfile.STATE_CONNECTED
+                || mHeadsetClientService.getConnectionState(device)
+                == BluetoothProfile.STATE_CONNECTING)) {
             Log.i(TAG, "disconnectAllEnabledProfiles: Disconnecting HFP");
             mHeadsetClientService.disconnect(device);
         }
-        if (mMapClientService != null && mMapClientService.getConnectionState(device)
-                == BluetoothProfile.STATE_CONNECTED) {
+        if (mMapClientService != null && (mMapClientService.getConnectionState(device)
+                == BluetoothProfile.STATE_CONNECTED
+                || mMapClientService.getConnectionState(device)
+                == BluetoothProfile.STATE_CONNECTING)) {
             Log.i(TAG, "disconnectAllEnabledProfiles: Disconnecting MAP Client");
             mMapClientService.disconnect(device);
         }
-        if (mMapService != null && mMapService.getConnectionState(device)
-                == BluetoothProfile.STATE_CONNECTED) {
+        if (mMapService != null && (mMapService.getConnectionState(device)
+                == BluetoothProfile.STATE_CONNECTED
+                || mMapService.getConnectionState(device)
+                == BluetoothProfile.STATE_CONNECTING)) {
             Log.i(TAG, "disconnectAllEnabledProfiles: Disconnecting MAP");
             mMapService.disconnect(device);
         }
-        if (mHidDeviceService != null && mHidDeviceService.getConnectionState(device)
-                == BluetoothProfile.STATE_CONNECTED) {
+        if (mHidDeviceService != null && (mHidDeviceService.getConnectionState(device)
+                == BluetoothProfile.STATE_CONNECTED
+                || mHidDeviceService.getConnectionState(device)
+                == BluetoothProfile.STATE_CONNECTING)) {
             Log.i(TAG, "disconnectAllEnabledProfiles: Disconnecting Hid Device Profile");
             mHidDeviceService.disconnect(device);
         }
-        if (mHidHostService != null && mHidHostService.getConnectionState(device)
-                == BluetoothProfile.STATE_CONNECTED) {
+        if (mHidHostService != null && (mHidHostService.getConnectionState(device)
+                == BluetoothProfile.STATE_CONNECTED
+                || mHidHostService.getConnectionState(device)
+                == BluetoothProfile.STATE_CONNECTING)) {
             Log.i(TAG, "disconnectAllEnabledProfiles: Disconnecting Hid Host Profile");
             mHidHostService.disconnect(device);
         }
-        if (mPanService != null && mPanService.getConnectionState(device)
-                == BluetoothProfile.STATE_CONNECTED) {
+        if (mPanService != null && (mPanService.getConnectionState(device)
+                == BluetoothProfile.STATE_CONNECTED
+                || mPanService.getConnectionState(device)
+                == BluetoothProfile.STATE_CONNECTING)) {
             Log.i(TAG, "disconnectAllEnabledProfiles: Disconnecting Pan Profile");
             mPanService.disconnect(device);
         }
-        if (mPbapClientService != null && mPbapClientService.getConnectionState(device)
-                == BluetoothProfile.STATE_CONNECTED) {
+        if (mPbapClientService != null && (mPbapClientService.getConnectionState(device)
+                == BluetoothProfile.STATE_CONNECTED
+                || mPbapClientService.getConnectionState(device)
+                == BluetoothProfile.STATE_CONNECTING)) {
             Log.i(TAG, "disconnectAllEnabledProfiles: Disconnecting Pbap Client");
             mPbapClientService.disconnect(device);
         }
-        if (mPbapService != null && mPbapService.getConnectionState(device)
-                == BluetoothProfile.STATE_CONNECTED) {
+        if (mPbapService != null && (mPbapService.getConnectionState(device)
+                == BluetoothProfile.STATE_CONNECTED
+                || mPbapService.getConnectionState(device)
+                == BluetoothProfile.STATE_CONNECTING)) {
             Log.i(TAG, "disconnectAllEnabledProfiles: Disconnecting Pbap Server");
             mPbapService.disconnect(device);
         }
-        if (mHearingAidService != null && mHearingAidService.getConnectionState(device)
-                == BluetoothProfile.STATE_CONNECTED) {
+        if (mHearingAidService != null && (mHearingAidService.getConnectionState(device)
+                == BluetoothProfile.STATE_CONNECTED
+                || mHearingAidService.getConnectionState(device)
+                == BluetoothProfile.STATE_CONNECTING)) {
             Log.i(TAG, "disconnectAllEnabledProfiles: Disconnecting Hearing Aid Profile");
             mHearingAidService.disconnect(device);
         }
-        if (mHapClientService != null && mHapClientService.getConnectionState(device)
-                == BluetoothProfile.STATE_CONNECTED) {
+        if (mHapClientService != null && (mHapClientService.getConnectionState(device)
+                == BluetoothProfile.STATE_CONNECTED
+                || mHapClientService.getConnectionState(device)
+                == BluetoothProfile.STATE_CONNECTING)) {
             Log.i(TAG, "disconnectAllEnabledProfiles: Disconnecting Hearing Access Profile Client");
             mHapClientService.disconnect(device);
         }
-        if (mVolumeControlService != null && mVolumeControlService.getConnectionState(device)
-                == BluetoothProfile.STATE_CONNECTED) {
+        if (mVolumeControlService != null && (mVolumeControlService.getConnectionState(device)
+                == BluetoothProfile.STATE_CONNECTED
+                || mVolumeControlService.getConnectionState(device)
+                == BluetoothProfile.STATE_CONNECTING)) {
             Log.i(TAG, "disconnectAllEnabledProfiles: Disconnecting Volume Control Profile");
             mVolumeControlService.disconnect(device);
         }
-        if (mSapService != null && mSapService.getConnectionState(device)
-                == BluetoothProfile.STATE_CONNECTED) {
+        if (mSapService != null && (mSapService.getConnectionState(device)
+                == BluetoothProfile.STATE_CONNECTED
+                || mSapService.getConnectionState(device)
+                == BluetoothProfile.STATE_CONNECTING)) {
             Log.i(TAG, "disconnectAllEnabledProfiles: Disconnecting Sap Profile");
             mSapService.disconnect(device);
         }
         if (mCsipSetCoordinatorService != null
-                && mCsipSetCoordinatorService.getConnectionState(device)
-                        == BluetoothProfile.STATE_CONNECTED) {
+                && (mCsipSetCoordinatorService.getConnectionState(device)
+                == BluetoothProfile.STATE_CONNECTED
+                || mCsipSetCoordinatorService.getConnectionState(device)
+                == BluetoothProfile.STATE_CONNECTING)) {
             Log.i(TAG, "disconnectAllEnabledProfiles: Disconnecting Coordinater Set Profile");
             mCsipSetCoordinatorService.disconnect(device);
         }
-        if (mLeAudioService != null && mLeAudioService.getConnectionState(device)
-                == BluetoothProfile.STATE_CONNECTED) {
+        if (mLeAudioService != null && (mLeAudioService.getConnectionState(device)
+                == BluetoothProfile.STATE_CONNECTED
+                || mLeAudioService.getConnectionState(device)
+                == BluetoothProfile.STATE_CONNECTING)) {
             Log.i(TAG, "disconnectAllEnabledProfiles: Disconnecting LeAudio profile (BAP)");
             mLeAudioService.disconnect(device);
         }
-        if (mBassClientService != null && mBassClientService.getConnectionState(device)
-                == BluetoothProfile.STATE_CONNECTED) {
+        if (mBassClientService != null && (mBassClientService.getConnectionState(device)
+                == BluetoothProfile.STATE_CONNECTED
+                || mBassClientService.getConnectionState(device)
+                == BluetoothProfile.STATE_CONNECTING)) {
             Log.i(TAG, "disconnectAllEnabledProfiles: Disconnecting "
                             + "LE Broadcast Assistant Profile");
             mBassClientService.disconnect(device);
@@ -4560,6 +4755,8 @@
                 return BluetoothStatusCodes.ERROR_DISCONNECT_REASON_BAD_PARAMETERS;
             case /*HCI_ERR_PEER_USER*/ 0x13:
                 return BluetoothStatusCodes.ERROR_DISCONNECT_REASON_REMOTE_REQUEST;
+            case /*HCI_ERR_REMOTE_POWER_OFF*/ 0x15:
+                return BluetoothStatusCodes.ERROR_DISCONNECT_REASON_REMOTE_REQUEST;
             case /*HCI_ERR_CONN_CAUSE_LOCAL_HOST*/ 0x16:
                 return BluetoothStatusCodes.ERROR_DISCONNECT_REASON_LOCAL_REQUEST;
             case /*HCI_ERR_UNSUPPORTED_REM_FEATURE*/ 0x1A:
@@ -4656,8 +4853,7 @@
      * @return true, if the LE audio broadcast source is supported
      */
     public boolean isLeAudioBroadcastSourceSupported() {
-        return  BluetoothProperties.isProfileBapBroadcastSourceEnabled().orElse(false)
-                && mAdapterProperties.isLePeriodicAdvertisingSupported()
+        return  mAdapterProperties.isLePeriodicAdvertisingSupported()
                 && mAdapterProperties.isLeExtendedAdvertisingSupported()
                 && mAdapterProperties.isLeIsochronousBroadcasterSupported();
     }
@@ -4674,6 +4870,10 @@
                 || mAdapterProperties.isLePeriodicAdvertisingSyncTransferRecipientSupported());
     }
 
+    public long getSupportedProfilesBitMask() {
+        return Config.getSupportedProfilesBitMask();
+    }
+
     /**
      * Check if the LE audio CIS central feature is supported.
      *
@@ -4705,7 +4905,8 @@
         return mAdapterProperties.isA2dpOffloadEnabled();
     }
 
-    private BluetoothActivityEnergyInfo reportActivityInfo() {
+    @VisibleForTesting
+    BluetoothActivityEnergyInfo reportActivityInfo() {
         if (mAdapterProperties.getState() != BluetoothAdapter.STATE_ON
                 || !mAdapterProperties.isActivityAndEnergyReportingSupported()) {
             return null;
@@ -4767,7 +4968,7 @@
                 source.getUid(), source.getPackageName(), deviceAddress);
     }
 
-    private static int convertScanModeToHal(int mode) {
+    static int convertScanModeToHal(int mode) {
         switch (mode) {
             case BluetoothAdapter.SCAN_MODE_NONE:
                 return AbstractionLayer.BT_SCAN_MODE_NONE;
@@ -4921,6 +5122,12 @@
     @VisibleForTesting
     public void metadataChanged(String address, int key, byte[] value) {
         BluetoothDevice device = mRemoteDevices.getDevice(Utils.getBytesFromAddress(address));
+
+        // pass just interesting metadata to native, to reduce spam
+        if (key == BluetoothDevice.METADATA_LE_AUDIO) {
+            metadataChangedNative(Utils.getBytesFromAddress(address), key, value);
+        }
+
         if (mMetadataListeners.containsKey(device)) {
             ArrayList<IBluetoothMetadataListener> list = mMetadataListeners.get(device);
             for (IBluetoothMetadataListener listener : list) {
@@ -5069,100 +5276,16 @@
         }
     }
 
-    // Boolean flags
-    private static final String GD_CORE_FLAG = "INIT_gd_core";
-    private static final String GD_ADVERTISING_FLAG = "INIT_gd_advertising";
-    private static final String GD_SCANNING_FLAG = "INIT_gd_scanning";
-    private static final String GD_HCI_FLAG = "INIT_gd_hci";
-    private static final String GD_CONTROLLER_FLAG = "INIT_gd_controller";
-    private static final String GD_ACL_FLAG = "INIT_gd_acl";
-    private static final String GD_L2CAP_FLAG = "INIT_gd_l2cap";
-    private static final String GD_RUST_FLAG = "INIT_gd_rust";
-    private static final String GD_LINK_POLICY_FLAG = "INIT_gd_link_policy";
-    private static final String GATT_ROBUST_CACHING_CLIENT_FLAG = "INIT_gatt_robust_caching_client";
-    private static final String GATT_ROBUST_CACHING_SERVER_FLAG = "INIT_gatt_robust_caching_server";
-    private static final String IRK_ROTATION_FLAG = "INIT_irk_rotation";
-
-    /**
-     * Logging flags logic (only applies to DEBUG and VERBOSE levels):
-     * if LOG_TAG in LOGGING_DEBUG_DISABLED_FOR_TAGS_FLAG:
-     *   DO NOT LOG
-     * else if LOG_TAG in LOGGING_DEBUG_ENABLED_FOR_TAGS_FLAG:
-     *   DO LOG
-     * else if LOGGING_DEBUG_ENABLED_FOR_ALL_FLAG:
-     *   DO LOG
-     * else:
-     *   DO NOT LOG
-     */
-    private static final String LOGGING_DEBUG_ENABLED_FOR_ALL_FLAG =
-            "INIT_logging_debug_enabled_for_all";
-    // String flags
-    // Comma separated tags
-    private static final String LOGGING_DEBUG_ENABLED_FOR_TAGS_FLAG =
-            "INIT_logging_debug_enabled_for_tags";
-    private static final String LOGGING_DEBUG_DISABLED_FOR_TAGS_FLAG =
-            "INIT_logging_debug_disabled_for_tags";
-    private static final String BTAA_HCI_LOG_FLAG = "INIT_btaa_hci";
-
+    @RequiresPermission(android.Manifest.permission.READ_DEVICE_CONFIG)
     private String[] getInitFlags() {
+        final DeviceConfig.Properties properties =
+                DeviceConfig.getProperties(DeviceConfig.NAMESPACE_BLUETOOTH);
         ArrayList<String> initFlags = new ArrayList<>();
-        if (DeviceConfig.getBoolean(DeviceConfig.NAMESPACE_BLUETOOTH, GD_CORE_FLAG, false)) {
-            initFlags.add(String.format("%s=%s", GD_CORE_FLAG, "true"));
-        }
-        if (DeviceConfig.getBoolean(DeviceConfig.NAMESPACE_BLUETOOTH, GD_ADVERTISING_FLAG, false)) {
-            initFlags.add(String.format("%s=%s", GD_ADVERTISING_FLAG, "true"));
-        }
-        if (DeviceConfig.getBoolean(DeviceConfig.NAMESPACE_BLUETOOTH, GD_SCANNING_FLAG,
-                Config.isGdEnabledUpToScanningLayer())) {
-            initFlags.add(String.format("%s=%s", GD_SCANNING_FLAG, "true"));
-        }
-        if (DeviceConfig.getBoolean(DeviceConfig.NAMESPACE_BLUETOOTH, GD_HCI_FLAG, false)) {
-            initFlags.add(String.format("%s=%s", GD_HCI_FLAG, "true"));
-        }
-        if (DeviceConfig.getBoolean(DeviceConfig.NAMESPACE_BLUETOOTH, GD_CONTROLLER_FLAG, false)) {
-            initFlags.add(String.format("%s=%s", GD_CONTROLLER_FLAG, "true"));
-        }
-        if (DeviceConfig.getBoolean(DeviceConfig.NAMESPACE_BLUETOOTH, GD_ACL_FLAG, false)) {
-            initFlags.add(String.format("%s=%s", GD_ACL_FLAG, "true"));
-        }
-        if (DeviceConfig.getBoolean(DeviceConfig.NAMESPACE_BLUETOOTH, GD_L2CAP_FLAG, false)) {
-            initFlags.add(String.format("%s=%s", GD_L2CAP_FLAG, "true"));
-        }
-        if (DeviceConfig.getBoolean(DeviceConfig.NAMESPACE_BLUETOOTH, GD_RUST_FLAG, false)) {
-            initFlags.add(String.format("%s=%s", GD_RUST_FLAG, "true"));
-        }
-        if (DeviceConfig.getBoolean(DeviceConfig.NAMESPACE_BLUETOOTH, GD_LINK_POLICY_FLAG, false)) {
-            initFlags.add(String.format("%s=%s", GD_LINK_POLICY_FLAG, "true"));
-        }
-        if (DeviceConfig.getBoolean(DeviceConfig.NAMESPACE_BLUETOOTH,
-                GATT_ROBUST_CACHING_CLIENT_FLAG, false)) {
-            initFlags.add(String.format("%s=%s", GATT_ROBUST_CACHING_CLIENT_FLAG, "true"));
-        }
-        if (DeviceConfig.getBoolean(DeviceConfig.NAMESPACE_BLUETOOTH,
-                GATT_ROBUST_CACHING_SERVER_FLAG, false)) {
-            initFlags.add(String.format("%s=%s", GATT_ROBUST_CACHING_SERVER_FLAG, "true"));
-        }
-        if (DeviceConfig.getBoolean(DeviceConfig.NAMESPACE_BLUETOOTH, IRK_ROTATION_FLAG, false)) {
-            initFlags.add(String.format("%s=%s", IRK_ROTATION_FLAG, "true"));
-        }
-        if (DeviceConfig.getBoolean(DeviceConfig.NAMESPACE_BLUETOOTH,
-                LOGGING_DEBUG_ENABLED_FOR_ALL_FLAG, false)) {
-            initFlags.add(String.format("%s=%s", LOGGING_DEBUG_ENABLED_FOR_ALL_FLAG, "true"));
-        }
-        String debugLoggingEnabledTags = DeviceConfig.getString(DeviceConfig.NAMESPACE_BLUETOOTH,
-                LOGGING_DEBUG_ENABLED_FOR_TAGS_FLAG, "");
-        if (!debugLoggingEnabledTags.isEmpty()) {
-            initFlags.add(String.format("%s=%s", LOGGING_DEBUG_ENABLED_FOR_TAGS_FLAG,
-                    debugLoggingEnabledTags));
-        }
-        String debugLoggingDisabledTags = DeviceConfig.getString(DeviceConfig.NAMESPACE_BLUETOOTH,
-                LOGGING_DEBUG_DISABLED_FOR_TAGS_FLAG, "");
-        if (!debugLoggingDisabledTags.isEmpty()) {
-            initFlags.add(String.format("%s=%s", LOGGING_DEBUG_DISABLED_FOR_TAGS_FLAG,
-                    debugLoggingDisabledTags));
-        }
-        if (DeviceConfig.getBoolean(DeviceConfig.NAMESPACE_BLUETOOTH, BTAA_HCI_LOG_FLAG, true)) {
-            initFlags.add(String.format("%s=%s", BTAA_HCI_LOG_FLAG, "true"));
+        for (String property: properties.getKeyset()) {
+            if (property.startsWith("INIT_")) {
+                initFlags.add(String.format("%s=%s", property,
+                            properties.getString(property, null)));
+            }
         }
         return initFlags.toArray(new String[0]);
     }
@@ -5230,33 +5353,30 @@
         }
     }
 
-    public static int getScanQuotaCount() {
-        if (sAdapterService == null) {
-            return DeviceConfigListener.DEFAULT_SCAN_QUOTA_COUNT;
-        }
-
-        synchronized (sAdapterService.mDeviceConfigLock) {
-            return sAdapterService.mScanQuotaCount;
+    /**
+     * Returns scan quota count.
+     */
+    public int getScanQuotaCount() {
+        synchronized (mDeviceConfigLock) {
+            return mScanQuotaCount;
         }
     }
 
-    public static long getScanQuotaWindowMillis() {
-        if (sAdapterService == null) {
-            return DeviceConfigListener.DEFAULT_SCAN_QUOTA_WINDOW_MILLIS;
-        }
-
-        synchronized (sAdapterService.mDeviceConfigLock) {
-            return sAdapterService.mScanQuotaWindowMillis;
+    /**
+     * Returns scan quota window in millis.
+     */
+    public long getScanQuotaWindowMillis() {
+        synchronized (mDeviceConfigLock) {
+            return mScanQuotaWindowMillis;
         }
     }
 
-    public static long getScanTimeoutMillis() {
-        if (sAdapterService == null) {
-            return DeviceConfigListener.DEFAULT_SCAN_TIMEOUT_MILLIS;
-        }
-
-        synchronized (sAdapterService.mDeviceConfigLock) {
-            return sAdapterService.mScanTimeoutMillis;
+    /**
+     * Returns scan timeout in millis.
+     */
+    public long getScanTimeoutMillis() {
+        synchronized (mDeviceConfigLock) {
+            return mScanTimeoutMillis;
         }
     }
 
@@ -5443,6 +5563,84 @@
         return getMetricIdNative(Utils.getByteAddress(device));
     }
 
+    public CompanionManager getCompanionManager() {
+        return mBtCompanionManager;
+    }
+
+    /**
+     *  Call for the AdapterService receives bond state change
+     *
+     *  @param device Bluetooth device
+     *  @param state bond state
+     */
+    public void onBondStateChanged(BluetoothDevice device, int state) {
+        if (mBtCompanionManager != null) {
+            mBtCompanionManager.onBondStateChanged(device, state);
+        }
+    }
+
+    /**
+     * Get audio policy feature support status
+     *
+     * @param device Bluetooth device to be checked for audio policy support
+     * @return int status of the remote support for audio policy feature
+     */
+    public int isRequestAudioPolicyAsSinkSupported(BluetoothDevice device) {
+        if (mHeadsetClientService != null) {
+            return mHeadsetClientService.getAudioPolicyRemoteSupported(device);
+        } else {
+            Log.e(TAG, "No audio transport connected");
+            return BluetoothStatusCodes.FEATURE_NOT_CONFIGURED;
+        }
+    }
+
+    /**
+     * Set audio policy for remote device
+     *
+     * @param device Bluetooth device to be set policy for
+     * @return int result status for requestAudioPolicyAsSink API
+     */
+    public int requestAudioPolicyAsSink(BluetoothDevice device, BluetoothSinkAudioPolicy policies) {
+        DeviceProperties deviceProp = mRemoteDevices.getDeviceProperties(device);
+        if (deviceProp == null) {
+            return BluetoothStatusCodes.ERROR_DEVICE_NOT_BONDED;
+        }
+
+        if (mHeadsetClientService != null) {
+            if (isRequestAudioPolicyAsSinkSupported(device)
+                    != BluetoothStatusCodes.FEATURE_SUPPORTED) {
+                throw new UnsupportedOperationException(
+                        "Request Audio Policy As Sink not supported");
+            }
+            deviceProp.setHfAudioPolicyForRemoteAg(policies);
+            mHeadsetClientService.setAudioPolicy(device, policies);
+            return BluetoothStatusCodes.SUCCESS;
+        } else {
+            Log.e(TAG, "HeadsetClient not connected");
+            return BluetoothStatusCodes.ERROR_PROFILE_NOT_CONNECTED;
+        }
+    }
+
+    /**
+     * Get audio policy for remote device
+     *
+     * @param device Bluetooth device to be set policy for
+     * @return {@link BluetoothSinkAudioPolicy} policy stored for the device
+     */
+    public BluetoothSinkAudioPolicy getRequestedAudioPolicyAsSink(BluetoothDevice device) {
+        DeviceProperties deviceProp = mRemoteDevices.getDeviceProperties(device);
+        if (deviceProp == null) {
+            return null;
+        }
+
+        if (mHeadsetClientService != null) {
+            return deviceProp.getHfAudioPolicyForRemoteAg();
+        } else {
+            Log.e(TAG, "HeadsetClient not connected");
+            return null;
+        }
+    }
+
     /**
      *  Allow audio low latency
      *
@@ -5556,6 +5754,8 @@
 
     private native boolean allowLowLatencyAudioNative(boolean allowed, byte[] address);
 
+    private native void metadataChangedNative(byte[] address, int key, byte[] value);
+
     // Returns if this is a mock object. This is currently used in testing so that we may not call
     // System.exit() while finalizing the object. Otherwise GC of mock objects unfortunately ends up
     // calling finalize() which in turn calls System.exit() and the process crashes.
diff --git a/android/app/src/com/android/bluetooth/btservice/BluetoothAdapterProxy.java b/android/app/src/com/android/bluetooth/btservice/BluetoothAdapterProxy.java
new file mode 100644
index 0000000..4376097
--- /dev/null
+++ b/android/app/src/com/android/bluetooth/btservice/BluetoothAdapterProxy.java
@@ -0,0 +1,75 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package com.android.bluetooth.btservice;
+
+import android.bluetooth.BluetoothAdapter;
+import android.util.Log;
+
+import com.android.bluetooth.Utils;
+import com.android.internal.annotations.VisibleForTesting;
+
+/**
+ * A proxy class that facilitates testing of the ScanManager.
+ *
+ * This is necessary due to the "final" attribute of the BluetoothAdapter class. In order to
+ * test the correct functioning of the ScanManager class, the final class must be put
+ * into a container that can be mocked correctly.
+ */
+public class BluetoothAdapterProxy {
+    private static final String TAG = BluetoothAdapterProxy.class.getSimpleName();
+    private static BluetoothAdapterProxy sInstance;
+    private static final Object INSTANCE_LOCK = new Object();
+
+    private BluetoothAdapterProxy() {}
+
+    /**
+     * Get the singleton instance of proxy.
+     *
+     * @return the singleton instance, guaranteed not null
+     */
+    public static BluetoothAdapterProxy getInstance() {
+        synchronized (INSTANCE_LOCK) {
+            if (sInstance == null) {
+                sInstance = new BluetoothAdapterProxy();
+            }
+            return sInstance;
+        }
+    }
+
+    /**
+     * Proxy function that calls {@link BluetoothAdapter#isOffloadedFilteringSupported()}.
+     *
+     * @return whether the offloaded scan filtering is supported
+     */
+    public boolean isOffloadedScanFilteringSupported() {
+        BluetoothAdapter adapter = BluetoothAdapter.getDefaultAdapter();
+        return adapter.isOffloadedFilteringSupported();
+    }
+
+    /**
+     * Allow unit tests to substitute BluetoothAdapterProxy with a test instance
+     *
+     * @param proxy a test instance of the BluetoothAdapterProxy
+     */
+    @VisibleForTesting
+    public static void setInstanceForTesting(BluetoothAdapterProxy proxy) {
+        Utils.enforceInstrumentationTestMode();
+        synchronized (INSTANCE_LOCK) {
+            Log.d(TAG, "setInstanceForTesting(), set to " + proxy);
+            sInstance = proxy;
+        }
+    }
+}
diff --git a/android/app/src/com/android/bluetooth/btservice/BluetoothSocketManagerBinder.java b/android/app/src/com/android/bluetooth/btservice/BluetoothSocketManagerBinder.java
index 2187a91..13a9f4c 100644
--- a/android/app/src/com/android/bluetooth/btservice/BluetoothSocketManagerBinder.java
+++ b/android/app/src/com/android/bluetooth/btservice/BluetoothSocketManagerBinder.java
@@ -17,6 +17,7 @@
 package com.android.bluetooth.btservice;
 
 import android.bluetooth.BluetoothDevice;
+import android.bluetooth.BluetoothSocket;
 import android.bluetooth.IBluetoothSocketManager;
 import android.os.Binder;
 import android.os.ParcelFileDescriptor;
@@ -49,13 +50,17 @@
             return null;
         }
 
-        return marshalFd(mService.connectSocketNative(
-            Utils.getBytesFromAddress(device.getAddress()),
-            type,
-            Utils.uuidToByteArray(uuid),
-            port,
-            flag,
-            Binder.getCallingUid()));
+        return marshalFd(
+                mService.connectSocketNative(
+                        Utils.getBytesFromAddress(
+                                type == BluetoothSocket.TYPE_L2CAP_LE
+                                        ? device.getAddress()
+                                        : mService.getIdentityAddress(device.getAddress())),
+                        type,
+                        Utils.uuidToByteArray(uuid),
+                        port,
+                        flag,
+                        Binder.getCallingUid()));
     }
 
     @Override
diff --git a/android/app/src/com/android/bluetooth/btservice/BondStateMachine.java b/android/app/src/com/android/bluetooth/btservice/BondStateMachine.java
index d62d7ba..c6633da 100644
--- a/android/app/src/com/android/bluetooth/btservice/BondStateMachine.java
+++ b/android/app/src/com/android/bluetooth/btservice/BondStateMachine.java
@@ -28,6 +28,7 @@
 import android.bluetooth.OobData;
 import android.content.Intent;
 import android.os.Build;
+import android.os.Bundle;
 import android.os.Message;
 import android.os.UserHandle;
 import android.util.Log;
@@ -48,6 +49,7 @@
 import java.util.ArrayList;
 import java.util.HashSet;
 import java.util.Objects;
+import java.util.Optional;
 import java.util.Set;
 
 /**
@@ -86,6 +88,7 @@
 
     public static final String OOBDATAP192 = "oobdatap192";
     public static final String OOBDATAP256 = "oobdatap256";
+    public static final String DISPLAY_PASSKEY = "display_passkey";
 
     @VisibleForTesting Set<BluetoothDevice> mPendingBondedDevices = new HashSet<>();
 
@@ -249,7 +252,14 @@
                 case SSP_REQUEST:
                     int passkey = msg.arg1;
                     int variant = msg.arg2;
-                    sendDisplayPinIntent(devProp.getAddress(), passkey, variant);
+                    boolean displayPasskey =
+                            (msg.getData() != null)
+                                    ? msg.getData().getByte(DISPLAY_PASSKEY) == 1 /* 1 == true */
+                                    : false;
+                    sendDisplayPinIntent(
+                            devProp.getAddress(),
+                            displayPasskey ? Optional.of(passkey) : Optional.empty(),
+                            variant);
                     break;
                 case PIN_REQUEST:
                     BluetoothClass btClass = dev.getBluetoothClass();
@@ -264,18 +274,24 @@
                         // Generate a variable 6-digit PIN in range of 100000-999999
                         // This is not truly random but good enough.
                         int pin = 100000 + (int) Math.floor((Math.random() * (999999 - 100000)));
-                        sendDisplayPinIntent(devProp.getAddress(), pin,
+                        sendDisplayPinIntent(
+                                devProp.getAddress(),
+                                Optional.of(pin),
                                 BluetoothDevice.PAIRING_VARIANT_DISPLAY_PIN);
                         break;
                     }
 
                     if (msg.arg2 == 1) { // Minimum 16 digit pin required here
-                        sendDisplayPinIntent(devProp.getAddress(), 0,
+                        sendDisplayPinIntent(
+                                devProp.getAddress(),
+                                Optional.empty(),
                                 BluetoothDevice.PAIRING_VARIANT_PIN_16_DIGITS);
                     } else {
                         // In PIN_REQUEST, there is no passkey to display.So do not send the
-                        // EXTRA_PAIRING_KEY type in the intent( 0 in SendDisplayPinIntent() )
-                        sendDisplayPinIntent(devProp.getAddress(), 0,
+                        // EXTRA_PAIRING_KEY type in the intent
+                        sendDisplayPinIntent(
+                                devProp.getAddress(),
+                                Optional.empty(),
                                 BluetoothDevice.PAIRING_VARIANT_PIN);
                     }
                     break;
@@ -326,9 +342,19 @@
             boolean result;
             // If we have some data
             if (remoteP192Data != null || remoteP256Data != null) {
+                BluetoothStatsLog.write(BluetoothStatsLog.BLUETOOTH_BOND_STATE_CHANGED,
+                      mAdapterService.obfuscateAddress(dev), transport, dev.getType(),
+                      BluetoothDevice.BOND_BONDING,
+                      BluetoothProtoEnums.BOND_SUB_STATE_LOCAL_START_PAIRING_OOB,
+                      BluetoothProtoEnums.UNBOND_REASON_UNKNOWN, mAdapterService.getMetricId(dev));
                 result = mAdapterService.createBondOutOfBandNative(addr, transport,
                     remoteP192Data, remoteP256Data);
             } else {
+                BluetoothStatsLog.write(BluetoothStatsLog.BLUETOOTH_BOND_STATE_CHANGED,
+                      mAdapterService.obfuscateAddress(dev), transport, dev.getType(),
+                      BluetoothDevice.BOND_BONDING,
+                      BluetoothProtoEnums.BOND_SUB_STATE_LOCAL_START_PAIRING,
+                      BluetoothProtoEnums.UNBOND_REASON_UNKNOWN, mAdapterService.getMetricId(dev));
                 result = mAdapterService.createBondNative(addr, transport);
             }
             BluetoothStatsLog.write(BluetoothStatsLog.BLUETOOTH_DEVICE_NAME_REPORTED,
@@ -358,12 +384,10 @@
         return false;
     }
 
-    private void sendDisplayPinIntent(byte[] address, int pin, int variant) {
+    private void sendDisplayPinIntent(byte[] address, Optional<Integer> maybePin, int variant) {
         Intent intent = new Intent(BluetoothDevice.ACTION_PAIRING_REQUEST);
         intent.putExtra(BluetoothDevice.EXTRA_DEVICE, mRemoteDevices.getDevice(address));
-        if (pin != 0) {
-            intent.putExtra(BluetoothDevice.EXTRA_PAIRING_KEY, pin);
-        }
+        maybePin.ifPresent(pin -> intent.putExtra(BluetoothDevice.EXTRA_PAIRING_KEY, pin));
         intent.putExtra(BluetoothDevice.EXTRA_PAIRING_VARIANT, variant);
         intent.setFlags(Intent.FLAG_RECEIVER_FOREGROUND);
         // Workaround for Android Auto until pre-accepting pairing requests is added.
@@ -446,6 +470,7 @@
         if (newState == BluetoothDevice.BOND_NONE) {
             intent.putExtra(BluetoothDevice.EXTRA_UNBOND_REASON, reason);
         }
+        mAdapterService.onBondStateChanged(device, newState);
         mAdapterService.sendBroadcastAsUser(intent, UserHandle.ALL, BLUETOOTH_CONNECT,
                 Utils.getTempAllowlistBroadcastOptions());
         infoLog("Bond State Change Intent:" + device + " " + state2str(oldState) + " => "
@@ -531,6 +556,9 @@
         msg.obj = device;
         if (displayPasskey) {
             msg.arg1 = passkey;
+            Bundle bundle = new Bundle();
+            bundle.putByte(BondStateMachine.DISPLAY_PASSKEY, (byte) 1 /* true */);
+            msg.setData(bundle);
         }
         msg.arg2 = variant;
         sendMessage(msg);
diff --git a/android/app/src/com/android/bluetooth/btservice/CompanionManager.java b/android/app/src/com/android/bluetooth/btservice/CompanionManager.java
new file mode 100644
index 0000000..64aae78
--- /dev/null
+++ b/android/app/src/com/android/bluetooth/btservice/CompanionManager.java
@@ -0,0 +1,403 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.btservice;
+
+import android.bluetooth.BluetoothAdapter;
+import android.bluetooth.BluetoothDevice;
+import android.bluetooth.BluetoothGatt;
+import android.content.Context;
+import android.content.SharedPreferences;
+import android.os.SystemProperties;
+import android.util.Log;
+
+import androidx.annotation.VisibleForTesting;
+
+import com.android.bluetooth.R;
+
+import java.util.HashSet;
+import java.util.Set;
+
+/**
+  A CompanionManager to specify parameters between companion devices and regular devices.
+
+  1.  A paired device is recognized as a companion device if its METADATA_SOFTWARE_VERSION is
+      set to BluetoothDevice.COMPANION_TYPE_PRIMARY or BluetoothDevice.COMPANION_TYPE_SECONDARY.
+  2.  Only can have one companion device at a time.
+  3.  Remove bond does not remove the companion device record.
+  4.  Factory reset Bluetooth removes the companion device.
+  5.  Companion device has individual GATT connection parameters.
+*/
+
+public class CompanionManager {
+    private static final String TAG = "BluetoothCompanionManager";
+
+    private BluetoothDevice mCompanionDevice;
+    private int mCompanionType;
+
+    private final int[] mGattConnHighPrimary;
+    private final int[] mGattConnBalancePrimary;
+    private final int[] mGattConnLowPrimary;
+    private final int[] mGattConnHighSecondary;
+    private final int[] mGattConnBalanceSecondary;
+    private final int[] mGattConnLowSecondary;
+    private final int[] mGattConnHighDefault;
+    private final int[] mGattConnBalanceDefault;
+    private final int[] mGattConnLowDefault;
+
+    @VisibleForTesting static final int COMPANION_TYPE_NONE      = 0;
+    @VisibleForTesting static final int COMPANION_TYPE_PRIMARY   = 1;
+    @VisibleForTesting static final int COMPANION_TYPE_SECONDARY = 2;
+
+    public static final int GATT_CONN_INTERVAL_MIN = 0;
+    public static final int GATT_CONN_INTERVAL_MAX = 1;
+    public static final int GATT_CONN_LATENCY      = 2;
+
+    @VisibleForTesting static final String COMPANION_INFO = "bluetooth_companion_info";
+    @VisibleForTesting static final String COMPANION_DEVICE_KEY = "companion_device";
+    @VisibleForTesting static final String COMPANION_TYPE_KEY = "companion_type";
+
+    static final String PROPERTY_HIGH_MIN_INTERVAL = "bluetooth.gatt.high_priority.min_interval";
+    static final String PROPERTY_HIGH_MAX_INTERVAL = "bluetooth.gatt.high_priority.max_interval";
+    static final String PROPERTY_HIGH_LATENCY = "bluetooth.gatt.high_priority.latency";
+    static final String PROPERTY_BALANCED_MIN_INTERVAL =
+            "bluetooth.gatt.balanced_priority.min_interval";
+    static final String PROPERTY_BALANCED_MAX_INTERVAL =
+            "bluetooth.gatt.balanced_priority.max_interval";
+    static final String PROPERTY_BALANCED_LATENCY = "bluetooth.gatt.balanced_priority.latency";
+    static final String PROPERTY_LOW_MIN_INTERVAL = "bluetooth.gatt.low_priority_min.interval";
+    static final String PROPERTY_LOW_MAX_INTERVAL = "bluetooth.gatt.low_priority_max.interval";
+    static final String PROPERTY_LOW_LATENCY = "bluetooth.gatt.low_priority.latency";
+    static final String PROPERTY_SUFFIX_PRIMARY = ".primary";
+    static final String PROPERTY_SUFFIX_SECONDARY = ".secondary";
+
+    private final AdapterService mAdapterService;
+    private final BluetoothAdapter mAdapter = BluetoothAdapter.getDefaultAdapter();
+    private final Set<BluetoothDevice> mMetadataListeningDevices = new HashSet<>();
+
+    public CompanionManager(AdapterService service, ServiceFactory factory) {
+        mAdapterService = service;
+
+        mGattConnHighDefault = new int[] {
+                getGattConfig(PROPERTY_HIGH_MIN_INTERVAL,
+                        R.integer.gatt_high_priority_min_interval),
+                getGattConfig(PROPERTY_HIGH_MAX_INTERVAL,
+                        R.integer.gatt_high_priority_max_interval),
+                getGattConfig(PROPERTY_HIGH_LATENCY,
+                        R.integer.gatt_high_priority_latency)};
+        mGattConnBalanceDefault = new int[] {
+                getGattConfig(PROPERTY_BALANCED_MIN_INTERVAL,
+                        R.integer.gatt_balanced_priority_min_interval),
+                getGattConfig(PROPERTY_BALANCED_MAX_INTERVAL,
+                        R.integer.gatt_balanced_priority_max_interval),
+                getGattConfig(PROPERTY_BALANCED_LATENCY,
+                        R.integer.gatt_balanced_priority_latency)};
+        mGattConnLowDefault = new int[] {
+                getGattConfig(PROPERTY_LOW_MIN_INTERVAL, R.integer.gatt_low_power_min_interval),
+                getGattConfig(PROPERTY_LOW_MAX_INTERVAL, R.integer.gatt_low_power_max_interval),
+                getGattConfig(PROPERTY_LOW_LATENCY, R.integer.gatt_low_power_latency)};
+
+        mGattConnHighPrimary = new int[] {
+                getGattConfig(PROPERTY_HIGH_MIN_INTERVAL + PROPERTY_SUFFIX_PRIMARY,
+                        R.integer.gatt_high_priority_min_interval_primary),
+                getGattConfig(PROPERTY_HIGH_MAX_INTERVAL + PROPERTY_SUFFIX_PRIMARY,
+                        R.integer.gatt_high_priority_max_interval_primary),
+                getGattConfig(PROPERTY_HIGH_LATENCY + PROPERTY_SUFFIX_PRIMARY,
+                        R.integer.gatt_high_priority_latency_primary)};
+        mGattConnBalancePrimary = new int[] {
+                getGattConfig(PROPERTY_BALANCED_MIN_INTERVAL + PROPERTY_SUFFIX_PRIMARY,
+                        R.integer.gatt_balanced_priority_min_interval_primary),
+                getGattConfig(PROPERTY_BALANCED_MAX_INTERVAL + PROPERTY_SUFFIX_PRIMARY,
+                        R.integer.gatt_balanced_priority_max_interval_primary),
+                getGattConfig(PROPERTY_BALANCED_LATENCY + PROPERTY_SUFFIX_PRIMARY,
+                        R.integer.gatt_balanced_priority_latency_primary)};
+        mGattConnLowPrimary = new int[] {
+                getGattConfig(PROPERTY_LOW_MIN_INTERVAL + PROPERTY_SUFFIX_PRIMARY,
+                        R.integer.gatt_low_power_min_interval_primary),
+                getGattConfig(PROPERTY_LOW_MAX_INTERVAL + PROPERTY_SUFFIX_PRIMARY,
+                        R.integer.gatt_low_power_max_interval_primary),
+                getGattConfig(PROPERTY_LOW_LATENCY + PROPERTY_SUFFIX_PRIMARY,
+                        R.integer.gatt_low_power_latency_primary)};
+
+        mGattConnHighSecondary = new int[] {
+                getGattConfig(PROPERTY_HIGH_MIN_INTERVAL + PROPERTY_SUFFIX_SECONDARY,
+                        R.integer.gatt_high_priority_min_interval_secondary),
+                getGattConfig(PROPERTY_HIGH_MAX_INTERVAL + PROPERTY_SUFFIX_SECONDARY,
+                        R.integer.gatt_high_priority_max_interval_secondary),
+                getGattConfig(PROPERTY_HIGH_LATENCY + PROPERTY_SUFFIX_SECONDARY,
+                        R.integer.gatt_high_priority_latency_secondary)};
+        mGattConnBalanceSecondary = new int[] {
+                getGattConfig(PROPERTY_BALANCED_MIN_INTERVAL + PROPERTY_SUFFIX_SECONDARY,
+                        R.integer.gatt_balanced_priority_min_interval_secondary),
+                getGattConfig(PROPERTY_BALANCED_MAX_INTERVAL + PROPERTY_SUFFIX_SECONDARY,
+                        R.integer.gatt_balanced_priority_max_interval_secondary),
+                getGattConfig(PROPERTY_BALANCED_LATENCY + PROPERTY_SUFFIX_SECONDARY,
+                        R.integer.gatt_balanced_priority_latency_secondary)};
+        mGattConnLowSecondary = new int[] {
+                getGattConfig(PROPERTY_LOW_MIN_INTERVAL + PROPERTY_SUFFIX_SECONDARY,
+                        R.integer.gatt_low_power_min_interval_secondary),
+                getGattConfig(PROPERTY_LOW_MAX_INTERVAL + PROPERTY_SUFFIX_SECONDARY,
+                        R.integer.gatt_low_power_max_interval_secondary),
+                getGattConfig(PROPERTY_LOW_LATENCY + PROPERTY_SUFFIX_SECONDARY,
+                        R.integer.gatt_low_power_latency_secondary)};
+    }
+
+    private int getGattConfig(String property, int resId) {
+        return SystemProperties.getInt(property, mAdapterService.getResources().getInteger(resId));
+    }
+
+    void loadCompanionInfo() {
+        synchronized (mMetadataListeningDevices) {
+            String address = getCompanionPreferences().getString(COMPANION_DEVICE_KEY, "");
+
+            try {
+                mCompanionDevice = mAdapter.getRemoteDevice(address);
+                mCompanionType = getCompanionPreferences().getInt(
+                        COMPANION_TYPE_KEY, COMPANION_TYPE_NONE);
+            } catch (IllegalArgumentException e) {
+                mCompanionDevice = null;
+                mCompanionType = COMPANION_TYPE_NONE;
+            }
+        }
+
+        if (mCompanionDevice == null) {
+            // We don't have any companion phone registered, try look from the bonded devices
+            for (BluetoothDevice device : mAdapter.getBondedDevices()) {
+                byte[] metadata = mAdapterService.getMetadata(device,
+                        BluetoothDevice.METADATA_SOFTWARE_VERSION);
+                if (metadata == null) {
+                    continue;
+                }
+                String valueStr = new String(metadata);
+                if ((valueStr.equals(BluetoothDevice.COMPANION_TYPE_PRIMARY)
+                        || valueStr.equals(BluetoothDevice.COMPANION_TYPE_SECONDARY))) {
+                    // found the companion device, store and unregister all listeners
+                    Log.i(TAG, "Found companion device from the database!");
+                    setCompanionDevice(device, valueStr);
+                    break;
+                }
+                registerMetadataListener(device);
+            }
+        }
+        Log.i(TAG, "Companion device is " + mCompanionDevice + ", type=" + mCompanionType);
+    }
+
+    final BluetoothAdapter.OnMetadataChangedListener mMetadataListener =
+            new BluetoothAdapter.OnMetadataChangedListener() {
+                @Override
+                public void onMetadataChanged(BluetoothDevice device, int key, byte[] value) {
+                    String valueStr = new String(value);
+                    Log.d(TAG, String.format("Metadata updated in Device %s: %d = %s.", device,
+                            key, value == null ? null : valueStr));
+                    if (key == BluetoothDevice.METADATA_SOFTWARE_VERSION
+                            && (valueStr.equals(BluetoothDevice.COMPANION_TYPE_PRIMARY)
+                            || valueStr.equals(BluetoothDevice.COMPANION_TYPE_SECONDARY))) {
+                        setCompanionDevice(device, valueStr);
+                    }
+                }
+            };
+
+    private void setCompanionDevice(BluetoothDevice companionDevice, String type) {
+        synchronized (mMetadataListeningDevices) {
+            Log.i(TAG, "setCompanionDevice: " + companionDevice + ", type=" + type);
+            mCompanionDevice = companionDevice;
+            mCompanionType = type.equals(BluetoothDevice.COMPANION_TYPE_PRIMARY)
+                    ? COMPANION_TYPE_PRIMARY : COMPANION_TYPE_SECONDARY;
+
+            // unregister all metadata listeners
+            for (BluetoothDevice device : mMetadataListeningDevices) {
+                try {
+                    mAdapter.removeOnMetadataChangedListener(device, mMetadataListener);
+                } catch (IllegalArgumentException e) {
+                    Log.e(TAG, "failed to unregister metadata listener for "
+                            + device + " " + e);
+                }
+            }
+            mMetadataListeningDevices.clear();
+
+            SharedPreferences.Editor pref = getCompanionPreferences().edit();
+            pref.putString(COMPANION_DEVICE_KEY, mCompanionDevice.getAddress());
+            pref.putInt(COMPANION_TYPE_KEY, mCompanionType);
+            pref.apply();
+        }
+    }
+
+    private SharedPreferences getCompanionPreferences() {
+        return mAdapterService.getSharedPreferences(COMPANION_INFO, Context.MODE_PRIVATE);
+    }
+
+    /**
+     * Bond state change event from the AdapterService
+     *
+     * @param device the Bluetooth device
+     * @param state the new Bluetooth bond state of the device
+     */
+    public void onBondStateChanged(BluetoothDevice device, int state) {
+        synchronized (mMetadataListeningDevices) {
+            if (mCompanionDevice != null) {
+                // We already have the companion device, do not care bond state change any more.
+                return;
+            }
+            switch (state) {
+                case BluetoothDevice.BOND_BONDING:
+                    registerMetadataListener(device);
+                    break;
+                case BluetoothDevice.BOND_NONE:
+                    removeMetadataListener(device);
+                    break;
+                default:
+                    break;
+            }
+        }
+    }
+
+    private void registerMetadataListener(BluetoothDevice device) {
+        synchronized (mMetadataListeningDevices) {
+            Log.d(TAG, "register metadata listener: " + device);
+            try {
+                mAdapter.addOnMetadataChangedListener(
+                        device, mAdapterService.getMainExecutor(), mMetadataListener);
+            } catch (IllegalArgumentException e) {
+                Log.e(TAG, "failed to register metadata listener for "
+                        + device + " " + e);
+            }
+            mMetadataListeningDevices.add(device);
+        }
+    }
+
+    private void removeMetadataListener(BluetoothDevice device) {
+        synchronized (mMetadataListeningDevices) {
+            if (!mMetadataListeningDevices.contains(device)) return;
+
+            Log.d(TAG, "remove metadata listener: " + device);
+            try {
+                mAdapter.removeOnMetadataChangedListener(device, mMetadataListener);
+            } catch (IllegalArgumentException e) {
+                Log.e(TAG, "failed to unregister metadata listener for "
+                        + device + " " + e);
+            }
+            mMetadataListeningDevices.remove(device);
+        }
+    }
+
+
+    /**
+     * Method to get the stored companion device
+     *
+     * @return the companion Bluetooth device
+     */
+    public BluetoothDevice getCompanionDevice() {
+        return mCompanionDevice;
+    }
+
+    /**
+     * Method to check whether it is a companion device
+     *
+     * @param address the address of the device
+     * @return true if the address is a companion device, otherwise false
+     */
+    public boolean isCompanionDevice(String address) {
+        try {
+            return isCompanionDevice(mAdapter.getRemoteDevice(address));
+        } catch (IllegalArgumentException e) {
+            return false;
+        }
+    }
+
+    /**
+     * Method to check whether it is a companion device
+     *
+     * @param device the Bluetooth device
+     * @return true if the device is a companion device, otherwise false
+     */
+    public boolean isCompanionDevice(BluetoothDevice device) {
+        if (device == null) return false;
+        return device.equals(mCompanionDevice);
+    }
+
+    /**
+     * Method to reset the stored companion info
+     */
+    public void factoryReset() {
+        synchronized (mMetadataListeningDevices) {
+            mCompanionDevice = null;
+            mCompanionType = COMPANION_TYPE_NONE;
+
+            SharedPreferences.Editor pref = getCompanionPreferences().edit();
+            pref.remove(COMPANION_DEVICE_KEY);
+            pref.remove(COMPANION_TYPE_KEY);
+            pref.apply();
+        }
+    }
+
+    /**
+     * Gets the GATT connection parameters of the device
+     *
+     * @param address the address of the Bluetooth device
+     * @param type type of the parameter, can be GATT_CONN_INTERVAL_MIN, GATT_CONN_INTERVAL_MAX
+     * or GATT_CONN_LATENCY
+     * @param priority the priority of the connection, can be
+     * BluetoothGatt.CONNECTION_PRIORITY_HIGH, BluetoothGatt.CONNECTION_PRIORITY_LOW_POWER or
+     * BluetoothGatt.CONNECTION_PRIORITY_BALANCED
+     * @return the connection parameter in integer
+     */
+    public int getGattConnParameters(String address, int type, int priority) {
+        int companionType = isCompanionDevice(address) ? mCompanionType : COMPANION_TYPE_NONE;
+        int parameter;
+        switch (companionType) {
+            case COMPANION_TYPE_PRIMARY:
+                parameter = getGattConnParameterPrimary(type, priority);
+                break;
+            case COMPANION_TYPE_SECONDARY:
+                parameter = getGattConnParameterSecondary(type, priority);
+                break;
+            default:
+                parameter = getGattConnParameterDefault(type, priority);
+                break;
+        }
+        return parameter;
+    }
+
+    private int getGattConnParameterPrimary(int type, int priority) {
+        switch (priority) {
+            case BluetoothGatt.CONNECTION_PRIORITY_HIGH:
+                return mGattConnHighPrimary[type];
+            case BluetoothGatt.CONNECTION_PRIORITY_LOW_POWER:
+                return mGattConnLowPrimary[type];
+        }
+        return mGattConnBalancePrimary[type];
+    }
+
+    private int getGattConnParameterSecondary(int type, int priority) {
+        switch (priority) {
+            case BluetoothGatt.CONNECTION_PRIORITY_HIGH:
+                return mGattConnHighSecondary[type];
+            case BluetoothGatt.CONNECTION_PRIORITY_LOW_POWER:
+                return mGattConnLowSecondary[type];
+        }
+        return mGattConnBalanceSecondary[type];
+    }
+
+    private int getGattConnParameterDefault(int type, int mode) {
+        switch (mode) {
+            case BluetoothGatt.CONNECTION_PRIORITY_HIGH:
+                return mGattConnHighDefault[type];
+            case BluetoothGatt.CONNECTION_PRIORITY_LOW_POWER:
+                return mGattConnLowDefault[type];
+        }
+        return mGattConnBalanceDefault[type];
+    }
+}
diff --git a/android/app/src/com/android/bluetooth/btservice/Config.java b/android/app/src/com/android/bluetooth/btservice/Config.java
index 1c02159..c149329 100644
--- a/android/app/src/com/android/bluetooth/btservice/Config.java
+++ b/android/app/src/com/android/bluetooth/btservice/Config.java
@@ -60,10 +60,11 @@
 
     private static final String FEATURE_HEARING_AID = "settings_bluetooth_hearing_aid";
     private static final String FEATURE_BATTERY = "settings_bluetooth_battery";
-    private static long sSupportedMask = 0;
 
     private static final String LE_AUDIO_DYNAMIC_SWITCH_PROPERTY =
             "ro.bluetooth.leaudio_switcher.supported";
+    private static final String LE_AUDIO_BROADCAST_DYNAMIC_SWITCH_PROPERTY =
+            "ro.bluetooth.leaudio_broadcast_switcher.supported";
     private static final String LE_AUDIO_DYNAMIC_ENABLED_PROPERTY =
             "persist.bluetooth.leaudio_switcher.enabled";
 
@@ -165,6 +166,11 @@
     private static boolean sIsGdEnabledUptoScanningLayer = false;
 
     static void init(Context ctx) {
+        if (LeAudioService.isBroadcastEnabled()) {
+            updateSupportedProfileMask(
+                    true, LeAudioService.class, BluetoothProfile.LE_AUDIO_BROADCAST);
+        }
+
         final boolean leAudioDynamicSwitchSupported =
                 SystemProperties.getBoolean(LE_AUDIO_DYNAMIC_SWITCH_PROPERTY, false);
 
@@ -205,6 +211,15 @@
         setProfileEnabled(TbsService.class, enable);
         setProfileEnabled(McpService.class, enable);
         setProfileEnabled(VolumeControlService.class, enable);
+
+        final boolean broadcastDynamicSwitchSupported =
+                SystemProperties.getBoolean(LE_AUDIO_BROADCAST_DYNAMIC_SWITCH_PROPERTY, false);
+
+        if (broadcastDynamicSwitchSupported) {
+            setProfileEnabled(BassClientService.class, enable);
+            updateSupportedProfileMask(
+                    enable, LeAudioService.class, BluetoothProfile.LE_AUDIO_BROADCAST);
+        }
     }
 
     /**
@@ -226,8 +241,17 @@
         sSupportedProfiles = profilesList.toArray(new Class[profilesList.size()]);
     }
 
-    static void addSupportedProfile(int supportedProfile) {
-        sSupportedMask |= (1 << supportedProfile);
+    static void updateSupportedProfileMask(Boolean enable, Class profile, int supportedProfile) {
+        for (ProfileConfig config : PROFILE_SERVICES_AND_FLAGS) {
+            if (config.mClass == profile) {
+                if (enable) {
+                    config.mMask |= 1 << supportedProfile;
+                } else {
+                    config.mMask &= ~(1 << supportedProfile);
+                }
+                return;
+            }
+        }
     }
 
     static HashSet<Class> geLeAudioUnicastProfiles() {
@@ -253,7 +277,7 @@
     }
 
     static long getSupportedProfilesBitMask() {
-        long mask = sSupportedMask;
+        long mask = 0;
         for (final Class profileClass : getSupportedProfiles()) {
             mask |= getProfileMask(profileClass);
         }
diff --git a/android/app/src/com/android/bluetooth/btservice/DataMigration.java b/android/app/src/com/android/bluetooth/btservice/DataMigration.java
new file mode 100644
index 0000000..4846d60
--- /dev/null
+++ b/android/app/src/com/android/bluetooth/btservice/DataMigration.java
@@ -0,0 +1,271 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.btservice;
+
+import android.content.ContentProviderClient;
+import android.content.ContentResolver;
+import android.content.Context;
+import android.content.SharedPreferences;
+import android.database.Cursor;
+import android.net.Uri;
+import android.os.Bundle;
+import android.util.Log;
+
+import com.android.bluetooth.btservice.storage.BluetoothDatabaseMigration;
+import com.android.bluetooth.opp.BluetoothOppProvider;
+import com.android.internal.annotations.VisibleForTesting;
+
+import java.util.List;
+
+/**
+ * @hide
+ */
+final class DataMigration {
+    private DataMigration(){}
+    private static final String TAG = "DataMigration";
+
+    @VisibleForTesting
+    static final String AUTHORITY = "bluetooth_legacy.provider";
+
+    @VisibleForTesting
+    static final String START_MIGRATION_CALL = "start_legacy_migration";
+    @VisibleForTesting
+    static final String FINISH_MIGRATION_CALL = "finish_legacy_migration";
+
+    @VisibleForTesting
+    static final String BLUETOOTH_DATABASE = "bluetooth_db";
+    @VisibleForTesting
+    static final String OPP_DATABASE = "btopp.db";
+
+    // AvrcpVolumeManager.VOLUME_MAP
+    private static final String VOLUME_MAP_PREFERENCE_FILE = "bluetooth_volume_map";
+    // com.android.blueotooth.opp.Constants.BLUETOOTHOPP_CHANNEL_PREFERENCE
+    private static final String BLUETOOTHOPP_CHANNEL_PREFERENCE = "btopp_channels";
+
+    // com.android.blueotooth.opp.Constants.BLUETOOTHOPP_NAME_PREFERENCE
+    private static final String BLUETOOTHOPP_NAME_PREFERENCE = "btopp_names";
+
+    // com.android.blueotooth.opp.OPP_PREFERENCE_FILE
+    private static final String OPP_PREFERENCE_FILE = "OPPMGR";
+
+    @VisibleForTesting
+    static final String[] sharedPreferencesKeys = {
+        // Bundles of Boolean
+        AdapterService.PHONEBOOK_ACCESS_PERMISSION_PREFERENCE_FILE,
+        AdapterService.MESSAGE_ACCESS_PERMISSION_PREFERENCE_FILE,
+        AdapterService.SIM_ACCESS_PERMISSION_PREFERENCE_FILE,
+
+        // Bundles of Integer
+        VOLUME_MAP_PREFERENCE_FILE,
+        BLUETOOTHOPP_CHANNEL_PREFERENCE,
+
+        // Bundles of String
+        BLUETOOTHOPP_NAME_PREFERENCE,
+
+        // Bundle of Boolean and String
+        OPP_PREFERENCE_FILE,
+    };
+
+    // Main key use for storing all the key in the associate bundle
+    @VisibleForTesting
+    static final String KEY_LIST = "key_list";
+
+    @VisibleForTesting
+    static final String BLUETOOTH_CONFIG = "bluetooth_config";
+    static final String MIGRATION_DONE_PROPERTY = "migration_done";
+    @VisibleForTesting
+    static final String MIGRATION_ATTEMPT_PROPERTY = "migration_attempt";
+
+    @VisibleForTesting
+    public static final int MIGRATION_STATUS_TO_BE_DONE = 0;
+    @VisibleForTesting
+    public static final int MIGRATION_STATUS_COMPLETED = 1;
+    @VisibleForTesting
+    public static final int MIGRATION_STATUS_MISSING_APK = 2;
+    @VisibleForTesting
+    public static final int MIGRATION_STATUS_MAX_ATTEMPT = 3;
+
+    @VisibleForTesting
+    static final int MAX_ATTEMPT = 3;
+
+    static int run(Context ctx) {
+        if (migrationStatus(ctx) == MIGRATION_STATUS_COMPLETED) {
+            Log.d(TAG, "Legacy migration skiped: already completed");
+            return MIGRATION_STATUS_COMPLETED;
+        }
+        if (!isMigrationApkInstalled(ctx)) {
+            Log.d(TAG, "Legacy migration skiped: no migration app installed");
+            markMigrationStatus(ctx, MIGRATION_STATUS_MISSING_APK);
+            return MIGRATION_STATUS_MISSING_APK;
+        }
+        if (!incrementeMigrationAttempt(ctx)) {
+            Log.d(TAG, "Legacy migration skiped: still failing after too many attempt");
+            markMigrationStatus(ctx, MIGRATION_STATUS_MAX_ATTEMPT);
+            return MIGRATION_STATUS_MAX_ATTEMPT;
+        }
+
+        for (String pref: sharedPreferencesKeys) {
+            sharedPreferencesMigration(pref, ctx);
+        }
+        // Migration for DefaultSharedPreferences used in PbapUtils. Contains Long
+        sharedPreferencesMigration(ctx.getPackageName() + "_preferences", ctx);
+
+        bluetoothDatabaseMigration(ctx);
+        oppDatabaseMigration(ctx);
+
+        markMigrationStatus(ctx, MIGRATION_STATUS_COMPLETED);
+        Log.d(TAG, "Legacy migration completed");
+        return MIGRATION_STATUS_COMPLETED;
+    }
+
+    @VisibleForTesting
+    static boolean bluetoothDatabaseMigration(Context ctx) {
+        final String logHeader = BLUETOOTH_DATABASE + ": ";
+        ContentResolver resolver = ctx.getContentResolver();
+        Cursor cursor = resolver.query(
+                Uri.parse("content://" + AUTHORITY + "/" + BLUETOOTH_DATABASE),
+                null, null, null, null);
+        if (cursor == null) {
+            Log.d(TAG, logHeader + "Nothing to migrate");
+            return true;
+        }
+        boolean status = BluetoothDatabaseMigration.run(ctx, cursor);
+        cursor.close();
+        if (status) {
+            resolver.call(AUTHORITY, FINISH_MIGRATION_CALL, BLUETOOTH_DATABASE, null);
+            Log.d(TAG, logHeader + "Migration complete. File is deleted");
+        } else {
+            Log.e(TAG, logHeader + "Invalid data. Incomplete migration. File is not deleted");
+        }
+        return status;
+    }
+
+    @VisibleForTesting
+    static boolean oppDatabaseMigration(Context ctx) {
+        final String logHeader = OPP_DATABASE + ": ";
+        ContentResolver resolver = ctx.getContentResolver();
+        Cursor cursor = resolver.query(
+                Uri.parse("content://" + AUTHORITY + "/" + OPP_DATABASE),
+                null, null, null, null);
+        if (cursor == null) {
+            Log.d(TAG, logHeader + "Nothing to migrate");
+            return true;
+        }
+        boolean status = BluetoothOppProvider.oppDatabaseMigration(ctx, cursor);
+        cursor.close();
+        if (status) {
+            resolver.call(AUTHORITY, FINISH_MIGRATION_CALL, OPP_DATABASE, null);
+            Log.d(TAG, logHeader + "Migration complete. File is deleted");
+        } else {
+            Log.e(TAG, logHeader + "Invalid data. Incomplete migration. File is not deleted");
+        }
+        return status;
+    }
+
+    private static boolean writeObjectToEditor(SharedPreferences.Editor editor, Bundle b,
+            String itemKey) {
+        Object value = b.get(itemKey);
+        if (value == null) {
+            Log.e(TAG, itemKey + ": No value associated with this itemKey");
+            return false;
+        }
+        if (value instanceof Boolean) {
+            editor.putBoolean(itemKey, (Boolean) value);
+        } else if (value instanceof Integer) {
+            editor.putInt(itemKey, (Integer) value);
+        } else if (value instanceof Long) {
+            editor.putLong(itemKey, (Long) value);
+        } else if (value instanceof String) {
+            editor.putString(itemKey, (String) value);
+        } else {
+            Log.e(TAG, itemKey + ": Failed to migrate: "
+                     + value.getClass().getSimpleName() + ": Data type not handled");
+            return false;
+        }
+        return true;
+    }
+
+    @VisibleForTesting
+    static boolean sharedPreferencesMigration(String prefKey, Context ctx) {
+        final String logHeader = "SharedPreferencesMigration - " + prefKey + ": ";
+        ContentResolver resolver = ctx.getContentResolver();
+        Bundle b = resolver.call(AUTHORITY, START_MIGRATION_CALL, prefKey, null);
+        if (b == null) {
+            Log.d(TAG, logHeader + "Nothing to migrate");
+            return true;
+        }
+        List<String> keys = b.getStringArrayList(KEY_LIST);
+        if (keys == null) {
+            Log.e(TAG, logHeader + "Wrong format of bundle: No keys to migrate");
+            return false;
+        }
+        SharedPreferences pref = ctx.getSharedPreferences(prefKey, Context.MODE_PRIVATE);
+        SharedPreferences.Editor editor = pref.edit();
+        boolean status = true;
+        for (String itemKey : keys) {
+            // prevent overriding any user settings if it's a new attempt
+            if (!pref.contains(itemKey)) {
+                status &= writeObjectToEditor(editor, b, itemKey);
+            } else {
+                Log.d(TAG, logHeader + itemKey + ": Already exists, not overriding data.");
+            }
+        }
+        editor.apply();
+        if (status) {
+            resolver.call(AUTHORITY, FINISH_MIGRATION_CALL, prefKey, null);
+            Log.d(TAG, logHeader + "Migration complete. File is deleted");
+        } else {
+            Log.e(TAG, logHeader + "Invalid data. Incomplete migration. File is not deleted");
+        }
+        return status;
+    }
+
+    @VisibleForTesting
+    static int migrationStatus(Context ctx) {
+        SharedPreferences pref = ctx.getSharedPreferences(BLUETOOTH_CONFIG, Context.MODE_PRIVATE);
+        return pref.getInt(MIGRATION_DONE_PROPERTY, MIGRATION_STATUS_TO_BE_DONE);
+    }
+
+    @VisibleForTesting
+    static boolean incrementeMigrationAttempt(Context ctx) {
+        SharedPreferences pref = ctx.getSharedPreferences(BLUETOOTH_CONFIG, Context.MODE_PRIVATE);
+        int currentAttempt = Math.min(pref.getInt(MIGRATION_ATTEMPT_PROPERTY, 0), MAX_ATTEMPT);
+        pref.edit()
+            .putInt(MIGRATION_ATTEMPT_PROPERTY, currentAttempt + 1)
+            .apply();
+        return currentAttempt < MAX_ATTEMPT;
+    }
+
+    @VisibleForTesting
+    static boolean isMigrationApkInstalled(Context ctx) {
+        ContentResolver resolver = ctx.getContentResolver();
+        ContentProviderClient client = resolver.acquireContentProviderClient(AUTHORITY);
+        if (client != null) {
+            client.close();
+            return true;
+        }
+        return false;
+    }
+
+    @VisibleForTesting
+    static void markMigrationStatus(Context ctx, int status) {
+        ctx.getSharedPreferences(BLUETOOTH_CONFIG, Context.MODE_PRIVATE)
+            .edit()
+            .putInt(MIGRATION_DONE_PROPERTY, status)
+            .apply();
+    }
+}
diff --git a/android/app/src/com/android/bluetooth/btservice/DeviceBloomfilterGenerator.java b/android/app/src/com/android/bluetooth/btservice/DeviceBloomfilterGenerator.java
new file mode 100644
index 0000000..fcadc29
--- /dev/null
+++ b/android/app/src/com/android/bluetooth/btservice/DeviceBloomfilterGenerator.java
@@ -0,0 +1,203 @@
+/*
+ * Copyright (C) 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package com.android.bluetooth.btservice;
+
+import java.io.File;
+import java.io.FileOutputStream;
+import java.io.IOException;
+
+/**
+ * Class to generate a default Device Bloomfilter
+ */
+public class DeviceBloomfilterGenerator {
+    public static final String BLOOM_FILTER_DEFAULT =
+            "01070000013b23cef3cd0e063e5dd15a"
+            + "1a3f14b8a2d6974ab2e5a2d37f2efa97"
+            + "10e526000ae8728c41445c9a1387c123"
+            + "dc63675c0b8da3d365cde65b9edf153d"
+            + "12d3a1ecdf9b78b3b2f86bc294ccf7ea"
+            + "f650e1fa767bcaad3b61520125d38364"
+            + "4cb480d820122ad455e7e422e9bc51fd"
+            + "c442628ed66154916130be24212e4f44"
+            + "efed5a6bc9b7064fa7b2efe86dd4e801"
+            + "72c65b972a7524b370a2bca955429385"
+            + "a405671d87ead027e7cb4080713dd0bf"
+            + "6b440048b14d3d55d41d1f4497143b98"
+            + "3b939c0bb686f026aa3c42df96bcab6a"
+            + "542f9b8b62cd30e76ac744b4a185c7aa"
+            + "3433dd714e95c0f268449c56e904a4d4"
+            + "8bf9d242f99fbbe3e259ee97cbafd1f7"
+            + "65306274f54f67b7dfbf2423b8ef8fd6"
+            + "ee3fca0e2217bb351bd3347c610fa3f7"
+            + "7e5ec2d7b931f657d61784fe59e2516c"
+            + "9c8f8f4bcffe0a247ed16d93347a818a"
+            + "a798320da96f05dbee4c5cf31661121f"
+            + "e0e6e6ce9b657df24a7b8e0b8a34e443"
+            + "79dcb270d856a5431a2b6416464e9327"
+            + "22bb423d6f4e620c33a5f2b1d02f9a8f"
+            + "521f7b49947284af61c0dfc4d0e64ccd"
+            + "1df147ae9999fdf9a3538c0ad83ee7d5"
+            + "d066f0f4759bcb5c46b7c3fd57697b88"
+            + "5a8f82a77d927617a6ea077ff352ff18"
+            + "1ab520f1cc0d73f688b55c37761e0be7"
+            + "e543e33accef44fa212f2b746a239bfd"
+            + "b139e39439ffa76919419b79e4505d17"
+            + "0b412ace6f21c6c34bff54eb2e16429a"
+            + "cbc691d3c17aa9e0590e3d4d3acc9349"
+            + "0d67e7cfbf4dfa9aeaadfead7770af8f"
+            + "fb827e2376d30d027cc949712dbce0f7"
+            + "3bb193dbf9201a59632ba6daf11b8a92"
+            + "6bea34175531df805afd72792c9ebada"
+            + "823a0b677c4ee75d745806a98a4dd754"
+            + "2f5e5f665e3280385a416e94ccd8eb88"
+            + "a949d2daaee0f11c238fed182e1c234c"
+            + "c4021288a0f7f31807b735ea96e3e4fe"
+            + "66d07484a2336971d6ac0e6a79967116"
+            + "cc9eac2921ea51ec822fcc5f90c0f6b4"
+            + "96845542dfe8fbd6299e7d2af66ce423"
+            + "a7346d1af0f5bca2f261e9a247e214a5"
+            + "aecf8d19f2e368d7f0ea9699bc313ccf"
+            + "ccdb8f759d9bf4ee42a49cda2021eba7"
+            + "71add727d5d8cf35143fd4ffc595ee83"
+            + "6d293113cd9ddcea69c009c6f94e4605"
+            + "f96efe314bbad0e5fa449b35e24d1121"
+            + "c1cbcfbacd3bad9759bb5028033ebfc4"
+            + "8ac390285e7b41195fa4c4512cb48bd7"
+            + "2787f52eb8d260e6a9e2b02d32d57c04"
+            + "fd236b933cb365d2ebc99c30fb972ac1"
+            + "fcd1afcf4087c4d612eb1fefc9a03e78"
+            + "de594bc828e3b1aaddb46b7f3d2e0916"
+            + "8c324e1059e2d6b8535c34e4ab05bc13"
+            + "adaf2d75db9d9c8f0891541b573f5782"
+            + "a543f214b34bfdad7373bd6703d4b1ae"
+            + "3793910ad3ccceebda27f714df06c63a"
+            + "94ac90a3044f9c9494ffdc7cb050a750"
+            + "0d647262b98a7f74378f525ba945ddc7"
+            + "a9926b67c553b37ca370ac9016e6b34d"
+            + "5966a6571bc62dfb0fea8906ce4e0739"
+            + "3ff747c356734343bcdc2362baa97e2a"
+            + "eb37244316ac6d0f91e0c6dada3f19d2"
+            + "21f4f309db772bcca9128ee94b11dca5"
+            + "58e678deabfd506f3acf269c0cdd4d66"
+            + "951567041afd88acfa5afff876f024bb"
+            + "7e72db189f9f9e77782aef5f565ceb12"
+            + "1b9cea8200c797bf46f9e086bb6c45c7"
+            + "2a8a7f521523158d005ba13f72866e4b"
+            + "281abb7c01bc16e666b3d9c49ac4ef8a"
+            + "d45b4a63a2d8318cfd6387fa59fc9c1e"
+            + "a7f753d4a2a12a9e802ecaf24ded9075"
+            + "4c476cb2d1f547ecabe06180471cf5b2"
+            + "18099f595df1f96eb9bb301da60853cb"
+            + "3db3ee16dc09f5c167632cb742f9b631"
+            + "35ebf72aaad9f8fbd44f15d9ba77b7c2"
+            + "9bc2873378bd433c0d27258dbf095c75"
+            + "dd7b4ed56b2db02331a5b3817473c6b5"
+            + "b3228749bf1fa16cd88903276b12ac9d"
+            + "949042a04c364725f27644fd082e8e1b"
+            + "2bcaa9ac54b170a67862fd3325e09896"
+            + "bdf499eb1a933d255bb7bd58011379a6"
+            + "20da77c55a7484c0aa19681a8fb71b8b"
+            + "5f10efa2cbaf518a071651b899961dcd"
+            + "953d695f8187a0a3249db6afc81492f1"
+            + "03de215ca8af5c62bda273e0c46f6d4e"
+            + "0f4f8025cc52532b7f4c3ef61769326e"
+            + "841c9c775294ddd2aeba8b7fcb7ce8c4"
+            + "66472f0551c905db5d6c7901e51ba435"
+            + "9a42ed96fb170e2b6e933440de8f4b7e"
+            + "7832696368f9c61c46840db11f5e411a"
+            + "d64e2aa300cfd0768fb919f9434f53b0"
+            + "02e9316c926fe1498ea8b8bfb1f87943"
+            + "6ad5633e004878d47f3102ec93f56737"
+            + "c7a4f0f723f402726f4419f1805b9bcb"
+            + "c25e5536a1356f30756580aa919dcc5f"
+            + "1491bdf6e4639eb56b246e6aa846f721"
+            + "59684a64b413264678df77a633c1c448"
+            + "0ceddd569bf36b61f9fb492ef7ad14dd"
+            + "6b5460e9b267ec1aecf078e3ad180e06"
+            + "35b86c65a0ae236c4cdaed5e48b33525"
+            + "856a70eac296a1744932ee9a91b45821"
+            + "fd7dcaa3e47ef274ed4d34ca440c71bf"
+            + "d9cee7e20b85993d61acb72acaeaf969"
+            + "4f6480d157c4a062a2abf5df87835df8"
+            + "cafbb79aa8f2f2b6b8eae630ff25bdc9"
+            + "5e4df395ce7626882cbb26de3a13d98a"
+            + "b5b7f3bde86c39ab85844cfabaaa9d5e"
+            + "8d6bb9f1c6d644f20c8bf59960efad58"
+            + "ec5071353c1fa7da4a681a650fcbeb8f"
+            + "9cc48389e5e8c0734d2d77126904addb"
+            + "6cf4166e1f4cb964d658a3bba2a2fb33"
+            + "0c16fc9b83f54774b826b38ca96019c8"
+            + "49705809b8656d61044ee19ade74e59f"
+            + "6bce4d414a11bdc1bb76cd096d88dd9d"
+            + "83ca5813bdfa7cc4cd6cefbd090c928d"
+            + "a944ca2012500c510f9462056ee6d99c"
+            + "a76467f9999f4ecf62f7ad1c98eb5914"
+            + "283c354c3fae5b527204983915648b2d"
+            + "4ccda53623e4e1c4eae633f5ed3f18d1"
+            + "3c25d41487014bcc72f3fb69cfe8cdc2"
+            + "d157f899b935ee1501bd8131cd2bdcc1"
+            + "b64c5425562fa6491d24a53047c8720a"
+            + "736be13878c14326035d4b45f319f249"
+            + "cab39e4332aa2e309d264be67c4fb376"
+            + "d3a9698df50497276792384787a9fd1e"
+            + "81c785a7491ec03b7b41625969898df5"
+            + "3456585ebe6db84fd70dcf6cb2914279"
+            + "ccfd1e7fc25d41f5d1020dce935a2eb6"
+            + "7d45641a180f47ab3e6b8cf8f507ef27"
+            + "c8c02c9fbd18519dcfd9adf0fdd4a50b"
+            + "e2c33bd38df85723e9c9763b6ac5a3da"
+            + "70d96dd329a42ca1e7bfed5f7f59e2ab"
+            + "830ba4f968bcf3b7dc2fe6e4d5851ab6"
+            + "360e5265525f153d9fd9ffc333cd946d"
+            + "6c7b035dbb9ee9d1d5a62b1c721481b5"
+            + "0a703f8e9ae4491a83d0fb5e2c72305d"
+            + "3d045f3c43d2db5168af4e1372d5a477"
+            + "ec76b55e3c734fdf9e17d4182ffd5c78"
+            + "0fcf25d709f331a2bd9bd991ab9acbd8"
+            + "50f701c039172dca18db78836de81f96"
+            + "7e75dfa622fe6bdaa7ea896eaab576f8"
+            + "3e9e39148bf5960dc4dc8f3b768415f3"
+            + "67f477cd34cd47ae7b7de6d3332d42d9"
+            + "cf87b883abbd016d668b5f389d72a219"
+            + "c82bdd4f2c2b6768779fe2d74bf01653"
+            + "1d5618d537029d86004bf48f4cc89d16"
+            + "7bdffccd73134c971cff61096877a799"
+            + "9d1bf238fb8c12aae9f02a08b9abdfa5"
+            + "c8d1101a3d1928a7bc63973cd84b62c2"
+            + "9f7c74668d3f203c84b165b5eee84881"
+            + "a8b7a86cf7edf7b2a060c56b75d55286"
+            + "fbf4468a573a7e77e24d32470b95680e"
+            + "7155eeeea7e9522814528e2c414bbf2d"
+            + "fcafa73fcbb3b7a42f19b5f057dd";
+
+    public static byte[] hexStringToByteArray(String s) {
+        int len = s.length();
+        byte[] data = new byte[len / 2];
+        for (int i = 0; i < len; i += 2) {
+            data[i / 2] = (byte) ((Character.digit(s.charAt(i), 16) << 4)
+                    + Character.digit(s.charAt(i + 1), 16));
+        }
+        return data;
+    }
+
+    public static void generateDefaultBloomfilter(String filePath) throws IOException {
+        File outputFile = new File(filePath);
+        outputFile.createNewFile(); // if file already exists will do nothing
+        FileOutputStream fos = new FileOutputStream(filePath);
+        fos.write(hexStringToByteArray(BLOOM_FILTER_DEFAULT));
+        fos.close();
+    }
+}
diff --git a/android/app/src/com/android/bluetooth/btservice/MetricsLogger.java b/android/app/src/com/android/bluetooth/btservice/MetricsLogger.java
index 12a4f81..08a3845 100644
--- a/android/app/src/com/android/bluetooth/btservice/MetricsLogger.java
+++ b/android/app/src/com/android/bluetooth/btservice/MetricsLogger.java
@@ -16,11 +16,7 @@
 package com.android.bluetooth.btservice;
 
 import android.app.AlarmManager;
-import android.app.PendingIntent;
-import android.content.BroadcastReceiver;
 import android.content.Context;
-import android.content.Intent;
-import android.content.IntentFilter;
 import android.os.SystemClock;
 import android.util.Log;
 
@@ -29,6 +25,17 @@
 import com.android.bluetooth.BluetoothMetricsProto.ProfileId;
 import com.android.bluetooth.BluetoothStatsLog;
 
+import com.google.common.hash.BloomFilter;
+import com.google.common.hash.Funnels;
+import com.google.common.hash.Hashing;
+
+import java.io.ByteArrayInputStream;
+import java.io.File;
+import java.io.FileInputStream;
+import java.io.IOException;
+import java.nio.charset.StandardCharsets;
+import java.security.MessageDigest;
+import java.security.NoSuchAlgorithmException;
 import java.util.HashMap;
 
 /**
@@ -36,16 +43,15 @@
  */
 public class MetricsLogger {
     private static final String TAG = "BluetoothMetricsLogger";
+    private static final String BLOOMFILTER_PATH = "/data/misc/bluetooth";
+    private static final String BLOOMFILTER_FILE = "/devices_for_metrics";
+    public static final String BLOOMFILTER_FULL_PATH = BLOOMFILTER_PATH + BLOOMFILTER_FILE;
 
     public static final boolean DEBUG = false;
 
-    /**
-     * Intent indicating Bluetooth counter metrics should send logs to BluetoothStatsLog
-     */
-    public static final String BLUETOOTH_COUNTER_METRICS_ACTION =
-            "com.android.bluetooth.btservice.BLUETOOTH_COUNTER_METRICS_ACTION";
     // 6 hours timeout for counter metrics
     private static final long BLUETOOTH_COUNTER_METRICS_ACTION_DURATION_MILLIS = 6L * 3600L * 1000L;
+    private static final int MAX_WORDS_ALLOWED_IN_DEVICE_NAME = 7;
 
     private static final HashMap<ProfileId, Integer> sProfileConnectionCounts = new HashMap<>();
 
@@ -55,17 +61,14 @@
     private AlarmManager mAlarmManager = null;
     private boolean mInitialized = false;
     static final private Object mLock = new Object();
+    private BloomFilter<byte[]> mBloomFilter = null;
+    protected boolean mBloomFilterInitialized = false;
 
-    private BroadcastReceiver mDrainReceiver = new BroadcastReceiver() {
+    private AlarmManager.OnAlarmListener mOnAlarmListener = new AlarmManager.OnAlarmListener () {
         @Override
-        public void onReceive(Context context, Intent intent) {
-            String action = intent.getAction();
-            if (DEBUG) {
-                Log.d(TAG, "onReceive: " + action);
-            }
-            if (action.equals(BLUETOOTH_COUNTER_METRICS_ACTION)) {
-                drainBufferedCounters();
-            }
+        public void onAlarm() {
+            drainBufferedCounters();
+            scheduleDrains();
         }
     };
 
@@ -84,20 +87,56 @@
         return mInitialized;
     }
 
+    public boolean initBloomFilter(String path) {
+        try {
+            File file = new File(path);
+            if (!file.exists()) {
+                Log.w(TAG, "MetricsLogger is creating a new Bloomfilter file");
+                DeviceBloomfilterGenerator.generateDefaultBloomfilter(path);
+            }
+
+            FileInputStream in = new FileInputStream(new File(path));
+            mBloomFilter = BloomFilter.readFrom(in, Funnels.byteArrayFunnel());
+            mBloomFilterInitialized = true;
+        } catch (IOException e1) {
+            Log.w(TAG, "MetricsLogger can't read the BloomFilter file.");
+            byte[] bloomfilterData = DeviceBloomfilterGenerator.hexStringToByteArray(
+                    DeviceBloomfilterGenerator.BLOOM_FILTER_DEFAULT);
+            try {
+                mBloomFilter = BloomFilter.readFrom(
+                        new ByteArrayInputStream(bloomfilterData), Funnels.byteArrayFunnel());
+                mBloomFilterInitialized = true;
+                Log.i(TAG, "The default bloomfilter is used");
+                return true;
+            } catch (IOException e2) {
+                Log.w(TAG, "The default bloomfilter can't be used.");
+            }
+            return false;
+        }
+        return true;
+    }
+
+    protected void setBloomfilter(BloomFilter bloomfilter) {
+        mBloomFilter = bloomfilter;
+    }
+
     public boolean init(Context context) {
         if (mInitialized) {
             return false;
         }
         mInitialized = true;
         mContext = context;
-        IntentFilter filter = new IntentFilter();
-        filter.addAction(BLUETOOTH_COUNTER_METRICS_ACTION);
-        mContext.registerReceiver(mDrainReceiver, filter, Context.RECEIVER_NOT_EXPORTED);
         scheduleDrains();
+        if (!initBloomFilter(BLOOMFILTER_FULL_PATH)) {
+            Log.w(TAG, "MetricsLogger can't initialize the bloomfilter");
+            // The class is for multiple metrics tasks.
+            // We still want to use this class even if the bloomfilter isn't initialized
+            // so still return true here.
+        }
         return true;
     }
 
-    public boolean count(int key, long count) {
+    public boolean cacheCount(int key, long count) {
         if (!mInitialized) {
             Log.w(TAG, "MetricsLogger isn't initialized");
             return false;
@@ -154,22 +193,30 @@
     }
 
     protected void scheduleDrains() {
-        if (DEBUG) {
-            Log.d(TAG, "setCounterMetricsAlarm()");
-        }
+        Log.i(TAG, "setCounterMetricsAlarm()");
         if (mAlarmManager == null) {
             mAlarmManager = mContext.getSystemService(AlarmManager.class);
         }
-        mAlarmManager.setRepeating(
+        mAlarmManager.set(
                 AlarmManager.ELAPSED_REALTIME_WAKEUP,
-                SystemClock.elapsedRealtime(),
-                BLUETOOTH_COUNTER_METRICS_ACTION_DURATION_MILLIS,
-                getDrainIntent());
+                SystemClock.elapsedRealtime() + BLUETOOTH_COUNTER_METRICS_ACTION_DURATION_MILLIS,
+                TAG,
+                mOnAlarmListener,
+                null);
     }
 
-    protected void writeCounter(int key, long count) {
+    public boolean count(int key, long count) {
+        if (!mInitialized) {
+            Log.w(TAG, "MetricsLogger isn't initialized");
+            return false;
+        }
+        if (count <= 0) {
+            Log.w(TAG, "count is not larger than 0. count: " + count + " key: " + key);
+            return false;
+        }
         BluetoothStatsLog.write(
                 BluetoothStatsLog.BLUETOOTH_CODE_PATH_COUNTER, key, count);
+        return true;
     }
 
     protected void drainBufferedCounters() {
@@ -177,7 +224,7 @@
         synchronized (mLock) {
             // send mCounters to statsd
             for (int key : mCounters.keySet()) {
-                writeCounter(key, mCounters.get(key));
+                count(key, mCounters.get(key));
             }
             mCounters.clear();
         }
@@ -195,18 +242,75 @@
         mAlarmManager = null;
         mContext = null;
         mInitialized = false;
+        mBloomFilterInitialized = false;
         return true;
     }
     protected void cancelPendingDrain() {
-        PendingIntent pIntent = getDrainIntent();
-        pIntent.cancel();
-        mAlarmManager.cancel(pIntent);
+        mAlarmManager.cancel(mOnAlarmListener);
     }
 
-    private PendingIntent getDrainIntent() {
-        Intent counterMetricsIntent = new Intent(BLUETOOTH_COUNTER_METRICS_ACTION);
-        counterMetricsIntent.setPackage(mContext.getPackageName());
-        return PendingIntent.getBroadcast(
-                mContext, 0, counterMetricsIntent, PendingIntent.FLAG_IMMUTABLE);
+    protected boolean logSanitizedBluetoothDeviceName(int metricId, String deviceName) {
+        if (!mBloomFilterInitialized || deviceName == null) {
+            return false;
+        }
+
+        // remove more than one spaces in a row
+        deviceName = deviceName.trim().replaceAll(" +", " ");
+        // remove non alphanumeric characters and spaces, and transform to lower cases.
+        String[] words = deviceName.replaceAll(
+                "[^a-zA-Z0-9 ]", "").toLowerCase().split(" ");
+
+        if (words.length > MAX_WORDS_ALLOWED_IN_DEVICE_NAME) {
+            // Validity checking here to avoid excessively long sequences
+            return false;
+        }
+        // find the longest matched substring
+        String matchedString = "";
+        byte[] matchedSha256 = null;
+        for (int start = 0; start < words.length; start++) {
+
+            String toBeMatched = "";
+            for (int end = start; end < words.length; end++) {
+                toBeMatched += words[end];
+                byte[] sha256 = getSha256(toBeMatched);
+                if (sha256 == null) {
+                    continue;
+                }
+
+                if (mBloomFilter.mightContain(sha256)
+                        && toBeMatched.length() > matchedString.length()) {
+                    matchedString = toBeMatched;
+                    matchedSha256 = sha256;
+                }
+            }
+        }
+
+        // upload the sha256 of the longest matched string.
+        if (matchedSha256 == null) {
+            return false;
+        }
+        statslogBluetoothDeviceNames(
+                metricId,
+                matchedString,
+                Hashing.sha256().hashString(matchedString, StandardCharsets.UTF_8).toString());
+        return true;
+    }
+
+    protected void statslogBluetoothDeviceNames(int metricId, String matchedString, String sha256) {
+        Log.d(TAG,
+                "Uploading sha256 hash of matched bluetooth device name: " + sha256);
+        BluetoothStatsLog.write(
+                BluetoothStatsLog.BLUETOOTH_HASHED_DEVICE_NAME_REPORTED, metricId, sha256);
+    }
+
+    protected static byte[] getSha256(String name) {
+        MessageDigest digest = null;
+        try {
+            digest = MessageDigest.getInstance("SHA-256");
+        } catch (NoSuchAlgorithmException e) {
+            Log.w(TAG, "No SHA-256 in MessageDigest");
+            return null;
+        }
+        return digest.digest(name.getBytes(StandardCharsets.UTF_8));
     }
 }
diff --git a/android/app/src/com/android/bluetooth/btservice/PhonePolicy.java b/android/app/src/com/android/bluetooth/btservice/PhonePolicy.java
index c81a5fb..6d2e838 100644
--- a/android/app/src/com/android/bluetooth/btservice/PhonePolicy.java
+++ b/android/app/src/com/android/bluetooth/btservice/PhonePolicy.java
@@ -355,10 +355,12 @@
                     BluetoothProfile.PAN, BluetoothProfile.CONNECTION_POLICY_ALLOWED);
         }
 
+        boolean isLeAudioProfileAllowed = false;
         if ((leAudioService != null) && Utils.arrayContains(uuids,
                 BluetoothUuid.LE_AUDIO) && (leAudioService.getConnectionPolicy(device)
                 == BluetoothProfile.CONNECTION_POLICY_UNKNOWN)) {
             debugLog("setting le audio profile priority for device " + device);
+            isLeAudioProfileAllowed = true;
             mAdapterService.getDatabase().setProfileConnectionPolicy(device,
                     BluetoothProfile.LE_AUDIO, BluetoothProfile.CONNECTION_POLICY_ALLOWED);
             if (mPreferLeAudioOnlyMode) {
@@ -384,9 +386,13 @@
         if ((hearingAidService != null) && Utils.arrayContains(uuids,
                 BluetoothUuid.HEARING_AID) && (hearingAidService.getConnectionPolicy(device)
                 == BluetoothProfile.CONNECTION_POLICY_UNKNOWN)) {
-            debugLog("setting hearing aid profile priority for device " + device);
-            mAdapterService.getDatabase().setProfileConnectionPolicy(device,
-                    BluetoothProfile.HEARING_AID, BluetoothProfile.CONNECTION_POLICY_ALLOWED);
+            if (isLeAudioProfileAllowed) {
+                debugLog("LE Audio preferred over ASHA for device " + device);
+            } else {
+                debugLog("setting hearing aid profile priority for device " + device);
+                mAdapterService.getDatabase().setProfileConnectionPolicy(device,
+                        BluetoothProfile.HEARING_AID, BluetoothProfile.CONNECTION_POLICY_ALLOWED);
+            }
         }
 
         if ((volumeControlService != null) && Utils.arrayContains(uuids,
@@ -576,6 +582,7 @@
                     + " attempting auto connection");
             autoConnectHeadset(mostRecentlyActiveA2dpDevice);
             autoConnectA2dp(mostRecentlyActiveA2dpDevice);
+            autoConnectHidHost(mostRecentlyActiveA2dpDevice);
         } else {
             debugLog("autoConnect() - BT is in quiet mode. Not initiating auto connections");
         }
@@ -614,6 +621,23 @@
         }
     }
 
+    @RequiresPermission(android.Manifest.permission.MODIFY_PHONE_STATE)
+    private void autoConnectHidHost(BluetoothDevice device) {
+        final HidHostService hidHostService = mFactory.getHidHostService();
+        if (hidHostService == null) {
+            warnLog("autoConnectHidHost: service is null, failed to connect to " + device);
+            return;
+        }
+        int hidHostConnectionPolicy = hidHostService.getConnectionPolicy(device);
+        if (hidHostConnectionPolicy == BluetoothProfile.CONNECTION_POLICY_ALLOWED) {
+            debugLog("autoConnectHidHost: Connecting HID with " + device);
+            hidHostService.connect(device);
+        } else {
+            debugLog("autoConnectHidHost: skipped auto-connect HID with device " + device
+                    + " connectionPolicy " + hidHostConnectionPolicy);
+        }
+    }
+
     private void connectOtherProfile(BluetoothDevice device) {
         if (mAdapterService.isQuietModeEnabled()) {
             debugLog("connectOtherProfile: in quiet mode, skip connect other profile " + device);
@@ -657,6 +681,7 @@
         VolumeControlService volumeControlService =
             mFactory.getVolumeControlService();
         BatteryService batteryService = mFactory.getBatteryService();
+        HidHostService hidHostService = mFactory.getHidHostService();
 
         if (hsService != null) {
             if (!mHeadsetRetrySet.contains(device) && (hsService.getConnectionPolicy(device)
@@ -730,6 +755,15 @@
                 batteryService.connect(device);
             }
         }
+        if (hidHostService != null) {
+            if ((hidHostService.getConnectionPolicy(device)
+                    == BluetoothProfile.CONNECTION_POLICY_ALLOWED)
+                    && (hidHostService.getConnectionState(device)
+                    == BluetoothProfile.STATE_DISCONNECTED)) {
+                debugLog("Retrying connection to HID with device " + device);
+                hidHostService.connect(device);
+            }
+        }
     }
 
     private static void debugLog(String msg) {
diff --git a/android/app/src/com/android/bluetooth/btservice/RemoteDevices.java b/android/app/src/com/android/bluetooth/btservice/RemoteDevices.java
index 9c8c88b..e748631 100644
--- a/android/app/src/com/android/bluetooth/btservice/RemoteDevices.java
+++ b/android/app/src/com/android/bluetooth/btservice/RemoteDevices.java
@@ -19,6 +19,7 @@
 import static android.Manifest.permission.BLUETOOTH_CONNECT;
 import static android.Manifest.permission.BLUETOOTH_SCAN;
 
+import android.app.admin.SecurityLog;
 import android.bluetooth.BluetoothAdapter;
 import android.bluetooth.BluetoothAssignedNumbers;
 import android.bluetooth.BluetoothClass;
@@ -26,6 +27,7 @@
 import android.bluetooth.BluetoothHeadset;
 import android.bluetooth.BluetoothHeadsetClient;
 import android.bluetooth.BluetoothProfile;
+import android.bluetooth.BluetoothSinkAudioPolicy;
 import android.bluetooth.IBluetoothConnectionCallback;
 import android.content.BroadcastReceiver;
 import android.content.Context;
@@ -37,6 +39,7 @@
 import android.os.Message;
 import android.os.ParcelUuid;
 import android.os.RemoteException;
+import android.os.SystemProperties;
 import android.util.Log;
 
 import com.android.bluetooth.BluetoothStatsLog;
@@ -244,29 +247,28 @@
 
     DeviceProperties getDeviceProperties(BluetoothDevice device) {
         synchronized (mDevices) {
-            DeviceProperties prop = mDevices.get(device.getAddress());
-            if (prop == null) {
-                String mainAddress = mDualDevicesMap.get(device.getAddress());
-                if (mainAddress != null && mDevices.get(mainAddress) != null) {
-                    prop = mDevices.get(mainAddress);
-                }
+            String address = mDualDevicesMap.get(device.getAddress());
+            // If the device is not in the dual map, use its original address
+            if (address == null || mDevices.get(address) == null) {
+                address = device.getAddress();
             }
-            return prop;
+            return mDevices.get(address);
         }
     }
 
     BluetoothDevice getDevice(byte[] address) {
         String addressString = Utils.getAddressStringFromByte(address);
-        DeviceProperties prop = mDevices.get(addressString);
-        if (prop == null) {
-            String mainAddress = mDualDevicesMap.get(addressString);
-            if (mainAddress != null && mDevices.get(mainAddress) != null) {
-                prop = mDevices.get(mainAddress);
-                return prop.getDevice();
-            }
-            return null;
+        String deviceAddress = mDualDevicesMap.get(addressString);
+        // If the device is not in the dual map, use its original address
+        if (deviceAddress == null || mDevices.get(deviceAddress) == null) {
+            deviceAddress = addressString;
         }
-        return prop.getDevice();
+
+        DeviceProperties prop = mDevices.get(deviceAddress);
+        if (prop != null) {
+            return prop.getDevice();
+        }
+        return null;
     }
 
     @VisibleForTesting
@@ -310,6 +312,7 @@
         @VisibleForTesting int mBondState;
         @VisibleForTesting int mDeviceType;
         @VisibleForTesting ParcelUuid[] mUuids;
+        private BluetoothSinkAudioPolicy mAudioPolicy;
 
         DeviceProperties() {
             mBondState = BluetoothDevice.BOND_NONE;
@@ -497,6 +500,14 @@
                 return mIsCoordinatedSetMember;
             }
         }
+
+        public void setHfAudioPolicyForRemoteAg(BluetoothSinkAudioPolicy policies) {
+            mAudioPolicy = policies;
+        }
+
+        public BluetoothSinkAudioPolicy getHfAudioPolicyForRemoteAg() {
+            return mAudioPolicy;
+        }
     }
 
     private void sendUuidIntent(BluetoothDevice device, DeviceProperties prop) {
@@ -753,6 +764,12 @@
             errorLog("Device Properties is null for Device:" + device);
             return;
         }
+        boolean restrict_device_found =
+                SystemProperties.getBoolean("bluetooth.restrict_discovered_device.enabled", false);
+        if (restrict_device_found && (deviceProp.mName == null || deviceProp.mName.isEmpty())) {
+            debugLog("Device name is null or empty: " + device);
+            return;
+        }
 
         Intent intent = new Intent(BluetoothDevice.ACTION_FOUND);
         intent.putExtra(BluetoothDevice.EXTRA_DEVICE, device);
@@ -850,6 +867,8 @@
             if (batteryService != null) {
                 batteryService.connect(device);
             }
+            SecurityLog.writeEvent(SecurityLog.TAG_BLUETOOTH_CONNECTION,
+                    Utils.getLoggableAddress(device), /* success */ 1, /* reason */ "");
             debugLog(
                     "aclStateChangeCallback: Adapter State: " + BluetoothAdapter.nameForState(state)
                             + " Connected: " + device);
@@ -883,6 +902,10 @@
                     deviceProp.setBondingInitiatedLocally(false);
                 }
             }
+            SecurityLog.writeEvent(SecurityLog.TAG_BLUETOOTH_DISCONNECTION,
+                    Utils.getLoggableAddress(device),
+                    BluetoothAdapter.BluetoothConnectionCallback.disconnectReasonToString(
+                            AdapterService.hciToAndroidDisconnectReason(hciReason)));
             debugLog(
                     "aclStateChangeCallback: Adapter State: " + BluetoothAdapter.nameForState(state)
                             + " Disconnected: " + device
diff --git a/android/app/src/com/android/bluetooth/btservice/activityAttribution/ActivityAttributionNativeInterface.java b/android/app/src/com/android/bluetooth/btservice/activityAttribution/ActivityAttributionNativeInterface.java
index 3d924c3..b9cb9d7 100644
--- a/android/app/src/com/android/bluetooth/btservice/activityAttribution/ActivityAttributionNativeInterface.java
+++ b/android/app/src/com/android/bluetooth/btservice/activityAttribution/ActivityAttributionNativeInterface.java
@@ -25,6 +25,8 @@
 
 import com.android.internal.annotations.GuardedBy;
 
+import java.util.Arrays;
+
 /** ActivityAttribution Native Interface to/from JNI. */
 public class ActivityAttributionNativeInterface {
     private static final boolean DBG = false;
@@ -73,7 +75,7 @@
     }
 
     private void onActivityLogsReady(byte[] logs) {
-        Log.i(TAG, "onActivityLogsReady() BTAA: " + logs);
+        Log.i(TAG, "onActivityLogsReady() BTAA: " + Arrays.toString(logs));
     }
 
     // Native methods that call into the JNI interface
diff --git a/android/app/src/com/android/bluetooth/btservice/storage/AudioPolicyEntity.java b/android/app/src/com/android/bluetooth/btservice/storage/AudioPolicyEntity.java
new file mode 100644
index 0000000..d5ec422
--- /dev/null
+++ b/android/app/src/com/android/bluetooth/btservice/storage/AudioPolicyEntity.java
@@ -0,0 +1,61 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.btservice.storage;
+
+import android.bluetooth.BluetoothSinkAudioPolicy;
+
+import androidx.room.ColumnInfo;
+import androidx.room.Entity;
+
+@Entity
+class AudioPolicyEntity {
+    @ColumnInfo(name = "call_establish_audio_policy")
+    public int callEstablishAudioPolicy;
+    @ColumnInfo(name = "connecting_time_audio_policy")
+    public int connectingTimeAudioPolicy;
+    @ColumnInfo(name = "in_band_ringtone_audio_policy")
+    public int inBandRingtoneAudioPolicy;
+
+    AudioPolicyEntity() {
+        callEstablishAudioPolicy = BluetoothSinkAudioPolicy.POLICY_UNCONFIGURED;
+        connectingTimeAudioPolicy = BluetoothSinkAudioPolicy.POLICY_UNCONFIGURED;
+        inBandRingtoneAudioPolicy = BluetoothSinkAudioPolicy.POLICY_UNCONFIGURED;
+    }
+
+    AudioPolicyEntity(int callEstablishAudioPolicy, int connectingTimeAudioPolicy,
+            int inBandRingtoneAudioPolicy) {
+        this.callEstablishAudioPolicy = callEstablishAudioPolicy;
+        this.connectingTimeAudioPolicy = connectingTimeAudioPolicy;
+        this.inBandRingtoneAudioPolicy = inBandRingtoneAudioPolicy;
+    }
+
+    public String toString() {
+        StringBuilder builder = new StringBuilder();
+        builder.append("callEstablishAudioPolicy=")
+                .append(metadataToString(callEstablishAudioPolicy))
+                .append("|connectingTimeAudioPolicy=")
+                .append(metadataToString(connectingTimeAudioPolicy))
+                .append("|inBandRingtoneAudioPolicy=")
+                .append(metadataToString(inBandRingtoneAudioPolicy));
+
+        return builder.toString();
+    }
+
+    private String metadataToString(int metadata) {
+        return String.valueOf(metadata);
+    }
+}
diff --git a/android/app/src/com/android/bluetooth/btservice/storage/BluetoothDatabaseMigration.java b/android/app/src/com/android/bluetooth/btservice/storage/BluetoothDatabaseMigration.java
new file mode 100644
index 0000000..a56c6a4
--- /dev/null
+++ b/android/app/src/com/android/bluetooth/btservice/storage/BluetoothDatabaseMigration.java
@@ -0,0 +1,197 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.btservice.storage;
+
+import android.bluetooth.BluetoothA2dp;
+import android.bluetooth.BluetoothDevice;
+import android.bluetooth.BluetoothProfile;
+import android.bluetooth.BluetoothUtils;
+import android.content.Context;
+import android.database.Cursor;
+import android.util.Log;
+import android.util.Pair;
+
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.List;
+
+/**
+ * Class for regrouping the migration that occur when going mainline
+ * @hide
+ */
+public final class BluetoothDatabaseMigration {
+    private static final String TAG = "BluetoothDatabaseMigration";
+    /**
+     * @hide
+     */
+    public static boolean run(Context ctx, Cursor cursor) {
+        boolean result = true;
+        MetadataDatabase database = MetadataDatabase.createDatabaseWithoutMigration(ctx);
+        while (cursor.moveToNext()) {
+            try {
+                final String primaryKey = cursor.getString(cursor.getColumnIndexOrThrow("address"));
+                String logKey = BluetoothUtils.toAnonymizedAddress(primaryKey);
+                if (logKey == null) { // handle non device address
+                    logKey = primaryKey;
+                }
+
+                Metadata metadata = new Metadata(primaryKey);
+
+                metadata.migrated = fetchInt(cursor, "migrated") > 0;
+                migrate_a2dpSupportsOptionalCodecs(cursor, logKey, metadata);
+                migrate_a2dpOptionalCodecsEnabled(cursor, logKey, metadata);
+                metadata.last_active_time = fetchInt(cursor, "last_active_time");
+                metadata.is_active_a2dp_device = fetchInt(cursor, "is_active_a2dp_device") > 0;
+                migrate_connectionPolicy(cursor, logKey, metadata);
+                migrate_customizedMeta(cursor, metadata);
+
+                database.insert(metadata);
+                Log.d(TAG, "One item migrated: " + metadata);
+            } catch (IllegalArgumentException e) {
+                Log.e(TAG, "Failed to migrate one item: " + e);
+                result = false;
+            }
+        }
+        return result;
+    }
+
+    private static final List<Pair<Integer, String>> CONNECTION_POLICIES =
+            Arrays.asList(
+            new Pair(BluetoothProfile.A2DP, "a2dp_connection_policy"),
+            new Pair(BluetoothProfile.A2DP_SINK, "a2dp_sink_connection_policy"),
+            new Pair(BluetoothProfile.HEADSET, "hfp_connection_policy"),
+            new Pair(BluetoothProfile.HEADSET_CLIENT, "hfp_client_connection_policy"),
+            new Pair(BluetoothProfile.HID_HOST, "hid_host_connection_policy"),
+            new Pair(BluetoothProfile.PAN, "pan_connection_policy"),
+            new Pair(BluetoothProfile.PBAP, "pbap_connection_policy"),
+            new Pair(BluetoothProfile.PBAP_CLIENT, "pbap_client_connection_policy"),
+            new Pair(BluetoothProfile.MAP, "map_connection_policy"),
+            new Pair(BluetoothProfile.SAP, "sap_connection_policy"),
+            new Pair(BluetoothProfile.HEARING_AID, "hearing_aid_connection_policy"),
+            new Pair(BluetoothProfile.HAP_CLIENT, "hap_client_connection_policy"),
+            new Pair(BluetoothProfile.MAP_CLIENT, "map_client_connection_policy"),
+            new Pair(BluetoothProfile.LE_AUDIO, "le_audio_connection_policy"),
+            new Pair(BluetoothProfile.VOLUME_CONTROL, "volume_control_connection_policy"),
+            new Pair(BluetoothProfile.CSIP_SET_COORDINATOR,
+                "csip_set_coordinator_connection_policy"),
+            new Pair(BluetoothProfile.LE_CALL_CONTROL, "le_call_control_connection_policy"),
+            new Pair(BluetoothProfile.LE_AUDIO_BROADCAST_ASSISTANT,
+                "bass_client_connection_policy"),
+            new Pair(BluetoothProfile.BATTERY, "battery_connection_policy")
+    );
+
+    private static final List<Pair<Integer, String>> CUSTOMIZED_META_KEYS =
+            Arrays.asList(
+            new Pair(BluetoothDevice.METADATA_MANUFACTURER_NAME, "manufacturer_name"),
+            new Pair(BluetoothDevice.METADATA_MODEL_NAME, "model_name"),
+            new Pair(BluetoothDevice.METADATA_SOFTWARE_VERSION, "software_version"),
+            new Pair(BluetoothDevice.METADATA_HARDWARE_VERSION, "hardware_version"),
+            new Pair(BluetoothDevice.METADATA_COMPANION_APP, "companion_app"),
+            new Pair(BluetoothDevice.METADATA_MAIN_ICON, "main_icon"),
+            new Pair(BluetoothDevice.METADATA_IS_UNTETHERED_HEADSET, "is_untethered_headset"),
+            new Pair(BluetoothDevice.METADATA_UNTETHERED_LEFT_ICON, "untethered_left_icon"),
+            new Pair(BluetoothDevice.METADATA_UNTETHERED_RIGHT_ICON, "untethered_right_icon"),
+            new Pair(BluetoothDevice.METADATA_UNTETHERED_CASE_ICON, "untethered_case_icon"),
+            new Pair(BluetoothDevice.METADATA_UNTETHERED_LEFT_BATTERY,
+                "untethered_left_battery"),
+            new Pair(BluetoothDevice.METADATA_UNTETHERED_RIGHT_BATTERY,
+                "untethered_right_battery"),
+            new Pair(BluetoothDevice.METADATA_UNTETHERED_CASE_BATTERY,
+                "untethered_case_battery"),
+            new Pair(BluetoothDevice.METADATA_UNTETHERED_LEFT_CHARGING,
+                "untethered_left_charging"),
+            new Pair(BluetoothDevice.METADATA_UNTETHERED_RIGHT_CHARGING,
+                "untethered_right_charging"),
+            new Pair(BluetoothDevice.METADATA_UNTETHERED_CASE_CHARGING,
+                    "untethered_case_charging"),
+            new Pair(BluetoothDevice.METADATA_ENHANCED_SETTINGS_UI_URI,
+                    "enhanced_settings_ui_uri"),
+            new Pair(BluetoothDevice.METADATA_DEVICE_TYPE, "device_type"),
+            new Pair(BluetoothDevice.METADATA_MAIN_BATTERY, "main_battery"),
+            new Pair(BluetoothDevice.METADATA_MAIN_CHARGING, "main_charging"),
+            new Pair(BluetoothDevice.METADATA_MAIN_LOW_BATTERY_THRESHOLD,
+                    "main_low_battery_threshold"),
+            new Pair(BluetoothDevice.METADATA_UNTETHERED_LEFT_LOW_BATTERY_THRESHOLD,
+                    "untethered_left_low_battery_threshold"),
+            new Pair(BluetoothDevice.METADATA_UNTETHERED_RIGHT_LOW_BATTERY_THRESHOLD,
+                    "untethered_right_low_battery_threshold"),
+            new Pair(BluetoothDevice.METADATA_UNTETHERED_CASE_LOW_BATTERY_THRESHOLD,
+                    "untethered_case_low_battery_threshold"),
+            new Pair(BluetoothDevice.METADATA_SPATIAL_AUDIO, "spatial_audio"),
+            new Pair(BluetoothDevice.METADATA_FAST_PAIR_CUSTOMIZED_FIELDS,
+                    "fastpair_customized")
+    );
+
+    private static int fetchInt(Cursor cursor, String key) {
+        return cursor.getInt(cursor.getColumnIndexOrThrow(key));
+    }
+
+    private static void migrate_a2dpSupportsOptionalCodecs(Cursor cursor, String logKey,
+            Metadata metadata) {
+        final String key = "a2dpSupportsOptionalCodecs";
+        final List<Integer> allowedValue =  new ArrayList<>(Arrays.asList(
+                BluetoothA2dp.OPTIONAL_CODECS_SUPPORT_UNKNOWN,
+                BluetoothA2dp.OPTIONAL_CODECS_NOT_SUPPORTED,
+                BluetoothA2dp.OPTIONAL_CODECS_SUPPORTED));
+        final int value = fetchInt(cursor, key);
+        if (!allowedValue.contains(value)) {
+            throw new IllegalArgumentException(logKey + ": Bad value for [" + key + "]: " + value);
+        }
+        metadata.a2dpSupportsOptionalCodecs = value;
+    }
+
+    private static void migrate_a2dpOptionalCodecsEnabled(Cursor cursor, String logKey,
+            Metadata metadata) {
+        final String key = "a2dpOptionalCodecsEnabled";
+        final List<Integer> allowedValue =  new ArrayList<>(Arrays.asList(
+                BluetoothA2dp.OPTIONAL_CODECS_PREF_UNKNOWN,
+                BluetoothA2dp.OPTIONAL_CODECS_PREF_DISABLED,
+                BluetoothA2dp.OPTIONAL_CODECS_PREF_ENABLED));
+        final int value = fetchInt(cursor, key);
+        if (!allowedValue.contains(value)) {
+            throw new IllegalArgumentException(logKey + ": Bad value for [" + key + "]: " + value);
+        }
+        metadata.a2dpOptionalCodecsEnabled = value;
+    }
+
+    private static void migrate_connectionPolicy(Cursor cursor, String logKey,
+            Metadata metadata) {
+        final List<Integer> allowedValue =  new ArrayList<>(Arrays.asList(
+                BluetoothProfile.CONNECTION_POLICY_UNKNOWN,
+                BluetoothProfile.CONNECTION_POLICY_FORBIDDEN,
+                BluetoothProfile.CONNECTION_POLICY_ALLOWED));
+        for (Pair<Integer, String> p : CONNECTION_POLICIES) {
+            final int policy = cursor.getInt(cursor.getColumnIndexOrThrow(p.second));
+            if (allowedValue.contains(policy)) {
+                metadata.setProfileConnectionPolicy(p.first, policy);
+            } else {
+                throw new IllegalArgumentException(logKey + ": Bad value for ["
+                        + BluetoothProfile.getProfileName(p.first)
+                        + "]: " + policy);
+            }
+        }
+    }
+
+    private static void migrate_customizedMeta(Cursor cursor, Metadata metadata) {
+        for (Pair<Integer, String> p : CUSTOMIZED_META_KEYS) {
+            final byte[] blob = cursor.getBlob(cursor.getColumnIndexOrThrow(p.second));
+            // There is no specific pattern to check the custom meta data
+            metadata.setCustomizedMeta(p.first, blob);
+        }
+    }
+
+}
diff --git a/android/app/src/com/android/bluetooth/btservice/storage/CustomizedMetadataEntity.java b/android/app/src/com/android/bluetooth/btservice/storage/CustomizedMetadataEntity.java
index 554e075..e2f0765 100644
--- a/android/app/src/com/android/bluetooth/btservice/storage/CustomizedMetadataEntity.java
+++ b/android/app/src/com/android/bluetooth/btservice/storage/CustomizedMetadataEntity.java
@@ -46,6 +46,9 @@
     public byte[] untethered_case_low_battery_threshold;
     public byte[] spatial_audio;
     public byte[] fastpair_customized;
+    public byte[] le_audio;
+    public byte[] gmcs_cccd;
+    public byte[] gtbs_cccd;
 
     public String toString() {
         StringBuilder builder = new StringBuilder();
@@ -100,7 +103,14 @@
                 .append("|spatial_audio=")
                 .append(metadataToString(spatial_audio))
                 .append("|fastpair_customized=")
-                .append(metadataToString(fastpair_customized));
+                .append(metadataToString(fastpair_customized))
+                .append("|le_audio=")
+                .append(metadataToString(le_audio))
+                .append("|gmcs_cccd=")
+                .append(metadataToString(gmcs_cccd))
+                .append("|gtbs_cccd=")
+                .append(metadataToString(gtbs_cccd));
+
 
         return builder.toString();
     }
diff --git a/android/app/src/com/android/bluetooth/btservice/storage/DatabaseManager.java b/android/app/src/com/android/bluetooth/btservice/storage/DatabaseManager.java
index 4bc32b4..cd81c9d 100644
--- a/android/app/src/com/android/bluetooth/btservice/storage/DatabaseManager.java
+++ b/android/app/src/com/android/bluetooth/btservice/storage/DatabaseManager.java
@@ -23,6 +23,7 @@
 import android.bluetooth.BluetoothDevice;
 import android.bluetooth.BluetoothProfile;
 import android.bluetooth.BluetoothProtoEnums;
+import android.bluetooth.BluetoothSinkAudioPolicy;
 import android.content.BroadcastReceiver;
 import android.content.ContentResolver;
 import android.content.Context;
@@ -284,6 +285,60 @@
     }
 
     /**
+     * Set audio policy metadata to database with requested key
+     */
+    @VisibleForTesting
+    public boolean setAudioPolicyMetadata(BluetoothDevice device,
+            BluetoothSinkAudioPolicy policies) {
+        synchronized (mMetadataCache) {
+            if (device == null) {
+                Log.e(TAG, "setAudioPolicyMetadata: device is null");
+                return false;
+            }
+
+            String address = device.getAddress();
+            if (!mMetadataCache.containsKey(address)) {
+                createMetadata(address, false);
+            }
+            Metadata data = mMetadataCache.get(address);
+            AudioPolicyEntity entity = data.audioPolicyMetadata;
+            entity.callEstablishAudioPolicy = policies.getCallEstablishPolicy();
+            entity.connectingTimeAudioPolicy = policies.getActiveDevicePolicyAfterConnection();
+            entity.inBandRingtoneAudioPolicy = policies.getInBandRingtonePolicy();
+
+            updateDatabase(data);
+            return true;
+        }
+    }
+
+    /**
+     * Get audio policy metadata from database with requested key
+     */
+    @VisibleForTesting
+    public BluetoothSinkAudioPolicy getAudioPolicyMetadata(BluetoothDevice device) {
+        synchronized (mMetadataCache) {
+            if (device == null) {
+                Log.e(TAG, "getAudioPolicyMetadata: device is null");
+                return null;
+            }
+
+            String address = device.getAddress();
+
+            if (!mMetadataCache.containsKey(address)) {
+                Log.d(TAG, "getAudioPolicyMetadata: device " + address + " is not in cache");
+                return null;
+            }
+
+            AudioPolicyEntity entity = mMetadataCache.get(address).audioPolicyMetadata;
+            return new BluetoothSinkAudioPolicy.Builder()
+                    .setCallEstablishPolicy(entity.callEstablishAudioPolicy)
+                    .setActiveDevicePolicyAfterConnection(entity.connectingTimeAudioPolicy)
+                    .setInBandRingtonePolicy(entity.inBandRingtoneAudioPolicy)
+                    .build();
+        }
+    }
+
+    /**
      * Set the device profile connection policy
      *
      * @param device {@link BluetoothDevice} wish to set
@@ -638,6 +693,38 @@
     }
 
     /**
+     * Gets the most recently connected bluetooth device in a given list.
+     *
+     * @param devicesList the list of {@link BluetoothDevice} to search in
+     * @return the most recently connected {@link BluetoothDevice} in the given
+     *         {@code devicesList}, or null if an error occurred
+     *
+     * @hide
+     */
+    public BluetoothDevice getMostRecentlyConnectedDevicesInList(
+            List<BluetoothDevice> devicesList) {
+        if (devicesList == null) {
+            return null;
+        }
+
+        BluetoothDevice mostRecentDevice = null;
+        long mostRecentLastActiveTime = -1;
+        synchronized (mMetadataCache) {
+            for (BluetoothDevice device : devicesList) {
+                String address = device.getAddress();
+                Metadata metadata = mMetadataCache.get(address);
+                if (metadata != null && (mostRecentLastActiveTime == -1
+                            || mostRecentLastActiveTime < metadata.last_active_time)) {
+                    mostRecentLastActiveTime = metadata.last_active_time;
+                    mostRecentDevice = device;
+                }
+
+            }
+        }
+        return mostRecentDevice;
+    }
+
+    /**
      * Gets the last active a2dp device
      *
      * @return the most recently active a2dp device or null if the last a2dp device was null
diff --git a/android/app/src/com/android/bluetooth/btservice/storage/Metadata.java b/android/app/src/com/android/bluetooth/btservice/storage/Metadata.java
index 91e33e0..756b6d7 100644
--- a/android/app/src/com/android/bluetooth/btservice/storage/Metadata.java
+++ b/android/app/src/com/android/bluetooth/btservice/storage/Metadata.java
@@ -21,17 +21,24 @@
 import android.bluetooth.BluetoothA2dp.OptionalCodecsSupportStatus;
 import android.bluetooth.BluetoothDevice;
 import android.bluetooth.BluetoothProfile;
+import android.bluetooth.BluetoothUtils;
 
 import androidx.annotation.NonNull;
 import androidx.room.Embedded;
 import androidx.room.Entity;
 import androidx.room.PrimaryKey;
 
+import com.android.internal.annotations.VisibleForTesting;
+
 import java.util.ArrayList;
 import java.util.List;
 
+/**
+ * @hide
+ */
 @Entity(tableName = "metadata")
-class Metadata {
+@VisibleForTesting
+public class Metadata {
     @PrimaryKey
     @NonNull
     private String address;
@@ -51,6 +58,25 @@
     public long last_active_time;
     public boolean is_active_a2dp_device;
 
+    @Embedded
+    public AudioPolicyEntity audioPolicyMetadata;
+
+    /**
+     * The preferred profile to be used for {@link BluetoothDevice#AUDIO_MODE_OUTPUT_ONLY}. This can
+     * be either {@link BluetoothProfile#A2DP} or {@link BluetoothProfile#LE_AUDIO}. This value is
+     * only used if the remote device supports both A2DP and LE Audio and both transports are
+     * connected and active.
+     */
+    public int preferred_output_only_profile;
+
+    /**
+     * The preferred profile to be used for {@link BluetoothDevice#AUDIO_MODE_DUPLEX}. This can
+     * be either {@link BluetoothProfile#HEADSET} or {@link BluetoothProfile#LE_AUDIO}. This value
+     * is only used if the remote device supports both HFP and LE Audio and both transports are
+     * connected and active.
+     */
+    public int preferred_duplex_profile;
+
     Metadata(String address) {
         this.address = address;
         migrated = false;
@@ -60,9 +86,16 @@
         a2dpOptionalCodecsEnabled = BluetoothA2dp.OPTIONAL_CODECS_PREF_UNKNOWN;
         last_active_time = MetadataDatabase.sCurrentConnectionNumber++;
         is_active_a2dp_device = true;
+        audioPolicyMetadata = new AudioPolicyEntity();
+        preferred_output_only_profile = 0;
+        preferred_duplex_profile = 0;
     }
 
-    String getAddress() {
+    /**
+     * @hide
+     */
+    @VisibleForTesting
+    public String getAddress() {
         return address;
     }
 
@@ -75,7 +108,7 @@
      */
     @NonNull
     public String getAnonymizedAddress() {
-        return "XX:XX:XX" + getAddress().substring(8);
+        return BluetoothUtils.toAnonymizedAddress(address);
     }
 
     void setProfileConnectionPolicy(int profile, int connectionPolicy) {
@@ -148,7 +181,11 @@
         }
     }
 
-    int getProfileConnectionPolicy(int profile) {
+    /**
+     * @hide
+     */
+    @VisibleForTesting
+    public int getProfileConnectionPolicy(int profile) {
         switch (profile) {
             case BluetoothProfile.A2DP:
                 return profileConnectionPolicies.a2dp_connection_policy;
@@ -272,10 +309,23 @@
             case BluetoothDevice.METADATA_FAST_PAIR_CUSTOMIZED_FIELDS:
                 publicMetadata.fastpair_customized = value;
                 break;
+            case BluetoothDevice.METADATA_LE_AUDIO:
+                publicMetadata.le_audio = value;
+                break;
+            case BluetoothDevice.METADATA_GMCS_CCCD:
+                publicMetadata.gmcs_cccd = value;
+                break;
+            case BluetoothDevice.METADATA_GTBS_CCCD:
+                publicMetadata.gtbs_cccd = value;
+                break;
         }
     }
 
-    byte[] getCustomizedMeta(int key) {
+    /**
+     * @hide
+     */
+    @VisibleForTesting
+    public byte[] getCustomizedMeta(int key) {
         byte[] value = null;
         switch (key) {
             case BluetoothDevice.METADATA_MANUFACTURER_NAME:
@@ -356,6 +406,15 @@
             case BluetoothDevice.METADATA_FAST_PAIR_CUSTOMIZED_FIELDS:
                 value = publicMetadata.fastpair_customized;
                 break;
+            case BluetoothDevice.METADATA_LE_AUDIO:
+                value = publicMetadata.le_audio;
+                break;
+            case BluetoothDevice.METADATA_GMCS_CCCD:
+                value = publicMetadata.gmcs_cccd;
+                break;
+            case BluetoothDevice.METADATA_GTBS_CCCD:
+                value = publicMetadata.gtbs_cccd;
+                break;
         }
         return value;
     }
@@ -372,7 +431,8 @@
 
     public String toString() {
         StringBuilder builder = new StringBuilder();
-        builder.append(address)
+        builder.append(getAnonymizedAddress())
+            .append(" last_active_time=" + last_active_time)
             .append(" {profile connection policy(")
             .append(profileConnectionPolicies)
             .append("), optional codec(support=")
@@ -381,6 +441,8 @@
             .append(a2dpOptionalCodecsEnabled)
             .append("), custom metadata(")
             .append(publicMetadata)
+            .append("), hfp client audio policy(")
+            .append(audioPolicyMetadata)
             .append(")}");
 
         return builder.toString();
diff --git a/android/app/src/com/android/bluetooth/btservice/storage/MetadataDatabase.java b/android/app/src/com/android/bluetooth/btservice/storage/MetadataDatabase.java
index a2db277..2776e65 100644
--- a/android/app/src/com/android/bluetooth/btservice/storage/MetadataDatabase.java
+++ b/android/app/src/com/android/bluetooth/btservice/storage/MetadataDatabase.java
@@ -33,7 +33,7 @@
 /**
  * MetadataDatabase is a Room database stores Bluetooth persistence data
  */
-@Database(entities = {Metadata.class}, version = 113)
+@Database(entities = {Metadata.class}, version = 117)
 public abstract class MetadataDatabase extends RoomDatabase {
     /**
      * The metadata database file name
@@ -66,6 +66,10 @@
                 .addMigrations(MIGRATION_110_111)
                 .addMigrations(MIGRATION_111_112)
                 .addMigrations(MIGRATION_112_113)
+                .addMigrations(MIGRATION_113_114)
+                .addMigrations(MIGRATION_114_115)
+                .addMigrations(MIGRATION_115_116)
+                .addMigrations(MIGRATION_116_117)
                 .allowMainThreadQueries()
                 .build();
     }
@@ -483,4 +487,83 @@
             }
         }
     };
+
+    @VisibleForTesting
+    static final Migration MIGRATION_113_114 = new Migration(113, 114) {
+        @Override
+        public void migrate(SupportSQLiteDatabase database) {
+            try {
+                database.execSQL("ALTER TABLE metadata ADD COLUMN `le_audio` BLOB");
+            } catch (SQLException ex) {
+                // Check if user has new schema, but is just missing the version update
+                Cursor cursor = database.query("SELECT * FROM metadata");
+                if (cursor == null || cursor.getColumnIndex("le_audio") == -1) {
+                    throw ex;
+                }
+            }
+        }
+    };
+
+    @VisibleForTesting
+    static final Migration MIGRATION_114_115 = new Migration(114, 115) {
+        @Override
+        public void migrate(SupportSQLiteDatabase database) {
+            try {
+                database.execSQL(
+                        "ALTER TABLE metadata ADD COLUMN `call_establish_audio_policy` "
+                        + "INTEGER DEFAULT 0");
+                database.execSQL(
+                        "ALTER TABLE metadata ADD COLUMN `connecting_time_audio_policy` "
+                        + "INTEGER DEFAULT 0");
+                database.execSQL(
+                        "ALTER TABLE metadata ADD COLUMN `in_band_ringtone_audio_policy` "
+                        + "INTEGER DEFAULT 0");
+            } catch (SQLException ex) {
+                // Check if user has new schema, but is just missing the version update
+                Cursor cursor = database.query("SELECT * FROM metadata");
+                if (cursor == null
+                        || cursor.getColumnIndex("call_establish_audio_policy") == -1) {
+                    throw ex;
+                }
+            }
+        }
+    };
+
+    @VisibleForTesting
+    static final Migration MIGRATION_115_116 = new Migration(115, 116) {
+        @Override
+        public void migrate(SupportSQLiteDatabase database) {
+            try {
+                database.execSQL("ALTER TABLE metadata ADD COLUMN `preferred_output_only_profile` "
+                        + "INTEGER NOT NULL DEFAULT 0");
+                database.execSQL("ALTER TABLE metadata ADD COLUMN `preferred_duplex_profile` "
+                        + "INTEGER NOT NULL DEFAULT 0");
+            } catch (SQLException ex) {
+                // Check if user has new schema, but is just missing the version update
+                Cursor cursor = database.query("SELECT * FROM metadata");
+                if (cursor == null
+                        || cursor.getColumnIndex("preferred_output_only_profile") == -1
+                        || cursor.getColumnIndex("preferred_duplex_profile") == -1) {
+                    throw ex;
+                }
+            }
+        }
+    };
+
+    @VisibleForTesting
+    static final Migration MIGRATION_116_117 = new Migration(116, 117) {
+        @Override
+        public void migrate(SupportSQLiteDatabase database) {
+            try {
+                database.execSQL("ALTER TABLE metadata ADD COLUMN `gmcs_cccd` BLOB");
+                database.execSQL("ALTER TABLE metadata ADD COLUMN `gtbs_cccd` BLOB");
+            } catch (SQLException ex) {
+                // Check if user has new schema, but is just missing the version update
+                Cursor cursor = database.query("SELECT * FROM metadata");
+                if (cursor == null || cursor.getColumnIndex("gmcs_cccd") == -1) {
+                    throw ex;
+                }
+            }
+        }
+    };
 }
diff --git a/android/app/src/com/android/bluetooth/csip/CsipSetCoordinatorService.java b/android/app/src/com/android/bluetooth/csip/CsipSetCoordinatorService.java
index 08e7809..6c87ed0 100644
--- a/android/app/src/com/android/bluetooth/csip/CsipSetCoordinatorService.java
+++ b/android/app/src/com/android/bluetooth/csip/CsipSetCoordinatorService.java
@@ -52,6 +52,7 @@
 import com.android.modules.utils.SynchronousResultReceiver;
 
 import java.util.ArrayList;
+import java.util.Collections;
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
@@ -277,6 +278,7 @@
             CsipSetCoordinatorStateMachine smConnect = getOrCreateStateMachine(device);
             if (smConnect == null) {
                 Log.e(TAG, "Cannot connect to " + device + " : no state machine");
+                return false;
             }
             smConnect.sendMessage(CsipSetCoordinatorStateMachine.CONNECT);
         }
@@ -585,7 +587,7 @@
 
     /**
      * Get collection of group IDs for a given UUID
-     * @param uuid
+     * @param uuid profile context UUID
      * @return list of group IDs
      */
     public List<Integer> getAllGroupIds(ParcelUuid uuid) {
@@ -597,8 +599,26 @@
     }
 
     /**
+     * Get group ID for a given device and UUID
+     * @param device potential group member
+     * @param uuid profile context UUID
+     * @return group ID
+     */
+    public Integer getGroupId(BluetoothDevice device, ParcelUuid uuid) {
+        Map<Integer, Integer> device_groups =
+                mDeviceGroupIdRankMap.getOrDefault(device, new HashMap<>());
+        return mGroupIdToUuidMap.entrySet()
+                .stream()
+                .filter(e -> (device_groups.containsKey(e.getKey())
+                        && e.getValue().equals(uuid)))
+                .map(Map.Entry::getKey)
+                .findFirst()
+                .orElse(IBluetoothCsipSetCoordinator.CSIS_GROUP_ID_INVALID);
+    }
+
+    /**
      * Get device's groups/
-     * @param device
+     * @param device group member device
      * @return map of group id and related uuids.
      */
     public Map<Integer, ParcelUuid> getGroupUuidMapByDevice(BluetoothDevice device) {
@@ -634,6 +654,24 @@
     }
 
     /**
+     * Get grouped devices
+     * @param device group member device
+     * @param uuid profile context UUID
+     * @return related list of devices sorted from the lowest to the highest rank value.
+     */
+    public @NonNull List<BluetoothDevice> getGroupDevicesOrdered(BluetoothDevice device,
+            ParcelUuid uuid) {
+        List<Integer> groupIds = getAllGroupIds(uuid);
+        for (Integer id : groupIds) {
+            List<BluetoothDevice> devices = getGroupDevicesOrdered(id);
+            if (devices.contains(device)) {
+                return devices;
+            }
+        }
+        return Collections.emptyList();
+    }
+
+    /**
      * Get group desired size
      * @param groupId group ID
      * @return the number of group members
@@ -869,6 +907,8 @@
                 return;
             }
             if (sm.getConnectionState() != BluetoothProfile.STATE_DISCONNECTED) {
+                Log.i(TAG, "Disconnecting device because it was unbonded.");
+                disconnect(device);
                 return;
             }
             removeStateMachine(device);
@@ -934,8 +974,11 @@
         private CsipSetCoordinatorService mService;
 
         private CsipSetCoordinatorService getService(AttributionSource source) {
-            if (!Utils.checkCallerIsSystemOrActiveUser(TAG)
-                    || !Utils.checkServiceAvailable(mService, TAG)) {
+            if (Utils.isInstrumentationTestMode()) {
+                return mService;
+            }
+            if (!Utils.checkServiceAvailable(mService, TAG)
+                    || !Utils.checkCallerIsSystemOrActiveOrManagedUser(mService, TAG)) {
                 return null;
             }
 
diff --git a/android/app/src/com/android/bluetooth/csip/CsipSetCoordinatorStateMachine.java b/android/app/src/com/android/bluetooth/csip/CsipSetCoordinatorStateMachine.java
index 5945180..062b004 100644
--- a/android/app/src/com/android/bluetooth/csip/CsipSetCoordinatorStateMachine.java
+++ b/android/app/src/com/android/bluetooth/csip/CsipSetCoordinatorStateMachine.java
@@ -47,7 +47,7 @@
     static final int CONNECT = 1;
     static final int DISCONNECT = 2;
     @VisibleForTesting static final int STACK_EVENT = 101;
-    private static final int CONNECT_TIMEOUT = 201;
+    @VisibleForTesting static final int CONNECT_TIMEOUT = 201;
 
     // NOTE: the value is not "final" - it is modified in the unit tests
     @VisibleForTesting static int sConnectTimeoutMs = 30000; // 30s
diff --git a/android/app/src/com/android/bluetooth/gatt/AdvertiseManager.java b/android/app/src/com/android/bluetooth/gatt/AdvertiseManager.java
index e02fd6f..f1c83b3 100644
--- a/android/app/src/com/android/bluetooth/gatt/AdvertiseManager.java
+++ b/android/app/src/com/android/bluetooth/gatt/AdvertiseManager.java
@@ -30,6 +30,8 @@
 import android.util.Log;
 
 import com.android.bluetooth.btservice.AdapterService;
+import com.android.bluetooth.gatt.GattService.AdvertiserMap;
+import com.android.internal.annotations.VisibleForTesting;
 
 import java.util.Collections;
 import java.util.HashMap;
@@ -40,12 +42,14 @@
  *
  * @hide
  */
-class AdvertiseManager {
+@VisibleForTesting(visibility = VisibleForTesting.Visibility.PACKAGE)
+public class AdvertiseManager {
     private static final boolean DBG = GattServiceConfig.DBG;
     private static final String TAG = GattServiceConfig.TAG_PREFIX + "AdvertiseManager";
 
     private final GattService mService;
     private final AdapterService mAdapterService;
+    private final AdvertiserMap mAdvertiserMap;
     private Handler mHandler;
     Map<IBinder, AdvertiserInfo> mAdvertisers = Collections.synchronizedMap(new HashMap<>());
     static int sTempRegistrationId = -1;
@@ -53,12 +57,14 @@
     /**
      * Constructor of {@link AdvertiseManager}.
      */
-    AdvertiseManager(GattService service, AdapterService adapterService) {
+    AdvertiseManager(GattService service, AdapterService adapterService,
+            AdvertiserMap advertiserMap) {
         if (DBG) {
             Log.d(TAG, "advertise manager created");
         }
         mService = service;
         mAdapterService = adapterService;
+        mAdvertiserMap = advertiserMap;
     }
 
     /**
@@ -157,10 +163,18 @@
         if (status == 0) {
             entry.setValue(
                     new AdvertiserInfo(advertiserId, entry.getValue().deathRecipient, callback));
+
+            mAdvertiserMap.setAdvertiserIdByRegId(regId, advertiserId);
         } else {
             IBinder binder = entry.getKey();
             binder.unlinkToDeath(entry.getValue().deathRecipient, 0);
             mAdvertisers.remove(binder);
+
+            AppAdvertiseStats stats = mAdvertiserMap.getAppAdvertiseStatsById(regId);
+            if (stats != null) {
+                stats.recordAdvertiseStop();
+            }
+            mAdvertiserMap.removeAppAdvertiseStats(regId);
         }
 
         callback.onAdvertisingSetStarted(advertiserId, txPower, status);
@@ -181,6 +195,13 @@
 
         IAdvertisingSetCallback callback = entry.getValue().callback;
         callback.onAdvertisingEnabled(advertiserId, enable, status);
+
+        if (!enable && status != 0) {
+            AppAdvertiseStats stats = mAdvertiserMap.getAppAdvertiseStatsById(advertiserId);
+            if (stats != null) {
+                stats.recordAdvertiseStop();
+            }
+        }
     }
 
     void startAdvertisingSet(AdvertisingSetParameters parameters, AdvertiseData advertiseData,
@@ -203,14 +224,19 @@
             byte[] periodicDataBytes =
                     AdvertiseHelper.advertiseDataToBytes(periodicData, deviceName);
 
-        int cbId = --sTempRegistrationId;
-        mAdvertisers.put(binder, new AdvertiserInfo(cbId, deathRecipient, callback));
+            int cbId = --sTempRegistrationId;
+            mAdvertisers.put(binder, new AdvertiserInfo(cbId, deathRecipient, callback));
 
-        if (DBG) {
-            Log.d(TAG, "startAdvertisingSet() - reg_id=" + cbId + ", callback: " + binder);
-        }
-        startAdvertisingSetNative(parameters, advDataBytes, scanResponseBytes, periodicParameters,
-                periodicDataBytes, duration, maxExtAdvEvents, cbId);
+            if (DBG) {
+                Log.d(TAG, "startAdvertisingSet() - reg_id=" + cbId + ", callback: " + binder);
+            }
+
+            mAdvertiserMap.add(cbId, callback, mService);
+            mAdvertiserMap.recordAdvertiseStart(cbId, parameters, advertiseData,
+                    scanResponse, periodicParameters, periodicData, duration, maxExtAdvEvents);
+
+            startAdvertisingSetNative(parameters, advDataBytes, scanResponseBytes,
+                    periodicParameters, periodicDataBytes, duration, maxExtAdvEvents, cbId);
 
         } catch (IllegalArgumentException e) {
             try {
@@ -276,6 +302,8 @@
         } catch (RemoteException e) {
             Log.i(TAG, "error sending onAdvertisingSetStopped callback", e);
         }
+
+        mAdvertiserMap.recordAdvertiseStop(advertiserId);
     }
 
     void enableAdvertisingSet(int advertiserId, boolean enable, int duration, int maxExtAdvEvents) {
@@ -285,6 +313,9 @@
             return;
         }
         enableAdvertisingSetNative(advertiserId, enable, duration, maxExtAdvEvents);
+
+        mAdvertiserMap.enableAdvertisingSet(advertiserId,
+                enable, duration, maxExtAdvEvents);
     }
 
     void setAdvertisingData(int advertiserId, AdvertiseData data) {
@@ -297,6 +328,8 @@
         try {
             setAdvertisingDataNative(advertiserId,
                     AdvertiseHelper.advertiseDataToBytes(data, deviceName));
+
+            mAdvertiserMap.setAdvertisingData(advertiserId, data);
         } catch (IllegalArgumentException e) {
             try {
                 onAdvertisingDataSet(advertiserId,
@@ -317,6 +350,8 @@
         try {
             setScanResponseDataNative(advertiserId,
                     AdvertiseHelper.advertiseDataToBytes(data, deviceName));
+
+            mAdvertiserMap.setScanResponseData(advertiserId, data);
         } catch (IllegalArgumentException e) {
             try {
                 onScanResponseDataSet(advertiserId,
@@ -334,6 +369,8 @@
             return;
         }
         setAdvertisingParametersNative(advertiserId, parameters);
+
+        mAdvertiserMap.setAdvertisingParameters(advertiserId, parameters);
     }
 
     void setPeriodicAdvertisingParameters(int advertiserId,
@@ -344,6 +381,8 @@
             return;
         }
         setPeriodicAdvertisingParametersNative(advertiserId, parameters);
+
+        mAdvertiserMap.setPeriodicAdvertisingParameters(advertiserId, parameters);
     }
 
     void setPeriodicAdvertisingData(int advertiserId, AdvertiseData data) {
@@ -356,6 +395,8 @@
         try {
             setPeriodicAdvertisingDataNative(advertiserId,
                     AdvertiseHelper.advertiseDataToBytes(data, deviceName));
+
+            mAdvertiserMap.setPeriodicAdvertisingData(advertiserId, data);
         } catch (IllegalArgumentException e) {
             try {
                 onPeriodicAdvertisingDataSet(advertiserId,
@@ -473,6 +514,11 @@
 
         IAdvertisingSetCallback callback = entry.getValue().callback;
         callback.onPeriodicAdvertisingEnabled(advertiserId, enable, status);
+
+        AppAdvertiseStats stats = mAdvertiserMap.getAppAdvertiseStatsById(advertiserId);
+        if (stats != null) {
+            stats.onPeriodicAdvertiseEnabled(enable);
+        }
     }
 
     static {
diff --git a/android/app/src/com/android/bluetooth/gatt/AppAdvertiseStats.java b/android/app/src/com/android/bluetooth/gatt/AppAdvertiseStats.java
new file mode 100644
index 0000000..3e07246
--- /dev/null
+++ b/android/app/src/com/android/bluetooth/gatt/AppAdvertiseStats.java
@@ -0,0 +1,389 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package com.android.bluetooth.gatt;
+
+import android.bluetooth.BluetoothDevice;
+import android.bluetooth.le.AdvertiseData;
+import android.bluetooth.le.AdvertisingSetParameters;
+import android.bluetooth.le.PeriodicAdvertisingParameters;
+import android.os.ParcelUuid;
+import android.util.SparseArray;
+
+import androidx.annotation.VisibleForTesting;
+
+import java.time.Duration;
+import java.time.Instant;
+import java.time.ZoneId;
+import java.time.format.DateTimeFormatter;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Map;
+
+/**
+ * ScanStats class helps keep track of information about scans
+ * on a per application basis.
+ * @hide
+ */
+@VisibleForTesting(otherwise = VisibleForTesting.PACKAGE_PRIVATE)
+public class AppAdvertiseStats {
+    private static final String TAG = AppAdvertiseStats.class.getSimpleName();
+
+    private static DateTimeFormatter sDateFormat = DateTimeFormatter.ofPattern("MM-dd HH:mm:ss")
+            .withZone(ZoneId.systemDefault());
+
+    static final String[] PHY_LE_STRINGS = {"LE_1M", "LE_2M", "LE_CODED"};
+    static final int UUID_STRING_FILTER_LEN = 8;
+
+    // ContextMap here is needed to grab Apps and Connections
+    ContextMap mContextMap;
+
+    // GattService is needed to add scan event protos to be dumped later
+    GattService mGattService;
+
+    static class AppAdvertiserData {
+        public boolean includeDeviceName = false;
+        public boolean includeTxPowerLevel = false;
+        public SparseArray<byte[]> manufacturerData;
+        public Map<ParcelUuid, byte[]> serviceData;
+        public List<ParcelUuid> serviceUuids;
+        AppAdvertiserData(boolean includeDeviceName, boolean includeTxPowerLevel,
+                SparseArray<byte[]> manufacturerData, Map<ParcelUuid, byte[]> serviceData,
+                List<ParcelUuid> serviceUuids) {
+            this.includeDeviceName = includeDeviceName;
+            this.includeTxPowerLevel = includeTxPowerLevel;
+            this.manufacturerData = manufacturerData;
+            this.serviceData = serviceData;
+            this.serviceUuids = serviceUuids;
+        }
+    }
+
+    static class AppAdvertiserRecord {
+        public Instant startTime = null;
+        public Instant stopTime = null;
+        public int duration = 0;
+        public int maxExtendedAdvertisingEvents = 0;
+        AppAdvertiserRecord(Instant startTime) {
+            this.startTime = startTime;
+        }
+    }
+
+    private int mAppUid;
+    private String mAppName;
+    private int mId;
+    private boolean mAdvertisingEnabled = false;
+    private boolean mPeriodicAdvertisingEnabled = false;
+    private int mPrimaryPhy = BluetoothDevice.PHY_LE_1M;
+    private int mSecondaryPhy = BluetoothDevice.PHY_LE_1M;
+    private int mInterval = 0;
+    private int mTxPowerLevel = 0;
+    private boolean mLegacy = false;
+    private boolean mAnonymous = false;
+    private boolean mConnectable = false;
+    private boolean mScannable = false;
+    private AppAdvertiserData mAdvertisingData = null;
+    private AppAdvertiserData mScanResponseData = null;
+    private AppAdvertiserData mPeriodicAdvertisingData = null;
+    private boolean mPeriodicIncludeTxPower = false;
+    private int mPeriodicInterval = 0;
+    public ArrayList<AppAdvertiserRecord> mAdvertiserRecords =
+            new ArrayList<AppAdvertiserRecord>();
+
+    @VisibleForTesting(otherwise = VisibleForTesting.PACKAGE_PRIVATE)
+    public AppAdvertiseStats(int appUid, int id, String name, ContextMap map, GattService service) {
+        this.mAppUid = appUid;
+        this.mId = id;
+        this.mAppName = name;
+        this.mContextMap = map;
+        this.mGattService = service;
+    }
+
+    void recordAdvertiseStart(AdvertisingSetParameters parameters,
+            AdvertiseData advertiseData, AdvertiseData scanResponse,
+            PeriodicAdvertisingParameters periodicParameters, AdvertiseData periodicData,
+            int duration, int maxExtAdvEvents) {
+        mAdvertisingEnabled = true;
+        AppAdvertiserRecord record = new AppAdvertiserRecord(Instant.now());
+        record.duration = duration;
+        record.maxExtendedAdvertisingEvents = maxExtAdvEvents;
+        mAdvertiserRecords.add(record);
+        if (mAdvertiserRecords.size() > 5) {
+            mAdvertiserRecords.remove(0);
+        }
+
+        if (parameters != null) {
+            mPrimaryPhy = parameters.getPrimaryPhy();
+            mSecondaryPhy = parameters.getSecondaryPhy();
+            mInterval = parameters.getInterval();
+            mTxPowerLevel = parameters.getTxPowerLevel();
+            mLegacy = parameters.isLegacy();
+            mAnonymous = parameters.isAnonymous();
+            mConnectable = parameters.isConnectable();
+            mScannable = parameters.isScannable();
+        }
+
+        if (advertiseData != null) {
+            mAdvertisingData = new AppAdvertiserData(advertiseData.getIncludeDeviceName(),
+                    advertiseData.getIncludeTxPowerLevel(),
+                    advertiseData.getManufacturerSpecificData(),
+                    advertiseData.getServiceData(),
+                    advertiseData.getServiceUuids());
+        }
+
+        if (scanResponse != null) {
+            mScanResponseData = new AppAdvertiserData(scanResponse.getIncludeDeviceName(),
+                    scanResponse.getIncludeTxPowerLevel(),
+                    scanResponse.getManufacturerSpecificData(),
+                    scanResponse.getServiceData(),
+                    scanResponse.getServiceUuids());
+        }
+
+        if (periodicData != null) {
+            mPeriodicAdvertisingData = new AppAdvertiserData(
+                    periodicData.getIncludeDeviceName(),
+                    periodicData.getIncludeTxPowerLevel(),
+                    periodicData.getManufacturerSpecificData(),
+                    periodicData.getServiceData(),
+                    periodicData.getServiceUuids());
+        }
+
+        if (periodicParameters != null) {
+            mPeriodicAdvertisingEnabled = true;
+            mPeriodicIncludeTxPower = periodicParameters.getIncludeTxPower();
+            mPeriodicInterval = periodicParameters.getInterval();
+        }
+    }
+
+    void recordAdvertiseStart(int duration, int maxExtAdvEvents) {
+        recordAdvertiseStart(null, null, null, null, null, duration, maxExtAdvEvents);
+    }
+
+    void recordAdvertiseStop() {
+        mAdvertisingEnabled = false;
+        mPeriodicAdvertisingEnabled = false;
+        if (!mAdvertiserRecords.isEmpty()) {
+            AppAdvertiserRecord record = mAdvertiserRecords.get(mAdvertiserRecords.size() - 1);
+            record.stopTime = Instant.now();
+        }
+    }
+
+    void enableAdvertisingSet(boolean enable, int duration, int maxExtAdvEvents) {
+        if (enable) {
+            //if the advertisingSet have not been disabled, skip enabling.
+            if (!mAdvertisingEnabled) {
+                recordAdvertiseStart(duration, maxExtAdvEvents);
+            }
+        } else {
+            //if the advertisingSet have not been enabled, skip disabling.
+            if (mAdvertisingEnabled) {
+                recordAdvertiseStop();
+            }
+        }
+    }
+
+    void setAdvertisingData(AdvertiseData data) {
+        if (mAdvertisingData == null) {
+            mAdvertisingData = new AppAdvertiserData(data.getIncludeDeviceName(),
+                    data.getIncludeTxPowerLevel(),
+                    data.getManufacturerSpecificData(),
+                    data.getServiceData(),
+                    data.getServiceUuids());
+        } else if (data != null) {
+            mAdvertisingData.includeDeviceName = data.getIncludeDeviceName();
+            mAdvertisingData.includeTxPowerLevel = data.getIncludeTxPowerLevel();
+            mAdvertisingData.manufacturerData = data.getManufacturerSpecificData();
+            mAdvertisingData.serviceData = data.getServiceData();
+            mAdvertisingData.serviceUuids = data.getServiceUuids();
+        }
+    }
+
+    void setScanResponseData(AdvertiseData data) {
+        if (mScanResponseData == null) {
+            mScanResponseData = new AppAdvertiserData(data.getIncludeDeviceName(),
+                    data.getIncludeTxPowerLevel(),
+                    data.getManufacturerSpecificData(),
+                    data.getServiceData(),
+                    data.getServiceUuids());
+        } else if (data != null) {
+            mScanResponseData.includeDeviceName = data.getIncludeDeviceName();
+            mScanResponseData.includeTxPowerLevel = data.getIncludeTxPowerLevel();
+            mScanResponseData.manufacturerData = data.getManufacturerSpecificData();
+            mScanResponseData.serviceData = data.getServiceData();
+            mScanResponseData.serviceUuids = data.getServiceUuids();
+        }
+    }
+
+    void setAdvertisingParameters(AdvertisingSetParameters parameters) {
+        if (parameters != null) {
+            mPrimaryPhy = parameters.getPrimaryPhy();
+            mSecondaryPhy = parameters.getSecondaryPhy();
+            mInterval = parameters.getInterval();
+            mTxPowerLevel = parameters.getTxPowerLevel();
+            mLegacy = parameters.isLegacy();
+            mAnonymous = parameters.isAnonymous();
+            mConnectable = parameters.isConnectable();
+            mScannable = parameters.isScannable();
+        }
+    }
+
+    void setPeriodicAdvertisingParameters(PeriodicAdvertisingParameters parameters) {
+        if (parameters != null) {
+            mPeriodicIncludeTxPower = parameters.getIncludeTxPower();
+            mPeriodicInterval = parameters.getInterval();
+        }
+    }
+
+    void setPeriodicAdvertisingData(AdvertiseData data) {
+        if (mPeriodicAdvertisingData == null) {
+            mPeriodicAdvertisingData = new AppAdvertiserData(data.getIncludeDeviceName(),
+                    data.getIncludeTxPowerLevel(),
+                    data.getManufacturerSpecificData(),
+                    data.getServiceData(),
+                    data.getServiceUuids());
+        } else if (data != null) {
+            mPeriodicAdvertisingData.includeDeviceName = data.getIncludeDeviceName();
+            mPeriodicAdvertisingData.includeTxPowerLevel = data.getIncludeTxPowerLevel();
+            mPeriodicAdvertisingData.manufacturerData = data.getManufacturerSpecificData();
+            mPeriodicAdvertisingData.serviceData = data.getServiceData();
+            mPeriodicAdvertisingData.serviceUuids = data.getServiceUuids();
+        }
+    }
+
+    void onPeriodicAdvertiseEnabled(boolean enable) {
+        mPeriodicAdvertisingEnabled = enable;
+    }
+
+    void setId(int id) {
+        this.mId = id;
+    }
+
+    private static String printByteArrayInHex(byte[] data) {
+        final StringBuilder hex = new StringBuilder();
+        for (byte b : data) {
+            hex.append(String.format("%02x", b));
+        }
+        return hex.toString();
+    }
+
+    private static void dumpAppAdvertiserData(StringBuilder sb, AppAdvertiserData advData) {
+        sb.append("\n          └Include Device Name                          : "
+                + advData.includeDeviceName);
+        sb.append("\n          └Include Tx Power Level                       : "
+                + advData.includeTxPowerLevel);
+
+        if (advData.manufacturerData.size() > 0) {
+            sb.append("\n          └Manufacturer Data (length of data)           : "
+                    + advData.manufacturerData.size());
+        }
+
+        if (!advData.serviceData.isEmpty()) {
+            sb.append("\n          └Service Data(UUID, length of data)           : ");
+            for (ParcelUuid uuid : advData.serviceData.keySet()) {
+                sb.append("\n            [" + uuid.toString().substring(0, UUID_STRING_FILTER_LEN)
+                        + "-xxxx-xxxx-xxxx-xxxxxxxxxxxx, "
+                        + advData.serviceData.get(uuid).length + "]");
+            }
+        }
+
+        if (!advData.serviceUuids.isEmpty()) {
+            sb.append("\n          └Service Uuids                                : \n            "
+                    + advData.serviceUuids.toString().substring(0, UUID_STRING_FILTER_LEN)
+                    + "-xxxx-xxxx-xxxx-xxxxxxxxxxxx");
+        }
+    }
+
+    private static String dumpPhyString(int phy) {
+        if (phy > PHY_LE_STRINGS.length) {
+            return Integer.toString(phy);
+        } else {
+            return PHY_LE_STRINGS[phy - 1];
+        }
+    }
+
+    private static void dumpAppAdvertiseStats(StringBuilder sb, AppAdvertiseStats stats) {
+        sb.append("\n      └Advertising:");
+        sb.append("\n        └Interval(0.625ms)                              : "
+                + stats.mInterval);
+        sb.append("\n        └TX POWER(dbm)                                  : "
+                + stats.mTxPowerLevel);
+        sb.append("\n        └Primary Phy                                    : "
+                + dumpPhyString(stats.mPrimaryPhy));
+        sb.append("\n        └Secondary Phy                                  : "
+                + dumpPhyString(stats.mSecondaryPhy));
+        sb.append("\n        └Legacy                                         : "
+                + stats.mLegacy);
+        sb.append("\n        └Anonymous                                      : "
+                + stats.mAnonymous);
+        sb.append("\n        └Connectable                                    : "
+                + stats.mConnectable);
+        sb.append("\n        └Scannable                                      : "
+                + stats.mScannable);
+
+        if (stats.mAdvertisingData != null) {
+            sb.append("\n        └Advertise Data:");
+            dumpAppAdvertiserData(sb, stats.mAdvertisingData);
+        }
+
+        if (stats.mScanResponseData != null) {
+            sb.append("\n        └Scan Response:");
+            dumpAppAdvertiserData(sb, stats.mScanResponseData);
+        }
+
+        if (stats.mPeriodicInterval > 0) {
+            sb.append("\n      └Periodic Advertising Enabled                     : "
+                    + stats.mPeriodicAdvertisingEnabled);
+            sb.append("\n        └Periodic Include TxPower                       : "
+                    + stats.mPeriodicIncludeTxPower);
+            sb.append("\n        └Periodic Interval(1.25ms)                      : "
+                    + stats.mPeriodicInterval);
+        }
+
+        if (stats.mPeriodicAdvertisingData != null) {
+            sb.append("\n        └Periodic Advertise Data:");
+            dumpAppAdvertiserData(sb, stats.mPeriodicAdvertisingData);
+        }
+
+        sb.append("\n");
+    }
+
+    static void dumpToString(StringBuilder sb, AppAdvertiseStats stats) {
+        Instant currentTime = Instant.now();
+
+        sb.append("\n    " + stats.mAppName);
+        sb.append("\n     Advertising ID                                     : "
+                + stats.mId);
+        for (int i = 0; i < stats.mAdvertiserRecords.size(); i++) {
+            AppAdvertiserRecord record = stats.mAdvertiserRecords.get(i);
+
+            sb.append("\n      " + (i + 1) + ":");
+            sb.append("\n        └Start time                                     : "
+                    + sDateFormat.format(record.startTime));
+            if (record.stopTime == null) {
+                Duration timeElapsed = Duration.between(record.startTime, currentTime);
+                sb.append("\n        └Elapsed time                                   : "
+                        + timeElapsed.toMillis() + "ms");
+            } else {
+                sb.append("\n        └Stop time                                      : "
+                        + sDateFormat.format(record.stopTime));
+            }
+            sb.append("\n        └Duration(10ms unit)                            : "
+                    + record.duration);
+            sb.append("\n        └Maximum number of extended advertising events  : "
+                    + record.maxExtendedAdvertisingEvents);
+        }
+
+        dumpAppAdvertiseStats(sb, stats);
+    }
+}
diff --git a/android/app/src/com/android/bluetooth/gatt/AppScanStats.java b/android/app/src/com/android/bluetooth/gatt/AppScanStats.java
index cdd11f3..b6de69d 100644
--- a/android/app/src/com/android/bluetooth/gatt/AppScanStats.java
+++ b/android/app/src/com/android/bluetooth/gatt/AppScanStats.java
@@ -105,29 +105,6 @@
             this.filterString = "";
         }
     }
-
-    static int getNumScanDurationsKept() {
-        return AdapterService.getScanQuotaCount();
-    }
-
-    // This constant defines the time window an app can scan multiple times.
-    // Any single app can scan up to |NUM_SCAN_DURATIONS_KEPT| times during
-    // this window. Once they reach this limit, they must wait until their
-    // earliest recorded scan exits this window.
-    static long getExcessiveScanningPeriodMillis() {
-        return AdapterService.getScanQuotaWindowMillis();
-    }
-
-    // Maximum msec before scan gets downgraded to opportunistic
-    static long getScanTimeoutMillis() {
-        return AdapterService.getScanTimeoutMillis();
-    }
-
-    // Scan mode upgrade duration after scanStart()
-    static long getScanUpgradeDurationMillis() {
-        return AdapterService.getAdapterService().getScanUpgradeDurationMillis();
-    }
-
     public String appName;
     public WorkSource mWorkSource; // Used for BatteryStatsManager
     public final WorkSourceUtil mWorkSourceUtil; // Used for BluetoothStatsLog
@@ -186,14 +163,22 @@
         results++;
     }
 
-    boolean isScanning() {
+    synchronized boolean isScanning() {
         return !mOngoingScans.isEmpty();
     }
 
-    LastScan getScanFromScannerId(int scannerId) {
+    synchronized LastScan getScanFromScannerId(int scannerId) {
         return mOngoingScans.get(scannerId);
     }
 
+    synchronized boolean isScanTimeout(int scannerId) {
+        LastScan onGoingScan = getScanFromScannerId(scannerId);
+        if (onGoingScan == null) {
+            return false;
+        }
+        return onGoingScan.isTimeout;
+    }
+
     synchronized void recordScanStart(ScanSettings settings, List<ScanFilter> filters,
             boolean isFilterScan, boolean isCallbackScan, int scannerId) {
         LastScan existingScan = getScanFromScannerId(scannerId);
diff --git a/android/app/src/com/android/bluetooth/gatt/CallbackInfo.java b/android/app/src/com/android/bluetooth/gatt/CallbackInfo.java
index f6035b3..ab3fe4e 100644
--- a/android/app/src/com/android/bluetooth/gatt/CallbackInfo.java
+++ b/android/app/src/com/android/bluetooth/gatt/CallbackInfo.java
@@ -20,9 +20,7 @@
  * These are held during congestion and reported when congestion clears.
  * @hide
  */
-/*package*/
-
-class CallbackInfo {
+/* package */ class CallbackInfo {
     public String address;
     public int status;
     public int handle;
@@ -58,6 +56,6 @@
         this.address = address;
         this.status = status;
         this.handle = handle;
+        this.value = value;
     }
 }
-
diff --git a/android/app/src/com/android/bluetooth/gatt/ContextMap.java b/android/app/src/com/android/bluetooth/gatt/ContextMap.java
index ed95301..dc9fe86 100644
--- a/android/app/src/com/android/bluetooth/gatt/ContextMap.java
+++ b/android/app/src/com/android/bluetooth/gatt/ContextMap.java
@@ -15,6 +15,9 @@
  */
 package com.android.bluetooth.gatt;
 
+import android.bluetooth.le.AdvertiseData;
+import android.bluetooth.le.AdvertisingSetParameters;
+import android.bluetooth.le.PeriodicAdvertisingParameters;
 import android.os.Binder;
 import android.os.IBinder;
 import android.os.IInterface;
@@ -24,6 +27,13 @@
 import android.os.WorkSource;
 import android.util.Log;
 
+import androidx.annotation.VisibleForTesting;
+
+import com.android.bluetooth.BluetoothMethodProxy;
+import com.android.internal.annotations.GuardedBy;
+
+import com.google.common.collect.EvictingQueue;
+
 import java.util.ArrayList;
 import java.util.HashMap;
 import java.util.HashSet;
@@ -39,7 +49,8 @@
  * This class manages application callbacks and keeps track of GATT connections.
  * @hide
  */
-/*package*/ class ContextMap<C, T> {
+@VisibleForTesting(otherwise = VisibleForTesting.PACKAGE_PRIVATE)
+public class ContextMap<C, T> {
     private static final String TAG = GattServiceConfig.TAG_PREFIX + "ContextMap";
 
     /**
@@ -126,6 +137,15 @@
         }
 
         /**
+         * Creates a new app context for advertiser.
+         */
+        App(int id, C callback, String name) {
+            this.id = id;
+            this.callback = callback;
+            this.name = name;
+        }
+
+        /**
          * Link death recipient
          */
         void linkToDeath(IBinder.DeathRecipient deathRecipient) {
@@ -169,11 +189,22 @@
     }
 
     /** Our internal application list */
+    private final Object mAppsLock = new Object();
+    @GuardedBy("mAppsLock")
     private List<App> mApps = new ArrayList<App>();
 
     /** Internal map to keep track of logging information by app name */
     private HashMap<Integer, AppScanStats> mAppScanStats = new HashMap<Integer, AppScanStats>();
 
+    /** Internal map to keep track of logging information by advertise id */
+    private final Map<Integer, AppAdvertiseStats> mAppAdvertiseStats =
+            new HashMap<Integer, AppAdvertiseStats>();
+
+    private static final int ADVERTISE_STATE_MAX_SIZE = 5;
+
+    private final EvictingQueue<AppAdvertiseStats> mLastAdvertises =
+            EvictingQueue.create(ADVERTISE_STATE_MAX_SIZE);
+
     /** Internal list of connected devices **/
     private Set<Connection> mConnections = new HashSet<Connection>();
 
@@ -201,6 +232,34 @@
     }
 
     /**
+     * Add an entry to the application context list for advertiser.
+     */
+    App add(int id, C callback, GattService service) {
+        int appUid = Binder.getCallingUid();
+        String appName = service.getPackageManager().getNameForUid(appUid);
+        if (appName == null) {
+            // Assign an app name if one isn't found
+            appName = "Unknown App (UID: " + appUid + ")";
+        }
+
+        synchronized (mAppsLock) {
+            synchronized (this) {
+                if (!mAppAdvertiseStats.containsKey(id)) {
+                    AppAdvertiseStats appAdvertiseStats = BluetoothMethodProxy.getInstance()
+                            .createAppAdvertiseStats(appUid, id, appName, this, service);
+                    mAppAdvertiseStats.put(id, appAdvertiseStats);
+                }
+            }
+            App app = getById(appUid);
+            if (app == null) {
+                app = new App(appUid, callback, appName);
+                mApps.add(app);
+            }
+            return app;
+        }
+    }
+
+    /**
      * Remove the context for a given UUID
      */
     void remove(UUID uuid) {
@@ -383,6 +442,135 @@
     }
 
     /**
+     * Remove the context for a given application ID.
+     */
+    void removeAppAdvertiseStats(int id) {
+        synchronized (this) {
+            mAppAdvertiseStats.remove(id);
+        }
+    }
+
+    /**
+     * Get Logging info by ID
+     */
+    AppAdvertiseStats getAppAdvertiseStatsById(int id) {
+        synchronized (this) {
+            return mAppAdvertiseStats.get(id);
+        }
+    }
+
+    /**
+     * update the advertiser ID by the regiseter ID
+     */
+    void setAdvertiserIdByRegId(int regId, int advertiserId) {
+        synchronized (this) {
+            AppAdvertiseStats stats = mAppAdvertiseStats.get(regId);
+            if (stats == null) {
+                return;
+            }
+            stats.setId(advertiserId);
+            mAppAdvertiseStats.remove(regId);
+            mAppAdvertiseStats.put(advertiserId, stats);
+        }
+    }
+
+    void recordAdvertiseStart(int id, AdvertisingSetParameters parameters,
+            AdvertiseData advertiseData, AdvertiseData scanResponse,
+            PeriodicAdvertisingParameters periodicParameters, AdvertiseData periodicData,
+            int duration, int maxExtAdvEvents) {
+        synchronized (this) {
+            AppAdvertiseStats stats = mAppAdvertiseStats.get(id);
+            if (stats == null) {
+                return;
+            }
+            stats.recordAdvertiseStart(parameters, advertiseData, scanResponse,
+                    periodicParameters, periodicData, duration, maxExtAdvEvents);
+        }
+    }
+
+    void recordAdvertiseStop(int id) {
+        synchronized (this) {
+            AppAdvertiseStats stats = mAppAdvertiseStats.get(id);
+            if (stats == null) {
+                return;
+            }
+            stats.recordAdvertiseStop();
+            mAppAdvertiseStats.remove(id);
+            mLastAdvertises.add(stats);
+        }
+    }
+
+    void enableAdvertisingSet(int id, boolean enable, int duration, int maxExtAdvEvents) {
+        synchronized (this) {
+            AppAdvertiseStats stats = mAppAdvertiseStats.get(id);
+            if (stats == null) {
+                return;
+            }
+            stats.enableAdvertisingSet(enable, duration, maxExtAdvEvents);
+        }
+    }
+
+    void setAdvertisingData(int id, AdvertiseData data) {
+        synchronized (this) {
+            AppAdvertiseStats stats = mAppAdvertiseStats.get(id);
+            if (stats == null) {
+                return;
+            }
+            stats.setAdvertisingData(data);
+        }
+    }
+
+    void setScanResponseData(int id, AdvertiseData data) {
+        synchronized (this) {
+            AppAdvertiseStats stats = mAppAdvertiseStats.get(id);
+            if (stats == null) {
+                return;
+            }
+            stats.setScanResponseData(data);
+        }
+    }
+
+    void setAdvertisingParameters(int id, AdvertisingSetParameters parameters) {
+        synchronized (this) {
+            AppAdvertiseStats stats = mAppAdvertiseStats.get(id);
+            if (stats == null) {
+                return;
+            }
+            stats.setAdvertisingParameters(parameters);
+        }
+    }
+
+    void setPeriodicAdvertisingParameters(int id, PeriodicAdvertisingParameters parameters) {
+        synchronized (this) {
+            AppAdvertiseStats stats = mAppAdvertiseStats.get(id);
+            if (stats == null) {
+                return;
+            }
+            stats.setPeriodicAdvertisingParameters(parameters);
+        }
+    }
+
+    void setPeriodicAdvertisingData(int id, AdvertiseData data) {
+        synchronized (this) {
+            AppAdvertiseStats stats = mAppAdvertiseStats.get(id);
+            if (stats == null) {
+                return;
+            }
+            stats.setPeriodicAdvertisingData(data);
+        }
+    }
+
+    void onPeriodicAdvertiseEnabled(int id, boolean enable) {
+        synchronized (this) {
+            AppAdvertiseStats stats = mAppAdvertiseStats.get(id);
+            if (stats == null) {
+                return;
+            }
+            stats.onPeriodicAdvertiseEnabled(enable);
+        }
+    }
+
+    /**
      * Get the device addresses for all connected devices
      */
     Set<String> getConnectedDevices() {
@@ -477,7 +665,9 @@
             while (i.hasNext()) {
                 App entry = i.next();
                 entry.unlinkToDeath();
-                entry.appScanStats.isRegistered = false;
+                if (entry.appScanStats != null) {
+                    entry.appScanStats.isRegistered = false;
+                }
                 i.remove();
             }
         }
@@ -485,6 +675,11 @@
         synchronized (mConnections) {
             mConnections.clear();
         }
+
+        synchronized (this) {
+            mAppAdvertiseStats.clear();
+            mLastAdvertises.clear();
+        }
     }
 
     /**
@@ -514,4 +709,31 @@
             appScanStats.dumpToString(sb);
         }
     }
+
+    /**
+     * Logs advertiser debug information.
+     */
+    void dumpAdvertiser(StringBuilder sb) {
+        synchronized (this) {
+            if (!mLastAdvertises.isEmpty()) {
+                sb.append("\n  last " + mLastAdvertises.size() + " advertising:");
+                for (AppAdvertiseStats stats : mLastAdvertises) {
+                    AppAdvertiseStats.dumpToString(sb, stats);
+                }
+                sb.append("\n");
+            }
+
+            if (!mAppAdvertiseStats.isEmpty()) {
+                sb.append("  Total number of ongoing advertising                   : "
+                        + mAppAdvertiseStats.size());
+                sb.append("\n  Ongoing advertising:");
+                for (Integer key : mAppAdvertiseStats.keySet()) {
+                    AppAdvertiseStats stats = mAppAdvertiseStats.get(key);
+                    AppAdvertiseStats.dumpToString(sb, stats);
+                }
+            }
+            sb.append("\n");
+        }
+        Log.d(TAG, sb.toString());
+    }
 }
diff --git a/android/app/src/com/android/bluetooth/gatt/GattDebugUtils.java b/android/app/src/com/android/bluetooth/gatt/GattDebugUtils.java
index 232477b..0a1bfb3 100644
--- a/android/app/src/com/android/bluetooth/gatt/GattDebugUtils.java
+++ b/android/app/src/com/android/bluetooth/gatt/GattDebugUtils.java
@@ -20,6 +20,9 @@
 import android.os.Bundle;
 import android.util.Log;
 
+import com.android.bluetooth.Utils;
+import com.android.internal.annotations.VisibleForTesting;
+
 import java.util.UUID;
 
 /**
@@ -29,17 +32,23 @@
     private static final String TAG = GattServiceConfig.TAG_PREFIX + "DebugUtils";
     private static final boolean DEBUG_ADMIN = GattServiceConfig.DEBUG_ADMIN;
 
-    private static final String ACTION_GATT_PAIRING_CONFIG =
+    @VisibleForTesting
+    static final String ACTION_GATT_PAIRING_CONFIG =
             "android.bluetooth.action.GATT_PAIRING_CONFIG";
 
-    private static final String ACTION_GATT_TEST_USAGE = "android.bluetooth.action.GATT_TEST_USAGE";
-    private static final String ACTION_GATT_TEST_ENABLE =
+    @VisibleForTesting
+    static final String ACTION_GATT_TEST_USAGE = "android.bluetooth.action.GATT_TEST_USAGE";
+    @VisibleForTesting
+    static final String ACTION_GATT_TEST_ENABLE =
             "android.bluetooth.action.GATT_TEST_ENABLE";
-    private static final String ACTION_GATT_TEST_CONNECT =
+    @VisibleForTesting
+    static final String ACTION_GATT_TEST_CONNECT =
             "android.bluetooth.action.GATT_TEST_CONNECT";
-    private static final String ACTION_GATT_TEST_DISCONNECT =
+    @VisibleForTesting
+    static final String ACTION_GATT_TEST_DISCONNECT =
             "android.bluetooth.action.GATT_TEST_DISCONNECT";
-    private static final String ACTION_GATT_TEST_DISCOVER =
+    @VisibleForTesting
+    static final String ACTION_GATT_TEST_DISCOVER =
             "android.bluetooth.action.GATT_TEST_DISCOVER";
 
     private static final String EXTRA_ENABLE = "enable";
@@ -69,7 +78,7 @@
      *   import com.android.bluetooth.gatt.GattService;
      */
     static boolean handleDebugAction(GattService svc, Intent intent) {
-        if (!DEBUG_ADMIN) {
+        if (!DEBUG_ADMIN && !Utils.isInstrumentationTestMode()) {
             return false;
         }
 
diff --git a/android/app/src/com/android/bluetooth/gatt/GattService.java b/android/app/src/com/android/bluetooth/gatt/GattService.java
index 009315d..c8f589b 100644
--- a/android/app/src/com/android/bluetooth/gatt/GattService.java
+++ b/android/app/src/com/android/bluetooth/gatt/GattService.java
@@ -24,6 +24,7 @@
 import android.app.AppOpsManager;
 import android.app.PendingIntent;
 import android.app.Service;
+import android.content.Context;
 import android.bluetooth.BluetoothAdapter;
 import android.bluetooth.BluetoothDevice;
 import android.bluetooth.BluetoothGatt;
@@ -52,6 +53,8 @@
 import android.companion.CompanionDeviceManager;
 import android.content.AttributionSource;
 import android.content.Intent;
+import android.content.pm.PackageManager.PackageInfoFlags;
+import android.content.pm.PackageManager.NameNotFoundException;
 import android.net.MacAddress;
 import android.os.Binder;
 import android.os.Build;
@@ -75,6 +78,8 @@
 import com.android.bluetooth.Utils;
 import com.android.bluetooth.btservice.AbstractionLayer;
 import com.android.bluetooth.btservice.AdapterService;
+import com.android.bluetooth.btservice.BluetoothAdapterProxy;
+import com.android.bluetooth.btservice.CompanionManager;
 import com.android.bluetooth.btservice.ProfileService;
 import com.android.bluetooth.util.NumberUtils;
 import com.android.internal.annotations.VisibleForTesting;
@@ -141,7 +146,8 @@
     /**
      * The default floor value for LE batch scan report delays greater than 0
      */
-    private static final long DEFAULT_REPORT_DELAY_FLOOR = 5000;
+    @VisibleForTesting
+    static final long DEFAULT_REPORT_DELAY_FLOOR = 5000;
 
     // onFoundLost related constants
     private static final int ADVT_STATE_ONFOUND = 0;
@@ -221,6 +227,13 @@
     ScannerMap mScannerMap = new ScannerMap();
 
     /**
+     * List of our registered advertisers.
+     */
+    static class AdvertiserMap extends ContextMap<IAdvertisingSetCallback, Void> {}
+
+    private AdvertiserMap mAdvertiserMap = new AdvertiserMap();
+
+    /**
      * List of our registered clients.
      */
     class ClientMap extends ContextMap<IBluetoothGattCallback, Void> {}
@@ -257,14 +270,18 @@
 
     /**
      * HashMap used to synchronize writeCharacteristic calls mapping remote device address to
-     * available permit (either 1 or 0).
+     * available permit (connectId or -1).
      */
-    private final HashMap<String, AtomicBoolean> mPermits = new HashMap<>();
+    private final HashMap<String, Integer> mPermits = new HashMap<>();
 
     private AdapterService mAdapterService;
-    private AdvertiseManager mAdvertiseManager;
-    private PeriodicScanManager mPeriodicScanManager;
-    private ScanManager mScanManager;
+    private BluetoothAdapterProxy mBluetoothAdapterProxy;
+    @VisibleForTesting
+    AdvertiseManager mAdvertiseManager;
+    @VisibleForTesting
+    PeriodicScanManager mPeriodicScanManager;
+    @VisibleForTesting
+    ScanManager mScanManager;
     private AppOpsManager mAppOps;
     private CompanionDeviceManager mCompanionManager;
     private String mExposureNotificationPackage;
@@ -297,7 +314,8 @@
     /**
      * Reliable write queue
      */
-    private Set<String> mReliableQueue = new HashSet<String>();
+    @VisibleForTesting
+    Set<String> mReliableQueue = new HashSet<String>();
 
     static {
         classInitNative();
@@ -319,12 +337,13 @@
 
         initializeNative();
         mAdapterService = AdapterService.getAdapterService();
+        mBluetoothAdapterProxy = BluetoothAdapterProxy.getInstance();
         mCompanionManager = getSystemService(CompanionDeviceManager.class);
         mAppOps = getSystemService(AppOpsManager.class);
-        mAdvertiseManager = new AdvertiseManager(this, mAdapterService);
+        mAdvertiseManager = new AdvertiseManager(this, mAdapterService, mAdvertiserMap);
         mAdvertiseManager.start();
 
-        mScanManager = new ScanManager(this, mAdapterService);
+        mScanManager = new ScanManager(this, mAdapterService, mBluetoothAdapterProxy);
         mScanManager.start();
 
         mPeriodicScanManager = new PeriodicScanManager(mAdapterService);
@@ -341,6 +360,7 @@
         }
         setGattService(null);
         mScannerMap.clear();
+        mAdvertiserMap.clear();
         mClientMap.clear();
         mServerMap.clear();
         mHandleMap.clear();
@@ -426,6 +446,15 @@
         return sGattService;
     }
 
+    @VisibleForTesting
+    ScanManager getScanManager() {
+        if (mScanManager == null) {
+            Log.w(TAG, "getScanManager(): scan manager is null");
+            return null;
+        }
+        return mScanManager;
+    }
+
     private static synchronized void setGattService(GattService instance) {
         if (DBG) {
             Log.d(TAG, "setGattService(): set to: " + instance);
@@ -549,7 +578,8 @@
     /**
      * Handlers for incoming service calls
      */
-    private static class BluetoothGattBinder extends IBluetoothGatt.Stub
+    @VisibleForTesting
+    static class BluetoothGattBinder extends IBluetoothGatt.Stub
             implements IProfileServiceBinder {
         private GattService mService;
 
@@ -2013,7 +2043,7 @@
             synchronized (mPermits) {
                 Log.d(TAG, "onConnected() - adding permit for address="
                     + address);
-                mPermits.putIfAbsent(address, new AtomicBoolean(true));
+                mPermits.putIfAbsent(address, -1);
             }
             connectionState = BluetoothProtoEnums.CONNECTION_STATE_CONNECTED;
 
@@ -2024,7 +2054,7 @@
                     (status == BluetoothGatt.GATT_SUCCESS), address);
         }
         statsLogGattConnectionStateChange(
-                BluetoothProfile.GATT, address, clientIf, connectionState);
+                BluetoothProfile.GATT, address, clientIf, connectionState, status);
     }
 
     void onDisconnected(int clientIf, int connId, int status, String address)
@@ -2045,6 +2075,13 @@
                     + address);
                 mPermits.remove(address);
             }
+        } else {
+            synchronized (mPermits) {
+                if (mPermits.get(address) == connId) {
+                    Log.d(TAG, "onDisconnected() - set permit -1 for address=" + address);
+                    mPermits.put(address, -1);
+                }
+            }
         }
 
         if (app != null) {
@@ -2052,7 +2089,7 @@
         }
         statsLogGattConnectionStateChange(
                 BluetoothProfile.GATT, address, clientIf,
-                BluetoothProtoEnums.CONNECTION_STATE_DISCONNECTED);
+                BluetoothProtoEnums.CONNECTION_STATE_DISCONNECTED, status);
     }
 
     void onClientPhyUpdate(int connId, int txPhy, int rxPhy, int status) throws RemoteException {
@@ -2350,7 +2387,7 @@
         synchronized (mPermits) {
             Log.d(TAG, "onWriteCharacteristic() - increasing permit for address="
                     + address);
-            mPermits.get(address).set(true);
+            mPermits.put(address, -1);
         }
 
         if (VDBG) {
@@ -3397,10 +3434,10 @@
             Log.d(TAG, "clientConnect() - address=" + address + ", isDirect=" + isDirect
                     + ", opportunistic=" + opportunistic + ", phy=" + phy);
         }
-        statsLogAppPackage(address, attributionSource.getPackageName());
+        statsLogAppPackage(address, attributionSource.getUid(), clientIf);
         statsLogGattConnectionStateChange(
                 BluetoothProfile.GATT, address, clientIf,
-                BluetoothProtoEnums.CONNECTION_STATE_CONNECTING);
+                BluetoothProtoEnums.CONNECTION_STATE_CONNECTING, -1);
         gattClientConnectNative(clientIf, address, isDirect, transport, opportunistic, phy);
     }
 
@@ -3417,7 +3454,7 @@
         }
         statsLogGattConnectionStateChange(
                 BluetoothProfile.GATT, address, clientIf,
-                BluetoothProtoEnums.CONNECTION_STATE_DISCONNECTING);
+                BluetoothProtoEnums.CONNECTION_STATE_DISCONNECTING, -1);
         gattClientDisconnectNative(clientIf, address, connId != null ? connId : 0);
     }
 
@@ -3643,18 +3680,18 @@
         Log.d(TAG, "writeCharacteristic() - trying to acquire permit.");
         // Lock the thread until onCharacteristicWrite callback comes back.
         synchronized (mPermits) {
-            AtomicBoolean atomicBoolean = mPermits.get(address);
-            if (atomicBoolean == null) {
+            Integer permit = mPermits.get(address);
+            if (permit == null) {
                 Log.d(TAG, "writeCharacteristic() -  atomicBoolean uninitialized!");
                 return BluetoothStatusCodes.ERROR_DEVICE_NOT_CONNECTED;
             }
 
-            boolean success = atomicBoolean.get();
+            boolean success = (permit == -1);
             if (!success) {
                 Log.d(TAG, "writeCharacteristic() - no permit available.");
                 return BluetoothStatusCodes.ERROR_GATT_WRITE_REQUEST_BUSY;
             }
-            atomicBoolean.set(false);
+            mPermits.put(address, connId);
         }
 
         gattClientWriteCharacteristicNative(connId, handle, writeType, authReq, value);
@@ -3829,33 +3866,21 @@
         // Link supervision timeout is measured in N * 10ms
         int timeout = 500; // 5s
 
-        switch (connectionPriority) {
-            case BluetoothGatt.CONNECTION_PRIORITY_HIGH:
-                minInterval = getResources().getInteger(R.integer.gatt_high_priority_min_interval);
-                maxInterval = getResources().getInteger(R.integer.gatt_high_priority_max_interval);
-                latency = getResources().getInteger(R.integer.gatt_high_priority_latency);
-                break;
 
-            case BluetoothGatt.CONNECTION_PRIORITY_LOW_POWER:
-                minInterval = getResources().getInteger(R.integer.gatt_low_power_min_interval);
-                maxInterval = getResources().getInteger(R.integer.gatt_low_power_max_interval);
-                latency = getResources().getInteger(R.integer.gatt_low_power_latency);
-                break;
+        CompanionManager manager =
+                AdapterService.getAdapterService().getCompanionManager();
 
-            default:
-                // Using the values for CONNECTION_PRIORITY_BALANCED.
-                minInterval =
-                        getResources().getInteger(R.integer.gatt_balanced_priority_min_interval);
-                maxInterval =
-                        getResources().getInteger(R.integer.gatt_balanced_priority_max_interval);
-                latency = getResources().getInteger(R.integer.gatt_balanced_priority_latency);
-                break;
-        }
+        minInterval = manager.getGattConnParameters(
+                address, CompanionManager.GATT_CONN_INTERVAL_MIN, connectionPriority);
+        maxInterval = manager.getGattConnParameters(
+                address, CompanionManager.GATT_CONN_INTERVAL_MAX, connectionPriority);
+        latency = manager.getGattConnParameters(
+                address, CompanionManager.GATT_CONN_LATENCY, connectionPriority);
 
-        if (DBG) {
-            Log.d(TAG, "connectionParameterUpdate() - address=" + address + "params="
-                    + connectionPriority + " interval=" + minInterval + "/" + maxInterval);
-        }
+        Log.d(TAG, "connectionParameterUpdate() - address=" + address + " params="
+                + connectionPriority + " interval=" + minInterval + "/" + maxInterval
+                + " timeout=" + timeout);
+
         gattConnectionParameterUpdateNative(clientIf, address, minInterval, maxInterval, latency,
                 timeout, 0, 0);
     }
@@ -3870,14 +3895,11 @@
             return;
         }
 
-        if (DBG) {
-            Log.d(TAG, "leConnectionUpdate() - address=" + address + ", intervals="
-                        + minInterval + "/" + maxInterval + ", latency=" + peripheralLatency
-                        + ", timeout=" + supervisionTimeout + "msec" + ", min_ce="
-                        + minConnectionEventLen + ", max_ce=" + maxConnectionEventLen);
+        Log.d(TAG, "leConnectionUpdate() - address=" + address + ", intervals="
+                    + minInterval + "/" + maxInterval + ", latency=" + peripheralLatency
+                    + ", timeout=" + supervisionTimeout + "msec" + ", min_ce="
+                    + minConnectionEventLen + ", max_ce=" + maxConnectionEventLen);
 
-
-        }
         gattConnectionParameterUpdateNative(clientIf, address, minInterval, maxInterval,
                                             peripheralLatency, supervisionTimeout,
                                             minConnectionEventLen, maxConnectionEventLen);
@@ -3988,10 +4010,19 @@
             connectionState = BluetoothProtoEnums.CONNECTION_STATE_DISCONNECTED;
         }
 
+        int applicationUid = -1;
+
+        try {
+          applicationUid = this.getPackageManager().getPackageUid(app.name, PackageInfoFlags.of(0));
+
+        } catch (NameNotFoundException e) {
+          Log.d(TAG, "onClientConnected() uid_not_found=" + app.name);
+        }
+
         app.callback.onServerConnectionState((byte) 0, serverIf, connected, address);
-        statsLogAppPackage(address, app.name);
+        statsLogAppPackage(address, applicationUid, serverIf);
         statsLogGattConnectionStateChange(
-                BluetoothProfile.GATT_SERVER, address, serverIf, connectionState);
+                BluetoothProfile.GATT_SERVER, address, serverIf, connectionState, -1);
     }
 
     void onServerReadCharacteristic(String address, int connId, int transId, int handle, int offset,
@@ -4541,7 +4572,8 @@
      *         a new ScanSettings object with the report delay being the floor value if the original
      *         report delay was between 0 and the floor value (exclusive of both)
      */
-    private ScanSettings enforceReportDelayFloor(ScanSettings settings) {
+    @VisibleForTesting
+    ScanSettings enforceReportDelayFloor(ScanSettings settings) {
         if (settings.getReportDelayMillis() == 0) {
             return settings;
         }
@@ -4646,6 +4678,9 @@
         sb.append("GATT Scanner Map\n");
         mScannerMap.dump(sb);
 
+        sb.append("GATT Advertiser Map\n");
+        mAdvertiserMap.dumpAdvertiser(sb);
+
         sb.append("GATT Client Map\n");
         mClientMap.dump(sb);
 
@@ -4665,28 +4700,30 @@
         }
     }
 
-    private void statsLogAppPackage(String address, String app) {
+    private void statsLogAppPackage(String address, int applicationUid, int sessionIndex) {
         BluetoothDevice device = BluetoothAdapter.getDefaultAdapter().getRemoteDevice(address);
         BluetoothStatsLog.write(
-                BluetoothStatsLog.BLUETOOTH_DEVICE_NAME_REPORTED,
-                mAdapterService.getMetricId(device), app);
+                BluetoothStatsLog.BLUETOOTH_GATT_APP_INFO,
+                sessionIndex, mAdapterService.getMetricId(device), applicationUid);
         if (DBG) {
             Log.d(TAG, "Gatt Logging: metric_id=" + mAdapterService.getMetricId(device)
-                    + ", app=" + app);
+                    + ", app_uid=" + applicationUid);
         }
     }
 
     private void statsLogGattConnectionStateChange(
-            int profile, String address, int sessionIndex, int connectionState) {
+            int profile, String address, int sessionIndex, int connectionState,
+            int connectionStatus) {
         BluetoothDevice device = BluetoothAdapter.getDefaultAdapter().getRemoteDevice(address);
         BluetoothStatsLog.write(
                 BluetoothStatsLog.BLUETOOTH_CONNECTION_STATE_CHANGED, connectionState,
                 0 /* deprecated */, profile, new byte[0],
-                mAdapterService.getMetricId(device), sessionIndex);
+                mAdapterService.getMetricId(device), sessionIndex, connectionStatus);
         if (DBG) {
             Log.d(TAG, "Gatt Logging: metric_id=" + mAdapterService.getMetricId(device)
                     + ", session_index=" + sessionIndex
-                    + ", connection state=" + connectionState);
+                    + ", connection state=" + connectionState
+                    + ", connection status=" + connectionStatus);
         }
     }
 
diff --git a/android/app/src/com/android/bluetooth/gatt/PeriodicScanManager.java b/android/app/src/com/android/bluetooth/gatt/PeriodicScanManager.java
index f4fdb95..e165f0b 100644
--- a/android/app/src/com/android/bluetooth/gatt/PeriodicScanManager.java
+++ b/android/app/src/com/android/bluetooth/gatt/PeriodicScanManager.java
@@ -28,6 +28,7 @@
 import android.util.Log;
 
 import com.android.bluetooth.btservice.AdapterService;
+import com.android.internal.annotations.VisibleForTesting;
 
 import java.util.Collections;
 import java.util.HashMap;
@@ -39,7 +40,8 @@
  *
  * @hide
  */
-class PeriodicScanManager {
+@VisibleForTesting(visibility = VisibleForTesting.Visibility.PACKAGE)
+public class PeriodicScanManager {
     private static final boolean DBG = GattServiceConfig.DBG;
     private static final String TAG = GattServiceConfig.TAG_PREFIX + "SyncManager";
 
diff --git a/android/app/src/com/android/bluetooth/gatt/ScanFilterQueue.java b/android/app/src/com/android/bluetooth/gatt/ScanFilterQueue.java
index 8231519..d223967 100644
--- a/android/app/src/com/android/bluetooth/gatt/ScanFilterQueue.java
+++ b/android/app/src/com/android/bluetooth/gatt/ScanFilterQueue.java
@@ -39,6 +39,7 @@
     public static final int TYPE_LOCAL_NAME = 4;
     public static final int TYPE_MANUFACTURER_DATA = 5;
     public static final int TYPE_SERVICE_DATA = 6;
+    public static final int TYPE_ADVERTISING_DATA_TYPE = 8;
 
     // Max length is 31 - 3(flags) - 2 (one byte for length and one byte for type).
     private static final int MAX_LEN_PER_FIELD = 26;
@@ -56,6 +57,7 @@
         public String name;
         public int company;
         public int company_mask;
+        public int ad_type;
         public byte[] data;
         public byte[] data_mask;
     }
@@ -145,6 +147,15 @@
         mEntries.add(entry);
     }
 
+    void addAdvertisingDataType(int adType, byte[] data, byte[] dataMask) {
+        Entry entry = new Entry();
+        entry.type = TYPE_ADVERTISING_DATA_TYPE;
+        entry.ad_type = adType;
+        entry.data = data;
+        entry.data_mask = dataMask;
+        mEntries.add(entry);
+    }
+
     Entry pop() {
         if (mEntries.isEmpty()) {
             return null;
@@ -226,6 +237,10 @@
                 addServiceData(serviceData, serviceDataMask);
             }
         }
+        if (filter.getAdvertisingDataType() > 0) {
+            addAdvertisingDataType(filter.getAdvertisingDataType(),
+                    filter.getAdvertisingData(), filter.getAdvertisingDataMask());
+        }
     }
 
     private byte[] concate(ParcelUuid serviceDataUuid, byte[] serviceData) {
diff --git a/android/app/src/com/android/bluetooth/gatt/ScanManager.java b/android/app/src/com/android/bluetooth/gatt/ScanManager.java
index 84033cd..fe506ca 100644
--- a/android/app/src/com/android/bluetooth/gatt/ScanManager.java
+++ b/android/app/src/com/android/bluetooth/gatt/ScanManager.java
@@ -20,7 +20,6 @@
 import android.app.ActivityManager;
 import android.app.AlarmManager;
 import android.app.PendingIntent;
-import android.bluetooth.BluetoothAdapter;
 import android.bluetooth.le.ScanCallback;
 import android.bluetooth.le.ScanFilter;
 import android.bluetooth.le.ScanSettings;
@@ -45,6 +44,8 @@
 
 import com.android.bluetooth.Utils;
 import com.android.bluetooth.btservice.AdapterService;
+import com.android.bluetooth.btservice.BluetoothAdapterProxy;
+import com.android.internal.annotations.VisibleForTesting;
 
 import java.util.ArrayDeque;
 import java.util.Collections;
@@ -86,17 +87,18 @@
     static final int SCAN_RESULT_TYPE_FULL = 2;
     static final int SCAN_RESULT_TYPE_BOTH = 3;
 
-    // Internal messages for handling BLE scan operations.
-    private static final int MSG_START_BLE_SCAN = 0;
-    private static final int MSG_STOP_BLE_SCAN = 1;
-    private static final int MSG_FLUSH_BATCH_RESULTS = 2;
-    private static final int MSG_SCAN_TIMEOUT = 3;
-    private static final int MSG_SUSPEND_SCANS = 4;
-    private static final int MSG_RESUME_SCANS = 5;
-    private static final int MSG_IMPORTANCE_CHANGE = 6;
-    private static final int MSG_SCREEN_ON = 7;
-    private static final int MSG_SCREEN_OFF = 8;
-    private static final int MSG_REVERT_SCAN_MODE_UPGRADE = 9;
+    // Messages for handling BLE scan operations.
+    @VisibleForTesting
+    static final int MSG_START_BLE_SCAN = 0;
+    static final int MSG_STOP_BLE_SCAN = 1;
+    static final int MSG_FLUSH_BATCH_RESULTS = 2;
+    static final int MSG_SCAN_TIMEOUT = 3;
+    static final int MSG_SUSPEND_SCANS = 4;
+    static final int MSG_RESUME_SCANS = 5;
+    static final int MSG_IMPORTANCE_CHANGE = 6;
+    static final int MSG_SCREEN_ON = 7;
+    static final int MSG_SCREEN_OFF = 8;
+    static final int MSG_REVERT_SCAN_MODE_UPGRADE = 9;
     private static final String ACTION_REFRESH_BATCHED_SCAN =
             "com.android.bluetooth.gatt.REFRESH_BATCHED_SCAN";
 
@@ -115,6 +117,7 @@
     private boolean mBatchAlarmReceiverRegistered;
     private ScanNative mScanNative;
     private volatile ClientHandler mHandler;
+    private BluetoothAdapterProxy mBluetoothAdapterProxy;
 
     private Set<ScanClient> mRegularScanClients;
     private Set<ScanClient> mBatchClients;
@@ -134,7 +137,8 @@
     private final SparseBooleanArray mIsUidForegroundMap = new SparseBooleanArray();
     private boolean mScreenOn = false;
 
-    private class UidImportance {
+    @VisibleForTesting
+    static class UidImportance {
         public int uid;
         public int importance;
 
@@ -144,7 +148,8 @@
         }
     }
 
-    ScanManager(GattService service, AdapterService adapterService) {
+    ScanManager(GattService service, AdapterService adapterService,
+            BluetoothAdapterProxy bluetoothAdapterProxy) {
         mRegularScanClients =
                 Collections.newSetFromMap(new ConcurrentHashMap<ScanClient, Boolean>());
         mBatchClients = Collections.newSetFromMap(new ConcurrentHashMap<ScanClient, Boolean>());
@@ -157,6 +162,7 @@
         mActivityManager = mService.getSystemService(ActivityManager.class);
         mLocationManager = mService.getSystemService(LocationManager.class);
         mAdapterService = adapterService;
+        mBluetoothAdapterProxy = bluetoothAdapterProxy;
 
         mPriorityMap.put(ScanSettings.SCAN_MODE_OPPORTUNISTIC, 0);
         mPriorityMap.put(ScanSettings.SCAN_MODE_SCREEN_OFF, 1);
@@ -175,6 +181,7 @@
         if (mDm != null) {
             mDm.registerDisplayListener(mDisplayListener, null);
         }
+        mScreenOn = isScreenOn();
         if (mActivityManager != null) {
             mActivityManager.addOnUidImportanceListener(mUidImportanceListener,
                     FOREGROUND_IMPORTANCE_CUTOFF);
@@ -235,6 +242,13 @@
     }
 
     /**
+     * Returns the suspended scan queue.
+     */
+    Set<ScanClient> getSuspendedScanQueue() {
+        return mSuspendedScanClients;
+    }
+
+    /**
      * Returns batch scan queue.
      */
     Set<ScanClient> getBatchScanQueue() {
@@ -268,6 +282,9 @@
         if (client == null) {
             client = mScanNative.getRegularScanClient(scannerId);
         }
+        if (client == null) {
+            client = mScanNative.getSuspendedScanClient(scannerId);
+        }
         sendMessage(MSG_STOP_BLE_SCAN, client);
     }
 
@@ -298,8 +315,11 @@
     }
 
     private boolean isFilteringSupported() {
-        BluetoothAdapter adapter = BluetoothAdapter.getDefaultAdapter();
-        return adapter.isOffloadedFilteringSupported();
+        if (mBluetoothAdapterProxy == null) {
+            Log.e(TAG, "mBluetoothAdapterProxy is null");
+            return false;
+        }
+        return mBluetoothAdapterProxy.isOffloadedScanFilteringSupported();
     }
 
     // Handler class that handles BLE scan operations.
@@ -363,7 +383,7 @@
                 return;
             }
 
-            if (requiresScreenOn(client) && !isScreenOn()) {
+            if (requiresScreenOn(client) && !mScreenOn) {
                 Log.w(TAG, "Cannot start unfiltered scan in screen-off. This scan will be resumed "
                         + "later: " + client.scannerId);
                 mSuspendedScanClients.add(client);
@@ -400,6 +420,11 @@
                         msg.obj = client;
                         // Only one timeout message should exist at any time
                         sendMessageDelayed(msg, mAdapterService.getScanTimeoutMillis());
+                        if (DBG) {
+                            Log.d(TAG,
+                                    "apply scan timeout (" + mAdapterService.getScanTimeoutMillis()
+                                            + ")" + "to scannerId " + client.scannerId);
+                        }
                     }
                 }
             }
@@ -429,13 +454,10 @@
                 mSuspendedScanClients.remove(client);
             }
             removeMessages(MSG_REVERT_SCAN_MODE_UPGRADE, client);
+            removeMessages(MSG_SCAN_TIMEOUT, client);
             if (mRegularScanClients.contains(client)) {
                 mScanNative.stopRegularScan(client);
 
-                if (mScanNative.numRegularScanClients() == 0) {
-                    removeMessages(MSG_SCAN_TIMEOUT);
-                }
-
                 if (!mScanNative.isOpportunisticScanClient(client)) {
                     mScanNative.configureRegularScanParams();
                 }
@@ -493,7 +515,7 @@
         @RequiresPermission(android.Manifest.permission.BLUETOOTH_SCAN)
         void handleSuspendScans() {
             for (ScanClient client : mRegularScanClients) {
-                if ((requiresScreenOn(client) && !isScreenOn())
+                if ((requiresScreenOn(client) && !mScreenOn)
                         || (requiresLocationOn(client) && !mLocationManager.isLocationEnabled())) {
                     /*Suspend unfiltered scans*/
                     if (client.stats != null) {
@@ -524,6 +546,9 @@
         }
 
         private boolean updateScanModeScreenOff(ScanClient client) {
+            if (mScanNative.isTimeoutScanClient(client)) {
+                return false;
+            }
             if (!isAppForeground(client) && !mScanNative.isOpportunisticScanClient(client)) {
                 return client.updateScanMode(ScanSettings.SCAN_MODE_SCREEN_OFF);
             }
@@ -555,7 +580,7 @@
             if (upgradeScanModeBeforeStart(client)) {
                 return true;
             }
-            if (isScreenOn()) {
+            if (mScreenOn) {
                 return updateScanModeScreenOn(client);
             } else {
                 return updateScanModeScreenOff(client);
@@ -613,6 +638,10 @@
         }
 
         private boolean updateScanModeScreenOn(ScanClient client) {
+            if (mScanNative.isTimeoutScanClient(client)) {
+                return false;
+            }
+
             int newScanMode =  (isAppForeground(client)
                     || mScanNative.isOpportunisticScanClient(client))
                     ? client.scanModeApp : SCAN_MODE_APP_IN_BACKGROUND;
@@ -633,7 +662,7 @@
 
         void handleResumeScans() {
             for (ScanClient client : mSuspendedScanClients) {
-                if ((!requiresScreenOn(client) || isScreenOn())
+                if ((!requiresScreenOn(client) || mScreenOn)
                         && (!requiresLocationOn(client) || mLocationManager.isLocationEnabled())) {
                     if (client.stats != null) {
                         client.stats.recordScanResume(client.scannerId);
@@ -871,14 +900,17 @@
         }
 
         private boolean isExemptFromScanDowngrade(ScanClient client) {
-            return isOpportunisticScanClient(client) || isFirstMatchScanClient(client)
-                    || !shouldUseAllPassFilter(client);
+            return isOpportunisticScanClient(client) || isFirstMatchScanClient(client);
         }
 
         private boolean isOpportunisticScanClient(ScanClient client) {
             return client.settings.getScanMode() == ScanSettings.SCAN_MODE_OPPORTUNISTIC;
         }
 
+        private boolean isTimeoutScanClient(ScanClient client) {
+            return (client.stats != null) && client.stats.isScanTimeout(client.scannerId);
+        }
+
         private boolean isFirstMatchScanClient(ScanClient client) {
             return (client.settings.getCallbackType() & ScanSettings.CALLBACK_TYPE_FIRST_MATCH)
                     != 0;
@@ -1046,11 +1078,23 @@
 
         void regularScanTimeout(ScanClient client) {
             if (!isExemptFromScanDowngrade(client) && client.stats.isScanningTooLong()) {
-                Log.w(TAG,
-                        "Moving scan client to opportunistic (scannerId " + client.scannerId + ")");
-                setOpportunisticScanClient(client);
-                removeScanFilters(client.scannerId);
-                client.stats.setScanTimeout(client.scannerId);
+                if (DBG) {
+                    Log.d(TAG, "regularScanTimeout - client scan time was too long");
+                }
+                if (client.filters == null || client.filters.isEmpty()) {
+                    Log.w(TAG,
+                            "Moving unfiltered scan client to opportunistic scan (scannerId "
+                                    + client.scannerId + ")");
+                    setOpportunisticScanClient(client);
+                    removeScanFilters(client.scannerId);
+                    client.stats.setScanTimeout(client.scannerId);
+                } else {
+                    Log.w(TAG,
+                            "Moving filtered scan client to downgraded scan (scannerId "
+                                    + client.scannerId + ")");
+                    client.updateScanMode(ScanSettings.SCAN_MODE_LOW_POWER);
+                    client.stats.setScanTimeout(client.scannerId);
+                }
             }
 
             // The scan should continue for background scans
@@ -1086,6 +1130,15 @@
             return null;
         }
 
+        ScanClient getSuspendedScanClient(int scannerId) {
+            for (ScanClient client : mSuspendedScanClients) {
+                if (client.scannerId == scannerId) {
+                    return client;
+                }
+            }
+            return null;
+        }
+
         void stopBatchScan(ScanClient client) {
             mBatchClients.remove(client);
             removeScanFilters(client.scannerId);
@@ -1284,11 +1337,12 @@
         private void initFilterIndexStack() {
             int maxFiltersSupported =
                     AdapterService.getAdapterService().getNumOfOffloadedScanFilterSupported();
-            // Start from index 3 as:
+            // Start from index 4 as:
             // index 0 is reserved for ALL_PASS filter in Settings app.
             // index 1 is reserved for ALL_PASS filter for regular scan apps.
             // index 2 is reserved for ALL_PASS filter for batch scan apps.
-            for (int i = 3; i < maxFiltersSupported; ++i) {
+            // index 3 is reserved for BAP/CAP Announcements
+            for (int i = 4; i < maxFiltersSupported; ++i) {
                 mFilterIndexStack.add(i);
             }
         }
@@ -1527,6 +1581,11 @@
         private native void gattClientReadScanReportsNative(int clientIf, int scanType);
     }
 
+    @VisibleForTesting
+    ClientHandler getClientHandler() {
+        return mHandler;
+    }
+
     private boolean isScreenOn() {
         Display[] displays = mDm.getDisplays();
 
@@ -1605,7 +1664,7 @@
         }
 
         for (ScanClient client : mRegularScanClients) {
-            if (client.appUid != uid) {
+            if (client.appUid != uid || mScanNative.isTimeoutScanClient(client)) {
                 continue;
             }
             if (isForeground) {
diff --git a/android/app/src/com/android/bluetooth/hap/HapClientNativeInterface.java b/android/app/src/com/android/bluetooth/hap/HapClientNativeInterface.java
index 69e10d3..5fab43a 100644
--- a/android/app/src/com/android/bluetooth/hap/HapClientNativeInterface.java
+++ b/android/app/src/com/android/bluetooth/hap/HapClientNativeInterface.java
@@ -104,7 +104,8 @@
         return Utils.getBytesFromAddress(device.getAddress());
     }
 
-    private void sendMessageToService(HapClientStackEvent event) {
+    @VisibleForTesting(visibility = VisibleForTesting.Visibility.PACKAGE)
+    void sendMessageToService(HapClientStackEvent event) {
         HapClientService service = HapClientService.getHapClientService();
         if (service != null) {
             service.messageFromNative(event);
diff --git a/android/app/src/com/android/bluetooth/hap/HapClientService.java b/android/app/src/com/android/bluetooth/hap/HapClientService.java
index 756d72b..2b06aa6 100644
--- a/android/app/src/com/android/bluetooth/hap/HapClientService.java
+++ b/android/app/src/com/android/bluetooth/hap/HapClientService.java
@@ -100,7 +100,8 @@
         return BluetoothProperties.isProfileHapClientEnabled().orElse(false);
     }
 
-    private static synchronized void setHapClient(HapClientService instance) {
+    @VisibleForTesting
+    static synchronized void setHapClient(HapClientService instance) {
         if (DBG) {
             Log.d(TAG, "setHapClient(): set to: " + instance);
         }
@@ -267,6 +268,8 @@
                 return;
             }
             if (sm.getConnectionState() != BluetoothProfile.STATE_DISCONNECTED) {
+                Log.i(TAG, "Disconnecting device because it was unbonded.");
+                disconnect(device);
                 return;
             }
             removeStateMachine(device);
@@ -696,6 +699,12 @@
         BluetoothHapPresetInfo defaultValue = null;
         if (presetIndex == BluetoothHapClient.PRESET_INDEX_UNAVAILABLE) return defaultValue;
 
+        if (Utils.isPtsTestMode()) {
+            /* We want native to be called for PTS testing even we have all
+             * the data in the cache here
+             */
+            mHapClientNativeInterface.getPresetInfo(device, presetIndex);
+        }
         List<BluetoothHapPresetInfo> current_presets = mPresetsMap.get(device);
         if (current_presets != null) {
             for (BluetoothHapPresetInfo preset : current_presets) {
@@ -1203,6 +1212,8 @@
     @VisibleForTesting
     static class BluetoothHapClientBinder extends IBluetoothHapClient.Stub
             implements IProfileServiceBinder {
+        @VisibleForTesting
+        boolean mIsTesting = false;
         private HapClientService mService;
 
         BluetoothHapClientBinder(HapClientService svc) {
@@ -1210,8 +1221,11 @@
         }
 
         private HapClientService getService(AttributionSource source) {
-            if (!Utils.checkCallerIsSystemOrActiveUser(TAG)
-                    || !Utils.checkServiceAvailable(mService, TAG)
+            if (mIsTesting) {
+                return mService;
+            }
+            if (!Utils.checkServiceAvailable(mService, TAG)
+                    || !Utils.checkCallerIsSystemOrActiveOrManagedUser(mService, TAG)
                     || !Utils.checkConnectPermissionForDataDelivery(mService, source, TAG)) {
                 Log.w(TAG, "Hearing Access call not allowed for non-active user");
                 return null;
diff --git a/android/app/src/com/android/bluetooth/hap/HapClientStackEvent.java b/android/app/src/com/android/bluetooth/hap/HapClientStackEvent.java
index e322f50..59700db 100644
--- a/android/app/src/com/android/bluetooth/hap/HapClientStackEvent.java
+++ b/android/app/src/com/android/bluetooth/hap/HapClientStackEvent.java
@@ -108,7 +108,7 @@
     private String eventTypeValueListToString(int type, List value) {
         switch (type) {
             case EVENT_TYPE_ON_PRESET_INFO:
-                return "{presets count: " + value.size() + "}";
+                return "{presets count: " + (value == null ? 0 : value.size()) + "}";
             default:
                 return "{list: empty}";
         }
@@ -245,18 +245,6 @@
         return features_str;
     }
 
-    private String availablePresetsToString(byte[] value) {
-        if (value.length == 0) return "NONE";
-
-        String presets_str = "[";
-        for (int i = 0; i < value.length; i++) {
-            presets_str += (value[i] + ", ");
-        }
-
-        presets_str += "]";
-        return presets_str;
-    }
-
     private static String eventTypeToString(int type) {
         switch (type) {
             case EVENT_TYPE_NONE:
diff --git a/android/app/src/com/android/bluetooth/hap/HapClientStateMachine.java b/android/app/src/com/android/bluetooth/hap/HapClientStateMachine.java
index 62c9dd2..dc85f0a 100644
--- a/android/app/src/com/android/bluetooth/hap/HapClientStateMachine.java
+++ b/android/app/src/com/android/bluetooth/hap/HapClientStateMachine.java
@@ -73,7 +73,8 @@
     static final int STACK_EVENT = 101;
     private static final boolean DBG = true;
     private static final String TAG = "HapClientStateMachine";
-    private static final int CONNECT_TIMEOUT = 201;
+    @VisibleForTesting
+    static final int CONNECT_TIMEOUT = 201;
 
     // NOTE: the value is not "final" - it is modified in the unit tests
     @VisibleForTesting
diff --git a/android/app/src/com/android/bluetooth/hearingaid/HearingAidNativeInterface.java b/android/app/src/com/android/bluetooth/hearingaid/HearingAidNativeInterface.java
index 9ef2678..a2aabd0 100644
--- a/android/app/src/com/android/bluetooth/hearingaid/HearingAidNativeInterface.java
+++ b/android/app/src/com/android/bluetooth/hearingaid/HearingAidNativeInterface.java
@@ -128,14 +128,16 @@
         return mAdapter.getRemoteDevice(address);
     }
 
-    private byte[] getByteAddress(BluetoothDevice device) {
+    @VisibleForTesting
+    byte[] getByteAddress(BluetoothDevice device) {
         if (device == null) {
             return Utils.getBytesFromAddress("00:00:00:00:00:00");
         }
         return Utils.getBytesFromAddress(device.getAddress());
     }
 
-    private void sendMessageToService(HearingAidStackEvent event) {
+    @VisibleForTesting
+    void sendMessageToService(HearingAidStackEvent event) {
         HearingAidService service = HearingAidService.getHearingAidService();
         if (service != null) {
             service.messageFromNative(event);
@@ -148,7 +150,8 @@
     // All callbacks are routed via the Service which will disambiguate which
     // state machine the message should be routed to.
 
-    private void onConnectionStateChanged(int state, byte[] address) {
+    @VisibleForTesting
+    void onConnectionStateChanged(int state, byte[] address) {
         HearingAidStackEvent event =
                 new HearingAidStackEvent(HearingAidStackEvent.EVENT_TYPE_CONNECTION_STATE_CHANGED);
         event.device = getDevice(address);
@@ -160,7 +163,8 @@
         sendMessageToService(event);
     }
 
-    private void onDeviceAvailable(byte capabilities, long hiSyncId, byte[] address) {
+    @VisibleForTesting
+    void onDeviceAvailable(byte capabilities, long hiSyncId, byte[] address) {
         HearingAidStackEvent event = new HearingAidStackEvent(
                 HearingAidStackEvent.EVENT_TYPE_DEVICE_AVAILABLE);
         event.device = getDevice(address);
diff --git a/android/app/src/com/android/bluetooth/hearingaid/HearingAidService.java b/android/app/src/com/android/bluetooth/hearingaid/HearingAidService.java
index 4aa87e1..b5feb52 100644
--- a/android/app/src/com/android/bluetooth/hearingaid/HearingAidService.java
+++ b/android/app/src/com/android/bluetooth/hearingaid/HearingAidService.java
@@ -29,9 +29,13 @@
 import android.content.Context;
 import android.content.Intent;
 import android.content.IntentFilter;
+import android.media.AudioDeviceCallback;
+import android.media.AudioDeviceInfo;
 import android.media.AudioManager;
 import android.media.BluetoothProfileConnectionInfo;
+import android.os.Handler;
 import android.os.HandlerThread;
+import android.os.Looper;
 import android.os.ParcelUuid;
 import android.sysprop.BluetoothProperties;
 import android.util.Log;
@@ -73,6 +77,7 @@
     private DatabaseManager mDatabaseManager;
     private HandlerThread mStateMachinesThread;
     private BluetoothDevice mPreviousAudioDevice;
+    private BluetoothDevice mActiveDevice;
 
     @VisibleForTesting
     HearingAidNativeInterface mHearingAidNativeInterface;
@@ -88,6 +93,12 @@
 
     private BroadcastReceiver mBondStateChangedReceiver;
     private BroadcastReceiver mConnectionStateChangedReceiver;
+    private Handler mHandler = new Handler(Looper.getMainLooper());
+    private final AudioManagerOnAudioDevicesAddedCallback mAudioManagerOnAudioDevicesAddedCallback =
+            new AudioManagerOnAudioDevicesAddedCallback();
+    private final AudioManagerOnAudioDevicesRemovedCallback
+            mAudioManagerOnAudioDevicesRemovedCallback =
+            new AudioManagerOnAudioDevicesRemovedCallback();
 
     private final ServiceFactory mFactory = new ServiceFactory();
 
@@ -206,6 +217,9 @@
             }
         }
 
+        mAudioManager.unregisterAudioDeviceCallback(mAudioManagerOnAudioDevicesAddedCallback);
+        mAudioManager.unregisterAudioDeviceCallback(mAudioManagerOnAudioDevicesRemovedCallback);
+
         // Clear AdapterService, HearingAidNativeInterface
         mAudioManager = null;
         mHearingAidNativeInterface = null;
@@ -238,7 +252,8 @@
         return sHearingAidService;
     }
 
-    private static synchronized void setHearingAidService(HearingAidService instance) {
+    @VisibleForTesting
+    static synchronized void setHearingAidService(HearingAidService instance) {
         if (DBG) {
             Log.d(TAG, "setHearingAidService(): set to: " + instance);
         }
@@ -582,6 +597,12 @@
                 }
                 return true;
             }
+
+            /* No action needed since this is the same device as previousely activated */
+            if (device.equals(mActiveDevice)) {
+                return true;
+            }
+
             if (getConnectionState(device) != BluetoothProfile.STATE_CONNECTED) {
                 Log.e(TAG, "setActiveDevice(" + device + "): failed because device not connected");
                 return false;
@@ -671,6 +692,46 @@
         }
     }
 
+    private void notifyActiveDeviceChanged() {
+        Intent intent = new Intent(BluetoothHearingAid.ACTION_ACTIVE_DEVICE_CHANGED);
+        intent.putExtra(BluetoothDevice.EXTRA_DEVICE, mActiveDevice);
+        intent.addFlags(Intent.FLAG_RECEIVER_REGISTERED_ONLY_BEFORE_BOOT
+                | Intent.FLAG_RECEIVER_INCLUDE_BACKGROUND);
+        sendBroadcast(intent, BLUETOOTH_CONNECT);
+    }
+
+    /* Notifications of audio device disconnection events. */
+    private class AudioManagerOnAudioDevicesRemovedCallback extends AudioDeviceCallback {
+        @Override
+        public void onAudioDevicesRemoved(AudioDeviceInfo[] removedDevices) {
+            for (AudioDeviceInfo deviceInfo : removedDevices) {
+                if (deviceInfo.getType() == AudioDeviceInfo.TYPE_HEARING_AID) {
+                    notifyActiveDeviceChanged();
+                    if (DBG) {
+                        Log.d(TAG, " onAudioDevicesRemoved: device type: " + deviceInfo.getType());
+                    }
+                    mAudioManager.unregisterAudioDeviceCallback(this);
+                }
+            }
+        }
+    }
+
+    /* Notifications of audio device connection events. */
+    private class AudioManagerOnAudioDevicesAddedCallback extends AudioDeviceCallback {
+        @Override
+        public void onAudioDevicesAdded(AudioDeviceInfo[] addedDevices) {
+            for (AudioDeviceInfo deviceInfo : addedDevices) {
+                if (deviceInfo.getType() == AudioDeviceInfo.TYPE_HEARING_AID) {
+                    notifyActiveDeviceChanged();
+                    if (DBG) {
+                        Log.d(TAG, " onAudioDevicesAdded: device type: " + deviceInfo.getType());
+                    }
+                    mAudioManager.unregisterAudioDeviceCallback(this);
+                }
+            }
+        }
+    }
+
     private HearingAidStateMachine getOrCreateStateMachine(BluetoothDevice device) {
         if (device == null) {
             Log.e(TAG, "getOrCreateStateMachine failed: device cannot be null");
@@ -706,22 +767,27 @@
             Log.d(TAG, "reportActiveDevice(" + device + ")");
         }
 
+        mActiveDevice = device;
+
         BluetoothStatsLog.write(BluetoothStatsLog.BLUETOOTH_ACTIVE_DEVICE_CHANGED,
                 BluetoothProfile.HEARING_AID, mAdapterService.obfuscateAddress(device),
                 mAdapterService.getMetricId(device));
 
-        Intent intent = new Intent(BluetoothHearingAid.ACTION_ACTIVE_DEVICE_CHANGED);
-        intent.putExtra(BluetoothDevice.EXTRA_DEVICE, device);
-        intent.addFlags(Intent.FLAG_RECEIVER_REGISTERED_ONLY_BEFORE_BOOT
-                | Intent.FLAG_RECEIVER_INCLUDE_BACKGROUND);
-        sendBroadcast(intent, BLUETOOTH_CONNECT, Utils.getTempAllowlistBroadcastOptions());
-
         boolean stopAudio = device == null
                 && (getConnectionState(mPreviousAudioDevice) != BluetoothProfile.STATE_CONNECTED);
         if (DBG) {
             Log.d(TAG, "Hearing Aid audio: " + mPreviousAudioDevice + " -> " + device
                     + ". Stop audio: " + stopAudio);
         }
+
+        if (device != null) {
+            mAudioManager.registerAudioDeviceCallback(mAudioManagerOnAudioDevicesAddedCallback,
+                    mHandler);
+        } else {
+            mAudioManager.registerAudioDeviceCallback(mAudioManagerOnAudioDevicesRemovedCallback,
+                    mHandler);
+        }
+
         mAudioManager.handleBluetoothActiveDeviceChanged(device, mPreviousAudioDevice,
                 BluetoothProfileConnectionInfo.createHearingAidInfo(!stopAudio));
         mPreviousAudioDevice = device;
@@ -767,6 +833,8 @@
                 return;
             }
             if (sm.getConnectionState() != BluetoothProfile.STATE_DISCONNECTED) {
+                Log.i(TAG, "Disconnecting device because it was unbonded.");
+                disconnect(device);
                 return;
             }
             removeStateMachine(device);
@@ -818,7 +886,6 @@
                         BluetoothMetricsProto.ProfileId.HEARING_AID);
             }
             if (!mHiSyncIdConnectedMap.getOrDefault(myHiSyncId, false)) {
-                setActiveDevice(device);
                 mHiSyncIdConnectedMap.put(myHiSyncId, true);
             }
         }
@@ -858,12 +925,17 @@
     @VisibleForTesting
     static class BluetoothHearingAidBinder extends IBluetoothHearingAid.Stub
             implements IProfileServiceBinder {
+        @VisibleForTesting
+        boolean mIsTesting = false;
         private HearingAidService mService;
 
         @RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)
         private HearingAidService getService(AttributionSource source) {
-            if (!Utils.checkCallerIsSystemOrActiveUser(TAG)
-                    || !Utils.checkServiceAvailable(mService, TAG)
+            if (mIsTesting) {
+                return mService;
+            }
+            if (!Utils.checkServiceAvailable(mService, TAG)
+                    || !Utils.checkCallerIsSystemOrActiveOrManagedUser(mService, TAG)
                     || !Utils.checkConnectPermissionForDataDelivery(mService, source, TAG)) {
                 return null;
             }
diff --git a/android/app/src/com/android/bluetooth/hfp/AtPhonebook.java b/android/app/src/com/android/bluetooth/hfp/AtPhonebook.java
index 12f1c4c..8f273aa 100644
--- a/android/app/src/com/android/bluetooth/hfp/AtPhonebook.java
+++ b/android/app/src/com/android/bluetooth/hfp/AtPhonebook.java
@@ -32,10 +32,12 @@
 import android.telephony.PhoneNumberUtils;
 import android.util.Log;
 
+import com.android.bluetooth.BluetoothMethodProxy;
 import com.android.bluetooth.R;
 import com.android.bluetooth.Utils;
 import com.android.bluetooth.util.DevicePolicyUtils;
 import com.android.bluetooth.util.GsmAlphabet;
+import com.android.internal.annotations.VisibleForTesting;
 
 import java.util.HashMap;
 
@@ -70,7 +72,8 @@
     private static final String INCOMING_CALL_WHERE = Calls.TYPE + "=" + Calls.INCOMING_TYPE;
     private static final String MISSED_CALL_WHERE = Calls.TYPE + "=" + Calls.MISSED_TYPE;
 
-    private class PhonebookResult {
+    @VisibleForTesting
+    class PhonebookResult {
         public Cursor cursor; // result set of last query
         public int numberColumn;
         public int numberPresentationColumn;
@@ -81,16 +84,20 @@
     private Context mContext;
     private ContentResolver mContentResolver;
     private HeadsetNativeInterface mNativeInterface;
-    private String mCurrentPhonebook;
-    private String mCharacterSet = "UTF-8";
+    @VisibleForTesting
+    String mCurrentPhonebook;
+    @VisibleForTesting
+    String mCharacterSet = "UTF-8";
 
-    private int mCpbrIndex1, mCpbrIndex2;
+    @VisibleForTesting
+    int mCpbrIndex1, mCpbrIndex2;
     private boolean mCheckingAccessPermission;
 
     // package and class name to which we send intent to check phone book access permission
     private final String mPairingPackage;
 
-    private final HashMap<String, PhonebookResult> mPhonebooks =
+    @VisibleForTesting
+    final HashMap<String, PhonebookResult> mPhonebooks =
             new HashMap<String, PhonebookResult>(4);
 
     static final int TYPE_UNKNOWN = -1;
@@ -387,7 +394,8 @@
      *  If force then re-query that phonebook
      *  Returns null if the cursor is not ready
      */
-    private synchronized PhonebookResult getPhonebookResult(String pb, boolean force) {
+    @VisibleForTesting
+    synchronized PhonebookResult getPhonebookResult(String pb, boolean force) {
         if (pb == null) {
             return null;
         }
@@ -431,8 +439,8 @@
             queryArgs.putString(ContentResolver.QUERY_ARG_SQL_SELECTION, where);
             queryArgs.putString(ContentResolver.QUERY_ARG_SQL_SORT_ORDER, Calls.DEFAULT_SORT_ORDER);
             queryArgs.putInt(ContentResolver.QUERY_ARG_LIMIT, MAX_PHONEBOOK_SIZE);
-            pbr.cursor = mContentResolver.query(Calls.CONTENT_URI, CALLS_PROJECTION,
-                    queryArgs, null);
+            pbr.cursor = BluetoothMethodProxy.getInstance().contentResolverQuery(mContentResolver,
+                    Calls.CONTENT_URI, CALLS_PROJECTION, queryArgs, null);
 
             if (pbr.cursor == null) {
                 return false;
@@ -447,8 +455,8 @@
             queryArgs.putString(ContentResolver.QUERY_ARG_SQL_SELECTION, where);
             queryArgs.putInt(ContentResolver.QUERY_ARG_LIMIT, MAX_PHONEBOOK_SIZE);
             final Uri phoneContentUri = DevicePolicyUtils.getEnterprisePhoneUri(mContext);
-            pbr.cursor = mContentResolver.query(phoneContentUri, PHONES_PROJECTION,
-                    queryArgs, null);
+            pbr.cursor = BluetoothMethodProxy.getInstance().contentResolverQuery(mContentResolver,
+                    phoneContentUri, PHONES_PROJECTION, queryArgs, null);
 
             if (pbr.cursor == null) {
                 return false;
@@ -469,7 +477,8 @@
         mCheckingAccessPermission = false;
     }
 
-    private synchronized int getMaxPhoneBookSize(int currSize) {
+    @VisibleForTesting
+    synchronized int getMaxPhoneBookSize(int currSize) {
         // some car kits ignore the current size and request max phone book
         // size entries. Thus, it takes a long time to transfer all the
         // entries. Use a heuristic to calculate the max phone book size
@@ -543,7 +552,7 @@
                 // try caller id lookup
                 // TODO: This code is horribly inefficient. I saw it
                 // take 7 seconds to process 100 missed calls.
-                Cursor c = mContentResolver.query(
+                Cursor c = BluetoothMethodProxy.getInstance().contentResolverQuery(mContentResolver,
                         Uri.withAppendedPath(PhoneLookup.ENTERPRISE_CONTENT_FILTER_URI, number),
                         new String[]{
                                 PhoneLookup.DISPLAY_NAME, PhoneLookup.TYPE
@@ -632,7 +641,8 @@
      * @return {@link BluetoothDevice#ACCESS_UNKNOWN}, {@link BluetoothDevice#ACCESS_ALLOWED} or
      *         {@link BluetoothDevice#ACCESS_REJECTED}.
      */
-    private int checkAccessPermission(BluetoothDevice remoteDevice) {
+    @VisibleForTesting
+    int checkAccessPermission(BluetoothDevice remoteDevice) {
         log("checkAccessPermission");
         int permission = remoteDevice.getPhonebookAccessPermission();
 
@@ -653,7 +663,8 @@
         return permission;
     }
 
-    private static String getPhoneType(int type) {
+    @VisibleForTesting
+    static String getPhoneType(int type) {
         switch (type) {
             case Phone.TYPE_HOME:
                 return "H";
diff --git a/android/app/src/com/android/bluetooth/hfp/HeadsetNativeInterface.java b/android/app/src/com/android/bluetooth/hfp/HeadsetNativeInterface.java
index be6327c..59d3eca 100644
--- a/android/app/src/com/android/bluetooth/hfp/HeadsetNativeInterface.java
+++ b/android/app/src/com/android/bluetooth/hfp/HeadsetNativeInterface.java
@@ -69,7 +69,7 @@
         } else {
             // Service must call cleanup() when quiting and native stack shouldn't send any event
             // after cleanup() -> cleanupNative() is called.
-            Log.wtf(TAG, "FATAL: Stack sent event while service is not available: " + event);
+            Log.w(TAG, "Stack sent event while service is not available: " + event);
         }
     }
 
diff --git a/android/app/src/com/android/bluetooth/hfp/HeadsetPhoneState.java b/android/app/src/com/android/bluetooth/hfp/HeadsetPhoneState.java
index 7bfe9f8..440cf81 100644
--- a/android/app/src/com/android/bluetooth/hfp/HeadsetPhoneState.java
+++ b/android/app/src/com/android/bluetooth/hfp/HeadsetPhoneState.java
@@ -76,23 +76,25 @@
     private final Object mPhoneStateListenerLock = new Object();
 
     HeadsetPhoneState(HeadsetService headsetService) {
-        Objects.requireNonNull(headsetService, "headsetService is null");
-        mHeadsetService = headsetService;
-        mTelephonyManager = mHeadsetService.getSystemService(TelephonyManager.class);
-        Objects.requireNonNull(mTelephonyManager, "TELEPHONY_SERVICE is null");
-        // Register for SubscriptionInfo list changes which is guaranteed to invoke
-        // onSubscriptionInfoChanged and which in turns calls loadInBackgroud.
-        mSubscriptionManager = SubscriptionManager.from(mHeadsetService);
-        Objects.requireNonNull(mSubscriptionManager, "TELEPHONY_SUBSCRIPTION_SERVICE is null");
-        // Initialize subscription on the handler thread
-        mHandler = new Handler(headsetService.getStateMachinesThreadLooper());
-        mOnSubscriptionsChangedListener = new HeadsetPhoneStateOnSubscriptionChangedListener();
-        mSubscriptionManager.addOnSubscriptionsChangedListener(command -> mHandler.post(command),
-                mOnSubscriptionsChangedListener);
-        mSignalStrengthUpdateRequest = new SignalStrengthUpdateRequest.Builder()
-                .setSignalThresholdInfos(Collections.EMPTY_LIST)
-                .setSystemThresholdReportingRequestedWhileIdle(true)
-                .build();
+        synchronized (mPhoneStateListenerLock) {
+            Objects.requireNonNull(headsetService, "headsetService is null");
+            mHeadsetService = headsetService;
+            mTelephonyManager = mHeadsetService.getSystemService(TelephonyManager.class);
+            Objects.requireNonNull(mTelephonyManager, "TELEPHONY_SERVICE is null");
+            // Register for SubscriptionInfo list changes which is guaranteed to invoke
+            // onSubscriptionInfoChanged and which in turns calls loadInBackgroud.
+            mSubscriptionManager = SubscriptionManager.from(mHeadsetService);
+            Objects.requireNonNull(mSubscriptionManager, "TELEPHONY_SUBSCRIPTION_SERVICE is null");
+            // Initialize subscription on the handler thread
+            mHandler = new Handler(headsetService.getStateMachinesThreadLooper());
+            mOnSubscriptionsChangedListener = new HeadsetPhoneStateOnSubscriptionChangedListener();
+            mSubscriptionManager.addOnSubscriptionsChangedListener(
+                    command -> mHandler.post(command), mOnSubscriptionsChangedListener);
+            mSignalStrengthUpdateRequest = new SignalStrengthUpdateRequest.Builder()
+                    .setSignalThresholdInfos(Collections.EMPTY_LIST)
+                    .setSystemThresholdReportingRequestedWhileIdle(true)
+                    .build();
+        }
     }
 
     /**
@@ -173,6 +175,7 @@
 
     private void stopListenForPhoneState() {
         synchronized (mPhoneStateListenerLock) {
+            mTelephonyManager.clearSignalStrengthUpdateRequest(mSignalStrengthUpdateRequest);
             if (mPhoneStateListener == null) {
                 Log.i(TAG, "stopListenForPhoneState(), no listener indicates nothing is listening");
                 return;
@@ -181,7 +184,6 @@
                     + getTelephonyEventsToListen());
             mTelephonyManager.listen(mPhoneStateListener, PhoneStateListener.LISTEN_NONE);
             mPhoneStateListener = null;
-            mTelephonyManager.clearSignalStrengthUpdateRequest(mSignalStrengthUpdateRequest);
         }
     }
 
diff --git a/android/app/src/com/android/bluetooth/hfp/HeadsetService.java b/android/app/src/com/android/bluetooth/hfp/HeadsetService.java
index 17a7067..856f7dd 100644
--- a/android/app/src/com/android/bluetooth/hfp/HeadsetService.java
+++ b/android/app/src/com/android/bluetooth/hfp/HeadsetService.java
@@ -23,9 +23,11 @@
 
 import android.annotation.Nullable;
 import android.annotation.RequiresPermission;
+import android.bluetooth.BluetoothClass;
 import android.bluetooth.BluetoothDevice;
 import android.bluetooth.BluetoothHeadset;
 import android.bluetooth.BluetoothProfile;
+import android.bluetooth.BluetoothSinkAudioPolicy;
 import android.bluetooth.BluetoothStatusCodes;
 import android.bluetooth.BluetoothUuid;
 import android.bluetooth.IBluetoothHeadset;
@@ -54,7 +56,10 @@
 import com.android.bluetooth.btservice.AdapterService;
 import com.android.bluetooth.btservice.MetricsLogger;
 import com.android.bluetooth.btservice.ProfileService;
+import com.android.bluetooth.btservice.ServiceFactory;
 import com.android.bluetooth.btservice.storage.DatabaseManager;
+import com.android.bluetooth.hfpclient.HeadsetClientService;
+import com.android.bluetooth.le_audio.LeAudioService;
 import com.android.bluetooth.telephony.BluetoothInCallService;
 import com.android.internal.annotations.VisibleForTesting;
 import com.android.modules.utils.SynchronousResultReceiver;
@@ -141,6 +146,8 @@
     private boolean mCreated;
     private static HeadsetService sHeadsetService;
 
+    private final ServiceFactory mFactory = new ServiceFactory();
+
     public static boolean isEnabled() {
         return BluetoothProperties.isProfileHfpAgEnabled().orElse(false);
     }
@@ -179,6 +186,7 @@
         // Step 3: Initialize system interface
         mSystemInterface = HeadsetObjectsFactory.getInstance().makeSystemInterface(this);
         // Step 4: Initialize native interface
+        setHeadsetService(this);
         mMaxHeadsetConnections = mAdapterService.getMaxConnectedAudioDevices();
         mNativeInterface = HeadsetObjectsFactory.getInstance().getNativeInterface();
         // Add 1 to allow a pending device to be connecting or disconnecting
@@ -197,7 +205,6 @@
         filter.addAction(BluetoothDevice.ACTION_BOND_STATE_CHANGED);
         registerReceiver(mHeadsetReceiver, filter);
         // Step 7: Mark service as started
-        setHeadsetService(this);
         mStarted = true;
         BluetoothDevice activeDevice = getActiveDevice();
         String deviceAddress = activeDevice != null ?
@@ -223,7 +230,6 @@
                 AdapterService.ACTIVITY_ATTRIBUTION_NO_ACTIVE_DEVICE_ADDRESS;
         mAdapterService.notifyActivityAttributionInfo(getAttributionSource(), deviceAddress);
         mStarted = false;
-        setHeadsetService(null);
         // Step 6: Tear down broadcast receivers
         unregisterReceiver(mHeadsetReceiver);
         synchronized (mStateMachines) {
@@ -256,6 +262,7 @@
         }
         // Step 4: Destroy native interface
         mNativeInterface.cleanup();
+        setHeadsetService(null);
         // Step 3: Destroy system interface
         mSystemInterface.stop();
         // Step 2: Stop handler thread
@@ -458,7 +465,8 @@
     /**
      * Handlers for incoming service calls
      */
-    private static class BluetoothHeadsetBinder extends IBluetoothHeadset.Stub
+    @VisibleForTesting
+    static class BluetoothHeadsetBinder extends IBluetoothHeadset.Stub
             implements IProfileServiceBinder {
         private volatile HeadsetService mService;
 
@@ -473,7 +481,10 @@
 
         @RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)
         private HeadsetService getService(AttributionSource source) {
-            if (!Utils.checkCallerIsSystemOrActiveUser(TAG)
+            if (Utils.isInstrumentationTestMode()) {
+                return mService;
+            }
+            if (!Utils.checkCallerIsSystemOrActiveOrManagedUser(mService, TAG)
                     || !Utils.checkServiceAvailable(mService, TAG)
                     || !Utils.checkConnectPermissionForDataDelivery(mService, source, TAG)) {
                 return null;
@@ -1355,10 +1366,38 @@
     }
 
     /**
+     * Get the Bluetooth Audio Policy stored in the state machine
+     *
+     * @param device the device to change silence mode
+     * @return a {@link BluetoothSinkAudioPolicy} object
+     */
+    public BluetoothSinkAudioPolicy getHfpCallAudioPolicy(BluetoothDevice device) {
+        synchronized (mStateMachines) {
+            final HeadsetStateMachine stateMachine = mStateMachines.get(device);
+            if (stateMachine == null) {
+                Log.e(TAG, "getHfpCallAudioPolicy(), " + device
+                        + " does not have a state machine");
+                return null;
+            }
+            return stateMachine.getHfpCallAudioPolicy();
+        }
+    }
+
+    /**
      * Remove the active device
      */
     private void removeActiveDevice() {
         synchronized (mStateMachines) {
+            // As per b/202602952, if we remove the active device due to a disconnection,
+            // we need to check if another device is connected and set it active instead.
+            // Calling this before any other active related calls has the same effect as
+            // a classic active device switch.
+            BluetoothDevice fallbackDevice = getFallbackDevice();
+            if (fallbackDevice != null && mActiveDevice != null
+                    && getConnectionState(mActiveDevice) != BluetoothProfile.STATE_CONNECTED) {
+                setActiveDevice(fallbackDevice);
+                return;
+            }
             // Clear the active device
             if (mVoiceRecognitionStarted) {
                 if (!stopVoiceRecognition(mActiveDevice)) {
@@ -1428,6 +1467,16 @@
                 }
                 broadcastActiveDevice(mActiveDevice);
             } else if (shouldPersistAudio()) {
+                /* If HFP is getting active for a phonecall and there is LeAudio device active,
+                 * Lets inactive LeAudio device as soon as possible so there is no CISes connected
+                 * when SCO is created
+                 */
+                LeAudioService leAudioService = mFactory.getLeAudioService();
+                if (leAudioService != null) {
+                    Log.i(TAG, "Make sure there is no le audio device active.");
+                    leAudioService.setInactiveForHfpHandover(mActiveDevice);
+                }
+
                 broadcastActiveDevice(mActiveDevice);
                 int connectStatus = connectAudio(mActiveDevice);
                 if (connectStatus != BluetoothStatusCodes.SUCCESS) {
@@ -1459,7 +1508,7 @@
         }
     }
 
-    int connectAudio() {
+    public int connectAudio() {
         synchronized (mStateMachines) {
             BluetoothDevice device = mActiveDevice;
             if (device == null) {
@@ -1862,7 +1911,24 @@
                 mSystemInterface.getAudioManager().setA2dpSuspended(false);
             }
         });
-
+        if (callState == HeadsetHalConstants.CALL_STATE_IDLE) {
+            final HeadsetStateMachine stateMachine = mStateMachines.get(mActiveDevice);
+            if (stateMachine == null) {
+                Log.d(TAG, "phoneStateChanged: CALL_STATE_IDLE, mActiveDevice is Null");
+            } else {
+                BluetoothSinkAudioPolicy currentPolicy = stateMachine.getHfpCallAudioPolicy();
+                if (currentPolicy != null && currentPolicy.getActiveDevicePolicyAfterConnection()
+                        == BluetoothSinkAudioPolicy.POLICY_NOT_ALLOWED) {
+                    /**
+                     * If the active device was set because of the pick up audio policy
+                     * and the connecting policy is NOT_ALLOWED, then after the call is
+                     * terminated, we must de-activate this device.
+                     * If there is a fallback mechanism, we should follow it.
+                     */
+                    removeActiveDevice();
+                }
+            }
+        }
     }
 
     @RequiresPermission(android.Manifest.permission.MODIFY_PHONE_STATE)
@@ -1903,11 +1969,40 @@
         return true;
     }
 
-    boolean isInbandRingingEnabled() {
+    /**
+     * Checks if headset devices are able to get inband ringing.
+     *
+     * @return True if inband ringing is enabled.
+     */
+    public boolean isInbandRingingEnabled() {
         boolean isInbandRingingSupported = getResources().getBoolean(
                 com.android.bluetooth.R.bool.config_bluetooth_hfp_inband_ringing_support);
+
+        boolean inbandRingtoneAllowedByPolicy = true;
+        List<BluetoothDevice> audioConnectableDevices = getConnectedDevices();
+        if (audioConnectableDevices.size() == 1) {
+            BluetoothDevice connectedDevice = audioConnectableDevices.get(0);
+            BluetoothSinkAudioPolicy callAudioPolicy =
+                    getHfpCallAudioPolicy(connectedDevice);
+            if (callAudioPolicy != null && callAudioPolicy.getInBandRingtonePolicy()
+                    == BluetoothSinkAudioPolicy.POLICY_NOT_ALLOWED) {
+                inbandRingtoneAllowedByPolicy = false;
+            }
+        }
+
         return isInbandRingingSupported && !SystemProperties.getBoolean(
-                DISABLE_INBAND_RINGING_PROPERTY, false) && !mInbandRingingRuntimeDisable;
+                DISABLE_INBAND_RINGING_PROPERTY, false)
+                && !mInbandRingingRuntimeDisable
+                && inbandRingtoneAllowedByPolicy
+                && !isHeadsetClientConnected();
+    }
+
+    private boolean isHeadsetClientConnected() {
+        HeadsetClientService headsetClientService = HeadsetClientService.getHeadsetClientService();
+        if (headsetClientService == null) {
+            return false;
+        }
+        return !(headsetClientService.getConnectedDevices().isEmpty());
     }
 
     /**
@@ -1922,30 +2017,53 @@
     @RequiresPermission(android.Manifest.permission.MODIFY_PHONE_STATE)
     public void onConnectionStateChangedFromStateMachine(BluetoothDevice device, int fromState,
             int toState) {
-        synchronized (mStateMachines) {
-            List<BluetoothDevice> audioConnectableDevices =
-                    getDevicesMatchingConnectionStates(CONNECTING_CONNECTED_STATES);
-            if (fromState != BluetoothProfile.STATE_CONNECTED
-                    && toState == BluetoothProfile.STATE_CONNECTED) {
-                if (audioConnectableDevices.size() > 1) {
-                    mInbandRingingRuntimeDisable = true;
-                    doForEachConnectedStateMachine(
-                            stateMachine -> stateMachine.sendMessage(HeadsetStateMachine.SEND_BSIR,
-                                    0));
-                }
-                MetricsLogger.logProfileConnectionEvent(BluetoothMetricsProto.ProfileId.HEADSET);
+        if (fromState != BluetoothProfile.STATE_CONNECTED
+                && toState == BluetoothProfile.STATE_CONNECTED) {
+            updateInbandRinging(device, true);
+            MetricsLogger.logProfileConnectionEvent(BluetoothMetricsProto.ProfileId.HEADSET);
+        }
+        if (fromState != BluetoothProfile.STATE_DISCONNECTED
+                && toState == BluetoothProfile.STATE_DISCONNECTED) {
+            updateInbandRinging(device, false);
+            if (device.equals(mActiveDevice)) {
+                setActiveDevice(null);
             }
-            if (fromState != BluetoothProfile.STATE_DISCONNECTED
-                    && toState == BluetoothProfile.STATE_DISCONNECTED) {
-                if (audioConnectableDevices.size() <= 1) {
-                    mInbandRingingRuntimeDisable = false;
-                    doForEachConnectedStateMachine(
-                            stateMachine -> stateMachine.sendMessage(HeadsetStateMachine.SEND_BSIR,
-                                    1));
-                }
-                if (device.equals(mActiveDevice)) {
-                    setActiveDevice(null);
-                }
+        }
+    }
+
+    /**
+     * Called from {@link HeadsetClientStateMachine} to update inband ringing status.
+     */
+    public void updateInbandRinging(BluetoothDevice device, boolean connected) {
+        synchronized (mStateMachines) {
+            List<BluetoothDevice> audioConnectableDevices = getConnectedDevices();
+            final int enabled;
+            final boolean inbandRingingRuntimeDisable = mInbandRingingRuntimeDisable;
+
+            if (audioConnectableDevices.size() > 1 || isHeadsetClientConnected()) {
+                mInbandRingingRuntimeDisable = true;
+                enabled = 0;
+            } else {
+                mInbandRingingRuntimeDisable = false;
+                enabled = 1;
+            }
+
+            final boolean updateAll = inbandRingingRuntimeDisable != mInbandRingingRuntimeDisable;
+
+            Log.i(TAG, "updateInbandRinging():"
+                    + " Device=" + device
+                    + " enabled=" + enabled
+                    + " connected=" + connected
+                    + " Update all=" + updateAll);
+
+            StateMachineTask sendBsirTask = stateMachine -> stateMachine
+                            .sendMessage(HeadsetStateMachine.SEND_BSIR, enabled);
+
+            if (updateAll) {
+                doForEachConnectedStateMachine(sendBsirTask);
+            } else if (connected) {
+                // Same Inband ringing status, send +BSIR only to the new connected device
+                doForStateMachine(device, sendBsirTask);
             }
         }
     }
@@ -2149,6 +2267,38 @@
                 == mStateMachinesThread.getId());
     }
 
+    /**
+     * Retrieves the most recently connected device in the A2DP connected devices list.
+     */
+    public BluetoothDevice getFallbackDevice() {
+        DatabaseManager dbManager = mAdapterService.getDatabase();
+        return dbManager != null ? dbManager
+            .getMostRecentlyConnectedDevicesInList(getFallbackCandidates(dbManager))
+            : null;
+    }
+
+    @VisibleForTesting(visibility = VisibleForTesting.Visibility.PACKAGE)
+    List<BluetoothDevice> getFallbackCandidates(DatabaseManager dbManager) {
+        List<BluetoothDevice> fallbackCandidates = getConnectedDevices();
+        List<BluetoothDevice> uninterestedCandidates = new ArrayList<>();
+        for (BluetoothDevice device : fallbackCandidates) {
+            byte[] deviceType = dbManager.getCustomMeta(device,
+                    BluetoothDevice.METADATA_DEVICE_TYPE);
+            BluetoothClass deviceClass = device.getBluetoothClass();
+            if ((deviceClass != null
+                    && deviceClass.getMajorDeviceClass()
+                    == BluetoothClass.Device.WEARABLE_WRIST_WATCH)
+                    || (deviceType != null
+                    && BluetoothDevice.DEVICE_TYPE_WATCH.equals(new String(deviceType)))) {
+                uninterestedCandidates.add(device);
+            }
+        }
+        for (BluetoothDevice device : uninterestedCandidates) {
+            fallbackCandidates.remove(device);
+        }
+        return fallbackCandidates;
+    }
+
     @Override
     public void dump(StringBuilder sb) {
         boolean isScoOn = mSystemInterface.getAudioManager().isBluetoothScoOn();
diff --git a/android/app/src/com/android/bluetooth/hfp/HeadsetStateMachine.java b/android/app/src/com/android/bluetooth/hfp/HeadsetStateMachine.java
index e431c43..03ea3fa 100644
--- a/android/app/src/com/android/bluetooth/hfp/HeadsetStateMachine.java
+++ b/android/app/src/com/android/bluetooth/hfp/HeadsetStateMachine.java
@@ -25,6 +25,7 @@
 import android.bluetooth.BluetoothHeadset;
 import android.bluetooth.BluetoothProfile;
 import android.bluetooth.BluetoothProtoEnums;
+import android.bluetooth.BluetoothSinkAudioPolicy;
 import android.bluetooth.BluetoothStatusCodes;
 import android.bluetooth.hfp.BluetoothHfpProtoEnums;
 import android.content.Intent;
@@ -43,6 +44,7 @@
 import com.android.bluetooth.Utils;
 import com.android.bluetooth.btservice.AdapterService;
 import com.android.bluetooth.btservice.ProfileService;
+import com.android.bluetooth.btservice.storage.DatabaseManager;
 import com.android.internal.annotations.VisibleForTesting;
 import com.android.internal.util.State;
 import com.android.internal.util.StateMachine;
@@ -134,10 +136,13 @@
     private final AdapterService mAdapterService;
     private final HeadsetNativeInterface mNativeInterface;
     private final HeadsetSystemInterface mSystemInterface;
+    private DatabaseManager mDatabaseManager;
 
     // Runtime states
-    private int mSpeakerVolume;
-    private int mMicVolume;
+    @VisibleForTesting
+    int mSpeakerVolume;
+    @VisibleForTesting
+    int mMicVolume;
     private boolean mDeviceSilenced;
     private HeadsetAgIndicatorEnableState mAgIndicatorEnableState;
     // The timestamp when the device entered connecting/connected state
@@ -146,12 +151,17 @@
     private boolean mHasNrecEnabled = false;
     private boolean mHasWbsEnabled = false;
     // AT Phone book keeps a group of states used by AT+CPBR commands
-    private final AtPhonebook mPhonebook;
+    @VisibleForTesting
+    final AtPhonebook mPhonebook;
     // HSP specific
     private boolean mNeedDialingOutReply;
     // Audio disconnect timeout retry count
     private int mAudioDisconnectRetry = 0;
 
+    static final int HFP_SET_AUDIO_POLICY = 1;
+
+    private BluetoothSinkAudioPolicy mHsClientAudioPolicy;
+
     // Keys are AT commands, and values are the company IDs.
     private static final Map<String, Integer> VENDOR_SPECIFIC_AT_COMMAND_COMPANY_ID;
 
@@ -184,7 +194,22 @@
         mSystemInterface =
                 Objects.requireNonNull(systemInterface, "systemInterface cannot be null");
         mAdapterService = Objects.requireNonNull(adapterService, "AdapterService cannot be null");
+        mDatabaseManager = Objects.requireNonNull(
+            AdapterService.getAdapterService().getDatabase(),
+            "DatabaseManager cannot be null when HeadsetClientStateMachine is created");
         mDeviceSilenced = false;
+
+        BluetoothSinkAudioPolicy storedAudioPolicy =
+                mDatabaseManager.getAudioPolicyMetadata(device);
+        if (storedAudioPolicy == null) {
+            Log.w(TAG, "Audio Policy not created in database! Creating...");
+            mHsClientAudioPolicy = new BluetoothSinkAudioPolicy.Builder().build();
+            mDatabaseManager.setAudioPolicyMetadata(device, mHsClientAudioPolicy);
+        } else {
+            Log.i(TAG, "Audio Policy found in database!");
+            mHsClientAudioPolicy = storedAudioPolicy;
+        }
+
         // Create phonebook helper
         mPhonebook = new AtPhonebook(mHeadsetService, mNativeInterface);
         // Initialize state machine
@@ -238,6 +263,8 @@
         ProfileService.println(sb, "  mMicVolume: " + mMicVolume);
         ProfileService.println(sb,
                 "  mConnectingTimestampMs(uptimeMillis): " + mConnectingTimestampMs);
+        ProfileService.println(sb, "  mHsClientAudioPolicy: " + mHsClientAudioPolicy.toString());
+
         ProfileService.println(sb, "  StateMachine: " + this);
         // Dump the state machine logs
         StringWriter stringWriter = new StringWriter();
@@ -1516,7 +1543,8 @@
     /*
      * Put the AT command, company ID, arguments, and device in an Intent and broadcast it.
      */
-    private void broadcastVendorSpecificEventIntent(String command, int companyId, int commandType,
+    @VisibleForTesting
+    void broadcastVendorSpecificEventIntent(String command, int companyId, int commandType,
             Object[] arguments, BluetoothDevice device) {
         log("broadcastVendorSpecificEventIntent(" + command + ")");
         Intent intent = new Intent(BluetoothHeadset.ACTION_VENDOR_SPECIFIC_HEADSET_EVENT);
@@ -1540,7 +1568,8 @@
         am.setBluetoothHeadsetProperties(getCurrentDeviceName(), mHasNrecEnabled, mHasWbsEnabled);
     }
 
-    private String parseUnknownAt(String atString) {
+    @VisibleForTesting
+    String parseUnknownAt(String atString) {
         StringBuilder atCommand = new StringBuilder(atString.length());
 
         for (int i = 0; i < atString.length(); i++) {
@@ -1561,7 +1590,8 @@
         return atCommand.toString();
     }
 
-    private int getAtCommandType(String atCommand) {
+    @VisibleForTesting
+    int getAtCommandType(String atCommand) {
         int commandType = AtPhonebook.TYPE_UNKNOWN;
         String atString = null;
         atCommand = atCommand.trim();
@@ -1642,7 +1672,8 @@
         }
     }
 
-    private void processVolumeEvent(int volumeType, int volume) {
+    @VisibleForTesting
+    void processVolumeEvent(int volumeType, int volume) {
         // Only current active device can change SCO volume
         if (!mDevice.equals(mHeadsetService.getActiveDevice())) {
             Log.w(TAG, "processVolumeEvent, ignored because " + mDevice + " is not active");
@@ -1691,7 +1722,8 @@
     }
 
     @RequiresPermission(android.Manifest.permission.MODIFY_PHONE_STATE)
-    private void processAtChld(int chld, BluetoothDevice device) {
+    @VisibleForTesting
+    void processAtChld(int chld, BluetoothDevice device) {
         if (mSystemInterface.processChld(chld)) {
             mNativeInterface.atResponseCode(device, HeadsetHalConstants.AT_RESPONSE_OK, 0);
         } else {
@@ -1700,7 +1732,8 @@
     }
 
     @RequiresPermission(android.Manifest.permission.MODIFY_PHONE_STATE)
-    private void processSubscriberNumberRequest(BluetoothDevice device) {
+    @VisibleForTesting
+    void processSubscriberNumberRequest(BluetoothDevice device) {
         String number = mSystemInterface.getSubscriberNumber();
         if (number != null) {
             mNativeInterface.atResponseString(device,
@@ -1735,7 +1768,8 @@
     }
 
     @RequiresPermission(android.Manifest.permission.MODIFY_PHONE_STATE)
-    private void processAtCops(BluetoothDevice device) {
+    @VisibleForTesting
+    void processAtCops(BluetoothDevice device) {
         // Get operator name suggested by Telephony
         String operatorName = null;
         ServiceState serviceState = mSystemInterface.getHeadsetPhoneState().getServiceState();
@@ -1756,7 +1790,8 @@
     }
 
     @RequiresPermission(android.Manifest.permission.MODIFY_PHONE_STATE)
-    private void processAtClcc(BluetoothDevice device) {
+    @VisibleForTesting
+    void processAtClcc(BluetoothDevice device) {
         if (mHeadsetService.isVirtualCallStarted()) {
             // In virtual call, send our phone number instead of remote phone number
             String phoneNumber = mSystemInterface.getSubscriberNumber();
@@ -1777,7 +1812,8 @@
         }
     }
 
-    private void processAtCscs(String atString, int type, BluetoothDevice device) {
+    @VisibleForTesting
+    void processAtCscs(String atString, int type, BluetoothDevice device) {
         log("processAtCscs - atString = " + atString);
         if (mPhonebook != null) {
             mPhonebook.handleCscsCommand(atString, type, device);
@@ -1787,7 +1823,8 @@
         }
     }
 
-    private void processAtCpbs(String atString, int type, BluetoothDevice device) {
+    @VisibleForTesting
+    void processAtCpbs(String atString, int type, BluetoothDevice device) {
         log("processAtCpbs - atString = " + atString);
         if (mPhonebook != null) {
             mPhonebook.handleCpbsCommand(atString, type, device);
@@ -1797,7 +1834,8 @@
         }
     }
 
-    private void processAtCpbr(String atString, int type, BluetoothDevice device) {
+    @VisibleForTesting
+    void processAtCpbr(String atString, int type, BluetoothDevice device) {
         log("processAtCpbr - atString = " + atString);
         if (mPhonebook != null) {
             mPhonebook.handleCpbrCommand(atString, type, device);
@@ -1811,7 +1849,8 @@
      * Find a character ch, ignoring quoted sections.
      * Return input.length() if not found.
      */
-    private static int findChar(char ch, String input, int fromIndex) {
+    @VisibleForTesting
+    static int findChar(char ch, String input, int fromIndex) {
         for (int i = fromIndex; i < input.length(); i++) {
             char c = input.charAt(i);
             if (c == '"') {
@@ -1831,7 +1870,8 @@
      * Integer arguments are turned into Integer objects. Otherwise a String
      * object is used.
      */
-    private static Object[] generateArgs(String input) {
+    @VisibleForTesting
+    static Object[] generateArgs(String input) {
         int i = 0;
         int j;
         ArrayList<Object> out = new ArrayList<Object>();
@@ -1856,7 +1896,8 @@
      * @param atString AT command after the "AT+" prefix
      * @param device Remote device that has sent this command
      */
-    private void processVendorSpecificAt(String atString, BluetoothDevice device) {
+    @VisibleForTesting
+    void processVendorSpecificAt(String atString, BluetoothDevice device) {
         log("processVendorSpecificAt - atString = " + atString);
 
         // Currently we accept only SET type commands.
@@ -1892,12 +1933,126 @@
     }
 
     /**
+     * Process Android specific AT commands.
+     *
+     * @param atString AT command after the "AT+" prefix. Starts with "ANDROID"
+     * @param device Remote device that has sent this command
+     */
+    private void processAndroidAt(String atString, BluetoothDevice device) {
+        log("processAndroidSpecificAt - atString = " + atString);
+
+        if (atString.equals("+ANDROID=?")) {
+            // feature request type command
+            processAndroidAtFeatureRequest(device);
+        } else if (atString.startsWith("+ANDROID=")) {
+            // set type command
+            int equalIndex = atString.indexOf("=");
+            String arg = atString.substring(equalIndex + 1);
+
+            if (arg.isEmpty()) {
+                Log.e(TAG, "Command Invalid!");
+                mNativeInterface.atResponseCode(device, HeadsetHalConstants.AT_RESPONSE_ERROR, 0);
+                return;
+            }
+
+            Object[] args = generateArgs(arg);
+
+            if (!(args[0] instanceof Integer)) {
+                Log.e(TAG, "Type ID is invalid");
+                mNativeInterface.atResponseCode(device, HeadsetHalConstants.AT_RESPONSE_ERROR, 0);
+                return;
+            }
+
+            int type = (Integer) args[0];
+
+            if (type == HFP_SET_AUDIO_POLICY) {
+                processAndroidAtSetAudioPolicy(args, device);
+            } else {
+                Log.w(TAG, "Undefined AT+ANDROID command");
+                mNativeInterface.atResponseCode(device, HeadsetHalConstants.AT_RESPONSE_ERROR, 0);
+                return;
+            }
+        } else {
+            Log.e(TAG, "Undefined AT+ANDROID command");
+            mNativeInterface.atResponseCode(device, HeadsetHalConstants.AT_RESPONSE_ERROR, 0);
+            return;
+        }
+        mNativeInterface.atResponseCode(device, HeadsetHalConstants.AT_RESPONSE_OK, 0);
+    }
+
+    private void processAndroidAtFeatureRequest(BluetoothDevice device) {
+        /*
+            replying with +ANDROID=1
+            here, 1 is the feature id for audio policy
+
+            currently we only support one type of feature
+        */
+        mNativeInterface.atResponseString(device,
+                BluetoothHeadset.VENDOR_RESULT_CODE_COMMAND_ANDROID
+                + ": " + HFP_SET_AUDIO_POLICY);
+    }
+
+    /**
+     * Process AT+ANDROID AT command
+     *
+     * @param args command arguments after the equal sign
+     * @param device Remote device that has sent this command
+     */
+    private void processAndroidAtSetAudioPolicy(Object[] args, BluetoothDevice device) {
+        if (args.length != 4) {
+            Log.e(TAG, "processAndroidAtSetAudioPolicy() args length must be 4: "
+                    + String.valueOf(args.length));
+            return;
+        }
+        if (!(args[1] instanceof Integer) || !(args[2] instanceof Integer)
+                || !(args[3] instanceof Integer)) {
+            Log.e(TAG, "processAndroidAtSetAudioPolicy() argument types not matched");
+            return;
+        }
+
+        if (!mDevice.equals(device)) {
+            Log.e(TAG, "processAndroidAtSetAudioPolicy(): argument device " + device
+                    + " doesn't match mDevice " + mDevice);
+            return;
+        }
+
+        int callEstablishPolicy = (Integer) args[1];
+        int connectingTimePolicy = (Integer) args[2];
+        int inbandPolicy = (Integer) args[3];
+
+        setHfpCallAudioPolicy(new BluetoothSinkAudioPolicy.Builder()
+                .setCallEstablishPolicy(callEstablishPolicy)
+                .setActiveDevicePolicyAfterConnection(connectingTimePolicy)
+                .setInBandRingtonePolicy(inbandPolicy)
+                .build());
+    }
+
+    /**
+     * sets the audio policy of the client device and stores in the database
+     *
+     * @param policies policies to be set and stored
+     */
+    public void setHfpCallAudioPolicy(BluetoothSinkAudioPolicy policies) {
+        mHsClientAudioPolicy = policies;
+        mDatabaseManager.setAudioPolicyMetadata(mDevice, policies);
+    }
+
+    /**
+     * get the audio policy of the client device
+     *
+     */
+    public BluetoothSinkAudioPolicy getHfpCallAudioPolicy() {
+        return mHsClientAudioPolicy;
+    }
+
+    /**
      * Process AT+XAPL AT command
      *
      * @param args command arguments after the equal sign
      * @param device Remote device that has sent this command
      */
-    private void processAtXapl(Object[] args, BluetoothDevice device) {
+    @VisibleForTesting
+    void processAtXapl(Object[] args, BluetoothDevice device) {
         if (args.length != 2) {
             Log.w(TAG, "processAtXapl() args length must be 2: " + String.valueOf(args.length));
             return;
@@ -1926,7 +2081,8 @@
         mNativeInterface.atResponseString(device, "+XAPL=iPhone," + String.valueOf(2));
     }
 
-    private void processUnknownAt(String atString, BluetoothDevice device) {
+    @VisibleForTesting
+    void processUnknownAt(String atString, BluetoothDevice device) {
         if (device == null) {
             Log.w(TAG, "processUnknownAt device is null");
             return;
@@ -1940,6 +2096,8 @@
             processAtCpbs(atCommand.substring(5), commandType, device);
         } else if (atCommand.startsWith("+CPBR")) {
             processAtCpbr(atCommand.substring(5), commandType, device);
+        } else if (atCommand.startsWith("+ANDROID")) {
+            processAndroidAt(atCommand, device);
         } else {
             processVendorSpecificAt(atCommand, device);
         }
@@ -2028,12 +2186,14 @@
         }
     }
 
-    private void processAtBiev(int indId, int indValue, BluetoothDevice device) {
+    @VisibleForTesting
+    void processAtBiev(int indId, int indValue, BluetoothDevice device) {
         log("processAtBiev: ind_id=" + indId + ", ind_value=" + indValue);
         sendIndicatorIntent(device, indId, indValue);
     }
 
-    private void processSendClccResponse(HeadsetClccResponse clcc) {
+    @VisibleForTesting
+    void processSendClccResponse(HeadsetClccResponse clcc) {
         if (!hasMessages(CLCC_RSP_TIMEOUT)) {
             return;
         }
@@ -2044,7 +2204,8 @@
                 clcc.mMode, clcc.mMpty, clcc.mNumber, clcc.mType);
     }
 
-    private void processSendVendorSpecificResultCode(HeadsetVendorSpecificResultCode resultCode) {
+    @VisibleForTesting
+    void processSendVendorSpecificResultCode(HeadsetVendorSpecificResultCode resultCode) {
         String stringToSend = resultCode.mCommand + ": ";
         if (resultCode.mArg != null) {
             stringToSend += resultCode.mArg;
@@ -2105,7 +2266,8 @@
         return builder.toString();
     }
 
-    private void handleAccessPermissionResult(Intent intent) {
+    @VisibleForTesting
+    void handleAccessPermissionResult(Intent intent) {
         log("handleAccessPermissionResult");
         BluetoothDevice device = intent.getParcelableExtra(BluetoothDevice.EXTRA_DEVICE);
         if (!mPhonebook.getCheckingAccessPermission()) {
diff --git a/android/app/src/com/android/bluetooth/hfp/HeadsetSystemInterface.java b/android/app/src/com/android/bluetooth/hfp/HeadsetSystemInterface.java
index 08f4bdb..bbf4e36 100644
--- a/android/app/src/com/android/bluetooth/hfp/HeadsetSystemInterface.java
+++ b/android/app/src/com/android/bluetooth/hfp/HeadsetSystemInterface.java
@@ -21,6 +21,7 @@
 import android.annotation.RequiresPermission;
 import android.bluetooth.BluetoothDevice;
 import android.bluetooth.BluetoothHeadset;
+import android.bluetooth.BluetoothSinkAudioPolicy;
 import android.content.ActivityNotFoundException;
 import android.content.ComponentName;
 import android.content.Intent;
@@ -155,13 +156,19 @@
     @VisibleForTesting
     @RequiresPermission(android.Manifest.permission.MODIFY_PHONE_STATE)
     public void answerCall(BluetoothDevice device) {
+        Log.d(TAG, "answerCall");
         if (device == null) {
             Log.w(TAG, "answerCall device is null");
             return;
         }
         BluetoothInCallService bluetoothInCallService = getBluetoothInCallServiceInstance();
         if (bluetoothInCallService != null) {
-            mHeadsetService.setActiveDevice(device);
+            BluetoothSinkAudioPolicy callAudioPolicy =
+                    mHeadsetService.getHfpCallAudioPolicy(device);
+            if (callAudioPolicy == null || callAudioPolicy.getCallEstablishPolicy()
+                    != BluetoothSinkAudioPolicy.POLICY_NOT_ALLOWED) {
+                mHeadsetService.setActiveDevice(device);
+            }
             bluetoothInCallService.answerCall();
         } else {
             Log.e(TAG, "Handsfree phone proxy null for answering call");
diff --git a/android/app/src/com/android/bluetooth/hfpclient/HeadsetClientService.java b/android/app/src/com/android/bluetooth/hfpclient/HeadsetClientService.java
index 6c60bff..9221d98 100644
--- a/android/app/src/com/android/bluetooth/hfpclient/HeadsetClientService.java
+++ b/android/app/src/com/android/bluetooth/hfpclient/HeadsetClientService.java
@@ -21,6 +21,8 @@
 import android.bluetooth.BluetoothHeadsetClient;
 import android.bluetooth.BluetoothHeadsetClientCall;
 import android.bluetooth.BluetoothProfile;
+import android.bluetooth.BluetoothSinkAudioPolicy;
+import android.bluetooth.BluetoothStatusCodes;
 import android.bluetooth.IBluetoothHeadsetClient;
 import android.content.AttributionSource;
 import android.content.BroadcastReceiver;
@@ -32,6 +34,7 @@
 import android.os.Bundle;
 import android.os.HandlerThread;
 import android.os.Message;
+import android.os.SystemProperties;
 import android.sysprop.BluetoothProperties;
 import android.util.Log;
 
@@ -59,7 +62,7 @@
  * @hide
  */
 public class HeadsetClientService extends ProfileService {
-    private static final boolean DBG = false;
+    private static final boolean DBG = true;
     private static final String TAG = "HeadsetClientService";
 
     // This is also used as a lock for shared data in {@link HeadsetClientService}
@@ -259,7 +262,8 @@
     /**
      * Handlers for incoming service calls
      */
-    private static class BluetoothHeadsetClientBinder extends IBluetoothHeadsetClient.Stub
+    @VisibleForTesting
+    static class BluetoothHeadsetClientBinder extends IBluetoothHeadsetClient.Stub
             implements IProfileServiceBinder {
         private HeadsetClientService mService;
 
@@ -274,8 +278,11 @@
 
         @RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)
         private HeadsetClientService getService(AttributionSource source) {
-            if (!Utils.checkCallerIsSystemOrActiveUser(TAG)
-                    || !Utils.checkServiceAvailable(mService, TAG)
+            if (Utils.isInstrumentationTestMode()) {
+                return mService;
+            }
+            if (!Utils.checkServiceAvailable(mService, TAG)
+                    || !Utils.checkCallerIsSystemOrActiveOrManagedUser(mService, TAG)
                     || !Utils.checkConnectPermissionForDataDelivery(mService, source, TAG)) {
                 return null;
             }
@@ -608,8 +615,10 @@
                 List<BluetoothHeadsetClientCall> defaultValue = new ArrayList<>();
                 if (service != null) {
                     List<HfpClientCall> calls = service.getCurrentCalls(device);
-                    for (HfpClientCall call : calls) {
-                        defaultValue.add(toLegacyCall(call));
+                    if (calls != null) {
+                        for (HfpClientCall call : calls) {
+                            defaultValue.add(toLegacyCall(call));
+                        }
                     }
                 }
                 receiver.send(defaultValue);
@@ -774,7 +783,7 @@
         return connectedDevices;
     }
 
-    private List<BluetoothDevice> getDevicesMatchingConnectionStates(int[] states) {
+    List<BluetoothDevice> getDevicesMatchingConnectionStates(int[] states) {
         List<BluetoothDevice> devices = new ArrayList<BluetoothDevice>();
         synchronized (mStateMachineMap) {
             for (BluetoothDevice bd : mStateMachineMap.keySet()) {
@@ -902,6 +911,8 @@
 
     public void setAudioRouteAllowed(BluetoothDevice device, boolean allowed) {
         enforceCallingOrSelfPermission(BLUETOOTH_PERM, "Need BLUETOOTH permission");
+        Log.i(TAG, "setAudioRouteAllowed: device=" + device + ", allowed=" + allowed + ", "
+                + Utils.getUidPidString());
         HeadsetClientStateMachine sm = mStateMachineMap.get(device);
         if (sm != null) {
             sm.setAudioRouteAllowed(allowed);
@@ -917,7 +928,55 @@
         return false;
     }
 
+    /**
+     * sends the {@link BluetoothSinkAudioPolicy} object to the state machine of the corresponding
+     * device to store and send to the remote device using Android specific AT commands.
+     *
+     * @param device for whom the policies to be set
+     * @param policies to be set policies
+     */
+    public void setAudioPolicy(BluetoothDevice device, BluetoothSinkAudioPolicy policies) {
+        enforceCallingOrSelfPermission(BLUETOOTH_PERM, "Need BLUETOOTH permission");
+        Log.i(TAG, "setAudioPolicy: device=" + device + ", " + policies.toString() + ", "
+                + Utils.getUidPidString());
+        HeadsetClientStateMachine sm = getStateMachine(device);
+        if (sm != null) {
+            sm.setAudioPolicy(policies);
+        }
+    }
+
+    /**
+     * sets the audio policy feature support status for the corresponding device.
+     *
+     * @param device for whom the policies to be set
+     * @param supported support status
+     */
+    public void setAudioPolicyRemoteSupported(BluetoothDevice device, boolean supported) {
+        enforceCallingOrSelfPermission(BLUETOOTH_PERM, "Need BLUETOOTH permission");
+        Log.i(TAG, "setAudioPolicyRemoteSupported: " + supported);
+        HeadsetClientStateMachine sm = getStateMachine(device);
+        if (sm != null) {
+            sm.setAudioPolicyRemoteSupported(supported);
+        }
+    }
+
+    /**
+     * gets the audio policy feature support status for the corresponding device.
+     *
+     * @param device for whom the policies to be set
+     * @return int support status
+     */
+    public int getAudioPolicyRemoteSupported(BluetoothDevice device) {
+        enforceCallingOrSelfPermission(BLUETOOTH_PERM, "Need BLUETOOTH permission");
+        HeadsetClientStateMachine sm = getStateMachine(device);
+        if (sm != null) {
+            return sm.getAudioPolicyRemoteSupported();
+        }
+        return BluetoothStatusCodes.FEATURE_NOT_CONFIGURED;
+    }
+
     public boolean connectAudio(BluetoothDevice device) {
+        Log.i(TAG, "connectAudio: device=" + device + ", " + Utils.getUidPidString());
         HeadsetClientStateMachine sm = getStateMachine(device);
         if (sm == null) {
             Log.e(TAG, "SM does not exist for device " + device);
@@ -1071,6 +1130,14 @@
             return null;
         }
 
+        // Some platform does not support three way calling (ex: watch)
+        final boolean support_three_way_calling = SystemProperties
+                .getBoolean("bluetooth.headset_client.three_way_calling.enabled", true);
+        if (!support_three_way_calling && !getCurrentCalls(device).isEmpty()) {
+            Log.e(TAG, String.format("dial(%s): Line is busy, reject dialing", device));
+            return null;
+        }
+
         HfpClientCall call = new HfpClientCall(device,
                 HeadsetClientStateMachine.HF_ORIGINATED_CALL_ID,
                 HfpClientCall.CALL_STATE_DIALING, number, false  /* multiparty */,
diff --git a/android/app/src/com/android/bluetooth/hfpclient/HeadsetClientStateMachine.java b/android/app/src/com/android/bluetooth/hfpclient/HeadsetClientStateMachine.java
index 4026b39..804dadd 100644
--- a/android/app/src/com/android/bluetooth/hfpclient/HeadsetClientStateMachine.java
+++ b/android/app/src/com/android/bluetooth/hfpclient/HeadsetClientStateMachine.java
@@ -41,6 +41,8 @@
 import android.bluetooth.BluetoothHeadsetClient;
 import android.bluetooth.BluetoothHeadsetClient.NetworkServiceState;
 import android.bluetooth.BluetoothProfile;
+import android.bluetooth.BluetoothSinkAudioPolicy;
+import android.bluetooth.BluetoothStatusCodes;
 import android.bluetooth.BluetoothUuid;
 import android.bluetooth.hfp.BluetoothHfpProtoEnums;
 import android.content.Intent;
@@ -52,6 +54,7 @@
 import android.os.Message;
 import android.os.ParcelUuid;
 import android.os.SystemClock;
+import android.os.SystemProperties;
 import android.util.Log;
 import android.util.Pair;
 
@@ -62,6 +65,7 @@
 import com.android.bluetooth.btservice.AdapterService;
 import com.android.bluetooth.btservice.MetricsLogger;
 import com.android.bluetooth.btservice.ProfileService;
+import com.android.bluetooth.hfp.HeadsetService;
 import com.android.internal.annotations.VisibleForTesting;
 import com.android.internal.util.IState;
 import com.android.internal.util.State;
@@ -108,12 +112,17 @@
     public static final int DISABLE_NREC = 20;
     public static final int SEND_VENDOR_AT_COMMAND = 21;
     public static final int SEND_BIEV = 22;
+    public static final int SEND_ANDROID_AT_COMMAND = 23;
 
     // internal actions
-    private static final int QUERY_CURRENT_CALLS = 50;
-    private static final int QUERY_OPERATOR_NAME = 51;
-    private static final int SUBSCRIBER_INFO = 52;
-    private static final int CONNECTING_TIMEOUT = 53;
+    @VisibleForTesting
+    static final int QUERY_CURRENT_CALLS = 50;
+    @VisibleForTesting
+    static final int QUERY_OPERATOR_NAME = 51;
+    @VisibleForTesting
+    static final int SUBSCRIBER_INFO = 52;
+    @VisibleForTesting
+    static final int CONNECTING_TIMEOUT = 53;
 
     // special action to handle terminating specific call from multiparty call
     static final int TERMINATE_SPECIFIC_CALL = 53;
@@ -141,10 +150,12 @@
     private long mClccTimer = 0;
 
     private final HeadsetClientService mService;
+    private final HeadsetService mHeadsetService;
 
     // Set of calls that represent the accurate state of calls that exists on AG and the calls that
     // are currently in process of being notified to the AG from HF.
-    private final Hashtable<Integer, HfpClientCall> mCalls = new Hashtable<>();
+    @VisibleForTesting
+    final Hashtable<Integer, HfpClientCall> mCalls = new Hashtable<>();
     // Set of calls received from AG via the AT+CLCC command. We use this map to update the mCalls
     // which is eventually used to inform the telephony stack of any changes to call on HF.
     private final Hashtable<Integer, HfpClientCall> mCallsUpdate = new Hashtable<>();
@@ -156,31 +167,43 @@
     private boolean mInBandRing;
 
     private String mOperatorName;
-    private String mSubscriberInfo;
+    @VisibleForTesting
+    String mSubscriberInfo;
 
     private static int sMaxAmVcVol;
     private static int sMinAmVcVol;
 
     // queue of send actions (pair action, action_data)
-    private Queue<Pair<Integer, Object>> mQueuedActions;
+    @VisibleForTesting
+    Queue<Pair<Integer, Object>> mQueuedActions;
 
     // last executed command, before action is complete e.g. waiting for some
     // indicator
     private Pair<Integer, Object> mPendingAction;
 
-    private int mAudioState;
+    @VisibleForTesting
+    int mAudioState;
     // Indicates whether audio can be routed to the device
     private boolean mAudioRouteAllowed;
+
+    private static final int CALL_AUDIO_POLICY_FEATURE_ID = 1;
+
+    public int mAudioPolicyRemoteSupported;
+    private BluetoothSinkAudioPolicy mHsClientAudioPolicy;
+
     private boolean mAudioWbs;
     private int mVoiceRecognitionActive;
     private final BluetoothAdapter mAdapter;
 
     // currently connected device
-    private BluetoothDevice mCurrentDevice = null;
+    @VisibleForTesting
+    BluetoothDevice mCurrentDevice = null;
 
     // general peer features and call handling features
-    private int mPeerFeatures;
-    private int mChldFeatures;
+    @VisibleForTesting
+    int mPeerFeatures;
+    @VisibleForTesting
+    int mChldFeatures;
 
     // This is returned when requesting focus from AudioManager
     private AudioFocusRequest mAudioFocusRequest;
@@ -200,11 +223,12 @@
     }
 
     public void dump(StringBuilder sb) {
-        if (mCurrentDevice == null) return;
-        ProfileService.println(sb,
-                "==== StateMachine for " + mCurrentDevice + " ====");
-        ProfileService.println(sb, "  mCurrentDevice: " + mCurrentDevice.getAddress() + "("
-                + Utils.getName(mCurrentDevice) + ") " + this.toString());
+        if (mCurrentDevice != null) {
+            ProfileService.println(sb,
+                    "==== StateMachine for " + mCurrentDevice + " ====");
+            ProfileService.println(sb, "  mCurrentDevice: " + mCurrentDevice.getAddress() + "("
+                    + Utils.getName(mCurrentDevice) + ") " + this.toString());
+        }
         ProfileService.println(sb, "  mAudioState: " + mAudioState);
         ProfileService.println(sb, "  mAudioWbs: " + mAudioWbs);
         ProfileService.println(sb, "  mIndicatorNetworkState: " + mIndicatorNetworkState);
@@ -214,6 +238,8 @@
         ProfileService.println(sb, "  mOperatorName: " + mOperatorName);
         ProfileService.println(sb, "  mSubscriberInfo: " + mSubscriberInfo);
         ProfileService.println(sb, "  mAudioRouteAllowed: " + mAudioRouteAllowed);
+        ProfileService.println(sb, "  mAudioPolicyRemoteSupported: " + mAudioPolicyRemoteSupported);
+        ProfileService.println(sb, "  mHsClientAudioPolicy: " + mHsClientAudioPolicy);
 
         ProfileService.println(sb, "  mCalls:");
         if (mCalls != null) {
@@ -257,7 +283,8 @@
         return builder.toString();
     }
 
-    private static String getMessageName(int what) {
+    @VisibleForTesting
+    static String getMessageName(int what) {
         switch (what) {
             case StackEvent.STACK_EVENT:
                 return "STACK_EVENT";
@@ -328,7 +355,8 @@
         mQueuedActions.add(new Pair<Integer, Object>(action, data));
     }
 
-    private HfpClientCall getCall(int... states) {
+    @VisibleForTesting
+    HfpClientCall getCall(int... states) {
         logD("getFromCallsWithStates states:" + Arrays.toString(states));
         for (HfpClientCall c : mCalls.values()) {
             for (int s : states) {
@@ -340,7 +368,8 @@
         return null;
     }
 
-    private int callsInState(int state) {
+    @VisibleForTesting
+    int callsInState(int state) {
         int i = 0;
         for (HfpClientCall c : mCalls.values()) {
             if (c.getState() == state) {
@@ -514,7 +543,12 @@
         }
 
         if (mCalls.size() > 0) {
-            if (mService.getResources().getBoolean(R.bool.hfp_clcc_poll_during_call)) {
+            // Continue polling even if not enabled until the new outgoing call is associated with
+            // a valid call on the phone. The polling would at most continue until
+            // OUTGOING_TIMEOUT_MILLI. This handles the potential scenario where the phone creates
+            // and terminates a call before the first QUERY_CURRENT_CALLS completes.
+            if (mService.getResources().getBoolean(R.bool.hfp_clcc_poll_during_call)
+                    || (mCalls.containsKey(HF_ORIGINATED_CALL_ID))) {
                 sendMessageDelayed(QUERY_CURRENT_CALLS,
                         mService.getResources().getInteger(
                         R.integer.hfp_clcc_poll_interval_during_call));
@@ -708,7 +742,8 @@
         }
     }
 
-    private void enterPrivateMode(int idx) {
+    @VisibleForTesting
+    void enterPrivateMode(int idx) {
         logD("enterPrivateMode: " + idx);
 
         HfpClientCall c = mCalls.get(idx);
@@ -726,7 +761,8 @@
         }
     }
 
-    private void explicitCallTransfer() {
+    @VisibleForTesting
+    void explicitCallTransfer() {
         logD("explicitCallTransfer");
 
         // can't transfer call if there is not enough call parties
@@ -827,12 +863,13 @@
         return (bitfield & mask) == mask;
     }
 
-    HeadsetClientStateMachine(HeadsetClientService context, Looper looper,
-                              NativeInterface nativeInterface) {
+    HeadsetClientStateMachine(HeadsetClientService context, HeadsetService headsetService,
+                              Looper looper, NativeInterface nativeInterface) {
         super(TAG, looper);
         mService = context;
         mNativeInterface = nativeInterface;
         mAudioManager = mService.getAudioManager();
+        mHeadsetService = headsetService;
 
         mVendorProcessor = new VendorCommandResponseProcessor(mService, mNativeInterface);
 
@@ -844,6 +881,8 @@
         mAudioRouteAllowed = context.getResources().getBoolean(
             R.bool.headset_client_initial_audio_route_allowed);
 
+        mHsClientAudioPolicy = new BluetoothSinkAudioPolicy.Builder().build();
+
         mIndicatorNetworkState = HeadsetClientHalConstants.NETWORK_STATE_NOT_AVAILABLE;
         mIndicatorNetworkType = HeadsetClientHalConstants.SERVICE_TYPE_HOME;
         mIndicatorNetworkSignal = 0;
@@ -874,11 +913,12 @@
         setInitialState(mDisconnected);
     }
 
-    static HeadsetClientStateMachine make(HeadsetClientService context, Looper looper,
-                                          NativeInterface nativeInterface) {
+    static HeadsetClientStateMachine make(HeadsetClientService context,
+                                          HeadsetService headsetService,
+                                          Looper looper, NativeInterface nativeInterface) {
         logD("make");
-        HeadsetClientStateMachine hfcsm = new HeadsetClientStateMachine(context, looper,
-                                                                        nativeInterface);
+        HeadsetClientStateMachine hfcsm = new HeadsetClientStateMachine(context, headsetService,
+                                                                        looper, nativeInterface);
         hfcsm.start();
         return hfcsm;
     }
@@ -984,8 +1024,11 @@
                 broadcastConnectionState(mCurrentDevice, BluetoothProfile.STATE_DISCONNECTED,
                         BluetoothProfile.STATE_CONNECTED);
             } else if (mPrevState != null) { // null is the default state before Disconnected
-                Log.e(TAG, "Connected: Illegal state transition from " + mPrevState.getName()
-                        + " to Connecting, mCurrentDevice=" + mCurrentDevice);
+                Log.e(TAG, "Disconnected: Illegal state transition from " + mPrevState.getName()
+                        + " to Disconnected, mCurrentDevice=" + mCurrentDevice);
+            }
+            if (mHeadsetService != null && mCurrentDevice != null) {
+                mHeadsetService.updateInbandRinging(mCurrentDevice, false);
             }
             mCurrentDevice = null;
         }
@@ -1086,7 +1129,7 @@
                         BluetoothProfile.STATE_DISCONNECTED);
             } else {
                 String prevStateName = mPrevState == null ? "null" : mPrevState.getName();
-                Log.e(TAG, "Connected: Illegal state transition from " + prevStateName
+                Log.e(TAG, "Connecting: Illegal state transition from " + prevStateName
                         + " to Connecting, mCurrentDevice=" + mCurrentDevice);
             }
         }
@@ -1126,6 +1169,40 @@
                             deferMessage(message);
                             break;
                         case StackEvent.EVENT_TYPE_CMD_RESULT:
+                            logD("Connecting: CMD_RESULT valueInt:" + event.valueInt
+                                    + " mQueuedActions.size=" + mQueuedActions.size());
+                            if (!mQueuedActions.isEmpty()) {
+                                logD("queuedAction:" + mQueuedActions.peek().first);
+                            }
+                            Pair<Integer, Object> queuedAction = mQueuedActions.poll();
+                            if (queuedAction == null || queuedAction.first == NO_ACTION) {
+                                break;
+                            }
+                            switch (queuedAction.first) {
+                                case SEND_ANDROID_AT_COMMAND:
+                                    if (event.valueInt == StackEvent.CMD_RESULT_TYPE_OK) {
+                                        Log.w(TAG, "Received OK instead of +ANDROID");
+                                    } else {
+                                        Log.w(TAG, "Received ERROR instead of +ANDROID");
+                                    }
+                                    setAudioPolicyRemoteSupported(false);
+                                    transitionTo(mConnected);
+                                    break;
+                                default:
+                                    Log.w(TAG, "Ignored CMD Result");
+                                    break;
+                            }
+                            break;
+
+                        case StackEvent.EVENT_TYPE_UNKNOWN_EVENT:
+                            if (mVendorProcessor.processEvent(event.valueString, event.device)) {
+                                mQueuedActions.poll();
+                                transitionTo(mConnected);
+                            } else {
+                                Log.e(TAG, "Unknown event :" + event.valueString
+                                        + " for device " + event.device);
+                            }
+                            break;
                         case StackEvent.EVENT_TYPE_SUBSCRIBER_INFO:
                         case StackEvent.EVENT_TYPE_CURRENT_CALLS:
                         case StackEvent.EVENT_TYPE_OPERATOR_NAME:
@@ -1189,7 +1266,11 @@
                             mAudioManager.isMicrophoneMute() ? 0 : 15, 0));
                     // query subscriber info
                     deferMessage(obtainMessage(HeadsetClientStateMachine.SUBSCRIBER_INFO));
-                    transitionTo(mConnected);
+
+                    if (!queryRemoteSupportedFeatures()) {
+                        Log.w(TAG, "Couldn't query Android AT remote supported!");
+                        transitionTo(mConnected);
+                    }
                     break;
 
                 case HeadsetClientHalConstants.CONNECTION_STATE_CONNECTED:
@@ -1236,12 +1317,15 @@
             if (mPrevState == mConnecting) {
                 broadcastConnectionState(mCurrentDevice, BluetoothProfile.STATE_CONNECTED,
                         BluetoothProfile.STATE_CONNECTING);
+                if (mHeadsetService != null) {
+                    mHeadsetService.updateInbandRinging(mCurrentDevice, true);
+                }
                 MetricsLogger.logProfileConnectionEvent(
                         BluetoothMetricsProto.ProfileId.HEADSET_CLIENT);
             } else if (mPrevState != mAudioOn) {
                 String prevStateName = mPrevState == null ? "null" : mPrevState.getName();
                 Log.e(TAG, "Connected: Illegal state transition from " + prevStateName
-                        + " to Connecting, mCurrentDevice=" + mCurrentDevice);
+                        + " to Connected, mCurrentDevice=" + mCurrentDevice);
             }
             mService.updateBatteryLevel();
         }
@@ -1530,8 +1614,11 @@
                             if (event.valueInt == HeadsetClientHalConstants.VOLUME_TYPE_SPK) {
                                 mCommandedSpeakerVolume = hfToAmVol(event.valueInt2);
                                 logD("AM volume set to " + mCommandedSpeakerVolume);
+                                boolean show_volume = SystemProperties
+                                        .getBoolean("bluetooth.hfp_volume_control.enabled", true);
                                 mAudioManager.setStreamVolume(AudioManager.STREAM_VOICE_CALL,
-                                        +mCommandedSpeakerVolume, AudioManager.FLAG_SHOW_UI);
+                                        +mCommandedSpeakerVolume,
+                                        show_volume ? AudioManager.FLAG_SHOW_UI : 0);
                             } else if (event.valueInt
                                     == HeadsetClientHalConstants.VOLUME_TYPE_MIC) {
                                 mAudioManager.setMicrophoneMute(event.valueInt2 == 0);
@@ -1571,6 +1658,8 @@
                                                 oldState, mVoiceRecognitionActive);
                                     }
                                     break;
+                                case SEND_ANDROID_AT_COMMAND:
+                                    logD("Connected: Received OK for AT+ANDROID");
                                 default:
                                     Log.w(TAG, "Unhandled AT OK " + event);
                                     break;
@@ -1666,8 +1755,10 @@
                         Log.d(TAG, "mAudioRouteAllowed=" + mAudioRouteAllowed);
                     }
                     if (!mAudioRouteAllowed) {
+                        Log.i(TAG, "Audio is not allowed! Disconnect SCO.");
                         sendMessage(HeadsetClientStateMachine.DISCONNECT_AUDIO);
-                        break;
+                        // Don't continue connecting!
+                        return;
                     }
 
                     // Audio state is split in two parts, the audio focus is maintained by the
@@ -1879,7 +1970,8 @@
         return BluetoothProfile.STATE_DISCONNECTED;
     }
 
-    private void broadcastAudioState(BluetoothDevice device, int newState, int prevState) {
+    @VisibleForTesting
+    void broadcastAudioState(BluetoothDevice device, int newState, int prevState) {
         BluetoothStatsLog.write(BluetoothStatsLog.BLUETOOTH_SCO_CONNECTION_STATE_CHANGED,
                 AdapterService.getAdapterService().obfuscateAddress(device),
                 getConnectionStateFromAudioState(newState), mAudioWbs
@@ -2028,7 +2120,8 @@
         return devices;
     }
 
-    private byte[] getByteAddress(BluetoothDevice device) {
+    @VisibleForTesting
+    byte[] getByteAddress(BluetoothDevice device) {
         return Utils.getBytesFromAddress(device.getAddress());
     }
 
@@ -2047,7 +2140,8 @@
         return b;
     }
 
-    private static int getConnectionStateFromAudioState(int audioState) {
+    @VisibleForTesting
+    static int getConnectionStateFromAudioState(int audioState) {
         switch (audioState) {
             case BluetoothHeadsetClient.STATE_AUDIO_CONNECTED:
                 return BluetoothAdapter.STATE_CONNECTED;
@@ -2067,9 +2161,81 @@
 
     public void setAudioRouteAllowed(boolean allowed) {
         mAudioRouteAllowed = allowed;
+
+        int establishPolicy = allowed
+                ? BluetoothSinkAudioPolicy.POLICY_ALLOWED :
+                BluetoothSinkAudioPolicy.POLICY_NOT_ALLOWED;
+
+        /*
+         * Backward compatibility for mAudioRouteAllowed
+         */
+        setAudioPolicy(new BluetoothSinkAudioPolicy.Builder(mHsClientAudioPolicy)
+                .setCallEstablishPolicy(establishPolicy).build());
     }
 
     public boolean getAudioRouteAllowed() {
         return mAudioRouteAllowed;
     }
+
+    private String createMaskString(BluetoothSinkAudioPolicy policies) {
+        StringBuilder mask = new StringBuilder();
+        mask.append(Integer.toString(CALL_AUDIO_POLICY_FEATURE_ID));
+        mask.append("," + policies.getCallEstablishPolicy());
+        mask.append("," + policies.getActiveDevicePolicyAfterConnection());
+        mask.append("," + policies.getInBandRingtonePolicy());
+        return mask.toString();
+    }
+
+    /**
+     * sets the {@link BluetoothSinkAudioPolicy} object device and send to the remote
+     * device using Android specific AT commands.
+     *
+     * @param policies to be set policies
+     */
+    public void setAudioPolicy(BluetoothSinkAudioPolicy policies) {
+        logD("setAudioPolicy: " + policies);
+        mHsClientAudioPolicy = policies;
+
+        if (mAudioPolicyRemoteSupported != BluetoothStatusCodes.FEATURE_SUPPORTED) {
+            Log.e(TAG, "Audio Policy feature not supported!");
+            return;
+        }
+
+        if (!mNativeInterface.sendAndroidAt(mCurrentDevice,
+                "+ANDROID=" + createMaskString(policies))) {
+            Log.e(TAG, "ERROR: Couldn't send call audio policies");
+        }
+    }
+
+    private boolean queryRemoteSupportedFeatures() {
+        Log.i(TAG, "queryRemoteSupportedFeatures");
+        if (!mNativeInterface.sendAndroidAt(mCurrentDevice, "+ANDROID=?")) {
+            Log.e(TAG, "ERROR: Couldn't send audio policy feature query");
+            return false;
+        }
+        addQueuedAction(SEND_ANDROID_AT_COMMAND);
+        return true;
+    }
+
+    /**
+     * sets the audio policy feature support status
+     *
+     * @param supported support status
+     */
+    public void setAudioPolicyRemoteSupported(boolean supported) {
+        if (supported) {
+            mAudioPolicyRemoteSupported = BluetoothStatusCodes.FEATURE_SUPPORTED;
+        } else {
+            mAudioPolicyRemoteSupported = BluetoothStatusCodes.FEATURE_NOT_SUPPORTED;
+        }
+    }
+
+    /**
+     * gets the audio policy feature support status
+     *
+     * @return int support status
+     */
+    public int getAudioPolicyRemoteSupported() {
+        return mAudioPolicyRemoteSupported;
+    }
 }
diff --git a/android/app/src/com/android/bluetooth/hfpclient/HeadsetClientStateMachineFactory.java b/android/app/src/com/android/bluetooth/hfpclient/HeadsetClientStateMachineFactory.java
index b0c7265..b21f537 100644
--- a/android/app/src/com/android/bluetooth/hfpclient/HeadsetClientStateMachineFactory.java
+++ b/android/app/src/com/android/bluetooth/hfpclient/HeadsetClientStateMachineFactory.java
@@ -18,6 +18,8 @@
 
 import android.os.HandlerThread;
 
+import com.android.bluetooth.hfp.HeadsetService;
+
 // Factory so that StateMachine objected can be mocked
 public class HeadsetClientStateMachineFactory {
     /**
@@ -26,6 +28,7 @@
      */
     public HeadsetClientStateMachine make(HeadsetClientService context, HandlerThread t,
             NativeInterface nativeInterface) {
-        return HeadsetClientStateMachine.make(context, t.getLooper(), nativeInterface);
+        return HeadsetClientStateMachine.make(context, HeadsetService.getHeadsetService(),
+                t.getLooper(), nativeInterface);
     }
 }
diff --git a/android/app/src/com/android/bluetooth/hfpclient/NativeInterface.java b/android/app/src/com/android/bluetooth/hfpclient/NativeInterface.java
index 67e4cb4..2615b73 100644
--- a/android/app/src/com/android/bluetooth/hfpclient/NativeInterface.java
+++ b/android/app/src/com/android/bluetooth/hfpclient/NativeInterface.java
@@ -266,6 +266,17 @@
         return sendATCmdNative(getByteAddress(device), atCmd, val1, val2, arg);
     }
 
+    /**
+     * Set call audio policy to the specified paired device
+     *
+     * @param cmd Android specific command string
+     * @return True on success, False on failure
+     */
+    @VisibleForTesting
+    public boolean sendAndroidAt(BluetoothDevice device, String cmd) {
+        return sendAndroidAtNative(getByteAddress(device), cmd);
+    }
+
     // Native methods that call into the JNI interface
     private static native void classInitNative();
 
@@ -306,6 +317,8 @@
     private static native boolean sendATCmdNative(byte[] address, int atCmd, int val1, int val2,
             String arg);
 
+    private static native boolean sendAndroidAtNative(byte[] address, String cmd);
+
     private BluetoothDevice getDevice(byte[] address) {
         return mAdapterService.getDeviceFromByte(address);
     }
@@ -316,7 +329,8 @@
 
     // Callbacks from the native back into the java framework. All callbacks are routed via the
     // Service which will disambiguate which state machine the message should be routed through.
-    private void onConnectionStateChanged(int state, int peerFeat, int chldFeat, byte[] address) {
+    @VisibleForTesting
+    void onConnectionStateChanged(int state, int peerFeat, int chldFeat, byte[] address) {
         StackEvent event = new StackEvent(StackEvent.EVENT_TYPE_CONNECTION_STATE_CHANGED);
         event.valueInt = state;
         event.valueInt2 = peerFeat;
@@ -335,12 +349,13 @@
         }
     }
 
-    private void onAudioStateChanged(int state, byte[] address) {
+    @VisibleForTesting
+    void onAudioStateChanged(int state, byte[] address) {
         StackEvent event = new StackEvent(StackEvent.EVENT_TYPE_AUDIO_STATE_CHANGED);
         event.valueInt = state;
         event.device = getDevice(address);
         if (DBG) {
-            Log.d(TAG, "onAudioStateChanged: address " + address + " event " + event);
+            Log.d(TAG, "onAudioStateChanged: event " + event);
         }
         HeadsetClientService service = HeadsetClientService.getHeadsetClientService();
         if (service != null) {
@@ -351,12 +366,13 @@
         }
     }
 
-    private void onVrStateChanged(int state, byte[] address) {
+    @VisibleForTesting
+    void onVrStateChanged(int state, byte[] address) {
         StackEvent event = new StackEvent(StackEvent.EVENT_TYPE_VR_STATE_CHANGED);
         event.valueInt = state;
         event.device = getDevice(address);
         if (DBG) {
-            Log.d(TAG, "onVrStateChanged: address " + address + " event " + event);
+            Log.d(TAG, "onVrStateChanged: event " + event);
         }
 
         HeadsetClientService service = HeadsetClientService.getHeadsetClientService();
@@ -368,12 +384,13 @@
         }
     }
 
-    private void onNetworkState(int state, byte[] address) {
+    @VisibleForTesting
+    void onNetworkState(int state, byte[] address) {
         StackEvent event = new StackEvent(StackEvent.EVENT_TYPE_NETWORK_STATE);
         event.valueInt = state;
         event.device = getDevice(address);
         if (DBG) {
-            Log.d(TAG, "onNetworkStateChanged: address " + address + " event " + event);
+            Log.d(TAG, "onNetworkStateChanged: event " + event);
         }
 
         HeadsetClientService service = HeadsetClientService.getHeadsetClientService();
@@ -386,7 +403,8 @@
         }
     }
 
-    private void onNetworkRoaming(int state, byte[] address) {
+    @VisibleForTesting
+    void onNetworkRoaming(int state, byte[] address) {
         StackEvent event = new StackEvent(StackEvent.EVENT_TYPE_ROAMING_STATE);
         event.valueInt = state;
         event.device = getDevice(address);
@@ -402,12 +420,13 @@
         }
     }
 
-    private void onNetworkSignal(int signal, byte[] address) {
+    @VisibleForTesting
+    void onNetworkSignal(int signal, byte[] address) {
         StackEvent event = new StackEvent(StackEvent.EVENT_TYPE_NETWORK_SIGNAL);
         event.valueInt = signal;
         event.device = getDevice(address);
         if (DBG) {
-            Log.d(TAG, "onNetworkSignal: address " + address + " event " + event);
+            Log.d(TAG, "onNetworkSignal: event " + event);
         }
         HeadsetClientService service = HeadsetClientService.getHeadsetClientService();
         if (service != null) {
@@ -417,12 +436,13 @@
         }
     }
 
-    private void onBatteryLevel(int level, byte[] address) {
+    @VisibleForTesting
+    void onBatteryLevel(int level, byte[] address) {
         StackEvent event = new StackEvent(StackEvent.EVENT_TYPE_BATTERY_LEVEL);
         event.valueInt = level;
         event.device = getDevice(address);
         if (DBG) {
-            Log.d(TAG, "onBatteryLevel: address " + address + " event " + event);
+            Log.d(TAG, "onBatteryLevel: event " + event);
         }
         HeadsetClientService service = HeadsetClientService.getHeadsetClientService();
         if (service != null) {
@@ -432,12 +452,13 @@
         }
     }
 
-    private void onCurrentOperator(String name, byte[] address) {
+    @VisibleForTesting
+    void onCurrentOperator(String name, byte[] address) {
         StackEvent event = new StackEvent(StackEvent.EVENT_TYPE_OPERATOR_NAME);
         event.valueString = name;
         event.device = getDevice(address);
         if (DBG) {
-            Log.d(TAG, "onCurrentOperator: address " + address + " event " + event);
+            Log.d(TAG, "onCurrentOperator: event " + event);
         }
         HeadsetClientService service = HeadsetClientService.getHeadsetClientService();
         if (service != null) {
@@ -448,12 +469,13 @@
         }
     }
 
-    private void onCall(int call, byte[] address) {
+    @VisibleForTesting
+    void onCall(int call, byte[] address) {
         StackEvent event = new StackEvent(StackEvent.EVENT_TYPE_CALL);
         event.valueInt = call;
         event.device = getDevice(address);
         if (DBG) {
-            Log.d(TAG, "onCall: address " + address + " event " + event);
+            Log.d(TAG, "onCall: event " + event);
         }
         HeadsetClientService service = HeadsetClientService.getHeadsetClientService();
         if (service != null) {
@@ -472,13 +494,14 @@
      * 2 - Outgoing call process ongoing
      * 3 - Remote party being alerted for outgoing call
      */
-    private void onCallSetup(int callsetup, byte[] address) {
+    @VisibleForTesting
+    void onCallSetup(int callsetup, byte[] address) {
         StackEvent event = new StackEvent(StackEvent.EVENT_TYPE_CALLSETUP);
         event.valueInt = callsetup;
         event.device = getDevice(address);
         if (DBG) {
-            Log.d(TAG, "onCallSetup: addr " + address + " device" + event.device);
-            Log.d(TAG, "onCallSetup: address " + address + " event " + event);
+            Log.d(TAG, "onCallSetup: device" + event.device);
+            Log.d(TAG, "onCallSetup: event " + event);
         }
         HeadsetClientService service = HeadsetClientService.getHeadsetClientService();
         if (service != null) {
@@ -497,12 +520,13 @@
      * call)
      * 2 - Call on hold, no active call
      */
-    private void onCallHeld(int callheld, byte[] address) {
+    @VisibleForTesting
+    void onCallHeld(int callheld, byte[] address) {
         StackEvent event = new StackEvent(StackEvent.EVENT_TYPE_CALLHELD);
         event.valueInt = callheld;
         event.device = getDevice(address);
         if (DBG) {
-            Log.d(TAG, "onCallHeld: address " + address + " event " + event);
+            Log.d(TAG, "onCallHeld: event " + event);
         }
         HeadsetClientService service = HeadsetClientService.getHeadsetClientService();
         if (service != null) {
@@ -512,12 +536,13 @@
         }
     }
 
-    private void onRespAndHold(int respAndHold, byte[] address) {
+    @VisibleForTesting
+    void onRespAndHold(int respAndHold, byte[] address) {
         StackEvent event = new StackEvent(StackEvent.EVENT_TYPE_RESP_AND_HOLD);
         event.valueInt = respAndHold;
         event.device = getDevice(address);
         if (DBG) {
-            Log.d(TAG, "onRespAndHold: address " + address + " event " + event);
+            Log.d(TAG, "onRespAndHold: event " + event);
         }
         HeadsetClientService service = HeadsetClientService.getHeadsetClientService();
         if (service != null) {
@@ -527,12 +552,13 @@
         }
     }
 
-    private void onClip(String number, byte[] address) {
+    @VisibleForTesting
+    void onClip(String number, byte[] address) {
         StackEvent event = new StackEvent(StackEvent.EVENT_TYPE_CLIP);
         event.valueString = number;
         event.device = getDevice(address);
         if (DBG) {
-            Log.d(TAG, "onClip: address " + address + " event " + event);
+            Log.d(TAG, "onClip: event " + event);
         }
         HeadsetClientService service = HeadsetClientService.getHeadsetClientService();
         if (service != null) {
@@ -542,12 +568,13 @@
         }
     }
 
-    private void onCallWaiting(String number, byte[] address) {
+    @VisibleForTesting
+    void onCallWaiting(String number, byte[] address) {
         StackEvent event = new StackEvent(StackEvent.EVENT_TYPE_CALL_WAITING);
         event.valueString = number;
         event.device = getDevice(address);
         if (DBG) {
-            Log.d(TAG, "onCallWaiting: address " + address + " event " + event);
+            Log.d(TAG, "onCallWaiting: event " + event);
         }
         HeadsetClientService service = HeadsetClientService.getHeadsetClientService();
         if (service != null) {
@@ -557,7 +584,8 @@
         }
     }
 
-    private void onCurrentCalls(int index, int dir, int state, int mparty, String number,
+    @VisibleForTesting
+    void onCurrentCalls(int index, int dir, int state, int mparty, String number,
             byte[] address) {
         StackEvent event = new StackEvent(StackEvent.EVENT_TYPE_CURRENT_CALLS);
         event.valueInt = index;
@@ -567,7 +595,7 @@
         event.valueString = number;
         event.device = getDevice(address);
         if (DBG) {
-            Log.d(TAG, "onCurrentCalls: address " + address + " event " + event);
+            Log.d(TAG, "onCurrentCalls: event " + event);
         }
         HeadsetClientService service = HeadsetClientService.getHeadsetClientService();
         if (service != null) {
@@ -577,13 +605,14 @@
         }
     }
 
-    private void onVolumeChange(int type, int volume, byte[] address) {
+    @VisibleForTesting
+    void onVolumeChange(int type, int volume, byte[] address) {
         StackEvent event = new StackEvent(StackEvent.EVENT_TYPE_VOLUME_CHANGED);
         event.valueInt = type;
         event.valueInt2 = volume;
         event.device = getDevice(address);
         if (DBG) {
-            Log.d(TAG, "onVolumeChange: address " + address + " event " + event);
+            Log.d(TAG, "onVolumeChange: event " + event);
         }
         HeadsetClientService service = HeadsetClientService.getHeadsetClientService();
         if (service != null) {
@@ -593,13 +622,14 @@
         }
     }
 
-    private void onCmdResult(int type, int cme, byte[] address) {
+    @VisibleForTesting
+    void onCmdResult(int type, int cme, byte[] address) {
         StackEvent event = new StackEvent(StackEvent.EVENT_TYPE_CMD_RESULT);
         event.valueInt = type;
         event.valueInt2 = cme;
         event.device = getDevice(address);
         if (DBG) {
-            Log.d(TAG, "onCmdResult: address " + address + " event " + event);
+            Log.d(TAG, "onCmdResult: event " + event);
         }
         HeadsetClientService service = HeadsetClientService.getHeadsetClientService();
         if (service != null) {
@@ -609,13 +639,14 @@
         }
     }
 
-    private void onSubscriberInfo(String number, int type, byte[] address) {
+    @VisibleForTesting
+    void onSubscriberInfo(String number, int type, byte[] address) {
         StackEvent event = new StackEvent(StackEvent.EVENT_TYPE_SUBSCRIBER_INFO);
         event.valueInt = type;
         event.valueString = number;
         event.device = getDevice(address);
         if (DBG) {
-            Log.d(TAG, "onSubscriberInfo: address " + address + " event " + event);
+            Log.d(TAG, "onSubscriberInfo: event " + event);
         }
         HeadsetClientService service = HeadsetClientService.getHeadsetClientService();
         if (service != null) {
@@ -626,12 +657,13 @@
         }
     }
 
-    private void onInBandRing(int inBand, byte[] address) {
+    @VisibleForTesting
+    void onInBandRing(int inBand, byte[] address) {
         StackEvent event = new StackEvent(StackEvent.EVENT_TYPE_IN_BAND_RINGTONE);
         event.valueInt = inBand;
         event.device = getDevice(address);
         if (DBG) {
-            Log.d(TAG, "onInBandRing: address " + address + " event " + event);
+            Log.d(TAG, "onInBandRing: event " + event);
         }
         HeadsetClientService service = HeadsetClientService.getHeadsetClientService();
         if (service != null) {
@@ -642,15 +674,17 @@
         }
     }
 
-    private void onLastVoiceTagNumber(String number, byte[] address) {
+    @VisibleForTesting
+    void onLastVoiceTagNumber(String number, byte[] address) {
         Log.w(TAG, "onLastVoiceTagNumber not supported");
     }
 
-    private void onRingIndication(byte[] address) {
+    @VisibleForTesting
+    void onRingIndication(byte[] address) {
         StackEvent event = new StackEvent(StackEvent.EVENT_TYPE_RING_INDICATION);
         event.device = getDevice(address);
         if (DBG) {
-            Log.d(TAG, "onRingIndication: address " + address + " event " + event);
+            Log.d(TAG, "onRingIndication: event " + event);
         }
         HeadsetClientService service = HeadsetClientService.getHeadsetClientService();
         if (service != null) {
@@ -661,12 +695,13 @@
         }
     }
 
-    private void onUnknownEvent(String eventString, byte[] address) {
+    @VisibleForTesting
+    void onUnknownEvent(String eventString, byte[] address) {
         StackEvent event = new StackEvent(StackEvent.EVENT_TYPE_UNKNOWN_EVENT);
         event.device = getDevice(address);
         event.valueString = eventString;
         if (DBG) {
-            Log.d(TAG, "onUnknownEvent: address " + address + " event " + event);
+            Log.d(TAG, "onUnknownEvent: event " + event);
         }
         HeadsetClientService service = HeadsetClientService.getHeadsetClientService();
         if (service != null) {
diff --git a/android/app/src/com/android/bluetooth/hfpclient/StackEvent.java b/android/app/src/com/android/bluetooth/hfpclient/StackEvent.java
index e9f7cba..4c08946 100644
--- a/android/app/src/com/android/bluetooth/hfpclient/StackEvent.java
+++ b/android/app/src/com/android/bluetooth/hfpclient/StackEvent.java
@@ -21,6 +21,8 @@
 
 import android.bluetooth.BluetoothDevice;
 
+import com.android.internal.annotations.VisibleForTesting;
+
 public class StackEvent {
     // Type of event that signifies a native event and consumed by state machine
     public static final int STACK_EVENT = 100;
@@ -49,6 +51,9 @@
     public static final int EVENT_TYPE_RING_INDICATION = 21;
     public static final int EVENT_TYPE_UNKNOWN_EVENT = 22;
 
+    public static final int CMD_RESULT_TYPE_OK = 0;
+    public static final int CMD_RESULT_TYPE_CME_ERROR = 7;
+
     public int type = EVENT_TYPE_NONE;
     public int valueInt = 0;
     public int valueInt2 = 0;
@@ -76,7 +81,8 @@
     }
 
     // for debugging only
-    private static String eventTypeToString(int type) {
+    @VisibleForTesting
+    static String eventTypeToString(int type) {
         switch (type) {
             case EVENT_TYPE_NONE:
                 return "EVENT_TYPE_NONE";
diff --git a/android/app/src/com/android/bluetooth/hfpclient/VendorCommandResponseProcessor.java b/android/app/src/com/android/bluetooth/hfpclient/VendorCommandResponseProcessor.java
index 205ba40..cd2ec0d 100644
--- a/android/app/src/com/android/bluetooth/hfpclient/VendorCommandResponseProcessor.java
+++ b/android/app/src/com/android/bluetooth/hfpclient/VendorCommandResponseProcessor.java
@@ -69,6 +69,9 @@
         SUPPORTED_VENDOR_EVENTS.put(
                 "+XAPL=",
                 BluetoothAssignedNumbers.APPLE);
+        SUPPORTED_VENDOR_EVENTS.put(
+                "+ANDROID:",
+                BluetoothAssignedNumbers.GOOGLE);
     }
 
     VendorCommandResponseProcessor(HeadsetClientService context, NativeInterface nativeInterface) {
@@ -148,10 +151,14 @@
         if (vendorId == null) {
             Log.e(TAG, "Invalid response: " + atString + ". " + eventCode);
             return false;
+        } else if (vendorId == BluetoothAssignedNumbers.GOOGLE) {
+            Log.i(TAG, "received +ANDROID event. Setting Audio policy to true");
+            mService.setAudioPolicyRemoteSupported(device, true);
+        } else {
+            broadcastVendorSpecificEventIntent(vendorId, eventCode, atString, device);
+            logD("process vendor event " + vendorId + ", " + eventCode + ", "
+                    + atString + " for device" + device);
         }
-        broadcastVendorSpecificEventIntent(vendorId, eventCode, atString, device);
-        logD("process vendor event " + vendorId + ", " + eventCode + ", "
-                + atString + " for device" + device);
         return true;
     }
 
diff --git a/android/app/src/com/android/bluetooth/hid/HidDeviceNativeInterface.java b/android/app/src/com/android/bluetooth/hid/HidDeviceNativeInterface.java
index c41f168..8d938f4 100644
--- a/android/app/src/com/android/bluetooth/hid/HidDeviceNativeInterface.java
+++ b/android/app/src/com/android/bluetooth/hid/HidDeviceNativeInterface.java
@@ -29,6 +29,7 @@
 import com.android.bluetooth.btservice.AdapterService;
 import com.android.internal.annotations.GuardedBy;
 import com.android.internal.annotations.VisibleForTesting;
+
 import java.util.Objects;
 
 /**
@@ -179,7 +180,8 @@
         return reportErrorNative(error);
     }
 
-    private synchronized void onApplicationStateChanged(byte[] address, boolean registered) {
+    @VisibleForTesting
+    synchronized void onApplicationStateChanged(byte[] address, boolean registered) {
         HidDeviceService service = HidDeviceService.getHidDeviceService();
         if (service != null) {
             service.onApplicationStateChangedFromNative(getDevice(address), registered);
@@ -189,7 +191,8 @@
         }
     }
 
-    private synchronized void onConnectStateChanged(byte[] address, int state) {
+    @VisibleForTesting
+    synchronized void onConnectStateChanged(byte[] address, int state) {
         HidDeviceService service = HidDeviceService.getHidDeviceService();
         if (service != null) {
             service.onConnectStateChangedFromNative(getDevice(address), state);
@@ -199,7 +202,8 @@
         }
     }
 
-    private synchronized void onGetReport(byte type, byte id, short bufferSize) {
+    @VisibleForTesting
+    synchronized void onGetReport(byte type, byte id, short bufferSize) {
         HidDeviceService service = HidDeviceService.getHidDeviceService();
         if (service != null) {
             service.onGetReportFromNative(type, id, bufferSize);
@@ -209,7 +213,8 @@
         }
     }
 
-    private synchronized void onSetReport(byte reportType, byte reportId, byte[] data) {
+    @VisibleForTesting
+    synchronized void onSetReport(byte reportType, byte reportId, byte[] data) {
         HidDeviceService service = HidDeviceService.getHidDeviceService();
         if (service != null) {
             service.onSetReportFromNative(reportType, reportId, data);
@@ -219,7 +224,8 @@
         }
     }
 
-    private synchronized void onSetProtocol(byte protocol) {
+    @VisibleForTesting
+    synchronized void onSetProtocol(byte protocol) {
         HidDeviceService service = HidDeviceService.getHidDeviceService();
         if (service != null) {
             service.onSetProtocolFromNative(protocol);
@@ -229,7 +235,8 @@
         }
     }
 
-    private synchronized void onInterruptData(byte reportId, byte[] data) {
+    @VisibleForTesting
+    synchronized void onInterruptData(byte reportId, byte[] data) {
         HidDeviceService service = HidDeviceService.getHidDeviceService();
         if (service != null) {
             service.onInterruptDataFromNative(reportId, data);
@@ -239,7 +246,8 @@
         }
     }
 
-    private synchronized void onVirtualCableUnplug() {
+    @VisibleForTesting
+    synchronized void onVirtualCableUnplug() {
         HidDeviceService service = HidDeviceService.getHidDeviceService();
         if (service != null) {
             service.onVirtualCableUnplugFromNative();
diff --git a/android/app/src/com/android/bluetooth/hid/HidDeviceService.java b/android/app/src/com/android/bluetooth/hid/HidDeviceService.java
index c95856a..33da519 100644
--- a/android/app/src/com/android/bluetooth/hid/HidDeviceService.java
+++ b/android/app/src/com/android/bluetooth/hid/HidDeviceService.java
@@ -306,8 +306,11 @@
 
         @RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)
         private HidDeviceService getService(AttributionSource source) {
-            if (!Utils.checkCallerIsSystemOrActiveUser(TAG)
-                    || !Utils.checkServiceAvailable(mService, TAG)
+            if (Utils.isInstrumentationTestMode()) {
+                return mService;
+            }
+            if (!Utils.checkServiceAvailable(mService, TAG)
+                    || !Utils.checkCallerIsSystemOrActiveOrManagedUser(mService, TAG)
                     || !Utils.checkConnectPermissionForDataDelivery(mService, source, TAG)) {
                 return null;
             }
@@ -827,7 +830,8 @@
         return sHidDeviceService;
     }
 
-    private static synchronized void setHidDeviceService(HidDeviceService instance) {
+    @VisibleForTesting
+    static synchronized void setHidDeviceService(HidDeviceService instance) {
         if (DBG) {
             Log.d(TAG, "setHidDeviceService(): set to: " + instance);
         }
diff --git a/android/app/src/com/android/bluetooth/hid/HidHostService.java b/android/app/src/com/android/bluetooth/hid/HidHostService.java
index 0c2c127..7352d58 100644
--- a/android/app/src/com/android/bluetooth/hid/HidHostService.java
+++ b/android/app/src/com/android/bluetooth/hid/HidHostService.java
@@ -325,7 +325,8 @@
     /**
      * Handlers for incoming service calls
      */
-    private static class BluetoothHidHostBinder extends IBluetoothHidHost.Stub
+    @VisibleForTesting
+    static class BluetoothHidHostBinder extends IBluetoothHidHost.Stub
             implements IProfileServiceBinder {
         private HidHostService mService;
 
@@ -340,8 +341,11 @@
 
         @RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)
         private HidHostService getService(AttributionSource source) {
-            if (!Utils.checkCallerIsSystemOrActiveUser(TAG)
-                    || !Utils.checkServiceAvailable(mService, TAG)
+            if (Utils.isInstrumentationTestMode()) {
+                return mService;
+            }
+            if (!Utils.checkServiceAvailable(mService, TAG)
+                    || !Utils.checkCallerIsSystemOrActiveOrManagedUser(mService, TAG)
                     || !Utils.checkConnectPermissionForDataDelivery(mService, source, TAG)) {
                 return null;
             }
diff --git a/android/app/src/com/android/bluetooth/le_audio/LeAudioNativeInterface.java b/android/app/src/com/android/bluetooth/le_audio/LeAudioNativeInterface.java
index d696dc8..267588a 100644
--- a/android/app/src/com/android/bluetooth/le_audio/LeAudioNativeInterface.java
+++ b/android/app/src/com/android/bluetooth/le_audio/LeAudioNativeInterface.java
@@ -29,6 +29,7 @@
 
 import com.android.bluetooth.Utils;
 import com.android.internal.annotations.GuardedBy;
+import com.android.internal.annotations.VisibleForTesting;
 
 import java.util.Arrays;
 
@@ -67,6 +68,16 @@
         }
     }
 
+    /**
+     * Set singleton instance.
+     */
+    @VisibleForTesting
+    static void setInstance(LeAudioNativeInterface instance) {
+        synchronized (INSTANCE_LOCK) {
+            sInstance = instance;
+        }
+    }
+
     private byte[] getByteAddress(BluetoothDevice device) {
         if (device == null) {
             return Utils.getBytesFromAddress("00:00:00:00:00:00");
@@ -100,7 +111,8 @@
         sendMessageToService(event);
     }
 
-    private void onConnectionStateChanged(int state, byte[] address) {
+    @VisibleForTesting
+    void onConnectionStateChanged(int state, byte[] address) {
         LeAudioStackEvent event =
                 new LeAudioStackEvent(LeAudioStackEvent.EVENT_TYPE_CONNECTION_STATE_CHANGED);
         event.device = getDevice(address);
@@ -112,7 +124,8 @@
         sendMessageToService(event);
     }
 
-    private void onGroupStatus(int groupId, int groupStatus) {
+    @VisibleForTesting
+    void onGroupStatus(int groupId, int groupStatus) {
         LeAudioStackEvent event =
                 new LeAudioStackEvent(LeAudioStackEvent.EVENT_TYPE_GROUP_STATUS_CHANGED);
         event.valueInt1 = groupId;
@@ -124,7 +137,8 @@
         sendMessageToService(event);
     }
 
-    private void onGroupNodeStatus(byte[] address, int groupId, int nodeStatus) {
+    @VisibleForTesting
+    void onGroupNodeStatus(byte[] address, int groupId, int nodeStatus) {
         LeAudioStackEvent event =
                 new LeAudioStackEvent(LeAudioStackEvent.EVENT_TYPE_GROUP_NODE_STATUS_CHANGED);
         event.valueInt1 = groupId;
@@ -137,7 +151,8 @@
         sendMessageToService(event);
     }
 
-    private void onAudioConf(int direction, int groupId, int sinkAudioLocation,
+    @VisibleForTesting
+    void onAudioConf(int direction, int groupId, int sinkAudioLocation,
                              int sourceAudioLocation, int availableContexts) {
         LeAudioStackEvent event =
                 new LeAudioStackEvent(LeAudioStackEvent.EVENT_TYPE_AUDIO_CONF_CHANGED);
@@ -153,7 +168,8 @@
         sendMessageToService(event);
     }
 
-    private void onSinkAudioLocationAvailable(byte[] address, int sinkAudioLocation) {
+    @VisibleForTesting
+    void onSinkAudioLocationAvailable(byte[] address, int sinkAudioLocation) {
         LeAudioStackEvent event =
                 new LeAudioStackEvent(LeAudioStackEvent.EVENT_TYPE_SINK_AUDIO_LOCATION_AVAILABLE);
         event.device = getDevice(address);
@@ -165,7 +181,8 @@
         sendMessageToService(event);
     }
 
-    private void onAudioLocalCodecCapabilities(
+    @VisibleForTesting
+    void onAudioLocalCodecCapabilities(
                             BluetoothLeAudioCodecConfig[] localInputCodecCapabilities,
                             BluetoothLeAudioCodecConfig[] localOutputCodecCapabilities) {
         LeAudioStackEvent event =
@@ -181,7 +198,8 @@
         sendMessageToService(event);
     }
 
-    private void onAudioGroupCodecConf(int groupId, BluetoothLeAudioCodecConfig inputCodecConfig,
+    @VisibleForTesting
+    void onAudioGroupCodecConf(int groupId, BluetoothLeAudioCodecConfig inputCodecConfig,
                             BluetoothLeAudioCodecConfig outputCodecConfig,
                             BluetoothLeAudioCodecConfig [] inputSelectableCodecConfig,
                             BluetoothLeAudioCodecConfig [] outputSelectableCodecConfig) {
@@ -287,6 +305,17 @@
         setCcidInformationNative(ccid, contextType);
     }
 
+    /**
+     * Set in call call flag.
+     * @param inCall true when device in call (any state), false otherwise
+     */
+    public void setInCall(boolean inCall) {
+        if (DBG) {
+            Log.d(TAG, "setInCall inCall: " + inCall);
+        }
+        setInCallNative(inCall);
+    }
+
     // Native methods that call into the JNI interface
     private static native void classInitNative();
     private native void initNative(BluetoothLeAudioCodecConfig[] codecConfigOffloading);
@@ -300,4 +329,5 @@
             BluetoothLeAudioCodecConfig inputCodecConfig,
             BluetoothLeAudioCodecConfig outputCodecConfig);
     private native void setCcidInformationNative(int ccid, int contextType);
+    private native void setInCallNative(boolean inCall);
 }
diff --git a/android/app/src/com/android/bluetooth/le_audio/LeAudioService.java b/android/app/src/com/android/bluetooth/le_audio/LeAudioService.java
index ffcf22e..9921c33 100644
--- a/android/app/src/com/android/bluetooth/le_audio/LeAudioService.java
+++ b/android/app/src/com/android/bluetooth/le_audio/LeAudioService.java
@@ -36,11 +36,14 @@
 import android.bluetooth.IBluetoothLeAudio;
 import android.bluetooth.IBluetoothLeAudioCallback;
 import android.bluetooth.IBluetoothLeBroadcastCallback;
+import android.bluetooth.IBluetoothVolumeControl;
 import android.content.AttributionSource;
 import android.content.BroadcastReceiver;
 import android.content.Context;
 import android.content.Intent;
 import android.content.IntentFilter;
+import android.media.AudioDeviceCallback;
+import android.media.AudioDeviceInfo;
 import android.media.AudioManager;
 import android.media.BluetoothProfileConnectionInfo;
 import android.os.Handler;
@@ -59,6 +62,7 @@
 import com.android.bluetooth.btservice.ProfileService;
 import com.android.bluetooth.btservice.ServiceFactory;
 import com.android.bluetooth.btservice.storage.DatabaseManager;
+import com.android.bluetooth.hfp.HeadsetService;
 import com.android.bluetooth.mcp.McpService;
 import com.android.bluetooth.tbs.TbsGatt;
 import com.android.bluetooth.vc.VolumeControlService;
@@ -73,7 +77,6 @@
 import java.util.List;
 import java.util.Map;
 import java.util.Objects;
-import java.util.concurrent.ConcurrentHashMap;
 
 /**
  * Provides Bluetooth LeAudio profile, as a service in the Bluetooth application.
@@ -87,23 +90,23 @@
     private static final int SM_THREAD_JOIN_TIMEOUT_MS = 1000;
 
     // Upper limit of all LeAudio devices: Bonded or Connected
-    private static final int MAX_LE_AUDIO_STATE_MACHINES = 10;
+    private static final int MAX_LE_AUDIO_DEVICES = 10;
     private static LeAudioService sLeAudioService;
 
     /**
-     * Indicates group audio support for input direction
+     * Indicates group audio support for none direction
      */
-    private static final int AUDIO_DIRECTION_INPUT_BIT = 0x01;
+    private static final int AUDIO_DIRECTION_NONE = 0x00;
 
     /**
      * Indicates group audio support for output direction
      */
-    private static final int AUDIO_DIRECTION_OUTPUT_BIT = 0x02;
+    private static final int AUDIO_DIRECTION_OUTPUT_BIT = 0x01;
 
-    /*
-     * Indicates no active contexts
+    /**
+     * Indicates group audio support for input direction
      */
-    private static final int ACTIVE_CONTEXTS_NONE = 0;
+    private static final int AUDIO_DIRECTION_INPUT_BIT = 0x02;
 
     private AdapterService mAdapterService;
     private DatabaseManager mDatabaseManager;
@@ -111,17 +114,22 @@
     private volatile BluetoothDevice mActiveAudioOutDevice;
     private volatile BluetoothDevice mActiveAudioInDevice;
     private LeAudioCodecConfig mLeAudioCodecConfig;
-    private Object mGroupLock = new Object();
+    private final Object mGroupLock = new Object();
     ServiceFactory mServiceFactory = new ServiceFactory();
 
     LeAudioNativeInterface mLeAudioNativeInterface;
     boolean mLeAudioNativeIsInitialized = false;
+    boolean mBluetoothEnabled = false;
+    BluetoothDevice mHfpHandoverDevice = null;
     LeAudioBroadcasterNativeInterface mLeAudioBroadcasterNativeInterface = null;
     @VisibleForTesting
     AudioManager mAudioManager;
     LeAudioTmapGattServer mTmapGattServer;
 
     @VisibleForTesting
+    McpService mMcpService;
+
+    @VisibleForTesting
     VolumeControlService mVolumeControlService;
 
     @VisibleForTesting
@@ -134,51 +142,50 @@
         LeAudioGroupDescriptor() {
             mIsConnected = false;
             mIsActive = false;
-            mActiveContexts = ACTIVE_CONTEXTS_NONE;
+            mDirection = AUDIO_DIRECTION_NONE;
             mCodecStatus = null;
             mLostLeadDeviceWhileStreaming = null;
         }
 
         public Boolean mIsConnected;
         public Boolean mIsActive;
-        public Integer mActiveContexts;
+        public Integer mDirection;
         public BluetoothLeAudioCodecStatus mCodecStatus;
         /* This can be non empty only for the streaming time */
         BluetoothDevice mLostLeadDeviceWhileStreaming;
     }
 
+    private static class LeAudioDeviceDescriptor {
+        LeAudioDeviceDescriptor() {
+            mStateMachine = null;
+            mGroupId = LE_AUDIO_GROUP_ID_INVALID;
+            mSinkAudioLocation = BluetoothLeAudio.AUDIO_LOCATION_INVALID;
+            mDirection = AUDIO_DIRECTION_NONE;
+        }
+
+        public LeAudioStateMachine mStateMachine;
+        public Integer mGroupId;
+        public Integer mSinkAudioLocation;
+        public Integer mDirection;
+    }
+
     List<BluetoothLeAudioCodecConfig> mInputLocalCodecCapabilities = new ArrayList<>();
     List<BluetoothLeAudioCodecConfig> mOutputLocalCodecCapabilities = new ArrayList<>();
 
     @GuardedBy("mGroupLock")
     private final Map<Integer, LeAudioGroupDescriptor> mGroupDescriptors = new LinkedHashMap<>();
-    private final Map<BluetoothDevice, LeAudioStateMachine> mStateMachines = new LinkedHashMap<>();
-
-    @GuardedBy("mGroupLock")
-    private final Map<BluetoothDevice, Integer> mDeviceGroupIdMap = new ConcurrentHashMap<>();
-    private final Map<BluetoothDevice, Integer> mDeviceAudioLocationMap = new ConcurrentHashMap<>();
-
-    private final int mContextSupportingInputAudio =
-            BluetoothLeAudio.CONTEXT_TYPE_COMMUNICATION |
-            BluetoothLeAudio.CONTEXT_TYPE_MAN_MACHINE;
-
-    private final int mContextSupportingOutputAudio = BluetoothLeAudio.CONTEXT_TYPE_COMMUNICATION |
-            BluetoothLeAudio.CONTEXT_TYPE_MEDIA |
-            BluetoothLeAudio.CONTEXT_TYPE_INSTRUCTIONAL |
-            BluetoothLeAudio.CONTEXT_TYPE_ATTENTION_SEEKING |
-            BluetoothLeAudio.CONTEXT_TYPE_IMMEDIATE_ALERT |
-            BluetoothLeAudio.CONTEXT_TYPE_MAN_MACHINE |
-            BluetoothLeAudio.CONTEXT_TYPE_EMERGENCY_ALERT |
-            BluetoothLeAudio.CONTEXT_TYPE_RINGTONE |
-            BluetoothLeAudio.CONTEXT_TYPE_TV |
-            BluetoothLeAudio.CONTEXT_TYPE_LIVE |
-            BluetoothLeAudio.CONTEXT_TYPE_GAME;
+    private final Map<BluetoothDevice, LeAudioDeviceDescriptor> mDeviceDescriptors =
+            new LinkedHashMap<>();
 
     private BroadcastReceiver mBondStateChangedReceiver;
     private BroadcastReceiver mConnectionStateChangedReceiver;
     private BroadcastReceiver mMuteStateChangedReceiver;
     private int mStoredRingerMode = -1;
     private Handler mHandler = new Handler(Looper.getMainLooper());
+    private final AudioManagerAddAudioDeviceCallback mAudioManagerAddAudioDeviceCallback =
+            new AudioManagerAddAudioDeviceCallback();
+    private final AudioManagerRemoveAudioDeviceCallback mAudioManagerRemoveAudioDeviceCallback =
+            new AudioManagerRemoveAudioDeviceCallback();
 
     private final Map<Integer, Integer> mBroadcastStateMap = new HashMap<>();
     private final Map<Integer, Boolean> mBroadcastsPlaybackMap = new HashMap<>();
@@ -194,6 +201,10 @@
         return BluetoothProperties.isProfileBapUnicastClientEnabled().orElse(false);
     }
 
+    public static boolean isBroadcastEnabled() {
+        return BluetoothProperties.isProfileBapBroadcastSourceEnabled().orElse(false);
+    }
+
     @Override
     protected void create() {
         Log.i(TAG, "create()");
@@ -218,17 +229,15 @@
                 "AudioManager cannot be null when LeAudioService starts");
 
         // Start handler thread for state machines
-        mStateMachines.clear();
         mStateMachinesThread = new HandlerThread("LeAudioService.StateMachines");
         mStateMachinesThread.start();
 
-        mDeviceAudioLocationMap.clear();
         mBroadcastStateMap.clear();
         mBroadcastMetadataList.clear();
         mBroadcastsPlaybackMap.clear();
 
         synchronized (mGroupLock) {
-            mDeviceGroupIdMap.clear();
+            mDeviceDescriptors.clear();
             mGroupDescriptors.clear();
         }
 
@@ -252,7 +261,9 @@
                 LeAudioTmapGattServer.TMAP_ROLE_FLAG_CG | LeAudioTmapGattServer.TMAP_ROLE_FLAG_UMS;
 
         // Initialize Broadcast native interface
-        if (mAdapterService.isLeAudioBroadcastSourceSupported()) {
+        if ((mAdapterService.getSupportedProfilesBitMask()
+                    & (1 << BluetoothProfile.LE_AUDIO_BROADCAST)) != 0) {
+            Log.i(TAG, "Init Le Audio broadcaster");
             mBroadcastCallbacks = new RemoteCallbackList<IBluetoothLeBroadcastCallback>();
             mLeAudioBroadcasterNativeInterface = Objects.requireNonNull(
                     LeAudioBroadcasterNativeInterface.getInstance(),
@@ -287,6 +298,7 @@
         LeAudioNativeInterface nativeInterface = mLeAudioNativeInterface;
         if (nativeInterface == null) {
             Log.w(TAG, "the service is stopped. ignore init()");
+            return;
         }
         nativeInterface.init(mLeAudioCodecConfig.getCodecConfigOffloading());
     }
@@ -299,6 +311,7 @@
             return true;
         }
 
+        mHandler.removeCallbacks(this::init);
         setActiveDevice(null);
 
         if (mTmapGattServer == null) {
@@ -316,12 +329,23 @@
                 Integer group_id = entry.getKey();
                 if (descriptor.mIsActive) {
                     descriptor.mIsActive = false;
-                    updateActiveDevices(group_id, descriptor.mActiveContexts,
-                            ACTIVE_CONTEXTS_NONE, descriptor.mIsActive);
+                    updateActiveDevices(group_id, descriptor.mDirection, AUDIO_DIRECTION_NONE,
+                            descriptor.mIsActive);
                     break;
                 }
             }
-            mDeviceGroupIdMap.clear();
+
+            // Destroy state machines and stop handler thread
+            for (LeAudioDeviceDescriptor descriptor : mDeviceDescriptors.values()) {
+                LeAudioStateMachine sm = descriptor.mStateMachine;
+                if (sm == null) {
+                    continue;
+                }
+                sm.doQuit();
+                sm.cleanup();
+            }
+
+            mDeviceDescriptors.clear();
             mGroupDescriptors.clear();
         }
 
@@ -329,6 +353,12 @@
         mLeAudioNativeInterface.cleanup();
         mLeAudioNativeInterface = null;
         mLeAudioNativeIsInitialized = false;
+        mBluetoothEnabled = false;
+        mHfpHandoverDevice = null;
+
+        mActiveAudioOutDevice = null;
+        mActiveAudioInDevice = null;
+        mLeAudioCodecConfig = null;
 
         // Set the service and BLE devices as inactive
         setLeAudioService(null);
@@ -341,16 +371,6 @@
         unregisterReceiver(mMuteStateChangedReceiver);
         mMuteStateChangedReceiver = null;
 
-        // Destroy state machines and stop handler thread
-        synchronized (mStateMachines) {
-            for (LeAudioStateMachine sm : mStateMachines.values()) {
-                sm.doQuit();
-                sm.cleanup();
-            }
-            mStateMachines.clear();
-        }
-
-        mDeviceAudioLocationMap.clear();
 
         if (mBroadcastCallbacks != null) {
             mBroadcastCallbacks.kill();
@@ -379,8 +399,12 @@
             }
         }
 
+        mAudioManager.unregisterAudioDeviceCallback(mAudioManagerAddAudioDeviceCallback);
+        mAudioManager.unregisterAudioDeviceCallback(mAudioManagerRemoveAudioDeviceCallback);
+
         mAdapterService = null;
         mAudioManager = null;
+        mMcpService = null;
         mVolumeControlService = null;
 
         return true;
@@ -403,23 +427,46 @@
         return sLeAudioService;
     }
 
-    private static synchronized void setLeAudioService(LeAudioService instance) {
+    @VisibleForTesting
+    static synchronized void setLeAudioService(LeAudioService instance) {
         if (DBG) {
             Log.d(TAG, "setLeAudioService(): set to: " + instance);
         }
         sLeAudioService = instance;
     }
 
-    private int getGroupVolume(int groupId) {
+    @VisibleForTesting
+    int getAudioDeviceGroupVolume(int groupId) {
         if (mVolumeControlService == null) {
             mVolumeControlService = mServiceFactory.getVolumeControlService();
-        }
-        if (mVolumeControlService == null) {
-            Log.e(TAG, "Volume control service is not available");
-            return -1;
+            if (mVolumeControlService == null) {
+                Log.e(TAG, "Volume control service is not available");
+                return IBluetoothVolumeControl.VOLUME_CONTROL_UNKNOWN_VOLUME;
+            }
         }
 
-        return mVolumeControlService.getGroupVolume(groupId);
+        return mVolumeControlService.getAudioDeviceGroupVolume(groupId);
+    }
+
+    LeAudioDeviceDescriptor createDeviceDescriptor(BluetoothDevice device) {
+        LeAudioDeviceDescriptor descriptor = mDeviceDescriptors.get(device);
+        if (descriptor == null) {
+
+            // Limit the maximum number of devices to avoid DoS attack
+            if (mDeviceDescriptors.size() >= MAX_LE_AUDIO_DEVICES) {
+                Log.e(TAG, "Maximum number of LeAudio state machines reached: "
+                        + MAX_LE_AUDIO_DEVICES);
+                return null;
+            }
+
+            mDeviceDescriptors.put(device, new LeAudioDeviceDescriptor());
+            descriptor = mDeviceDescriptors.get(device);
+            Log.d(TAG, "Created descriptor for device: " + device);
+        } else {
+            Log.w(TAG, "Device: " + device + ", already exists");
+        }
+
+        return descriptor;
     }
 
     public boolean connect(BluetoothDevice device) {
@@ -437,7 +484,11 @@
             return false;
         }
 
-        synchronized (mStateMachines) {
+        synchronized (mGroupLock) {
+            if (createDeviceDescriptor(device) == null) {
+                return false;
+            }
+
             LeAudioStateMachine sm = getOrCreateStateMachine(device);
             if (sm == null) {
                 Log.e(TAG, "Ignored connect request for " + device + " : no state machine");
@@ -460,9 +511,14 @@
             Log.d(TAG, "disconnect(): " + device);
         }
 
-        // Disconnect this device
-        synchronized (mStateMachines) {
-            LeAudioStateMachine sm = mStateMachines.get(device);
+        synchronized (mGroupLock) {
+            LeAudioDeviceDescriptor descriptor = getDeviceDescriptor(device);
+            if (descriptor == null) {
+                Log.e(TAG, "disconnect: No valid descriptor for device: " + device);
+                return false;
+            }
+
+            LeAudioStateMachine sm = descriptor.mStateMachine;
             if (sm == null) {
                 Log.e(TAG, "Ignored disconnect request for " + device
                         + " : no state machine");
@@ -475,10 +531,11 @@
     }
 
     public List<BluetoothDevice> getConnectedDevices() {
-        synchronized (mStateMachines) {
+        synchronized (mGroupLock) {
             List<BluetoothDevice> devices = new ArrayList<>();
-            for (LeAudioStateMachine sm : mStateMachines.values()) {
-                if (sm.isConnected()) {
+            for (LeAudioDeviceDescriptor descriptor : mDeviceDescriptors.values()) {
+                LeAudioStateMachine sm = descriptor.mStateMachine;
+                if (sm != null && sm.isConnected()) {
                     devices.add(sm.getDevice());
                 }
             }
@@ -487,11 +544,31 @@
     }
 
     BluetoothDevice getConnectedGroupLeadDevice(int groupId) {
+        BluetoothDevice device = null;
+
         if (mActiveAudioOutDevice != null
-            && getGroupId(mActiveAudioOutDevice) == groupId) {
-            return mActiveAudioOutDevice;
+                && getGroupId(mActiveAudioOutDevice) == groupId) {
+            device = mActiveAudioOutDevice;
+        } else {
+            device = getFirstDeviceFromGroup(groupId);
         }
-        return getFirstDeviceFromGroup(groupId);
+
+        if (device == null) {
+            return device;
+        }
+
+        LeAudioDeviceDescriptor descriptor = getDeviceDescriptor(device);
+        if (descriptor == null) {
+            Log.e(TAG, "getConnectedGroupLeadDevice: No valid descriptor for device: " + device);
+            return null;
+        }
+
+        LeAudioStateMachine sm = descriptor.mStateMachine;
+        if (sm != null && sm.getConnectionState() == BluetoothProfile.STATE_CONNECTED) {
+            return device;
+        }
+
+        return null;
     }
 
     List<BluetoothDevice> getDevicesMatchingConnectionStates(int[] states) {
@@ -503,14 +580,21 @@
         if (bondedDevices == null) {
             return devices;
         }
-        synchronized (mStateMachines) {
+        synchronized (mGroupLock) {
             for (BluetoothDevice device : bondedDevices) {
                 final ParcelUuid[] featureUuids = device.getUuids();
                 if (!Utils.arrayContains(featureUuids, BluetoothUuid.LE_AUDIO)) {
                     continue;
                 }
                 int connectionState = BluetoothProfile.STATE_DISCONNECTED;
-                LeAudioStateMachine sm = mStateMachines.get(device);
+                LeAudioDeviceDescriptor descriptor = getDeviceDescriptor(device);
+                if (descriptor == null) {
+                    Log.e(TAG, "getDevicesMatchingConnectionStates: "
+                            + "No valid descriptor for device: " + device);
+                    return null;
+                }
+
+                LeAudioStateMachine sm = descriptor.mStateMachine;
                 if (sm != null) {
                     connectionState = sm.getConnectionState();
                 }
@@ -533,9 +617,11 @@
     @VisibleForTesting
     List<BluetoothDevice> getDevices() {
         List<BluetoothDevice> devices = new ArrayList<>();
-        synchronized (mStateMachines) {
-            for (LeAudioStateMachine sm : mStateMachines.values()) {
-                devices.add(sm.getDevice());
+        synchronized (mGroupLock) {
+            for (LeAudioDeviceDescriptor descriptor : mDeviceDescriptors.values()) {
+                if (descriptor.mStateMachine != null) {
+                    devices.add(descriptor.mStateMachine.getDevice());
+                }
             }
             return devices;
         }
@@ -551,8 +637,13 @@
      * {@link BluetoothProfile#STATE_DISCONNECTING} if this profile is being disconnected
      */
     public int getConnectionState(BluetoothDevice device) {
-        synchronized (mStateMachines) {
-            LeAudioStateMachine sm = mStateMachines.get(device);
+        synchronized (mGroupLock) {
+            LeAudioDeviceDescriptor descriptor = getDeviceDescriptor(device);
+            if (descriptor == null) {
+                return BluetoothProfile.STATE_DISCONNECTED;
+            }
+
+            LeAudioStateMachine sm = descriptor.mStateMachine;
             if (sm == null) {
                 return BluetoothProfile.STATE_DISCONNECTED;
             }
@@ -593,8 +684,10 @@
      * @param group_id group Id to verify
      * @return true given group exists, otherwise false
      */
-    public boolean isValidDeviceGroup(int group_id) {
-        return group_id != LE_AUDIO_GROUP_ID_INVALID && mDeviceGroupIdMap.containsValue(group_id);
+    public boolean isValidDeviceGroup(int groupId) {
+        synchronized (mGroupLock) {
+            return groupId != LE_AUDIO_GROUP_ID_INVALID && mGroupDescriptors.containsKey(groupId);
+        }
     }
 
     /**
@@ -610,8 +703,9 @@
         }
 
         synchronized (mGroupLock) {
-            for (Map.Entry<BluetoothDevice, Integer> entry : mDeviceGroupIdMap.entrySet()) {
-                if (entry.getValue() == groupId) {
+            for (Map.Entry<BluetoothDevice, LeAudioDeviceDescriptor> entry
+                    : mDeviceDescriptors.entrySet()) {
+                if (entry.getValue().mGroupId == groupId) {
                     result.add(entry.getKey());
                 }
             }
@@ -619,28 +713,6 @@
         return result;
     }
 
-    /**
-     * Get supported group audio direction from available context.
-     *
-     * @param activeContexts bitset of active context to be matched with possible audio direction
-     * support.
-     * @return matched possible audio direction support masked bitset
-     * {@link #AUDIO_DIRECTION_INPUT_BIT} if input audio is supported
-     * {@link #AUDIO_DIRECTION_OUTPUT_BIT} if output audio is supported
-     */
-    private Integer getAudioDirectionsFromActiveContextsMap(Integer activeContexts) {
-        Integer supportedAudioDirections = 0;
-
-        if ((activeContexts & mContextSupportingInputAudio) != 0) {
-          supportedAudioDirections |= AUDIO_DIRECTION_INPUT_BIT;
-        }
-        if ((activeContexts & mContextSupportingOutputAudio) != 0) {
-          supportedAudioDirections |= AUDIO_DIRECTION_OUTPUT_BIT;
-        }
-
-        return supportedAudioDirections;
-    }
-
     private Integer getActiveGroupId() {
         synchronized (mGroupLock) {
             for (Map.Entry<Integer, LeAudioGroupDescriptor> entry : mGroupDescriptors.entrySet()) {
@@ -662,6 +734,15 @@
             Log.w(TAG, "Native interface not available.");
             return;
         }
+        boolean isEncrypted = (broadcastCode != null) && (broadcastCode.length != 0);
+        if (isEncrypted) {
+            if ((broadcastCode.length > 16) || (broadcastCode.length < 4)) {
+                Log.e(TAG, "Invalid broadcast code length. Should be from 4 to 16 octets long.");
+                return;
+            }
+        }
+
+        Log.i(TAG, "createBroadcast: isEncrypted=" + (isEncrypted ? "true" : "false"));
         mLeAudioBroadcasterNativeInterface.createBroadcast(metadata.getRawMetadata(),
                 broadcastCode);
     }
@@ -768,28 +849,23 @@
             return null;
         }
         synchronized (mGroupLock) {
-            for (Map.Entry<BluetoothDevice, Integer> entry : mDeviceGroupIdMap.entrySet()) {
-                if (entry.getValue() != groupId) {
+            for (LeAudioDeviceDescriptor descriptor : mDeviceDescriptors.values()) {
+                if (!descriptor.mGroupId.equals(groupId)) {
                     continue;
                 }
-                LeAudioStateMachine sm = mStateMachines.get(entry.getKey());
+
+                LeAudioStateMachine sm = descriptor.mStateMachine;
                 if (sm == null || sm.getConnectionState() != BluetoothProfile.STATE_CONNECTED) {
                     continue;
                 }
-                return entry.getKey();
+                return sm.getDevice();
             }
         }
         return null;
     }
 
     private boolean updateActiveInDevice(BluetoothDevice device, Integer groupId,
-                                            Integer oldActiveContexts,
-                                            Integer newActiveContexts) {
-        Integer oldSupportedAudioDirections =
-                getAudioDirectionsFromActiveContextsMap(oldActiveContexts);
-        Integer newSupportedAudioDirections =
-                getAudioDirectionsFromActiveContextsMap(newActiveContexts);
-
+            Integer oldSupportedAudioDirections, Integer newSupportedAudioDirections) {
         boolean oldSupportedByDeviceInput = (oldSupportedAudioDirections
                 & AUDIO_DIRECTION_INPUT_BIT) != 0;
         boolean newSupportedByDeviceInput = (newSupportedAudioDirections
@@ -804,18 +880,23 @@
         }
 
         if (device != null && mActiveAudioInDevice != null) {
-            int previousGroupId = getGroupId(mActiveAudioInDevice);
-            if (previousGroupId == groupId) {
+            LeAudioDeviceDescriptor deviceDescriptor = getDeviceDescriptor(device);
+            if (deviceDescriptor == null) {
+                Log.e(TAG, "updateActiveInDevice: No valid descriptor for device: " + device);
+                return false;
+            }
+
+            if (deviceDescriptor.mGroupId.equals(groupId)) {
                 /* This is thes same group as aleady notified to the system.
-                * Therefore do not change the device we have connected to the group,
-                * unless, previous one is disconnected now
-                */
+                 * Therefore do not change the device we have connected to the group,
+                 * unless, previous one is disconnected now
+                 */
                 if (mActiveAudioInDevice.isConnected()) {
                     device = mActiveAudioInDevice;
                 }
-            } else if (previousGroupId != LE_AUDIO_GROUP_ID_INVALID) {
+            } else if (deviceDescriptor.mGroupId != LE_AUDIO_GROUP_ID_INVALID) {
                 /* Mark old group as no active */
-                LeAudioGroupDescriptor descriptor = getGroupDescriptor(previousGroupId);
+                LeAudioGroupDescriptor descriptor = getGroupDescriptor(deviceDescriptor.mGroupId);
                 if (descriptor != null) {
                     descriptor.mIsActive = false;
                 }
@@ -835,13 +916,10 @@
             mActiveAudioInDevice = newSupportedByDeviceInput ? device : null;
             if (DBG) {
                 Log.d(TAG, " handleBluetoothActiveDeviceChanged  previousInDevice: "
-                            + previousInDevice + ", mActiveAudioInDevice" + mActiveAudioInDevice
-                            + " isLeOutput: false");
+                        + previousInDevice + ", mActiveAudioInDevice" + mActiveAudioInDevice
+                        + " isLeOutput: false");
             }
 
-            mAudioManager.handleBluetoothActiveDeviceChanged(mActiveAudioInDevice,previousInDevice,
-                    BluetoothProfileConnectionInfo.createLeAudioInfo(false, false));
-
             return true;
         }
         Log.d(TAG, "updateActiveInDevice: Nothing to do.");
@@ -849,13 +927,7 @@
     }
 
     private boolean updateActiveOutDevice(BluetoothDevice device, Integer groupId,
-                                       Integer oldActiveContexts,
-                                       Integer newActiveContexts) {
-        Integer oldSupportedAudioDirections =
-                getAudioDirectionsFromActiveContextsMap(oldActiveContexts);
-        Integer newSupportedAudioDirections =
-                getAudioDirectionsFromActiveContextsMap(newActiveContexts);
-
+            Integer oldSupportedAudioDirections, Integer newSupportedAudioDirections) {
         boolean oldSupportedByDeviceOutput = (oldSupportedAudioDirections
                 & AUDIO_DIRECTION_OUTPUT_BIT) != 0;
         boolean newSupportedByDeviceOutput = (newSupportedAudioDirections
@@ -870,19 +942,25 @@
         }
 
         if (device != null && mActiveAudioOutDevice != null) {
-            int previousGroupId = getGroupId(mActiveAudioOutDevice);
-            if (previousGroupId == groupId) {
+            LeAudioDeviceDescriptor deviceDescriptor = getDeviceDescriptor(device);
+            if (deviceDescriptor == null) {
+                Log.e(TAG, "updateActiveOutDevice: No valid descriptor for device: " + device);
+                return false;
+            }
+
+            if (deviceDescriptor.mGroupId.equals(groupId)) {
                 /* This is the same group as already notified to the system.
-                * Therefore do not change the device we have connected to the group,
-                * unless, previous one is disconnected now
-                */
+                 * Therefore do not change the device we have connected to the group,
+                 * unless, previous one is disconnected now
+                 */
                 if (mActiveAudioOutDevice.isConnected()) {
                     device = mActiveAudioOutDevice;
                 }
-            } else if (previousGroupId != LE_AUDIO_GROUP_ID_INVALID) {
-                Log.i(TAG, " Switching active group from " + previousGroupId + " to " + groupId);
+            } else if (deviceDescriptor.mGroupId != LE_AUDIO_GROUP_ID_INVALID) {
+                Log.i(TAG, " Switching active group from " + deviceDescriptor.mGroupId + " to "
+                        + groupId);
                 /* Mark old group as no active */
-                LeAudioGroupDescriptor descriptor = getGroupDescriptor(previousGroupId);
+                LeAudioGroupDescriptor descriptor = getGroupDescriptor(deviceDescriptor.mGroupId);
                 if (descriptor != null) {
                     descriptor.mIsActive = false;
                 }
@@ -900,22 +978,11 @@
         if (!Objects.equals(device, previousOutDevice)
                 || (oldSupportedByDeviceOutput != newSupportedByDeviceOutput)) {
             mActiveAudioOutDevice = newSupportedByDeviceOutput ? device : null;
-            final boolean suppressNoisyIntent = (mActiveAudioOutDevice != null)
-                    || (getConnectionState(previousOutDevice) == BluetoothProfile.STATE_CONNECTED);
-
             if (DBG) {
                 Log.d(TAG, " handleBluetoothActiveDeviceChanged previousOutDevice: "
-                            + previousOutDevice + ", mActiveOutDevice: " + mActiveAudioOutDevice
-                            + " isLeOutput: true");
+                        + previousOutDevice + ", mActiveOutDevice: " + mActiveAudioOutDevice
+                        + " isLeOutput: true");
             }
-            int volume = -1;
-            if (mActiveAudioOutDevice != null) {
-                volume = getGroupVolume(groupId);
-            }
-
-            mAudioManager.handleBluetoothActiveDeviceChanged(mActiveAudioOutDevice,
-                    previousOutDevice,
-                    getLeAudioOutputProfile(suppressNoisyIntent, volume));
             return true;
         }
         Log.d(TAG, "updateActiveOutDevice: Nothing to do.");
@@ -923,32 +990,126 @@
     }
 
     /**
+     * Send broadcast intent about LeAudio active device.
+     * This is called when AudioManager confirms, LeAudio device
+     * is added or removed.
+     */
+    @VisibleForTesting
+    void notifyActiveDeviceChanged() {
+        Intent intent = new Intent(BluetoothLeAudio.ACTION_LE_AUDIO_ACTIVE_DEVICE_CHANGED);
+        intent.putExtra(BluetoothDevice.EXTRA_DEVICE,
+                mActiveAudioOutDevice != null ? mActiveAudioOutDevice : mActiveAudioInDevice);
+        intent.addFlags(Intent.FLAG_RECEIVER_REGISTERED_ONLY_BEFORE_BOOT
+                | Intent.FLAG_RECEIVER_INCLUDE_BACKGROUND);
+        sendBroadcast(intent, BLUETOOTH_CONNECT);
+    }
+
+    /* Notifications of audio device disconnection events. */
+    private class AudioManagerRemoveAudioDeviceCallback extends AudioDeviceCallback {
+        @Override
+        public void onAudioDevicesRemoved(AudioDeviceInfo[] removedDevices) {
+            if (mAudioManager == null) {
+                Log.e(TAG, "Callback called when LeAudioService is stopped");
+                return;
+            }
+
+            for (AudioDeviceInfo deviceInfo : removedDevices) {
+                if (deviceInfo.getType() == AudioDeviceInfo.TYPE_BLE_HEADSET
+                        || deviceInfo.getType() == AudioDeviceInfo.TYPE_BLE_SPEAKER) {
+                    notifyActiveDeviceChanged();
+                    if (DBG) {
+                        Log.d(TAG, " onAudioDevicesRemoved: device type: " + deviceInfo.getType());
+                    }
+                    mAudioManager.unregisterAudioDeviceCallback(this);
+                }
+            }
+        }
+    }
+
+    /* Notifications of audio device connection events. */
+    private class AudioManagerAddAudioDeviceCallback extends AudioDeviceCallback {
+        @Override
+        public void onAudioDevicesAdded(AudioDeviceInfo[] addedDevices) {
+            if (mAudioManager == null) {
+                Log.e(TAG, "Callback called when LeAudioService is stopped");
+                return;
+            }
+
+            for (AudioDeviceInfo deviceInfo : addedDevices) {
+                if (deviceInfo.getType() == AudioDeviceInfo.TYPE_BLE_HEADSET
+                        || deviceInfo.getType() == AudioDeviceInfo.TYPE_BLE_SPEAKER) {
+                    notifyActiveDeviceChanged();
+                    if (DBG) {
+                        Log.d(TAG, " onAudioDevicesAdded: device type: " + deviceInfo.getType());
+                    }
+                    mAudioManager.unregisterAudioDeviceCallback(this);
+                }
+            }
+        }
+    }
+
+    /**
      * Report the active devices change to the active device manager and the media framework.
      * @param groupId id of group which devices should be updated
-     * @param newActiveContexts new active contexts for group of devices
-     * @param oldActiveContexts old active contexts for group of devices
+     * @param newSupportedAudioDirections new supported audio directions for group of devices
+     * @param oldSupportedAudioDirections old supported audio directions for group of devices
      * @param isActive if there is new active group
      * @return true if group is active after change false otherwise.
      */
-    private boolean updateActiveDevices(Integer groupId, Integer oldActiveContexts,
-            Integer newActiveContexts, boolean isActive) {
+    private boolean updateActiveDevices(Integer groupId, Integer oldSupportedAudioDirections,
+            Integer newSupportedAudioDirections, boolean isActive) {
         BluetoothDevice device = null;
+        BluetoothDevice previousActiveOutDevice = mActiveAudioOutDevice;
+        BluetoothDevice previousActiveInDevice = mActiveAudioInDevice;
 
         if (isActive) {
             device = getFirstDeviceFromGroup(groupId);
         }
 
-        boolean outReplaced =
-            updateActiveOutDevice(device, groupId, oldActiveContexts, newActiveContexts);
-        boolean inReplaced =
-            updateActiveInDevice(device, groupId, oldActiveContexts, newActiveContexts);
+        boolean isNewActiveOutDevice = updateActiveOutDevice(device, groupId,
+                oldSupportedAudioDirections, newSupportedAudioDirections);
+        boolean isNewActiveInDevice = updateActiveInDevice(device, groupId,
+                oldSupportedAudioDirections, newSupportedAudioDirections);
 
-        if (outReplaced || inReplaced) {
-            Intent intent = new Intent(BluetoothLeAudio.ACTION_LE_AUDIO_ACTIVE_DEVICE_CHANGED);
-            intent.putExtra(BluetoothDevice.EXTRA_DEVICE, mActiveAudioOutDevice);
-            intent.addFlags(Intent.FLAG_RECEIVER_REGISTERED_ONLY_BEFORE_BOOT
-                    | Intent.FLAG_RECEIVER_INCLUDE_BACKGROUND);
-            sendBroadcast(intent, BLUETOOTH_CONNECT);
+        if (DBG) {
+            Log.d(TAG, " isNewActiveOutDevice: " + isNewActiveOutDevice + ", "
+                    + mActiveAudioOutDevice + ", isNewActiveInDevice: " + isNewActiveInDevice
+                    + ", " + mActiveAudioInDevice);
+        }
+
+        /* Active device changed, there is need to inform about new active LE Audio device */
+        if (isNewActiveOutDevice || isNewActiveInDevice) {
+            /* Register for new device connection/disconnection in Audio Manager */
+            if (mActiveAudioOutDevice != null || mActiveAudioInDevice != null) {
+                /* Register for any device connection in case if any of devices become connected */
+                mAudioManager.registerAudioDeviceCallback(mAudioManagerAddAudioDeviceCallback,
+                        mHandler);
+            } else {
+                /* Register for disconnection if active devices become non-active */
+                mAudioManager.registerAudioDeviceCallback(mAudioManagerRemoveAudioDeviceCallback,
+                        mHandler);
+            }
+        }
+
+        if (isNewActiveOutDevice) {
+            int volume = IBluetoothVolumeControl.VOLUME_CONTROL_UNKNOWN_VOLUME;
+
+            if (mActiveAudioOutDevice != null) {
+                volume = getAudioDeviceGroupVolume(groupId);
+            }
+
+            final boolean suppressNoisyIntent = (mActiveAudioOutDevice != null)
+                    || (getConnectionState(previousActiveOutDevice)
+                    == BluetoothProfile.STATE_CONNECTED);
+
+            mAudioManager.handleBluetoothActiveDeviceChanged(mActiveAudioOutDevice,
+                    previousActiveOutDevice, getLeAudioOutputProfile(suppressNoisyIntent, volume));
+        }
+
+        if (isNewActiveInDevice) {
+            mAudioManager.handleBluetoothActiveDeviceChanged(mActiveAudioInDevice,
+                    previousActiveInDevice, BluetoothProfileConnectionInfo.createLeAudioInfo(false,
+                            false));
         }
 
         return mActiveAudioOutDevice != null;
@@ -961,7 +1122,13 @@
         int groupId = LE_AUDIO_GROUP_ID_INVALID;
 
         if (device != null) {
-            groupId = mDeviceGroupIdMap.getOrDefault(device, LE_AUDIO_GROUP_ID_INVALID);
+            LeAudioDeviceDescriptor descriptor = getDeviceDescriptor(device);
+            if (descriptor == null) {
+                Log.e(TAG, "setActiveGroupWithDevice: No valid descriptor for device: " + device);
+                return;
+            }
+
+            groupId = descriptor.mGroupId;
         }
 
         int currentlyActiveGroupId = getActiveGroupId();
@@ -983,6 +1150,13 @@
             return;
         }
         mLeAudioNativeInterface.groupSetActive(groupId);
+        if (groupId == LE_AUDIO_GROUP_ID_INVALID) {
+            /* Native will clear its states and send us group Inactive.
+             * However we would like to notify audio framework that LeAudio is not
+             * active anymore and does not want to get more audio data.
+             */
+            handleGroupTransitToInactive(currentlyActiveGroupId);
+        }
     }
 
     /**
@@ -1010,11 +1184,11 @@
      * Get the active LE audio devices.
      *
      * Note: When LE audio group is active, one of the Bluetooth device address
-     * which belongs to the group, represents the active LE audio group.
+     * which belongs to the group, represents the active LE audio group - it is called
+     * Lead device.
      * Internally, this address is translated to LE audio group id.
      *
-     * @return List of two elements. First element is an active output device
-     *         and second element is an active input device.
+     * @return List of active group members. First element is a Lead device.
      */
     public List<BluetoothDevice> getActiveDevices() {
         if (DBG) {
@@ -1028,42 +1202,66 @@
         if (currentlyActiveGroupId == LE_AUDIO_GROUP_ID_INVALID) {
             return activeDevices;
         }
-        activeDevices.set(0, mActiveAudioOutDevice);
-        activeDevices.set(1, mActiveAudioInDevice);
+
+        BluetoothDevice leadDevice = getConnectedGroupLeadDevice(currentlyActiveGroupId);
+        activeDevices.set(0, leadDevice);
+
+        int i = 1;
+        for (BluetoothDevice dev : getGroupDevices(currentlyActiveGroupId)) {
+            if (Objects.equals(dev, leadDevice)) {
+                continue;
+            }
+            if (i == 1) {
+                /* Already has a spot for first member */
+                activeDevices.set(i++, dev);
+            } else {
+                /* Extend list with other members */
+                activeDevices.add(dev);
+            }
+        }
         return activeDevices;
     }
 
     void connectSet(BluetoothDevice device) {
-        int groupId = getGroupId(device);
-        if (groupId == LE_AUDIO_GROUP_ID_INVALID) {
+        LeAudioDeviceDescriptor descriptor = getDeviceDescriptor(device);
+        if (descriptor == null) {
+            Log.e(TAG, "connectSet: No valid descriptor for device: " + device);
+            return;
+        }
+        if (descriptor.mGroupId == LE_AUDIO_GROUP_ID_INVALID) {
             return;
         }
 
         if (DBG) {
-            Log.d(TAG, "connect() others from group id: " + groupId);
+            Log.d(TAG, "connect() others from group id: " + descriptor.mGroupId);
         }
 
-        for (BluetoothDevice storedDevice : mDeviceGroupIdMap.keySet()) {
+        Integer setGroupId = descriptor.mGroupId;
+
+        for (Map.Entry<BluetoothDevice, LeAudioDeviceDescriptor> entry
+                : mDeviceDescriptors.entrySet()) {
+            BluetoothDevice storedDevice = entry.getKey();
+            descriptor = entry.getValue();
             if (device.equals(storedDevice)) {
                 continue;
             }
 
-            if (getGroupId(storedDevice) != groupId) {
+            if (!descriptor.mGroupId.equals(setGroupId)) {
                 continue;
             }
 
             if (DBG) {
-                Log.d(TAG, "connect(): " + device);
+                Log.d(TAG, "connect(): " + storedDevice);
             }
 
-            synchronized (mStateMachines) {
-                 LeAudioStateMachine sm = getOrCreateStateMachine(storedDevice);
-                 if (sm == null) {
-                     Log.e(TAG, "Ignored connect request for " + storedDevice
-                             + " : no state machine");
-                     continue;
-                 }
-                 sm.sendMessage(LeAudioStateMachine.CONNECT);
+            synchronized (mGroupLock) {
+                LeAudioStateMachine sm = getOrCreateStateMachine(storedDevice);
+                if (sm == null) {
+                    Log.e(TAG, "Ignored connect request for " + storedDevice
+                            + " : no state machine");
+                    continue;
+                }
+                sm.sendMessage(LeAudioStateMachine.CONNECT);
             }
         }
     }
@@ -1099,19 +1297,96 @@
     }
 
     private void clearLostDevicesWhileStreaming(LeAudioGroupDescriptor descriptor) {
-        if (DBG) {
-            Log.d(TAG, " lost dev: " + descriptor.mLostLeadDeviceWhileStreaming);
+        synchronized (mGroupLock) {
+            if (DBG) {
+                Log.d(TAG, "Clearing lost dev: " + descriptor.mLostLeadDeviceWhileStreaming);
+            }
+
+            LeAudioDeviceDescriptor deviceDescriptor =
+                    getDeviceDescriptor(descriptor.mLostLeadDeviceWhileStreaming);
+            if (deviceDescriptor == null) {
+                Log.e(TAG, "clearLostDevicesWhileStreaming: No valid descriptor for device: "
+                        + descriptor.mLostLeadDeviceWhileStreaming);
+                return;
+            }
+
+            LeAudioStateMachine sm = deviceDescriptor.mStateMachine;
+            if (sm != null) {
+                LeAudioStackEvent stackEvent =
+                        new LeAudioStackEvent(
+                                LeAudioStackEvent.EVENT_TYPE_CONNECTION_STATE_CHANGED);
+                stackEvent.device = descriptor.mLostLeadDeviceWhileStreaming;
+                stackEvent.valueInt1 = LeAudioStackEvent.CONNECTION_STATE_DISCONNECTED;
+                sm.sendMessage(LeAudioStateMachine.STACK_EVENT, stackEvent);
+            }
+            descriptor.mLostLeadDeviceWhileStreaming = null;
+        }
+    }
+
+    private void handleGroupTransitToActive(int groupId) {
+        synchronized (mGroupLock) {
+            LeAudioGroupDescriptor descriptor = getGroupDescriptor(groupId);
+            if (descriptor == null || descriptor.mIsActive) {
+                Log.e(TAG, "no descriptors for group: " + groupId + " or group already active");
+                return;
+            }
+
+            descriptor.mIsActive = updateActiveDevices(groupId, AUDIO_DIRECTION_NONE,
+                    descriptor.mDirection, true);
+
+            if (descriptor.mIsActive) {
+                notifyGroupStatusChanged(groupId, LeAudioStackEvent.GROUP_STATUS_ACTIVE);
+            }
+        }
+    }
+
+    private void handleGroupTransitToInactive(int groupId) {
+        synchronized (mGroupLock) {
+            LeAudioGroupDescriptor descriptor = getGroupDescriptor(groupId);
+            if (descriptor == null || !descriptor.mIsActive) {
+                Log.e(TAG, "no descriptors for group: " + groupId + " or group already inactive");
+                return;
+            }
+
+            descriptor.mIsActive = false;
+            updateActiveDevices(groupId, descriptor.mDirection, AUDIO_DIRECTION_NONE,
+                    descriptor.mIsActive);
+            /* Clear lost devices */
+            if (DBG) Log.d(TAG, "Clear for group: " + groupId);
+            clearLostDevicesWhileStreaming(descriptor);
+            notifyGroupStatusChanged(groupId, LeAudioStackEvent.GROUP_STATUS_INACTIVE);
+        }
+    }
+
+    @VisibleForTesting
+    void handleGroupIdleDuringCall() {
+        if (mHfpHandoverDevice == null) {
+            if (DBG) {
+                Log.d(TAG, "There is no HFP handover");
+            }
+            return;
+        }
+        HeadsetService headsetService = mServiceFactory.getHeadsetService();
+        if (headsetService == null) {
+            if (DBG) {
+                Log.d(TAG, "There is no HFP service available");
+            }
+            return;
         }
 
-        LeAudioStateMachine sm = mStateMachines.get(descriptor.mLostLeadDeviceWhileStreaming);
-        if (sm != null) {
-            LeAudioStackEvent stackEvent =
-                new LeAudioStackEvent(LeAudioStackEvent.EVENT_TYPE_CONNECTION_STATE_CHANGED);
-            stackEvent.device = descriptor.mLostLeadDeviceWhileStreaming;
-            stackEvent.valueInt1 = LeAudioStackEvent.CONNECTION_STATE_DISCONNECTED;
-            sm.sendMessage(LeAudioStateMachine.STACK_EVENT, stackEvent);
+        BluetoothDevice activeHfpDevice = headsetService.getActiveDevice();
+        if (activeHfpDevice == null) {
+            if (DBG) {
+                Log.d(TAG, "Make " + mHfpHandoverDevice + " active again ");
+            }
+            headsetService.setActiveDevice(mHfpHandoverDevice);
+        } else {
+            if (DBG) {
+                Log.d(TAG, "Connect audio to " + activeHfpDevice);
+            }
+            headsetService.connectAudio();
         }
-        descriptor.mLostLeadDeviceWhileStreaming = null;
+        mHfpHandoverDevice = null;
     }
 
     // Suppressed since this is part of a local process
@@ -1119,47 +1394,59 @@
     void messageFromNative(LeAudioStackEvent stackEvent) {
         Log.d(TAG, "Message from native: " + stackEvent);
         BluetoothDevice device = stackEvent.device;
-        Intent intent = null;
 
         if (stackEvent.type == LeAudioStackEvent.EVENT_TYPE_CONNECTION_STATE_CHANGED) {
-        // Some events require device state machine
-            synchronized (mStateMachines) {
-                LeAudioStateMachine sm = mStateMachines.get(device);
+            // Some events require device state machine
+            synchronized (mGroupLock) {
+                LeAudioDeviceDescriptor deviceDescriptor = getDeviceDescriptor(device);
+                if (deviceDescriptor == null) {
+                    Log.e(TAG, "messageFromNative: No valid descriptor for device: " + device);
+                    return;
+                }
+
+                LeAudioStateMachine sm = deviceDescriptor.mStateMachine;
                 if (sm != null) {
                     /*
-                    * To improve scenario when lead Le Audio device is disconnected for the
-                    * streaming group, while there are still other devices streaming,
-                    * LeAudioService will not notify audio framework or other users about
-                    * Le Audio lead device disconnection. Instead we try to reconnect under the hood
-                    * and keep using lead device as a audio device indetifier in the audio framework
-                    * in order to not stop the stream.
-                    */
-                    int groupId = getGroupId(device);
-                    synchronized (mGroupLock) {
-                        LeAudioGroupDescriptor descriptor = mGroupDescriptors.get(groupId);
-                        switch (stackEvent.valueInt1) {
-                            case LeAudioStackEvent.CONNECTION_STATE_DISCONNECTING:
-                            case LeAudioStackEvent.CONNECTION_STATE_DISCONNECTED:
-                                if (descriptor != null && (Objects.equals(device,
-                                        mActiveAudioOutDevice)
-                                        || Objects.equals(device, mActiveAudioInDevice))
-                                        && (getConnectedPeerDevices(groupId).size() > 1)) {
+                     * To improve scenario when lead Le Audio device is disconnected for the
+                     * streaming group, while there are still other devices streaming,
+                     * LeAudioService will not notify audio framework or other users about
+                     * Le Audio lead device disconnection. Instead we try to reconnect under
+                     * the hood and keep using lead device as a audio device indetifier in
+                     * the audio framework in order to not stop the stream.
+                     */
+                    int groupId = deviceDescriptor.mGroupId;
+                    LeAudioGroupDescriptor descriptor = mGroupDescriptors.get(groupId);
+                    switch (stackEvent.valueInt1) {
+                        case LeAudioStackEvent.CONNECTION_STATE_DISCONNECTING:
+                        case LeAudioStackEvent.CONNECTION_STATE_DISCONNECTED:
+                            boolean disconnectDueToUnbond =
+                                    (BluetoothDevice.BOND_NONE
+                                            == mAdapterService.getBondState(device));
+                            if (descriptor != null && (Objects.equals(device,
+                                    mActiveAudioOutDevice)
+                                    || Objects.equals(device, mActiveAudioInDevice))
+                                    && (getConnectedPeerDevices(groupId).size() > 1)
+                                    && !disconnectDueToUnbond) {
 
-                                    if (DBG) Log.d(TAG, "Adding to lost devices : " + device);
-                                    descriptor.mLostLeadDeviceWhileStreaming = device;
-                                    return;
+                                if (DBG) Log.d(TAG, "Adding to lost devices : " + device);
+                                descriptor.mLostLeadDeviceWhileStreaming = device;
+                                return;
+                            }
+                            break;
+                        case LeAudioStackEvent.CONNECTION_STATE_CONNECTED:
+                        case LeAudioStackEvent.CONNECTION_STATE_CONNECTING:
+                            if (descriptor != null
+                                    && Objects.equals(
+                                            descriptor.mLostLeadDeviceWhileStreaming,
+                                            device)) {
+                                if (DBG) {
+                                    Log.d(TAG, "Removing from lost devices : " + device);
                                 }
-                                break;
-                            case LeAudioStackEvent.CONNECTION_STATE_CONNECTED:
-                            case LeAudioStackEvent.CONNECTION_STATE_CONNECTING:
-                                if (descriptor != null) {
-                                    if (DBG) Log.d(TAG, "Removing from lost devices : " + device);
-                                    descriptor.mLostLeadDeviceWhileStreaming = null;
-                                    /* Try to connect other devices from the group */
-                                    connectSet(device);
-                                }
-                                break;
-                        }
+                                descriptor.mLostLeadDeviceWhileStreaming = null;
+                                /* Try to connect other devices from the group */
+                                connectSet(device);
+                            }
+                            break;
                     }
                 } else {
                     /* state machine does not exist yet */
@@ -1201,11 +1488,11 @@
                     break;
             }
         } else if (stackEvent.type
-                        == LeAudioStackEvent.EVENT_TYPE_AUDIO_LOCAL_CODEC_CONFIG_CAPA_CHANGED) {
+                == LeAudioStackEvent.EVENT_TYPE_AUDIO_LOCAL_CODEC_CONFIG_CAPA_CHANGED) {
             mInputLocalCodecCapabilities = stackEvent.valueCodecList1;
             mOutputLocalCodecCapabilities = stackEvent.valueCodecList2;
         } else if (stackEvent.type
-                        == LeAudioStackEvent.EVENT_TYPE_AUDIO_GROUP_CODEC_CONFIG_CHANGED) {
+                == LeAudioStackEvent.EVENT_TYPE_AUDIO_GROUP_CODEC_CONFIG_CHANGED) {
             int groupId = stackEvent.valueInt1;
             LeAudioGroupDescriptor descriptor = getGroupDescriptor(groupId);
             if (descriptor == null) {
@@ -1237,26 +1524,36 @@
             int src_audio_location = stackEvent.valueInt4;
             int available_contexts = stackEvent.valueInt5;
 
-            LeAudioGroupDescriptor descriptor = getGroupDescriptor(groupId);
-            if (descriptor != null) {
-                if (descriptor.mIsActive) {
-                    descriptor.mIsActive =
-                        updateActiveDevices(groupId, descriptor.mActiveContexts,
-                                        available_contexts, descriptor.mIsActive);
-                    if (!descriptor.mIsActive) {
-                        notifyGroupStatusChanged(groupId, BluetoothLeAudio.GROUP_STATUS_INACTIVE);
+            synchronized (mGroupLock) {
+                LeAudioGroupDescriptor descriptor = getGroupDescriptor(groupId);
+                if (descriptor != null) {
+                    if (descriptor.mIsActive) {
+                        descriptor.mIsActive =
+                                updateActiveDevices(groupId, descriptor.mDirection, direction,
+                                descriptor.mIsActive);
+                        if (!descriptor.mIsActive) {
+                            notifyGroupStatusChanged(groupId,
+                                    BluetoothLeAudio.GROUP_STATUS_INACTIVE);
+                        }
                     }
+                    descriptor.mDirection = direction;
+                } else {
+                    Log.e(TAG, "no descriptors for group: " + groupId);
                 }
-                descriptor.mActiveContexts = available_contexts;
-            } else {
-                Log.e(TAG, "no descriptors for group: " + groupId);
             }
         } else if (stackEvent.type == LeAudioStackEvent.EVENT_TYPE_SINK_AUDIO_LOCATION_AVAILABLE) {
             Objects.requireNonNull(stackEvent.device,
                     "Device should never be null, event: " + stackEvent);
 
             int sink_audio_location = stackEvent.valueInt1;
-            mDeviceAudioLocationMap.put(device, sink_audio_location);
+
+            LeAudioDeviceDescriptor descriptor = getDeviceDescriptor(device);
+            if (descriptor == null) {
+                Log.e(TAG, "messageFromNative: No valid descriptor for device: " + device);
+                return;
+            }
+
+            descriptor.mSinkAudioLocation = sink_audio_location;
 
             if (DBG) {
                 Log.i(TAG, "EVENT_TYPE_SINK_AUDIO_LOCATION_AVAILABLE:" + device
@@ -1265,48 +1562,23 @@
         } else if (stackEvent.type == LeAudioStackEvent.EVENT_TYPE_GROUP_STATUS_CHANGED) {
             int groupId = stackEvent.valueInt1;
             int groupStatus = stackEvent.valueInt2;
-            boolean notifyGroupStatus = false;
 
             switch (groupStatus) {
                 case LeAudioStackEvent.GROUP_STATUS_ACTIVE: {
-                    LeAudioGroupDescriptor descriptor = getGroupDescriptor(groupId);
-                    if (descriptor != null) {
-                        if (!descriptor.mIsActive) {
-                            descriptor.mIsActive = updateActiveDevices(groupId,
-                                                ACTIVE_CONTEXTS_NONE,
-                                                descriptor.mActiveContexts, true);
-                            notifyGroupStatus = descriptor.mIsActive;
-                        }
-                    } else {
-                        Log.e(TAG, "no descriptors for group: " + groupId);
-                    }
+                    handleGroupTransitToActive(groupId);
                     break;
                 }
                 case LeAudioStackEvent.GROUP_STATUS_INACTIVE: {
-                    LeAudioGroupDescriptor descriptor = getGroupDescriptor(groupId);
-                    if (descriptor != null) {
-                        if (descriptor.mIsActive) {
-                            descriptor.mIsActive = false;
-                            updateActiveDevices(groupId, descriptor.mActiveContexts,
-                                    ACTIVE_CONTEXTS_NONE, descriptor.mIsActive);
-                            notifyGroupStatus = true;
-                            /* Clear lost devices */
-                            if (DBG) Log.d(TAG, "Clear for group: " + groupId);
-                            clearLostDevicesWhileStreaming(descriptor);
-                        }
-                    } else {
-                        Log.e(TAG, "no descriptors for group: " + groupId);
-                    }
+                    handleGroupTransitToInactive(groupId);
+                    break;
+                }
+                case LeAudioStackEvent.GROUP_STATUS_TURNED_IDLE_DURING_CALL: {
+                    handleGroupIdleDuringCall();
                     break;
                 }
                 default:
                     break;
             }
-
-            if (notifyGroupStatus) {
-                notifyGroupStatusChanged(groupId, groupStatus);
-            }
-
         } else if (stackEvent.type == LeAudioStackEvent.EVENT_TYPE_BROADCAST_CREATED) {
             int broadcastId = stackEvent.valueInt1;
             boolean success = stackEvent.valueBool1;
@@ -1409,10 +1681,6 @@
                 setCcidInformation(userUuid, ccidInformation.first, ccidInformation.second);
             }
         }
-
-        if (intent != null) {
-            sendBroadcast(intent, BLUETOOTH_CONNECT);
-        }
     }
 
     private LeAudioStateMachine getOrCreateStateMachine(BluetoothDevice device) {
@@ -1420,25 +1688,26 @@
             Log.e(TAG, "getOrCreateStateMachine failed: device cannot be null");
             return null;
         }
-        synchronized (mStateMachines) {
-            LeAudioStateMachine sm = mStateMachines.get(device);
-            if (sm != null) {
-                return sm;
-            }
-            // Limit the maximum number of state machines to avoid DoS attack
-            if (mStateMachines.size() >= MAX_LE_AUDIO_STATE_MACHINES) {
-                Log.e(TAG, "Maximum number of LeAudio state machines reached: "
-                        + MAX_LE_AUDIO_STATE_MACHINES);
-                return null;
-            }
-            if (DBG) {
-                Log.d(TAG, "Creating a new state machine for " + device);
-            }
-            sm = LeAudioStateMachine.make(device, this,
-                    mLeAudioNativeInterface, mStateMachinesThread.getLooper());
-            mStateMachines.put(device, sm);
+
+        LeAudioDeviceDescriptor descriptor = getDeviceDescriptor(device);
+        if (descriptor == null) {
+            Log.e(TAG, "getOrCreateStateMachine: No valid descriptor for device: " + device);
+            return null;
+        }
+
+        LeAudioStateMachine sm = descriptor.mStateMachine;
+        if (sm != null) {
             return sm;
         }
+
+        if (DBG) {
+            Log.d(TAG, "Creating a new state machine for " + device);
+        }
+
+        sm = LeAudioStateMachine.make(device, this,
+                mLeAudioNativeInterface, mStateMachinesThread.getLooper());
+        descriptor.mStateMachine = sm;
+        return sm;
     }
 
     // Remove state machine if the bonding for a device is removed
@@ -1449,7 +1718,7 @@
                 return;
             }
             int state = intent.getIntExtra(BluetoothDevice.EXTRA_BOND_STATE,
-                                           BluetoothDevice.ERROR);
+                    BluetoothDevice.ERROR);
             BluetoothDevice device = intent.getParcelableExtra(BluetoothDevice.EXTRA_DEVICE);
             Objects.requireNonNull(device, "ACTION_BOND_STATE_CHANGED with no EXTRA_DEVICE");
             bondStateChanged(device, state);
@@ -1475,29 +1744,45 @@
             return;
         }
 
-        int groupId = getGroupId(device);
-        if (groupId != LE_AUDIO_GROUP_ID_INVALID) {
-            /* In case device is still in the group, let's remove it */
-            mLeAudioNativeInterface.groupRemoveNode(groupId, device);
-        }
+        synchronized (mGroupLock) {
+            LeAudioDeviceDescriptor descriptor = getDeviceDescriptor(device);
+            if (descriptor == null) {
+                Log.e(TAG, "bondStateChanged: No valid descriptor for device: " + device);
+                return;
+            }
 
-        mDeviceGroupIdMap.remove(device);
-        mDeviceAudioLocationMap.remove(device);
-        synchronized (mStateMachines) {
-            LeAudioStateMachine sm = mStateMachines.get(device);
+            if (descriptor.mGroupId != LE_AUDIO_GROUP_ID_INVALID) {
+                /* In case device is still in the group, let's remove it */
+                mLeAudioNativeInterface.groupRemoveNode(descriptor.mGroupId, device);
+            }
+
+            descriptor.mGroupId = LE_AUDIO_GROUP_ID_INVALID;
+            descriptor.mSinkAudioLocation = BluetoothLeAudio.AUDIO_LOCATION_INVALID;
+            descriptor.mDirection = AUDIO_DIRECTION_NONE;
+
+            LeAudioStateMachine sm = descriptor.mStateMachine;
             if (sm == null) {
                 return;
             }
             if (sm.getConnectionState() != BluetoothProfile.STATE_DISCONNECTED) {
+                Log.w(TAG, "Device is not disconnected yet.");
+                disconnect(device);
                 return;
             }
             removeStateMachine(device);
+            mDeviceDescriptors.remove(device);
         }
     }
 
     private void removeStateMachine(BluetoothDevice device) {
-        synchronized (mStateMachines) {
-            LeAudioStateMachine sm = mStateMachines.get(device);
+        synchronized (mGroupLock) {
+            LeAudioDeviceDescriptor descriptor = getDeviceDescriptor(device);
+            if (descriptor == null) {
+                Log.e(TAG, "removeStateMachine: No valid descriptor for device: " + device);
+                return;
+            }
+
+            LeAudioStateMachine sm = descriptor.mStateMachine;
             if (sm == null) {
                 Log.w(TAG, "removeStateMachine: device " + device
                         + " does not have a state machine");
@@ -1506,11 +1791,12 @@
             Log.i(TAG, "removeStateMachine: removing state machine for device: " + device);
             sm.doQuit();
             sm.cleanup();
-            mStateMachines.remove(device);
+            descriptor.mStateMachine = null;
         }
     }
 
-    private List<BluetoothDevice> getConnectedPeerDevices(int groupId) {
+    @VisibleForTesting
+    List<BluetoothDevice> getConnectedPeerDevices(int groupId) {
         List<BluetoothDevice> result = new ArrayList<>();
         for (BluetoothDevice peerDevice : getConnectedDevices()) {
             if (getGroupId(peerDevice) == groupId) {
@@ -1521,37 +1807,33 @@
     }
 
     @VisibleForTesting
-    synchronized void connectionStateChanged(BluetoothDevice device, int fromState,
-                                                     int toState) {
+    synchronized void connectionStateChanged(BluetoothDevice device, int fromState, int toState) {
         if ((device == null) || (fromState == toState)) {
             Log.e(TAG, "connectionStateChanged: unexpected invocation. device=" + device
                     + " fromState=" + fromState + " toState=" + toState);
             return;
         }
+
+        LeAudioDeviceDescriptor deviceDescriptor = getDeviceDescriptor(device);
+        if (deviceDescriptor == null) {
+            Log.e(TAG, "connectionStateChanged: No valid descriptor for device: " + device);
+            return;
+        }
+
         if (toState == BluetoothProfile.STATE_CONNECTED) {
-            int myGroupId = getGroupId(device);
-            if (myGroupId == LE_AUDIO_GROUP_ID_INVALID
-                    || getConnectedPeerDevices(myGroupId).size() == 1) {
+            if (deviceDescriptor.mGroupId == LE_AUDIO_GROUP_ID_INVALID
+                    || getConnectedPeerDevices(deviceDescriptor.mGroupId).size() == 1) {
                 // Log LE Audio connection event if we are the first device in a set
                 // Or when the GroupId has not been found
                 // MetricsLogger.logProfileConnectionEvent(
                 //         BluetoothMetricsProto.ProfileId.LE_AUDIO);
             }
 
-            LeAudioGroupDescriptor descriptor = getGroupDescriptor(myGroupId);
+            LeAudioGroupDescriptor descriptor = getGroupDescriptor(deviceDescriptor.mGroupId);
             if (descriptor != null) {
                 descriptor.mIsConnected = true;
-                /* HearingAid activates device after connection
-                 * A2dp makes active device via activedevicemanager - connection intent
-                 */
-                setActiveDevice(device);
             } else {
-                Log.e(TAG, "no descriptors for group: " + myGroupId);
-            }
-
-            McpService mcpService = mServiceFactory.getMcpService();
-            if (mcpService != null) {
-                mcpService.setDeviceAuthorized(device, true);
+                Log.e(TAG, "no descriptors for group: " + deviceDescriptor.mGroupId);
             }
         }
         // Check if the device is disconnected - if unbond, remove the state machine
@@ -1564,47 +1846,41 @@
                 removeStateMachine(device);
             }
 
-            McpService mcpService = mServiceFactory.getMcpService();
-            if (mcpService != null) {
-                mcpService.setDeviceAuthorized(device, false);
-            }
-
-            int myGroupId = getGroupId(device);
-            LeAudioGroupDescriptor descriptor = getGroupDescriptor(myGroupId);
+            LeAudioGroupDescriptor descriptor = getGroupDescriptor(deviceDescriptor.mGroupId);
             if (descriptor == null) {
-                Log.e(TAG, "no descriptors for group: " + myGroupId);
+                Log.e(TAG, "no descriptors for group: " + deviceDescriptor.mGroupId);
                 return;
             }
 
-            List<BluetoothDevice> connectedDevices = getConnectedPeerDevices(myGroupId);
+            List<BluetoothDevice> connectedDevices =
+                    getConnectedPeerDevices(deviceDescriptor.mGroupId);
             /* Let's check if the last connected device is really connected */
-            if (connectedDevices.size() == 1
-                    && Objects.equals(connectedDevices.get(0),
-                            descriptor.mLostLeadDeviceWhileStreaming)) {
+            if (connectedDevices.size() == 1 && Objects.equals(
+                    connectedDevices.get(0), descriptor.mLostLeadDeviceWhileStreaming)) {
                 clearLostDevicesWhileStreaming(descriptor);
                 return;
             }
 
-            if (getConnectedPeerDevices(myGroupId).isEmpty()){
+            if (getConnectedPeerDevices(deviceDescriptor.mGroupId).isEmpty()) {
                 descriptor.mIsConnected = false;
                 if (descriptor.mIsActive) {
                     /* Notify Native layer */
                     setActiveDevice(null);
                     descriptor.mIsActive = false;
                     /* Update audio framework */
-                    updateActiveDevices(myGroupId,
-                                    descriptor.mActiveContexts,
-                                    descriptor.mActiveContexts,
-                                    descriptor.mIsActive);
+                    updateActiveDevices(deviceDescriptor.mGroupId,
+                            descriptor.mDirection,
+                            descriptor.mDirection,
+                            descriptor.mIsActive);
                     return;
                 }
             }
 
             if (descriptor.mIsActive) {
-                updateActiveDevices(myGroupId,
-                                    descriptor.mActiveContexts,
-                                    descriptor.mActiveContexts,
-                                    descriptor.mIsActive);
+                updateActiveDevices(deviceDescriptor.mGroupId,
+                        descriptor.mDirection,
+                        descriptor.mDirection,
+                        descriptor.mIsActive);
             }
         }
     }
@@ -1612,7 +1888,8 @@
     private class ConnectionStateChangedReceiver extends BroadcastReceiver {
         @Override
         public void onReceive(Context context, Intent intent) {
-            if (!BluetoothLeAudio.ACTION_LE_AUDIO_CONNECTION_STATE_CHANGED.equals(intent.getAction())) {
+            if (!BluetoothLeAudio.ACTION_LE_AUDIO_CONNECTION_STATE_CHANGED
+                    .equals(intent.getAction())) {
                 return;
             }
             BluetoothDevice device = intent.getParcelableExtra(BluetoothDevice.EXTRA_DEVICE);
@@ -1622,7 +1899,8 @@
         }
     }
 
-    private synchronized boolean isSilentModeEnabled() {
+    @VisibleForTesting
+    synchronized boolean isSilentModeEnabled() {
         return mStoredRingerMode != AudioManager.RINGER_MODE_NORMAL;
     }
 
@@ -1635,6 +1913,8 @@
 
             final String action = intent.getAction();
             if (action.equals(AudioManager.RINGER_MODE_CHANGED_ACTION)) {
+                if (!Utils.isPtsTestMode()) return;
+
                 int ringerMode = intent.getIntExtra(AudioManager.EXTRA_RINGER_MODE, -1);
 
                 if (ringerMode < 0 || ringerMode == mStoredRingerMode) return;
@@ -1655,7 +1935,7 @@
         }
     }
 
-   /**
+    /**
      * Check whether can connect to a peer device.
      * The check considers a number of factors during the evaluation.
      *
@@ -1694,8 +1974,40 @@
         if (device == null) {
             return BluetoothLeAudio.AUDIO_LOCATION_INVALID;
         }
-        return mDeviceAudioLocationMap.getOrDefault(device,
-                BluetoothLeAudio.AUDIO_LOCATION_INVALID);
+
+        LeAudioDeviceDescriptor descriptor = getDeviceDescriptor(device);
+        if (descriptor == null) {
+            Log.e(TAG, "getAudioLocation: No valid descriptor for device: " + device);
+            return BluetoothLeAudio.AUDIO_LOCATION_INVALID;
+        }
+
+        return descriptor.mSinkAudioLocation;
+    }
+
+    /**
+     * Set In Call state
+     * @param inCall True if device in call (any state), false otherwise.
+     */
+    public void setInCall(boolean inCall) {
+        if (!mLeAudioNativeIsInitialized) {
+            Log.e(TAG, "Le Audio not initialized properly.");
+            return;
+        }
+        mLeAudioNativeInterface.setInCall(inCall);
+    }
+
+    /**
+     * Set Inactive by HFP during handover
+     */
+    public void setInactiveForHfpHandover(BluetoothDevice hfpHandoverDevice) {
+        if (!mLeAudioNativeIsInitialized) {
+            Log.e(TAG, "Le Audio not initialized properly.");
+            return;
+        }
+        if (getActiveGroupId() != LE_AUDIO_GROUP_ID_INVALID) {
+            mHfpHandoverDevice = hfpHandoverDevice;
+            setActiveDevice(null);
+        }
     }
 
     /**
@@ -1722,7 +2034,7 @@
         }
 
         if (!mDatabaseManager.setProfileConnectionPolicy(device, BluetoothProfile.LE_AUDIO,
-                  connectionPolicy)) {
+                connectionPolicy)) {
             return false;
         }
         if (connectionPolicy == BluetoothProfile.CONNECTION_POLICY_ALLOWED) {
@@ -1760,8 +2072,15 @@
         if (device == null) {
             return LE_AUDIO_GROUP_ID_INVALID;
         }
+
         synchronized (mGroupLock) {
-            return mDeviceGroupIdMap.getOrDefault(device, LE_AUDIO_GROUP_ID_INVALID);
+            LeAudioDeviceDescriptor descriptor = getDeviceDescriptor(device);
+            if (descriptor == null) {
+                Log.e(TAG, "getGroupId: No valid descriptor for device: " + device);
+                return LE_AUDIO_GROUP_ID_INVALID;
+            }
+
+            return descriptor.mGroupId;
         }
     }
 
@@ -1807,24 +2126,113 @@
         }
     }
 
+    McpService getMcpService() {
+        if (mMcpService != null) {
+            return mMcpService;
+        }
+
+        mMcpService = mServiceFactory.getMcpService();
+        return mMcpService;
+    }
+
+    /**
+     * This function is called when the framework registers
+     * a callback with the service for this first time.
+     * This is used as an indication that Bluetooth has been enabled.
+     * 
+     * It is used to authorize all known LeAudio devices in the services
+     * which requires that e.g. GMCS
+     */
+    @VisibleForTesting
+    void handleBluetoothEnabled() {
+        if (DBG) {
+            Log.d(TAG, "handleBluetoothEnabled ");
+        }
+
+        mBluetoothEnabled = true;
+
+        synchronized (mGroupLock) {
+            if (mDeviceDescriptors.isEmpty()) {
+                return;
+            }
+        }
+
+        McpService mcpService = getMcpService();
+        if (mcpService == null) {
+            Log.e(TAG, "mcpService not available ");
+            return;
+        }
+
+        synchronized (mGroupLock) {
+            for (Map.Entry<BluetoothDevice, LeAudioDeviceDescriptor> entry
+                    : mDeviceDescriptors.entrySet()) {
+                if (entry.getValue().mGroupId == LE_AUDIO_GROUP_ID_INVALID) {
+                    continue;
+                }
+
+                mcpService.setDeviceAuthorized(entry.getKey(), true);
+            }
+        }
+    }
+
     private LeAudioGroupDescriptor getGroupDescriptor(int groupId) {
         synchronized (mGroupLock) {
             return mGroupDescriptors.get(groupId);
         }
     }
 
+    private LeAudioDeviceDescriptor getDeviceDescriptor(BluetoothDevice device) {
+        synchronized (mGroupLock) {
+            return mDeviceDescriptors.get(device);
+        }
+    }
+
     private void handleGroupNodeAdded(BluetoothDevice device, int groupId) {
         synchronized (mGroupLock) {
-            mDeviceGroupIdMap.put(device, groupId);
+            if (DBG) {
+                Log.d(TAG, "Device " + device + " added to group " + groupId);
+            }
+
+            LeAudioDeviceDescriptor deviceDescriptor = getDeviceDescriptor(device);
+            if (deviceDescriptor == null) {
+                deviceDescriptor = createDeviceDescriptor(device);
+                if (deviceDescriptor == null) {
+                    Log.e(TAG, "handleGroupNodeAdded: Can't create descriptor for added from"
+                            + " storage device: " + device);
+                    return;
+                }
+
+                LeAudioStateMachine sm = getOrCreateStateMachine(device);
+                if (getOrCreateStateMachine(device) == null) {
+                    Log.e(TAG, "Can't get state machine for device: " + device);
+                    return;
+                }
+            }
+            deviceDescriptor.mGroupId = groupId;
+
             LeAudioGroupDescriptor descriptor = mGroupDescriptors.get(groupId);
             if (descriptor == null) {
                 mGroupDescriptors.put(groupId, new LeAudioGroupDescriptor());
             }
             notifyGroupNodeAdded(device, groupId);
         }
+
+        if (mBluetoothEnabled) {
+            McpService mcpService = getMcpService();
+            if (mcpService != null) {
+                mcpService.setDeviceAuthorized(device, true);
+            }
+        }
     }
 
     private void notifyGroupNodeAdded(BluetoothDevice device, int groupId) {
+        if (mVolumeControlService == null) {
+            mVolumeControlService = mServiceFactory.getVolumeControlService();
+        }
+        if (mVolumeControlService != null) {
+            mVolumeControlService.handleGroupNodeAdded(groupId, device);
+        }
+
         if (mLeAudioCallbacks != null) {
             int n = mLeAudioCallbacks.beginBroadcast();
             for (int i = 0; i < n; i++) {
@@ -1839,13 +2247,52 @@
     }
 
     private void handleGroupNodeRemoved(BluetoothDevice device, int groupId) {
+        if (DBG) {
+            Log.d(TAG, "Removing device " + device + " grom group " + groupId);
+        }
+
         synchronized (mGroupLock) {
-            mDeviceGroupIdMap.remove(device);
-            if (!mDeviceGroupIdMap.containsValue(groupId)) {
+            LeAudioGroupDescriptor groupDescriptor = getGroupDescriptor(groupId);
+            if (DBG) {
+                Log.d(TAG, "Lost lead device is " + groupDescriptor.mLostLeadDeviceWhileStreaming);
+            }
+            if (Objects.equals(device, groupDescriptor.mLostLeadDeviceWhileStreaming)) {
+                clearLostDevicesWhileStreaming(groupDescriptor);
+            }
+
+            LeAudioDeviceDescriptor deviceDescriptor = getDeviceDescriptor(device);
+            if (deviceDescriptor == null) {
+                Log.e(TAG, "handleGroupNodeRemoved: No valid descriptor for device: " + device);
+                return;
+            }
+            deviceDescriptor.mGroupId = LE_AUDIO_GROUP_ID_INVALID;
+
+            boolean isGroupEmpty = true;
+
+            for (LeAudioDeviceDescriptor descriptor : mDeviceDescriptors.values()) {
+                if (descriptor.mGroupId == groupId) {
+                    isGroupEmpty = false;
+                    break;
+                }
+            }
+
+            if (isGroupEmpty) {
+                /* Device is currently an active device. Group needs to be inactivated before
+                 * removing
+                 */
+                if (Objects.equals(device, mActiveAudioOutDevice)
+                        || Objects.equals(device, mActiveAudioInDevice)) {
+                    handleGroupTransitToInactive(groupId);
+                }
                 mGroupDescriptors.remove(groupId);
             }
             notifyGroupNodeRemoved(device, groupId);
         }
+
+        McpService mcpService = getMcpService();
+        if (mcpService != null) {
+            mcpService.setDeviceAuthorized(device, false);
+        }
     }
 
     private void notifyGroupNodeRemoved(BluetoothDevice device, int groupId) {
@@ -1876,8 +2323,7 @@
         }
     }
 
-    private void notifyUnicastCodecConfigChanged(int groupId,
-                                                 BluetoothLeAudioCodecStatus status) {
+    private void notifyUnicastCodecConfigChanged(int groupId, BluetoothLeAudioCodecStatus status) {
         if (mLeAudioCallbacks != null) {
             int n = mLeAudioCallbacks.beginBroadcast();
             for (int i = 0; i < n; i++) {
@@ -2047,8 +2493,8 @@
      * @hide
      */
     public void setCodecConfigPreference(int groupId,
-                                         BluetoothLeAudioCodecConfig inputCodecConfig,
-                                         BluetoothLeAudioCodecConfig outputCodecConfig) {
+            BluetoothLeAudioCodecConfig inputCodecConfig,
+            BluetoothLeAudioCodecConfig outputCodecConfig) {
         if (DBG) {
             Log.d(TAG, "setCodecConfigPreference(" + groupId + "): "
                     + Objects.toString(inputCodecConfig)
@@ -2084,8 +2530,8 @@
             return;
         }
 
-        mLeAudioNativeInterface.setCodecConfigPreference(groupId,
-                                inputCodecConfig, outputCodecConfig);
+        mLeAudioNativeInterface.setCodecConfigPreference(
+                groupId, inputCodecConfig, outputCodecConfig);
     }
 
     /**
@@ -2098,8 +2544,11 @@
 
         @RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)
         private LeAudioService getService(AttributionSource source) {
-            if (!Utils.checkCallerIsSystemOrActiveUser(TAG)
-                    || !Utils.checkServiceAvailable(mService, TAG)
+            if (Utils.isInstrumentationTestMode()) {
+                return mService;
+            }
+            if (!Utils.checkServiceAvailable(mService, TAG)
+                    || !Utils.checkCallerIsSystemOrActiveOrManagedUser(mService, TAG)
                     || !Utils.checkConnectPermissionForDataDelivery(mService, source, TAG)) {
                 return null;
             }
@@ -2124,11 +2573,11 @@
                 Objects.requireNonNull(receiver, "receiver cannot be null");
 
                 LeAudioService service = getService(source);
-                boolean defaultValue = false;
+                boolean result = false;
                 if (service != null) {
-                    defaultValue = service.connect(device);
+                    result = service.connect(device);
                 }
-                receiver.send(defaultValue);
+                receiver.send(result);
             } catch (RuntimeException e) {
                 receiver.propagateException(e);
             }
@@ -2143,11 +2592,11 @@
                 Objects.requireNonNull(receiver, "receiver cannot be null");
 
                 LeAudioService service = getService(source);
-                boolean defaultValue = false;
+                boolean result = false;
                 if (service != null) {
-                    defaultValue = service.disconnect(device);
+                    result = service.disconnect(device);
                 }
-                receiver.send(defaultValue);
+                receiver.send(result);
             } catch (RuntimeException e) {
                 receiver.propagateException(e);
             }
@@ -2161,11 +2610,11 @@
                 Objects.requireNonNull(receiver, "receiver cannot be null");
 
                 LeAudioService service = getService(source);
-                List<BluetoothDevice> defaultValue = new ArrayList<>(0);
+                List<BluetoothDevice> result = new ArrayList<>(0);
                 if (service != null) {
-                    defaultValue = service.getConnectedDevices();
+                    result = service.getConnectedDevices();
                 }
-                receiver.send(defaultValue);
+                receiver.send(result);
             } catch (RuntimeException e) {
                 receiver.propagateException(e);
             }
@@ -2179,11 +2628,11 @@
                 Objects.requireNonNull(receiver, "receiver cannot be null");
 
                 LeAudioService service = getService(source);
-                BluetoothDevice defaultValue = null;
+                BluetoothDevice result = null;
                 if (service != null) {
-                    defaultValue = service.getConnectedGroupLeadDevice(groupId);
+                    result = service.getConnectedGroupLeadDevice(groupId);
                 }
-                receiver.send(defaultValue);
+                receiver.send(result);
             } catch (RuntimeException e) {
                 receiver.propagateException(e);
             }
@@ -2197,11 +2646,11 @@
                 Objects.requireNonNull(receiver, "receiver cannot be null");
 
                 LeAudioService service = getService(source);
-                List<BluetoothDevice> defaultValue = new ArrayList<>(0);
+                List<BluetoothDevice> result = new ArrayList<>(0);
                 if (service != null) {
-                    defaultValue = service.getDevicesMatchingConnectionStates(states);
+                    result = service.getDevicesMatchingConnectionStates(states);
                 }
-                receiver.send(defaultValue);
+                receiver.send(result);
             } catch (RuntimeException e) {
                 receiver.propagateException(e);
             }
@@ -2216,11 +2665,11 @@
                 Objects.requireNonNull(receiver, "receiver cannot be null");
 
                 LeAudioService service = getService(source);
-                int defaultValue = BluetoothProfile.STATE_DISCONNECTED;
+                int result = BluetoothProfile.STATE_DISCONNECTED;
                 if (service != null) {
-                    defaultValue = service.getConnectionState(device);
+                    result = service.getConnectionState(device);
                 }
-                receiver.send(defaultValue);
+                receiver.send(result);
             } catch (RuntimeException e) {
                 receiver.propagateException(e);
             }
@@ -2235,11 +2684,11 @@
                 Objects.requireNonNull(receiver, "receiver cannot be null");
 
                 LeAudioService service = getService(source);
-                boolean defaultValue = false;
+                boolean result = false;
                 if (service != null) {
-                    defaultValue = service.setActiveDevice(device);
+                    result = service.setActiveDevice(device);
                 }
-                receiver.send(defaultValue);
+                receiver.send(result);
             } catch (RuntimeException e) {
                 receiver.propagateException(e);
             }
@@ -2252,11 +2701,11 @@
                 Objects.requireNonNull(receiver, "receiver cannot be null");
 
                 LeAudioService service = getService(source);
-                List<BluetoothDevice> defaultValue = new ArrayList<>();
+                List<BluetoothDevice> result = new ArrayList<>();
                 if (service != null) {
-                    defaultValue = service.getActiveDevices();
+                    result = service.getActiveDevices();
                 }
-                receiver.send(defaultValue);
+                receiver.send(result);
             } catch (RuntimeException e) {
                 receiver.propagateException(e);
             }
@@ -2271,11 +2720,12 @@
                 Objects.requireNonNull(receiver, "receiver cannot be null");
 
                 LeAudioService service = getService(source);
-                int defaultValue = BluetoothLeAudio.AUDIO_LOCATION_INVALID;
+                int result = BluetoothLeAudio.AUDIO_LOCATION_INVALID;
                 if (service != null) {
-                    defaultValue = service.getAudioLocation(device);
+                    enforceBluetoothPrivilegedPermission(service);
+                    result = service.getAudioLocation(device);
                 }
-                receiver.send(defaultValue);
+                receiver.send(result);
             } catch (RuntimeException e) {
                 receiver.propagateException(e);
             }
@@ -2290,11 +2740,12 @@
 
             try {
                 LeAudioService service = getService(source);
-                boolean defaultValue = false;
+                boolean result = false;
                 if (service != null) {
-                    defaultValue = service.setConnectionPolicy(device, connectionPolicy);
+                    enforceBluetoothPrivilegedPermission(service);
+                    result = service.setConnectionPolicy(device, connectionPolicy);
                 }
-                receiver.send(defaultValue);
+                receiver.send(result);
             } catch (RuntimeException e) {
                 receiver.propagateException(e);
             }
@@ -2309,13 +2760,13 @@
                 Objects.requireNonNull(receiver, "receiver cannot be null");
 
                 LeAudioService service = getService(source);
-                int defaultValue = BluetoothProfile.CONNECTION_POLICY_UNKNOWN;
+                int result = BluetoothProfile.CONNECTION_POLICY_UNKNOWN;
                 if (service == null) {
                     throw new IllegalStateException("service is null");
                 }
                 enforceBluetoothPrivilegedPermission(service);
-                defaultValue = service.getConnectionPolicy(device);
-                receiver.send(defaultValue);
+                result = service.getConnectionPolicy(device);
+                receiver.send(result);
             } catch (RuntimeException e) {
                 receiver.propagateException(e);
             }
@@ -2351,13 +2802,12 @@
                 Objects.requireNonNull(receiver, "receiver cannot be null");
 
                 LeAudioService service = getService(source);
-                int defaultValue = LE_AUDIO_GROUP_ID_INVALID;
+                int result = LE_AUDIO_GROUP_ID_INVALID;
                 if (service == null) {
                     throw new IllegalStateException("service is null");
                 }
-                enforceBluetoothPrivilegedPermission(service);
-                defaultValue = service.getGroupId(device);
-                receiver.send(defaultValue);
+                result = service.getGroupId(device);
+                receiver.send(result);
             } catch (RuntimeException e) {
                 receiver.propagateException(e);
             }
@@ -2372,13 +2822,52 @@
                 Objects.requireNonNull(receiver, "receiver cannot be null");
 
                 LeAudioService service = getService(source);
-                boolean defaultValue = false;
+                boolean result = false;
                 if (service == null) {
                     throw new IllegalStateException("service is null");
                 }
                 enforceBluetoothPrivilegedPermission(service);
-                defaultValue = service.groupAddNode(group_id, device);
-                receiver.send(defaultValue);
+                result = service.groupAddNode(group_id, device);
+                receiver.send(result);
+            } catch (RuntimeException e) {
+                receiver.propagateException(e);
+            }
+        }
+
+        @Override
+        public void setInCall(boolean inCall, AttributionSource source,
+                SynchronousResultReceiver receiver) {
+            try {
+                Objects.requireNonNull(source, "source cannot be null");
+                Objects.requireNonNull(receiver, "receiver cannot be null");
+
+                LeAudioService service = getService(source);
+                if (service == null) {
+                    throw new IllegalStateException("service is null");
+                }
+                enforceBluetoothPrivilegedPermission(service);
+                service.setInCall(inCall);
+                receiver.send(null);
+            } catch (RuntimeException e) {
+                receiver.propagateException(e);
+            }
+        }
+
+        @Override
+        public void setInactiveForHfpHandover(BluetoothDevice hfpHandoverDevice,
+                AttributionSource source,
+                SynchronousResultReceiver receiver) {
+            try {
+                Objects.requireNonNull(source, "source cannot be null");
+                Objects.requireNonNull(receiver, "receiver cannot be null");
+
+                LeAudioService service = getService(source);
+                if (service == null) {
+                    throw new IllegalStateException("service is null");
+                }
+                enforceBluetoothPrivilegedPermission(service);
+                service.setInactiveForHfpHandover(hfpHandoverDevice);
+                receiver.send(null);
             } catch (RuntimeException e) {
                 receiver.propagateException(e);
             }
@@ -2393,13 +2882,13 @@
                 Objects.requireNonNull(receiver, "receiver cannot be null");
 
                 LeAudioService service = getService(source);
-                boolean defaultValue = false;
+                boolean result = false;
                 if (service == null) {
                     throw new IllegalStateException("service is null");
                 }
                 enforceBluetoothPrivilegedPermission(service);
-                defaultValue = service.groupRemoveNode(groupId, device);
-                receiver.send(defaultValue);
+                result = service.groupRemoveNode(groupId, device);
+                receiver.send(result);
             } catch (RuntimeException e) {
                 receiver.propagateException(e);
             }
@@ -2439,6 +2928,9 @@
 
                 enforceBluetoothPrivilegedPermission(service);
                 service.mLeAudioCallbacks.register(callback);
+                if (!service.mBluetoothEnabled) {
+                    service.handleBluetoothEnabled();
+                }
                 receiver.send(null);
             } catch (RuntimeException e) {
                 receiver.propagateException(e);
@@ -2515,6 +3007,7 @@
                 byte[] broadcastCode, AttributionSource source) {
             LeAudioService service = getService(source);
             if (service != null) {
+                enforceBluetoothPrivilegedPermission(service);
                 service.createBroadcast(contentMetadata, broadcastCode);
             }
         }
@@ -2523,6 +3016,7 @@
         public void stopBroadcast(int broadcastId, AttributionSource source) {
             LeAudioService service = getService(source);
             if (service != null) {
+                enforceBluetoothPrivilegedPermission(service);
                 service.stopBroadcast(broadcastId);
             }
         }
@@ -2532,6 +3026,7 @@
                 BluetoothLeAudioContentMetadata contentMetadata, AttributionSource source) {
             LeAudioService service = getService(source);
             if (service != null) {
+                enforceBluetoothPrivilegedPermission(service);
                 service.updateBroadcast(broadcastId, contentMetadata);
             }
         }
@@ -2540,12 +3035,13 @@
         public void isPlaying(int broadcastId, AttributionSource source,
                 SynchronousResultReceiver receiver) {
             try {
-                boolean defaultValue = false;
+                boolean result = false;
                 LeAudioService service = getService(source);
                 if (service != null) {
-                    defaultValue = service.isPlaying(broadcastId);
+                    enforceBluetoothPrivilegedPermission(service);
+                    result = service.isPlaying(broadcastId);
                 }
-                receiver.send(defaultValue);
+                receiver.send(result);
             } catch (RuntimeException e) {
                 receiver.propagateException(e);
             }
@@ -2555,12 +3051,13 @@
         public void getAllBroadcastMetadata(AttributionSource source,
                 SynchronousResultReceiver receiver) {
             try {
-                List<BluetoothLeBroadcastMetadata> defaultValue = new ArrayList<>();
+                List<BluetoothLeBroadcastMetadata> result = new ArrayList<>();
                 LeAudioService service = getService(source);
                 if (service != null) {
-                    defaultValue = service.getAllBroadcastMetadata();
+                    enforceBluetoothPrivilegedPermission(service);
+                    result = service.getAllBroadcastMetadata();
                 }
-                receiver.send(defaultValue);
+                receiver.send(result);
             } catch (RuntimeException e) {
                 receiver.propagateException(e);
             }
@@ -2570,12 +3067,13 @@
         public void getMaximumNumberOfBroadcasts(AttributionSource source,
                 SynchronousResultReceiver receiver) {
             try {
-                int defaultValue = 0;
+                int result = 0;
                 LeAudioService service = getService(source);
                 if (service != null) {
-                    defaultValue = service.getMaximumNumberOfBroadcasts();
+                    enforceBluetoothPrivilegedPermission(service);
+                    result = service.getMaximumNumberOfBroadcasts();
                 }
-                receiver.send(defaultValue);
+                receiver.send(result);
             } catch (RuntimeException e) {
                 receiver.propagateException(e);
             }
@@ -2615,14 +3113,21 @@
     @Override
     public void dump(StringBuilder sb) {
         super.dump(sb);
-        ProfileService.println(sb, "State machines: ");
-        for (LeAudioStateMachine sm : mStateMachines.values()) {
-            sm.dump(sb);
-        }
         ProfileService.println(sb, "Active Groups information: ");
         ProfileService.println(sb, "  currentlyActiveGroupId: " + getActiveGroupId());
         ProfileService.println(sb, "  mActiveAudioOutDevice: " + mActiveAudioOutDevice);
         ProfileService.println(sb, "  mActiveAudioInDevice: " + mActiveAudioInDevice);
+        ProfileService.println(sb, "  mHfpHandoverDevice:" + mHfpHandoverDevice);
+
+        for (Map.Entry<BluetoothDevice, LeAudioDeviceDescriptor> entry
+                : mDeviceDescriptors.entrySet()) {
+            LeAudioDeviceDescriptor descriptor = entry.getValue();
+
+            descriptor.mStateMachine.dump(sb);
+            ProfileService.println(sb, "    mGroupId: " + descriptor.mGroupId);
+            ProfileService.println(sb, "    mSinkAudioLocation: " + descriptor.mSinkAudioLocation);
+            ProfileService.println(sb, "    mDirection: " + descriptor.mDirection);
+        }
 
         for (Map.Entry<Integer, LeAudioGroupDescriptor> entry : mGroupDescriptors.entrySet()) {
             LeAudioGroupDescriptor descriptor = entry.getValue();
@@ -2630,7 +3135,7 @@
             ProfileService.println(sb, "  Group: " + groupId);
             ProfileService.println(sb, "    isActive: " + descriptor.mIsActive);
             ProfileService.println(sb, "    isConnected: " + descriptor.mIsConnected);
-            ProfileService.println(sb, "    mActiveContexts: " + descriptor.mActiveContexts);
+            ProfileService.println(sb, "    mDirection: " + descriptor.mDirection);
             ProfileService.println(sb, "    group lead: " + getConnectedGroupLeadDevice(groupId));
             ProfileService.println(sb, "    first device: " + getFirstDeviceFromGroup(groupId));
             ProfileService.println(sb, "    lost lead device: "
diff --git a/android/app/src/com/android/bluetooth/le_audio/LeAudioStackEvent.java b/android/app/src/com/android/bluetooth/le_audio/LeAudioStackEvent.java
index 6ec7483..3824dfe 100644
--- a/android/app/src/com/android/bluetooth/le_audio/LeAudioStackEvent.java
+++ b/android/app/src/com/android/bluetooth/le_audio/LeAudioStackEvent.java
@@ -55,6 +55,7 @@
 
     static final int GROUP_STATUS_INACTIVE = 0;
     static final int GROUP_STATUS_ACTIVE = 1;
+    static final int GROUP_STATUS_TURNED_IDLE_DURING_CALL = 2;
 
     static final int GROUP_NODE_ADDED = 1;
     static final int GROUP_NODE_REMOVED = 2;
@@ -192,6 +193,8 @@
                         return "GROUP_STATUS_ACTIVE";
                     case GROUP_STATUS_INACTIVE:
                         return "GROUP_STATUS_INACTIVE";
+                    case GROUP_STATUS_TURNED_IDLE_DURING_CALL:
+                        return "GROUP_STATUS_TURNED_IDLE_DURING_CALL";
                     default:
                         break;
                 }
diff --git a/android/app/src/com/android/bluetooth/le_audio/LeAudioStateMachine.java b/android/app/src/com/android/bluetooth/le_audio/LeAudioStateMachine.java
index a838cbb..95c4e0f 100644
--- a/android/app/src/com/android/bluetooth/le_audio/LeAudioStateMachine.java
+++ b/android/app/src/com/android/bluetooth/le_audio/LeAudioStateMachine.java
@@ -55,8 +55,6 @@
 import android.util.Log;
 import static android.Manifest.permission.BLUETOOTH_CONNECT;
 
-import android.annotation.RequiresPermission;
-
 import com.android.bluetooth.Utils;
 import com.android.bluetooth.btservice.ProfileService;
 import com.android.internal.annotations.VisibleForTesting;
diff --git a/android/app/src/com/android/bluetooth/le_audio/LeAudioTmapGattServer.java b/android/app/src/com/android/bluetooth/le_audio/LeAudioTmapGattServer.java
index 230279c..b204baa 100644
--- a/android/app/src/com/android/bluetooth/le_audio/LeAudioTmapGattServer.java
+++ b/android/app/src/com/android/bluetooth/le_audio/LeAudioTmapGattServer.java
@@ -123,7 +123,7 @@
                                                 BluetoothGattCharacteristic characteristic) {
             byte[] value = characteristic.getValue();
             if (DBG) {
-                Log.d(TAG, "value " + value);
+                Log.d(TAG, "value " + Arrays.toString(value));
             }
             if (value != null) {
                 Log.e(TAG, "value null");
diff --git a/android/app/src/com/android/bluetooth/map/BluetoothMapAccountItem.java b/android/app/src/com/android/bluetooth/map/BluetoothMapAccountItem.java
index cb9481b..f36cf3e 100644
--- a/android/app/src/com/android/bluetooth/map/BluetoothMapAccountItem.java
+++ b/android/app/src/com/android/bluetooth/map/BluetoothMapAccountItem.java
@@ -41,7 +41,7 @@
     private final String mUci;
     private final String mUciPrefix;
 
-    public BluetoothMapAccountItem(String id, String name, String packageName, String authority,
+    private BluetoothMapAccountItem(String id, String name, String packageName, String authority,
             Drawable icon, BluetoothMapUtils.TYPE appType, String uci, String uciPrefix) {
         this.mName = name;
         this.mIcon = icon;
diff --git a/android/app/src/com/android/bluetooth/map/BluetoothMapContent.java b/android/app/src/com/android/bluetooth/map/BluetoothMapContent.java
index afa59bd..1c684bf 100644
--- a/android/app/src/com/android/bluetooth/map/BluetoothMapContent.java
+++ b/android/app/src/com/android/bluetooth/map/BluetoothMapContent.java
@@ -37,12 +37,15 @@
 import android.text.util.Rfc822Tokenizer;
 import android.util.Log;
 
+import com.android.bluetooth.BluetoothMethodProxy;
 import com.android.bluetooth.DeviceWorkArounds;
 import com.android.bluetooth.SignedLongLong;
+import com.android.bluetooth.Utils;
 import com.android.bluetooth.map.BluetoothMapUtils.TYPE;
 import com.android.bluetooth.map.BluetoothMapbMessageMime.MimePart;
 import com.android.bluetooth.mapapi.BluetoothMapContract;
 import com.android.bluetooth.mapapi.BluetoothMapContract.ConversationColumns;
+import com.android.internal.annotations.VisibleForTesting;
 
 import com.google.android.mms.pdu.CharacterSets;
 import com.google.android.mms.pdu.PduHeaders;
@@ -69,16 +72,21 @@
 
     // Parameter Mask for selection of parameters to return in listings
     private static final int MASK_SUBJECT = 0x00000001;
-    private static final int MASK_DATETIME = 0x00000002;
-    private static final int MASK_SENDER_NAME = 0x00000004;
-    private static final int MASK_SENDER_ADDRESSING = 0x00000008;
+    @VisibleForTesting
+    static final int MASK_DATETIME = 0x00000002;
+    @VisibleForTesting
+    static final int MASK_SENDER_NAME = 0x00000004;
+    @VisibleForTesting
+    static final int MASK_SENDER_ADDRESSING = 0x00000008;
     private static final int MASK_RECIPIENT_NAME = 0x00000010;
-    private static final int MASK_RECIPIENT_ADDRESSING = 0x00000020;
+    @VisibleForTesting
+    static final int MASK_RECIPIENT_ADDRESSING = 0x00000020;
     private static final int MASK_TYPE = 0x00000040;
     private static final int MASK_SIZE = 0x00000080;
     private static final int MASK_RECEPTION_STATUS = 0x00000100;
     private static final int MASK_TEXT = 0x00000200;
-    private static final int MASK_ATTACHMENT_SIZE = 0x00000400;
+    @VisibleForTesting
+    static final int MASK_ATTACHMENT_SIZE = 0x00000400;
     private static final int MASK_PRIORITY = 0x00000800;
     private static final int MASK_READ = 0x00001000;
     private static final int MASK_SENT = 0x00002000;
@@ -86,7 +94,8 @@
     private static final int MASK_REPLYTO_ADDRESSING = 0x00008000;
     // TODO: Duplicate in proposed spec
     // private static final int MASK_RECEPTION_STATE       = 0x00010000;
-    private static final int MASK_DELIVERY_STATUS = 0x00010000;
+    @VisibleForTesting
+    static final int MASK_DELIVERY_STATUS = 0x00010000;
     private static final int MASK_CONVERSATION_ID = 0x00020000;
     private static final int MASK_CONVERSATION_NAME = 0x00040000;
     private static final int MASK_FOLDER_TYPE = 0x00100000;
@@ -144,14 +153,17 @@
 
     private final Context mContext;
     private final ContentResolver mResolver;
-    private final String mBaseUri;
+    @VisibleForTesting
+    final String mBaseUri;
     private final BluetoothMapAccountItem mAccount;
     /* The MasInstance reference is used to update persistent (over a connection) version counters*/
     private final BluetoothMapMasInstance mMasInstance;
-    private String mMessageVersion = BluetoothMapUtils.MAP_V10_STR;
+    @VisibleForTesting
+    String mMessageVersion = BluetoothMapUtils.MAP_V10_STR;
 
     private int mRemoteFeatureMask = BluetoothMapUtils.MAP_FEATURE_DEFAULT_BITMASK;
-    private int mMsgListingVersion = BluetoothMapUtils.MAP_MESSAGE_LISTING_FORMAT_V10;
+    @VisibleForTesting
+    int mMsgListingVersion = BluetoothMapUtils.MAP_MESSAGE_LISTING_FORMAT_V10;
 
     static final String[] SMS_PROJECTION = new String[]{
             BaseColumns._ID,
@@ -212,7 +224,8 @@
     };
 
     /* CONVO LISTING projections and column indexes */
-    private static final String[] MMS_SMS_THREAD_PROJECTION = {
+    @VisibleForTesting
+    static final String[] MMS_SMS_THREAD_PROJECTION = {
             Threads._ID,
             Threads.DATE,
             Threads.SNIPPET,
@@ -251,7 +264,8 @@
         MMS_SMS_THREAD_COL_RECIPIENT_IDS = projection.indexOf(Threads.RECIPIENT_IDS);
     }
 
-    private class FilterInfo {
+    @VisibleForTesting
+    static class FilterInfo {
         public static final int TYPE_SMS = 0;
         public static final int TYPE_MMS = 1;
         public static final int TYPE_EMAIL = 2;
@@ -588,7 +602,8 @@
      * the total message size. To provide a more accurate attachment size, one could
      * extract the length (in bytes) of the text parts.
      */
-    private void setAttachment(BluetoothMapMessageListingElement e, Cursor c, FilterInfo fi,
+    @VisibleForTesting
+    void setAttachment(BluetoothMapMessageListingElement e, Cursor c, FilterInfo fi,
             BluetoothMapAppParams ap) {
         if ((ap.getParameterMask() & MASK_ATTACHMENT_SIZE) != 0) {
             int size = 0;
@@ -683,7 +698,8 @@
         }
     }
 
-    private void setDeliveryStatus(BluetoothMapMessageListingElement e, Cursor c, FilterInfo fi,
+    @VisibleForTesting
+    void setDeliveryStatus(BluetoothMapMessageListingElement e, Cursor c, FilterInfo fi,
             BluetoothMapAppParams ap) {
         if ((ap.getParameterMask() & MASK_DELIVERY_STATUS) != 0) {
             String deliveryStatus = "delivered";
@@ -820,8 +836,8 @@
         }
     }
 
-    private String getRecipientNameEmail(BluetoothMapMessageListingElement e, Cursor c,
-            FilterInfo fi) {
+    @VisibleForTesting
+    String getRecipientNameEmail(Cursor c, FilterInfo fi) {
 
         String toAddress, ccAddress, bccAddress;
         toAddress = c.getString(fi.mMessageColToAddress);
@@ -905,8 +921,8 @@
         return sb.toString();
     }
 
-    private String getRecipientAddressingEmail(BluetoothMapMessageListingElement e, Cursor c,
-            FilterInfo fi) {
+    @VisibleForTesting
+    String getRecipientAddressingEmail(Cursor c, FilterInfo fi) {
         String toAddress, ccAddress, bccAddress;
         toAddress = c.getString(fi.mMessageColToAddress);
         ccAddress = c.getString(fi.mMessageColCcAddress);
@@ -989,7 +1005,8 @@
         return sb.toString();
     }
 
-    private void setRecipientAddressing(BluetoothMapMessageListingElement e, Cursor c,
+    @VisibleForTesting
+    void setRecipientAddressing(BluetoothMapMessageListingElement e, Cursor c,
             FilterInfo fi, BluetoothMapAppParams ap) {
         if ((ap.getParameterMask() & MASK_RECIPIENT_ADDRESSING) != 0) {
             String address = null;
@@ -1018,7 +1035,7 @@
                 address = getAddressMms(mResolver, id, MMS_TO);
             } else if (fi.mMsgType == FilterInfo.TYPE_EMAIL) {
                 /* Might be another way to handle addresses */
-                address = getRecipientAddressingEmail(e, c, fi);
+                address = getRecipientAddressingEmail(c, fi);
             }
             if (V) {
                 Log.v(TAG, "setRecipientAddressing: " + address);
@@ -1057,7 +1074,7 @@
                 }
             } else if (fi.mMsgType == FilterInfo.TYPE_EMAIL) {
                 /* Might be another way to handle address and names */
-                name = getRecipientNameEmail(e, c, fi);
+                name = getRecipientNameEmail(c, fi);
             }
             if (V) {
                 Log.v(TAG, "setRecipientName: " + name);
@@ -1069,7 +1086,8 @@
         }
     }
 
-    private void setSenderAddressing(BluetoothMapMessageListingElement e, Cursor c, FilterInfo fi,
+    @VisibleForTesting
+    void setSenderAddressing(BluetoothMapMessageListingElement e, Cursor c, FilterInfo fi,
             BluetoothMapAppParams ap) {
         if ((ap.getParameterMask() & MASK_SENDER_ADDRESSING) != 0) {
             String address = "";
@@ -1136,10 +1154,10 @@
                 // TODO: This is a BAD hack, that we map the contact ID to a conversation ID!!!
                 //       We need to reach a conclusion on what to do
                 Uri contactsUri = Uri.parse(mBaseUri + BluetoothMapContract.TABLE_CONVOCONTACT);
-                Cursor contacts =
-                        mResolver.query(contactsUri, BluetoothMapContract.BT_CONTACT_PROJECTION,
-                                BluetoothMapContract.ConvoContactColumns.CONVO_ID + " = "
-                                        + contactId, null, null);
+                Cursor contacts = BluetoothMethodProxy.getInstance().contentResolverQuery(mResolver,
+                        contactsUri, BluetoothMapContract.BT_CONTACT_PROJECTION,
+                        BluetoothMapContract.ConvoContactColumns.CONVO_ID + " = " + contactId, null,
+                        null);
                 try {
                     // TODO this will not work for group-chats
                     if (contacts != null && contacts.moveToFirst()) {
@@ -1163,7 +1181,8 @@
         }
     }
 
-    private void setSenderName(BluetoothMapMessageListingElement e, Cursor c, FilterInfo fi,
+    @VisibleForTesting
+    void setSenderName(BluetoothMapMessageListingElement e, Cursor c, FilterInfo fi,
             BluetoothMapAppParams ap) {
         if ((ap.getParameterMask() & MASK_SENDER_NAME) != 0) {
             String name = "";
@@ -1217,10 +1236,10 @@
                 // For IM we add the contact ID in the addressing
                 long contactId = c.getLong(fi.mMessageColFromAddress);
                 Uri contactsUri = Uri.parse(mBaseUri + BluetoothMapContract.TABLE_CONVOCONTACT);
-                Cursor contacts =
-                        mResolver.query(contactsUri, BluetoothMapContract.BT_CONTACT_PROJECTION,
-                                BluetoothMapContract.ConvoContactColumns.CONVO_ID + " = "
-                                        + contactId, null, null);
+                Cursor contacts = BluetoothMethodProxy.getInstance().contentResolverQuery(mResolver,
+                        contactsUri, BluetoothMapContract.BT_CONTACT_PROJECTION,
+                        BluetoothMapContract.ConvoContactColumns.CONVO_ID + " = " + contactId, null,
+                        null);
                 try {
                     // TODO this will not work for group-chats
                     if (contacts != null && contacts.moveToFirst()) {
@@ -1243,8 +1262,8 @@
         }
     }
 
-
-    private void setDateTime(BluetoothMapMessageListingElement e, Cursor c, FilterInfo fi,
+    @VisibleForTesting
+    void setDateTime(BluetoothMapMessageListingElement e, Cursor c, FilterInfo fi,
             BluetoothMapAppParams ap) {
         if ((ap.getParameterMask() & MASK_DATETIME) != 0) {
             long date = 0;
@@ -1268,9 +1287,8 @@
         }
     }
 
-
-    private void setLastActivity(BluetoothMapConvoListingElement e, Cursor c, FilterInfo fi,
-            BluetoothMapAppParams ap) {
+    @VisibleForTesting
+    void setLastActivity(BluetoothMapConvoListingElement e, Cursor c, FilterInfo fi) {
         long date = 0;
         if (fi.mMsgType == FilterInfo.TYPE_SMS || fi.mMsgType == FilterInfo.TYPE_MMS) {
             date = c.getLong(MMS_SMS_THREAD_COL_DATE);
@@ -1290,7 +1308,8 @@
         String uriStr = new String(Mms.CONTENT_URI + "/" + id + "/part");
         Uri uriAddress = Uri.parse(uriStr);
         // TODO: maybe use a projection with only "ct" and "text"
-        Cursor c = r.query(uriAddress, null, selection, null, null);
+        Cursor c = BluetoothMethodProxy.getInstance().contentResolverQuery(r, uriAddress, null,
+                selection, null, null);
         try {
             if (c != null && c.moveToFirst()) {
                 do {
@@ -1321,9 +1340,15 @@
         }
 
         // Fix Subject Display issue with HONDA Carkit - Ignore subject Mask.
-        if (DeviceWorkArounds.addressStartsWith(BluetoothMapService.getRemoteDevice().getAddress(),
-                    DeviceWorkArounds.HONDA_CARKIT)
-                || (ap.getParameterMask() & MASK_SUBJECT) != 0) {
+        boolean isHondaCarkit;
+        if (Utils.isInstrumentationTestMode()) {
+            isHondaCarkit = false;
+        } else {
+            isHondaCarkit = DeviceWorkArounds.addressStartsWith(
+                    BluetoothMapService.getRemoteDevice().getAddress(),
+                    DeviceWorkArounds.HONDA_CARKIT);
+        }
+        if (isHondaCarkit || (ap.getParameterMask() & MASK_SUBJECT) != 0) {
             if (fi.mMsgType == FilterInfo.TYPE_SMS) {
                 subject = c.getString(fi.mSmsColSubject);
             } else if (fi.mMsgType == FilterInfo.TYPE_MMS) {
@@ -1381,7 +1406,7 @@
     private BluetoothMapConvoListingElement createConvoElement(Cursor c, FilterInfo fi,
             BluetoothMapAppParams ap) {
         BluetoothMapConvoListingElement e = new BluetoothMapConvoListingElement();
-        setLastActivity(e, c, fi, ap);
+        setLastActivity(e, c, fi);
         e.setType(getType(c, fi));
 //        setConvoRead(e, c, fi, ap);
         e.setCursorIndex(c.getPosition());
@@ -1405,7 +1430,8 @@
         String orderBy = Contacts.DISPLAY_NAME + " ASC";
         Cursor c = null;
         try {
-            c = resolver.query(uri, projection, selection, null, orderBy);
+            c = BluetoothMethodProxy.getInstance().contentResolverQuery(resolver, uri, projection,
+                    selection, null, orderBy);
             if (c != null) {
                 int colIndex = c.getColumnIndex(Contacts.DISPLAY_NAME);
                 if (c.getCount() >= 1) {
@@ -1447,7 +1473,8 @@
             Log.v(TAG, "whereClause is " + whereClause);
         }
         try {
-            cr = r.query(sAllThreadsUri, RECIPIENT_ID_PROJECTION, whereClause, null, null);
+            cr = BluetoothMethodProxy.getInstance().contentResolverQuery(r, sAllThreadsUri,
+                    RECIPIENT_ID_PROJECTION, whereClause, null, null);
             if (cr != null && cr.moveToFirst()) {
                 recipientIds = cr.getString(0);
                 if (V) {
@@ -1479,7 +1506,8 @@
                 Log.v(TAG, "whereClause is " + whereClause);
             }
             try {
-                cr = r.query(sAllCanonical, null, whereClause, null, null);
+                cr = BluetoothMethodProxy.getInstance().contentResolverQuery(r, sAllCanonical, null,
+                        whereClause, null, null);
                 if (cr != null && cr.moveToFirst()) {
                     do {
                         //TODO: Multiple Recipeints are appended with ";" for now.
@@ -1511,7 +1539,8 @@
         String[] projection = {Mms.Addr.ADDRESS};
         Cursor c = null;
         try {
-            c = r.query(uriAddress, projection, selection, null, null); // TODO: Add projection
+            c = BluetoothMethodProxy.getInstance().contentResolverQuery(r, uriAddress, projection,
+                    selection, null, null); // TODO: Add projection
             int colIndex = c.getColumnIndex(Mms.Addr.ADDRESS);
             if (c != null) {
                 if (c.moveToFirst()) {
@@ -2027,8 +2056,9 @@
 
 
     /* Used only for SMS/MMS */
-    private void setConvoWhereFilterSmsMms(StringBuilder selection, ArrayList<String> selectionArgs,
-            FilterInfo fi, BluetoothMapAppParams ap) {
+    @VisibleForTesting
+    void setConvoWhereFilterSmsMms(StringBuilder selection, FilterInfo fi,
+            BluetoothMapAppParams ap) {
 
         if (smsSelected(fi, ap) || mmsSelected(ap)) {
 
@@ -2079,7 +2109,8 @@
      * @param ap
      * @return boolean true if sms is selected, false if not
      */
-    private boolean smsSelected(FilterInfo fi, BluetoothMapAppParams ap) {
+    @VisibleForTesting
+    boolean smsSelected(FilterInfo fi, BluetoothMapAppParams ap) {
         int msgType = ap.getFilterMessageType();
         int phoneType = fi.mPhoneType;
 
@@ -2116,7 +2147,8 @@
      * @param ap
      * @return boolean true if mms is selected, false if not
      */
-    private boolean mmsSelected(BluetoothMapAppParams ap) {
+    @VisibleForTesting
+    boolean mmsSelected(BluetoothMapAppParams ap) {
         int msgType = ap.getFilterMessageType();
 
         if (D) {
@@ -2184,7 +2216,8 @@
         return false;
     }
 
-    private void setFilterInfo(FilterInfo fi) {
+    @VisibleForTesting
+    void setFilterInfo(FilterInfo fi) {
         TelephonyManager tm = mContext.getSystemService(TelephonyManager.class);
         if (tm != null) {
             fi.mPhoneType = tm.getPhoneType();
@@ -2258,7 +2291,8 @@
                     if (D) {
                         Log.d(TAG, "msgType: " + fi.mMsgType + " where: " + where);
                     }
-                    smsCursor = mResolver.query(Sms.CONTENT_URI, SMS_PROJECTION, where, null,
+                    smsCursor = BluetoothMethodProxy.getInstance().contentResolverQuery(mResolver,
+                            Sms.CONTENT_URI, SMS_PROJECTION, where, null,
                             Sms.DATE + " DESC" + limit);
                     if (smsCursor != null) {
                         BluetoothMapMessageListingElement e = null;
@@ -2300,7 +2334,8 @@
                     if (D) {
                         Log.d(TAG, "msgType: " + fi.mMsgType + " where: " + where);
                     }
-                    mmsCursor = mResolver.query(Mms.CONTENT_URI, MMS_PROJECTION, where, null,
+                    mmsCursor = BluetoothMethodProxy.getInstance().contentResolverQuery(mResolver,
+                            Mms.CONTENT_URI, MMS_PROJECTION, where, null,
                             Mms.DATE + " DESC" + limit);
                     if (mmsCursor != null) {
                         BluetoothMapMessageListingElement e = null;
@@ -2343,10 +2378,9 @@
                         Log.d(TAG, "msgType: " + fi.mMsgType + " where: " + where);
                     }
                     Uri contentUri = Uri.parse(mBaseUri + BluetoothMapContract.TABLE_MESSAGE);
-                    emailCursor =
-                            mResolver.query(contentUri, BluetoothMapContract.BT_MESSAGE_PROJECTION,
-                                    where, null,
-                                    BluetoothMapContract.MessageColumns.DATE + " DESC" + limit);
+                    emailCursor = BluetoothMethodProxy.getInstance().contentResolverQuery(mResolver,
+                            contentUri, BluetoothMapContract.BT_MESSAGE_PROJECTION, where, null,
+                            BluetoothMapContract.MessageColumns.DATE + " DESC" + limit);
                     if (emailCursor != null) {
                         BluetoothMapMessageListingElement e = null;
                         // store column index so we dont have to look them up anymore (optimization)
@@ -2387,8 +2421,8 @@
                 }
 
                 Uri contentUri = Uri.parse(mBaseUri + BluetoothMapContract.TABLE_MESSAGE);
-                imCursor = mResolver.query(contentUri,
-                        BluetoothMapContract.BT_INSTANT_MESSAGE_PROJECTION, where, null,
+                imCursor = BluetoothMethodProxy.getInstance().contentResolverQuery(mResolver,
+                        contentUri, BluetoothMapContract.BT_INSTANT_MESSAGE_PROJECTION, where, null,
                         BluetoothMapContract.MessageColumns.DATE + " DESC" + limit);
                 if (imCursor != null) {
                     BluetoothMapMessageListingElement e = null;
@@ -2496,8 +2530,8 @@
         if (smsSelected(fi, ap) && folderElement.hasSmsMmsContent()) {
             fi.mMsgType = FilterInfo.TYPE_SMS;
             String where = setWhereFilter(folderElement, fi, ap);
-            Cursor c = mResolver.query(Sms.CONTENT_URI, SMS_PROJECTION, where, null,
-                    Sms.DATE + " DESC");
+            Cursor c = BluetoothMethodProxy.getInstance().contentResolverQuery(mResolver,
+                    Sms.CONTENT_URI, SMS_PROJECTION, where, null, Sms.DATE + " DESC");
             try {
                 if (c != null) {
                     cnt = c.getCount();
@@ -2512,8 +2546,8 @@
         if (mmsSelected(ap) && folderElement.hasSmsMmsContent()) {
             fi.mMsgType = FilterInfo.TYPE_MMS;
             String where = setWhereFilter(folderElement, fi, ap);
-            Cursor c = mResolver.query(Mms.CONTENT_URI, MMS_PROJECTION, where, null,
-                    Mms.DATE + " DESC");
+            Cursor c = BluetoothMethodProxy.getInstance().contentResolverQuery(mResolver,
+                    Mms.CONTENT_URI, MMS_PROJECTION, where, null, Mms.DATE + " DESC");
             try {
                 if (c != null) {
                     cnt += c.getCount();
@@ -2530,8 +2564,9 @@
             String where = setWhereFilter(folderElement, fi, ap);
             if (!where.isEmpty()) {
                 Uri contentUri = Uri.parse(mBaseUri + BluetoothMapContract.TABLE_MESSAGE);
-                Cursor c = mResolver.query(contentUri, BluetoothMapContract.BT_MESSAGE_PROJECTION,
-                        where, null, BluetoothMapContract.MessageColumns.DATE + " DESC");
+                Cursor c = BluetoothMethodProxy.getInstance().contentResolverQuery(mResolver,
+                        contentUri, BluetoothMapContract.BT_MESSAGE_PROJECTION, where, null,
+                        BluetoothMapContract.MessageColumns.DATE + " DESC");
                 try {
                     if (c != null) {
                         cnt += c.getCount();
@@ -2549,8 +2584,8 @@
             String where = setWhereFilter(folderElement, fi, ap);
             if (!where.isEmpty()) {
                 Uri contentUri = Uri.parse(mBaseUri + BluetoothMapContract.TABLE_MESSAGE);
-                Cursor c = mResolver.query(contentUri,
-                        BluetoothMapContract.BT_INSTANT_MESSAGE_PROJECTION, where, null,
+                Cursor c = BluetoothMethodProxy.getInstance().contentResolverQuery(mResolver,
+                        contentUri, BluetoothMapContract.BT_INSTANT_MESSAGE_PROJECTION, where, null,
                         BluetoothMapContract.MessageColumns.DATE + " DESC");
                 try {
                     if (c != null) {
@@ -2592,8 +2627,8 @@
             String where = setWhereFilterFolderType(folderElement, fi);
             where += " AND " + Sms.READ + "=0 ";
             where += setWhereFilterPeriod(ap, fi);
-            Cursor c = mResolver.query(Sms.CONTENT_URI, SMS_PROJECTION, where, null,
-                    Sms.DATE + " DESC");
+            Cursor c = BluetoothMethodProxy.getInstance().contentResolverQuery(mResolver,
+                    Sms.CONTENT_URI, SMS_PROJECTION, where, null, Sms.DATE + " DESC");
             try {
                 if (c != null) {
                     cnt = c.getCount();
@@ -2610,8 +2645,8 @@
             String where = setWhereFilterFolderType(folderElement, fi);
             where += " AND " + Mms.READ + "=0 ";
             where += setWhereFilterPeriod(ap, fi);
-            Cursor c = mResolver.query(Mms.CONTENT_URI, MMS_PROJECTION, where, null,
-                    Sms.DATE + " DESC");
+            Cursor c = BluetoothMethodProxy.getInstance().contentResolverQuery(mResolver,
+                    Mms.CONTENT_URI, MMS_PROJECTION, where, null, Sms.DATE + " DESC");
             try {
                 if (c != null) {
                     cnt += c.getCount();
@@ -2631,8 +2666,9 @@
                 where += " AND " + BluetoothMapContract.MessageColumns.FLAG_READ + "=0 ";
                 where += setWhereFilterPeriod(ap, fi);
                 Uri contentUri = Uri.parse(mBaseUri + BluetoothMapContract.TABLE_MESSAGE);
-                Cursor c = mResolver.query(contentUri, BluetoothMapContract.BT_MESSAGE_PROJECTION,
-                        where, null, BluetoothMapContract.MessageColumns.DATE + " DESC");
+                Cursor c = BluetoothMethodProxy.getInstance().contentResolverQuery(mResolver,
+                        contentUri, BluetoothMapContract.BT_MESSAGE_PROJECTION, where, null,
+                        BluetoothMapContract.MessageColumns.DATE + " DESC");
                 try {
                     if (c != null) {
                         cnt += c.getCount();
@@ -2652,8 +2688,8 @@
                 where += " AND " + BluetoothMapContract.MessageColumns.FLAG_READ + "=0 ";
                 where += setWhereFilterPeriod(ap, fi);
                 Uri contentUri = Uri.parse(mBaseUri + BluetoothMapContract.TABLE_MESSAGE);
-                Cursor c = mResolver.query(contentUri,
-                        BluetoothMapContract.BT_INSTANT_MESSAGE_PROJECTION, where, null,
+                Cursor c = BluetoothMethodProxy.getInstance().contentResolverQuery(mResolver,
+                        contentUri, BluetoothMapContract.BT_INSTANT_MESSAGE_PROJECTION, where, null,
                         BluetoothMapContract.MessageColumns.DATE + " DESC");
                 try {
                     if (c != null) {
@@ -2753,7 +2789,7 @@
                 StringBuilder selection = new StringBuilder(120); // This covers most cases
                 ArrayList<String> selectionArgs = new ArrayList<String>(12); // Covers all cases
                 selection.append("1=1 "); // just to simplify building the where-clause
-                setConvoWhereFilterSmsMms(selection, selectionArgs, fi, ap);
+                setConvoWhereFilterSmsMms(selection, fi, ap);
                 String[] args = null;
                 if (selectionArgs.size() > 0) {
                     args = new String[selectionArgs.size()];
@@ -2769,7 +2805,8 @@
                 }
                 // TODO: Optimize: Reduce projection based on convo parameter mask
                 smsMmsCursor =
-                        mResolver.query(uri, MMS_SMS_THREAD_PROJECTION, selection.toString(), args,
+                        BluetoothMethodProxy.getInstance().contentResolverQuery(mResolver, uri,
+                                MMS_SMS_THREAD_PROJECTION, selection.toString(), null,
                                 sortOrder.toString());
                 if (smsMmsCursor != null) {
                     // store column index so we don't have to look them up anymore (optimization)
@@ -2830,13 +2867,12 @@
                     Log.v(TAG, "URI with parameters: " + contentUri.toString());
                 }
                 // TODO: Optimize: Reduce projection based on convo parameter mask
-                imEmailCursor =
-                        mResolver.query(contentUri, BluetoothMapContract.BT_CONVERSATION_PROJECTION,
-                                null, null,
-                                BluetoothMapContract.ConversationColumns.LAST_THREAD_ACTIVITY
-                                        + " DESC, "
-                                        + BluetoothMapContract.ConversationColumns.THREAD_ID
-                                        + " ASC");
+                imEmailCursor = BluetoothMethodProxy.getInstance().contentResolverQuery(mResolver,
+                        contentUri, BluetoothMapContract.BT_CONVERSATION_PROJECTION, null, null,
+                        BluetoothMapContract.ConversationColumns.LAST_THREAD_ACTIVITY
+                                + " DESC, "
+                                + BluetoothMapContract.ConversationColumns.THREAD_ID
+                                + " ASC");
                 if (imEmailCursor != null) {
                     BluetoothMapConvoListingElement e = null;
                     // store column index so we don't have to look them up anymore (optimization)
@@ -4068,8 +4104,8 @@
 
         BluetoothMapbMessageEmail message = new BluetoothMapbMessageEmail();
         Uri contentUri = Uri.parse(mBaseUri + BluetoothMapContract.TABLE_MESSAGE);
-        Cursor c = mResolver.query(contentUri, BluetoothMapContract.BT_MESSAGE_PROJECTION,
-                "_ID = " + id, null, null);
+        Cursor c = BluetoothMethodProxy.getInstance().contentResolverQuery(mResolver, contentUri,
+                BluetoothMapContract.BT_MESSAGE_PROJECTION, "_ID = " + id, null, null);
         try {
             if (c != null && c.moveToFirst()) {
                 BluetoothMapFolderElement folderElement;
@@ -4166,7 +4202,8 @@
                 // Get email message body content
                 int count = 0;
                 try {
-                    fd = mResolver.openFileDescriptor(uri, "r");
+                    fd = BluetoothMethodProxy.getInstance().contentResolverOpenFileDescriptor(
+                            mResolver, uri, "r");
                     is = new FileInputStream(fd.getFileDescriptor());
                     StringBuilder email = new StringBuilder("");
                     byte[] buffer = new byte[1024];
@@ -4237,8 +4274,8 @@
 
         BluetoothMapbMessageMime message = new BluetoothMapbMessageMime();
         Uri contentUri = Uri.parse(mBaseUri + BluetoothMapContract.TABLE_MESSAGE);
-        Cursor c = mResolver.query(contentUri, BluetoothMapContract.BT_MESSAGE_PROJECTION,
-                "_ID = " + id, null, null);
+        Cursor c = BluetoothMethodProxy.getInstance().contentResolverQuery(mResolver, contentUri,
+                BluetoothMapContract.BT_MESSAGE_PROJECTION, "_ID = " + id, null, null);
         Cursor contacts = null;
         try {
             if (c != null && c.moveToFirst()) {
@@ -4291,7 +4328,8 @@
                 // FIXME end temp code
 
                 Uri contactsUri = Uri.parse(mBaseUri + BluetoothMapContract.TABLE_CONVOCONTACT);
-                contacts = mResolver.query(contactsUri, BluetoothMapContract.BT_CONTACT_PROJECTION,
+                contacts = BluetoothMethodProxy.getInstance().contentResolverQuery(mResolver,
+                        contactsUri, BluetoothMapContract.BT_CONTACT_PROJECTION,
                         BluetoothMapContract.ConvoContactColumns.CONVO_ID + " = " + threadId, null,
                         null);
                 // TODO this will not work for group-chats
diff --git a/android/app/src/com/android/bluetooth/map/BluetoothMapContentObserver.java b/android/app/src/com/android/bluetooth/map/BluetoothMapContentObserver.java
index a15a75d..8179da3 100644
--- a/android/app/src/com/android/bluetooth/map/BluetoothMapContentObserver.java
+++ b/android/app/src/com/android/bluetooth/map/BluetoothMapContentObserver.java
@@ -53,11 +53,13 @@
 import android.util.Log;
 import android.util.Xml;
 
+import com.android.bluetooth.BluetoothMethodProxy;
 import com.android.bluetooth.Utils;
 import com.android.bluetooth.map.BluetoothMapUtils.TYPE;
 import com.android.bluetooth.map.BluetoothMapbMessageMime.MimePart;
 import com.android.bluetooth.mapapi.BluetoothMapContract;
 import com.android.bluetooth.mapapi.BluetoothMapContract.MessageColumns;
+import com.android.internal.annotations.VisibleForTesting;
 import com.android.obex.ResponseCodes;
 
 import com.google.android.mms.pdu.PduHeaders;
@@ -79,6 +81,7 @@
 import java.util.Map;
 import java.util.Objects;
 import java.util.Set;
+import java.util.concurrent.TimeUnit;
 
 @TargetApi(19)
 public class BluetoothMapContentObserver {
@@ -87,18 +90,30 @@
     private static final boolean D = BluetoothMapService.DEBUG;
     private static final boolean V = BluetoothMapService.VERBOSE;
 
-    private static final String EVENT_TYPE_NEW = "NewMessage";
-    private static final String EVENT_TYPE_DELETE = "MessageDeleted";
-    private static final String EVENT_TYPE_REMOVED = "MessageRemoved";
-    private static final String EVENT_TYPE_SHIFT = "MessageShift";
-    private static final String EVENT_TYPE_DELEVERY_SUCCESS = "DeliverySuccess";
-    private static final String EVENT_TYPE_SENDING_SUCCESS = "SendingSuccess";
-    private static final String EVENT_TYPE_SENDING_FAILURE = "SendingFailure";
-    private static final String EVENT_TYPE_DELIVERY_FAILURE = "DeliveryFailure";
-    private static final String EVENT_TYPE_READ_STATUS = "ReadStatusChanged";
-    private static final String EVENT_TYPE_CONVERSATION = "ConversationChanged";
-    private static final String EVENT_TYPE_PRESENCE = "ParticipantPresenceChanged";
-    private static final String EVENT_TYPE_CHAT_STATE = "ParticipantChatStateChanged";
+    @VisibleForTesting
+    static final String EVENT_TYPE_NEW = "NewMessage";
+    @VisibleForTesting
+    static final String EVENT_TYPE_DELETE = "MessageDeleted";
+    @VisibleForTesting
+    static final String EVENT_TYPE_REMOVED = "MessageRemoved";
+    @VisibleForTesting
+    static final String EVENT_TYPE_SHIFT = "MessageShift";
+    @VisibleForTesting
+    static final String EVENT_TYPE_DELEVERY_SUCCESS = "DeliverySuccess";
+    @VisibleForTesting
+    static final String EVENT_TYPE_SENDING_SUCCESS = "SendingSuccess";
+    @VisibleForTesting
+    static final String EVENT_TYPE_SENDING_FAILURE = "SendingFailure";
+    @VisibleForTesting
+    static final String EVENT_TYPE_DELIVERY_FAILURE = "DeliveryFailure";
+    @VisibleForTesting
+    static final String EVENT_TYPE_READ_STATUS = "ReadStatusChanged";
+    @VisibleForTesting
+    static final String EVENT_TYPE_CONVERSATION = "ConversationChanged";
+    @VisibleForTesting
+    static final String EVENT_TYPE_PRESENCE = "ParticipantPresenceChanged";
+    @VisibleForTesting
+    static final String EVENT_TYPE_CHAT_STATE = "ParticipantChatStateChanged";
 
     private static final long EVENT_FILTER_NEW_MESSAGE = 1L;
     private static final long EVENT_FILTER_MESSAGE_DELETED = 1L << 1;
@@ -122,24 +137,31 @@
 
     private Context mContext;
     private ContentResolver mResolver;
-    private ContentProviderClient mProviderClient = null;
+    @VisibleForTesting
+    ContentProviderClient mProviderClient = null;
     private BluetoothMnsObexClient mMnsClient;
     private BluetoothMapMasInstance mMasInstance = null;
     private int mMasId;
     private boolean mEnableSmsMms = false;
-    private boolean mObserverRegistered = false;
-    private BluetoothMapAccountItem mAccount;
-    private String mAuthority = null;
+    @VisibleForTesting
+    boolean mObserverRegistered = false;
+    @VisibleForTesting
+    BluetoothMapAccountItem mAccount;
+    @VisibleForTesting
+    String mAuthority = null;
 
     // Default supported feature bit mask is 0x1f
     private int mMapSupportedFeatures = BluetoothMapUtils.MAP_FEATURE_DEFAULT_BITMASK;
     // Default event report version is 1.0
-    private int mMapEventReportVersion = BluetoothMapUtils.MAP_EVENT_REPORT_V10;
+    @VisibleForTesting
+    int mMapEventReportVersion = BluetoothMapUtils.MAP_EVENT_REPORT_V10;
 
     private BluetoothMapFolderElement mFolders = new BluetoothMapFolderElement("DUMMY", null);
     // Will be set by the MAS when generated.
-    private Uri mMessageUri = null;
-    private Uri mContactUri = null;
+    @VisibleForTesting
+    Uri mMessageUri = null;
+    @VisibleForTesting
+    Uri mContactUri = null;
 
     private boolean mTransmitEvents = true;
 
@@ -336,11 +358,13 @@
         }
     }
 
-    private Map<Long, Msg> getMsgListSms() {
+    @VisibleForTesting
+    Map<Long, Msg> getMsgListSms() {
         return mMsgListSms;
     }
 
-    private void setMsgListSms(Map<Long, Msg> msgListSms, boolean changesDetected) {
+    @VisibleForTesting
+    void setMsgListSms(Map<Long, Msg> msgListSms, boolean changesDetected) {
         mMsgListSms = msgListSms;
         if (changesDetected) {
             mMasInstance.updateFolderVersionCounter();
@@ -348,13 +372,13 @@
         mMasInstance.setMsgListSms(msgListSms);
     }
 
-
-    private Map<Long, Msg> getMsgListMms() {
+    @VisibleForTesting
+    Map<Long, Msg> getMsgListMms() {
         return mMsgListMms;
     }
 
-
-    private void setMsgListMms(Map<Long, Msg> msgListMms, boolean changesDetected) {
+    @VisibleForTesting
+    void setMsgListMms(Map<Long, Msg> msgListMms, boolean changesDetected) {
         mMsgListMms = msgListMms;
         if (changesDetected) {
             mMasInstance.updateFolderVersionCounter();
@@ -362,13 +386,13 @@
         mMasInstance.setMsgListMms(msgListMms);
     }
 
-
-    private Map<Long, Msg> getMsgListMsg() {
+    @VisibleForTesting
+    Map<Long, Msg> getMsgListMsg() {
         return mMsgListMsg;
     }
 
-
-    private void setMsgListMsg(Map<Long, Msg> msgListMsg, boolean changesDetected) {
+    @VisibleForTesting
+    void setMsgListMsg(Map<Long, Msg> msgListMsg, boolean changesDetected) {
         mMsgListMsg = msgListMsg;
         if (changesDetected) {
             mMasInstance.updateFolderVersionCounter();
@@ -376,7 +400,8 @@
         mMasInstance.setMsgListMsg(msgListMsg);
     }
 
-    private Map<String, BluetoothMapConvoContactElement> getContactList() {
+    @VisibleForTesting
+    Map<String, BluetoothMapConvoContactElement> getContactList() {
         return mContactList;
     }
 
@@ -386,7 +411,8 @@
      * @param contactList
      * @param changesDetected that is not chat state changed nor presence state changed.
      */
-    private void setContactList(Map<String, BluetoothMapConvoContactElement> contactList,
+    @VisibleForTesting
+    void setContactList(Map<String, BluetoothMapConvoContactElement> contactList,
             boolean changesDetected) {
         mContactList = contactList;
         if (changesDetected) {
@@ -536,7 +562,8 @@
         this.mFolders = folderStructure;
     }
 
-    private class ConvoContactInfo {
+    @VisibleForTesting
+    static class ConvoContactInfo {
         public int mConvoColConvoId = -1;
         public int mConvoColLastActivity = -1;
         public int mConvoColName = -1;
@@ -587,7 +614,8 @@
         }
     }
 
-    private class Event {
+    @VisibleForTesting
+    class Event {
         public String eventType;
         public long handle;
         public String folder = null;
@@ -608,7 +636,8 @@
 
         static final String PATH = "telecom/msg/";
 
-        private void setFolderPath(String name, TYPE type) {
+        @VisibleForTesting
+        void setFolderPath(String name, TYPE type) {
             if (name != null) {
                 if (type == TYPE.EMAIL || type == TYPE.IM) {
                     this.folder = name;
@@ -827,7 +856,7 @@
         }
     }
 
-    /*package*/ class Msg {
+    /*package*/ static class Msg {
         public long id;
         public int type;               // Used as folder for SMS/MMS
         public int threadId;           // Used for SMS/MMS at delete
@@ -1113,7 +1142,8 @@
         }
     }
 
-    private void sendEvent(Event evt) {
+    @VisibleForTesting
+    void sendEvent(Event evt) {
 
         if (!mTransmitEvents) {
             if (V) {
@@ -1235,7 +1265,8 @@
         }
     }
 
-    private void initMsgList() throws RemoteException {
+    @VisibleForTesting
+    void initMsgList() throws RemoteException {
         if (V) {
             Log.d(TAG, "initMsgList");
         }
@@ -1249,7 +1280,8 @@
 
             Cursor c;
             try {
-                c = mResolver.query(Sms.CONTENT_URI, SMS_PROJECTION_SHORT, null, null, null);
+                c = BluetoothMethodProxy.getInstance().contentResolverQuery(mResolver,
+                        Sms.CONTENT_URI, SMS_PROJECTION_SHORT, null, null, null);
             } catch (SQLiteException e) {
                 Log.e(TAG, "Failed to initialize the list of messages: " + e.toString());
                 return;
@@ -1280,7 +1312,8 @@
 
             HashMap<Long, Msg> msgListMms = new HashMap<Long, Msg>();
 
-            c = mResolver.query(Mms.CONTENT_URI, MMS_PROJECTION_SHORT, null, null, null);
+            c = BluetoothMethodProxy.getInstance().contentResolverQuery(mResolver, Mms.CONTENT_URI,
+                    MMS_PROJECTION_SHORT, null, null, null);
             try {
                 if (c != null && c.moveToFirst()) {
                     do {
@@ -1335,7 +1368,8 @@
         }
     }
 
-    private void initContactsList() throws RemoteException {
+    @VisibleForTesting
+    void initContactsList() throws RemoteException {
         if (V) {
             Log.d(TAG, "initContactsList");
         }
@@ -1389,7 +1423,8 @@
         }
     }
 
-    private void handleMsgListChangesSms() {
+    @VisibleForTesting
+    void handleMsgListChangesSms() {
         if (V) {
             Log.d(TAG, "handleMsgListChangesSms");
         }
@@ -1400,9 +1435,11 @@
         Cursor c;
         synchronized (getMsgListSms()) {
             if (mMapEventReportVersion == BluetoothMapUtils.MAP_EVENT_REPORT_V10) {
-                c = mResolver.query(Sms.CONTENT_URI, SMS_PROJECTION_SHORT, null, null, null);
+                c = BluetoothMethodProxy.getInstance().contentResolverQuery(mResolver,
+                        Sms.CONTENT_URI, SMS_PROJECTION_SHORT, null, null, null);
             } else {
-                c = mResolver.query(Sms.CONTENT_URI, SMS_PROJECTION_SHORT_EXT, null, null, null);
+                c = BluetoothMethodProxy.getInstance().contentResolverQuery(mResolver,
+                        Sms.CONTENT_URI, SMS_PROJECTION_SHORT_EXT, null, null, null);
             }
             try {
                 if (c != null && c.moveToFirst()) {
@@ -1431,8 +1468,14 @@
                             if (mTransmitEvents && // extract contact details only if needed
                                     mMapEventReportVersion
                                             > BluetoothMapUtils.MAP_EVENT_REPORT_V10) {
-                                String date = BluetoothMapUtils.getDateTimeString(
-                                        c.getLong(c.getColumnIndex(Sms.DATE)));
+                                long timestamp = c.getLong(c.getColumnIndex(Sms.DATE));
+                                String date = BluetoothMapUtils.getDateTimeString(timestamp);
+                                if (BluetoothMapUtils.isDateTimeOlderThanOneYear(timestamp)) {
+                                    // Skip sending message events older than one year
+                                    listChanged = false;
+                                    msgListSms.remove(id);
+                                    continue;
+                                }
                                 String subject = c.getString(c.getColumnIndex(Sms.BODY));
                                 if (subject == null) {
                                     subject = "";
@@ -1549,7 +1592,8 @@
         }
     }
 
-    private void handleMsgListChangesMms() {
+    @VisibleForTesting
+    void handleMsgListChangesMms() {
         if (V) {
             Log.d(TAG, "handleMsgListChangesMms");
         }
@@ -1559,9 +1603,11 @@
         Cursor c;
         synchronized (getMsgListMms()) {
             if (mMapEventReportVersion == BluetoothMapUtils.MAP_EVENT_REPORT_V10) {
-                c = mResolver.query(Mms.CONTENT_URI, MMS_PROJECTION_SHORT, null, null, null);
+                c = BluetoothMethodProxy.getInstance().contentResolverQuery(mResolver,
+                        Mms.CONTENT_URI, MMS_PROJECTION_SHORT, null, null, null);
             } else {
-                c = mResolver.query(Mms.CONTENT_URI, MMS_PROJECTION_SHORT_EXT, null, null, null);
+                c = BluetoothMethodProxy.getInstance().contentResolverQuery(mResolver,
+                        Mms.CONTENT_URI, MMS_PROJECTION_SHORT_EXT, null, null, null);
             }
 
             try {
@@ -1588,7 +1634,6 @@
 
                         if (msg == null) {
                             /* New message - only notify on retrieve conf */
-                            listChanged = true;
                             if (getMmsFolderName(type).equalsIgnoreCase(
                                     BluetoothMapContract.FOLDER_NAME_INBOX)
                                     && mtype != MESSAGE_TYPE_RETRIEVE_CONF) {
@@ -1600,8 +1645,16 @@
                             if (mTransmitEvents && // extract contact details only if needed
                                     mMapEventReportVersion
                                             != BluetoothMapUtils.MAP_EVENT_REPORT_V10) {
-                                String date = BluetoothMapUtils.getDateTimeString(
-                                        c.getLong(c.getColumnIndex(Mms.DATE)));
+                                // MMS date field is in seconds
+                                long timestamp =
+                                        TimeUnit.SECONDS.toMillis(
+                                            c.getLong(c.getColumnIndex(Mms.DATE)));
+                                String date = BluetoothMapUtils.getDateTimeString(timestamp);
+                                if (BluetoothMapUtils.isDateTimeOlderThanOneYear(timestamp)) {
+                                    // Skip sending new message events older than one year
+                                    msgListMms.remove(id);
+                                    continue;
+                                }
                                 String subject = c.getString(c.getColumnIndex(Mms.SUBJECT));
                                 if (subject == null || subject.length() == 0) {
                                     /* Get subject from mms text body parts - if any exists */
@@ -1642,6 +1695,7 @@
                                 evt = new Event(EVENT_TYPE_NEW, id, getMmsFolderName(type), null,
                                         TYPE.MMS);
                             }
+                            listChanged = true;
 
                             sendEvent(evt);
                         } else {
@@ -1717,7 +1771,8 @@
         }
     }
 
-    private void handleMsgListChangesMsg(Uri uri) throws RemoteException {
+    @VisibleForTesting
+    void handleMsgListChangesMsg(Uri uri) throws RemoteException {
         if (V) {
             Log.v(TAG, "handleMsgListChangesMsg uri: " + uri.toString());
         }
@@ -1830,7 +1885,8 @@
                                         && sentFolder.getFolderId() == folderId
                                         && msg.localInitiatedSend) {
                                     if (msg.transparent) {
-                                        mResolver.delete(
+                                        BluetoothMethodProxy.getInstance().contentResolverDelete(
+                                                mResolver,
                                                 ContentUris.withAppendedId(mMessageUri, id), null,
                                                 null);
                                     } else {
@@ -1930,7 +1986,8 @@
         }
     }
 
-    private void handleContactListChanges(Uri uri) {
+    @VisibleForTesting
+    void handleContactListChanges(Uri uri) {
         if (uri.getAuthority().equals(mAuthority)) {
             try {
                 if (V) {
@@ -2131,7 +2188,8 @@
         // TODO: conversation contact updates if IM and SMS(MMS in one instance
     }
 
-    private boolean setEmailMessageStatusDelete(BluetoothMapFolderElement mCurrentFolder,
+    @VisibleForTesting
+    boolean setEmailMessageStatusDelete(BluetoothMapFolderElement mCurrentFolder,
             String uriStr, long handle, int status) {
         boolean res = false;
         Uri uri = Uri.parse(uriStr + BluetoothMapContract.TABLE_MESSAGE);
@@ -2150,7 +2208,8 @@
                     folderId = deleteFolder.getFolderId();
                 }
                 contentValues.put(BluetoothMapContract.MessageColumns.FOLDER_ID, folderId);
-                updateCount = mResolver.update(uri, contentValues, null, null);
+                updateCount = BluetoothMethodProxy.getInstance().contentResolverUpdate(
+                        mResolver, uri, contentValues, null, null);
                 /* The race between updating the value in our cached values and the database
                  * is handled by the synchronized statement. */
                 if (updateCount > 0) {
@@ -2189,7 +2248,8 @@
                         }
                     }
                     contentValues.put(BluetoothMapContract.MessageColumns.FOLDER_ID, folderId);
-                    updateCount = mResolver.update(uri, contentValues, null, null);
+                    updateCount = BluetoothMethodProxy.getInstance().contentResolverUpdate(
+                            mResolver, uri, contentValues, null, null);
                     if (updateCount > 0) {
                         res = true;
                         /* Update the folder ID to avoid triggering an event for MCE
@@ -2233,13 +2293,16 @@
     private void updateThreadId(Uri uri, String valueString, long threadId) {
         ContentValues contentValues = new ContentValues();
         contentValues.put(valueString, threadId);
-        mResolver.update(uri, contentValues, null, null);
+        BluetoothMethodProxy.getInstance().contentResolverUpdate(mResolver, uri, contentValues,
+                null, null);
     }
 
-    private boolean deleteMessageMms(long handle) {
+    @VisibleForTesting
+    boolean deleteMessageMms(long handle) {
         boolean res = false;
         Uri uri = ContentUris.withAppendedId(Mms.CONTENT_URI, handle);
-        Cursor c = mResolver.query(uri, null, null, null, null);
+        Cursor c = BluetoothMethodProxy.getInstance().contentResolverQuery(mResolver, uri, null,
+                null, null, null);
         try {
             if (c != null && c.moveToFirst()) {
                 /* Move to deleted folder, or delete if already in deleted folder */
@@ -2259,7 +2322,8 @@
                         getMsgListMms().remove(handle);
                     }
                     /* Delete message */
-                    mResolver.delete(uri, null, null);
+                    BluetoothMethodProxy.getInstance().contentResolverDelete(mResolver, uri, null,
+                            null);
                 }
                 res = true;
             }
@@ -2272,10 +2336,12 @@
         return res;
     }
 
-    private boolean unDeleteMessageMms(long handle) {
+    @VisibleForTesting
+    boolean unDeleteMessageMms(long handle) {
         boolean res = false;
         Uri uri = ContentUris.withAppendedId(Mms.CONTENT_URI, handle);
-        Cursor c = mResolver.query(uri, null, null, null, null);
+        Cursor c = BluetoothMethodProxy.getInstance().contentResolverQuery(mResolver, uri, null,
+                null, null, null);
         try {
             if (c != null && c.moveToFirst()) {
                 int threadId = c.getInt(c.getColumnIndex(Mms.THREAD_ID));
@@ -2294,7 +2360,9 @@
                     }
                     Set<String> recipients = new HashSet<String>();
                     recipients.addAll(Arrays.asList(address));
-                    Long oldThreadId = Telephony.Threads.getOrCreateThreadId(mContext, recipients);
+                    Long oldThreadId =
+                            BluetoothMethodProxy.getInstance().telephonyGetOrCreateThreadId(
+                                    mContext, recipients);
                     synchronized (getMsgListMms()) {
                         Msg msg = getMsgListMms().get(handle);
                         if (msg != null) { // This will always be the case
@@ -2323,10 +2391,12 @@
         return res;
     }
 
-    private boolean deleteMessageSms(long handle) {
+    @VisibleForTesting
+    boolean deleteMessageSms(long handle) {
         boolean res = false;
         Uri uri = ContentUris.withAppendedId(Sms.CONTENT_URI, handle);
-        Cursor c = mResolver.query(uri, null, null, null, null);
+        Cursor c = BluetoothMethodProxy.getInstance().contentResolverQuery(mResolver, uri, null,
+                null, null, null);
         try {
             if (c != null && c.moveToFirst()) {
                 /* Move to deleted folder, or delete if already in deleted folder */
@@ -2346,7 +2416,8 @@
                         getMsgListSms().remove(handle);
                     }
                     /* Delete message */
-                    mResolver.delete(uri, null, null);
+                    BluetoothMethodProxy.getInstance().contentResolverDelete(mResolver, uri, null,
+                            null);
                 }
                 res = true;
             }
@@ -2358,10 +2429,12 @@
         return res;
     }
 
-    private boolean unDeleteMessageSms(long handle) {
+    @VisibleForTesting
+    boolean unDeleteMessageSms(long handle) {
         boolean res = false;
         Uri uri = ContentUris.withAppendedId(Sms.CONTENT_URI, handle);
-        Cursor c = mResolver.query(uri, null, null, null, null);
+        Cursor c = BluetoothMethodProxy.getInstance().contentResolverQuery(mResolver, uri, null,
+                null, null, null);
         try {
             if (c != null && c.moveToFirst()) {
                 int threadId = c.getInt(c.getColumnIndex(Sms.THREAD_ID));
@@ -2369,7 +2442,9 @@
                     String address = c.getString(c.getColumnIndex(Sms.ADDRESS));
                     Set<String> recipients = new HashSet<String>();
                     recipients.addAll(Arrays.asList(address));
-                    Long oldThreadId = Telephony.Threads.getOrCreateThreadId(mContext, recipients);
+                    Long oldThreadId =
+                            BluetoothMethodProxy.getInstance().telephonyGetOrCreateThreadId(
+                                    mContext, recipients);
                     synchronized (getMsgListSms()) {
                         Msg msg = getMsgListSms().get(handle);
                         if (msg != null) {
@@ -2480,7 +2555,8 @@
                     msg.flagRead = statusValue;
                 }
             }
-            count = mResolver.update(uri, contentValues, null, null);
+            count = BluetoothMethodProxy.getInstance().contentResolverUpdate(mResolver, uri,
+                    contentValues, null, null);
             if (D) {
                 Log.d(TAG, " -> " + count + " rows updated!");
             }
@@ -2498,7 +2574,8 @@
                     msg.flagRead = statusValue;
                 }
             }
-            count = mResolver.update(uri, contentValues, null, null);
+            count = BluetoothMethodProxy.getInstance().contentResolverUpdate(mResolver, uri,
+                    contentValues, null, null);
             if (D) {
                 Log.d(TAG, " -> " + count + " rows updated!");
             }
@@ -2519,7 +2596,8 @@
         return (count > 0);
     }
 
-    private class PushMsgInfo {
+    @VisibleForTesting
+    static class PushMsgInfo {
         public long id;
         public int transparent;
         public int retry;
@@ -2885,7 +2963,8 @@
         if (handle != -1) {
             String whereClause = " _id= " + handle;
             Uri uri = Mms.CONTENT_URI;
-            Cursor queryResult = resolver.query(uri, null, whereClause, null, null);
+            Cursor queryResult = BluetoothMethodProxy.getInstance().contentResolverQuery(resolver,
+                    uri, null, whereClause, null, null);
             try {
                 if (queryResult != null) {
                     if (queryResult.getCount() > 0) {
@@ -2893,7 +2972,8 @@
                         ContentValues data = new ContentValues();
                         /* set folder to be outbox */
                         data.put(Mms.MESSAGE_BOX, folder);
-                        resolver.update(uri, data, whereClause, null);
+                        BluetoothMethodProxy.getInstance().contentResolverUpdate(resolver, uri,
+                                data, whereClause, null);
                         if (D) {
                             Log.d(TAG, "moved MMS message to " + getMmsFolderName(folder));
                         }
@@ -3512,7 +3592,7 @@
             if (D) {
                 Log.d(TAG, "Transparent in use - delete");
             }
-            resolver.delete(uri, null, null);
+            BluetoothMethodProxy.getInstance().contentResolverDelete(resolver, uri, null, null);
         } else if (result == Activity.RESULT_OK) {
             /* This will trigger a notification */
             moveMmsToFolder(handle, resolver, Mms.MESSAGE_BOX_SENT);
@@ -3587,7 +3667,7 @@
             /* Delete from DB */
             ContentResolver resolver = context.getContentResolver();
             if (resolver != null) {
-                resolver.delete(uri, null, null);
+                BluetoothMethodProxy.getInstance().contentResolverDelete(resolver, uri, null, null);
             } else {
                 Log.w(TAG, "Unable to get resolver");
             }
diff --git a/android/app/src/com/android/bluetooth/map/BluetoothMapFolderElement.java b/android/app/src/com/android/bluetooth/map/BluetoothMapFolderElement.java
index bc32726..de8525f 100644
--- a/android/app/src/com/android/bluetooth/map/BluetoothMapFolderElement.java
+++ b/android/app/src/com/android/bluetooth/map/BluetoothMapFolderElement.java
@@ -58,7 +58,7 @@
         mSubFolders = new HashMap<String, BluetoothMapFolderElement>();
     }
 
-    public void setIngore(boolean ignore) {
+    public void setIgnore(boolean ignore) {
         mIgnore = ignore;
     }
 
diff --git a/android/app/src/com/android/bluetooth/map/BluetoothMapMasInstance.java b/android/app/src/com/android/bluetooth/map/BluetoothMapMasInstance.java
index 43daaf8..2567da6 100644
--- a/android/app/src/com/android/bluetooth/map/BluetoothMapMasInstance.java
+++ b/android/app/src/com/android/bluetooth/map/BluetoothMapMasInstance.java
@@ -30,6 +30,7 @@
 import com.android.bluetooth.map.BluetoothMapContentObserver.Msg;
 import com.android.bluetooth.map.BluetoothMapUtils.TYPE;
 import com.android.bluetooth.sdp.SdpManager;
+import com.android.internal.annotations.VisibleForTesting;
 import com.android.obex.ServerSession;
 
 import java.io.IOException;
@@ -39,8 +40,10 @@
 import java.util.concurrent.atomic.AtomicLong;
 
 public class BluetoothMapMasInstance implements IObexConnectionHandler {
-    private final String mTag;
-    private static volatile int sInstanceCounter = 0;
+    @VisibleForTesting
+    final String mTag;
+    @VisibleForTesting
+    static volatile int sInstanceCounter = 0;
 
     private static final boolean D = BluetoothMapService.DEBUG;
     private static final boolean V = BluetoothMapService.VERBOSE;
@@ -146,7 +149,8 @@
     }
 
     /* Needed only for test */
-    protected BluetoothMapMasInstance() {
+    @VisibleForTesting
+    BluetoothMapMasInstance() {
         mTag = "BluetoothMapMasInstance" + sInstanceCounter++;
     }
 
diff --git a/android/app/src/com/android/bluetooth/map/BluetoothMapMessageListing.java b/android/app/src/com/android/bluetooth/map/BluetoothMapMessageListing.java
index 3a19967..96427be 100644
--- a/android/app/src/com/android/bluetooth/map/BluetoothMapMessageListing.java
+++ b/android/app/src/com/android/bluetooth/map/BluetoothMapMessageListing.java
@@ -18,6 +18,7 @@
 import android.util.Xml;
 
 import com.android.bluetooth.DeviceWorkArounds;
+import com.android.bluetooth.Utils;
 
 import org.xmlpull.v1.XmlSerializer;
 
@@ -90,9 +91,15 @@
     public byte[] encode(boolean includeThreadId, String version)
             throws UnsupportedEncodingException {
         StringWriter sw = new StringWriter();
-        boolean isBenzCarkit = DeviceWorkArounds.addressStartsWith(
-                BluetoothMapService.getRemoteDevice().getAddress(),
-                DeviceWorkArounds.MERCEDES_BENZ_CARKIT);
+        boolean isBenzCarkit;
+
+        if (Utils.isInstrumentationTestMode()) {
+            isBenzCarkit = false;
+        } else {
+            isBenzCarkit = DeviceWorkArounds.addressStartsWith(
+                    BluetoothMapService.getRemoteDevice().getAddress(),
+                    DeviceWorkArounds.MERCEDES_BENZ_CARKIT);
+        }
         try {
             XmlSerializer xmlMsgElement = Xml.newSerializer();
             xmlMsgElement.setOutput(sw);
@@ -121,8 +128,9 @@
             Log.w(TAG, e);
         }
         /* Fix IOT issue to replace '&amp;' by '&', &lt; by < and '&gt; by '>' in MessageListing */
-        if (DeviceWorkArounds.addressStartsWith(BluetoothMapService.getRemoteDevice().getAddress(),
-                    DeviceWorkArounds.BREZZA_ZDI_CARKIT)) {
+        if (!Utils.isInstrumentationTestMode() && DeviceWorkArounds.addressStartsWith(
+                BluetoothMapService.getRemoteDevice().getAddress(),
+                DeviceWorkArounds.BREZZA_ZDI_CARKIT)) {
             return sw.toString()
                     .replaceAll("&amp;", "&")
                     .replaceAll("&lt;", "<")
diff --git a/android/app/src/com/android/bluetooth/map/BluetoothMapObexServer.java b/android/app/src/com/android/bluetooth/map/BluetoothMapObexServer.java
index 0c77062..c02fe4a 100644
--- a/android/app/src/com/android/bluetooth/map/BluetoothMapObexServer.java
+++ b/android/app/src/com/android/bluetooth/map/BluetoothMapObexServer.java
@@ -29,9 +29,11 @@
 import android.text.format.DateUtils;
 import android.util.Log;
 
+import com.android.bluetooth.BluetoothMethodProxy;
 import com.android.bluetooth.SignedLongLong;
 import com.android.bluetooth.map.BluetoothMapUtils.TYPE;
 import com.android.bluetooth.mapapi.BluetoothMapContract;
+import com.android.internal.annotations.VisibleForTesting;
 import com.android.obex.HeaderSet;
 import com.android.obex.Operation;
 import com.android.obex.ResponseCodes;
@@ -168,8 +170,8 @@
      *
      */
     private ContentProviderClient acquireUnstableContentProviderOrThrow() throws RemoteException {
-        ContentProviderClient providerClient =
-                mResolver.acquireUnstableContentProviderClient(mAuthority);
+        ContentProviderClient providerClient = BluetoothMethodProxy.getInstance()
+                .contentResolverAcquireUnstableContentProviderClient(mResolver, mAuthority);
         if (providerClient == null) {
             throw new RemoteException("Failed to acquire provider for " + mAuthority);
         }
@@ -276,7 +278,8 @@
      *        folder.getFolderId() will be used to query sub-folders.
      *        Use a parentFolder with id -1 to get all folders from root.
      */
-    private void addEmailFolders(BluetoothMapFolderElement parentFolder) throws RemoteException {
+    @VisibleForTesting
+    void addEmailFolders(BluetoothMapFolderElement parentFolder) throws RemoteException {
         // Select all parent folders
         BluetoothMapFolderElement newFolder;
 
@@ -529,7 +532,7 @@
                             + appParams.getChatState() + ", ChatStatusConvoId: "
                             + appParams.getChatStateConvoIdString());
                 }
-                return setOwnerStatus(name, appParams);
+                return setOwnerStatus(appParams);
             }
 
         } catch (RemoteException e) {
@@ -841,7 +844,8 @@
         return ResponseCodes.OBEX_HTTP_OK;
     }
 
-    private int setOwnerStatus(String msgHandle, BluetoothMapAppParams appParams)
+    @VisibleForTesting
+    int setOwnerStatus(BluetoothMapAppParams appParams)
             throws RemoteException {
         // This does only work for IM
         if (mAccount != null && mAccount.getType() == BluetoothMapUtils.TYPE.IM) {
@@ -1163,7 +1167,7 @@
             // If messageHandle or convoId filtering ignore folder
             Log.v(TAG, "sendMessageListingRsp: ignore folder ");
             folderToList = mCurrentFolder.getRoot();
-            folderToList.setIngore(true);
+            folderToList.setIgnore(true);
         } else {
             folderToList = getFolderElementFromName(folderName);
             if (folderToList == null) {
@@ -1207,7 +1211,7 @@
                 outAppParams.setMessageListingSize(listSize);
                 op.noBodyHeader();
             }
-            folderToList.setIngore(false);
+            folderToList.setIgnore(false);
             // Build the application parameter header
             // let the peer know if there are unread messages in the list
             if (hasUnread) {
@@ -1304,7 +1308,8 @@
      * @param overwrite True: The msgType will be overwritten to match the message types supported
      * by this MAS instance. False: any unsupported message types will be masked out.
      */
-    private void setMsgTypeFilterParams(BluetoothMapAppParams appParams, boolean overwrite) {
+    @VisibleForTesting
+    void setMsgTypeFilterParams(BluetoothMapAppParams appParams, boolean overwrite) {
         int masFilterMask = 0;
         if (!mEnableSmsMms) {
             masFilterMask |= BluetoothMapAppParams.FILTER_NO_SMS_CDMA;
@@ -1845,7 +1850,7 @@
                             + appParams.getChatState() + ", ChatStatusConvoId: "
                             + appParams.getChatStateConvoIdString());
                 }
-                return setOwnerStatus(name, appParams);
+                return setOwnerStatus(appParams);
             }
 
         } catch (RemoteException e) {
diff --git a/android/app/src/com/android/bluetooth/map/BluetoothMapService.java b/android/app/src/com/android/bluetooth/map/BluetoothMapService.java
index df87ab4..e4dfe64 100644
--- a/android/app/src/com/android/bluetooth/map/BluetoothMapService.java
+++ b/android/app/src/com/android/bluetooth/map/BluetoothMapService.java
@@ -74,9 +74,9 @@
      * DEBUG log: "setprop log.tag.BluetoothMapService VERBOSE"
      */
 
-    public static final boolean DEBUG = false;
+    public static final boolean DEBUG = Log.isLoggable(TAG, Log.DEBUG);
 
-    public static final boolean VERBOSE = false;
+    public static final boolean VERBOSE = Log.isLoggable(TAG, Log.VERBOSE);
 
     /**
      * The component names for the owned provider and activity
@@ -104,10 +104,12 @@
     static final int MSG_OBSERVER_REGISTRATION = 5008;
 
     private static final int START_LISTENER = 1;
-    private static final int USER_TIMEOUT = 2;
+    @VisibleForTesting
+    static final int USER_TIMEOUT = 2;
     private static final int DISCONNECT_MAP = 3;
     private static final int SHUTDOWN = 4;
-    private static final int UPDATE_MAS_INSTANCES = 5;
+    @VisibleForTesting
+    static final int UPDATE_MAS_INSTANCES = 5;
 
     private static final int RELEASE_WAKE_LOCK_DELAY = 10000;
     private PowerManager.WakeLock mWakeLock = null;
@@ -148,7 +150,8 @@
     private boolean mAccountChanged = false;
     private boolean mSdpSearchInitiated = false;
     private SdpMnsRecord mMnsRecord = null;
-    private MapServiceMessageHandler mSessionStatusHandler;
+    @VisibleForTesting
+    Handler mSessionStatusHandler;
     private boolean mServiceStarted = false;
 
     private static BluetoothMapService sBluetoothMapService;
@@ -556,7 +559,7 @@
         }
     }
 
-    private List<BluetoothDevice> getConnectedDevices() {
+    List<BluetoothDevice> getConnectedDevices() {
         List<BluetoothDevice> devices = new ArrayList<>();
         synchronized (this) {
             if (mState == BluetoothMap.STATE_CONNECTED && sRemoteDevice != null) {
@@ -834,7 +837,8 @@
      * If the key 255 is in use, the first free masId will be returned.
      * @return a free MasId
      */
-    private int getNextMasId() {
+    @VisibleForTesting
+    int getNextMasId() {
         // Find the largest masId in use
         int largestMasId = 0;
         for (int i = 0, c = mMasInstances.size(); i < c; i++) {
@@ -1026,7 +1030,8 @@
         } // Can only be null during shutdown
     }
 
-    private void sendConnectTimeoutMessage() {
+    @VisibleForTesting
+    void sendConnectTimeoutMessage() {
         if (DEBUG) {
             Log.d(TAG, "sendConnectTimeoutMessage()");
         }
@@ -1036,7 +1041,8 @@
         } // Can only be null during shutdown
     }
 
-    private void sendConnectCancelMessage() {
+    @VisibleForTesting
+    void sendConnectCancelMessage() {
         if (mSessionStatusHandler != null) {
             Message msg = mSessionStatusHandler.obtainMessage(MSG_MAS_CONNECT_CANCEL);
             msg.sendToTarget();
@@ -1209,14 +1215,18 @@
      * This class implements the IBluetoothMap interface - or actually it validates the
      * preconditions for calling the actual functionality in the MapService, and calls it.
      */
-    private static class BluetoothMapBinder extends IBluetoothMap.Stub
+    @VisibleForTesting
+    static class BluetoothMapBinder extends IBluetoothMap.Stub
             implements IProfileServiceBinder {
         private BluetoothMapService mService;
 
         @RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)
         private BluetoothMapService getService(AttributionSource source) {
-            if (!Utils.checkCallerIsSystemOrActiveUser(TAG)
-                    || !Utils.checkServiceAvailable(mService, TAG)
+            if (Utils.isInstrumentationTestMode()) {
+                return mService;
+            }
+            if (!Utils.checkServiceAvailable(mService, TAG)
+                    || !Utils.checkCallerIsSystemOrActiveOrManagedUser(mService, TAG)
                     || !Utils.checkConnectPermissionForDataDelivery(mService, source, TAG)) {
                 return null;
             }
diff --git a/android/app/src/com/android/bluetooth/map/BluetoothMapUtils.java b/android/app/src/com/android/bluetooth/map/BluetoothMapUtils.java
index a3710a3..5d26238 100644
--- a/android/app/src/com/android/bluetooth/map/BluetoothMapUtils.java
+++ b/android/app/src/com/android/bluetooth/map/BluetoothMapUtils.java
@@ -677,6 +677,21 @@
         return format.format(cal.getTime());
     }
 
+    static boolean isDateTimeOlderThanOneYear(long timestamp) {
+        Calendar cal = Calendar.getInstance();
+        cal.setTimeInMillis(timestamp);
+        Calendar oneYearAgo = Calendar.getInstance();
+        oneYearAgo.add(Calendar.YEAR, -1);
+        if (cal.before(oneYearAgo)) {
+            if (V) {
+                Log.v(TAG, "isDateTimeOlderThanOneYear " + cal.getTimeInMillis()
+                        + " oneYearAgo: " + oneYearAgo.getTimeInMillis());
+            }
+            return true;
+        }
+        return false;
+    }
+
     static void savePeerSupportUtcTimeStamp(int remoteFeatureMask) {
         if ((remoteFeatureMask & MAP_FEATURE_DEFINED_TIMESTAMP_FORMAT_BIT)
                 == MAP_FEATURE_DEFINED_TIMESTAMP_FORMAT_BIT) {
diff --git a/android/app/src/com/android/bluetooth/map/BluetoothMapbMessage.java b/android/app/src/com/android/bluetooth/map/BluetoothMapbMessage.java
index e222aa9..3ed5c60 100644
--- a/android/app/src/com/android/bluetooth/map/BluetoothMapbMessage.java
+++ b/android/app/src/com/android/bluetooth/map/BluetoothMapbMessage.java
@@ -19,6 +19,7 @@
 import android.util.Log;
 
 import com.android.bluetooth.map.BluetoothMapUtils.TYPE;
+import com.android.internal.annotations.VisibleForTesting;
 
 import java.io.ByteArrayOutputStream;
 import java.io.File;
@@ -323,7 +324,8 @@
 
     ;
 
-    private static class BMsgReader {
+    @VisibleForTesting
+    static class BMsgReader {
         InputStream mInStream;
 
         BMsgReader(InputStream is) {
diff --git a/android/app/src/com/android/bluetooth/map/BluetoothMapbMessageMime.java b/android/app/src/com/android/bluetooth/map/BluetoothMapbMessageMime.java
index 1d466c5..a2a81fc 100644
--- a/android/app/src/com/android/bluetooth/map/BluetoothMapbMessageMime.java
+++ b/android/app/src/com/android/bluetooth/map/BluetoothMapbMessageMime.java
@@ -591,14 +591,6 @@
                 headerValue = BluetoothMapUtils.stripEncoding(headerValue);
                 Rfc822Token[] tokens = Rfc822Tokenizer.tokenize(headerValue);
                 mFrom = new ArrayList<Rfc822Token>(Arrays.asList(tokens));
-            } else if (headerType.contains("TO")) {
-                headerValue = BluetoothMapUtils.stripEncoding(headerValue);
-                Rfc822Token[] tokens = Rfc822Tokenizer.tokenize(headerValue);
-                mTo = new ArrayList<Rfc822Token>(Arrays.asList(tokens));
-            } else if (headerType.contains("CC")) {
-                headerValue = BluetoothMapUtils.stripEncoding(headerValue);
-                Rfc822Token[] tokens = Rfc822Tokenizer.tokenize(headerValue);
-                mCc = new ArrayList<Rfc822Token>(Arrays.asList(tokens));
             } else if (headerType.contains("BCC")) {
                 headerValue = BluetoothMapUtils.stripEncoding(headerValue);
                 Rfc822Token[] tokens = Rfc822Tokenizer.tokenize(headerValue);
@@ -607,6 +599,14 @@
                 headerValue = BluetoothMapUtils.stripEncoding(headerValue);
                 Rfc822Token[] tokens = Rfc822Tokenizer.tokenize(headerValue);
                 mReplyTo = new ArrayList<Rfc822Token>(Arrays.asList(tokens));
+            } else if (headerType.contains("TO")) {
+                headerValue = BluetoothMapUtils.stripEncoding(headerValue);
+                Rfc822Token[] tokens = Rfc822Tokenizer.tokenize(headerValue);
+                mTo = new ArrayList<Rfc822Token>(Arrays.asList(tokens));
+            } else if (headerType.contains("CC")) {
+                headerValue = BluetoothMapUtils.stripEncoding(headerValue);
+                Rfc822Token[] tokens = Rfc822Tokenizer.tokenize(headerValue);
+                mCc = new ArrayList<Rfc822Token>(Arrays.asList(tokens));
             } else if (headerType.contains("SUBJECT")) { // Other headers
                 mSubject = BluetoothMapUtils.stripEncoding(headerValue);
             } else if (headerType.contains("MESSAGE-ID")) {
diff --git a/android/app/src/com/android/bluetooth/map/SmsMmsContacts.java b/android/app/src/com/android/bluetooth/map/SmsMmsContacts.java
index 932e2dd..b00bd24 100644
--- a/android/app/src/com/android/bluetooth/map/SmsMmsContacts.java
+++ b/android/app/src/com/android/bluetooth/map/SmsMmsContacts.java
@@ -26,6 +26,9 @@
 import android.provider.Telephony.MmsSms;
 import android.util.Log;
 
+import com.android.bluetooth.BluetoothMethodProxy;
+import com.android.internal.annotations.VisibleForTesting;
+
 import java.util.Arrays;
 import java.util.HashMap;
 import java.util.regex.Pattern;
@@ -40,12 +43,14 @@
     private static final String TAG = "SmsMmsContacts";
 
     private HashMap<Long, String> mPhoneNumbers = null;
-    private final HashMap<String, MapContact> mNames = new HashMap<String, MapContact>(10);
+    @VisibleForTesting
+    final HashMap<String, MapContact> mNames = new HashMap<String, MapContact>(10);
 
     private static final Uri ADDRESS_URI =
             MmsSms.CONTENT_URI.buildUpon().appendPath("canonical-addresses").build();
 
-    private static final String[] ADDRESS_PROJECTION = {
+    @VisibleForTesting
+    static final String[] ADDRESS_PROJECTION = {
             CanonicalAddressesColumns._ID, CanonicalAddressesColumns.ADDRESS
     };
     private static final int COL_ADDR_ID =
@@ -53,7 +58,8 @@
     private static final int COL_ADDR_ADDR =
             Arrays.asList(ADDRESS_PROJECTION).indexOf(CanonicalAddressesColumns.ADDRESS);
 
-    private static final String[] CONTACT_PROJECTION = {Contacts._ID, Contacts.DISPLAY_NAME};
+    @VisibleForTesting
+    static final String[] CONTACT_PROJECTION = {Contacts._ID, Contacts.DISPLAY_NAME};
     private static final String CONTACT_SEL_VISIBLE = Contacts.IN_VISIBLE_GROUP + "=1";
     private static final int COL_CONTACT_ID =
             Arrays.asList(CONTACT_PROJECTION).indexOf(Contacts._ID);
@@ -78,7 +84,8 @@
 
     public static String getPhoneNumberUncached(ContentResolver resolver, long id) {
         String where = CanonicalAddressesColumns._ID + " = " + id;
-        Cursor c = resolver.query(ADDRESS_URI, ADDRESS_PROJECTION, where, null, null);
+        Cursor c = BluetoothMethodProxy.getInstance().contentResolverQuery(resolver, ADDRESS_URI,
+                ADDRESS_PROJECTION, where, null, null);
         try {
             if (c != null) {
                 if (c.moveToPosition(0)) {
@@ -111,8 +118,10 @@
      * a new query.
      * @param resolver the ContantResolver to be used.
      */
-    private void fillPhoneCache(ContentResolver resolver) {
-        Cursor c = resolver.query(ADDRESS_URI, ADDRESS_PROJECTION, null, null, null);
+    @VisibleForTesting
+    void fillPhoneCache(ContentResolver resolver) {
+        Cursor c = BluetoothMethodProxy.getInstance().contentResolverQuery(resolver, ADDRESS_URI,
+                ADDRESS_PROJECTION, null, null, null);
         if (mPhoneNumbers == null) {
             int size = 0;
             if (c != null) {
@@ -184,7 +193,8 @@
             selectionArgs = new String[]{"%" + contactNameFilter.replace("*", "%") + "%"};
         }
 
-        Cursor c = resolver.query(uri, CONTACT_PROJECTION, selection, selectionArgs, null);
+        Cursor c = BluetoothMethodProxy.getInstance().contentResolverQuery(resolver, uri,
+                CONTACT_PROJECTION, selection, selectionArgs, null);
         try {
             if (c != null && c.getCount() >= 1) {
                 c.moveToFirst();
diff --git a/android/app/src/com/android/bluetooth/mapclient/MapClientContent.java b/android/app/src/com/android/bluetooth/mapclient/MapClientContent.java
index 36d4535..aa60b5b 100644
--- a/android/app/src/com/android/bluetooth/mapclient/MapClientContent.java
+++ b/android/app/src/com/android/bluetooth/mapclient/MapClientContent.java
@@ -137,6 +137,10 @@
         SubscriptionManager subscriptionManager =
                 context.getSystemService(SubscriptionManager.class);
         List<SubscriptionInfo> subscriptions = subscriptionManager.getActiveSubscriptionInfoList();
+        if (subscriptions == null) {
+            Log.w(TAG, "Active subscription list is missing");
+            return;
+        }
         for (SubscriptionInfo info : subscriptions) {
             if (info.getSubscriptionType() == SubscriptionManager.SUBSCRIPTION_TYPE_REMOTE_SIM) {
                 clearMessages(context, info.getSubscriptionId());
diff --git a/android/app/src/com/android/bluetooth/mapclient/MapClientService.java b/android/app/src/com/android/bluetooth/mapclient/MapClientService.java
index a030224..c1daa8c 100644
--- a/android/app/src/com/android/bluetooth/mapclient/MapClientService.java
+++ b/android/app/src/com/android/bluetooth/mapclient/MapClientService.java
@@ -53,8 +53,8 @@
 public class MapClientService extends ProfileService {
     private static final String TAG = "MapClientService";
 
-    static final boolean DBG = false;
-    static final boolean VDBG = false;
+    static final boolean DBG = Log.isLoggable(TAG, Log.DEBUG);
+    static final boolean VDBG = Log.isLoggable(TAG, Log.VERBOSE);
 
     static final int MAXIMUM_CONNECTED_DEVICES = 4;
 
@@ -64,7 +64,8 @@
     private AdapterService mAdapterService;
     private DatabaseManager mDatabaseManager;
     private static MapClientService sMapClientService;
-    private MapBroadcastReceiver mMapReceiver;
+    @VisibleForTesting
+    MapBroadcastReceiver mMapReceiver;
 
     public static boolean isEnabled() {
         return BluetoothProperties.isProfileMapClientEnabled().orElse(false);
@@ -82,7 +83,8 @@
         return sMapClientService;
     }
 
-    private static synchronized void setMapClientService(MapClientService instance) {
+    @VisibleForTesting
+    static synchronized void setMapClientService(MapClientService instance) {
         if (DBG) {
             Log.d(TAG, "setMapClientService(): set to: " + instance);
         }
@@ -337,9 +339,11 @@
             Log.d(TAG, "stop()");
         }
 
-        mAdapterService.notifyActivityAttributionInfo(
-                getAttributionSource(),
-                AdapterService.ACTIVITY_ATTRIBUTION_NO_ACTIVE_DEVICE_ADDRESS);
+        if (mAdapterService != null) {
+            mAdapterService.notifyActivityAttributionInfo(
+                    getAttributionSource(),
+                    AdapterService.ACTIVITY_ATTRIBUTION_NO_ACTIVE_DEVICE_ADDRESS);
+        }
         if (mMapReceiver != null) {
             unregisterReceiver(mMapReceiver);
             mMapReceiver = null;
@@ -353,6 +357,7 @@
             }
             stateMachine.doQuit();
         }
+        mMapInstanceMap.clear();
         return true;
     }
 
@@ -461,7 +466,8 @@
      * This class implements the IClient interface - or actually it validates the
      * preconditions for calling the actual functionality in the MapClientService, and calls it.
      */
-    private static class Binder extends IBluetoothMapClient.Stub implements IProfileServiceBinder {
+    @VisibleForTesting
+    static class Binder extends IBluetoothMapClient.Stub implements IProfileServiceBinder {
         private MapClientService mService;
 
         Binder(MapClientService service) {
@@ -473,8 +479,12 @@
 
         @RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)
         private MapClientService getService(AttributionSource source) {
-            if (!(MapUtils.isSystemUser() || Utils.checkCallerIsSystemOrActiveUser(TAG))
-                    || !Utils.checkServiceAvailable(mService, TAG)
+            if (Utils.isInstrumentationTestMode()) {
+                return mService;
+            }
+            if (!Utils.checkServiceAvailable(mService, TAG)
+                    || !(MapUtils.isSystemUser()
+                    || Utils.checkCallerIsSystemOrActiveOrManagedUser(mService, TAG))
                     || !Utils.checkConnectPermissionForDataDelivery(mService, source, TAG)) {
                 return null;
             }
@@ -714,7 +724,8 @@
         }
     }
 
-    private class MapBroadcastReceiver extends BroadcastReceiver {
+    @VisibleForTesting
+    class MapBroadcastReceiver extends BroadcastReceiver {
         @Override
         public void onReceive(Context context, Intent intent) {
             String action = intent.getAction();
diff --git a/android/app/src/com/android/bluetooth/mapclient/MasClient.java b/android/app/src/com/android/bluetooth/mapclient/MasClient.java
index c12b3af..617b4cd 100644
--- a/android/app/src/com/android/bluetooth/mapclient/MasClient.java
+++ b/android/app/src/com/android/bluetooth/mapclient/MasClient.java
@@ -26,6 +26,7 @@
 import android.util.Log;
 
 import com.android.bluetooth.BluetoothObexTransport;
+import com.android.bluetooth.ObexAppParameters;
 import com.android.internal.util.StateMachine;
 import com.android.obex.ClientSession;
 import com.android.obex.HeaderSet;
diff --git a/android/app/src/com/android/bluetooth/mapclient/MnsObexServer.java b/android/app/src/com/android/bluetooth/mapclient/MnsObexServer.java
index 60f5208..accdbfb 100644
--- a/android/app/src/com/android/bluetooth/mapclient/MnsObexServer.java
+++ b/android/app/src/com/android/bluetooth/mapclient/MnsObexServer.java
@@ -18,7 +18,9 @@
 
 import android.util.Log;
 
+import com.android.bluetooth.ObexAppParameters;
 import com.android.bluetooth.ObexServerSockets;
+import com.android.internal.annotations.VisibleForTesting;
 import com.android.obex.HeaderSet;
 import com.android.obex.Operation;
 import com.android.obex.ResponseCodes;
@@ -33,7 +35,8 @@
     private static final String TAG = "MnsObexServer";
     private static final boolean VDBG = MapClientService.VDBG;
 
-    private static final byte[] MNS_TARGET = new byte[]{
+    @VisibleForTesting
+    static final byte[] MNS_TARGET = new byte[]{
             (byte) 0xbb,
             0x58,
             0x2b,
@@ -52,7 +55,8 @@
             0x66
     };
 
-    private static final String TYPE = "x-bt/MAP-event-report";
+    @VisibleForTesting
+    static final String TYPE = "x-bt/MAP-event-report";
 
     private final WeakReference<MceStateMachine> mStateMachineReference;
     private final ObexServerSockets mObexServerSockets;
diff --git a/android/app/src/com/android/bluetooth/mapclient/obex/EventReport.java b/android/app/src/com/android/bluetooth/mapclient/obex/EventReport.java
index 414589e..399d044 100644
--- a/android/app/src/com/android/bluetooth/mapclient/obex/EventReport.java
+++ b/android/app/src/com/android/bluetooth/mapclient/obex/EventReport.java
@@ -212,7 +212,7 @@
         MESSAGE_EXTENDED_DATA_CHANGED("MessageExtendedDataChanged"),
         PARTICIPANT_PRESENCE_CHANGED("ParticipantPresenceChanged"),
         PARTICIPANT_CHAT_STATE_CHANGED("ParticipantChatStateChanged"),
-        CONCERSATION_CHANGED("ConversationChanged");
+        CONVERSATION_CHANGED("ConversationChanged");
         private final String mSpecName;
 
         Type(String specName) {
diff --git a/android/app/src/com/android/bluetooth/mapclient/obex/Message.java b/android/app/src/com/android/bluetooth/mapclient/obex/Message.java
index 606ef04..007775f 100644
--- a/android/app/src/com/android/bluetooth/mapclient/obex/Message.java
+++ b/android/app/src/com/android/bluetooth/mapclient/obex/Message.java
@@ -132,8 +132,6 @@
         mProtected = yesnoToBoolean(attrs.get("protected"));
     }
 
-    ;
-
     private boolean yesnoToBoolean(String yesno) {
         return "yes".equals(yesno);
     }
diff --git a/android/app/src/com/android/bluetooth/mapclient/obex/ObexAppParameters.java b/android/app/src/com/android/bluetooth/mapclient/obex/ObexAppParameters.java
deleted file mode 100644
index 28e8b1c..0000000
--- a/android/app/src/com/android/bluetooth/mapclient/obex/ObexAppParameters.java
+++ /dev/null
@@ -1,182 +0,0 @@
-/*
- * Copyright (C) 2014 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package com.android.bluetooth.mapclient;
-
-import com.android.obex.HeaderSet;
-
-import java.io.IOException;
-import java.nio.ByteBuffer;
-import java.util.HashMap;
-import java.util.Map;
-
-public final class ObexAppParameters {
-
-    private final HashMap<Byte, byte[]> mParams;
-
-    public ObexAppParameters() {
-        mParams = new HashMap<Byte, byte[]>();
-    }
-
-    public ObexAppParameters(byte[] raw) {
-        mParams = new HashMap<Byte, byte[]>();
-
-        if (raw != null) {
-            for (int i = 0; i < raw.length; ) {
-                if (raw.length - i < 2) {
-                    break;
-                }
-
-                byte tag = raw[i++];
-                byte len = raw[i++];
-
-                if (raw.length - i - len < 0) {
-                    break;
-                }
-
-                byte[] val = new byte[len];
-
-                System.arraycopy(raw, i, val, 0, len);
-                this.add(tag, val);
-
-                i += len;
-            }
-        }
-    }
-
-    public static ObexAppParameters fromHeaderSet(HeaderSet headerset) {
-        try {
-            byte[] raw = (byte[]) headerset.getHeader(HeaderSet.APPLICATION_PARAMETER);
-            return new ObexAppParameters(raw);
-        } catch (IOException e) {
-            // won't happen
-        }
-
-        return null;
-    }
-
-    public byte[] getHeader() {
-        int length = 0;
-
-        for (Map.Entry<Byte, byte[]> entry : mParams.entrySet()) {
-            length += (entry.getValue().length + 2);
-        }
-
-        byte[] ret = new byte[length];
-
-        int idx = 0;
-        for (Map.Entry<Byte, byte[]> entry : mParams.entrySet()) {
-            length = entry.getValue().length;
-
-            ret[idx++] = entry.getKey();
-            ret[idx++] = (byte) length;
-            System.arraycopy(entry.getValue(), 0, ret, idx, length);
-            idx += length;
-        }
-
-        return ret;
-    }
-
-    public void addToHeaderSet(HeaderSet headerset) {
-        if (mParams.size() > 0) {
-            headerset.setHeader(HeaderSet.APPLICATION_PARAMETER, getHeader());
-        }
-    }
-
-    public boolean exists(byte tag) {
-        return mParams.containsKey(tag);
-    }
-
-    public void add(byte tag, byte val) {
-        byte[] bval = ByteBuffer.allocate(1).put(val).array();
-        mParams.put(tag, bval);
-    }
-
-    public void add(byte tag, short val) {
-        byte[] bval = ByteBuffer.allocate(2).putShort(val).array();
-        mParams.put(tag, bval);
-    }
-
-    public void add(byte tag, int val) {
-        byte[] bval = ByteBuffer.allocate(4).putInt(val).array();
-        mParams.put(tag, bval);
-    }
-
-    public void add(byte tag, long val) {
-        byte[] bval = ByteBuffer.allocate(8).putLong(val).array();
-        mParams.put(tag, bval);
-    }
-
-    public void add(byte tag, String val) {
-        byte[] bval = val.getBytes();
-        mParams.put(tag, bval);
-    }
-
-    public void add(byte tag, byte[] bval) {
-        mParams.put(tag, bval);
-    }
-
-    public byte getByte(byte tag) {
-        byte[] bval = mParams.get(tag);
-
-        if (bval == null || bval.length < 1) {
-            return 0;
-        }
-
-        return ByteBuffer.wrap(bval).get();
-    }
-
-    public short getShort(byte tag) {
-        byte[] bval = mParams.get(tag);
-
-        if (bval == null || bval.length < 2) {
-            return 0;
-        }
-
-        return ByteBuffer.wrap(bval).getShort();
-    }
-
-    public int getInt(byte tag) {
-        byte[] bval = mParams.get(tag);
-
-        if (bval == null || bval.length < 4) {
-            return 0;
-        }
-
-        return ByteBuffer.wrap(bval).getInt();
-    }
-
-    public String getString(byte tag) {
-        byte[] bval = mParams.get(tag);
-
-        if (bval == null) {
-            return null;
-        }
-
-        return new String(bval);
-    }
-
-    public byte[] getByteArray(byte tag) {
-        byte[] bval = mParams.get(tag);
-
-        return bval;
-    }
-
-    @Override
-    public String toString() {
-        return mParams.toString();
-    }
-}
diff --git a/android/app/src/com/android/bluetooth/mapclient/obex/RequestGetFolderListing.java b/android/app/src/com/android/bluetooth/mapclient/obex/RequestGetFolderListing.java
index fa7f2a1..bad6a91 100644
--- a/android/app/src/com/android/bluetooth/mapclient/obex/RequestGetFolderListing.java
+++ b/android/app/src/com/android/bluetooth/mapclient/obex/RequestGetFolderListing.java
@@ -16,6 +16,7 @@
 
 package com.android.bluetooth.mapclient;
 
+import com.android.bluetooth.ObexAppParameters;
 import com.android.obex.ClientSession;
 import com.android.obex.HeaderSet;
 
diff --git a/android/app/src/com/android/bluetooth/mapclient/obex/RequestGetMessage.java b/android/app/src/com/android/bluetooth/mapclient/obex/RequestGetMessage.java
index baf5c4a..cf8a48a 100644
--- a/android/app/src/com/android/bluetooth/mapclient/obex/RequestGetMessage.java
+++ b/android/app/src/com/android/bluetooth/mapclient/obex/RequestGetMessage.java
@@ -24,6 +24,7 @@
 
 import android.util.Log;
 
+import com.android.bluetooth.ObexAppParameters;
 import com.android.obex.ClientSession;
 import com.android.obex.HeaderSet;
 import com.android.obex.ResponseCodes;
diff --git a/android/app/src/com/android/bluetooth/mapclient/obex/RequestGetMessagesListing.java b/android/app/src/com/android/bluetooth/mapclient/obex/RequestGetMessagesListing.java
index 71de6f1..fcffb24 100644
--- a/android/app/src/com/android/bluetooth/mapclient/obex/RequestGetMessagesListing.java
+++ b/android/app/src/com/android/bluetooth/mapclient/obex/RequestGetMessagesListing.java
@@ -16,6 +16,7 @@
 
 package com.android.bluetooth.mapclient;
 
+import com.android.bluetooth.ObexAppParameters;
 import com.android.obex.ClientSession;
 import com.android.obex.HeaderSet;
 
diff --git a/android/app/src/com/android/bluetooth/mapclient/obex/RequestPushMessage.java b/android/app/src/com/android/bluetooth/mapclient/obex/RequestPushMessage.java
index d8a1128..07e0135 100644
--- a/android/app/src/com/android/bluetooth/mapclient/obex/RequestPushMessage.java
+++ b/android/app/src/com/android/bluetooth/mapclient/obex/RequestPushMessage.java
@@ -16,6 +16,7 @@
 
 package com.android.bluetooth.mapclient;
 
+import com.android.bluetooth.ObexAppParameters;
 import com.android.bluetooth.mapclient.MasClient.CharsetType;
 import com.android.internal.annotations.VisibleForTesting;
 import com.android.obex.ClientSession;
diff --git a/android/app/src/com/android/bluetooth/mapclient/obex/RequestSetMessageStatus.java b/android/app/src/com/android/bluetooth/mapclient/obex/RequestSetMessageStatus.java
index 3b50245..5de3074 100644
--- a/android/app/src/com/android/bluetooth/mapclient/obex/RequestSetMessageStatus.java
+++ b/android/app/src/com/android/bluetooth/mapclient/obex/RequestSetMessageStatus.java
@@ -18,6 +18,7 @@
 
 import android.util.Log;
 
+import com.android.bluetooth.ObexAppParameters;
 import com.android.obex.ClientSession;
 import com.android.obex.HeaderSet;
 
diff --git a/android/app/src/com/android/bluetooth/mapclient/obex/RequestSetNotificationRegistration.java b/android/app/src/com/android/bluetooth/mapclient/obex/RequestSetNotificationRegistration.java
index 7f6d211..9b25a52 100644
--- a/android/app/src/com/android/bluetooth/mapclient/obex/RequestSetNotificationRegistration.java
+++ b/android/app/src/com/android/bluetooth/mapclient/obex/RequestSetNotificationRegistration.java
@@ -17,6 +17,7 @@
 package com.android.bluetooth.mapclient;
 
 
+import com.android.bluetooth.ObexAppParameters;
 import com.android.obex.ClientSession;
 import com.android.obex.HeaderSet;
 
diff --git a/android/app/src/com/android/bluetooth/mcp/McpService.java b/android/app/src/com/android/bluetooth/mcp/McpService.java
index dca1c1d..e46c23a 100644
--- a/android/app/src/com/android/bluetooth/mcp/McpService.java
+++ b/android/app/src/com/android/bluetooth/mcp/McpService.java
@@ -18,6 +18,7 @@
 package com.android.bluetooth.mcp;
 
 import android.bluetooth.BluetoothDevice;
+import android.bluetooth.BluetoothProfile;
 import android.bluetooth.IBluetoothMcpServiceManager;
 import android.content.AttributionSource;
 import android.os.Handler;
@@ -27,6 +28,7 @@
 
 import com.android.bluetooth.Utils;
 import com.android.bluetooth.btservice.ProfileService;
+import com.android.bluetooth.le_audio.LeAudioService;
 import com.android.internal.annotations.GuardedBy;
 import com.android.internal.annotations.VisibleForTesting;
 
@@ -182,6 +184,7 @@
             return;
         }
         Log.w(TAG, "onDeviceUnauthorized - authorization notification not implemented yet ");
+        setDeviceAuthorized(device, false);
     }
 
     public void setDeviceAuthorized(BluetoothDevice device, boolean isAuthorized) {
@@ -199,10 +202,34 @@
     }
 
     public int getDeviceAuthorization(BluetoothDevice device) {
-        // TODO: For now just reject authorization for other than LeAudio device already authorized
-        // except for PTS. Consider intent based authorization mechanism for non-LeAudio devices.
-        return mDeviceAuthorizations.getOrDefault(device, Utils.isPtsTestMode()
+        /* Media control is allowed for
+         * 1. in PTS mode
+         * 2. authorized devices
+         * 3. Any LeAudio devices which are allowed to connect
+         */
+        int authorization = mDeviceAuthorizations.getOrDefault(device, Utils.isPtsTestMode()
                 ? BluetoothDevice.ACCESS_ALLOWED : BluetoothDevice.ACCESS_UNKNOWN);
+        if (authorization != BluetoothDevice.ACCESS_UNKNOWN) {
+            return authorization;
+        }
+
+        LeAudioService leAudioService = LeAudioService.getLeAudioService();
+        if (leAudioService == null) {
+            Log.e(TAG, "MCS access not permited. LeAudioService not available");
+            return BluetoothDevice.ACCESS_UNKNOWN;
+        }
+
+        if (leAudioService.getConnectionPolicy(device)
+                > BluetoothProfile.CONNECTION_POLICY_FORBIDDEN) {
+            if (DBG) {
+                Log.d(TAG, "MCS authorization allowed based on supported LeAudio service");
+            }
+            setDeviceAuthorized(device, true);
+            return BluetoothDevice.ACCESS_ALLOWED;
+        }
+
+        Log.e(TAG, "MCS access not permited");
+        return BluetoothDevice.ACCESS_UNKNOWN;
     }
 
     @GuardedBy("mLock")
diff --git a/android/app/src/com/android/bluetooth/mcp/MediaControlGattService.java b/android/app/src/com/android/bluetooth/mcp/MediaControlGattService.java
index 8135fe0..cbf41a6 100644
--- a/android/app/src/com/android/bluetooth/mcp/MediaControlGattService.java
+++ b/android/app/src/com/android/bluetooth/mcp/MediaControlGattService.java
@@ -17,6 +17,7 @@
 
 package com.android.bluetooth.mcp;
 
+import static android.bluetooth.BluetoothDevice.METADATA_GMCS_CCCD;
 import static android.bluetooth.BluetoothGattCharacteristic.PERMISSION_READ_ENCRYPTED;
 import static android.bluetooth.BluetoothGattCharacteristic.PERMISSION_WRITE_ENCRYPTED;
 import static android.bluetooth.BluetoothGattCharacteristic.PROPERTY_NOTIFY;
@@ -28,6 +29,7 @@
 
 import android.annotation.NonNull;
 import android.annotation.Nullable;
+import android.bluetooth.BluetoothAdapter;
 import android.bluetooth.BluetoothDevice;
 import android.bluetooth.BluetoothGatt;
 import android.bluetooth.BluetoothGattCharacteristic;
@@ -37,12 +39,17 @@
 import android.bluetooth.BluetoothGattService;
 import android.bluetooth.BluetoothManager;
 import android.bluetooth.BluetoothProfile;
+import android.bluetooth.IBluetoothManager;
+import android.bluetooth.IBluetoothStateChangeCallback;
 import android.content.Context;
 import android.os.Handler;
 import android.os.Looper;
+import android.os.ParcelUuid;
+import android.os.RemoteException;
 import android.util.Log;
 import android.util.Pair;
 
+import com.android.bluetooth.Utils;
 import com.android.bluetooth.a2dp.A2dpService;
 import com.android.bluetooth.btservice.AdapterService;
 import com.android.bluetooth.hearingaid.HearingAidService;
@@ -337,16 +344,18 @@
             Log.d(TAG, "onUnauthorizedGattOperation device: " + device);
         }
 
-        List<GattOpContext> operations = mPendingGattOperations.get(device);
-        if (operations == null) {
-            operations = new ArrayList<>();
-            mPendingGattOperations.put(device, operations);
-        }
+        synchronized (mPendingGattOperations) {
+            List<GattOpContext> operations = mPendingGattOperations.get(device);
+            if (operations == null) {
+                operations = new ArrayList<>();
+                mPendingGattOperations.put(device, operations);
+            }
 
-        operations.add(op);
-        // Send authorization request for each device only for it's first GATT request
-        if (operations.size() == 1) {
-            mMcpService.onDeviceUnauthorized(device);
+            operations.add(op);
+            // Send authorization request for each device only for it's first GATT request
+            if (operations.size() == 1) {
+                mMcpService.onDeviceUnauthorized(device);
+            }
         }
     }
 
@@ -439,7 +448,7 @@
                 } else {
                     status = BluetoothGatt.GATT_SUCCESS;
                     setCcc(device, op.mDescriptor.getCharacteristic().getUuid(), op.mOffset,
-                            op.mValue);
+                            op.mValue, true);
                 }
 
                 if (op.mResponseNeeded) {
@@ -454,9 +463,7 @@
     }
 
     private void onRejectedAuthorizationGattOperation(BluetoothDevice device, GattOpContext op) {
-        if (VDBG) {
-            Log.d(TAG, "onRejectedAuthorizationGattOperation device: " + device);
-        }
+        Log.w(TAG, "onRejectedAuthorizationGattOperation device: " + device);
 
         switch (op.mOperation) {
             case READ_CHARACTERISTIC:
@@ -496,7 +503,9 @@
             Log.d(TAG, "ClearUnauthorizedGattOperations device: " + device);
         }
 
-        mPendingGattOperations.remove(device);
+        synchronized (mPendingGattOperations) {
+            mPendingGattOperations.remove(device);
+        }
     }
 
     private void ProcessPendingGattOperations(BluetoothDevice device) {
@@ -504,21 +513,50 @@
             Log.d(TAG, "ProcessPendingGattOperations device: " + device);
         }
 
-        if (mPendingGattOperations.containsKey(device)) {
-            if (getDeviceAuthorization(device) == BluetoothDevice.ACCESS_ALLOWED) {
-                for (GattOpContext op : mPendingGattOperations.get(device)) {
-                    onAuthorizedGattOperation(device, op);
+        synchronized (mPendingGattOperations) {
+            if (mPendingGattOperations.containsKey(device)) {
+                if (getDeviceAuthorization(device) == BluetoothDevice.ACCESS_ALLOWED) {
+                    for (GattOpContext op : mPendingGattOperations.get(device)) {
+                        onAuthorizedGattOperation(device, op);
+                    }
+                } else {
+                    for (GattOpContext op : mPendingGattOperations.get(device)) {
+                        onRejectedAuthorizationGattOperation(device, op);
+                    }
                 }
-            } else {
-                for (GattOpContext op : mPendingGattOperations.get(device)) {
-                    onRejectedAuthorizationGattOperation(device, op);
-                }
+                ClearUnauthorizedGattOperations(device);
             }
-
-            ClearUnauthorizedGattOperations(device);
         }
     }
 
+    private void restoreCccValuesForStoredDevices() {
+        for (BluetoothDevice device : mAdapterService.getBondedDevices()) {
+            byte[] gmcs_cccd = device.getMetadata(METADATA_GMCS_CCCD);
+
+            if ((gmcs_cccd == null) || (gmcs_cccd.length == 0)) {
+                return;
+            }
+
+            List<ParcelUuid> uuidList = Arrays.asList(Utils.byteArrayToUuid(gmcs_cccd));
+
+            /* Restore CCCD values for device */
+            for (ParcelUuid uuid : uuidList) {
+                setCcc(device, uuid.getUuid(), 0,
+                        BluetoothGattDescriptor.ENABLE_NOTIFICATION_VALUE, false);
+            }
+        }
+    }
+
+    private final IBluetoothStateChangeCallback mBluetoothStateChangeCallback =
+            new IBluetoothStateChangeCallback.Stub() {
+                public void onBluetoothStateChange(boolean up) {
+                    if (DBG) Log.d(TAG, "onBluetoothStateChange: up=" + up);
+                    if (up) {
+                        restoreCccValuesForStoredDevices();
+                    }
+                }
+            };
+
     @VisibleForTesting
     final BluetoothGattServerCallback mServerCallback = new BluetoothGattServerCallback() {
         @Override
@@ -548,6 +586,7 @@
 
             mCharacteristics.get(CharId.CONTENT_CONTROL_ID)
                     .setValue(mCcid, BluetoothGattCharacteristic.FORMAT_UINT8, 0);
+            restoreCccValuesForStoredDevices();
             setInitialCharacteristicValuesAndNotify();
             initialStateRequest();
         }
@@ -558,7 +597,7 @@
             super.onCharacteristicReadRequest(device, requestId, offset, characteristic);
             if (VDBG) {
                 Log.d(TAG, "BluetoothGattServerCallback: onCharacteristicReadRequest offset= "
-                        + offset + " entire value= " + characteristic.getValue());
+                        + offset + " entire value= " + Arrays.toString(characteristic.getValue()));
             }
 
             if ((characteristic.getProperties() & PROPERTY_READ) == 0) {
@@ -793,6 +832,15 @@
         mMcpService = mcpService;
         mAdapterService =  Objects.requireNonNull(AdapterService.getAdapterService(),
                 "AdapterService shouldn't be null when creating MediaControlCattService");
+
+        IBluetoothManager mgr = BluetoothAdapter.getDefaultAdapter().getBluetoothManager();
+        if (mgr != null) {
+            try {
+                mgr.registerStateChangeCallback(mBluetoothStateChangeCallback);
+            } catch (RemoteException e) {
+                throw e.rethrowFromSystemServer();
+            }
+        }
     }
 
     protected boolean init(UUID scvUuid) {
@@ -846,16 +894,13 @@
 
     @VisibleForTesting
     int handleMediaControlPointRequest(BluetoothDevice device, byte[] value) {
-        if (DBG) {
-            Log.d(TAG, "handleMediaControlPointRequest");
-        }
-
         final int payloadOffset = 1;
         final int opcode = value[0];
 
         // Test for RFU bits and currently supported opcodes
         if (!isOpcodeSupported(opcode)) {
-            Log.e(TAG, "handleMediaControlPointRequest: opcode or feature not supported");
+            Log.i(TAG, "handleMediaControlPointRequest: " + Request.Opcodes.toString(opcode)
+                     + " not supported");
             mHandler.post(() -> {
                 setMediaControlRequestResult(new Request(opcode, 0),
                         Request.Results.OPCODE_NOT_SUPPORTED);
@@ -864,6 +909,8 @@
         }
 
         if (getMediaControlPointRequestPayloadLength(opcode) != (value.length - payloadOffset)) {
+            Log.w(TAG, "handleMediaControlPointRequest: " + Request.Opcodes.toString(opcode)
+                    + " bad payload length");
             return BluetoothGatt.GATT_INVALID_ATTRIBUTE_LENGTH;
         }
 
@@ -885,8 +932,9 @@
 
         Request req = new Request(opcode, intVal);
 
-        if (VDBG) {
-            Log.d(TAG, "handleMediaControlPointRequest: sending request up");
+        if (DBG) {
+            Log.d(TAG, "handleMediaControlPointRequest: sending " + Request.Opcodes.toString(opcode)
+                    + " request up");
         }
 
         if (req.getOpcode() == Request.Opcodes.PLAY) {
@@ -984,16 +1032,77 @@
         return mBluetoothGattServer.addService(mGattService);
     }
 
+    private void removeUuidFromMetadata(ParcelUuid charUuid, BluetoothDevice device) {
+        List<ParcelUuid> uuidList;
+        byte[] gmcs_cccd = device.getMetadata(METADATA_GMCS_CCCD);
+
+        if ((gmcs_cccd == null) || (gmcs_cccd.length == 0)) {
+            uuidList = new ArrayList<ParcelUuid>();
+        } else {
+            uuidList = new ArrayList<>(Arrays.asList(Utils.byteArrayToUuid(gmcs_cccd)));
+
+            if (!uuidList.contains(charUuid)) {
+                Log.d(TAG, "Characteristic CCCD can't be removed (not cached): "
+                        + charUuid.toString());
+                return;
+            }
+        }
+
+        uuidList.remove(charUuid);
+
+        if (!device.setMetadata(METADATA_GMCS_CCCD,
+                Utils.uuidsToByteArray(uuidList.toArray(new ParcelUuid[0])))) {
+            Log.e(TAG, "Can't set CCCD for GMCS characteristic UUID: " + charUuid.toString()
+                    + ", (remove)");
+        }
+    }
+
+    private void addUuidToMetadata(ParcelUuid charUuid, BluetoothDevice device) {
+        List<ParcelUuid> uuidList;
+        byte[] gmcs_cccd = device.getMetadata(METADATA_GMCS_CCCD);
+
+        if ((gmcs_cccd == null) || (gmcs_cccd.length == 0)) {
+            uuidList = new ArrayList<ParcelUuid>();
+        } else {
+            uuidList = new ArrayList<>(Arrays.asList(Utils.byteArrayToUuid(gmcs_cccd)));
+
+            if (uuidList.contains(charUuid)) {
+                Log.d(TAG, "Characteristic CCCD already added: " + charUuid.toString());
+                return;
+            }
+        }
+
+        uuidList.add(charUuid);
+
+        if (!device.setMetadata(METADATA_GMCS_CCCD,
+                Utils.uuidsToByteArray(uuidList.toArray(new ParcelUuid[0])))) {
+            Log.e(TAG, "Can't set CCCD for GMCS characteristic UUID: " + charUuid.toString()
+                    + ", (add)");
+        }
+    }
+
     @VisibleForTesting
-    void setCcc(BluetoothDevice device, UUID charUuid, int offset, byte[] value) {
+    void setCcc(BluetoothDevice device, UUID charUuid, int offset, byte[] value, boolean store) {
         HashMap<UUID, Short> characteristicCcc = mCccDescriptorValues.get(device.getAddress());
         if (characteristicCcc == null) {
             characteristicCcc = new HashMap<>();
             mCccDescriptorValues.put(device.getAddress(), characteristicCcc);
         }
 
-        characteristicCcc.put(
-                charUuid, ByteBuffer.wrap(value).order(ByteOrder.LITTLE_ENDIAN).getShort());
+        characteristicCcc.put(charUuid,
+                ByteBuffer.wrap(value).order(ByteOrder.LITTLE_ENDIAN).getShort());
+
+        if (!store) {
+            return;
+        }
+
+        if (Arrays.equals(value, BluetoothGattDescriptor.ENABLE_NOTIFICATION_VALUE)) {
+            addUuidToMetadata(new ParcelUuid(charUuid), device);
+        } else if (Arrays.equals(value, BluetoothGattDescriptor.DISABLE_NOTIFICATION_VALUE)) {
+            removeUuidFromMetadata(new ParcelUuid(charUuid), device);
+        } else {
+            Log.e(TAG, "Not handled CCC value: " + Arrays.toString(value));
+        }
     }
 
     private byte[] getCccBytes(BluetoothDevice device, UUID charUuid) {
@@ -1278,12 +1387,18 @@
         if (DBG) {
             Log.d(TAG, "Destroy");
         }
-        if (mBluetoothGattServer != null
-                && mBluetoothGattServer.removeService(mGattService)) {
+
+        if (mBluetoothGattServer == null) {
+            return;
+        }
+
+        if (mBluetoothGattServer.removeService(mGattService)) {
             if (mCallbacks != null) {
                 mCallbacks.onServiceInstanceUnregistered(ServiceStatus.OK);
             }
         }
+
+        mBluetoothGattServer.close();
     }
 
     @VisibleForTesting
@@ -1626,7 +1741,8 @@
 
     private boolean isFeatureSupported(long featureBit) {
         if (DBG) {
-            Log.w(TAG, "Feature " + featureBit + " support: " + ((mFeatures & featureBit) != 0));
+            Log.w(TAG, "Feature " + ServiceFeature.toString(featureBit) + " support: "
+                    + ((mFeatures & featureBit) != 0));
         }
         return (mFeatures & featureBit) != 0;
     }
diff --git a/android/app/src/com/android/bluetooth/mcp/Request.java b/android/app/src/com/android/bluetooth/mcp/Request.java
index 0aa0d37..c100a6b 100644
--- a/android/app/src/com/android/bluetooth/mcp/Request.java
+++ b/android/app/src/com/android/bluetooth/mcp/Request.java
@@ -130,6 +130,55 @@
         public static final int FIRST_GROUP = 0x42;
         public static final int LAST_GROUP = 0x43;
         public static final int GOTO_GROUP = 0x44;
+
+        static String toString(int opcode) {
+            switch(opcode) {
+                case 0x01:
+                    return "PLAY(0x01)";
+                case 0x02:
+                    return "PAUSE(0x02)";
+                case 0x03:
+                    return "FAST_REWIND(0x03)";
+                case 0x04:
+                    return "FAST_FORWARD(0x04)";
+                case 0x05:
+                    return "STOP(0x05)";
+                case 0x10:
+                    return "MOVE_RELATIVE(0x10)";
+                case 0x20:
+                    return "PREVIOUS_SEGMENT(0x20)";
+                case 0x21:
+                    return "NEXT_SEGMENT(0x21)";
+                case 0x22:
+                    return "FIRST_SEGMENT(0x22)";
+                case 0x23:
+                    return "LAST_SEGMENT(0x23)";
+                case 0x24:
+                    return "GOTO_SEGMENT(0x24)";
+                case 0x30:
+                    return "PREVIOUS_TRACK(0x30)";
+                case 0x31:
+                    return "NEXT_TRACK(0x31)";
+                case 0x32:
+                    return "FIRST_TRACK(0x32)";
+                case 0x33:
+                    return "LAST_TRACK(0x33)";
+                case 0x34:
+                    return "GOTO_TRACK(0x34)";
+                case 0x40:
+                    return "PREVIOUS_GROUP(0x40)";
+                case 0x41:
+                    return "NEXT_GROUP(0x41)";
+                case 0x42:
+                    return "FIRST_GROUP(0x42)";
+                case 0x43:
+                    return "LAST_GROUP(0x43)";
+                case 0x44:
+                    return "GOTO_GROUP(0x44)";
+                default:
+                    return "UNKNOWN(0x" + Integer.toHexString(opcode) + ")";
+            }
+        }
     }
 
     /* Map opcodes which are written to 'Media Control Point' characteristics to their corresponding
diff --git a/android/app/src/com/android/bluetooth/mcp/ServiceFeature.java b/android/app/src/com/android/bluetooth/mcp/ServiceFeature.java
index 4e54d78..c515761 100644
--- a/android/app/src/com/android/bluetooth/mcp/ServiceFeature.java
+++ b/android/app/src/com/android/bluetooth/mcp/ServiceFeature.java
@@ -64,4 +64,43 @@
     // Table 3.1.
     public static final long ALL_MANDATORY_SERVICE_FEATURES = PLAYER_NAME | TRACK_CHANGED
             | TRACK_TITLE | TRACK_DURATION | TRACK_POSITION | MEDIA_STATE | CONTENT_CONTROL_ID;
+
+    static String toString(long serviceFeature) {
+        if (serviceFeature == PLAYER_NAME) return "PLAYER_NAME(BIT 1)";
+        if (serviceFeature == PLAYER_ICON_OBJ_ID) return "PLAYER_ICON_OBJ_ID(BIT 2)";
+        if (serviceFeature == PLAYER_ICON_URL) return "PLAYER_ICON_URL(BIT 3)";
+        if (serviceFeature == TRACK_CHANGED) return "TRACK_CHANGED(BIT 4)";
+        if (serviceFeature == TRACK_TITLE) return "TRACK_TITLE(BIT 5)";
+        if (serviceFeature == TRACK_DURATION) return "TRACK_DURATION(BIT 6)";
+        if (serviceFeature == TRACK_POSITION) return "TRACK_POSITION(BIT 7)";
+        if (serviceFeature == PLAYBACK_SPEED) return "PLAYBACK_SPEED(BIT 8)";
+        if (serviceFeature == SEEKING_SPEED) return "SEEKING_SPEED(BIT 9)";
+        if (serviceFeature == CURRENT_TRACK_SEGMENT_OBJ_ID) return "CURRENT_TRACK_SEGMENT_OBJ_ID(BIT 10)";
+        if (serviceFeature == CURRENT_TRACK_OBJ_ID) return "CURRENT_TRACK_OBJ_ID(BIT 11)";
+        if (serviceFeature == NEXT_TRACK_OBJ_ID) return "NEXT_TRACK_OBJ_ID(BIT 12)";
+        if (serviceFeature == CURRENT_GROUP_OBJ_ID) return "CURRENT_GROUP_OBJ_ID(BIT 13)";
+        if (serviceFeature == PARENT_GROUP_OBJ_ID) return "PARENT_GROUP_OBJ_ID(BIT 14)";
+        if (serviceFeature == PLAYING_ORDER) return "PLAYING_ORDER(BIT 15)";
+        if (serviceFeature == PLAYING_ORDER_SUPPORTED) return "PLAYING_ORDER_SUPPORTED(BIT 16)";
+        if (serviceFeature == MEDIA_STATE) return "MEDIA_STATE(BIT 17)";
+        if (serviceFeature == MEDIA_CONTROL_POINT) return "MEDIA_CONTROL_POINT(BIT 18)";
+        if (serviceFeature == MEDIA_CONTROL_POINT_OPCODES_SUPPORTED) return "MEDIA_CONTROL_POINT_OPCODES_SUPPORTED(BIT 19)";
+        if (serviceFeature == SEARCH_RESULT_OBJ_ID) return "SEARCH_RESULT_OBJ_ID(BIT 20)";
+        if (serviceFeature == SEARCH_CONTROL_POINT) return "SEARCH_CONTROL_POINT(BIT 21)";
+        if (serviceFeature == CONTENT_CONTROL_ID) return "CONTENT_CONTROL_ID(BIT 22)";
+        if (serviceFeature == PLAYER_NAME_NOTIFY) return "PLAYER_NAME_NOTIFY";
+        if (serviceFeature == TRACK_TITLE_NOTIFY) return "TRACK_TITLE_NOTIFY";
+        if (serviceFeature == TRACK_DURATION_NOTIFY) return "TRACK_DURATION_NOTIFY";
+        if (serviceFeature == TRACK_POSITION_NOTIFY) return "TRACK_POSITION_NOTIFY";
+        if (serviceFeature == PLAYBACK_SPEED_NOTIFY) return "PLAYBACK_SPEED_NOTIFY";
+        if (serviceFeature == SEEKING_SPEED_NOTIFY) return "SEEKING_SPEED_NOTIFY";
+        if (serviceFeature == CURRENT_TRACK_OBJ_ID_NOTIFY) return "CURRENT_TRACK_OBJ_ID_NOTIFY";
+        if (serviceFeature == NEXT_TRACK_OBJ_ID_NOTIFY) return "NEXT_TRACK_OBJ_ID_NOTIFY";
+        if (serviceFeature == CURRENT_GROUP_OBJ_ID_NOTIFY) return "CURRENT_GROUP_OBJ_ID_NOTIFY";
+        if (serviceFeature == PARENT_GROUP_OBJ_ID_NOTIFY) return "PARENT_GROUP_OBJ_ID_NOTIFY";
+        if (serviceFeature == PLAYING_ORDER_NOTIFY) return "PLAYING_ORDER_NOTIFY";
+        if (serviceFeature == MEDIA_CONTROL_POINT_OPCODES_SUPPORTED_NOTIFY) return "MEDIA_CONTROL_POINT_OPCODES_SUPPORTED_NOTIFY";
+
+        return "UNKNOWN(0x" + Long.toHexString(serviceFeature) + ")";
+    }
 }
diff --git a/android/app/src/com/android/bluetooth/opp/BluetoothOppBatch.java b/android/app/src/com/android/bluetooth/opp/BluetoothOppBatch.java
index ef2502e..dff6fff 100644
--- a/android/app/src/com/android/bluetooth/opp/BluetoothOppBatch.java
+++ b/android/app/src/com/android/bluetooth/opp/BluetoothOppBatch.java
@@ -37,6 +37,8 @@
 import android.content.Context;
 import android.util.Log;
 
+import com.android.bluetooth.BluetoothMethodProxy;
+
 import java.util.ArrayList;
 
 /**
@@ -148,7 +150,9 @@
 
             if (info.mStatus < 200) {
                 if (info.mDirection == BluetoothShare.DIRECTION_INBOUND && info.mUri != null) {
-                    mContext.getContentResolver().delete(info.mUri, null, null);
+                    BluetoothMethodProxy.getInstance().contentResolverDelete(
+                            mContext.getContentResolver(), info.mUri, null, null
+                    );
                 }
                 if (V) {
                     Log.v(TAG, "Cancel batch for info " + info.mId);
@@ -180,7 +184,7 @@
      */
 
     /** register a listener for the batch change */
-    public void registerListern(BluetoothOppBatchListener listener) {
+    public void registerListener(BluetoothOppBatchListener listener) {
         mListener = listener;
     }
 
diff --git a/android/app/src/com/android/bluetooth/opp/BluetoothOppBtEnableActivity.java b/android/app/src/com/android/bluetooth/opp/BluetoothOppBtEnableActivity.java
index a65eaa6..f6f5d75 100644
--- a/android/app/src/com/android/bluetooth/opp/BluetoothOppBtEnableActivity.java
+++ b/android/app/src/com/android/bluetooth/opp/BluetoothOppBtEnableActivity.java
@@ -41,13 +41,16 @@
 import android.widget.TextView;
 import android.widget.Toast;
 
+import androidx.annotation.VisibleForTesting;
+
 import com.android.bluetooth.R;
 
 /**
  * This class is designed to show BT enable confirmation dialog;
  */
 public class BluetoothOppBtEnableActivity extends AlertActivity {
-    private BluetoothOppManager mOppManager;
+    @VisibleForTesting
+    BluetoothOppManager mOppManager;
 
     @Override
     protected void onCreate(Bundle savedInstanceState) {
diff --git a/android/app/src/com/android/bluetooth/opp/BluetoothOppBtEnablingActivity.java b/android/app/src/com/android/bluetooth/opp/BluetoothOppBtEnablingActivity.java
index 7ca5c49..4b173fd 100644
--- a/android/app/src/com/android/bluetooth/opp/BluetoothOppBtEnablingActivity.java
+++ b/android/app/src/com/android/bluetooth/opp/BluetoothOppBtEnablingActivity.java
@@ -48,7 +48,9 @@
 import android.view.View;
 import android.widget.TextView;
 
+import com.android.bluetooth.BluetoothMethodProxy;
 import com.android.bluetooth.R;
+import com.android.internal.annotations.VisibleForTesting;
 
 /**
  * This class is designed to show BT enabling progress.
@@ -62,7 +64,8 @@
 
     private static final int BT_ENABLING_TIMEOUT = 0;
 
-    private static final int BT_ENABLING_TIMEOUT_VALUE = 20000;
+    @VisibleForTesting
+    static int sBtEnablingTimeoutMs = 20000;
 
     private boolean mRegistered = false;
 
@@ -73,7 +76,7 @@
         getWindow().addSystemFlags(SYSTEM_FLAG_HIDE_NON_SYSTEM_OVERLAY_WINDOWS);
         // If BT is already enabled jus return.
         BluetoothAdapter adapter = BluetoothAdapter.getDefaultAdapter();
-        if (adapter.isEnabled()) {
+        if (BluetoothMethodProxy.getInstance().bluetoothAdapterIsEnabled(adapter)) {
             finish();
             return;
         }
@@ -88,7 +91,7 @@
 
         // Add timeout for enabling progress
         mTimeoutHandler.sendMessageDelayed(mTimeoutHandler.obtainMessage(BT_ENABLING_TIMEOUT),
-                BT_ENABLING_TIMEOUT_VALUE);
+                sBtEnablingTimeoutMs);
     }
 
     private View createView() {
@@ -119,7 +122,8 @@
         }
     }
 
-    private final Handler mTimeoutHandler = new Handler() {
+    @VisibleForTesting
+    final Handler mTimeoutHandler = new Handler() {
         @Override
         public void handleMessage(Message msg) {
             switch (msg.what) {
@@ -135,7 +139,8 @@
         }
     };
 
-    private final BroadcastReceiver mBluetoothReceiver = new BroadcastReceiver() {
+    @VisibleForTesting
+    final BroadcastReceiver mBluetoothReceiver = new BroadcastReceiver() {
         @Override
         public void onReceive(Context context, Intent intent) {
             String action = intent.getAction();
diff --git a/android/app/src/com/android/bluetooth/opp/BluetoothOppHandoverReceiver.java b/android/app/src/com/android/bluetooth/opp/BluetoothOppHandoverReceiver.java
index 6205408..9bbd4c1 100644
--- a/android/app/src/com/android/bluetooth/opp/BluetoothOppHandoverReceiver.java
+++ b/android/app/src/com/android/bluetooth/opp/BluetoothOppHandoverReceiver.java
@@ -23,6 +23,8 @@
 import android.net.Uri;
 import android.util.Log;
 
+import com.android.bluetooth.BluetoothMethodProxy;
+
 import java.util.ArrayList;
 
 public class BluetoothOppHandoverReceiver extends BroadcastReceiver {
@@ -78,13 +80,13 @@
         } else if (action.equals(Constants.ACTION_ACCEPTLIST_DEVICE)) {
             BluetoothDevice device =
                     (BluetoothDevice) intent.getParcelableExtra(BluetoothDevice.EXTRA_DEVICE);
-            if (D) {
-                Log.d(TAG, "Adding " + device + " to acceptlist");
-            }
             if (device == null) {
                 return;
             }
-            BluetoothOppManager.getInstance(context).addToAcceptlist(device.getAddress());
+            if (D) {
+                Log.d(TAG, "Adding " + device.getIdentityAddress() + " to acceptlist");
+            }
+            BluetoothOppManager.getInstance(context).addToAcceptlist(device.getIdentityAddress());
         } else if (action.equals(Constants.ACTION_STOP_HANDOVER)) {
             int id = intent.getIntExtra(Constants.EXTRA_BT_OPP_TRANSFER_ID, -1);
             if (id != -1) {
@@ -93,7 +95,8 @@
                 if (D) {
                     Log.d(TAG, "Stopping handover transfer with Uri " + contentUri);
                 }
-                context.getContentResolver().delete(contentUri, null, null);
+                BluetoothMethodProxy.getInstance().contentResolverDelete(
+                        context.getContentResolver(), contentUri, null, null);
             }
         } else {
             if (D) {
diff --git a/android/app/src/com/android/bluetooth/opp/BluetoothOppIncomingFileConfirmActivity.java b/android/app/src/com/android/bluetooth/opp/BluetoothOppIncomingFileConfirmActivity.java
index 73e87b8..9196216 100644
--- a/android/app/src/com/android/bluetooth/opp/BluetoothOppIncomingFileConfirmActivity.java
+++ b/android/app/src/com/android/bluetooth/opp/BluetoothOppIncomingFileConfirmActivity.java
@@ -52,6 +52,7 @@
 import android.widget.TextView;
 import android.widget.Toast;
 
+import com.android.bluetooth.BluetoothMethodProxy;
 import com.android.bluetooth.R;
 
 /**
@@ -76,15 +77,7 @@
 
     private boolean mTimeout = false;
 
-    private BroadcastReceiver mReceiver = new BroadcastReceiver() {
-        @Override
-        public void onReceive(Context context, Intent intent) {
-            if (!BluetoothShare.USER_CONFIRMATION_TIMEOUT_ACTION.equals(intent.getAction())) {
-                return;
-            }
-            onTimeout();
-        }
-    };
+    private BroadcastReceiver mReceiver = null;
 
     @Override
     protected void onCreate(Bundle savedInstanceState) {
@@ -126,6 +119,15 @@
             Log.v(TAG, "BluetoothIncomingFileConfirmActivity: Got uri:" + mUri);
         }
 
+        mReceiver = new BroadcastReceiver() {
+            @Override
+            public void onReceive(Context context, Intent intent) {
+                if (!BluetoothShare.USER_CONFIRMATION_TIMEOUT_ACTION.equals(intent.getAction())) {
+                    return;
+                }
+                onTimeout();
+            }
+        };
         registerReceiver(mReceiver,
                 new IntentFilter(BluetoothShare.USER_CONFIRMATION_TIMEOUT_ACTION));
     }
@@ -154,7 +156,8 @@
             mUpdateValues = new ContentValues();
             mUpdateValues.put(BluetoothShare.USER_CONFIRMATION,
                     BluetoothShare.USER_CONFIRMATION_CONFIRMED);
-            this.getContentResolver().update(mUri, mUpdateValues, null, null);
+            BluetoothMethodProxy.getInstance().contentResolverUpdate(this.getContentResolver(),
+                    mUri, mUpdateValues, null, null);
 
             Toast.makeText(this, getString(R.string.bt_toast_1), Toast.LENGTH_SHORT).show();
         }
@@ -165,7 +168,8 @@
         mUpdateValues = new ContentValues();
         mUpdateValues.put(BluetoothShare.USER_CONFIRMATION,
                 BluetoothShare.USER_CONFIRMATION_DENIED);
-        this.getContentResolver().update(mUri, mUpdateValues, null, null);
+        BluetoothMethodProxy.getInstance().contentResolverUpdate(this.getContentResolver(),
+                mUri, mUpdateValues, null, null);
     }
 
     @Override
@@ -183,7 +187,9 @@
     @Override
     protected void onDestroy() {
         super.onDestroy();
-        unregisterReceiver(mReceiver);
+        if (mReceiver != null) {
+            unregisterReceiver(mReceiver);
+        }
     }
 
     @Override
diff --git a/android/app/src/com/android/bluetooth/opp/BluetoothOppLauncherActivity.java b/android/app/src/com/android/bluetooth/opp/BluetoothOppLauncherActivity.java
index c29ee86..b5dd0f7 100644
--- a/android/app/src/com/android/bluetooth/opp/BluetoothOppLauncherActivity.java
+++ b/android/app/src/com/android/bluetooth/opp/BluetoothOppLauncherActivity.java
@@ -46,7 +46,10 @@
 import android.util.Patterns;
 import android.widget.Toast;
 
+import com.android.bluetooth.BluetoothMethodProxy;
 import com.android.bluetooth.R;
+import com.android.bluetooth.Utils;
+import com.android.internal.annotations.VisibleForTesting;
 
 import java.io.File;
 import java.io.FileNotFoundException;
@@ -133,7 +136,7 @@
                                 "Get ACTION_SEND intent with Extra_text = " + extraText.toString()
                                         + "; mimetype = " + type);
                     }
-                    final Uri fileUri = creatFileForSharedContent(
+                    final Uri fileUri = createFileForSharedContent(
                             this.createCredentialProtectedStorageContext(), extraText);
                     if (fileUri != null) {
                         Thread t = new Thread(new Runnable() {
@@ -193,15 +196,17 @@
             if (V) {
                 Log.v(TAG, "Get ACTION_OPEN intent: Uri = " + uri);
             }
-
             Intent intent1 = new Intent(Constants.ACTION_OPEN);
             intent1.setClassName(this, BluetoothOppReceiver.class.getName());
             intent1.setDataAndNormalize(uri);
-            this.sendBroadcast(intent1);
+            BluetoothMethodProxy.getInstance().contextSendBroadcast(this, intent1);
             finish();
         } else {
             Log.w(TAG, "Unsupported action: " + action);
-            finish();
+            // To prevent activity to finish immediately in testing mode
+            if (!Utils.isInstrumentationTestMode()) {
+                finish();
+            }
         }
     }
 
@@ -209,7 +214,8 @@
      * Turns on Bluetooth if not already on, or launches device picker if Bluetooth is on
      * @return
      */
-    private void launchDevicePicker() {
+    @VisibleForTesting
+    void launchDevicePicker() {
         // TODO: In the future, we may send intent to DevicePickerActivity
         // directly,
         // and let DevicePickerActivity to handle Bluetooth Enable.
@@ -274,7 +280,8 @@
         return false;
     }
 
-    private Uri creatFileForSharedContent(Context context, CharSequence shareContent) {
+    @VisibleForTesting
+    Uri createFileForSharedContent(Context context, CharSequence shareContent) {
         if (shareContent == null) {
             return null;
         }
@@ -406,7 +413,8 @@
         return text;
     }
 
-    private void sendFileInfo(String mimeType, String uriString, boolean isHandover,
+    @VisibleForTesting
+    void sendFileInfo(String mimeType, String uriString, boolean isHandover,
             boolean fromExternal) {
         BluetoothOppManager manager = BluetoothOppManager.getInstance(getApplicationContext());
         try {
@@ -414,7 +422,8 @@
             launchDevicePicker();
             finish();
         } catch (IllegalArgumentException exception) {
-            showToast(exception.getMessage());
+            String message = exception.getMessage();
+            showToast(message != null ? message : "IllegalArgumentException");
             finish();
         }
     }
diff --git a/android/app/src/com/android/bluetooth/opp/BluetoothOppManager.java b/android/app/src/com/android/bluetooth/opp/BluetoothOppManager.java
index a353d72..9b18f71 100644
--- a/android/app/src/com/android/bluetooth/opp/BluetoothOppManager.java
+++ b/android/app/src/com/android/bluetooth/opp/BluetoothOppManager.java
@@ -46,7 +46,9 @@
 import android.util.Log;
 import android.util.Pair;
 
+import com.android.bluetooth.BluetoothMethodProxy;
 import com.android.bluetooth.R;
+import com.android.internal.annotations.VisibleForTesting;
 
 import java.util.ArrayList;
 import java.util.Iterator;
@@ -61,7 +63,8 @@
     private static final String TAG = "BluetoothOppManager";
     private static final boolean V = Constants.VERBOSE;
 
-    private static BluetoothOppManager sInstance;
+    @VisibleForTesting
+    static BluetoothOppManager sInstance;
 
     /** Used when obtaining a reference to the singleton instance. */
     private static final Object INSTANCE_LOCK = new Object();
@@ -72,17 +75,22 @@
 
     private BluetoothAdapter mAdapter;
 
-    private String mMimeTypeOfSendingFile;
+    @VisibleForTesting
+    String mMimeTypeOfSendingFile;
 
-    private String mUriOfSendingFile;
+    @VisibleForTesting
+    String mUriOfSendingFile;
 
-    private String mMimeTypeOfSendingFiles;
+    @VisibleForTesting
+    String mMimeTypeOfSendingFiles;
 
-    private ArrayList<Uri> mUrisOfSendingFiles;
+    @VisibleForTesting
+    ArrayList<Uri> mUrisOfSendingFiles;
 
     private boolean mIsHandoverInitiated;
 
-    private static final String OPP_PREFERENCE_FILE = "OPPMGR";
+    @VisibleForTesting
+    static final String OPP_PREFERENCE_FILE = "OPPMGR";
 
     private static final String SENDING_FLAG = "SENDINGFLAG";
 
@@ -132,6 +140,14 @@
     }
 
     /**
+     * Set Singleton instance. Intended for testing purpose
+     */
+    @VisibleForTesting
+    static void setInstance(BluetoothOppManager instance) {
+        sInstance = instance;
+    }
+
+    /**
      * init
      */
     private boolean init(Context context) {
@@ -303,7 +319,7 @@
      */
     public boolean isEnabled() {
         if (mAdapter != null) {
-            return mAdapter.isEnabled();
+            return BluetoothMethodProxy.getInstance().bluetoothAdapterIsEnabled(mAdapter);
         } else {
             if (V) {
                 Log.v(TAG, "BLUETOOTH_SERVICE is not available! ");
@@ -470,14 +486,14 @@
                 }
 
                 values.put(BluetoothShare.MIMETYPE, contentType);
-                values.put(BluetoothShare.DESTINATION, mRemoteDevice.getAddress());
+                values.put(BluetoothShare.DESTINATION, mRemoteDevice.getIdentityAddress());
                 values.put(BluetoothShare.TIMESTAMP, ts);
                 if (mIsHandoverInitiated) {
                     values.put(BluetoothShare.USER_CONFIRMATION,
                             BluetoothShare.USER_CONFIRMATION_HANDOVER_CONFIRMED);
                 }
-                final Uri contentUri =
-                        mContext.getContentResolver().insert(BluetoothShare.CONTENT_URI, values);
+                final Uri contentUri = BluetoothMethodProxy.getInstance().contentResolverInsert(
+                        mContext.getContentResolver(), BluetoothShare.CONTENT_URI, values);
                 if (V) {
                     Log.v(TAG, "Insert contentUri: " + contentUri + "  to device: " + getDeviceName(
                             mRemoteDevice));
@@ -492,13 +508,13 @@
             ContentValues values = new ContentValues();
             values.put(BluetoothShare.URI, mUri);
             values.put(BluetoothShare.MIMETYPE, mTypeOfSingleFile);
-            values.put(BluetoothShare.DESTINATION, mRemoteDevice.getAddress());
+            values.put(BluetoothShare.DESTINATION, mRemoteDevice.getIdentityAddress());
             if (mIsHandoverInitiated) {
                 values.put(BluetoothShare.USER_CONFIRMATION,
                         BluetoothShare.USER_CONFIRMATION_HANDOVER_CONFIRMED);
             }
-            final Uri contentUri =
-                    mContext.getContentResolver().insert(BluetoothShare.CONTENT_URI, values);
+            final Uri contentUri = BluetoothMethodProxy.getInstance().contentResolverInsert(
+                    mContext.getContentResolver(), BluetoothShare.CONTENT_URI, values);
             if (V) {
                 Log.v(TAG, "Insert contentUri: " + contentUri + "  to device: " + getDeviceName(
                         mRemoteDevice));
diff --git a/android/app/src/com/android/bluetooth/opp/BluetoothOppNotification.java b/android/app/src/com/android/bluetooth/opp/BluetoothOppNotification.java
index 44a9c18..af138f2 100644
--- a/android/app/src/com/android/bluetooth/opp/BluetoothOppNotification.java
+++ b/android/app/src/com/android/bluetooth/opp/BluetoothOppNotification.java
@@ -48,9 +48,12 @@
 import android.text.format.Formatter;
 import android.util.Log;
 
+import com.android.bluetooth.BluetoothMethodProxy;
 import com.android.bluetooth.R;
 import com.android.bluetooth.Utils;
 
+import com.google.common.annotations.VisibleForTesting;
+
 import java.util.HashMap;
 
 /**
@@ -111,9 +114,11 @@
 
     public static final int NOTIFICATION_ID_PROGRESS = -1000004;
 
-    private static final int NOTIFICATION_ID_OUTBOUND_COMPLETE = -1000005;
+    @VisibleForTesting
+    static final int NOTIFICATION_ID_OUTBOUND_COMPLETE = -1000005;
 
-    private static final int NOTIFICATION_ID_INBOUND_COMPLETE = -1000006;
+    @VisibleForTesting
+    static final int NOTIFICATION_ID_INBOUND_COMPLETE = -1000006;
 
     private boolean mUpdateCompleteNotification = true;
 
@@ -242,11 +247,11 @@
         }
     }
 
-    private void updateActiveNotification() {
+    @VisibleForTesting
+    void updateActiveNotification() {
         // Active transfers
-        Cursor cursor =
-                mContentResolver.query(BluetoothShare.CONTENT_URI, null, WHERE_RUNNING, null,
-                        BluetoothShare._ID);
+        Cursor cursor = BluetoothMethodProxy.getInstance().contentResolverQuery(mContentResolver,
+                BluetoothShare.CONTENT_URI, null, WHERE_RUNNING, null, BluetoothShare._ID);
         if (cursor == null) {
             return;
         }
@@ -396,7 +401,8 @@
         }
     }
 
-    private void updateCompletedNotification() {
+    @VisibleForTesting
+    void updateCompletedNotification() {
         long timeStamp = 0;
         int outboundSuccNumber = 0;
         int outboundFailNumber = 0;
@@ -406,9 +412,9 @@
         int inboundFailNumber = 0;
 
         // Creating outbound notification
-        Cursor cursor =
-                mContentResolver.query(BluetoothShare.CONTENT_URI, null, WHERE_COMPLETED_OUTBOUND,
-                        null, BluetoothShare.TIMESTAMP + " DESC");
+        Cursor cursor = BluetoothMethodProxy.getInstance()
+                .contentResolverQuery(mContentResolver, BluetoothShare.CONTENT_URI, null,
+                        WHERE_COMPLETED_OUTBOUND, null, BluetoothShare.TIMESTAMP + " DESC");
         if (cursor == null) {
             return;
         }
@@ -474,8 +480,9 @@
         }
 
         // Creating inbound notification
-        cursor = mContentResolver.query(BluetoothShare.CONTENT_URI, null, WHERE_COMPLETED_INBOUND,
-                null, BluetoothShare.TIMESTAMP + " DESC");
+        cursor = BluetoothMethodProxy.getInstance()
+                .contentResolverQuery(mContentResolver, BluetoothShare.CONTENT_URI, null,
+                        WHERE_COMPLETED_INBOUND, null, BluetoothShare.TIMESTAMP + " DESC");
         if (cursor == null) {
             return;
         }
@@ -539,9 +546,10 @@
         }
     }
 
-    private void updateIncomingFileConfirmNotification() {
-        Cursor cursor =
-                mContentResolver.query(BluetoothShare.CONTENT_URI, null, WHERE_CONFIRM_PENDING,
+    @VisibleForTesting
+    void updateIncomingFileConfirmNotification() {
+        Cursor cursor = BluetoothMethodProxy.getInstance().contentResolverQuery(mContentResolver,
+                BluetoothShare.CONTENT_URI, null, WHERE_CONFIRM_PENDING,
                         null, BluetoothShare._ID);
 
         if (cursor == null) {
diff --git a/android/app/src/com/android/bluetooth/opp/BluetoothOppPreference.java b/android/app/src/com/android/bluetooth/opp/BluetoothOppPreference.java
index 47053e8..740513f 100644
--- a/android/app/src/com/android/bluetooth/opp/BluetoothOppPreference.java
+++ b/android/app/src/com/android/bluetooth/opp/BluetoothOppPreference.java
@@ -98,15 +98,16 @@
     }
 
     private String getChannelKey(BluetoothDevice remoteDevice, int uuid) {
-        return remoteDevice.getAddress() + "_" + Integer.toHexString(uuid);
+        return remoteDevice.getIdentityAddress() + "_" + Integer.toHexString(uuid);
     }
 
     public String getName(BluetoothDevice remoteDevice) {
-        if (remoteDevice.getAddress().equals("FF:FF:FF:00:00:00")) {
+        String identityAddress = remoteDevice.getIdentityAddress();
+        if (identityAddress != null && identityAddress.equals("FF:FF:FF:00:00:00")) {
             return "localhost";
         }
         if (!mNames.isEmpty()) {
-            String name = mNames.get(remoteDevice.getAddress());
+            String name = mNames.get(remoteDevice.getIdentityAddress());
             if (name != null) {
                 return name;
             }
@@ -124,7 +125,7 @@
             channel = mChannels.get(key);
             if (V) {
                 Log.v(TAG,
-                        "getChannel for " + remoteDevice + "_" + Integer.toHexString(uuid) + " as "
+                        "getChannel for " + remoteDevice.getIdentityAddress() + "_" + Integer.toHexString(uuid) + " as "
                                 + channel);
             }
         }
@@ -133,19 +134,19 @@
 
     public void setName(BluetoothDevice remoteDevice, String name) {
         if (V) {
-            Log.v(TAG, "Setname for " + remoteDevice + " to " + name);
+            Log.v(TAG, "Setname for " + remoteDevice.getIdentityAddress() + " to " + name);
         }
         if (name != null && !name.equals(getName(remoteDevice))) {
             Editor ed = mNamePreference.edit();
-            ed.putString(remoteDevice.getAddress(), name);
+            ed.putString(remoteDevice.getIdentityAddress(), name);
             ed.apply();
-            mNames.put(remoteDevice.getAddress(), name);
+            mNames.put(remoteDevice.getIdentityAddress(), name);
         }
     }
 
     public void setChannel(BluetoothDevice remoteDevice, int uuid, int channel) {
         if (V) {
-            Log.v(TAG, "Setchannel for " + remoteDevice + "_" + Integer.toHexString(uuid) + " to "
+            Log.v(TAG, "Setchannel for " + remoteDevice.getIdentityAddress() + "_" + Integer.toHexString(uuid) + " to "
                     + channel);
         }
         if (channel != getChannel(remoteDevice, uuid)) {
diff --git a/android/app/src/com/android/bluetooth/opp/BluetoothOppProvider.java b/android/app/src/com/android/bluetooth/opp/BluetoothOppProvider.java
index 4079a87..6505305 100644
--- a/android/app/src/com/android/bluetooth/opp/BluetoothOppProvider.java
+++ b/android/app/src/com/android/bluetooth/opp/BluetoothOppProvider.java
@@ -44,6 +44,10 @@
 import android.net.Uri;
 import android.util.Log;
 
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.List;
+
 /**
  * This provider allows application to interact with Bluetooth OPP manager
  */
@@ -98,7 +102,7 @@
      * when a new version of the provider needs an updated version of the
      * database.
      */
-    private final class DatabaseHelper extends SQLiteOpenHelper {
+    private static final class DatabaseHelper extends SQLiteOpenHelper {
 
         DatabaseHelper(final Context context) {
             super(context, DB_NAME, null, DB_VERSION);
@@ -137,7 +141,7 @@
 
     }
 
-    private void createTable(SQLiteDatabase db) {
+    private static void createTable(SQLiteDatabase db) {
         try {
             db.execSQL("CREATE TABLE " + DB_TABLE + "(" + BluetoothShare._ID
                     + " INTEGER PRIMARY KEY AUTOINCREMENT," + BluetoothShare.URI + " TEXT, "
@@ -155,7 +159,7 @@
         }
     }
 
-    private void dropTable(SQLiteDatabase db) {
+    private static void dropTable(SQLiteDatabase db) {
         try {
             db.execSQL("DROP TABLE IF EXISTS " + DB_TABLE);
         } catch (SQLException ex) {
@@ -198,6 +202,62 @@
         }
     }
 
+    private static void putString(String key, Cursor from, ContentValues to) {
+        to.put(key, from.getString(from.getColumnIndexOrThrow(key)));
+    }
+    private static void putInteger(String key, Cursor from, ContentValues to) {
+        to.put(key, from.getInt(from.getColumnIndexOrThrow(key)));
+    }
+    private static void putLong(String key, Cursor from, ContentValues to) {
+        to.put(key, from.getLong(from.getColumnIndexOrThrow(key)));
+    }
+
+    /**
+     * @hide
+     */
+    public static boolean oppDatabaseMigration(Context ctx, Cursor cursor) {
+        boolean result = true;
+        SQLiteDatabase db = new DatabaseHelper(ctx).getWritableDatabase();
+        while (cursor.moveToNext()) {
+            try {
+                ContentValues values = new ContentValues();
+
+                final List<String> stringKeys =  new ArrayList<>(Arrays.asList(
+                            BluetoothShare.URI,
+                            BluetoothShare.FILENAME_HINT,
+                            BluetoothShare.MIMETYPE,
+                            BluetoothShare.DESTINATION));
+                for (String k : stringKeys) {
+                    putString(k, cursor, values);
+                }
+
+                final List<String> integerKeys =  new ArrayList<>(Arrays.asList(
+                            BluetoothShare.VISIBILITY,
+                            BluetoothShare.USER_CONFIRMATION,
+                            BluetoothShare.DIRECTION,
+                            BluetoothShare.STATUS,
+                            Constants.MEDIA_SCANNED));
+                for (String k : integerKeys) {
+                    putInteger(k, cursor, values);
+                }
+
+                final List<String> longKeys =  new ArrayList<>(Arrays.asList(
+                            BluetoothShare.TOTAL_BYTES,
+                            BluetoothShare.TIMESTAMP));
+                for (String k : longKeys) {
+                    putLong(k, cursor, values);
+                }
+
+                db.insert(DB_TABLE, null, values);
+                Log.d(TAG, "One item migrated: " + values);
+            } catch (IllegalArgumentException e) {
+                Log.e(TAG, "Failed to migrate one item: " + e);
+                result = false;
+            }
+        }
+        return result;
+    }
+
     @Override
     public Uri insert(Uri uri, ContentValues values) {
         SQLiteDatabase db = mOpenHelper.getWritableDatabase();
diff --git a/android/app/src/com/android/bluetooth/opp/BluetoothOppReceiveFileInfo.java b/android/app/src/com/android/bluetooth/opp/BluetoothOppReceiveFileInfo.java
index 1589988..4545179 100644
--- a/android/app/src/com/android/bluetooth/opp/BluetoothOppReceiveFileInfo.java
+++ b/android/app/src/com/android/bluetooth/opp/BluetoothOppReceiveFileInfo.java
@@ -41,6 +41,8 @@
 import android.provider.MediaStore;
 import android.util.Log;
 
+import com.android.bluetooth.BluetoothMethodProxy;
+
 import java.io.UnsupportedEncodingException;
 import java.text.DateFormat;
 import java.text.SimpleDateFormat;
@@ -95,9 +97,11 @@
         Uri contentUri = Uri.parse(BluetoothShare.CONTENT_URI + "/" + id);
         String filename = null, hint = null, mimeType = null;
         long length = 0;
-        Cursor metadataCursor = contentResolver.query(contentUri, new String[]{
-                BluetoothShare.FILENAME_HINT, BluetoothShare.TOTAL_BYTES, BluetoothShare.MIMETYPE
-        }, null, null, null);
+        Cursor metadataCursor = BluetoothMethodProxy.getInstance().contentResolverQuery(
+                contentResolver, contentUri, new String[]{
+                        BluetoothShare.FILENAME_HINT, BluetoothShare.TOTAL_BYTES,
+                        BluetoothShare.MIMETYPE
+                }, null, null, null);
         if (metadataCursor != null) {
             try {
                 if (metadataCursor.moveToFirst()) {
@@ -177,8 +181,8 @@
         mediaContentValues.put(MediaStore.MediaColumns.MIME_TYPE, mimeType);
         mediaContentValues.put(MediaStore.MediaColumns.RELATIVE_PATH,
                 Environment.DIRECTORY_DOWNLOADS);
-        insertUri = contentResolver.insert(MediaStore.Downloads.EXTERNAL_CONTENT_URI,
-                mediaContentValues);
+        insertUri = BluetoothMethodProxy.getInstance().contentResolverInsert(contentResolver,
+                MediaStore.Downloads.EXTERNAL_CONTENT_URI, mediaContentValues);
 
         if (insertUri == null) {
             if (D) {
diff --git a/android/app/src/com/android/bluetooth/opp/BluetoothOppReceiver.java b/android/app/src/com/android/bluetooth/opp/BluetoothOppReceiver.java
index 3540c4d..3d243ca 100644
--- a/android/app/src/com/android/bluetooth/opp/BluetoothOppReceiver.java
+++ b/android/app/src/com/android/bluetooth/opp/BluetoothOppReceiver.java
@@ -44,6 +44,7 @@
 import android.util.Log;
 import android.widget.Toast;
 
+import com.android.bluetooth.BluetoothMethodProxy;
 import com.android.bluetooth.R;
 import com.android.bluetooth.Utils;
 
@@ -66,14 +67,15 @@
 
             BluetoothDevice remoteDevice = intent.getParcelableExtra(BluetoothDevice.EXTRA_DEVICE);
 
-            if (D) {
-                Log.d(TAG, "Received BT device selected intent, bt device: " + remoteDevice);
-            }
-
             if (remoteDevice == null) {
                 mOppManager.cleanUpSendingFileInfo();
                 return;
             }
+
+            if (D) {
+                Log.d(TAG, "Received BT device selected intent, bt device: " + remoteDevice.getIdentityAddress());
+            }
+
             // Insert transfer session record to database
             mOppManager.startTransfer(remoteDevice);
 
@@ -107,7 +109,8 @@
             Uri uri = intent.getData();
             ContentValues values = new ContentValues();
             values.put(BluetoothShare.USER_CONFIRMATION, BluetoothShare.USER_CONFIRMATION_DENIED);
-            context.getContentResolver().update(uri, values, null, null);
+            BluetoothMethodProxy.getInstance().contentResolverUpdate(context.getContentResolver(),
+                    uri, values, null, null);
             cancelNotification(context, BluetoothOppNotification.NOTIFICATION_ID_PROGRESS);
 
         } else if (action.equals(Constants.ACTION_ACCEPT)) {
@@ -119,7 +122,8 @@
             ContentValues values = new ContentValues();
             values.put(BluetoothShare.USER_CONFIRMATION,
                     BluetoothShare.USER_CONFIRMATION_CONFIRMED);
-            context.getContentResolver().update(uri, values, null, null);
+            BluetoothMethodProxy.getInstance().contentResolverUpdate(context.getContentResolver(),
+                    uri, values, null, null);
         } else if (action.equals(Constants.ACTION_OPEN) || action.equals(Constants.ACTION_LIST)) {
             if (V) {
                 if (action.equals(Constants.ACTION_OPEN)) {
@@ -182,8 +186,8 @@
             if (V) {
                 Log.v(TAG, "Receiver hide for " + intent.getData());
             }
-            Cursor cursor =
-                    context.getContentResolver().query(intent.getData(), null, null, null, null);
+            Cursor cursor = BluetoothMethodProxy.getInstance().contentResolverQuery(
+                    context.getContentResolver(), intent.getData(), null, null, null, null);
             if (cursor != null) {
                 if (cursor.moveToFirst()) {
                     int visibilityColumn = cursor.getColumnIndexOrThrow(BluetoothShare.VISIBILITY);
@@ -195,7 +199,9 @@
                             && visibility == BluetoothShare.VISIBILITY_VISIBLE) {
                         ContentValues values = new ContentValues();
                         values.put(BluetoothShare.VISIBILITY, BluetoothShare.VISIBILITY_HIDDEN);
-                        context.getContentResolver().update(intent.getData(), values, null, null);
+                        BluetoothMethodProxy.getInstance().contentResolverUpdate(
+                                context.getContentResolver(), intent.getData(), values, null,
+                                null);
                         if (V) {
                             Log.v(TAG, "Action_hide received and db updated");
                         }
@@ -209,9 +215,9 @@
             }
             ContentValues updateValues = new ContentValues();
             updateValues.put(BluetoothShare.VISIBILITY, BluetoothShare.VISIBILITY_HIDDEN);
-            context.getContentResolver()
-                    .update(BluetoothShare.CONTENT_URI, updateValues,
-                            BluetoothOppNotification.WHERE_COMPLETED, null);
+            BluetoothMethodProxy.getInstance().contentResolverUpdate(
+                    context.getContentResolver(), BluetoothShare.CONTENT_URI, updateValues,
+                    BluetoothOppNotification.WHERE_COMPLETED, null);
         } else if (action.equals(BluetoothShare.TRANSFER_COMPLETED_ACTION)) {
             if (V) {
                 Log.v(TAG, "Receiver Transfer Complete Intent for " + intent.getData());
diff --git a/android/app/src/com/android/bluetooth/opp/BluetoothOppSendFileInfo.java b/android/app/src/com/android/bluetooth/opp/BluetoothOppSendFileInfo.java
index 46e3ba1..2adb8e5 100644
--- a/android/app/src/com/android/bluetooth/opp/BluetoothOppSendFileInfo.java
+++ b/android/app/src/com/android/bluetooth/opp/BluetoothOppSendFileInfo.java
@@ -42,6 +42,7 @@
 import android.util.EventLog;
 import android.util.Log;
 
+import com.android.bluetooth.BluetoothMethodProxy;
 import com.android.bluetooth.R;
 
 import java.io.File;
@@ -119,9 +120,10 @@
             contentType = contentResolver.getType(uri);
             Cursor metadataCursor;
             try {
-                metadataCursor = contentResolver.query(uri, new String[]{
-                        OpenableColumns.DISPLAY_NAME, OpenableColumns.SIZE
-                }, null, null, null);
+                metadataCursor = BluetoothMethodProxy.getInstance().contentResolverQuery(
+                        contentResolver, uri, new String[]{
+                                OpenableColumns.DISPLAY_NAME, OpenableColumns.SIZE
+                        }, null, null, null);
             } catch (SQLiteException e) {
                 // some content providers don't support the DISPLAY_NAME or SIZE columns
                 metadataCursor = null;
@@ -180,7 +182,8 @@
                 // right size in _OpenableColumns.SIZE
                 // As a second source of getting the correct file length,
                 // get a file descriptor and get the stat length
-                AssetFileDescriptor fd = contentResolver.openAssetFileDescriptor(uri, "r");
+                AssetFileDescriptor fd = BluetoothMethodProxy.getInstance()
+                        .contentResolverOpenAssetFileDescriptor(contentResolver, uri, "r");
                 long statLength = fd.getLength();
                 if (length != statLength && statLength > 0) {
                     Log.e(TAG, "Content provider length is wrong (" + Long.toString(length)
@@ -200,7 +203,8 @@
                         length = getStreamSize(is);
                         Log.w(TAG, "File length not provided. Length from stream = " + length);
                         // Reset the stream
-                        fd = contentResolver.openAssetFileDescriptor(uri, "r");
+                        fd = BluetoothMethodProxy.getInstance()
+                                .contentResolverOpenAssetFileDescriptor(contentResolver, uri, "r");
                         is = fd.createInputStream();
                     }
                 } catch (IOException e) {
@@ -219,14 +223,16 @@
 
         if (is == null) {
             try {
-                is = (FileInputStream) contentResolver.openInputStream(uri);
+                is = (FileInputStream) BluetoothMethodProxy.getInstance()
+                        .contentResolverOpenInputStream(contentResolver, uri);
 
                 // If the database doesn't contain the file size, get the size
                 // by reading through the entire stream
                 if (length == 0) {
                     length = getStreamSize(is);
                     // Reset the stream
-                    is = (FileInputStream) contentResolver.openInputStream(uri);
+                    is = (FileInputStream) BluetoothMethodProxy.getInstance()
+                            .contentResolverOpenInputStream(contentResolver, uri);
                 }
             } catch (FileNotFoundException e) {
                 return SEND_FILE_INFO_ERROR;
diff --git a/android/app/src/com/android/bluetooth/opp/BluetoothOppService.java b/android/app/src/com/android/bluetooth/opp/BluetoothOppService.java
index 3bbd85d..f9521b0 100644
--- a/android/app/src/com/android/bluetooth/opp/BluetoothOppService.java
+++ b/android/app/src/com/android/bluetooth/opp/BluetoothOppService.java
@@ -52,8 +52,6 @@
 import android.os.Handler;
 import android.os.Message;
 import android.os.Process;
-import android.os.UserHandle;
-import android.os.UserManager;
 import android.sysprop.BluetoothProperties;
 import android.util.Log;
 
@@ -88,14 +86,6 @@
             BluetoothOppProvider.class.getCanonicalName();
     private static final String OPP_FILE_PROVIDER =
             BluetoothOppFileProvider.class.getCanonicalName();
-    private static final String LAUNCHER_ACTIVITY =
-            BluetoothOppLauncherActivity.class.getCanonicalName();
-    private static final String BT_ENABLE_ACTIVITY =
-            BluetoothOppBtEnableActivity.class.getCanonicalName();
-    private static final String BT_ERROR_ACTIVITY =
-            BluetoothOppBtErrorActivity.class.getCanonicalName();
-    private static final String BT_ENABLING_ACTIVITY =
-            BluetoothOppBtEnablingActivity.class.getCanonicalName();
     private static final String INCOMING_FILE_CONFIRM_ACTIVITY =
             BluetoothOppIncomingFileConfirmActivity.class.getCanonicalName();
     private static final String TRANSFER_ACTIVITY =
@@ -252,18 +242,8 @@
             Log.v(TAG, "start()");
         }
 
-        //Check for user restrictions before enabling component
-        UserManager mUserManager = getSystemService(UserManager.class);
-        if (!mUserManager.hasUserRestrictionForUser(
-                UserManager.DISALLOW_BLUETOOTH_SHARING, UserHandle.CURRENT)) {
-            setComponentAvailable(LAUNCHER_ACTIVITY, true);
-        }
-
         setComponentAvailable(OPP_PROVIDER, true);
         setComponentAvailable(OPP_FILE_PROVIDER, true);
-        setComponentAvailable(BT_ENABLE_ACTIVITY, true);
-        setComponentAvailable(BT_ERROR_ACTIVITY, true);
-        setComponentAvailable(BT_ENABLING_ACTIVITY, true);
         setComponentAvailable(INCOMING_FILE_CONFIRM_ACTIVITY, true);
         setComponentAvailable(TRANSFER_ACTIVITY, true);
         setComponentAvailable(TRANSFER_HISTORY_ACTIVITY, true);
@@ -306,10 +286,6 @@
 
         setComponentAvailable(OPP_PROVIDER, false);
         setComponentAvailable(OPP_FILE_PROVIDER, false);
-        setComponentAvailable(LAUNCHER_ACTIVITY, false);
-        setComponentAvailable(BT_ENABLE_ACTIVITY, false);
-        setComponentAvailable(BT_ERROR_ACTIVITY, false);
-        setComponentAvailable(BT_ENABLING_ACTIVITY, false);
         setComponentAvailable(INCOMING_FILE_CONFIRM_ACTIVITY, false);
         setComponentAvailable(TRANSFER_ACTIVITY, false);
         setComponentAvailable(TRANSFER_HISTORY_ACTIVITY, false);
@@ -1139,6 +1115,11 @@
 
     // Run in a background thread at boot.
     private static void trimDatabase(ContentResolver contentResolver) {
+        if (contentResolver.acquireContentProviderClient(BluetoothShare.CONTENT_URI) == null) {
+            Log.w(TAG, "ContentProvider doesn't exist");
+            return;
+        }
+
         // remove the invisible/unconfirmed inbound shares
         int delNum = contentResolver.delete(BluetoothShare.CONTENT_URI, WHERE_INVISIBLE_UNCONFIRMED,
                 null);
@@ -1255,7 +1236,7 @@
     public boolean onConnect(BluetoothDevice device, BluetoothSocket socket) {
 
         if (D) {
-            Log.d(TAG, " onConnect BluetoothSocket :" + socket + " \n :device :" + device);
+            Log.d(TAG, " onConnect BluetoothSocket :" + socket + " \n :device :" + device.getIdentityAddress());
         }
         if (!mAcceptNewConnections) {
             Log.d(TAG, " onConnect BluetoothSocket :" + socket + " rejected");
diff --git a/android/app/src/com/android/bluetooth/opp/BluetoothOppTransfer.java b/android/app/src/com/android/bluetooth/opp/BluetoothOppTransfer.java
index 9d9cdbc..eb10b23 100644
--- a/android/app/src/com/android/bluetooth/opp/BluetoothOppTransfer.java
+++ b/android/app/src/com/android/bluetooth/opp/BluetoothOppTransfer.java
@@ -52,8 +52,10 @@
 import android.os.Process;
 import android.util.Log;
 
+import com.android.bluetooth.BluetoothMethodProxy;
 import com.android.bluetooth.BluetoothObexTransport;
 import com.android.bluetooth.Utils;
+import com.android.internal.annotations.VisibleForTesting;
 import com.android.obex.ObexTransport;
 
 import java.io.IOException;
@@ -69,11 +71,14 @@
 
     private static final boolean V = Constants.VERBOSE;
 
-    private static final int TRANSPORT_ERROR = 10;
+    @VisibleForTesting
+    static final int TRANSPORT_ERROR = 10;
 
-    private static final int TRANSPORT_CONNECTED = 11;
+    @VisibleForTesting
+    static final int TRANSPORT_CONNECTED = 11;
 
-    private static final int SOCKET_ERROR_RETRY = 13;
+    @VisibleForTesting
+    static final int SOCKET_ERROR_RETRY = 13;
 
     private static final int CONNECT_WAIT_TIMEOUT = 45000;
 
@@ -87,23 +92,27 @@
 
     private BluetoothAdapter mAdapter;
 
-    private BluetoothDevice mDevice;
+    @VisibleForTesting
+    BluetoothDevice mDevice;
 
     private BluetoothOppBatch mBatch;
 
     private BluetoothOppObexSession mSession;
 
-    private BluetoothOppShareInfo mCurrentShare;
+    @VisibleForTesting
+    BluetoothOppShareInfo mCurrentShare;
 
     private ObexTransport mTransport;
 
     private HandlerThread mHandlerThread;
 
-    private EventHandler mSessionHandler;
+    @VisibleForTesting
+    EventHandler mSessionHandler;
 
     private long mTimestamp;
 
-    private class OppConnectionReceiver extends BroadcastReceiver {
+    @VisibleForTesting
+    class OppConnectionReceiver extends BroadcastReceiver {
         @Override
         public void onReceive(Context context, Intent intent) {
             String action = intent.getAction();
@@ -112,14 +121,17 @@
             }
             if (action.equals(BluetoothDevice.ACTION_ACL_DISCONNECTED)) {
                 BluetoothDevice device = intent.getParcelableExtra(BluetoothDevice.EXTRA_DEVICE);
-                if (device == null || mBatch == null || mCurrentShare == null) {
-                    Log.e(TAG, "device : " + device + " mBatch :" + mBatch + " mCurrentShare :"
+                if (device == null) {
+                    Log.e(TAG, "Device is null");
+                    return;
+                } else if (mBatch == null || mCurrentShare == null) {
+                    Log.e(TAG, "device : " + device.getIdentityAddress() + " mBatch :" + mBatch + " mCurrentShare :"
                             + mCurrentShare);
                     return;
                 }
                 try {
                     if (V) {
-                        Log.v(TAG, "Device :" + device + "- OPP device: " + mBatch.mDestination
+                        Log.v(TAG, "Device :" + device.getIdentityAddress() + "- OPP device: " + mBatch.mDestination
                                 + " \n mCurrentShare.mConfirm == " + mCurrentShare.mConfirm);
                     }
                     if ((device.equals(mBatch.mDestination)) && (mCurrentShare.mConfirm
@@ -131,8 +143,8 @@
                         // Remove the timeout message triggered earlier during Obex Put
                         mSessionHandler.removeMessages(BluetoothOppObexSession.MSG_CONNECT_TIMEOUT);
                         // Now reuse the same message to clean up the session.
-                        mSessionHandler.sendMessage(mSessionHandler.obtainMessage(
-                                BluetoothOppObexSession.MSG_CONNECT_TIMEOUT));
+                        BluetoothMethodProxy.getInstance().handlerSendEmptyMessage(mSessionHandler,
+                                BluetoothOppObexSession.MSG_CONNECT_TIMEOUT);
                     }
                 } catch (Exception e) {
                     e.printStackTrace();
@@ -152,7 +164,11 @@
                         Log.w(TAG, "OPP SDP search, target device is null, ignoring result");
                         return;
                     }
-                    if (!device.getAddress().equalsIgnoreCase(mDevice.getAddress())) {
+                    String deviceIdentityAddress = device.getIdentityAddress();
+                    String transferDeviceIdentityAddress = mDevice.getIdentityAddress();
+                    if (deviceIdentityAddress == null || transferDeviceIdentityAddress == null
+                            || !deviceIdentityAddress.equalsIgnoreCase(
+                                    transferDeviceIdentityAddress)) {
                         Log.w(TAG, " OPP SDP search for wrong device, ignoring!!");
                         return;
                     }
@@ -183,7 +199,7 @@
         mBatch = batch;
         mSession = session;
 
-        mBatch.registerListern(this);
+        mBatch.registerListener(this);
         mAdapter = BluetoothAdapter.getDefaultAdapter();
 
     }
@@ -199,7 +215,8 @@
     /*
      * Receives events from mConnectThread & mSession back in the main thread.
      */
-    private class EventHandler extends Handler {
+    @VisibleForTesting
+    class EventHandler extends Handler {
         EventHandler(Looper looper) {
             super(looper);
         }
@@ -386,7 +403,8 @@
         ContentValues updateValues = new ContentValues();
         updateValues.put(BluetoothShare.USER_CONFIRMATION,
                 BluetoothShare.USER_CONFIRMATION_TIMEOUT);
-        mContext.getContentResolver().update(contentUri, updateValues, null, null);
+        BluetoothMethodProxy.getInstance().contentResolverUpdate(mContext.getContentResolver(),
+                contentUri, updateValues, null, null);
     }
 
     private void markBatchFailed(int failReason) {
@@ -412,7 +430,8 @@
             }
             if (mCurrentShare.mDirection == BluetoothShare.DIRECTION_INBOUND
                     && mCurrentShare.mUri != null) {
-                mContext.getContentResolver().delete(mCurrentShare.mUri, null, null);
+                BluetoothMethodProxy.getInstance().contentResolverDelete(
+                        mContext.getContentResolver(), mCurrentShare.mUri, null, null);
             }
         }
 
@@ -439,10 +458,12 @@
                     }
                 } else {
                     if (info.mStatus < 200 && info.mUri != null) {
-                        mContext.getContentResolver().delete(info.mUri, null, null);
+                        BluetoothMethodProxy.getInstance().contentResolverDelete(
+                                mContext.getContentResolver(), info.mUri, null, null);
                     }
                 }
-                mContext.getContentResolver().update(contentUri, updateValues, null, null);
+                BluetoothMethodProxy.getInstance().contentResolverUpdate(
+                        mContext.getContentResolver(), contentUri, updateValues, null, null);
                 Constants.sendIntentIfCompleted(mContext, contentUri, info.mStatus);
             }
             info = mBatch.getPendingShare();
@@ -477,7 +498,7 @@
          * normally it's impossible to reach here if BT is disabled. Just check
          * for safety
          */
-        if (!mAdapter.isEnabled()) {
+        if (!BluetoothMethodProxy.getInstance().bluetoothAdapterIsEnabled(mAdapter)) {
             Log.e(TAG, "Can't start transfer when Bluetooth is disabled for " + mBatch.mId);
             markBatchFailed(BluetoothShare.STATUS_UNKNOWN_ERROR);
             mBatch.mStatus = Constants.BATCH_STATUS_FAILED;
@@ -660,12 +681,15 @@
         }
     }
 
-    private SocketConnectThread mConnectThread;
+    @VisibleForTesting
+    SocketConnectThread mConnectThread;
 
-    private class SocketConnectThread extends Thread {
+    @VisibleForTesting
+    class SocketConnectThread extends Thread {
         private final String mHost;
 
-        private final BluetoothDevice mDevice;
+        @VisibleForTesting
+        final BluetoothDevice mDevice;
 
         private final int mChannel;
 
@@ -681,7 +705,8 @@
 
         private boolean mSdpInitiated = false;
 
-        private boolean mIsInterrupted = false;
+        @VisibleForTesting
+        boolean mIsInterrupted = false;
 
         /* create a Rfcomm/L2CAP Socket */
         SocketConnectThread(BluetoothDevice device, boolean retry) {
@@ -849,7 +874,8 @@
                 Log.e(TAG, "Error when close socket");
             }
         }
-        mSessionHandler.obtainMessage(TRANSPORT_ERROR).sendToTarget();
+        BluetoothMethodProxy.getInstance().handlerSendEmptyMessage(mSessionHandler,
+                TRANSPORT_ERROR);
         return;
     }
 
@@ -862,7 +888,8 @@
         Uri contentUri = Uri.parse(BluetoothShare.CONTENT_URI + "/" + share.mId);
         ContentValues updateValues = new ContentValues();
         updateValues.put(BluetoothShare.DIRECTION, share.mDirection);
-        mContext.getContentResolver().update(contentUri, updateValues, null, null);
+        BluetoothMethodProxy.getInstance().contentResolverUpdate(mContext.getContentResolver(),
+                contentUri, updateValues, null, null);
     }
 
     /*
diff --git a/android/app/src/com/android/bluetooth/opp/BluetoothOppTransferActivity.java b/android/app/src/com/android/bluetooth/opp/BluetoothOppTransferActivity.java
index bba6758..5f59890 100644
--- a/android/app/src/com/android/bluetooth/opp/BluetoothOppTransferActivity.java
+++ b/android/app/src/com/android/bluetooth/opp/BluetoothOppTransferActivity.java
@@ -52,6 +52,8 @@
 
 import com.android.bluetooth.R;
 
+import com.google.common.annotations.VisibleForTesting;
+
 /**
  * Handle all transfer related dialogs: -Ongoing transfer -Receiving one file
  * dialog -Sending one file dialog -sending multiple files dialog -Complete
@@ -83,7 +85,8 @@
 
     private TextView mLine1View, mLine2View, mLine3View, mLine5View;
 
-    private int mWhichDialog;
+    @VisibleForTesting
+    int mWhichDialog;
 
     private BluetoothAdapter mAdapter;
 
diff --git a/android/app/src/com/android/bluetooth/opp/BluetoothOppTransferHistory.java b/android/app/src/com/android/bluetooth/opp/BluetoothOppTransferHistory.java
index e4f978d..6d9d9d3 100644
--- a/android/app/src/com/android/bluetooth/opp/BluetoothOppTransferHistory.java
+++ b/android/app/src/com/android/bluetooth/opp/BluetoothOppTransferHistory.java
@@ -52,6 +52,7 @@
 import android.widget.AdapterView.OnItemClickListener;
 import android.widget.ListView;
 
+import com.android.bluetooth.BluetoothMethodProxy;
 import com.android.bluetooth.R;
 
 /**
@@ -116,8 +117,8 @@
         }
 
         final String sortOrder = BluetoothShare.TIMESTAMP + " DESC";
-
-        mTransferCursor = getContentResolver().query(BluetoothShare.CONTENT_URI, new String[]{
+        mTransferCursor = BluetoothMethodProxy.getInstance().contentResolverQuery(
+                getContentResolver(), BluetoothShare.CONTENT_URI, new String[]{
                 "_id",
                 BluetoothShare.FILENAME_HINT,
                 BluetoothShare.STATUS,
diff --git a/android/app/src/com/android/bluetooth/opp/BluetoothOppUtility.java b/android/app/src/com/android/bluetooth/opp/BluetoothOppUtility.java
index 63c6b8e..eb1452d 100644
--- a/android/app/src/com/android/bluetooth/opp/BluetoothOppUtility.java
+++ b/android/app/src/com/android/bluetooth/opp/BluetoothOppUtility.java
@@ -51,7 +51,9 @@
 import android.util.EventLog;
 import android.util.Log;
 
+import com.android.bluetooth.BluetoothMethodProxy;
 import com.android.bluetooth.R;
+import com.android.internal.annotations.VisibleForTesting;
 
 import java.io.File;
 import java.io.IOException;
@@ -76,12 +78,13 @@
     /** Whether the device has the "nosdcard" characteristic, or null if not-yet-known. */
     private static Boolean sNoSdCard = null;
 
-    private static final ConcurrentHashMap<Uri, BluetoothOppSendFileInfo> sSendFileMap =
+    @VisibleForTesting
+    static final ConcurrentHashMap<Uri, BluetoothOppSendFileInfo> sSendFileMap =
             new ConcurrentHashMap<Uri, BluetoothOppSendFileInfo>();
 
     public static boolean isBluetoothShareUri(Uri uri) {
         if (uri.toString().startsWith(BluetoothShare.CONTENT_URI.toString())
-                && !Objects.equals(uri.getAuthority(), BluetoothShare.CONTENT_URI.getAuthority())) {
+                && !uri.getAuthority().equals(BluetoothShare.CONTENT_URI.getAuthority())) {
             EventLog.writeEvent(0x534e4554, "225880741", -1, "");
         }
         return Objects.equals(uri.getAuthority(), BluetoothShare.CONTENT_URI.getAuthority());
@@ -89,7 +92,9 @@
 
     public static BluetoothOppTransferInfo queryRecord(Context context, Uri uri) {
         BluetoothOppTransferInfo info = new BluetoothOppTransferInfo();
-        Cursor cursor = context.getContentResolver().query(uri, null, null, null, null);
+        Cursor cursor = BluetoothMethodProxy.getInstance().contentResolverQuery(
+                context.getContentResolver(), uri, null, null, null, null
+        );
         if (cursor != null) {
             if (cursor.moveToFirst()) {
                 fillRecord(context, cursor, info);
@@ -158,10 +163,14 @@
     public static ArrayList<String> queryTransfersInBatch(Context context, Long timeStamp) {
         ArrayList<String> uris = new ArrayList();
         final String where = BluetoothShare.TIMESTAMP + " == " + timeStamp;
-        Cursor metadataCursor =
-                context.getContentResolver().query(BluetoothShare.CONTENT_URI, new String[]{
-                        BluetoothShare._DATA
-                }, where, null, BluetoothShare._ID);
+        Cursor metadataCursor = BluetoothMethodProxy.getInstance().contentResolverQuery(
+                context.getContentResolver(),
+                BluetoothShare.CONTENT_URI,
+                new String[]{BluetoothShare._DATA},
+                where,
+                null,
+                BluetoothShare._ID
+        );
 
         if (metadataCursor == null) {
             return null;
@@ -201,8 +210,10 @@
         }
 
         Uri path = null;
-        Cursor metadataCursor = context.getContentResolver().query(uri, new String[]{
-                BluetoothShare.URI}, null, null, null);
+        Cursor metadataCursor = BluetoothMethodProxy.getInstance().contentResolverQuery(
+                context.getContentResolver(), uri, new String[]{BluetoothShare.URI},
+                null, null, null
+        );
         if (metadataCursor != null) {
             try {
                 if (metadataCursor.moveToFirst()) {
@@ -230,7 +241,8 @@
             if (V) {
                 Log.d(TAG, "This uri will be deleted: " + uri);
             }
-            context.getContentResolver().delete(uri, null, null);
+            BluetoothMethodProxy.getInstance().contentResolverDelete(context.getContentResolver(),
+                    uri, null, null);
             return;
         }
 
@@ -269,7 +281,8 @@
         String readOnlyMode = "r";
         ParcelFileDescriptor pfd = null;
         try {
-            pfd = resolver.openFileDescriptor(uri, readOnlyMode);
+            pfd = BluetoothMethodProxy.getInstance()
+                    .contentResolverOpenFileDescriptor(resolver, uri, readOnlyMode);
             return true;
         } catch (IOException e) {
             e.printStackTrace();
@@ -308,7 +321,8 @@
     public static void updateVisibilityToHidden(Context context, Uri uri) {
         ContentValues updateValues = new ContentValues();
         updateValues.put(BluetoothShare.VISIBILITY, BluetoothShare.VISIBILITY_HIDDEN);
-        context.getContentResolver().update(uri, updateValues, null, null);
+        BluetoothMethodProxy.getInstance().contentResolverUpdate(context.getContentResolver(), uri,
+                updateValues, null, null);
     }
 
     /**
diff --git a/android/app/src/com/android/bluetooth/opp/Constants.java b/android/app/src/com/android/bluetooth/opp/Constants.java
index 84f735d..f1e5a30 100644
--- a/android/app/src/com/android/bluetooth/opp/Constants.java
+++ b/android/app/src/com/android/bluetooth/opp/Constants.java
@@ -38,6 +38,7 @@
 import android.net.Uri;
 import android.util.Log;
 
+import com.android.bluetooth.BluetoothMethodProxy;
 import com.android.obex.HeaderSet;
 
 import java.io.IOException;
@@ -229,7 +230,8 @@
         Uri contentUri = Uri.parse(BluetoothShare.CONTENT_URI + "/" + id);
         ContentValues updateValues = new ContentValues();
         updateValues.put(BluetoothShare.STATUS, status);
-        context.getContentResolver().update(contentUri, updateValues, null, null);
+        BluetoothMethodProxy.getInstance().contentResolverUpdate(context.getContentResolver(),
+                contentUri, updateValues, null, null);
         Constants.sendIntentIfCompleted(context, contentUri, status);
     }
 
diff --git a/android/app/src/com/android/bluetooth/pan/PanService.java b/android/app/src/com/android/bluetooth/pan/PanService.java
index 672ae59..93a4a0c 100644
--- a/android/app/src/com/android/bluetooth/pan/PanService.java
+++ b/android/app/src/com/android/bluetooth/pan/PanService.java
@@ -70,10 +70,12 @@
     private static final int BLUETOOTH_MAX_PAN_CONNECTIONS = 5;
     private static final int BLUETOOTH_PREFIX_LENGTH = 24;
 
-    private HashMap<BluetoothDevice, BluetoothPanDevice> mPanDevices;
+    @VisibleForTesting
+    HashMap<BluetoothDevice, BluetoothPanDevice> mPanDevices;
     private int mMaxPanDevices;
     private String mPanIfName;
-    private boolean mIsTethering = false;
+    @VisibleForTesting
+    boolean mIsTethering = false;
     private boolean mNativeAvailable;
     private HashMap<String, IBluetoothPanCallback> mBluetoothTetheringCallbacks;
 
@@ -270,7 +272,8 @@
     /**
      * Handlers for incoming service calls
      */
-    private static class BluetoothPanBinder extends IBluetoothPan.Stub
+    @VisibleForTesting
+    static class BluetoothPanBinder extends IBluetoothPan.Stub
             implements IProfileServiceBinder {
         private PanService mService;
 
@@ -285,8 +288,11 @@
 
         @RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)
         private PanService getService(AttributionSource source) {
-            if (!Utils.checkCallerIsSystemOrActiveUser(TAG)
-                    || !Utils.checkServiceAvailable(mService, TAG)
+            if (Utils.isInstrumentationTestMode()) {
+                return mService;
+            }
+            if (!Utils.checkServiceAvailable(mService, TAG)
+                    || !Utils.checkCallerIsSystemOrActiveOrManagedUser(mService, TAG)
                     || !Utils.checkConnectPermissionForDataDelivery(mService, source, TAG)) {
                 return null;
             }
@@ -598,9 +604,8 @@
         public int remote_role;
     }
 
-    ;
-
-    private void onConnectStateChanged(byte[] address, int state, int error, int localRole,
+    @VisibleForTesting
+    void onConnectStateChanged(byte[] address, int state, int error, int localRole,
             int remoteRole) {
         if (DBG) {
             Log.d(TAG, "onConnectStateChanged: " + state + ", local role:" + localRole
@@ -611,7 +616,8 @@
         mHandler.sendMessage(msg);
     }
 
-    private void onControlStateChanged(int localRole, int state, int error, String ifname) {
+    @VisibleForTesting
+    void onControlStateChanged(int localRole, int state, int error, String ifname) {
         if (DBG) {
             Log.d(TAG, "onControlStateChanged: " + state + ", error: " + error + ", ifname: "
                     + ifname);
@@ -621,7 +627,8 @@
         }
     }
 
-    private static int convertHalState(int halState) {
+    @VisibleForTesting
+    static int convertHalState(int halState) {
         switch (halState) {
             case CONN_STATE_CONNECTED:
                 return BluetoothProfile.STATE_CONNECTED;
@@ -744,25 +751,6 @@
         sendBroadcast(intent, BLUETOOTH_CONNECT);
     }
 
-    private List<BluetoothDevice> getConnectedPanDevices() {
-        List<BluetoothDevice> devices = new ArrayList<BluetoothDevice>();
-
-        for (BluetoothDevice device : mPanDevices.keySet()) {
-            if (getPanDeviceConnectionState(device) == BluetoothProfile.STATE_CONNECTED) {
-                devices.add(device);
-            }
-        }
-        return devices;
-    }
-
-    private int getPanDeviceConnectionState(BluetoothDevice device) {
-        BluetoothPanDevice panDevice = mPanDevices.get(device);
-        if (panDevice == null) {
-            return BluetoothProfile.STATE_DISCONNECTED;
-        }
-        return panDevice.mState;
-    }
-
     @Override
     public void dump(StringBuilder sb) {
         super.dump(sb);
@@ -775,7 +763,8 @@
         }
     }
 
-    private class BluetoothPanDevice {
+    @VisibleForTesting
+    static class BluetoothPanDevice {
         private int mState;
         private String mIface;
         private int mLocalRole; // Which local role is this PAN device bound to
@@ -791,10 +780,14 @@
 
     // Constants matching Hal header file bt_hh.h
     // bthh_connection_state_t
-    private static final int CONN_STATE_CONNECTED = 0;
-    private static final int CONN_STATE_CONNECTING = 1;
-    private static final int CONN_STATE_DISCONNECTED = 2;
-    private static final int CONN_STATE_DISCONNECTING = 3;
+    @VisibleForTesting
+    static final int CONN_STATE_CONNECTED = 0;
+    @VisibleForTesting
+    static final int CONN_STATE_CONNECTING = 1;
+    @VisibleForTesting
+    static final int CONN_STATE_DISCONNECTED = 2;
+    @VisibleForTesting
+    static final int CONN_STATE_DISCONNECTING = 3;
 
     private static native void classInitNative();
 
diff --git a/android/app/src/com/android/bluetooth/pbap/BluetoothPbapActivity.java b/android/app/src/com/android/bluetooth/pbap/BluetoothPbapActivity.java
index 6773232..e225912 100644
--- a/android/app/src/com/android/bluetooth/pbap/BluetoothPbapActivity.java
+++ b/android/app/src/com/android/bluetooth/pbap/BluetoothPbapActivity.java
@@ -54,6 +54,7 @@
 import android.widget.TextView;
 
 import com.android.bluetooth.R;
+import com.android.internal.annotations.VisibleForTesting;
 
 /**
  * PbapActivity shows two dialogues: One for accepting incoming pbap request and
@@ -68,7 +69,8 @@
 
     private static final int BLUETOOTH_OBEX_AUTHKEY_MAX_LENGTH = 16;
 
-    private static final int DIALOG_YES_NO_AUTH = 1;
+    @VisibleForTesting
+    static final int DIALOG_YES_NO_AUTH = 1;
 
     private static final String KEY_USER_TIMEOUT = "user_timeout";
 
@@ -80,7 +82,8 @@
 
     private String mSessionKey = "";
 
-    private int mCurrentDialog;
+    @VisibleForTesting
+    int mCurrentDialog;
 
     private boolean mTimeout = false;
 
@@ -90,7 +93,8 @@
 
     private BluetoothDevice mDevice;
 
-    private BroadcastReceiver mReceiver = new BroadcastReceiver() {
+    @VisibleForTesting
+    BroadcastReceiver mReceiver = new BroadcastReceiver() {
         @Override
         public void onReceive(Context context, Intent intent) {
             if (!BluetoothPbapService.USER_CONFIRM_TIMEOUT_ACTION.equals(intent.getAction())) {
@@ -164,7 +168,8 @@
         }
     }
 
-    private void onPositive() {
+    @VisibleForTesting
+    void onPositive() {
         if (mCurrentDialog == DIALOG_YES_NO_AUTH) {
             mSessionKey = mKeyView.getText().toString();
         }
@@ -180,7 +185,8 @@
         finish();
     }
 
-    private void onNegative() {
+    @VisibleForTesting
+    void onNegative() {
         if (mCurrentDialog == DIALOG_YES_NO_AUTH) {
             sendIntentToReceiver(BluetoothPbapService.AUTH_CANCELLED_ACTION, null, null);
             mKeyView.removeTextChangedListener(this);
@@ -199,6 +205,7 @@
         sendBroadcast(intent);
     }
 
+    @VisibleForTesting
     private void onTimeout() {
         mTimeout = true;
         if (mCurrentDialog == DIALOG_YES_NO_AUTH) {
diff --git a/android/app/src/com/android/bluetooth/pbap/BluetoothPbapAuthenticator.java b/android/app/src/com/android/bluetooth/pbap/BluetoothPbapAuthenticator.java
index a4387fa..79aa4a6 100644
--- a/android/app/src/com/android/bluetooth/pbap/BluetoothPbapAuthenticator.java
+++ b/android/app/src/com/android/bluetooth/pbap/BluetoothPbapAuthenticator.java
@@ -34,6 +34,7 @@
 
 import android.util.Log;
 
+import com.android.internal.annotations.VisibleForTesting;
 import com.android.obex.Authenticator;
 import com.android.obex.PasswordAuthentication;
 
@@ -44,10 +45,10 @@
 public class BluetoothPbapAuthenticator implements Authenticator {
     private static final String TAG = "PbapAuthenticator";
 
-    private boolean mChallenged;
-    private boolean mAuthCancelled;
-    private String mSessionKey;
-    private PbapStateMachine mPbapStateMachine;
+    @VisibleForTesting boolean mChallenged;
+    @VisibleForTesting boolean mAuthCancelled;
+    @VisibleForTesting String mSessionKey;
+    @VisibleForTesting PbapStateMachine mPbapStateMachine;
 
     BluetoothPbapAuthenticator(final PbapStateMachine stateMachine) {
         mPbapStateMachine = stateMachine;
diff --git a/android/app/src/com/android/bluetooth/pbap/BluetoothPbapCallLogComposer.java b/android/app/src/com/android/bluetooth/pbap/BluetoothPbapCallLogComposer.java
index b5fb51b..123f145 100644
--- a/android/app/src/com/android/bluetooth/pbap/BluetoothPbapCallLogComposer.java
+++ b/android/app/src/com/android/bluetooth/pbap/BluetoothPbapCallLogComposer.java
@@ -15,7 +15,6 @@
  */
 package com.android.bluetooth.pbap;
 
-import android.content.ContentResolver;
 import android.content.Context;
 import android.database.Cursor;
 import android.database.sqlite.SQLiteException;
@@ -25,7 +24,9 @@
 import android.text.TextUtils;
 import android.util.Log;
 
+import com.android.bluetooth.BluetoothMethodProxy;
 import com.android.bluetooth.R;
+import com.android.internal.annotations.VisibleForTesting;
 import com.android.vcard.VCardBuilder;
 import com.android.vcard.VCardConfig;
 import com.android.vcard.VCardConstants;
@@ -41,19 +42,24 @@
 public class BluetoothPbapCallLogComposer {
     private static final String TAG = "PbapCallLogComposer";
 
-    private static final String FAILURE_REASON_FAILED_TO_GET_DATABASE_INFO =
+    @VisibleForTesting
+    static final String FAILURE_REASON_FAILED_TO_GET_DATABASE_INFO =
             "Failed to get database information";
 
-    private static final String FAILURE_REASON_NO_ENTRY = "There's no exportable in the database";
+    @VisibleForTesting
+    static final String FAILURE_REASON_NO_ENTRY = "There's no exportable in the database";
 
-    private static final String FAILURE_REASON_NOT_INITIALIZED =
+    @VisibleForTesting
+    static final String FAILURE_REASON_NOT_INITIALIZED =
             "The vCard composer object is not correctly initialized";
 
     /** Should be visible only from developers... (no need to translate, hopefully) */
-    private static final String FAILURE_REASON_UNSUPPORTED_URI =
+    @VisibleForTesting
+    static final String FAILURE_REASON_UNSUPPORTED_URI =
             "The Uri vCard composer received is not supported by the composer.";
 
-    private static final String NO_ERROR = "No error";
+    @VisibleForTesting
+    static final String NO_ERROR = "No error";
 
     /** The projection to use when querying the call log table */
     private static final String[] sCallLogProjection = new String[]{
@@ -80,7 +86,6 @@
     private static final String VCARD_PROPERTY_CALLTYPE_MISSED = "MISSED";
 
     private final Context mContext;
-    private ContentResolver mContentResolver;
     private Cursor mCursor;
 
     private boolean mTerminateIsCalled;
@@ -91,7 +96,6 @@
 
     public BluetoothPbapCallLogComposer(final Context context) {
         mContext = context;
-        mContentResolver = context.getContentResolver();
     }
 
     public boolean init(final Uri contentUri, final String selection, final String[] selectionArgs,
@@ -104,8 +108,9 @@
             return false;
         }
 
-        mCursor =
-                mContentResolver.query(contentUri, projection, selection, selectionArgs, sortOrder);
+        mCursor = BluetoothMethodProxy.getInstance().contentResolverQuery(
+                mContext.getContentResolver(), contentUri, projection, selection, selectionArgs,
+                sortOrder);
 
         if (mCursor == null) {
             mErrorReason = FAILURE_REASON_FAILED_TO_GET_DATABASE_INFO;
@@ -175,8 +180,8 @@
     /**
      * This static function is to compose vCard for phone own number
      */
-    public String composeVCardForPhoneOwnNumber(int phonetype, String phoneName, String phoneNumber,
-            boolean vcardVer21) {
+    public static String composeVCardForPhoneOwnNumber(int phonetype, String phoneName,
+            String phoneNumber, boolean vcardVer21) {
         final int vcardType = (vcardVer21 ? VCardConfig.VCARD_TYPE_V21_GENERIC
                 : VCardConfig.VCARD_TYPE_V30_GENERIC)
                 | VCardConfig.FLAG_REFRAIN_PHONE_NUMBER_FORMATTING;
diff --git a/android/app/src/com/android/bluetooth/pbap/BluetoothPbapConfig.java b/android/app/src/com/android/bluetooth/pbap/BluetoothPbapConfig.java
index 28051a6..01c1e9a 100644
--- a/android/app/src/com/android/bluetooth/pbap/BluetoothPbapConfig.java
+++ b/android/app/src/com/android/bluetooth/pbap/BluetoothPbapConfig.java
@@ -22,6 +22,7 @@
 import android.util.Log;
 
 import com.android.bluetooth.R;
+import com.android.internal.annotations.VisibleForTesting;
 
 public class BluetoothPbapConfig {
     private static boolean sUseProfileForOwnerVcard = true;
@@ -57,4 +58,9 @@
     public static boolean includePhotosInVcard() {
         return sIncludePhotosInVcard;
     }
+
+    @VisibleForTesting
+    public static void setIncludePhotosInVcard(boolean includePhotosInVcard) {
+        sIncludePhotosInVcard = includePhotosInVcard;
+    }
 }
diff --git a/android/app/src/com/android/bluetooth/pbap/BluetoothPbapObexServer.java b/android/app/src/com/android/bluetooth/pbap/BluetoothPbapObexServer.java
index 2090ea6..ad12f05 100644
--- a/android/app/src/com/android/bluetooth/pbap/BluetoothPbapObexServer.java
+++ b/android/app/src/com/android/bluetooth/pbap/BluetoothPbapObexServer.java
@@ -43,6 +43,8 @@
 import android.text.TextUtils;
 import android.util.Log;
 
+import com.android.bluetooth.BluetoothMethodProxy;
+import com.android.internal.annotations.VisibleForTesting;
 import com.android.obex.ApplicationParameter;
 import com.android.obex.HeaderSet;
 import com.android.obex.Operation;
@@ -74,7 +76,8 @@
     private static final int VCARD_NAME_SUFFIX_LENGTH = 5;
 
     // 128 bit UUID for PBAP
-    private static final byte[] PBAP_TARGET = new byte[]{
+    @VisibleForTesting
+    public static final byte[] PBAP_TARGET = new byte[]{
             0x79,
             0x61,
             0x35,
@@ -122,39 +125,53 @@
     };
 
     // SIM card
-    private static final String SIM1 = "SIM1";
+    @VisibleForTesting
+    public static final String SIM1 = "SIM1";
 
     // missed call history
-    private static final String MCH = "mch";
+    @VisibleForTesting
+    public static final String MCH = "mch";
 
     // incoming call history
-    private static final String ICH = "ich";
+    @VisibleForTesting
+    public static final String ICH = "ich";
 
     // outgoing call history
-    private static final String OCH = "och";
+    @VisibleForTesting
+    public static final String OCH = "och";
 
     // combined call history
-    private static final String CCH = "cch";
+    @VisibleForTesting
+    public static final String CCH = "cch";
 
     // phone book
-    private static final String PB = "pb";
+    @VisibleForTesting
+    public static final String PB = "pb";
 
     // favorites
-    private static final String FAV = "fav";
+    @VisibleForTesting
+    public static final String FAV = "fav";
 
-    private static final String TELECOM_PATH = "/telecom";
+    @VisibleForTesting
+    public static final String TELECOM_PATH = "/telecom";
 
-    private static final String ICH_PATH = "/telecom/ich";
+    @VisibleForTesting
+    public static final String ICH_PATH = "/telecom/ich";
 
-    private static final String OCH_PATH = "/telecom/och";
+    @VisibleForTesting
+    public static final String OCH_PATH = "/telecom/och";
 
-    private static final String MCH_PATH = "/telecom/mch";
+    @VisibleForTesting
+    public static final String MCH_PATH = "/telecom/mch";
 
-    private static final String CCH_PATH = "/telecom/cch";
+    @VisibleForTesting
+    public static final String CCH_PATH = "/telecom/cch";
 
-    private static final String PB_PATH = "/telecom/pb";
+    @VisibleForTesting
+    public static final String PB_PATH = "/telecom/pb";
 
-    private static final String FAV_PATH = "/telecom/fav";
+    @VisibleForTesting
+    public static final String FAV_PATH = "/telecom/fav";
 
     // SIM Support
     private static final String SIM_PATH = "/SIM1/telecom";
@@ -170,16 +187,19 @@
     private static final String SIM_PB_PATH = "/SIM1/telecom/pb";
 
     // type for list vcard objects
-    private static final String TYPE_LISTING = "x-bt/vcard-listing";
+    @VisibleForTesting
+    public static final String TYPE_LISTING = "x-bt/vcard-listing";
 
     // type for get single vcard object
-    private static final String TYPE_VCARD = "x-bt/vcard";
+    @VisibleForTesting
+    public static final String TYPE_VCARD = "x-bt/vcard";
 
     // to indicate if need send body besides headers
     private static final int NEED_SEND_BODY = -1;
 
     // type for download all vcard objects
-    private static final String TYPE_PB = "x-bt/phonebook";
+    @VisibleForTesting
+    public static final String TYPE_PB = "x-bt/phonebook";
 
     // The number of indexes in the phone book.
     private boolean mNeedPhonebookSize = false;
@@ -223,6 +243,8 @@
 
     private PbapStateMachine mStateMachine;
 
+    private BluetoothMethodProxy mPbapMethodProxy;
+
     private enum ContactsType {
         TYPE_PHONEBOOK , TYPE_SIM ;
     }
@@ -251,6 +273,7 @@
         mVcardManager = new BluetoothPbapVcardManager(mContext);
         mVcardSimManager = new BluetoothPbapSimVcardManager(mContext);
         mStateMachine = stateMachine;
+        mPbapMethodProxy = BluetoothMethodProxy.getInstance();
     }
 
     @Override
@@ -260,7 +283,7 @@
         }
         notifyUpdateWakeLock();
         try {
-            byte[] uuid = (byte[]) request.getHeader(HeaderSet.TARGET);
+            byte[] uuid = (byte[]) mPbapMethodProxy.getHeader(request, HeaderSet.TARGET);
             if (uuid == null) {
                 return ResponseCodes.OBEX_HTTP_NOT_ACCEPTABLE;
             }
@@ -285,7 +308,7 @@
         }
 
         try {
-            byte[] remote = (byte[]) request.getHeader(HeaderSet.WHO);
+            byte[] remote = (byte[]) mPbapMethodProxy.getHeader(request, HeaderSet.WHO);
             if (remote != null) {
                 if (D) {
                     Log.d(TAG, "onConnect(): remote=" + Arrays.toString(remote));
@@ -300,7 +323,8 @@
         try {
             byte[] appParam = null;
             mConnAppParamValue = new AppParamValue();
-            appParam = (byte[]) request.getHeader(HeaderSet.APPLICATION_PARAMETER);
+            appParam = (byte[])
+                    mPbapMethodProxy.getHeader(request, HeaderSet.APPLICATION_PARAMETER);
             if ((appParam != null) && !parseApplicationParameter(appParam, mConnAppParamValue)) {
                 return ResponseCodes.OBEX_HTTP_BAD_REQUEST;
             }
@@ -369,7 +393,7 @@
         String currentPathTmp = mCurrentPath;
         String tmpPath = null;
         try {
-            tmpPath = (String) request.getHeader(HeaderSet.NAME);
+            tmpPath = (String) mPbapMethodProxy.getHeader(request, HeaderSet.NAME);
         } catch (IOException e) {
             Log.e(TAG, "Get name header fail");
             return ResponseCodes.OBEX_HTTP_INTERNAL_ERROR;
@@ -386,7 +410,11 @@
             if (tmpPath == null) {
                 currentPathTmp = "";
             } else {
-                currentPathTmp = currentPathTmp + "/" + tmpPath;
+                if (tmpPath.startsWith("/")) {
+                    currentPathTmp = currentPathTmp + tmpPath;
+                } else {
+                    currentPathTmp = currentPathTmp + "/" + tmpPath;
+                }
             }
         }
 
@@ -424,9 +452,10 @@
         AppParamValue appParamValue = new AppParamValue();
         try {
             request = op.getReceivedHeader();
-            type = (String) request.getHeader(HeaderSet.TYPE);
-            name = (String) request.getHeader(HeaderSet.NAME);
-            appParam = (byte[]) request.getHeader(HeaderSet.APPLICATION_PARAMETER);
+            type = (String) mPbapMethodProxy.getHeader(request, HeaderSet.TYPE);
+            name = (String) mPbapMethodProxy.getHeader(request, HeaderSet.NAME);
+            appParam = (byte[]) mPbapMethodProxy.getHeader(
+                    request, HeaderSet.APPLICATION_PARAMETER);
         } catch (IOException e) {
             Log.e(TAG, "request headers error");
             return ResponseCodes.OBEX_HTTP_INTERNAL_ERROR;
@@ -445,7 +474,7 @@
             return ResponseCodes.OBEX_HTTP_NOT_ACCEPTABLE;
         }
 
-        if (!mContext.getSystemService(UserManager.class).isUserUnlocked()) {
+        if (!mPbapMethodProxy.getSystemService(mContext, UserManager.class).isUserUnlocked()) {
             Log.e(TAG, "Storage locked, " + type + " failed");
             return ResponseCodes.OBEX_HTTP_UNAVAILABLE;
         }
@@ -608,7 +637,8 @@
         return false;
     }
 
-    private class AppParamValue {
+    @VisibleForTesting
+    public static class AppParamValue {
         public int maxListCount;
 
         public int listStartOffset;
@@ -641,7 +671,7 @@
 
         public byte[] callHistoryVersionCounter;
 
-        AppParamValue() {
+        public AppParamValue() {
             maxListCount = 0xFFFF;
             listStartOffset = 0;
             searchValue = "";
@@ -661,12 +691,13 @@
             Log.i(TAG, "maxListCount=" + maxListCount + " listStartOffset=" + listStartOffset
                     + " searchValue=" + searchValue + " searchAttr=" + searchAttr + " needTag="
                     + needTag + " vcard21=" + vcard21 + " order=" + order + "vcardselector="
-                    + vCardSelector + "vcardselop=" + vCardSelectorOperator);
+                    + Arrays.toString(vCardSelector) + "vcardselop=" + vCardSelectorOperator);
         }
     }
 
     /** To parse obex application parameter */
-    private boolean parseApplicationParameter(final byte[] appParam, AppParamValue appParamValue) {
+    @VisibleForTesting
+    boolean parseApplicationParameter(final byte[] appParam, AppParamValue appParamValue) {
         int i = 0;
         boolean parseOk = true;
         while ((i < appParam.length) && (parseOk)) {
@@ -944,7 +975,8 @@
      * Function to send obex header back to client such as get phonebook size
      * request
      */
-    private int pushHeader(final Operation op, final HeaderSet reply) {
+    @VisibleForTesting
+    static int pushHeader(final Operation op, final HeaderSet reply) {
         OutputStream outputStream = null;
 
         if (D) {
@@ -1278,8 +1310,8 @@
                         appParamValue.ignorefilter ? null : appParamValue.propertySelector);
                 return pushBytes(op, ownerVcard);
             } else {
-                return mVcardSimManager.composeAndSendSIMPhonebookOneVcard(op, intIndex,
-                        vcard21, null, mOrderBy);
+                return BluetoothPbapSimVcardManager.composeAndSendSIMPhonebookOneVcard(
+                        mContext, op, intIndex, vcard21, null, mOrderBy);
             }
         } else {
             if (intIndex <= 0 || intIndex > size) {
@@ -1396,12 +1428,12 @@
                 if (endPoint == 0) {
                     return pushBytes(op, ownerVcard);
                 } else {
-                    return mVcardSimManager.composeAndSendSIMPhonebookVcards(op, 1, endPoint,
-                        vcard21, ownerVcard);
+                    return BluetoothPbapSimVcardManager.composeAndSendSIMPhonebookVcards(
+                            mContext, op, 1, endPoint, vcard21, ownerVcard);
                 }
             } else {
-                return mVcardSimManager.composeAndSendSIMPhonebookVcards(op, startPoint,
-                        endPoint, vcard21, null);
+                return BluetoothPbapSimVcardManager.composeAndSendSIMPhonebookVcards(
+                        mContext, op, startPoint, endPoint, vcard21, null);
             }
         } else {
             return mVcardManager.composeAndSendSelectedCallLogVcards(appParamValue.needTag, op,
@@ -1465,7 +1497,7 @@
     /**
      * XML encode special characters in the name field
      */
-    private void xmlEncode(String name, StringBuilder result) {
+    private static void xmlEncode(String name, StringBuilder result) {
         if (name == null) {
             return;
         }
@@ -1491,7 +1523,8 @@
         }
     }
 
-    private void writeVCardEntry(int vcfIndex, String name, StringBuilder result) {
+    @VisibleForTesting
+    static void writeVCardEntry(int vcfIndex, String name, StringBuilder result) {
         result.append("<card handle=\"");
         result.append(vcfIndex);
         result.append(".vcf\" name=\"");
@@ -1526,13 +1559,15 @@
         }
     }
 
-    private void setDbCounters(ApplicationParameter ap) {
+    @VisibleForTesting
+    void setDbCounters(ApplicationParameter ap) {
         ap.addTriplet(ApplicationParameter.TRIPLET_TAGID.DATABASEIDENTIFIER_TAGID,
                 ApplicationParameter.TRIPLET_LENGTH.DATABASEIDENTIFIER_LENGTH,
                 getDatabaseIdentifier());
     }
 
-    private void setFolderVersionCounters(ApplicationParameter ap) {
+    @VisibleForTesting
+    static void setFolderVersionCounters(ApplicationParameter ap) {
         ap.addTriplet(ApplicationParameter.TRIPLET_TAGID.PRIMARYVERSIONCOUNTER_TAGID,
                 ApplicationParameter.TRIPLET_LENGTH.PRIMARYVERSIONCOUNTER_LENGTH,
                 getPBPrimaryFolderVersion());
@@ -1541,7 +1576,8 @@
                 getPBSecondaryFolderVersion());
     }
 
-    private void setCallversionCounters(ApplicationParameter ap, AppParamValue appParamValue) {
+    @VisibleForTesting
+    static void setCallversionCounters(ApplicationParameter ap, AppParamValue appParamValue) {
         ap.addTriplet(ApplicationParameter.TRIPLET_TAGID.PRIMARYVERSIONCOUNTER_TAGID,
                 ApplicationParameter.TRIPLET_LENGTH.PRIMARYVERSIONCOUNTER_LENGTH,
                 appParamValue.callHistoryVersionCounter);
@@ -1551,7 +1587,8 @@
                 appParamValue.callHistoryVersionCounter);
     }
 
-    private byte[] getDatabaseIdentifier() {
+    @VisibleForTesting
+    byte[] getDatabaseIdentifier() {
         mDatabaseIdentifierHigh = 0;
         mDatabaseIdentifierLow = BluetoothPbapUtils.sDbIdentifier.get();
         if (mDatabaseIdentifierLow != INVALID_VALUE_PARAMETER
@@ -1565,7 +1602,8 @@
         }
     }
 
-    private byte[] getPBPrimaryFolderVersion() {
+    @VisibleForTesting
+    static byte[] getPBPrimaryFolderVersion() {
         long primaryVcMsb = 0;
         ByteBuffer pvc = ByteBuffer.allocate(16);
         pvc.putLong(primaryVcMsb);
@@ -1575,7 +1613,8 @@
         return pvc.array();
     }
 
-    private byte[] getPBSecondaryFolderVersion() {
+    @VisibleForTesting
+    static byte[] getPBSecondaryFolderVersion() {
         long secondaryVcMsb = 0;
         ByteBuffer svc = ByteBuffer.allocate(16);
         svc.putLong(secondaryVcMsb);
@@ -1590,4 +1629,15 @@
         return ((ByteBuffer.wrap(mConnAppParamValue.supportedFeature).getInt() & featureBitMask)
                 != 0);
     }
+
+    @VisibleForTesting
+    public void setCurrentPath(String path) {
+        mCurrentPath = path != null ? path : "";
+    }
+
+    @VisibleForTesting
+    public void setConnAppParamValue(AppParamValue connAppParamValue) {
+        mConnAppParamValue = connAppParamValue;
+    }
+
 }
diff --git a/android/app/src/com/android/bluetooth/pbap/BluetoothPbapService.java b/android/app/src/com/android/bluetooth/pbap/BluetoothPbapService.java
index 7a21f3a..62ebfd5 100644
--- a/android/app/src/com/android/bluetooth/pbap/BluetoothPbapService.java
+++ b/android/app/src/com/android/bluetooth/pbap/BluetoothPbapService.java
@@ -43,7 +43,6 @@
 import android.bluetooth.IBluetoothPbap;
 import android.content.AttributionSource;
 import android.content.BroadcastReceiver;
-import android.content.ComponentName;
 import android.content.Context;
 import android.content.Intent;
 import android.content.IntentFilter;
@@ -167,7 +166,8 @@
 
     private PbapHandler mSessionStatusHandler;
     private HandlerThread mHandlerThread;
-    private final HashMap<BluetoothDevice, PbapStateMachine> mPbapStateMachineMap = new HashMap<>();
+    @VisibleForTesting
+    final HashMap<BluetoothDevice, PbapStateMachine> mPbapStateMachineMap = new HashMap<>();
     private volatile int mNextNotificationId = PBAP_NOTIFICATION_ID_START;
 
     // package and class name to which we send intent to check phone book access permission
@@ -277,7 +277,8 @@
         }
     }
 
-    private BroadcastReceiver mPbapReceiver = new BroadcastReceiver() {
+    @VisibleForTesting
+    BroadcastReceiver mPbapReceiver = new BroadcastReceiver() {
         @Override
         public void onReceive(Context context, Intent intent) {
             parseIntent(intent);
@@ -447,10 +448,6 @@
     public int getConnectionState(BluetoothDevice device) {
         enforceCallingOrSelfPermission(
                 BLUETOOTH_PRIVILEGED, "Need BLUETOOTH_PRIVILEGED permission");
-        if (mPbapStateMachineMap == null) {
-            return BluetoothProfile.STATE_DISCONNECTED;
-        }
-
         synchronized (mPbapStateMachineMap) {
             PbapStateMachine sm = mPbapStateMachineMap.get(device);
             if (sm == null) {
@@ -461,9 +458,6 @@
     }
 
     List<BluetoothDevice> getConnectedDevices() {
-        if (mPbapStateMachineMap == null) {
-            return new ArrayList<>();
-        }
         synchronized (mPbapStateMachineMap) {
             return new ArrayList<>(mPbapStateMachineMap.keySet());
         }
@@ -471,7 +465,7 @@
 
     List<BluetoothDevice> getDevicesMatchingConnectionStates(int[] states) {
         List<BluetoothDevice> devices = new ArrayList<>();
-        if (mPbapStateMachineMap == null || states == null) {
+        if (states == null) {
             return devices;
         }
         synchronized (mPbapStateMachineMap) {
@@ -555,6 +549,11 @@
         return sLocalPhoneNum;
     }
 
+    @VisibleForTesting
+    static void setLocalPhoneName(String localPhoneName) {
+        sLocalPhoneName = localPhoneName;
+    }
+
     static String getLocalPhoneName() {
         return sLocalPhoneName;
     }
@@ -627,6 +626,7 @@
         getContentResolver().unregisterContentObserver(mContactChangeObserver);
         mContactChangeObserver = null;
         setComponentAvailable(PBAP_ACTIVITY, false);
+        mPbapStateMachineMap.clear();
         return true;
     }
 
@@ -670,13 +670,17 @@
         sendUpdateRequest();
     }
 
-    private static class PbapBinder extends IBluetoothPbap.Stub implements IProfileServiceBinder {
+    @VisibleForTesting
+    static class PbapBinder extends IBluetoothPbap.Stub implements IProfileServiceBinder {
         private BluetoothPbapService mService;
 
         @RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)
         private BluetoothPbapService getService(AttributionSource source) {
-            if (!Utils.checkCallerIsSystemOrActiveUser(TAG)
-                    || !Utils.checkServiceAvailable(mService, TAG)
+            if (Utils.isInstrumentationTestMode()) {
+                return mService;
+            }
+            if (!Utils.checkServiceAvailable(mService, TAG)
+                    || !Utils.checkCallerIsSystemOrActiveOrManagedUser(mService, TAG)
                     || !Utils.checkConnectPermissionForDataDelivery(mService, source, TAG)) {
                 return null;
             }
diff --git a/android/app/src/com/android/bluetooth/pbap/BluetoothPbapSimVcardManager.java b/android/app/src/com/android/bluetooth/pbap/BluetoothPbapSimVcardManager.java
index 6eb6aa1..6d54460 100644
--- a/android/app/src/com/android/bluetooth/pbap/BluetoothPbapSimVcardManager.java
+++ b/android/app/src/com/android/bluetooth/pbap/BluetoothPbapSimVcardManager.java
@@ -15,39 +15,33 @@
 */
 package com.android.bluetooth.pbap;
 
-import com.android.bluetooth.R;
-
 import android.content.ContentResolver;
+import android.content.ContentValues;
 import android.content.Context;
 import android.database.Cursor;
 import android.database.sqlite.SQLiteException;
 import android.net.Uri;
-import com.android.vcard.VCardBuilder;
-import com.android.vcard.VCardConfig;
-import com.android.vcard.VCardConstants;
-import com.android.vcard.VCardUtils;
-
-import android.content.ContentValues;
-import android.provider.CallLog;
-import android.provider.CallLog.Calls;
-import android.text.TextUtils;
-import android.util.Log;
-import android.provider.ContactsContract.Contacts;
 import android.provider.ContactsContract.CommonDataKinds;
 import android.provider.ContactsContract.CommonDataKinds.Phone;
 import android.provider.ContactsContract.CommonDataKinds.StructuredName;
+import android.provider.ContactsContract.Contacts;
+import android.text.TextUtils;
+import android.util.Log;
 
-import java.io.IOException;
-import java.io.OutputStream;
-import java.util.ArrayList;
-import java.util.Arrays;
-import java.util.List;
-import java.util.Collections;
-import java.util.Comparator;
-
+import com.android.bluetooth.BluetoothMethodProxy;
+import com.android.bluetooth.R;
+import com.android.internal.annotations.VisibleForTesting;
 import com.android.obex.Operation;
 import com.android.obex.ResponseCodes;
 import com.android.obex.ServerOperation;
+import com.android.vcard.VCardBuilder;
+import com.android.vcard.VCardConfig;
+import com.android.vcard.VCardUtils;
+
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.Comparator;
+import java.util.List;
 
 /**
  * VCard composer especially for Call Log used in Bluetooth.
@@ -57,23 +51,31 @@
 
     private static final boolean V = BluetoothPbapService.VERBOSE;
 
-    private static final String FAILURE_REASON_FAILED_TO_GET_DATABASE_INFO =
+    @VisibleForTesting
+    public static final String FAILURE_REASON_FAILED_TO_GET_DATABASE_INFO =
         "Failed to get database information";
 
-    private static final String FAILURE_REASON_NO_ENTRY =
+    @VisibleForTesting
+    public static final String FAILURE_REASON_NO_ENTRY =
         "There's no exportable in the database";
 
-    private static final String FAILURE_REASON_NOT_INITIALIZED =
+    @VisibleForTesting
+    public static final String FAILURE_REASON_NOT_INITIALIZED =
         "The vCard composer object is not correctly initialized";
 
     /** Should be visible only from developers... (no need to translate, hopefully) */
-    private static final String FAILURE_REASON_UNSUPPORTED_URI =
+    @VisibleForTesting
+    public static final String FAILURE_REASON_UNSUPPORTED_URI =
         "The Uri vCard composer received is not supported by the composer.";
 
-    private static final String NO_ERROR = "No error";
+    @VisibleForTesting
+    public static final String NO_ERROR = "No error";
 
-    private final String SIM_URI = "content://icc/adn";
-    private final  String SIM_PATH = "/SIM1/telecom";
+    @VisibleForTesting
+    public static final Uri SIM_URI = Uri.parse("content://icc/adn");
+
+    @VisibleForTesting
+    public static final String SIM_PATH = "/SIM1/telecom";
 
     private static final String[] SIM_PROJECTION = new String[] {
         Contacts.DISPLAY_NAME,
@@ -82,8 +84,10 @@
         CommonDataKinds.Phone.LABEL
     };
 
-    private static final int NAME_COLUMN_INDEX = 0;
-    private static final int NUMBER_COLUMN_INDEX = 1;
+    @VisibleForTesting
+    public static final int NAME_COLUMN_INDEX = 0;
+    @VisibleForTesting
+    public static final int NUMBER_COLUMN_INDEX = 1;
     private static final int NUMBERTYPE_COLUMN_INDEX = 2;
     private static final int NUMBERLABEL_COLUMN_INDEX = 3;
 
@@ -101,16 +105,14 @@
 
     public boolean init(final Uri contentUri, final String selection,
             final String[] selectionArgs, final String sortOrder) {
-            final Uri myUri = Uri.parse(SIM_URI);
-        if (!myUri.equals(contentUri)) {
-
+        if (!SIM_URI.equals(contentUri)) {
             mErrorReason = FAILURE_REASON_UNSUPPORTED_URI;
             return false;
         }
 
         //checkpoint Figure out if we can apply selection, projection and sort order.
-        mCursor = mContentResolver.query(
-                contentUri, SIM_PROJECTION, null, null,sortOrder);
+        mCursor = BluetoothMethodProxy.getInstance().contentResolverQuery(mContentResolver,
+                contentUri, SIM_PROJECTION, null, null, sortOrder);
 
         if (mCursor == null) {
             mErrorReason = FAILURE_REASON_FAILED_TO_GET_DATABASE_INFO;
@@ -230,7 +232,7 @@
         return mErrorReason;
     }
 
-    public void setPositionByAlpha(int position) {
+    private void setPositionByAlpha(int position) {
         if(mCursor == null) {
             return;
         }
@@ -260,11 +262,11 @@
     }
 
     public final int getSIMContactsSize() {
-        final Uri myUri = Uri.parse(SIM_URI);
         int size = 0;
         Cursor contactCursor = null;
         try {
-            contactCursor = mContentResolver.query(myUri, SIM_PROJECTION, null,null, null);
+            contactCursor = BluetoothMethodProxy.getInstance().contentResolverQuery(
+                    mContentResolver, SIM_URI, SIM_PROJECTION, null,null, null);
             if (contactCursor != null) {
                 size = contactCursor.getCount();
             }
@@ -281,10 +283,10 @@
         nameList.add(BluetoothPbapService.getLocalPhoneName());
         //Since owner card should always be 0.vcf, maintain a separate list to avoid sorting
         ArrayList<String> allnames = new ArrayList<String>();
-        final Uri myUri = Uri.parse(SIM_URI);
         Cursor contactCursor = null;
         try {
-            contactCursor = mContentResolver.query(myUri, SIM_PROJECTION, null,null,null);
+            contactCursor = BluetoothMethodProxy.getInstance().contentResolverQuery(
+                    mContentResolver, SIM_URI, SIM_PROJECTION, null,null,null);
             if (contactCursor != null) {
                 for (contactCursor.moveToFirst(); !contactCursor.isAfterLast(); contactCursor
                         .moveToNext()) {
@@ -322,11 +324,10 @@
         ArrayList<String> nameList = new ArrayList<String>();
         ArrayList<String> startNameList = new ArrayList<String>();
         Cursor contactCursor = null;
-        final Uri uri = Uri.parse(SIM_URI);
 
         try {
-            contactCursor = mContentResolver.query(uri, SIM_PROJECTION,
-                    null, null, null);
+            contactCursor = BluetoothMethodProxy.getInstance().contentResolverQuery(
+                    mContentResolver, SIM_URI, SIM_PROJECTION, null, null, null);
 
             if (contactCursor != null) {
                 for (contactCursor.moveToFirst(); !contactCursor.isAfterLast(); contactCursor
@@ -370,21 +371,20 @@
         return nameList;
     }
 
-    public final int composeAndSendSIMPhonebookVcards(Operation op,
+    public static final int composeAndSendSIMPhonebookVcards(Context context, Operation op,
             final int startPoint, final int endPoint, final boolean vcardType21,
             String ownerVCard) {
         if (startPoint < 1 || startPoint > endPoint) {
             Log.e(TAG, "internal error: startPoint or endPoint is not correct.");
             return ResponseCodes.OBEX_HTTP_INTERNAL_ERROR;
         }
-        final Uri myUri = Uri.parse(SIM_URI);
         BluetoothPbapSimVcardManager composer = null;
         HandlerForStringBuffer buffer = null;
         try {
-            composer = new BluetoothPbapSimVcardManager(mContext);
+            composer = new BluetoothPbapSimVcardManager(context);
             buffer = new HandlerForStringBuffer(op, ownerVCard);
 
-            if (!composer.init(myUri, null, null, null) || !buffer.onInit(mContext)) {
+            if (!composer.init(SIM_URI, null, null, null) || !buffer.init()) {
                 return ResponseCodes.OBEX_HTTP_INTERNAL_ERROR;
             }
             composer.moveToPosition(startPoint -1, false);
@@ -400,91 +400,33 @@
                             + composer.getErrorReason() + ", count:" + count);
                     return ResponseCodes.OBEX_HTTP_INTERNAL_ERROR;
                 }
-                buffer.onEntryCreated(vcard);
+                buffer.writeVCard(vcard);
             }
         } finally {
             if (composer != null) {
                 composer.terminate();
             }
             if (buffer != null) {
-                buffer.onTerminate();
+                buffer.terminate();
             }
         }
         return ResponseCodes.OBEX_HTTP_OK;
     }
 
-    /**
-     * Handler to emit vCards to PCE.
-     */
-    public class HandlerForStringBuffer {
-        private Operation operation;
-
-        private OutputStream outputStream;
-
-        private String phoneOwnVCard = null;
-
-        public HandlerForStringBuffer(Operation op, String ownerVCard) {
-            operation = op;
-            if (ownerVCard != null) {
-                phoneOwnVCard = ownerVCard;
-                if (V) Log.v(TAG, "phoneOwnVCard \n " + phoneOwnVCard);
-            }
-        }
-
-        private boolean write(String vCard) {
-            try {
-                if (vCard != null) {
-                    outputStream.write(vCard.getBytes());
-                    return true;
-                }
-            } catch (IOException e) {
-                Log.e(TAG, "write outputstrem failed" + e.toString());
-            }
-            return false;
-        }
-
-        public boolean onInit(Context context) {
-            try {
-                outputStream = operation.openOutputStream();
-                if (phoneOwnVCard != null) {
-                    return write(phoneOwnVCard);
-                }
-                return true;
-            } catch (IOException e) {
-                Log.e(TAG, "open outputstrem failed" + e.toString());
-            }
-            return false;
-        }
-
-        public boolean onEntryCreated(String vcard) {
-            return write(vcard);
-        }
-
-        public void onTerminate() {
-            if (!BluetoothPbapObexServer.closeStream(outputStream, operation)) {
-                if (V) Log.v(TAG, "CloseStream failed!");
-            } else {
-                if (V) Log.v(TAG, "CloseStream ok!");
-            }
-        }
-    }
-
-    public final int composeAndSendSIMPhonebookOneVcard(Operation op,
+    public static final int composeAndSendSIMPhonebookOneVcard(Context context, Operation op,
             final int offset, final boolean vcardType21, String ownerVCard,
             int orderByWhat) {
         if (offset < 1) {
             Log.e(TAG, "Internal error: offset is not correct.");
             return ResponseCodes.OBEX_HTTP_INTERNAL_ERROR;
         }
-        final Uri myUri = Uri.parse(SIM_URI);
         if (V) Log.v(TAG, "composeAndSendSIMPhonebookOneVcard orderByWhat " + orderByWhat);
         BluetoothPbapSimVcardManager composer = null;
         HandlerForStringBuffer buffer = null;
         try {
-            composer = new BluetoothPbapSimVcardManager(mContext);
+            composer = new BluetoothPbapSimVcardManager(context);
             buffer = new HandlerForStringBuffer(op, ownerVCard);
-            if (!composer.init(myUri, null, null,null)||
-                               !buffer.onInit(mContext)) {
+            if (!composer.init(SIM_URI, null, null, null) || !buffer.init()) {
                 return ResponseCodes.OBEX_HTTP_INTERNAL_ERROR;
             }
             if (orderByWhat == BluetoothPbapObexServer.ORDER_BY_INDEXED) {
@@ -502,13 +444,13 @@
                             + composer.getErrorReason());
                 return ResponseCodes.OBEX_HTTP_INTERNAL_ERROR;
             }
-            buffer.onEntryCreated(vcard);
+            buffer.writeVCard(vcard);
         } finally {
             if (composer != null) {
                 composer.terminate();
             }
             if (buffer != null) {
-                buffer.onTerminate();
+                buffer.terminate();
             }
         }
 
diff --git a/android/app/src/com/android/bluetooth/pbap/BluetoothPbapUtils.java b/android/app/src/com/android/bluetooth/pbap/BluetoothPbapUtils.java
index df78600..7b4337a 100644
--- a/android/app/src/com/android/bluetooth/pbap/BluetoothPbapUtils.java
+++ b/android/app/src/com/android/bluetooth/pbap/BluetoothPbapUtils.java
@@ -34,6 +34,8 @@
 import android.provider.ContactsContract.RawContactsEntity;
 import android.util.Log;
 
+import com.android.bluetooth.BluetoothMethodProxy;
+import com.android.internal.annotations.VisibleForTesting;
 import com.android.vcard.VCardComposer;
 import com.android.vcard.VCardConfig;
 
@@ -68,13 +70,17 @@
 
     static long sPrimaryVersionCounter = 0;
     static long sSecondaryVersionCounter = 0;
-    private static long sTotalContacts = 0;
+    @VisibleForTesting
+    static long sTotalContacts = 0;
 
     /* totalFields and totalSvcFields used to update primary/secondary version
      * counter between pbap sessions*/
-    private static long sTotalFields = 0;
-    private static long sTotalSvcFields = 0;
-    private static long sContactsLastUpdated = 0;
+    @VisibleForTesting
+    static long sTotalFields = 0;
+    @VisibleForTesting
+    static long sTotalSvcFields = 0;
+    @VisibleForTesting
+    static long sContactsLastUpdated = 0;
 
     private static class ContactData {
         private String mName;
@@ -97,14 +103,20 @@
         }
     }
 
-    private static HashMap<String, ContactData> sContactDataset = new HashMap<>();
+    @VisibleForTesting
+    static HashMap<String, ContactData> sContactDataset = new HashMap<>();
 
-    private static HashSet<String> sContactSet = new HashSet<>();
+    @VisibleForTesting
+    static HashSet<String> sContactSet = new HashSet<>();
 
-    private static final String TYPE_NAME = "name";
-    private static final String TYPE_PHONE = "phone";
-    private static final String TYPE_EMAIL = "email";
-    private static final String TYPE_ADDRESS = "address";
+    @VisibleForTesting
+    static final String TYPE_NAME = "name";
+    @VisibleForTesting
+    static final String TYPE_PHONE = "phone";
+    @VisibleForTesting
+    static final String TYPE_EMAIL = "email";
+    @VisibleForTesting
+    static final String TYPE_ADDRESS = "address";
 
     private static boolean hasFilter(byte[] filter) {
         return filter != null && filter.length > 0;
@@ -171,8 +183,9 @@
     }
 
     public static String getProfileName(Context context) {
-        Cursor c = context.getContentResolver()
-                .query(Profile.CONTENT_URI, new String[]{Profile.DISPLAY_NAME}, null, null, null);
+        Cursor c = BluetoothMethodProxy.getInstance().contentResolverQuery(
+                context.getContentResolver(), Profile.CONTENT_URI,
+                new String[]{Profile.DISPLAY_NAME}, null, null, null);
         String ownerName = null;
         if (c != null && c.moveToFirst()) {
             ownerName = c.getString(0);
@@ -267,8 +280,8 @@
         HashSet<String> currentContactSet = new HashSet<>();
 
         String[] projection = {Contacts._ID, Contacts.CONTACT_LAST_UPDATED_TIMESTAMP};
-        Cursor c = context.getContentResolver()
-                .query(Contacts.CONTENT_URI, projection, null, null, null);
+        Cursor c = BluetoothMethodProxy.getInstance().contentResolverQuery(
+                context.getContentResolver(), Contacts.CONTENT_URI, projection, null, null, null);
 
         if (c == null) {
             Log.d(TAG, "Failed to fetch data from contact database");
@@ -320,8 +333,9 @@
             for (String deletedContact : deletedContacts) {
                 sContactSet.remove(deletedContact);
                 String[] selectionArgs = {deletedContact};
-                Cursor dataCursor = context.getContentResolver()
-                        .query(Data.CONTENT_URI, dataProjection, whereClause, selectionArgs, null);
+                Cursor dataCursor = BluetoothMethodProxy.getInstance().contentResolverQuery(
+                        context.getContentResolver(), Data.CONTENT_URI, dataProjection, whereClause,
+                        selectionArgs, null);
 
                 if (dataCursor == null) {
                     Log.d(TAG, "Failed to fetch data from contact database");
@@ -350,8 +364,9 @@
                 boolean updated = false;
 
                 String[] selectionArgs = {contact};
-                Cursor dataCursor = context.getContentResolver()
-                        .query(Data.CONTENT_URI, dataProjection, whereClause, selectionArgs, null);
+                Cursor dataCursor = BluetoothMethodProxy.getInstance().contentResolverQuery(
+                        context.getContentResolver(), Data.CONTENT_URI, dataProjection, whereClause,
+                        selectionArgs, null);
 
                 if (dataCursor == null) {
                     Log.d(TAG, "Failed to fetch data from contact database");
@@ -419,7 +434,8 @@
     /* checkFieldUpdates checks update contact fields of a particular contact.
      * Field update can be a field updated/added/deleted in an existing contact.
      * Returns true if any contact field is updated else return false. */
-    private static boolean checkFieldUpdates(ArrayList<String> oldFields,
+    @VisibleForTesting
+    static boolean checkFieldUpdates(ArrayList<String> oldFields,
             ArrayList<String> newFields) {
         if (newFields != null && oldFields != null) {
             if (newFields.size() != oldFields.size()) {
@@ -451,11 +467,13 @@
     /* fetchAndSetContacts reads contacts and caches them
      * isLoad = true indicates its loading all contacts
      * isLoad = false indiacates its caching recently added contact in database*/
-    private static int fetchAndSetContacts(Context context, Handler handler, String[] projection,
+    @VisibleForTesting
+    static int fetchAndSetContacts(Context context, Handler handler, String[] projection,
             String whereClause, String[] selectionArgs, boolean isLoad) {
         long currentTotalFields = 0, currentSvcFieldCount = 0;
-        Cursor c = context.getContentResolver()
-                .query(Data.CONTENT_URI, projection, whereClause, selectionArgs, null);
+        Cursor c = BluetoothMethodProxy.getInstance().contentResolverQuery(
+                context.getContentResolver(), Data.CONTENT_URI, projection, whereClause,
+                selectionArgs, null);
 
         /* send delayed message to loadContact when ContentResolver is unable
          * to fetch data from contact database using the specified URI at that
@@ -540,8 +558,8 @@
      * email or address which is required for updating Secondary Version counter).
      * contactsFieldData - List of field data for phone/email/address.
      * contactId - Contact ID, data1 - field value from data table for phone/email/address*/
-
-    private static void setContactFields(String fieldType, String contactId, String data) {
+    @VisibleForTesting
+    static void setContactFields(String fieldType, String contactId, String data) {
         ContactData cData;
         if (sContactDataset.containsKey(contactId)) {
             cData = sContactDataset.get(contactId);
diff --git a/android/app/src/com/android/bluetooth/pbap/BluetoothPbapVcardManager.java b/android/app/src/com/android/bluetooth/pbap/BluetoothPbapVcardManager.java
index b22713f..ba4f9d4 100644
--- a/android/app/src/com/android/bluetooth/pbap/BluetoothPbapVcardManager.java
+++ b/android/app/src/com/android/bluetooth/pbap/BluetoothPbapVcardManager.java
@@ -51,8 +51,10 @@
 import android.text.TextUtils;
 import android.util.Log;
 
+import com.android.bluetooth.BluetoothMethodProxy;
 import com.android.bluetooth.R;
 import com.android.bluetooth.util.DevicePolicyUtils;
+import com.android.internal.annotations.VisibleForTesting;
 import com.android.obex.Operation;
 import com.android.obex.ResponseCodes;
 import com.android.obex.ServerOperation;
@@ -60,8 +62,6 @@
 import com.android.vcard.VCardConfig;
 import com.android.vcard.VCardPhoneNumberTranslationCallback;
 
-import java.io.IOException;
-import java.io.OutputStream;
 import java.nio.ByteBuffer;
 import java.util.ArrayList;
 import java.util.Collections;
@@ -140,11 +140,10 @@
         }
         //End enhancement
 
-        BluetoothPbapCallLogComposer composer = new BluetoothPbapCallLogComposer(mContext);
         String name = BluetoothPbapService.getLocalPhoneName();
         String number = BluetoothPbapService.getLocalPhoneNum();
-        String vcard = composer.composeVCardForPhoneOwnNumber(Phone.TYPE_MOBILE, name, number,
-                vcardType21);
+        String vcard = BluetoothPbapCallLogComposer.composeVCardForPhoneOwnNumber(
+                Phone.TYPE_MOBILE, name, number, vcardType21);
         return vcard;
     }
 
@@ -174,7 +173,7 @@
      * @param type specifies which phonebook object, e.g., pb, fav
      * @return
      */
-    public final int getContactsSize(final int type) {
+    private int getContactsSize(final int type) {
         final Uri myUri = DevicePolicyUtils.getEnterprisePhoneUri(mContext);
         Cursor contactCursor = null;
         String selectionClause = null;
@@ -182,8 +181,8 @@
             selectionClause = Phone.STARRED + " = 1";
         }
         try {
-            contactCursor = mResolver.query(myUri,
-                    new String[]{Phone.CONTACT_ID}, selectionClause,
+            contactCursor = BluetoothMethodProxy.getInstance().contentResolverQuery(mResolver,
+                    myUri, new String[]{Phone.CONTACT_ID}, selectionClause,
                     null, Phone.CONTACT_ID);
             if (contactCursor == null) {
                 return 0;
@@ -203,14 +202,14 @@
         return 0;
     }
 
-    public final int getCallHistorySize(final int type) {
+    private int getCallHistorySize(final int type) {
         final Uri myUri = CallLog.Calls.CONTENT_URI;
         String selection = BluetoothPbapObexServer.createSelectionPara(type);
         int size = 0;
         Cursor callCursor = null;
         try {
-            callCursor =
-                    mResolver.query(myUri, null, selection, null, CallLog.Calls.DEFAULT_SORT_ORDER);
+            callCursor = BluetoothMethodProxy.getInstance().contentResolverQuery(mResolver,
+                    myUri, null, selection, null, CallLog.Calls.DEFAULT_SORT_ORDER);
             if (callCursor != null) {
                 size = callCursor.getCount();
             }
@@ -225,9 +224,12 @@
         return size;
     }
 
-    private static final int CALLS_NUMBER_COLUMN_INDEX = 0;
-    private static final int CALLS_NAME_COLUMN_INDEX = 1;
-    private static final int CALLS_NUMBER_PRESENTATION_COLUMN_INDEX = 2;
+    @VisibleForTesting
+    static final int CALLS_NUMBER_COLUMN_INDEX = 0;
+    @VisibleForTesting
+    static final int CALLS_NAME_COLUMN_INDEX = 1;
+    @VisibleForTesting
+    static final int CALLS_NUMBER_PRESENTATION_COLUMN_INDEX = 2;
 
     public final ArrayList<String> loadCallHistoryList(final int type) {
         final Uri myUri = CallLog.Calls.CONTENT_URI;
@@ -240,7 +242,8 @@
         Cursor callCursor = null;
         ArrayList<String> list = new ArrayList<String>();
         try {
-            callCursor = mResolver.query(myUri, projection, selection, null, CALLLOG_SORT_ORDER);
+            callCursor = BluetoothMethodProxy.getInstance().contentResolverQuery(mResolver,
+                    myUri, projection, selection, null, CALLLOG_SORT_ORDER);
             if (callCursor != null) {
                 for (callCursor.moveToFirst(); !callCursor.isAfterLast(); callCursor.moveToNext()) {
                     String name = callCursor.getString(CALLS_NAME_COLUMN_INDEX);
@@ -278,7 +281,9 @@
         if (ownerName == null || ownerName.length() == 0) {
             ownerName = BluetoothPbapService.getLocalPhoneName();
         }
-        nameList.add(ownerName);
+        if (ownerName != null) {
+            nameList.add(ownerName);
+        }
         //End enhancement
 
         final Uri myUri = DevicePolicyUtils.getEnterprisePhoneUri(mContext);
@@ -289,7 +294,8 @@
             if (orderByWhat == BluetoothPbapObexServer.ORDER_BY_ALPHABETICAL) {
                 orderBy = Phone.DISPLAY_NAME;
             }
-            contactCursor = mResolver.query(myUri, PHONES_CONTACTS_PROJECTION, null, null, orderBy);
+            contactCursor = BluetoothMethodProxy.getInstance().contentResolverQuery(mResolver,
+                    myUri, PHONES_CONTACTS_PROJECTION, null, null, orderBy);
             if (contactCursor != null) {
                 appendDistinctNameIdList(nameList, mContext.getString(android.R.string.unknownName),
                         contactCursor);
@@ -309,7 +315,7 @@
 
     final ArrayList<String> getSelectedPhonebookNameList(final int orderByWhat,
             final boolean vcardType21, int needSendBody, int pbSize, byte[] selector,
-            String vcardselectorop) {
+            String vCardSelectorOperator) {
         ArrayList<String> nameList = new ArrayList<String>();
         PropertySelector vcardselector = new PropertySelector(selector);
         VCardComposer composer = null;
@@ -347,7 +353,8 @@
         final Uri myUri = DevicePolicyUtils.getEnterprisePhoneUri(mContext);
         Cursor contactCursor = null;
         try {
-            contactCursor = mResolver.query(myUri, PHONES_CONTACTS_PROJECTION, null, null,
+            contactCursor = BluetoothMethodProxy.getInstance().contentResolverQuery(mResolver,
+                    myUri, PHONES_CONTACTS_PROJECTION, null, null,
                     Phone.CONTACT_ID);
 
             ArrayList<String> contactNameIdList = new ArrayList<String>();
@@ -382,13 +389,13 @@
                         Log.v(TAG, "Checking selected bits in the vcard composer" + vcard);
                     }
 
-                    if (!vcardselector.checkVCardSelector(vcard, vcardselectorop)) {
+                    if (!vcardselector.checkVCardSelector(vcard, vCardSelectorOperator)) {
                         Log.e(TAG, "vcard selector check fail");
                         vcard = null;
                         pbSize--;
                         continue;
                     } else {
-                        String name = vcardselector.getName(vcard);
+                        String name = getNameFromVCard(vcard);
                         if (TextUtils.isEmpty(name)) {
                             name = mContext.getString(android.R.string.unknownName);
                         }
@@ -421,7 +428,6 @@
 
     public final ArrayList<String> getContactNamesByNumber(final String phoneNumber) {
         ArrayList<String> nameList = new ArrayList<String>();
-        ArrayList<String> tempNameList = new ArrayList<String>();
 
         Cursor contactCursor = null;
         Uri uri = null;
@@ -436,7 +442,8 @@
         }
 
         try {
-            contactCursor = mResolver.query(uri, projection, null, null, Phone.CONTACT_ID);
+            contactCursor = BluetoothMethodProxy.getInstance().contentResolverQuery(mResolver,
+                    uri, projection, null, null, Phone.CONTACT_ID);
 
             if (contactCursor != null) {
                 appendDistinctNameIdList(nameList, mContext.getString(android.R.string.unknownName),
@@ -455,13 +462,6 @@
                 contactCursor = null;
             }
         }
-        int tempListSize = tempNameList.size();
-        for (int index = 0; index < tempListSize; index++) {
-            String object = tempNameList.get(index);
-            if (!nameList.contains(object)) {
-                nameList.add(object);
-            }
-        }
 
         return nameList;
     }
@@ -477,7 +477,8 @@
         long primaryVcMsb = 0;
         ArrayList<String> list = new ArrayList<String>();
         try {
-            callCursor = mResolver.query(myUri, null, selection, null, null);
+            callCursor = BluetoothMethodProxy.getInstance().contentResolverQuery(mResolver,
+                    myUri, null, selection, null, null);
             while (callCursor != null && callCursor.moveToNext()) {
                 count = count + 1;
             }
@@ -520,7 +521,8 @@
         long endPointId = 0;
         try {
             // Need test to see if order by _ID is ok here, or by date?
-            callsCursor = mResolver.query(myUri, CALLLOG_PROJECTION, typeSelection, null,
+            callsCursor = BluetoothMethodProxy.getInstance().contentResolverQuery(mResolver,
+                    myUri, CALLLOG_PROJECTION, typeSelection, null,
                     CALLLOG_SORT_ORDER);
             if (callsCursor != null) {
                 callsCursor.moveToPosition(startPoint - 1);
@@ -593,7 +595,8 @@
         }
 
         try {
-            contactCursor = mResolver.query(myUri, PHONES_CONTACTS_PROJECTION, selectionClause,
+            contactCursor = BluetoothMethodProxy.getInstance().contentResolverQuery(mResolver,
+                    myUri, PHONES_CONTACTS_PROJECTION, selectionClause,
                     null, Phone.CONTACT_ID);
             if (contactCursor != null) {
                 contactIdCursor =
@@ -636,7 +639,8 @@
             if (orderByWhat == BluetoothPbapObexServer.ORDER_BY_ALPHABETICAL) {
                 orderBy = Phone.DISPLAY_NAME;
             }
-            contactCursor = mResolver.query(myUri, PHONES_CONTACTS_PROJECTION, null, null, orderBy);
+            contactCursor = BluetoothMethodProxy.getInstance().contentResolverQuery(mResolver,
+                    myUri, PHONES_CONTACTS_PROJECTION, null, null, orderBy);
         } catch (CursorWindowAllocationException e) {
             Log.e(TAG, "CursorWindowAllocationException while composing phonebook one vcard");
         } finally {
@@ -653,14 +657,14 @@
     /**
      * Filter contact cursor by certain condition.
      */
-    private static final class ContactCursorFilter {
+    static final class ContactCursorFilter {
         /**
          *
          * @param contactCursor
          * @param offset
          * @return a cursor containing contact id of {@code offset} contact.
          */
-        public static Cursor filterByOffset(Cursor contactCursor, int offset) {
+        static Cursor filterByOffset(Cursor contactCursor, int offset) {
             return filterByRange(contactCursor, offset, offset);
         }
 
@@ -670,9 +674,9 @@
          * @param startPoint
          * @param endPoint
          * @return a cursor containing contact ids of {@code startPoint}th to {@code endPoint}th
-         * contact.
+         * contact. (i.e. [startPoint, endPoint], both points should be greater than 0)
          */
-        public static Cursor filterByRange(Cursor contactCursor, int startPoint, int endPoint) {
+        static Cursor filterByRange(Cursor contactCursor, int startPoint, int endPoint) {
             final int contactIdColumn = contactCursor.getColumnIndex(Data.CONTACT_ID);
             long previousContactId = -1;
             // As startPoint, endOffset index starts from 1 to n, we set
@@ -746,7 +750,7 @@
             });
             buffer = new HandlerForStringBuffer(op, ownerVCard);
             Log.v(TAG, "contactIdCursor size: " + contactIdCursor.getCount());
-            if (!composer.init(contactIdCursor) || !buffer.onInit(mContext)) {
+            if (!composer.init(contactIdCursor) || !buffer.init()) {
                 return ResponseCodes.OBEX_HTTP_INTERNAL_ERROR;
             }
             int idColumn = contactIdCursor.getColumnIndex(Data.CONTACT_ID);
@@ -783,7 +787,7 @@
                     Log.v(TAG, "vCard after cleanup: " + vcard);
                 }
 
-                if (!buffer.onEntryCreated(vcard)) {
+                if (!buffer.writeVCard(vcard)) {
                     // onEntryCreate() already emits error.
                     return ResponseCodes.OBEX_HTTP_INTERNAL_ERROR;
                 }
@@ -793,7 +797,7 @@
                 composer.terminate();
             }
             if (buffer != null) {
-                buffer.onTerminate();
+                buffer.terminate();
             }
         }
 
@@ -851,7 +855,7 @@
             });
             buffer = new HandlerForStringBuffer(op, ownerVCard);
             Log.v(TAG, "contactIdCursor size: " + contactIdCursor.getCount());
-            if (!composer.init(contactIdCursor) || !buffer.onInit(mContext)) {
+            if (!composer.init(contactIdCursor) || !buffer.init()) {
                 return ResponseCodes.OBEX_HTTP_INTERNAL_ERROR;
             }
             int idColumn = contactIdCursor.getColumnIndex(Data.CONTACT_ID);
@@ -898,7 +902,7 @@
                         Log.v(TAG, "vCard after cleanup: " + vcard);
                     }
 
-                    if (!buffer.onEntryCreated(vcard)) {
+                    if (!buffer.writeVCard(vcard)) {
                         // onEntryCreate() already emits error.
                         return ResponseCodes.OBEX_HTTP_INTERNAL_ERROR;
                     }
@@ -913,7 +917,7 @@
                 composer.terminate();
             }
             if (buffer != null) {
-                buffer.onTerminate();
+                buffer.terminate();
             }
         }
 
@@ -943,7 +947,7 @@
             composer = new BluetoothPbapCallLogComposer(mContext);
             buffer = new HandlerForStringBuffer(op, ownerVCard);
             if (!composer.init(CallLog.Calls.CONTENT_URI, selection, null, CALLLOG_SORT_ORDER)
-                    || !buffer.onInit(mContext)) {
+                    || !buffer.init()) {
                 return ResponseCodes.OBEX_HTTP_INTERNAL_ERROR;
             }
 
@@ -976,7 +980,7 @@
                             Log.v(TAG, "Vcard Entry:");
                             Log.v(TAG, vcard);
                         }
-                        buffer.onEntryCreated(vcard);
+                        buffer.writeVCard(vcard);
                     }
                 } else {
                     if (vcard == null) {
@@ -988,7 +992,7 @@
                         Log.v(TAG, "Vcard Entry:");
                         Log.v(TAG, vcard);
                     }
-                    buffer.onEntryCreated(vcard);
+                    buffer.writeVCard(vcard);
                 }
             }
             if (needSendBody != NEED_SEND_BODY && vCardSelct) {
@@ -999,7 +1003,7 @@
                 composer.terminate();
             }
             if (buffer != null) {
-                buffer.onTerminate();
+                buffer.terminate();
             }
         }
 
@@ -1011,7 +1015,8 @@
     }
 
     public String stripTelephoneNumber(String vCard) {
-        String[] attr = vCard.split(System.getProperty("line.separator"));
+        String separator = System.getProperty("line.separator");
+        String[] attr = vCard.split(separator);
         String stripedVCard = "";
         for (int i = 0; i < attr.length; i++) {
             if (attr[i].startsWith("TEL")) {
@@ -1034,7 +1039,7 @@
 
         for (int i = 0; i < attr.length; i++) {
             if (!attr[i].isEmpty()) {
-                stripedVCard = stripedVCard.concat(attr[i] + "\n");
+                stripedVCard = stripedVCard.concat(attr[i] + separator);
             }
         }
         if (V) {
@@ -1043,71 +1048,6 @@
         return stripedVCard;
     }
 
-    /**
-     * Handler to emit vCards to PCE.
-     */
-    public class HandlerForStringBuffer {
-        private Operation mOperation;
-
-        private OutputStream mOutputStream;
-
-        private String mPhoneOwnVCard = null;
-
-        public HandlerForStringBuffer(Operation op, String ownerVCard) {
-            mOperation = op;
-            if (ownerVCard != null) {
-                mPhoneOwnVCard = ownerVCard;
-                if (V) {
-                    Log.v(TAG, "phone own number vcard:");
-                }
-                if (V) {
-                    Log.v(TAG, mPhoneOwnVCard);
-                }
-            }
-        }
-
-        private boolean write(String vCard) {
-            try {
-                if (vCard != null) {
-                    mOutputStream.write(vCard.getBytes());
-                    return true;
-                }
-            } catch (IOException e) {
-                Log.e(TAG, "write outputstrem failed" + e.toString());
-            }
-            return false;
-        }
-
-        public boolean onInit(Context context) {
-            try {
-                mOutputStream = mOperation.openOutputStream();
-                if (mPhoneOwnVCard != null) {
-                    return write(mPhoneOwnVCard);
-                }
-                return true;
-            } catch (IOException e) {
-                Log.e(TAG, "open outputstrem failed" + e.toString());
-            }
-            return false;
-        }
-
-        public boolean onEntryCreated(String vcard) {
-            return write(vcard);
-        }
-
-        public void onTerminate() {
-            if (!BluetoothPbapObexServer.closeStream(mOutputStream, mOperation)) {
-                if (V) {
-                    Log.v(TAG, "CloseStream failed!");
-                }
-            } else {
-                if (V) {
-                    Log.v(TAG, "CloseStream ok!");
-                }
-            }
-        }
-    }
-
     public static class VCardFilter {
         private enum FilterBit {
             //       bit  property                  onlyCheckV21  excludeForV21
@@ -1150,7 +1090,7 @@
             if (vCardType21 && bit.excludeForV21) {
                 return false;
             }
-            if (mFilter == null || offset >= mFilter.length) {
+            if (mFilter == null || offset > mFilter.length) {
                 return true;
             }
             return ((mFilter[mFilter.length - offset] >> bitPos) & 0x01) != 0;
@@ -1207,7 +1147,8 @@
         }
     }
 
-    private static class PropertySelector {
+    @VisibleForTesting
+    static class PropertySelector {
         private enum PropertyMask {
             //               bit    property
             VERSION(0, "VERSION"),
@@ -1226,12 +1167,12 @@
             NICKNAME(23, "NICKNAME"),
             DATETIME(28, "DATETIME");
 
-            public final int pos;
-            public final String prop;
+            public final int mBitPosition;
+            public final String mProperty;
 
-            PropertyMask(int pos, String prop) {
-                this.pos = pos;
-                this.prop = prop;
+            PropertyMask(int bitPosition, String property) {
+                this.mBitPosition = bitPosition;
+                this.mProperty = property;
             }
         }
 
@@ -1242,71 +1183,51 @@
             this.mSelector = selector;
         }
 
-        private boolean checkbit(int attrBit, byte[] selector) {
-            int selectorlen = selector.length;
-            if (((selector[selectorlen - 1 - ((int) attrBit / 8)] >> (attrBit % 8)) & 0x01) == 0) {
+        boolean checkVCardSelector(String vCard, String vCardSelectorOperator) {
+            Log.d(TAG, "vCardSelectorOperator=" + vCardSelectorOperator);
+
+            final boolean checkAtLeastOnePropertyExists = vCardSelectorOperator.equals("0");
+            final boolean checkAllPropertiesExist = vCardSelectorOperator.equals("1");
+
+            boolean result = true;
+
+            if (checkAtLeastOnePropertyExists) {
+                for (PropertyMask mask : PropertyMask.values()) {
+                    if (!checkBit(mask.mBitPosition, mSelector)) {
+                        continue;
+                    }
+                    Log.d(TAG, "checking for prop :" + mask.mProperty);
+
+                    if (doesVCardHaveProperty(vCard, mask.mProperty)) {
+                        Log.d(TAG, "mask.prop.equals current prop :" + mask.mProperty);
+                        return true;
+                    } else {
+                        result = false;
+                    }
+                }
+            } else if (checkAllPropertiesExist) {
+                for (PropertyMask mask : PropertyMask.values()) {
+                    if (!checkBit(mask.mBitPosition, mSelector)) {
+                        continue;
+                    }
+                    Log.d(TAG, "checking for prop :" + mask.mProperty);
+
+                    if (!doesVCardHaveProperty(vCard, mask.mProperty)) {
+                        Log.d(TAG, "mask.prop.notequals current prop" + mask.mProperty);
+                        return false;
+                    }
+                }
+            }
+
+            return result;
+        }
+
+        private boolean checkBit(int attrBit, byte[] selector) {
+            int offset = (attrBit / 8) + 1;
+            if (mSelector == null || offset > mSelector.length) {
                 return false;
             }
-            return true;
-        }
-
-        private boolean checkprop(String vcard, String prop) {
-            String[] lines = vcard.split(SEPARATOR);
-            boolean isPresent = false;
-            for (String line : lines) {
-                if (!Character.isWhitespace(line.charAt(0)) && !line.startsWith("=")) {
-                    String currentProp = line.split("[;:]")[0];
-                    if (prop.equals(currentProp)) {
-                        Log.d(TAG, "bit.prop.equals current prop :" + prop);
-                        isPresent = true;
-                        return isPresent;
-                    }
-                }
-            }
-
-            return isPresent;
-        }
-
-        private boolean checkVCardSelector(String vcard, String vcardselectorop) {
-            boolean selectedIn = true;
-
-            for (PropertyMask bit : PropertyMask.values()) {
-                if (checkbit(bit.pos, mSelector)) {
-                    Log.d(TAG, "checking for prop :" + bit.prop);
-                    if (vcardselectorop.equals("0")) {
-                        if (checkprop(vcard, bit.prop)) {
-                            Log.d(TAG, "bit.prop.equals current prop :" + bit.prop);
-                            selectedIn = true;
-                            break;
-                        } else {
-                            selectedIn = false;
-                        }
-                    } else if (vcardselectorop.equals("1")) {
-                        if (!checkprop(vcard, bit.prop)) {
-                            Log.d(TAG, "bit.prop.notequals current prop" + bit.prop);
-                            selectedIn = false;
-                            return selectedIn;
-                        } else {
-                            selectedIn = true;
-                        }
-                    }
-                }
-            }
-            return selectedIn;
-        }
-
-        private String getName(String vcard) {
-            String[] lines = vcard.split(SEPARATOR);
-            String name = "";
-            for (String line : lines) {
-                if (!Character.isWhitespace(line.charAt(0)) && !line.startsWith("=")) {
-                    if (line.startsWith("N:")) {
-                        name = line.substring(line.lastIndexOf(':'), line.length());
-                    }
-                }
-            }
-            Log.d(TAG, "returning name: " + name);
-            return name;
+            return ((selector[mSelector.length - offset] >> (attrBit % 8)) & 0x01) != 0;
         }
     }
 
@@ -1367,4 +1288,32 @@
             }
         }
     }
+
+    @VisibleForTesting
+    static String getNameFromVCard(String vCard) {
+        String[] lines = vCard.split(PropertySelector.SEPARATOR);
+        String name = "";
+        for (String line : lines) {
+            if (!Character.isWhitespace(line.charAt(0)) && !line.startsWith("=")) {
+                if (line.startsWith("N:")) {
+                    name = line.substring(line.lastIndexOf(':') + 1);
+                }
+            }
+        }
+        Log.d(TAG, "returning name: " + name);
+        return name;
+    }
+
+    private static boolean doesVCardHaveProperty(String vCard, String property) {
+        String[] lines = vCard.split(PropertySelector.SEPARATOR);
+        for (String line : lines) {
+            if (!Character.isWhitespace(line.charAt(0)) && !line.startsWith("=")) {
+                String currentProperty = line.split("[;:]")[0];
+                if (property.equals(currentProperty)) {
+                    return true;
+                }
+            }
+        }
+        return false;
+    }
 }
diff --git a/android/app/src/com/android/bluetooth/pbap/HandlerForStringBuffer.java b/android/app/src/com/android/bluetooth/pbap/HandlerForStringBuffer.java
new file mode 100644
index 0000000..4a4a520
--- /dev/null
+++ b/android/app/src/com/android/bluetooth/pbap/HandlerForStringBuffer.java
@@ -0,0 +1,80 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.pbap;
+
+import android.util.Log;
+
+import com.android.obex.Operation;
+
+import java.io.IOException;
+import java.io.OutputStream;
+
+/**
+ * Handler to emit vCards to PCE.
+ */
+public class HandlerForStringBuffer {
+    private static final String TAG = "HandlerForStringBuffer";
+
+    private final Operation mOperation;
+    private final String mOwnerVCard;
+
+    private OutputStream mOutputStream;
+
+    public HandlerForStringBuffer(Operation op, String ownerVCard) {
+        mOperation = op;
+        mOwnerVCard = ownerVCard;
+        if (BluetoothPbapService.VERBOSE) {
+            Log.v(TAG, "ownerVCard \n " + mOwnerVCard);
+        }
+    }
+
+    public boolean init() {
+        try {
+            mOutputStream = mOperation.openOutputStream();
+            if (mOwnerVCard != null) {
+                return writeVCard(mOwnerVCard);
+            }
+            return true;
+        } catch (IOException e) {
+            Log.e(TAG, "openOutputStream failed", e);
+        }
+        return false;
+    }
+
+    public boolean writeVCard(String vCard) {
+        try {
+            if (vCard != null) {
+                mOutputStream.write(vCard.getBytes());
+                return true;
+            }
+        } catch (IOException e) {
+            Log.e(TAG, "write failed", e);
+        }
+        return false;
+    }
+
+    public void terminate() {
+        boolean result = BluetoothPbapObexServer.closeStream(mOutputStream, mOperation);
+        if (BluetoothPbapService.VERBOSE) {
+            if (result) {
+                Log.v(TAG, "closeStream succeeded!");
+            } else {
+                Log.v(TAG, "closeStream failed!");
+            }
+        }
+    }
+}
diff --git a/android/app/src/com/android/bluetooth/pbap/PbapStateMachine.java b/android/app/src/com/android/bluetooth/pbap/PbapStateMachine.java
index 3859b42..3767877 100644
--- a/android/app/src/com/android/bluetooth/pbap/PbapStateMachine.java
+++ b/android/app/src/com/android/bluetooth/pbap/PbapStateMachine.java
@@ -41,6 +41,8 @@
 import com.android.bluetooth.R;
 import com.android.bluetooth.Utils;
 import com.android.bluetooth.btservice.MetricsLogger;
+import com.android.internal.annotations.VisibleForTesting;
+import com.android.internal.annotations.VisibleForTesting.Visibility;
 import com.android.internal.util.State;
 import com.android.internal.util.StateMachine;
 import com.android.obex.ResponseCodes;
@@ -61,7 +63,8 @@
  *          CONNECTED   ----->  FINISHED
  *                (OBEX Server done)
  */
-class PbapStateMachine extends StateMachine {
+@VisibleForTesting(visibility = Visibility.PACKAGE)
+public class PbapStateMachine extends StateMachine {
     private static final String TAG = "PbapStateMachine";
     private static final boolean DEBUG = true;
     private static final boolean VERBOSE = true;
diff --git a/android/app/src/com/android/bluetooth/pbapclient/BluetoothPbapObexAuthenticator.java b/android/app/src/com/android/bluetooth/pbapclient/BluetoothPbapObexAuthenticator.java
index 629b193..06ca087 100644
--- a/android/app/src/com/android/bluetooth/pbapclient/BluetoothPbapObexAuthenticator.java
+++ b/android/app/src/com/android/bluetooth/pbapclient/BluetoothPbapObexAuthenticator.java
@@ -19,22 +19,24 @@
 import android.os.Handler;
 import android.util.Log;
 
+import com.android.internal.annotations.VisibleForTesting;
 import com.android.obex.Authenticator;
 import com.android.obex.PasswordAuthentication;
 
+import java.util.Arrays;
+
 /* ObexAuthentication is a required component for PBAP in order to support backwards compatibility
  * with PSE devices prior to PBAP 1.2. With profiles prior to 1.2 the actual initiation of
  * authentication is implementation defined.
  */
-
-
 class BluetoothPbapObexAuthenticator implements Authenticator {
 
     private static final String TAG = "BtPbapObexAuthenticator";
     private static final boolean DBG = Utils.DBG;
 
     //Default session key for legacy devices is 0000
-    private String mSessionKey = "0000";
+    @VisibleForTesting
+    String mSessionKey = "0000";
 
     private final Handler mCallback;
 
@@ -63,9 +65,8 @@
 
     @Override
     public byte[] onAuthenticationResponse(byte[] userName) {
-        if (DBG) Log.v(TAG, "onAuthenticationResponse: " + userName);
+        if (DBG) Log.v(TAG, "onAuthenticationResponse: " + Arrays.toString(userName));
         /* required only in case PCE challenges PSE which we don't do now */
         return null;
     }
-
 }
diff --git a/android/app/src/com/android/bluetooth/pbapclient/BluetoothPbapObexTransport.java b/android/app/src/com/android/bluetooth/pbapclient/BluetoothPbapObexTransport.java
deleted file mode 100644
index d1cad9d..0000000
--- a/android/app/src/com/android/bluetooth/pbapclient/BluetoothPbapObexTransport.java
+++ /dev/null
@@ -1,98 +0,0 @@
-/*
- * Copyright (C) 2016 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package com.android.bluetooth.pbapclient;
-
-import android.bluetooth.BluetoothSocket;
-
-import com.android.obex.ObexTransport;
-
-import java.io.DataInputStream;
-import java.io.DataOutputStream;
-import java.io.IOException;
-import java.io.InputStream;
-import java.io.OutputStream;
-
-class BluetoothPbapObexTransport implements ObexTransport {
-
-    private BluetoothSocket mSocket = null;
-
-    BluetoothPbapObexTransport(BluetoothSocket rfs) {
-        super();
-        mSocket = rfs;
-    }
-
-    @Override
-    public void close() throws IOException {
-        mSocket.close();
-    }
-
-    @Override
-    public DataInputStream openDataInputStream() throws IOException {
-        return new DataInputStream(openInputStream());
-    }
-
-    @Override
-    public DataOutputStream openDataOutputStream() throws IOException {
-        return new DataOutputStream(openOutputStream());
-    }
-
-    @Override
-    public InputStream openInputStream() throws IOException {
-        return mSocket.getInputStream();
-    }
-
-    @Override
-    public OutputStream openOutputStream() throws IOException {
-        return mSocket.getOutputStream();
-    }
-
-    @Override
-    public void connect() throws IOException {
-    }
-
-    @Override
-    public void create() throws IOException {
-    }
-
-    @Override
-    public void disconnect() throws IOException {
-    }
-
-    @Override
-    public void listen() throws IOException {
-    }
-
-    public boolean isConnected() throws IOException {
-        // return true;
-        return mSocket.isConnected();
-    }
-
-    @Override
-    public int getMaxTransmitPacketSize() {
-        return -1;
-    }
-
-    @Override
-    public int getMaxReceivePacketSize() {
-        return -1;
-    }
-
-    @Override
-    public boolean isSrmSupported() {
-        return false;
-    }
-}
diff --git a/android/app/src/com/android/bluetooth/pbapclient/BluetoothPbapRequestPullPhoneBook.java b/android/app/src/com/android/bluetooth/pbapclient/BluetoothPbapRequestPullPhoneBook.java
index d563237..2fde0b8 100644
--- a/android/app/src/com/android/bluetooth/pbapclient/BluetoothPbapRequestPullPhoneBook.java
+++ b/android/app/src/com/android/bluetooth/pbapclient/BluetoothPbapRequestPullPhoneBook.java
@@ -19,6 +19,7 @@
 import android.accounts.Account;
 import android.util.Log;
 
+import com.android.bluetooth.ObexAppParameters;
 import com.android.obex.HeaderSet;
 import com.android.vcard.VCardEntry;
 
diff --git a/android/app/src/com/android/bluetooth/pbapclient/BluetoothPbapRequestPullPhoneBookSize.java b/android/app/src/com/android/bluetooth/pbapclient/BluetoothPbapRequestPullPhoneBookSize.java
index bd5e0a3..8552114 100644
--- a/android/app/src/com/android/bluetooth/pbapclient/BluetoothPbapRequestPullPhoneBookSize.java
+++ b/android/app/src/com/android/bluetooth/pbapclient/BluetoothPbapRequestPullPhoneBookSize.java
@@ -18,6 +18,7 @@
 
 import android.util.Log;
 
+import com.android.bluetooth.ObexAppParameters;
 import com.android.obex.HeaderSet;
 
 final class BluetoothPbapRequestPullPhoneBookSize extends BluetoothPbapRequest {
diff --git a/android/app/src/com/android/bluetooth/pbapclient/CallLogPullRequest.java b/android/app/src/com/android/bluetooth/pbapclient/CallLogPullRequest.java
index 8ab9a1a..4f73938 100644
--- a/android/app/src/com/android/bluetooth/pbapclient/CallLogPullRequest.java
+++ b/android/app/src/com/android/bluetooth/pbapclient/CallLogPullRequest.java
@@ -29,6 +29,7 @@
 import android.util.Log;
 import android.util.Pair;
 
+import com.android.internal.annotations.VisibleForTesting;
 import com.android.vcard.VCardEntry;
 import com.android.vcard.VCardEntry.PhoneData;
 
@@ -42,7 +43,8 @@
     private static final boolean DBG = Utils.DBG;
     private static final boolean VDBG = Utils.VDBG;
     private static final String TAG = "PbapCallLogPullRequest";
-    private static final String TIMESTAMP_PROPERTY = "X-IRMC-CALL-DATETIME";
+    @VisibleForTesting
+    static final String TIMESTAMP_PROPERTY = "X-IRMC-CALL-DATETIME";
     private static final String TIMESTAMP_FORMAT = "yyyyMMdd'T'HHmmss";
 
     private final Account mAccount;
diff --git a/android/app/src/com/android/bluetooth/pbapclient/ObexAppParameters.java b/android/app/src/com/android/bluetooth/pbapclient/ObexAppParameters.java
deleted file mode 100644
index ef8eafc..0000000
--- a/android/app/src/com/android/bluetooth/pbapclient/ObexAppParameters.java
+++ /dev/null
@@ -1,182 +0,0 @@
-/*
- * Copyright (C) 2016 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package com.android.bluetooth.pbapclient;
-
-import com.android.obex.HeaderSet;
-
-import java.io.IOException;
-import java.nio.ByteBuffer;
-import java.util.HashMap;
-import java.util.Map;
-
-public final class ObexAppParameters {
-
-    private final HashMap<Byte, byte[]> mParams;
-
-    public ObexAppParameters() {
-        mParams = new HashMap<Byte, byte[]>();
-    }
-
-    public ObexAppParameters(byte[] raw) {
-        mParams = new HashMap<Byte, byte[]>();
-
-        if (raw != null) {
-            for (int i = 0; i < raw.length; ) {
-                if (raw.length - i < 2) {
-                    break;
-                }
-
-                byte tag = raw[i++];
-                byte len = raw[i++];
-
-                if (raw.length - i - len < 0) {
-                    break;
-                }
-
-                byte[] val = new byte[len];
-
-                System.arraycopy(raw, i, val, 0, len);
-                this.add(tag, val);
-
-                i += len;
-            }
-        }
-    }
-
-    public static ObexAppParameters fromHeaderSet(HeaderSet headerset) {
-        try {
-            byte[] raw = (byte[]) headerset.getHeader(HeaderSet.APPLICATION_PARAMETER);
-            return new ObexAppParameters(raw);
-        } catch (IOException e) {
-            // won't happen
-        }
-
-        return null;
-    }
-
-    public byte[] getHeader() {
-        int length = 0;
-
-        for (Map.Entry<Byte, byte[]> entry : mParams.entrySet()) {
-            length += (entry.getValue().length + 2);
-        }
-
-        byte[] ret = new byte[length];
-
-        int idx = 0;
-        for (Map.Entry<Byte, byte[]> entry : mParams.entrySet()) {
-            length = entry.getValue().length;
-
-            ret[idx++] = entry.getKey();
-            ret[idx++] = (byte) length;
-            System.arraycopy(entry.getValue(), 0, ret, idx, length);
-            idx += length;
-        }
-
-        return ret;
-    }
-
-    public void addToHeaderSet(HeaderSet headerset) {
-        if (mParams.size() > 0) {
-            headerset.setHeader(HeaderSet.APPLICATION_PARAMETER, getHeader());
-        }
-    }
-
-    public boolean exists(byte tag) {
-        return mParams.containsKey(tag);
-    }
-
-    public void add(byte tag, byte val) {
-        byte[] bval = ByteBuffer.allocate(1).put(val).array();
-        mParams.put(tag, bval);
-    }
-
-    public void add(byte tag, short val) {
-        byte[] bval = ByteBuffer.allocate(2).putShort(val).array();
-        mParams.put(tag, bval);
-    }
-
-    public void add(byte tag, int val) {
-        byte[] bval = ByteBuffer.allocate(4).putInt(val).array();
-        mParams.put(tag, bval);
-    }
-
-    public void add(byte tag, long val) {
-        byte[] bval = ByteBuffer.allocate(8).putLong(val).array();
-        mParams.put(tag, bval);
-    }
-
-    public void add(byte tag, String val) {
-        byte[] bval = val.getBytes();
-        mParams.put(tag, bval);
-    }
-
-    public void add(byte tag, byte[] bval) {
-        mParams.put(tag, bval);
-    }
-
-    public byte getByte(byte tag) {
-        byte[] bval = mParams.get(tag);
-
-        if (bval == null || bval.length < 1) {
-            return 0;
-        }
-
-        return ByteBuffer.wrap(bval).get();
-    }
-
-    public short getShort(byte tag) {
-        byte[] bval = mParams.get(tag);
-
-        if (bval == null || bval.length < 2) {
-            return 0;
-        }
-
-        return ByteBuffer.wrap(bval).getShort();
-    }
-
-    public int getInt(byte tag) {
-        byte[] bval = mParams.get(tag);
-
-        if (bval == null || bval.length < 4) {
-            return 0;
-        }
-
-        return ByteBuffer.wrap(bval).getInt();
-    }
-
-    public String getString(byte tag) {
-        byte[] bval = mParams.get(tag);
-
-        if (bval == null) {
-            return null;
-        }
-
-        return new String(bval);
-    }
-
-    public byte[] getByteArray(byte tag) {
-        byte[] bval = mParams.get(tag);
-
-        return bval;
-    }
-
-    @Override
-    public String toString() {
-        return mParams.toString();
-    }
-}
diff --git a/android/app/src/com/android/bluetooth/pbapclient/PbapClientConnectionHandler.java b/android/app/src/com/android/bluetooth/pbapclient/PbapClientConnectionHandler.java
index 70621d9..dcfd9de 100644
--- a/android/app/src/com/android/bluetooth/pbapclient/PbapClientConnectionHandler.java
+++ b/android/app/src/com/android/bluetooth/pbapclient/PbapClientConnectionHandler.java
@@ -17,7 +17,6 @@
 
 import android.accounts.Account;
 import android.accounts.AccountManager;
-import android.bluetooth.BluetoothAdapter;
 import android.bluetooth.BluetoothDevice;
 import android.bluetooth.BluetoothSocket;
 import android.bluetooth.BluetoothUuid;
@@ -31,7 +30,9 @@
 import android.util.Log;
 
 import com.android.bluetooth.BluetoothObexTransport;
+import com.android.bluetooth.ObexAppParameters;
 import com.android.bluetooth.R;
+import com.android.internal.annotations.VisibleForTesting;
 import com.android.obex.ClientSession;
 import com.android.obex.HeaderSet;
 import com.android.obex.ResponseCodes;
@@ -102,7 +103,9 @@
     private static final long PBAP_REQUESTED_FIELDS =
             PBAP_FILTER_VERSION | PBAP_FILTER_FN | PBAP_FILTER_N | PBAP_FILTER_PHOTO
                     | PBAP_FILTER_ADR | PBAP_FILTER_EMAIL | PBAP_FILTER_TEL | PBAP_FILTER_NICKNAME;
-    private static final int L2CAP_INVALID_PSM = -1;
+
+    @VisibleForTesting
+    static final int L2CAP_INVALID_PSM = -1;
 
     public static final String PB_PATH = "telecom/pb.vcf";
     public static final String FAV_PATH = "telecom/fav.vcf";
@@ -126,7 +129,6 @@
     private Account mAccount;
     private AccountManager mAccountManager;
     private BluetoothSocket mSocket;
-    private final BluetoothAdapter mAdapter;
     private final BluetoothDevice mDevice;
     // PSE SDP Record for current device.
     private SdpPseRecord mPseRec = null;
@@ -136,19 +138,6 @@
     private final PbapClientStateMachine mPbapClientStateMachine;
     private boolean mAccountCreated;
 
-    PbapClientConnectionHandler(Looper looper, Context context, PbapClientStateMachine stateMachine,
-            BluetoothDevice device) {
-        super(looper);
-        mAdapter = BluetoothAdapter.getDefaultAdapter();
-        mDevice = device;
-        mContext = context;
-        mPbapClientStateMachine = stateMachine;
-        mAuth = new BluetoothPbapObexAuthenticator(this);
-        mAccountManager = AccountManager.get(mPbapClientStateMachine.getContext());
-        mAccount =
-                new Account(mDevice.getAddress(), mContext.getString(R.string.pbap_account_type));
-    }
-
     /**
      * Constructs PCEConnectionHandler object
      *
@@ -156,7 +145,6 @@
      */
     PbapClientConnectionHandler(Builder pceHandlerbuild) {
         super(pceHandlerbuild.mLooper);
-        mAdapter = BluetoothAdapter.getDefaultAdapter();
         mDevice = pceHandlerbuild.mDevice;
         mContext = pceHandlerbuild.mContext;
         mPbapClientStateMachine = pceHandlerbuild.mClientStateMachine;
@@ -252,14 +240,14 @@
                 if (DBG) {
                     Log.d(TAG, "Completing Disconnect");
                 }
-                removeAccount(mAccount);
-                removeCallLog(mAccount);
+                removeAccount();
+                removeCallLog();
 
                 mPbapClientStateMachine.sendMessage(PbapClientStateMachine.MSG_CONNECTION_CLOSED);
                 break;
 
             case MSG_DOWNLOAD:
-                mAccountCreated = addAccount(mAccount);
+                mAccountCreated = addAccount();
                 if (!mAccountCreated) {
                     Log.e(TAG, "Account creation failed.");
                     return;
@@ -286,9 +274,20 @@
         return;
     }
 
+    @VisibleForTesting
+    synchronized void setPseRecord(SdpPseRecord record) {
+        mPseRec = record;
+    }
+
+    @VisibleForTesting
+    synchronized BluetoothSocket getSocket() {
+        return mSocket;
+    }
+
     /* Utilize SDP, if available, to create a socket connection over L2CAP, RFCOMM specified
      * channel, or RFCOMM default channel. */
-    private synchronized boolean connectSocket() {
+    @VisibleForTesting
+    synchronized boolean connectSocket() {
         try {
             /* Use BluetoothSocket to connect */
             if (mPseRec == null) {
@@ -318,7 +317,8 @@
 
     /* Connect an OBEX session over the already connected socket.  First establish an OBEX Transport
      * abstraction, then establish a Bluetooth Authenticator, and finally issue the connect call */
-    private boolean connectObexSession() {
+    @VisibleForTesting
+    boolean connectObexSession() {
         boolean connectionSuccessful = false;
 
         try {
@@ -357,13 +357,13 @@
             // Will get NPE if a null mSocket is passed to BluetoothObexTransport.
             // mSocket can be set to null if an abort() --> closeSocket() was called between
             // the calls to connectSocket() and connectObexSession().
-            Log.w(TAG, "CONNECT Failure " + e.toString());
+            Log.w(TAG, "CONNECT Failure ", e);
             closeSocket();
         }
         return connectionSuccessful;
     }
 
-    public void abort() {
+    void abort() {
         // Perform forced cleanup, it is ok if the handler throws an exception this will free the
         // handler to complete what it is doing and finish with cleanup.
         closeSocket();
@@ -385,6 +385,7 @@
         }
     }
 
+    @VisibleForTesting
     void downloadContacts(String path) {
         try {
             PhonebookPullRequest processor =
@@ -438,6 +439,7 @@
         }
     }
 
+    @VisibleForTesting
     void downloadCallLog(String path, HashMap<String, Integer> callCounter) {
         try {
             BluetoothPbapRequestPullPhoneBook request =
@@ -453,8 +455,9 @@
         }
     }
 
-    private boolean addAccount(Account account) {
-        if (mAccountManager.addAccountExplicitly(account, null, null)) {
+    @VisibleForTesting
+    boolean addAccount() {
+        if (mAccountManager.addAccountExplicitly(mAccount, null, null)) {
             if (DBG) {
                 Log.d(TAG, "Added account " + mAccount);
             }
@@ -463,17 +466,19 @@
         return false;
     }
 
-    private void removeAccount(Account account) {
-        if (mAccountManager.removeAccountExplicitly(account)) {
+    @VisibleForTesting
+    void removeAccount() {
+        if (mAccountManager.removeAccountExplicitly(mAccount)) {
             if (DBG) {
-                Log.d(TAG, "Removed account " + account);
+                Log.d(TAG, "Removed account " + mAccount);
             }
         } else {
             Log.e(TAG, "Failed to remove account " + mAccount);
         }
     }
 
-    private void removeCallLog(Account account) {
+    @VisibleForTesting
+    void removeCallLog() {
         try {
             // need to check call table is exist ?
             if (mContext.getContentResolver() == null) {
@@ -489,7 +494,8 @@
         }
     }
 
-    private boolean isRepositorySupported(int mask) {
+    @VisibleForTesting
+    boolean isRepositorySupported(int mask) {
         if (mPseRec == null) {
             if (VDBG) Log.v(TAG, "No PBAP Server SDP Record");
             return false;
diff --git a/android/app/src/com/android/bluetooth/pbapclient/PbapClientService.java b/android/app/src/com/android/bluetooth/pbapclient/PbapClientService.java
index 34feddc..ca24aac 100644
--- a/android/app/src/com/android/bluetooth/pbapclient/PbapClientService.java
+++ b/android/app/src/com/android/bluetooth/pbapclient/PbapClientService.java
@@ -34,6 +34,7 @@
 import android.sysprop.BluetoothProperties;
 import android.util.Log;
 
+import com.android.bluetooth.BluetoothMethodProxy;
 import com.android.bluetooth.R;
 import com.android.bluetooth.Utils;
 import com.android.bluetooth.btservice.AdapterService;
@@ -41,6 +42,7 @@
 import com.android.bluetooth.btservice.storage.DatabaseManager;
 import com.android.bluetooth.hfpclient.HfpClientConnectionService;
 import com.android.bluetooth.sdp.SdpManager;
+import com.android.internal.annotations.VisibleForTesting;
 import com.android.modules.utils.SynchronousResultReceiver;
 
 import java.util.ArrayList;
@@ -69,10 +71,12 @@
 
     // MAXIMUM_DEVICES set to 10 to prevent an excessive number of simultaneous devices.
     private static final int MAXIMUM_DEVICES = 10;
-    private Map<BluetoothDevice, PbapClientStateMachine> mPbapClientStateMachineMap =
+    @VisibleForTesting
+    Map<BluetoothDevice, PbapClientStateMachine> mPbapClientStateMachineMap =
             new ConcurrentHashMap<>();
     private static PbapClientService sPbapClientService;
-    private PbapBroadcastReceiver mPbapBroadcastReceiver = new PbapBroadcastReceiver();
+    @VisibleForTesting
+    PbapBroadcastReceiver mPbapBroadcastReceiver = new PbapBroadcastReceiver();
     private int mSdpHandle = -1;
 
     private DatabaseManager mDatabaseManager;
@@ -162,6 +166,7 @@
         for (PbapClientStateMachine pbapClientStateMachine : mPbapClientStateMachineMap.values()) {
             pbapClientStateMachine.doQuit();
         }
+        mPbapClientStateMachineMap.clear();
         cleanupAuthenicationService();
         setComponentAvailable(AUTHENTICATOR_SERVICE, false);
         return true;
@@ -243,7 +248,8 @@
                 + CallLog.Calls.PHONE_ACCOUNT_COMPONENT_NAME + "=?";
         String[] selectionArgs = new String[]{accountName, componentName.flattenToString()};
         try {
-            getContentResolver().delete(CallLog.Calls.CONTENT_URI, selectionFilter, selectionArgs);
+            BluetoothMethodProxy.getInstance().contentResolverDelete(getContentResolver(),
+                    CallLog.Calls.CONTENT_URI, selectionFilter, selectionArgs);
         } catch (IllegalArgumentException e) {
             Log.w(TAG, "Call Logs could not be deleted, they may not exist yet.");
         }
@@ -278,7 +284,8 @@
     }
 
 
-    private class PbapBroadcastReceiver extends BroadcastReceiver {
+    @VisibleForTesting
+    class PbapBroadcastReceiver extends BroadcastReceiver {
         @Override
         public void onReceive(Context context, Intent intent) {
             String action = intent.getAction();
@@ -314,7 +321,8 @@
     /**
      * Handler for incoming service calls
      */
-    private static class BluetoothPbapClientBinder extends IBluetoothPbapClient.Stub
+    @VisibleForTesting
+    static class BluetoothPbapClientBinder extends IBluetoothPbapClient.Stub
             implements IProfileServiceBinder {
         private PbapClientService mService;
 
@@ -329,8 +337,11 @@
 
         @RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)
         private PbapClientService getService(AttributionSource source) {
-            if (!Utils.checkCallerIsSystemOrActiveUser(TAG)
-                    || !Utils.checkServiceAvailable(mService, TAG)
+            if (Utils.isInstrumentationTestMode()) {
+                return mService;
+            }
+            if (!Utils.checkServiceAvailable(mService, TAG)
+                    || !Utils.checkCallerIsSystemOrActiveOrManagedUser(mService, TAG)
                     || !Utils.checkConnectPermissionForDataDelivery(mService, source, TAG)) {
                 return null;
             }
@@ -461,7 +472,8 @@
         return sPbapClientService;
     }
 
-    private static synchronized void setPbapClientService(PbapClientService instance) {
+    @VisibleForTesting
+    static synchronized void setPbapClientService(PbapClientService instance) {
         if (VDBG) {
             Log.v(TAG, "setPbapClientService(): set to: " + instance);
         }
@@ -511,7 +523,6 @@
         if (pbapClientStateMachine != null) {
             pbapClientStateMachine.disconnect(device);
             return true;
-
         } else {
             Log.w(TAG, "disconnect() called on unconnected device.");
             return false;
@@ -523,7 +534,8 @@
         return getDevicesMatchingConnectionStates(desiredStates);
     }
 
-    private List<BluetoothDevice> getDevicesMatchingConnectionStates(int[] states) {
+    @VisibleForTesting
+    List<BluetoothDevice> getDevicesMatchingConnectionStates(int[] states) {
         List<BluetoothDevice> deviceList = new ArrayList<BluetoothDevice>(0);
         for (Map.Entry<BluetoothDevice, PbapClientStateMachine> stateMachineEntry :
                 mPbapClientStateMachineMap
diff --git a/android/app/src/com/android/bluetooth/pbapclient/PbapClientStateMachine.java b/android/app/src/com/android/bluetooth/pbapclient/PbapClientStateMachine.java
index 6f4c0fa..8331c63 100644
--- a/android/app/src/com/android/bluetooth/pbapclient/PbapClientStateMachine.java
+++ b/android/app/src/com/android/bluetooth/pbapclient/PbapClientStateMachine.java
@@ -70,7 +70,7 @@
 import java.util.ArrayList;
 import java.util.List;
 
-final class PbapClientStateMachine extends StateMachine {
+class PbapClientStateMachine extends StateMachine {
     private static final boolean DBG = false; //Utils.DBG;
     private static final String TAG = "PbapClientStateMachine";
 
diff --git a/android/app/src/com/android/bluetooth/pbapclient/PhonebookEntry.java b/android/app/src/com/android/bluetooth/pbapclient/PhonebookEntry.java
deleted file mode 100644
index 62093e5..0000000
--- a/android/app/src/com/android/bluetooth/pbapclient/PhonebookEntry.java
+++ /dev/null
@@ -1,172 +0,0 @@
-/*
- * Copyright (C) 2016 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package com.android.bluetooth.pbapclient;
-
-import com.android.vcard.VCardEntry;
-
-import java.util.ArrayList;
-import java.util.List;
-import java.util.Objects;
-
-/**
- *  A simpler more public version of VCardEntry.
- */
-public class PhonebookEntry {
-    public static class Name {
-        public String family;
-        public String given;
-        public String middle;
-        public String prefix;
-        public String suffix;
-
-        public Name() { }
-
-        @Override
-        public boolean equals(Object o) {
-            if (!(o instanceof Name)) {
-                return false;
-            }
-
-            Name n = ((Name) o);
-            return (Objects.equals(family, n.family) || family != null && family.equals(n.family))
-                    && (Objects.equals(given, n.given) || given != null && given.equals(n.given))
-                    && (Objects.equals(middle, n.middle) || middle != null && middle.equals(
-                    n.middle)) && (Objects.equals(prefix, n.prefix)
-                    || prefix != null && prefix.equals(n.prefix)) && (
-                    Objects.equals(suffix, n.suffix) || suffix != null && suffix.equals(n.suffix));
-        }
-
-        @Override
-        public int hashCode() {
-            int result = 23 * (family == null ? 0 : family.hashCode());
-            result = 23 * result + (given == null ? 0 : given.hashCode());
-            result = 23 * result + (middle == null ? 0 : middle.hashCode());
-            result = 23 * result + (prefix == null ? 0 : prefix.hashCode());
-            result = 23 * result + (suffix == null ? 0 : suffix.hashCode());
-            return result;
-        }
-
-        @Override
-        public String toString() {
-            StringBuilder sb = new StringBuilder();
-            sb.append("Name: { family: ");
-            sb.append(family);
-            sb.append(" given: ");
-            sb.append(given);
-            sb.append(" middle: ");
-            sb.append(middle);
-            sb.append(" prefix: ");
-            sb.append(prefix);
-            sb.append(" suffix: ");
-            sb.append(suffix);
-            sb.append(" }");
-            return sb.toString();
-        }
-    }
-
-    public static class Phone {
-        public int type;
-        public String number;
-
-        @Override
-        public boolean equals(Object o) {
-            if (!(o instanceof Phone)) {
-                return false;
-            }
-
-            Phone p = (Phone) o;
-            return (Objects.equals(number, p.number) || number != null && number.equals(p.number))
-                    && type == p.type;
-        }
-
-        @Override
-        public int hashCode() {
-            return 23 * type + number.hashCode();
-        }
-
-        @Override
-        public String toString() {
-            StringBuilder sb = new StringBuilder();
-            sb.append(" Phone: { number: ");
-            sb.append(number);
-            sb.append(" type: " + type);
-            sb.append(" }");
-            return sb.toString();
-        }
-    }
-
-    @Override
-    public boolean equals(Object object) {
-        if (object instanceof PhonebookEntry) {
-            return equals((PhonebookEntry) object);
-        }
-        return false;
-    }
-
-    public PhonebookEntry() {
-        name = new Name();
-        phones = new ArrayList<Phone>();
-    }
-
-    public PhonebookEntry(VCardEntry v) {
-        name = new Name();
-        phones = new ArrayList<Phone>();
-
-        VCardEntry.NameData n = v.getNameData();
-        name.family = n.getFamily();
-        name.given = n.getGiven();
-        name.middle = n.getMiddle();
-        name.prefix = n.getPrefix();
-        name.suffix = n.getSuffix();
-
-        List<VCardEntry.PhoneData> vp = v.getPhoneList();
-        if (vp == null || vp.isEmpty()) {
-            return;
-        }
-
-        for (VCardEntry.PhoneData p : vp) {
-            Phone phone = new Phone();
-            phone.type = p.getType();
-            phone.number = p.getNumber();
-            phones.add(phone);
-        }
-    }
-
-    private boolean equals(PhonebookEntry p) {
-        return name.equals(p.name) && phones.equals(p.phones);
-    }
-
-    @Override
-    public int hashCode() {
-        return name.hashCode() + 23 * phones.hashCode();
-    }
-
-    @Override
-    public String toString() {
-        StringBuilder sb = new StringBuilder();
-        sb.append("PhonebookEntry { id: ");
-        sb.append(id);
-        sb.append(" ");
-        sb.append(name.toString());
-        sb.append(phones.toString());
-        sb.append(" }");
-        return sb.toString();
-    }
-
-    public Name name;
-    public List<Phone> phones;
-    public String id;
-}
diff --git a/android/app/src/com/android/bluetooth/pbapclient/PhonebookPullRequest.java b/android/app/src/com/android/bluetooth/pbapclient/PhonebookPullRequest.java
index 48ccf37..ada8d32 100644
--- a/android/app/src/com/android/bluetooth/pbapclient/PhonebookPullRequest.java
+++ b/android/app/src/com/android/bluetooth/pbapclient/PhonebookPullRequest.java
@@ -24,12 +24,14 @@
 import android.provider.ContactsContract;
 import android.util.Log;
 
+import com.android.internal.annotations.VisibleForTesting;
 import com.android.vcard.VCardEntry;
 
 import java.util.ArrayList;
 
 public class PhonebookPullRequest extends PullRequest {
-    private static final int MAX_OPS = 250;
+    @VisibleForTesting
+    static final int MAX_OPS = 250;
     private static final boolean VDBG = Utils.VDBG;
     private static final String TAG = "PbapPbPullRequest";
 
diff --git a/android/app/src/com/android/bluetooth/sap/SapMessage.java b/android/app/src/com/android/bluetooth/sap/SapMessage.java
index 147a654..df3c1cf 100644
--- a/android/app/src/com/android/bluetooth/sap/SapMessage.java
+++ b/android/app/src/com/android/bluetooth/sap/SapMessage.java
@@ -6,6 +6,8 @@
 import android.os.RemoteException;
 import android.util.Log;
 
+import com.android.internal.annotations.VisibleForTesting;
+
 import com.google.protobuf.micro.CodedOutputStreamMicro;
 import com.google.protobuf.micro.InvalidProtocolBufferMicroException;
 
@@ -198,7 +200,8 @@
         this.mMsgType = msgType;
     }
 
-    private static void resetPendingRilMessages() {
+    @VisibleForTesting
+    static void resetPendingRilMessages() {
         int numMessages = sOngoingRequests.size();
         if (numMessages != 0) {
             Log.w(TAG, "Clearing message queue with size: " + numMessages);
@@ -330,7 +333,8 @@
         this.mTestMode = testMode;
     }
 
-    private int getParamCount() {
+    @VisibleForTesting
+    int getParamCount() {
         int paramCount = 0;
         if (mMaxMsgSize != INVALID_VALUE) {
             paramCount++;
@@ -725,20 +729,6 @@
      * RILD Interface message conversion functions.
      ***************************************************************************/
 
-    /**
-     * We use this function to
-     * @param length
-     * @param rawOut
-     * @throws IOException
-     */
-    private void writeLength(int length, CodedOutputStreamMicro out) throws IOException {
-        byte[] dataLength = new byte[4];
-        dataLength[0] = dataLength[1] = 0;
-        dataLength[2] = (byte) ((length >> 8) & 0xff);
-        dataLength[3] = (byte) ((length) & 0xff);
-        out.writeRawBytes(dataLength);
-    }
-
     private ArrayList<Byte> primitiveArrayToContainerArrayList(byte[] arr) {
         ArrayList<Byte> arrayList = new ArrayList<>(arr.length);
         for (byte b : arr) {
diff --git a/android/app/src/com/android/bluetooth/sap/SapRilReceiver.java b/android/app/src/com/android/bluetooth/sap/SapRilReceiver.java
index c21778b..f7eb8f4 100644
--- a/android/app/src/com/android/bluetooth/sap/SapRilReceiver.java
+++ b/android/app/src/com/android/bluetooth/sap/SapRilReceiver.java
@@ -280,60 +280,6 @@
     }
 
     /**
-     * Read the message into buffer
-     * @param is
-     * @param buffer
-     * @return the length of the message
-     * @throws IOException
-     */
-    private static int readMessage(InputStream is, byte[] buffer) throws IOException {
-        int countRead;
-        int offset;
-        int remaining;
-        int messageLength;
-
-        // Read in the length of the message
-        offset = 0;
-        remaining = 4;
-        do {
-            countRead = is.read(buffer, offset, remaining);
-
-            if (countRead < 0) {
-                Log.e(TAG, "Hit EOS reading message length");
-                return -1;
-            }
-
-            offset += countRead;
-            remaining -= countRead;
-        } while (remaining > 0);
-
-        messageLength =
-                ((buffer[0] & 0xff) << 24) | ((buffer[1] & 0xff) << 16) | ((buffer[2] & 0xff) << 8)
-                        | (buffer[3] & 0xff);
-        if (VERBOSE) {
-            Log.e(TAG, "Message length found to be: " + messageLength);
-        }
-        // Read the message
-        offset = 0;
-        remaining = messageLength;
-        do {
-            countRead = is.read(buffer, offset, remaining);
-
-            if (countRead < 0) {
-                Log.e(TAG,
-                        "Hit EOS reading message.  messageLength=" + messageLength + " remaining="
-                                + remaining);
-                return -1;
-            }
-
-            offset += countRead;
-            remaining -= countRead;
-        } while (remaining > 0);
-
-        return messageLength;
-    }
-
-    /**
      * Notify SapServer that the RIL socket is connected
      */
     void sendRilConnectMessage() {
@@ -369,4 +315,7 @@
         mSapServerMsgHandler.sendMessage(newMsg);
     }
 
+    AtomicLong getSapProxyCookie() {
+        return mSapProxyCookie;
+    }
 }
diff --git a/android/app/src/com/android/bluetooth/sap/SapServer.java b/android/app/src/com/android/bluetooth/sap/SapServer.java
index 2514863..0ad1f8d 100644
--- a/android/app/src/com/android/bluetooth/sap/SapServer.java
+++ b/android/app/src/com/android/bluetooth/sap/SapServer.java
@@ -25,6 +25,8 @@
 import android.util.Log;
 
 import com.android.bluetooth.R;
+import com.android.bluetooth.Utils;
+import com.android.internal.annotations.VisibleForTesting;
 
 import java.io.BufferedInputStream;
 import java.io.BufferedOutputStream;
@@ -51,26 +53,31 @@
     public static final boolean DEBUG = SapService.DEBUG;
     public static final boolean VERBOSE = SapService.VERBOSE;
 
-    private enum SAP_STATE {
+    @VisibleForTesting
+    enum SAP_STATE {
         DISCONNECTED, CONNECTING, CONNECTING_CALL_ONGOING, CONNECTED, CONNECTED_BUSY, DISCONNECTING;
     }
 
-    private SAP_STATE mState = SAP_STATE.DISCONNECTED;
+    @VisibleForTesting
+    SAP_STATE mState = SAP_STATE.DISCONNECTED;
 
     private Context mContext = null;
     /* RFCOMM socket I/O streams */
     private BufferedOutputStream mRfcommOut = null;
     private BufferedInputStream mRfcommIn = null;
     /* References to the SapRilReceiver object */
-    private SapRilReceiver mRilBtReceiver = null;
+    @VisibleForTesting
+    SapRilReceiver mRilBtReceiver = null;
     /* The message handler members */
-    private Handler mSapHandler = null;
+    @VisibleForTesting
+    Handler mSapHandler = null;
     private HandlerThread mHandlerThread = null;
     /* Reference to the SAP service - which created this instance of the SAP server */
     private Handler mSapServiceHandler = null;
 
     /* flag for when user forces disconnect of rfcomm */
-    private boolean mIsLocalInitDisconnect = false;
+    @VisibleForTesting
+    boolean mIsLocalInitDisconnect = false;
     private CountDownLatch mDeinitSignal = new CountDownLatch(1);
 
     /* Message ID's handled by the message handler */
@@ -86,7 +93,8 @@
     public static final String SAP_DISCONNECT_TYPE_EXTRA =
             "com.android.bluetooth.sap.extra.DISCONNECT_TYPE";
     public static final int NOTIFICATION_ID = android.R.drawable.stat_sys_data_bluetooth;
-    private static final String SAP_NOTIFICATION_CHANNEL = "sap_notification_channel";
+    @VisibleForTesting
+    static final String SAP_NOTIFICATION_CHANNEL = "sap_notification_channel";
     public static final int ISAP_GET_SERVICE_DELAY_MILLIS = 3 * 1000;
     private static final int DISCONNECT_TIMEOUT_IMMEDIATE = 5000; /* ms */
     private static final int DISCONNECT_TIMEOUT_RFCOMM = 2000; /* ms */
@@ -99,7 +107,8 @@
     /* We store the mMaxMessageSize, as we need a copy of it when the init. sequence completes */
     private int mMaxMsgSize = 0;
     /* keep track of the current RIL test mode */
-    private int mTestMode = SapMessage.INVALID_VALUE; // used to set the RIL in test mode
+    @VisibleForTesting
+    int mTestMode = SapMessage.INVALID_VALUE; // used to set the RIL in test mode
 
     /**
      * SapServer constructor
@@ -127,9 +136,11 @@
     /**
      * This handles the response from RIL.
      */
-    private BroadcastReceiver mIntentReceiver;
+    @VisibleForTesting
+    BroadcastReceiver mIntentReceiver;
 
-    private class SapServerBroadcastReceiver extends BroadcastReceiver {
+    @VisibleForTesting
+    class SapServerBroadcastReceiver extends BroadcastReceiver {
         @Override
         public void onReceive(Context context, Intent intent) {
             if (intent.getAction().equals(TelephonyManager.ACTION_PHONE_STATE_CHANGED)) {
@@ -177,12 +188,13 @@
      * @param testMode Use SapMessage.TEST_MODE_XXX
      */
     public void setTestMode(int testMode) {
-        if (SapMessage.TEST) {
+        if (SapMessage.TEST || Utils.isInstrumentationTestMode()) {
             mTestMode = testMode;
         }
     }
 
-    private void sendDisconnectInd(int discType) {
+    @VisibleForTesting
+    void sendDisconnectInd(int discType) {
         if (VERBOSE) {
             Log.v(TAG, "in sendDisconnectInd()");
         }
@@ -556,7 +568,8 @@
      *
      * @param msg the incoming SapMessage
      */
-    private void onConnectRequest(SapMessage msg) {
+    @VisibleForTesting
+    void onConnectRequest(SapMessage msg) {
         SapMessage reply = new SapMessage(SapMessage.ID_CONNECT_RESP);
 
         if (mState == SAP_STATE.CONNECTING) {
@@ -601,7 +614,8 @@
         }
     }
 
-    private void clearPendingRilResponses(SapMessage msg) {
+    @VisibleForTesting
+    void clearPendingRilResponses(SapMessage msg) {
         if (mState == SAP_STATE.CONNECTED_BUSY) {
             msg.setClearRilQueue(true);
         }
@@ -611,7 +625,8 @@
      * Send RFCOMM message to the Sap Server Handler Thread
      * @param sapMsg The message to send
      */
-    private void sendClientMessage(SapMessage sapMsg) {
+    @VisibleForTesting
+    void sendClientMessage(SapMessage sapMsg) {
         Message newMsg = mSapHandler.obtainMessage(SAP_MSG_RFC_REPLY, sapMsg);
         mSapHandler.sendMessage(newMsg);
     }
@@ -620,7 +635,8 @@
      * Send a RIL message to the SapServer message handler thread
      * @param sapMsg
      */
-    private void sendRilThreadMessage(SapMessage sapMsg) {
+    @VisibleForTesting
+    void sendRilThreadMessage(SapMessage sapMsg) {
         Message newMsg = mSapHandler.obtainMessage(SAP_MSG_RIL_REQ, sapMsg);
         mSapHandler.sendMessage(newMsg);
     }
@@ -629,7 +645,8 @@
      * Examine if a call is ongoing, by asking the telephony manager
      * @return false if the phone is IDLE (can be used for SAP), true otherwise.
      */
-    private boolean isCallOngoing() {
+    @VisibleForTesting
+    boolean isCallOngoing() {
         TelephonyManager tManager = mContext.getSystemService(TelephonyManager.class);
         if (tManager.getCallState() == TelephonyManager.CALL_STATE_IDLE) {
             return false;
@@ -642,7 +659,8 @@
      * We add thread protection, as we access the state from two threads.
      * @param newState
      */
-    private void changeState(SAP_STATE newState) {
+    @VisibleForTesting
+    void changeState(SAP_STATE newState) {
         if (DEBUG) {
             Log.i(TAG_HANDLER, "Changing state from " + mState.name() + " to " + newState.name());
         }
@@ -706,7 +724,7 @@
                 startDisconnectTimer(SapMessage.DISC_RFCOMM, DISCONNECT_TIMEOUT_RFCOMM);
                 break;
             case SAP_PROXY_DEAD:
-                if ((long) msg.obj == mRilBtReceiver.mSapProxyCookie.get()) {
+                if ((long) msg.obj == mRilBtReceiver.getSapProxyCookie().get()) {
                     mRilBtReceiver.notifyShutdown(); /* Only needed in case of a connection error */
                     mRilBtReceiver.resetSapProxy();
 
@@ -726,7 +744,8 @@
      * Close the in/out rfcomm streams, to trigger a shutdown of the SapServer main thread.
      * Use this after completing the deinit sequence.
      */
-    private void shutdown() {
+    @VisibleForTesting
+    void shutdown() {
 
         if (DEBUG) {
             Log.i(TAG_HANDLER, "in Shutdown()");
@@ -749,7 +768,8 @@
         clearNotification();
     }
 
-    private void startDisconnectTimer(int discType, int timeMs) {
+    @VisibleForTesting
+    void startDisconnectTimer(int discType, int timeMs) {
 
         stopDisconnectTimer();
         synchronized (this) {
@@ -769,7 +789,8 @@
         }
     }
 
-    private void stopDisconnectTimer() {
+    @VisibleForTesting
+    void stopDisconnectTimer() {
         synchronized (this) {
             if (mPendingDiscIntent != null) {
                 AlarmManager alarmManager = mContext.getSystemService(AlarmManager.class);
@@ -789,7 +810,8 @@
      * here before they go to the client
      * @param sapMsg the message to send to the SAP client
      */
-    private void handleRfcommReply(SapMessage sapMsg) {
+    @VisibleForTesting
+    void handleRfcommReply(SapMessage sapMsg) {
         if (sapMsg != null) {
 
             if (DEBUG) {
@@ -908,7 +930,8 @@
         }
     }
 
-    private void handleRilInd(SapMessage sapMsg) {
+    @VisibleForTesting
+    void handleRilInd(SapMessage sapMsg) {
         if (sapMsg == null) {
             return;
         }
@@ -939,7 +962,8 @@
      * This is only to be called from the handlerThread, else use sendRilThreadMessage();
      * @param sapMsg
      */
-    private void sendRilMessage(SapMessage sapMsg) {
+    @VisibleForTesting
+    void sendRilMessage(SapMessage sapMsg) {
         if (VERBOSE) {
             Log.i(TAG_HANDLER,
                     "sendRilMessage() - " + SapMessage.getMsgTypeName(sapMsg.getMsgType()));
@@ -975,7 +999,8 @@
     /**
      * Only call this from the sapHandler thread.
      */
-    private void sendReply(SapMessage msg) {
+    @VisibleForTesting
+    void sendReply(SapMessage msg) {
         if (VERBOSE) {
             Log.i(TAG_HANDLER,
                     "sendReply() RFCOMM - " + SapMessage.getMsgTypeName(msg.getMsgType()));
@@ -992,7 +1017,8 @@
         }
     }
 
-    private static String getMessageName(int messageId) {
+    @VisibleForTesting
+    static String getMessageName(int messageId) {
         switch (messageId) {
             case SAP_MSG_RFC_REPLY:
                 return "SAP_MSG_REPLY";
diff --git a/android/app/src/com/android/bluetooth/sap/SapService.java b/android/app/src/com/android/bluetooth/sap/SapService.java
index 1fb7b9d..eef5632 100644
--- a/android/app/src/com/android/bluetooth/sap/SapService.java
+++ b/android/app/src/com/android/bluetooth/sap/SapService.java
@@ -173,6 +173,9 @@
             } catch (IOException e) {
                 Log.e(TAG, "Error create RfcommServerSocket ", e);
                 initSocketOK = false;
+            } catch (SecurityException e) {
+                Log.e(TAG, "Error creating RfcommServerSocket ", e);
+                initSocketOK = false;
             }
 
             if (!initSocketOK) {
@@ -930,8 +933,8 @@
 
         @RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)
         private SapService getService(AttributionSource source) {
-            if (!Utils.checkCallerIsSystemOrActiveUser(TAG)
-                    || !Utils.checkServiceAvailable(mService, TAG)
+            if (!Utils.checkServiceAvailable(mService, TAG)
+                    || !Utils.checkCallerIsSystemOrActiveOrManagedUser(mService, TAG)
                     || !Utils.checkConnectPermissionForDataDelivery(mService, source, TAG)) {
                 return null;
             }
diff --git a/android/app/src/com/android/bluetooth/tbs/BluetoothGattServerProxy.java b/android/app/src/com/android/bluetooth/tbs/BluetoothGattServerProxy.java
index a68af61..59688a6 100644
--- a/android/app/src/com/android/bluetooth/tbs/BluetoothGattServerProxy.java
+++ b/android/app/src/com/android/bluetooth/tbs/BluetoothGattServerProxy.java
@@ -27,6 +27,7 @@
 import android.content.Context;
 
 import java.util.List;
+import java.util.UUID;
 
 /**
  * A proxy class that facilitates testing of the TbsService class.
@@ -63,6 +64,21 @@
         return mBluetoothGattServer.addService(service);
     }
 
+    /**
+     * A proxy that Returns a {@link BluetoothGattService} from the list of services offered
+     * by this device.
+     *
+     * <p>If multiple instances of the same service (as identified by UUID)
+     * exist, the first instance of the service is returned.
+     *
+     * @param uuid UUID of the requested service
+     * @return BluetoothGattService if supported, or null if the requested service is not offered by
+     * this device.
+     */
+    public BluetoothGattService getService(UUID uuid) {
+        return mBluetoothGattServer.getService(uuid);
+    }
+
     public boolean sendResponse(BluetoothDevice device, int requestId, int status, int offset,
             byte[] value) {
         return mBluetoothGattServer.sendResponse(device, requestId, status, offset, value);
diff --git a/android/app/src/com/android/bluetooth/tbs/TbsGatt.java b/android/app/src/com/android/bluetooth/tbs/TbsGatt.java
index 7c3f9fc..4c1833a 100644
--- a/android/app/src/com/android/bluetooth/tbs/TbsGatt.java
+++ b/android/app/src/com/android/bluetooth/tbs/TbsGatt.java
@@ -17,17 +17,27 @@
 
 package com.android.bluetooth.tbs;
 
+import static android.bluetooth.BluetoothDevice.METADATA_GTBS_CCCD;
+
+import android.bluetooth.BluetoothAdapter;
 import android.bluetooth.BluetoothDevice;
 import android.bluetooth.BluetoothGatt;
 import android.bluetooth.BluetoothGattCharacteristic;
 import android.bluetooth.BluetoothGattDescriptor;
 import android.bluetooth.BluetoothGattServerCallback;
 import android.bluetooth.BluetoothGattService;
+import android.bluetooth.BluetoothProfile;
+import android.bluetooth.IBluetoothManager;
+import android.bluetooth.IBluetoothStateChangeCallback;
 import android.content.Context;
 import android.os.Handler;
 import android.os.Looper;
+import android.os.ParcelUuid;
+import android.os.RemoteException;
 import android.util.Log;
 
+import com.android.bluetooth.btservice.AdapterService;
+import com.android.bluetooth.Utils;
 import com.android.internal.annotations.VisibleForTesting;
 
 import java.io.ByteArrayOutputStream;
@@ -35,6 +45,7 @@
 import java.util.Arrays;
 import java.util.List;
 import java.util.Map;
+import java.util.Objects;
 import java.util.UUID;
 
 public class TbsGatt {
@@ -131,9 +142,11 @@
     private final GattCharacteristic mTerminationReasonCharacteristic;
     private final GattCharacteristic mIncomingCallCharacteristic;
     private final GattCharacteristic mCallFriendlyNameCharacteristic;
+    private List<BluetoothDevice> mSubscribers = new ArrayList<>();
     private BluetoothGattServerProxy mBluetoothGattServer;
     private Handler mHandler;
     private Callback mCallback;
+    private AdapterService mAdapterService;
 
     public static abstract class Callback {
 
@@ -144,6 +157,17 @@
     }
 
     TbsGatt(Context context) {
+        mAdapterService =  Objects.requireNonNull(AdapterService.getAdapterService(),
+                "AdapterService shouldn't be null when creating MediaControlCattService");
+        IBluetoothManager mgr = BluetoothAdapter.getDefaultAdapter().getBluetoothManager();
+        if (mgr != null) {
+            try {
+                mgr.registerStateChangeCallback(mBluetoothStateChangeCallback);
+            } catch (RemoteException e) {
+                throw e.rethrowFromSystemServer();
+            }
+        }
+
         mContext = context;
         mBearerProviderNameCharacteristic = new GattCharacteristic(UUID_BEARER_PROVIDER_NAME,
                 BluetoothGattCharacteristic.PROPERTY_READ
@@ -252,11 +276,55 @@
         return mContext;
     }
 
+    private void removeUuidFromMetadata(ParcelUuid charUuid, BluetoothDevice device) {
+        List<ParcelUuid> uuidList;
+        byte[] gtbs_cccd = device.getMetadata(METADATA_GTBS_CCCD);
+
+        if ((gtbs_cccd == null) || (gtbs_cccd.length == 0)) {
+            uuidList = new ArrayList<ParcelUuid>();
+        } else {
+            uuidList = new ArrayList<>(Arrays.asList(Utils.byteArrayToUuid(gtbs_cccd)));
+
+            if (!uuidList.contains(charUuid)) {
+                Log.d(TAG, "Characteristic CCCD can't be removed (not cached): "
+                        + charUuid.toString());
+                return;
+            }
+        }
+
+        uuidList.remove(charUuid);
+
+        if (!device.setMetadata(METADATA_GTBS_CCCD,
+                Utils.uuidsToByteArray(uuidList.toArray(new ParcelUuid[0])))) {
+            Log.e(TAG, "Can't set CCCD for GTBS characteristic UUID: " + charUuid + ", (remove)");
+        }
+    }
+
+    private void addUuidToMetadata(ParcelUuid charUuid, BluetoothDevice device) {
+        List<ParcelUuid> uuidList;
+        byte[] gtbs_cccd = device.getMetadata(METADATA_GTBS_CCCD);
+
+        if ((gtbs_cccd == null) || (gtbs_cccd.length == 0)) {
+            uuidList = new ArrayList<ParcelUuid>();
+        } else {
+            uuidList = new ArrayList<>(Arrays.asList(Utils.byteArrayToUuid(gtbs_cccd)));
+
+            if (uuidList.contains(charUuid)) {
+                Log.d(TAG, "Characteristic CCCD already add: " + charUuid.toString());
+                return;
+            }
+        }
+
+        uuidList.add(charUuid);
+
+        if (!device.setMetadata(METADATA_GTBS_CCCD,
+                Utils.uuidsToByteArray(uuidList.toArray(new ParcelUuid[0])))) {
+            Log.e(TAG, "Can't set CCCD for GTBS characteristic UUID: " + charUuid + ", (add)");
+        }
+    }
+
     /** Class that handles GATT characteristic notifications */
     private class BluetoothGattCharacteristicNotifier {
-
-        private List<BluetoothDevice> mSubscribers = new ArrayList<>();
-
         public int setSubscriptionConfiguration(BluetoothDevice device, byte[] configuration) {
             if (Arrays.equals(configuration, BluetoothGattDescriptor.DISABLE_NOTIFICATION_VALUE)) {
                 mSubscribers.remove(device);
@@ -455,6 +523,14 @@
                 return BluetoothGatt.GATT_FAILURE;
             }
 
+            if (Arrays.equals(value, BluetoothGattDescriptor.ENABLE_NOTIFICATION_VALUE)) {
+                addUuidToMetadata(new ParcelUuid(characteristic.getUuid()), device);
+            } else if (Arrays.equals(value, BluetoothGattDescriptor.DISABLE_NOTIFICATION_VALUE)) {
+                removeUuidFromMetadata(new ParcelUuid(characteristic.getUuid()), device);
+            } else {
+                Log.e(TAG, "Not handled CCC value: " + Arrays.toString(value));
+            }
+
             return characteristic.setSubscriptionConfiguration(device, value);
         }
     }
@@ -659,13 +735,56 @@
         return UUID.fromString(UUID_PREFIX + uuid16 + UUID_SUFFIX);
     }
 
+    private void restoreCccValuesForStoredDevices() {
+        BluetoothGattService gattService = mBluetoothGattServer.getService(UUID_GTBS);
+
+        for (BluetoothDevice device : mAdapterService.getBondedDevices()) {
+            byte[] gtbs_cccd = device.getMetadata(METADATA_GTBS_CCCD);
+
+            if ((gtbs_cccd == null) || (gtbs_cccd.length == 0)) {
+                return;
+            }
+
+            List<ParcelUuid> uuidList = Arrays.asList(Utils.byteArrayToUuid(gtbs_cccd));
+
+            /* Restore CCCD values for device */
+            for (ParcelUuid uuid : uuidList) {
+                BluetoothGattCharacteristic characteristic =
+                        gattService.getCharacteristic(uuid.getUuid());
+                if (characteristic == null) {
+                    Log.e(TAG, "Invalid UUID stored in metadata: " + uuid.toString());
+                    continue;
+                }
+
+                BluetoothGattDescriptor descriptor =
+                        characteristic.getDescriptor(UUID_CLIENT_CHARACTERISTIC_CONFIGURATION);
+                if (descriptor == null) {
+                    Log.e(TAG, "Invalid characteristic, does not include CCCD");
+                    continue;
+                }
+
+                descriptor.setValue(BluetoothGattDescriptor.ENABLE_NOTIFICATION_VALUE);
+                mSubscribers.add(device);
+            }
+        }
+    }
+
+    private final IBluetoothStateChangeCallback mBluetoothStateChangeCallback =
+            new IBluetoothStateChangeCallback.Stub() {
+                public void onBluetoothStateChange(boolean up) {
+                    if (DBG) Log.d(TAG, "onBluetoothStateChange: up=" + up);
+                    if (up) {
+                        restoreCccValuesForStoredDevices();
+                    }
+                }
+            };
+
     /**
      * Callback to handle incoming requests to the GATT server. All read/write requests for
      * characteristics and descriptors are handled here.
      */
     @VisibleForTesting
     final BluetoothGattServerCallback mGattServerCallback = new BluetoothGattServerCallback() {
-
         @Override
         public void onServiceAdded(int status, BluetoothGattService service) {
             if (DBG) {
@@ -674,6 +793,8 @@
             if (mCallback != null) {
                 mCallback.onServiceAdded(status == BluetoothGatt.GATT_SUCCESS);
             }
+
+            restoreCccValuesForStoredDevices();
         }
 
         @Override
diff --git a/android/app/src/com/android/bluetooth/tbs/TbsGeneric.java b/android/app/src/com/android/bluetooth/tbs/TbsGeneric.java
index d73ae5b..488bdbf 100644
--- a/android/app/src/com/android/bluetooth/tbs/TbsGeneric.java
+++ b/android/app/src/com/android/bluetooth/tbs/TbsGeneric.java
@@ -32,7 +32,10 @@
 import android.os.RemoteException;
 import android.util.Log;
 
+import com.android.bluetooth.btservice.ServiceFactory;
 import com.android.bluetooth.le_audio.ContentControlIdKeeper;
+import com.android.bluetooth.le_audio.LeAudioService;
+import com.android.internal.annotations.VisibleForTesting;
 
 import java.util.ArrayList;
 import java.util.Arrays;
@@ -122,6 +125,8 @@
     private List<String> mUriSchemes = new ArrayList<>(Arrays.asList("tel"));
     private Receiver mReceiver = null;
     private int mStoredRingerMode = -1;
+    private final ServiceFactory mFactory = new ServiceFactory();
+    private LeAudioService mLeAudioService;
 
     private final class Receiver extends BroadcastReceiver {
         @Override
@@ -157,7 +162,7 @@
         mTbsGatt = tbsGatt;
 
         int ccid = ContentControlIdKeeper.acquireCcid(new ParcelUuid(TbsGatt.UUID_GTBS),
-                BluetoothLeAudio.CONTEXT_TYPE_COMMUNICATION);
+                BluetoothLeAudio.CONTEXT_TYPE_CONVERSATIONAL);
         if (!isCcidValid(ccid)) {
             Log.e(TAG, " CCID is not valid");
             cleanup();
@@ -280,7 +285,7 @@
         // Acquire CCID for TbsObject. The CCID is released on remove()
         Bearer bearer = new Bearer(token, callback, uci, uriSchemes, capabilities, providerName,
                 technology, ContentControlIdKeeper.acquireCcid(new ParcelUuid(UUID.randomUUID()),
-                        BluetoothLeAudio.CONTEXT_TYPE_COMMUNICATION));
+                        BluetoothLeAudio.CONTEXT_TYPE_CONVERSATIONAL));
         if (isCcidValid(bearer.ccid)) {
             mBearerList.add(bearer);
 
@@ -731,7 +736,7 @@
             mLastIndexAssigned = requestId;
         }
 
-
+        setActiveLeDevice(device);
         return TbsGatt.CALL_CONTROL_POINT_RESULT_SUCCESS;
     }
 
@@ -790,6 +795,7 @@
                         Request request = new Request(device, callId, opcode, callIndex);
                         try {
                             if (opcode == TbsGatt.CALL_CONTROL_POINT_OPCODE_ACCEPT) {
+                                setActiveLeDevice(device);
                                 bearer.callback.onAcceptCall(requestId, new ParcelUuid(callId));
                             } else if (opcode == TbsGatt.CALL_CONTROL_POINT_OPCODE_TERMINATE) {
                                 bearer.callback.onTerminateCall(requestId, new ParcelUuid(callId));
@@ -835,6 +841,7 @@
 
                         Map.Entry<UUID, Bearer> firstEntry = null;
                         List<ParcelUuid> parcelUuids = new ArrayList<>();
+                        result = TbsGatt.CALL_CONTROL_POINT_RESULT_SUCCESS;
                         for (int callIndex : args) {
                             Map.Entry<UUID, Bearer> entry = getCallIdByIndex(callIndex);
                             if (entry == null) {
@@ -858,6 +865,10 @@
                             parcelUuids.add(new ParcelUuid(entry.getKey()));
                         }
 
+                        if (result != TbsGatt.CALL_CONTROL_POINT_RESULT_SUCCESS) {
+                            break;
+                        }
+
                         Bearer bearer = firstEntry.getValue();
                         Request request = new Request(device, parcelUuids, opcode, args[0]);
                         int requestId = mLastRequestIdAssigned + 1;
@@ -1005,10 +1016,38 @@
         mForegroundBearer = bearer;
     }
 
+    private boolean isLeAudioServiceAvailable() {
+        if (mLeAudioService != null) {
+            return true;
+        }
+
+        mLeAudioService = mFactory.getLeAudioService();
+        if (mLeAudioService == null) {
+            Log.e(TAG, "leAudioService not available");
+            return false;
+        }
+
+        return true;
+    }
+
+    @VisibleForTesting
+    void setLeAudioServiceForTesting(LeAudioService leAudioService) {
+        mLeAudioService = leAudioService;
+    }
+
     private synchronized void notifyCclc() {
         if (DBG) {
             Log.d(TAG, "notifyCclc");
         }
+
+        if (isLeAudioServiceAvailable()) {
+            if (mCurrentCallsList.size() > 0) {
+                mLeAudioService.setInCall(true);
+            } else {
+                mLeAudioService.setInCall(false);
+            }
+        }
+
         mTbsGatt.setCallState(mCurrentCallsList);
         mTbsGatt.setBearerListCurrentCalls(mCurrentCallsList);
     }
@@ -1029,6 +1068,18 @@
         mTbsGatt.setBearerUriSchemesSupportedList(mUriSchemes);
     }
 
+    private void setActiveLeDevice(BluetoothDevice device) {
+        if (device == null) {
+            Log.w(TAG, "setActiveLeDevice: ignore null device");
+            return;
+        }
+        if (!isLeAudioServiceAvailable()) {
+            Log.w(TAG, "mLeAudioService not available");
+            return;
+        }
+        mLeAudioService.setActiveDevice(device);
+    }
+
     private static boolean isCallStateTransitionValid(int callState, int requestedOpcode) {
         switch (requestedOpcode) {
             case TbsGatt.CALL_CONTROL_POINT_OPCODE_ACCEPT:
diff --git a/android/app/src/com/android/bluetooth/tbs/TbsService.java b/android/app/src/com/android/bluetooth/tbs/TbsService.java
index 5fdecbe..2bfc937 100644
--- a/android/app/src/com/android/bluetooth/tbs/TbsService.java
+++ b/android/app/src/com/android/bluetooth/tbs/TbsService.java
@@ -17,19 +17,10 @@
 
 package com.android.bluetooth.tbs;
 
-import android.Manifest;
-import android.bluetooth.BluetoothDevice;
-import android.bluetooth.BluetoothGatt;
-import android.bluetooth.BluetoothGattCharacteristic;
-import android.bluetooth.BluetoothGattDescriptor;
-import android.bluetooth.BluetoothGattServerCallback;
-import android.bluetooth.BluetoothGattService;
-import android.bluetooth.BluetoothLeCallControl;
 import android.bluetooth.BluetoothLeCall;
 import android.bluetooth.IBluetoothLeCallControl;
 import android.bluetooth.IBluetoothLeCallControlCallback;
 import android.content.AttributionSource;
-import android.content.Context;
 import android.os.ParcelUuid;
 import android.os.RemoteException;
 import android.sysprop.BluetoothProperties;
@@ -37,13 +28,11 @@
 
 import static com.android.bluetooth.Utils.enforceBluetoothPrivilegedPermission;
 
-import com.android.bluetooth.btservice.ProfileService;
 import com.android.bluetooth.Utils;
+import com.android.bluetooth.btservice.ProfileService;
 import com.android.internal.annotations.VisibleForTesting;
 
-import java.util.ArrayList;
 import java.util.List;
-import java.util.Objects;
 import java.util.UUID;
 
 public class TbsService extends ProfileService {
@@ -149,9 +138,9 @@
         private TbsService mService;
 
         private TbsService getService(AttributionSource source) {
-            if (!Utils.checkCallerIsSystemOrActiveUser(TAG)
-                || !Utils.checkServiceAvailable(mService, TAG)
-                || !Utils.checkConnectPermissionForDataDelivery(mService, source, TAG)) {
+            if (!Utils.checkServiceAvailable(mService, TAG)
+                    || !Utils.checkCallerIsSystemOrActiveOrManagedUser(mService, TAG)
+                    || !Utils.checkConnectPermissionForDataDelivery(mService, source, TAG)) {
                 Log.w(TAG, "TbsService call not allowed for non-active user");
                 return null;
             }
diff --git a/android/app/src/com/android/bluetooth/telephony/BluetoothInCallService.java b/android/app/src/com/android/bluetooth/telephony/BluetoothInCallService.java
index 85ebcab..7cc5bac 100644
--- a/android/app/src/com/android/bluetooth/telephony/BluetoothInCallService.java
+++ b/android/app/src/com/android/bluetooth/telephony/BluetoothInCallService.java
@@ -103,11 +103,17 @@
     private BluetoothCall mOldHeldCall = null;
     private boolean mHeadsetUpdatedRecently = false;
     private boolean mIsDisconnectedTonePlaying = false;
-    private boolean mIsTerminatedByClient = false;
+
+    @VisibleForTesting
+    boolean mIsTerminatedByClient = false;
 
     private static final Object LOCK = new Object();
-    private BluetoothHeadsetProxy mBluetoothHeadset;
-    private BluetoothLeCallControlProxy mBluetoothLeCallControl;
+
+    @VisibleForTesting
+    BluetoothHeadsetProxy mBluetoothHeadset;
+
+    @VisibleForTesting
+    BluetoothLeCallControlProxy mBluetoothLeCallControl;
     private ExecutorService mExecutor;
 
     @VisibleForTesting
@@ -131,6 +137,8 @@
 
     protected boolean mOnCreateCalled = false;
 
+    private int mMaxNumberOfCalls = 0;
+
     /**
      * Listens to connections and disconnections of bluetooth headsets.  We need to save the current
      * bluetooth headset so that we know where to send BluetoothCall updates.
@@ -551,6 +559,9 @@
             call.registerCallback(callback);
 
             mBluetoothCallHashMap.put(call.getId(), call);
+            if (!call.isConference()) {
+                mMaxNumberOfCalls = Integer.max(mMaxNumberOfCalls, mBluetoothCallHashMap.size());
+            }
             updateHeadsetWithCallState(false /* force */);
 
             BluetoothLeCall tbsCall = createTbsCall(call);
@@ -640,8 +651,8 @@
         super.onCreate();
         BluetoothAdapter.getDefaultAdapter()
                 .getProfileProxy(this, mProfileListener, BluetoothProfile.HEADSET);
-        BluetoothAdapter.getDefaultAdapter().
-                getProfileProxy(this, mProfileListener, BluetoothProfile.LE_CALL_CONTROL);
+        BluetoothAdapter.getDefaultAdapter()
+                .getProfileProxy(this, mProfileListener, BluetoothProfile.LE_CALL_CONTROL);
         mBluetoothAdapterReceiver = new BluetoothAdapterReceiver();
         IntentFilter intentFilter = new IntentFilter(BluetoothAdapter.ACTION_STATE_CHANGED);
         registerReceiver(mBluetoothAdapterReceiver, intentFilter);
@@ -656,7 +667,14 @@
         super.onDestroy();
     }
 
-    private void clear() {
+    @Override
+    @VisibleForTesting
+    public void attachBaseContext(Context base) {
+        super.attachBaseContext(base);
+    }
+
+    @VisibleForTesting
+    void clear() {
         Log.d(TAG, "clear");
         if (mBluetoothAdapterReceiver != null) {
             unregisterReceiver(mBluetoothAdapterReceiver);
@@ -674,6 +692,13 @@
         mCallbacks.clear();
         mBluetoothCallHashMap.clear();
         mClccIndexMap.clear();
+        mMaxNumberOfCalls = 0;
+    }
+
+    private static boolean isConferenceWithNoChildren(BluetoothCall call) {
+        return call.isConference()
+            && (call.can(Connection.CAPABILITY_CONFERENCE_HAS_NO_CHILDREN)
+                    || call.getChildrenIds().isEmpty());
     }
 
     private void sendListOfCalls(boolean shouldLog) {
@@ -682,9 +707,10 @@
             // We don't send the parent conference BluetoothCall to the bluetooth device.
             // We do, however want to send conferences that have no children to the bluetooth
             // device (e.g. IMS Conference).
-            if (!call.isConference()
-                    || (call.isConference()
-                            && call.can(Connection.CAPABILITY_CONFERENCE_HAS_NO_CHILDREN))) {
+            boolean isConferenceWithNoChildren = isConferenceWithNoChildren(call);
+            Log.i(TAG, "sendListOfCalls isConferenceWithNoChildren " + isConferenceWithNoChildren
+                + ", call.getChildrenIds() size " + call.getChildrenIds().size());
+            if (!call.isConference() || isConferenceWithNoChildren) {
                 sendClccForCall(call, shouldLog);
             }
         }
@@ -705,45 +731,46 @@
         boolean isForeground = mCallInfo.getForegroundCall() == call;
         int state = getBtCallState(call, isForeground);
         boolean isPartOfConference = false;
-        boolean isConferenceWithNoChildren = call.isConference()
-                && call.can(Connection.CAPABILITY_CONFERENCE_HAS_NO_CHILDREN);
+        boolean isConferenceWithNoChildren = isConferenceWithNoChildren(call);
 
         if (state == CALL_STATE_IDLE) {
             return;
         }
 
         BluetoothCall conferenceCall = getBluetoothCallById(call.getParentId());
-        if (!mCallInfo.isNullCall(conferenceCall)
-                && conferenceCall.hasProperty(Call.Details.PROPERTY_GENERIC_CONFERENCE)) {
+        if (!mCallInfo.isNullCall(conferenceCall)) {
             isPartOfConference = true;
 
-            // Run some alternative states for Conference-level merge/swap support.
-            // Basically, if BluetoothCall supports swapping or merging at the conference-level,
-            // then we need to expose the calls as having distinct states
-            // (ACTIVE vs CAPABILITY_HOLD) or
-            // the functionality won't show up on the bluetooth device.
+            if (conferenceCall.hasProperty(Call.Details.PROPERTY_GENERIC_CONFERENCE)) {
+                // Run some alternative states for CDMA Conference-level merge/swap support.
+                // Basically, if BluetoothCall supports swapping or merging at the conference-level,
+                // then we need to expose the calls as having distinct states
+                // (ACTIVE vs CAPABILITY_HOLD) or
+                // the functionality won't show up on the bluetooth device.
 
-            // Before doing any special logic, ensure that we are dealing with an
-            // ACTIVE BluetoothCall and that the conference itself has a notion of
-            // the current "active" child call.
-            BluetoothCall activeChild = getBluetoothCallById(
-                    conferenceCall.getGenericConferenceActiveChildCallId());
-            if (state == CALL_STATE_ACTIVE && !mCallInfo.isNullCall(activeChild)) {
-                // Reevaluate state if we can MERGE or if we can SWAP without previously having
-                // MERGED.
-                boolean shouldReevaluateState =
-                        conferenceCall.can(Connection.CAPABILITY_MERGE_CONFERENCE)
-                                || (conferenceCall.can(Connection.CAPABILITY_SWAP_CONFERENCE)
-                                        && !conferenceCall.wasConferencePreviouslyMerged());
+                // Before doing any special logic, ensure that we are dealing with an
+                // ACTIVE BluetoothCall and that the conference itself has a notion of
+                // the current "active" child call.
+                BluetoothCall activeChild =
+                        getBluetoothCallById(
+                                conferenceCall.getGenericConferenceActiveChildCallId());
+                if (state == CALL_STATE_ACTIVE && !mCallInfo.isNullCall(activeChild)) {
+                    // Reevaluate state if we can MERGE or if we can SWAP without previously having
+                    // MERGED.
+                    boolean shouldReevaluateState =
+                            conferenceCall.can(Connection.CAPABILITY_MERGE_CONFERENCE)
+                                    || (conferenceCall.can(Connection.CAPABILITY_SWAP_CONFERENCE)
+                                            && !conferenceCall.wasConferencePreviouslyMerged());
 
-                if (shouldReevaluateState) {
-                    isPartOfConference = false;
-                    if (call == activeChild) {
-                        state = CALL_STATE_ACTIVE;
-                    } else {
-                        // At this point we know there is an "active" child and we know that it is
-                        // not this call, so set it to HELD instead.
-                        state = CALL_STATE_HELD;
+                    if (shouldReevaluateState) {
+                        isPartOfConference = false;
+                        if (call == activeChild) {
+                            state = CALL_STATE_ACTIVE;
+                        } else {
+                            // At this point we know there is an "active" child and we know that it
+                            // is not this call, so set it to HELD instead.
+                            state = CALL_STATE_HELD;
+                        }
                     }
                 }
             }
@@ -823,15 +850,20 @@
         if (mClccIndexMap.containsKey(key)) {
             return mClccIndexMap.get(key);
         }
-
-        int i = 1;  // Indexes for bluetooth clcc are 1-based.
-        while (mClccIndexMap.containsValue(i)) {
-            i++;
+        int index = 1; // Indexes for bluetooth clcc are 1-based.
+        if (call.isConference()) {
+            index = mMaxNumberOfCalls + 1; // The conference call should have a higher index
+            Log.i(TAG,
+                  "getIndexForCall for conference call starting from "
+                  + mMaxNumberOfCalls);
+        }
+        while (mClccIndexMap.containsValue(index)) {
+            index++;
         }
 
         // NOTE: Indexes are removed in {@link #onCallRemoved}.
-        mClccIndexMap.put(key, i);
-        return i;
+        mClccIndexMap.put(key, index);
+        return index;
     }
 
     private boolean _processChld(int chld) {
@@ -1331,7 +1363,8 @@
         return null;
     }
 
-    private int getTbsTerminationReason(BluetoothCall call) {
+    @VisibleForTesting
+    int getTbsTerminationReason(BluetoothCall call) {
         DisconnectCause cause = call.getDisconnectCause();
         if (cause == null) {
             Log.w(TAG, " termination cause is null");
@@ -1362,8 +1395,7 @@
     private BluetoothLeCall createTbsCall(BluetoothCall call) {
         Integer state = getTbsCallState(call);
         boolean isPartOfConference = false;
-        boolean isConferenceWithNoChildren = call.isConference()
-                && call.can(Connection.CAPABILITY_CONFERENCE_HAS_NO_CHILDREN);
+        boolean isConferenceWithNoChildren = isConferenceWithNoChildren(call);
 
         if (state == null) {
             return null;
@@ -1447,7 +1479,9 @@
         mBluetoothLeCallControl.currentCallsList(tbsCalls);
     }
 
-    private final BluetoothLeCallControl.Callback mBluetoothLeCallControlCallback = new BluetoothLeCallControl.Callback() {
+    @VisibleForTesting
+    final BluetoothLeCallControl.Callback mBluetoothLeCallControlCallback =
+            new BluetoothLeCallControl.Callback() {
 
         @Override
         public void onAcceptCall(int requestId, UUID callId) {
diff --git a/android/app/src/com/android/bluetooth/util/Interop.java b/android/app/src/com/android/bluetooth/util/Interop.java
deleted file mode 100644
index 41ac512..0000000
--- a/android/app/src/com/android/bluetooth/util/Interop.java
+++ /dev/null
@@ -1,91 +0,0 @@
-/*
- * Copyright (C) 2016 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package com.android.bluetooth.util;
-
-import java.util.ArrayList;
-import java.util.List;
-
-/**
- * Centralized Bluetooth Interoperability workaround utilities and database.
- * This is the Java version. An analagous native version can be found
- * in /system/bt/devices/include/interop_database.h.
- */
-public class Interop {
-
-    /**
-     * Simple interop entry consisting of a workarond id (see below)
-     * and a (partial or complete) Bluetooth device address string
-     * to match against.
-     */
-    private static class Entry {
-        public String address;
-        public int workaround_id;
-
-        Entry(int workaroundId, String address) {
-            this.workaround_id = workaroundId;
-            this.address = address;
-        }
-    }
-
-    /**
-     * The actual "database" of interop entries.
-     */
-    private static List<Entry> sEntries = null;
-
-    /**
-     * Workaround ID for deivces which do not accept non-ASCII
-     * characters in SMS messages.
-     */
-    public static final int INTEROP_MAP_ASCIIONLY = 1;
-
-    /**
-     * Initializes the interop datbase with the relevant workaround
-     * entries.
-     * When adding entries, please provide a description for each
-     * device as to what problem the workaround addresses.
-     */
-    private static void lazyInitInteropDatabase() {
-        if (sEntries != null) {
-            return;
-        }
-        sEntries = new ArrayList<Entry>();
-
-        /** Mercedes Benz NTG 4.5 does not handle non-ASCII characters in SMS */
-        sEntries.add(new Entry(INTEROP_MAP_ASCIIONLY, "00:26:e8"));
-    }
-
-    /**
-     * Checks wheter a given device identified by |address| is a match
-     * for a given workaround identified by |workaroundId|.
-     * Return true if the address matches, false otherwise.
-     */
-    public static boolean matchByAddress(int workaroundId, String address) {
-        if (address == null || address.isEmpty()) {
-            return false;
-        }
-
-        lazyInitInteropDatabase();
-        for (Entry entry : sEntries) {
-            if (entry.workaround_id == workaroundId && entry.address.startsWith(
-                    address.toLowerCase())) {
-                return true;
-            }
-        }
-
-        return false;
-    }
-}
diff --git a/android/app/src/com/android/bluetooth/vc/VolumeControlNativeInterface.java b/android/app/src/com/android/bluetooth/vc/VolumeControlNativeInterface.java
index 5a6927c..de76659 100644
--- a/android/app/src/com/android/bluetooth/vc/VolumeControlNativeInterface.java
+++ b/android/app/src/com/android/bluetooth/vc/VolumeControlNativeInterface.java
@@ -260,8 +260,8 @@
     // Callbacks from the native stack back into the Java framework.
     // All callbacks are routed via the Service which will disambiguate which
     // state machine the message should be routed to.
-
-    private void onConnectionStateChanged(int state, byte[] address) {
+    @VisibleForTesting
+    void onConnectionStateChanged(int state, byte[] address) {
         VolumeControlStackEvent event =
                 new VolumeControlStackEvent(
                         VolumeControlStackEvent.EVENT_TYPE_CONNECTION_STATE_CHANGED);
@@ -274,7 +274,8 @@
         sendMessageToService(event);
     }
 
-    private void onVolumeStateChanged(int volume, boolean mute, byte[] address,
+    @VisibleForTesting
+    void onVolumeStateChanged(int volume, boolean mute, byte[] address,
             boolean isAutonomous) {
         VolumeControlStackEvent event =
                 new VolumeControlStackEvent(
@@ -291,7 +292,8 @@
         sendMessageToService(event);
     }
 
-    private void onGroupVolumeStateChanged(int volume, boolean mute, int groupId,
+    @VisibleForTesting
+    void onGroupVolumeStateChanged(int volume, boolean mute, int groupId,
             boolean isAutonomous) {
         VolumeControlStackEvent event =
                 new VolumeControlStackEvent(
@@ -308,7 +310,8 @@
         sendMessageToService(event);
     }
 
-    private void onDeviceAvailable(int numOfExternalOutputs,
+    @VisibleForTesting
+    void onDeviceAvailable(int numOfExternalOutputs,
                                    byte[] address) {
         VolumeControlStackEvent event =
                 new VolumeControlStackEvent(
@@ -322,7 +325,8 @@
         sendMessageToService(event);
     }
 
-    private void onExtAudioOutVolumeOffsetChanged(int externalOutputId, int offset,
+    @VisibleForTesting
+    void onExtAudioOutVolumeOffsetChanged(int externalOutputId, int offset,
                                                byte[] address) {
         VolumeControlStackEvent event =
                 new VolumeControlStackEvent(
@@ -337,7 +341,8 @@
         sendMessageToService(event);
     }
 
-    private void onExtAudioOutLocationChanged(int externalOutputId, int location,
+    @VisibleForTesting
+    void onExtAudioOutLocationChanged(int externalOutputId, int location,
                                                byte[] address) {
         VolumeControlStackEvent event =
                 new VolumeControlStackEvent(
@@ -352,7 +357,8 @@
         sendMessageToService(event);
     }
 
-    private void onExtAudioOutDescriptionChanged(int externalOutputId, String descr,
+    @VisibleForTesting
+    void onExtAudioOutDescriptionChanged(int externalOutputId, String descr,
                                                byte[] address) {
         VolumeControlStackEvent event =
                 new VolumeControlStackEvent(
diff --git a/android/app/src/com/android/bluetooth/vc/VolumeControlService.java b/android/app/src/com/android/bluetooth/vc/VolumeControlService.java
index c1b2587..de9fb47 100644
--- a/android/app/src/com/android/bluetooth/vc/VolumeControlService.java
+++ b/android/app/src/com/android/bluetooth/vc/VolumeControlService.java
@@ -26,6 +26,8 @@
 import android.bluetooth.BluetoothProfile;
 import android.bluetooth.BluetoothUuid;
 import android.bluetooth.BluetoothVolumeControl;
+import android.bluetooth.IBluetoothCsipSetCoordinator;
+import android.bluetooth.IBluetoothLeAudio;
 import android.bluetooth.IBluetoothVolumeControl;
 import android.bluetooth.IBluetoothVolumeControlCallback;
 import android.content.AttributionSource;
@@ -33,8 +35,6 @@
 import android.content.Context;
 import android.content.Intent;
 import android.content.IntentFilter;
-import android.media.AudioDeviceAttributes;
-import android.media.AudioDeviceInfo;
 import android.media.AudioManager;
 import android.os.HandlerThread;
 import android.os.ParcelUuid;
@@ -48,6 +48,8 @@
 import com.android.bluetooth.btservice.ProfileService;
 import com.android.bluetooth.btservice.ServiceFactory;
 import com.android.bluetooth.btservice.storage.DatabaseManager;
+import com.android.bluetooth.csip.CsipSetCoordinatorService;
+import com.android.bluetooth.le_audio.LeAudioService;
 import com.android.internal.annotations.VisibleForTesting;
 import com.android.modules.utils.SynchronousResultReceiver;
 
@@ -79,7 +81,10 @@
     @VisibleForTesting
     RemoteCallbackList<IBluetoothVolumeControlCallback> mCallbacks;
 
-    private class VolumeControlOffsetDescriptor {
+    @VisibleForTesting
+    static class VolumeControlOffsetDescriptor {
+        Map<Integer, Descriptor> mVolumeOffsets;
+
         private class Descriptor {
             Descriptor() {
                 mValue = 0;
@@ -94,15 +99,18 @@
         VolumeControlOffsetDescriptor() {
             mVolumeOffsets = new HashMap<>();
         }
+
         int size() {
             return mVolumeOffsets.size();
         }
+
         void add(int id) {
             Descriptor d = mVolumeOffsets.get(id);
             if (d == null) {
                 mVolumeOffsets.put(id, new Descriptor());
             }
         }
+
         boolean setValue(int id, int value) {
             Descriptor d = mVolumeOffsets.get(id);
             if (d == null) {
@@ -111,6 +119,7 @@
             d.mValue = value;
             return true;
         }
+
         int getValue(int id) {
             Descriptor d = mVolumeOffsets.get(id);
             if (d == null) {
@@ -118,6 +127,7 @@
             }
             return d.mValue;
         }
+
         boolean setDescription(int id, String desc) {
             Descriptor d = mVolumeOffsets.get(id);
             if (d == null) {
@@ -126,6 +136,7 @@
             d.mDescription = desc;
             return true;
         }
+
         String getDescription(int id) {
             Descriptor d = mVolumeOffsets.get(id);
             if (d == null) {
@@ -133,6 +144,7 @@
             }
             return d.mDescription;
         }
+
         boolean setLocation(int id, int location) {
             Descriptor d = mVolumeOffsets.get(id);
             if (d == null) {
@@ -141,6 +153,7 @@
             d.mLocation = location;
             return true;
         }
+
         int getLocation(int id) {
             Descriptor d = mVolumeOffsets.get(id);
             if (d == null) {
@@ -148,12 +161,15 @@
             }
             return d.mLocation;
         }
+
         void remove(int id) {
             mVolumeOffsets.remove(id);
         }
+
         void clear() {
             mVolumeOffsets.clear();
         }
+
         void dump(StringBuilder sb) {
             for (Map.Entry<Integer, Descriptor> entry : mVolumeOffsets.entrySet()) {
                 Descriptor descriptor = entry.getValue();
@@ -164,15 +180,8 @@
                 ProfileService.println(sb, "        description: " + descriptor.mDescription);
             }
         }
-
-        Map<Integer, Descriptor> mVolumeOffsets;
     }
 
-    private int mMusicMaxVolume = 0;
-    private int mMusicMinVolume = 0;
-    private int mVoiceCallMaxVolume = 0;
-    private int mVoiceCallMinVolume = 0;
-
     @VisibleForTesting
     VolumeControlNativeInterface mVolumeControlNativeInterface;
     @VisibleForTesting
@@ -186,7 +195,8 @@
     private BroadcastReceiver mBondStateChangedReceiver;
     private BroadcastReceiver mConnectionStateChangedReceiver;
 
-    private final ServiceFactory mFactory = new ServiceFactory();
+    @VisibleForTesting
+    ServiceFactory mFactory = new ServiceFactory();
 
     public static boolean isEnabled() {
         return BluetoothProperties.isProfileVcpControllerEnabled().orElse(false);
@@ -226,11 +236,6 @@
         Objects.requireNonNull(mAudioManager,
                 "AudioManager cannot be null when VolumeControlService starts");
 
-        mMusicMaxVolume = mAudioManager.getStreamMaxVolume(AudioManager.STREAM_MUSIC);
-        mMusicMinVolume = mAudioManager.getStreamMinVolume(AudioManager.STREAM_MUSIC);
-        mVoiceCallMaxVolume = mAudioManager.getStreamMaxVolume(AudioManager.STREAM_VOICE_CALL);
-        mVoiceCallMinVolume = mAudioManager.getStreamMinVolume(AudioManager.STREAM_VOICE_CALL);
-
         // Start handler thread for state machines
         mStateMachines.clear();
         mStateMachinesThread = new HandlerThread("VolumeControlService.StateMachines");
@@ -340,7 +345,8 @@
         return sVolumeControlService;
     }
 
-    private static synchronized void setVolumeControlService(VolumeControlService instance) {
+    @VisibleForTesting
+    static synchronized void setVolumeControlService(VolumeControlService instance) {
         if (DBG) {
             Log.d(TAG, "setVolumeControlService(): set to: " + instance);
         }
@@ -584,6 +590,11 @@
      * {@hide}
      */
     public void setGroupVolume(int groupId, int volume) {
+        if (volume < 0) {
+            Log.w(TAG, "Tried to set invalid volume " + volume + ". Ignored.");
+            return;
+        }
+
         mGroupVolumeCache.put(groupId, volume);
         mVolumeControlNativeInterface.setGroupVolume(groupId, volume);
     }
@@ -593,7 +604,8 @@
      * @param groupId
      */
     public int getGroupVolume(int groupId) {
-        return mGroupVolumeCache.getOrDefault(groupId, -1);
+        return mGroupVolumeCache.getOrDefault(groupId,
+                        IBluetoothVolumeControl.VOLUME_CONTROL_UNKNOWN_VOLUME);
     }
 
     /**
@@ -624,34 +636,123 @@
         mVolumeControlNativeInterface.unmuteGroup(groupId);
     }
 
+    /**
+     * {@hide}
+     */
+    public void handleGroupNodeAdded(int groupId, BluetoothDevice device) {
+        // Ignore disconnected device, its volume will be set once it connects
+        synchronized (mStateMachines) {
+            VolumeControlStateMachine sm = mStateMachines.get(device);
+            if (sm == null) {
+                return;
+            }
+            if (sm.getConnectionState() != BluetoothProfile.STATE_CONNECTED) {
+                return;
+            }
+        }
+
+        // If group volume has already changed, the new group member should set it
+        Integer groupVolume = mGroupVolumeCache.getOrDefault(groupId,
+                IBluetoothVolumeControl.VOLUME_CONTROL_UNKNOWN_VOLUME);
+        if (groupVolume != IBluetoothVolumeControl.VOLUME_CONTROL_UNKNOWN_VOLUME) {
+            // Correct the volume level only if device was already reported as connected.
+            boolean can_change_volume = false;
+            synchronized (mStateMachines) {
+                VolumeControlStateMachine sm = mStateMachines.get(device);
+                if (sm != null) {
+                    can_change_volume =
+                            (sm.getConnectionState() == BluetoothProfile.STATE_CONNECTED);
+                }
+            }
+            if (can_change_volume) {
+                Log.i(TAG, "Setting value:" + groupVolume + " to " + device);
+                mVolumeControlNativeInterface.setVolume(device, groupVolume);
+            }
+        }
+    }
+
     void handleVolumeControlChanged(BluetoothDevice device, int groupId,
                                     int volume, boolean mute, boolean isAutonomous) {
-        if (!isAutonomous) {
-            // If the change is triggered by Android device, the stream is already changed.
+
+        if (isAutonomous && device != null) {
+            Log.e(TAG, "We expect only group notification for autonomous updates");
             return;
         }
-        // TODO: Handle the other arguments: device, groupId, mute.
 
-        /* We are interested only in the group volume as any LeAudio device is a part of group */
-        if (device == null) {
-            mGroupVolumeCache.put(groupId, volume);
+        if (groupId == IBluetoothLeAudio.LE_AUDIO_GROUP_ID_INVALID) {
+            LeAudioService leAudioService = mFactory.getLeAudioService();
+            if (leAudioService == null) {
+                Log.e(TAG, "leAudioService not available");
+                return;
+            }
+            groupId = leAudioService.getGroupId(device);
         }
 
-        int streamType = getBluetoothContextualVolumeStream();
-        mAudioManager.setStreamVolume(streamType, getDeviceVolume(streamType, volume),
-                AudioManager.FLAG_SHOW_UI | AudioManager.FLAG_BLUETOOTH_ABS_VOLUME);
+        if (groupId == IBluetoothLeAudio.LE_AUDIO_GROUP_ID_INVALID) {
+            Log.e(TAG, "Device not a part of the group");
+            return;
+        }
+
+        int groupVolume = getGroupVolume(groupId);
+
+        if (!isAutonomous) {
+            /* If the change is triggered by Android device, the stream is already changed.
+             * However it might be called with isAutonomous, one the first read of after
+             * reconnection. Make sure device has group volume. Also it might happen that
+             * remote side send us wrong value - lets check it.
+             */
+
+            if (groupVolume == volume) {
+                Log.i(TAG, " Volume:" + volume + " confirmed by remote side.");
+                return;
+            }
+
+            if (device != null && groupVolume
+                            != IBluetoothVolumeControl.VOLUME_CONTROL_UNKNOWN_VOLUME) {
+                // Correct the volume level only if device was already reported as connected.
+                boolean can_change_volume = false;
+                synchronized (mStateMachines) {
+                    VolumeControlStateMachine sm = mStateMachines.get(device);
+                    if (sm != null) {
+                        can_change_volume =
+                                (sm.getConnectionState() == BluetoothProfile.STATE_CONNECTED);
+                    }
+                }
+                if (can_change_volume) {
+                    Log.i(TAG, "Setting value:" + groupVolume + " to " + device);
+                    mVolumeControlNativeInterface.setVolume(device, groupVolume);
+                }
+            } else {
+                Log.e(TAG, "Volume changed did not succeed. Volume: " + volume
+                                + " expected volume: " + groupVolume);
+            }
+        } else {
+            // TODO: Handle the other arguments: mute.
+
+            /* Received group notification for autonomous change. Update cache and audio system. */
+            mGroupVolumeCache.put(groupId, volume);
+
+            int streamType = getBluetoothContextualVolumeStream();
+            mAudioManager.setStreamVolume(streamType, getDeviceVolume(streamType, volume),
+                    AudioManager.FLAG_SHOW_UI | AudioManager.FLAG_BLUETOOTH_ABS_VOLUME);
+        }
+    }
+
+    /**
+     * {@hide}
+     */
+    public int getAudioDeviceGroupVolume(int groupId) {
+        int volume = getGroupVolume(groupId);
+        if (volume == IBluetoothVolumeControl.VOLUME_CONTROL_UNKNOWN_VOLUME) return -1;
+        return getDeviceVolume(getBluetoothContextualVolumeStream(), volume);
     }
 
     int getDeviceVolume(int streamType, int bleVolume) {
-        int bleMaxVolume = 255; // min volume is zero
-        int deviceMaxVolume = (streamType == AudioManager.STREAM_VOICE_CALL)
-                ? mVoiceCallMaxVolume : mMusicMaxVolume;
-        int deviceMinVolume = (streamType == AudioManager.STREAM_VOICE_CALL)
-                ? mVoiceCallMinVolume : mMusicMinVolume;
+        int deviceMaxVolume = mAudioManager.getStreamMaxVolume(streamType);
 
         // TODO: Investigate what happens in classic BT when BT volume is changed to zero.
-        return (int) Math.floor(
-                (double) bleVolume * (deviceMaxVolume - deviceMinVolume) / bleMaxVolume);
+        double deviceVolume = (double) (bleVolume * deviceMaxVolume) / LE_AUDIO_MAX_VOL;
+        return (int) Math.round(deviceVolume);
     }
 
     // Copied from AudioService.getBluetoothContextualVolumeStream() and modified it.
@@ -840,14 +941,6 @@
             sm = VolumeControlStateMachine.make(device, this,
                     mVolumeControlNativeInterface, mStateMachinesThread.getLooper());
             mStateMachines.put(device, sm);
-
-            mAudioManager.setDeviceVolumeBehavior(
-                    new AudioDeviceAttributes(
-                            AudioDeviceAttributes.ROLE_OUTPUT,
-                            // Currently, TYPE_BLUETOOTH_A2DP is the only thing that works.
-                            AudioDeviceInfo.TYPE_BLUETOOTH_A2DP,
-                            ""),
-                    AudioManager.DEVICE_VOLUME_BEHAVIOR_ABSOLUTE);
             return sm;
         }
     }
@@ -892,6 +985,8 @@
                 return;
             }
             if (sm.getConnectionState() != BluetoothProfile.STATE_DISCONNECTED) {
+                Log.i(TAG, "Disconnecting device because it was unbonded.");
+                disconnect(device);
                 return;
             }
             removeStateMachine(device);
@@ -931,6 +1026,17 @@
                 }
                 removeStateMachine(device);
             }
+        } else if (toState == BluetoothProfile.STATE_CONNECTED) {
+            // Restore the group volume if it was changed while the device was not yet connected.
+            CsipSetCoordinatorService csipClient = mFactory.getCsipSetCoordinatorService();
+            Integer groupId = csipClient.getGroupId(device, BluetoothUuid.CAP);
+            if (groupId != IBluetoothCsipSetCoordinator.CSIS_GROUP_ID_INVALID) {
+                Integer groupVolume = mGroupVolumeCache.getOrDefault(groupId,
+                        IBluetoothVolumeControl.VOLUME_CONTROL_UNKNOWN_VOLUME);
+                if (groupVolume != IBluetoothVolumeControl.VOLUME_CONTROL_UNKNOWN_VOLUME) {
+                    mVolumeControlNativeInterface.setVolume(device, groupVolume);
+                }
+            }
         }
     }
 
@@ -953,12 +1059,17 @@
     @VisibleForTesting
     static class BluetoothVolumeControlBinder extends IBluetoothVolumeControl.Stub
             implements IProfileServiceBinder {
+        @VisibleForTesting
+        boolean mIsTesting = false;
         private VolumeControlService mService;
 
         @RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)
         private VolumeControlService getService(AttributionSource source) {
-            if (!Utils.checkCallerIsSystemOrActiveUser(TAG)
-                    || !Utils.checkServiceAvailable(mService, TAG)
+            if (mIsTesting) {
+                return mService;
+            }
+            if (!Utils.checkServiceAvailable(mService, TAG)
+                    || !Utils.checkCallerIsSystemOrActiveOrManagedUser(mService, TAG)
                     || !Utils.checkConnectPermissionForDataDelivery(mService, source, TAG)) {
                 return null;
             }
@@ -1167,11 +1278,12 @@
                 Objects.requireNonNull(source, "source cannot be null");
                 Objects.requireNonNull(receiver, "receiver cannot be null");
 
+                int groupVolume = 0;
                 VolumeControlService service = getService(source);
                 if (service != null) {
-                    service.getGroupVolume(groupId);
+                    groupVolume = service.getGroupVolume(groupId);
                 }
-                receiver.send(null);
+                receiver.send(groupVolume);
             } catch (RuntimeException e) {
                 receiver.propagateException(e);
             }
diff --git a/android/app/src/com/android/bluetooth/vc/VolumeControlStateMachine.java b/android/app/src/com/android/bluetooth/vc/VolumeControlStateMachine.java
index 40973f0..bc0c990 100644
--- a/android/app/src/com/android/bluetooth/vc/VolumeControlStateMachine.java
+++ b/android/app/src/com/android/bluetooth/vc/VolumeControlStateMachine.java
@@ -46,7 +46,8 @@
     static final int DISCONNECT = 2;
     @VisibleForTesting
     static final int STACK_EVENT = 101;
-    private static final int CONNECT_TIMEOUT = 201;
+    @VisibleForTesting
+    static final int CONNECT_TIMEOUT = 201;
 
     // NOTE: the value is not "final" - it is modified in the unit tests
     @VisibleForTesting
diff --git a/android/app/tests/unit/Android.bp b/android/app/tests/unit/Android.bp
index f4f9323..196b7a4 100755
--- a/android/app/tests/unit/Android.bp
+++ b/android/app/tests/unit/Android.bp
@@ -2,11 +2,8 @@
     default_applicable_licenses: ["Android-Apache-2.0"],
 }
 
-android_test {
-    name: "BluetoothInstrumentationTests",
-
-    // We only want this apk build for tests.
-    certificate: ":com.android.bluetooth.certificate",
+java_defaults {
+    name: "BluetoothInstrumentationTestsDefaults",
     defaults: ["framework-bluetooth-tests-defaults"],
 
     min_sdk_version: "current",
@@ -21,6 +18,7 @@
     ],
 
     static_libs: [
+        "androidx.media_media",
         "androidx.test.ext.truth",
         "androidx.test.rules",
         "mockito-target",
@@ -51,3 +49,15 @@
 
     instrumentation_for: "Bluetooth",
 }
+
+android_test {
+    name: "BluetoothInstrumentationTests",
+    defaults: ["BluetoothInstrumentationTestsDefaults"],
+}
+
+android_test {
+    name: "GoogleBluetoothInstrumentationTests",
+    defaults: ["BluetoothInstrumentationTestsDefaults"],
+    test_config: "GoogleAndroidTest.xml",
+    instrumentation_target_package: "com.google.android.bluetooth",
+}
diff --git a/android/app/tests/unit/AndroidManifest.xml b/android/app/tests/unit/AndroidManifest.xml
index cf50f48..5e03504 100644
--- a/android/app/tests/unit/AndroidManifest.xml
+++ b/android/app/tests/unit/AndroidManifest.xml
@@ -1,8 +1,8 @@
 <?xml version="1.0" encoding="utf-8"?>
 <!-- package name must be unique so suffix with "tests" so package loader doesn't ignore us -->
 <manifest xmlns:android="http://schemas.android.com/apk/res/android"
-          package="com.android.bluetooth.tests"
-          android:sharedUserId="android.uid.bluetooth">
+          xmlns:tools="http://schemas.android.com/tools"
+          package="com.android.bluetooth.tests">
 
     <uses-permission android:name="android.permission.RECEIVE_BOOT_COMPLETED" />
     <uses-permission android:name="android.permission.ACCESS_BLUETOOTH_SHARE" />
@@ -58,6 +58,19 @@
                  android:autoRevokePermissions="disallowed">
         <uses-library android:name="android.test.runner" />
         <uses-library android:name="org.apache.http.legacy" android:required="false" />
+
+        <!-- Workaround for *ActivityTest failures (b/260295342) -->
+        <activity
+            android:name="androidx.test.core.app.InstrumentationActivityInvoker$BootstrapActivity"
+            tools:node="merge">
+            <intent-filter tools:node="removeAll" />
+        </activity>
+        <activity
+            android:name="androidx.test.core.app.InstrumentationActivityInvoker$EmptyActivity"
+            tools:node="merge">
+            <intent-filter tools:node="removeAll" />
+        </activity>
+
     </application>
     <!--
     This declares that this application uses the instrumentation test runner targeting
diff --git a/android/app/tests/unit/AndroidTest.xml b/android/app/tests/unit/AndroidTest.xml
index 97f1b8b..4358ed8 100644
--- a/android/app/tests/unit/AndroidTest.xml
+++ b/android/app/tests/unit/AndroidTest.xml
@@ -20,11 +20,36 @@
         <option name="cleanup-apks" value="true" />
         <option name="test-file-name" value="BluetoothInstrumentationTests.apk" />
     </target_preparer>
+    <target_preparer class="com.android.tradefed.targetprep.RootTargetPreparer">
+        <option name="force-root" value="true" />
+    </target_preparer>
     <target_preparer class="com.android.tradefed.targetprep.RunCommandTargetPreparer">
+        <option name="throw-if-cmd-fail" value="true" />
+        <option name="run-command" value="input keyevent KEYCODE_WAKEUP" />
+        <option name="run-command" value="wm dismiss-keyguard" />
         <option name="run-command" value="settings put global ble_scan_always_enabled 0" />
-        <option name="run-command" value="su u$(am get-current-user)_system svc bluetooth disable" />
-        <option name="teardown-command" value="su u$(am get-current-user)_system svc bluetooth enable" />
+        <option name="run-command" value="cmd bluetooth_manager disable" />
+        <option name="run-command" value="cmd bluetooth_manager wait-for-state:STATE_OFF" />
+        <option name="run-command" value="setprop bluetooth.profile.hfp.hf.enabled true" />
+        <option name="run-command" value="setprop bluetooth.profile.pbap.client.enabled true" />
+        <option name="run-command" value="setprop bluetooth.profile.map.client.enabled true" />
+        <option name="run-command"
+                value="setprop bluetooth.profile.avrcp.controller.enabled true" />
+        <option name="run-command" value="setprop bluetooth.profile.a2dp.sink.enabled true" />
+        <option name="run-command" value="setprop bluetooth.profile.sap.server.enabled true" />
+        <option name="teardown-command" value="cmd bluetooth_manager enable" />
+        <option name="teardown-command" value="cmd bluetooth_manager wait-for-state:STATE_ON" />
         <option name="teardown-command" value="settings put global ble_scan_always_enabled 1" />
+        <option name="teardown-command" value="setprop bluetooth.profile.hfp.hf.enabled false" />
+        <option name="teardown-command"
+                value="setprop bluetooth.profile.pbap.client.enabled false" />
+        <option name="teardown-command"
+                value="setprop bluetooth.profile.map.client.enabled false" />
+        <option name="teardown-command"
+                value="setprop bluetooth.profile.avrcp.controller.enabled false" />
+        <option name="teardown-command" value="setprop bluetooth.profile.a2dp.sink.enabled false" />
+        <option name="teardown-command"
+                value="setprop bluetooth.profile.sap.server.enabled false" />
     </target_preparer>
     <target_preparer class="com.android.tradefed.targetprep.FolderSaver">
         <option name="device-path" value="/data/vendor/ssrdump" />
@@ -32,12 +57,17 @@
     <option name="test-tag" value="BluetoothInstrumentationTests" />
     <test class="com.android.tradefed.testtype.AndroidJUnitTest" >
         <option name="package" value="com.android.bluetooth.tests" />
+        <!-- include and exclude filters go into /data/local/tmp/ajur/ by default
+             However it's prohibited for access by system uid packages.
+             So instead we use the app cache folder for filter -->
+        <option name="test-filter-dir" value="/data/data/com.android.bluetooth/cache" />
         <option name="hidden-api-checks" value="false"/>
     </test>
 
-    <!-- Only run Cts Tests in MTS if the Bluetooth Mainline module is installed. -->
+    <!-- Only run if the Bluetooth Mainline module is installed. -->
     <object type="module_controller"
             class="com.android.tradefed.testtype.suite.module.MainlineTestModuleController">
-        <option name="mainline-module-package-name" value="com.google.android.bluetooth" />
+        <option name="enable" value="true" />
+        <option name="mainline-module-package-name" value="com.android.btservices" />
     </object>
 </configuration>
diff --git a/android/app/tests/unit/GoogleAndroidTest.xml b/android/app/tests/unit/GoogleAndroidTest.xml
new file mode 100644
index 0000000..8300f6c
--- /dev/null
+++ b/android/app/tests/unit/GoogleAndroidTest.xml
@@ -0,0 +1,73 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright 2017 The Android Open Source Project
+
+     Licensed under the Apache License, Version 2.0 (the "License");
+     you may not use this file except in compliance with the License.
+     You may obtain a copy of the License at
+
+          http://www.apache.org/licenses/LICENSE-2.0
+
+     Unless required by applicable law or agreed to in writing, software
+     distributed under the License is distributed on an "AS IS" BASIS,
+     WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+     See the License for the specific language governing permissions and
+     limitations under the License.
+-->
+<configuration description="Runs Bluetooth Test Cases.">
+    <option name="test-suite-tag" value="apct" />
+    <option name="test-suite-tag" value="apct-instrumentation" />
+    <target_preparer class="com.android.tradefed.targetprep.suite.SuiteApkInstaller">
+        <option name="cleanup-apks" value="true" />
+        <option name="test-file-name" value="GoogleBluetoothInstrumentationTests.apk" />
+    </target_preparer>
+    <target_preparer class="com.android.tradefed.targetprep.RootTargetPreparer">
+        <option name="force-root" value="true" />
+    </target_preparer>
+    <target_preparer class="com.android.tradefed.targetprep.RunCommandTargetPreparer">
+        <option name="throw-if-cmd-fail" value="true" />
+        <option name="run-command" value="input keyevent KEYCODE_WAKEUP" />
+        <option name="run-command" value="wm dismiss-keyguard" />
+        <option name="run-command" value="settings put global ble_scan_always_enabled 0" />
+        <option name="run-command" value="cmd bluetooth_manager disable" />
+        <option name="run-command" value="cmd bluetooth_manager wait-for-state:STATE_OFF" />
+        <option name="run-command" value="setprop bluetooth.profile.hfp.hf.enabled true" />
+        <option name="run-command" value="setprop bluetooth.profile.pbap.client.enabled true" />
+        <option name="run-command" value="setprop bluetooth.profile.map.client.enabled true" />
+        <option name="run-command"
+                value="setprop bluetooth.profile.avrcp.controller.enabled true" />
+        <option name="run-command" value="setprop bluetooth.profile.a2dp.sink.enabled true" />
+        <option name="run-command" value="setprop bluetooth.profile.sap.server.enabled true" />
+        <option name="teardown-command" value="cmd bluetooth_manager enable" />
+        <option name="teardown-command" value="cmd bluetooth_manager wait-for-state:STATE_ON" />
+        <option name="teardown-command" value="settings put global ble_scan_always_enabled 1" />
+        <option name="teardown-command"
+                value="setprop bluetooth.profile.pbap.client.enabled false" />
+        <option name="teardown-command"
+                value="setprop bluetooth.profile.map.client.enabled false" />
+        <option name="teardown-command" value="setprop bluetooth.profile.hfp.hf.enabled false" />
+        <option name="teardown-command"
+                value="setprop bluetooth.profile.avrcp.controller.enabled false" />
+        <option name="teardown-command" value="setprop bluetooth.profile.a2dp.sink.enabled false" />
+        <option name="teardown-command"
+                value="setprop bluetooth.profile.sap.server.enabled false" />
+    </target_preparer>
+    <target_preparer class="com.android.tradefed.targetprep.FolderSaver">
+        <option name="device-path" value="/data/vendor/ssrdump" />
+    </target_preparer>
+    <option name="test-tag" value="GoogleBluetoothInstrumentationTests" />
+    <test class="com.android.tradefed.testtype.AndroidJUnitTest" >
+        <option name="package" value="com.android.bluetooth.tests" />
+        <!-- include and exclude filters go into /data/local/tmp/ajur/ by default
+             However it's prohibited for access by system uid packages.
+             So instead we use the app cache folder for filter -->
+        <option name="test-filter-dir" value="/data/data/com.google.android.bluetooth/cache" />
+        <option name="hidden-api-checks" value="false"/>
+    </test>
+
+    <!-- Only run if the Google Bluetooth Mainline module is installed. -->
+    <object type="module_controller"
+            class="com.android.tradefed.testtype.suite.module.MainlineTestModuleController">
+        <option name="enable" value="true" />
+        <option name="mainline-module-package-name" value="com.google.android.btservices" />
+    </object>
+</configuration>
diff --git a/android/app/tests/unit/src/com/android/bluetooth/ObexAppParametersTest.java b/android/app/tests/unit/src/com/android/bluetooth/ObexAppParametersTest.java
new file mode 100644
index 0000000..4e84591
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/ObexAppParametersTest.java
@@ -0,0 +1,201 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth;
+
+import static com.google.common.truth.Truth.assertThat;
+import static com.google.common.truth.Truth.assertWithMessage;
+
+import androidx.test.filters.SmallTest;
+import androidx.test.runner.AndroidJUnit4;
+
+import com.android.obex.HeaderSet;
+
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+import java.nio.ByteBuffer;
+import java.util.Arrays;
+
+@SmallTest
+@RunWith(AndroidJUnit4.class)
+public class ObexAppParametersTest {
+
+    private static final byte KEY = 0x12;
+
+    @Test
+    public void constructorWithByteArrays_withOneInvalidElement() {
+        final int length = 4;
+
+        byte[] byteArray = new byte[] {KEY, length, 0x12, 0x34, 0x56, 0x78,
+                0x66}; // Last one is invalid. It will be filtered out.
+
+        ObexAppParameters params = new ObexAppParameters(byteArray);
+        assertThat(params.exists(KEY)).isTrue();
+
+        byte[] expected = Arrays.copyOfRange(byteArray, 2, 6);
+        assertThat(params.getByteArray(KEY)).isEqualTo(expected);
+    }
+
+    @Test
+    public void constructorWithByteArrays_withTwoInvalidElements() {
+        final int length = 4;
+        byte[] byteArray = new byte[] {KEY, length, 0x12, 0x34, 0x56, 0x78,
+                0x66, 0x77}; // Last two are invalid. It will be filtered out.
+
+        ObexAppParameters params = new ObexAppParameters(byteArray);
+        assertThat(params.exists(KEY)).isTrue();
+
+        byte[] expected = Arrays.copyOfRange(byteArray, 2, 6);
+        assertThat(params.getByteArray(KEY)).isEqualTo(expected);
+    }
+
+    @Test
+    public void fromHeaderSet() {
+        final int length = 4;
+        byte[] byteArray = new byte[] {KEY, length, 0x12, 0x34, 0x56, 0x78};
+
+        HeaderSet headerSet = new HeaderSet();
+        headerSet.setHeader(HeaderSet.APPLICATION_PARAMETER, byteArray);
+
+        ObexAppParameters params = ObexAppParameters.fromHeaderSet(headerSet);
+        assertThat(params).isNotNull();
+
+        byte[] expected = Arrays.copyOfRange(byteArray, 2, 6);
+        assertThat(params.getByteArray(KEY)).isEqualTo(expected);
+    }
+
+    @Test
+    public void addToHeaderSet() throws Exception {
+        final int length = 4;
+        byte[] byteArray = new byte[] {KEY, length, 0x12, 0x34, 0x56, 0x78};
+
+        HeaderSet headerSet = new HeaderSet();
+        ObexAppParameters params = new ObexAppParameters(byteArray);
+        params.addToHeaderSet(headerSet);
+
+        assertThat(byteArray).isEqualTo(headerSet.getHeader(HeaderSet.APPLICATION_PARAMETER));
+    }
+
+    @Test
+    public void add_byte() {
+        ObexAppParameters params = new ObexAppParameters();
+        final byte value = 0x34;
+        params.add(KEY, value);
+
+        assertThat(params.getByte(KEY)).isEqualTo(value);
+    }
+
+    @Test
+    public void add_short() {
+        ObexAppParameters params = new ObexAppParameters();
+        final short value = 0x99; // More than max byte value
+        params.add(KEY, value);
+
+        assertThat(params.getShort(KEY)).isEqualTo(value);
+    }
+
+    @Test
+    public void add_int() {
+        ObexAppParameters params = new ObexAppParameters();
+        final int value = 12345678; // More than max short value
+        params.add(KEY, value);
+
+        assertThat(params.getInt(KEY)).isEqualTo(value);
+    }
+
+    @Test
+    public void add_long() {
+        ObexAppParameters params = new ObexAppParameters();
+        final long value = 1234567890123456L; // More than max integer value
+        params.add(KEY, value);
+
+        // Note: getLong() does not exist
+        byte[] byteArray = params.getByteArray(KEY);
+        assertThat(ByteBuffer.wrap(byteArray).getLong()).isEqualTo(value);
+    }
+
+    @Test
+    public void add_string() {
+        ObexAppParameters params = new ObexAppParameters();
+        final String value = "Some string value";
+        params.add(KEY, value);
+
+        assertThat(params.getString(KEY)).isEqualTo(value);
+    }
+
+    @Test
+    public void add_byteArray() {
+        ObexAppParameters params = new ObexAppParameters();
+        final byte[] value = new byte[] {0x00, 0x01, 0x02, 0x03};
+        params.add(KEY, value);
+
+        assertThat(params.getByteArray(KEY)).isEqualTo(value);
+    }
+
+    @Test
+    public void get_errorCases() {
+        ObexAppParameters emptyParams = new ObexAppParameters();
+
+        assertThat(emptyParams.getByte(KEY)).isEqualTo(0);
+        assertThat(emptyParams.getShort(KEY)).isEqualTo(0);
+        assertThat(emptyParams.getInt(KEY)).isEqualTo(0);
+        // Note: getLong() does not exist
+        assertThat(emptyParams.getString(KEY)).isNull();
+        assertThat(emptyParams.getByteArray(KEY)).isNull();
+    }
+
+    @Test
+    public void toString_isNotNull() {
+        ObexAppParameters params = new ObexAppParameters();
+        assertThat(params.toString()).isNotNull();
+    }
+
+    @Test
+    public void getHeader_withTwoEntries() {
+        ObexAppParameters params = new ObexAppParameters();
+
+        final byte key1 = 0x01;
+        final int value1 = 12345;
+        params.add(key1, value1);
+
+        final byte key2 = 0x02;
+        final int value2 = 56789;
+        params.add(key2, value2);
+
+        ByteBuffer result = ByteBuffer.wrap(params.getHeader());
+        final byte firstKey = result.get();
+
+        final int sizeOfInt = 4;
+        if (firstKey == key1) {
+            assertThat(result.get()).isEqualTo(sizeOfInt);
+            assertThat(result.getInt()).isEqualTo(value1);
+
+            assertThat(result.get()).isEqualTo(key2);
+            assertThat(result.get()).isEqualTo(sizeOfInt);
+            assertThat(result.getInt()).isEqualTo(value2);
+        } else if (firstKey == key2) {
+            assertThat(result.get()).isEqualTo(sizeOfInt);
+            assertThat(result.getInt()).isEqualTo(value2);
+
+            assertThat(result.get()).isEqualTo(key1);
+            assertThat(result.get()).isEqualTo(sizeOfInt);
+            assertThat(result.getInt()).isEqualTo(value1);
+        } else {
+            assertWithMessage("Key should be one of two keys").fail();
+        }
+    }
+}
diff --git a/android/app/tests/unit/src/com/android/bluetooth/SignedLongLongTest.java b/android/app/tests/unit/src/com/android/bluetooth/SignedLongLongTest.java
new file mode 100644
index 0000000..0a4b682
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/SignedLongLongTest.java
@@ -0,0 +1,139 @@
+/*
+ * Copyright 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package com.android.bluetooth;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import static org.junit.Assert.assertThrows;
+
+import androidx.test.filters.SmallTest;
+import androidx.test.runner.AndroidJUnit4;
+
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+/**
+ * Test for SignedLongLong.java
+ */
+@SmallTest
+@RunWith(AndroidJUnit4.class)
+public class SignedLongLongTest {
+
+    @Test
+    public void compareTo_sameValue_returnsZero() {
+        long mostSigBits = 1352;
+        long leastSigBits = 53423;
+
+        SignedLongLong value = new SignedLongLong(mostSigBits, leastSigBits);
+        SignedLongLong sameValue = new SignedLongLong(mostSigBits, leastSigBits);
+
+        assertThat(value.compareTo(sameValue)).isEqualTo(0);
+    }
+
+    @Test
+    public void compareTo_biggerLeastSigBits_returnsMinusOne() {
+        long commonMostSigBits = 12345;
+        long leastSigBits = 1;
+        SignedLongLong value = new SignedLongLong(leastSigBits, commonMostSigBits);
+
+        long biggerLeastSigBits = 2;
+        SignedLongLong biggerValue = new SignedLongLong(biggerLeastSigBits, commonMostSigBits);
+
+        assertThat(value.compareTo(biggerValue)).isEqualTo(-1);
+    }
+
+    @Test
+    public void compareTo_smallerLeastSigBits_returnsOne() {
+        long commonMostSigBits = 12345;
+        long leastSigBits = 2;
+        SignedLongLong value = new SignedLongLong(leastSigBits, commonMostSigBits);
+
+        long smallerLeastSigBits = 1;
+        SignedLongLong smallerValue = new SignedLongLong(smallerLeastSigBits, commonMostSigBits);
+
+        assertThat(value.compareTo(smallerValue)).isEqualTo(1);
+    }
+
+    @Test
+    public void compareTo_biggerMostSigBits_returnsMinusOne() {
+        long commonLeastSigBits = 12345;
+        long mostSigBits = 1;
+        SignedLongLong value = new SignedLongLong(commonLeastSigBits, mostSigBits);
+
+        long biggerMostSigBits = 2;
+        SignedLongLong biggerValue = new SignedLongLong(commonLeastSigBits, biggerMostSigBits);
+
+        assertThat(value.compareTo(biggerValue)).isEqualTo(-1);
+    }
+
+    @Test
+    public void compareTo_smallerMostSigBits_returnsOne() {
+        long commonLeastSigBits = 12345;
+        long mostSigBits = 2;
+        SignedLongLong value = new SignedLongLong(commonLeastSigBits, mostSigBits);
+
+        long smallerMostSigBits = 1;
+        SignedLongLong smallerValue = new SignedLongLong(commonLeastSigBits, smallerMostSigBits);
+
+        assertThat(value.compareTo(smallerValue)).isEqualTo(1);
+    }
+
+    @Test
+    public void toString_RepresentedAsHexValues() {
+        SignedLongLong value = new SignedLongLong(2, 11);
+
+        assertThat(value.toString()).isEqualTo("B0000000000000002");
+    }
+
+    @SuppressWarnings("EqualsIncompatibleType")
+    @Test
+    public void equals_variousCases() {
+        SignedLongLong value = new SignedLongLong(1, 2);
+
+        assertThat(value.equals(value)).isTrue();
+        assertThat(value.equals(null)).isFalse();
+        assertThat(value.equals("a random string")).isFalse();
+        assertThat(value.equals(new SignedLongLong(1, 1))).isFalse();
+        assertThat(value.equals(new SignedLongLong(2, 2))).isFalse();
+        assertThat(value.equals(new SignedLongLong(1, 2))).isTrue();
+    }
+
+    @Test
+    public void fromString_whenStringIsNull_throwsNPE() {
+        assertThrows(NullPointerException.class, () -> SignedLongLong.fromString(null));
+    }
+
+    @Test
+    public void fromString_whenLengthIsInvalid_throwsNumberFormatException() {
+        assertThrows(NumberFormatException.class, () -> SignedLongLong.fromString(""));
+    }
+
+    @Test
+    public void fromString_whenLengthIsNotGreaterThan16() throws Exception {
+        String strValue = "1";
+
+        assertThat(SignedLongLong.fromString(strValue))
+                .isEqualTo(new SignedLongLong(1, 0));
+    }
+
+    @Test
+    public void fromString_whenLengthIsGreaterThan16() throws Exception {
+        String strValue = "B0000000000000002";
+
+        assertThat(SignedLongLong.fromString(strValue))
+                .isEqualTo(new SignedLongLong(2, 11));
+    }
+}
diff --git a/android/app/tests/unit/src/com/android/bluetooth/TestUtils.java b/android/app/tests/unit/src/com/android/bluetooth/TestUtils.java
index 15b3f84..6662725 100644
--- a/android/app/tests/unit/src/com/android/bluetooth/TestUtils.java
+++ b/android/app/tests/unit/src/com/android/bluetooth/TestUtils.java
@@ -205,18 +205,13 @@
     }
 
     public static Resources getTestApplicationResources(Context context) {
-        for (String name: context.getPackageManager().getPackagesForUid(Process.BLUETOOTH_UID)) {
-            if (name.contains(".android.bluetooth.tests")) {
-                try {
-                    return context.getPackageManager().getResourcesForApplication(name);
-                } catch (PackageManager.NameNotFoundException e) {
-                    assertWithMessage("Setup Failure: Unable to get test application resources"
-                            + e.toString()).fail();
-                }
-            }
+        try {
+            return context.getPackageManager().getResourcesForApplication("com.android.bluetooth.tests");
+        } catch (PackageManager.NameNotFoundException e) {
+            assertWithMessage("Setup Failure: Unable to get test application resources"
+                    + e.toString()).fail();
+            return null;
         }
-        assertWithMessage("Could not find tests package").fail();
-        return null;
     }
 
     /**
diff --git a/android/app/tests/unit/src/com/android/bluetooth/UtilsTest.java b/android/app/tests/unit/src/com/android/bluetooth/UtilsTest.java
new file mode 100644
index 0000000..20e830c
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/UtilsTest.java
@@ -0,0 +1,252 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package com.android.bluetooth;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import static org.mockito.Mockito.doThrow;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;
+import static org.mockito.Mockito.verify;
+
+import android.bluetooth.BluetoothAdapter;
+import android.bluetooth.BluetoothDevice;
+import android.content.Context;
+import android.location.LocationManager;
+import android.os.Build;
+import android.os.ParcelUuid;
+import android.os.UserHandle;
+
+import androidx.test.InstrumentationRegistry;
+import androidx.test.filters.SmallTest;
+import androidx.test.runner.AndroidJUnit4;
+
+import com.android.bluetooth.btservice.ProfileService;
+
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.Mockito;
+
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.OutputStream;
+import java.nio.ByteBuffer;
+import java.nio.ByteOrder;
+import java.util.UUID;
+
+/**
+ * Test for Utils.java
+ */
+@SmallTest
+@RunWith(AndroidJUnit4.class)
+public class UtilsTest {
+    @Test
+    public void byteArrayToShort() {
+        byte[] valueBuf = new byte[] {0x01, 0x02};
+        short s = Utils.byteArrayToShort(valueBuf);
+        assertThat(s).isEqualTo(0x0201);
+    }
+
+    @Test
+    public void byteArrayToString() {
+        byte[] valueBuf = new byte[] {0x01, 0x02};
+        String str = Utils.byteArrayToString(valueBuf);
+        assertThat(str).isEqualTo("01 02");
+    }
+
+    @Test
+    public void uuidsToByteArray() {
+        ParcelUuid[] uuids = new ParcelUuid[] {
+                new ParcelUuid(new UUID(10, 20)),
+                new ParcelUuid(new UUID(30, 40))
+        };
+        ByteBuffer converter = ByteBuffer.allocate(uuids.length * 16);
+        converter.order(ByteOrder.BIG_ENDIAN);
+        converter.putLong(0, 10);
+        converter.putLong(8, 20);
+        converter.putLong(16, 30);
+        converter.putLong(24, 40);
+        assertThat(Utils.uuidsToByteArray(uuids)).isEqualTo(converter.array());
+    }
+
+    @Test
+    public void checkServiceAvailable() {
+        final String tag = "UTILS_TEST";
+        assertThat(Utils.checkServiceAvailable(null, tag)).isFalse();
+
+        ProfileService mockProfile = Mockito.mock(ProfileService.class);
+        when(mockProfile.isAvailable()).thenReturn(false);
+        assertThat(Utils.checkServiceAvailable(mockProfile, tag)).isFalse();
+
+        when(mockProfile.isAvailable()).thenReturn(true);
+        assertThat(Utils.checkServiceAvailable(mockProfile, tag)).isTrue();
+    }
+
+    @Test
+    public void blockedByLocationOff() throws Exception {
+        Context context = InstrumentationRegistry.getTargetContext();
+        UserHandle userHandle = new UserHandle(UserHandle.USER_SYSTEM);
+        LocationManager locationManager = context.getSystemService(LocationManager.class);
+        boolean enableStatus = locationManager.isLocationEnabledForUser(userHandle);
+        assertThat(Utils.blockedByLocationOff(context, userHandle)).isEqualTo(!enableStatus);
+
+        locationManager.setLocationEnabledForUser(!enableStatus, userHandle);
+        assertThat(Utils.blockedByLocationOff(context, userHandle)).isEqualTo(enableStatus);
+
+        locationManager.setLocationEnabledForUser(enableStatus, userHandle);
+    }
+
+    @Test
+    public void checkCallerHasCoarseLocation_doesNotCrash() {
+        Context context = InstrumentationRegistry.getTargetContext();
+        UserHandle userHandle = new UserHandle(UserHandle.USER_SYSTEM);
+        LocationManager locationManager = context.getSystemService(LocationManager.class);
+        boolean enabledStatus = locationManager.isLocationEnabledForUser(userHandle);
+
+        locationManager.setLocationEnabledForUser(false, userHandle);
+        assertThat(Utils.checkCallerHasCoarseLocation(context, null, userHandle)).isFalse();
+
+        locationManager.setLocationEnabledForUser(true, userHandle);
+        Utils.checkCallerHasCoarseLocation(context, null, userHandle);
+        if (!enabledStatus) {
+            locationManager.setLocationEnabledForUser(false, userHandle);
+        }
+    }
+
+    @Test
+    public void checkCallerHasCoarseOrFineLocation_doesNotCrash() {
+        Context context = InstrumentationRegistry.getTargetContext();
+        UserHandle userHandle = new UserHandle(UserHandle.USER_SYSTEM);
+        LocationManager locationManager = context.getSystemService(LocationManager.class);
+        boolean enabledStatus = locationManager.isLocationEnabledForUser(userHandle);
+
+        locationManager.setLocationEnabledForUser(false, userHandle);
+        assertThat(Utils.checkCallerHasCoarseOrFineLocation(context, null, userHandle)).isFalse();
+
+        locationManager.setLocationEnabledForUser(true, userHandle);
+        Utils.checkCallerHasCoarseOrFineLocation(context, null, userHandle);
+        if (!enabledStatus) {
+            locationManager.setLocationEnabledForUser(false, userHandle);
+        }
+    }
+
+    @Test
+    public void checkPermissionMethod_doesNotCrash() {
+        Context context = InstrumentationRegistry.getTargetContext();
+        try {
+            Utils.checkAdvertisePermissionForDataDelivery(context, null, "message");
+            Utils.checkAdvertisePermissionForPreflight(context);
+            Utils.checkCallerHasWriteSmsPermission(context);
+            Utils.checkScanPermissionForPreflight(context);
+            Utils.checkConnectPermissionForPreflight(context);
+        } catch (SecurityException e) {
+            // SecurityException could happen.
+        }
+    }
+
+    @Test
+    public void enforceDumpPermission_doesNotCrash() {
+        Context context = InstrumentationRegistry.getTargetContext();
+        try {
+            Utils.enforceDumpPermission(context);
+        } catch (SecurityException e) {
+            // SecurityException could happen.
+        }
+    }
+
+    @Test
+    public void getLoggableAddress() {
+        assertThat(Utils.getLoggableAddress(null)).isEqualTo("00:00:00:00:00:00");
+
+        BluetoothDevice device = TestUtils.getTestDevice(BluetoothAdapter.getDefaultAdapter(), 1);
+        String loggableAddress = "xx:xx:xx:xx:" + device.getAddress().substring(12);
+        assertThat(Utils.getLoggableAddress(device)).isEqualTo(loggableAddress);
+    }
+
+    @Test
+    public void checkCallerIsSystemMethods_doesNotCrash() {
+        Context context = InstrumentationRegistry.getTargetContext();
+        String tag = "test_tag";
+
+        Utils.checkCallerIsSystemOrActiveOrManagedUser(context, tag);
+        Utils.checkCallerIsSystemOrActiveOrManagedUser(null, tag);
+        Utils.checkCallerIsSystemOrActiveUser(tag);
+    }
+
+    @Test
+    public void testCopyStream() throws Exception {
+        byte[] data = new byte[] {1, 2, 3, 4, 5, 6, 7, 8};
+        ByteArrayInputStream in = new ByteArrayInputStream(data);
+        ByteArrayOutputStream out = new ByteArrayOutputStream();
+        int bufferSize = 4;
+
+        Utils.copyStream(in, out, bufferSize);
+
+        assertThat(out.toByteArray()).isEqualTo(data);
+    }
+
+    @Test
+    public void debugGetAdapterStateString() {
+        assertThat(Utils.debugGetAdapterStateString(BluetoothAdapter.STATE_OFF))
+                .isEqualTo("STATE_OFF");
+        assertThat(Utils.debugGetAdapterStateString(BluetoothAdapter.STATE_ON))
+                .isEqualTo("STATE_ON");
+        assertThat(Utils.debugGetAdapterStateString(BluetoothAdapter.STATE_TURNING_ON))
+                .isEqualTo("STATE_TURNING_ON");
+        assertThat(Utils.debugGetAdapterStateString(BluetoothAdapter.STATE_TURNING_OFF))
+                .isEqualTo("STATE_TURNING_OFF");
+        assertThat(Utils.debugGetAdapterStateString(-124))
+                .isEqualTo("UNKNOWN");
+    }
+
+    @Test
+    public void ellipsize() {
+        if (!Build.TYPE.equals("user")) {
+            // Only ellipsize release builds
+            String input = "a_long_string";
+            assertThat(Utils.ellipsize(input)).isEqualTo(input);
+            return;
+        }
+
+        assertThat(Utils.ellipsize("ab")).isEqualTo("ab");
+        assertThat(Utils.ellipsize("abc")).isEqualTo("a⋯c");
+        assertThat(Utils.ellipsize(null)).isEqualTo(null);
+    }
+
+    @Test
+    public void safeCloseStream_inputStream_doesNotCrash() throws Exception {
+        InputStream is = mock(InputStream.class);
+        Utils.safeCloseStream(is);
+        verify(is).close();
+
+        Mockito.clearInvocations(is);
+        doThrow(new IOException()).when(is).close();
+        Utils.safeCloseStream(is);
+    }
+
+    @Test
+    public void safeCloseStream_outputStream_doesNotCrash() throws Exception {
+        OutputStream os = mock(OutputStream.class);
+        Utils.safeCloseStream(os);
+        verify(os).close();
+
+        Mockito.clearInvocations(os);
+        doThrow(new IOException()).when(os).close();
+        Utils.safeCloseStream(os);
+    }
+}
diff --git a/android/app/tests/unit/src/com/android/bluetooth/a2dp/A2dpCodecConfigTest.java b/android/app/tests/unit/src/com/android/bluetooth/a2dp/A2dpCodecConfigTest.java
index f9a8c45..f6e4d22 100644
--- a/android/app/tests/unit/src/com/android/bluetooth/a2dp/A2dpCodecConfigTest.java
+++ b/android/app/tests/unit/src/com/android/bluetooth/a2dp/A2dpCodecConfigTest.java
@@ -44,6 +44,10 @@
 @MediumTest
 @RunWith(AndroidJUnit4.class)
 public class A2dpCodecConfigTest {
+
+    // TODO(b/240635097): remove in U
+    private static final int SOURCE_CODEC_TYPE_OPUS = 6;
+
     private Context mTargetContext;
     private BluetoothDevice mTestDevice;
     private A2dpCodecConfig mA2dpCodecConfig;
@@ -57,7 +61,7 @@
             BluetoothCodecConfig.SOURCE_CODEC_TYPE_APTX,
             BluetoothCodecConfig.SOURCE_CODEC_TYPE_APTX_HD,
             BluetoothCodecConfig.SOURCE_CODEC_TYPE_LDAC,
-            BluetoothCodecConfig.SOURCE_CODEC_TYPE_LC3
+            SOURCE_CODEC_TYPE_OPUS // TODO(b/240635097): update in U
     };
 
     // Not use the default value to make sure it reads from config
@@ -67,6 +71,7 @@
     private static final int APTX_HD_PRIORITY_DEFAULT = 7001;
     private static final int LDAC_PRIORITY_DEFAULT = 9001;
     private static final int LC3_PRIORITY_DEFAULT = 11001;
+    private static final int OPUS_PRIORITY_DEFAULT = 13001;
     private static final int PRIORITY_HIGH = 1000000;
 
     private static final BluetoothCodecConfig[] sCodecCapabilities = new BluetoothCodecConfig[] {
@@ -108,13 +113,11 @@
                                      | BluetoothCodecConfig.BITS_PER_SAMPLE_32,
                                      BluetoothCodecConfig.CHANNEL_MODE_STEREO,
                                      0, 0, 0, 0),       // Codec-specific fields
-            buildBluetoothCodecConfig(BluetoothCodecConfig.SOURCE_CODEC_TYPE_LC3,
-                                     LC3_PRIORITY_DEFAULT,
-                                     BluetoothCodecConfig.SAMPLE_RATE_44100
-                                     | BluetoothCodecConfig.SAMPLE_RATE_48000,
+            buildBluetoothCodecConfig(SOURCE_CODEC_TYPE_OPUS, // TODO(b/240635097): update in U
+                                     OPUS_PRIORITY_DEFAULT,
+                                     BluetoothCodecConfig.SAMPLE_RATE_48000,
                                      BluetoothCodecConfig.BITS_PER_SAMPLE_16,
-                                     BluetoothCodecConfig.CHANNEL_MODE_MONO
-                                     | BluetoothCodecConfig.CHANNEL_MODE_STEREO,
+                                     BluetoothCodecConfig.CHANNEL_MODE_STEREO,
                                      0, 0, 0, 0)        // Codec-specific fields
     };
 
@@ -149,8 +152,8 @@
                                      BluetoothCodecConfig.BITS_PER_SAMPLE_32,
                                      BluetoothCodecConfig.CHANNEL_MODE_STEREO,
                                      0, 0, 0, 0),       // Codec-specific fields
-            buildBluetoothCodecConfig(BluetoothCodecConfig.SOURCE_CODEC_TYPE_LC3,
-                                     LC3_PRIORITY_DEFAULT,
+            buildBluetoothCodecConfig(SOURCE_CODEC_TYPE_OPUS, // TODO(b/240635097): update in U
+                                     OPUS_PRIORITY_DEFAULT,
                                      BluetoothCodecConfig.SAMPLE_RATE_48000,
                                      BluetoothCodecConfig.BITS_PER_SAMPLE_16,
                                      BluetoothCodecConfig.CHANNEL_MODE_STEREO,
@@ -174,8 +177,8 @@
                 .thenReturn(APTX_HD_PRIORITY_DEFAULT);
         when(mMockResources.getInteger(R.integer.a2dp_source_codec_priority_ldac))
                 .thenReturn(LDAC_PRIORITY_DEFAULT);
-        when(mMockResources.getInteger(R.integer.a2dp_source_codec_priority_lc3))
-                .thenReturn(LC3_PRIORITY_DEFAULT);
+        when(mMockResources.getInteger(R.integer.a2dp_source_codec_priority_opus))
+                .thenReturn(OPUS_PRIORITY_DEFAULT);
 
         mA2dpCodecConfig = new A2dpCodecConfig(mMockContext, mA2dpNativeInterface);
         mTestDevice = BluetoothAdapter.getDefaultAdapter().getRemoteDevice("00:01:02:03:04:05");
@@ -209,8 +212,8 @@
                 case BluetoothCodecConfig.SOURCE_CODEC_TYPE_LDAC:
                     Assert.assertEquals(config.getCodecPriority(), LDAC_PRIORITY_DEFAULT);
                     break;
-                case BluetoothCodecConfig.SOURCE_CODEC_TYPE_LC3:
-                    Assert.assertEquals(config.getCodecPriority(), LC3_PRIORITY_DEFAULT);
+                case SOURCE_CODEC_TYPE_OPUS: // TODO(b/240635097): update in U
+                    Assert.assertEquals(config.getCodecPriority(), OPUS_PRIORITY_DEFAULT);
                     break;
             }
         }
@@ -242,8 +245,9 @@
                 BluetoothCodecConfig.SOURCE_CODEC_TYPE_LDAC, PRIORITY_HIGH,
                 true);
         testCodecPriorityChangeHelper(
-                BluetoothCodecConfig.SOURCE_CODEC_TYPE_LC3, LC3_PRIORITY_DEFAULT,
-                BluetoothCodecConfig.SOURCE_CODEC_TYPE_LC3, PRIORITY_HIGH,
+                // TODO(b/240635097): update in U
+                SOURCE_CODEC_TYPE_OPUS, OPUS_PRIORITY_DEFAULT,
+                SOURCE_CODEC_TYPE_OPUS, PRIORITY_HIGH,
                 false);
     }
 
@@ -255,27 +259,33 @@
     public void testSetCodecPreference_priorityDefaultToRaiseHigh() {
         testCodecPriorityChangeHelper(
                 BluetoothCodecConfig.SOURCE_CODEC_TYPE_SBC, PRIORITY_HIGH,
-                BluetoothCodecConfig.SOURCE_CODEC_TYPE_LC3, LC3_PRIORITY_DEFAULT,
+                // TODO(b/240635097): update in U
+                SOURCE_CODEC_TYPE_OPUS, OPUS_PRIORITY_DEFAULT,
                 true);
         testCodecPriorityChangeHelper(
                 BluetoothCodecConfig.SOURCE_CODEC_TYPE_AAC, PRIORITY_HIGH,
-                BluetoothCodecConfig.SOURCE_CODEC_TYPE_LC3, LC3_PRIORITY_DEFAULT,
+                // TODO(b/240635097): update in U
+                SOURCE_CODEC_TYPE_OPUS, OPUS_PRIORITY_DEFAULT,
                 true);
         testCodecPriorityChangeHelper(
                 BluetoothCodecConfig.SOURCE_CODEC_TYPE_APTX, PRIORITY_HIGH,
-                BluetoothCodecConfig.SOURCE_CODEC_TYPE_LC3, LC3_PRIORITY_DEFAULT,
+                // TODO(b/240635097): update in U
+                SOURCE_CODEC_TYPE_OPUS, OPUS_PRIORITY_DEFAULT,
                 true);
         testCodecPriorityChangeHelper(
                 BluetoothCodecConfig.SOURCE_CODEC_TYPE_APTX_HD, PRIORITY_HIGH,
-                BluetoothCodecConfig.SOURCE_CODEC_TYPE_LC3, LC3_PRIORITY_DEFAULT,
+                // TODO(b/240635097): update in U
+                SOURCE_CODEC_TYPE_OPUS, OPUS_PRIORITY_DEFAULT,
                 true);
         testCodecPriorityChangeHelper(
                 BluetoothCodecConfig.SOURCE_CODEC_TYPE_LDAC, PRIORITY_HIGH,
-                BluetoothCodecConfig.SOURCE_CODEC_TYPE_LC3, LC3_PRIORITY_DEFAULT,
+                // TODO(b/240635097): update in U
+                SOURCE_CODEC_TYPE_OPUS, OPUS_PRIORITY_DEFAULT,
                 true);
         testCodecPriorityChangeHelper(
-                BluetoothCodecConfig.SOURCE_CODEC_TYPE_LC3, PRIORITY_HIGH,
-                BluetoothCodecConfig.SOURCE_CODEC_TYPE_LC3, LC3_PRIORITY_DEFAULT,
+                // TODO(b/240635097): update in U
+                SOURCE_CODEC_TYPE_OPUS, PRIORITY_HIGH,
+                SOURCE_CODEC_TYPE_OPUS, OPUS_PRIORITY_DEFAULT,
                 false);
     }
 
@@ -302,7 +312,8 @@
                 BluetoothCodecConfig.SOURCE_CODEC_TYPE_SBC, PRIORITY_HIGH,
                 true);
         testCodecPriorityChangeHelper(
-                BluetoothCodecConfig.SOURCE_CODEC_TYPE_LC3, PRIORITY_HIGH,
+                // TODO(b/240635097): update in U
+                SOURCE_CODEC_TYPE_OPUS, PRIORITY_HIGH,
                 BluetoothCodecConfig.SOURCE_CODEC_TYPE_SBC, PRIORITY_HIGH,
                 true);
     }
@@ -330,7 +341,8 @@
                 BluetoothCodecConfig.SOURCE_CODEC_TYPE_AAC, PRIORITY_HIGH,
                 true);
         testCodecPriorityChangeHelper(
-                BluetoothCodecConfig.SOURCE_CODEC_TYPE_LC3, PRIORITY_HIGH,
+                // TODO(b/240635097): update in U
+                SOURCE_CODEC_TYPE_OPUS, PRIORITY_HIGH,
                 BluetoothCodecConfig.SOURCE_CODEC_TYPE_AAC, PRIORITY_HIGH,
                 true);
     }
diff --git a/android/app/tests/unit/src/com/android/bluetooth/a2dp/A2dpServiceBinderTest.java b/android/app/tests/unit/src/com/android/bluetooth/a2dp/A2dpServiceBinderTest.java
new file mode 100644
index 0000000..2af526a
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/a2dp/A2dpServiceBinderTest.java
@@ -0,0 +1,322 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.a2dp;
+
+import static android.bluetooth.BluetoothCodecConfig.SOURCE_CODEC_TYPE_INVALID;
+
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.doReturn;
+
+import android.bluetooth.BluetoothA2dp;
+import android.bluetooth.BluetoothAdapter;
+import android.bluetooth.BluetoothCodecConfig;
+import android.bluetooth.BluetoothCodecStatus;
+import android.bluetooth.BluetoothDevice;
+import android.bluetooth.BluetoothProfile;
+import android.bluetooth.BufferConstraints;
+import android.content.AttributionSource;
+
+import androidx.test.InstrumentationRegistry;
+
+import com.android.bluetooth.TestUtils;
+import com.android.bluetooth.x.com.android.modules.utils.SynchronousResultReceiver;
+
+import org.junit.After;
+import org.junit.Before;
+import org.junit.Test;
+import org.mockito.Mock;
+import org.mockito.MockitoAnnotations;
+
+import java.util.List;
+
+public class A2dpServiceBinderTest {
+    @Mock private A2dpService mService;
+
+    private A2dpService.BluetoothA2dpBinder mBinder;
+    private BluetoothAdapter mAdapter;
+
+    @Before
+    public void setUp() throws Exception {
+        MockitoAnnotations.initMocks(this);
+
+        mAdapter = BluetoothAdapter.getDefaultAdapter();
+        mBinder = new A2dpService.BluetoothA2dpBinder(mService);
+        doReturn(InstrumentationRegistry.getTargetContext().getPackageManager())
+                .when(mService).getPackageManager();
+    }
+
+    @After
+    public void cleaUp() {
+        mBinder.cleanup();
+    }
+
+    @Test
+    public void connect() {
+        BluetoothDevice device = TestUtils.getTestDevice(mAdapter, 0);
+        final SynchronousResultReceiver<Boolean> recv = SynchronousResultReceiver.get();
+
+        mBinder.connect(device, recv);
+        verify(mService).connect(device);
+    }
+
+    @Test
+    public void connectWithAttribution() {
+        BluetoothDevice device = TestUtils.getTestDevice(mAdapter, 0);
+        AttributionSource source = new AttributionSource.Builder(0).build();
+        final SynchronousResultReceiver<Boolean> recv = SynchronousResultReceiver.get();
+
+        mBinder.connectWithAttribution(device, source, recv);
+        verify(mService).connect(device);
+    }
+
+    @Test
+    public void disconnect() {
+        BluetoothDevice device = TestUtils.getTestDevice(mAdapter, 0);
+        final SynchronousResultReceiver<Boolean> recv = SynchronousResultReceiver.get();
+
+        mBinder.disconnect(device, recv);
+        verify(mService).disconnect(device);
+    }
+
+    @Test
+    public void disconnectWithAttribution() {
+        BluetoothDevice device = TestUtils.getTestDevice(mAdapter, 0);
+        AttributionSource source = new AttributionSource.Builder(0).build();
+        final SynchronousResultReceiver<Boolean> recv = SynchronousResultReceiver.get();
+
+        mBinder.disconnectWithAttribution(device, source, recv);
+        verify(mService).disconnect(device);
+    }
+
+    @Test
+    public void getConnectedDevices() {
+        final SynchronousResultReceiver<List<BluetoothDevice>> recv =
+                SynchronousResultReceiver.get();
+
+        mBinder.getConnectedDevices(recv);
+        verify(mService).getConnectedDevices();
+    }
+
+    @Test
+    public void getConnectedDevicesWithAttribution() {
+        AttributionSource source = new AttributionSource.Builder(0).build();
+        final SynchronousResultReceiver<List<BluetoothDevice>> recv =
+                SynchronousResultReceiver.get();
+
+        mBinder.getConnectedDevicesWithAttribution(source, recv);
+        verify(mService).getConnectedDevices();
+    }
+
+    @Test
+    public void getDevicesMatchingConnectionStates() {
+        int[] states = new int[] {BluetoothProfile.STATE_CONNECTED };
+        final SynchronousResultReceiver<List<BluetoothDevice>> recv =
+                SynchronousResultReceiver.get();
+
+        mBinder.getDevicesMatchingConnectionStates(states, recv);
+        verify(mService).getDevicesMatchingConnectionStates(states);
+    }
+
+    @Test
+    public void getDevicesMatchingConnectionStatesWithAttribution() {
+        int[] states = new int[] {BluetoothProfile.STATE_CONNECTED };
+        AttributionSource source = new AttributionSource.Builder(0).build();
+        final SynchronousResultReceiver<List<BluetoothDevice>> recv =
+                SynchronousResultReceiver.get();
+
+        mBinder.getDevicesMatchingConnectionStatesWithAttribution(states, source, recv);
+        verify(mService).getDevicesMatchingConnectionStates(states);
+    }
+
+    @Test
+    public void getConnectionState() {
+        BluetoothDevice device = TestUtils.getTestDevice(mAdapter, 0);
+        final SynchronousResultReceiver<List<BluetoothDevice>> recv =
+                SynchronousResultReceiver.get();
+
+        mBinder.getConnectionState(device, recv);
+        verify(mService).getConnectionState(device);
+    }
+
+    @Test
+    public void getConnectionStateWithAttribution() {
+        BluetoothDevice device = TestUtils.getTestDevice(mAdapter, 0);
+        AttributionSource source = new AttributionSource.Builder(0).build();
+        final SynchronousResultReceiver<List<BluetoothDevice>> recv =
+                SynchronousResultReceiver.get();
+
+        mBinder.getConnectionStateWithAttribution(device, source, recv);
+        verify(mService).getConnectionState(device);
+    }
+
+    @Test
+    public void setActiveDevice() {
+        BluetoothDevice device = TestUtils.getTestDevice(mAdapter, 0);
+        AttributionSource source = new AttributionSource.Builder(0).build();
+        final SynchronousResultReceiver<Boolean> recv = SynchronousResultReceiver.get();
+
+        mBinder.setActiveDevice(device, source, recv);
+        verify(mService).setActiveDevice(device);
+    }
+
+    @Test
+    public void getActiveDevice() {
+        AttributionSource source = new AttributionSource.Builder(0).build();
+        final SynchronousResultReceiver<BluetoothDevice> recv = SynchronousResultReceiver.get();
+
+        mBinder.getActiveDevice(source, recv);
+        verify(mService).getActiveDevice();
+    }
+
+    @Test
+    public void setConnectionPolicy() {
+        BluetoothDevice device = TestUtils.getTestDevice(mAdapter, 0);
+        int connectionPolicy = BluetoothProfile.CONNECTION_POLICY_ALLOWED;
+        AttributionSource source = new AttributionSource.Builder(0).build();
+        final SynchronousResultReceiver<Boolean> recv = SynchronousResultReceiver.get();
+
+        mBinder.setConnectionPolicy(device, connectionPolicy, source, recv);
+        verify(mService).setConnectionPolicy(device, connectionPolicy);
+    }
+
+    @Test
+    public void getConnectionPolicy() {
+        BluetoothDevice device = TestUtils.getTestDevice(mAdapter, 0);
+        AttributionSource source = new AttributionSource.Builder(0).build();
+        final SynchronousResultReceiver<Integer> recv = SynchronousResultReceiver.get();
+
+        mBinder.getConnectionPolicy(device, source, recv);
+        verify(mService).getConnectionPolicy(device);
+    }
+
+    @Test
+    public void setAvrcpAbsoluteVolume() {
+        int volume = 3;
+        AttributionSource source = new AttributionSource.Builder(0).build();
+
+        mBinder.setAvrcpAbsoluteVolume(volume, source);
+        verify(mService).setAvrcpAbsoluteVolume(volume);
+    }
+
+    @Test
+    public void isA2dpPlaying() {
+        BluetoothDevice device = TestUtils.getTestDevice(mAdapter, 0);
+        AttributionSource source = new AttributionSource.Builder(0).build();
+        final SynchronousResultReceiver<Boolean> recv = SynchronousResultReceiver.get();
+
+        mBinder.isA2dpPlaying(device, source, recv);
+        verify(mService).isA2dpPlaying(device);
+    }
+
+    @Test
+    public void getCodecStatus() {
+        BluetoothDevice device = TestUtils.getTestDevice(mAdapter, 0);
+        AttributionSource source = new AttributionSource.Builder(0).build();
+        final SynchronousResultReceiver<BluetoothCodecStatus> recv =
+                SynchronousResultReceiver.get();
+
+        mBinder.getCodecStatus(device, source, recv);
+        verify(mService).getCodecStatus(device);
+    }
+
+    @Test
+    public void setCodecConfigPreference() {
+        BluetoothDevice device = TestUtils.getTestDevice(mAdapter, 0);
+        BluetoothCodecConfig config = new BluetoothCodecConfig(SOURCE_CODEC_TYPE_INVALID);
+        AttributionSource source = new AttributionSource.Builder(0).build();
+
+        mBinder.setCodecConfigPreference(device, config, source);
+        verify(mService).setCodecConfigPreference(device, config);
+    }
+
+    @Test
+    public void enableOptionalCodecs() {
+        BluetoothDevice device = TestUtils.getTestDevice(mAdapter, 0);
+        AttributionSource source = new AttributionSource.Builder(0).build();
+
+        mBinder.enableOptionalCodecs(device, source);
+        verify(mService).enableOptionalCodecs(device);
+    }
+
+    @Test
+    public void disableOptionalCodecs() {
+        BluetoothDevice device = TestUtils.getTestDevice(mAdapter, 0);
+        AttributionSource source = new AttributionSource.Builder(0).build();
+
+        mBinder.disableOptionalCodecs(device, source);
+        verify(mService).disableOptionalCodecs(device);
+    }
+
+    @Test
+    public void isOptionalCodecsSupported() {
+        BluetoothDevice device = TestUtils.getTestDevice(mAdapter, 0);
+        AttributionSource source = new AttributionSource.Builder(0).build();
+        final SynchronousResultReceiver<Integer> recv = SynchronousResultReceiver.get();
+
+        mBinder.isOptionalCodecsSupported(device, source, recv);
+        verify(mService).getSupportsOptionalCodecs(device);
+    }
+
+    @Test
+    public void isOptionalCodecsEnabled() {
+        BluetoothDevice device = TestUtils.getTestDevice(mAdapter, 0);
+        AttributionSource source = new AttributionSource.Builder(0).build();
+        final SynchronousResultReceiver<Integer> recv = SynchronousResultReceiver.get();
+
+        mBinder.isOptionalCodecsEnabled(device, source, recv);
+        verify(mService).getOptionalCodecsEnabled(device);
+    }
+
+    @Test
+    public void setOptionalCodecsEnabled() {
+        BluetoothDevice device = TestUtils.getTestDevice(mAdapter, 0);
+        int value = BluetoothA2dp.OPTIONAL_CODECS_PREF_UNKNOWN;
+        AttributionSource source = new AttributionSource.Builder(0).build();
+
+        mBinder.setOptionalCodecsEnabled(device, value, source);
+        verify(mService).setOptionalCodecsEnabled(device, value);
+    }
+
+    @Test
+    public void getDynamicBufferSupport() {
+        AttributionSource source = new AttributionSource.Builder(0).build();
+        final SynchronousResultReceiver<Integer> recv = SynchronousResultReceiver.get();
+
+        mBinder.getDynamicBufferSupport(source, recv);
+        verify(mService).getDynamicBufferSupport();
+    }
+
+    @Test
+    public void getBufferConstraints() {
+        AttributionSource source = new AttributionSource.Builder(0).build();
+        final SynchronousResultReceiver<BufferConstraints> recv = SynchronousResultReceiver.get();
+
+        mBinder.getBufferConstraints(source, recv);
+        verify(mService).getBufferConstraints();
+    }
+
+    @Test
+    public void setBufferLengthMillis() {
+        int codec = 0;
+        int value = BluetoothA2dp.OPTIONAL_CODECS_PREF_UNKNOWN;
+        AttributionSource source = new AttributionSource.Builder(0).build();
+        final SynchronousResultReceiver<Boolean> recv = SynchronousResultReceiver.get();
+
+        mBinder.setBufferLengthMillis(codec, value, source, recv);
+        verify(mService).setBufferLengthMillis(codec, value);
+    }
+}
diff --git a/android/app/tests/unit/src/com/android/bluetooth/a2dp/A2dpServiceTest.java b/android/app/tests/unit/src/com/android/bluetooth/a2dp/A2dpServiceTest.java
index 416661d..1d216f7 100644
--- a/android/app/tests/unit/src/com/android/bluetooth/a2dp/A2dpServiceTest.java
+++ b/android/app/tests/unit/src/com/android/bluetooth/a2dp/A2dpServiceTest.java
@@ -91,6 +91,7 @@
         }
 
         TestUtils.setAdapterService(mAdapterService);
+        doReturn(true).when(mAdapterService).isA2dpOffloadEnabled();
         doReturn(MAX_CONNECTED_AUDIO_DEVICES).when(mAdapterService).getMaxConnectedAudioDevices();
         doReturn(true, false).when(mAdapterService).isStartedProfile(anyString());
         doReturn(false).when(mAdapterService).isQuietModeEnabled();
@@ -865,6 +866,11 @@
                 verifySupportTime, verifyNotSupportTime, verifyEnabledTime);
     }
 
+    @Test
+    public void testDumpDoesNotCrash() {
+        mA2dpService.dump(new StringBuilder());
+    }
+
     private void connectDevice(BluetoothDevice device) {
         connectDeviceWithCodecStatus(device, null);
     }
diff --git a/android/app/tests/unit/src/com/android/bluetooth/a2dp/A2dpStateMachineTest.java b/android/app/tests/unit/src/com/android/bluetooth/a2dp/A2dpStateMachineTest.java
index f2a81dd..d4fe9ed 100644
--- a/android/app/tests/unit/src/com/android/bluetooth/a2dp/A2dpStateMachineTest.java
+++ b/android/app/tests/unit/src/com/android/bluetooth/a2dp/A2dpStateMachineTest.java
@@ -53,6 +53,9 @@
 @MediumTest
 @RunWith(AndroidJUnit4.class)
 public class A2dpStateMachineTest {
+    // TODO(b/240635097): remove in U
+    private static final int SOURCE_CODEC_TYPE_OPUS = 6;
+
     private BluetoothAdapter mAdapter;
     private Context mTargetContext;
     private HandlerThread mHandlerThread;
@@ -62,6 +65,7 @@
 
     private BluetoothCodecConfig mCodecConfigSbc;
     private BluetoothCodecConfig mCodecConfigAac;
+    private BluetoothCodecConfig mCodecConfigOpus;
 
     @Mock private AdapterService mAdapterService;
     @Mock private A2dpService mA2dpService;
@@ -103,6 +107,18 @@
                     .setCodecSpecific4(0)
                     .build();
 
+        mCodecConfigOpus = new BluetoothCodecConfig.Builder()
+                    .setCodecType(SOURCE_CODEC_TYPE_OPUS) // TODO(b/240635097): update in U
+                    .setCodecPriority(BluetoothCodecConfig.CODEC_PRIORITY_DEFAULT)
+                    .setSampleRate(BluetoothCodecConfig.SAMPLE_RATE_48000)
+                    .setBitsPerSample(BluetoothCodecConfig.BITS_PER_SAMPLE_16)
+                    .setChannelMode(BluetoothCodecConfig.CHANNEL_MODE_STEREO)
+                    .setCodecSpecific1(0)
+                    .setCodecSpecific2(0)
+                    .setCodecSpecific3(0)
+                    .setCodecSpecific4(0)
+                    .build();
+
         // Set up thread and looper
         mHandlerThread = new HandlerThread("A2dpStateMachineTestHandlerThread");
         mHandlerThread.start();
@@ -326,17 +342,27 @@
         codecsSelectableSbcAac[0] = mCodecConfigSbc;
         codecsSelectableSbcAac[1] = mCodecConfigAac;
 
+        BluetoothCodecConfig[] codecsSelectableSbcAacOpus;
+        codecsSelectableSbcAacOpus = new BluetoothCodecConfig[3];
+        codecsSelectableSbcAacOpus[0] = mCodecConfigSbc;
+        codecsSelectableSbcAacOpus[1] = mCodecConfigAac;
+        codecsSelectableSbcAacOpus[2] = mCodecConfigOpus;
+
         BluetoothCodecStatus codecStatusSbcAndSbc = new BluetoothCodecStatus(mCodecConfigSbc,
                 Arrays.asList(codecsSelectableSbcAac), Arrays.asList(codecsSelectableSbc));
         BluetoothCodecStatus codecStatusSbcAndSbcAac = new BluetoothCodecStatus(mCodecConfigSbc,
                 Arrays.asList(codecsSelectableSbcAac), Arrays.asList(codecsSelectableSbcAac));
         BluetoothCodecStatus codecStatusAacAndSbcAac = new BluetoothCodecStatus(mCodecConfigAac,
                 Arrays.asList(codecsSelectableSbcAac), Arrays.asList(codecsSelectableSbcAac));
+        BluetoothCodecStatus codecStatusOpusAndSbcAacOpus = new BluetoothCodecStatus(
+                mCodecConfigOpus, Arrays.asList(codecsSelectableSbcAacOpus),
+                Arrays.asList(codecsSelectableSbcAacOpus));
 
         // Set default codec status when device disconnected
         // Selected codec = SBC, selectable codec = SBC
         mA2dpStateMachine.processCodecConfigEvent(codecStatusSbcAndSbc);
         verify(mA2dpService).codecConfigUpdated(mTestDevice, codecStatusSbcAndSbc, false);
+        verify(mA2dpService, times(1)).updateLowLatencyAudioSupport(mTestDevice);
 
         // Inject an event to change state machine to connected state
         A2dpStackEvent connStCh =
@@ -354,6 +380,7 @@
 
         // Verify that state machine update optional codec when enter connected state
         verify(mA2dpService, times(1)).updateOptionalCodecsSupport(mTestDevice);
+        verify(mA2dpService, times(2)).updateLowLatencyAudioSupport(mTestDevice);
 
         // Change codec status when device connected.
         // Selected codec = SBC, selectable codec = SBC+AAC
@@ -362,11 +389,50 @@
             verify(mA2dpService).codecConfigUpdated(mTestDevice, codecStatusSbcAndSbcAac, true);
         }
         verify(mA2dpService, times(2)).updateOptionalCodecsSupport(mTestDevice);
+        verify(mA2dpService, times(3)).updateLowLatencyAudioSupport(mTestDevice);
 
         // Update selected codec with selectable codec unchanged.
         // Selected codec = AAC, selectable codec = SBC+AAC
         mA2dpStateMachine.processCodecConfigEvent(codecStatusAacAndSbcAac);
         verify(mA2dpService).codecConfigUpdated(mTestDevice, codecStatusAacAndSbcAac, false);
         verify(mA2dpService, times(2)).updateOptionalCodecsSupport(mTestDevice);
+        verify(mA2dpService, times(4)).updateLowLatencyAudioSupport(mTestDevice);
+
+        // Update selected codec
+        // Selected codec = OPUS, selectable codec = SBC+AAC+OPUS
+        mA2dpStateMachine.processCodecConfigEvent(codecStatusOpusAndSbcAacOpus);
+        if (!offloadEnabled) {
+            verify(mA2dpService).codecConfigUpdated(mTestDevice, codecStatusOpusAndSbcAacOpus, true);
+        }
+        verify(mA2dpService, times(3)).updateOptionalCodecsSupport(mTestDevice);
+        // Check if low latency audio been updated.
+        verify(mA2dpService, times(5)).updateLowLatencyAudioSupport(mTestDevice);
+
+        // Update selected codec with selectable codec changed.
+        // Selected codec = SBC, selectable codec = SBC+AAC
+        mA2dpStateMachine.processCodecConfigEvent(codecStatusSbcAndSbcAac);
+        if (!offloadEnabled) {
+            verify(mA2dpService).codecConfigUpdated(mTestDevice, codecStatusSbcAndSbcAac, true);
+        }
+        // Check if low latency audio been update.
+        verify(mA2dpService, times(6)).updateLowLatencyAudioSupport(mTestDevice);
+    }
+
+    @Test
+    public void dump_doesNotCrash() {
+        BluetoothCodecConfig[] codecsSelectableSbc;
+        codecsSelectableSbc = new BluetoothCodecConfig[1];
+        codecsSelectableSbc[0] = mCodecConfigSbc;
+
+        BluetoothCodecConfig[] codecsSelectableSbcAac;
+        codecsSelectableSbcAac = new BluetoothCodecConfig[2];
+        codecsSelectableSbcAac[0] = mCodecConfigSbc;
+        codecsSelectableSbcAac[1] = mCodecConfigAac;
+
+        BluetoothCodecStatus codecStatusSbcAndSbc = new BluetoothCodecStatus(mCodecConfigSbc,
+                Arrays.asList(codecsSelectableSbcAac), Arrays.asList(codecsSelectableSbc));
+        mA2dpStateMachine.processCodecConfigEvent(codecStatusSbcAndSbc);
+
+        mA2dpStateMachine.dump(new StringBuilder());
     }
 }
diff --git a/android/app/tests/unit/src/com/android/bluetooth/a2dpsink/A2dpSinkServiceBinderTest.java b/android/app/tests/unit/src/com/android/bluetooth/a2dpsink/A2dpSinkServiceBinderTest.java
new file mode 100644
index 0000000..30dfc2a
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/a2dpsink/A2dpSinkServiceBinderTest.java
@@ -0,0 +1,148 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.a2dpsink;
+
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.doReturn;
+
+import android.bluetooth.BluetoothAdapter;
+import android.bluetooth.BluetoothAudioConfig;
+import android.bluetooth.BluetoothDevice;
+import android.bluetooth.BluetoothProfile;
+import android.content.AttributionSource;
+
+import com.android.bluetooth.TestUtils;
+import com.android.bluetooth.x.com.android.modules.utils.SynchronousResultReceiver;
+
+import org.junit.After;
+import org.junit.Before;
+import org.junit.Test;
+import org.mockito.Mock;
+import org.mockito.MockitoAnnotations;
+
+import java.util.List;
+
+public class A2dpSinkServiceBinderTest {
+    @Mock private A2dpSinkService mService;
+    private A2dpSinkService.A2dpSinkServiceBinder mBinder;
+    private BluetoothAdapter mAdapter;
+
+    @Before
+    public void setUp() throws Exception {
+        MockitoAnnotations.initMocks(this);
+        mAdapter = BluetoothAdapter.getDefaultAdapter();
+        mBinder = new A2dpSinkService.A2dpSinkServiceBinder(mService);
+    }
+
+    @After
+    public void cleaUp() {
+        mBinder.cleanup();
+    }
+
+    @Test
+    public void connect() {
+        BluetoothDevice device = TestUtils.getTestDevice(mAdapter, 0);
+        AttributionSource source = new AttributionSource.Builder(0).build();
+        final SynchronousResultReceiver<Boolean> recv = SynchronousResultReceiver.get();
+
+        mBinder.connect(device, source, recv);
+        verify(mService).connect(device);
+    }
+
+    @Test
+    public void disconnect() {
+        BluetoothDevice device = TestUtils.getTestDevice(mAdapter, 0);
+        AttributionSource source = new AttributionSource.Builder(0).build();
+        final SynchronousResultReceiver<Boolean> recv = SynchronousResultReceiver.get();
+
+        mBinder.disconnect(device, source, recv);
+        verify(mService).disconnect(device);
+    }
+
+    @Test
+    public void getConnectedDevices() {
+        AttributionSource source = new AttributionSource.Builder(0).build();
+        final SynchronousResultReceiver<List<BluetoothDevice>> recv =
+                SynchronousResultReceiver.get();
+        mBinder.getConnectedDevices(source, recv);
+        verify(mService).getConnectedDevices();
+    }
+
+    @Test
+    public void getDevicesMatchingConnectionStates() {
+        int[] states = new int[] {BluetoothProfile.STATE_CONNECTED };
+        AttributionSource source = new AttributionSource.Builder(0).build();
+        final SynchronousResultReceiver<List<BluetoothDevice>> recv =
+                SynchronousResultReceiver.get();
+
+        mBinder.getDevicesMatchingConnectionStates(states, source, recv);
+        verify(mService).getDevicesMatchingConnectionStates(states);
+    }
+
+    @Test
+    public void getConnectionState() {
+        BluetoothDevice device = TestUtils.getTestDevice(mAdapter, 0);
+        AttributionSource source = new AttributionSource.Builder(0).build();
+        final SynchronousResultReceiver<List<BluetoothDevice>> recv =
+                SynchronousResultReceiver.get();
+
+        mBinder.getConnectionState(device, source, recv);
+        verify(mService).getConnectionState(device);
+    }
+
+    @Test
+    public void setConnectionPolicy() {
+        BluetoothDevice device = TestUtils.getTestDevice(mAdapter, 0);
+        int connectionPolicy = BluetoothProfile.CONNECTION_POLICY_ALLOWED;
+        AttributionSource source = new AttributionSource.Builder(0).build();
+        final SynchronousResultReceiver<Boolean> recv = SynchronousResultReceiver.get();
+
+        mBinder.setConnectionPolicy(device, connectionPolicy, source, recv);
+        verify(mService).setConnectionPolicy(device, connectionPolicy);
+    }
+
+    @Test
+    public void getConnectionPolicy() {
+        BluetoothDevice device = TestUtils.getTestDevice(mAdapter, 0);
+        AttributionSource source = new AttributionSource.Builder(0).build();
+        final SynchronousResultReceiver<Integer> recv = SynchronousResultReceiver.get();
+
+        mBinder.getConnectionPolicy(device, source, recv);
+        verify(mService).getConnectionPolicy(device);
+    }
+
+    @Test
+    public void isA2dpPlaying() {
+        BluetoothDevice device = TestUtils.getTestDevice(mAdapter, 0);
+        AttributionSource source = new AttributionSource.Builder(0).build();
+        final SynchronousResultReceiver<Boolean> recv = SynchronousResultReceiver.get();
+
+        mBinder.isA2dpPlaying(device, source, recv);
+        verify(mService).isA2dpPlaying(device);
+    }
+
+    @Test
+    public void getAudioConfig() {
+        BluetoothDevice device = TestUtils.getTestDevice(mAdapter, 0);
+        AttributionSource source = new AttributionSource.Builder(0).build();
+        final SynchronousResultReceiver<BluetoothAudioConfig> recv =
+                SynchronousResultReceiver.get();
+
+        mBinder.getAudioConfig(device, source, recv);
+        verify(mService).getAudioConfig(device);
+    }
+}
diff --git a/android/app/tests/unit/src/com/android/bluetooth/a2dpsink/A2dpSinkServiceTest.java b/android/app/tests/unit/src/com/android/bluetooth/a2dpsink/A2dpSinkServiceTest.java
index 42b5ff7..1f63faa 100644
--- a/android/app/tests/unit/src/com/android/bluetooth/a2dpsink/A2dpSinkServiceTest.java
+++ b/android/app/tests/unit/src/com/android/bluetooth/a2dpsink/A2dpSinkServiceTest.java
@@ -464,4 +464,12 @@
         assertThat(mService.setConnectionPolicy(mDevice1,
                 BluetoothProfile.CONNECTION_POLICY_ALLOWED)).isFalse();
     }
+
+    @Test
+    public void testDumpDoesNotCrash() {
+        mockDevicePriority(mDevice1, BluetoothProfile.CONNECTION_POLICY_ALLOWED);
+        setupDeviceConnection(mDevice1);
+
+        mService.dump(new StringBuilder());
+    }
 }
diff --git a/android/app/tests/unit/src/com/android/bluetooth/audio_util/AvrcpPassthroughTest.java b/android/app/tests/unit/src/com/android/bluetooth/audio_util/AvrcpPassthroughTest.java
new file mode 100644
index 0000000..5160e19
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/audio_util/AvrcpPassthroughTest.java
@@ -0,0 +1,131 @@
+package com.android.bluetooth.audio_util;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import android.bluetooth.BluetoothAvrcp;
+import android.view.KeyEvent;
+
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.junit.runners.JUnit4;
+
+@RunWith(JUnit4.class)
+public final class AvrcpPassthroughTest {
+
+  @Test
+  public void toKeyCode() {
+    AvrcpPassthrough ap = new AvrcpPassthrough();
+    assertThat(ap.toKeyCode(BluetoothAvrcp.PASSTHROUGH_ID_UP))
+            .isEqualTo(KeyEvent.KEYCODE_DPAD_UP);
+    assertThat(ap.toKeyCode(BluetoothAvrcp.PASSTHROUGH_ID_DOWN))
+            .isEqualTo(KeyEvent.KEYCODE_DPAD_DOWN);
+    assertThat(ap.toKeyCode(BluetoothAvrcp.PASSTHROUGH_ID_LEFT))
+            .isEqualTo(KeyEvent.KEYCODE_DPAD_LEFT);
+    assertThat(ap.toKeyCode(BluetoothAvrcp.PASSTHROUGH_ID_RIGHT))
+            .isEqualTo(KeyEvent.KEYCODE_DPAD_RIGHT);
+    assertThat(ap.toKeyCode(BluetoothAvrcp.PASSTHROUGH_ID_RIGHT_UP))
+            .isEqualTo(KeyEvent.KEYCODE_DPAD_UP_RIGHT);
+    assertThat(ap.toKeyCode(BluetoothAvrcp.PASSTHROUGH_ID_RIGHT_DOWN))
+            .isEqualTo(KeyEvent.KEYCODE_DPAD_DOWN_RIGHT);
+    assertThat(ap.toKeyCode(BluetoothAvrcp.PASSTHROUGH_ID_LEFT_UP))
+            .isEqualTo(KeyEvent.KEYCODE_DPAD_UP_LEFT);
+    assertThat(ap.toKeyCode(BluetoothAvrcp.PASSTHROUGH_ID_LEFT_DOWN))
+            .isEqualTo(KeyEvent.KEYCODE_DPAD_DOWN_LEFT);
+    assertThat(ap.toKeyCode(BluetoothAvrcp.PASSTHROUGH_ID_0))
+            .isEqualTo(KeyEvent.KEYCODE_NUMPAD_0);
+    assertThat(ap.toKeyCode(BluetoothAvrcp.PASSTHROUGH_ID_1))
+            .isEqualTo(KeyEvent.KEYCODE_NUMPAD_1);
+    assertThat(ap.toKeyCode(BluetoothAvrcp.PASSTHROUGH_ID_2))
+            .isEqualTo(KeyEvent.KEYCODE_NUMPAD_2);
+    assertThat(ap.toKeyCode(BluetoothAvrcp.PASSTHROUGH_ID_3))
+            .isEqualTo(KeyEvent.KEYCODE_NUMPAD_3);
+    assertThat(ap.toKeyCode(BluetoothAvrcp.PASSTHROUGH_ID_4))
+            .isEqualTo(KeyEvent.KEYCODE_NUMPAD_4);
+    assertThat(ap.toKeyCode(BluetoothAvrcp.PASSTHROUGH_ID_5))
+            .isEqualTo(KeyEvent.KEYCODE_NUMPAD_5);
+    assertThat(ap.toKeyCode(BluetoothAvrcp.PASSTHROUGH_ID_6))
+            .isEqualTo(KeyEvent.KEYCODE_NUMPAD_6);
+    assertThat(ap.toKeyCode(BluetoothAvrcp.PASSTHROUGH_ID_7))
+            .isEqualTo(KeyEvent.KEYCODE_NUMPAD_7);
+    assertThat(ap.toKeyCode(BluetoothAvrcp.PASSTHROUGH_ID_8))
+            .isEqualTo(KeyEvent.KEYCODE_NUMPAD_8);
+    assertThat(ap.toKeyCode(BluetoothAvrcp.PASSTHROUGH_ID_9))
+            .isEqualTo(KeyEvent.KEYCODE_NUMPAD_9);
+    assertThat(ap.toKeyCode(BluetoothAvrcp.PASSTHROUGH_ID_DOT))
+            .isEqualTo(KeyEvent.KEYCODE_NUMPAD_DOT);
+    assertThat(ap.toKeyCode(BluetoothAvrcp.PASSTHROUGH_ID_ENTER))
+            .isEqualTo(KeyEvent.KEYCODE_NUMPAD_ENTER);
+    assertThat(ap.toKeyCode(BluetoothAvrcp.PASSTHROUGH_ID_CLEAR))
+            .isEqualTo(KeyEvent.KEYCODE_CLEAR);
+    assertThat(ap.toKeyCode(BluetoothAvrcp.PASSTHROUGH_ID_CHAN_DOWN))
+            .isEqualTo(KeyEvent.KEYCODE_CHANNEL_DOWN);
+    assertThat(ap.toKeyCode(BluetoothAvrcp.PASSTHROUGH_ID_PREV_CHAN))
+            .isEqualTo(KeyEvent.KEYCODE_LAST_CHANNEL);
+    assertThat(ap.toKeyCode(BluetoothAvrcp.PASSTHROUGH_ID_INPUT_SEL))
+            .isEqualTo(KeyEvent.KEYCODE_TV_INPUT);
+    assertThat(ap.toKeyCode(BluetoothAvrcp.PASSTHROUGH_ID_DISP_INFO))
+            .isEqualTo(KeyEvent.KEYCODE_INFO);
+    assertThat(ap.toKeyCode(BluetoothAvrcp.PASSTHROUGH_ID_HELP))
+            .isEqualTo(KeyEvent.KEYCODE_HELP);
+    assertThat(ap.toKeyCode(BluetoothAvrcp.PASSTHROUGH_ID_PAGE_UP))
+            .isEqualTo(KeyEvent.KEYCODE_PAGE_UP);
+    assertThat(ap.toKeyCode(BluetoothAvrcp.PASSTHROUGH_ID_PAGE_DOWN))
+            .isEqualTo(KeyEvent.KEYCODE_PAGE_DOWN);
+    assertThat(ap.toKeyCode(BluetoothAvrcp.PASSTHROUGH_ID_POWER))
+            .isEqualTo(KeyEvent.KEYCODE_POWER);
+    assertThat(ap.toKeyCode(BluetoothAvrcp.PASSTHROUGH_ID_VOL_UP))
+            .isEqualTo(KeyEvent.KEYCODE_VOLUME_UP);
+    assertThat(ap.toKeyCode(BluetoothAvrcp.PASSTHROUGH_ID_VOL_DOWN))
+            .isEqualTo(KeyEvent.KEYCODE_VOLUME_DOWN);
+    assertThat(ap.toKeyCode(BluetoothAvrcp.PASSTHROUGH_ID_MUTE))
+            .isEqualTo(KeyEvent.KEYCODE_MUTE);
+    assertThat(ap.toKeyCode(BluetoothAvrcp.PASSTHROUGH_ID_PLAY))
+            .isEqualTo(KeyEvent.KEYCODE_MEDIA_PLAY);
+    assertThat(ap.toKeyCode(BluetoothAvrcp.PASSTHROUGH_ID_STOP))
+            .isEqualTo(KeyEvent.KEYCODE_MEDIA_STOP);
+    assertThat(ap.toKeyCode(BluetoothAvrcp.PASSTHROUGH_ID_PAUSE))
+            .isEqualTo(KeyEvent.KEYCODE_MEDIA_PAUSE);
+    assertThat(ap.toKeyCode(BluetoothAvrcp.PASSTHROUGH_ID_RECORD))
+            .isEqualTo(KeyEvent.KEYCODE_MEDIA_RECORD);
+    assertThat(ap.toKeyCode(BluetoothAvrcp.PASSTHROUGH_ID_REWIND))
+            .isEqualTo(KeyEvent.KEYCODE_MEDIA_REWIND);
+    assertThat(ap.toKeyCode(BluetoothAvrcp.PASSTHROUGH_ID_FAST_FOR))
+            .isEqualTo(KeyEvent.KEYCODE_MEDIA_FAST_FORWARD);
+    assertThat(ap.toKeyCode(BluetoothAvrcp.PASSTHROUGH_ID_EJECT))
+            .isEqualTo(KeyEvent.KEYCODE_MEDIA_EJECT);
+    assertThat(ap.toKeyCode(BluetoothAvrcp.PASSTHROUGH_ID_FORWARD))
+            .isEqualTo(KeyEvent.KEYCODE_MEDIA_NEXT);
+    assertThat(ap.toKeyCode(BluetoothAvrcp.PASSTHROUGH_ID_BACKWARD))
+            .isEqualTo(KeyEvent.KEYCODE_MEDIA_PREVIOUS);
+    assertThat(ap.toKeyCode(BluetoothAvrcp.PASSTHROUGH_ID_F1))
+            .isEqualTo(KeyEvent.KEYCODE_F1);
+    assertThat(ap.toKeyCode(BluetoothAvrcp.PASSTHROUGH_ID_F2))
+            .isEqualTo(KeyEvent.KEYCODE_F2);
+    assertThat(ap.toKeyCode(BluetoothAvrcp.PASSTHROUGH_ID_F3))
+            .isEqualTo(KeyEvent.KEYCODE_F3);
+    assertThat(ap.toKeyCode(BluetoothAvrcp.PASSTHROUGH_ID_F4))
+            .isEqualTo(KeyEvent.KEYCODE_F4);
+    assertThat(ap.toKeyCode(BluetoothAvrcp.PASSTHROUGH_ID_F5))
+            .isEqualTo(KeyEvent.KEYCODE_F5);
+    assertThat(ap.toKeyCode(BluetoothAvrcp.PASSTHROUGH_ID_SELECT))
+            .isEqualTo(KeyEvent.KEYCODE_UNKNOWN);
+    assertThat(ap.toKeyCode(BluetoothAvrcp.PASSTHROUGH_ID_ROOT_MENU))
+            .isEqualTo(KeyEvent.KEYCODE_UNKNOWN);
+    assertThat(ap.toKeyCode(BluetoothAvrcp.PASSTHROUGH_ID_SETUP_MENU))
+            .isEqualTo(KeyEvent.KEYCODE_UNKNOWN);
+    assertThat(ap.toKeyCode(BluetoothAvrcp.PASSTHROUGH_ID_CONT_MENU))
+            .isEqualTo(KeyEvent.KEYCODE_UNKNOWN);
+    assertThat(ap.toKeyCode(BluetoothAvrcp.PASSTHROUGH_ID_FAV_MENU))
+            .isEqualTo(KeyEvent.KEYCODE_UNKNOWN);
+    assertThat(ap.toKeyCode(BluetoothAvrcp.PASSTHROUGH_ID_EXIT))
+            .isEqualTo(KeyEvent.KEYCODE_UNKNOWN);
+    assertThat(ap.toKeyCode(BluetoothAvrcp.PASSTHROUGH_ID_SOUND_SEL))
+            .isEqualTo(KeyEvent.KEYCODE_UNKNOWN);
+    assertThat(ap.toKeyCode(BluetoothAvrcp.PASSTHROUGH_ID_ANGLE))
+            .isEqualTo(KeyEvent.KEYCODE_UNKNOWN);
+    assertThat(ap.toKeyCode(BluetoothAvrcp.PASSTHROUGH_ID_SUBPICT))
+            .isEqualTo(KeyEvent.KEYCODE_UNKNOWN);
+    assertThat(ap.toKeyCode(BluetoothAvrcp.PASSTHROUGH_ID_VENDOR))
+            .isEqualTo(KeyEvent.KEYCODE_UNKNOWN);
+  }
+}
diff --git a/android/app/tests/unit/src/com/android/bluetooth/audio_util/GPMWrapperTest.java b/android/app/tests/unit/src/com/android/bluetooth/audio_util/GPMWrapperTest.java
new file mode 100644
index 0000000..7f03b37
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/audio_util/GPMWrapperTest.java
@@ -0,0 +1,116 @@
+/*
+ * Copyright 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package com.android.bluetooth.audio_util;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;
+
+import android.content.Context;
+import android.media.MediaDescription;
+import android.media.MediaMetadata;
+import android.media.session.MediaSession;
+import android.media.session.PlaybackState;
+
+import androidx.test.InstrumentationRegistry;
+import androidx.test.filters.SmallTest;
+import androidx.test.runner.AndroidJUnit4;
+
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+import java.util.ArrayList;
+import java.util.List;
+
+@SmallTest
+@RunWith(AndroidJUnit4.class)
+public class GPMWrapperTest {
+
+    private Context mContext;
+    private MediaController mMediaController;
+
+    @Before
+    public void setUp() throws Exception {
+        mContext = InstrumentationRegistry.getTargetContext();
+        mMediaController = mock(MediaController.class);
+    }
+
+    @Test
+    public void isMetadataSynced_whenQueueIsNull_returnsFalse() {
+        when(mMediaController.getQueue()).thenReturn(null);
+
+        GPMWrapper wrapper = new GPMWrapper(mContext, mMediaController, null);
+
+        assertThat(wrapper.isMetadataSynced()).isFalse();
+    }
+
+    @Test
+    public void isMetadataSynced_whenOutOfSync_returnsFalse() {
+        long activeQueueItemId = 3;
+        PlaybackState state = new PlaybackState.Builder()
+                .setActiveQueueItemId(activeQueueItemId).build();
+        when(mMediaController.getPlaybackState()).thenReturn(state);
+
+        List<MediaSession.QueueItem> queue = new ArrayList<>();
+        MediaDescription description = new MediaDescription.Builder()
+                .setTitle("Title from queue item")
+                .build();
+        MediaSession.QueueItem queueItem = new MediaSession.QueueItem(
+                description, activeQueueItemId);
+        queue.add(queueItem);
+        when(mMediaController.getQueue()).thenReturn(queue);
+
+        MediaMetadata metadata = new MediaMetadata.Builder()
+                .putString(MediaMetadata.METADATA_KEY_TITLE,
+                        "Different Title from MediaMetadata")
+                .build();
+        when(mMediaController.getMetadata()).thenReturn(metadata);
+
+        GPMWrapper wrapper = new GPMWrapper(mContext, mMediaController, null);
+
+        assertThat(wrapper.isMetadataSynced()).isFalse();
+    }
+
+    @Test
+    public void isMetadataSynced_whenSynced_returnsTrue() {
+        String title = "test_title";
+
+        long activeQueueItemId = 3;
+        PlaybackState state = new PlaybackState.Builder()
+                .setActiveQueueItemId(activeQueueItemId).build();
+        when(mMediaController.getPlaybackState()).thenReturn(state);
+
+        List<MediaSession.QueueItem> queue = new ArrayList<>();
+        MediaDescription description = new MediaDescription.Builder()
+                .setTitle(title)
+                .build();
+        MediaSession.QueueItem queueItem = new MediaSession.QueueItem(
+                description, activeQueueItemId);
+        queue.add(queueItem);
+        when(mMediaController.getQueue()).thenReturn(queue);
+
+        MediaMetadata metadata = new MediaMetadata.Builder()
+                .putString(MediaMetadata.METADATA_KEY_TITLE, title)
+                .build();
+        when(mMediaController.getMetadata()).thenReturn(metadata);
+
+        GPMWrapper wrapper = new GPMWrapper(mContext, mMediaController, null);
+
+        assertThat(wrapper.isMetadataSynced()).isTrue();
+    }
+}
diff --git a/android/app/tests/unit/src/com/android/bluetooth/audio_util/MediaPlayerWrapperTest.java b/android/app/tests/unit/src/com/android/bluetooth/audio_util/MediaPlayerWrapperTest.java
index 16ba201..2940d00 100644
--- a/android/app/tests/unit/src/com/android/bluetooth/audio_util/MediaPlayerWrapperTest.java
+++ b/android/app/tests/unit/src/com/android/bluetooth/audio_util/MediaPlayerWrapperTest.java
@@ -16,6 +16,8 @@
 
 package com.android.bluetooth.audio_util;
 
+import static com.google.common.truth.Truth.assertThat;
+
 import static org.mockito.Mockito.*;
 
 import android.content.Context;
@@ -717,4 +719,144 @@
         Assert.assertFalse(wrapper.getTimeoutHandler().hasMessages(MSG_TIMEOUT));
         verify(mFailHandler, never()).onTerribleFailure(any(), any(), anyBoolean());
     }
+
+    @Test
+    public void pauseCurrent() {
+        MediaController.TransportControls transportControls
+                = mock(MediaController.TransportControls.class);
+        when(mMockController.getTransportControls()).thenReturn(transportControls);
+        MediaPlayerWrapper wrapper =
+                MediaPlayerWrapperFactory.wrap(mMockContext, mMockController, mThread.getLooper());
+
+        wrapper.pauseCurrent();
+
+        verify(transportControls).pause();
+    }
+
+    @Test
+    public void playCurrent() {
+        MediaController.TransportControls transportControls
+                = mock(MediaController.TransportControls.class);
+        when(mMockController.getTransportControls()).thenReturn(transportControls);
+        MediaPlayerWrapper wrapper =
+                MediaPlayerWrapperFactory.wrap(mMockContext, mMockController, mThread.getLooper());
+
+        wrapper.playCurrent();
+
+        verify(transportControls).play();
+    }
+
+    @Test
+    public void playItemFromQueue() {
+        MediaController.TransportControls transportControls
+                = mock(MediaController.TransportControls.class);
+        when(mMockController.getTransportControls()).thenReturn(transportControls);
+        when(mMockController.getQueue()).thenReturn(new ArrayList<>());
+        MediaPlayerWrapper wrapper =
+                MediaPlayerWrapperFactory.wrap(mMockContext, mMockController, mThread.getLooper());
+
+        long queueItemId = 4;
+        wrapper.playItemFromQueue(queueItemId);
+
+        verify(transportControls).skipToQueueItem(queueItemId);
+    }
+
+    @Test
+    public void rewind() {
+        MediaController.TransportControls transportControls
+                = mock(MediaController.TransportControls.class);
+        when(mMockController.getTransportControls()).thenReturn(transportControls);
+        MediaPlayerWrapper wrapper =
+                MediaPlayerWrapperFactory.wrap(mMockContext, mMockController, mThread.getLooper());
+
+        wrapper.rewind();
+
+        verify(transportControls).rewind();
+    }
+
+    @Test
+    public void seekTo() {
+        MediaController.TransportControls transportControls
+                = mock(MediaController.TransportControls.class);
+        when(mMockController.getTransportControls()).thenReturn(transportControls);
+        MediaPlayerWrapper wrapper =
+                MediaPlayerWrapperFactory.wrap(mMockContext, mMockController, mThread.getLooper());
+
+        long position = 50;
+        wrapper.seekTo(position);
+
+        verify(transportControls).seekTo(position);
+    }
+
+    @Test
+    public void setPlaybackSpeed() {
+        MediaController.TransportControls transportControls
+                = mock(MediaController.TransportControls.class);
+        when(mMockController.getTransportControls()).thenReturn(transportControls);
+        MediaPlayerWrapper wrapper =
+                MediaPlayerWrapperFactory.wrap(mMockContext, mMockController, mThread.getLooper());
+
+        float speed = 2.0f;
+        wrapper.setPlaybackSpeed(speed);
+
+        verify(transportControls).setPlaybackSpeed(speed);
+    }
+
+    @Test
+    public void skipToNext() {
+        MediaController.TransportControls transportControls
+                = mock(MediaController.TransportControls.class);
+        when(mMockController.getTransportControls()).thenReturn(transportControls);
+        MediaPlayerWrapper wrapper =
+                MediaPlayerWrapperFactory.wrap(mMockContext, mMockController, mThread.getLooper());
+
+        wrapper.skipToNext();
+
+        verify(transportControls).skipToNext();
+    }
+
+    @Test
+    public void skipToPrevious() {
+        MediaController.TransportControls transportControls
+                = mock(MediaController.TransportControls.class);
+        when(mMockController.getTransportControls()).thenReturn(transportControls);
+        MediaPlayerWrapper wrapper =
+                MediaPlayerWrapperFactory.wrap(mMockContext, mMockController, mThread.getLooper());
+
+        wrapper.skipToPrevious();
+
+        verify(transportControls).skipToPrevious();
+    }
+
+    @Test
+    public void stopCurrent() {
+        MediaController.TransportControls transportControls
+                = mock(MediaController.TransportControls.class);
+        when(mMockController.getTransportControls()).thenReturn(transportControls);
+        MediaPlayerWrapper wrapper =
+                MediaPlayerWrapperFactory.wrap(mMockContext, mMockController, mThread.getLooper());
+
+        wrapper.stopCurrent();
+
+        verify(transportControls).stop();
+    }
+
+    @Test
+    public void toggleRepeat_andToggleShuffle_doesNotCrash() {
+        MediaPlayerWrapper wrapper =
+                MediaPlayerWrapperFactory.wrap(mMockContext, mMockController, mThread.getLooper());
+
+        wrapper.toggleRepeat(true);
+        wrapper.toggleRepeat(false);
+        wrapper.toggleShuffle(true);
+        wrapper.toggleShuffle(false);
+    }
+
+    @Test
+    public void toString_doesNotCrash() {
+        MediaPlayerWrapper wrapper =
+                MediaPlayerWrapperFactory.wrap(mMockContext, mMockController, mThread.getLooper());
+
+        assertThat(wrapper.toString()).isNotEmpty();
+    }
 }
diff --git a/android/app/tests/unit/src/com/android/bluetooth/audio_util/UtilTest.java b/android/app/tests/unit/src/com/android/bluetooth/audio_util/UtilTest.java
new file mode 100644
index 0000000..0865507
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/audio_util/UtilTest.java
@@ -0,0 +1,163 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.audio_util;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import android.content.Context;
+import android.content.pm.PackageManager;
+import android.media.MediaDescription;
+import android.media.MediaMetadata;
+import android.media.browse.MediaBrowser;
+import android.media.session.MediaSession;
+import android.media.session.PlaybackState;
+import android.os.Bundle;
+
+import androidx.test.InstrumentationRegistry;
+
+import org.junit.Before;
+import org.junit.Test;
+
+public class UtilTest {
+    private static final String SONG_MEDIA_ID = "abc123";
+    private static final String SONG_TITLE = "BT Test Song";
+    private static final String SONG_ARTIST = "BT Test Artist";
+    private static final String SONG_ALBUM = "BT Test Album";
+
+    private Context mContext;
+
+    @Before
+    public void setUp() {
+        mContext = InstrumentationRegistry.getTargetContext();
+    }
+
+    @Test
+    public void getDisplayName() throws Exception {
+        PackageManager manager = mContext.getPackageManager();
+        String displayName =  manager.getApplicationLabel(
+                manager.getApplicationInfo(mContext.getPackageName(), 0)).toString();
+        assertThat(Util.getDisplayName(mContext, mContext.getPackageName())).isEqualTo(displayName);
+
+        String invalidPackage = "invalidPackage";
+        assertThat(Util.getDisplayName(mContext, invalidPackage)).isEqualTo(invalidPackage);
+    }
+
+    @Test
+    public void toMetadata_withBundle() {
+        Bundle bundle = new Bundle();
+        bundle.putString(MediaMetadata.METADATA_KEY_MEDIA_ID, SONG_MEDIA_ID);
+        bundle.putString(MediaMetadata.METADATA_KEY_TITLE, SONG_TITLE);
+        bundle.putString(MediaMetadata.METADATA_KEY_ARTIST, SONG_ARTIST);
+        bundle.putString(MediaMetadata.METADATA_KEY_ALBUM, SONG_ALBUM);
+
+        Metadata metadata = Util.toMetadata(mContext, bundle);
+        assertThat(metadata.mediaId).isEqualTo(SONG_MEDIA_ID);
+        assertThat(metadata.title).isEqualTo(SONG_TITLE);
+        assertThat(metadata.artist).isEqualTo(SONG_ARTIST);
+        assertThat(metadata.album).isEqualTo(SONG_ALBUM);
+    }
+
+    @Test
+    public void toMetadata_withMediaDescription() {
+        Metadata metadata = Util.toMetadata(mContext, createDescription());
+        assertThat(metadata.mediaId).isEqualTo(SONG_MEDIA_ID);
+        assertThat(metadata.title).isEqualTo(SONG_TITLE);
+        assertThat(metadata.artist).isEqualTo(SONG_ARTIST);
+        assertThat(metadata.album).isEqualTo(SONG_ALBUM);
+    }
+
+    @Test
+    public void toMetadata_withMediaItem() {
+        Metadata metadata = Util.toMetadata(mContext,
+                new MediaBrowser.MediaItem(createDescription(), 0));
+        assertThat(metadata.mediaId).isEqualTo(SONG_MEDIA_ID);
+        assertThat(metadata.title).isEqualTo(SONG_TITLE);
+        assertThat(metadata.artist).isEqualTo(SONG_ARTIST);
+        assertThat(metadata.album).isEqualTo(SONG_ALBUM);
+    }
+
+    @Test
+    public void toMetadata_withQueueItem() {
+        // This will change the media ID to NOW_PLAYING_PREFIX ('NowPlayingId') + the given id
+        long queueId = 1;
+        Metadata metadata = Util.toMetadata(mContext,
+                new MediaSession.QueueItem(createDescription(), queueId));
+        assertThat(metadata.mediaId).isEqualTo(Util.NOW_PLAYING_PREFIX + queueId);
+        assertThat(metadata.title).isEqualTo(SONG_TITLE);
+        assertThat(metadata.artist).isEqualTo(SONG_ARTIST);
+        assertThat(metadata.album).isEqualTo(SONG_ALBUM);
+    }
+
+    @Test
+    public void toMetadata_withMediaMetadata() {
+        MediaMetadata.Builder builder = new MediaMetadata.Builder()
+                .putString(MediaMetadata.METADATA_KEY_MEDIA_ID, SONG_MEDIA_ID)
+                .putString(MediaMetadata.METADATA_KEY_TITLE, SONG_TITLE)
+                .putString(MediaMetadata.METADATA_KEY_ARTIST, SONG_ARTIST)
+                .putString(MediaMetadata.METADATA_KEY_ALBUM, SONG_ALBUM);
+        // This will change the media ID to "currsong".
+        Metadata metadata = Util.toMetadata(mContext, builder.build());
+        assertThat(metadata.mediaId).isEqualTo("currsong");
+        assertThat(metadata.title).isEqualTo(SONG_TITLE);
+        assertThat(metadata.artist).isEqualTo(SONG_ARTIST);
+        assertThat(metadata.album).isEqualTo(SONG_ALBUM);
+    }
+
+    @Test
+    public void playStatus_playbackStateToAvrcpState() {
+        assertThat(PlayStatus.playbackStateToAvrcpState(PlaybackState.STATE_STOPPED))
+                .isEqualTo(PlayStatus.STOPPED);
+        assertThat(PlayStatus.playbackStateToAvrcpState(PlaybackState.STATE_NONE))
+                .isEqualTo(PlayStatus.STOPPED);
+        assertThat(PlayStatus.playbackStateToAvrcpState(PlaybackState.STATE_CONNECTING))
+                .isEqualTo(PlayStatus.STOPPED);
+
+        assertThat(PlayStatus.playbackStateToAvrcpState(PlaybackState.STATE_BUFFERING))
+                .isEqualTo(PlayStatus.PLAYING);
+        assertThat(PlayStatus.playbackStateToAvrcpState(PlaybackState.STATE_PLAYING))
+                .isEqualTo(PlayStatus.PLAYING);
+
+        assertThat(PlayStatus.playbackStateToAvrcpState(PlaybackState.STATE_PAUSED))
+                .isEqualTo(PlayStatus.PAUSED);
+
+        assertThat(PlayStatus.playbackStateToAvrcpState(PlaybackState.STATE_FAST_FORWARDING))
+                .isEqualTo(PlayStatus.FWD_SEEK);
+        assertThat(PlayStatus.playbackStateToAvrcpState(PlaybackState.STATE_SKIPPING_TO_NEXT))
+                .isEqualTo(PlayStatus.FWD_SEEK);
+        assertThat(PlayStatus.playbackStateToAvrcpState(PlaybackState.STATE_SKIPPING_TO_QUEUE_ITEM))
+                .isEqualTo(PlayStatus.FWD_SEEK);
+
+        assertThat(PlayStatus.playbackStateToAvrcpState(PlaybackState.STATE_REWINDING))
+                .isEqualTo(PlayStatus.REV_SEEK);
+        assertThat(PlayStatus.playbackStateToAvrcpState(PlaybackState.STATE_SKIPPING_TO_PREVIOUS))
+                .isEqualTo(PlayStatus.REV_SEEK);
+
+        assertThat(PlayStatus.playbackStateToAvrcpState(PlaybackState.STATE_ERROR))
+                .isEqualTo(PlayStatus.ERROR);
+        assertThat(PlayStatus.playbackStateToAvrcpState(-100))
+                .isEqualTo(PlayStatus.ERROR);
+    }
+
+    MediaDescription createDescription() {
+        MediaDescription.Builder builder = new MediaDescription.Builder()
+                .setMediaId(SONG_MEDIA_ID)
+                .setTitle(SONG_TITLE)
+                .setSubtitle(SONG_ARTIST)
+                .setDescription(SONG_ALBUM);
+        return builder.build();
+    }
+}
diff --git a/android/app/tests/unit/src/com/android/bluetooth/avrcp/AvrcpVolumeManagerTest.java b/android/app/tests/unit/src/com/android/bluetooth/avrcp/AvrcpVolumeManagerTest.java
new file mode 100644
index 0000000..dd57998
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/avrcp/AvrcpVolumeManagerTest.java
@@ -0,0 +1,104 @@
+/*
+ * Copyright 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.avrcp;
+
+import static com.android.bluetooth.avrcp.AvrcpVolumeManager.AVRCP_MAX_VOL;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import static org.mockito.Mockito.anyInt;
+import static org.mockito.Mockito.eq;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import android.bluetooth.BluetoothAdapter;
+import android.bluetooth.BluetoothDevice;
+import android.content.Context;
+import android.media.AudioManager;
+
+import androidx.test.InstrumentationRegistry;
+import androidx.test.filters.SmallTest;
+import androidx.test.runner.AndroidJUnit4;
+
+import org.junit.After;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.Mock;
+import org.mockito.MockitoAnnotations;
+
+@SmallTest
+@RunWith(AndroidJUnit4.class)
+public class AvrcpVolumeManagerTest {
+    private static final String REMOTE_DEVICE_ADDRESS = "00:01:02:03:04:05";
+    private static final int TEST_DEVICE_MAX_VOUME = 25;
+
+    @Mock
+    AvrcpNativeInterface mNativeInterface;
+
+    @Mock
+    AudioManager mAudioManager;
+
+    Context mContext;
+    BluetoothDevice mRemoteDevice;
+    AvrcpVolumeManager mAvrcpVolumeManager;
+
+    @Before
+    public void setUp() throws Exception {
+        MockitoAnnotations.initMocks(this);
+        mContext = InstrumentationRegistry.getTargetContext();
+        when(mAudioManager.getStreamMaxVolume(AudioManager.STREAM_MUSIC))
+                .thenReturn(TEST_DEVICE_MAX_VOUME);
+        mRemoteDevice = BluetoothAdapter.getDefaultAdapter().getRemoteDevice(REMOTE_DEVICE_ADDRESS);
+        mAvrcpVolumeManager = new AvrcpVolumeManager(mContext, mAudioManager, mNativeInterface);
+    }
+
+    @After
+    public void tearDown() throws Exception {
+        mAvrcpVolumeManager.removeStoredVolumeForDevice(mRemoteDevice);
+    }
+
+    @Test
+    public void avrcpToSystemVolume() {
+        assertThat(AvrcpVolumeManager.avrcpToSystemVolume(0)).isEqualTo(0);
+        assertThat(AvrcpVolumeManager.avrcpToSystemVolume(AVRCP_MAX_VOL))
+                .isEqualTo(TEST_DEVICE_MAX_VOUME);
+    }
+
+    @Test
+    public void dump() {
+        StringBuilder sb = new StringBuilder();
+        mAvrcpVolumeManager.dump(sb);
+
+        assertThat(sb.toString()).isNotEmpty();
+    }
+
+    @Test
+    public void sendVolumeChanged() {
+        mAvrcpVolumeManager.sendVolumeChanged(mRemoteDevice, TEST_DEVICE_MAX_VOUME);
+
+        verify(mNativeInterface).sendVolumeChanged(REMOTE_DEVICE_ADDRESS, AVRCP_MAX_VOL);
+    }
+
+    @Test
+    public void setVolume() {
+        mAvrcpVolumeManager.setVolume(mRemoteDevice, AVRCP_MAX_VOL);
+
+        verify(mAudioManager).setStreamVolume(eq(AudioManager.STREAM_MUSIC),
+                eq(TEST_DEVICE_MAX_VOUME), anyInt());
+    }
+}
diff --git a/android/app/tests/unit/src/com/android/bluetooth/avrcpcontroller/AvrcpBipClientTest.java b/android/app/tests/unit/src/com/android/bluetooth/avrcpcontroller/AvrcpBipClientTest.java
new file mode 100644
index 0000000..aa2f28e
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/avrcpcontroller/AvrcpBipClientTest.java
@@ -0,0 +1,144 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.avrcpcontroller;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import static org.junit.Assert.assertThrows;
+import static org.mockito.ArgumentMatchers.anyString;
+import static org.mockito.Mockito.doReturn;
+
+import android.bluetooth.BluetoothAdapter;
+import android.bluetooth.BluetoothDevice;
+import android.bluetooth.BluetoothProfile;
+
+import androidx.test.filters.SmallTest;
+import androidx.test.rule.ServiceTestRule;
+import androidx.test.runner.AndroidJUnit4;
+
+import com.android.bluetooth.TestUtils;
+import com.android.bluetooth.btservice.AdapterService;
+
+import org.junit.After;
+import org.junit.Before;
+import org.junit.Rule;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.Mock;
+import org.mockito.MockitoAnnotations;
+
+@SmallTest
+@RunWith(AndroidJUnit4.class)
+public class AvrcpBipClientTest {
+    private static final int TEST_PSM = 1;
+
+    @Rule
+    public final ServiceTestRule mServiceRule = new ServiceTestRule();
+
+    @Mock
+    private AdapterService mAdapterService;
+
+    private BluetoothAdapter mAdapter;
+    private BluetoothDevice mTestDevice;
+    private AvrcpControllerService mService = null;
+    private AvrcpCoverArtManager mArtManager;
+    private AvrcpBipClient mClient;
+
+    @Before
+    public void setUp() throws Exception {
+        MockitoAnnotations.initMocks(this);
+        TestUtils.setAdapterService(mAdapterService);
+        doReturn(true, false).when(mAdapterService).isStartedProfile(anyString());
+        TestUtils.startService(mServiceRule, AvrcpControllerService.class);
+        mService = AvrcpControllerService.getAvrcpControllerService();
+
+        mAdapter = BluetoothAdapter.getDefaultAdapter();
+        mTestDevice = mAdapter.getRemoteDevice("00:01:02:03:04:05");
+
+        AvrcpCoverArtManager.Callback callback = (device, event) -> {
+        };
+        mArtManager = new AvrcpCoverArtManager(mService, callback);
+
+        mClient = new AvrcpBipClient(mTestDevice, TEST_PSM,
+                mArtManager.new BipClientCallback(mTestDevice));
+    }
+
+    @After
+    public void tearDown() throws Exception {
+        TestUtils.stopService(mServiceRule, AvrcpControllerService.class);
+        mService = AvrcpControllerService.getAvrcpControllerService();
+        assertThat(mService).isNull();
+        TestUtils.clearAdapterService(mAdapterService);
+        mArtManager.cleanup();
+    }
+
+    @Test
+    public void constructor() {
+        AvrcpBipClient client = new AvrcpBipClient(mTestDevice, TEST_PSM,
+                mArtManager.new BipClientCallback(mTestDevice));
+
+        assertThat(client.getL2capPsm()).isEqualTo(TEST_PSM);
+    }
+
+    @Test
+    public void constructor_withNullDevice() {
+        assertThrows(NullPointerException.class, () -> new AvrcpBipClient(null, TEST_PSM,
+                mArtManager.new BipClientCallback(mTestDevice)));
+    }
+
+    @Test
+    public void constructor_withNullCallback() {
+        assertThrows(NullPointerException.class, () -> new AvrcpBipClient(mTestDevice, TEST_PSM,
+                null));
+    }
+
+    @Test
+    public void setConnectionState() {
+        mClient.setConnectionState(BluetoothProfile.STATE_CONNECTING);
+
+        assertThat(mClient.getState()).isEqualTo(BluetoothProfile.STATE_CONNECTING);
+    }
+
+    @Test
+    public void getConnectionState() {
+        mClient.setConnectionState(BluetoothProfile.STATE_DISCONNECTED);
+        assertThat(mClient.getStateName()).isEqualTo("Disconnected");
+
+        mClient.setConnectionState(BluetoothProfile.STATE_CONNECTING);
+        assertThat(mClient.getStateName()).isEqualTo("Connecting");
+
+        mClient.setConnectionState(BluetoothProfile.STATE_CONNECTED);
+        assertThat(mClient.getStateName()).isEqualTo("Connected");
+
+        mClient.setConnectionState(BluetoothProfile.STATE_DISCONNECTING);
+        assertThat(mClient.getStateName()).isEqualTo("Disconnecting");
+
+        int invalidState = 4;
+        mClient.setConnectionState(invalidState);
+        assertThat(mClient.getStateName()).isEqualTo("Unknown");
+    }
+
+    @Test
+    public void toString_returnsClientInfo() {
+        AvrcpBipClient client = new AvrcpBipClient(mTestDevice, TEST_PSM,
+                mArtManager.new BipClientCallback(mTestDevice));
+
+        String expected = "<AvrcpBipClient" + " device=" + mTestDevice.getAddress() + " psm="
+                + TEST_PSM + " state=" + client.getStateName() + ">";
+        assertThat(client.toString()).isEqualTo(expected);
+    }
+}
diff --git a/android/app/tests/unit/src/com/android/bluetooth/avrcpcontroller/AvrcpControllerServiceBinderTest.java b/android/app/tests/unit/src/com/android/bluetooth/avrcpcontroller/AvrcpControllerServiceBinderTest.java
new file mode 100644
index 0000000..59bf2d1
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/avrcpcontroller/AvrcpControllerServiceBinderTest.java
@@ -0,0 +1,100 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.avrcpcontroller;
+
+import static org.mockito.Mockito.verify;
+
+import android.bluetooth.BluetoothAdapter;
+import android.bluetooth.BluetoothAvrcpPlayerSettings;
+import android.bluetooth.BluetoothDevice;
+import android.bluetooth.BluetoothProfile;
+
+import androidx.test.filters.SmallTest;
+import androidx.test.runner.AndroidJUnit4;
+
+import com.android.bluetooth.x.com.android.modules.utils.SynchronousResultReceiver;
+
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.Mock;
+import org.mockito.MockitoAnnotations;
+
+@SmallTest
+@RunWith(AndroidJUnit4.class)
+public class AvrcpControllerServiceBinderTest {
+    private static final String REMOTE_DEVICE_ADDRESS = "00:00:00:00:00:00";
+
+    @Mock
+    private AvrcpControllerService mService;
+
+    BluetoothDevice mRemoteDevice;
+
+    AvrcpControllerService.AvrcpControllerServiceBinder mBinder;
+
+    @Before
+    public void setUp() throws Exception {
+        MockitoAnnotations.initMocks(this);
+        mRemoteDevice = BluetoothAdapter.getDefaultAdapter().getRemoteDevice(REMOTE_DEVICE_ADDRESS);
+        mBinder = new AvrcpControllerService.AvrcpControllerServiceBinder(mService);
+    }
+
+    @Test
+    public void getConnectedDevices_callsServiceMethod() {
+        mBinder.getConnectedDevices(null, SynchronousResultReceiver.get());
+
+        verify(mService).getConnectedDevices();
+    }
+
+    @Test
+    public void getDevicesMatchingConnectionStates_callsServiceMethod() {
+        int[] states = new int[] {BluetoothProfile.STATE_CONNECTED};
+        mBinder.getDevicesMatchingConnectionStates(states, null, SynchronousResultReceiver.get());
+
+        verify(mService).getDevicesMatchingConnectionStates(states);
+    }
+
+    @Test
+    public void getConnectionState_callsServiceMethod() {
+        mBinder.getConnectionState(mRemoteDevice, null, SynchronousResultReceiver.get());
+
+        verify(mService).getConnectionState(mRemoteDevice);
+    }
+
+    @Test
+    public void sendGroupNavigationCmd_notImplemented_doesNothing() {
+        mBinder.sendGroupNavigationCmd(mRemoteDevice, 1, 2,
+                null, SynchronousResultReceiver.get());
+    }
+
+    @Test
+    public void setPlayerApplicationSetting_notImplemented_doesNothing() {
+        BluetoothAvrcpPlayerSettings settings = new BluetoothAvrcpPlayerSettings(1);
+
+        mBinder.setPlayerApplicationSetting(settings, null, SynchronousResultReceiver.get());
+    }
+
+    @Test
+    public void getPlayerSettings_notImplemented_doesNothing() {
+        mBinder.getPlayerSettings(mRemoteDevice, null, SynchronousResultReceiver.get());
+    }
+
+    @Test
+    public void cleanUp_doesNotCrash() {
+        mBinder.cleanup();
+    }
+}
diff --git a/android/app/tests/unit/src/com/android/bluetooth/avrcpcontroller/AvrcpControllerServiceTest.java b/android/app/tests/unit/src/com/android/bluetooth/avrcpcontroller/AvrcpControllerServiceTest.java
index 2f282cc..f4d400b 100644
--- a/android/app/tests/unit/src/com/android/bluetooth/avrcpcontroller/AvrcpControllerServiceTest.java
+++ b/android/app/tests/unit/src/com/android/bluetooth/avrcpcontroller/AvrcpControllerServiceTest.java
@@ -15,45 +15,59 @@
  */
 package com.android.bluetooth.avrcpcontroller;
 
+import static com.google.common.truth.Truth.assertThat;
+
+import static org.mockito.Mockito.any;
 import static org.mockito.Mockito.anyString;
 import static org.mockito.Mockito.doReturn;
+import static org.mockito.Mockito.eq;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
 
 import android.bluetooth.BluetoothAdapter;
-import android.content.Context;
+import android.bluetooth.BluetoothDevice;
+import android.bluetooth.BluetoothProfile;
+import android.support.v4.media.session.PlaybackStateCompat;
 
-import androidx.test.InstrumentationRegistry;
 import androidx.test.filters.MediumTest;
 import androidx.test.rule.ServiceTestRule;
 import androidx.test.runner.AndroidJUnit4;
 
-import com.android.bluetooth.R;
 import com.android.bluetooth.TestUtils;
 import com.android.bluetooth.btservice.AdapterService;
 
 import org.junit.After;
-import org.junit.Assert;
 import org.junit.Assume;
 import org.junit.Before;
 import org.junit.Rule;
 import org.junit.Test;
 import org.junit.runner.RunWith;
+import org.mockito.ArgumentCaptor;
 import org.mockito.Mock;
 import org.mockito.MockitoAnnotations;
 
+import java.util.ArrayList;
+import java.util.Arrays;
+
 @MediumTest
 @RunWith(AndroidJUnit4.class)
 public class AvrcpControllerServiceTest {
+    private static final String REMOTE_DEVICE_ADDRESS = "00:00:00:00:00:00";
+    private static final byte[] REMOTE_DEVICE_ADDRESS_AS_ARRAY = new byte[] {0, 0, 0, 0, 0, 0};
+
     private AvrcpControllerService mService = null;
     private BluetoothAdapter mAdapter = null;
-    private Context mTargetContext;
 
     @Rule public final ServiceTestRule mServiceRule = new ServiceTestRule();
 
     @Mock private AdapterService mAdapterService;
+    @Mock private AvrcpControllerStateMachine mStateMachine;
+
+    private BluetoothDevice mRemoteDevice;
 
     @Before
     public void setUp() throws Exception {
-        mTargetContext = InstrumentationRegistry.getTargetContext();
         Assume.assumeTrue("Ignore test when AvrcpControllerService is not enabled",
                 AvrcpControllerService.isEnabled());
         MockitoAnnotations.initMocks(this);
@@ -61,10 +75,12 @@
         doReturn(true, false).when(mAdapterService).isStartedProfile(anyString());
         TestUtils.startService(mServiceRule, AvrcpControllerService.class);
         mService = AvrcpControllerService.getAvrcpControllerService();
-        Assert.assertNotNull(mService);
+        assertThat(mService).isNotNull();
         // Try getting the Bluetooth adapter
         mAdapter = BluetoothAdapter.getDefaultAdapter();
-        Assert.assertNotNull(mAdapter);
+        assertThat(mAdapter).isNotNull();
+        mRemoteDevice = mAdapter.getRemoteDevice(REMOTE_DEVICE_ADDRESS);
+        mService.mDeviceStateMap.put(mRemoteDevice, mStateMachine);
     }
 
     @After
@@ -74,12 +90,348 @@
         }
         TestUtils.stopService(mServiceRule, AvrcpControllerService.class);
         mService = AvrcpControllerService.getAvrcpControllerService();
-        Assert.assertNull(mService);
+        assertThat(mService).isNull();
         TestUtils.clearAdapterService(mAdapterService);
     }
 
     @Test
-    public void testInitialize() {
-        Assert.assertNotNull(AvrcpControllerService.getAvrcpControllerService());
+    public void initialize() {
+        assertThat(AvrcpControllerService.getAvrcpControllerService()).isNotNull();
+    }
+
+    @Test
+    public void disconnect_whenDisconnected_returnsFalse() {
+        when(mStateMachine.getState()).thenReturn(BluetoothProfile.STATE_DISCONNECTED);
+
+        assertThat(mService.disconnect(mRemoteDevice)).isFalse();
+    }
+
+    @Test
+    public void disconnect_whenDisconnected_returnsTrue() {
+        when(mStateMachine.getState()).thenReturn(BluetoothProfile.STATE_CONNECTED);
+
+        assertThat(mService.disconnect(mRemoteDevice)).isTrue();
+        verify(mStateMachine).disconnect();
+    }
+
+    @Test
+    public void removeStateMachine() {
+        when(mStateMachine.getDevice()).thenReturn(mRemoteDevice);
+
+        mService.removeStateMachine(mStateMachine);
+
+        assertThat(mService.mDeviceStateMap).doesNotContainKey(mRemoteDevice);
+    }
+
+    @Test
+    public void getConnectedDevices() {
+        when(mAdapterService.getBondedDevices()).thenReturn(
+                new BluetoothDevice[]{mRemoteDevice});
+        when(mStateMachine.getState()).thenReturn(BluetoothProfile.STATE_CONNECTED);
+
+        assertThat(mService.getConnectedDevices()).contains(mRemoteDevice);
+    }
+
+    @Test
+    public void setActiveDevice_whenA2dpSinkServiceIsNotInitailized_returnsFalse() {
+        assertThat(mService.setActiveDevice(mRemoteDevice)).isFalse();
+
+        assertThat(mService.getActiveDevice()).isNull();
+    }
+
+    @Test
+    public void getCurrentMetadataIfNoCoverArt_doesNotCrash() {
+        mService.getCurrentMetadataIfNoCoverArt(mRemoteDevice);
+    }
+
+    @Test
+    public void refreshContents() {
+        BrowseTree.BrowseNode node = mock(BrowseTree.BrowseNode.class);
+        when(node.getDevice()).thenReturn(mRemoteDevice);
+
+        mService.refreshContents(node);
+
+        verify(mStateMachine).requestContents(node);
+    }
+
+    @Test
+    public void playItem() {
+        String parentMediaId = "test_parent_media_id";
+        BrowseTree.BrowseNode node = mock(BrowseTree.BrowseNode.class);
+        when(mStateMachine.findNode(parentMediaId)).thenReturn(node);
+
+        mService.playItem(parentMediaId);
+
+        verify(mStateMachine).playItem(node);
+    }
+
+    @Test
+    public void getContents() {
+        String parentMediaId = "test_parent_media_id";
+        BrowseTree.BrowseNode node = mock(BrowseTree.BrowseNode.class);
+        when(mStateMachine.findNode(parentMediaId)).thenReturn(node);
+
+        mService.getContents(parentMediaId);
+
+        verify(node).getContents();
+    }
+
+    @Test
+    public void createFromNativeMediaItem() {
+        long uid = 1;
+        int type = 2;
+        int[] attrIds = new int[] { 0x01 }; // MEDIA_ATTRIBUTE_TITLE}
+        String[] attrVals = new String[] {"test_title"};
+
+        AvrcpItem item = mService.createFromNativeMediaItem(
+                REMOTE_DEVICE_ADDRESS_AS_ARRAY, uid, type, "unused_name", attrIds, attrVals);
+
+        assertThat(item.getDevice().getAddress()).isEqualTo(REMOTE_DEVICE_ADDRESS);
+        assertThat(item.getItemType()).isEqualTo(AvrcpItem.TYPE_MEDIA);
+        assertThat(item.getType()).isEqualTo(type);
+        assertThat(item.getUid()).isEqualTo(uid);
+        assertThat(item.getUuid()).isNotNull(); // Random uuid
+        assertThat(item.getTitle()).isEqualTo(attrVals[0]);
+        assertThat(item.isPlayable()).isTrue();
+    }
+
+    @Test
+    public void createFromNativeFolderItem() {
+        long uid = 1;
+        int type = 2;
+        String folderName = "test_folder_name";
+        int playable = 0x01; // Playable folder
+
+        AvrcpItem item = mService.createFromNativeFolderItem(
+                REMOTE_DEVICE_ADDRESS_AS_ARRAY, uid, type, folderName, playable);
+
+        assertThat(item.getDevice().getAddress()).isEqualTo(REMOTE_DEVICE_ADDRESS);
+        assertThat(item.getItemType()).isEqualTo(AvrcpItem.TYPE_FOLDER);
+        assertThat(item.getType()).isEqualTo(type);
+        assertThat(item.getUid()).isEqualTo(uid);
+        assertThat(item.getUuid()).isNotNull(); // Random uuid
+        assertThat(item.getDisplayableName()).isEqualTo(folderName);
+        assertThat(item.isPlayable()).isTrue();
+    }
+
+    @Test
+    public void createFromNativePlayerItem() {
+        int playerId = 1;
+        String name = "test_name";
+        byte[] transportFlags = new byte[] {1, 0, 0, 0, 0, 0, 0, 0};
+        int playStatus = AvrcpControllerService.JNI_PLAY_STATUS_REV_SEEK;
+        int playerType = AvrcpPlayer.TYPE_AUDIO; // No getter exists
+
+        AvrcpPlayer player = mService.createFromNativePlayerItem(
+                REMOTE_DEVICE_ADDRESS_AS_ARRAY, playerId, name, transportFlags,
+                playStatus, playerType);
+
+        assertThat(player.getDevice().getAddress()).isEqualTo(REMOTE_DEVICE_ADDRESS);
+        assertThat(player.getId()).isEqualTo(playerId);
+        assertThat(player.supportsFeature(0)).isTrue();
+        assertThat(player.getName()).isEqualTo(name);
+        assertThat(player.getPlayStatus()).isEqualTo(PlaybackStateCompat.STATE_REWINDING);
+    }
+
+    @Test
+    public void handleChangeFolderRsp() {
+        int count = 1;
+
+        mService.handleChangeFolderRsp(REMOTE_DEVICE_ADDRESS_AS_ARRAY, count);
+
+        verify(mStateMachine).sendMessage(
+                AvrcpControllerStateMachine.MESSAGE_PROCESS_FOLDER_PATH, count);
+    }
+
+    @Test
+    public void handleSetBrowsedPlayerRsp() {
+        int items = 3;
+        int depth = 5;
+
+        mService.handleSetBrowsedPlayerRsp(REMOTE_DEVICE_ADDRESS_AS_ARRAY, items, depth);
+
+        verify(mStateMachine).sendMessage(
+                AvrcpControllerStateMachine.MESSAGE_PROCESS_SET_BROWSED_PLAYER, items, depth);
+    }
+
+    @Test
+    public void handleSetAddressedPlayerRsp() {
+        int status = 1;
+
+        mService.handleSetAddressedPlayerRsp(REMOTE_DEVICE_ADDRESS_AS_ARRAY, status);
+
+        verify(mStateMachine).sendMessage(
+                AvrcpControllerStateMachine.MESSAGE_PROCESS_SET_ADDRESSED_PLAYER);
+    }
+
+    @Test
+    public void handleAddressedPlayerChanged() {
+        int id = 1;
+
+        mService.handleAddressedPlayerChanged(REMOTE_DEVICE_ADDRESS_AS_ARRAY, id);
+
+        verify(mStateMachine).sendMessage(
+                AvrcpControllerStateMachine.MESSAGE_PROCESS_ADDRESSED_PLAYER_CHANGED, id);
+    }
+
+    @Test
+    public void handleNowPlayingContentChanged() {
+        mService.handleNowPlayingContentChanged(REMOTE_DEVICE_ADDRESS_AS_ARRAY);
+
+        verify(mStateMachine).nowPlayingContentChanged();
+    }
+
+    @Test
+    public void JniApisWithNoBehaviors_doNotCrash() {
+        mService.handlePassthroughRsp(1, 2, new byte[0]);
+        mService.handleGroupNavigationRsp(1, 2);
+        mService.getRcFeatures(new byte[0], 1);
+        mService.setPlayerAppSettingRsp(new byte[0], (byte) 0);
+    }
+
+    @Test
+    public void onConnectionStateChanged_connectCase() {
+        boolean remoteControlConnected = true;
+        boolean browsingConnected = true; // Calls connect when any of them is true.
+
+        mService.onConnectionStateChanged(remoteControlConnected, browsingConnected,
+                REMOTE_DEVICE_ADDRESS_AS_ARRAY);
+
+        ArgumentCaptor<StackEvent> captor = ArgumentCaptor.forClass(StackEvent.class);
+        verify(mStateMachine).connect(captor.capture());
+        StackEvent event = captor.getValue();
+        assertThat(event.mType).isEqualTo(StackEvent.EVENT_TYPE_CONNECTION_STATE_CHANGED);
+        assertThat(event.mRemoteControlConnected).isEqualTo(remoteControlConnected);
+        assertThat(event.mBrowsingConnected).isEqualTo(browsingConnected);
+    }
+
+    @Test
+    public void onConnectionStateChanged_disconnectCase() {
+        boolean remoteControlConnected = false;
+        boolean browsingConnected = false; // Calls disconnect when both of them are false.
+
+        mService.onConnectionStateChanged(
+                remoteControlConnected, browsingConnected, REMOTE_DEVICE_ADDRESS_AS_ARRAY);
+
+        verify(mStateMachine).disconnect();
+    }
+
+    @Test
+    public void getRcPsm() {
+        int psm = 1;
+
+        mService.getRcPsm(REMOTE_DEVICE_ADDRESS_AS_ARRAY, psm);
+
+        verify(mStateMachine).sendMessage(
+                AvrcpControllerStateMachine.MESSAGE_PROCESS_RECEIVED_COVER_ART_PSM, psm);
+    }
+
+    @Test
+    public void handleRegisterNotificationAbsVol() {
+        byte label = 1;
+
+        mService.handleRegisterNotificationAbsVol(REMOTE_DEVICE_ADDRESS_AS_ARRAY, label);
+
+        verify(mStateMachine).sendMessage(
+                AvrcpControllerStateMachine.MESSAGE_PROCESS_REGISTER_ABS_VOL_NOTIFICATION);
+    }
+
+    @Test
+    public void handleSetAbsVolume() {
+        byte absVol = 15;
+        byte label = 1;
+
+        mService.handleSetAbsVolume(REMOTE_DEVICE_ADDRESS_AS_ARRAY, absVol, label);
+
+        verify(mStateMachine).sendMessage(
+                AvrcpControllerStateMachine.MESSAGE_PROCESS_SET_ABS_VOL_CMD, absVol);
+    }
+
+    @Test
+    public void onTrackChanged() {
+        byte numAttrs = 0;
+        int[] attrs = new int[0];
+        String[] attrVals = new String[0];
+
+        mService.onTrackChanged(REMOTE_DEVICE_ADDRESS_AS_ARRAY, numAttrs, attrs, attrVals);
+
+        ArgumentCaptor<AvrcpItem> captor = ArgumentCaptor.forClass(AvrcpItem.class);
+        verify(mStateMachine).sendMessage(
+                eq(AvrcpControllerStateMachine.MESSAGE_PROCESS_TRACK_CHANGED), captor.capture());
+        AvrcpItem item = captor.getValue();
+        assertThat(item.getDevice().getAddress()).isEqualTo(REMOTE_DEVICE_ADDRESS);
+        assertThat(item.getItemType()).isEqualTo(AvrcpItem.TYPE_MEDIA);
+        assertThat(item.getUuid()).isNotNull(); // Random uuid
+    }
+
+    @Test
+    public void onPlayPositionChanged() {
+        int songLen = 100;
+        int currSongPos = 33;
+
+        mService.onPlayPositionChanged(REMOTE_DEVICE_ADDRESS_AS_ARRAY, songLen, currSongPos);
+
+        verify(mStateMachine).sendMessage(
+                AvrcpControllerStateMachine.MESSAGE_PROCESS_PLAY_POS_CHANGED, songLen, currSongPos);
+    }
+
+    @Test
+    public void onPlayStatusChanged() {
+        byte status = AvrcpControllerService.JNI_PLAY_STATUS_REV_SEEK;
+
+        mService.onPlayStatusChanged(REMOTE_DEVICE_ADDRESS_AS_ARRAY, status);
+
+        verify(mStateMachine).sendMessage(
+                AvrcpControllerStateMachine.MESSAGE_PROCESS_PLAY_STATUS_CHANGED,
+                PlaybackStateCompat.STATE_REWINDING);
+    }
+
+    @Test
+    public void onPlayerAppSettingChanged() {
+        byte[] playerAttribRsp = new byte[] {PlayerApplicationSettings.REPEAT_STATUS,
+                PlayerApplicationSettings.JNI_REPEAT_STATUS_ALL_TRACK_REPEAT};
+
+        mService.onPlayerAppSettingChanged(REMOTE_DEVICE_ADDRESS_AS_ARRAY, playerAttribRsp, 2);
+
+        verify(mStateMachine).sendMessage(
+                eq(AvrcpControllerStateMachine.MESSAGE_PROCESS_CURRENT_APPLICATION_SETTINGS),
+                any(PlayerApplicationSettings.class));
+    }
+
+    @Test
+    public void onAvailablePlayerChanged() {
+        mService.onAvailablePlayerChanged(REMOTE_DEVICE_ADDRESS_AS_ARRAY);
+
+        verify(mStateMachine).sendMessage(
+                AvrcpControllerStateMachine.MESSAGE_PROCESS_AVAILABLE_PLAYER_CHANGED);
+    }
+
+    @Test
+    public void handleGetFolderItemsRsp() {
+        int status = 2;
+        AvrcpItem[] items = new AvrcpItem[] {mock(AvrcpItem.class)};
+
+        mService.handleGetFolderItemsRsp(REMOTE_DEVICE_ADDRESS_AS_ARRAY, status, items);
+
+        verify(mStateMachine).sendMessage(
+                eq(AvrcpControllerStateMachine.MESSAGE_PROCESS_GET_FOLDER_ITEMS),
+                eq(new ArrayList<>(Arrays.asList(items))));
+    }
+
+    @Test
+    public void handleGetPlayerItemsRsp() {
+        AvrcpPlayer[] items = new AvrcpPlayer[] {mock(AvrcpPlayer.class)};
+
+        mService.handleGetPlayerItemsRsp(REMOTE_DEVICE_ADDRESS_AS_ARRAY, items);
+
+        verify(mStateMachine).sendMessage(
+                eq(AvrcpControllerStateMachine.MESSAGE_PROCESS_GET_PLAYER_ITEMS),
+                eq(new ArrayList<>(Arrays.asList(items))));
+    }
+
+    @Test
+    public void dump_doesNotCrash() {
+        mService.getRcPsm(REMOTE_DEVICE_ADDRESS_AS_ARRAY, 1);
+        mService.dump(new StringBuilder());
     }
 }
diff --git a/android/app/tests/unit/src/com/android/bluetooth/avrcpcontroller/AvrcpCoverArtProviderTest.java b/android/app/tests/unit/src/com/android/bluetooth/avrcpcontroller/AvrcpCoverArtProviderTest.java
new file mode 100644
index 0000000..f650390
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/avrcpcontroller/AvrcpCoverArtProviderTest.java
@@ -0,0 +1,151 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.avrcpcontroller;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import static org.junit.Assert.assertThrows;
+import static org.mockito.ArgumentMatchers.anyString;
+import static org.mockito.Mockito.doReturn;
+import static org.mockito.Mockito.when;
+
+import android.bluetooth.BluetoothAdapter;
+import android.bluetooth.BluetoothDevice;
+import android.net.Uri;
+
+import androidx.test.filters.SmallTest;
+import androidx.test.rule.ServiceTestRule;
+import androidx.test.runner.AndroidJUnit4;
+
+import com.android.bluetooth.TestUtils;
+import com.android.bluetooth.btservice.AdapterService;
+
+import org.junit.After;
+import org.junit.Before;
+import org.junit.Rule;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.Mock;
+import org.mockito.MockitoAnnotations;
+
+import java.io.FileNotFoundException;
+
+@SmallTest
+@RunWith(AndroidJUnit4.class)
+public class AvrcpCoverArtProviderTest {
+    private static final String TEST_MODE = "test_mode";
+
+    private final byte[] mTestAddress = new byte[]{01, 01, 01, 01, 01, 01};
+
+    private BluetoothAdapter mAdapter;
+    private BluetoothDevice mTestDevice = null;
+    private AvrcpCoverArtProvider mArtProvider;
+
+    @Rule
+    public final ServiceTestRule mServiceRule = new ServiceTestRule();
+    @Mock
+    private Uri mUri;
+    @Mock
+    private AdapterService mAdapterService;
+
+    @Before
+    public void setUp() throws Exception {
+        MockitoAnnotations.initMocks(this);
+        TestUtils.setAdapterService(mAdapterService);
+        doReturn(true, false).when(mAdapterService).isStartedProfile(anyString());
+        TestUtils.startService(mServiceRule, AvrcpControllerService.class);
+        mAdapter = BluetoothAdapter.getDefaultAdapter();
+        mTestDevice = mAdapter.getRemoteDevice(mTestAddress);
+        mArtProvider = new AvrcpCoverArtProvider();
+    }
+
+    @After
+    public void tearDown() throws Exception {
+        TestUtils.stopService(mServiceRule, AvrcpControllerService.class);
+        TestUtils.clearAdapterService(mAdapterService);
+    }
+
+    @Test
+    public void openFile_whenFileNotFoundExceptionIsCaught() {
+        when(mUri.getQueryParameter("device")).thenReturn("00:01:02:03:04:05");
+        when(mUri.getQueryParameter("uuid")).thenReturn("1111");
+        assertThat(mArtProvider.onCreate()).isTrue();
+
+        assertThrows(FileNotFoundException.class, () -> mArtProvider.openFile(mUri, TEST_MODE));
+    }
+
+    @Test
+    public void openFile_whenNullPointerExceptionIsCaught() {
+        when(mUri.getQueryParameter("device")).thenThrow(NullPointerException.class);
+
+        assertThrows(FileNotFoundException.class, () -> mArtProvider.openFile(mUri, TEST_MODE));
+    }
+
+    @Test
+    public void openFile_whenIllegalArgumentExceptionIsCaught() {
+        // This causes device address to be null, invoking an IllegalArgumentException
+        when(mUri.getQueryParameter("device")).thenReturn(null);
+        when(mUri.getQueryParameter("uuid")).thenReturn("1111");
+        assertThat(mArtProvider.onCreate()).isTrue();
+
+        assertThrows(FileNotFoundException.class, () -> mArtProvider.openFile(mUri, TEST_MODE));
+    }
+
+    @Test
+    public void getImageUri_withEmptyImageUuid() {
+        assertThat(AvrcpCoverArtProvider.getImageUri(mTestDevice, "")).isNull();
+    }
+
+    @Test
+    public void getImageUri_withValidImageUuid() {
+        String uuid = "1111";
+        Uri expectedUri = AvrcpCoverArtProvider.CONTENT_URI.buildUpon().appendQueryParameter(
+                "device", mTestDevice.getAddress()).appendQueryParameter("uuid", uuid).build();
+
+        assertThat(AvrcpCoverArtProvider.getImageUri(mTestDevice, uuid)).isEqualTo(expectedUri);
+    }
+
+    @Test
+    public void onCreate() {
+        assertThat(mArtProvider.onCreate()).isTrue();
+    }
+
+    @Test
+    public void query() {
+        assertThat(mArtProvider.query(null, null, null, null, null)).isNull();
+    }
+
+    @Test
+    public void insert() {
+        assertThat(mArtProvider.insert(null, null)).isNull();
+    }
+
+    @Test
+    public void delete() {
+        assertThat(mArtProvider.delete(null, null, null)).isEqualTo(0);
+    }
+
+    @Test
+    public void update() {
+        assertThat(mArtProvider.update(null, null, null, null)).isEqualTo(0);
+    }
+
+    @Test
+    public void getType() {
+        assertThat(mArtProvider.getType(null)).isNull();
+    }
+}
\ No newline at end of file
diff --git a/android/app/tests/unit/src/com/android/bluetooth/avrcpcontroller/AvrcpCoverArtStorageTest.java b/android/app/tests/unit/src/com/android/bluetooth/avrcpcontroller/AvrcpCoverArtStorageTest.java
index 6a2c3d3..846d7af 100644
--- a/android/app/tests/unit/src/com/android/bluetooth/avrcpcontroller/AvrcpCoverArtStorageTest.java
+++ b/android/app/tests/unit/src/com/android/bluetooth/avrcpcontroller/AvrcpCoverArtStorageTest.java
@@ -329,4 +329,15 @@
         Assert.assertFalse(mAvrcpCoverArtStorage.doesImageExist(mDevice2, mHandle1));
         Assert.assertFalse(mAvrcpCoverArtStorage.doesImageExist(mDevice2, mHandle2));
     }
+
+    @Test
+    public void toString_returnsDeviceInfo() {
+        String expectedString =
+                "CoverArtStorage:\n" + "  " + mDevice1.getAddress() + " (" + 1 + "):" + "\n    "
+                        + mHandle1 + "\n";
+
+        mAvrcpCoverArtStorage.addImage(mDevice1, mHandle1, mImage1);
+
+        Assert.assertEquals(expectedString, mAvrcpCoverArtStorage.toString());
+    }
 }
diff --git a/android/app/tests/unit/src/com/android/bluetooth/avrcpcontroller/AvrcpItemTest.java b/android/app/tests/unit/src/com/android/bluetooth/avrcpcontroller/AvrcpItemTest.java
index eb1421e..a3f0715 100644
--- a/android/app/tests/unit/src/com/android/bluetooth/avrcpcontroller/AvrcpItemTest.java
+++ b/android/app/tests/unit/src/com/android/bluetooth/avrcpcontroller/AvrcpItemTest.java
@@ -639,4 +639,34 @@
         Assert.assertEquals(uri, desc.getIconUri());
         Assert.assertEquals(null, desc.getIconBitmap());
     }
+
+    @Test
+    public void equals_withItself() {
+        AvrcpItem.Builder builder = new AvrcpItem.Builder();
+
+        AvrcpItem item = builder.build();
+
+        Assert.assertTrue(item.equals(item));
+    }
+
+    @Test
+    public void equals_withDifferentInstance() {
+        AvrcpItem.Builder builder = new AvrcpItem.Builder();
+        String notAvrcpItem = "notAvrcpItem";
+
+        AvrcpItem item = builder.build();
+
+        Assert.assertFalse(item.equals(notAvrcpItem));
+    }
+
+    @Test
+    public void equals_withItemContainingSameInfo() {
+        AvrcpItem.Builder builder = new AvrcpItem.Builder();
+        AvrcpItem.Builder builderEqual = new AvrcpItem.Builder();
+
+        AvrcpItem item = builder.build();
+        AvrcpItem itemEqual = builderEqual.build();
+
+        Assert.assertTrue(item.equals(itemEqual));
+    }
 }
diff --git a/android/app/tests/unit/src/com/android/bluetooth/avrcpcontroller/AvrcpPlayerTest.java b/android/app/tests/unit/src/com/android/bluetooth/avrcpcontroller/AvrcpPlayerTest.java
new file mode 100644
index 0000000..30e9c62
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/avrcpcontroller/AvrcpPlayerTest.java
@@ -0,0 +1,190 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.avrcpcontroller;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import static org.mockito.Mockito.when;
+
+import android.bluetooth.BluetoothAdapter;
+import android.bluetooth.BluetoothDevice;
+import android.net.Uri;
+import android.support.v4.media.session.PlaybackStateCompat;
+
+import org.junit.Before;
+import org.junit.Test;
+import org.mockito.Mock;
+import org.mockito.MockitoAnnotations;
+
+public class AvrcpPlayerTest {
+    private static final int TEST_PLAYER_ID = 1;
+    private static final int TEST_PLAYER_TYPE = AvrcpPlayer.TYPE_VIDEO;
+    private static final int TEST_PLAYER_SUB_TYPE = AvrcpPlayer.SUB_TYPE_AUDIO_BOOK;
+    private static final String TEST_NAME = "test_name";
+    private static final int TEST_FEATURE = AvrcpPlayer.FEATURE_PLAY;
+    private static final int TEST_PLAY_STATUS = PlaybackStateCompat.STATE_STOPPED;
+    private static final int TEST_PLAY_TIME = 1;
+
+    private final AvrcpItem mAvrcpItem = new AvrcpItem.Builder().build();
+    private final byte[] mTestAddress = new byte[]{01, 01, 01, 01, 01, 01};
+    private BluetoothAdapter mAdapter;
+    private BluetoothDevice mTestDevice = null;
+
+    @Mock
+    private PlayerApplicationSettings mPlayerApplicationSettings;
+
+    @Before
+    public void setUp() {
+        MockitoAnnotations.initMocks(this);
+        mAdapter = BluetoothAdapter.getDefaultAdapter();
+        mTestDevice = mAdapter.getRemoteDevice(mTestAddress);
+    }
+
+    @Test
+    public void buildAvrcpPlayer() {
+        AvrcpPlayer.Builder builder = new AvrcpPlayer.Builder();
+        builder.setDevice(mTestDevice);
+        builder.setPlayerId(TEST_PLAYER_ID);
+        builder.setPlayerType(TEST_PLAYER_TYPE);
+        builder.setPlayerSubType(TEST_PLAYER_SUB_TYPE);
+        builder.setName(TEST_NAME);
+        builder.setSupportedFeature(TEST_FEATURE);
+        builder.setPlayStatus(TEST_PLAY_STATUS);
+        builder.setCurrentTrack(mAvrcpItem);
+
+        AvrcpPlayer avrcpPlayer = builder.build();
+
+        assertThat(avrcpPlayer.getDevice()).isEqualTo(mTestDevice);
+        assertThat(avrcpPlayer.getId()).isEqualTo(TEST_PLAYER_ID);
+        assertThat(avrcpPlayer.getName()).isEqualTo(TEST_NAME);
+        assertThat(avrcpPlayer.supportsFeature(TEST_FEATURE)).isTrue();
+        assertThat(avrcpPlayer.getPlayStatus()).isEqualTo(TEST_PLAY_STATUS);
+        assertThat(avrcpPlayer.getCurrentTrack()).isEqualTo(mAvrcpItem);
+        assertThat(avrcpPlayer.getPlaybackState().getActions()).isEqualTo(
+                PlaybackStateCompat.ACTION_PREPARE | PlaybackStateCompat.ACTION_PLAY);
+    }
+
+    @Test
+    public void setAndGetPlayTime() {
+        AvrcpPlayer avrcpPlayer = new AvrcpPlayer.Builder().build();
+
+        avrcpPlayer.setPlayTime(TEST_PLAY_TIME);
+
+        assertThat(avrcpPlayer.getPlayTime()).isEqualTo(TEST_PLAY_TIME);
+    }
+
+    @Test
+    public void setPlayStatus() {
+        AvrcpPlayer avrcpPlayer = new AvrcpPlayer.Builder().build();
+        avrcpPlayer.setPlayTime(TEST_PLAY_TIME);
+
+        avrcpPlayer.setPlayStatus(PlaybackStateCompat.STATE_PLAYING);
+        assertThat(avrcpPlayer.getPlaybackState().getPlaybackSpeed()).isEqualTo(1);
+
+        avrcpPlayer.setPlayStatus(PlaybackStateCompat.STATE_PAUSED);
+        assertThat(avrcpPlayer.getPlaybackState().getPlaybackSpeed()).isEqualTo(0);
+
+        avrcpPlayer.setPlayStatus(PlaybackStateCompat.STATE_FAST_FORWARDING);
+        assertThat(avrcpPlayer.getPlaybackState().getPlaybackSpeed()).isEqualTo(3);
+
+        avrcpPlayer.setPlayStatus(PlaybackStateCompat.STATE_REWINDING);
+        assertThat(avrcpPlayer.getPlaybackState().getPlaybackSpeed()).isEqualTo(-3);
+    }
+
+    @Test
+    public void setSupportedPlayerApplicationSettings() {
+        when(mPlayerApplicationSettings.supportsSetting(
+                PlayerApplicationSettings.REPEAT_STATUS)).thenReturn(true);
+        when(mPlayerApplicationSettings.supportsSetting(
+                PlayerApplicationSettings.SHUFFLE_STATUS)).thenReturn(true);
+        AvrcpPlayer avrcpPlayer = new AvrcpPlayer.Builder().build();
+        long expectedActions =
+                PlaybackStateCompat.ACTION_PREPARE | PlaybackStateCompat.ACTION_SET_REPEAT_MODE
+                        | PlaybackStateCompat.ACTION_SET_SHUFFLE_MODE;
+
+        avrcpPlayer.setSupportedPlayerApplicationSettings(mPlayerApplicationSettings);
+
+        assertThat(avrcpPlayer.getPlaybackState().getActions()).isEqualTo(expectedActions);
+    }
+
+    @Test
+    public void supportsSetting() {
+        int settingType = 1;
+        int settingValue = 1;
+        when(mPlayerApplicationSettings.supportsSetting(settingType, settingValue)).thenReturn(
+                true);
+        AvrcpPlayer avrcpPlayer = new AvrcpPlayer.Builder().build();
+
+        avrcpPlayer.setSupportedPlayerApplicationSettings(mPlayerApplicationSettings);
+
+        assertThat(avrcpPlayer.supportsSetting(settingType, settingValue)).isTrue();
+    }
+
+    @Test
+    public void updateAvailableActions() {
+        byte[] supportedFeatures = new byte[16];
+        setSupportedFeature(supportedFeatures, AvrcpPlayer.FEATURE_STOP);
+        setSupportedFeature(supportedFeatures, AvrcpPlayer.FEATURE_PAUSE);
+        setSupportedFeature(supportedFeatures, AvrcpPlayer.FEATURE_REWIND);
+        setSupportedFeature(supportedFeatures, AvrcpPlayer.FEATURE_FAST_FORWARD);
+        setSupportedFeature(supportedFeatures, AvrcpPlayer.FEATURE_FORWARD);
+        setSupportedFeature(supportedFeatures, AvrcpPlayer.FEATURE_PREVIOUS);
+        long expectedActions = PlaybackStateCompat.ACTION_PREPARE | PlaybackStateCompat.ACTION_STOP
+                | PlaybackStateCompat.ACTION_PAUSE | PlaybackStateCompat.ACTION_REWIND
+                | PlaybackStateCompat.ACTION_FAST_FORWARD | PlaybackStateCompat.ACTION_SKIP_TO_NEXT
+                | PlaybackStateCompat.ACTION_SKIP_TO_PREVIOUS;
+
+        AvrcpPlayer avrcpPlayer = new AvrcpPlayer.Builder().setSupportedFeatures(
+                supportedFeatures).build();
+
+        assertThat(avrcpPlayer.getPlaybackState().getActions()).isEqualTo(expectedActions);
+    }
+
+    @Test
+    public void toString_returnsInfo() {
+        AvrcpPlayer avrcpPlayer = new AvrcpPlayer.Builder().setPlayerId(TEST_PLAYER_ID).setName(
+                TEST_NAME).setCurrentTrack(mAvrcpItem).build();
+
+        assertThat(avrcpPlayer.toString()).isEqualTo(
+                "<AvrcpPlayer id=" + TEST_PLAYER_ID + " name=" + TEST_NAME + " track="
+                        + mAvrcpItem + " playState=" + avrcpPlayer.getPlaybackState() + ">");
+    }
+
+    @Test
+    public void notifyImageDownload() {
+        String uuid = "1111";
+        Uri uri = Uri.parse("http://test.com");
+        AvrcpItem trackWithDifferentUuid = new AvrcpItem.Builder().build();
+        AvrcpItem trackWithSameUuid = new AvrcpItem.Builder().build();
+        trackWithSameUuid.setCoverArtUuid(uuid);
+        AvrcpPlayer avrcpPlayer = new AvrcpPlayer.Builder().build();
+
+        assertThat(avrcpPlayer.notifyImageDownload(uuid, uri)).isFalse();
+
+        avrcpPlayer.updateCurrentTrack(trackWithDifferentUuid);
+        assertThat(avrcpPlayer.notifyImageDownload(uuid, uri)).isFalse();
+
+        avrcpPlayer.updateCurrentTrack(trackWithSameUuid);
+        assertThat(avrcpPlayer.notifyImageDownload(uuid, uri)).isTrue();
+    }
+
+    private void setSupportedFeature(byte[] supportedFeatures, int feature) {
+        int byteNumber = feature / 8;
+        byte bitMask = (byte) (1 << (feature % 8));
+        supportedFeatures[byteNumber] = (byte) (supportedFeatures[byteNumber] | bitMask);
+    }
+}
diff --git a/android/app/tests/unit/src/com/android/bluetooth/avrcpcontroller/BrowseNodeTest.java b/android/app/tests/unit/src/com/android/bluetooth/avrcpcontroller/BrowseNodeTest.java
new file mode 100644
index 0000000..51250bd
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/avrcpcontroller/BrowseNodeTest.java
@@ -0,0 +1,191 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.avrcpcontroller;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import android.bluetooth.BluetoothAdapter;
+import android.bluetooth.BluetoothDevice;
+
+import androidx.test.filters.SmallTest;
+import androidx.test.runner.AndroidJUnit4;
+
+import com.android.bluetooth.avrcpcontroller.BrowseTree.BrowseNode;
+
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+import java.util.ArrayList;
+import java.util.List;
+
+@SmallTest
+@RunWith(AndroidJUnit4.class)
+public class BrowseNodeTest {
+    private static final int TEST_PLAYER_ID = 1;
+    private static final String TEST_UUID = "1111";
+
+    private final byte[] mTestAddress = new byte[]{01, 01, 01, 01, 01, 01};
+    private BluetoothAdapter mAdapter;
+    private BluetoothDevice mTestDevice = null;
+    private BrowseTree mBrowseTree;
+    private BrowseNode mRootNode;
+
+    @Before
+    public void setUp() {
+        mAdapter = BluetoothAdapter.getDefaultAdapter();
+        mTestDevice = mAdapter.getRemoteDevice(mTestAddress);
+        mBrowseTree = new BrowseTree(null);
+        mRootNode = mBrowseTree.mRootNode;
+    }
+
+    @Test
+    public void constructor_withAvrcpPlayer() {
+        BrowseNode browseNode = mBrowseTree.new BrowseNode(new AvrcpPlayer.Builder().setDevice(
+                mTestDevice).setPlayerId(TEST_PLAYER_ID).setSupportedFeature(
+                AvrcpPlayer.FEATURE_BROWSING).build());
+
+        assertThat(browseNode.isPlayer()).isTrue();
+        assertThat(browseNode.getBluetoothID()).isEqualTo(TEST_PLAYER_ID);
+        assertThat(browseNode.getDevice()).isEqualTo(mTestDevice);
+        assertThat(browseNode.isBrowsable()).isTrue();
+    }
+
+    @Test
+    public void getExpectedChildren() {
+        int expectedChildren = 10;
+
+        mRootNode.setExpectedChildren(expectedChildren);
+
+        assertThat(mRootNode.getExpectedChildren()).isEqualTo(expectedChildren);
+    }
+
+    @Test
+    public void addChildren() {
+        AvrcpPlayer childAvrcpPlayer = new AvrcpPlayer.Builder().setPlayerId(
+                TEST_PLAYER_ID).build();
+        AvrcpItem childAvrcpItem = new AvrcpItem.Builder().setUuid(TEST_UUID).build();
+        List<Object> children = new ArrayList<>();
+        children.add(childAvrcpPlayer);
+        children.add(childAvrcpItem);
+        assertThat(mRootNode.getChild(0)).isNull();
+
+        mRootNode.addChildren(children);
+
+        assertThat(mRootNode.getChildrenCount()).isEqualTo(children.size());
+        assertThat(mRootNode.getChildren().get(0).getBluetoothID()).isEqualTo(TEST_PLAYER_ID);
+        assertThat(mRootNode.getChildren().get(1).getID()).isEqualTo(TEST_UUID);
+    }
+
+    @Test
+    public void addChild_withImageUuid_toNowPlayingNode() {
+        String coverArtUuid = "2222";
+        AvrcpItem avrcpItem = new AvrcpItem.Builder().setUuid(TEST_UUID).build();
+        avrcpItem.setCoverArtUuid(coverArtUuid);
+        BrowseNode browseNode = mBrowseTree.new BrowseNode(avrcpItem);
+        assertThat(mBrowseTree.mNowPlayingNode.isNowPlaying()).isTrue();
+
+        mBrowseTree.mNowPlayingNode.addChild(browseNode);
+
+        assertThat(mBrowseTree.mNowPlayingNode.isChild(browseNode)).isTrue();
+        assertThat(browseNode.getParent()).isEqualTo(mBrowseTree.mNowPlayingNode);
+        assertThat(browseNode.getScope()).isEqualTo(
+                AvrcpControllerService.BROWSE_SCOPE_NOW_PLAYING);
+        assertThat(mBrowseTree.getNodesUsingCoverArt(coverArtUuid).get(0)).isEqualTo(TEST_UUID);
+    }
+
+    @Test
+    public void removeChild() {
+        BrowseNode browseNode = mBrowseTree.new BrowseNode(
+                new AvrcpItem.Builder().setUuid(TEST_UUID).build());
+        mRootNode.addChild(browseNode);
+        assertThat(mRootNode.getChildrenCount()).isEqualTo(1);
+
+        mRootNode.removeChild(browseNode);
+
+        assertThat(mRootNode.getChildrenCount()).isEqualTo(0);
+    }
+
+    @Test
+    public void getContents() {
+        mRootNode.setCached(false);
+        assertThat(mRootNode.getContents()).isNull();
+        AvrcpItem avrcpItem = new AvrcpItem.Builder().setUuid(TEST_UUID).build();
+        BrowseNode browseNode = mBrowseTree.new BrowseNode(avrcpItem);
+
+        mRootNode.addChild(browseNode);
+
+        assertThat(mRootNode.getContents().size()).isEqualTo(1);
+    }
+
+    @Test
+    public void setCached() {
+        BrowseNode browseNode = mBrowseTree.new BrowseNode(
+                new AvrcpItem.Builder().setUuid(TEST_UUID).build());
+        mRootNode.addChild(browseNode);
+        assertThat(mRootNode.getChildrenCount()).isEqualTo(1);
+
+        mRootNode.setCached(false);
+
+        assertThat(mRootNode.isCached()).isFalse();
+        assertThat(mRootNode.getChildrenCount()).isEqualTo(0);
+    }
+
+    @Test
+    public void getters() {
+        BrowseNode browseNode = mBrowseTree.new BrowseNode(
+                new AvrcpItem.Builder().setUuid(TEST_UUID).build());
+
+        assertThat(browseNode.getFolderUID()).isEqualTo(TEST_UUID);
+        assertThat(browseNode.getPlayerID()).isEqualTo(
+                Integer.parseInt((TEST_UUID).replace(BrowseTree.PLAYER_PREFIX, "")));
+    }
+
+    @Test
+    public void equals_withDifferentClass() {
+        AvrcpItem avrcpItem = new AvrcpItem.Builder().setUuid(TEST_UUID).build();
+
+        assertThat(mRootNode).isNotEqualTo(avrcpItem);
+    }
+
+    @Test
+    public void equals_withSameId() {
+        BrowseNode browseNodeOne = mBrowseTree.new BrowseNode(
+                new AvrcpItem.Builder().setUuid(TEST_UUID).build());
+        BrowseNode browseNodeTwo = mBrowseTree.new BrowseNode(
+                new AvrcpItem.Builder().setUuid(TEST_UUID).build());
+
+        assertThat(browseNodeOne).isEqualTo(browseNodeTwo);
+    }
+
+    @Test
+    public void isDescendant() {
+        BrowseNode browseNode = mBrowseTree.new BrowseNode(
+                new AvrcpItem.Builder().setUuid(TEST_UUID).build());
+        mRootNode.addChild(browseNode);
+
+        assertThat(mRootNode.isDescendant(browseNode)).isTrue();
+    }
+
+    @Test
+    public void toString_returnsId() {
+        BrowseNode browseNode = mBrowseTree.new BrowseNode(
+                new AvrcpItem.Builder().setUuid(TEST_UUID).build());
+
+        assertThat(browseNode.toString()).isEqualTo("ID: " + TEST_UUID);
+    }
+}
\ No newline at end of file
diff --git a/android/app/tests/unit/src/com/android/bluetooth/avrcpcontroller/BrowseTreeTest.java b/android/app/tests/unit/src/com/android/bluetooth/avrcpcontroller/BrowseTreeTest.java
new file mode 100644
index 0000000..53af271
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/avrcpcontroller/BrowseTreeTest.java
@@ -0,0 +1,202 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.avrcpcontroller;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import android.bluetooth.BluetoothAdapter;
+import android.bluetooth.BluetoothDevice;
+
+import com.android.bluetooth.avrcpcontroller.BrowseTree.BrowseNode;
+
+import org.junit.Before;
+import org.junit.Test;
+
+import java.util.Set;
+
+public class BrowseTreeTest {
+    private static final String ILLEGAL_ID = "illegal_id";
+    private static final String TEST_HANDLE = "test_handle";
+    private static final String TEST_NODE_ID = "test_node_id";
+
+    private final byte[] mTestAddress = new byte[]{01, 01, 01, 01, 01, 01};
+    private BluetoothAdapter mAdapter;
+    private BluetoothDevice mTestDevice = null;
+
+    @Before
+    public void setUp() {
+        mAdapter = BluetoothAdapter.getDefaultAdapter();
+        mTestDevice = mAdapter.getRemoteDevice(mTestAddress);
+    }
+
+    @Test
+    public void constructor_withoutDevice() {
+        BrowseTree browseTree = new BrowseTree(null);
+
+        assertThat(browseTree.mRootNode.mItem.getDevice()).isEqualTo(null);
+    }
+
+    @Test
+    public void constructor_withDevice() {
+        BrowseTree browseTree = new BrowseTree(mTestDevice);
+
+        assertThat(browseTree.mRootNode.mItem.getDevice()).isEqualTo(mTestDevice);
+    }
+
+    @Test
+    public void clear() {
+        BrowseTree browseTree = new BrowseTree(mTestDevice);
+
+        browseTree.clear();
+
+        assertThat(browseTree.mBrowseMap).isEmpty();
+    }
+
+    @Test
+    public void getTrackFromNowPlayingList() {
+        BrowseTree browseTree = new BrowseTree(mTestDevice);
+        BrowseNode trackInNowPlayingList = browseTree.new BrowseNode(new AvrcpItem.Builder()
+                .setUuid(ILLEGAL_ID).setTitle(ILLEGAL_ID).setBrowsable(true).build());
+
+        browseTree.mNowPlayingNode.addChild(trackInNowPlayingList);
+
+        assertThat(browseTree.getTrackFromNowPlayingList(0)).isEqualTo(
+                trackInNowPlayingList);
+    }
+
+    @Test
+    public void onConnected() {
+        BrowseTree browseTree = new BrowseTree(null);
+
+        assertThat(browseTree.mRootNode.getChildrenCount()).isEqualTo(0);
+
+        browseTree.onConnected(mTestDevice);
+
+        assertThat(browseTree.mRootNode.getChildrenCount()).isEqualTo(1);
+    }
+
+    @Test
+    public void findBrowseNodeByID() {
+        BrowseTree browseTree = new BrowseTree(mTestDevice);
+
+        assertThat(browseTree.findBrowseNodeByID(ILLEGAL_ID)).isNull();
+        assertThat(browseTree.findBrowseNodeByID(BrowseTree.ROOT)).isEqualTo(browseTree.mRootNode);
+    }
+
+    @Test
+    public void setAndGetCurrentBrowsedFolder() {
+        BrowseTree browseTree = new BrowseTree(mTestDevice);
+
+        assertThat(browseTree.setCurrentBrowsedFolder(ILLEGAL_ID)).isFalse();
+        assertThat(browseTree.setCurrentBrowsedFolder(BrowseTree.NOW_PLAYING_PREFIX)).isTrue();
+        assertThat(browseTree.getCurrentBrowsedFolder()).isEqualTo(browseTree.mNowPlayingNode);
+    }
+
+    @Test
+    public void setAndGetCurrentBrowsedPlayer() {
+        BrowseTree browseTree = new BrowseTree(mTestDevice);
+
+        assertThat(browseTree.setCurrentBrowsedPlayer(ILLEGAL_ID, 0, 0)).isFalse();
+        assertThat(
+                browseTree.setCurrentBrowsedPlayer(BrowseTree.NOW_PLAYING_PREFIX, 2, 1)).isTrue();
+        assertThat(browseTree.getCurrentBrowsedPlayer()).isEqualTo(browseTree.mNowPlayingNode);
+    }
+
+    @Test
+    public void setAndGetCurrentAddressedPlayer() {
+        BrowseTree browseTree = new BrowseTree(mTestDevice);
+
+        assertThat(browseTree.setCurrentAddressedPlayer(ILLEGAL_ID)).isFalse();
+        assertThat(browseTree.setCurrentAddressedPlayer(BrowseTree.NOW_PLAYING_PREFIX)).isTrue();
+        assertThat(browseTree.getCurrentAddressedPlayer()).isEqualTo(browseTree.mNowPlayingNode);
+    }
+
+    @Test
+    public void indicateCoverArtUsedAndUnused() {
+        BrowseTree browseTree = new BrowseTree(mTestDevice);
+        assertThat(browseTree.getNodesUsingCoverArt(TEST_HANDLE)).isEmpty();
+
+        browseTree.indicateCoverArtUsed(TEST_NODE_ID, TEST_HANDLE);
+
+        assertThat(browseTree.getNodesUsingCoverArt(TEST_HANDLE).get(0)).isEqualTo(TEST_NODE_ID);
+
+        browseTree.indicateCoverArtUnused(TEST_NODE_ID, TEST_HANDLE);
+
+        assertThat(browseTree.getNodesUsingCoverArt(TEST_HANDLE)).isEmpty();
+        assertThat(browseTree.getAndClearUnusedCoverArt().get(0)).isEqualTo(TEST_HANDLE);
+    }
+
+    @Test
+    public void notifyImageDownload() {
+        BrowseTree browseTree = new BrowseTree(null);
+        String testDeviceId = BrowseTree.PLAYER_PREFIX + mTestDevice.getAddress();
+
+        browseTree.onConnected(mTestDevice);
+        browseTree.indicateCoverArtUsed(TEST_NODE_ID, TEST_HANDLE);
+        browseTree.indicateCoverArtUsed(testDeviceId, TEST_HANDLE);
+        Set<BrowseTree.BrowseNode> parents = browseTree.notifyImageDownload(TEST_HANDLE, null);
+
+        assertThat(parents.contains(browseTree.mRootNode)).isTrue();
+    }
+
+    @Test
+    public void getEldestChild_whenNodesAreNotAncestorDescendantRelation() {
+        BrowseTree browseTree = new BrowseTree(null);
+
+        browseTree.onConnected(mTestDevice);
+
+        assertThat(BrowseTree.getEldestChild(browseTree.mNowPlayingNode,
+                browseTree.mRootNode)).isNull();
+    }
+
+    @Test
+    public void getEldestChild_whenNodesAreAncestorDescendantRelation() {
+        BrowseTree browseTree = new BrowseTree(null);
+
+        browseTree.onConnected(mTestDevice);
+
+        assertThat(BrowseTree.getEldestChild(browseTree.mRootNode,
+                browseTree.mRootNode.getChild(0))).isEqualTo(browseTree.mRootNode.getChild(0));
+    }
+
+    @Test
+    public void getNextStepFolder() {
+        BrowseTree browseTree = new BrowseTree(null);
+        BrowseNode nodeOutOfMap = browseTree.new BrowseNode(new AvrcpItem.Builder()
+                .setUuid(ILLEGAL_ID).setTitle(ILLEGAL_ID).setBrowsable(true).build());
+
+        browseTree.onConnected(mTestDevice);
+
+        assertThat(browseTree.getNextStepToFolder(null)).isNull();
+        assertThat(browseTree.getNextStepToFolder(browseTree.mRootNode)).isEqualTo(
+                browseTree.mRootNode);
+        assertThat(browseTree.getNextStepToFolder(browseTree.mRootNode.getChild(0))).isEqualTo(
+                browseTree.mRootNode.getChild(0));
+        assertThat(browseTree.getNextStepToFolder(nodeOutOfMap)).isNull();
+
+        browseTree.setCurrentBrowsedPlayer(BrowseTree.NOW_PLAYING_PREFIX, 2, 1);
+        assertThat(browseTree.getNextStepToFolder(browseTree.mRootNode.getChild(0))).isEqualTo(
+                browseTree.mNavigateUpNode);
+    }
+
+    @Test
+    public void toString_returnsSizeInfo() {
+        BrowseTree browseTree = new BrowseTree(mTestDevice);
+
+        assertThat(browseTree.toString()).isEqualTo("Size: " + browseTree.mBrowseMap.size());
+    }
+}
\ No newline at end of file
diff --git a/android/app/tests/unit/src/com/android/bluetooth/avrcpcontroller/PlayerApplicationSettingsTest.java b/android/app/tests/unit/src/com/android/bluetooth/avrcpcontroller/PlayerApplicationSettingsTest.java
new file mode 100644
index 0000000..b311ddc
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/avrcpcontroller/PlayerApplicationSettingsTest.java
@@ -0,0 +1,144 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.avrcpcontroller;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import android.support.v4.media.session.PlaybackStateCompat;
+
+import androidx.test.filters.SmallTest;
+import androidx.test.runner.AndroidJUnit4;
+
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+@SmallTest
+@RunWith(AndroidJUnit4.class)
+public class PlayerApplicationSettingsTest {
+
+    @Test
+    public void makeSupportedSettings() {
+        byte[] btAvrcpAttributeList = new byte[3];
+        btAvrcpAttributeList[0] = PlayerApplicationSettings.REPEAT_STATUS;
+        btAvrcpAttributeList[1] = 1;
+        btAvrcpAttributeList[2] = PlayerApplicationSettings.JNI_REPEAT_STATUS_ALL_TRACK_REPEAT;
+
+        PlayerApplicationSettings settings = PlayerApplicationSettings.makeSupportedSettings(
+                btAvrcpAttributeList);
+
+        assertThat(settings.supportsSetting(PlayerApplicationSettings.REPEAT_STATUS)).isTrue();
+    }
+
+    @Test
+    public void makeSettings() {
+        byte[] btAvrcpAttributeList = new byte[2];
+        btAvrcpAttributeList[0] = PlayerApplicationSettings.REPEAT_STATUS;
+        btAvrcpAttributeList[1] = PlayerApplicationSettings.JNI_REPEAT_STATUS_GROUP_REPEAT;
+
+        PlayerApplicationSettings settings = PlayerApplicationSettings.makeSettings(
+                btAvrcpAttributeList);
+
+        assertThat(settings.getSetting(PlayerApplicationSettings.REPEAT_STATUS)).isEqualTo(
+                PlaybackStateCompat.REPEAT_MODE_GROUP);
+    }
+
+    @Test
+    public void setSupport() {
+        byte[] btAvrcpAttributeList = new byte[2];
+        btAvrcpAttributeList[0] = PlayerApplicationSettings.REPEAT_STATUS;
+        btAvrcpAttributeList[1] = PlayerApplicationSettings.JNI_REPEAT_STATUS_GROUP_REPEAT;
+        PlayerApplicationSettings settings = PlayerApplicationSettings.makeSettings(
+                btAvrcpAttributeList);
+        PlayerApplicationSettings settingsFromSetSupport = new PlayerApplicationSettings();
+
+        settingsFromSetSupport.setSupport(settings);
+
+        assertThat(settingsFromSetSupport.getSetting(
+                PlayerApplicationSettings.REPEAT_STATUS)).isEqualTo(
+                PlaybackStateCompat.REPEAT_MODE_GROUP);
+    }
+
+    @Test
+    public void mapAttribIdValtoAvrcpPlayerSetting() {
+        assertThat(PlayerApplicationSettings.mapAttribIdValtoAvrcpPlayerSetting(
+                PlayerApplicationSettings.REPEAT_STATUS,
+                PlayerApplicationSettings.JNI_REPEAT_STATUS_ALL_TRACK_REPEAT)).isEqualTo(
+                PlaybackStateCompat.REPEAT_MODE_ALL);
+        assertThat(PlayerApplicationSettings.mapAttribIdValtoAvrcpPlayerSetting(
+                PlayerApplicationSettings.REPEAT_STATUS,
+                PlayerApplicationSettings.JNI_REPEAT_STATUS_GROUP_REPEAT)).isEqualTo(
+                PlaybackStateCompat.REPEAT_MODE_GROUP);
+        assertThat(PlayerApplicationSettings.mapAttribIdValtoAvrcpPlayerSetting(
+                PlayerApplicationSettings.REPEAT_STATUS,
+                PlayerApplicationSettings.JNI_REPEAT_STATUS_OFF)).isEqualTo(
+                PlaybackStateCompat.REPEAT_MODE_NONE);
+        assertThat(PlayerApplicationSettings.mapAttribIdValtoAvrcpPlayerSetting(
+                PlayerApplicationSettings.REPEAT_STATUS,
+                PlayerApplicationSettings.JNI_REPEAT_STATUS_SINGLE_TRACK_REPEAT)).isEqualTo(
+                PlaybackStateCompat.REPEAT_MODE_ONE);
+        assertThat(PlayerApplicationSettings.mapAttribIdValtoAvrcpPlayerSetting(
+                PlayerApplicationSettings.SHUFFLE_STATUS,
+                PlayerApplicationSettings.JNI_SHUFFLE_STATUS_ALL_TRACK_SHUFFLE)).isEqualTo(
+                PlaybackStateCompat.SHUFFLE_MODE_ALL);
+        assertThat(PlayerApplicationSettings.mapAttribIdValtoAvrcpPlayerSetting(
+                PlayerApplicationSettings.SHUFFLE_STATUS,
+                PlayerApplicationSettings.JNI_SHUFFLE_STATUS_GROUP_SHUFFLE)).isEqualTo(
+                PlaybackStateCompat.SHUFFLE_MODE_GROUP);
+        assertThat(PlayerApplicationSettings.mapAttribIdValtoAvrcpPlayerSetting(
+                PlayerApplicationSettings.SHUFFLE_STATUS,
+                PlayerApplicationSettings.JNI_SHUFFLE_STATUS_OFF)).isEqualTo(
+                PlaybackStateCompat.SHUFFLE_MODE_NONE);
+        assertThat(PlayerApplicationSettings.mapAttribIdValtoAvrcpPlayerSetting(
+                PlayerApplicationSettings.JNI_STATUS_INVALID,
+                PlayerApplicationSettings.JNI_STATUS_INVALID)).isEqualTo(
+                PlayerApplicationSettings.JNI_STATUS_INVALID);
+    }
+
+    @Test
+    public void mapAvrcpPlayerSettingstoBTattribVal() {
+        assertThat(PlayerApplicationSettings.mapAvrcpPlayerSettingstoBTattribVal(
+                PlayerApplicationSettings.REPEAT_STATUS,
+                PlaybackStateCompat.REPEAT_MODE_NONE)).isEqualTo(
+                PlayerApplicationSettings.JNI_REPEAT_STATUS_OFF);
+        assertThat(PlayerApplicationSettings.mapAvrcpPlayerSettingstoBTattribVal(
+                PlayerApplicationSettings.REPEAT_STATUS,
+                PlaybackStateCompat.REPEAT_MODE_ONE)).isEqualTo(
+                PlayerApplicationSettings.JNI_REPEAT_STATUS_SINGLE_TRACK_REPEAT);
+        assertThat(PlayerApplicationSettings.mapAvrcpPlayerSettingstoBTattribVal(
+                PlayerApplicationSettings.REPEAT_STATUS,
+                PlaybackStateCompat.REPEAT_MODE_ALL)).isEqualTo(
+                PlayerApplicationSettings.JNI_REPEAT_STATUS_ALL_TRACK_REPEAT);
+        assertThat(PlayerApplicationSettings.mapAvrcpPlayerSettingstoBTattribVal(
+                PlayerApplicationSettings.REPEAT_STATUS,
+                PlaybackStateCompat.REPEAT_MODE_GROUP)).isEqualTo(
+                PlayerApplicationSettings.JNI_REPEAT_STATUS_GROUP_REPEAT);
+        assertThat(PlayerApplicationSettings.mapAvrcpPlayerSettingstoBTattribVal(
+                PlayerApplicationSettings.SHUFFLE_STATUS,
+                PlaybackStateCompat.SHUFFLE_MODE_NONE)).isEqualTo(
+                PlayerApplicationSettings.JNI_SHUFFLE_STATUS_OFF);
+        assertThat(PlayerApplicationSettings.mapAvrcpPlayerSettingstoBTattribVal(
+                PlayerApplicationSettings.SHUFFLE_STATUS,
+                PlaybackStateCompat.SHUFFLE_MODE_ALL)).isEqualTo(
+                PlayerApplicationSettings.JNI_SHUFFLE_STATUS_ALL_TRACK_SHUFFLE);
+        assertThat(PlayerApplicationSettings.mapAvrcpPlayerSettingstoBTattribVal(
+                PlayerApplicationSettings.SHUFFLE_STATUS,
+                PlaybackStateCompat.SHUFFLE_MODE_GROUP)).isEqualTo(
+                PlayerApplicationSettings.JNI_SHUFFLE_STATUS_GROUP_SHUFFLE);
+        assertThat(PlayerApplicationSettings.mapAvrcpPlayerSettingstoBTattribVal(-1, -1)).isEqualTo(
+                PlayerApplicationSettings.JNI_STATUS_INVALID);
+    }
+}
\ No newline at end of file
diff --git a/android/app/tests/unit/src/com/android/bluetooth/avrcpcontroller/StackEventTest.java b/android/app/tests/unit/src/com/android/bluetooth/avrcpcontroller/StackEventTest.java
new file mode 100644
index 0000000..3f3083b
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/avrcpcontroller/StackEventTest.java
@@ -0,0 +1,65 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.avrcpcontroller;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import androidx.test.filters.SmallTest;
+import androidx.test.runner.AndroidJUnit4;
+
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+@SmallTest
+@RunWith(AndroidJUnit4.class)
+public class StackEventTest {
+
+    @Test
+    public void connectionStateChanged() {
+        boolean remoteControlConnected = true;
+        boolean browsingConnected = true;
+
+        StackEvent stackEvent = StackEvent.connectionStateChanged(remoteControlConnected,
+                browsingConnected);
+
+        assertThat(stackEvent.mType).isEqualTo(StackEvent.EVENT_TYPE_CONNECTION_STATE_CHANGED);
+        assertThat(stackEvent.mRemoteControlConnected).isTrue();
+        assertThat(stackEvent.mBrowsingConnected).isTrue();
+        assertThat(stackEvent.toString()).isEqualTo(
+                "EVENT_TYPE_CONNECTION_STATE_CHANGED " + remoteControlConnected);
+    }
+
+    @Test
+    public void rcFeatures() {
+        int features = 3;
+
+        StackEvent stackEvent = StackEvent.rcFeatures(features);
+
+        assertThat(stackEvent.mType).isEqualTo(StackEvent.EVENT_TYPE_RC_FEATURES);
+        assertThat(stackEvent.mFeatures).isEqualTo(features);
+        assertThat(stackEvent.toString()).isEqualTo("EVENT_TYPE_RC_FEATURES");
+    }
+
+    @Test
+    public void toString_whenEventTypeNone() {
+        StackEvent stackEvent = StackEvent.rcFeatures(1);
+
+        stackEvent.mType = StackEvent.EVENT_TYPE_NONE;
+
+        assertThat(stackEvent.toString()).isEqualTo("Unknown");
+    }
+}
\ No newline at end of file
diff --git a/android/app/tests/unit/src/com/android/bluetooth/avrcpcontroller/bip/BipAttachmentFormatTest.java b/android/app/tests/unit/src/com/android/bluetooth/avrcpcontroller/bip/BipAttachmentFormatTest.java
index 6872780..feb6308 100644
--- a/android/app/tests/unit/src/com/android/bluetooth/avrcpcontroller/bip/BipAttachmentFormatTest.java
+++ b/android/app/tests/unit/src/com/android/bluetooth/avrcpcontroller/bip/BipAttachmentFormatTest.java
@@ -48,7 +48,7 @@
 
     private void testParse(String contentType, String charset, String name, String size,
             String created, String modified, Date expectedCreated, boolean isCreatedUtc,
-                Date expectedModified, boolean isModifiedUtc) {
+            Date expectedModified, boolean isModifiedUtc) {
         int expectedSize = (size != null ? Integer.parseInt(size) : -1);
         BipAttachmentFormat attachment = new BipAttachmentFormat(contentType, charset, name,
                 size, created, modified);
@@ -190,21 +190,21 @@
         BipAttachmentFormat attachment = null;
 
         String expected = "<attachment content-type=\"text/plain\" charset=\"ISO-8859-1\""
-                          + " name=\"thisisatextfile.txt\" size=\"2048\""
-                          + " created=\"19900101T123456\" modified=\"19900101T123456\" />";
+                + " name=\"thisisatextfile.txt\" size=\"2048\""
+                + " created=\"19900101T123456\" modified=\"19900101T123456\" />";
 
         String expectedUtc = "<attachment content-type=\"text/plain\" charset=\"ISO-8859-1\""
-                          + " name=\"thisisatextfile.txt\" size=\"2048\""
-                          + " created=\"19900101T123456Z\" modified=\"19900101T123456Z\" />";
+                + " name=\"thisisatextfile.txt\" size=\"2048\""
+                + " created=\"19900101T123456Z\" modified=\"19900101T123456Z\" />";
 
         String expectedNoDates = "<attachment content-type=\"text/plain\" charset=\"ISO-8859-1\""
-                          + " name=\"thisisatextfile.txt\" size=\"2048\" />";
+                + " name=\"thisisatextfile.txt\" size=\"2048\" />";
 
         String expectedNoSizeNoDates = "<attachment content-type=\"text/plain\""
-                          + " charset=\"ISO-8859-1\" name=\"thisisatextfile.txt\" />";
+                + " charset=\"ISO-8859-1\" name=\"thisisatextfile.txt\" />";
 
         String expectedNoCharsetNoDates = "<attachment content-type=\"text/plain\""
-                          + " name=\"thisisatextfile.txt\" size=\"2048\" />";
+                + " name=\"thisisatextfile.txt\" size=\"2048\" />";
 
         String expectedRequiredOnly = "<attachment content-type=\"text/plain\""
                 + " name=\"thisisatextfile.txt\" />";
@@ -289,4 +289,31 @@
                 null);
         Assert.assertEquals(expectedRequiredOnly, attachment.toString());
     }
+
+    @Test
+    public void testEquals_withSameInstance() {
+        BipAttachmentFormat attachment = new BipAttachmentFormat("text/plain", null,
+                "thisisatextfile.txt", -1, null, null);
+
+        Assert.assertTrue(attachment.equals(attachment));
+    }
+
+    @Test
+    public void testEquals_withDifferentClass() {
+        BipAttachmentFormat attachment = new BipAttachmentFormat("text/plain", null,
+                "thisisatextfile.txt", -1, null, null);
+        String notAttachment = "notAttachment";
+
+        Assert.assertFalse(attachment.equals(notAttachment));
+    }
+
+    @Test
+    public void testEquals_withSameInfo() {
+        BipAttachmentFormat attachment = new BipAttachmentFormat("text/plain", null,
+                "thisisatextfile.txt", -1, null, null);
+        BipAttachmentFormat attachmentEqual = new BipAttachmentFormat("text/plain", null,
+                "thisisatextfile.txt", -1, null, null);
+
+        Assert.assertTrue(attachment.equals(attachmentEqual));
+    }
 }
diff --git a/android/app/tests/unit/src/com/android/bluetooth/avrcpcontroller/bip/BipDatetimeTest.java b/android/app/tests/unit/src/com/android/bluetooth/avrcpcontroller/bip/BipDatetimeTest.java
index 571360d..958e1c4 100644
--- a/android/app/tests/unit/src/com/android/bluetooth/avrcpcontroller/bip/BipDatetimeTest.java
+++ b/android/app/tests/unit/src/com/android/bluetooth/avrcpcontroller/bip/BipDatetimeTest.java
@@ -53,9 +53,9 @@
         cal.setTime(makeDate(month, day, year, hours, min, sec));
         cal.setTimeZone(TimeZone.getDefault());
         return String.format(Locale.US, "%04d%02d%02dT%02d%02d%02d", cal.get(Calendar.YEAR),
-                    cal.get(Calendar.MONTH) + 1, cal.get(Calendar.DATE),
-                    cal.get(Calendar.HOUR_OF_DAY), cal.get(Calendar.MINUTE),
-                    cal.get(Calendar.SECOND));
+                cal.get(Calendar.MONTH) + 1, cal.get(Calendar.DATE),
+                cal.get(Calendar.HOUR_OF_DAY), cal.get(Calendar.MINUTE),
+                cal.get(Calendar.SECOND));
     }
 
     private void testParse(String date, Date expectedDate, boolean isUtc, String expectedStr) {
@@ -176,4 +176,37 @@
         testCreate(makeDate(1, 1, 2000, 23, 59, 59, utc), "20000101T235959Z");
         testCreate(makeDate(11, 27, 2050, 23, 59, 59, utc), "20501127T235959Z");
     }
+
+    @Test
+    public void testEquals_withSameInstance() {
+        TimeZone utc = TimeZone.getTimeZone("UTC");
+        utc.setRawOffset(0);
+
+        BipDateTime bipDate = new BipDateTime(makeDate(1, 1, 2000, 6, 1, 15, utc));
+
+        Assert.assertTrue(bipDate.equals(bipDate));
+    }
+
+    @Test
+    public void testEquals_withDifferentClass() {
+        TimeZone utc = TimeZone.getTimeZone("UTC");
+        utc.setRawOffset(0);
+
+        BipDateTime bipDate = new BipDateTime(makeDate(1, 1, 2000, 6, 1, 15, utc));
+        String notBipDate = "notBipDate";
+
+        Assert.assertFalse(bipDate.equals(notBipDate));
+    }
+
+    @Test
+    public void testEquals_withSameInfo() {
+        TimeZone utc = TimeZone.getTimeZone("UTC");
+        utc.setRawOffset(0);
+        Date date = makeDate(1, 1, 2000, 6, 1, 15, utc);
+
+        BipDateTime bipDate = new BipDateTime(date);
+        BipDateTime bipDateEqual = new BipDateTime(date);
+
+        Assert.assertTrue(bipDate.equals(bipDateEqual));
+    }
 }
diff --git a/android/app/tests/unit/src/com/android/bluetooth/avrcpcontroller/bip/BipImageDescriptorTest.java b/android/app/tests/unit/src/com/android/bluetooth/avrcpcontroller/bip/BipImageDescriptorTest.java
index 72aff6c..2a12b1a 100644
--- a/android/app/tests/unit/src/com/android/bluetooth/avrcpcontroller/bip/BipImageDescriptorTest.java
+++ b/android/app/tests/unit/src/com/android/bluetooth/avrcpcontroller/bip/BipImageDescriptorTest.java
@@ -216,4 +216,34 @@
         BipImageDescriptor descriptor = builder.build();
         Assert.assertEquals(null, descriptor.toString());
     }
+
+    @Test
+    public void testEquals_sameInstance() {
+        BipImageDescriptor.Builder builder = new BipImageDescriptor.Builder();
+
+        BipImageDescriptor descriptor = builder.build();
+
+        Assert.assertTrue(descriptor.equals(descriptor));
+    }
+
+    @Test
+    public void testEquals_differentClass() {
+        BipImageDescriptor.Builder builder = new BipImageDescriptor.Builder();
+
+        BipImageDescriptor descriptor = builder.build();
+        String notDescriptor = "notDescriptor";
+
+        Assert.assertFalse(descriptor.equals(notDescriptor));
+    }
+
+    @Test
+    public void testEquals_sameInfo() {
+        BipImageDescriptor.Builder builder = new BipImageDescriptor.Builder();
+        BipImageDescriptor.Builder builderEqual = new BipImageDescriptor.Builder();
+
+        BipImageDescriptor descriptor = builder.build();
+        BipImageDescriptor descriptorEqual = builderEqual.build();
+
+        Assert.assertTrue(descriptor.equals(descriptorEqual));
+    }
 }
diff --git a/android/app/tests/unit/src/com/android/bluetooth/avrcpcontroller/bip/BipImageFormatTest.java b/android/app/tests/unit/src/com/android/bluetooth/avrcpcontroller/bip/BipImageFormatTest.java
index 175ceb9..d5d6bdf 100644
--- a/android/app/tests/unit/src/com/android/bluetooth/avrcpcontroller/bip/BipImageFormatTest.java
+++ b/android/app/tests/unit/src/com/android/bluetooth/avrcpcontroller/bip/BipImageFormatTest.java
@@ -273,4 +273,32 @@
         BipImageFormat format = BipImageFormat.createNative(new BipEncoding(BipEncoding.JPEG, null),
                 null, -1);
     }
+
+    @Test
+    public void testEquals_withSameInstance() {
+        BipImageFormat format = BipImageFormat.createNative(
+                new BipEncoding(BipEncoding.JPEG, null), BipPixel.createFixed(1280, 1024), -1);
+
+        Assert.assertTrue(format.equals(format));
+    }
+
+    @Test
+    public void testEquals_withDifferentClass() {
+        BipImageFormat format = BipImageFormat.createNative(
+                new BipEncoding(BipEncoding.JPEG, null), BipPixel.createFixed(1280, 1024), -1);
+        String notFormat = "notFormat";
+
+        Assert.assertFalse(format.equals(notFormat));
+    }
+
+    @Test
+    public void testEquals_withSameInfo() {
+        BipEncoding encoding = new BipEncoding(BipEncoding.JPEG, null);
+        BipPixel pixel = BipPixel.createFixed(1280, 1024);
+
+        BipImageFormat format = BipImageFormat.createNative(encoding, pixel, -1);
+        BipImageFormat formatEqual = BipImageFormat.createNative(encoding, pixel, -1);
+
+        Assert.assertTrue(format.equals(formatEqual));
+    }
 }
diff --git a/android/app/tests/unit/src/com/android/bluetooth/avrcpcontroller/bip/RequestGetImagePropertiesTest.java b/android/app/tests/unit/src/com/android/bluetooth/avrcpcontroller/bip/RequestGetImagePropertiesTest.java
new file mode 100644
index 0000000..d795dca
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/avrcpcontroller/bip/RequestGetImagePropertiesTest.java
@@ -0,0 +1,48 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.avrcpcontroller;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import androidx.test.filters.SmallTest;
+import androidx.test.runner.AndroidJUnit4;
+
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+@SmallTest
+@RunWith(AndroidJUnit4.class)
+public class RequestGetImagePropertiesTest {
+    private static final String TEST_IMAGE_HANDLE = "test_image_handle";
+
+    @Test
+    public void constructor() {
+        RequestGetImageProperties requestGetImageProperties = new RequestGetImageProperties(
+                TEST_IMAGE_HANDLE);
+
+        assertThat(requestGetImageProperties.getImageHandle()).isEqualTo(TEST_IMAGE_HANDLE);
+    }
+
+    @Test
+    public void getType() {
+        RequestGetImageProperties requestGetImageProperties = new RequestGetImageProperties(
+                TEST_IMAGE_HANDLE);
+
+        assertThat(requestGetImageProperties.getType()).isEqualTo(
+                BipRequest.TYPE_GET_IMAGE_PROPERTIES);
+    }
+}
\ No newline at end of file
diff --git a/android/app/tests/unit/src/com/android/bluetooth/avrcpcontroller/bip/RequestGetImageTest.java b/android/app/tests/unit/src/com/android/bluetooth/avrcpcontroller/bip/RequestGetImageTest.java
new file mode 100644
index 0000000..8f55832
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/avrcpcontroller/bip/RequestGetImageTest.java
@@ -0,0 +1,63 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.avrcpcontroller;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import androidx.test.filters.SmallTest;
+import androidx.test.runner.AndroidJUnit4;
+
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+@SmallTest
+@RunWith(AndroidJUnit4.class)
+public class RequestGetImageTest {
+    private static final String TEST_IMAGE_HANDLE = "test_image_handle";
+    private static final String sXmlDocDecl =
+            "<?xml version='1.0' encoding='UTF-8' standalone='yes' ?>\r\n";
+
+    @Test
+    public void constructor_withDescriptorNotNull() {
+        BipImageDescriptor.Builder builder = new BipImageDescriptor.Builder();
+        builder.setEncoding(BipEncoding.JPEG);
+        builder.setFixedDimensions(1280, 960);
+        BipImageDescriptor descriptor = builder.build();
+
+        RequestGetImage requestGetImage = new RequestGetImage(TEST_IMAGE_HANDLE, descriptor);
+
+        String expected = sXmlDocDecl + "<image-descriptor version=\"1.0\">\r\n"
+                + "  <image encoding=\"JPEG\" pixel=\"1280*960\" />\r\n"
+                + "</image-descriptor>";
+        assertThat(requestGetImage.getImageHandle()).isEqualTo(TEST_IMAGE_HANDLE);
+        assertThat(requestGetImage.mImageDescriptor.toString()).isEqualTo(expected);
+    }
+
+    @Test
+    public void constructor_withDescriptorNull() {
+        RequestGetImage requestGetImage = new RequestGetImage(TEST_IMAGE_HANDLE, null);
+
+        assertThat(requestGetImage.getImageHandle()).isEqualTo(TEST_IMAGE_HANDLE);
+    }
+
+    @Test
+    public void getType() {
+        RequestGetImage requestGetImage = new RequestGetImage(TEST_IMAGE_HANDLE, null);
+
+        assertThat(requestGetImage.getType()).isEqualTo(BipRequest.TYPE_GET_IMAGE);
+    }
+}
\ No newline at end of file
diff --git a/android/app/tests/unit/src/com/android/bluetooth/bas/BatteryServiceBinderTest.java b/android/app/tests/unit/src/com/android/bluetooth/bas/BatteryServiceBinderTest.java
new file mode 100644
index 0000000..91b6af8
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/bas/BatteryServiceBinderTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.bas;
+
+import static org.mockito.Mockito.verify;
+
+import android.bluetooth.BluetoothAdapter;
+import android.bluetooth.BluetoothDevice;
+import android.bluetooth.BluetoothProfile;
+import android.content.AttributionSource;
+
+import com.android.bluetooth.TestUtils;
+import com.android.bluetooth.x.com.android.modules.utils.SynchronousResultReceiver;
+
+import org.junit.After;
+import org.junit.Before;
+import org.junit.Test;
+import org.mockito.Mock;
+import org.mockito.MockitoAnnotations;
+
+import java.util.List;
+
+public class BatteryServiceBinderTest {
+    @Mock
+    private BatteryService mService;
+    private BatteryService.BluetoothBatteryBinder mBinder;
+    private BluetoothAdapter mAdapter;
+
+    @Before
+    public void setUp() throws Exception {
+        MockitoAnnotations.initMocks(this);
+        mAdapter = BluetoothAdapter.getDefaultAdapter();
+        mBinder = new BatteryService.BluetoothBatteryBinder(mService);
+    }
+
+    @After
+    public void cleaUp() {
+        mBinder.cleanup();
+    }
+
+    @Test
+    public void connect() {
+        BluetoothDevice device = TestUtils.getTestDevice(mAdapter, 0);
+        AttributionSource source = new AttributionSource.Builder(0).build();
+        final SynchronousResultReceiver<Boolean> recv = SynchronousResultReceiver.get();
+
+        mBinder.connect(device, source, recv);
+        verify(mService).connect(device);
+    }
+
+    @Test
+    public void disconnect() {
+        BluetoothDevice device = TestUtils.getTestDevice(mAdapter, 0);
+        AttributionSource source = new AttributionSource.Builder(0).build();
+        final SynchronousResultReceiver<Boolean> recv = SynchronousResultReceiver.get();
+
+        mBinder.disconnect(device, source, recv);
+        verify(mService).disconnect(device);
+    }
+
+    @Test
+    public void getConnectedDevices() {
+        AttributionSource source = new AttributionSource.Builder(0).build();
+        final SynchronousResultReceiver<List<BluetoothDevice>> recv =
+                SynchronousResultReceiver.get();
+        mBinder.getConnectedDevices(source, recv);
+        verify(mService).getConnectedDevices();
+    }
+
+    @Test
+    public void getDevicesMatchingConnectionStates() {
+        int[] states = new int[] { BluetoothProfile.STATE_CONNECTED };
+        AttributionSource source = new AttributionSource.Builder(0).build();
+        final SynchronousResultReceiver<List<BluetoothDevice>> recv =
+                SynchronousResultReceiver.get();
+
+        mBinder.getDevicesMatchingConnectionStates(states, source, recv);
+        verify(mService).getDevicesMatchingConnectionStates(states);
+    }
+
+    @Test
+    public void getConnectionState() {
+        BluetoothDevice device = TestUtils.getTestDevice(mAdapter, 0);
+        AttributionSource source = new AttributionSource.Builder(0).build();
+        final SynchronousResultReceiver<List<BluetoothDevice>> recv =
+                SynchronousResultReceiver.get();
+
+        mBinder.getConnectionState(device, source, recv);
+        verify(mService).getConnectionState(device);
+    }
+
+    @Test
+    public void setConnectionPolicy() {
+        BluetoothDevice device = TestUtils.getTestDevice(mAdapter, 0);
+        int connectionPolicy = BluetoothProfile.CONNECTION_POLICY_ALLOWED;
+        AttributionSource source = new AttributionSource.Builder(0).build();
+        final SynchronousResultReceiver<Boolean> recv = SynchronousResultReceiver.get();
+
+        mBinder.setConnectionPolicy(device, connectionPolicy, source, recv);
+        verify(mService).setConnectionPolicy(device, connectionPolicy);
+    }
+
+    @Test
+    public void getConnectionPolicy() {
+        BluetoothDevice device = TestUtils.getTestDevice(mAdapter, 0);
+        AttributionSource source = new AttributionSource.Builder(0).build();
+        final SynchronousResultReceiver<Integer> recv = SynchronousResultReceiver.get();
+
+        mBinder.getConnectionPolicy(device, source, recv);
+        verify(mService).getConnectionPolicy(device);
+    }
+}
diff --git a/android/app/tests/unit/src/com/android/bluetooth/bas/BatteryServiceTest.java b/android/app/tests/unit/src/com/android/bluetooth/bas/BatteryServiceTest.java
index ef909ac..e4a706d 100644
--- a/android/app/tests/unit/src/com/android/bluetooth/bas/BatteryServiceTest.java
+++ b/android/app/tests/unit/src/com/android/bluetooth/bas/BatteryServiceTest.java
@@ -211,7 +211,7 @@
      * Test that an outgoing connection to device
      */
     @Test
-    public void testConnect() {
+    public void testConnectAndDump() {
         // Update the device policy so okToConnect() returns true
         when(mAdapterService.getDatabase()).thenReturn(mDatabaseManager);
         when(mDatabaseManager
@@ -222,6 +222,9 @@
                 .getRemoteUuids(any(BluetoothDevice.class));
         // Send a connect request
         Assert.assertTrue("Connect expected to succeed", mService.connect(mDevice));
+
+        // Test dump() is not crashed.
+        mService.dump(new StringBuilder());
     }
 
     /**
@@ -239,6 +242,31 @@
         Assert.assertFalse("Connect expected to fail", mService.connect(mDevice));
     }
 
+    @Test
+    public void getConnectionState_whenNoDevicesAreConnected_returnsDisconnectedState() {
+        Assert.assertEquals(mService.getConnectionState(mDevice),
+                BluetoothProfile.STATE_DISCONNECTED);
+    }
+
+    @Test
+    public void getDevices_whenNoDevicesAreConnected_returnsEmptyList() {
+        Assert.assertTrue(mService.getDevices().isEmpty());
+    }
+
+    @Test
+    public void getDevicesMatchingConnectionStates() {
+        when(mAdapterService.getBondedDevices()).thenReturn(new BluetoothDevice[] {mDevice});
+        int states[] = new int[] {BluetoothProfile.STATE_DISCONNECTED};
+
+        Assert.assertTrue(mService.getDevicesMatchingConnectionStates(states).contains(mDevice));
+    }
+
+    @Test
+    public void setConnectionPolicy() {
+        Assert.assertTrue(mService.setConnectionPolicy(
+                mDevice, BluetoothProfile.CONNECTION_POLICY_FORBIDDEN));
+    }
+
     /**
      *  Helper function to test okToConnect() method
      *
diff --git a/android/app/tests/unit/src/com/android/bluetooth/bas/BatteryStateMachineTest.java b/android/app/tests/unit/src/com/android/bluetooth/bas/BatteryStateMachineTest.java
index f6c3f79..e580a52 100644
--- a/android/app/tests/unit/src/com/android/bluetooth/bas/BatteryStateMachineTest.java
+++ b/android/app/tests/unit/src/com/android/bluetooth/bas/BatteryStateMachineTest.java
@@ -18,6 +18,8 @@
 
 import static android.bluetooth.BluetoothGatt.GATT_SUCCESS;
 
+import static com.google.common.truth.Truth.assertThat;
+
 import static org.junit.Assert.assertNotNull;
 import static org.junit.Assert.assertNull;
 import static org.junit.Assert.fail;
@@ -32,6 +34,7 @@
 
 import android.bluetooth.BluetoothAdapter;
 import android.bluetooth.BluetoothDevice;
+import android.bluetooth.BluetoothGatt;
 import android.bluetooth.BluetoothProfile;
 import android.content.Context;
 import android.os.HandlerThread;
@@ -190,6 +193,72 @@
     }
 
     @Test
+    public void testConnectedStateChanges() {
+        allowConnection(true);
+        allowConnectGatt(true);
+
+        // Connected -> CONNECT
+        reconnect();
+
+        mBatteryStateMachine.sendMessage(BatteryStateMachine.CONNECT);
+
+        assertThat(mBatteryStateMachine.getCurrentState())
+                .isInstanceOf(BatteryStateMachine.Connected.class);
+
+        // Connected -> DISCONNECT
+        reconnect();
+
+        mBatteryStateMachine.sendMessage(BatteryStateMachine.DISCONNECT);
+
+        TestUtils.waitForLooperToFinishScheduledTask(mBatteryStateMachine.getHandler().getLooper());
+
+        mBatteryStateMachine.notifyConnectionStateChanged(
+                GATT_SUCCESS, BluetoothProfile.STATE_DISCONNECTED);
+
+        assertThat(mBatteryStateMachine.getCurrentState())
+                .isInstanceOf(BatteryStateMachine.Disconnected.class);
+
+        // Connected -> STATE_DISCONNECTED
+        reconnect();
+
+        mBatteryStateMachine.sendMessage(
+                BatteryStateMachine.CONNECTION_STATE_CHANGED, BluetoothGatt.STATE_DISCONNECTED);
+
+        TestUtils.waitForLooperToFinishScheduledTask(mBatteryStateMachine.getHandler().getLooper());
+
+        mBatteryStateMachine.notifyConnectionStateChanged(
+                GATT_SUCCESS, BluetoothProfile.STATE_DISCONNECTED);
+
+        // Connected -> STATE_CONNECTED
+        reconnect();
+
+        mBatteryStateMachine.sendMessage(
+                BatteryStateMachine.CONNECTION_STATE_CHANGED, BluetoothGatt.STATE_CONNECTED);
+
+        assertThat(mBatteryStateMachine.getCurrentState())
+                .isInstanceOf(BatteryStateMachine.Connected.class);
+
+        // Connected -> ILLEGAL_STATE
+        reconnect();
+
+        int badState = -1;
+        mBatteryStateMachine.sendMessage(
+                BatteryStateMachine.CONNECTION_STATE_CHANGED, badState);
+
+        assertThat(mBatteryStateMachine.getCurrentState())
+                .isInstanceOf(BatteryStateMachine.Connected.class);
+
+        // Connected -> NOT_HANDLED
+        reconnect();
+
+        int notHandled = -1;
+        mBatteryStateMachine.sendMessage(notHandled);
+
+        assertThat(mBatteryStateMachine.getCurrentState())
+                .isInstanceOf(BatteryStateMachine.Connected.class);
+    }
+
+    @Test
     public void testConnectGattTimeout() {
         allowConnection(true);
         allowConnectGatt(true);
@@ -244,6 +313,18 @@
                 .handleBatteryChanged(any(BluetoothDevice.class), anyInt());
     }
 
+    private void reconnect() {
+        // Inject an event for when incoming connection is requested
+        mBatteryStateMachine.sendMessage(BatteryStateMachine.CONNECT);
+
+        TestUtils.waitForLooperToFinishScheduledTask(mBatteryStateMachine.getHandler().getLooper());
+
+        mBatteryStateMachine.notifyConnectionStateChanged(
+                GATT_SUCCESS, BluetoothProfile.STATE_CONNECTED);
+
+        TestUtils.waitForLooperToFinishScheduledTask(mBatteryStateMachine.getHandler().getLooper());
+    }
+
     // It simulates GATT connection for testing.
     public class StubBatteryStateMachine extends BatteryStateMachine {
         boolean mShouldAllowGatt = true;
diff --git a/android/app/tests/unit/src/com/android/bluetooth/bass_client/BaseDataTest.java b/android/app/tests/unit/src/com/android/bluetooth/bass_client/BaseDataTest.java
new file mode 100644
index 0000000..578ea57
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/bass_client/BaseDataTest.java
@@ -0,0 +1,99 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.bass_client;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import static org.junit.Assert.assertThrows;
+
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.junit.runners.JUnit4;
+
+import java.util.LinkedHashSet;
+import java.util.Set;
+
+@RunWith(JUnit4.class)
+public class BaseDataTest {
+
+    @Test
+    public void baseInformation() {
+        BaseData.BaseInformation info = new BaseData.BaseInformation();
+        assertThat(info.presentationDelay.length).isEqualTo(3);
+        assertThat(info.codecId.length).isEqualTo(5);
+
+        assertThat(info.isCodecIdUnknown()).isFalse();
+        info.codecId[4] = (byte) 0xFE;
+        assertThat(info.isCodecIdUnknown()).isTrue();
+
+        // info.print() with different combination shouldn't crash.
+        info.print();
+
+        info.level = 1;
+        info.codecConfigLength = 1;
+        info.print();
+
+        info.level = 2;
+        info.metaDataLength = 1;
+        info.keyMetadataDiff.add("metadata-diff");
+        info.keyCodecCfgDiff.add("cfg-diff");
+        info.print();
+
+        info.level = 3;
+        info.print();
+    }
+
+    @Test
+    public void parseBaseData() {
+        assertThrows(IllegalArgumentException.class, () -> BaseData.parseBaseData(null));
+
+        byte[] serviceData = new byte[] {
+                // LEVEL 1
+                (byte) 0x01, (byte) 0x02, (byte) 0x03, // presentationDelay
+                (byte) 0x01,  // numSubGroups
+                // LEVEL 2
+                (byte) 0x01,  // numSubGroups
+                (byte) 0xFE,  // UNKNOWN_CODEC
+                (byte) 0x02,  // codecConfigLength
+                (byte) 0x01, (byte) 'A', // codecConfigInfo
+                (byte) 0x03,  // metaDataLength
+                (byte) 0x06, (byte) 0x07, (byte) 0x08,  // metaData
+                // LEVEL 3
+                (byte) 0x04,  // index
+                (byte) 0x03,  // codecConfigLength
+                (byte) 0x02, (byte) 'B', (byte) 'C' // codecConfigInfo
+        };
+
+        BaseData data = BaseData.parseBaseData(serviceData);
+        BaseData.BaseInformation level = data.getLevelOne();
+        assertThat(level.presentationDelay).isEqualTo(new byte[] { 0x01, 0x02, 0x03 });
+        assertThat(level.numSubGroups).isEqualTo(1);
+
+        assertThat(data.getLevelTwo().size()).isEqualTo(1);
+        level = data.getLevelTwo().get(0);
+
+        assertThat(level.numSubGroups).isEqualTo(1);
+        assertThat(level.isCodecIdUnknown()).isTrue();
+        assertThat(level.codecConfigLength).isEqualTo(2);
+        assertThat(level.metaDataLength).isEqualTo(3);
+
+        assertThat(data.getLevelThree().size()).isEqualTo(1);
+        level = data.getLevelThree().get(0);
+        assertThat(level.index).isEqualTo(4);
+        assertThat(level.codecConfigLength).isEqualTo(3);
+    }
+}
diff --git a/android/app/tests/unit/src/com/android/bluetooth/bass_client/BassClientServiceTest.java b/android/app/tests/unit/src/com/android/bluetooth/bass_client/BassClientServiceTest.java
index 55905a7..60ce730 100644
--- a/android/app/tests/unit/src/com/android/bluetooth/bass_client/BassClientServiceTest.java
+++ b/android/app/tests/unit/src/com/android/bluetooth/bass_client/BassClientServiceTest.java
@@ -20,22 +20,43 @@
 
 import static org.mockito.ArgumentMatchers.eq;
 import static org.mockito.Mockito.any;
+import static org.mockito.Mockito.atLeast;
 import static org.mockito.Mockito.anyString;
+import static org.mockito.Mockito.after;
+import static org.mockito.Mockito.clearInvocations;
 import static org.mockito.Mockito.doAnswer;
+import static org.mockito.Mockito.doCallRealMethod;
 import static org.mockito.Mockito.doReturn;
 import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.never;
 import static org.mockito.Mockito.notNull;
+import static org.mockito.Mockito.times;
 import static org.mockito.Mockito.verify;
 import static org.mockito.Mockito.when;
 
 import android.bluetooth.BluetoothAdapter;
 import android.bluetooth.BluetoothDevice;
+import android.bluetooth.BluetoothLeAudioCodecConfigMetadata;
+import android.bluetooth.BluetoothLeAudioContentMetadata;
+import android.bluetooth.BluetoothLeBroadcast;
+import android.bluetooth.BluetoothLeBroadcastAssistant;
+import android.bluetooth.BluetoothLeBroadcastChannel;
+import android.bluetooth.BluetoothLeBroadcastMetadata;
+import android.bluetooth.BluetoothLeBroadcastReceiveState;
+import android.bluetooth.BluetoothLeBroadcastSubgroup;
 import android.bluetooth.BluetoothProfile;
+import android.bluetooth.BluetoothStatusCodes;
 import android.bluetooth.BluetoothUuid;
+import android.bluetooth.IBluetoothLeBroadcastAssistantCallback;
 import android.bluetooth.le.ScanFilter;
+import android.content.BroadcastReceiver;
 import android.content.Context;
+import android.content.Intent;
+import android.content.IntentFilter;
+import android.os.Binder;
+import android.os.Message;
 import android.os.ParcelUuid;
+import android.os.RemoteException;
 
 import androidx.test.InstrumentationRegistry;
 import androidx.test.filters.MediumTest;
@@ -44,7 +65,9 @@
 
 import com.android.bluetooth.TestUtils;
 import com.android.bluetooth.btservice.AdapterService;
+import com.android.bluetooth.btservice.ServiceFactory;
 import com.android.bluetooth.btservice.storage.DatabaseManager;
+import com.android.bluetooth.csip.CsipSetCoordinatorService;
 
 import org.junit.After;
 import org.junit.Assert;
@@ -52,14 +75,19 @@
 import org.junit.Rule;
 import org.junit.Test;
 import org.junit.runner.RunWith;
+import org.mockito.ArgumentCaptor;
 import org.mockito.Mock;
 import org.mockito.MockitoAnnotations;
 import org.mockito.Spy;
 
+import java.util.Arrays;
 import java.util.ArrayList;
 import java.util.HashMap;
 import java.util.List;
+import java.util.Optional;
 import java.util.Set;
+import java.util.stream.Collectors;
+import java.util.concurrent.LinkedBlockingQueue;
 
 /**
  * Tests for {@link BassClientService}
@@ -67,16 +95,47 @@
 @MediumTest
 @RunWith(AndroidJUnit4.class)
 public class BassClientServiceTest {
+    private final String mFlagDexmarker = System.getProperty("dexmaker.share_classloader", "false");
+
+    private static final int TIMEOUT_MS = 1000;
+
     private static final int MAX_HEADSET_CONNECTIONS = 5;
     private static final ParcelUuid[] FAKE_SERVICE_UUIDS = {BluetoothUuid.BASS};
     private static final int ASYNC_CALL_TIMEOUT_MILLIS = 250;
 
+    private static final String TEST_MAC_ADDRESS = "00:11:22:33:44:55";
+    private static final int TEST_BROADCAST_ID = 42;
+    private static final int TEST_ADVERTISER_SID = 1234;
+    private static final int TEST_PA_SYNC_INTERVAL = 100;
+    private static final int TEST_PRESENTATION_DELAY_MS = 345;
+
+    private static final int TEST_CODEC_ID = 42;
+    private static final int TEST_CHANNEL_INDEX = 56;
+
+    // For BluetoothLeAudioCodecConfigMetadata
+    private static final long TEST_AUDIO_LOCATION_FRONT_LEFT = 0x01;
+    private static final long TEST_AUDIO_LOCATION_FRONT_RIGHT = 0x02;
+
+    // For BluetoothLeAudioContentMetadata
+    private static final String TEST_PROGRAM_INFO = "Test";
+    // German language code in ISO 639-3
+    private static final String TEST_LANGUAGE = "deu";
+    private static final int TEST_SOURCE_ID = 10;
+    private static final int TEST_NUM_SOURCES = 2;
+
+
+    private static final int TEST_MAX_NUM_DEVICES = 3;
+
     private final HashMap<BluetoothDevice, BassClientStateMachine> mStateMachines = new HashMap<>();
+    private final List<BassClientStateMachine> mStateMachinePool = new ArrayList<>();
+    private HashMap<BluetoothDevice, LinkedBlockingQueue<Intent>> mIntentQueue;
 
     private Context mTargetContext;
     private BassClientService mBassClientService;
     private BluetoothAdapter mBluetoothAdapter;
     private BluetoothDevice mCurrentDevice;
+    private BluetoothDevice mCurrentDevice1;
+    private BassIntentReceiver mBassIntentReceiver;
 
     @Rule public final ServiceTestRule mServiceRule = new ServiceTestRule();
 
@@ -84,9 +143,61 @@
     @Mock private AdapterService mAdapterService;
     @Mock private DatabaseManager mDatabaseManager;
     @Mock private BluetoothLeScannerWrapper mBluetoothLeScannerWrapper;
+    @Mock private ServiceFactory mServiceFactory;
+    @Mock private CsipSetCoordinatorService mCsipService;
+    @Mock private IBluetoothLeBroadcastAssistantCallback mCallback;
+    @Mock private Binder mBinder;
+
+    BluetoothLeBroadcastSubgroup createBroadcastSubgroup() {
+        BluetoothLeAudioCodecConfigMetadata codecMetadata =
+                new BluetoothLeAudioCodecConfigMetadata.Builder()
+                        .setAudioLocation(TEST_AUDIO_LOCATION_FRONT_LEFT).build();
+        BluetoothLeAudioContentMetadata contentMetadata =
+                new BluetoothLeAudioContentMetadata.Builder()
+                        .setProgramInfo(TEST_PROGRAM_INFO).setLanguage(TEST_LANGUAGE).build();
+        BluetoothLeBroadcastSubgroup.Builder builder = new BluetoothLeBroadcastSubgroup.Builder()
+                .setCodecId(TEST_CODEC_ID)
+                .setCodecSpecificConfig(codecMetadata)
+                .setContentMetadata(contentMetadata);
+
+        BluetoothLeAudioCodecConfigMetadata channelCodecMetadata =
+                new BluetoothLeAudioCodecConfigMetadata.Builder()
+                        .setAudioLocation(TEST_AUDIO_LOCATION_FRONT_RIGHT).build();
+
+        // builder expect at least one channel
+        BluetoothLeBroadcastChannel channel =
+                new BluetoothLeBroadcastChannel.Builder()
+                        .setSelected(true)
+                        .setChannelIndex(TEST_CHANNEL_INDEX)
+                        .setCodecMetadata(channelCodecMetadata)
+                        .build();
+        builder.addChannel(channel);
+        return builder.build();
+    }
+
+    BluetoothLeBroadcastMetadata createBroadcastMetadata(int broadcastId) {
+        BluetoothDevice testDevice = mBluetoothAdapter.getRemoteLeDevice(TEST_MAC_ADDRESS,
+                        BluetoothDevice.ADDRESS_TYPE_RANDOM);
+
+        BluetoothLeBroadcastMetadata.Builder builder = new BluetoothLeBroadcastMetadata.Builder()
+                        .setEncrypted(false)
+                        .setSourceDevice(testDevice, BluetoothDevice.ADDRESS_TYPE_RANDOM)
+                        .setSourceAdvertisingSid(TEST_ADVERTISER_SID)
+                        .setBroadcastId(broadcastId)
+                        .setBroadcastCode(null)
+                        .setPaSyncInterval(TEST_PA_SYNC_INTERVAL)
+                        .setPresentationDelayMicros(TEST_PRESENTATION_DELAY_MS);
+        // builder expect at least one subgroup
+        builder.addSubgroup(createBroadcastSubgroup());
+        return builder.build();
+    }
 
     @Before
     public void setUp() throws Exception {
+        if (!mFlagDexmarker.equals("true")) {
+            System.setProperty("dexmaker.share_classloader", "true");
+        }
+
         mTargetContext = InstrumentationRegistry.getTargetContext();
         MockitoAnnotations.initMocks(this);
         TestUtils.setAdapterService(mAdapterService);
@@ -113,7 +224,10 @@
         doAnswer(invocation -> {
             assertThat(mCurrentDevice).isNotNull();
             final BassClientStateMachine stateMachine = mock(BassClientStateMachine.class);
-            mStateMachines.put(mCurrentDevice, stateMachine);
+            doReturn(new ArrayList<>()).when(stateMachine).getAllSources();
+            doReturn(TEST_NUM_SOURCES).when(stateMachine).getMaximumSourceCapacity();
+            doReturn((BluetoothDevice)invocation.getArgument(0)).when(stateMachine).getDevice();
+            mStateMachines.put((BluetoothDevice)invocation.getArgument(0), stateMachine);
             return stateMachine;
         }).when(mObjectsFactory).makeStateMachine(any(), any(), any());
         doReturn(mBluetoothLeScannerWrapper).when(mObjectsFactory)
@@ -122,6 +236,23 @@
         TestUtils.startService(mServiceRule, BassClientService.class);
         mBassClientService = BassClientService.getBassClientService();
         assertThat(mBassClientService).isNotNull();
+
+        mBassClientService.mServiceFactory = mServiceFactory;
+        doReturn(mCsipService).when(mServiceFactory).getCsipSetCoordinatorService();
+
+        when(mCallback.asBinder()).thenReturn(mBinder);
+        mBassClientService.registerCallback(mCallback);
+
+        mIntentQueue = new HashMap<>();
+        mIntentQueue.put(mCurrentDevice, new LinkedBlockingQueue<>());
+        mIntentQueue.put(mCurrentDevice1, new LinkedBlockingQueue<>());
+
+        // Set up the Connection State Changed receiver
+        IntentFilter filter = new IntentFilter();
+        filter.addAction(BluetoothLeBroadcastAssistant.ACTION_CONNECTION_STATE_CHANGED);
+
+        mBassIntentReceiver = new BassIntentReceiver();
+        mTargetContext.registerReceiver(mBassIntentReceiver, filter);
     }
 
     @After
@@ -129,14 +260,38 @@
         if (mBassClientService == null) {
             return;
         }
+        mBassClientService.unregisterCallback(mCallback);
 
         TestUtils.stopService(mServiceRule, BassClientService.class);
         mBassClientService = BassClientService.getBassClientService();
         assertThat(mBassClientService).isNull();
         mStateMachines.clear();
         mCurrentDevice = null;
+        mCurrentDevice1 = null;
+        mTargetContext.unregisterReceiver(mBassIntentReceiver);
+        mIntentQueue.clear();
         BassObjectsFactory.setInstanceForTesting(null);
         TestUtils.clearAdapterService(mAdapterService);
+
+        if (!mFlagDexmarker.equals("true")) {
+            System.setProperty("dexmaker.share_classloader", mFlagDexmarker);
+        }
+    }
+
+    private class BassIntentReceiver extends BroadcastReceiver {
+        @Override
+        public void onReceive(Context context, Intent intent) {
+            try {
+                BluetoothDevice device = intent.getParcelableExtra(
+                        BluetoothDevice.EXTRA_DEVICE);
+                assertThat(device).isNotNull();
+                LinkedBlockingQueue<Intent> queue = mIntentQueue.get(device);
+                assertThat(queue).isNotNull();
+                queue.put(intent);
+            } catch (InterruptedException e) {
+                throw new AssertionError("Cannot add Intent to the queue: " + e.getMessage());
+            }
+        }
     }
 
     /**
@@ -201,14 +356,14 @@
     }
 
     /**
-     * Test connecting to a device when the connection policy is unknown.
+     * Test connecting to a device when the connection policy is forbidden.
      *  - service.connect() should return false.
      */
     @Test
-    public void testConnect_whenConnectionPolicyIsUnknown() {
+    public void testConnect_whenConnectionPolicyIsForbidden() {
         when(mDatabaseManager.getProfileConnectionPolicy(any(BluetoothDevice.class),
                 eq(BluetoothProfile.LE_AUDIO_BROADCAST_ASSISTANT)))
-                .thenReturn(BluetoothProfile.CONNECTION_POLICY_UNKNOWN);
+                .thenReturn(BluetoothProfile.CONNECTION_POLICY_FORBIDDEN);
         mCurrentDevice = TestUtils.getTestDevice(mBluetoothAdapter, 0);
         assertThat(mCurrentDevice).isNotNull();
 
@@ -239,4 +394,605 @@
 
         verify(mBluetoothLeScannerWrapper, never()).startScan(any(), any(), any());
     }
+
+    private void prepareConnectedDeviceGroup() {
+        when(mDatabaseManager.getProfileConnectionPolicy(any(BluetoothDevice.class),
+                        eq(BluetoothProfile.LE_AUDIO_BROADCAST_ASSISTANT)))
+                        .thenReturn(BluetoothProfile.CONNECTION_POLICY_ALLOWED);
+        mCurrentDevice = TestUtils.getTestDevice(mBluetoothAdapter, 0);
+        mCurrentDevice1 = TestUtils.getTestDevice(mBluetoothAdapter, 1);
+
+        // Prepare intent queues
+        mIntentQueue.put(mCurrentDevice, new LinkedBlockingQueue<>());
+        mIntentQueue.put(mCurrentDevice1, new LinkedBlockingQueue<>());
+
+        // Mock the CSIP group
+        List<BluetoothDevice> groupDevices = new ArrayList<>();
+        groupDevices.add(mCurrentDevice);
+        groupDevices.add(mCurrentDevice1);
+        doReturn(groupDevices).when(mCsipService)
+                .getGroupDevicesOrdered(mCurrentDevice, BluetoothUuid.CAP);
+        doReturn(groupDevices).when(mCsipService)
+                .getGroupDevicesOrdered(mCurrentDevice1, BluetoothUuid.CAP);
+
+        // Prepare connected devices
+        assertThat(mBassClientService.connect(mCurrentDevice)).isTrue();
+        assertThat(mBassClientService.connect(mCurrentDevice1)).isTrue();
+
+        assertThat(mStateMachines.size()).isEqualTo(2);
+        for (BassClientStateMachine sm: mStateMachines.values()) {
+            // Verify the call
+            verify(sm).sendMessage(eq(BassClientStateMachine.CONNECT));
+
+            // Notify the service about the connection event
+            BluetoothDevice dev = sm.getDevice();
+            doCallRealMethod().when(sm)
+                .broadcastConnectionState(eq(dev), any(Integer.class), any(Integer.class));
+            sm.mService = mBassClientService;
+            sm.mDevice = dev;
+            sm.broadcastConnectionState(dev, BluetoothProfile.STATE_CONNECTING,
+                    BluetoothProfile.STATE_CONNECTED);
+
+            doReturn(BluetoothProfile.STATE_CONNECTED).when(sm).getConnectionState();
+            doReturn(true).when(sm).isConnected();
+
+            // Inject initial broadcast source state
+            BluetoothLeBroadcastMetadata meta = createBroadcastMetadata(TEST_BROADCAST_ID);
+            injectRemoteSourceState(sm, meta, TEST_SOURCE_ID,
+                BluetoothLeBroadcastReceiveState.PA_SYNC_STATE_IDLE,
+                meta.isEncrypted() ?
+                        BluetoothLeBroadcastReceiveState.BIG_ENCRYPTION_STATE_DECRYPTING :
+                        BluetoothLeBroadcastReceiveState.BIG_ENCRYPTION_STATE_NOT_ENCRYPTED,
+                null);
+            injectRemoteSourceStateRemoval(sm, TEST_SOURCE_ID);
+
+            injectRemoteSourceState(sm, meta, TEST_SOURCE_ID + 1,
+                BluetoothLeBroadcastReceiveState.PA_SYNC_STATE_IDLE,
+                meta.isEncrypted() ?
+                        BluetoothLeBroadcastReceiveState.BIG_ENCRYPTION_STATE_DECRYPTING :
+                        BluetoothLeBroadcastReceiveState.BIG_ENCRYPTION_STATE_NOT_ENCRYPTED,
+                null);
+            injectRemoteSourceStateRemoval(sm, TEST_SOURCE_ID + 1);
+        }
+    }
+
+    private void verifyConnectionStateIntent(int timeoutMs, BluetoothDevice device, int newState,
+            int prevState) {
+        Intent intent = TestUtils.waitForIntent(timeoutMs, mIntentQueue.get(device));
+        assertThat(intent).isNotNull();
+        assertThat(BluetoothLeBroadcastAssistant.ACTION_CONNECTION_STATE_CHANGED)
+                .isEqualTo(intent.getAction());
+        assertThat(device).isEqualTo(intent.getParcelableExtra(BluetoothDevice.EXTRA_DEVICE));
+        assertThat(newState).isEqualTo(intent.getIntExtra(BluetoothProfile.EXTRA_STATE, -1));
+        assertThat(prevState).isEqualTo(intent.getIntExtra(BluetoothProfile.EXTRA_PREVIOUS_STATE,
+                -1));
+    }
+
+    private void verifyAddSourceForGroup(BluetoothLeBroadcastMetadata meta) {
+        // Add broadcast source
+        mBassClientService.addSource(mCurrentDevice, meta, true);
+
+        // Verify all group members getting ADD_BCAST_SOURCE message
+        assertThat(mStateMachines.size()).isEqualTo(2);
+        for (BassClientStateMachine sm: mStateMachines.values()) {
+            ArgumentCaptor<Message> messageCaptor = ArgumentCaptor.forClass(Message.class);
+            verify(sm, atLeast(1)).sendMessage(messageCaptor.capture());
+
+            Message msg = messageCaptor.getAllValues().stream()
+                    .filter(m -> (m.what == BassClientStateMachine.ADD_BCAST_SOURCE)
+                                        && (m.obj == meta))
+                    .findFirst()
+                    .orElse(null);
+            assertThat(msg).isNotNull();
+        }
+    }
+
+    private void injectRemoteSourceState(BassClientStateMachine sm,
+            BluetoothLeBroadcastMetadata meta, int sourceId, int paSynState, int encryptionState,
+            byte[] badCode) {
+        BluetoothLeBroadcastReceiveState recvState = new BluetoothLeBroadcastReceiveState(
+                sourceId,
+                meta.getSourceAddressType(),
+                meta.getSourceDevice(),
+                meta.getSourceAdvertisingSid(),
+                meta.getBroadcastId(),
+                paSynState,
+                encryptionState,
+                badCode,
+                meta.getSubgroups().size(),
+                // Bis sync states
+                meta.getSubgroups().stream()
+                        .map(e -> (long) 0x00000002)
+                        .collect(Collectors.toList()),
+                meta.getSubgroups().stream()
+                                .map(e -> e.getContentMetadata())
+                                .collect(Collectors.toList())
+                );
+        doReturn(meta).when(sm).getCurrentBroadcastMetadata(eq(sourceId));
+
+        List<BluetoothLeBroadcastReceiveState> stateList = sm.getAllSources();
+        if (stateList == null) {
+            stateList = new ArrayList<BluetoothLeBroadcastReceiveState>();
+        } else {
+            stateList.removeIf(e -> e.getSourceId() == sourceId);
+        }
+        stateList.add(recvState);
+        doReturn(stateList).when(sm).getAllSources();
+
+        mBassClientService.getCallbacks().notifySourceAdded(sm.getDevice(), recvState,
+                        BluetoothStatusCodes.REASON_LOCAL_APP_REQUEST);
+        TestUtils.waitForLooperToFinishScheduledTask(mBassClientService.getCallbacks().getLooper());
+    }
+
+    private void injectRemoteSourceStateRemoval(BassClientStateMachine sm, int sourceId) {
+        List<BluetoothLeBroadcastReceiveState> stateList = sm.getAllSources();
+        if (stateList == null) {
+                stateList = new ArrayList<BluetoothLeBroadcastReceiveState>();
+        }
+        stateList.replaceAll(e -> {
+            if (e.getSourceId() != sourceId) return e;
+            return new BluetoothLeBroadcastReceiveState(
+                sourceId,
+                BluetoothDevice.ADDRESS_TYPE_PUBLIC,
+                mBluetoothAdapter.getRemoteLeDevice("00:00:00:00:00:00",
+                        BluetoothDevice.ADDRESS_TYPE_PUBLIC),
+                0,
+                0,
+                BluetoothLeBroadcastReceiveState.PA_SYNC_STATE_IDLE,
+                BluetoothLeBroadcastReceiveState.BIG_ENCRYPTION_STATE_NOT_ENCRYPTED,
+                null,
+                0,
+                Arrays.asList(new Long[0]),
+                Arrays.asList(new BluetoothLeAudioContentMetadata[0])
+            );
+        });
+        doReturn(stateList).when(sm).getAllSources();
+
+        mBassClientService.getCallbacks().notifySourceRemoved(sm.getDevice(), sourceId,
+                        BluetoothStatusCodes.REASON_LOCAL_APP_REQUEST);
+        TestUtils.waitForLooperToFinishScheduledTask(mBassClientService.getCallbacks().getLooper());
+    }
+
+    /**
+     * Test whether service.addSource() does send proper messages to all the
+     * state machines within the Csip coordinated group
+     */
+    @Test
+    public void testAddSourceForGroup() {
+        prepareConnectedDeviceGroup();
+        BluetoothLeBroadcastMetadata meta = createBroadcastMetadata(TEST_BROADCAST_ID);
+        verifyAddSourceForGroup(meta);
+    }
+
+   /**
+     * Test whether service.modifySource() does send proper messages to all the
+     * state machines within the Csip coordinated group
+     */
+    @Test
+    public void testModifySourceForGroup() {
+        prepareConnectedDeviceGroup();
+        BluetoothLeBroadcastMetadata meta = createBroadcastMetadata(TEST_BROADCAST_ID);
+        verifyAddSourceForGroup(meta);
+        for (BassClientStateMachine sm: mStateMachines.values()) {
+            if (sm.getDevice().equals(mCurrentDevice)) {
+                injectRemoteSourceState(sm, meta, TEST_SOURCE_ID,
+                        BluetoothLeBroadcastReceiveState.PA_SYNC_STATE_IDLE,
+                        meta.isEncrypted() ?
+                                BluetoothLeBroadcastReceiveState.BIG_ENCRYPTION_STATE_DECRYPTING :
+                                BluetoothLeBroadcastReceiveState.BIG_ENCRYPTION_STATE_NOT_ENCRYPTED,
+                        null);
+            } else if (sm.getDevice().equals(mCurrentDevice1)) {
+                injectRemoteSourceState(sm, meta, TEST_SOURCE_ID + 1,
+                        BluetoothLeBroadcastReceiveState.PA_SYNC_STATE_IDLE,
+                        meta.isEncrypted() ?
+                                BluetoothLeBroadcastReceiveState.BIG_ENCRYPTION_STATE_DECRYPTING :
+                                BluetoothLeBroadcastReceiveState.BIG_ENCRYPTION_STATE_NOT_ENCRYPTED,
+                        null);
+            }
+        }
+
+        // Update broadcast source using other member of the same group
+        BluetoothLeBroadcastMetadata metaUpdate =
+                new BluetoothLeBroadcastMetadata.Builder(meta)
+                        .setBroadcastId(TEST_BROADCAST_ID + 1).build();
+        mBassClientService.modifySource(mCurrentDevice1, TEST_SOURCE_ID + 1, metaUpdate);
+
+        // Verify all group members getting UPDATE_BCAST_SOURCE message on proper sources
+        assertThat(mStateMachines.size()).isEqualTo(2);
+        for (BassClientStateMachine sm: mStateMachines.values()) {
+            ArgumentCaptor<Message> messageCaptor = ArgumentCaptor.forClass(Message.class);
+            verify(sm, atLeast(1)).sendMessage(messageCaptor.capture());
+
+            Optional<Message> msg = messageCaptor.getAllValues().stream()
+                    .filter(m -> m.what == BassClientStateMachine.UPDATE_BCAST_SOURCE)
+                    .findFirst();
+            assertThat(msg.isPresent()).isEqualTo(true);
+            assertThat(msg.get().obj).isEqualTo(metaUpdate);
+
+            // Verify using the right sourceId on each device
+            if (sm.getDevice().equals(mCurrentDevice)) {
+                assertThat(msg.get().arg1).isEqualTo(TEST_SOURCE_ID);
+            } else if (sm.getDevice().equals(mCurrentDevice1)) {
+                assertThat(msg.get().arg1).isEqualTo(TEST_SOURCE_ID + 1);
+            }
+        }
+    }
+
+    /**
+     * Test whether service.removeSource() does send proper messages to all the
+     * state machines within the Csip coordinated group
+     */
+    @Test
+    public void testRemoveSourceForGroup() {
+        prepareConnectedDeviceGroup();
+        BluetoothLeBroadcastMetadata meta = createBroadcastMetadata(TEST_BROADCAST_ID);
+        verifyAddSourceForGroup(meta);
+        for (BassClientStateMachine sm: mStateMachines.values()) {
+            if (sm.getDevice().equals(mCurrentDevice)) {
+                injectRemoteSourceState(sm, meta, TEST_SOURCE_ID,
+                        BluetoothLeBroadcastReceiveState.PA_SYNC_STATE_IDLE,
+                        meta.isEncrypted() ?
+                                BluetoothLeBroadcastReceiveState.BIG_ENCRYPTION_STATE_DECRYPTING :
+                                BluetoothLeBroadcastReceiveState.BIG_ENCRYPTION_STATE_NOT_ENCRYPTED,
+                        null);
+            } else if (sm.getDevice().equals(mCurrentDevice1)) {
+                injectRemoteSourceState(sm, meta, TEST_SOURCE_ID + 1,
+                        BluetoothLeBroadcastReceiveState.PA_SYNC_STATE_IDLE,
+                        meta.isEncrypted() ?
+                                BluetoothLeBroadcastReceiveState.BIG_ENCRYPTION_STATE_DECRYPTING :
+                                BluetoothLeBroadcastReceiveState.BIG_ENCRYPTION_STATE_NOT_ENCRYPTED,
+                        null);
+            }
+        }
+
+        // Remove broadcast source using other member of the same group
+        mBassClientService.removeSource(mCurrentDevice1, TEST_SOURCE_ID + 1);
+
+        // Verify all group members getting REMOVE_BCAST_SOURCE message
+        assertThat(mStateMachines.size()).isEqualTo(2);
+        for (BassClientStateMachine sm: mStateMachines.values()) {
+            ArgumentCaptor<Message> messageCaptor = ArgumentCaptor.forClass(Message.class);
+            verify(sm, atLeast(1)).sendMessage(messageCaptor.capture());
+
+            Optional<Message> msg = messageCaptor.getAllValues().stream()
+                    .filter(m -> m.what == BassClientStateMachine.REMOVE_BCAST_SOURCE)
+                    .findFirst();
+            assertThat(msg.isPresent()).isEqualTo(true);
+
+            // Verify using the right sourceId on each device
+            if (sm.getDevice().equals(mCurrentDevice)) {
+                assertThat(msg.get().arg1).isEqualTo(TEST_SOURCE_ID);
+            } else if (sm.getDevice().equals(mCurrentDevice1)) {
+                assertThat(msg.get().arg1).isEqualTo(TEST_SOURCE_ID + 1);
+            }
+        }
+    }
+
+    /**
+     * Test whether the group operation flag is set on addSource() and removed on removeSource
+     */
+    @Test
+    public void testGroupStickyFlagSetUnset() {
+        prepareConnectedDeviceGroup();
+        BluetoothLeBroadcastMetadata meta = createBroadcastMetadata(TEST_BROADCAST_ID);
+
+        verifyAddSourceForGroup(meta);
+        // Inject source added
+        for (BassClientStateMachine sm: mStateMachines.values()) {
+            if (sm.getDevice().equals(mCurrentDevice)) {
+                injectRemoteSourceState(sm, meta, TEST_SOURCE_ID,
+                        BluetoothLeBroadcastReceiveState.PA_SYNC_STATE_IDLE,
+                        meta.isEncrypted() ?
+                                BluetoothLeBroadcastReceiveState.BIG_ENCRYPTION_STATE_DECRYPTING :
+                                BluetoothLeBroadcastReceiveState.BIG_ENCRYPTION_STATE_NOT_ENCRYPTED,
+                        null);
+            } else if (sm.getDevice().equals(mCurrentDevice1)) {
+                injectRemoteSourceState(sm, meta, TEST_SOURCE_ID + 1,
+                        BluetoothLeBroadcastReceiveState.PA_SYNC_STATE_IDLE,
+                        meta.isEncrypted() ?
+                                BluetoothLeBroadcastReceiveState.BIG_ENCRYPTION_STATE_DECRYPTING :
+                                BluetoothLeBroadcastReceiveState.BIG_ENCRYPTION_STATE_NOT_ENCRYPTED,
+                        null);
+            }
+        }
+
+        // Remove broadcast source
+        mBassClientService.removeSource(mCurrentDevice, TEST_SOURCE_ID);
+        // Inject source removed
+        for (BassClientStateMachine sm: mStateMachines.values()) {
+            ArgumentCaptor<Message> messageCaptor = ArgumentCaptor.forClass(Message.class);
+            verify(sm, atLeast(1)).sendMessage(messageCaptor.capture());
+
+            Optional<Message> msg = messageCaptor.getAllValues().stream()
+                    .filter(m -> m.what == BassClientStateMachine.REMOVE_BCAST_SOURCE)
+                    .findFirst();
+            assertThat(msg.isPresent()).isEqualTo(true);
+
+            if (sm.getDevice().equals(mCurrentDevice)) {
+                assertThat(msg.get().arg1).isEqualTo(TEST_SOURCE_ID);
+                injectRemoteSourceStateRemoval(sm, TEST_SOURCE_ID);
+            } else if (sm.getDevice().equals(mCurrentDevice1)) {
+                assertThat(msg.get().arg1).isEqualTo(TEST_SOURCE_ID + 1);
+                injectRemoteSourceStateRemoval(sm, TEST_SOURCE_ID + 1);
+            }
+        }
+
+        // Update broadcast source
+        BluetoothLeBroadcastMetadata metaUpdate = createBroadcastMetadata(TEST_BROADCAST_ID + 1);
+        mBassClientService.modifySource(mCurrentDevice, TEST_SOURCE_ID, metaUpdate);
+
+        ArgumentCaptor<Message> messageCaptor = ArgumentCaptor.forClass(Message.class);
+        Optional<Message> msg;
+
+        // Verrify that one device got the message...
+        verify(mStateMachines.get(mCurrentDevice), atLeast(1)).sendMessage(messageCaptor.capture());
+        msg = messageCaptor.getAllValues().stream()
+                    .filter(m -> m.what == BassClientStateMachine.UPDATE_BCAST_SOURCE)
+                    .findFirst();
+        assertThat(msg.isPresent()).isTrue();
+        assertThat(msg.orElse(null)).isNotNull();
+
+        //... but not the other one, since the sticky group flag should have been removed
+        messageCaptor = ArgumentCaptor.forClass(Message.class);
+        verify(mStateMachines.get(mCurrentDevice1), atLeast(1))
+                .sendMessage(messageCaptor.capture());
+        msg = messageCaptor.getAllValues().stream()
+                    .filter(m -> m.what == BassClientStateMachine.UPDATE_BCAST_SOURCE)
+                    .findFirst();
+        assertThat(msg.isPresent()).isFalse();
+    }
+
+    /**
+     * Test that after multiple calls to service.addSource() with a group operation flag set,
+     * there are two call to service.removeSource() needed to clear the flag
+     */
+    @Test
+    public void testAddRemoveMultipleSourcesForGroup() {
+        prepareConnectedDeviceGroup();
+        BluetoothLeBroadcastMetadata meta = createBroadcastMetadata(TEST_BROADCAST_ID);
+        verifyAddSourceForGroup(meta);
+        assertThat(mStateMachines.size()).isEqualTo(2);
+        for (BassClientStateMachine sm: mStateMachines.values()) {
+            if (sm.getDevice().equals(mCurrentDevice)) {
+                injectRemoteSourceState(sm, meta, TEST_SOURCE_ID,
+                        BluetoothLeBroadcastReceiveState.PA_SYNC_STATE_IDLE,
+                        meta.isEncrypted() ?
+                                BluetoothLeBroadcastReceiveState.BIG_ENCRYPTION_STATE_DECRYPTING :
+                                BluetoothLeBroadcastReceiveState.BIG_ENCRYPTION_STATE_NOT_ENCRYPTED,
+                        null);
+            } else if (sm.getDevice().equals(mCurrentDevice1)) {
+                injectRemoteSourceState(sm, meta, TEST_SOURCE_ID + 1,
+                        BluetoothLeBroadcastReceiveState.PA_SYNC_STATE_IDLE,
+                        meta.isEncrypted() ?
+                                BluetoothLeBroadcastReceiveState.BIG_ENCRYPTION_STATE_DECRYPTING :
+                                BluetoothLeBroadcastReceiveState.BIG_ENCRYPTION_STATE_NOT_ENCRYPTED,
+                        null);
+            } else {
+                throw new AssertionError("Unexpected device");
+            }
+        }
+
+        // Add another broadcast source
+        BluetoothLeBroadcastMetadata meta1 =
+                new BluetoothLeBroadcastMetadata.Builder(meta)
+                        .setBroadcastId(TEST_BROADCAST_ID + 1).build();
+        verifyAddSourceForGroup(meta1);
+        assertThat(mStateMachines.size()).isEqualTo(2);
+        for (BassClientStateMachine sm: mStateMachines.values()) {
+            if (sm.getDevice().equals(mCurrentDevice)) {
+                injectRemoteSourceState(sm, meta1, TEST_SOURCE_ID + 2,
+                        BluetoothLeBroadcastReceiveState.PA_SYNC_STATE_IDLE,
+                        meta1.isEncrypted() ?
+                                BluetoothLeBroadcastReceiveState.BIG_ENCRYPTION_STATE_DECRYPTING :
+                                BluetoothLeBroadcastReceiveState.BIG_ENCRYPTION_STATE_NOT_ENCRYPTED,
+                        null);
+            } else if (sm.getDevice().equals(mCurrentDevice1)) {
+                injectRemoteSourceState(sm, meta1, TEST_SOURCE_ID + 3,
+                        BluetoothLeBroadcastReceiveState.PA_SYNC_STATE_IDLE,
+                        meta1.isEncrypted() ?
+                                BluetoothLeBroadcastReceiveState.BIG_ENCRYPTION_STATE_DECRYPTING :
+                                BluetoothLeBroadcastReceiveState.BIG_ENCRYPTION_STATE_NOT_ENCRYPTED,
+                        null);
+            } else {
+                throw new AssertionError("Unexpected device");
+            }
+        }
+
+        // Remove the first broadcast source
+        mBassClientService.removeSource(mCurrentDevice, TEST_SOURCE_ID);
+        assertThat(mStateMachines.size()).isEqualTo(2);
+        for (BassClientStateMachine sm: mStateMachines.values()) {
+            ArgumentCaptor<Message> messageCaptor = ArgumentCaptor.forClass(Message.class);
+            verify(sm, atLeast(1)).sendMessage(messageCaptor.capture());
+
+            Optional<Message> msg = messageCaptor.getAllValues().stream()
+                    .filter(m -> m.what == BassClientStateMachine.REMOVE_BCAST_SOURCE)
+                    .findFirst();
+            assertThat(msg.isPresent()).isEqualTo(true);
+
+            // Verify using the right sourceId on each device
+            if (sm.getDevice().equals(mCurrentDevice)) {
+                assertThat(msg.get().arg1).isEqualTo(TEST_SOURCE_ID);
+                injectRemoteSourceStateRemoval(sm, TEST_SOURCE_ID);
+            } else if (sm.getDevice().equals(mCurrentDevice1)) {
+                assertThat(msg.get().arg1).isEqualTo(TEST_SOURCE_ID + 1);
+                injectRemoteSourceStateRemoval(sm, TEST_SOURCE_ID + 1);
+            } else {
+                throw new AssertionError("Unexpected device");
+            }
+        }
+
+        // Modify the second one and verify all group members getting UPDATE_BCAST_SOURCE
+        BluetoothLeBroadcastMetadata metaUpdate = createBroadcastMetadata(TEST_BROADCAST_ID + 3);
+        mBassClientService.modifySource(mCurrentDevice1, TEST_SOURCE_ID + 3, metaUpdate);
+        assertThat(mStateMachines.size()).isEqualTo(2);
+        for (BassClientStateMachine sm: mStateMachines.values()) {
+            ArgumentCaptor<Message> messageCaptor = ArgumentCaptor.forClass(Message.class);
+            verify(sm, atLeast(1)).sendMessage(messageCaptor.capture());
+
+            Optional<Message> msg = messageCaptor.getAllValues().stream()
+                    .filter(m -> m.what == BassClientStateMachine.UPDATE_BCAST_SOURCE)
+                    .findFirst();
+            assertThat(msg.isPresent()).isEqualTo(true);
+            assertThat(msg.get().obj).isEqualTo(metaUpdate);
+
+            // Verify using the right sourceId on each device
+            if (sm.getDevice().equals(mCurrentDevice)) {
+                    assertThat(msg.get().arg1).isEqualTo(TEST_SOURCE_ID + 2);
+            } else if (sm.getDevice().equals(mCurrentDevice1)) {
+                    assertThat(msg.get().arg1).isEqualTo(TEST_SOURCE_ID + 3);
+            } else {
+                throw new AssertionError("Unexpected device");
+            }
+        }
+
+        // Remove the second broadcast source and verify all group members getting
+        // REMOVE_BCAST_SOURCE message for the second source
+        mBassClientService.removeSource(mCurrentDevice, TEST_SOURCE_ID + 2);
+        assertThat(mStateMachines.size()).isEqualTo(2);
+        for (BassClientStateMachine sm: mStateMachines.values()) {
+            ArgumentCaptor<Message> messageCaptor = ArgumentCaptor.forClass(Message.class);
+            verify(sm, atLeast(1)).sendMessage(messageCaptor.capture());
+
+            if (sm.getDevice().equals(mCurrentDevice)) {
+                Optional<Message> msg = messageCaptor.getAllValues().stream()
+                        .filter(m -> (m.what == BassClientStateMachine.REMOVE_BCAST_SOURCE)
+                                && (m.arg1 == TEST_SOURCE_ID + 2))
+                        .findFirst();
+                assertThat(msg.isPresent()).isEqualTo(true);
+                injectRemoteSourceStateRemoval(sm, TEST_SOURCE_ID + 2);
+            } else if (sm.getDevice().equals(mCurrentDevice1)) {
+                Optional<Message> msg = messageCaptor.getAllValues().stream()
+                        .filter(m -> (m.what == BassClientStateMachine.REMOVE_BCAST_SOURCE)
+                                && (m.arg1 == TEST_SOURCE_ID + 3))
+                        .findFirst();
+                assertThat(msg.isPresent()).isEqualTo(true);
+                injectRemoteSourceStateRemoval(sm, TEST_SOURCE_ID + 3);
+            } else {
+                throw new AssertionError("Unexpected device");
+            }
+        }
+
+        // Fake the autonomous source change - or other client setting the source
+        for (BassClientStateMachine sm: mStateMachines.values()) {
+            clearInvocations(sm);
+
+            BluetoothLeBroadcastMetadata metaOther =
+                    createBroadcastMetadata(TEST_BROADCAST_ID + 20);
+            injectRemoteSourceState(sm, metaOther, TEST_SOURCE_ID + 20,
+                    BluetoothLeBroadcastReceiveState.PA_SYNC_STATE_IDLE,
+                    meta.isEncrypted() ?
+                            BluetoothLeBroadcastReceiveState.BIG_ENCRYPTION_STATE_DECRYPTING :
+                            BluetoothLeBroadcastReceiveState.BIG_ENCRYPTION_STATE_NOT_ENCRYPTED,
+                    null);
+        }
+
+        // Modify this source and verify it is not group managed
+        BluetoothLeBroadcastMetadata metaUpdate2 = createBroadcastMetadata(TEST_BROADCAST_ID + 30);
+        mBassClientService.modifySource(mCurrentDevice1, TEST_SOURCE_ID + 20, metaUpdate2);
+        for (BassClientStateMachine sm: mStateMachines.values()) {
+            if (sm.getDevice().equals(mCurrentDevice)) {
+                verify(sm, times(0)).sendMessage(any());
+            } else if (sm.getDevice().equals(mCurrentDevice1)) {
+                ArgumentCaptor<Message> messageCaptor = ArgumentCaptor.forClass(Message.class);
+                verify(sm, times(1)).sendMessage(messageCaptor.capture());
+                List<Message> msgs = messageCaptor.getAllValues().stream()
+                        .filter(m -> (m.what == BassClientStateMachine.UPDATE_BCAST_SOURCE)
+                                && (m.arg1 == TEST_SOURCE_ID + 20))
+                        .collect(Collectors.toList());
+                assertThat(msgs.size()).isEqualTo(1);
+            } else {
+                throw new AssertionError("Unexpected device");
+            }
+        }
+    }
+
+    @Test
+    public void testInvalidRequestForGroup() {
+        // Prepare the initial state
+        prepareConnectedDeviceGroup();
+        BluetoothLeBroadcastMetadata meta = createBroadcastMetadata(TEST_BROADCAST_ID);
+        verifyAddSourceForGroup(meta);
+        for (BassClientStateMachine sm: mStateMachines.values()) {
+            if (sm.getDevice().equals(mCurrentDevice)) {
+                injectRemoteSourceState(sm, meta, TEST_SOURCE_ID,
+                        BluetoothLeBroadcastReceiveState.PA_SYNC_STATE_IDLE,
+                        meta.isEncrypted() ?
+                                BluetoothLeBroadcastReceiveState.BIG_ENCRYPTION_STATE_DECRYPTING :
+                                BluetoothLeBroadcastReceiveState.BIG_ENCRYPTION_STATE_NOT_ENCRYPTED,
+                        null);
+            } else if (sm.getDevice().equals(mCurrentDevice1)) {
+                injectRemoteSourceState(sm, meta, TEST_SOURCE_ID + 1,
+                        BluetoothLeBroadcastReceiveState.PA_SYNC_STATE_IDLE,
+                        meta.isEncrypted() ?
+                                BluetoothLeBroadcastReceiveState.BIG_ENCRYPTION_STATE_DECRYPTING :
+                                BluetoothLeBroadcastReceiveState.BIG_ENCRYPTION_STATE_NOT_ENCRYPTED,
+                        null);
+            }
+        }
+
+        // Verify errors are reported for the entire group
+        mBassClientService.addSource(mCurrentDevice1, null, true);
+        assertThat(mStateMachines.size()).isEqualTo(2);
+        for (BassClientStateMachine sm: mStateMachines.values()) {
+            BluetoothDevice dev = sm.getDevice();
+            try {
+                verify(mCallback, after(TIMEOUT_MS).times(1)).onSourceAddFailed(eq(dev),
+                        eq(null), eq(BluetoothStatusCodes.ERROR_BAD_PARAMETERS));
+            } catch (RemoteException e) {
+                throw e.rethrowFromSystemServer();
+            }
+        }
+
+        // Verify errors are reported for the entire group
+        mBassClientService.modifySource(mCurrentDevice, TEST_SOURCE_ID, null);
+        assertThat(mStateMachines.size()).isEqualTo(2);
+        for (BassClientStateMachine sm: mStateMachines.values()) {
+            BluetoothDevice dev = sm.getDevice();
+            try {
+                verify(mCallback, after(TIMEOUT_MS).times(1)).onSourceModifyFailed(eq(dev),
+                        eq(TEST_SOURCE_ID), eq(BluetoothStatusCodes.ERROR_BAD_PARAMETERS));
+            } catch (RemoteException e) {
+                throw e.rethrowFromSystemServer();
+            }
+        }
+
+        assertThat(mStateMachines.size()).isEqualTo(2);
+        for (BassClientStateMachine sm: mStateMachines.values()) {
+            doReturn(BluetoothProfile.STATE_DISCONNECTED).when(sm).getConnectionState();
+        }
+
+        // Verify errors are reported for the entire group
+        mBassClientService.removeSource(mCurrentDevice, TEST_SOURCE_ID);
+        assertThat(mStateMachines.size()).isEqualTo(2);
+        for (BassClientStateMachine sm: mStateMachines.values()) {
+            BluetoothDevice dev = sm.getDevice();
+            try {
+                verify(mCallback, after(TIMEOUT_MS).times(1)).onSourceRemoveFailed(eq(dev),
+                        eq(TEST_SOURCE_ID), eq(BluetoothStatusCodes.ERROR_REMOTE_LINK_ERROR));
+            } catch (RemoteException e) {
+                throw e.rethrowFromSystemServer();
+            }
+        }
+    }
+
+    /**
+     * Test that an outgoing connection to two device that have BASS UUID is successful
+     * and a connection state change intent is sent
+     */
+    @Test
+    public void testConnectedIntent() {
+        prepareConnectedDeviceGroup();
+
+        assertThat(mStateMachines.size()).isEqualTo(2);
+        for (BassClientStateMachine sm: mStateMachines.values()) {
+            BluetoothDevice dev = sm.getDevice();
+            verifyConnectionStateIntent(TIMEOUT_MS, dev, BluetoothProfile.STATE_CONNECTED,
+                    BluetoothProfile.STATE_CONNECTING);
+        }
+
+        List<BluetoothDevice> devices = mBassClientService.getConnectedDevices();
+        assertThat(devices.contains(mCurrentDevice)).isTrue();
+        assertThat(devices.contains(mCurrentDevice1)).isTrue();
+    }
 }
diff --git a/android/app/tests/unit/src/com/android/bluetooth/bass_client/BassClientStateMachineTest.java b/android/app/tests/unit/src/com/android/bluetooth/bass_client/BassClientStateMachineTest.java
new file mode 100644
index 0000000..f1f88b8
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/bass_client/BassClientStateMachineTest.java
@@ -0,0 +1,1665 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.bass_client;
+
+import static android.bluetooth.BluetoothGatt.GATT_FAILURE;
+import static android.bluetooth.BluetoothGatt.GATT_SUCCESS;
+
+import static com.android.bluetooth.bass_client.BassClientStateMachine.ADD_BCAST_SOURCE;
+import static com.android.bluetooth.bass_client.BassClientStateMachine.CONNECT;
+import static com.android.bluetooth.bass_client.BassClientStateMachine.CONNECTION_STATE_CHANGED;
+import static com.android.bluetooth.bass_client.BassClientStateMachine.CONNECT_TIMEOUT;
+import static com.android.bluetooth.bass_client.BassClientStateMachine.DISCONNECT;
+import static com.android.bluetooth.bass_client.BassClientStateMachine.GATT_TXN_PROCESSED;
+import static com.android.bluetooth.bass_client.BassClientStateMachine.GATT_TXN_TIMEOUT;
+import static com.android.bluetooth.bass_client.BassClientStateMachine.PSYNC_ACTIVE_TIMEOUT;
+import static com.android.bluetooth.bass_client.BassClientStateMachine.READ_BASS_CHARACTERISTICS;
+import static com.android.bluetooth.bass_client.BassClientStateMachine.REMOTE_SCAN_START;
+import static com.android.bluetooth.bass_client.BassClientStateMachine.REMOTE_SCAN_STOP;
+import static com.android.bluetooth.bass_client.BassClientStateMachine.REMOVE_BCAST_SOURCE;
+import static com.android.bluetooth.bass_client.BassClientStateMachine.SELECT_BCAST_SOURCE;
+import static com.android.bluetooth.bass_client.BassClientStateMachine.SET_BCAST_CODE;
+import static com.android.bluetooth.bass_client.BassClientStateMachine.START_SCAN_OFFLOAD;
+import static com.android.bluetooth.bass_client.BassClientStateMachine.STOP_SCAN_OFFLOAD;
+import static com.android.bluetooth.bass_client.BassClientStateMachine.UPDATE_BCAST_SOURCE;
+import static com.android.bluetooth.bass_client.BassConstants.CLIENT_CHARACTERISTIC_CONFIG;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertNull;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.anyBoolean;
+import static org.mockito.ArgumentMatchers.anyInt;
+import static org.mockito.ArgumentMatchers.anyString;
+import static org.mockito.Mockito.after;
+import static org.mockito.Mockito.atLeast;
+import static org.mockito.Mockito.doNothing;
+import static org.mockito.Mockito.never;
+import static org.mockito.Mockito.timeout;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import android.bluetooth.BluetoothAdapter;
+import android.bluetooth.BluetoothDevice;
+import android.bluetooth.BluetoothGatt;
+import android.bluetooth.BluetoothGattCallback;
+import android.bluetooth.BluetoothGattCharacteristic;
+import android.bluetooth.BluetoothGattDescriptor;
+import android.bluetooth.BluetoothGattService;
+import android.bluetooth.BluetoothLeAudioCodecConfigMetadata;
+import android.bluetooth.BluetoothLeAudioContentMetadata;
+import android.bluetooth.BluetoothLeBroadcastChannel;
+import android.bluetooth.BluetoothLeBroadcastMetadata;
+import android.bluetooth.BluetoothLeBroadcastReceiveState;
+import android.bluetooth.BluetoothLeBroadcastSubgroup;
+import android.bluetooth.BluetoothProfile;
+import android.bluetooth.le.ScanRecord;
+import android.bluetooth.le.ScanResult;
+import android.content.Intent;
+import android.os.Bundle;
+import android.os.HandlerThread;
+import android.os.Looper;
+import android.os.Message;
+import android.telecom.Log;
+
+import androidx.test.filters.MediumTest;
+
+import com.android.bluetooth.BluetoothMethodProxy;
+import com.android.bluetooth.TestUtils;
+import com.android.bluetooth.btservice.AdapterService;
+
+import org.hamcrest.core.IsInstanceOf;
+import org.junit.After;
+import org.junit.Assert;
+import org.junit.Before;
+import org.junit.Rule;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.junit.runners.JUnit4;
+import org.mockito.ArgumentCaptor;
+import org.mockito.Mock;
+import org.mockito.Mockito;
+import org.mockito.Spy;
+import org.mockito.junit.MockitoJUnit;
+import org.mockito.junit.MockitoRule;
+
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.List;
+import java.util.UUID;
+
+@MediumTest
+@RunWith(JUnit4.class)
+public class BassClientStateMachineTest {
+    @Rule
+    public final MockitoRule mockito = MockitoJUnit.rule();
+
+    private static final int CONNECTION_TIMEOUT_MS = 1_000;
+    private static final int TIMEOUT_MS = 2_000;
+    private static final int WAIT_MS = 1_200;
+    private BluetoothAdapter mAdapter;
+    private HandlerThread mHandlerThread;
+    private StubBassClientStateMachine mBassClientStateMachine;
+    private BluetoothDevice mTestDevice;
+
+    @Mock private AdapterService mAdapterService;
+    @Mock private BassClientService mBassClientService;
+    @Spy private BluetoothMethodProxy mMethodProxy;
+
+    @Before
+    public void setUp() throws Exception {
+        TestUtils.setAdapterService(mAdapterService);
+
+        mAdapter = BluetoothAdapter.getDefaultAdapter();
+        BluetoothMethodProxy.setInstanceForTesting(mMethodProxy);
+        doNothing().when(mMethodProxy).periodicAdvertisingManagerTransferSync(
+                any(), any(), anyInt(), anyInt());
+
+        // Get a device for testing
+        mTestDevice = mAdapter.getRemoteDevice("00:01:02:03:04:05");
+
+        // Set up thread and looper
+        mHandlerThread = new HandlerThread("BassClientStateMachineTestHandlerThread");
+        mHandlerThread.start();
+        mBassClientStateMachine = new StubBassClientStateMachine(mTestDevice,
+                mBassClientService, mHandlerThread.getLooper(), CONNECTION_TIMEOUT_MS);
+        mBassClientStateMachine.start();
+    }
+
+    @After
+    public void tearDown() throws Exception {
+        mBassClientStateMachine.doQuit();
+        mHandlerThread.quit();
+        TestUtils.clearAdapterService(mAdapterService);
+    }
+
+    /**
+     * Test that default state is disconnected
+     */
+    @Test
+    public void testDefaultDisconnectedState() {
+        Assert.assertEquals(BluetoothProfile.STATE_DISCONNECTED,
+                mBassClientStateMachine.getConnectionState());
+    }
+
+    /**
+     * Allow/disallow connection to any device.
+     *
+     * @param allow if true, connection is allowed
+     */
+    private void allowConnection(boolean allow) {
+        when(mBassClientService.okToConnect(any(BluetoothDevice.class))).thenReturn(allow);
+    }
+
+    private void allowConnectGatt(boolean allow) {
+        mBassClientStateMachine.mShouldAllowGatt = allow;
+    }
+
+    /**
+     * Test that an incoming connection with policy forbidding connection is rejected
+     */
+    @Test
+    public void testOkToConnectFails() {
+        allowConnection(false);
+        allowConnectGatt(true);
+
+        // Inject an event for when incoming connection is requested
+        mBassClientStateMachine.sendMessage(CONNECT);
+
+        // Verify that no connection state broadcast is executed
+        verify(mBassClientService, after(WAIT_MS).never()).sendBroadcast(any(Intent.class),
+                anyString());
+
+        // Check that we are in Disconnected state
+        Assert.assertThat(mBassClientStateMachine.getCurrentState(),
+                IsInstanceOf.instanceOf(BassClientStateMachine.Disconnected.class));
+    }
+
+    @Test
+    public void testFailToConnectGatt() {
+        allowConnection(true);
+        allowConnectGatt(false);
+
+        // Inject an event for when incoming connection is requested
+        mBassClientStateMachine.sendMessage(CONNECT);
+
+        // Verify that no connection state broadcast is executed
+        verify(mBassClientService, after(WAIT_MS).never()).sendBroadcast(any(Intent.class),
+                anyString());
+
+        // Check that we are in Disconnected state
+        Assert.assertThat(mBassClientStateMachine.getCurrentState(),
+                IsInstanceOf.instanceOf(BassClientStateMachine.Disconnected.class));
+        assertNull(mBassClientStateMachine.mBluetoothGatt);
+    }
+
+    @Test
+    public void testSuccessfullyConnected() {
+        allowConnection(true);
+        allowConnectGatt(true);
+
+        // Inject an event for when incoming connection is requested
+        mBassClientStateMachine.sendMessage(CONNECT);
+
+        // Verify that one connection state broadcast is executed
+        ArgumentCaptor<Intent> intentArgument1 = ArgumentCaptor.forClass(Intent.class);
+        verify(mBassClientService, timeout(TIMEOUT_MS).times(1)).sendBroadcast(
+                intentArgument1.capture(), anyString(), any(Bundle.class));
+        Assert.assertEquals(BluetoothProfile.STATE_CONNECTING,
+                intentArgument1.getValue().getIntExtra(BluetoothProfile.EXTRA_STATE, -1));
+
+        Assert.assertThat(mBassClientStateMachine.getCurrentState(),
+                IsInstanceOf.instanceOf(BassClientStateMachine.Connecting.class));
+
+        assertNotNull(mBassClientStateMachine.mGattCallback);
+        mBassClientStateMachine.notifyConnectionStateChanged(
+                GATT_SUCCESS, BluetoothProfile.STATE_CONNECTED);
+
+        // Verify that the expected number of broadcasts are executed:
+        // - two calls to broadcastConnectionState(): Disconnected -> Connecting -> Connected
+        ArgumentCaptor<Intent> intentArgument2 = ArgumentCaptor.forClass(Intent.class);
+        verify(mBassClientService, timeout(TIMEOUT_MS).times(2)).sendBroadcast(
+                intentArgument2.capture(), anyString(), any(Bundle.class));
+
+        Assert.assertThat(mBassClientStateMachine.getCurrentState(),
+                IsInstanceOf.instanceOf(BassClientStateMachine.Connected.class));
+    }
+
+    @Test
+    public void testConnectGattTimeout() {
+        allowConnection(true);
+        allowConnectGatt(true);
+
+        // Inject an event for when incoming connection is requested
+        mBassClientStateMachine.sendMessage(CONNECT);
+
+        // Verify that one connection state broadcast is executed
+        ArgumentCaptor<Intent> intentArgument1 = ArgumentCaptor.forClass(Intent.class);
+        verify(mBassClientService, timeout(TIMEOUT_MS).times(1)).sendBroadcast(
+                intentArgument1.capture(), anyString(), any(Bundle.class));
+        Assert.assertEquals(BluetoothProfile.STATE_CONNECTING,
+                intentArgument1.getValue().getIntExtra(BluetoothProfile.EXTRA_STATE, -1));
+
+        Assert.assertThat(mBassClientStateMachine.getCurrentState(),
+                IsInstanceOf.instanceOf(BassClientStateMachine.Connecting.class));
+
+        // Verify that one connection state broadcast is executed
+        ArgumentCaptor<Intent> intentArgument2 = ArgumentCaptor.forClass(Intent.class);
+        verify(mBassClientService, timeout(TIMEOUT_MS).times(
+                2)).sendBroadcast(intentArgument2.capture(), anyString(), any(Bundle.class));
+        Assert.assertEquals(BluetoothProfile.STATE_DISCONNECTED,
+                intentArgument2.getValue().getIntExtra(BluetoothProfile.EXTRA_STATE, -1));
+
+        Assert.assertThat(mBassClientStateMachine.getCurrentState(),
+                IsInstanceOf.instanceOf(BassClientStateMachine.Disconnected.class));
+    }
+
+    @Test
+    public void testStatesChangesWithMessages() {
+        allowConnection(true);
+        allowConnectGatt(true);
+
+        assertThat(mBassClientStateMachine.getCurrentState())
+                .isInstanceOf(BassClientStateMachine.Disconnected.class);
+
+        // disconnected -> connecting ---timeout---> disconnected
+        sendMessageAndVerifyTransition(
+                mBassClientStateMachine.obtainMessage(CONNECT),
+                BassClientStateMachine.Connecting.class);
+        sendMessageAndVerifyTransition(
+                mBassClientStateMachine.obtainMessage(BassClientStateMachine.CONNECT_TIMEOUT),
+                BassClientStateMachine.Disconnected.class);
+
+        // disconnected -> connecting ---DISCONNECT---> disconnected
+        sendMessageAndVerifyTransition(
+                mBassClientStateMachine.obtainMessage(CONNECT),
+                BassClientStateMachine.Connecting.class);
+        sendMessageAndVerifyTransition(
+                mBassClientStateMachine.obtainMessage(BassClientStateMachine.DISCONNECT),
+                BassClientStateMachine.Disconnected.class);
+
+        // disconnected -> connecting ---CONNECTION_STATE_CHANGED(connected)---> connected -->
+        // disconnected
+        sendMessageAndVerifyTransition(
+                mBassClientStateMachine.obtainMessage(CONNECT),
+                BassClientStateMachine.Connecting.class);
+        sendMessageAndVerifyTransition(
+                mBassClientStateMachine.obtainMessage(
+                        CONNECTION_STATE_CHANGED,
+                        Integer.valueOf(BluetoothProfile.STATE_CONNECTED)),
+                BassClientStateMachine.Connected.class);
+        sendMessageAndVerifyTransition(
+                mBassClientStateMachine.obtainMessage(
+                        CONNECTION_STATE_CHANGED,
+                        Integer.valueOf(BluetoothProfile.STATE_DISCONNECTED)),
+                BassClientStateMachine.Disconnected.class);
+
+        // disconnected -> connecting ---CONNECTION_STATE_CHANGED(non-connected) --> disconnected
+        sendMessageAndVerifyTransition(
+                mBassClientStateMachine.obtainMessage(CONNECT),
+                BassClientStateMachine.Connecting.class);
+        sendMessageAndVerifyTransition(
+                mBassClientStateMachine.obtainMessage(
+                        CONNECTION_STATE_CHANGED,
+                        Integer.valueOf(BluetoothProfile.STATE_DISCONNECTED)),
+                BassClientStateMachine.Disconnected.class);
+
+        // change default state to connected for the next tests
+        sendMessageAndVerifyTransition(
+                mBassClientStateMachine.obtainMessage(CONNECT),
+                BassClientStateMachine.Connecting.class);
+        sendMessageAndVerifyTransition(
+                mBassClientStateMachine.obtainMessage(
+                        CONNECTION_STATE_CHANGED,
+                        Integer.valueOf(BluetoothProfile.STATE_CONNECTED)),
+                BassClientStateMachine.Connected.class);
+
+        // connected ----READ_BASS_CHARACTERISTICS---> connectedProcessing --GATT_TXN_PROCESSED
+        // --> connected
+
+        // Make bluetoothGatt non-null so state will transit
+        mBassClientStateMachine.mBluetoothGatt = Mockito.mock(
+                BassClientStateMachine.BluetoothGattTestableWrapper.class);
+        mBassClientStateMachine.mBroadcastScanControlPoint = new BluetoothGattCharacteristic(
+                BassConstants.BASS_BCAST_AUDIO_SCAN_CTRL_POINT,
+                BluetoothGattCharacteristic.PROPERTY_READ,
+                BluetoothGattCharacteristic.PERMISSION_READ);
+
+        sendMessageAndVerifyTransition(
+                mBassClientStateMachine.obtainMessage(
+                        READ_BASS_CHARACTERISTICS,
+                        new BluetoothGattCharacteristic(UUID.randomUUID(),
+                                BluetoothGattCharacteristic.PROPERTY_READ,
+                                BluetoothGattCharacteristic.PERMISSION_READ)),
+                BassClientStateMachine.ConnectedProcessing.class);
+        sendMessageAndVerifyTransition(
+                mBassClientStateMachine.obtainMessage(GATT_TXN_PROCESSED),
+                BassClientStateMachine.Connected.class);
+
+        // connected ----READ_BASS_CHARACTERISTICS---> connectedProcessing --GATT_TXN_TIMEOUT -->
+        // connected
+        sendMessageAndVerifyTransition(
+                mBassClientStateMachine.obtainMessage(
+                        READ_BASS_CHARACTERISTICS,
+                        new BluetoothGattCharacteristic(UUID.randomUUID(),
+                                BluetoothGattCharacteristic.PROPERTY_READ,
+                                BluetoothGattCharacteristic.PERMISSION_READ)),
+                BassClientStateMachine.ConnectedProcessing.class);
+        sendMessageAndVerifyTransition(
+                mBassClientStateMachine.obtainMessage(GATT_TXN_TIMEOUT),
+                BassClientStateMachine.Connected.class);
+
+        // connected ----START_SCAN_OFFLOAD---> connectedProcessing --GATT_TXN_PROCESSED-->
+        // connected
+        sendMessageAndVerifyTransition(
+                mBassClientStateMachine.obtainMessage(BassClientStateMachine.START_SCAN_OFFLOAD),
+                BassClientStateMachine.ConnectedProcessing.class);
+        sendMessageAndVerifyTransition(
+                mBassClientStateMachine.obtainMessage(GATT_TXN_PROCESSED),
+                BassClientStateMachine.Connected.class);
+
+        // connected ----STOP_SCAN_OFFLOAD---> connectedProcessing --GATT_TXN_PROCESSED--> connected
+        sendMessageAndVerifyTransition(
+                mBassClientStateMachine.obtainMessage(STOP_SCAN_OFFLOAD),
+                BassClientStateMachine.ConnectedProcessing.class);
+        sendMessageAndVerifyTransition(
+                mBassClientStateMachine.obtainMessage(GATT_TXN_PROCESSED),
+                BassClientStateMachine.Connected.class);
+    }
+
+    @Test
+    public void acquireAllBassChars() {
+        BassClientStateMachine.BluetoothGattTestableWrapper btGatt = Mockito.mock(
+                BassClientStateMachine.BluetoothGattTestableWrapper.class);
+        mBassClientStateMachine.mBluetoothGatt = btGatt;
+        // Do nothing when mBluetoothGatt.getService returns null
+        mBassClientStateMachine.acquireAllBassChars();
+
+        BluetoothGattService gattService = Mockito.mock(BluetoothGattService.class);
+        when(btGatt.getService(BassConstants.BASS_UUID)).thenReturn(gattService);
+
+        List<BluetoothGattCharacteristic> characteristics = new ArrayList<>();
+        BluetoothGattCharacteristic scanControlPoint = new BluetoothGattCharacteristic(
+                BassConstants.BASS_BCAST_AUDIO_SCAN_CTRL_POINT,
+                BluetoothGattCharacteristic.PROPERTY_READ,
+                BluetoothGattCharacteristic.PERMISSION_READ);
+        characteristics.add(scanControlPoint);
+
+        BluetoothGattCharacteristic bassCharacteristic = new BluetoothGattCharacteristic(
+                UUID.randomUUID(),
+                BluetoothGattCharacteristic.PROPERTY_READ,
+                BluetoothGattCharacteristic.PERMISSION_READ);
+        characteristics.add(bassCharacteristic);
+
+        when(gattService.getCharacteristics()).thenReturn(characteristics);
+        mBassClientStateMachine.acquireAllBassChars();
+        assertThat(mBassClientStateMachine.mBroadcastScanControlPoint).isEqualTo(scanControlPoint);
+        assertThat(mBassClientStateMachine.mBroadcastCharacteristics).contains(bassCharacteristic);
+    }
+
+    @Test
+    public void simpleMethods() {
+        // dump() shouldn't crash
+        StringBuilder sb = new StringBuilder();
+        mBassClientStateMachine.dump(sb);
+
+        // log() shouldn't crash
+        String msg = "test-log-message";
+        mBassClientStateMachine.log(msg);
+
+        // messageWhatToString() shouldn't crash
+        for (int i = CONNECT; i <= CONNECT_TIMEOUT + 1; ++i) {
+            mBassClientStateMachine.messageWhatToString(i);
+        }
+
+        final int invalidSourceId = -100;
+        assertThat(mBassClientStateMachine.getCurrentBroadcastMetadata(invalidSourceId)).isNull();
+        assertThat(mBassClientStateMachine.getDevice()).isEqualTo(mTestDevice);
+        assertThat(mBassClientStateMachine.hasPendingSourceOperation()).isFalse();
+        assertThat(mBassClientStateMachine.isEmpty(new byte[] { 0 })).isTrue();
+        assertThat(mBassClientStateMachine.isEmpty(new byte[] { 1 })).isFalse();
+        assertThat(mBassClientStateMachine.isPendingRemove(invalidSourceId)).isFalse();
+    }
+
+    @Test
+    public void parseScanRecord_withoutBaseData_makesNoStopScanOffloadFalse() {
+        byte[] scanRecord = new byte[]{
+                0x02, 0x01, 0x1a, // advertising flags
+                0x05, 0x02, 0x0b, 0x11, 0x0a, 0x11, // 16 bit service uuids
+                0x04, 0x09, 0x50, 0x65, 0x64, // name
+                0x02, 0x0A, (byte) 0xec, // tx power level
+                0x05, 0x16, 0x0b, 0x11, 0x50, 0x64, // service data
+                0x05, (byte) 0xff, (byte) 0xe0, 0x00, 0x02, 0x15, // manufacturer specific data
+                0x03, 0x50, 0x01, 0x02, // an unknown data type won't cause trouble
+        };
+        ScanRecord data = ScanRecord.parseFromBytes(scanRecord);
+        mBassClientStateMachine.mNoStopScanOffload = true;
+        mBassClientStateMachine.parseScanRecord(0, data);
+        assertThat(mBassClientStateMachine.mNoStopScanOffload).isFalse();
+    }
+
+    @Test
+    public void parseScanRecord_withBaseData_callsUpdateBase() {
+        byte[] scanRecordWithBaseData = new byte[] {
+                0x02, 0x01, 0x1a, // advertising flags
+                0x05, 0x02, 0x51, 0x18, 0x0a, 0x11, // 16 bit service uuids
+                0x04, 0x09, 0x50, 0x65, 0x64, // name
+                0x02, 0x0A, (byte) 0xec, // tx power level
+                0x15, 0x16, 0x51, 0x18, // service data (base data with 18 bytes)
+                    // LEVEL 1
+                    (byte) 0x01, (byte) 0x02, (byte) 0x03, // presentationDelay
+                    (byte) 0x01,  // numSubGroups
+                    // LEVEL 2
+                    (byte) 0x01,  // numSubGroups
+                    (byte) 0xFE,  // UNKNOWN_CODEC
+                    (byte) 0x02,  // codecConfigLength
+                    (byte) 0x01, (byte) 'A', // codecConfigInfo
+                    (byte) 0x03,  // metaDataLength
+                    (byte) 0x06, (byte) 0x07, (byte) 0x08,  // metaData
+                    // LEVEL 3
+                    (byte) 0x04,  // index
+                    (byte) 0x03,  // codecConfigLength
+                    (byte) 0x02, (byte) 'B', (byte) 'C', // codecConfigInfo
+                0x05, (byte) 0xff, (byte) 0xe0, 0x00, 0x02, 0x15, // manufacturer specific data
+                0x03, 0x50, 0x01, 0x02, // an unknown data type won't cause trouble
+        };
+        ScanRecord data = ScanRecord.parseFromBytes(scanRecordWithBaseData);
+        assertThat(data.getServiceUuids()).contains(BassConstants.BASIC_AUDIO_UUID);
+        assertThat(data.getServiceData(BassConstants.BASIC_AUDIO_UUID)).isNotNull();
+        mBassClientStateMachine.parseScanRecord(0, data);
+        verify(mBassClientService).updateBase(anyInt(), any());
+    }
+
+    @Test
+    public void gattCallbackOnConnectionStateChange_changedToConnected()
+            throws InterruptedException {
+        mBassClientStateMachine.connectGatt(true);
+        BluetoothGattCallback cb = mBassClientStateMachine.mGattCallback;
+        BassClientStateMachine.BluetoothGattTestableWrapper btGatt = Mockito.mock(
+                BassClientStateMachine.BluetoothGattTestableWrapper.class);
+        mBassClientStateMachine.mBluetoothGatt = btGatt;
+
+        // disallow connection
+        allowConnection(false);
+        int status = BluetoothProfile.STATE_CONNECTING;
+        int newState = BluetoothProfile.STATE_CONNECTED;
+        cb.onConnectionStateChange(null, status, newState);
+        TestUtils.waitForLooperToFinishScheduledTask(mHandlerThread.getLooper());
+
+        verify(btGatt).disconnect();
+        verify(btGatt).close();
+        assertThat(mBassClientStateMachine.mBluetoothGatt).isNull();
+        assertThat(mBassClientStateMachine.mMsgWhats).contains(CONNECTION_STATE_CHANGED);
+        mBassClientStateMachine.mMsgWhats.clear();
+
+        mBassClientStateMachine.mBluetoothGatt = btGatt;
+        allowConnection(true);
+        mBassClientStateMachine.mDiscoveryInitiated = false;
+        status = BluetoothProfile.STATE_DISCONNECTED;
+        newState = BluetoothProfile.STATE_CONNECTED;
+        cb.onConnectionStateChange(null, status, newState);
+        TestUtils.waitForLooperToFinishScheduledTask(mHandlerThread.getLooper());
+
+        assertThat(mBassClientStateMachine.mDiscoveryInitiated).isTrue();
+        assertThat(mBassClientStateMachine.mMsgWhats).contains(CONNECTION_STATE_CHANGED);
+        assertThat(mBassClientStateMachine.mMsgObj).isEqualTo(newState);
+        mBassClientStateMachine.mMsgWhats.clear();
+    }
+
+    @Test
+    public void gattCallbackOnConnectionStateChanged_changedToDisconnected()
+            throws InterruptedException {
+        initToConnectingState();
+        mBassClientStateMachine.connectGatt(true);
+        BluetoothGattCallback cb = mBassClientStateMachine.mGattCallback;
+        BassClientStateMachine.BluetoothGattTestableWrapper btGatt = Mockito.mock(
+                BassClientStateMachine.BluetoothGattTestableWrapper.class);
+        mBassClientStateMachine.mBluetoothGatt = btGatt;
+
+        allowConnection(false);
+        int status = BluetoothProfile.STATE_CONNECTING;
+        int newState = BluetoothProfile.STATE_DISCONNECTED;
+        cb.onConnectionStateChange(null, status, newState);
+        TestUtils.waitForLooperToFinishScheduledTask(mHandlerThread.getLooper());
+
+        assertThat(mBassClientStateMachine.mMsgWhats).contains(CONNECTION_STATE_CHANGED);
+        assertThat(mBassClientStateMachine.mMsgObj).isEqualTo(newState);
+        mBassClientStateMachine.mMsgWhats.clear();
+    }
+
+    @Test
+    public void gattCallbackOnServicesDiscovered() {
+        mBassClientStateMachine.connectGatt(true);
+        BluetoothGattCallback cb = mBassClientStateMachine.mGattCallback;
+        BassClientStateMachine.BluetoothGattTestableWrapper btGatt = Mockito.mock(
+                BassClientStateMachine.BluetoothGattTestableWrapper.class);
+        mBassClientStateMachine.mBluetoothGatt = btGatt;
+
+        // Do nothing if mDiscoveryInitiated is false.
+        mBassClientStateMachine.mDiscoveryInitiated = false;
+        int status = GATT_FAILURE;
+        cb.onServicesDiscovered(null, status);
+
+        verify(btGatt, never()).requestMtu(anyInt());
+
+        // Do nothing if status is not GATT_SUCCESS.
+        mBassClientStateMachine.mDiscoveryInitiated = true;
+        status = GATT_FAILURE;
+        cb.onServicesDiscovered(null, status);
+
+        verify(btGatt, never()).requestMtu(anyInt());
+
+        // call requestMtu() if status is GATT_SUCCESS.
+        mBassClientStateMachine.mDiscoveryInitiated = true;
+        status = GATT_SUCCESS;
+        cb.onServicesDiscovered(null, status);
+
+        verify(btGatt).requestMtu(anyInt());
+    }
+
+    /**
+     * This also tests BassClientStateMachine#processBroadcastReceiverState.
+     */
+    @Test
+    public void gattCallbackOnCharacteristicRead() {
+        mBassClientStateMachine.mShouldHandleMessage = false;
+        mBassClientStateMachine.connectGatt(true);
+        BluetoothGattCallback cb = mBassClientStateMachine.mGattCallback;
+        BluetoothGattDescriptor desc = Mockito.mock(BluetoothGattDescriptor.class);
+        BassClientService.Callbacks callbacks = Mockito.mock(BassClientService.Callbacks.class);
+        BluetoothGattCharacteristic characteristic =
+                Mockito.mock(BluetoothGattCharacteristic.class);
+        BassClientStateMachine.BluetoothGattTestableWrapper btGatt = Mockito.mock(
+                BassClientStateMachine.BluetoothGattTestableWrapper.class);
+        when(characteristic.getUuid()).thenReturn(BassConstants.BASS_BCAST_RECEIVER_STATE);
+        when(mBassClientService.getCallbacks()).thenReturn(callbacks);
+
+        // Characteristic read success with null value
+        when(characteristic.getValue()).thenReturn(null);
+        cb.onCharacteristicRead(null, characteristic, GATT_SUCCESS);
+        verify(characteristic, never()).getDescriptor(any());
+
+        // Characteristic read failed and mBluetoothGatt is null.
+        mBassClientStateMachine.mBluetoothGatt = null;
+        cb.onCharacteristicRead(null, characteristic, GATT_FAILURE);
+        TestUtils.waitForLooperToFinishScheduledTask(mHandlerThread.getLooper());
+
+        assertThat(mBassClientStateMachine.mMsgWhats).contains(GATT_TXN_PROCESSED);
+        assertThat(mBassClientStateMachine.mMsgAgr1).isEqualTo(GATT_FAILURE);
+        mBassClientStateMachine.mMsgWhats.clear();
+
+
+        // Characteristic read failed and mBluetoothGatt is not null.
+        mBassClientStateMachine.mBluetoothGatt = btGatt;
+        when(characteristic.getDescriptor(CLIENT_CHARACTERISTIC_CONFIG)).thenReturn(desc);
+        cb.onCharacteristicRead(null, characteristic, GATT_FAILURE);
+
+        verify(btGatt).setCharacteristicNotification(any(), anyBoolean());
+        verify(btGatt).writeDescriptor(desc);
+        verify(desc).setValue(BluetoothGattDescriptor.ENABLE_NOTIFICATION_VALUE);
+
+        // Tests for processBroadcastReceiverState
+        int sourceId = 1;
+        byte[] value = new byte[] { };
+        mBassClientStateMachine.mNumOfBroadcastReceiverStates = 2;
+        mBassClientStateMachine.mPendingOperation = REMOVE_BCAST_SOURCE;
+        mBassClientStateMachine.mPendingSourceId = (byte) sourceId;
+        when(characteristic.getValue()).thenReturn(value);
+        when(characteristic.getInstanceId()).thenReturn(sourceId);
+
+        cb.onCharacteristicRead(null, characteristic, GATT_SUCCESS);
+        TestUtils.waitForLooperToFinishScheduledTask(mHandlerThread.getLooper());
+        verify(callbacks).notifyReceiveStateChanged(any(), anyInt(), any());
+
+        mBassClientStateMachine.mPendingOperation = 0;
+        mBassClientStateMachine.mPendingSourceId = 0;
+        sourceId = 2; // mNextId would become 2
+        when(characteristic.getInstanceId()).thenReturn(sourceId);
+
+        Mockito.clearInvocations(callbacks);
+        cb.onCharacteristicRead(null, characteristic, GATT_SUCCESS);
+        TestUtils.waitForLooperToFinishScheduledTask(mHandlerThread.getLooper());
+        verify(callbacks).notifyReceiveStateChanged(any(), anyInt(), any());
+
+        mBassClientStateMachine.mPendingMetadata = createBroadcastMetadata();
+        sourceId = 1;
+        value = new byte[] {
+                (byte) sourceId,  // sourceId
+                0x00,  // sourceAddressType
+                0x01, 0x02, 0x03, 0x04, 0x05, 0x00,  // sourceAddress
+                0x00,  // sourceAdvSid
+                0x00, 0x00, 0x00,  // broadcastIdBytes
+                (byte) BluetoothLeBroadcastReceiveState.PA_SYNC_STATE_NO_PAST,
+                (byte) BluetoothLeBroadcastReceiveState.BIG_ENCRYPTION_STATE_BAD_CODE,
+                // 16 bytes badBroadcastCode
+                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x01, // numSubGroups
+                // SubGroup #1
+                0x00, 0x00, 0x00, 0x00, // audioSyncIndex
+                0x02, // metaDataLength
+                0x00, 0x00, // metadata
+        };
+        when(characteristic.getValue()).thenReturn(value);
+        when(characteristic.getInstanceId()).thenReturn(sourceId);
+
+        Mockito.clearInvocations(callbacks);
+        cb.onCharacteristicRead(null, characteristic, GATT_SUCCESS);
+        TestUtils.waitForLooperToFinishScheduledTask(mHandlerThread.getLooper());
+
+        verify(callbacks).notifySourceAdded(any(), any(), anyInt());
+        verify(callbacks).notifyReceiveStateChanged(any(), anyInt(), any());
+        assertThat(mBassClientStateMachine.mMsgWhats).contains(STOP_SCAN_OFFLOAD);
+
+        // set some values for covering more lines of processPASyncState()
+        mBassClientStateMachine.mPendingMetadata = null;
+        mBassClientStateMachine.mSetBroadcastCodePending = true;
+        mBassClientStateMachine.mIsPendingRemove = true;
+        value[BassConstants.BCAST_RCVR_STATE_PA_SYNC_IDX] =
+                BluetoothLeBroadcastReceiveState.PA_SYNC_STATE_SYNCINFO_REQUEST;
+        value[BassConstants.BCAST_RCVR_STATE_ENC_STATUS_IDX] =
+                BluetoothLeBroadcastReceiveState.BIG_ENCRYPTION_STATE_CODE_REQUIRED;
+        value[35] = 0; // set metaDataLength of subgroup #1 0
+        PeriodicAdvertisementResult paResult = Mockito.mock(PeriodicAdvertisementResult.class);
+        when(characteristic.getValue()).thenReturn(value);
+        when(mBassClientService.getPeriodicAdvertisementResult(any())).thenReturn(paResult);
+        when(paResult.getSyncHandle()).thenReturn(100);
+
+        Mockito.clearInvocations(callbacks);
+        cb.onCharacteristicRead(null, characteristic, GATT_SUCCESS);
+        TestUtils.waitForLooperToFinishScheduledTask(mHandlerThread.getLooper());
+
+        verify(callbacks).notifyReceiveStateChanged(any(), anyInt(), any());
+        assertThat(mBassClientStateMachine.mMsgWhats).contains(REMOVE_BCAST_SOURCE);
+
+        mBassClientStateMachine.mIsPendingRemove = null;
+        // set some values for covering more lines of processPASyncState()
+        mBassClientStateMachine.mPendingMetadata = createBroadcastMetadata();
+        for (int i = 0; i < BassConstants.BCAST_RCVR_STATE_SRC_ADDR_SIZE; ++i) {
+            value[BassConstants.BCAST_RCVR_STATE_SRC_ADDR_START_IDX + i] = 0x00;
+        }
+        when(mBassClientService.getPeriodicAdvertisementResult(any())).thenReturn(null);
+        when(mBassClientService.isLocalBroadcast(any())).thenReturn(true);
+        when(characteristic.getValue()).thenReturn(value);
+
+        Mockito.clearInvocations(callbacks);
+        cb.onCharacteristicRead(null, characteristic, GATT_SUCCESS);
+        TestUtils.waitForLooperToFinishScheduledTask(mHandlerThread.getLooper());
+
+        verify(callbacks).notifySourceRemoved(any(), anyInt(), anyInt());
+        verify(callbacks).notifyReceiveStateChanged(any(), anyInt(), any());
+    }
+
+    @Test
+    public void gattCallbackOnCharacteristicChanged() {
+        mBassClientStateMachine.connectGatt(true);
+        BluetoothGattCallback cb = mBassClientStateMachine.mGattCallback;
+        mBassClientStateMachine.mNumOfBroadcastReceiverStates = 1;
+        BassClientService.Callbacks callbacks = Mockito.mock(BassClientService.Callbacks.class);
+        when(mBassClientService.getCallbacks()).thenReturn(callbacks);
+
+        BluetoothGattCharacteristic characteristic =
+                Mockito.mock(BluetoothGattCharacteristic.class);
+        when(characteristic.getUuid()).thenReturn(BassConstants.BASS_BCAST_RECEIVER_STATE);
+        when(characteristic.getValue()).thenReturn(null);
+
+        cb.onCharacteristicChanged(null, characteristic);
+        verify(characteristic, atLeast(1)).getUuid();
+        verify(characteristic).getValue();
+        verify(callbacks, never()).notifyReceiveStateChanged(any(), anyInt(), any());
+        TestUtils.waitForLooperToFinishScheduledTask(mHandlerThread.getLooper());
+
+        mBassClientStateMachine.mNumOfBroadcastReceiverStates = 1;
+        Mockito.clearInvocations(characteristic);
+        when(characteristic.getValue()).thenReturn(new byte[] { });
+        cb.onCharacteristicChanged(null, characteristic);
+        verify(characteristic, atLeast(1)).getUuid();
+        verify(characteristic, atLeast(1)).getValue();
+        verify(callbacks).notifyReceiveStateChanged(any(), anyInt(), any());
+    }
+
+    @Test
+    public void gattCharacteristicWrite() {
+        mBassClientStateMachine.connectGatt(true);
+        BluetoothGattCallback cb = mBassClientStateMachine.mGattCallback;
+
+        BluetoothGattCharacteristic characteristic =Mockito.mock(BluetoothGattCharacteristic.class);
+        when(characteristic.getUuid()).thenReturn(BassConstants.BASS_BCAST_AUDIO_SCAN_CTRL_POINT);
+
+        cb.onCharacteristicWrite(null, characteristic, GATT_SUCCESS);
+        TestUtils.waitForLooperToFinishScheduledTask(mHandlerThread.getLooper());
+        assertThat(mBassClientStateMachine.mMsgWhats).contains(GATT_TXN_PROCESSED);
+    }
+
+    @Test
+    public void gattCallbackOnDescriptorWrite() {
+        mBassClientStateMachine.connectGatt(true);
+        BluetoothGattCallback cb = mBassClientStateMachine.mGattCallback;
+        BluetoothGattDescriptor descriptor = Mockito.mock(BluetoothGattDescriptor.class);
+        when(descriptor.getUuid()).thenReturn(BassConstants.CLIENT_CHARACTERISTIC_CONFIG);
+
+        cb.onDescriptorWrite(null, descriptor, GATT_SUCCESS);
+        TestUtils.waitForLooperToFinishScheduledTask(mHandlerThread.getLooper());
+        assertThat(mBassClientStateMachine.mMsgWhats).contains(GATT_TXN_PROCESSED);
+    }
+
+    @Test
+    public void gattCallbackOnMtuChanged() {
+        mBassClientStateMachine.connectGatt(true);
+        BluetoothGattCallback cb = mBassClientStateMachine.mGattCallback;
+        mBassClientStateMachine.mMTUChangeRequested = true;
+
+        cb.onMtuChanged(null, 10, GATT_SUCCESS);
+        assertThat(mBassClientStateMachine.mMTUChangeRequested).isTrue();
+
+        BassClientStateMachine.BluetoothGattTestableWrapper btGatt = Mockito.mock(
+                BassClientStateMachine.BluetoothGattTestableWrapper.class);
+        mBassClientStateMachine.mBluetoothGatt = btGatt;
+
+        cb.onMtuChanged(null, 10, GATT_SUCCESS);
+        assertThat(mBassClientStateMachine.mMTUChangeRequested).isFalse();
+    }
+
+    @Test
+    public void sendConnectMessage_inDisconnectedState() {
+        initToDisconnectedState();
+
+        BassClientStateMachine.BluetoothGattTestableWrapper btGatt = Mockito.mock(
+                BassClientStateMachine.BluetoothGattTestableWrapper.class);
+        mBassClientStateMachine.mBluetoothGatt = btGatt;
+
+        sendMessageAndVerifyTransition(
+                mBassClientStateMachine.obtainMessage(CONNECT),
+                BassClientStateMachine.Connecting.class);
+        verify(btGatt).disconnect();
+        verify(btGatt).close();
+    }
+
+    @Test
+    public void sendDisconnectMessage_inDisconnectedState() {
+        initToDisconnectedState();
+
+        BassClientStateMachine.BluetoothGattTestableWrapper btGatt = Mockito.mock(
+                BassClientStateMachine.BluetoothGattTestableWrapper.class);
+        mBassClientStateMachine.mBluetoothGatt = btGatt;
+
+        mBassClientStateMachine.sendMessage(DISCONNECT);
+        TestUtils.waitForLooperToFinishScheduledTask(mHandlerThread.getLooper());
+        verify(btGatt).disconnect();
+        verify(btGatt).close();
+    }
+
+    @Test
+    public void sendStateChangedMessage_inDisconnectedState() {
+        initToDisconnectedState();
+
+        BassClientStateMachine.BluetoothGattTestableWrapper btGatt = Mockito.mock(
+                BassClientStateMachine.BluetoothGattTestableWrapper.class);
+        mBassClientStateMachine.mBluetoothGatt = btGatt;
+
+        Message msgToConnectingState =
+                mBassClientStateMachine.obtainMessage(CONNECTION_STATE_CHANGED);
+        msgToConnectingState.obj = BluetoothProfile.STATE_CONNECTING;
+
+        mBassClientStateMachine.sendMessage(msgToConnectingState);
+        TestUtils.waitForLooperToFinishScheduledTask(mHandlerThread.getLooper());
+        verify(mBassClientService, never()).sendBroadcast(any(Intent.class), anyString(), any());
+
+        Message msgToConnectedState =
+                mBassClientStateMachine.obtainMessage(CONNECTION_STATE_CHANGED);
+        msgToConnectedState.obj = BluetoothProfile.STATE_CONNECTED;
+        sendMessageAndVerifyTransition(msgToConnectedState, BassClientStateMachine.Connected.class);
+    }
+
+    @Test
+    public void sendOtherMessages_inDisconnectedState_doesNotChangeState() {
+        initToDisconnectedState();
+
+        mBassClientStateMachine.sendMessage(PSYNC_ACTIVE_TIMEOUT);
+        TestUtils.waitForLooperToFinishScheduledTask(mHandlerThread.getLooper());
+        verify(mBassClientService, never()).sendBroadcast(any(Intent.class), anyString(), any());
+
+        mBassClientStateMachine.sendMessage(-1);
+        TestUtils.waitForLooperToFinishScheduledTask(mHandlerThread.getLooper());
+        verify(mBassClientService, never()).sendBroadcast(any(Intent.class), anyString(), any());
+    }
+
+    @Test
+    public void sendConnectMessages_inConnectingState_doesNotChangeState() {
+        initToConnectingState();
+
+        mBassClientStateMachine.sendMessage(CONNECT);
+        TestUtils.waitForLooperToFinishScheduledTask(mHandlerThread.getLooper());
+        verify(mBassClientService, never()).sendBroadcast(any(Intent.class), anyString(), any());
+    }
+
+    @Test
+    public void sendDisconnectMessages_inConnectingState_defersMessage() {
+        initToConnectingState();
+
+        mBassClientStateMachine.sendMessage(DISCONNECT);
+        TestUtils.waitForLooperToFinishScheduledTask(mHandlerThread.getLooper());
+        assertThat(mBassClientStateMachine.hasDeferredMessagesSuper(DISCONNECT)).isTrue();
+    }
+
+    @Test
+    public void sendReadBassCharacteristicsMessage_inConnectingState_defersMessage() {
+        initToConnectingState();
+
+        mBassClientStateMachine.sendMessage(READ_BASS_CHARACTERISTICS);
+        TestUtils.waitForLooperToFinishScheduledTask(mHandlerThread.getLooper());
+        assertThat(mBassClientStateMachine.hasDeferredMessagesSuper(READ_BASS_CHARACTERISTICS))
+                .isTrue();
+    }
+
+    @Test
+    public void sendPsyncActiveTimeoutMessage_inConnectingState_defersMessage() {
+        initToConnectingState();
+
+        mBassClientStateMachine.sendMessage(PSYNC_ACTIVE_TIMEOUT);
+        TestUtils.waitForLooperToFinishScheduledTask(mHandlerThread.getLooper());
+        assertThat(mBassClientStateMachine.hasDeferredMessagesSuper(PSYNC_ACTIVE_TIMEOUT)).isTrue();
+    }
+
+    @Test
+    public void sendStateChangedToNonConnectedMessage_inConnectingState_movesToDisconnected() {
+        initToConnectingState();
+
+        Message msg = mBassClientStateMachine.obtainMessage(CONNECTION_STATE_CHANGED);
+        msg.obj = BluetoothProfile.STATE_CONNECTING;
+        sendMessageAndVerifyTransition(msg, BassClientStateMachine.Disconnected.class);
+    }
+
+    @Test
+    public void sendStateChangedToConnectedMessage_inConnectingState_movesToConnected() {
+        initToConnectingState();
+
+        Message msg = mBassClientStateMachine.obtainMessage(CONNECTION_STATE_CHANGED);
+        msg.obj = BluetoothProfile.STATE_CONNECTED;
+        sendMessageAndVerifyTransition(msg, BassClientStateMachine.Connected.class);
+    }
+
+    @Test
+    public void sendConnectTimeMessage_inConnectingState() {
+        initToConnectingState();
+
+        Message timeoutWithDifferentDevice = mBassClientStateMachine.obtainMessage(CONNECT_TIMEOUT,
+                mAdapter.getRemoteDevice("00:00:00:00:00:00"));
+        mBassClientStateMachine.sendMessage(timeoutWithDifferentDevice);
+        TestUtils.waitForLooperToFinishScheduledTask(mHandlerThread.getLooper());
+        verify(mBassClientService, never()).sendBroadcast(any(Intent.class), anyString(), any());
+
+        Message msg = mBassClientStateMachine.obtainMessage(CONNECT_TIMEOUT, mTestDevice);
+        sendMessageAndVerifyTransition(msg, BassClientStateMachine.Disconnected.class);
+    }
+
+    @Test
+    public void sendInvalidMessage_inConnectingState_doesNotChangeState() {
+        initToConnectingState();
+        mBassClientStateMachine.sendMessage(-1);
+        TestUtils.waitForLooperToFinishScheduledTask(mHandlerThread.getLooper());
+        verify(mBassClientService, never()).sendBroadcast(any(Intent.class), anyString(), any());
+    }
+
+    @Test
+    public void sendConnectMessage_inConnectedState() {
+        initToConnectedState();
+
+        mBassClientStateMachine.sendMessage(CONNECT);
+        TestUtils.waitForLooperToFinishScheduledTask(mHandlerThread.getLooper());
+        verify(mBassClientService, never()).sendBroadcast(any(Intent.class), anyString(), any());
+    }
+
+    @Test
+    public void sendDisconnectMessage_inConnectedState() {
+        initToConnectedState();
+
+        mBassClientStateMachine.mBluetoothGatt = null;
+        mBassClientStateMachine.sendMessage(DISCONNECT);
+        TestUtils.waitForLooperToFinishScheduledTask(mHandlerThread.getLooper());
+        verify(mBassClientService, never()).sendBroadcast(any(Intent.class), anyString(), any());
+
+        BassClientStateMachine.BluetoothGattTestableWrapper btGatt = Mockito.mock(
+                BassClientStateMachine.BluetoothGattTestableWrapper.class);
+        mBassClientStateMachine.mBluetoothGatt = btGatt;
+        sendMessageAndVerifyTransition(
+                mBassClientStateMachine.obtainMessage(DISCONNECT),
+                BassClientStateMachine.Disconnected.class);
+        verify(btGatt).disconnect();
+        verify(btGatt).close();
+    }
+
+    @Test
+    public void sendStateChangedMessage_inConnectedState() {
+        initToConnectedState();
+
+        Message connectedMsg = mBassClientStateMachine.obtainMessage(CONNECTION_STATE_CHANGED);
+        connectedMsg.obj = BluetoothProfile.STATE_CONNECTED;
+        mBassClientStateMachine.sendMessage(connectedMsg);
+        TestUtils.waitForLooperToFinishScheduledTask(mHandlerThread.getLooper());
+        verify(mBassClientService, never()).sendBroadcast(any(Intent.class), anyString(), any());
+
+        Message noneConnectedMsg = mBassClientStateMachine.obtainMessage(CONNECTION_STATE_CHANGED);
+        noneConnectedMsg.obj = BluetoothProfile.STATE_DISCONNECTING;
+        sendMessageAndVerifyTransition(noneConnectedMsg, BassClientStateMachine.Disconnected.class);
+    }
+
+    @Test
+    public void sendReadBassCharacteristicsMessage_inConnectedState() {
+        initToConnectedState();
+        BluetoothGattCharacteristic gattCharacteristic = Mockito.mock(
+                BluetoothGattCharacteristic.class);
+
+        mBassClientStateMachine.sendMessage(READ_BASS_CHARACTERISTICS, gattCharacteristic);
+        TestUtils.waitForLooperToFinishScheduledTask(mHandlerThread.getLooper());
+        verify(mBassClientService, never()).sendBroadcast(any(Intent.class), anyString(), any());
+
+        BassClientStateMachine.BluetoothGattTestableWrapper btGatt = Mockito.mock(
+                BassClientStateMachine.BluetoothGattTestableWrapper.class);
+        mBassClientStateMachine.mBluetoothGatt = btGatt;
+        sendMessageAndVerifyTransition(mBassClientStateMachine.obtainMessage(
+                READ_BASS_CHARACTERISTICS, gattCharacteristic),
+                BassClientStateMachine.ConnectedProcessing.class);
+    }
+
+    @Test
+    public void sendStartScanOffloadMessage_inConnectedState() {
+        initToConnectedState();
+        BassClientStateMachine.BluetoothGattTestableWrapper btGatt = Mockito.mock(
+                BassClientStateMachine.BluetoothGattTestableWrapper.class);
+        mBassClientStateMachine.mBluetoothGatt = btGatt;
+
+        mBassClientStateMachine.sendMessage(START_SCAN_OFFLOAD);
+        TestUtils.waitForLooperToFinishScheduledTask(mHandlerThread.getLooper());
+        verify(mBassClientService, never()).sendBroadcast(any(Intent.class), anyString(), any());
+
+        BluetoothGattCharacteristic scanControlPoint = Mockito.mock(
+                BluetoothGattCharacteristic.class);
+        mBassClientStateMachine.mBroadcastScanControlPoint = scanControlPoint;
+
+        sendMessageAndVerifyTransition(
+                mBassClientStateMachine.obtainMessage(START_SCAN_OFFLOAD),
+                BassClientStateMachine.ConnectedProcessing.class);
+        verify(btGatt).writeCharacteristic(scanControlPoint);
+        verify(scanControlPoint).setValue(REMOTE_SCAN_START);
+    }
+
+    @Test
+    public void sendStopScanOffloadMessage_inConnectedState() {
+        initToConnectedState();
+        BassClientStateMachine.BluetoothGattTestableWrapper btGatt = Mockito.mock(
+                BassClientStateMachine.BluetoothGattTestableWrapper.class);
+        mBassClientStateMachine.mBluetoothGatt = btGatt;
+
+        mBassClientStateMachine.sendMessage(STOP_SCAN_OFFLOAD);
+        TestUtils.waitForLooperToFinishScheduledTask(mHandlerThread.getLooper());
+        verify(mBassClientService, never()).sendBroadcast(any(Intent.class), anyString(), any());
+
+        BluetoothGattCharacteristic scanControlPoint = Mockito.mock(
+                BluetoothGattCharacteristic.class);
+        mBassClientStateMachine.mBroadcastScanControlPoint = scanControlPoint;
+
+        sendMessageAndVerifyTransition(
+                mBassClientStateMachine.obtainMessage(STOP_SCAN_OFFLOAD),
+                BassClientStateMachine.ConnectedProcessing.class);
+        verify(btGatt).writeCharacteristic(scanControlPoint);
+        verify(scanControlPoint).setValue(REMOTE_SCAN_STOP);
+    }
+
+    @Test
+    public void sendPsyncActiveMessage_inConnectedState() {
+        initToConnectedState();
+
+        mBassClientStateMachine.mNoStopScanOffload = true;
+        mBassClientStateMachine.sendMessage(PSYNC_ACTIVE_TIMEOUT);
+        TestUtils.waitForLooperToFinishScheduledTask(mHandlerThread.getLooper());
+        assertThat(mBassClientStateMachine.mNoStopScanOffload).isFalse();
+    }
+
+    @Test
+    public void sendInvalidMessage_inConnectedState_doesNotChangeState() {
+        initToConnectedState();
+
+        mBassClientStateMachine.sendMessage(-1);
+        TestUtils.waitForLooperToFinishScheduledTask(mHandlerThread.getLooper());
+        verify(mBassClientService, never()).sendBroadcast(any(Intent.class), anyString(), any());
+    }
+
+    @Test
+    public void sendSelectBcastSourceMessage_inConnectedState() {
+        initToConnectedState();
+
+        byte[] scanRecord = new byte[]{
+                0x02, 0x01, 0x1a, // advertising flags
+                0x05, 0x02, 0x52, 0x18, 0x0a, 0x11, // 16 bit service uuids
+                0x04, 0x09, 0x50, 0x65, 0x64, // name
+                0x02, 0x0A, (byte) 0xec, // tx power level
+                0x06, 0x16, 0x52, 0x18, 0x50, 0x64, 0x65, // service data
+                0x05, (byte) 0xff, (byte) 0xe0, 0x00, 0x02, 0x15, // manufacturer specific data
+                0x03, 0x50, 0x01, 0x02, // an unknown data type won't cause trouble
+        };
+        ScanRecord record = ScanRecord.parseFromBytes(scanRecord);
+
+        doNothing().when(mMethodProxy).periodicAdvertisingManagerRegisterSync(
+                any(), any(), anyInt(), anyInt(), any(), any());
+        ScanResult scanResult = new ScanResult(mTestDevice, 0, 0, 0, 0, 0, 0, 0, record, 0);
+        mBassClientStateMachine.sendMessage(
+                SELECT_BCAST_SOURCE, BassConstants.AUTO, 0, scanResult);
+        TestUtils.waitForLooperToFinishScheduledTask(mHandlerThread.getLooper());
+        verify(mBassClientService).updatePeriodicAdvertisementResultMap(
+                any(), anyInt(), anyInt(), anyInt(), anyInt(), anyInt());
+    }
+
+    @Test
+    public void sendAddBcastSourceMessage_inConnectedState() {
+        initToConnectedState();
+
+        BassClientService.Callbacks callbacks = Mockito.mock(BassClientService.Callbacks.class);
+        when(mBassClientService.getCallbacks()).thenReturn(callbacks);
+
+        BluetoothLeBroadcastMetadata metadata = createBroadcastMetadata();
+        mBassClientStateMachine.sendMessage(ADD_BCAST_SOURCE, metadata);
+        TestUtils.waitForLooperToFinishScheduledTask(mHandlerThread.getLooper());
+
+        verify(mBassClientService).getCallbacks();
+        verify(callbacks).notifySourceAddFailed(any(), any(), anyInt());
+
+        BassClientStateMachine.BluetoothGattTestableWrapper btGatt = Mockito.mock(
+                BassClientStateMachine.BluetoothGattTestableWrapper.class);
+        mBassClientStateMachine.mBluetoothGatt = btGatt;
+        BluetoothGattCharacteristic scanControlPoint = Mockito.mock(
+                BluetoothGattCharacteristic.class);
+        mBassClientStateMachine.mBroadcastScanControlPoint = scanControlPoint;
+
+        sendMessageAndVerifyTransition(
+                mBassClientStateMachine.obtainMessage(ADD_BCAST_SOURCE, metadata),
+                BassClientStateMachine.ConnectedProcessing.class);
+        verify(scanControlPoint).setValue(any(byte[].class));
+        verify(btGatt).writeCharacteristic(any());
+    }
+
+    @Test
+    public void sendUpdateBcastSourceMessage_inConnectedState() {
+        initToConnectedState();
+        mBassClientStateMachine.connectGatt(true);
+        mBassClientStateMachine.mNumOfBroadcastReceiverStates = 2;
+
+        // Prepare mBluetoothLeBroadcastReceiveStates for test
+        BassClientService.Callbacks callbacks = Mockito.mock(BassClientService.Callbacks.class);
+        when(mBassClientService.getCallbacks()).thenReturn(callbacks);
+        int sourceId = 1;
+        int paSync = BluetoothLeBroadcastReceiveState.PA_SYNC_STATE_IDLE;
+        byte[] value = new byte[] {
+                (byte) sourceId,  // sourceId
+                0x00,  // sourceAddressType
+                0x01, 0x02, 0x03, 0x04, 0x05, 0x00,  // sourceAddress
+                0x00,  // sourceAdvSid
+                0x00, 0x00, 0x00,  // broadcastIdBytes
+                (byte) paSync,
+                (byte) BluetoothLeBroadcastReceiveState.BIG_ENCRYPTION_STATE_BAD_CODE,
+                // 16 bytes badBroadcastCode
+                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x01, // numSubGroups
+                // SubGroup #1
+                0x00, 0x00, 0x00, 0x00, // audioSyncIndex
+                0x02, // metaDataLength
+                0x00, 0x00, // metadata
+        };
+        BluetoothGattCharacteristic characteristic =
+                Mockito.mock(BluetoothGattCharacteristic.class);
+        when(characteristic.getValue()).thenReturn(value);
+        when(characteristic.getInstanceId()).thenReturn(sourceId);
+        when(characteristic.getUuid()).thenReturn(BassConstants.BASS_BCAST_RECEIVER_STATE);
+        mBassClientStateMachine.mGattCallback.onCharacteristicRead(
+                null, characteristic, GATT_SUCCESS);
+        TestUtils.waitForLooperToFinishScheduledTask(mHandlerThread.getLooper());
+
+        BluetoothLeBroadcastMetadata metadata = createBroadcastMetadata();
+        when(mBassClientService.getPeriodicAdvertisementResult(any())).thenReturn(null);
+
+        mBassClientStateMachine.sendMessage(UPDATE_BCAST_SOURCE, sourceId, paSync, metadata);
+        TestUtils.waitForLooperToFinishScheduledTask(mHandlerThread.getLooper());
+        verify(callbacks).notifySourceRemoveFailed(any(), anyInt(), anyInt());
+
+        PeriodicAdvertisementResult paResult = Mockito.mock(PeriodicAdvertisementResult.class);
+        when(mBassClientService.getPeriodicAdvertisementResult(any())).thenReturn(paResult);
+        when(mBassClientService.getBase(anyInt())).thenReturn(null);
+        Mockito.clearInvocations(callbacks);
+
+        mBassClientStateMachine.sendMessage(UPDATE_BCAST_SOURCE, sourceId, paSync, metadata);
+        TestUtils.waitForLooperToFinishScheduledTask(mHandlerThread.getLooper());
+        verify(callbacks).notifySourceRemoveFailed(any(), anyInt(), anyInt());
+
+        BaseData data = Mockito.mock(BaseData.class);
+        when(mBassClientService.getBase(anyInt())).thenReturn(data);
+        when(data.getNumberOfSubgroupsofBIG()).thenReturn((byte) 1);
+        Mockito.clearInvocations(callbacks);
+
+        mBassClientStateMachine.sendMessage(UPDATE_BCAST_SOURCE, sourceId, paSync, metadata);
+        TestUtils.waitForLooperToFinishScheduledTask(mHandlerThread.getLooper());
+        verify(callbacks).notifySourceModifyFailed(any(), anyInt(), anyInt());
+
+        BassClientStateMachine.BluetoothGattTestableWrapper btGatt = Mockito.mock(
+                BassClientStateMachine.BluetoothGattTestableWrapper.class);
+        BluetoothGattCharacteristic scanControlPoint = Mockito.mock(
+                BluetoothGattCharacteristic.class);
+        mBassClientStateMachine.mBluetoothGatt = btGatt;
+        mBassClientStateMachine.mBroadcastScanControlPoint = scanControlPoint;
+        mBassClientStateMachine.mPendingOperation = 0;
+        mBassClientStateMachine.mPendingSourceId = 0;
+        mBassClientStateMachine.mPendingMetadata = null;
+        Mockito.clearInvocations(callbacks);
+
+        sendMessageAndVerifyTransition(
+                mBassClientStateMachine.obtainMessage(
+                        UPDATE_BCAST_SOURCE, sourceId, paSync, metadata),
+                BassClientStateMachine.ConnectedProcessing.class);
+        assertThat(mBassClientStateMachine.mPendingOperation).isEqualTo(UPDATE_BCAST_SOURCE);
+        assertThat(mBassClientStateMachine.mPendingSourceId).isEqualTo(sourceId);
+        assertThat(mBassClientStateMachine.mPendingMetadata).isEqualTo(metadata);
+    }
+
+    @Test
+    public void sendSetBcastCodeMessage_inConnectedState() {
+        initToConnectedState();
+        mBassClientStateMachine.connectGatt(true);
+        mBassClientStateMachine.mNumOfBroadcastReceiverStates = 2;
+        BassClientService.Callbacks callbacks = Mockito.mock(BassClientService.Callbacks.class);
+        when(mBassClientService.getCallbacks()).thenReturn(callbacks);
+
+        // Prepare mBluetoothLeBroadcastReceiveStates with metadata for test
+        mBassClientStateMachine.mShouldHandleMessage = false;
+        int sourceId = 1;
+        byte[] value = new byte[] {
+                (byte) sourceId,  // sourceId
+                0x00,  // sourceAddressType
+                0x01, 0x02, 0x03, 0x04, 0x05, 0x00,  // sourceAddress
+                0x00,  // sourceAdvSid
+                0x00, 0x00, 0x00,  // broadcastIdBytes
+                (byte) BluetoothLeBroadcastReceiveState.PA_SYNC_STATE_IDLE,
+                (byte) BluetoothLeBroadcastReceiveState.BIG_ENCRYPTION_STATE_CODE_REQUIRED,
+                // 16 bytes badBroadcastCode
+                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0x01, // numSubGroups
+                // SubGroup #1
+                0x00, 0x00, 0x00, 0x00, // audioSyncIndex
+                0x02, // metaDataLength
+                0x00, 0x00, // metadata
+        };
+        mBassClientStateMachine.mPendingOperation = REMOVE_BCAST_SOURCE;
+        mBassClientStateMachine.mPendingSourceId = (byte) sourceId;
+        BluetoothGattCharacteristic characteristic =
+                Mockito.mock(BluetoothGattCharacteristic.class);
+        when(characteristic.getValue()).thenReturn(value);
+        when(characteristic.getInstanceId()).thenReturn(sourceId);
+        when(characteristic.getUuid()).thenReturn(BassConstants.BASS_BCAST_RECEIVER_STATE);
+
+        mBassClientStateMachine.mGattCallback.onCharacteristicRead(
+                null, characteristic, GATT_SUCCESS);
+        TestUtils.waitForLooperToFinishScheduledTask(mHandlerThread.getLooper());
+
+        mBassClientStateMachine.mPendingMetadata = createBroadcastMetadata();
+        mBassClientStateMachine.mGattCallback.onCharacteristicRead(
+                null, characteristic, GATT_SUCCESS);
+        TestUtils.waitForLooperToFinishScheduledTask(mHandlerThread.getLooper());
+        mBassClientStateMachine.mShouldHandleMessage = true;
+
+        BluetoothLeBroadcastReceiveState recvState = new BluetoothLeBroadcastReceiveState(
+                2,
+                BluetoothDevice.ADDRESS_TYPE_PUBLIC,
+                mAdapter.getRemoteLeDevice("00:00:00:00:00:00",
+                        BluetoothDevice.ADDRESS_TYPE_PUBLIC),
+                0,
+                0,
+                BluetoothLeBroadcastReceiveState.PA_SYNC_STATE_IDLE,
+                BluetoothLeBroadcastReceiveState.BIG_ENCRYPTION_STATE_CODE_REQUIRED,
+                null,
+                0,
+                Arrays.asList(new Long[0]),
+                Arrays.asList(new BluetoothLeAudioContentMetadata[0])
+        );
+        mBassClientStateMachine.mSetBroadcastCodePending = false;
+        mBassClientStateMachine.sendMessage(SET_BCAST_CODE, recvState);
+        TestUtils.waitForLooperToFinishScheduledTask(mHandlerThread.getLooper());
+        assertThat(mBassClientStateMachine.mSetBroadcastCodePending).isTrue();
+
+        recvState = new BluetoothLeBroadcastReceiveState(
+                sourceId,
+                BluetoothDevice.ADDRESS_TYPE_PUBLIC,
+                mAdapter.getRemoteLeDevice("00:00:00:00:00:00",
+                        BluetoothDevice.ADDRESS_TYPE_PUBLIC),
+                0,
+                0,
+                BluetoothLeBroadcastReceiveState.PA_SYNC_STATE_IDLE,
+                BluetoothLeBroadcastReceiveState.BIG_ENCRYPTION_STATE_CODE_REQUIRED,
+                null,
+                0,
+                Arrays.asList(new Long[0]),
+                Arrays.asList(new BluetoothLeAudioContentMetadata[0])
+        );
+        mBassClientStateMachine.sendMessage(SET_BCAST_CODE, recvState);
+        BassClientStateMachine.BluetoothGattTestableWrapper btGatt = Mockito.mock(
+                BassClientStateMachine.BluetoothGattTestableWrapper.class);
+        mBassClientStateMachine.mBluetoothGatt = btGatt;
+        BluetoothGattCharacteristic scanControlPoint = Mockito.mock(
+                BluetoothGattCharacteristic.class);
+        mBassClientStateMachine.mBroadcastScanControlPoint = scanControlPoint;
+
+        sendMessageAndVerifyTransition(
+                mBassClientStateMachine.obtainMessage(SET_BCAST_CODE, recvState),
+                BassClientStateMachine.ConnectedProcessing.class);
+        assertThat(mBassClientStateMachine.mPendingOperation).isEqualTo(SET_BCAST_CODE);
+        assertThat(mBassClientStateMachine.mPendingSourceId).isEqualTo(sourceId);
+        verify(btGatt).writeCharacteristic(any());
+        verify(scanControlPoint).setValue(any(byte[].class));
+    }
+
+    @Test
+    public void sendRemoveBcastSourceMessage_inConnectedState() {
+        initToConnectedState();
+        BassClientService.Callbacks callbacks = Mockito.mock(BassClientService.Callbacks.class);
+        when(mBassClientService.getCallbacks()).thenReturn(callbacks);
+
+        int sid = 10;
+        mBassClientStateMachine.sendMessage(REMOVE_BCAST_SOURCE, sid);
+        TestUtils.waitForLooperToFinishScheduledTask(mHandlerThread.getLooper());
+        verify(callbacks).notifySourceRemoveFailed(any(), anyInt(), anyInt());
+
+        BassClientStateMachine.BluetoothGattTestableWrapper btGatt = Mockito.mock(
+                BassClientStateMachine.BluetoothGattTestableWrapper.class);
+        mBassClientStateMachine.mBluetoothGatt = btGatt;
+        BluetoothGattCharacteristic scanControlPoint = Mockito.mock(
+                BluetoothGattCharacteristic.class);
+        mBassClientStateMachine.mBroadcastScanControlPoint = scanControlPoint;
+
+        sendMessageAndVerifyTransition(
+                mBassClientStateMachine.obtainMessage(REMOVE_BCAST_SOURCE, sid),
+                BassClientStateMachine.ConnectedProcessing.class);
+        verify(scanControlPoint).setValue(any(byte[].class));
+        verify(btGatt).writeCharacteristic(any());
+        assertThat(mBassClientStateMachine.mPendingOperation).isEqualTo(REMOVE_BCAST_SOURCE);
+        assertThat(mBassClientStateMachine.mPendingSourceId).isEqualTo(sid);
+    }
+
+    @Test
+    public void sendConnectMessage_inConnectedProcessingState_doesNotChangeState() {
+        initToConnectedProcessingState();
+
+        mBassClientStateMachine.sendMessage(CONNECT);
+        TestUtils.waitForLooperToFinishScheduledTask(mHandlerThread.getLooper());
+        verify(mBassClientService, never()).sendBroadcast(any(Intent.class), anyString(), any());
+    }
+
+    @Test
+    public void sendDisconnectMessage_inConnectedProcessingState_doesNotChangeState() {
+        initToConnectedProcessingState();
+
+        // Mock instance of btGatt was created in initToConnectedProcessingState().
+        BassClientStateMachine.BluetoothGattTestableWrapper btGatt =
+                mBassClientStateMachine.mBluetoothGatt;
+        mBassClientStateMachine.mBluetoothGatt = null;
+        mBassClientStateMachine.sendMessage(DISCONNECT);
+        TestUtils.waitForLooperToFinishScheduledTask(mHandlerThread.getLooper());
+        verify(mBassClientService, never()).sendBroadcast(any(Intent.class), anyString(), any());
+
+        mBassClientStateMachine.mBluetoothGatt = btGatt;
+        sendMessageAndVerifyTransition(
+                mBassClientStateMachine.obtainMessage(DISCONNECT),
+                BassClientStateMachine.Disconnected.class);
+        verify(btGatt).disconnect();
+        verify(btGatt).close();
+    }
+
+    @Test
+    public void sendStateChangedMessage_inConnectedProcessingState() {
+        initToConnectedProcessingState();
+
+        Message msgToConnectedState =
+                mBassClientStateMachine.obtainMessage(CONNECTION_STATE_CHANGED);
+        msgToConnectedState.obj = BluetoothProfile.STATE_CONNECTED;
+
+        mBassClientStateMachine.sendMessage(msgToConnectedState);
+        TestUtils.waitForLooperToFinishScheduledTask(mHandlerThread.getLooper());
+        verify(mBassClientService, never()).sendBroadcast(any(Intent.class), anyString(), any());
+
+        Message msgToNoneConnectedState =
+                mBassClientStateMachine.obtainMessage(CONNECTION_STATE_CHANGED);
+        msgToNoneConnectedState.obj = BluetoothProfile.STATE_DISCONNECTING;
+        sendMessageAndVerifyTransition(
+                msgToNoneConnectedState, BassClientStateMachine.Disconnected.class);
+    }
+
+    /**
+     * This also tests BassClientStateMachine#sendPendingCallbacks
+     */
+    @Test
+    public void sendGattTxnProcessedMessage_inConnectedProcessingState() {
+        initToConnectedProcessingState();
+        BassClientService.Callbacks callbacks = Mockito.mock(BassClientService.Callbacks.class);
+        when(mBassClientService.getCallbacks()).thenReturn(callbacks);
+
+        // Test sendPendingCallbacks(START_SCAN_OFFLOAD, ERROR_UNKNOWN)
+        mBassClientStateMachine.mPendingOperation = START_SCAN_OFFLOAD;
+        mBassClientStateMachine.mNoStopScanOffload = true;
+        mBassClientStateMachine.mAutoTriggered = false;
+        sendMessageAndVerifyTransition(
+                mBassClientStateMachine.obtainMessage(GATT_TXN_PROCESSED, GATT_FAILURE),
+                BassClientStateMachine.Connected.class);
+        assertThat(mBassClientStateMachine.mNoStopScanOffload).isFalse();
+
+        // Test sendPendingCallbacks(START_SCAN_OFFLOAD, ERROR_UNKNOWN)
+        moveConnectedStateToConnectedProcessingState();
+        mBassClientStateMachine.mPendingOperation = START_SCAN_OFFLOAD;
+        mBassClientStateMachine.mAutoTriggered = true;
+        sendMessageAndVerifyTransition(
+                mBassClientStateMachine.obtainMessage(GATT_TXN_PROCESSED, GATT_FAILURE),
+                BassClientStateMachine.Connected.class);
+        assertThat(mBassClientStateMachine.mAutoTriggered).isFalse();
+
+        // Test sendPendingCallbacks(ADD_BCAST_SOURCE, ERROR_UNKNOWN)
+        moveConnectedStateToConnectedProcessingState();
+        mBassClientStateMachine.mPendingOperation = ADD_BCAST_SOURCE;
+        sendMessageAndVerifyTransition(
+                mBassClientStateMachine.obtainMessage(GATT_TXN_PROCESSED, GATT_FAILURE),
+                BassClientStateMachine.Connected.class);
+        verify(callbacks).notifySourceAddFailed(any(), any(), anyInt());
+
+        // Test sendPendingCallbacks(UPDATE_BCAST_SOURCE, REASON_LOCAL_APP_REQUEST)
+        moveConnectedStateToConnectedProcessingState();
+        mBassClientStateMachine.mPendingOperation = UPDATE_BCAST_SOURCE;
+        mBassClientStateMachine.mAutoTriggered = true;
+        sendMessageAndVerifyTransition(
+                mBassClientStateMachine.obtainMessage(GATT_TXN_PROCESSED, GATT_SUCCESS),
+                BassClientStateMachine.Connected.class);
+        assertThat(mBassClientStateMachine.mAutoTriggered).isFalse();
+
+        // Test sendPendingCallbacks(UPDATE_BCAST_SOURCE, ERROR_UNKNOWN)
+        moveConnectedStateToConnectedProcessingState();
+        mBassClientStateMachine.mPendingOperation = UPDATE_BCAST_SOURCE;
+        sendMessageAndVerifyTransition(
+                mBassClientStateMachine.obtainMessage(GATT_TXN_PROCESSED, GATT_FAILURE),
+                BassClientStateMachine.Connected.class);
+        verify(callbacks).notifySourceModifyFailed(any(), anyInt(), anyInt());
+
+        // Test sendPendingCallbacks(REMOVE_BCAST_SOURCE, ERROR_UNKNOWN)
+        moveConnectedStateToConnectedProcessingState();
+        mBassClientStateMachine.mPendingOperation = REMOVE_BCAST_SOURCE;
+        sendMessageAndVerifyTransition(
+                mBassClientStateMachine.obtainMessage(GATT_TXN_PROCESSED, GATT_FAILURE),
+                BassClientStateMachine.Connected.class);
+        verify(callbacks).notifySourceRemoveFailed(any(), anyInt(), anyInt());
+
+        // Test sendPendingCallbacks(SET_BCAST_CODE, REASON_LOCAL_APP_REQUEST)
+        moveConnectedStateToConnectedProcessingState();
+        mBassClientStateMachine.mPendingOperation = REMOVE_BCAST_SOURCE;
+        sendMessageAndVerifyTransition(
+                mBassClientStateMachine.obtainMessage(GATT_TXN_PROCESSED, GATT_FAILURE),
+                BassClientStateMachine.Connected.class);
+        // Nothing to verify more
+
+        // Test sendPendingCallbacks(SET_BCAST_CODE, REASON_LOCAL_APP_REQUEST)
+        moveConnectedStateToConnectedProcessingState();
+        mBassClientStateMachine.mPendingOperation = -1;
+        sendMessageAndVerifyTransition(
+                mBassClientStateMachine.obtainMessage(GATT_TXN_PROCESSED, GATT_FAILURE),
+                BassClientStateMachine.Connected.class);
+        // Nothing to verify more
+    }
+
+    @Test
+    public void sendGattTxnTimeoutMessage_inConnectedProcessingState_doesNotChangeState() {
+        initToConnectedProcessingState();
+
+        mBassClientStateMachine.mPendingOperation = SET_BCAST_CODE;
+        mBassClientStateMachine.mPendingSourceId = 0;
+        sendMessageAndVerifyTransition(
+                mBassClientStateMachine.obtainMessage(GATT_TXN_TIMEOUT, GATT_FAILURE),
+                BassClientStateMachine.Connected.class);
+        assertThat(mBassClientStateMachine.mPendingOperation).isEqualTo(-1);
+        assertThat(mBassClientStateMachine.mPendingSourceId).isEqualTo(-1);
+    }
+
+    @Test
+    public void sendMessageForDeferring_inConnectedProcessingState_defersMessage() {
+        initToConnectedProcessingState();
+
+        mBassClientStateMachine.sendMessage(READ_BASS_CHARACTERISTICS);
+        TestUtils.waitForLooperToFinishScheduledTask(mHandlerThread.getLooper());
+        assertThat(mBassClientStateMachine.hasDeferredMessagesSuper(READ_BASS_CHARACTERISTICS))
+                .isTrue();
+
+        mBassClientStateMachine.sendMessage(START_SCAN_OFFLOAD);
+        TestUtils.waitForLooperToFinishScheduledTask(mHandlerThread.getLooper());
+        assertThat(mBassClientStateMachine.hasDeferredMessagesSuper(START_SCAN_OFFLOAD))
+                .isTrue();
+
+        mBassClientStateMachine.sendMessage(STOP_SCAN_OFFLOAD);
+        TestUtils.waitForLooperToFinishScheduledTask(mHandlerThread.getLooper());
+        assertThat(mBassClientStateMachine.hasDeferredMessagesSuper(STOP_SCAN_OFFLOAD))
+                .isTrue();
+
+        mBassClientStateMachine.sendMessage(SELECT_BCAST_SOURCE);
+        TestUtils.waitForLooperToFinishScheduledTask(mHandlerThread.getLooper());
+        assertThat(mBassClientStateMachine.hasDeferredMessagesSuper(SELECT_BCAST_SOURCE))
+                .isTrue();
+
+        mBassClientStateMachine.sendMessage(ADD_BCAST_SOURCE);
+        TestUtils.waitForLooperToFinishScheduledTask(mHandlerThread.getLooper());
+        assertThat(mBassClientStateMachine.hasDeferredMessagesSuper(ADD_BCAST_SOURCE))
+                .isTrue();
+
+        mBassClientStateMachine.sendMessage(SET_BCAST_CODE);
+        TestUtils.waitForLooperToFinishScheduledTask(mHandlerThread.getLooper());
+        assertThat(mBassClientStateMachine.hasDeferredMessagesSuper(SET_BCAST_CODE))
+                .isTrue();
+
+        mBassClientStateMachine.sendMessage(REMOVE_BCAST_SOURCE);
+        TestUtils.waitForLooperToFinishScheduledTask(mHandlerThread.getLooper());
+        assertThat(mBassClientStateMachine.hasDeferredMessagesSuper(REMOVE_BCAST_SOURCE))
+                .isTrue();
+
+        mBassClientStateMachine.sendMessage(PSYNC_ACTIVE_TIMEOUT);
+        TestUtils.waitForLooperToFinishScheduledTask(mHandlerThread.getLooper());
+        assertThat(mBassClientStateMachine.hasDeferredMessagesSuper(PSYNC_ACTIVE_TIMEOUT))
+                .isTrue();
+    }
+
+    @Test
+    public void sendInvalidMessage_inConnectedProcessingState_doesNotChangeState() {
+        initToConnectedProcessingState();
+
+        mBassClientStateMachine.sendMessage(-1);
+        TestUtils.waitForLooperToFinishScheduledTask(mHandlerThread.getLooper());
+        verify(mBassClientService, never()).sendBroadcast(any(Intent.class), anyString(), any());
+    }
+
+    @Test
+    public void dump_doesNotCrash() {
+        mBassClientStateMachine.dump(new StringBuilder());
+    }
+
+    private void initToDisconnectedState() {
+        allowConnection(true);
+        allowConnectGatt(true);
+        assertThat(mBassClientStateMachine.getCurrentState())
+                .isInstanceOf(BassClientStateMachine.Disconnected.class);
+    }
+
+    private void initToConnectingState() {
+        allowConnection(true);
+        allowConnectGatt(true);
+        sendMessageAndVerifyTransition(
+                mBassClientStateMachine.obtainMessage(CONNECT),
+                BassClientStateMachine.Connecting.class);
+        Mockito.clearInvocations(mBassClientService);
+    }
+
+    private void initToConnectedState() {
+        initToConnectingState();
+
+        Message msg = mBassClientStateMachine.obtainMessage(CONNECTION_STATE_CHANGED);
+        msg.obj = BluetoothProfile.STATE_CONNECTED;
+        sendMessageAndVerifyTransition(msg, BassClientStateMachine.Connected.class);
+        Mockito.clearInvocations(mBassClientService);
+    }
+
+    private void initToConnectedProcessingState() {
+        initToConnectedState();
+        moveConnectedStateToConnectedProcessingState();
+    }
+
+    private void moveConnectedStateToConnectedProcessingState() {
+        BluetoothGattCharacteristic gattCharacteristic = Mockito.mock(
+                BluetoothGattCharacteristic.class);
+        BassClientStateMachine.BluetoothGattTestableWrapper btGatt = Mockito.mock(
+                BassClientStateMachine.BluetoothGattTestableWrapper.class);
+        mBassClientStateMachine.mBluetoothGatt = btGatt;
+        sendMessageAndVerifyTransition(mBassClientStateMachine.obtainMessage(
+                        READ_BASS_CHARACTERISTICS, gattCharacteristic),
+                BassClientStateMachine.ConnectedProcessing.class);
+        Mockito.clearInvocations(mBassClientService);
+    }
+
+    private <T> void sendMessageAndVerifyTransition(Message msg, Class<T> type) {
+        Mockito.clearInvocations(mBassClientService);
+        mBassClientStateMachine.sendMessage(msg);
+        // Verify that one connection state broadcast is executed
+        verify(mBassClientService, timeout(TIMEOUT_MS)
+                .times(1))
+                .sendBroadcast(any(Intent.class), anyString(), any());
+        Assert.assertThat(mBassClientStateMachine.getCurrentState(), IsInstanceOf.instanceOf(type));
+    }
+
+    private BluetoothLeBroadcastMetadata createBroadcastMetadata() {
+        final String testMacAddress = "00:11:22:33:44:55";
+        final int testBroadcastId = 42;
+        final int testAdvertiserSid = 1234;
+        final int testPaSyncInterval = 100;
+        final int testPresentationDelayMs = 345;
+
+        BluetoothDevice testDevice =
+                mAdapter.getRemoteLeDevice(testMacAddress, BluetoothDevice.ADDRESS_TYPE_RANDOM);
+
+        BluetoothLeBroadcastMetadata.Builder builder = new BluetoothLeBroadcastMetadata.Builder()
+                .setEncrypted(false)
+                .setSourceDevice(testDevice, BluetoothDevice.ADDRESS_TYPE_RANDOM)
+                .setSourceAdvertisingSid(testAdvertiserSid)
+                .setBroadcastId(testBroadcastId)
+                .setBroadcastCode(new byte[] { 0x00 })
+                .setPaSyncInterval(testPaSyncInterval)
+                .setPresentationDelayMicros(testPresentationDelayMs);
+        // builder expect at least one subgroup
+        builder.addSubgroup(createBroadcastSubgroup());
+        return builder.build();
+    }
+
+    private BluetoothLeBroadcastSubgroup createBroadcastSubgroup() {
+        final long testAudioLocationFrontLeft = 0x01;
+        final long testAudioLocationFrontRight = 0x02;
+        // For BluetoothLeAudioContentMetadata
+        final String testProgramInfo = "Test";
+        // German language code in ISO 639-3
+        final String testLanguage = "deu";
+        final int testCodecId = 42;
+        final int testChannelIndex = 56;
+
+        BluetoothLeAudioCodecConfigMetadata codecMetadata =
+                new BluetoothLeAudioCodecConfigMetadata.Builder()
+                        .setAudioLocation(testAudioLocationFrontLeft).build();
+        BluetoothLeAudioContentMetadata contentMetadata =
+                new BluetoothLeAudioContentMetadata.Builder()
+                        .setProgramInfo(testProgramInfo).setLanguage(testLanguage).build();
+        BluetoothLeBroadcastSubgroup.Builder builder = new BluetoothLeBroadcastSubgroup.Builder()
+                .setCodecId(testCodecId)
+                .setCodecSpecificConfig(codecMetadata)
+                .setContentMetadata(contentMetadata);
+
+        BluetoothLeAudioCodecConfigMetadata channelCodecMetadata =
+                new BluetoothLeAudioCodecConfigMetadata.Builder()
+                        .setAudioLocation(testAudioLocationFrontRight).build();
+
+        // builder expect at least one channel
+        BluetoothLeBroadcastChannel channel =
+                new BluetoothLeBroadcastChannel.Builder()
+                        .setSelected(true)
+                        .setChannelIndex(testChannelIndex)
+                        .setCodecMetadata(channelCodecMetadata)
+                        .build();
+        builder.addChannel(channel);
+        return builder.build();
+    }
+
+    // It simulates GATT connection for testing.
+    public static class StubBassClientStateMachine extends BassClientStateMachine {
+        boolean mShouldAllowGatt = true;
+        boolean mShouldHandleMessage = true;
+        Boolean mIsPendingRemove;
+        List<Integer> mMsgWhats = new ArrayList<>();
+        int mMsgWhat;
+        int mMsgAgr1;
+        int mMsgArg2;
+        Object mMsgObj;
+
+        StubBassClientStateMachine(BluetoothDevice device, BassClientService service, Looper looper,
+                int connectTimeout) {
+            super(device, service, looper, connectTimeout);
+        }
+
+        @Override
+        public boolean connectGatt(Boolean autoConnect) {
+            mGattCallback = new GattCallback();
+            return mShouldAllowGatt;
+        }
+
+        @Override
+        public void sendMessage(Message msg) {
+            mMsgWhats.add(msg.what);
+            mMsgWhat = msg.what;
+            mMsgAgr1 = msg.arg1;
+            mMsgArg2 = msg.arg2;
+            mMsgObj = msg.obj;
+            if (mShouldHandleMessage) {
+                super.sendMessage(msg);
+            }
+        }
+
+        public void notifyConnectionStateChanged(int status, int newState) {
+            if (mGattCallback != null) {
+                BluetoothGatt gatt = null;
+                if (mBluetoothGatt != null) {
+                    gatt = mBluetoothGatt.mWrappedBluetoothGatt;
+                }
+                mGattCallback.onConnectionStateChange(gatt, status, newState);
+            }
+        }
+
+        public boolean hasDeferredMessagesSuper(int what) {
+            return super.hasDeferredMessages(what);
+        }
+
+        @Override
+        boolean isPendingRemove(Integer sourceId) {
+            if (mIsPendingRemove == null) {
+                return super.isPendingRemove(sourceId);
+            }
+            return mIsPendingRemove;
+        }
+    }
+}
diff --git a/android/app/tests/unit/src/com/android/bluetooth/bass_client/BleBroadcastAssistantBinderTest.java b/android/app/tests/unit/src/com/android/bluetooth/bass_client/BleBroadcastAssistantBinderTest.java
new file mode 100644
index 0000000..678b6b1
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/bass_client/BleBroadcastAssistantBinderTest.java
@@ -0,0 +1,289 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.bass_client;
+
+import static android.bluetooth.BluetoothProfile.STATE_DISCONNECTED;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import static org.mockito.Mockito.any;
+import static org.mockito.Mockito.doThrow;
+import static org.mockito.Mockito.never;
+import static org.mockito.Mockito.verify;
+
+import android.bluetooth.BluetoothAdapter;
+import android.bluetooth.BluetoothDevice;
+import android.bluetooth.BluetoothProfile;
+import android.bluetooth.IBluetoothLeBroadcastAssistantCallback;
+import android.bluetooth.le.ScanFilter;
+
+import com.android.bluetooth.TestUtils;
+
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.junit.runners.JUnit4;
+import org.mockito.Mock;
+import org.mockito.Mockito;
+import org.mockito.MockitoAnnotations;
+
+import java.util.Collections;
+import java.util.List;
+
+@RunWith(JUnit4.class)
+public class BleBroadcastAssistantBinderTest {
+
+    @Mock private BassClientService mService;
+
+    private BassClientService.BluetoothLeBroadcastAssistantBinder mBinder;
+    private BluetoothAdapter mAdapter;
+
+    @Before
+    public void setUp() {
+        MockitoAnnotations.initMocks(this);
+        mBinder = new BassClientService.BluetoothLeBroadcastAssistantBinder(mService);
+        mAdapter = BluetoothAdapter.getDefaultAdapter();
+    }
+
+    @Test
+    public void cleanUp() {
+        mBinder.cleanup();
+        assertThat(mBinder.mService).isNull();
+    }
+
+    @Test
+    public void getConnectionState() {
+        BluetoothDevice device = TestUtils.getTestDevice(mAdapter, 0);
+        mBinder.getConnectionState(device);
+        verify(mService).getConnectionState(device);
+
+        doThrow(new RuntimeException()).when(mService).getConnectionState(device);
+        assertThat(mBinder.getConnectionState(device)).isEqualTo(STATE_DISCONNECTED);
+
+        mBinder.cleanup();
+        assertThat(mBinder.getConnectionState(device)).isEqualTo(STATE_DISCONNECTED);
+    }
+
+    @Test
+    public void getDevicesMatchingConnectionStates() {
+        int[] states = new int[] { STATE_DISCONNECTED };
+        mBinder.getDevicesMatchingConnectionStates(states);
+        verify(mService).getDevicesMatchingConnectionStates(states);
+
+        doThrow(new RuntimeException()).when(mService).getDevicesMatchingConnectionStates(states);
+        assertThat(mBinder.getDevicesMatchingConnectionStates(states)).isEqualTo(
+                Collections.emptyList());
+
+        mBinder.cleanup();
+        assertThat(mBinder.getDevicesMatchingConnectionStates(states)).isEqualTo(
+                Collections.emptyList());
+    }
+
+    @Test
+    public void getConnectedDevices() {
+        mBinder.getConnectedDevices();
+        verify(mService).getConnectedDevices();
+
+        doThrow(new RuntimeException()).when(mService).getConnectedDevices();
+        assertThat(mBinder.getConnectedDevices()).isEqualTo(Collections.emptyList());
+
+        mBinder.cleanup();
+        assertThat(mBinder.getConnectedDevices()).isEqualTo(Collections.emptyList());
+    }
+
+    @Test
+    public void setConnectionPolicy() {
+        BluetoothDevice device = TestUtils.getTestDevice(mAdapter, 0);
+        mBinder.setConnectionPolicy(device, BluetoothProfile.CONNECTION_POLICY_ALLOWED);
+        verify(mService).setConnectionPolicy(device, BluetoothProfile.CONNECTION_POLICY_ALLOWED);
+
+        doThrow(new RuntimeException()).when(mService)
+                .setConnectionPolicy(device, BluetoothProfile.CONNECTION_POLICY_ALLOWED);
+        assertThat(mBinder.setConnectionPolicy(device, BluetoothProfile.CONNECTION_POLICY_ALLOWED))
+                .isFalse();
+
+        mBinder.cleanup();
+        assertThat(mBinder.setConnectionPolicy(device, BluetoothProfile.CONNECTION_POLICY_ALLOWED))
+                .isFalse();
+    }
+
+    @Test
+    public void getConnectionPolicy() {
+        BluetoothDevice device = TestUtils.getTestDevice(mAdapter, 0);
+        mBinder.getConnectionPolicy(device);
+        verify(mService).getConnectionPolicy(device);
+
+        doThrow(new RuntimeException()).when(mService).getConnectionPolicy(device);
+        assertThat(mBinder.getConnectionPolicy(device))
+                .isEqualTo(BluetoothProfile.CONNECTION_POLICY_FORBIDDEN);
+
+        mBinder.cleanup();
+        assertThat(mBinder.getConnectionPolicy(device))
+                .isEqualTo(BluetoothProfile.CONNECTION_POLICY_FORBIDDEN);
+    }
+
+    @Test
+    public void registerCallback() {
+        IBluetoothLeBroadcastAssistantCallback cb =
+                Mockito.mock(IBluetoothLeBroadcastAssistantCallback.class);
+        mBinder.registerCallback(cb);
+        verify(mService).registerCallback(cb);
+
+        Mockito.clearInvocations(mService);
+        doThrow(new RuntimeException()).when(mService).enforceCallingOrSelfPermission(any(), any());
+        mBinder.registerCallback(cb);
+        verify(mService, never()).registerCallback(cb);
+
+        mBinder.cleanup();
+        mBinder.registerCallback(cb);
+        verify(mService, never()).registerCallback(cb);
+    }
+
+    @Test
+    public void unregisterCallback() {
+        IBluetoothLeBroadcastAssistantCallback cb =
+                Mockito.mock(IBluetoothLeBroadcastAssistantCallback.class);
+        mBinder.unregisterCallback(cb);
+        verify(mService).unregisterCallback(cb);
+
+        Mockito.clearInvocations(mService);
+        doThrow(new RuntimeException()).when(mService).enforceCallingOrSelfPermission(any(), any());
+        mBinder.unregisterCallback(cb);
+        verify(mService, never()).unregisterCallback(cb);
+
+        mBinder.cleanup();
+        mBinder.unregisterCallback(cb);
+        verify(mService, never()).unregisterCallback(cb);
+    }
+
+    @Test
+    public void startSearchingForSources() {
+        List<ScanFilter> filters =  Collections.EMPTY_LIST;
+        mBinder.startSearchingForSources(filters);
+        verify(mService).startSearchingForSources(filters);
+
+        Mockito.clearInvocations(mService);
+        doThrow(new RuntimeException()).when(mService).enforceCallingOrSelfPermission(any(), any());
+        mBinder.startSearchingForSources(filters);
+        verify(mService, never()).startSearchingForSources(filters);
+
+        mBinder.cleanup();
+        mBinder.startSearchingForSources(filters);
+        verify(mService, never()).startSearchingForSources(filters);
+    }
+
+    @Test
+    public void stopSearchingForSources() {
+        mBinder.stopSearchingForSources();
+        verify(mService).stopSearchingForSources();
+
+        Mockito.clearInvocations(mService);
+        doThrow(new RuntimeException()).when(mService).enforceCallingOrSelfPermission(any(), any());
+        mBinder.stopSearchingForSources();
+        verify(mService, never()).stopSearchingForSources();
+
+        mBinder.cleanup();
+        mBinder.stopSearchingForSources();
+        verify(mService, never()).stopSearchingForSources();
+    }
+
+    @Test
+    public void isSearchInProgress() {
+        mBinder.isSearchInProgress();
+        verify(mService).isSearchInProgress();
+
+        doThrow(new RuntimeException()).when(mService).enforceCallingOrSelfPermission(any(), any());
+        assertThat(mBinder.isSearchInProgress()).isFalse();
+
+        mBinder.cleanup();
+        assertThat(mBinder.isSearchInProgress()).isFalse();
+    }
+
+    @Test
+    public void addSource() {
+        BluetoothDevice device = TestUtils.getTestDevice(mAdapter, 0);
+        mBinder.addSource(device, null, false);
+        verify(mService).addSource(device, null, false);
+
+        Mockito.clearInvocations(mService);
+        doThrow(new RuntimeException()).when(mService).enforceCallingOrSelfPermission(any(), any());
+        mBinder.addSource(device, null, false);
+        verify(mService, never()).addSource(device, null, false);
+
+        mBinder.cleanup();
+        mBinder.addSource(device, null, false);
+        verify(mService, never()).addSource(device, null, false);
+    }
+
+    @Test
+    public void modifySource() {
+        BluetoothDevice device = TestUtils.getTestDevice(mAdapter, 0);
+        mBinder.modifySource(device, 0, null);
+        verify(mService).modifySource(device, 0, null);
+
+        Mockito.clearInvocations(mService);
+        doThrow(new RuntimeException()).when(mService).enforceCallingOrSelfPermission(any(), any());
+        mBinder.modifySource(device, 0, null);
+        verify(mService, never()).modifySource(device, 0, null);
+
+        mBinder.cleanup();
+        mBinder.modifySource(device, 0, null);
+        verify(mService, never()).modifySource(device, 0, null);
+    }
+
+    @Test
+    public void removeSource() {
+        BluetoothDevice device = TestUtils.getTestDevice(mAdapter, 0);
+        mBinder.removeSource(device, 0);
+        verify(mService).removeSource(device, 0);
+
+        Mockito.clearInvocations(mService);
+        doThrow(new RuntimeException()).when(mService).enforceCallingOrSelfPermission(any(), any());
+        mBinder.removeSource(device, 0);
+        verify(mService, never()).removeSource(device, 0);
+
+        mBinder.cleanup();
+        mBinder.removeSource(device, 0);
+        verify(mService, never()).removeSource(device, 0);
+    }
+
+    @Test
+    public void getAllSources() {
+        BluetoothDevice device = TestUtils.getTestDevice(mAdapter, 0);
+        mBinder.getAllSources(device);
+        verify(mService).getAllSources(device);
+
+        doThrow(new RuntimeException()).when(mService).getConnectionPolicy(device);
+        assertThat(mBinder.getAllSources(device)).isEqualTo(Collections.emptyList());
+
+        mBinder.cleanup();
+        assertThat(mBinder.getAllSources(device)).isEqualTo(Collections.emptyList());
+    }
+
+    @Test
+    public void getMaximumSourceCapacity() {
+        BluetoothDevice device = TestUtils.getTestDevice(mAdapter, 0);
+        mBinder.getMaximumSourceCapacity(device);
+        verify(mService).getMaximumSourceCapacity(device);
+
+        doThrow(new RuntimeException()).when(mService).getMaximumSourceCapacity(device);
+        assertThat(mBinder.getMaximumSourceCapacity(device)).isEqualTo(0);
+
+        mBinder.cleanup();
+        assertThat(mBinder.getMaximumSourceCapacity(device)).isEqualTo(0);
+    }
+}
diff --git a/android/app/tests/unit/src/com/android/bluetooth/bass_client/PeriodicAdvertisementResultTest.java b/android/app/tests/unit/src/com/android/bluetooth/bass_client/PeriodicAdvertisementResultTest.java
new file mode 100644
index 0000000..b80c949
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/bass_client/PeriodicAdvertisementResultTest.java
@@ -0,0 +1,103 @@
+/*
+ * Copyright 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.bass_client;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import android.bluetooth.BluetoothAdapter;
+import android.bluetooth.BluetoothDevice;
+
+import androidx.test.filters.SmallTest;
+import androidx.test.runner.AndroidJUnit4;
+
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+@SmallTest
+@RunWith(AndroidJUnit4.class)
+public class PeriodicAdvertisementResultTest {
+    private static final String REMOTE_DEVICE_ADDRESS = "00:01:02:03:04:05";
+
+    BluetoothDevice mDevice;
+
+    @Before
+    public void setUp() {
+        mDevice = BluetoothAdapter.getDefaultAdapter().getRemoteDevice(REMOTE_DEVICE_ADDRESS);
+    }
+
+    @Test
+    public void constructor() {
+        int addressType = 1;
+        int syncHandle = 2;
+        int advSid = 3;
+        int paInterval = 4;
+        int broadcastId = 5;
+        PeriodicAdvertisementResult result = new PeriodicAdvertisementResult(
+                mDevice, addressType, syncHandle, advSid, paInterval, broadcastId);
+
+        assertThat(result.getAddressType()).isEqualTo(addressType);
+        assertThat(result.getSyncHandle()).isEqualTo(syncHandle);
+        assertThat(result.getAdvSid()).isEqualTo(advSid);
+        assertThat(result.getAdvInterval()).isEqualTo(paInterval);
+        assertThat(result.getBroadcastId()).isEqualTo(broadcastId);
+    }
+
+    @Test
+    public void updateMethods() {
+        int addressType = 1;
+        int syncHandle = 2;
+        int advSid = 3;
+        int paInterval = 4;
+        int broadcastId = 5;
+        PeriodicAdvertisementResult result = new PeriodicAdvertisementResult(
+                mDevice, addressType, syncHandle, advSid, paInterval, broadcastId);
+
+        int newAddressType = 6;
+        result.updateAddressType(newAddressType);
+        assertThat(result.getAddressType()).isEqualTo(newAddressType);
+
+        int newSyncHandle = 7;
+        result.updateSyncHandle(newSyncHandle);
+        assertThat(result.getSyncHandle()).isEqualTo(newSyncHandle);
+
+        int newAdvSid = 8;
+        result.updateAdvSid(newAdvSid);
+        assertThat(result.getAdvSid()).isEqualTo(newAdvSid);
+
+        int newAdvInterval = 9;
+        result.updateAdvInterval(newAdvInterval);
+        assertThat(result.getAdvInterval()).isEqualTo(newAdvInterval);
+
+        int newBroadcastId = 10;
+        result.updateBroadcastId(newBroadcastId);
+        assertThat(result.getBroadcastId()).isEqualTo(newBroadcastId);
+    }
+
+    @Test
+    public void print_doesNotCrash() {
+        int addressType = 1;
+        int syncHandle = 2;
+        int advSid = 3;
+        int paInterval = 4;
+        int broadcastId = 5;
+        PeriodicAdvertisementResult result = new PeriodicAdvertisementResult(
+                mDevice, addressType, syncHandle, advSid, paInterval, broadcastId);
+
+        result.print();
+    }
+}
diff --git a/android/app/tests/unit/src/com/android/bluetooth/btservice/ActiveDeviceManagerTest.java b/android/app/tests/unit/src/com/android/bluetooth/btservice/ActiveDeviceManagerTest.java
index f6e8015..c6ed3c1 100644
--- a/android/app/tests/unit/src/com/android/bluetooth/btservice/ActiveDeviceManagerTest.java
+++ b/android/app/tests/unit/src/com/android/bluetooth/btservice/ActiveDeviceManagerTest.java
@@ -16,15 +16,23 @@
 
 package com.android.bluetooth.btservice;
 
-import static org.mockito.Mockito.*;
+import static org.mockito.Mockito.any;
+import static org.mockito.Mockito.isNull;
+import static org.mockito.Mockito.never;
+import static org.mockito.Mockito.timeout;
+import static org.mockito.Mockito.times;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
 
 import android.bluetooth.BluetoothA2dp;
 import android.bluetooth.BluetoothAdapter;
 import android.bluetooth.BluetoothDevice;
+import android.bluetooth.BluetoothHapClient;
 import android.bluetooth.BluetoothHeadset;
 import android.bluetooth.BluetoothHearingAid;
 import android.bluetooth.BluetoothLeAudio;
 import android.bluetooth.BluetoothProfile;
+import android.bluetooth.BluetoothSinkAudioPolicy;
 import android.content.Context;
 import android.content.Intent;
 import android.media.AudioManager;
@@ -35,6 +43,7 @@
 
 import com.android.bluetooth.TestUtils;
 import com.android.bluetooth.a2dp.A2dpService;
+import com.android.bluetooth.btservice.storage.DatabaseManager;
 import com.android.bluetooth.hearingaid.HearingAidService;
 import com.android.bluetooth.hfp.HeadsetService;
 import com.android.bluetooth.le_audio.LeAudioService;
@@ -46,8 +55,13 @@
 import org.junit.Test;
 import org.junit.runner.RunWith;
 import org.mockito.Mock;
+import org.mockito.Mockito;
 import org.mockito.MockitoAnnotations;
 
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Objects;
+
 @MediumTest
 @RunWith(AndroidJUnit4.class)
 public class ActiveDeviceManagerTest {
@@ -58,6 +72,10 @@
     private BluetoothDevice mA2dpHeadsetDevice;
     private BluetoothDevice mHearingAidDevice;
     private BluetoothDevice mLeAudioDevice;
+    private BluetoothDevice mLeHearingAidDevice;
+    private BluetoothDevice mSecondaryAudioDevice;
+    private ArrayList<BluetoothDevice> mDeviceConnectionStack;
+    private BluetoothDevice mMostRecentDevice;
     private ActiveDeviceManager mActiveDeviceManager;
     private static final int TIMEOUT_MS = 1000;
 
@@ -68,6 +86,7 @@
     @Mock private HearingAidService mHearingAidService;
     @Mock private LeAudioService mLeAudioService;
     @Mock private AudioManager mAudioManager;
+    @Mock private DatabaseManager mDatabaseManager;
 
     @Before
     public void setUp() throws Exception {
@@ -79,17 +98,15 @@
         // Set up mocks and test assets
         MockitoAnnotations.initMocks(this);
         TestUtils.setAdapterService(mAdapterService);
+
         when(mAdapterService.getSystemService(Context.AUDIO_SERVICE)).thenReturn(mAudioManager);
         when(mAdapterService.getSystemServiceName(AudioManager.class))
                 .thenReturn(Context.AUDIO_SERVICE);
+        when(mAdapterService.getDatabase()).thenReturn(mDatabaseManager);
         when(mServiceFactory.getA2dpService()).thenReturn(mA2dpService);
         when(mServiceFactory.getHeadsetService()).thenReturn(mHeadsetService);
         when(mServiceFactory.getHearingAidService()).thenReturn(mHearingAidService);
         when(mServiceFactory.getLeAudioService()).thenReturn(mLeAudioService);
-        when(mA2dpService.setActiveDevice(any())).thenReturn(true);
-        when(mHeadsetService.setActiveDevice(any())).thenReturn(true);
-        when(mHearingAidService.setActiveDevice(any())).thenReturn(true);
-        when(mLeAudioService.setActiveDevice(any())).thenReturn(true);
 
         mActiveDeviceManager = new ActiveDeviceManager(mAdapterService, mServiceFactory);
         mActiveDeviceManager.start();
@@ -101,6 +118,48 @@
         mA2dpHeadsetDevice = TestUtils.getTestDevice(mAdapter, 2);
         mHearingAidDevice = TestUtils.getTestDevice(mAdapter, 3);
         mLeAudioDevice = TestUtils.getTestDevice(mAdapter, 4);
+        mLeHearingAidDevice = TestUtils.getTestDevice(mAdapter, 5);
+        mSecondaryAudioDevice = TestUtils.getTestDevice(mAdapter, 6);
+        mDeviceConnectionStack = new ArrayList<>();
+        mMostRecentDevice = null;
+
+        when(mA2dpService.setActiveDevice(any())).thenReturn(true);
+        when(mHeadsetService.getHfpCallAudioPolicy(any())).thenReturn(
+                new BluetoothSinkAudioPolicy.Builder().build());
+        when(mHeadsetService.setActiveDevice(any())).thenReturn(true);
+        when(mHearingAidService.setActiveDevice(any())).thenReturn(true);
+        when(mLeAudioService.setActiveDevice(any())).thenReturn(true);
+
+        when(mA2dpService.getFallbackDevice()).thenAnswer(invocation -> {
+            if (!mDeviceConnectionStack.isEmpty() && Objects.equals(mA2dpDevice,
+                    mDeviceConnectionStack.get(mDeviceConnectionStack.size() - 1))) {
+                return mA2dpDevice;
+            }
+            return null;
+        });
+        when(mHeadsetService.getFallbackDevice()).thenAnswer(invocation -> {
+            if (!mDeviceConnectionStack.isEmpty() && Objects.equals(mHeadsetDevice,
+                    mDeviceConnectionStack.get(mDeviceConnectionStack.size() - 1))) {
+                return mHeadsetDevice;
+            }
+            return null;
+        });
+        when(mDatabaseManager.getMostRecentlyConnectedDevicesInList(any())).thenAnswer(
+                invocation -> {
+                    List<BluetoothDevice> devices = invocation.getArgument(0);
+                    if (devices == null || devices.size() == 0) {
+                        return null;
+                    } else if (devices.contains(mLeHearingAidDevice)) {
+                        return mLeHearingAidDevice;
+                    } else if (devices.contains(mHearingAidDevice)) {
+                        return mHearingAidDevice;
+                    } else if (mMostRecentDevice != null && devices.contains(mMostRecentDevice)) {
+                        return mMostRecentDevice;
+                    } else {
+                        return devices.get(0);
+                    }
+                }
+        );
     }
 
     @After
@@ -167,6 +226,23 @@
     }
 
     /**
+     * Two A2DP devices are connected and the current active is then disconnected.
+     * Should then set active device to fallback device.
+     */
+    @Test
+    public void a2dpSecondDeviceDisconnected_fallbackDeviceActive() {
+        a2dpConnected(mA2dpDevice);
+        verify(mA2dpService, timeout(TIMEOUT_MS)).setActiveDevice(mA2dpDevice);
+
+        a2dpConnected(mSecondaryAudioDevice);
+        verify(mA2dpService, timeout(TIMEOUT_MS)).setActiveDevice(mSecondaryAudioDevice);
+
+        Mockito.clearInvocations(mA2dpService);
+        a2dpDisconnected(mSecondaryAudioDevice);
+        verify(mA2dpService, timeout(TIMEOUT_MS)).setActiveDevice(mA2dpDevice);
+    }
+
+    /**
      * One Headset is connected.
      */
     @Test
@@ -217,6 +293,42 @@
         Assert.assertEquals(mHeadsetDevice, mActiveDeviceManager.getHfpActiveDevice());
     }
 
+    /**
+     * Two Headsets are connected and the current active is then disconnected.
+     * Should then set active device to fallback device.
+     */
+    @Test
+    public void headsetSecondDeviceDisconnected_fallbackDeviceActive() {
+        when(mAudioManager.getMode()).thenReturn(AudioManager.MODE_IN_CALL);
+
+        headsetConnected(mHeadsetDevice);
+        verify(mHeadsetService, timeout(TIMEOUT_MS)).setActiveDevice(mHeadsetDevice);
+
+        headsetConnected(mSecondaryAudioDevice);
+        verify(mHeadsetService, timeout(TIMEOUT_MS)).setActiveDevice(mSecondaryAudioDevice);
+
+        Mockito.clearInvocations(mHeadsetService);
+        headsetDisconnected(mSecondaryAudioDevice);
+        verify(mHeadsetService, timeout(TIMEOUT_MS)).setActiveDevice(mHeadsetDevice);
+    }
+
+    /**
+     * A headset device with connecting audio policy set to NOT ALLOWED.
+     */
+    @Test
+    public void notAllowedConnectingPolicyHeadsetConnected_noSetActiveDevice() {
+        // setting connecting policy to NOT ALLOWED
+        when(mHeadsetService.getHfpCallAudioPolicy(mHeadsetDevice))
+                .thenReturn(new BluetoothSinkAudioPolicy.Builder()
+                        .setCallEstablishPolicy(BluetoothSinkAudioPolicy.POLICY_ALLOWED)
+                        .setActiveDevicePolicyAfterConnection(
+                                BluetoothSinkAudioPolicy.POLICY_NOT_ALLOWED)
+                        .setInBandRingtonePolicy(BluetoothSinkAudioPolicy.POLICY_ALLOWED)
+                        .build());
+
+        headsetConnected(mHeadsetDevice);
+        verify(mHeadsetService, never()).setActiveDevice(mHeadsetDevice);
+    }
 
     /**
      * A combo (A2DP + Headset) device is connected. Then a Hearing Aid is connected.
@@ -294,6 +406,74 @@
     }
 
     /**
+     * One LE Audio is connected.
+     */
+    @Test
+    public void onlyLeAudioConnected_setHeadsetActive() {
+        leAudioConnected(mLeAudioDevice);
+        verify(mLeAudioService, timeout(TIMEOUT_MS)).setActiveDevice(mLeAudioDevice);
+    }
+
+    /**
+     * Two LE Audio are connected. Should set the second one active.
+     */
+    @Test
+    public void secondLeAudioConnected_setSecondLeAudioActive() {
+        leAudioConnected(mLeAudioDevice);
+        verify(mLeAudioService, timeout(TIMEOUT_MS)).setActiveDevice(mLeAudioDevice);
+
+        leAudioConnected(mSecondaryAudioDevice);
+        verify(mLeAudioService, timeout(TIMEOUT_MS)).setActiveDevice(mSecondaryAudioDevice);
+    }
+
+    /**
+     * One LE Audio  is connected and disconnected later. Should then set active device to null.
+     */
+    @Test
+    public void lastLeAudioDisconnected_clearLeAudioActive() {
+        leAudioConnected(mLeAudioDevice);
+        verify(mLeAudioService, timeout(TIMEOUT_MS)).setActiveDevice(mLeAudioDevice);
+
+        leAudioDisconnected(mLeAudioDevice);
+        verify(mLeAudioService, timeout(TIMEOUT_MS)).setActiveDevice(isNull());
+    }
+
+    /**
+     * Two LE Audio are connected and active device is explicitly set.
+     */
+    @Test
+    public void leAudioActiveDeviceSelected_setActive() {
+        leAudioConnected(mLeAudioDevice);
+        verify(mLeAudioService, timeout(TIMEOUT_MS)).setActiveDevice(mLeAudioDevice);
+
+        leAudioConnected(mSecondaryAudioDevice);
+        verify(mLeAudioService, timeout(TIMEOUT_MS)).setActiveDevice(mSecondaryAudioDevice);
+
+        leAudioActiveDeviceChanged(mLeAudioDevice);
+        // Don't call mLeAudioService.setActiveDevice()
+        TestUtils.waitForLooperToFinishScheduledTask(mActiveDeviceManager.getHandlerLooper());
+        verify(mLeAudioService, times(1)).setActiveDevice(mLeAudioDevice);
+        Assert.assertEquals(mLeAudioDevice, mActiveDeviceManager.getLeAudioActiveDevice());
+    }
+
+    /**
+     * Two LE Audio are connected and the current active is then disconnected.
+     * Should then set active device to fallback device.
+     */
+    @Test
+    public void leAudioSecondDeviceDisconnected_fallbackDeviceActive() {
+        leAudioConnected(mLeAudioDevice);
+        verify(mLeAudioService, timeout(TIMEOUT_MS)).setActiveDevice(mLeAudioDevice);
+
+        leAudioConnected(mSecondaryAudioDevice);
+        verify(mLeAudioService, timeout(TIMEOUT_MS)).setActiveDevice(mSecondaryAudioDevice);
+
+        Mockito.clearInvocations(mLeAudioService);
+        leAudioDisconnected(mSecondaryAudioDevice);
+        verify(mLeAudioService, timeout(TIMEOUT_MS)).setActiveDevice(mLeAudioDevice);
+    }
+
+    /**
      * A combo (A2DP + Headset) device is connected. Then an LE Audio is connected.
      */
     @Test
@@ -324,8 +504,8 @@
         headsetConnected(mA2dpHeadsetDevice);
 
         TestUtils.waitForLooperToFinishScheduledTask(mActiveDeviceManager.getHandlerLooper());
-        verify(mA2dpService, never()).setActiveDevice(mA2dpHeadsetDevice);
-        verify(mHeadsetService, never()).setActiveDevice(mA2dpHeadsetDevice);
+        verify(mA2dpService).setActiveDevice(mA2dpHeadsetDevice);
+        verify(mHeadsetService).setActiveDevice(mA2dpHeadsetDevice);
     }
 
     /**
@@ -342,8 +522,7 @@
 
         TestUtils.waitForLooperToFinishScheduledTask(mActiveDeviceManager.getHandlerLooper());
         verify(mLeAudioService).setActiveDevice(isNull());
-        // Don't call mA2dpService.setActiveDevice()
-        verify(mA2dpService, never()).setActiveDevice(mA2dpHeadsetDevice);
+        verify(mA2dpService).setActiveDevice(mA2dpHeadsetDevice);
         Assert.assertEquals(mA2dpHeadsetDevice, mActiveDeviceManager.getA2dpActiveDevice());
         Assert.assertEquals(null, mActiveDeviceManager.getLeAudioActiveDevice());
     }
@@ -362,13 +541,154 @@
 
         TestUtils.waitForLooperToFinishScheduledTask(mActiveDeviceManager.getHandlerLooper());
         verify(mLeAudioService).setActiveDevice(isNull());
-        // Don't call mLeAudioService.setActiveDevice()
-        verify(mLeAudioService, never()).setActiveDevice(mA2dpHeadsetDevice);
+        verify(mHeadsetService).setActiveDevice(mA2dpHeadsetDevice);
         Assert.assertEquals(mA2dpHeadsetDevice, mActiveDeviceManager.getHfpActiveDevice());
         Assert.assertEquals(null, mActiveDeviceManager.getLeAudioActiveDevice());
     }
 
     /**
+     * An LE Audio connected. An A2DP connected. The A2DP disconnected.
+     * Then the LE Audio should be the active one.
+     */
+    @Test
+    public void leAudioAndA2dpConnectedThenA2dpDisconnected_fallbackToLeAudio() {
+        when(mAudioManager.getMode()).thenReturn(AudioManager.MODE_NORMAL);
+
+        leAudioConnected(mLeAudioDevice);
+        verify(mLeAudioService, timeout(TIMEOUT_MS)).setActiveDevice(mLeAudioDevice);
+
+        a2dpConnected(mA2dpDevice);
+        verify(mA2dpService, timeout(TIMEOUT_MS)).setActiveDevice(mA2dpDevice);
+
+        Mockito.clearInvocations(mLeAudioService);
+        a2dpDisconnected(mA2dpDevice);
+        verify(mA2dpService, timeout(TIMEOUT_MS).atLeast(1)).setActiveDevice(isNull());
+        verify(mLeAudioService, timeout(TIMEOUT_MS)).setActiveDevice(mLeAudioDevice);
+    }
+
+    /**
+     * An A2DP connected. An LE Audio connected. The LE Audio disconnected.
+     * Then the A2DP should be the active one.
+     */
+    @Test
+    public void a2dpAndLeAudioConnectedThenLeAudioDisconnected_fallbackToA2dp() {
+        when(mAudioManager.getMode()).thenReturn(AudioManager.MODE_NORMAL);
+
+        a2dpConnected(mA2dpDevice);
+        verify(mA2dpService, timeout(TIMEOUT_MS)).setActiveDevice(mA2dpDevice);
+
+        leAudioConnected(mLeAudioDevice);
+        verify(mLeAudioService, timeout(TIMEOUT_MS)).setActiveDevice(mLeAudioDevice);
+
+        Mockito.clearInvocations(mA2dpService);
+        leAudioDisconnected(mLeAudioDevice);
+        verify(mLeAudioService, timeout(TIMEOUT_MS).atLeast(1)).setActiveDevice(isNull());
+        verify(mA2dpService, timeout(TIMEOUT_MS)).setActiveDevice(mA2dpDevice);
+    }
+
+    /**
+     * Two Hearing Aid are connected and the current active is then disconnected.
+     * Should then set active device to fallback device.
+     */
+    @Test
+    public void hearingAidSecondDeviceDisconnected_fallbackDeviceActive() {
+        hearingAidConnected(mHearingAidDevice);
+        verify(mHearingAidService, timeout(TIMEOUT_MS)).setActiveDevice(mHearingAidDevice);
+
+        hearingAidConnected(mSecondaryAudioDevice);
+        verify(mHearingAidService, timeout(TIMEOUT_MS)).setActiveDevice(mSecondaryAudioDevice);
+
+        Mockito.clearInvocations(mHearingAidService);
+        hearingAidDisconnected(mSecondaryAudioDevice);
+        verify(mHearingAidService, timeout(TIMEOUT_MS)).setActiveDevice(mHearingAidDevice);
+    }
+
+    /**
+     * Hearing aid is connected, but active device is different BT.
+     * When the active device is disconnected, the hearing aid should be the active one.
+     */
+    @Test
+    public void activeDeviceDisconnected_fallbackToHearingAid() {
+        when(mAudioManager.getMode()).thenReturn(AudioManager.MODE_NORMAL);
+
+        hearingAidConnected(mHearingAidDevice);
+        verify(mHearingAidService, timeout(TIMEOUT_MS)).setActiveDevice(mHearingAidDevice);
+
+        leAudioConnected(mLeAudioDevice);
+        a2dpConnected(mA2dpDevice);
+
+        a2dpActiveDeviceChanged(mA2dpDevice);
+        TestUtils.waitForLooperToFinishScheduledTask(mActiveDeviceManager.getHandlerLooper());
+
+        verify(mHearingAidService).setActiveDevice(isNull());
+        verify(mLeAudioService, never()).setActiveDevice(mLeAudioDevice);
+        verify(mA2dpService, never()).setActiveDevice(mA2dpDevice);
+
+        a2dpDisconnected(mA2dpDevice);
+        verify(mA2dpService, timeout(TIMEOUT_MS).atLeast(1)).setActiveDevice(isNull());
+        verify(mHearingAidService, timeout(TIMEOUT_MS).times(2))
+                .setActiveDevice(mHearingAidDevice);
+    }
+
+    /**
+     * One LE Hearing Aid is connected.
+     */
+    @Test
+    public void onlyLeHearingAidConnected_setLeAudioActive() {
+        leHearingAidConnected(mLeHearingAidDevice);
+        TestUtils.waitForLooperToFinishScheduledTask(mActiveDeviceManager.getHandlerLooper());
+        verify(mLeAudioService, never()).setActiveDevice(mLeHearingAidDevice);
+
+        leAudioConnected(mLeHearingAidDevice);
+        verify(mLeAudioService, timeout(TIMEOUT_MS)).setActiveDevice(mLeHearingAidDevice);
+    }
+
+    /**
+     * LE audio is connected after LE Hearing Aid device.
+     * Keep LE hearing Aid active.
+     */
+    @Test
+    public void leAudioConnectedAfterLeHearingAid_setLeAudioActiveShouldNotBeCalled() {
+        leHearingAidConnected(mLeHearingAidDevice);
+        leAudioConnected(mLeHearingAidDevice);
+        verify(mLeAudioService, timeout(TIMEOUT_MS)).setActiveDevice(mLeHearingAidDevice);
+
+        leAudioConnected(mLeAudioDevice);
+        TestUtils.waitForLooperToFinishScheduledTask(mActiveDeviceManager.getHandlerLooper());
+        verify(mLeAudioService, never()).setActiveDevice(mLeAudioDevice);
+    }
+
+    /**
+     * Test connect/disconnect of devices.
+     * Hearing Aid, LE Hearing Aid, A2DP connected, then LE hearing Aid and hearing aid
+     * disconnected.
+     */
+    @Test
+    public void activeDeviceChange_withHearingAidLeHearingAidAndA2dpDevices() {
+        when(mAudioManager.getMode()).thenReturn(AudioManager.MODE_NORMAL);
+
+        hearingAidConnected(mHearingAidDevice);
+        verify(mHearingAidService, timeout(TIMEOUT_MS)).setActiveDevice(mHearingAidDevice);
+
+        leHearingAidConnected(mLeHearingAidDevice);
+        leAudioConnected(mLeHearingAidDevice);
+        verify(mLeAudioService, timeout(TIMEOUT_MS)).setActiveDevice(mLeHearingAidDevice);
+
+        a2dpConnected(mA2dpDevice);
+        TestUtils.waitForLooperToFinishScheduledTask(mActiveDeviceManager.getHandlerLooper());
+        verify(mA2dpService, never()).setActiveDevice(mA2dpDevice);
+
+        Mockito.clearInvocations(mHearingAidService, mA2dpService);
+        leHearingAidDisconnected(mLeHearingAidDevice);
+        leAudioDisconnected(mLeHearingAidDevice);
+        verify(mHearingAidService, timeout(TIMEOUT_MS)).setActiveDevice(mHearingAidDevice);
+        verify(mA2dpService, timeout(TIMEOUT_MS)).setActiveDevice(isNull());
+
+        hearingAidDisconnected(mHearingAidDevice);
+        verify(mA2dpService, timeout(TIMEOUT_MS)).setActiveDevice(mA2dpDevice);
+    }
+
+    /**
      * A wired audio device is connected. Then all active devices are set to null.
      */
     @Test
@@ -388,6 +708,9 @@
      * Helper to indicate A2dp connected for a device.
      */
     private void a2dpConnected(BluetoothDevice device) {
+        mDeviceConnectionStack.add(device);
+        mMostRecentDevice = device;
+
         Intent intent = new Intent(BluetoothA2dp.ACTION_CONNECTION_STATE_CHANGED);
         intent.putExtra(BluetoothDevice.EXTRA_DEVICE, device);
         intent.putExtra(BluetoothProfile.EXTRA_PREVIOUS_STATE, BluetoothProfile.STATE_DISCONNECTED);
@@ -399,6 +722,10 @@
      * Helper to indicate A2dp disconnected for a device.
      */
     private void a2dpDisconnected(BluetoothDevice device) {
+        mDeviceConnectionStack.remove(device);
+        mMostRecentDevice = (mDeviceConnectionStack.size() > 0)
+                ? mDeviceConnectionStack.get(mDeviceConnectionStack.size() - 1) : null;
+
         Intent intent = new Intent(BluetoothA2dp.ACTION_CONNECTION_STATE_CHANGED);
         intent.putExtra(BluetoothDevice.EXTRA_DEVICE, device);
         intent.putExtra(BluetoothProfile.EXTRA_PREVIOUS_STATE, BluetoothProfile.STATE_CONNECTED);
@@ -410,6 +737,10 @@
      * Helper to indicate A2dp active device changed for a device.
      */
     private void a2dpActiveDeviceChanged(BluetoothDevice device) {
+        mDeviceConnectionStack.remove(device);
+        mDeviceConnectionStack.add(device);
+        mMostRecentDevice = device;
+
         Intent intent = new Intent(BluetoothA2dp.ACTION_ACTIVE_DEVICE_CHANGED);
         intent.putExtra(BluetoothDevice.EXTRA_DEVICE, device);
         mActiveDeviceManager.getBroadcastReceiver().onReceive(mContext, intent);
@@ -419,6 +750,9 @@
      * Helper to indicate Headset connected for a device.
      */
     private void headsetConnected(BluetoothDevice device) {
+        mDeviceConnectionStack.add(device);
+        mMostRecentDevice = device;
+
         Intent intent = new Intent(BluetoothHeadset.ACTION_CONNECTION_STATE_CHANGED);
         intent.putExtra(BluetoothDevice.EXTRA_DEVICE, device);
         intent.putExtra(BluetoothProfile.EXTRA_PREVIOUS_STATE, BluetoothProfile.STATE_DISCONNECTED);
@@ -430,6 +764,10 @@
      * Helper to indicate Headset disconnected for a device.
      */
     private void headsetDisconnected(BluetoothDevice device) {
+        mDeviceConnectionStack.remove(device);
+        mMostRecentDevice = (mDeviceConnectionStack.size() > 0)
+                ? mDeviceConnectionStack.get(mDeviceConnectionStack.size() - 1) : null;
+
         Intent intent = new Intent(BluetoothHeadset.ACTION_CONNECTION_STATE_CHANGED);
         intent.putExtra(BluetoothDevice.EXTRA_DEVICE, device);
         intent.putExtra(BluetoothProfile.EXTRA_PREVIOUS_STATE, BluetoothProfile.STATE_CONNECTED);
@@ -441,27 +779,136 @@
      * Helper to indicate Headset active device changed for a device.
      */
     private void headsetActiveDeviceChanged(BluetoothDevice device) {
+        mDeviceConnectionStack.remove(device);
+        mDeviceConnectionStack.add(device);
+        mMostRecentDevice = device;
+
         Intent intent = new Intent(BluetoothHeadset.ACTION_ACTIVE_DEVICE_CHANGED);
         intent.putExtra(BluetoothDevice.EXTRA_DEVICE, device);
         mActiveDeviceManager.getBroadcastReceiver().onReceive(mContext, intent);
     }
 
     /**
+     * Helper to indicate Hearing Aid connected for a device.
+     */
+    private void hearingAidConnected(BluetoothDevice device) {
+        mMostRecentDevice = device;
+
+        Intent intent = new Intent(BluetoothHearingAid.ACTION_CONNECTION_STATE_CHANGED);
+        intent.putExtra(BluetoothDevice.EXTRA_DEVICE, device);
+        intent.putExtra(BluetoothProfile.EXTRA_PREVIOUS_STATE, BluetoothProfile.STATE_DISCONNECTED);
+        intent.putExtra(BluetoothProfile.EXTRA_STATE, BluetoothProfile.STATE_CONNECTED);
+        mActiveDeviceManager.getBroadcastReceiver().onReceive(mContext, intent);
+    }
+
+    /**
+     * Helper to indicate Hearing Aid disconnected for a device.
+     */
+    private void hearingAidDisconnected(BluetoothDevice device) {
+        mDeviceConnectionStack.remove(device);
+        mMostRecentDevice = (mDeviceConnectionStack.size() > 0)
+                ? mDeviceConnectionStack.get(mDeviceConnectionStack.size() - 1) : null;
+
+        Intent intent = new Intent(BluetoothHearingAid.ACTION_CONNECTION_STATE_CHANGED);
+        intent.putExtra(BluetoothDevice.EXTRA_DEVICE, device);
+        intent.putExtra(BluetoothProfile.EXTRA_PREVIOUS_STATE, BluetoothProfile.STATE_CONNECTED);
+        intent.putExtra(BluetoothProfile.EXTRA_STATE, BluetoothProfile.STATE_DISCONNECTED);
+        mActiveDeviceManager.getBroadcastReceiver().onReceive(mContext, intent);
+    }
+
+    /**
      * Helper to indicate Hearing Aid active device changed for a device.
      */
     private void hearingAidActiveDeviceChanged(BluetoothDevice device) {
+        mMostRecentDevice = device;
+
         Intent intent = new Intent(BluetoothHearingAid.ACTION_ACTIVE_DEVICE_CHANGED);
         intent.putExtra(BluetoothDevice.EXTRA_DEVICE, device);
         mActiveDeviceManager.getBroadcastReceiver().onReceive(mContext, intent);
+        mDeviceConnectionStack.remove(device);
+        mDeviceConnectionStack.add(device);
+    }
+
+    /**
+     * Helper to indicate LE Audio connected for a device.
+     */
+    private void leAudioConnected(BluetoothDevice device) {
+        mMostRecentDevice = device;
+
+        Intent intent = new Intent(BluetoothLeAudio.ACTION_LE_AUDIO_CONNECTION_STATE_CHANGED);
+        intent.putExtra(BluetoothDevice.EXTRA_DEVICE, device);
+        intent.putExtra(BluetoothProfile.EXTRA_PREVIOUS_STATE, BluetoothProfile.STATE_DISCONNECTED);
+        intent.putExtra(BluetoothProfile.EXTRA_STATE, BluetoothProfile.STATE_CONNECTED);
+        mActiveDeviceManager.getBroadcastReceiver().onReceive(mContext, intent);
+    }
+
+    /**
+     * Helper to indicate LE Audio disconnected for a device.
+     */
+    private void leAudioDisconnected(BluetoothDevice device) {
+        mDeviceConnectionStack.remove(device);
+        mMostRecentDevice = (mDeviceConnectionStack.size() > 0)
+                ? mDeviceConnectionStack.get(mDeviceConnectionStack.size() - 1) : null;
+
+        Intent intent = new Intent(BluetoothLeAudio.ACTION_LE_AUDIO_CONNECTION_STATE_CHANGED);
+        intent.putExtra(BluetoothDevice.EXTRA_DEVICE, device);
+        intent.putExtra(BluetoothProfile.EXTRA_PREVIOUS_STATE, BluetoothProfile.STATE_CONNECTED);
+        intent.putExtra(BluetoothProfile.EXTRA_STATE, BluetoothProfile.STATE_DISCONNECTED);
+        mActiveDeviceManager.getBroadcastReceiver().onReceive(mContext, intent);
     }
 
     /**
      * Helper to indicate LE Audio active device changed for a device.
      */
     private void leAudioActiveDeviceChanged(BluetoothDevice device) {
+        mDeviceConnectionStack.remove(device);
+        mDeviceConnectionStack.add(device);
+        mMostRecentDevice = device;
+
         Intent intent = new Intent(BluetoothLeAudio.ACTION_LE_AUDIO_ACTIVE_DEVICE_CHANGED);
         intent.putExtra(BluetoothDevice.EXTRA_DEVICE, device);
         mActiveDeviceManager.getBroadcastReceiver().onReceive(mContext, intent);
     }
 
+    /**
+     * Helper to indicate LE Hearing Aid connected for a device.
+     */
+    private void leHearingAidConnected(BluetoothDevice device) {
+        mDeviceConnectionStack.add(device);
+        mMostRecentDevice = device;
+
+        Intent intent = new Intent(BluetoothHapClient.ACTION_HAP_CONNECTION_STATE_CHANGED);
+        intent.putExtra(BluetoothDevice.EXTRA_DEVICE, device);
+        intent.putExtra(BluetoothProfile.EXTRA_PREVIOUS_STATE, BluetoothProfile.STATE_DISCONNECTED);
+        intent.putExtra(BluetoothProfile.EXTRA_STATE, BluetoothProfile.STATE_CONNECTED);
+        mActiveDeviceManager.getBroadcastReceiver().onReceive(mContext, intent);
+    }
+
+    /**
+     * Helper to indicate LE Hearing Aid disconnected for a device.
+     */
+    private void leHearingAidDisconnected(BluetoothDevice device) {
+        mDeviceConnectionStack.remove(device);
+        mMostRecentDevice = (mDeviceConnectionStack.size() > 0)
+                ? mDeviceConnectionStack.get(mDeviceConnectionStack.size() - 1) : null;
+
+        Intent intent = new Intent(BluetoothHapClient.ACTION_HAP_CONNECTION_STATE_CHANGED);
+        intent.putExtra(BluetoothDevice.EXTRA_DEVICE, device);
+        intent.putExtra(BluetoothProfile.EXTRA_PREVIOUS_STATE, BluetoothProfile.STATE_CONNECTED);
+        intent.putExtra(BluetoothProfile.EXTRA_STATE, BluetoothProfile.STATE_DISCONNECTED);
+        mActiveDeviceManager.getBroadcastReceiver().onReceive(mContext, intent);
+    }
+
+    /**
+     * Helper to indicate LE Audio Hearing Aid device changed for a device.
+     */
+    private void leHearingAidActiveDeviceChanged(BluetoothDevice device) {
+        mDeviceConnectionStack.remove(device);
+        mDeviceConnectionStack.add(device);
+        mMostRecentDevice = device;
+
+        Intent intent = new Intent(BluetoothHapClient.ACTION_HAP_DEVICE_AVAILABLE);
+        intent.putExtra(BluetoothDevice.EXTRA_DEVICE, device);
+        mActiveDeviceManager.getBroadcastReceiver().onReceive(mContext, intent);
+    }
 }
diff --git a/android/app/tests/unit/src/com/android/bluetooth/btservice/AdapterServiceBinderTest.java b/android/app/tests/unit/src/com/android/bluetooth/btservice/AdapterServiceBinderTest.java
new file mode 100644
index 0000000..0e6d4d1
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/btservice/AdapterServiceBinderTest.java
@@ -0,0 +1,211 @@
+/*
+ * Copyright 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.btservice;
+
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.anyInt;
+import static org.mockito.Mockito.doReturn;
+import static org.mockito.Mockito.never;
+import static org.mockito.Mockito.verify;
+
+import android.bluetooth.BluetoothAdapter;
+import android.bluetooth.BluetoothClass;
+import android.bluetooth.IBluetoothOobDataCallback;
+import android.content.AttributionSource;
+import android.content.pm.PackageManager;
+import android.os.ParcelUuid;
+
+import com.android.bluetooth.x.com.android.modules.utils.SynchronousResultReceiver;
+
+import org.junit.After;
+import org.junit.Before;
+import org.junit.Test;
+import org.mockito.Mock;
+import org.mockito.Mockito;
+import org.mockito.MockitoAnnotations;
+
+import java.io.FileDescriptor;
+
+public class AdapterServiceBinderTest {
+    @Mock private AdapterService mService;
+    @Mock private AdapterProperties mAdapterProperties;
+    @Mock private PackageManager mPackageManager;
+
+    private AdapterService.AdapterServiceBinder mBinder;
+    private AttributionSource mAttributionSource;
+
+    @Before
+    public void setUp() {
+        MockitoAnnotations.initMocks(this);
+        mService.mAdapterProperties = mAdapterProperties;
+        doReturn(true).when(mService).isAvailable();
+        doReturn(mPackageManager).when(mService).getPackageManager();
+        doReturn(new String[] { "com.android.bluetooth.btservice.test" })
+                .when(mPackageManager).getPackagesForUid(anyInt());
+        mBinder = new AdapterService.AdapterServiceBinder(mService);
+        mAttributionSource = new AttributionSource.Builder(0).build();
+    }
+
+    @After
+    public void cleaUp() {
+        mBinder.cleanup();
+    }
+
+    @Test
+    public void getAddress() {
+        mBinder.getAddress();
+        verify(mService.mAdapterProperties).getAddress();
+    }
+
+    @Test
+    public void dump() {
+        FileDescriptor fd = new FileDescriptor();
+        String[] args = new String[] { };
+        mBinder.dump(fd, args);
+        verify(mService).dump(any(), any(), any());
+
+        Mockito.clearInvocations(mService);
+        mBinder.cleanup();
+        mBinder.dump(fd, args);
+        verify(mService, never()).dump(any(), any(), any());
+    }
+
+    @Test
+    public void generateLocalOobData() {
+        int transport = 0;
+        IBluetoothOobDataCallback cb = Mockito.mock(IBluetoothOobDataCallback.class);
+
+        mBinder.generateLocalOobData(transport, cb, mAttributionSource,
+                SynchronousResultReceiver.get());
+        verify(mService).generateLocalOobData(transport, cb);
+
+        Mockito.clearInvocations(mService);
+        mBinder.cleanup();
+        mBinder.generateLocalOobData(transport, cb, mAttributionSource,
+                SynchronousResultReceiver.get());
+        verify(mService, never()).generateLocalOobData(transport, cb);
+    }
+
+    @Test
+    public void getBluetoothClass() {
+        mBinder.getBluetoothClass(mAttributionSource, SynchronousResultReceiver.get());
+        verify(mService.mAdapterProperties).getBluetoothClass();
+    }
+
+    @Test
+    public void getIoCapability() {
+        mBinder.getIoCapability(mAttributionSource, SynchronousResultReceiver.get());
+        verify(mService.mAdapterProperties).getIoCapability();
+    }
+
+    @Test
+    public void getLeIoCapability() {
+        mBinder.getLeIoCapability(mAttributionSource, SynchronousResultReceiver.get());
+        verify(mService.mAdapterProperties).getLeIoCapability();
+    }
+
+    @Test
+    public void getLeMaximumAdvertisingDataLength() {
+        mBinder.getLeMaximumAdvertisingDataLength(SynchronousResultReceiver.get());
+        verify(mService).getLeMaximumAdvertisingDataLength();
+    }
+
+    @Test
+    public void getScanMode() {
+        mBinder.getScanMode(mAttributionSource, SynchronousResultReceiver.get());
+        verify(mService.mAdapterProperties).getScanMode();
+    }
+
+    @Test
+    public void isA2dpOffloadEnabled() {
+        mBinder.isA2dpOffloadEnabled(mAttributionSource, SynchronousResultReceiver.get());
+        verify(mService).isA2dpOffloadEnabled();
+    }
+
+    @Test
+    public void isActivityAndEnergyReportingSupported() {
+        mBinder.isActivityAndEnergyReportingSupported(SynchronousResultReceiver.get());
+        verify(mService.mAdapterProperties).isActivityAndEnergyReportingSupported();
+    }
+
+    @Test
+    public void isLe2MPhySupported() {
+        mBinder.isLe2MPhySupported(SynchronousResultReceiver.get());
+        verify(mService).isLe2MPhySupported();
+    }
+
+    @Test
+    public void isLeCodedPhySupported() {
+        mBinder.isLeCodedPhySupported(SynchronousResultReceiver.get());
+        verify(mService).isLeCodedPhySupported();
+    }
+
+    @Test
+    public void isLeExtendedAdvertisingSupported() {
+        mBinder.isLeExtendedAdvertisingSupported(SynchronousResultReceiver.get());
+        verify(mService).isLeExtendedAdvertisingSupported();
+    }
+
+    @Test
+    public void removeActiveDevice() {
+        int profiles = BluetoothAdapter.ACTIVE_DEVICE_ALL;
+        mBinder.removeActiveDevice(profiles, mAttributionSource, SynchronousResultReceiver.get());
+        verify(mService).setActiveDevice(null, profiles);
+    }
+
+    @Test
+    public void reportActivityInfo() {
+        mBinder.reportActivityInfo(mAttributionSource, SynchronousResultReceiver.get());
+        verify(mService).reportActivityInfo();
+    }
+
+    @Test
+    public void retrievePendingSocketForServiceRecord() {
+        ParcelUuid uuid = ParcelUuid.fromString("0000110A-0000-1000-8000-00805F9B34FB");
+        mBinder.retrievePendingSocketForServiceRecord(uuid, mAttributionSource,
+                SynchronousResultReceiver.get());
+        verify(mService).retrievePendingSocketForServiceRecord(uuid, mAttributionSource);
+    }
+
+    @Test
+    public void setBluetoothClass() {
+        BluetoothClass btClass = new BluetoothClass(0);
+        mBinder.setBluetoothClass(btClass, mAttributionSource, SynchronousResultReceiver.get());
+        verify(mService.mAdapterProperties).setBluetoothClass(btClass);
+    }
+
+    @Test
+    public void setIoCapability() {
+        int capability = BluetoothAdapter.IO_CAPABILITY_MAX - 1;
+        mBinder.setIoCapability(capability, mAttributionSource, SynchronousResultReceiver.get());
+        verify(mService.mAdapterProperties).setIoCapability(capability);
+    }
+
+    @Test
+    public void setLeIoCapability() {
+        int capability = BluetoothAdapter.IO_CAPABILITY_MAX - 1;
+        mBinder.setLeIoCapability(capability, mAttributionSource, SynchronousResultReceiver.get());
+        verify(mService.mAdapterProperties).setLeIoCapability(capability);
+    }
+
+    @Test
+    public void stopRfcommListener() {
+        ParcelUuid uuid = ParcelUuid.fromString("0000110A-0000-1000-8000-00805F9B34FB");
+        mBinder.stopRfcommListener(uuid, mAttributionSource, SynchronousResultReceiver.get());
+        verify(mService).stopRfcommListener(uuid, mAttributionSource);
+    }
+}
diff --git a/android/app/tests/unit/src/com/android/bluetooth/btservice/AdapterServiceFactoryResetTest.java b/android/app/tests/unit/src/com/android/bluetooth/btservice/AdapterServiceFactoryResetTest.java
new file mode 100644
index 0000000..6acc5a0
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/btservice/AdapterServiceFactoryResetTest.java
@@ -0,0 +1,477 @@
+/*
+ * Copyright 2017 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.btservice;
+
+import static android.Manifest.permission.BLUETOOTH_SCAN;
+
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.Mockito.*;
+
+import android.app.AlarmManager;
+import android.app.admin.DevicePolicyManager;
+import android.bluetooth.BluetoothAdapter;
+import android.bluetooth.BluetoothDevice;
+import android.bluetooth.BluetoothManager;
+import android.bluetooth.IBluetoothCallback;
+import android.content.AttributionSource;
+import android.content.Context;
+import android.content.pm.ApplicationInfo;
+import android.content.pm.PackageManager;
+import android.content.pm.PermissionInfo;
+import android.content.res.Resources;
+import android.media.AudioManager;
+import android.os.AsyncTask;
+import android.os.BatteryStatsManager;
+import android.os.Binder;
+import android.os.Bundle;
+import android.os.Looper;
+import android.os.PowerManager;
+import android.os.Process;
+import android.os.RemoteException;
+import android.os.UserHandle;
+import android.os.UserManager;
+import android.permission.PermissionCheckerManager;
+import android.permission.PermissionManager;
+import android.provider.Settings;
+import android.test.mock.MockContentProvider;
+import android.test.mock.MockContentResolver;
+import android.util.Log;
+
+import androidx.test.InstrumentationRegistry;
+import androidx.test.filters.MediumTest;
+import androidx.test.runner.AndroidJUnit4;
+
+import com.android.bluetooth.TestUtils;
+import com.android.bluetooth.Utils;
+import com.android.bluetooth.a2dp.A2dpService;
+import com.android.bluetooth.a2dpsink.A2dpSinkService;
+import com.android.bluetooth.avrcp.AvrcpTargetService;
+import com.android.bluetooth.avrcpcontroller.AvrcpControllerService;
+import com.android.bluetooth.bas.BatteryService;
+import com.android.bluetooth.bass_client.BassClientService;
+import com.android.bluetooth.csip.CsipSetCoordinatorService;
+import com.android.bluetooth.gatt.GattService;
+import com.android.bluetooth.hap.HapClientService;
+import com.android.bluetooth.hearingaid.HearingAidService;
+import com.android.bluetooth.hfp.HeadsetService;
+import com.android.bluetooth.hfpclient.HeadsetClientService;
+import com.android.bluetooth.hid.HidDeviceService;
+import com.android.bluetooth.hid.HidHostService;
+import com.android.bluetooth.le_audio.LeAudioService;
+import com.android.bluetooth.map.BluetoothMapService;
+import com.android.bluetooth.mapclient.MapClientService;
+import com.android.bluetooth.mcp.McpService;
+import com.android.bluetooth.opp.BluetoothOppService;
+import com.android.bluetooth.pan.PanService;
+import com.android.bluetooth.pbap.BluetoothPbapService;
+import com.android.bluetooth.pbapclient.PbapClientService;
+import com.android.bluetooth.sap.SapService;
+import com.android.bluetooth.tbs.TbsService;
+import com.android.bluetooth.vc.VolumeControlService;
+import com.android.internal.app.IBatteryStats;
+
+import org.junit.After;
+import org.junit.AfterClass;
+import org.junit.Assert;
+import org.junit.Before;
+import org.junit.BeforeClass;
+import org.junit.Ignore;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.Mock;
+import org.mockito.MockitoAnnotations;
+
+import java.util.Arrays;
+import java.util.HashMap;
+
+@MediumTest
+@RunWith(AndroidJUnit4.class)
+public class AdapterServiceFactoryResetTest {
+    private static final String TAG = AdapterServiceFactoryResetTest.class.getSimpleName();
+
+    private AdapterService mAdapterService;
+    private AdapterService.AdapterServiceBinder mServiceBinder;
+
+    private @Mock Context mMockContext;
+    private @Mock ApplicationInfo mMockApplicationInfo;
+    private @Mock AlarmManager mMockAlarmManager;
+    private @Mock Resources mMockResources;
+    private @Mock UserManager mMockUserManager;
+    private @Mock DevicePolicyManager mMockDevicePolicyManager;
+    private @Mock ProfileService mMockGattService;
+    private @Mock ProfileService mMockService;
+    private @Mock ProfileService mMockService2;
+    private @Mock IBluetoothCallback mIBluetoothCallback;
+    private @Mock Binder mBinder;
+    private @Mock AudioManager mAudioManager;
+    private @Mock android.app.Application mApplication;
+    private @Mock MetricsLogger mMockMetricsLogger;
+
+    // BatteryStatsManager is final and cannot be mocked with regular mockito, so just mock the
+    // underlying binder calls.
+    final BatteryStatsManager mBatteryStatsManager =
+            new BatteryStatsManager(mock(IBatteryStats.class));
+
+    private static final int CONTEXT_SWITCH_MS = 100;
+    private static final int PROFILE_SERVICE_TOGGLE_TIME_MS = 200;
+    private static final int GATT_START_TIME_MS = 1000;
+    private static final int ONE_SECOND_MS = 1000;
+    private static final int NATIVE_INIT_MS = 8000;
+
+    private final AttributionSource mAttributionSource = new AttributionSource.Builder(
+            Process.myUid()).build();
+
+    private BluetoothManager mBluetoothManager;
+    private PowerManager mPowerManager;
+    private PermissionCheckerManager mPermissionCheckerManager;
+    private PermissionManager mPermissionManager;
+    private PackageManager mMockPackageManager;
+    private MockContentResolver mMockContentResolver;
+    private HashMap<String, HashMap<String, String>> mAdapterConfig;
+    private int mForegroundUserId;
+
+    private void configureEnabledProfiles() {
+        Log.e(TAG, "configureEnabledProfiles");
+        Config.setProfileEnabled(PanService.class, true);
+        Config.setProfileEnabled(BluetoothPbapService.class, true);
+        Config.setProfileEnabled(GattService.class, true);
+
+        Config.setProfileEnabled(A2dpService.class, false);
+        Config.setProfileEnabled(A2dpSinkService.class, false);
+        Config.setProfileEnabled(AvrcpTargetService.class, false);
+        Config.setProfileEnabled(AvrcpControllerService.class, false);
+        Config.setProfileEnabled(BassClientService.class, false);
+        Config.setProfileEnabled(BatteryService.class, false);
+        Config.setProfileEnabled(CsipSetCoordinatorService.class, false);
+        Config.setProfileEnabled(HapClientService.class, false);
+        Config.setProfileEnabled(HeadsetService.class, false);
+        Config.setProfileEnabled(HeadsetClientService.class, false);
+        Config.setProfileEnabled(HearingAidService.class, false);
+        Config.setProfileEnabled(HidDeviceService.class, false);
+        Config.setProfileEnabled(HidHostService.class, false);
+        Config.setProfileEnabled(LeAudioService.class, false);
+        Config.setProfileEnabled(TbsService.class, false);
+        Config.setProfileEnabled(BluetoothMapService.class, false);
+        Config.setProfileEnabled(MapClientService.class, false);
+        Config.setProfileEnabled(McpService.class, false);
+        Config.setProfileEnabled(BluetoothOppService.class, false);
+        Config.setProfileEnabled(PbapClientService.class, false);
+        Config.setProfileEnabled(SapService.class, false);
+        Config.setProfileEnabled(VolumeControlService.class, false);
+    }
+
+    @BeforeClass
+    public static void setupClass() {
+        Log.e(TAG, "setupClass");
+        // Bring native layer up and down to make sure config files are properly loaded
+        if (Looper.myLooper() == null) {
+            Looper.prepare();
+        }
+        Assert.assertNotNull(Looper.myLooper());
+        AdapterService adapterService = new AdapterService();
+        adapterService.initNative(false /* is_restricted */, false /* is_common_criteria_mode */,
+                0 /* config_compare_result */, new String[0], false, "");
+        adapterService.cleanupNative();
+        HashMap<String, HashMap<String, String>> adapterConfig = TestUtils.readAdapterConfig();
+        Assert.assertNotNull(adapterConfig);
+        Assert.assertNotNull("metrics salt is null: " + adapterConfig.toString(),
+                AdapterServiceTest.getMetricsSalt(adapterConfig));
+    }
+
+    @Before
+    public void setUp() throws PackageManager.NameNotFoundException {
+        Log.e(TAG, "setUp()");
+        MockitoAnnotations.initMocks(this);
+        if (Looper.myLooper() == null) {
+            Looper.prepare();
+        }
+        Assert.assertNotNull(Looper.myLooper());
+
+        // Dispatch all async work through instrumentation so we can wait until
+        // it's drained below
+        AsyncTask.setDefaultExecutor((r) -> {
+            androidx.test.platform.app.InstrumentationRegistry.getInstrumentation()
+                    .runOnMainSync(r);
+        });
+        androidx.test.platform.app.InstrumentationRegistry.getInstrumentation().getUiAutomation()
+                .adoptShellPermissionIdentity();
+
+        androidx.test.platform.app.InstrumentationRegistry.getInstrumentation().runOnMainSync(
+                () -> mAdapterService = new AdapterService());
+        mServiceBinder = new AdapterService.AdapterServiceBinder(mAdapterService);
+        mMockPackageManager = mock(PackageManager.class);
+        when(mMockPackageManager.getPermissionInfo(any(), anyInt()))
+                .thenReturn(new PermissionInfo());
+
+        mMockContentResolver = new MockContentResolver(InstrumentationRegistry.getTargetContext());
+        mMockContentResolver.addProvider(Settings.AUTHORITY, new MockContentProvider() {
+            @Override
+            public Bundle call(String method, String request, Bundle args) {
+                return Bundle.EMPTY;
+            }
+        });
+
+        mPowerManager = InstrumentationRegistry.getTargetContext()
+                .getSystemService(PowerManager.class);
+        mPermissionCheckerManager = InstrumentationRegistry.getTargetContext()
+                .getSystemService(PermissionCheckerManager.class);
+
+        mPermissionManager = InstrumentationRegistry.getTargetContext()
+                .getSystemService(PermissionManager.class);
+
+        mBluetoothManager = InstrumentationRegistry.getTargetContext()
+                .getSystemService(BluetoothManager.class);
+
+        when(mMockContext.getCacheDir()).thenReturn(InstrumentationRegistry.getTargetContext()
+                .getCacheDir());
+        when(mMockContext.getApplicationInfo()).thenReturn(mMockApplicationInfo);
+        when(mMockContext.getContentResolver()).thenReturn(mMockContentResolver);
+        when(mMockContext.getApplicationContext()).thenReturn(mMockContext);
+        when(mMockContext.createContextAsUser(UserHandle.SYSTEM, /* flags= */ 0)).thenReturn(
+                mMockContext);
+        when(mMockContext.getResources()).thenReturn(mMockResources);
+        when(mMockContext.getUserId()).thenReturn(Process.BLUETOOTH_UID);
+        when(mMockContext.getPackageManager()).thenReturn(mMockPackageManager);
+        when(mMockContext.getSystemService(Context.USER_SERVICE)).thenReturn(mMockUserManager);
+        when(mMockContext.getSystemServiceName(UserManager.class)).thenReturn(Context.USER_SERVICE);
+        when(mMockContext.getSystemService(Context.DEVICE_POLICY_SERVICE)).thenReturn(
+                mMockDevicePolicyManager);
+        when(mMockContext.getSystemServiceName(DevicePolicyManager.class))
+                .thenReturn(Context.DEVICE_POLICY_SERVICE);
+        when(mMockContext.getSystemService(Context.POWER_SERVICE)).thenReturn(mPowerManager);
+        when(mMockContext.getSystemServiceName(PowerManager.class))
+                .thenReturn(Context.POWER_SERVICE);
+        when(mMockContext.getSystemServiceName(PermissionCheckerManager.class))
+                .thenReturn(Context.PERMISSION_CHECKER_SERVICE);
+        when(mMockContext.getSystemService(Context.PERMISSION_CHECKER_SERVICE))
+                .thenReturn(mPermissionCheckerManager);
+        when(mMockContext.getSystemServiceName(PermissionManager.class))
+                .thenReturn(Context.PERMISSION_SERVICE);
+        when(mMockContext.getSystemService(Context.PERMISSION_SERVICE))
+                .thenReturn(mPermissionManager);
+        when(mMockContext.getSystemService(Context.ALARM_SERVICE)).thenReturn(mMockAlarmManager);
+        when(mMockContext.getSystemServiceName(AlarmManager.class))
+                .thenReturn(Context.ALARM_SERVICE);
+        when(mMockContext.getSystemService(Context.AUDIO_SERVICE)).thenReturn(mAudioManager);
+        when(mMockContext.getSystemServiceName(AudioManager.class))
+                .thenReturn(Context.AUDIO_SERVICE);
+        when(mMockContext.getSystemService(Context.BATTERY_STATS_SERVICE))
+                .thenReturn(mBatteryStatsManager);
+        when(mMockContext.getSystemServiceName(BatteryStatsManager.class))
+                .thenReturn(Context.BATTERY_STATS_SERVICE);
+        when(mMockContext.getSystemService(Context.BLUETOOTH_SERVICE))
+                .thenReturn(mBluetoothManager);
+        when(mMockContext.getSystemServiceName(BluetoothManager.class))
+                .thenReturn(Context.BLUETOOTH_SERVICE);
+        when(mMockContext.getSharedPreferences(anyString(), anyInt()))
+                .thenReturn(InstrumentationRegistry.getTargetContext()
+                        .getSharedPreferences("AdapterServiceTestPrefs", Context.MODE_PRIVATE));
+
+        when(mMockContext.getAttributionSource()).thenReturn(mAttributionSource);
+        doAnswer(invocation -> {
+            Object[] args = invocation.getArguments();
+            return InstrumentationRegistry.getTargetContext().getDatabasePath((String) args[0]);
+        }).when(mMockContext).getDatabasePath(anyString());
+
+        // Sets the foreground user id to match that of the tests (restored in tearDown)
+        mForegroundUserId = Utils.getForegroundUserId();
+        int callingUid = Binder.getCallingUid();
+        UserHandle callingUser = UserHandle.getUserHandleForUid(callingUid);
+        Utils.setForegroundUserId(callingUser.getIdentifier());
+
+        when(mMockDevicePolicyManager.isCommonCriteriaModeEnabled(any())).thenReturn(false);
+
+        when(mIBluetoothCallback.asBinder()).thenReturn(mBinder);
+
+        doReturn(Process.BLUETOOTH_UID).when(mMockPackageManager)
+                .getPackageUidAsUser(any(), anyInt(), anyInt());
+
+        when(mMockGattService.getName()).thenReturn("GattService");
+        when(mMockService.getName()).thenReturn("Service1");
+        when(mMockService2.getName()).thenReturn("Service2");
+
+        when(mMockMetricsLogger.init(any())).thenReturn(true);
+        when(mMockMetricsLogger.close()).thenReturn(true);
+
+        configureEnabledProfiles();
+        Config.init(mMockContext);
+
+        mAdapterService.setMetricsLogger(mMockMetricsLogger);
+
+        // Attach a context to the service for permission checks.
+        mAdapterService.attach(mMockContext, null, null, null, mApplication, null);
+        mAdapterService.onCreate();
+
+        // Wait for any async events to drain
+        androidx.test.platform.app.InstrumentationRegistry.getInstrumentation().waitForIdleSync();
+
+        mServiceBinder.registerCallback(mIBluetoothCallback, mAttributionSource);
+
+        mAdapterConfig = TestUtils.readAdapterConfig();
+        Assert.assertNotNull(mAdapterConfig);
+    }
+
+    @After
+    public void tearDown() {
+        Log.e(TAG, "tearDown()");
+
+        // Enable the stack to re-create the config. Next tests rely on it.
+        doEnable(0, false);
+
+        // Restores the foregroundUserId to the ID prior to the test setup
+        Utils.setForegroundUserId(mForegroundUserId);
+
+        mServiceBinder.unregisterCallback(mIBluetoothCallback, mAttributionSource);
+        mAdapterService.cleanup();
+    }
+
+    @AfterClass
+    public static void tearDownOnce() {
+        AsyncTask.setDefaultExecutor(AsyncTask.SERIAL_EXECUTOR);
+    }
+
+    private void verifyStateChange(int prevState, int currState, int callNumber, int timeoutMs) {
+        try {
+            verify(mIBluetoothCallback, timeout(timeoutMs).times(callNumber))
+                .onBluetoothStateChange(prevState, currState);
+        } catch (RemoteException e) {
+            // the mocked onBluetoothStateChange doesn't throw RemoteException
+        }
+    }
+
+    private void doEnable(int invocationNumber, boolean onlyGatt) {
+        Log.e(TAG, "doEnable() start");
+        Assert.assertFalse(mAdapterService.getState() == BluetoothAdapter.STATE_ON);
+
+        int startServiceCalls;
+        startServiceCalls = 2 * (onlyGatt ? 1 : 3); // Start and stop GATT + 2
+
+        mAdapterService.enable(false);
+
+        verifyStateChange(BluetoothAdapter.STATE_OFF, BluetoothAdapter.STATE_BLE_TURNING_ON,
+                invocationNumber + 1, CONTEXT_SWITCH_MS);
+
+        // Start GATT
+        verify(mMockContext, timeout(GATT_START_TIME_MS).times(
+                startServiceCalls * invocationNumber + 1)).startService(any());
+        mAdapterService.addProfile(mMockGattService);
+        mAdapterService.onProfileServiceStateChanged(mMockGattService, BluetoothAdapter.STATE_ON);
+
+        verifyStateChange(BluetoothAdapter.STATE_BLE_TURNING_ON, BluetoothAdapter.STATE_BLE_ON,
+                invocationNumber + 1, NATIVE_INIT_MS);
+
+        mServiceBinder.onLeServiceUp(mAttributionSource);
+
+        verifyStateChange(BluetoothAdapter.STATE_BLE_ON, BluetoothAdapter.STATE_TURNING_ON,
+                invocationNumber + 1, CONTEXT_SWITCH_MS);
+
+        if (!onlyGatt) {
+            // Start Mock PBAP and PAN services
+            verify(mMockContext, timeout(ONE_SECOND_MS).times(
+                    startServiceCalls * invocationNumber + 3)).startService(any());
+
+            mAdapterService.addProfile(mMockService);
+            mAdapterService.addProfile(mMockService2);
+            mAdapterService.onProfileServiceStateChanged(mMockService, BluetoothAdapter.STATE_ON);
+            mAdapterService.onProfileServiceStateChanged(mMockService2, BluetoothAdapter.STATE_ON);
+        }
+
+        verifyStateChange(BluetoothAdapter.STATE_TURNING_ON, BluetoothAdapter.STATE_ON,
+                invocationNumber + 1, PROFILE_SERVICE_TOGGLE_TIME_MS);
+
+        verify(mMockContext, timeout(CONTEXT_SWITCH_MS).times(2 * invocationNumber + 2))
+                .sendBroadcast(any(), eq(BLUETOOTH_SCAN),
+                        any(Bundle.class));
+        final int scanMode = mServiceBinder.getScanMode(mAttributionSource);
+        Assert.assertTrue(scanMode == BluetoothAdapter.SCAN_MODE_CONNECTABLE
+                || scanMode == BluetoothAdapter.SCAN_MODE_CONNECTABLE_DISCOVERABLE);
+        Assert.assertTrue(mAdapterService.getState() == BluetoothAdapter.STATE_ON);
+
+        Log.e(TAG, "doEnable() complete success");
+    }
+
+    /**
+     * Test: Verify that obfuscated Bluetooth address changes after factory reset
+     *
+     * There are 4 types of factory reset that we are talking about:
+     * 1. Factory reset all user data from Settings -> Will restart phone
+     * 2. Factory reset WiFi and Bluetooth from Settings -> Will only restart WiFi and BT
+     * 3. Call BluetoothAdapter.factoryReset() -> Will disable Bluetooth and reset config in
+     * memory and disk
+     * 4. Call AdapterService.factoryReset() -> Will only reset config in memory
+     *
+     * We can only use No. 4 here
+     */
+    @Ignore("AdapterService.factoryReset() does not reload config into memory and hence old salt"
+            + " is still used until next time Bluetooth library is initialized. However Bluetooth"
+            + " cannot be used until Bluetooth process restart any way. Thus it is almost"
+            + " guaranteed that user has to re-enable Bluetooth and hence re-generate new salt"
+            + " after factory reset")
+    @Test
+    public void testObfuscateBluetoothAddress_FactoryReset() {
+        Assert.assertFalse(mAdapterService.getState() == BluetoothAdapter.STATE_ON);
+        BluetoothDevice device = TestUtils.getTestDevice(BluetoothAdapter.getDefaultAdapter(), 0);
+        byte[] obfuscatedAddress1 = mAdapterService.obfuscateAddress(device);
+        Assert.assertTrue(obfuscatedAddress1.length > 0);
+        Assert.assertFalse(AdapterServiceTest.isByteArrayAllZero(obfuscatedAddress1));
+        mServiceBinder.factoryReset(mAttributionSource);
+        byte[] obfuscatedAddress2 = mAdapterService.obfuscateAddress(device);
+        Assert.assertTrue(obfuscatedAddress2.length > 0);
+        Assert.assertFalse(AdapterServiceTest.isByteArrayAllZero(obfuscatedAddress2));
+        Assert.assertFalse(Arrays.equals(obfuscatedAddress2,
+                obfuscatedAddress1));
+        doEnable(0, false);
+        byte[] obfuscatedAddress3 = mAdapterService.obfuscateAddress(device);
+        Assert.assertTrue(obfuscatedAddress3.length > 0);
+        Assert.assertFalse(AdapterServiceTest.isByteArrayAllZero(obfuscatedAddress3));
+        Assert.assertArrayEquals(obfuscatedAddress3,
+                obfuscatedAddress2);
+        mServiceBinder.factoryReset(mAttributionSource);
+        byte[] obfuscatedAddress4 = mAdapterService.obfuscateAddress(device);
+        Assert.assertTrue(obfuscatedAddress4.length > 0);
+        Assert.assertFalse(AdapterServiceTest.isByteArrayAllZero(obfuscatedAddress4));
+        Assert.assertFalse(Arrays.equals(obfuscatedAddress4,
+                obfuscatedAddress3));
+    }
+
+    /**
+     * Test: Verify that obfuscated Bluetooth address changes after factory reset and reloading
+     *       native layer
+     */
+    @Test
+    public void testObfuscateBluetoothAddress_FactoryResetAndReloadNativeLayer() throws
+            PackageManager.NameNotFoundException {
+        byte[] metricsSalt1 = AdapterServiceTest.getMetricsSalt(mAdapterConfig);
+        Assert.assertNotNull(metricsSalt1);
+        Assert.assertFalse(mAdapterService.getState() == BluetoothAdapter.STATE_ON);
+        BluetoothDevice device = TestUtils.getTestDevice(BluetoothAdapter.getDefaultAdapter(), 0);
+        byte[] obfuscatedAddress1 = mAdapterService.obfuscateAddress(device);
+        Assert.assertTrue(obfuscatedAddress1.length > 0);
+        Assert.assertFalse(AdapterServiceTest.isByteArrayAllZero(obfuscatedAddress1));
+        Assert.assertArrayEquals(AdapterServiceTest.obfuscateInJava(metricsSalt1, device),
+                obfuscatedAddress1);
+        mServiceBinder.factoryReset(mAttributionSource);
+        tearDown();
+        setUp();
+        // Cannot verify metrics salt since it is not written to disk until native cleanup
+        byte[] obfuscatedAddress2 = mAdapterService.obfuscateAddress(device);
+        Assert.assertTrue(obfuscatedAddress2.length > 0);
+        Assert.assertFalse(AdapterServiceTest.isByteArrayAllZero(obfuscatedAddress2));
+        Assert.assertFalse(Arrays.equals(obfuscatedAddress2,
+                obfuscatedAddress1));
+    }
+}
diff --git a/android/app/tests/unit/src/com/android/bluetooth/btservice/AdapterServiceRestartTest.java b/android/app/tests/unit/src/com/android/bluetooth/btservice/AdapterServiceRestartTest.java
new file mode 100644
index 0000000..c93837b
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/btservice/AdapterServiceRestartTest.java
@@ -0,0 +1,374 @@
+/*
+ * Copyright 2017 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.btservice;
+
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.Mockito.*;
+
+import android.app.AlarmManager;
+import android.app.admin.DevicePolicyManager;
+import android.bluetooth.BluetoothAdapter;
+import android.bluetooth.BluetoothDevice;
+import android.bluetooth.BluetoothManager;
+import android.bluetooth.IBluetoothCallback;
+import android.content.AttributionSource;
+import android.content.Context;
+import android.content.pm.ApplicationInfo;
+import android.content.pm.PackageManager;
+import android.content.pm.PermissionInfo;
+import android.content.res.Resources;
+import android.media.AudioManager;
+import android.os.AsyncTask;
+import android.os.BatteryStatsManager;
+import android.os.Binder;
+import android.os.Bundle;
+import android.os.Looper;
+import android.os.PowerManager;
+import android.os.Process;
+import android.os.UserHandle;
+import android.os.UserManager;
+import android.permission.PermissionCheckerManager;
+import android.permission.PermissionManager;
+import android.provider.Settings;
+import android.test.mock.MockContentProvider;
+import android.test.mock.MockContentResolver;
+import android.util.Log;
+
+import androidx.test.InstrumentationRegistry;
+import androidx.test.filters.MediumTest;
+import androidx.test.runner.AndroidJUnit4;
+
+import com.android.bluetooth.TestUtils;
+import com.android.bluetooth.Utils;
+import com.android.bluetooth.a2dp.A2dpService;
+import com.android.bluetooth.a2dpsink.A2dpSinkService;
+import com.android.bluetooth.avrcp.AvrcpTargetService;
+import com.android.bluetooth.avrcpcontroller.AvrcpControllerService;
+import com.android.bluetooth.bas.BatteryService;
+import com.android.bluetooth.bass_client.BassClientService;
+import com.android.bluetooth.csip.CsipSetCoordinatorService;
+import com.android.bluetooth.gatt.GattService;
+import com.android.bluetooth.hap.HapClientService;
+import com.android.bluetooth.hearingaid.HearingAidService;
+import com.android.bluetooth.hfp.HeadsetService;
+import com.android.bluetooth.hfpclient.HeadsetClientService;
+import com.android.bluetooth.hid.HidDeviceService;
+import com.android.bluetooth.hid.HidHostService;
+import com.android.bluetooth.le_audio.LeAudioService;
+import com.android.bluetooth.map.BluetoothMapService;
+import com.android.bluetooth.mapclient.MapClientService;
+import com.android.bluetooth.mcp.McpService;
+import com.android.bluetooth.opp.BluetoothOppService;
+import com.android.bluetooth.pan.PanService;
+import com.android.bluetooth.pbap.BluetoothPbapService;
+import com.android.bluetooth.pbapclient.PbapClientService;
+import com.android.bluetooth.sap.SapService;
+import com.android.bluetooth.tbs.TbsService;
+import com.android.bluetooth.vc.VolumeControlService;
+import com.android.internal.app.IBatteryStats;
+
+import org.junit.After;
+import org.junit.AfterClass;
+import org.junit.Assert;
+import org.junit.Before;
+import org.junit.BeforeClass;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.Mock;
+import org.mockito.MockitoAnnotations;
+
+import java.util.HashMap;
+
+@MediumTest
+@RunWith(AndroidJUnit4.class)
+public class AdapterServiceRestartTest {
+    private static final String TAG = AdapterServiceTest.class.getSimpleName();
+
+    private AdapterService mAdapterService;
+    private AdapterService.AdapterServiceBinder mServiceBinder;
+
+    private @Mock Context mMockContext;
+    private @Mock ApplicationInfo mMockApplicationInfo;
+    private @Mock AlarmManager mMockAlarmManager;
+    private @Mock Resources mMockResources;
+    private @Mock UserManager mMockUserManager;
+    private @Mock DevicePolicyManager mMockDevicePolicyManager;
+    private @Mock IBluetoothCallback mIBluetoothCallback;
+    private @Mock Binder mBinder;
+    private @Mock AudioManager mAudioManager;
+    private @Mock android.app.Application mApplication;
+    private @Mock MetricsLogger mMockMetricsLogger;
+
+    // BatteryStatsManager is final and cannot be mocked with regular mockito, so just mock the
+    // underlying binder calls.
+    final BatteryStatsManager mBatteryStatsManager =
+            new BatteryStatsManager(mock(IBatteryStats.class));
+
+    private final AttributionSource mAttributionSource = new AttributionSource.Builder(
+            Process.myUid()).build();
+
+    private BluetoothManager mBluetoothManager;
+    private PowerManager mPowerManager;
+    private PermissionCheckerManager mPermissionCheckerManager;
+    private PermissionManager mPermissionManager;
+    private PackageManager mMockPackageManager;
+    private MockContentResolver mMockContentResolver;
+    private HashMap<String, HashMap<String, String>> mAdapterConfig;
+    private int mForegroundUserId;
+
+    private void configureEnabledProfiles() {
+        Log.e(TAG, "configureEnabledProfiles");
+        Config.setProfileEnabled(PanService.class, true);
+        Config.setProfileEnabled(BluetoothPbapService.class, true);
+        Config.setProfileEnabled(GattService.class, true);
+
+        Config.setProfileEnabled(A2dpService.class, false);
+        Config.setProfileEnabled(A2dpSinkService.class, false);
+        Config.setProfileEnabled(AvrcpTargetService.class, false);
+        Config.setProfileEnabled(AvrcpControllerService.class, false);
+        Config.setProfileEnabled(BassClientService.class, false);
+        Config.setProfileEnabled(BatteryService.class, false);
+        Config.setProfileEnabled(CsipSetCoordinatorService.class, false);
+        Config.setProfileEnabled(HapClientService.class, false);
+        Config.setProfileEnabled(HeadsetService.class, false);
+        Config.setProfileEnabled(HeadsetClientService.class, false);
+        Config.setProfileEnabled(HearingAidService.class, false);
+        Config.setProfileEnabled(HidDeviceService.class, false);
+        Config.setProfileEnabled(HidHostService.class, false);
+        Config.setProfileEnabled(LeAudioService.class, false);
+        Config.setProfileEnabled(TbsService.class, false);
+        Config.setProfileEnabled(BluetoothMapService.class, false);
+        Config.setProfileEnabled(MapClientService.class, false);
+        Config.setProfileEnabled(McpService.class, false);
+        Config.setProfileEnabled(BluetoothOppService.class, false);
+        Config.setProfileEnabled(PbapClientService.class, false);
+        Config.setProfileEnabled(SapService.class, false);
+        Config.setProfileEnabled(VolumeControlService.class, false);
+    }
+
+    @BeforeClass
+    public static void setupClass() {
+        Log.e(TAG, "setupClass");
+        // Bring native layer up and down to make sure config files are properly loaded
+        if (Looper.myLooper() == null) {
+            Looper.prepare();
+        }
+        Assert.assertNotNull(Looper.myLooper());
+        AdapterService adapterService = new AdapterService();
+        adapterService.initNative(false /* is_restricted */, false /* is_common_criteria_mode */,
+                0 /* config_compare_result */, new String[0], false, "");
+        adapterService.cleanupNative();
+        HashMap<String, HashMap<String, String>> adapterConfig = TestUtils.readAdapterConfig();
+        Assert.assertNotNull(adapterConfig);
+        Assert.assertNotNull("metrics salt is null: " + adapterConfig.toString(),
+                AdapterServiceTest.getMetricsSalt(adapterConfig));
+    }
+
+    @Before
+    public void setUp() throws PackageManager.NameNotFoundException {
+        Log.e(TAG, "setUp()");
+        MockitoAnnotations.initMocks(this);
+        if (Looper.myLooper() == null) {
+            Looper.prepare();
+        }
+        Assert.assertNotNull(Looper.myLooper());
+
+        // Dispatch all async work through instrumentation so we can wait until
+        // it's drained below
+        AsyncTask.setDefaultExecutor((r) -> {
+            androidx.test.platform.app.InstrumentationRegistry.getInstrumentation()
+                    .runOnMainSync(r);
+        });
+        androidx.test.platform.app.InstrumentationRegistry.getInstrumentation().getUiAutomation()
+                .adoptShellPermissionIdentity();
+
+        androidx.test.platform.app.InstrumentationRegistry.getInstrumentation().runOnMainSync(
+                () -> mAdapterService = new AdapterService());
+        mServiceBinder = new AdapterService.AdapterServiceBinder(mAdapterService);
+        mMockPackageManager = mock(PackageManager.class);
+        when(mMockPackageManager.getPermissionInfo(any(), anyInt()))
+                .thenReturn(new PermissionInfo());
+
+        mMockContentResolver = new MockContentResolver(InstrumentationRegistry.getTargetContext());
+        mMockContentResolver.addProvider(Settings.AUTHORITY, new MockContentProvider() {
+            @Override
+            public Bundle call(String method, String request, Bundle args) {
+                return Bundle.EMPTY;
+            }
+        });
+
+        mPowerManager = InstrumentationRegistry.getTargetContext()
+                .getSystemService(PowerManager.class);
+        mPermissionCheckerManager = InstrumentationRegistry.getTargetContext()
+                .getSystemService(PermissionCheckerManager.class);
+
+        mPermissionManager = InstrumentationRegistry.getTargetContext()
+                .getSystemService(PermissionManager.class);
+
+        mBluetoothManager = InstrumentationRegistry.getTargetContext()
+                .getSystemService(BluetoothManager.class);
+
+        when(mMockContext.getCacheDir()).thenReturn(InstrumentationRegistry.getTargetContext()
+                .getCacheDir());
+        when(mMockContext.getApplicationInfo()).thenReturn(mMockApplicationInfo);
+        when(mMockContext.getContentResolver()).thenReturn(mMockContentResolver);
+        when(mMockContext.getApplicationContext()).thenReturn(mMockContext);
+        when(mMockContext.createContextAsUser(UserHandle.SYSTEM, /* flags= */ 0)).thenReturn(
+                mMockContext);
+        when(mMockContext.getResources()).thenReturn(mMockResources);
+        when(mMockContext.getUserId()).thenReturn(Process.BLUETOOTH_UID);
+        when(mMockContext.getPackageManager()).thenReturn(mMockPackageManager);
+        when(mMockContext.getSystemService(Context.USER_SERVICE)).thenReturn(mMockUserManager);
+        when(mMockContext.getSystemServiceName(UserManager.class)).thenReturn(Context.USER_SERVICE);
+        when(mMockContext.getSystemService(Context.DEVICE_POLICY_SERVICE)).thenReturn(
+                mMockDevicePolicyManager);
+        when(mMockContext.getSystemServiceName(DevicePolicyManager.class))
+                .thenReturn(Context.DEVICE_POLICY_SERVICE);
+        when(mMockContext.getSystemService(Context.POWER_SERVICE)).thenReturn(mPowerManager);
+        when(mMockContext.getSystemServiceName(PowerManager.class))
+                .thenReturn(Context.POWER_SERVICE);
+        when(mMockContext.getSystemServiceName(PermissionCheckerManager.class))
+                .thenReturn(Context.PERMISSION_CHECKER_SERVICE);
+        when(mMockContext.getSystemService(Context.PERMISSION_CHECKER_SERVICE))
+                .thenReturn(mPermissionCheckerManager);
+        when(mMockContext.getSystemServiceName(PermissionManager.class))
+                .thenReturn(Context.PERMISSION_SERVICE);
+        when(mMockContext.getSystemService(Context.PERMISSION_SERVICE))
+                .thenReturn(mPermissionManager);
+        when(mMockContext.getSystemService(Context.ALARM_SERVICE)).thenReturn(mMockAlarmManager);
+        when(mMockContext.getSystemServiceName(AlarmManager.class))
+                .thenReturn(Context.ALARM_SERVICE);
+        when(mMockContext.getSystemService(Context.AUDIO_SERVICE)).thenReturn(mAudioManager);
+        when(mMockContext.getSystemServiceName(AudioManager.class))
+                .thenReturn(Context.AUDIO_SERVICE);
+        when(mMockContext.getSystemService(Context.BATTERY_STATS_SERVICE))
+                .thenReturn(mBatteryStatsManager);
+        when(mMockContext.getSystemServiceName(BatteryStatsManager.class))
+                .thenReturn(Context.BATTERY_STATS_SERVICE);
+        when(mMockContext.getSystemService(Context.BLUETOOTH_SERVICE))
+                .thenReturn(mBluetoothManager);
+        when(mMockContext.getSystemServiceName(BluetoothManager.class))
+                .thenReturn(Context.BLUETOOTH_SERVICE);
+        when(mMockContext.getSharedPreferences(anyString(), anyInt()))
+                .thenReturn(InstrumentationRegistry.getTargetContext()
+                        .getSharedPreferences("AdapterServiceTestPrefs", Context.MODE_PRIVATE));
+
+        when(mMockContext.getAttributionSource()).thenReturn(mAttributionSource);
+        doAnswer(invocation -> {
+            Object[] args = invocation.getArguments();
+            return InstrumentationRegistry.getTargetContext().getDatabasePath((String) args[0]);
+        }).when(mMockContext).getDatabasePath(anyString());
+
+        // Sets the foreground user id to match that of the tests (restored in tearDown)
+        mForegroundUserId = Utils.getForegroundUserId();
+        int callingUid = Binder.getCallingUid();
+        UserHandle callingUser = UserHandle.getUserHandleForUid(callingUid);
+        Utils.setForegroundUserId(callingUser.getIdentifier());
+
+        when(mMockDevicePolicyManager.isCommonCriteriaModeEnabled(any())).thenReturn(false);
+
+        when(mIBluetoothCallback.asBinder()).thenReturn(mBinder);
+
+        doReturn(Process.BLUETOOTH_UID).when(mMockPackageManager)
+                .getPackageUidAsUser(any(), anyInt(), anyInt());
+
+        when(mMockMetricsLogger.init(any())).thenReturn(true);
+        when(mMockMetricsLogger.close()).thenReturn(true);
+
+        configureEnabledProfiles();
+        Config.init(mMockContext);
+
+        mAdapterService.setMetricsLogger(mMockMetricsLogger);
+
+        // Attach a context to the service for permission checks.
+        mAdapterService.attach(mMockContext, null, null, null, mApplication, null);
+        mAdapterService.onCreate();
+
+        // Wait for any async events to drain
+        androidx.test.platform.app.InstrumentationRegistry.getInstrumentation().waitForIdleSync();
+
+        mServiceBinder.registerCallback(mIBluetoothCallback, mAttributionSource);
+
+        mAdapterConfig = TestUtils.readAdapterConfig();
+        Assert.assertNotNull(mAdapterConfig);
+    }
+
+    @After
+    public void tearDown() {
+        Log.e(TAG, "tearDown()");
+
+        // Restores the foregroundUserId to the ID prior to the test setup
+        Utils.setForegroundUserId(mForegroundUserId);
+
+        mServiceBinder.unregisterCallback(mIBluetoothCallback, mAttributionSource);
+        mAdapterService.cleanup();
+    }
+
+    @AfterClass
+    public static void tearDownOnce() {
+        AsyncTask.setDefaultExecutor(AsyncTask.SERIAL_EXECUTOR);
+    }
+
+    /**
+     * Test: Check if obfuscated Bluetooth address stays the same after re-initializing
+     *       {@link AdapterService}
+     */
+    @Test
+    public void testObfuscateBluetoothAddress_PersistentBetweenAdapterServiceInitialization() throws
+            PackageManager.NameNotFoundException {
+        byte[] metricsSalt = AdapterServiceTest.getMetricsSalt(mAdapterConfig);
+        Assert.assertNotNull(metricsSalt);
+        Assert.assertFalse(mAdapterService.getState() == BluetoothAdapter.STATE_ON);
+        BluetoothDevice device = TestUtils.getTestDevice(BluetoothAdapter.getDefaultAdapter(), 0);
+        byte[] obfuscatedAddress1 = mAdapterService.obfuscateAddress(device);
+        Assert.assertTrue(obfuscatedAddress1.length > 0);
+        Assert.assertFalse(AdapterServiceTest.isByteArrayAllZero(obfuscatedAddress1));
+        Assert.assertArrayEquals(AdapterServiceTest.obfuscateInJava(metricsSalt, device),
+                obfuscatedAddress1);
+        tearDown();
+        setUp();
+
+        byte[] metricsSalt2 = AdapterServiceTest.getMetricsSalt(mAdapterConfig);
+        Assert.assertNotNull(metricsSalt2);
+        Assert.assertArrayEquals(metricsSalt, metricsSalt2);
+
+        Assert.assertFalse(mAdapterService.getState() == BluetoothAdapter.STATE_ON);
+        byte[] obfuscatedAddress2 = mAdapterService.obfuscateAddress(device);
+        Assert.assertTrue(obfuscatedAddress2.length > 0);
+        Assert.assertFalse(AdapterServiceTest.isByteArrayAllZero(obfuscatedAddress2));
+        Assert.assertArrayEquals(obfuscatedAddress2,
+                obfuscatedAddress1);
+    }
+
+    /**
+     * Test: Check if id gotten stays the same after re-initializing
+     *       {@link AdapterService}
+     */
+    @Test
+    public void testgetMetricId_PersistentBetweenAdapterServiceInitialization() throws
+            PackageManager.NameNotFoundException {
+        Assert.assertFalse(mAdapterService.getState() == BluetoothAdapter.STATE_ON);
+        BluetoothDevice device = TestUtils.getTestDevice(BluetoothAdapter.getDefaultAdapter(), 0);
+        int id1 = mAdapterService.getMetricId(device);
+        Assert.assertTrue(id1 > 0);
+        tearDown();
+        setUp();
+        Assert.assertFalse(mAdapterService.getState() == BluetoothAdapter.STATE_ON);
+        int id2 = mAdapterService.getMetricId(device);
+        Assert.assertEquals(id2, id1);
+    }
+}
diff --git a/android/app/tests/unit/src/com/android/bluetooth/btservice/AdapterServiceTest.java b/android/app/tests/unit/src/com/android/bluetooth/btservice/AdapterServiceTest.java
index 042480d..c320b35 100644
--- a/android/app/tests/unit/src/com/android/bluetooth/btservice/AdapterServiceTest.java
+++ b/android/app/tests/unit/src/com/android/bluetooth/btservice/AdapterServiceTest.java
@@ -87,6 +87,7 @@
 import libcore.util.HexEncoding;
 
 import org.junit.After;
+import org.junit.AfterClass;
 import org.junit.Assert;
 import org.junit.Before;
 import org.junit.BeforeClass;
@@ -96,9 +97,10 @@
 import org.mockito.Mock;
 import org.mockito.MockitoAnnotations;
 
+import java.io.FileDescriptor;
+import java.io.PrintWriter;
 import java.security.InvalidKeyException;
 import java.security.NoSuchAlgorithmException;
-import java.util.Arrays;
 import java.util.HashMap;
 
 import javax.crypto.Mac;
@@ -214,6 +216,8 @@
         AsyncTask.setDefaultExecutor((r) -> {
             InstrumentationRegistry.getInstrumentation().runOnMainSync(r);
         });
+        InstrumentationRegistry.getInstrumentation().getUiAutomation()
+                .adoptShellPermissionIdentity();
 
         InstrumentationRegistry.getInstrumentation().runOnMainSync(
                 () -> mAdapterService = new AdapterService());
@@ -238,6 +242,8 @@
         mPermissionManager = InstrumentationRegistry.getTargetContext()
                 .getSystemService(PermissionManager.class);
 
+        when(mMockContext.getCacheDir()).thenReturn(InstrumentationRegistry.getTargetContext()
+                .getCacheDir());
         when(mMockContext.getApplicationInfo()).thenReturn(mMockApplicationInfo);
         when(mMockContext.getContentResolver()).thenReturn(mMockContentResolver);
         when(mMockContext.getApplicationContext()).thenReturn(mMockContext);
@@ -273,6 +279,10 @@
                 .thenReturn(mBatteryStatsManager);
         when(mMockContext.getSystemServiceName(BatteryStatsManager.class))
                 .thenReturn(Context.BATTERY_STATS_SERVICE);
+        when(mMockContext.getSharedPreferences(anyString(), anyInt()))
+                .thenReturn(InstrumentationRegistry.getTargetContext()
+                        .getSharedPreferences("AdapterServiceTestPrefs", Context.MODE_PRIVATE));
+
         when(mMockContext.getAttributionSource()).thenReturn(mAttributionSource);
         doAnswer(invocation -> {
             Object[] args = invocation.getArguments();
@@ -328,6 +338,11 @@
         mAdapterService.cleanup();
     }
 
+    @AfterClass
+    public static void tearDownOnce() {
+        AsyncTask.setDefaultExecutor(AsyncTask.SERIAL_EXECUTOR);
+    }
+
     private void verifyStateChange(int prevState, int currState, int callNumber, int timeoutMs) {
         try {
             verify(mIBluetoothCallback, timeout(timeoutMs)
@@ -431,6 +446,7 @@
      * Test: Turn Bluetooth on.
      * Check whether the AdapterService gets started.
      */
+    @Ignore("b/228874625")
     @Test
     public void testEnable() {
         Log.e("AdapterServiceTest", "testEnable() start");
@@ -754,103 +770,6 @@
                 obfuscatedAddress1);
     }
 
-    /**
-     * Test: Check if obfuscated Bluetooth address stays the same after re-initializing
-     *       {@link AdapterService}
-     */
-    @Test
-    public void testObfuscateBluetoothAddress_PersistentBetweenAdapterServiceInitialization() throws
-            PackageManager.NameNotFoundException {
-        byte[] metricsSalt = getMetricsSalt(mAdapterConfig);
-        Assert.assertNotNull(metricsSalt);
-        Assert.assertFalse(mAdapterService.getState() == BluetoothAdapter.STATE_ON);
-        BluetoothDevice device = TestUtils.getTestDevice(BluetoothAdapter.getDefaultAdapter(), 0);
-        byte[] obfuscatedAddress1 = mAdapterService.obfuscateAddress(device);
-        Assert.assertTrue(obfuscatedAddress1.length > 0);
-        Assert.assertFalse(isByteArrayAllZero(obfuscatedAddress1));
-        Assert.assertArrayEquals(obfuscateInJava(metricsSalt, device),
-                obfuscatedAddress1);
-        tearDown();
-        setUp();
-        Assert.assertFalse(mAdapterService.getState() == BluetoothAdapter.STATE_ON);
-        byte[] obfuscatedAddress2 = mAdapterService.obfuscateAddress(device);
-        Assert.assertTrue(obfuscatedAddress2.length > 0);
-        Assert.assertFalse(isByteArrayAllZero(obfuscatedAddress2));
-        Assert.assertArrayEquals(obfuscatedAddress2,
-                obfuscatedAddress1);
-    }
-
-    /**
-     * Test: Verify that obfuscated Bluetooth address changes after factory reset
-     *
-     * There are 4 types of factory reset that we are talking about:
-     * 1. Factory reset all user data from Settings -> Will restart phone
-     * 2. Factory reset WiFi and Bluetooth from Settings -> Will only restart WiFi and BT
-     * 3. Call BluetoothAdapter.factoryReset() -> Will disable Bluetooth and reset config in
-     * memory and disk
-     * 4. Call AdapterService.factoryReset() -> Will only reset config in memory
-     *
-     * We can only use No. 4 here
-     */
-    @Ignore("AdapterService.factoryReset() does not reload config into memory and hence old salt"
-            + " is still used until next time Bluetooth library is initialized. However Bluetooth"
-            + " cannot be used until Bluetooth process restart any way. Thus it is almost"
-            + " guaranteed that user has to re-enable Bluetooth and hence re-generate new salt"
-            + " after factory reset")
-    @Test
-    public void testObfuscateBluetoothAddress_FactoryReset() {
-        Assert.assertFalse(mAdapterService.getState() == BluetoothAdapter.STATE_ON);
-        BluetoothDevice device = TestUtils.getTestDevice(BluetoothAdapter.getDefaultAdapter(), 0);
-        byte[] obfuscatedAddress1 = mAdapterService.obfuscateAddress(device);
-        Assert.assertTrue(obfuscatedAddress1.length > 0);
-        Assert.assertFalse(isByteArrayAllZero(obfuscatedAddress1));
-        mServiceBinder.factoryReset(mAttributionSource);
-        byte[] obfuscatedAddress2 = mAdapterService.obfuscateAddress(device);
-        Assert.assertTrue(obfuscatedAddress2.length > 0);
-        Assert.assertFalse(isByteArrayAllZero(obfuscatedAddress2));
-        Assert.assertFalse(Arrays.equals(obfuscatedAddress2,
-                obfuscatedAddress1));
-        doEnable(0, false);
-        byte[] obfuscatedAddress3 = mAdapterService.obfuscateAddress(device);
-        Assert.assertTrue(obfuscatedAddress3.length > 0);
-        Assert.assertFalse(isByteArrayAllZero(obfuscatedAddress3));
-        Assert.assertArrayEquals(obfuscatedAddress3,
-                obfuscatedAddress2);
-        mServiceBinder.factoryReset(mAttributionSource);
-        byte[] obfuscatedAddress4 = mAdapterService.obfuscateAddress(device);
-        Assert.assertTrue(obfuscatedAddress4.length > 0);
-        Assert.assertFalse(isByteArrayAllZero(obfuscatedAddress4));
-        Assert.assertFalse(Arrays.equals(obfuscatedAddress4,
-                obfuscatedAddress3));
-    }
-
-    /**
-     * Test: Verify that obfuscated Bluetooth address changes after factory reset and reloading
-     *       native layer
-     */
-    @Test
-    public void testObfuscateBluetoothAddress_FactoryResetAndReloadNativeLayer() throws
-            PackageManager.NameNotFoundException {
-        byte[] metricsSalt1 = getMetricsSalt(mAdapterConfig);
-        Assert.assertNotNull(metricsSalt1);
-        Assert.assertFalse(mAdapterService.getState() == BluetoothAdapter.STATE_ON);
-        BluetoothDevice device = TestUtils.getTestDevice(BluetoothAdapter.getDefaultAdapter(), 0);
-        byte[] obfuscatedAddress1 = mAdapterService.obfuscateAddress(device);
-        Assert.assertTrue(obfuscatedAddress1.length > 0);
-        Assert.assertFalse(isByteArrayAllZero(obfuscatedAddress1));
-        Assert.assertArrayEquals(obfuscateInJava(metricsSalt1, device),
-                obfuscatedAddress1);
-        mServiceBinder.factoryReset(mAttributionSource);
-        tearDown();
-        setUp();
-        // Cannot verify metrics salt since it is not written to disk until native cleanup
-        byte[] obfuscatedAddress2 = mAdapterService.obfuscateAddress(device);
-        Assert.assertTrue(obfuscatedAddress2.length > 0);
-        Assert.assertFalse(isByteArrayAllZero(obfuscatedAddress2));
-        Assert.assertFalse(Arrays.equals(obfuscatedAddress2,
-                obfuscatedAddress1));
-    }
-
     @Test
     public void testAddressConsolidation() {
         // Create device properties
@@ -868,7 +787,7 @@
         Assert.assertEquals(identityAddress, TEST_BT_ADDR_2);
     }
 
-    private static byte[] getMetricsSalt(HashMap<String, HashMap<String, String>> adapterConfig) {
+    public static byte[] getMetricsSalt(HashMap<String, HashMap<String, String>> adapterConfig) {
         HashMap<String, String> metricsSection = adapterConfig.get("Metrics");
         if (metricsSection == null) {
             Log.e(TAG, "Metrics section is null: " + adapterConfig.toString());
@@ -887,7 +806,7 @@
         return metricsSalt;
     }
 
-    private static byte[] obfuscateInJava(byte[] key, BluetoothDevice device) {
+    public static byte[] obfuscateInJava(byte[] key, BluetoothDevice device) {
         String algorithm = "HmacSHA256";
         try {
             Mac hmac256 = Mac.getInstance(algorithm);
@@ -899,7 +818,7 @@
         }
     }
 
-    private static boolean isByteArrayAllZero(byte[] byteArray) {
+    public static boolean isByteArrayAllZero(byte[] byteArray) {
         for (byte i : byteArray) {
             if (i != 0) {
                 return false;
@@ -967,21 +886,14 @@
         Assert.assertEquals(id3, id1);
     }
 
-    /**
-     * Test: Check if id gotten stays the same after re-initializing
-     *       {@link AdapterService}
-     */
     @Test
-    public void testgetMetricId_PersistentBetweenAdapterServiceInitialization() throws
-            PackageManager.NameNotFoundException {
-        Assert.assertFalse(mAdapterService.getState() == BluetoothAdapter.STATE_ON);
-        BluetoothDevice device = TestUtils.getTestDevice(BluetoothAdapter.getDefaultAdapter(), 0);
-        int id1 = mAdapterService.getMetricId(device);
-        Assert.assertTrue(id1 > 0);
-        tearDown();
-        setUp();
-        Assert.assertFalse(mAdapterService.getState() == BluetoothAdapter.STATE_ON);
-        int id2 = mAdapterService.getMetricId(device);
-        Assert.assertEquals(id2, id1);
+    public void testDump_doesNotCrash() {
+        FileDescriptor fd = new FileDescriptor();
+        PrintWriter writer = mock(PrintWriter.class);
+
+        mAdapterService.dump(fd, writer, new String[]{});
+        mAdapterService.dump(fd, writer, new String[]{"set-test-mode", "enabled"});
+        mAdapterService.dump(fd, writer, new String[]{"--proto-bin"});
+        mAdapterService.dump(fd, writer, new String[]{"random", "arguments"});
     }
 }
diff --git a/android/app/tests/unit/src/com/android/bluetooth/btservice/CompanionManagerTest.java b/android/app/tests/unit/src/com/android/bluetooth/btservice/CompanionManagerTest.java
new file mode 100644
index 0000000..41746f0
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/btservice/CompanionManagerTest.java
@@ -0,0 +1,169 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package com.android.bluetooth.btservice;
+
+import static org.mockito.Mockito.*;
+
+import android.bluetooth.BluetoothDevice;
+import android.bluetooth.BluetoothGatt;
+import android.content.Context;
+import android.content.SharedPreferences;
+import android.os.HandlerThread;
+
+import androidx.test.InstrumentationRegistry;
+import androidx.test.filters.MediumTest;
+import androidx.test.runner.AndroidJUnit4;
+
+import com.android.bluetooth.TestUtils;
+
+import org.junit.After;
+import org.junit.Assert;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.Mock;
+import org.mockito.MockitoAnnotations;
+
+@MediumTest
+@RunWith(AndroidJUnit4.class)
+public class CompanionManagerTest {
+
+    private static final String TEST_DEVICE = "11:22:33:44:55:66";
+
+    private AdapterProperties mAdapterProperties;
+    private Context mTargetContext;
+    private CompanionManager mCompanionManager;
+
+    private HandlerThread mHandlerThread;
+
+    @Mock
+    private AdapterService mAdapterService;
+    @Mock
+    SharedPreferences mSharedPreferences;
+    @Mock
+    SharedPreferences.Editor mEditor;
+
+    @Before
+    public void setUp() throws Exception {
+        MockitoAnnotations.initMocks(this);
+        mTargetContext = InstrumentationRegistry.getTargetContext();
+        // Prepare the TestUtils
+        TestUtils.setAdapterService(mAdapterService);
+        // Start handler thread for this test
+        mHandlerThread = new HandlerThread("CompanionManagerTestHandlerThread");
+        mHandlerThread.start();
+        // Mock the looper
+        doReturn(mHandlerThread.getLooper()).when(mAdapterService).getMainLooper();
+        // Mock SharedPreferences
+        when(mSharedPreferences.edit()).thenReturn(mEditor);
+        doReturn(mSharedPreferences).when(mAdapterService).getSharedPreferences(eq(
+                CompanionManager.COMPANION_INFO), eq(Context.MODE_PRIVATE));
+        // Tell the AdapterService that it is a mock (see isMock documentation)
+        doReturn(true).when(mAdapterService).isMock();
+        // Use the resources in the instrumentation instead of the mocked AdapterService
+        when(mAdapterService.getResources()).thenReturn(mTargetContext.getResources());
+
+        // Must be called to initialize services
+        mCompanionManager = new CompanionManager(mAdapterService, null);
+    }
+
+    @After
+    public void tearDown() throws Exception {
+        mHandlerThread.quit();
+        TestUtils.clearAdapterService(mAdapterService);
+    }
+
+    @Test
+    public void testLoadCompanionInfo_hasCompanionDeviceKey() {
+        loadCompanionInfoHelper(TEST_DEVICE, CompanionManager.COMPANION_TYPE_PRIMARY);
+    }
+
+    @Test
+    public void testLoadCompanionInfo_noCompanionDeviceSetButHaveBondedDevices_shouldNotCrash() {
+        BluetoothDevice[] devices = new BluetoothDevice[2];
+        doReturn(devices).when(mAdapterService).getBondedDevices();
+        doThrow(new IllegalArgumentException())
+                .when(mSharedPreferences)
+                .getInt(eq(CompanionManager.COMPANION_TYPE_KEY), anyInt());
+        mCompanionManager.loadCompanionInfo();
+    }
+
+    @Test
+    public void testIsCompanionDevice() {
+        loadCompanionInfoHelper(TEST_DEVICE, CompanionManager.COMPANION_TYPE_NONE);
+        Assert.assertTrue(mCompanionManager.isCompanionDevice(TEST_DEVICE));
+
+        loadCompanionInfoHelper(TEST_DEVICE, CompanionManager.COMPANION_TYPE_PRIMARY);
+        Assert.assertTrue(mCompanionManager.isCompanionDevice(TEST_DEVICE));
+
+        loadCompanionInfoHelper(TEST_DEVICE, CompanionManager.COMPANION_TYPE_SECONDARY);
+        Assert.assertTrue(mCompanionManager.isCompanionDevice(TEST_DEVICE));
+    }
+
+    @Test
+    public void testGetGattConnParameterPrimary() {
+        loadCompanionInfoHelper(TEST_DEVICE, CompanionManager.COMPANION_TYPE_PRIMARY);
+        checkReasonableConnParameterHelper(BluetoothGatt.CONNECTION_PRIORITY_HIGH);
+        checkReasonableConnParameterHelper(BluetoothGatt.CONNECTION_PRIORITY_BALANCED);
+        checkReasonableConnParameterHelper(BluetoothGatt.CONNECTION_PRIORITY_LOW_POWER);
+
+        loadCompanionInfoHelper(TEST_DEVICE, CompanionManager.COMPANION_TYPE_SECONDARY);
+        checkReasonableConnParameterHelper(BluetoothGatt.CONNECTION_PRIORITY_HIGH);
+        checkReasonableConnParameterHelper(BluetoothGatt.CONNECTION_PRIORITY_BALANCED);
+        checkReasonableConnParameterHelper(BluetoothGatt.CONNECTION_PRIORITY_LOW_POWER);
+
+        loadCompanionInfoHelper(TEST_DEVICE, CompanionManager.COMPANION_TYPE_NONE);
+        checkReasonableConnParameterHelper(BluetoothGatt.CONNECTION_PRIORITY_HIGH);
+        checkReasonableConnParameterHelper(BluetoothGatt.CONNECTION_PRIORITY_BALANCED);
+        checkReasonableConnParameterHelper(BluetoothGatt.CONNECTION_PRIORITY_LOW_POWER);
+    }
+
+    private void loadCompanionInfoHelper(String address, int companionType) {
+        doReturn(address)
+                .when(mSharedPreferences)
+                .getString(eq(CompanionManager.COMPANION_DEVICE_KEY), anyString());
+        doReturn(companionType)
+                .when(mSharedPreferences)
+                .getInt(eq(CompanionManager.COMPANION_TYPE_KEY), anyInt());
+        mCompanionManager.loadCompanionInfo();
+    }
+
+    private void checkReasonableConnParameterHelper(int priority) {
+        // Max/Min values from the Bluetooth spec Version 5.3 | Vol 4, Part E | 7.8.18
+        final int minInterval = 6;    // 0x0006
+        final int maxInterval = 3200; // 0x0C80
+        final int minLatency = 0;     // 0x0000
+        final int maxLatency = 499;   // 0x01F3
+
+        int min = mCompanionManager.getGattConnParameters(
+                TEST_DEVICE, CompanionManager.GATT_CONN_INTERVAL_MIN,
+                priority);
+        int max = mCompanionManager.getGattConnParameters(
+                TEST_DEVICE, CompanionManager.GATT_CONN_INTERVAL_MAX,
+                priority);
+        int latency = mCompanionManager.getGattConnParameters(
+                TEST_DEVICE, CompanionManager.GATT_CONN_LATENCY,
+                priority);
+
+        Assert.assertTrue(max >= min);
+        Assert.assertTrue(max >= minInterval);
+        Assert.assertTrue(min >= minInterval);
+        Assert.assertTrue(max <= maxInterval);
+        Assert.assertTrue(min <= maxInterval);
+        Assert.assertTrue(latency >= minLatency);
+        Assert.assertTrue(latency <= maxLatency);
+    }
+}
diff --git a/android/app/tests/unit/src/com/android/bluetooth/btservice/DataMigrationTest.java b/android/app/tests/unit/src/com/android/bluetooth/btservice/DataMigrationTest.java
new file mode 100644
index 0000000..ea39f28
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/btservice/DataMigrationTest.java
@@ -0,0 +1,523 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.btservice;
+
+import static android.bluetooth.BluetoothA2dp.OPTIONAL_CODECS_NOT_SUPPORTED;
+import static android.bluetooth.BluetoothA2dp.OPTIONAL_CODECS_PREF_DISABLED;
+import static android.bluetooth.BluetoothProfile.CONNECTION_POLICY_FORBIDDEN;
+
+import static com.google.common.truth.Truth.assertThat;
+import static com.google.common.truth.Truth.assertWithMessage;
+
+import static org.mockito.Mockito.anyInt;
+import static org.mockito.Mockito.anyString;
+import static org.mockito.Mockito.when;
+
+import android.bluetooth.BluetoothDevice;
+import android.bluetooth.BluetoothProfile;
+import android.content.Context;
+import android.content.SharedPreferences;
+import android.database.Cursor;
+import android.net.Uri;
+import android.os.Bundle;
+import android.test.mock.MockContentProvider;
+import android.test.mock.MockContentResolver;
+import android.test.mock.MockCursor;
+import android.util.Log;
+import android.util.Pair;
+
+import androidx.test.InstrumentationRegistry;
+import androidx.test.filters.SmallTest;
+import androidx.test.runner.AndroidJUnit4;
+
+import com.android.bluetooth.btservice.storage.Metadata;
+import com.android.bluetooth.btservice.storage.MetadataDatabase;
+import com.android.bluetooth.opp.BluetoothShare;
+
+import org.junit.After;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.Mock;
+import org.mockito.MockitoAnnotations;
+
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.List;
+
+@SmallTest
+@RunWith(AndroidJUnit4.class)
+public class DataMigrationTest {
+    private static final String TAG = "DataMigrationTest";
+
+    private static final String AUTHORITY = "bluetooth_legacy.provider";
+
+    private static final String TEST_PREF = "DatabaseTestPref";
+
+    private MockContentResolver mMockContentResolver;
+
+    private Context mTargetContext;
+    private SharedPreferences mPrefs;
+
+    @Mock private Context mMockContext;
+
+    @Before
+    public void setUp() throws Exception {
+        MockitoAnnotations.initMocks(this);
+
+        mTargetContext = InstrumentationRegistry.getTargetContext();
+        mTargetContext.deleteSharedPreferences(TEST_PREF);
+        mPrefs = mTargetContext.getSharedPreferences(TEST_PREF, Context.MODE_PRIVATE);
+        mPrefs.edit().clear().apply();
+
+        mMockContentResolver = new MockContentResolver(mTargetContext);
+        when(mMockContext.getContentResolver()).thenReturn(mMockContentResolver);
+        when(mMockContext.getCacheDir()).thenReturn(mTargetContext.getCacheDir());
+
+        when(mMockContext.getSharedPreferences(anyString(), anyInt())).thenReturn(mPrefs);
+
+    }
+
+    @After
+    public void tearDown() throws Exception {
+        mPrefs.edit().clear().apply();
+        mTargetContext.deleteSharedPreferences(TEST_PREF);
+        mTargetContext.deleteDatabase("TestBluetoothDb");
+        mTargetContext.deleteDatabase("TestOppDb");
+    }
+
+    private void assertRunStatus(int status) {
+        assertThat(DataMigration.run(mMockContext)).isEqualTo(status);
+        assertThat(DataMigration.migrationStatus(mMockContext)).isEqualTo(status);
+    }
+
+    /**
+     * Test: execute Empty migration
+     */
+    @Test
+    public void testEmptyMigration() {
+        BluetoothLegacyContentProvider fakeContentProvider =
+                new BluetoothLegacyContentProvider(mMockContext);
+        mMockContentResolver.addProvider(AUTHORITY, fakeContentProvider);
+
+        final int nCallCount = DataMigration.sharedPreferencesKeys.length
+                + 1; // +1 for default preferences
+        final int nBundleCount = 2; // `bluetooth_db` && `btopp.db`
+
+        assertRunStatus(DataMigration.MIGRATION_STATUS_COMPLETED);
+        assertThat(fakeContentProvider.mCallCount).isEqualTo(nCallCount);
+        assertThat(fakeContentProvider.mBundleCount).isEqualTo(nBundleCount);
+
+        // run it twice to trigger an already completed migration
+        assertRunStatus(DataMigration.MIGRATION_STATUS_COMPLETED);
+        // ContentProvider should not have any more calls made than previously
+        assertThat(fakeContentProvider.mCallCount).isEqualTo(nCallCount);
+        assertThat(fakeContentProvider.mBundleCount).isEqualTo(nBundleCount);
+    }
+
+    private static class BluetoothLegacyContentProvider extends MockContentProvider {
+        BluetoothLegacyContentProvider(Context ctx) {
+            super(ctx);
+        }
+        int mCallCount = 0;
+        int mBundleCount = 0;
+        @Override
+        public Cursor query(Uri uri, String[] projection, String selection, String[] selectionArgs,
+                String sortOrder) {
+            mBundleCount++;
+            return null;
+        }
+        @Override
+        public Bundle call(String method, String arg, Bundle extras) {
+            mCallCount++;
+            return null;
+        }
+    }
+
+    /**
+     * Test: execute migration without having a content provided registered
+     */
+    @Test
+    public void testMissingProvider() {
+        assertThat(DataMigration.isMigrationApkInstalled(mMockContext)).isFalse();
+
+        assertRunStatus(DataMigration.MIGRATION_STATUS_MISSING_APK);
+
+        mMockContentResolver.addProvider(AUTHORITY, new MockContentProvider(mMockContext));
+        assertThat(DataMigration.isMigrationApkInstalled(mMockContext)).isTrue();
+    }
+
+    /**
+     * Test: execute migration after too many attempt
+     */
+    @Test
+    public void testTooManyAttempt() {
+        assertThat(mPrefs.getInt(DataMigration.MIGRATION_ATTEMPT_PROPERTY, -1))
+            .isEqualTo(-1);
+
+        for (int i = 0; i < DataMigration.MAX_ATTEMPT; i++) {
+            assertThat(DataMigration.incrementeMigrationAttempt(mMockContext))
+                .isTrue();
+            assertThat(mPrefs.getInt(DataMigration.MIGRATION_ATTEMPT_PROPERTY, -1))
+                .isEqualTo(i + 1);
+        }
+        assertThat(DataMigration.incrementeMigrationAttempt(mMockContext))
+            .isFalse();
+        assertThat(mPrefs.getInt(DataMigration.MIGRATION_ATTEMPT_PROPERTY, -1))
+            .isEqualTo(DataMigration.MAX_ATTEMPT + 1);
+
+        mMockContentResolver.addProvider(AUTHORITY, new MockContentProvider(mMockContext));
+        assertRunStatus(DataMigration.MIGRATION_STATUS_MAX_ATTEMPT);
+    }
+
+    /**
+     * Test: execute migration of SharedPreferences
+     */
+    @Test
+    public void testSharedPreferencesMigration() {
+        BluetoothLegacySharedPreferencesContentProvider fakeContentProvider =
+                new BluetoothLegacySharedPreferencesContentProvider(mMockContext);
+        mMockContentResolver.addProvider(AUTHORITY, fakeContentProvider);
+
+        assertThat(DataMigration.sharedPreferencesMigration("Boolean", mMockContext)).isTrue();
+        assertThat(mPrefs.getBoolean("keyBoolean", false)).isTrue();
+        assertThat(fakeContentProvider.mCallCount).isEqualTo(2);
+
+        assertThat(DataMigration.sharedPreferencesMigration("Long", mMockContext)).isTrue();
+        assertThat(mPrefs.getLong("keyLong", -1)).isEqualTo(42);
+        assertThat(fakeContentProvider.mCallCount).isEqualTo(4);
+
+        assertThat(DataMigration.sharedPreferencesMigration("Int", mMockContext)).isTrue();
+        assertThat(mPrefs.getInt("keyInt", -1)).isEqualTo(42);
+        assertThat(fakeContentProvider.mCallCount).isEqualTo(6);
+
+        assertThat(DataMigration.sharedPreferencesMigration("String", mMockContext)).isTrue();
+        assertThat(mPrefs.getString("keyString", "Not42")).isEqualTo("42");
+        assertThat(fakeContentProvider.mCallCount).isEqualTo(8);
+
+        // Check not overriding an existing value:
+        mPrefs.edit().putString("keyString2", "already 42").apply();
+        assertThat(DataMigration.sharedPreferencesMigration("String2", mMockContext)).isTrue();
+        assertThat(mPrefs.getString("keyString2", "Not42")).isEqualTo("already 42");
+        assertThat(fakeContentProvider.mCallCount).isEqualTo(10);
+
+        assertThat(DataMigration.sharedPreferencesMigration("Invalid", mMockContext)).isFalse();
+
+        assertThat(DataMigration.sharedPreferencesMigration("null", mMockContext)).isFalse();
+
+        assertThat(DataMigration.sharedPreferencesMigration("empty", mMockContext)).isFalse();
+
+        assertThat(DataMigration
+                .sharedPreferencesMigration("anything else", mMockContext)).isTrue();
+    }
+
+    private static class BluetoothLegacySharedPreferencesContentProvider
+            extends MockContentProvider {
+        BluetoothLegacySharedPreferencesContentProvider(Context ctx) {
+            super(ctx);
+        }
+        String mLastMethod = null;
+        int mCallCount = 0;
+        int mBundleCount = 0;
+        @Override
+        public Cursor query(Uri uri, String[] projection, String selection, String[] selectionArgs,
+                String sortOrder) {
+            mBundleCount++;
+            return null;
+        }
+        @Override
+        public Bundle call(String method, String arg, Bundle extras) {
+            mCallCount++;
+            mLastMethod = method;
+            assertThat(method).isNotNull();
+            assertThat(arg).isNotNull();
+            assertThat(extras).isNull();
+            final String key = "key" + arg;
+            Bundle b = new Bundle();
+            b.putStringArrayList(DataMigration.KEY_LIST, new ArrayList<String>(Arrays.asList(key)));
+            switch(arg) {
+                case "Boolean":
+                    b.putBoolean(key, true);
+                    break;
+                case "Long":
+                    b.putLong(key, Long.valueOf(42));
+                    break;
+                case "Int":
+                    b.putInt(key, 42);
+                    break;
+                case "String":
+                    b.putString(key, "42");
+                    break;
+                case "String2":
+                    b.putString(key, "42");
+                    break;
+                case "null":
+                    b.putObject(key, null);
+                    break;
+                case "Invalid":
+                     // Put anything different from Boolean/Long/Integer/String
+                    b.putFloat(key, 42f);
+                    break;
+                case "empty":
+                    // Do not put anything in the bundle and remove the key
+                    b = new Bundle();
+                    break;
+                default:
+                    return null;
+            }
+            return b;
+        }
+    }
+
+    /**
+     * Test: execute migration of BLUETOOTH_DATABASE and OPP_DATABASE without correct data
+     */
+    @Test
+    public void testIncompleteDbMigration() {
+        when(mMockContext.getDatabasePath("btopp.db"))
+            .thenReturn(mTargetContext.getDatabasePath("TestOppDb"));
+        when(mMockContext.getDatabasePath("bluetooth_db"))
+            .thenReturn(mTargetContext.getDatabasePath("TestBluetoothDb"));
+
+        BluetoothLegacyDbContentProvider fakeContentProvider =
+                new BluetoothLegacyDbContentProvider(mMockContext);
+        mMockContentResolver.addProvider(AUTHORITY, fakeContentProvider);
+
+        fakeContentProvider.mCursor = new FakeCursor(FAKE_SAMPLE);
+        assertThat(DataMigration.bluetoothDatabaseMigration(mMockContext)).isFalse();
+
+        fakeContentProvider.mCursor = new FakeCursor(FAKE_SAMPLE);
+        assertThat(DataMigration.oppDatabaseMigration(mMockContext)).isFalse();
+    }
+
+    private static final List<Pair<String, Object>> FAKE_SAMPLE =
+            Arrays.asList(
+                    new Pair("wrong_key", "wrong_content")
+    );
+
+    /**
+     * Test: execute migration of BLUETOOTH_DATABASE
+     */
+    @Test
+    public void testBluetoothDbMigration() {
+        when(mMockContext.getDatabasePath("bluetooth_db"))
+            .thenReturn(mTargetContext.getDatabasePath("TestBluetoothDb"));
+
+        BluetoothLegacyDbContentProvider fakeContentProvider =
+                new BluetoothLegacyDbContentProvider(mMockContext);
+        mMockContentResolver.addProvider(AUTHORITY, fakeContentProvider);
+
+        Cursor c = new FakeCursor(BLUETOOTH_DATABASE_SAMPLE);
+        fakeContentProvider.mCursor = c;
+        assertThat(DataMigration.bluetoothDatabaseMigration(mMockContext)).isTrue();
+
+        MetadataDatabase database = MetadataDatabase.createDatabaseWithoutMigration(mMockContext);
+        Metadata metadata = database.load().get(0);
+
+        Log.d(TAG, "Metadata migrated: " + metadata);
+
+        assertWithMessage("Address mismatch")
+            .that(metadata.getAddress()).isEqualTo("my_address");
+        assertWithMessage("Connection policy mismatch")
+            .that(metadata.getProfileConnectionPolicy(BluetoothProfile.A2DP))
+            .isEqualTo(CONNECTION_POLICY_FORBIDDEN);
+        assertWithMessage("Custom metadata mismatch")
+            .that(metadata.getCustomizedMeta(BluetoothDevice.METADATA_UNTETHERED_LEFT_CHARGING))
+            .isEqualTo(CUSTOM_META);
+    }
+
+    private static final byte[] CUSTOM_META =  new byte[]{ 42, 43, 44};
+
+    private static final List<Pair<String, Object>> BLUETOOTH_DATABASE_SAMPLE =
+            Arrays.asList(
+                    new Pair("address", "my_address"),
+                    new Pair("migrated", 1),
+                    new Pair("a2dpSupportsOptionalCodecs", OPTIONAL_CODECS_NOT_SUPPORTED),
+                    new Pair("a2dpOptionalCodecsEnabled", OPTIONAL_CODECS_PREF_DISABLED),
+                    new Pair("last_active_time", 42),
+                    new Pair("is_active_a2dp_device", 1),
+
+                    // connection_policy
+                    new Pair("a2dp_connection_policy", CONNECTION_POLICY_FORBIDDEN),
+                    new Pair("a2dp_sink_connection_policy", CONNECTION_POLICY_FORBIDDEN),
+                    new Pair("hfp_connection_policy", CONNECTION_POLICY_FORBIDDEN),
+                    new Pair("hfp_client_connection_policy", CONNECTION_POLICY_FORBIDDEN),
+                    new Pair("hid_host_connection_policy", CONNECTION_POLICY_FORBIDDEN),
+                    new Pair("pan_connection_policy", CONNECTION_POLICY_FORBIDDEN),
+                    new Pair("pbap_connection_policy", CONNECTION_POLICY_FORBIDDEN),
+                    new Pair("pbap_client_connection_policy", CONNECTION_POLICY_FORBIDDEN),
+                    new Pair("map_connection_policy", CONNECTION_POLICY_FORBIDDEN),
+                    new Pair("sap_connection_policy", CONNECTION_POLICY_FORBIDDEN),
+                    new Pair("hearing_aid_connection_policy", CONNECTION_POLICY_FORBIDDEN),
+                    new Pair("hap_client_connection_policy", CONNECTION_POLICY_FORBIDDEN),
+                    new Pair("map_client_connection_policy", CONNECTION_POLICY_FORBIDDEN),
+                    new Pair("le_audio_connection_policy", CONNECTION_POLICY_FORBIDDEN),
+                    new Pair("volume_control_connection_policy", CONNECTION_POLICY_FORBIDDEN),
+                    new Pair("csip_set_coordinator_connection_policy", CONNECTION_POLICY_FORBIDDEN),
+                    new Pair("le_call_control_connection_policy", CONNECTION_POLICY_FORBIDDEN),
+                    new Pair("bass_client_connection_policy", CONNECTION_POLICY_FORBIDDEN),
+                    new Pair("battery_connection_policy", CONNECTION_POLICY_FORBIDDEN),
+
+                    // Custom meta-data
+                    new Pair("manufacturer_name", CUSTOM_META),
+                    new Pair("model_name", CUSTOM_META),
+                    new Pair("software_version", CUSTOM_META),
+                    new Pair("hardware_version", CUSTOM_META),
+                    new Pair("companion_app", CUSTOM_META),
+                    new Pair("main_icon", CUSTOM_META),
+                    new Pair("is_untethered_headset", CUSTOM_META),
+                    new Pair("untethered_left_icon", CUSTOM_META),
+                    new Pair("untethered_right_icon", CUSTOM_META),
+                    new Pair("untethered_case_icon", CUSTOM_META),
+                    new Pair("untethered_left_battery", CUSTOM_META),
+                    new Pair("untethered_right_battery", CUSTOM_META),
+                    new Pair("untethered_case_battery", CUSTOM_META),
+                    new Pair("untethered_left_charging", CUSTOM_META),
+                    new Pair("untethered_right_charging", CUSTOM_META),
+                    new Pair("untethered_case_charging", CUSTOM_META),
+                    new Pair("enhanced_settings_ui_uri", CUSTOM_META),
+                    new Pair("device_type", CUSTOM_META),
+                    new Pair("main_battery", CUSTOM_META),
+                    new Pair("main_charging", CUSTOM_META),
+                    new Pair("main_low_battery_threshold", CUSTOM_META),
+                    new Pair("untethered_left_low_battery_threshold", CUSTOM_META),
+                    new Pair("untethered_right_low_battery_threshold", CUSTOM_META),
+                    new Pair("untethered_case_low_battery_threshold", CUSTOM_META),
+                    new Pair("spatial_audio", CUSTOM_META),
+                    new Pair("fastpair_customized", CUSTOM_META)
+    );
+
+    /**
+     * Test: execute migration of OPP_DATABASE
+     */
+    @Test
+    public void testOppDbMigration() {
+        when(mMockContext.getDatabasePath("btopp.db"))
+            .thenReturn(mTargetContext.getDatabasePath("TestOppDb"));
+
+        BluetoothLegacyDbContentProvider fakeContentProvider =
+                new BluetoothLegacyDbContentProvider(mMockContext);
+        mMockContentResolver.addProvider(AUTHORITY, fakeContentProvider);
+
+        Cursor c = new FakeCursor(OPP_DATABASE_SAMPLE);
+        fakeContentProvider.mCursor = c;
+        assertThat(DataMigration.oppDatabaseMigration(mMockContext)).isTrue();
+    }
+
+    private static final List<Pair<String, Object>> OPP_DATABASE_SAMPLE =
+            Arrays.asList(
+                    // String
+                    new Pair(BluetoothShare.URI, "content"),
+                    new Pair(BluetoothShare.FILENAME_HINT, "content"),
+                    new Pair(BluetoothShare.MIMETYPE, "content"),
+                    new Pair(BluetoothShare.DESTINATION, "content"),
+
+                    // Int
+                    new Pair(BluetoothShare.VISIBILITY, 42),
+                    new Pair(BluetoothShare.USER_CONFIRMATION, 42),
+                    new Pair(BluetoothShare.DIRECTION, 42),
+                    new Pair(BluetoothShare.STATUS, 42),
+                    new Pair("scanned" /* Constants.MEDIA_SCANNED */, 42),
+
+                    // Long
+                    new Pair(BluetoothShare.TOTAL_BYTES, 42L),
+                    new Pair(BluetoothShare.TIMESTAMP, 42L)
+    );
+
+    private static class BluetoothLegacyDbContentProvider extends MockContentProvider {
+        BluetoothLegacyDbContentProvider(Context ctx) {
+            super(ctx);
+        }
+        String mLastMethod = null;
+        Cursor mCursor = null;
+        int mCallCount = 0;
+        int mBundleCount = 0;
+        @Override
+        public Cursor query(Uri uri, String[] projection, String selection, String[] selectionArgs,
+                String sortOrder) {
+            mBundleCount++;
+            return mCursor;
+        }
+        @Override
+        public Bundle call(String method, String arg, Bundle extras) {
+            mCallCount++;
+            return null;
+        }
+    }
+
+    private static class FakeCursor extends MockCursor {
+        int mNumItem = 1;
+        List<Pair<String, Object>> mRows;
+
+        FakeCursor(List<Pair<String, Object>> rows) {
+            mRows = rows;
+        }
+
+        @Override
+        public String getString(int columnIndex) {
+            return (String) (mRows.get(columnIndex).second);
+        }
+
+        @Override
+        public byte[] getBlob(int columnIndex) {
+            return (byte[]) (mRows.get(columnIndex).second);
+        }
+
+        @Override
+        public int getInt(int columnIndex) {
+            return (int) (mRows.get(columnIndex).second);
+        }
+
+        @Override
+        public long getLong(int columnIndex) {
+            return (long) (mRows.get(columnIndex).second);
+        }
+
+        @Override
+        public boolean moveToNext() {
+            return mNumItem-- > 0;
+        }
+
+        @Override
+        public int getCount() {
+            return 1;
+        }
+
+        @Override
+        public int getColumnIndexOrThrow(String columnName) {
+            for (int i = 0; i < mRows.size(); i++) {
+                if (columnName.equals(mRows.get(i).first)) {
+                    return i;
+                }
+            }
+            throw new IllegalArgumentException("No such column: " + columnName);
+        }
+
+        @Override
+        public int getColumnIndex(String columnName) {
+            for (int i = 0; i < mRows.size(); i++) {
+                if (columnName.equals(mRows.get(i).first)) {
+                    return i;
+                }
+            }
+            return -1;
+        }
+
+        @Override
+        public void close() {}
+    }
+}
diff --git a/android/app/tests/unit/src/com/android/bluetooth/btservice/MetricsLoggerTest.java b/android/app/tests/unit/src/com/android/bluetooth/btservice/MetricsLoggerTest.java
index 9566ef9..f665967 100644
--- a/android/app/tests/unit/src/com/android/bluetooth/btservice/MetricsLoggerTest.java
+++ b/android/app/tests/unit/src/com/android/bluetooth/btservice/MetricsLoggerTest.java
@@ -26,6 +26,8 @@
 import com.android.bluetooth.BluetoothMetricsProto.ProfileConnectionStats;
 import com.android.bluetooth.BluetoothMetricsProto.ProfileId;
 
+import com.google.common.hash.BloomFilter;
+import com.google.common.hash.Funnels;
 import org.junit.After;
 import org.junit.Assert;
 import org.junit.Before;
@@ -34,6 +36,9 @@
 import org.mockito.Mock;
 import org.mockito.MockitoAnnotations;
 
+import java.io.ByteArrayInputStream;
+import java.io.File;
+import java.io.IOException;
 import java.util.HashMap;
 import java.util.List;
 
@@ -43,16 +48,20 @@
 @MediumTest
 @RunWith(AndroidJUnit4.class)
 public class MetricsLoggerTest {
+    private static final String TEST_BLOOMFILTER_NAME = "TestBloomfilter";
+
     private TestableMetricsLogger mTestableMetricsLogger;
     @Mock
     private AdapterService mMockAdapterService;
 
     public class TestableMetricsLogger extends MetricsLogger {
         public HashMap<Integer, Long> mTestableCounters = new HashMap<>();
+        public HashMap<String, Integer> mTestableDeviceNames = new HashMap<>();
 
         @Override
-        protected void writeCounter(int key, long count) {
+        public boolean count(int key, long count) {
             mTestableCounters.put(key, count);
+          return true;
         }
 
         @Override
@@ -62,6 +71,12 @@
         @Override
         protected void cancelPendingDrain() {
         }
+
+        @Override
+        protected void statslogBluetoothDeviceNames(
+                int metricId, String matchedString, String sha256) {
+            mTestableDeviceNames.merge(matchedString, 1, Integer::sum);
+        }
     }
 
     @Before
@@ -70,6 +85,7 @@
         // Dump metrics to clean up internal states
         MetricsLogger.dumpProto(BluetoothLog.newBuilder());
         mTestableMetricsLogger = new TestableMetricsLogger();
+        mTestableMetricsLogger.mBloomFilterInitialized = true;
         doReturn(null)
                 .when(mMockAdapterService).registerReceiver(any(), any());
     }
@@ -141,18 +157,18 @@
     @Test
     public void testAddAndSendCountersNormalCases() {
         mTestableMetricsLogger.init(mMockAdapterService);
-        mTestableMetricsLogger.count(1, 10);
-        mTestableMetricsLogger.count(1, 10);
-        mTestableMetricsLogger.count(2, 5);
+        mTestableMetricsLogger.cacheCount(1, 10);
+        mTestableMetricsLogger.cacheCount(1, 10);
+        mTestableMetricsLogger.cacheCount(2, 5);
         mTestableMetricsLogger.drainBufferedCounters();
 
         Assert.assertEquals(20L, mTestableMetricsLogger.mTestableCounters.get(1).longValue());
         Assert.assertEquals(5L, mTestableMetricsLogger.mTestableCounters.get(2).longValue());
 
-        mTestableMetricsLogger.count(1, 3);
-        mTestableMetricsLogger.count(2, 5);
-        mTestableMetricsLogger.count(2, 5);
-        mTestableMetricsLogger.count(3, 1);
+        mTestableMetricsLogger.cacheCount(1, 3);
+        mTestableMetricsLogger.cacheCount(2, 5);
+        mTestableMetricsLogger.cacheCount(2, 5);
+        mTestableMetricsLogger.cacheCount(3, 1);
         mTestableMetricsLogger.drainBufferedCounters();
         Assert.assertEquals(
                 3L, mTestableMetricsLogger.mTestableCounters.get(1).longValue());
@@ -166,10 +182,10 @@
     public void testAddAndSendCountersCornerCases() {
         mTestableMetricsLogger.init(mMockAdapterService);
         Assert.assertTrue(mTestableMetricsLogger.isInitialized());
-        mTestableMetricsLogger.count(1, -1);
-        mTestableMetricsLogger.count(3, 0);
-        mTestableMetricsLogger.count(2, 10);
-        mTestableMetricsLogger.count(2, Long.MAX_VALUE - 8L);
+        mTestableMetricsLogger.cacheCount(1, -1);
+        mTestableMetricsLogger.cacheCount(3, 0);
+        mTestableMetricsLogger.cacheCount(2, 10);
+        mTestableMetricsLogger.cacheCount(2, Long.MAX_VALUE - 8L);
         mTestableMetricsLogger.drainBufferedCounters();
 
         Assert.assertFalse(mTestableMetricsLogger.mTestableCounters.containsKey(1));
@@ -181,9 +197,9 @@
     @Test
     public void testMetricsLoggerClose() {
         mTestableMetricsLogger.init(mMockAdapterService);
-        mTestableMetricsLogger.count(1, 1);
-        mTestableMetricsLogger.count(2, 10);
-        mTestableMetricsLogger.count(2, Long.MAX_VALUE);
+        mTestableMetricsLogger.cacheCount(1, 1);
+        mTestableMetricsLogger.cacheCount(2, 10);
+        mTestableMetricsLogger.cacheCount(2, Long.MAX_VALUE);
         mTestableMetricsLogger.close();
 
         Assert.assertEquals(
@@ -194,7 +210,7 @@
 
     @Test
     public void testMetricsLoggerNotInit() {
-        Assert.assertFalse(mTestableMetricsLogger.count(1, 1));
+        Assert.assertFalse(mTestableMetricsLogger.cacheCount(1, 1));
         mTestableMetricsLogger.drainBufferedCounters();
         Assert.assertFalse(mTestableMetricsLogger.mTestableCounters.containsKey(1));
         Assert.assertFalse(mTestableMetricsLogger.close());
@@ -206,4 +222,181 @@
         Assert.assertTrue(mTestableMetricsLogger.isInitialized());
         Assert.assertFalse(mTestableMetricsLogger.init(mMockAdapterService));
     }
+
+    @Test
+    public void testDeviceNameUploadingDeviceSet1() {
+        initTestingBloomfitler();
+
+        mTestableMetricsLogger.logSanitizedBluetoothDeviceName(1, "a b c d e f g h pixel 7");
+        Assert.assertTrue(mTestableMetricsLogger.mTestableDeviceNames.isEmpty());
+
+        mTestableMetricsLogger.logSanitizedBluetoothDeviceName(1, "AirpoDspro");
+        Assert.assertEquals(1,
+                mTestableMetricsLogger.mTestableDeviceNames.get("airpodspro").intValue());
+
+        mTestableMetricsLogger.logSanitizedBluetoothDeviceName(1, "AirpoDs-pro");
+        Assert.assertEquals(2,
+                mTestableMetricsLogger.mTestableDeviceNames.get("airpodspro").intValue());
+
+        mTestableMetricsLogger.logSanitizedBluetoothDeviceName(1, "Someone's AirpoDs");
+        Assert.assertEquals(1,
+                mTestableMetricsLogger.mTestableDeviceNames.get("airpods").intValue());
+
+        mTestableMetricsLogger.logSanitizedBluetoothDeviceName(1, "Who's Pixel 7");
+        Assert.assertEquals(1,
+                mTestableMetricsLogger.mTestableDeviceNames.get("pixel7").intValue());
+
+        mTestableMetricsLogger.logSanitizedBluetoothDeviceName(1, "陈的pixel 7手机");
+        Assert.assertEquals(2,
+                mTestableMetricsLogger.mTestableDeviceNames.get("pixel7").intValue());
+
+        mTestableMetricsLogger.logSanitizedBluetoothDeviceName(2, "pixel 7 pro");
+        Assert.assertEquals(1,
+                mTestableMetricsLogger.mTestableDeviceNames.get("pixel7pro").intValue());
+
+        mTestableMetricsLogger.logSanitizedBluetoothDeviceName(1, "My Pixel 7 PRO");
+        Assert.assertEquals(2,
+                mTestableMetricsLogger.mTestableDeviceNames.get("pixel7pro").intValue());
+
+        mTestableMetricsLogger.logSanitizedBluetoothDeviceName(1, "My Pixel   7   PRO");
+        Assert.assertEquals(3,
+                mTestableMetricsLogger.mTestableDeviceNames.get("pixel7pro").intValue());
+
+        mTestableMetricsLogger.logSanitizedBluetoothDeviceName(1, "My Pixel   7   - PRO");
+        Assert.assertEquals(4,
+                mTestableMetricsLogger.mTestableDeviceNames.get("pixel7pro").intValue());
+
+        mTestableMetricsLogger.logSanitizedBluetoothDeviceName(1, "My BMW X5");
+        Assert.assertEquals(1,
+                mTestableMetricsLogger.mTestableDeviceNames.get("bmwx5").intValue());
+
+        mTestableMetricsLogger.logSanitizedBluetoothDeviceName(1, "Jane Doe's Tesla Model--X");
+        Assert.assertEquals(1,
+                mTestableMetricsLogger.mTestableDeviceNames.get("teslamodelx").intValue());
+
+        mTestableMetricsLogger.logSanitizedBluetoothDeviceName(1, "TESLA of Jane DOE");
+        Assert.assertEquals(1,
+                mTestableMetricsLogger.mTestableDeviceNames.get("tesla").intValue());
+
+        mTestableMetricsLogger
+                .logSanitizedBluetoothDeviceName(1, "SONY WH-1000XM noise cancelling headsets");
+        Assert.assertEquals(1,
+                mTestableMetricsLogger.mTestableDeviceNames.get("sonywh1000xm").intValue());
+
+        mTestableMetricsLogger
+                .logSanitizedBluetoothDeviceName(1, "SONY WH-1000XM4 noise cancelling headsets");
+        Assert.assertEquals(1,
+                mTestableMetricsLogger.mTestableDeviceNames.get("sonywh1000xm4").intValue());
+
+        mTestableMetricsLogger
+                .logSanitizedBluetoothDeviceName(1, "Amazon Echo Dot in Kitchen");
+        Assert.assertEquals(1,
+                mTestableMetricsLogger.mTestableDeviceNames.get("amazonechodot").intValue());
+
+        mTestableMetricsLogger
+                .logSanitizedBluetoothDeviceName(1, "斯巴鲁 Starlink");
+        Assert.assertEquals(1,
+                mTestableMetricsLogger.mTestableDeviceNames.get("starlink").intValue());
+
+        mTestableMetricsLogger
+                .logSanitizedBluetoothDeviceName(1, "大黄蜂MyLink");
+        Assert.assertEquals(1,
+                mTestableMetricsLogger.mTestableDeviceNames.get("mylink").intValue());
+
+        mTestableMetricsLogger
+                .logSanitizedBluetoothDeviceName(1, "Dad's Fitbit Charge 3");
+        Assert.assertEquals(1,
+                mTestableMetricsLogger.mTestableDeviceNames.get("fitbitcharge3").intValue());
+
+        mTestableMetricsLogger.mTestableDeviceNames.clear();
+        mTestableMetricsLogger.logSanitizedBluetoothDeviceName(1, "");
+        Assert.assertTrue(mTestableMetricsLogger.mTestableDeviceNames.isEmpty());
+
+        mTestableMetricsLogger.logSanitizedBluetoothDeviceName(1, " ");
+        Assert.assertTrue(mTestableMetricsLogger.mTestableDeviceNames.isEmpty());
+
+        mTestableMetricsLogger.logSanitizedBluetoothDeviceName(1, "SomeDevice1");
+        Assert.assertTrue(mTestableMetricsLogger.mTestableDeviceNames.isEmpty());
+
+        mTestableMetricsLogger.logSanitizedBluetoothDeviceName(1, "Bluetooth headset");
+        Assert.assertTrue(mTestableMetricsLogger.mTestableDeviceNames.isEmpty());
+
+        mTestableMetricsLogger.logSanitizedBluetoothDeviceName(3, "Some Device-2");
+        Assert.assertTrue(mTestableMetricsLogger.mTestableDeviceNames.isEmpty());
+
+        mTestableMetricsLogger.logSanitizedBluetoothDeviceName(5, "abcgfDG gdfg");
+        Assert.assertTrue(mTestableMetricsLogger.mTestableDeviceNames.isEmpty());
+    }
+
+    @Test
+    public void testDeviceNameUploadingDeviceSet2() {
+        initTestingBloomfitler();
+
+        mTestableMetricsLogger
+                .logSanitizedBluetoothDeviceName(1, "Galaxy Buds pro");
+        Assert.assertEquals(1,
+                mTestableMetricsLogger.mTestableDeviceNames.get("galaxybudspro").intValue());
+
+        mTestableMetricsLogger
+                .logSanitizedBluetoothDeviceName(1, "Mike's new Galaxy Buds 2");
+        Assert.assertEquals(1,
+                mTestableMetricsLogger.mTestableDeviceNames.get("galaxybuds2").intValue());
+
+        mTestableMetricsLogger
+                .logSanitizedBluetoothDeviceName(877, "My third Ford F-150");
+        Assert.assertEquals(1,
+                mTestableMetricsLogger.mTestableDeviceNames.get("fordf150").intValue());
+
+        mTestableMetricsLogger
+                .logSanitizedBluetoothDeviceName(1, "BOSE QC_35 Noise Cancelling Headsets");
+        Assert.assertEquals(1,
+                mTestableMetricsLogger.mTestableDeviceNames.get("boseqc35").intValue());
+
+        mTestableMetricsLogger
+                .logSanitizedBluetoothDeviceName(1, "BOSE Quiet Comfort 35 Headsets");
+        Assert.assertEquals(1,
+                mTestableMetricsLogger.mTestableDeviceNames.get("bosequietcomfort35").intValue());
+
+        mTestableMetricsLogger
+                .logSanitizedBluetoothDeviceName(1, "Fitbit versa 3 band");
+        Assert.assertEquals(1,
+                mTestableMetricsLogger.mTestableDeviceNames.get("fitbitversa3").intValue());
+
+        mTestableMetricsLogger
+                .logSanitizedBluetoothDeviceName(1, "vw atlas");
+        Assert.assertEquals(1,
+                mTestableMetricsLogger.mTestableDeviceNames.get("vwatlas").intValue());
+
+        mTestableMetricsLogger
+                .logSanitizedBluetoothDeviceName(1, "My volkswagen tiguan");
+        Assert.assertEquals(1,
+                mTestableMetricsLogger.mTestableDeviceNames.get("volkswagentiguan").intValue());
+
+        mTestableMetricsLogger.mTestableDeviceNames.clear();
+        mTestableMetricsLogger.logSanitizedBluetoothDeviceName(1, "");
+        Assert.assertTrue(mTestableMetricsLogger.mTestableDeviceNames.isEmpty());
+
+        mTestableMetricsLogger.logSanitizedBluetoothDeviceName(1, " ");
+        Assert.assertTrue(mTestableMetricsLogger.mTestableDeviceNames.isEmpty());
+
+        mTestableMetricsLogger.logSanitizedBluetoothDeviceName(1, "weirddevice");
+        Assert.assertTrue(mTestableMetricsLogger.mTestableDeviceNames.isEmpty());
+
+        mTestableMetricsLogger.logSanitizedBluetoothDeviceName(1, ""
+                + "My BOSE Quiet Comfort 35 Noise Cancelling Headsets");
+        // Too long, won't process
+        Assert.assertTrue(mTestableMetricsLogger.mTestableDeviceNames.isEmpty());
+
+    }
+    private void initTestingBloomfitler() {
+        byte[] bloomfilterData = DeviceBloomfilterGenerator.hexStringToByteArray(
+                DeviceBloomfilterGenerator.BLOOM_FILTER_DEFAULT);
+        try {
+            mTestableMetricsLogger.setBloomfilter(
+                    BloomFilter.readFrom(
+                            new ByteArrayInputStream(bloomfilterData), Funnels.byteArrayFunnel()));
+        } catch (IOException e) {
+            Assert.assertTrue(false);
+        }
+    }
 }
diff --git a/android/app/tests/unit/src/com/android/bluetooth/btservice/RemoteDevicesTest.java b/android/app/tests/unit/src/com/android/bluetooth/btservice/RemoteDevicesTest.java
index 42e93e5..86875f2 100644
--- a/android/app/tests/unit/src/com/android/bluetooth/btservice/RemoteDevicesTest.java
+++ b/android/app/tests/unit/src/com/android/bluetooth/btservice/RemoteDevicesTest.java
@@ -10,6 +10,7 @@
 import android.bluetooth.BluetoothHeadset;
 import android.bluetooth.BluetoothHeadsetClient;
 import android.bluetooth.BluetoothProfile;
+import android.bluetooth.BluetoothSinkAudioPolicy;
 import android.content.Intent;
 import android.os.Bundle;
 import android.os.HandlerThread;
@@ -21,6 +22,7 @@
 import androidx.test.runner.AndroidJUnit4;
 
 import com.android.bluetooth.Utils;
+import com.android.bluetooth.btservice.RemoteDevices.DeviceProperties;
 import com.android.bluetooth.hfp.HeadsetHalConstants;
 
 import org.junit.After;
@@ -517,6 +519,26 @@
         Assert.assertNull(mRemoteDevices.getDeviceProperties(mDevice1));
     }
 
+    @Test
+    public void testSetgetHfAudioPolicyForRemoteAg() {
+        // Verify that device property is null initially
+        Assert.assertNull(mRemoteDevices.getDeviceProperties(mDevice1));
+
+        mRemoteDevices.addDeviceProperties(Utils.getBytesFromAddress(TEST_BT_ADDR_1));
+
+        DeviceProperties deviceProp = mRemoteDevices.getDeviceProperties(mDevice1);
+        BluetoothSinkAudioPolicy policies = new BluetoothSinkAudioPolicy.Builder()
+                .setCallEstablishPolicy(BluetoothSinkAudioPolicy.POLICY_ALLOWED)
+                .setActiveDevicePolicyAfterConnection(BluetoothSinkAudioPolicy.POLICY_ALLOWED)
+                .setInBandRingtonePolicy(BluetoothSinkAudioPolicy.POLICY_ALLOWED)
+                .build();
+        deviceProp.setHfAudioPolicyForRemoteAg(policies);
+
+        // Verify that the audio policy properties are set and get propperly
+        Assert.assertEquals(policies, mRemoteDevices.getDeviceProperties(mDevice1)
+                .getHfAudioPolicyForRemoteAg());
+    }
+
     private static void verifyBatteryLevelChangedIntent(BluetoothDevice device, int batteryLevel,
             ArgumentCaptor<Intent> intentArgument) {
         verifyBatteryLevelChangedIntent(device, batteryLevel, intentArgument.getValue());
diff --git a/android/app/tests/unit/src/com/android/bluetooth/btservice/storage/DatabaseManagerTest.java b/android/app/tests/unit/src/com/android/bluetooth/btservice/storage/DatabaseManagerTest.java
index 42498b4..cd306f4 100644
--- a/android/app/tests/unit/src/com/android/bluetooth/btservice/storage/DatabaseManagerTest.java
+++ b/android/app/tests/unit/src/com/android/bluetooth/btservice/storage/DatabaseManagerTest.java
@@ -30,6 +30,7 @@
 import android.bluetooth.BluetoothAdapter;
 import android.bluetooth.BluetoothDevice;
 import android.bluetooth.BluetoothProfile;
+import android.bluetooth.BluetoothSinkAudioPolicy;
 import android.content.ContentValues;
 import android.database.Cursor;
 import android.database.sqlite.SQLiteDatabase;
@@ -385,6 +386,12 @@
                 value, true);
         testSetGetCustomMetaCase(false, BluetoothDevice.METADATA_FAST_PAIR_CUSTOMIZED_FIELDS,
                 value, true);
+        testSetGetCustomMetaCase(false, BluetoothDevice.METADATA_LE_AUDIO,
+                value, true);
+        testSetGetCustomMetaCase(false, BluetoothDevice.METADATA_GMCS_CCCD,
+                value, true);
+        testSetGetCustomMetaCase(false, BluetoothDevice.METADATA_GTBS_CCCD,
+                value, true);
         testSetGetCustomMetaCase(false, badKey, value, false);
 
         // Device is in database
@@ -443,6 +450,26 @@
                 value, true);
         testSetGetCustomMetaCase(true, BluetoothDevice.METADATA_FAST_PAIR_CUSTOMIZED_FIELDS,
                 value, true);
+        testSetGetCustomMetaCase(true, BluetoothDevice.METADATA_LE_AUDIO,
+                value, true);
+        testSetGetCustomMetaCase(true, BluetoothDevice.METADATA_GMCS_CCCD,
+                value, true);
+        testSetGetCustomMetaCase(true, BluetoothDevice.METADATA_GTBS_CCCD,
+                value, true);
+    }
+    @Test
+    public void testSetGetAudioPolicyMetaData() {
+        int badKey = 100;
+        BluetoothSinkAudioPolicy value = new BluetoothSinkAudioPolicy.Builder()
+                .setCallEstablishPolicy(BluetoothSinkAudioPolicy.POLICY_ALLOWED)
+                .setActiveDevicePolicyAfterConnection(BluetoothSinkAudioPolicy.POLICY_NOT_ALLOWED)
+                .setInBandRingtonePolicy(BluetoothSinkAudioPolicy.POLICY_ALLOWED)
+                .build();
+
+        // Device is not in database
+        testSetGetAudioPolicyMetadataCase(false, value, true);
+        // Device is in database
+        testSetGetAudioPolicyMetadataCase(true, value, true);
     }
 
     @Test
@@ -1139,7 +1166,7 @@
     @Test
     public void testDatabaseMigration_111_112() throws IOException {
         String testString = "TEST STRING";
-        // Create a database with version 109
+        // Create a database with version 111
         SupportSQLiteDatabase db = testHelper.createDatabase(DB_NAME, 111);
         // insert a device to the database
         ContentValues device = new ContentValues();
@@ -1183,6 +1210,105 @@
         }
     }
 
+    @Test
+    public void testDatabaseMigration_113_114() throws IOException {
+        // Create a database with version 113
+        SupportSQLiteDatabase db = testHelper.createDatabase(DB_NAME, 113);
+        // insert a device to the database
+        ContentValues device = new ContentValues();
+        device.put("address", TEST_BT_ADDR);
+        device.put("migrated", false);
+        assertThat(db.insert("metadata", SQLiteDatabase.CONFLICT_IGNORE, device),
+                CoreMatchers.not(-1));
+        // Migrate database from 113 to 114
+        db.close();
+        db = testHelper.runMigrationsAndValidate(DB_NAME, 114, true,
+                MetadataDatabase.MIGRATION_113_114);
+        Cursor cursor = db.query("SELECT * FROM metadata");
+        assertHasColumn(cursor, "le_audio", true);
+        while (cursor.moveToNext()) {
+            // Check the new columns was added with default value
+            assertColumnBlobData(cursor, "le_audio", null);
+        }
+    }
+
+    @Test
+    public void testDatabaseMigration_114_115() throws IOException {
+        // Create a database with version 114
+        SupportSQLiteDatabase db = testHelper.createDatabase(DB_NAME, 114);
+        // insert a device to the database
+        ContentValues device = new ContentValues();
+        device.put("address", TEST_BT_ADDR);
+        device.put("migrated", false);
+        assertThat(db.insert("metadata", SQLiteDatabase.CONFLICT_IGNORE, device),
+                CoreMatchers.not(-1));
+
+        // Migrate database from 114 to 115
+        db.close();
+        db = testHelper.runMigrationsAndValidate(DB_NAME, 115, true,
+                MetadataDatabase.MIGRATION_114_115);
+        Cursor cursor = db.query("SELECT * FROM metadata");
+
+        assertHasColumn(cursor, "call_establish_audio_policy", true);
+        assertHasColumn(cursor, "connecting_time_audio_policy", true);
+        assertHasColumn(cursor, "in_band_ringtone_audio_policy", true);
+        while (cursor.moveToNext()) {
+            // Check the new columns was added with default value
+            assertColumnBlobData(cursor, "call_establish_audio_policy", null);
+            assertColumnBlobData(cursor, "connecting_time_audio_policy", null);
+            assertColumnBlobData(cursor, "in_band_ringtone_audio_policy", null);
+        }
+    }
+
+    @Test
+    public void testDatabaseMigration_115_116() throws IOException {
+        // Create a database with version 115
+        SupportSQLiteDatabase db = testHelper.createDatabase(DB_NAME, 115);
+        // insert a device to the database
+        ContentValues device = new ContentValues();
+        device.put("address", TEST_BT_ADDR);
+        device.put("migrated", false);
+        assertThat(db.insert("metadata", SQLiteDatabase.CONFLICT_IGNORE, device),
+                CoreMatchers.not(-1));
+
+        // Migrate database from 115 to 116
+        db.close();
+        db = testHelper.runMigrationsAndValidate(DB_NAME, 116, true,
+                MetadataDatabase.MIGRATION_115_116);
+        Cursor cursor = db.query("SELECT * FROM metadata");
+        assertHasColumn(cursor, "preferred_output_only_profile", true);
+        assertHasColumn(cursor, "preferred_duplex_profile", true);
+        while (cursor.moveToNext()) {
+            // Check the new columns was added with default value
+            assertColumnIntData(cursor, "preferred_output_only_profile", 0);
+            assertColumnIntData(cursor, "preferred_duplex_profile", 0);
+        }
+    }
+
+    @Test
+    public void testDatabaseMigration_116_117() throws IOException {
+        // Create a database with version 116
+        SupportSQLiteDatabase db = testHelper.createDatabase(DB_NAME, 116);
+        // insert a device to the database
+        ContentValues device = new ContentValues();
+        device.put("address", TEST_BT_ADDR);
+        device.put("migrated", false);
+        assertThat(db.insert("metadata", SQLiteDatabase.CONFLICT_IGNORE, device),
+                CoreMatchers.not(-1));
+        // Migrate database from 116 to 117
+        db.close();
+        db = testHelper.runMigrationsAndValidate(DB_NAME, 117, true,
+                MetadataDatabase.MIGRATION_116_117);
+        Cursor cursor = db.query("SELECT * FROM metadata");
+        assertHasColumn(cursor, "gmcs_cccd", true);
+        assertHasColumn(cursor, "gtbs_cccd", true);
+        while (cursor.moveToNext()) {
+            // Check the new columns was added with default value
+            assertColumnBlobData(cursor, "gmcs_cccd", null);
+            assertColumnBlobData(cursor, "gtbs_cccd", null);
+        }
+    }
+
     /**
      * Helper function to check whether the database has the expected column
      */
@@ -1353,4 +1479,38 @@
         // Wait for clear database
         TestUtils.waitForLooperToFinishScheduledTask(mDatabaseManager.getHandlerLooper());
     }
+
+    void testSetGetAudioPolicyMetadataCase(boolean stored,
+                BluetoothSinkAudioPolicy policy, boolean expectedResult) {
+        BluetoothSinkAudioPolicy testPolicy = new BluetoothSinkAudioPolicy.Builder().build();
+        if (stored) {
+            Metadata data = new Metadata(TEST_BT_ADDR);
+            mDatabaseManager.mMetadataCache.put(TEST_BT_ADDR, data);
+            mDatabase.insert(data);
+            Assert.assertEquals(expectedResult,
+                    mDatabaseManager.setAudioPolicyMetadata(mTestDevice, testPolicy));
+        }
+        Assert.assertEquals(expectedResult,
+                mDatabaseManager.setAudioPolicyMetadata(mTestDevice, policy));
+        if (expectedResult) {
+            // Check for callback and get value
+            Assert.assertEquals(policy,
+                    mDatabaseManager.getAudioPolicyMetadata(mTestDevice));
+        } else {
+            Assert.assertNull(mDatabaseManager.getAudioPolicyMetadata(mTestDevice));
+            return;
+        }
+        // Wait for database update
+        TestUtils.waitForLooperToFinishScheduledTask(mDatabaseManager.getHandlerLooper());
+
+        // Check whether the value is saved in database
+        restartDatabaseManagerHelper();
+        Assert.assertEquals(policy,
+                mDatabaseManager.getAudioPolicyMetadata(mTestDevice));
+
+        mDatabaseManager.factoryReset();
+        mDatabaseManager.mMetadataCache.clear();
+        // Wait for clear database
+        TestUtils.waitForLooperToFinishScheduledTask(mDatabaseManager.getHandlerLooper());
+    }
 }
diff --git a/android/app/tests/unit/src/com/android/bluetooth/btservice/storage/schemas/com.android.bluetooth.btservice.storage.MetadataDatabase/114.json b/android/app/tests/unit/src/com/android/bluetooth/btservice/storage/schemas/com.android.bluetooth.btservice.storage.MetadataDatabase/114.json
new file mode 100644
index 0000000..96e0503
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/btservice/storage/schemas/com.android.bluetooth.btservice.storage.MetadataDatabase/114.json
@@ -0,0 +1,340 @@
+{
+  "formatVersion": 1,
+  "database": {
+    "version": 114,
+    "identityHash": "ba0a06f58eaae06198b90b4f6e5eb553",
+    "entities": [
+      {
+        "tableName": "metadata",
+        "createSql": "CREATE TABLE IF NOT EXISTS `${TABLE_NAME}` (`address` TEXT NOT NULL, `migrated` INTEGER NOT NULL, `a2dpSupportsOptionalCodecs` INTEGER NOT NULL, `a2dpOptionalCodecsEnabled` INTEGER NOT NULL, `last_active_time` INTEGER NOT NULL, `is_active_a2dp_device` INTEGER NOT NULL, `a2dp_connection_policy` INTEGER, `a2dp_sink_connection_policy` INTEGER, `hfp_connection_policy` INTEGER, `hfp_client_connection_policy` INTEGER, `hid_host_connection_policy` INTEGER, `pan_connection_policy` INTEGER, `pbap_connection_policy` INTEGER, `pbap_client_connection_policy` INTEGER, `map_connection_policy` INTEGER, `sap_connection_policy` INTEGER, `hearing_aid_connection_policy` INTEGER, `hap_client_connection_policy` INTEGER, `map_client_connection_policy` INTEGER, `le_audio_connection_policy` INTEGER, `volume_control_connection_policy` INTEGER, `csip_set_coordinator_connection_policy` INTEGER, `le_call_control_connection_policy` INTEGER, `bass_client_connection_policy` INTEGER, `battery_connection_policy` INTEGER, `manufacturer_name` BLOB, `model_name` BLOB, `software_version` BLOB, `hardware_version` BLOB, `companion_app` BLOB, `main_icon` BLOB, `is_untethered_headset` BLOB, `untethered_left_icon` BLOB, `untethered_right_icon` BLOB, `untethered_case_icon` BLOB, `untethered_left_battery` BLOB, `untethered_right_battery` BLOB, `untethered_case_battery` BLOB, `untethered_left_charging` BLOB, `untethered_right_charging` BLOB, `untethered_case_charging` BLOB, `enhanced_settings_ui_uri` BLOB, `device_type` BLOB, `main_battery` BLOB, `main_charging` BLOB, `main_low_battery_threshold` BLOB, `untethered_left_low_battery_threshold` BLOB, `untethered_right_low_battery_threshold` BLOB, `untethered_case_low_battery_threshold` BLOB, `spatial_audio` BLOB, `fastpair_customized` BLOB, `le_audio` BLOB, PRIMARY KEY(`address`))",
+        "fields": [
+          {
+            "fieldPath": "address",
+            "columnName": "address",
+            "affinity": "TEXT",
+            "notNull": true
+          },
+          {
+            "fieldPath": "migrated",
+            "columnName": "migrated",
+            "affinity": "INTEGER",
+            "notNull": true
+          },
+          {
+            "fieldPath": "a2dpSupportsOptionalCodecs",
+            "columnName": "a2dpSupportsOptionalCodecs",
+            "affinity": "INTEGER",
+            "notNull": true
+          },
+          {
+            "fieldPath": "a2dpOptionalCodecsEnabled",
+            "columnName": "a2dpOptionalCodecsEnabled",
+            "affinity": "INTEGER",
+            "notNull": true
+          },
+          {
+            "fieldPath": "last_active_time",
+            "columnName": "last_active_time",
+            "affinity": "INTEGER",
+            "notNull": true
+          },
+          {
+            "fieldPath": "is_active_a2dp_device",
+            "columnName": "is_active_a2dp_device",
+            "affinity": "INTEGER",
+            "notNull": true
+          },
+          {
+            "fieldPath": "profileConnectionPolicies.a2dp_connection_policy",
+            "columnName": "a2dp_connection_policy",
+            "affinity": "INTEGER",
+            "notNull": false
+          },
+          {
+            "fieldPath": "profileConnectionPolicies.a2dp_sink_connection_policy",
+            "columnName": "a2dp_sink_connection_policy",
+            "affinity": "INTEGER",
+            "notNull": false
+          },
+          {
+            "fieldPath": "profileConnectionPolicies.hfp_connection_policy",
+            "columnName": "hfp_connection_policy",
+            "affinity": "INTEGER",
+            "notNull": false
+          },
+          {
+            "fieldPath": "profileConnectionPolicies.hfp_client_connection_policy",
+            "columnName": "hfp_client_connection_policy",
+            "affinity": "INTEGER",
+            "notNull": false
+          },
+          {
+            "fieldPath": "profileConnectionPolicies.hid_host_connection_policy",
+            "columnName": "hid_host_connection_policy",
+            "affinity": "INTEGER",
+            "notNull": false
+          },
+          {
+            "fieldPath": "profileConnectionPolicies.pan_connection_policy",
+            "columnName": "pan_connection_policy",
+            "affinity": "INTEGER",
+            "notNull": false
+          },
+          {
+            "fieldPath": "profileConnectionPolicies.pbap_connection_policy",
+            "columnName": "pbap_connection_policy",
+            "affinity": "INTEGER",
+            "notNull": false
+          },
+          {
+            "fieldPath": "profileConnectionPolicies.pbap_client_connection_policy",
+            "columnName": "pbap_client_connection_policy",
+            "affinity": "INTEGER",
+            "notNull": false
+          },
+          {
+            "fieldPath": "profileConnectionPolicies.map_connection_policy",
+            "columnName": "map_connection_policy",
+            "affinity": "INTEGER",
+            "notNull": false
+          },
+          {
+            "fieldPath": "profileConnectionPolicies.sap_connection_policy",
+            "columnName": "sap_connection_policy",
+            "affinity": "INTEGER",
+            "notNull": false
+          },
+          {
+            "fieldPath": "profileConnectionPolicies.hearing_aid_connection_policy",
+            "columnName": "hearing_aid_connection_policy",
+            "affinity": "INTEGER",
+            "notNull": false
+          },
+          {
+            "fieldPath": "profileConnectionPolicies.hap_client_connection_policy",
+            "columnName": "hap_client_connection_policy",
+            "affinity": "INTEGER",
+            "notNull": false
+          },
+          {
+            "fieldPath": "profileConnectionPolicies.map_client_connection_policy",
+            "columnName": "map_client_connection_policy",
+            "affinity": "INTEGER",
+            "notNull": false
+          },
+          {
+            "fieldPath": "profileConnectionPolicies.le_audio_connection_policy",
+            "columnName": "le_audio_connection_policy",
+            "affinity": "INTEGER",
+            "notNull": false
+          },
+          {
+            "fieldPath": "profileConnectionPolicies.volume_control_connection_policy",
+            "columnName": "volume_control_connection_policy",
+            "affinity": "INTEGER",
+            "notNull": false
+          },
+          {
+            "fieldPath": "profileConnectionPolicies.csip_set_coordinator_connection_policy",
+            "columnName": "csip_set_coordinator_connection_policy",
+            "affinity": "INTEGER",
+            "notNull": false
+          },
+          {
+            "fieldPath": "profileConnectionPolicies.le_call_control_connection_policy",
+            "columnName": "le_call_control_connection_policy",
+            "affinity": "INTEGER",
+            "notNull": false
+          },
+          {
+            "fieldPath": "profileConnectionPolicies.bass_client_connection_policy",
+            "columnName": "bass_client_connection_policy",
+            "affinity": "INTEGER",
+            "notNull": false
+          },
+          {
+            "fieldPath": "profileConnectionPolicies.battery_connection_policy",
+            "columnName": "battery_connection_policy",
+            "affinity": "INTEGER",
+            "notNull": false
+          },
+          {
+            "fieldPath": "publicMetadata.manufacturer_name",
+            "columnName": "manufacturer_name",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "publicMetadata.model_name",
+            "columnName": "model_name",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "publicMetadata.software_version",
+            "columnName": "software_version",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "publicMetadata.hardware_version",
+            "columnName": "hardware_version",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "publicMetadata.companion_app",
+            "columnName": "companion_app",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "publicMetadata.main_icon",
+            "columnName": "main_icon",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "publicMetadata.is_untethered_headset",
+            "columnName": "is_untethered_headset",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "publicMetadata.untethered_left_icon",
+            "columnName": "untethered_left_icon",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "publicMetadata.untethered_right_icon",
+            "columnName": "untethered_right_icon",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "publicMetadata.untethered_case_icon",
+            "columnName": "untethered_case_icon",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "publicMetadata.untethered_left_battery",
+            "columnName": "untethered_left_battery",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "publicMetadata.untethered_right_battery",
+            "columnName": "untethered_right_battery",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "publicMetadata.untethered_case_battery",
+            "columnName": "untethered_case_battery",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "publicMetadata.untethered_left_charging",
+            "columnName": "untethered_left_charging",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "publicMetadata.untethered_right_charging",
+            "columnName": "untethered_right_charging",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "publicMetadata.untethered_case_charging",
+            "columnName": "untethered_case_charging",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "publicMetadata.enhanced_settings_ui_uri",
+            "columnName": "enhanced_settings_ui_uri",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "publicMetadata.device_type",
+            "columnName": "device_type",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "publicMetadata.main_battery",
+            "columnName": "main_battery",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "publicMetadata.main_charging",
+            "columnName": "main_charging",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "publicMetadata.main_low_battery_threshold",
+            "columnName": "main_low_battery_threshold",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "publicMetadata.untethered_left_low_battery_threshold",
+            "columnName": "untethered_left_low_battery_threshold",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "publicMetadata.untethered_right_low_battery_threshold",
+            "columnName": "untethered_right_low_battery_threshold",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "publicMetadata.untethered_case_low_battery_threshold",
+            "columnName": "untethered_case_low_battery_threshold",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "publicMetadata.spatial_audio",
+            "columnName": "spatial_audio",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "publicMetadata.fastpair_customized",
+            "columnName": "fastpair_customized",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "publicMetadata.le_audio",
+            "columnName": "le_audio",
+            "affinity": "BLOB",
+            "notNull": false
+          }
+        ],
+        "primaryKey": {
+          "autoGenerate": false,
+          "columnNames": [
+            "address"
+          ]
+        },
+        "indices": [],
+        "foreignKeys": []
+      }
+    ],
+    "views": [],
+    "setupQueries": [
+      "CREATE TABLE IF NOT EXISTS room_master_table (id INTEGER PRIMARY KEY,identity_hash TEXT)",
+      "INSERT OR REPLACE INTO room_master_table (id,identity_hash) VALUES(42, 'ba0a06f58eaae06198b90b4f6e5eb553')"
+    ]
+  }
+}
\ No newline at end of file
diff --git a/android/app/tests/unit/src/com/android/bluetooth/btservice/storage/schemas/com.android.bluetooth.btservice.storage.MetadataDatabase/115.json b/android/app/tests/unit/src/com/android/bluetooth/btservice/storage/schemas/com.android.bluetooth.btservice.storage.MetadataDatabase/115.json
new file mode 100644
index 0000000..5d576dc
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/btservice/storage/schemas/com.android.bluetooth.btservice.storage.MetadataDatabase/115.json
@@ -0,0 +1,358 @@
+{
+  "formatVersion": 1,
+  "database": {
+    "version": 115,
+    "identityHash": "c61976c8f6248cefd19ef8f25f543e01",
+    "entities": [
+      {
+        "tableName": "metadata",
+        "createSql": "CREATE TABLE IF NOT EXISTS `${TABLE_NAME}` (`address` TEXT NOT NULL, `migrated` INTEGER NOT NULL, `a2dpSupportsOptionalCodecs` INTEGER NOT NULL, `a2dpOptionalCodecsEnabled` INTEGER NOT NULL, `last_active_time` INTEGER NOT NULL, `is_active_a2dp_device` INTEGER NOT NULL, `a2dp_connection_policy` INTEGER, `a2dp_sink_connection_policy` INTEGER, `hfp_connection_policy` INTEGER, `hfp_client_connection_policy` INTEGER, `hid_host_connection_policy` INTEGER, `pan_connection_policy` INTEGER, `pbap_connection_policy` INTEGER, `pbap_client_connection_policy` INTEGER, `map_connection_policy` INTEGER, `sap_connection_policy` INTEGER, `hearing_aid_connection_policy` INTEGER, `hap_client_connection_policy` INTEGER, `map_client_connection_policy` INTEGER, `le_audio_connection_policy` INTEGER, `volume_control_connection_policy` INTEGER, `csip_set_coordinator_connection_policy` INTEGER, `le_call_control_connection_policy` INTEGER, `bass_client_connection_policy` INTEGER, `battery_connection_policy` INTEGER, `manufacturer_name` BLOB, `model_name` BLOB, `software_version` BLOB, `hardware_version` BLOB, `companion_app` BLOB, `main_icon` BLOB, `is_untethered_headset` BLOB, `untethered_left_icon` BLOB, `untethered_right_icon` BLOB, `untethered_case_icon` BLOB, `untethered_left_battery` BLOB, `untethered_right_battery` BLOB, `untethered_case_battery` BLOB, `untethered_left_charging` BLOB, `untethered_right_charging` BLOB, `untethered_case_charging` BLOB, `enhanced_settings_ui_uri` BLOB, `device_type` BLOB, `main_battery` BLOB, `main_charging` BLOB, `main_low_battery_threshold` BLOB, `untethered_left_low_battery_threshold` BLOB, `untethered_right_low_battery_threshold` BLOB, `untethered_case_low_battery_threshold` BLOB, `spatial_audio` BLOB, `fastpair_customized` BLOB, `le_audio` BLOB, `call_establish_audio_policy` INTEGER, `connecting_time_audio_policy` INTEGER, `in_band_ringtone_audio_policy` INTEGER, PRIMARY KEY(`address`))",
+        "fields": [
+          {
+            "fieldPath": "address",
+            "columnName": "address",
+            "affinity": "TEXT",
+            "notNull": true
+          },
+          {
+            "fieldPath": "migrated",
+            "columnName": "migrated",
+            "affinity": "INTEGER",
+            "notNull": true
+          },
+          {
+            "fieldPath": "a2dpSupportsOptionalCodecs",
+            "columnName": "a2dpSupportsOptionalCodecs",
+            "affinity": "INTEGER",
+            "notNull": true
+          },
+          {
+            "fieldPath": "a2dpOptionalCodecsEnabled",
+            "columnName": "a2dpOptionalCodecsEnabled",
+            "affinity": "INTEGER",
+            "notNull": true
+          },
+          {
+            "fieldPath": "last_active_time",
+            "columnName": "last_active_time",
+            "affinity": "INTEGER",
+            "notNull": true
+          },
+          {
+            "fieldPath": "is_active_a2dp_device",
+            "columnName": "is_active_a2dp_device",
+            "affinity": "INTEGER",
+            "notNull": true
+          },
+          {
+            "fieldPath": "profileConnectionPolicies.a2dp_connection_policy",
+            "columnName": "a2dp_connection_policy",
+            "affinity": "INTEGER",
+            "notNull": false
+          },
+          {
+            "fieldPath": "profileConnectionPolicies.a2dp_sink_connection_policy",
+            "columnName": "a2dp_sink_connection_policy",
+            "affinity": "INTEGER",
+            "notNull": false
+          },
+          {
+            "fieldPath": "profileConnectionPolicies.hfp_connection_policy",
+            "columnName": "hfp_connection_policy",
+            "affinity": "INTEGER",
+            "notNull": false
+          },
+          {
+            "fieldPath": "profileConnectionPolicies.hfp_client_connection_policy",
+            "columnName": "hfp_client_connection_policy",
+            "affinity": "INTEGER",
+            "notNull": false
+          },
+          {
+            "fieldPath": "profileConnectionPolicies.hid_host_connection_policy",
+            "columnName": "hid_host_connection_policy",
+            "affinity": "INTEGER",
+            "notNull": false
+          },
+          {
+            "fieldPath": "profileConnectionPolicies.pan_connection_policy",
+            "columnName": "pan_connection_policy",
+            "affinity": "INTEGER",
+            "notNull": false
+          },
+          {
+            "fieldPath": "profileConnectionPolicies.pbap_connection_policy",
+            "columnName": "pbap_connection_policy",
+            "affinity": "INTEGER",
+            "notNull": false
+          },
+          {
+            "fieldPath": "profileConnectionPolicies.pbap_client_connection_policy",
+            "columnName": "pbap_client_connection_policy",
+            "affinity": "INTEGER",
+            "notNull": false
+          },
+          {
+            "fieldPath": "profileConnectionPolicies.map_connection_policy",
+            "columnName": "map_connection_policy",
+            "affinity": "INTEGER",
+            "notNull": false
+          },
+          {
+            "fieldPath": "profileConnectionPolicies.sap_connection_policy",
+            "columnName": "sap_connection_policy",
+            "affinity": "INTEGER",
+            "notNull": false
+          },
+          {
+            "fieldPath": "profileConnectionPolicies.hearing_aid_connection_policy",
+            "columnName": "hearing_aid_connection_policy",
+            "affinity": "INTEGER",
+            "notNull": false
+          },
+          {
+            "fieldPath": "profileConnectionPolicies.hap_client_connection_policy",
+            "columnName": "hap_client_connection_policy",
+            "affinity": "INTEGER",
+            "notNull": false
+          },
+          {
+            "fieldPath": "profileConnectionPolicies.map_client_connection_policy",
+            "columnName": "map_client_connection_policy",
+            "affinity": "INTEGER",
+            "notNull": false
+          },
+          {
+            "fieldPath": "profileConnectionPolicies.le_audio_connection_policy",
+            "columnName": "le_audio_connection_policy",
+            "affinity": "INTEGER",
+            "notNull": false
+          },
+          {
+            "fieldPath": "profileConnectionPolicies.volume_control_connection_policy",
+            "columnName": "volume_control_connection_policy",
+            "affinity": "INTEGER",
+            "notNull": false
+          },
+          {
+            "fieldPath": "profileConnectionPolicies.csip_set_coordinator_connection_policy",
+            "columnName": "csip_set_coordinator_connection_policy",
+            "affinity": "INTEGER",
+            "notNull": false
+          },
+          {
+            "fieldPath": "profileConnectionPolicies.le_call_control_connection_policy",
+            "columnName": "le_call_control_connection_policy",
+            "affinity": "INTEGER",
+            "notNull": false
+          },
+          {
+            "fieldPath": "profileConnectionPolicies.bass_client_connection_policy",
+            "columnName": "bass_client_connection_policy",
+            "affinity": "INTEGER",
+            "notNull": false
+          },
+          {
+            "fieldPath": "profileConnectionPolicies.battery_connection_policy",
+            "columnName": "battery_connection_policy",
+            "affinity": "INTEGER",
+            "notNull": false
+          },
+          {
+            "fieldPath": "publicMetadata.manufacturer_name",
+            "columnName": "manufacturer_name",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "publicMetadata.model_name",
+            "columnName": "model_name",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "publicMetadata.software_version",
+            "columnName": "software_version",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "publicMetadata.hardware_version",
+            "columnName": "hardware_version",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "publicMetadata.companion_app",
+            "columnName": "companion_app",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "publicMetadata.main_icon",
+            "columnName": "main_icon",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "publicMetadata.is_untethered_headset",
+            "columnName": "is_untethered_headset",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "publicMetadata.untethered_left_icon",
+            "columnName": "untethered_left_icon",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "publicMetadata.untethered_right_icon",
+            "columnName": "untethered_right_icon",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "publicMetadata.untethered_case_icon",
+            "columnName": "untethered_case_icon",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "publicMetadata.untethered_left_battery",
+            "columnName": "untethered_left_battery",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "publicMetadata.untethered_right_battery",
+            "columnName": "untethered_right_battery",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "publicMetadata.untethered_case_battery",
+            "columnName": "untethered_case_battery",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "publicMetadata.untethered_left_charging",
+            "columnName": "untethered_left_charging",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "publicMetadata.untethered_right_charging",
+            "columnName": "untethered_right_charging",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "publicMetadata.untethered_case_charging",
+            "columnName": "untethered_case_charging",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "publicMetadata.enhanced_settings_ui_uri",
+            "columnName": "enhanced_settings_ui_uri",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "publicMetadata.device_type",
+            "columnName": "device_type",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "publicMetadata.main_battery",
+            "columnName": "main_battery",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "publicMetadata.main_charging",
+            "columnName": "main_charging",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "publicMetadata.main_low_battery_threshold",
+            "columnName": "main_low_battery_threshold",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "publicMetadata.untethered_left_low_battery_threshold",
+            "columnName": "untethered_left_low_battery_threshold",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "publicMetadata.untethered_right_low_battery_threshold",
+            "columnName": "untethered_right_low_battery_threshold",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "publicMetadata.untethered_case_low_battery_threshold",
+            "columnName": "untethered_case_low_battery_threshold",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "publicMetadata.spatial_audio",
+            "columnName": "spatial_audio",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "publicMetadata.fastpair_customized",
+            "columnName": "fastpair_customized",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "publicMetadata.le_audio",
+            "columnName": "le_audio",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "audioPolicyMetadata.callEstablishAudioPolicy",
+            "columnName": "call_establish_audio_policy",
+            "affinity": "INTEGER",
+            "notNull": false
+          },
+          {
+            "fieldPath": "audioPolicyMetadata.connectingTimeAudioPolicy",
+            "columnName": "connecting_time_audio_policy",
+            "affinity": "INTEGER",
+            "notNull": false
+          },
+          {
+            "fieldPath": "audioPolicyMetadata.inBandRingtoneAudioPolicy",
+            "columnName": "in_band_ringtone_audio_policy",
+            "affinity": "INTEGER",
+            "notNull": false
+          }
+        ],
+        "primaryKey": {
+          "autoGenerate": false,
+          "columnNames": [
+            "address"
+          ]
+        },
+        "indices": [],
+        "foreignKeys": []
+      }
+    ],
+    "views": [],
+    "setupQueries": [
+      "CREATE TABLE IF NOT EXISTS room_master_table (id INTEGER PRIMARY KEY,identity_hash TEXT)",
+      "INSERT OR REPLACE INTO room_master_table (id,identity_hash) VALUES(42, 'c61976c8f6248cefd19ef8f25f543e01')"
+    ]
+  }
+}
diff --git a/android/app/tests/unit/src/com/android/bluetooth/btservice/storage/schemas/com.android.bluetooth.btservice.storage.MetadataDatabase/116.json b/android/app/tests/unit/src/com/android/bluetooth/btservice/storage/schemas/com.android.bluetooth.btservice.storage.MetadataDatabase/116.json
new file mode 100644
index 0000000..2e85b51
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/btservice/storage/schemas/com.android.bluetooth.btservice.storage.MetadataDatabase/116.json
@@ -0,0 +1,370 @@
+{
+  "formatVersion": 1,
+  "database": {
+    "version": 116,
+    "identityHash": "0b8549de3acad8b14fe6f7198206ea02",
+    "entities": [
+      {
+        "tableName": "metadata",
+        "createSql": "CREATE TABLE IF NOT EXISTS `${TABLE_NAME}` (`address` TEXT NOT NULL, `migrated` INTEGER NOT NULL, `a2dpSupportsOptionalCodecs` INTEGER NOT NULL, `a2dpOptionalCodecsEnabled` INTEGER NOT NULL, `last_active_time` INTEGER NOT NULL, `is_active_a2dp_device` INTEGER NOT NULL, `preferred_output_only_profile` INTEGER NOT NULL, `preferred_duplex_profile` INTEGER NOT NULL, `a2dp_connection_policy` INTEGER, `a2dp_sink_connection_policy` INTEGER, `hfp_connection_policy` INTEGER, `hfp_client_connection_policy` INTEGER, `hid_host_connection_policy` INTEGER, `pan_connection_policy` INTEGER, `pbap_connection_policy` INTEGER, `pbap_client_connection_policy` INTEGER, `map_connection_policy` INTEGER, `sap_connection_policy` INTEGER, `hearing_aid_connection_policy` INTEGER, `hap_client_connection_policy` INTEGER, `map_client_connection_policy` INTEGER, `le_audio_connection_policy` INTEGER, `volume_control_connection_policy` INTEGER, `csip_set_coordinator_connection_policy` INTEGER, `le_call_control_connection_policy` INTEGER, `bass_client_connection_policy` INTEGER, `battery_connection_policy` INTEGER, `manufacturer_name` BLOB, `model_name` BLOB, `software_version` BLOB, `hardware_version` BLOB, `companion_app` BLOB, `main_icon` BLOB, `is_untethered_headset` BLOB, `untethered_left_icon` BLOB, `untethered_right_icon` BLOB, `untethered_case_icon` BLOB, `untethered_left_battery` BLOB, `untethered_right_battery` BLOB, `untethered_case_battery` BLOB, `untethered_left_charging` BLOB, `untethered_right_charging` BLOB, `untethered_case_charging` BLOB, `enhanced_settings_ui_uri` BLOB, `device_type` BLOB, `main_battery` BLOB, `main_charging` BLOB, `main_low_battery_threshold` BLOB, `untethered_left_low_battery_threshold` BLOB, `untethered_right_low_battery_threshold` BLOB, `untethered_case_low_battery_threshold` BLOB, `spatial_audio` BLOB, `fastpair_customized` BLOB, `le_audio` BLOB, `call_establish_audio_policy` INTEGER, `connecting_time_audio_policy` INTEGER, `in_band_ringtone_audio_policy` INTEGER, PRIMARY KEY(`address`))",
+        "fields": [
+          {
+            "fieldPath": "address",
+            "columnName": "address",
+            "affinity": "TEXT",
+            "notNull": true
+          },
+          {
+            "fieldPath": "migrated",
+            "columnName": "migrated",
+            "affinity": "INTEGER",
+            "notNull": true
+          },
+          {
+            "fieldPath": "a2dpSupportsOptionalCodecs",
+            "columnName": "a2dpSupportsOptionalCodecs",
+            "affinity": "INTEGER",
+            "notNull": true
+          },
+          {
+            "fieldPath": "a2dpOptionalCodecsEnabled",
+            "columnName": "a2dpOptionalCodecsEnabled",
+            "affinity": "INTEGER",
+            "notNull": true
+          },
+          {
+            "fieldPath": "last_active_time",
+            "columnName": "last_active_time",
+            "affinity": "INTEGER",
+            "notNull": true
+          },
+          {
+            "fieldPath": "is_active_a2dp_device",
+            "columnName": "is_active_a2dp_device",
+            "affinity": "INTEGER",
+            "notNull": true
+          },
+          {
+            "fieldPath": "preferred_output_only_profile",
+            "columnName": "preferred_output_only_profile",
+            "affinity": "INTEGER",
+            "notNull": true
+          },
+          {
+            "fieldPath": "preferred_duplex_profile",
+            "columnName": "preferred_duplex_profile",
+            "affinity": "INTEGER",
+            "notNull": true
+          },
+          {
+            "fieldPath": "profileConnectionPolicies.a2dp_connection_policy",
+            "columnName": "a2dp_connection_policy",
+            "affinity": "INTEGER",
+            "notNull": false
+          },
+          {
+            "fieldPath": "profileConnectionPolicies.a2dp_sink_connection_policy",
+            "columnName": "a2dp_sink_connection_policy",
+            "affinity": "INTEGER",
+            "notNull": false
+          },
+          {
+            "fieldPath": "profileConnectionPolicies.hfp_connection_policy",
+            "columnName": "hfp_connection_policy",
+            "affinity": "INTEGER",
+            "notNull": false
+          },
+          {
+            "fieldPath": "profileConnectionPolicies.hfp_client_connection_policy",
+            "columnName": "hfp_client_connection_policy",
+            "affinity": "INTEGER",
+            "notNull": false
+          },
+          {
+            "fieldPath": "profileConnectionPolicies.hid_host_connection_policy",
+            "columnName": "hid_host_connection_policy",
+            "affinity": "INTEGER",
+            "notNull": false
+          },
+          {
+            "fieldPath": "profileConnectionPolicies.pan_connection_policy",
+            "columnName": "pan_connection_policy",
+            "affinity": "INTEGER",
+            "notNull": false
+          },
+          {
+            "fieldPath": "profileConnectionPolicies.pbap_connection_policy",
+            "columnName": "pbap_connection_policy",
+            "affinity": "INTEGER",
+            "notNull": false
+          },
+          {
+            "fieldPath": "profileConnectionPolicies.pbap_client_connection_policy",
+            "columnName": "pbap_client_connection_policy",
+            "affinity": "INTEGER",
+            "notNull": false
+          },
+          {
+            "fieldPath": "profileConnectionPolicies.map_connection_policy",
+            "columnName": "map_connection_policy",
+            "affinity": "INTEGER",
+            "notNull": false
+          },
+          {
+            "fieldPath": "profileConnectionPolicies.sap_connection_policy",
+            "columnName": "sap_connection_policy",
+            "affinity": "INTEGER",
+            "notNull": false
+          },
+          {
+            "fieldPath": "profileConnectionPolicies.hearing_aid_connection_policy",
+            "columnName": "hearing_aid_connection_policy",
+            "affinity": "INTEGER",
+            "notNull": false
+          },
+          {
+            "fieldPath": "profileConnectionPolicies.hap_client_connection_policy",
+            "columnName": "hap_client_connection_policy",
+            "affinity": "INTEGER",
+            "notNull": false
+          },
+          {
+            "fieldPath": "profileConnectionPolicies.map_client_connection_policy",
+            "columnName": "map_client_connection_policy",
+            "affinity": "INTEGER",
+            "notNull": false
+          },
+          {
+            "fieldPath": "profileConnectionPolicies.le_audio_connection_policy",
+            "columnName": "le_audio_connection_policy",
+            "affinity": "INTEGER",
+            "notNull": false
+          },
+          {
+            "fieldPath": "profileConnectionPolicies.volume_control_connection_policy",
+            "columnName": "volume_control_connection_policy",
+            "affinity": "INTEGER",
+            "notNull": false
+          },
+          {
+            "fieldPath": "profileConnectionPolicies.csip_set_coordinator_connection_policy",
+            "columnName": "csip_set_coordinator_connection_policy",
+            "affinity": "INTEGER",
+            "notNull": false
+          },
+          {
+            "fieldPath": "profileConnectionPolicies.le_call_control_connection_policy",
+            "columnName": "le_call_control_connection_policy",
+            "affinity": "INTEGER",
+            "notNull": false
+          },
+          {
+            "fieldPath": "profileConnectionPolicies.bass_client_connection_policy",
+            "columnName": "bass_client_connection_policy",
+            "affinity": "INTEGER",
+            "notNull": false
+          },
+          {
+            "fieldPath": "profileConnectionPolicies.battery_connection_policy",
+            "columnName": "battery_connection_policy",
+            "affinity": "INTEGER",
+            "notNull": false
+          },
+          {
+            "fieldPath": "publicMetadata.manufacturer_name",
+            "columnName": "manufacturer_name",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "publicMetadata.model_name",
+            "columnName": "model_name",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "publicMetadata.software_version",
+            "columnName": "software_version",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "publicMetadata.hardware_version",
+            "columnName": "hardware_version",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "publicMetadata.companion_app",
+            "columnName": "companion_app",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "publicMetadata.main_icon",
+            "columnName": "main_icon",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "publicMetadata.is_untethered_headset",
+            "columnName": "is_untethered_headset",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "publicMetadata.untethered_left_icon",
+            "columnName": "untethered_left_icon",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "publicMetadata.untethered_right_icon",
+            "columnName": "untethered_right_icon",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "publicMetadata.untethered_case_icon",
+            "columnName": "untethered_case_icon",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "publicMetadata.untethered_left_battery",
+            "columnName": "untethered_left_battery",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "publicMetadata.untethered_right_battery",
+            "columnName": "untethered_right_battery",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "publicMetadata.untethered_case_battery",
+            "columnName": "untethered_case_battery",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "publicMetadata.untethered_left_charging",
+            "columnName": "untethered_left_charging",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "publicMetadata.untethered_right_charging",
+            "columnName": "untethered_right_charging",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "publicMetadata.untethered_case_charging",
+            "columnName": "untethered_case_charging",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "publicMetadata.enhanced_settings_ui_uri",
+            "columnName": "enhanced_settings_ui_uri",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "publicMetadata.device_type",
+            "columnName": "device_type",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "publicMetadata.main_battery",
+            "columnName": "main_battery",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "publicMetadata.main_charging",
+            "columnName": "main_charging",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "publicMetadata.main_low_battery_threshold",
+            "columnName": "main_low_battery_threshold",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "publicMetadata.untethered_left_low_battery_threshold",
+            "columnName": "untethered_left_low_battery_threshold",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "publicMetadata.untethered_right_low_battery_threshold",
+            "columnName": "untethered_right_low_battery_threshold",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "publicMetadata.untethered_case_low_battery_threshold",
+            "columnName": "untethered_case_low_battery_threshold",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "publicMetadata.spatial_audio",
+            "columnName": "spatial_audio",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "publicMetadata.fastpair_customized",
+            "columnName": "fastpair_customized",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "publicMetadata.le_audio",
+            "columnName": "le_audio",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "audioPolicyMetadata.callEstablishAudioPolicy",
+            "columnName": "call_establish_audio_policy",
+            "affinity": "INTEGER",
+            "notNull": false
+          },
+          {
+            "fieldPath": "audioPolicyMetadata.connectingTimeAudioPolicy",
+            "columnName": "connecting_time_audio_policy",
+            "affinity": "INTEGER",
+            "notNull": false
+          },
+          {
+            "fieldPath": "audioPolicyMetadata.inBandRingtoneAudioPolicy",
+            "columnName": "in_band_ringtone_audio_policy",
+            "affinity": "INTEGER",
+            "notNull": false
+          }
+        ],
+        "primaryKey": {
+          "autoGenerate": false,
+          "columnNames": [
+            "address"
+          ]
+        },
+        "indices": [],
+        "foreignKeys": []
+      }
+    ],
+    "views": [],
+    "setupQueries": [
+      "CREATE TABLE IF NOT EXISTS room_master_table (id INTEGER PRIMARY KEY,identity_hash TEXT)",
+      "INSERT OR REPLACE INTO room_master_table (id,identity_hash) VALUES(42, '0b8549de3acad8b14fe6f7198206ea02')"
+    ]
+  }
+}
\ No newline at end of file
diff --git a/android/app/tests/unit/src/com/android/bluetooth/btservice/storage/schemas/com.android.bluetooth.btservice.storage.MetadataDatabase/117.json b/android/app/tests/unit/src/com/android/bluetooth/btservice/storage/schemas/com.android.bluetooth.btservice.storage.MetadataDatabase/117.json
new file mode 100644
index 0000000..d4c1f7e
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/btservice/storage/schemas/com.android.bluetooth.btservice.storage.MetadataDatabase/117.json
@@ -0,0 +1,382 @@
+{
+  "formatVersion": 1,
+  "database": {
+    "version": 117,
+    "identityHash": "b3363a857e6d4f3ece8ba92d57d52c26",
+    "entities": [
+      {
+        "tableName": "metadata",
+        "createSql": "CREATE TABLE IF NOT EXISTS `${TABLE_NAME}` (`address` TEXT NOT NULL, `migrated` INTEGER NOT NULL, `a2dpSupportsOptionalCodecs` INTEGER NOT NULL, `a2dpOptionalCodecsEnabled` INTEGER NOT NULL, `last_active_time` INTEGER NOT NULL, `is_active_a2dp_device` INTEGER NOT NULL, `preferred_output_only_profile` INTEGER NOT NULL, `preferred_duplex_profile` INTEGER NOT NULL, `a2dp_connection_policy` INTEGER, `a2dp_sink_connection_policy` INTEGER, `hfp_connection_policy` INTEGER, `hfp_client_connection_policy` INTEGER, `hid_host_connection_policy` INTEGER, `pan_connection_policy` INTEGER, `pbap_connection_policy` INTEGER, `pbap_client_connection_policy` INTEGER, `map_connection_policy` INTEGER, `sap_connection_policy` INTEGER, `hearing_aid_connection_policy` INTEGER, `hap_client_connection_policy` INTEGER, `map_client_connection_policy` INTEGER, `le_audio_connection_policy` INTEGER, `volume_control_connection_policy` INTEGER, `csip_set_coordinator_connection_policy` INTEGER, `le_call_control_connection_policy` INTEGER, `bass_client_connection_policy` INTEGER, `battery_connection_policy` INTEGER, `manufacturer_name` BLOB, `model_name` BLOB, `software_version` BLOB, `hardware_version` BLOB, `companion_app` BLOB, `main_icon` BLOB, `is_untethered_headset` BLOB, `untethered_left_icon` BLOB, `untethered_right_icon` BLOB, `untethered_case_icon` BLOB, `untethered_left_battery` BLOB, `untethered_right_battery` BLOB, `untethered_case_battery` BLOB, `untethered_left_charging` BLOB, `untethered_right_charging` BLOB, `untethered_case_charging` BLOB, `enhanced_settings_ui_uri` BLOB, `device_type` BLOB, `main_battery` BLOB, `main_charging` BLOB, `main_low_battery_threshold` BLOB, `untethered_left_low_battery_threshold` BLOB, `untethered_right_low_battery_threshold` BLOB, `untethered_case_low_battery_threshold` BLOB, `spatial_audio` BLOB, `fastpair_customized` BLOB, `le_audio` BLOB, `gmcs_cccd` BLOB, `gtbs_cccd` BLOB, `call_establish_audio_policy` INTEGER, `connecting_time_audio_policy` INTEGER, `in_band_ringtone_audio_policy` INTEGER, PRIMARY KEY(`address`))",
+        "fields": [
+          {
+            "fieldPath": "address",
+            "columnName": "address",
+            "affinity": "TEXT",
+            "notNull": true
+          },
+          {
+            "fieldPath": "migrated",
+            "columnName": "migrated",
+            "affinity": "INTEGER",
+            "notNull": true
+          },
+          {
+            "fieldPath": "a2dpSupportsOptionalCodecs",
+            "columnName": "a2dpSupportsOptionalCodecs",
+            "affinity": "INTEGER",
+            "notNull": true
+          },
+          {
+            "fieldPath": "a2dpOptionalCodecsEnabled",
+            "columnName": "a2dpOptionalCodecsEnabled",
+            "affinity": "INTEGER",
+            "notNull": true
+          },
+          {
+            "fieldPath": "last_active_time",
+            "columnName": "last_active_time",
+            "affinity": "INTEGER",
+            "notNull": true
+          },
+          {
+            "fieldPath": "is_active_a2dp_device",
+            "columnName": "is_active_a2dp_device",
+            "affinity": "INTEGER",
+            "notNull": true
+          },
+          {
+            "fieldPath": "preferred_output_only_profile",
+            "columnName": "preferred_output_only_profile",
+            "affinity": "INTEGER",
+            "notNull": true
+          },
+          {
+            "fieldPath": "preferred_duplex_profile",
+            "columnName": "preferred_duplex_profile",
+            "affinity": "INTEGER",
+            "notNull": true
+          },
+          {
+            "fieldPath": "profileConnectionPolicies.a2dp_connection_policy",
+            "columnName": "a2dp_connection_policy",
+            "affinity": "INTEGER",
+            "notNull": false
+          },
+          {
+            "fieldPath": "profileConnectionPolicies.a2dp_sink_connection_policy",
+            "columnName": "a2dp_sink_connection_policy",
+            "affinity": "INTEGER",
+            "notNull": false
+          },
+          {
+            "fieldPath": "profileConnectionPolicies.hfp_connection_policy",
+            "columnName": "hfp_connection_policy",
+            "affinity": "INTEGER",
+            "notNull": false
+          },
+          {
+            "fieldPath": "profileConnectionPolicies.hfp_client_connection_policy",
+            "columnName": "hfp_client_connection_policy",
+            "affinity": "INTEGER",
+            "notNull": false
+          },
+          {
+            "fieldPath": "profileConnectionPolicies.hid_host_connection_policy",
+            "columnName": "hid_host_connection_policy",
+            "affinity": "INTEGER",
+            "notNull": false
+          },
+          {
+            "fieldPath": "profileConnectionPolicies.pan_connection_policy",
+            "columnName": "pan_connection_policy",
+            "affinity": "INTEGER",
+            "notNull": false
+          },
+          {
+            "fieldPath": "profileConnectionPolicies.pbap_connection_policy",
+            "columnName": "pbap_connection_policy",
+            "affinity": "INTEGER",
+            "notNull": false
+          },
+          {
+            "fieldPath": "profileConnectionPolicies.pbap_client_connection_policy",
+            "columnName": "pbap_client_connection_policy",
+            "affinity": "INTEGER",
+            "notNull": false
+          },
+          {
+            "fieldPath": "profileConnectionPolicies.map_connection_policy",
+            "columnName": "map_connection_policy",
+            "affinity": "INTEGER",
+            "notNull": false
+          },
+          {
+            "fieldPath": "profileConnectionPolicies.sap_connection_policy",
+            "columnName": "sap_connection_policy",
+            "affinity": "INTEGER",
+            "notNull": false
+          },
+          {
+            "fieldPath": "profileConnectionPolicies.hearing_aid_connection_policy",
+            "columnName": "hearing_aid_connection_policy",
+            "affinity": "INTEGER",
+            "notNull": false
+          },
+          {
+            "fieldPath": "profileConnectionPolicies.hap_client_connection_policy",
+            "columnName": "hap_client_connection_policy",
+            "affinity": "INTEGER",
+            "notNull": false
+          },
+          {
+            "fieldPath": "profileConnectionPolicies.map_client_connection_policy",
+            "columnName": "map_client_connection_policy",
+            "affinity": "INTEGER",
+            "notNull": false
+          },
+          {
+            "fieldPath": "profileConnectionPolicies.le_audio_connection_policy",
+            "columnName": "le_audio_connection_policy",
+            "affinity": "INTEGER",
+            "notNull": false
+          },
+          {
+            "fieldPath": "profileConnectionPolicies.volume_control_connection_policy",
+            "columnName": "volume_control_connection_policy",
+            "affinity": "INTEGER",
+            "notNull": false
+          },
+          {
+            "fieldPath": "profileConnectionPolicies.csip_set_coordinator_connection_policy",
+            "columnName": "csip_set_coordinator_connection_policy",
+            "affinity": "INTEGER",
+            "notNull": false
+          },
+          {
+            "fieldPath": "profileConnectionPolicies.le_call_control_connection_policy",
+            "columnName": "le_call_control_connection_policy",
+            "affinity": "INTEGER",
+            "notNull": false
+          },
+          {
+            "fieldPath": "profileConnectionPolicies.bass_client_connection_policy",
+            "columnName": "bass_client_connection_policy",
+            "affinity": "INTEGER",
+            "notNull": false
+          },
+          {
+            "fieldPath": "profileConnectionPolicies.battery_connection_policy",
+            "columnName": "battery_connection_policy",
+            "affinity": "INTEGER",
+            "notNull": false
+          },
+          {
+            "fieldPath": "publicMetadata.manufacturer_name",
+            "columnName": "manufacturer_name",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "publicMetadata.model_name",
+            "columnName": "model_name",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "publicMetadata.software_version",
+            "columnName": "software_version",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "publicMetadata.hardware_version",
+            "columnName": "hardware_version",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "publicMetadata.companion_app",
+            "columnName": "companion_app",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "publicMetadata.main_icon",
+            "columnName": "main_icon",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "publicMetadata.is_untethered_headset",
+            "columnName": "is_untethered_headset",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "publicMetadata.untethered_left_icon",
+            "columnName": "untethered_left_icon",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "publicMetadata.untethered_right_icon",
+            "columnName": "untethered_right_icon",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "publicMetadata.untethered_case_icon",
+            "columnName": "untethered_case_icon",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "publicMetadata.untethered_left_battery",
+            "columnName": "untethered_left_battery",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "publicMetadata.untethered_right_battery",
+            "columnName": "untethered_right_battery",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "publicMetadata.untethered_case_battery",
+            "columnName": "untethered_case_battery",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "publicMetadata.untethered_left_charging",
+            "columnName": "untethered_left_charging",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "publicMetadata.untethered_right_charging",
+            "columnName": "untethered_right_charging",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "publicMetadata.untethered_case_charging",
+            "columnName": "untethered_case_charging",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "publicMetadata.enhanced_settings_ui_uri",
+            "columnName": "enhanced_settings_ui_uri",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "publicMetadata.device_type",
+            "columnName": "device_type",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "publicMetadata.main_battery",
+            "columnName": "main_battery",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "publicMetadata.main_charging",
+            "columnName": "main_charging",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "publicMetadata.main_low_battery_threshold",
+            "columnName": "main_low_battery_threshold",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "publicMetadata.untethered_left_low_battery_threshold",
+            "columnName": "untethered_left_low_battery_threshold",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "publicMetadata.untethered_right_low_battery_threshold",
+            "columnName": "untethered_right_low_battery_threshold",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "publicMetadata.untethered_case_low_battery_threshold",
+            "columnName": "untethered_case_low_battery_threshold",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "publicMetadata.spatial_audio",
+            "columnName": "spatial_audio",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "publicMetadata.fastpair_customized",
+            "columnName": "fastpair_customized",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "publicMetadata.le_audio",
+            "columnName": "le_audio",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "publicMetadata.gmcs_cccd",
+            "columnName": "gmcs_cccd",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "publicMetadata.gtbs_cccd",
+            "columnName": "gtbs_cccd",
+            "affinity": "BLOB",
+            "notNull": false
+          },
+          {
+            "fieldPath": "audioPolicyMetadata.callEstablishAudioPolicy",
+            "columnName": "call_establish_audio_policy",
+            "affinity": "INTEGER",
+            "notNull": false
+          },
+          {
+            "fieldPath": "audioPolicyMetadata.connectingTimeAudioPolicy",
+            "columnName": "connecting_time_audio_policy",
+            "affinity": "INTEGER",
+            "notNull": false
+          },
+          {
+            "fieldPath": "audioPolicyMetadata.inBandRingtoneAudioPolicy",
+            "columnName": "in_band_ringtone_audio_policy",
+            "affinity": "INTEGER",
+            "notNull": false
+          }
+        ],
+        "primaryKey": {
+          "autoGenerate": false,
+          "columnNames": [
+            "address"
+          ]
+        },
+        "indices": [],
+        "foreignKeys": []
+      }
+    ],
+    "views": [],
+    "setupQueries": [
+      "CREATE TABLE IF NOT EXISTS room_master_table (id INTEGER PRIMARY KEY,identity_hash TEXT)",
+      "INSERT OR REPLACE INTO room_master_table (id,identity_hash) VALUES(42, 'b3363a857e6d4f3ece8ba92d57d52c26')"
+    ]
+  }
+}
\ No newline at end of file
diff --git a/android/app/tests/unit/src/com/android/bluetooth/csip/BluetoothCsisBinderTest.java b/android/app/tests/unit/src/com/android/bluetooth/csip/BluetoothCsisBinderTest.java
new file mode 100644
index 0000000..0432ed6
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/csip/BluetoothCsisBinderTest.java
@@ -0,0 +1,141 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.csip;
+
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import android.bluetooth.BluetoothAdapter;
+import android.bluetooth.BluetoothDevice;
+import android.bluetooth.BluetoothProfile;
+import android.bluetooth.IBluetoothCsipSetCoordinatorLockCallback;
+import android.content.AttributionSource;
+import android.os.ParcelUuid;
+
+import com.android.bluetooth.x.com.android.modules.utils.SynchronousResultReceiver;
+
+import org.junit.Before;
+import org.junit.Test;
+import org.mockito.Mock;
+import org.mockito.MockitoAnnotations;
+
+public class BluetoothCsisBinderTest {
+    private static final String TEST_DEVICE_ADDRESS = "00:00:00:00:00:00";
+
+    @Mock
+    private CsipSetCoordinatorService mService;
+
+    private AttributionSource mAttributionSource;
+    private BluetoothDevice mTestDevice;
+
+    private CsipSetCoordinatorService.BluetoothCsisBinder mBinder;
+
+    @Before
+    public void setUp() throws Exception {
+        MockitoAnnotations.initMocks(this);
+        mBinder = new CsipSetCoordinatorService.BluetoothCsisBinder(mService);
+        mAttributionSource = new AttributionSource.Builder(1).build();
+        mTestDevice = BluetoothAdapter.getDefaultAdapter().getRemoteDevice(TEST_DEVICE_ADDRESS);
+    }
+
+    @Test
+    public void connect() {
+        mBinder.connect(mTestDevice, mAttributionSource, SynchronousResultReceiver.get());
+        verify(mService).connect(mTestDevice);
+    }
+
+    @Test
+    public void disconnect() {
+        mBinder.disconnect(mTestDevice, mAttributionSource, SynchronousResultReceiver.get());
+        verify(mService).disconnect(mTestDevice);
+    }
+
+    @Test
+    public void getConnectedDevices() {
+        mBinder.getConnectedDevices(mAttributionSource, SynchronousResultReceiver.get());
+        verify(mService).getConnectedDevices();
+    }
+
+    @Test
+    public void getDevicesMatchingConnectionStates() {
+        int[] states = new int[] { BluetoothProfile.STATE_CONNECTED };
+        mBinder.getDevicesMatchingConnectionStates(states, mAttributionSource,
+                SynchronousResultReceiver.get());
+        verify(mService).getDevicesMatchingConnectionStates(states);
+    }
+
+    @Test
+    public void getConnectionState() {
+        mBinder.getConnectionState(mTestDevice, mAttributionSource,
+                SynchronousResultReceiver.get());
+        verify(mService).getConnectionState(mTestDevice);
+    }
+
+    @Test
+    public void setConnectionPolicy() {
+        int connectionPolicy = BluetoothProfile.CONNECTION_POLICY_ALLOWED;
+        mBinder.setConnectionPolicy(mTestDevice, connectionPolicy, mAttributionSource,
+                SynchronousResultReceiver.get());
+        verify(mService).setConnectionPolicy(mTestDevice, connectionPolicy);
+    }
+
+    @Test
+    public void getConnectionPolicy() {
+        mBinder.getConnectionPolicy(mTestDevice, mAttributionSource,
+                SynchronousResultReceiver.get());
+        verify(mService).getConnectionPolicy(mTestDevice);
+    }
+
+    @Test
+    public void lockGroup() {
+        int groupId = 100;
+        IBluetoothCsipSetCoordinatorLockCallback cb =
+                mock(IBluetoothCsipSetCoordinatorLockCallback.class);
+        mBinder.lockGroup(groupId, cb, mAttributionSource, SynchronousResultReceiver.get());
+        verify(mService).lockGroup(groupId, cb);
+    }
+
+    @Test
+    public void unlockGroup() {
+        ParcelUuid uuid = ParcelUuid.fromString("0000110A-0000-1000-8000-00805F9B34FB");
+        mBinder.unlockGroup(uuid, mAttributionSource, SynchronousResultReceiver.get());
+        verify(mService).unlockGroup(uuid.getUuid());
+    }
+
+    @Test
+    public void getAllGroupIds() {
+        ParcelUuid uuid = ParcelUuid.fromString("0000110A-0000-1000-8000-00805F9B34FB");
+        mBinder.getAllGroupIds(uuid, mAttributionSource, SynchronousResultReceiver.get());
+        verify(mService).getAllGroupIds(uuid);
+    }
+
+    @Test
+    public void getGroupUuidMapByDevice() {
+        mBinder.getGroupUuidMapByDevice(mTestDevice, mAttributionSource,
+                SynchronousResultReceiver.get());
+        verify(mService).getGroupUuidMapByDevice(mTestDevice);
+    }
+
+    @Test
+    public void getDesiredGroupSize() {
+        int groupId = 100;
+        mBinder.getDesiredGroupSize(groupId, mAttributionSource,
+                SynchronousResultReceiver.get());
+        verify(mService).getDesiredGroupSize(groupId);
+    }
+}
diff --git a/android/app/tests/unit/src/com/android/bluetooth/csip/CsipSetCoordinatorServiceTest.java b/android/app/tests/unit/src/com/android/bluetooth/csip/CsipSetCoordinatorServiceTest.java
index caac745..4c7cc43 100644
--- a/android/app/tests/unit/src/com/android/bluetooth/csip/CsipSetCoordinatorServiceTest.java
+++ b/android/app/tests/unit/src/com/android/bluetooth/csip/CsipSetCoordinatorServiceTest.java
@@ -57,6 +57,8 @@
 @MediumTest
 @RunWith(AndroidJUnit4.class)
 public class CsipSetCoordinatorServiceTest {
+    private final String mFlagDexmarker = System.getProperty("dexmaker.share_classloader", "false");
+
     public final ServiceTestRule mServiceRule = new ServiceTestRule();
     private Context mTargetContext;
     private BluetoothAdapter mAdapter;
@@ -73,11 +75,14 @@
     @Mock private AdapterService mAdapterService;
     @Mock private DatabaseManager mDatabaseManager;
     @Mock private CsipSetCoordinatorNativeInterface mCsipSetCoordinatorNativeInterface;
-    @Mock private CsipSetCoordinatorService mCsipSetCoordinatorService;
     @Mock private IBluetoothCsipSetCoordinatorLockCallback mCsipSetCoordinatorLockCallback;
 
     @Before
     public void setUp() throws Exception {
+        if (!mFlagDexmarker.equals("true")) {
+            System.setProperty("dexmaker.share_classloader", "true");
+        }
+
         mTargetContext = InstrumentationRegistry.getTargetContext();
         if (Looper.myLooper() == null) {
             Looper.prepare();
@@ -132,14 +137,18 @@
 
     @After
     public void tearDown() throws Exception {
-        if (mService == null) {
-            return;
+        if (!mFlagDexmarker.equals("true")) {
+            System.setProperty("dexmaker.share_classloader", mFlagDexmarker);
         }
 
         if (Looper.myLooper() == null) {
             return;
         }
 
+        if (mService == null) {
+            return;
+        }
+
         stopService();
         mTargetContext.unregisterReceiver(mCsipSetCoordinatorIntentReceiver);
         TestUtils.clearAdapterService(mAdapterService);
@@ -523,6 +532,25 @@
                 group_id, intent.getIntExtra(BluetoothCsipSetCoordinator.EXTRA_CSIS_GROUP_ID, -1));
     }
 
+    @Test
+    public void testDump_doesNotCrash() {
+        // Update the device policy so okToConnect() returns true
+        when(mDatabaseManager.getProfileConnectionPolicy(
+                mTestDevice, BluetoothProfile.CSIP_SET_COORDINATOR))
+                .thenReturn(BluetoothProfile.CONNECTION_POLICY_ALLOWED);
+        doReturn(true).when(mCsipSetCoordinatorNativeInterface).connect(any(BluetoothDevice.class));
+        doReturn(true)
+                .when(mCsipSetCoordinatorNativeInterface)
+                .disconnect(any(BluetoothDevice.class));
+        doReturn(new ParcelUuid[] {BluetoothUuid.COORDINATED_SET})
+                .when(mAdapterService)
+                .getRemoteUuids(any(BluetoothDevice.class));
+        // add state machines for testing dump()
+        mService.connect(mTestDevice);
+
+        mService.dump(new StringBuilder());
+    }
+
     /**
      * Helper function to test ConnectionStateIntent() method
      */
diff --git a/android/app/tests/unit/src/com/android/bluetooth/csip/CsipSetCoordinatorStateMachineTest.java b/android/app/tests/unit/src/com/android/bluetooth/csip/CsipSetCoordinatorStateMachineTest.java
index 8a08dfe..8ae5f93 100644
--- a/android/app/tests/unit/src/com/android/bluetooth/csip/CsipSetCoordinatorStateMachineTest.java
+++ b/android/app/tests/unit/src/com/android/bluetooth/csip/CsipSetCoordinatorStateMachineTest.java
@@ -17,6 +17,11 @@
 
 package com.android.bluetooth.csip;
 
+import static android.bluetooth.BluetoothProfile.STATE_CONNECTED;
+import static android.bluetooth.BluetoothProfile.STATE_CONNECTING;
+import static android.bluetooth.BluetoothProfile.STATE_DISCONNECTED;
+import static android.bluetooth.BluetoothProfile.STATE_DISCONNECTING;
+
 import static org.mockito.ArgumentMatchers.any;
 import static org.mockito.ArgumentMatchers.anyString;
 import static org.mockito.ArgumentMatchers.eq;
@@ -25,9 +30,10 @@
 import android.bluetooth.BluetoothAdapter;
 import android.bluetooth.BluetoothDevice;
 import android.bluetooth.BluetoothProfile;
-import android.content.Context;
 import android.content.Intent;
 import android.os.HandlerThread;
+import android.os.Looper;
+import android.os.Message;
 import android.test.suitebuilder.annotation.MediumTest;
 
 import androidx.test.InstrumentationRegistry;
@@ -42,16 +48,18 @@
 import org.junit.runner.RunWith;
 import org.mockito.ArgumentCaptor;
 import org.mockito.Mock;
+import org.mockito.Mockito;
 import org.mockito.MockitoAnnotations;
 
 @MediumTest
 @RunWith(AndroidJUnit4.class)
 public class CsipSetCoordinatorStateMachineTest {
-    private Context mTargetContext;
+    private final String mFlagDexmarker = System.getProperty("dexmaker.share_classloader", "false");
+
     private BluetoothAdapter mAdapter;
     private BluetoothDevice mTestDevice;
     private HandlerThread mHandlerThread;
-    private CsipSetCoordinatorStateMachine mStateMachine;
+    private CsipSetCoordinatorStateMachineWrapper mStateMachine;
     private static final int TIMEOUT_MS = 1000;
 
     @Mock private AdapterService mAdapterService;
@@ -60,7 +68,10 @@
 
     @Before
     public void setUp() throws Exception {
-        mTargetContext = InstrumentationRegistry.getTargetContext();
+        if (!mFlagDexmarker.equals("true")) {
+            System.setProperty("dexmaker.share_classloader", "true");
+        }
+
         // Set up mocks and test assets
         MockitoAnnotations.initMocks(this);
         TestUtils.setAdapterService(mAdapterService);
@@ -73,8 +84,8 @@
         // Set up thread and looper
         mHandlerThread = new HandlerThread("CsipSetCoordinatorServiceTestHandlerThread");
         mHandlerThread.start();
-        mStateMachine = new CsipSetCoordinatorStateMachine(
-                mTestDevice, mService, mNativeInterface, mHandlerThread.getLooper());
+        mStateMachine = spy(new CsipSetCoordinatorStateMachineWrapper(
+                mTestDevice, mService, mNativeInterface, mHandlerThread.getLooper()));
 
         // Override the timeout value to speed up the test
         CsipSetCoordinatorStateMachine.sConnectTimeoutMs = 1000;
@@ -83,6 +94,9 @@
 
     @After
     public void tearDown() throws Exception {
+        if (!mFlagDexmarker.equals("true")) {
+            System.setProperty("dexmaker.share_classloader", mFlagDexmarker);
+        }
         mStateMachine.doQuit();
         mHandlerThread.quit();
         TestUtils.clearAdapterService(mAdapterService);
@@ -94,7 +108,7 @@
     @Test
     public void testDefaultDisconnectedState() {
         Assert.assertEquals(
-                BluetoothProfile.STATE_DISCONNECTED, mStateMachine.getConnectionState());
+                STATE_DISCONNECTED, mStateMachine.getConnectionState());
     }
 
     /**
@@ -146,7 +160,7 @@
         ArgumentCaptor<Intent> intentArgument1 = ArgumentCaptor.forClass(Intent.class);
         verify(mService, timeout(TIMEOUT_MS).times(1))
                 .sendBroadcast(intentArgument1.capture(), anyString());
-        Assert.assertEquals(BluetoothProfile.STATE_CONNECTING,
+        Assert.assertEquals(STATE_CONNECTING,
                 intentArgument1.getValue().getIntExtra(BluetoothProfile.EXTRA_STATE, -1));
 
         // Check that we are in Connecting state
@@ -187,7 +201,7 @@
         ArgumentCaptor<Intent> intentArgument1 = ArgumentCaptor.forClass(Intent.class);
         verify(mService, timeout(TIMEOUT_MS).times(1))
                 .sendBroadcast(intentArgument1.capture(), anyString());
-        Assert.assertEquals(BluetoothProfile.STATE_CONNECTING,
+        Assert.assertEquals(STATE_CONNECTING,
                 intentArgument1.getValue().getIntExtra(BluetoothProfile.EXTRA_STATE, -1));
 
         // Check that we are in Connecting state
@@ -198,7 +212,7 @@
         ArgumentCaptor<Intent> intentArgument2 = ArgumentCaptor.forClass(Intent.class);
         verify(mService, timeout(CsipSetCoordinatorStateMachine.sConnectTimeoutMs * 2).times(2))
                 .sendBroadcast(intentArgument2.capture(), anyString());
-        Assert.assertEquals(BluetoothProfile.STATE_DISCONNECTED,
+        Assert.assertEquals(STATE_DISCONNECTED,
                 intentArgument2.getValue().getIntExtra(BluetoothProfile.EXTRA_STATE, -1));
 
         // Check that we are in Disconnected state
@@ -227,7 +241,7 @@
         ArgumentCaptor<Intent> intentArgument1 = ArgumentCaptor.forClass(Intent.class);
         verify(mService, timeout(TIMEOUT_MS).times(1))
                 .sendBroadcast(intentArgument1.capture(), anyString());
-        Assert.assertEquals(BluetoothProfile.STATE_CONNECTING,
+        Assert.assertEquals(STATE_CONNECTING,
                 intentArgument1.getValue().getIntExtra(BluetoothProfile.EXTRA_STATE, -1));
 
         // Check that we are in Connecting state
@@ -238,7 +252,7 @@
         ArgumentCaptor<Intent> intentArgument2 = ArgumentCaptor.forClass(Intent.class);
         verify(mService, timeout(CsipSetCoordinatorStateMachine.sConnectTimeoutMs * 2).times(2))
                 .sendBroadcast(intentArgument2.capture(), anyString());
-        Assert.assertEquals(BluetoothProfile.STATE_DISCONNECTED,
+        Assert.assertEquals(STATE_DISCONNECTED,
                 intentArgument2.getValue().getIntExtra(BluetoothProfile.EXTRA_STATE, -1));
 
         // Check that we are in Disconnected state
@@ -246,4 +260,427 @@
                 IsInstanceOf.instanceOf(CsipSetCoordinatorStateMachine.Disconnected.class));
         verify(mNativeInterface).disconnect(eq(mTestDevice));
     }
+
+    @Test
+    public void testGetDevice() {
+        Assert.assertEquals(mTestDevice, mStateMachine.getDevice());
+    }
+
+    @Test
+    public void testIsConnected() {
+        Assert.assertFalse(mStateMachine.isConnected());
+
+        initToConnectedState();
+        Assert.assertTrue(mStateMachine.isConnected());
+    }
+
+    @Test
+    public void testDumpDoesNotCrash() {
+        mStateMachine.dump(new StringBuilder());
+    }
+
+    @Test
+    public void testProcessDisconnectMessage_onDisconnectedState() {
+        mStateMachine.sendMessage(CsipSetCoordinatorStateMachine.DISCONNECT);
+        TestUtils.waitForLooperToFinishScheduledTask(mHandlerThread.getLooper());
+        Assert.assertEquals(STATE_DISCONNECTED, mStateMachine.getConnectionState());
+    }
+
+    @Test
+    public void testProcessConnectMessage_onDisconnectedState() {
+        allowConnection(false);
+        mStateMachine.sendMessage(CsipSetCoordinatorStateMachine.CONNECT);
+        TestUtils.waitForLooperToFinishScheduledTask(mHandlerThread.getLooper());
+        Assert.assertEquals(STATE_DISCONNECTED, mStateMachine.getConnectionState());
+
+        allowConnection(false);
+        mStateMachine.sendMessage(CsipSetCoordinatorStateMachine.CONNECT);
+        TestUtils.waitForLooperToFinishScheduledTask(mHandlerThread.getLooper());
+        Assert.assertEquals(STATE_DISCONNECTED, mStateMachine.getConnectionState());
+
+        allowConnection(true);
+        doReturn(true).when(mNativeInterface).connect(any(BluetoothDevice.class));
+        sendMessageAndVerifyTransition(
+                mStateMachine.obtainMessage(CsipSetCoordinatorStateMachine.CONNECT),
+                CsipSetCoordinatorStateMachine.Connecting.class);
+    }
+
+    @Test
+    public void testStackEvent_withoutStateChange_onDisconnectedState() {
+        allowConnection(false);
+
+        CsipSetCoordinatorStackEvent event = new CsipSetCoordinatorStackEvent(-1);
+        mStateMachine.sendMessage(CsipSetCoordinatorStateMachine.STACK_EVENT, event);
+        TestUtils.waitForLooperToFinishScheduledTask(mHandlerThread.getLooper());
+        Assert.assertEquals(STATE_DISCONNECTED, mStateMachine.getConnectionState());
+
+        event = new CsipSetCoordinatorStackEvent(
+                CsipSetCoordinatorStackEvent.EVENT_TYPE_CONNECTION_STATE_CHANGED);
+        event.valueInt1 = CsipSetCoordinatorStackEvent.CONNECTION_STATE_DISCONNECTED;
+        mStateMachine.sendMessage(CsipSetCoordinatorStateMachine.STACK_EVENT, event);
+        TestUtils.waitForLooperToFinishScheduledTask(mHandlerThread.getLooper());
+        Assert.assertEquals(STATE_DISCONNECTED, mStateMachine.getConnectionState());
+
+        event = new CsipSetCoordinatorStackEvent(
+                CsipSetCoordinatorStackEvent.EVENT_TYPE_CONNECTION_STATE_CHANGED);
+        event.valueInt1 = CsipSetCoordinatorStackEvent.CONNECTION_STATE_CONNECTING;
+        mStateMachine.sendMessage(CsipSetCoordinatorStateMachine.STACK_EVENT, event);
+        TestUtils.waitForLooperToFinishScheduledTask(mHandlerThread.getLooper());
+        Assert.assertEquals(STATE_DISCONNECTED, mStateMachine.getConnectionState());
+        verify(mNativeInterface).disconnect(mTestDevice);
+
+        Mockito.clearInvocations(mNativeInterface);
+        event = new CsipSetCoordinatorStackEvent(
+                CsipSetCoordinatorStackEvent.EVENT_TYPE_CONNECTION_STATE_CHANGED);
+        event.valueInt1 = CsipSetCoordinatorStackEvent.CONNECTION_STATE_CONNECTED;
+        mStateMachine.sendMessage(CsipSetCoordinatorStateMachine.STACK_EVENT, event);
+        TestUtils.waitForLooperToFinishScheduledTask(mHandlerThread.getLooper());
+        Assert.assertEquals(STATE_DISCONNECTED, mStateMachine.getConnectionState());
+        verify(mNativeInterface).disconnect(mTestDevice);
+
+        event = new CsipSetCoordinatorStackEvent(
+                CsipSetCoordinatorStackEvent.EVENT_TYPE_CONNECTION_STATE_CHANGED);
+        event.valueInt1 = CsipSetCoordinatorStackEvent.CONNECTION_STATE_DISCONNECTING;
+        mStateMachine.sendMessage(CsipSetCoordinatorStateMachine.STACK_EVENT, event);
+        TestUtils.waitForLooperToFinishScheduledTask(mHandlerThread.getLooper());
+        Assert.assertEquals(STATE_DISCONNECTED, mStateMachine.getConnectionState());
+
+        event = new CsipSetCoordinatorStackEvent(
+                CsipSetCoordinatorStackEvent.EVENT_TYPE_CONNECTION_STATE_CHANGED);
+        event.valueInt1 = -1;
+        mStateMachine.sendMessage(CsipSetCoordinatorStateMachine.STACK_EVENT, event);
+        TestUtils.waitForLooperToFinishScheduledTask(mHandlerThread.getLooper());
+        Assert.assertEquals(STATE_DISCONNECTED, mStateMachine.getConnectionState());
+    }
+
+    @Test
+    public void testStackEvent_toConnectingState_onDisconnectedState() {
+        allowConnection(true);
+        CsipSetCoordinatorStackEvent event = new CsipSetCoordinatorStackEvent(
+                CsipSetCoordinatorStackEvent.EVENT_TYPE_CONNECTION_STATE_CHANGED);
+        event.valueInt1 = CsipSetCoordinatorStackEvent.CONNECTION_STATE_CONNECTING;
+        sendMessageAndVerifyTransition(
+                mStateMachine.obtainMessage(CsipSetCoordinatorStateMachine.STACK_EVENT, event),
+                CsipSetCoordinatorStateMachine.Connecting.class);
+    }
+
+    @Test
+    public void testStackEvent_toConnectedState_onDisconnectedState() {
+        allowConnection(true);
+        CsipSetCoordinatorStackEvent event = new CsipSetCoordinatorStackEvent(
+                CsipSetCoordinatorStackEvent.EVENT_TYPE_CONNECTION_STATE_CHANGED);
+        event.valueInt1 = CsipSetCoordinatorStackEvent.CONNECTION_STATE_CONNECTED;
+        sendMessageAndVerifyTransition(
+                mStateMachine.obtainMessage(CsipSetCoordinatorStateMachine.STACK_EVENT, event),
+                CsipSetCoordinatorStateMachine.Connected.class);
+    }
+
+    @Test
+    public void testProcessConnectMessage_onConnectingState() {
+        initToConnectingState();
+        mStateMachine.sendMessage(CsipSetCoordinatorStateMachine.CONNECT);
+        TestUtils.waitForLooperToFinishScheduledTask(mHandlerThread.getLooper());
+        Assert.assertTrue(mStateMachine.doesSuperHaveDeferredMessages(
+                CsipSetCoordinatorStateMachine.CONNECT));
+    }
+
+    @Test
+    public void testProcessConnectTimeoutMessage_onConnectingState() {
+        initToConnectingState();
+        Message msg = mStateMachine.obtainMessage(CsipSetCoordinatorStateMachine.CONNECT_TIMEOUT);
+        sendMessageAndVerifyTransition(msg, CsipSetCoordinatorStateMachine.Disconnected.class);
+    }
+
+    @Test
+    public void testProcessDisconnectMessage_onConnectingState() {
+        initToConnectingState();
+        Message msg = mStateMachine.obtainMessage(CsipSetCoordinatorStateMachine.DISCONNECT);
+        sendMessageAndVerifyTransition(msg, CsipSetCoordinatorStateMachine.Disconnected.class);
+    }
+
+    @Test
+    public void testStackEvent_withoutStateChange_onConnectingState() {
+        initToConnectingState();
+        CsipSetCoordinatorStackEvent event = new CsipSetCoordinatorStackEvent(-1);
+        mStateMachine.sendMessage(CsipSetCoordinatorStateMachine.STACK_EVENT, event);
+        TestUtils.waitForLooperToFinishScheduledTask(mHandlerThread.getLooper());
+        Assert.assertEquals(STATE_CONNECTING, mStateMachine.getConnectionState());
+
+        event = new CsipSetCoordinatorStackEvent(
+                CsipSetCoordinatorStackEvent.EVENT_TYPE_CONNECTION_STATE_CHANGED);
+        event.valueInt1 = CsipSetCoordinatorStackEvent.CONNECTION_STATE_CONNECTING;
+        mStateMachine.sendMessage(CsipSetCoordinatorStateMachine.STACK_EVENT, event);
+        TestUtils.waitForLooperToFinishScheduledTask(mHandlerThread.getLooper());
+        Assert.assertEquals(STATE_CONNECTING, mStateMachine.getConnectionState());
+
+        event = new CsipSetCoordinatorStackEvent(
+                CsipSetCoordinatorStackEvent.EVENT_TYPE_CONNECTION_STATE_CHANGED);
+        event.valueInt1 = 10000;
+        mStateMachine.sendMessage(CsipSetCoordinatorStateMachine.STACK_EVENT, event);
+        TestUtils.waitForLooperToFinishScheduledTask(mHandlerThread.getLooper());
+        Assert.assertEquals(STATE_CONNECTING, mStateMachine.getConnectionState());
+    }
+
+    @Test
+    public void testStackEvent_toDisconnectedState_onConnectingState() {
+        initToConnectingState();
+        CsipSetCoordinatorStackEvent event = new CsipSetCoordinatorStackEvent(
+                CsipSetCoordinatorStackEvent.EVENT_TYPE_CONNECTION_STATE_CHANGED);
+        event.valueInt1 = CsipSetCoordinatorStackEvent.CONNECTION_STATE_DISCONNECTED;
+        sendMessageAndVerifyTransition(
+                mStateMachine.obtainMessage(CsipSetCoordinatorStateMachine.STACK_EVENT, event),
+                CsipSetCoordinatorStateMachine.Disconnected.class);
+    }
+
+    @Test
+    public void testStackEvent_toConnectedState_onConnectingState() {
+        initToConnectingState();
+        CsipSetCoordinatorStackEvent event = new CsipSetCoordinatorStackEvent(
+                CsipSetCoordinatorStackEvent.EVENT_TYPE_CONNECTION_STATE_CHANGED);
+        event.valueInt1 = CsipSetCoordinatorStackEvent.CONNECTION_STATE_CONNECTED;
+        sendMessageAndVerifyTransition(
+                mStateMachine.obtainMessage(CsipSetCoordinatorStateMachine.STACK_EVENT, event),
+                CsipSetCoordinatorStateMachine.Connected.class);
+    }
+
+    @Test
+    public void testStackEvent_toDisconnectingState_onConnectingState() {
+        initToConnectingState();
+        CsipSetCoordinatorStackEvent event = new CsipSetCoordinatorStackEvent(
+                CsipSetCoordinatorStackEvent.EVENT_TYPE_CONNECTION_STATE_CHANGED);
+        event.valueInt1 = CsipSetCoordinatorStackEvent.CONNECTION_STATE_DISCONNECTING;
+        sendMessageAndVerifyTransition(
+                mStateMachine.obtainMessage(CsipSetCoordinatorStateMachine.STACK_EVENT, event),
+                CsipSetCoordinatorStateMachine.Disconnecting.class);
+    }
+
+    @Test
+    public void testProcessConnectMessage_onConnectedState() {
+        initToConnectedState();
+        mStateMachine.sendMessage(CsipSetCoordinatorStateMachine.CONNECT);
+        TestUtils.waitForLooperToFinishScheduledTask(mHandlerThread.getLooper());
+        Assert.assertEquals(STATE_CONNECTED, mStateMachine.getConnectionState());
+    }
+
+    @Test
+    public void testProcessDisconnectMessage_onConnectedState() {
+        initToConnectedState();
+        doReturn(true).when(mNativeInterface).disconnect(any(BluetoothDevice.class));
+        sendMessageAndVerifyTransition(
+                mStateMachine.obtainMessage(CsipSetCoordinatorStateMachine.DISCONNECT),
+                CsipSetCoordinatorStateMachine.Disconnecting.class);
+    }
+
+    @Test
+    public void testProcessDisconnectMessage_onConnectedState_withNativeError() {
+        initToConnectedState();
+        doReturn(false).when(mNativeInterface).disconnect(any(BluetoothDevice.class));
+        sendMessageAndVerifyTransition(
+                mStateMachine.obtainMessage(CsipSetCoordinatorStateMachine.DISCONNECT),
+                CsipSetCoordinatorStateMachine.Disconnected.class);
+    }
+
+    @Test
+    public void testStackEvent_withoutStateChange_onConnectedState() {
+        initToConnectedState();
+        CsipSetCoordinatorStackEvent event = new CsipSetCoordinatorStackEvent(-1);
+        mStateMachine.sendMessage(CsipSetCoordinatorStateMachine.STACK_EVENT, event);
+        TestUtils.waitForLooperToFinishScheduledTask(mHandlerThread.getLooper());
+        Assert.assertEquals(STATE_CONNECTED, mStateMachine.getConnectionState());
+
+        event = new CsipSetCoordinatorStackEvent(
+                CsipSetCoordinatorStackEvent.EVENT_TYPE_CONNECTION_STATE_CHANGED);
+        event.valueInt1 = CsipSetCoordinatorStackEvent.CONNECTION_STATE_CONNECTING;
+        mStateMachine.sendMessage(CsipSetCoordinatorStateMachine.STACK_EVENT, event);
+        TestUtils.waitForLooperToFinishScheduledTask(mHandlerThread.getLooper());
+        Assert.assertEquals(STATE_CONNECTED, mStateMachine.getConnectionState());
+    }
+
+    @Test
+    public void testStackEvent_toDisconnectedState_onConnectedState() {
+        initToConnectedState();
+        CsipSetCoordinatorStackEvent event = new CsipSetCoordinatorStackEvent(
+                CsipSetCoordinatorStackEvent.EVENT_TYPE_CONNECTION_STATE_CHANGED);
+        event.valueInt1 = CsipSetCoordinatorStackEvent.CONNECTION_STATE_DISCONNECTED;
+        sendMessageAndVerifyTransition(
+                mStateMachine.obtainMessage(CsipSetCoordinatorStateMachine.STACK_EVENT, event),
+                CsipSetCoordinatorStateMachine.Disconnected.class);
+    }
+
+    @Test
+    public void testStackEvent_toDisconnectingState_onConnectedState() {
+        initToConnectedState();
+        CsipSetCoordinatorStackEvent event = new CsipSetCoordinatorStackEvent(
+                CsipSetCoordinatorStackEvent.EVENT_TYPE_CONNECTION_STATE_CHANGED);
+        event.valueInt1 = CsipSetCoordinatorStackEvent.CONNECTION_STATE_DISCONNECTING;
+        sendMessageAndVerifyTransition(
+                mStateMachine.obtainMessage(CsipSetCoordinatorStateMachine.STACK_EVENT, event),
+                CsipSetCoordinatorStateMachine.Disconnecting.class);
+    }
+
+    @Test
+    public void testProcessConnectMessage_onDisconnectingState() {
+        initToDisconnectingState();
+        Message msg = mStateMachine.obtainMessage(CsipSetCoordinatorStateMachine.CONNECT);
+        mStateMachine.sendMessage(msg);
+        TestUtils.waitForLooperToFinishScheduledTask(mHandlerThread.getLooper());
+        verify(mStateMachine).deferMessage(msg);
+    }
+
+    @Test
+    public void testProcessConnectTimeoutMessage_onDisconnectingState() {
+        initToConnectingState();
+        Message msg = mStateMachine.obtainMessage(CsipSetCoordinatorStateMachine.CONNECT_TIMEOUT);
+        sendMessageAndVerifyTransition(msg, CsipSetCoordinatorStateMachine.Disconnected.class);
+    }
+
+    @Test
+    public void testProcessDisconnectMessage_onDisconnectingState() {
+        initToDisconnectingState();
+        Message msg = mStateMachine.obtainMessage(CsipSetCoordinatorStateMachine.DISCONNECT);
+        mStateMachine.sendMessage(msg);
+        TestUtils.waitForLooperToFinishScheduledTask(mHandlerThread.getLooper());
+        verify(mStateMachine).deferMessage(msg);
+    }
+
+    @Test
+    public void testStackEvent_withoutStateChange_onDisconnectingState() {
+        initToDisconnectingState();
+        CsipSetCoordinatorStackEvent event = new CsipSetCoordinatorStackEvent(-1);
+        mStateMachine.sendMessage(CsipSetCoordinatorStateMachine.STACK_EVENT, event);
+        TestUtils.waitForLooperToFinishScheduledTask(mHandlerThread.getLooper());
+        Assert.assertEquals(STATE_DISCONNECTING, mStateMachine.getConnectionState());
+
+        allowConnection(false);
+        event = new CsipSetCoordinatorStackEvent(
+                CsipSetCoordinatorStackEvent.EVENT_TYPE_CONNECTION_STATE_CHANGED);
+        event.valueInt1 = CsipSetCoordinatorStackEvent.CONNECTION_STATE_CONNECTED;
+        mStateMachine.sendMessage(CsipSetCoordinatorStateMachine.STACK_EVENT, event);
+        TestUtils.waitForLooperToFinishScheduledTask(mHandlerThread.getLooper());
+        verify(mNativeInterface).disconnect(any());
+
+        Mockito.clearInvocations(mNativeInterface);
+        event = new CsipSetCoordinatorStackEvent(
+                CsipSetCoordinatorStackEvent.EVENT_TYPE_CONNECTION_STATE_CHANGED);
+        event.valueInt1 = CsipSetCoordinatorStackEvent.CONNECTION_STATE_CONNECTING;
+        mStateMachine.sendMessage(CsipSetCoordinatorStateMachine.STACK_EVENT, event);
+        TestUtils.waitForLooperToFinishScheduledTask(mHandlerThread.getLooper());
+        verify(mNativeInterface).disconnect(any());
+
+        event = new CsipSetCoordinatorStackEvent(
+                CsipSetCoordinatorStackEvent.EVENT_TYPE_CONNECTION_STATE_CHANGED);
+        event.valueInt1 = CsipSetCoordinatorStackEvent.CONNECTION_STATE_DISCONNECTING;
+        mStateMachine.sendMessage(CsipSetCoordinatorStateMachine.STACK_EVENT, event);
+        TestUtils.waitForLooperToFinishScheduledTask(mHandlerThread.getLooper());
+        Assert.assertEquals(STATE_DISCONNECTING, mStateMachine.getConnectionState());
+
+        event = new CsipSetCoordinatorStackEvent(
+                CsipSetCoordinatorStackEvent.EVENT_TYPE_CONNECTION_STATE_CHANGED);
+        event.valueInt1 = 10000;
+        mStateMachine.sendMessage(CsipSetCoordinatorStateMachine.STACK_EVENT, event);
+        TestUtils.waitForLooperToFinishScheduledTask(mHandlerThread.getLooper());
+        Assert.assertEquals(STATE_DISCONNECTING, mStateMachine.getConnectionState());
+    }
+
+    @Test
+    public void testStackEvent_toConnectedState_onDisconnectingState() {
+        initToDisconnectingState();
+        allowConnection(true);
+        CsipSetCoordinatorStackEvent event = new CsipSetCoordinatorStackEvent(
+                CsipSetCoordinatorStackEvent.EVENT_TYPE_CONNECTION_STATE_CHANGED);
+        event.valueInt1 = CsipSetCoordinatorStackEvent.CONNECTION_STATE_CONNECTED;
+        sendMessageAndVerifyTransition(
+                mStateMachine.obtainMessage(CsipSetCoordinatorStateMachine.STACK_EVENT, event),
+                CsipSetCoordinatorStateMachine.Connected.class);
+    }
+
+    @Test
+    public void testStackEvent_toConnectedState_butNotAllowed_onDisconnectingState() {
+        initToDisconnectingState();
+        allowConnection(false);
+        CsipSetCoordinatorStackEvent event = new CsipSetCoordinatorStackEvent(
+                CsipSetCoordinatorStackEvent.EVENT_TYPE_CONNECTION_STATE_CHANGED);
+        event.valueInt1 = CsipSetCoordinatorStackEvent.CONNECTION_STATE_CONNECTED;
+        mStateMachine.sendMessage(CsipSetCoordinatorStateMachine.STACK_EVENT, event);
+        TestUtils.waitForLooperToFinishScheduledTask(mHandlerThread.getLooper());
+        verify(mNativeInterface).disconnect(any());
+    }
+
+    @Test
+    public void testStackEvent_toConnectingState_onDisconnectingState() {
+        initToDisconnectingState();
+        allowConnection(true);
+        CsipSetCoordinatorStackEvent event = new CsipSetCoordinatorStackEvent(
+                CsipSetCoordinatorStackEvent.EVENT_TYPE_CONNECTION_STATE_CHANGED);
+        event.valueInt1 = CsipSetCoordinatorStackEvent.CONNECTION_STATE_CONNECTING;
+        sendMessageAndVerifyTransition(
+                mStateMachine.obtainMessage(CsipSetCoordinatorStateMachine.STACK_EVENT, event),
+                CsipSetCoordinatorStateMachine.Connecting.class);
+    }
+
+    @Test
+    public void testStackEvent_toConnectingState_butNotAllowed_onDisconnectingState() {
+        initToDisconnectingState();
+        allowConnection(false);
+        CsipSetCoordinatorStackEvent event = new CsipSetCoordinatorStackEvent(
+                CsipSetCoordinatorStackEvent.EVENT_TYPE_CONNECTION_STATE_CHANGED);
+        event.valueInt1 = CsipSetCoordinatorStackEvent.CONNECTION_STATE_CONNECTED;
+        mStateMachine.sendMessage(CsipSetCoordinatorStateMachine.STACK_EVENT, event);
+        TestUtils.waitForLooperToFinishScheduledTask(mHandlerThread.getLooper());
+        verify(mNativeInterface).disconnect(any());
+    }
+
+    private void initToConnectingState() {
+        allowConnection(true);
+        CsipSetCoordinatorStackEvent event = new CsipSetCoordinatorStackEvent(
+                CsipSetCoordinatorStackEvent.EVENT_TYPE_CONNECTION_STATE_CHANGED);
+        event.valueInt1 = CsipSetCoordinatorStackEvent.CONNECTION_STATE_CONNECTING;
+        sendMessageAndVerifyTransition(
+                mStateMachine.obtainMessage(CsipSetCoordinatorStateMachine.STACK_EVENT, event),
+                CsipSetCoordinatorStateMachine.Connecting.class);
+        allowConnection(false);
+    }
+
+    private void initToConnectedState() {
+        allowConnection(true);
+        CsipSetCoordinatorStackEvent event = new CsipSetCoordinatorStackEvent(
+                CsipSetCoordinatorStackEvent.EVENT_TYPE_CONNECTION_STATE_CHANGED);
+        event.valueInt1 = CsipSetCoordinatorStackEvent.CONNECTION_STATE_CONNECTED;
+        sendMessageAndVerifyTransition(
+                mStateMachine.obtainMessage(CsipSetCoordinatorStateMachine.STACK_EVENT, event),
+                CsipSetCoordinatorStateMachine.Connected.class);
+        allowConnection(false);
+    }
+
+    private void initToDisconnectingState() {
+        initToConnectingState();
+        CsipSetCoordinatorStackEvent event = new CsipSetCoordinatorStackEvent(
+                CsipSetCoordinatorStackEvent.EVENT_TYPE_CONNECTION_STATE_CHANGED);
+        event.valueInt1 = CsipSetCoordinatorStackEvent.CONNECTION_STATE_DISCONNECTING;
+        sendMessageAndVerifyTransition(
+                mStateMachine.obtainMessage(CsipSetCoordinatorStateMachine.STACK_EVENT, event),
+                CsipSetCoordinatorStateMachine.Disconnecting.class);
+    }
+
+    private <T> void sendMessageAndVerifyTransition(Message msg, Class<T> type) {
+        Mockito.clearInvocations(mService);
+        mStateMachine.sendMessage(msg);
+        // Verify that one connection state broadcast is executed
+        verify(mService, timeout(TIMEOUT_MS)).sendBroadcast(any(Intent.class), anyString());
+        Assert.assertThat(mStateMachine.getCurrentState(), IsInstanceOf.instanceOf(type));
+    }
+
+    public static class CsipSetCoordinatorStateMachineWrapper
+            extends CsipSetCoordinatorStateMachine {
+
+        CsipSetCoordinatorStateMachineWrapper(BluetoothDevice device,
+                CsipSetCoordinatorService svc,
+                CsipSetCoordinatorNativeInterface nativeInterface, Looper looper) {
+            super(device, svc, nativeInterface, looper);
+        }
+
+        public boolean doesSuperHaveDeferredMessages(int what) {
+            return super.hasDeferredMessages(what);
+        }
+    }
 }
diff --git a/android/app/tests/unit/src/com/android/bluetooth/gatt/AdvertiseHelperTest.java b/android/app/tests/unit/src/com/android/bluetooth/gatt/AdvertiseHelperTest.java
new file mode 100644
index 0000000..37b14cb
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/gatt/AdvertiseHelperTest.java
@@ -0,0 +1,93 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.gatt;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import static org.junit.Assert.assertThrows;
+
+import android.bluetooth.le.AdvertiseData;
+import android.bluetooth.le.TransportDiscoveryData;
+import android.os.ParcelUuid;
+
+import androidx.test.filters.SmallTest;
+import androidx.test.runner.AndroidJUnit4;
+
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+import java.util.UUID;
+
+/**
+ * Test cases for {@link AdvertiseHelper}.
+ */
+@SmallTest
+@RunWith(AndroidJUnit4.class)
+public class AdvertiseHelperTest {
+
+    @Test
+    public void advertiseDataToBytes() throws Exception {
+        byte[] emptyBytes = AdvertiseHelper.advertiseDataToBytes(null, "");
+
+        assertThat(emptyBytes.length).isEqualTo(0);
+
+        int manufacturerId = 1;
+        byte[] manufacturerData = new byte[]{
+                0x30, 0x31, 0x32, 0x34
+        };
+
+        byte[] serviceData = new byte[]{
+                0x10, 0x12, 0x14
+        };
+
+        byte[] transportDiscoveryData = new byte[]{
+                0x40, 0x44, 0x48
+        };
+
+        AdvertiseData advertiseData = new AdvertiseData.Builder()
+                .setIncludeDeviceName(true)
+                .addManufacturerData(manufacturerId, manufacturerData)
+                .setIncludeTxPowerLevel(true)
+                .addServiceUuid(new ParcelUuid(UUID.randomUUID()))
+                .addServiceData(new ParcelUuid(UUID.randomUUID()), serviceData)
+                .addServiceSolicitationUuid(new ParcelUuid(UUID.randomUUID()))
+                .addTransportDiscoveryData(new TransportDiscoveryData(transportDiscoveryData))
+                .build();
+        String deviceName = "TestDeviceName";
+
+        int expectedAdvDataBytesLength = 87;
+        byte[] advDataBytes = AdvertiseHelper.advertiseDataToBytes(advertiseData, deviceName);
+
+        String deviceNameLong = "TestDeviceNameLongTestDeviceName";
+
+        assertThat(advDataBytes.length).isEqualTo(expectedAdvDataBytesLength);
+
+        int expectedAdvDataBytesLongNameLength = 99;
+        byte[] advDataBytesLongName = AdvertiseHelper
+                .advertiseDataToBytes(advertiseData, deviceNameLong);
+
+        assertThat(advDataBytesLongName.length).isEqualTo(expectedAdvDataBytesLongNameLength);
+    }
+
+    @Test
+    public void checkLength_withGT255_throwsException() {
+        assertThrows(
+                IllegalArgumentException.class,
+                () -> AdvertiseHelper.check_length(0X00, 256)
+        );
+    }
+}
\ No newline at end of file
diff --git a/android/app/tests/unit/src/com/android/bluetooth/gatt/AdvertiseManagerTest.java b/android/app/tests/unit/src/com/android/bluetooth/gatt/AdvertiseManagerTest.java
new file mode 100644
index 0000000..eca9508
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/gatt/AdvertiseManagerTest.java
@@ -0,0 +1,158 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.gatt;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.eq;
+import static org.mockito.Mockito.doNothing;
+import static org.mockito.Mockito.doReturn;
+import static org.mockito.Mockito.verify;
+
+import android.bluetooth.le.AdvertiseData;
+import android.bluetooth.le.AdvertisingSetParameters;
+import android.bluetooth.le.IAdvertisingSetCallback;
+import android.bluetooth.le.PeriodicAdvertisingParameters;
+import android.os.IBinder;
+
+import androidx.test.filters.SmallTest;
+import androidx.test.runner.AndroidJUnit4;
+
+import com.android.bluetooth.TestUtils;
+import com.android.bluetooth.btservice.AdapterService;
+
+import org.junit.After;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.Mock;
+import org.mockito.MockitoAnnotations;
+
+/**
+ * Test cases for {@link AdvertiseManager}.
+ */
+@SmallTest
+@RunWith(AndroidJUnit4.class)
+public class AdvertiseManagerTest {
+
+    @Mock
+    private AdapterService mAdapterService;
+
+    @Mock
+    private GattService mService;
+
+    @Mock
+    private GattService.AdvertiserMap mAdvertiserMap;
+
+    @Mock
+    private IAdvertisingSetCallback mCallback;
+
+    @Mock
+    private IBinder mBinder;
+
+    private AdvertiseManager mAdvertiseManager;
+    private int mAdvertiserId;
+
+    @Before
+    public void setUp() throws Exception {
+        MockitoAnnotations.initMocks(this);
+
+        TestUtils.setAdapterService(mAdapterService);
+
+        mAdvertiseManager = new AdvertiseManager(mService, mAdapterService, mAdvertiserMap);
+        AdvertisingSetParameters parameters = new AdvertisingSetParameters.Builder().build();
+        AdvertiseData advertiseData = new AdvertiseData.Builder().build();
+        AdvertiseData scanResponse = new AdvertiseData.Builder().build();
+        PeriodicAdvertisingParameters periodicParameters =
+                new PeriodicAdvertisingParameters.Builder().build();
+        AdvertiseData periodicData = new AdvertiseData.Builder().build();
+        int duration = 10;
+        int maxExtAdvEvents = 15;
+
+        doReturn(mBinder).when(mCallback).asBinder();
+        doNothing().when(mBinder).linkToDeath(any(), eq(0));
+
+        mAdvertiseManager.startAdvertisingSet(parameters, advertiseData, scanResponse,
+                periodicParameters, periodicData, duration, maxExtAdvEvents, mCallback);
+
+        mAdvertiserId = AdvertiseManager.sTempRegistrationId;
+    }
+
+    @After
+    public void tearDown() throws Exception {
+        TestUtils.clearAdapterService(mAdapterService);
+    }
+
+    @Test
+    public void advertisingSet() {
+        boolean enable = true;
+        int duration = 60;
+        int maxExtAdvEvents = 100;
+
+        mAdvertiseManager.enableAdvertisingSet(mAdvertiserId, enable, duration, maxExtAdvEvents);
+
+        verify(mAdvertiserMap).enableAdvertisingSet(mAdvertiserId, enable, duration,
+                maxExtAdvEvents);
+    }
+
+    @Test
+    public void advertisingData() {
+        AdvertiseData advertiseData = new AdvertiseData.Builder().build();
+
+        mAdvertiseManager.setAdvertisingData(mAdvertiserId, advertiseData);
+
+        verify(mAdvertiserMap).setAdvertisingData(mAdvertiserId, advertiseData);
+    }
+
+    @Test
+    public void scanResponseData() {
+        AdvertiseData scanResponse = new AdvertiseData.Builder().build();
+
+        mAdvertiseManager.setScanResponseData(mAdvertiserId, scanResponse);
+
+        verify(mAdvertiserMap).setScanResponseData(mAdvertiserId, scanResponse);
+    }
+
+    @Test
+    public void advertisingParameters() {
+        AdvertisingSetParameters parameters = new AdvertisingSetParameters.Builder().build();
+
+        mAdvertiseManager.setAdvertisingParameters(mAdvertiserId, parameters);
+
+        verify(mAdvertiserMap).setAdvertisingParameters(mAdvertiserId, parameters);
+    }
+
+    @Test
+    public void periodicAdvertisingParameters() {
+        PeriodicAdvertisingParameters periodicParameters =
+                new PeriodicAdvertisingParameters.Builder().build();
+
+        mAdvertiseManager.setPeriodicAdvertisingParameters(mAdvertiserId, periodicParameters);
+
+        verify(mAdvertiserMap).setPeriodicAdvertisingParameters(mAdvertiserId, periodicParameters);
+    }
+
+    @Test
+    public void periodicAdvertisingData() {
+        AdvertiseData periodicData = new AdvertiseData.Builder().build();
+
+        mAdvertiseManager.setPeriodicAdvertisingData(mAdvertiserId, periodicData);
+
+        verify(mAdvertiserMap).setPeriodicAdvertisingData(mAdvertiserId, periodicData);
+    }
+}
diff --git a/android/app/tests/unit/src/com/android/bluetooth/gatt/AdvtFilterOnFoundOnLostInfoTest.java b/android/app/tests/unit/src/com/android/bluetooth/gatt/AdvtFilterOnFoundOnLostInfoTest.java
new file mode 100644
index 0000000..3eade70
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/gatt/AdvtFilterOnFoundOnLostInfoTest.java
@@ -0,0 +1,83 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.gatt;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import androidx.test.filters.SmallTest;
+import androidx.test.runner.AndroidJUnit4;
+
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+/**
+ * Test cases for {@link AdvtFilterOnFoundOnLostInfoTest}.
+ */
+@SmallTest
+@RunWith(AndroidJUnit4.class)
+public class AdvtFilterOnFoundOnLostInfoTest {
+
+    @Test
+    public void advtFilterOnFoundOnLostInfoParams() {
+        int clientIf = 0;
+        int advPktLen = 1;
+        byte[] advPkt = new byte[]{0x02};
+        int scanRspLen = 3;
+        byte[] scanRsp = new byte[]{0x04};
+        int filtIndex = 5;
+        int advState = 6;
+        int advInfoPresent = 7;
+        String address = "00:11:22:33:FF:EE";
+        int addrType = 8;
+        int txPower = 9;
+        int rssiValue = 10;
+        int timeStamp = 11;
+
+        AdvtFilterOnFoundOnLostInfo advtFilterOnFoundOnLostInfo = new AdvtFilterOnFoundOnLostInfo(
+                clientIf,
+                advPktLen,
+                advPkt,
+                scanRspLen,
+                scanRsp,
+                filtIndex,
+                advState,
+                advInfoPresent,
+                address,
+                addrType,
+                txPower,
+                rssiValue,
+                timeStamp
+        );
+
+        assertThat(advtFilterOnFoundOnLostInfo.getClientIf()).isEqualTo(clientIf);
+        assertThat(advtFilterOnFoundOnLostInfo.getFiltIndex()).isEqualTo(filtIndex);
+        assertThat(advtFilterOnFoundOnLostInfo.getAdvState()).isEqualTo(advState);
+        assertThat(advtFilterOnFoundOnLostInfo.getTxPower()).isEqualTo(txPower);
+        assertThat(advtFilterOnFoundOnLostInfo.getTimeStamp()).isEqualTo(timeStamp);
+        assertThat(advtFilterOnFoundOnLostInfo.getRSSIValue()).isEqualTo(rssiValue);
+        assertThat(advtFilterOnFoundOnLostInfo.getAdvInfoPresent()).isEqualTo(advInfoPresent);
+        assertThat(advtFilterOnFoundOnLostInfo.getAddress()).isEqualTo(address);
+        assertThat(advtFilterOnFoundOnLostInfo.getAddressType()).isEqualTo(addrType);
+        assertThat(advtFilterOnFoundOnLostInfo.getAdvPacketData()).isEqualTo(advPkt);
+        assertThat(advtFilterOnFoundOnLostInfo.getAdvPacketLen()).isEqualTo(advPktLen);
+        assertThat(advtFilterOnFoundOnLostInfo.getScanRspData()).isEqualTo(scanRsp);
+        assertThat(advtFilterOnFoundOnLostInfo.getScanRspLen()).isEqualTo(scanRspLen);
+
+        byte[] resultByteArray = new byte[]{2, 4};
+        assertThat(advtFilterOnFoundOnLostInfo.getResult()).isEqualTo(resultByteArray);
+    }
+}
diff --git a/android/app/tests/unit/src/com/android/bluetooth/gatt/AppAdvertiseStatsTest.java b/android/app/tests/unit/src/com/android/bluetooth/gatt/AppAdvertiseStatsTest.java
new file mode 100644
index 0000000..25f2f04
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/gatt/AppAdvertiseStatsTest.java
@@ -0,0 +1,258 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.gatt;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import android.bluetooth.le.AdvertiseData;
+import android.bluetooth.le.AdvertisingSetParameters;
+import android.bluetooth.le.PeriodicAdvertisingParameters;
+
+import androidx.test.filters.SmallTest;
+import androidx.test.runner.AndroidJUnit4;
+
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.Mock;
+
+/**
+ * Test cases for {@link AppAdvertiseStats}.
+ */
+@SmallTest
+@RunWith(AndroidJUnit4.class)
+public class AppAdvertiseStatsTest {
+
+    @Mock
+    private ContextMap map;
+
+    @Mock
+    private GattService service;
+
+    @Test
+    public void constructor() {
+        int appUid = 0;
+        int id = 1;
+        String name = "name";
+
+        AppAdvertiseStats appAdvertiseStats = new AppAdvertiseStats(appUid, id, name, map, service);
+
+        assertThat(appAdvertiseStats.mContextMap).isEqualTo(map);
+        assertThat(appAdvertiseStats.mGattService).isEqualTo(service);
+    }
+
+    @Test
+    public void recordAdvertiseStart() {
+        int appUid = 0;
+        int id = 1;
+        String name = "name";
+
+        AppAdvertiseStats appAdvertiseStats = new AppAdvertiseStats(appUid, id, name, map, service);
+
+        assertThat(appAdvertiseStats.mAdvertiserRecords.size())
+                .isEqualTo(0);
+
+        int duration = 1;
+        int maxExtAdvEvents = 2;
+
+        appAdvertiseStats.recordAdvertiseStart(duration, maxExtAdvEvents);
+
+        AdvertisingSetParameters parameters = new AdvertisingSetParameters.Builder().build();
+        AdvertiseData advertiseData = new AdvertiseData.Builder().build();
+        AdvertiseData scanResponse = new AdvertiseData.Builder().build();
+        PeriodicAdvertisingParameters periodicParameters =
+                new PeriodicAdvertisingParameters.Builder().build();
+        AdvertiseData periodicData = new AdvertiseData.Builder().build();
+
+        appAdvertiseStats.recordAdvertiseStart(
+                parameters,
+                advertiseData,
+                scanResponse,
+                periodicParameters,
+                periodicData,
+                duration,
+                maxExtAdvEvents
+        );
+
+        int numOfExpectedRecords = 2;
+
+        assertThat(appAdvertiseStats.mAdvertiserRecords.size())
+                .isEqualTo(numOfExpectedRecords);
+    }
+
+    @Test
+    public void recordAdvertiseStop() {
+        int appUid = 0;
+        int id = 1;
+        String name = "name";
+
+        AppAdvertiseStats appAdvertiseStats = new AppAdvertiseStats(appUid, id, name, map, service);
+
+        int duration = 1;
+        int maxExtAdvEvents = 2;
+
+        assertThat(appAdvertiseStats.mAdvertiserRecords.size())
+                .isEqualTo(0);
+
+        appAdvertiseStats.recordAdvertiseStart(duration, maxExtAdvEvents);
+
+        AdvertisingSetParameters parameters = new AdvertisingSetParameters.Builder().build();
+        AdvertiseData advertiseData = new AdvertiseData.Builder().build();
+        AdvertiseData scanResponse = new AdvertiseData.Builder().build();
+        PeriodicAdvertisingParameters periodicParameters =
+                new PeriodicAdvertisingParameters.Builder().build();
+        AdvertiseData periodicData = new AdvertiseData.Builder().build();
+
+        appAdvertiseStats.recordAdvertiseStart(
+                parameters,
+                advertiseData,
+                scanResponse,
+                periodicParameters,
+                periodicData,
+                duration,
+                maxExtAdvEvents
+        );
+
+        appAdvertiseStats.recordAdvertiseStop();
+
+        int numOfExpectedRecords = 2;
+
+        assertThat(appAdvertiseStats.mAdvertiserRecords.size())
+                .isEqualTo(numOfExpectedRecords);
+    }
+
+    @Test
+    public void enableAdvertisingSet() {
+        int appUid = 0;
+        int id = 1;
+        String name = "name";
+
+        AppAdvertiseStats appAdvertiseStats = new AppAdvertiseStats(appUid, id, name, map, service);
+
+        int duration = 1;
+        int maxExtAdvEvents = 2;
+
+        assertThat(appAdvertiseStats.mAdvertiserRecords.size())
+                .isEqualTo(0);
+
+        appAdvertiseStats.enableAdvertisingSet(true, duration, maxExtAdvEvents);
+        appAdvertiseStats.enableAdvertisingSet(false, duration, maxExtAdvEvents);
+
+        int numOfExpectedRecords = 1;
+
+        assertThat(appAdvertiseStats.mAdvertiserRecords.size())
+                .isEqualTo(numOfExpectedRecords);
+    }
+
+    @Test
+    public void setAdvertisingData() {
+        int appUid = 0;
+        int id = 1;
+        String name = "name";
+
+        AppAdvertiseStats appAdvertiseStats = new AppAdvertiseStats(appUid, id, name, map, service);
+
+        AdvertiseData advertiseData = new AdvertiseData.Builder().build();
+        appAdvertiseStats.setAdvertisingData(advertiseData);
+
+        appAdvertiseStats.setAdvertisingData(advertiseData);
+    }
+
+    @Test
+    public void setScanResponseData() {
+        int appUid = 0;
+        int id = 1;
+        String name = "name";
+
+        AppAdvertiseStats appAdvertiseStats = new AppAdvertiseStats(appUid, id, name, map, service);
+
+        AdvertiseData scanResponse = new AdvertiseData.Builder().build();
+        appAdvertiseStats.setScanResponseData(scanResponse);
+
+        appAdvertiseStats.setScanResponseData(scanResponse);
+    }
+
+    @Test
+    public void setAdvertisingParameters() {
+        int appUid = 0;
+        int id = 1;
+        String name = "name";
+
+        AppAdvertiseStats appAdvertiseStats = new AppAdvertiseStats(appUid, id, name, map, service);
+
+        AdvertisingSetParameters parameters = new AdvertisingSetParameters.Builder().build();
+        appAdvertiseStats.setAdvertisingParameters(parameters);
+    }
+
+    @Test
+    public void setPeriodicAdvertisingParameters() {
+        int appUid = 0;
+        int id = 1;
+        String name = "name";
+
+        AppAdvertiseStats appAdvertiseStats = new AppAdvertiseStats(appUid, id, name, map, service);
+
+        PeriodicAdvertisingParameters periodicParameters =
+                new PeriodicAdvertisingParameters.Builder().build();
+        appAdvertiseStats.setPeriodicAdvertisingParameters(periodicParameters);
+    }
+
+    @Test
+    public void setPeriodicAdvertisingData() {
+        int appUid = 0;
+        int id = 1;
+        String name = "name";
+
+        AppAdvertiseStats appAdvertiseStats = new AppAdvertiseStats(appUid, id, name, map, service);
+
+        AdvertiseData periodicData = new AdvertiseData.Builder().build();
+        appAdvertiseStats.setPeriodicAdvertisingData(periodicData);
+
+        appAdvertiseStats.setPeriodicAdvertisingData(periodicData);
+    }
+
+    @Test
+    public void testDump_doesNotCrash() throws Exception {
+        StringBuilder sb = new StringBuilder();
+
+        int appUid = 0;
+        int id = 1;
+        String name = "name";
+
+        AppAdvertiseStats appAdvertiseStats = new AppAdvertiseStats(appUid, id, name, map, service);
+
+        AdvertisingSetParameters parameters = new AdvertisingSetParameters.Builder().build();
+        AdvertiseData advertiseData = new AdvertiseData.Builder().build();
+        AdvertiseData scanResponse = new AdvertiseData.Builder().build();
+        PeriodicAdvertisingParameters periodicParameters =
+                new PeriodicAdvertisingParameters.Builder().build();
+        AdvertiseData periodicData = new AdvertiseData.Builder().build();
+        int duration = 1;
+        int maxExtAdvEvents = 2;
+
+        appAdvertiseStats.recordAdvertiseStart(
+                parameters,
+                advertiseData,
+                scanResponse,
+                periodicParameters,
+                periodicData,
+                duration,
+                maxExtAdvEvents
+        );
+
+        AppAdvertiseStats.dumpToString(sb, appAdvertiseStats);
+    }
+}
diff --git a/android/app/tests/unit/src/com/android/bluetooth/gatt/AppScanStatsTest.java b/android/app/tests/unit/src/com/android/bluetooth/gatt/AppScanStatsTest.java
new file mode 100644
index 0000000..c9e47fd
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/gatt/AppScanStatsTest.java
@@ -0,0 +1,123 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.gatt;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import static org.mockito.ArgumentMatchers.anyString;
+import static org.mockito.Mockito.doReturn;
+
+import android.bluetooth.le.ScanFilter;
+import android.bluetooth.le.ScanSettings;
+import android.os.WorkSource;
+
+import androidx.test.filters.SmallTest;
+import androidx.test.rule.ServiceTestRule;
+import androidx.test.runner.AndroidJUnit4;
+
+import com.android.bluetooth.TestUtils;
+import com.android.bluetooth.btservice.AdapterService;
+import com.android.bluetooth.btservice.BluetoothAdapterProxy;
+
+import org.junit.After;
+import org.junit.Before;
+import org.junit.Rule;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.Mock;
+import org.mockito.MockitoAnnotations;
+
+import java.util.ArrayList;
+import java.util.List;
+
+/**
+ * Test cases for {@link AppScanStats}.
+ */
+@SmallTest
+@RunWith(AndroidJUnit4.class)
+public class AppScanStatsTest {
+
+    private GattService mService;
+
+    @Rule
+    public final ServiceTestRule mServiceRule = new ServiceTestRule();
+
+    @Mock
+    private ContextMap map;
+
+    @Mock
+    private AdapterService mAdapterService;
+
+    @Before
+    public void setUp() throws Exception {
+        MockitoAnnotations.initMocks(this);
+
+        TestUtils.setAdapterService(mAdapterService);
+        doReturn(true).when(mAdapterService).isStartedProfile(anyString());
+
+        TestUtils.startService(mServiceRule, GattService.class);
+        mService = GattService.getGattService();
+    }
+
+    @After
+    public void tearDown() throws Exception {
+        if (!GattService.isEnabled()) {
+            return;
+        }
+
+        doReturn(false).when(mAdapterService).isStartedProfile(anyString());
+        TestUtils.stopService(mServiceRule, GattService.class);
+        mService = GattService.getGattService();
+
+        TestUtils.clearAdapterService(mAdapterService);
+    }
+
+    @Test
+    public void constructor() {
+        String name = "appName";
+        WorkSource source = null;
+
+        AppScanStats appScanStats = new AppScanStats(name, source, map, mService);
+
+        assertThat(appScanStats.mContextMap).isEqualTo(map);
+        assertThat(appScanStats.mGattService).isEqualTo(mService);
+
+        assertThat(appScanStats.isScanning()).isEqualTo(false);
+    }
+
+    @Test
+    public void testDump_doesNotCrash() throws Exception {
+        String name = "appName";
+        WorkSource source = null;
+
+        AppScanStats appScanStats = new AppScanStats(name, source, map, mService);
+
+        ScanSettings settings = new ScanSettings.Builder().build();
+        List<ScanFilter> filters = new ArrayList<>();
+        filters.add(new ScanFilter.Builder().setDeviceName("TestName").build());
+        boolean isFilterScan = false;
+        boolean isCallbackScan = false;
+        int scannerId = 0;
+
+        appScanStats.recordScanStart(settings, filters, isFilterScan, isCallbackScan, scannerId);
+        appScanStats.isRegistered = true;
+
+        StringBuilder stringBuilder = new StringBuilder();
+
+        appScanStats.dumpToString(stringBuilder);
+    }
+}
diff --git a/android/app/tests/unit/src/com/android/bluetooth/gatt/CallbackInfoTest.java b/android/app/tests/unit/src/com/android/bluetooth/gatt/CallbackInfoTest.java
new file mode 100644
index 0000000..dea410c
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/gatt/CallbackInfoTest.java
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.gatt;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import androidx.test.filters.SmallTest;
+import androidx.test.runner.AndroidJUnit4;
+
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+import java.util.Arrays;
+
+/**
+ * Test cases for {@link CallbackInfo}.
+ */
+@SmallTest
+@RunWith(AndroidJUnit4.class)
+public class CallbackInfoTest {
+
+    @Test
+    public void callbackInfoBuilder() {
+        String address = "TestAddress";
+        int status = 0;
+        int handle = 1;
+        byte[] value = "Test Value Byte Array".getBytes();
+
+        CallbackInfo callbackInfo = new CallbackInfo.Builder(address, status)
+                .setHandle(handle)
+                .setValue(value)
+                .build();
+
+        assertThat(callbackInfo.address).isEqualTo(address);
+        assertThat(callbackInfo.status).isEqualTo(status);
+        assertThat(callbackInfo.handle).isEqualTo(handle);
+        assertThat(Arrays.equals(callbackInfo.value, value)).isTrue();
+    }
+}
diff --git a/android/app/tests/unit/src/com/android/bluetooth/gatt/ContextMapTest.java b/android/app/tests/unit/src/com/android/bluetooth/gatt/ContextMapTest.java
new file mode 100644
index 0000000..560abfe
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/gatt/ContextMapTest.java
@@ -0,0 +1,194 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.gatt;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import static org.mockito.ArgumentMatchers.anyString;
+import static org.mockito.Mockito.doReturn;
+import static org.mockito.Mockito.verify;
+
+import android.bluetooth.le.AdvertiseData;
+import android.bluetooth.le.AdvertisingSetParameters;
+import android.bluetooth.le.PeriodicAdvertisingParameters;
+import android.os.Binder;
+
+import androidx.test.filters.SmallTest;
+import androidx.test.rule.ServiceTestRule;
+import androidx.test.runner.AndroidJUnit4;
+
+import com.android.bluetooth.BluetoothMethodProxy;
+import com.android.bluetooth.TestUtils;
+import com.android.bluetooth.btservice.AdapterService;
+
+import org.junit.After;
+import org.junit.Before;
+import org.junit.Rule;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.Mock;
+import org.mockito.MockitoAnnotations;
+import org.mockito.Spy;
+
+import java.util.UUID;
+
+/**
+ * Test cases for {@link ContextMap}.
+ */
+@SmallTest
+@RunWith(AndroidJUnit4.class)
+public class ContextMapTest {
+
+    private GattService mService;
+
+    @Rule
+    public final ServiceTestRule mServiceRule = new ServiceTestRule();
+
+    @Mock
+    private AdapterService mAdapterService;
+
+    @Mock
+    private AppAdvertiseStats appAdvertiseStats;
+
+    @Spy
+    private BluetoothMethodProxy mMapMethodProxy = BluetoothMethodProxy.getInstance();
+
+    @Before
+    public void setUp() throws Exception {
+        MockitoAnnotations.initMocks(this);
+        BluetoothMethodProxy.setInstanceForTesting(mMapMethodProxy);
+
+        TestUtils.setAdapterService(mAdapterService);
+        doReturn(true).when(mAdapterService).isStartedProfile(anyString());
+
+        TestUtils.startService(mServiceRule, GattService.class);
+        mService = GattService.getGattService();
+    }
+
+    @After
+    public void tearDown() throws Exception {
+        if (!GattService.isEnabled()) {
+            return;
+        }
+
+        BluetoothMethodProxy.setInstanceForTesting(null);
+
+        doReturn(false).when(mAdapterService).isStartedProfile(anyString());
+        TestUtils.stopService(mServiceRule, GattService.class);
+        mService = GattService.getGattService();
+
+        TestUtils.clearAdapterService(mAdapterService);
+    }
+
+    @Test
+    public void getByMethods() {
+        ContextMap contextMap = new ContextMap<>();
+
+        int id = 12345;
+        contextMap.add(id, null, mService);
+
+        contextMap.add(UUID.randomUUID(), null, null, null, mService);
+
+        int appUid = Binder.getCallingUid();
+        String appName = mService.getPackageManager().getNameForUid(appUid);
+
+        ContextMap.App contextMapById = contextMap.getById(appUid);
+        assertThat(contextMapById.name).isEqualTo(appName);
+
+        ContextMap.App contextMapByName = contextMap.getByName(appName);
+        assertThat(contextMapByName.name).isEqualTo(appName);
+    }
+
+    @Test
+    public void advertisingSetAndData() {
+        ContextMap contextMap = new ContextMap<>();
+
+        int appUid = Binder.getCallingUid();
+        int id = 12345;
+        String appName = mService.getPackageManager().getNameForUid(appUid);
+        doReturn(appAdvertiseStats).when(mMapMethodProxy)
+                .createAppAdvertiseStats(appUid, id, appName, contextMap, mService);
+
+        contextMap.add(id, null, mService);
+
+        int duration = 60;
+        int maxExtAdvEvents = 100;
+        contextMap.enableAdvertisingSet(id, true, duration, maxExtAdvEvents);
+        verify(appAdvertiseStats).enableAdvertisingSet(true, duration, maxExtAdvEvents);
+
+        AdvertiseData advertiseData = new AdvertiseData.Builder().build();
+        contextMap.setAdvertisingData(id, advertiseData);
+        verify(appAdvertiseStats).setAdvertisingData(advertiseData);
+
+        AdvertiseData scanResponse = new AdvertiseData.Builder().build();
+        contextMap.setScanResponseData(id, scanResponse);
+        verify(appAdvertiseStats).setScanResponseData(scanResponse);
+
+        AdvertisingSetParameters parameters = new AdvertisingSetParameters.Builder().build();
+        contextMap.setAdvertisingParameters(id, parameters);
+        verify(appAdvertiseStats).setAdvertisingParameters(parameters);
+
+        PeriodicAdvertisingParameters periodicParameters =
+                new PeriodicAdvertisingParameters.Builder().build();
+        contextMap.setPeriodicAdvertisingParameters(id, periodicParameters);
+        verify(appAdvertiseStats).setPeriodicAdvertisingParameters(periodicParameters);
+
+        AdvertiseData periodicData = new AdvertiseData.Builder().build();
+        contextMap.setPeriodicAdvertisingData(id, periodicData);
+        verify(appAdvertiseStats).setPeriodicAdvertisingData(periodicData);
+
+        contextMap.onPeriodicAdvertiseEnabled(id, true);
+        verify(appAdvertiseStats).onPeriodicAdvertiseEnabled(true);
+
+        AppAdvertiseStats toBeRemoved = contextMap.getAppAdvertiseStatsById(id);
+        assertThat(toBeRemoved).isNotNull();
+
+        contextMap.removeAppAdvertiseStats(id);
+
+        AppAdvertiseStats isRemoved = contextMap.getAppAdvertiseStatsById(id);
+        assertThat(isRemoved).isNull();
+    }
+
+    @Test
+    public void emptyStop_doesNotCrash() throws Exception {
+        ContextMap contextMap = new ContextMap<>();
+
+        int id = 12345;
+        contextMap.recordAdvertiseStop(id);
+    }
+
+    @Test
+    public void testDump_doesNotCrash() throws Exception {
+        StringBuilder sb = new StringBuilder();
+
+        ContextMap contextMap = new ContextMap<>();
+
+        int id = 12345;
+        contextMap.add(id, null, mService);
+
+        contextMap.add(UUID.randomUUID(), null, null, null, mService);
+
+        contextMap.recordAdvertiseStop(id);
+
+        int idSecond = 54321;
+        contextMap.add(idSecond, null, mService);
+
+        contextMap.dump(sb);
+
+        contextMap.dumpAdvertiser(sb);
+    }
+}
diff --git a/android/app/tests/unit/src/com/android/bluetooth/gatt/FilterParamsTest.java b/android/app/tests/unit/src/com/android/bluetooth/gatt/FilterParamsTest.java
new file mode 100644
index 0000000..3033c12
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/gatt/FilterParamsTest.java
@@ -0,0 +1,79 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.gatt;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import androidx.test.filters.SmallTest;
+import androidx.test.runner.AndroidJUnit4;
+
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+/**
+ * Test cases for {@link FilterParams}.
+ */
+@SmallTest
+@RunWith(AndroidJUnit4.class)
+public class FilterParamsTest {
+
+    @Test
+    public void filterParamsProperties() {
+        int clientIf = 0;
+        int filtIndex = 1;
+        int featSeln = 2;
+        int listLogicType = 3;
+        int filtLogicType = 4;
+        int rssiHighValue = 5;
+        int rssiLowValue = 6;
+        int delyMode = 7;
+        int foundTimeOut = 8;
+        int lostTimeOut = 9;
+        int foundTimeOutCnt = 10;
+        int numOfTrackEntries = 11;
+
+        FilterParams filterParams = new FilterParams(
+                clientIf,
+                filtIndex,
+                featSeln,
+                listLogicType,
+                filtLogicType,
+                rssiHighValue,
+                rssiLowValue,
+                delyMode,
+                foundTimeOut,
+                lostTimeOut,
+                foundTimeOutCnt,
+                numOfTrackEntries
+        );
+
+        assertThat(filterParams).isNotNull();
+
+        assertThat(filterParams.getClientIf()).isEqualTo(clientIf);
+        assertThat(filterParams.getFiltIndex()).isEqualTo(filtIndex);
+        assertThat(filterParams.getFeatSeln()).isEqualTo(featSeln);
+        assertThat(filterParams.getListLogicType()).isEqualTo(listLogicType);
+        assertThat(filterParams.getFiltLogicType()).isEqualTo(filtLogicType);
+        assertThat(filterParams.getRSSIHighValue()).isEqualTo(rssiHighValue);
+        assertThat(filterParams.getRSSILowValue()).isEqualTo(rssiLowValue);
+        assertThat(filterParams.getDelyMode()).isEqualTo(delyMode);
+        assertThat(filterParams.getFoundTimeout()).isEqualTo(foundTimeOut);
+        assertThat(filterParams.getLostTimeout()).isEqualTo(lostTimeOut);
+        assertThat(filterParams.getFoundTimeOutCnt()).isEqualTo(foundTimeOutCnt);
+        assertThat(filterParams.getNumOfTrackEntries()).isEqualTo(numOfTrackEntries);
+    }
+}
diff --git a/android/app/tests/unit/src/com/android/bluetooth/gatt/GattDebugUtilsTest.java b/android/app/tests/unit/src/com/android/bluetooth/gatt/GattDebugUtilsTest.java
new file mode 100644
index 0000000..ab83f1d
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/gatt/GattDebugUtilsTest.java
@@ -0,0 +1,87 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.gatt;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import static org.mockito.Mockito.verify;
+
+import android.content.Intent;
+
+import androidx.test.filters.SmallTest;
+import androidx.test.runner.AndroidJUnit4;
+
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.Mock;
+import org.mockito.MockitoAnnotations;
+
+/**
+ * Test cases for {@link GattDebugUtils}.
+ */
+@SmallTest
+@RunWith(AndroidJUnit4.class)
+public class GattDebugUtilsTest {
+
+    @Mock
+    private GattService mService;
+
+    @Before
+    public void setUp() throws Exception {
+        MockitoAnnotations.initMocks(this);
+    }
+
+    @Test
+    public void handleDebugAction() {
+        Intent intent = new Intent(GattDebugUtils.ACTION_GATT_TEST_USAGE);
+
+        boolean result = GattDebugUtils.handleDebugAction(mService, intent);
+        assertThat(result).isTrue();
+
+        intent = new Intent(GattDebugUtils.ACTION_GATT_TEST_ENABLE);
+        GattDebugUtils.handleDebugAction(mService, intent);
+        int bEnable = 1;
+        verify(mService).gattTestCommand(0x01, null, null, bEnable, 0, 0, 0, 0);
+
+        intent = new Intent(GattDebugUtils.ACTION_GATT_TEST_CONNECT);
+        GattDebugUtils.handleDebugAction(mService, intent);
+        int type = 2;
+        verify(mService).gattTestCommand(0x02, null, null, type, 0, 0, 0, 0);
+
+        intent = new Intent(GattDebugUtils.ACTION_GATT_TEST_DISCONNECT);
+        GattDebugUtils.handleDebugAction(mService, intent);
+        verify(mService).gattTestCommand(0x03, null, null, 0, 0, 0, 0, 0);
+
+        intent = new Intent(GattDebugUtils.ACTION_GATT_TEST_DISCOVER);
+        GattDebugUtils.handleDebugAction(mService, intent);
+        int typeDiscover = 1;
+        int shdl = 1;
+        int ehdl = 0xFFFF;
+        verify(mService).gattTestCommand(0x04, null, null, typeDiscover, shdl, ehdl, 0, 0);
+
+        intent = new Intent(GattDebugUtils.ACTION_GATT_PAIRING_CONFIG);
+        GattDebugUtils.handleDebugAction(mService, intent);
+        int authReq = 5;
+        int ioCap = 4;
+        int initKey = 7;
+        int respKey = 7;
+        int maxKey = 16;
+        verify(mService).gattTestCommand(0xF0, null, null, authReq, ioCap, initKey, respKey,
+                maxKey);
+    }
+}
diff --git a/android/app/tests/unit/src/com/android/bluetooth/gatt/GattServiceBinderTest.java b/android/app/tests/unit/src/com/android/bluetooth/gatt/GattServiceBinderTest.java
new file mode 100644
index 0000000..3897a79
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/gatt/GattServiceBinderTest.java
@@ -0,0 +1,774 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.gatt;
+
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import android.app.PendingIntent;
+import android.bluetooth.BluetoothAdapter;
+import android.bluetooth.BluetoothDevice;
+import android.bluetooth.BluetoothGattService;
+import android.bluetooth.BluetoothProfile;
+import android.bluetooth.IBluetoothGattCallback;
+import android.bluetooth.IBluetoothGattServerCallback;
+import android.bluetooth.le.AdvertiseData;
+import android.bluetooth.le.AdvertisingSetParameters;
+import android.bluetooth.le.IAdvertisingSetCallback;
+import android.bluetooth.le.IPeriodicAdvertisingCallback;
+import android.bluetooth.le.IScannerCallback;
+import android.bluetooth.le.PeriodicAdvertisingParameters;
+import android.bluetooth.le.ScanFilter;
+import android.bluetooth.le.ScanResult;
+import android.bluetooth.le.ScanSettings;
+import android.content.AttributionSource;
+import android.content.Context;
+import android.content.Intent;
+import android.os.ParcelUuid;
+import android.os.WorkSource;
+
+import androidx.test.InstrumentationRegistry;
+import androidx.test.filters.SmallTest;
+import androidx.test.runner.AndroidJUnit4;
+
+import com.android.bluetooth.x.com.android.modules.utils.SynchronousResultReceiver;
+
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.Mock;
+import org.mockito.MockitoAnnotations;
+
+import java.util.ArrayList;
+import java.util.List;
+import java.util.UUID;
+
+@SmallTest
+@RunWith(AndroidJUnit4.class)
+public class GattServiceBinderTest {
+
+    private static final String REMOTE_DEVICE_ADDRESS = "00:00:00:00:00:00";
+
+    @Mock
+    private GattService mService;
+
+    private Context mContext;
+    private BluetoothDevice mDevice;
+    private PendingIntent mPendingIntent;
+    private AttributionSource mAttributionSource;
+
+    private GattService.BluetoothGattBinder mBinder;
+
+    @Before
+    public void setUp() throws Exception {
+        mContext = InstrumentationRegistry.getTargetContext();
+        Intent intent = new Intent();
+        mPendingIntent = PendingIntent.getBroadcast(mContext, 0, intent,
+                PendingIntent.FLAG_IMMUTABLE);
+        MockitoAnnotations.initMocks(this);
+        when(mService.isAvailable()).thenReturn(true);
+        mBinder = new GattService.BluetoothGattBinder(mService);
+        mAttributionSource = new AttributionSource.Builder(1).build();
+        mDevice = BluetoothAdapter.getDefaultAdapter().getRemoteDevice(REMOTE_DEVICE_ADDRESS);
+    }
+
+    @Test
+    public void getDevicesMatchingConnectionStates() {
+        int[] states = new int[] {BluetoothProfile.STATE_CONNECTED};
+
+        mBinder.getDevicesMatchingConnectionStates(states, mAttributionSource,
+                SynchronousResultReceiver.get());
+
+        verify(mService).getDevicesMatchingConnectionStates(states, mAttributionSource);
+    }
+
+    @Test
+    public void registerClient() {
+        UUID uuid = UUID.randomUUID();
+        IBluetoothGattCallback callback = mock(IBluetoothGattCallback.class);
+        boolean eattSupport = true;
+
+        mBinder.registerClient(new ParcelUuid(uuid), callback, eattSupport, mAttributionSource,
+                SynchronousResultReceiver.get());
+
+        verify(mService).registerClient(uuid, callback, eattSupport, mAttributionSource);
+    }
+
+    @Test
+    public void unregisterClient() {
+        int clientIf = 3;
+
+        mBinder.unregisterClient(clientIf, mAttributionSource, SynchronousResultReceiver.get());
+
+        verify(mService).unregisterClient(clientIf, mAttributionSource);
+    }
+
+    @Test
+    public void registerScanner() throws Exception {
+        IScannerCallback callback = mock(IScannerCallback.class);
+        WorkSource workSource = mock(WorkSource.class);
+
+        mBinder.registerScanner(callback, workSource, mAttributionSource,
+                SynchronousResultReceiver.get());
+
+        verify(mService).registerScanner(callback, workSource, mAttributionSource);
+    }
+
+    @Test
+    public void unregisterScanner() {
+        int scannerId = 3;
+
+        mBinder.unregisterScanner(scannerId, mAttributionSource, SynchronousResultReceiver.get());
+
+        verify(mService).unregisterScanner(scannerId, mAttributionSource);
+    }
+
+    @Test
+    public void startScan() throws Exception {
+        int scannerId = 1;
+        ScanSettings settings = new ScanSettings.Builder().build();
+        List<ScanFilter> filters = new ArrayList<>();
+
+        mBinder.startScan(scannerId, settings, filters, mAttributionSource,
+                SynchronousResultReceiver.get());
+
+        verify(mService).startScan(scannerId, settings, filters, mAttributionSource);
+    }
+
+    @Test
+    public void startScanForIntent() throws Exception {
+        ScanSettings settings = new ScanSettings.Builder().build();
+        List<ScanFilter> filters = new ArrayList<>();
+
+        mBinder.startScanForIntent(mPendingIntent, settings, filters, mAttributionSource,
+                SynchronousResultReceiver.get());
+
+        verify(mService).registerPiAndStartScan(mPendingIntent, settings, filters,
+                mAttributionSource);
+    }
+
+    @Test
+    public void stopScanForIntent() throws Exception {
+        mBinder.stopScanForIntent(mPendingIntent, mAttributionSource,
+                SynchronousResultReceiver.get());
+
+        verify(mService).stopScan(mPendingIntent, mAttributionSource);
+    }
+
+    @Test
+    public void stopScan() throws Exception {
+        int scannerId = 3;
+
+        mBinder.stopScan(scannerId, mAttributionSource, SynchronousResultReceiver.get());
+
+        verify(mService).stopScan(scannerId, mAttributionSource);
+    }
+
+    @Test
+    public void flushPendingBatchResults() throws Exception {
+        int scannerId = 3;
+
+        mBinder.flushPendingBatchResults(scannerId, mAttributionSource,
+                SynchronousResultReceiver.get());
+
+        verify(mService).flushPendingBatchResults(scannerId, mAttributionSource);
+    }
+
+    @Test
+    public void clientConnect() throws Exception {
+        int clientIf = 1;
+        String address = REMOTE_DEVICE_ADDRESS;
+        boolean isDirect = true;
+        int transport = 2;
+        boolean opportunistic = true;
+        int phy = 3;
+
+        mBinder.clientConnect(clientIf, address, isDirect, transport, opportunistic, phy,
+                mAttributionSource, SynchronousResultReceiver.get());
+
+        verify(mService).clientConnect(clientIf, address, isDirect, transport, opportunistic, phy,
+                mAttributionSource);
+    }
+
+    @Test
+    public void clientDisconnect() throws Exception {
+        int clientIf = 1;
+        String address = REMOTE_DEVICE_ADDRESS;
+
+        mBinder.clientDisconnect(clientIf, address, mAttributionSource,
+                SynchronousResultReceiver.get());
+
+        verify(mService).clientDisconnect(clientIf, address, mAttributionSource);
+    }
+
+    @Test
+    public void clientSetPreferredPhy() throws Exception {
+        int clientIf = 1;
+        String address = REMOTE_DEVICE_ADDRESS;
+        int txPhy = 2;
+        int rxPhy = 1;
+        int phyOptions = 3;
+
+        mBinder.clientSetPreferredPhy(clientIf, address, txPhy, rxPhy, phyOptions,
+                mAttributionSource, SynchronousResultReceiver.get());
+
+        verify(mService).clientSetPreferredPhy(clientIf, address, txPhy, rxPhy, phyOptions,
+                mAttributionSource);
+    }
+
+    @Test
+    public void clientReadPhy() throws Exception {
+        int clientIf = 1;
+        String address = REMOTE_DEVICE_ADDRESS;
+
+        mBinder.clientReadPhy(clientIf, address, mAttributionSource,
+                SynchronousResultReceiver.get());
+
+        verify(mService).clientReadPhy(clientIf, address, mAttributionSource);
+    }
+
+    @Test
+    public void refreshDevice() throws Exception {
+        int clientIf = 1;
+        String address = REMOTE_DEVICE_ADDRESS;
+
+        mBinder.refreshDevice(clientIf, address, mAttributionSource,
+                SynchronousResultReceiver.get());
+
+        verify(mService).refreshDevice(clientIf, address, mAttributionSource);
+    }
+
+    @Test
+    public void discoverServices() throws Exception {
+        int clientIf = 1;
+        String address = REMOTE_DEVICE_ADDRESS;
+
+        mBinder.discoverServices(clientIf, address, mAttributionSource,
+                SynchronousResultReceiver.get());
+
+        verify(mService).discoverServices(clientIf, address, mAttributionSource);
+    }
+
+    @Test
+    public void discoverServiceByUuid() throws Exception {
+        int clientIf = 1;
+        String address = REMOTE_DEVICE_ADDRESS;
+        UUID uuid = UUID.randomUUID();
+
+        mBinder.discoverServiceByUuid(clientIf, address, new ParcelUuid(uuid), mAttributionSource,
+                SynchronousResultReceiver.get());
+
+        verify(mService).discoverServiceByUuid(clientIf, address, uuid, mAttributionSource);
+    }
+
+    @Test
+    public void readCharacteristic() throws Exception {
+        int clientIf = 1;
+        String address = REMOTE_DEVICE_ADDRESS;
+        int handle = 2;
+        int authReq = 3;
+
+        mBinder.readCharacteristic(clientIf, address, handle, authReq, mAttributionSource,
+                SynchronousResultReceiver.get());
+
+        verify(mService).readCharacteristic(clientIf, address, handle, authReq, mAttributionSource);
+    }
+
+    @Test
+    public void readUsingCharacteristicUuid() throws Exception {
+        int clientIf = 1;
+        String address = REMOTE_DEVICE_ADDRESS;
+        UUID uuid = UUID.randomUUID();
+        int startHandle = 2;
+        int endHandle = 3;
+        int authReq = 4;
+
+        mBinder.readUsingCharacteristicUuid(clientIf, address, new ParcelUuid(uuid),
+                startHandle, endHandle, authReq, mAttributionSource,
+                SynchronousResultReceiver.get());
+
+        verify(mService).readUsingCharacteristicUuid(clientIf, address, uuid, startHandle,
+                endHandle, authReq, mAttributionSource);
+    }
+
+    @Test
+    public void writeCharacteristic() throws Exception {
+        int clientIf = 1;
+        String address = REMOTE_DEVICE_ADDRESS;
+        int handle = 2;
+        int writeType = 3;
+        int authReq = 4;
+        byte[] value = new byte[] {5, 6};
+
+        mBinder.writeCharacteristic(clientIf, address, handle, writeType, authReq,
+                value, mAttributionSource, SynchronousResultReceiver.get());
+
+        verify(mService).writeCharacteristic(clientIf, address, handle, writeType, authReq, value,
+                mAttributionSource);
+    }
+
+    @Test
+    public void readDescriptor() throws Exception {
+        int clientIf = 1;
+        String address = REMOTE_DEVICE_ADDRESS;
+        int handle = 2;
+        int authReq = 3;
+
+        mBinder.readDescriptor(clientIf, address, handle, authReq, mAttributionSource,
+                SynchronousResultReceiver.get());
+
+        verify(mService).readDescriptor(clientIf, address, handle, authReq, mAttributionSource);
+    }
+
+    @Test
+    public void writeDescriptor() throws Exception {
+        int clientIf = 1;
+        String address = REMOTE_DEVICE_ADDRESS;
+        int handle = 2;
+        int authReq = 3;
+        byte[] value = new byte[] {4, 5};
+
+        mBinder.writeDescriptor(clientIf, address, handle, authReq, value,
+                mAttributionSource, SynchronousResultReceiver.get());
+
+        verify(mService).writeDescriptor(clientIf, address, handle, authReq, value,
+                mAttributionSource);
+    }
+
+    @Test
+    public void beginReliableWrite() throws Exception {
+        int clientIf = 1;
+        String address = REMOTE_DEVICE_ADDRESS;
+
+        mBinder.beginReliableWrite(clientIf, address, mAttributionSource,
+                SynchronousResultReceiver.get());
+
+        verify(mService).beginReliableWrite(clientIf, address, mAttributionSource);
+    }
+
+    @Test
+    public void endReliableWrite() throws Exception {
+        int clientIf = 1;
+        String address = REMOTE_DEVICE_ADDRESS;
+        boolean execute = true;
+
+        mBinder.endReliableWrite(clientIf, address, execute, mAttributionSource,
+                SynchronousResultReceiver.get());
+
+        verify(mService).endReliableWrite(clientIf, address, execute, mAttributionSource);
+    }
+
+    @Test
+    public void registerForNotification() throws Exception {
+        int clientIf = 1;
+        String address = REMOTE_DEVICE_ADDRESS;
+        int handle = 2;
+        boolean enable = true;
+
+        mBinder.registerForNotification(clientIf, address, handle, enable,
+                mAttributionSource, SynchronousResultReceiver.get());
+
+        verify(mService).registerForNotification(clientIf, address, handle, enable,
+                mAttributionSource);
+    }
+
+    @Test
+    public void readRemoteRssi() throws Exception {
+        int clientIf = 1;
+        String address = REMOTE_DEVICE_ADDRESS;
+
+        mBinder.readRemoteRssi(clientIf, address, mAttributionSource,
+                SynchronousResultReceiver.get());
+
+        verify(mService).readRemoteRssi(clientIf, address, mAttributionSource);
+    }
+
+    @Test
+    public void configureMTU() throws Exception {
+        int clientIf = 1;
+        String address = REMOTE_DEVICE_ADDRESS;
+        int mtu = 2;
+
+        mBinder.configureMTU(clientIf, address, mtu, mAttributionSource,
+                SynchronousResultReceiver.get());
+
+        verify(mService).configureMTU(clientIf, address, mtu, mAttributionSource);
+    }
+
+    @Test
+    public void connectionParameterUpdate() throws Exception {
+        int clientIf = 1;
+        String address = REMOTE_DEVICE_ADDRESS;
+        int connectionPriority = 2;
+
+        mBinder.connectionParameterUpdate(clientIf, address, connectionPriority,
+                mAttributionSource, SynchronousResultReceiver.get());
+
+        verify(mService).connectionParameterUpdate(clientIf, address, connectionPriority,
+                mAttributionSource);
+    }
+
+    @Test
+    public void leConnectionUpdate() throws Exception {
+        int clientIf = 1;
+        String address = REMOTE_DEVICE_ADDRESS;
+        int minConnectionInterval = 3;
+        int maxConnectionInterval = 4;
+        int peripheralLatency = 5;
+        int supervisionTimeout = 6;
+        int minConnectionEventLen = 7;
+        int maxConnectionEventLen = 8;
+
+        mBinder.leConnectionUpdate(clientIf, address, minConnectionInterval, maxConnectionInterval,
+                peripheralLatency, supervisionTimeout, minConnectionEventLen,
+                maxConnectionEventLen, mAttributionSource, SynchronousResultReceiver.get());
+
+        verify(mService).leConnectionUpdate(
+                clientIf, address, minConnectionInterval, maxConnectionInterval,
+                peripheralLatency, supervisionTimeout, minConnectionEventLen,
+                maxConnectionEventLen, mAttributionSource);
+    }
+
+    @Test
+    public void registerServer() {
+        UUID uuid = UUID.randomUUID();
+        IBluetoothGattServerCallback callback = mock(IBluetoothGattServerCallback.class);
+        boolean eattSupport = true;
+
+        mBinder.registerServer(new ParcelUuid(uuid), callback, eattSupport, mAttributionSource,
+                SynchronousResultReceiver.get());
+
+        verify(mService).registerServer(uuid, callback, eattSupport, mAttributionSource);
+    }
+
+    @Test
+    public void unregisterServer() {
+        int serverIf = 3;
+
+        mBinder.unregisterServer(serverIf, mAttributionSource, SynchronousResultReceiver.get());
+
+        verify(mService).unregisterServer(serverIf, mAttributionSource);
+    }
+
+    @Test
+    public void serverConnect() {
+        int serverIf = 1;
+        String address = REMOTE_DEVICE_ADDRESS;
+        boolean isDirect = true;
+        int transport = 2;
+
+        mBinder.serverConnect(serverIf, address, isDirect, transport, mAttributionSource,
+                SynchronousResultReceiver.get());
+
+        verify(mService).serverConnect(serverIf, address, isDirect, transport, mAttributionSource);
+    }
+
+    @Test
+    public void serverDisconnect() {
+        int serverIf = 1;
+        String address = REMOTE_DEVICE_ADDRESS;
+
+        mBinder.serverDisconnect(serverIf, address, mAttributionSource,
+                SynchronousResultReceiver.get());
+
+        verify(mService).serverDisconnect(serverIf, address, mAttributionSource);
+    }
+
+    @Test
+    public void serverSetPreferredPhy() throws Exception {
+        int serverIf = 1;
+        String address = REMOTE_DEVICE_ADDRESS;
+        int txPhy = 2;
+        int rxPhy = 1;
+        int phyOptions = 3;
+
+        mBinder.serverSetPreferredPhy(serverIf, address, txPhy, rxPhy, phyOptions,
+                mAttributionSource, SynchronousResultReceiver.get());
+
+        verify(mService).serverSetPreferredPhy(serverIf, address, txPhy, rxPhy, phyOptions,
+                mAttributionSource);
+    }
+
+    @Test
+    public void serverReadPhy() throws Exception {
+        int serverIf = 1;
+        String address = REMOTE_DEVICE_ADDRESS;
+
+        mBinder.serverReadPhy(serverIf, address, mAttributionSource,
+                SynchronousResultReceiver.get());
+
+        verify(mService).serverReadPhy(serverIf, address, mAttributionSource);
+    }
+
+    @Test
+    public void addService() {
+        int serverIf = 1;
+        BluetoothGattService svc = mock(BluetoothGattService.class);
+
+        mBinder.addService(serverIf, svc, mAttributionSource,
+                SynchronousResultReceiver.get());
+
+        verify(mService).addService(serverIf, svc, mAttributionSource);
+    }
+
+    @Test
+    public void removeService() {
+        int serverIf = 1;
+        int handle = 2;
+
+        mBinder.removeService(serverIf, handle, mAttributionSource,
+                SynchronousResultReceiver.get());
+
+        verify(mService).removeService(serverIf, handle, mAttributionSource);
+    }
+
+    @Test
+    public void clearServices() {
+        int serverIf = 1;
+
+        mBinder.clearServices(serverIf, mAttributionSource, SynchronousResultReceiver.get());
+
+        verify(mService).clearServices(serverIf, mAttributionSource);
+    }
+
+    @Test
+    public void sendResponse() throws Exception {
+        int serverIf = 1;
+        String address = REMOTE_DEVICE_ADDRESS;
+        int requestId = 2;
+        int status = 3;
+        int offset = 4;
+        byte[] value = new byte[] {5, 6};
+
+        mBinder.sendResponse(serverIf, address, requestId, status, offset, value,
+                mAttributionSource, SynchronousResultReceiver.get());
+
+        verify(mService).sendResponse(serverIf, address, requestId, status, offset, value,
+                mAttributionSource);
+    }
+
+    @Test
+    public void sendNotification() throws Exception {
+        int serverIf = 1;
+        String address = REMOTE_DEVICE_ADDRESS;
+        int handle = 2;
+        boolean confirm = true;
+        byte[] value = new byte[] {5, 6};
+
+        mBinder.sendNotification(serverIf, address, handle, confirm, value,
+                mAttributionSource, SynchronousResultReceiver.get());
+
+        verify(mService).sendNotification(serverIf, address, handle, confirm, value,
+                mAttributionSource);
+    }
+
+    @Test
+    public void startAdvertisingSet() throws Exception {
+        AdvertisingSetParameters parameters = new AdvertisingSetParameters.Builder().build();
+        AdvertiseData advertiseData = new AdvertiseData.Builder().build();
+        AdvertiseData scanResponse = new AdvertiseData.Builder().build();
+        PeriodicAdvertisingParameters periodicParameters =
+                new PeriodicAdvertisingParameters.Builder().build();
+        AdvertiseData periodicData = new AdvertiseData.Builder().build();
+        int duration = 1;
+        int maxExtAdvEvents = 2;
+        IAdvertisingSetCallback callback = mock(IAdvertisingSetCallback.class);
+
+        mBinder.startAdvertisingSet(parameters, advertiseData, scanResponse, periodicParameters,
+                periodicData, duration, maxExtAdvEvents, callback,
+                mAttributionSource, SynchronousResultReceiver.get());
+
+        verify(mService).startAdvertisingSet(parameters, advertiseData, scanResponse,
+                periodicParameters, periodicData, duration, maxExtAdvEvents, callback,
+                mAttributionSource);
+    }
+
+    @Test
+    public void stopAdvertisingSet() throws Exception {
+        IAdvertisingSetCallback callback = mock(IAdvertisingSetCallback.class);
+
+        mBinder.stopAdvertisingSet(callback, mAttributionSource, SynchronousResultReceiver.get());
+
+        verify(mService).stopAdvertisingSet(callback, mAttributionSource);
+    }
+
+    @Test
+    public void getOwnAddress() throws Exception {
+        int advertiserId = 1;
+
+        mBinder.getOwnAddress(advertiserId, mAttributionSource, SynchronousResultReceiver.get());
+
+        verify(mService).getOwnAddress(advertiserId, mAttributionSource);
+    }
+
+    @Test
+    public void enableAdvertisingSet() throws Exception {
+        int advertiserId = 1;
+        boolean enable = true;
+        int duration = 3;
+        int maxExtAdvEvents = 4;
+
+        mBinder.enableAdvertisingSet(advertiserId, enable, duration, maxExtAdvEvents,
+                mAttributionSource, SynchronousResultReceiver.get());
+
+        verify(mService).enableAdvertisingSet(advertiserId, enable, duration, maxExtAdvEvents,
+                mAttributionSource);
+    }
+
+    @Test
+    public void setAdvertisingData() throws Exception {
+        int advertiserId = 1;
+        AdvertiseData data = new AdvertiseData.Builder().build();
+
+        mBinder.setAdvertisingData(advertiserId, data,
+                mAttributionSource, SynchronousResultReceiver.get());
+
+        verify(mService).setAdvertisingData(advertiserId, data, mAttributionSource);
+    }
+
+    @Test
+    public void setScanResponseData() throws Exception {
+        int advertiserId = 1;
+        AdvertiseData data = new AdvertiseData.Builder().build();
+
+        mBinder.setScanResponseData(advertiserId, data,
+                mAttributionSource, SynchronousResultReceiver.get());
+
+        verify(mService).setScanResponseData(advertiserId, data, mAttributionSource);
+    }
+
+    @Test
+    public void setAdvertisingParameters() throws Exception {
+        int advertiserId = 1;
+        AdvertisingSetParameters parameters = new AdvertisingSetParameters.Builder().build();
+
+        mBinder.setAdvertisingParameters(advertiserId, parameters,
+                mAttributionSource, SynchronousResultReceiver.get());
+
+        verify(mService).setAdvertisingParameters(advertiserId, parameters, mAttributionSource);
+    }
+
+    @Test
+    public void setPeriodicAdvertisingParameters() throws Exception {
+        int advertiserId = 1;
+        PeriodicAdvertisingParameters parameters =
+                new PeriodicAdvertisingParameters.Builder().build();
+
+        mBinder.setPeriodicAdvertisingParameters(advertiserId, parameters,
+                mAttributionSource, SynchronousResultReceiver.get());
+
+        verify(mService).setPeriodicAdvertisingParameters(advertiserId, parameters,
+                mAttributionSource);
+    }
+
+    @Test
+    public void setPeriodicAdvertisingData() throws Exception {
+        int advertiserId = 1;
+        AdvertiseData data = new AdvertiseData.Builder().build();
+
+        mBinder.setPeriodicAdvertisingData(advertiserId, data,
+                mAttributionSource, SynchronousResultReceiver.get());
+
+        verify(mService).setPeriodicAdvertisingData(advertiserId, data, mAttributionSource);
+    }
+
+    @Test
+    public void setPeriodicAdvertisingEnable() throws Exception {
+        int advertiserId = 1;
+        boolean enable = true;
+
+        mBinder.setPeriodicAdvertisingEnable(advertiserId, enable,
+                mAttributionSource, SynchronousResultReceiver.get());
+
+        verify(mService).setPeriodicAdvertisingEnable(advertiserId, enable, mAttributionSource);
+    }
+
+    @Test
+    public void registerSync() throws Exception {
+        ScanResult scanResult = new ScanResult(mDevice, 1, 2, 3, 4, 5, 6, 7, null, 8);
+        int skip = 1;
+        int timeout = 2;
+        IPeriodicAdvertisingCallback callback = mock(IPeriodicAdvertisingCallback.class);
+
+        mBinder.registerSync(scanResult, skip, timeout, callback,
+                mAttributionSource, SynchronousResultReceiver.get());
+
+        verify(mService).registerSync(scanResult, skip, timeout, callback, mAttributionSource);
+    }
+
+    @Test
+    public void transferSync() throws Exception {
+        int serviceData = 1;
+        int syncHandle = 2;
+
+        mBinder.transferSync(mDevice, serviceData, syncHandle,
+                mAttributionSource, SynchronousResultReceiver.get());
+
+        verify(mService).transferSync(mDevice, serviceData, syncHandle, mAttributionSource);
+    }
+
+    @Test
+    public void transferSetInfo() throws Exception {
+        int serviceData = 1;
+        int advHandle = 2;
+        IPeriodicAdvertisingCallback callback = mock(IPeriodicAdvertisingCallback.class);
+
+        mBinder.transferSetInfo(mDevice, serviceData, advHandle, callback,
+                mAttributionSource, SynchronousResultReceiver.get());
+
+        verify(mService).transferSetInfo(mDevice, serviceData, advHandle, callback,
+                mAttributionSource);
+    }
+
+    @Test
+    public void unregisterSync() throws Exception {
+        IPeriodicAdvertisingCallback callback = mock(IPeriodicAdvertisingCallback.class);
+
+        mBinder.unregisterSync(callback, mAttributionSource, SynchronousResultReceiver.get());
+
+        verify(mService).unregisterSync(callback, mAttributionSource);
+    }
+
+    @Test
+    public void disconnectAll() throws Exception {
+        IPeriodicAdvertisingCallback callback = mock(IPeriodicAdvertisingCallback.class);
+
+        mBinder.disconnectAll(mAttributionSource, SynchronousResultReceiver.get());
+
+        verify(mService).disconnectAll(mAttributionSource);
+    }
+
+    @Test
+    public void unregAll() throws Exception {
+        mBinder.unregAll(mAttributionSource, SynchronousResultReceiver.get());
+
+        verify(mService).unregAll(mAttributionSource);
+    }
+
+    @Test
+    public void numHwTrackFiltersAvailable() throws Exception {
+        mBinder.numHwTrackFiltersAvailable(mAttributionSource, SynchronousResultReceiver.get());
+
+        verify(mService).numHwTrackFiltersAvailable(mAttributionSource);
+    }
+
+    @Test
+    public void cleanUp_doesNotCrash() {
+        mBinder.cleanup();
+    }
+}
diff --git a/android/app/tests/unit/src/com/android/bluetooth/gatt/GattServiceTest.java b/android/app/tests/unit/src/com/android/bluetooth/gatt/GattServiceTest.java
index 90a1a56..8cdc684 100644
--- a/android/app/tests/unit/src/com/android/bluetooth/gatt/GattServiceTest.java
+++ b/android/app/tests/unit/src/com/android/bluetooth/gatt/GattServiceTest.java
@@ -1,8 +1,50 @@
+/*
+ * Copyright 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
 package com.android.bluetooth.gatt;
 
-import static org.mockito.Mockito.*;
+import static com.google.common.truth.Truth.assertThat;
 
+import static org.mockito.Mockito.*;
+import static org.mockito.Mockito.verify;
+
+import android.bluetooth.BluetoothAdapter;
+import android.bluetooth.BluetoothDevice;
+import android.bluetooth.BluetoothGatt;
+import android.bluetooth.BluetoothGattService;
+import android.bluetooth.BluetoothProfile;
+import android.bluetooth.BluetoothStatusCodes;
+import android.bluetooth.IBluetoothGattCallback;
+import android.bluetooth.IBluetoothGattServerCallback;
+import android.bluetooth.le.AdvertiseData;
+import android.bluetooth.le.AdvertisingSetParameters;
+import android.bluetooth.le.IAdvertisingSetCallback;
+import android.bluetooth.le.IPeriodicAdvertisingCallback;
+import android.bluetooth.le.IScannerCallback;
+import android.bluetooth.le.PeriodicAdvertisingParameters;
+import android.bluetooth.le.ScanFilter;
+import android.bluetooth.le.ScanResult;
+import android.bluetooth.le.ScanSettings;
+import android.content.AttributionSource;
 import android.content.Context;
+import android.content.res.Resources;
+import android.os.Binder;
+import android.os.ParcelUuid;
+import android.os.RemoteException;
+import android.os.WorkSource;
 
 import androidx.test.InstrumentationRegistry;
 import androidx.test.filters.SmallTest;
@@ -12,30 +54,56 @@
 import com.android.bluetooth.R;
 import com.android.bluetooth.TestUtils;
 import com.android.bluetooth.btservice.AdapterService;
+import com.android.bluetooth.btservice.CompanionManager;
 
 import org.junit.After;
 import org.junit.Assert;
 import org.junit.Assume;
 import org.junit.Before;
+import org.junit.Ignore;
 import org.junit.Rule;
 import org.junit.Test;
 import org.junit.runner.RunWith;
 import org.mockito.Mock;
 import org.mockito.MockitoAnnotations;
 
+import java.util.ArrayList;
+import java.util.HashMap;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+import java.util.UUID;
+
 /**
  * Test cases for {@link GattService}.
  */
 @SmallTest
 @RunWith(AndroidJUnit4.class)
 public class GattServiceTest {
+
+    private static final String REMOTE_DEVICE_ADDRESS = "00:00:00:00:00:00";
+
     private static final int TIMES_UP_AND_DOWN = 3;
     private Context mTargetContext;
     private GattService mService;
+    @Mock private GattService.ClientMap mClientMap;
+    @Mock private GattService.ScannerMap mScannerMap;
+    @Mock private GattService.ScannerMap.App mApp;
+    @Mock private GattService.PendingIntentInfo mPiInfo;
+    @Mock private ScanManager mScanManager;
+    @Mock private Set<String> mReliableQueue;
+    @Mock private GattService.ServerMap mServerMap;
 
     @Rule public final ServiceTestRule mServiceRule = new ServiceTestRule();
 
+    private BluetoothDevice mDevice;
+    private BluetoothAdapter mAdapter;
+    private AttributionSource mAttributionSource;
+
+    @Mock private Resources mResources;
     @Mock private AdapterService mAdapterService;
+    private CompanionManager mBtCompanionManager;
 
     @Before
     public void setUp() throws Exception {
@@ -44,9 +112,29 @@
         MockitoAnnotations.initMocks(this);
         TestUtils.setAdapterService(mAdapterService);
         doReturn(true).when(mAdapterService).isStartedProfile(anyString());
+
+        mAdapter = BluetoothAdapter.getDefaultAdapter();
+        mAttributionSource = mAdapter.getAttributionSource();
+        mDevice = BluetoothAdapter.getDefaultAdapter().getRemoteDevice(REMOTE_DEVICE_ADDRESS);
+
+        when(mAdapterService.getResources()).thenReturn(mResources);
+        when(mResources.getInteger(anyInt())).thenReturn(0);
+        when(mAdapterService.getSharedPreferences(anyString(), anyInt()))
+                .thenReturn(InstrumentationRegistry.getTargetContext()
+                        .getSharedPreferences("GattServiceTestPrefs", Context.MODE_PRIVATE));
+
+        mBtCompanionManager = new CompanionManager(mAdapterService, null);
+        doReturn(mBtCompanionManager).when(mAdapterService).getCompanionManager();
+
         TestUtils.startService(mServiceRule, GattService.class);
         mService = GattService.getGattService();
         Assert.assertNotNull(mService);
+
+        mService.mClientMap = mClientMap;
+        mService.mScannerMap = mScannerMap;
+        mService.mScanManager = mScanManager;
+        mService.mReliableQueue = mReliableQueue;
+        mService.mServerMap = mServerMap;
     }
 
     @After
@@ -63,7 +151,7 @@
 
     @Test
     public void testInitialize() {
-        Assert.assertNotNull(GattService.getGattService());
+        Assert.assertEquals(mService, GattService.getGattService());
     }
 
     @Test
@@ -92,4 +180,522 @@
         });
         Assert.assertEquals(99700000000L, timestampNanos);
     }
+
+    public void emptyClearServices() {
+        int serverIf = 1;
+
+        mService.clearServices(serverIf, mAttributionSource);
+    }
+
+    @Test
+    public void clientReadPhy() {
+        int clientIf = 1;
+        String address = REMOTE_DEVICE_ADDRESS;
+
+        Integer connId = 1;
+        doReturn(connId).when(mClientMap).connIdByAddress(clientIf, address);
+
+        mService.clientReadPhy(clientIf, address, mAttributionSource);
+    }
+
+    @Test
+    public void clientSetPreferredPhy() {
+        int clientIf = 1;
+        String address = REMOTE_DEVICE_ADDRESS;
+        int txPhy = 2;
+        int rxPhy = 1;
+        int phyOptions = 3;
+
+        Integer connId = 1;
+        doReturn(connId).when(mClientMap).connIdByAddress(clientIf, address);
+
+        mService.clientSetPreferredPhy(clientIf, address, txPhy, rxPhy, phyOptions,
+                mAttributionSource);
+    }
+
+    @Test
+    public void connectionParameterUpdate() {
+        int clientIf = 1;
+        String address = REMOTE_DEVICE_ADDRESS;
+
+        int connectionPriority = BluetoothGatt.CONNECTION_PRIORITY_HIGH;
+        mService.connectionParameterUpdate(clientIf, address, connectionPriority,
+                mAttributionSource);
+
+        connectionPriority = BluetoothGatt.CONNECTION_PRIORITY_LOW_POWER;
+        mService.connectionParameterUpdate(clientIf, address, connectionPriority,
+                mAttributionSource);
+
+        connectionPriority = BluetoothGatt.CONNECTION_PRIORITY_BALANCED;;
+        mService.connectionParameterUpdate(clientIf, address, connectionPriority,
+                mAttributionSource);
+    }
+
+    @Test
+    public void testDumpDoesNotCrash() {
+        mService.dump(new StringBuilder());
+    }
+
+    @Test
+    public void continuePiStartScan() {
+        int scannerId = 1;
+
+        mPiInfo.settings = new ScanSettings.Builder().build();
+        mApp.info = mPiInfo;
+
+        AppScanStats appScanStats = mock(AppScanStats.class);
+        doReturn(appScanStats).when(mScannerMap).getAppScanStatsById(scannerId);
+
+        mService.continuePiStartScan(scannerId, mApp);
+
+        verify(appScanStats).recordScanStart(
+                mPiInfo.settings, mPiInfo.filters, false, false, scannerId);
+        verify(mScanManager).startScan(any());
+    }
+
+    @Test
+    public void onBatchScanReportsInternal_deliverBatchScan() throws RemoteException {
+        int status = 1;
+        int scannerId = 2;
+        int reportType = ScanManager.SCAN_RESULT_TYPE_FULL;
+        int numRecords = 1;
+        byte[] recordData = new byte[]{0x01, 0x02, 0x03, 0x04, 0x05,
+                0x06, 0x07, 0x08, 0x09, 0x00, 0x00, 0x00, 0x00};
+
+        Set<ScanClient> scanClientSet = new HashSet<>();
+        ScanClient scanClient = new ScanClient(scannerId);
+        scanClient.associatedDevices = new ArrayList<>();
+        scanClient.associatedDevices.add("02:00:00:00:00:00");
+        scanClient.scannerId = scannerId;
+        scanClientSet.add(scanClient);
+        doReturn(scanClientSet).when(mScanManager).getFullBatchScanQueue();
+        doReturn(mApp).when(mScannerMap).getById(scanClient.scannerId);
+
+        mService.onBatchScanReportsInternal(status, scannerId, reportType, numRecords, recordData);
+        verify(mScanManager).callbackDone(scannerId, status);
+
+        reportType = ScanManager.SCAN_RESULT_TYPE_TRUNCATED;
+        recordData = new byte[]{0x00, 0x00, 0x00, 0x00, 0x00, 0x02,
+                0x06, 0x04, 0x02, 0x02, 0x00, 0x00, 0x02};
+        doReturn(scanClientSet).when(mScanManager).getBatchScanQueue();
+        IScannerCallback callback = mock(IScannerCallback.class);
+        mApp.callback = callback;
+
+        mService.onBatchScanReportsInternal(status, scannerId, reportType, numRecords, recordData);
+        verify(callback).onBatchScanResults(any());
+    }
+
+    @Test
+    public void disconnectAll() {
+        Map<Integer, String> connMap = new HashMap<>();
+        int clientIf = 1;
+        String address = "02:00:00:00:00:00";
+        connMap.put(clientIf, address);
+        doReturn(connMap).when(mClientMap).getConnectedMap();
+        Integer connId = 1;
+        doReturn(connId).when(mClientMap).connIdByAddress(clientIf, address);
+
+        mService.disconnectAll(mAttributionSource);
+    }
+
+    @Test
+    public void enforceReportDelayFloor() {
+        long reportDelayFloorHigher = GattService.DEFAULT_REPORT_DELAY_FLOOR + 1;
+        ScanSettings scanSettings = new ScanSettings.Builder()
+                .setReportDelay(reportDelayFloorHigher)
+                .build();
+
+        ScanSettings newScanSettings = mService.enforceReportDelayFloor(scanSettings);
+
+        assertThat(newScanSettings.getReportDelayMillis())
+                .isEqualTo(scanSettings.getReportDelayMillis());
+
+        ScanSettings scanSettingsFloor = new ScanSettings.Builder()
+                .setReportDelay(1)
+                .build();
+
+        ScanSettings newScanSettingsFloor = mService.enforceReportDelayFloor(scanSettingsFloor);
+
+        assertThat(newScanSettingsFloor.getReportDelayMillis())
+                .isEqualTo(GattService.DEFAULT_REPORT_DELAY_FLOOR);
+    }
+
+    @Test
+    public void setAdvertisingData() {
+        int advertiserId = 1;
+        AdvertiseData data = new AdvertiseData.Builder().build();
+
+        mService.setAdvertisingData(advertiserId, data, mAttributionSource);
+    }
+
+    @Test
+    public void setAdvertisingParameters() {
+        int advertiserId = 1;
+        AdvertisingSetParameters parameters = new AdvertisingSetParameters.Builder().build();
+
+        mService.setAdvertisingParameters(advertiserId, parameters, mAttributionSource);
+    }
+
+    @Test
+    public void setPeriodicAdvertisingData() {
+        int advertiserId = 1;
+        AdvertiseData data = new AdvertiseData.Builder().build();
+
+        mService.setPeriodicAdvertisingData(advertiserId, data, mAttributionSource);
+    }
+
+    @Test
+    public void setPeriodicAdvertisingEnable() {
+        int advertiserId = 1;
+        boolean enable = true;
+
+        mService.setPeriodicAdvertisingEnable(advertiserId, enable, mAttributionSource);
+    }
+
+    @Test
+    public void setPeriodicAdvertisingParameters() {
+        int advertiserId = 1;
+        PeriodicAdvertisingParameters parameters =
+                new PeriodicAdvertisingParameters.Builder().build();
+
+        mService.setPeriodicAdvertisingParameters(advertiserId, parameters, mAttributionSource);
+    }
+
+    @Test
+    public void setScanResponseData() {
+        int advertiserId = 1;
+        AdvertiseData data = new AdvertiseData.Builder().build();
+
+        mService.setScanResponseData(advertiserId, data, mAttributionSource);
+    }
+
+    @Test
+    public void getDevicesMatchingConnectionStates() {
+        int[] states = new int[] {BluetoothProfile.STATE_CONNECTED};
+
+        BluetoothDevice testDevice = mAdapter.getRemoteDevice("00:01:02:03:04:05");
+        BluetoothDevice[] bluetoothDevices = new BluetoothDevice[]{testDevice};
+        doReturn(bluetoothDevices).when(mAdapterService).getBondedDevices();
+
+        Set<String> connectedDevices = new HashSet<>();
+        String address = "02:00:00:00:00:00";
+        connectedDevices.add(address);
+        doReturn(connectedDevices).when(mClientMap).getConnectedDevices();
+
+        List<BluetoothDevice> deviceList =
+                mService.getDevicesMatchingConnectionStates(states, mAttributionSource);
+
+        int expectedSize = 1;
+        assertThat(deviceList.size()).isEqualTo(expectedSize);
+
+        BluetoothDevice bluetoothDevice = deviceList.get(0);
+        assertThat(bluetoothDevice.getAddress()).isEqualTo(address);
+    }
+
+    @Test
+    public void registerClient() {
+        UUID uuid = UUID.randomUUID();
+        IBluetoothGattCallback callback = mock(IBluetoothGattCallback.class);
+        boolean eattSupport = true;
+
+        mService.registerClient(uuid, callback, eattSupport, mAttributionSource);
+    }
+
+    @Test
+    public void unregisterClient() {
+        int clientIf = 3;
+
+        mService.unregisterClient(clientIf, mAttributionSource);
+        verify(mClientMap).remove(clientIf);
+    }
+
+    @Test
+    public void registerScanner() throws Exception {
+        IScannerCallback callback = mock(IScannerCallback.class);
+        WorkSource workSource = mock(WorkSource.class);
+
+        AppScanStats appScanStats = mock(AppScanStats.class);
+        doReturn(appScanStats).when(mScannerMap).getAppScanStatsByUid(Binder.getCallingUid());
+
+        mService.registerScanner(callback, workSource, mAttributionSource);
+        verify(mScannerMap).add(any(), eq(workSource), eq(callback), eq(null), eq(mService));
+        verify(mScanManager).registerScanner(any());
+    }
+
+    @Test
+    public void flushPendingBatchResults() {
+        int scannerId = 3;
+
+        mService.flushPendingBatchResults(scannerId, mAttributionSource);
+        verify(mScanManager).flushBatchScanResults(new ScanClient(scannerId));
+    }
+
+    @Test
+    public void readCharacteristic() {
+        int clientIf = 1;
+        String address = REMOTE_DEVICE_ADDRESS;
+        int handle = 2;
+        int authReq = 3;
+
+        Integer connId = 1;
+        doReturn(connId).when(mClientMap).connIdByAddress(clientIf, address);
+
+        mService.readCharacteristic(clientIf, address, handle, authReq, mAttributionSource);
+    }
+
+    @Test
+    public void readUsingCharacteristicUuid() {
+        int clientIf = 1;
+        String address = REMOTE_DEVICE_ADDRESS;
+        UUID uuid = UUID.randomUUID();
+        int startHandle = 2;
+        int endHandle = 3;
+        int authReq = 4;
+
+        Integer connId = 1;
+        doReturn(connId).when(mClientMap).connIdByAddress(clientIf, address);
+
+        mService.readUsingCharacteristicUuid(clientIf, address, uuid, startHandle, endHandle,
+                authReq, mAttributionSource);
+    }
+
+    @Test
+    public void writeCharacteristic() {
+        int clientIf = 1;
+        String address = REMOTE_DEVICE_ADDRESS;
+        int handle = 2;
+        int writeType = 3;
+        int authReq = 4;
+        byte[] value = new byte[] {5, 6};
+
+        Integer connId = 1;
+        doReturn(connId).when(mClientMap).connIdByAddress(clientIf, address);
+
+        int writeCharacteristicResult = mService.writeCharacteristic(clientIf, address, handle,
+                writeType, authReq, value, mAttributionSource);
+        assertThat(writeCharacteristicResult)
+                .isEqualTo(BluetoothStatusCodes.ERROR_DEVICE_NOT_CONNECTED);
+    }
+
+    @Test
+    public void readDescriptor() throws Exception {
+        int clientIf = 1;
+        String address = REMOTE_DEVICE_ADDRESS;
+        int handle = 2;
+        int authReq = 3;
+
+        Integer connId = 1;
+        doReturn(connId).when(mClientMap).connIdByAddress(clientIf, address);
+
+        mService.readDescriptor(clientIf, address, handle, authReq, mAttributionSource);
+    }
+
+    @Test
+    public void beginReliableWrite() {
+        int clientIf = 1;
+        String address = REMOTE_DEVICE_ADDRESS;
+
+        mService.beginReliableWrite(clientIf, address, mAttributionSource);
+        verify(mReliableQueue).add(address);
+    }
+
+    @Test
+    public void endReliableWrite() {
+        int clientIf = 1;
+        String address = REMOTE_DEVICE_ADDRESS;
+        boolean execute = true;
+
+        Integer connId = 1;
+        doReturn(connId).when(mClientMap).connIdByAddress(clientIf, address);
+
+        mService.endReliableWrite(clientIf, address, execute, mAttributionSource);
+        verify(mReliableQueue).remove(address);
+    }
+
+    @Test
+    public void registerForNotification() throws Exception {
+        int clientIf = 1;
+        String address = REMOTE_DEVICE_ADDRESS;
+        int handle = 2;
+        boolean enable = true;
+
+        Integer connId = 1;
+        doReturn(connId).when(mClientMap).connIdByAddress(clientIf, address);
+
+        mService.registerForNotification(clientIf, address, handle, enable, mAttributionSource);
+    }
+
+    @Test
+    public void readRemoteRssi() {
+        int clientIf = 1;
+        String address = REMOTE_DEVICE_ADDRESS;
+
+        mService.readRemoteRssi(clientIf, address, mAttributionSource);
+    }
+
+    @Test
+    public void configureMTU() {
+        int clientIf = 1;
+        String address = REMOTE_DEVICE_ADDRESS;
+        int mtu = 2;
+
+        Integer connId = 1;
+        doReturn(connId).when(mClientMap).connIdByAddress(clientIf, address);
+
+        mService.configureMTU(clientIf, address, mtu, mAttributionSource);
+    }
+
+    @Test
+    public void leConnectionUpdate() throws Exception {
+        int clientIf = 1;
+        String address = REMOTE_DEVICE_ADDRESS;
+        int minInterval = 3;
+        int maxInterval = 4;
+        int peripheralLatency = 5;
+        int supervisionTimeout = 6;
+        int minConnectionEventLen = 7;
+        int maxConnectionEventLen = 8;
+
+        mService.leConnectionUpdate(clientIf, address, minInterval, maxInterval,
+                peripheralLatency, supervisionTimeout, minConnectionEventLen,
+                maxConnectionEventLen, mAttributionSource);
+    }
+
+    @Test
+    public void serverConnect() {
+        int serverIf = 1;
+        String address = REMOTE_DEVICE_ADDRESS;
+        boolean isDirect = true;
+        int transport = 2;
+
+        mService.serverConnect(serverIf, address, isDirect, transport, mAttributionSource);
+    }
+
+    @Test
+    public void serverDisconnect() {
+        int serverIf = 1;
+        String address = REMOTE_DEVICE_ADDRESS;
+
+        Integer connId = 1;
+        doReturn(connId).when(mServerMap).connIdByAddress(serverIf, address);
+
+        mService.serverDisconnect(serverIf, address, mAttributionSource);
+    }
+
+    @Test
+    public void serverSetPreferredPhy() throws Exception {
+        int serverIf = 1;
+        String address = REMOTE_DEVICE_ADDRESS;
+        int txPhy = 2;
+        int rxPhy = 1;
+        int phyOptions = 3;
+
+        mService.serverSetPreferredPhy(serverIf, address, txPhy, rxPhy, phyOptions,
+                mAttributionSource);
+    }
+
+    @Test
+    public void serverReadPhy() {
+        int serverIf = 1;
+        String address = REMOTE_DEVICE_ADDRESS;
+
+        mService.serverReadPhy(serverIf, address, mAttributionSource);
+    }
+
+    @Test
+    public void sendNotification() throws Exception {
+        int serverIf = 1;
+        String address = REMOTE_DEVICE_ADDRESS;
+        int handle = 2;
+        boolean confirm = true;
+        byte[] value = new byte[] {5, 6};;
+
+        Integer connId = 1;
+        doReturn(connId).when(mServerMap).connIdByAddress(serverIf, address);
+
+        mService.sendNotification(serverIf, address, handle, confirm, value, mAttributionSource);
+
+        confirm = false;
+
+        mService.sendNotification(serverIf, address, handle, confirm, value, mAttributionSource);
+    }
+
+    @Test
+    public void getOwnAddress() throws Exception {
+        int advertiserId = 1;
+
+        mService.getOwnAddress(advertiserId, mAttributionSource);
+    }
+
+    @Test
+    public void enableAdvertisingSet() throws Exception {
+        int advertiserId = 1;
+        boolean enable = true;
+        int duration = 3;
+        int maxExtAdvEvents = 4;
+
+        mService.enableAdvertisingSet(advertiserId, enable, duration, maxExtAdvEvents,
+                mAttributionSource);
+    }
+
+    @Ignore("b/265327402")
+    @Test
+    public void registerSync() {
+        ScanResult scanResult = new ScanResult(mDevice, 1, 2, 3, 4, 5, 6, 7, null, 8);
+        int skip = 1;
+        int timeout = 2;
+        IPeriodicAdvertisingCallback callback = mock(IPeriodicAdvertisingCallback.class);
+
+        mService.registerSync(scanResult, skip, timeout, callback, mAttributionSource);
+    }
+
+    @Test
+    public void transferSync() {
+        int serviceData = 1;
+        int syncHandle = 2;
+
+        mService.transferSync(mDevice, serviceData, syncHandle, mAttributionSource);
+    }
+
+    @Ignore("b/265327402")
+    @Test
+    public void transferSetInfo() {
+        int serviceData = 1;
+        int advHandle = 2;
+        IPeriodicAdvertisingCallback callback = mock(IPeriodicAdvertisingCallback.class);
+
+        mService.transferSetInfo(mDevice, serviceData, advHandle, callback,
+                mAttributionSource);
+    }
+
+    @Ignore("b/265327402")
+    @Test
+    public void unregisterSync() {
+        IPeriodicAdvertisingCallback callback = mock(IPeriodicAdvertisingCallback.class);
+
+        mService.unregisterSync(callback, mAttributionSource);
+    }
+
+    @Test
+    public void unregAll() throws Exception {
+        int appId = 1;
+        List<Integer> appIds = new ArrayList<>();
+        appIds.add(appId);
+        doReturn(appIds).when(mClientMap).getAllAppsIds();
+
+        mService.unregAll(mAttributionSource);
+        verify(mClientMap).remove(appId);
+    }
+
+    @Test
+    public void numHwTrackFiltersAvailable() {
+        mService.numHwTrackFiltersAvailable(mAttributionSource);
+        verify(mScanManager).getCurrentUsedTrackingAdvertisement();
+    }
+
+    @Test
+    public void cleanUp_doesNotCrash() {
+        mService.cleanup();
+    }
 }
+
diff --git a/android/app/tests/unit/src/com/android/bluetooth/gatt/ScanFilterQueueTest.java b/android/app/tests/unit/src/com/android/bluetooth/gatt/ScanFilterQueueTest.java
new file mode 100644
index 0000000..e272a8d
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/gatt/ScanFilterQueueTest.java
@@ -0,0 +1,199 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.gatt;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import android.bluetooth.le.ScanFilter;
+import android.os.ParcelUuid;
+
+import androidx.test.filters.SmallTest;
+import androidx.test.runner.AndroidJUnit4;
+
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+import java.util.UUID;
+
+/**
+ * Test cases for {@link ScanFilterQueue}.
+ */
+@SmallTest
+@RunWith(AndroidJUnit4.class)
+public class ScanFilterQueueTest {
+
+    @Test
+    public void scanFilterQueueParams() {
+        ScanFilterQueue queue = new ScanFilterQueue();
+
+        String address = "address";
+        byte type = 1;
+        byte[] irk = new byte[]{0x02};
+        queue.addDeviceAddress(address, type, irk);
+
+        queue.addServiceChanged();
+
+        UUID uuid = UUID.randomUUID();
+        queue.addUuid(uuid);
+
+        UUID uuidMask = UUID.randomUUID();
+        queue.addUuid(uuid, uuidMask);
+
+        UUID solicitUuid = UUID.randomUUID();
+        UUID solicitUuidMask = UUID.randomUUID();
+        queue.addSolicitUuid(solicitUuid, solicitUuidMask);
+
+        String name = "name";
+        queue.addName(name);
+
+        int company = 2;
+        byte[] data = new byte[]{0x04};
+        queue.addManufacturerData(company, data);
+
+        int companyMask = 2;
+        byte[] dataMask = new byte[]{0x05};
+        queue.addManufacturerData(company, companyMask, data, dataMask);
+
+        byte[] serviceData = new byte[]{0x06};
+        byte[] serviceDataMask = new byte[]{0x08};
+        queue.addServiceData(serviceData, serviceDataMask);
+
+        int adType = 3;
+        byte[] adData = new byte[]{0x10};
+        byte[] adDataMask = new byte[]{0x12};
+        queue.addAdvertisingDataType(adType, adData, adDataMask);
+
+        ScanFilterQueue.Entry[] entries = queue.toArray();
+        int entriesLength = 10;
+        assertThat(entries.length).isEqualTo(entriesLength);
+
+        for (ScanFilterQueue.Entry entry : entries) {
+            switch (entry.type) {
+                case ScanFilterQueue.TYPE_DEVICE_ADDRESS:
+                    assertThat(entry.address).isEqualTo(address);
+                    assertThat(entry.addr_type).isEqualTo(type);
+                    assertThat(entry.irk).isEqualTo(irk);
+                    break;
+                case ScanFilterQueue.TYPE_SERVICE_DATA_CHANGED:
+                    assertThat(entry).isNotNull();
+                    break;
+                case ScanFilterQueue.TYPE_SERVICE_UUID:
+                    assertThat(entry.uuid).isEqualTo(uuid);
+                    break;
+                case ScanFilterQueue.TYPE_SOLICIT_UUID:
+                    assertThat(entry.uuid).isEqualTo(solicitUuid);
+                    assertThat(entry.uuid_mask).isEqualTo(solicitUuidMask);
+                    break;
+                case ScanFilterQueue.TYPE_LOCAL_NAME:
+                    assertThat(entry.name).isEqualTo(name);
+                    break;
+                case ScanFilterQueue.TYPE_MANUFACTURER_DATA:
+                    assertThat(entry.company).isEqualTo(company);
+                    assertThat(entry.data).isEqualTo(data);
+                    break;
+                case ScanFilterQueue.TYPE_SERVICE_DATA:
+                    assertThat(entry.data).isEqualTo(serviceData);
+                    assertThat(entry.data_mask).isEqualTo(serviceDataMask);
+                    break;
+                case ScanFilterQueue.TYPE_ADVERTISING_DATA_TYPE:
+                    assertThat(entry.ad_type).isEqualTo(adType);
+                    assertThat(entry.data).isEqualTo(adData);
+                    assertThat(entry.data_mask).isEqualTo(adDataMask);
+                    break;
+            }
+        }
+    }
+
+    @Test
+    public void popEmpty() {
+        ScanFilterQueue queue = new ScanFilterQueue();
+
+        ScanFilterQueue.Entry entry = queue.pop();
+        assertThat(entry).isNull();
+    }
+
+    @Test
+    public void popFromQueue() {
+        ScanFilterQueue queue = new ScanFilterQueue();
+
+        byte[] serviceData = new byte[]{0x02};
+        byte[] serviceDataMask = new byte[]{0x04};
+        queue.addServiceData(serviceData, serviceDataMask);
+
+        ScanFilterQueue.Entry entry = queue.pop();
+        assertThat(entry.data).isEqualTo(serviceData);
+        assertThat(entry.data_mask).isEqualTo(serviceDataMask);
+    }
+
+    @Test
+    public void checkFeatureSelection() {
+        ScanFilterQueue queue = new ScanFilterQueue();
+
+        byte[] serviceData = new byte[]{0x02};
+        byte[] serviceDataMask = new byte[]{0x04};
+        queue.addServiceData(serviceData, serviceDataMask);
+
+        int feature = 1 << ScanFilterQueue.TYPE_SERVICE_DATA;
+        assertThat(queue.getFeatureSelection()).isEqualTo(feature);
+    }
+
+    @Test
+    public void convertQueueToArray() {
+        ScanFilterQueue queue = new ScanFilterQueue();
+
+        byte[] serviceData = new byte[]{0x02};
+        byte[] serviceDataMask = new byte[]{0x04};
+        queue.addServiceData(serviceData, serviceDataMask);
+
+        ScanFilterQueue.Entry[] entries = queue.toArray();
+        int entriesLength = 1;
+        assertThat(entries.length).isEqualTo(entriesLength);
+
+        ScanFilterQueue.Entry entry = entries[0];
+        assertThat(entry.data).isEqualTo(serviceData);
+        assertThat(entry.data_mask).isEqualTo(serviceDataMask);
+    }
+
+    @Test
+    public void queueAddScanFilter() {
+        ScanFilterQueue queue = new ScanFilterQueue();
+
+        String name = "name";
+        String deviceAddress = "00:11:22:33:FF:EE";
+        ParcelUuid serviceUuid = ParcelUuid.fromString(UUID.randomUUID().toString());
+        ParcelUuid serviceSolicitationUuid = ParcelUuid.fromString(UUID.randomUUID().toString());
+        int manufacturerId = 0;
+        byte[] manufacturerData = new byte[0];
+        ParcelUuid serviceDataUuid = ParcelUuid.fromString(UUID.randomUUID().toString());
+        byte[] serviceData = new byte[0];
+        int advertisingDataType = 1;
+
+        ScanFilter filter = new ScanFilter.Builder()
+                .setDeviceName(name)
+                .setDeviceAddress(deviceAddress)
+                .setServiceUuid(serviceUuid)
+                .setServiceSolicitationUuid(serviceSolicitationUuid)
+                .setManufacturerData(manufacturerId, manufacturerData)
+                .setServiceData(serviceDataUuid, serviceData)
+                .setAdvertisingDataType(advertisingDataType)
+                .build();
+        queue.addScanFilter(filter);
+
+        int numOfEntries = 7;
+        assertThat(queue.toArray().length).isEqualTo(numOfEntries);
+    }
+}
diff --git a/android/app/tests/unit/src/com/android/bluetooth/gatt/ScanManagerTest.java b/android/app/tests/unit/src/com/android/bluetooth/gatt/ScanManagerTest.java
new file mode 100644
index 0000000..d70ae4f
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/gatt/ScanManagerTest.java
@@ -0,0 +1,568 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.gatt;
+
+import static android.bluetooth.le.ScanSettings.SCAN_MODE_OPPORTUNISTIC;
+import static android.bluetooth.le.ScanSettings.SCAN_MODE_LOW_POWER;
+import static android.bluetooth.le.ScanSettings.SCAN_MODE_BALANCED;
+import static android.bluetooth.le.ScanSettings.SCAN_MODE_LOW_LATENCY;
+import static android.bluetooth.le.ScanSettings.SCAN_MODE_AMBIENT_DISCOVERY;
+import static android.bluetooth.le.ScanSettings.SCAN_MODE_SCREEN_OFF;
+import static android.bluetooth.le.ScanSettings.SCAN_MODE_SCREEN_OFF_BALANCED;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import static org.mockito.Mockito.anyString;
+import static org.mockito.Mockito.doReturn;
+import static org.mockito.Mockito.when;
+
+import android.app.ActivityManager;
+import android.bluetooth.le.ScanFilter;
+import android.bluetooth.le.ScanSettings;
+import android.content.Context;
+import android.os.Binder;
+import android.os.Handler;
+import android.os.Message;
+import android.util.Log;
+import android.util.SparseIntArray;
+
+import androidx.test.InstrumentationRegistry;
+import androidx.test.filters.SmallTest;
+import androidx.test.rule.ServiceTestRule;
+import androidx.test.runner.AndroidJUnit4;
+
+import com.android.bluetooth.R;
+import com.android.bluetooth.TestUtils;
+import com.android.bluetooth.btservice.AdapterService;
+import com.android.bluetooth.btservice.BluetoothAdapterProxy;
+
+import java.util.ArrayList;
+import java.util.List;
+import java.util.concurrent.CountDownLatch;
+import java.util.concurrent.TimeUnit;
+
+import org.junit.After;
+import org.junit.Assume;
+import org.junit.Before;
+import org.junit.Rule;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.Mock;
+import org.mockito.MockitoAnnotations;
+
+/**
+ * Test cases for {@link ScanManager}.
+ */
+@SmallTest
+@RunWith(AndroidJUnit4.class)
+public class ScanManagerTest {
+    private static final String TAG = ScanManagerTest.class.getSimpleName();
+    private static final int DELAY_ASYNC_MS = 10;
+    private static final int DELAY_DEFAULT_SCAN_TIMEOUT_MS = 1500000;
+    private static final int DELAY_SCAN_TIMEOUT_MS = 100;
+    private static final int DEFAULT_SCAN_REPORT_DELAY_MS = 100;
+    private static final int DEFAULT_NUM_OFFLOAD_SCAN_FILTER = 16;
+    private static final int DEFAULT_BYTES_OFFLOAD_SCAN_RESULT_STORAGE = 4096;
+
+    private Context mTargetContext;
+    private GattService mService;
+    private ScanManager mScanManager;
+    private Handler mHandler;
+    private CountDownLatch mLatch;
+
+    @Rule public final ServiceTestRule mServiceRule = new ServiceTestRule();
+    @Mock private AdapterService mAdapterService;
+    @Mock private BluetoothAdapterProxy mBluetoothAdapterProxy;
+
+    @Before
+    public void setUp() throws Exception {
+        mTargetContext = InstrumentationRegistry.getTargetContext();
+        Assume.assumeTrue("Ignore test when GattService is not enabled"
+                , GattService.isEnabled());
+        MockitoAnnotations.initMocks(this);
+
+        TestUtils.setAdapterService(mAdapterService);
+        doReturn(true).when(mAdapterService).isStartedProfile(anyString());
+        when(mAdapterService.getScanTimeoutMillis()).
+                thenReturn((long)DELAY_DEFAULT_SCAN_TIMEOUT_MS);
+        when(mAdapterService.getNumOfOffloadedScanFilterSupported())
+                .thenReturn(DEFAULT_NUM_OFFLOAD_SCAN_FILTER);
+        when(mAdapterService.getOffloadedScanResultStorage())
+                .thenReturn(DEFAULT_BYTES_OFFLOAD_SCAN_RESULT_STORAGE);
+
+        BluetoothAdapterProxy.setInstanceForTesting(mBluetoothAdapterProxy);
+        // TODO: Need to handle Native call/callback for hw filter configuration when return true
+        when(mBluetoothAdapterProxy.isOffloadedScanFilteringSupported()).thenReturn(false);
+
+        TestUtils.startService(mServiceRule, GattService.class);
+        mService = GattService.getGattService();
+        assertThat(mService).isNotNull();
+
+        mScanManager = mService.getScanManager();
+        assertThat(mScanManager).isNotNull();
+
+        mHandler = mScanManager.getClientHandler();
+        assertThat(mHandler).isNotNull();
+
+        mLatch = new CountDownLatch(1);
+        assertThat(mLatch).isNotNull();
+    }
+
+    @After
+    public void tearDown() throws Exception {
+        if (!GattService.isEnabled()) {
+            return;
+        }
+        doReturn(false).when(mAdapterService).isStartedProfile(anyString());
+        TestUtils.stopService(mServiceRule, GattService.class);
+        mService = GattService.getGattService();
+        assertThat(mService).isNull();
+        TestUtils.clearAdapterService(mAdapterService);
+        BluetoothAdapterProxy.setInstanceForTesting(null);
+    }
+
+    private void testSleep(long millis) {
+        try {
+            mLatch.await(millis, TimeUnit.MILLISECONDS);
+        } catch (Exception e) {
+            Log.e(TAG, "Latch await", e);
+        }
+    }
+
+    private void sendMessageWaitForProcessed(Message msg) {
+        if (mHandler == null) {
+            Log.e(TAG, "sendMessage: mHandler is null.");
+            return;
+        }
+        mHandler.sendMessage(msg);
+        // Wait for async work from handler thread
+        TestUtils.waitForLooperToBeIdle(mHandler.getLooper());
+    }
+
+    private ScanClient createScanClient(int id, boolean isFiltered, int scanMode,
+            boolean isBatch) {
+        List<ScanFilter> scanFilterList = createScanFilterList(isFiltered);
+        ScanSettings scanSettings = createScanSettings(scanMode, isBatch);
+
+        ScanClient client = new ScanClient(id, scanSettings, scanFilterList);
+        client.stats = new AppScanStats("Test", null, null, mService);
+        client.stats.recordScanStart(scanSettings, scanFilterList, isFiltered, false, id);
+        return client;
+    }
+
+    private ScanClient createScanClient(int id, boolean isFiltered, int scanMode) {
+        return createScanClient(id, isFiltered, scanMode, false);
+    }
+
+    private List<ScanFilter> createScanFilterList(boolean isFiltered) {
+        List<ScanFilter> scanFilterList = null;
+        if (isFiltered) {
+            scanFilterList = new ArrayList<>();
+            scanFilterList.add(new ScanFilter.Builder().setDeviceName("TestName").build());
+        }
+        return scanFilterList;
+    }
+
+    private ScanSettings createScanSettings(int scanMode, boolean isBatch) {
+
+        ScanSettings scanSettings = null;
+        if(isBatch) {
+            scanSettings = new ScanSettings.Builder().setScanMode(scanMode)
+                    .setReportDelay(DEFAULT_SCAN_REPORT_DELAY_MS).build();
+        } else {
+            scanSettings = new ScanSettings.Builder().setScanMode(scanMode).build();
+        }
+        return scanSettings;
+    }
+
+    private Message createStartStopScanMessage(boolean isStartScan, Object obj) {
+        Message message = new Message();
+        message.what = isStartScan ? ScanManager.MSG_START_BLE_SCAN : ScanManager.MSG_STOP_BLE_SCAN;
+        message.obj = obj;
+        return message;
+    }
+
+    private Message createScreenOnOffMessage(boolean isScreenOn) {
+        Message message = new Message();
+        message.what = isScreenOn ? ScanManager.MSG_SCREEN_ON : ScanManager.MSG_SCREEN_OFF;
+        message.obj = null;
+        return message;
+    }
+
+    private Message createImportanceMessage(boolean isForeground) {
+        final int importance = isForeground ? ActivityManager.RunningAppProcessInfo
+                .IMPORTANCE_FOREGROUND_SERVICE : ActivityManager.RunningAppProcessInfo
+                .IMPORTANCE_FOREGROUND_SERVICE + 1;
+        final int uid = Binder.getCallingUid();
+        Message message = new Message();
+        message.what = ScanManager.MSG_IMPORTANCE_CHANGE;
+        message.obj = new ScanManager.UidImportance(uid, importance);
+        return message;
+    }
+
+    @Test
+    public void testScreenOffStartUnfilteredScan() {
+        // Set filtered scan flag
+        final boolean isFiltered = false;
+        // Set scan mode map {original scan mode (ScanMode) : expected scan mode (expectedScanMode)}
+        SparseIntArray scanModeMap = new SparseIntArray();
+        scanModeMap.put(SCAN_MODE_LOW_POWER, SCAN_MODE_LOW_POWER);
+        scanModeMap.put(SCAN_MODE_BALANCED, SCAN_MODE_BALANCED);
+        scanModeMap.put(SCAN_MODE_LOW_LATENCY, SCAN_MODE_LOW_LATENCY);
+        scanModeMap.put(SCAN_MODE_AMBIENT_DISCOVERY, SCAN_MODE_AMBIENT_DISCOVERY);
+
+        for (int i = 0; i < scanModeMap.size(); i++) {
+            int ScanMode = scanModeMap.keyAt(i);
+            int expectedScanMode = scanModeMap.get(ScanMode);
+            Log.d(TAG, "ScanMode: " + String.valueOf(ScanMode)
+                    + " expectedScanMode: " + String.valueOf(expectedScanMode));
+
+            // Turn off screen
+            sendMessageWaitForProcessed(createScreenOnOffMessage(false));
+            // Create scan client
+            ScanClient client = createScanClient(i, isFiltered, ScanMode);
+            // Start scan
+            sendMessageWaitForProcessed(createStartStopScanMessage(true, client));
+            assertThat(mScanManager.getRegularScanQueue().contains(client)).isFalse();
+            assertThat(mScanManager.getSuspendedScanQueue().contains(client)).isTrue();
+            assertThat(client.settings.getScanMode()).isEqualTo(expectedScanMode);
+        }
+    }
+
+    @Test
+    public void testScreenOffStartFilteredScan() {
+        // Set filtered scan flag
+        final boolean isFiltered = true;
+        // Set scan mode map {original scan mode (ScanMode) : expected scan mode (expectedScanMode)}
+        SparseIntArray scanModeMap = new SparseIntArray();
+        scanModeMap.put(SCAN_MODE_LOW_POWER, SCAN_MODE_SCREEN_OFF);
+        scanModeMap.put(SCAN_MODE_BALANCED, SCAN_MODE_SCREEN_OFF_BALANCED);
+        scanModeMap.put(SCAN_MODE_LOW_LATENCY, SCAN_MODE_LOW_LATENCY);
+        scanModeMap.put(SCAN_MODE_AMBIENT_DISCOVERY, SCAN_MODE_SCREEN_OFF_BALANCED);
+
+        for (int i = 0; i < scanModeMap.size(); i++) {
+            int ScanMode = scanModeMap.keyAt(i);
+            int expectedScanMode = scanModeMap.get(ScanMode);
+            Log.d(TAG, "ScanMode: " + String.valueOf(ScanMode)
+                    + " expectedScanMode: " + String.valueOf(expectedScanMode));
+
+            // Turn off screen
+            sendMessageWaitForProcessed(createScreenOnOffMessage(false));
+            // Create scan client
+            ScanClient client = createScanClient(i, isFiltered, ScanMode);
+            // Start scan
+            sendMessageWaitForProcessed(createStartStopScanMessage(true, client));
+            assertThat(mScanManager.getRegularScanQueue().contains(client)).isTrue();
+            assertThat(mScanManager.getSuspendedScanQueue().contains(client)).isFalse();
+            assertThat(client.settings.getScanMode()).isEqualTo(expectedScanMode);
+        }
+    }
+
+    @Test
+    public void testScreenOnStartUnfilteredScan() {
+        // Set filtered scan flag
+        final boolean isFiltered = false;
+        // Set scan mode map {original scan mode (ScanMode) : expected scan mode (expectedScanMode)}
+        SparseIntArray scanModeMap = new SparseIntArray();
+        scanModeMap.put(SCAN_MODE_LOW_POWER, SCAN_MODE_LOW_POWER);
+        scanModeMap.put(SCAN_MODE_BALANCED, SCAN_MODE_BALANCED);
+        scanModeMap.put(SCAN_MODE_LOW_LATENCY, SCAN_MODE_LOW_LATENCY);
+        scanModeMap.put(SCAN_MODE_AMBIENT_DISCOVERY, SCAN_MODE_AMBIENT_DISCOVERY);
+
+        for (int i = 0; i < scanModeMap.size(); i++) {
+            int ScanMode = scanModeMap.keyAt(i);
+            int expectedScanMode = scanModeMap.get(ScanMode);
+            Log.d(TAG, "ScanMode: " + String.valueOf(ScanMode)
+                    + " expectedScanMode: " + String.valueOf(expectedScanMode));
+
+            // Turn on screen
+            sendMessageWaitForProcessed(createScreenOnOffMessage(true));
+            // Create scan client
+            ScanClient client = createScanClient(i, isFiltered, ScanMode);
+            // Start scan
+            sendMessageWaitForProcessed(createStartStopScanMessage(true, client));
+            assertThat(mScanManager.getRegularScanQueue().contains(client)).isTrue();
+            assertThat(mScanManager.getSuspendedScanQueue().contains(client)).isFalse();
+            assertThat(client.settings.getScanMode()).isEqualTo(expectedScanMode);
+        }
+    }
+
+    @Test
+    public void testScreenOnStartFilteredScan() {
+        // Set filtered scan flag
+        final boolean isFiltered = true;
+        // Set scan mode map {original scan mode (ScanMode) : expected scan mode (expectedScanMode)}
+        SparseIntArray scanModeMap = new SparseIntArray();
+        scanModeMap.put(SCAN_MODE_LOW_POWER, SCAN_MODE_LOW_POWER);
+        scanModeMap.put(SCAN_MODE_BALANCED, SCAN_MODE_BALANCED);
+        scanModeMap.put(SCAN_MODE_LOW_LATENCY, SCAN_MODE_LOW_LATENCY);
+        scanModeMap.put(SCAN_MODE_AMBIENT_DISCOVERY, SCAN_MODE_AMBIENT_DISCOVERY);
+
+        for (int i = 0; i < scanModeMap.size(); i++) {
+            int ScanMode = scanModeMap.keyAt(i);
+            int expectedScanMode = scanModeMap.get(ScanMode);
+            Log.d(TAG, "ScanMode: " + String.valueOf(ScanMode)
+                    + " expectedScanMode: " + String.valueOf(expectedScanMode));
+
+            // Turn on screen
+            sendMessageWaitForProcessed(createScreenOnOffMessage(true));
+            // Create scan client
+            ScanClient client = createScanClient(i, isFiltered, ScanMode);
+            // Start scan
+            sendMessageWaitForProcessed(createStartStopScanMessage(true, client));
+            assertThat(mScanManager.getRegularScanQueue().contains(client)).isTrue();
+            assertThat(mScanManager.getSuspendedScanQueue().contains(client)).isFalse();
+            assertThat(client.settings.getScanMode()).isEqualTo(expectedScanMode);
+        }
+    }
+
+    @Test
+    public void testResumeUnfilteredScanAfterScreenOn() {
+        // Set filtered scan flag
+        final boolean isFiltered = false;
+        // Set scan mode map {original scan mode (ScanMode) : expected scan mode (expectedScanMode)}
+        SparseIntArray scanModeMap = new SparseIntArray();
+        scanModeMap.put(SCAN_MODE_LOW_POWER, SCAN_MODE_SCREEN_OFF);
+        scanModeMap.put(SCAN_MODE_BALANCED, SCAN_MODE_SCREEN_OFF_BALANCED);
+        scanModeMap.put(SCAN_MODE_LOW_LATENCY, SCAN_MODE_LOW_LATENCY);
+        scanModeMap.put(SCAN_MODE_AMBIENT_DISCOVERY, SCAN_MODE_SCREEN_OFF_BALANCED);
+
+        for (int i = 0; i < scanModeMap.size(); i++) {
+            int ScanMode = scanModeMap.keyAt(i);
+            int expectedScanMode = scanModeMap.get(ScanMode);
+            Log.d(TAG, "ScanMode: " + String.valueOf(ScanMode)
+                    + " expectedScanMode: " + String.valueOf(expectedScanMode));
+
+            // Turn off screen
+            sendMessageWaitForProcessed(createScreenOnOffMessage(false));
+            // Create scan client
+            ScanClient client = createScanClient(i, isFiltered, ScanMode);
+            // Start scan
+            sendMessageWaitForProcessed(createStartStopScanMessage(true, client));
+            assertThat(mScanManager.getRegularScanQueue().contains(client)).isFalse();
+            assertThat(mScanManager.getSuspendedScanQueue().contains(client)).isTrue();
+            assertThat(client.settings.getScanMode()).isEqualTo(ScanMode);
+            // Turn on screen
+            sendMessageWaitForProcessed(createScreenOnOffMessage(true));
+            assertThat(mScanManager.getRegularScanQueue().contains(client)).isTrue();
+            assertThat(mScanManager.getSuspendedScanQueue().contains(client)).isFalse();
+            assertThat(client.settings.getScanMode()).isEqualTo(ScanMode);
+        }
+    }
+
+    @Test
+    public void testResumeFilteredScanAfterScreenOn() {
+        // Set filtered scan flag
+        final boolean isFiltered = true;
+        // Set scan mode map {original scan mode (ScanMode) : expected scan mode (expectedScanMode)}
+        SparseIntArray scanModeMap = new SparseIntArray();
+        scanModeMap.put(SCAN_MODE_LOW_POWER, SCAN_MODE_SCREEN_OFF);
+        scanModeMap.put(SCAN_MODE_BALANCED, SCAN_MODE_SCREEN_OFF_BALANCED);
+        scanModeMap.put(SCAN_MODE_LOW_LATENCY, SCAN_MODE_LOW_LATENCY);
+        scanModeMap.put(SCAN_MODE_AMBIENT_DISCOVERY, SCAN_MODE_SCREEN_OFF_BALANCED);
+
+        for (int i = 0; i < scanModeMap.size(); i++) {
+            int ScanMode = scanModeMap.keyAt(i);
+            int expectedScanMode = scanModeMap.get(ScanMode);
+            Log.d(TAG, "ScanMode: " + String.valueOf(ScanMode)
+                    + " expectedScanMode: " + String.valueOf(expectedScanMode));
+
+            // Turn off screen
+            sendMessageWaitForProcessed(createScreenOnOffMessage(false));
+            // Create scan client
+            ScanClient client = createScanClient(i, isFiltered, ScanMode);
+            // Start scan
+            sendMessageWaitForProcessed(createStartStopScanMessage(true, client));
+            assertThat(mScanManager.getRegularScanQueue().contains(client)).isTrue();
+            assertThat(mScanManager.getSuspendedScanQueue().contains(client)).isFalse();
+            assertThat(client.settings.getScanMode()).isEqualTo(expectedScanMode);
+            // Turn on screen
+            sendMessageWaitForProcessed(createScreenOnOffMessage(true));
+            assertThat(mScanManager.getRegularScanQueue().contains(client)).isTrue();
+            assertThat(mScanManager.getSuspendedScanQueue().contains(client)).isFalse();
+            assertThat(client.settings.getScanMode()).isEqualTo(ScanMode);
+        }
+    }
+
+    @Test
+    public void testUnfilteredScanTimeout() {
+        // Set filtered scan flag
+        final boolean isFiltered = false;
+        // Set scan mode map {original scan mode (ScanMode) : expected scan mode (expectedScanMode)}
+        SparseIntArray scanModeMap = new SparseIntArray();
+        scanModeMap.put(SCAN_MODE_LOW_POWER, SCAN_MODE_OPPORTUNISTIC);
+        scanModeMap.put(SCAN_MODE_BALANCED, SCAN_MODE_OPPORTUNISTIC);
+        scanModeMap.put(SCAN_MODE_LOW_LATENCY, SCAN_MODE_OPPORTUNISTIC);
+        scanModeMap.put(SCAN_MODE_AMBIENT_DISCOVERY, SCAN_MODE_OPPORTUNISTIC);
+        // Set scan timeout through Mock
+        when(mAdapterService.getScanTimeoutMillis()).thenReturn((long)DELAY_SCAN_TIMEOUT_MS);
+
+        for (int i = 0; i < scanModeMap.size(); i++) {
+            int ScanMode = scanModeMap.keyAt(i);
+            int expectedScanMode = scanModeMap.get(ScanMode);
+            Log.d(TAG, "ScanMode: " + String.valueOf(ScanMode)
+                    + " expectedScanMode: " + String.valueOf(expectedScanMode));
+
+            // Turn on screen
+            sendMessageWaitForProcessed(createScreenOnOffMessage(true));
+            // Create scan client
+            ScanClient client = createScanClient(i, isFiltered, ScanMode);
+            // Start scan
+            sendMessageWaitForProcessed(createStartStopScanMessage(true, client));
+            assertThat(client.settings.getScanMode()).isEqualTo(ScanMode);
+            // Wait for scan timeout
+            testSleep(DELAY_SCAN_TIMEOUT_MS + DELAY_ASYNC_MS);
+            assertThat(client.settings.getScanMode()).isEqualTo(expectedScanMode);
+            assertThat(client.stats.isScanTimeout(client.scannerId)).isTrue();
+            // Turn off screen
+            sendMessageWaitForProcessed(createScreenOnOffMessage(false));
+            assertThat(client.settings.getScanMode()).isEqualTo(expectedScanMode);
+            // Turn on screen
+            sendMessageWaitForProcessed(createScreenOnOffMessage(true));
+            assertThat(client.settings.getScanMode()).isEqualTo(expectedScanMode);
+            // Set as backgournd app
+            sendMessageWaitForProcessed(createImportanceMessage(false));
+            assertThat(client.settings.getScanMode()).isEqualTo(expectedScanMode);
+            // Set as foreground app
+            sendMessageWaitForProcessed(createImportanceMessage(true));
+            assertThat(client.settings.getScanMode()).isEqualTo(expectedScanMode);
+        }
+    }
+
+    @Test
+    public void testFilteredScanTimeout() {
+        // Set filtered scan flag
+        final boolean isFiltered = true;
+        // Set scan mode map {original scan mode (ScanMode) : expected scan mode (expectedScanMode)}
+        SparseIntArray scanModeMap = new SparseIntArray();
+        scanModeMap.put(SCAN_MODE_LOW_POWER, SCAN_MODE_LOW_POWER);
+        scanModeMap.put(SCAN_MODE_BALANCED, SCAN_MODE_LOW_POWER);
+        scanModeMap.put(SCAN_MODE_LOW_LATENCY, SCAN_MODE_LOW_POWER);
+        scanModeMap.put(SCAN_MODE_AMBIENT_DISCOVERY, SCAN_MODE_LOW_POWER);
+        // Set scan timeout through Mock
+        when(mAdapterService.getScanTimeoutMillis()).thenReturn((long)DELAY_SCAN_TIMEOUT_MS);
+
+        for (int i = 0; i < scanModeMap.size(); i++) {
+            int ScanMode = scanModeMap.keyAt(i);
+            int expectedScanMode = scanModeMap.get(ScanMode);
+            Log.d(TAG, "ScanMode: " + String.valueOf(ScanMode)
+                    + " expectedScanMode: " + String.valueOf(expectedScanMode));
+
+            // Turn on screen
+            sendMessageWaitForProcessed(createScreenOnOffMessage(true));
+            // Create scan client
+            ScanClient client = createScanClient(i, isFiltered, ScanMode);
+            // Start scan
+            sendMessageWaitForProcessed(createStartStopScanMessage(true, client));
+            assertThat(client.settings.getScanMode()).isEqualTo(ScanMode);
+            // Wait for scan timeout
+            testSleep(DELAY_SCAN_TIMEOUT_MS + DELAY_ASYNC_MS);
+            assertThat(client.settings.getScanMode()).isEqualTo(expectedScanMode);
+            assertThat(client.stats.isScanTimeout(client.scannerId)).isTrue();
+            // Turn off screen
+            sendMessageWaitForProcessed(createScreenOnOffMessage(false));
+            assertThat(client.settings.getScanMode()).isEqualTo(expectedScanMode);
+            // Turn on screen
+            sendMessageWaitForProcessed(createScreenOnOffMessage(true));
+            assertThat(client.settings.getScanMode()).isEqualTo(expectedScanMode);
+            // Set as backgournd app
+            sendMessageWaitForProcessed(createImportanceMessage(false));
+            assertThat(client.settings.getScanMode()).isEqualTo(expectedScanMode);
+            // Set as foreground app
+            sendMessageWaitForProcessed(createImportanceMessage(true));
+            assertThat(client.settings.getScanMode()).isEqualTo(expectedScanMode);
+        }
+    }
+
+    @Test
+    public void testSwitchForeBackgroundUnfilteredScan() {
+        // Set filtered scan flag
+        final boolean isFiltered = false;
+        // Set scan mode map {original scan mode (ScanMode) : expected scan mode (expectedScanMode)}
+        SparseIntArray scanModeMap = new SparseIntArray();
+        scanModeMap.put(SCAN_MODE_LOW_POWER, SCAN_MODE_LOW_POWER);
+        scanModeMap.put(SCAN_MODE_BALANCED, SCAN_MODE_LOW_POWER);
+        scanModeMap.put(SCAN_MODE_LOW_LATENCY, SCAN_MODE_LOW_POWER);
+        scanModeMap.put(SCAN_MODE_AMBIENT_DISCOVERY, SCAN_MODE_LOW_POWER);
+
+        for (int i = 0; i < scanModeMap.size(); i++) {
+            int ScanMode = scanModeMap.keyAt(i);
+            int expectedScanMode = scanModeMap.get(ScanMode);
+            Log.d(TAG, "ScanMode: " + String.valueOf(ScanMode)
+                    + " expectedScanMode: " + String.valueOf(expectedScanMode));
+
+            // Turn on screen
+            sendMessageWaitForProcessed(createScreenOnOffMessage(true));
+            // Create scan client
+            ScanClient client = createScanClient(i, isFiltered, ScanMode);
+            // Start scan
+            sendMessageWaitForProcessed(createStartStopScanMessage(true, client));
+            assertThat(mScanManager.getRegularScanQueue().contains(client)).isTrue();
+            assertThat(mScanManager.getSuspendedScanQueue().contains(client)).isFalse();
+            assertThat(client.settings.getScanMode()).isEqualTo(ScanMode);
+            // Set as backgournd app
+            sendMessageWaitForProcessed(createImportanceMessage(false));
+            assertThat(mScanManager.getRegularScanQueue().contains(client)).isTrue();
+            assertThat(mScanManager.getSuspendedScanQueue().contains(client)).isFalse();
+            assertThat(client.settings.getScanMode()).isEqualTo(expectedScanMode);
+            // Set as foreground app
+            sendMessageWaitForProcessed(createImportanceMessage(true));
+            assertThat(mScanManager.getRegularScanQueue().contains(client)).isTrue();
+            assertThat(mScanManager.getSuspendedScanQueue().contains(client)).isFalse();
+            assertThat(client.settings.getScanMode()).isEqualTo(ScanMode);
+        }
+    }
+
+    @Test
+    public void testSwitchForeBackgroundFilteredScan() {
+        // Set filtered scan flag
+        final boolean isFiltered = true;
+        // Set scan mode map {original scan mode (ScanMode) : expected scan mode (expectedScanMode)}
+        SparseIntArray scanModeMap = new SparseIntArray();
+        scanModeMap.put(SCAN_MODE_LOW_POWER, SCAN_MODE_LOW_POWER);
+        scanModeMap.put(SCAN_MODE_BALANCED, SCAN_MODE_LOW_POWER);
+        scanModeMap.put(SCAN_MODE_LOW_LATENCY, SCAN_MODE_LOW_POWER);
+        scanModeMap.put(SCAN_MODE_AMBIENT_DISCOVERY, SCAN_MODE_LOW_POWER);
+
+        for (int i = 0; i < scanModeMap.size(); i++) {
+            int ScanMode = scanModeMap.keyAt(i);
+            int expectedScanMode = scanModeMap.get(ScanMode);
+            Log.d(TAG, "ScanMode: " + String.valueOf(ScanMode)
+                    + " expectedScanMode: " + String.valueOf(expectedScanMode));
+
+            // Turn on screen
+            sendMessageWaitForProcessed(createScreenOnOffMessage(true));
+            // Create scan client
+            ScanClient client = createScanClient(i, isFiltered, ScanMode);
+            // Start scan
+            sendMessageWaitForProcessed(createStartStopScanMessage(true, client));
+            assertThat(mScanManager.getRegularScanQueue().contains(client)).isTrue();
+            assertThat(mScanManager.getSuspendedScanQueue().contains(client)).isFalse();
+            assertThat(client.settings.getScanMode()).isEqualTo(ScanMode);
+            // Set as backgournd app
+            sendMessageWaitForProcessed(createImportanceMessage(false));
+            assertThat(mScanManager.getRegularScanQueue().contains(client)).isTrue();
+            assertThat(mScanManager.getSuspendedScanQueue().contains(client)).isFalse();
+            assertThat(client.settings.getScanMode()).isEqualTo(expectedScanMode);
+            // Set as foreground app
+            sendMessageWaitForProcessed(createImportanceMessage(true));
+            assertThat(mScanManager.getRegularScanQueue().contains(client)).isTrue();
+            assertThat(mScanManager.getSuspendedScanQueue().contains(client)).isFalse();
+            assertThat(client.settings.getScanMode()).isEqualTo(ScanMode);
+        }
+    }
+}
diff --git a/android/app/tests/unit/src/com/android/bluetooth/hap/HapClientNativeInterfaceTest.java b/android/app/tests/unit/src/com/android/bluetooth/hap/HapClientNativeInterfaceTest.java
new file mode 100644
index 0000000..1d4ecbe
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/hap/HapClientNativeInterfaceTest.java
@@ -0,0 +1,254 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.hap;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import android.bluetooth.BluetoothHapPresetInfo;
+import android.bluetooth.BluetoothProfile;
+
+import org.junit.After;
+import org.junit.Before;
+import org.junit.Test;
+import org.mockito.ArgumentCaptor;
+import org.mockito.Mock;
+import org.mockito.MockitoAnnotations;
+
+public class HapClientNativeInterfaceTest {
+    private static final byte[] TEST_DEVICE_ADDRESS =
+            new byte[] { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
+    @Mock
+    HapClientService mService;
+
+    private HapClientNativeInterface mNativeInterface;
+
+    @Before
+    public void setUp() throws Exception {
+        MockitoAnnotations.initMocks(this);
+        when(mService.isAvailable()).thenReturn(true);
+        HapClientService.setHapClient(mService);
+        mNativeInterface = HapClientNativeInterface.getInstance();
+    }
+
+    @After
+    public void tearDown() {
+        HapClientService.setHapClient(null);
+    }
+
+    @Test
+    public void onConnectionStateChanged() {
+        int state = BluetoothProfile.STATE_CONNECTED;
+        mNativeInterface.onConnectionStateChanged(state, TEST_DEVICE_ADDRESS);
+
+        ArgumentCaptor<HapClientStackEvent> event =
+                ArgumentCaptor.forClass(HapClientStackEvent.class);
+        verify(mService).messageFromNative(event.capture());
+        assertThat(event.getValue().type).isEqualTo(
+                HapClientStackEvent.EVENT_TYPE_CONNECTION_STATE_CHANGED);
+        assertThat(event.getValue().valueInt1).isEqualTo(state);
+    }
+
+    @Test
+    public void onDeviceAvailable() {
+        int features = 1;
+        mNativeInterface.onDeviceAvailable(TEST_DEVICE_ADDRESS, features);
+
+        ArgumentCaptor<HapClientStackEvent> event =
+                ArgumentCaptor.forClass(HapClientStackEvent.class);
+        verify(mService).messageFromNative(event.capture());
+        assertThat(event.getValue().type).isEqualTo(
+                HapClientStackEvent.EVENT_TYPE_DEVICE_AVAILABLE);
+        assertThat(event.getValue().valueInt1).isEqualTo(features);
+    }
+
+    @Test
+    public void onFeaturesUpdate() {
+        int features = 1;
+        mNativeInterface.onFeaturesUpdate(TEST_DEVICE_ADDRESS, features);
+
+        ArgumentCaptor<HapClientStackEvent> event =
+                ArgumentCaptor.forClass(HapClientStackEvent.class);
+        verify(mService).messageFromNative(event.capture());
+        assertThat(event.getValue().type).isEqualTo(
+                HapClientStackEvent.EVENT_TYPE_DEVICE_FEATURES);
+        assertThat(event.getValue().valueInt1).isEqualTo(features);
+    }
+
+    @Test
+    public void onActivePresetSelected() {
+        int presetIndex = 0;
+        mNativeInterface.onActivePresetSelected(TEST_DEVICE_ADDRESS, presetIndex);
+
+        ArgumentCaptor<HapClientStackEvent> event =
+                ArgumentCaptor.forClass(HapClientStackEvent.class);
+        verify(mService).messageFromNative(event.capture());
+        assertThat(event.getValue().type).isEqualTo(
+                HapClientStackEvent.EVENT_TYPE_ON_ACTIVE_PRESET_SELECTED);
+        assertThat(event.getValue().valueInt1).isEqualTo(presetIndex);
+    }
+
+    @Test
+    public void onActivePresetGroupSelected() {
+        int groupId = 1;
+        int presetIndex = 0;
+        mNativeInterface.onActivePresetGroupSelected(groupId, presetIndex);
+
+        ArgumentCaptor<HapClientStackEvent> event =
+                ArgumentCaptor.forClass(HapClientStackEvent.class);
+        verify(mService).messageFromNative(event.capture());
+        assertThat(event.getValue().type).isEqualTo(
+                HapClientStackEvent.EVENT_TYPE_ON_ACTIVE_PRESET_SELECTED);
+        assertThat(event.getValue().valueInt1).isEqualTo(presetIndex);
+        assertThat(event.getValue().valueInt2).isEqualTo(groupId);
+    }
+
+
+    @Test
+    public void onActivePresetSelectError() {
+        int resultCode = -1;
+        mNativeInterface.onActivePresetSelectError(TEST_DEVICE_ADDRESS, resultCode);
+
+        ArgumentCaptor<HapClientStackEvent> event =
+                ArgumentCaptor.forClass(HapClientStackEvent.class);
+        verify(mService).messageFromNative(event.capture());
+        assertThat(event.getValue().type).isEqualTo(
+                HapClientStackEvent.EVENT_TYPE_ON_ACTIVE_PRESET_SELECT_ERROR);
+        assertThat(event.getValue().valueInt1).isEqualTo(resultCode);
+    }
+
+    @Test
+    public void onActivePresetGroupSelectError() {
+        int groupId = 1;
+        int resultCode = -2;
+        mNativeInterface.onActivePresetGroupSelectError(groupId, resultCode);
+
+        ArgumentCaptor<HapClientStackEvent> event =
+                ArgumentCaptor.forClass(HapClientStackEvent.class);
+        verify(mService).messageFromNative(event.capture());
+        assertThat(event.getValue().type).isEqualTo(
+                HapClientStackEvent.EVENT_TYPE_ON_ACTIVE_PRESET_SELECT_ERROR);
+        assertThat(event.getValue().valueInt1).isEqualTo(resultCode);
+        assertThat(event.getValue().valueInt2).isEqualTo(groupId);
+    }
+
+    @Test
+    public void onPresetInfo() {
+        int infoReason = HapClientStackEvent.PRESET_INFO_REASON_ALL_PRESET_INFO;
+        BluetoothHapPresetInfo[] presets =
+                {new BluetoothHapPresetInfo.Builder(0x01, "onPresetInfo")
+                        .setWritable(true)
+                        .setAvailable(false)
+                        .build()};
+        mNativeInterface.onPresetInfo(TEST_DEVICE_ADDRESS, infoReason, presets);
+
+        ArgumentCaptor<HapClientStackEvent> event =
+                ArgumentCaptor.forClass(HapClientStackEvent.class);
+        verify(mService).messageFromNative(event.capture());
+        assertThat(event.getValue().type).isEqualTo(
+                HapClientStackEvent.EVENT_TYPE_ON_PRESET_INFO);
+        assertThat(event.getValue().valueInt2).isEqualTo(infoReason);
+        assertThat(event.getValue().valueList.toArray()).isEqualTo(presets);
+    }
+
+    @Test
+    public void onGroupPresetInfo() {
+        int groupId = 100;
+        int infoReason = HapClientStackEvent.PRESET_INFO_REASON_ALL_PRESET_INFO;
+        BluetoothHapPresetInfo[] presets =
+                {new BluetoothHapPresetInfo.Builder(0x01, "onPresetInfo")
+                        .setWritable(true)
+                        .setAvailable(false)
+                        .build()};
+        mNativeInterface.onGroupPresetInfo(groupId, infoReason, presets);
+
+        ArgumentCaptor<HapClientStackEvent> event =
+                ArgumentCaptor.forClass(HapClientStackEvent.class);
+        verify(mService).messageFromNative(event.capture());
+        assertThat(event.getValue().type).isEqualTo(
+                HapClientStackEvent.EVENT_TYPE_ON_PRESET_INFO);
+        assertThat(event.getValue().valueInt2).isEqualTo(infoReason);
+        assertThat(event.getValue().valueInt3).isEqualTo(groupId);
+        assertThat(event.getValue().valueList.toArray()).isEqualTo(presets);
+    }
+
+    @Test
+    public void onPresetNameSetError() {
+        int presetIndex = 2;
+        int resultCode = HapClientStackEvent.STATUS_SET_NAME_NOT_ALLOWED;
+        mNativeInterface.onPresetNameSetError(TEST_DEVICE_ADDRESS, presetIndex, resultCode);
+
+        ArgumentCaptor<HapClientStackEvent> event =
+                ArgumentCaptor.forClass(HapClientStackEvent.class);
+        verify(mService).messageFromNative(event.capture());
+        assertThat(event.getValue().type).isEqualTo(
+                HapClientStackEvent.EVENT_TYPE_ON_PRESET_NAME_SET_ERROR);
+        assertThat(event.getValue().valueInt1).isEqualTo(resultCode);
+        assertThat(event.getValue().valueInt2).isEqualTo(presetIndex);
+    }
+
+    @Test
+    public void onGroupPresetNameSetError() {
+        int groupId = 5;
+        int presetIndex = 2;
+        int resultCode = HapClientStackEvent.STATUS_SET_NAME_NOT_ALLOWED;
+        mNativeInterface.onGroupPresetNameSetError(groupId, presetIndex, resultCode);
+
+        ArgumentCaptor<HapClientStackEvent> event =
+                ArgumentCaptor.forClass(HapClientStackEvent.class);
+        verify(mService).messageFromNative(event.capture());
+        assertThat(event.getValue().type).isEqualTo(
+                HapClientStackEvent.EVENT_TYPE_ON_PRESET_NAME_SET_ERROR);
+        assertThat(event.getValue().valueInt1).isEqualTo(resultCode);
+        assertThat(event.getValue().valueInt2).isEqualTo(presetIndex);
+        assertThat(event.getValue().valueInt3).isEqualTo(groupId);
+    }
+
+    @Test
+    public void onPresetInfoError() {
+        int presetIndex = 2;
+        int resultCode = HapClientStackEvent.STATUS_SET_NAME_NOT_ALLOWED;
+        mNativeInterface.onPresetInfoError(TEST_DEVICE_ADDRESS, presetIndex, resultCode);
+
+        ArgumentCaptor<HapClientStackEvent> event =
+                ArgumentCaptor.forClass(HapClientStackEvent.class);
+        verify(mService).messageFromNative(event.capture());
+        assertThat(event.getValue().type).isEqualTo(
+                HapClientStackEvent.EVENT_TYPE_ON_PRESET_INFO_ERROR);
+        assertThat(event.getValue().valueInt1).isEqualTo(resultCode);
+        assertThat(event.getValue().valueInt2).isEqualTo(presetIndex);
+    }
+
+    @Test
+    public void onGroupPresetInfoError() {
+        int groupId = 5;
+        int presetIndex = 2;
+        int resultCode = HapClientStackEvent.STATUS_SET_NAME_NOT_ALLOWED;
+        mNativeInterface.onGroupPresetInfoError(groupId, presetIndex, resultCode);
+
+        ArgumentCaptor<HapClientStackEvent> event =
+                ArgumentCaptor.forClass(HapClientStackEvent.class);
+        verify(mService).messageFromNative(event.capture());
+        assertThat(event.getValue().type).isEqualTo(
+                HapClientStackEvent.EVENT_TYPE_ON_PRESET_INFO_ERROR);
+        assertThat(event.getValue().valueInt1).isEqualTo(resultCode);
+        assertThat(event.getValue().valueInt2).isEqualTo(presetIndex);
+        assertThat(event.getValue().valueInt3).isEqualTo(groupId);
+    }
+}
diff --git a/android/app/tests/unit/src/com/android/bluetooth/hap/HapClientStackEventTest.java b/android/app/tests/unit/src/com/android/bluetooth/hap/HapClientStackEventTest.java
new file mode 100644
index 0000000..20a6790
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/hap/HapClientStackEventTest.java
@@ -0,0 +1,165 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.hap;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.junit.runners.JUnit4;
+
+@RunWith(JUnit4.class)
+public final class HapClientStackEventTest {
+
+  @Test
+  public void toString_containsProperSubStrings() {
+    HapClientStackEvent event;
+    String eventStr;
+    event = new HapClientStackEvent(0 /* EVENT_TYPE_NONE */);
+    eventStr = event.toString();
+    assertThat(eventStr).contains("EVENT_TYPE_NONE");
+
+    event = new HapClientStackEvent(10000);
+    eventStr = event.toString();
+    assertThat(eventStr).contains("EVENT_TYPE_UNKNOWN");
+
+    event = new HapClientStackEvent(HapClientStackEvent.EVENT_TYPE_CONNECTION_STATE_CHANGED);
+    event.valueInt1 = -1;
+    eventStr = event.toString();
+    assertThat(eventStr).contains("EVENT_TYPE_CONNECTION_STATE_CHANGED");
+    assertThat(eventStr).contains("CONNECTION_STATE_UNKNOWN");
+
+    event.valueInt1 = HapClientStackEvent.CONNECTION_STATE_DISCONNECTED;
+    eventStr = event.toString();
+    assertThat(eventStr).contains("CONNECTION_STATE_DISCONNECTED");
+
+    event.valueInt1 = HapClientStackEvent.CONNECTION_STATE_CONNECTING;
+    eventStr = event.toString();
+    assertThat(eventStr).contains("CONNECTION_STATE_CONNECTING");
+
+    event.valueInt1 = HapClientStackEvent.CONNECTION_STATE_CONNECTED;
+    eventStr = event.toString();
+    assertThat(eventStr).contains("CONNECTION_STATE_CONNECTED");
+
+    event.valueInt1 = HapClientStackEvent.CONNECTION_STATE_DISCONNECTING;
+    eventStr = event.toString();
+    assertThat(eventStr).contains("CONNECTION_STATE_DISCONNECTING");
+
+    event = new HapClientStackEvent(HapClientStackEvent.EVENT_TYPE_DEVICE_AVAILABLE);
+    eventStr = event.toString();
+    assertThat(eventStr).contains("EVENT_TYPE_DEVICE_AVAILABLE");
+
+    event.valueInt1 = 1 << HapClientStackEvent.FEATURE_BIT_NUM_TYPE_MONAURAL
+            | 1 << HapClientStackEvent.FEATURE_BIT_NUM_SYNCHRONIZATED_PRESETS;
+    eventStr = event.toString();
+    assertThat(eventStr).contains("TYPE_MONAURAL");
+    assertThat(eventStr).contains("SYNCHRONIZATED_PRESETS");
+
+    event.valueInt1 = 1 << HapClientStackEvent.FEATURE_BIT_NUM_TYPE_BANDED
+            | 1 << HapClientStackEvent.FEATURE_BIT_NUM_INDEPENDENT_PRESETS;
+    eventStr = event.toString();
+    assertThat(eventStr).contains("TYPE_BANDED");
+    assertThat(eventStr).contains("INDEPENDENT_PRESETS");
+
+    event.valueInt1 = 1 << HapClientStackEvent.FEATURE_BIT_NUM_DYNAMIC_PRESETS
+            | 1 << HapClientStackEvent.FEATURE_BIT_NUM_WRITABLE_PRESETS;
+    eventStr = event.toString();
+    assertThat(eventStr).contains("TYPE_BINAURAL");
+    assertThat(eventStr).contains("DYNAMIC_PRESETS");
+    assertThat(eventStr).contains("WRITABLE_PRESETS");
+
+    event = new HapClientStackEvent(HapClientStackEvent.EVENT_TYPE_DEVICE_FEATURES);
+    eventStr = event.toString();
+    assertThat(eventStr).contains("EVENT_TYPE_DEVICE_FEATURES");
+
+    event = new HapClientStackEvent(HapClientStackEvent.EVENT_TYPE_ON_ACTIVE_PRESET_SELECTED);
+    eventStr = event.toString();
+    assertThat(eventStr).contains("EVENT_TYPE_ON_ACTIVE_PRESET_SELECTED");
+
+    event = new HapClientStackEvent(HapClientStackEvent.EVENT_TYPE_ON_ACTIVE_PRESET_SELECT_ERROR);
+    event.valueInt1 = -1;
+    eventStr = event.toString();
+    assertThat(eventStr).contains("EVENT_TYPE_ON_ACTIVE_PRESET_SELECT_ERROR");
+    assertThat(eventStr).contains("ERROR_UNKNOWN");
+
+    event.valueInt1 = HapClientStackEvent.STATUS_NO_ERROR;
+    eventStr = event.toString();
+    assertThat(eventStr).contains("STATUS_NO_ERROR");
+
+    event.valueInt1 = HapClientStackEvent.STATUS_SET_NAME_NOT_ALLOWED;
+    eventStr = event.toString();
+    assertThat(eventStr).contains("STATUS_SET_NAME_NOT_ALLOWED");
+
+    event.valueInt1 = HapClientStackEvent.STATUS_OPERATION_NOT_SUPPORTED;
+    eventStr = event.toString();
+    assertThat(eventStr).contains("STATUS_OPERATION_NOT_SUPPORTED");
+
+    event.valueInt1 = HapClientStackEvent.STATUS_OPERATION_NOT_POSSIBLE;
+    eventStr = event.toString();
+    assertThat(eventStr).contains("STATUS_OPERATION_NOT_POSSIBLE");
+
+    event.valueInt1 = HapClientStackEvent.STATUS_INVALID_PRESET_NAME_LENGTH;
+    eventStr = event.toString();
+    assertThat(eventStr).contains("STATUS_INVALID_PRESET_NAME_LENGTH");
+
+    event.valueInt1 = HapClientStackEvent.STATUS_INVALID_PRESET_INDEX;
+    eventStr = event.toString();
+    assertThat(eventStr).contains("STATUS_INVALID_PRESET_INDEX");
+
+    event.valueInt1 = HapClientStackEvent.STATUS_GROUP_OPERATION_NOT_SUPPORTED;
+    eventStr = event.toString();
+    assertThat(eventStr).contains("STATUS_GROUP_OPERATION_NOT_SUPPORTED");
+
+    event.valueInt1 = HapClientStackEvent.STATUS_PROCEDURE_ALREADY_IN_PROGRESS;
+    eventStr = event.toString();
+    assertThat(eventStr).contains("STATUS_PROCEDURE_ALREADY_IN_PROGRESS");
+
+    event = new HapClientStackEvent(HapClientStackEvent.EVENT_TYPE_ON_PRESET_INFO);
+    event.valueInt2 = -1;
+    eventStr = event.toString();
+    assertThat(eventStr).contains("EVENT_TYPE_ON_PRESET_INFO");
+    assertThat(eventStr).contains("UNKNOWN");
+
+    event.valueInt2 = HapClientStackEvent.PRESET_INFO_REASON_ALL_PRESET_INFO;
+    eventStr = event.toString();
+    assertThat(eventStr).contains("PRESET_INFO_REASON_ALL_PRESET_INFO");
+
+    event.valueInt2 = HapClientStackEvent.PRESET_INFO_REASON_PRESET_INFO_UPDATE;
+    eventStr = event.toString();
+    assertThat(eventStr).contains("PRESET_INFO_REASON_PRESET_INFO_UPDATE");
+
+    event.valueInt2 = HapClientStackEvent.PRESET_INFO_REASON_PRESET_DELETED;
+    eventStr = event.toString();
+    assertThat(eventStr).contains("PRESET_INFO_REASON_PRESET_DELETED");
+
+    event.valueInt2 = HapClientStackEvent.PRESET_INFO_REASON_PRESET_AVAILABILITY_CHANGED;
+    eventStr = event.toString();
+    assertThat(eventStr).contains("PRESET_INFO_REASON_PRESET_AVAILABILITY_CHANGED");
+
+    event.valueInt2 = HapClientStackEvent.PRESET_INFO_REASON_PRESET_INFO_REQUEST_RESPONSE;
+    eventStr = event.toString();
+    assertThat(eventStr).contains("PRESET_INFO_REASON_PRESET_INFO_REQUEST_RESPONSE");
+
+    event = new HapClientStackEvent(HapClientStackEvent.EVENT_TYPE_ON_PRESET_NAME_SET_ERROR);
+    eventStr = event.toString();
+    assertThat(eventStr).contains("EVENT_TYPE_ON_PRESET_NAME_SET_ERROR");
+
+    event = new HapClientStackEvent(HapClientStackEvent.EVENT_TYPE_ON_PRESET_INFO_ERROR);
+    eventStr = event.toString();
+    assertThat(eventStr).contains("EVENT_TYPE_ON_PRESET_INFO_ERROR");
+  }
+}
diff --git a/android/app/tests/unit/src/com/android/bluetooth/hap/HapClientStateMachineTest.java b/android/app/tests/unit/src/com/android/bluetooth/hap/HapClientStateMachineTest.java
index 3f88b34..3fb878c 100644
--- a/android/app/tests/unit/src/com/android/bluetooth/hap/HapClientStateMachineTest.java
+++ b/android/app/tests/unit/src/com/android/bluetooth/hap/HapClientStateMachineTest.java
@@ -20,7 +20,10 @@
 import static org.mockito.ArgumentMatchers.any;
 import static org.mockito.ArgumentMatchers.anyString;
 import static org.mockito.ArgumentMatchers.eq;
-import static org.mockito.Mockito.*;
+import static org.mockito.Mockito.after;
+import static org.mockito.Mockito.doReturn;
+import static org.mockito.Mockito.timeout;
+import static org.mockito.Mockito.verify;
 
 import android.bluetooth.BluetoothAdapter;
 import android.bluetooth.BluetoothDevice;
@@ -28,20 +31,24 @@
 import android.content.Context;
 import android.content.Intent;
 import android.os.HandlerThread;
+import android.os.Message;
 import android.test.suitebuilder.annotation.MediumTest;
 
 import androidx.test.InstrumentationRegistry;
 import androidx.test.runner.AndroidJUnit4;
 
-import com.android.bluetooth.R;
 import com.android.bluetooth.TestUtils;
 import com.android.bluetooth.btservice.AdapterService;
 
 import org.hamcrest.core.IsInstanceOf;
-import org.junit.*;
+import org.junit.After;
+import org.junit.Assert;
+import org.junit.Before;
+import org.junit.Test;
 import org.junit.runner.RunWith;
 import org.mockito.ArgumentCaptor;
 import org.mockito.Mock;
+import org.mockito.Mockito;
 import org.mockito.MockitoAnnotations;
 
 @MediumTest
@@ -257,4 +264,118 @@
                 IsInstanceOf.instanceOf(HapClientStateMachine.Disconnected.class));
         verify(mHearingAccessGattClientInterface).disconnectHapClient(eq(mTestDevice));
     }
+
+    @Test
+    public void testStatesChangesWithMessages() {
+        allowConnection(true);
+        doReturn(true).when(mHearingAccessGattClientInterface).connectHapClient(any(
+                BluetoothDevice.class));
+
+        // Check that we are in Disconnected state
+        Assert.assertThat(mHapClientStateMachine.getCurrentState(),
+                IsInstanceOf.instanceOf(HapClientStateMachine.Disconnected.class));
+
+        mHapClientStateMachine.sendMessage(HapClientStateMachine.DISCONNECT);
+        // verify disconnectHapClient was called
+        verify(mHearingAccessGattClientInterface, timeout(TIMEOUT_MS).times(1))
+                .disconnectHapClient(any(BluetoothDevice.class));
+
+        // disconnected -> connecting
+        sendMessageAndVerifyTransition(
+                mHapClientStateMachine.obtainMessage(HapClientStateMachine.CONNECT),
+                HapClientStateMachine.Connecting.class);
+        // connecting -> disconnected
+        sendMessageAndVerifyTransition(
+                mHapClientStateMachine.obtainMessage(HapClientStateMachine.CONNECT_TIMEOUT),
+                HapClientStateMachine.Disconnected.class);
+
+        // disconnected -> connecting
+        sendMessageAndVerifyTransition(
+                mHapClientStateMachine.obtainMessage(HapClientStateMachine.CONNECT),
+                HapClientStateMachine.Connecting.class);
+        // connecting -> disconnected
+        sendMessageAndVerifyTransition(
+                mHapClientStateMachine.obtainMessage(HapClientStateMachine.DISCONNECT),
+                HapClientStateMachine.Disconnected.class);
+
+        // disconnected -> connecting
+        sendMessageAndVerifyTransition(
+                mHapClientStateMachine.obtainMessage(HapClientStateMachine.CONNECT),
+                HapClientStateMachine.Connecting.class);
+        // connecting -> disconnecting
+        HapClientStackEvent connStCh = new HapClientStackEvent(
+                HapClientStackEvent.EVENT_TYPE_CONNECTION_STATE_CHANGED);
+        connStCh.device = mTestDevice;
+        connStCh.valueInt1 = HapClientStackEvent.CONNECTION_STATE_DISCONNECTING;
+        sendMessageAndVerifyTransition(
+                mHapClientStateMachine.obtainMessage(HapClientStateMachine.STACK_EVENT, connStCh),
+                HapClientStateMachine.Disconnecting.class);
+        // disconnecting -> connecting
+        connStCh = new HapClientStackEvent(
+                HapClientStackEvent.EVENT_TYPE_CONNECTION_STATE_CHANGED);
+        connStCh.device = mTestDevice;
+        connStCh.valueInt1 = HapClientStackEvent.CONNECTION_STATE_CONNECTING;
+        sendMessageAndVerifyTransition(
+                mHapClientStateMachine.obtainMessage(HapClientStateMachine.STACK_EVENT, connStCh),
+                HapClientStateMachine.Connecting.class);
+        // connecting -> connected
+        connStCh = new HapClientStackEvent(
+                HapClientStackEvent.EVENT_TYPE_CONNECTION_STATE_CHANGED);
+        connStCh.device = mTestDevice;
+        connStCh.valueInt1 = HapClientStackEvent.CONNECTION_STATE_CONNECTED;
+        sendMessageAndVerifyTransition(
+                mHapClientStateMachine.obtainMessage(HapClientStateMachine.STACK_EVENT, connStCh),
+                HapClientStateMachine.Connected.class);
+        // connected -> disconnecting
+        connStCh = new HapClientStackEvent(
+                HapClientStackEvent.EVENT_TYPE_CONNECTION_STATE_CHANGED);
+        connStCh.device = mTestDevice;
+        connStCh.valueInt1 = HapClientStackEvent.CONNECTION_STATE_DISCONNECTING;
+        sendMessageAndVerifyTransition(
+                mHapClientStateMachine.obtainMessage(HapClientStateMachine.STACK_EVENT, connStCh),
+                HapClientStateMachine.Disconnecting.class);
+        // disconnecting -> disconnected
+        sendMessageAndVerifyTransition(
+                mHapClientStateMachine.obtainMessage(HapClientStateMachine.CONNECT_TIMEOUT),
+                HapClientStateMachine.Disconnected.class);
+
+        // disconnected -> connected
+        connStCh = new HapClientStackEvent(
+                HapClientStackEvent.EVENT_TYPE_CONNECTION_STATE_CHANGED);
+        connStCh.device = mTestDevice;
+        connStCh.valueInt1 = HapClientStackEvent.CONNECTION_STATE_CONNECTED;
+        sendMessageAndVerifyTransition(
+                mHapClientStateMachine.obtainMessage(HapClientStateMachine.STACK_EVENT, connStCh),
+                HapClientStateMachine.Connected.class);
+        // connected -> disconnected
+        sendMessageAndVerifyTransition(
+                mHapClientStateMachine.obtainMessage(HapClientStateMachine.DISCONNECT),
+                HapClientStateMachine.Disconnected.class);
+
+        // disconnected -> connected
+        connStCh = new HapClientStackEvent(
+                HapClientStackEvent.EVENT_TYPE_CONNECTION_STATE_CHANGED);
+        connStCh.device = mTestDevice;
+        connStCh.valueInt1 = HapClientStackEvent.CONNECTION_STATE_CONNECTED;
+        sendMessageAndVerifyTransition(
+                mHapClientStateMachine.obtainMessage(HapClientStateMachine.STACK_EVENT, connStCh),
+                HapClientStateMachine.Connected.class);
+        // connected -> disconnected
+        connStCh = new HapClientStackEvent(
+                HapClientStackEvent.EVENT_TYPE_CONNECTION_STATE_CHANGED);
+        connStCh.device = mTestDevice;
+        connStCh.valueInt1 = HapClientStackEvent.CONNECTION_STATE_DISCONNECTED;
+        sendMessageAndVerifyTransition(
+                mHapClientStateMachine.obtainMessage(HapClientStateMachine.STACK_EVENT, connStCh),
+                HapClientStateMachine.Disconnected.class);
+    }
+
+    private <T> void sendMessageAndVerifyTransition(Message msg, Class<T> type) {
+        Mockito.clearInvocations(mHapClientService);
+        mHapClientStateMachine.sendMessage(msg);
+        // Verify that one connection state broadcast is executed
+        verify(mHapClientService, timeout(TIMEOUT_MS).times(1)).sendBroadcast(
+                any(Intent.class), anyString());
+        Assert.assertThat(mHapClientStateMachine.getCurrentState(), IsInstanceOf.instanceOf(type));
+    }
 }
diff --git a/android/app/tests/unit/src/com/android/bluetooth/hap/HapClientTest.java b/android/app/tests/unit/src/com/android/bluetooth/hap/HapClientTest.java
index 77eb6e9..3c2819e 100644
--- a/android/app/tests/unit/src/com/android/bluetooth/hap/HapClientTest.java
+++ b/android/app/tests/unit/src/com/android/bluetooth/hap/HapClientTest.java
@@ -17,9 +17,26 @@
 
 package com.android.bluetooth.hap;
 
-import static org.mockito.Mockito.*;
+import static org.mockito.Mockito.after;
+import static org.mockito.Mockito.any;
+import static org.mockito.Mockito.anyInt;
+import static org.mockito.Mockito.anyString;
+import static org.mockito.Mockito.doCallRealMethod;
+import static org.mockito.Mockito.doReturn;
+import static org.mockito.Mockito.eq;
+import static org.mockito.Mockito.times;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
 
-import android.bluetooth.*;
+import android.bluetooth.BluetoothAdapter;
+import android.bluetooth.BluetoothDevice;
+import android.bluetooth.BluetoothHapClient;
+import android.bluetooth.BluetoothHapPresetInfo;
+import android.bluetooth.BluetoothProfile;
+import android.bluetooth.BluetoothStatusCodes;
+import android.bluetooth.BluetoothUuid;
+import android.bluetooth.IBluetoothHapClientCallback;
+import android.content.AttributionSource;
 import android.content.BroadcastReceiver;
 import android.content.Context;
 import android.content.Intent;
@@ -28,32 +45,32 @@
 import android.os.Looper;
 import android.os.ParcelUuid;
 import android.os.RemoteException;
-import android.util.Log;
 
 import androidx.test.InstrumentationRegistry;
 import androidx.test.filters.MediumTest;
 import androidx.test.rule.ServiceTestRule;
 import androidx.test.runner.AndroidJUnit4;
 
-import com.android.bluetooth.R;
 import com.android.bluetooth.TestUtils;
 import com.android.bluetooth.Utils;
 import com.android.bluetooth.btservice.AdapterService;
 import com.android.bluetooth.btservice.ServiceFactory;
 import com.android.bluetooth.btservice.storage.DatabaseManager;
 import com.android.bluetooth.csip.CsipSetCoordinatorService;
+import com.android.bluetooth.x.com.android.modules.utils.SynchronousResultReceiver;
 
 import org.junit.After;
 import org.junit.Assert;
-import org.junit.Assume;
 import org.junit.Before;
 import org.junit.Rule;
 import org.junit.Test;
 import org.junit.runner.RunWith;
 import org.mockito.ArgumentCaptor;
 import org.mockito.Mock;
+import org.mockito.Mockito;
 import org.mockito.MockitoAnnotations;
 
+import java.time.Duration;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.HashMap;
@@ -66,6 +83,8 @@
 @MediumTest
 @RunWith(AndroidJUnit4.class)
 public class HapClientTest {
+    private final String mFlagDexmarker = System.getProperty("dexmaker.share_classloader", "false");
+
     private static final int TIMEOUT_MS = 1000;
     @Rule
     public final ServiceTestRule mServiceRule = new ServiceTestRule();
@@ -75,6 +94,8 @@
     private BluetoothDevice mDevice3;
     private Context mTargetContext;
     private HapClientService mService;
+    private HapClientService.BluetoothHapClientBinder mServiceBinder;
+    private AttributionSource mAttributionSource;
     private HasIntentReceiver mHasIntentReceiver;
     private HashMap<BluetoothDevice, LinkedBlockingQueue<Intent>> mIntentQueue;
 
@@ -95,6 +116,10 @@
 
     @Before
     public void setUp() throws Exception {
+        if (!mFlagDexmarker.equals("true")) {
+            System.setProperty("dexmaker.share_classloader", "true");
+        }
+
         mTargetContext = InstrumentationRegistry.getTargetContext();
         // Set up mocks and test assets
         MockitoAnnotations.initMocks(this);
@@ -110,11 +135,14 @@
         doReturn(true, false).when(mAdapterService).isStartedProfile(anyString());
 
         mAdapter = BluetoothAdapter.getDefaultAdapter();
+        mAttributionSource = mAdapter.getAttributionSource();
 
         startService();
         mService.mHapClientNativeInterface = mNativeInterface;
         mService.mFactory = mServiceFactory;
         doReturn(mCsipService).when(mServiceFactory).getCsipSetCoordinatorService();
+        mServiceBinder = (HapClientService.BluetoothHapClientBinder) mService.initBinder();
+        mServiceBinder.mIsTesting = true;
 
         // Set up the State Changed receiver
         IntentFilter filter = new IntentFilter();
@@ -134,6 +162,21 @@
         mDevice3 = TestUtils.getTestDevice(mAdapter, 2);
         when(mNativeInterface.getDevice(getByteAddress(mDevice3))).thenReturn(mDevice3);
 
+        doCallRealMethod().when(mNativeInterface)
+                .sendMessageToService(any(HapClientStackEvent.class));
+        doCallRealMethod().when(mNativeInterface).onFeaturesUpdate(any(byte[].class), anyInt());
+        doCallRealMethod().when(mNativeInterface).onDeviceAvailable(any(byte[].class), anyInt());
+        doCallRealMethod().when(mNativeInterface)
+                .onActivePresetSelected(any(byte[].class), anyInt());
+        doCallRealMethod().when(mNativeInterface)
+                .onActivePresetSelectError(any(byte[].class), anyInt());
+        doCallRealMethod().when(mNativeInterface)
+                .onPresetNameSetError(any(byte[].class), anyInt(), anyInt());
+        doCallRealMethod().when(mNativeInterface)
+                .onPresetInfo(any(byte[].class), anyInt(), any(BluetoothHapPresetInfo[].class));
+        doCallRealMethod().when(mNativeInterface)
+                .onGroupPresetNameSetError(anyInt(), anyInt(), anyInt());
+
         /* Prepare CAS groups */
         doReturn(Arrays.asList(0x02, 0x03)).when(mCsipService).getAllGroupIds(BluetoothUuid.CAP);
 
@@ -170,6 +213,10 @@
 
     @After
     public void tearDown() throws Exception {
+        if (!mFlagDexmarker.equals("true")) {
+            System.setProperty("dexmaker.share_classloader", mFlagDexmarker);
+        }
+
         if (mService == null) {
             return;
         }
@@ -177,11 +224,19 @@
         mService.mCallbacks.unregister(mCallback);
 
         stopService();
-        mTargetContext.unregisterReceiver(mHasIntentReceiver);
+
+        if (mHasIntentReceiver != null) {
+            mTargetContext.unregisterReceiver(mHasIntentReceiver);
+        }
 
         mAdapter = null;
-        TestUtils.clearAdapterService(mAdapterService);
-        mIntentQueue.clear();
+
+        if (mAdapterService != null) {
+            TestUtils.clearAdapterService(mAdapterService);
+        }
+
+        if (mIntentQueue != null)
+            mIntentQueue.clear();
     }
 
     private void startService() throws TimeoutException {
@@ -227,7 +282,7 @@
      * Test get/set policy for BluetoothDevice
      */
     @Test
-    public void testGetSetPolicy() {
+    public void testGetSetPolicy() throws Exception {
         when(mDatabaseManager
                 .getProfileConnectionPolicy(mDevice, BluetoothProfile.HAP_CLIENT))
                 .thenReturn(BluetoothProfile.CONNECTION_POLICY_UNKNOWN);
@@ -245,9 +300,14 @@
         when(mDatabaseManager
                 .getProfileConnectionPolicy(mDevice, BluetoothProfile.HAP_CLIENT))
                 .thenReturn(BluetoothProfile.CONNECTION_POLICY_ALLOWED);
+        // call getConnectionPolicy via binder
+        final SynchronousResultReceiver<Integer> recv = SynchronousResultReceiver.get();
+        int defaultRecvValue = -1000;
+        mServiceBinder.getConnectionPolicy(mDevice, mAttributionSource, recv);
+        int policy = recv.awaitResultNoInterrupt(Duration.ofMillis(TIMEOUT_MS))
+                .getValue(defaultRecvValue);
         Assert.assertEquals("Setting device policy to POLICY_ALLOWED",
-                BluetoothProfile.CONNECTION_POLICY_ALLOWED,
-                mService.getConnectionPolicy(mDevice));
+                BluetoothProfile.CONNECTION_POLICY_ALLOWED, policy);
     }
 
     /**
@@ -365,7 +425,7 @@
      * Test that an outgoing connection times out
      */
     @Test
-    public void testOutgoingConnectTimeout() {
+    public void testOutgoingConnectTimeout() throws Exception {
         // Update the device policy so okToConnect() returns true
         when(mDatabaseManager
                 .getProfileConnectionPolicy(mDevice, BluetoothProfile.HAP_CLIENT))
@@ -382,19 +442,22 @@
         Assert.assertEquals(BluetoothProfile.STATE_CONNECTING,
                 mService.getConnectionState(mDevice));
 
-        // Verify the connection state broadcast, and that we are in Disconnected state
+        // Verify the connection state broadcast, and that we are in Disconnected state via binder
         verifyConnectionStateIntent(HapClientStateMachine.sConnectTimeoutMs * 2,
-                mDevice, BluetoothProfile.STATE_DISCONNECTED,
-                BluetoothProfile.STATE_CONNECTING);
-        Assert.assertEquals(BluetoothProfile.STATE_DISCONNECTED,
-                mService.getConnectionState(mDevice));
+                mDevice, BluetoothProfile.STATE_DISCONNECTED, BluetoothProfile.STATE_CONNECTING);
+        final SynchronousResultReceiver<Integer> recv = SynchronousResultReceiver.get();
+        int defaultRecvValue = -1000;
+        mServiceBinder.getConnectionState(mDevice, mAttributionSource, recv);
+        int state = recv.awaitResultNoInterrupt(Duration.ofMillis(TIMEOUT_MS))
+                .getValue(defaultRecvValue);
+        Assert.assertEquals(BluetoothProfile.STATE_DISCONNECTED, state);
     }
 
     /**
      * Test that an outgoing connection to two device that have HAS UUID is successful
      */
     @Test
-    public void testConnectTwo() {
+    public void testConnectTwo() throws Exception {
         doReturn(new ParcelUuid[]{BluetoothUuid.HAS}).when(mAdapterService)
                 .getRemoteUuids(any(BluetoothDevice.class));
 
@@ -405,7 +468,12 @@
         BluetoothDevice Device2 = TestUtils.getTestDevice(mAdapter, 1);
         testConnectingDevice(Device2);
 
-        List<BluetoothDevice> devices = mService.getConnectedDevices();
+        // indirect call of mService.getConnectedDevices to test BluetoothHearingAidBinder
+        final SynchronousResultReceiver<List<BluetoothDevice>> recv =
+                SynchronousResultReceiver.get();
+        mServiceBinder.getConnectedDevices(mAttributionSource, recv);
+        List<BluetoothDevice> devices = recv.awaitResultNoInterrupt(Duration.ofMillis(TIMEOUT_MS))
+                .getValue(null);
         Assert.assertTrue(devices.contains(mDevice));
         Assert.assertTrue(devices.contains(Device2));
         Assert.assertNotEquals(mDevice, Device2);
@@ -417,14 +485,14 @@
     @Test
     public void testCallsForNotConnectedDevice() {
         Assert.assertEquals(BluetoothHapClient.PRESET_INDEX_UNAVAILABLE,
-                        mService.getActivePresetIndex(mDevice));
+                mService.getActivePresetIndex(mDevice));
     }
 
     /**
      * Test getting HAS coordinated sets.
      */
     @Test
-    public void testGetHapGroupCoordinatedOps() {
+    public void testGetHapGroupCoordinatedOps() throws Exception {
         doReturn(new ParcelUuid[]{BluetoothUuid.HAS}).when(mAdapterService)
                 .getRemoteUuids(any(BluetoothDevice.class));
         testConnectingDevice(mDevice);
@@ -449,7 +517,12 @@
         Assert.assertEquals(3, mService.getHapGroup(mDevice3));
 
         /* Third one has no coordinated operations support but is part of the group */
-        Assert.assertEquals(2, mService.getHapGroup(mDevice2));
+        final SynchronousResultReceiver<Integer> recv = SynchronousResultReceiver.get();
+        int defaultRecvValue = -1000;
+        mServiceBinder.getHapGroup(mDevice2, mAttributionSource, recv);
+        int hapGroup = recv.awaitResultNoInterrupt(Duration.ofMillis(TIMEOUT_MS))
+                .getValue(defaultRecvValue);
+        Assert.assertEquals(2, hapGroup);
     }
 
     /**
@@ -472,7 +545,7 @@
             throw e.rethrowFromSystemServer();
         }
 
-        mService.selectPreset(mDevice, 0x01);
+        mServiceBinder.selectPreset(mDevice, 0x01, mAttributionSource);
         verify(mNativeInterface, times(1))
                 .selectActivePreset(eq(mDevice), eq(0x01));
     }
@@ -498,7 +571,7 @@
             throw e.rethrowFromSystemServer();
         }
 
-        mService.selectPresetForGroup(0x03, 0x01);
+        mServiceBinder.selectPresetForGroup(0x03, 0x01, mAttributionSource);
         verify(mNativeInterface, times(1))
                 .groupSelectActivePreset(eq(0x03), eq(0x01));
     }
@@ -513,7 +586,7 @@
         testConnectingDevice(mDevice);
 
         // Verify Native Interface call
-        mService.switchToNextPreset(mDevice);
+        mServiceBinder.switchToNextPreset(mDevice, mAttributionSource);
         verify(mNativeInterface, times(1))
                 .nextActivePreset(eq(mDevice));
     }
@@ -530,7 +603,7 @@
         mNativeInterface.onFeaturesUpdate(getByteAddress(mDevice3), flags);
 
         // Verify Native Interface call
-        mService.switchToNextPresetForGroup(0x03);
+        mServiceBinder.switchToNextPresetForGroup(0x03, mAttributionSource);
         verify(mNativeInterface, times(1)).groupNextActivePreset(eq(0x03));
     }
 
@@ -544,7 +617,7 @@
         testConnectingDevice(mDevice);
 
         // Verify Native Interface call
-        mService.switchToPreviousPreset(mDevice);
+        mServiceBinder.switchToPreviousPreset(mDevice, mAttributionSource);
         verify(mNativeInterface, times(1))
                 .previousActivePreset(eq(mDevice));
     }
@@ -563,7 +636,7 @@
         mNativeInterface.onFeaturesUpdate(getByteAddress(mDevice), flags);
 
         // Verify Native Interface call
-        mService.switchToPreviousPresetForGroup(0x02);
+        mServiceBinder.switchToPreviousPresetForGroup(0x02, mAttributionSource);
         verify(mNativeInterface, times(1)).groupPreviousActivePreset(eq(0x02));
     }
 
@@ -571,26 +644,45 @@
      * Test that getActivePresetIndex returns cached value.
      */
     @Test
-    public void testGetActivePresetIndex() {
+    public void testGetActivePresetIndex() throws Exception {
         doReturn(new ParcelUuid[]{BluetoothUuid.HAS}).when(mAdapterService)
                 .getRemoteUuids(any(BluetoothDevice.class));
         testConnectingDevice(mDevice);
         testOnPresetSelected(mDevice, 0x01);
 
-        // Verify cached value
-        Assert.assertEquals(0x01, mService.getActivePresetIndex(mDevice));
+        // Verify cached value via binder
+        final SynchronousResultReceiver<Integer> recv = SynchronousResultReceiver.get();
+        int defaultRecvValue = -1000;
+        mServiceBinder.getActivePresetIndex(mDevice, mAttributionSource, recv);
+        int presetIndex = recv.awaitResultNoInterrupt(Duration.ofMillis(TIMEOUT_MS))
+                .getValue(defaultRecvValue);
+        Assert.assertEquals(0x01, presetIndex);
     }
 
     /**
      * Test that getActivePresetInfo returns cached value for valid parameters.
      */
     @Test
-    public void testGetActivePresetInfo() {
+    public void testGetPresetInfoAndActivePresetInfo() throws Exception {
         doReturn(new ParcelUuid[]{BluetoothUuid.HAS}).when(mAdapterService)
                 .getRemoteUuids(any(BluetoothDevice.class));
         testConnectingDevice(mDevice2);
 
         // Check when active preset is not known yet
+        final SynchronousResultReceiver<List<BluetoothHapPresetInfo>> presetListRecv =
+                SynchronousResultReceiver.get();
+        mServiceBinder.getAllPresetInfo(mDevice2, mAttributionSource, presetListRecv);
+        List<BluetoothHapPresetInfo> presetList = presetListRecv.awaitResultNoInterrupt(
+                Duration.ofMillis(TIMEOUT_MS)).getValue(null);
+
+        final SynchronousResultReceiver<BluetoothHapPresetInfo> presetRecv =
+                SynchronousResultReceiver.get();
+        mServiceBinder.getPresetInfo(mDevice2, 0x01, mAttributionSource, presetRecv);
+        BluetoothHapPresetInfo presetInfo = presetRecv.awaitResultNoInterrupt(
+                Duration.ofMillis(TIMEOUT_MS)).getValue(null);
+        Assert.assertTrue(presetList.contains(presetInfo));
+        Assert.assertEquals(0x01, presetInfo.getIndex());
+
         Assert.assertEquals(BluetoothHapClient.PRESET_INDEX_UNAVAILABLE,
                 mService.getActivePresetIndex(mDevice2));
         Assert.assertEquals(null, mService.getActivePresetInfo(mDevice2));
@@ -600,9 +692,13 @@
 
         // Check when active preset is known
         Assert.assertEquals(0x01, mService.getActivePresetIndex(mDevice2));
-        BluetoothHapPresetInfo info = mService.getActivePresetInfo(mDevice2);
+        final SynchronousResultReceiver<BluetoothHapPresetInfo> recv =
+                SynchronousResultReceiver.get();
+        mServiceBinder.getActivePresetInfo(mDevice2, mAttributionSource, recv);
+        BluetoothHapPresetInfo info = recv.awaitResultNoInterrupt(Duration.ofMillis(TIMEOUT_MS))
+                .getValue(null);
         Assert.assertNotNull(info);
-        Assert.assertEquals(0x01, info.getIndex());
+        Assert.assertEquals("One", info.getName());
     }
 
     /**
@@ -614,7 +710,7 @@
                 .getRemoteUuids(any(BluetoothDevice.class));
         testConnectingDevice(mDevice);
 
-        mService.setPresetName(mDevice, 0x00, "ExamplePresetName");
+        mServiceBinder.setPresetName(mDevice, 0x00, "ExamplePresetName", mAttributionSource);
         verify(mNativeInterface, times(0))
                 .setPresetName(eq(mDevice), eq(0x00), eq("ExamplePresetName"));
         try {
@@ -645,7 +741,8 @@
         int flags = 0x21;
         mNativeInterface.onFeaturesUpdate(getByteAddress(mDevice), flags);
 
-        mService.setPresetNameForGroup(test_group, 0x00, "ExamplePresetName");
+        mServiceBinder.setPresetNameForGroup(
+                test_group, 0x00, "ExamplePresetName", mAttributionSource);
         try {
             verify(mCallback, after(TIMEOUT_MS).times(1)).onSetPresetNameForGroupFailed(eq(test_group),
                     eq(BluetoothStatusCodes.ERROR_HAP_INVALID_PRESET_INDEX));
@@ -904,6 +1001,75 @@
         }
     }
 
+    @Test
+    public void testServiceBinderGetDevicesMatchingConnectionStates() throws Exception {
+        final SynchronousResultReceiver<List<BluetoothDevice>> recv =
+                SynchronousResultReceiver.get();
+        mServiceBinder.getDevicesMatchingConnectionStates(null, mAttributionSource, recv);
+        List<BluetoothDevice> devices = recv.awaitResultNoInterrupt(Duration.ofMillis(TIMEOUT_MS))
+                .getValue(null);
+        Assert.assertEquals(0, devices.size());
+    }
+
+    @Test
+    public void testServiceBinderSetConnectionPolicy() throws Exception {
+        final SynchronousResultReceiver<Boolean> recv = SynchronousResultReceiver.get();
+        boolean defaultRecvValue = false;
+        mServiceBinder.setConnectionPolicy(
+                mDevice, BluetoothProfile.CONNECTION_POLICY_UNKNOWN, mAttributionSource, recv);
+        Assert.assertTrue(recv.awaitResultNoInterrupt(Duration.ofMillis(TIMEOUT_MS))
+                .getValue(defaultRecvValue));
+        verify(mDatabaseManager).setProfileConnectionPolicy(
+                mDevice, BluetoothProfile.HAP_CLIENT, BluetoothProfile.CONNECTION_POLICY_UNKNOWN);
+    }
+
+    @Test
+    public void testServiceBinderGetFeatures() throws Exception {
+        final SynchronousResultReceiver<Integer> recv = SynchronousResultReceiver.get();
+        int defaultRecvValue = -1000;
+        mServiceBinder.getFeatures(mDevice, mAttributionSource, recv);
+        int features = recv.awaitResultNoInterrupt(Duration.ofMillis(TIMEOUT_MS))
+                .getValue(defaultRecvValue);
+        Assert.assertEquals(0x00, features);
+    }
+
+    @Test
+    public void testServiceBinderRegisterUnregisterCallback() throws Exception {
+        IBluetoothHapClientCallback callback = Mockito.mock(IBluetoothHapClientCallback.class);
+        Binder binder = Mockito.mock(Binder.class);
+        when(callback.asBinder()).thenReturn(binder);
+
+        int size = mService.mCallbacks.getRegisteredCallbackCount();
+        SynchronousResultReceiver<Void> recv = SynchronousResultReceiver.get();
+        mServiceBinder.registerCallback(callback, mAttributionSource, recv);
+        recv.awaitResultNoInterrupt(Duration.ofMillis(TIMEOUT_MS)).getValue(null);
+        Assert.assertEquals(size + 1, mService.mCallbacks.getRegisteredCallbackCount());
+
+        recv = SynchronousResultReceiver.get();
+        mServiceBinder.unregisterCallback(callback, mAttributionSource, recv);
+        recv.awaitResultNoInterrupt(Duration.ofMillis(TIMEOUT_MS)).getValue(null);
+        Assert.assertEquals(size, mService.mCallbacks.getRegisteredCallbackCount());
+
+    }
+
+    @Test
+    public void testDumpDoesNotCrash() {
+        // Update the device policy so okToConnect() returns true
+        when(mDatabaseManager
+                .getProfileConnectionPolicy(mDevice, BluetoothProfile.HAP_CLIENT))
+                .thenReturn(BluetoothProfile.CONNECTION_POLICY_ALLOWED);
+        doReturn(true).when(mNativeInterface).connectHapClient(any(BluetoothDevice.class));
+        doReturn(true).when(mNativeInterface).disconnectHapClient(any(BluetoothDevice.class));
+
+        doReturn(new ParcelUuid[]{BluetoothUuid.HAS}).when(mAdapterService)
+                .getRemoteUuids(any(BluetoothDevice.class));
+
+        // Add state machine for testing dump()
+        mService.connect(mDevice);
+
+        mService.dump(new StringBuilder());
+    }
+
     /**
      * Helper function to test device connecting
      */
diff --git a/android/app/tests/unit/src/com/android/bluetooth/hearingaid/HearingAidNativeInterfaceTest.java b/android/app/tests/unit/src/com/android/bluetooth/hearingaid/HearingAidNativeInterfaceTest.java
new file mode 100644
index 0000000..27e1c15
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/hearingaid/HearingAidNativeInterfaceTest.java
@@ -0,0 +1,114 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.hearingaid;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import static org.mockito.Mockito.any;
+import static org.mockito.Mockito.never;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import android.bluetooth.BluetoothAdapter;
+import android.bluetooth.BluetoothDevice;
+import android.bluetooth.BluetoothProfile;
+
+import com.android.bluetooth.TestUtils;
+import com.android.bluetooth.Utils;
+
+import org.junit.After;
+import org.junit.Before;
+import org.junit.Test;
+import org.mockito.ArgumentCaptor;
+import org.mockito.Mock;
+import org.mockito.Mockito;
+import org.mockito.MockitoAnnotations;
+
+public class HearingAidNativeInterfaceTest {
+
+    @Mock private HearingAidService mService;
+
+    private HearingAidNativeInterface mNativeInterface;
+    private BluetoothAdapter mAdapter;
+
+    @Before
+    public void setUp() throws Exception {
+        MockitoAnnotations.initMocks(this);
+        when(mService.isAvailable()).thenReturn(true);
+        HearingAidService.setHearingAidService(mService);
+        mNativeInterface = HearingAidNativeInterface.getInstance();
+        mAdapter = BluetoothAdapter.getDefaultAdapter();
+    }
+
+    @After
+    public void tearDown() {
+        HearingAidService.setHearingAidService(null);
+    }
+
+    @Test
+    public void getByteAddress() {
+        assertThat(mNativeInterface.getByteAddress(null))
+                .isEqualTo(Utils.getBytesFromAddress("00:00:00:00:00:00"));
+
+        BluetoothDevice device = TestUtils.getTestDevice(mAdapter, 0);
+        assertThat(mNativeInterface.getByteAddress(device))
+                .isEqualTo(Utils.getBytesFromAddress(device.getAddress()));
+    }
+
+    @Test
+    public void onConnectionStateChanged() {
+        BluetoothDevice device = TestUtils.getTestDevice(mAdapter, 0);
+        mNativeInterface.onConnectionStateChanged(BluetoothProfile.STATE_CONNECTED,
+                mNativeInterface.getByteAddress(device));
+
+        ArgumentCaptor<HearingAidStackEvent> event =
+                ArgumentCaptor.forClass(HearingAidStackEvent.class);
+        verify(mService).messageFromNative(event.capture());
+        assertThat(event.getValue().type).isEqualTo(
+                HearingAidStackEvent.EVENT_TYPE_CONNECTION_STATE_CHANGED);
+        assertThat(event.getValue().valueInt1).isEqualTo(BluetoothProfile.STATE_CONNECTED);
+
+        Mockito.clearInvocations(mService);
+        HearingAidService.setHearingAidService(null);
+        mNativeInterface.onConnectionStateChanged(BluetoothProfile.STATE_CONNECTED,
+                mNativeInterface.getByteAddress(device));
+        verify(mService, never()).messageFromNative(any());
+    }
+
+    @Test
+    public void onDeviceAvailable() {
+        BluetoothDevice device = TestUtils.getTestDevice(mAdapter, 0);
+        byte capabilities = 0;
+        long hiSyncId = 100;
+        mNativeInterface.onDeviceAvailable(capabilities, hiSyncId,
+                mNativeInterface.getByteAddress(device));
+
+        ArgumentCaptor<HearingAidStackEvent> event =
+                ArgumentCaptor.forClass(HearingAidStackEvent.class);
+        verify(mService).messageFromNative(event.capture());
+        assertThat(event.getValue().type).isEqualTo(
+                HearingAidStackEvent.EVENT_TYPE_DEVICE_AVAILABLE);
+        assertThat(event.getValue().valueInt1).isEqualTo(capabilities);
+        assertThat(event.getValue().valueLong2).isEqualTo(hiSyncId);
+
+        Mockito.clearInvocations(mService);
+        HearingAidService.setHearingAidService(null);
+        mNativeInterface.onDeviceAvailable(capabilities, hiSyncId,
+                mNativeInterface.getByteAddress(device));
+        verify(mService, never()).messageFromNative(any());
+    }
+}
diff --git a/android/app/tests/unit/src/com/android/bluetooth/hearingaid/HearingAidServiceTest.java b/android/app/tests/unit/src/com/android/bluetooth/hearingaid/HearingAidServiceTest.java
index 95a4bac..5478dd5 100644
--- a/android/app/tests/unit/src/com/android/bluetooth/hearingaid/HearingAidServiceTest.java
+++ b/android/app/tests/unit/src/com/android/bluetooth/hearingaid/HearingAidServiceTest.java
@@ -16,7 +16,13 @@
 
 package com.android.bluetooth.hearingaid;
 
-import static org.mockito.Mockito.*;
+import static org.mockito.Mockito.any;
+import static org.mockito.Mockito.anyString;
+import static org.mockito.Mockito.doReturn;
+import static org.mockito.Mockito.eq;
+import static org.mockito.Mockito.reset;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
 
 import android.bluetooth.BluetoothAdapter;
 import android.bluetooth.BluetoothDevice;
@@ -31,7 +37,6 @@
 import android.media.BluetoothProfileConnectionInfo;
 import android.os.Looper;
 import android.os.ParcelUuid;
-import android.sysprop.BluetoothProperties;
 
 import androidx.test.InstrumentationRegistry;
 import androidx.test.filters.MediumTest;
@@ -39,14 +44,12 @@
 import androidx.test.runner.AndroidJUnit4;
 
 import com.android.bluetooth.TestUtils;
-import com.android.bluetooth.R;
 import com.android.bluetooth.btservice.AdapterService;
 import com.android.bluetooth.btservice.storage.DatabaseManager;
-
+import com.android.bluetooth.x.com.android.modules.utils.SynchronousResultReceiver;
 
 import org.junit.After;
 import org.junit.Assert;
-import org.junit.Assume;
 import org.junit.Before;
 import org.junit.Rule;
 import org.junit.Test;
@@ -54,6 +57,7 @@
 import org.mockito.Mock;
 import org.mockito.MockitoAnnotations;
 
+import java.time.Duration;
 import java.util.HashMap;
 import java.util.List;
 import java.util.concurrent.LinkedBlockingQueue;
@@ -65,6 +69,7 @@
     private BluetoothAdapter mAdapter;
     private Context mTargetContext;
     private HearingAidService mService;
+    private HearingAidService.BluetoothHearingAidBinder mServiceBinder;
     private BluetoothDevice mLeftDevice;
     private BluetoothDevice mRightDevice;
     private BluetoothDevice mSingleDevice;
@@ -95,10 +100,11 @@
         doReturn(true, false).when(mAdapterService).isStartedProfile(anyString());
 
         mAdapter = BluetoothAdapter.getDefaultAdapter();
-
         startService();
         mService.mHearingAidNativeInterface = mNativeInterface;
         mService.mAudioManager = mAudioManager;
+        mServiceBinder = (HearingAidService.BluetoothHearingAidBinder) mService.initBinder();
+        mServiceBinder.mIsTesting = true;
 
         // Override the timeout value to speed up the test
         HearingAidStateMachine.sConnectTimeoutMs = TIMEOUT_MS;    // 1s
@@ -174,6 +180,11 @@
         Assert.assertEquals(newState, intent.getIntExtra(BluetoothProfile.EXTRA_STATE, -1));
         Assert.assertEquals(prevState, intent.getIntExtra(BluetoothProfile.EXTRA_PREVIOUS_STATE,
                 -1));
+        if (newState == BluetoothProfile.STATE_CONNECTED) {
+            // ActiveDeviceManager calls setActiveDevice when connected.
+            mService.setActiveDevice(device);
+        }
+
     }
 
     private void verifyNoConnectionStateIntent(int timeoutMs, BluetoothDevice device) {
@@ -214,12 +225,17 @@
      * Test get/set priority for BluetoothDevice
      */
     @Test
-    public void testGetSetPriority() {
+    public void testGetSetPriority() throws Exception {
         when(mDatabaseManager.getProfileConnectionPolicy(mLeftDevice, BluetoothProfile.HEARING_AID))
                 .thenReturn(BluetoothProfile.CONNECTION_POLICY_UNKNOWN);
+        // indirect call of mService.getConnectionPolicy to test BluetoothHearingAidBinder
+        final SynchronousResultReceiver<Integer> recv = SynchronousResultReceiver.get();
+        final int defaultRecvValue = -1000;
+        mServiceBinder.getConnectionPolicy(mLeftDevice, null, recv);
+        int connectionPolicy = recv.awaitResultNoInterrupt(Duration.ofMillis(TIMEOUT_MS))
+                .getValue(defaultRecvValue);
         Assert.assertEquals("Initial device priority",
-                BluetoothProfile.CONNECTION_POLICY_UNKNOWN,
-                mService.getConnectionPolicy(mLeftDevice));
+                BluetoothProfile.CONNECTION_POLICY_UNKNOWN, connectionPolicy);
 
         when(mDatabaseManager.getProfileConnectionPolicy(mLeftDevice, BluetoothProfile.HEARING_AID))
                 .thenReturn(BluetoothProfile.CONNECTION_POLICY_FORBIDDEN);
@@ -304,7 +320,7 @@
      * Test that an outgoing connection to device with PRIORITY_OFF is rejected
      */
     @Test
-    public void testOutgoingConnectPriorityOff() {
+    public void testOutgoingConnectPriorityOff() throws Exception {
         doReturn(true).when(mNativeInterface).connectHearingAid(any(BluetoothDevice.class));
         doReturn(true).when(mNativeInterface).disconnectHearingAid(any(BluetoothDevice.class));
 
@@ -313,15 +329,19 @@
                 .getProfileConnectionPolicy(mLeftDevice, BluetoothProfile.HEARING_AID))
                 .thenReturn(BluetoothProfile.CONNECTION_POLICY_FORBIDDEN);
 
-        // Send a connect request
-        Assert.assertFalse("Connect expected to fail", mService.connect(mLeftDevice));
+        // Send a connect request via BluetoothHearingAidBinder
+        final SynchronousResultReceiver<Boolean> recv = SynchronousResultReceiver.get();
+        boolean defaultRecvValue = true;
+        mServiceBinder.connect(mLeftDevice, null, recv);
+        Assert.assertFalse("Connect expected to fail", recv.awaitResultNoInterrupt(
+                Duration.ofMillis(TIMEOUT_MS)).getValue(defaultRecvValue));
     }
 
     /**
      * Test that an outgoing connection times out
      */
     @Test
-    public void testOutgoingConnectTimeout() {
+    public void testOutgoingConnectTimeout() throws Exception {
         // Update the device priority so okToConnect() returns true
         when(mDatabaseManager
                 .getProfileConnectionPolicy(mLeftDevice, BluetoothProfile.HEARING_AID))
@@ -341,8 +361,13 @@
         // Verify the connection state broadcast, and that we are in Connecting state
         verifyConnectionStateIntent(TIMEOUT_MS, mLeftDevice, BluetoothProfile.STATE_CONNECTING,
                 BluetoothProfile.STATE_DISCONNECTED);
-        Assert.assertEquals(BluetoothProfile.STATE_CONNECTING,
-                mService.getConnectionState(mLeftDevice));
+        // indirect call of mService.getConnectionState to test BluetoothHearingAidBinder
+        final SynchronousResultReceiver<Integer> recv = SynchronousResultReceiver.get();
+        int defaultRecvValue = -1000;
+        mServiceBinder.getConnectionState(mLeftDevice, null, recv);
+        int connectionState = recv.awaitResultNoInterrupt(Duration.ofMillis(TIMEOUT_MS))
+                .getValue(defaultRecvValue);
+        Assert.assertEquals(BluetoothProfile.STATE_CONNECTING, connectionState);
 
         // Verify the connection state broadcast, and that we are in Disconnected state
         verifyConnectionStateIntent(HearingAidStateMachine.sConnectTimeoutMs * 2,
@@ -390,7 +415,7 @@
      * Test that the service disconnects the current pair before connecting to another pair.
      */
     @Test
-    public void testConnectAnotherPair_disconnectCurrentPair() {
+    public void testConnectAnotherPair_disconnectCurrentPair() throws Exception {
         // Update hiSyncId map
         getHiSyncIdFromNative();
         // Update the device priority so okToConnect() returns true
@@ -442,7 +467,13 @@
                 BluetoothProfile.STATE_CONNECTED);
         verifyConnectionStateIntent(TIMEOUT_MS, mRightDevice, BluetoothProfile.STATE_DISCONNECTING,
                 BluetoothProfile.STATE_CONNECTED);
-        Assert.assertFalse(mService.getConnectedDevices().contains(mLeftDevice));
+        // indirect call of mService.getConnectedDevices to test BluetoothHearingAidBinder
+        final SynchronousResultReceiver<List<BluetoothDevice>> recv =
+                SynchronousResultReceiver.get();
+        List<BluetoothDevice> defaultRecvValue = null;
+        mServiceBinder.getConnectedDevices(null, recv);
+        Assert.assertFalse(recv.awaitResultNoInterrupt(Duration.ofMillis(TIMEOUT_MS))
+                .getValue(defaultRecvValue).contains(mLeftDevice));
         Assert.assertFalse(mService.getConnectedDevices().contains(mRightDevice));
 
         // Verify the connection state broadcast, and that the second device is in Connecting state
@@ -456,7 +487,7 @@
      * Test that the outgoing connect/disconnect and audio switch is successful.
      */
     @Test
-    public void testAudioManagerConnectDisconnect() {
+    public void testAudioManagerConnectDisconnect() throws Exception {
         // Update hiSyncId map
         getHiSyncIdFromNative();
         // Update the device priority so okToConnect() returns true
@@ -523,7 +554,12 @@
 
         // Send a disconnect request
         Assert.assertTrue("Disconnect failed", mService.disconnect(mLeftDevice));
-        Assert.assertTrue("Disconnect failed", mService.disconnect(mRightDevice));
+        // Send a disconnect request via BluetoothHearingAidBinder
+        final SynchronousResultReceiver<Boolean> recv = SynchronousResultReceiver.get();
+        boolean revalueRecvValue = false;
+        mServiceBinder.disconnect(mRightDevice, null, recv);
+        Assert.assertTrue("Disconnect failed", recv.awaitResultNoInterrupt(
+                Duration.ofMillis(TIMEOUT_MS)).getValue(revalueRecvValue));
 
         // Verify the connection state broadcast, and that we are in Disconnecting state
         verifyConnectionStateIntent(TIMEOUT_MS, mLeftDevice, BluetoothProfile.STATE_DISCONNECTING,
@@ -754,7 +790,7 @@
     }
 
     @Test
-    public void testConnectionStateChangedActiveDevice() {
+    public void testConnectionStateChangedActiveDevice() throws Exception {
         // Update hiSyncId map
         getHiSyncIdFromNative();
         // Update the device priority so okToConnect() returns true
@@ -771,7 +807,14 @@
         generateConnectionMessageFromNative(mRightDevice, BluetoothProfile.STATE_CONNECTED,
                 BluetoothProfile.STATE_DISCONNECTED);
         Assert.assertTrue(mService.getActiveDevices().contains(mRightDevice));
-        Assert.assertFalse(mService.getActiveDevices().contains(mLeftDevice));
+
+        // indirect call of mService.getActiveDevices to test BluetoothHearingAidBinder
+        final SynchronousResultReceiver<List<BluetoothDevice>> recv =
+                SynchronousResultReceiver.get();
+        List<BluetoothDevice> defaultRecvValue = null;
+        mServiceBinder.getActiveDevices(null, recv);
+        Assert.assertFalse(recv.awaitResultNoInterrupt(Duration.ofMillis(TIMEOUT_MS))
+                .getValue(defaultRecvValue).contains(mLeftDevice));
 
         generateConnectionMessageFromNative(mLeftDevice, BluetoothProfile.STATE_CONNECTED,
                 BluetoothProfile.STATE_DISCONNECTED);
@@ -790,7 +833,7 @@
     }
 
     @Test
-    public void testConnectionStateChangedAnotherActiveDevice() {
+    public void testConnectionStateChangedAnotherActiveDevice() throws Exception {
         // Update hiSyncId map
         getHiSyncIdFromNative();
         // Update the device priority so okToConnect() returns true
@@ -819,6 +862,13 @@
         Assert.assertFalse(mService.getActiveDevices().contains(mRightDevice));
         Assert.assertFalse(mService.getActiveDevices().contains(mLeftDevice));
         Assert.assertTrue(mService.getActiveDevices().contains(mSingleDevice));
+
+        final SynchronousResultReceiver<Boolean> recv = SynchronousResultReceiver.get();
+        boolean defaultRecvValue = false;
+        mServiceBinder.setActiveDevice(null, null, recv);
+        Assert.assertTrue(recv.awaitResultNoInterrupt(Duration.ofMillis(TIMEOUT_MS))
+                .getValue(defaultRecvValue));
+        Assert.assertFalse(mService.getActiveDevices().contains(mSingleDevice));
     }
 
     /**
@@ -980,7 +1030,7 @@
      * Test that the service can update HiSyncId from native message
      */
     @Test
-    public void getHiSyncIdFromNative_addToMap() {
+    public void getHiSyncIdFromNative_addToMap() throws Exception {
         getHiSyncIdFromNative();
         Assert.assertTrue("hiSyncIdMap should contain mLeftDevice",
                 mService.getHiSyncIdMap().containsKey(mLeftDevice));
@@ -988,6 +1038,25 @@
                 mService.getHiSyncIdMap().containsKey(mRightDevice));
         Assert.assertTrue("hiSyncIdMap should contain mSingleDevice",
                 mService.getHiSyncIdMap().containsKey(mSingleDevice));
+
+        SynchronousResultReceiver<Long> recv = SynchronousResultReceiver.get();
+        long defaultRecvValue = -1000;
+        mServiceBinder.getHiSyncId(mLeftDevice, null, recv);
+        long id = recv.awaitResultNoInterrupt(Duration.ofMillis(TIMEOUT_MS))
+                .getValue(defaultRecvValue);
+        Assert.assertNotEquals(BluetoothHearingAid.HI_SYNC_ID_INVALID, id);
+
+        recv = SynchronousResultReceiver.get();
+        mServiceBinder.getHiSyncId(mRightDevice, null, recv);
+        id = recv.awaitResultNoInterrupt(Duration.ofMillis(TIMEOUT_MS))
+                .getValue(defaultRecvValue);
+        Assert.assertNotEquals(BluetoothHearingAid.HI_SYNC_ID_INVALID, id);
+
+        recv = SynchronousResultReceiver.get();
+        mServiceBinder.getHiSyncId(mSingleDevice, null, recv);
+        id = recv.awaitResultNoInterrupt(Duration.ofMillis(TIMEOUT_MS))
+                .getValue(defaultRecvValue);
+        Assert.assertNotEquals(BluetoothHearingAid.HI_SYNC_ID_INVALID, id);
     }
 
     /**
@@ -1001,6 +1070,63 @@
                 mService.getHiSyncIdMap().containsKey(mLeftDevice));
     }
 
+    @Test
+    public void serviceBinder_callGetDeviceMode() throws Exception {
+        final SynchronousResultReceiver<Integer> recv = SynchronousResultReceiver.get();
+        mServiceBinder.getDeviceMode(mSingleDevice, null, recv);
+        int mode = recv.awaitResultNoInterrupt(Duration.ofMillis(TIMEOUT_MS))
+                .getValue(BluetoothHearingAid.MODE_MONAURAL);
+        Assert.assertEquals(BluetoothHearingAid.MODE_BINAURAL, mode);
+    }
+
+    @Test
+    public void serviceBinder_callGetDeviceSide() throws Exception {
+        final SynchronousResultReceiver<Integer> recv = SynchronousResultReceiver.get();
+        int defaultRecvValue = -1000;
+        mServiceBinder.getDeviceSide(mSingleDevice, null, recv);
+        int side = recv.awaitResultNoInterrupt(Duration.ofMillis(TIMEOUT_MS))
+                .getValue(defaultRecvValue);
+        Assert.assertEquals(BluetoothHearingAid.SIDE_RIGHT, side);
+    }
+
+    @Test
+    public void serviceBinder_setConnectionPolicy() throws Exception {
+        when(mDatabaseManager.setProfileConnectionPolicy(mSingleDevice,
+                BluetoothProfile.HEARING_AID, BluetoothProfile.CONNECTION_POLICY_UNKNOWN))
+                .thenReturn(true);
+
+        final SynchronousResultReceiver<Boolean> recv = SynchronousResultReceiver.get();
+        boolean defaultRecvValue = false;
+        mServiceBinder.setConnectionPolicy(mSingleDevice,
+                BluetoothProfile.CONNECTION_POLICY_UNKNOWN, null, recv);
+        Assert.assertTrue(recv.awaitResultNoInterrupt(Duration.ofMillis(TIMEOUT_MS))
+                .getValue(defaultRecvValue));
+        verify(mDatabaseManager).setProfileConnectionPolicy(mSingleDevice,
+                BluetoothProfile.HEARING_AID, BluetoothProfile.CONNECTION_POLICY_UNKNOWN);
+    }
+
+    @Test
+    public void serviceBinder_setVolume() throws Exception {
+        final SynchronousResultReceiver<Void> recv = SynchronousResultReceiver.get();
+        mServiceBinder.setVolume(0, null, recv);
+        recv.awaitResultNoInterrupt(Duration.ofMillis(TIMEOUT_MS));
+        verify(mNativeInterface).setVolume(0);
+    }
+
+    @Test
+    public void dump_doesNotCrash() {
+        // Update the device priority so okToConnect() returns true
+        when(mDatabaseManager
+                .getProfileConnectionPolicy(mSingleDevice, BluetoothProfile.HEARING_AID))
+                .thenReturn(BluetoothProfile.CONNECTION_POLICY_ALLOWED);
+        doReturn(true).when(mNativeInterface).connectHearingAid(any(BluetoothDevice.class));
+
+        // Send a connect request
+        mService.connect(mSingleDevice);
+
+        mService.dump(new StringBuilder());
+    }
+
     private void connectDevice(BluetoothDevice device) {
         HearingAidStackEvent connCompletedEvent;
 
diff --git a/android/app/tests/unit/src/com/android/bluetooth/hfp/AtPhonebookTest.java b/android/app/tests/unit/src/com/android/bluetooth/hfp/AtPhonebookTest.java
new file mode 100644
index 0000000..ac30e35
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/hfp/AtPhonebookTest.java
@@ -0,0 +1,314 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.hfp;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import static org.mockito.Mockito.any;
+import static org.mockito.Mockito.atLeastOnce;
+import static org.mockito.Mockito.doReturn;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.spy;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import android.bluetooth.BluetoothAdapter;
+import android.bluetooth.BluetoothDevice;
+import android.content.Context;
+import android.database.Cursor;
+import android.provider.CallLog;
+import android.provider.ContactsContract.CommonDataKinds.Phone;
+import android.telephony.PhoneNumberUtils;
+
+import androidx.test.InstrumentationRegistry;
+import androidx.test.runner.AndroidJUnit4;
+
+import com.android.bluetooth.BluetoothMethodProxy;
+import com.android.bluetooth.R;
+import com.android.bluetooth.TestUtils;
+import com.android.bluetooth.btservice.AdapterService;
+import com.android.internal.telephony.GsmAlphabet;
+
+import org.junit.After;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.Mock;
+import org.mockito.MockitoAnnotations;
+import org.mockito.Spy;
+
+@RunWith(AndroidJUnit4.class)
+public class AtPhonebookTest {
+    private static final String INVALID_COMMAND = "invalid_command";
+    private Context mTargetContext;
+    private BluetoothAdapter mAdapter;
+    private BluetoothDevice mTestDevice;
+
+    @Mock
+    private AdapterService mAdapterService;
+    private HeadsetNativeInterface mNativeInterface;
+    private AtPhonebook mAtPhonebook;
+    @Spy
+    private BluetoothMethodProxy mHfpMethodProxy = BluetoothMethodProxy.getInstance();
+
+    @Before
+    public void setUp() throws Exception {
+        mTargetContext = InstrumentationRegistry.getTargetContext();
+        MockitoAnnotations.initMocks(this);
+        TestUtils.setAdapterService(mAdapterService);
+
+        BluetoothMethodProxy.setInstanceForTesting(mHfpMethodProxy);
+        mAdapter = BluetoothAdapter.getDefaultAdapter();
+        mTestDevice = mAdapter.getRemoteDevice("00:01:02:03:04:05");
+        // Spy on native interface
+        mNativeInterface = spy(HeadsetNativeInterface.getInstance());
+        mAtPhonebook = new AtPhonebook(mTargetContext, mNativeInterface);
+    }
+
+    @After
+    public void tearDown() throws Exception {
+        TestUtils.clearAdapterService(mAdapterService);
+        BluetoothMethodProxy.setInstanceForTesting(null);
+    }
+
+    @Test
+    public void checkAccessPermission_returnsCorrectPermission() {
+        assertThat(mAtPhonebook.checkAccessPermission(mTestDevice)).isEqualTo(
+                BluetoothDevice.ACCESS_UNKNOWN);
+    }
+
+    @Test
+    public void getAndSetCheckingAccessPermission_setCorrectly() {
+        mAtPhonebook.setCheckingAccessPermission(true);
+
+        assertThat(mAtPhonebook.getCheckingAccessPermission()).isTrue();
+    }
+
+    @Test
+    public void handleCscsCommand() {
+        mAtPhonebook.handleCscsCommand(INVALID_COMMAND, AtPhonebook.TYPE_READ, mTestDevice);
+        verify(mNativeInterface).atResponseString(mTestDevice,
+                "+CSCS: \"" + "UTF-8" + "\"");
+
+        mAtPhonebook.handleCscsCommand(INVALID_COMMAND, AtPhonebook.TYPE_TEST, mTestDevice);
+        verify(mNativeInterface).atResponseString(mTestDevice,
+                "+CSCS: (\"UTF-8\",\"IRA\",\"GSM\")");
+
+        mAtPhonebook.handleCscsCommand(INVALID_COMMAND, AtPhonebook.TYPE_SET, mTestDevice);
+        verify(mNativeInterface, atLeastOnce()).atResponseCode(mTestDevice,
+                HeadsetHalConstants.AT_RESPONSE_ERROR, -1);
+
+        mAtPhonebook.handleCscsCommand("command=GSM", AtPhonebook.TYPE_SET, mTestDevice);
+        verify(mNativeInterface, atLeastOnce()).atResponseCode(mTestDevice,
+                HeadsetHalConstants.AT_RESPONSE_OK, -1);
+
+        mAtPhonebook.handleCscsCommand("command=ERR", AtPhonebook.TYPE_SET, mTestDevice);
+        verify(mNativeInterface).atResponseCode(mTestDevice, HeadsetHalConstants.AT_RESPONSE_ERROR,
+                BluetoothCmeError.OPERATION_NOT_SUPPORTED);
+
+        mAtPhonebook.handleCscsCommand(INVALID_COMMAND, AtPhonebook.TYPE_UNKNOWN, mTestDevice);
+        verify(mNativeInterface).atResponseCode(mTestDevice, HeadsetHalConstants.AT_RESPONSE_ERROR,
+                BluetoothCmeError.TEXT_HAS_INVALID_CHARS);
+    }
+
+    @Test
+    public void handleCpbsCommand() {
+        mAtPhonebook.handleCpbsCommand(INVALID_COMMAND, AtPhonebook.TYPE_READ, mTestDevice);
+        int size = mAtPhonebook.getPhonebookResult("ME", true).cursor.getCount();
+        int maxSize = mAtPhonebook.getMaxPhoneBookSize(size);
+        verify(mNativeInterface).atResponseString(mTestDevice,
+                "+CPBS: \"" + "ME" + "\"," + size + "," + maxSize);
+
+        mAtPhonebook.handleCpbsCommand(INVALID_COMMAND, AtPhonebook.TYPE_TEST, mTestDevice);
+        verify(mNativeInterface).atResponseString(mTestDevice,
+                "+CPBS: (\"ME\",\"SM\",\"DC\",\"RC\",\"MC\")");
+
+        mAtPhonebook.handleCpbsCommand(INVALID_COMMAND, AtPhonebook.TYPE_SET, mTestDevice);
+        verify(mNativeInterface).atResponseCode(mTestDevice, HeadsetHalConstants.AT_RESPONSE_ERROR,
+                BluetoothCmeError.OPERATION_NOT_SUPPORTED);
+
+        mAtPhonebook.handleCpbsCommand("command=ERR", AtPhonebook.TYPE_SET, mTestDevice);
+        verify(mNativeInterface).atResponseCode(mTestDevice, HeadsetHalConstants.AT_RESPONSE_ERROR,
+                BluetoothCmeError.OPERATION_NOT_ALLOWED);
+
+        mAtPhonebook.handleCpbsCommand("command=SM", AtPhonebook.TYPE_SET, mTestDevice);
+        verify(mNativeInterface, atLeastOnce()).atResponseCode(mTestDevice,
+                HeadsetHalConstants.AT_RESPONSE_OK, -1);
+
+        mAtPhonebook.handleCpbsCommand(INVALID_COMMAND, AtPhonebook.TYPE_UNKNOWN, mTestDevice);
+        verify(mNativeInterface).atResponseCode(mTestDevice, HeadsetHalConstants.AT_RESPONSE_ERROR,
+                BluetoothCmeError.TEXT_HAS_INVALID_CHARS);
+    }
+
+    @Test
+    public void handleCpbrCommand() {
+        mAtPhonebook.handleCpbrCommand(INVALID_COMMAND, AtPhonebook.TYPE_TEST, mTestDevice);
+        int size = mAtPhonebook.getPhonebookResult("ME", true).cursor.getCount();
+        if (size == 0) {
+            size = 1;
+        }
+        verify(mNativeInterface).atResponseString(mTestDevice, "+CPBR: (1-" + size + "),30,30");
+        verify(mNativeInterface).atResponseCode(mTestDevice, HeadsetHalConstants.AT_RESPONSE_OK,
+                -1);
+
+        mAtPhonebook.handleCpbrCommand(INVALID_COMMAND, AtPhonebook.TYPE_SET, mTestDevice);
+        verify(mNativeInterface).atResponseCode(mTestDevice, HeadsetHalConstants.AT_RESPONSE_ERROR,
+                -1);
+
+        mAtPhonebook.handleCpbrCommand("command=ERR", AtPhonebook.TYPE_SET, mTestDevice);
+        verify(mNativeInterface).atResponseCode(mTestDevice, HeadsetHalConstants.AT_RESPONSE_ERROR,
+                BluetoothCmeError.TEXT_HAS_INVALID_CHARS);
+
+        mAtPhonebook.handleCpbrCommand("command=123,123", AtPhonebook.TYPE_SET, mTestDevice);
+        assertThat(mAtPhonebook.getCheckingAccessPermission()).isTrue();
+
+        mAtPhonebook.handleCpbrCommand(INVALID_COMMAND, AtPhonebook.TYPE_UNKNOWN, mTestDevice);
+        verify(mNativeInterface, atLeastOnce()).atResponseCode(mTestDevice,
+                HeadsetHalConstants.AT_RESPONSE_ERROR, BluetoothCmeError.TEXT_HAS_INVALID_CHARS);
+    }
+
+    @Test
+    public void processCpbrCommand() {
+        mAtPhonebook.handleCpbsCommand("command=SM", AtPhonebook.TYPE_SET, mTestDevice);
+        assertThat(mAtPhonebook.processCpbrCommand(mTestDevice)).isEqualTo(
+                HeadsetHalConstants.AT_RESPONSE_OK);
+
+        mAtPhonebook.handleCpbsCommand("command=ME", AtPhonebook.TYPE_SET, mTestDevice);
+        assertThat(mAtPhonebook.processCpbrCommand(mTestDevice)).isEqualTo(
+                HeadsetHalConstants.AT_RESPONSE_OK);
+
+        mAtPhonebook.mCurrentPhonebook = "ER";
+        assertThat(mAtPhonebook.processCpbrCommand(mTestDevice)).isEqualTo(
+                HeadsetHalConstants.AT_RESPONSE_ERROR);
+    }
+
+    @Test
+    public void processCpbrCommand_withMobilePhonebook() {
+        Cursor mockCursorOne = mock(Cursor.class);
+        when(mockCursorOne.getCount()).thenReturn(1);
+        when(mockCursorOne.getColumnIndex(Phone.TYPE)).thenReturn(1); //TypeColumn
+        when(mockCursorOne.getColumnIndex(Phone.NUMBER)).thenReturn(2); //numberColumn
+        when(mockCursorOne.getColumnIndex(Phone.DISPLAY_NAME)).thenReturn(3); // nameColumn
+        when(mockCursorOne.getInt(1)).thenReturn(Phone.TYPE_WORK);
+        when(mockCursorOne.getString(2)).thenReturn(null);
+        when(mockCursorOne.getString(3)).thenReturn(null);
+        when(mockCursorOne.moveToNext()).thenReturn(false);
+        doReturn(mockCursorOne).when(mHfpMethodProxy).contentResolverQuery(any(), any(), any(),
+                any(), any());
+
+        mAtPhonebook.mCurrentPhonebook = "ME";
+        mAtPhonebook.mCpbrIndex1 = 1;
+        mAtPhonebook.mCpbrIndex2 = 2;
+
+        mAtPhonebook.processCpbrCommand(mTestDevice);
+
+        String expected = "+CPBR: " + 1 + ",\"" + "" + "\"," + PhoneNumberUtils.toaFromString("")
+                + ",\"" + "" + "/" + AtPhonebook.getPhoneType(Phone.TYPE_WORK) + "\"" + "\r\n\r\n";
+        verify(mNativeInterface).atResponseString(mTestDevice, expected);
+    }
+
+    @Test
+    public void processCpbrCommand_withMissedCalls() {
+        Cursor mockCursorOne = mock(Cursor.class);
+        when(mockCursorOne.getCount()).thenReturn(1);
+        when(mockCursorOne.getColumnIndexOrThrow(CallLog.Calls.NUMBER)).thenReturn(1);
+        when(mockCursorOne.getColumnIndexOrThrow(CallLog.Calls.NUMBER_PRESENTATION)).thenReturn(2);
+        String number = "1".repeat(31);
+        when(mockCursorOne.getString(1)).thenReturn(number);
+        when(mockCursorOne.getInt(2)).thenReturn(CallLog.Calls.PRESENTATION_RESTRICTED);
+        doReturn(mockCursorOne).when(mHfpMethodProxy).contentResolverQuery(any(), any(), any(),
+                any(), any());
+
+        Cursor mockCursorTwo = mock(Cursor.class);
+        when(mockCursorTwo.moveToFirst()).thenReturn(true);
+        String name = "k".repeat(30);
+        when(mockCursorTwo.getString(0)).thenReturn(name);
+        when(mockCursorTwo.getInt(1)).thenReturn(1);
+        doReturn(mockCursorTwo).when(mHfpMethodProxy).contentResolverQuery(any(), any(), any(),
+                any(), any(), any());
+
+        mAtPhonebook.mCurrentPhonebook = "MC";
+        mAtPhonebook.mCpbrIndex1 = 1;
+        mAtPhonebook.mCpbrIndex2 = 2;
+
+        mAtPhonebook.processCpbrCommand(mTestDevice);
+
+        String expected = "+CPBR: " + 1 + ",\"" + "" + "\"," + PhoneNumberUtils.toaFromString(
+                number) + ",\"" + mTargetContext.getString(R.string.unknownNumber) + "\""
+                + "\r\n\r\n";
+        verify(mNativeInterface).atResponseString(mTestDevice, expected);
+    }
+
+    @Test
+    public void processCpbrCommand_withReceivcedCallsAndCharsetGsm() {
+        Cursor mockCursorOne = mock(Cursor.class);
+        when(mockCursorOne.getCount()).thenReturn(1);
+        when(mockCursorOne.getColumnIndexOrThrow(CallLog.Calls.NUMBER)).thenReturn(1);
+        when(mockCursorOne.getColumnIndexOrThrow(CallLog.Calls.NUMBER_PRESENTATION)).thenReturn(-1);
+        String number = "1".repeat(31);
+        when(mockCursorOne.getString(1)).thenReturn(number);
+        when(mockCursorOne.getInt(2)).thenReturn(CallLog.Calls.PRESENTATION_RESTRICTED);
+        doReturn(mockCursorOne).when(mHfpMethodProxy).contentResolverQuery(any(), any(), any(),
+                any(), any());
+
+        Cursor mockCursorTwo = mock(Cursor.class);
+        when(mockCursorTwo.moveToFirst()).thenReturn(true);
+        String name = "k".repeat(30);
+        when(mockCursorTwo.getString(0)).thenReturn(name);
+        when(mockCursorTwo.getInt(1)).thenReturn(1);
+        doReturn(mockCursorTwo).when(mHfpMethodProxy).contentResolverQuery(any(), any(), any(),
+                any(), any(), any());
+
+        mAtPhonebook.mCurrentPhonebook = "RC";
+        mAtPhonebook.mCpbrIndex1 = 1;
+        mAtPhonebook.mCpbrIndex2 = 2;
+        mAtPhonebook.mCharacterSet = "GSM";
+
+        mAtPhonebook.processCpbrCommand(mTestDevice);
+
+        String expectedName = new String(GsmAlphabet.stringToGsm8BitPacked(name.substring(0, 28)));
+        String expected = "+CPBR: " + 1 + ",\"" + number.substring(0, 30) + "\","
+                + PhoneNumberUtils.toaFromString(number) + ",\"" + expectedName + "\"" + "\r\n\r\n";
+        verify(mNativeInterface).atResponseString(mTestDevice, expected);
+    }
+
+    @Test
+    public void setCpbrIndex() {
+        int index = 1;
+
+        mAtPhonebook.setCpbrIndex(index);
+
+        assertThat(mAtPhonebook.mCpbrIndex1).isEqualTo(index);
+        assertThat(mAtPhonebook.mCpbrIndex2).isEqualTo(index);
+    }
+
+    @Test
+    public void resetAtState() {
+        mAtPhonebook.resetAtState();
+
+        assertThat(mAtPhonebook.getCheckingAccessPermission()).isFalse();
+    }
+
+    @Test
+    public void getPhoneType() {
+        assertThat(AtPhonebook.getPhoneType(Phone.TYPE_HOME)).isEqualTo("H");
+        assertThat(AtPhonebook.getPhoneType(Phone.TYPE_MOBILE)).isEqualTo("M");
+        assertThat(AtPhonebook.getPhoneType(Phone.TYPE_WORK)).isEqualTo("W");
+        assertThat(AtPhonebook.getPhoneType(Phone.TYPE_FAX_WORK)).isEqualTo("F");
+        assertThat(AtPhonebook.getPhoneType(Phone.TYPE_CUSTOM)).isEqualTo("O");
+    }
+}
\ No newline at end of file
diff --git a/android/app/tests/unit/src/com/android/bluetooth/hfp/BluetoothHeadsetBinderTest.java b/android/app/tests/unit/src/com/android/bluetooth/hfp/BluetoothHeadsetBinderTest.java
new file mode 100644
index 0000000..4d6ca38
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/hfp/BluetoothHeadsetBinderTest.java
@@ -0,0 +1,238 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.hfp;
+
+import static org.mockito.Mockito.anyInt;
+import static org.mockito.Mockito.doReturn;
+import static org.mockito.Mockito.verify;
+
+import android.bluetooth.BluetoothAdapter;
+import android.bluetooth.BluetoothDevice;
+import android.bluetooth.BluetoothProfile;
+import android.content.AttributionSource;
+import android.content.pm.PackageManager;
+
+import com.android.bluetooth.x.com.android.modules.utils.SynchronousResultReceiver;
+
+import org.junit.Before;
+import org.junit.Test;
+import org.mockito.Mock;
+import org.mockito.MockitoAnnotations;
+
+public class BluetoothHeadsetBinderTest {
+    private static final String TEST_DEVICE_ADDRESS = "00:00:00:00:00:00";
+
+    @Mock
+    private HeadsetService mService;
+    @Mock
+    private PackageManager mPackageManager;
+
+    private AttributionSource mAttributionSource;
+    private BluetoothDevice mTestDevice;
+
+    private HeadsetService.BluetoothHeadsetBinder mBinder;
+
+    @Before
+    public void setUp() throws Exception {
+        MockitoAnnotations.initMocks(this);
+        mBinder = new HeadsetService.BluetoothHeadsetBinder(mService);
+        doReturn(mPackageManager).when(mService).getPackageManager();
+        doReturn(new String[] { "com.android.bluetooth.test" })
+                .when(mPackageManager).getPackagesForUid(anyInt());
+        mAttributionSource = new AttributionSource.Builder(1).build();
+        mTestDevice = BluetoothAdapter.getDefaultAdapter().getRemoteDevice(TEST_DEVICE_ADDRESS);
+    }
+
+    @Test
+    public void connect() {
+        mBinder.connect(mTestDevice);
+        verify(mService).connect(mTestDevice);
+    }
+
+    @Test
+    public void connectWithAttribution() {
+        mBinder.connectWithAttribution(mTestDevice, mAttributionSource,
+                SynchronousResultReceiver.get());
+        verify(mService).connect(mTestDevice);
+    }
+
+    @Test
+    public void disconnect() {
+        mBinder.disconnect(mTestDevice);
+        verify(mService).disconnect(mTestDevice);
+    }
+
+    @Test
+    public void disconnectWithAttribution() {
+        mBinder.disconnectWithAttribution(mTestDevice, mAttributionSource,
+                SynchronousResultReceiver.get());
+        verify(mService).disconnect(mTestDevice);
+    }
+
+    @Test
+    public void getConnectedDevices() {
+        mBinder.getConnectedDevices();
+        verify(mService).getConnectedDevices();
+    }
+
+    @Test
+    public void getConnectedDevicesWithAttribution() {
+        mBinder.getConnectedDevicesWithAttribution(mAttributionSource,
+                SynchronousResultReceiver.get());
+        verify(mService).getConnectedDevices();
+    }
+
+    @Test
+    public void getDevicesMatchingConnectionStates() {
+        int[] states = new int[] { BluetoothProfile.STATE_CONNECTED };
+        mBinder.getDevicesMatchingConnectionStates(states, mAttributionSource,
+                SynchronousResultReceiver.get());
+        verify(mService).getDevicesMatchingConnectionStates(states);
+    }
+
+    @Test
+    public void getConnectionState() {
+        mBinder.getConnectionState(mTestDevice);
+        verify(mService).getConnectionState(mTestDevice);
+    }
+
+    @Test
+    public void getConnectionStateWithAttribution() {
+        mBinder.getConnectionStateWithAttribution(mTestDevice, mAttributionSource,
+                SynchronousResultReceiver.get());
+        verify(mService).getConnectionState(mTestDevice);
+    }
+
+    @Test
+    public void setConnectionPolicy() {
+        int connectionPolicy = BluetoothProfile.CONNECTION_POLICY_ALLOWED;
+        mBinder.setConnectionPolicy(mTestDevice, connectionPolicy, mAttributionSource,
+                SynchronousResultReceiver.get());
+        verify(mService).setConnectionPolicy(mTestDevice, connectionPolicy);
+    }
+
+    @Test
+    public void getConnectionPolicy() {
+        mBinder.getConnectionPolicy(mTestDevice, mAttributionSource,
+                SynchronousResultReceiver.get());
+        verify(mService).getConnectionPolicy(mTestDevice);
+    }
+
+    @Test
+    public void isNoiseReductionSupported() {
+        mBinder.isNoiseReductionSupported(mTestDevice, mAttributionSource,
+                SynchronousResultReceiver.get());
+        verify(mService).isNoiseReductionSupported(mTestDevice);
+    }
+
+    @Test
+    public void isVoiceRecognitionSupported() {
+        mBinder.isVoiceRecognitionSupported(mTestDevice, mAttributionSource,
+                SynchronousResultReceiver.get());
+        verify(mService).isVoiceRecognitionSupported(mTestDevice);
+    }
+
+    @Test
+    public void startVoiceRecognition() {
+        mBinder.startVoiceRecognition(mTestDevice, mAttributionSource,
+                SynchronousResultReceiver.get());
+        verify(mService).startVoiceRecognition(mTestDevice);
+    }
+
+    @Test
+    public void stopVoiceRecognition() {
+        mBinder.stopVoiceRecognition(mTestDevice, mAttributionSource,
+                SynchronousResultReceiver.get());
+        verify(mService).stopVoiceRecognition(mTestDevice);
+    }
+
+    @Test
+    public void isAudioOn() {
+        mBinder.isAudioOn(mAttributionSource, SynchronousResultReceiver.get());
+        verify(mService).isAudioOn();
+    }
+
+    @Test
+    public void isAudioConnected() {
+        mBinder.isAudioConnected(mTestDevice, mAttributionSource, SynchronousResultReceiver.get());
+        verify(mService).isAudioConnected(mTestDevice);
+    }
+
+    @Test
+    public void getAudioState() {
+        mBinder.getAudioState(mTestDevice, mAttributionSource, SynchronousResultReceiver.get());
+        verify(mService).getAudioState(mTestDevice);
+    }
+
+    @Test
+    public void connectAudio() {
+        mBinder.connectAudio(mAttributionSource, SynchronousResultReceiver.get());
+        verify(mService).connectAudio();
+    }
+
+    @Test
+    public void disconnectAudio() {
+        mBinder.disconnectAudio(mAttributionSource, SynchronousResultReceiver.get());
+        verify(mService).disconnectAudio();
+    }
+
+    @Test
+    public void setAudioRouteAllowed() {
+        boolean allowed = true;
+        mBinder.setAudioRouteAllowed(allowed, mAttributionSource, SynchronousResultReceiver.get());
+        verify(mService).setAudioRouteAllowed(allowed);
+    }
+
+    @Test
+    public void getAudioRouteAllowed() {
+        mBinder.getAudioRouteAllowed(mAttributionSource, SynchronousResultReceiver.get());
+        verify(mService).getAudioRouteAllowed();
+    }
+
+    @Test
+    public void setForceScoAudio() {
+        boolean forced = true;
+        mBinder.setForceScoAudio(forced, mAttributionSource, SynchronousResultReceiver.get());
+        verify(mService).setForceScoAudio(forced);
+    }
+
+    @Test
+    public void startScoUsingVirtualVoiceCall() {
+        mBinder.startScoUsingVirtualVoiceCall(mAttributionSource, SynchronousResultReceiver.get());
+        verify(mService).startScoUsingVirtualVoiceCall();
+    }
+
+    @Test
+    public void stopScoUsingVirtualVoiceCall() {
+        mBinder.stopScoUsingVirtualVoiceCall(mAttributionSource, SynchronousResultReceiver.get());
+        verify(mService).stopScoUsingVirtualVoiceCall();
+    }
+
+    @Test
+    public void phoneStateChanged() {
+        int numActive = 2;
+        int numHeld = 5;
+        int callState = HeadsetHalConstants.CALL_STATE_IDLE;
+        String number = "000-000-0000";
+        int type = 0;
+        String name = "Unknown";
+        mBinder.phoneStateChanged(
+                numActive, numHeld, callState, number, type, name, mAttributionSource);
+        verify(mService).phoneStateChanged(
+                numActive, numHeld, callState, number, type, name, false);
+    }
+}
diff --git a/android/app/tests/unit/src/com/android/bluetooth/hfp/HeadsetAgIndicatorEnableStateTest.java b/android/app/tests/unit/src/com/android/bluetooth/hfp/HeadsetAgIndicatorEnableStateTest.java
new file mode 100644
index 0000000..5c28504
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/hfp/HeadsetAgIndicatorEnableStateTest.java
@@ -0,0 +1,38 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.hfp;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import androidx.test.filters.SmallTest;
+import androidx.test.runner.AndroidJUnit4;
+
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+@SmallTest
+@RunWith(AndroidJUnit4.class)
+public class HeadsetAgIndicatorEnableStateTest {
+
+    @Test
+    public void hashCode_returnsCorrectResult() {
+        HeadsetAgIndicatorEnableState state = new HeadsetAgIndicatorEnableState(true, true, true,
+                true);
+
+        assertThat(state.hashCode()).isEqualTo(15);
+    }
+}
diff --git a/android/app/tests/unit/src/com/android/bluetooth/hfp/HeadsetClccResponseTest.java b/android/app/tests/unit/src/com/android/bluetooth/hfp/HeadsetClccResponseTest.java
new file mode 100644
index 0000000..9e5788a
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/hfp/HeadsetClccResponseTest.java
@@ -0,0 +1,83 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.hfp;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import androidx.test.filters.SmallTest;
+import androidx.test.runner.AndroidJUnit4;
+
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+@SmallTest
+@RunWith(AndroidJUnit4.class)
+public class HeadsetClccResponseTest {
+    private static final int TEST_INDEX = 1;
+    private static final int TEST_DIRECTION = 1;
+    private static final int TEST_STATUS = 1;
+    private static final int TEST_MODE = 1;
+    private static final boolean TEST_MPTY = true;
+    private static final String TEST_NUMBER = "111-1111-1111";
+    private static final int TEST_TYPE = 1;
+
+    @Test
+    public void constructor() {
+        HeadsetClccResponse response = new HeadsetClccResponse(TEST_INDEX, TEST_DIRECTION,
+                TEST_STATUS, TEST_MODE, TEST_MPTY, TEST_NUMBER, TEST_TYPE);
+
+        assertThat(response.mIndex).isEqualTo(TEST_INDEX);
+        assertThat(response.mDirection).isEqualTo(TEST_DIRECTION);
+        assertThat(response.mStatus).isEqualTo(TEST_STATUS);
+        assertThat(response.mMode).isEqualTo(TEST_MODE);
+        assertThat(response.mMpty).isEqualTo(TEST_MPTY);
+        assertThat(response.mNumber).isEqualTo(TEST_NUMBER);
+        assertThat(response.mType).isEqualTo(TEST_TYPE);
+    }
+
+    @Test
+    public void buildString() {
+        HeadsetClccResponse response = new HeadsetClccResponse(TEST_INDEX, TEST_DIRECTION,
+                TEST_STATUS, TEST_MODE, TEST_MPTY, TEST_NUMBER, TEST_TYPE);
+        StringBuilder builder = new StringBuilder();
+
+        response.buildString(builder);
+
+        String expectedString =
+                response.getClass().getSimpleName() + "[index=" + TEST_INDEX + ", direction="
+                        + TEST_DIRECTION + ", status=" + TEST_STATUS + ", callMode=" + TEST_MODE
+                        + ", isMultiParty=" + TEST_MPTY + ", number=" + "***" + ", type="
+                        + TEST_TYPE + "]";
+        assertThat(response.toString()).isEqualTo(expectedString);
+    }
+
+    @Test
+    public void buildString_withNoNumber() {
+        HeadsetClccResponse response = new HeadsetClccResponse(TEST_INDEX, TEST_DIRECTION,
+                TEST_STATUS, TEST_MODE, TEST_MPTY, null, TEST_TYPE);
+        StringBuilder builder = new StringBuilder();
+
+        response.buildString(builder);
+
+        String expectedString =
+                response.getClass().getSimpleName() + "[index=" + TEST_INDEX + ", direction="
+                        + TEST_DIRECTION + ", status=" + TEST_STATUS + ", callMode=" + TEST_MODE
+                        + ", isMultiParty=" + TEST_MPTY + ", number=" + "null" + ", type="
+                        + TEST_TYPE + "]";
+        assertThat(response.toString()).isEqualTo(expectedString);
+    }
+}
diff --git a/android/app/tests/unit/src/com/android/bluetooth/hfp/HeadsetPhoneStateTest.java b/android/app/tests/unit/src/com/android/bluetooth/hfp/HeadsetPhoneStateTest.java
index ed40cfe..b83c7e3 100644
--- a/android/app/tests/unit/src/com/android/bluetooth/hfp/HeadsetPhoneStateTest.java
+++ b/android/app/tests/unit/src/com/android/bluetooth/hfp/HeadsetPhoneStateTest.java
@@ -126,6 +126,8 @@
         BluetoothDevice device1 = TestUtils.getTestDevice(mAdapter, 1);
         mHeadsetPhoneState.listenForPhoneState(device1, PhoneStateListener.LISTEN_SERVICE_STATE);
         verify(mTelephonyManager).listen(any(), eq(PhoneStateListener.LISTEN_SERVICE_STATE));
+        verify(mTelephonyManager).clearSignalStrengthUpdateRequest(
+                any(SignalStrengthUpdateRequest.class));
         verifyNoMoreInteractions(mTelephonyManager);
     }
 
@@ -162,7 +164,7 @@
         mHeadsetPhoneState.listenForPhoneState(device1, PhoneStateListener.LISTEN_SERVICE_STATE);
         verify(mTelephonyManager).listen(any(), eq(PhoneStateListener.LISTEN_NONE));
         verify(mTelephonyManager).listen(any(), eq(PhoneStateListener.LISTEN_SERVICE_STATE));
-        verify(mTelephonyManager).clearSignalStrengthUpdateRequest(
+        verify(mTelephonyManager, times(2)).clearSignalStrengthUpdateRequest(
                 any(SignalStrengthUpdateRequest.class));
     }
 
@@ -181,7 +183,7 @@
 
         mHeadsetPhoneState.listenForPhoneState(device1, PhoneStateListener.LISTEN_NONE);
         verify(mTelephonyManager).listen(any(), eq(PhoneStateListener.LISTEN_NONE));
-        verify(mTelephonyManager).clearSignalStrengthUpdateRequest(
+        verify(mTelephonyManager, times(2)).clearSignalStrengthUpdateRequest(
                 any(SignalStrengthUpdateRequest.class));
     }
 
@@ -210,7 +212,7 @@
         // Disabling updates from second device should cancel subscription
         mHeadsetPhoneState.listenForPhoneState(device2, PhoneStateListener.LISTEN_NONE);
         verify(mTelephonyManager).listen(any(), eq(PhoneStateListener.LISTEN_NONE));
-        verify(mTelephonyManager).clearSignalStrengthUpdateRequest(
+        verify(mTelephonyManager, times(2)).clearSignalStrengthUpdateRequest(
                 any(SignalStrengthUpdateRequest.class));
     }
 
@@ -226,6 +228,8 @@
         // Partially enabling updates from first device should trigger partial subscription
         mHeadsetPhoneState.listenForPhoneState(device1, PhoneStateListener.LISTEN_SERVICE_STATE);
         verify(mTelephonyManager).listen(any(), eq(PhoneStateListener.LISTEN_SERVICE_STATE));
+        verify(mTelephonyManager).clearSignalStrengthUpdateRequest(
+                any(SignalStrengthUpdateRequest.class));
         verifyNoMoreInteractions(mTelephonyManager);
         // Partially enabling updates from second device should trigger partial subscription
         mHeadsetPhoneState.listenForPhoneState(device2,
@@ -244,7 +248,7 @@
         // Partially disabling updates from second device should cancel subscription
         mHeadsetPhoneState.listenForPhoneState(device2, PhoneStateListener.LISTEN_NONE);
         verify(mTelephonyManager, times(3)).listen(any(), eq(PhoneStateListener.LISTEN_NONE));
-        verify(mTelephonyManager, times(3)).clearSignalStrengthUpdateRequest(
+        verify(mTelephonyManager, times(4)).clearSignalStrengthUpdateRequest(
                 any(SignalStrengthUpdateRequest.class));
     }
 }
diff --git a/android/app/tests/unit/src/com/android/bluetooth/hfp/HeadsetServiceAndStateMachineTest.java b/android/app/tests/unit/src/com/android/bluetooth/hfp/HeadsetServiceAndStateMachineTest.java
index c89e135..c41cbce 100644
--- a/android/app/tests/unit/src/com/android/bluetooth/hfp/HeadsetServiceAndStateMachineTest.java
+++ b/android/app/tests/unit/src/com/android/bluetooth/hfp/HeadsetServiceAndStateMachineTest.java
@@ -26,6 +26,7 @@
 import android.app.Activity;
 import android.app.Instrumentation;
 import android.bluetooth.BluetoothAdapter;
+import android.bluetooth.BluetoothSinkAudioPolicy;
 import android.bluetooth.BluetoothDevice;
 import android.bluetooth.BluetoothHeadset;
 import android.bluetooth.BluetoothProfile;
@@ -66,6 +67,7 @@
 import org.mockito.Mock;
 import org.mockito.MockitoAnnotations;
 import org.mockito.Spy;
+import org.mockito.InOrder;
 
 import java.lang.reflect.Method;
 import java.util.Collections;
@@ -181,6 +183,8 @@
                 .getBondState(any(BluetoothDevice.class));
         doAnswer(invocation -> mBondedDevices.toArray(new BluetoothDevice[]{})).when(
                 mAdapterService).getBondedDevices();
+        doReturn(new BluetoothSinkAudioPolicy.Builder().build()).when(mAdapterService)
+                .getRequestedAudioPolicyAsSink(any(BluetoothDevice.class));
         // Mock system interface
         doNothing().when(mSystemInterface).stop();
         when(mSystemInterface.getHeadsetPhoneState()).thenReturn(mPhoneState);
@@ -663,6 +667,7 @@
         Assert.assertTrue(mHeadsetService.setActiveDevice(device));
         verify(mNativeInterface).setActiveDevice(device);
         Assert.assertEquals(device, mHeadsetService.getActiveDevice());
+        verify(mNativeInterface).sendBsir(eq(device), eq(true));
         // Start voice recognition
         startVoiceRecognitionFromHf(device);
     }
@@ -686,6 +691,7 @@
         Assert.assertTrue(mHeadsetService.setActiveDevice(device));
         verify(mNativeInterface).setActiveDevice(device);
         Assert.assertEquals(device, mHeadsetService.getActiveDevice());
+        verify(mNativeInterface).sendBsir(eq(device), eq(true));
         // Start voice recognition
         startVoiceRecognitionFromHf(device);
         // Stop voice recognition
@@ -720,6 +726,7 @@
         Assert.assertTrue(mHeadsetService.setActiveDevice(device));
         verify(mNativeInterface).setActiveDevice(device);
         Assert.assertEquals(device, mHeadsetService.getActiveDevice());
+        verify(mNativeInterface).sendBsir(eq(device), eq(true));
         // Start voice recognition
         HeadsetStackEvent startVrEvent =
                 new HeadsetStackEvent(HeadsetStackEvent.EVENT_TYPE_VR_STATE_CHANGED,
@@ -752,6 +759,7 @@
         Assert.assertTrue(mHeadsetService.setActiveDevice(device));
         verify(mNativeInterface).setActiveDevice(device);
         Assert.assertEquals(device, mHeadsetService.getActiveDevice());
+        verify(mNativeInterface).sendBsir(eq(device), eq(true));
         // Start voice recognition
         HeadsetStackEvent startVrEvent =
                 new HeadsetStackEvent(HeadsetStackEvent.EVENT_TYPE_VR_STATE_CHANGED,
@@ -784,6 +792,7 @@
         Assert.assertTrue(mHeadsetService.setActiveDevice(device));
         verify(mNativeInterface).setActiveDevice(device);
         Assert.assertEquals(device, mHeadsetService.getActiveDevice());
+        verify(mNativeInterface).sendBsir(eq(device), eq(true));
         // Start voice recognition
         startVoiceRecognitionFromAg();
     }
@@ -857,6 +866,7 @@
         Assert.assertTrue(mHeadsetService.setActiveDevice(device));
         verify(mNativeInterface).setActiveDevice(device);
         Assert.assertEquals(device, mHeadsetService.getActiveDevice());
+        verify(mNativeInterface).sendBsir(eq(device), eq(true));
         // Start voice recognition
         startVoiceRecognitionFromAg();
         // Stop voice recognition
@@ -905,8 +915,10 @@
         connectTestDevice(deviceA);
         BluetoothDevice deviceB = TestUtils.getTestDevice(mAdapter, 1);
         connectTestDevice(deviceB);
-        verify(mNativeInterface, timeout(ASYNC_CALL_TIMEOUT_MILLIS)).sendBsir(deviceA, false);
-        verify(mNativeInterface, timeout(ASYNC_CALL_TIMEOUT_MILLIS)).sendBsir(deviceB, false);
+        InOrder inOrder = inOrder(mNativeInterface);
+        inOrder.verify(mNativeInterface).sendBsir(eq(deviceA), eq(true));
+        inOrder.verify(mNativeInterface).sendBsir(eq(deviceB), eq(false));
+        inOrder.verify(mNativeInterface).sendBsir(eq(deviceA), eq(false));
         // Set active device to device B
         Assert.assertTrue(mHeadsetService.setActiveDevice(deviceB));
         verify(mNativeInterface).setActiveDevice(deviceB);
@@ -957,8 +969,10 @@
         connectTestDevice(deviceA);
         BluetoothDevice deviceB = TestUtils.getTestDevice(mAdapter, 1);
         connectTestDevice(deviceB);
-        verify(mNativeInterface, timeout(ASYNC_CALL_TIMEOUT_MILLIS)).sendBsir(deviceA, false);
-        verify(mNativeInterface, timeout(ASYNC_CALL_TIMEOUT_MILLIS)).sendBsir(deviceB, false);
+        InOrder inOrder = inOrder(mNativeInterface);
+        inOrder.verify(mNativeInterface).sendBsir(eq(deviceA), eq(true));
+        inOrder.verify(mNativeInterface).sendBsir(eq(deviceB), eq(false));
+        inOrder.verify(mNativeInterface).sendBsir(eq(deviceA), eq(false));
         // Set active device to device B
         Assert.assertTrue(mHeadsetService.setActiveDevice(deviceB));
         verify(mNativeInterface).setActiveDevice(deviceB);
@@ -1009,8 +1023,10 @@
         connectTestDevice(deviceA);
         BluetoothDevice deviceB = TestUtils.getTestDevice(mAdapter, 1);
         connectTestDevice(deviceB);
-        verify(mNativeInterface, timeout(ASYNC_CALL_TIMEOUT_MILLIS)).sendBsir(deviceA, false);
-        verify(mNativeInterface, timeout(ASYNC_CALL_TIMEOUT_MILLIS)).sendBsir(deviceB, false);
+        InOrder inOrder = inOrder(mNativeInterface);
+        inOrder.verify(mNativeInterface).sendBsir(eq(deviceA), eq(true));
+        inOrder.verify(mNativeInterface).sendBsir(eq(deviceB), eq(false));
+        inOrder.verify(mNativeInterface).sendBsir(eq(deviceA), eq(false));
         // Set active device to device B
         Assert.assertTrue(mHeadsetService.setActiveDevice(deviceB));
         verify(mNativeInterface).setActiveDevice(deviceB);
@@ -1048,8 +1064,10 @@
         connectTestDevice(deviceA);
         BluetoothDevice deviceB = TestUtils.getTestDevice(mAdapter, 1);
         connectTestDevice(deviceB);
-        verify(mNativeInterface, timeout(ASYNC_CALL_TIMEOUT_MILLIS)).sendBsir(deviceA, false);
-        verify(mNativeInterface, timeout(ASYNC_CALL_TIMEOUT_MILLIS)).sendBsir(deviceB, false);
+        InOrder inOrder = inOrder(mNativeInterface);
+        inOrder.verify(mNativeInterface).sendBsir(eq(deviceA), eq(true));
+        inOrder.verify(mNativeInterface).sendBsir(eq(deviceB), eq(false));
+        inOrder.verify(mNativeInterface).sendBsir(eq(deviceA), eq(false));
         // Set active device to device B
         Assert.assertTrue(mHeadsetService.setActiveDevice(deviceB));
         verify(mNativeInterface).setActiveDevice(deviceB);
diff --git a/android/app/tests/unit/src/com/android/bluetooth/hfp/HeadsetServiceTest.java b/android/app/tests/unit/src/com/android/bluetooth/hfp/HeadsetServiceTest.java
index edcfce6..09fe7cc 100644
--- a/android/app/tests/unit/src/com/android/bluetooth/hfp/HeadsetServiceTest.java
+++ b/android/app/tests/unit/src/com/android/bluetooth/hfp/HeadsetServiceTest.java
@@ -19,6 +19,7 @@
 import static org.mockito.Mockito.*;
 
 import android.bluetooth.BluetoothAdapter;
+import android.bluetooth.BluetoothSinkAudioPolicy;
 import android.bluetooth.BluetoothDevice;
 import android.bluetooth.BluetoothHeadset;
 import android.bluetooth.BluetoothProfile;
@@ -116,6 +117,8 @@
             Set<BluetoothDevice> keys = mStateMachines.keySet();
             return keys.toArray(new BluetoothDevice[keys.size()]);
         }).when(mAdapterService).getBondedDevices();
+        doReturn(new BluetoothSinkAudioPolicy.Builder().build()).when(mAdapterService)
+                .getRequestedAudioPolicyAsSink(any(BluetoothDevice.class));
         // Mock system interface
         doNothing().when(mSystemInterface).stop();
         when(mSystemInterface.getHeadsetPhoneState()).thenReturn(mPhoneState);
@@ -938,6 +941,115 @@
         Assert.assertEquals(null, mHeadsetService.getActiveDevice());
     }
 
+    @Test
+    public void testGetFallbackCandidates() {
+        BluetoothDevice deviceA = TestUtils.getTestDevice(mAdapter, 0);
+        BluetoothDevice deviceB = TestUtils.getTestDevice(mAdapter, 1);
+        when(mDatabaseManager.getCustomMeta(any(BluetoothDevice.class),
+                any(Integer.class))).thenReturn(null);
+
+        // No connected device
+        Assert.assertTrue(mHeadsetService.getFallbackCandidates(mDatabaseManager).isEmpty());
+
+        // One connected device
+        addConnectedDeviceHelper(deviceA);
+        Assert.assertTrue(mHeadsetService.getFallbackCandidates(mDatabaseManager)
+                .contains(deviceA));
+
+        // Two connected devices
+        addConnectedDeviceHelper(deviceB);
+        Assert.assertTrue(mHeadsetService.getFallbackCandidates(mDatabaseManager)
+                .contains(deviceA));
+        Assert.assertTrue(mHeadsetService.getFallbackCandidates(mDatabaseManager)
+                .contains(deviceB));
+    }
+
+    @Test
+    public void testGetFallbackCandidates_HasWatchDevice() {
+        BluetoothDevice deviceWatch = TestUtils.getTestDevice(mAdapter, 0);
+        BluetoothDevice deviceRegular = TestUtils.getTestDevice(mAdapter, 1);
+
+        // Make deviceWatch a watch
+        when(mDatabaseManager.getCustomMeta(deviceWatch, BluetoothDevice.METADATA_DEVICE_TYPE))
+                .thenReturn(BluetoothDevice.DEVICE_TYPE_WATCH.getBytes());
+        when(mDatabaseManager.getCustomMeta(deviceRegular, BluetoothDevice.METADATA_DEVICE_TYPE))
+                .thenReturn(null);
+
+        // Has a connected watch device
+        addConnectedDeviceHelper(deviceWatch);
+        Assert.assertTrue(mHeadsetService.getFallbackCandidates(mDatabaseManager).isEmpty());
+
+        // Two connected devices with one watch
+        addConnectedDeviceHelper(deviceRegular);
+        Assert.assertFalse(mHeadsetService.getFallbackCandidates(mDatabaseManager)
+                .contains(deviceWatch));
+        Assert.assertTrue(mHeadsetService.getFallbackCandidates(mDatabaseManager)
+                .contains(deviceRegular));
+    }
+
+    @Test
+    public void testDump_doesNotCrash() {
+        StringBuilder sb = new StringBuilder();
+
+        mHeadsetService.dump(sb);
+    }
+
+    @Test
+    public void testConnectDeviceNotAllowedInbandRingPolicy_InbandRingStatus() {
+        when(mDatabaseManager.getProfileConnectionPolicy(any(BluetoothDevice.class),
+                eq(BluetoothProfile.HEADSET)))
+                .thenReturn(BluetoothProfile.CONNECTION_POLICY_UNKNOWN);
+        mCurrentDevice = TestUtils.getTestDevice(mAdapter, 0);
+        Assert.assertTrue(mHeadsetService.connect(mCurrentDevice));
+        when(mStateMachines.get(mCurrentDevice).getDevice()).thenReturn(mCurrentDevice);
+        when(mStateMachines.get(mCurrentDevice).getConnectionState()).thenReturn(
+                BluetoothProfile.STATE_CONNECTED);
+        when(mStateMachines.get(mCurrentDevice).getConnectingTimestampMs()).thenReturn(
+                SystemClock.uptimeMillis());
+        Assert.assertEquals(Collections.singletonList(mCurrentDevice),
+                mHeadsetService.getConnectedDevices());
+        mHeadsetService.onConnectionStateChangedFromStateMachine(mCurrentDevice,
+                BluetoothProfile.STATE_DISCONNECTED, BluetoothProfile.STATE_CONNECTED);
+
+        when(mStateMachines.get(mCurrentDevice).getHfpCallAudioPolicy()).thenReturn(
+                new BluetoothSinkAudioPolicy.Builder()
+                        .setCallEstablishPolicy(BluetoothSinkAudioPolicy.POLICY_ALLOWED)
+                        .setActiveDevicePolicyAfterConnection(
+                                BluetoothSinkAudioPolicy.POLICY_ALLOWED)
+                        .setInBandRingtonePolicy(BluetoothSinkAudioPolicy.POLICY_ALLOWED)
+                        .build()
+        );
+        Assert.assertEquals(true, mHeadsetService.isInbandRingingEnabled());
+
+        when(mStateMachines.get(mCurrentDevice).getHfpCallAudioPolicy()).thenReturn(
+                new BluetoothSinkAudioPolicy.Builder()
+                        .setCallEstablishPolicy(BluetoothSinkAudioPolicy.POLICY_ALLOWED)
+                        .setActiveDevicePolicyAfterConnection(
+                                BluetoothSinkAudioPolicy.POLICY_ALLOWED)
+                        .setInBandRingtonePolicy(BluetoothSinkAudioPolicy.POLICY_NOT_ALLOWED)
+                        .build()
+        );
+        Assert.assertEquals(false, mHeadsetService.isInbandRingingEnabled());
+    }
+
+    private void addConnectedDeviceHelper(BluetoothDevice device) {
+        mCurrentDevice = device;
+        when(mDatabaseManager.getProfileConnectionPolicy(any(BluetoothDevice.class),
+                eq(BluetoothProfile.HEADSET)))
+                .thenReturn(BluetoothProfile.CONNECTION_POLICY_UNKNOWN);
+        Assert.assertTrue(mHeadsetService.connect(device));
+        when(mStateMachines.get(device).getDevice()).thenReturn(device);
+        when(mStateMachines.get(device).getConnectionState()).thenReturn(
+                BluetoothProfile.STATE_CONNECTING);
+        Assert.assertEquals(BluetoothProfile.STATE_CONNECTING,
+                mHeadsetService.getConnectionState(device));
+        when(mStateMachines.get(mCurrentDevice).getConnectionState()).thenReturn(
+                BluetoothProfile.STATE_CONNECTED);
+        Assert.assertEquals(BluetoothProfile.STATE_CONNECTED,
+                mHeadsetService.getConnectionState(device));
+        Assert.assertTrue(mHeadsetService.getConnectedDevices().contains(device));
+    }
+
     /*
      *  Helper function to test okToAcceptConnection() method
      *
diff --git a/android/app/tests/unit/src/com/android/bluetooth/hfp/HeadsetStackEventTest.java b/android/app/tests/unit/src/com/android/bluetooth/hfp/HeadsetStackEventTest.java
new file mode 100644
index 0000000..049e949
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/hfp/HeadsetStackEventTest.java
@@ -0,0 +1,108 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.hfp;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import android.bluetooth.BluetoothAdapter;
+import android.bluetooth.BluetoothDevice;
+
+import androidx.test.filters.SmallTest;
+import androidx.test.runner.AndroidJUnit4;
+
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+@SmallTest
+@RunWith(AndroidJUnit4.class)
+public class HeadsetStackEventTest {
+
+    @Test
+    public void getTypeString() {
+        BluetoothAdapter adapter = BluetoothAdapter.getDefaultAdapter();
+        BluetoothDevice device = adapter.getRemoteDevice("00:01:02:03:04:05");
+
+        HeadsetStackEvent event = new HeadsetStackEvent(HeadsetStackEvent.EVENT_TYPE_NONE, device);
+        assertThat(event.getTypeString()).isEqualTo("EVENT_TYPE_NONE");
+
+        event = new HeadsetStackEvent(HeadsetStackEvent.EVENT_TYPE_CONNECTION_STATE_CHANGED,
+                device);
+        assertThat(event.getTypeString()).isEqualTo("EVENT_TYPE_CONNECTION_STATE_CHANGED");
+
+        event = new HeadsetStackEvent(HeadsetStackEvent.EVENT_TYPE_AUDIO_STATE_CHANGED, device);
+        assertThat(event.getTypeString()).isEqualTo("EVENT_TYPE_AUDIO_STATE_CHANGED");
+
+        event = new HeadsetStackEvent(HeadsetStackEvent.EVENT_TYPE_VR_STATE_CHANGED, device);
+        assertThat(event.getTypeString()).isEqualTo("EVENT_TYPE_VR_STATE_CHANGED");
+
+        event = new HeadsetStackEvent(HeadsetStackEvent.EVENT_TYPE_ANSWER_CALL, device);
+        assertThat(event.getTypeString()).isEqualTo("EVENT_TYPE_ANSWER_CALL");
+
+        event = new HeadsetStackEvent(HeadsetStackEvent.EVENT_TYPE_HANGUP_CALL, device);
+        assertThat(event.getTypeString()).isEqualTo("EVENT_TYPE_HANGUP_CALL");
+
+        event = new HeadsetStackEvent(HeadsetStackEvent.EVENT_TYPE_VOLUME_CHANGED, device);
+        assertThat(event.getTypeString()).isEqualTo("EVENT_TYPE_VOLUME_CHANGED");
+
+        event = new HeadsetStackEvent(HeadsetStackEvent.EVENT_TYPE_DIAL_CALL, device);
+        assertThat(event.getTypeString()).isEqualTo("EVENT_TYPE_DIAL_CALL");
+
+        event = new HeadsetStackEvent(HeadsetStackEvent.EVENT_TYPE_SEND_DTMF, device);
+        assertThat(event.getTypeString()).isEqualTo("EVENT_TYPE_SEND_DTMF");
+
+        event = new HeadsetStackEvent(HeadsetStackEvent.EVENT_TYPE_NOISE_REDUCTION, device);
+        assertThat(event.getTypeString()).isEqualTo("EVENT_TYPE_NOISE_REDUCTION");
+
+        event = new HeadsetStackEvent(HeadsetStackEvent.EVENT_TYPE_AT_CHLD, device);
+        assertThat(event.getTypeString()).isEqualTo("EVENT_TYPE_AT_CHLD");
+
+        event = new HeadsetStackEvent(HeadsetStackEvent.EVENT_TYPE_SUBSCRIBER_NUMBER_REQUEST,
+                device);
+        assertThat(event.getTypeString()).isEqualTo("EVENT_TYPE_SUBSCRIBER_NUMBER_REQUEST");
+
+        event = new HeadsetStackEvent(HeadsetStackEvent.EVENT_TYPE_AT_CIND, device);
+        assertThat(event.getTypeString()).isEqualTo("EVENT_TYPE_AT_CIND");
+
+        event = new HeadsetStackEvent(HeadsetStackEvent.EVENT_TYPE_AT_COPS, device);
+        assertThat(event.getTypeString()).isEqualTo("EVENT_TYPE_AT_COPS");
+
+        event = new HeadsetStackEvent(HeadsetStackEvent.EVENT_TYPE_AT_CLCC, device);
+        assertThat(event.getTypeString()).isEqualTo("EVENT_TYPE_AT_CLCC");
+
+        event = new HeadsetStackEvent(HeadsetStackEvent.EVENT_TYPE_UNKNOWN_AT, device);
+        assertThat(event.getTypeString()).isEqualTo("EVENT_TYPE_UNKNOWN_AT");
+
+        event = new HeadsetStackEvent(HeadsetStackEvent.EVENT_TYPE_KEY_PRESSED, device);
+        assertThat(event.getTypeString()).isEqualTo("EVENT_TYPE_KEY_PRESSED");
+
+        event = new HeadsetStackEvent(HeadsetStackEvent.EVENT_TYPE_WBS, device);
+        assertThat(event.getTypeString()).isEqualTo("EVENT_TYPE_WBS");
+
+        event = new HeadsetStackEvent(HeadsetStackEvent.EVENT_TYPE_BIND, device);
+        assertThat(event.getTypeString()).isEqualTo("EVENT_TYPE_BIND");
+
+        event = new HeadsetStackEvent(HeadsetStackEvent.EVENT_TYPE_BIEV, device);
+        assertThat(event.getTypeString()).isEqualTo("EVENT_TYPE_BIEV");
+
+        event = new HeadsetStackEvent(HeadsetStackEvent.EVENT_TYPE_BIA, device);
+        assertThat(event.getTypeString()).isEqualTo("EVENT_TYPE_BIA");
+
+        int unknownType = 21;
+        event = new HeadsetStackEvent(unknownType, device);
+        assertThat(event.getTypeString()).isEqualTo("UNKNOWN");
+    }
+}
diff --git a/android/app/tests/unit/src/com/android/bluetooth/hfp/HeadsetStateMachineTest.java b/android/app/tests/unit/src/com/android/bluetooth/hfp/HeadsetStateMachineTest.java
index 27ce847..025fe05 100644
--- a/android/app/tests/unit/src/com/android/bluetooth/hfp/HeadsetStateMachineTest.java
+++ b/android/app/tests/unit/src/com/android/bluetooth/hfp/HeadsetStateMachineTest.java
@@ -38,7 +38,9 @@
 import android.os.UserHandle;
 import android.provider.CallLog;
 import android.provider.CallLog.Calls;
+import android.telephony.PhoneNumberUtils;
 import android.telephony.PhoneStateListener;
+import android.telephony.ServiceState;
 import android.test.mock.MockContentProvider;
 import android.test.mock.MockContentResolver;
 
@@ -49,18 +51,23 @@
 import com.android.bluetooth.R;
 import com.android.bluetooth.TestUtils;
 import com.android.bluetooth.btservice.AdapterService;
+import com.android.bluetooth.btservice.storage.DatabaseManager;
 
 import org.hamcrest.core.IsInstanceOf;
 import org.junit.After;
 import org.junit.Assert;
 import org.junit.Assume;
 import org.junit.Before;
+import org.junit.Ignore;
 import org.junit.Test;
 import org.junit.runner.RunWith;
 import org.mockito.ArgumentCaptor;
 import org.mockito.Mock;
+import org.mockito.Mockito;
 import org.mockito.MockitoAnnotations;
 
+import java.util.ArrayList;
+
 /**
  * Tests for {@link HeadsetStateMachine}
  */
@@ -80,10 +87,12 @@
     private ArgumentCaptor<Intent> mIntentArgument = ArgumentCaptor.forClass(Intent.class);
 
     @Mock private AdapterService mAdapterService;
+    @Mock private DatabaseManager mDatabaseManager;
     @Mock private HeadsetService mHeadsetService;
     @Mock private HeadsetSystemInterface mSystemInterface;
     @Mock private AudioManager mAudioManager;
     @Mock private HeadsetPhoneState mPhoneState;
+    @Mock private Intent mIntent;
     private MockContentResolver mMockContentResolver;
     private HeadsetNativeInterface mNativeInterface;
 
@@ -102,6 +111,9 @@
         mAdapter = BluetoothAdapter.getDefaultAdapter();
         // Get a device for testing
         mTestDevice = mAdapter.getRemoteDevice("00:01:02:03:04:05");
+        // Get a database
+        doReturn(mDatabaseManager).when(mAdapterService).getDatabase();
+        doReturn(true).when(mDatabaseManager).setAudioPolicyMetadata(anyObject(), anyObject());
         // Spy on native interface
         mNativeInterface = spy(HeadsetNativeInterface.getInstance());
         doNothing().when(mNativeInterface).init(anyInt(), anyBoolean());
@@ -1095,6 +1107,356 @@
                 PhoneStateListener.LISTEN_NONE);
     }
 
+    @Test
+    public void testBroadcastVendorSpecificEventIntent() {
+        mHeadsetStateMachine.broadcastVendorSpecificEventIntent(
+                "command", 1, 1, null, mTestDevice);
+        verify(mHeadsetService, timeout(ASYNC_CALL_TIMEOUT_MILLIS)).sendBroadcastAsUser(
+                mIntentArgument.capture(), eq(UserHandle.ALL), eq(BLUETOOTH_CONNECT),
+                any(Bundle.class));
+    }
+
+    @Test
+    public void testFindChar_withCharFound() {
+        char ch = 's';
+        String input = "test";
+        int fromIndex = 0;
+
+        Assert.assertEquals(HeadsetStateMachine.findChar(ch, input, fromIndex), 2);
+    }
+
+    @Test
+    public void testFindChar_withCharNotFound() {
+        char ch = 'x';
+        String input = "test";
+        int fromIndex = 0;
+
+        Assert.assertEquals(HeadsetStateMachine.findChar(ch, input, fromIndex), input.length());
+    }
+
+    @Test
+    public void testFindChar_withQuotes() {
+        char ch = 's';
+        String input = "te\"st";
+        int fromIndex = 0;
+
+        Assert.assertEquals(HeadsetStateMachine.findChar(ch, input, fromIndex), input.length());
+    }
+
+    @Test
+    public void testGenerateArgs() {
+        String input = "11,notint";
+        ArrayList<Object> expected = new ArrayList<Object>();
+        expected.add(11);
+        expected.add("notint");
+
+        Assert.assertEquals(HeadsetStateMachine.generateArgs(input), expected.toArray());
+    }
+
+    @Test
+    public void testGetAtCommandType() {
+        String atCommand = "start?";
+        Assert.assertEquals(mHeadsetStateMachine.getAtCommandType(atCommand),
+                AtPhonebook.TYPE_READ);
+
+        atCommand = "start=?";
+        Assert.assertEquals(mHeadsetStateMachine.getAtCommandType(atCommand),
+                AtPhonebook.TYPE_TEST);
+
+        atCommand = "start=comm";
+        Assert.assertEquals(mHeadsetStateMachine.getAtCommandType(atCommand), AtPhonebook.TYPE_SET);
+
+        atCommand = "start!";
+        Assert.assertEquals(mHeadsetStateMachine.getAtCommandType(atCommand),
+                AtPhonebook.TYPE_UNKNOWN);
+    }
+
+    @Test
+    public void testParseUnknownAt() {
+        String atString = "\"command\"";
+
+        Assert.assertEquals(mHeadsetStateMachine.parseUnknownAt(atString), "\"command\"");
+    }
+
+    @Test
+    public void testParseUnknownAt_withUnmatchingQuotes() {
+        String atString = "\"command";
+
+        Assert.assertEquals(mHeadsetStateMachine.parseUnknownAt(atString), "\"command\"");
+    }
+
+    @Test
+    public void testParseUnknownAt_withCharOutsideQuotes() {
+        String atString = "a\"command\"";
+
+        Assert.assertEquals(mHeadsetStateMachine.parseUnknownAt(atString), "A\"command\"");
+    }
+
+    @Ignore("b/265556073")
+    @Test
+    public void testHandleAccessPermissionResult_withNoChangeInAtCommandResult() {
+        when(mIntent.getParcelableExtra(BluetoothDevice.EXTRA_DEVICE)).thenReturn(null);
+        when(mIntent.getAction()).thenReturn(BluetoothDevice.ACTION_CONNECTION_ACCESS_REPLY);
+        when(mIntent.getIntExtra(BluetoothDevice.EXTRA_CONNECTION_ACCESS_RESULT,
+                BluetoothDevice.CONNECTION_ACCESS_NO))
+                .thenReturn(BluetoothDevice.CONNECTION_ACCESS_NO);
+        when(mIntent.getBooleanExtra(BluetoothDevice.EXTRA_ALWAYS_ALLOWED, false)).thenReturn(true);
+        mHeadsetStateMachine.mPhonebook.setCheckingAccessPermission(true);
+
+        mHeadsetStateMachine.handleAccessPermissionResult(mIntent);
+
+        verify(mNativeInterface).atResponseCode(null, 0, 0);
+    }
+
+    @Test
+    public void testProcessAtBievCommand() {
+        mHeadsetStateMachine.processAtBiev(1, 1, mTestDevice);
+
+        verify(mHeadsetService, timeout(ASYNC_CALL_TIMEOUT_MILLIS)).sendBroadcast(
+                mIntentArgument.capture(), eq(BLUETOOTH_CONNECT), any(Bundle.class));
+    }
+
+    @Test
+    public void testProcessAtChld_withProcessChldTrue() {
+        int chld = 1;
+        when(mSystemInterface.processChld(chld)).thenReturn(true);
+
+        mHeadsetStateMachine.processAtChld(chld, mTestDevice);
+
+        verify(mNativeInterface).atResponseCode(mTestDevice, HeadsetHalConstants.AT_RESPONSE_OK, 0);
+    }
+
+    @Test
+    public void testProcessAtChld_withProcessChldFalse() {
+        int chld = 1;
+        when(mSystemInterface.processChld(chld)).thenReturn(false);
+
+        mHeadsetStateMachine.processAtChld(chld, mTestDevice);
+
+        verify(mNativeInterface).atResponseCode(mTestDevice, HeadsetHalConstants.AT_RESPONSE_ERROR,
+                0);
+    }
+
+    @Test
+    public void testProcessAtClcc_withVirtualCallStarted() {
+        when(mHeadsetService.isVirtualCallStarted()).thenReturn(true);
+        when(mSystemInterface.getSubscriberNumber()).thenReturn(null);
+
+        mHeadsetStateMachine.processAtClcc(mTestDevice);
+
+        verify(mNativeInterface).clccResponse(mTestDevice, 0, 0, 0, 0, false, "", 0);
+    }
+
+    @Test
+    public void testProcessAtClcc_withVirtualCallNotStarted() {
+        when(mHeadsetService.isVirtualCallStarted()).thenReturn(false);
+        when(mSystemInterface.listCurrentCalls()).thenReturn(false);
+
+        mHeadsetStateMachine.processAtClcc(mTestDevice);
+
+        verify(mNativeInterface).clccResponse(mTestDevice, 0, 0, 0, 0, false, "", 0);
+    }
+
+    @Test
+    public void testProcessAtCops() {
+        ServiceState serviceState = mock(ServiceState.class);
+        when(serviceState.getOperatorAlphaLong()).thenReturn("");
+        when(serviceState.getOperatorAlphaShort()).thenReturn("");
+        HeadsetPhoneState phoneState = mock(HeadsetPhoneState.class);
+        when(phoneState.getServiceState()).thenReturn(serviceState);
+        when(mSystemInterface.getHeadsetPhoneState()).thenReturn(phoneState);
+        when(mSystemInterface.isInCall()).thenReturn(true);
+        when(mSystemInterface.getNetworkOperator()).thenReturn(null);
+
+        mHeadsetStateMachine.processAtCops(mTestDevice);
+
+        verify(mNativeInterface).copsResponse(mTestDevice, "");
+    }
+
+    @Test
+    public void testProcessAtCpbr() {
+        String atString = "command=ERR";
+        int type = AtPhonebook.TYPE_SET;
+
+        mHeadsetStateMachine.processAtCpbr(atString, type, mTestDevice);
+
+        verify(mNativeInterface).atResponseCode(mTestDevice, HeadsetHalConstants.AT_RESPONSE_ERROR,
+                BluetoothCmeError.TEXT_HAS_INVALID_CHARS);
+    }
+
+    @Test
+    public void testProcessAtCpbs() {
+        String atString = "command=ERR";
+        int type = AtPhonebook.TYPE_SET;
+
+        mHeadsetStateMachine.processAtCpbs(atString, type, mTestDevice);
+
+        verify(mNativeInterface).atResponseCode(mTestDevice, HeadsetHalConstants.AT_RESPONSE_ERROR,
+                BluetoothCmeError.OPERATION_NOT_ALLOWED);
+    }
+
+    @Test
+    public void testProcessAtCscs() {
+        String atString = "command=GSM";
+        int type = AtPhonebook.TYPE_SET;
+
+        mHeadsetStateMachine.processAtCscs(atString, type, mTestDevice);
+
+        verify(mNativeInterface).atResponseCode(mTestDevice, HeadsetHalConstants.AT_RESPONSE_OK,
+                -1);
+    }
+
+    @Test
+    public void testProcessAtXapl() {
+        Object[] args = new Object[2];
+        args[0] = "1-12-3";
+        args[1] = 1;
+
+        mHeadsetStateMachine.processAtXapl(args, mTestDevice);
+
+        verify(mNativeInterface).atResponseString(mTestDevice, "+XAPL=iPhone," + String.valueOf(2));
+    }
+
+    @Test
+    public void testProcessSendVendorSpecificResultCode() {
+        HeadsetVendorSpecificResultCode resultCode = new HeadsetVendorSpecificResultCode(
+                mTestDevice, "command", "arg");
+
+        mHeadsetStateMachine.processSendVendorSpecificResultCode(resultCode);
+
+        verify(mNativeInterface).atResponseString(mTestDevice, "command" + ": " + "arg");
+    }
+
+    @Test
+    public void testProcessSubscriberNumberRequest_withSubscriberNumberNull() {
+        when(mSystemInterface.getSubscriberNumber()).thenReturn(null);
+
+        mHeadsetStateMachine.processSubscriberNumberRequest(mTestDevice);
+
+        verify(mNativeInterface).atResponseCode(mTestDevice, HeadsetHalConstants.AT_RESPONSE_OK, 0);
+    }
+
+    @Test
+    public void testProcessSubscriberNumberRequest_withSubscriberNumberNotNull() {
+        String number = "1111";
+        when(mSystemInterface.getSubscriberNumber()).thenReturn(number);
+
+        mHeadsetStateMachine.processSubscriberNumberRequest(mTestDevice);
+
+        verify(mNativeInterface).atResponseString(mTestDevice,
+                "+CNUM: ,\"" + number + "\"," + PhoneNumberUtils.toaFromString(number) + ",,4");
+        verify(mNativeInterface).atResponseCode(mTestDevice, HeadsetHalConstants.AT_RESPONSE_OK, 0);
+    }
+
+    @Test
+    public void testProcessUnknownAt() {
+        String atString = "+CSCS=invalid";
+        mHeadsetStateMachine.processUnknownAt(atString, mTestDevice);
+        verify(mNativeInterface).atResponseCode(mTestDevice, HeadsetHalConstants.AT_RESPONSE_ERROR,
+                BluetoothCmeError.OPERATION_NOT_SUPPORTED);
+        Mockito.clearInvocations(mNativeInterface);
+
+        atString = "+CPBS=";
+        mHeadsetStateMachine.processUnknownAt(atString, mTestDevice);
+        verify(mNativeInterface).atResponseCode(mTestDevice, HeadsetHalConstants.AT_RESPONSE_ERROR,
+                BluetoothCmeError.OPERATION_NOT_SUPPORTED);
+
+        atString = "+CPBR=ERR";
+        mHeadsetStateMachine.processUnknownAt(atString, mTestDevice);
+        verify(mNativeInterface).atResponseCode(mTestDevice, HeadsetHalConstants.AT_RESPONSE_ERROR,
+                BluetoothCmeError.TEXT_HAS_INVALID_CHARS);
+
+        atString = "inval=";
+        mHeadsetStateMachine.processUnknownAt(atString, mTestDevice);
+        verify(mNativeInterface).atResponseCode(mTestDevice, HeadsetHalConstants.AT_RESPONSE_ERROR,
+                0);
+    }
+
+    @Test
+    public void testProcessVendorSpecificAt_withNoEqualSignCommand() {
+        String atString = "invalid_command";
+
+        mHeadsetStateMachine.processVendorSpecificAt(atString, mTestDevice);
+
+        verify(mNativeInterface).atResponseCode(mTestDevice, HeadsetHalConstants.AT_RESPONSE_ERROR,
+                0);
+    }
+
+    @Test
+    public void testProcessVendorSpecificAt_withUnsupportedCommand() {
+        String atString = "invalid_command=";
+
+        mHeadsetStateMachine.processVendorSpecificAt(atString, mTestDevice);
+
+        verify(mNativeInterface).atResponseCode(mTestDevice, HeadsetHalConstants.AT_RESPONSE_ERROR,
+                0);
+    }
+
+    @Test
+    public void testProcessVendorSpecificAt_withQuestionMarkArg() {
+        String atString = BluetoothHeadset.VENDOR_SPECIFIC_HEADSET_EVENT_XEVENT + "=?arg";
+
+        mHeadsetStateMachine.processVendorSpecificAt(atString, mTestDevice);
+
+        verify(mNativeInterface).atResponseCode(mTestDevice, HeadsetHalConstants.AT_RESPONSE_ERROR,
+                0);
+    }
+
+    @Test
+    public void testProcessVendorSpecificAt_withValidCommandAndArg() {
+        String atString = BluetoothHeadset.VENDOR_SPECIFIC_HEADSET_EVENT_XAPL + "=1-12-3,1";
+
+        mHeadsetStateMachine.processVendorSpecificAt(atString, mTestDevice);
+
+        verify(mNativeInterface).atResponseString(mTestDevice, "+XAPL=iPhone," + "2");
+        verify(mNativeInterface).atResponseCode(mTestDevice, HeadsetHalConstants.AT_RESPONSE_OK, 0);
+    }
+
+    @Test
+    public void testProcessVolumeEvent_withVolumeTypeMic() {
+        when(mHeadsetService.getActiveDevice()).thenReturn(mTestDevice);
+
+        mHeadsetStateMachine.processVolumeEvent(HeadsetHalConstants.VOLUME_TYPE_MIC, 1);
+
+        Assert.assertEquals(mHeadsetStateMachine.mMicVolume, 1);
+    }
+
+    @Test
+    public void testProcessVolumeEvent_withVolumeTypeSpk() {
+        when(mHeadsetService.getActiveDevice()).thenReturn(mTestDevice);
+        AudioManager mockAudioManager = mock(AudioManager.class);
+        when(mockAudioManager.getStreamVolume(AudioManager.STREAM_BLUETOOTH_SCO)).thenReturn(1);
+        when(mSystemInterface.getAudioManager()).thenReturn(mockAudioManager);
+
+        mHeadsetStateMachine.processVolumeEvent(HeadsetHalConstants.VOLUME_TYPE_SPK, 2);
+
+        Assert.assertEquals(mHeadsetStateMachine.mSpeakerVolume, 2);
+        verify(mockAudioManager).setStreamVolume(AudioManager.STREAM_BLUETOOTH_SCO, 2, 0);
+    }
+
+    @Test
+    public void testDump_doesNotCrash() {
+        StringBuilder sb = new StringBuilder();
+
+        mHeadsetStateMachine.dump(sb);
+    }
+
+    /**
+     * A test to validate received Android AT commands and processing
+     */
+    @Test
+    public void testProcessAndroidAt() {
+        setUpConnectedState();
+        // setup Audio Policy Feature
+        setUpAudioPolicy();
+        // receive and set android policy
+        mHeadsetStateMachine.sendMessage(HeadsetStateMachine.STACK_EVENT,
+                new HeadsetStackEvent(HeadsetStackEvent.EVENT_TYPE_UNKNOWN_AT,
+                        "+ANDROID=1,1,1,1", mTestDevice));
+        verify(mDatabaseManager, timeout(ASYNC_CALL_TIMEOUT_MILLIS))
+                .setAudioPolicyMetadata(anyObject(), anyObject());
+    }
+
     /**
      * Setup Connecting State
      * @return number of times mHeadsetService.sendBroadcastAsUser() has been invoked
@@ -1209,4 +1571,12 @@
                 IsInstanceOf.instanceOf(HeadsetStateMachine.Disconnecting.class));
         return numBroadcastsSent;
     }
+
+    private void setUpAudioPolicy() {
+        mHeadsetStateMachine.sendMessage(HeadsetStateMachine.STACK_EVENT,
+                new HeadsetStackEvent(HeadsetStackEvent.EVENT_TYPE_UNKNOWN_AT,
+                        "+ANDROID=?", mTestDevice));
+        verify(mNativeInterface, timeout(ASYNC_CALL_TIMEOUT_MILLIS)).atResponseString(
+                anyObject(), anyString());
+    }
 }
diff --git a/android/app/tests/unit/src/com/android/bluetooth/hfp/HeadsetVendorSpecificResultCodeTest.java b/android/app/tests/unit/src/com/android/bluetooth/hfp/HeadsetVendorSpecificResultCodeTest.java
new file mode 100644
index 0000000..8d669e1
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/hfp/HeadsetVendorSpecificResultCodeTest.java
@@ -0,0 +1,69 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.hfp;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import android.bluetooth.BluetoothAdapter;
+import android.bluetooth.BluetoothDevice;
+
+import androidx.test.filters.SmallTest;
+import androidx.test.runner.AndroidJUnit4;
+
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+@SmallTest
+@RunWith(AndroidJUnit4.class)
+public class HeadsetVendorSpecificResultCodeTest {
+    private static final String TEST_COMMAND = "test_command";
+    private static final String TEST_ARG = "test_arg";
+
+    private BluetoothAdapter mAdapter;
+    private BluetoothDevice mTestDevice;
+
+    @Before
+    public void setUp() {
+        mAdapter = BluetoothAdapter.getDefaultAdapter();
+        mTestDevice = mAdapter.getRemoteDevice("00:01:02:03:04:05");
+    }
+
+    @Test
+    public void constructor() {
+        HeadsetVendorSpecificResultCode code = new HeadsetVendorSpecificResultCode(mTestDevice,
+                TEST_COMMAND, TEST_ARG);
+
+        assertThat(code.mDevice).isEqualTo(mTestDevice);
+        assertThat(code.mCommand).isEqualTo(TEST_COMMAND);
+        assertThat(code.mArg).isEqualTo(TEST_ARG);
+    }
+
+    @Test
+    public void buildString() {
+        HeadsetVendorSpecificResultCode code = new HeadsetVendorSpecificResultCode(mTestDevice,
+                TEST_COMMAND, TEST_ARG);
+        StringBuilder builder = new StringBuilder();
+
+        code.buildString(builder);
+
+        String expectedString =
+                code.getClass().getSimpleName() + "[device=" + mTestDevice + ", command="
+                        + TEST_COMMAND + ", arg=" + TEST_ARG + "]";
+        assertThat(builder.toString()).isEqualTo(expectedString);
+    }
+}
diff --git a/android/app/tests/unit/src/com/android/bluetooth/hfpclient/HeadsetClientServiceBinderTest.java b/android/app/tests/unit/src/com/android/bluetooth/hfpclient/HeadsetClientServiceBinderTest.java
new file mode 100644
index 0000000..9f68682
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/hfpclient/HeadsetClientServiceBinderTest.java
@@ -0,0 +1,265 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.hfpclient;
+
+import static org.mockito.Mockito.verify;
+
+import android.bluetooth.BluetoothAdapter;
+import android.bluetooth.BluetoothDevice;
+import android.bluetooth.BluetoothProfile;
+
+import androidx.test.filters.SmallTest;
+import androidx.test.runner.AndroidJUnit4;
+
+import com.android.bluetooth.x.com.android.modules.utils.SynchronousResultReceiver;
+
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.Mock;
+import org.mockito.MockitoAnnotations;
+
+@SmallTest
+@RunWith(AndroidJUnit4.class)
+public class HeadsetClientServiceBinderTest {
+    private static final String REMOTE_DEVICE_ADDRESS = "00:00:00:00:00:00";
+
+    @Mock
+    private HeadsetClientService mService;
+
+    BluetoothDevice mRemoteDevice;
+
+    HeadsetClientService.BluetoothHeadsetClientBinder mBinder;
+
+    @Before
+    public void setUp() throws Exception {
+        MockitoAnnotations.initMocks(this);
+        mRemoteDevice = BluetoothAdapter.getDefaultAdapter().getRemoteDevice(REMOTE_DEVICE_ADDRESS);
+        mBinder = new HeadsetClientService.BluetoothHeadsetClientBinder(mService);
+    }
+
+    @Test
+    public void connect_callsServiceMethod() {
+        mBinder.connect(mRemoteDevice, null, SynchronousResultReceiver.get());
+
+        verify(mService).connect(mRemoteDevice);
+    }
+
+    @Test
+    public void disconnect_callsServiceMethod() {
+        mBinder.disconnect(mRemoteDevice, null, SynchronousResultReceiver.get());
+
+        verify(mService).disconnect(mRemoteDevice);
+    }
+
+    @Test
+    public void getConnectedDevices_callsServiceMethod() {
+        mBinder.getConnectedDevices(null, SynchronousResultReceiver.get());
+
+        verify(mService).getConnectedDevices();
+    }
+
+    @Test
+    public void getDevicesMatchingConnectionStates_callsServiceMethod() {
+        int[] states = new int[] {BluetoothProfile.STATE_CONNECTED};
+        mBinder.getDevicesMatchingConnectionStates(states, null, SynchronousResultReceiver.get());
+
+        verify(mService).getDevicesMatchingConnectionStates(states);
+    }
+
+    @Test
+    public void getConnectionState_callsServiceMethod() {
+        mBinder.getConnectionState(mRemoteDevice, null, SynchronousResultReceiver.get());
+
+        verify(mService).getConnectionState(mRemoteDevice);
+    }
+
+    @Test
+    public void setConnectionPolicy_callsServiceMethod() {
+        int connectionPolicy = BluetoothProfile.CONNECTION_POLICY_ALLOWED;
+        mBinder.setConnectionPolicy(mRemoteDevice, connectionPolicy,
+                null, SynchronousResultReceiver.get());
+
+        verify(mService).setConnectionPolicy(mRemoteDevice, connectionPolicy);
+    }
+
+    @Test
+    public void getConnectionPolicy_callsServiceMethod() {
+        mBinder.getConnectionPolicy(mRemoteDevice, null, SynchronousResultReceiver.get());
+
+        verify(mService).getConnectionPolicy(mRemoteDevice);
+    }
+
+    @Test
+    public void startVoiceRecognition_callsServiceMethod() {
+        mBinder.startVoiceRecognition(mRemoteDevice, null, SynchronousResultReceiver.get());
+
+        verify(mService).startVoiceRecognition(mRemoteDevice);
+    }
+
+    @Test
+    public void stopVoiceRecognition_callsServiceMethod() {
+        mBinder.stopVoiceRecognition(mRemoteDevice, null, SynchronousResultReceiver.get());
+
+        verify(mService).stopVoiceRecognition(mRemoteDevice);
+    }
+
+    @Test
+    public void getAudioState_callsServiceMethod() {
+        mBinder.getAudioState(mRemoteDevice, null, SynchronousResultReceiver.get());
+
+        verify(mService).getAudioState(mRemoteDevice);
+    }
+
+    @Test
+    public void setAudioRouteAllowed_callsServiceMethod() {
+        boolean allowed = true;
+        mBinder.setAudioRouteAllowed(mRemoteDevice, allowed, null,
+                SynchronousResultReceiver.get());
+
+        verify(mService).setAudioRouteAllowed(mRemoteDevice, allowed);
+    }
+
+    @Test
+    public void getAudioRouteAllowed_callsServiceMethod() {
+        boolean allowed = true;
+        mBinder.getAudioRouteAllowed(mRemoteDevice, null,
+                SynchronousResultReceiver.get());
+
+        verify(mService).getAudioRouteAllowed(mRemoteDevice);
+    }
+
+    @Test
+    public void connectAudio_callsServiceMethod() {
+        mBinder.connectAudio(mRemoteDevice, null, SynchronousResultReceiver.get());
+
+        verify(mService).connectAudio(mRemoteDevice);
+    }
+
+    @Test
+    public void disconnectAudio_callsServiceMethod() {
+        mBinder.disconnectAudio(mRemoteDevice, null, SynchronousResultReceiver.get());
+
+        verify(mService).disconnectAudio(mRemoteDevice);
+    }
+
+    @Test
+    public void acceptCall_callsServiceMethod() {
+        int flag = 2;
+        mBinder.acceptCall(mRemoteDevice, flag, null, SynchronousResultReceiver.get());
+
+        verify(mService).acceptCall(mRemoteDevice, flag);
+    }
+
+    @Test
+    public void rejectCall_callsServiceMethod() {
+        mBinder.rejectCall(mRemoteDevice, null, SynchronousResultReceiver.get());
+
+        verify(mService).rejectCall(mRemoteDevice);
+    }
+
+    @Test
+    public void holdCall_callsServiceMethod() {
+        mBinder.holdCall(mRemoteDevice, null, SynchronousResultReceiver.get());
+
+        verify(mService).holdCall(mRemoteDevice);
+    }
+
+    @Test
+    public void terminateCall_callsServiceMethod() {
+        mBinder.terminateCall(mRemoteDevice, null, null, SynchronousResultReceiver.get());
+
+        verify(mService).terminateCall(mRemoteDevice, null);
+    }
+
+    @Test
+    public void explicitCallTransfer_callsServiceMethod() {
+        mBinder.explicitCallTransfer(mRemoteDevice, null, SynchronousResultReceiver.get());
+
+        verify(mService).explicitCallTransfer(mRemoteDevice);
+    }
+
+    @Test
+    public void enterPrivateMode_callsServiceMethod() {
+        int index = 1;
+        mBinder.enterPrivateMode(mRemoteDevice, index, null,
+                SynchronousResultReceiver.get());
+
+        verify(mService).enterPrivateMode(mRemoteDevice, index);
+    }
+
+    @Test
+    public void dial_callsServiceMethod() {
+        String number = "12532523";
+        mBinder.dial(mRemoteDevice, number, null,
+                SynchronousResultReceiver.get());
+
+        verify(mService).dial(mRemoteDevice, number);
+    }
+
+    @Test
+    public void getCurrentCalls_callsServiceMethod() {
+        mBinder.getCurrentCalls(mRemoteDevice, null, SynchronousResultReceiver.get());
+
+        verify(mService).getCurrentCalls(mRemoteDevice);
+    }
+
+    @Test
+    public void sendDTMF_callsServiceMethod() {
+        byte code = 21;
+        mBinder.sendDTMF(mRemoteDevice, code, null, SynchronousResultReceiver.get());
+
+        verify(mService).sendDTMF(mRemoteDevice, code);
+    }
+
+    @Test
+    public void getLastVoiceTagNumber_callsServiceMethod() {
+        mBinder.getLastVoiceTagNumber(mRemoteDevice, null, SynchronousResultReceiver.get());
+
+        verify(mService).getLastVoiceTagNumber(mRemoteDevice);
+    }
+
+    @Test
+    public void getCurrentAgEvents_callsServiceMethod() {
+        mBinder.getCurrentAgEvents(mRemoteDevice, null, SynchronousResultReceiver.get());
+
+        verify(mService).getCurrentAgEvents(mRemoteDevice);
+    }
+
+    @Test
+    public void sendVendorAtCommand_callsServiceMethod() {
+        int vendorId = 5;
+        String cmd = "test_command";
+
+        mBinder.sendVendorAtCommand(mRemoteDevice, vendorId, cmd,
+                null, SynchronousResultReceiver.get());
+
+        verify(mService).sendVendorAtCommand(mRemoteDevice, vendorId, cmd);
+    }
+
+    @Test
+    public void getCurrentAgFeatures_callsServiceMethod() {
+        mBinder.getCurrentAgFeatures(mRemoteDevice, null, SynchronousResultReceiver.get());
+
+        verify(mService).getCurrentAgFeaturesBundle(mRemoteDevice);
+    }
+
+    @Test
+    public void cleanUp_doesNotCrash() {
+        mBinder.cleanup();
+    }
+}
diff --git a/android/app/tests/unit/src/com/android/bluetooth/hfpclient/HeadsetClientServiceTest.java b/android/app/tests/unit/src/com/android/bluetooth/hfpclient/HeadsetClientServiceTest.java
index a511753..be9df4b 100644
--- a/android/app/tests/unit/src/com/android/bluetooth/hfpclient/HeadsetClientServiceTest.java
+++ b/android/app/tests/unit/src/com/android/bluetooth/hfpclient/HeadsetClientServiceTest.java
@@ -16,6 +16,7 @@
 
 package com.android.bluetooth.hfpclient;
 
+import static org.mockito.Mockito.any;
 import static org.mockito.Mockito.anyInt;
 import static org.mockito.Mockito.anyString;
 import static org.mockito.Mockito.doReturn;
@@ -25,6 +26,8 @@
 
 import android.bluetooth.BluetoothAdapter;
 import android.bluetooth.BluetoothDevice;
+import android.bluetooth.BluetoothHeadset;
+import android.bluetooth.BluetoothSinkAudioPolicy;
 import android.bluetooth.BluetoothManager;
 import android.content.Context;
 import android.content.Intent;
@@ -44,6 +47,7 @@
 import org.junit.Assert;
 import org.junit.Assume;
 import org.junit.Before;
+import org.junit.Ignore;
 import org.junit.Rule;
 import org.junit.Test;
 import org.junit.runner.RunWith;
@@ -100,6 +104,7 @@
         Assert.assertNotNull(HeadsetClientService.getHeadsetClientService());
     }
 
+    @Ignore("b/260202548")
     @Test
     public void testSendBIEVtoStateMachineWhenBatteryChanged() {
         // Put mock state machine
@@ -136,4 +141,27 @@
                     eq(2),
                     anyInt());
     }
+
+    @Test
+    public void testDumpDoesNotCrash() {
+        // Put mock state machine
+        BluetoothDevice device =
+                BluetoothAdapter.getDefaultAdapter().getRemoteDevice("00:01:02:03:04:05");
+        mService.getStateMachineMap().put(device, mStateMachine);
+
+        mService.dump(new StringBuilder());
+    }
+
+    @Test
+    public void testSetCallAudioPolicy() {
+        // Put mock state machine
+        BluetoothDevice device =
+                BluetoothAdapter.getDefaultAdapter().getRemoteDevice("00:01:02:03:04:05");
+        mService.getStateMachineMap().put(device, mStateMachine);
+
+        mService.setAudioPolicy(device, new BluetoothSinkAudioPolicy.Builder().build());
+
+        verify(mStateMachine, timeout(STANDARD_WAIT_MILLIS).times(1))
+                .setAudioPolicy(any(BluetoothSinkAudioPolicy.class));
+    }
 }
diff --git a/android/app/tests/unit/src/com/android/bluetooth/hfpclient/HeadsetClientStateMachineTest.java b/android/app/tests/unit/src/com/android/bluetooth/hfpclient/HeadsetClientStateMachineTest.java
index f6f085b..dc8683d 100644
--- a/android/app/tests/unit/src/com/android/bluetooth/hfpclient/HeadsetClientStateMachineTest.java
+++ b/android/app/tests/unit/src/com/android/bluetooth/hfpclient/HeadsetClientStateMachineTest.java
@@ -1,6 +1,29 @@
+/*
+ * Copyright 2016 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
 package com.android.bluetooth.hfpclient;
 
+import static android.bluetooth.BluetoothProfile.STATE_CONNECTED;
+import static android.bluetooth.BluetoothProfile.STATE_CONNECTING;
+import static android.bluetooth.BluetoothProfile.STATE_DISCONNECTED;
+import static android.bluetooth.BluetoothProfile.STATE_DISCONNECTING;
+
 import static com.android.bluetooth.hfpclient.HeadsetClientStateMachine.AT_OK;
+import static com.android.bluetooth.hfpclient.HeadsetClientStateMachine.ENTER_PRIVATE_MODE;
+import static com.android.bluetooth.hfpclient.HeadsetClientStateMachine.EXPLICIT_CALL_TRANSFER;
 import static com.android.bluetooth.hfpclient.HeadsetClientStateMachine.VOICE_RECOGNITION_START;
 import static com.android.bluetooth.hfpclient.HeadsetClientStateMachine.VOICE_RECOGNITION_STOP;
 
@@ -11,6 +34,7 @@
 import android.bluetooth.BluetoothAssignedNumbers;
 import android.bluetooth.BluetoothDevice;
 import android.bluetooth.BluetoothHeadsetClient;
+import android.bluetooth.BluetoothSinkAudioPolicy;
 import android.bluetooth.BluetoothProfile;
 import android.content.Context;
 import android.content.Intent;
@@ -18,7 +42,9 @@
 import android.media.AudioManager;
 import android.os.Bundle;
 import android.os.HandlerThread;
+import android.os.Looper;
 import android.os.Message;
+import android.util.Pair;
 
 import androidx.test.InstrumentationRegistry;
 import androidx.test.espresso.intent.matcher.IntentMatchers;
@@ -31,6 +57,9 @@
 import com.android.bluetooth.R;
 import com.android.bluetooth.TestUtils;
 import com.android.bluetooth.Utils;
+import com.android.bluetooth.btservice.AdapterService;
+import com.android.bluetooth.hfp.HeadsetService;
+import com.android.bluetooth.hfp.HeadsetStackEvent;
 
 import org.hamcrest.core.AllOf;
 import org.hamcrest.core.IsInstanceOf;
@@ -42,21 +71,32 @@
 import org.junit.runner.RunWith;
 import org.mockito.ArgumentCaptor;
 import org.mockito.Mock;
+import org.mockito.Mockito;
 import org.mockito.MockitoAnnotations;
 import org.mockito.hamcrest.MockitoHamcrest;
 
+import java.util.List;
+import java.util.Set;
+
+/**
+ * Test cases for {@link HeadsetClientStateMachine}.
+ */
 @LargeTest
 @RunWith(AndroidJUnit4.class)
 public class HeadsetClientStateMachineTest {
     private BluetoothAdapter mAdapter;
     private HandlerThread mHandlerThread;
-    private HeadsetClientStateMachine mHeadsetClientStateMachine;
+    private TestHeadsetClientStateMachine mHeadsetClientStateMachine;
     private BluetoothDevice mTestDevice;
     private Context mTargetContext;
 
     @Mock
+    private AdapterService mAdapterService;
+    @Mock
     private Resources mMockHfpResources;
     @Mock
+    private HeadsetService mHeadsetService;
+    @Mock
     private HeadsetClientService mHeadsetClientService;
     @Mock
     private AudioManager mAudioManager;
@@ -67,9 +107,10 @@
     private static final int QUERY_CURRENT_CALLS_WAIT_MILLIS = 2000;
     private static final int QUERY_CURRENT_CALLS_TEST_WAIT_MILLIS = QUERY_CURRENT_CALLS_WAIT_MILLIS
             * 3 / 2;
+    private static final int TIMEOUT_MS = 1000;
 
     @Before
-    public void setUp() {
+    public void setUp() throws Exception {
         mTargetContext = InstrumentationRegistry.getTargetContext();
         Assume.assumeTrue("Ignore test when HeadsetClientService is not enabled",
                 HeadsetClientService.isEnabled());
@@ -85,7 +126,10 @@
         when(mMockHfpResources.getBoolean(R.bool.hfp_clcc_poll_during_call)).thenReturn(true);
         when(mMockHfpResources.getInteger(R.integer.hfp_clcc_poll_interval_during_call))
                 .thenReturn(2000);
+
+        TestUtils.setAdapterService(mAdapterService);
         mNativeInterface = spy(NativeInterface.getInstance());
+        doReturn(true).when(mNativeInterface).sendAndroidAt(anyObject(), anyString());
 
         // This line must be called to make sure relevant objects are initialized properly
         mAdapter = BluetoothAdapter.getDefaultAdapter();
@@ -96,21 +140,24 @@
         mHandlerThread = new HandlerThread("HeadsetClientStateMachineTestHandlerThread");
         mHandlerThread.start();
         // Manage looper execution in main test thread explicitly to guarantee timing consistency
-        mHeadsetClientStateMachine =
-                new HeadsetClientStateMachine(mHeadsetClientService, mHandlerThread.getLooper(),
-                                              mNativeInterface);
+        mHeadsetClientStateMachine = new TestHeadsetClientStateMachine(mHeadsetClientService,
+                mHeadsetService, mHandlerThread.getLooper(), mNativeInterface);
         mHeadsetClientStateMachine.start();
         TestUtils.waitForLooperToFinishScheduledTask(mHandlerThread.getLooper());
     }
 
     @After
-    public void tearDown() {
+    public void tearDown() throws Exception {
         if (!HeadsetClientService.isEnabled()) {
             return;
         }
         TestUtils.waitForLooperToFinishScheduledTask(mHandlerThread.getLooper());
+        mHeadsetClientStateMachine.allowConnect = null;
         mHeadsetClientStateMachine.doQuit();
+        TestUtils.waitForLooperToFinishScheduledTask(mHandlerThread.getLooper());
         mHandlerThread.quit();
+        TestUtils.clearAdapterService(mAdapterService);
+        verifyNoMoreInteractions(mHeadsetService);
     }
 
     /**
@@ -189,6 +236,9 @@
         slcEvent.valueInt2 = HeadsetClientHalConstants.PEER_FEAT_ECS;
         slcEvent.device = mTestDevice;
         mHeadsetClientStateMachine.sendMessage(StackEvent.STACK_EVENT, slcEvent);
+        TestUtils.waitForLooperToFinishScheduledTask(mHandlerThread.getLooper());
+
+        setUpAndroidAt(false);
 
         // Verify that one connection state broadcast is executed
         ArgumentCaptor<Intent> intentArgument2 = ArgumentCaptor.forClass(Intent.class);
@@ -200,6 +250,7 @@
         // Check we are in connecting state now.
         Assert.assertThat(mHeadsetClientStateMachine.getCurrentState(),
                 IsInstanceOf.instanceOf(HeadsetClientStateMachine.Connected.class));
+        verify(mHeadsetService).updateInbandRinging(eq(mTestDevice), eq(true));
     }
 
     /**
@@ -242,6 +293,7 @@
         // Check we are in connecting state now.
         Assert.assertThat(mHeadsetClientStateMachine.getCurrentState(),
                 IsInstanceOf.instanceOf(HeadsetClientStateMachine.Disconnected.class));
+        verify(mHeadsetService).updateInbandRinging(eq(mTestDevice), eq(false));
     }
 
     /**
@@ -281,6 +333,9 @@
         slcEvent.valueInt2 = HeadsetClientHalConstants.PEER_FEAT_ECS;
         slcEvent.device = mTestDevice;
         mHeadsetClientStateMachine.sendMessage(StackEvent.STACK_EVENT, slcEvent);
+        TestUtils.waitForLooperToFinishScheduledTask(mHandlerThread.getLooper());
+
+        setUpAndroidAt(false);
 
         verify(mHeadsetClientService,
                 timeout(STANDARD_WAIT_MILLIS).times(expectedBroadcastMultiplePermissionsIndex++))
@@ -290,6 +345,8 @@
         Assert.assertEquals(BluetoothProfile.STATE_CONNECTED,
                 intentArgument.getValue().getIntExtra(BluetoothProfile.EXTRA_STATE, -1));
 
+        verify(mHeadsetService).updateInbandRinging(eq(mTestDevice), eq(true));
+
         StackEvent event = new StackEvent(StackEvent.EVENT_TYPE_IN_BAND_RINGTONE);
         event.valueInt = 0;
         event.device = mTestDevice;
@@ -384,6 +441,10 @@
 
     /* Utility function to simulate SLC connection. */
     private int setUpServiceLevelConnection(int startBroadcastIndex) {
+        return setUpServiceLevelConnection(startBroadcastIndex, false);
+    }
+
+    private int setUpServiceLevelConnection(int startBroadcastIndex, boolean androidAtSupported) {
         // Trigger SLC connection
         StackEvent slcEvent = new StackEvent(StackEvent.EVENT_TYPE_CONNECTION_STATE_CHANGED);
         slcEvent.valueInt = HeadsetClientHalConstants.CONNECTION_STATE_SLC_CONNECTED;
@@ -391,16 +452,47 @@
         slcEvent.valueInt2 |= HeadsetClientHalConstants.PEER_FEAT_HF_IND;
         slcEvent.device = mTestDevice;
         mHeadsetClientStateMachine.sendMessage(StackEvent.STACK_EVENT, slcEvent);
+        TestUtils.waitForLooperToFinishScheduledTask(mHandlerThread.getLooper());
+
+        setUpAndroidAt(androidAtSupported);
+
         ArgumentCaptor<Intent> intentArgument = ArgumentCaptor.forClass(Intent.class);
         verify(mHeadsetClientService, timeout(STANDARD_WAIT_MILLIS).times(startBroadcastIndex))
                 .sendBroadcastMultiplePermissions(intentArgument.capture(),
                                                   any(String[].class), any(BroadcastOptions.class));
         Assert.assertEquals(BluetoothProfile.STATE_CONNECTED,
                 intentArgument.getValue().getIntExtra(BluetoothProfile.EXTRA_STATE, -1));
+        Assert.assertThat(mHeadsetClientStateMachine.getCurrentState(),
+                IsInstanceOf.instanceOf(HeadsetClientStateMachine.Connected.class));
+        verify(mHeadsetService).updateInbandRinging(eq(mTestDevice), eq(true));
+
         startBroadcastIndex++;
         return startBroadcastIndex;
     }
 
+    /**
+     * Set up and verify AT Android related commands and events.
+     * Make sure this method is invoked after SLC is setup.
+     */
+    private void setUpAndroidAt(boolean androidAtSupported) {
+        verify(mNativeInterface).sendAndroidAt(mTestDevice, "+ANDROID=?");
+        if (androidAtSupported) {
+            StackEvent unknownEvt = new StackEvent(StackEvent.EVENT_TYPE_UNKNOWN_EVENT);
+            unknownEvt.valueString = "+ANDROID: 1";
+            unknownEvt.device = mTestDevice;
+            mHeadsetClientStateMachine.sendMessage(StackEvent.STACK_EVENT, unknownEvt);
+            TestUtils.waitForLooperToFinishScheduledTask(mHandlerThread.getLooper());
+            verify(mHeadsetClientService).setAudioPolicyRemoteSupported(mTestDevice, true);
+            mHeadsetClientStateMachine.setAudioPolicyRemoteSupported(true);
+        } else {
+            // receive CMD_RESULT CME_ERROR due to remote not supporting Android AT
+            StackEvent cmdResEvt = new StackEvent(StackEvent.EVENT_TYPE_CMD_RESULT);
+            cmdResEvt.valueInt = StackEvent.CMD_RESULT_TYPE_CME_ERROR;
+            cmdResEvt.device = mTestDevice;
+            mHeadsetClientStateMachine.sendMessage(StackEvent.STACK_EVENT, cmdResEvt);
+        }
+    }
+
     /* Utility function: supported AT command should lead to native call */
     private void runSupportedVendorAtCommand(String atCommand, int vendorId) {
         // Return true for priority.
@@ -700,4 +792,640 @@
         verify(mHeadsetClientService, timeout(STANDARD_WAIT_MILLIS).times(1))
                 .updateBatteryLevel();
     }
+
+    @Test
+    public void testBroadcastAudioState() {
+        mHeadsetClientStateMachine.broadcastAudioState(mTestDevice,
+                BluetoothHeadsetClient.STATE_AUDIO_CONNECTED,
+                BluetoothHeadsetClient.STATE_AUDIO_CONNECTING);
+
+        verify(mHeadsetClientService).sendBroadcast(any(), any(), any());
+    }
+
+    @Test
+    public void testCallsInState() {
+        HfpClientCall call = new HfpClientCall(mTestDevice, 0, HfpClientCall.CALL_STATE_WAITING,
+                "1", false, false, false);
+        mHeadsetClientStateMachine.mCalls.put(0, call);
+
+        Assert.assertEquals(
+                mHeadsetClientStateMachine.callsInState(HfpClientCall.CALL_STATE_WAITING), 1);
+    }
+
+    @Test
+    public void testEnterPrivateMode() {
+        HfpClientCall call = new HfpClientCall(mTestDevice, 0, HfpClientCall.CALL_STATE_ACTIVE,
+                "1", true, false, false);
+        mHeadsetClientStateMachine.mCalls.put(0, call);
+        doReturn(true).when(mNativeInterface).handleCallAction(null,
+                HeadsetClientHalConstants.CALL_ACTION_CHLD_2X, 0);
+
+        mHeadsetClientStateMachine.enterPrivateMode(0);
+
+        Pair expectedPair = new Pair<Integer, Object>(ENTER_PRIVATE_MODE, call);
+        Assert.assertEquals(mHeadsetClientStateMachine.mQueuedActions.peek(), expectedPair);
+    }
+
+    @Test
+    public void testExplicitCallTransfer() {
+        HfpClientCall callOne = new HfpClientCall(mTestDevice, 0, HfpClientCall.CALL_STATE_ACTIVE,
+                "1", true, false, false);
+        HfpClientCall callTwo = new HfpClientCall(mTestDevice, 0, HfpClientCall.CALL_STATE_ACTIVE,
+                "1", true, false, false);
+        mHeadsetClientStateMachine.mCalls.put(0, callOne);
+        mHeadsetClientStateMachine.mCalls.put(1, callTwo);
+        doReturn(true).when(mNativeInterface).handleCallAction(null,
+                HeadsetClientHalConstants.CALL_ACTION_CHLD_4, -1);
+
+        mHeadsetClientStateMachine.explicitCallTransfer();
+
+        Pair expectedPair = new Pair<Integer, Object>(EXPLICIT_CALL_TRANSFER, 0);
+        Assert.assertEquals(mHeadsetClientStateMachine.mQueuedActions.peek(), expectedPair);
+    }
+
+    @Test
+    public void testSetAudioRouteAllowed() {
+        mHeadsetClientStateMachine.setAudioRouteAllowed(true);
+
+        Assert.assertTrue(mHeadsetClientStateMachine.getAudioRouteAllowed());
+    }
+
+    @Test
+    public void testGetAudioState_withCurrentDeviceNull() {
+        Assert.assertNull(mHeadsetClientStateMachine.mCurrentDevice);
+
+        Assert.assertEquals(mHeadsetClientStateMachine.getAudioState(mTestDevice),
+                BluetoothHeadsetClient.STATE_AUDIO_DISCONNECTED);
+    }
+
+    @Test
+    public void testGetAudioState_withCurrentDeviceNotNull() {
+        int audioState = 1;
+        mHeadsetClientStateMachine.mAudioState = audioState;
+        mHeadsetClientStateMachine.mCurrentDevice = mTestDevice;
+
+        Assert.assertEquals(mHeadsetClientStateMachine.getAudioState(mTestDevice), audioState);
+    }
+
+    @Test
+    public void testGetCall_withMatchingState() {
+        HfpClientCall call = new HfpClientCall(mTestDevice, 0, HfpClientCall.CALL_STATE_ACTIVE,
+                "1", true, false, false);
+        mHeadsetClientStateMachine.mCalls.put(0, call);
+        int[] states = new int[1];
+        states[0] = HfpClientCall.CALL_STATE_ACTIVE;
+
+        Assert.assertEquals(mHeadsetClientStateMachine.getCall(states), call);
+    }
+
+    @Test
+    public void testGetCall_withNoMatchingState() {
+        HfpClientCall call = new HfpClientCall(mTestDevice, 0, HfpClientCall.CALL_STATE_WAITING,
+                "1", true, false, false);
+        mHeadsetClientStateMachine.mCalls.put(0, call);
+        int[] states = new int[1];
+        states[0] = HfpClientCall.CALL_STATE_ACTIVE;
+
+        Assert.assertNull(mHeadsetClientStateMachine.getCall(states));
+    }
+
+    @Test
+    public void testGetConnectionState_withNullDevice() {
+        Assert.assertEquals(mHeadsetClientStateMachine.getConnectionState(null),
+                BluetoothProfile.STATE_DISCONNECTED);
+    }
+
+    @Test
+    public void testGetConnectionState_withNonNullDevice() {
+        mHeadsetClientStateMachine.mCurrentDevice = mTestDevice;
+
+        Assert.assertEquals(mHeadsetClientStateMachine.getConnectionState(mTestDevice),
+                BluetoothProfile.STATE_DISCONNECTED);
+    }
+
+    @Test
+    public void testGetConnectionStateFromAudioState() {
+        Assert.assertEquals(HeadsetClientStateMachine.getConnectionStateFromAudioState(
+                BluetoothHeadsetClient.STATE_AUDIO_CONNECTED), BluetoothAdapter.STATE_CONNECTED);
+        Assert.assertEquals(HeadsetClientStateMachine.getConnectionStateFromAudioState(
+                BluetoothHeadsetClient.STATE_AUDIO_CONNECTING), BluetoothAdapter.STATE_CONNECTING);
+        Assert.assertEquals(HeadsetClientStateMachine.getConnectionStateFromAudioState(
+                        BluetoothHeadsetClient.STATE_AUDIO_DISCONNECTED),
+                BluetoothAdapter.STATE_DISCONNECTED);
+        int invalidAudioState = 3;
+        Assert.assertEquals(
+                HeadsetClientStateMachine.getConnectionStateFromAudioState(invalidAudioState),
+                BluetoothAdapter.STATE_DISCONNECTED);
+    }
+
+    @Test
+    public void testGetCurrentAgEvents() {
+        Bundle bundle = mHeadsetClientStateMachine.getCurrentAgEvents();
+
+        Assert.assertEquals(bundle.getString(BluetoothHeadsetClient.EXTRA_SUBSCRIBER_INFO),
+                mHeadsetClientStateMachine.mSubscriberInfo);
+    }
+
+    @Test
+    public void testGetCurrentAgFeatures() {
+        mHeadsetClientStateMachine.mPeerFeatures = HeadsetClientHalConstants.PEER_FEAT_3WAY;
+        mHeadsetClientStateMachine.mChldFeatures = HeadsetClientHalConstants.CHLD_FEAT_HOLD_ACC;
+        Set<Integer> features = mHeadsetClientStateMachine.getCurrentAgFeatures();
+        Assert.assertTrue(features.contains(HeadsetClientHalConstants.PEER_FEAT_3WAY));
+        Assert.assertTrue(features.contains(HeadsetClientHalConstants.CHLD_FEAT_HOLD_ACC));
+
+        mHeadsetClientStateMachine.mPeerFeatures = HeadsetClientHalConstants.PEER_FEAT_VREC;
+        mHeadsetClientStateMachine.mChldFeatures = HeadsetClientHalConstants.CHLD_FEAT_REL;
+        features = mHeadsetClientStateMachine.getCurrentAgFeatures();
+        Assert.assertTrue(features.contains(HeadsetClientHalConstants.PEER_FEAT_VREC));
+        Assert.assertTrue(features.contains(HeadsetClientHalConstants.CHLD_FEAT_REL));
+
+        mHeadsetClientStateMachine.mPeerFeatures = HeadsetClientHalConstants.PEER_FEAT_REJECT;
+        mHeadsetClientStateMachine.mChldFeatures = HeadsetClientHalConstants.CHLD_FEAT_REL_ACC;
+        features = mHeadsetClientStateMachine.getCurrentAgFeatures();
+        Assert.assertTrue(features.contains(HeadsetClientHalConstants.PEER_FEAT_REJECT));
+        Assert.assertTrue(features.contains(HeadsetClientHalConstants.CHLD_FEAT_REL_ACC));
+
+        mHeadsetClientStateMachine.mPeerFeatures = HeadsetClientHalConstants.PEER_FEAT_ECC;
+        mHeadsetClientStateMachine.mChldFeatures = HeadsetClientHalConstants.CHLD_FEAT_MERGE;
+        features = mHeadsetClientStateMachine.getCurrentAgFeatures();
+        Assert.assertTrue(features.contains(HeadsetClientHalConstants.PEER_FEAT_ECC));
+        Assert.assertTrue(features.contains(HeadsetClientHalConstants.CHLD_FEAT_MERGE));
+
+        mHeadsetClientStateMachine.mChldFeatures = HeadsetClientHalConstants.CHLD_FEAT_MERGE_DETACH;
+        features = mHeadsetClientStateMachine.getCurrentAgFeatures();
+        Assert.assertTrue(features.contains(HeadsetClientHalConstants.CHLD_FEAT_MERGE_DETACH));
+    }
+
+    @Test
+    public void testGetCurrentAgFeaturesBundle() {
+        mHeadsetClientStateMachine.mPeerFeatures = HeadsetClientHalConstants.PEER_FEAT_3WAY;
+        mHeadsetClientStateMachine.mChldFeatures = HeadsetClientHalConstants.CHLD_FEAT_HOLD_ACC;
+        Bundle bundle = mHeadsetClientStateMachine.getCurrentAgFeaturesBundle();
+        Assert.assertTrue(bundle.getBoolean(BluetoothHeadsetClient.EXTRA_AG_FEATURE_3WAY_CALLING));
+        Assert.assertTrue(bundle.getBoolean(
+                BluetoothHeadsetClient.EXTRA_AG_FEATURE_ACCEPT_HELD_OR_WAITING_CALL));
+
+        mHeadsetClientStateMachine.mPeerFeatures = HeadsetClientHalConstants.PEER_FEAT_VREC;
+        mHeadsetClientStateMachine.mChldFeatures = HeadsetClientHalConstants.CHLD_FEAT_REL;
+        bundle = mHeadsetClientStateMachine.getCurrentAgFeaturesBundle();
+        Assert.assertTrue(
+                bundle.getBoolean(BluetoothHeadsetClient.EXTRA_AG_FEATURE_VOICE_RECOGNITION));
+        Assert.assertTrue(bundle.getBoolean(
+                BluetoothHeadsetClient.EXTRA_AG_FEATURE_RELEASE_HELD_OR_WAITING_CALL));
+
+        mHeadsetClientStateMachine.mPeerFeatures = HeadsetClientHalConstants.PEER_FEAT_REJECT;
+        mHeadsetClientStateMachine.mChldFeatures = HeadsetClientHalConstants.CHLD_FEAT_REL_ACC;
+        bundle = mHeadsetClientStateMachine.getCurrentAgFeaturesBundle();
+        Assert.assertTrue(bundle.getBoolean(BluetoothHeadsetClient.EXTRA_AG_FEATURE_REJECT_CALL));
+        Assert.assertTrue(
+                bundle.getBoolean(BluetoothHeadsetClient.EXTRA_AG_FEATURE_RELEASE_AND_ACCEPT));
+
+        mHeadsetClientStateMachine.mPeerFeatures = HeadsetClientHalConstants.PEER_FEAT_ECC;
+        mHeadsetClientStateMachine.mChldFeatures = HeadsetClientHalConstants.CHLD_FEAT_MERGE;
+        bundle = mHeadsetClientStateMachine.getCurrentAgFeaturesBundle();
+        Assert.assertTrue(bundle.getBoolean(BluetoothHeadsetClient.EXTRA_AG_FEATURE_ECC));
+        Assert.assertTrue(bundle.getBoolean(BluetoothHeadsetClient.EXTRA_AG_FEATURE_MERGE));
+
+        mHeadsetClientStateMachine.mChldFeatures = HeadsetClientHalConstants.CHLD_FEAT_MERGE_DETACH;
+        bundle = mHeadsetClientStateMachine.getCurrentAgFeaturesBundle();
+        Assert.assertTrue(
+                bundle.getBoolean(BluetoothHeadsetClient.EXTRA_AG_FEATURE_MERGE_AND_DETACH));
+    }
+
+    @Test
+    public void testGetCurrentCalls() {
+        HfpClientCall call = new HfpClientCall(mTestDevice, 0, HfpClientCall.CALL_STATE_WAITING,
+                "1", true, false, false);
+        mHeadsetClientStateMachine.mCalls.put(0, call);
+
+        List<HfpClientCall> currentCalls = mHeadsetClientStateMachine.getCurrentCalls();
+
+        Assert.assertEquals(currentCalls.get(0), call);
+    }
+
+    @Test
+    public void testGetMessageName() {
+        Assert.assertEquals(HeadsetClientStateMachine.getMessageName(StackEvent.STACK_EVENT),
+                "STACK_EVENT");
+        Assert.assertEquals(
+                HeadsetClientStateMachine.getMessageName(HeadsetClientStateMachine.CONNECT),
+                "CONNECT");
+        Assert.assertEquals(
+                HeadsetClientStateMachine.getMessageName(HeadsetClientStateMachine.DISCONNECT),
+                "DISCONNECT");
+        Assert.assertEquals(
+                HeadsetClientStateMachine.getMessageName(HeadsetClientStateMachine.CONNECT_AUDIO),
+                "CONNECT_AUDIO");
+        Assert.assertEquals(HeadsetClientStateMachine.getMessageName(
+                HeadsetClientStateMachine.DISCONNECT_AUDIO), "DISCONNECT_AUDIO");
+        Assert.assertEquals(HeadsetClientStateMachine.getMessageName(VOICE_RECOGNITION_START),
+                "VOICE_RECOGNITION_START");
+        Assert.assertEquals(HeadsetClientStateMachine.getMessageName(VOICE_RECOGNITION_STOP),
+                "VOICE_RECOGNITION_STOP");
+        Assert.assertEquals(
+                HeadsetClientStateMachine.getMessageName(HeadsetClientStateMachine.SET_MIC_VOLUME),
+                "SET_MIC_VOLUME");
+        Assert.assertEquals(HeadsetClientStateMachine.getMessageName(
+                HeadsetClientStateMachine.SET_SPEAKER_VOLUME), "SET_SPEAKER_VOLUME");
+        Assert.assertEquals(
+                HeadsetClientStateMachine.getMessageName(HeadsetClientStateMachine.DIAL_NUMBER),
+                "DIAL_NUMBER");
+        Assert.assertEquals(
+                HeadsetClientStateMachine.getMessageName(HeadsetClientStateMachine.ACCEPT_CALL),
+                "ACCEPT_CALL");
+        Assert.assertEquals(
+                HeadsetClientStateMachine.getMessageName(HeadsetClientStateMachine.REJECT_CALL),
+                "REJECT_CALL");
+        Assert.assertEquals(
+                HeadsetClientStateMachine.getMessageName(HeadsetClientStateMachine.HOLD_CALL),
+                "HOLD_CALL");
+        Assert.assertEquals(
+                HeadsetClientStateMachine.getMessageName(HeadsetClientStateMachine.TERMINATE_CALL),
+                "TERMINATE_CALL");
+        Assert.assertEquals(HeadsetClientStateMachine.getMessageName(ENTER_PRIVATE_MODE),
+                "ENTER_PRIVATE_MODE");
+        Assert.assertEquals(
+                HeadsetClientStateMachine.getMessageName(HeadsetClientStateMachine.SEND_DTMF),
+                "SEND_DTMF");
+        Assert.assertEquals(HeadsetClientStateMachine.getMessageName(EXPLICIT_CALL_TRANSFER),
+                "EXPLICIT_CALL_TRANSFER");
+        Assert.assertEquals(
+                HeadsetClientStateMachine.getMessageName(HeadsetClientStateMachine.DISABLE_NREC),
+                "DISABLE_NREC");
+        Assert.assertEquals(HeadsetClientStateMachine.getMessageName(
+                HeadsetClientStateMachine.SEND_VENDOR_AT_COMMAND), "SEND_VENDOR_AT_COMMAND");
+        Assert.assertEquals(
+                HeadsetClientStateMachine.getMessageName(HeadsetClientStateMachine.SEND_BIEV),
+                "SEND_BIEV");
+        Assert.assertEquals(HeadsetClientStateMachine.getMessageName(
+                HeadsetClientStateMachine.QUERY_CURRENT_CALLS), "QUERY_CURRENT_CALLS");
+        Assert.assertEquals(HeadsetClientStateMachine.getMessageName(
+                HeadsetClientStateMachine.QUERY_OPERATOR_NAME), "QUERY_OPERATOR_NAME");
+        Assert.assertEquals(
+                HeadsetClientStateMachine.getMessageName(HeadsetClientStateMachine.SUBSCRIBER_INFO),
+                "SUBSCRIBER_INFO");
+        Assert.assertEquals(HeadsetClientStateMachine.getMessageName(
+                HeadsetClientStateMachine.CONNECTING_TIMEOUT), "CONNECTING_TIMEOUT");
+        int unknownMessageInt = 54;
+        Assert.assertEquals(HeadsetClientStateMachine.getMessageName(unknownMessageInt),
+                "UNKNOWN(" + unknownMessageInt + ")");
+    }
+    /**
+     * Tests and verify behavior of the case where remote device doesn't support
+     * At Android but tries to send audio policy.
+     */
+    @Test
+    public void testAndroidAtRemoteNotSupported_StateTransition_setAudioPolicy() {
+        // Setup connection state machine to be in connected state
+        when(mHeadsetClientService.getConnectionPolicy(any(BluetoothDevice.class))).thenReturn(
+                BluetoothProfile.CONNECTION_POLICY_ALLOWED);
+        int expectedBroadcastIndex = 1;
+
+        expectedBroadcastIndex = setUpHfpClientConnection(expectedBroadcastIndex);
+        expectedBroadcastIndex = setUpServiceLevelConnection(expectedBroadcastIndex);
+
+        BluetoothSinkAudioPolicy dummyAudioPolicy = new BluetoothSinkAudioPolicy.Builder().build();
+        mHeadsetClientStateMachine.setAudioPolicy(dummyAudioPolicy);
+        verify(mNativeInterface, never()).sendAndroidAt(mTestDevice, "+ANDROID:1,0,0,0");
+    }
+
+    @SmallTest
+    @Test
+    public void testSetGetCallAudioPolicy() {
+        // Return true for priority.
+        when(mHeadsetClientService.getConnectionPolicy(any(BluetoothDevice.class))).thenReturn(
+                BluetoothProfile.CONNECTION_POLICY_ALLOWED);
+
+        int expectedBroadcastIndex = 1;
+
+        expectedBroadcastIndex = setUpHfpClientConnection(expectedBroadcastIndex);
+        expectedBroadcastIndex = setUpServiceLevelConnection(expectedBroadcastIndex, true);
+
+        BluetoothSinkAudioPolicy dummyAudioPolicy = new BluetoothSinkAudioPolicy.Builder()
+                .setCallEstablishPolicy(BluetoothSinkAudioPolicy.POLICY_ALLOWED)
+                .setActiveDevicePolicyAfterConnection(BluetoothSinkAudioPolicy.POLICY_NOT_ALLOWED)
+                .setInBandRingtonePolicy(BluetoothSinkAudioPolicy.POLICY_ALLOWED)
+                .build();
+
+        mHeadsetClientStateMachine.setAudioPolicy(dummyAudioPolicy);
+        verify(mNativeInterface).sendAndroidAt(mTestDevice, "+ANDROID=1,1,2,1");
+    }
+
+    @Test
+    public void testDumpDoesNotCrash() {
+        mHeadsetClientStateMachine.dump(new StringBuilder());
+    }
+
+    @Test
+    public void testProcessDisconnectMessage_onDisconnectedState() {
+        mHeadsetClientStateMachine.sendMessage(HeadsetClientStateMachine.DISCONNECT);
+        TestUtils.waitForLooperToFinishScheduledTask(mHandlerThread.getLooper());
+        Assert.assertEquals(STATE_DISCONNECTED,
+                mHeadsetClientStateMachine.getConnectionState(mTestDevice));
+    }
+
+    @Test
+    public void testProcessConnectMessage_onDisconnectedState() {
+        doReturn(true).when(mNativeInterface).connect(any(BluetoothDevice.class));
+        sendMessageAndVerifyTransition(
+                mHeadsetClientStateMachine
+                        .obtainMessage(HeadsetClientStateMachine.CONNECT, mTestDevice),
+                HeadsetClientStateMachine.Connecting.class);
+    }
+
+    @Test
+    public void testStackEvent_toConnectingState_onDisconnectedState() {
+        allowConnection(true);
+        StackEvent event = new StackEvent(StackEvent.EVENT_TYPE_CONNECTION_STATE_CHANGED);
+        event.valueInt = HeadsetClientHalConstants.CONNECTION_STATE_CONNECTED;
+        event.device = mTestDevice;
+        sendMessageAndVerifyTransition(
+                mHeadsetClientStateMachine.obtainMessage(StackEvent.STACK_EVENT, event),
+                HeadsetClientStateMachine.Connecting.class);
+    }
+
+    @Test
+    public void testStackEvent_toConnectingState_disallowConnection_onDisconnectedState() {
+        allowConnection(false);
+        StackEvent event = new StackEvent(StackEvent.EVENT_TYPE_CONNECTION_STATE_CHANGED);
+        event.valueInt = HeadsetClientHalConstants.CONNECTION_STATE_CONNECTED;
+        event.device = mTestDevice;
+        sendMessageAndVerifyTransition(
+                mHeadsetClientStateMachine.obtainMessage(StackEvent.STACK_EVENT, event),
+                HeadsetClientStateMachine.Disconnected.class);
+    }
+
+    @Test
+    public void testProcessConnectMessage_onConnectingState() {
+        initToConnectingState();
+        mHeadsetClientStateMachine.sendMessage(HeadsetClientStateMachine.CONNECT);
+        TestUtils.waitForLooperToFinishScheduledTask(mHandlerThread.getLooper());
+        Assert.assertTrue(mHeadsetClientStateMachine.doesSuperHaveDeferredMessages(
+                HeadsetClientStateMachine.CONNECT));
+    }
+
+    @Test
+    public void testProcessStackEvent_ConnectionStateChanged_Disconnected_onConnectingState() {
+        initToConnectingState();
+        StackEvent event = new StackEvent(StackEvent.EVENT_TYPE_CONNECTION_STATE_CHANGED);
+        event.valueInt = HeadsetClientHalConstants.CONNECTION_STATE_DISCONNECTED;
+        event.device = mTestDevice;
+        sendMessageAndVerifyTransition(
+                mHeadsetClientStateMachine.obtainMessage(StackEvent.STACK_EVENT, event),
+                HeadsetClientStateMachine.Disconnected.class);
+        verify(mHeadsetService).updateInbandRinging(eq(mTestDevice), eq(false));
+    }
+
+    @Test
+    public void testProcessStackEvent_ConnectionStateChanged_Connected_onConnectingState() {
+        initToConnectingState();
+        StackEvent event = new StackEvent(StackEvent.EVENT_TYPE_CONNECTION_STATE_CHANGED);
+        event.valueInt = HeadsetClientHalConstants.CONNECTION_STATE_CONNECTED;
+        event.device = mTestDevice;
+        mHeadsetClientStateMachine.sendMessage(
+                mHeadsetClientStateMachine.obtainMessage(StackEvent.STACK_EVENT, event));
+        Assert.assertThat(mHeadsetClientStateMachine.getCurrentState(),
+                IsInstanceOf.instanceOf(HeadsetClientStateMachine.Connecting.class));
+    }
+
+    @Test
+    public void testProcessStackEvent_ConnectionStateChanged_Connecting_onConnectingState() {
+        initToConnectingState();
+        StackEvent event = new StackEvent(StackEvent.EVENT_TYPE_CONNECTION_STATE_CHANGED);
+        event.valueInt = HeadsetClientHalConstants.CONNECTION_STATE_CONNECTING;
+        event.device = mTestDevice;
+        mHeadsetClientStateMachine.sendMessage(
+                mHeadsetClientStateMachine.obtainMessage(StackEvent.STACK_EVENT, event));
+        Assert.assertThat(mHeadsetClientStateMachine.getCurrentState(),
+                IsInstanceOf.instanceOf(HeadsetClientStateMachine.Connecting.class));
+    }
+
+    @Test
+    public void testProcessStackEvent_Call_onConnectingState() {
+        initToConnectingState();
+        StackEvent event = new StackEvent(StackEvent.EVENT_TYPE_CALL);
+        event.valueInt = StackEvent.EVENT_TYPE_CALL;
+        event.device = mTestDevice;
+        mHeadsetClientStateMachine.sendMessage(
+                mHeadsetClientStateMachine.obtainMessage(StackEvent.STACK_EVENT, event));
+        TestUtils.waitForLooperToFinishScheduledTask(mHandlerThread.getLooper());
+        Assert.assertTrue(mHeadsetClientStateMachine.doesSuperHaveDeferredMessages(
+                StackEvent.STACK_EVENT));
+    }
+
+    @Test
+    public void testProcessStackEvent_CmdResultWithEmptyQueuedActions_onConnectingState() {
+        initToConnectingState();
+        StackEvent event = new StackEvent(StackEvent.EVENT_TYPE_CMD_RESULT);
+        event.valueInt = StackEvent.CMD_RESULT_TYPE_OK;
+        event.device = mTestDevice;
+        mHeadsetClientStateMachine.sendMessage(
+                mHeadsetClientStateMachine.obtainMessage(StackEvent.STACK_EVENT, event));
+        Assert.assertThat(mHeadsetClientStateMachine.getCurrentState(),
+                IsInstanceOf.instanceOf(HeadsetClientStateMachine.Connecting.class));
+    }
+
+    @Test
+    public void testProcessStackEvent_Unknown_onConnectingState() {
+        String atCommand = "+ANDROID: 1";
+
+        initToConnectingState();
+        StackEvent event = new StackEvent(StackEvent.EVENT_TYPE_UNKNOWN_EVENT);
+        event.valueString = atCommand;
+        event.device = mTestDevice;
+        mHeadsetClientStateMachine.sendMessage(
+                mHeadsetClientStateMachine.obtainMessage(StackEvent.STACK_EVENT, event));
+        TestUtils.waitForLooperToFinishScheduledTask(mHandlerThread.getLooper());
+        Assert.assertThat(mHeadsetClientStateMachine.getCurrentState(),
+                IsInstanceOf.instanceOf(HeadsetClientStateMachine.Connected.class));
+        verify(mHeadsetService).updateInbandRinging(eq(mTestDevice), eq(true));
+    }
+
+    @Test
+    public void testProcessConnectTimeoutMessage_onConnectingState() {
+        initToConnectingState();
+        Message msg = mHeadsetClientStateMachine
+                .obtainMessage(HeadsetClientStateMachine.CONNECTING_TIMEOUT);
+        sendMessageAndVerifyTransition(msg, HeadsetClientStateMachine.Disconnected.class);
+        verify(mHeadsetService).updateInbandRinging(eq(mTestDevice), eq(false));
+    }
+
+    @Test
+    public void testProcessConnectMessage_onConnectedState() {
+        initToConnectedState();
+        mHeadsetClientStateMachine.sendMessage(HeadsetClientStateMachine.CONNECT);
+        TestUtils.waitForLooperToFinishScheduledTask(mHandlerThread.getLooper());
+        Assert.assertThat(mHeadsetClientStateMachine.getCurrentState(),
+                IsInstanceOf.instanceOf(HeadsetClientStateMachine.Connected.class));
+    }
+
+    @Test
+    public void testProcessDisconnectMessage_onConnectedState() {
+        initToConnectedState();
+        mHeadsetClientStateMachine.sendMessage(HeadsetClientStateMachine.DISCONNECT, mTestDevice);
+        TestUtils.waitForLooperToFinishScheduledTask(mHandlerThread.getLooper());
+        verify(mNativeInterface).disconnect(any(BluetoothDevice.class));
+    }
+
+    @Test
+    public void testProcessConnectAudioMessage_onConnectedState() {
+        initToConnectedState();
+        mHeadsetClientStateMachine.sendMessage(HeadsetClientStateMachine.CONNECT_AUDIO);
+        TestUtils.waitForLooperToFinishScheduledTask(mHandlerThread.getLooper());
+        verify(mNativeInterface).connectAudio(any(BluetoothDevice.class));
+    }
+
+    @Test
+    public void testProcessDisconnectAudioMessage_onConnectedState() {
+        initToConnectedState();
+        mHeadsetClientStateMachine.sendMessage(HeadsetClientStateMachine.DISCONNECT_AUDIO);
+        TestUtils.waitForLooperToFinishScheduledTask(mHandlerThread.getLooper());
+        verify(mNativeInterface).disconnectAudio(any(BluetoothDevice.class));
+    }
+
+    @Test
+    public void testProcessVoiceRecognitionStartMessage_onConnectedState() {
+        initToConnectedState();
+        mHeadsetClientStateMachine.sendMessage(HeadsetClientStateMachine.VOICE_RECOGNITION_START);
+        TestUtils.waitForLooperToFinishScheduledTask(mHandlerThread.getLooper());
+        verify(mNativeInterface).startVoiceRecognition(any(BluetoothDevice.class));
+    }
+
+    @Test
+    public void testProcessDisconnectMessage_onAudioOnState() {
+        initToAudioOnState();
+        mHeadsetClientStateMachine.sendMessage(HeadsetClientStateMachine.DISCONNECT, mTestDevice);
+        TestUtils.waitForLooperToFinishScheduledTask(mHandlerThread.getLooper());
+        Assert.assertTrue(mHeadsetClientStateMachine.doesSuperHaveDeferredMessages(
+                HeadsetClientStateMachine.DISCONNECT));
+    }
+
+    @Test
+    public void testProcessDisconnectAudioMessage_onAudioOnState() {
+        initToAudioOnState();
+        mHeadsetClientStateMachine.sendMessage(HeadsetClientStateMachine.DISCONNECT_AUDIO,
+                mTestDevice);
+        TestUtils.waitForLooperToFinishScheduledTask(mHandlerThread.getLooper());
+        verify(mNativeInterface).disconnectAudio(any(BluetoothDevice.class));
+    }
+
+    @Test
+    public void testProcessHoldCall_onAudioOnState() {
+        initToAudioOnState();
+        HfpClientCall call = new HfpClientCall(mTestDevice, 0, HfpClientCall.CALL_STATE_ACTIVE,
+                "1", true, false, false);
+        mHeadsetClientStateMachine.mCalls.put(0, call);
+        int[] states = new int[1];
+        states[0] = HfpClientCall.CALL_STATE_ACTIVE;
+        mHeadsetClientStateMachine.sendMessage(HeadsetClientStateMachine.HOLD_CALL,
+                mTestDevice);
+        TestUtils.waitForLooperToFinishScheduledTask(mHandlerThread.getLooper());
+        verify(mNativeInterface).handleCallAction(any(BluetoothDevice.class), anyInt(), eq(0));
+    }
+
+    @Test
+    public void testProcessStackEvent_ConnectionStateChanged_onAudioOnState() {
+        initToAudioOnState();
+        Assert.assertThat(mHeadsetClientStateMachine.getCurrentState(),
+                IsInstanceOf.instanceOf(HeadsetClientStateMachine.AudioOn.class));
+        StackEvent event = new StackEvent(StackEvent.EVENT_TYPE_CONNECTION_STATE_CHANGED);
+        event.valueInt = HeadsetClientHalConstants.CONNECTION_STATE_DISCONNECTED;
+        event.device = mTestDevice;
+        mHeadsetClientStateMachine.sendMessage(
+                mHeadsetClientStateMachine.obtainMessage(StackEvent.STACK_EVENT, event));
+        TestUtils.waitForLooperToFinishScheduledTask(mHandlerThread.getLooper());
+        Assert.assertThat(mHeadsetClientStateMachine.getCurrentState(),
+                IsInstanceOf.instanceOf(HeadsetClientStateMachine.Disconnected.class));
+        verify(mHeadsetService).updateInbandRinging(eq(mTestDevice), eq(false));
+    }
+
+    @Test
+    public void testProcessStackEvent_AudioStateChanged_onAudioOnState() {
+        initToAudioOnState();
+        Assert.assertThat(mHeadsetClientStateMachine.getCurrentState(),
+                IsInstanceOf.instanceOf(HeadsetClientStateMachine.AudioOn.class));
+        StackEvent event = new StackEvent(StackEvent.EVENT_TYPE_AUDIO_STATE_CHANGED);
+        event.valueInt = HeadsetClientHalConstants.AUDIO_STATE_DISCONNECTED;
+        event.device = mTestDevice;
+        mHeadsetClientStateMachine.sendMessage(
+                mHeadsetClientStateMachine.obtainMessage(StackEvent.STACK_EVENT, event));
+        TestUtils.waitForLooperToFinishScheduledTask(mHandlerThread.getLooper());
+        Assert.assertThat(mHeadsetClientStateMachine.getCurrentState(),
+                IsInstanceOf.instanceOf(HeadsetClientStateMachine.Connected.class));
+    }
+
+    /**
+     * Allow/disallow connection to any device
+     *
+     * @param allow if true, connection is allowed
+     */
+    private void allowConnection(boolean allow) {
+        mHeadsetClientStateMachine.allowConnect = allow;
+    }
+
+    private void initToConnectingState() {
+        doReturn(true).when(mNativeInterface).connect(any(BluetoothDevice.class));
+        sendMessageAndVerifyTransition(
+                mHeadsetClientStateMachine
+                        .obtainMessage(HeadsetClientStateMachine.CONNECT, mTestDevice),
+                HeadsetClientStateMachine.Connecting.class);
+    }
+
+    private void initToConnectedState() {
+        String atCommand = "+ANDROID: 1";
+        initToConnectingState();
+        StackEvent event = new StackEvent(StackEvent.EVENT_TYPE_UNKNOWN_EVENT);
+        event.valueString = atCommand;
+        event.device = mTestDevice;
+        mHeadsetClientStateMachine.sendMessage(
+                mHeadsetClientStateMachine.obtainMessage(StackEvent.STACK_EVENT, event));
+        TestUtils.waitForLooperToFinishScheduledTask(mHandlerThread.getLooper());
+        Assert.assertThat(mHeadsetClientStateMachine.getCurrentState(),
+                IsInstanceOf.instanceOf(HeadsetClientStateMachine.Connected.class));
+        verify(mHeadsetService).updateInbandRinging(eq(mTestDevice), eq(true));
+    }
+
+    private void initToAudioOnState() {
+        mHeadsetClientStateMachine.setAudioRouteAllowed(true);
+        initToConnectedState();
+        StackEvent event = new StackEvent(StackEvent.EVENT_TYPE_AUDIO_STATE_CHANGED);
+        event.valueInt = HeadsetClientHalConstants.AUDIO_STATE_CONNECTED;
+        event.device = mTestDevice;
+        mHeadsetClientStateMachine.sendMessage(
+                mHeadsetClientStateMachine.obtainMessage(StackEvent.STACK_EVENT, event));
+        TestUtils.waitForLooperToFinishScheduledTask(mHandlerThread.getLooper());
+        Assert.assertThat(mHeadsetClientStateMachine.getCurrentState(),
+                IsInstanceOf.instanceOf(HeadsetClientStateMachine.AudioOn.class));
+    }
+
+    private <T> void sendMessageAndVerifyTransition(Message msg, Class<T> type) {
+        Mockito.clearInvocations(mHeadsetClientService);
+        mHeadsetClientStateMachine.sendMessage(msg);
+        // Verify that one connection state broadcast is executed
+        verify(mHeadsetClientService, timeout(TIMEOUT_MS)).sendBroadcastMultiplePermissions(
+                any(Intent.class), any(String[].class), any(BroadcastOptions.class)
+        );
+        Assert.assertThat(mHeadsetClientStateMachine.getCurrentState(),
+                IsInstanceOf.instanceOf(type));
+    }
+
+    public static class TestHeadsetClientStateMachine extends HeadsetClientStateMachine {
+
+        Boolean allowConnect = null;
+
+        TestHeadsetClientStateMachine(HeadsetClientService context, HeadsetService headsetService,
+                Looper looper, NativeInterface nativeInterface) {
+            super(context, headsetService, looper, nativeInterface);
+        }
+
+        public boolean doesSuperHaveDeferredMessages(int what) {
+            return super.hasDeferredMessages(what);
+        }
+
+        @Override
+        public boolean okToConnect(BluetoothDevice device) {
+            return allowConnect != null ? allowConnect : super.okToConnect(device);
+        }
+    }
 }
diff --git a/android/app/tests/unit/src/com/android/bluetooth/hfpclient/HfpNativeInterfaceTest.java b/android/app/tests/unit/src/com/android/bluetooth/hfpclient/HfpNativeInterfaceTest.java
new file mode 100644
index 0000000..771e476
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/hfpclient/HfpNativeInterfaceTest.java
@@ -0,0 +1,311 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.hfpclient;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import com.android.bluetooth.TestUtils;
+import com.android.bluetooth.btservice.AdapterService;
+
+import org.junit.After;
+import org.junit.Before;
+import org.junit.Test;
+import org.mockito.ArgumentCaptor;
+import org.mockito.Mock;
+import org.mockito.MockitoAnnotations;
+
+public class HfpNativeInterfaceTest {
+    private static final byte[] TEST_DEVICE_ADDRESS =
+            new byte[] { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
+    @Mock
+    HeadsetClientService mService;
+    @Mock
+    AdapterService mAdapterService;
+
+    private NativeInterface mNativeInterface;
+
+    @Before
+    public void setUp() throws Exception {
+        MockitoAnnotations.initMocks(this);
+        when(mService.isAvailable()).thenReturn(true);
+        HeadsetClientService.setHeadsetClientService(mService);
+        TestUtils.setAdapterService(mAdapterService);
+        mNativeInterface = NativeInterface.getInstance();
+    }
+
+    @After
+    public void tearDown() throws Exception {
+        HeadsetClientService.setHeadsetClientService(null);
+        TestUtils.clearAdapterService(mAdapterService);
+    }
+
+    @Test
+    public void onConnectionStateChanged() {
+        int state = HeadsetClientHalConstants.CONNECTION_STATE_CONNECTED;
+        int peerFeat = HeadsetClientHalConstants.PEER_FEAT_HF_IND;
+        int chldFeat = HeadsetClientHalConstants.PEER_FEAT_ECS;
+        mNativeInterface.onConnectionStateChanged(state, peerFeat, chldFeat, TEST_DEVICE_ADDRESS);
+
+        ArgumentCaptor<StackEvent> event = ArgumentCaptor.forClass(StackEvent.class);
+        verify(mService).messageFromNative(event.capture());
+        assertThat(event.getValue().type).isEqualTo(StackEvent.EVENT_TYPE_CONNECTION_STATE_CHANGED);
+        assertThat(event.getValue().valueInt).isEqualTo(state);
+        assertThat(event.getValue().valueInt2).isEqualTo(peerFeat);
+        assertThat(event.getValue().valueInt3).isEqualTo(chldFeat);
+    }
+
+    @Test
+    public void onAudioStateChanged() {
+        int state = HeadsetClientHalConstants.AUDIO_STATE_DISCONNECTED;
+        mNativeInterface.onAudioStateChanged(state, TEST_DEVICE_ADDRESS);
+
+        ArgumentCaptor<StackEvent> event = ArgumentCaptor.forClass(StackEvent.class);
+        verify(mService).messageFromNative(event.capture());
+        assertThat(event.getValue().type).isEqualTo(StackEvent.EVENT_TYPE_AUDIO_STATE_CHANGED);
+        assertThat(event.getValue().valueInt).isEqualTo(state);
+    }
+
+    @Test
+    public void onVrStateChanged() {
+        int state = 1;
+        mNativeInterface.onVrStateChanged(state, TEST_DEVICE_ADDRESS);
+
+        ArgumentCaptor<StackEvent> event = ArgumentCaptor.forClass(StackEvent.class);
+        verify(mService).messageFromNative(event.capture());
+        assertThat(event.getValue().type).isEqualTo(StackEvent.EVENT_TYPE_VR_STATE_CHANGED);
+        assertThat(event.getValue().valueInt).isEqualTo(state);
+    }
+
+    @Test
+    public void onNetworkState() {
+        int state = HeadsetClientHalConstants.NETWORK_STATE_NOT_AVAILABLE;
+        mNativeInterface.onNetworkState(state, TEST_DEVICE_ADDRESS);
+
+        ArgumentCaptor<StackEvent> event = ArgumentCaptor.forClass(StackEvent.class);
+        verify(mService).messageFromNative(event.capture());
+        assertThat(event.getValue().type).isEqualTo(StackEvent.EVENT_TYPE_NETWORK_STATE);
+        assertThat(event.getValue().valueInt).isEqualTo(state);
+    }
+
+    @Test
+    public void onNetworkRoaming() {
+        int state = HeadsetClientHalConstants.SERVICE_TYPE_ROAMING;
+        mNativeInterface.onNetworkRoaming(state, TEST_DEVICE_ADDRESS);
+
+        ArgumentCaptor<StackEvent> event = ArgumentCaptor.forClass(StackEvent.class);
+        verify(mService).messageFromNative(event.capture());
+        assertThat(event.getValue().type).isEqualTo(StackEvent.EVENT_TYPE_ROAMING_STATE);
+        assertThat(event.getValue().valueInt).isEqualTo(state);
+    }
+
+    @Test
+    public void onNetworkSignal() {
+        int signal = 3;
+        mNativeInterface.onNetworkSignal(signal, TEST_DEVICE_ADDRESS);
+
+        ArgumentCaptor<StackEvent> event = ArgumentCaptor.forClass(StackEvent.class);
+        verify(mService).messageFromNative(event.capture());
+        assertThat(event.getValue().type).isEqualTo(StackEvent.EVENT_TYPE_NETWORK_SIGNAL);
+        assertThat(event.getValue().valueInt).isEqualTo(signal);
+    }
+
+    @Test
+    public void onBatteryLevel() {
+        int level = 15;
+        mNativeInterface.onBatteryLevel(level, TEST_DEVICE_ADDRESS);
+
+        ArgumentCaptor<StackEvent> event = ArgumentCaptor.forClass(StackEvent.class);
+        verify(mService).messageFromNative(event.capture());
+        assertThat(event.getValue().type).isEqualTo(StackEvent.EVENT_TYPE_BATTERY_LEVEL);
+        assertThat(event.getValue().valueInt).isEqualTo(level);
+    }
+
+    @Test
+    public void onCurrentOperator() {
+        String name = "test";
+        mNativeInterface.onCurrentOperator(name, TEST_DEVICE_ADDRESS);
+
+        ArgumentCaptor<StackEvent> event = ArgumentCaptor.forClass(StackEvent.class);
+        verify(mService).messageFromNative(event.capture());
+        assertThat(event.getValue().type).isEqualTo(StackEvent.EVENT_TYPE_OPERATOR_NAME);
+        assertThat(event.getValue().valueString).isEqualTo(name);
+    }
+
+    @Test
+    public void onCall() {
+        int call = 1;
+        mNativeInterface.onCall(call, TEST_DEVICE_ADDRESS);
+
+        ArgumentCaptor<StackEvent> event = ArgumentCaptor.forClass(StackEvent.class);
+        verify(mService).messageFromNative(event.capture());
+        assertThat(event.getValue().type).isEqualTo(StackEvent.EVENT_TYPE_CALL);
+        assertThat(event.getValue().valueInt).isEqualTo(call);
+    }
+
+    @Test
+    public void onCallSetup() {
+        int callsetup = 1;
+        mNativeInterface.onCallSetup(callsetup, TEST_DEVICE_ADDRESS);
+
+        ArgumentCaptor<StackEvent> event = ArgumentCaptor.forClass(StackEvent.class);
+        verify(mService).messageFromNative(event.capture());
+        assertThat(event.getValue().type).isEqualTo(StackEvent.EVENT_TYPE_CALLSETUP);
+        assertThat(event.getValue().valueInt).isEqualTo(callsetup);
+    }
+
+    @Test
+    public void onCallHeld() {
+        int callheld = 1;
+        mNativeInterface.onCallSetup(callheld, TEST_DEVICE_ADDRESS);
+
+        ArgumentCaptor<StackEvent> event = ArgumentCaptor.forClass(StackEvent.class);
+        verify(mService).messageFromNative(event.capture());
+        assertThat(event.getValue().type).isEqualTo(StackEvent.EVENT_TYPE_CALLSETUP);
+        assertThat(event.getValue().valueInt).isEqualTo(callheld);
+    }
+
+    @Test
+    public void onRespAndHold() {
+        int respAndHold = 1;
+        mNativeInterface.onRespAndHold(respAndHold, TEST_DEVICE_ADDRESS);
+
+        ArgumentCaptor<StackEvent> event = ArgumentCaptor.forClass(StackEvent.class);
+        verify(mService).messageFromNative(event.capture());
+        assertThat(event.getValue().type).isEqualTo(StackEvent.EVENT_TYPE_RESP_AND_HOLD);
+        assertThat(event.getValue().valueInt).isEqualTo(respAndHold);
+    }
+
+    @Test
+    public void onClip() {
+        String number = "000-000-0000";
+        mNativeInterface.onClip(number, TEST_DEVICE_ADDRESS);
+
+        ArgumentCaptor<StackEvent> event = ArgumentCaptor.forClass(StackEvent.class);
+        verify(mService).messageFromNative(event.capture());
+        assertThat(event.getValue().type).isEqualTo(StackEvent.EVENT_TYPE_CLIP);
+        assertThat(event.getValue().valueString).isEqualTo(number);
+    }
+
+    @Test
+    public void onCallWaiting() {
+        String number = "000-000-0000";
+        mNativeInterface.onCallWaiting(number, TEST_DEVICE_ADDRESS);
+
+        ArgumentCaptor<StackEvent> event = ArgumentCaptor.forClass(StackEvent.class);
+        verify(mService).messageFromNative(event.capture());
+        assertThat(event.getValue().type).isEqualTo(StackEvent.EVENT_TYPE_CALL_WAITING);
+        assertThat(event.getValue().valueString).isEqualTo(number);
+    }
+
+    @Test
+    public void onCurrentCalls() {
+        int index = 2;
+        int dir = HeadsetClientHalConstants.CALL_DIRECTION_OUTGOING;
+        int state = HfpClientCall.CALL_STATE_WAITING;
+        int mparty = HeadsetClientHalConstants.CALL_MPTY_TYPE_MULTI;
+        String number = "000-000-0000";
+        mNativeInterface.onCurrentCalls(index, dir, state, mparty, number, TEST_DEVICE_ADDRESS);
+
+        ArgumentCaptor<StackEvent> event = ArgumentCaptor.forClass(StackEvent.class);
+        verify(mService).messageFromNative(event.capture());
+        assertThat(event.getValue().type).isEqualTo(StackEvent.EVENT_TYPE_CURRENT_CALLS);
+        assertThat(event.getValue().valueInt).isEqualTo(index);
+        assertThat(event.getValue().valueInt2).isEqualTo(dir);
+        assertThat(event.getValue().valueInt3).isEqualTo(state);
+        assertThat(event.getValue().valueInt4).isEqualTo(mparty);
+        assertThat(event.getValue().valueString).isEqualTo(number);
+    }
+
+    @Test
+    public void onVolumeChange() {
+        int type = HeadsetClientHalConstants.VOLUME_TYPE_SPK;
+        int volume = 10;
+        mNativeInterface.onVolumeChange(type, volume, TEST_DEVICE_ADDRESS);
+
+        ArgumentCaptor<StackEvent> event = ArgumentCaptor.forClass(StackEvent.class);
+        verify(mService).messageFromNative(event.capture());
+        assertThat(event.getValue().type).isEqualTo(StackEvent.EVENT_TYPE_VOLUME_CHANGED);
+        assertThat(event.getValue().valueInt).isEqualTo(type);
+        assertThat(event.getValue().valueInt2).isEqualTo(volume);
+    }
+
+    @Test
+    public void onCmdResult() {
+        int type = HeadsetClientStateMachine.AT_OK;
+        int cme = 10;
+        mNativeInterface.onCmdResult(type, cme, TEST_DEVICE_ADDRESS);
+
+        ArgumentCaptor<StackEvent> event = ArgumentCaptor.forClass(StackEvent.class);
+        verify(mService).messageFromNative(event.capture());
+        assertThat(event.getValue().type).isEqualTo(StackEvent.EVENT_TYPE_CMD_RESULT);
+        assertThat(event.getValue().valueInt).isEqualTo(type);
+        assertThat(event.getValue().valueInt2).isEqualTo(cme);
+    }
+
+    @Test
+    public void onSubscriberInfo() {
+        String number = "000-000-0000";
+        int type = 5;
+        mNativeInterface.onSubscriberInfo(number, type, TEST_DEVICE_ADDRESS);
+
+        ArgumentCaptor<StackEvent> event = ArgumentCaptor.forClass(StackEvent.class);
+        verify(mService).messageFromNative(event.capture());
+        assertThat(event.getValue().type).isEqualTo(StackEvent.EVENT_TYPE_SUBSCRIBER_INFO);
+        assertThat(event.getValue().valueString).isEqualTo(number);
+    }
+
+    @Test
+    public void onInBandRing() {
+        int inBand = 1;
+        mNativeInterface.onInBandRing(inBand, TEST_DEVICE_ADDRESS);
+
+        ArgumentCaptor<StackEvent> event = ArgumentCaptor.forClass(StackEvent.class);
+        verify(mService).messageFromNative(event.capture());
+        assertThat(event.getValue().type).isEqualTo(StackEvent.EVENT_TYPE_IN_BAND_RINGTONE);
+        assertThat(event.getValue().valueInt).isEqualTo(inBand);
+    }
+
+    @Test
+    // onLastVoiceTagNumber is not supported.
+    public void onLastVoiceTagNumber_doesNotCrash() {
+        String number = "000-000-0000";
+        mNativeInterface.onLastVoiceTagNumber(number, TEST_DEVICE_ADDRESS);
+    }
+
+    @Test
+    public void onRingIndication() {
+        mNativeInterface.onRingIndication(TEST_DEVICE_ADDRESS);
+
+        ArgumentCaptor<StackEvent> event = ArgumentCaptor.forClass(StackEvent.class);
+        verify(mService).messageFromNative(event.capture());
+        assertThat(event.getValue().type).isEqualTo(StackEvent.EVENT_TYPE_RING_INDICATION);
+    }
+
+    @Test
+    public void onUnknownEvent() {
+        String eventString = "unknown";
+        mNativeInterface.onUnknownEvent(eventString, TEST_DEVICE_ADDRESS);
+
+        ArgumentCaptor<StackEvent> event = ArgumentCaptor.forClass(StackEvent.class);
+        verify(mService).messageFromNative(event.capture());
+        assertThat(event.getValue().type).isEqualTo(StackEvent.EVENT_TYPE_UNKNOWN_EVENT);
+        assertThat(event.getValue().valueString).isEqualTo(eventString);
+    }
+}
diff --git a/android/app/tests/unit/src/com/android/bluetooth/hfpclient/StackEventTest.java b/android/app/tests/unit/src/com/android/bluetooth/hfpclient/StackEventTest.java
new file mode 100644
index 0000000..ec15c6e
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/hfpclient/StackEventTest.java
@@ -0,0 +1,91 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.hfpclient;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import androidx.test.filters.SmallTest;
+import androidx.test.runner.AndroidJUnit4;
+
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+@SmallTest
+@RunWith(AndroidJUnit4.class)
+public class StackEventTest {
+
+    @Test
+    public void toString_returnsInfo() {
+        int type = StackEvent.EVENT_TYPE_RING_INDICATION;
+
+        StackEvent event = new StackEvent(type);
+        String expectedString = "StackEvent {type:" + StackEvent.eventTypeToString(type)
+                + ", value1:" + event.valueInt + ", value2:" + event.valueInt2 + ", value3:"
+                + event.valueInt3 + ", value4:" + event.valueInt4 + ", string: \""
+                + event.valueString + "\"" + ", device:" + event.device + "}";
+
+        assertThat(event.toString()).isEqualTo(expectedString);
+    }
+
+    @Test
+    public void eventTypeToString() {
+        int invalidType = 23;
+
+        assertThat(StackEvent.eventTypeToString(StackEvent.EVENT_TYPE_NONE)).isEqualTo(
+                "EVENT_TYPE_NONE");
+        assertThat(StackEvent.eventTypeToString(
+                StackEvent.EVENT_TYPE_CONNECTION_STATE_CHANGED)).isEqualTo(
+                "EVENT_TYPE_CONNECTION_STATE_CHANGED");
+        assertThat(
+                StackEvent.eventTypeToString(StackEvent.EVENT_TYPE_AUDIO_STATE_CHANGED)).isEqualTo(
+                "EVENT_TYPE_AUDIO_STATE_CHANGED");
+        assertThat(StackEvent.eventTypeToString(StackEvent.EVENT_TYPE_NETWORK_STATE)).isEqualTo(
+                "EVENT_TYPE_NETWORK_STATE");
+        assertThat(StackEvent.eventTypeToString(StackEvent.EVENT_TYPE_ROAMING_STATE)).isEqualTo(
+                "EVENT_TYPE_ROAMING_STATE");
+        assertThat(StackEvent.eventTypeToString(StackEvent.EVENT_TYPE_NETWORK_SIGNAL)).isEqualTo(
+                "EVENT_TYPE_NETWORK_SIGNAL");
+        assertThat(StackEvent.eventTypeToString(StackEvent.EVENT_TYPE_BATTERY_LEVEL)).isEqualTo(
+                "EVENT_TYPE_BATTERY_LEVEL");
+        assertThat(StackEvent.eventTypeToString(StackEvent.EVENT_TYPE_OPERATOR_NAME)).isEqualTo(
+                "EVENT_TYPE_OPERATOR_NAME");
+        assertThat(StackEvent.eventTypeToString(StackEvent.EVENT_TYPE_CALL)).isEqualTo(
+                "EVENT_TYPE_CALL");
+        assertThat(StackEvent.eventTypeToString(StackEvent.EVENT_TYPE_CALLSETUP)).isEqualTo(
+                "EVENT_TYPE_CALLSETUP");
+        assertThat(StackEvent.eventTypeToString(StackEvent.EVENT_TYPE_CALLHELD)).isEqualTo(
+                "EVENT_TYPE_CALLHELD");
+        assertThat(StackEvent.eventTypeToString(StackEvent.EVENT_TYPE_CLIP)).isEqualTo(
+                "EVENT_TYPE_CLIP");
+        assertThat(StackEvent.eventTypeToString(StackEvent.EVENT_TYPE_CALL_WAITING)).isEqualTo(
+                "EVENT_TYPE_CALL_WAITING");
+        assertThat(StackEvent.eventTypeToString(StackEvent.EVENT_TYPE_CURRENT_CALLS)).isEqualTo(
+                "EVENT_TYPE_CURRENT_CALLS");
+        assertThat(StackEvent.eventTypeToString(StackEvent.EVENT_TYPE_VOLUME_CHANGED)).isEqualTo(
+                "EVENT_TYPE_VOLUME_CHANGED");
+        assertThat(StackEvent.eventTypeToString(StackEvent.EVENT_TYPE_CMD_RESULT)).isEqualTo(
+                "EVENT_TYPE_CMD_RESULT");
+        assertThat(StackEvent.eventTypeToString(StackEvent.EVENT_TYPE_SUBSCRIBER_INFO)).isEqualTo(
+                "EVENT_TYPE_SUBSCRIBER_INFO");
+        assertThat(StackEvent.eventTypeToString(StackEvent.EVENT_TYPE_RESP_AND_HOLD)).isEqualTo(
+                "EVENT_TYPE_RESP_AND_HOLD");
+        assertThat(StackEvent.eventTypeToString(StackEvent.EVENT_TYPE_RING_INDICATION)).isEqualTo(
+                "EVENT_TYPE_RING_INDICATION");
+        assertThat(StackEvent.eventTypeToString(invalidType)).isEqualTo(
+                "EVENT_TYPE_UNKNOWN:" + invalidType);
+    }
+}
diff --git a/android/app/tests/unit/src/com/android/bluetooth/hfpclient/VendorCommandResponseProcessorTest.java b/android/app/tests/unit/src/com/android/bluetooth/hfpclient/VendorCommandResponseProcessorTest.java
new file mode 100644
index 0000000..c866a68
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/hfpclient/VendorCommandResponseProcessorTest.java
@@ -0,0 +1,150 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.hfpclient;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import static org.mockito.Mockito.doReturn;
+import static org.mockito.Mockito.spy;
+
+import android.bluetooth.BluetoothAdapter;
+import android.bluetooth.BluetoothAssignedNumbers;
+import android.bluetooth.BluetoothDevice;
+
+import androidx.test.filters.SmallTest;
+import androidx.test.runner.AndroidJUnit4;
+
+import com.android.bluetooth.TestUtils;
+import com.android.bluetooth.btservice.AdapterService;
+
+import org.junit.After;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.Mock;
+import org.mockito.MockitoAnnotations;
+
+@SmallTest
+@RunWith(AndroidJUnit4.class)
+public class VendorCommandResponseProcessorTest {
+    private static int TEST_VENDOR_ID = BluetoothAssignedNumbers.APPLE;
+
+    private BluetoothAdapter mAdapter;
+    private BluetoothDevice mTestDevice;
+    private NativeInterface mNativeInterface;
+    private VendorCommandResponseProcessor mProcessor;
+
+    @Mock
+    private AdapterService mAdapterService;
+    @Mock
+    private HeadsetClientService mHeadsetClientService;
+
+    @Before
+    public void setUp() throws Exception {
+        MockitoAnnotations.initMocks(this);
+        TestUtils.setAdapterService(mAdapterService);
+        mNativeInterface = spy(NativeInterface.getInstance());
+
+        mAdapter = BluetoothAdapter.getDefaultAdapter();
+        mTestDevice = mAdapter.getRemoteDevice("00:01:02:03:04:05");
+        mProcessor = new VendorCommandResponseProcessor(mHeadsetClientService, mNativeInterface);
+    }
+
+    @After
+    public void tearDown() throws Exception {
+        TestUtils.clearAdapterService(mAdapterService);
+    }
+
+    @Test
+    public void sendCommand_withSemicolon() {
+        String atCommand = "command;";
+
+        assertThat(mProcessor.sendCommand(TEST_VENDOR_ID, atCommand, mTestDevice)).isFalse();
+    }
+
+    @Test
+    public void sendCommand_withNullDevice() {
+        String atCommand = "+XAPL=";
+
+        assertThat(mProcessor.sendCommand(TEST_VENDOR_ID, atCommand, null)).isFalse();
+    }
+
+    @Test
+    public void sendCommand_withInvalidCommand() {
+        String invalidCommand = "invalidCommand";
+
+        assertThat(mProcessor.sendCommand(TEST_VENDOR_ID, invalidCommand, mTestDevice)).isFalse();
+    }
+
+    @Test
+    public void sendCommand_withEqualSign() {
+        String atCommand = "+XAPL=";
+        doReturn(true).when(mNativeInterface).sendATCmd(mTestDevice,
+                HeadsetClientHalConstants.HANDSFREECLIENT_AT_CMD_VENDOR_SPECIFIC_CMD, 0, 0,
+                atCommand);
+
+        assertThat(mProcessor.sendCommand(TEST_VENDOR_ID, atCommand, mTestDevice)).isTrue();
+    }
+
+    @Test
+    public void sendCommand_withQuestionMarkSign() {
+        String atCommand = "+APLSIRI?";
+        doReturn(true).when(mNativeInterface).sendATCmd(mTestDevice,
+                HeadsetClientHalConstants.HANDSFREECLIENT_AT_CMD_VENDOR_SPECIFIC_CMD, 0, 0,
+                atCommand);
+
+        assertThat(mProcessor.sendCommand(TEST_VENDOR_ID, atCommand, mTestDevice)).isTrue();
+    }
+
+    @Test
+    public void sendCommand_failingToSendATCommand() {
+        String atCommand = "+APLSIRI?";
+        doReturn(false).when(mNativeInterface).sendATCmd(mTestDevice,
+                HeadsetClientHalConstants.HANDSFREECLIENT_AT_CMD_VENDOR_SPECIFIC_CMD, 0, 0,
+                atCommand);
+
+        assertThat(mProcessor.sendCommand(TEST_VENDOR_ID, atCommand, mTestDevice)).isFalse();
+    }
+
+    @Test
+    public void processEvent_withNullDevice() {
+        String atString = "+XAPL=";
+
+        assertThat(mProcessor.processEvent(atString, null)).isFalse();
+    }
+
+    @Test
+    public void processEvent_withInvalidString() {
+        String invalidString = "+APLSIRI?";
+
+        assertThat(mProcessor.processEvent(invalidString, mTestDevice)).isFalse();
+    }
+
+    @Test
+    public void processEvent_withEqualSign() {
+        String atString = "+XAPL=";
+
+        assertThat(mProcessor.processEvent(atString, mTestDevice)).isTrue();
+    }
+
+    @Test
+    public void processEvent_withColonSign() {
+        String atString = "+APLSIRI:";
+
+        assertThat(mProcessor.processEvent(atString, mTestDevice)).isTrue();
+    }
+}
\ No newline at end of file
diff --git a/android/app/tests/unit/src/com/android/bluetooth/hfpclient/connserv/HfpClientConnectionServiceTest.java b/android/app/tests/unit/src/com/android/bluetooth/hfpclient/connserv/HfpClientConnectionServiceTest.java
index 0692a68..7bf69c1 100644
--- a/android/app/tests/unit/src/com/android/bluetooth/hfpclient/connserv/HfpClientConnectionServiceTest.java
+++ b/android/app/tests/unit/src/com/android/bluetooth/hfpclient/connserv/HfpClientConnectionServiceTest.java
@@ -89,11 +89,6 @@
 
         Context targetContext = InstrumentationRegistry.getTargetContext();
 
-        // HfpClientConnectionService is only enabled for some form factors, and the tests should
-        // only be run if the service is enabled.
-        assumeTrue(targetContext.getResources()
-                .getBoolean(R.bool.hfp_client_connection_service_enabled));
-
         // Setup a mock TelecomManager so our calls don't start a real instance of this service
         doNothing().when(mMockTelecomManager).addNewIncomingCall(any(), any());
         doNothing().when(mMockTelecomManager).addNewUnknownCall(any(), any());
diff --git a/android/app/tests/unit/src/com/android/bluetooth/hid/BluetoothHidDeviceBinderTest.java b/android/app/tests/unit/src/com/android/bluetooth/hid/BluetoothHidDeviceBinderTest.java
new file mode 100644
index 0000000..2138729
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/hid/BluetoothHidDeviceBinderTest.java
@@ -0,0 +1,179 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.hid;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import static org.mockito.Mockito.any;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import android.bluetooth.BluetoothAdapter;
+import android.bluetooth.BluetoothDevice;
+import android.bluetooth.BluetoothHidDeviceAppQosSettings;
+import android.bluetooth.BluetoothHidDeviceAppSdpSettings;
+import android.bluetooth.BluetoothProfile;
+import android.bluetooth.IBluetoothHidDeviceCallback;
+import android.content.AttributionSource;
+
+import com.android.bluetooth.x.com.android.modules.utils.SynchronousResultReceiver;
+
+import org.junit.Before;
+import org.junit.Test;
+import org.mockito.Mock;
+import org.mockito.MockitoAnnotations;
+
+public class BluetoothHidDeviceBinderTest {
+
+    private static final String TEST_DEVICE_ADDRESS = "00:00:00:00:00:00";
+
+    @Mock
+    private HidDeviceService mService;
+    private AttributionSource mAttributionSource;
+    private BluetoothDevice mTestDevice;
+    private HidDeviceService.BluetoothHidDeviceBinder mBinder;
+
+    @Before
+    public void setUp() throws Exception {
+        MockitoAnnotations.initMocks(this);
+        when(mService.isAvailable()).thenReturn(true);
+        mBinder = new HidDeviceService.BluetoothHidDeviceBinder(mService);
+        mAttributionSource = new AttributionSource.Builder(1).build();
+        mTestDevice = BluetoothAdapter.getDefaultAdapter().getRemoteDevice(TEST_DEVICE_ADDRESS);
+    }
+
+    @Test
+    public void cleanup() {
+        mBinder.cleanup();
+        assertThat(mBinder.getServiceForTesting()).isNull();
+    }
+
+    @Test
+    public void registerApp() {
+        String name = "test-name";
+        String description = "test-description";
+        String provider = "test-provider";
+        byte subclass = 1;
+        byte[] descriptors = new byte[] {10};
+        BluetoothHidDeviceAppSdpSettings sdp = new BluetoothHidDeviceAppSdpSettings(
+                name, description, provider, subclass, descriptors);
+
+        int tokenRate = 800;
+        int tokenBucketSize = 9;
+        int peakBandwidth = 10;
+        int latency = 11250;
+        int delayVariation = BluetoothHidDeviceAppQosSettings.MAX;
+        BluetoothHidDeviceAppQosSettings inQos = new BluetoothHidDeviceAppQosSettings(
+                BluetoothHidDeviceAppQosSettings.SERVICE_BEST_EFFORT, tokenRate,
+                tokenBucketSize, peakBandwidth, latency, delayVariation);
+        BluetoothHidDeviceAppQosSettings outQos = new BluetoothHidDeviceAppQosSettings(
+                BluetoothHidDeviceAppQosSettings.SERVICE_BEST_EFFORT, tokenRate,
+                tokenBucketSize, peakBandwidth, latency, delayVariation);
+        IBluetoothHidDeviceCallback cb = mock(IBluetoothHidDeviceCallback.class);
+
+        mBinder.registerApp(sdp, inQos, outQos, cb, mAttributionSource,
+                SynchronousResultReceiver.get());
+        verify(mService).registerApp(sdp, inQos, outQos, cb);
+    }
+
+    @Test
+    public void unregisterApp() {
+        mBinder.unregisterApp(mAttributionSource, SynchronousResultReceiver.get());
+        verify(mService).unregisterApp();
+    }
+
+    @Test
+    public void sendReport() {
+        int id = 100;
+        byte[] data = new byte[] { 0x00,  0x01 };
+        mBinder.sendReport(mTestDevice, id, data, mAttributionSource,
+                SynchronousResultReceiver.get());
+        verify(mService).sendReport(mTestDevice, id, data);
+    }
+
+    @Test
+    public void replyReport() {
+        byte type = 0;
+        byte id = 100;
+        byte[] data = new byte[] { 0x00,  0x01 };
+        mBinder.replyReport(mTestDevice, type, id, data, mAttributionSource,
+                SynchronousResultReceiver.get());
+        verify(mService).replyReport(mTestDevice, type, id, data);
+    }
+
+    @Test
+    public void unplug() {
+        mBinder.unplug(mTestDevice, mAttributionSource, SynchronousResultReceiver.get());
+        verify(mService).unplug(mTestDevice);
+    }
+
+    @Test
+    public void connect() {
+        mBinder.connect(mTestDevice, mAttributionSource, SynchronousResultReceiver.get());
+        verify(mService).connect(mTestDevice);
+    }
+
+    @Test
+    public void disconnect() {
+        mBinder.disconnect(mTestDevice, mAttributionSource, SynchronousResultReceiver.get());
+        verify(mService).disconnect(mTestDevice);
+    }
+
+    @Test
+    public void setConnectionPolicy() {
+        int connectionPolicy = BluetoothProfile.CONNECTION_POLICY_ALLOWED;
+        mBinder.setConnectionPolicy(mTestDevice, connectionPolicy, mAttributionSource,
+                SynchronousResultReceiver.get());
+        verify(mService).setConnectionPolicy(mTestDevice, connectionPolicy);
+    }
+
+    @Test
+    public void reportError() {
+        byte error = -1;
+        mBinder.reportError(mTestDevice, error, mAttributionSource,
+                SynchronousResultReceiver.get());
+        verify(mService).reportError(mTestDevice, error);
+    }
+
+    @Test
+    public void getConnectionState() {
+        mBinder.getConnectionState(mTestDevice, mAttributionSource,
+                SynchronousResultReceiver.get());
+        verify(mService).getConnectionState(mTestDevice);
+    }
+
+    @Test
+    public void getConnectedDevices() {
+        mBinder.getConnectedDevices(mAttributionSource, SynchronousResultReceiver.get());
+        verify(mService).getDevicesMatchingConnectionStates(any(int[].class));
+    }
+
+    @Test
+    public void getDevicesMatchingConnectionStates() {
+        int[] states = new int[] { BluetoothProfile.STATE_CONNECTED };
+        mBinder.getDevicesMatchingConnectionStates(states, mAttributionSource,
+                SynchronousResultReceiver.get());
+        verify(mService).getDevicesMatchingConnectionStates(states);
+    }
+
+    @Test
+    public void getUserAppName() {
+        mBinder.getUserAppName(mAttributionSource, SynchronousResultReceiver.get());
+        verify(mService).getUserAppName();
+    }
+}
diff --git a/android/app/tests/unit/src/com/android/bluetooth/hid/HidDeviceNativeInterfaceTest.java b/android/app/tests/unit/src/com/android/bluetooth/hid/HidDeviceNativeInterfaceTest.java
new file mode 100644
index 0000000..fd70351
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/hid/HidDeviceNativeInterfaceTest.java
@@ -0,0 +1,112 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.hid;
+
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.anyBoolean;
+import static org.mockito.ArgumentMatchers.anyInt;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import android.bluetooth.BluetoothHidDevice;
+
+import com.android.bluetooth.TestUtils;
+import com.android.bluetooth.btservice.AdapterService;
+
+import org.junit.After;
+import org.junit.Before;
+import org.junit.Test;
+import org.mockito.Mock;
+import org.mockito.MockitoAnnotations;
+
+public class HidDeviceNativeInterfaceTest {
+    private static final byte[] TEST_DEVICE_ADDRESS =
+            new byte[] { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
+    @Mock
+    HidDeviceService mService;
+    @Mock
+    AdapterService mAdapterService;
+
+    private HidDeviceNativeInterface mNativeInterface;
+
+    @Before
+    public void setUp() throws Exception {
+        MockitoAnnotations.initMocks(this);
+        when(mService.isAvailable()).thenReturn(true);
+        HidDeviceService.setHidDeviceService(mService);
+        TestUtils.setAdapterService(mAdapterService);
+        mNativeInterface = HidDeviceNativeInterface.getInstance();
+    }
+
+    @After
+    public void tearDown() throws Exception {
+        HidDeviceService.setHidDeviceService(null);
+        TestUtils.clearAdapterService(mAdapterService);
+    }
+
+    @Test
+    public void onApplicationStateChanged() {
+        mNativeInterface.onApplicationStateChanged(TEST_DEVICE_ADDRESS, true);
+        verify(mService).onApplicationStateChangedFromNative(any(), anyBoolean());
+    }
+
+    @Test
+    public void onConnectStateChanged() {
+        mNativeInterface.onConnectStateChanged(TEST_DEVICE_ADDRESS,
+                BluetoothHidDevice.STATE_DISCONNECTED);
+        verify(mService).onConnectStateChangedFromNative(any(), anyInt());
+    }
+
+    @Test
+    public void onGetReport() {
+        byte type = 1;
+        byte id = 2;
+        short bufferSize = 100;
+        mNativeInterface.onGetReport(type, id, bufferSize);
+        verify(mService).onGetReportFromNative(type, id, bufferSize);
+    }
+
+    @Test
+    public void onSetReport() {
+        byte reportType = 1;
+        byte reportId = 2;
+        byte[] data = new byte[] { 0x00, 0x00 };
+        mNativeInterface.onSetReport(reportType, reportId, data);
+        verify(mService).onSetReportFromNative(reportType, reportId, data);
+    }
+
+    @Test
+    public void onSetProtocol() {
+        byte protocol = 1;
+        mNativeInterface.onSetProtocol(protocol);
+        verify(mService).onSetProtocolFromNative(protocol);
+    }
+
+    @Test
+    public void onInterruptData() {
+        byte reportId = 3;
+        byte[] data = new byte[] { 0x00, 0x00 };
+        mNativeInterface.onInterruptData(reportId, data);
+        verify(mService).onInterruptDataFromNative(reportId, data);
+    }
+
+    @Test
+    public void onVirtualCableUnplug() {
+        mNativeInterface.onVirtualCableUnplug();
+        verify(mService).onVirtualCableUnplugFromNative();
+    }
+}
diff --git a/android/app/tests/unit/src/com/android/bluetooth/hid/HidHostServiceBinderTest.java b/android/app/tests/unit/src/com/android/bluetooth/hid/HidHostServiceBinderTest.java
new file mode 100644
index 0000000..f90f867
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/hid/HidHostServiceBinderTest.java
@@ -0,0 +1,182 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.hid;
+
+import static org.mockito.Mockito.verify;
+
+import android.bluetooth.BluetoothAdapter;
+import android.bluetooth.BluetoothDevice;
+import android.bluetooth.BluetoothProfile;
+
+import androidx.test.filters.SmallTest;
+import androidx.test.runner.AndroidJUnit4;
+
+import com.android.bluetooth.x.com.android.modules.utils.SynchronousResultReceiver;
+
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.Mock;
+import org.mockito.MockitoAnnotations;
+
+@SmallTest
+@RunWith(AndroidJUnit4.class)
+public class HidHostServiceBinderTest {
+
+    private static final String REMOTE_DEVICE_ADDRESS = "00:00:00:00:00:00";
+
+    @Mock
+    private HidHostService mService;
+
+    BluetoothDevice mRemoteDevice;
+
+    HidHostService.BluetoothHidHostBinder mBinder;
+
+    @Before
+    public void setUp() throws Exception {
+        MockitoAnnotations.initMocks(this);
+        mRemoteDevice = BluetoothAdapter.getDefaultAdapter().getRemoteDevice(REMOTE_DEVICE_ADDRESS);
+        mBinder = new HidHostService.BluetoothHidHostBinder(mService);
+    }
+
+    @Test
+    public void connect_callsServiceMethod() {
+        mBinder.connect(mRemoteDevice, null, SynchronousResultReceiver.get());
+
+        verify(mService).connect(mRemoteDevice);
+    }
+
+    @Test
+    public void disconnect_callsServiceMethod() {
+        mBinder.disconnect(mRemoteDevice, null, SynchronousResultReceiver.get());
+
+        verify(mService).disconnect(mRemoteDevice);
+    }
+
+    @Test
+    public void getConnectedDevices_callsServiceMethod() {
+        mBinder.getConnectedDevices(null, SynchronousResultReceiver.get());
+
+        verify(mService).getDevicesMatchingConnectionStates(
+                new int[] { BluetoothProfile.STATE_CONNECTED });
+    }
+
+    @Test
+    public void getDevicesMatchingConnectionStates_callsServiceMethod() {
+        int[] states = new int[] {BluetoothProfile.STATE_CONNECTED};
+        mBinder.getDevicesMatchingConnectionStates(states, null, SynchronousResultReceiver.get());
+
+        verify(mService).getDevicesMatchingConnectionStates(states);
+    }
+
+    @Test
+    public void getConnectionState_callsServiceMethod() {
+        mBinder.getConnectionState(mRemoteDevice, null, SynchronousResultReceiver.get());
+
+        verify(mService).getConnectionState(mRemoteDevice);
+    }
+
+    @Test
+    public void setConnectionPolicy_callsServiceMethod() {
+        int connectionPolicy = BluetoothProfile.CONNECTION_POLICY_ALLOWED;
+        mBinder.setConnectionPolicy(mRemoteDevice, connectionPolicy,
+                null, SynchronousResultReceiver.get());
+
+        verify(mService).setConnectionPolicy(mRemoteDevice, connectionPolicy);
+    }
+
+    @Test
+    public void getConnectionPolicy_callsServiceMethod() {
+        mBinder.getConnectionPolicy(mRemoteDevice, null, SynchronousResultReceiver.get());
+
+        verify(mService).getConnectionPolicy(mRemoteDevice);
+    }
+
+    @Test
+    public void getProtocolMode_callsServiceMethod() {
+        mBinder.getProtocolMode(mRemoteDevice, null,
+                SynchronousResultReceiver.get());
+
+        verify(mService).getProtocolMode(mRemoteDevice);
+    }
+
+    @Test
+    public void virtualUnplug_callsServiceMethod() {
+        mBinder.virtualUnplug(mRemoteDevice, null, SynchronousResultReceiver.get());
+
+        verify(mService).virtualUnplug(mRemoteDevice);
+    }
+
+    @Test
+    public void setProtocolMode_callsServiceMethod() {
+        int protocolMode = 1;
+        mBinder.setProtocolMode(mRemoteDevice, protocolMode, null, SynchronousResultReceiver.get());
+
+        verify(mService).setProtocolMode(mRemoteDevice, protocolMode);
+    }
+
+    @Test
+    public void getReport_callsServiceMethod() {
+        byte reportType = 1;
+        byte reportId = 2;
+        int bufferSize = 16;
+        mBinder.getReport(mRemoteDevice, reportType, reportId, bufferSize, null,
+                SynchronousResultReceiver.get());
+
+        verify(mService).getReport(mRemoteDevice, reportType, reportId, bufferSize);
+    }
+
+    @Test
+    public void setReport_callsServiceMethod() {
+        byte reportType = 1;
+        String report = "test_report";
+        mBinder.setReport(mRemoteDevice, reportType, report, null,
+                SynchronousResultReceiver.get());
+
+        verify(mService).setReport(mRemoteDevice, reportType, report);
+    }
+
+    @Test
+    public void sendData_callsServiceMethod() {
+        String report = "test_report";
+        mBinder.sendData(mRemoteDevice, report, null,
+                SynchronousResultReceiver.get());
+
+        verify(mService).sendData(mRemoteDevice, report);
+    }
+
+    @Test
+    public void setIdleTime_callsServiceMethod() {
+        byte idleTime = 1;
+        mBinder.setIdleTime(mRemoteDevice, idleTime, null,
+                SynchronousResultReceiver.get());
+
+        verify(mService).setIdleTime(mRemoteDevice, idleTime);
+    }
+
+    @Test
+    public void getIdleTime_callsServiceMethod() {
+        mBinder.getIdleTime(mRemoteDevice, null, SynchronousResultReceiver.get());
+
+        verify(mService).getIdleTime(mRemoteDevice);
+    }
+
+    @Test
+    public void cleanUp_doesNotCrash() {
+        mBinder.cleanup();
+    }
+}
diff --git a/android/app/tests/unit/src/com/android/bluetooth/hid/HidHostServiceTest.java b/android/app/tests/unit/src/com/android/bluetooth/hid/HidHostServiceTest.java
index 4122c33..a9667d0 100644
--- a/android/app/tests/unit/src/com/android/bluetooth/hid/HidHostServiceTest.java
+++ b/android/app/tests/unit/src/com/android/bluetooth/hid/HidHostServiceTest.java
@@ -133,6 +133,11 @@
                 badBondState, badPriorityValue, false);
     }
 
+    @Test
+    public void testDumpDoesNotCrash() {
+        mService.dump(new StringBuilder());
+    }
+
     /**
      * Helper function to test okToConnect() method.
      *
@@ -155,5 +160,4 @@
         doReturn(true).when(mAdapterService).isQuietModeEnabled();
         Assert.assertEquals(false, mService.okToConnect(device));
     }
-
 }
diff --git a/android/app/tests/unit/src/com/android/bluetooth/le_audio/LeAudioBinderTest.java b/android/app/tests/unit/src/com/android/bluetooth/le_audio/LeAudioBinderTest.java
new file mode 100644
index 0000000..6223f67
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/le_audio/LeAudioBinderTest.java
@@ -0,0 +1,384 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.le_audio;
+
+import static org.mockito.Mockito.verify;
+
+import android.bluetooth.BluetoothAdapter;
+import android.bluetooth.BluetoothDevice;
+import android.bluetooth.BluetoothLeAudio;
+import android.bluetooth.BluetoothLeAudioCodecConfig;
+import android.bluetooth.BluetoothLeAudioCodecStatus;
+import android.bluetooth.BluetoothLeAudioContentMetadata;
+import android.bluetooth.BluetoothLeBroadcastMetadata;
+import android.bluetooth.BluetoothProfile;
+import android.bluetooth.IBluetoothLeAudioCallback;
+import android.bluetooth.IBluetoothLeBroadcastCallback;
+import android.content.AttributionSource;
+import android.os.ParcelUuid;
+import android.os.RemoteCallbackList;
+
+import com.android.bluetooth.TestUtils;
+import com.android.bluetooth.x.com.android.modules.utils.SynchronousResultReceiver;
+
+import org.junit.After;
+import org.junit.Before;
+import org.junit.Test;
+import org.mockito.Mock;
+import org.mockito.Mockito;
+import org.mockito.MockitoAnnotations;
+
+import java.util.List;
+import java.util.UUID;
+
+public class LeAudioBinderTest {
+    @Mock
+    private LeAudioService mMockService;
+    @Mock
+    private RemoteCallbackList<IBluetoothLeAudioCallback> mLeAudioCallbacks;
+    @Mock
+    private RemoteCallbackList<IBluetoothLeBroadcastCallback> mBroadcastCallbacks;
+
+    private LeAudioService.BluetoothLeAudioBinder mBinder;
+    private BluetoothAdapter mAdapter;
+
+    @Before
+    public void setUp() throws Exception {
+        MockitoAnnotations.initMocks(this);
+        mAdapter = BluetoothAdapter.getDefaultAdapter();
+        mBinder = new LeAudioService.BluetoothLeAudioBinder(mMockService);
+        mMockService.mLeAudioCallbacks = mLeAudioCallbacks;
+        mMockService.mBroadcastCallbacks = mBroadcastCallbacks;
+    }
+
+    @After
+    public void cleanUp() {
+        mBinder.cleanup();
+    }
+
+    @Test
+    public void connect() {
+        BluetoothDevice device = TestUtils.getTestDevice(mAdapter, 0);
+        AttributionSource source = new AttributionSource.Builder(0).build();
+        final SynchronousResultReceiver<Boolean> recv = SynchronousResultReceiver.get();
+
+        mBinder.connect(device, source, recv);
+        verify(mMockService).connect(device);
+    }
+
+    @Test
+    public void disconnect() {
+        BluetoothDevice device = TestUtils.getTestDevice(mAdapter, 0);
+        AttributionSource source = new AttributionSource.Builder(0).build();
+        final SynchronousResultReceiver<Boolean> recv = SynchronousResultReceiver.get();
+
+        mBinder.disconnect(device, source, recv);
+        verify(mMockService).disconnect(device);
+    }
+
+    @Test
+    public void getConnectedDevices() {
+        AttributionSource source = new AttributionSource.Builder(0).build();
+        final SynchronousResultReceiver<List<BluetoothDevice>> recv =
+                SynchronousResultReceiver.get();
+
+        mBinder.getConnectedDevices(source, recv);
+        verify(mMockService).getConnectedDevices();
+    }
+
+    @Test
+    public void getConnectedGroupLeadDevice() {
+        int groupId = 1;
+        AttributionSource source = new AttributionSource.Builder(0).build();
+        final SynchronousResultReceiver<List<BluetoothDevice>> recv =
+                SynchronousResultReceiver.get();
+
+        mBinder.getConnectedGroupLeadDevice(groupId, source, recv);
+        verify(mMockService).getConnectedGroupLeadDevice(groupId);
+    }
+
+    @Test
+    public void getDevicesMatchingConnectionStates() {
+        int[] states = new int[] {BluetoothProfile.STATE_DISCONNECTED };
+        AttributionSource source = new AttributionSource.Builder(0).build();
+        final SynchronousResultReceiver<List<BluetoothDevice>> recv =
+                SynchronousResultReceiver.get();
+
+        mBinder.getDevicesMatchingConnectionStates(states, source, recv);
+        verify(mMockService).getDevicesMatchingConnectionStates(states);
+    }
+
+    @Test
+    public void getConnectionState() {
+        BluetoothDevice device = TestUtils.getTestDevice(mAdapter, 0);
+        AttributionSource source = new AttributionSource.Builder(0).build();
+        final SynchronousResultReceiver<Integer> recv = SynchronousResultReceiver.get();
+
+        mBinder.getConnectionState(device, source, recv);
+        verify(mMockService).getConnectionState(device);
+    }
+
+    @Test
+    public void setActiveDevice() {
+        BluetoothDevice device = TestUtils.getTestDevice(mAdapter, 0);
+        AttributionSource source = new AttributionSource.Builder(0).build();
+        final SynchronousResultReceiver<Boolean> recv = SynchronousResultReceiver.get();
+
+        mBinder.setActiveDevice(device, source, recv);
+        verify(mMockService).setActiveDevice(device);
+    }
+
+    @Test
+    public void getActiveDevices() {
+        AttributionSource source = new AttributionSource.Builder(0).build();
+        final SynchronousResultReceiver<Boolean> recv = SynchronousResultReceiver.get();
+
+        mBinder.getActiveDevices(source, recv);
+        verify(mMockService).getActiveDevices();
+    }
+
+    @Test
+    public void getAudioLocation() {
+        BluetoothDevice device = TestUtils.getTestDevice(mAdapter, 0);
+        AttributionSource source = new AttributionSource.Builder(0).build();
+        final SynchronousResultReceiver<Integer> recv = SynchronousResultReceiver.get();
+
+        mBinder.getAudioLocation(device, source, recv);
+        verify(mMockService).getAudioLocation(device);
+    }
+
+    @Test
+    public void setConnectionPolicy() {
+        BluetoothDevice device = TestUtils.getTestDevice(mAdapter, 0);
+        int connectionPolicy = BluetoothProfile.CONNECTION_POLICY_UNKNOWN;
+        AttributionSource source = new AttributionSource.Builder(0).build();
+        final SynchronousResultReceiver<Boolean> recv = SynchronousResultReceiver.get();
+
+        mBinder.setConnectionPolicy(device, connectionPolicy, source, recv);
+        verify(mMockService).setConnectionPolicy(device, connectionPolicy);
+    }
+
+    @Test
+    public void getConnectionPolicy() {
+        BluetoothDevice device = TestUtils.getTestDevice(mAdapter, 0);
+        AttributionSource source = new AttributionSource.Builder(0).build();
+        final SynchronousResultReceiver<Integer> recv = SynchronousResultReceiver.get();
+
+        mBinder.getConnectionPolicy(device, source, recv);
+        verify(mMockService).getConnectionPolicy(device);
+    }
+
+    @Test
+    public void setCcidInformation() {
+        ParcelUuid uuid = new ParcelUuid(new UUID(0, 0));
+        int ccid = 0;
+        int contextType = BluetoothLeAudio.CONTEXT_TYPE_UNSPECIFIED;
+        AttributionSource source = new AttributionSource.Builder(0).build();
+        final SynchronousResultReceiver<Void> recv = SynchronousResultReceiver.get();
+
+        mBinder.setCcidInformation(uuid, ccid, contextType, source, recv);
+        verify(mMockService).setCcidInformation(uuid, ccid, contextType);
+    }
+
+    @Test
+    public void getGroupId() {
+        BluetoothDevice device = TestUtils.getTestDevice(mAdapter, 0);
+        AttributionSource source = new AttributionSource.Builder(0).build();
+        final SynchronousResultReceiver<Integer> recv = SynchronousResultReceiver.get();
+
+        mBinder.getGroupId(device, source, recv);
+        verify(mMockService).getGroupId(device);
+    }
+
+    @Test
+    public void groupAddNode() {
+        int groupId = 1;
+        BluetoothDevice device = TestUtils.getTestDevice(mAdapter, 0);
+        AttributionSource source = new AttributionSource.Builder(0).build();
+        final SynchronousResultReceiver<Integer> recv = SynchronousResultReceiver.get();
+
+        mBinder.groupAddNode(groupId, device, source, recv);
+        verify(mMockService).groupAddNode(groupId, device);
+    }
+
+    @Test
+    public void setInCall() {
+        boolean inCall = true;
+        AttributionSource source = new AttributionSource.Builder(0).build();
+        final SynchronousResultReceiver<Void> recv = SynchronousResultReceiver.get();
+
+        mBinder.setInCall(inCall, source, recv);
+        verify(mMockService).setInCall(inCall);
+    }
+
+    @Test
+    public void setInactiveForHfpHandover() {
+        BluetoothDevice device = TestUtils.getTestDevice(mAdapter, 0);
+        AttributionSource source = new AttributionSource.Builder(0).build();
+        final SynchronousResultReceiver<Void> recv = SynchronousResultReceiver.get();
+
+        mBinder.setInactiveForHfpHandover(device, source, recv);
+        verify(mMockService).setInactiveForHfpHandover(device);
+    }
+
+    @Test
+    public void groupRemoveNode() {
+        int groupId = 1;
+        BluetoothDevice device = TestUtils.getTestDevice(mAdapter, 0);
+        AttributionSource source = new AttributionSource.Builder(0).build();
+        final SynchronousResultReceiver<Boolean> recv = SynchronousResultReceiver.get();
+
+        mBinder.groupRemoveNode(groupId, device, source, recv);
+        verify(mMockService).groupRemoveNode(groupId, device);
+    }
+
+    @Test
+    public void setVolume() {
+        int volume = 3;
+        AttributionSource source = new AttributionSource.Builder(0).build();
+        final SynchronousResultReceiver<Void> recv = SynchronousResultReceiver.get();
+
+        mBinder.setVolume(volume, source, recv);
+        verify(mMockService).setVolume(volume);
+    }
+
+    @Test
+    public void registerCallback() {
+        IBluetoothLeAudioCallback callback = Mockito.mock(IBluetoothLeAudioCallback.class);
+        AttributionSource source = new AttributionSource.Builder(0).build();
+        final SynchronousResultReceiver<Void> recv = SynchronousResultReceiver.get();
+
+        mBinder.registerCallback(callback, source, recv);
+        verify(mMockService.mLeAudioCallbacks).register(callback);
+    }
+
+    @Test
+    public void unregisterCallback() {
+        IBluetoothLeAudioCallback callback = Mockito.mock(IBluetoothLeAudioCallback.class);
+        AttributionSource source = new AttributionSource.Builder(0).build();
+        final SynchronousResultReceiver<Void> recv = SynchronousResultReceiver.get();
+
+        mBinder.unregisterCallback(callback, source, recv);
+        verify(mMockService.mLeAudioCallbacks).unregister(callback);
+    }
+
+    @Test
+    public void registerLeBroadcastCallback() {
+        IBluetoothLeBroadcastCallback callback = Mockito.mock(IBluetoothLeBroadcastCallback.class);
+        AttributionSource source = new AttributionSource.Builder(0).build();
+        final SynchronousResultReceiver<Void> recv = SynchronousResultReceiver.get();
+
+        mBinder.registerLeBroadcastCallback(callback, source, recv);
+        verify(mMockService.mBroadcastCallbacks).register(callback);
+    }
+
+    @Test
+    public void unregisterLeBroadcastCallback() {
+        IBluetoothLeBroadcastCallback callback = Mockito.mock(IBluetoothLeBroadcastCallback.class);
+        AttributionSource source = new AttributionSource.Builder(0).build();
+        final SynchronousResultReceiver<Void> recv = SynchronousResultReceiver.get();
+
+        mBinder.unregisterLeBroadcastCallback(callback, source, recv);
+        verify(mMockService.mBroadcastCallbacks).unregister(callback);
+    }
+
+    @Test
+    public void startBroadcast() {
+        BluetoothLeAudioContentMetadata metadata =
+                new BluetoothLeAudioContentMetadata.Builder().build();
+        byte[] code = new byte[] { 0x00 };
+        AttributionSource source = new AttributionSource.Builder(0).build();
+
+        mBinder.startBroadcast(metadata, code, source);
+        verify(mMockService).createBroadcast(metadata, code);
+    }
+
+    @Test
+    public void stopBroadcast() {
+        int id = 1;
+        AttributionSource source = new AttributionSource.Builder(0).build();
+
+        mBinder.stopBroadcast(id, source);
+        verify(mMockService).stopBroadcast(id);
+    }
+
+    @Test
+    public void updateBroadcast() {
+        int id = 1;
+        BluetoothLeAudioContentMetadata metadata =
+                new BluetoothLeAudioContentMetadata.Builder().build();
+        AttributionSource source = new AttributionSource.Builder(0).build();
+
+        mBinder.updateBroadcast(id, metadata, source);
+        verify(mMockService).updateBroadcast(id, metadata);
+    }
+
+    @Test
+    public void isPlaying() {
+        int id = 1;
+        BluetoothLeAudioContentMetadata metadata =
+                new BluetoothLeAudioContentMetadata.Builder().build();
+        AttributionSource source = new AttributionSource.Builder(0).build();
+        final SynchronousResultReceiver<Boolean> recv = SynchronousResultReceiver.get();
+
+        mBinder.isPlaying(id, source, recv);
+        verify(mMockService).isPlaying(id);
+    }
+
+    @Test
+    public void getAllBroadcastMetadata() {
+        AttributionSource source = new AttributionSource.Builder(0).build();
+        final SynchronousResultReceiver<List<BluetoothLeBroadcastMetadata>> recv =
+                SynchronousResultReceiver.get();
+
+        mBinder.getAllBroadcastMetadata(source, recv);
+        verify(mMockService).getAllBroadcastMetadata();
+    }
+
+    @Test
+    public void getMaximumNumberOfBroadcasts() {
+        AttributionSource source = new AttributionSource.Builder(0).build();
+        final SynchronousResultReceiver<Integer> recv = SynchronousResultReceiver.get();
+
+        mBinder.getMaximumNumberOfBroadcasts(source, recv);
+        verify(mMockService).getMaximumNumberOfBroadcasts();
+    }
+
+    @Test
+    public void getCodecStatus() {
+        int groupId = 1;
+        AttributionSource source = new AttributionSource.Builder(0).build();
+        final SynchronousResultReceiver<BluetoothLeAudioCodecStatus> recv =
+                SynchronousResultReceiver.get();
+
+        mBinder.getCodecStatus(groupId, source, recv);
+        verify(mMockService).getCodecStatus(groupId);
+    }
+
+    @Test
+    public void setCodecConfigPreference() {
+        int groupId = 1;
+        BluetoothLeAudioCodecConfig inputConfig =
+                new BluetoothLeAudioCodecConfig.Builder().build();
+        BluetoothLeAudioCodecConfig outputConfig =
+                new BluetoothLeAudioCodecConfig.Builder().build();
+        AttributionSource source = new AttributionSource.Builder(0).build();
+
+        mBinder.setCodecConfigPreference(groupId, inputConfig, outputConfig, source);
+        verify(mMockService).setCodecConfigPreference(groupId, inputConfig, outputConfig);
+    }
+}
diff --git a/android/app/tests/unit/src/com/android/bluetooth/le_audio/LeAudioBroadcastServiceTest.java b/android/app/tests/unit/src/com/android/bluetooth/le_audio/LeAudioBroadcastServiceTest.java
index 9568d4b..0219258 100644
--- a/android/app/tests/unit/src/com/android/bluetooth/le_audio/LeAudioBroadcastServiceTest.java
+++ b/android/app/tests/unit/src/com/android/bluetooth/le_audio/LeAudioBroadcastServiceTest.java
@@ -172,6 +172,8 @@
         doReturn(mDatabaseManager).when(mAdapterService).getDatabase();
         doReturn(true, false).when(mAdapterService).isStartedProfile(anyString());
         doReturn(true).when(mAdapterService).isLeAudioBroadcastSourceSupported();
+        doReturn((long)(1 << BluetoothProfile.LE_AUDIO_BROADCAST) | (1 << BluetoothProfile.LE_AUDIO))
+                .when(mAdapterService).getSupportedProfilesBitMask();
 
         mAdapter = BluetoothAdapter.getDefaultAdapter();
 
@@ -299,7 +301,7 @@
     @Test
     public void testCreateBroadcastNative() {
         int broadcastId = 243;
-        byte[] code = {0x00, 0x01, 0x00};
+        byte[] code = {0x00, 0x01, 0x00, 0x02};
 
         mService.mBroadcastCallbacks.register(mCallbacks);
 
@@ -314,7 +316,7 @@
     @Test
     public void testCreateBroadcastNativeFailed() {
         int broadcastId = 243;
-        byte[] code = {0x00, 0x01, 0x00};
+        byte[] code = {0x00, 0x01, 0x00, 0x02};
 
         mService.mBroadcastCallbacks.register(mCallbacks);
 
@@ -340,7 +342,7 @@
     @Test
     public void testStartStopBroadcastNative() {
         int broadcastId = 243;
-        byte[] code = {0x00, 0x01, 0x00};
+        byte[] code = {0x00, 0x01, 0x00, 0x02};
 
         mService.mBroadcastCallbacks.register(mCallbacks);
 
diff --git a/android/app/tests/unit/src/com/android/bluetooth/le_audio/LeAudioBroadcasterNativeInterfaceTest.java b/android/app/tests/unit/src/com/android/bluetooth/le_audio/LeAudioBroadcasterNativeInterfaceTest.java
new file mode 100644
index 0000000..58d75c0
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/le_audio/LeAudioBroadcasterNativeInterfaceTest.java
@@ -0,0 +1,112 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.le_audio;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import android.bluetooth.BluetoothLeAudio;
+import android.bluetooth.BluetoothLeAudioCodecConfig;
+import android.bluetooth.BluetoothLeBroadcastMetadata;
+
+import androidx.test.runner.AndroidJUnit4;
+
+import org.junit.After;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.ArgumentCaptor;
+import org.mockito.Mock;
+import org.mockito.MockitoAnnotations;
+
+@RunWith(AndroidJUnit4.class)
+public class LeAudioBroadcasterNativeInterfaceTest {
+    @Mock
+    private LeAudioService mMockService;
+
+    private LeAudioBroadcasterNativeInterface mNativeInterface;
+
+    @Before
+    public void setUp() throws Exception {
+        MockitoAnnotations.initMocks(this);
+        when(mMockService.isAvailable()).thenReturn(true);
+        LeAudioService.setLeAudioService(mMockService);
+        mNativeInterface = LeAudioBroadcasterNativeInterface.getInstance();
+    }
+
+    @After
+    public void tearDown() {
+        LeAudioService.setLeAudioService(null);
+    }
+
+    @Test
+    public void onBroadcastCreated() {
+        int broadcastId = 1;
+        boolean success = true;
+
+        mNativeInterface.onBroadcastCreated(broadcastId, success);
+
+        ArgumentCaptor<LeAudioStackEvent> event =
+                ArgumentCaptor.forClass(LeAudioStackEvent.class);
+        verify(mMockService).messageFromNative(event.capture());
+        assertThat(event.getValue().type).isEqualTo(
+                LeAudioStackEvent.EVENT_TYPE_BROADCAST_CREATED);
+    }
+
+    @Test
+    public void onBroadcastDestroyed() {
+        int broadcastId = 1;
+
+        mNativeInterface.onBroadcastDestroyed(broadcastId);
+
+        ArgumentCaptor<LeAudioStackEvent> event =
+                ArgumentCaptor.forClass(LeAudioStackEvent.class);
+        verify(mMockService).messageFromNative(event.capture());
+        assertThat(event.getValue().type).isEqualTo(
+                LeAudioStackEvent.EVENT_TYPE_BROADCAST_DESTROYED);
+    }
+
+    @Test
+    public void onBroadcastStateChanged() {
+        int broadcastId = 1;
+        int state = 0;
+
+        mNativeInterface.onBroadcastStateChanged(broadcastId, state);
+
+        ArgumentCaptor<LeAudioStackEvent> event =
+                ArgumentCaptor.forClass(LeAudioStackEvent.class);
+        verify(mMockService).messageFromNative(event.capture());
+        assertThat(event.getValue().type).isEqualTo(
+                LeAudioStackEvent.EVENT_TYPE_BROADCAST_STATE);
+    }
+
+    @Test
+    public void onBroadcastMetadataChanged() {
+        int broadcastId = 1;
+        BluetoothLeBroadcastMetadata metadata = null;
+
+        mNativeInterface.onBroadcastMetadataChanged(broadcastId, metadata);
+
+        ArgumentCaptor<LeAudioStackEvent> event =
+                ArgumentCaptor.forClass(LeAudioStackEvent.class);
+        verify(mMockService).messageFromNative(event.capture());
+        assertThat(event.getValue().type).isEqualTo(
+                LeAudioStackEvent.EVENT_TYPE_BROADCAST_METADATA_CHANGED);
+    }
+}
diff --git a/android/app/tests/unit/src/com/android/bluetooth/le_audio/LeAudioNativeInterfaceTest.java b/android/app/tests/unit/src/com/android/bluetooth/le_audio/LeAudioNativeInterfaceTest.java
new file mode 100644
index 0000000..ba933f4
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/le_audio/LeAudioNativeInterfaceTest.java
@@ -0,0 +1,158 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.le_audio;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import android.bluetooth.BluetoothLeAudio;
+import android.bluetooth.BluetoothLeAudioCodecConfig;
+
+import androidx.test.runner.AndroidJUnit4;
+
+import org.junit.After;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.ArgumentCaptor;
+import org.mockito.Mock;
+import org.mockito.MockitoAnnotations;
+
+@RunWith(AndroidJUnit4.class)
+public class LeAudioNativeInterfaceTest {
+    @Mock
+    private LeAudioService mMockService;
+
+    private LeAudioNativeInterface mNativeInterface;
+
+    @Before
+    public void setUp() throws Exception {
+        MockitoAnnotations.initMocks(this);
+        when(mMockService.isAvailable()).thenReturn(true);
+        LeAudioService.setLeAudioService(mMockService);
+        mNativeInterface = LeAudioNativeInterface.getInstance();
+    }
+
+    @After
+    public void tearDown() {
+        LeAudioService.setLeAudioService(null);
+    }
+
+    @Test
+    public void onConnectionStateChanged() {
+        int state = LeAudioStackEvent.CONNECTION_STATE_CONNECTED;
+        byte[] address = new byte[] { 0x00, 0x01, 0x02, 0x03, 0x04, 0x05 };
+
+        mNativeInterface.onConnectionStateChanged(state, address);
+
+        ArgumentCaptor<LeAudioStackEvent> event =
+                ArgumentCaptor.forClass(LeAudioStackEvent.class);
+        verify(mMockService).messageFromNative(event.capture());
+        assertThat(event.getValue().type).isEqualTo(
+                LeAudioStackEvent.EVENT_TYPE_CONNECTION_STATE_CHANGED);
+    }
+
+    @Test
+    public void onGroupNodeStatus() {
+        byte[] address = new byte[] { 0x00, 0x01, 0x02, 0x03, 0x04, 0x05 };
+        int groupId = 1;
+        int nodeStatus = LeAudioStackEvent.GROUP_NODE_ADDED;
+
+        mNativeInterface.onGroupNodeStatus(address, groupId, nodeStatus);
+
+        ArgumentCaptor<LeAudioStackEvent> event =
+                ArgumentCaptor.forClass(LeAudioStackEvent.class);
+        verify(mMockService).messageFromNative(event.capture());
+        assertThat(event.getValue().type).isEqualTo(
+                LeAudioStackEvent.EVENT_TYPE_GROUP_NODE_STATUS_CHANGED);
+    }
+
+    @Test
+    public void onAudioConf() {
+        int direction = 0;
+        int groupId = 1;
+        int sinkAudioLocation = BluetoothLeAudio.AUDIO_LOCATION_INVALID;
+        int sourceAudioLocation = BluetoothLeAudio.AUDIO_LOCATION_INVALID;
+        int availableContexts = 2;
+
+        mNativeInterface.onAudioConf(
+                direction, groupId, sinkAudioLocation, sourceAudioLocation, availableContexts);
+
+        ArgumentCaptor<LeAudioStackEvent> event =
+                ArgumentCaptor.forClass(LeAudioStackEvent.class);
+        verify(mMockService).messageFromNative(event.capture());
+        assertThat(event.getValue().type).isEqualTo(
+                LeAudioStackEvent.EVENT_TYPE_AUDIO_CONF_CHANGED);
+    }
+
+    @Test
+    public void onSinkAudioLocationAvailable() {
+        byte[] address = new byte[] { 0x00, 0x01, 0x02, 0x03, 0x04, 0x05 };
+        int sinkAudioLocation = BluetoothLeAudio.AUDIO_LOCATION_INVALID;
+
+        mNativeInterface.onSinkAudioLocationAvailable(address, sinkAudioLocation);
+
+        ArgumentCaptor<LeAudioStackEvent> event =
+                ArgumentCaptor.forClass(LeAudioStackEvent.class);
+        verify(mMockService).messageFromNative(event.capture());
+        assertThat(event.getValue().type).isEqualTo(
+                LeAudioStackEvent.EVENT_TYPE_SINK_AUDIO_LOCATION_AVAILABLE);
+    }
+
+    @Test
+    public void onAudioLocalCodecCapabilities() {
+        BluetoothLeAudioCodecConfig emptyConfig =
+                new BluetoothLeAudioCodecConfig.Builder().build();
+        BluetoothLeAudioCodecConfig[] localInputCodecCapabilities =
+                new BluetoothLeAudioCodecConfig[] { emptyConfig };
+        BluetoothLeAudioCodecConfig[] localOutputCodecCapabilities =
+                new BluetoothLeAudioCodecConfig[] { emptyConfig };
+
+        mNativeInterface.onAudioLocalCodecCapabilities(
+                localInputCodecCapabilities, localOutputCodecCapabilities);
+
+        ArgumentCaptor<LeAudioStackEvent> event =
+                ArgumentCaptor.forClass(LeAudioStackEvent.class);
+        verify(mMockService).messageFromNative(event.capture());
+        assertThat(event.getValue().type).isEqualTo(
+                LeAudioStackEvent.EVENT_TYPE_AUDIO_LOCAL_CODEC_CONFIG_CAPA_CHANGED);
+    }
+
+    @Test
+    public void onAudioGroupCodecConf() {
+        int groupId = 1;
+        BluetoothLeAudioCodecConfig inputConfig =
+                new BluetoothLeAudioCodecConfig.Builder().build();
+        BluetoothLeAudioCodecConfig outputConfig =
+                new BluetoothLeAudioCodecConfig.Builder().build();
+        BluetoothLeAudioCodecConfig[] inputSelectableCodecConfig =
+                new BluetoothLeAudioCodecConfig[] { inputConfig };
+        BluetoothLeAudioCodecConfig[] outputSelectableCodecConfig =
+                new BluetoothLeAudioCodecConfig[] { outputConfig };
+
+        mNativeInterface.onAudioGroupCodecConf(groupId, inputConfig, outputConfig,
+                inputSelectableCodecConfig, outputSelectableCodecConfig);
+
+        ArgumentCaptor<LeAudioStackEvent> event =
+                ArgumentCaptor.forClass(LeAudioStackEvent.class);
+        verify(mMockService).messageFromNative(event.capture());
+        assertThat(event.getValue().type).isEqualTo(
+                LeAudioStackEvent.EVENT_TYPE_AUDIO_GROUP_CODEC_CONFIG_CHANGED);
+    }
+}
diff --git a/android/app/tests/unit/src/com/android/bluetooth/le_audio/LeAudioServiceTest.java b/android/app/tests/unit/src/com/android/bluetooth/le_audio/LeAudioServiceTest.java
index 26cfebe..39c3cd7 100644
--- a/android/app/tests/unit/src/com/android/bluetooth/le_audio/LeAudioServiceTest.java
+++ b/android/app/tests/unit/src/com/android/bluetooth/le_audio/LeAudioServiceTest.java
@@ -27,10 +27,11 @@
 import static org.mockito.Mockito.doNothing;
 import static org.mockito.Mockito.doReturn;
 import static org.mockito.Mockito.eq;
-import static org.mockito.Mockito.when;
+import static org.mockito.Mockito.never;
 import static org.mockito.Mockito.timeout;
 import static org.mockito.Mockito.times;
 import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
 
 import android.bluetooth.BluetoothAdapter;
 import android.bluetooth.BluetoothDevice;
@@ -58,17 +59,22 @@
 import com.android.bluetooth.R;
 import com.android.bluetooth.TestUtils;
 import com.android.bluetooth.btservice.AdapterService;
+import com.android.bluetooth.btservice.ServiceFactory;
 import com.android.bluetooth.btservice.storage.DatabaseManager;
+import com.android.bluetooth.hfp.HeadsetService;
+import com.android.bluetooth.mcp.McpService;
 import com.android.bluetooth.vc.VolumeControlService;
 
 import org.junit.After;
 import org.junit.Assume;
 import org.junit.Before;
+import org.junit.Ignore;
 import org.junit.Rule;
 import org.junit.Test;
 import org.junit.runner.RunWith;
 import org.mockito.ArgumentCaptor;
 import org.mockito.Mock;
+import org.mockito.Mockito;
 import org.mockito.MockitoAnnotations;
 import org.mockito.Spy;
 
@@ -85,6 +91,7 @@
 public class LeAudioServiceTest {
     private static final int ASYNC_CALL_TIMEOUT_MILLIS = 250;
     private static final int TIMEOUT_MS = 1000;
+    private static final int AUDIO_MANAGER_DEVICE_ADD_TIMEOUT_MS = 3000;
     private static final int MAX_LE_AUDIO_CONNECTIONS = 5;
     private static final int LE_AUDIO_GROUP_ID_INVALID = -1;
 
@@ -105,13 +112,14 @@
     private BroadcastReceiver mLeAudioIntentReceiver;
 
     @Mock private AdapterService mAdapterService;
+    @Mock private AudioManager mAudioManager;
     @Mock private DatabaseManager mDatabaseManager;
     @Mock private LeAudioNativeInterface mNativeInterface;
-    @Mock private AudioManager mAudioManager;
-    @Mock private VolumeControlService mVolumeControlService;
     @Mock private LeAudioTmapGattServer mTmapGattServer;
+    @Mock private McpService mMcpService;
+    @Mock private VolumeControlService mVolumeControlService;
     @Spy private LeAudioObjectsFactory mObjectsFactory = LeAudioObjectsFactory.getInstance();
-
+    @Spy private ServiceFactory mServiceFactory = new ServiceFactory();
 
     @Rule public final ServiceTestRule mServiceRule = new ServiceTestRule();
 
@@ -180,10 +188,12 @@
         doAnswer(invocation -> mBondedDevices.toArray(new BluetoothDevice[]{})).when(
                 mAdapterService).getBondedDevices();
 
+        LeAudioNativeInterface.setInstance(mNativeInterface);
         startService();
-        mService.mLeAudioNativeInterface = mNativeInterface;
         mService.mAudioManager = mAudioManager;
-        mService.mVolumeControlService = mVolumeControlService;
+        mService.mMcpService = mMcpService;
+        mService.mServiceFactory = mServiceFactory;
+        when(mServiceFactory.getVolumeControlService()).thenReturn(mVolumeControlService);
 
         LeAudioStackEvent stackEvent =
         new LeAudioStackEvent(LeAudioStackEvent.EVENT_TYPE_NATIVE_INITIALIZED);
@@ -217,6 +227,8 @@
                 .getBondState(any(BluetoothDevice.class));
         doReturn(new ParcelUuid[]{BluetoothUuid.LE_AUDIO}).when(mAdapterService)
                 .getRemoteUuids(any(BluetoothDevice.class));
+
+        verify(mNativeInterface, timeout(3000).times(1)).init(any());
     }
 
     @After
@@ -231,6 +243,7 @@
         mTargetContext.unregisterReceiver(mLeAudioIntentReceiver);
         mDeviceQueueMap.clear();
         TestUtils.clearAdapterService(mAdapterService);
+        LeAudioNativeInterface.setInstance(null);
     }
 
     private void startService() throws TimeoutException {
@@ -285,10 +298,9 @@
         assertThat(intent).isNotNull();
         assertThat(intent.getAction())
                 .isEqualTo(BluetoothLeAudio.ACTION_LE_AUDIO_CONNECTION_STATE_CHANGED);
-        assertThat(device).isEqualTo(intent.getParcelableExtra(BluetoothDevice.EXTRA_DEVICE));
-        assertThat(newState).isEqualTo(intent.getIntExtra(BluetoothProfile.EXTRA_STATE, -1));
-        assertThat(prevState).isEqualTo(intent.getIntExtra(BluetoothProfile.EXTRA_PREVIOUS_STATE,
-                -1));
+        assertThat((BluetoothDevice)intent.getParcelableExtra(BluetoothDevice.EXTRA_DEVICE)).isEqualTo(device);
+        assertThat(intent.getIntExtra(BluetoothProfile.EXTRA_STATE, -1)).isEqualTo(newState);
+        assertThat(intent.getIntExtra(BluetoothProfile.EXTRA_PREVIOUS_STATE, -1)).isEqualTo(prevState);
     }
 
     /**
@@ -315,6 +327,21 @@
     }
 
     /**
+     * Test if stop during init is ok.
+     */
+    @Test
+    public void testStopStartStopService() throws Exception {
+        InstrumentationRegistry.getInstrumentation().runOnMainSync(new Runnable() {
+            public void run() {
+                assertThat(mService.stop()).isTrue();
+                assertThat(mService.start()).isTrue();
+                assertThat(mService.stop()).isTrue();
+                assertThat(mService.start()).isTrue();
+            }
+        });
+    }
+
+    /**
      * Test get/set priority for BluetoothDevice
      */
     @Test
@@ -616,6 +643,9 @@
         doReturn(true).when(mNativeInterface).connectLeAudio(any(BluetoothDevice.class));
         doReturn(true).when(mNativeInterface).disconnectLeAudio(any(BluetoothDevice.class));
 
+        // Create device descriptor with connect request
+        assertWithMessage("Connect failed").that(mService.connect(mLeftDevice)).isTrue();
+
         // Le Audio stack event: CONNECTION_STATE_CONNECTING - state machine should be created
         generateConnectionMessageFromNative(mLeftDevice, BluetoothProfile.STATE_CONNECTING,
                 BluetoothProfile.STATE_DISCONNECTED);
@@ -632,9 +662,15 @@
         mService.bondStateChanged(mLeftDevice, BluetoothDevice.BOND_NONE);
         assertThat(mService.getDevices().contains(mLeftDevice)).isFalse();
 
+        // Remove bond will remove also device descriptor. Device has to be connected again
+        assertWithMessage("Connect failed").that(mService.connect(mLeftDevice)).isTrue();
+        verifyConnectionStateIntent(LeAudioStateMachine.sConnectTimeoutMs * 2,
+                mLeftDevice, BluetoothProfile.STATE_CONNECTING,
+                BluetoothProfile.STATE_DISCONNECTED);
+
         // stack event: CONNECTION_STATE_CONNECTED - state machine should be created
         generateConnectionMessageFromNative(mLeftDevice, BluetoothProfile.STATE_CONNECTED,
-                BluetoothProfile.STATE_DISCONNECTED);
+                BluetoothProfile.STATE_CONNECTING);
         assertThat(BluetoothProfile.STATE_CONNECTED)
                 .isEqualTo(mService.getConnectionState(mLeftDevice));
         assertThat(mService.getDevices().contains(mLeftDevice)).isTrue();
@@ -683,34 +719,41 @@
         doReturn(true).when(mNativeInterface).connectLeAudio(any(BluetoothDevice.class));
         doReturn(true).when(mNativeInterface).disconnectLeAudio(any(BluetoothDevice.class));
 
+        // Create device descriptor with connect request
+        assertWithMessage("Connect failed").that(mService.connect(mLeftDevice)).isTrue();
+
         // LeAudio stack event: CONNECTION_STATE_CONNECTING - state machine should be created
         generateConnectionMessageFromNative(mLeftDevice, BluetoothProfile.STATE_CONNECTING,
                 BluetoothProfile.STATE_DISCONNECTED);
-        assertThat(BluetoothProfile.STATE_CONNECTING)
-                .isEqualTo(mService.getConnectionState(mLeftDevice));
+        assertThat(mService.getConnectionState(mLeftDevice))
+                .isEqualTo(BluetoothProfile.STATE_CONNECTING);
         assertThat(mService.getDevices().contains(mLeftDevice)).isTrue();
         // Device unbond - state machine is not removed
         mService.bondStateChanged(mLeftDevice, BluetoothDevice.BOND_NONE);
         assertThat(mService.getDevices().contains(mLeftDevice)).isTrue();
+        verifyConnectionStateIntent(TIMEOUT_MS, mLeftDevice, BluetoothProfile.STATE_DISCONNECTED,
+                BluetoothProfile.STATE_CONNECTING);
 
         // LeAudio stack event: CONNECTION_STATE_CONNECTED - state machine is not removed
         mService.bondStateChanged(mLeftDevice, BluetoothDevice.BOND_BONDED);
         generateConnectionMessageFromNative(mLeftDevice, BluetoothProfile.STATE_CONNECTED,
-                BluetoothProfile.STATE_CONNECTING);
-        assertThat(BluetoothProfile.STATE_CONNECTED)
-                .isEqualTo(mService.getConnectionState(mLeftDevice));
+                BluetoothProfile.STATE_DISCONNECTED);
+        assertThat(mService.getConnectionState(mLeftDevice))
+                .isEqualTo(BluetoothProfile.STATE_CONNECTED);
         assertThat(mService.getDevices().contains(mLeftDevice)).isTrue();
         // Device unbond - state machine is not removed
         mService.bondStateChanged(mLeftDevice, BluetoothDevice.BOND_NONE);
         assertThat(mService.getDevices().contains(mLeftDevice)).isTrue();
+        verifyConnectionStateIntent(TIMEOUT_MS, mLeftDevice, BluetoothProfile.STATE_DISCONNECTING,
+                BluetoothProfile.STATE_CONNECTED);
+        assertThat(mService.getConnectionState(mLeftDevice))
+                .isEqualTo(BluetoothProfile.STATE_DISCONNECTING);
+        assertThat(mService.getDevices().contains(mLeftDevice)).isTrue();
 
         // LeAudio stack event: CONNECTION_STATE_DISCONNECTING - state machine is not removed
         mService.bondStateChanged(mLeftDevice, BluetoothDevice.BOND_BONDED);
-        generateConnectionMessageFromNative(mLeftDevice, BluetoothProfile.STATE_DISCONNECTING,
-                BluetoothProfile.STATE_CONNECTED);
-        assertThat(BluetoothProfile.STATE_DISCONNECTING)
-                .isEqualTo(mService.getConnectionState(mLeftDevice));
-        assertThat(mService.getDevices().contains(mLeftDevice)).isTrue();
+        assertThat(mService.getConnectionState(mLeftDevice))
+                .isEqualTo(BluetoothProfile.STATE_DISCONNECTING);
         // Device unbond - state machine is not removed
         mService.bondStateChanged(mLeftDevice, BluetoothDevice.BOND_NONE);
         assertThat(mService.getDevices().contains(mLeftDevice)).isTrue();
@@ -719,8 +762,8 @@
         mService.bondStateChanged(mLeftDevice, BluetoothDevice.BOND_BONDED);
         generateConnectionMessageFromNative(mLeftDevice, BluetoothProfile.STATE_DISCONNECTED,
                 BluetoothProfile.STATE_DISCONNECTING);
-        assertThat(BluetoothProfile.STATE_DISCONNECTED)
-                .isEqualTo(mService.getConnectionState(mLeftDevice));
+        assertThat(mService.getConnectionState(mLeftDevice))
+                .isEqualTo(BluetoothProfile.STATE_DISCONNECTED);
         assertThat(mService.getDevices().contains(mLeftDevice)).isTrue();
         // Device unbond - state machine is removed
         mService.bondStateChanged(mLeftDevice, BluetoothDevice.BOND_NONE);
@@ -746,6 +789,9 @@
         doReturn(true).when(mNativeInterface).connectLeAudio(any(BluetoothDevice.class));
         doReturn(true).when(mNativeInterface).disconnectLeAudio(any(BluetoothDevice.class));
 
+        // Create device descriptor with connect request
+        assertWithMessage("Connect failed").that(mService.connect(mLeftDevice)).isTrue();
+
         // LeAudio stack event: CONNECTION_STATE_CONNECTING - state machine should be created
         generateConnectionMessageFromNative(mLeftDevice, BluetoothProfile.STATE_CONNECTING,
                 BluetoothProfile.STATE_DISCONNECTED);
@@ -842,6 +888,24 @@
         verifyNoConnectionStateIntent(TIMEOUT_MS, device);
     }
 
+    private void generateGroupNodeAdded(BluetoothDevice device, int groupId) {
+        LeAudioStackEvent nodeGroupAdded =
+        new LeAudioStackEvent(LeAudioStackEvent.EVENT_TYPE_GROUP_NODE_STATUS_CHANGED);
+        nodeGroupAdded.device = device;
+        nodeGroupAdded.valueInt1 = groupId;
+        nodeGroupAdded.valueInt2 = LeAudioStackEvent.GROUP_NODE_ADDED;
+        mService.messageFromNative(nodeGroupAdded);
+    }
+
+    private void generateGroupNodeRemoved(BluetoothDevice device, int groupId) {
+        LeAudioStackEvent nodeGroupRemoved =
+        new LeAudioStackEvent(LeAudioStackEvent.EVENT_TYPE_GROUP_NODE_STATUS_CHANGED);
+        nodeGroupRemoved.device = device;
+        nodeGroupRemoved.valueInt1 = groupId;
+        nodeGroupRemoved.valueInt2 = LeAudioStackEvent.GROUP_NODE_REMOVED;
+        mService.messageFromNative(nodeGroupRemoved);
+    }
+
     private void verifyNoConnectionStateIntent(int timeoutMs, BluetoothDevice device) {
         Intent intent = TestUtils.waitForNoIntent(timeoutMs, mDeviceQueueMap.get(device));
         assertThat(intent).isNull();
@@ -957,24 +1021,6 @@
         for (BluetoothDevice prevDevice : prevConnectedDevices) {
                 assertThat(mService.getConnectedDevices().contains(prevDevice)).isTrue();
         }
-   }
-
-    /**
-     * Test matching connection state devices.
-     */
-    @Test
-    public void testGetDevicesMatchingConnectionState() {
-        // Update the device priority so okToConnect() returns true
-        doReturn(new ParcelUuid[]{BluetoothUuid.LE_AUDIO}).when(mAdapterService)
-                .getRemoteUuids(any(BluetoothDevice.class));
-        doReturn(new BluetoothDevice[]{mSingleDevice}).when(mAdapterService).getBondedDevices();
-        when(mDatabaseManager
-                .getProfileConnectionPolicy(mSingleDevice, BluetoothProfile.LE_AUDIO))
-                .thenReturn(BluetoothProfile.CONNECTION_POLICY_ALLOWED);
-        doReturn(true).when(mNativeInterface).connectLeAudio(any(BluetoothDevice.class));
-        doReturn(true).when(mNativeInterface).disconnectLeAudio(any(BluetoothDevice.class));
-
-        connectTestDevice(mSingleDevice, testGroupId);
     }
 
     /**
@@ -1016,6 +1062,7 @@
     @Test
     public void testGetActiveDevices() {
         int groupId = 1;
+        /* AUDIO_DIRECTION_OUTPUT_BIT = 0x01 */
         int direction = 1;
         int snkAudioLocation = 3;
         int srcAudioLocation = 4;
@@ -1037,7 +1084,7 @@
 
         assertThat(mService.setActiveDevice(mSingleDevice)).isTrue();
 
-        //Add location support
+        // Add location support
         LeAudioStackEvent audioConfChangedEvent =
                 new LeAudioStackEvent(LeAudioStackEvent.EVENT_TYPE_AUDIO_CONF_CHANGED);
         audioConfChangedEvent.device = mSingleDevice;
@@ -1048,7 +1095,7 @@
         audioConfChangedEvent.valueInt5 = availableContexts;
         mService.messageFromNative(audioConfChangedEvent);
 
-        //Set group and device as active
+        // Set group and device as active
         LeAudioStackEvent groupStatusChangedEvent =
                 new LeAudioStackEvent(LeAudioStackEvent.EVENT_TYPE_GROUP_STATUS_CHANGED);
         groupStatusChangedEvent.device = mSingleDevice;
@@ -1057,6 +1104,16 @@
         mService.messageFromNative(groupStatusChangedEvent);
 
         assertThat(mService.getActiveDevices().contains(mSingleDevice)).isTrue();
+
+        // Remove device from group
+        groupStatusChangedEvent =
+                new LeAudioStackEvent(LeAudioStackEvent.EVENT_TYPE_GROUP_NODE_STATUS_CHANGED);
+        groupStatusChangedEvent.device = mSingleDevice;
+        groupStatusChangedEvent.valueInt1 = groupId;
+        groupStatusChangedEvent.valueInt2 = LeAudioStackEvent.GROUP_NODE_REMOVED;
+        mService.messageFromNative(groupStatusChangedEvent);
+
+        assertThat(mService.getActiveDevices().contains(mSingleDevice)).isFalse();
     }
 
     private void injectGroupStatusChange(int groupId, int groupStatus) {
@@ -1067,8 +1124,7 @@
         mService.messageFromNative(groupStatusChangedEvent);
     }
 
-    private void injectAudioConfChanged(int groupId, Integer availableContexts) {
-        int direction = 1;
+    private void injectAudioConfChanged(int groupId, Integer availableContexts, int direction) {
         int snkAudioLocation = 3;
         int srcAudioLocation = 4;
         int eventType = LeAudioStackEvent.EVENT_TYPE_AUDIO_CONF_CHANGED;
@@ -1087,15 +1143,24 @@
      * Test native interface audio configuration changed message handling
      */
     @Test
+    @Ignore("b/258573934")
     public void testMessageFromNativeAudioConfChangedActiveGroup() {
         doReturn(true).when(mNativeInterface).connectLeAudio(any(BluetoothDevice.class));
         connectTestDevice(mSingleDevice, testGroupId);
         injectAudioConfChanged(testGroupId, BluetoothLeAudio.CONTEXT_TYPE_MEDIA |
-                         BluetoothLeAudio.CONTEXT_TYPE_COMMUNICATION);
+                         BluetoothLeAudio.CONTEXT_TYPE_CONVERSATIONAL, 3);
         injectGroupStatusChange(testGroupId, BluetoothLeAudio.GROUP_STATUS_ACTIVE);
 
-        String action = BluetoothLeAudio.ACTION_LE_AUDIO_ACTIVE_DEVICE_CHANGED;
+        /* Expect 2 calles to Audio Manager - one for output and second for input as this is
+         * Conversational use case */
+        verify(mAudioManager, times(2)).handleBluetoothActiveDeviceChanged(any(), any(),
+                        any(BluetoothProfileConnectionInfo.class));
+        /* Since LeAudioService called AudioManager - assume Audio manager calles properly callback
+        * mAudioManager.onAudioDeviceAdded
+        */
+        mService.notifyActiveDeviceChanged();
 
+        String action = BluetoothLeAudio.ACTION_LE_AUDIO_ACTIVE_DEVICE_CHANGED;
         Intent intent = TestUtils.waitForIntent(TIMEOUT_MS, mDeviceQueueMap.get(mSingleDevice));
         assertThat(intent).isNotNull();
         assertThat(action).isEqualTo(intent.getAction());
@@ -1112,8 +1177,8 @@
 
         String action = BluetoothLeAudio.ACTION_LE_AUDIO_ACTIVE_DEVICE_CHANGED;
         Integer contexts = BluetoothLeAudio.CONTEXT_TYPE_MEDIA |
-        BluetoothLeAudio.CONTEXT_TYPE_COMMUNICATION;
-        injectAudioConfChanged(testGroupId, contexts);
+        BluetoothLeAudio.CONTEXT_TYPE_CONVERSATIONAL;
+        injectAudioConfChanged(testGroupId, contexts, 3);
 
         Intent intent = TestUtils.waitForNoIntent(TIMEOUT_MS, mDeviceQueueMap.get(mSingleDevice));
         assertThat(intent).isNull();
@@ -1128,7 +1193,7 @@
 
         String action = BluetoothLeAudio.ACTION_LE_AUDIO_ACTIVE_DEVICE_CHANGED;
 
-        injectAudioConfChanged(testGroupId, 0);
+        injectAudioConfChanged(testGroupId, 0, 3);
         Intent intent = TestUtils.waitForNoIntent(TIMEOUT_MS, mDeviceQueueMap.get(mSingleDevice));
         assertThat(intent).isNull();
     }
@@ -1174,7 +1239,7 @@
         connectTestDevice(mSingleDevice, testGroupId);
 
         injectAudioConfChanged(testGroupId, BluetoothLeAudio.CONTEXT_TYPE_MEDIA |
-                                 BluetoothLeAudio.CONTEXT_TYPE_COMMUNICATION);
+                                 BluetoothLeAudio.CONTEXT_TYPE_CONVERSATIONAL, 3);
 
         sendEventAndVerifyIntentForGroupStatusChanged(testGroupId, LeAudioStackEvent.GROUP_STATUS_ACTIVE);
         sendEventAndVerifyIntentForGroupStatusChanged(testGroupId, LeAudioStackEvent.GROUP_STATUS_INACTIVE);
@@ -1245,7 +1310,6 @@
                                         INPUT_SELECTABLE_CONFIG,
                                         OUTPUT_SELECTABLE_CONFIG);
 
-
         TestUtils.waitForLooperToFinishScheduledTask(mService.getMainLooper());
         assertThat(onGroupCodecConfChangedCallbackCalled).isTrue();
 
@@ -1265,8 +1329,10 @@
      * Test native interface group status message handling
      */
     @Test
+    @Ignore("b/258573934")
     public void testLeadGroupDeviceDisconnects() {
         int groupId = 1;
+        /* AUDIO_DIRECTION_OUTPUT_BIT = 0x01 */
         int direction = 1;
         int snkAudioLocation = 3;
         int srcAudioLocation = 4;
@@ -1306,8 +1372,12 @@
         assertThat(mService.getActiveDevices().contains(leadDevice)).isTrue();
         verify(mAudioManager, times(1)).handleBluetoothActiveDeviceChanged(eq(leadDevice), any(),
                         any(BluetoothProfileConnectionInfo.class));
-
-        verifyActiveDeviceStateIntent(TIMEOUT_MS, leadDevice);
+        /* Since LeAudioService called AudioManager - assume Audio manager calles properly callback
+         * mAudioManager.onAudioDeviceAdded
+         */
+        mService.notifyActiveDeviceChanged();
+        doReturn(BluetoothDevice.BOND_BONDED).when(mAdapterService).getBondState(leadDevice);
+        verifyActiveDeviceStateIntent(AUDIO_MANAGER_DEVICE_ADD_TIMEOUT_MS, leadDevice);
         injectNoVerifyDeviceDisconnected(leadDevice);
 
         // We should not change the audio device
@@ -1329,8 +1399,10 @@
      * Test native interface group status message handling
      */
     @Test
+    @Ignore("b/258573934")
     public void testLeadGroupDeviceReconnects() {
         int groupId = 1;
+        /* AUDIO_DIRECTION_OUTPUT_BIT = 0x01 */
         int direction = 1;
         int snkAudioLocation = 3;
         int srcAudioLocation = 4;
@@ -1370,8 +1442,12 @@
         assertThat(mService.getActiveDevices().contains(leadDevice)).isTrue();
         verify(mAudioManager, times(1)).handleBluetoothActiveDeviceChanged(eq(leadDevice), any(),
                         any(BluetoothProfileConnectionInfo.class));
+        /* Since LeAudioService called AudioManager - assume Audio manager calles properly callback
+         * mAudioManager.onAudioDeviceAdded
+         */
+        mService.notifyActiveDeviceChanged();
 
-        verifyActiveDeviceStateIntent(TIMEOUT_MS, leadDevice);
+        verifyActiveDeviceStateIntent(AUDIO_MANAGER_DEVICE_ADD_TIMEOUT_MS, leadDevice);
         /* We don't want to distribute DISCONNECTION event, instead will try to reconnect
          * (in native)
          */
@@ -1398,6 +1474,8 @@
     public void testVolumeCache() {
         int groupId = 1;
         int volume = 100;
+        /* AUDIO_DIRECTION_OUTPUT_BIT = 0x01 */
+        int direction = 1;
         int availableContexts = 4;
 
         doReturn(true).when(mNativeInterface).connectLeAudio(any(BluetoothDevice.class));
@@ -1410,9 +1488,9 @@
                         ArgumentCaptor.forClass(BluetoothProfileConnectionInfo.class);
 
         //Add location support.
-        injectAudioConfChanged(groupId, availableContexts);
+        injectAudioConfChanged(groupId, availableContexts, direction);
 
-        doReturn(-1).when(mVolumeControlService).getGroupVolume(groupId);
+        doReturn(-1).when(mVolumeControlService).getAudioDeviceGroupVolume(groupId);
         //Set group and device as active.
         injectGroupStatusChange(groupId, LeAudioStackEvent.GROUP_STATUS_ACTIVE);
 
@@ -1429,7 +1507,7 @@
         verify(mAudioManager, times(1)).handleBluetoothActiveDeviceChanged(eq(null), any(),
                         any(BluetoothProfileConnectionInfo.class));
 
-        doReturn(100).when(mVolumeControlService).getGroupVolume(groupId);
+        doReturn(100).when(mVolumeControlService).getAudioDeviceGroupVolume(groupId);
 
         //Set back to active and check if last volume is restored.
         injectGroupStatusChange(groupId, LeAudioStackEvent.GROUP_STATUS_ACTIVE);
@@ -1439,4 +1517,145 @@
 
         assertThat(profileInfo.getValue().getVolume()).isEqualTo(volume);
     }
+
+    @Test
+    public void testGetAudioDeviceGroupVolume_whenVolumeControlServiceIsNull() {
+        mService.mVolumeControlService = null;
+        doReturn(null).when(mServiceFactory).getVolumeControlService();
+
+        int groupId = 1;
+        assertThat(mService.getAudioDeviceGroupVolume(groupId)).isEqualTo(-1);
+    }
+
+    @Test
+    public void testGetAudioLocation() {
+        doReturn(true).when(mNativeInterface).connectLeAudio(any(BluetoothDevice.class));
+        connectTestDevice(mSingleDevice, testGroupId);
+
+        assertThat(mService.getAudioLocation(null))
+                .isEqualTo(BluetoothLeAudio.AUDIO_LOCATION_INVALID);
+
+        int sinkAudioLocation = 10;
+        LeAudioStackEvent stackEvent =
+                new LeAudioStackEvent(LeAudioStackEvent.EVENT_TYPE_SINK_AUDIO_LOCATION_AVAILABLE);
+        stackEvent.device = mSingleDevice;
+        stackEvent.valueInt1 = sinkAudioLocation;
+        mService.messageFromNative(stackEvent);
+
+        assertThat(mService.getAudioLocation(mSingleDevice)).isEqualTo(sinkAudioLocation);
+    }
+
+    @Test
+    public void testGetConnectedPeerDevices() {
+        doReturn(true).when(mNativeInterface).connectLeAudio(any(BluetoothDevice.class));
+        connectTestDevice(mLeftDevice, testGroupId);
+        connectTestDevice(mRightDevice, testGroupId);
+
+        List<BluetoothDevice> peerDevices = mService.getConnectedPeerDevices(testGroupId);
+        assertThat(peerDevices.contains(mLeftDevice)).isTrue();
+        assertThat(peerDevices.contains(mRightDevice)).isTrue();
+    }
+
+    @Test
+    public void testGetDevicesMatchingConnectionStates() {
+        assertThat(mService.getDevicesMatchingConnectionStates(null)).isEmpty();
+
+        int[] states = new int[] { BluetoothProfile.STATE_CONNECTED };
+        doReturn(null).when(mAdapterService).getBondedDevices();
+        assertThat(mService.getDevicesMatchingConnectionStates(states)).isEmpty();
+
+        doReturn(new BluetoothDevice[] { mSingleDevice }).when(mAdapterService).getBondedDevices();
+        assertThat(mService.getDevicesMatchingConnectionStates(states)).isEmpty();
+    }
+
+    @Test
+    public void testDefaultValuesOfSeveralGetters() {
+        assertThat(mService.getMaximumNumberOfBroadcasts()).isEqualTo(1);
+        assertThat(mService.isPlaying(100)).isFalse();
+        assertThat(mService.isValidDeviceGroup(LE_AUDIO_GROUP_ID_INVALID)).isFalse();
+    }
+
+    @Test
+    public void testHandleGroupIdleDuringCall() {
+        BluetoothDevice headsetDevice = TestUtils.getTestDevice(mAdapter, 5);
+        HeadsetService headsetService = Mockito.mock(HeadsetService.class);
+        when(mServiceFactory.getHeadsetService()).thenReturn(headsetService);
+
+        mService.mHfpHandoverDevice = null;
+        mService.handleGroupIdleDuringCall();
+        verify(headsetService, never()).getActiveDevice();
+
+        mService.mHfpHandoverDevice = headsetDevice;
+        when(headsetService.getActiveDevice()).thenReturn(headsetDevice);
+        mService.handleGroupIdleDuringCall();
+        verify(headsetService).connectAudio();
+        assertThat(mService.mHfpHandoverDevice).isNull();
+
+        mService.mHfpHandoverDevice = headsetDevice;
+        when(headsetService.getActiveDevice()).thenReturn(null);
+        mService.handleGroupIdleDuringCall();
+        verify(headsetService).setActiveDevice(headsetDevice);
+        assertThat(mService.mHfpHandoverDevice).isNull();
+    }
+
+    @Test
+    public void testDump_doesNotCrash() {
+        doReturn(new ParcelUuid[]{BluetoothUuid.LE_AUDIO}).when(mAdapterService)
+                .getRemoteUuids(any(BluetoothDevice.class));
+        doReturn(new BluetoothDevice[]{mSingleDevice}).when(mAdapterService).getBondedDevices();
+        when(mDatabaseManager
+                .getProfileConnectionPolicy(mSingleDevice, BluetoothProfile.LE_AUDIO))
+                .thenReturn(BluetoothProfile.CONNECTION_POLICY_ALLOWED);
+        doReturn(true).when(mNativeInterface).connectLeAudio(any(BluetoothDevice.class));
+        doReturn(true).when(mNativeInterface).disconnectLeAudio(any(BluetoothDevice.class));
+
+        connectTestDevice(mSingleDevice, testGroupId);
+
+        StringBuilder sb = new StringBuilder();
+        mService.dump(sb);
+    }
+
+    /**
+     * Test setting authorization for LeAudio device in the McpService
+     */
+    @Test
+    public void testAuthorizeMcpServiceWhenDeviceConnecting() {
+        int groupId = 1;
+
+        mService.handleBluetoothEnabled();
+        doReturn(true).when(mNativeInterface).connectLeAudio(any(BluetoothDevice.class));
+        connectTestDevice(mLeftDevice, groupId);
+        connectTestDevice(mRightDevice, groupId);
+        verify(mMcpService, times(1)).setDeviceAuthorized(mLeftDevice, true);
+        verify(mMcpService, times(1)).setDeviceAuthorized(mRightDevice, true);
+    }
+
+    /**
+     * Test setting authorization for LeAudio device in the McpService
+     */
+    @Test
+    public void testAuthorizeMcpServiceOnBluetoothEnableAndNodeRemoval() {
+        int groupId = 1;
+
+        doReturn(true).when(mNativeInterface).connectLeAudio(any(BluetoothDevice.class));
+        connectTestDevice(mLeftDevice, groupId);
+        connectTestDevice(mRightDevice, groupId);
+
+        generateGroupNodeAdded(mLeftDevice, groupId);
+        generateGroupNodeAdded(mRightDevice, groupId);
+
+        verify(mMcpService, times(0)).setDeviceAuthorized(mLeftDevice, true);
+        verify(mMcpService, times(0)).setDeviceAuthorized(mRightDevice, true);
+
+        mService.handleBluetoothEnabled();
+
+        verify(mMcpService, times(1)).setDeviceAuthorized(mLeftDevice, true);
+        verify(mMcpService, times(1)).setDeviceAuthorized(mRightDevice, true);
+
+        generateGroupNodeRemoved(mLeftDevice, groupId);
+        verify(mMcpService, times(1)).setDeviceAuthorized(mLeftDevice, false);
+
+        generateGroupNodeRemoved(mRightDevice, groupId);
+        verify(mMcpService, times(1)).setDeviceAuthorized(mRightDevice, false);
+    }
 }
diff --git a/android/app/tests/unit/src/com/android/bluetooth/map/BluetoothMapAccountItemTest.java b/android/app/tests/unit/src/com/android/bluetooth/map/BluetoothMapAccountItemTest.java
new file mode 100644
index 0000000..9b2e2ec
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/map/BluetoothMapAccountItemTest.java
@@ -0,0 +1,278 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.map;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import android.graphics.drawable.ColorDrawable;
+import android.graphics.drawable.Drawable;
+
+import androidx.test.runner.AndroidJUnit4;
+
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+@RunWith(AndroidJUnit4.class)
+public class BluetoothMapAccountItemTest {
+    private static final String TEST_NAME = "test_name";
+    private static final String TEST_PACKAGE_NAME = "test.package.name";
+    private static final String TEST_ID = "1111";
+    private static final String TEST_PROVIDER_AUTHORITY = "test.project.provider";
+    private static final Drawable TEST_DRAWABLE = new ColorDrawable();
+    private static final BluetoothMapUtils.TYPE TEST_TYPE = BluetoothMapUtils.TYPE.EMAIL;
+    private static final String TEST_UCI = "uci";
+    private static final String TEST_UCI_PREFIX = "uci_prefix";
+
+    @Test
+    public void create_withAllParameters() {
+        BluetoothMapAccountItem accountItem = BluetoothMapAccountItem.create(TEST_ID, TEST_NAME,
+                TEST_PACKAGE_NAME, TEST_PROVIDER_AUTHORITY, TEST_DRAWABLE,
+                TEST_TYPE, TEST_UCI, TEST_UCI_PREFIX);
+        assertThat(accountItem.getId()).isEqualTo(TEST_ID);
+        assertThat(accountItem.getAccountId()).isEqualTo(Long.parseLong(TEST_ID));
+        assertThat(accountItem.getName()).isEqualTo(TEST_NAME);
+        assertThat(accountItem.getPackageName()).isEqualTo(TEST_PACKAGE_NAME);
+        assertThat(accountItem.getProviderAuthority()).isEqualTo(TEST_PROVIDER_AUTHORITY);
+        assertThat(accountItem.getIcon()).isEqualTo(TEST_DRAWABLE);
+        assertThat(accountItem.getType()).isEqualTo(TEST_TYPE);
+        assertThat(accountItem.getUci()).isEqualTo(TEST_UCI);
+        assertThat(accountItem.getUciPrefix()).isEqualTo(TEST_UCI_PREFIX);
+    }
+
+    @Test
+    public void create_withoutIdAndUciData() {
+        BluetoothMapAccountItem accountItem = BluetoothMapAccountItem.create(/*id=*/null, TEST_NAME,
+                TEST_PACKAGE_NAME, TEST_PROVIDER_AUTHORITY, TEST_DRAWABLE, TEST_TYPE);
+        assertThat(accountItem.getId()).isNull();
+        assertThat(accountItem.getAccountId()).isEqualTo(-1);
+        assertThat(accountItem.getName()).isEqualTo(TEST_NAME);
+        assertThat(accountItem.getPackageName()).isEqualTo(TEST_PACKAGE_NAME);
+        assertThat(accountItem.getProviderAuthority()).isEqualTo(TEST_PROVIDER_AUTHORITY);
+        assertThat(accountItem.getIcon()).isEqualTo(TEST_DRAWABLE);
+        assertThat(accountItem.getType()).isEqualTo(TEST_TYPE);
+        assertThat(accountItem.getUci()).isNull();
+        assertThat(accountItem.getUciPrefix()).isNull();
+    }
+
+    @Test
+    public void getUciFull() {
+        BluetoothMapAccountItem accountItem = BluetoothMapAccountItem.create(TEST_ID, TEST_NAME,
+                TEST_PACKAGE_NAME, TEST_PROVIDER_AUTHORITY, TEST_DRAWABLE,
+                TEST_TYPE, TEST_UCI, TEST_UCI_PREFIX);
+
+        BluetoothMapAccountItem accountItemWithoutUciPrefix = BluetoothMapAccountItem.create(
+                TEST_ID, TEST_NAME, TEST_PACKAGE_NAME, TEST_PROVIDER_AUTHORITY, TEST_DRAWABLE,
+                TEST_TYPE, TEST_UCI, null);
+
+        BluetoothMapAccountItem accountItemWithoutUci = BluetoothMapAccountItem.create(TEST_ID,
+                TEST_NAME, TEST_PACKAGE_NAME, TEST_PROVIDER_AUTHORITY, TEST_DRAWABLE,
+                TEST_TYPE, null, null);
+
+        assertThat(accountItem.getUciFull()).isEqualTo("uci_prefix:uci");
+        assertThat(accountItemWithoutUciPrefix.getUciFull()).isNull();
+        assertThat(accountItemWithoutUci.getUciFull()).isNull();
+    }
+
+    @Test
+    public void compareIfTwoObjectsAreEqual_returnFalse_whenTypesAreDifferent() {
+        BluetoothMapAccountItem accountItem = BluetoothMapAccountItem.create(TEST_ID, TEST_NAME,
+                TEST_PACKAGE_NAME, TEST_PROVIDER_AUTHORITY, TEST_DRAWABLE,
+                TEST_TYPE, TEST_UCI, TEST_UCI_PREFIX);
+
+        BluetoothMapAccountItem accountItemWithDifferentType = BluetoothMapAccountItem.create(
+                TEST_ID, TEST_NAME, TEST_PACKAGE_NAME, TEST_PROVIDER_AUTHORITY, TEST_DRAWABLE,
+                BluetoothMapUtils.TYPE.MMS);
+
+        assertThat(accountItem.equals(accountItemWithDifferentType)).isFalse();
+        assertThat(accountItem.compareTo(accountItemWithDifferentType)).isEqualTo(-1);
+    }
+
+    @Test
+    public void compareIfTwoObjectsAreEqual_returnTrue_evenWhenUcisAreDifferent() {
+        BluetoothMapAccountItem accountItem = BluetoothMapAccountItem.create(TEST_ID, TEST_NAME,
+                TEST_PACKAGE_NAME, TEST_PROVIDER_AUTHORITY, TEST_DRAWABLE,
+                TEST_TYPE, TEST_UCI, TEST_UCI_PREFIX);
+
+        BluetoothMapAccountItem accountItemWithoutUciData = BluetoothMapAccountItem.create(TEST_ID,
+                TEST_NAME, TEST_PACKAGE_NAME, TEST_PROVIDER_AUTHORITY, TEST_DRAWABLE, TEST_TYPE);
+
+        assertThat(accountItem.equals(accountItemWithoutUciData)).isTrue();
+        assertThat(accountItem.compareTo(accountItemWithoutUciData)).isEqualTo(0);
+    }
+
+    @Test
+    public void equals_withSameInstance() {
+        BluetoothMapAccountItem accountItem = BluetoothMapAccountItem.create(TEST_ID, TEST_NAME,
+                TEST_PACKAGE_NAME, TEST_PROVIDER_AUTHORITY, TEST_DRAWABLE,
+                TEST_TYPE, TEST_UCI, TEST_UCI_PREFIX);
+
+        assertThat(accountItem.equals(accountItem)).isTrue();
+    }
+    @Test
+    public void equals_withNull() {
+        BluetoothMapAccountItem accountItem = BluetoothMapAccountItem.create(TEST_ID, TEST_NAME,
+                TEST_PACKAGE_NAME, TEST_PROVIDER_AUTHORITY, TEST_DRAWABLE,
+                TEST_TYPE, TEST_UCI, TEST_UCI_PREFIX);
+
+        assertThat(accountItem).isNotEqualTo(null);
+    }
+
+    @SuppressWarnings("EqualsIncompatibleType")
+    @Test
+    public void equals_withDifferentClass() {
+        BluetoothMapAccountItem accountItem = BluetoothMapAccountItem.create(TEST_ID, TEST_NAME,
+                TEST_PACKAGE_NAME, TEST_PROVIDER_AUTHORITY, TEST_DRAWABLE,
+                TEST_TYPE, TEST_UCI, TEST_UCI_PREFIX);
+        String accountItemString = "accountItem_string";
+
+        assertThat(accountItem.equals(accountItemString)).isFalse();
+    }
+
+    @Test
+    public void equals_withNullId() {
+        BluetoothMapAccountItem accountItemWithNullId = BluetoothMapAccountItem.create(/*id=*/null,
+                TEST_NAME, TEST_PACKAGE_NAME, TEST_PROVIDER_AUTHORITY, TEST_DRAWABLE, TEST_TYPE,
+                TEST_UCI, TEST_UCI_PREFIX);
+        BluetoothMapAccountItem accountItemWithNonNullId = BluetoothMapAccountItem.create(TEST_ID,
+                TEST_NAME, TEST_PACKAGE_NAME, TEST_PROVIDER_AUTHORITY, TEST_DRAWABLE, TEST_TYPE,
+                TEST_UCI, TEST_UCI_PREFIX);
+
+        assertThat(accountItemWithNullId).isNotEqualTo(accountItemWithNonNullId);
+    }
+
+    @Test
+    public void equals_withDifferentId() {
+        String TEST_ID_DIFFERENT = "2222";
+        BluetoothMapAccountItem accountItem = BluetoothMapAccountItem.create(TEST_ID, TEST_NAME,
+                TEST_PACKAGE_NAME, TEST_PROVIDER_AUTHORITY, TEST_DRAWABLE,
+                TEST_TYPE, TEST_UCI, TEST_UCI_PREFIX);
+        BluetoothMapAccountItem accountItemWithDifferentId = BluetoothMapAccountItem.create(
+                TEST_ID_DIFFERENT, TEST_NAME, TEST_PACKAGE_NAME, TEST_PROVIDER_AUTHORITY,
+                TEST_DRAWABLE, TEST_TYPE, TEST_UCI, TEST_UCI_PREFIX);
+
+        assertThat(accountItem).isNotEqualTo(accountItemWithDifferentId);
+    }
+
+    @Test
+    public void equals_withNullName() {
+        BluetoothMapAccountItem accountItemWithNullName = BluetoothMapAccountItem.create(
+                TEST_ID, /*name=*/null, TEST_PACKAGE_NAME, TEST_PROVIDER_AUTHORITY, TEST_DRAWABLE,
+                TEST_TYPE, TEST_UCI, TEST_UCI_PREFIX);
+        BluetoothMapAccountItem accountItemWithNonNullName = BluetoothMapAccountItem.create(TEST_ID,
+                TEST_NAME, TEST_PACKAGE_NAME, TEST_PROVIDER_AUTHORITY, TEST_DRAWABLE, TEST_TYPE,
+                TEST_UCI, TEST_UCI_PREFIX);
+
+        assertThat(accountItemWithNullName).isNotEqualTo(accountItemWithNonNullName);
+    }
+
+    @Test
+    public void equals_withDifferentName() {
+        String TEST_NAME_DIFFERENT = "test_name_different";
+        BluetoothMapAccountItem accountItem = BluetoothMapAccountItem.create(TEST_ID, TEST_NAME,
+                TEST_PACKAGE_NAME, TEST_PROVIDER_AUTHORITY, TEST_DRAWABLE,
+                TEST_TYPE, TEST_UCI, TEST_UCI_PREFIX);
+        BluetoothMapAccountItem accountItemWithDifferentName = BluetoothMapAccountItem.create(
+                TEST_ID, TEST_NAME_DIFFERENT, TEST_PACKAGE_NAME, TEST_PROVIDER_AUTHORITY,
+                TEST_DRAWABLE, TEST_TYPE, TEST_UCI, TEST_UCI_PREFIX);
+
+        assertThat(accountItem).isNotEqualTo(accountItemWithDifferentName);
+    }
+
+    @Test
+    public void equals_withNullPackageName() {
+        BluetoothMapAccountItem accountItemWithNullPackageName = BluetoothMapAccountItem.create(
+                TEST_ID, TEST_NAME, /*package_name=*/null, TEST_PROVIDER_AUTHORITY, TEST_DRAWABLE,
+                TEST_TYPE, TEST_UCI, TEST_UCI_PREFIX);
+        BluetoothMapAccountItem accountItemWithNonNullPackageName = BluetoothMapAccountItem.create(
+                TEST_ID, TEST_NAME, TEST_PACKAGE_NAME, TEST_PROVIDER_AUTHORITY, TEST_DRAWABLE,
+                TEST_TYPE, TEST_UCI, TEST_UCI_PREFIX);
+
+        assertThat(accountItemWithNullPackageName).isNotEqualTo(accountItemWithNonNullPackageName);
+    }
+
+    @Test
+    public void equals_withDifferentPackageName() {
+        String TEST_PACKAGE_NAME_DIFFERENT = "test.different.package.name";
+        BluetoothMapAccountItem accountItem = BluetoothMapAccountItem.create(TEST_ID, TEST_NAME,
+                TEST_PACKAGE_NAME, TEST_PROVIDER_AUTHORITY, TEST_DRAWABLE,
+                TEST_TYPE, TEST_UCI, TEST_UCI_PREFIX);
+        BluetoothMapAccountItem accountItemWithDifferentPackageName =
+                BluetoothMapAccountItem.create(TEST_ID, TEST_NAME, TEST_PACKAGE_NAME_DIFFERENT,
+                        TEST_PROVIDER_AUTHORITY, TEST_DRAWABLE, TEST_TYPE, TEST_UCI,
+                        TEST_UCI_PREFIX);
+
+        assertThat(accountItem).isNotEqualTo(accountItemWithDifferentPackageName);
+    }
+
+    @Test
+    public void equals_withNullAuthority() {
+        BluetoothMapAccountItem accountItemWithNullAuthority = BluetoothMapAccountItem.create(
+                TEST_ID, TEST_NAME, TEST_PACKAGE_NAME, /*provider_authority=*/null, TEST_DRAWABLE,
+                TEST_TYPE, TEST_UCI, TEST_UCI_PREFIX);
+        BluetoothMapAccountItem accountItemWithNonNullAuthority = BluetoothMapAccountItem.create(
+                TEST_ID, TEST_NAME, TEST_PACKAGE_NAME, TEST_PROVIDER_AUTHORITY, TEST_DRAWABLE,
+                TEST_TYPE, TEST_UCI, TEST_UCI_PREFIX);
+
+        assertThat(accountItemWithNullAuthority).isNotEqualTo(accountItemWithNonNullAuthority);
+    }
+
+    @Test
+    public void equals_withDifferentAuthority() {
+        String TEST_PROVIDER_AUTHORITY_DIFFERENT = "test.project.different.provider";
+        BluetoothMapAccountItem accountItem = BluetoothMapAccountItem.create(TEST_ID, TEST_NAME,
+                TEST_PACKAGE_NAME, TEST_PROVIDER_AUTHORITY, TEST_DRAWABLE,
+                TEST_TYPE, TEST_UCI, TEST_UCI_PREFIX);
+        BluetoothMapAccountItem accountItemWithDifferentAuthority =
+                BluetoothMapAccountItem.create(TEST_ID, TEST_NAME, TEST_PACKAGE_NAME,
+                        TEST_PROVIDER_AUTHORITY_DIFFERENT, TEST_DRAWABLE, TEST_TYPE, TEST_UCI,
+                        TEST_UCI_PREFIX);
+
+        assertThat(accountItem).isNotEqualTo(accountItemWithDifferentAuthority);
+    }
+
+    @Test
+    public void equals_withNullType() {
+        BluetoothMapAccountItem accountItemWithNullType = BluetoothMapAccountItem.create(
+                TEST_ID, TEST_NAME, TEST_PACKAGE_NAME, TEST_PROVIDER_AUTHORITY, TEST_DRAWABLE,
+                /*type=*/null, TEST_UCI, TEST_UCI_PREFIX);
+        BluetoothMapAccountItem accountItemWithNonNullType = BluetoothMapAccountItem.create(TEST_ID,
+                TEST_NAME, TEST_PACKAGE_NAME, TEST_PROVIDER_AUTHORITY, TEST_DRAWABLE, TEST_TYPE,
+                TEST_UCI, TEST_UCI_PREFIX);
+
+        assertThat(accountItemWithNullType).isNotEqualTo(accountItemWithNonNullType);
+    }
+
+    @Test
+    public void hashCode_withOnlyIdNotNull() {
+        BluetoothMapAccountItem accountItem = BluetoothMapAccountItem.create(TEST_ID, null,
+                null, null, null, null);
+
+        int expected = (31 + TEST_ID.hashCode()) * 31 * 31 * 31;
+        assertThat(accountItem.hashCode()).isEqualTo(expected);
+    }
+
+    @Test
+    public void toString_returnsNameAndUriInfo() {
+        BluetoothMapAccountItem accountItem = BluetoothMapAccountItem.create(TEST_ID, TEST_NAME,
+                TEST_PACKAGE_NAME, TEST_PROVIDER_AUTHORITY, TEST_DRAWABLE,
+                TEST_TYPE, TEST_UCI, TEST_UCI_PREFIX);
+
+        String expected =
+                TEST_NAME + " (" + "content://" + TEST_PROVIDER_AUTHORITY + "/" + TEST_ID + ")";
+        assertThat(accountItem.toString()).isEqualTo(expected);
+    }
+}
\ No newline at end of file
diff --git a/android/app/tests/unit/src/com/android/bluetooth/map/BluetoothMapAppParamsTest.java b/android/app/tests/unit/src/com/android/bluetooth/map/BluetoothMapAppParamsTest.java
new file mode 100644
index 0000000..900835a
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/map/BluetoothMapAppParamsTest.java
@@ -0,0 +1,371 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.map;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import static org.junit.Assert.assertThrows;
+
+import androidx.test.filters.SmallTest;
+import androidx.test.runner.AndroidJUnit4;
+
+import com.android.bluetooth.SignedLongLong;
+
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+import java.nio.ByteBuffer;
+
+@SmallTest
+@RunWith(AndroidJUnit4.class)
+public class BluetoothMapAppParamsTest {
+    public static final long TEST_PARAMETER_MASK = 1;
+    public static final int TEST_MAX_LIST_COUNT = 3;
+    public static final int TEST_START_OFFSET = 1;
+    public static final int TEST_FILTER_MESSAGE_TYPE = 1;
+    public static final int TEST_FILTER_PRIORITY = 1;
+    public static final int TEST_ATTACHMENT = 1;
+    public static final int TEST_CHARSET = 1;
+    public static final int TEST_CHAT_STATE = 1;
+    public static final long TEST_ID_HIGH = 1;
+    public static final long TEST_ID_LOW = 1;
+    public static final int TEST_CONVO_LISTING_SIZE = 1;
+    public static final long TEST_COUNT_LOW = 1;
+    public static final long TEST_COUNT_HIGH = 1;
+    public static final long TEST_CONVO_PARAMETER_MASK = 1;
+    public static final String TEST_FILTER_CONVO_ID = "1111";
+    public static final long TEST_FILTER_LAST_ACTIVITY_BEGIN = 0;
+    public static final long TEST_FILTER_LAST_ACTIVITY_END = 0;
+    public static final String TEST_FILTER_MSG_HANDLE = "1";
+    public static final String TEST_FILTER_ORIGINATOR = "test_filter_originator";
+    public static final long TEST_FILTER_PERIOD_BEGIN = 0;
+    public static final long TEST_FILTER_PERIOD_END = 0;
+    public static final int TEST_FILTER_PRESENCE = 1;
+    public static final int TEST_FILTER_READ_STATUS = 1;
+    public static final String TEST_FILTER_RECIPIENT = "test_filter_recipient";
+    public static final int TEST_FOLDER_LISTING_SIZE = 1;
+    public static final int TEST_FILTER_UID_PRESENT = 1;
+    public static final int TEST_FRACTION_DELIVER = 1;
+    public static final int TEST_FRACTION_REQUEST = 1;
+    public static final long TEST_LAST_ACTIVITY = 0;
+    public static final int TEST_MAS_INSTANCE_ID = 1;
+    public static final int TEST_MESSAGE_LISTING_SIZE = 1;
+    public static final long TEST_MSE_TIME = 0;
+    public static final int TEST_NEW_MESSAGE = 1;
+    public static final long TEST_NOTIFICATION_FILTER = 1;
+    public static final int TEST_NOTIFICATION_STATUS = 1;
+    public static final int TEST_PRESENCE_AVAILABILITY = 1;
+    public static final String TEST_PRESENCE_STATUS = "test_presence_status";
+    public static final int TEST_RETRY = 1;
+    public static final int TEST_STATUS_INDICATOR = 1;
+    public static final int TEST_STATUS_VALUE = 1;
+    public static final int TEST_SUBJECT_LENGTH = 1;
+    public static final int TEST_TRANSPARENT = 1;
+
+    @Test
+    public void encodeToBuffer_thenDecode() throws Exception {
+        ByteBuffer ret = ByteBuffer.allocate(16);
+        ret.putLong(TEST_COUNT_HIGH);
+        ret.putLong(TEST_COUNT_LOW);
+
+        BluetoothMapAppParams appParams = new BluetoothMapAppParams();
+        appParams.setMaxListCount(TEST_MAX_LIST_COUNT);
+        appParams.setStartOffset(TEST_START_OFFSET);
+        appParams.setFilterMessageType(TEST_FILTER_MESSAGE_TYPE);
+        appParams.setFilterPeriodBegin(TEST_FILTER_PERIOD_BEGIN);
+        appParams.setFilterPeriodEnd(TEST_FILTER_PERIOD_END);
+        appParams.setFilterReadStatus(TEST_FILTER_READ_STATUS);
+        appParams.setFilterRecipient(TEST_FILTER_RECIPIENT);
+        appParams.setFilterOriginator(TEST_FILTER_ORIGINATOR);
+        appParams.setFilterPriority(TEST_FILTER_PRIORITY);
+        appParams.setAttachment(TEST_ATTACHMENT);
+        appParams.setTransparent(TEST_TRANSPARENT);
+        appParams.setRetry(TEST_RETRY);
+        appParams.setNewMessage(TEST_NEW_MESSAGE);
+        appParams.setNotificationFilter(TEST_NOTIFICATION_FILTER);
+        appParams.setMasInstanceId(TEST_MAS_INSTANCE_ID);
+        appParams.setParameterMask(TEST_PARAMETER_MASK);
+        appParams.setFolderListingSize(TEST_FOLDER_LISTING_SIZE);
+        appParams.setMessageListingSize(TEST_MESSAGE_LISTING_SIZE);
+        appParams.setSubjectLength(TEST_SUBJECT_LENGTH);
+        appParams.setCharset(TEST_CHARSET);
+        appParams.setFractionRequest(TEST_FRACTION_REQUEST);
+        appParams.setFractionDeliver(TEST_FRACTION_DELIVER);
+        appParams.setStatusIndicator(TEST_STATUS_INDICATOR);
+        appParams.setStatusValue(TEST_STATUS_VALUE);
+        appParams.setMseTime(TEST_MSE_TIME);
+        appParams.setDatabaseIdentifier(TEST_ID_HIGH, TEST_ID_LOW);
+        appParams.setConvoListingVerCounter(TEST_COUNT_LOW, TEST_COUNT_HIGH);
+        appParams.setPresenceStatus(TEST_PRESENCE_STATUS);
+        appParams.setLastActivity(TEST_LAST_ACTIVITY);
+        appParams.setConvoListingSize(TEST_CONVO_LISTING_SIZE);
+        appParams.setChatStateConvoId(TEST_ID_HIGH, TEST_ID_LOW);
+        appParams.setFolderVerCounter(TEST_COUNT_LOW, TEST_COUNT_HIGH);
+
+        byte[] encodedParams = appParams.encodeParams();
+        BluetoothMapAppParams appParamsDecoded = new BluetoothMapAppParams(encodedParams);
+
+        assertThat(appParamsDecoded.getMaxListCount()).isEqualTo(TEST_MAX_LIST_COUNT);
+        assertThat(appParamsDecoded.getStartOffset()).isEqualTo(TEST_START_OFFSET);
+        assertThat(appParamsDecoded.getFilterMessageType()).isEqualTo(TEST_FILTER_MESSAGE_TYPE);
+        assertThat(appParamsDecoded.getFilterPeriodBegin()).isEqualTo(TEST_FILTER_PERIOD_BEGIN);
+        assertThat(appParamsDecoded.getFilterPeriodEnd()).isEqualTo(TEST_FILTER_PERIOD_END);
+        assertThat(appParamsDecoded.getFilterReadStatus()).isEqualTo(TEST_FILTER_READ_STATUS);
+        assertThat(appParamsDecoded.getFilterRecipient()).isEqualTo(TEST_FILTER_RECIPIENT);
+        assertThat(appParamsDecoded.getFilterOriginator()).isEqualTo(TEST_FILTER_ORIGINATOR);
+        assertThat(appParamsDecoded.getFilterPriority()).isEqualTo(TEST_FILTER_PRIORITY);
+        assertThat(appParamsDecoded.getAttachment()).isEqualTo(TEST_ATTACHMENT);
+        assertThat(appParamsDecoded.getTransparent()).isEqualTo(TEST_TRANSPARENT);
+        assertThat(appParamsDecoded.getRetry()).isEqualTo(TEST_RETRY);
+        assertThat(appParamsDecoded.getNewMessage()).isEqualTo(TEST_NEW_MESSAGE);
+        assertThat(appParamsDecoded.getNotificationFilter()).isEqualTo(TEST_NOTIFICATION_FILTER);
+        assertThat(appParamsDecoded.getMasInstanceId()).isEqualTo(TEST_MAS_INSTANCE_ID);
+        assertThat(appParamsDecoded.getParameterMask()).isEqualTo(TEST_PARAMETER_MASK);
+        assertThat(appParamsDecoded.getFolderListingSize()).isEqualTo(TEST_FOLDER_LISTING_SIZE);
+        assertThat(appParamsDecoded.getMessageListingSize()).isEqualTo(TEST_MESSAGE_LISTING_SIZE);
+        assertThat(appParamsDecoded.getSubjectLength()).isEqualTo(TEST_SUBJECT_LENGTH);
+        assertThat(appParamsDecoded.getCharset()).isEqualTo(TEST_CHARSET);
+        assertThat(appParamsDecoded.getFractionRequest()).isEqualTo(TEST_FRACTION_REQUEST);
+        assertThat(appParamsDecoded.getFractionDeliver()).isEqualTo(TEST_FRACTION_DELIVER);
+        assertThat(appParamsDecoded.getStatusIndicator()).isEqualTo(TEST_STATUS_INDICATOR);
+        assertThat(appParamsDecoded.getStatusValue()).isEqualTo(TEST_STATUS_VALUE);
+        assertThat(appParamsDecoded.getMseTime()).isEqualTo(TEST_MSE_TIME);
+        assertThat(appParamsDecoded.getDatabaseIdentifier()).isEqualTo(ret.array());
+        assertThat(appParamsDecoded.getConvoListingVerCounter()).isEqualTo(ret.array());
+        assertThat(appParamsDecoded.getPresenceStatus()).isEqualTo(TEST_PRESENCE_STATUS);
+        assertThat(appParamsDecoded.getLastActivity()).isEqualTo(TEST_LAST_ACTIVITY);
+        assertThat(appParamsDecoded.getConvoListingSize()).isEqualTo(TEST_CONVO_LISTING_SIZE);
+        assertThat(appParamsDecoded.getChatStateConvoId()).isEqualTo(new SignedLongLong(
+                TEST_ID_HIGH, TEST_ID_LOW));
+    }
+    @Test
+    public void settersAndGetters() throws Exception {
+        ByteBuffer ret = ByteBuffer.allocate(16);
+        ret.putLong(TEST_COUNT_HIGH);
+        ret.putLong(TEST_COUNT_LOW);
+
+        BluetoothMapAppParams appParams = new BluetoothMapAppParams();
+        appParams.setParameterMask(TEST_PARAMETER_MASK);
+        appParams.setMaxListCount(TEST_MAX_LIST_COUNT);
+        appParams.setStartOffset(TEST_START_OFFSET);
+        appParams.setFilterMessageType(TEST_FILTER_MESSAGE_TYPE);
+        appParams.setFilterPriority(TEST_FILTER_PRIORITY);
+        appParams.setAttachment(TEST_ATTACHMENT);
+        appParams.setCharset(TEST_CHARSET);
+        appParams.setChatState(TEST_CHAT_STATE);
+        appParams.setChatStateConvoId(TEST_ID_HIGH, TEST_ID_LOW);
+        appParams.setConvoListingSize(TEST_CONVO_LISTING_SIZE);
+        appParams.setConvoListingVerCounter(TEST_COUNT_LOW, TEST_COUNT_HIGH);
+        appParams.setConvoParameterMask(TEST_CONVO_PARAMETER_MASK);
+        appParams.setDatabaseIdentifier(TEST_ID_HIGH, TEST_ID_LOW);
+        appParams.setFilterConvoId(TEST_FILTER_CONVO_ID);
+        appParams.setFilterMsgHandle(TEST_FILTER_MSG_HANDLE);
+        appParams.setFilterOriginator(TEST_FILTER_ORIGINATOR);
+        appParams.setFilterPresence(TEST_FILTER_PRESENCE);
+        appParams.setFilterReadStatus(TEST_FILTER_READ_STATUS);
+        appParams.setFilterRecipient(TEST_FILTER_RECIPIENT);
+        appParams.setFolderListingSize(TEST_FOLDER_LISTING_SIZE);
+        appParams.setFilterUidPresent(TEST_FILTER_UID_PRESENT);
+        appParams.setFolderVerCounter(TEST_COUNT_LOW, TEST_COUNT_HIGH);
+        appParams.setFractionDeliver(TEST_FRACTION_DELIVER);
+        appParams.setFractionRequest(TEST_FRACTION_REQUEST);
+        appParams.setMasInstanceId(TEST_MAS_INSTANCE_ID);
+        appParams.setMessageListingSize(TEST_MESSAGE_LISTING_SIZE);
+        appParams.setNewMessage(TEST_NEW_MESSAGE);
+        appParams.setNotificationFilter(TEST_NOTIFICATION_FILTER);
+        appParams.setNotificationStatus(TEST_NOTIFICATION_STATUS);
+        appParams.setPresenceAvailability(TEST_PRESENCE_AVAILABILITY);
+        appParams.setPresenceStatus(TEST_PRESENCE_STATUS);
+        appParams.setRetry(TEST_RETRY);
+        appParams.setStatusIndicator(TEST_STATUS_INDICATOR);
+        appParams.setStatusValue(TEST_STATUS_VALUE);
+        appParams.setSubjectLength(TEST_SUBJECT_LENGTH);
+        appParams.setTransparent(TEST_TRANSPARENT);
+
+        assertThat(appParams.getParameterMask()).isEqualTo(TEST_PARAMETER_MASK);
+        assertThat(appParams.getMaxListCount()).isEqualTo(TEST_MAX_LIST_COUNT);
+        assertThat(appParams.getStartOffset()).isEqualTo(TEST_START_OFFSET);
+        assertThat(appParams.getFilterMessageType()).isEqualTo(TEST_FILTER_MESSAGE_TYPE);
+        assertThat(appParams.getFilterPriority()).isEqualTo(TEST_FILTER_PRIORITY);
+        assertThat(appParams.getAttachment()).isEqualTo(TEST_ATTACHMENT);
+        assertThat(appParams.getCharset()).isEqualTo(TEST_CHARSET);
+        assertThat(appParams.getChatState()).isEqualTo(TEST_CHAT_STATE);
+        assertThat(appParams.getChatStateConvoId()).isEqualTo(new SignedLongLong(
+                TEST_ID_HIGH, TEST_ID_LOW));
+        assertThat(appParams.getChatStateConvoIdByteArray()).isEqualTo(ret.array());
+        assertThat(appParams.getChatStateConvoIdString()).isEqualTo(new String(ret.array()));
+        assertThat(appParams.getConvoListingSize()).isEqualTo(TEST_CONVO_LISTING_SIZE);
+        assertThat(appParams.getConvoListingVerCounter()).isEqualTo(ret.array());
+        assertThat(appParams.getConvoParameterMask()).isEqualTo(TEST_CONVO_PARAMETER_MASK);
+        assertThat(appParams.getDatabaseIdentifier()).isEqualTo(ret.array());
+        assertThat(appParams.getFilterConvoId()).isEqualTo(
+                SignedLongLong.fromString(TEST_FILTER_CONVO_ID));
+        assertThat(appParams.getFilterConvoIdString()).isEqualTo(BluetoothMapUtils.getLongAsString(
+                SignedLongLong.fromString(TEST_FILTER_CONVO_ID).getLeastSignificantBits()));
+        assertThat(appParams.getFilterMsgHandle()).isEqualTo(
+                BluetoothMapUtils.getLongFromString(TEST_FILTER_MSG_HANDLE));
+        assertThat(appParams.getFilterMsgHandleString()).isEqualTo(
+                BluetoothMapUtils.getLongAsString(appParams.getFilterMsgHandle()));
+        assertThat(appParams.getFilterOriginator()).isEqualTo(TEST_FILTER_ORIGINATOR);
+        assertThat(appParams.getFilterPresence()).isEqualTo(TEST_FILTER_PRESENCE);
+        assertThat(appParams.getFilterReadStatus()).isEqualTo(TEST_FILTER_READ_STATUS);
+        assertThat(appParams.getFilterRecipient()).isEqualTo(TEST_FILTER_RECIPIENT);
+        assertThat(appParams.getFolderListingSize()).isEqualTo(TEST_FOLDER_LISTING_SIZE);
+        assertThat(appParams.getFilterUidPresent()).isEqualTo(TEST_FILTER_UID_PRESENT);
+        assertThat(appParams.getFolderVerCounter()).isEqualTo(ret.array());
+        assertThat(appParams.getFractionDeliver()).isEqualTo(TEST_FRACTION_DELIVER);
+        assertThat(appParams.getFractionRequest()).isEqualTo(TEST_FRACTION_REQUEST);
+        assertThat(appParams.getMasInstanceId()).isEqualTo(TEST_MAS_INSTANCE_ID);
+        assertThat(appParams.getMessageListingSize()).isEqualTo(TEST_MESSAGE_LISTING_SIZE);
+        assertThat(appParams.getNewMessage()).isEqualTo(TEST_NEW_MESSAGE);
+        assertThat(appParams.getNotificationFilter()).isEqualTo(TEST_NOTIFICATION_FILTER);
+        assertThat(appParams.getNotificationStatus()).isEqualTo(TEST_NOTIFICATION_STATUS);
+        assertThat(appParams.getPresenceAvailability()).isEqualTo(TEST_PRESENCE_AVAILABILITY);
+        assertThat(appParams.getPresenceStatus()).isEqualTo(TEST_PRESENCE_STATUS);
+        assertThat(appParams.getRetry()).isEqualTo(TEST_RETRY);
+        assertThat(appParams.getStatusIndicator()).isEqualTo(TEST_STATUS_INDICATOR);
+        assertThat(appParams.getStatusValue()).isEqualTo(TEST_STATUS_VALUE);
+        assertThat(appParams.getSubjectLength()).isEqualTo(TEST_SUBJECT_LENGTH);
+        assertThat(appParams.getTransparent()).isEqualTo(TEST_TRANSPARENT);
+    }
+
+    @Test
+    public void setAndGetFilterLastActivity_withString() throws Exception {
+        BluetoothMapAppParams appParams = new BluetoothMapAppParams();
+        appParams.setFilterLastActivityBegin(TEST_FILTER_LAST_ACTIVITY_BEGIN);
+        appParams.setFilterLastActivityEnd(TEST_FILTER_LAST_ACTIVITY_END);
+        String lastActivityBeginString = appParams.getFilterLastActivityBeginString();
+        String lastActivityEndString = appParams.getFilterLastActivityEndString();
+
+        appParams.setFilterLastActivityBegin(lastActivityBeginString);
+        appParams.setFilterLastActivityEnd(lastActivityEndString);
+
+        assertThat(appParams.getFilterLastActivityBegin()).isEqualTo(
+                TEST_FILTER_LAST_ACTIVITY_BEGIN);
+        assertThat(appParams.getFilterLastActivityEnd()).isEqualTo(TEST_FILTER_LAST_ACTIVITY_END);
+    }
+
+    @Test
+    public void setAndGetLastActivity_withString() throws Exception {
+        BluetoothMapAppParams appParams = new BluetoothMapAppParams();
+        appParams.setLastActivity(TEST_LAST_ACTIVITY);
+        String lastActivityString = appParams.getLastActivityString();
+
+        appParams.setLastActivity(lastActivityString);
+
+        assertThat(appParams.getLastActivity()).isEqualTo(TEST_LAST_ACTIVITY);
+    }
+
+    @Test
+    public void setAndGetFilterPeriod_withString() throws Exception {
+        BluetoothMapAppParams appParams = new BluetoothMapAppParams();
+        appParams.setFilterPeriodBegin(TEST_FILTER_PERIOD_BEGIN);
+        appParams.setFilterPeriodEnd(TEST_FILTER_PERIOD_END);
+        String filterPeriodBeginString = appParams.getFilterPeriodBeginString();
+        String filterPeriodEndString = appParams.getFilterPeriodEndString();
+
+        appParams.setFilterPeriodBegin(filterPeriodBeginString);
+        appParams.setFilterPeriodEnd(filterPeriodEndString);
+
+        assertThat(appParams.getFilterPeriodBegin()).isEqualTo(TEST_FILTER_PERIOD_BEGIN);
+        assertThat(appParams.getFilterPeriodEnd()).isEqualTo(TEST_FILTER_PERIOD_END);
+    }
+
+    @Test
+    public void setAndGetMseTime_withString() throws Exception {
+        BluetoothMapAppParams appParams = new BluetoothMapAppParams();
+        appParams.setMseTime(TEST_MSE_TIME);
+        String mseTimeString = appParams.getMseTimeString();
+
+        appParams.setMseTime(mseTimeString);
+
+        assertThat(appParams.getMseTime()).isEqualTo(TEST_MSE_TIME);
+    }
+
+    @Test
+    public void setters_withIllegalArguments() {
+        BluetoothMapAppParams appParams = new BluetoothMapAppParams();
+        int ILLEGAL_PARAMETER_INT = -2;
+        long ILLEGAL_PARAMETER_LONG = -2;
+
+        assertThrows(IllegalArgumentException.class,
+                () -> appParams.setAttachment(ILLEGAL_PARAMETER_INT));
+        assertThrows(IllegalArgumentException.class,
+                () -> appParams.setCharset(ILLEGAL_PARAMETER_INT));
+        assertThrows(IllegalArgumentException.class,
+                () -> appParams.setChatState(ILLEGAL_PARAMETER_INT));
+        assertThrows(IllegalArgumentException.class,
+                () -> appParams.setConvoListingSize(ILLEGAL_PARAMETER_INT));
+        assertThrows(IllegalArgumentException.class,
+                () -> appParams.setConvoParameterMask(ILLEGAL_PARAMETER_LONG));
+        assertThrows(IllegalArgumentException.class,
+                () -> appParams.setFilterMessageType(ILLEGAL_PARAMETER_INT));
+        assertThrows(IllegalArgumentException.class,
+                () -> appParams.setFilterPresence(ILLEGAL_PARAMETER_INT));
+        assertThrows(IllegalArgumentException.class,
+                () -> appParams.setFilterPriority(ILLEGAL_PARAMETER_INT));
+        assertThrows(IllegalArgumentException.class,
+                () -> appParams.setFilterReadStatus(ILLEGAL_PARAMETER_INT));
+        assertThrows(IllegalArgumentException.class,
+                () -> appParams.setFilterUidPresent(ILLEGAL_PARAMETER_INT));
+        assertThrows(IllegalArgumentException.class,
+                () -> appParams.setFolderListingSize(ILLEGAL_PARAMETER_INT));
+        assertThrows(IllegalArgumentException.class,
+                () -> appParams.setFractionDeliver(ILLEGAL_PARAMETER_INT));
+        assertThrows(IllegalArgumentException.class,
+                () -> appParams.setFractionRequest(ILLEGAL_PARAMETER_INT));
+        assertThrows(IllegalArgumentException.class,
+                () -> appParams.setMasInstanceId(ILLEGAL_PARAMETER_INT));
+        assertThrows(IllegalArgumentException.class,
+                () -> appParams.setMaxListCount(ILLEGAL_PARAMETER_INT));
+        assertThrows(IllegalArgumentException.class,
+                () -> appParams.setMessageListingSize(ILLEGAL_PARAMETER_INT));
+        assertThrows(IllegalArgumentException.class,
+                () -> appParams.setNewMessage(ILLEGAL_PARAMETER_INT));
+        assertThrows(IllegalArgumentException.class,
+                () -> appParams.setNotificationFilter(ILLEGAL_PARAMETER_LONG));
+        assertThrows(IllegalArgumentException.class,
+                () -> appParams.setNotificationStatus(ILLEGAL_PARAMETER_INT));
+        assertThrows(IllegalArgumentException.class,
+                () -> appParams.setParameterMask(ILLEGAL_PARAMETER_LONG));
+        assertThrows(IllegalArgumentException.class,
+                () -> appParams.setPresenceAvailability(ILLEGAL_PARAMETER_INT));
+        assertThrows(IllegalArgumentException.class,
+                () -> appParams.setRetry(ILLEGAL_PARAMETER_INT));
+        assertThrows(IllegalArgumentException.class,
+                () -> appParams.setStartOffset(ILLEGAL_PARAMETER_INT));
+        assertThrows(IllegalArgumentException.class,
+                () -> appParams.setStatusIndicator(ILLEGAL_PARAMETER_INT));
+        assertThrows(IllegalArgumentException.class,
+                () -> appParams.setStatusValue(ILLEGAL_PARAMETER_INT));
+        assertThrows(IllegalArgumentException.class,
+                () -> appParams.setSubjectLength(ILLEGAL_PARAMETER_INT));
+        assertThrows(IllegalArgumentException.class,
+                () -> appParams.setTransparent(ILLEGAL_PARAMETER_INT));
+    }
+
+    @Test
+    public void setters_withIllegalStrings() {
+        BluetoothMapAppParams appParams = new BluetoothMapAppParams();
+
+        appParams.setFilterConvoId(" ");
+        appParams.setFilterMsgHandle("=");
+
+        assertThat(appParams.getFilterConvoId()).isNull();
+        assertThat(appParams.getFilterMsgHandle()).isEqualTo(-1);
+    }
+}
\ No newline at end of file
diff --git a/android/app/tests/unit/src/com/android/bluetooth/map/BluetoothMapContentObserverTest.java b/android/app/tests/unit/src/com/android/bluetooth/map/BluetoothMapContentObserverTest.java
index 71963c3..b0f6bbe 100644
--- a/android/app/tests/unit/src/com/android/bluetooth/map/BluetoothMapContentObserverTest.java
+++ b/android/app/tests/unit/src/com/android/bluetooth/map/BluetoothMapContentObserverTest.java
@@ -18,45 +18,134 @@
 
 import static org.mockito.Mockito.*;
 
+import android.app.Activity;
+import android.content.ContentProviderClient;
 import android.content.ContentValues;
 import android.content.Context;
+import android.content.Intent;
 import android.database.Cursor;
+import android.database.MatrixCursor;
 import android.database.sqlite.SQLiteException;
 import android.net.Uri;
+import android.os.Handler;
 import android.os.Looper;
 import android.os.RemoteException;
 import android.os.UserManager;
+import android.provider.ContactsContract;
+import android.provider.Telephony;
 import android.provider.Telephony.Mms;
 import android.provider.Telephony.Sms;
 import android.telephony.TelephonyManager;
 import android.test.mock.MockContentProvider;
 import android.test.mock.MockContentResolver;
 
-import androidx.test.InstrumentationRegistry;
 import androidx.test.filters.MediumTest;
 import androidx.test.runner.AndroidJUnit4;
 
-import com.android.bluetooth.R;
+import com.android.bluetooth.BluetoothMethodProxy;
+import com.android.bluetooth.SignedLongLong;
+import com.android.bluetooth.map.BluetoothMapUtils.TYPE;
+import com.android.bluetooth.mapapi.BluetoothMapContract;
+import com.android.bluetooth.mapapi.BluetoothMapContract.MessageColumns;
+import com.android.obex.ResponseCodes;
 
+import com.google.android.mms.pdu.PduHeaders;
+
+import org.junit.After;
 import org.junit.Assert;
 import org.junit.Assume;
 import org.junit.Before;
 import org.junit.Test;
 import org.junit.runner.RunWith;
+import org.mockito.Mock;
 import org.mockito.Mockito;
+import org.mockito.MockitoAnnotations;
+import org.mockito.Spy;
 
 import java.io.IOException;
+import java.text.SimpleDateFormat;
+import java.util.Calendar;
+import java.util.HashMap;
 import java.util.HashSet;
+import java.util.Map;
+import java.util.concurrent.TimeUnit;
 
 @MediumTest
 @RunWith(AndroidJUnit4.class)
 public class BluetoothMapContentObserverTest {
     static final String TEST_NUMBER_ONE = "5551212";
     static final String TEST_NUMBER_TWO = "5551234";
-    private Context mTargetContext;
+    static final int TEST_ID = 1;
+    static final long TEST_HANDLE_ONE = 1;
+    static final long TEST_HANDLE_TWO = 2;
+    static final String TEST_URI_STR = "http://www.google.com";
+    static final int TEST_STATUS_VALUE = 1;
+    static final int TEST_THREAD_ID = 1;
+    static final long TEST_OLD_THREAD_ID = 2;
+    static final int TEST_PLACEHOLDER_INT = 1;
+    static final String TEST_ADDRESS = "test_address";
+    static final long TEST_DELETE_FOLDER_ID = BluetoothMapContract.FOLDER_ID_DELETED;
+    static final long TEST_INBOX_FOLDER_ID = BluetoothMapContract.FOLDER_ID_INBOX;
+    static final long TEST_SENT_FOLDER_ID = BluetoothMapContract.FOLDER_ID_SENT;
+    static final long TEST_DRAFT_FOLDER_ID = BluetoothMapContract.FOLDER_ID_DRAFT;
+    static final long TEST_OLD_FOLDER_ID = 6;
+    static final int TEST_READ_FLAG_ONE = 1;
+    static final int TEST_READ_FLAG_ZERO = 0;
+    static final long TEST_DATE_MS = Calendar.getInstance().getTimeInMillis();
+    static final long TEST_DATE_SEC = TimeUnit.MILLISECONDS.toSeconds(TEST_DATE_MS);
+    static final String TEST_SUBJECT = "subject";
+    static final int TEST_MMS_MTYPE = 1;
+    static final int TEST_MMS_TYPE_ALL = Telephony.BaseMmsColumns.MESSAGE_BOX_ALL;
+    static final int TEST_MMS_TYPE_INBOX = Telephony.BaseMmsColumns.MESSAGE_BOX_INBOX;
+    static final int TEST_SMS_TYPE_ALL = Telephony.TextBasedSmsColumns.MESSAGE_TYPE_ALL;
+    static final int TEST_SMS_TYPE_INBOX = Telephony.BaseMmsColumns.MESSAGE_BOX_INBOX;
+    static final Uri TEST_URI = Mms.CONTENT_URI;
+    static final String TEST_AUTHORITY = "test_authority";
+
+    static final long TEST_CONVO_ID = 1;
+    static final String TEST_NAME = "col_name";
+    static final String TEST_DISPLAY_NAME = "col_nickname";
+    static final String TEST_BT_UID = "1111";
+    static final int TEST_CHAT_STATE = 1;
+    static final int TEST_CHAT_STATE_DIFFERENT = 2;
+    static final String TEST_UCI = "col_uci";
+    static final String TEST_UCI_DIFFERENT = "col_uci_different";
+    static final long TEST_LAST_ACTIVITY = 1;
+    static final int TEST_PRESENCE_STATE = 1;
+    static final int TEST_PRESENCE_STATE_DIFFERENT = 2;
+    static final String TEST_STATUS_TEXT = "col_status_text";
+    static final String TEST_STATUS_TEXT_DIFFERENT = "col_status_text_different";
+    static final int TEST_PRIORITY = 1;
+    static final int TEST_LAST_ONLINE = 1;
+
+    @Mock
+    private BluetoothMnsObexClient mClient;
+    @Mock
+    private BluetoothMapMasInstance mInstance;
+    @Mock
+    private TelephonyManager mTelephonyManager;
+    @Mock
+    private UserManager mUserService;
+    @Mock
+    private Context mContext;
+    @Mock
+    private ContentProviderClient mProviderClient;
+    @Mock
+    private BluetoothMapAccountItem mItem;
+    @Mock
+    private Intent mIntent;
+    @Spy
+    private BluetoothMethodProxy mMapMethodProxy = BluetoothMethodProxy.getInstance();
+
+    private ExceptionTestProvider mProvider;
+    private MockContentResolver mMockContentResolver;
+    private BluetoothMapContentObserver mObserver;
+    private BluetoothMapFolderElement mFolders;
+    private BluetoothMapFolderElement mCurrentFolder;
 
     static class ExceptionTestProvider extends MockContentProvider {
         HashSet<String> mContents = new HashSet<String>();
+
         public ExceptionTestProvider(Context context) {
             super(context);
         }
@@ -83,44 +172,39 @@
     }
 
     @Before
-    public void setUp() {
-        mTargetContext = InstrumentationRegistry.getTargetContext();
+    public void setUp() throws Exception {
         Assume.assumeTrue("Ignore test when BluetoothMapService is not enabled",
                 BluetoothMapService.isEnabled());
-    }
-
-    @Test
-    public void testInitMsgList() {
+        MockitoAnnotations.initMocks(this);
+        BluetoothMethodProxy.setInstanceForTesting(mMapMethodProxy);
         if (Looper.myLooper() == null) {
             Looper.prepare();
         }
-        Context mockContext = mock(Context.class);
-        MockContentResolver mockResolver = new MockContentResolver();
-        ExceptionTestProvider mockProvider = new ExceptionTestProvider(mockContext);
-        mockResolver.addProvider("sms", mockProvider);
-
-        TelephonyManager mockTelephony = mock(TelephonyManager.class);
-        UserManager mockUserService = mock(UserManager.class);
-        BluetoothMapMasInstance mockMas = mock(BluetoothMapMasInstance.class);
+        mMockContentResolver = new MockContentResolver();
+        mProvider = new ExceptionTestProvider(mContext);
+        mMockContentResolver.addProvider("sms", mProvider);
+        mFolders = new BluetoothMapFolderElement("placeholder", null);
+        mCurrentFolder = new BluetoothMapFolderElement("current", null);
 
         // Functions that get called when BluetoothMapContentObserver is created
-        when(mockUserService.isUserUnlocked()).thenReturn(true);
-        when(mockContext.getContentResolver()).thenReturn(mockResolver);
-        when(mockContext.getSystemService(Context.TELEPHONY_SERVICE)).thenReturn(mockTelephony);
-        when(mockContext.getSystemServiceName(TelephonyManager.class))
+        when(mUserService.isUserUnlocked()).thenReturn(true);
+        when(mContext.getContentResolver()).thenReturn(mMockContentResolver);
+        when(mContext.getSystemService(Context.TELEPHONY_SERVICE)).thenReturn(mTelephonyManager);
+        when(mContext.getSystemServiceName(TelephonyManager.class))
                 .thenReturn(Context.TELEPHONY_SERVICE);
-        when(mockContext.getSystemService(Context.USER_SERVICE)).thenReturn(mockUserService);
-        when(mockContext.getSystemServiceName(UserManager.class)).thenReturn(Context.USER_SERVICE);
+        when(mContext.getSystemService(Context.USER_SERVICE)).thenReturn(mUserService);
+        when(mContext.getSystemServiceName(UserManager.class)).thenReturn(Context.USER_SERVICE);
+        when(mInstance.getMasId()).thenReturn(TEST_ID);
 
-        BluetoothMapContentObserver observer;
-        try {
-            // The constructor of BluetoothMapContentObserver calls initMsgList
-            observer = new BluetoothMapContentObserver(mockContext, null, mockMas, null, true);
-        } catch (RemoteException e) {
-            Assert.fail("Failed to created BluetoothMapContentObserver object");
-        } catch (SQLiteException e) {
-            Assert.fail("Threw SQLiteException instead of Assert.failing cleanly");
-        }
+        mObserver = new BluetoothMapContentObserver(mContext, mClient, mInstance, null, true);
+        mObserver.mProviderClient = mProviderClient;
+        mObserver.mAccount = mItem;
+        when(mItem.getType()).thenReturn(TYPE.IM);
+    }
+
+    @After
+    public void tearDown() throws Exception {
+        BluetoothMethodProxy.setInstanceForTesting(null);
     }
 
     @Test
@@ -128,33 +212,16 @@
         if (Looper.myLooper() == null) {
             Looper.prepare();
         }
-        Context mockContext = mock(Context.class);
-        MockContentResolver mockResolver = new MockContentResolver();
-        ExceptionTestProvider mockProvider = new ExceptionTestProvider(mockContext);
-
-        mockResolver.addProvider("sms", mockProvider);
-        mockResolver.addProvider("mms", mockProvider);
-        mockResolver.addProvider("mms-sms", mockProvider);
-        TelephonyManager mockTelephony = mock(TelephonyManager.class);
-        UserManager mockUserService = mock(UserManager.class);
-        BluetoothMapMasInstance mockMas = mock(BluetoothMapMasInstance.class);
-
-        // Functions that get called when BluetoothMapContentObserver is created
-        when(mockUserService.isUserUnlocked()).thenReturn(true);
-        when(mockContext.getContentResolver()).thenReturn(mockResolver);
-        when(mockContext.getSystemService(Context.TELEPHONY_SERVICE)).thenReturn(mockTelephony);
-        when(mockContext.getSystemServiceName(TelephonyManager.class))
-                .thenReturn(Context.TELEPHONY_SERVICE);
-        when(mockContext.getSystemService(Context.USER_SERVICE)).thenReturn(mockUserService);
-        when(mockContext.getSystemServiceName(UserManager.class)).thenReturn(Context.USER_SERVICE);
+        mMockContentResolver.addProvider("mms", mProvider);
+        mMockContentResolver.addProvider("mms-sms", mProvider);
 
         BluetoothMapbMessageMime message = new BluetoothMapbMessageMime();
         message.setType(BluetoothMapUtils.TYPE.MMS);
         message.setFolder("telecom/msg/outbox");
         message.addSender("Zero", "0");
-        message.addRecipient("One", new String[] {TEST_NUMBER_ONE}, null);
-        message.addRecipient("Two", new String[] {TEST_NUMBER_TWO}, null);
-        BluetoothMapbMessageMime.MimePart body =  message.addMimePart();
+        message.addRecipient("One", new String[]{TEST_NUMBER_ONE}, null);
+        message.addRecipient("Two", new String[]{TEST_NUMBER_TWO}, null);
+        BluetoothMapbMessageMime.MimePart body = message.addMimePart();
         try {
             body.mContentType = "text/plain";
             body.mData = "HelloWorld".getBytes("utf-8");
@@ -168,7 +235,7 @@
         try {
             // The constructor of BluetoothMapContentObserver calls initMsgList
             BluetoothMapContentObserver observer =
-                    new BluetoothMapContentObserver(mockContext, null, mockMas, null, true);
+                    new BluetoothMapContentObserver(mContext, null, mInstance, null, true);
             observer.pushMessage(message, folderElement, appParams, null);
         } catch (RemoteException e) {
             Assert.fail("Failed to created BluetoothMapContentObserver object");
@@ -182,9 +249,1710 @@
         }
 
         // Validate that 3 addresses were inserted into the database with 2 being the recipients
-        Assert.assertEquals(3, mockProvider.mContents.size());
-        Assert.assertTrue(mockProvider.mContents.contains(TEST_NUMBER_ONE));
-        Assert.assertTrue(mockProvider.mContents.contains(TEST_NUMBER_TWO));
+        Assert.assertEquals(3, mProvider.mContents.size());
+        Assert.assertTrue(mProvider.mContents.contains(TEST_NUMBER_ONE));
+        Assert.assertTrue(mProvider.mContents.contains(TEST_NUMBER_TWO));
     }
 
+    @Test
+    public void testSendEvent_withZeroEventFilter() {
+        when(mClient.isConnected()).thenReturn(true);
+        mObserver.setNotificationFilter(0);
+
+        String eventType = BluetoothMapContentObserver.EVENT_TYPE_NEW;
+        BluetoothMapContentObserver.Event event = mObserver.new Event(eventType, TEST_HANDLE_ONE,
+                null, null);
+        mObserver.sendEvent(event);
+        verify(mClient, never()).sendEvent(any(), anyInt());
+
+        event.eventType = BluetoothMapContentObserver.EVENT_TYPE_DELETE;
+        mObserver.sendEvent(event);
+        verify(mClient, never()).sendEvent(any(), anyInt());
+
+        event.eventType = BluetoothMapContentObserver.EVENT_TYPE_REMOVED;
+        mObserver.sendEvent(event);
+        verify(mClient, never()).sendEvent(any(), anyInt());
+
+        event.eventType = BluetoothMapContentObserver.EVENT_TYPE_SHIFT;
+        mObserver.sendEvent(event);
+        verify(mClient, never()).sendEvent(any(), anyInt());
+
+        event.eventType = BluetoothMapContentObserver.EVENT_TYPE_DELEVERY_SUCCESS;
+        mObserver.sendEvent(event);
+        verify(mClient, never()).sendEvent(any(), anyInt());
+
+        event.eventType = BluetoothMapContentObserver.EVENT_TYPE_SENDING_SUCCESS;
+        mObserver.sendEvent(event);
+        verify(mClient, never()).sendEvent(any(), anyInt());
+
+        event.eventType = BluetoothMapContentObserver.EVENT_TYPE_SENDING_FAILURE;
+        mObserver.sendEvent(event);
+        verify(mClient, never()).sendEvent(any(), anyInt());
+
+        event.eventType = BluetoothMapContentObserver.EVENT_TYPE_READ_STATUS;
+        mObserver.sendEvent(event);
+        verify(mClient, never()).sendEvent(any(), anyInt());
+
+        event.eventType = BluetoothMapContentObserver.EVENT_TYPE_CONVERSATION;
+        mObserver.sendEvent(event);
+        verify(mClient, never()).sendEvent(any(), anyInt());
+
+        event.eventType = BluetoothMapContentObserver.EVENT_TYPE_PRESENCE;
+        mObserver.sendEvent(event);
+        verify(mClient, never()).sendEvent(any(), anyInt());
+
+        event.eventType = BluetoothMapContentObserver.EVENT_TYPE_CHAT_STATE;
+        mObserver.sendEvent(event);
+        verify(mClient, never()).sendEvent(any(), anyInt());
+    }
+
+    @Test
+    public void testEvent_withNonZeroEventFilter() throws Exception {
+        when(mClient.isConnected()).thenReturn(true);
+
+        String eventType = BluetoothMapContentObserver.EVENT_TYPE_NEW;
+        BluetoothMapContentObserver.Event event = mObserver.new Event(eventType, TEST_HANDLE_ONE,
+                null, null);
+
+        mObserver.sendEvent(event);
+
+        verify(mClient).sendEvent(event.encode(), TEST_ID);
+    }
+
+    @Test
+    public void testSetContactList() {
+        Map<String, BluetoothMapConvoContactElement> map = Map.of();
+
+        mObserver.setContactList(map, true);
+
+        Assert.assertEquals(mObserver.getContactList(), map);
+    }
+
+    @Test
+    public void testSetMsgListSms() {
+        Map<Long, BluetoothMapContentObserver.Msg> map = Map.of();
+
+        mObserver.setMsgListSms(map, true);
+
+        Assert.assertEquals(mObserver.getMsgListSms(), map);
+    }
+
+    @Test
+    public void testSetMsgListMsg() {
+        Map<Long, BluetoothMapContentObserver.Msg> map = Map.of();
+
+        mObserver.setMsgListMsg(map, true);
+
+        Assert.assertEquals(mObserver.getMsgListMsg(), map);
+    }
+
+    @Test
+    public void testSetMsgListMms() {
+        Map<Long, BluetoothMapContentObserver.Msg> map = Map.of();
+
+        mObserver.setMsgListMms(map, true);
+
+        Assert.assertEquals(mObserver.getMsgListMms(), map);
+    }
+
+    @Test
+    public void testSetNotificationRegistration_withNullHandler() throws Exception {
+        when(mClient.getMessageHandler()).thenReturn(null);
+
+        Assert.assertEquals(
+                mObserver.setNotificationRegistration(BluetoothMapAppParams.NOTIFICATION_STATUS_NO),
+                ResponseCodes.OBEX_HTTP_UNAVAILABLE);
+    }
+
+    @Test
+    public void testSetNotificationRegistration_withInvalidMnsRecord() throws Exception {
+        if (Looper.myLooper() == null) {
+            Looper.prepare();
+        }
+        Handler handler = new Handler();
+        when(mClient.getMessageHandler()).thenReturn(handler);
+        when(mClient.isValidMnsRecord()).thenReturn(false);
+
+        Assert.assertEquals(
+                mObserver.setNotificationRegistration(BluetoothMapAppParams.NOTIFICATION_STATUS_NO),
+                ResponseCodes.OBEX_HTTP_OK);
+    }
+
+    @Test
+    public void testSetNotificationRegistration_withValidMnsRecord() throws Exception {
+        if (Looper.myLooper() == null) {
+            Looper.prepare();
+        }
+        Handler handler = new Handler();
+        when(mClient.getMessageHandler()).thenReturn(handler);
+        when(mClient.isValidMnsRecord()).thenReturn(true);
+
+        Assert.assertEquals(
+                mObserver.setNotificationRegistration(BluetoothMapAppParams.NOTIFICATION_STATUS_NO),
+                ResponseCodes.OBEX_HTTP_OK);
+    }
+
+    @Test
+    public void testSetMessageStatusRead_withTypeSmsGsm() throws Exception {
+        TYPE type = TYPE.SMS_GSM;
+        Map<Long, BluetoothMapContentObserver.Msg> map = new HashMap<>();
+        BluetoothMapContentObserver.Msg msg = createSimpleMsg();
+        map.put(TEST_HANDLE_ONE, msg);
+        mObserver.setMsgListSms(map, true);
+        doReturn(TEST_PLACEHOLDER_INT).when(mMapMethodProxy).contentResolverUpdate(any(), any(),
+                any(), any(), any());
+
+        Assert.assertTrue(mObserver.setMessageStatusRead(TEST_HANDLE_ONE, type, TEST_URI_STR,
+                TEST_STATUS_VALUE));
+
+        Assert.assertEquals(msg.flagRead, TEST_STATUS_VALUE);
+    }
+
+    @Test
+    public void testSetMessageStatusRead_withTypeMms() throws Exception {
+        TYPE type = TYPE.MMS;
+        Map<Long, BluetoothMapContentObserver.Msg> map = new HashMap<>();
+        BluetoothMapContentObserver.Msg msg = createSimpleMsg();
+        map.put(TEST_HANDLE_ONE, msg);
+        mObserver.setMsgListMms(map, true);
+        doReturn(TEST_PLACEHOLDER_INT).when(mMapMethodProxy).contentResolverUpdate(any(), any(),
+                any(), any(), any());
+
+        Assert.assertTrue(mObserver.setMessageStatusRead(TEST_HANDLE_ONE, type, TEST_URI_STR,
+                TEST_STATUS_VALUE));
+
+        Assert.assertEquals(msg.flagRead, TEST_STATUS_VALUE);
+    }
+
+    @Test
+    public void testSetMessageStatusRead_withTypeEmail() throws Exception {
+        TYPE type = TYPE.EMAIL;
+        Map<Long, BluetoothMapContentObserver.Msg> map = new HashMap<>();
+        BluetoothMapContentObserver.Msg msg = createSimpleMsg();
+        map.put(TEST_HANDLE_ONE, msg);
+        mObserver.setMsgListMsg(map, true);
+        mObserver.mProviderClient = mProviderClient;
+        when(mProviderClient.update(any(), any(), any(), any())).thenReturn(TEST_PLACEHOLDER_INT);
+
+        Assert.assertTrue(mObserver.setMessageStatusRead(TEST_HANDLE_ONE, type, TEST_URI_STR,
+                TEST_STATUS_VALUE));
+
+        Assert.assertEquals(msg.flagRead, TEST_STATUS_VALUE);
+    }
+
+    @Test
+    public void testDeleteMessageMms_withNonDeletedThreadId() {
+        Map<Long, BluetoothMapContentObserver.Msg> map = new HashMap<>();
+        BluetoothMapContentObserver.Msg msg = createMsgWithTypeAndThreadId(Mms.MESSAGE_BOX_ALL,
+                TEST_THREAD_ID);
+        map.put(TEST_HANDLE_ONE, msg);
+        mObserver.setMsgListMms(map, true);
+        Assert.assertEquals(msg.threadId, TEST_THREAD_ID);
+
+        MatrixCursor cursor = new MatrixCursor(new String[] {Mms.THREAD_ID});
+        cursor.addRow(new Object[] {TEST_THREAD_ID});
+        doReturn(cursor).when(mMapMethodProxy).contentResolverQuery(any(), any(), any(), any(),
+                any(), any());
+        doReturn(TEST_PLACEHOLDER_INT).when(mMapMethodProxy).contentResolverUpdate(any(), any(),
+                any(), any(), any());
+
+        Assert.assertTrue(mObserver.deleteMessageMms(TEST_HANDLE_ONE));
+
+        Assert.assertEquals(msg.threadId, BluetoothMapContentObserver.DELETED_THREAD_ID);
+    }
+
+    @Test
+    public void testDeleteMessageMms_withDeletedThreadId() {
+        Map<Long, BluetoothMapContentObserver.Msg> map = new HashMap<>();
+        BluetoothMapContentObserver.Msg msg = createMsgWithTypeAndThreadId(Mms.MESSAGE_BOX_ALL,
+                TEST_THREAD_ID);
+        map.put(TEST_HANDLE_ONE, msg);
+        mObserver.setMsgListMms(map, true);
+        Assert.assertNotNull(mObserver.getMsgListMms().get(TEST_HANDLE_ONE));
+
+        MatrixCursor cursor = new MatrixCursor(new String[] {Mms.THREAD_ID});
+        cursor.addRow(new Object[] {BluetoothMapContentObserver.DELETED_THREAD_ID});
+        doReturn(cursor).when(mMapMethodProxy).contentResolverQuery(any(), any(), any(), any(),
+                any(), any());
+        doReturn(TEST_PLACEHOLDER_INT).when(mMapMethodProxy).contentResolverDelete(any(), any(),
+                any(), any());
+
+        Assert.assertTrue(mObserver.deleteMessageMms(TEST_HANDLE_ONE));
+
+        Assert.assertNull(mObserver.getMsgListMms().get(TEST_HANDLE_ONE));
+    }
+
+    @Test
+    public void testDeleteMessageSms_withNonDeletedThreadId() {
+        Map<Long, BluetoothMapContentObserver.Msg> map = new HashMap<>();
+        BluetoothMapContentObserver.Msg msg = createMsgWithTypeAndThreadId(Sms.MESSAGE_TYPE_ALL,
+                TEST_THREAD_ID);
+        map.put(TEST_HANDLE_ONE, msg);
+        mObserver.setMsgListSms(map, true);
+        Assert.assertEquals(msg.threadId, TEST_THREAD_ID);
+
+        MatrixCursor cursor = new MatrixCursor(new String[] {Mms.THREAD_ID});
+        cursor.addRow(new Object[] {TEST_THREAD_ID});
+        doReturn(cursor).when(mMapMethodProxy).contentResolverQuery(any(), any(), any(), any(),
+                any(), any());
+        doReturn(TEST_PLACEHOLDER_INT).when(mMapMethodProxy).contentResolverUpdate(any(), any(),
+                any(), any(), any());
+
+        Assert.assertTrue(mObserver.deleteMessageSms(TEST_HANDLE_ONE));
+
+        Assert.assertEquals(msg.threadId, BluetoothMapContentObserver.DELETED_THREAD_ID);
+    }
+
+    @Test
+    public void testDeleteMessageSms_withDeletedThreadId() {
+        Map<Long, BluetoothMapContentObserver.Msg> map = new HashMap<>();
+        BluetoothMapContentObserver.Msg msg = createMsgWithTypeAndThreadId(Sms.MESSAGE_TYPE_ALL,
+                TEST_THREAD_ID);
+        map.put(TEST_HANDLE_ONE, msg);
+        mObserver.setMsgListSms(map, true);
+        Assert.assertNotNull(mObserver.getMsgListSms().get(TEST_HANDLE_ONE));
+
+        MatrixCursor cursor = new MatrixCursor(new String[] {Mms.THREAD_ID});
+        cursor.addRow(new Object[] {BluetoothMapContentObserver.DELETED_THREAD_ID});
+        doReturn(cursor).when(mMapMethodProxy).contentResolverQuery(any(), any(), any(), any(),
+                any(), any());
+        doReturn(TEST_PLACEHOLDER_INT).when(mMapMethodProxy).contentResolverDelete(any(), any(),
+                any(), any());
+
+        Assert.assertTrue(mObserver.deleteMessageSms(TEST_HANDLE_ONE));
+
+        Assert.assertNull(mObserver.getMsgListSms().get(TEST_HANDLE_ONE));
+    }
+
+    @Test
+    public void testUnDeleteMessageMms_withDeletedThreadId_andMessageBoxInbox() {
+        Map<Long, BluetoothMapContentObserver.Msg> map = new HashMap<>();
+        BluetoothMapContentObserver.Msg msg = createMsgWithTypeAndThreadId(Mms.MESSAGE_BOX_ALL,
+                TEST_THREAD_ID);
+        map.put(TEST_HANDLE_ONE, msg);
+        mObserver.setMsgListMms(map, true);
+        Assert.assertEquals(msg.threadId, TEST_THREAD_ID);
+        Assert.assertEquals(msg.type, Mms.MESSAGE_BOX_ALL);
+
+        MatrixCursor cursor = new MatrixCursor(
+                new String[] {Mms.THREAD_ID, Mms._ID, Mms.MESSAGE_BOX, Mms.Addr.ADDRESS});
+        cursor.addRow(new Object[] {BluetoothMapContentObserver.DELETED_THREAD_ID, 1L,
+                Mms.MESSAGE_BOX_INBOX, TEST_ADDRESS});
+        doReturn(cursor).when(mMapMethodProxy).contentResolverQuery(any(), any(), any(), any(),
+                any(), any());
+        doReturn(TEST_PLACEHOLDER_INT).when(mMapMethodProxy).contentResolverUpdate(any(), any(),
+                any(), any(), any());
+        doReturn(TEST_OLD_THREAD_ID).when(mMapMethodProxy).telephonyGetOrCreateThreadId(any(),
+                any());
+
+        Assert.assertTrue(mObserver.unDeleteMessageMms(TEST_HANDLE_ONE));
+
+        Assert.assertEquals(msg.threadId, TEST_OLD_THREAD_ID);
+        Assert.assertEquals(msg.type, Mms.MESSAGE_BOX_INBOX);
+    }
+
+    @Test
+    public void testUnDeleteMessageMms_withDeletedThreadId_andMessageBoxSent() {
+        Map<Long, BluetoothMapContentObserver.Msg> map = new HashMap<>();
+        BluetoothMapContentObserver.Msg msg = createMsgWithTypeAndThreadId(Mms.MESSAGE_BOX_ALL,
+                TEST_THREAD_ID);
+        map.put(TEST_HANDLE_ONE, msg);
+        mObserver.setMsgListMms(map, true);
+        Assert.assertEquals(msg.threadId, TEST_THREAD_ID);
+        Assert.assertEquals(msg.type, Mms.MESSAGE_BOX_ALL);
+
+        MatrixCursor cursor = new MatrixCursor(
+                new String[] {Mms.THREAD_ID, Mms._ID, Mms.MESSAGE_BOX, Mms.Addr.ADDRESS});
+        cursor.addRow(new Object[] {BluetoothMapContentObserver.DELETED_THREAD_ID, 1L,
+                Mms.MESSAGE_BOX_SENT, TEST_ADDRESS});
+        doReturn(cursor).when(mMapMethodProxy).contentResolverQuery(any(), any(), any(), any(),
+                any(), any());
+        doReturn(TEST_PLACEHOLDER_INT).when(mMapMethodProxy).contentResolverUpdate(any(), any(),
+                any(), any(), any());
+        doReturn(TEST_OLD_THREAD_ID).when(mMapMethodProxy).telephonyGetOrCreateThreadId(any(),
+                any());
+
+        Assert.assertTrue(mObserver.unDeleteMessageMms(TEST_HANDLE_ONE));
+
+        Assert.assertEquals(msg.threadId, TEST_OLD_THREAD_ID);
+        Assert.assertEquals(msg.type, Mms.MESSAGE_BOX_INBOX);
+    }
+
+    @Test
+    public void testUnDeleteMessageMms_withoutDeletedThreadId() {
+        Map<Long, BluetoothMapContentObserver.Msg> map = new HashMap<>();
+        BluetoothMapContentObserver.Msg msg = createMsgWithTypeAndThreadId(Mms.MESSAGE_BOX_ALL,
+                TEST_THREAD_ID);
+        map.put(TEST_HANDLE_ONE, msg);
+        mObserver.setMsgListMms(map, true);
+        Assert.assertEquals(msg.threadId, TEST_THREAD_ID);
+        Assert.assertEquals(msg.type, Mms.MESSAGE_BOX_ALL);
+
+        MatrixCursor cursor = new MatrixCursor(
+                new String[] {Mms.THREAD_ID, Mms._ID, Mms.MESSAGE_BOX, Mms.Addr.ADDRESS,});
+        cursor.addRow(new Object[] {TEST_THREAD_ID, 1L, Mms.MESSAGE_BOX_SENT, TEST_ADDRESS});
+        doReturn(cursor).when(mMapMethodProxy).contentResolverQuery(any(), any(), any(), any(),
+                any(), any());
+        doReturn(TEST_OLD_THREAD_ID).when(mMapMethodProxy).telephonyGetOrCreateThreadId(any(),
+                any());
+
+        Assert.assertTrue(mObserver.unDeleteMessageMms(TEST_HANDLE_ONE));
+
+        // Nothing changes when thread id is not BluetoothMapContentObserver.DELETED_THREAD_ID
+        Assert.assertEquals(msg.threadId, TEST_THREAD_ID);
+        Assert.assertEquals(msg.type, Sms.MESSAGE_TYPE_ALL);
+    }
+
+    @Test
+    public void testUnDeleteMessageSms_withDeletedThreadId() {
+        Map<Long, BluetoothMapContentObserver.Msg> map = new HashMap<>();
+        BluetoothMapContentObserver.Msg msg = createMsgWithTypeAndThreadId(Sms.MESSAGE_TYPE_ALL,
+                TEST_THREAD_ID);
+        map.put(TEST_HANDLE_ONE, msg);
+        mObserver.setMsgListSms(map, true);
+        Assert.assertEquals(msg.threadId, TEST_THREAD_ID);
+        Assert.assertEquals(msg.type, Sms.MESSAGE_TYPE_ALL);
+
+        MatrixCursor cursor = new MatrixCursor(
+                new String[] {Sms.THREAD_ID, Sms.ADDRESS});
+        cursor.addRow(new Object[] {BluetoothMapContentObserver.DELETED_THREAD_ID, TEST_ADDRESS});
+        doReturn(cursor).when(mMapMethodProxy).contentResolverQuery(any(), any(), any(), any(),
+                any(), any());
+        doReturn(TEST_PLACEHOLDER_INT).when(mMapMethodProxy).contentResolverUpdate(any(), any(),
+                any(), any(), any());
+        doReturn(TEST_OLD_THREAD_ID).when(mMapMethodProxy).telephonyGetOrCreateThreadId(any(),
+                any());
+
+        Assert.assertTrue(mObserver.unDeleteMessageSms(TEST_HANDLE_ONE));
+
+        Assert.assertEquals(msg.threadId, TEST_OLD_THREAD_ID);
+        Assert.assertEquals(msg.type, Sms.MESSAGE_TYPE_INBOX);
+    }
+
+    @Test
+    public void testUnDeleteMessageSms_withoutDeletedThreadId() {
+        Map<Long, BluetoothMapContentObserver.Msg> map = new HashMap<>();
+        BluetoothMapContentObserver.Msg msg = createMsgWithTypeAndThreadId(Sms.MESSAGE_TYPE_ALL,
+                TEST_THREAD_ID);
+        map.put(TEST_HANDLE_ONE, msg);
+        mObserver.setMsgListSms(map, true);
+        Assert.assertEquals(msg.threadId, TEST_THREAD_ID);
+        Assert.assertEquals(msg.type, Sms.MESSAGE_TYPE_ALL);
+
+        MatrixCursor cursor = new MatrixCursor(
+                new String[] {Sms.THREAD_ID, Sms.ADDRESS});
+        cursor.addRow(new Object[] {TEST_THREAD_ID, TEST_ADDRESS});
+        doReturn(cursor).when(mMapMethodProxy).contentResolverQuery(any(), any(), any(), any(),
+                any(), any());
+        doReturn(TEST_OLD_THREAD_ID).when(mMapMethodProxy).telephonyGetOrCreateThreadId(any(),
+                any());
+
+        Assert.assertTrue(mObserver.unDeleteMessageSms(TEST_HANDLE_ONE));
+
+        // Nothing changes when thread id is not BluetoothMapContentObserver.DELETED_THREAD_ID
+        Assert.assertEquals(msg.threadId, TEST_THREAD_ID);
+        Assert.assertEquals(msg.type, Sms.MESSAGE_TYPE_ALL);
+    }
+
+    @Test
+    public void testPushMsgInfo() {
+        long id = 1;
+        int transparent = 1;
+        int retry = 1;
+        String phone = "test_phone";
+        Uri uri = mock(Uri.class);
+
+        BluetoothMapContentObserver.PushMsgInfo msgInfo =
+                new BluetoothMapContentObserver.PushMsgInfo(id, transparent, retry, phone, uri);
+
+        Assert.assertEquals(msgInfo.id, id);
+        Assert.assertEquals(msgInfo.transparent, transparent);
+        Assert.assertEquals(msgInfo.retry, retry);
+        Assert.assertEquals(msgInfo.phone, phone);
+        Assert.assertEquals(msgInfo.uri, uri);
+    }
+
+    @Test
+    public void setEmailMessageStatusDelete_withStatusValueYes() {
+        setFolderStructureWithTelecomAndMsg(mFolders, BluetoothMapContract.FOLDER_NAME_DELETED,
+                TEST_DELETE_FOLDER_ID);
+        mObserver.setFolderStructure(mFolders);
+
+        Map<Long, BluetoothMapContentObserver.Msg> map = new HashMap<>();
+        BluetoothMapContentObserver.Msg msg = createSimpleMsg();
+        map.put(TEST_HANDLE_ONE, msg);
+        mObserver.setMsgListMsg(map, true);
+        doReturn(TEST_PLACEHOLDER_INT).when(mMapMethodProxy).contentResolverUpdate(any(), any(),
+                any(), any(), any());
+
+        Assert.assertTrue(mObserver.setEmailMessageStatusDelete(mCurrentFolder, TEST_URI_STR,
+                TEST_HANDLE_ONE, BluetoothMapAppParams.STATUS_VALUE_YES));
+        Assert.assertEquals(msg.folderId, TEST_DELETE_FOLDER_ID);
+    }
+
+    @Test
+    public void setEmailMessageStatusDelete_withStatusValueYes_andUpdateCountZero() {
+        setFolderStructureWithTelecomAndMsg(mFolders, BluetoothMapContract.FOLDER_NAME_DELETED,
+                TEST_DELETE_FOLDER_ID);
+        mObserver.setFolderStructure(mFolders);
+
+        Map<Long, BluetoothMapContentObserver.Msg> map = new HashMap<>();
+        BluetoothMapContentObserver.Msg msg = createSimpleMsg();
+        map.put(TEST_HANDLE_ONE, msg);
+        mObserver.setMsgListMsg(map, true);
+        doReturn(0).when(mMapMethodProxy).contentResolverUpdate(any(), any(),
+                any(), any(), any());
+
+        Assert.assertFalse(mObserver.setEmailMessageStatusDelete(mCurrentFolder, TEST_URI_STR,
+                TEST_HANDLE_ONE, BluetoothMapAppParams.STATUS_VALUE_YES));
+    }
+
+    @Test
+    public void setEmailMessageStatusDelete_withStatusValueNo() {
+        setFolderStructureWithTelecomAndMsg(mCurrentFolder, BluetoothMapContract.FOLDER_NAME_INBOX,
+                TEST_INBOX_FOLDER_ID);
+        setFolderStructureWithTelecomAndMsg(mFolders, BluetoothMapContract.FOLDER_NAME_DELETED,
+                TEST_DELETE_FOLDER_ID);
+        mObserver.setFolderStructure(mFolders);
+
+        Map<Long, BluetoothMapContentObserver.Msg> map = new HashMap<>();
+        BluetoothMapContentObserver.Msg msg = createSimpleMsg();
+        msg.oldFolderId = TEST_OLD_FOLDER_ID;
+        msg.folderId = TEST_DELETE_FOLDER_ID;
+        map.put(TEST_HANDLE_ONE, msg);
+        mObserver.setMsgListMsg(map, true);
+        doReturn(TEST_PLACEHOLDER_INT).when(mMapMethodProxy).contentResolverUpdate(any(), any(),
+                any(), any(), any());
+
+        Assert.assertTrue(mObserver.setEmailMessageStatusDelete(mCurrentFolder, TEST_URI_STR,
+                TEST_HANDLE_ONE, BluetoothMapAppParams.STATUS_VALUE_NO));
+        Assert.assertEquals(msg.folderId, TEST_INBOX_FOLDER_ID);
+    }
+
+    @Test
+    public void setEmailMessageStatusDelete_withStatusValueNo_andOldFolderIdMinusOne() {
+        int oldFolderId = -1;
+        setFolderStructureWithTelecomAndMsg(mCurrentFolder, BluetoothMapContract.FOLDER_NAME_INBOX,
+                TEST_INBOX_FOLDER_ID);
+        setFolderStructureWithTelecomAndMsg(mFolders, BluetoothMapContract.FOLDER_NAME_DELETED,
+                TEST_DELETE_FOLDER_ID);
+        mObserver.setFolderStructure(mFolders);
+
+        Map<Long, BluetoothMapContentObserver.Msg> map = new HashMap<>();
+        BluetoothMapContentObserver.Msg msg = createSimpleMsg();
+        msg.oldFolderId = oldFolderId;
+        msg.folderId = TEST_DELETE_FOLDER_ID;
+        map.put(TEST_HANDLE_ONE, msg);
+        mObserver.setMsgListMsg(map, true);
+        doReturn(TEST_PLACEHOLDER_INT).when(mMapMethodProxy).contentResolverUpdate(any(), any(),
+                any(), any(), any());
+
+        Assert.assertTrue(mObserver.setEmailMessageStatusDelete(mCurrentFolder, TEST_URI_STR,
+                TEST_HANDLE_ONE, BluetoothMapAppParams.STATUS_VALUE_NO));
+        Assert.assertEquals(msg.folderId, TEST_INBOX_FOLDER_ID);
+    }
+
+    @Test
+    public void setEmailMessageStatusDelete_withStatusValueNo_andInboxFolderNull() {
+        // This sets mCurrentFolder to have a sent folder, but not an inbox folder
+        setFolderStructureWithTelecomAndMsg(mCurrentFolder, BluetoothMapContract.FOLDER_NAME_SENT,
+                BluetoothMapContract.FOLDER_ID_SENT);
+        setFolderStructureWithTelecomAndMsg(mFolders, BluetoothMapContract.FOLDER_NAME_DELETED,
+                TEST_DELETE_FOLDER_ID);
+        mObserver.setFolderStructure(mFolders);
+
+        Map<Long, BluetoothMapContentObserver.Msg> map = new HashMap<>();
+        BluetoothMapContentObserver.Msg msg = createSimpleMsg();
+        msg.oldFolderId = TEST_OLD_FOLDER_ID;
+        msg.folderId = TEST_DELETE_FOLDER_ID;
+        map.put(TEST_HANDLE_ONE, msg);
+        mObserver.setMsgListMsg(map, true);
+        doReturn(TEST_PLACEHOLDER_INT).when(mMapMethodProxy).contentResolverUpdate(any(), any(),
+                any(), any(), any());
+
+        Assert.assertTrue(mObserver.setEmailMessageStatusDelete(mCurrentFolder, TEST_URI_STR,
+                TEST_HANDLE_ONE, BluetoothMapAppParams.STATUS_VALUE_NO));
+        Assert.assertEquals(msg.folderId, TEST_OLD_FOLDER_ID);
+    }
+
+    @Test
+    public void setMessageStatusDeleted_withTypeEmail() {
+        setFolderStructureWithTelecomAndMsg(mFolders, BluetoothMapContract.FOLDER_NAME_DELETED,
+                TEST_DELETE_FOLDER_ID);
+        mObserver.setFolderStructure(mFolders);
+
+        Map<Long, BluetoothMapContentObserver.Msg> map = new HashMap<>();
+        BluetoothMapContentObserver.Msg msg = createSimpleMsg();
+        map.put(TEST_HANDLE_ONE, msg);
+        mObserver.setMsgListMsg(map, true);
+        doReturn(TEST_PLACEHOLDER_INT).when(mMapMethodProxy).contentResolverUpdate(any(), any(),
+                any(), any(), any());
+
+        Assert.assertTrue(mObserver.setMessageStatusDeleted(TEST_HANDLE_ONE, TYPE.EMAIL,
+                mCurrentFolder, TEST_URI_STR, BluetoothMapAppParams.STATUS_VALUE_YES));
+    }
+
+    @Test
+    public void setMessageStatusDeleted_withTypeIm() {
+        Assert.assertFalse(mObserver.setMessageStatusDeleted(TEST_HANDLE_ONE, TYPE.IM,
+                mCurrentFolder, TEST_URI_STR, BluetoothMapAppParams.STATUS_VALUE_YES));
+    }
+
+    @Test
+    public void setMessageStatusDeleted_withTypeGsmOrMms_andStatusValueNo() {
+        doReturn(null).when(mMapMethodProxy).contentResolverQuery(any(), any(), any(), any(),
+                any(), any());
+        doReturn(TEST_OLD_THREAD_ID).when(mMapMethodProxy).telephonyGetOrCreateThreadId(any(),
+                any());
+
+        // setMessageStatusDeleted with type Gsm or Mms calls either deleteMessage() or
+        // unDeleteMessage(), which returns false when no cursor is set with BluetoothMethodProxy.
+        Assert.assertFalse(mObserver.setMessageStatusDeleted(TEST_HANDLE_ONE, TYPE.MMS,
+                mCurrentFolder, TEST_URI_STR, BluetoothMapAppParams.STATUS_VALUE_NO));
+        Assert.assertFalse(mObserver.setMessageStatusDeleted(TEST_HANDLE_ONE, TYPE.SMS_GSM,
+                mCurrentFolder, TEST_URI_STR, BluetoothMapAppParams.STATUS_VALUE_NO));
+    }
+
+    @Test
+    public void setMessageStatusDeleted_withTypeGsmOrMms_andStatusValueYes() {
+        doReturn(null).when(mMapMethodProxy).contentResolverQuery(any(), any(), any(), any(),
+                any(), any());
+        doReturn(TEST_PLACEHOLDER_INT).when(mMapMethodProxy).contentResolverUpdate(any(), any(),
+                any(), any(), any());
+
+        // setMessageStatusDeleted with type Gsm or Mms calls either deleteMessage() or
+        // unDeleteMessage(), which returns false when no cursor is set with BluetoothMethodProxy.
+        Assert.assertFalse(mObserver.setMessageStatusDeleted(TEST_HANDLE_ONE, TYPE.MMS,
+                mCurrentFolder, TEST_URI_STR, BluetoothMapAppParams.STATUS_VALUE_YES));
+        Assert.assertFalse(mObserver.setMessageStatusDeleted(TEST_HANDLE_ONE, TYPE.SMS_GSM,
+                mCurrentFolder, TEST_URI_STR, BluetoothMapAppParams.STATUS_VALUE_YES));
+    }
+
+    @Test
+    public void initMsgList_withMsgSms() throws Exception {
+        MatrixCursor cursor = new MatrixCursor(new String[] {Sms._ID, Sms.TYPE, Sms.THREAD_ID,
+                Sms.READ});
+        cursor.addRow(new Object[] {(long) TEST_ID, TEST_SMS_TYPE_ALL, TEST_THREAD_ID,
+                TEST_READ_FLAG_ONE});
+        doReturn(cursor).when(mMapMethodProxy).contentResolverQuery(any(), any(),
+                eq(BluetoothMapContentObserver.SMS_PROJECTION_SHORT), any(), any(), any());
+        cursor.moveToFirst();
+        Map<Long, BluetoothMapContentObserver.Msg> map = new HashMap<>();
+        mObserver.setMsgListMsg(map, true);
+
+        mObserver.initMsgList();
+
+        BluetoothMapContentObserver.Msg msg = mObserver.getMsgListSms().get((long) TEST_ID);
+        Assert.assertEquals(msg.id, TEST_ID);
+        Assert.assertEquals(msg.type, TEST_SMS_TYPE_ALL);
+        Assert.assertEquals(msg.threadId, TEST_THREAD_ID);
+        Assert.assertEquals(msg.flagRead, TEST_READ_FLAG_ONE);
+    }
+
+    @Test
+    public void initMsgList_withMsgMms() throws Exception {
+        MatrixCursor cursor = new MatrixCursor(new String[] {Mms._ID, Mms.MESSAGE_BOX,
+                Mms.THREAD_ID, Mms.READ});
+        cursor.addRow(new Object[] {(long) TEST_ID, TEST_MMS_TYPE_ALL, TEST_THREAD_ID,
+                TEST_READ_FLAG_ZERO});
+        doReturn(null).when(mMapMethodProxy).contentResolverQuery(any(), any(),
+                eq(BluetoothMapContentObserver.SMS_PROJECTION_SHORT), any(), any(), any());
+        doReturn(cursor).when(mMapMethodProxy).contentResolverQuery(any(), any(),
+                eq(BluetoothMapContentObserver.MMS_PROJECTION_SHORT), any(), any(), any());
+        cursor.moveToFirst();
+        Map<Long, BluetoothMapContentObserver.Msg> map = new HashMap<>();
+        mObserver.setMsgListMsg(map, true);
+
+        mObserver.initMsgList();
+
+        BluetoothMapContentObserver.Msg msg = mObserver.getMsgListMms().get((long) TEST_ID);
+        Assert.assertEquals(msg.id, TEST_ID);
+        Assert.assertEquals(msg.type, TEST_MMS_TYPE_ALL);
+        Assert.assertEquals(msg.threadId, TEST_THREAD_ID);
+        Assert.assertEquals(msg.flagRead, TEST_READ_FLAG_ZERO);
+    }
+
+    @Test
+    public void initMsgList_withMsg() throws Exception {
+        MatrixCursor cursor = new MatrixCursor(new String[] {MessageColumns._ID,
+                MessageColumns.FOLDER_ID, MessageColumns.FLAG_READ});
+        cursor.addRow(new Object[] {(long) TEST_ID, TEST_INBOX_FOLDER_ID, TEST_READ_FLAG_ONE});
+        doReturn(null).when(mMapMethodProxy).contentResolverQuery(any(), any(),
+                eq(BluetoothMapContentObserver.SMS_PROJECTION_SHORT), any(), any(), any());
+        doReturn(null).when(mMapMethodProxy).contentResolverQuery(any(), any(),
+                eq(BluetoothMapContentObserver.MMS_PROJECTION_SHORT), any(), any(), any());
+        when(mProviderClient.query(any(), any(), any(), any(), any())).thenReturn(cursor);
+        cursor.moveToFirst();
+        Map<Long, BluetoothMapContentObserver.Msg> map = new HashMap<>();
+        mObserver.setMsgListMsg(map, true);
+
+        mObserver.initMsgList();
+
+        BluetoothMapContentObserver.Msg msg = mObserver.getMsgListMsg().get((long) TEST_ID);
+        Assert.assertEquals(msg.id, TEST_ID);
+        Assert.assertEquals(msg.folderId, TEST_INBOX_FOLDER_ID);
+        Assert.assertEquals(msg.flagRead, TEST_READ_FLAG_ONE);
+    }
+
+    @Test
+    public void initContactsList() throws Exception {
+        MatrixCursor cursor = new MatrixCursor(
+                new String[] {BluetoothMapContract.ConvoContactColumns.CONVO_ID,
+                        BluetoothMapContract.ConvoContactColumns.NAME,
+                        BluetoothMapContract.ConvoContactColumns.NICKNAME,
+                        BluetoothMapContract.ConvoContactColumns.X_BT_UID,
+                        BluetoothMapContract.ConvoContactColumns.CHAT_STATE,
+                        BluetoothMapContract.ConvoContactColumns.UCI,
+                        BluetoothMapContract.ConvoContactColumns.LAST_ACTIVE,
+                        BluetoothMapContract.ConvoContactColumns.PRESENCE_STATE,
+                        BluetoothMapContract.ConvoContactColumns.STATUS_TEXT,
+                        BluetoothMapContract.ConvoContactColumns.PRIORITY,
+                        BluetoothMapContract.ConvoContactColumns.LAST_ONLINE});
+        cursor.addRow(new Object[] {TEST_CONVO_ID, TEST_NAME, TEST_DISPLAY_NAME, TEST_BT_UID,
+                TEST_CHAT_STATE, TEST_UCI, TEST_LAST_ACTIVITY, TEST_PRESENCE_STATE,
+                TEST_STATUS_TEXT, TEST_PRIORITY, TEST_LAST_ONLINE});
+        doReturn(cursor).when(mMapMethodProxy).contentResolverQuery(any(), any(), any(), any(),
+                any(), any());
+
+        mObserver.mContactUri = mock(Uri.class);
+        when(mProviderClient.query(any(), any(), any(), any(), any())).thenReturn(cursor);
+
+        Map<String, BluetoothMapConvoContactElement> map = new HashMap<>();
+        mObserver.setContactList(map, true);
+        mObserver.initContactsList();
+        BluetoothMapConvoContactElement contactElement = mObserver.getContactList().get(TEST_UCI);
+
+        final SimpleDateFormat format = new SimpleDateFormat("yyyyMMdd'T'HHmmss");
+        Assert.assertEquals(contactElement.getContactId(), TEST_UCI);
+        Assert.assertEquals(contactElement.getName(), TEST_NAME);
+        Assert.assertEquals(contactElement.getDisplayName(), TEST_DISPLAY_NAME);
+        Assert.assertEquals(contactElement.getBtUid(), TEST_BT_UID);
+        Assert.assertEquals(contactElement.getChatState(), TEST_CHAT_STATE);
+        Assert.assertEquals(contactElement.getPresenceStatus(), TEST_STATUS_TEXT);
+        Assert.assertEquals(contactElement.getPresenceAvailability(), TEST_PRESENCE_STATE);
+        Assert.assertEquals(contactElement.getLastActivityString(), format.format(
+                TEST_LAST_ACTIVITY));
+        Assert.assertEquals(contactElement.getPriority(), TEST_PRIORITY);
+    }
+
+    @Test
+    public void handleMsgListChangesMsg_withNonExistingMessage_andVersion11() throws Exception {
+        MatrixCursor cursor = new MatrixCursor(new String[] {
+                BluetoothMapContract.MessageColumns._ID,
+                BluetoothMapContract.MessageColumns.FOLDER_ID,
+                BluetoothMapContract.MessageColumns.FLAG_READ,
+                BluetoothMapContract.MessageColumns.DATE,
+                BluetoothMapContract.MessageColumns.SUBJECT,
+                BluetoothMapContract.MessageColumns.FROM_LIST,
+                BluetoothMapContract.MessageColumns.FLAG_HIGH_PRIORITY});
+        cursor.addRow(new Object[] {TEST_HANDLE_ONE, TEST_INBOX_FOLDER_ID, TEST_READ_FLAG_ONE,
+                TEST_DATE_MS, TEST_SUBJECT, TEST_ADDRESS, 1});
+        when(mProviderClient.query(any(), any(), any(), any(), any())).thenReturn(cursor);
+
+        Map<Long, BluetoothMapContentObserver.Msg> map = new HashMap<>();
+        // Giving a different handle for msg below and cursor above makes handleMsgListChangesMsg()
+        // function for a non-existing message
+        BluetoothMapContentObserver.Msg msg = new BluetoothMapContentObserver.Msg(TEST_HANDLE_TWO,
+                TEST_INBOX_FOLDER_ID, TEST_READ_FLAG_ONE);
+        msg.localInitiatedSend = true;
+        msg.transparent = true;
+        map.put(TEST_HANDLE_TWO, msg);
+        mObserver.setMsgListMsg(map, true);
+        mObserver.mMapEventReportVersion = BluetoothMapUtils.MAP_EVENT_REPORT_V11;
+        mFolders.setFolderId(TEST_INBOX_FOLDER_ID);
+        mObserver.setFolderStructure(mFolders);
+
+        mObserver.handleMsgListChangesMsg(TEST_URI);
+
+        Assert.assertEquals(mObserver.getMsgListMsg().get(TEST_HANDLE_ONE).id, TEST_HANDLE_ONE);
+        Assert.assertEquals(mObserver.getMsgListMsg().get(TEST_HANDLE_ONE).type,
+                TEST_INBOX_FOLDER_ID);
+        Assert.assertEquals(mObserver.getMsgListMsg().get(TEST_HANDLE_ONE).flagRead,
+                TEST_READ_FLAG_ONE);
+    }
+
+    @Test
+    public void handleMsgListChangesMsg_withNonExistingMessage_andVersion12() throws Exception {
+        MatrixCursor cursor = new MatrixCursor(new String[] {
+                BluetoothMapContract.MessageColumns._ID,
+                BluetoothMapContract.MessageColumns.FOLDER_ID,
+                BluetoothMapContract.MessageColumns.FLAG_READ,
+                BluetoothMapContract.MessageColumns.DATE,
+                BluetoothMapContract.MessageColumns.SUBJECT,
+                BluetoothMapContract.MessageColumns.FROM_LIST,
+                BluetoothMapContract.MessageColumns.FLAG_HIGH_PRIORITY,
+                BluetoothMapContract.MessageColumns.THREAD_ID,
+                BluetoothMapContract.MessageColumns.THREAD_NAME});
+        cursor.addRow(new Object[] {TEST_HANDLE_ONE, TEST_INBOX_FOLDER_ID, TEST_READ_FLAG_ONE,
+                TEST_DATE_MS, TEST_SUBJECT, TEST_ADDRESS, 1, 1, "threadName"});
+        when(mProviderClient.query(any(), any(), any(), any(), any())).thenReturn(cursor);
+
+        Map<Long, BluetoothMapContentObserver.Msg> map = new HashMap<>();
+        // Giving a different handle for msg below and cursor above makes handleMsgListChangesMsg()
+        // function for a non-existing message
+        BluetoothMapContentObserver.Msg msg = new BluetoothMapContentObserver.Msg(TEST_HANDLE_TWO,
+                TEST_INBOX_FOLDER_ID, TEST_READ_FLAG_ONE);
+        msg.localInitiatedSend = false;
+        msg.transparent = false;
+        map.put(TEST_HANDLE_TWO, msg);
+        mObserver.setMsgListMsg(map, true);
+        mObserver.mMapEventReportVersion = BluetoothMapUtils.MAP_EVENT_REPORT_V12;
+
+        mObserver.handleMsgListChangesMsg(TEST_URI);
+
+        Assert.assertEquals(mObserver.getMsgListMsg().get(TEST_HANDLE_ONE).id, TEST_HANDLE_ONE);
+        Assert.assertEquals(mObserver.getMsgListMsg().get(TEST_HANDLE_ONE).type,
+                TEST_INBOX_FOLDER_ID);
+        Assert.assertEquals(mObserver.getMsgListMsg().get(TEST_HANDLE_ONE).flagRead,
+                TEST_READ_FLAG_ONE);
+    }
+
+    @Test
+    public void handleMsgListChangesMsg_withNonExistingMessage_andVersion10() throws Exception {
+        MatrixCursor cursor = new MatrixCursor(new String[] {
+                BluetoothMapContract.MessageColumns._ID,
+                BluetoothMapContract.MessageColumns.FOLDER_ID,
+                BluetoothMapContract.MessageColumns.FLAG_READ});
+        cursor.addRow(new Object[] {TEST_HANDLE_ONE, TEST_INBOX_FOLDER_ID, TEST_READ_FLAG_ONE});
+        when(mProviderClient.query(any(), any(), any(), any(), any())).thenReturn(cursor);
+
+        Map<Long, BluetoothMapContentObserver.Msg> map = new HashMap<>();
+        // Giving a different handle for msg below and cursor above makes handleMsgListChangesMsg()
+        // function for a non-existing message
+        BluetoothMapContentObserver.Msg msg = new BluetoothMapContentObserver.Msg(TEST_HANDLE_TWO,
+                TEST_INBOX_FOLDER_ID, TEST_READ_FLAG_ONE);
+        msg.localInitiatedSend = false;
+        msg.transparent = false;
+        map.put(TEST_HANDLE_TWO, msg);
+        mObserver.setMsgListMsg(map, true);
+        mObserver.mMapEventReportVersion = BluetoothMapUtils.MAP_EVENT_REPORT_V10;
+        mFolders.setFolderId(TEST_HANDLE_TWO);
+        mObserver.setFolderStructure(mFolders);
+
+        mObserver.handleMsgListChangesMsg(TEST_URI);
+
+        Assert.assertEquals(mObserver.getMsgListMsg().get(TEST_HANDLE_ONE).id, TEST_HANDLE_ONE);
+        Assert.assertEquals(mObserver.getMsgListMsg().get(TEST_HANDLE_ONE).type,
+                TEST_INBOX_FOLDER_ID);
+        Assert.assertEquals(mObserver.getMsgListMsg().get(TEST_HANDLE_ONE).flagRead,
+                TEST_READ_FLAG_ONE);
+    }
+
+    @Test
+    public void handleMsgListChangesMsg_withExistingMessage_andNonNullDeletedFolder()
+            throws Exception {
+        MatrixCursor cursor = new MatrixCursor(new String[] {
+                BluetoothMapContract.MessageColumns._ID,
+                BluetoothMapContract.MessageColumns.FOLDER_ID,
+                BluetoothMapContract.MessageColumns.FLAG_READ,});
+        cursor.addRow(new Object[] {TEST_HANDLE_ONE, TEST_DELETE_FOLDER_ID, TEST_READ_FLAG_ONE});
+        when(mProviderClient.query(any(), any(), any(), any(), any())).thenReturn(cursor);
+
+        Map<Long, BluetoothMapContentObserver.Msg> map = new HashMap<>();
+        // Giving the same handle for msg below and cursor above makes handleMsgListChangesMsg()
+        // function for an existing message
+        BluetoothMapContentObserver.Msg msg = new BluetoothMapContentObserver.Msg(TEST_HANDLE_ONE,
+                TEST_INBOX_FOLDER_ID, TEST_READ_FLAG_ZERO);
+        map.put(TEST_HANDLE_ONE, msg);
+        mObserver.setMsgListMsg(map, true);
+        mObserver.mMapEventReportVersion = BluetoothMapUtils.MAP_EVENT_REPORT_V11;
+        setFolderStructureWithTelecomAndMsg(mFolders, BluetoothMapContract.FOLDER_NAME_DELETED,
+                TEST_DELETE_FOLDER_ID);
+        mObserver.setFolderStructure(mFolders);
+
+        mObserver.handleMsgListChangesMsg(TEST_URI);
+
+        Assert.assertEquals(mObserver.getMsgListMsg().get(TEST_HANDLE_ONE).id, TEST_HANDLE_ONE);
+        Assert.assertEquals(mObserver.getMsgListMsg().get(TEST_HANDLE_ONE).folderId,
+                TEST_DELETE_FOLDER_ID);
+        Assert.assertEquals(mObserver.getMsgListMsg().get(TEST_HANDLE_ONE).flagRead,
+                TEST_READ_FLAG_ONE);
+    }
+
+    @Test
+    public void handleMsgListChangesMsg_withExistingMessage_andNonNullSentFolder()
+            throws Exception {
+        MatrixCursor cursor = new MatrixCursor(new String[] {
+                BluetoothMapContract.MessageColumns._ID,
+                BluetoothMapContract.MessageColumns.FOLDER_ID,
+                BluetoothMapContract.MessageColumns.FLAG_READ,});
+        cursor.addRow(new Object[] {TEST_HANDLE_ONE, TEST_SENT_FOLDER_ID, TEST_READ_FLAG_ONE});
+        when(mProviderClient.query(any(), any(), any(), any(), any())).thenReturn(cursor);
+
+        Map<Long, BluetoothMapContentObserver.Msg> map = new HashMap<>();
+        // Giving the same handle for msg below and cursor above makes handleMsgListChangesMsg()
+        // function for an existing message
+        BluetoothMapContentObserver.Msg msg = new BluetoothMapContentObserver.Msg(TEST_HANDLE_ONE,
+                TEST_INBOX_FOLDER_ID, TEST_READ_FLAG_ZERO);
+        msg.localInitiatedSend = true;
+        msg.transparent = false;
+        map.put(TEST_HANDLE_ONE, msg);
+        mObserver.setMsgListMsg(map, true);
+        mObserver.mMapEventReportVersion = BluetoothMapUtils.MAP_EVENT_REPORT_V11;
+        setFolderStructureWithTelecomAndMsg(mFolders, BluetoothMapContract.FOLDER_NAME_SENT,
+                TEST_SENT_FOLDER_ID);
+        mObserver.setFolderStructure(mFolders);
+
+        mObserver.handleMsgListChangesMsg(TEST_URI);
+
+        Assert.assertEquals(mObserver.getMsgListMsg().get(TEST_HANDLE_ONE).id, TEST_HANDLE_ONE);
+        Assert.assertEquals(mObserver.getMsgListMsg().get(TEST_HANDLE_ONE).folderId,
+                TEST_SENT_FOLDER_ID);
+        Assert.assertEquals(mObserver.getMsgListMsg().get(TEST_HANDLE_ONE).flagRead,
+                TEST_READ_FLAG_ONE);
+    }
+
+    @Test
+    public void handleMsgListChangesMsg_withExistingMessage_andNonNullTransparentSentFolder()
+            throws Exception {
+        MatrixCursor cursor = new MatrixCursor(new String[] {
+                BluetoothMapContract.MessageColumns._ID,
+                BluetoothMapContract.MessageColumns.FOLDER_ID,
+                BluetoothMapContract.MessageColumns.FLAG_READ,});
+        cursor.addRow(new Object[] {TEST_HANDLE_ONE, TEST_SENT_FOLDER_ID, TEST_READ_FLAG_ONE});
+        when(mProviderClient.query(any(), any(), any(), any(), any())).thenReturn(cursor);
+
+        Map<Long, BluetoothMapContentObserver.Msg> map = new HashMap<>();
+        // Giving the same handle for msg below and cursor above makes handleMsgListChangesMsg()
+        // function for an existing message
+        BluetoothMapContentObserver.Msg msg = new BluetoothMapContentObserver.Msg(TEST_HANDLE_ONE,
+                TEST_INBOX_FOLDER_ID, TEST_READ_FLAG_ZERO);
+        msg.localInitiatedSend = true;
+        msg.transparent = true;
+        map.put(TEST_HANDLE_ONE, msg);
+        mObserver.setMsgListMsg(map, true);
+        mObserver.mMapEventReportVersion = BluetoothMapUtils.MAP_EVENT_REPORT_V11;
+        doReturn(TEST_PLACEHOLDER_INT).when(mMapMethodProxy).contentResolverDelete(any(), any(),
+                any(), any());
+        setFolderStructureWithTelecomAndMsg(mFolders, BluetoothMapContract.FOLDER_NAME_SENT,
+                TEST_SENT_FOLDER_ID);
+        mObserver.setFolderStructure(mFolders);
+        mObserver.mMessageUri = Mms.CONTENT_URI;
+
+        mObserver.handleMsgListChangesMsg(TEST_URI);
+
+        Assert.assertEquals(mObserver.getMsgListMsg().get(TEST_HANDLE_ONE).id, TEST_HANDLE_ONE);
+        Assert.assertEquals(mObserver.getMsgListMsg().get(TEST_HANDLE_ONE).folderId,
+                TEST_SENT_FOLDER_ID);
+        Assert.assertEquals(mObserver.getMsgListMsg().get(TEST_HANDLE_ONE).flagRead,
+                TEST_READ_FLAG_ONE);
+    }
+
+    @Test
+    public void handleMsgListChangesMsg_withExistingMessage_andUnknownOldFolder()
+            throws Exception {
+        MatrixCursor cursor = new MatrixCursor(new String[] {
+                BluetoothMapContract.MessageColumns._ID,
+                BluetoothMapContract.MessageColumns.FOLDER_ID,
+                BluetoothMapContract.MessageColumns.FLAG_READ,});
+        cursor.addRow(new Object[] {TEST_HANDLE_ONE, TEST_INBOX_FOLDER_ID, TEST_READ_FLAG_ONE});
+        when(mProviderClient.query(any(), any(), any(), any(), any())).thenReturn(cursor);
+
+        Map<Long, BluetoothMapContentObserver.Msg> map = new HashMap<>();
+        // Giving the same handle for msg below and cursor above makes handleMsgListChangesMsg()
+        // function for an existing message
+        BluetoothMapContentObserver.Msg msg = new BluetoothMapContentObserver.Msg(TEST_HANDLE_ONE,
+                TEST_SENT_FOLDER_ID, TEST_READ_FLAG_ZERO);
+        msg.localInitiatedSend = true;
+        msg.transparent = false;
+        map.put(TEST_HANDLE_ONE, msg);
+        mObserver.setMsgListMsg(map, true);
+        mObserver.mMapEventReportVersion = BluetoothMapUtils.MAP_EVENT_REPORT_V11;
+        setFolderStructureWithTelecomAndMsg(mFolders, BluetoothMapContract.FOLDER_NAME_DRAFT,
+                TEST_DRAFT_FOLDER_ID);
+        mObserver.setFolderStructure(mFolders);
+
+        mObserver.handleMsgListChangesMsg(TEST_URI);
+
+        Assert.assertEquals(mObserver.getMsgListMsg().get(TEST_HANDLE_ONE).id, TEST_HANDLE_ONE);
+        Assert.assertEquals(mObserver.getMsgListMsg().get(TEST_HANDLE_ONE).folderId,
+                TEST_INBOX_FOLDER_ID);
+        Assert.assertEquals(mObserver.getMsgListMsg().get(TEST_HANDLE_ONE).flagRead,
+                TEST_READ_FLAG_ONE);
+    }
+
+    @Test
+    public void handleMsgListChangesMms_withNonExistingMessage_andVersion11() {
+        MatrixCursor cursor = new MatrixCursor(new String[] {Mms._ID, Mms.MESSAGE_BOX,
+                Mms.MESSAGE_TYPE, Mms.THREAD_ID, Mms.READ, Mms.DATE, Mms.SUBJECT,
+                Mms.PRIORITY, Mms.Addr.ADDRESS});
+        cursor.addRow(new Object[] {TEST_HANDLE_ONE, TEST_MMS_TYPE_ALL, TEST_MMS_MTYPE,
+                TEST_THREAD_ID, TEST_READ_FLAG_ONE, TEST_DATE_SEC, TEST_SUBJECT,
+                PduHeaders.PRIORITY_HIGH, null});
+        doReturn(cursor).when(mMapMethodProxy).contentResolverQuery(any(), any(), any(), any(),
+                any(), any());
+
+        Map<Long, BluetoothMapContentObserver.Msg> map = new HashMap<>();
+        // Giving a different handle for msg below and cursor above makes handleMsgListChangesMms()
+        // function for a non-existing message
+        BluetoothMapContentObserver.Msg msg = new BluetoothMapContentObserver.Msg(TEST_HANDLE_TWO,
+                TEST_INBOX_FOLDER_ID, TEST_READ_FLAG_ONE);
+        map.put(TEST_HANDLE_TWO, msg);
+        mObserver.setMsgListMms(map, true);
+        mObserver.mMapEventReportVersion = BluetoothMapUtils.MAP_EVENT_REPORT_V11;
+
+        mObserver.handleMsgListChangesMms();
+
+        Assert.assertEquals(mObserver.getMsgListMms().get(TEST_HANDLE_ONE).id, TEST_HANDLE_ONE);
+        Assert.assertEquals(mObserver.getMsgListMms().get(TEST_HANDLE_ONE).type, TEST_MMS_TYPE_ALL);
+        Assert.assertEquals(mObserver.getMsgListMms().get(TEST_HANDLE_ONE).threadId,
+                TEST_THREAD_ID);
+        Assert.assertEquals(mObserver.getMsgListMms().get(TEST_HANDLE_ONE).flagRead,
+                TEST_READ_FLAG_ONE);
+    }
+
+    @Test
+    public void handleMsgListChangesMms_withNonExistingMessage_andVersion12() {
+        MatrixCursor cursor = new MatrixCursor(new String[] {Mms._ID, Mms.MESSAGE_BOX,
+                Mms.MESSAGE_TYPE, Mms.THREAD_ID, Mms.READ, Mms.DATE, Mms.SUBJECT,
+                Mms.PRIORITY, Mms.Addr.ADDRESS});
+        cursor.addRow(new Object[] {TEST_HANDLE_ONE, TEST_MMS_TYPE_ALL, TEST_MMS_MTYPE,
+                TEST_THREAD_ID, TEST_READ_FLAG_ONE, TEST_DATE_SEC, TEST_SUBJECT,
+                PduHeaders.PRIORITY_HIGH, null});
+        doReturn(cursor).when(mMapMethodProxy).contentResolverQuery(any(), any(), any(), any(),
+                any(), any());
+
+        Map<Long, BluetoothMapContentObserver.Msg> map = new HashMap<>();
+        // Giving a different handle for msg below and cursor above makes handleMsgListChangesMms()
+        // function for a non-existing message
+        BluetoothMapContentObserver.Msg msg = new BluetoothMapContentObserver.Msg(TEST_HANDLE_TWO,
+                TEST_INBOX_FOLDER_ID, TEST_READ_FLAG_ONE);
+        map.put(TEST_HANDLE_TWO, msg);
+        mObserver.setMsgListMms(map, true);
+        mObserver.mMapEventReportVersion = BluetoothMapUtils.MAP_EVENT_REPORT_V12;
+
+        mObserver.handleMsgListChangesMms();
+
+        Assert.assertEquals(mObserver.getMsgListMms().get(TEST_HANDLE_ONE).id, TEST_HANDLE_ONE);
+        Assert.assertEquals(mObserver.getMsgListMms().get(TEST_HANDLE_ONE).type, TEST_MMS_TYPE_ALL);
+        Assert.assertEquals(mObserver.getMsgListMms().get(TEST_HANDLE_ONE).threadId,
+                TEST_THREAD_ID);
+        Assert.assertEquals(mObserver.getMsgListMms().get(TEST_HANDLE_ONE).flagRead,
+                TEST_READ_FLAG_ONE);
+    }
+
+    @Test
+    public void handleMsgListChangesMms_withNonExistingOldMessage_andVersion12() {
+        Calendar cal = Calendar.getInstance();
+        cal.add(Calendar.YEAR, -1);
+        cal.add(Calendar.DATE, -1);
+        long timestampSec = TimeUnit.MILLISECONDS.toSeconds(cal.getTimeInMillis());
+
+        MatrixCursor cursor = new MatrixCursor(new String[] {Mms._ID, Mms.MESSAGE_BOX,
+            Mms.MESSAGE_TYPE, Mms.THREAD_ID, Mms.READ, Mms.DATE, Mms.SUBJECT,
+            Mms.PRIORITY, Mms.Addr.ADDRESS});
+        cursor.addRow(new Object[] {TEST_HANDLE_ONE, TEST_MMS_TYPE_ALL, TEST_MMS_MTYPE,
+            TEST_THREAD_ID, TEST_READ_FLAG_ONE, timestampSec, TEST_SUBJECT,
+            PduHeaders.PRIORITY_HIGH, null});
+        doReturn(cursor).when(mMapMethodProxy).contentResolverQuery(any(), any(), any(), any(),
+            any(), any());
+
+        Map<Long, BluetoothMapContentObserver.Msg> map = new HashMap<>();
+        // Giving a different handle for msg below and cursor above makes handleMsgListChangesMms()
+        // function for a non-existing message
+        BluetoothMapContentObserver.Msg msg = new BluetoothMapContentObserver.Msg(TEST_HANDLE_TWO,
+            TEST_INBOX_FOLDER_ID, TEST_READ_FLAG_ONE);
+        map.put(TEST_HANDLE_TWO, msg);
+        mObserver.setMsgListMms(map, true);
+        mObserver.mMapEventReportVersion = BluetoothMapUtils.MAP_EVENT_REPORT_V12;
+
+        mObserver.handleMsgListChangesMms();
+
+        Assert.assertEquals(mObserver.getMsgListMms().get(TEST_HANDLE_ONE), null);
+    }
+
+    @Test
+    public void handleMsgListChangesMms_withNonExistingMessage_andVersion10() {
+        MatrixCursor cursor = new MatrixCursor(new String[] {Mms._ID, Mms.MESSAGE_BOX,
+                Mms.MESSAGE_TYPE, Mms.THREAD_ID, Mms.READ});
+        cursor.addRow(new Object[] {TEST_HANDLE_ONE, TEST_MMS_TYPE_ALL, TEST_MMS_MTYPE,
+                TEST_THREAD_ID, TEST_READ_FLAG_ONE});
+        doReturn(cursor).when(mMapMethodProxy).contentResolverQuery(any(), any(), any(), any(),
+                any(), any());
+
+        Map<Long, BluetoothMapContentObserver.Msg> map = new HashMap<>();
+        // Giving a different handle for msg below and cursor above makes handleMsgListChangesMms()
+        // function for a non-existing message
+        BluetoothMapContentObserver.Msg msg = new BluetoothMapContentObserver.Msg(TEST_HANDLE_TWO,
+                TEST_INBOX_FOLDER_ID, TEST_READ_FLAG_ONE);
+        map.put(TEST_HANDLE_TWO, msg);
+        mObserver.setMsgListMms(map, true);
+        mObserver.mMapEventReportVersion = BluetoothMapUtils.MAP_EVENT_REPORT_V10;
+
+        mObserver.handleMsgListChangesMms();
+
+        Assert.assertEquals(mObserver.getMsgListMms().get(TEST_HANDLE_ONE).id, TEST_HANDLE_ONE);
+        Assert.assertEquals(mObserver.getMsgListMms().get(TEST_HANDLE_ONE).type, TEST_MMS_TYPE_ALL);
+        Assert.assertEquals(mObserver.getMsgListMms().get(TEST_HANDLE_ONE).threadId,
+                TEST_THREAD_ID);
+        Assert.assertEquals(mObserver.getMsgListMms().get(TEST_HANDLE_ONE).flagRead,
+                TEST_READ_FLAG_ONE);
+    }
+
+    @Test
+    public void handleMsgListChangesMms_withExistingMessage_withNonEqualType_andLocalSendFalse() {
+        MatrixCursor cursor = new MatrixCursor(new String[] {Mms._ID, Mms.MESSAGE_BOX,
+                Mms.MESSAGE_TYPE, Mms.THREAD_ID, Mms.READ});
+        cursor.addRow(new Object[] {TEST_HANDLE_ONE, TEST_MMS_TYPE_ALL, TEST_MMS_MTYPE,
+                TEST_THREAD_ID, TEST_READ_FLAG_ONE});
+        doReturn(cursor).when(mMapMethodProxy).contentResolverQuery(any(), any(), any(), any(),
+                any(), any());
+
+        Map<Long, BluetoothMapContentObserver.Msg> map = new HashMap<>();
+        // Giving the same handle for msg below and cursor above makes handleMsgListChangesMms()
+        // function for an existing message
+        BluetoothMapContentObserver.Msg msg = new BluetoothMapContentObserver.Msg(TEST_HANDLE_ONE,
+                TEST_MMS_TYPE_INBOX, TEST_THREAD_ID, TEST_READ_FLAG_ZERO);
+        map.put(TEST_HANDLE_ONE, msg);
+        msg.localInitiatedSend = false;
+        mObserver.setMsgListMms(map, true);
+        mObserver.mMapEventReportVersion = BluetoothMapUtils.MAP_EVENT_REPORT_V12;
+
+        mObserver.handleMsgListChangesMms();
+
+        Assert.assertEquals(mObserver.getMsgListMms().get(TEST_HANDLE_ONE).id, TEST_HANDLE_ONE);
+        Assert.assertEquals(mObserver.getMsgListMms().get(TEST_HANDLE_ONE).type, TEST_MMS_TYPE_ALL);
+        Assert.assertEquals(mObserver.getMsgListMms().get(TEST_HANDLE_ONE).threadId,
+                TEST_THREAD_ID);
+        Assert.assertEquals(mObserver.getMsgListMms().get(TEST_HANDLE_ONE).flagRead,
+                TEST_READ_FLAG_ONE);
+    }
+
+    @Test
+    public void handleMsgListChangesMms_withExistingMessage_withNonEqualType_andLocalSendTrue() {
+        MatrixCursor cursor = new MatrixCursor(new String[] {Mms._ID, Mms.MESSAGE_BOX,
+                Mms.MESSAGE_TYPE, Mms.THREAD_ID, Mms.READ});
+        cursor.addRow(new Object[] {TEST_HANDLE_ONE, TEST_MMS_TYPE_ALL, TEST_MMS_MTYPE,
+                TEST_THREAD_ID, TEST_READ_FLAG_ONE});
+        doReturn(cursor).when(mMapMethodProxy).contentResolverQuery(any(), any(), any(), any(),
+                any(), any());
+
+        Map<Long, BluetoothMapContentObserver.Msg> map = new HashMap<>();
+        // Giving the same handle for msg below and cursor above makes handleMsgListChangesMms()
+        // function for an existing message
+        BluetoothMapContentObserver.Msg msg = new BluetoothMapContentObserver.Msg(TEST_HANDLE_ONE,
+                TEST_MMS_TYPE_INBOX, TEST_THREAD_ID, TEST_READ_FLAG_ZERO);
+        map.put(TEST_HANDLE_ONE, msg);
+        msg.localInitiatedSend = true;
+        mObserver.setMsgListMms(map, true);
+        mObserver.mMapEventReportVersion = BluetoothMapUtils.MAP_EVENT_REPORT_V12;
+
+        mObserver.handleMsgListChangesMms();
+
+        Assert.assertEquals(mObserver.getMsgListMms().get(TEST_HANDLE_ONE).id, TEST_HANDLE_ONE);
+        Assert.assertEquals(mObserver.getMsgListMms().get(TEST_HANDLE_ONE).type, TEST_MMS_TYPE_ALL);
+        Assert.assertEquals(mObserver.getMsgListMms().get(TEST_HANDLE_ONE).threadId,
+                TEST_THREAD_ID);
+        Assert.assertEquals(mObserver.getMsgListMms().get(TEST_HANDLE_ONE).flagRead,
+                TEST_READ_FLAG_ONE);
+    }
+
+    @Test
+    public void handleMsgListChangesMms_withExistingMessage_withDeletedThreadId() {
+        MatrixCursor cursor = new MatrixCursor(new String[] {Mms._ID, Mms.MESSAGE_BOX,
+                Mms.MESSAGE_TYPE, Mms.THREAD_ID, Mms.READ});
+        cursor.addRow(new Object[] {TEST_HANDLE_ONE, TEST_MMS_TYPE_ALL, TEST_MMS_MTYPE,
+                BluetoothMapContentObserver.DELETED_THREAD_ID, TEST_READ_FLAG_ONE});
+        doReturn(cursor).when(mMapMethodProxy).contentResolverQuery(any(), any(), any(), any(),
+                any(), any());
+
+        Map<Long, BluetoothMapContentObserver.Msg> map = new HashMap<>();
+        // Giving the same handle for msg below and cursor above makes handleMsgListChangesMms()
+        // function for an existing message
+        BluetoothMapContentObserver.Msg msg = new BluetoothMapContentObserver.Msg(TEST_HANDLE_ONE,
+                TEST_MMS_TYPE_ALL, TEST_THREAD_ID, TEST_READ_FLAG_ZERO);
+        map.put(TEST_HANDLE_ONE, msg);
+        msg.localInitiatedSend = true;
+        mObserver.setMsgListMms(map, true);
+        mObserver.mMapEventReportVersion = BluetoothMapUtils.MAP_EVENT_REPORT_V12;
+
+        mObserver.handleMsgListChangesMms();
+
+        Assert.assertEquals(mObserver.getMsgListMms().get(TEST_HANDLE_ONE).id, TEST_HANDLE_ONE);
+        Assert.assertEquals(mObserver.getMsgListMms().get(TEST_HANDLE_ONE).type, TEST_MMS_TYPE_ALL);
+        Assert.assertEquals(mObserver.getMsgListMms().get(TEST_HANDLE_ONE).threadId,
+                BluetoothMapContentObserver.DELETED_THREAD_ID);
+        Assert.assertEquals(mObserver.getMsgListMms().get(TEST_HANDLE_ONE).flagRead,
+                TEST_READ_FLAG_ONE);
+    }
+
+    @Test
+    public void handleMsgListChangesMms_withExistingMessage_withUndeletedThreadId() {
+        int undeletedThreadId = 0;
+        MatrixCursor cursor = new MatrixCursor(new String[] {Mms._ID, Mms.MESSAGE_BOX,
+                Mms.MESSAGE_TYPE, Mms.THREAD_ID, Mms.READ});
+        cursor.addRow(new Object[] {TEST_HANDLE_ONE, TEST_MMS_TYPE_ALL, TEST_MMS_MTYPE,
+                undeletedThreadId, TEST_READ_FLAG_ONE});
+        doReturn(cursor).when(mMapMethodProxy).contentResolverQuery(any(), any(), any(), any(),
+                any(), any());
+
+        Map<Long, BluetoothMapContentObserver.Msg> map = new HashMap<>();
+        // Giving the same handle for msg below and cursor above makes handleMsgListChangesMms()
+        // function for an existing message
+        BluetoothMapContentObserver.Msg msg = new BluetoothMapContentObserver.Msg(TEST_HANDLE_ONE,
+                TEST_MMS_TYPE_ALL, TEST_THREAD_ID, TEST_READ_FLAG_ZERO);
+        map.put(TEST_HANDLE_ONE, msg);
+        msg.localInitiatedSend = true;
+        mObserver.setMsgListMms(map, true);
+        mObserver.mMapEventReportVersion = BluetoothMapUtils.MAP_EVENT_REPORT_V12;
+
+        mObserver.handleMsgListChangesMms();
+
+        Assert.assertEquals(mObserver.getMsgListMms().get(TEST_HANDLE_ONE).id, TEST_HANDLE_ONE);
+        Assert.assertEquals(mObserver.getMsgListMms().get(TEST_HANDLE_ONE).type, TEST_MMS_TYPE_ALL);
+        Assert.assertEquals(mObserver.getMsgListMms().get(TEST_HANDLE_ONE).threadId,
+                undeletedThreadId);
+        Assert.assertEquals(mObserver.getMsgListMms().get(TEST_HANDLE_ONE).flagRead,
+                TEST_READ_FLAG_ONE);
+    }
+
+    @Test
+    public void handleMsgListChangesSms_withNonExistingMessage_andVersion11() {
+        MatrixCursor cursor = new MatrixCursor(new String[] {Sms._ID, Sms.TYPE, Sms.THREAD_ID,
+                Sms.READ, Sms.DATE, Sms.BODY, Sms.ADDRESS, ContactsContract.Contacts.DISPLAY_NAME});
+        cursor.addRow(new Object[] {TEST_HANDLE_ONE, TEST_SMS_TYPE_INBOX, TEST_THREAD_ID,
+                TEST_READ_FLAG_ONE, TEST_DATE_MS, TEST_SUBJECT, TEST_ADDRESS, null});
+        doReturn(cursor).when(mMapMethodProxy).contentResolverQuery(any(), any(), any(), any(),
+                any(), any());
+
+        Map<Long, BluetoothMapContentObserver.Msg> map = new HashMap<>();
+        // Giving a different handle for msg below and cursor above makes handleMsgListChangesSms()
+        // function for a non-existing message
+        BluetoothMapContentObserver.Msg msg = new BluetoothMapContentObserver.Msg(TEST_HANDLE_TWO,
+                TEST_SMS_TYPE_ALL, TEST_READ_FLAG_ONE);
+        map.put(TEST_HANDLE_TWO, msg);
+        mObserver.setMsgListSms(map, true);
+        mObserver.mMapEventReportVersion = BluetoothMapUtils.MAP_EVENT_REPORT_V11;
+
+        mObserver.handleMsgListChangesSms();
+
+        Assert.assertEquals(mObserver.getMsgListSms().get(TEST_HANDLE_ONE).id, TEST_HANDLE_ONE);
+        Assert.assertEquals(mObserver.getMsgListSms().get(TEST_HANDLE_ONE).type,
+                TEST_SMS_TYPE_INBOX);
+        Assert.assertEquals(mObserver.getMsgListSms().get(TEST_HANDLE_ONE).threadId,
+                TEST_THREAD_ID);
+        Assert.assertEquals(mObserver.getMsgListSms().get(TEST_HANDLE_ONE).flagRead,
+                TEST_READ_FLAG_ONE);
+    }
+
+    @Test
+    public void handleMsgListChangesSms_withNonExistingMessage_andVersion12() {
+        MatrixCursor cursor = new MatrixCursor(new String[] {Sms._ID, Sms.TYPE, Sms.THREAD_ID,
+                Sms.READ, Sms.DATE, Sms.BODY, Sms.ADDRESS});
+        cursor.addRow(new Object[] {TEST_HANDLE_ONE, TEST_SMS_TYPE_ALL, TEST_THREAD_ID,
+                TEST_READ_FLAG_ONE, TEST_DATE_MS, "", null});
+        doReturn(cursor).when(mMapMethodProxy).contentResolverQuery(any(), any(), any(), any(),
+                any(), any());
+
+        Map<Long, BluetoothMapContentObserver.Msg> map = new HashMap<>();
+        // Giving a different handle for msg below and cursor above makes handleMsgListChangesSms()
+        // function for a non-existing message
+        BluetoothMapContentObserver.Msg msg = new BluetoothMapContentObserver.Msg(TEST_HANDLE_TWO,
+                TEST_SMS_TYPE_INBOX, TEST_READ_FLAG_ONE);
+        map.put(TEST_HANDLE_TWO, msg);
+        mObserver.setMsgListSms(map, true);
+        mObserver.mMapEventReportVersion = BluetoothMapUtils.MAP_EVENT_REPORT_V12;
+
+        mObserver.handleMsgListChangesSms();
+
+        Assert.assertEquals(mObserver.getMsgListSms().get(TEST_HANDLE_ONE).id, TEST_HANDLE_ONE);
+        Assert.assertEquals(mObserver.getMsgListSms().get(TEST_HANDLE_ONE).type,
+                TEST_SMS_TYPE_ALL);
+        Assert.assertEquals(mObserver.getMsgListSms().get(TEST_HANDLE_ONE).threadId,
+                TEST_THREAD_ID);
+        Assert.assertEquals(mObserver.getMsgListSms().get(TEST_HANDLE_ONE).flagRead,
+                TEST_READ_FLAG_ONE);
+    }
+
+    @Test
+    public void handleMsgListChangesSms_withNonExistingOldMessage_andVersion12() {
+        Calendar cal = Calendar.getInstance();
+        cal.add(Calendar.YEAR, -1);
+        cal.add(Calendar.DATE, -1);
+
+        MatrixCursor cursor = new MatrixCursor(new String[] {Sms._ID, Sms.TYPE, Sms.THREAD_ID,
+            Sms.READ, Sms.DATE, Sms.BODY, Sms.ADDRESS});
+        cursor.addRow(new Object[] {TEST_HANDLE_ONE, TEST_SMS_TYPE_ALL, TEST_THREAD_ID,
+            TEST_READ_FLAG_ONE, cal.getTimeInMillis(), "", null});
+        doReturn(cursor).when(mMapMethodProxy).contentResolverQuery(any(), any(), any(), any(),
+            any(), any());
+
+        Map<Long, BluetoothMapContentObserver.Msg> map = new HashMap<>();
+        // Giving a different handle for msg below and cursor above makes handleMsgListChangesMms()
+        // function for a non-existing message
+        BluetoothMapContentObserver.Msg msg = new BluetoothMapContentObserver.Msg(TEST_HANDLE_TWO,
+            TEST_SMS_TYPE_INBOX, TEST_READ_FLAG_ONE);
+        map.put(TEST_HANDLE_TWO, msg);
+        mObserver.setMsgListSms(map, true);
+        mObserver.mMapEventReportVersion = BluetoothMapUtils.MAP_EVENT_REPORT_V12;
+
+        mObserver.handleMsgListChangesSms();
+
+        Assert.assertEquals(mObserver.getMsgListSms().get(TEST_HANDLE_ONE), null);
+    }
+
+    @Test
+    public void handleMsgListChangesSms_withNonExistingMessage_andVersion10() {
+        MatrixCursor cursor = new MatrixCursor(new String[] {Sms._ID, Sms.TYPE, Sms.THREAD_ID,
+                Sms.READ});
+        cursor.addRow(new Object[] {TEST_HANDLE_ONE, TEST_SMS_TYPE_ALL, TEST_THREAD_ID,
+                TEST_READ_FLAG_ONE});
+        doReturn(cursor).when(mMapMethodProxy).contentResolverQuery(any(), any(), any(), any(),
+                any(), any());
+
+        Map<Long, BluetoothMapContentObserver.Msg> map = new HashMap<>();
+        // Giving a different handle for msg below and cursor above makes handleMsgListChangesSms()
+        // function for a non-existing message
+        BluetoothMapContentObserver.Msg msg = new BluetoothMapContentObserver.Msg(TEST_HANDLE_TWO,
+                TEST_SMS_TYPE_INBOX, TEST_READ_FLAG_ONE);
+        map.put(TEST_HANDLE_TWO, msg);
+        mObserver.setMsgListSms(map, true);
+        mObserver.mMapEventReportVersion = BluetoothMapUtils.MAP_EVENT_REPORT_V10;
+
+        mObserver.handleMsgListChangesSms();
+
+        Assert.assertEquals(mObserver.getMsgListSms().get(TEST_HANDLE_ONE).id, TEST_HANDLE_ONE);
+        Assert.assertEquals(mObserver.getMsgListSms().get(TEST_HANDLE_ONE).type,
+                TEST_SMS_TYPE_ALL);
+        Assert.assertEquals(mObserver.getMsgListSms().get(TEST_HANDLE_ONE).threadId,
+                TEST_THREAD_ID);
+        Assert.assertEquals(mObserver.getMsgListSms().get(TEST_HANDLE_ONE).flagRead,
+                TEST_READ_FLAG_ONE);
+    }
+
+    @Test
+    public void handleMsgListChangesSms_withExistingMessage_withNonEqualType() {
+        MatrixCursor cursor = new MatrixCursor(new String[] {Sms._ID, Sms.TYPE, Sms.THREAD_ID,
+                Sms.READ});
+        cursor.addRow(new Object[] {TEST_HANDLE_ONE, TEST_SMS_TYPE_ALL, TEST_THREAD_ID,
+                TEST_READ_FLAG_ONE});
+        doReturn(cursor).when(mMapMethodProxy).contentResolverQuery(any(), any(), any(), any(),
+                any(), any());
+
+        Map<Long, BluetoothMapContentObserver.Msg> map = new HashMap<>();
+        // Giving the same handle for msg below and cursor above makes handleMsgListChangesSms()
+        // function for an existing message
+        BluetoothMapContentObserver.Msg msg = new BluetoothMapContentObserver.Msg(TEST_HANDLE_ONE,
+                TEST_SMS_TYPE_INBOX, TEST_THREAD_ID, TEST_READ_FLAG_ZERO);
+        map.put(TEST_HANDLE_ONE, msg);
+        mObserver.setMsgListSms(map, true);
+        mObserver.mMapEventReportVersion = BluetoothMapUtils.MAP_EVENT_REPORT_V12;
+
+        mObserver.handleMsgListChangesSms();
+
+        Assert.assertEquals(mObserver.getMsgListSms().get(TEST_HANDLE_ONE).id, TEST_HANDLE_ONE);
+        Assert.assertEquals(mObserver.getMsgListSms().get(TEST_HANDLE_ONE).type,
+                TEST_SMS_TYPE_ALL);
+        Assert.assertEquals(mObserver.getMsgListSms().get(TEST_HANDLE_ONE).threadId,
+                TEST_THREAD_ID);
+        Assert.assertEquals(mObserver.getMsgListSms().get(TEST_HANDLE_ONE).flagRead,
+                TEST_READ_FLAG_ONE);
+    }
+
+    @Test
+    public void handleMsgListChangesSms_withExistingMessage_withDeletedThreadId() {
+        MatrixCursor cursor = new MatrixCursor(new String[] {Sms._ID, Sms.TYPE, Sms.THREAD_ID,
+                Sms.READ});
+        cursor.addRow(new Object[] {TEST_HANDLE_ONE, TEST_SMS_TYPE_ALL,
+                BluetoothMapContentObserver.DELETED_THREAD_ID, TEST_READ_FLAG_ONE});
+        doReturn(cursor).when(mMapMethodProxy).contentResolverQuery(any(), any(), any(), any(),
+                any(), any());
+
+        Map<Long, BluetoothMapContentObserver.Msg> map = new HashMap<>();
+        // Giving the same handle for msg below and cursor above makes handleMsgListChangesSms()
+        // function for an existing message
+        BluetoothMapContentObserver.Msg msg = new BluetoothMapContentObserver.Msg(TEST_HANDLE_ONE,
+                TEST_SMS_TYPE_ALL, TEST_THREAD_ID, TEST_READ_FLAG_ZERO);
+        map.put(TEST_HANDLE_ONE, msg);
+        mObserver.setMsgListSms(map, true);
+        mObserver.mMapEventReportVersion = BluetoothMapUtils.MAP_EVENT_REPORT_V12;
+
+        mObserver.handleMsgListChangesSms();
+
+        Assert.assertEquals(mObserver.getMsgListSms().get(TEST_HANDLE_ONE).id, TEST_HANDLE_ONE);
+        Assert.assertEquals(mObserver.getMsgListSms().get(TEST_HANDLE_ONE).type, TEST_SMS_TYPE_ALL);
+        Assert.assertEquals(mObserver.getMsgListSms().get(TEST_HANDLE_ONE).threadId,
+                BluetoothMapContentObserver.DELETED_THREAD_ID);
+        Assert.assertEquals(mObserver.getMsgListSms().get(TEST_HANDLE_ONE).flagRead,
+                TEST_READ_FLAG_ONE);
+    }
+
+    @Test
+    public void handleMsgListChangesSms_withExistingMessage_withUndeletedThreadId() {
+        int undeletedThreadId = 0;
+        MatrixCursor cursor = new MatrixCursor(new String[] {Sms._ID, Sms.TYPE, Sms.THREAD_ID,
+                Sms.READ});
+        cursor.addRow(new Object[] {TEST_HANDLE_ONE, TEST_SMS_TYPE_ALL, undeletedThreadId,
+                TEST_READ_FLAG_ONE});
+        doReturn(cursor).when(mMapMethodProxy).contentResolverQuery(any(), any(), any(), any(),
+                any(), any());
+
+        Map<Long, BluetoothMapContentObserver.Msg> map = new HashMap<>();
+        // Giving the same handle for msg below and cursor above makes handleMsgListChangesSms()
+        // function for an existing message
+        BluetoothMapContentObserver.Msg msg = new BluetoothMapContentObserver.Msg(TEST_HANDLE_ONE,
+                TEST_SMS_TYPE_ALL, TEST_THREAD_ID, TEST_READ_FLAG_ZERO);
+        map.put(TEST_HANDLE_ONE, msg);
+        mObserver.setMsgListSms(map, true);
+        mObserver.mMapEventReportVersion = BluetoothMapUtils.MAP_EVENT_REPORT_V12;
+
+        mObserver.handleMsgListChangesSms();
+
+        Assert.assertEquals(mObserver.getMsgListSms().get(TEST_HANDLE_ONE).id, TEST_HANDLE_ONE);
+        Assert.assertEquals(mObserver.getMsgListSms().get(TEST_HANDLE_ONE).type, TEST_SMS_TYPE_ALL);
+        Assert.assertEquals(mObserver.getMsgListSms().get(TEST_HANDLE_ONE).threadId,
+                undeletedThreadId);
+        Assert.assertEquals(mObserver.getMsgListSms().get(TEST_HANDLE_ONE).flagRead,
+                TEST_READ_FLAG_ONE);
+    }
+
+    @Test
+    public void handleMmsSendIntent_withMnsClientNotConnected() {
+        when(mClient.isConnected()).thenReturn(false);
+
+        Assert.assertFalse(mObserver.handleMmsSendIntent(mContext, mIntent));
+    }
+
+    @Test
+    public void handleMmsSendIntent_withInvalidHandle() {
+        when(mClient.isConnected()).thenReturn(true);
+        doReturn((long) -1).when(mIntent).getLongExtra(
+                BluetoothMapContentObserver.EXTRA_MESSAGE_SENT_HANDLE, -1);
+
+        Assert.assertTrue(mObserver.handleMmsSendIntent(mContext, mIntent));
+    }
+
+    @Test
+    public void handleMmsSendIntent_withActivityResultOk() {
+        when(mClient.isConnected()).thenReturn(true);
+        doReturn(TEST_HANDLE_ONE).when(mIntent).getLongExtra(
+                BluetoothMapContentObserver.EXTRA_MESSAGE_SENT_HANDLE, -1);
+        doReturn(Activity.RESULT_OK).when(mIntent).getIntExtra(
+                BluetoothMapContentObserver.EXTRA_MESSAGE_SENT_RESULT, Activity.RESULT_CANCELED);
+        doReturn(0).when(mIntent).getIntExtra(
+                BluetoothMapContentObserver.EXTRA_MESSAGE_SENT_TRANSPARENT, 0);
+        mObserver.mObserverRegistered = true;
+
+        Assert.assertTrue(mObserver.handleMmsSendIntent(mContext, mIntent));
+    }
+
+    @Test
+    public void handleMmsSendIntent_withActivityResultFirstUser() {
+        when(mClient.isConnected()).thenReturn(true);
+        doReturn(TEST_HANDLE_ONE).when(mIntent).getLongExtra(
+                BluetoothMapContentObserver.EXTRA_MESSAGE_SENT_HANDLE, -1);
+        doReturn(Activity.RESULT_FIRST_USER).when(mIntent).getIntExtra(
+                BluetoothMapContentObserver.EXTRA_MESSAGE_SENT_RESULT, Activity.RESULT_CANCELED);
+        mObserver.mObserverRegistered = true;
+        doReturn(TEST_PLACEHOLDER_INT).when(mMapMethodProxy).contentResolverDelete(any(), any(),
+                any(), any());
+
+        Assert.assertTrue(mObserver.handleMmsSendIntent(mContext, mIntent));
+    }
+
+    @Test
+    public void actionMessageSentDisconnected_withTypeMms() {
+        Map<Long, BluetoothMapContentObserver.Msg> mmsMsgList = new HashMap<>();
+        BluetoothMapContentObserver.Msg msg = createSimpleMsg();
+        mmsMsgList.put(TEST_HANDLE_ONE, msg);
+        doReturn(1).when(mIntent).getIntExtra(
+                BluetoothMapContentObserver.EXTRA_MESSAGE_SENT_TRANSPARENT, 0);
+        doReturn((long) -1).when(mIntent).getLongExtra(
+                BluetoothMapContentObserver.EXTRA_MESSAGE_SENT_HANDLE, -1);
+        // This mock sets type to MMS
+        doReturn(4).when(mIntent).getIntExtra(
+                BluetoothMapContentObserver.EXTRA_MESSAGE_SENT_MSG_TYPE, TYPE.NONE.ordinal());
+
+        mObserver.actionMessageSentDisconnected(mContext, mIntent, 1);
+
+        Assert.assertTrue(mmsMsgList.containsKey(TEST_HANDLE_ONE));
+    }
+
+    @Test
+    public void actionMessageSentDisconnected_withTypeEmail() {
+        // This sets to null uriString
+        doReturn(null).when(mIntent).getStringExtra(
+                BluetoothMapContentObserver.EXTRA_MESSAGE_SENT_URI);
+        doReturn(1).when(mIntent).getIntExtra(
+                BluetoothMapContentObserver.EXTRA_MESSAGE_SENT_TRANSPARENT, 0);
+        // This mock sets type to Email
+        doReturn(1).when(mIntent).getIntExtra(
+                BluetoothMapContentObserver.EXTRA_MESSAGE_SENT_MSG_TYPE, TYPE.NONE.ordinal());
+        clearInvocations(mContext);
+
+        mObserver.actionMessageSentDisconnected(mContext, mIntent, Activity.RESULT_FIRST_USER);
+
+        verify(mContext, never()).getContentResolver();
+    }
+
+    @Test
+    public void actionMmsSent_withInvalidHandle() {
+        Map<Long, BluetoothMapContentObserver.Msg> mmsMsgList = new HashMap<>();
+        BluetoothMapContentObserver.Msg msg = createSimpleMsg();
+        mmsMsgList.put(TEST_HANDLE_ONE, msg);
+        doReturn(1).when(mIntent).getIntExtra(
+                BluetoothMapContentObserver.EXTRA_MESSAGE_SENT_TRANSPARENT, 0);
+        doReturn((long) -1).when(mIntent).getLongExtra(
+                BluetoothMapContentObserver.EXTRA_MESSAGE_SENT_HANDLE, -1);
+
+        mObserver.actionMmsSent(mContext, mIntent, 1, mmsMsgList);
+
+        Assert.assertTrue(mmsMsgList.containsKey(TEST_HANDLE_ONE));
+    }
+
+    @Test
+    public void actionMmsSent_withTransparency() {
+        Map<Long, BluetoothMapContentObserver.Msg> mmsMsgList = new HashMap<>();
+        BluetoothMapContentObserver.Msg msg = createSimpleMsg();
+        mmsMsgList.put(TEST_HANDLE_ONE, msg);
+        // This mock turns on the transparent flag
+        doReturn(1).when(mIntent).getIntExtra(
+                BluetoothMapContentObserver.EXTRA_MESSAGE_SENT_TRANSPARENT, 0);
+        doReturn(TEST_HANDLE_ONE).when(mIntent).getLongExtra(
+                BluetoothMapContentObserver.EXTRA_MESSAGE_SENT_HANDLE, -1);
+        doReturn(TEST_PLACEHOLDER_INT).when(mMapMethodProxy).contentResolverDelete(any(), any(),
+                any(), any());
+
+        mObserver.actionMmsSent(mContext, mIntent, 1, mmsMsgList);
+
+        Assert.assertFalse(mmsMsgList.containsKey(TEST_HANDLE_ONE));
+    }
+
+    @Test
+    public void actionMmsSent_withActivityResultOk() {
+        Map<Long, BluetoothMapContentObserver.Msg> mmsMsgList = new HashMap<>();
+        BluetoothMapContentObserver.Msg msg = createSimpleMsg();
+        mmsMsgList.put(TEST_HANDLE_ONE, msg);
+        // This mock turns off the transparent flag
+        doReturn(0).when(mIntent).getIntExtra(
+                BluetoothMapContentObserver.EXTRA_MESSAGE_SENT_TRANSPARENT, 0);
+        doReturn(TEST_HANDLE_ONE).when(mIntent).getLongExtra(
+                BluetoothMapContentObserver.EXTRA_MESSAGE_SENT_HANDLE, -1);
+
+        MatrixCursor cursor = new MatrixCursor(new String[] {});
+        doReturn(cursor).when(mMapMethodProxy).contentResolverQuery(any(), any(), any(), any(),
+                any(), any());
+        doReturn(TEST_PLACEHOLDER_INT).when(mMapMethodProxy).contentResolverUpdate(any(), any(),
+                any(), any(), any());
+
+        mObserver.actionMmsSent(mContext, mIntent, Activity.RESULT_OK, mmsMsgList);
+
+        Assert.assertTrue(mmsMsgList.containsKey(TEST_HANDLE_ONE));
+    }
+
+    @Test
+    public void actionMmsSent_withActivityResultFirstUser() {
+        Map<Long, BluetoothMapContentObserver.Msg> mmsMsgList = new HashMap<>();
+        BluetoothMapContentObserver.Msg msg = createSimpleMsg();
+        mmsMsgList.put(TEST_HANDLE_ONE, msg);
+        // This mock turns off the transparent flag
+        doReturn(0).when(mIntent).getIntExtra(
+                BluetoothMapContentObserver.EXTRA_MESSAGE_SENT_TRANSPARENT, 0);
+        doReturn(TEST_HANDLE_ONE).when(mIntent).getLongExtra(
+                BluetoothMapContentObserver.EXTRA_MESSAGE_SENT_HANDLE, -1);
+
+        mObserver.actionMmsSent(mContext, mIntent, Activity.RESULT_FIRST_USER, mmsMsgList);
+
+        Assert.assertEquals(msg.type, Mms.MESSAGE_BOX_OUTBOX);
+    }
+
+    @Test
+    public void actionSmsSentDisconnected_withNullUriString() {
+        // This sets to null uriString
+        doReturn(null).when(mIntent).getStringExtra(
+                BluetoothMapContentObserver.EXTRA_MESSAGE_SENT_URI);
+        doReturn(1).when(mIntent).getIntExtra(
+                BluetoothMapContentObserver.EXTRA_MESSAGE_SENT_TRANSPARENT, 0);
+
+        clearInvocations(mContext);
+        mObserver.actionSmsSentDisconnected(mContext, mIntent, Activity.RESULT_FIRST_USER);
+
+        verify(mContext, never()).getContentResolver();
+    }
+
+    @Test
+    public void actionSmsSentDisconnected_withActivityResultOk_andTransparentOff() {
+        doReturn(TEST_URI_STR).when(mIntent).getStringExtra(
+                BluetoothMapContentObserver.EXTRA_MESSAGE_SENT_URI);
+        // This mock turns off the transparent flag
+        doReturn(0).when(mIntent).getIntExtra(
+                BluetoothMapContentObserver.EXTRA_MESSAGE_SENT_TRANSPARENT, 0);
+        doReturn(TEST_PLACEHOLDER_INT).when(mMapMethodProxy).contentResolverUpdate(any(), any(),
+                any(), any(), any());
+
+        clearInvocations(mContext);
+        mObserver.actionSmsSentDisconnected(mContext, mIntent, Activity.RESULT_OK);
+
+        verify(mContext).getContentResolver();
+    }
+
+    @Test
+    public void actionSmsSentDisconnected_withActivityResultOk_andTransparentOn() {
+        doReturn(TEST_URI_STR).when(mIntent).getStringExtra(
+                BluetoothMapContentObserver.EXTRA_MESSAGE_SENT_URI);
+        // This mock turns on the transparent flag
+        doReturn(1).when(mIntent).getIntExtra(
+                BluetoothMapContentObserver.EXTRA_MESSAGE_SENT_TRANSPARENT, 0);
+        doReturn(TEST_PLACEHOLDER_INT).when(mMapMethodProxy).contentResolverDelete(any(), any(),
+                any(), any());
+
+        clearInvocations(mContext);
+        mObserver.actionSmsSentDisconnected(mContext, mIntent, Activity.RESULT_OK);
+
+        verify(mContext).getContentResolver();
+    }
+
+    @Test
+    public void actionSmsSentDisconnected_withActivityResultFirstUser_andTransparentOff() {
+        doReturn(TEST_URI_STR).when(mIntent).getStringExtra(
+                BluetoothMapContentObserver.EXTRA_MESSAGE_SENT_URI);
+        // This mock turns off the transparent flag
+        doReturn(0).when(mIntent).getIntExtra(
+                BluetoothMapContentObserver.EXTRA_MESSAGE_SENT_TRANSPARENT, 0);
+        doReturn(TEST_PLACEHOLDER_INT).when(mMapMethodProxy).contentResolverUpdate(any(), any(),
+                any(), any(), any());
+
+        clearInvocations(mContext);
+        mObserver.actionSmsSentDisconnected(mContext, mIntent, Activity.RESULT_OK);
+
+        verify(mContext).getContentResolver();
+    }
+
+    @Test
+    public void actionSmsSentDisconnected_withActivityResultFirstUser_andTransparentOn() {
+        doReturn(TEST_URI_STR).when(mIntent).getStringExtra(
+                BluetoothMapContentObserver.EXTRA_MESSAGE_SENT_URI);
+        // This mock turns on the transparent flag
+        doReturn(1).when(mIntent).getIntExtra(
+                BluetoothMapContentObserver.EXTRA_MESSAGE_SENT_TRANSPARENT, 0);
+        doReturn(null).when(mContext).getContentResolver();
+
+        clearInvocations(mContext);
+        mObserver.actionSmsSentDisconnected(mContext, mIntent, Activity.RESULT_OK);
+
+        verify(mContext).getContentResolver();
+    }
+
+    @Test
+    public void handleContactListChanges_withNullContactForUci() throws Exception {
+        Uri uri = mock(Uri.class);
+        mObserver.mAuthority = TEST_AUTHORITY;
+        when(uri.getAuthority()).thenReturn(TEST_AUTHORITY);
+
+        MatrixCursor cursor = new MatrixCursor(
+                new String[]{BluetoothMapContract.ConvoContactColumns.CONVO_ID,
+                        BluetoothMapContract.ConvoContactColumns.NAME,
+                        BluetoothMapContract.ConvoContactColumns.NICKNAME,
+                        BluetoothMapContract.ConvoContactColumns.X_BT_UID,
+                        BluetoothMapContract.ConvoContactColumns.CHAT_STATE,
+                        BluetoothMapContract.ConvoContactColumns.UCI,
+                        BluetoothMapContract.ConvoContactColumns.LAST_ACTIVE,
+                        BluetoothMapContract.ConvoContactColumns.PRESENCE_STATE,
+                        BluetoothMapContract.ConvoContactColumns.STATUS_TEXT,
+                        BluetoothMapContract.ConvoContactColumns.PRIORITY,
+                        BluetoothMapContract.ConvoContactColumns.LAST_ONLINE});
+        cursor.addRow(new Object[] {TEST_CONVO_ID, TEST_NAME, TEST_DISPLAY_NAME, TEST_BT_UID,
+                TEST_CHAT_STATE, TEST_UCI, TEST_LAST_ACTIVITY, TEST_PRESENCE_STATE,
+                TEST_STATUS_TEXT, TEST_PRIORITY, TEST_LAST_ONLINE});
+        doReturn(cursor).when(mProviderClient).query(any(), any(), any(), any(), any());
+
+        Map<String, BluetoothMapConvoContactElement> map = new HashMap<>();
+        map.put(TEST_UCI_DIFFERENT, null);
+        mObserver.setContactList(map, true);
+        mObserver.mMapEventReportVersion = BluetoothMapUtils.MAP_EVENT_REPORT_V12;
+
+        mObserver.handleContactListChanges(uri);
+
+        BluetoothMapConvoContactElement contactElement = mObserver.getContactList().get(TEST_UCI);
+        final SimpleDateFormat format = new SimpleDateFormat("yyyyMMdd'T'HHmmss");
+        Assert.assertEquals(contactElement.getContactId(), TEST_UCI);
+        Assert.assertEquals(contactElement.getName(), TEST_NAME);
+        Assert.assertEquals(contactElement.getDisplayName(), TEST_DISPLAY_NAME);
+        Assert.assertEquals(contactElement.getBtUid(), TEST_BT_UID);
+        Assert.assertEquals(contactElement.getChatState(), TEST_CHAT_STATE);
+        Assert.assertEquals(contactElement.getPresenceStatus(), TEST_STATUS_TEXT);
+        Assert.assertEquals(contactElement.getPresenceAvailability(), TEST_PRESENCE_STATE);
+        Assert.assertEquals(contactElement.getLastActivityString(), format.format(
+                TEST_LAST_ACTIVITY));
+        Assert.assertEquals(contactElement.getPriority(), TEST_PRIORITY);
+    }
+
+    @Test
+    public void handleContactListChanges_withNonNullContactForUci() throws Exception {
+        Uri uri = mock(Uri.class);
+        mObserver.mAuthority = TEST_AUTHORITY;
+        when(uri.getAuthority()).thenReturn(TEST_AUTHORITY);
+
+        MatrixCursor cursor = new MatrixCursor(
+                new String[]{BluetoothMapContract.ConvoContactColumns.CONVO_ID,
+                        BluetoothMapContract.ConvoContactColumns.NAME,
+                        BluetoothMapContract.ConvoContactColumns.NICKNAME,
+                        BluetoothMapContract.ConvoContactColumns.X_BT_UID,
+                        BluetoothMapContract.ConvoContactColumns.CHAT_STATE,
+                        BluetoothMapContract.ConvoContactColumns.UCI,
+                        BluetoothMapContract.ConvoContactColumns.LAST_ACTIVE,
+                        BluetoothMapContract.ConvoContactColumns.PRESENCE_STATE,
+                        BluetoothMapContract.ConvoContactColumns.STATUS_TEXT,
+                        BluetoothMapContract.ConvoContactColumns.PRIORITY,
+                        BluetoothMapContract.ConvoContactColumns.LAST_ONLINE});
+        cursor.addRow(new Object[] {TEST_CONVO_ID, TEST_NAME, TEST_DISPLAY_NAME, TEST_BT_UID,
+                TEST_CHAT_STATE, TEST_UCI, TEST_LAST_ACTIVITY, TEST_PRESENCE_STATE,
+                TEST_STATUS_TEXT, TEST_PRIORITY, TEST_LAST_ONLINE});
+        doReturn(cursor).when(mProviderClient).query(any(), any(), any(), any(), any());
+
+        Map<String, BluetoothMapConvoContactElement> map = new HashMap<>();
+        map.put(TEST_UCI_DIFFERENT, null);
+        BluetoothMapConvoContactElement contact = new BluetoothMapConvoContactElement(TEST_UCI,
+                TEST_NAME, TEST_DISPLAY_NAME, TEST_STATUS_TEXT_DIFFERENT,
+                TEST_PRESENCE_STATE_DIFFERENT, TEST_LAST_ACTIVITY, TEST_CHAT_STATE_DIFFERENT,
+                TEST_PRIORITY, TEST_BT_UID);
+        map.put(TEST_UCI, contact);
+        mObserver.setContactList(map, true);
+        mObserver.mMapEventReportVersion = BluetoothMapUtils.MAP_EVENT_REPORT_V12;
+        when(mTelephonyManager.getLine1Number()).thenReturn("");
+
+        mObserver.handleContactListChanges(uri);
+
+        BluetoothMapConvoContactElement contactElement = mObserver.getContactList().get(TEST_UCI);
+        final SimpleDateFormat format = new SimpleDateFormat("yyyyMMdd'T'HHmmss");
+        Assert.assertEquals(contactElement.getContactId(), TEST_UCI);
+        Assert.assertEquals(contactElement.getName(), TEST_NAME);
+        Assert.assertEquals(contactElement.getDisplayName(), TEST_DISPLAY_NAME);
+        Assert.assertEquals(contactElement.getBtUid(), TEST_BT_UID);
+        Assert.assertEquals(contactElement.getChatState(), TEST_CHAT_STATE);
+        Assert.assertEquals(contactElement.getPresenceStatus(), TEST_STATUS_TEXT);
+        Assert.assertEquals(contactElement.getPresenceAvailability(), TEST_PRESENCE_STATE);
+        Assert.assertEquals(contactElement.getLastActivityString(), format.format(
+                TEST_LAST_ACTIVITY));
+        Assert.assertEquals(contactElement.getPriority(), TEST_PRIORITY);
+    }
+
+    @Test
+    public void handleContactListChanges_withMapEventReportVersion11() throws Exception {
+        Uri uri = mock(Uri.class);
+        mObserver.mAuthority = TEST_AUTHORITY;
+        when(uri.getAuthority()).thenReturn(TEST_AUTHORITY);
+        mObserver.mMapEventReportVersion = BluetoothMapUtils.MAP_EVENT_REPORT_V11;
+
+        mObserver.handleContactListChanges(uri);
+
+        verify(mProviderClient, never()).query(any(), any(), any(), any(), any(), any());
+    }
+
+    private BluetoothMapContentObserver.Msg createSimpleMsg() {
+        return new BluetoothMapContentObserver.Msg(1, 1L, 1);
+    }
+
+    private BluetoothMapContentObserver.Msg createMsgWithTypeAndThreadId(int type, int threadId) {
+        return new BluetoothMapContentObserver.Msg(1, type, threadId, 1);
+    }
+
+    private void setFolderStructureWithTelecomAndMsg(BluetoothMapFolderElement folderElement,
+            String folderName, long folderId) {
+        folderElement.addFolder("telecom");
+        folderElement.getSubFolder("telecom").addFolder("msg");
+        BluetoothMapFolderElement subFolder = folderElement.getSubFolder("telecom").getSubFolder(
+                "msg").addFolder(folderName);
+        subFolder.setFolderId(folderId);
+    }
 }
diff --git a/android/app/tests/unit/src/com/android/bluetooth/map/BluetoothMapContentTest.java b/android/app/tests/unit/src/com/android/bluetooth/map/BluetoothMapContentTest.java
new file mode 100644
index 0000000..9e1f738
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/map/BluetoothMapContentTest.java
@@ -0,0 +1,1484 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.map;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import static org.junit.Assert.assertThrows;
+import static org.mockito.ArgumentMatchers.eq;
+import static org.mockito.Mockito.any;
+import static org.mockito.Mockito.doReturn;
+import static org.mockito.Mockito.doThrow;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.spy;
+import static org.mockito.Mockito.when;
+
+import android.content.ContentResolver;
+import android.content.Context;
+import android.database.Cursor;
+import android.database.MatrixCursor;
+import android.os.ParcelFileDescriptor;
+import android.provider.BaseColumns;
+import android.provider.ContactsContract;
+import android.provider.Telephony;
+import android.provider.Telephony.Threads;
+import android.telephony.PhoneNumberUtils;
+import android.telephony.TelephonyManager;
+import android.text.util.Rfc822Tokenizer;
+
+import androidx.test.runner.AndroidJUnit4;
+
+import com.android.bluetooth.BluetoothMethodProxy;
+import com.android.bluetooth.SignedLongLong;
+import com.android.bluetooth.map.BluetoothMapContent.FilterInfo;
+import com.android.bluetooth.map.BluetoothMapUtils.TYPE;
+import com.android.bluetooth.mapapi.BluetoothMapContract;
+
+import com.google.android.mms.pdu.PduHeaders;
+
+import org.junit.After;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.Mock;
+import org.mockito.MockitoAnnotations;
+import org.mockito.Spy;
+
+import java.io.ByteArrayInputStream;
+import java.io.FileDescriptor;
+import java.io.FileNotFoundException;
+import java.io.InputStream;
+import java.util.HashMap;
+
+@RunWith(AndroidJUnit4.class)
+public class BluetoothMapContentTest {
+    private static final String TEST_TEXT = "text";
+    private static final String TEST_TO_ADDRESS = "toName (toAddress) <to@google.com>";
+    private static final String TEST_CC_ADDRESS = "ccName (ccAddress) <cc@google.com>";
+    private static final String TEST_BCC_ADDRESS = "bccName (bccAddress) <bcc@google.com>";
+    private static final String TEST_FROM_ADDRESS = "fromName (fromAddress) <from@google.com>";
+    private static final String TEST_ADDRESS = "111-1111-1111";
+    private static final long TEST_DATE_SMS = 4;
+    private static final long TEST_DATE_MMS = 3;
+    private static final long TEST_DATE_EMAIL = 2;
+    private static final long TEST_DATE_IM = 1;
+    private static final String TEST_NAME = "test_name";
+    private static final String TEST_FORMATTED_NAME = "test_formatted_name";
+    private static final String TEST_PHONE = "test_phone";
+    private static final String TEST_PHONE_NAME = "test_phone_name";
+    private static final long TEST_ID = 1;
+    private static final long TEST_INBOX_FOLDER_ID = BluetoothMapContract.FOLDER_ID_INBOX;
+    private static final long TEST_SENT_FOLDER_ID = BluetoothMapContract.FOLDER_ID_SENT;
+    private static final String TEST_SUBJECT = "subject";
+    private static final long TEST_DATE = 1;
+    private static final String TEST_MESSAGE_ID = "test_message_id";
+    private static final String TEST_FIRST_BT_UID = "1111";
+    private static final String TEST_FIRST_BT_UCI_RECIPIENT = "test_first_bt_uci_recipient";
+    private static final String TEST_FIRST_BT_UCI_ORIGINATOR = "test_first_bt_uci_originator";
+    private static final int TEST_NO_FILTER = 0;
+    private static final String TEST_CONTACT_NAME_FILTER = "test_contact_name_filter";
+    private static final int TEST_SIZE = 1;
+    private static final int TEST_TEXT_ONLY = 1;
+    private static final int TEST_READ_TRUE = 1;
+    private static final int TEST_READ_FALSE = 0;
+    private static final int TEST_PRIORITY_HIGH = 1;
+    private static final int TEST_SENT_YES = 2;
+    private static final int TEST_SENT_NO = 1;
+    private static final int TEST_PROTECTED = 1;
+    private static final int TEST_ATTACHMENT_TRUE = 1;
+    private static final String TEST_DELIVERY_STATE = "delivered";
+    private static final long TEST_THREAD_ID = 1;
+    private static final String TEST_ATTACHMENT_MIME_TYPE = "test_mime_type";
+    private static final String TEST_YES = "yes";
+    private static final String TEST_NO = "no";
+    private static final String TEST_RECEPTION_STATUS = "complete";
+
+    @Mock
+    private BluetoothMapAccountItem mAccountItem;
+    @Mock
+    private BluetoothMapMasInstance mMasInstance;
+    @Mock
+    private Context mContext;
+    @Mock
+    private TelephonyManager mTelephonyManager;
+    @Mock
+    private ContentResolver mContentResolver;
+    @Mock
+    private BluetoothMapAppParams mParams;
+    @Spy
+    private BluetoothMethodProxy mMapMethodProxy = BluetoothMethodProxy.getInstance();
+
+    private BluetoothMapContent mContent;
+    private FilterInfo mInfo;
+    private BluetoothMapMessageListingElement mMessageListingElement;
+    private BluetoothMapConvoListingElement mConvoListingElement;
+    private BluetoothMapFolderElement mCurrentFolder;
+
+    @Before
+    public void setUp() {
+        MockitoAnnotations.initMocks(this);
+        BluetoothMethodProxy.setInstanceForTesting(mMapMethodProxy);
+
+        mContent = new BluetoothMapContent(mContext, mAccountItem, mMasInstance);
+        mInfo = new FilterInfo();
+        mMessageListingElement = new BluetoothMapMessageListingElement();
+        mConvoListingElement = new BluetoothMapConvoListingElement();
+        mCurrentFolder = new BluetoothMapFolderElement("current", null);
+    }
+
+    @After
+    public void tearDown() {
+        BluetoothMethodProxy.setInstanceForTesting(null);
+    }
+
+    @Test
+    public void constructor_withNonNullAccountItem() {
+        BluetoothMapContent content = new BluetoothMapContent(mContext, mAccountItem,
+                mMasInstance);
+
+        assertThat(content.mBaseUri).isNotNull();
+    }
+
+    @Test
+    public void constructor_withNullAccountItem() {
+        BluetoothMapContent content = new BluetoothMapContent(mContext, null, mMasInstance);
+
+        assertThat(content.mBaseUri).isNull();
+    }
+
+    @Test
+    public void getTextPartsMms() {
+        final long id = 1111;
+        Cursor cursor = mock(Cursor.class);
+        when(cursor.moveToFirst()).thenReturn(true);
+        when(cursor.getColumnIndex("ct")).thenReturn(1);
+        when(cursor.getString(1)).thenReturn("text/plain");
+        when(cursor.getColumnIndex("text")).thenReturn(2);
+        when(cursor.getString(2)).thenReturn(TEST_TEXT);
+        doReturn(cursor).when(mMapMethodProxy).contentResolverQuery(any(), any(), any(), any(),
+                any(), any());
+
+        assertThat(BluetoothMapContent.getTextPartsMms(mContentResolver, id)).isEqualTo(TEST_TEXT);
+    }
+
+    @Test
+    public void getContactNameFromPhone() {
+        String phoneName = "testPhone";
+        Cursor cursor = mock(Cursor.class);
+        when(cursor.getColumnIndex(ContactsContract.Contacts.DISPLAY_NAME)).thenReturn(1);
+        when(cursor.getCount()).thenReturn(1);
+        when(cursor.getString(1)).thenReturn(TEST_TEXT);
+        doReturn(cursor).when(mMapMethodProxy).contentResolverQuery(any(), any(), any(), any(),
+                any(), any());
+
+        assertThat(
+                BluetoothMapContent.getContactNameFromPhone(phoneName, mContentResolver)).isEqualTo(
+                TEST_TEXT);
+    }
+
+    @Test
+    public void getCanonicalAddressSms() {
+        int threadId = 0;
+        Cursor cursor = mock(Cursor.class);
+        when(cursor.moveToFirst()).thenReturn(true);
+        when(cursor.getString(0)).thenReturn("recipientIdOne recipientIdTwo");
+        when(cursor.getColumnIndex(Telephony.CanonicalAddressesColumns.ADDRESS)).thenReturn(1);
+        when(cursor.getString(1)).thenReturn("recipientAddress");
+        doReturn(cursor).when(mMapMethodProxy).contentResolverQuery(any(), any(), any(), any(),
+                any(), any());
+
+        assertThat(
+                BluetoothMapContent.getCanonicalAddressSms(mContentResolver, threadId)).isEqualTo(
+                "recipientAddress");
+    }
+
+    @Test
+    public void getAddressMms() {
+        long id = 1111;
+        int type = 0;
+        Cursor cursor = mock(Cursor.class);
+        when(cursor.moveToFirst()).thenReturn(true);
+        when(cursor.getColumnIndex(Telephony.Mms.Addr.ADDRESS)).thenReturn(1);
+        when(cursor.getString(1)).thenReturn(TEST_TEXT);
+        doReturn(cursor).when(mMapMethodProxy).contentResolverQuery(any(), any(), any(), any(),
+                any(), any());
+
+        assertThat(BluetoothMapContent.getAddressMms(mContentResolver, id, type)).isEqualTo(
+                TEST_TEXT);
+    }
+
+    @Test
+    public void setAttachment_withTypeMms() {
+        when(mParams.getParameterMask()).thenReturn(
+                (long) BluetoothMapContent.MASK_ATTACHMENT_SIZE);
+        mInfo.mMsgType = FilterInfo.TYPE_MMS;
+        mInfo.mMmsColTextOnly = 0;
+        mInfo.mMmsColAttachmentSize = 1;
+        MatrixCursor cursor = new MatrixCursor(
+                new String[]{"MmsColTextOnly", "MmsColAttachmentSize"});
+        cursor.addRow(new Object[]{0, -1});
+        cursor.moveToFirst();
+
+        mContent.setAttachment(mMessageListingElement, cursor, mInfo, mParams);
+
+        assertThat(mMessageListingElement.getAttachmentSize()).isEqualTo(1);
+    }
+
+    @Test
+    public void setAttachment_withTypeEmail() {
+        when(mParams.getParameterMask()).thenReturn(
+                (long) BluetoothMapContent.MASK_ATTACHMENT_SIZE);
+        mInfo.mMsgType = FilterInfo.TYPE_EMAIL;
+        mInfo.mMessageColAttachment = 0;
+        mInfo.mMessageColAttachmentSize = 1;
+        MatrixCursor cursor = new MatrixCursor(new String[]{"MessageColAttachment",
+                "MessageColAttachmentSize"});
+        cursor.addRow(new Object[]{1, 0});
+        cursor.moveToFirst();
+
+        mContent.setAttachment(mMessageListingElement, cursor, mInfo, mParams);
+
+        assertThat(mMessageListingElement.getAttachmentSize()).isEqualTo(1);
+    }
+
+    @Test
+    public void setAttachment_withTypeIm() {
+        int featureMask = 1 << 9;
+        long parameterMask = 0x00100400;
+        when(mParams.getParameterMask()).thenReturn(parameterMask);
+        mInfo.mMsgType = FilterInfo.TYPE_IM;
+        mInfo.mMessageColAttachment = 0;
+        mInfo.mMessageColAttachmentSize = 1;
+        mInfo.mMessageColAttachmentMime = 2;
+        MatrixCursor cursor = new MatrixCursor(new String[]{"MessageColAttachment",
+                "MessageColAttachmentSize",
+                "MessageColAttachmentMime"});
+        cursor.addRow(new Object[]{1, 0, "test_mime_type"});
+        cursor.moveToFirst();
+
+        mContent.setRemoteFeatureMask(featureMask);
+        mContent.setAttachment(mMessageListingElement, cursor, mInfo, mParams);
+
+        assertThat(mMessageListingElement.getAttachmentSize()).isEqualTo(1);
+        assertThat(mMessageListingElement.getAttachmentMimeTypes()).isEqualTo("test_mime_type");
+    }
+
+    @Test
+    public void setRemoteFeatureMask() {
+        int featureMask = 1 << 9;
+
+        mContent.setRemoteFeatureMask(featureMask);
+
+        assertThat(mContent.getRemoteFeatureMask()).isEqualTo(featureMask);
+        assertThat(mContent.mMsgListingVersion).isEqualTo(
+                BluetoothMapUtils.MAP_MESSAGE_LISTING_FORMAT_V11);
+    }
+
+    @Test
+    public void setConvoWhereFilterSmsMms() throws Exception {
+        when(mParams.getFilterMessageType()).thenReturn(0);
+        when(mParams.getFilterReadStatus()).thenReturn(0x03);
+        long lastActivity = 1L;
+        when(mParams.getFilterLastActivityBegin()).thenReturn(lastActivity);
+        when(mParams.getFilterLastActivityEnd()).thenReturn(lastActivity);
+        String convoId = "1111";
+        when(mParams.getFilterConvoId()).thenReturn(SignedLongLong.fromString(convoId));
+        StringBuilder selection = new StringBuilder();
+
+        mContent.setConvoWhereFilterSmsMms(selection, mInfo, mParams);
+
+        StringBuilder expected = new StringBuilder();
+        expected.append(" AND ").append(Threads.READ).append(" = 0");
+        expected.append(" AND ").append(Threads.READ).append(" = 1");
+        expected.append(" AND ")
+                .append(Threads.DATE)
+                .append(" >= ")
+                .append(lastActivity);
+        expected.append(" AND ")
+                .append(Threads.DATE)
+                .append(" <= ")
+                .append(lastActivity);
+        expected.append(" AND ")
+                .append(Threads._ID)
+                .append(" = ")
+                .append(SignedLongLong.fromString(convoId).getLeastSignificantBits());
+        assertThat(selection.toString()).isEqualTo(expected.toString());
+    }
+
+    @Test
+    public void setDateTime_withTypeSms() {
+        when(mParams.getParameterMask()).thenReturn((long) BluetoothMapContent.MASK_DATETIME);
+        mInfo.mMsgType = FilterInfo.TYPE_SMS;
+        mInfo.mSmsColDate = 0;
+        MatrixCursor cursor = new MatrixCursor(new String[]{"SmsColDate"});
+        cursor.addRow(new Object[]{2L});
+        cursor.moveToFirst();
+
+        mContent.setDateTime(mMessageListingElement, cursor, mInfo, mParams);
+
+        assertThat(mMessageListingElement.getDateTime()).isEqualTo(2L);
+    }
+
+    @Test
+    public void setDateTime_withTypeMms() {
+        when(mParams.getParameterMask()).thenReturn((long) BluetoothMapContent.MASK_DATETIME);
+        mInfo.mMsgType = FilterInfo.TYPE_MMS;
+        mInfo.mMmsColDate = 0;
+        MatrixCursor cursor = new MatrixCursor(new String[]{"MmsColDate"});
+        cursor.addRow(new Object[]{2L});
+        cursor.moveToFirst();
+
+        mContent.setDateTime(mMessageListingElement, cursor, mInfo, mParams);
+
+        assertThat(mMessageListingElement.getDateTime()).isEqualTo(2L * 1000L);
+    }
+
+    @Test
+    public void setDateTime_withTypeIM() {
+        when(mParams.getParameterMask()).thenReturn((long) BluetoothMapContent.MASK_DATETIME);
+        mInfo.mMsgType = FilterInfo.TYPE_IM;
+        mInfo.mMessageColDate = 0;
+        MatrixCursor cursor = new MatrixCursor(new String[]{"MessageColDate"});
+        cursor.addRow(new Object[]{2L});
+        cursor.moveToFirst();
+
+        mContent.setDateTime(mMessageListingElement, cursor, mInfo, mParams);
+
+        assertThat(mMessageListingElement.getDateTime()).isEqualTo(2L);
+    }
+
+    @Test
+    public void setDeliveryStatus() {
+        when(mParams.getParameterMask()).thenReturn(
+                (long) BluetoothMapContent.MASK_DELIVERY_STATUS);
+        mInfo.mMsgType = FilterInfo.TYPE_EMAIL;
+        mInfo.mMessageColDelivery = 0;
+        MatrixCursor cursor = new MatrixCursor(new String[]{"MessageColDelivery"});
+        cursor.addRow(new Object[]{"test_delivery_status"});
+        cursor.moveToFirst();
+
+        mContent.setDeliveryStatus(mMessageListingElement, cursor, mInfo, mParams);
+
+        assertThat(mMessageListingElement.getDeliveryStatus()).isEqualTo("test_delivery_status");
+    }
+
+    @Test
+    public void setFilterInfo() {
+        when(mContext.getSystemService(Context.TELEPHONY_SERVICE)).thenReturn(mTelephonyManager);
+        when(mContext.getSystemServiceName(TelephonyManager.class))
+                .thenReturn(Context.TELEPHONY_SERVICE);
+        when(mTelephonyManager.getPhoneType()).thenReturn(TelephonyManager.PHONE_TYPE_GSM);
+
+        mContent.setFilterInfo(mInfo);
+
+        assertThat(mInfo.mPhoneType).isEqualTo(TelephonyManager.PHONE_TYPE_GSM);
+    }
+
+    @Test
+    public void smsSelected_withInvalidFilter() {
+        when(mParams.getFilterMessageType()).thenReturn(
+                BluetoothMapAppParams.INVALID_VALUE_PARAMETER);
+
+        assertThat(mContent.smsSelected(mInfo, mParams)).isTrue();
+    }
+
+    @Test
+    public void smsSelected_withNoFilter() {
+        when(mParams.getFilterMessageType()).thenReturn(TEST_NO_FILTER);
+
+        assertThat(mContent.smsSelected(mInfo, mParams)).isTrue();
+    }
+
+    @Test
+    public void smsSelected_withSmsCdmaExcludeFilter_andPhoneTypeGsm() {
+        when(mParams.getFilterMessageType()).thenReturn(BluetoothMapAppParams.FILTER_NO_SMS_CDMA);
+
+        mInfo.mPhoneType = TelephonyManager.PHONE_TYPE_GSM;
+        assertThat(mContent.smsSelected(mInfo, mParams)).isTrue();
+
+        mInfo.mPhoneType = TelephonyManager.PHONE_TYPE_CDMA;
+        assertThat(mContent.smsSelected(mInfo, mParams)).isFalse();
+    }
+
+    @Test
+    public void smsSelected_witSmsGsmExcludeFilter_andPhoneTypeCdma() {
+        when(mParams.getFilterMessageType()).thenReturn(BluetoothMapAppParams.FILTER_NO_SMS_GSM);
+
+        mInfo.mPhoneType = TelephonyManager.PHONE_TYPE_CDMA;
+        assertThat(mContent.smsSelected(mInfo, mParams)).isTrue();
+
+        mInfo.mPhoneType = TelephonyManager.PHONE_TYPE_GSM;
+        assertThat(mContent.smsSelected(mInfo, mParams)).isFalse();
+    }
+
+    @Test
+    public void smsSelected_withGsmAndCdmaExcludeFilter() {
+        int noSms =
+                BluetoothMapAppParams.FILTER_NO_SMS_CDMA | BluetoothMapAppParams.FILTER_NO_SMS_GSM;
+        when(mParams.getFilterMessageType()).thenReturn(noSms);
+
+        assertThat(mContent.smsSelected(mInfo, mParams)).isFalse();
+    }
+
+    @Test
+    public void mmsSelected_withInvalidFilter() {
+        when(mParams.getFilterMessageType()).thenReturn(
+                BluetoothMapAppParams.INVALID_VALUE_PARAMETER);
+
+        assertThat(mContent.mmsSelected(mParams)).isTrue();
+    }
+
+    @Test
+    public void mmsSelected_withNoFilter() {
+        when(mParams.getFilterMessageType()).thenReturn(TEST_NO_FILTER);
+
+        assertThat(mContent.mmsSelected(mParams)).isTrue();
+    }
+
+    @Test
+    public void mmsSelected_withMmsExcludeFilter() {
+        when(mParams.getFilterMessageType()).thenReturn(BluetoothMapAppParams.FILTER_NO_MMS);
+
+        assertThat(mContent.mmsSelected(mParams)).isFalse();
+    }
+
+    @Test
+    public void getRecipientNameEmail() {
+        mInfo.mMessageColToAddress = 0;
+        mInfo.mMessageColCcAddress = 1;
+        mInfo.mMessageColBccAddress = 2;
+
+        MatrixCursor cursor = new MatrixCursor(
+                new String[]{"MessageColToAddress", "MessageColCcAddress", "MessageColBccAddress"});
+        cursor.addRow(new Object[]{TEST_TO_ADDRESS, TEST_CC_ADDRESS, TEST_BCC_ADDRESS});
+        cursor.moveToFirst();
+
+        StringBuilder expected = new StringBuilder();
+        expected.append(Rfc822Tokenizer.tokenize(TEST_TO_ADDRESS)[0].getName());
+        expected.append("; ");
+        expected.append(Rfc822Tokenizer.tokenize(TEST_CC_ADDRESS)[0].getName());
+        expected.append("; ");
+        expected.append(Rfc822Tokenizer.tokenize(TEST_BCC_ADDRESS)[0].getName());
+        assertThat(mContent.getRecipientNameEmail(cursor, mInfo)).isEqualTo(
+                expected.toString());
+    }
+
+    @Test
+    public void getRecipientAddressingEmail() {
+        mInfo.mMessageColToAddress = 0;
+        mInfo.mMessageColCcAddress = 1;
+        mInfo.mMessageColBccAddress = 2;
+
+        MatrixCursor cursor = new MatrixCursor(
+                new String[]{"MessageColToAddress", "MessageColCcAddress", "MessageColBccAddress"});
+        cursor.addRow(new Object[]{TEST_TO_ADDRESS, TEST_CC_ADDRESS, TEST_BCC_ADDRESS});
+        cursor.moveToFirst();
+
+        StringBuilder expected = new StringBuilder();
+        expected.append(Rfc822Tokenizer.tokenize(TEST_TO_ADDRESS)[0].getAddress());
+        expected.append("; ");
+        expected.append(Rfc822Tokenizer.tokenize(TEST_CC_ADDRESS)[0].getAddress());
+        expected.append("; ");
+        expected.append(Rfc822Tokenizer.tokenize(TEST_BCC_ADDRESS)[0].getAddress());
+        assertThat(mContent.getRecipientAddressingEmail(cursor, mInfo)).isEqualTo(
+                expected.toString());
+    }
+
+    @Test
+    public void setRecipientAddressing_withFilterMsgTypeSms_andSmsMsgTypeInbox() {
+        when(mParams.getParameterMask()).thenReturn(
+                (long) BluetoothMapContent.MASK_RECIPIENT_ADDRESSING);
+        mInfo.mMsgType = FilterInfo.TYPE_SMS;
+        mInfo.mPhoneNum = TEST_ADDRESS;
+        mInfo.mSmsColType = 0;
+        MatrixCursor cursor = new MatrixCursor(new String[] {"SmsColType"});
+        cursor.addRow(new Object[] {Telephony.Sms.MESSAGE_TYPE_INBOX});
+        cursor.moveToFirst();
+
+        mContent.setRecipientAddressing(mMessageListingElement, cursor, mInfo, mParams);
+
+        assertThat(mMessageListingElement.getRecipientAddressing()).isEqualTo(TEST_ADDRESS);
+    }
+
+    @Test
+    public void setRecipientAddressing_withFilterMsgTypeSms_andSmsMsgTypeDraft() {
+        when(mParams.getParameterMask()).thenReturn(
+                (long) BluetoothMapContent.MASK_RECIPIENT_ADDRESSING);
+        mInfo.mMsgType = FilterInfo.TYPE_SMS;
+        mInfo.mSmsColType = 2;
+        MatrixCursor cursor = new MatrixCursor(new String[] {"RecipientIds",
+                Telephony.CanonicalAddressesColumns.ADDRESS, "SmsColType",
+                Telephony.Sms.ADDRESS, Telephony.Sms.THREAD_ID});
+        cursor.addRow(new Object[] {"recipientIdOne recipientIdTwo", "recipientAddress",
+                Telephony.Sms.MESSAGE_TYPE_DRAFT, null, "0"});
+        cursor.moveToFirst();
+
+        mContent.setRecipientAddressing(mMessageListingElement, cursor, mInfo, mParams);
+
+        assertThat(mMessageListingElement.getRecipientAddressing()).isEqualTo("recipientAddress");
+    }
+
+    @Test
+    public void setRecipientAddressing_withFilterMsgTypeMms() {
+        when(mParams.getParameterMask()).thenReturn(
+                (long) BluetoothMapContent.MASK_RECIPIENT_ADDRESSING);
+        mInfo.mMsgType = FilterInfo.TYPE_MMS;
+        MatrixCursor cursor = new MatrixCursor(
+                new String[]{BaseColumns._ID, Telephony.Mms.Addr.ADDRESS});
+        cursor.addRow(new Object[] {Telephony.Sms.MESSAGE_TYPE_INBOX, null});
+        cursor.moveToFirst();
+        doReturn(cursor).when(mMapMethodProxy).contentResolverQuery(any(), any(), any(), any(),
+                any(), any());
+
+        mContent.setRecipientAddressing(mMessageListingElement, cursor, mInfo, mParams);
+
+        assertThat(mMessageListingElement.getRecipientAddressing()).isEqualTo("");
+    }
+
+    @Test
+    public void setRecipientAddressing_withFilterMsgTypeEmail() {
+        when(mParams.getParameterMask()).thenReturn(
+                (long) BluetoothMapContent.MASK_RECIPIENT_ADDRESSING);
+        mInfo.mMsgType = FilterInfo.TYPE_EMAIL;
+        mInfo.mMessageColToAddress = 0;
+        mInfo.mMessageColCcAddress = 1;
+        mInfo.mMessageColBccAddress = 2;
+        MatrixCursor cursor = new MatrixCursor(
+                new String[]{"MessageColToAddress", "MessageColCcAddress", "MessageColBccAddress"});
+        cursor.addRow(new Object[]{TEST_TO_ADDRESS, TEST_CC_ADDRESS, TEST_BCC_ADDRESS});
+        cursor.moveToFirst();
+
+        mContent.setRecipientAddressing(mMessageListingElement, cursor, mInfo, mParams);
+
+        StringBuilder expected = new StringBuilder();
+        expected.append(Rfc822Tokenizer.tokenize(TEST_TO_ADDRESS)[0].getAddress());
+        expected.append("; ");
+        expected.append(Rfc822Tokenizer.tokenize(TEST_CC_ADDRESS)[0].getAddress());
+        expected.append("; ");
+        expected.append(Rfc822Tokenizer.tokenize(TEST_BCC_ADDRESS)[0].getAddress());
+        assertThat(mMessageListingElement.getRecipientAddressing()).isEqualTo(expected.toString());
+    }
+
+    @Test
+    public void setSenderAddressing_withFilterMsgTypeSms_andSmsMsgTypeInbox() {
+        when(mParams.getParameterMask()).thenReturn(
+                (long) BluetoothMapContent.MASK_SENDER_ADDRESSING);
+        mInfo.mMsgType = FilterInfo.TYPE_SMS;
+        mInfo.mSmsColType = 0;
+        mInfo.mSmsColAddress = 1;
+        MatrixCursor cursor = new MatrixCursor(new String[] {"SmsColType", "SmsColAddress"});
+        cursor.addRow(new Object[] {Telephony.Sms.MESSAGE_TYPE_INBOX, TEST_ADDRESS});
+        cursor.moveToFirst();
+        doReturn(cursor).when(mMapMethodProxy).contentResolverQuery(any(), any(), any(), any(),
+                any(), any());
+
+        mContent.setSenderAddressing(mMessageListingElement, cursor, mInfo, mParams);
+
+        assertThat(mMessageListingElement.getSenderAddressing()).isEqualTo(
+                PhoneNumberUtils.extractNetworkPortion(TEST_ADDRESS));
+    }
+
+    @Test
+    public void setSenderAddressing_withFilterMsgTypeSms_andSmsMsgTypeDraft() {
+        when(mParams.getParameterMask()).thenReturn(
+                (long) BluetoothMapContent.MASK_SENDER_ADDRESSING);
+        mInfo.mMsgType = FilterInfo.TYPE_SMS;
+        mInfo.mPhoneNum = null;
+        mInfo.mSmsColType = 0;
+        MatrixCursor cursor = new MatrixCursor(new String[] {"SmsColType"});
+        cursor.addRow(new Object[] {Telephony.Sms.MESSAGE_TYPE_DRAFT});
+        cursor.moveToFirst();
+
+        mContent.setSenderAddressing(mMessageListingElement, cursor, mInfo, mParams);
+
+        assertThat(mMessageListingElement.getSenderAddressing()).isEqualTo("");
+    }
+
+    @Test
+    public void setSenderAddressing_withFilterMsgTypeMms() {
+        when(mParams.getParameterMask()).thenReturn(
+                (long) BluetoothMapContent.MASK_SENDER_ADDRESSING);
+        mInfo.mMsgType = FilterInfo.TYPE_MMS;
+        mInfo.mMmsColId = 0;
+        MatrixCursor cursor = new MatrixCursor(
+                new String[]{"MmsColId", Telephony.Mms.Addr.ADDRESS});
+        cursor.addRow(new Object[] {0, ""});
+        cursor.moveToFirst();
+        doReturn(cursor).when(mMapMethodProxy).contentResolverQuery(any(), any(), any(), any(),
+                any(), any());
+
+        mContent.setSenderAddressing(mMessageListingElement, cursor, mInfo, mParams);
+
+        assertThat(mMessageListingElement.getSenderAddressing()).isEqualTo("");
+    }
+
+    @Test
+    public void setSenderAddressing_withFilterTypeEmail() {
+        when(mParams.getParameterMask()).thenReturn(
+                (long) BluetoothMapContent.MASK_SENDER_ADDRESSING);
+        mInfo.mMsgType = FilterInfo.TYPE_EMAIL;
+        mInfo.mMessageColFromAddress = 0;
+        MatrixCursor cursor = new MatrixCursor(
+                new String[]{"MessageColFromAddress"});
+        cursor.addRow(new Object[]{TEST_FROM_ADDRESS});
+        cursor.moveToFirst();
+
+        mContent.setSenderAddressing(mMessageListingElement, cursor, mInfo, mParams);
+
+        StringBuilder expected = new StringBuilder();
+        expected.append(Rfc822Tokenizer.tokenize(TEST_FROM_ADDRESS)[0].getAddress());
+        assertThat(mMessageListingElement.getSenderAddressing()).isEqualTo(expected.toString());
+    }
+
+    @Test
+    public void setSenderAddressing_withFilterTypeIm() {
+        when(mParams.getParameterMask()).thenReturn(
+                (long) BluetoothMapContent.MASK_SENDER_ADDRESSING);
+        mInfo.mMsgType = FilterInfo.TYPE_IM;
+        mInfo.mMessageColFromAddress = 0;
+        MatrixCursor cursor = new MatrixCursor(new String[] {"MessageColFromAddress",
+                BluetoothMapContract.ConvoContactColumns.UCI});
+        cursor.addRow(new Object[] {(long) 1, TEST_ADDRESS});
+        cursor.moveToFirst();
+        doReturn(cursor).when(mMapMethodProxy).contentResolverQuery(any(), any(), any(), any(),
+                any(), any());
+
+        mContent.setSenderAddressing(mMessageListingElement, cursor, mInfo, mParams);
+
+        assertThat(mMessageListingElement.getSenderAddressing()).isEqualTo(TEST_ADDRESS);
+    }
+
+    @Test
+    public void setSenderName_withFilterTypeSms_andSmsMsgTypeInbox() {
+        when(mParams.getParameterMask()).thenReturn((long) BluetoothMapContent.MASK_SENDER_NAME);
+        mInfo.mMsgType = FilterInfo.TYPE_SMS;
+        mInfo.mSmsColAddress = 1;
+        MatrixCursor cursor = new MatrixCursor(new String[] {Telephony.Sms.TYPE, "SmsColAddress",
+                ContactsContract.Contacts.DISPLAY_NAME});
+        cursor.addRow(new Object[] {Telephony.Sms.MESSAGE_TYPE_INBOX, TEST_PHONE, TEST_PHONE_NAME});
+        cursor.moveToFirst();
+        doReturn(cursor).when(mMapMethodProxy).contentResolverQuery(any(), any(), any(), any(),
+                any(), any());
+
+        mContent.setSenderName(mMessageListingElement, cursor, mInfo, mParams);
+
+        assertThat(mMessageListingElement.getSenderName()).isEqualTo(TEST_PHONE_NAME);
+    }
+
+    @Test
+    public void setSenderName_withFilterTypeSms_andSmsMsgTypeDraft() {
+        when(mParams.getParameterMask()).thenReturn((long) BluetoothMapContent.MASK_SENDER_NAME);
+        mInfo.mMsgType = FilterInfo.TYPE_SMS;
+        mInfo.mPhoneAlphaTag = TEST_NAME;
+        MatrixCursor cursor = new MatrixCursor(new String[] {Telephony.Sms.TYPE});
+        cursor.addRow(new Object[] {Telephony.Sms.MESSAGE_TYPE_DRAFT});
+        cursor.moveToFirst();
+        doReturn(cursor).when(mMapMethodProxy).contentResolverQuery(any(), any(), any(), any(),
+                any(), any());
+
+        mContent.setSenderName(mMessageListingElement, cursor, mInfo, mParams);
+
+        assertThat(mMessageListingElement.getSenderName()).isEqualTo(TEST_NAME);
+    }
+
+    @Test
+    public void setSenderName_withFilterTypeMms_withNonNullSenderAddressing() {
+        when(mParams.getParameterMask()).thenReturn((long) BluetoothMapContent.MASK_SENDER_NAME);
+        mInfo.mMsgType = FilterInfo.TYPE_MMS;
+        mInfo.mMmsColId = 0;
+        mMessageListingElement.setSenderAddressing(TEST_ADDRESS);
+        MatrixCursor cursor = new MatrixCursor(new String[] {"MmsColId", Telephony.Mms.Addr.ADDRESS,
+                ContactsContract.Contacts.DISPLAY_NAME});
+        cursor.addRow(new Object[] {0, TEST_PHONE, TEST_PHONE_NAME});
+        cursor.moveToFirst();
+        doReturn(cursor).when(mMapMethodProxy).contentResolverQuery(any(), any(), any(), any(),
+                any(), any());
+
+        mContent.setSenderName(mMessageListingElement, cursor, mInfo, mParams);
+
+        assertThat(mMessageListingElement.getSenderName()).isEqualTo(TEST_PHONE_NAME);
+    }
+
+    @Test
+    public void setSenderName_withFilterTypeMms_withNullSenderAddressing() {
+        when(mParams.getParameterMask()).thenReturn((long) BluetoothMapContent.MASK_SENDER_NAME);
+        mInfo.mMsgType = FilterInfo.TYPE_MMS;
+        mInfo.mMmsColId = 0;
+        MatrixCursor cursor = new MatrixCursor(new String[] {"MmsColId"});
+        cursor.addRow(new Object[] {0});
+        cursor.moveToFirst();
+        doReturn(cursor).when(mMapMethodProxy).contentResolverQuery(any(), any(), any(), any(),
+                any(), any());
+
+        mContent.setSenderName(mMessageListingElement, cursor, mInfo, mParams);
+
+        assertThat(mMessageListingElement.getSenderName()).isEqualTo("");
+    }
+
+    @Test
+    public void setSenderName_withFilterTypeEmail() {
+        when(mParams.getParameterMask()).thenReturn((long) BluetoothMapContent.MASK_SENDER_NAME);
+        mInfo.mMsgType = FilterInfo.TYPE_EMAIL;
+        mInfo.mMessageColFromAddress = 0;
+        MatrixCursor cursor = new MatrixCursor(new String[] {"MessageColFromAddress"});
+        cursor.addRow(new Object[] {TEST_FROM_ADDRESS});
+        cursor.moveToFirst();
+
+        mContent.setSenderName(mMessageListingElement, cursor, mInfo, mParams);
+
+        StringBuilder expected = new StringBuilder();
+        expected.append(Rfc822Tokenizer.tokenize(TEST_FROM_ADDRESS)[0].getName());
+        assertThat(mMessageListingElement.getSenderName()).isEqualTo(expected.toString());
+    }
+
+    @Test
+    public void setSenderName_withFilterTypeIm() {
+        when(mParams.getParameterMask()).thenReturn((long) BluetoothMapContent.MASK_SENDER_NAME);
+        mInfo.mMsgType = FilterInfo.TYPE_IM;
+        mInfo.mMessageColFromAddress = 0;
+        MatrixCursor cursor = new MatrixCursor(new String[] {"MessageColFromAddress",
+                BluetoothMapContract.ConvoContactColumns.NAME});
+        cursor.addRow(new Object[] {(long) 1, TEST_NAME});
+        cursor.moveToFirst();
+        doReturn(cursor).when(mMapMethodProxy).contentResolverQuery(any(), any(), any(), any(),
+                any(), any());
+
+        mContent.setSenderName(mMessageListingElement, cursor, mInfo, mParams);
+
+        assertThat(mMessageListingElement.getSenderName()).isEqualTo(TEST_NAME);
+    }
+
+    @Test
+    public void setters_withConvoList() {
+        BluetoothMapMasInstance instance = spy(BluetoothMapMasInstance.class);
+        BluetoothMapContent content = new BluetoothMapContent(mContext, mAccountItem, instance);
+        HashMap<Long, BluetoothMapConvoListingElement> emailMap =
+                new HashMap<Long, BluetoothMapConvoListingElement>();
+        HashMap<Long, BluetoothMapConvoListingElement> smsMap =
+                new HashMap<Long, BluetoothMapConvoListingElement>();
+
+        content.setImEmailConvoList(emailMap);
+        content.setSmsMmsConvoList(smsMap);
+
+        assertThat(content.getImEmailConvoList()).isEqualTo(emailMap);
+        assertThat(content.getSmsMmsConvoList()).isEqualTo(smsMap);
+    }
+
+    @Test
+    public void setLastActivity_withFilterTypeSms() {
+        mInfo.mMsgType = FilterInfo.TYPE_SMS;
+        mInfo.mConvoColLastActivity = 0;
+        MatrixCursor cursor = new MatrixCursor(new String[] {"ConvoColLastActivity",
+                "MmsSmsThreadColDate"});
+        cursor.addRow(new Object[] {TEST_DATE_EMAIL, TEST_DATE_SMS});
+        cursor.moveToFirst();
+
+        mContent.setLastActivity(mConvoListingElement, cursor, mInfo);
+
+        assertThat(mConvoListingElement.getLastActivity()).isEqualTo(TEST_DATE_SMS);
+    }
+
+    @Test
+    public void setLastActivity_withFilterTypeEmail() {
+        mInfo.mMsgType = FilterInfo.TYPE_EMAIL;
+        mInfo.mConvoColLastActivity = 0;
+        MatrixCursor cursor = new MatrixCursor(new String[] {"ConvoColLastActivity",
+                "MmsSmsThreadColDate"});
+        cursor.addRow(new Object[] {TEST_DATE_EMAIL, TEST_DATE_SMS});
+        cursor.moveToFirst();
+
+        mContent.setLastActivity(mConvoListingElement, cursor, mInfo);
+
+        assertThat(mConvoListingElement.getLastActivity()).isEqualTo(TEST_DATE_EMAIL);
+    }
+
+    @Test
+    public void getEmailMessage_withCharsetNative() {
+        when(mParams.getCharset()).thenReturn(BluetoothMapContent.MAP_MESSAGE_CHARSET_NATIVE);
+
+        assertThrows(IllegalArgumentException.class, () -> mContent.getEmailMessage(TEST_ID,
+                mParams, mCurrentFolder));
+    }
+
+    @Test
+    public void getEmailMessage_withEmptyCursor() {
+        when(mParams.getCharset()).thenReturn(BluetoothMapContent.MAP_MESSAGE_CHARSET_UTF8);
+        MatrixCursor cursor = new MatrixCursor(new String[] {});
+        doReturn(cursor).when(mMapMethodProxy).contentResolverQuery(any(), any(), any(), any(),
+                any(), any());
+
+        assertThrows(IllegalArgumentException.class, () -> mContent.getEmailMessage(TEST_ID,
+                mParams, mCurrentFolder));
+    }
+
+    @Test
+    public void getEmailMessage_withFileNotFoundExceptionForEmailBodyAccess() throws Exception {
+        when(mParams.getCharset()).thenReturn(BluetoothMapContent.MAP_MESSAGE_CHARSET_UTF8);
+        when(mParams.getFractionRequest()).thenReturn(BluetoothMapAppParams.FRACTION_REQUEST_FIRST);
+        when(mParams.getAttachment()).thenReturn(0);
+
+        MatrixCursor cursor = new MatrixCursor(new String[] {
+                BluetoothMapContract.MessageColumns.RECEPTION_STATE,
+                BluetoothMapContract.MessageColumns.FLAG_READ,
+                BluetoothMapContract.MessageColumns.FOLDER_ID,
+                BluetoothMapContract.MessageColumns.TO_LIST,
+                BluetoothMapContract.MessageColumns.FROM_LIST
+        });
+        cursor.addRow(new Object[] {BluetoothMapContract.RECEPTION_STATE_FRACTIONED, "1",
+        TEST_INBOX_FOLDER_ID, TEST_TO_ADDRESS, TEST_FROM_ADDRESS});
+        cursor.moveToFirst();
+        doReturn(cursor).when(mMapMethodProxy).contentResolverQuery(any(), any(), any(), any(),
+                any(), any());
+
+        mCurrentFolder.setFolderId(TEST_INBOX_FOLDER_ID);
+        // This mock sets up FileNotFoundException during email body access
+        doThrow(FileNotFoundException.class).when(
+                mMapMethodProxy).contentResolverOpenFileDescriptor(any(), any(), any());
+
+        byte[] encodedMessageEmail = mContent.getEmailMessage(TEST_ID, mParams, mCurrentFolder);
+        InputStream inputStream = new ByteArrayInputStream(encodedMessageEmail);
+        BluetoothMapbMessage messageParsed = BluetoothMapbMessage.parse(inputStream,
+                BluetoothMapAppParams.CHARSET_UTF8);
+
+        assertThat(messageParsed.getType()).isEqualTo(TYPE.EMAIL);
+        assertThat(messageParsed.getVersionString()).isEqualTo("VERSION:" +
+                mContent.mMessageVersion);
+        assertThat(messageParsed.getFolder()).isEqualTo(mCurrentFolder.getFullPath());
+        assertThat(messageParsed.getRecipients().get(0).getName()).isEqualTo(
+                Rfc822Tokenizer.tokenize(TEST_TO_ADDRESS)[0].getName());
+        assertThat(messageParsed.getRecipients().get(0).getFirstEmail()).isEqualTo(
+                Rfc822Tokenizer.tokenize(TEST_TO_ADDRESS)[0].getAddress());
+        assertThat(messageParsed.getOriginators().get(0).getName()).isEqualTo(
+                Rfc822Tokenizer.tokenize(TEST_FROM_ADDRESS)[0].getName());
+        assertThat(messageParsed.getOriginators().get(0).getFirstEmail()).isEqualTo(
+                Rfc822Tokenizer.tokenize(TEST_FROM_ADDRESS)[0].getAddress());
+    }
+
+    @Test
+    public void getEmailMessage_withNullPointerExceptionForEmailBodyAccess() throws Exception {
+        when(mParams.getCharset()).thenReturn(BluetoothMapContent.MAP_MESSAGE_CHARSET_UTF8);
+        when(mParams.getFractionRequest()).thenReturn(BluetoothMapAppParams.FRACTION_REQUEST_FIRST);
+        when(mParams.getAttachment()).thenReturn(0);
+
+        MatrixCursor cursor = new MatrixCursor(new String[] {
+                BluetoothMapContract.MessageColumns.RECEPTION_STATE,
+                BluetoothMapContract.MessageColumns.FLAG_READ,
+                BluetoothMapContract.MessageColumns.FOLDER_ID,
+                BluetoothMapContract.MessageColumns.TO_LIST,
+                BluetoothMapContract.MessageColumns.FROM_LIST
+        });
+        cursor.addRow(new Object[] {BluetoothMapContract.RECEPTION_STATE_FRACTIONED, null,
+                TEST_INBOX_FOLDER_ID, TEST_TO_ADDRESS, TEST_FROM_ADDRESS});
+        cursor.moveToFirst();
+        doReturn(cursor).when(mMapMethodProxy).contentResolverQuery(any(), any(), any(), any(),
+                any(), any());
+
+        mCurrentFolder.setFolderId(TEST_INBOX_FOLDER_ID);
+        // This mock sets up NullPointerException during email body access
+        doThrow(NullPointerException.class).when(
+                mMapMethodProxy).contentResolverOpenFileDescriptor(any(), any(), any());
+
+        byte[] encodedMessageEmail = mContent.getEmailMessage(TEST_ID, mParams, mCurrentFolder);
+        InputStream inputStream = new ByteArrayInputStream(encodedMessageEmail);
+        BluetoothMapbMessage messageParsed = BluetoothMapbMessage.parse(inputStream,
+                BluetoothMapAppParams.CHARSET_UTF8);
+
+        assertThat(messageParsed.getType()).isEqualTo(TYPE.EMAIL);
+        assertThat(messageParsed.getVersionString()).isEqualTo("VERSION:" +
+                mContent.mMessageVersion);
+        assertThat(messageParsed.getFolder()).isEqualTo(mCurrentFolder.getFullPath());
+        assertThat(messageParsed.getRecipients().get(0).getName()).isEqualTo(
+                Rfc822Tokenizer.tokenize(TEST_TO_ADDRESS)[0].getName());
+        assertThat(messageParsed.getRecipients().get(0).getFirstEmail()).isEqualTo(
+                Rfc822Tokenizer.tokenize(TEST_TO_ADDRESS)[0].getAddress());
+        assertThat(messageParsed.getOriginators().get(0).getName()).isEqualTo(
+                Rfc822Tokenizer.tokenize(TEST_FROM_ADDRESS)[0].getName());
+        assertThat(messageParsed.getOriginators().get(0).getFirstEmail()).isEqualTo(
+                Rfc822Tokenizer.tokenize(TEST_FROM_ADDRESS)[0].getAddress());
+    }
+
+    @Test
+    public void getEmailMessage() throws Exception {
+        when(mParams.getCharset()).thenReturn(BluetoothMapContent.MAP_MESSAGE_CHARSET_UTF8);
+        when(mParams.getFractionRequest()).thenReturn(BluetoothMapAppParams.FRACTION_REQUEST_FIRST);
+        when(mParams.getAttachment()).thenReturn(0);
+
+        MatrixCursor cursor = new MatrixCursor(new String[] {
+                BluetoothMapContract.MessageColumns.RECEPTION_STATE,
+                BluetoothMapContract.MessageColumns.FLAG_READ,
+                BluetoothMapContract.MessageColumns.FOLDER_ID,
+                BluetoothMapContract.MessageColumns.TO_LIST,
+                BluetoothMapContract.MessageColumns.FROM_LIST
+        });
+        cursor.addRow(new Object[] {BluetoothMapContract.RECEPTION_STATE_FRACTIONED, "1",
+                TEST_INBOX_FOLDER_ID, TEST_TO_ADDRESS, TEST_FROM_ADDRESS});
+        cursor.moveToFirst();
+        doReturn(cursor).when(mMapMethodProxy).contentResolverQuery(any(), any(), any(), any(),
+                any(), any());
+
+        mCurrentFolder.setFolderId(TEST_INBOX_FOLDER_ID);
+        FileDescriptor fd = new FileDescriptor();
+        ParcelFileDescriptor pfd = mock(ParcelFileDescriptor.class);
+        doReturn(fd).when(pfd).getFileDescriptor();
+        doReturn(pfd).when(mMapMethodProxy).contentResolverOpenFileDescriptor(any(), any(), any());
+
+        byte[] encodedMessageEmail = mContent.getEmailMessage(TEST_ID, mParams, mCurrentFolder);
+        InputStream inputStream = new ByteArrayInputStream(encodedMessageEmail);
+        BluetoothMapbMessage messageParsed = BluetoothMapbMessage.parse(inputStream,
+                BluetoothMapAppParams.CHARSET_UTF8);
+
+        assertThat(messageParsed.getType()).isEqualTo(TYPE.EMAIL);
+        assertThat(messageParsed.getVersionString()).isEqualTo("VERSION:" +
+                mContent.mMessageVersion);
+        assertThat(messageParsed.getFolder()).isEqualTo(mCurrentFolder.getFullPath());
+        assertThat(messageParsed.getRecipients().get(0).getName()).isEqualTo(
+                Rfc822Tokenizer.tokenize(TEST_TO_ADDRESS)[0].getName());
+        assertThat(messageParsed.getRecipients().get(0).getFirstEmail()).isEqualTo(
+                Rfc822Tokenizer.tokenize(TEST_TO_ADDRESS)[0].getAddress());
+        assertThat(messageParsed.getOriginators().get(0).getName()).isEqualTo(
+                Rfc822Tokenizer.tokenize(TEST_FROM_ADDRESS)[0].getName());
+        assertThat(messageParsed.getOriginators().get(0).getFirstEmail()).isEqualTo(
+                Rfc822Tokenizer.tokenize(TEST_FROM_ADDRESS)[0].getAddress());
+    }
+
+    @Test
+    public void getIMMessage_withCharsetNative() {
+        when(mParams.getCharset()).thenReturn(BluetoothMapContent.MAP_MESSAGE_CHARSET_NATIVE);
+
+        assertThrows(IllegalArgumentException.class, () -> mContent.getIMMessage(TEST_ID,
+                mParams, mCurrentFolder));
+    }
+
+    @Test
+    public void getIMMessage_withEmptyCursor() {
+        when(mParams.getCharset()).thenReturn(BluetoothMapContent.MAP_MESSAGE_CHARSET_UTF8);
+        MatrixCursor cursor = new MatrixCursor(new String[] {});
+        cursor.moveToFirst();
+        doReturn(cursor).when(mMapMethodProxy).contentResolverQuery(any(), any(), any(), any(),
+                any(), any());
+
+        assertThrows(IllegalArgumentException.class, () -> mContent.getIMMessage(TEST_ID,
+                mParams, mCurrentFolder));
+    }
+
+    @Test
+    public void getIMMessage_withSentFolderId() throws Exception {
+        when(mParams.getCharset()).thenReturn(BluetoothMapContent.MAP_MESSAGE_CHARSET_UTF8);
+        when(mParams.getAttachment()).thenReturn(1);
+
+        MatrixCursor cursor = new MatrixCursor(new String[] {
+                BluetoothMapContract.MessageColumns.FLAG_READ,
+                BluetoothMapContract.MessageColumns.THREAD_ID,
+                BluetoothMapContract.MessageColumns.FOLDER_ID,
+                BluetoothMapContract.MessageColumns.SUBJECT,
+                BluetoothMapContract.MessageColumns._ID,
+                BluetoothMapContract.MessageColumns.DATE,
+                BluetoothMapContract.MessageColumns.ATTACHMENT_SIZE,
+                BluetoothMapContract.MessageColumns.BODY,
+                BluetoothMapContract.ConvoContactColumns.NAME,
+                BluetoothMapContract.ConvoContactColumns.X_BT_UID,
+                BluetoothMapContract.ConvoContactColumns.NICKNAME,
+                BluetoothMapContract.ConvoContactColumns.UCI,
+        });
+        cursor.addRow(new Object[] {1, 1, TEST_SENT_FOLDER_ID, TEST_SUBJECT, TEST_MESSAGE_ID,
+                TEST_DATE, 0, "body", TEST_NAME, TEST_FIRST_BT_UID, TEST_FORMATTED_NAME,
+                TEST_FIRST_BT_UCI_RECIPIENT});
+        cursor.moveToFirst();
+        doReturn(cursor).when(mMapMethodProxy).contentResolverQuery(any(), any(), any(), any(),
+                any(), any());
+
+        mCurrentFolder.setFolderId(TEST_SENT_FOLDER_ID);
+        when(mAccountItem.getUciFull()).thenReturn(TEST_FIRST_BT_UCI_ORIGINATOR);
+
+        byte[] encodedMessageMime = mContent.getIMMessage(TEST_ID, mParams, mCurrentFolder);
+        InputStream inputStream = new ByteArrayInputStream(encodedMessageMime);
+        BluetoothMapbMessage messageMimeParsed = BluetoothMapbMessage.parse(inputStream, 1);
+
+        assertThat(messageMimeParsed.mAppParamCharset).isEqualTo(1);
+        assertThat(messageMimeParsed.getType()).isEqualTo(TYPE.IM);
+        assertThat(messageMimeParsed.getVersionString()).isEqualTo("VERSION:" +
+                mContent.mMessageVersion);
+        assertThat(messageMimeParsed.getFolder()).isEqualTo(mCurrentFolder.getFullPath());
+        assertThat(messageMimeParsed.getRecipients().size()).isEqualTo(1);
+        assertThat(messageMimeParsed.getOriginators().size()).isEqualTo(1);
+        assertThat(messageMimeParsed.getOriginators().get(0).getName()).isEmpty();
+        assertThat(messageMimeParsed.getRecipients().get(0).getName()).isEqualTo(
+                TEST_FORMATTED_NAME);
+    }
+
+    @Test
+    public void getIMMessage_withInboxFolderId() throws Exception {
+        when(mParams.getCharset()).thenReturn(BluetoothMapContent.MAP_MESSAGE_CHARSET_UTF8);
+        when(mParams.getAttachment()).thenReturn(1);
+
+        MatrixCursor cursor = new MatrixCursor(new String[] {
+                BluetoothMapContract.MessageColumns.FLAG_READ,
+                BluetoothMapContract.MessageColumns.THREAD_ID,
+                BluetoothMapContract.MessageColumns.FOLDER_ID,
+                BluetoothMapContract.MessageColumns.SUBJECT,
+                BluetoothMapContract.MessageColumns._ID,
+                BluetoothMapContract.MessageColumns.DATE,
+                BluetoothMapContract.MessageColumns.ATTACHMENT_SIZE,
+                BluetoothMapContract.MessageColumns.BODY,
+                BluetoothMapContract.ConvoContactColumns.NAME,
+                BluetoothMapContract.ConvoContactColumns.X_BT_UID,
+                BluetoothMapContract.ConvoContactColumns.NICKNAME,
+                BluetoothMapContract.ConvoContactColumns.UCI,
+        });
+        cursor.addRow(new Object[] {0, 1, TEST_INBOX_FOLDER_ID, TEST_SUBJECT, TEST_MESSAGE_ID,
+                TEST_DATE, 0, "body", TEST_NAME, TEST_FIRST_BT_UID, TEST_FORMATTED_NAME,
+                TEST_FIRST_BT_UCI_ORIGINATOR});
+        cursor.moveToFirst();
+        doReturn(cursor).when(mMapMethodProxy).contentResolverQuery(any(), any(), any(), any(),
+                any(), any());
+
+        mCurrentFolder.setFolderId(TEST_INBOX_FOLDER_ID);
+        when(mAccountItem.getUciFull()).thenReturn(TEST_FIRST_BT_UCI_RECIPIENT);
+
+        byte[] encodedMessageMime = mContent.getIMMessage(TEST_ID, mParams, mCurrentFolder);
+        InputStream inputStream = new ByteArrayInputStream(encodedMessageMime);
+        BluetoothMapbMessage messageMimeParsed = BluetoothMapbMessage.parse(inputStream, 1);
+
+        assertThat(messageMimeParsed.mAppParamCharset).isEqualTo(1);
+        assertThat(messageMimeParsed.getType()).isEqualTo(TYPE.IM);
+        assertThat(messageMimeParsed.getVersionString()).isEqualTo("VERSION:" +
+                mContent.mMessageVersion);
+        assertThat(messageMimeParsed.getFolder()).isEqualTo(mCurrentFolder.getFullPath());
+        assertThat(messageMimeParsed.getRecipients().size()).isEqualTo(1);
+        assertThat(messageMimeParsed.getOriginators().size()).isEqualTo(1);
+        assertThat(messageMimeParsed.getOriginators().get(0).getName()).isEqualTo(
+                TEST_FORMATTED_NAME);
+        assertThat(messageMimeParsed.getRecipients().get(0).getName()).isEmpty();
+    }
+
+    @Test
+    public void convoListing_withNullFilterRecipient() {
+        when(mParams.getConvoParameterMask()).thenReturn(
+                (long) BluetoothMapAppParams.INVALID_VALUE_PARAMETER);
+        when(mParams.getFilterMessageType()).thenReturn(TEST_NO_FILTER);
+        when(mParams.getMaxListCount()).thenReturn(2);
+        when(mParams.getStartOffset()).thenReturn(0);
+        // This mock sets filter recipient to null
+        when(mParams.getFilterRecipient()).thenReturn(null);
+
+        MatrixCursor smsMmsCursor = new MatrixCursor(new String[] {"MmsSmsThreadColId",
+                "MmsSmsThreadColDate", "MmsSmsThreadColSnippet", "MmsSmsThreadSnippetCharset",
+                "MmsSmsThreadColRead", "MmsSmsThreadColRecipientIds"});
+        smsMmsCursor.addRow(new Object[] {TEST_ID, TEST_DATE_SMS, "test_col_snippet",
+                "test_col_snippet_cs", 1, "test_recipient_ids"});
+        smsMmsCursor.moveToFirst();
+        doReturn(smsMmsCursor).when(mMapMethodProxy).contentResolverQuery(any(), any(),
+                eq(BluetoothMapContent.MMS_SMS_THREAD_PROJECTION), any(), any(), any());
+
+        MatrixCursor imEmailCursor = new MatrixCursor(
+                new String[] {BluetoothMapContract.ConversationColumns.THREAD_ID,
+                        BluetoothMapContract.ConversationColumns.LAST_THREAD_ACTIVITY,
+                        BluetoothMapContract.ConversationColumns.THREAD_NAME,
+                        BluetoothMapContract.ConversationColumns.READ_STATUS,
+                        BluetoothMapContract.ConversationColumns.VERSION_COUNTER,
+                        BluetoothMapContract.ConversationColumns.SUMMARY,
+                        BluetoothMapContract.ConvoContactColumns.X_BT_UID,
+                        BluetoothMapContract.ConvoContactColumns.CHAT_STATE,
+                        BluetoothMapContract.ConvoContactColumns.UCI,
+                        BluetoothMapContract.ConvoContactColumns.NICKNAME,
+                        BluetoothMapContract.ConvoContactColumns.LAST_ACTIVE,
+                        BluetoothMapContract.ConvoContactColumns.NAME,
+                        BluetoothMapContract.ConvoContactColumns.PRESENCE_STATE,
+                        BluetoothMapContract.ConvoContactColumns.STATUS_TEXT,
+                        BluetoothMapContract.ConvoContactColumns.PRIORITY});
+        imEmailCursor.addRow(new Object[] {TEST_ID, TEST_DATE_EMAIL, TEST_NAME, 0, 0, 0, 0, 0, 0, 0,
+                0, 0, 0, 0, 0});
+        doReturn(imEmailCursor).when(mMapMethodProxy).contentResolverQuery(any(), any(),
+                eq(BluetoothMapContract.BT_CONVERSATION_PROJECTION), any(), any(), any());
+
+        BluetoothMapConvoListing listing = mContent.convoListing(mParams, false);
+
+        assertThat(listing.getCount()).isEqualTo(2);
+        BluetoothMapConvoListingElement emailElement = listing.getList().get(1);
+        assertThat(emailElement.getType()).isEqualTo(TYPE.EMAIL);
+        assertThat(emailElement.getLastActivity()).isEqualTo(TEST_DATE_EMAIL);
+        assertThat(emailElement.getName()).isEqualTo(TEST_NAME);
+        assertThat(emailElement.getReadBool()).isFalse();
+        BluetoothMapConvoListingElement smsElement = listing.getList().get(0);
+        assertThat(smsElement.getType()).isEqualTo(TYPE.SMS_GSM);
+        assertThat(smsElement.getLastActivity()).isEqualTo(TEST_DATE_SMS);
+        assertThat(smsElement.getName()).isEqualTo("");
+        assertThat(smsElement.getReadBool()).isTrue();
+    }
+
+    @Test
+    public void convoListing_withNonNullFilterRecipient() {
+        when(mParams.getConvoParameterMask()).thenReturn(
+                (long) BluetoothMapAppParams.INVALID_VALUE_PARAMETER);
+        when(mParams.getFilterMessageType()).thenReturn(BluetoothMapAppParams.FILTER_NO_EMAIL);
+        when(mParams.getMaxListCount()).thenReturn(2);
+        when(mParams.getStartOffset()).thenReturn(0);
+        // This mock sets filter recipient to non null
+        when(mParams.getFilterRecipient()).thenReturn(TEST_CONTACT_NAME_FILTER);
+
+        MatrixCursor smsMmsCursor = new MatrixCursor(new String[] {"MmsSmsThreadColId",
+                "MmsSmsThreadColDate", "MmsSmsThreadColSnippet", "MmsSmsThreadSnippetCharset",
+                "MmsSmsThreadColRead", "MmsSmsThreadColRecipientIds"});
+        smsMmsCursor.addRow(new Object[] {TEST_ID, TEST_DATE_SMS, "test_col_snippet",
+                "test_col_snippet_cs", 1, String.valueOf(TEST_ID)});
+        smsMmsCursor.moveToFirst();
+        doReturn(smsMmsCursor).when(mMapMethodProxy).contentResolverQuery(any(), any(),
+                eq(BluetoothMapContent.MMS_SMS_THREAD_PROJECTION), any(), any(), any());
+
+        MatrixCursor addressCursor = new MatrixCursor(new String[] {"COL_ADDR_ID",
+                "COL_ADDR_ADDR"});
+        addressCursor.addRow(new Object[]{TEST_ID, TEST_ADDRESS});
+        doReturn(addressCursor).when(mMapMethodProxy).contentResolverQuery(any(), any(),
+                eq(SmsMmsContacts.ADDRESS_PROJECTION), any(), any(), any());
+
+        MatrixCursor contactCursor = new MatrixCursor(new String[] {"COL_CONTACT_ID",
+                "COL_CONTACT_NAME"});
+        contactCursor.addRow(new Object[]{TEST_ID, TEST_NAME});
+        doReturn(contactCursor).when(mMapMethodProxy).contentResolverQuery(any(), any(),
+                eq(SmsMmsContacts.CONTACT_PROJECTION), any(), any(), any());
+
+        MatrixCursor imEmailCursor = new MatrixCursor(
+                new String[] {BluetoothMapContract.ConversationColumns.THREAD_ID,
+                        BluetoothMapContract.ConversationColumns.LAST_THREAD_ACTIVITY,
+                        BluetoothMapContract.ConversationColumns.THREAD_NAME,
+                        BluetoothMapContract.ConversationColumns.READ_STATUS,
+                        BluetoothMapContract.ConversationColumns.VERSION_COUNTER,
+                        BluetoothMapContract.ConversationColumns.SUMMARY,
+                        BluetoothMapContract.ConvoContactColumns.X_BT_UID,
+                        BluetoothMapContract.ConvoContactColumns.CHAT_STATE,
+                        BluetoothMapContract.ConvoContactColumns.UCI,
+                        BluetoothMapContract.ConvoContactColumns.NICKNAME,
+                        BluetoothMapContract.ConvoContactColumns.LAST_ACTIVE,
+                        BluetoothMapContract.ConvoContactColumns.NAME,
+                        BluetoothMapContract.ConvoContactColumns.PRESENCE_STATE,
+                        BluetoothMapContract.ConvoContactColumns.STATUS_TEXT,
+                        BluetoothMapContract.ConvoContactColumns.PRIORITY});
+        imEmailCursor.addRow(new Object[] {TEST_ID, TEST_DATE_EMAIL, TEST_NAME, 0, 0, 0, 0, 0, 0, 0,
+                0, 0, 0, 0, 0});
+        doReturn(imEmailCursor).when(mMapMethodProxy).contentResolverQuery(any(), any(),
+                eq(BluetoothMapContract.BT_CONVERSATION_PROJECTION), any(), any(), any());
+
+        BluetoothMapConvoListing listing = mContent.convoListing(mParams, false);
+
+        assertThat(listing.getCount()).isEqualTo(2);
+        BluetoothMapConvoListingElement imElement = listing.getList().get(1);
+        assertThat(imElement.getType()).isEqualTo(TYPE.IM);
+        assertThat(imElement.getLastActivity()).isEqualTo(TEST_DATE_EMAIL);
+        assertThat(imElement.getName()).isEqualTo(TEST_NAME);
+        assertThat(imElement.getReadBool()).isFalse();
+        BluetoothMapConvoListingElement smsElement = listing.getList().get(0);
+        assertThat(smsElement.getType()).isEqualTo(TYPE.SMS_GSM);
+        assertThat(smsElement.getLastActivity()).isEqualTo(TEST_DATE_SMS);
+        assertThat(smsElement.getName()).isEqualTo("");
+        assertThat(smsElement.getReadBool()).isTrue();
+    }
+
+    @Test
+    public void msgListing_withSmsCursorOnly() {
+        when(mParams.getParameterMask()).thenReturn(
+                (long) BluetoothMapAppParams.INVALID_VALUE_PARAMETER);
+        int noMms = BluetoothMapAppParams.FILTER_NO_MMS;
+        when(mParams.getFilterMessageType()).thenReturn(noMms);
+        when(mParams.getMaxListCount()).thenReturn(1);
+        when(mParams.getStartOffset()).thenReturn(0);
+
+        mCurrentFolder.setHasSmsMmsContent(true);
+        mCurrentFolder.setFolderId(TEST_ID);
+        mContent.mMsgListingVersion = BluetoothMapUtils.MAP_MESSAGE_LISTING_FORMAT_V11;
+
+        MatrixCursor smsCursor = new MatrixCursor(new String[] {BaseColumns._ID, Telephony.Sms.TYPE,
+                Telephony.Sms.READ, Telephony.Sms.BODY, Telephony.Sms.ADDRESS, Telephony.Sms.DATE,
+                Telephony.Sms.THREAD_ID, ContactsContract.Contacts.DISPLAY_NAME});
+        smsCursor.addRow(new Object[] {TEST_ID, TEST_SENT_NO, TEST_READ_TRUE, TEST_SUBJECT,
+                TEST_ADDRESS, TEST_DATE_SMS, TEST_THREAD_ID, TEST_PHONE_NAME});
+        doReturn(smsCursor).when(mMapMethodProxy).contentResolverQuery(any(), any(),
+                eq(BluetoothMapContent.SMS_PROJECTION), any(), any(), any());
+        doReturn(smsCursor).when(mMapMethodProxy).contentResolverQuery(any(), any(),
+                eq(new String[] {ContactsContract.Contacts._ID,
+                        ContactsContract.Contacts.DISPLAY_NAME}), any(), any(), any());
+
+        BluetoothMapMessageListing listing = mContent.msgListing(mCurrentFolder, mParams);
+        assertThat(listing.getCount()).isEqualTo(1);
+
+        BluetoothMapMessageListingElement smsElement = listing.getList().get(0);
+        assertThat(smsElement.getHandle()).isEqualTo(TEST_ID);
+        assertThat(smsElement.getDateTime()).isEqualTo(TEST_DATE_SMS);
+        assertThat(smsElement.getType()).isEqualTo(TYPE.SMS_GSM);
+        assertThat(smsElement.getReadBool()).isTrue();
+        assertThat(smsElement.getSenderAddressing()).isEqualTo(
+                PhoneNumberUtils.extractNetworkPortion(TEST_ADDRESS));
+        assertThat(smsElement.getSenderName()).isEqualTo(TEST_PHONE_NAME);
+        assertThat(smsElement.getSize()).isEqualTo(TEST_SUBJECT.length());
+        assertThat(smsElement.getPriority()).isEqualTo(TEST_NO);
+        assertThat(smsElement.getSent()).isEqualTo(TEST_NO);
+        assertThat(smsElement.getProtect()).isEqualTo(TEST_NO);
+        assertThat(smsElement.getReceptionStatus()).isEqualTo(TEST_RECEPTION_STATUS);
+        assertThat(smsElement.getAttachmentSize()).isEqualTo(0);
+        assertThat(smsElement.getDeliveryStatus()).isEqualTo(TEST_DELIVERY_STATE);
+    }
+
+    @Test
+    public void msgListing_withMmsCursorOnly() {
+        when(mParams.getParameterMask()).thenReturn(
+                (long) BluetoothMapAppParams.INVALID_VALUE_PARAMETER);
+        int onlyMms =
+                BluetoothMapAppParams.FILTER_NO_EMAIL | BluetoothMapAppParams.FILTER_NO_SMS_CDMA
+                        | BluetoothMapAppParams.FILTER_NO_SMS_GSM
+                        | BluetoothMapAppParams.FILTER_NO_IM;
+        when(mParams.getFilterMessageType()).thenReturn(onlyMms);
+        when(mParams.getMaxListCount()).thenReturn(1);
+        when(mParams.getStartOffset()).thenReturn(0);
+
+        mCurrentFolder.setHasSmsMmsContent(true);
+        mCurrentFolder.setFolderId(TEST_ID);
+        mContent.mMsgListingVersion = BluetoothMapUtils.MAP_MESSAGE_LISTING_FORMAT_V11;
+
+        MatrixCursor mmsCursor = new MatrixCursor(new String[] {BaseColumns._ID,
+                Telephony.Mms.MESSAGE_BOX, Telephony.Mms.READ, Telephony.Mms.MESSAGE_SIZE,
+                Telephony.Mms.TEXT_ONLY, Telephony.Mms.DATE, Telephony.Mms.SUBJECT,
+                Telephony.Mms.THREAD_ID, Telephony.Mms.Addr.ADDRESS,
+                ContactsContract.Contacts.DISPLAY_NAME, Telephony.Mms.PRIORITY});
+        mmsCursor.addRow(new Object[] {TEST_ID, TEST_SENT_NO, TEST_READ_FALSE, TEST_SIZE,
+                TEST_TEXT_ONLY, TEST_DATE_MMS, TEST_SUBJECT, TEST_THREAD_ID, TEST_PHONE,
+                TEST_PHONE_NAME, PduHeaders.PRIORITY_HIGH});
+        doReturn(mmsCursor).when(mMapMethodProxy).contentResolverQuery(any(), any(),
+                eq(BluetoothMapContent.MMS_PROJECTION), any(), any(), any());
+        doReturn(mmsCursor).when(mMapMethodProxy).contentResolverQuery(any(), any(),
+                eq(new String[] {Telephony.Mms.Addr.ADDRESS}), any(), any(), any());
+        doReturn(mmsCursor).when(mMapMethodProxy).contentResolverQuery(any(), any(),
+                eq(new String[] {ContactsContract.Contacts._ID,
+                        ContactsContract.Contacts.DISPLAY_NAME}), any(), any(), any());
+
+        BluetoothMapMessageListing listing = mContent.msgListing(mCurrentFolder, mParams);
+        assertThat(listing.getCount()).isEqualTo(1);
+
+        BluetoothMapMessageListingElement mmsElement = listing.getList().get(0);
+        assertThat(mmsElement.getHandle()).isEqualTo(TEST_ID);
+        assertThat(mmsElement.getDateTime()).isEqualTo(TEST_DATE_MMS * 1000L);
+        assertThat(mmsElement.getType()).isEqualTo(TYPE.MMS);
+        assertThat(mmsElement.getReadBool()).isFalse();
+        assertThat(mmsElement.getSenderAddressing()).isEqualTo(TEST_PHONE);
+        assertThat(mmsElement.getSenderName()).isEqualTo(TEST_PHONE_NAME);
+        assertThat(mmsElement.getSize()).isEqualTo(TEST_SIZE);
+        assertThat(mmsElement.getPriority()).isEqualTo(TEST_YES);
+        assertThat(mmsElement.getSent()).isEqualTo(TEST_NO);
+        assertThat(mmsElement.getProtect()).isEqualTo(TEST_NO);
+        assertThat(mmsElement.getReceptionStatus()).isEqualTo(TEST_RECEPTION_STATUS);
+        assertThat(mmsElement.getAttachmentSize()).isEqualTo(0);
+        assertThat(mmsElement.getDeliveryStatus()).isEqualTo(TEST_DELIVERY_STATE);
+    }
+
+    @Test
+    public void msgListing_withEmailCursorOnly() {
+        when(mParams.getParameterMask()).thenReturn(
+                (long) BluetoothMapAppParams.INVALID_VALUE_PARAMETER);
+        int onlyEmail =
+                BluetoothMapAppParams.FILTER_NO_MMS | BluetoothMapAppParams.FILTER_NO_SMS_CDMA
+                        | BluetoothMapAppParams.FILTER_NO_SMS_GSM
+                        | BluetoothMapAppParams.FILTER_NO_IM;
+        when(mParams.getFilterMessageType()).thenReturn(onlyEmail);
+        when(mParams.getMaxListCount()).thenReturn(1);
+        when(mParams.getStartOffset()).thenReturn(0);
+
+        mCurrentFolder.setHasEmailContent(true);
+        mCurrentFolder.setFolderId(TEST_ID);
+        mContent.mMsgListingVersion = BluetoothMapUtils.MAP_MESSAGE_LISTING_FORMAT_V11;
+
+        MatrixCursor emailCursor = new MatrixCursor(new String[] {
+                BluetoothMapContract.MessageColumns._ID,
+                BluetoothMapContract.MessageColumns.DATE,
+                BluetoothMapContract.MessageColumns.SUBJECT,
+                BluetoothMapContract.MessageColumns.FOLDER_ID,
+                BluetoothMapContract.MessageColumns.FLAG_READ,
+                BluetoothMapContract.MessageColumns.MESSAGE_SIZE,
+                BluetoothMapContract.MessageColumns.FROM_LIST,
+                BluetoothMapContract.MessageColumns.TO_LIST,
+                BluetoothMapContract.MessageColumns.FLAG_ATTACHMENT,
+                BluetoothMapContract.MessageColumns.ATTACHMENT_SIZE,
+                BluetoothMapContract.MessageColumns.FLAG_HIGH_PRIORITY,
+                BluetoothMapContract.MessageColumns.FLAG_PROTECTED,
+                BluetoothMapContract.MessageColumns.RECEPTION_STATE,
+                BluetoothMapContract.MessageColumns.DEVILERY_STATE,
+                BluetoothMapContract.MessageColumns.THREAD_ID,
+                BluetoothMapContract.MessageColumns.CC_LIST,
+                BluetoothMapContract.MessageColumns.BCC_LIST,
+                BluetoothMapContract.MessageColumns.REPLY_TO_LIST});
+        emailCursor.addRow(new Object[] {TEST_ID, TEST_DATE_EMAIL, TEST_SUBJECT, TEST_SENT_YES,
+                TEST_READ_TRUE, TEST_SIZE, TEST_FROM_ADDRESS, TEST_TO_ADDRESS, TEST_ATTACHMENT_TRUE,
+                0, TEST_PRIORITY_HIGH, TEST_PROTECTED, 0, TEST_DELIVERY_STATE,
+                TEST_THREAD_ID, TEST_CC_ADDRESS, TEST_BCC_ADDRESS, TEST_TO_ADDRESS});
+        doReturn(emailCursor).when(mMapMethodProxy).contentResolverQuery(any(), any(),
+                eq(BluetoothMapContract.BT_MESSAGE_PROJECTION), any(), any(), any());
+
+        BluetoothMapMessageListing listing = mContent.msgListing(mCurrentFolder, mParams);
+        assertThat(listing.getCount()).isEqualTo(1);
+
+        BluetoothMapMessageListingElement emailElement = listing.getList().get(0);
+        assertThat(emailElement.getHandle()).isEqualTo(TEST_ID);
+        assertThat(emailElement.getDateTime()).isEqualTo(TEST_DATE_EMAIL);
+        assertThat(emailElement.getType()).isEqualTo(TYPE.EMAIL);
+        assertThat(emailElement.getReadBool()).isTrue();
+        StringBuilder expectedAddress = new StringBuilder();
+        expectedAddress.append(Rfc822Tokenizer.tokenize(TEST_FROM_ADDRESS)[0].getAddress());
+        assertThat(emailElement.getSenderAddressing()).isEqualTo(expectedAddress.toString());
+        StringBuilder expectedName = new StringBuilder();
+        expectedName.append(Rfc822Tokenizer.tokenize(TEST_FROM_ADDRESS)[0].getName());
+        assertThat(emailElement.getSenderName()).isEqualTo(expectedName.toString());
+        assertThat(emailElement.getSize()).isEqualTo(TEST_SIZE);
+        assertThat(emailElement.getPriority()).isEqualTo(TEST_YES);
+        assertThat(emailElement.getSent()).isEqualTo(TEST_YES);
+        assertThat(emailElement.getProtect()).isEqualTo(TEST_YES);
+        assertThat(emailElement.getReceptionStatus()).isEqualTo(TEST_RECEPTION_STATUS);
+        assertThat(emailElement.getAttachmentSize()).isEqualTo(TEST_SIZE);
+        assertThat(emailElement.getDeliveryStatus()).isEqualTo(TEST_DELIVERY_STATE);
+    }
+
+    @Test
+    public void msgListing_withImCursorOnly() {
+        when(mParams.getParameterMask()).thenReturn(
+                (long) BluetoothMapAppParams.INVALID_VALUE_PARAMETER);
+        int onlyIm = BluetoothMapAppParams.FILTER_NO_MMS | BluetoothMapAppParams.FILTER_NO_SMS_CDMA
+                | BluetoothMapAppParams.FILTER_NO_SMS_GSM | BluetoothMapAppParams.FILTER_NO_EMAIL;
+        when(mParams.getFilterMessageType()).thenReturn(onlyIm);
+        when(mParams.getMaxListCount()).thenReturn(1);
+        when(mParams.getStartOffset()).thenReturn(0);
+
+        mCurrentFolder.setHasImContent(true);
+        mCurrentFolder.setFolderId(TEST_ID);
+        mContent.mMsgListingVersion = BluetoothMapUtils.MAP_MESSAGE_LISTING_FORMAT_V11;
+
+        MatrixCursor imCursor = new MatrixCursor(new String[] {
+                BluetoothMapContract.MessageColumns._ID,
+                BluetoothMapContract.MessageColumns.DATE,
+                BluetoothMapContract.MessageColumns.SUBJECT,
+                BluetoothMapContract.MessageColumns.FOLDER_ID,
+                BluetoothMapContract.MessageColumns.FLAG_READ,
+                BluetoothMapContract.MessageColumns.MESSAGE_SIZE,
+                BluetoothMapContract.MessageColumns.FROM_LIST,
+                BluetoothMapContract.MessageColumns.TO_LIST,
+                BluetoothMapContract.MessageColumns.FLAG_ATTACHMENT,
+                BluetoothMapContract.MessageColumns.ATTACHMENT_SIZE,
+                BluetoothMapContract.MessageColumns.FLAG_HIGH_PRIORITY,
+                BluetoothMapContract.MessageColumns.FLAG_PROTECTED,
+                BluetoothMapContract.MessageColumns.RECEPTION_STATE,
+                BluetoothMapContract.MessageColumns.DEVILERY_STATE,
+                BluetoothMapContract.MessageColumns.THREAD_ID,
+                BluetoothMapContract.MessageColumns.THREAD_NAME,
+                BluetoothMapContract.MessageColumns.ATTACHMENT_MINE_TYPES,
+                BluetoothMapContract.MessageColumns.BODY,
+                BluetoothMapContract.ConvoContactColumns.UCI,
+                BluetoothMapContract.ConvoContactColumns.NAME});
+        imCursor.addRow(new Object[] {TEST_ID, TEST_DATE_IM, TEST_SUBJECT, TEST_SENT_NO,
+                TEST_READ_FALSE, TEST_SIZE, TEST_ID, TEST_TO_ADDRESS, TEST_ATTACHMENT_TRUE,
+                0 /*=attachment size*/, TEST_PRIORITY_HIGH, TEST_PROTECTED, 0, TEST_DELIVERY_STATE,
+                TEST_THREAD_ID, TEST_NAME, TEST_ATTACHMENT_MIME_TYPE, 0, TEST_ADDRESS, TEST_NAME});
+        doReturn(imCursor).when(mMapMethodProxy).contentResolverQuery(any(), any(),
+                eq(BluetoothMapContract.BT_INSTANT_MESSAGE_PROJECTION), any(), any(), any());
+        doReturn(imCursor).when(mMapMethodProxy).contentResolverQuery(any(), any(),
+                eq(BluetoothMapContract.BT_CONTACT_PROJECTION), any(), any(), any());
+
+        BluetoothMapMessageListing listing = mContent.msgListing(mCurrentFolder, mParams);
+        assertThat(listing.getCount()).isEqualTo(1);
+
+        BluetoothMapMessageListingElement imElement = listing.getList().get(0);
+        assertThat(imElement.getHandle()).isEqualTo(TEST_ID);
+        assertThat(imElement.getDateTime()).isEqualTo(TEST_DATE_IM);
+        assertThat(imElement.getType()).isEqualTo(TYPE.IM);
+        assertThat(imElement.getReadBool()).isFalse();
+        assertThat(imElement.getSenderAddressing()).isEqualTo(TEST_ADDRESS);
+        assertThat(imElement.getSenderName()).isEqualTo(TEST_NAME);
+        assertThat(imElement.getSize()).isEqualTo(TEST_SIZE);
+        assertThat(imElement.getPriority()).isEqualTo(TEST_YES);
+        assertThat(imElement.getSent()).isEqualTo(TEST_NO);
+        assertThat(imElement.getProtect()).isEqualTo(TEST_YES);
+        assertThat(imElement.getReceptionStatus()).isEqualTo(TEST_RECEPTION_STATUS);
+        assertThat(imElement.getAttachmentSize()).isEqualTo(TEST_SIZE);
+        assertThat(imElement.getAttachmentMimeTypes()).isEqualTo(TEST_ATTACHMENT_MIME_TYPE);
+        assertThat(imElement.getDeliveryStatus()).isEqualTo(TEST_DELIVERY_STATE);
+        assertThat(imElement.getThreadName()).isEqualTo(TEST_NAME);
+    }
+
+    @Test
+    public void msgListingSize() {
+        when(mParams.getFilterMessageType()).thenReturn(TEST_NO_FILTER);
+        mCurrentFolder.setHasSmsMmsContent(true);
+        mCurrentFolder.setHasEmailContent(true);
+        mCurrentFolder.setHasImContent(true);
+        mCurrentFolder.setFolderId(TEST_ID);
+
+        MatrixCursor smsCursor = new MatrixCursor(new String[] {"Placeholder"});
+        // Making cursor.getCount() as 1
+        smsCursor.addRow(new Object[] {1});
+        doReturn(smsCursor).when(mMapMethodProxy).contentResolverQuery(any(), any(),
+                eq(BluetoothMapContent.SMS_PROJECTION), any(), any(), any());
+
+        MatrixCursor mmsCursor = new MatrixCursor(new String[] {"Placeholder"});
+        // Making cursor.getCount() as 1
+        mmsCursor.addRow(new Object[] {1});
+        doReturn(mmsCursor).when(mMapMethodProxy).contentResolverQuery(any(), any(),
+                eq(BluetoothMapContent.MMS_PROJECTION), any(), any(), any());
+
+        MatrixCursor emailCursor = new MatrixCursor(new String[] {"Placeholder"});
+        // Making cursor.getCount() as 1
+        emailCursor.addRow(new Object[] {1});
+        doReturn(emailCursor).when(mMapMethodProxy).contentResolverQuery(any(), any(),
+                eq(BluetoothMapContract.BT_MESSAGE_PROJECTION), any(), any(), any());
+
+        MatrixCursor imCursor = new MatrixCursor(new String[] {"Placeholder"});
+        // Making cursor.getCount() as 1
+        imCursor.addRow(new Object[] {1});
+        doReturn(imCursor).when(mMapMethodProxy).contentResolverQuery(any(), any(),
+                eq(BluetoothMapContract.BT_INSTANT_MESSAGE_PROJECTION), any(), any(), any());
+
+        assertThat(mContent.msgListingSize(mCurrentFolder, mParams)).isEqualTo(4);
+    }
+
+    @Test
+    public void msgListingHasUnread() {
+        when(mParams.getFilterMessageType()).thenReturn(TEST_NO_FILTER);
+        mCurrentFolder.setHasSmsMmsContent(true);
+        mCurrentFolder.setHasEmailContent(true);
+        mCurrentFolder.setHasImContent(true);
+        mCurrentFolder.setFolderId(TEST_ID);
+
+        MatrixCursor smsCursor = new MatrixCursor(new String[] {"Placeholder"});
+        // Making cursor.getCount() as 1
+        smsCursor.addRow(new Object[] {1});
+        doReturn(smsCursor).when(mMapMethodProxy).contentResolverQuery(any(), any(),
+                eq(BluetoothMapContent.SMS_PROJECTION), any(), any(), any());
+
+        MatrixCursor mmsCursor = new MatrixCursor(new String[] {"Placeholder"});
+        // Making cursor.getCount() as 1
+        mmsCursor.addRow(new Object[] {1});
+        doReturn(mmsCursor).when(mMapMethodProxy).contentResolverQuery(any(), any(),
+                eq(BluetoothMapContent.MMS_PROJECTION), any(), any(), any());
+
+        MatrixCursor emailCursor = new MatrixCursor(new String[] {"Placeholder"});
+        // Making cursor.getCount() as 1
+        emailCursor.addRow(new Object[] {1});
+        doReturn(emailCursor).when(mMapMethodProxy).contentResolverQuery(any(), any(),
+                eq(BluetoothMapContract.BT_MESSAGE_PROJECTION), any(), any(), any());
+
+        MatrixCursor imCursor = new MatrixCursor(new String[] {"Placeholder"});
+        // Making cursor.getCount() as 1
+        imCursor.addRow(new Object[] {1});
+        doReturn(imCursor).when(mMapMethodProxy).contentResolverQuery(any(), any(),
+                eq(BluetoothMapContract.BT_INSTANT_MESSAGE_PROJECTION), any(), any(), any());
+
+        assertThat(mContent.msgListingHasUnread(mCurrentFolder, mParams)).isTrue();
+    }
+}
\ No newline at end of file
diff --git a/android/app/tests/unit/src/com/android/bluetooth/map/BluetoothMapConvoContactElementTest.java b/android/app/tests/unit/src/com/android/bluetooth/map/BluetoothMapConvoContactElementTest.java
new file mode 100644
index 0000000..4e6a144
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/map/BluetoothMapConvoContactElementTest.java
@@ -0,0 +1,203 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.map;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import static org.mockito.Mockito.when;
+
+import androidx.test.runner.AndroidJUnit4;
+
+import com.android.bluetooth.SignedLongLong;
+import com.android.internal.util.FastXmlSerializer;
+
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.Mock;
+import org.mockito.MockitoAnnotations;
+import org.xmlpull.v1.XmlPullParser;
+import org.xmlpull.v1.XmlPullParserFactory;
+import org.xmlpull.v1.XmlSerializer;
+
+import java.io.StringReader;
+import java.io.StringWriter;
+import java.text.SimpleDateFormat;
+
+@RunWith(AndroidJUnit4.class)
+public class BluetoothMapConvoContactElementTest {
+    private static final String TEST_UCI = "test_bt_uci";
+    private static final String TEST_NAME = "test_name";
+    private static final String TEST_DISPLAY_NAME = "test_display_name";
+    private static final String TEST_PRESENCE_STATUS = "test_presence_status";
+    private static final int TEST_PRESENCE_AVAILABILITY = 2;
+    private static final long TEST_LAST_ACTIVITY = 1;
+    private static final int TEST_CHAT_STATE = 2;
+    private static final int TEST_PRIORITY = 1;
+    private static final String TEST_BT_UID = "1111";
+
+    private final SimpleDateFormat format = new SimpleDateFormat("yyyyMMdd'T'HHmmss");
+
+    @Mock
+    private MapContact mMapContact;
+
+    @Before
+    public void setUp() throws Exception {
+        MockitoAnnotations.initMocks(this);
+    }
+
+    @Test
+    public void constructorWithArguments() {
+        BluetoothMapConvoContactElement contactElement =
+                new BluetoothMapConvoContactElement(TEST_UCI, TEST_NAME, TEST_DISPLAY_NAME,
+                TEST_PRESENCE_STATUS, TEST_PRESENCE_AVAILABILITY, TEST_LAST_ACTIVITY,
+                TEST_CHAT_STATE, TEST_PRIORITY, TEST_BT_UID);
+
+        assertThat(contactElement.getContactId()).isEqualTo(TEST_UCI);
+        assertThat(contactElement.getName()).isEqualTo(TEST_NAME);
+        assertThat(contactElement.getDisplayName()).isEqualTo(TEST_DISPLAY_NAME);
+        assertThat(contactElement.getPresenceStatus()).isEqualTo(TEST_PRESENCE_STATUS);
+        assertThat(contactElement.getPresenceAvailability()).isEqualTo(TEST_PRESENCE_AVAILABILITY);
+        assertThat(contactElement.getLastActivityString()).isEqualTo(
+                format.format(TEST_LAST_ACTIVITY));
+        assertThat(contactElement.getChatState()).isEqualTo(TEST_CHAT_STATE);
+        assertThat(contactElement.getPriority()).isEqualTo(TEST_PRIORITY);
+        assertThat(contactElement.getBtUid()).isEqualTo(TEST_BT_UID);
+    }
+
+    @Test
+    public void createFromMapContact() {
+        final long id = 1111;
+        final SignedLongLong signedLongLong = new SignedLongLong(id, 0);
+        when(mMapContact.getId()).thenReturn(id);
+        when(mMapContact.getName()).thenReturn(TEST_DISPLAY_NAME);
+        BluetoothMapConvoContactElement contactElement =
+                BluetoothMapConvoContactElement.createFromMapContact(mMapContact, TEST_UCI);
+        assertThat(contactElement.getContactId()).isEqualTo(TEST_UCI);
+        assertThat(contactElement.getBtUid()).isEqualTo(signedLongLong.toHexString());
+        assertThat(contactElement.getDisplayName()).isEqualTo(TEST_DISPLAY_NAME);
+    }
+
+    @Test
+    public void settersAndGetters() throws Exception {
+        BluetoothMapConvoContactElement contactElement = new BluetoothMapConvoContactElement();
+        contactElement.setDisplayName(TEST_DISPLAY_NAME);
+        contactElement.setPresenceStatus(TEST_PRESENCE_STATUS);
+        contactElement.setPresenceAvailability(TEST_PRESENCE_AVAILABILITY);
+        contactElement.setPriority(TEST_PRIORITY);
+        contactElement.setName(TEST_NAME);
+        contactElement.setBtUid(SignedLongLong.fromString(TEST_BT_UID));
+        contactElement.setChatState(TEST_CHAT_STATE);
+        contactElement.setLastActivity(TEST_LAST_ACTIVITY);
+        contactElement.setContactId(TEST_UCI);
+
+        assertThat(contactElement.getContactId()).isEqualTo(TEST_UCI);
+        assertThat(contactElement.getName()).isEqualTo(TEST_NAME);
+        assertThat(contactElement.getDisplayName()).isEqualTo(TEST_DISPLAY_NAME);
+        assertThat(contactElement.getPresenceStatus()).isEqualTo(TEST_PRESENCE_STATUS);
+        assertThat(contactElement.getPresenceAvailability()).isEqualTo(TEST_PRESENCE_AVAILABILITY);
+        assertThat(contactElement.getLastActivityString()).isEqualTo(
+                format.format(TEST_LAST_ACTIVITY));
+        assertThat(contactElement.getChatState()).isEqualTo(TEST_CHAT_STATE);
+        assertThat(contactElement.getPriority()).isEqualTo(TEST_PRIORITY);
+        assertThat(contactElement.getBtUid()).isEqualTo(TEST_BT_UID);
+    }
+
+    @Test
+    public void encodeToXml_thenDecodeToInstance_returnsCorrectly() throws Exception {
+        BluetoothMapConvoContactElement contactElement = new
+                BluetoothMapConvoContactElement(TEST_UCI, TEST_NAME, TEST_DISPLAY_NAME,
+                TEST_PRESENCE_STATUS, TEST_PRESENCE_AVAILABILITY, TEST_LAST_ACTIVITY,
+                TEST_CHAT_STATE, TEST_PRIORITY, TEST_BT_UID);
+
+        final XmlSerializer serializer = new FastXmlSerializer();
+        final StringWriter writer = new StringWriter();
+
+        serializer.setOutput(writer);
+        serializer.startDocument("UTF-8", true);
+        contactElement.encode(serializer);
+        serializer.endDocument();
+
+        final XmlPullParserFactory parserFactory = XmlPullParserFactory.newInstance();
+        parserFactory.setNamespaceAware(true);
+        final XmlPullParser parser;
+        parser = parserFactory.newPullParser();
+
+        parser.setInput(new StringReader(writer.toString()));
+        parser.next();
+
+        BluetoothMapConvoContactElement contactElementFromXml =
+                BluetoothMapConvoContactElement.createFromXml(parser);
+
+        assertThat(contactElementFromXml.getContactId()).isEqualTo(TEST_UCI);
+        assertThat(contactElementFromXml.getName()).isEqualTo(TEST_NAME);
+        assertThat(contactElementFromXml.getDisplayName()).isEqualTo(TEST_DISPLAY_NAME);
+        assertThat(contactElementFromXml.getPresenceStatus()).isEqualTo(TEST_PRESENCE_STATUS);
+        assertThat(contactElementFromXml.getPresenceAvailability()).isEqualTo(
+                TEST_PRESENCE_AVAILABILITY);
+        assertThat(contactElementFromXml.getLastActivityString()).isEqualTo(
+                format.format(TEST_LAST_ACTIVITY));
+        assertThat(contactElementFromXml.getChatState()).isEqualTo(TEST_CHAT_STATE);
+        assertThat(contactElementFromXml.getPriority()).isEqualTo(TEST_PRIORITY);
+        assertThat(contactElementFromXml.getBtUid()).isEqualTo(TEST_BT_UID);
+    }
+
+    @Test
+    public void equalsWithSameValues_returnsTrue() {
+        BluetoothMapConvoContactElement contactElement =
+                new BluetoothMapConvoContactElement(TEST_UCI, TEST_NAME, TEST_DISPLAY_NAME,
+                TEST_PRESENCE_STATUS, TEST_PRESENCE_AVAILABILITY, TEST_LAST_ACTIVITY,
+                TEST_CHAT_STATE, TEST_PRIORITY, TEST_BT_UID);
+
+        BluetoothMapConvoContactElement contactElementEqual =
+                new BluetoothMapConvoContactElement(TEST_UCI, TEST_NAME, TEST_DISPLAY_NAME,
+                TEST_PRESENCE_STATUS, TEST_PRESENCE_AVAILABILITY, TEST_LAST_ACTIVITY,
+                TEST_CHAT_STATE, TEST_PRIORITY, TEST_BT_UID);
+
+        assertThat(contactElement).isEqualTo(contactElementEqual);
+    }
+
+    @Test
+    public void equalsWithDifferentPriority_returnsFalse() {
+        BluetoothMapConvoContactElement contactElement =
+                new BluetoothMapConvoContactElement(TEST_UCI, TEST_NAME, TEST_DISPLAY_NAME,
+                TEST_PRESENCE_STATUS, TEST_PRESENCE_AVAILABILITY, TEST_LAST_ACTIVITY,
+                TEST_CHAT_STATE, TEST_PRIORITY, TEST_BT_UID);
+
+        BluetoothMapConvoContactElement contactElementWithDifferentPriority =
+                new BluetoothMapConvoContactElement(TEST_UCI, TEST_NAME, TEST_DISPLAY_NAME,
+                TEST_PRESENCE_STATUS, TEST_PRESENCE_AVAILABILITY, TEST_LAST_ACTIVITY,
+                TEST_CHAT_STATE, /*priority=*/0, TEST_BT_UID);
+
+        assertThat(contactElement).isNotEqualTo(contactElementWithDifferentPriority);
+    }
+
+    @Test
+    public void compareTo_withSameValues_returnsZero() {
+        BluetoothMapConvoContactElement contactElement =
+                new BluetoothMapConvoContactElement(TEST_UCI, TEST_NAME, TEST_DISPLAY_NAME,
+                TEST_PRESENCE_STATUS, TEST_PRESENCE_AVAILABILITY, TEST_LAST_ACTIVITY,
+                TEST_CHAT_STATE, TEST_PRIORITY, TEST_BT_UID);
+
+        BluetoothMapConvoContactElement contactElementSameLastActivity =
+                new BluetoothMapConvoContactElement(TEST_UCI, TEST_NAME, TEST_DISPLAY_NAME,
+                TEST_PRESENCE_STATUS, TEST_PRESENCE_AVAILABILITY, TEST_LAST_ACTIVITY,
+                TEST_CHAT_STATE, TEST_PRIORITY, TEST_BT_UID);
+
+        assertThat(contactElement.compareTo(contactElementSameLastActivity)).isEqualTo(0);
+    }
+}
\ No newline at end of file
diff --git a/android/app/tests/unit/src/com/android/bluetooth/map/BluetoothMapConvoListingElementTest.java b/android/app/tests/unit/src/com/android/bluetooth/map/BluetoothMapConvoListingElementTest.java
new file mode 100644
index 0000000..84b0d7f
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/map/BluetoothMapConvoListingElementTest.java
@@ -0,0 +1,192 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.map;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import androidx.test.runner.AndroidJUnit4;
+
+import com.android.bluetooth.SignedLongLong;
+import com.android.bluetooth.map.BluetoothMapUtils.TYPE;
+import com.android.internal.util.FastXmlSerializer;
+
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.xmlpull.v1.XmlPullParser;
+import org.xmlpull.v1.XmlPullParserFactory;
+import org.xmlpull.v1.XmlSerializer;
+
+import java.io.StringReader;
+import java.io.StringWriter;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.List;
+
+@RunWith(AndroidJUnit4.class)
+public class BluetoothMapConvoListingElementTest {
+    private static final long TEST_ID = 1111;
+    private static final String TEST_NAME = "test_name";
+    private static final long TEST_LAST_ACTIVITY = 0;
+    private static final boolean TEST_READ = true;
+    private static final boolean TEST_REPORT_READ = true;
+    private static final long TEST_VERSION_COUNTER = 0;
+    private static final int TEST_CURSOR_INDEX = 1;
+    private static final TYPE TEST_TYPE = TYPE.EMAIL;
+    private static final String TEST_SUMMARY = "test_summary";
+    private static final String TEST_SMS_MMS_CONTACTS = "test_sms_mms_contacts";
+
+    private final BluetoothMapConvoContactElement TEST_CONTACT_ELEMENT_ONE =
+            new BluetoothMapConvoContactElement("test_uci_one", "test_name_one",
+                    "test_display_name_one", "test_presence_status_one", 2, TEST_LAST_ACTIVITY, 2,
+                    1, "1111");
+
+    private final BluetoothMapConvoContactElement TEST_CONTACT_ELEMENT_TWO =
+            new BluetoothMapConvoContactElement("test_uci_two", "test_name_two",
+                    "test_display_name_two", "test_presence_status_two", 1, TEST_LAST_ACTIVITY, 1,
+                    2, "1112");
+
+    private final List<BluetoothMapConvoContactElement> TEST_CONTACTS = new ArrayList<>(
+            Arrays.asList(TEST_CONTACT_ELEMENT_ONE, TEST_CONTACT_ELEMENT_TWO));
+
+    private final SignedLongLong signedLongLong = new SignedLongLong(TEST_ID, 0);
+
+    private BluetoothMapConvoListingElement mListingElement;
+
+    @Before
+    public void setUp() throws Exception {
+        mListingElement = new BluetoothMapConvoListingElement();
+
+        mListingElement.setCursorIndex(TEST_CURSOR_INDEX);
+        mListingElement.setVersionCounter(TEST_VERSION_COUNTER);
+        mListingElement.setName(TEST_NAME);
+        mListingElement.setType(TEST_TYPE);
+        mListingElement.setContacts(TEST_CONTACTS);
+        mListingElement.setLastActivity(TEST_LAST_ACTIVITY);
+        mListingElement.setRead(TEST_READ, TEST_REPORT_READ);
+        mListingElement.setConvoId(0, TEST_ID);
+        mListingElement.setSummary(TEST_SUMMARY);
+        mListingElement.setSmsMmsContacts(TEST_SMS_MMS_CONTACTS);
+    }
+
+    @Test
+    public void getters() throws Exception {
+        assertThat(mListingElement.getCursorIndex()).isEqualTo(TEST_CURSOR_INDEX);
+        assertThat(mListingElement.getVersionCounter()).isEqualTo(TEST_VERSION_COUNTER);
+        assertThat(mListingElement.getName()).isEqualTo(TEST_NAME);
+        assertThat(mListingElement.getType()).isEqualTo(TEST_TYPE);
+        assertThat(mListingElement.getContacts()).isEqualTo(TEST_CONTACTS);
+        assertThat(mListingElement.getLastActivity()).isEqualTo(TEST_LAST_ACTIVITY);
+        assertThat(mListingElement.getRead()).isEqualTo("READ");
+        assertThat(mListingElement.getReadBool()).isEqualTo(TEST_READ);
+        assertThat(mListingElement.getConvoId()).isEqualTo(signedLongLong.toHexString());
+        assertThat(mListingElement.getCpConvoId()).isEqualTo(
+                signedLongLong.getLeastSignificantBits());
+        assertThat(mListingElement.getFullSummary()).isEqualTo(TEST_SUMMARY);
+        assertThat(mListingElement.getSmsMmsContacts()).isEqualTo(TEST_SMS_MMS_CONTACTS);
+    }
+
+    @Test
+    public void incrementVersionCounter() {
+        mListingElement.incrementVersionCounter();
+        assertThat(mListingElement.getVersionCounter()).isEqualTo(TEST_VERSION_COUNTER + 1);
+    }
+
+    @Test
+    public void removeContactWithObject() {
+        mListingElement.removeContact(TEST_CONTACT_ELEMENT_TWO);
+        assertThat(mListingElement.getContacts().size()).isEqualTo(1);
+    }
+
+    @Test
+    public void removeContactWithIndex() {
+        mListingElement.removeContact(1);
+        assertThat(mListingElement.getContacts().size()).isEqualTo(1);
+    }
+
+    @Test
+    public void encodeToXml_thenDecodeToInstance_returnsCorrectly() throws Exception {
+        final XmlSerializer serializer = new FastXmlSerializer();
+        final StringWriter writer = new StringWriter();
+
+        serializer.setOutput(writer);
+        serializer.startDocument("UTF-8", true);
+        mListingElement.encode(serializer);
+        serializer.endDocument();
+
+        final XmlPullParserFactory parserFactory = XmlPullParserFactory.newInstance();
+        parserFactory.setNamespaceAware(true);
+        final XmlPullParser parser;
+        parser = parserFactory.newPullParser();
+
+        parser.setInput(new StringReader(writer.toString()));
+        parser.next();
+
+        BluetoothMapConvoListingElement listingElementFromXml =
+                BluetoothMapConvoListingElement.createFromXml(parser);
+
+        assertThat(listingElementFromXml.getVersionCounter()).isEqualTo(0);
+        assertThat(listingElementFromXml.getName()).isEqualTo(TEST_NAME);
+        assertThat(listingElementFromXml.getContacts()).isEqualTo(TEST_CONTACTS);
+        assertThat(listingElementFromXml.getLastActivity()).isEqualTo(TEST_LAST_ACTIVITY);
+        assertThat(listingElementFromXml.getRead()).isEqualTo("UNREAD");
+        assertThat(listingElementFromXml.getConvoId()).isEqualTo(signedLongLong.toHexString());
+        assertThat(listingElementFromXml.getFullSummary().trim()).isEqualTo(TEST_SUMMARY);
+    }
+
+    @Test
+    public void equalsWithSameValues_returnsTrue() {
+        BluetoothMapConvoListingElement listingElement = new BluetoothMapConvoListingElement();
+        listingElement.setName(TEST_NAME);
+        listingElement.setContacts(TEST_CONTACTS);
+        listingElement.setLastActivity(TEST_LAST_ACTIVITY);
+        listingElement.setRead(TEST_READ, TEST_REPORT_READ);
+
+        BluetoothMapConvoListingElement listingElementEqual = new BluetoothMapConvoListingElement();
+        listingElementEqual.setName(TEST_NAME);
+        listingElementEqual.setContacts(TEST_CONTACTS);
+        listingElementEqual.setLastActivity(TEST_LAST_ACTIVITY);
+        listingElementEqual.setRead(TEST_READ, TEST_REPORT_READ);
+
+        assertThat(listingElement).isEqualTo(listingElementEqual);
+    }
+
+    @Test
+    public void equalsWithDifferentRead_returnsFalse() {
+        BluetoothMapConvoListingElement
+                listingElement = new BluetoothMapConvoListingElement();
+
+        BluetoothMapConvoListingElement listingElementWithDifferentRead =
+                new BluetoothMapConvoListingElement();
+        listingElementWithDifferentRead.setRead(TEST_READ, TEST_REPORT_READ);
+
+        assertThat(listingElement).isNotEqualTo(listingElementWithDifferentRead);
+    }
+
+    @Test
+    public void compareToWithSameValues_returnsZero() {
+        BluetoothMapConvoListingElement
+                listingElement = new BluetoothMapConvoListingElement();
+        listingElement.setLastActivity(TEST_LAST_ACTIVITY);
+
+        BluetoothMapConvoListingElement listingElementSameLastActivity =
+                new BluetoothMapConvoListingElement();
+        listingElementSameLastActivity.setLastActivity(TEST_LAST_ACTIVITY);
+
+        assertThat(listingElement.compareTo(listingElementSameLastActivity)).isEqualTo(0);
+    }
+}
\ No newline at end of file
diff --git a/android/app/tests/unit/src/com/android/bluetooth/map/BluetoothMapConvoListingTest.java b/android/app/tests/unit/src/com/android/bluetooth/map/BluetoothMapConvoListingTest.java
new file mode 100644
index 0000000..432506b
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/map/BluetoothMapConvoListingTest.java
@@ -0,0 +1,179 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.map;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import androidx.test.runner.AndroidJUnit4;
+
+import com.android.bluetooth.SignedLongLong;
+
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+import java.io.ByteArrayInputStream;
+import java.io.InputStream;
+
+@RunWith(AndroidJUnit4.class)
+public class BluetoothMapConvoListingTest {
+    private static final long TEST_LAST_ACTIVITY_EARLIEST = 0;
+    private static final long TEST_LAST_ACTIVITY_MIDDLE = 1;
+    private static final long TEST_LAST_ACTIVITY_LATEST = 2;
+    private static final boolean TEST_READ = true;
+    private static final boolean TEST_REPORT_READ = true;
+
+    private BluetoothMapConvoListingElement mListingElementEarliestWithReadFalse;
+    private BluetoothMapConvoListingElement mListingElementMiddleWithReadFalse;
+    private BluetoothMapConvoListingElement mListingElementLatestWithReadTrue;
+    private BluetoothMapConvoListing mListing;
+
+    @Before
+    public void setUp() {
+        mListingElementEarliestWithReadFalse = new BluetoothMapConvoListingElement();
+        mListingElementEarliestWithReadFalse.setLastActivity(TEST_LAST_ACTIVITY_EARLIEST);
+
+        mListingElementMiddleWithReadFalse = new BluetoothMapConvoListingElement();
+        mListingElementMiddleWithReadFalse.setLastActivity(TEST_LAST_ACTIVITY_MIDDLE);
+
+        mListingElementLatestWithReadTrue = new BluetoothMapConvoListingElement();
+        mListingElementLatestWithReadTrue.setLastActivity(TEST_LAST_ACTIVITY_LATEST);
+        mListingElementLatestWithReadTrue.setRead(TEST_READ, TEST_REPORT_READ);
+
+        mListing = new BluetoothMapConvoListing();
+        mListing.add(mListingElementEarliestWithReadFalse);
+        mListing.add(mListingElementMiddleWithReadFalse);
+        mListing.add(mListingElementLatestWithReadTrue);
+    }
+
+    @Test
+    public void addElement() {
+        final BluetoothMapConvoListing listing = new BluetoothMapConvoListing();
+        assertThat(listing.getCount()).isEqualTo(0);
+        listing.add(mListingElementLatestWithReadTrue);
+        assertThat(listing.getCount()).isEqualTo(1);
+        assertThat(listing.hasUnread()).isEqualTo(true);
+    }
+
+    @Test
+    public void segment_whenCountIsLessThanOne_returnsOffsetToEnd() {
+        mListing.segment(0, 1);
+        assertThat(mListing.getList().size()).isEqualTo(2);
+    }
+
+    @Test
+    public void segment_whenOffsetIsBiggerThanSize_returnsEmptyList() {
+        mListing.segment(1, 4);
+        assertThat(mListing.getList().size()).isEqualTo(0);
+    }
+
+    @Test
+    public void segment_whenOffsetCountCombinationIsValid_returnsCorrectly() {
+        mListing.segment(1, 1);
+        assertThat(mListing.getList().size()).isEqualTo(1);
+    }
+
+    @Test
+    public void sort() {
+        // BluetoothMapConvoListingElements are sorted according to their mLastActivity values
+        mListing.sort();
+        assertThat(mListing.getList().get(0).getLastActivity()).isEqualTo(
+                TEST_LAST_ACTIVITY_LATEST);
+    }
+
+    @Test
+    public void equals_withSameObject_returnsTrue() {
+        assertThat(mListing.equals(mListing)).isEqualTo(true);
+    }
+
+    @Test
+    public void equals_withNull_returnsFalse() {
+        assertThat(mListing.equals(null)).isEqualTo(false);
+    }
+
+    @Test
+    public void equals_withDifferentClass_returnsFalse() {
+        assertThat(mListing.equals(mListingElementEarliestWithReadFalse)).isEqualTo(false);
+    }
+
+    @Test
+    public void equals_withDifferentRead_returnsFalse() {
+        final BluetoothMapConvoListing listingWithDifferentRead = new BluetoothMapConvoListing();
+        assertThat(mListing.equals(listingWithDifferentRead)).isEqualTo(false);
+    }
+
+    @Test
+    public void equals_whenNullComparedWithNonNullList_returnsFalse() {
+        final BluetoothMapConvoListing listingWithNullList = new BluetoothMapConvoListing();
+        final BluetoothMapConvoListing listingWithNonNullList = new BluetoothMapConvoListing();
+        listingWithNonNullList.add(mListingElementEarliestWithReadFalse);
+
+        assertThat(listingWithNullList.equals(listingWithNonNullList)).isEqualTo(false);
+    }
+
+    @Test
+    public void equals_whenNonNullListsAreDifferent_returnsFalse() {
+        final BluetoothMapConvoListing listingWithListSizeOne = new BluetoothMapConvoListing();
+        listingWithListSizeOne.add(mListingElementEarliestWithReadFalse);
+
+        final BluetoothMapConvoListing listingWithListSizeTwo = new BluetoothMapConvoListing();
+        listingWithListSizeTwo.add(mListingElementEarliestWithReadFalse);
+        listingWithListSizeTwo.add(mListingElementMiddleWithReadFalse);
+
+        assertThat(listingWithListSizeOne.equals(listingWithListSizeTwo)).isEqualTo(false);
+    }
+
+    @Test
+    public void equals_whenNonNullListsAreTheSame_returnsTrue() {
+        final BluetoothMapConvoListing listing = new BluetoothMapConvoListing();
+        final BluetoothMapConvoListing listingEqual = new BluetoothMapConvoListing();
+        listing.add(mListingElementEarliestWithReadFalse);
+        listingEqual.add(mListingElementEarliestWithReadFalse);
+        assertThat(listing.equals(listingEqual)).isEqualTo(true);
+    }
+
+    @Test
+    public void encodeToXml_thenAppendFromXml() throws Exception {
+        final BluetoothMapConvoListing listingToAppend = new BluetoothMapConvoListing();
+        final BluetoothMapConvoListingElement listingElementToAppendOne =
+                new BluetoothMapConvoListingElement();
+        final BluetoothMapConvoListingElement listingElementToAppendTwo =
+                new BluetoothMapConvoListingElement();
+
+        final long testIdOne = 1111;
+        final long testIdTwo = 1112;
+
+        final SignedLongLong signedLongLongIdOne = new SignedLongLong(testIdOne, 0);
+        final SignedLongLong signedLongLongIdTwo = new SignedLongLong(testIdTwo, 0);
+
+        listingElementToAppendOne.setConvoId(0, testIdOne);
+        listingElementToAppendTwo.setConvoId(0, testIdTwo);
+
+        listingToAppend.add(listingElementToAppendOne);
+        listingToAppend.add(listingElementToAppendTwo);
+
+        final InputStream listingStream = new ByteArrayInputStream(listingToAppend.encode());
+
+        BluetoothMapConvoListing listing = new BluetoothMapConvoListing();
+        listing.appendFromXml(listingStream);
+        assertThat(listing.getList().size()).isEqualTo(2);
+        assertThat(listing.getList().get(0).getConvoId()).isEqualTo(
+                signedLongLongIdOne.toHexString());
+        assertThat(listing.getList().get(1).getConvoId()).isEqualTo(
+                signedLongLongIdTwo.toHexString());
+    }
+}
\ No newline at end of file
diff --git a/android/app/tests/unit/src/com/android/bluetooth/map/BluetoothMapFolderElementTest.java b/android/app/tests/unit/src/com/android/bluetooth/map/BluetoothMapFolderElementTest.java
new file mode 100644
index 0000000..d6f7ff9
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/map/BluetoothMapFolderElementTest.java
@@ -0,0 +1,184 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.map;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import androidx.test.runner.AndroidJUnit4;
+
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+@RunWith(AndroidJUnit4.class)
+public class BluetoothMapFolderElementTest {
+    private static final boolean TEST_HAS_SMS_MMS_CONTENT = true;
+    private static final boolean TEST_HAS_IM_CONTENT = true;
+    private static final boolean TEST_HAS_EMAIL_CONTENT = true;
+    private static final boolean TEST_IGNORE = true;
+
+    private static final String TEST_SMS_MMS_FOLDER_NAME = "smsmms";
+    private static final String TEST_IM_FOLDER_NAME = "im";
+    private static final String TEST_EMAIL_FOLDER_NAME = "email";
+    private static final String TEST_TELECOM_FOLDER_NAME = "telecom";
+    private static final String TEST_MSG_FOLDER_NAME = "msg";
+    private static final String TEST_PLACEHOLDER_FOLDER_NAME = "placeholder";
+
+    private static final long TEST_ROOT_FOLDER_ID = 1;
+    private static final long TEST_PARENT_FOLDER_ID = 2;
+    private static final long TEST_FOLDER_ID = 3;
+    private static final long TEST_IM_FOLDER_ID = 4;
+    private static final long TEST_EMAIL_FOLDER_ID = 5;
+    private static final long TEST_PLACEHOLDER_ID = 6;
+
+    private static final String TEST_FOLDER_NAME = "test";
+    private static final String TEST_PARENT_FOLDER_NAME = "parent";
+    private static final String TEST_ROOT_FOLDER_NAME = "root";
+
+    private final BluetoothMapFolderElement mRootFolderElement =
+            new BluetoothMapFolderElement(TEST_ROOT_FOLDER_NAME, null);
+
+    private BluetoothMapFolderElement mParentFolderElement;
+    private BluetoothMapFolderElement mTestFolderElement;
+
+
+    @Before
+    public void setUp() throws Exception {
+        mRootFolderElement.setFolderId(TEST_ROOT_FOLDER_ID);
+        mRootFolderElement.addFolder(TEST_PARENT_FOLDER_NAME);
+
+        mParentFolderElement = mRootFolderElement.getSubFolder(TEST_PARENT_FOLDER_NAME);
+        mParentFolderElement.setFolderId(TEST_PARENT_FOLDER_ID);
+        mParentFolderElement.addFolder(TEST_FOLDER_NAME);
+
+        mTestFolderElement = mParentFolderElement.getSubFolder(TEST_FOLDER_NAME);
+        mTestFolderElement.setFolderId(TEST_FOLDER_ID);
+        mTestFolderElement.setIgnore(TEST_IGNORE);
+        mTestFolderElement.setHasSmsMmsContent(TEST_HAS_SMS_MMS_CONTENT);
+        mTestFolderElement.setHasEmailContent(TEST_HAS_EMAIL_CONTENT);
+        mTestFolderElement.setHasImContent(TEST_HAS_IM_CONTENT);
+    }
+
+
+    @Test
+    public void getters() {
+        assertThat(mTestFolderElement.shouldIgnore()).isEqualTo(TEST_IGNORE);
+        assertThat(mTestFolderElement.getFolderId()).isEqualTo(TEST_FOLDER_ID);
+        assertThat(mTestFolderElement.hasSmsMmsContent()).isEqualTo(TEST_HAS_SMS_MMS_CONTENT);
+        assertThat(mTestFolderElement.hasEmailContent()).isEqualTo(TEST_HAS_EMAIL_CONTENT);
+        assertThat(mTestFolderElement.hasImContent()).isEqualTo(TEST_HAS_IM_CONTENT);
+    }
+
+    @Test
+    public void getFullPath() {
+        assertThat(mTestFolderElement.getFullPath()).isEqualTo(
+                String.format("%s/%s", TEST_PARENT_FOLDER_NAME, TEST_FOLDER_NAME));
+    }
+
+    @Test
+    public void getRoot() {
+        assertThat(mTestFolderElement.getRoot()).isEqualTo(mRootFolderElement);
+    }
+
+    @Test
+    public void addFolders() {
+        mTestFolderElement.addSmsMmsFolder(TEST_SMS_MMS_FOLDER_NAME);
+        mTestFolderElement.addImFolder(TEST_IM_FOLDER_NAME, TEST_IM_FOLDER_ID);
+        mTestFolderElement.addEmailFolder(TEST_EMAIL_FOLDER_NAME, TEST_EMAIL_FOLDER_ID);
+
+        assertThat(mTestFolderElement.getSubFolder(TEST_SMS_MMS_FOLDER_NAME).getName()).isEqualTo(
+                TEST_SMS_MMS_FOLDER_NAME);
+        assertThat(mTestFolderElement.getSubFolder(TEST_IM_FOLDER_NAME).getName()).isEqualTo(
+                TEST_IM_FOLDER_NAME);
+        assertThat(mTestFolderElement.getSubFolder(TEST_EMAIL_FOLDER_NAME).getName()).isEqualTo(
+                TEST_EMAIL_FOLDER_NAME);
+
+        mTestFolderElement.addFolder(TEST_SMS_MMS_FOLDER_NAME);
+        assertThat(mTestFolderElement.getSubFolderCount()).isEqualTo(3);
+    }
+
+    @Test
+    public void getFolderById() {
+        assertThat(mTestFolderElement.getFolderById(TEST_FOLDER_ID)).isEqualTo(mTestFolderElement);
+        assertThat(mRootFolderElement.getFolderById(TEST_ROOT_FOLDER_ID)).isEqualTo(
+                mRootFolderElement);
+        assertThat(BluetoothMapFolderElement.getFolderById(TEST_FOLDER_ID, null)).isNull();
+        assertThat(BluetoothMapFolderElement.getFolderById(TEST_PLACEHOLDER_ID,
+                mTestFolderElement)).isNull();
+    }
+
+    @Test
+    public void getFolderByName() {
+        mRootFolderElement.addFolder(TEST_TELECOM_FOLDER_NAME);
+        mRootFolderElement.getSubFolder(TEST_TELECOM_FOLDER_NAME).addFolder(TEST_MSG_FOLDER_NAME);
+        BluetoothMapFolderElement placeholderFolderElement = mRootFolderElement.getSubFolder(
+                TEST_TELECOM_FOLDER_NAME).getSubFolder(TEST_MSG_FOLDER_NAME).addFolder(
+                TEST_PLACEHOLDER_FOLDER_NAME);
+        assertThat(mRootFolderElement.getFolderByName(TEST_PLACEHOLDER_FOLDER_NAME)).isNull();
+        placeholderFolderElement.setFolderId(TEST_PLACEHOLDER_ID);
+        assertThat(mRootFolderElement.getFolderByName(TEST_PLACEHOLDER_FOLDER_NAME)).isEqualTo(
+                placeholderFolderElement);
+    }
+
+    @Test
+    public void compareTo_withNull_returnsOne() {
+        assertThat(mTestFolderElement.compareTo(null)).isEqualTo(1);
+    }
+
+    @Test
+    public void compareTo_withDifferentName_returnsCharacterDifference() {
+        assertThat(mTestFolderElement.compareTo(mParentFolderElement)).isEqualTo(4);
+    }
+
+    @Test
+    public void compareTo_withSameSubFolders_returnsZero() {
+        BluetoothMapFolderElement folderElementWithSameSubFolders =
+                new BluetoothMapFolderElement(TEST_FOLDER_NAME, mParentFolderElement);
+
+        mTestFolderElement.addSmsMmsFolder(TEST_SMS_MMS_FOLDER_NAME);
+        folderElementWithSameSubFolders.addSmsMmsFolder(TEST_SMS_MMS_FOLDER_NAME);
+        assertThat(mTestFolderElement.compareTo(folderElementWithSameSubFolders)).isEqualTo(0);
+    }
+
+    @Test
+    public void compareTo_withDifferentSubFoldersSize_returnsSizeDifference() {
+        BluetoothMapFolderElement folderElementWithDifferentSubFoldersSize =
+                new BluetoothMapFolderElement(TEST_FOLDER_NAME, mParentFolderElement);
+
+        mTestFolderElement.addSmsMmsFolder(TEST_SMS_MMS_FOLDER_NAME);
+        folderElementWithDifferentSubFoldersSize.addSmsMmsFolder(TEST_SMS_MMS_FOLDER_NAME);
+        folderElementWithDifferentSubFoldersSize.addImFolder(TEST_IM_FOLDER_NAME,
+                TEST_IM_FOLDER_ID);
+        assertThat(
+                mTestFolderElement.compareTo(folderElementWithDifferentSubFoldersSize)).isEqualTo(
+                -1);
+    }
+
+    @Test
+    public void compareTo_withDifferentSubFolderTree_returnsCompareToRecursively() {
+        BluetoothMapFolderElement folderElementWithDifferentSubFoldersTree =
+                new BluetoothMapFolderElement(TEST_FOLDER_NAME, mParentFolderElement);
+
+        mTestFolderElement.addSmsMmsFolder(TEST_SMS_MMS_FOLDER_NAME);
+        folderElementWithDifferentSubFoldersTree.addSmsMmsFolder(TEST_SMS_MMS_FOLDER_NAME);
+        folderElementWithDifferentSubFoldersTree.getSubFolder(TEST_SMS_MMS_FOLDER_NAME).addFolder(
+                TEST_PLACEHOLDER_FOLDER_NAME);
+        assertThat(
+                mTestFolderElement.compareTo(folderElementWithDifferentSubFoldersTree)).isEqualTo(
+                -1);
+    }
+}
diff --git a/android/app/tests/unit/src/com/android/bluetooth/map/BluetoothMapMasInstanceTest.java b/android/app/tests/unit/src/com/android/bluetooth/map/BluetoothMapMasInstanceTest.java
new file mode 100644
index 0000000..621c991
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/map/BluetoothMapMasInstanceTest.java
@@ -0,0 +1,80 @@
+/*
+ * Copyright 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.map;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import android.content.Context;
+import android.graphics.drawable.ColorDrawable;
+import android.graphics.drawable.Drawable;
+
+import androidx.test.filters.SmallTest;
+import androidx.test.runner.AndroidJUnit4;
+
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.Mock;
+import org.mockito.MockitoAnnotations;
+
+@SmallTest
+@RunWith(AndroidJUnit4.class)
+public class BluetoothMapMasInstanceTest {
+    private static final int TEST_MAS_ID = 1;
+    private static final boolean TEST_ENABLE_SMS_MMS = true;
+    private static final String TEST_NAME = "test_name";
+    private static final String TEST_PACKAGE_NAME = "test.package.name";
+    private static final String TEST_ID = "1111";
+    private static final String TEST_PROVIDER_AUTHORITY = "test.project.provider";
+    private static final Drawable TEST_DRAWABLE = new ColorDrawable();
+    private static final BluetoothMapUtils.TYPE TEST_TYPE = BluetoothMapUtils.TYPE.EMAIL;
+    private static final String TEST_UCI = "uci";
+    private static final String TEST_UCI_PREFIX = "uci_prefix";
+
+    private BluetoothMapAccountItem mAccountItem;
+
+    @Mock
+    private Context mContext;
+    @Mock
+    private BluetoothMapService mMapService;
+
+    @Before
+    public void setUp() {
+        MockitoAnnotations.initMocks(this);
+
+        mAccountItem = BluetoothMapAccountItem.create(TEST_ID, TEST_NAME, TEST_PACKAGE_NAME,
+                TEST_PROVIDER_AUTHORITY, TEST_DRAWABLE, TEST_TYPE, TEST_UCI, TEST_UCI_PREFIX);
+    }
+
+    @Test
+    public void constructor_withNoParameters() {
+        BluetoothMapMasInstance instance = new BluetoothMapMasInstance();
+
+        assertThat(instance.mTag).isEqualTo(
+                "BluetoothMapMasInstance" + (BluetoothMapMasInstance.sInstanceCounter - 1));
+    }
+
+    @Test
+    public void toString_returnsInfo() {
+        BluetoothMapMasInstance instance = new BluetoothMapMasInstance(mMapService, mContext,
+                mAccountItem, TEST_MAS_ID, TEST_ENABLE_SMS_MMS);
+
+        String expected = "MasId: " + TEST_MAS_ID + " Uri:" + mAccountItem.mBase_uri + " SMS/MMS:"
+                + TEST_ENABLE_SMS_MMS;
+        assertThat(instance.toString()).isEqualTo(expected);
+    }
+}
diff --git a/android/app/tests/unit/src/com/android/bluetooth/map/BluetoothMapMessageListingElementTest.java b/android/app/tests/unit/src/com/android/bluetooth/map/BluetoothMapMessageListingElementTest.java
new file mode 100644
index 0000000..a918f32
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/map/BluetoothMapMessageListingElementTest.java
@@ -0,0 +1,231 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.map;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import androidx.test.runner.AndroidJUnit4;
+
+import com.android.bluetooth.map.BluetoothMapUtils.TYPE;
+import com.android.internal.util.FastXmlSerializer;
+
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.xmlpull.v1.XmlPullParser;
+import org.xmlpull.v1.XmlPullParserFactory;
+import org.xmlpull.v1.XmlSerializer;
+
+import java.io.StringReader;
+import java.io.StringWriter;
+import java.text.SimpleDateFormat;
+
+@RunWith(AndroidJUnit4.class)
+public class BluetoothMapMessageListingElementTest {
+    private static final long TEST_CP_HANDLE = 1;
+    private static final String TEST_SUBJECT = "test_subject";
+    private static final long TEST_DATE_TIME = 2;
+    private static final String TEST_SENDER_NAME = "test_sender_name";
+    private static final String TEST_SENDER_ADDRESSING = "test_sender_addressing";
+    private static final String TEST_REPLY_TO_ADDRESSING = "test_reply_to_addressing";
+    private static final String TEST_RECIPIENT_NAME = "test_recipient_name";
+    private static final String TEST_RECIPIENT_ADDRESSING = "test_recipient_addressing";
+    private static final TYPE TEST_TYPE = TYPE.EMAIL;
+    private static final boolean TEST_MSG_TYPE_APP_PARAM_SET = true;
+    private static final int TEST_SIZE = 0;
+    private static final String TEST_TEXT = "test_text";
+    private static final String TEST_RECEPTION_STATUS = "test_reception_status";
+    private static final String TEST_DELIVERY_STATUS = "test_delivery_status";
+    private static final int TEST_ATTACHMENT_SIZE = 0;
+    private static final String TEST_PRIORITY = "test_priority";
+    private static final boolean TEST_READ = true;
+    private static final String TEST_SENT = "test_sent";
+    private static final String TEST_PROTECT = "test_protect";
+    private static final String TEST_FOLDER_TYPE = "test_folder_type";
+    private static final long TEST_THREAD_ID = 1;
+    private static final String TEST_THREAD_NAME = "test_thread_name";
+    private static final String TEST_ATTACHMENT_MIME_TYPES = "test_attachment_mime_types";
+    private static final boolean TEST_REPORT_READ = true;
+    private static final int TEST_CURSOR_INDEX = 1;
+
+    private final SimpleDateFormat format = new SimpleDateFormat("yyyyMMdd'T'HHmmss");
+
+    private BluetoothMapMessageListingElement mMessageListingElement;
+
+    @Before
+    public void setUp() throws Exception {
+        mMessageListingElement = new BluetoothMapMessageListingElement();
+
+        mMessageListingElement.setHandle(TEST_CP_HANDLE);
+        mMessageListingElement.setSubject(TEST_SUBJECT);
+        mMessageListingElement.setDateTime(TEST_DATE_TIME);
+        mMessageListingElement.setSenderName(TEST_SENDER_NAME);
+        mMessageListingElement.setSenderAddressing(TEST_SENDER_ADDRESSING);
+        mMessageListingElement.setReplytoAddressing(TEST_REPLY_TO_ADDRESSING);
+        mMessageListingElement.setRecipientName(TEST_RECIPIENT_NAME);
+        mMessageListingElement.setRecipientAddressing(TEST_RECIPIENT_ADDRESSING);
+        mMessageListingElement.setType(TEST_TYPE, TEST_MSG_TYPE_APP_PARAM_SET);
+        mMessageListingElement.setSize(TEST_SIZE);
+        mMessageListingElement.setText(TEST_TEXT);
+        mMessageListingElement.setReceptionStatus(TEST_RECEPTION_STATUS);
+        mMessageListingElement.setDeliveryStatus(TEST_DELIVERY_STATUS);
+        mMessageListingElement.setAttachmentSize(TEST_ATTACHMENT_SIZE);
+        mMessageListingElement.setPriority(TEST_PRIORITY);
+        mMessageListingElement.setRead(TEST_READ, TEST_REPORT_READ);
+        mMessageListingElement.setSent(TEST_SENT);
+        mMessageListingElement.setProtect(TEST_PROTECT);
+        mMessageListingElement.setFolderType(TEST_FOLDER_TYPE);
+        mMessageListingElement.setThreadId(TEST_THREAD_ID, TEST_TYPE);
+        mMessageListingElement.setThreadName(TEST_THREAD_NAME);
+        mMessageListingElement.setAttachmentMimeTypes(TEST_ATTACHMENT_MIME_TYPES);
+        mMessageListingElement.setCursorIndex(TEST_CURSOR_INDEX);
+    }
+
+    @Test
+    public void getters() {
+        assertThat(mMessageListingElement.getHandle()).isEqualTo(TEST_CP_HANDLE);
+        assertThat(mMessageListingElement.getSubject()).isEqualTo(TEST_SUBJECT);
+        assertThat(mMessageListingElement.getDateTime()).isEqualTo(TEST_DATE_TIME);
+        assertThat(mMessageListingElement.getDateTimeString()).isEqualTo(
+                format.format(TEST_DATE_TIME));
+        assertThat(mMessageListingElement.getSenderName()).isEqualTo(TEST_SENDER_NAME);
+        assertThat(mMessageListingElement.getSenderAddressing()).isEqualTo(TEST_SENDER_ADDRESSING);
+        assertThat(mMessageListingElement.getReplyToAddressing()).isEqualTo(
+                TEST_REPLY_TO_ADDRESSING);
+        assertThat(mMessageListingElement.getRecipientName()).isEqualTo(TEST_RECIPIENT_NAME);
+        assertThat(mMessageListingElement.getRecipientAddressing()).isEqualTo(
+                TEST_RECIPIENT_ADDRESSING);
+        assertThat(mMessageListingElement.getType()).isEqualTo(TEST_TYPE);
+        assertThat(mMessageListingElement.getSize()).isEqualTo(TEST_SIZE);
+        assertThat(mMessageListingElement.getText()).isEqualTo(TEST_TEXT);
+        assertThat(mMessageListingElement.getReceptionStatus()).isEqualTo(TEST_RECEPTION_STATUS);
+        assertThat(mMessageListingElement.getDeliveryStatus()).isEqualTo(TEST_DELIVERY_STATUS);
+        assertThat(mMessageListingElement.getAttachmentSize()).isEqualTo(TEST_ATTACHMENT_SIZE);
+        assertThat(mMessageListingElement.getPriority()).isEqualTo(TEST_PRIORITY);
+        assertThat(mMessageListingElement.getRead()).isEqualTo("yes");
+        assertThat(mMessageListingElement.getReadBool()).isEqualTo(TEST_READ);
+        assertThat(mMessageListingElement.getSent()).isEqualTo(TEST_SENT);
+        assertThat(mMessageListingElement.getProtect()).isEqualTo(TEST_PROTECT);
+        assertThat(mMessageListingElement.getFolderType()).isEqualTo(TEST_FOLDER_TYPE);
+        assertThat(mMessageListingElement.getThreadName()).isEqualTo(TEST_THREAD_NAME);
+        assertThat(mMessageListingElement.getAttachmentMimeTypes()).isEqualTo(
+                TEST_ATTACHMENT_MIME_TYPES);
+        assertThat(mMessageListingElement.getCursorIndex()).isEqualTo(TEST_CURSOR_INDEX);
+    }
+
+    @Test
+    public void encode() throws Exception {
+        mMessageListingElement.setSubject(null);
+
+        final XmlSerializer serializer = new FastXmlSerializer();
+        final StringWriter writer = new StringWriter();
+
+        serializer.setOutput(writer);
+        serializer.startDocument("UTF-8", true);
+        mMessageListingElement.encode(serializer, true);
+        serializer.endDocument();
+
+        final XmlPullParserFactory parserFactory = XmlPullParserFactory.newInstance();
+        parserFactory.setNamespaceAware(true);
+        final XmlPullParser parser;
+        parser = parserFactory.newPullParser();
+
+        parser.setInput(new StringReader(writer.toString()));
+        parser.next();
+
+        int count = parser.getAttributeCount();
+        assertThat(count).isEqualTo(21);
+
+        for (int i = 0; i < count; i++) {
+            String attributeName = parser.getAttributeName(i).trim();
+            String attributeValue = parser.getAttributeValue(i);
+            if (attributeName.equalsIgnoreCase("handle")) {
+                assertThat(attributeValue).isEqualTo(
+                        BluetoothMapUtils.getMapHandle(TEST_CP_HANDLE, TEST_TYPE));
+            } else if (attributeName.equalsIgnoreCase("datetime")) {
+                assertThat(attributeValue).isEqualTo(
+                        BluetoothMapUtils.getDateTimeString(TEST_DATE_TIME));
+            } else if (attributeName.equalsIgnoreCase("sender_name")) {
+                assertThat(attributeValue).isEqualTo(
+                        BluetoothMapUtils.stripInvalidChars(TEST_SENDER_NAME));
+            } else if (attributeName.equalsIgnoreCase("sender_addressing")) {
+                assertThat(attributeValue).isEqualTo(TEST_SENDER_ADDRESSING);
+            } else if (attributeName.equalsIgnoreCase("replyto_addressing")) {
+                assertThat(attributeValue).isEqualTo(TEST_REPLY_TO_ADDRESSING);
+            } else if (attributeName.equalsIgnoreCase("recipient_name")) {
+                assertThat(attributeValue).isEqualTo(TEST_RECIPIENT_NAME);
+            } else if (attributeName.equalsIgnoreCase("recipient_addressing")) {
+                assertThat(attributeValue).isEqualTo(TEST_RECIPIENT_ADDRESSING);
+            } else if (attributeName.equalsIgnoreCase("type")) {
+                assertThat(attributeValue).isEqualTo(TEST_TYPE.name());
+            } else if (attributeName.equalsIgnoreCase("size")) {
+                assertThat(attributeValue).isEqualTo(Integer.toString(TEST_SIZE));
+            } else if (attributeName.equalsIgnoreCase("text")) {
+                assertThat(attributeValue).isEqualTo(TEST_TEXT);
+            } else if (attributeName.equalsIgnoreCase("reception_status")) {
+                assertThat(attributeValue).isEqualTo(TEST_RECEPTION_STATUS);
+            } else if (attributeName.equalsIgnoreCase("delivery_status")) {
+                assertThat(attributeValue).isEqualTo(TEST_DELIVERY_STATUS);
+            } else if (attributeName.equalsIgnoreCase("attachment_size")) {
+                assertThat(attributeValue).isEqualTo(Integer.toString(TEST_ATTACHMENT_SIZE));
+            } else if (attributeName.equalsIgnoreCase("attachment_mime_types")) {
+                assertThat(attributeValue).isEqualTo(TEST_ATTACHMENT_MIME_TYPES);
+            } else if (attributeName.equalsIgnoreCase("priority")) {
+                assertThat(attributeValue).isEqualTo(TEST_PRIORITY);
+            } else if (attributeName.equalsIgnoreCase("read")) {
+                assertThat(attributeValue).isEqualTo(mMessageListingElement.getRead());
+            } else if (attributeName.equalsIgnoreCase("sent")) {
+                assertThat(attributeValue).isEqualTo(TEST_SENT);
+            } else if (attributeName.equalsIgnoreCase("protected")) {
+                assertThat(attributeValue).isEqualTo(TEST_PROTECT);
+            } else if (attributeName.equalsIgnoreCase("conversation_id")) {
+                assertThat(attributeValue).isEqualTo(
+                        BluetoothMapUtils.getMapConvoHandle(TEST_THREAD_ID, TEST_TYPE));
+            } else if (attributeName.equalsIgnoreCase("conversation_name")) {
+                assertThat(attributeValue).isEqualTo(TEST_THREAD_NAME);
+            } else if (attributeName.equalsIgnoreCase("folder_type")) {
+                assertThat(attributeValue).isEqualTo(TEST_FOLDER_TYPE);
+            } else {
+                throw new Exception("Test fails with unknown XML attribute");
+            }
+        }
+    }
+
+    @Test
+    public void compareTo_withLaterDateTime_ReturnsOne() {
+        BluetoothMapMessageListingElement elementWithLaterDateTime =
+                new BluetoothMapMessageListingElement();
+        elementWithLaterDateTime.setDateTime(TEST_DATE_TIME + 1);
+        assertThat(mMessageListingElement.compareTo(elementWithLaterDateTime)).isEqualTo(1);
+    }
+
+    @Test
+    public void compareTo_withFasterDateTime_ReturnsNegativeOne() {
+        BluetoothMapMessageListingElement elementWithFasterDateTime =
+                new BluetoothMapMessageListingElement();
+        elementWithFasterDateTime.setDateTime(TEST_DATE_TIME - 1);
+        assertThat(mMessageListingElement.compareTo(elementWithFasterDateTime)).isEqualTo(-1);
+    }
+
+    @Test
+    public void compareTo_withEqualDateTime_ReturnsZero() {
+        BluetoothMapMessageListingElement elementWithEqualDateTime =
+                new BluetoothMapMessageListingElement();
+        elementWithEqualDateTime.setDateTime(TEST_DATE_TIME);
+        assertThat(mMessageListingElement.compareTo(elementWithEqualDateTime)).isEqualTo(0);
+    }
+}
\ No newline at end of file
diff --git a/android/app/tests/unit/src/com/android/bluetooth/map/BluetoothMapMessageListingTest.java b/android/app/tests/unit/src/com/android/bluetooth/map/BluetoothMapMessageListingTest.java
new file mode 100644
index 0000000..51fdb48
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/map/BluetoothMapMessageListingTest.java
@@ -0,0 +1,200 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.map;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import android.util.Xml;
+
+import androidx.test.runner.AndroidJUnit4;
+
+import com.android.bluetooth.Utils;
+
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.xmlpull.v1.XmlPullParser;
+import org.xmlpull.v1.XmlPullParserException;
+
+import java.io.ByteArrayInputStream;
+import java.io.IOException;
+import java.io.InputStream;
+import java.text.SimpleDateFormat;
+import java.time.LocalDateTime;
+import java.time.ZoneOffset;
+import java.time.format.DateTimeFormatter;
+
+@RunWith(AndroidJUnit4.class)
+public class BluetoothMapMessageListingTest {
+    private static final long TEST_DATE_TIME_EARLIEST = 0;
+    private static final long TEST_DATE_TIME_MIDDLE = 1;
+    private static final long TEST_DATE_TIME_LATEST = 2;
+    private static final boolean TEST_READ = true;
+    private static final boolean TEST_REPORT_READ = true;
+    private static final String TEST_VERSION = "test_version";
+
+    private final SimpleDateFormat format = new SimpleDateFormat("yyyyMMdd'T'HHmmss");
+    private final DateTimeFormatter formatter = DateTimeFormatter.ofPattern("yyyyMMdd'T'HHmmss");
+
+    private BluetoothMapMessageListingElement mListingElementEarliestWithReadFalse;
+    private BluetoothMapMessageListingElement mListingElementMiddleWithReadFalse;
+    private BluetoothMapMessageListingElement mListingElementLatestWithReadTrue;
+
+    private BluetoothMapMessageListing mListing;
+
+    @Before
+    public void setUp() {
+        mListingElementEarliestWithReadFalse = new BluetoothMapMessageListingElement();
+        mListingElementEarliestWithReadFalse.setDateTime(TEST_DATE_TIME_EARLIEST);
+
+        mListingElementMiddleWithReadFalse = new BluetoothMapMessageListingElement();
+        mListingElementMiddleWithReadFalse.setDateTime(TEST_DATE_TIME_MIDDLE);
+
+        mListingElementLatestWithReadTrue = new BluetoothMapMessageListingElement();
+        mListingElementLatestWithReadTrue.setDateTime(TEST_DATE_TIME_LATEST);
+        mListingElementLatestWithReadTrue.setRead(TEST_READ, TEST_REPORT_READ);
+
+        mListing = new BluetoothMapMessageListing();
+        mListing.add(mListingElementEarliestWithReadFalse);
+        mListing.add(mListingElementMiddleWithReadFalse);
+        mListing.add(mListingElementLatestWithReadTrue);
+    }
+
+    @Test
+    public void addElement() {
+        final BluetoothMapMessageListing listing = new BluetoothMapMessageListing();
+        assertThat(listing.getCount()).isEqualTo(0);
+        listing.add(mListingElementEarliestWithReadFalse);
+        assertThat(listing.getCount()).isEqualTo(1);
+        assertThat(listing.hasUnread()).isEqualTo(true);
+    }
+
+    @Test
+    public void segment_whenCountIsLessThanOne_returnsOffsetToEnd() {
+        mListing.segment(0, 1);
+        assertThat(mListing.getList().size()).isEqualTo(2);
+    }
+
+    @Test
+    public void segment_whenOffsetIsBiggerThanSize_returnsEmptyList() {
+        mListing.segment(1, 4);
+        assertThat(mListing.getList().size()).isEqualTo(0);
+    }
+
+    @Test
+    public void segment_whenOffsetCountCombinationIsValid_returnsCorrectly() {
+        mListing.segment(1, 1);
+        assertThat(mListing.getList().size()).isEqualTo(1);
+    }
+
+    @Test
+    public void sort() {
+        // BluetoothMapMessageListingElements are sorted according to their mDateTime values
+        mListing.sort();
+        assertThat(mListing.getList().get(0).getDateTime()).isEqualTo(TEST_DATE_TIME_LATEST);
+        assertThat(mListing.getList().get(1).getDateTime()).isEqualTo(TEST_DATE_TIME_MIDDLE);
+        assertThat(mListing.getList().get(2).getDateTime()).isEqualTo(TEST_DATE_TIME_EARLIEST);
+    }
+
+    @Test
+    public void encodeToXml_thenAppendFromXml() throws Exception {
+        final BluetoothMapMessageListing listingToAppend = new BluetoothMapMessageListing();
+        final BluetoothMapMessageListingElement listingElementToAppendOne =
+                new BluetoothMapMessageListingElement();
+        final BluetoothMapMessageListingElement listingElementToAppendTwo =
+                new BluetoothMapMessageListingElement();
+
+        listingElementToAppendOne.setDateTime(TEST_DATE_TIME_EARLIEST);
+        listingElementToAppendTwo.setRead(TEST_READ, TEST_REPORT_READ);
+
+        listingToAppend.add(listingElementToAppendOne);
+        listingToAppend.add(listingElementToAppendTwo);
+
+        assertThat(listingToAppend.getList().size()).isEqualTo(2);
+
+        final InputStream listingStream = new ByteArrayInputStream(
+                listingToAppend.encode(false, TEST_VERSION));
+
+        BluetoothMapMessageListing listing = new BluetoothMapMessageListing();
+        appendFromXml(listingStream, listing);
+        assertThat(listing.getList().size()).isEqualTo(2);
+        assertThat(listing.getList().get(0).getDateTime()).isEqualTo(TEST_DATE_TIME_EARLIEST);
+        assertThat(listing.getList().get(1).getReadBool()).isTrue();
+    }
+
+    /**
+     * Decodes the encoded xml document then append the BluetoothMapMessageListingElements to the
+     * given BluetoothMapMessageListing object.
+     */
+    private void appendFromXml(InputStream xmlDocument, BluetoothMapMessageListing newListing)
+            throws XmlPullParserException, IOException {
+        try {
+            XmlPullParser parser = Xml.newPullParser();
+            int type;
+            parser.setInput(xmlDocument, "UTF-8");
+
+            while ((type = parser.next()) != XmlPullParser.END_TAG
+                    && type != XmlPullParser.END_DOCUMENT) {
+                if (parser.getEventType() != XmlPullParser.START_TAG) {
+                    continue;
+                }
+                String name = parser.getName();
+                if (!name.equalsIgnoreCase("MAP-msg-listing")) {
+                    Utils.skipCurrentTag(parser);
+                }
+                readMessageElements(parser, newListing);
+            }
+        } finally {
+            xmlDocument.close();
+        }
+    }
+
+    private void readMessageElements(XmlPullParser parser, BluetoothMapMessageListing newListing)
+            throws XmlPullParserException, IOException {
+        int type;
+        while ((type = parser.next()) != XmlPullParser.END_TAG
+                && type != XmlPullParser.END_DOCUMENT) {
+            if (parser.getEventType() != XmlPullParser.START_TAG) {
+                continue;
+            }
+            String name = parser.getName();
+            if (!name.trim().equalsIgnoreCase("msg")) {
+                Utils.skipCurrentTag(parser);
+                continue;
+            }
+            newListing.add(createFromXml(parser));
+        }
+    }
+
+    private BluetoothMapMessageListingElement createFromXml(XmlPullParser parser)
+            throws XmlPullParserException, IOException {
+        BluetoothMapMessageListingElement newElement = new BluetoothMapMessageListingElement();
+        int count = parser.getAttributeCount();
+        for (int i = 0; i < count; i++) {
+            String attributeName = parser.getAttributeName(i).trim();
+            String attributeValue = parser.getAttributeValue(i);
+            if (attributeName.equalsIgnoreCase("datetime")) {
+                newElement.setDateTime(LocalDateTime.parse(attributeValue, formatter).toInstant(
+                        ZoneOffset.ofTotalSeconds(0)).toEpochMilli());
+            } else if (attributeName.equalsIgnoreCase("read")) {
+                newElement.setRead(true, true);
+            }
+        }
+        parser.nextTag();
+        return newElement;
+    }
+}
\ No newline at end of file
diff --git a/android/app/tests/unit/src/com/android/bluetooth/map/BluetoothMapObexServerTest.java b/android/app/tests/unit/src/com/android/bluetooth/map/BluetoothMapObexServerTest.java
new file mode 100644
index 0000000..4b252fc
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/map/BluetoothMapObexServerTest.java
@@ -0,0 +1,244 @@
+/*
+ * Copyright 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.map;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import static org.junit.Assert.assertThrows;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.eq;
+import static org.mockito.Mockito.doReturn;
+import static org.mockito.Mockito.doThrow;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;
+
+import android.content.ContentProviderClient;
+import android.content.Context;
+import android.database.MatrixCursor;
+import android.graphics.drawable.ColorDrawable;
+import android.graphics.drawable.Drawable;
+import android.os.Bundle;
+import android.os.RemoteException;
+
+import androidx.test.filters.SmallTest;
+import androidx.test.runner.AndroidJUnit4;
+
+import com.android.bluetooth.BluetoothMethodProxy;
+import com.android.bluetooth.mapapi.BluetoothMapContract;
+import com.android.obex.ResponseCodes;
+import com.android.obex.Operation;
+
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.Mock;
+import org.mockito.MockitoAnnotations;
+import org.mockito.Spy;
+
+@SmallTest
+@RunWith(AndroidJUnit4.class)
+public class BluetoothMapObexServerTest {
+    private static final int TEST_MAS_ID = 1;
+    private static final boolean TEST_ENABLE_SMS_MMS = true;
+    private static final String TEST_NAME = "test_name";
+    private static final String TEST_PACKAGE_NAME = "test.package.name";
+    private static final String TEST_ID = "1111";
+    private static final String TEST_PROVIDER_AUTHORITY = "test.project.provider";
+    private static final Drawable TEST_DRAWABLE = new ColorDrawable();
+    private static final BluetoothMapUtils.TYPE TEST_TYPE = BluetoothMapUtils.TYPE.IM;
+    private static final String TEST_UCI = "uci";
+    private static final String TEST_UCI_PREFIX = "uci_prefix";
+
+    private BluetoothMapAccountItem mAccountItem;
+    private BluetoothMapMasInstance mMasInstance;
+    private BluetoothMapObexServer mObexServer;
+    private BluetoothMapAppParams mParams;
+
+    @Mock
+    private Context mContext;
+    @Mock
+    private BluetoothMapService mMapService;
+    @Mock
+    private ContentProviderClient mProviderClient;
+    @Mock
+    private BluetoothMapContentObserver mObserver;
+    @Spy
+    private BluetoothMethodProxy mMapMethodProxy = BluetoothMethodProxy.getInstance();
+
+    @Before
+    public void setUp() throws Exception {
+        MockitoAnnotations.initMocks(this);
+        BluetoothMethodProxy.setInstanceForTesting(mMapMethodProxy);
+        doReturn(mProviderClient).when(
+                mMapMethodProxy).contentResolverAcquireUnstableContentProviderClient(any(), any());
+        mAccountItem = BluetoothMapAccountItem.create(TEST_ID, TEST_NAME, TEST_PACKAGE_NAME,
+                TEST_PROVIDER_AUTHORITY, TEST_DRAWABLE, TEST_TYPE, TEST_UCI, TEST_UCI_PREFIX);
+        mMasInstance = new BluetoothMapMasInstance(mMapService, mContext,
+                mAccountItem, TEST_MAS_ID, TEST_ENABLE_SMS_MMS);
+        mParams = new BluetoothMapAppParams();
+        mObexServer = new BluetoothMapObexServer(null, mContext, mObserver, mMasInstance,
+                mAccountItem, TEST_ENABLE_SMS_MMS);
+    }
+
+    @Test
+    public void setOwnerStatus_withAccountTypeEmail() throws Exception {
+        doReturn(null).when(mProviderClient).query(any(), any(), any(), any(), any());
+        BluetoothMapAccountItem accountItemWithTypeEmail = BluetoothMapAccountItem.create(TEST_ID,
+                TEST_NAME, TEST_PACKAGE_NAME, TEST_PROVIDER_AUTHORITY, TEST_DRAWABLE,
+                BluetoothMapUtils.TYPE.EMAIL, TEST_UCI, TEST_UCI_PREFIX);
+        BluetoothMapObexServer obexServer = new BluetoothMapObexServer(null, mContext, mObserver,
+                mMasInstance, accountItemWithTypeEmail, TEST_ENABLE_SMS_MMS);
+
+        assertThat(obexServer.setOwnerStatus(mParams)).isEqualTo(
+                ResponseCodes.OBEX_HTTP_UNAVAILABLE);
+    }
+
+    @Test
+    public void setOwnerStatus_withAppParamsInvalid() throws Exception {
+        BluetoothMapAppParams params = mock(BluetoothMapAppParams.class);
+        when(params.getPresenceAvailability()).thenReturn(
+                BluetoothMapAppParams.INVALID_VALUE_PARAMETER);
+        when(params.getPresenceStatus()).thenReturn(null);
+        when(params.getLastActivity()).thenReturn(
+                (long) BluetoothMapAppParams.INVALID_VALUE_PARAMETER);
+        when(params.getChatState()).thenReturn(BluetoothMapAppParams.INVALID_VALUE_PARAMETER);
+        when(params.getChatStateConvoIdString()).thenReturn(null);
+
+        assertThat(mObexServer.setOwnerStatus(params)).isEqualTo(
+                ResponseCodes.OBEX_HTTP_PRECON_FAILED);
+    }
+
+    @Test
+    public void setOwnerStatus_withNonNullBundle() throws Exception {
+        setUpBluetoothMapAppParams(mParams);
+        Bundle bundle = new Bundle();
+        when(mProviderClient.call(any(), any(), any())).thenReturn(bundle);
+
+        assertThat(mObexServer.setOwnerStatus(mParams)).isEqualTo(
+                ResponseCodes.OBEX_HTTP_OK);
+    }
+
+    @Test
+    public void setOwnerStatus_withNullBundle() throws Exception {
+        setUpBluetoothMapAppParams(mParams);
+        when(mProviderClient.call(any(), any(), any())).thenReturn(null);
+
+        assertThat(mObexServer.setOwnerStatus(mParams)).isEqualTo(
+                ResponseCodes.OBEX_HTTP_NOT_IMPLEMENTED);
+    }
+
+    @Test
+    public void setOwnerStatus_withRemoteExceptionThrown() throws Exception {
+        setUpBluetoothMapAppParams(mParams);
+        doThrow(RemoteException.class).when(mProviderClient).call(any(), any(), any());
+
+        assertThat(mObexServer.setOwnerStatus(mParams)).isEqualTo(
+                ResponseCodes.OBEX_HTTP_UNAVAILABLE);
+    }
+
+    @Test
+    public void setOwnerStatus_withNullPointerExceptionThrown() throws Exception {
+        setUpBluetoothMapAppParams(mParams);
+        doThrow(NullPointerException.class).when(mProviderClient).call(any(), any(), any());
+
+        assertThat(mObexServer.setOwnerStatus(mParams)).isEqualTo(
+                ResponseCodes.OBEX_HTTP_UNAVAILABLE);
+    }
+
+    @Test
+    public void setOwnerStatus_withIllegalArgumentExceptionThrown() throws Exception {
+        setUpBluetoothMapAppParams(mParams);
+        doThrow(IllegalArgumentException.class).when(mProviderClient).call(any(), any(), any());
+
+        assertThat(mObexServer.setOwnerStatus(mParams)).isEqualTo(
+                ResponseCodes.OBEX_HTTP_UNAVAILABLE);
+    }
+
+    @Test
+    public void addEmailFolders() throws Exception {
+        MatrixCursor cursor = new MatrixCursor(new String[]{BluetoothMapContract.FolderColumns.NAME,
+                BluetoothMapContract.FolderColumns._ID});
+        long parentId = 1;
+        long childId = 2;
+        cursor.addRow(new Object[]{"test_name", childId});
+        cursor.moveToFirst();
+        BluetoothMapFolderElement parentFolder = new BluetoothMapFolderElement("parent", null);
+        parentFolder.setFolderId(parentId);
+        doReturn(cursor).when(mProviderClient).query(any(), any(),
+                eq(BluetoothMapContract.FolderColumns.PARENT_FOLDER_ID + " = " + parentId), any(),
+                any());
+
+        mObexServer.addEmailFolders(parentFolder);
+
+        assertThat(parentFolder.getFolderById(childId)).isNotNull();
+    }
+
+    @Test
+    public void setMsgTypeFilterParams_withAccountNull_andOverwriteTrue() throws Exception {
+        BluetoothMapObexServer obexServer = new BluetoothMapObexServer(null, mContext, mObserver,
+                mMasInstance, null, false);
+
+        obexServer.setMsgTypeFilterParams(mParams, true);
+
+        int expectedMask = 0;
+        expectedMask |= BluetoothMapAppParams.FILTER_NO_SMS_CDMA;
+        expectedMask |= BluetoothMapAppParams.FILTER_NO_SMS_GSM;
+        expectedMask |= BluetoothMapAppParams.FILTER_NO_MMS;
+        expectedMask |= BluetoothMapAppParams.FILTER_NO_EMAIL;
+        expectedMask |= BluetoothMapAppParams.FILTER_NO_IM;
+        assertThat(mParams.getFilterMessageType()).isEqualTo(expectedMask);
+    }
+
+    @Test
+    public void setMsgTypeFilterParams_withInvalidFilterMessageType() throws Exception {
+        BluetoothMapAccountItem accountItemWithTypeEmail = BluetoothMapAccountItem.create(TEST_ID,
+                TEST_NAME, TEST_PACKAGE_NAME, TEST_PROVIDER_AUTHORITY, TEST_DRAWABLE,
+                BluetoothMapUtils.TYPE.EMAIL, TEST_UCI, TEST_UCI_PREFIX);
+        BluetoothMapObexServer obexServer = new BluetoothMapObexServer(null, mContext, mObserver,
+                mMasInstance, accountItemWithTypeEmail, TEST_ENABLE_SMS_MMS);
+
+        // Passing mParams without any previous settings pass invalid filter message type
+        assertThrows(IllegalArgumentException.class,
+                () -> obexServer.setMsgTypeFilterParams(mParams, false));
+    }
+
+    @Test
+    public void setMsgTypeFilterParams_withValidFilterMessageType() throws Exception {
+        BluetoothMapAccountItem accountItemWithTypeIm = BluetoothMapAccountItem.create(TEST_ID,
+                TEST_NAME, TEST_PACKAGE_NAME, TEST_PROVIDER_AUTHORITY, TEST_DRAWABLE,
+                BluetoothMapUtils.TYPE.IM, TEST_UCI, TEST_UCI_PREFIX);
+        BluetoothMapObexServer obexServer = new BluetoothMapObexServer(null, mContext, mObserver,
+                mMasInstance, accountItemWithTypeIm, TEST_ENABLE_SMS_MMS);
+        int expectedMask = 1;
+        mParams.setFilterMessageType(expectedMask);
+
+        obexServer.setMsgTypeFilterParams(mParams, false);
+
+        int masFilterMask = 0;
+        masFilterMask |= BluetoothMapAppParams.FILTER_NO_EMAIL;
+        expectedMask |= masFilterMask;
+        assertThat(mParams.getFilterMessageType()).isEqualTo(expectedMask);
+    }
+
+    private void setUpBluetoothMapAppParams(BluetoothMapAppParams params) {
+        params.setPresenceAvailability(1);
+        params.setPresenceStatus("test_presence_status");
+        params.setLastActivity(0);
+        params.setChatState(1);
+        params.setChatStateConvoId(1, 1);
+    }
+}
diff --git a/android/app/tests/unit/src/com/android/bluetooth/map/BluetoothMapServiceBinderTest.java b/android/app/tests/unit/src/com/android/bluetooth/map/BluetoothMapServiceBinderTest.java
new file mode 100644
index 0000000..498fefa
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/map/BluetoothMapServiceBinderTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.map;
+
+import static org.mockito.Mockito.verify;
+
+import android.bluetooth.BluetoothAdapter;
+import android.bluetooth.BluetoothDevice;
+import android.bluetooth.BluetoothProfile;
+
+import androidx.test.filters.SmallTest;
+import androidx.test.runner.AndroidJUnit4;
+
+import com.android.bluetooth.x.com.android.modules.utils.SynchronousResultReceiver;
+
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.Mock;
+import org.mockito.MockitoAnnotations;
+
+@SmallTest
+@RunWith(AndroidJUnit4.class)
+public class BluetoothMapServiceBinderTest {
+    private static final String REMOTE_DEVICE_ADDRESS = "00:00:00:00:00:00";
+
+    @Mock
+    private BluetoothMapService mService;
+
+    BluetoothDevice mRemoteDevice;
+
+    BluetoothMapService.BluetoothMapBinder mBinder;
+
+    @Before
+    public void setUp() throws Exception {
+        MockitoAnnotations.initMocks(this);
+        mRemoteDevice = BluetoothAdapter.getDefaultAdapter().getRemoteDevice(REMOTE_DEVICE_ADDRESS);
+        mBinder = new BluetoothMapService.BluetoothMapBinder(mService);
+    }
+
+    @Test
+    public void disconnect_callsServiceMethod() {
+        mBinder.disconnect(mRemoteDevice, null, SynchronousResultReceiver.get());
+
+        verify(mService).disconnect(mRemoteDevice);
+    }
+
+    @Test
+    public void getConnectedDevices_callsServiceMethod() {
+        mBinder.getConnectedDevices(null, SynchronousResultReceiver.get());
+
+        verify(mService).getConnectedDevices();
+    }
+
+    @Test
+    public void getDevicesMatchingConnectionStates_callsServiceMethod() {
+        int[] states = new int[] {BluetoothProfile.STATE_CONNECTED};
+        mBinder.getDevicesMatchingConnectionStates(states, null, SynchronousResultReceiver.get());
+
+        verify(mService).getDevicesMatchingConnectionStates(states);
+    }
+
+    @Test
+    public void getConnectionState_callsServiceMethod() {
+        mBinder.getConnectionState(mRemoteDevice, null, SynchronousResultReceiver.get());
+
+        verify(mService).getConnectionState(mRemoteDevice);
+    }
+
+    @Test
+    public void setConnectionPolicy_callsServiceMethod() {
+        int connectionPolicy = BluetoothProfile.CONNECTION_POLICY_ALLOWED;
+        mBinder.setConnectionPolicy(mRemoteDevice, connectionPolicy,
+                null, SynchronousResultReceiver.get());
+
+        verify(mService).setConnectionPolicy(mRemoteDevice, connectionPolicy);
+    }
+
+    @Test
+    public void getConnectionPolicy_callsServiceMethod() {
+        mBinder.getConnectionPolicy(mRemoteDevice, null, SynchronousResultReceiver.get());
+
+        verify(mService).getConnectionPolicy(mRemoteDevice);
+    }
+
+    @Test
+    public void getState_callsServiceMethod() {
+        mBinder.getState(null, SynchronousResultReceiver.get());
+
+        verify(mService).getState();
+    }
+
+    @Test
+    public void isConnected_callsServiceStaticMethod() {
+        mBinder.isConnected(mRemoteDevice, null, SynchronousResultReceiver.get());
+
+        verify(mService).getConnectionState(mRemoteDevice);
+    }
+
+    @Test
+    public void getClient_callsServiceStaticMethod() {
+        mBinder.getClient(null, SynchronousResultReceiver.get());
+
+        // TODO: Check the static BluetoothMapService.getRemoteDevice() is called
+        //       when static methods become mockable.
+    }
+
+    @Test
+    public void cleanUp_doesNotCrash() {
+        mBinder.cleanup();
+    }
+}
diff --git a/android/app/tests/unit/src/com/android/bluetooth/map/BluetoothMapServiceTest.java b/android/app/tests/unit/src/com/android/bluetooth/map/BluetoothMapServiceTest.java
index 511aba1..1a3ed24 100644
--- a/android/app/tests/unit/src/com/android/bluetooth/map/BluetoothMapServiceTest.java
+++ b/android/app/tests/unit/src/com/android/bluetooth/map/BluetoothMapServiceTest.java
@@ -15,24 +15,38 @@
  */
 package com.android.bluetooth.map;
 
+import static com.android.bluetooth.map.BluetoothMapService.MSG_MAS_CONNECT_CANCEL;
+import static com.android.bluetooth.map.BluetoothMapService.UPDATE_MAS_INSTANCES;
+import static com.android.bluetooth.map.BluetoothMapService.USER_TIMEOUT;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import static org.mockito.Mockito.any;
+import static org.mockito.Mockito.anyInt;
 import static org.mockito.Mockito.anyString;
 import static org.mockito.Mockito.doReturn;
+import static org.mockito.Mockito.eq;
+import static org.mockito.Mockito.spy;
+import static org.mockito.Mockito.timeout;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
 
 import android.bluetooth.BluetoothAdapter;
-import android.content.Context;
+import android.bluetooth.BluetoothDevice;
+import android.bluetooth.BluetoothProfile;
+import android.os.Handler;
+import android.os.Looper;
+import android.os.Message;
 
-import androidx.test.InstrumentationRegistry;
 import androidx.test.filters.MediumTest;
 import androidx.test.rule.ServiceTestRule;
 import androidx.test.runner.AndroidJUnit4;
 
-import com.android.bluetooth.R;
 import com.android.bluetooth.TestUtils;
 import com.android.bluetooth.btservice.AdapterService;
 import com.android.bluetooth.btservice.storage.DatabaseManager;
 
 import org.junit.After;
-import org.junit.Assert;
 import org.junit.Assume;
 import org.junit.Before;
 import org.junit.Rule;
@@ -44,9 +58,11 @@
 @MediumTest
 @RunWith(AndroidJUnit4.class)
 public class BluetoothMapServiceTest {
+    private static final String REMOTE_DEVICE_ADDRESS = "00:00:00:00:00:00";
+
     private BluetoothMapService mService = null;
     private BluetoothAdapter mAdapter = null;
-    private Context mTargetContext;
+    private BluetoothDevice mRemoteDevice;
 
     @Rule public final ServiceTestRule mServiceRule = new ServiceTestRule();
 
@@ -55,7 +71,6 @@
 
     @Before
     public void setUp() throws Exception {
-        mTargetContext = InstrumentationRegistry.getTargetContext();
         Assume.assumeTrue("Ignore test when BluetoothMapService is not enabled",
                 BluetoothMapService.isEnabled());
         MockitoAnnotations.initMocks(this);
@@ -64,10 +79,11 @@
         doReturn(true, false).when(mAdapterService).isStartedProfile(anyString());
         TestUtils.startService(mServiceRule, BluetoothMapService.class);
         mService = BluetoothMapService.getBluetoothMapService();
-        Assert.assertNotNull(mService);
+        assertThat(mService).isNotNull();
         // Try getting the Bluetooth adapter
         mAdapter = BluetoothAdapter.getDefaultAdapter();
-        Assert.assertNotNull(mAdapter);
+        assertThat(mAdapter).isNotNull();
+        mRemoteDevice = mAdapter.getRemoteDevice(REMOTE_DEVICE_ADDRESS);
     }
 
     @After
@@ -77,12 +93,79 @@
         }
         TestUtils.stopService(mServiceRule, BluetoothMapService.class);
         mService = BluetoothMapService.getBluetoothMapService();
-        Assert.assertNull(mService);
+        assertThat(mService).isNull();
         TestUtils.clearAdapterService(mAdapterService);
     }
 
     @Test
-    public void testInitialize() {
-        Assert.assertNotNull(BluetoothMapService.getBluetoothMapService());
+    public void initialize() {
+        assertThat(BluetoothMapService.getBluetoothMapService()).isNotNull();
+    }
+
+    @Test
+    public void getDevicesMatchingConnectionStates_whenNoDeviceIsConnected_returnsEmptyList() {
+        when(mAdapterService.getBondedDevices()).thenReturn(new BluetoothDevice[] {mRemoteDevice});
+
+        assertThat(mService.getDevicesMatchingConnectionStates(
+                new int[] {BluetoothProfile.STATE_CONNECTED})).isEmpty();
+    }
+
+    @Test
+    public void getNextMasId_isInRange() {
+        int masId = mService.getNextMasId();
+        assertThat(masId).isAtMost(0xff);
+        assertThat(masId).isAtLeast(1);
+    }
+
+    @Test
+    public void sendConnectCancelMessage() {
+        TestableHandler handler = spy(new TestableHandler(Looper.getMainLooper()));
+        mService.mSessionStatusHandler = handler;
+
+        mService.sendConnectCancelMessage();
+
+        verify(handler, timeout(1_000)).messageArrived(
+                eq(MSG_MAS_CONNECT_CANCEL), anyInt(), anyInt(), any());
+    }
+
+    @Test
+    public void sendConnectTimeoutMessage() {
+        TestableHandler handler = spy(new TestableHandler(Looper.getMainLooper()));
+        mService.mSessionStatusHandler = handler;
+
+        mService.sendConnectTimeoutMessage();
+
+        verify(handler, timeout(1_000)).messageArrived(
+                eq(USER_TIMEOUT), anyInt(), anyInt(), any());
+    }
+
+    @Test
+    public void updateMasInstances() {
+        int action = 5;
+        TestableHandler handler = spy(new TestableHandler(Looper.getMainLooper()));
+        mService.mSessionStatusHandler = handler;
+
+        mService.updateMasInstances(action);
+
+        verify(handler, timeout(1_000)).messageArrived(
+                eq(UPDATE_MAS_INSTANCES), eq(action), anyInt(), any());
+    }
+
+    public static class TestableHandler extends Handler {
+        public TestableHandler(Looper looper) {
+            super(looper);
+        }
+
+        @Override
+        public void handleMessage(Message msg) {
+            messageArrived(msg.what, msg.arg1, msg.arg2, msg.obj);
+        }
+
+        public void messageArrived(int what, int arg1, int arg2, Object obj) {}
+    }
+
+    @Test
+    public void testDumpDoesNotCrash() {
+        mService.dump(new StringBuilder());
     }
 }
diff --git a/android/app/tests/unit/src/com/android/bluetooth/map/BluetoothMapSettingsTest.java b/android/app/tests/unit/src/com/android/bluetooth/map/BluetoothMapSettingsTest.java
new file mode 100644
index 0000000..df751e3
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/map/BluetoothMapSettingsTest.java
@@ -0,0 +1,90 @@
+/*
+ * Copyright 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.map;
+
+import static android.content.pm.PackageManager.COMPONENT_ENABLED_STATE_DEFAULT;
+import static android.content.pm.PackageManager.COMPONENT_ENABLED_STATE_ENABLED;
+import static android.content.pm.PackageManager.DONT_KILL_APP;
+
+import static androidx.test.espresso.Espresso.onView;
+import static androidx.test.espresso.assertion.ViewAssertions.matches;
+import static androidx.test.espresso.matcher.ViewMatchers.isDisplayed;
+import static androidx.test.espresso.matcher.ViewMatchers.withId;
+
+import android.content.ComponentName;
+import android.content.Context;
+import android.content.Intent;
+
+import androidx.test.core.app.ActivityScenario;
+import androidx.test.filters.LargeTest;
+import androidx.test.platform.app.InstrumentationRegistry;
+import androidx.test.runner.AndroidJUnit4;
+
+import com.android.bluetooth.R;
+
+import org.junit.After;
+import org.junit.Assume;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+@LargeTest
+@RunWith(AndroidJUnit4.class)
+public class BluetoothMapSettingsTest {
+
+    Context mTargetContext = InstrumentationRegistry.getInstrumentation().getTargetContext();
+    Intent mIntent;
+
+    ActivityScenario<BluetoothMapSettings> mActivityScenario;
+
+    @Before
+    public void setUp() {
+        Assume.assumeTrue("Ignore test when BluetoothMapService is not enabled",
+                BluetoothMapService.isEnabled());
+        enableActivity(true);
+        mIntent = new Intent();
+        mIntent.setClass(mTargetContext, BluetoothMapSettings.class);
+        mActivityScenario = ActivityScenario.launch(mIntent);
+    }
+
+    @After
+    public void tearDown() throws Exception {
+        if (mActivityScenario != null) {
+            // Workaround for b/159805732. Without this, test hangs for 45 seconds.
+            Thread.sleep(1_000);
+            mActivityScenario.close();
+        }
+        enableActivity(false);
+    }
+
+    @Test
+    public void initialize() throws Exception {
+        onView(withId(R.id.bluetooth_map_settings_list_view)).check(matches(isDisplayed()));
+    }
+
+    private void enableActivity(boolean enable) {
+        int enabledState = enable ? COMPONENT_ENABLED_STATE_ENABLED
+                : COMPONENT_ENABLED_STATE_DEFAULT;
+
+        mTargetContext.getPackageManager().setApplicationEnabledSetting(
+                mTargetContext.getPackageName(), enabledState, DONT_KILL_APP);
+
+        ComponentName activityName = new ComponentName(mTargetContext, BluetoothMapSettings.class);
+        mTargetContext.getPackageManager().setComponentEnabledSetting(
+                activityName, enabledState, DONT_KILL_APP);
+    }
+}
diff --git a/android/app/tests/unit/src/com/android/bluetooth/map/BluetoothMapSmsPduTest.java b/android/app/tests/unit/src/com/android/bluetooth/map/BluetoothMapSmsPduTest.java
new file mode 100644
index 0000000..56c791c
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/map/BluetoothMapSmsPduTest.java
@@ -0,0 +1,236 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.map;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import static org.junit.Assert.assertThrows;
+import static org.mockito.Mockito.when;
+
+import android.content.Context;
+import android.telephony.SmsMessage;
+import android.telephony.TelephonyManager;
+
+import androidx.test.filters.SmallTest;
+import androidx.test.runner.AndroidJUnit4;
+
+import com.android.bluetooth.map.BluetoothMapSmsPdu.SmsPdu;
+
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.Mock;
+import org.mockito.MockitoAnnotations;
+
+import java.io.ByteArrayInputStream;
+import java.io.InputStream;
+import java.util.ArrayList;
+
+@SmallTest
+@RunWith(AndroidJUnit4.class)
+public class BluetoothMapSmsPduTest {
+    private static final String TEST_TEXT = "test";
+    // Text below size 160 only need one SMS part
+    private static final String TEST_TEXT_WITH_TWO_SMS_PARTS = "a".repeat(161);
+    private static final String TEST_DESTINATION_ADDRESS = "12";
+    private static final int TEST_TYPE = BluetoothMapSmsPdu.SMS_TYPE_GSM;
+    private static final long TEST_DATE = 1;
+
+    private byte[] TEST_DATA;
+    private int TEST_ENCODING;
+    private int TEST_LANGUAGE_TABLE;
+
+    @Mock
+    private Context mTargetContext;
+    @Mock
+    private TelephonyManager mTelephonyManager;
+
+    @Before
+    public void setUp() throws Exception {
+        MockitoAnnotations.initMocks(this);
+        when(mTargetContext.getSystemServiceName(TelephonyManager.class)).thenReturn(
+                "TELEPHONY_SERVICE");
+        when(mTargetContext.getSystemService("TELEPHONY_SERVICE")).thenReturn(mTelephonyManager);
+
+        int[] ted = SmsMessage.calculateLength((CharSequence) TEST_TEXT, false);
+        TEST_ENCODING = ted[3];
+        TEST_LANGUAGE_TABLE = ted[4];
+        TEST_DATA = SmsMessage.getSubmitPdu(null, TEST_DESTINATION_ADDRESS, TEST_TEXT,
+                false).encodedMessage;
+    }
+
+    @Test
+    public void constructor_withDataAndType() {
+        SmsPdu smsPdu = new SmsPdu(TEST_DATA, TEST_TYPE);
+        int offsetExpected = 2 + ((TEST_DATA[2] + 1) & 0xff) / 2 + 5;
+
+        assertThat(smsPdu.getData()).isEqualTo(TEST_DATA);
+        assertThat(smsPdu.getEncoding()).isEqualTo(-1);
+        assertThat(smsPdu.getLanguageTable()).isEqualTo(-1);
+        assertThat(smsPdu.getLanguageShiftTable()).isEqualTo(-1);
+        assertThat(smsPdu.getUserDataMsgOffset()).isEqualTo(offsetExpected);
+        assertThat(smsPdu.getUserDataMsgSize()).isEqualTo(TEST_DATA.length - (offsetExpected));
+    }
+
+    @Test
+    public void constructor_withAllParameters() {
+        SmsPdu smsPdu = new SmsPdu(TEST_DATA, TEST_ENCODING, TEST_TYPE, TEST_LANGUAGE_TABLE);
+
+        assertThat(smsPdu.getData()).isEqualTo(TEST_DATA);
+        assertThat(smsPdu.getEncoding()).isEqualTo(TEST_ENCODING);
+        assertThat(smsPdu.getType()).isEqualTo(TEST_TYPE);
+        assertThat(smsPdu.getLanguageTable()).isEqualTo(TEST_LANGUAGE_TABLE);
+    }
+
+    @Test
+    public void getSubmitPdus_withTypeGSM_whenMsgCountIsMoreThanOne() throws Exception {
+        when(mTelephonyManager.getCurrentPhoneType()).thenReturn(TelephonyManager.PHONE_TYPE_GSM);
+
+        ArrayList<SmsPdu> pdus = BluetoothMapSmsPdu.getSubmitPdus(mTargetContext,
+                TEST_TEXT_WITH_TWO_SMS_PARTS, null);
+
+        assertThat(pdus.size()).isEqualTo(2);
+        assertThat(pdus.get(0).getType()).isEqualTo(BluetoothMapSmsPdu.SMS_TYPE_GSM);
+
+        BluetoothMapbMessageSms messageSmsToEncode = new BluetoothMapbMessageSms();
+        messageSmsToEncode.setType(BluetoothMapUtils.TYPE.SMS_GSM);
+        messageSmsToEncode.setFolder("placeholder");
+        messageSmsToEncode.setStatus(true);
+        messageSmsToEncode.setSmsBodyPdus(pdus);
+
+        byte[] encodedMessageSms = messageSmsToEncode.encode();
+        InputStream inputStream = new ByteArrayInputStream(encodedMessageSms);
+        BluetoothMapbMessage messageParsed = BluetoothMapbMessage.parse(inputStream,
+                BluetoothMapAppParams.CHARSET_NATIVE);
+
+        assertThat(messageParsed).isInstanceOf(BluetoothMapbMessageSms.class);
+        BluetoothMapbMessageSms messageSmsParsed = (BluetoothMapbMessageSms) messageParsed;
+        assertThat(messageSmsParsed.getSmsBody()).isEqualTo(TEST_TEXT_WITH_TWO_SMS_PARTS);
+    }
+
+    @Test
+    public void getSubmitPdus_withTypeCDMA() throws Exception {
+        when(mTelephonyManager.getCurrentPhoneType()).thenReturn(TelephonyManager.PHONE_TYPE_CDMA);
+
+        ArrayList<SmsPdu> pdus = BluetoothMapSmsPdu.getSubmitPdus(mTargetContext, TEST_TEXT, null);
+
+        assertThat(pdus.size()).isEqualTo(1);
+        assertThat(pdus.get(0).getType()).isEqualTo(BluetoothMapSmsPdu.SMS_TYPE_CDMA);
+
+        BluetoothMapbMessageSms messageSmsToEncode = new BluetoothMapbMessageSms();
+        messageSmsToEncode.setType(BluetoothMapUtils.TYPE.SMS_CDMA);
+        messageSmsToEncode.setFolder("placeholder");
+        messageSmsToEncode.setStatus(true);
+        messageSmsToEncode.setSmsBodyPdus(pdus);
+
+        byte[] encodedMessageSms = messageSmsToEncode.encode();
+        InputStream inputStream = new ByteArrayInputStream(encodedMessageSms);
+        BluetoothMapbMessage messageParsed = BluetoothMapbMessage.parse(inputStream,
+                BluetoothMapAppParams.CHARSET_NATIVE);
+
+        assertThat(messageParsed).isInstanceOf(BluetoothMapbMessageSms.class);
+    }
+
+    @Test
+    public void getDeliverPdus_withTypeGSM() throws Exception {
+        when(mTelephonyManager.getCurrentPhoneType()).thenReturn(TelephonyManager.PHONE_TYPE_GSM);
+
+        ArrayList<SmsPdu> pdus = BluetoothMapSmsPdu.getDeliverPdus(mTargetContext, TEST_TEXT,
+                TEST_DESTINATION_ADDRESS, TEST_DATE);
+
+        assertThat(pdus.size()).isEqualTo(1);
+        assertThat(pdus.get(0).getType()).isEqualTo(BluetoothMapSmsPdu.SMS_TYPE_GSM);
+
+        BluetoothMapbMessageSms messageSmsToEncode = new BluetoothMapbMessageSms();
+        messageSmsToEncode.setType(BluetoothMapUtils.TYPE.SMS_GSM);
+        messageSmsToEncode.setFolder("placeholder");
+        messageSmsToEncode.setStatus(true);
+        messageSmsToEncode.setSmsBodyPdus(pdus);
+
+        byte[] encodedMessageSms = messageSmsToEncode.encode();
+        InputStream inputStream = new ByteArrayInputStream(encodedMessageSms);
+
+        assertThrows(IllegalArgumentException.class, () -> BluetoothMapbMessage.parse(inputStream,
+                BluetoothMapAppParams.CHARSET_NATIVE));
+    }
+
+    @Test
+    public void getDeliverPdus_withTypeCDMA() throws Exception {
+        when(mTelephonyManager.getCurrentPhoneType()).thenReturn(TelephonyManager.PHONE_TYPE_CDMA);
+
+        ArrayList<SmsPdu> pdus = BluetoothMapSmsPdu.getDeliverPdus(mTargetContext, TEST_TEXT,
+                TEST_DESTINATION_ADDRESS, TEST_DATE);
+
+        assertThat(pdus.size()).isEqualTo(1);
+        assertThat(pdus.get(0).getType()).isEqualTo(BluetoothMapSmsPdu.SMS_TYPE_CDMA);
+
+        BluetoothMapbMessageSms messageSmsToEncode = new BluetoothMapbMessageSms();
+        messageSmsToEncode.setType(BluetoothMapUtils.TYPE.SMS_CDMA);
+        messageSmsToEncode.setFolder("placeholder");
+        messageSmsToEncode.setStatus(true);
+        messageSmsToEncode.setSmsBodyPdus(pdus);
+
+        byte[] encodedMessageSms = messageSmsToEncode.encode();
+        InputStream inputStream = new ByteArrayInputStream(encodedMessageSms);
+
+        assertThrows(IllegalArgumentException.class, () -> BluetoothMapbMessage.parse(inputStream,
+                BluetoothMapAppParams.CHARSET_NATIVE));
+    }
+
+    @Test
+    public void getEncodingString() {
+        SmsPdu smsPduGsm7bitWithLanguageTableZero = new SmsPdu(TEST_DATA, SmsMessage.ENCODING_7BIT,
+                BluetoothMapSmsPdu.SMS_TYPE_GSM, 0);
+        assertThat(smsPduGsm7bitWithLanguageTableZero.getEncodingString()).isEqualTo("G-7BIT");
+
+        SmsPdu smsPduGsm7bitWithLanguageTableOne = new SmsPdu(TEST_DATA, SmsMessage.ENCODING_7BIT,
+                BluetoothMapSmsPdu.SMS_TYPE_GSM, 1);
+        assertThat(smsPduGsm7bitWithLanguageTableOne.getEncodingString()).isEqualTo("G-7BITEXT");
+
+        SmsPdu smsPduGsm8bit = new SmsPdu(TEST_DATA, SmsMessage.ENCODING_8BIT,
+                BluetoothMapSmsPdu.SMS_TYPE_GSM, 0);
+        assertThat(smsPduGsm8bit.getEncodingString()).isEqualTo("G-8BIT");
+
+        SmsPdu smsPduGsm16bit = new SmsPdu(TEST_DATA, SmsMessage.ENCODING_16BIT,
+                BluetoothMapSmsPdu.SMS_TYPE_GSM, 0);
+        assertThat(smsPduGsm16bit.getEncodingString()).isEqualTo("G-16BIT");
+
+        SmsPdu smsPduGsmUnknown = new SmsPdu(TEST_DATA, SmsMessage.ENCODING_UNKNOWN,
+                BluetoothMapSmsPdu.SMS_TYPE_GSM, 0);
+        assertThat(smsPduGsmUnknown.getEncodingString()).isEqualTo("");
+
+        SmsPdu smsPduCdma7bit = new SmsPdu(TEST_DATA, SmsMessage.ENCODING_7BIT,
+                BluetoothMapSmsPdu.SMS_TYPE_CDMA, 0);
+        assertThat(smsPduCdma7bit.getEncodingString()).isEqualTo("C-7ASCII");
+
+        SmsPdu smsPduCdma8bit = new SmsPdu(TEST_DATA, SmsMessage.ENCODING_8BIT,
+                BluetoothMapSmsPdu.SMS_TYPE_CDMA, 0);
+        assertThat(smsPduCdma8bit.getEncodingString()).isEqualTo("C-8BIT");
+
+        SmsPdu smsPduCdma16bit = new SmsPdu(TEST_DATA, SmsMessage.ENCODING_16BIT,
+                BluetoothMapSmsPdu.SMS_TYPE_CDMA, 0);
+        assertThat(smsPduCdma16bit.getEncodingString()).isEqualTo("C-UNICODE");
+
+        SmsPdu smsPduCdmaKsc5601 = new SmsPdu(TEST_DATA, SmsMessage.ENCODING_KSC5601,
+                BluetoothMapSmsPdu.SMS_TYPE_CDMA, 0);
+        assertThat(smsPduCdmaKsc5601.getEncodingString()).isEqualTo("C-KOREAN");
+
+        SmsPdu smsPduCdmaUnknown = new SmsPdu(TEST_DATA, SmsMessage.ENCODING_UNKNOWN,
+                BluetoothMapSmsPdu.SMS_TYPE_CDMA, 0);
+        assertThat(smsPduCdmaUnknown.getEncodingString()).isEqualTo("");
+    }
+}
\ No newline at end of file
diff --git a/android/app/tests/unit/src/com/android/bluetooth/map/BluetoothMapUtilsTest.java b/android/app/tests/unit/src/com/android/bluetooth/map/BluetoothMapUtilsTest.java
new file mode 100644
index 0000000..6a8eb18
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/map/BluetoothMapUtilsTest.java
@@ -0,0 +1,78 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.map;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import android.database.MatrixCursor;
+
+import androidx.test.filters.MediumTest;
+import androidx.test.runner.AndroidJUnit4;
+
+import com.android.bluetooth.mapapi.BluetoothMapContract;
+
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+import java.nio.charset.StandardCharsets;
+
+@MediumTest
+@RunWith(AndroidJUnit4.class)
+public class BluetoothMapUtilsTest {
+
+    private static final String TEXT = "코드";
+    private static final String QUOTED_PRINTABLE_ENCODED_TEXT = "=EC=BD=94=EB=93=9C";
+    private static final String BASE64_ENCODED_TEXT = "7L2U65Oc";
+
+    @Test
+    public void encodeQuotedPrintable_withNullInput_returnsNull() {
+        assertThat(BluetoothMapUtils.encodeQuotedPrintable(null)).isNull();
+    }
+
+    @Test
+    public void encodeQuotedPrintable() {
+        assertThat(BluetoothMapUtils.encodeQuotedPrintable(TEXT.getBytes(StandardCharsets.UTF_8)))
+                .isEqualTo(QUOTED_PRINTABLE_ENCODED_TEXT);
+    }
+
+    @Test
+    public void quotedPrintableToUtf8() {
+        assertThat(BluetoothMapUtils.quotedPrintableToUtf8(QUOTED_PRINTABLE_ENCODED_TEXT, null))
+                .isEqualTo(TEXT.getBytes(StandardCharsets.UTF_8));
+    }
+
+    @Test
+    public void printCursor_doesNotCrash() {
+        MatrixCursor cursor = new MatrixCursor(new String[] {
+                BluetoothMapContract.PresenceColumns.LAST_ONLINE, "Name"});
+        cursor.addRow(new Object[] {345345226L, "test_name"});
+
+        BluetoothMapUtils.printCursor(cursor);
+    }
+
+    @Test
+    public void stripEncoding_quotedPrintable() {
+        assertThat(BluetoothMapUtils.stripEncoding("=?UTF-8?Q?" + QUOTED_PRINTABLE_ENCODED_TEXT
+                + "?=")).isEqualTo(TEXT);
+    }
+
+    @Test
+    public void stripEncoding_base64() {
+        assertThat(BluetoothMapUtils.stripEncoding("=?UTF-8?B?" + BASE64_ENCODED_TEXT + "?="))
+                .isEqualTo(TEXT);
+    }
+}
diff --git a/android/app/tests/unit/src/com/android/bluetooth/map/BluetoothMapbMessageEmailTest.java b/android/app/tests/unit/src/com/android/bluetooth/map/BluetoothMapbMessageEmailTest.java
new file mode 100644
index 0000000..e2a5cb4
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/map/BluetoothMapbMessageEmailTest.java
@@ -0,0 +1,78 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.map;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import androidx.test.filters.SmallTest;
+import androidx.test.runner.AndroidJUnit4;
+
+import com.android.bluetooth.map.BluetoothMapUtils.TYPE;
+
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+import java.io.ByteArrayInputStream;
+import java.io.InputStream;
+
+@SmallTest
+@RunWith(AndroidJUnit4.class)
+public class BluetoothMapbMessageEmailTest {
+    public static final String TEST_EMAIL_BODY = "test_email_body";
+
+    @Test
+    public void setAndGetEmailBody() {
+        BluetoothMapbMessageEmail messageEmail = new BluetoothMapbMessageEmail();
+        messageEmail.setEmailBody(TEST_EMAIL_BODY);
+        assertThat(messageEmail.getEmailBody()).isEqualTo(TEST_EMAIL_BODY);
+    }
+
+    @Test
+    public void encodeToByteArray_thenCreateByParsing() throws Exception {
+        BluetoothMapbMessageEmail messageEmailToEncode = new BluetoothMapbMessageEmail();
+        messageEmailToEncode.setType(TYPE.EMAIL);
+        messageEmailToEncode.setFolder("placeholder");
+        messageEmailToEncode.setStatus(true);
+        messageEmailToEncode.setEmailBody(TEST_EMAIL_BODY);
+
+        byte[] encodedMessageEmail = messageEmailToEncode.encode();
+        InputStream inputStream = new ByteArrayInputStream(encodedMessageEmail);
+
+        BluetoothMapbMessage messageParsed = BluetoothMapbMessage.parse(inputStream,
+                BluetoothMapAppParams.CHARSET_UTF8);
+        assertThat(messageParsed).isInstanceOf(BluetoothMapbMessageEmail.class);
+        BluetoothMapbMessageEmail messageEmailParsed = (BluetoothMapbMessageEmail) messageParsed;
+        assertThat(messageEmailParsed.getEmailBody()).isEqualTo(TEST_EMAIL_BODY);
+    }
+
+    @Test
+    public void encodeToByteArray_withEmptyBody_thenCreateByParsing() throws Exception {
+        BluetoothMapbMessageEmail messageEmailToEncode = new BluetoothMapbMessageEmail();
+        messageEmailToEncode.setType(TYPE.EMAIL);
+        messageEmailToEncode.setFolder("placeholder");
+        messageEmailToEncode.setStatus(true);
+
+        byte[] encodedMessageEmail = messageEmailToEncode.encode();
+        InputStream inputStream = new ByteArrayInputStream(encodedMessageEmail);
+
+        BluetoothMapbMessage messageParsed = BluetoothMapbMessage.parse(inputStream,
+                BluetoothMapAppParams.CHARSET_UTF8);
+        assertThat(messageParsed).isInstanceOf(BluetoothMapbMessageEmail.class);
+        BluetoothMapbMessageEmail messageEmailParsed = (BluetoothMapbMessageEmail) messageParsed;
+        assertThat(messageEmailParsed.getEmailBody()).isEqualTo("");
+    }
+}
\ No newline at end of file
diff --git a/android/app/tests/unit/src/com/android/bluetooth/map/BluetoothMapbMessageMimeTest.java b/android/app/tests/unit/src/com/android/bluetooth/map/BluetoothMapbMessageMimeTest.java
index cbd37bb..ac2d980 100644
--- a/android/app/tests/unit/src/com/android/bluetooth/map/BluetoothMapbMessageMimeTest.java
+++ b/android/app/tests/unit/src/com/android/bluetooth/map/BluetoothMapbMessageMimeTest.java
@@ -16,19 +16,203 @@
 
 package com.android.bluetooth.map;
 
-import static org.mockito.Mockito.*;
+import static com.google.common.truth.Truth.assertThat;
+
+import android.text.util.Rfc822Token;
 
 import androidx.test.filters.MediumTest;
 import androidx.test.runner.AndroidJUnit4;
 
+import org.junit.Before;
 import org.junit.Test;
 import org.junit.runner.RunWith;
 
+import java.text.SimpleDateFormat;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.Date;
+import java.util.Locale;
+
 @MediumTest
 @RunWith(AndroidJUnit4.class)
 public class BluetoothMapbMessageMimeTest {
     private static final String TAG = BluetoothMapbMessageMimeTest.class.getSimpleName();
 
+    private static final long TEST_DATE = 1;
+    private static final String TEST_SUBJECT = "test_subject";
+    private static final String TEST_MESSAGE_ID = "test_message_id";
+    private static final String TEST_CONTENT_TYPE = "text/plain";
+    private static final boolean TEST_TEXT_ONLY = true;
+    private static final boolean TEST_INCLUDE_ATTACHMENTS = true;
+
+    private final SimpleDateFormat format = new SimpleDateFormat("EEE, dd MMM yyyy HH:mm:ss Z",
+            Locale.US);
+    private final Date date = new Date(TEST_DATE);
+
+    private final ArrayList<Rfc822Token> TEST_FROM = new ArrayList<>(
+            Arrays.asList(new Rfc822Token("from_name", "from_address", null)));
+    private final ArrayList<Rfc822Token> TEST_SENDER = new ArrayList<>(
+            Arrays.asList(new Rfc822Token("sender_name", "sender_address", null)));
+    private static final ArrayList<Rfc822Token> TEST_TO = new ArrayList<>(
+            Arrays.asList(new Rfc822Token("to_name", "to_address", null)));
+    private static final ArrayList<Rfc822Token> TEST_CC = new ArrayList<>(
+            Arrays.asList(new Rfc822Token("cc_name", "cc_address", null)));
+    private final ArrayList<Rfc822Token> TEST_BCC = new ArrayList<>(
+            Arrays.asList(new Rfc822Token("bcc_name", "bcc_address", null)));
+    private final ArrayList<Rfc822Token> TEST_REPLY_TO = new ArrayList<>(
+            Arrays.asList(new Rfc822Token("reply_to_name", "reply_to_address", null)));
+
+    private BluetoothMapbMessageMime mMime;
+
+    @Before
+    public void setUp() {
+        mMime = new BluetoothMapbMessageMime();
+
+        mMime.setSubject(TEST_SUBJECT);
+        mMime.setDate(TEST_DATE);
+        mMime.setMessageId(TEST_MESSAGE_ID);
+        mMime.setContentType(TEST_CONTENT_TYPE);
+        mMime.setTextOnly(TEST_TEXT_ONLY);
+        mMime.setIncludeAttachments(TEST_INCLUDE_ATTACHMENTS);
+
+        mMime.setFrom(TEST_FROM);
+        mMime.setSender(TEST_SENDER);
+        mMime.setTo(TEST_TO);
+        mMime.setCc(TEST_CC);
+        mMime.setBcc(TEST_BCC);
+        mMime.setReplyTo(TEST_REPLY_TO);
+
+        mMime.addMimePart();
+    }
+
+    @Test
+    public void testGetters() {
+        assertThat(mMime.getSubject()).isEqualTo(TEST_SUBJECT);
+        assertThat(mMime.getDate()).isEqualTo(TEST_DATE);
+        assertThat(mMime.getMessageId()).isEqualTo(TEST_MESSAGE_ID);
+        assertThat(mMime.getDateString()).isEqualTo(format.format(date));
+        assertThat(mMime.getContentType()).isEqualTo(TEST_CONTENT_TYPE);
+        assertThat(mMime.getTextOnly()).isEqualTo(TEST_TEXT_ONLY);
+        assertThat(mMime.getIncludeAttachments()).isEqualTo(TEST_INCLUDE_ATTACHMENTS);
+
+        assertThat(mMime.getFrom()).isEqualTo(TEST_FROM);
+        assertThat(mMime.getSender()).isEqualTo(TEST_SENDER);
+        assertThat(mMime.getTo()).isEqualTo(TEST_TO);
+        assertThat(mMime.getCc()).isEqualTo(TEST_CC);
+        assertThat(mMime.getBcc()).isEqualTo(TEST_BCC);
+        assertThat(mMime.getReplyTo()).isEqualTo(TEST_REPLY_TO);
+
+        assertThat(mMime.getMimeParts().size()).isEqualTo(1);
+    }
+
+    @Test
+    public void testGetSize() {
+        mMime.getMimeParts().get(0).mData = new byte[10];
+        assertThat(mMime.getSize()).isEqualTo(10);
+    }
+
+    @Test
+    public void testUpdateCharset() {
+        mMime.getMimeParts().get(0).mContentType = TEST_CONTENT_TYPE/*="text/plain*/;
+        mMime.updateCharset();
+        assertThat(mMime.mCharset).isEqualTo("UTF-8");
+    }
+
+    @Test
+    public void testAddFrom() {
+        final BluetoothMapbMessageMime mime = new BluetoothMapbMessageMime();
+        final String nameToAdd = "name_to_add";
+        final String addressToAdd = "address_to_add";
+        mime.addFrom(nameToAdd, addressToAdd);
+        assertThat(mime.getFrom().get(0)).isEqualTo(new Rfc822Token(nameToAdd, addressToAdd, null));
+    }
+
+    @Test
+    public void testAddSender() {
+        final BluetoothMapbMessageMime mime = new BluetoothMapbMessageMime();
+        final String nameToAdd = "name_to_add";
+        final String addressToAdd = "address_to_add";
+        mime.addSender(nameToAdd, addressToAdd);
+        assertThat(mime.getSender().get(0)).isEqualTo(
+                new Rfc822Token(nameToAdd, addressToAdd, null));
+    }
+
+    @Test
+    public void testAddTo() {
+        final BluetoothMapbMessageMime mime = new BluetoothMapbMessageMime();
+        final String nameToAdd = "name_to_add";
+        final String addressToAdd = "address_to_add";
+        mime.addTo(nameToAdd, addressToAdd);
+        assertThat(mime.getTo().get(0)).isEqualTo(new Rfc822Token(nameToAdd, addressToAdd, null));
+    }
+
+    @Test
+    public void testAddCc() {
+        final BluetoothMapbMessageMime mime = new BluetoothMapbMessageMime();
+        final String nameToAdd = "name_to_add";
+        final String addressToAdd = "address_to_add";
+        mime.addCc(nameToAdd, addressToAdd);
+        assertThat(mime.getCc().get(0)).isEqualTo(new Rfc822Token(nameToAdd, addressToAdd, null));
+    }
+
+    @Test
+    public void testAddBcc() {
+        final BluetoothMapbMessageMime mime = new BluetoothMapbMessageMime();
+        final String nameToAdd = "name_to_add";
+        final String addressToAdd = "address_to_add";
+        mime.addBcc(nameToAdd, addressToAdd);
+        assertThat(mime.getBcc().get(0)).isEqualTo(new Rfc822Token(nameToAdd, addressToAdd, null));
+    }
+
+    @Test
+    public void testAddReplyTo() {
+        final BluetoothMapbMessageMime mime = new BluetoothMapbMessageMime();
+        final String nameToAdd = "name_to_add";
+        final String addressToAdd = "address_to_add";
+        mime.addReplyTo(nameToAdd, addressToAdd);
+        assertThat(mime.getReplyTo().get(0)).isEqualTo(
+                new Rfc822Token(nameToAdd, addressToAdd, null));
+    }
+
+    @Test
+    public void testEncode_ThenCreateByParsing_ReturnsCorrectly() throws Exception {
+        mMime.setType(BluetoothMapUtils.TYPE.EMAIL);
+        mMime.setFolder("placeholder");
+        byte[] encodedMime = mMime.encodeMime();
+
+        final BluetoothMapbMessageMime mimeToCreateByParsing = new BluetoothMapbMessageMime();
+        mimeToCreateByParsing.parseMsgPart(new String(encodedMime));
+
+        assertThat(mimeToCreateByParsing.getSubject()).isEqualTo(TEST_SUBJECT);
+        assertThat(mimeToCreateByParsing.getMessageId()).isEqualTo(TEST_MESSAGE_ID);
+        assertThat(mimeToCreateByParsing.getContentType()).isEqualTo(TEST_CONTENT_TYPE);
+
+        assertThat(mimeToCreateByParsing.getFrom().get(0).getName()).isEqualTo(
+                TEST_FROM.get(0).getName());
+        assertThat(mimeToCreateByParsing.getFrom().get(0).getAddress()).isEqualTo(
+                TEST_FROM.get(0).getAddress());
+
+        assertThat(mimeToCreateByParsing.getTo().get(0).getName()).isEqualTo(
+                TEST_TO.get(0).getName());
+        assertThat(mimeToCreateByParsing.getTo().get(0).getAddress()).isEqualTo(
+                TEST_TO.get(0).getAddress());
+
+        assertThat(mimeToCreateByParsing.getCc().get(0).getName()).isEqualTo(
+                TEST_CC.get(0).getName());
+        assertThat(mimeToCreateByParsing.getCc().get(0).getAddress()).isEqualTo(
+                TEST_CC.get(0).getAddress());
+
+        assertThat(mimeToCreateByParsing.getBcc().get(0).getName()).isEqualTo(
+                TEST_BCC.get(0).getName());
+        assertThat(mimeToCreateByParsing.getBcc().get(0).getAddress()).isEqualTo(
+                TEST_BCC.get(0).getAddress());
+
+        assertThat(mimeToCreateByParsing.getReplyTo().get(0).getName()).isEqualTo(
+                TEST_REPLY_TO.get(0).getName());
+        assertThat(mimeToCreateByParsing.getReplyTo().get(0).getAddress()).isEqualTo(
+                TEST_REPLY_TO.get(0).getAddress());
+    }
+
     @Test
     public void testParseNullMsgPart_NoExceptionsThrown() {
         BluetoothMapbMessageMime bMessageMime = new BluetoothMapbMessageMime();
diff --git a/android/app/tests/unit/src/com/android/bluetooth/map/BluetoothMapbMessageSmsTest.java b/android/app/tests/unit/src/com/android/bluetooth/map/BluetoothMapbMessageSmsTest.java
new file mode 100644
index 0000000..40607b2
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/map/BluetoothMapbMessageSmsTest.java
@@ -0,0 +1,105 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.map;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import android.content.Context;
+
+import androidx.test.filters.SmallTest;
+import androidx.test.InstrumentationRegistry;
+import androidx.test.runner.AndroidJUnit4;
+
+import com.android.bluetooth.map.BluetoothMapSmsPdu.SmsPdu;
+
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+import java.io.ByteArrayInputStream;
+import java.io.InputStream;
+import java.util.ArrayList;
+
+@SmallTest
+@RunWith(AndroidJUnit4.class)
+public class BluetoothMapbMessageSmsTest {
+    private static final String TEST_SMS_BODY = "test_sms_body";
+    private static final String TEST_MESSAGE = "test";
+    private static final String TEST_ADDRESS = "12";
+
+    private Context mTargetContext;
+    private ArrayList<SmsPdu> TEST_SMS_BODY_PDUS;
+
+    @Before
+    public void setUp() throws Exception {
+        mTargetContext = InstrumentationRegistry.getTargetContext();
+        TEST_SMS_BODY_PDUS = BluetoothMapSmsPdu.getSubmitPdus(mTargetContext, TEST_MESSAGE,
+                TEST_ADDRESS);
+    }
+
+    @Test
+    public void settersAndGetters() {
+        BluetoothMapbMessageSms messageSms = new BluetoothMapbMessageSms();
+        messageSms.setSmsBody(TEST_SMS_BODY);
+        messageSms.setSmsBodyPdus(TEST_SMS_BODY_PDUS);
+
+        assertThat(messageSms.getSmsBody()).isEqualTo(TEST_SMS_BODY);
+        assertThat(messageSms.mEncoding).isEqualTo(TEST_SMS_BODY_PDUS.get(0).getEncodingString());
+    }
+
+    @Test
+    public void parseMsgInit() {
+        BluetoothMapbMessageSms messageSms = new BluetoothMapbMessageSms();
+        messageSms.parseMsgInit();
+        assertThat(messageSms.getSmsBody()).isEqualTo("");
+    }
+
+    @Test
+    public void encodeToByteArray_thenAddByParsing() throws Exception {
+        BluetoothMapbMessageSms messageSmsToEncode = new BluetoothMapbMessageSms();
+        messageSmsToEncode.setType(BluetoothMapUtils.TYPE.SMS_GSM);
+        messageSmsToEncode.setFolder("placeholder");
+        messageSmsToEncode.setStatus(true);
+        messageSmsToEncode.setSmsBodyPdus(TEST_SMS_BODY_PDUS);
+
+        byte[] encodedMessageSms = messageSmsToEncode.encode();
+        InputStream inputStream = new ByteArrayInputStream(encodedMessageSms);
+
+        BluetoothMapbMessage messageParsed = BluetoothMapbMessage.parse(inputStream,
+                BluetoothMapAppParams.CHARSET_NATIVE);
+        assertThat(messageParsed).isInstanceOf(BluetoothMapbMessageSms.class);
+        BluetoothMapbMessageSms messageSmsParsed = (BluetoothMapbMessageSms) messageParsed;
+        assertThat(messageSmsParsed.getSmsBody()).isEqualTo(TEST_MESSAGE);
+    }
+
+    @Test
+    public void encodeToByteArray_withEmptyMessage_thenAddByParsing() throws Exception {
+        BluetoothMapbMessageSms messageSmsToEncode = new BluetoothMapbMessageSms();
+        messageSmsToEncode.setType(BluetoothMapUtils.TYPE.SMS_GSM);
+        messageSmsToEncode.setFolder("placeholder");
+        messageSmsToEncode.setStatus(true);
+
+        byte[] encodedMessageSms = messageSmsToEncode.encode();
+        InputStream inputStream = new ByteArrayInputStream(encodedMessageSms);
+
+        BluetoothMapbMessage messageParsed = BluetoothMapbMessage.parse(inputStream,
+                BluetoothMapAppParams.CHARSET_UTF8);
+        assertThat(messageParsed).isInstanceOf(BluetoothMapbMessageSms.class);
+        BluetoothMapbMessageSms messageSmsParsed = (BluetoothMapbMessageSms) messageParsed;
+        assertThat(messageSmsParsed.getSmsBody()).isEqualTo("");
+    }
+}
\ No newline at end of file
diff --git a/android/app/tests/unit/src/com/android/bluetooth/map/BluetoothMapbMessageTest.java b/android/app/tests/unit/src/com/android/bluetooth/map/BluetoothMapbMessageTest.java
new file mode 100644
index 0000000..2bc0e1a
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/map/BluetoothMapbMessageTest.java
@@ -0,0 +1,175 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.map;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import android.telephony.PhoneNumberUtils;
+
+import androidx.test.runner.AndroidJUnit4;
+
+import com.android.bluetooth.map.BluetoothMapUtils.TYPE;
+import com.android.bluetooth.map.BluetoothMapbMessage.VCard;
+
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+import java.io.ByteArrayInputStream;
+import java.io.InputStream;
+
+@RunWith(AndroidJUnit4.class)
+public class BluetoothMapbMessageTest {
+    private static final String TEST_VERSION_STRING = "1.0";
+    private static final boolean TEST_STATUS = true;
+    private static final TYPE TEST_TYPE = TYPE.IM;
+    private static final String TEST_FOLDER = "placeholder";
+    private static final String TEST_ENCODING = "test_encoding";
+
+    private static final String TEST_NAME = "test_name";
+    private static final String TEST_FORMATTED_NAME = "test_formatted_name";
+    private static final String TEST_FIRST_PHONE_NUMBER = "111-1111-1111";
+    private static final String[] TEST_PHONE_NUMBERS =
+            new String[]{TEST_FIRST_PHONE_NUMBER, "222-2222-2222"};
+    private static final String TEST_FIRST_EMAIL = "testFirst@email.com";
+    private static final String[] TEST_EMAIL_ADDRESSES =
+            new String[]{TEST_FIRST_EMAIL, "testSecond@email.com"};
+    private static final String TEST_FIRST_BT_UCI = "test_first_bt_uci";
+    private static final String[] TEST_BT_UCIS =
+            new String[]{TEST_FIRST_BT_UCI, "test_second_bt_uci"};
+    private static final String TEST_FIRST_BT_UID = "1111";
+    private static final String[] TEST_BT_UIDS = new String[]{TEST_FIRST_BT_UID, "1112"};
+
+    private static final VCard TEST_VCARD = new VCard(TEST_NAME, TEST_PHONE_NUMBERS,
+            TEST_EMAIL_ADDRESSES);
+
+    @Test
+    public void settersAndGetters() {
+        BluetoothMapbMessage messageMime = new BluetoothMapbMessageMime();
+        messageMime.setVersionString(TEST_VERSION_STRING);
+        messageMime.setStatus(TEST_STATUS);
+        messageMime.setType(TEST_TYPE);
+        messageMime.setFolder(TEST_FOLDER);
+        messageMime.setEncoding(TEST_ENCODING);
+        messageMime.setRecipient(TEST_VCARD);
+
+        assertThat(messageMime.getVersionString()).isEqualTo("VERSION:" + TEST_VERSION_STRING);
+        assertThat(messageMime.getType()).isEqualTo(TEST_TYPE);
+        assertThat(messageMime.getFolder()).isEqualTo("telecom/msg/" + TEST_FOLDER);
+        assertThat(messageMime.getRecipients().size()).isEqualTo(1);
+        assertThat(messageMime.getOriginators()).isNull();
+    }
+
+    @Test
+    public void setCompleteFolder() {
+        BluetoothMapbMessage messageMime = new BluetoothMapbMessageMime();
+        messageMime.setCompleteFolder(TEST_FOLDER);
+        assertThat(messageMime.getFolder()).isEqualTo(TEST_FOLDER);
+    }
+
+    @Test
+    public void addOriginator_forVCardVersionTwoPointOne() {
+        BluetoothMapbMessage messageMime = new BluetoothMapbMessageMime();
+        messageMime.addOriginator(TEST_NAME, TEST_PHONE_NUMBERS, TEST_EMAIL_ADDRESSES);
+        assertThat(messageMime.getOriginators().get(0).getName()).isEqualTo(TEST_NAME);
+        assertThat(messageMime.getOriginators().get(0).getFirstPhoneNumber()).isEqualTo(
+                PhoneNumberUtils.stripSeparators(TEST_FIRST_PHONE_NUMBER));
+        assertThat(messageMime.getOriginators().get(0).getFirstEmail()).isEqualTo(TEST_FIRST_EMAIL);
+    }
+
+    @Test
+    public void addOriginator_withVCardObject() {
+        BluetoothMapbMessage messageMime = new BluetoothMapbMessageMime();
+        messageMime.addOriginator(TEST_VCARD);
+        assertThat(messageMime.getOriginators().get(0)).isEqualTo(TEST_VCARD);
+    }
+
+    @Test
+    public void addOriginator_forVCardVersionThree() {
+        BluetoothMapbMessage messageMime = new BluetoothMapbMessageMime();
+        messageMime.addOriginator(TEST_NAME, TEST_FORMATTED_NAME, TEST_PHONE_NUMBERS,
+                TEST_EMAIL_ADDRESSES, TEST_BT_UIDS, TEST_BT_UCIS);
+        assertThat(messageMime.getOriginators().get(0).getName()).isEqualTo(TEST_NAME);
+        assertThat(messageMime.getOriginators().get(0).getFirstPhoneNumber()).isEqualTo(
+                PhoneNumberUtils.stripSeparators(TEST_FIRST_PHONE_NUMBER));
+        assertThat(messageMime.getOriginators().get(0).getFirstEmail()).isEqualTo(TEST_FIRST_EMAIL);
+        assertThat(messageMime.getOriginators().get(0).getFirstBtUci()).isEqualTo(
+                TEST_FIRST_BT_UCI);
+    }
+
+    @Test
+    public void addOriginator_forVCardVersionThree_withOnlyBtUcisAndBtUids() {
+        BluetoothMapbMessage messageMime = new BluetoothMapbMessageMime();
+        messageMime.addOriginator(TEST_BT_UCIS, TEST_BT_UIDS);
+        assertThat(messageMime.getOriginators().get(0).getFirstBtUci()).isEqualTo(
+                TEST_FIRST_BT_UCI);
+    }
+
+    @Test
+    public void addRecipient_forVCardVersionTwoPointOne() {
+        BluetoothMapbMessage messageMime = new BluetoothMapbMessageMime();
+        messageMime.addRecipient(TEST_NAME, TEST_PHONE_NUMBERS, TEST_EMAIL_ADDRESSES);
+        assertThat(messageMime.getRecipients().get(0).getName()).isEqualTo(TEST_NAME);
+        assertThat(messageMime.getRecipients().get(0).getFirstPhoneNumber()).isEqualTo(
+                PhoneNumberUtils.stripSeparators(TEST_FIRST_PHONE_NUMBER));
+        assertThat(messageMime.getRecipients().get(0).getFirstEmail()).isEqualTo(TEST_FIRST_EMAIL);
+    }
+
+    @Test
+    public void addRecipient_forVCardVersionThree() {
+        BluetoothMapbMessage messageMime = new BluetoothMapbMessageMime();
+        messageMime.addRecipient(TEST_NAME, TEST_FORMATTED_NAME, TEST_PHONE_NUMBERS,
+                TEST_EMAIL_ADDRESSES, TEST_BT_UIDS, TEST_BT_UCIS);
+        assertThat(messageMime.getRecipients().get(0).getName()).isEqualTo(TEST_NAME);
+        assertThat(messageMime.getRecipients().get(0).getFirstPhoneNumber()).isEqualTo(
+                PhoneNumberUtils.stripSeparators(TEST_FIRST_PHONE_NUMBER));
+        assertThat(messageMime.getRecipients().get(0).getFirstEmail()).isEqualTo(TEST_FIRST_EMAIL);
+        assertThat(messageMime.getRecipients().get(0).getFirstBtUci()).isEqualTo(TEST_FIRST_BT_UCI);
+    }
+
+    @Test
+    public void addRecipient_forVCardVersionThree_withOnlyBtUcisAndBtUids() {
+        BluetoothMapbMessage messageMime = new BluetoothMapbMessageMime();
+        messageMime.addRecipient(TEST_BT_UCIS, TEST_BT_UIDS);
+        assertThat(messageMime.getRecipients().get(0).getFirstBtUci()).isEqualTo(TEST_FIRST_BT_UCI);
+    }
+
+    @Test
+    public void encodeToByteArray_thenCreateByParsing_ReturnsCorrectly() throws Exception {
+        BluetoothMapbMessage messageMimeToEncode = new BluetoothMapbMessageMime();
+        messageMimeToEncode.setVersionString(TEST_VERSION_STRING);
+        messageMimeToEncode.setStatus(TEST_STATUS);
+        messageMimeToEncode.setType(TEST_TYPE);
+        messageMimeToEncode.setCompleteFolder(TEST_FOLDER);
+        messageMimeToEncode.setEncoding(TEST_ENCODING);
+        messageMimeToEncode.addOriginator(TEST_NAME, TEST_FORMATTED_NAME, TEST_PHONE_NUMBERS,
+                TEST_EMAIL_ADDRESSES, TEST_BT_UIDS, TEST_BT_UCIS);
+        messageMimeToEncode.addRecipient(TEST_NAME, TEST_FORMATTED_NAME, TEST_PHONE_NUMBERS,
+                TEST_EMAIL_ADDRESSES, TEST_BT_UIDS, TEST_BT_UCIS);
+
+        byte[] encodedMessageMime = messageMimeToEncode.encode();
+        InputStream inputStream = new ByteArrayInputStream(encodedMessageMime);
+
+        BluetoothMapbMessage messageMimeParsed = BluetoothMapbMessage.parse(inputStream, 1);
+        assertThat(messageMimeParsed.mAppParamCharset).isEqualTo(1);
+        assertThat(messageMimeParsed.getVersionString()).isEqualTo(
+                "VERSION:" + TEST_VERSION_STRING);
+        assertThat(messageMimeParsed.getType()).isEqualTo(TEST_TYPE);
+        assertThat(messageMimeParsed.getFolder()).isEqualTo(TEST_FOLDER);
+        assertThat(messageMimeParsed.getRecipients().size()).isEqualTo(1);
+        assertThat(messageMimeParsed.getOriginators().size()).isEqualTo(1);
+    }
+}
\ No newline at end of file
diff --git a/android/app/tests/unit/src/com/android/bluetooth/map/BluetoothMapbMessageVCardTest.java b/android/app/tests/unit/src/com/android/bluetooth/map/BluetoothMapbMessageVCardTest.java
new file mode 100644
index 0000000..8f108f5
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/map/BluetoothMapbMessageVCardTest.java
@@ -0,0 +1,119 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.map;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import android.telephony.PhoneNumberUtils;
+
+import androidx.test.runner.AndroidJUnit4;
+
+import com.android.bluetooth.map.BluetoothMapbMessage.BMsgReader;
+import com.android.bluetooth.map.BluetoothMapbMessage.VCard;
+
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+import java.io.ByteArrayInputStream;
+import java.io.InputStream;
+
+@RunWith(AndroidJUnit4.class)
+public class BluetoothMapbMessageVCardTest {
+    private static final String TEST_NAME = "test_name";
+    private static final String TEST_FORMATTED_NAME = "test_formatted_name";
+    private static final String TEST_FIRST_PHONE_NUMBER = "111-1111-1111";
+    private static final String[] TEST_PHONE_NUMBERS =
+            new String[]{TEST_FIRST_PHONE_NUMBER, "222-2222-2222"};
+    private static final String TEST_FIRST_EMAIL = "testFirst@email.com";
+    private static final String[] TEST_EMAIL_ADDRESSES =
+            new String[]{TEST_FIRST_EMAIL, "testSecond@email.com"};
+    private static final String TEST_FIRST_BT_UCI = "test_first_bt_uci";
+    private static final String[] TEST_BT_UCIS =
+            new String[]{TEST_FIRST_BT_UCI, "test_second_bt_uci"};
+    private static final String TEST_FIRST_BT_UID = "1111";
+    private static final String[] TEST_BT_UIDS = new String[]{TEST_FIRST_BT_UID, "1112"};
+    private static final int TEST_ENV_LEVEL = 1;
+
+    @Test
+    public void constructor_forVersionTwoPointOne() {
+        VCard vcard = new VCard(TEST_NAME, TEST_PHONE_NUMBERS, TEST_EMAIL_ADDRESSES);
+        assertThat(vcard.getName()).isEqualTo(TEST_NAME);
+        assertThat(vcard.getFirstPhoneNumber()).isEqualTo(
+                PhoneNumberUtils.stripSeparators(TEST_FIRST_PHONE_NUMBER));
+        assertThat(vcard.getFirstEmail()).isEqualTo(TEST_FIRST_EMAIL);
+    }
+
+    @Test
+    public void constructor_forVersionTwoPointOne_withEnvLevel() {
+        VCard vcard = new VCard(TEST_NAME, TEST_PHONE_NUMBERS, TEST_EMAIL_ADDRESSES,
+                TEST_ENV_LEVEL);
+        assertThat(vcard.getName()).isEqualTo(TEST_NAME);
+        assertThat(vcard.getFirstPhoneNumber()).isEqualTo(
+                PhoneNumberUtils.stripSeparators(TEST_FIRST_PHONE_NUMBER));
+        assertThat(vcard.getFirstEmail()).isEqualTo(TEST_FIRST_EMAIL);
+        assertThat(vcard.getEnvLevel()).isEqualTo(TEST_ENV_LEVEL);
+    }
+
+    @Test
+    public void constructor_forVersionThree() {
+        VCard vcard = new VCard(TEST_NAME, TEST_FORMATTED_NAME, TEST_PHONE_NUMBERS,
+                TEST_EMAIL_ADDRESSES, TEST_ENV_LEVEL);
+        assertThat(vcard.getName()).isEqualTo(TEST_NAME);
+        assertThat(vcard.getFirstPhoneNumber()).isEqualTo(
+                PhoneNumberUtils.stripSeparators(TEST_FIRST_PHONE_NUMBER));
+        assertThat(vcard.getFirstEmail()).isEqualTo(TEST_FIRST_EMAIL);
+        assertThat(vcard.getEnvLevel()).isEqualTo(TEST_ENV_LEVEL);
+    }
+
+    @Test
+    public void constructor_forVersionThree_withUcis() {
+        VCard vcard = new VCard(TEST_NAME, TEST_FORMATTED_NAME, TEST_PHONE_NUMBERS,
+                TEST_EMAIL_ADDRESSES, TEST_BT_UIDS, TEST_BT_UCIS);
+        assertThat(vcard.getName()).isEqualTo(TEST_NAME);
+        assertThat(vcard.getFirstPhoneNumber()).isEqualTo(
+                PhoneNumberUtils.stripSeparators(TEST_FIRST_PHONE_NUMBER));
+        assertThat(vcard.getFirstEmail()).isEqualTo(TEST_FIRST_EMAIL);
+        assertThat(vcard.getFirstBtUci()).isEqualTo(TEST_FIRST_BT_UCI);
+    }
+
+    @Test
+    public void getters_withInitWithNulls_returnsCorrectly() {
+        VCard vcard = new VCard(null, null, null);
+        assertThat(vcard.getName()).isEqualTo("");
+        assertThat(vcard.getFirstPhoneNumber()).isNull();
+        assertThat(vcard.getFirstEmail()).isNull();
+        assertThat(vcard.getFirstBtUci()).isNull();
+        assertThat(vcard.getFirstBtUid()).isNull();
+    }
+
+    @Test
+    public void encodeToStringBuilder_thenParseBackToVCard_returnsCorrectly() {
+        VCard vcardOriginal = new VCard(TEST_NAME, TEST_FORMATTED_NAME, TEST_PHONE_NUMBERS,
+                TEST_EMAIL_ADDRESSES, TEST_BT_UIDS, TEST_BT_UCIS);
+        StringBuilder stringBuilder = new StringBuilder();
+        vcardOriginal.encode(stringBuilder);
+        InputStream inputStream = new ByteArrayInputStream(stringBuilder.toString().getBytes());
+
+        VCard vcardParsed = VCard.parseVcard(new BMsgReader(inputStream), TEST_ENV_LEVEL);
+
+        assertThat(vcardParsed.getName()).isEqualTo(TEST_NAME);
+        assertThat(vcardParsed.getFirstPhoneNumber()).isEqualTo(
+                PhoneNumberUtils.stripSeparators(TEST_FIRST_PHONE_NUMBER));
+        assertThat(vcardParsed.getFirstEmail()).isEqualTo(TEST_FIRST_EMAIL);
+        assertThat(vcardParsed.getEnvLevel()).isEqualTo(TEST_ENV_LEVEL);
+    }
+}
\ No newline at end of file
diff --git a/android/app/tests/unit/src/com/android/bluetooth/map/ConvoContactInfoTest.java b/android/app/tests/unit/src/com/android/bluetooth/map/ConvoContactInfoTest.java
new file mode 100644
index 0000000..8703e8e
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/map/ConvoContactInfoTest.java
@@ -0,0 +1,68 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.map;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import android.database.MatrixCursor;
+
+import androidx.test.filters.SmallTest;
+import androidx.test.runner.AndroidJUnit4;
+
+import com.android.bluetooth.mapapi.BluetoothMapContract;
+
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+@SmallTest
+@RunWith(AndroidJUnit4.class)
+public class ConvoContactInfoTest {
+
+    @Test
+    public void setConvoColumns() {
+        BluetoothMapContentObserver.ConvoContactInfo info =
+                new BluetoothMapContentObserver.ConvoContactInfo();
+        MatrixCursor cursor = new MatrixCursor(
+                new String[]{BluetoothMapContract.ConvoContactColumns.CONVO_ID,
+                        BluetoothMapContract.ConvoContactColumns.NAME,
+                        BluetoothMapContract.ConvoContactColumns.NICKNAME,
+                        BluetoothMapContract.ConvoContactColumns.X_BT_UID,
+                        BluetoothMapContract.ConvoContactColumns.CHAT_STATE,
+                        BluetoothMapContract.ConvoContactColumns.UCI,
+                        BluetoothMapContract.ConvoContactColumns.LAST_ACTIVE,
+                        BluetoothMapContract.ConvoContactColumns.PRESENCE_STATE,
+                        BluetoothMapContract.ConvoContactColumns.STATUS_TEXT,
+                        BluetoothMapContract.ConvoContactColumns.PRIORITY,
+                        BluetoothMapContract.ConvoContactColumns.LAST_ONLINE});
+
+        info.setConvoColunms(cursor);
+
+        assertThat(info.mContactColConvoId).isEqualTo(0);
+        assertThat(info.mContactColName).isEqualTo(1);
+        assertThat(info.mContactColNickname).isEqualTo(2);
+        assertThat(info.mContactColBtUid).isEqualTo(3);
+        assertThat(info.mContactColChatState).isEqualTo(4);
+        assertThat(info.mContactColUci).isEqualTo(5);
+        assertThat(info.mContactColNickname).isEqualTo(2);
+        assertThat(info.mContactColLastActive).isEqualTo(6);
+        assertThat(info.mContactColName).isEqualTo(1);
+        assertThat(info.mContactColPresenceState).isEqualTo(7);
+        assertThat(info.mContactColPresenceText).isEqualTo(8);
+        assertThat(info.mContactColPriority).isEqualTo(9);
+        assertThat(info.mContactColLastOnline).isEqualTo(10);
+    }
+}
diff --git a/android/app/tests/unit/src/com/android/bluetooth/map/EventTest.java b/android/app/tests/unit/src/com/android/bluetooth/map/EventTest.java
new file mode 100644
index 0000000..12bb438
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/map/EventTest.java
@@ -0,0 +1,205 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.map;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;
+
+import android.content.Context;
+import android.os.Looper;
+import android.os.UserManager;
+import android.telephony.TelephonyManager;
+import android.test.mock.MockContentResolver;
+
+import androidx.test.filters.SmallTest;
+import androidx.test.runner.AndroidJUnit4;
+
+import com.android.bluetooth.map.BluetoothMapUtils.TYPE;
+import com.android.bluetooth.mapapi.BluetoothMapContract;
+
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+@SmallTest
+@RunWith(AndroidJUnit4.class)
+public class EventTest {
+    private static final String TEST_EVENT_TYPE = "test_event_type";
+    private static final long TEST_HANDLE = 1;
+    private static final String TEST_FOLDER = "test_folder";
+    private static final String TEST_OLD_FOLDER = "test_old_folder";
+    private static final TYPE TEST_TYPE = TYPE.EMAIL;
+    private static final String TEST_DATETIME = "20221207T16:35:21";
+    private static final String TEST_SUBJECT = "test_subject";
+    private static final String TEST_SENDER_NAME = "test_sender_name";
+    private static final String TEST_PRIORITY = "test_priority";
+    private static final long TEST_CONVERSATION_ID = 1;
+    private static final String TEST_CONVERSATION_NAME = "test_conversation_name";
+    private static final int TEST_PRESENCE_STATE = BluetoothMapContract.PresenceState.ONLINE;
+    private static final String TEST_PRESENCE_STATUS = "test_presence_status";
+    private static final int TEST_CHAT_STATE = BluetoothMapContract.ChatState.COMPOSING;
+    private static final String TEST_UCI = "test_uci";
+    private static final String TEST_NAME = "test_name";
+    private static final String TEST_LAST_ACTIVITY = "20211207T16:35:21";
+
+    private BluetoothMapContentObserver mObserver;
+    private BluetoothMapContentObserver.Event mEvent;
+
+    @Before
+    public void setUp() throws Exception {
+        if (Looper.myLooper() == null) {
+            Looper.prepare();
+        }
+        Context mockContext = mock(Context.class);
+        MockContentResolver mockResolver = new MockContentResolver();
+        BluetoothMapContentObserverTest.ExceptionTestProvider
+                mockProvider = new BluetoothMapContentObserverTest.ExceptionTestProvider(
+                mockContext);
+        mockResolver.addProvider("sms", mockProvider);
+
+        TelephonyManager mockTelephony = mock(TelephonyManager.class);
+        UserManager mockUserService = mock(UserManager.class);
+        BluetoothMapMasInstance mockMas = mock(BluetoothMapMasInstance.class);
+
+        // Functions that get called when BluetoothMapContentObserver is created
+        when(mockUserService.isUserUnlocked()).thenReturn(true);
+        when(mockContext.getContentResolver()).thenReturn(mockResolver);
+        when(mockContext.getSystemService(Context.TELEPHONY_SERVICE)).thenReturn(mockTelephony);
+        when(mockContext.getSystemServiceName(TelephonyManager.class))
+                .thenReturn(Context.TELEPHONY_SERVICE);
+        when(mockContext.getSystemService(Context.USER_SERVICE)).thenReturn(mockUserService);
+        mObserver = new BluetoothMapContentObserver(mockContext, null, mockMas, null, true);
+        mEvent = mObserver.new Event(TEST_EVENT_TYPE, TEST_HANDLE, TEST_FOLDER, TEST_TYPE);
+    }
+
+    @Test
+    public void constructor() {
+        BluetoothMapContentObserver.Event event = mObserver.new Event(TEST_EVENT_TYPE, TEST_HANDLE,
+                TEST_FOLDER, TEST_TYPE);
+
+        assertThat(event.eventType).isEqualTo(TEST_EVENT_TYPE);
+        assertThat(event.handle).isEqualTo(TEST_HANDLE);
+        assertThat(event.msgType).isEqualTo(TEST_TYPE);
+    }
+
+    @Test
+    public void constructor_withNullOldFolder() {
+        BluetoothMapContentObserver.Event event = mObserver.new Event(TEST_EVENT_TYPE, TEST_HANDLE,
+                TEST_FOLDER, null, TEST_TYPE);
+
+        assertThat(event.eventType).isEqualTo(TEST_EVENT_TYPE);
+        assertThat(event.handle).isEqualTo(TEST_HANDLE);
+        assertThat(event.oldFolder).isNull();
+        assertThat(event.msgType).isEqualTo(TEST_TYPE);
+    }
+
+    @Test
+    public void constructor_withNonNullOldFolder() {
+        BluetoothMapContentObserver.Event event = mObserver.new Event(TEST_EVENT_TYPE, TEST_HANDLE,
+                TEST_FOLDER, TEST_OLD_FOLDER, TEST_TYPE);
+
+        assertThat(event.eventType).isEqualTo(TEST_EVENT_TYPE);
+        assertThat(event.handle).isEqualTo(TEST_HANDLE);
+        assertThat(event.oldFolder).isEqualTo(TEST_OLD_FOLDER);
+        assertThat(event.msgType).isEqualTo(TEST_TYPE);
+    }
+
+    @Test
+    public void constructor_forExtendedEventTypeOnePointOne() {
+        BluetoothMapContentObserver.Event event = mObserver.new Event(TEST_EVENT_TYPE, TEST_HANDLE,
+                TEST_FOLDER, TEST_TYPE, TEST_DATETIME, TEST_SUBJECT, TEST_SENDER_NAME,
+                TEST_PRIORITY);
+
+        assertThat(event.eventType).isEqualTo(TEST_EVENT_TYPE);
+        assertThat(event.handle).isEqualTo(TEST_HANDLE);
+        assertThat(event.msgType).isEqualTo(TEST_TYPE);
+        assertThat(event.datetime).isEqualTo(TEST_DATETIME);
+        assertThat(event.subject).isEqualTo(BluetoothMapUtils.stripInvalidChars(TEST_SUBJECT));
+        assertThat(event.senderName).isEqualTo(
+                BluetoothMapUtils.stripInvalidChars(TEST_SENDER_NAME));
+        assertThat(event.priority).isEqualTo(TEST_PRIORITY);
+    }
+
+    @Test
+    public void constructor_forExtendedEventTypeOnePointTwo_withMessageEvents() {
+        BluetoothMapContentObserver.Event event = mObserver.new Event(TEST_EVENT_TYPE, TEST_HANDLE,
+                TEST_FOLDER, TEST_TYPE, TEST_DATETIME, TEST_SUBJECT, TEST_SENDER_NAME,
+                TEST_PRIORITY, TEST_CONVERSATION_ID, TEST_CONVERSATION_NAME);
+
+        assertThat(event.eventType).isEqualTo(TEST_EVENT_TYPE);
+        assertThat(event.handle).isEqualTo(TEST_HANDLE);
+        assertThat(event.msgType).isEqualTo(TEST_TYPE);
+        assertThat(event.datetime).isEqualTo(TEST_DATETIME);
+        assertThat(event.subject).isEqualTo(BluetoothMapUtils.stripInvalidChars(TEST_SUBJECT));
+        assertThat(event.senderName).isEqualTo(
+                BluetoothMapUtils.stripInvalidChars(TEST_SENDER_NAME));
+        assertThat(event.priority).isEqualTo(TEST_PRIORITY);
+        assertThat(event.conversationID).isEqualTo(TEST_CONVERSATION_ID);
+        assertThat(event.conversationName).isEqualTo(
+                BluetoothMapUtils.stripInvalidChars(TEST_CONVERSATION_NAME));
+    }
+
+    @Test
+    public void constructor_forExtendedEventTypeOnePointTwo_withConversationEvents() {
+        BluetoothMapContentObserver.Event event = mObserver.new Event(TEST_EVENT_TYPE, TEST_UCI,
+                TEST_TYPE, TEST_NAME, TEST_PRIORITY, TEST_LAST_ACTIVITY, TEST_CONVERSATION_ID,
+                TEST_CONVERSATION_NAME, TEST_PRESENCE_STATE, TEST_PRESENCE_STATUS, TEST_CHAT_STATE);
+
+        assertThat(event.eventType).isEqualTo(TEST_EVENT_TYPE);
+        assertThat(event.uci).isEqualTo(TEST_UCI);
+        assertThat(event.msgType).isEqualTo(TEST_TYPE);
+        assertThat(event.senderName).isEqualTo(BluetoothMapUtils.stripInvalidChars(TEST_NAME));
+        assertThat(event.priority).isEqualTo(TEST_PRIORITY);
+        assertThat(event.datetime).isEqualTo(TEST_LAST_ACTIVITY);
+        assertThat(event.conversationID).isEqualTo(TEST_CONVERSATION_ID);
+        assertThat(event.conversationName).isEqualTo(
+                BluetoothMapUtils.stripInvalidChars(TEST_CONVERSATION_NAME));
+        assertThat(event.presenceState).isEqualTo(TEST_PRESENCE_STATE);
+        assertThat(event.presenceStatus).isEqualTo(
+                BluetoothMapUtils.stripInvalidChars(TEST_PRESENCE_STATUS));
+        assertThat(event.chatState).isEqualTo(TEST_CHAT_STATE);
+    }
+
+    @Test
+    public void setFolderPath_withNullName() {
+        mEvent.setFolderPath(null, null);
+
+        assertThat(mEvent.folder).isNull();
+    }
+
+    @Test
+    public void setFolderPath_withNonNullNameAndTypeIm() {
+        String name = "name";
+        TYPE type = TYPE.IM;
+
+        mEvent.setFolderPath(name, type);
+
+        assertThat(mEvent.folder).isEqualTo(name);
+    }
+
+    @Test
+    public void setFolderPath_withNonNullNameAndTypeMms() {
+        String name = "name";
+        TYPE type = TYPE.MMS;
+
+        mEvent.setFolderPath(name, type);
+
+        assertThat(mEvent.folder).isEqualTo(BluetoothMapContentObserver.Event.PATH + name);
+    }
+}
diff --git a/android/app/tests/unit/src/com/android/bluetooth/map/FilterInfoTest.java b/android/app/tests/unit/src/com/android/bluetooth/map/FilterInfoTest.java
new file mode 100644
index 0000000..3c1a0c0
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/map/FilterInfoTest.java
@@ -0,0 +1,192 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.map;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import android.database.MatrixCursor;
+import android.provider.BaseColumns;
+import android.provider.Telephony.Mms;
+import android.provider.Telephony.Sms;
+
+import androidx.test.filters.SmallTest;
+import androidx.test.runner.AndroidJUnit4;
+
+import com.android.bluetooth.mapapi.BluetoothMapContract;
+
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+@SmallTest
+@RunWith(AndroidJUnit4.class)
+public class FilterInfoTest {
+    private BluetoothMapContent.FilterInfo mFilterInfo;
+
+    @Before
+    public void setUp() {
+        mFilterInfo = new BluetoothMapContent.FilterInfo();
+    }
+
+    @Test
+    public void setMessageColumns() {
+        MatrixCursor cursor = new MatrixCursor(new String[] {
+                BluetoothMapContract.MessageColumns._ID,
+                BluetoothMapContract.MessageColumns.DATE,
+                BluetoothMapContract.MessageColumns.SUBJECT,
+                BluetoothMapContract.MessageColumns.FOLDER_ID,
+                BluetoothMapContract.MessageColumns.FLAG_READ,
+                BluetoothMapContract.MessageColumns.MESSAGE_SIZE,
+                BluetoothMapContract.MessageColumns.FROM_LIST,
+                BluetoothMapContract.MessageColumns.TO_LIST,
+                BluetoothMapContract.MessageColumns.FLAG_ATTACHMENT,
+                BluetoothMapContract.MessageColumns.ATTACHMENT_SIZE,
+                BluetoothMapContract.MessageColumns.FLAG_HIGH_PRIORITY,
+                BluetoothMapContract.MessageColumns.FLAG_PROTECTED,
+                BluetoothMapContract.MessageColumns.RECEPTION_STATE,
+                BluetoothMapContract.MessageColumns.DEVILERY_STATE,
+                BluetoothMapContract.MessageColumns.THREAD_ID});
+
+        mFilterInfo.setMessageColumns(cursor);
+
+        assertThat(mFilterInfo.mMessageColId).isEqualTo(0);
+        assertThat(mFilterInfo.mMessageColDate).isEqualTo(1);
+        assertThat(mFilterInfo.mMessageColSubject).isEqualTo(2);
+        assertThat(mFilterInfo.mMessageColFolder).isEqualTo(3);
+        assertThat(mFilterInfo.mMessageColRead).isEqualTo(4);
+        assertThat(mFilterInfo.mMessageColSize).isEqualTo(5);
+        assertThat(mFilterInfo.mMessageColFromAddress).isEqualTo(6);
+        assertThat(mFilterInfo.mMessageColToAddress).isEqualTo(7);
+        assertThat(mFilterInfo.mMessageColAttachment).isEqualTo(8);
+        assertThat(mFilterInfo.mMessageColAttachmentSize).isEqualTo(9);
+        assertThat(mFilterInfo.mMessageColPriority).isEqualTo(10);
+        assertThat(mFilterInfo.mMessageColProtected).isEqualTo(11);
+        assertThat(mFilterInfo.mMessageColReception).isEqualTo(12);
+        assertThat(mFilterInfo.mMessageColDelivery).isEqualTo(13);
+        assertThat(mFilterInfo.mMessageColThreadId).isEqualTo(14);
+    }
+
+    @Test
+    public void setEmailMessageColumns() {
+        MatrixCursor cursor = new MatrixCursor(
+                new String[] {BluetoothMapContract.MessageColumns.CC_LIST,
+                        BluetoothMapContract.MessageColumns.BCC_LIST,
+                        BluetoothMapContract.MessageColumns.REPLY_TO_LIST});
+
+        mFilterInfo.setEmailMessageColumns(cursor);
+
+        assertThat(mFilterInfo.mMessageColCcAddress).isEqualTo(0);
+        assertThat(mFilterInfo.mMessageColBccAddress).isEqualTo(1);
+        assertThat(mFilterInfo.mMessageColReplyTo).isEqualTo(2);
+    }
+
+    @Test
+    public void setImMessageColumns() {
+        MatrixCursor cursor = new MatrixCursor(
+                new String[] {BluetoothMapContract.MessageColumns.THREAD_NAME,
+                        BluetoothMapContract.MessageColumns.ATTACHMENT_MINE_TYPES,
+                        BluetoothMapContract.MessageColumns.BODY});
+
+        mFilterInfo.setImMessageColumns(cursor);
+
+        assertThat(mFilterInfo.mMessageColThreadName).isEqualTo(0);
+        assertThat(mFilterInfo.mMessageColAttachmentMime).isEqualTo(1);
+        assertThat(mFilterInfo.mMessageColBody).isEqualTo(2);
+    }
+
+    @Test
+    public void setEmailImConvoColumns() {
+        MatrixCursor cursor = new MatrixCursor(
+                new String[] {BluetoothMapContract.ConversationColumns.THREAD_ID,
+                        BluetoothMapContract.ConversationColumns.LAST_THREAD_ACTIVITY,
+                        BluetoothMapContract.ConversationColumns.THREAD_NAME,
+                        BluetoothMapContract.ConversationColumns.READ_STATUS,
+                        BluetoothMapContract.ConversationColumns.VERSION_COUNTER,
+                        BluetoothMapContract.ConversationColumns.SUMMARY});
+
+        mFilterInfo.setEmailImConvoColumns(cursor);
+
+        assertThat(mFilterInfo.mConvoColConvoId).isEqualTo(0);
+        assertThat(mFilterInfo.mConvoColLastActivity).isEqualTo(1);
+        assertThat(mFilterInfo.mConvoColName).isEqualTo(2);
+        assertThat(mFilterInfo.mConvoColRead).isEqualTo(3);
+        assertThat(mFilterInfo.mConvoColVersionCounter).isEqualTo(4);
+        assertThat(mFilterInfo.mConvoColSummary).isEqualTo(5);
+    }
+
+    @Test
+    public void setEmailImConvoContactColumns() {
+        MatrixCursor cursor = new MatrixCursor(
+                new String[] {BluetoothMapContract.ConvoContactColumns.X_BT_UID,
+                        BluetoothMapContract.ConvoContactColumns.CHAT_STATE,
+                        BluetoothMapContract.ConvoContactColumns.UCI,
+                        BluetoothMapContract.ConvoContactColumns.NICKNAME,
+                        BluetoothMapContract.ConvoContactColumns.LAST_ACTIVE,
+                        BluetoothMapContract.ConvoContactColumns.NAME,
+                        BluetoothMapContract.ConvoContactColumns.PRESENCE_STATE,
+                        BluetoothMapContract.ConvoContactColumns.STATUS_TEXT,
+                        BluetoothMapContract.ConvoContactColumns.PRIORITY});
+
+        mFilterInfo.setEmailImConvoContactColumns(cursor);
+
+        assertThat(mFilterInfo.mContactColBtUid).isEqualTo(0);
+        assertThat(mFilterInfo.mContactColChatState).isEqualTo(1);
+        assertThat(mFilterInfo.mContactColContactUci).isEqualTo(2);
+        assertThat(mFilterInfo.mContactColNickname).isEqualTo(3);
+        assertThat(mFilterInfo.mContactColLastActive).isEqualTo(4);
+        assertThat(mFilterInfo.mContactColName).isEqualTo(5);
+        assertThat(mFilterInfo.mContactColPresenceState).isEqualTo(6);
+        assertThat(mFilterInfo.mContactColPresenceText).isEqualTo(7);
+        assertThat(mFilterInfo.mContactColPriority).isEqualTo(8);
+    }
+
+    @Test
+    public void setSmsColumns() {
+        MatrixCursor cursor = new MatrixCursor(new String[]{BaseColumns._ID, Sms.TYPE, Sms.READ,
+                Sms.BODY, Sms.ADDRESS, Sms.DATE, Sms.THREAD_ID});
+
+        mFilterInfo.setSmsColumns(cursor);
+
+        assertThat(mFilterInfo.mSmsColId).isEqualTo(0);
+        assertThat(mFilterInfo.mSmsColFolder).isEqualTo(1);
+        assertThat(mFilterInfo.mSmsColRead).isEqualTo(2);
+        assertThat(mFilterInfo.mSmsColSubject).isEqualTo(3);
+        assertThat(mFilterInfo.mSmsColAddress).isEqualTo(4);
+        assertThat(mFilterInfo.mSmsColDate).isEqualTo(5);
+        assertThat(mFilterInfo.mSmsColType).isEqualTo(1);
+        assertThat(mFilterInfo.mSmsColThreadId).isEqualTo(6);
+    }
+
+    @Test
+    public void setMmsColumns() {
+        MatrixCursor cursor = new MatrixCursor(
+                new String[] {BaseColumns._ID, Mms.MESSAGE_BOX, Mms.READ, Mms.MESSAGE_SIZE,
+                        Mms.TEXT_ONLY, Mms.DATE, Mms.SUBJECT, Mms.THREAD_ID});
+
+        mFilterInfo.setMmsColumns(cursor);
+
+        assertThat(mFilterInfo.mMmsColId).isEqualTo(0);
+        assertThat(mFilterInfo.mMmsColFolder).isEqualTo(1);
+        assertThat(mFilterInfo.mMmsColRead).isEqualTo(2);
+        assertThat(mFilterInfo.mMmsColAttachmentSize).isEqualTo(3);
+        assertThat(mFilterInfo.mMmsColTextOnly).isEqualTo(4);
+        assertThat(mFilterInfo.mMmsColSize).isEqualTo(3);
+        assertThat(mFilterInfo.mMmsColDate).isEqualTo(5);
+        assertThat(mFilterInfo.mMmsColSubject).isEqualTo(6);
+        assertThat(mFilterInfo.mMmsColThreadId).isEqualTo(7);
+    }
+}
diff --git a/android/app/tests/unit/src/com/android/bluetooth/map/MapContactTest.java b/android/app/tests/unit/src/com/android/bluetooth/map/MapContactTest.java
new file mode 100644
index 0000000..9195ead
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/map/MapContactTest.java
@@ -0,0 +1,79 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.map;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import androidx.test.filters.SmallTest;
+import androidx.test.runner.AndroidJUnit4;
+
+import com.android.bluetooth.SignedLongLong;
+
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+@SmallTest
+@RunWith(AndroidJUnit4.class)
+public class MapContactTest {
+    private static final long TEST_NON_ZERO_ID = 1;
+    private static final long TEST_ZERO_ID = 0;
+    private static final String TEST_NAME = "test_name";
+
+    @Test
+    public void constructor() {
+        MapContact contact = MapContact.create(TEST_NON_ZERO_ID, TEST_NAME);
+
+        assertThat(contact.getId()).isEqualTo(TEST_NON_ZERO_ID);
+        assertThat(contact.getName()).isEqualTo(TEST_NAME);
+    }
+
+    @Test
+    public void getXBtUidString_withZeroId() {
+        MapContact contact = MapContact.create(TEST_ZERO_ID, TEST_NAME);
+
+        assertThat(contact.getXBtUidString()).isNull();
+    }
+
+    @Test
+    public void getXBtUidString_withNonZeroId() {
+        MapContact contact = MapContact.create(TEST_NON_ZERO_ID, TEST_NAME);
+
+        assertThat(contact.getXBtUidString()).isEqualTo(
+                BluetoothMapUtils.getLongLongAsString(TEST_NON_ZERO_ID, 0));
+    }
+
+    @Test
+    public void getXBtUid_withZeroId() {
+        MapContact contact = MapContact.create(TEST_ZERO_ID, TEST_NAME);
+
+        assertThat(contact.getXBtUid()).isNull();
+    }
+
+    @Test
+    public void getXBtUid_withNonZeroId() {
+        MapContact contact = MapContact.create(TEST_NON_ZERO_ID, TEST_NAME);
+
+        assertThat(contact.getXBtUid()).isEqualTo(new SignedLongLong(TEST_NON_ZERO_ID, 0));
+    }
+
+    @Test
+    public void toString_returnsName() {
+        MapContact contact = MapContact.create(TEST_NON_ZERO_ID, TEST_NAME);
+
+        assertThat(contact.toString()).isEqualTo(TEST_NAME);
+    }
+}
diff --git a/android/app/tests/unit/src/com/android/bluetooth/map/MsgTest.java b/android/app/tests/unit/src/com/android/bluetooth/map/MsgTest.java
new file mode 100644
index 0000000..9e68fa6
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/map/MsgTest.java
@@ -0,0 +1,99 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.map;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import androidx.test.filters.SmallTest;
+import androidx.test.runner.AndroidJUnit4;
+
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+@SmallTest
+@RunWith(AndroidJUnit4.class)
+public class MsgTest {
+    private static final long TEST_ID = 1;
+    private static final long TEST_FOLDER_ID = 1;
+    private static final int TEST_READ_FLAG = 1;
+
+    @Test
+    public void constructor() {
+        BluetoothMapContentObserver.Msg msg = new BluetoothMapContentObserver.Msg(TEST_ID,
+                TEST_FOLDER_ID, TEST_READ_FLAG);
+
+        assertThat(msg.id).isEqualTo(TEST_ID);
+        assertThat(msg.folderId).isEqualTo(TEST_FOLDER_ID);
+        assertThat(msg.flagRead).isEqualTo(TEST_READ_FLAG);
+    }
+
+    @Test
+    public void hashCode_returnsExpectedResult() {
+        BluetoothMapContentObserver.Msg msg = new BluetoothMapContentObserver.Msg(TEST_ID,
+                TEST_FOLDER_ID, TEST_READ_FLAG);
+
+        int expected = 31 + (int) (TEST_ID ^ (TEST_ID >>> 32));
+        assertThat(msg.hashCode()).isEqualTo(expected);
+    }
+
+    @Test
+    public void equals_withSameInstance() {
+        BluetoothMapContentObserver.Msg msg = new BluetoothMapContentObserver.Msg(TEST_ID,
+                TEST_FOLDER_ID, TEST_READ_FLAG);
+
+        assertThat(msg.equals(msg)).isTrue();
+    }
+
+    @Test
+    public void equals_withNull() {
+        BluetoothMapContentObserver.Msg msg = new BluetoothMapContentObserver.Msg(TEST_ID,
+                TEST_FOLDER_ID, TEST_READ_FLAG);
+
+        assertThat(msg).isNotNull();
+    }
+
+    @Test
+    public void equals_withDifferentClass() {
+        BluetoothMapContentObserver.Msg msg = new BluetoothMapContentObserver.Msg(TEST_ID,
+                TEST_FOLDER_ID, TEST_READ_FLAG);
+        String msgOfDifferentClass = "msg_of_different_class";
+
+        assertThat(msg).isNotEqualTo(msgOfDifferentClass);
+    }
+
+    @Test
+    public void equals_withDifferentId() {
+        long idOne = 1;
+        long idTwo = 2;
+        BluetoothMapContentObserver.Msg msg = new BluetoothMapContentObserver.Msg(idOne,
+                TEST_FOLDER_ID, TEST_READ_FLAG);
+        BluetoothMapContentObserver.Msg msgWithDifferentId = new BluetoothMapContentObserver.Msg(
+                idTwo, TEST_FOLDER_ID, TEST_READ_FLAG);
+
+        assertThat(msg).isNotEqualTo(msgWithDifferentId);
+    }
+
+    @Test
+    public void equals_withEqualInstance() {
+        BluetoothMapContentObserver.Msg msg = new BluetoothMapContentObserver.Msg(TEST_ID,
+                TEST_FOLDER_ID, TEST_READ_FLAG);
+        BluetoothMapContentObserver.Msg msgWithSameId = new BluetoothMapContentObserver.Msg(TEST_ID,
+                TEST_FOLDER_ID, TEST_READ_FLAG);
+
+        assertThat(msg).isEqualTo(msgWithSameId);
+    }
+}
diff --git a/android/app/tests/unit/src/com/android/bluetooth/map/SmsMmsContactsTest.java b/android/app/tests/unit/src/com/android/bluetooth/map/SmsMmsContactsTest.java
new file mode 100644
index 0000000..c65053e
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/map/SmsMmsContactsTest.java
@@ -0,0 +1,192 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.map;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import static org.mockito.Mockito.any;
+import static org.mockito.Mockito.doReturn;
+
+import android.content.ContentResolver;
+import android.database.MatrixCursor;
+
+import androidx.test.filters.SmallTest;
+import androidx.test.runner.AndroidJUnit4;
+
+import com.android.bluetooth.BluetoothMethodProxy;
+
+import org.junit.After;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.Mock;
+import org.mockito.MockitoAnnotations;
+import org.mockito.Spy;
+
+@SmallTest
+@RunWith(AndroidJUnit4.class)
+public class SmsMmsContactsTest {
+    private static final long TEST_ID = 1;
+    private static final String TEST_NAME = "test_name";
+    private static final String TEST_PHONE_NUMBER = "111-1111-1111";
+    private static final String TEST_PHONE = "test_phone";
+    private static final String TEST_CONTACT_NAME_FILTER = "test_contact_name_filter";
+
+    @Mock
+    private ContentResolver mResolver;
+    @Spy
+    private BluetoothMethodProxy mMapMethodProxy = BluetoothMethodProxy.getInstance();
+
+    private SmsMmsContacts mContacts;
+
+    @Before
+    public void setUp() throws Exception {
+        MockitoAnnotations.initMocks(this);
+        BluetoothMethodProxy.setInstanceForTesting(mMapMethodProxy);
+        mContacts = new SmsMmsContacts();
+    }
+
+    @After
+    public void tearDown() throws Exception {
+        BluetoothMethodProxy.setInstanceForTesting(null);
+    }
+
+    @Test
+    public void getPhoneNumberUncached_withNonEmptyCursor() {
+        MatrixCursor cursor = new MatrixCursor(new String[]{"COL_ARRR_ID", "COL_ADDR_ADDR"});
+        cursor.addRow(new Object[]{null, TEST_PHONE_NUMBER});
+        doReturn(cursor).when(mMapMethodProxy).contentResolverQuery(any(), any(), any(), any(),
+                any(), any());
+
+        assertThat(SmsMmsContacts.getPhoneNumberUncached(mResolver, TEST_ID)).isEqualTo(
+                TEST_PHONE_NUMBER);
+    }
+
+    @Test
+    public void getPhoneNumberUncached_withEmptyCursor() {
+        MatrixCursor cursor = new MatrixCursor(new String[]{});
+        doReturn(cursor).when(mMapMethodProxy).contentResolverQuery(any(), any(), any(), any(),
+                any(), any());
+
+        assertThat(SmsMmsContacts.getPhoneNumberUncached(mResolver, TEST_ID)).isNull();
+    }
+
+    @Test
+    public void fillPhoneCache() {
+        MatrixCursor cursor = new MatrixCursor(new String[]{"COL_ADDR_ID", "COL_ADDR_ADDR"});
+        cursor.addRow(new Object[]{TEST_ID, TEST_PHONE_NUMBER});
+        doReturn(cursor).when(mMapMethodProxy).contentResolverQuery(any(), any(), any(), any(),
+                any(), any());
+
+        mContacts.fillPhoneCache(mResolver);
+
+        assertThat(mContacts.getPhoneNumber(mResolver, TEST_ID)).isEqualTo(TEST_PHONE_NUMBER);
+    }
+
+    @Test
+    public void fillPhoneCache_withNonNullPhoneNumbers() {
+        MatrixCursor cursor = new MatrixCursor(new String[]{"COL_ADDR_ID", "COL_ADDR_ADDR"});
+        cursor.addRow(new Object[]{TEST_ID, TEST_PHONE_NUMBER});
+        doReturn(cursor).when(mMapMethodProxy).contentResolverQuery(any(), any(), any(), any(),
+                any(), any());
+
+        mContacts.fillPhoneCache(mResolver);
+        assertThat(mContacts.getPhoneNumber(mResolver, TEST_ID)).isEqualTo(TEST_PHONE_NUMBER);
+        doReturn(null).when(mMapMethodProxy).contentResolverQuery(any(), any(), any(), any(),
+                any(), any());
+        mContacts.fillPhoneCache(mResolver);
+
+        assertThat(mContacts.getPhoneNumber(mResolver, TEST_ID)).isNull();
+    }
+
+    @Test
+    public void clearCache() {
+        MatrixCursor cursor = new MatrixCursor(new String[]{"COL_ADDR_ID", "COL_ADDR_ADDR"});
+        cursor.addRow(new Object[]{TEST_ID, TEST_PHONE_NUMBER});
+        doReturn(cursor).when(mMapMethodProxy).contentResolverQuery(any(), any(), any(), any(),
+                any(), any());
+        MapContact contact = MapContact.create(TEST_ID, TEST_PHONE);
+
+        mContacts.mNames.put(TEST_PHONE, contact);
+        mContacts.fillPhoneCache(mResolver);
+        assertThat(mContacts.getPhoneNumber(mResolver, TEST_ID)).isEqualTo(TEST_PHONE_NUMBER);
+        mContacts.clearCache();
+
+        doReturn(null).when(mMapMethodProxy).contentResolverQuery(any(), any(), any(), any(),
+                any(), any());
+        assertThat(mContacts.mNames).isEmpty();
+        assertThat(mContacts.getPhoneNumber(mResolver, TEST_ID)).isEqualTo(null);
+    }
+
+    @Test
+    public void getContactNameFromPhone_withNonNullCursor() {
+        MatrixCursor cursor = new MatrixCursor(new String[]{"COL_CONTACT_ID", "COL_CONTACT_NAME"});
+        cursor.addRow(new Object[]{TEST_ID, TEST_NAME});
+        doReturn(cursor).when(mMapMethodProxy).contentResolverQuery(any(), any(), any(), any(),
+                any(), any());
+
+        MapContact expected = MapContact.create(TEST_ID, TEST_NAME);
+        assertThat(mContacts.getContactNameFromPhone(TEST_PHONE, mResolver,
+                TEST_CONTACT_NAME_FILTER).toString()).isEqualTo(expected.toString());
+    }
+
+    @Test
+    public void getContactNameFromPhone_withNullCursor() {
+        doReturn(null).when(mMapMethodProxy).contentResolverQuery(any(), any(), any(), any(),
+                any(), any());
+
+        assertThat(mContacts.getContactNameFromPhone(TEST_PHONE, mResolver,
+                TEST_CONTACT_NAME_FILTER)).isNull();
+    }
+
+    @Test
+    public void getContactNameFromPhone_withNoParameterForContactNameFilter() {
+        doReturn(null).when(mMapMethodProxy).contentResolverQuery(any(), any(), any(), any(),
+                any(), any());
+
+        assertThat(mContacts.getContactNameFromPhone(TEST_PHONE, mResolver)).isNull();
+    }
+
+    @Test
+    public void getContactNameFromPhone_withNonNullContact_andZeroId() {
+        long zeroId = 0;
+        MapContact contact = MapContact.create(zeroId, TEST_PHONE);
+        mContacts.mNames.put(TEST_PHONE, contact);
+
+        assertThat(mContacts.getContactNameFromPhone(TEST_PHONE, mResolver,
+                TEST_CONTACT_NAME_FILTER)).isNull();
+    }
+
+    @Test
+    public void getContactNameFromPhone_withNonNullContact_andNullFilter() {
+        MapContact contact = MapContact.create(TEST_ID, TEST_PHONE);
+        mContacts.mNames.put(TEST_PHONE, contact);
+
+        assertThat(mContacts.getContactNameFromPhone(TEST_PHONE, mResolver, null)).isEqualTo(
+                contact);
+    }
+
+    @Test
+    public void getContactNameFromPhone_withNonNullContact_andNonMatchingFilter() {
+        MapContact contact = MapContact.create(TEST_ID, TEST_PHONE);
+        mContacts.mNames.put(TEST_PHONE, contact);
+        String nonMatchingFilter = "non_matching_filter";
+
+        assertThat(mContacts.getContactNameFromPhone(TEST_PHONE, mResolver,
+                nonMatchingFilter)).isNull();
+    }
+}
diff --git a/android/app/tests/unit/src/com/android/bluetooth/mapapi/BluetoothMapContractTest.java b/android/app/tests/unit/src/com/android/bluetooth/mapapi/BluetoothMapContractTest.java
new file mode 100644
index 0000000..0a34f88
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/mapapi/BluetoothMapContractTest.java
@@ -0,0 +1,127 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.mapapi;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import android.net.Uri;
+
+import androidx.test.runner.AndroidJUnit4;
+
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+@RunWith(AndroidJUnit4.class)
+public class BluetoothMapContractTest {
+
+    private static final String TEST_AUTHORITY = "com.test";
+    private static final String ACCOUNT_ID = "test_account_id";
+    private static final String MESSAGE_ID = "test_message_id";
+    private static final String CONTACT_ID = "test_contact_id";
+
+    @Test
+    public void testBuildAccountUri() {
+        final String expectedUriString = "content://" + TEST_AUTHORITY + "/"
+                + BluetoothMapContract.TABLE_ACCOUNT;
+
+        Uri result = BluetoothMapContract.buildAccountUri(TEST_AUTHORITY);
+        assertThat(result.toString()).isEqualTo(expectedUriString);
+    }
+
+    @Test
+    public void testBuildAccountUriWithId() {
+        final String expectedUriString = "content://" + TEST_AUTHORITY + "/"
+                + BluetoothMapContract.TABLE_ACCOUNT + "/" + ACCOUNT_ID;
+
+        Uri result = BluetoothMapContract.buildAccountUriwithId(TEST_AUTHORITY, ACCOUNT_ID);
+        assertThat(result.toString()).isEqualTo(expectedUriString);
+    }
+
+    @Test
+    public void testBuildMessageUri() {
+        final String expectedUriString = "content://" + TEST_AUTHORITY + "/"
+                + BluetoothMapContract.TABLE_MESSAGE;
+
+        Uri result = BluetoothMapContract.buildMessageUri(TEST_AUTHORITY);
+        assertThat(result.toString()).isEqualTo(expectedUriString);
+    }
+
+    @Test
+    public void testBuildMessageUri_withAccountId() {
+        final String expectedUriString = "content://" + TEST_AUTHORITY + "/"
+                + ACCOUNT_ID + "/" + BluetoothMapContract.TABLE_MESSAGE;
+
+        Uri result = BluetoothMapContract.buildMessageUri(TEST_AUTHORITY, ACCOUNT_ID);
+        assertThat(result.toString()).isEqualTo(expectedUriString);
+    }
+
+    @Test
+    public void testBuildMessageUriWithId() {
+        final String expectedUriString = "content://" + TEST_AUTHORITY + "/"
+                + ACCOUNT_ID + "/" + BluetoothMapContract.TABLE_MESSAGE + "/" + MESSAGE_ID;
+
+        Uri result = BluetoothMapContract.buildMessageUriWithId(
+                TEST_AUTHORITY, ACCOUNT_ID, MESSAGE_ID);
+        assertThat(result.toString()).isEqualTo(expectedUriString);
+    }
+
+    @Test
+    public void testBuildFolderUri() {
+        final String expectedUriString = "content://" + TEST_AUTHORITY + "/"
+                + ACCOUNT_ID + "/" + BluetoothMapContract.TABLE_FOLDER;
+
+        Uri result = BluetoothMapContract.buildFolderUri(TEST_AUTHORITY, ACCOUNT_ID);
+        assertThat(result.toString()).isEqualTo(expectedUriString);
+    }
+
+    @Test
+    public void testBuildConversationUri() {
+        final String expectedUriString = "content://" + TEST_AUTHORITY + "/"
+                + ACCOUNT_ID + "/" + BluetoothMapContract.TABLE_CONVERSATION;
+
+        Uri result = BluetoothMapContract.buildConversationUri(TEST_AUTHORITY, ACCOUNT_ID);
+        assertThat(result.toString()).isEqualTo(expectedUriString);
+    }
+
+    @Test
+    public void testBuildConvoContactsUri() {
+        final String expectedUriString = "content://" + TEST_AUTHORITY + "/"
+                + BluetoothMapContract.TABLE_CONVOCONTACT;
+
+        Uri result = BluetoothMapContract.buildConvoContactsUri(TEST_AUTHORITY);
+        assertThat(result.toString()).isEqualTo(expectedUriString);
+    }
+
+    @Test
+    public void testBuildConvoContactsUri_withAccountId() {
+        final String expectedUriString = "content://" + TEST_AUTHORITY + "/"
+                + ACCOUNT_ID + "/" + BluetoothMapContract.TABLE_CONVOCONTACT;
+
+        Uri result = BluetoothMapContract.buildConvoContactsUri(TEST_AUTHORITY, ACCOUNT_ID);
+        assertThat(result.toString()).isEqualTo(expectedUriString);
+    }
+
+    @Test
+    public void testBuildConvoContactsUriWithId() {
+        final String expectedUriString = "content://" + TEST_AUTHORITY + "/"
+                + ACCOUNT_ID + "/" + BluetoothMapContract.TABLE_CONVOCONTACT + "/" + CONTACT_ID;
+
+        Uri result = BluetoothMapContract.buildConvoContactsUriWithId(
+                TEST_AUTHORITY, ACCOUNT_ID, CONTACT_ID);
+        assertThat(result.toString()).isEqualTo(expectedUriString);
+    }
+}
diff --git a/android/app/tests/unit/src/com/android/bluetooth/mapapi/BluetoothMapEmailProviderTest.java b/android/app/tests/unit/src/com/android/bluetooth/mapapi/BluetoothMapEmailProviderTest.java
new file mode 100644
index 0000000..0ef6e4e
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/mapapi/BluetoothMapEmailProviderTest.java
@@ -0,0 +1,444 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.mapapi;
+
+import static com.google.common.truth.Truth.assertThat;
+import static com.google.common.truth.Truth.assertWithMessage;
+
+import static org.junit.Assert.assertThrows;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.eq;
+import static org.mockito.Mockito.verify;
+
+import android.content.ContentResolver;
+import android.content.ContentValues;
+import android.content.Context;
+import android.content.pm.ProviderInfo;
+import android.database.Cursor;
+import android.net.Uri;
+import android.os.Bundle;
+
+import androidx.test.InstrumentationRegistry;
+import androidx.test.runner.AndroidJUnit4;
+
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.MockitoAnnotations;
+import org.mockito.Spy;
+
+import java.io.FileInputStream;
+import java.io.FileOutputStream;
+import java.io.IOException;
+
+@RunWith(AndroidJUnit4.class)
+public class BluetoothMapEmailProviderTest {
+
+    private static final String AUTHORITY = "com.test";
+    private static final String ACCOUNT_ID = "12345";
+    private static final String MESSAGE_ID = "987654321";
+    private static final String FOLDER_ID = "6789";
+
+    private Context mContext;
+
+    @Spy
+    private BluetoothMapEmailProvider mProvider = new TestBluetoothMapEmailProvider();
+
+    @Before
+    public void setUp() throws Exception {
+        MockitoAnnotations.initMocks(this);
+        mContext = InstrumentationRegistry.getTargetContext();
+    }
+
+    @Test
+    public void attachInfo_whenProviderIsNotExported() throws Exception {
+        ProviderInfo providerInfo = new ProviderInfo();
+        providerInfo.authority = AUTHORITY;
+        providerInfo.exported = false;
+
+        assertThrows(SecurityException.class,
+                () -> mProvider.attachInfo(mContext, providerInfo));
+    }
+
+    @Test
+    public void attachInfo_whenNoPermission() throws Exception {
+        ProviderInfo providerInfo = new ProviderInfo();
+        providerInfo.authority = AUTHORITY;
+        providerInfo.exported = true;
+        providerInfo.writePermission = "some.random.permission";
+
+        assertThrows(SecurityException.class,
+                () -> mProvider.attachInfo(mContext, providerInfo));
+    }
+
+    @Test
+    public void attachInfo_success() throws Exception {
+        ProviderInfo providerInfo = new ProviderInfo();
+        providerInfo.authority = AUTHORITY;
+        providerInfo.exported = true;
+        providerInfo.writePermission = android.Manifest.permission.BLUETOOTH_MAP;
+
+        try {
+            mProvider.attachInfo(mContext, providerInfo);
+        } catch (Exception e) {
+            assertWithMessage("Exception should not happen.").fail();
+        }
+    }
+
+    @Test
+    public void getType() throws Exception {
+        try {
+            mProvider.getType(/*uri=*/ null);
+        } catch (Exception e) {
+            assertWithMessage("Exception should not happen.").fail();
+        }
+    }
+
+    @Test
+    public void delete_whenTableNameIsWrong() throws Exception {
+        Uri uriWithWrongTable = new Uri.Builder().scheme(ContentResolver.SCHEME_CONTENT)
+                .authority(AUTHORITY)
+                .appendPath(ACCOUNT_ID)
+                .appendPath("some_random_table_name")
+                .appendPath(MESSAGE_ID)
+                .build();
+
+        // No rows are impacted.
+        assertThat(mProvider.delete(uriWithWrongTable, /*where=*/null, /*selectionArgs=*/null))
+                .isEqualTo(0);
+    }
+
+    @Test
+    public void delete_success() throws Exception {
+        Uri messageUri = new Uri.Builder().scheme(ContentResolver.SCHEME_CONTENT)
+                .authority(AUTHORITY)
+                .appendPath(ACCOUNT_ID)
+                .appendPath(BluetoothMapContract.TABLE_MESSAGE)
+                .appendPath(MESSAGE_ID)
+                .build();
+
+        mProvider.delete(messageUri, /*where=*/null, /*selectionArgs=*/null);
+        verify(mProvider).deleteMessage(ACCOUNT_ID, MESSAGE_ID);
+    }
+
+    @Test
+    public void insert_whenFolderIdIsNull() throws Exception {
+        Uri messageUri = new Uri.Builder().scheme(ContentResolver.SCHEME_CONTENT)
+                .authority(AUTHORITY)
+                .appendPath(ACCOUNT_ID)
+                .appendPath(BluetoothMapContract.TABLE_MESSAGE)
+                .build();
+        // ContentValues doses not have folder ID.
+        ContentValues values = new ContentValues();
+
+        assertThrows(IllegalArgumentException.class, () -> mProvider.insert(messageUri, values));
+    }
+
+    @Test
+    public void insert_whenTableNameIsWrong() throws Exception {
+        Uri uriWithWrongTable = new Uri.Builder().scheme(ContentResolver.SCHEME_CONTENT)
+                .authority(AUTHORITY)
+                .appendPath(ACCOUNT_ID)
+                .appendPath("some_random_table_name")
+                .build();
+        ContentValues values = new ContentValues();
+        values.put(BluetoothMapContract.MessageColumns.FOLDER_ID, Long.parseLong(FOLDER_ID));
+
+        assertThat(mProvider.insert(uriWithWrongTable, values)).isNull();
+    }
+
+    @Test
+    public void insert_success() throws Exception {
+        Uri messageUri = new Uri.Builder().scheme(ContentResolver.SCHEME_CONTENT)
+                .authority(AUTHORITY)
+                .appendPath(ACCOUNT_ID)
+                .appendPath(BluetoothMapContract.TABLE_MESSAGE)
+                .build();
+
+        ContentValues values = new ContentValues();
+        values.put(BluetoothMapContract.MessageColumns.FOLDER_ID, Long.parseLong(FOLDER_ID));
+
+        mProvider.insert(messageUri, values);
+        verify(mProvider).insertMessage(ACCOUNT_ID, FOLDER_ID);
+    }
+
+    @Test
+    public void query_forAccountUri() {
+        ProviderInfo providerInfo = new ProviderInfo();
+        providerInfo.authority = AUTHORITY;
+        providerInfo.exported = true;
+        providerInfo.writePermission = android.Manifest.permission.BLUETOOTH_MAP;
+        mProvider.attachInfo(mContext, providerInfo);
+
+        Uri accountUri = new Uri.Builder().scheme(ContentResolver.SCHEME_CONTENT)
+                .authority(AUTHORITY)
+                .appendPath(BluetoothMapContract.TABLE_ACCOUNT)
+                .build();
+
+        mProvider.query(accountUri, /*projection=*/ null, /*selection=*/ null,
+                /*selectionArgs=*/ null, /*sortOrder=*/ null);
+        verify(mProvider).queryAccount(any(), any(), any(), any());
+    }
+
+    @Test
+    public void query_forFolderUri() {
+        ProviderInfo providerInfo = new ProviderInfo();
+        providerInfo.authority = AUTHORITY;
+        providerInfo.exported = true;
+        providerInfo.writePermission = android.Manifest.permission.BLUETOOTH_MAP;
+        mProvider.attachInfo(mContext, providerInfo);
+
+        Uri folderUri = new Uri.Builder().scheme(ContentResolver.SCHEME_CONTENT)
+                .authority(AUTHORITY)
+                .appendPath(ACCOUNT_ID)
+                .appendPath(BluetoothMapContract.TABLE_FOLDER)
+                .build();
+
+        mProvider.query(folderUri, /*projection=*/ null, /*selection=*/ null,
+                /*selectionArgs=*/ null, /*sortOrder=*/ null);
+        verify(mProvider).queryFolder(eq(ACCOUNT_ID), any(), any(), any(), any());
+    }
+
+    @Test
+    public void query_forMessageUri() {
+        ProviderInfo providerInfo = new ProviderInfo();
+        providerInfo.authority = AUTHORITY;
+        providerInfo.exported = true;
+        providerInfo.writePermission = android.Manifest.permission.BLUETOOTH_MAP;
+        mProvider.attachInfo(mContext, providerInfo);
+
+        Uri messageUri = new Uri.Builder().scheme(ContentResolver.SCHEME_CONTENT)
+                .authority(AUTHORITY)
+                .appendPath(ACCOUNT_ID)
+                .appendPath(BluetoothMapContract.TABLE_MESSAGE)
+                .build();
+
+        mProvider.query(messageUri, /*projection=*/ null, /*selection=*/ null,
+                /*selectionArgs=*/ null, /*sortOrder=*/ null);
+        verify(mProvider).queryMessage(eq(ACCOUNT_ID), any(), any(), any(), any());
+    }
+
+    @Test
+    public void update_whenTableIsNull() {
+        Uri uriWithoutTable = new Uri.Builder().scheme(ContentResolver.SCHEME_CONTENT)
+                .authority(AUTHORITY)
+                .build();
+        ContentValues values = new ContentValues();
+
+        assertThrows(IllegalArgumentException.class,
+                () -> mProvider.update(uriWithoutTable, values, /*selection=*/ null,
+                        /*selectionArgs=*/ null));
+    }
+
+    @Test
+    public void update_whenSelectionIsNotNull() {
+        Uri uriWithTable = new Uri.Builder().scheme(ContentResolver.SCHEME_CONTENT)
+                .authority(AUTHORITY)
+                .appendPath(ACCOUNT_ID)
+                .appendPath(BluetoothMapContract.TABLE_ACCOUNT)
+                .build();
+        ContentValues values = new ContentValues();
+
+        String nonNullSelection = "id = 1234";
+
+        assertThrows(IllegalArgumentException.class,
+                () -> mProvider.update(uriWithTable, values, nonNullSelection,
+                        /*selectionArgs=*/ null));
+    }
+
+    @Test
+    public void update_forAccountUri_success() {
+        Uri accountUri = new Uri.Builder().scheme(ContentResolver.SCHEME_CONTENT)
+                .authority(AUTHORITY)
+                .appendPath(ACCOUNT_ID)
+                .appendPath(BluetoothMapContract.TABLE_ACCOUNT)
+                .build();
+
+        ContentValues values = new ContentValues();
+        final int flagValue = 1;
+        values.put(BluetoothMapContract.AccountColumns._ID, ACCOUNT_ID);
+        values.put(BluetoothMapContract.AccountColumns.FLAG_EXPOSE, flagValue);
+
+        mProvider.update(accountUri, values, /*selection=*/ null, /*selectionArgs=*/ null);
+        verify(mProvider).updateAccount(ACCOUNT_ID, flagValue);
+    }
+
+    @Test
+    public void update_forFolderUri() {
+        Uri folderUri = new Uri.Builder().scheme(ContentResolver.SCHEME_CONTENT)
+                .authority(AUTHORITY)
+                .appendPath(ACCOUNT_ID)
+                .appendPath(BluetoothMapContract.TABLE_FOLDER)
+                .build();
+
+        assertThat(mProvider.update(
+                folderUri, /*values=*/ null, /*selection=*/ null, /*selectionArgs=*/ null))
+                .isEqualTo(0);
+    }
+
+    @Test
+    public void update_forMessageUri_success() {
+        Uri accountUri = new Uri.Builder().scheme(ContentResolver.SCHEME_CONTENT)
+                .authority(AUTHORITY)
+                .appendPath(ACCOUNT_ID)
+                .appendPath(BluetoothMapContract.TABLE_MESSAGE)
+                .build();
+
+        ContentValues values = new ContentValues();
+        final boolean flagRead = true;
+        values.put(BluetoothMapContract.MessageColumns._ID, MESSAGE_ID);
+        values.put(BluetoothMapContract.MessageColumns.FOLDER_ID, Long.parseLong(FOLDER_ID));
+        values.put(BluetoothMapContract.MessageColumns.FLAG_READ, flagRead);
+
+        mProvider.update(accountUri, values, /*selection=*/ null, /*selectionArgs=*/ null);
+        verify(mProvider).updateMessage(
+                ACCOUNT_ID, Long.parseLong(MESSAGE_ID), Long.parseLong(FOLDER_ID), flagRead);
+    }
+
+    @Test
+    public void call_whenMethodIsWrong() {
+        String method = "some_random_method";
+        assertThat(mProvider.call(method, /*arg=*/ null, /*extras=*/ null)).isNull();
+    }
+
+    @Test
+    public void call_whenExtrasDoesNotHaveAccountId() {
+        Bundle extras = new Bundle();
+        extras.putLong(BluetoothMapContract.EXTRA_UPDATE_FOLDER_ID, 12345);
+
+        assertThat(mProvider.call(BluetoothMapContract.METHOD_UPDATE_FOLDER, /*arg=*/ null, extras))
+                .isNull();
+    }
+
+    @Test
+    public void call_whenExtrasDoesNotHaveFolderId() {
+        Bundle extras = new Bundle();
+        extras.putLong(BluetoothMapContract.EXTRA_UPDATE_ACCOUNT_ID, 12345);
+
+        assertThat(mProvider.call(BluetoothMapContract.METHOD_UPDATE_FOLDER, /*arg=*/ null, extras))
+                .isNull();
+    }
+
+    @Test
+    public void call_success() {
+        Bundle extras = new Bundle();
+        extras.putLong(BluetoothMapContract.EXTRA_UPDATE_ACCOUNT_ID, Long.parseLong(ACCOUNT_ID));
+        extras.putLong(BluetoothMapContract.EXTRA_UPDATE_FOLDER_ID, Long.parseLong(FOLDER_ID));
+
+        mProvider.call(BluetoothMapContract.METHOD_UPDATE_FOLDER, /*arg=*/ null, extras);
+        verify(mProvider).syncFolder(Long.parseLong(ACCOUNT_ID), Long.parseLong(FOLDER_ID));
+    }
+
+    @Test
+    public void shutdown() {
+        try {
+            mProvider.shutdown();
+        } catch (Exception e) {
+            assertWithMessage("Exception should not happen.").fail();
+        }
+    }
+
+    @Test
+    public void getAccountId_whenNotEnoughPathSegments() {
+        Uri uri = new Uri.Builder().scheme(ContentResolver.SCHEME_CONTENT)
+                .authority(AUTHORITY)
+                .build();
+
+        assertThrows(IllegalArgumentException.class,
+                () -> BluetoothMapEmailProvider.getAccountId(uri));
+    }
+
+    @Test
+    public void getAccountId_success() {
+        Uri messageUri = new Uri.Builder().scheme(ContentResolver.SCHEME_CONTENT)
+                .authority(AUTHORITY)
+                .appendPath(ACCOUNT_ID)
+                .appendPath(BluetoothMapContract.TABLE_MESSAGE)
+                .appendPath(MESSAGE_ID)
+                .build();
+
+        assertThat(BluetoothMapEmailProvider.getAccountId(messageUri)).isEqualTo(ACCOUNT_ID);
+    }
+
+    public static class TestBluetoothMapEmailProvider extends BluetoothMapEmailProvider {
+        @Override
+        protected void WriteMessageToStream(long accountId, long messageId,
+                boolean includeAttachment, boolean download, FileOutputStream out)
+                throws IOException {
+        }
+
+        @Override
+        protected Uri getContentUri() {
+            return null;
+        }
+
+        @Override
+        protected void UpdateMimeMessageFromStream(FileInputStream input, long accountId,
+                long messageId) throws IOException {
+        }
+
+        @Override
+        protected int deleteMessage(String accountId, String messageId) {
+            return 0;
+        }
+
+        @Override
+        protected String insertMessage(String accountId, String folderId) {
+            return null;
+        }
+
+        @Override
+        protected Cursor queryAccount(String[] projection, String selection, String[] selectionArgs,
+                String sortOrder) {
+            return null;
+        }
+
+        @Override
+        protected Cursor queryFolder(String accountId, String[] projection, String selection,
+                String[] selectionArgs, String sortOrder) {
+            return null;
+        }
+
+        @Override
+        protected Cursor queryMessage(String accountId, String[] projection, String selection,
+                String[] selectionArgs, String sortOrder) {
+            return null;
+        }
+
+        @Override
+        protected int updateAccount(String accountId, int flagExpose) {
+            return 0;
+        }
+
+        @Override
+        protected int updateMessage(String accountId, Long messageId, Long folderId,
+                Boolean flagRead) {
+            return 0;
+        }
+
+        @Override
+        protected int syncFolder(long accountId, long folderId) {
+            return 0;
+        }
+
+        @Override
+        public boolean onCreate() {
+            return true;
+        }
+    };
+
+}
diff --git a/android/app/tests/unit/src/com/android/bluetooth/mapapi/BluetoothMapIMProviderTest.java b/android/app/tests/unit/src/com/android/bluetooth/mapapi/BluetoothMapIMProviderTest.java
new file mode 100644
index 0000000..f57fb56
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/mapapi/BluetoothMapIMProviderTest.java
@@ -0,0 +1,672 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.mapapi;
+
+import static com.google.common.truth.Truth.assertThat;
+import static com.google.common.truth.Truth.assertWithMessage;
+
+import static org.junit.Assert.assertThrows;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.eq;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.spy;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.doReturn;
+
+import android.content.ContentResolver;
+import android.content.ContentValues;
+import android.content.Context;
+import android.content.pm.ProviderInfo;
+import android.database.Cursor;
+import android.net.Uri;
+import android.os.Bundle;
+import android.util.Log;
+
+import android.content.ContextWrapper;
+
+import org.mockito.Mockito;
+
+import androidx.test.InstrumentationRegistry;
+import androidx.test.runner.AndroidJUnit4;
+
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.MockitoAnnotations;
+import org.mockito.Spy;
+
+import java.time.Instant;
+import java.util.Set;
+import java.util.Map;
+import java.util.HashMap;
+import java.util.HashSet;
+import java.util.AbstractMap;
+
+@RunWith(AndroidJUnit4.class)
+public class BluetoothMapIMProviderTest {
+
+    private static final String TAG = "MapIMProviderTest";
+
+    private static final String AUTHORITY = "com.test";
+    private static final String ACCOUNT_ID = "12345";
+    private static final String MESSAGE_ID = "987654321";
+    private static final String FOLDER_ID = "6789";
+
+    private Context mContext;
+
+    @Spy
+    private BluetoothMapIMProvider mProvider = new TestBluetoothMapIMProvider();
+
+    @Before
+    public void setUp() throws Exception {
+        MockitoAnnotations.initMocks(this);
+        mContext = InstrumentationRegistry.getTargetContext();
+    }
+
+    @Test
+    public void attachInfo_whenProviderIsNotExported() throws Exception {
+        ProviderInfo providerInfo = new ProviderInfo();
+        providerInfo.authority = AUTHORITY;
+        providerInfo.exported = false;
+
+        assertThrows(SecurityException.class,
+                () -> mProvider.attachInfo(mContext, providerInfo));
+    }
+
+    @Test
+    public void attachInfo_whenNoPermission() throws Exception {
+        ProviderInfo providerInfo = new ProviderInfo();
+        providerInfo.authority = AUTHORITY;
+        providerInfo.exported = true;
+        providerInfo.writePermission = "some.random.permission";
+
+        assertThrows(SecurityException.class,
+                () -> mProvider.attachInfo(mContext, providerInfo));
+    }
+
+    @Test
+    public void attachInfo_success() throws Exception {
+        ProviderInfo providerInfo = new ProviderInfo();
+        providerInfo.authority = AUTHORITY;
+        providerInfo.exported = true;
+        providerInfo.writePermission = android.Manifest.permission.BLUETOOTH_MAP;
+
+        try {
+            mProvider.attachInfo(mContext, providerInfo);
+        } catch (Exception e) {
+            assertWithMessage("Exception should not happen.").fail();
+        }
+    }
+
+    @Test
+    public void getType() throws Exception {
+        try {
+            mProvider.getType(/*uri=*/ null);
+        } catch (Exception e) {
+            assertWithMessage("Exception should not happen.").fail();
+        }
+    }
+
+    @Test
+    public void delete_whenTableNameIsWrong() throws Exception {
+        Uri uriWithWrongTable = new Uri.Builder().scheme(ContentResolver.SCHEME_CONTENT)
+                .authority(AUTHORITY)
+                .appendPath(ACCOUNT_ID)
+                .appendPath("some_random_table_name")
+                .appendPath(MESSAGE_ID)
+                .build();
+
+        // No rows are impacted.
+        assertThat(mProvider.delete(uriWithWrongTable, /*where=*/null, /*selectionArgs=*/null))
+                .isEqualTo(0);
+    }
+
+    @Test
+    public void delete_success() throws Exception {
+        Uri messageUri = new Uri.Builder().scheme(ContentResolver.SCHEME_CONTENT)
+                .authority(AUTHORITY)
+                .appendPath(ACCOUNT_ID)
+                .appendPath(BluetoothMapContract.TABLE_MESSAGE)
+                .appendPath(MESSAGE_ID)
+                .build();
+
+        mProvider.delete(messageUri, /*where=*/null, /*selectionArgs=*/null);
+        verify(mProvider).deleteMessage(ACCOUNT_ID, MESSAGE_ID);
+    }
+
+    @Test
+    public void insert_whenTableNameIsWrong() throws Exception {
+        Uri uriWithWrongTable = new Uri.Builder().scheme(ContentResolver.SCHEME_CONTENT)
+                .authority(AUTHORITY)
+                .appendPath(ACCOUNT_ID)
+                .appendPath("some_random_table_name")
+                .build();
+        ContentValues values = new ContentValues();
+        values.put(BluetoothMapContract.MessageColumns.FOLDER_ID, Long.parseLong(FOLDER_ID));
+
+        assertThat(mProvider.insert(uriWithWrongTable, values)).isNull();
+    }
+
+    @Test
+    public void insert_success() throws Exception {
+        Uri messageUri = new Uri.Builder().scheme(ContentResolver.SCHEME_CONTENT)
+                .authority(AUTHORITY)
+                .appendPath(ACCOUNT_ID)
+                .appendPath(BluetoothMapContract.TABLE_MESSAGE)
+                .build();
+
+        ContentValues values = new ContentValues();
+        values.put(BluetoothMapContract.MessageColumns.FOLDER_ID, Long.parseLong(FOLDER_ID));
+
+        mProvider.insert(messageUri, values);
+        verify(mProvider).insertMessage(ACCOUNT_ID, values);
+    }
+
+    @Test
+    public void query_forAccountUri() {
+        ProviderInfo providerInfo = new ProviderInfo();
+        providerInfo.authority = AUTHORITY;
+        providerInfo.exported = true;
+        providerInfo.writePermission = android.Manifest.permission.BLUETOOTH_MAP;
+        mProvider.attachInfo(mContext, providerInfo);
+
+        Uri accountUri = new Uri.Builder().scheme(ContentResolver.SCHEME_CONTENT)
+                .authority(AUTHORITY)
+                .appendPath(BluetoothMapContract.TABLE_ACCOUNT)
+                .build();
+
+        mProvider.query(accountUri, /*projection=*/ null, /*selection=*/ null,
+                /*selectionArgs=*/ null, /*sortOrder=*/ null);
+        verify(mProvider).queryAccount(any(), any(), any(), any());
+    }
+
+    @Test
+    public void query_forMessageUri() {
+        ProviderInfo providerInfo = new ProviderInfo();
+        providerInfo.authority = AUTHORITY;
+        providerInfo.exported = true;
+        providerInfo.writePermission = android.Manifest.permission.BLUETOOTH_MAP;
+        mProvider.attachInfo(mContext, providerInfo);
+
+        Uri messageUri = new Uri.Builder().scheme(ContentResolver.SCHEME_CONTENT)
+                .authority(AUTHORITY)
+                .appendPath(ACCOUNT_ID)
+                .appendPath(BluetoothMapContract.TABLE_MESSAGE)
+                .build();
+
+        mProvider.query(messageUri, /*projection=*/ null, /*selection=*/ null,
+                /*selectionArgs=*/ null, /*sortOrder=*/ null);
+        verify(mProvider).queryMessage(eq(ACCOUNT_ID), any(), any(), any(), any());
+    }
+
+    @Test
+    public void query_forConversationUri() {
+        ProviderInfo providerInfo = new ProviderInfo();
+        providerInfo.authority = AUTHORITY;
+        providerInfo.exported = true;
+        providerInfo.writePermission = android.Manifest.permission.BLUETOOTH_MAP;
+        mProvider.attachInfo(mContext, providerInfo);
+
+        final long threadId = 1;
+        final boolean read = true;
+        final long periodEnd = 100;
+        final long periodBegin = 10;
+        final String searchString = "sample_search_query";
+
+        Uri conversationUri = new Uri.Builder().scheme(ContentResolver.SCHEME_CONTENT)
+                .authority(AUTHORITY)
+                .appendPath(ACCOUNT_ID)
+                .appendPath(BluetoothMapContract.TABLE_CONVERSATION)
+                .appendQueryParameter(BluetoothMapContract.FILTER_ORIGINATOR_SUBSTRING,
+                        searchString)
+                .appendQueryParameter(BluetoothMapContract.FILTER_PERIOD_BEGIN,
+                        Long.toString(periodBegin))
+                .appendQueryParameter(BluetoothMapContract.FILTER_PERIOD_END,
+                        Long.toString(periodEnd))
+                .appendQueryParameter(BluetoothMapContract.FILTER_READ_STATUS,
+                        Boolean.toString(read))
+                .appendQueryParameter(BluetoothMapContract.FILTER_THREAD_ID,
+                        Long.toString(threadId))
+                .build();
+
+        mProvider.query(conversationUri, /*projection=*/ null, /*selection=*/ null,
+                /*selectionArgs=*/ null, /*sortOrder=*/ null);
+        verify(mProvider).queryConversation(eq(ACCOUNT_ID), eq(threadId), eq(read), eq(periodEnd),
+                eq(periodBegin), eq(searchString), any(), any());
+    }
+
+    @Test
+    public void query_forConvoContactUri() {
+        ProviderInfo providerInfo = new ProviderInfo();
+        providerInfo.authority = AUTHORITY;
+        providerInfo.exported = true;
+        providerInfo.writePermission = android.Manifest.permission.BLUETOOTH_MAP;
+        mProvider.attachInfo(mContext, providerInfo);
+
+        Uri convoContactUri = new Uri.Builder().scheme(ContentResolver.SCHEME_CONTENT)
+                .authority(AUTHORITY)
+                .appendPath(ACCOUNT_ID)
+                .appendPath(BluetoothMapContract.TABLE_CONVOCONTACT)
+                .build();
+
+        mProvider.query(convoContactUri, /*projection=*/ null, /*selection=*/ null,
+                /*selectionArgs=*/ null, /*sortOrder=*/ null);
+        verify(mProvider).queryConvoContact(eq(ACCOUNT_ID), any(), any(), any(), any(), any());
+    }
+
+    @Test
+    public void update_whenTableIsNull() {
+        Uri uriWithoutTable = new Uri.Builder().scheme(ContentResolver.SCHEME_CONTENT)
+                .authority(AUTHORITY)
+                .build();
+        ContentValues values = new ContentValues();
+
+        assertThrows(IllegalArgumentException.class,
+                () -> mProvider.update(uriWithoutTable, values, /*selection=*/ null,
+                        /*selectionArgs=*/ null));
+    }
+
+    @Test
+    public void update_whenSelectionIsNotNull() {
+        Uri uriWithTable = new Uri.Builder().scheme(ContentResolver.SCHEME_CONTENT)
+                .authority(AUTHORITY)
+                .appendPath(ACCOUNT_ID)
+                .appendPath(BluetoothMapContract.TABLE_ACCOUNT)
+                .build();
+        ContentValues values = new ContentValues();
+
+        String nonNullSelection = "id = 1234";
+
+        assertThrows(IllegalArgumentException.class,
+                () -> mProvider.update(uriWithTable, values, nonNullSelection,
+                        /*selectionArgs=*/ null));
+    }
+
+    @Test
+    public void update_forAccountUri_success() {
+        Uri accountUri = new Uri.Builder().scheme(ContentResolver.SCHEME_CONTENT)
+                .authority(AUTHORITY)
+                .appendPath(ACCOUNT_ID)
+                .appendPath(BluetoothMapContract.TABLE_ACCOUNT)
+                .build();
+
+        ContentValues values = new ContentValues();
+        final int flagValue = 1;
+        values.put(BluetoothMapContract.AccountColumns._ID, ACCOUNT_ID);
+        values.put(BluetoothMapContract.AccountColumns.FLAG_EXPOSE, flagValue);
+
+        mProvider.update(accountUri, values, /*selection=*/ null, /*selectionArgs=*/ null);
+        verify(mProvider).updateAccount(ACCOUNT_ID, flagValue);
+    }
+
+    @Test
+    public void update_forFolderUri() {
+        Uri folderUri = new Uri.Builder().scheme(ContentResolver.SCHEME_CONTENT)
+                .authority(AUTHORITY)
+                .appendPath(ACCOUNT_ID)
+                .appendPath(BluetoothMapContract.TABLE_FOLDER)
+                .build();
+
+        assertThat(mProvider.update(
+                folderUri, /*values=*/ null, /*selection=*/ null, /*selectionArgs=*/ null))
+                .isEqualTo(0);
+    }
+
+    @Test
+    public void update_forConversationUri() {
+        Uri folderUri = new Uri.Builder().scheme(ContentResolver.SCHEME_CONTENT)
+                .authority(AUTHORITY)
+                .appendPath(ACCOUNT_ID)
+                .appendPath(BluetoothMapContract.TABLE_CONVERSATION)
+                .build();
+
+        assertThat(mProvider.update(
+                folderUri, /*values=*/ null, /*selection=*/ null, /*selectionArgs=*/ null))
+                .isEqualTo(0);
+    }
+
+    @Test
+    public void update_forConvoContactUri() {
+        Uri folderUri = new Uri.Builder().scheme(ContentResolver.SCHEME_CONTENT)
+                .authority(AUTHORITY)
+                .appendPath(ACCOUNT_ID)
+                .appendPath(BluetoothMapContract.TABLE_CONVOCONTACT)
+                .build();
+
+        assertThat(mProvider.update(
+                folderUri, /*values=*/ null, /*selection=*/ null, /*selectionArgs=*/ null))
+                .isEqualTo(0);
+    }
+
+    @Test
+    public void update_forMessageUri_success() {
+        Uri accountUri = new Uri.Builder().scheme(ContentResolver.SCHEME_CONTENT)
+                .authority(AUTHORITY)
+                .appendPath(ACCOUNT_ID)
+                .appendPath(BluetoothMapContract.TABLE_MESSAGE)
+                .build();
+
+        ContentValues values = new ContentValues();
+        final boolean flagRead = true;
+        values.put(BluetoothMapContract.MessageColumns._ID, MESSAGE_ID);
+        values.put(BluetoothMapContract.MessageColumns.FOLDER_ID, Long.parseLong(FOLDER_ID));
+        values.put(BluetoothMapContract.MessageColumns.FLAG_READ, flagRead);
+
+        mProvider.update(accountUri, values, /*selection=*/ null, /*selectionArgs=*/ null);
+        verify(mProvider).updateMessage(
+                ACCOUNT_ID, Long.parseLong(MESSAGE_ID), Long.parseLong(FOLDER_ID), flagRead);
+    }
+
+    @Test
+    public void call_whenMethodIsWrong() {
+        String method = "some_random_method";
+        assertThat(mProvider.call(method, /*arg=*/ null, /*extras=*/ null)).isNull();
+    }
+
+    @Test
+    public void call_updateFolderMethod_whenExtrasDoesNotHaveAccountId() {
+        Bundle extras = new Bundle();
+        extras.putLong(BluetoothMapContract.EXTRA_UPDATE_FOLDER_ID, 12345);
+
+        assertThat(mProvider.call(BluetoothMapContract.METHOD_UPDATE_FOLDER, /*arg=*/ null, extras))
+                .isNull();
+    }
+
+    @Test
+    public void call_updateFolderMethod_whenExtrasDoesNotHaveFolderId() {
+        Bundle extras = new Bundle();
+        extras.putLong(BluetoothMapContract.EXTRA_UPDATE_ACCOUNT_ID, 12345);
+
+        assertThat(mProvider.call(BluetoothMapContract.METHOD_UPDATE_FOLDER, /*arg=*/ null, extras))
+                .isNull();
+    }
+
+    @Test
+    public void call_updateFolderMethod_success() {
+        Bundle extras = new Bundle();
+        extras.putLong(BluetoothMapContract.EXTRA_UPDATE_ACCOUNT_ID, Long.parseLong(ACCOUNT_ID));
+        extras.putLong(BluetoothMapContract.EXTRA_UPDATE_FOLDER_ID, Long.parseLong(FOLDER_ID));
+
+        mProvider.call(BluetoothMapContract.METHOD_UPDATE_FOLDER, /*arg=*/ null, extras);
+        verify(mProvider).syncFolder(Long.parseLong(ACCOUNT_ID), Long.parseLong(FOLDER_ID));
+    }
+
+    @Test
+    public void call_setOwnerStatusMethod_success() {
+        final int presenceState = 1;
+        final String presenceStatus = Integer.toString(3); // 0x0000 to 0x00FF
+        final long lastActive = Instant.now().toEpochMilli();
+        final int chatState = 5; // 0x0000 to 0x00FF
+        final String convoId = Integer.toString(7);
+
+        Bundle extras = new Bundle();
+        extras.putInt(BluetoothMapContract.EXTRA_PRESENCE_STATE, presenceState);
+        extras.putString(BluetoothMapContract.EXTRA_PRESENCE_STATUS, presenceStatus);
+        extras.putLong(BluetoothMapContract.EXTRA_LAST_ACTIVE, lastActive);
+        extras.putInt(BluetoothMapContract.EXTRA_CHAT_STATE, chatState);
+        extras.putString(BluetoothMapContract.EXTRA_CONVERSATION_ID, convoId);
+
+        mProvider.call(BluetoothMapContract.METHOD_SET_OWNER_STATUS, /*arg=*/ null, extras);
+        verify(mProvider).setOwnerStatus(presenceState, presenceStatus, lastActive, chatState,
+                convoId);
+    }
+
+    @Test
+    public void call_setBluetoothStateMethod_success() {
+        final boolean state = true;
+
+        Bundle extras = new Bundle();
+        extras.putBoolean(BluetoothMapContract.EXTRA_BLUETOOTH_STATE, state);
+
+        mProvider.call(BluetoothMapContract.METHOD_SET_BLUETOOTH_STATE, /*arg=*/ null, extras);
+        verify(mProvider).setBluetoothStatus(state);
+    }
+
+    @Test
+    public void shutdown() {
+        try {
+            mProvider.shutdown();
+        } catch (Exception e) {
+            assertWithMessage("Exception should not happen.").fail();
+        }
+    }
+
+    @Test
+    public void getAccountId_whenNotEnoughPathSegments() {
+        Uri uri = new Uri.Builder().scheme(ContentResolver.SCHEME_CONTENT)
+                .authority(AUTHORITY)
+                .build();
+
+        assertThrows(IllegalArgumentException.class,
+                () -> BluetoothMapEmailProvider.getAccountId(uri));
+    }
+
+    @Test
+    public void getAccountId_success() {
+        Uri messageUri = new Uri.Builder().scheme(ContentResolver.SCHEME_CONTENT)
+                .authority(AUTHORITY)
+                .appendPath(ACCOUNT_ID)
+                .appendPath(BluetoothMapContract.TABLE_MESSAGE)
+                .appendPath(MESSAGE_ID)
+                .build();
+
+        assertThat(BluetoothMapEmailProvider.getAccountId(messageUri)).isEqualTo(ACCOUNT_ID);
+    }
+
+    @Test
+    public void onAccountChanged() {
+        ProviderInfo providerInfo = new ProviderInfo();
+        providerInfo.authority = AUTHORITY;
+        providerInfo.exported = true;
+        providerInfo.writePermission = android.Manifest.permission.BLUETOOTH_MAP;
+
+        ContentResolver resolver = mock(ContentResolver.class);
+        Context context = spy(new ContextWrapper(mContext));
+        doReturn(resolver).when(context).getContentResolver();
+        mProvider.attachInfo(context, providerInfo);
+
+        Uri expectedUri;
+
+        expectedUri = BluetoothMapContract.buildAccountUri(AUTHORITY);
+        mProvider.onAccountChanged(null);
+        verify(resolver).notifyChange(expectedUri, null);
+
+        Mockito.clearInvocations(resolver);
+        String accountId = "32608910";
+        expectedUri = BluetoothMapContract.buildAccountUriwithId(AUTHORITY, accountId);
+        mProvider.onAccountChanged(accountId);
+        verify(resolver).notifyChange(expectedUri, null);
+    }
+
+    @Test
+    public void onContactChanged() {
+        ProviderInfo providerInfo = new ProviderInfo();
+        providerInfo.authority = AUTHORITY;
+        providerInfo.exported = true;
+        providerInfo.writePermission = android.Manifest.permission.BLUETOOTH_MAP;
+
+        ContentResolver resolver = mock(ContentResolver.class);
+        Context context = spy(new ContextWrapper(mContext));
+        doReturn(resolver).when(context).getContentResolver();
+        mProvider.attachInfo(context, providerInfo);
+
+        Uri expectedUri;
+
+        expectedUri = BluetoothMapContract.buildConvoContactsUri(AUTHORITY);
+        mProvider.onContactChanged(null,null);
+        verify(resolver).notifyChange(expectedUri, null);
+
+        Mockito.clearInvocations(resolver);
+        String accountId = "32608910";
+        expectedUri = BluetoothMapContract.buildConvoContactsUri(AUTHORITY, accountId);
+        mProvider.onContactChanged(accountId, null);
+        verify(resolver).notifyChange(expectedUri, null);
+
+        Mockito.clearInvocations(resolver);
+        String contactId = "23623";
+        expectedUri = BluetoothMapContract.buildConvoContactsUriWithId(
+                AUTHORITY, accountId, contactId);
+        mProvider.onContactChanged(accountId, contactId);
+        verify(resolver).notifyChange(expectedUri, null);
+    }
+
+    @Test
+    public void onMessageChanged() {
+        ProviderInfo providerInfo = new ProviderInfo();
+        providerInfo.authority = AUTHORITY;
+        providerInfo.exported = true;
+        providerInfo.writePermission = android.Manifest.permission.BLUETOOTH_MAP;
+
+        ContentResolver resolver = mock(ContentResolver.class);
+        Context context = spy(new ContextWrapper(mContext));
+        doReturn(resolver).when(context).getContentResolver();
+        mProvider.attachInfo(context, providerInfo);
+
+        Uri expectedUri;
+
+        expectedUri = BluetoothMapContract.buildMessageUri(AUTHORITY);
+        mProvider.onMessageChanged(null, null);
+        verify(resolver).notifyChange(expectedUri, null);
+
+        Mockito.clearInvocations(resolver);
+        String accountId = "32608910";
+        expectedUri = BluetoothMapContract.buildMessageUri(AUTHORITY, accountId);
+        mProvider.onMessageChanged(accountId, null);
+        verify(resolver).notifyChange(expectedUri, null);
+
+        Mockito.clearInvocations(resolver);
+        String messageId = "23623";
+        expectedUri = BluetoothMapContract.buildMessageUriWithId(
+                AUTHORITY, accountId, messageId);
+        mProvider.onMessageChanged(accountId, messageId);
+        verify(resolver).notifyChange(expectedUri, null);
+    }
+
+    @Test
+    public void createContentValues_throwsIAE_forUnknownDataType() {
+        Set<Map.Entry<String, Object>> valueSet = new HashSet<>();
+        Map<String, String> keyMap = new HashMap<>();
+
+        String key = "test_key";
+        Uri unknownTypeObject = Uri.parse("http://www.google.com");
+        valueSet.add(new AbstractMap.SimpleEntry<String, Object>(key, unknownTypeObject));
+
+        try {
+            mProvider.createContentValues(valueSet, keyMap);
+            assertWithMessage("IllegalArgumentException should be thrown.").fail();
+        } catch (IllegalArgumentException ex) {
+            // Expected
+        }
+    }
+
+    @Test
+    public void createContentValues_success() {
+        Map<String, String> keyMap = new HashMap<>();
+        String key = "test_key";
+        String convertedKey = "test_converted_key";
+        keyMap.put(key, convertedKey);
+
+        Object[] valuesToTest = new Object[] {
+                null, true, (byte) 0x01, new byte[] {0x01, 0x02},
+                0.01, 0.01f, 123, 12345L, (short) 10, "testString"
+        };
+
+        for (Object value : valuesToTest) {
+            Log.d(TAG, "value=" + value);
+
+            Set<Map.Entry<String, Object>> valueSet = new HashSet<>();
+            valueSet.add(new AbstractMap.SimpleEntry<String, Object>(key, value));
+            ContentValues contentValues = mProvider.createContentValues(valueSet, keyMap);
+
+            assertThat(contentValues.get(convertedKey)).isEqualTo(value);
+        }
+    }
+
+    public static class TestBluetoothMapIMProvider extends BluetoothMapIMProvider {
+        @Override
+        public boolean onCreate() {
+            return true;
+        }
+
+        @Override
+        protected Uri getContentUri() {
+            return null;
+        }
+
+        @Override
+        protected int deleteMessage(String accountId, String messageId) {
+            return 0;
+        }
+
+        @Override
+        protected String insertMessage(String accountId, ContentValues values) {
+            return null;
+        }
+
+        @Override
+        protected Cursor queryAccount(String[] projection, String selection, String[] selectionArgs,
+                String sortOrder) {
+            return null;
+        }
+
+        @Override
+        protected Cursor queryMessage(String accountId, String[] projection, String selection,
+                String[] selectionArgs, String sortOrder) {
+            return null;
+        }
+
+        @Override
+        protected Cursor queryConversation(String accountId, Long threadId, Boolean read,
+                Long periodEnd, Long periodBegin, String searchString, String[] projection,
+                String sortOrder) {
+            return null;
+        }
+
+        @Override
+        protected Cursor queryConvoContact(String accountId, Long contactId, String[] projection,
+                String selection, String[] selectionArgs, String sortOrder) {
+            return null;
+        }
+
+        @Override
+        protected int updateAccount(String accountId, Integer flagExpose) {
+            return 0;
+        }
+
+        @Override
+        protected int updateMessage(String accountId, Long messageId, Long folderId,
+                Boolean flagRead) {
+            return 0;
+        }
+
+        @Override
+        protected int syncFolder(long accountId, long folderId) {
+            return 0;
+        }
+
+        @Override
+        protected int setOwnerStatus(int presenceState, String presenceStatus, long lastActive,
+                int chatState, String convoId) {
+            return 0;
+        }
+
+        @Override
+        protected int setBluetoothStatus(boolean bluetoothState) {
+            return 0;
+        }
+    }
+}
diff --git a/android/app/tests/unit/src/com/android/bluetooth/mapclient/BmessageTest.java b/android/app/tests/unit/src/com/android/bluetooth/mapclient/BmessageTest.java
index acd05ed..c7d011a 100644
--- a/android/app/tests/unit/src/com/android/bluetooth/mapclient/BmessageTest.java
+++ b/android/app/tests/unit/src/com/android/bluetooth/mapclient/BmessageTest.java
@@ -93,4 +93,31 @@
         Bmessage message = BmessageParser.createBmessage(NEGATIVE_LENGTH_MESSAGE);
         Assert.assertNull(message);
     }
+
+    @Test
+    public void setCharset() {
+        Bmessage message = new Bmessage();
+
+        message.setCharset("UTF-8");
+
+        Assert.assertEquals(message.getCharset(), "UTF-8");
+    }
+
+    @Test
+    public void setEncoding() {
+        Bmessage message = new Bmessage();
+
+        message.setEncoding("test_encoding");
+
+        Assert.assertEquals(message.getEncoding(), "test_encoding");
+    }
+
+    @Test
+    public void setStatus() {
+        Bmessage message = new Bmessage();
+
+        message.setStatus(Bmessage.Status.READ);
+
+        Assert.assertEquals(message.getStatus(), Bmessage.Status.READ);
+    }
 }
diff --git a/android/app/tests/unit/src/com/android/bluetooth/mapclient/EventReportTest.java b/android/app/tests/unit/src/com/android/bluetooth/mapclient/EventReportTest.java
new file mode 100644
index 0000000..ef459e2
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/mapclient/EventReportTest.java
@@ -0,0 +1,101 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.mapclient;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import static org.mockito.Mockito.any;
+import static org.mockito.Mockito.doThrow;
+import static org.mockito.Mockito.mock;
+
+import androidx.test.filters.SmallTest;
+import androidx.test.runner.AndroidJUnit4;
+
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+import java.io.ByteArrayInputStream;
+import java.io.DataInputStream;
+import java.io.IOException;
+import java.io.InputStream;
+
+@SmallTest
+@RunWith(AndroidJUnit4.class)
+public class EventReportTest {
+
+    @Test
+    public void fromStream() throws Exception {
+        EventReport.Type type = EventReport.Type.PARTICIPANT_CHAT_STATE_CHANGED;
+        String handle = "FFAB";
+        String folder = "test_folder";
+        String oldFolder = "old_folder";
+        Bmessage.Type msgType = Bmessage.Type.MMS;
+
+        final StringBuilder xml = new StringBuilder();
+        xml.append("<event\n");
+        xml.append("type=\"" + type.toString() + "\"\n");
+        xml.append("handle=\"" + handle + "\"\n");
+        xml.append("folder=\"" + folder + "\"\n");
+        xml.append("old_folder=\"" + oldFolder + "\"\n");
+        xml.append("msg_type=\"" + msgType + "\"\n");
+        xml.append("/>\n");
+        ByteArrayInputStream stream = new ByteArrayInputStream(xml.toString().getBytes());
+
+        EventReport report = EventReport.fromStream(new DataInputStream(stream));
+
+        assertThat(report.getType()).isEqualTo(type);
+        assertThat(report.getHandle()).isEqualTo(handle);
+        assertThat(report.getFolder()).isEqualTo(folder);
+        assertThat(report.getOldFolder()).isEqualTo(oldFolder);
+        assertThat(report.getMsgType()).isEqualTo(msgType);
+        assertThat(report.toString()).isNotEmpty();
+    }
+
+    @Test
+    public void fromStream_withInvalidXml_doesNotCrash_andReturnNull() {
+        final StringBuilder xml = new StringBuilder();
+        xml.append("<<event>>\n");
+        ByteArrayInputStream stream = new ByteArrayInputStream(xml.toString().getBytes());
+
+        EventReport report = EventReport.fromStream(new DataInputStream(stream));
+
+        assertThat(report).isNull();
+    }
+
+    @Test
+    public void fromStream_withIOException_doesNotCrash_andReturnNull() throws Exception {
+        InputStream stream = mock(InputStream.class);
+        doThrow(new IOException()).when(stream).read(any());
+
+        EventReport report = EventReport.fromStream(new DataInputStream(stream));
+
+        assertThat(report).isNull();
+    }
+
+    @Test
+    public void fromStream_withIllegalArgumentException_doesNotCrash_andReturnNull() {
+        final StringBuilder xml = new StringBuilder();
+        xml.append("<event\n");
+        xml.append("type=\"" + "some_random_type" + "\"\n");
+        xml.append("/>\n");
+        ByteArrayInputStream stream = new ByteArrayInputStream(xml.toString().getBytes());
+
+        EventReport report = EventReport.fromStream(new DataInputStream(stream));
+
+        assertThat(report).isNull();
+    }
+}
diff --git a/android/app/tests/unit/src/com/android/bluetooth/mapclient/MapClientContentTest.java b/android/app/tests/unit/src/com/android/bluetooth/mapclient/MapClientContentTest.java
index 8b3eced..29b59f3 100644
--- a/android/app/tests/unit/src/com/android/bluetooth/mapclient/MapClientContentTest.java
+++ b/android/app/tests/unit/src/com/android/bluetooth/mapclient/MapClientContentTest.java
@@ -364,6 +364,17 @@
                 eq(SubscriptionManager.SUBSCRIPTION_TYPE_REMOTE_SIM));
     }
 
+    /**
+     * Test to validate that cleaning content does not crash when no subscription are available.
+     */
+    @Test
+    public void testCleanUpWithNoSubscriptions() {
+        when(mMockSubscriptionManager.getActiveSubscriptionInfoList())
+                .thenReturn(null);
+
+        MapClientContent.clearAllContent(mMockContext);
+    }
+
     void createTestMessages() {
         mOriginator = new VCardEntry();
         VCardProperty property = new VCardProperty();
diff --git a/android/app/tests/unit/src/com/android/bluetooth/mapclient/MapClientServiceBinderTest.java b/android/app/tests/unit/src/com/android/bluetooth/mapclient/MapClientServiceBinderTest.java
new file mode 100644
index 0000000..8853633
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/mapclient/MapClientServiceBinderTest.java
@@ -0,0 +1,147 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package com.android.bluetooth.mapclient;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import static org.mockito.Mockito.verify;
+
+import android.bluetooth.BluetoothAdapter;
+import android.bluetooth.BluetoothDevice;
+import android.bluetooth.BluetoothProfile;
+import android.net.Uri;
+
+import androidx.test.filters.MediumTest;
+import androidx.test.runner.AndroidJUnit4;
+
+import com.android.bluetooth.x.com.android.modules.utils.SynchronousResultReceiver;
+
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.Mock;
+import org.mockito.MockitoAnnotations;
+
+@MediumTest
+@RunWith(AndroidJUnit4.class)
+public class MapClientServiceBinderTest {
+    private static final String REMOTE_DEVICE_ADDRESS = "00:00:00:00:00:00";
+
+    @Mock
+    private MapClientService mService;
+
+    BluetoothDevice mRemoteDevice;
+
+    MapClientService.Binder mBinder;
+
+    @Before
+    public void setUp() throws Exception {
+        MockitoAnnotations.initMocks(this);
+        mRemoteDevice = BluetoothAdapter.getDefaultAdapter().getRemoteDevice(REMOTE_DEVICE_ADDRESS);
+        mBinder = new MapClientService.Binder(mService);
+    }
+
+    @Test
+    public void connect_callsServiceMethod() {
+        mBinder.connect(mRemoteDevice, null, SynchronousResultReceiver.get());
+
+        verify(mService).connect(mRemoteDevice);
+    }
+
+    @Test
+    public void disconnect_callsServiceMethod() {
+        mBinder.disconnect(mRemoteDevice, null, SynchronousResultReceiver.get());
+
+        verify(mService).disconnect(mRemoteDevice);
+    }
+
+    @Test
+    public void getConnectedDevices_callsServiceMethod() {
+        mBinder.getConnectedDevices(null, SynchronousResultReceiver.get());
+
+        verify(mService).getConnectedDevices();
+    }
+
+    @Test
+    public void getDevicesMatchingConnectionStates_callsServiceMethod() {
+        int[] states = new int[] {BluetoothProfile.STATE_CONNECTED};
+        mBinder.getDevicesMatchingConnectionStates(states, null, SynchronousResultReceiver.get());
+
+        verify(mService).getDevicesMatchingConnectionStates(states);
+    }
+
+    @Test
+    public void getConnectionState_callsServiceMethod() {
+        mBinder.getConnectionState(mRemoteDevice, null, SynchronousResultReceiver.get());
+
+        verify(mService).getConnectionState(mRemoteDevice);
+    }
+
+    @Test
+    public void setConnectionPolicy_callsServiceMethod() {
+        int connectionPolicy = BluetoothProfile.CONNECTION_POLICY_ALLOWED;
+        mBinder.setConnectionPolicy(mRemoteDevice, connectionPolicy,
+                null, SynchronousResultReceiver.get());
+
+        verify(mService).setConnectionPolicy(mRemoteDevice, connectionPolicy);
+    }
+
+    @Test
+    public void getConnectionPolicy_callsServiceMethod() {
+        mBinder.getConnectionPolicy(mRemoteDevice, null, SynchronousResultReceiver.get());
+
+        verify(mService).getConnectionPolicy(mRemoteDevice);
+    }
+
+    @Test
+    public void sendMessage_callsServiceMethod() {
+        Uri[] contacts = new Uri[] {};
+        String message = "test_message";
+        mBinder.sendMessage(mRemoteDevice, contacts, message, null, null, null,
+                SynchronousResultReceiver.get());
+
+        verify(mService).sendMessage(mRemoteDevice, contacts, message, null, null);
+    }
+
+    @Test
+    public void getUnreadMessages_callsServiceMethod() {
+        mBinder.getUnreadMessages(mRemoteDevice, null, SynchronousResultReceiver.get());
+
+        verify(mService).getUnreadMessages(mRemoteDevice);
+    }
+
+    @Test
+    public void getSupportedFeatures_callsServiceMethod() {
+        mBinder.getSupportedFeatures(mRemoteDevice, null, SynchronousResultReceiver.get());
+
+        verify(mService).getSupportedFeatures(mRemoteDevice);
+    }
+
+    @Test
+    public void setMessageStatus_callsServiceMethod() {
+        String handle = "FFAB";
+        int status = 1234;
+        mBinder.setMessageStatus(mRemoteDevice, handle, status, null,
+                SynchronousResultReceiver.get());
+
+        verify(mService).setMessageStatus(mRemoteDevice, handle, status);
+    }
+
+    @Test
+    public void cleanUp_doesNotCrash() {
+        mBinder.cleanup();
+    }
+}
\ No newline at end of file
diff --git a/android/app/tests/unit/src/com/android/bluetooth/mapclient/MapClientServiceTest.java b/android/app/tests/unit/src/com/android/bluetooth/mapclient/MapClientServiceTest.java
new file mode 100644
index 0000000..93365e5
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/mapclient/MapClientServiceTest.java
@@ -0,0 +1,311 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package com.android.bluetooth.mapclient;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import static org.mockito.Mockito.anyString;
+import static org.mockito.Mockito.doReturn;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.never;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import android.bluetooth.BluetoothAdapter;
+import android.bluetooth.BluetoothDevice;
+import android.bluetooth.BluetoothHeadsetClient;
+import android.bluetooth.BluetoothProfile;
+import android.bluetooth.BluetoothUuid;
+import android.content.Intent;
+
+import androidx.test.InstrumentationRegistry;
+import androidx.test.filters.MediumTest;
+import androidx.test.rule.ServiceTestRule;
+import androidx.test.runner.AndroidJUnit4;
+
+import com.android.bluetooth.BluetoothMethodProxy;
+import com.android.bluetooth.TestUtils;
+import com.android.bluetooth.btservice.AdapterService;
+import com.android.bluetooth.btservice.storage.DatabaseManager;
+
+import org.junit.After;
+import org.junit.Assume;
+import org.junit.Before;
+import org.junit.Rule;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.Mock;
+import org.mockito.MockitoAnnotations;
+
+@MediumTest
+@RunWith(AndroidJUnit4.class)
+public class MapClientServiceTest {
+    private static final String REMOTE_DEVICE_ADDRESS = "00:00:00:00:00:00";
+
+    @Rule public final ServiceTestRule mServiceRule = new ServiceTestRule();
+
+    @Mock private AdapterService mAdapterService;
+    @Mock private DatabaseManager mDatabaseManager;
+
+    private MapClientService mService = null;
+    private BluetoothAdapter mAdapter = null;
+    private BluetoothDevice mRemoteDevice;
+
+    @Before
+    public void setUp() throws Exception {
+        Assume.assumeTrue("Ignore test when MapClientService is not enabled",
+                MapClientService.isEnabled());
+        MockitoAnnotations.initMocks(this);
+        TestUtils.setAdapterService(mAdapterService);
+        doReturn(mDatabaseManager).when(mAdapterService).getDatabase();
+        doReturn(true, false).when(mAdapterService).isStartedProfile(anyString());
+        TestUtils.startService(mServiceRule, MapClientService.class);
+        mService = MapClientService.getMapClientService();
+        assertThat(mService).isNotNull();
+        // Try getting the Bluetooth adapter
+        mAdapter = BluetoothAdapter.getDefaultAdapter();
+        assertThat(mAdapter).isNotNull();
+        mRemoteDevice = mAdapter.getRemoteDevice(REMOTE_DEVICE_ADDRESS);
+    }
+
+    @After
+    public void tearDown() throws Exception {
+        if (!MapClientService.isEnabled()) {
+            return;
+        }
+        TestUtils.stopService(mServiceRule, MapClientService.class);
+        mService = MapClientService.getMapClientService();
+        assertThat(mService).isNull();
+        TestUtils.clearAdapterService(mAdapterService);
+        BluetoothMethodProxy.setInstanceForTesting(null);
+    }
+
+    @Test
+    public void initialize() {
+        assertThat(MapClientService.getMapClientService()).isNotNull();
+    }
+
+    @Test
+    public void setMapClientService_withNull() {
+        MapClientService.setMapClientService(null);
+
+        assertThat(MapClientService.getMapClientService()).isNull();
+    }
+
+    @Test
+    public void dump_callsStateMachineDump() {
+        MceStateMachine sm = mock(MceStateMachine.class);
+        mService.getInstanceMap().put(mRemoteDevice, sm);
+        StringBuilder builder = new StringBuilder();
+
+        mService.dump(builder);
+
+        verify(sm).dump(builder);
+    }
+
+    @Test
+    public void setConnectionPolicy() {
+        int connectionPolicy = BluetoothProfile.CONNECTION_POLICY_UNKNOWN;
+        when(mDatabaseManager.setProfileConnectionPolicy(
+                mRemoteDevice, BluetoothProfile.MAP_CLIENT, connectionPolicy)).thenReturn(true);
+
+        assertThat(mService.setConnectionPolicy(mRemoteDevice, connectionPolicy)).isTrue();
+    }
+
+    @Test
+    public void getConnectionPolicy() {
+        int connectionPolicy = BluetoothProfile.CONNECTION_POLICY_ALLOWED;
+        when(mDatabaseManager.getProfileConnectionPolicy(
+                mRemoteDevice, BluetoothProfile.MAP_CLIENT)).thenReturn(connectionPolicy);
+
+        assertThat(mService.getConnectionPolicy(mRemoteDevice)).isEqualTo(connectionPolicy);
+    }
+
+    @Test
+    public void connect_whenPolicyIsForbidden_returnsFalse() {
+        int connectionPolicy = BluetoothProfile.CONNECTION_POLICY_FORBIDDEN;
+        when(mDatabaseManager.getProfileConnectionPolicy(
+                mRemoteDevice, BluetoothProfile.MAP_CLIENT)).thenReturn(connectionPolicy);
+
+        assertThat(mService.connect(mRemoteDevice)).isFalse();
+    }
+
+    @Test
+    public void connect_whenPolicyIsAllowed_returnsTrue() {
+        int connectionPolicy = BluetoothProfile.CONNECTION_POLICY_ALLOWED;
+        when(mDatabaseManager.getProfileConnectionPolicy(
+                mRemoteDevice, BluetoothProfile.MAP_CLIENT)).thenReturn(connectionPolicy);
+
+        assertThat(mService.connect(mRemoteDevice)).isTrue();
+    }
+
+    @Test
+    public void disconnect_whenNotConnected_returnsFalse() {
+        assertThat(mService.disconnect(mRemoteDevice)).isFalse();
+    }
+
+    @Test
+    public void disconnect_whenConnected_returnsTrue() {
+        int connectionState = BluetoothProfile.STATE_CONNECTED;
+        MceStateMachine sm = mock(MceStateMachine.class);
+        when(sm.getState()).thenReturn(connectionState);
+        mService.getInstanceMap().put(mRemoteDevice, sm);
+
+        assertThat(mService.disconnect(mRemoteDevice)).isTrue();
+
+        verify(sm).disconnect();
+    }
+
+    @Test
+    public void getConnectionState_whenNotConnected() {
+        assertThat(mService.getConnectionState(mRemoteDevice))
+                .isEqualTo(BluetoothProfile.STATE_DISCONNECTED);
+    }
+
+    @Test
+    public void getConnectionState_whenConnected() {
+        int connectionState = BluetoothProfile.STATE_CONNECTED;
+        MceStateMachine sm = mock(MceStateMachine.class);
+        when(sm.getState()).thenReturn(connectionState);
+        mService.getInstanceMap().put(mRemoteDevice, sm);
+
+        assertThat(mService.getConnectionState(mRemoteDevice)).isEqualTo(connectionState);
+    }
+
+    @Test
+    public void getConnectedDevices() {
+        int connectionState = BluetoothProfile.STATE_CONNECTED;
+        MceStateMachine sm = mock(MceStateMachine.class);
+        BluetoothDevice[] bondedDevices = new BluetoothDevice[] {mRemoteDevice};
+        when(mAdapterService.getBondedDevices()).thenReturn(bondedDevices);
+        mService.getInstanceMap().put(mRemoteDevice, sm);
+        when(sm.getState()).thenReturn(connectionState);
+
+        assertThat(mService.getConnectedDevices()).contains(mRemoteDevice);
+    }
+
+    @Test
+    public void getMceStateMachineForDevice() {
+        MceStateMachine sm = mock(MceStateMachine.class);
+        mService.getInstanceMap().put(mRemoteDevice, sm);
+
+        assertThat(mService.getMceStateMachineForDevice(mRemoteDevice)).isEqualTo(sm);
+    }
+
+    @Test
+    public void getSupportedFeatures() {
+        int supportedFeatures = 100;
+        MceStateMachine sm = mock(MceStateMachine.class);
+        mService.getInstanceMap().put(mRemoteDevice, sm);
+        when(sm.getSupportedFeatures()).thenReturn(supportedFeatures);
+
+        assertThat(mService.getSupportedFeatures(mRemoteDevice)).isEqualTo(supportedFeatures);
+        verify(sm).getSupportedFeatures();
+    }
+
+    @Test
+    public void setMessageStatus() {
+        String handle = "FFAB";
+        int status = 123;
+        MceStateMachine sm = mock(MceStateMachine.class);
+        mService.getInstanceMap().put(mRemoteDevice, sm);
+        when(sm.setMessageStatus(handle, status)).thenReturn(true);
+
+        assertThat(mService.setMessageStatus(mRemoteDevice, handle, status)).isTrue();
+        verify(sm).setMessageStatus(handle, status);
+    }
+
+    @Test
+    public void getUnreadMessages() {
+        MceStateMachine sm = mock(MceStateMachine.class);
+        mService.getInstanceMap().put(mRemoteDevice, sm);
+        when(sm.getUnreadMessages()).thenReturn(true);
+
+        assertThat(mService.getUnreadMessages(mRemoteDevice)).isTrue();
+        verify(sm).getUnreadMessages();
+    }
+
+    @Test
+    public void cleanUpDevice() {
+        MceStateMachine sm = mock(MceStateMachine.class);
+        mService.getInstanceMap().put(mRemoteDevice, sm);
+
+        mService.cleanupDevice(mRemoteDevice);
+
+        assertThat(mService.getInstanceMap()).doesNotContainKey(mRemoteDevice);
+    }
+
+    @Test
+    public void broadcastReceiver_withRandomAction_doesNothing() {
+        MceStateMachine sm = mock(MceStateMachine.class);
+        mService.getInstanceMap().put(mRemoteDevice, sm);
+
+        Intent intent = new Intent("Test_random_action");
+        intent.putExtra(BluetoothDevice.EXTRA_DEVICE, mRemoteDevice);
+        mService.mMapReceiver.onReceive(mService, intent);
+
+        verify(sm, never()).disconnect();
+    }
+
+    @Test
+    public void broadcastReceiver_withActionAclDisconnected_withoutDevice_doesNothing() {
+        int connectionState = BluetoothProfile.STATE_CONNECTED;
+        MceStateMachine sm = mock(MceStateMachine.class);
+        mService.getInstanceMap().put(mRemoteDevice, sm);
+        when(sm.getState()).thenReturn(connectionState);
+
+        Intent intent = new Intent(BluetoothDevice.ACTION_ACL_DISCONNECTED);
+        // Device is not included in this intent
+        mService.mMapReceiver.onReceive(mService, intent);
+
+        verify(sm, never()).disconnect();
+    }
+
+    @Test
+    public void broadcastReceiver_withActionAclDisconnected_whenNotConnected_doesNothing() {
+        // No state machine exists for this device
+        Intent intent = new Intent(BluetoothDevice.ACTION_ACL_DISCONNECTED);
+        intent.putExtra(BluetoothDevice.EXTRA_DEVICE, mRemoteDevice);
+        mService.mMapReceiver.onReceive(mService, intent);
+    }
+
+    @Test
+    public void broadcastReceiver_withActionAclDisconnected_whenConnected_callsDisconnect() {
+        int connectionState = BluetoothProfile.STATE_CONNECTED;
+        MceStateMachine sm = mock(MceStateMachine.class);
+        mService.getInstanceMap().put(mRemoteDevice, sm);
+        when(sm.getState()).thenReturn(connectionState);
+
+        Intent intent = new Intent(BluetoothDevice.ACTION_ACL_DISCONNECTED);
+        intent.putExtra(BluetoothDevice.EXTRA_DEVICE, mRemoteDevice);
+        mService.mMapReceiver.onReceive(mService, intent);
+
+        verify(sm).disconnect();
+    }
+
+    @Test
+    public void broadcastReceiver_withActionSdpRecord_withoutMasRecord_doesNothing() {
+        MceStateMachine sm = mock(MceStateMachine.class);
+        mService.getInstanceMap().put(mRemoteDevice, sm);
+
+        Intent intent = new Intent(BluetoothDevice.ACTION_SDP_RECORD);
+        intent.putExtra(BluetoothDevice.EXTRA_DEVICE, mRemoteDevice);
+        intent.putExtra(BluetoothProfile.EXTRA_STATE, BluetoothProfile.STATE_DISCONNECTED);
+        intent.putExtra(BluetoothDevice.EXTRA_UUID, BluetoothUuid.MAS);
+        // No MasRecord / searchStatus is included in this intent
+        mService.mMapReceiver.onReceive(mService, intent);
+    }
+}
diff --git a/android/app/tests/unit/src/com/android/bluetooth/mapclient/MapClientTest.java b/android/app/tests/unit/src/com/android/bluetooth/mapclient/MapClientTest.java
index c78616e..7c80bff 100644
--- a/android/app/tests/unit/src/com/android/bluetooth/mapclient/MapClientTest.java
+++ b/android/app/tests/unit/src/com/android/bluetooth/mapclient/MapClientTest.java
@@ -122,6 +122,7 @@
 
         // is the statemachine created
         Map<BluetoothDevice, MceStateMachine> map = mService.getInstanceMap();
+
         Assert.assertEquals(1, map.size());
         Assert.assertNotNull(map.get(device));
         TestUtils.waitForLooperToFinishScheduledTask(mService.getMainLooper());
diff --git a/android/app/tests/unit/src/com/android/bluetooth/mapclient/MessageTest.java b/android/app/tests/unit/src/com/android/bluetooth/mapclient/MessageTest.java
new file mode 100644
index 0000000..2f95d56
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/mapclient/MessageTest.java
@@ -0,0 +1,111 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.mapclient;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import androidx.test.filters.SmallTest;
+import androidx.test.runner.AndroidJUnit4;
+
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+import java.util.HashMap;
+
+@SmallTest
+@RunWith(AndroidJUnit4.class)
+public class MessageTest {
+
+    @Test
+    public void constructor() throws Exception {
+        HashMap<String, String> attrs = new HashMap<>();
+
+        String handle = "FFAB";
+        attrs.put("handle", handle);
+
+        String subject = "test_subject";
+        attrs.put("subject", subject);
+
+        String dateTime = "20221220T165048";
+        attrs.put("datetime", dateTime);
+
+        String senderName = "test_sender_name";
+        attrs.put("sender_name", senderName);
+
+        String senderAddr = "test_sender_addressing";
+        attrs.put("sender_addressing", senderAddr);
+
+        String replytoAddr = "test_replyto_addressing";
+        attrs.put("replyto_addressing", replytoAddr);
+
+        String recipientName = "test_recipient_name";
+        attrs.put("recipient_name", recipientName);
+
+        String recipientAddr = "test_recipient_addressing";
+        attrs.put("recipient_addressing", recipientAddr);
+
+        String type = "MMS";
+        attrs.put("type", type);
+
+        int size = 23;
+        attrs.put("size", Integer.toString(size));
+
+        String text = "yes";
+        attrs.put("text", text);
+
+        String receptionStatus = "notification";
+        attrs.put("reception_status", receptionStatus);
+
+        int attachmentSize = 15;
+        attrs.put("attachment_size", Integer.toString(attachmentSize));
+
+        String isPriority = "yes";
+        attrs.put("priority", isPriority);
+
+        String isRead = "yes";
+        attrs.put("read", isRead);
+
+        String isSent = "yes";
+        attrs.put("sent", isSent);
+
+        String isProtected = "yes";
+        attrs.put("protected", isProtected);
+
+        Message msg = new Message(attrs);
+
+        assertThat(msg.getHandle()).isEqualTo(handle);
+        assertThat(msg.getSubject()).isEqualTo(subject);
+        // TODO: Compare the Date class properly.
+        // assertThat(msg.getDateTime()).isEqualTo(expectedTime);
+        assertThat(msg.getDateTime()).isNotNull();
+        assertThat(msg.getSenderName()).isEqualTo(senderName);
+        assertThat(msg.getSenderAddressing()).isEqualTo(senderAddr);
+        assertThat(msg.getReplytoAddressing()).isEqualTo(replytoAddr);
+        assertThat(msg.getRecipientName()).isEqualTo(recipientName);
+        assertThat(msg.getRecipientAddressing()).isEqualTo(recipientAddr);
+        assertThat(msg.getType()).isEqualTo(Message.Type.MMS);
+        assertThat(msg.getSize()).isEqualTo(size);
+        assertThat(msg.getReceptionStatus()).isEqualTo(Message.ReceptionStatus.NOTIFICATION);
+        assertThat(msg.getAttachmentSize()).isEqualTo(attachmentSize);
+        assertThat(msg.isText()).isTrue();
+        assertThat(msg.isPriority()).isTrue();
+        assertThat(msg.isRead()).isTrue();
+        assertThat(msg.isSent()).isTrue();
+        assertThat(msg.isProtected()).isTrue();
+        assertThat(msg.toString()).isNotEmpty();
+    }
+}
diff --git a/android/app/tests/unit/src/com/android/bluetooth/mapclient/MessagesFilterTest.java b/android/app/tests/unit/src/com/android/bluetooth/mapclient/MessagesFilterTest.java
new file mode 100644
index 0000000..9c6a307
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/mapclient/MessagesFilterTest.java
@@ -0,0 +1,81 @@
+/*
+ * Copyright 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.mapclient;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import androidx.test.filters.SmallTest;
+import androidx.test.runner.AndroidJUnit4;
+
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+@SmallTest
+@RunWith(AndroidJUnit4.class)
+public class MessagesFilterTest {
+
+    @Test
+    public void setOriginator() {
+        MessagesFilter filter = new MessagesFilter();
+
+        String originator = "test_originator";
+        filter.setOriginator(originator);
+        assertThat(filter.originator).isEqualTo(originator);
+
+        filter.setOriginator("");
+        assertThat(filter.originator).isEqualTo(null); // Empty string is stored as null
+
+        filter.setOriginator(null);
+        assertThat(filter.originator).isEqualTo(null);
+    }
+
+    @Test
+    public void setPriority() {
+        MessagesFilter filter = new MessagesFilter();
+
+        byte priority = 5;
+        filter.setPriority(priority);
+
+        assertThat(filter.priority).isEqualTo(priority);
+    }
+
+    @Test
+    public void setReadStatus() {
+        MessagesFilter filter = new MessagesFilter();
+
+        byte readStatus = 5;
+        filter.setReadStatus(readStatus);
+
+        assertThat(filter.readStatus).isEqualTo(readStatus);
+    }
+
+    @Test
+    public void setRecipient() {
+        MessagesFilter filter = new MessagesFilter();
+
+        String recipient = "test_originator";
+        filter.setRecipient(recipient);
+        assertThat(filter.recipient).isEqualTo(recipient);
+
+        filter.setRecipient("");
+        assertThat(filter.recipient).isEqualTo(null); // Empty string is stored as null
+
+        filter.setRecipient(null);
+        assertThat(filter.recipient).isEqualTo(null);
+    }
+
+}
diff --git a/android/app/tests/unit/src/com/android/bluetooth/mapclient/MessagesListingTest.java b/android/app/tests/unit/src/com/android/bluetooth/mapclient/MessagesListingTest.java
new file mode 100644
index 0000000..48ece84
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/mapclient/MessagesListingTest.java
@@ -0,0 +1,51 @@
+/*
+ * Copyright 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.mapclient;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import androidx.test.filters.SmallTest;
+import androidx.test.runner.AndroidJUnit4;
+
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+import java.io.ByteArrayInputStream;
+
+@SmallTest
+@RunWith(AndroidJUnit4.class)
+public class MessagesListingTest {
+
+    @Test
+    public void constructor() {
+        String handle = "FFAB";
+        String subject = "test_subject";
+        final StringBuilder xml = new StringBuilder();
+        xml.append("<msg\n");
+        xml.append("handle=\"" + handle + "\"\n");
+        xml.append("subject=\"" + subject + "\"\n");
+        xml.append("/>\n");
+        ByteArrayInputStream stream = new ByteArrayInputStream(xml.toString().getBytes());
+
+        MessagesListing listing = new MessagesListing(stream);
+
+        assertThat(listing.getList()).hasSize(1);
+        Message msg = listing.getList().get(0);
+        assertThat(msg.getHandle()).isEqualTo(handle);
+        assertThat(msg.getSubject()).isEqualTo(subject);
+    }
+}
diff --git a/android/app/tests/unit/src/com/android/bluetooth/mapclient/MnsObexServerTest.java b/android/app/tests/unit/src/com/android/bluetooth/mapclient/MnsObexServerTest.java
new file mode 100644
index 0000000..e57ab50
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/mapclient/MnsObexServerTest.java
@@ -0,0 +1,169 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.mapclient;
+
+import static com.google.common.truth.Truth.assertThat;
+import static com.google.common.truth.Truth.assertWithMessage;
+
+import static org.mockito.Mockito.any;
+import static org.mockito.Mockito.doThrow;
+import static org.mockito.Mockito.when;
+import static org.mockito.Mockito.eq;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.verify;
+
+import android.os.Handler;
+
+import androidx.test.InstrumentationRegistry;
+import androidx.test.filters.SmallTest;
+import androidx.test.runner.AndroidJUnit4;
+
+import com.android.obex.HeaderSet;
+import com.android.obex.Operation;
+import com.android.obex.ResponseCodes;
+
+import org.junit.After;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.Mock;
+import org.mockito.MockitoAnnotations;
+import org.mockito.Spy;
+
+import java.io.ByteArrayInputStream;
+import java.io.DataInputStream;
+import java.io.IOException;
+import java.io.OutputStream;
+
+@SmallTest
+@RunWith(AndroidJUnit4.class)
+public class MnsObexServerTest {
+
+    @Mock
+    MceStateMachine mStateMachine;
+
+    MnsObexServer mServer;
+
+    @Before
+    public void setUp() throws Exception {
+        MockitoAnnotations.initMocks(this);
+        mServer = new MnsObexServer(mStateMachine, null);
+    }
+
+    @Test
+    public void onConnect_whenUuidIsWrong() {
+        byte[] wrongUuid = new byte[]{};
+        HeaderSet request = new HeaderSet();
+        request.setHeader(HeaderSet.TARGET, wrongUuid);
+        HeaderSet reply = new HeaderSet();
+
+        assertThat(mServer.onConnect(request, reply))
+                .isEqualTo(ResponseCodes.OBEX_HTTP_NOT_ACCEPTABLE);
+    }
+
+    @Test
+    public void onConnect_withCorrectUuid() throws Exception {
+        HeaderSet request = new HeaderSet();
+        request.setHeader(HeaderSet.TARGET, MnsObexServer.MNS_TARGET);
+        HeaderSet reply = new HeaderSet();
+
+        assertThat(mServer.onConnect(request, reply)).isEqualTo(ResponseCodes.OBEX_HTTP_OK);
+        assertThat(reply.getHeader(HeaderSet.WHO)).isEqualTo(MnsObexServer.MNS_TARGET);
+    }
+
+    @Test
+    public void onDisconnect_callsStateMachineDisconnect() {
+        HeaderSet request = new HeaderSet();
+        HeaderSet reply = new HeaderSet();
+
+        mServer.onDisconnect(request, reply);
+
+        verify(mStateMachine).disconnect();
+    }
+
+    @Test
+    public void onGet_returnsBadRequest() {
+        Operation op = mock(Operation.class);
+
+        assertThat(mServer.onGet(op)).isEqualTo(ResponseCodes.OBEX_HTTP_BAD_REQUEST);
+    }
+
+    @Test
+    public void onPut_whenTypeIsInvalid_returnsBadRequest() throws Exception {
+        HeaderSet headerSet = new HeaderSet();
+        headerSet.setHeader(HeaderSet.TYPE, "some_invalid_type");
+        Operation op = mock(Operation.class);
+        when(op.getReceivedHeader()).thenReturn(headerSet);
+
+        assertThat(mServer.onPut(op)).isEqualTo(ResponseCodes.OBEX_HTTP_BAD_REQUEST);
+    }
+
+    @Test
+    public void onPut_whenHeaderSetIsValid_returnsOk() throws Exception {
+        final StringBuilder xml = new StringBuilder();
+        xml.append("<event\n");
+        xml.append("    type=\"test_type\"\n");
+        xml.append("    handle=\"FFAB\"\n");
+        xml.append("    folder=\"test_folder\"\n");
+        xml.append("    old_folder=\"test_old_folder\"\n");
+        xml.append("    msg_type=\"MMS\"\n");
+        xml.append("/>\n");
+        DataInputStream stream = new DataInputStream(
+                new ByteArrayInputStream(xml.toString().getBytes()));
+
+        byte[] applicationParameter = new byte[] {
+                Request.OAP_TAGID_MAS_INSTANCE_ID,
+                1, // length in byte
+                (byte) 55
+        };
+
+        HeaderSet headerSet = new HeaderSet();
+        headerSet.setHeader(HeaderSet.TYPE, MnsObexServer.TYPE);
+        headerSet.setHeader(HeaderSet.APPLICATION_PARAMETER, applicationParameter);
+
+        Operation op = mock(Operation.class);
+        when(op.getReceivedHeader()).thenReturn(headerSet);
+        when(op.openDataInputStream()).thenReturn(stream);
+
+        assertThat(mServer.onPut(op)).isEqualTo(ResponseCodes.OBEX_HTTP_OK);
+
+        verify(mStateMachine).receiveEvent(any());
+    }
+
+    @Test
+    public void onAbort_returnsNotImplemented() {
+        HeaderSet request = new HeaderSet();
+        HeaderSet reply = new HeaderSet();
+
+        assertThat(mServer.onAbort(request, reply))
+                .isEqualTo(ResponseCodes.OBEX_HTTP_NOT_IMPLEMENTED);
+    }
+
+    @Test
+    public void onSetPath_returnsBadRequest() {
+        HeaderSet request = new HeaderSet();
+        HeaderSet reply = new HeaderSet();
+
+        assertThat(mServer.onSetPath(request, reply, false, false))
+                .isEqualTo(ResponseCodes.OBEX_HTTP_BAD_REQUEST);
+    }
+
+    @Test
+    public void onClose_doesNotCrash() {
+        mServer.onClose();
+    }
+}
diff --git a/android/app/tests/unit/src/com/android/bluetooth/mcp/McpServiceTest.java b/android/app/tests/unit/src/com/android/bluetooth/mcp/McpServiceTest.java
index 3374607..cfd051a 100644
--- a/android/app/tests/unit/src/com/android/bluetooth/mcp/McpServiceTest.java
+++ b/android/app/tests/unit/src/com/android/bluetooth/mcp/McpServiceTest.java
@@ -136,4 +136,9 @@
             }
         });
     }
+
+    @Test
+    public void testDumpDoesNotCrash() {
+        mMcpService.dump(new StringBuilder());
+    }
 }
diff --git a/android/app/tests/unit/src/com/android/bluetooth/mcp/MediaControlGattServiceTest.java b/android/app/tests/unit/src/com/android/bluetooth/mcp/MediaControlGattServiceTest.java
index ff7406a..d840126 100644
--- a/android/app/tests/unit/src/com/android/bluetooth/mcp/MediaControlGattServiceTest.java
+++ b/android/app/tests/unit/src/com/android/bluetooth/mcp/MediaControlGattServiceTest.java
@@ -90,6 +90,7 @@
         mAdapter = BluetoothAdapter.getDefaultAdapter();
 
         doReturn(true).when(mMockGattServer).addService(any(BluetoothGattService.class));
+        doReturn(new BluetoothDevice[0]).when(mAdapterService).getBondedDevices();
 
         mMcpService = new MediaControlGattService(mMockMcpService, mMockMcsCallbacks, TEST_CCID);
         mMcpService.setBluetoothGattServerForTesting(mMockGattServer);
@@ -122,7 +123,7 @@
         List<BluetoothDevice> devices = new ArrayList<BluetoothDevice>();
         devices.add(mCurrentDevice);
         doReturn(devices).when(mMockGattServer).getConnectedDevices();
-        mMcpService.setCcc(mCurrentDevice, characteristic.getUuid(), 0, value);
+        mMcpService.setCcc(mCurrentDevice, characteristic.getUuid(), 0, value, true);
     }
 
     @Test
diff --git a/android/app/tests/unit/src/com/android/bluetooth/mcp/MediaControlProfileTest.java b/android/app/tests/unit/src/com/android/bluetooth/mcp/MediaControlProfileTest.java
index 3ec632a..bed8b79 100644
--- a/android/app/tests/unit/src/com/android/bluetooth/mcp/MediaControlProfileTest.java
+++ b/android/app/tests/unit/src/com/android/bluetooth/mcp/MediaControlProfileTest.java
@@ -465,4 +465,9 @@
         testGetSupportedPlayingOrder(false, true);
         testGetSupportedPlayingOrder(false, false);
     }
+
+    @Test
+    public void testDumpDoesNotCrash() {
+        mMediaControlProfile.dump(new StringBuilder());
+    }
 }
diff --git a/android/app/tests/unit/src/com/android/bluetooth/opp/BluetoothOppBatchTest.java b/android/app/tests/unit/src/com/android/bluetooth/opp/BluetoothOppBatchTest.java
new file mode 100644
index 0000000..a37d049
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/opp/BluetoothOppBatchTest.java
@@ -0,0 +1,108 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.opp;
+
+import static com.google.common.truth.Truth.assertThat;
+import static org.mockito.Mockito.any;
+import static org.mockito.Mockito.doReturn;
+import static org.mockito.Mockito.spy;
+
+import android.content.Context;
+
+import androidx.test.filters.MediumTest;
+import androidx.test.platform.app.InstrumentationRegistry;
+import androidx.test.runner.AndroidJUnit4;
+
+import com.android.bluetooth.BluetoothMethodProxy;
+
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.Mockito;
+
+@MediumTest
+@RunWith(AndroidJUnit4.class)
+public class BluetoothOppBatchTest {
+    private BluetoothOppBatch mBluetoothOppBatch;
+    private Context mContext;
+
+    private BluetoothOppShareInfo mInitShareInfo;
+
+    @Before
+    public void setUp() throws Exception {
+        mInitShareInfo = new BluetoothOppShareInfo(0, null, null, null, null, 0,
+                "00:11:22:33:44:55", 0, 0, BluetoothShare.STATUS_PENDING, 0, 0, 0, false);
+        mContext = InstrumentationRegistry.getInstrumentation().getContext();
+        mBluetoothOppBatch = new BluetoothOppBatch(mContext, mInitShareInfo);
+    }
+
+    @Test
+    public void constructor_instanceCreatedCorrectly() {
+        assertThat(mBluetoothOppBatch.mTimestamp).isEqualTo(mInitShareInfo.mTimestamp);
+        assertThat(mBluetoothOppBatch.mDirection).isEqualTo(mInitShareInfo.mDirection);
+        assertThat(mBluetoothOppBatch.mStatus).isEqualTo(Constants.BATCH_STATUS_PENDING);
+        assertThat(mBluetoothOppBatch.mDestination.getAddress())
+                .isEqualTo(mInitShareInfo.mDestination);
+        assertThat(mBluetoothOppBatch.hasShare(mInitShareInfo)).isTrue();
+    }
+
+    @Test
+    public void addShare_shareInfoStoredCorrectly() {
+        BluetoothOppShareInfo newBluetoothOppShareInfo = new BluetoothOppShareInfo(1, null, null,
+                null, null, 0, "AA:BB:22:CD:E0:55", 0, 0, BluetoothShare.STATUS_PENDING, 0, 0, 0,
+                false);
+
+        mBluetoothOppBatch.registerListener(new BluetoothOppBatch.BluetoothOppBatchListener() {
+            @Override
+            public void onShareAdded(int id) {
+                assertThat(id).isEqualTo(newBluetoothOppShareInfo.mId);
+            }
+
+            @Override
+            public void onShareDeleted(int id) {
+            }
+
+            @Override
+            public void onBatchCanceled() {
+            }
+        });
+        assertThat(mBluetoothOppBatch.isEmpty()).isFalse();
+        assertThat(mBluetoothOppBatch.getNumShares()).isEqualTo(1);
+        assertThat(mBluetoothOppBatch.hasShare(mInitShareInfo)).isTrue();
+        assertThat(mBluetoothOppBatch.hasShare(newBluetoothOppShareInfo)).isFalse();
+        mBluetoothOppBatch.addShare(newBluetoothOppShareInfo);
+        assertThat(mBluetoothOppBatch.getNumShares()).isEqualTo(2);
+        assertThat(mBluetoothOppBatch.hasShare(mInitShareInfo)).isTrue();
+        assertThat(mBluetoothOppBatch.hasShare(newBluetoothOppShareInfo)).isTrue();
+    }
+
+    @Test
+    public void cancelBatch_cancelSuccessfully() {
+
+        BluetoothMethodProxy proxy = spy(BluetoothMethodProxy.getInstance());
+        BluetoothMethodProxy.setInstanceForTesting(proxy);
+        doReturn(0).when(proxy).contentResolverDelete(any(), any(), any(), any());
+        doReturn(0).when(proxy).contentResolverUpdate(any(), any(), any(), any(), any());
+
+        assertThat(mBluetoothOppBatch.getPendingShare()).isEqualTo(mInitShareInfo);
+
+        mBluetoothOppBatch.cancelBatch();
+        assertThat(mBluetoothOppBatch.isEmpty()).isTrue();
+
+        BluetoothMethodProxy.setInstanceForTesting(null);
+    }
+}
diff --git a/android/app/tests/unit/src/com/android/bluetooth/opp/BluetoothOppBtEnableActivityTest.java b/android/app/tests/unit/src/com/android/bluetooth/opp/BluetoothOppBtEnableActivityTest.java
new file mode 100644
index 0000000..cadc168
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/opp/BluetoothOppBtEnableActivityTest.java
@@ -0,0 +1,80 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.opp;
+
+import static android.content.pm.PackageManager.COMPONENT_ENABLED_STATE_DEFAULT;
+import static android.content.pm.PackageManager.COMPONENT_ENABLED_STATE_ENABLED;
+import static android.content.pm.PackageManager.DONT_KILL_APP;
+
+import static androidx.test.espresso.Espresso.onView;
+import static androidx.test.espresso.action.ViewActions.click;
+import static androidx.test.espresso.assertion.ViewAssertions.matches;
+import static androidx.test.espresso.intent.Intents.intended;
+import static androidx.test.espresso.intent.matcher.IntentMatchers.hasComponent;
+import static androidx.test.espresso.matcher.RootMatchers.isDialog;
+import static androidx.test.espresso.matcher.ViewMatchers.isDisplayed;
+import static androidx.test.espresso.matcher.ViewMatchers.withText;
+
+import static org.mockito.Mockito.mock;
+
+import android.content.ComponentName;
+import android.content.Context;
+import android.content.Intent;
+
+import androidx.test.core.app.ActivityScenario;
+import androidx.test.espresso.intent.Intents;
+import androidx.test.platform.app.InstrumentationRegistry;
+
+import com.android.bluetooth.R;
+
+import org.junit.After;
+import org.junit.Before;
+import org.junit.Test;
+import org.mockito.MockitoAnnotations;
+
+public class BluetoothOppBtEnableActivityTest {
+
+    Intent mIntent;
+    Context mTargetContext;
+
+    @Before
+    public void setUp() {
+        MockitoAnnotations.initMocks(this);
+        mTargetContext = InstrumentationRegistry.getInstrumentation().getTargetContext();
+        mIntent = new Intent();
+        mIntent.setClass(mTargetContext, BluetoothOppBtEnableActivity.class);
+        Intents.init();
+        BluetoothOppTestUtils.enableOppActivities(true, mTargetContext);
+    }
+
+    @After
+    public void tearDown() {
+        Intents.release();
+        BluetoothOppTestUtils.enableOppActivities(false, mTargetContext);
+    }
+
+    @Test
+    public void onCreate_clickOnEnable_launchEnablingActivity() {
+        ActivityScenario<BluetoothOppBtEnableActivity> activityScenario = ActivityScenario.launch(
+                mIntent);
+        activityScenario.onActivity(
+                activity -> activity.mOppManager = mock(BluetoothOppManager.class));
+        onView(withText(mTargetContext.getText(R.string.bt_enable_ok).toString())).inRoot(
+                isDialog()).check(matches(isDisplayed())).perform(click());
+        intended(hasComponent(BluetoothOppBtEnablingActivity.class.getName()));
+    }
+}
diff --git a/android/app/tests/unit/src/com/android/bluetooth/opp/BluetoothOppBtEnablingActivityTest.java b/android/app/tests/unit/src/com/android/bluetooth/opp/BluetoothOppBtEnablingActivityTest.java
new file mode 100644
index 0000000..6f05030
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/opp/BluetoothOppBtEnablingActivityTest.java
@@ -0,0 +1,158 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.opp;
+
+import static android.content.pm.PackageManager.COMPONENT_ENABLED_STATE_DEFAULT;
+import static android.content.pm.PackageManager.COMPONENT_ENABLED_STATE_ENABLED;
+import static android.content.pm.PackageManager.DONT_KILL_APP;
+
+import static androidx.lifecycle.Lifecycle.State.DESTROYED;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.Mockito.doReturn;
+
+import android.bluetooth.BluetoothAdapter;
+import android.content.ComponentName;
+import android.content.Context;
+import android.content.Intent;
+import android.view.KeyEvent;
+
+import androidx.lifecycle.Lifecycle;
+import androidx.test.core.app.ActivityScenario;
+import androidx.test.platform.app.InstrumentationRegistry;
+import androidx.test.runner.AndroidJUnit4;
+
+import com.android.bluetooth.BluetoothMethodProxy;
+
+import org.junit.After;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.Mockito;
+import org.mockito.MockitoAnnotations;
+import org.mockito.Spy;
+
+@RunWith(AndroidJUnit4.class)
+public class BluetoothOppBtEnablingActivityTest {
+    @Spy
+    BluetoothMethodProxy mBluetoothMethodProxy;
+
+    Intent mIntent;
+    Context mTargetContext;
+
+    int mRealTimeoutValue;
+
+    @Before
+    public void setUp() {
+        MockitoAnnotations.initMocks(this);
+        mBluetoothMethodProxy = Mockito.spy(BluetoothMethodProxy.getInstance());
+        BluetoothMethodProxy.setInstanceForTesting(mBluetoothMethodProxy);
+
+        mTargetContext = InstrumentationRegistry.getInstrumentation().getTargetContext();
+
+        mIntent = new Intent();
+        mIntent.setClass(mTargetContext, BluetoothOppBtEnablingActivity.class);
+
+        mRealTimeoutValue = BluetoothOppBtEnablingActivity.sBtEnablingTimeoutMs;
+        BluetoothOppTestUtils.enableOppActivities(true, mTargetContext);
+    }
+
+    @After
+    public void tearDown() {
+        BluetoothMethodProxy.setInstanceForTesting(null);
+        BluetoothOppBtEnablingActivity.sBtEnablingTimeoutMs = mRealTimeoutValue;
+        BluetoothOppTestUtils.enableOppActivities(false, mTargetContext);
+    }
+
+    @Test
+    public void onCreate_bluetoothEnableTimeout_finishAfterTimeout() throws Exception {
+        int spedUpTimeoutValue = 1000;
+        // To speed up the test
+        BluetoothOppBtEnablingActivity.sBtEnablingTimeoutMs = spedUpTimeoutValue;
+        doReturn(false).when(mBluetoothMethodProxy).bluetoothAdapterIsEnabled(any());
+
+        ActivityScenario<BluetoothOppBtEnablingActivity> activityScenario = ActivityScenario.launch(
+                mIntent);
+        final BluetoothOppManager[] mOppManager = new BluetoothOppManager[1];
+        activityScenario.onActivity(activity -> {
+            // Should be cancelled after timeout
+            mOppManager[0] = BluetoothOppManager.getInstance(activity);
+        });
+        Thread.sleep(spedUpTimeoutValue);
+        assertThat(mOppManager[0].mSendingFlag).isEqualTo(false);
+        assertActivityState(activityScenario, DESTROYED);
+    }
+
+    @Test
+    public void onKeyDown_cancelProgress() throws Exception {
+        doReturn(false).when(mBluetoothMethodProxy).bluetoothAdapterIsEnabled(any());
+        ActivityScenario<BluetoothOppBtEnablingActivity> activityScenario = ActivityScenario.launch(
+                mIntent);
+
+        activityScenario.onActivity(activity -> {
+            activity.onKeyDown(KeyEvent.KEYCODE_BACK,
+                    new KeyEvent(KeyEvent.ACTION_DOWN, KeyEvent.KEYCODE_BACK));
+            // Should be cancelled immediately
+            BluetoothOppManager mOppManager = BluetoothOppManager.getInstance(activity);
+            assertThat(mOppManager.mSendingFlag).isEqualTo(false);
+        });
+        assertActivityState(activityScenario, DESTROYED);
+    }
+
+    @Test
+    public void onCreate_bluetoothAlreadyEnabled_finishImmediately() throws Exception {
+        doReturn(true).when(mBluetoothMethodProxy).bluetoothAdapterIsEnabled(any());
+        ActivityScenario<BluetoothOppBtEnablingActivity> activityScenario = ActivityScenario.launch(
+                mIntent);
+        assertActivityState(activityScenario, DESTROYED);
+    }
+
+    @Test
+    public void broadcastReceiver_onReceive_finishImmediately() throws Exception {
+        doReturn(false).when(mBluetoothMethodProxy).bluetoothAdapterIsEnabled(any());
+        ActivityScenario<BluetoothOppBtEnablingActivity> activityScenario = ActivityScenario.launch(
+                mIntent);
+        activityScenario.onActivity(activity -> {
+            Intent intent = new Intent(BluetoothAdapter.ACTION_STATE_CHANGED);
+            intent.putExtra(BluetoothAdapter.EXTRA_STATE, BluetoothAdapter.STATE_ON);
+            activity.mBluetoothReceiver.onReceive(mTargetContext, intent);
+        });
+        assertActivityState(activityScenario, DESTROYED);
+    }
+
+    private void assertActivityState(ActivityScenario activityScenario, Lifecycle.State state)
+      throws Exception {
+        // TODO: Change this into an event driven systems
+        Thread.sleep(3_000);
+        assertThat(activityScenario.getState()).isEqualTo(state);
+    }
+
+    private void enableActivity(boolean enable) {
+        int enabledState = enable ? COMPONENT_ENABLED_STATE_ENABLED
+                : COMPONENT_ENABLED_STATE_DEFAULT;
+
+        mTargetContext.getPackageManager().setApplicationEnabledSetting(
+                mTargetContext.getPackageName(), enabledState, DONT_KILL_APP);
+
+        ComponentName activityName = new ComponentName(mTargetContext,
+                BluetoothOppTransferActivity.class);
+        mTargetContext.getPackageManager().setComponentEnabledSetting(
+                activityName, enabledState, DONT_KILL_APP);
+    }
+}
diff --git a/android/app/tests/unit/src/com/android/bluetooth/opp/BluetoothOppHandoverReceiverTest.java b/android/app/tests/unit/src/com/android/bluetooth/opp/BluetoothOppHandoverReceiverTest.java
new file mode 100644
index 0000000..fd6261e
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/opp/BluetoothOppHandoverReceiverTest.java
@@ -0,0 +1,138 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.opp;
+
+import static org.mockito.ArgumentMatchers.eq;
+import static org.mockito.Mockito.any;
+import static org.mockito.Mockito.doReturn;
+import static org.mockito.Mockito.nullable;
+import static org.mockito.Mockito.spy;
+import static org.mockito.Mockito.timeout;
+import static org.mockito.Mockito.verify;
+
+import android.bluetooth.BluetoothDevice;
+import android.bluetooth.BluetoothManager;
+import android.content.ContentValues;
+import android.content.Context;
+import android.content.Intent;
+import android.net.Uri;
+
+import androidx.test.filters.MediumTest;
+import androidx.test.platform.app.InstrumentationRegistry;
+import androidx.test.runner.AndroidJUnit4;
+
+import com.android.bluetooth.BluetoothMethodProxy;
+
+import org.junit.After;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.MockitoAnnotations;
+import org.mockito.Spy;
+
+import java.util.ArrayList;
+import java.util.List;
+
+@MediumTest
+@RunWith(AndroidJUnit4.class)
+public class BluetoothOppHandoverReceiverTest {
+    Context mContext;
+
+    @Spy
+    BluetoothMethodProxy mCallProxy = BluetoothMethodProxy.getInstance();
+
+    @Before
+    public void setUp() {
+        MockitoAnnotations.initMocks(this);
+        mContext = InstrumentationRegistry.getInstrumentation().getTargetContext();
+        BluetoothMethodProxy.setInstanceForTesting(mCallProxy);
+        doReturn(0).when(mCallProxy).contentResolverDelete(any(), any(Uri.class), any(), any());
+        doReturn(null).when(mCallProxy).contentResolverInsert(
+          any(), eq(BluetoothShare.CONTENT_URI), any());
+    }
+
+    @After
+    public void tearDown() {
+        BluetoothMethodProxy.setInstanceForTesting(null);
+    }
+
+    @Test
+    public void onReceive_withActionHandoverSend_startTransfer() {
+        Intent intent = new Intent(Constants.ACTION_HANDOVER_SEND);
+        String address = "AA:BB:CC:DD:EE:FF";
+        Uri uri = Uri.parse("content:///abc/xyz.txt");
+        BluetoothDevice device = (mContext.getSystemService(BluetoothManager.class))
+                .getAdapter().getRemoteDevice(address);
+        intent.putExtra(BluetoothDevice.EXTRA_DEVICE, device);
+        intent.putExtra(Intent.EXTRA_STREAM, uri);
+        intent.setType("text/plain");
+
+        BluetoothOppManager spyManager = spy(new BluetoothOppManager());
+        BluetoothOppManager.setInstance(spyManager);
+        new BluetoothOppHandoverReceiver().onReceive(mContext, intent);
+
+        verify(spyManager, timeout(3_000)).startTransfer(any());
+
+        // this will run BluetoothOppManager#startTransfer, which will then make
+        // InsertShareInfoThread insert into content resolver
+        verify(mCallProxy, timeout(3_000).times(1)).contentResolverInsert(any(),
+                eq(BluetoothShare.CONTENT_URI), nullable(ContentValues.class));
+        BluetoothOppManager.setInstance(null);
+    }
+
+    @Test
+    public void onReceive_withActionHandoverSendMultiple_startTransfer() {
+        Intent intent = new Intent(Constants.ACTION_HANDOVER_SEND_MULTIPLE);
+        String address = "AA:BB:CC:DD:EE:FF";
+        ArrayList<Uri> uris = new ArrayList<Uri>(
+                List.of(Uri.parse("content:///abc/xyz.txt"),
+                        Uri.parse("content:///a/b/c/d/x/y/z.txt"),
+                        Uri.parse("content:///123/456.txt")));
+        BluetoothDevice device = (mContext.getSystemService(BluetoothManager.class))
+                .getAdapter().getRemoteDevice(address);
+        intent.putExtra(BluetoothDevice.EXTRA_DEVICE, device);
+        intent.putExtra(Intent.EXTRA_STREAM, uris);
+        intent.setType("text/plain");
+
+        BluetoothOppManager spyManager = spy(new BluetoothOppManager());
+        BluetoothOppManager.setInstance(spyManager);
+        new BluetoothOppHandoverReceiver().onReceive(mContext, intent);
+
+        verify(spyManager, timeout(3_000)).startTransfer(any());
+
+        // this will run BluetoothOppManager#startTransfer, which will then make
+        // InsertShareInfoThread insert into content resolver
+        verify(mCallProxy, timeout(3_000).times(3)).contentResolverInsert(any(),
+                eq(BluetoothShare.CONTENT_URI), nullable(ContentValues.class));
+        BluetoothOppManager.setInstance(null);
+    }
+
+    @Test
+    public void onReceive_withActionStopHandover_triggerContentResolverDelete() {
+        Intent intent = new Intent(Constants.ACTION_STOP_HANDOVER);
+        String address = "AA:BB:CC:DD:EE:FF";
+        BluetoothDevice device = (mContext.getSystemService(BluetoothManager.class))
+                .getAdapter().getRemoteDevice(address);
+        intent.putExtra(BluetoothDevice.EXTRA_DEVICE, device);
+        intent.putExtra(Constants.EXTRA_BT_OPP_TRANSFER_ID, 0);
+
+        new BluetoothOppHandoverReceiver().onReceive(mContext, intent);
+
+        verify(mCallProxy).contentResolverDelete(any(), any(),
+                nullable(String.class), nullable(String[].class));
+    }
+}
\ No newline at end of file
diff --git a/android/app/tests/unit/src/com/android/bluetooth/opp/BluetoothOppLauncherActivityTest.java b/android/app/tests/unit/src/com/android/bluetooth/opp/BluetoothOppLauncherActivityTest.java
new file mode 100644
index 0000000..d9dbbb1
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/opp/BluetoothOppLauncherActivityTest.java
@@ -0,0 +1,211 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.opp;
+
+import static android.content.pm.PackageManager.COMPONENT_ENABLED_STATE_DEFAULT;
+import static android.content.pm.PackageManager.COMPONENT_ENABLED_STATE_ENABLED;
+import static android.content.pm.PackageManager.DONT_KILL_APP;
+
+import static androidx.test.espresso.Espresso.onView;
+import static androidx.test.espresso.action.ViewActions.click;
+import static androidx.test.espresso.assertion.ViewAssertions.matches;
+import static androidx.test.espresso.intent.Intents.intended;
+import static androidx.test.espresso.intent.matcher.IntentMatchers.hasAction;
+import static androidx.test.espresso.intent.matcher.IntentMatchers.hasComponent;
+import static androidx.test.espresso.matcher.RootMatchers.isDialog;
+import static androidx.test.espresso.matcher.ViewMatchers.isDisplayed;
+import static androidx.test.espresso.matcher.ViewMatchers.withText;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.anyBoolean;
+import static org.mockito.Mockito.doReturn;
+import static org.mockito.Mockito.doThrow;
+import static org.mockito.Mockito.spy;
+import static org.mockito.Mockito.verify;
+
+import android.bluetooth.BluetoothDevicePicker;
+import android.content.ComponentName;
+import android.content.Context;
+import android.content.ContextWrapper;
+import android.content.Intent;
+import android.net.Uri;
+
+import androidx.lifecycle.Lifecycle;
+import androidx.test.core.app.ActivityScenario;
+import androidx.test.core.app.ApplicationProvider;
+import androidx.test.espresso.intent.Intents;
+import androidx.test.filters.MediumTest;
+import androidx.test.runner.AndroidJUnit4;
+
+import com.android.bluetooth.BluetoothMethodProxy;
+import com.android.bluetooth.R;
+
+import org.junit.After;
+import org.junit.Before;
+import org.junit.Ignore;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.ArgumentCaptor;
+import org.mockito.Mock;
+import org.mockito.MockitoAnnotations;
+
+import java.io.File;
+
+@MediumTest
+@RunWith(AndroidJUnit4.class)
+public class BluetoothOppLauncherActivityTest {
+    Context mTargetContext;
+    Intent mIntent;
+
+    BluetoothMethodProxy mMethodProxy;
+    @Mock
+    BluetoothOppManager mBluetoothOppManager;
+
+    @Before
+    public void setUp() {
+        MockitoAnnotations.initMocks(this);
+        mTargetContext = spy(new ContextWrapper(
+                ApplicationProvider.getApplicationContext()));
+        mMethodProxy = spy(BluetoothMethodProxy.getInstance());
+        BluetoothMethodProxy.setInstanceForTesting(mMethodProxy);
+
+        mIntent = new Intent();
+        mIntent.setClass(mTargetContext, BluetoothOppLauncherActivity.class);
+
+        BluetoothOppTestUtils.enableOppActivities(true, mTargetContext);
+        BluetoothOppManager.setInstance(mBluetoothOppManager);
+        Intents.init();
+    }
+
+    @After
+    public void tearDown() {
+        BluetoothMethodProxy.setInstanceForTesting(null);
+        BluetoothOppManager.setInstance(null);
+        Intents.release();
+        BluetoothOppTestUtils.enableOppActivities(false, mTargetContext);
+    }
+
+    @Test
+    public void onCreate_withNoAction_returnImmediately() throws Exception {
+        ActivityScenario<BluetoothOppLauncherActivity> activityScenario = ActivityScenario.launch(
+                mIntent);
+        assertActivityState(activityScenario, Lifecycle.State.DESTROYED);
+    }
+
+    @Test
+    public void onCreate_withActionSend_withoutMetadata_finishImmediately() throws Exception {
+        mIntent.setAction(Intent.ACTION_SEND);
+        ActivityScenario<BluetoothOppLauncherActivity> activityScenario = ActivityScenario.launch(
+                mIntent);
+        assertActivityState(activityScenario, Lifecycle.State.DESTROYED);
+    }
+
+    @Test
+    public void onCreate_withActionSendMultiple_withoutMetadata_finishImmediately()
+            throws Exception {
+        mIntent.setAction(Intent.ACTION_SEND_MULTIPLE);
+        ActivityScenario<BluetoothOppLauncherActivity> activityScenario = ActivityScenario.launch(
+                mIntent);
+        assertActivityState(activityScenario, Lifecycle.State.DESTROYED);
+    }
+
+    @Test
+    public void onCreate_withActionOpen_sendBroadcast() throws Exception {
+        mIntent.setAction(Constants.ACTION_OPEN);
+        mIntent.setData(Uri.EMPTY);
+        ActivityScenario.launch(mIntent);
+        ArgumentCaptor<Intent> argument = ArgumentCaptor.forClass(Intent.class);
+
+        verify(mMethodProxy).contextSendBroadcast(any(), argument.capture());
+
+        assertThat(argument.getValue().getAction()).isEqualTo(Constants.ACTION_OPEN);
+        assertThat(argument.getValue().getComponent().getClassName())
+                .isEqualTo(BluetoothOppReceiver.class.getName());
+        assertThat(argument.getValue().getData()).isEqualTo(Uri.EMPTY);
+    }
+
+    @Ignore("b/263724420")
+    @Test
+    public void launchDevicePicker_bluetoothNotEnabled_launchEnableActivity() throws Exception {
+        doReturn(false).when(mMethodProxy).bluetoothAdapterIsEnabled(any());
+        // Unsupported action, the activity will stay without being finished right the way
+        mIntent.setAction("unsupported-action");
+        ActivityScenario<BluetoothOppLauncherActivity> scenario = ActivityScenario.launch(mIntent);
+
+        scenario.onActivity(BluetoothOppLauncherActivity::launchDevicePicker);
+
+        intended(hasComponent(BluetoothOppBtEnableActivity.class.getName()));
+    }
+
+    @Ignore("b/263724420")
+    @Test
+    public void launchDevicePicker_bluetoothEnabled_launchActivity() throws Exception {
+        doReturn(true).when(mMethodProxy).bluetoothAdapterIsEnabled(any());
+        // Unsupported action, the activity will stay without being finished right the way
+        mIntent.setAction("unsupported-action");
+        ActivityScenario<BluetoothOppLauncherActivity> scenario = ActivityScenario.launch(mIntent);
+
+        scenario.onActivity(BluetoothOppLauncherActivity::launchDevicePicker);
+
+        intended(hasAction(BluetoothDevicePicker.ACTION_LAUNCH));
+    }
+
+    @Test
+    public void createFileForSharedContent_returnFile() throws Exception {
+        doReturn(true).when(mMethodProxy).bluetoothAdapterIsEnabled(any());
+        // Unsupported action, the activity will stay without being finished right the way
+        mIntent.setAction("unsupported-action");
+        ActivityScenario<BluetoothOppLauncherActivity> scenario = ActivityScenario.launch(mIntent);
+
+        final Uri[] fileUri = new Uri[1];
+        final String shareContent =
+                "\na < b & c > a string to trigger pattern match with url: \r"
+                        + "www.google.com, phone number: +821023456798, and email: abc@test.com";
+        scenario.onActivity(activity -> {
+            fileUri[0] = activity.createFileForSharedContent(activity, shareContent);
+
+        });
+        assertThat(fileUri[0].toString().endsWith(".html")).isTrue();
+
+        File file = new File(fileUri[0].getPath());
+        // new file is in html format that include the shared content, so length should increase
+        assertThat(file.length()).isGreaterThan(shareContent.length());
+    }
+
+    @Test
+    public void sendFileInfo_finishImmediately() throws Exception {
+        doReturn(true).when(mMethodProxy).bluetoothAdapterIsEnabled(any());
+        // Unsupported action, the activity will stay without being finished right the way
+        mIntent.setAction("unsupported-action");
+        ActivityScenario<BluetoothOppLauncherActivity> scenario = ActivityScenario.launch(mIntent);
+        doThrow(new IllegalArgumentException()).when(mBluetoothOppManager).saveSendingFileInfo(
+                any(), any(String.class), anyBoolean(), anyBoolean());
+        scenario.onActivity(activity -> {
+            activity.sendFileInfo("text/plain", "content:///abc.txt", false, false);
+        });
+
+        assertActivityState(scenario, Lifecycle.State.DESTROYED);
+    }
+
+    private void assertActivityState(ActivityScenario activityScenario, Lifecycle.State state)
+            throws Exception {
+        Thread.sleep(2_000);
+        assertThat(activityScenario.getState()).isEqualTo(state);
+    }
+}
diff --git a/android/app/tests/unit/src/com/android/bluetooth/opp/BluetoothOppManagerTest.java b/android/app/tests/unit/src/com/android/bluetooth/opp/BluetoothOppManagerTest.java
new file mode 100644
index 0000000..75747da
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/opp/BluetoothOppManagerTest.java
@@ -0,0 +1,197 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.opp;
+
+import static com.android.bluetooth.opp.BluetoothOppManager.OPP_PREFERENCE_FILE;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import static org.mockito.Mockito.eq;
+import static org.mockito.Mockito.any;
+import static org.mockito.Mockito.doReturn;
+import static org.mockito.Mockito.nullable;
+import static org.mockito.Mockito.spy;
+import static org.mockito.Mockito.timeout;
+import static org.mockito.Mockito.verify;
+
+import android.bluetooth.BluetoothDevice;
+import android.bluetooth.BluetoothManager;
+import android.content.ContentValues;
+import android.content.Context;
+import android.content.ContextWrapper;
+import android.net.Uri;
+
+import androidx.test.platform.app.InstrumentationRegistry;
+import androidx.test.runner.AndroidJUnit4;
+
+import com.android.bluetooth.BluetoothMethodProxy;
+
+import org.junit.After;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.MockitoAnnotations;
+
+import java.util.ArrayList;
+import java.util.List;
+
+@RunWith(AndroidJUnit4.class)
+public class BluetoothOppManagerTest {
+    Context mContext;
+
+    BluetoothMethodProxy mCallProxy;
+
+    @Before
+    public void setUp() {
+        MockitoAnnotations.initMocks(this);
+        mContext = spy(new ContextWrapper(
+                InstrumentationRegistry.getInstrumentation().getTargetContext()));
+
+        mCallProxy = spy(BluetoothMethodProxy.getInstance());
+        BluetoothMethodProxy.setInstanceForTesting(mCallProxy);
+
+        doReturn(null).when(mCallProxy).contentResolverInsert(
+                any(), eq(BluetoothShare.CONTENT_URI), any());
+    }
+
+    @After
+    public void tearDown() {
+        BluetoothMethodProxy.setInstanceForTesting(null);
+        BluetoothOppUtility.sSendFileMap.clear();
+        mContext.getSharedPreferences(OPP_PREFERENCE_FILE, 0).edit().clear().apply();
+        BluetoothOppManager.sInstance = null;
+    }
+
+    @Test
+    public void
+    restoreApplicationData_afterSavingSingleSendingFileInfo_containsSendingFileInfoSaved() {
+        BluetoothOppManager bluetoothOppManager = BluetoothOppManager.getInstance(mContext);
+        bluetoothOppManager.mSendingFlag = true;
+        bluetoothOppManager.saveSendingFileInfo("text/plain", "content:///abc/xyz.txt", false,
+                true);
+
+        BluetoothOppManager.sInstance = null;
+        BluetoothOppManager restartedBluetoothOppManager = BluetoothOppManager.getInstance(
+                mContext);
+        assertThat(bluetoothOppManager.mSendingFlag).isEqualTo(
+                restartedBluetoothOppManager.mSendingFlag);
+        assertThat(bluetoothOppManager.mMultipleFlag).isEqualTo(
+                restartedBluetoothOppManager.mMultipleFlag);
+        assertThat(bluetoothOppManager.mUriOfSendingFile).isEqualTo(
+                restartedBluetoothOppManager.mUriOfSendingFile);
+        assertThat(bluetoothOppManager.mUrisOfSendingFiles).isEqualTo(
+                restartedBluetoothOppManager.mUrisOfSendingFiles);
+        assertThat(bluetoothOppManager.mMimeTypeOfSendingFile).isEqualTo(
+                restartedBluetoothOppManager.mMimeTypeOfSendingFile);
+        assertThat(bluetoothOppManager.mMimeTypeOfSendingFiles).isEqualTo(
+                restartedBluetoothOppManager.mMimeTypeOfSendingFiles);
+    }
+
+    @Test
+    public void
+    restoreApplicationData_afterSavingMultipleSendingFileInfo_containsSendingFileInfoSaved() {
+        BluetoothOppManager bluetoothOppManager = BluetoothOppManager.getInstance(mContext);
+        bluetoothOppManager.mSendingFlag = true;
+        bluetoothOppManager.saveSendingFileInfo("text/plain", new ArrayList<Uri>(
+                        List.of(Uri.parse("content:///abc/xyz.txt"), Uri.parse("content:///123"
+                                + "/456.txt"))),
+                false, true);
+
+        BluetoothOppManager.sInstance = null;
+        BluetoothOppManager restartedBluetoothOppManager = BluetoothOppManager.getInstance(
+                mContext);
+        assertThat(bluetoothOppManager.mSendingFlag).isEqualTo(
+                restartedBluetoothOppManager.mSendingFlag);
+        assertThat(bluetoothOppManager.mMultipleFlag).isEqualTo(
+                restartedBluetoothOppManager.mMultipleFlag);
+        assertThat(bluetoothOppManager.mUriOfSendingFile).isEqualTo(
+                restartedBluetoothOppManager.mUriOfSendingFile);
+        assertThat(bluetoothOppManager.mUrisOfSendingFiles).isEqualTo(
+                restartedBluetoothOppManager.mUrisOfSendingFiles);
+        assertThat(bluetoothOppManager.mMimeTypeOfSendingFile).isEqualTo(
+                restartedBluetoothOppManager.mMimeTypeOfSendingFile);
+        assertThat(bluetoothOppManager.mMimeTypeOfSendingFiles).isEqualTo(
+                restartedBluetoothOppManager.mMimeTypeOfSendingFiles);
+    }
+
+    @Test
+    public void isAcceptedList_inAcceptList_returnsTrue() {
+        BluetoothOppManager bluetoothOppManager = BluetoothOppManager.getInstance(mContext);
+        String address1 = "AA:BB:CC:DD:EE:FF";
+        String address2 = "00:11:22:33:44:55";
+
+        bluetoothOppManager.addToAcceptlist(address1);
+        bluetoothOppManager.addToAcceptlist(address2);
+        assertThat(bluetoothOppManager.isAcceptlisted(address1)).isTrue();
+        assertThat(bluetoothOppManager.isAcceptlisted(address2)).isTrue();
+    }
+
+    @Test
+    public void isAcceptedList_notInAcceptList_returnsFalse() {
+        BluetoothOppManager bluetoothOppManager = BluetoothOppManager.getInstance(mContext);
+        String address = "01:23:45:67:89:AB";
+
+        assertThat(bluetoothOppManager.isAcceptlisted(address)).isFalse();
+
+        bluetoothOppManager.addToAcceptlist(address);
+        assertThat(bluetoothOppManager.isAcceptlisted(address)).isTrue();
+    }
+
+    @Test
+    public void startTransfer_withMultipleUris_contentResolverInsertMultipleTimes() {
+        BluetoothOppManager bluetoothOppManager = BluetoothOppManager.getInstance(mContext);
+        String address = "AA:BB:CC:DD:EE:FF";
+        bluetoothOppManager.saveSendingFileInfo("text/plain", new ArrayList<Uri>(
+                List.of(Uri.parse("content:///abc/xyz.txt"),
+                        Uri.parse("content:///a/b/c/d/x/y/z.docs"),
+                        Uri.parse("content:///123/456.txt"))), false, true);
+        BluetoothDevice device = (mContext.getSystemService(BluetoothManager.class))
+                .getAdapter().getRemoteDevice(address);
+        bluetoothOppManager.startTransfer(device);
+        // add 2 files
+        verify(mCallProxy, timeout(5_000)
+                .times(3)).contentResolverInsert(any(), nullable(Uri.class),
+                nullable(ContentValues.class));
+    }
+
+    @Test
+    public void startTransfer_withOneUri_contentResolverInsertOnce() {
+        BluetoothOppManager bluetoothOppManager = BluetoothOppManager.getInstance(mContext);
+        String address = "AA:BB:CC:DD:EE:FF";
+        bluetoothOppManager.saveSendingFileInfo("text/plain", "content:///abc/xyz.txt",
+                false, true);
+        BluetoothDevice device = (mContext.getSystemService(BluetoothManager.class))
+                .getAdapter().getRemoteDevice(address);
+        bluetoothOppManager.startTransfer(device);
+        // add 2 files
+        verify(mCallProxy, timeout(5_000).times(1)).contentResolverInsert(any(),
+                nullable(Uri.class), nullable(ContentValues.class));
+    }
+
+    @Test
+    public void cleanUpSendingFileInfo_fileInfoCleaned() {
+        BluetoothOppUtility.sSendFileMap.clear();
+        Uri uri = Uri.parse("content:///a/new/folder/abc/xyz.txt");
+        assertThat(BluetoothOppUtility.sSendFileMap.size()).isEqualTo(0);
+        BluetoothOppManager.getInstance(mContext).saveSendingFileInfo("text/plain",
+                uri.toString(), false, true);
+        assertThat(BluetoothOppUtility.sSendFileMap.size()).isEqualTo(1);
+
+        BluetoothOppManager.getInstance(mContext).cleanUpSendingFileInfo();
+        assertThat(BluetoothOppUtility.sSendFileMap.size()).isEqualTo(0);
+    }
+}
diff --git a/android/app/tests/unit/src/com/android/bluetooth/opp/BluetoothOppNotificationTest.java b/android/app/tests/unit/src/com/android/bluetooth/opp/BluetoothOppNotificationTest.java
new file mode 100644
index 0000000..4c2bc24
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/opp/BluetoothOppNotificationTest.java
@@ -0,0 +1,240 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.opp;
+
+import static com.android.bluetooth.opp.BluetoothOppNotification.NOTIFICATION_ID_INBOUND_COMPLETE;
+import static com.android.bluetooth.opp.BluetoothOppNotification.NOTIFICATION_ID_OUTBOUND_COMPLETE;
+import static com.android.bluetooth.opp.BluetoothOppNotification.NOTIFICATION_ID_PROGRESS;
+
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.argThat;
+import static org.mockito.ArgumentMatchers.eq;
+import static org.mockito.Mockito.doReturn;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.spy;
+import static org.mockito.Mockito.verify;
+
+import android.app.NotificationManager;
+import android.content.Context;
+import android.content.ContextWrapper;
+import android.database.MatrixCursor;
+import android.graphics.drawable.Icon;
+import android.util.Log;
+
+import androidx.test.core.app.ApplicationProvider;
+import androidx.test.espresso.intent.Intents;
+import androidx.test.platform.app.InstrumentationRegistry;
+import androidx.test.runner.AndroidJUnit4;
+
+import com.android.bluetooth.BluetoothMethodProxy;
+import com.android.bluetooth.R;
+
+import org.junit.After;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.Mock;
+import org.mockito.MockitoAnnotations;
+
+import java.util.Objects;
+
+@RunWith(AndroidJUnit4.class)
+public class BluetoothOppNotificationTest {
+    @Mock
+    BluetoothMethodProxy mMethodProxy;
+
+    Context mTargetContext;
+
+    BluetoothOppNotification mOppNotification;
+
+    @Before
+    public void setUp() {
+        MockitoAnnotations.initMocks(this);
+        mTargetContext = spy(new ContextWrapper(
+                ApplicationProvider.getApplicationContext()));
+        mMethodProxy = spy(BluetoothMethodProxy.getInstance());
+        BluetoothMethodProxy.setInstanceForTesting(mMethodProxy);
+
+        InstrumentationRegistry.getInstrumentation().runOnMainSync(() ->
+                mOppNotification = new BluetoothOppNotification(mTargetContext));
+
+        Intents.init();
+    }
+
+    @After
+    public void tearDown() {
+        BluetoothMethodProxy.setInstanceForTesting(null);
+        Intents.release();
+    }
+
+    @Test
+    public void updateActiveNotification() {
+        long timestamp = 10L;
+        int dir = BluetoothShare.DIRECTION_INBOUND;
+        int id = 0;
+        long total = 200;
+        long current = 100;
+        int status = BluetoothShare.STATUS_RUNNING;
+        int confirmation = BluetoothShare.USER_CONFIRMATION_CONFIRMED;
+        int confirmationHandoverInitiated = BluetoothShare.USER_CONFIRMATION_HANDOVER_CONFIRMED;
+        String destination = "AA:BB:CC:DD:EE:FF";
+        NotificationManager mockNotificationManager = mock(NotificationManager.class);
+        mOppNotification.mNotificationMgr = mockNotificationManager;
+        MatrixCursor cursor = new MatrixCursor(new String[]{
+                BluetoothShare.TIMESTAMP, BluetoothShare.DIRECTION, BluetoothShare._ID,
+                BluetoothShare.TOTAL_BYTES, BluetoothShare.CURRENT_BYTES, BluetoothShare._DATA,
+                BluetoothShare.FILENAME_HINT, BluetoothShare.USER_CONFIRMATION,
+                BluetoothShare.DESTINATION, BluetoothShare.STATUS
+        });
+        cursor.addRow(new Object[]{
+                timestamp, dir, id, total, current, null, null, confirmation, destination, status
+        });
+        cursor.addRow(new Object[]{
+                timestamp + 10L, dir, id, total, current, null, null, confirmationHandoverInitiated,
+                destination, status
+        });
+        doReturn(cursor).when(mMethodProxy).contentResolverQuery(any(),
+                eq(BluetoothShare.CONTENT_URI), any(), any(), any(), any());
+
+        mOppNotification.updateActiveNotification();
+
+        //confirm handover case does broadcast
+        verify(mTargetContext).sendBroadcast(any(), eq(Constants.HANDOVER_STATUS_PERMISSION),
+                any());
+        // Todo: find a better way to verify the notification
+        // getContentIntent doesn't work because it requires signature permission
+        verify(mockNotificationManager).notify(eq(NOTIFICATION_ID_PROGRESS), argThat(
+                arg -> arg.getSmallIcon().sameAs(Icon.createWithResource(mTargetContext,
+                        android.R.drawable.stat_sys_download))
+        ));
+    }
+
+    @Test
+    public void updateCompletedNotification_withOutBoundShare_showsNoti() {
+        long timestamp = 10L;
+        int status = BluetoothShare.STATUS_SUCCESS;
+        int statusError = BluetoothShare.STATUS_CONNECTION_ERROR;
+        int dir = BluetoothShare.DIRECTION_OUTBOUND;
+        int id = 0;
+        long total = 200;
+        long current = 100;
+        int confirmation = BluetoothShare.USER_CONFIRMATION_CONFIRMED;
+        String destination = "AA:BB:CC:DD:EE:FF";
+        NotificationManager mockNotificationManager = mock(NotificationManager.class);
+        mOppNotification.mNotificationMgr = mockNotificationManager;
+        MatrixCursor cursor = new MatrixCursor(new String[]{
+                BluetoothShare.TIMESTAMP, BluetoothShare.DIRECTION, BluetoothShare._ID,
+                BluetoothShare.TOTAL_BYTES, BluetoothShare.CURRENT_BYTES, BluetoothShare._DATA,
+                BluetoothShare.FILENAME_HINT, BluetoothShare.USER_CONFIRMATION,
+                BluetoothShare.DESTINATION, BluetoothShare.STATUS
+        });
+        cursor.addRow(new Object[]{
+                timestamp, dir, id, total, current, null, null, confirmation, destination, status
+        });
+        cursor.addRow(new Object[]{
+                timestamp + 10L, dir, id, total, current, null, null, confirmation,
+                destination, statusError
+        });
+        doReturn(cursor).when(mMethodProxy).contentResolverQuery(any(),
+                eq(BluetoothShare.CONTENT_URI), any(), any(), any(), any());
+
+        mOppNotification.updateCompletedNotification();
+
+        // Todo: find a better way to verify the notification
+        // getContentIntent doesn't work because it requires signature permission
+        verify(mockNotificationManager).notify(eq(NOTIFICATION_ID_OUTBOUND_COMPLETE), argThat(
+                arg -> arg.getSmallIcon().sameAs(Icon.createWithResource(mTargetContext,
+                        android.R.drawable.stat_sys_upload_done))
+        ));
+    }
+
+    @Test
+    public void updateCompletedNotification_withInBoundShare_showsNoti() {
+        long timestamp = 10L;
+        int status = BluetoothShare.STATUS_SUCCESS;
+        int statusError = BluetoothShare.STATUS_CONNECTION_ERROR;
+        int dir = BluetoothShare.DIRECTION_INBOUND;
+        int id = 0;
+        long total = 200;
+        long current = 100;
+        int confirmation = BluetoothShare.USER_CONFIRMATION_CONFIRMED;
+        String destination = "AA:BB:CC:DD:EE:FF";
+        NotificationManager mockNotificationManager = mock(NotificationManager.class);
+        mOppNotification.mNotificationMgr = mockNotificationManager;
+        MatrixCursor cursor = new MatrixCursor(new String[]{
+                BluetoothShare.TIMESTAMP, BluetoothShare.DIRECTION, BluetoothShare._ID,
+                BluetoothShare.TOTAL_BYTES, BluetoothShare.CURRENT_BYTES, BluetoothShare._DATA,
+                BluetoothShare.FILENAME_HINT, BluetoothShare.USER_CONFIRMATION,
+                BluetoothShare.DESTINATION, BluetoothShare.STATUS
+        });
+        cursor.addRow(new Object[]{
+                timestamp, dir, id, total, current, null, null, confirmation, destination, status
+        });
+        cursor.addRow(new Object[]{
+                timestamp + 10L, dir, id, total, current, null, null, confirmation,
+                destination, statusError
+        });
+        doReturn(cursor).when(mMethodProxy).contentResolverQuery(any(),
+                eq(BluetoothShare.CONTENT_URI), any(), any(), any(), any());
+
+        mOppNotification.updateCompletedNotification();
+
+        // Todo: find a better way to verify the notification
+        // getContentIntent doesn't work because it requires signature permission
+        verify(mockNotificationManager).notify(eq(NOTIFICATION_ID_INBOUND_COMPLETE), argThat(
+                arg -> arg.getSmallIcon().sameAs(Icon.createWithResource(mTargetContext,
+                            android.R.drawable.stat_sys_download_done)
+        )));
+    }
+
+    @Test
+    public void updateIncomingFileConfirmationNotification() {
+        long timestamp = 10L;
+        int dir = BluetoothShare.DIRECTION_INBOUND;
+        int id = 0;
+        long total = 200;
+        long current = 100;
+        int confirmation = BluetoothShare.USER_CONFIRMATION_PENDING;
+        int status = BluetoothShare.STATUS_SUCCESS;
+        String url = "content:///abc/xyz";
+        String destination = "AA:BB:CC:DD:EE:FF";
+        String mimeType = "text/plain";
+        NotificationManager mockNotificationManager = mock(NotificationManager.class);
+        mOppNotification.mNotificationMgr = mockNotificationManager;
+        MatrixCursor cursor = new MatrixCursor(new String[]{
+                BluetoothShare.TIMESTAMP, BluetoothShare.DIRECTION, BluetoothShare._ID,
+                BluetoothShare.TOTAL_BYTES, BluetoothShare.CURRENT_BYTES, BluetoothShare._DATA,
+                BluetoothShare.FILENAME_HINT, BluetoothShare.USER_CONFIRMATION, BluetoothShare.URI,
+                BluetoothShare.DESTINATION, BluetoothShare.STATUS, BluetoothShare.MIMETYPE
+        });
+        cursor.addRow(new Object[]{
+                timestamp, dir, id, total, current, null, null, confirmation, url, destination,
+                status, mimeType
+        });
+        doReturn(cursor).when(mMethodProxy).contentResolverQuery(any(),
+                eq(BluetoothShare.CONTENT_URI), any(), any(), any(), any());
+
+        mOppNotification.updateIncomingFileConfirmNotification();
+
+        // Todo: find a better way to verify the notification
+        // getContentIntent doesn't work because it requires signature permission
+        verify(mockNotificationManager).notify(eq(NOTIFICATION_ID_PROGRESS), argThat(
+                arg -> arg.getSmallIcon().sameAs(Icon.createWithResource(mTargetContext,
+                    R.drawable.bt_incomming_file_notification))
+        ));
+    }
+}
diff --git a/android/app/tests/unit/src/com/android/bluetooth/opp/BluetoothOppReceiveFileInfoTest.java b/android/app/tests/unit/src/com/android/bluetooth/opp/BluetoothOppReceiveFileInfoTest.java
new file mode 100644
index 0000000..bc7714d
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/opp/BluetoothOppReceiveFileInfoTest.java
@@ -0,0 +1,233 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.opp;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.eq;
+import static org.mockito.Mockito.doReturn;
+import static org.mockito.Mockito.spy;
+
+import android.content.Context;
+import android.content.ContextWrapper;
+import android.database.MatrixCursor;
+import android.net.Uri;
+import android.os.Environment;
+import android.provider.MediaStore;
+
+import androidx.test.platform.app.InstrumentationRegistry;
+import androidx.test.runner.AndroidJUnit4;
+
+import com.android.bluetooth.BluetoothMethodProxy;
+
+import org.junit.After;
+import org.junit.Assume;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.MockitoAnnotations;
+
+@RunWith(AndroidJUnit4.class)
+public class BluetoothOppReceiveFileInfoTest {
+    Context mContext;
+    BluetoothMethodProxy mCallProxy;
+
+    MatrixCursor mCursor;
+
+    @Before
+    public void setUp() {
+        mContext = spy(new ContextWrapper(
+                InstrumentationRegistry.getInstrumentation().getTargetContext()));
+
+        mCallProxy = spy(BluetoothMethodProxy.getInstance());
+        BluetoothMethodProxy.setInstanceForTesting(mCallProxy);
+
+        doReturn(null).when(mCallProxy).contentResolverInsert(
+                any(), eq(BluetoothShare.CONTENT_URI), any());
+    }
+
+    @After
+    public void tearDown() {
+        BluetoothMethodProxy.setInstanceForTesting(null);
+        BluetoothOppManager.sInstance = null;
+    }
+
+    @Test
+    public void createInstance_withStatus_createCorrectly() {
+        BluetoothOppReceiveFileInfo info =
+                new BluetoothOppReceiveFileInfo(BluetoothShare.STATUS_CANCELED);
+
+        assertThat(info.mStatus).isEqualTo(BluetoothShare.STATUS_CANCELED);
+    }
+
+    @Test
+    public void createInstance_withData_createCorrectly() {
+        String data = "abcdef";
+        int status = BluetoothShare.STATUS_SUCCESS;
+        BluetoothOppReceiveFileInfo info =
+                new BluetoothOppReceiveFileInfo(data, data.length(), status);
+
+        assertThat(info.mStatus).isEqualTo(status);
+        assertThat(info.mLength).isEqualTo(data.length());
+        assertThat(info.mData).isEqualTo(data);
+    }
+
+    @Test
+    public void createInstance_withFileName_createCorrectly() {
+        String fileName = "abcdef.txt";
+        int length = 10;
+        int status = BluetoothShare.STATUS_SUCCESS;
+        Uri uri = Uri.parse("content:///abc/xyz");
+        BluetoothOppReceiveFileInfo info =
+                new BluetoothOppReceiveFileInfo(fileName, length, uri, status);
+
+        assertThat(info.mStatus).isEqualTo(status);
+        assertThat(info.mLength).isEqualTo(length);
+        assertThat(info.mFileName).isEqualTo(fileName);
+        assertThat(info.mInsertUri).isEqualTo(uri);
+    }
+
+    @Test
+    public void generateFileInfo_wrongHint_fileError() {
+        Assume.assumeTrue("Ignore test when if there is no media mounted",
+                Environment.getExternalStorageState().equals(Environment.MEDIA_MOUNTED));
+        int id = 0;
+        long fileLength = 100;
+        String hint = "content:///arandomhint/";
+        String mimeType = "text/plain";
+
+        mCursor = new MatrixCursor(
+                new String[]{BluetoothShare.FILENAME_HINT, BluetoothShare.TOTAL_BYTES,
+                        BluetoothShare.MIMETYPE});
+        mCursor.addRow(new Object[]{hint, fileLength, mimeType});
+
+        doReturn(mCursor).when(mCallProxy).contentResolverQuery(
+                any(), eq(Uri.parse(BluetoothShare.CONTENT_URI + "/" + id)), any(), any(), any(),
+                any());
+
+        BluetoothOppReceiveFileInfo info =
+                BluetoothOppReceiveFileInfo.generateFileInfo(mContext, id);
+
+        assertThat(info.mStatus).isEqualTo(BluetoothShare.STATUS_FILE_ERROR);
+    }
+
+    @Test
+    public void generateFileInfo_noMediaMounted_noSdcardError() {
+        Assume.assumeTrue("Ignore test when if there is media mounted",
+                !Environment.getExternalStorageState().equals(Environment.MEDIA_MOUNTED));
+        int id = 0;
+
+        BluetoothOppReceiveFileInfo info =
+                BluetoothOppReceiveFileInfo.generateFileInfo(mContext, id);
+
+        assertThat(info.mStatus).isEqualTo(BluetoothShare.STATUS_ERROR_NO_SDCARD);
+    }
+
+    @Test
+    public void generateFileInfo_noInsertUri_returnFileError() {
+        Assume.assumeTrue("Ignore test when if there is not media mounted",
+                Environment.getExternalStorageState().equals(Environment.MEDIA_MOUNTED));
+        int id = 0;
+        long fileLength = 100;
+        String hint = "content:///arandomhint.txt";
+        String mimeType = "text/plain";
+
+        mCursor = new MatrixCursor(
+                new String[]{BluetoothShare.FILENAME_HINT, BluetoothShare.TOTAL_BYTES,
+                        BluetoothShare.MIMETYPE});
+        mCursor.addRow(new Object[]{hint, fileLength, mimeType});
+
+        doReturn(mCursor).when(mCallProxy).contentResolverQuery(
+                any(), eq(Uri.parse(BluetoothShare.CONTENT_URI + "/" + id)), any(), any(), any(),
+                any());
+
+        doReturn(null).when(mCallProxy).contentResolverInsert(
+                any(), eq(MediaStore.Downloads.EXTERNAL_CONTENT_URI), any());
+
+        BluetoothOppReceiveFileInfo info =
+                BluetoothOppReceiveFileInfo.generateFileInfo(mContext, id);
+
+        assertThat(info.mStatus).isEqualTo(BluetoothShare.STATUS_FILE_ERROR);
+    }
+
+    @Test
+    public void generateFileInfo_withInsertUri_workCorrectly() {
+        Assume.assumeTrue("Ignore test when if there is not media mounted",
+                Environment.getExternalStorageState().equals(Environment.MEDIA_MOUNTED));
+        int id = 0;
+        long fileLength = 100;
+        String hint = "content:///arandomhint.txt";
+        String mimeType = "text/plain";
+        Uri insertUri = Uri.parse("content:///abc/xyz");
+
+        mCursor = new MatrixCursor(
+                new String[]{BluetoothShare.FILENAME_HINT, BluetoothShare.TOTAL_BYTES,
+                        BluetoothShare.MIMETYPE});
+        mCursor.addRow(new Object[]{hint, fileLength, mimeType});
+
+        doReturn(mCursor).when(mCallProxy).contentResolverQuery(
+                any(), eq(Uri.parse(BluetoothShare.CONTENT_URI + "/" + id)), any(), any(), any(),
+                any());
+
+        doReturn(insertUri).when(mCallProxy).contentResolverInsert(
+                any(), eq(MediaStore.Downloads.EXTERNAL_CONTENT_URI), any());
+
+        assertThat(mCursor.moveToFirst()).isTrue();
+
+        BluetoothOppReceiveFileInfo info =
+                BluetoothOppReceiveFileInfo.generateFileInfo(mContext, id);
+
+        assertThat(info.mStatus).isEqualTo(0);
+        assertThat(info.mInsertUri).isEqualTo(insertUri);
+        assertThat(info.mLength).isEqualTo(fileLength);
+    }
+
+    @Test
+    public void generateFileInfo_longFileName_trimFileName() {
+        Assume.assumeTrue("Ignore test when if there is not media mounted",
+                Environment.getExternalStorageState().equals(Environment.MEDIA_MOUNTED));
+        int id = 0;
+        long fileLength = 100;
+        String hint = "content:///" + "a".repeat(500) + ".txt";
+        String mimeType = "text/plain";
+        Uri insertUri = Uri.parse("content:///abc/xyz");
+
+        mCursor = new MatrixCursor(
+                new String[]{BluetoothShare.FILENAME_HINT, BluetoothShare.TOTAL_BYTES,
+                        BluetoothShare.MIMETYPE});
+        mCursor.addRow(new Object[]{hint, fileLength, mimeType});
+
+        doReturn(mCursor).when(mCallProxy).contentResolverQuery(
+                any(), eq(Uri.parse(BluetoothShare.CONTENT_URI + "/" + id)), any(), any(), any(),
+                any());
+
+        doReturn(insertUri).when(mCallProxy).contentResolverInsert(
+                any(), eq(MediaStore.Downloads.EXTERNAL_CONTENT_URI), any());
+
+        assertThat(mCursor.moveToFirst()).isTrue();
+
+        BluetoothOppReceiveFileInfo info =
+                BluetoothOppReceiveFileInfo.generateFileInfo(mContext, id);
+
+        assertThat(info.mStatus).isEqualTo(0);
+        assertThat(info.mInsertUri).isEqualTo(insertUri);
+        assertThat(info.mLength).isEqualTo(fileLength);
+        // maximum file length for Linux is 255
+        assertThat(info.mFileName.length()).isLessThan(256);
+    }
+}
diff --git a/android/app/tests/unit/src/com/android/bluetooth/opp/BluetoothOppReceiverTest.java b/android/app/tests/unit/src/com/android/bluetooth/opp/BluetoothOppReceiverTest.java
new file mode 100644
index 0000000..2f087f4
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/opp/BluetoothOppReceiverTest.java
@@ -0,0 +1,317 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.opp;
+
+import static androidx.test.espresso.intent.Intents.intended;
+import static androidx.test.espresso.intent.Intents.intending;
+import static androidx.test.espresso.intent.matcher.IntentMatchers.anyIntent;
+import static androidx.test.espresso.intent.matcher.IntentMatchers.hasComponent;
+import static androidx.test.espresso.intent.matcher.IntentMatchers.hasExtra;
+
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.argThat;
+import static org.mockito.ArgumentMatchers.eq;
+import static org.mockito.Mockito.doNothing;
+import static org.mockito.Mockito.doReturn;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.never;
+import static org.mockito.Mockito.spy;
+import static org.mockito.Mockito.verify;
+
+import android.app.Activity;
+import android.app.Instrumentation;
+import android.bluetooth.BluetoothDevice;
+import android.bluetooth.BluetoothDevicePicker;
+import android.bluetooth.BluetoothManager;
+import android.content.Context;
+import android.content.ContextWrapper;
+import android.content.Intent;
+import android.database.Cursor;
+import android.net.Uri;
+
+import androidx.test.core.app.ActivityScenario;
+import androidx.test.espresso.intent.Intents;
+import androidx.test.platform.app.InstrumentationRegistry;
+import androidx.test.runner.AndroidJUnit4;
+
+import com.android.bluetooth.BluetoothMethodProxy;
+
+import com.google.common.base.Objects;
+
+import org.junit.After;
+import org.junit.Before;
+import org.junit.Ignore;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.Mock;
+import org.mockito.MockitoAnnotations;
+
+import java.util.ArrayList;
+import java.util.List;
+
+@RunWith(AndroidJUnit4.class)
+public class BluetoothOppReceiverTest {
+    Context mContext;
+
+    @Mock
+    BluetoothMethodProxy mBluetoothMethodProxy;
+    BluetoothOppReceiver mReceiver;
+
+    @Before
+    public void setUp() {
+        MockitoAnnotations.initMocks(this);
+        mContext = spy(new ContextWrapper(
+                InstrumentationRegistry.getInstrumentation().getTargetContext()));
+
+        // mock instance so query/insert/update/etc. will not be executed
+        BluetoothMethodProxy.setInstanceForTesting(mBluetoothMethodProxy);
+
+        mReceiver = new BluetoothOppReceiver();
+
+        Intents.init();
+
+        BluetoothOppTestUtils.enableOppActivities(true, mContext);
+    }
+
+    @After
+    public void tearDown() {
+        BluetoothMethodProxy.setInstanceForTesting(null);
+
+        Intents.release();
+    }
+
+    @Ignore("b/262201478")
+    @Test
+    public void onReceive_withActionDeviceSelected_callsStartTransfer() {
+        BluetoothOppManager bluetoothOppManager = spy(BluetoothOppManager.getInstance(mContext));
+        BluetoothOppManager.setInstance(bluetoothOppManager);
+        String address = "AA:BB:CC:DD:EE:FF";
+        BluetoothDevice device = mContext.getSystemService(BluetoothManager.class)
+                .getAdapter().getRemoteDevice(address);
+        Intent intent = new Intent();
+        intent.setAction(BluetoothDevicePicker.ACTION_DEVICE_SELECTED);
+        intent.putExtra(BluetoothDevice.EXTRA_DEVICE, device);
+        ActivityScenario<BluetoothOppBtEnableActivity> activityScenario
+                = ActivityScenario.launch(BluetoothOppBtEnableActivity.class);
+        activityScenario.onActivity(activity -> {
+            mReceiver.onReceive(mContext, intent);
+        });
+        doNothing().when(bluetoothOppManager).startTransfer(eq(device));
+        verify(bluetoothOppManager).startTransfer(eq(device));
+        BluetoothOppManager.setInstance(null);
+    }
+
+    @Test
+    public void onReceive_withActionIncomingFileConfirm_startsIncomingFileConfirmActivity() {
+        Intent intent = new Intent();
+        intent.setAction(Constants.ACTION_INCOMING_FILE_CONFIRM);
+        intent.setData(Uri.parse("content:///not/important"));
+        mReceiver.onReceive(mContext, intent);
+        intended(hasComponent(BluetoothOppIncomingFileConfirmActivity.class.getName()));
+    }
+
+    @Test
+    public void onReceive_withActionAccept_updatesContents() {
+        Uri uri = Uri.parse("content:///important");
+        Intent intent = new Intent();
+        intent.setAction(Constants.ACTION_ACCEPT);
+        intent.setData(uri);
+        mReceiver.onReceive(mContext, intent);
+        verify(mBluetoothMethodProxy).contentResolverUpdate(any(), eq(uri), argThat(arg ->
+                Objects.equal(BluetoothShare.USER_CONFIRMATION_CONFIRMED,
+                        arg.get(BluetoothShare.USER_CONFIRMATION))), any(), any());
+    }
+
+    @Test
+    public void onReceive_withActionDecline_updatesContents() {
+        Uri uri = Uri.parse("content:///important");
+        Intent intent = new Intent();
+        intent.setAction(Constants.ACTION_DECLINE);
+        intent.setData(uri);
+        mReceiver.onReceive(mContext, intent);
+        verify(mBluetoothMethodProxy).contentResolverUpdate(any(), eq(uri), argThat(arg ->
+                Objects.equal(BluetoothShare.USER_CONFIRMATION_DENIED,
+                        arg.get(BluetoothShare.USER_CONFIRMATION))), any(), any());
+    }
+
+    @Test
+    public void onReceive_withActionOutboundTransfer_startsTransferHistoryActivity() {
+        Intent intent = new Intent();
+        intent.setAction(Constants.ACTION_OPEN_OUTBOUND_TRANSFER);
+        intent.setData(Uri.parse("content:///not/important"));
+        intending(anyIntent()).respondWith(
+                new Instrumentation.ActivityResult(Activity.RESULT_OK, new Intent()));
+
+        mReceiver.onReceive(mContext, intent);
+        intended(hasComponent(BluetoothOppTransferHistory.class.getName()));
+        intended(hasExtra("direction", BluetoothShare.DIRECTION_OUTBOUND));
+    }
+
+    @Test
+    public void onReceive_withActionInboundTransfer_startsTransferHistoryActivity() {
+        Intent intent = new Intent();
+        intent.setAction(Constants.ACTION_OPEN_INBOUND_TRANSFER);
+        intent.setData(Uri.parse("content:///not/important"));
+        intending(anyIntent()).respondWith(
+                new Instrumentation.ActivityResult(Activity.RESULT_OK, new Intent()));
+        mReceiver.onReceive(mContext, intent);
+        intended(hasComponent(BluetoothOppTransferHistory.class.getName()));
+        intended(hasExtra("direction", BluetoothShare.DIRECTION_INBOUND));
+    }
+
+    @Test
+    public void onReceive_withActionOpenReceivedFile_startsTransferHistoryActivity() {
+        Intent intent = new Intent();
+        intent.setAction(Constants.ACTION_OPEN_RECEIVED_FILES);
+        intent.setData(Uri.parse("content:///not/important"));
+        mReceiver.onReceive(mContext, intent);
+        intended(hasComponent(BluetoothOppTransferHistory.class.getName()));
+        intended(hasExtra("direction", BluetoothShare.DIRECTION_INBOUND));
+        intended(hasExtra(Constants.EXTRA_SHOW_ALL_FILES, true));
+    }
+
+    @Test
+    public void onReceive_withActionHide_contentUpdate() {
+        List<BluetoothOppTestUtils.CursorMockData> cursorMockDataList;
+        Cursor cursor = mock(Cursor.class);
+        cursorMockDataList = new ArrayList<>(List.of(
+                new BluetoothOppTestUtils.CursorMockData(BluetoothShare.VISIBILITY, 0,
+                        BluetoothShare.VISIBILITY_VISIBLE),
+                new BluetoothOppTestUtils.CursorMockData(BluetoothShare.USER_CONFIRMATION, 1,
+                        BluetoothShare.USER_CONFIRMATION_PENDING)
+        ));
+
+        BluetoothOppTestUtils.setUpMockCursor(cursor, cursorMockDataList);
+
+        doReturn(cursor).when(mBluetoothMethodProxy).contentResolverQuery(any(), any(), any(),
+                any(), any(), any());
+        doReturn(true).when(cursor).moveToFirst();
+
+        Intent intent = new Intent();
+        intent.setAction(Constants.ACTION_HIDE);
+        mReceiver.onReceive(mContext, intent);
+
+        verify(mBluetoothMethodProxy).contentResolverUpdate(any(), any(),
+                argThat(arg -> Objects.equal(BluetoothShare.VISIBILITY_HIDDEN,
+                        arg.get(BluetoothShare.VISIBILITY))), any(), any());
+    }
+
+    @Test
+    public void onReceive_withActionCompleteHide_contentUpdate() {
+        Intent intent = new Intent();
+        intent.setAction(Constants.ACTION_COMPLETE_HIDE);
+        mReceiver.onReceive(mContext, intent);
+        verify(mBluetoothMethodProxy).contentResolverUpdate(any(), eq(BluetoothShare.CONTENT_URI),
+                argThat(arg -> Objects.equal(BluetoothShare.VISIBILITY_HIDDEN,
+                        arg.get(BluetoothShare.VISIBILITY))), any(), any());
+    }
+
+    @Test
+    public void onReceive_withActionTransferCompletedAndHandoverInitiated_contextSendBroadcast() {
+        List<BluetoothOppTestUtils.CursorMockData> cursorMockDataList;
+        Cursor cursor = mock(Cursor.class);
+        int idValue = 1234;
+        Long timestampValue = 123456789L;
+        String destinationValue = "AA:BB:CC:00:11:22";
+        String fileTypeValue = "text/plain";
+
+        cursorMockDataList = new ArrayList<>(List.of(
+                new BluetoothOppTestUtils.CursorMockData(BluetoothShare._ID, 0, idValue),
+                new BluetoothOppTestUtils.CursorMockData(BluetoothShare.STATUS, 1,
+                        BluetoothShare.STATUS_SUCCESS),
+                new BluetoothOppTestUtils.CursorMockData(BluetoothShare.DIRECTION, 2,
+                        BluetoothShare.DIRECTION_OUTBOUND),
+                new BluetoothOppTestUtils.CursorMockData(BluetoothShare.TOTAL_BYTES, 3, 100),
+                new BluetoothOppTestUtils.CursorMockData(BluetoothShare.CURRENT_BYTES, 4, 100),
+                new BluetoothOppTestUtils.CursorMockData(BluetoothShare.MIMETYPE, 5, fileTypeValue),
+                new BluetoothOppTestUtils.CursorMockData(BluetoothShare.TIMESTAMP, 6,
+                        timestampValue),
+                new BluetoothOppTestUtils.CursorMockData(BluetoothShare.DESTINATION, 7,
+                        destinationValue),
+                new BluetoothOppTestUtils.CursorMockData(BluetoothShare._DATA, 8, null),
+                new BluetoothOppTestUtils.CursorMockData(BluetoothShare.FILENAME_HINT, 9, null),
+                new BluetoothOppTestUtils.CursorMockData(BluetoothShare.URI, 10,
+                        "content://textfile.txt"),
+                new BluetoothOppTestUtils.CursorMockData(BluetoothShare.USER_CONFIRMATION, 11,
+                        BluetoothShare.USER_CONFIRMATION_HANDOVER_CONFIRMED)
+        ));
+
+        BluetoothOppTestUtils.setUpMockCursor(cursor, cursorMockDataList);
+
+        doReturn(cursor).when(mBluetoothMethodProxy).contentResolverQuery(any(), any(), any(),
+                any(), any(), any());
+        doReturn(true).when(cursor).moveToFirst();
+
+        Intent intent = new Intent();
+        intent.setAction(BluetoothShare.TRANSFER_COMPLETED_ACTION);
+        mReceiver.onReceive(mContext, intent);
+        verify(mContext).sendBroadcast(any(), eq(Constants.HANDOVER_STATUS_PERMISSION), any());
+    }
+
+    @Test
+    public void onReceive_withActionTransferComplete_noBroadcastSent() throws Exception {
+        List<BluetoothOppTestUtils.CursorMockData> cursorMockDataList;
+        Cursor cursor = mock(Cursor.class);
+        int idValue = 1234;
+        Long timestampValue = 123456789L;
+        String destinationValue = "AA:BB:CC:00:11:22";
+        String fileTypeValue = "text/plain";
+
+        cursorMockDataList = new ArrayList<>(List.of(
+                new BluetoothOppTestUtils.CursorMockData(BluetoothShare._ID, 0, idValue),
+                new BluetoothOppTestUtils.CursorMockData(BluetoothShare.STATUS, 1,
+                        BluetoothShare.STATUS_SUCCESS),
+                new BluetoothOppTestUtils.CursorMockData(BluetoothShare.DIRECTION, 2,
+                        BluetoothShare.DIRECTION_OUTBOUND),
+                new BluetoothOppTestUtils.CursorMockData(BluetoothShare.TOTAL_BYTES, 3, 100),
+                new BluetoothOppTestUtils.CursorMockData(BluetoothShare.CURRENT_BYTES, 4, 100),
+                new BluetoothOppTestUtils.CursorMockData(BluetoothShare.MIMETYPE, 5, fileTypeValue),
+                new BluetoothOppTestUtils.CursorMockData(BluetoothShare.TIMESTAMP, 6,
+                        timestampValue),
+                new BluetoothOppTestUtils.CursorMockData(BluetoothShare.DESTINATION, 7,
+                        destinationValue),
+                new BluetoothOppTestUtils.CursorMockData(BluetoothShare._DATA, 8, null),
+                new BluetoothOppTestUtils.CursorMockData(BluetoothShare.FILENAME_HINT, 9, null),
+                new BluetoothOppTestUtils.CursorMockData(BluetoothShare.URI, 10,
+                        "content://textfile.txt"),
+                new BluetoothOppTestUtils.CursorMockData(BluetoothShare.USER_CONFIRMATION, 11,
+                        BluetoothShare.USER_CONFIRMATION_CONFIRMED)
+        ));
+
+        BluetoothOppTestUtils.setUpMockCursor(cursor, cursorMockDataList);
+
+        doReturn(cursor).when(mBluetoothMethodProxy).contentResolverQuery(any(), any(), any(),
+                any(), any(), any());
+        doReturn(true).when(cursor).moveToFirst();
+
+        Intent intent = new Intent();
+        intent.setAction(BluetoothShare.TRANSFER_COMPLETED_ACTION);
+
+        ActivityScenario<BluetoothOppBtEnableActivity> activityScenario
+                = ActivityScenario.launch(BluetoothOppBtEnableActivity.class);
+
+        activityScenario.onActivity(activity -> {
+            mReceiver.onReceive(mContext, intent);
+        });
+        InstrumentationRegistry.getInstrumentation().waitForIdleSync();
+
+        // check Toast with Espresso seems not to work on Android 11+. Check not send broadcast
+        // context instead
+        verify(mContext, never()).sendBroadcast(any(), eq(Constants.HANDOVER_STATUS_PERMISSION),
+                any());
+    }
+}
diff --git a/android/app/tests/unit/src/com/android/bluetooth/opp/BluetoothOppSendFileInfoTest.java b/android/app/tests/unit/src/com/android/bluetooth/opp/BluetoothOppSendFileInfoTest.java
new file mode 100644
index 0000000..756836a
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/opp/BluetoothOppSendFileInfoTest.java
@@ -0,0 +1,220 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.android.bluetooth.opp;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.anyInt;
+import static org.mockito.ArgumentMatchers.eq;
+import static org.mockito.Mockito.doReturn;
+import static org.mockito.Mockito.doThrow;
+import static org.mockito.Mockito.mock;
+
+import android.content.Context;
+import android.content.res.AssetFileDescriptor;
+import android.database.MatrixCursor;
+import android.net.Uri;
+import android.provider.OpenableColumns;
+import android.util.Log;
+
+import androidx.test.platform.app.InstrumentationRegistry;
+import androidx.test.runner.AndroidJUnit4;
+
+import com.android.bluetooth.BluetoothMethodProxy;
+
+import org.junit.After;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.Mock;
+import org.mockito.MockitoAnnotations;
+
+import java.io.FileInputStream;
+import java.io.IOException;
+
+@RunWith(AndroidJUnit4.class)
+public class BluetoothOppSendFileInfoTest {
+    Context mContext;
+    MatrixCursor mCursor;
+
+    @Mock
+    BluetoothMethodProxy mCallProxy;
+
+    @Before
+    public void setUp() {
+        MockitoAnnotations.initMocks(this);
+        mContext = InstrumentationRegistry.getInstrumentation().getTargetContext();
+        BluetoothMethodProxy.setInstanceForTesting(mCallProxy);
+    }
+
+    @After
+    public void tearDown() {
+        BluetoothMethodProxy.setInstanceForTesting(null);
+    }
+
+    @Test
+    public void createInstance_withFileInputStream() {
+        String fileName = "abc.txt";
+        String type = "text/plain";
+        long length = 10000;
+        FileInputStream inputStream = mock(FileInputStream.class);
+        int status = BluetoothShare.STATUS_SUCCESS;
+        BluetoothOppSendFileInfo info =
+                new BluetoothOppSendFileInfo(fileName, type, length, inputStream, status);
+
+        assertThat(info.mStatus).isEqualTo(status);
+        assertThat(info.mFileName).isEqualTo(fileName);
+        assertThat(info.mLength).isEqualTo(length);
+        assertThat(info.mInputStream).isEqualTo(inputStream);
+        assertThat(info.mMimetype).isEqualTo(type);
+    }
+
+    @Test
+    public void createInstance_withoutFileInputStream() {
+        String type = "text/plain";
+        long length = 10000;
+        int status = BluetoothShare.STATUS_SUCCESS;
+        String data = "Testing is boring";
+        BluetoothOppSendFileInfo info =
+                new BluetoothOppSendFileInfo(data, type, length, status);
+
+        assertThat(info.mStatus).isEqualTo(status);
+        assertThat(info.mData).isEqualTo(data);
+        assertThat(info.mLength).isEqualTo(length);
+        assertThat(info.mMimetype).isEqualTo(type);
+    }
+
+    @Test
+    public void generateFileInfo_withUnsupportedScheme_returnsSendFileInfoError() {
+        String type = "text/plain";
+        Uri uri = Uri.parse("https://www.google.com");
+
+        BluetoothOppSendFileInfo info = BluetoothOppSendFileInfo.generateFileInfo(mContext, uri,
+                type, true);
+        assertThat(info).isEqualTo(BluetoothOppSendFileInfo.SEND_FILE_INFO_ERROR);
+    }
+
+    @Test
+    public void generateFileInfo_withForbiddenExternalUri_returnsSendFileInfoError() {
+        String type = "text/plain";
+        Uri uri = Uri.parse("content://com.android.bluetooth.map.MmsFileProvider:8080");
+
+        BluetoothOppSendFileInfo info = BluetoothOppSendFileInfo.generateFileInfo(mContext, uri,
+                type, true);
+        assertThat(info).isEqualTo(BluetoothOppSendFileInfo.SEND_FILE_INFO_ERROR);
+    }
+
+    @Test
+    public void generateFileInfo_withoutPermissionForAccessingUri_returnsSendFileInfoError() {
+        String type = "text/plain";
+        Uri uri = Uri.parse("content:///hello/world");
+
+        doThrow(new SecurityException()).when(mCallProxy).contentResolverQuery(
+                any(), eq(uri), any(), any(), any(),
+                any());
+
+        BluetoothOppSendFileInfo info = BluetoothOppSendFileInfo.generateFileInfo(mContext, uri,
+                type, true);
+        assertThat(info).isEqualTo(BluetoothOppSendFileInfo.SEND_FILE_INFO_ERROR);
+    }
+
+    @Test
+    public void generateFileInfo_withUncorrectableMismatch_returnsSendFileInfoError()
+            throws IOException {
+        String type = "text/plain";
+        Uri uri = Uri.parse("content:///hello/world");
+
+        long fileLength = 0;
+        String fileName = "coolName.txt";
+
+        AssetFileDescriptor fd = mock(AssetFileDescriptor.class);
+        FileInputStream fs = mock(FileInputStream.class);
+
+        mCursor = new MatrixCursor(new String[]{
+                OpenableColumns.DISPLAY_NAME, OpenableColumns.SIZE
+        });
+        mCursor.addRow(new Object[]{fileName, fileLength});
+
+        doReturn(mCursor).when(mCallProxy).contentResolverQuery(
+                any(), eq(uri), any(), any(), any(),
+                any());
+
+        doReturn(fd).when(mCallProxy).contentResolverOpenAssetFileDescriptor(
+                any(), eq(uri), any());
+        doReturn(0L).when(fd).getLength();
+        doThrow(new IOException()).when(fd).createInputStream();
+        doReturn(fs).when(mCallProxy).contentResolverOpenInputStream(any(), eq(uri));
+        doReturn(0, -1).when(fs).read(any(), anyInt(), anyInt());
+
+        BluetoothOppSendFileInfo info = BluetoothOppSendFileInfo.generateFileInfo(mContext, uri,
+                type, true);
+
+        assertThat(info).isEqualTo(BluetoothOppSendFileInfo.SEND_FILE_INFO_ERROR);
+    }
+
+    @Test
+    public void generateFileInfo_withCorrectableMismatch_returnInfoWithCorrectLength()
+            throws IOException {
+        String type = "text/plain";
+        Uri uri = Uri.parse("content:///hello/world");
+
+        long fileLength = 0;
+        long correctFileLength = 1000;
+        String fileName = "coolName.txt";
+
+        AssetFileDescriptor fd = mock(AssetFileDescriptor.class);
+        FileInputStream fs = mock(FileInputStream.class);
+
+        mCursor = new MatrixCursor(new String[]{
+                OpenableColumns.DISPLAY_NAME, OpenableColumns.SIZE
+        });
+        mCursor.addRow(new Object[]{fileName, fileLength});
+
+        doReturn(mCursor).when(mCallProxy).contentResolverQuery(
+                any(), eq(uri), any(), any(), any(),
+                any());
+
+        doReturn(fd).when(mCallProxy).contentResolverOpenAssetFileDescriptor(
+                any(), eq(uri), any());
+        doReturn(0L).when(fd).getLength();
+        doReturn(fs).when(fd).createInputStream();
+
+        // the real size will be returned in getStreamSize(fs)
+        doReturn((int) correctFileLength, -1).when(fs).read(any(), anyInt(), anyInt());
+
+        BluetoothOppSendFileInfo info = BluetoothOppSendFileInfo.generateFileInfo(mContext, uri,
+                type, true);
+
+        assertThat(info.mInputStream).isEqualTo(fs);
+        assertThat(info.mFileName).isEqualTo(fileName);
+        assertThat(info.mLength).isEqualTo(correctFileLength);
+        assertThat(info.mStatus).isEqualTo(0);
+    }
+
+    @Test
+    public void generateFileInfo_withFileUriNotInExternalStorageDir_returnFileErrorInfo() {
+        String type = "text/plain";
+        Uri uri = Uri.parse("file:///obviously/not/in/external/storage");
+
+        BluetoothOppSendFileInfo info = BluetoothOppSendFileInfo.generateFileInfo(mContext, uri,
+                type, true);
+
+        assertThat(info).isEqualTo(BluetoothOppSendFileInfo.SEND_FILE_INFO_ERROR);
+    }
+}
diff --git a/android/app/tests/unit/src/com/android/bluetooth/opp/BluetoothOppServiceTest.java b/android/app/tests/unit/src/com/android/bluetooth/opp/BluetoothOppServiceTest.java
index e1f67aa..d011a6d 100644
--- a/android/app/tests/unit/src/com/android/bluetooth/opp/BluetoothOppServiceTest.java
+++ b/android/app/tests/unit/src/com/android/bluetooth/opp/BluetoothOppServiceTest.java
@@ -45,9 +45,11 @@
     private BluetoothOppService mService = null;
     private BluetoothAdapter mAdapter = null;
 
-    @Rule public final ServiceTestRule mServiceRule = new ServiceTestRule();
+    @Rule
+    public final ServiceTestRule mServiceRule = new ServiceTestRule();
 
-    @Mock private AdapterService mAdapterService;
+    @Mock
+    private AdapterService mAdapterService;
 
     @Before
     public void setUp() throws Exception {
diff --git a/android/app/tests/unit/src/com/android/bluetooth/opp/BluetoothOppShareInfoTest.java b/android/app/tests/unit/src/com/android/bluetooth/opp/BluetoothOppShareInfoTest.java
new file mode 100644
index 0000000..ca549ec
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/opp/BluetoothOppShareInfoTest.java
@@ -0,0 +1,100 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.opp;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import android.net.Uri;
+
+import androidx.test.filters.SmallTest;
+import androidx.test.runner.AndroidJUnit4;
+
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+@SmallTest
+@RunWith(AndroidJUnit4.class)
+public class BluetoothOppShareInfoTest {
+    private BluetoothOppShareInfo mBluetoothOppShareInfo;
+
+    private Uri uri = Uri.parse("file://Idontknow//Justmadeitup");
+    private String hintString = "this is a object that take 4 bytes";
+    private String filename = "random.jpg";
+    private String mimetype = "image/jpeg";
+    private int direction = BluetoothShare.DIRECTION_INBOUND;
+    private String destination = "01:23:45:67:89:AB";
+    private int visibility = BluetoothShare.VISIBILITY_VISIBLE;
+    private int confirm = BluetoothShare.USER_CONFIRMATION_CONFIRMED;
+    private int status = BluetoothShare.STATUS_PENDING;
+    private int totalBytes = 1023;
+    private int currentBytes = 42;
+    private int timestamp = 123456789;
+    private boolean mediaScanned = false;
+
+    @Before
+    public void setUp() throws Exception {
+        mBluetoothOppShareInfo = new BluetoothOppShareInfo(0, uri, hintString, filename,
+                mimetype, direction, destination, visibility, confirm, status, totalBytes,
+                currentBytes, timestamp, mediaScanned);
+    }
+
+    @Test
+    public void testConstructor() {
+        assertThat(mBluetoothOppShareInfo.mUri).isEqualTo(uri);
+        assertThat(mBluetoothOppShareInfo.mFilename).isEqualTo(filename);
+        assertThat(mBluetoothOppShareInfo.mMimetype).isEqualTo(mimetype);
+        assertThat(mBluetoothOppShareInfo.mDirection).isEqualTo(direction);
+        assertThat(mBluetoothOppShareInfo.mDestination).isEqualTo(destination);
+        assertThat(mBluetoothOppShareInfo.mVisibility).isEqualTo(visibility);
+        assertThat(mBluetoothOppShareInfo.mConfirm).isEqualTo(confirm);
+        assertThat(mBluetoothOppShareInfo.mStatus).isEqualTo(status);
+        assertThat(mBluetoothOppShareInfo.mTotalBytes).isEqualTo(totalBytes);
+        assertThat(mBluetoothOppShareInfo.mCurrentBytes).isEqualTo(currentBytes);
+        assertThat(mBluetoothOppShareInfo.mTimestamp).isEqualTo(timestamp);
+        assertThat(mBluetoothOppShareInfo.mMediaScanned).isEqualTo(mediaScanned);
+    }
+
+    @Test
+    public void testReadyToStart() {
+        assertThat(mBluetoothOppShareInfo.isReadyToStart()).isTrue();
+
+        mBluetoothOppShareInfo.mDirection = BluetoothShare.DIRECTION_OUTBOUND;
+        assertThat(mBluetoothOppShareInfo.isReadyToStart()).isTrue();
+
+        mBluetoothOppShareInfo.mStatus = BluetoothShare.STATUS_RUNNING;
+        assertThat(mBluetoothOppShareInfo.isReadyToStart()).isFalse();
+    }
+
+    @Test
+    public void testHasCompletionNotification() {
+        assertThat(mBluetoothOppShareInfo.hasCompletionNotification()).isFalse();
+
+        mBluetoothOppShareInfo.mStatus = BluetoothShare.STATUS_CANCELED;
+        assertThat(mBluetoothOppShareInfo.hasCompletionNotification()).isTrue();
+
+        mBluetoothOppShareInfo.mVisibility = BluetoothShare.VISIBILITY_HIDDEN;
+        assertThat(mBluetoothOppShareInfo.hasCompletionNotification()).isFalse();
+    }
+
+    @Test
+    public void testIsObsolete() {
+        assertThat(mBluetoothOppShareInfo.isObsolete()).isFalse();
+        mBluetoothOppShareInfo.mStatus = BluetoothShare.STATUS_RUNNING;
+        assertThat(mBluetoothOppShareInfo.isObsolete()).isTrue();
+    }
+}
diff --git a/android/app/tests/unit/src/com/android/bluetooth/opp/BluetoothOppTestUtils.java b/android/app/tests/unit/src/com/android/bluetooth/opp/BluetoothOppTestUtils.java
new file mode 100644
index 0000000..c8174be
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/opp/BluetoothOppTestUtils.java
@@ -0,0 +1,149 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.opp;
+
+import static android.content.pm.PackageManager.COMPONENT_ENABLED_STATE_DEFAULT;
+import static android.content.pm.PackageManager.COMPONENT_ENABLED_STATE_ENABLED;
+import static android.content.pm.PackageManager.DONT_KILL_APP;
+
+import static org.mockito.ArgumentMatchers.anyInt;
+import static org.mockito.ArgumentMatchers.anyString;
+import static org.mockito.Mockito.doAnswer;
+import static org.mockito.Mockito.doReturn;
+
+import android.content.ComponentName;
+import android.content.Context;
+import android.database.Cursor;
+
+import org.mockito.internal.util.MockUtil;
+
+import java.util.Arrays;
+import java.util.List;
+import java.util.Objects;
+
+public class BluetoothOppTestUtils {
+
+    /**
+     * A class containing the data to be return by a cursor. Intended to be use with setUpMockCursor
+     *
+     * @attr columnName is name of column to be used as a parameter in cursor.getColumnIndexOrThrow
+     * @attr mIndex should be returned from cursor.getColumnIndexOrThrow
+     * @attr mValue should be returned from cursor.getInt() or cursor.getString() or
+     * cursor.getLong()
+     */
+    public static class CursorMockData {
+        public final String mColumnName;
+        public final int mColumnIndex;
+        public final Object mValue;
+
+        public CursorMockData(String columnName, int index, Object value) {
+            mColumnName = columnName;
+            mColumnIndex = index;
+            mValue = value;
+        }
+    }
+
+    /**
+     * Set up a mock single-row Cursor that work for common use cases in the OPP package.
+     * It mocks the database column index and value of the cell in that column of the current row
+     *
+     * <pre>
+     *  cursorMockDataList.add(
+     *     new CursorMockData(BluetoothShare.DIRECTION, 2, BluetoothShare.DIRECTION_INBOUND
+     *     );
+     *     ...
+     *  setUpMockCursor(cursor, cursorMockDataList);
+     *  // This will return 2
+     *  int index = cursor.getColumnIndexOrThrow(BluetoothShare.DIRECTION);
+     *  int direction = cursor.getInt(index); // This will return BluetoothShare.DIRECTION_INBOUND
+     * </pre>
+     *
+     * @param cursor a mock/spy cursor to be setup
+     * @param cursorMockDataList a list representing what cursor will return
+     */
+    public static void setUpMockCursor(
+            Cursor cursor, List<CursorMockData> cursorMockDataList) {
+        assert(MockUtil.isMock(cursor));
+
+        doAnswer(invocation -> {
+            String name = invocation.getArgument(0);
+            return cursorMockDataList.stream().filter(
+                    mockCursorData -> Objects.equals(mockCursorData.mColumnName, name)
+            ).findFirst().orElse(new CursorMockData("", -1, null)).mColumnIndex;
+        }).when(cursor).getColumnIndexOrThrow(anyString());
+
+        doAnswer(invocation -> {
+            int index = invocation.getArgument(0);
+            return cursorMockDataList.stream().filter(
+                    mockCursorData -> mockCursorData.mColumnIndex == index
+            ).findFirst().orElse(new CursorMockData("", -1, -1)).mValue;
+        }).when(cursor).getInt(anyInt());
+
+        doAnswer(invocation -> {
+            int index = invocation.getArgument(0);
+            return cursorMockDataList.stream().filter(
+                    mockCursorData -> mockCursorData.mColumnIndex == index
+            ).findFirst().orElse(new CursorMockData("", -1, -1)).mValue;
+        }).when(cursor).getLong(anyInt());
+
+        doAnswer(invocation -> {
+            int index = invocation.getArgument(0);
+            return cursorMockDataList.stream().filter(
+                    mockCursorData -> mockCursorData.mColumnIndex == index
+            ).findFirst().orElse(new CursorMockData("", -1, null)).mValue;
+        }).when(cursor).getString(anyInt());
+
+        doReturn(true).when(cursor).moveToFirst();
+        doReturn(true).when(cursor).moveToLast();
+        doReturn(true).when(cursor).moveToNext();
+        doReturn(true).when(cursor).moveToPrevious();
+        doReturn(true).when(cursor).moveToPosition(anyInt());
+    }
+
+    /**
+     * Enable/Disable all activities in Opp for testing
+     *
+     * @param enable true to enable, false to disable
+     * @param mTargetContext target context
+     */
+    public static void enableOppActivities(boolean enable, Context mTargetContext) {
+        int enabledState = enable ? COMPONENT_ENABLED_STATE_ENABLED
+                : COMPONENT_ENABLED_STATE_DEFAULT;
+
+        mTargetContext.getPackageManager().setApplicationEnabledSetting(
+                mTargetContext.getPackageName(), enabledState, DONT_KILL_APP);
+
+        // All activities to be test
+        Class[] activities = {
+                BluetoothOppTransferActivity.class,
+                BluetoothOppBtEnableActivity.class,
+                BluetoothOppBtEnablingActivity.class,
+                BluetoothOppBtErrorActivity.class,
+                BluetoothOppIncomingFileConfirmActivity.class,
+                BluetoothOppTransferHistory.class,
+                BluetoothOppLauncherActivity.class,
+        };
+
+        Arrays.stream(activities).forEach(activityClass -> {
+            ComponentName activityName = new ComponentName(mTargetContext, activityClass);
+            mTargetContext.getPackageManager().setComponentEnabledSetting(
+                    activityName, enabledState, DONT_KILL_APP);
+        });
+
+    }
+}
+
diff --git a/android/app/tests/unit/src/com/android/bluetooth/opp/BluetoothOppTransferActivityTest.java b/android/app/tests/unit/src/com/android/bluetooth/opp/BluetoothOppTransferActivityTest.java
new file mode 100644
index 0000000..c512705
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/opp/BluetoothOppTransferActivityTest.java
@@ -0,0 +1,252 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.opp;
+
+
+import static com.android.bluetooth.opp.BluetoothOppTestUtils.CursorMockData;
+import static com.android.bluetooth.opp.BluetoothOppTransferActivity.DIALOG_RECEIVE_COMPLETE_FAIL;
+import static com.android.bluetooth.opp.BluetoothOppTransferActivity.DIALOG_RECEIVE_COMPLETE_SUCCESS;
+import static com.android.bluetooth.opp.BluetoothOppTransferActivity.DIALOG_RECEIVE_ONGOING;
+import static com.android.bluetooth.opp.BluetoothOppTransferActivity.DIALOG_SEND_COMPLETE_FAIL;
+import static com.android.bluetooth.opp.BluetoothOppTransferActivity.DIALOG_SEND_COMPLETE_SUCCESS;
+import static com.android.bluetooth.opp.BluetoothOppTransferActivity.DIALOG_SEND_ONGOING;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import static org.mockito.Mockito.any;
+import static org.mockito.Mockito.doReturn;
+import static org.mockito.Mockito.eq;
+
+import android.content.Context;
+import android.content.Intent;
+import android.database.Cursor;
+import android.net.Uri;
+
+import androidx.test.core.app.ActivityScenario;
+import androidx.test.platform.app.InstrumentationRegistry;
+import androidx.test.runner.AndroidJUnit4;
+
+import com.android.bluetooth.BluetoothMethodProxy;
+
+import org.junit.After;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.Mock;
+import org.mockito.Mockito;
+import org.mockito.MockitoAnnotations;
+import org.mockito.Spy;
+
+import java.util.ArrayList;
+import java.util.List;
+import java.util.concurrent.atomic.AtomicBoolean;
+
+@RunWith(AndroidJUnit4.class)
+public class BluetoothOppTransferActivityTest {
+    @Mock
+    Cursor mCursor;
+    @Spy
+    BluetoothMethodProxy mBluetoothMethodProxy;
+
+    List<CursorMockData> mCursorMockDataList;
+
+    Intent mIntent;
+    Context mTargetContext;
+
+    @Before
+    public void setUp() {
+        MockitoAnnotations.initMocks(this);
+        mBluetoothMethodProxy = Mockito.spy(BluetoothMethodProxy.getInstance());
+        BluetoothMethodProxy.setInstanceForTesting(mBluetoothMethodProxy);
+
+        Uri dataUrl = Uri.parse("content://com.android.bluetooth.opp.test/random");
+        mTargetContext = InstrumentationRegistry.getInstrumentation().getTargetContext();
+
+        mIntent = new Intent();
+        mIntent.setClass(mTargetContext, BluetoothOppTransferActivity.class);
+        mIntent.setData(dataUrl);
+
+        doReturn(mCursor).when(mBluetoothMethodProxy).contentResolverQuery(any(), eq(dataUrl),
+                eq(null), eq(null),
+                eq(null), eq(null));
+
+        doReturn(1).when(mBluetoothMethodProxy).contentResolverUpdate(any(), eq(dataUrl),
+                any(), eq(null), eq(null));
+
+        int idValue = 1234;
+        Long timestampValue = 123456789L;
+        String destinationValue = "AA:BB:CC:00:11:22";
+        String fileTypeValue = "text/plain";
+
+        mCursorMockDataList = new ArrayList<>(List.of(
+                new CursorMockData(BluetoothShare._ID, 0, idValue),
+                new CursorMockData(BluetoothShare.MIMETYPE, 5, fileTypeValue),
+                new CursorMockData(BluetoothShare.TIMESTAMP, 6, timestampValue),
+                new CursorMockData(BluetoothShare.DESTINATION, 7, destinationValue),
+                new CursorMockData(BluetoothShare._DATA, 8, null),
+                new CursorMockData(BluetoothShare.FILENAME_HINT, 9, null),
+                new CursorMockData(BluetoothShare.URI, 10, "content://textfile.txt"),
+                new CursorMockData(BluetoothShare.USER_CONFIRMATION, 11,
+                        BluetoothShare.USER_CONFIRMATION_HANDOVER_CONFIRMED)
+        ));
+        BluetoothOppTestUtils.enableOppActivities(true, mTargetContext);
+    }
+
+    @After
+    public void tearDown() {
+        BluetoothMethodProxy.setInstanceForTesting(null);
+        BluetoothOppTestUtils.enableOppActivities(false, mTargetContext);
+    }
+
+    @Test
+    public void onCreate_showSendOnGoingDialog() {
+        mCursorMockDataList.add(
+                new CursorMockData(BluetoothShare.STATUS, 1, BluetoothShare.STATUS_PENDING));
+        mCursorMockDataList.add(
+                new CursorMockData(BluetoothShare.DIRECTION, 2, BluetoothShare.DIRECTION_OUTBOUND)
+        );
+        mCursorMockDataList.add(new CursorMockData(BluetoothShare.TOTAL_BYTES, 3, 100));
+        mCursorMockDataList.add(new CursorMockData(BluetoothShare.CURRENT_BYTES, 4, 0));
+        BluetoothOppTestUtils.setUpMockCursor(mCursor, mCursorMockDataList);
+
+        AtomicBoolean check = new AtomicBoolean(false);
+        ActivityScenario<BluetoothOppTransferActivity> activityScenario = ActivityScenario.launch(
+                mIntent);
+
+        activityScenario.onActivity(activity -> {
+            check.set(activity.mWhichDialog == DIALOG_SEND_ONGOING);
+        });
+
+        assertThat(check.get()).isTrue();
+    }
+
+    @Test
+    public void onCreate_showSendCompleteSuccessDialog() {
+        mCursorMockDataList.add(
+                new CursorMockData(BluetoothShare.STATUS, 1, BluetoothShare.STATUS_SUCCESS)
+        );
+        mCursorMockDataList.add(
+                new CursorMockData(BluetoothShare.DIRECTION, 2, BluetoothShare.DIRECTION_OUTBOUND)
+        );
+        mCursorMockDataList.add(new CursorMockData(BluetoothShare.TOTAL_BYTES, 3, 100));
+        mCursorMockDataList.add(
+                new CursorMockData(BluetoothShare.CURRENT_BYTES, 4, 100));
+        BluetoothOppTestUtils.setUpMockCursor(mCursor, mCursorMockDataList);
+
+        AtomicBoolean check = new AtomicBoolean(false);
+        ActivityScenario<BluetoothOppTransferActivity> activityScenario = ActivityScenario.launch(
+                mIntent);
+
+        activityScenario.onActivity(activity -> {
+            check.set(activity.mWhichDialog == DIALOG_SEND_COMPLETE_SUCCESS);
+        });
+
+        assertThat(check.get()).isTrue();
+    }
+
+    @Test
+    public void onCreate_showSendCompleteFailDialog() {
+        mCursorMockDataList.add(
+                new CursorMockData(BluetoothShare.STATUS, 1, BluetoothShare.STATUS_FORBIDDEN));
+        mCursorMockDataList.add(
+                new CursorMockData(BluetoothShare.DIRECTION, 2, BluetoothShare.DIRECTION_OUTBOUND)
+        );
+        mCursorMockDataList.add(new CursorMockData(BluetoothShare.TOTAL_BYTES, 3, 100));
+        mCursorMockDataList.add(new CursorMockData(BluetoothShare.CURRENT_BYTES, 4, 42));
+        BluetoothOppTestUtils.setUpMockCursor(mCursor, mCursorMockDataList);
+
+        AtomicBoolean check = new AtomicBoolean(false);
+        ActivityScenario<BluetoothOppTransferActivity> activityScenario = ActivityScenario.launch(
+                mIntent);
+
+        activityScenario.onActivity(activity -> {
+            check.set(activity.mWhichDialog == DIALOG_SEND_COMPLETE_FAIL);
+        });
+
+        assertThat(check.get()).isTrue();
+    }
+
+    @Test
+    public void onCreate_showReceiveOnGoingDialog() {
+        mCursorMockDataList.add(
+                new CursorMockData(BluetoothShare.STATUS, 1, BluetoothShare.STATUS_PENDING));
+        mCursorMockDataList.add(
+                new CursorMockData(BluetoothShare.DIRECTION, 2, BluetoothShare.DIRECTION_INBOUND)
+        );
+        mCursorMockDataList.add(new CursorMockData(BluetoothShare.TOTAL_BYTES, 3, 100));
+        mCursorMockDataList.add(new CursorMockData(BluetoothShare.CURRENT_BYTES, 4, 0));
+        BluetoothOppTestUtils.setUpMockCursor(mCursor, mCursorMockDataList);
+
+        AtomicBoolean check = new AtomicBoolean(false);
+        ActivityScenario<BluetoothOppTransferActivity> activityScenario = ActivityScenario.launch(
+                mIntent);
+
+        activityScenario.onActivity(activity -> {
+            check.set(activity.mWhichDialog == DIALOG_RECEIVE_ONGOING);
+        });
+
+        assertThat(check.get()).isTrue();
+    }
+
+    @Test
+    public void onCreate_showReceiveCompleteSuccessDialog() {
+        mCursorMockDataList.add(
+                new CursorMockData(BluetoothShare.STATUS, 1, BluetoothShare.STATUS_SUCCESS));
+        mCursorMockDataList.add(
+                new CursorMockData(BluetoothShare.DIRECTION, 2, BluetoothShare.DIRECTION_INBOUND)
+        );
+        mCursorMockDataList.add(new CursorMockData(BluetoothShare.TOTAL_BYTES, 3, 100));
+        mCursorMockDataList.add(
+                new CursorMockData(BluetoothShare.CURRENT_BYTES, 4, 100)
+        );
+
+        BluetoothOppTestUtils.setUpMockCursor(mCursor, mCursorMockDataList);
+
+        AtomicBoolean check = new AtomicBoolean(false);
+        ActivityScenario<BluetoothOppTransferActivity> activityScenario = ActivityScenario.launch(
+                mIntent);
+
+        activityScenario.onActivity(activity -> {
+            check.set(activity.mWhichDialog == DIALOG_RECEIVE_COMPLETE_SUCCESS);
+        });
+
+        assertThat(check.get()).isTrue();
+    }
+
+    @Test
+    public void onCreate_showReceiveCompleteFailDialog() {
+        mCursorMockDataList.add(
+                new CursorMockData(BluetoothShare.STATUS, 1, BluetoothShare.STATUS_FORBIDDEN));
+        mCursorMockDataList.add(
+                new CursorMockData(BluetoothShare.DIRECTION, 2, BluetoothShare.DIRECTION_INBOUND)
+        );
+        mCursorMockDataList.add(new CursorMockData(BluetoothShare.TOTAL_BYTES, 3, 100));
+        mCursorMockDataList.add(new CursorMockData(BluetoothShare.CURRENT_BYTES, 4, 42));
+
+        BluetoothOppTestUtils.setUpMockCursor(mCursor, mCursorMockDataList);
+
+        AtomicBoolean check = new AtomicBoolean(false);
+        ActivityScenario<BluetoothOppTransferActivity> activityScenario = ActivityScenario.launch(
+                mIntent);
+
+        activityScenario.onActivity(activity -> {
+            check.set(activity.mWhichDialog == DIALOG_RECEIVE_COMPLETE_FAIL);
+        });
+
+        assertThat(check.get()).isTrue();
+    }
+}
diff --git a/android/app/tests/unit/src/com/android/bluetooth/opp/BluetoothOppTransferHistoryTest.java b/android/app/tests/unit/src/com/android/bluetooth/opp/BluetoothOppTransferHistoryTest.java
new file mode 100644
index 0000000..56c5621
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/opp/BluetoothOppTransferHistoryTest.java
@@ -0,0 +1,206 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.opp;
+
+import static androidx.test.espresso.Espresso.onView;
+import static androidx.test.espresso.action.ViewActions.click;
+import static androidx.test.espresso.assertion.ViewAssertions.matches;
+import static androidx.test.espresso.matcher.RootMatchers.isDialog;
+import static androidx.test.espresso.matcher.ViewMatchers.isDisplayed;
+import static androidx.test.espresso.matcher.ViewMatchers.withText;
+
+import static org.mockito.ArgumentMatchers.argThat;
+import static org.mockito.Mockito.any;
+import static org.mockito.Mockito.doReturn;
+import static org.mockito.Mockito.eq;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.verify;
+
+import android.content.Context;
+import android.content.Intent;
+import android.database.Cursor;
+import android.net.Uri;
+import android.test.ActivityInstrumentationTestCase2;
+import android.view.MenuItem;
+
+import androidx.test.core.app.ActivityScenario;
+import androidx.test.platform.app.InstrumentationRegistry;
+import androidx.test.runner.AndroidJUnit4;
+
+import com.android.bluetooth.BluetoothMethodProxy;
+import com.android.bluetooth.R;
+
+import com.google.common.base.Objects;
+
+import org.junit.After;
+import org.junit.Before;
+import org.junit.Ignore;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.Mock;
+import org.mockito.Mockito;
+import org.mockito.MockitoAnnotations;
+import org.mockito.Spy;
+
+import java.util.ArrayList;
+import java.util.List;
+
+/**
+ * This class will also test BluetoothOppTransferAdapter
+ */
+@RunWith(AndroidJUnit4.class)
+public class BluetoothOppTransferHistoryTest {
+    @Mock
+    Cursor mCursor;
+    @Spy
+    BluetoothMethodProxy mBluetoothMethodProxy;
+
+    List<BluetoothOppTestUtils.CursorMockData> mCursorMockDataList;
+
+    Intent mIntent;
+    Context mTargetContext;
+
+    @Before
+    public void setUp() {
+        MockitoAnnotations.initMocks(this);
+        mBluetoothMethodProxy = Mockito.spy(BluetoothMethodProxy.getInstance());
+        BluetoothMethodProxy.setInstanceForTesting(mBluetoothMethodProxy);
+
+        Uri dataUrl = Uri.parse("content://com.android.bluetooth.opp.test/random");
+        mTargetContext = InstrumentationRegistry.getInstrumentation().getTargetContext();
+
+        mIntent = new Intent();
+        mIntent.setClass(mTargetContext, BluetoothOppTransferHistory.class);
+        mIntent.setData(dataUrl);
+
+        doReturn(mCursor).when(mBluetoothMethodProxy).contentResolverQuery(any(),
+                eq(BluetoothShare.CONTENT_URI),
+                any(), any(), any(), any());
+
+        int idValue = 1234;
+        Long timestampValue = 123456789L;
+        String destinationValue = "AA:BB:CC:00:11:22";
+        String fileTypeValue = "text/plain";
+
+        mCursorMockDataList = new ArrayList<>(List.of(
+                new BluetoothOppTestUtils.CursorMockData(BluetoothShare.STATUS, 1,
+                        BluetoothShare.STATUS_SUCCESS),
+                new BluetoothOppTestUtils.CursorMockData(BluetoothShare.DIRECTION, 2,
+                        BluetoothShare.DIRECTION_INBOUND),
+                new BluetoothOppTestUtils.CursorMockData(BluetoothShare.TOTAL_BYTES, 3, 100),
+                new BluetoothOppTestUtils.CursorMockData(BluetoothShare.CURRENT_BYTES, 4, 0),
+                new BluetoothOppTestUtils.CursorMockData(BluetoothShare._ID, 0, idValue),
+                new BluetoothOppTestUtils.CursorMockData(BluetoothShare.MIMETYPE, 5, fileTypeValue),
+                new BluetoothOppTestUtils.CursorMockData(BluetoothShare.TIMESTAMP, 6,
+                        timestampValue),
+                new BluetoothOppTestUtils.CursorMockData(BluetoothShare.DESTINATION, 7,
+                        destinationValue),
+                new BluetoothOppTestUtils.CursorMockData(BluetoothShare._DATA, 8, null),
+                new BluetoothOppTestUtils.CursorMockData(BluetoothShare.FILENAME_HINT, 9, null),
+                new BluetoothOppTestUtils.CursorMockData(BluetoothShare.URI, 10,
+                        "content://textfile.txt"),
+                new BluetoothOppTestUtils.CursorMockData(BluetoothShare.USER_CONFIRMATION, 11,
+                        BluetoothShare.USER_CONFIRMATION_HANDOVER_CONFIRMED)
+        ));
+
+        BluetoothOppTestUtils.enableOppActivities(true, mTargetContext);
+    }
+
+    @After
+    public void tearDown() {
+        BluetoothMethodProxy.setInstanceForTesting(null);
+        BluetoothOppTestUtils.enableOppActivities(false, mTargetContext);
+    }
+
+    @Test
+    public void onCreate_withDirectionInbound_withExtraShowAllFileIsTrue_displayLiveFolder() {
+        BluetoothOppTestUtils.setUpMockCursor(mCursor, mCursorMockDataList);
+        mIntent.putExtra(Constants.EXTRA_SHOW_ALL_FILES, true);
+        mIntent.putExtra("direction", BluetoothShare.DIRECTION_INBOUND);
+        ActivityScenario<BluetoothOppTransferHistory> scenario = ActivityScenario.launch(mIntent);
+        InstrumentationRegistry.getInstrumentation().waitForIdleSync();
+
+        onView(withText(mTargetContext.getText(R.string.btopp_live_folder).toString())).check(
+                matches(isDisplayed()));
+    }
+
+    @Test
+    public void onCreate_withDirectionInbound_withExtraShowAllFileIsFalse_displayInboundHistory() {
+        BluetoothOppTestUtils.setUpMockCursor(mCursor, mCursorMockDataList);
+        mIntent.putExtra(Constants.EXTRA_SHOW_ALL_FILES, false);
+        mIntent.putExtra("direction", BluetoothShare.DIRECTION_INBOUND);
+
+        ActivityScenario<BluetoothOppTransferHistory> scenario = ActivityScenario.launch(mIntent);
+        InstrumentationRegistry.getInstrumentation().waitForIdleSync();
+
+        onView(withText(mTargetContext.getText(R.string.inbound_history_title).toString())).check(
+                matches(isDisplayed()));
+    }
+
+    @Test
+    public void onCreate_withDirectionOutbound_displayOutboundHistory() {
+        BluetoothOppTestUtils.setUpMockCursor(mCursor, mCursorMockDataList);
+        mCursorMockDataList.set(1,
+                new BluetoothOppTestUtils.CursorMockData(BluetoothShare.DIRECTION, 2,
+                        BluetoothShare.DIRECTION_OUTBOUND));
+        mIntent.putExtra(Constants.EXTRA_SHOW_ALL_FILES, true);
+        mIntent.putExtra("direction", BluetoothShare.DIRECTION_OUTBOUND);
+
+        ActivityScenario<BluetoothOppTransferHistory> scenario = ActivityScenario.launch(mIntent);
+        InstrumentationRegistry.getInstrumentation().waitForIdleSync();
+
+        onView(withText(mTargetContext.getText(R.string.outbound_history_title).toString())).check(
+                matches(isDisplayed()));
+    }
+
+    @Ignore("b/268424815")
+    @Test
+    public void onOptionsItemSelected_clearAllSelected_promptWarning() {
+        BluetoothOppTestUtils.setUpMockCursor(mCursor, mCursorMockDataList);
+        mIntent.putExtra(Constants.EXTRA_SHOW_ALL_FILES, false);
+        mIntent.putExtra("direction", BluetoothShare.DIRECTION_INBOUND);
+
+        ActivityScenario<BluetoothOppTransferHistory> scenario = ActivityScenario.launch(mIntent);
+
+
+        MenuItem mockMenuItem = mock(MenuItem.class);
+        doReturn(R.id.transfer_menu_clear_all).when(mockMenuItem).getItemId();
+        scenario.onActivity(activity -> {
+            activity.onOptionsItemSelected(mockMenuItem);
+        });
+        InstrumentationRegistry.getInstrumentation().waitForIdleSync();
+
+        // Controlling clear all download
+        doReturn(true, false).when(mCursor).moveToFirst();
+        doReturn(false, true).when(mCursor).isAfterLast();
+        doReturn(0).when(mBluetoothMethodProxy).contentResolverUpdate(any(), any(),
+                argThat(arg -> Objects.equal(arg.get(BluetoothShare.VISIBILITY),
+                        BluetoothShare.VISIBILITY_HIDDEN)), any(), any());
+
+        onView(withText(mTargetContext.getText(R.string.transfer_clear_dlg_title).toString()))
+                .inRoot(isDialog()).check(matches(isDisplayed()));
+
+        // Click ok on the prompted dialog
+        onView(withText(mTargetContext.getText(android.R.string.ok).toString())).inRoot(
+                isDialog()).check(matches(isDisplayed())).perform(click());
+
+        // Verify that item is hidden
+        verify(mBluetoothMethodProxy).contentResolverUpdate(any(), any(),
+                argThat(arg -> Objects.equal(arg.get(BluetoothShare.VISIBILITY),
+                        BluetoothShare.VISIBILITY_HIDDEN)), any(), any());
+    }
+}
\ No newline at end of file
diff --git a/android/app/tests/unit/src/com/android/bluetooth/opp/BluetoothOppTransferTest.java b/android/app/tests/unit/src/com/android/bluetooth/opp/BluetoothOppTransferTest.java
new file mode 100644
index 0000000..f1e2a77
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/opp/BluetoothOppTransferTest.java
@@ -0,0 +1,347 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package com.android.bluetooth.opp;
+
+import static com.android.bluetooth.opp.BluetoothOppTransfer.TRANSPORT_CONNECTED;
+import static com.android.bluetooth.opp.BluetoothOppTransfer.TRANSPORT_ERROR;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import static org.mockito.ArgumentMatchers.argThat;
+import static org.mockito.ArgumentMatchers.eq;
+import static org.mockito.ArgumentMatchers.nullable;
+import static org.mockito.Mockito.any;
+import static org.mockito.Mockito.doAnswer;
+import static org.mockito.Mockito.doReturn;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.spy;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.verifyNoMoreInteractions;
+
+import android.bluetooth.BluetoothDevice;
+import android.bluetooth.BluetoothManager;
+import android.bluetooth.BluetoothUuid;
+import android.content.ContentValues;
+import android.content.Context;
+import android.content.ContextWrapper;
+import android.content.Intent;
+import android.content.IntentFilter;
+import android.net.Uri;
+import android.os.Looper;
+import android.os.Message;
+
+import androidx.test.filters.MediumTest;
+import androidx.test.platform.app.InstrumentationRegistry;
+import androidx.test.runner.AndroidJUnit4;
+
+import com.android.bluetooth.BluetoothMethodProxy;
+import com.android.bluetooth.BluetoothObexTransport;
+import com.android.obex.ObexTransport;
+
+import org.junit.After;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.Mock;
+import org.mockito.MockitoAnnotations;
+
+import java.util.Objects;
+
+@MediumTest
+@RunWith(AndroidJUnit4.class)
+public class BluetoothOppTransferTest {
+    private final Uri mUri = Uri.parse("file://Idontknow/Justmadeitup");
+    private final String mHintString = "this is a object that take 4 bytes";
+    private final String mFilename = "random.jpg";
+    private final String mMimetype = "image/jpeg";
+    private final int mDirection = BluetoothShare.DIRECTION_INBOUND;
+    private final String mDestination = "01:23:45:67:89:AB";
+    private final int mVisibility = BluetoothShare.VISIBILITY_VISIBLE;
+    private final int mConfirm = BluetoothShare.USER_CONFIRMATION_AUTO_CONFIRMED;
+    private final int mStatus = BluetoothShare.STATUS_PENDING;
+    private final int mTotalBytes = 1023;
+    private final int mCurrentBytes = 42;
+    private final int mTimestamp = 123456789;
+    private final boolean mMediaScanned = false;
+
+    @Mock
+    BluetoothOppObexSession mSession;
+    @Mock
+    BluetoothMethodProxy mCallProxy;
+    Context mContext;
+    BluetoothOppBatch mBluetoothOppBatch;
+    BluetoothOppTransfer mTransfer;
+    BluetoothOppTransfer.EventHandler mEventHandler;
+    BluetoothOppShareInfo mInitShareInfo;
+
+    @Before
+    public void setUp() throws Exception {
+        MockitoAnnotations.initMocks(this);
+        BluetoothMethodProxy.setInstanceForTesting(mCallProxy);
+        doReturn(0).when(mCallProxy).contentResolverDelete(any(), nullable(Uri.class),
+                nullable(String.class), nullable(String[].class));
+        doReturn(0).when(mCallProxy).contentResolverUpdate(any(), nullable(Uri.class),
+                nullable(ContentValues.class), nullable(String.class), nullable(String[].class));
+
+        mInitShareInfo = new BluetoothOppShareInfo(8765, mUri, mHintString, mFilename, mMimetype,
+                mDirection, mDestination, mVisibility, mConfirm, mStatus, mTotalBytes,
+                mCurrentBytes,
+                mTimestamp, mMediaScanned);
+        mContext = spy(
+                new ContextWrapper(
+                        InstrumentationRegistry.getInstrumentation().getTargetContext()));
+        mBluetoothOppBatch = spy(new BluetoothOppBatch(mContext, mInitShareInfo));
+        mTransfer = new BluetoothOppTransfer(mContext, mBluetoothOppBatch, mSession);
+        mEventHandler = mTransfer.new EventHandler(Looper.getMainLooper());
+    }
+
+    @After
+    public void tearDown() {
+        BluetoothMethodProxy.setInstanceForTesting(null);
+    }
+
+    @Test
+    public void onShareAdded_checkFirstPendingShare() {
+        BluetoothOppShareInfo newShareInfo = new BluetoothOppShareInfo(1, mUri, mHintString,
+                mFilename, mMimetype, BluetoothShare.DIRECTION_INBOUND, mDestination, mVisibility,
+                BluetoothShare.USER_CONFIRMATION_AUTO_CONFIRMED, mStatus, mTotalBytes,
+                mCurrentBytes,
+                mTimestamp, mMediaScanned);
+
+        doAnswer(invocation -> {
+            assertThat((BluetoothOppShareInfo) invocation.getArgument(0))
+                    .isEqualTo(mInitShareInfo);
+            return null;
+        }).when(mSession).addShare(any(BluetoothOppShareInfo.class));
+
+        // This will trigger mTransfer.onShareAdded(), which will call mTransfer
+        // .processCurrentShare(),
+        // which will add the first pending share to the session
+        mBluetoothOppBatch.addShare(newShareInfo);
+        verify(mSession).addShare(any(BluetoothOppShareInfo.class));
+    }
+
+    @Test
+    public void onBatchCanceled_checkStatus() {
+        // This will trigger mTransfer.onBatchCanceled(),
+        // which will then change the status of the batch accordingly
+        mBluetoothOppBatch.cancelBatch();
+        assertThat(mBluetoothOppBatch.mStatus).isEqualTo(Constants.BATCH_STATUS_FINISHED);
+    }
+
+    @Test
+    public void start_bluetoothDisabled_batchFail() {
+        mTransfer.start();
+        // Since Bluetooth is disabled, the batch will fail
+        assertThat(mBluetoothOppBatch.mStatus).isEqualTo(Constants.BATCH_STATUS_FAILED);
+    }
+
+    @Test
+    public void start_receiverRegistered() {
+        doReturn(true).when(mCallProxy).bluetoothAdapterIsEnabled(any());
+        mTransfer.start();
+        verify(mContext).registerReceiver(any(), any(IntentFilter.class));
+        // need this, or else the handler thread might throw in middle of the next test
+        mTransfer.stop();
+    }
+
+    @Test
+    public void stop_unregisterRegistered() {
+        doReturn(true).when(mCallProxy).bluetoothAdapterIsEnabled(any());
+        mTransfer.start();
+        mTransfer.stop();
+        verify(mContext).unregisterReceiver(any());
+    }
+
+    @Test
+    public void eventHandler_handleMessage_TRANSPORT_ERROR_connectThreadIsNull() {
+        Message message = Message.obtain(mEventHandler, TRANSPORT_ERROR);
+        mEventHandler.handleMessage(message);
+        assertThat(mTransfer.mConnectThread).isNull();
+        assertThat(mBluetoothOppBatch.mStatus).isEqualTo(Constants.BATCH_STATUS_FAILED);
+    }
+
+// TODO: try to use ShadowBluetoothDevice
+//    @Test
+//    public void eventHandler_handleMessage_SOCKET_ERROR_RETRY_connectThreadInitiated() {
+//        BluetoothDevice bluetoothDevice = ShadowBluetoothDevice();
+//        Message message = Message.obtain(mEventHandler, SOCKET_ERROR_RETRY, bluetoothDevice);
+//        mEventHandler.handleMessage(message);
+//        assertThat(mTransfer.mConnectThread).isNotNull();
+//    }
+
+    @Test
+    public void eventHandler_handleMessage_TRANSPORT_CONNECTED_obexSessionStarted() {
+        ObexTransport transport = mock(BluetoothObexTransport.class);
+        Message message = Message.obtain(mEventHandler, TRANSPORT_CONNECTED, transport);
+        mEventHandler.handleMessage(message);
+        assertThat(mBluetoothOppBatch.mStatus).isEqualTo(Constants.BATCH_STATUS_RUNNING);
+    }
+
+    @Test
+    public void eventHandler_handleMessage_MSG_SHARE_COMPLETE_shareAdded() {
+        Message message = Message.obtain(mEventHandler, BluetoothOppObexSession.MSG_SHARE_COMPLETE);
+
+        mInitShareInfo = new BluetoothOppShareInfo(123, mUri, mHintString, mFilename, mMimetype,
+                BluetoothShare.DIRECTION_OUTBOUND, mDestination, mVisibility, mConfirm, mStatus,
+                mTotalBytes, mCurrentBytes, mTimestamp, mMediaScanned);
+        mContext = spy(
+                new ContextWrapper(
+                        InstrumentationRegistry.getInstrumentation().getTargetContext()));
+        mBluetoothOppBatch = spy(new BluetoothOppBatch(mContext, mInitShareInfo));
+        mTransfer = new BluetoothOppTransfer(mContext, mBluetoothOppBatch, mSession);
+        mEventHandler = mTransfer.new EventHandler(Looper.getMainLooper());
+        mEventHandler.handleMessage(message);
+
+        // Since there is still a share in mBluetoothOppBatch, it will be added into session
+        verify(mSession).addShare(any(BluetoothOppShareInfo.class));
+    }
+
+    @Test
+    public void eventHandler_handleMessage_MSG_SESSION_COMPLETE_batchFinished() {
+        BluetoothOppShareInfo info = mock(BluetoothOppShareInfo.class);
+        Message message = Message.obtain(mEventHandler,
+                BluetoothOppObexSession.MSG_SESSION_COMPLETE,
+                info);
+        mEventHandler.handleMessage(message);
+
+        assertThat(mBluetoothOppBatch.mStatus).isEqualTo(Constants.BATCH_STATUS_FINISHED);
+    }
+
+    @Test
+    public void eventHandler_handleMessage_MSG_SESSION_ERROR_batchFailed() {
+        BluetoothOppShareInfo info = mock(BluetoothOppShareInfo.class);
+        Message message = Message.obtain(mEventHandler, BluetoothOppObexSession.MSG_SESSION_ERROR,
+                info);
+        mEventHandler.handleMessage(message);
+
+        assertThat(mBluetoothOppBatch.mStatus).isEqualTo(Constants.BATCH_STATUS_FAILED);
+    }
+
+    @Test
+    public void eventHandler_handleMessage_MSG_SHARE_INTERRUPTED_batchFailed() {
+
+        mInitShareInfo = new BluetoothOppShareInfo(123, mUri, mHintString, mFilename, mMimetype,
+                BluetoothShare.DIRECTION_OUTBOUND, mDestination, mVisibility, mConfirm, mStatus,
+                mTotalBytes, mCurrentBytes, mTimestamp, mMediaScanned);
+        mBluetoothOppBatch = spy(new BluetoothOppBatch(mContext, mInitShareInfo));
+        mTransfer = new BluetoothOppTransfer(mContext, mBluetoothOppBatch, mSession);
+        mEventHandler = mTransfer.new EventHandler(Looper.getMainLooper());
+
+        BluetoothOppShareInfo info = mock(BluetoothOppShareInfo.class);
+        Message message = Message.obtain(mEventHandler,
+                BluetoothOppObexSession.MSG_SHARE_INTERRUPTED,
+                info);
+        mEventHandler.handleMessage(message);
+
+        assertThat(mBluetoothOppBatch.mStatus).isEqualTo(Constants.BATCH_STATUS_FAILED);
+    }
+
+    @Test
+    public void eventHandler_handleMessage_MSG_CONNECT_TIMEOUT() {
+        Message message = Message.obtain(mEventHandler,
+                BluetoothOppObexSession.MSG_CONNECT_TIMEOUT);
+        BluetoothOppShareInfo newInfo = new BluetoothOppShareInfo(321, mUri, mHintString,
+                mFilename, mMimetype, mDirection, mDestination, mVisibility, mConfirm, mStatus,
+                mTotalBytes, mCurrentBytes, mTimestamp, mMediaScanned);
+        // Adding new info will assign value to mCurrentShare
+        mBluetoothOppBatch.addShare(newInfo);
+        mEventHandler.handleMessage(message);
+
+        verify(mContext).sendBroadcast(argThat(
+                arg -> arg.getAction().equals(BluetoothShare.USER_CONFIRMATION_TIMEOUT_ACTION)));
+    }
+
+    @Test
+    public void socketConnectThreadConstructors() {
+        String address = "AA:BB:CC:EE:DD:11";
+        BluetoothDevice device = (mContext.getSystemService(BluetoothManager.class))
+                .getAdapter().getRemoteDevice(address);
+        BluetoothOppTransfer transfer = new BluetoothOppTransfer(mContext, mBluetoothOppBatch);
+        BluetoothOppTransfer.SocketConnectThread socketConnectThread =
+                transfer.new SocketConnectThread(device, true);
+        BluetoothOppTransfer.SocketConnectThread socketConnectThread2 =
+                transfer.new SocketConnectThread(device, true, false, 0);
+        assertThat(Objects.equals(socketConnectThread.mDevice, device)).isTrue();
+        assertThat(Objects.equals(socketConnectThread2.mDevice, device)).isTrue();
+    }
+
+    @Test
+    public void socketConnectThreadInterrupt() {
+        String address = "AA:BB:CC:EE:DD:11";
+        BluetoothDevice device = (mContext.getSystemService(BluetoothManager.class))
+                .getAdapter().getRemoteDevice(address);
+        BluetoothOppTransfer transfer = new BluetoothOppTransfer(mContext, mBluetoothOppBatch);
+        BluetoothOppTransfer.SocketConnectThread socketConnectThread =
+                transfer.new SocketConnectThread(device, true);
+        socketConnectThread.interrupt();
+        assertThat(socketConnectThread.mIsInterrupted).isTrue();
+    }
+
+    @Test
+    @SuppressWarnings("DoNotCall")
+    public void socketConnectThreadRun_bluetoothDisabled_connectionFailed() {
+        String address = "AA:BB:CC:EE:DD:11";
+        BluetoothDevice device = (mContext.getSystemService(BluetoothManager.class))
+                .getAdapter().getRemoteDevice(address);
+        BluetoothOppTransfer transfer = new BluetoothOppTransfer(mContext, mBluetoothOppBatch);
+        BluetoothOppTransfer.SocketConnectThread socketConnectThread =
+                transfer.new SocketConnectThread(device, true);
+        transfer.mSessionHandler = mEventHandler;
+
+        socketConnectThread.run();
+        verify(mCallProxy).handlerSendEmptyMessage(any(), eq(TRANSPORT_ERROR));
+    }
+
+    @Test
+    public void oppConnectionReceiver_onReceiveWithActionAclDisconnected_sendsConnectTimeout() {
+        BluetoothDevice device = (mContext.getSystemService(BluetoothManager.class))
+                .getAdapter().getRemoteDevice(mDestination);
+        BluetoothOppTransfer transfer = new BluetoothOppTransfer(mContext, mBluetoothOppBatch);
+        transfer.mCurrentShare = mInitShareInfo;
+        transfer.mCurrentShare.mConfirm = BluetoothShare.USER_CONFIRMATION_PENDING;
+        BluetoothOppTransfer.OppConnectionReceiver receiver = transfer.new OppConnectionReceiver();
+        Intent intent = new Intent();
+        intent.setAction(BluetoothDevice.ACTION_ACL_DISCONNECTED);
+        intent.putExtra(BluetoothDevice.EXTRA_DEVICE, device);
+
+        transfer.mSessionHandler = mEventHandler;
+        receiver.onReceive(mContext, intent);
+        verify(mCallProxy).handlerSendEmptyMessage(any(),
+                eq(BluetoothOppObexSession.MSG_CONNECT_TIMEOUT));
+    }
+
+    @Test
+    public void oppConnectionReceiver_onReceiveWithActionSdpRecord_sendsNoMessage() {
+        BluetoothDevice device = (mContext.getSystemService(BluetoothManager.class))
+                .getAdapter().getRemoteDevice(mDestination);
+        BluetoothOppTransfer transfer = new BluetoothOppTransfer(mContext, mBluetoothOppBatch);
+        transfer.mCurrentShare = mInitShareInfo;
+        transfer.mCurrentShare.mConfirm = BluetoothShare.USER_CONFIRMATION_PENDING;
+        transfer.mDevice = device;
+        transfer.mSessionHandler = mEventHandler;
+        BluetoothOppTransfer.OppConnectionReceiver receiver = transfer.new OppConnectionReceiver();
+        Intent intent = new Intent();
+        intent.setAction(BluetoothDevice.ACTION_SDP_RECORD);
+        intent.putExtra(BluetoothDevice.EXTRA_UUID, BluetoothUuid.OBEX_OBJECT_PUSH);
+        intent.putExtra(BluetoothDevice.EXTRA_DEVICE, device);
+
+        receiver.onReceive(mContext, intent);
+
+        // bluetooth device name is null => skip without interaction
+        verifyNoMoreInteractions(mCallProxy);
+    }
+}
diff --git a/android/app/tests/unit/src/com/android/bluetooth/opp/BluetoothOppUtilityTest.java b/android/app/tests/unit/src/com/android/bluetooth/opp/BluetoothOppUtilityTest.java
new file mode 100644
index 0000000..aea10f6
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/opp/BluetoothOppUtilityTest.java
@@ -0,0 +1,381 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.opp;
+
+import static com.google.common.truth.Truth.assertThat;
+import static com.google.common.truth.Truth.assertWithMessage;
+
+import static org.mockito.ArgumentMatchers.argThat;
+import static org.mockito.ArgumentMatchers.nullable;
+import static org.mockito.Mockito.any;
+import static org.mockito.Mockito.anyInt;
+import static org.mockito.Mockito.doAnswer;
+import static org.mockito.Mockito.doReturn;
+import static org.mockito.Mockito.eq;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.spy;
+import static org.mockito.Mockito.verify;
+
+import android.content.Context;
+import android.content.ContextWrapper;
+import android.content.Intent;
+import android.content.pm.PackageManager;
+import android.content.pm.ResolveInfo;
+import android.database.Cursor;
+import android.net.Uri;
+
+import androidx.test.platform.app.InstrumentationRegistry;
+
+import com.android.bluetooth.BluetoothMethodProxy;
+import com.android.bluetooth.opp.BluetoothOppTestUtils.CursorMockData;
+
+import org.junit.After;
+import org.junit.Before;
+import org.junit.Test;
+import org.mockito.Mock;
+import org.mockito.MockitoAnnotations;
+import org.mockito.Spy;
+
+import java.io.FileNotFoundException;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Objects;
+import java.util.concurrent.atomic.AtomicInteger;
+
+public class BluetoothOppUtilityTest {
+
+    private static final Uri CORRECT_FORMAT_BUT_INVALID_FILE_URI = Uri.parse(
+            "content://com.android.bluetooth.opp/btopp/0123455343467");
+    private static final Uri INCORRECT_FORMAT_URI = Uri.parse("www.google.com");
+
+    Context mContext;
+    @Mock
+    Cursor mCursor;
+
+    @Spy
+    BluetoothMethodProxy mCallProxy = BluetoothMethodProxy.getInstance();
+
+
+    @Before
+    public void setUp() {
+        MockitoAnnotations.initMocks(this);
+        mContext = InstrumentationRegistry.getInstrumentation().getTargetContext();
+        BluetoothMethodProxy.setInstanceForTesting(mCallProxy);
+        BluetoothOppTestUtils.enableOppActivities(true, mContext);
+    }
+
+    @After
+    public void tearDown() {
+        BluetoothOppTestUtils.enableOppActivities(false, mContext);
+        BluetoothMethodProxy.setInstanceForTesting(null);
+    }
+
+    @Test
+    public void isBluetoothShareUri_correctlyCheckUri() {
+        assertThat(BluetoothOppUtility.isBluetoothShareUri(INCORRECT_FORMAT_URI)).isFalse();
+        assertThat(BluetoothOppUtility.isBluetoothShareUri(CORRECT_FORMAT_BUT_INVALID_FILE_URI))
+                .isTrue();
+    }
+
+    @Test
+    public void queryRecord_withInvalidFileUrl_returnsNull() {
+        doReturn(null).when(mCallProxy).contentResolverQuery(any(),
+                eq(CORRECT_FORMAT_BUT_INVALID_FILE_URI), eq(null), eq(null),
+                eq(null), eq(null));
+        assertThat(BluetoothOppUtility.queryRecord(mContext,
+                CORRECT_FORMAT_BUT_INVALID_FILE_URI)).isNull();
+    }
+
+    @Test
+    public void queryRecord_mockCursor_returnsInstance() {
+        String destinationValue = "AA:BB:CC:00:11:22";
+
+        doReturn(mCursor).when(mCallProxy).contentResolverQuery(any(),
+                eq(CORRECT_FORMAT_BUT_INVALID_FILE_URI), eq(null), eq(null),
+                eq(null), eq(null));
+        doReturn(true).when(mCursor).moveToFirst();
+        doReturn(destinationValue).when(mCursor).getString(anyInt());
+        assertThat(BluetoothOppUtility.queryRecord(mContext,
+                CORRECT_FORMAT_BUT_INVALID_FILE_URI)).isInstanceOf(BluetoothOppTransferInfo.class);
+    }
+
+    @Test
+    public void queryTransfersInBatch_returnsCorrectUrlArrayList() {
+        long timestampValue = 123456;
+        String where = BluetoothShare.TIMESTAMP + " == " + timestampValue;
+        AtomicInteger cnt = new AtomicInteger(1);
+
+        doReturn(mCursor).when(mCallProxy).contentResolverQuery(any(),
+                eq(BluetoothShare.CONTENT_URI), eq(new String[]{
+                        BluetoothShare._DATA
+                }), eq(where), eq(null), eq(BluetoothShare._ID));
+
+
+        doAnswer(invocation -> cnt.incrementAndGet() > 5).when(mCursor).isAfterLast();
+        doReturn(CORRECT_FORMAT_BUT_INVALID_FILE_URI.toString()).when(mCursor)
+                .getString(0);
+
+        ArrayList<String> answer = BluetoothOppUtility.queryTransfersInBatch(mContext,
+                timestampValue);
+        for (String url : answer) {
+            assertThat(url).isEqualTo(CORRECT_FORMAT_BUT_INVALID_FILE_URI.toString());
+        }
+    }
+
+    @Test
+    public void openReceivedFile_fileNotExist() {
+
+        Uri contentResolverUri = Uri.parse("content://com.android.bluetooth.opp/btopp/0123");
+        Uri fileUri = Uri.parse("content:///tmp/randomFileName.txt");
+
+        Context spiedContext = spy(new ContextWrapper(mContext));
+
+        doReturn(0).when(mCallProxy).contentResolverDelete(any(), any(), any(), any());
+        doReturn(mCursor).when(mCallProxy).contentResolverQuery(any(),
+                eq(contentResolverUri), any(), eq(null),
+                eq(null), eq(null));
+
+        doReturn(true).when(mCursor).moveToFirst();
+        doReturn(fileUri.toString()).when(mCursor).getString(anyInt());
+
+        doReturn(0).when(mCallProxy).contentResolverDelete(any(), any(), nullable(String.class),
+                nullable(String[].class));
+
+        BluetoothOppUtility.openReceivedFile(spiedContext, "randomFileName.txt",
+                "text/plain", 0L, contentResolverUri);
+
+        verify(spiedContext).startActivity(argThat(argument
+                -> Objects.equals(argument.getComponent().getClassName(),
+                BluetoothOppBtErrorActivity.class.getName())
+        ));
+    }
+
+    @Test
+    public void openReceivedFile_fileExist_HandlingApplicationExist() throws FileNotFoundException {
+        Uri contentResolverUri = Uri.parse("content://com.android.bluetooth.opp/btopp/0123");
+        Uri fileUri = Uri.parse("content:///tmp/randomFileName.txt");
+
+        Context spiedContext = spy(new ContextWrapper(mContext));
+        // Control BluetoothOppUtility#fileExists flow
+        doReturn(mCursor).when(mCallProxy).contentResolverQuery(any(),
+                eq(contentResolverUri), any(), eq(null),
+                eq(null), eq(null));
+
+        doReturn(true).when(mCursor).moveToFirst();
+        doReturn(fileUri.toString()).when(mCursor).getString(anyInt());
+
+        doReturn(0).when(mCallProxy).contentResolverDelete(any(), any(), any(), any());
+        doReturn(null).when(mCallProxy).contentResolverOpenFileDescriptor(any(),
+                eq(fileUri), any());
+
+        // Control BluetoothOppUtility#isRecognizedFileType flow
+        PackageManager mockManager = mock(PackageManager.class);
+        doReturn(mockManager).when(spiedContext).getPackageManager();
+        doReturn(List.of(new ResolveInfo())).when(mockManager).queryIntentActivities(any(),
+                anyInt());
+
+        BluetoothOppUtility.openReceivedFile(spiedContext, "randomFileName.txt",
+                "text/plain", 0L, contentResolverUri);
+
+        verify(spiedContext).startActivity(argThat(argument
+                        -> Objects.equals(
+                        argument.getData(), Uri.parse("content:///tmp/randomFileName.txt")
+                ) && Objects.equals(argument.getAction(), Intent.ACTION_VIEW)
+        ));
+    }
+
+    @Test
+    public void openReceivedFile_fileExist_HandlingApplicationNotExist()
+            throws FileNotFoundException {
+
+        Uri contentResolverUri = Uri.parse("content://com.android.bluetooth.opp/btopp/0123");
+        Uri fileUri = Uri.parse("content:///tmp/randomFileName.txt");
+
+        Context spiedContext = spy(new ContextWrapper(mContext));
+        // Control BluetoothOppUtility#fileExists flow
+        doReturn(mCursor).when(mCallProxy).contentResolverQuery(any(),
+                eq(contentResolverUri), any(), eq(null),
+                eq(null), eq(null));
+
+        doReturn(true).when(mCursor).moveToFirst();
+        doReturn(fileUri.toString()).when(mCursor).getString(anyInt());
+
+
+        doReturn(0).when(mCallProxy).contentResolverDelete(any(), any(), any(), any());
+        doReturn(null).when(mCallProxy).contentResolverOpenFileDescriptor(any(),
+                eq(fileUri), any());
+
+        // Control BluetoothOppUtility#isRecognizedFileType flow
+        PackageManager mockManager = mock(PackageManager.class);
+        doReturn(mockManager).when(spiedContext).getPackageManager();
+        doReturn(List.of()).when(mockManager).queryIntentActivities(any(), anyInt());
+
+        BluetoothOppUtility.openReceivedFile(spiedContext, "randomFileName.txt",
+                "text/plain", 0L, contentResolverUri);
+
+        verify(spiedContext).startActivity(
+                argThat(argument -> argument.getComponent().getClassName().equals(
+                        BluetoothOppBtErrorActivity.class.getName())
+                ));
+    }
+
+
+    @Test
+    public void fillRecord_filledAllProperties() {
+        int idValue = 1234;
+        int directionValue = BluetoothShare.DIRECTION_OUTBOUND;
+        long totalBytesValue = 10;
+        long currentBytesValue = 1;
+        int statusValue = BluetoothShare.STATUS_PENDING;
+        Long timestampValue = 123456789L;
+        String destinationValue = "AA:BB:CC:00:11:22";
+        String fileNameValue = "Unknown file";
+        String deviceNameValue = "Unknown device"; // bt device name
+        String fileTypeValue = "text/plain";
+
+        List<CursorMockData> cursorMockDataList = List.of(
+                new CursorMockData(BluetoothShare._ID, 0, idValue),
+                new CursorMockData(BluetoothShare.STATUS, 1, statusValue),
+                new CursorMockData(BluetoothShare.DIRECTION, 2, directionValue),
+                new CursorMockData(BluetoothShare.TOTAL_BYTES, 3, totalBytesValue),
+                new CursorMockData(BluetoothShare.CURRENT_BYTES, 4, currentBytesValue),
+                new CursorMockData(BluetoothShare.TIMESTAMP, 5, timestampValue),
+                new CursorMockData(BluetoothShare.DESTINATION, 6, destinationValue),
+                new CursorMockData(BluetoothShare._DATA, 7, null),
+                new CursorMockData(BluetoothShare.FILENAME_HINT, 8, null),
+                new CursorMockData(BluetoothShare.MIMETYPE, 9, fileTypeValue)
+        );
+
+        BluetoothOppTestUtils.setUpMockCursor(mCursor, cursorMockDataList);
+
+        BluetoothOppTransferInfo info = new BluetoothOppTransferInfo();
+        BluetoothOppUtility.fillRecord(mContext, mCursor, info);
+
+        assertThat(info.mID).isEqualTo(idValue);
+        assertThat(info.mStatus).isEqualTo(statusValue);
+        assertThat(info.mDirection).isEqualTo(directionValue);
+        assertThat(info.mTotalBytes).isEqualTo(totalBytesValue);
+        assertThat(info.mCurrentBytes).isEqualTo(currentBytesValue);
+        assertThat(info.mTimeStamp).isEqualTo(timestampValue);
+        assertThat(info.mDestAddr).isEqualTo(destinationValue);
+        assertThat(info.mFileUri).isEqualTo(null);
+        assertThat(info.mFileType).isEqualTo(fileTypeValue);
+        assertThat(info.mDeviceName).isEqualTo(deviceNameValue);
+        assertThat(info.mHandoverInitiated).isEqualTo(false);
+        assertThat(info.mFileName).isEqualTo(fileNameValue);
+    }
+
+    @Test
+    public void fileExists_returnFalse() {
+        assertThat(
+                BluetoothOppUtility.fileExists(mContext, CORRECT_FORMAT_BUT_INVALID_FILE_URI)
+        ).isFalse();
+    }
+
+    @Test
+    public void isRecognizedFileType_withWrongFileUriAndMimeType_returnFalse() {
+        assertThat(
+                BluetoothOppUtility.isRecognizedFileType(mContext,
+                        CORRECT_FORMAT_BUT_INVALID_FILE_URI,
+                        "aWrongMimeType")
+        ).isFalse();
+    }
+
+    @Test
+    public void formatProgressText() {
+        assertThat(BluetoothOppUtility.formatProgressText(100, 42)).isEqualTo("42%");
+    }
+
+    @Test
+    public void formatResultText() {
+        assertThat(BluetoothOppUtility.formatResultText(1, 2, mContext)).isEqualTo(
+                "1 successful, 2 unsuccessful.");
+    }
+
+    @Test
+    public void getStatusDescription_returnCorrectString() {
+        String deviceName = "randomName";
+        assertThat(BluetoothOppUtility.getStatusDescription(mContext,
+                BluetoothShare.STATUS_PENDING, deviceName)).isEqualTo(
+                "File transfer not started yet.");
+        assertThat(BluetoothOppUtility.getStatusDescription(mContext,
+                BluetoothShare.STATUS_RUNNING, deviceName)).isEqualTo(
+                "File transfer is ongoing.");
+        assertThat(BluetoothOppUtility.getStatusDescription(mContext,
+                BluetoothShare.STATUS_SUCCESS, deviceName)).isEqualTo(
+                "File transfer completed successfully.");
+        assertThat(BluetoothOppUtility.getStatusDescription(mContext,
+                BluetoothShare.STATUS_NOT_ACCEPTABLE, deviceName)).isEqualTo(
+                "Content isn\'t supported.");
+        assertThat(BluetoothOppUtility.getStatusDescription(mContext,
+                BluetoothShare.STATUS_FORBIDDEN, deviceName)).isEqualTo(
+                "Transfer forbidden by target device.");
+        assertThat(BluetoothOppUtility.getStatusDescription(mContext,
+                BluetoothShare.STATUS_CANCELED, deviceName)).isEqualTo(
+                "Transfer canceled by user.");
+        assertThat(BluetoothOppUtility.getStatusDescription(mContext,
+                BluetoothShare.STATUS_FILE_ERROR, deviceName)).isEqualTo("Storage issue.");
+        assertThat(BluetoothOppUtility.getStatusDescription(mContext,
+                BluetoothShare.STATUS_CONNECTION_ERROR, deviceName)).isEqualTo(
+                "Connection unsuccessful.");
+        assertThat(BluetoothOppUtility.getStatusDescription(mContext,
+                BluetoothShare.STATUS_ERROR_NO_SDCARD, deviceName)).isEqualTo(
+                BluetoothOppUtility.deviceHasNoSdCard() ?
+                        "No USB storage." :
+                        "No SD card. Insert an SD card to save transferred files."
+        );
+        assertThat(BluetoothOppUtility.getStatusDescription(mContext,
+                BluetoothShare.STATUS_ERROR_SDCARD_FULL, deviceName)).isEqualTo(
+                BluetoothOppUtility.deviceHasNoSdCard() ?
+                        "There isn\'t enough space in USB storage to save the file." :
+                        "There isn\'t enough space on the SD card to save the file."
+        );
+        assertThat(BluetoothOppUtility.getStatusDescription(mContext,
+                BluetoothShare.STATUS_BAD_REQUEST, deviceName)).isEqualTo(
+                "Request can\'t be handled correctly.");
+        assertThat(BluetoothOppUtility.getStatusDescription(mContext, 12345465,
+                deviceName)).isEqualTo("Unknown error.");
+    }
+
+    @Test
+    public void originalUri_trimBeforeAt() {
+        Uri originalUri = Uri.parse("com.android.bluetooth.opp.BluetoothOppSendFileInfo");
+        Uri uri = Uri.parse("com.android.bluetooth.opp.BluetoothOppSendFileInfo@dfe15a6");
+        assertThat(BluetoothOppUtility.originalUri(uri)).isEqualTo(originalUri);
+    }
+
+    @Test
+    public void fileInfo_testFileInfoFunctions() {
+        assertThat(
+                BluetoothOppUtility.getSendFileInfo(CORRECT_FORMAT_BUT_INVALID_FILE_URI)
+        ).isEqualTo(
+                BluetoothOppSendFileInfo.SEND_FILE_INFO_ERROR
+        );
+        assertThat(BluetoothOppUtility.generateUri(CORRECT_FORMAT_BUT_INVALID_FILE_URI,
+                BluetoothOppSendFileInfo.SEND_FILE_INFO_ERROR).toString()
+        ).contains(
+                CORRECT_FORMAT_BUT_INVALID_FILE_URI.toString());
+        try {
+            BluetoothOppUtility.putSendFileInfo(CORRECT_FORMAT_BUT_INVALID_FILE_URI,
+                    BluetoothOppSendFileInfo.SEND_FILE_INFO_ERROR);
+            BluetoothOppUtility.closeSendFileInfo(CORRECT_FORMAT_BUT_INVALID_FILE_URI);
+        } catch (Exception e) {
+            assertWithMessage("Exception should not happen.").fail();
+        }
+    }
+
+}
diff --git a/android/app/tests/unit/src/com/android/bluetooth/opp/IncomingFileConfirmActivityTest.java b/android/app/tests/unit/src/com/android/bluetooth/opp/IncomingFileConfirmActivityTest.java
new file mode 100644
index 0000000..8d7c673
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/opp/IncomingFileConfirmActivityTest.java
@@ -0,0 +1,193 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.opp;
+
+import static androidx.test.espresso.Espresso.onView;
+import static androidx.test.espresso.action.ViewActions.click;
+import static androidx.test.espresso.assertion.ViewAssertions.matches;
+import static androidx.test.espresso.matcher.RootMatchers.isDialog;
+import static androidx.test.espresso.matcher.ViewMatchers.isDisplayed;
+import static androidx.test.espresso.matcher.ViewMatchers.withText;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.argThat;
+import static org.mockito.ArgumentMatchers.eq;
+import static org.mockito.ArgumentMatchers.nullable;
+import static org.mockito.Mockito.doReturn;
+import static org.mockito.Mockito.verify;
+
+import android.content.Context;
+import android.content.Intent;
+import android.database.Cursor;
+import android.net.Uri;
+
+import androidx.lifecycle.Lifecycle;
+import androidx.test.core.app.ActivityScenario;
+import androidx.test.platform.app.InstrumentationRegistry;
+import androidx.test.runner.AndroidJUnit4;
+
+import com.android.bluetooth.BluetoothMethodProxy;
+import com.android.bluetooth.R;
+
+import com.google.common.base.Objects;
+
+import org.junit.After;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.Mock;
+import org.mockito.Mockito;
+import org.mockito.MockitoAnnotations;
+import org.mockito.Spy;
+
+import java.util.ArrayList;
+import java.util.List;
+
+// Long class name cause problem with Junit4. It will raise java.lang.NoClassDefFoundError
+@RunWith(AndroidJUnit4.class)
+public class IncomingFileConfirmActivityTest {
+    @Mock
+    Cursor mCursor;
+    @Spy
+    BluetoothMethodProxy mBluetoothMethodProxy;
+
+    List<BluetoothOppTestUtils.CursorMockData> mCursorMockDataList;
+
+    Intent mIntent;
+    Context mTargetContext;
+
+    boolean mDestroyed;
+
+    @Before
+    public void setUp() {
+        MockitoAnnotations.initMocks(this);
+        mBluetoothMethodProxy = Mockito.spy(BluetoothMethodProxy.getInstance());
+        BluetoothMethodProxy.setInstanceForTesting(mBluetoothMethodProxy);
+
+        Uri dataUrl = Uri.parse("content://com.android.bluetooth.opp.test/random");
+
+        mTargetContext = InstrumentationRegistry.getInstrumentation().getTargetContext();
+
+        mIntent = new Intent();
+        mIntent.setClass(mTargetContext, BluetoothOppIncomingFileConfirmActivity.class);
+        mIntent.setData(dataUrl);
+
+        doReturn(mCursor).when(mBluetoothMethodProxy).contentResolverQuery(any(), eq(dataUrl),
+                eq(null), eq(null),
+                eq(null), eq(null));
+
+        doReturn(1).when(mBluetoothMethodProxy).contentResolverUpdate(any(), eq(dataUrl),
+                any(), eq(null), eq(null));
+
+        int idValue = 1234;
+        Long timestampValue = 123456789L;
+        String destinationValue = "AA:BB:CC:00:11:22";
+        String fileTypeValue = "text/plain";
+
+        mCursorMockDataList = new ArrayList<>(List.of(
+                new BluetoothOppTestUtils.CursorMockData(BluetoothShare.STATUS, 1,
+                        BluetoothShare.STATUS_PENDING),
+                new BluetoothOppTestUtils.CursorMockData(BluetoothShare.DIRECTION, 2,
+                        BluetoothShare.DIRECTION_OUTBOUND),
+                new BluetoothOppTestUtils.CursorMockData(BluetoothShare.TOTAL_BYTES, 3, 100),
+                new BluetoothOppTestUtils.CursorMockData(BluetoothShare.CURRENT_BYTES, 4, 0),
+                new BluetoothOppTestUtils.CursorMockData(BluetoothShare._ID, 0, idValue),
+                new BluetoothOppTestUtils.CursorMockData(BluetoothShare.MIMETYPE, 5, fileTypeValue),
+                new BluetoothOppTestUtils.CursorMockData(BluetoothShare.TIMESTAMP, 6,
+                        timestampValue),
+                new BluetoothOppTestUtils.CursorMockData(BluetoothShare.DESTINATION, 7,
+                        destinationValue),
+                new BluetoothOppTestUtils.CursorMockData(BluetoothShare._DATA, 8, null),
+                new BluetoothOppTestUtils.CursorMockData(BluetoothShare.FILENAME_HINT, 9, null),
+                new BluetoothOppTestUtils.CursorMockData(BluetoothShare.URI, 10,
+                        "content://textfile.txt"),
+                new BluetoothOppTestUtils.CursorMockData(BluetoothShare.USER_CONFIRMATION, 11,
+                        BluetoothShare.USER_CONFIRMATION_HANDOVER_CONFIRMED)
+        ));
+
+        BluetoothOppTestUtils.enableOppActivities(true, mTargetContext);
+    }
+
+    @After
+    public void tearDown() {
+        BluetoothMethodProxy.setInstanceForTesting(null);
+        BluetoothOppTestUtils.enableOppActivities(false, mTargetContext);
+    }
+
+    @Test
+    public void onCreate_clickConfirmCancel_saveUSER_CONFIRMAMTION_DENIED()
+            throws InterruptedException {
+        BluetoothOppTestUtils.setUpMockCursor(mCursor, mCursorMockDataList);
+
+        ActivityScenario<BluetoothOppIncomingFileConfirmActivity> activityScenario
+                = ActivityScenario.launch(mIntent);
+        activityScenario.onActivity(activity -> {});
+
+        // To work around (possibly) ActivityScenario's bug.
+        // The dialog button is clicked (no error throw) but onClick() is not triggered.
+        // It works normally if sleep for a few seconds
+        Thread.sleep(3_000);
+        onView(withText(mTargetContext.getText(R.string.incoming_file_confirm_cancel).toString()))
+                .inRoot(isDialog()).check(matches(isDisplayed())).perform(click());
+
+        verify(mBluetoothMethodProxy).contentResolverUpdate(any(), any(), argThat(
+                argument -> Objects.equal(
+                        BluetoothShare.USER_CONFIRMATION_DENIED,
+                        argument.get(BluetoothShare.USER_CONFIRMATION))
+        ), nullable(String.class), nullable(String[].class));
+    }
+
+    @Test
+    public void onCreate_clickConfirmOk_saveUSER_CONFIRMATION_CONFIRMED()
+            throws InterruptedException {
+        BluetoothOppTestUtils.setUpMockCursor(mCursor, mCursorMockDataList);
+
+        ActivityScenario.launch(mIntent);
+
+        // To work around (possibly) ActivityScenario's bug.
+        // The dialog button is clicked (no error throw) but onClick() is not triggered.
+        // It works normally if sleep for a few seconds
+        Thread.sleep(3_000);
+        onView(withText(mTargetContext.getText(R.string.incoming_file_confirm_ok).toString()))
+                .inRoot(isDialog()).check(matches(isDisplayed())).perform(click());
+
+        verify(mBluetoothMethodProxy).contentResolverUpdate(any(), any(), argThat(
+                argument -> Objects.equal(
+                        BluetoothShare.USER_CONFIRMATION_CONFIRMED,
+                        argument.get(BluetoothShare.USER_CONFIRMATION))
+        ), nullable(String.class), nullable(String[].class));
+    }
+
+    @Test
+    public void onTimeout_sendIntentWithUSER_CONFIRMATION_TIMEOUT_ACTION_finish() throws Exception {
+        BluetoothOppTestUtils.setUpMockCursor(mCursor, mCursorMockDataList);
+        ActivityScenario<BluetoothOppIncomingFileConfirmActivity> scenario =
+                ActivityScenario.launch(mIntent);
+
+        assertThat(scenario.getState()).isNotEqualTo(Lifecycle.State.DESTROYED);
+        Intent in = new Intent(BluetoothShare.USER_CONFIRMATION_TIMEOUT_ACTION);
+        mTargetContext.sendBroadcast(in);
+
+        // To work around (possibly) ActivityScenario's bug.
+        // The dialog button is clicked (no error throw) but onClick() is not triggered.
+        // It works normally if sleep for a few seconds
+        Thread.sleep(3_000);
+        assertThat(scenario.getState()).isEqualTo(Lifecycle.State.DESTROYED);
+    }
+}
diff --git a/android/app/src/com/android/bluetooth/opp/TestActivity.java b/android/app/tests/unit/src/com/android/bluetooth/opp/TestActivity.java
similarity index 100%
rename from android/app/src/com/android/bluetooth/opp/TestActivity.java
rename to android/app/tests/unit/src/com/android/bluetooth/opp/TestActivity.java
diff --git a/android/app/tests/unit/src/com/android/bluetooth/pan/BluetoothTetheringNetworkFactoryTest.java b/android/app/tests/unit/src/com/android/bluetooth/pan/BluetoothTetheringNetworkFactoryTest.java
new file mode 100644
index 0000000..8357e12
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/pan/BluetoothTetheringNetworkFactoryTest.java
@@ -0,0 +1,133 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.pan;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import static org.mockito.Mockito.times;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import android.bluetooth.BluetoothAdapter;
+import android.bluetooth.BluetoothDevice;
+import android.bluetooth.BluetoothManager;
+import android.content.Context;
+import android.os.Looper;
+
+import androidx.test.core.app.ApplicationProvider;
+import androidx.test.filters.SmallTest;
+import androidx.test.runner.AndroidJUnit4;
+
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.Mock;
+import org.mockito.MockitoAnnotations;
+
+import java.util.ArrayList;
+import java.util.List;
+
+/**
+ * Test cases for {@link BluetoothTetheringNetworkFactory}.
+ */
+@SmallTest
+@RunWith(AndroidJUnit4.class)
+public class BluetoothTetheringNetworkFactoryTest {
+
+    @Mock
+    private PanService mPanService;
+
+    private Context mContext = ApplicationProvider.getApplicationContext();
+
+    @Before
+    public void setUp() {
+        MockitoAnnotations.initMocks(this);
+    }
+
+    @Test
+    public void networkStartReverseTetherEmptyIface() {
+        if (Looper.myLooper() == null) {
+            Looper.prepare();
+        }
+
+        BluetoothTetheringNetworkFactory bluetoothTetheringNetworkFactory =
+                new BluetoothTetheringNetworkFactory(mContext, Looper.myLooper(), mPanService);
+
+        String iface = "";
+        bluetoothTetheringNetworkFactory.startReverseTether(iface);
+
+        assertThat(bluetoothTetheringNetworkFactory.getProvider()).isNull();
+    }
+
+    @Test
+    public void networkStartReverseTether() {
+        if (Looper.myLooper() == null) {
+            Looper.prepare();
+        }
+
+        BluetoothTetheringNetworkFactory bluetoothTetheringNetworkFactory =
+                new BluetoothTetheringNetworkFactory(mContext, Looper.myLooper(), mPanService);
+
+        String iface = "iface";
+        bluetoothTetheringNetworkFactory.startReverseTether(iface);
+
+        assertThat(bluetoothTetheringNetworkFactory.getProvider()).isNotNull();
+    }
+
+    @Test
+    public void networkStartReverseTetherStop() {
+        if (Looper.myLooper() == null) {
+            Looper.prepare();
+        }
+
+        BluetoothTetheringNetworkFactory bluetoothTetheringNetworkFactory =
+                new BluetoothTetheringNetworkFactory(mContext, Looper.myLooper(), mPanService);
+
+        String iface = "iface";
+        bluetoothTetheringNetworkFactory.startReverseTether(iface);
+
+        assertThat(bluetoothTetheringNetworkFactory.getProvider()).isNotNull();
+
+        BluetoothAdapter adapter =
+                mContext.getSystemService(BluetoothManager.class).getAdapter();
+        List<BluetoothDevice> bluetoothDevices = new ArrayList<>();
+        BluetoothDevice bluetoothDevice = adapter.getRemoteDevice("11:11:11:11:11:11");
+        bluetoothDevices.add(bluetoothDevice);
+
+        when(mPanService.getConnectedDevices()).thenReturn(bluetoothDevices);
+
+        bluetoothTetheringNetworkFactory.stopReverseTether();
+
+        verify(mPanService, times(1)).getConnectedDevices();
+        verify(mPanService, times(1)).disconnect(bluetoothDevice);
+    }
+
+    @Test
+    public void networkStopEmptyIface() {
+        if (Looper.myLooper() == null) {
+            Looper.prepare();
+        }
+
+        BluetoothTetheringNetworkFactory bluetoothTetheringNetworkFactory =
+                new BluetoothTetheringNetworkFactory(mContext, Looper.myLooper(), mPanService);
+
+        bluetoothTetheringNetworkFactory.stopNetwork();
+        bluetoothTetheringNetworkFactory.stopReverseTether();
+
+        assertThat(bluetoothTetheringNetworkFactory.getProvider()).isNull();
+    }
+}
diff --git a/android/app/tests/unit/src/com/android/bluetooth/pan/PanServiceBinderTest.java b/android/app/tests/unit/src/com/android/bluetooth/pan/PanServiceBinderTest.java
new file mode 100644
index 0000000..a822d45
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/pan/PanServiceBinderTest.java
@@ -0,0 +1,114 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.pan;
+
+import static org.mockito.Mockito.isNull;
+import static org.mockito.Mockito.anyInt;
+import static org.mockito.Mockito.eq;
+import static org.mockito.Mockito.verify;
+
+import android.bluetooth.BluetoothAdapter;
+import android.bluetooth.BluetoothDevice;
+import android.bluetooth.BluetoothProfile;
+
+import androidx.test.filters.SmallTest;
+import androidx.test.runner.AndroidJUnit4;
+
+import com.android.bluetooth.x.com.android.modules.utils.SynchronousResultReceiver;
+
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.Mock;
+import org.mockito.MockitoAnnotations;
+
+@SmallTest
+@RunWith(AndroidJUnit4.class)
+public class PanServiceBinderTest {
+    private static final String REMOTE_DEVICE_ADDRESS = "00:00:00:00:00:00";
+
+    @Mock
+    private PanService mService;
+
+    BluetoothDevice mRemoteDevice;
+
+    PanService.BluetoothPanBinder mBinder;
+
+    @Before
+    public void setUp() throws Exception {
+        MockitoAnnotations.initMocks(this);
+        mRemoteDevice = BluetoothAdapter.getDefaultAdapter().getRemoteDevice(REMOTE_DEVICE_ADDRESS);
+        mBinder = new PanService.BluetoothPanBinder(mService);
+    }
+
+    @Test
+    public void connect_callsServiceMethod() {
+        mBinder.connect(mRemoteDevice, null, SynchronousResultReceiver.get());
+
+        verify(mService).connect(mRemoteDevice);
+    }
+
+    @Test
+    public void disconnect_callsServiceMethod() {
+        mBinder.disconnect(mRemoteDevice, null, SynchronousResultReceiver.get());
+
+        verify(mService).disconnect(mRemoteDevice);
+    }
+
+    @Test
+    public void getConnectedDevices_callsServiceMethod() {
+        mBinder.getConnectedDevices(null, SynchronousResultReceiver.get());
+
+        verify(mService).getConnectedDevices();
+    }
+
+    @Test
+    public void getDevicesMatchingConnectionStates_callsServiceMethod() {
+        int[] states = new int[] {BluetoothProfile.STATE_CONNECTED};
+        mBinder.getDevicesMatchingConnectionStates(states, null, SynchronousResultReceiver.get());
+
+        verify(mService).getDevicesMatchingConnectionStates(states);
+    }
+
+    @Test
+    public void getConnectionState_callsServiceMethod() {
+        mBinder.getConnectionState(mRemoteDevice, null, SynchronousResultReceiver.get());
+
+        verify(mService).getConnectionState(mRemoteDevice);
+    }
+
+    @Test
+    public void setConnectionPolicy_callsServiceMethod() {
+        int connectionPolicy = BluetoothProfile.CONNECTION_POLICY_ALLOWED;
+        mBinder.setConnectionPolicy(mRemoteDevice, connectionPolicy,
+                null, SynchronousResultReceiver.get());
+
+        verify(mService).setConnectionPolicy(mRemoteDevice, connectionPolicy);
+    }
+
+    @Test
+    public void isTetheringOn_callsServiceMethod() {
+        mBinder.isTetheringOn(null, SynchronousResultReceiver.get());
+
+        verify(mService).isTetheringOn();
+    }
+
+    @Test
+    public void cleanUp_doesNotCrash() {
+        mBinder.cleanup();
+    }
+}
diff --git a/android/app/tests/unit/src/com/android/bluetooth/pan/PanServiceTest.java b/android/app/tests/unit/src/com/android/bluetooth/pan/PanServiceTest.java
index a6736cf..fb33486 100644
--- a/android/app/tests/unit/src/com/android/bluetooth/pan/PanServiceTest.java
+++ b/android/app/tests/unit/src/com/android/bluetooth/pan/PanServiceTest.java
@@ -15,27 +15,32 @@
  */
 package com.android.bluetooth.pan;
 
+import static android.bluetooth.BluetoothPan.PAN_ROLE_NONE;
+import static android.net.TetheringManager.TETHERING_BLUETOOTH;
+import static android.net.TetheringManager.TETHER_ERROR_SERVICE_UNAVAIL;
+
+import static com.google.common.truth.Truth.assertThat;
+
 import static org.mockito.Mockito.anyString;
 import static org.mockito.Mockito.doReturn;
 import static org.mockito.Mockito.when;
 
 import android.bluetooth.BluetoothAdapter;
 import android.bluetooth.BluetoothDevice;
-import android.content.Context;
+import android.bluetooth.BluetoothProfile;
+import android.net.TetheringInterface;
 import android.os.UserManager;
 
-import androidx.test.InstrumentationRegistry;
 import androidx.test.filters.MediumTest;
 import androidx.test.rule.ServiceTestRule;
 import androidx.test.runner.AndroidJUnit4;
 
-import com.android.bluetooth.R;
 import com.android.bluetooth.TestUtils;
 import com.android.bluetooth.btservice.AdapterService;
 import com.android.bluetooth.btservice.storage.DatabaseManager;
+import com.android.bluetooth.pan.PanService.BluetoothPanDevice;
 
 import org.junit.After;
-import org.junit.Assert;
 import org.junit.Assume;
 import org.junit.Before;
 import org.junit.Rule;
@@ -47,9 +52,12 @@
 @MediumTest
 @RunWith(AndroidJUnit4.class)
 public class PanServiceTest {
+    private static final String REMOTE_DEVICE_ADDRESS = "00:00:00:00:00:00";
+    private static final byte[] REMOTE_DEVICE_ADDRESS_AS_ARRAY = new byte[] {0, 0, 0, 0, 0, 0};
+
     private PanService mService = null;
     private BluetoothAdapter mAdapter = null;
-    private Context mTargetContext;
+    private BluetoothDevice mRemoteDevice;
 
     @Rule public final ServiceTestRule mServiceRule = new ServiceTestRule();
 
@@ -59,7 +67,6 @@
 
     @Before
     public void setUp() throws Exception {
-        mTargetContext = InstrumentationRegistry.getTargetContext();
         Assume.assumeTrue("Ignore test when PanService is not enabled",
                 PanService.isEnabled());
         MockitoAnnotations.initMocks(this);
@@ -68,11 +75,12 @@
         doReturn(true, false).when(mAdapterService).isStartedProfile(anyString());
         TestUtils.startService(mServiceRule, PanService.class);
         mService = PanService.getPanService();
-        Assert.assertNotNull(mService);
+        assertThat(mService).isNotNull();
         // Try getting the Bluetooth adapter
         mAdapter = BluetoothAdapter.getDefaultAdapter();
-        Assert.assertNotNull(mAdapter);
+        assertThat(mAdapter).isNotNull();
         mService.mUserManager = mMockUserManager;
+        mRemoteDevice = mAdapter.getRemoteDevice(REMOTE_DEVICE_ADDRESS);
     }
 
     @After
@@ -82,19 +90,127 @@
         }
         TestUtils.stopService(mServiceRule, PanService.class);
         mService = PanService.getPanService();
-        Assert.assertNull(mService);
+        assertThat(mService).isNull();
         TestUtils.clearAdapterService(mAdapterService);
     }
 
     @Test
-    public void testInitialize() {
-        Assert.assertNotNull(PanService.getPanService());
+    public void initialize() {
+        assertThat(PanService.getPanService()).isNotNull();
     }
 
     @Test
-    public void testGuestUserConnect() {
-        BluetoothDevice device = TestUtils.getTestDevice(mAdapter, 0);
+    public void connect_whenGuestUser_returnsFalse() {
         when(mMockUserManager.isGuestUser()).thenReturn(true);
-        Assert.assertFalse(mService.connect(device));
+        assertThat(mService.connect(mRemoteDevice)).isFalse();
+    }
+
+    @Test
+    public void connect_inConnectedState_returnsFalse() {
+        when(mMockUserManager.isGuestUser()).thenReturn(false);
+        mService.mPanDevices.put(mRemoteDevice, new BluetoothPanDevice(
+                BluetoothProfile.STATE_CONNECTED, "iface", PAN_ROLE_NONE, PAN_ROLE_NONE));
+
+        assertThat(mService.connect(mRemoteDevice)).isFalse();
+    }
+
+    @Test
+    public void connect() {
+        when(mMockUserManager.isGuestUser()).thenReturn(false);
+        mService.mPanDevices.put(mRemoteDevice, new BluetoothPanDevice(
+                BluetoothProfile.STATE_DISCONNECTED, "iface", PAN_ROLE_NONE, PAN_ROLE_NONE));
+
+        assertThat(mService.connect(mRemoteDevice)).isTrue();
+    }
+
+    @Test
+    public void disconnect_returnsTrue() {
+        assertThat(mService.disconnect(mRemoteDevice)).isTrue();
+    }
+
+    @Test
+    public void convertHalState() {
+        assertThat(PanService.convertHalState(PanService.CONN_STATE_CONNECTED))
+                .isEqualTo(BluetoothProfile.STATE_CONNECTED);
+        assertThat(PanService.convertHalState(PanService.CONN_STATE_CONNECTING))
+                .isEqualTo(BluetoothProfile.STATE_CONNECTING);
+        assertThat(PanService.convertHalState(PanService.CONN_STATE_DISCONNECTED))
+                .isEqualTo(BluetoothProfile.STATE_DISCONNECTED);
+        assertThat(PanService.convertHalState(PanService.CONN_STATE_DISCONNECTING))
+                .isEqualTo(BluetoothProfile.STATE_DISCONNECTING);
+        assertThat(PanService.convertHalState(-24664)) // illegal value
+                .isEqualTo(BluetoothProfile.STATE_DISCONNECTED);
+    }
+
+    @Test
+    public void dump() {
+        mService.mPanDevices.put(mRemoteDevice, new BluetoothPanDevice(
+                BluetoothProfile.STATE_DISCONNECTED, "iface", PAN_ROLE_NONE, PAN_ROLE_NONE));
+
+        mService.dump(new StringBuilder());
+    }
+
+    @Test
+    public void onConnectStateChanged_doesNotCrash() {
+        mService.onConnectStateChanged(REMOTE_DEVICE_ADDRESS_AS_ARRAY, 1, 2, 3, 4);
+    }
+
+    @Test
+    public void onControlStateChanged_doesNotCrash() {
+        mService.onControlStateChanged(1, 2, 3, "ifname");
+    }
+
+    @Test
+    public void setConnectionPolicy_whenDatabaseManagerRefuses_returnsFalse() {
+        int connectionPolicy = BluetoothProfile.CONNECTION_POLICY_ALLOWED;
+        when(mDatabaseManager.setProfileConnectionPolicy(
+                mRemoteDevice, BluetoothProfile.PAN, connectionPolicy)).thenReturn(false);
+
+        assertThat(mService.setConnectionPolicy(mRemoteDevice, connectionPolicy)).isFalse();
+    }
+
+    @Test
+    public void setConnectionPolicy_returnsTrue() {
+        when(mDatabaseManager.setProfileConnectionPolicy(
+                mRemoteDevice, BluetoothProfile.PAN, BluetoothProfile.CONNECTION_POLICY_ALLOWED))
+                .thenReturn(true);
+        assertThat(mService.setConnectionPolicy(
+                mRemoteDevice, BluetoothProfile.CONNECTION_POLICY_ALLOWED)).isTrue();
+
+        when(mDatabaseManager.setProfileConnectionPolicy(
+                mRemoteDevice, BluetoothProfile.PAN, BluetoothProfile.CONNECTION_POLICY_FORBIDDEN))
+                .thenReturn(true);
+        assertThat(mService.setConnectionPolicy(
+                mRemoteDevice, BluetoothProfile.CONNECTION_POLICY_FORBIDDEN)).isTrue();
+    }
+
+    @Test
+    public void connectState_constructor() {
+        int state = 1;
+        int error = 2;
+        int localRole = 3;
+        int remoteRole = 4;
+
+        PanService.ConnectState connectState = new PanService.ConnectState(
+                REMOTE_DEVICE_ADDRESS_AS_ARRAY, state, error, localRole, remoteRole);
+
+        assertThat(connectState.addr).isEqualTo(REMOTE_DEVICE_ADDRESS_AS_ARRAY);
+        assertThat(connectState.state).isEqualTo(state);
+        assertThat(connectState.error).isEqualTo(error);
+        assertThat(connectState.local_role).isEqualTo(localRole);
+        assertThat(connectState.remote_role).isEqualTo(remoteRole);
+    }
+
+    @Test
+    public void tetheringCallback_onError_clearsPanDevices() {
+        mService.mIsTethering = true;
+        mService.mPanDevices.put(mRemoteDevice, new BluetoothPanDevice(
+                BluetoothProfile.STATE_DISCONNECTED, "iface", PAN_ROLE_NONE, PAN_ROLE_NONE));
+        TetheringInterface iface = new TetheringInterface(TETHERING_BLUETOOTH, "iface");
+
+        mService.mTetheringCallback.onError(iface, TETHER_ERROR_SERVICE_UNAVAIL);
+
+        assertThat(mService.mPanDevices).isEmpty();
+        assertThat(mService.mIsTethering).isFalse();
     }
 }
diff --git a/android/app/tests/unit/src/com/android/bluetooth/pbap/BluetoothPbapActivityTest.java b/android/app/tests/unit/src/com/android/bluetooth/pbap/BluetoothPbapActivityTest.java
new file mode 100644
index 0000000..f5bd7be
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/pbap/BluetoothPbapActivityTest.java
@@ -0,0 +1,173 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.pbap;
+
+import static android.content.DialogInterface.BUTTON_POSITIVE;
+import static android.content.pm.PackageManager.COMPONENT_ENABLED_STATE_DEFAULT;
+import static android.content.pm.PackageManager.COMPONENT_ENABLED_STATE_ENABLED;
+import static android.content.pm.PackageManager.DONT_KILL_APP;
+
+import static androidx.lifecycle.Lifecycle.State;
+import static androidx.lifecycle.Lifecycle.State.DESTROYED;
+import static androidx.lifecycle.Lifecycle.State.RESUMED;
+
+import static com.google.common.truth.Truth.assertThat;
+import static com.google.common.truth.Truth.assertWithMessage;
+
+import android.content.ComponentName;
+import android.content.Context;
+import android.content.Intent;
+import android.text.Editable;
+import android.text.SpannableStringBuilder;
+
+import androidx.test.core.app.ActivityScenario;
+import androidx.test.filters.LargeTest;
+import androidx.test.platform.app.InstrumentationRegistry;
+import androidx.test.runner.AndroidJUnit4;
+
+import org.junit.After;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+import java.util.concurrent.atomic.AtomicBoolean;
+
+@LargeTest
+@RunWith(AndroidJUnit4.class)
+public class BluetoothPbapActivityTest {
+
+    Context mTargetContext = InstrumentationRegistry.getInstrumentation().getTargetContext();
+    Intent mIntent;
+
+    ActivityScenario<BluetoothPbapActivity> mActivityScenario;
+
+    @Before
+    public void setUp() {
+        mIntent = new Intent();
+        mIntent.setClass(mTargetContext, BluetoothPbapActivity.class);
+        mIntent.setAction(BluetoothPbapService.AUTH_CHALL_ACTION);
+
+        enableActivity(true);
+        mActivityScenario = ActivityScenario.launch(mIntent);
+    }
+
+    @After
+    public void tearDown() throws Exception {
+        if (mActivityScenario != null) {
+            // Workaround for b/159805732. Without this, test hangs for 45 seconds.
+            Thread.sleep(1_000);
+            mActivityScenario.close();
+        }
+        enableActivity(false);
+    }
+
+    @Test
+    public void activityIsDestroyed_whenLaunchedWithoutIntentAction() throws Exception {
+        mActivityScenario.close();
+
+        mIntent.setAction(null);
+        mActivityScenario = ActivityScenario.launch(mIntent);
+
+        assertActivityState(DESTROYED);
+    }
+
+    @Test
+    public void onPreferenceChange_returnsTrue() throws Exception {
+        AtomicBoolean result = new AtomicBoolean(false);
+
+        mActivityScenario.onActivity(activity -> result.set(
+                activity.onPreferenceChange(/*preference=*/null, /*newValue=*/null)));
+
+        assertThat(result.get()).isTrue();
+    }
+
+    @Test
+    public void onPositive_finishesActivity() throws Exception {
+        mActivityScenario.onActivity(activity -> {
+            activity.onPositive();
+        });
+
+        assertActivityState(DESTROYED);
+    }
+
+    @Test
+    public void onNegative_finishesActivity() throws Exception {
+        mActivityScenario.onActivity(activity -> {
+            activity.onNegative();
+        });
+
+        assertActivityState(DESTROYED);
+    }
+
+    @Test
+    public void onReceiveTimeoutIntent_finishesActivity() throws Exception {
+        Intent intent = new Intent(BluetoothPbapService.USER_CONFIRM_TIMEOUT_ACTION);
+
+        mActivityScenario.onActivity(activity -> {
+            activity.mReceiver.onReceive(activity, intent);
+        });
+
+        assertActivityState(DESTROYED);
+    }
+
+    @Test
+    public void afterTextChanged() throws Exception {
+        Editable editable = new SpannableStringBuilder("An editable text");
+        AtomicBoolean result = new AtomicBoolean(false);
+
+        mActivityScenario.onActivity(activity -> {
+            activity.afterTextChanged(editable);
+            result.set(activity.getButton(BUTTON_POSITIVE).isEnabled());
+        });
+
+        assertThat(result.get()).isTrue();
+    }
+
+    // TODO: Test onSaveInstanceState and onRestoreInstanceState.
+    // Note: Activity.recreate() fails. The Activity just finishes itself when recreated.
+    //       Fix the bug and test those methods.
+
+    @Test
+    public void emptyMethods_doesNotThrowException() throws Exception {
+        try {
+            mActivityScenario.onActivity(activity -> {
+                activity.beforeTextChanged(null, 0, 0, 0);
+                activity.onTextChanged(null, 0, 0, 0);
+            });
+        } catch (Exception ex) {
+            assertWithMessage("Exception should not happen!").fail();
+        }
+    }
+
+    private void assertActivityState(State state) throws Exception {
+        // TODO: Change this into an event driven systems
+        Thread.sleep(3_000);
+        assertThat(mActivityScenario.getState()).isEqualTo(state);
+    }
+
+    private void enableActivity(boolean enable) {
+        int enabledState = enable ? COMPONENT_ENABLED_STATE_ENABLED
+                : COMPONENT_ENABLED_STATE_DEFAULT;
+
+        mTargetContext.getPackageManager().setApplicationEnabledSetting(
+                mTargetContext.getPackageName(), enabledState, DONT_KILL_APP);
+
+        ComponentName activityName = new ComponentName(mTargetContext, BluetoothPbapActivity.class);
+        mTargetContext.getPackageManager().setComponentEnabledSetting(
+                activityName, enabledState, DONT_KILL_APP);
+    }
+}
diff --git a/android/app/tests/unit/src/com/android/bluetooth/pbap/BluetoothPbapAuthenticatorTest.java b/android/app/tests/unit/src/com/android/bluetooth/pbap/BluetoothPbapAuthenticatorTest.java
new file mode 100644
index 0000000..431c8cd
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/pbap/BluetoothPbapAuthenticatorTest.java
@@ -0,0 +1,128 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.pbap;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import static org.mockito.Mockito.doAnswer;
+import static org.mockito.Mockito.verify;
+
+import androidx.test.filters.MediumTest;
+import androidx.test.runner.AndroidJUnit4;
+
+import com.android.obex.PasswordAuthentication;
+
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.Mock;
+import org.mockito.MockitoAnnotations;
+
+@MediumTest
+@RunWith(AndroidJUnit4.class)
+public class BluetoothPbapAuthenticatorTest {
+
+    private BluetoothPbapAuthenticator mAuthenticator;
+
+    @Mock
+    PbapStateMachine mMockPbapStateMachine;
+
+    @Before
+    public void setUp() throws Exception {
+        MockitoAnnotations.initMocks(this);
+        mAuthenticator = new BluetoothPbapAuthenticator(mMockPbapStateMachine);
+    }
+
+    @Test
+    public void testConstructor() {
+        assertThat(mAuthenticator.mChallenged).isFalse();
+        assertThat(mAuthenticator.mAuthCancelled).isFalse();
+        assertThat(mAuthenticator.mSessionKey).isNull();
+        assertThat(mAuthenticator.mPbapStateMachine).isEqualTo(mMockPbapStateMachine);
+    }
+
+    @Test
+    public void testSetChallenged() {
+        mAuthenticator.setChallenged(true);
+        assertThat(mAuthenticator.mChallenged).isTrue();
+
+        mAuthenticator.setChallenged(false);
+        assertThat(mAuthenticator.mChallenged).isFalse();
+    }
+
+    @Test
+    public void testSetCancelled() {
+        mAuthenticator.setCancelled(true);
+        assertThat(mAuthenticator.mAuthCancelled).isTrue();
+
+        mAuthenticator.setCancelled(false);
+        assertThat(mAuthenticator.mAuthCancelled).isFalse();
+    }
+
+    @Test
+    public void testSetSessionKey() {
+        final String sessionKey = "test_session_key";
+
+        mAuthenticator.setSessionKey(sessionKey);
+        assertThat(mAuthenticator.mSessionKey).isEqualTo(sessionKey);
+
+        mAuthenticator.setSessionKey(null);
+        assertThat(mAuthenticator.mSessionKey).isNull();
+    }
+
+    @Test
+    public void testOnAuthenticationChallenge() {
+        final String sessionKey = "test_session_key";
+        doAnswer(invocation -> {
+            mAuthenticator.setSessionKey(sessionKey);
+            mAuthenticator.setChallenged(true);
+            return null;
+        }).when(mMockPbapStateMachine).sendMessage(PbapStateMachine.CREATE_NOTIFICATION);
+
+        // Note: onAuthenticationChallenge() does not use any arguments
+        PasswordAuthentication passwordAuthentication = mAuthenticator.onAuthenticationChallenge(
+                /*description=*/ null, /*isUserIdRequired=*/ false, /*isFullAccess=*/ false);
+
+        verify(mMockPbapStateMachine).sendMessage(PbapStateMachine.CREATE_NOTIFICATION);
+        verify(mMockPbapStateMachine).sendMessageDelayed(PbapStateMachine.REMOVE_NOTIFICATION,
+                BluetoothPbapService.USER_CONFIRM_TIMEOUT_VALUE);
+        assertThat(passwordAuthentication.getPassword()).isEqualTo(sessionKey.getBytes());
+    }
+
+    @Test
+    public void testOnAuthenticationChallenge_returnsNullWhenSessionKeyIsEmpty() {
+        final String emptySessionKey = "";
+        doAnswer(invocation -> {
+            mAuthenticator.setSessionKey(emptySessionKey);
+            mAuthenticator.setChallenged(true);
+            return null;
+        }).when(mMockPbapStateMachine).sendMessage(PbapStateMachine.CREATE_NOTIFICATION);
+
+        // Note: onAuthenticationChallenge() does not use any arguments
+        PasswordAuthentication passwordAuthentication = mAuthenticator.onAuthenticationChallenge(
+                /*description=*/ null, /*isUserIdRequired=*/ false, /*isFullAccess=*/ false);
+        assertThat(passwordAuthentication).isNull();
+    }
+
+    @Test
+    public void testOnAuthenticationResponse() {
+        byte[] userName = "test_user_name".getBytes();
+
+        // This assertion should be fixed when the implementation changes.
+        assertThat(mAuthenticator.onAuthenticationResponse(userName)).isNull();
+    }
+}
diff --git a/android/app/tests/unit/src/com/android/bluetooth/pbap/BluetoothPbapCallLogComposerTest.java b/android/app/tests/unit/src/com/android/bluetooth/pbap/BluetoothPbapCallLogComposerTest.java
new file mode 100644
index 0000000..33089f4
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/pbap/BluetoothPbapCallLogComposerTest.java
@@ -0,0 +1,207 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.pbap;
+
+import static com.android.bluetooth.pbap.BluetoothPbapCallLogComposer.FAILURE_REASON_FAILED_TO_GET_DATABASE_INFO;
+import static com.android.bluetooth.pbap.BluetoothPbapCallLogComposer.FAILURE_REASON_NOT_INITIALIZED;
+import static com.android.bluetooth.pbap.BluetoothPbapCallLogComposer.FAILURE_REASON_NO_ENTRY;
+import static com.android.bluetooth.pbap.BluetoothPbapCallLogComposer.FAILURE_REASON_UNSUPPORTED_URI;
+import static com.android.bluetooth.pbap.BluetoothPbapCallLogComposer.NO_ERROR;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import static org.mockito.Mockito.any;
+import static org.mockito.Mockito.doReturn;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import android.database.Cursor;
+import android.net.Uri;
+import android.provider.CallLog;
+import android.provider.ContactsContract;
+
+import androidx.test.InstrumentationRegistry;
+import androidx.test.filters.SmallTest;
+import androidx.test.runner.AndroidJUnit4;
+
+import com.android.bluetooth.BluetoothMethodProxy;
+
+import org.junit.After;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.Mock;
+import org.mockito.MockitoAnnotations;
+import org.mockito.Spy;
+
+@SmallTest
+@RunWith(AndroidJUnit4.class)
+public class BluetoothPbapCallLogComposerTest {
+
+    private static final Uri CALL_LOG_URI = CallLog.Calls.CONTENT_URI;
+
+    // Note: These variables are used intentionally put as null,
+    //       since the values are not at all used inside BluetoothPbapCallLogComposer.init().
+    private static final String SELECTION = null;
+    private static final String[] SELECTION_ARGS = null;
+    private static final String SORT_ORDER = null;
+
+    private BluetoothPbapCallLogComposer mComposer;
+
+    @Spy
+    BluetoothMethodProxy mPbapCallProxy = BluetoothMethodProxy.getInstance();
+
+    @Mock
+    Cursor mMockCursor;
+
+    @Before
+    public void setUp() throws Exception {
+        MockitoAnnotations.initMocks(this);
+        BluetoothMethodProxy.setInstanceForTesting(mPbapCallProxy);
+
+        doReturn(mMockCursor).when(mPbapCallProxy)
+                .contentResolverQuery(any(), any(), any(), any(), any(), any());
+        final int validRowCount = 5;
+        when(mMockCursor.getCount()).thenReturn(validRowCount);
+        when(mMockCursor.moveToFirst()).thenReturn(true);
+
+        mComposer = new BluetoothPbapCallLogComposer(InstrumentationRegistry.getTargetContext());
+    }
+
+    @After
+    public void tearDown() throws Exception {
+        BluetoothMethodProxy.setInstanceForTesting(null);
+    }
+
+    @Test
+    public void testInit_success() {
+        assertThat(mComposer.init(CALL_LOG_URI, SELECTION, SELECTION_ARGS, SORT_ORDER))
+                .isTrue();
+        assertThat(mComposer.getErrorReason()).isEqualTo(NO_ERROR);
+    }
+
+    @Test
+    public void testInit_failWhenUriIsNotSupported() {
+        final Uri uriOtherThanCallLog = Uri.parse("content://not/a/call/log/uri");
+        assertThat(uriOtherThanCallLog).isNotEqualTo(CALL_LOG_URI);
+
+        assertThat(mComposer.init(uriOtherThanCallLog, SELECTION, SELECTION_ARGS, SORT_ORDER))
+                .isFalse();
+        assertThat(mComposer.getErrorReason()).isEqualTo(FAILURE_REASON_UNSUPPORTED_URI);
+    }
+
+    @Test
+    public void testInit_failWhenCursorIsNull() {
+        doReturn(null).when(mPbapCallProxy)
+                .contentResolverQuery(any(), any(), any(), any(), any(), any());
+
+        assertThat(mComposer.init(CALL_LOG_URI, SELECTION, SELECTION_ARGS, SORT_ORDER))
+                .isFalse();
+        assertThat(mComposer.getErrorReason())
+                .isEqualTo(FAILURE_REASON_FAILED_TO_GET_DATABASE_INFO);
+    }
+
+    @Test
+    public void testInit_failWhenCursorRowCountIsZero() {
+        when(mMockCursor.getCount()).thenReturn(0);
+
+        assertThat(mComposer.init(CALL_LOG_URI, SELECTION, SELECTION_ARGS, SORT_ORDER))
+                .isFalse();
+        assertThat(mComposer.getErrorReason()).isEqualTo(FAILURE_REASON_NO_ENTRY);
+        verify(mMockCursor).close();
+    }
+
+    @Test
+    public void testInit_failWhenCursorMoveToFirstFails() {
+        when(mMockCursor.moveToFirst()).thenReturn(false);
+
+        assertThat(mComposer.init(CALL_LOG_URI, SELECTION, SELECTION_ARGS, SORT_ORDER))
+                .isFalse();
+        assertThat(mComposer.getErrorReason()).isEqualTo(FAILURE_REASON_NO_ENTRY);
+        verify(mMockCursor).close();
+    }
+
+    @Test
+    public void testCreateOneEntry_success() {
+        mComposer.init(CALL_LOG_URI, SELECTION, SELECTION_ARGS, SORT_ORDER);
+
+        assertThat(mComposer.createOneEntry(true)).isNotEmpty();
+        assertThat(mComposer.getErrorReason()).isEqualTo(NO_ERROR);
+        verify(mMockCursor).moveToNext();
+    }
+
+    @Test
+    public void testCreateOneEntry_failWhenNotInitialized() {
+        assertThat(mComposer.createOneEntry(true)).isNull();
+        assertThat(mComposer.getErrorReason()).isEqualTo(FAILURE_REASON_NOT_INITIALIZED);
+    }
+
+    @Test
+    public void testComposeVCardForPhoneOwnNumber() {
+        final int testPhoneType = ContactsContract.CommonDataKinds.Phone.TYPE_MOBILE;
+        final String testPhoneName = "test_phone_name";
+        final String testPhoneNumber = "0123456789";
+
+        assertThat(BluetoothPbapCallLogComposer.composeVCardForPhoneOwnNumber(
+                testPhoneType, testPhoneName, testPhoneNumber, /*vcardVer21=*/ true))
+                .contains(testPhoneNumber);
+    }
+
+    @Test
+    public void testTerminate() {
+        mComposer.init(CALL_LOG_URI, SELECTION, SELECTION_ARGS, SORT_ORDER);
+
+        mComposer.terminate();
+        verify(mMockCursor).close();
+    }
+
+    @Test
+    public void testFinalize() {
+        mComposer.init(CALL_LOG_URI, SELECTION, SELECTION_ARGS, SORT_ORDER);
+
+        mComposer.finalize();
+        verify(mMockCursor).close();
+    }
+
+    @Test
+    public void testGetCount_success() {
+        mComposer.init(CALL_LOG_URI, SELECTION, SELECTION_ARGS, SORT_ORDER);
+        final int cursorRowCount = 15;
+        when(mMockCursor.getCount()).thenReturn(cursorRowCount);
+
+        assertThat(mComposer.getCount()).isEqualTo(cursorRowCount);
+    }
+
+    @Test
+    public void testGetCount_returnsZeroWhenNotInitialized() {
+        assertThat(mComposer.getCount()).isEqualTo(0);
+    }
+
+    @Test
+    public void testIsAfterLast_success() {
+        mComposer.init(CALL_LOG_URI, SELECTION, SELECTION_ARGS, SORT_ORDER);
+        final boolean cursorIsAfterLast = true;
+        when(mMockCursor.isAfterLast()).thenReturn(cursorIsAfterLast);
+
+        assertThat(mComposer.isAfterLast()).isEqualTo(cursorIsAfterLast);
+    }
+
+    @Test
+    public void testIsAfterLast_returnsFalseWhenNotInitialized() {
+        assertThat(mComposer.isAfterLast()).isEqualTo(false);
+    }
+}
diff --git a/android/app/tests/unit/src/com/android/bluetooth/pbap/BluetoothPbapConfigTest.java b/android/app/tests/unit/src/com/android/bluetooth/pbap/BluetoothPbapConfigTest.java
new file mode 100644
index 0000000..097f46d
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/pbap/BluetoothPbapConfigTest.java
@@ -0,0 +1,106 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.pbap;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import static org.mockito.Mockito.when;
+
+import android.content.Context;
+import android.content.res.Resources;
+
+import androidx.test.filters.SmallTest;
+import androidx.test.runner.AndroidJUnit4;
+
+import com.android.bluetooth.R;
+
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.Mock;
+import org.mockito.MockitoAnnotations;
+
+@SmallTest
+@RunWith(AndroidJUnit4.class)
+public class BluetoothPbapConfigTest {
+
+    @Mock
+    Context mContext;
+
+    @Mock
+    Resources mResources;
+
+    @Before
+    public void setUp() throws Exception {
+        MockitoAnnotations.initMocks(this);
+        when(mContext.getResources()).thenReturn(mResources);
+    }
+
+    @Test
+    public void testInit_whenUseProfileForOwnerVcardIsTrue() {
+        when(mResources.getBoolean(R.bool.pbap_use_profile_for_owner_vcard))
+                .thenReturn(true);
+
+        BluetoothPbapConfig.init(mContext);
+        assertThat(BluetoothPbapConfig.useProfileForOwnerVcard()).isTrue();
+    }
+
+    @Test
+    public void testInit_whenUseProfileForOwnerVcardIsFalse() {
+        when(mResources.getBoolean(R.bool.pbap_use_profile_for_owner_vcard))
+                .thenReturn(false);
+
+        BluetoothPbapConfig.init(mContext);
+        assertThat(BluetoothPbapConfig.useProfileForOwnerVcard()).isFalse();
+    }
+
+    @Test
+    public void testInit_whenUseProfileForOwnerVcardThrowsException() {
+        when(mResources.getBoolean(R.bool.pbap_use_profile_for_owner_vcard))
+                .thenThrow(new RuntimeException());
+
+        BluetoothPbapConfig.init(mContext);
+        // Test should not crash
+    }
+
+    @Test
+    public void testInit_whenIncludePhotosInVcardIsTrue() {
+        when(mResources.getBoolean(R.bool.pbap_include_photos_in_vcard))
+                .thenReturn(true);
+
+        BluetoothPbapConfig.init(mContext);
+        assertThat(BluetoothPbapConfig.includePhotosInVcard()).isTrue();
+    }
+
+    @Test
+    public void testInit_whenIncludePhotosInVcardIsFalse() {
+        when(mResources.getBoolean(R.bool.pbap_include_photos_in_vcard))
+                .thenReturn(false);
+
+        BluetoothPbapConfig.init(mContext);
+        assertThat(BluetoothPbapConfig.includePhotosInVcard()).isFalse();
+    }
+
+    @Test
+    public void testInit_whenIncludePhotosInVcardThrowsException() {
+        when(mResources.getBoolean(R.bool.pbap_include_photos_in_vcard))
+                .thenThrow(new RuntimeException());
+
+        BluetoothPbapConfig.init(mContext);
+        // Test should not crash
+    }
+}
\ No newline at end of file
diff --git a/android/app/tests/unit/src/com/android/bluetooth/pbap/BluetoothPbapObexServerTest.java b/android/app/tests/unit/src/com/android/bluetooth/pbap/BluetoothPbapObexServerTest.java
new file mode 100644
index 0000000..62834b4
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/pbap/BluetoothPbapObexServerTest.java
@@ -0,0 +1,856 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.pbap;
+
+import static com.android.obex.ApplicationParameter.TRIPLET_LENGTH.FORMAT_LENGTH;
+import static com.android.obex.ApplicationParameter.TRIPLET_LENGTH.LISTSTARTOFFSET_LENGTH;
+import static com.android.obex.ApplicationParameter.TRIPLET_LENGTH.ORDER_LENGTH;
+import static com.android.obex.ApplicationParameter.TRIPLET_LENGTH.PRIMARYVERSIONCOUNTER_LENGTH;
+import static com.android.obex.ApplicationParameter.TRIPLET_LENGTH.PROPERTY_SELECTOR_LENGTH;
+import static com.android.obex.ApplicationParameter.TRIPLET_LENGTH.SEARCH_ATTRIBUTE_LENGTH;
+import static com.android.obex.ApplicationParameter.TRIPLET_LENGTH.SECONDARYVERSIONCOUNTER_LENGTH;
+import static com.android.obex.ApplicationParameter.TRIPLET_LENGTH.SUPPORTEDFEATURE_LENGTH;
+import static com.android.obex.ApplicationParameter.TRIPLET_LENGTH.VCARDSELECTOROPERATOR_LENGTH;
+import static com.android.obex.ApplicationParameter.TRIPLET_LENGTH.VCARDSELECTOR_LENGTH;
+import static com.android.obex.ApplicationParameter.TRIPLET_TAGID.FORMAT_TAGID;
+import static com.android.obex.ApplicationParameter.TRIPLET_TAGID.LISTSTARTOFFSET_TAGID;
+import static com.android.obex.ApplicationParameter.TRIPLET_TAGID.MAXLISTCOUNT_TAGID;
+import static com.android.obex.ApplicationParameter.TRIPLET_TAGID.ORDER_TAGID;
+import static com.android.obex.ApplicationParameter.TRIPLET_TAGID.PRIMARYVERSIONCOUNTER_TAGID;
+import static com.android.obex.ApplicationParameter.TRIPLET_TAGID.PROPERTY_SELECTOR_TAGID;
+import static com.android.obex.ApplicationParameter.TRIPLET_TAGID.SEARCH_ATTRIBUTE_TAGID;
+import static com.android.obex.ApplicationParameter.TRIPLET_TAGID.SEARCH_VALUE_TAGID;
+import static com.android.obex.ApplicationParameter.TRIPLET_TAGID.SECONDARYVERSIONCOUNTER_TAGID;
+import static com.android.obex.ApplicationParameter.TRIPLET_TAGID.SUPPORTEDFEATURE_TAGID;
+import static com.android.obex.ApplicationParameter.TRIPLET_TAGID.VCARDSELECTOROPERATOR_TAGID;
+import static com.android.obex.ApplicationParameter.TRIPLET_TAGID.VCARDSELECTOR_TAGID;
+import static com.android.obex.ApplicationParameter.TRIPLET_VALUE.ORDER.ORDER_BY_ALPHANUMERIC;
+
+import static com.google.common.truth.Truth.assertThat;
+import static com.google.common.truth.Truth.assertWithMessage;
+
+import static org.mockito.Mockito.any;
+import static org.mockito.Mockito.doReturn;
+import static org.mockito.Mockito.doThrow;
+import static org.mockito.Mockito.eq;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import android.os.Handler;
+import android.os.UserManager;
+
+import androidx.test.InstrumentationRegistry;
+import androidx.test.filters.SmallTest;
+import androidx.test.runner.AndroidJUnit4;
+
+import com.android.bluetooth.BluetoothMethodProxy;
+import com.android.bluetooth.pbap.BluetoothPbapObexServer.AppParamValue;
+import com.android.obex.ApplicationParameter;
+import com.android.obex.HeaderSet;
+import com.android.obex.Operation;
+import com.android.obex.ResponseCodes;
+
+import org.junit.After;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.Mock;
+import org.mockito.MockitoAnnotations;
+import org.mockito.Spy;
+
+import java.io.IOException;
+import java.io.OutputStream;
+
+@SmallTest
+@RunWith(AndroidJUnit4.class)
+public class BluetoothPbapObexServerTest {
+
+    private static final String TAG = BluetoothPbapObexServerTest.class.getSimpleName();
+
+    @Mock Handler mMockHandler;
+    @Mock PbapStateMachine mMockStateMachine;
+
+    @Spy
+    BluetoothMethodProxy mPbapMethodProxy = BluetoothMethodProxy.getInstance();
+
+    BluetoothPbapObexServer mServer;
+
+    private static final byte[] WRONG_UUID = new byte[] {
+            0x00, 0x00, 0x00, 0x00, 0x00,
+            0x00, 0x00, 0x00, 0x00, 0x00,
+            0x00, 0x00, 0x00, 0x00, 0x00,
+            0x00,
+    };
+
+    private static final byte[] WRONG_LENGTH_UUID = new byte[] {
+            0x79,
+            0x61,
+            0x35,
+    };
+
+    private static final String ILLEGAL_PATH = "some/random/path";
+
+    @Before
+    public void setUp() throws Exception {
+        MockitoAnnotations.initMocks(this);
+        BluetoothMethodProxy.setInstanceForTesting(mPbapMethodProxy);
+        mServer = new BluetoothPbapObexServer(
+                mMockHandler, InstrumentationRegistry.getTargetContext(), mMockStateMachine);
+    }
+
+    @After
+    public void tearDown() throws Exception {
+        BluetoothMethodProxy.setInstanceForTesting(null);
+    }
+
+    @Test
+    public void testOnConnect_whenIoExceptionIsThrownFromGettingTargetHeader()
+            throws Exception {
+        HeaderSet request = new HeaderSet();
+        HeaderSet reply = new HeaderSet();
+
+        doThrow(IOException.class).when(mPbapMethodProxy).getHeader(request, HeaderSet.TARGET);
+
+        assertThat(mServer.onConnect(request, reply))
+                .isEqualTo(ResponseCodes.OBEX_HTTP_INTERNAL_ERROR);
+    }
+
+    @Test
+    public void testOnConnect_whenUuidIsNull() {
+        // Create an empty header set.
+        HeaderSet request = new HeaderSet();
+        HeaderSet reply = new HeaderSet();
+
+        assertThat(mServer.onConnect(request, reply))
+                .isEqualTo(ResponseCodes.OBEX_HTTP_NOT_ACCEPTABLE);
+    }
+
+    @Test
+    public void testOnConnect_whenUuidLengthIsWrong() {
+        HeaderSet request = new HeaderSet();
+        request.setHeader(HeaderSet.TARGET, WRONG_LENGTH_UUID);
+        HeaderSet reply = new HeaderSet();
+
+        assertThat(mServer.onConnect(request, reply))
+                .isEqualTo(ResponseCodes.OBEX_HTTP_NOT_ACCEPTABLE);
+    }
+
+    @Test
+    public void testOnConnect_whenUuidIsWrong() {
+        HeaderSet request = new HeaderSet();
+        request.setHeader(HeaderSet.TARGET, WRONG_UUID);
+        HeaderSet reply = new HeaderSet();
+
+        assertThat(mServer.onConnect(request, reply))
+                .isEqualTo(ResponseCodes.OBEX_HTTP_NOT_ACCEPTABLE);
+    }
+
+    @Test
+    public void testOnConnect_whenIoExceptionIsThrownFromGettingWhoHeader()
+            throws Exception {
+        HeaderSet request = new HeaderSet();
+        request.setHeader(HeaderSet.TARGET, BluetoothPbapObexServer.PBAP_TARGET);
+        HeaderSet reply = new HeaderSet();
+
+        doThrow(IOException.class).when(mPbapMethodProxy).getHeader(request, HeaderSet.WHO);
+
+        assertThat(mServer.onConnect(request, reply))
+                .isEqualTo(ResponseCodes.OBEX_HTTP_INTERNAL_ERROR);
+    }
+
+    @Test
+    public void testOnConnect_whenIoExceptionIsThrownFromGettingApplicationParameterHeader()
+            throws Exception {
+        HeaderSet request = new HeaderSet();
+        request.setHeader(HeaderSet.TARGET, BluetoothPbapObexServer.PBAP_TARGET);
+        HeaderSet reply = new HeaderSet();
+
+        doThrow(IOException.class).when(mPbapMethodProxy)
+                .getHeader(request, HeaderSet.APPLICATION_PARAMETER);
+
+        assertThat(mServer.onConnect(request, reply))
+                .isEqualTo(ResponseCodes.OBEX_HTTP_INTERNAL_ERROR);
+    }
+
+    @Test
+    public void testOnConnect_whenApplicationParameterIsWrong() {
+        HeaderSet request = new HeaderSet();
+        request.setHeader(HeaderSet.TARGET, BluetoothPbapObexServer.PBAP_TARGET);
+        HeaderSet reply = new HeaderSet();
+
+        byte[] badApplicationParameter = new byte[] {0x00, 0x01, 0x02};
+        request.setHeader(HeaderSet.APPLICATION_PARAMETER, badApplicationParameter);
+
+        assertThat(mServer.onConnect(request, reply))
+                .isEqualTo(ResponseCodes.OBEX_HTTP_BAD_REQUEST);
+    }
+
+    @Test
+    public void testOnConnect_success() {
+        HeaderSet request = new HeaderSet();
+        request.setHeader(HeaderSet.TARGET, BluetoothPbapObexServer.PBAP_TARGET);
+        HeaderSet reply = new HeaderSet();
+
+        assertThat(mServer.onConnect(request, reply)).isEqualTo(ResponseCodes.OBEX_HTTP_OK);
+    }
+
+    @Test
+    public void testOnDisconnect() throws Exception {
+        HeaderSet request = new HeaderSet();
+        HeaderSet response = new HeaderSet();
+
+        mServer.onDisconnect(request, response);
+
+        assertThat(response.getResponseCode()).isEqualTo(ResponseCodes.OBEX_HTTP_OK);
+    }
+
+    @Test
+    public void testOnAbort() throws Exception {
+        HeaderSet request = new HeaderSet();
+        HeaderSet reply = new HeaderSet();
+
+        assertThat(mServer.onAbort(request, reply)).isEqualTo(ResponseCodes.OBEX_HTTP_OK);
+        assertThat(mServer.sIsAborted).isTrue();
+    }
+
+    @Test
+    public void testOnPut_notSupported() {
+        Operation operation = mock(Operation.class);
+        assertThat(mServer.onPut(operation)).isEqualTo(ResponseCodes.OBEX_HTTP_BAD_REQUEST);
+    }
+
+    @Test
+    public void testOnDelete_notSupported() {
+        HeaderSet request = new HeaderSet();
+        HeaderSet reply = new HeaderSet();
+
+        assertThat(mServer.onDelete(request, reply)).isEqualTo(ResponseCodes.OBEX_HTTP_BAD_REQUEST);
+    }
+
+    @Test
+    public void testOnClose() {
+        mServer.onClose();
+        verify(mMockStateMachine).sendMessage(PbapStateMachine.DISCONNECT);
+    }
+
+    @Test
+    public void testCloseStream_success() throws Exception{
+        OutputStream outputStream = mock(OutputStream.class);
+        Operation operation = mock(Operation.class);
+
+        assertThat(BluetoothPbapObexServer.closeStream(outputStream, operation)).isTrue();
+        verify(outputStream).close();
+        verify(operation).close();
+    }
+
+    @Test
+    public void testCloseStream_failOnClosingOutputStream() throws Exception {
+        OutputStream outputStream = mock(OutputStream.class);
+        doThrow(IOException.class).when(outputStream).close();
+        Operation operation = mock(Operation.class);
+
+        assertThat(BluetoothPbapObexServer.closeStream(outputStream, operation)).isFalse();
+    }
+
+    @Test
+    public void testCloseStream_failOnClosingOperation() throws Exception {
+        OutputStream outputStream = mock(OutputStream.class);
+        Operation operation = mock(Operation.class);
+        doThrow(IOException.class).when(operation).close();
+
+        assertThat(BluetoothPbapObexServer.closeStream(outputStream, operation)).isFalse();
+    }
+
+    @Test
+    public void testOnAuthenticationFailure() {
+        byte[] userName = {0x57, 0x68, 0x79};
+        try {
+            mServer.onAuthenticationFailure(userName);
+        } catch (Exception ex) {
+            assertWithMessage("Exception should not happen.").fail();
+        }
+    }
+
+    @Test
+    public void testLogHeader() throws Exception{
+        HeaderSet headerSet = new HeaderSet();
+        try {
+            BluetoothPbapObexServer.logHeader(headerSet);
+        } catch (Exception ex) {
+            assertWithMessage("Exception should not happen.").fail();
+        }
+    }
+
+    @Test
+    public void testOnSetPath_whenIoExceptionIsThrownFromGettingNameHeader()
+            throws Exception {
+        HeaderSet request = new HeaderSet();
+        HeaderSet reply = new HeaderSet();
+        boolean backup = true;
+        boolean create = true;
+
+        doThrow(IOException.class).when(mPbapMethodProxy)
+                .getHeader(request, HeaderSet.NAME);
+
+        assertThat(mServer.onSetPath(request, reply, backup, create))
+                .isEqualTo(ResponseCodes.OBEX_HTTP_INTERNAL_ERROR);
+    }
+
+    @Test
+    public void testOnSetPath_whenPathCreateIsForbidden() throws Exception {
+        HeaderSet request = new HeaderSet();
+        request.setHeader(HeaderSet.NAME, ILLEGAL_PATH);
+        HeaderSet reply = new HeaderSet();
+        boolean backup = false;
+        boolean create = true;
+
+        assertThat(mServer.onSetPath(request, reply, backup, create))
+                .isEqualTo(ResponseCodes.OBEX_HTTP_FORBIDDEN);
+    }
+
+    @Test
+    public void testOnSetPath_whenPathIsIllegal() throws Exception {
+        HeaderSet request = new HeaderSet();
+        request.setHeader(HeaderSet.NAME, ILLEGAL_PATH);
+        HeaderSet reply = new HeaderSet();
+        boolean backup = false;
+        boolean create = false;
+
+        assertThat(mServer.onSetPath(request, reply, backup, create))
+                .isEqualTo(ResponseCodes.OBEX_HTTP_NOT_FOUND);
+    }
+
+    @Test
+    public void testOnSetPath_success() throws Exception {
+        HeaderSet request = new HeaderSet();
+        request.setHeader(HeaderSet.NAME, BluetoothPbapObexServer.TELECOM_PATH);
+        HeaderSet reply = new HeaderSet();
+        boolean backup = false;
+        boolean create = true;
+
+        assertThat(mServer.onSetPath(request, reply, backup, create))
+                .isEqualTo(ResponseCodes.OBEX_HTTP_OK);
+
+        backup = true;
+        assertThat(mServer.onSetPath(request, reply, backup, create))
+                .isEqualTo(ResponseCodes.OBEX_HTTP_OK);
+    }
+
+    @Test
+    public void testOnGet_whenIoExceptionIsThrownFromGettingApplicationParameterHeader()
+            throws Exception {
+        Operation operation = mock(Operation.class);
+        HeaderSet headerSet = new HeaderSet();
+        when(operation.getReceivedHeader()).thenReturn(headerSet);
+
+        doThrow(IOException.class).when(mPbapMethodProxy)
+                .getHeader(headerSet, HeaderSet.APPLICATION_PARAMETER);
+
+        assertThat(mServer.onGet(operation)).isEqualTo(ResponseCodes.OBEX_HTTP_INTERNAL_ERROR);
+    }
+
+    @Test
+    public void testOnGet_whenTypeIsNull() throws Exception {
+        Operation operation = mock(Operation.class);
+        HeaderSet headerSet = new HeaderSet();
+        when(operation.getReceivedHeader()).thenReturn(headerSet);
+
+        headerSet.setHeader(HeaderSet.TYPE, null);
+
+        assertThat(mServer.onGet(operation)).isEqualTo(ResponseCodes.OBEX_HTTP_NOT_ACCEPTABLE);
+    }
+
+    @Test
+    public void testOnGet_whenUserIsNotUnlocked() throws Exception {
+        Operation operation = mock(Operation.class);
+        HeaderSet headerSet = new HeaderSet();
+        headerSet.setHeader(HeaderSet.TYPE, BluetoothPbapObexServer.TYPE_VCARD);
+        when(operation.getReceivedHeader()).thenReturn(headerSet);
+        UserManager userManager = mock(UserManager.class);
+        doReturn(userManager).when(mPbapMethodProxy).getSystemService(any(), eq(UserManager.class));
+
+        when(userManager.isUserUnlocked()).thenReturn(false);
+
+        assertThat(mServer.onGet(operation)).isEqualTo(ResponseCodes.OBEX_HTTP_UNAVAILABLE);
+    }
+
+    @Test
+    public void testOnGet_whenNameIsNotSet_andCurrentPathIsTelecom_andTypeIsListing()
+            throws Exception {
+        Operation operation = mock(Operation.class);
+        HeaderSet request = new HeaderSet();
+        when(operation.getReceivedHeader()).thenReturn(request);
+        UserManager userManager = mock(UserManager.class);
+        doReturn(userManager).when(mPbapMethodProxy).getSystemService(any(), eq(UserManager.class));
+        when(userManager.isUserUnlocked()).thenReturn(true);
+
+        mServer.setCurrentPath(BluetoothPbapObexServer.TELECOM_PATH);
+        request.setHeader(HeaderSet.TYPE, BluetoothPbapObexServer.TYPE_LISTING);
+
+        assertThat(mServer.onGet(operation)).isEqualTo(ResponseCodes.OBEX_HTTP_NOT_FOUND);
+    }
+
+    @Test
+    public void testOnGet_whenNameIsNotSet_andCurrentPathIsInvalid() throws Exception {
+        Operation operation = mock(Operation.class);
+        HeaderSet request = new HeaderSet();
+        request.setHeader(HeaderSet.TYPE, BluetoothPbapObexServer.TYPE_LISTING);
+        when(operation.getReceivedHeader()).thenReturn(request);
+        UserManager userManager = mock(UserManager.class);
+        doReturn(userManager).when(mPbapMethodProxy).getSystemService(any(), eq(UserManager.class));
+        when(userManager.isUserUnlocked()).thenReturn(true);
+
+        mServer.setCurrentPath(ILLEGAL_PATH);
+
+        assertThat(mServer.onGet(operation)).isEqualTo(ResponseCodes.OBEX_HTTP_NOT_ACCEPTABLE);
+    }
+
+    @Test
+    public void testOnGet_whenAppParamIsInvalid() throws Exception {
+        Operation operation = mock(Operation.class);
+        HeaderSet request = new HeaderSet();
+        request.setHeader(HeaderSet.TYPE, BluetoothPbapObexServer.TYPE_LISTING);
+        when(operation.getReceivedHeader()).thenReturn(request);
+        UserManager userManager = mock(UserManager.class);
+        doReturn(userManager).when(mPbapMethodProxy).getSystemService(any(), eq(UserManager.class));
+        when(userManager.isUserUnlocked()).thenReturn(true);
+
+        mServer.setCurrentPath(BluetoothPbapObexServer.PB_PATH);
+        byte[] badApplicationParameter = new byte[] {0x00, 0x01, 0x02};
+        request.setHeader(HeaderSet.APPLICATION_PARAMETER, badApplicationParameter);
+
+        assertThat(mServer.onGet(operation)).isEqualTo(ResponseCodes.OBEX_HTTP_BAD_REQUEST);
+    }
+
+    @Test
+    public void testOnGet_whenTypeIsInvalid() throws Exception {
+        Operation operation = mock(Operation.class);
+        HeaderSet request = new HeaderSet();
+        when(operation.getReceivedHeader()).thenReturn(request);
+        UserManager userManager = mock(UserManager.class);
+        doReturn(userManager).when(mPbapMethodProxy).getSystemService(any(), eq(UserManager.class));
+        when(userManager.isUserUnlocked()).thenReturn(true);
+
+        mServer.setCurrentPath(BluetoothPbapObexServer.PB_PATH);
+        request.setHeader(HeaderSet.TYPE, "someType");
+
+        assertThat(mServer.onGet(operation)).isEqualTo(ResponseCodes.OBEX_HTTP_NOT_ACCEPTABLE);
+    }
+
+    @Test
+    public void testOnGet_whenNameIsNotSet_andTypeIsListing_success() throws Exception {
+        Operation operation = mock(Operation.class);
+        OutputStream outputStream = mock(OutputStream.class);
+        when(operation.openOutputStream()).thenReturn(outputStream);
+        HeaderSet request = new HeaderSet();
+        when(operation.getReceivedHeader()).thenReturn(request);
+        UserManager userManager = mock(UserManager.class);
+        doReturn(userManager).when(mPbapMethodProxy).getSystemService(any(), eq(UserManager.class));
+        when(userManager.isUserUnlocked()).thenReturn(true);
+        mServer.setConnAppParamValue(new AppParamValue());
+        request.setHeader(HeaderSet.TYPE, BluetoothPbapObexServer.TYPE_LISTING);
+
+        mServer.setCurrentPath(BluetoothPbapObexServer.ICH_PATH);
+        assertThat(mServer.onGet(operation)).isEqualTo(ResponseCodes.OBEX_HTTP_OK);
+
+        mServer.setCurrentPath(BluetoothPbapObexServer.OCH_PATH);
+        assertThat(mServer.onGet(operation)).isEqualTo(ResponseCodes.OBEX_HTTP_OK);
+
+        mServer.setCurrentPath(BluetoothPbapObexServer.MCH_PATH);
+        assertThat(mServer.onGet(operation)).isEqualTo(ResponseCodes.OBEX_HTTP_OK);
+
+        mServer.setCurrentPath(BluetoothPbapObexServer.CCH_PATH);
+        assertThat(mServer.onGet(operation)).isEqualTo(ResponseCodes.OBEX_HTTP_OK);
+
+        mServer.setCurrentPath(BluetoothPbapObexServer.PB_PATH);
+        assertThat(mServer.onGet(operation)).isEqualTo(ResponseCodes.OBEX_HTTP_OK);
+
+        mServer.setCurrentPath(BluetoothPbapObexServer.FAV_PATH);
+        assertThat(mServer.onGet(operation)).isEqualTo(ResponseCodes.OBEX_HTTP_OK);
+    }
+
+    @Test
+    public void testOnGet_whenNameIsNotSet_andTypeIsPb_success() throws Exception {
+        Operation operation = mock(Operation.class);
+        OutputStream outputStream = mock(OutputStream.class);
+        when(operation.openOutputStream()).thenReturn(outputStream);
+        HeaderSet request = new HeaderSet();
+        when(operation.getReceivedHeader()).thenReturn(request);
+        UserManager userManager = mock(UserManager.class);
+        doReturn(userManager).when(mPbapMethodProxy).getSystemService(any(), eq(UserManager.class));
+        when(userManager.isUserUnlocked()).thenReturn(true);
+        mServer.setConnAppParamValue(new AppParamValue());
+        request.setHeader(HeaderSet.TYPE, BluetoothPbapObexServer.TYPE_PB);
+
+        mServer.setCurrentPath(BluetoothPbapObexServer.TELECOM_PATH);
+        assertThat(mServer.onGet(operation)).isEqualTo(ResponseCodes.OBEX_HTTP_OK);
+
+        mServer.setCurrentPath(BluetoothPbapObexServer.ICH_PATH);
+        assertThat(mServer.onGet(operation)).isEqualTo(ResponseCodes.OBEX_HTTP_OK);
+
+        mServer.setCurrentPath(BluetoothPbapObexServer.OCH_PATH);
+        assertThat(mServer.onGet(operation)).isEqualTo(ResponseCodes.OBEX_HTTP_OK);
+
+        mServer.setCurrentPath(BluetoothPbapObexServer.MCH_PATH);
+        assertThat(mServer.onGet(operation)).isEqualTo(ResponseCodes.OBEX_HTTP_OK);
+
+        mServer.setCurrentPath(BluetoothPbapObexServer.CCH_PATH);
+        assertThat(mServer.onGet(operation)).isEqualTo(ResponseCodes.OBEX_HTTP_OK);
+
+        mServer.setCurrentPath(BluetoothPbapObexServer.PB_PATH);
+        assertThat(mServer.onGet(operation)).isEqualTo(ResponseCodes.OBEX_HTTP_OK);
+
+        mServer.setCurrentPath(BluetoothPbapObexServer.FAV_PATH);
+        assertThat(mServer.onGet(operation)).isEqualTo(ResponseCodes.OBEX_HTTP_OK);
+    }
+
+    @Test
+    public void testOnGet_whenSimPhoneBook() throws Exception {
+        Operation operation = mock(Operation.class);
+        HeaderSet request = new HeaderSet();
+        when(operation.getReceivedHeader()).thenReturn(request);
+        UserManager userManager = mock(UserManager.class);
+        doReturn(userManager).when(mPbapMethodProxy).getSystemService(any(), eq(UserManager.class));
+        when(userManager.isUserUnlocked()).thenReturn(true);
+
+        request.setHeader(HeaderSet.NAME, BluetoothPbapObexServer.PB);
+        request.setHeader(HeaderSet.TYPE, BluetoothPbapObexServer.TYPE_LISTING);
+        mServer.setCurrentPath(BluetoothPbapSimVcardManager.SIM_PATH);
+
+        assertThat(mServer.onGet(operation)).isEqualTo(ResponseCodes.OBEX_HTTP_NOT_ACCEPTABLE);
+    }
+
+    @Test
+    public void testOnGet_whenNameDoesNotMatch() throws Exception {
+        Operation operation = mock(Operation.class);
+        HeaderSet request = new HeaderSet();
+        request.setHeader(HeaderSet.TYPE, BluetoothPbapObexServer.TYPE_LISTING);
+        when(operation.getReceivedHeader()).thenReturn(request);
+        UserManager userManager = mock(UserManager.class);
+        doReturn(userManager).when(mPbapMethodProxy).getSystemService(any(), eq(UserManager.class));
+        when(userManager.isUserUnlocked()).thenReturn(true);
+
+        request.setHeader(HeaderSet.NAME, "someName");
+
+        assertThat(mServer.onGet(operation)).isEqualTo(ResponseCodes.OBEX_HTTP_NOT_FOUND);
+    }
+
+    @Test
+    public void testOnGet_whenNameIsSet_andTypeIsListing_success() throws Exception {
+        Operation operation = mock(Operation.class);
+        OutputStream outputStream = mock(OutputStream.class);
+        when(operation.openOutputStream()).thenReturn(outputStream);
+        HeaderSet request = new HeaderSet();
+        when(operation.getReceivedHeader()).thenReturn(request);
+        UserManager userManager = mock(UserManager.class);
+        doReturn(userManager).when(mPbapMethodProxy).getSystemService(any(), eq(UserManager.class));
+        when(userManager.isUserUnlocked()).thenReturn(true);
+        mServer.setConnAppParamValue(new AppParamValue());
+        request.setHeader(HeaderSet.TYPE, BluetoothPbapObexServer.TYPE_LISTING);
+
+        request.setHeader(HeaderSet.NAME, BluetoothPbapObexServer.ICH);
+        assertThat(mServer.onGet(operation)).isEqualTo(ResponseCodes.OBEX_HTTP_OK);
+
+        request.setHeader(HeaderSet.NAME, BluetoothPbapObexServer.OCH);
+        assertThat(mServer.onGet(operation)).isEqualTo(ResponseCodes.OBEX_HTTP_OK);
+
+        request.setHeader(HeaderSet.NAME, BluetoothPbapObexServer.MCH);
+        assertThat(mServer.onGet(operation)).isEqualTo(ResponseCodes.OBEX_HTTP_OK);
+
+        request.setHeader(HeaderSet.NAME, BluetoothPbapObexServer.CCH);
+        assertThat(mServer.onGet(operation)).isEqualTo(ResponseCodes.OBEX_HTTP_OK);
+
+        request.setHeader(HeaderSet.NAME, BluetoothPbapObexServer.PB);
+        assertThat(mServer.onGet(operation)).isEqualTo(ResponseCodes.OBEX_HTTP_OK);
+
+        request.setHeader(HeaderSet.NAME, BluetoothPbapObexServer.FAV);
+        assertThat(mServer.onGet(operation)).isEqualTo(ResponseCodes.OBEX_HTTP_OK);
+    }
+
+    @Test
+    public void testOnGet_whenNameIsSet_andTypeIsPb_success() throws Exception {
+        Operation operation = mock(Operation.class);
+        OutputStream outputStream = mock(OutputStream.class);
+        when(operation.openOutputStream()).thenReturn(outputStream);
+        HeaderSet request = new HeaderSet();
+        when(operation.getReceivedHeader()).thenReturn(request);
+        UserManager userManager = mock(UserManager.class);
+        doReturn(userManager).when(mPbapMethodProxy).getSystemService(any(), eq(UserManager.class));
+        when(userManager.isUserUnlocked()).thenReturn(true);
+        mServer.setConnAppParamValue(new AppParamValue());
+        request.setHeader(HeaderSet.TYPE, BluetoothPbapObexServer.TYPE_PB);
+
+        request.setHeader(HeaderSet.NAME, BluetoothPbapObexServer.ICH);
+        assertThat(mServer.onGet(operation)).isEqualTo(ResponseCodes.OBEX_HTTP_OK);
+
+        request.setHeader(HeaderSet.NAME, BluetoothPbapObexServer.OCH);
+        assertThat(mServer.onGet(operation)).isEqualTo(ResponseCodes.OBEX_HTTP_OK);
+
+        request.setHeader(HeaderSet.NAME, BluetoothPbapObexServer.MCH);
+        assertThat(mServer.onGet(operation)).isEqualTo(ResponseCodes.OBEX_HTTP_OK);
+
+        request.setHeader(HeaderSet.NAME, BluetoothPbapObexServer.CCH);
+        assertThat(mServer.onGet(operation)).isEqualTo(ResponseCodes.OBEX_HTTP_OK);
+
+        request.setHeader(HeaderSet.NAME, BluetoothPbapObexServer.PB);
+        assertThat(mServer.onGet(operation)).isEqualTo(ResponseCodes.OBEX_HTTP_OK);
+
+        request.setHeader(HeaderSet.NAME, BluetoothPbapObexServer.FAV);
+        assertThat(mServer.onGet(operation)).isEqualTo(ResponseCodes.OBEX_HTTP_OK);
+    }
+
+    @Test
+    public void writeVCardEntry() {
+        int vcfIndex = 1;
+        String nameWithSpecialChars = "Name<>\"\'&";
+        StringBuilder stringBuilder = new StringBuilder();
+
+        BluetoothPbapObexServer.writeVCardEntry(vcfIndex, nameWithSpecialChars, stringBuilder);
+        String result = stringBuilder.toString();
+
+        String expectedResult = "<card handle=\"" + vcfIndex + ".vcf\" name=\"" +
+                "Name&lt;&gt;&quot;&#039;&amp;" + "\"/>";
+        assertThat(result).isEqualTo(expectedResult);
+    }
+
+    @Test
+    public void getDatabaseIdentifier() {
+        long databaseIdentifierLow = 1;
+        BluetoothPbapUtils.sDbIdentifier.set(databaseIdentifierLow);
+        byte[] expected = new byte[] {0, 0, 0, 0, 0, 0, 0, 0,
+                0, 0, 0, 0, 0, 0, 0, 1}; // Big-endian
+
+        assertThat(mServer.getDatabaseIdentifier()).isEqualTo(expected);
+    }
+
+    @Test
+    public void getPBPrimaryFolderVersion() {
+        long primaryVersion = 5;
+        BluetoothPbapUtils.sPrimaryVersionCounter = primaryVersion;
+        byte[] expected = new byte[] {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+                0, 0, 0, 5}; // Big-endian
+
+        assertThat(BluetoothPbapObexServer.getPBPrimaryFolderVersion()).isEqualTo(expected);
+    }
+
+    @Test
+    public void getPBSecondaryFolderVersion() {
+        long secondaryVersion = 5;
+        BluetoothPbapUtils.sSecondaryVersionCounter = secondaryVersion;
+        byte[] expected = new byte[] {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+                0, 0, 0, 5}; // Big-endian
+
+        assertThat(BluetoothPbapObexServer.getPBSecondaryFolderVersion()).isEqualTo(expected);
+    }
+
+    @Test
+    public void setDbCounters() {
+        ApplicationParameter param = new ApplicationParameter();
+
+        mServer.setDbCounters(param);
+
+        byte[] result = param.getHeader();
+        assertThat(result).isNotNull();
+        int expectedLength = 2 + ApplicationParameter.TRIPLET_LENGTH.DATABASEIDENTIFIER_LENGTH;
+        assertThat(result.length).isEqualTo(expectedLength);
+    }
+
+    @Test
+    public void setFolderVersionCounters() {
+        ApplicationParameter param = new ApplicationParameter();
+
+        BluetoothPbapObexServer.setFolderVersionCounters(param);
+
+        byte[] result = param.getHeader();
+        assertThat(result).isNotNull();
+        int expectedLength = 2 + ApplicationParameter.TRIPLET_LENGTH.PRIMARYVERSIONCOUNTER_LENGTH
+                + 2 + ApplicationParameter.TRIPLET_LENGTH.SECONDARYVERSIONCOUNTER_LENGTH;
+        assertThat(result.length).isEqualTo(expectedLength);
+    }
+
+    @Test
+    public void setCallversionCounters() {
+        ApplicationParameter param = new ApplicationParameter();
+        AppParamValue value = new AppParamValue();
+        value.callHistoryVersionCounter = new byte[]
+                {1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16};
+
+        BluetoothPbapObexServer.setCallversionCounters(param, value);
+
+        byte[] expectedResult = new byte[] {
+                PRIMARYVERSIONCOUNTER_TAGID, PRIMARYVERSIONCOUNTER_LENGTH,
+                1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16,
+                SECONDARYVERSIONCOUNTER_TAGID, SECONDARYVERSIONCOUNTER_LENGTH,
+                1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16
+        };
+        assertThat(param.getHeader()).isEqualTo(expectedResult);
+    }
+
+    @Test
+    public void pushHeader_returnsObexHttpOk() throws Exception {
+        Operation op = mock(Operation.class);
+        OutputStream os = mock(OutputStream.class);
+        when(op.openOutputStream()).thenReturn(os);
+        HeaderSet reply = new HeaderSet();
+
+        assertThat(BluetoothPbapObexServer.pushHeader(op, reply))
+                .isEqualTo(ResponseCodes.OBEX_HTTP_OK);
+    }
+
+    @Test
+    public void pushHeader_withExceptionWhenOpeningOutputStream_returnsObexHttpInternalError()
+            throws Exception {
+        HeaderSet reply = new HeaderSet();
+        Operation op = mock(Operation.class);
+        when(op.openOutputStream()).thenThrow(new IOException());
+
+        assertThat(BluetoothPbapObexServer.pushHeader(op, reply))
+                .isEqualTo(ResponseCodes.OBEX_HTTP_INTERNAL_ERROR);
+    }
+
+    @Test
+    public void pushHeader_withExceptionWhenClosingOutputStream_returnsObexHttpInternalError()
+            throws Exception {
+        HeaderSet reply = new HeaderSet();
+        Operation op = mock(Operation.class);
+        OutputStream os = mock(OutputStream.class);
+        when(op.openOutputStream()).thenReturn(os);
+        doThrow(new IOException()).when(os).close();
+
+        assertThat(BluetoothPbapObexServer.pushHeader(op, reply))
+                .isEqualTo(ResponseCodes.OBEX_HTTP_INTERNAL_ERROR);
+    }
+
+    @Test
+    public void parseApplicationParameter_withInvalidTripletTagid_returnsFalse() {
+        byte invalidTripletTagId = 0x00;
+        byte[] rawBytes = new byte[] {invalidTripletTagId};
+        AppParamValue appParamValue = new AppParamValue();
+
+        assertThat(mServer.parseApplicationParameter(rawBytes, appParamValue)).isFalse();
+    }
+
+    @Test
+    public void parseApplicationParameter_withPropertySelectorTagid() {
+        byte[] rawBytes = new byte[] {PROPERTY_SELECTOR_TAGID, PROPERTY_SELECTOR_LENGTH,
+                0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08}; // non-zero value uses filter
+        AppParamValue appParamValue = new AppParamValue();
+
+        assertThat(mServer.parseApplicationParameter(rawBytes, appParamValue)).isTrue();
+        assertThat(appParamValue.ignorefilter).isFalse();
+    }
+
+    @Test
+    public void parseApplicationParameter_withSupportedFeatureTagid() {
+        byte[] rawBytes = new byte[] {SUPPORTEDFEATURE_TAGID, SUPPORTEDFEATURE_LENGTH,
+                0x01, 0x02, 0x03, 0x04};
+        AppParamValue appParamValue = new AppParamValue();
+
+        assertThat(mServer.parseApplicationParameter(rawBytes, appParamValue)).isTrue();
+        byte[] expectedSupportedFeature = new byte[] {0x01, 0x02, 0x03, 0x04};
+        assertThat(appParamValue.supportedFeature).isEqualTo(expectedSupportedFeature);
+    }
+
+    @Test
+    public void parseApplicationParameter_withOrderTagid() {
+        byte[] rawBytes = new byte[] {ORDER_TAGID, ORDER_LENGTH,
+                ORDER_BY_ALPHANUMERIC};
+        AppParamValue appParamValue = new AppParamValue();
+
+        assertThat(mServer.parseApplicationParameter(rawBytes, appParamValue)).isTrue();
+        assertThat(appParamValue.order).isEqualTo("1");
+    }
+
+    @Test
+    public void parseApplicationParameter_withSearchValueTagid() {
+        int searchLength = 4;
+        byte[] rawBytes = new byte[] {SEARCH_VALUE_TAGID, (byte) searchLength,
+                'a', 'b', 'c', 'd' };
+        AppParamValue appParamValue = new AppParamValue();
+
+        assertThat(mServer.parseApplicationParameter(rawBytes, appParamValue)).isTrue();
+        assertThat(appParamValue.searchValue).isEqualTo("abcd");
+    }
+
+    @Test
+    public void parseApplicationParameter_withSearchAttributeTagid() {
+        byte[] rawBytes = new byte[] {SEARCH_ATTRIBUTE_TAGID, SEARCH_ATTRIBUTE_LENGTH,
+                0x05};
+        AppParamValue appParamValue = new AppParamValue();
+
+        assertThat(mServer.parseApplicationParameter(rawBytes, appParamValue)).isTrue();
+        assertThat(appParamValue.searchAttr).isEqualTo("5");
+    }
+
+    @Test
+    public void parseApplicationParameter_withMaxListCountTagid() {
+        byte[] rawBytes = new byte[] {MAXLISTCOUNT_TAGID, SEARCH_ATTRIBUTE_LENGTH,
+                0x01, 0x02};
+        AppParamValue appParamValue = new AppParamValue();
+
+        assertThat(mServer.parseApplicationParameter(rawBytes, appParamValue)).isTrue();
+        assertThat(appParamValue.maxListCount).isEqualTo(256 * 1 + 2);
+    }
+
+    @Test
+    public void parseApplicationParameter_withListStartOffsetTagid() {
+        byte[] rawBytes = new byte[] {LISTSTARTOFFSET_TAGID, LISTSTARTOFFSET_LENGTH,
+                0x01, 0x02};
+        AppParamValue appParamValue = new AppParamValue();
+
+        assertThat(mServer.parseApplicationParameter(rawBytes, appParamValue)).isTrue();
+        assertThat(appParamValue.listStartOffset).isEqualTo(256 * 1 + 2);
+    }
+
+    @Test
+    public void parseApplicationParameter_withFormatTagid() {
+        byte[] rawBytes = new byte[] {FORMAT_TAGID, FORMAT_LENGTH,
+                0x01};
+        AppParamValue appParamValue = new AppParamValue();
+
+        assertThat(mServer.parseApplicationParameter(rawBytes, appParamValue)).isTrue();
+        assertThat(appParamValue.vcard21).isFalse();
+    }
+
+    @Test
+    public void parseApplicationParameter_withVCardSelectorTagid() {
+        byte[] rawBytes = new byte[] {VCARDSELECTOR_TAGID, VCARDSELECTOR_LENGTH,
+                0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08};
+        AppParamValue appParamValue = new AppParamValue();
+
+        assertThat(mServer.parseApplicationParameter(rawBytes, appParamValue)).isTrue();
+        byte[] expectedVcardSelector = new byte[] {0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08};
+        assertThat(appParamValue.vCardSelector).isEqualTo(expectedVcardSelector);
+    }
+
+    @Test
+    public void parseApplicationParameter_withVCardSelectorOperatorTagid() {
+        byte[] rawBytes = new byte[] {VCARDSELECTOROPERATOR_TAGID, VCARDSELECTOROPERATOR_LENGTH,
+                0x01};
+        AppParamValue appParamValue = new AppParamValue();
+
+        assertThat(mServer.parseApplicationParameter(rawBytes, appParamValue)).isTrue();
+        assertThat(appParamValue.vCardSelectorOperator).isEqualTo("1");
+    }
+
+    @Test
+    public void appParamValueDump_doesNotCrash() {
+        AppParamValue appParamValue = new AppParamValue();
+        appParamValue.dump();
+    }
+}
diff --git a/android/app/tests/unit/src/com/android/bluetooth/pbap/BluetoothPbapServiceBinderTest.java b/android/app/tests/unit/src/com/android/bluetooth/pbap/BluetoothPbapServiceBinderTest.java
new file mode 100644
index 0000000..4bd3a10
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/pbap/BluetoothPbapServiceBinderTest.java
@@ -0,0 +1,94 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.pbap;
+
+import static org.mockito.Mockito.verify;
+
+import android.bluetooth.BluetoothAdapter;
+import android.bluetooth.BluetoothDevice;
+import android.bluetooth.BluetoothProfile;
+
+import androidx.test.filters.MediumTest;
+import androidx.test.runner.AndroidJUnit4;
+
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.Mock;
+import org.mockito.MockitoAnnotations;
+
+@MediumTest
+@RunWith(AndroidJUnit4.class)
+public class BluetoothPbapServiceBinderTest {
+    private static final String REMOTE_DEVICE_ADDRESS = "00:00:00:00:00:00";
+
+    @Mock
+    private BluetoothPbapService mService;
+
+    BluetoothDevice mRemoteDevice;
+
+    BluetoothPbapService.PbapBinder mBinder;
+
+    @Before
+    public void setUp() throws Exception {
+        MockitoAnnotations.initMocks(this);
+        mRemoteDevice = BluetoothAdapter.getDefaultAdapter().getRemoteDevice(REMOTE_DEVICE_ADDRESS);
+        mBinder = new BluetoothPbapService.PbapBinder(mService);
+    }
+
+    @Test
+    public void disconnect_callsServiceMethod() {
+        mBinder.disconnect(mRemoteDevice, null);
+
+        verify(mService).disconnect(mRemoteDevice);
+    }
+
+    @Test
+    public void getConnectedDevices_callsServiceMethod() {
+        mBinder.getConnectedDevices(null);
+
+        verify(mService).getConnectedDevices();
+    }
+
+    @Test
+    public void getDevicesMatchingConnectionStates_callsServiceMethod() {
+        int[] states = new int[] {BluetoothProfile.STATE_CONNECTED};
+        mBinder.getDevicesMatchingConnectionStates(states, null);
+
+        verify(mService).getDevicesMatchingConnectionStates(states);
+    }
+
+    @Test
+    public void getConnectionState_callsServiceMethod() {
+        mBinder.getConnectionState(mRemoteDevice, null);
+
+        verify(mService).getConnectionState(mRemoteDevice);
+    }
+
+    @Test
+    public void setConnectionPolicy_callsServiceMethod() {
+        int connectionPolicy = BluetoothProfile.CONNECTION_POLICY_ALLOWED;
+        mBinder.setConnectionPolicy(mRemoteDevice, connectionPolicy, null);
+
+        verify(mService).setConnectionPolicy(mRemoteDevice, connectionPolicy);
+    }
+
+    @Test
+    public void cleanUp_doesNotCrash() {
+        mBinder.cleanup();
+    }
+}
diff --git a/android/app/tests/unit/src/com/android/bluetooth/pbap/BluetoothPbapServiceTest.java b/android/app/tests/unit/src/com/android/bluetooth/pbap/BluetoothPbapServiceTest.java
index 75fb5ed..44aedc1 100644
--- a/android/app/tests/unit/src/com/android/bluetooth/pbap/BluetoothPbapServiceTest.java
+++ b/android/app/tests/unit/src/com/android/bluetooth/pbap/BluetoothPbapServiceTest.java
@@ -15,38 +15,47 @@
  */
 package com.android.bluetooth.pbap;
 
+import static com.google.common.truth.Truth.assertThat;
+
+import static org.junit.Assert.assertThrows;
 import static org.mockito.Mockito.anyString;
 import static org.mockito.Mockito.doReturn;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
 
 import android.bluetooth.BluetoothAdapter;
-import android.content.Context;
+import android.bluetooth.BluetoothDevice;
+import android.bluetooth.BluetoothProfile;
+import android.content.Intent;
+import android.os.Message;
 
-import androidx.test.InstrumentationRegistry;
 import androidx.test.filters.MediumTest;
 import androidx.test.rule.ServiceTestRule;
 import androidx.test.runner.AndroidJUnit4;
 
-import com.android.bluetooth.R;
 import com.android.bluetooth.TestUtils;
 import com.android.bluetooth.btservice.AdapterService;
 import com.android.bluetooth.btservice.storage.DatabaseManager;
 
 import org.junit.After;
-import org.junit.Assert;
 import org.junit.Assume;
 import org.junit.Before;
 import org.junit.Rule;
 import org.junit.Test;
 import org.junit.runner.RunWith;
+import org.mockito.ArgumentCaptor;
 import org.mockito.Mock;
 import org.mockito.MockitoAnnotations;
 
 @MediumTest
 @RunWith(AndroidJUnit4.class)
 public class BluetoothPbapServiceTest {
+    private static final String REMOTE_DEVICE_ADDRESS = "00:00:00:00:00:00";
+
     private BluetoothPbapService mService;
     private BluetoothAdapter mAdapter = null;
-    private Context mTargetContext;
+    private BluetoothDevice mRemoteDevice;
 
     @Rule public final ServiceTestRule mServiceRule = new ServiceTestRule();
 
@@ -55,7 +64,6 @@
 
     @Before
     public void setUp() throws Exception {
-        mTargetContext = InstrumentationRegistry.getTargetContext();
         Assume.assumeTrue("Ignore test when BluetoothPbapService is not enabled",
                 BluetoothPbapService.isEnabled());
         MockitoAnnotations.initMocks(this);
@@ -64,10 +72,11 @@
         doReturn(true, false).when(mAdapterService).isStartedProfile(anyString());
         TestUtils.startService(mServiceRule, BluetoothPbapService.class);
         mService = BluetoothPbapService.getBluetoothPbapService();
-        Assert.assertNotNull(mService);
+        assertThat(mService).isNotNull();
         // Try getting the Bluetooth adapter
         mAdapter = BluetoothAdapter.getDefaultAdapter();
-        Assert.assertNotNull(mAdapter);
+        assertThat(mAdapter).isNotNull();
+        mRemoteDevice = mAdapter.getRemoteDevice(REMOTE_DEVICE_ADDRESS);
     }
 
     @After
@@ -77,12 +86,122 @@
         }
         TestUtils.stopService(mServiceRule, BluetoothPbapService.class);
         mService = BluetoothPbapService.getBluetoothPbapService();
-        Assert.assertNull(mService);
+        assertThat(mService).isNull();
         TestUtils.clearAdapterService(mAdapterService);
     }
 
     @Test
-    public void testInitialize() {
-        Assert.assertNotNull(BluetoothPbapService.getBluetoothPbapService());
+    public void initialize() {
+        assertThat(BluetoothPbapService.getBluetoothPbapService()).isNotNull();
+    }
+
+    @Test
+    public void disconnect() {
+        PbapStateMachine sm = mock(PbapStateMachine.class);
+        mService.mPbapStateMachineMap.put(mRemoteDevice, sm);
+
+        mService.disconnect(mRemoteDevice);
+
+        verify(sm).sendMessage(PbapStateMachine.DISCONNECT);
+    }
+
+    @Test
+    public void getConnectedDevices() {
+        PbapStateMachine sm = mock(PbapStateMachine.class);
+        mService.mPbapStateMachineMap.put(mRemoteDevice, sm);
+
+        assertThat(mService.getConnectedDevices()).contains(mRemoteDevice);
+    }
+
+    @Test
+    public void getConnectionPolicy_withDeviceIsNull_throwsNPE() {
+        assertThrows(IllegalArgumentException.class, () -> mService.getConnectionPolicy(null));
+    }
+
+    @Test
+    public void getConnectionPolicy() {
+        mService.getConnectionPolicy(mRemoteDevice);
+
+        verify(mDatabaseManager).getProfileConnectionPolicy(mRemoteDevice, BluetoothProfile.PBAP);
+    }
+
+    @Test
+    public void getDevicesMatchingConnectionStates_whenStatesIsNull_returnsEmptyList() {
+        assertThat(mService.getDevicesMatchingConnectionStates(null)).isEmpty();
+    }
+
+    @Test
+    public void getDevicesMatchingConnectionStates() {
+        PbapStateMachine sm = mock(PbapStateMachine.class);
+        mService.mPbapStateMachineMap.put(mRemoteDevice, sm);
+        when(sm.getConnectionState()).thenReturn(BluetoothProfile.STATE_CONNECTED);
+
+        int[] states = new int[] {BluetoothProfile.STATE_CONNECTED};
+        assertThat(mService.getDevicesMatchingConnectionStates(states)).contains(mRemoteDevice);
+    }
+
+    @Test
+    public void onAcceptFailed() {
+        PbapStateMachine sm = mock(PbapStateMachine.class);
+        mService.mPbapStateMachineMap.put(mRemoteDevice, sm);
+
+        mService.onAcceptFailed();
+
+        assertThat(mService.mPbapStateMachineMap).isEmpty();
+    }
+
+    @Test
+    public void broadcastReceiver_onReceive_withActionConnectionAccessReply() {
+        Intent intent = new Intent(BluetoothDevice.ACTION_CONNECTION_ACCESS_REPLY);
+        intent.putExtra(BluetoothDevice.EXTRA_ACCESS_REQUEST_TYPE,
+                BluetoothDevice.REQUEST_TYPE_PHONEBOOK_ACCESS);
+        intent.putExtra(BluetoothDevice.EXTRA_CONNECTION_ACCESS_RESULT,
+                BluetoothDevice.CONNECTION_ACCESS_YES);
+        intent.putExtra(BluetoothDevice.EXTRA_ALWAYS_ALLOWED, true);
+        intent.putExtra(BluetoothDevice.EXTRA_DEVICE, mRemoteDevice);
+        PbapStateMachine sm = mock(PbapStateMachine.class);
+        mService.mPbapStateMachineMap.put(mRemoteDevice, sm);
+
+        mService.mPbapReceiver.onReceive(null, intent);
+
+        verify(sm).sendMessage(PbapStateMachine.AUTHORIZED);
+    }
+
+    @Test
+    public void broadcastReceiver_onReceive_withActionAuthResponse() {
+        Intent intent = new Intent(BluetoothPbapService.AUTH_RESPONSE_ACTION);
+        String sessionKey = "test_session_key";
+        intent.putExtra(BluetoothPbapService.EXTRA_SESSION_KEY, sessionKey);
+        intent.putExtra(BluetoothPbapService.EXTRA_DEVICE, mRemoteDevice);
+        PbapStateMachine sm = mock(PbapStateMachine.class);
+        mService.mPbapStateMachineMap.put(mRemoteDevice, sm);
+
+        mService.mPbapReceiver.onReceive(null, intent);
+
+        ArgumentCaptor<Message> captor = ArgumentCaptor.forClass(Message.class);
+        verify(sm).sendMessage(captor.capture());
+        Message msg = captor.getValue();
+        assertThat(msg.what).isEqualTo(PbapStateMachine.AUTH_KEY_INPUT);
+        assertThat(msg.obj).isEqualTo(sessionKey);
+        msg.recycle();
+    }
+
+    @Test
+    public void broadcastReceiver_onReceive_withActionAuthCancelled() {
+        Intent intent = new Intent(BluetoothPbapService.AUTH_CANCELLED_ACTION);
+        intent.putExtra(BluetoothPbapService.EXTRA_DEVICE, mRemoteDevice);
+        PbapStateMachine sm = mock(PbapStateMachine.class);
+        mService.mPbapStateMachineMap.put(mRemoteDevice, sm);
+
+        mService.mPbapReceiver.onReceive(null, intent);
+
+        verify(sm).sendMessage(PbapStateMachine.AUTH_CANCELLED);
+    }
+
+    @Test
+    public void broadcastReceiver_onReceive_withIllegalAction_doesNothing() {
+        Intent intent = new Intent("test_random_action");
+
+        mService.mPbapReceiver.onReceive(null, intent);
     }
 }
diff --git a/android/app/tests/unit/src/com/android/bluetooth/pbap/BluetoothPbapSimVcardManagerTest.java b/android/app/tests/unit/src/com/android/bluetooth/pbap/BluetoothPbapSimVcardManagerTest.java
new file mode 100644
index 0000000..46302cb
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/pbap/BluetoothPbapSimVcardManagerTest.java
@@ -0,0 +1,458 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.pbap;
+
+import static com.google.common.truth.Truth.assertThat;
+import static com.google.common.truth.Truth.assertWithMessage;
+
+import static org.mockito.ArgumentMatchers.anyInt;
+import static org.mockito.Mockito.any;
+import static org.mockito.Mockito.doReturn;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.times;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import android.content.Context;
+import android.database.Cursor;
+import android.net.Uri;
+
+import androidx.test.InstrumentationRegistry;
+import androidx.test.filters.SmallTest;
+import androidx.test.runner.AndroidJUnit4;
+
+import com.android.bluetooth.BluetoothMethodProxy;
+import com.android.obex.Operation;
+import com.android.obex.ResponseCodes;
+
+import org.junit.After;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.MockitoAnnotations;
+import org.mockito.Spy;
+import org.mockito.stubbing.Answer;
+
+import java.io.OutputStream;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.Collections;
+import java.util.List;
+import java.util.concurrent.atomic.AtomicInteger;
+
+@SmallTest
+@RunWith(AndroidJUnit4.class)
+public class BluetoothPbapSimVcardManagerTest {
+
+    private static final String TAG = BluetoothPbapSimVcardManagerTest.class.getSimpleName();
+
+    @Spy
+    BluetoothMethodProxy mPbapMethodProxy = BluetoothMethodProxy.getInstance();
+
+    Context mContext;
+    BluetoothPbapSimVcardManager mManager;
+
+    private static final Uri WRONG_URI = Uri.parse("content://some/wrong/uri");
+
+    @Before
+    public void setUp() {
+        MockitoAnnotations.initMocks(this);
+        BluetoothMethodProxy.setInstanceForTesting(mPbapMethodProxy);
+        mContext =  InstrumentationRegistry.getTargetContext();
+        mManager = new BluetoothPbapSimVcardManager(mContext);
+    }
+
+    @After
+    public void tearDown() {
+        BluetoothMethodProxy.setInstanceForTesting(null);
+    }
+
+    @Test
+    public void testInit_whenUriIsUnsupported() {
+        assertThat(mManager.init(WRONG_URI, null, null, null))
+                .isFalse();
+        assertThat(mManager.getErrorReason())
+                .isEqualTo(BluetoothPbapSimVcardManager.FAILURE_REASON_UNSUPPORTED_URI);
+    }
+
+    @Test
+    public void testInit_whenCursorIsNull() {
+        doReturn(null).when(mPbapMethodProxy)
+                .contentResolverQuery(any(), any(), any(), any(), any(), any());
+
+        assertThat(mManager.init(BluetoothPbapSimVcardManager.SIM_URI, null, null, null))
+                .isFalse();
+        assertThat(mManager.getErrorReason())
+                .isEqualTo(BluetoothPbapSimVcardManager.FAILURE_REASON_FAILED_TO_GET_DATABASE_INFO);
+    }
+
+    @Test
+    public void testInit_whenCursorHasNoEntry() {
+        Cursor cursor = mock(Cursor.class);
+        when(cursor.getCount()).thenReturn(0);
+        doReturn(cursor).when(mPbapMethodProxy)
+                .contentResolverQuery(any(), any(), any(), any(), any(), any());
+
+        assertThat(mManager.init(BluetoothPbapSimVcardManager.SIM_URI, null, null, null))
+                .isFalse();
+        verify(cursor).close();
+        assertThat(mManager.getErrorReason())
+                .isEqualTo(BluetoothPbapSimVcardManager.FAILURE_REASON_NO_ENTRY);
+    }
+
+    @Test
+    public void testInit_success() {
+        Cursor cursor = mock(Cursor.class);
+        when(cursor.getCount()).thenReturn(1);
+        when(cursor.moveToFirst()).thenReturn(true);
+        doReturn(cursor).when(mPbapMethodProxy)
+                .contentResolverQuery(any(), any(), any(), any(), any(), any());
+
+        assertThat(mManager.init(BluetoothPbapSimVcardManager.SIM_URI, null, null, null))
+                .isTrue();
+        assertThat(mManager.getErrorReason()).isEqualTo(BluetoothPbapSimVcardManager.NO_ERROR);
+    }
+
+    @Test
+    public void testCreateOneEntry_whenNotInitialized() {
+        assertThat(mManager.createOneEntry(true)).isNull();
+        assertThat(mManager.getErrorReason())
+                .isEqualTo(BluetoothPbapSimVcardManager.FAILURE_REASON_NOT_INITIALIZED);
+    }
+
+    @Test
+    public void testCreateOneEntry_success() {
+        Cursor cursor = initManager();
+
+        assertThat(mManager.createOneEntry(true)).isNotNull();
+        assertThat(mManager.createOneEntry(false)).isNotNull();
+        verify(cursor, times(2)).moveToNext();
+    }
+
+    @Test
+    public void testTerminate() {
+        Cursor cursor = initManager();
+        mManager.terminate();
+
+        verify(cursor).close();
+    }
+
+    @Test
+    public void testGetCount_beforeInit() {
+        assertThat(mManager.getCount()).isEqualTo(0);
+    }
+
+    @Test
+    public void testGetCount_success() {
+        final int count = 5;
+        Cursor cursor = initManager();
+        when(cursor.getCount()).thenReturn(count);
+
+        assertThat(mManager.getCount()).isEqualTo(count);
+    }
+
+    @Test
+    public void testIsAfterLast_beforeInit() {
+        assertThat(mManager.isAfterLast()).isFalse();
+    }
+
+    @Test
+    public void testIsAfterLast_success() {
+        final boolean isAfterLast = true;
+        Cursor cursor = initManager();
+        when(cursor.isAfterLast()).thenReturn(isAfterLast);
+
+        assertThat(mManager.isAfterLast()).isEqualTo(isAfterLast);
+    }
+
+    @Test
+    public void testMoveToPosition_beforeInit() {
+        try {
+            mManager.moveToPosition(0, /*sortByAlphabet=*/ true);
+            mManager.moveToPosition(0, /*sortByAlphabet=*/ false);
+        } catch (Exception e) {
+            assertWithMessage("This should not throw exception").fail();
+        }
+    }
+
+    @Test
+    public void testMoveToPosition_byAlphabeticalOrder_success() {
+        Cursor cursor = initManager();
+        List<String> nameList = Arrays.asList("D", "C", "A", "B");
+
+        // Implement Cursor iteration
+        final int size = nameList.size();
+        AtomicInteger currentPosition = new AtomicInteger(0);
+        when(cursor.moveToFirst()).then((Answer<Boolean>) i -> {
+            currentPosition.set(0);
+            return true;
+        });
+        when(cursor.isAfterLast()).then((Answer<Boolean>) i -> {
+            return currentPosition.get() >= size;
+        });
+        when(cursor.moveToNext()).then((Answer<Boolean>) i -> {
+            int pos = currentPosition.addAndGet(1);
+            return pos < size;
+        });
+        when(cursor.getString(anyInt())).then((Answer<String>) i -> {
+            return nameList.get(currentPosition.get());
+        });
+        // Find first one in alphabetical order ("A")
+        int position = 0;
+        mManager.moveToPosition(position, /*sortByAlphabet=*/ true);
+
+        assertThat(currentPosition.get()).isEqualTo(2);
+    }
+
+    @Test
+    public void testMoveToPosition_notByAlphabeticalOrder_success() {
+        Cursor cursor = initManager();
+        int position = 3;
+
+        mManager.moveToPosition(position, /*sortByAlphabet=*/ false);
+
+        verify(cursor).moveToPosition(position);
+    }
+
+    @Test
+    public void testGetSIMContactsSize() {
+        final int count = 10;
+        Cursor cursor = initManager();
+        when(cursor.getCount()).thenReturn(count);
+
+        assertThat(mManager.getSIMContactsSize()).isEqualTo(count);
+        verify(cursor).close();
+    }
+
+    @Test
+    public void testGetSIMPhonebookNameList_orderByIndexed() {
+        String prevLocalPhoneName = BluetoothPbapService.getLocalPhoneName();
+        try {
+            final String localPhoneName = "test_local_phone_name";
+            BluetoothPbapService.setLocalPhoneName(localPhoneName);
+            Cursor cursor = initManager();
+            List<String> nameList = Arrays.asList("D", "C", "A", "B");
+
+            // Implement Cursor iteration
+            final int size = nameList.size();
+            AtomicInteger currentPosition = new AtomicInteger(0);
+            when(cursor.moveToFirst()).then((Answer<Boolean>) i -> {
+                currentPosition.set(0);
+                return true;
+            });
+            when(cursor.isAfterLast()).then((Answer<Boolean>) i -> {
+                return currentPosition.get() >= size;
+            });
+            when(cursor.moveToNext()).then((Answer<Boolean>) i -> {
+                int pos = currentPosition.addAndGet(1);
+                return pos < size;
+            });
+            when(cursor.getString(anyInt())).then((Answer<String>) i -> {
+                return nameList.get(currentPosition.get());
+            });
+
+            ArrayList<String> result = mManager.getSIMPhonebookNameList(
+                    BluetoothPbapObexServer.ORDER_BY_INDEXED);
+
+            ArrayList<String> expectedResult = new ArrayList<>();
+            expectedResult.add(localPhoneName);
+            expectedResult.addAll(nameList);
+
+            assertThat(result).isEqualTo(expectedResult);
+        } finally {
+            BluetoothPbapService.setLocalPhoneName(prevLocalPhoneName);
+        }
+    }
+
+    @Test
+    public void testGetSIMPhonebookNameList_orderByAlphabet() {
+        String prevLocalPhoneName = BluetoothPbapService.getLocalPhoneName();
+        try {
+            final String localPhoneName = "test_local_phone_name";
+            BluetoothPbapService.setLocalPhoneName(localPhoneName);
+            Cursor cursor = initManager();
+            List<String> nameList = Arrays.asList("D", "C", "A", "B");
+
+            // Implement Cursor iteration
+            final int size = nameList.size();
+            AtomicInteger currentPosition = new AtomicInteger(0);
+            when(cursor.moveToFirst()).then((Answer<Boolean>) i -> {
+                currentPosition.set(0);
+                return true;
+            });
+            when(cursor.isAfterLast()).then((Answer<Boolean>) i -> {
+                return currentPosition.get() >= size;
+            });
+            when(cursor.moveToNext()).then((Answer<Boolean>) i -> {
+                int pos = currentPosition.addAndGet(1);
+                return pos < size;
+            });
+            when(cursor.getString(anyInt())).then((Answer<String>) i -> {
+                return nameList.get(currentPosition.get());
+            });
+
+            List<String> result = mManager.getSIMPhonebookNameList(
+                    BluetoothPbapObexServer.ORDER_BY_ALPHABETICAL);
+
+            List<String> expectedResult = new ArrayList<>(nameList);
+            Collections.sort(expectedResult, String.CASE_INSENSITIVE_ORDER);
+            expectedResult.add(0, localPhoneName);
+
+            assertThat(result).isEqualTo(expectedResult);
+        } finally {
+            BluetoothPbapService.setLocalPhoneName(prevLocalPhoneName);
+        }
+    }
+
+    @Test
+    public void testGetSIMContactNamesByNumber() {
+        Cursor cursor = initManager();
+        List<String> nameList = Arrays.asList("A", "B", "C", "D");
+        List<String> numberList = Arrays.asList(
+                "000123456789",
+                "123456789000",
+                "000111111000",
+                "123456789123");
+        final String query = "000";
+
+        // Implement Cursor iteration
+        final int size = nameList.size();
+        AtomicInteger currentPosition = new AtomicInteger(0);
+        when(cursor.moveToFirst()).then((Answer<Boolean>) i -> {
+            currentPosition.set(0);
+            return true;
+        });
+        when(cursor.isAfterLast()).then((Answer<Boolean>) i -> {
+            return currentPosition.get() >= size;
+        });
+        when(cursor.moveToNext()).then((Answer<Boolean>) i -> {
+            int pos = currentPosition.addAndGet(1);
+            return pos < size;
+        });
+        when(cursor.getString(BluetoothPbapSimVcardManager.NAME_COLUMN_INDEX)).then(
+                (Answer<String>) i -> {
+                    return nameList.get(currentPosition.get());
+                });
+        when(cursor.getString(BluetoothPbapSimVcardManager.NUMBER_COLUMN_INDEX)).then(
+                (Answer<String>) i -> {
+                    return numberList.get(currentPosition.get());
+                });
+
+        // Find the names whose number ends with 'query', and then
+        // also the names whose number starts with 'query'.
+        List<String> result = mManager.getSIMContactNamesByNumber(query);
+        List<String> expectedResult = Arrays.asList("B", "C", "A");
+        assertThat(result).isEqualTo(expectedResult);
+    }
+
+    @Test
+    public void testComposeAndSendSIMPhonebookVcards_whenStartPointIsNotCorrect() {
+        Operation operation = mock(Operation.class);
+        final int incorrectStartPoint = 0; // Should be greater than zero
+
+        int result = BluetoothPbapSimVcardManager.composeAndSendSIMPhonebookVcards(mContext,
+                operation, incorrectStartPoint, 0, /*vcardType21=*/false, /*ownerVCard=*/null);
+        assertThat(result).isEqualTo(ResponseCodes.OBEX_HTTP_INTERNAL_ERROR);
+    }
+
+    @Test
+    public void testComposeAndSendSIMPhonebookVcards_whenEndPointIsLessThanStartpoint() {
+        Operation operation = mock(Operation.class);
+        final int startPoint = 1;
+        final int endPoint = 0; // Should be equal or greater than startPoint
+
+        int result = BluetoothPbapSimVcardManager.composeAndSendSIMPhonebookVcards(mContext,
+                operation, startPoint, endPoint, /*vcardType21=*/false, /*ownerVCard=*/null);
+        assertThat(result).isEqualTo(ResponseCodes.OBEX_HTTP_INTERNAL_ERROR);
+    }
+
+    @Test
+    public void testComposeAndSendSIMPhonebookVcards_whenCursorInitFailed() {
+        Operation operation = mock(Operation.class);
+        final int startPoint = 1;
+        final int endPoint = 1;
+        doReturn(null).when(mPbapMethodProxy)
+                .contentResolverQuery(any(), any(), any(), any(), any(), any());
+
+        int result = BluetoothPbapSimVcardManager.composeAndSendSIMPhonebookVcards(mContext,
+                operation, startPoint, endPoint, /*vcardType21=*/false, /*ownerVCard=*/null);
+        assertThat(result).isEqualTo(ResponseCodes.OBEX_HTTP_INTERNAL_ERROR);
+    }
+
+    @Test
+    public void testComposeAndSendSIMPhonebookVcards_success() throws Exception {
+        Cursor cursor = mock(Cursor.class);
+        when(cursor.getCount()).thenReturn(10);
+        when(cursor.moveToFirst()).thenReturn(true);
+        when(cursor.isAfterLast()).thenReturn(false);
+        doReturn(cursor).when(mPbapMethodProxy)
+                .contentResolverQuery(any(), any(), any(), any(), any(), any());
+        Operation operation = mock(Operation.class);
+        OutputStream outputStream = mock(OutputStream.class);
+        when(operation.openOutputStream()).thenReturn(outputStream);
+        final int startPoint = 1;
+        final int endPoint = 1;
+        final String testOwnerVcard = "owner_v_card";
+
+        int result = BluetoothPbapSimVcardManager.composeAndSendSIMPhonebookVcards(mContext,
+                operation, startPoint, endPoint, /*vcardType21=*/false, testOwnerVcard);
+        assertThat(result).isEqualTo(ResponseCodes.OBEX_HTTP_OK);
+    }
+
+    @Test
+    public void testComposeAndSendSIMPhonebookOneVcard_whenOffsetIsNotCorrect() {
+        Operation operation = mock(Operation.class);
+        final int offset = 0; // Should be greater than zero
+
+        int result = BluetoothPbapSimVcardManager.composeAndSendSIMPhonebookOneVcard(mContext,
+                operation, offset, /*vcardType21=*/false, /*ownerVCard=*/null,
+                BluetoothPbapObexServer.ORDER_BY_INDEXED);
+        assertThat(result).isEqualTo(ResponseCodes.OBEX_HTTP_INTERNAL_ERROR);
+    }
+
+    @Test
+    public void testComposeAndSendSIMPhonebookOneVcard_success() throws Exception {
+        Cursor cursor = mock(Cursor.class);
+        when(cursor.getCount()).thenReturn(10);
+        when(cursor.moveToFirst()).thenReturn(true);
+        when(cursor.isAfterLast()).thenReturn(false);
+        doReturn(cursor).when(mPbapMethodProxy)
+                .contentResolverQuery(any(), any(), any(), any(), any(), any());
+        Operation operation = mock(Operation.class);
+        OutputStream outputStream = mock(OutputStream.class);
+        when(operation.openOutputStream()).thenReturn(outputStream);
+        final int offset = 1;
+        final String testOwnerVcard = "owner_v_card";
+
+        int result = BluetoothPbapSimVcardManager.composeAndSendSIMPhonebookOneVcard(mContext,
+                operation, offset, /*vcardType21=*/false, testOwnerVcard,
+                BluetoothPbapObexServer.ORDER_BY_INDEXED);
+        assertThat(result).isEqualTo(ResponseCodes.OBEX_HTTP_OK);
+    }
+
+    private Cursor initManager() {
+        Cursor cursor = mock(Cursor.class);
+        when(cursor.getCount()).thenReturn(10);
+        when(cursor.moveToFirst()).thenReturn(true);
+        when(cursor.isAfterLast()).thenReturn(false);
+        doReturn(cursor).when(mPbapMethodProxy)
+                .contentResolverQuery(any(), any(), any(), any(), any(), any());
+        mManager.init(BluetoothPbapSimVcardManager.SIM_URI, null, null, null);
+
+        return cursor;
+    }
+}
diff --git a/android/app/tests/unit/src/com/android/bluetooth/pbap/BluetoothPbapUtilsTest.java b/android/app/tests/unit/src/com/android/bluetooth/pbap/BluetoothPbapUtilsTest.java
new file mode 100644
index 0000000..875042f
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/pbap/BluetoothPbapUtilsTest.java
@@ -0,0 +1,348 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.pbap;
+
+import static android.provider.ContactsContract.Data.CONTACT_ID;
+import static android.provider.ContactsContract.Data.DATA1;
+import static android.provider.ContactsContract.Data.MIMETYPE;
+
+import static com.google.common.truth.Truth.assertThat;
+import static com.google.common.truth.Truth.assertWithMessage;
+
+import static org.mockito.Mockito.any;
+import static org.mockito.Mockito.doReturn;
+import static org.mockito.Mockito.eq;
+import static org.mockito.Mockito.when;
+
+import android.content.Context;
+import android.content.res.Resources;
+import android.database.MatrixCursor;
+import android.os.Handler;
+import android.os.HandlerThread;
+import android.provider.ContactsContract.CommonDataKinds.Email;
+import android.provider.ContactsContract.CommonDataKinds.Phone;
+import android.provider.ContactsContract.CommonDataKinds.StructuredName;
+import android.provider.ContactsContract.CommonDataKinds.StructuredPostal;
+import android.provider.ContactsContract.Contacts;
+import android.provider.ContactsContract.Data;
+
+import androidx.test.filters.SmallTest;
+import androidx.test.runner.AndroidJUnit4;
+
+import com.android.bluetooth.BluetoothMethodProxy;
+import com.android.vcard.VCardConfig;
+
+import org.junit.After;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.Mock;
+import org.mockito.MockitoAnnotations;
+import org.mockito.Spy;
+
+import java.util.ArrayList;
+import java.util.Calendar;
+import java.util.List;
+
+@SmallTest
+@RunWith(AndroidJUnit4.class)
+public class BluetoothPbapUtilsTest {
+
+    @Mock
+    Context mContext;
+
+    @Mock
+    Resources mResources;
+
+    @Spy
+    BluetoothMethodProxy mProxy;
+
+    @Before
+    public void setUp() throws Exception {
+        MockitoAnnotations.initMocks(this);
+        BluetoothMethodProxy.setInstanceForTesting(mProxy);
+
+        when(mContext.getResources()).thenReturn(mResources);
+        clearStaticFields();
+    }
+
+    @After
+    public void tearDown() {
+        BluetoothMethodProxy.setInstanceForTesting(null);
+        clearStaticFields();
+    }
+
+    @Test
+    public void checkFieldUpdates_whenSizeAreDifferent_returnsTrue() {
+        ArrayList<String> oldFields = new ArrayList<>(List.of("0", "1", "2", "3"));
+        ArrayList<String> newFields = new ArrayList<>(List.of("0", "1", "2", "3", "4"));
+
+        assertThat(BluetoothPbapUtils.checkFieldUpdates(oldFields, newFields)).isTrue();
+    }
+
+    @Test
+    public void checkFieldUpdates_newFieldsHasItsOwnFields_returnsTrue() {
+        ArrayList<String> oldFields = new ArrayList<>(List.of("0", "1", "2", "3"));
+        ArrayList<String> newFields = new ArrayList<>(List.of("0", "1", "2", "5"));
+
+        assertThat(BluetoothPbapUtils.checkFieldUpdates(oldFields, newFields)).isTrue();
+    }
+
+    @Test
+    public void checkFieldUpdates_onlyNewFieldsIsNull_returnsTrue() {
+        ArrayList<String> oldFields = new ArrayList<>(List.of("0", "1", "2", "3"));
+        ArrayList<String> newFields = null;
+
+        assertThat(BluetoothPbapUtils.checkFieldUpdates(oldFields, newFields)).isTrue();
+    }
+
+    @Test
+    public void checkFieldUpdates_onlyOldFieldsIsNull_returnsTrue() {
+        ArrayList<String> oldFields = null;
+        ArrayList<String> newFields = new ArrayList<>(List.of("0", "1", "2", "3"));
+
+        assertThat(BluetoothPbapUtils.checkFieldUpdates(oldFields, newFields)).isTrue();
+    }
+
+    @Test
+    public void checkFieldUpdates_whenBothAreNull_returnsTrue() {
+        ArrayList<String> oldFields = null;
+        ArrayList<String> newFields = null;
+
+        assertThat(BluetoothPbapUtils.checkFieldUpdates(oldFields, newFields)).isFalse();
+    }
+
+    @Test
+    public void createFilteredVCardComposer_returnsNewVCardComposer() {
+        byte[] filter = new byte[] {(byte) 0xFF, (byte) 0xFF, (byte) 0xFF, (byte) 0xFF,
+                (byte) 0xFF, (byte) 0xFF, (byte) 0xFF, (byte) 0xFF};
+        int vcardType = VCardConfig.VCARD_TYPE_V21_GENERIC;
+
+        assertThat(BluetoothPbapUtils.createFilteredVCardComposer(mContext, vcardType, filter))
+                .isNotNull();
+    }
+
+    @Test
+    public void rolloverCounters() {
+        BluetoothPbapUtils.sPrimaryVersionCounter = -1;
+        BluetoothPbapUtils.sSecondaryVersionCounter = -1;
+
+        BluetoothPbapUtils.rolloverCounters();
+
+        assertThat(BluetoothPbapUtils.sPrimaryVersionCounter).isEqualTo(0);
+        assertThat(BluetoothPbapUtils.sSecondaryVersionCounter).isEqualTo(0);
+    }
+
+    @Test
+    public void setContactFields() {
+        String contactId = "1358923";
+
+        BluetoothPbapUtils.setContactFields(BluetoothPbapUtils.TYPE_NAME, contactId,
+                "test_name");
+        BluetoothPbapUtils.setContactFields(BluetoothPbapUtils.TYPE_PHONE, contactId,
+                "0123456789");
+        BluetoothPbapUtils.setContactFields(BluetoothPbapUtils.TYPE_EMAIL, contactId,
+                "android@android.com");
+        BluetoothPbapUtils.setContactFields(BluetoothPbapUtils.TYPE_ADDRESS, contactId,
+                "SomeAddress");
+
+        assertThat(BluetoothPbapUtils.sContactDataset.get(contactId)).isNotNull();
+    }
+
+    @Test
+    public void fetchAndSetContacts_whenCursorIsNull_returnsMinusOne() {
+        doReturn(null).when(mProxy).contentResolverQuery(
+                any(), any(), any(), any(), any(), any());
+        HandlerThread handlerThread = new HandlerThread("BluetoothPbapUtilsTest");
+        handlerThread.start();
+        Handler handler = new Handler(handlerThread.getLooper());
+
+        try {
+            assertThat(BluetoothPbapUtils.fetchAndSetContacts(
+                    mContext, handler, null, null, null, true))
+                    .isEqualTo(-1);
+        } finally {
+            handlerThread.quit();
+        }
+    }
+
+    @Test
+    public void fetchAndSetContacts_whenIsLoadTrue_returnsContactsSetSize() {
+        MatrixCursor cursor = new MatrixCursor(new String[] {CONTACT_ID, MIMETYPE, DATA1});
+        cursor.addRow(new Object[] {"id1", Phone.CONTENT_ITEM_TYPE, "01234567"});
+        cursor.addRow(new Object[] {"id1", Email.CONTENT_ITEM_TYPE, "android@android.com"});
+        cursor.addRow(new Object[] {"id1", StructuredPostal.CONTENT_ITEM_TYPE, "01234"});
+        cursor.addRow(new Object[] {"id2", StructuredName.CONTENT_ITEM_TYPE, "And Roid"});
+        cursor.addRow(new Object[] {null, null, null});
+
+        doReturn(cursor).when(mProxy).contentResolverQuery(
+                any(), any(), any(), any(), any(), any());
+        HandlerThread handlerThread = new HandlerThread("BluetoothPbapUtilsTest");
+        handlerThread.start();
+        Handler handler = new Handler(handlerThread.getLooper());
+
+        try {
+            boolean isLoad = true;
+            assertThat(BluetoothPbapUtils.fetchAndSetContacts(
+                    mContext, handler, null, null, null, isLoad))
+                    .isEqualTo(2); // Two IDs exist in sContactSet.
+        } finally {
+            handlerThread.quit();
+        }
+    }
+
+    @Test
+    public void fetchAndSetContacts_whenIsLoadFalse_returnsContactsSetSize() {
+        MatrixCursor cursor = new MatrixCursor(new String[] {CONTACT_ID, MIMETYPE, DATA1});
+        cursor.addRow(new Object[] {"id1", Phone.CONTENT_ITEM_TYPE, "01234567"});
+        cursor.addRow(new Object[] {"id1", Email.CONTENT_ITEM_TYPE, "android@android.com"});
+        cursor.addRow(new Object[] {"id1", StructuredPostal.CONTENT_ITEM_TYPE, "01234"});
+        cursor.addRow(new Object[] {"id2", StructuredName.CONTENT_ITEM_TYPE, "And Roid"});
+        cursor.addRow(new Object[] {null, null, null});
+
+        doReturn(cursor).when(mProxy).contentResolverQuery(
+                any(), any(), any(), any(), any(), any());
+        HandlerThread handlerThread = new HandlerThread("BluetoothPbapUtilsTest");
+        handlerThread.start();
+        Handler handler = new Handler(handlerThread.getLooper());
+
+        try {
+            boolean isLoad = false;
+            assertThat(BluetoothPbapUtils.fetchAndSetContacts(
+                    mContext, handler, null, null, null, isLoad))
+                    .isEqualTo(2); // Two IDs exist in sContactSet.
+            assertThat(BluetoothPbapUtils.sTotalFields).isEqualTo(1);
+            assertThat(BluetoothPbapUtils.sTotalSvcFields).isEqualTo(1);
+        } finally {
+            handlerThread.quit();
+        }
+    }
+
+    @Test
+    public void updateSecondaryVersionCounter_whenCursorIsNull_shouldNotCrash() {
+        doReturn(null).when(mProxy).contentResolverQuery(
+                any(), any(), any(), any(), any(), any());
+        HandlerThread handlerThread = new HandlerThread("BluetoothPbapUtilsTest");
+        handlerThread.start();
+        Handler handler = new Handler(handlerThread.getLooper());
+
+        try {
+            BluetoothPbapUtils.updateSecondaryVersionCounter(mContext, handler);
+        } catch (Exception e) {
+            assertWithMessage("Exception should not happen.").fail();
+        } finally {
+            handlerThread.quit();
+        }
+    }
+
+    @Test
+    public void updateSecondaryVersionCounter_whenContactsAreAdded() {
+        MatrixCursor contactCursor = new MatrixCursor(
+                new String[] {Contacts._ID, Contacts.CONTACT_LAST_UPDATED_TIMESTAMP});
+        contactCursor.addRow(new Object[] {"id1", Calendar.getInstance().getTimeInMillis()});
+        contactCursor.addRow(new Object[] {"id2", Calendar.getInstance().getTimeInMillis()});
+        contactCursor.addRow(new Object[] {"id3", Calendar.getInstance().getTimeInMillis()});
+        contactCursor.addRow(new Object[] {"id4", Calendar.getInstance().getTimeInMillis()});
+        doReturn(contactCursor).when(mProxy).contentResolverQuery(
+                any(), eq(Contacts.CONTENT_URI), any(), any(), any(), any());
+
+        MatrixCursor dataCursor = new MatrixCursor(new String[] {CONTACT_ID, MIMETYPE, DATA1});
+        dataCursor.addRow(new Object[] {"id1", Phone.CONTENT_ITEM_TYPE, "01234567"});
+        dataCursor.addRow(new Object[] {"id1", Email.CONTENT_ITEM_TYPE, "android@android.com"});
+        dataCursor.addRow(new Object[] {"id1", StructuredPostal.CONTENT_ITEM_TYPE, "01234"});
+        dataCursor.addRow(new Object[] {"id2", StructuredName.CONTENT_ITEM_TYPE, "And Roid"});
+        doReturn(dataCursor).when(mProxy).contentResolverQuery(
+                any(), eq(Data.CONTENT_URI), any(), any(), any(), any());
+
+        HandlerThread handlerThread = new HandlerThread("BluetoothPbapUtilsTest");
+        handlerThread.start();
+        Handler handler = new Handler(handlerThread.getLooper());
+
+        try {
+            BluetoothPbapUtils.updateSecondaryVersionCounter(mContext, handler);
+
+            assertThat(BluetoothPbapUtils.sTotalContacts).isEqualTo(4);
+        } finally {
+            handlerThread.quit();
+        }
+    }
+
+    @Test
+    public void updateSecondaryVersionCounter_whenContactsAreDeleted() {
+        MatrixCursor contactCursor = new MatrixCursor(
+                new String[] {Contacts._ID, Contacts.CONTACT_LAST_UPDATED_TIMESTAMP});
+        doReturn(contactCursor).when(mProxy).contentResolverQuery(
+                any(), eq(Contacts.CONTENT_URI), any(), any(), any(), any());
+
+        MatrixCursor dataCursor = new MatrixCursor(new String[] {CONTACT_ID, MIMETYPE, DATA1});
+        doReturn(dataCursor).when(mProxy).contentResolverQuery(
+                any(), eq(Data.CONTENT_URI), any(), any(), any(), any());
+
+        HandlerThread handlerThread = new HandlerThread("BluetoothPbapUtilsTest");
+        handlerThread.start();
+        Handler handler = new Handler(handlerThread.getLooper());
+
+        try {
+            BluetoothPbapUtils.sTotalContacts = 2;
+            BluetoothPbapUtils.sContactSet.add("id1");
+            BluetoothPbapUtils.sContactSet.add("id2");
+
+            BluetoothPbapUtils.updateSecondaryVersionCounter(mContext, handler);
+
+            assertThat(BluetoothPbapUtils.sTotalContacts).isEqualTo(0);
+        } finally {
+            handlerThread.quit();
+        }
+    }
+
+    @Test
+    public void updateSecondaryVersionCounter_whenContactsAreUpdated() {
+        MatrixCursor contactCursor = new MatrixCursor(
+                new String[] {Contacts._ID, Contacts.CONTACT_LAST_UPDATED_TIMESTAMP});
+        contactCursor.addRow(new Object[] {"id1", Calendar.getInstance().getTimeInMillis()});
+        doReturn(contactCursor).when(mProxy).contentResolverQuery(
+                any(), eq(Contacts.CONTENT_URI), any(), any(), any(), any());
+
+        MatrixCursor dataCursor = new MatrixCursor(new String[] {CONTACT_ID, MIMETYPE, DATA1});
+        dataCursor.addRow(new Object[] {"id1", Phone.CONTENT_ITEM_TYPE, "01234567"});
+        dataCursor.addRow(new Object[] {"id1", Email.CONTENT_ITEM_TYPE, "android@android.com"});
+        dataCursor.addRow(new Object[] {"id1", StructuredPostal.CONTENT_ITEM_TYPE, "01234"});
+        dataCursor.addRow(new Object[] {"id1", StructuredName.CONTENT_ITEM_TYPE, "And Roid"});
+        doReturn(dataCursor).when(mProxy).contentResolverQuery(
+                any(), eq(Data.CONTENT_URI), any(), any(), any(), any());
+        assertThat(BluetoothPbapUtils.sSecondaryVersionCounter).isEqualTo(0);
+
+        BluetoothPbapUtils.sTotalContacts = 1;
+        BluetoothPbapUtils.setContactFields(BluetoothPbapUtils.TYPE_NAME, "id1",
+                "test_previous_name_before_update");
+
+        BluetoothPbapUtils.updateSecondaryVersionCounter(mContext, null);
+
+        assertThat(BluetoothPbapUtils.sSecondaryVersionCounter).isEqualTo(1);
+    }
+
+    private static void clearStaticFields() {
+        BluetoothPbapUtils.sPrimaryVersionCounter = 0;
+        BluetoothPbapUtils.sSecondaryVersionCounter = 0;
+        BluetoothPbapUtils.sContactSet.clear();
+        BluetoothPbapUtils.sContactDataset.clear();
+        BluetoothPbapUtils.sTotalContacts = 0;
+        BluetoothPbapUtils.sTotalFields = 0;
+        BluetoothPbapUtils.sTotalSvcFields = 0;
+        BluetoothPbapUtils.sContactsLastUpdated = 0;
+    }
+}
diff --git a/android/app/tests/unit/src/com/android/bluetooth/pbap/BluetoothPbapVcardManagerNestedClassesTest.java b/android/app/tests/unit/src/com/android/bluetooth/pbap/BluetoothPbapVcardManagerNestedClassesTest.java
new file mode 100644
index 0000000..a6c16aa
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/pbap/BluetoothPbapVcardManagerNestedClassesTest.java
@@ -0,0 +1,216 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.pbap;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;
+
+import android.content.Context;
+import android.content.res.Resources;
+import android.database.Cursor;
+import android.provider.ContactsContract;
+
+import androidx.test.filters.SmallTest;
+import androidx.test.runner.AndroidJUnit4;
+
+import com.android.bluetooth.pbap.BluetoothPbapVcardManager.ContactCursorFilter;
+import com.android.bluetooth.pbap.BluetoothPbapVcardManager.PropertySelector;
+import com.android.bluetooth.pbap.BluetoothPbapVcardManager.VCardFilter;
+
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.Mock;
+import org.mockito.MockitoAnnotations;
+
+import java.util.concurrent.atomic.AtomicInteger;
+
+@SmallTest
+@RunWith(AndroidJUnit4.class)
+public class BluetoothPbapVcardManagerNestedClassesTest {
+
+    @Mock
+    Context mContext;
+
+    @Mock
+    Resources mResources;
+
+    @Before
+    public void setUp() throws Exception {
+        MockitoAnnotations.initMocks(this);
+        when(mContext.getResources()).thenReturn(mResources);
+    }
+
+    @Test
+    public void VCardFilter_isPhotoEnabled_whenFilterIncludesPhoto_returnsTrue() {
+        final byte photoEnableBit = 1 << 3;
+        byte[] filter = new byte[] {photoEnableBit};
+        VCardFilter vCardFilter = new VCardFilter(filter);
+
+        assertThat(vCardFilter.isPhotoEnabled()).isTrue();
+    }
+
+    @Test
+    public void VCardFilter_isPhotoEnabled_whenFilterExcludesPhoto_returnsFalse() {
+        byte[] filter = new byte[] {(byte) 0x00};
+        VCardFilter vCardFilter = new VCardFilter(filter);
+
+        assertThat(vCardFilter.isPhotoEnabled()).isFalse();
+    }
+
+    @Test
+    public void VCardFilter_apply_whenFilterIsNull_returnsSameVcard() {
+        VCardFilter vCardFilter = new VCardFilter(/*filter=*/null);
+
+        String vCard = "FN:Full Name";
+        assertThat(vCardFilter.apply(vCard, /*vCardType21=*/ true)).isEqualTo(vCard);
+    }
+
+    @Test
+    public void VCardFilter_apply_returnsSameVcard() {
+        final String separator = System.getProperty("line.separator");
+        String vCard = "FN:Test Full Name" + separator
+                + "EMAIL:android@android.com:" + separator
+                + "X-IRMC-CALL-DATETIME:20170314T173942" + separator;
+
+        byte[] emailExcludeFilter = new byte[] {(byte) 0xFE, (byte) 0xFF};
+        VCardFilter vCardFilter = new VCardFilter(/*filter=*/ emailExcludeFilter);
+        String expectedVCard = "FN:Test Full Name" + separator
+                + "X-IRMC-CALL-DATETIME:20170314T173942" + separator;
+
+        assertThat(vCardFilter.apply(vCard, /*vCardType21=*/ true))
+                .isEqualTo(expectedVCard);
+    }
+
+    @Test
+    public void PropertySelector_checkVCardSelector_atLeastOnePropertyExists_returnsTrue() {
+        final String separator = System.getProperty("line.separator");
+        String vCard = "FN:Test Full Name" + separator
+                + "EMAIL:android@android.com:" + separator
+                + "TEL:0123456789" + separator;
+
+        byte[] emailSelector = new byte[] {0x01, 0x00};
+        PropertySelector selector = new PropertySelector(emailSelector);
+
+        assertThat(selector.checkVCardSelector(vCard, "0")).isTrue();
+    }
+
+    @Test
+    public void PropertySelector_checkVCardSelector_atLeastOnePropertyExists_returnsFalse() {
+        final String separator = System.getProperty("line.separator");
+        String vCard = "FN:Test Full Name" + separator
+                + "EMAIL:android@android.com:" + separator
+                + "TEL:0123456789" + separator;
+
+        byte[] organizationSelector = new byte[] {0x01, 0x00, 0x00};
+        PropertySelector selector = new PropertySelector(organizationSelector);
+
+        assertThat(selector.checkVCardSelector(vCard, "0")).isFalse();
+    }
+
+    @Test
+    public void PropertySelector_checkVCardSelector_allPropertiesExist_returnsTrue() {
+        final String separator = System.getProperty("line.separator");
+        String vCard = "FN:Test Full Name" + separator
+                + "EMAIL:android@android.com:" + separator
+                + "TEL:0123456789" + separator;
+
+        byte[] fullNameAndEmailSelector = new byte[] {0x01, 0x02};
+        PropertySelector selector = new PropertySelector(fullNameAndEmailSelector);
+
+        assertThat(selector.checkVCardSelector(vCard, "1")).isTrue();
+    }
+
+    @Test
+    public void PropertySelector_checkVCardSelector_allPropertiesExist_returnsFalse() {
+        final String separator = System.getProperty("line.separator");
+        String vCard = "FN:Test Full Name" + separator
+                + "EMAIL:android@android.com:" + separator
+                + "TEL:0123456789" + separator;
+
+        byte[] fullNameAndOrganizationSelector = new byte[] {0x01, 0x00, 0x02};
+        PropertySelector selector = new PropertySelector(fullNameAndOrganizationSelector);
+
+        assertThat(selector.checkVCardSelector(vCard, "1")).isFalse();
+    }
+
+    @Test
+    public void ContactCursorFilter_filterByOffset() {
+        Cursor contactCursor = mock(Cursor.class);
+        int contactIdColumn = 5;
+        when(contactCursor.getColumnIndex(ContactsContract.Data.CONTACT_ID))
+                .thenReturn(contactIdColumn);
+
+        long[] contactIds = new long[] {1001, 1001, 1002, 1002, 1003, 1003, 1004};
+        AtomicInteger currentPos = new AtomicInteger(-1);
+        when(contactCursor.moveToNext()).thenAnswer(invocation -> {
+            if (currentPos.get() < contactIds.length - 1) {
+                currentPos.incrementAndGet();
+                return true;
+            }
+            return false;
+        });
+        when(contactCursor.getLong(contactIdColumn))
+                .thenAnswer(invocation -> contactIds[currentPos.get()]);
+
+        int offset = 3;
+        Cursor resultCursor = ContactCursorFilter.filterByOffset(contactCursor, offset);
+
+        // Should return cursor containing [1003]
+        assertThat(resultCursor.getCount()).isEqualTo(1);
+        assertThat(getContactsIdFromCursor(resultCursor, 0)).isEqualTo(1003);
+    }
+
+    @Test
+    public void ContactCursorFilter_filterByRange() {
+        Cursor contactCursor = mock(Cursor.class);
+        int contactIdColumn = 5;
+        when(contactCursor.getColumnIndex(ContactsContract.Data.CONTACT_ID))
+                .thenReturn(contactIdColumn);
+
+        long[] contactIds = new long[] {1001, 1001, 1002, 1002, 1003, 1003, 1004};
+        AtomicInteger currentPos = new AtomicInteger(-1);
+        when(contactCursor.moveToNext()).thenAnswer(invocation -> {
+            if (currentPos.get() < contactIds.length - 1) {
+                currentPos.incrementAndGet();
+                return true;
+            }
+            return false;
+        });
+        when(contactCursor.getLong(contactIdColumn))
+                .thenAnswer(invocation -> contactIds[currentPos.get()]);
+
+        int startPoint = 2;
+        int endPoint = 4;
+        Cursor resultCursor = ContactCursorFilter.filterByRange(
+                contactCursor, startPoint, endPoint);
+
+        // Should return cursor containing [1002, 1003, 1004]
+        assertThat(resultCursor.getCount()).isEqualTo(3);
+        assertThat(getContactsIdFromCursor(resultCursor, 0)).isEqualTo(1002);
+        assertThat(getContactsIdFromCursor(resultCursor, 1)).isEqualTo(1003);
+        assertThat(getContactsIdFromCursor(resultCursor, 2)).isEqualTo(1004);
+    }
+
+    private long getContactsIdFromCursor(Cursor cursor, int position) {
+        int index = cursor.getColumnIndex(ContactsContract.Data.CONTACT_ID);
+        cursor.moveToPosition(position);
+        return cursor.getLong(index);
+    }
+}
diff --git a/android/app/tests/unit/src/com/android/bluetooth/pbap/BluetoothPbapVcardManagerTest.java b/android/app/tests/unit/src/com/android/bluetooth/pbap/BluetoothPbapVcardManagerTest.java
new file mode 100644
index 0000000..a6ed559
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/pbap/BluetoothPbapVcardManagerTest.java
@@ -0,0 +1,346 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.pbap;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import static org.mockito.ArgumentMatchers.anyInt;
+import static org.mockito.Mockito.any;
+import static org.mockito.Mockito.doReturn;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import android.content.Context;
+import android.database.Cursor;
+import android.provider.CallLog;
+import android.provider.ContactsContract;
+
+import androidx.test.InstrumentationRegistry;
+import androidx.test.filters.SmallTest;
+import androidx.test.runner.AndroidJUnit4;
+
+import com.android.bluetooth.BluetoothMethodProxy;
+import com.android.bluetooth.R;
+
+import org.junit.After;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.MockitoAnnotations;
+import org.mockito.Spy;
+import org.mockito.stubbing.Answer;
+
+import java.util.Arrays;
+import java.util.List;
+import java.util.concurrent.atomic.AtomicInteger;
+
+@SmallTest
+@RunWith(AndroidJUnit4.class)
+public class BluetoothPbapVcardManagerTest {
+
+    private static final String TAG = BluetoothPbapVcardManagerTest.class.getSimpleName();
+
+    @Spy
+    BluetoothMethodProxy mPbapMethodProxy = BluetoothMethodProxy.getInstance();
+
+    Context mContext;
+    BluetoothPbapVcardManager mManager;
+
+    @Before
+    public void setUp() {
+        MockitoAnnotations.initMocks(this);
+        BluetoothMethodProxy.setInstanceForTesting(mPbapMethodProxy);
+        mContext = InstrumentationRegistry.getTargetContext();
+        mManager = new BluetoothPbapVcardManager(mContext);
+    }
+
+    @After
+    public void tearDown() {
+        BluetoothMethodProxy.setInstanceForTesting(null);
+    }
+
+    @Test
+    public void testGetOwnerPhoneNumberVcard_whenUseProfileForOwnerVcard() {
+        BluetoothPbapConfig.setIncludePhotosInVcard(true);
+
+        assertThat(mManager.getOwnerPhoneNumberVcard(/*vcardType21=*/true, /*filter=*/null))
+                .isNotNull();
+    }
+
+    @Test
+    public void testGetOwnerPhoneNumberVcard_whenNotUseProfileForOwnerVcard() {
+        BluetoothPbapConfig.setIncludePhotosInVcard(false);
+
+        assertThat(mManager.getOwnerPhoneNumberVcard(/*vcardType21=*/true, /*filter=*/null))
+                .isNotNull();
+    }
+
+    @Test
+    public void testGetPhonebookSize_whenTypeIsPhonebook() {
+        Cursor cursor = mock(Cursor.class);
+        doReturn(cursor).when(mPbapMethodProxy)
+                .contentResolverQuery(any(), any(), any(), any(), any(), any());
+
+        // 5 distinct contact IDs.
+        final List<Integer> contactIdsWithDuplicates = Arrays.asList(0, 1, 1, 2, 2, 3, 3, 4, 4);
+
+        // Implement Cursor iteration
+        final int size = contactIdsWithDuplicates.size();
+        AtomicInteger currentPosition = new AtomicInteger(0);
+        when(cursor.moveToPosition(anyInt())).then((Answer<Boolean>) i -> {
+            int position = i.getArgument(0);
+            currentPosition.set(position);
+            return true;
+        });
+        when(cursor.moveToNext()).then((Answer<Boolean>) i -> {
+            int pos = currentPosition.addAndGet(1);
+            return pos < size;
+        });
+        when(cursor.getLong(anyInt())).then((Answer<Long>) i -> {
+            return (long) contactIdsWithDuplicates.get(currentPosition.get());
+        });
+
+        // 5 distinct contact IDs + self (which is only included for phonebook)
+        final int expectedSize = 5 + 1;
+
+        assertThat(mManager.getPhonebookSize(BluetoothPbapObexServer.ContentType.PHONEBOOK, null))
+                .isEqualTo(expectedSize);
+    }
+
+    @Test
+    public void testGetPhonebookSize_whenTypeIsFavorites() {
+        Cursor cursor = mock(Cursor.class);
+        doReturn(cursor).when(mPbapMethodProxy)
+                .contentResolverQuery(any(), any(), any(), any(), any(), any());
+
+        // 5 distinct contact IDs.
+        final List<Integer> contactIdsWithDuplicates = Arrays.asList(
+                0, 1, 1, 2,     // starred
+                2, 3, 3, 4, 4   // not starred
+        );
+
+        // Implement Cursor iteration
+        final int starredSize = 4;
+        AtomicInteger currentPosition = new AtomicInteger(0);
+        when(cursor.moveToPosition(anyInt())).then((Answer<Boolean>) i -> {
+            int position = i.getArgument(0);
+            currentPosition.set(position);
+            return true;
+        });
+        when(cursor.moveToNext()).then((Answer<Boolean>) i -> {
+            int pos = currentPosition.addAndGet(1);
+            return pos < starredSize;
+        });
+        when(cursor.getLong(anyInt())).then((Answer<Long>) i -> {
+            return (long) contactIdsWithDuplicates.get(currentPosition.get());
+        });
+
+        // Among 4 starred contact Ids, there are 3 distinct contact IDs
+        final int expectedSize = 3;
+
+        assertThat(mManager.getPhonebookSize(BluetoothPbapObexServer.ContentType.FAVORITES, null))
+                .isEqualTo(expectedSize);
+    }
+
+    @Test
+    public void testGetPhonebookSize_whenTypeIsSimPhonebook() {
+        Cursor cursor = mock(Cursor.class);
+        doReturn(cursor).when(mPbapMethodProxy)
+                .contentResolverQuery(any(), any(), any(), any(), any(), any());
+        final int expectedSize = 10;
+        when(cursor.getCount()).thenReturn(expectedSize);
+        BluetoothPbapSimVcardManager simVcardManager = mock(BluetoothPbapSimVcardManager.class);
+
+        assertThat(mManager.getPhonebookSize(BluetoothPbapObexServer.ContentType.SIM_PHONEBOOK,
+                simVcardManager)).isEqualTo(expectedSize);
+        verify(simVcardManager).getSIMContactsSize();
+    }
+
+    @Test
+    public void testGetPhonebookSize_whenTypeIsHistory() {
+        final int historySize = 10;
+        Cursor cursor = mock(Cursor.class);
+        when(cursor.getCount()).thenReturn(historySize);
+        doReturn(cursor).when(mPbapMethodProxy)
+                .contentResolverQuery(any(), any(), any(), any(), any(), any());
+
+        assertThat(mManager.getPhonebookSize(
+                BluetoothPbapObexServer.ContentType.INCOMING_CALL_HISTORY, null))
+                .isEqualTo(historySize);
+    }
+
+    @Test
+    public void testLoadCallHistoryList() {
+        Cursor cursor = mock(Cursor.class);
+        doReturn(cursor).when(mPbapMethodProxy)
+                .contentResolverQuery(any(), any(), any(), any(), any(), any());
+
+        List<String> nameList = Arrays.asList("A", "B", "", "");
+        List<String> numberList = Arrays.asList("0000", "1111", "2222", "3333");
+        List<Integer> presentationAllowedList = Arrays.asList(
+                CallLog.Calls.PRESENTATION_ALLOWED,
+                CallLog.Calls.PRESENTATION_ALLOWED,
+                CallLog.Calls.PRESENTATION_ALLOWED,
+                CallLog.Calls.PRESENTATION_UNKNOWN); // The number "3333" should not be shown.
+
+        List<String> expectedResult = Arrays.asList(
+                "A", "B", "2222", mContext.getString(R.string.unknownNumber));
+
+        // Implement Cursor iteration
+        final int size = nameList.size();
+        AtomicInteger currentPosition = new AtomicInteger(0);
+        when(cursor.moveToFirst()).then((Answer<Boolean>) i -> {
+            currentPosition.set(0);
+            return true;
+        });
+        when(cursor.isAfterLast()).then((Answer<Boolean>) i -> {
+            return currentPosition.get() >= size;
+        });
+        when(cursor.moveToNext()).then((Answer<Boolean>) i -> {
+            int pos = currentPosition.addAndGet(1);
+            return pos < size;
+        });
+        when(cursor.getString(BluetoothPbapVcardManager.CALLS_NAME_COLUMN_INDEX))
+                .then((Answer<String>) i -> {
+            return nameList.get(currentPosition.get());
+        });
+        when(cursor.getString(BluetoothPbapVcardManager.CALLS_NUMBER_COLUMN_INDEX))
+                .then((Answer<String>) i -> {
+            return numberList.get(currentPosition.get());
+        });
+        when(cursor.getInt(BluetoothPbapVcardManager.CALLS_NUMBER_PRESENTATION_COLUMN_INDEX))
+                .then((Answer<Integer>) i -> {
+            return presentationAllowedList.get(currentPosition.get());
+        });
+
+        assertThat(mManager.loadCallHistoryList(
+                BluetoothPbapObexServer.ContentType.INCOMING_CALL_HISTORY))
+                .isEqualTo(expectedResult);
+    }
+
+    @Test
+    public void testGetPhonebookNameList() {
+        final String localPhoneName = "test_local_phone_name";
+        BluetoothPbapService.setLocalPhoneName(localPhoneName);
+
+        Cursor cursor = mock(Cursor.class);
+        doReturn(cursor).when(mPbapMethodProxy)
+                .contentResolverQuery(any(), any(), any(), any(), any(), any());
+
+        List<String> nameList = Arrays.asList("A", "B", "C", "");
+        List<Integer> contactIdList = Arrays.asList(0, 1, 2, 3);
+
+        List<String> expectedResult = Arrays.asList(
+                localPhoneName,
+                "A,0",
+                "B,1",
+                "C,2",
+                mContext.getString(android.R.string.unknownName) + ",3");
+
+        // Implement Cursor iteration
+        final int size = nameList.size();
+        AtomicInteger currentPosition = new AtomicInteger(0);
+        when(cursor.moveToPosition(anyInt())).then((Answer<Boolean>) i -> {
+            int position = i.getArgument(0);
+            currentPosition.set(position);
+            return true;
+        });
+        when(cursor.moveToNext()).then((Answer<Boolean>) i -> {
+            int pos = currentPosition.addAndGet(1);
+            return pos < size;
+        });
+
+        final int contactIdColumn = 0;
+        final int nameColumn = 1;
+        when(cursor.getColumnIndex(ContactsContract.Data.CONTACT_ID)).thenReturn(contactIdColumn);
+        when(cursor.getColumnIndex(ContactsContract.Data.DISPLAY_NAME)).thenReturn(nameColumn);
+
+        when(cursor.getLong(contactIdColumn)).then((Answer<Long>) i -> {
+            return (long) contactIdList.get(currentPosition.get());
+        });
+        when(cursor.getString(nameColumn)).then((Answer<String>) i -> {
+            return nameList.get(currentPosition.get());
+        });
+
+        assertThat(mManager.getPhonebookNameList(BluetoothPbapObexServer.ORDER_BY_ALPHABETICAL))
+                .isEqualTo(expectedResult);
+    }
+
+    @Test
+    public void testGetContactNamesByNumber_whenNumberIsNull() {
+        Cursor cursor = mock(Cursor.class);
+        doReturn(cursor).when(mPbapMethodProxy)
+                .contentResolverQuery(any(), any(), any(), any(), any(), any());
+
+        List<String> nameList = Arrays.asList("A", "B", "C", "");
+        List<Integer> contactIdList = Arrays.asList(0, 1, 2, 3);
+
+        List<String> expectedResult = Arrays.asList(
+                "A,0",
+                "B,1",
+                "C,2",
+                mContext.getString(android.R.string.unknownName) + ",3");
+
+        // Implement Cursor iteration
+        final int size = nameList.size();
+        AtomicInteger currentPosition = new AtomicInteger(0);
+        when(cursor.moveToPosition(anyInt())).then((Answer<Boolean>) i -> {
+            int position = i.getArgument(0);
+            currentPosition.set(position);
+            return true;
+        });
+        when(cursor.moveToNext()).then((Answer<Boolean>) i -> {
+            int pos = currentPosition.addAndGet(1);
+            return pos < size;
+        });
+
+        final int contactIdColumn = 0;
+        final int nameColumn = 1;
+        when(cursor.getColumnIndex(ContactsContract.Data.CONTACT_ID)).thenReturn(contactIdColumn);
+        when(cursor.getColumnIndex(ContactsContract.Data.DISPLAY_NAME)).thenReturn(nameColumn);
+
+        when(cursor.getLong(contactIdColumn)).then((Answer<Long>) i -> {
+            return (long) contactIdList.get(currentPosition.get());
+        });
+        when(cursor.getString(nameColumn)).then((Answer<String>) i -> {
+            return nameList.get(currentPosition.get());
+        });
+
+        assertThat(mManager.getContactNamesByNumber(null))
+                .isEqualTo(expectedResult);
+    }
+
+    @Test
+    public void testStripTelephoneNumber() {
+        final String separator = System.getProperty("line.separator");
+        final String vCard = "SomeRandomLine" + separator + "TEL:+1-(588)-328-382" + separator;
+        final String expectedResult = "SomeRandomLine" + separator + "TEL:+1588328382" + separator;
+
+        assertThat(mManager.stripTelephoneNumber(vCard)).isEqualTo(expectedResult);
+    }
+
+    @Test
+    public void getNameFromVCard() {
+        final String separator = System.getProperty("line.separator");
+        String vCard = "N:Test Name" + separator
+                + "FN:Test Full Name" + separator
+                + "EMAIL:android@android.com:" + separator;
+
+        assertThat(BluetoothPbapVcardManager.getNameFromVCard(vCard)).isEqualTo("Test Name");
+    }
+}
diff --git a/android/app/tests/unit/src/com/android/bluetooth/pbap/HandlerForStringBufferTest.java b/android/app/tests/unit/src/com/android/bluetooth/pbap/HandlerForStringBufferTest.java
new file mode 100644
index 0000000..3e8dd1f
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/pbap/HandlerForStringBufferTest.java
@@ -0,0 +1,128 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.pbap;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import static org.mockito.Mockito.any;
+import static org.mockito.Mockito.doThrow;
+import static org.mockito.Mockito.never;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import androidx.test.filters.SmallTest;
+import androidx.test.runner.AndroidJUnit4;
+
+import com.android.obex.Operation;
+
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.Mock;
+import org.mockito.MockitoAnnotations;
+
+import java.io.IOException;
+import java.io.OutputStream;
+
+@SmallTest
+@RunWith(AndroidJUnit4.class)
+public class HandlerForStringBufferTest {
+
+    @Mock
+    private Operation mOperation;
+
+    @Mock
+    private OutputStream mOutputStream;
+
+    @Before
+    public void setUp() throws Exception {
+        MockitoAnnotations.initMocks(this);
+        when(mOperation.openOutputStream()).thenReturn(mOutputStream);
+    }
+
+    @Test
+    public void init_withNonNullOwnerVCard_returnsTrue() throws Exception {
+        String ownerVcard = "testOwnerVcard";
+        HandlerForStringBuffer buffer = new HandlerForStringBuffer(mOperation, ownerVcard);
+
+        assertThat(buffer.init()).isTrue();
+        verify(mOutputStream).write(ownerVcard.getBytes());
+    }
+
+    @Test
+    public void init_withNullOwnerVCard_returnsTrue() throws Exception {
+        String ownerVcard = null;
+        HandlerForStringBuffer buffer = new HandlerForStringBuffer(mOperation, ownerVcard);
+
+        assertThat(buffer.init()).isTrue();
+        verify(mOutputStream, never()).write(any());
+    }
+
+    @Test
+    public void init_withIOExceptionWhenOpeningOutputStream_returnsFalse() throws Exception {
+        doThrow(new IOException()).when(mOperation).openOutputStream();
+
+        String ownerVcard = "testOwnerVcard";
+        HandlerForStringBuffer buffer = new HandlerForStringBuffer(mOperation, ownerVcard);
+
+        assertThat(buffer.init()).isFalse();
+    }
+
+    @Test
+    public void writeVCard_withNonNullOwnerVCard_returnsTrue() throws Exception {
+        String ownerVcard = null;
+        HandlerForStringBuffer buffer = new HandlerForStringBuffer(mOperation, ownerVcard);
+        buffer.init();
+
+        String newVcard = "newEntryVcard";
+
+        assertThat(buffer.writeVCard(newVcard)).isTrue();
+    }
+
+    @Test
+    public void writeVCard_withNullOwnerVCard_returnsFalse() throws Exception {
+        String ownerVcard = null;
+        HandlerForStringBuffer buffer = new HandlerForStringBuffer(mOperation, ownerVcard);
+        buffer.init();
+
+        String newVcard = null;
+
+        assertThat(buffer.writeVCard(newVcard)).isFalse();
+    }
+
+    @Test
+    public void writeVCard_withIOExceptionWhenWritingToStream_returnsFalse() throws Exception {
+        doThrow(new IOException()).when(mOutputStream).write(any(byte[].class));
+        HandlerForStringBuffer buffer = new HandlerForStringBuffer(mOperation, /*ownerVcard=*/null);
+        buffer.init();
+
+        String newVCard = "newVCard";
+
+        assertThat(buffer.writeVCard(newVCard)).isFalse();
+    }
+
+    @Test
+    public void terminate() throws Exception {
+        String ownerVcard = "testOwnerVcard";
+        HandlerForStringBuffer buffer = new HandlerForStringBuffer(mOperation, ownerVcard);
+        buffer.init();
+
+        buffer.terminate();
+
+        verify(mOutputStream).close();
+    }
+}
\ No newline at end of file
diff --git a/android/app/tests/unit/src/com/android/bluetooth/pbapclient/AuthenticationServiceTest.java b/android/app/tests/unit/src/com/android/bluetooth/pbapclient/AuthenticationServiceTest.java
new file mode 100644
index 0000000..e07a9c8
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/pbapclient/AuthenticationServiceTest.java
@@ -0,0 +1,75 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package com.android.bluetooth.pbapclient;
+
+import static android.content.pm.PackageManager.COMPONENT_ENABLED_STATE_DEFAULT;
+import static android.content.pm.PackageManager.COMPONENT_ENABLED_STATE_ENABLED;
+import static android.content.pm.PackageManager.DONT_KILL_APP;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import android.content.ComponentName;
+import android.content.Context;
+import android.content.Intent;
+
+import androidx.test.filters.MediumTest;
+import androidx.test.platform.app.InstrumentationRegistry;
+import androidx.test.rule.ServiceTestRule;
+import androidx.test.runner.AndroidJUnit4;
+
+import org.junit.After;
+import org.junit.Before;
+import org.junit.Rule;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+@MediumTest
+@RunWith(AndroidJUnit4.class)
+public class AuthenticationServiceTest {
+
+    Context mTargetContext;
+
+    @Rule
+    public final ServiceTestRule mServiceRule = new ServiceTestRule();
+
+    @Before
+    public void setUp() {
+        mTargetContext = InstrumentationRegistry.getInstrumentation().getTargetContext();
+        enableService(true);
+    }
+
+    @After
+    public void tearDown() {
+        enableService(false);
+    }
+
+    @Test
+    public void bind() throws Exception {
+        Intent intent = new Intent("android.accounts.AccountAuthenticator");
+        intent.setClass(mTargetContext, AuthenticationService.class);
+
+        assertThat(mServiceRule.bindService(intent)).isNotNull();
+    }
+
+    private void enableService(boolean enable) {
+        int enabledState = enable ? COMPONENT_ENABLED_STATE_ENABLED
+                : COMPONENT_ENABLED_STATE_DEFAULT;
+        ComponentName serviceName = new ComponentName(
+                mTargetContext, AuthenticationService.class);
+        mTargetContext.getPackageManager().setComponentEnabledSetting(
+                serviceName, enabledState, DONT_KILL_APP);
+    }
+}
diff --git a/android/app/tests/unit/src/com/android/bluetooth/pbapclient/AuthenticatorTest.java b/android/app/tests/unit/src/com/android/bluetooth/pbapclient/AuthenticatorTest.java
new file mode 100644
index 0000000..dd332ac
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/pbapclient/AuthenticatorTest.java
@@ -0,0 +1,95 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.pbapclient;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import static org.junit.Assert.assertThrows;
+
+import android.accounts.Account;
+import android.accounts.AccountAuthenticatorResponse;
+import android.accounts.AccountManager;
+import android.content.Context;
+import android.os.Bundle;
+
+import androidx.test.InstrumentationRegistry;
+import androidx.test.filters.SmallTest;
+import androidx.test.runner.AndroidJUnit4;
+
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.Mock;
+
+@SmallTest
+@RunWith(AndroidJUnit4.class)
+public class AuthenticatorTest {
+
+    private Context mTargetContext;
+    private Authenticator mAuthenticator;
+
+    @Mock
+    AccountAuthenticatorResponse mResponse;
+
+    @Mock
+    Account mAccount;
+
+    @Before
+    public void setUp() throws Exception {
+        mTargetContext = InstrumentationRegistry.getTargetContext();
+        mAuthenticator = new Authenticator(mTargetContext);
+    }
+
+    @Test
+    public void editProperties_throwsUnsupportedOperationException() {
+        assertThrows(UnsupportedOperationException.class,
+                () -> mAuthenticator.editProperties(mResponse, null));
+    }
+
+    @Test
+    public void addAccount_throwsUnsupportedOperationException() {
+        assertThrows(UnsupportedOperationException.class,
+                () -> mAuthenticator.addAccount(mResponse, null, null, null, null));
+    }
+
+    @Test
+    public void confirmCredentials_returnsNull() throws Exception {
+        assertThat(mAuthenticator.confirmCredentials(mResponse, mAccount, null)).isNull();
+    }
+
+    @Test
+    public void getAuthToken_throwsUnsupportedOperationException() {
+        assertThrows(UnsupportedOperationException.class,
+                () -> mAuthenticator.getAuthToken(mResponse, mAccount, null, null));
+    }
+
+    @Test
+    public void getAuthTokenLabel_returnsNull() {
+        assertThat(mAuthenticator.getAuthTokenLabel(null)).isNull();
+    }
+
+    @Test
+    public void updateCredentials_returnsNull() throws Exception {
+        assertThat(mAuthenticator.updateCredentials(mResponse, mAccount, null, null)).isNull();
+    }
+
+    @Test
+    public void hasFeatures_notSupported() throws Exception {
+        Bundle result = mAuthenticator.hasFeatures(mResponse, mAccount, null);
+        assertThat(result.getBoolean(AccountManager.KEY_BOOLEAN_RESULT)).isFalse();
+    }
+}
\ No newline at end of file
diff --git a/android/app/tests/unit/src/com/android/bluetooth/pbapclient/BluetoothPbapObexAuthenticatorTest.java b/android/app/tests/unit/src/com/android/bluetooth/pbapclient/BluetoothPbapObexAuthenticatorTest.java
new file mode 100644
index 0000000..1d725bb
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/pbapclient/BluetoothPbapObexAuthenticatorTest.java
@@ -0,0 +1,63 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.pbapclient;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import android.os.Handler;
+
+import androidx.test.filters.SmallTest;
+import androidx.test.runner.AndroidJUnit4;
+
+import com.android.obex.PasswordAuthentication;
+
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.Mock;
+
+@SmallTest
+@RunWith(AndroidJUnit4.class)
+public class BluetoothPbapObexAuthenticatorTest {
+
+    private BluetoothPbapObexAuthenticator mAuthenticator;
+
+    @Mock
+    Handler mHandler;
+
+    @Before
+    public void setUp() throws Exception {
+        mAuthenticator = new BluetoothPbapObexAuthenticator(mHandler);
+    }
+
+    @Test
+    public void onAuthenticationChallenge() {
+        // Note: onAuthenticationChallenge() does not use any arguments
+        PasswordAuthentication passwordAuthentication = mAuthenticator.onAuthenticationChallenge(
+                /*description=*/ null, /*isUserIdRequired=*/ false, /*isFullAccess=*/ false);
+
+        assertThat(passwordAuthentication.getPassword())
+                .isEqualTo(mAuthenticator.mSessionKey.getBytes());
+    }
+
+    @Test
+    public void onAuthenticationResponse() {
+        byte[] userName = new byte[] {};
+        // Note: onAuthenticationResponse() does not use any arguments
+        assertThat(mAuthenticator.onAuthenticationResponse(userName)).isNull();
+    }
+}
diff --git a/android/app/tests/unit/src/com/android/bluetooth/pbapclient/BluetoothPbapRequestPullPhoneBookSizeTest.java b/android/app/tests/unit/src/com/android/bluetooth/pbapclient/BluetoothPbapRequestPullPhoneBookSizeTest.java
new file mode 100644
index 0000000..68be55d
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/pbapclient/BluetoothPbapRequestPullPhoneBookSizeTest.java
@@ -0,0 +1,52 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.pbapclient;
+
+import static com.google.common.truth.Truth.assertThat;
+import static com.google.common.truth.Truth.assertWithMessage;
+
+import androidx.test.filters.SmallTest;
+import androidx.test.runner.AndroidJUnit4;
+
+import com.android.obex.HeaderSet;
+
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+@SmallTest
+@RunWith(AndroidJUnit4.class)
+public class BluetoothPbapRequestPullPhoneBookSizeTest {
+
+    BluetoothPbapRequestPullPhoneBookSize mRequest;
+
+    @Before
+    public void setUp() {
+        mRequest = new BluetoothPbapRequestPullPhoneBookSize(/*pbName=*/"phonebook", /*filter=*/1);
+    }
+
+    @Test
+    public void readResponseHeaders() {
+        try {
+            HeaderSet headerSet = new HeaderSet();
+            mRequest.readResponseHeaders(headerSet);
+            assertThat(mRequest.getSize()).isEqualTo(0);
+        } catch (Exception e) {
+            assertWithMessage("Exception should not happen.").fail();
+        }
+    }
+}
diff --git a/android/app/tests/unit/src/com/android/bluetooth/pbapclient/BluetoothPbapRequestPullPhoneBookTest.java b/android/app/tests/unit/src/com/android/bluetooth/pbapclient/BluetoothPbapRequestPullPhoneBookTest.java
new file mode 100644
index 0000000..bd56188
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/pbapclient/BluetoothPbapRequestPullPhoneBookTest.java
@@ -0,0 +1,101 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.pbapclient;
+
+import static com.google.common.truth.Truth.assertThat;
+import static com.google.common.truth.Truth.assertWithMessage;
+
+import static org.junit.Assert.assertThrows;
+import static org.mockito.Mockito.mock;
+
+import android.accounts.Account;
+
+import androidx.test.filters.SmallTest;
+import androidx.test.runner.AndroidJUnit4;
+
+import com.android.obex.HeaderSet;
+
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+import java.io.IOException;
+import java.io.InputStream;
+
+@SmallTest
+@RunWith(AndroidJUnit4.class)
+public class BluetoothPbapRequestPullPhoneBookTest {
+
+    private static final String PB_NAME = "phonebook";
+    private static final Account ACCOUNT = mock(Account.class);
+
+    @Test
+    public void constructor_wrongMaxListCount_throwsIAE() {
+        final long filter = 0;
+        final byte format = PbapClientConnectionHandler.VCARD_TYPE_30;
+        final int listStartOffset = 10;
+
+        final int wrongMaxListCount = -1;
+
+        assertThrows(IllegalArgumentException.class, () ->
+                new BluetoothPbapRequestPullPhoneBook(PB_NAME, ACCOUNT, filter, format,
+                        wrongMaxListCount, listStartOffset));
+    }
+
+    @Test
+    public void constructor_wrongListStartOffset_throwsIAE() {
+        final long filter = 0;
+        final byte format = PbapClientConnectionHandler.VCARD_TYPE_30;
+        final int maxListCount = 100;
+
+        final int wrongListStartOffset = -1;
+
+        assertThrows(IllegalArgumentException.class, () ->
+                new BluetoothPbapRequestPullPhoneBook(PB_NAME, ACCOUNT, filter, format,
+                        maxListCount, wrongListStartOffset));
+    }
+
+    @Test
+    public void readResponse_failWithMockInputStream() {
+        final long filter = 1;
+        final byte format = 0; // Will be properly handled as VCARD_TYPE_21.
+        final int maxListCount = 0; // Will be specially handled as 65535.
+        final int listStartOffset = 10;
+        BluetoothPbapRequestPullPhoneBook request = new BluetoothPbapRequestPullPhoneBook(
+                PB_NAME, ACCOUNT, filter, format, maxListCount, listStartOffset);
+
+        InputStream is = mock(InputStream.class);
+        assertThrows(IOException.class, () -> request.readResponse(is));
+    }
+
+    @Test
+    public void readResponseHeaders() {
+        final long filter = 1;
+        final byte format = 0; // Will be properly handled as VCARD_TYPE_21.
+        final int maxListCount = 0; // Will be specially handled as 65535.
+        final int listStartOffset = 10;
+        BluetoothPbapRequestPullPhoneBook request = new BluetoothPbapRequestPullPhoneBook(
+                PB_NAME, ACCOUNT, filter, format, maxListCount, listStartOffset);
+
+        try {
+            HeaderSet headerSet = new HeaderSet();
+            request.readResponseHeaders(headerSet);
+            assertThat(request.getNewMissedCalls()).isEqualTo(-1);
+        } catch (Exception e) {
+            assertWithMessage("Exception should not happen.").fail();
+        }
+    }
+}
diff --git a/android/app/tests/unit/src/com/android/bluetooth/pbapclient/BluetoothPbapRequestTest.java b/android/app/tests/unit/src/com/android/bluetooth/pbapclient/BluetoothPbapRequestTest.java
new file mode 100644
index 0000000..e258921
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/pbapclient/BluetoothPbapRequestTest.java
@@ -0,0 +1,91 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.pbapclient;
+
+import static com.google.common.truth.Truth.assertThat;
+import static com.google.common.truth.Truth.assertWithMessage;
+
+import static org.mockito.Mockito.mock;
+
+import androidx.test.filters.SmallTest;
+import androidx.test.runner.AndroidJUnit4;
+
+import com.android.obex.ClientSession;
+import com.android.obex.HeaderSet;
+import com.android.obex.ObexTransport;
+import com.android.obex.ResponseCodes;
+
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.Mock;
+import org.mockito.MockitoAnnotations;
+
+import java.io.InputStream;
+
+@SmallTest
+@RunWith(AndroidJUnit4.class)
+public class BluetoothPbapRequestTest {
+
+    private BluetoothPbapRequest mRequest = new BluetoothPbapRequest() {};
+
+    @Mock
+    private ObexTransport mObexTransport;
+
+    @Before
+    public void setUp() throws Exception {
+        MockitoAnnotations.initMocks(this);
+        mRequest = new BluetoothPbapRequest() {};
+    }
+
+    @Test
+    public void isSuccess_true() {
+        mRequest.mResponseCode = ResponseCodes.OBEX_HTTP_OK;
+
+        assertThat(mRequest.isSuccess()).isTrue();
+    }
+
+    @Test
+    public void isSuccess_false() {
+        mRequest.mResponseCode = ResponseCodes.OBEX_HTTP_INTERNAL_ERROR;
+
+        assertThat(mRequest.isSuccess()).isFalse();
+    }
+
+    @Test
+    public void execute_afterAbort() throws Exception {
+        mRequest.abort();
+        ClientSession session = new ClientSession(mObexTransport);
+        mRequest.execute(session);
+
+        assertThat(mRequest.mResponseCode).isEqualTo(ResponseCodes.OBEX_HTTP_INTERNAL_ERROR);
+    }
+
+    // TODO: Add execute_success test case.
+
+    @Test
+    public void emptyMethods() {
+        try {
+            mRequest.readResponse(mock(InputStream.class));
+            mRequest.readResponseHeaders(new HeaderSet());
+            mRequest.checkResponseCode(ResponseCodes.OBEX_HTTP_OK);
+
+        } catch (Exception e) {
+            assertWithMessage("Exception should not happen.").fail();
+        }
+    }
+}
diff --git a/android/app/tests/unit/src/com/android/bluetooth/pbapclient/BluetoothPbapVcardListTest.java b/android/app/tests/unit/src/com/android/bluetooth/pbapclient/BluetoothPbapVcardListTest.java
new file mode 100644
index 0000000..38b2045
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/pbapclient/BluetoothPbapVcardListTest.java
@@ -0,0 +1,48 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.pbapclient;
+
+import static org.junit.Assert.assertThrows;
+import static org.mockito.Mockito.mock;
+
+import android.accounts.Account;
+
+import androidx.test.filters.SmallTest;
+import androidx.test.runner.AndroidJUnit4;
+
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+import java.io.IOException;
+import java.io.InputStream;
+
+@SmallTest
+@RunWith(AndroidJUnit4.class)
+public class BluetoothPbapVcardListTest {
+
+    private static final Account ACCOUNT = mock(Account.class);
+
+    @Test
+    public void constructor_withMockInputStream_throwsIOException() {
+        InputStream is = mock(InputStream.class);
+
+        assertThrows(IOException.class, () ->
+                new BluetoothPbapVcardList(ACCOUNT, is, PbapClientConnectionHandler.VCARD_TYPE_30));
+        assertThrows(IOException.class, () ->
+                new BluetoothPbapVcardList(ACCOUNT, is, PbapClientConnectionHandler.VCARD_TYPE_21));
+    }
+}
diff --git a/android/app/tests/unit/src/com/android/bluetooth/pbapclient/CallLogPullRequestTest.java b/android/app/tests/unit/src/com/android/bluetooth/pbapclient/CallLogPullRequestTest.java
new file mode 100644
index 0000000..20d75a0
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/pbapclient/CallLogPullRequestTest.java
@@ -0,0 +1,165 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.pbapclient;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import static org.mockito.Mockito.mock;
+
+import android.accounts.Account;
+import android.content.Context;
+
+import androidx.test.filters.SmallTest;
+import androidx.test.platform.app.InstrumentationRegistry;
+import androidx.test.runner.AndroidJUnit4;
+
+import com.android.vcard.VCardConstants;
+import com.android.vcard.VCardEntry;
+import com.android.vcard.VCardProperty;
+
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+import java.util.ArrayList;
+import java.util.HashMap;
+import java.util.List;
+
+@SmallTest
+@RunWith(AndroidJUnit4.class)
+public class CallLogPullRequestTest {
+
+    private final Account mAccount = mock(Account.class);
+    private final HashMap<String, Integer> mCallCounter = new HashMap<>();
+
+    private Context mTargetContext;
+
+    @Before
+    public void setUp() {
+        mTargetContext = InstrumentationRegistry.getInstrumentation().getTargetContext();
+    }
+
+    @Test
+    public void testToString() {
+        final String path = PbapClientConnectionHandler.ICH_PATH;
+        final CallLogPullRequest request = new CallLogPullRequest(
+                mTargetContext, path, mCallCounter, mAccount);
+
+        assertThat(request.toString()).isNotEmpty();
+    }
+
+    @Test
+    public void onPullComplete_whenResultsAreNull() {
+        final String path = PbapClientConnectionHandler.ICH_PATH;
+        final CallLogPullRequest request = new CallLogPullRequest(
+                mTargetContext, path, mCallCounter, mAccount);
+        request.setResults(null);
+
+        request.onPullComplete();
+
+        // No operation has been done.
+        assertThat(mCallCounter.size()).isEqualTo(0);
+    }
+
+    @Test
+    public void onPullComplete_whenPathIsInvalid() {
+        final String invalidPath = "invalidPath";
+        final CallLogPullRequest request = new CallLogPullRequest(
+                mTargetContext, invalidPath, mCallCounter, mAccount);
+        List<VCardEntry> results = new ArrayList<>();
+        request.setResults(results);
+
+        request.onPullComplete();
+
+        // No operation has been done.
+        assertThat(mCallCounter.size()).isEqualTo(0);
+    }
+
+    @Test
+    public void onPullComplete_whenResultsAreEmpty() {
+        final String path = PbapClientConnectionHandler.ICH_PATH;
+        final CallLogPullRequest request = new CallLogPullRequest(
+                mTargetContext, path, mCallCounter, mAccount);
+        List<VCardEntry> results = new ArrayList<>();
+        request.setResults(results);
+
+        request.onPullComplete();
+
+        // Call counter should remain same.
+        assertThat(mCallCounter.size()).isEqualTo(0);
+    }
+
+    @Test
+    public void onPullComplete_whenThereIsNoPhoneProperty() {
+        final String path = PbapClientConnectionHandler.MCH_PATH;
+        final CallLogPullRequest request = new CallLogPullRequest(
+                mTargetContext, path, mCallCounter, mAccount);
+
+        // Add some property which is NOT a phone number
+        VCardProperty property = new VCardProperty();
+        property.setName(VCardConstants.PROPERTY_NOTE);
+        property.setValues("Some random note");
+
+        VCardEntry entry = new VCardEntry();
+        entry.addProperty(property);
+
+        List<VCardEntry> results = new ArrayList<>();
+        results.add(entry);
+        request.setResults(results);
+
+        request.onPullComplete();
+
+        // Call counter should remain same.
+        assertThat(mCallCounter.size()).isEqualTo(0);
+    }
+
+    @Test
+    public void onPullComplete_success() {
+        final String path = PbapClientConnectionHandler.OCH_PATH;
+        final CallLogPullRequest request = new CallLogPullRequest(
+                mTargetContext, path, mCallCounter, mAccount);
+        List<VCardEntry> results = new ArrayList<>();
+
+        final String phoneNum = "tel:0123456789";
+
+        VCardEntry entry1 = new VCardEntry();
+        entry1.addProperty(createProperty(VCardConstants.PROPERTY_TEL, phoneNum));
+        results.add(entry1);
+
+        VCardEntry entry2 = new VCardEntry();
+        entry2.addProperty(createProperty(VCardConstants.PROPERTY_TEL, phoneNum));
+        entry2.addProperty(
+                createProperty(CallLogPullRequest.TIMESTAMP_PROPERTY, "20220914T143305"));
+        results.add(entry2);
+        request.setResults(results);
+
+        request.onPullComplete();
+
+        assertThat(mCallCounter.size()).isEqualTo(1);
+        for (String key : mCallCounter.keySet()) {
+            assertThat(mCallCounter.get(key)).isEqualTo(2);
+            break;
+        }
+    }
+
+    private VCardProperty createProperty(String name, String value) {
+        VCardProperty property = new VCardProperty();
+        property.setName(name);
+        property.setValues(value);
+        return property;
+    }
+}
diff --git a/android/app/tests/unit/src/com/android/bluetooth/pbapclient/PbapClientConnectionHandlerTest.java b/android/app/tests/unit/src/com/android/bluetooth/pbapclient/PbapClientConnectionHandlerTest.java
new file mode 100644
index 0000000..1b4f5aa
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/pbapclient/PbapClientConnectionHandlerTest.java
@@ -0,0 +1,200 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.pbapclient;
+
+import static com.google.common.truth.Truth.assertThat;
+import static com.google.common.truth.Truth.assertWithMessage;
+
+import static org.mockito.ArgumentMatchers.anyString;
+import static org.mockito.Mockito.doReturn;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.spy;
+import static org.mockito.Mockito.when;
+
+import android.accounts.Account;
+import android.bluetooth.BluetoothAdapter;
+import android.bluetooth.BluetoothDevice;
+import android.bluetooth.SdpPseRecord;
+import android.content.ContentResolver;
+import android.content.Context;
+import android.content.ContextWrapper;
+import android.os.HandlerThread;
+import android.os.Looper;
+
+import androidx.test.filters.SmallTest;
+import androidx.test.platform.app.InstrumentationRegistry;
+import androidx.test.rule.ServiceTestRule;
+import androidx.test.runner.AndroidJUnit4;
+
+import com.android.bluetooth.TestUtils;
+import com.android.bluetooth.btservice.AdapterService;
+import com.android.bluetooth.btservice.storage.DatabaseManager;
+
+import org.junit.After;
+import org.junit.Assume;
+import org.junit.Before;
+import org.junit.Rule;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.Mock;
+import org.mockito.MockitoAnnotations;
+
+@SmallTest
+@RunWith(AndroidJUnit4.class)
+public class PbapClientConnectionHandlerTest {
+
+    private static final String TAG = "ConnHandlerTest";
+    private static final String REMOTE_DEVICE_ADDRESS = "00:00:00:00:00:00";
+
+    private HandlerThread mThread;
+    private Looper mLooper;
+    private Context mTargetContext;
+    private BluetoothDevice mRemoteDevice;
+
+    @Rule
+    public final ServiceTestRule mServiceRule = new ServiceTestRule();
+
+    @Mock
+    private AdapterService mAdapterService;
+
+    @Mock
+    private DatabaseManager mDatabaseManager;
+
+    private BluetoothAdapter mAdapter;
+
+    private PbapClientService mService;
+
+    private PbapClientStateMachine mStateMachine;
+
+    private PbapClientConnectionHandler mHandler;
+
+    @Before
+    public void setUp() throws Exception {
+        mTargetContext = spy(new ContextWrapper(
+                InstrumentationRegistry.getInstrumentation().getTargetContext()));
+        Assume.assumeTrue("Ignore test when PbapClientService is not enabled",
+                PbapClientService.isEnabled());
+        MockitoAnnotations.initMocks(this);
+        TestUtils.setAdapterService(mAdapterService);
+        doReturn(mDatabaseManager).when(mAdapterService).getDatabase();
+        doReturn(true, false).when(mAdapterService)
+                .isStartedProfile(anyString());
+        TestUtils.startService(mServiceRule, PbapClientService.class);
+        mService = PbapClientService.getPbapClientService();
+        assertThat(mService).isNotNull();
+
+        mAdapter = BluetoothAdapter.getDefaultAdapter();
+
+        mThread = new HandlerThread("test_handler_thread");
+        mThread.start();
+        mLooper = mThread.getLooper();
+        mRemoteDevice = mAdapter.getRemoteDevice(REMOTE_DEVICE_ADDRESS);
+
+        mStateMachine = new PbapClientStateMachine(mService, mRemoteDevice);
+        mHandler = new PbapClientConnectionHandler.Builder()
+                .setLooper(mLooper)
+                .setClientSM(mStateMachine)
+                .setContext(mTargetContext)
+                .setRemoteDevice(mRemoteDevice)
+                .build();
+    }
+
+    @After
+    public void tearDown() throws Exception {
+        if (!PbapClientService.isEnabled()) {
+            return;
+        }
+        TestUtils.stopService(mServiceRule, PbapClientService.class);
+        mService = PbapClientService.getPbapClientService();
+        assertThat(mService).isNull();
+        TestUtils.clearAdapterService(mAdapterService);
+        mLooper.quit();
+    }
+
+    @Test
+    public void connectSocket_whenBluetoothIsNotEnabled_returnsFalse() {
+        assertThat(mHandler.connectSocket()).isFalse();
+    }
+
+    @Test
+    public void connectSocket_whenBluetoothIsNotEnabled_returnsFalse_withInvalidL2capPsm() {
+        SdpPseRecord record = mock(SdpPseRecord.class);
+        mHandler.setPseRecord(record);
+
+        when(record.getL2capPsm()).thenReturn(PbapClientConnectionHandler.L2CAP_INVALID_PSM);
+        assertThat(mHandler.connectSocket()).isFalse();
+    }
+
+    @Test
+    public void connectSocket_whenBluetoothIsNotEnabled_returnsFalse_withValidL2capPsm() {
+        SdpPseRecord record = mock(SdpPseRecord.class);
+        mHandler.setPseRecord(record);
+
+        when(record.getL2capPsm()).thenReturn(1); // Valid PSM ranges 1 to 30;
+        assertThat(mHandler.connectSocket()).isFalse();
+    }
+
+    // TODO: Add connectObexSession_returnsTrue
+
+    @Test
+    public void connectObexSession_returnsFalse_withoutConnectingSocket() {
+        assertThat(mHandler.connectObexSession()).isFalse();
+    }
+
+    @Test
+    public void abort() {
+        SdpPseRecord record = mock(SdpPseRecord.class);
+        when(record.getL2capPsm()).thenReturn(1); // Valid PSM ranges 1 to 30;
+        mHandler.setPseRecord(record);
+        mHandler.connectSocket(); // Workaround for setting mSocket as non-null value
+        assertThat(mHandler.getSocket()).isNotNull();
+
+        mHandler.abort();
+
+        assertThat(mThread.isInterrupted()).isTrue();
+        assertThat(mHandler.getSocket()).isNull();
+    }
+
+    @Test
+    public void removeCallLog_doesNotCrash() {
+        ContentResolver res = mock(ContentResolver.class);
+        when(mTargetContext.getContentResolver()).thenReturn(res);
+        mHandler.removeCallLog();
+
+        // Also test when content resolver is null.
+        when(mTargetContext.getContentResolver()).thenReturn(null);
+        mHandler.removeCallLog();
+    }
+
+    @Test
+    public void isRepositorySupported_withoutSettingPseRecord_returnsFalse() {
+        mHandler.setPseRecord(null);
+        final int mask = 0x11;
+
+        assertThat(mHandler.isRepositorySupported(mask)).isFalse();
+    }
+
+    @Test
+    public void isRepositorySupported_withSettingPseRecord() {
+        SdpPseRecord record = mock(SdpPseRecord.class);
+        when(record.getSupportedRepositories()).thenReturn(1);
+        mHandler.setPseRecord(record);
+        final int mask = 0x11;
+
+        assertThat(mHandler.isRepositorySupported(mask)).isTrue();
+    }
+}
diff --git a/android/app/tests/unit/src/com/android/bluetooth/pbapclient/PbapClientServiceTest.java b/android/app/tests/unit/src/com/android/bluetooth/pbapclient/PbapClientServiceTest.java
index 4ddd9f2..53aaeb0 100644
--- a/android/app/tests/unit/src/com/android/bluetooth/pbapclient/PbapClientServiceTest.java
+++ b/android/app/tests/unit/src/com/android/bluetooth/pbapclient/PbapClientServiceTest.java
@@ -15,21 +15,36 @@
  */
 package com.android.bluetooth.pbapclient;
 
+import static com.google.common.truth.Truth.assertThat;
+
+import static org.junit.Assert.assertThrows;
+import static org.mockito.Mockito.any;
 import static org.mockito.Mockito.anyString;
 import static org.mockito.Mockito.doReturn;
+import static org.mockito.Mockito.eq;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.spy;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
 
 import android.bluetooth.BluetoothAdapter;
+import android.bluetooth.BluetoothDevice;
+import android.bluetooth.BluetoothHeadsetClient;
+import android.bluetooth.BluetoothProfile;
 import android.content.Context;
+import android.content.Intent;
+import android.provider.CallLog;
 
 import androidx.test.InstrumentationRegistry;
 import androidx.test.filters.MediumTest;
 import androidx.test.rule.ServiceTestRule;
 import androidx.test.runner.AndroidJUnit4;
 
-import com.android.bluetooth.R;
+import com.android.bluetooth.BluetoothMethodProxy;
 import com.android.bluetooth.TestUtils;
 import com.android.bluetooth.btservice.AdapterService;
 import com.android.bluetooth.btservice.storage.DatabaseManager;
+import com.android.bluetooth.x.com.android.modules.utils.SynchronousResultReceiver;
 
 import org.junit.After;
 import org.junit.Assert;
@@ -38,15 +53,19 @@
 import org.junit.Rule;
 import org.junit.Test;
 import org.junit.runner.RunWith;
+import org.mockito.ArgumentCaptor;
 import org.mockito.Mock;
 import org.mockito.MockitoAnnotations;
 
 @MediumTest
 @RunWith(AndroidJUnit4.class)
 public class PbapClientServiceTest {
+    private static final String REMOTE_DEVICE_ADDRESS = "00:00:00:00:00:00";
+
     private PbapClientService mService = null;
     private BluetoothAdapter mAdapter = null;
     private Context mTargetContext;
+    private BluetoothDevice mRemoteDevice;
 
     @Rule public final ServiceTestRule mServiceRule = new ServiceTestRule();
 
@@ -69,6 +88,7 @@
         // Try getting the Bluetooth adapter
         mAdapter = BluetoothAdapter.getDefaultAdapter();
         Assert.assertNotNull(mAdapter);
+        mRemoteDevice = mAdapter.getRemoteDevice(REMOTE_DEVICE_ADDRESS);
     }
 
     @After
@@ -80,10 +100,260 @@
         mService = PbapClientService.getPbapClientService();
         Assert.assertNull(mService);
         TestUtils.clearAdapterService(mAdapterService);
+        BluetoothMethodProxy.setInstanceForTesting(null);
     }
 
     @Test
     public void testInitialize() {
         Assert.assertNotNull(PbapClientService.getPbapClientService());
     }
+
+    @Test
+    public void testSetPbapClientService_withNull() {
+        PbapClientService.setPbapClientService(null);
+
+        assertThat(PbapClientService.getPbapClientService()).isNull();
+    }
+
+    @Test
+    public void dump_callsStateMachineDump() {
+        PbapClientStateMachine sm = mock(PbapClientStateMachine.class);
+        mService.mPbapClientStateMachineMap.put(mRemoteDevice, sm);
+        StringBuilder builder = new StringBuilder();
+
+        mService.dump(builder);
+
+        verify(sm).dump(builder);
+    }
+
+    @Test
+    public void testSetConnectionPolicy_withNullDevice_throwsIAE() {
+        assertThrows(IllegalArgumentException.class, () -> mService.setConnectionPolicy(
+                null, BluetoothProfile.CONNECTION_POLICY_ALLOWED));
+    }
+
+    @Test
+    public void testSetConnectionPolicy() {
+        int connectionPolicy = BluetoothProfile.CONNECTION_POLICY_UNKNOWN;
+        when(mDatabaseManager.setProfileConnectionPolicy(
+                mRemoteDevice, BluetoothProfile.PBAP_CLIENT, connectionPolicy)).thenReturn(true);
+
+        assertThat(mService.setConnectionPolicy(mRemoteDevice, connectionPolicy)).isTrue();
+    }
+
+    @Test
+    public void testGetConnectionPolicy_withNullDevice_throwsIAE() {
+        assertThrows(IllegalArgumentException.class, () -> mService.getConnectionPolicy(null));
+    }
+
+    @Test
+    public void testGetConnectionPolicy() {
+        int connectionPolicy = BluetoothProfile.CONNECTION_POLICY_ALLOWED;
+        when(mDatabaseManager.getProfileConnectionPolicy(
+                mRemoteDevice, BluetoothProfile.PBAP_CLIENT)).thenReturn(connectionPolicy);
+
+        assertThat(mService.getConnectionPolicy(mRemoteDevice)).isEqualTo(connectionPolicy);
+    }
+
+    @Test
+    public void testConnect_withNullDevice_throwsIAE() {
+        assertThrows(IllegalArgumentException.class, () -> mService.connect(null));
+    }
+
+    @Test
+    public void testConnect_whenPolicyIsForbidden_returnsFalse() {
+        int connectionPolicy = BluetoothProfile.CONNECTION_POLICY_FORBIDDEN;
+        when(mDatabaseManager.getProfileConnectionPolicy(
+                mRemoteDevice, BluetoothProfile.PBAP_CLIENT)).thenReturn(connectionPolicy);
+
+        assertThat(mService.connect(mRemoteDevice)).isFalse();
+    }
+
+    @Test
+    public void testConnect_whenPolicyIsAllowed_returnsTrue() {
+        int connectionPolicy = BluetoothProfile.CONNECTION_POLICY_ALLOWED;
+        when(mDatabaseManager.getProfileConnectionPolicy(
+                mRemoteDevice, BluetoothProfile.PBAP_CLIENT)).thenReturn(connectionPolicy);
+
+        assertThat(mService.connect(mRemoteDevice)).isTrue();
+    }
+
+    @Test
+    public void testDisconnect_withNullDevice_throwsIAE() {
+        assertThrows(IllegalArgumentException.class, () -> mService.disconnect(null));
+    }
+
+    @Test
+    public void testDisconnect_whenNotConnected_returnsFalse() {
+        assertThat(mService.disconnect(mRemoteDevice)).isFalse();
+    }
+
+    @Test
+    public void testDisconnect_whenConnected_returnsTrue() {
+        PbapClientStateMachine sm = mock(PbapClientStateMachine.class);
+        mService.mPbapClientStateMachineMap.put(mRemoteDevice, sm);
+
+        assertThat(mService.disconnect(mRemoteDevice)).isTrue();
+
+        verify(sm).disconnect(mRemoteDevice);
+    }
+
+    @Test
+    public void testGetConnectionState_whenNotConnected() {
+        assertThat(mService.getConnectionState(mRemoteDevice))
+                .isEqualTo(BluetoothProfile.STATE_DISCONNECTED);
+    }
+
+    @Test
+    public void cleanUpDevice() {
+        PbapClientStateMachine sm = mock(PbapClientStateMachine.class);
+        mService.mPbapClientStateMachineMap.put(mRemoteDevice, sm);
+
+        mService.cleanupDevice(mRemoteDevice);
+
+        assertThat(mService.mPbapClientStateMachineMap).doesNotContainKey(mRemoteDevice);
+    }
+
+    @Test
+    public void getConnectedDevices() {
+        int connectionState = BluetoothProfile.STATE_CONNECTED;
+        PbapClientStateMachine sm = mock(PbapClientStateMachine.class);
+        mService.mPbapClientStateMachineMap.put(mRemoteDevice, sm);
+        when(sm.getConnectionState()).thenReturn(connectionState);
+
+        assertThat(mService.getConnectedDevices()).contains(mRemoteDevice);
+    }
+
+    @Test
+    public void binder_connect_callsServiceMethod() {
+        PbapClientService mockService = mock(PbapClientService.class);
+        PbapClientService.BluetoothPbapClientBinder binder =
+                new PbapClientService.BluetoothPbapClientBinder(mockService);
+
+        binder.connect(mRemoteDevice, null, SynchronousResultReceiver.get());
+
+        verify(mockService).connect(mRemoteDevice);
+    }
+
+    @Test
+    public void binder_disconnect_callsServiceMethod() {
+        PbapClientService mockService = mock(PbapClientService.class);
+        PbapClientService.BluetoothPbapClientBinder binder =
+                new PbapClientService.BluetoothPbapClientBinder(mockService);
+
+        binder.disconnect(mRemoteDevice, null, SynchronousResultReceiver.get());
+
+        verify(mockService).disconnect(mRemoteDevice);
+    }
+
+    @Test
+    public void binder_getConnectedDevices_callsServiceMethod() {
+        PbapClientService mockService = mock(PbapClientService.class);
+        PbapClientService.BluetoothPbapClientBinder binder =
+                new PbapClientService.BluetoothPbapClientBinder(mockService);
+
+        binder.getConnectedDevices(null, SynchronousResultReceiver.get());
+
+        verify(mockService).getConnectedDevices();
+    }
+
+    @Test
+    public void binder_getDevicesMatchingConnectionStates_callsServiceMethod() {
+        PbapClientService mockService = mock(PbapClientService.class);
+        PbapClientService.BluetoothPbapClientBinder binder =
+                new PbapClientService.BluetoothPbapClientBinder(mockService);
+
+        int[] states = new int[] {BluetoothProfile.STATE_CONNECTED};
+        binder.getDevicesMatchingConnectionStates(states, null, SynchronousResultReceiver.get());
+
+        verify(mockService).getDevicesMatchingConnectionStates(states);
+    }
+
+    @Test
+    public void binder_getConnectionState_callsServiceMethod() {
+        PbapClientService mockService = mock(PbapClientService.class);
+        PbapClientService.BluetoothPbapClientBinder binder =
+                new PbapClientService.BluetoothPbapClientBinder(mockService);
+
+        binder.getConnectionState(mRemoteDevice, null, SynchronousResultReceiver.get());
+
+        verify(mockService).getConnectionState(mRemoteDevice);
+    }
+
+    @Test
+    public void binder_setConnectionPolicy_callsServiceMethod() {
+        PbapClientService mockService = mock(PbapClientService.class);
+        PbapClientService.BluetoothPbapClientBinder binder =
+                new PbapClientService.BluetoothPbapClientBinder(mockService);
+
+        int connectionPolicy = BluetoothProfile.CONNECTION_POLICY_ALLOWED;
+        binder.setConnectionPolicy(mRemoteDevice, connectionPolicy,
+                null, SynchronousResultReceiver.get());
+
+        verify(mockService).setConnectionPolicy(mRemoteDevice, connectionPolicy);
+    }
+
+    @Test
+    public void binder_getConnectionPolicy_callsServiceMethod() {
+        PbapClientService mockService = mock(PbapClientService.class);
+        PbapClientService.BluetoothPbapClientBinder binder =
+                new PbapClientService.BluetoothPbapClientBinder(mockService);
+
+        binder.getConnectionPolicy(mRemoteDevice, null, SynchronousResultReceiver.get());
+
+        verify(mockService).getConnectionPolicy(mRemoteDevice);
+    }
+
+    @Test
+    public void binder_cleanUp_doesNotCrash() {
+        PbapClientService mockService = mock(PbapClientService.class);
+        PbapClientService.BluetoothPbapClientBinder binder =
+                new PbapClientService.BluetoothPbapClientBinder(mockService);
+
+        binder.cleanup();
+    }
+
+    @Test
+    public void broadcastReceiver_withActionAclDisconnected_callsDisconnect() {
+        int connectionState = BluetoothProfile.STATE_CONNECTED;
+        PbapClientStateMachine sm = mock(PbapClientStateMachine.class);
+        mService.mPbapClientStateMachineMap.put(mRemoteDevice, sm);
+        when(sm.getConnectionState(mRemoteDevice)).thenReturn(connectionState);
+
+        Intent intent = new Intent(BluetoothDevice.ACTION_ACL_DISCONNECTED);
+        intent.putExtra(BluetoothDevice.EXTRA_DEVICE, mRemoteDevice);
+        mService.mPbapBroadcastReceiver.onReceive(mService, intent);
+
+        verify(sm).disconnect(mRemoteDevice);
+    }
+
+    @Test
+    public void broadcastReceiver_withActionUserUnlocked_callsTryDownloadIfConnected() {
+        PbapClientStateMachine sm = mock(PbapClientStateMachine.class);
+        mService.mPbapClientStateMachineMap.put(mRemoteDevice, sm);
+
+        Intent intent = new Intent(Intent.ACTION_USER_UNLOCKED);
+        intent.putExtra(BluetoothDevice.EXTRA_DEVICE, mRemoteDevice);
+        mService.mPbapBroadcastReceiver.onReceive(mService, intent);
+
+        verify(sm).tryDownloadIfConnected();
+    }
+
+    @Test
+    public void broadcastReceiver_withActionHeadsetClientConnectionStateChanged() {
+        BluetoothMethodProxy methodProxy = spy(BluetoothMethodProxy.getInstance());
+        BluetoothMethodProxy.setInstanceForTesting(methodProxy);
+
+        Intent intent = new Intent(BluetoothHeadsetClient.ACTION_CONNECTION_STATE_CHANGED);
+        intent.putExtra(BluetoothDevice.EXTRA_DEVICE, mRemoteDevice);
+        intent.putExtra(BluetoothProfile.EXTRA_STATE, BluetoothProfile.STATE_DISCONNECTED);
+        mService.mPbapBroadcastReceiver.onReceive(mService, intent);
+
+        ArgumentCaptor<Object> selectionArgsCaptor = ArgumentCaptor.forClass(Object.class);
+        verify(methodProxy).contentResolverDelete(any(), eq(CallLog.Calls.CONTENT_URI), any(),
+                (String[]) selectionArgsCaptor.capture());
+
+        assertThat(((String[]) selectionArgsCaptor.getValue())[0])
+                .isEqualTo(mRemoteDevice.getAddress());
+    }
 }
diff --git a/android/app/tests/unit/src/com/android/bluetooth/pbapclient/PhonebookPullRequestTest.java b/android/app/tests/unit/src/com/android/bluetooth/pbapclient/PhonebookPullRequestTest.java
new file mode 100644
index 0000000..342485c
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/pbapclient/PhonebookPullRequestTest.java
@@ -0,0 +1,91 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.pbapclient;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import static org.mockito.Mockito.mock;
+
+import android.accounts.Account;
+import android.content.Context;
+
+import androidx.test.filters.SmallTest;
+import androidx.test.platform.app.InstrumentationRegistry;
+import androidx.test.runner.AndroidJUnit4;
+
+import com.android.vcard.VCardConstants;
+import com.android.vcard.VCardEntry;
+import com.android.vcard.VCardProperty;
+
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+import java.util.ArrayList;
+import java.util.List;
+
+@SmallTest
+@RunWith(AndroidJUnit4.class)
+public class PhonebookPullRequestTest {
+
+    private PhonebookPullRequest mRequest;
+    private Context mTargetContext;
+
+    @Before
+    public void setUp() {
+        mTargetContext = InstrumentationRegistry.getInstrumentation().getTargetContext();
+        mRequest = new PhonebookPullRequest(mTargetContext, mock(Account.class));
+    }
+
+    @Test
+    public void onPullComplete_whenResultsAreNull() {
+        mRequest.setResults(null);
+
+        mRequest.onPullComplete();
+
+        // No operation has been done.
+        assertThat(mRequest.complete).isFalse();
+    }
+
+    @Test
+    public void onPullComplete_success() {
+        List<VCardEntry> results = new ArrayList<>();
+        results.add(createEntry(200));
+        results.add(createEntry(200));
+        results.add(createEntry(PhonebookPullRequest.MAX_OPS));
+        mRequest.setResults(results);
+
+        mRequest.onPullComplete();
+
+        assertThat(mRequest.complete).isTrue();
+    }
+
+    private VCardProperty createProperty(String name, String value) {
+        VCardProperty property = new VCardProperty();
+        property.setName(name);
+        property.setValues(value);
+        return property;
+    }
+
+    private VCardEntry createEntry(int propertyCount) {
+        VCardEntry entry = new VCardEntry();
+        for (int i = 0; i < propertyCount; i++) {
+            entry.addProperty(createProperty(VCardConstants.PROPERTY_TEL, Integer.toString(i)));
+        }
+        return entry;
+    }
+}
diff --git a/android/app/tests/unit/src/com/android/bluetooth/sap/SapMessageTest.java b/android/app/tests/unit/src/com/android/bluetooth/sap/SapMessageTest.java
new file mode 100644
index 0000000..55cf35f
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/sap/SapMessageTest.java
@@ -0,0 +1,274 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.sap;
+
+import static com.android.bluetooth.sap.SapMessage.CON_STATUS_OK;
+import static com.android.bluetooth.sap.SapMessage.DISC_GRACEFULL;
+import static com.android.bluetooth.sap.SapMessage.ID_CONNECT_REQ;
+import static com.android.bluetooth.sap.SapMessage.ID_DISCONNECT_REQ;
+import static com.android.bluetooth.sap.SapMessage.ID_POWER_SIM_OFF_REQ;
+import static com.android.bluetooth.sap.SapMessage.ID_POWER_SIM_ON_REQ;
+import static com.android.bluetooth.sap.SapMessage.ID_RESET_SIM_REQ;
+import static com.android.bluetooth.sap.SapMessage.ID_SET_TRANSPORT_PROTOCOL_REQ;
+import static com.android.bluetooth.sap.SapMessage.ID_TRANSFER_APDU_REQ;
+import static com.android.bluetooth.sap.SapMessage.ID_TRANSFER_ATR_REQ;
+import static com.android.bluetooth.sap.SapMessage.ID_TRANSFER_CARD_READER_STATUS_REQ;
+import static com.android.bluetooth.sap.SapMessage.RESULT_OK;
+import static com.android.bluetooth.sap.SapMessage.STATUS_CARD_INSERTED;
+import static com.android.bluetooth.sap.SapMessage.TEST_MODE_ENABLE;
+import static com.android.bluetooth.sap.SapMessage.TRANS_PROTO_T0;
+import static com.android.bluetooth.sap.SapMessage.TRANS_PROTO_T1;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import static org.junit.Assert.assertThrows;
+import static org.mockito.Mockito.any;
+import static org.mockito.Mockito.anyInt;
+import static org.mockito.Mockito.eq;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.verify;
+
+import android.hardware.radio.V1_0.ISap;
+import android.hardware.radio.V1_0.SapTransferProtocol;
+
+import androidx.test.filters.SmallTest;
+import androidx.test.runner.AndroidJUnit4;
+
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.Mockito;
+
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+
+@SmallTest
+@RunWith(AndroidJUnit4.class)
+public class SapMessageTest {
+
+    private SapMessage mMessage;
+
+    @Before
+    public void setUp() throws Exception {
+        mMessage = new SapMessage(ID_CONNECT_REQ);
+    }
+
+    @Test
+    public void settersAndGetters() {
+        int msgType = ID_CONNECT_REQ;
+        int maxMsgSize = 512;
+        int connectionStatus = CON_STATUS_OK;
+        int resultCode = RESULT_OK;
+        int disconnectionType = DISC_GRACEFULL;
+        int cardReaderStatus = STATUS_CARD_INSERTED;
+        int statusChange = 1;
+        int transportProtocol = TRANS_PROTO_T0;
+        byte[] apdu = new byte[] {0x01, 0x02};
+        byte[] apdu7816 = new byte[] {0x03, 0x04};
+        byte[] apduResp = new byte[] {0x05, 0x06};
+        byte[] atr = new byte[] {0x07, 0x08};
+        boolean sendToRil = true;
+        boolean clearRilQueue = true;
+        int testMode = TEST_MODE_ENABLE;
+
+        mMessage.setMsgType(msgType);
+        mMessage.setMaxMsgSize(maxMsgSize);
+        mMessage.setConnectionStatus(connectionStatus);
+        mMessage.setResultCode(resultCode);
+        mMessage.setDisconnectionType(disconnectionType);
+        mMessage.setCardReaderStatus(cardReaderStatus);
+        mMessage.setStatusChange(statusChange);
+        mMessage.setTransportProtocol(transportProtocol);
+        mMessage.setApdu(apdu);
+        mMessage.setApdu7816(apdu7816);
+        mMessage.setApduResp(apduResp);
+        mMessage.setAtr(atr);
+        mMessage.setSendToRil(sendToRil);
+        mMessage.setClearRilQueue(clearRilQueue);
+        mMessage.setTestMode(testMode);
+
+        assertThat(mMessage.getMsgType()).isEqualTo(msgType);
+        assertThat(mMessage.getMaxMsgSize()).isEqualTo(maxMsgSize);
+        assertThat(mMessage.getConnectionStatus()).isEqualTo(connectionStatus);
+        assertThat(mMessage.getResultCode()).isEqualTo(resultCode);
+        assertThat(mMessage.getDisconnectionType()).isEqualTo(disconnectionType);
+        assertThat(mMessage.getCardReaderStatus()).isEqualTo(cardReaderStatus);
+        assertThat(mMessage.getStatusChange()).isEqualTo(statusChange);
+        assertThat(mMessage.getTransportProtocol()).isEqualTo(transportProtocol);
+        assertThat(mMessage.getApdu()).isEqualTo(apdu);
+        assertThat(mMessage.getApdu7816()).isEqualTo(apdu7816);
+        assertThat(mMessage.getApduResp()).isEqualTo(apduResp);
+        assertThat(mMessage.getAtr()).isEqualTo(atr);
+        assertThat(mMessage.getSendToRil()).isEqualTo(sendToRil);
+        assertThat(mMessage.getClearRilQueue()).isEqualTo(clearRilQueue);
+        assertThat(mMessage.getTestMode()).isEqualTo(testMode);
+    }
+
+    @Test
+    public void getParamCount() {
+        int paramCount = 3;
+
+        mMessage.setMaxMsgSize(512);
+        mMessage.setConnectionStatus(CON_STATUS_OK);
+        mMessage.setResultCode(RESULT_OK);
+
+        assertThat(mMessage.getParamCount()).isEqualTo(paramCount);
+    }
+
+    @Test
+    public void getNumPendingRilMessages() {
+        SapMessage.sOngoingRequests.put(/*rilSerial=*/10000, ID_CONNECT_REQ);
+        assertThat(SapMessage.getNumPendingRilMessages()).isEqualTo(1);
+
+        SapMessage.resetPendingRilMessages();
+        assertThat(SapMessage.getNumPendingRilMessages()).isEqualTo(0);
+    }
+
+    @Test
+    public void writeAndRead() throws Exception {
+        int msgType = ID_CONNECT_REQ;
+        int maxMsgSize = 512;
+        int connectionStatus = CON_STATUS_OK;
+        int resultCode = RESULT_OK;
+        int disconnectionType = DISC_GRACEFULL;
+        int cardReaderStatus = STATUS_CARD_INSERTED;
+        int statusChange = 1;
+        int transportProtocol = TRANS_PROTO_T0;
+        byte[] apdu = new byte[] {0x01, 0x02};
+        byte[] apdu7816 = new byte[] {0x03, 0x04};
+        byte[] apduResp = new byte[] {0x05, 0x06};
+        byte[] atr = new byte[] {0x07, 0x08};
+
+        mMessage.setMsgType(msgType);
+        mMessage.setMaxMsgSize(maxMsgSize);
+        mMessage.setConnectionStatus(connectionStatus);
+        mMessage.setResultCode(resultCode);
+        mMessage.setDisconnectionType(disconnectionType);
+        mMessage.setCardReaderStatus(cardReaderStatus);
+        mMessage.setStatusChange(statusChange);
+        mMessage.setTransportProtocol(transportProtocol);
+        mMessage.setApdu(apdu);
+        mMessage.setApdu7816(apdu7816);
+        mMessage.setApduResp(apduResp);
+        mMessage.setAtr(atr);
+
+        ByteArrayOutputStream os = new ByteArrayOutputStream();
+        mMessage.write(os);
+
+        // Now, reconstruct the message from the written data.
+        byte[] data = os.toByteArray();
+        ByteArrayInputStream is = new ByteArrayInputStream(data);
+        int msgTypeReadFromStream = is.read();
+        SapMessage msgFromInputStream = SapMessage.readMessage(msgTypeReadFromStream, is);
+
+        assertThat(msgFromInputStream.getMsgType()).isEqualTo(msgType);
+        assertThat(msgFromInputStream.getMaxMsgSize()).isEqualTo(maxMsgSize);
+        assertThat(msgFromInputStream.getConnectionStatus()).isEqualTo(connectionStatus);
+        assertThat(msgFromInputStream.getResultCode()).isEqualTo(resultCode);
+        assertThat(msgFromInputStream.getDisconnectionType()).isEqualTo(disconnectionType);
+        assertThat(msgFromInputStream.getCardReaderStatus()).isEqualTo(cardReaderStatus);
+        assertThat(msgFromInputStream.getStatusChange()).isEqualTo(statusChange);
+        assertThat(msgFromInputStream.getTransportProtocol()).isEqualTo(transportProtocol);
+        assertThat(msgFromInputStream.getApdu()).isEqualTo(apdu);
+        assertThat(msgFromInputStream.getApdu7816()).isEqualTo(apdu7816);
+        assertThat(msgFromInputStream.getApduResp()).isEqualTo(apduResp);
+        assertThat(msgFromInputStream.getAtr()).isEqualTo(atr);
+    }
+
+    // TODO: Add test for newInstance()
+    // Note: MsgHeader throws a NoSuchMethodError when MsgHeader.getType() is called,
+    //       which prevents writing tests for newInstance. Possibly a bug with protobuf?
+
+    @Test
+    public void send() throws Exception {
+        int maxMsgSize = 512;
+        byte[] apdu = new byte[] {0x01, 0x02};
+        byte[] apdu7816 = new byte[] {0x03, 0x04};
+
+        ISap sapProxy = mock(ISap.class);
+        mMessage.setClearRilQueue(true);
+
+        mMessage.setMsgType(ID_CONNECT_REQ);
+        mMessage.setMaxMsgSize(maxMsgSize);
+        mMessage.send(sapProxy);
+        verify(sapProxy).connectReq(anyInt(), eq(maxMsgSize));
+        Mockito.clearInvocations(sapProxy);
+
+        mMessage.setMsgType(ID_DISCONNECT_REQ);
+        mMessage.send(sapProxy);
+        verify(sapProxy).disconnectReq(anyInt());
+        Mockito.clearInvocations(sapProxy);
+
+        mMessage.setMsgType(ID_TRANSFER_APDU_REQ);
+        mMessage.setApdu(apdu);
+        mMessage.send(sapProxy);
+        verify(sapProxy).apduReq(anyInt(), anyInt(), any());
+        Mockito.clearInvocations(sapProxy);
+
+        mMessage.setMsgType(ID_TRANSFER_APDU_REQ);
+        mMessage.setApdu(null);
+        mMessage.setApdu7816(apdu7816);
+        mMessage.send(sapProxy);
+        verify(sapProxy).apduReq(anyInt(), anyInt(), any());
+        Mockito.clearInvocations(sapProxy);
+
+        mMessage.setMsgType(ID_TRANSFER_APDU_REQ);
+        mMessage.setApdu(null);
+        mMessage.setApdu7816(null);
+        assertThrows(IllegalArgumentException.class, () -> mMessage.send(sapProxy));
+
+        mMessage.setMsgType(ID_SET_TRANSPORT_PROTOCOL_REQ);
+        mMessage.setTransportProtocol(TRANS_PROTO_T0);
+        mMessage.send(sapProxy);
+        verify(sapProxy).setTransferProtocolReq(anyInt(), eq(SapTransferProtocol.T0));
+        Mockito.clearInvocations(sapProxy);
+
+        mMessage.setMsgType(ID_SET_TRANSPORT_PROTOCOL_REQ);
+        mMessage.setTransportProtocol(TRANS_PROTO_T1);
+        mMessage.send(sapProxy);
+        verify(sapProxy).setTransferProtocolReq(anyInt(), eq(SapTransferProtocol.T1));
+        Mockito.clearInvocations(sapProxy);
+
+        mMessage.setMsgType(ID_TRANSFER_ATR_REQ);
+        mMessage.send(sapProxy);
+        verify(sapProxy).transferAtrReq(anyInt());
+        Mockito.clearInvocations(sapProxy);
+
+        mMessage.setMsgType(ID_POWER_SIM_OFF_REQ);
+        mMessage.send(sapProxy);
+        verify(sapProxy).powerReq(anyInt(), eq(false));
+        Mockito.clearInvocations(sapProxy);
+
+        mMessage.setMsgType(ID_POWER_SIM_ON_REQ);
+        mMessage.send(sapProxy);
+        verify(sapProxy).powerReq(anyInt(), eq(true));
+        Mockito.clearInvocations(sapProxy);
+
+        mMessage.setMsgType(ID_RESET_SIM_REQ);
+        mMessage.send(sapProxy);
+        verify(sapProxy).resetSimReq(anyInt());
+        Mockito.clearInvocations(sapProxy);
+
+        mMessage.setMsgType(ID_TRANSFER_CARD_READER_STATUS_REQ);
+        mMessage.send(sapProxy);
+        verify(sapProxy).transferCardReaderStatusReq(anyInt());
+        Mockito.clearInvocations(sapProxy);
+
+        mMessage.setMsgType(-1000);
+        assertThrows(IllegalArgumentException.class, () -> mMessage.send(sapProxy));
+    }
+}
diff --git a/android/app/tests/unit/src/com/android/bluetooth/sap/SapRilReceiverTest.java b/android/app/tests/unit/src/com/android/bluetooth/sap/SapRilReceiverTest.java
new file mode 100644
index 0000000..8299daa
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/sap/SapRilReceiverTest.java
@@ -0,0 +1,435 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.sap;
+
+import static com.android.bluetooth.sap.SapMessage.CON_STATUS_OK;
+import static com.android.bluetooth.sap.SapMessage.DISC_GRACEFULL;
+import static com.android.bluetooth.sap.SapMessage.ID_CONNECT_RESP;
+import static com.android.bluetooth.sap.SapMessage.ID_DISCONNECT_RESP;
+import static com.android.bluetooth.sap.SapMessage.ID_POWER_SIM_OFF_REQ;
+import static com.android.bluetooth.sap.SapMessage.ID_POWER_SIM_OFF_RESP;
+import static com.android.bluetooth.sap.SapMessage.ID_POWER_SIM_ON_REQ;
+import static com.android.bluetooth.sap.SapMessage.ID_POWER_SIM_ON_RESP;
+import static com.android.bluetooth.sap.SapMessage.ID_RESET_SIM_RESP;
+import static com.android.bluetooth.sap.SapMessage.ID_RIL_UNKNOWN;
+import static com.android.bluetooth.sap.SapMessage.ID_RIL_UNSOL_DISCONNECT_IND;
+import static com.android.bluetooth.sap.SapMessage.ID_SET_TRANSPORT_PROTOCOL_RESP;
+import static com.android.bluetooth.sap.SapMessage.ID_STATUS_IND;
+import static com.android.bluetooth.sap.SapMessage.ID_TRANSFER_APDU_RESP;
+import static com.android.bluetooth.sap.SapMessage.ID_TRANSFER_ATR_RESP;
+import static com.android.bluetooth.sap.SapMessage.ID_TRANSFER_CARD_READER_STATUS_RESP;
+import static com.android.bluetooth.sap.SapMessage.RESULT_OK;
+import static com.android.bluetooth.sap.SapMessage.STATUS_CARD_INSERTED;
+import static com.android.bluetooth.sap.SapServer.ISAP_GET_SERVICE_DELAY_MILLIS;
+import static com.android.bluetooth.sap.SapServer.SAP_MSG_RFC_REPLY;
+import static com.android.bluetooth.sap.SapServer.SAP_MSG_RIL_CONNECT;
+import static com.android.bluetooth.sap.SapServer.SAP_MSG_RIL_IND;
+import static com.android.bluetooth.sap.SapServer.SAP_PROXY_DEAD;
+import static com.android.bluetooth.sap.SapServer.SAP_RIL_SOCK_CLOSED;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import static org.mockito.Mockito.any;
+import static org.mockito.Mockito.argThat;
+import static org.mockito.Mockito.eq;
+import static org.mockito.Mockito.timeout;
+import static org.mockito.Mockito.verify;
+
+import android.hardware.radio.V1_0.ISap;
+import android.os.Handler;
+import android.os.HandlerThread;
+import android.os.Message;
+
+import androidx.test.filters.LargeTest;
+import androidx.test.runner.AndroidJUnit4;
+
+import org.junit.After;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.ArgumentMatcher;
+import org.mockito.Mock;
+import org.mockito.MockitoAnnotations;
+import org.mockito.Spy;
+
+import java.util.ArrayList;
+import java.util.Arrays;
+
+@LargeTest
+@RunWith(AndroidJUnit4.class)
+public class SapRilReceiverTest {
+
+    private static final long TIMEOUT_MS = 1_000;
+
+    private HandlerThread mHandlerThread;
+    private Handler mServerMsgHandler;
+
+    @Spy
+    private TestHandlerCallback mCallback = new TestHandlerCallback();
+
+    @Mock
+    private Handler mServiceHandler;
+
+    @Mock
+    private ISap mSapProxy;
+
+    private SapRilReceiver mReceiver;
+
+    @Before
+    public void setUp() throws Exception {
+        MockitoAnnotations.initMocks(this);
+
+        mHandlerThread = new HandlerThread("SapRilReceiverTest");
+        mHandlerThread.start();
+
+        mServerMsgHandler = new Handler(mHandlerThread.getLooper(), mCallback);
+        mReceiver = new SapRilReceiver(mServerMsgHandler, mServiceHandler);
+        mReceiver.mSapProxy = mSapProxy;
+    }
+
+    @After
+    public void tearDown() {
+        mHandlerThread.quit();
+    }
+
+    @Test
+    public void getSapProxyLock() {
+        assertThat(mReceiver.getSapProxyLock()).isNotNull();
+    }
+
+    @Test
+    public void resetSapProxy() throws Exception {
+        mReceiver.resetSapProxy();
+
+        assertThat(mReceiver.mSapProxy).isNull();
+        verify(mSapProxy).unlinkToDeath(any());
+    }
+
+    @Test
+    public void notifyShutdown() throws Exception {
+        mReceiver.notifyShutdown();
+
+        verify(mCallback, timeout(TIMEOUT_MS)).receiveMessage(eq(SAP_RIL_SOCK_CLOSED), any());
+    }
+
+    @Test
+    public void sendRilConnectMessage() throws Exception {
+        mReceiver.sendRilConnectMessage();
+
+        verify(mCallback, timeout(TIMEOUT_MS)).receiveMessage(eq(SAP_MSG_RIL_CONNECT), any());
+    }
+
+    @Test
+    public void serviceDied() throws Exception {
+        long cookie = 1;
+        mReceiver.mSapProxyDeathRecipient.serviceDied(cookie);
+
+        verify(mCallback, timeout(ISAP_GET_SERVICE_DELAY_MILLIS + TIMEOUT_MS))
+                .receiveMessage(eq(SAP_PROXY_DEAD), argThat(
+                        arg -> (arg instanceof Long) && ((Long) arg == cookie)
+                ));
+    }
+
+    @Test
+    public void callback_connectResponse() throws Exception {
+        int token = 1;
+        int sapConnectRsp = CON_STATUS_OK;
+        int maxMsgSize = 512;
+        mReceiver.mSapCallback.connectResponse(token, sapConnectRsp, maxMsgSize);
+
+        verify(mCallback, timeout(TIMEOUT_MS)).receiveMessage(eq(SAP_MSG_RFC_REPLY), argThat(
+                new ArgumentMatcher<Object>() {
+                    @Override
+                    public boolean matches(Object arg) {
+                        if (!(arg instanceof SapMessage)) {
+                            return false;
+                        }
+                        SapMessage sapMsg = (SapMessage) arg;
+                        return sapMsg.getMsgType() == ID_CONNECT_RESP
+                                && sapMsg.getConnectionStatus() == sapConnectRsp;
+                    }
+                }
+        ));
+    }
+
+    @Test
+    public void callback_disconnectResponse() throws Exception {
+        int token = 1;
+        mReceiver.mSapCallback.disconnectResponse(token);
+
+        verify(mCallback, timeout(TIMEOUT_MS)).receiveMessage(eq(SAP_MSG_RFC_REPLY), argThat(
+                new ArgumentMatcher<Object>() {
+                    @Override
+                    public boolean matches(Object arg) {
+                        if (!(arg instanceof SapMessage)) {
+                            return false;
+                        }
+                        SapMessage sapMsg = (SapMessage) arg;
+                        return sapMsg.getMsgType() == ID_DISCONNECT_RESP;
+                    }
+                }
+        ));
+    }
+
+    @Test
+    public void callback_disconnectIndication() throws Exception {
+        int token = 1;
+        int disconnectType = DISC_GRACEFULL;
+        mReceiver.mSapCallback.disconnectIndication(token, disconnectType);
+
+        verify(mCallback, timeout(TIMEOUT_MS)).receiveMessage(eq(SAP_MSG_RIL_IND), argThat(
+                new ArgumentMatcher<Object>() {
+                    @Override
+                    public boolean matches(Object arg) {
+                        if (!(arg instanceof SapMessage)) {
+                            return false;
+                        }
+                        SapMessage sapMsg = (SapMessage) arg;
+                        return sapMsg.getMsgType() == ID_RIL_UNSOL_DISCONNECT_IND
+                                && sapMsg.getDisconnectionType() == disconnectType;
+                    }
+                }
+        ));
+    }
+
+    @Test
+    public void callback_apduResponse() throws Exception {
+        int token = 1;
+        int resultCode = RESULT_OK;
+        byte[] apduRsp = new byte[]{0x03, 0x04};
+        ArrayList<Byte> apduRspList = new ArrayList<>();
+        for (byte b : apduRsp) {
+            apduRspList.add(b);
+        }
+
+        mReceiver.mSapCallback.apduResponse(token, resultCode, apduRspList);
+
+        verify(mCallback, timeout(TIMEOUT_MS)).receiveMessage(eq(SAP_MSG_RFC_REPLY), argThat(
+                new ArgumentMatcher<Object>() {
+                    @Override
+                    public boolean matches(Object arg) {
+                        if (!(arg instanceof SapMessage)) {
+                            return false;
+                        }
+                        SapMessage sapMsg = (SapMessage) arg;
+                        return sapMsg.getMsgType() == ID_TRANSFER_APDU_RESP
+                                && sapMsg.getResultCode() == resultCode
+                                && Arrays.equals(sapMsg.getApduResp(), apduRsp);
+                    }
+                }
+        ));
+    }
+
+    @Test
+    public void callback_transferAtrResponse() throws Exception {
+        int token = 1;
+        int resultCode = RESULT_OK;
+        byte[] atr = new byte[]{0x03, 0x04};
+        ArrayList<Byte> atrList = new ArrayList<>();
+        for (byte b : atr) {
+            atrList.add(b);
+        }
+
+        mReceiver.mSapCallback.transferAtrResponse(token, resultCode, atrList);
+
+        verify(mCallback, timeout(TIMEOUT_MS)).receiveMessage(eq(SAP_MSG_RFC_REPLY), argThat(
+                new ArgumentMatcher<Object>() {
+                    @Override
+                    public boolean matches(Object arg) {
+                        if (!(arg instanceof SapMessage)) {
+                            return false;
+                        }
+                        SapMessage sapMsg = (SapMessage) arg;
+                        return sapMsg.getMsgType() == ID_TRANSFER_ATR_RESP
+                                && sapMsg.getResultCode() == resultCode
+                                && Arrays.equals(sapMsg.getAtr(), atr);
+                    }
+                }
+        ));
+    }
+
+    @Test
+    public void callback_powerResponse_powerOff() throws Exception {
+        int token = 1;
+        int reqType = ID_POWER_SIM_OFF_REQ;
+        int resultCode = RESULT_OK;
+        SapMessage.sOngoingRequests.clear();
+        SapMessage.sOngoingRequests.put(token, reqType);
+
+        mReceiver.mSapCallback.powerResponse(token, resultCode);
+
+        verify(mCallback, timeout(TIMEOUT_MS)).receiveMessage(eq(SAP_MSG_RFC_REPLY), argThat(
+                new ArgumentMatcher<Object>() {
+                    @Override
+                    public boolean matches(Object arg) {
+                        if (!(arg instanceof SapMessage)) {
+                            return false;
+                        }
+                        SapMessage sapMsg = (SapMessage) arg;
+                        return sapMsg.getMsgType() == ID_POWER_SIM_OFF_RESP
+                                && sapMsg.getResultCode() == resultCode;
+                    }
+                }
+        ));
+    }
+
+    @Test
+    public void callback_powerResponse_powerOn() throws Exception {
+        int token = 1;
+        int reqType = ID_POWER_SIM_ON_REQ;
+        int resultCode = RESULT_OK;
+        SapMessage.sOngoingRequests.clear();
+        SapMessage.sOngoingRequests.put(token, reqType);
+
+        mReceiver.mSapCallback.powerResponse(token, resultCode);
+
+        verify(mCallback, timeout(TIMEOUT_MS)).receiveMessage(eq(SAP_MSG_RFC_REPLY), argThat(
+                new ArgumentMatcher<Object>() {
+                    @Override
+                    public boolean matches(Object arg) {
+                        if (!(arg instanceof SapMessage)) {
+                            return false;
+                        }
+                        SapMessage sapMsg = (SapMessage) arg;
+                        return sapMsg.getMsgType() == ID_POWER_SIM_ON_RESP
+                                && sapMsg.getResultCode() == resultCode;
+                    }
+                }
+        ));
+    }
+
+    @Test
+    public void callback_resetSimResponse() throws Exception {
+        int token = 1;
+        int resultCode = RESULT_OK;
+
+        mReceiver.mSapCallback.resetSimResponse(token, resultCode);
+
+        verify(mCallback, timeout(TIMEOUT_MS)).receiveMessage(eq(SAP_MSG_RFC_REPLY), argThat(
+                new ArgumentMatcher<Object>() {
+                    @Override
+                    public boolean matches(Object arg) {
+                        if (!(arg instanceof SapMessage)) {
+                            return false;
+                        }
+                        SapMessage sapMsg = (SapMessage) arg;
+                        return sapMsg.getMsgType() == ID_RESET_SIM_RESP
+                                && sapMsg.getResultCode() == resultCode;
+                    }
+                }
+        ));
+    }
+
+    @Test
+    public void callback_statusIndication() throws Exception {
+        int token = 1;
+        int statusChange = 2;
+
+        mReceiver.mSapCallback.statusIndication(token, statusChange);
+
+        verify(mCallback, timeout(TIMEOUT_MS)).receiveMessage(eq(SAP_MSG_RFC_REPLY), argThat(
+                new ArgumentMatcher<Object>() {
+                    @Override
+                    public boolean matches(Object arg) {
+                        if (!(arg instanceof SapMessage)) {
+                            return false;
+                        }
+                        SapMessage sapMsg = (SapMessage) arg;
+                        return sapMsg.getMsgType() == ID_STATUS_IND
+                                && sapMsg.getStatusChange() == statusChange;
+                    }
+                }
+        ));
+    }
+
+    @Test
+    public void callback_transferCardReaderStatusResponse() throws Exception {
+        int token = 1;
+        int resultCode = RESULT_OK;
+        int cardReaderStatus = STATUS_CARD_INSERTED;
+
+        mReceiver.mSapCallback.transferCardReaderStatusResponse(
+                token, resultCode, cardReaderStatus);
+
+        verify(mCallback, timeout(TIMEOUT_MS)).receiveMessage(eq(SAP_MSG_RFC_REPLY), argThat(
+                new ArgumentMatcher<Object>() {
+                    @Override
+                    public boolean matches(Object arg) {
+                        if (!(arg instanceof SapMessage)) {
+                            return false;
+                        }
+                        SapMessage sapMsg = (SapMessage) arg;
+                        return sapMsg.getMsgType() == ID_TRANSFER_CARD_READER_STATUS_RESP
+                                && sapMsg.getResultCode() == resultCode;
+                    }
+                }
+        ));
+    }
+
+    @Test
+    public void callback_errorResponse() throws Exception {
+        int token = 1;
+
+        mReceiver.mSapCallback.errorResponse(token);
+
+        verify(mCallback, timeout(TIMEOUT_MS)).receiveMessage(eq(SAP_MSG_RIL_IND), argThat(
+                new ArgumentMatcher<Object>() {
+                    @Override
+                    public boolean matches(Object arg) {
+                        if (!(arg instanceof SapMessage)) {
+                            return false;
+                        }
+                        SapMessage sapMsg = (SapMessage) arg;
+                        return sapMsg.getMsgType() == ID_RIL_UNKNOWN;
+                    }
+                }
+        ));
+    }
+
+    @Test
+    public void callback_transferProtocolResponse() throws Exception {
+        int token = 1;
+        int resultCode = RESULT_OK;
+
+        mReceiver.mSapCallback.transferProtocolResponse(token, resultCode);
+
+        verify(mCallback, timeout(TIMEOUT_MS)).receiveMessage(eq(SAP_MSG_RFC_REPLY), argThat(
+                new ArgumentMatcher<Object>() {
+                    @Override
+                    public boolean matches(Object arg) {
+                        if (!(arg instanceof SapMessage)) {
+                            return false;
+                        }
+                        SapMessage sapMsg = (SapMessage) arg;
+                        return sapMsg.getMsgType() == ID_SET_TRANSPORT_PROTOCOL_RESP
+                                && sapMsg.getResultCode() == resultCode;
+                    }
+                }
+        ));
+    }
+
+    public static class TestHandlerCallback implements Handler.Callback {
+
+        @Override
+        public boolean handleMessage(Message msg) {
+            receiveMessage(msg.what, msg.obj);
+            return true;
+        }
+
+        public void receiveMessage(int what, Object obj) {}
+    }
+}
diff --git a/android/app/tests/unit/src/com/android/bluetooth/sap/SapServerTest.java b/android/app/tests/unit/src/com/android/bluetooth/sap/SapServerTest.java
new file mode 100644
index 0000000..09ac038
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/sap/SapServerTest.java
@@ -0,0 +1,714 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.sap;
+
+import static com.android.bluetooth.sap.SapMessage.CON_STATUS_ERROR_CONNECTION;
+import static com.android.bluetooth.sap.SapMessage.CON_STATUS_OK;
+import static com.android.bluetooth.sap.SapMessage.CON_STATUS_OK_ONGOING_CALL;
+import static com.android.bluetooth.sap.SapMessage.DISC_GRACEFULL;
+import static com.android.bluetooth.sap.SapMessage.ID_CONNECT_REQ;
+import static com.android.bluetooth.sap.SapMessage.ID_CONNECT_RESP;
+import static com.android.bluetooth.sap.SapMessage.ID_DISCONNECT_IND;
+import static com.android.bluetooth.sap.SapMessage.ID_DISCONNECT_RESP;
+import static com.android.bluetooth.sap.SapMessage.ID_ERROR_RESP;
+import static com.android.bluetooth.sap.SapMessage.ID_RIL_UNSOL_DISCONNECT_IND;
+import static com.android.bluetooth.sap.SapMessage.ID_STATUS_IND;
+import static com.android.bluetooth.sap.SapMessage.TEST_MODE_ENABLE;
+import static com.android.bluetooth.sap.SapServer.SAP_MSG_RFC_REPLY;
+import static com.android.bluetooth.sap.SapServer.SAP_MSG_RIL_CONNECT;
+import static com.android.bluetooth.sap.SapServer.SAP_MSG_RIL_IND;
+import static com.android.bluetooth.sap.SapServer.SAP_MSG_RIL_REQ;
+import static com.android.bluetooth.sap.SapServer.SAP_PROXY_DEAD;
+import static com.android.bluetooth.sap.SapServer.SAP_RIL_SOCK_CLOSED;
+
+import static com.google.common.truth.Truth.assertThat;
+import static com.google.common.truth.Truth.assertWithMessage;
+
+import static org.mockito.Mockito.any;
+import static org.mockito.Mockito.anyInt;
+import static org.mockito.Mockito.anyLong;
+import static org.mockito.Mockito.argThat;
+import static org.mockito.Mockito.atLeastOnce;
+import static org.mockito.Mockito.doThrow;
+import static org.mockito.Mockito.eq;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.never;
+import static org.mockito.Mockito.spy;
+import static org.mockito.Mockito.timeout;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import android.app.AlarmManager;
+import android.app.Notification;
+import android.app.NotificationManager;
+import android.app.PendingIntent;
+import android.content.Context;
+import android.content.ContextWrapper;
+import android.content.Intent;
+import android.hardware.radio.V1_0.ISap;
+import android.os.Handler;
+import android.os.HandlerThread;
+import android.os.Message;
+import android.os.RemoteException;
+import android.telephony.TelephonyManager;
+
+import androidx.test.filters.SmallTest;
+import androidx.test.platform.app.InstrumentationRegistry;
+import androidx.test.runner.AndroidJUnit4;
+
+import org.junit.After;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.ArgumentCaptor;
+import org.mockito.ArgumentMatcher;
+import org.mockito.Mock;
+import org.mockito.MockitoAnnotations;
+import org.mockito.Spy;
+
+import java.io.InputStream;
+import java.io.OutputStream;
+import java.util.concurrent.atomic.AtomicLong;
+
+@SmallTest
+@RunWith(AndroidJUnit4.class)
+public class SapServerTest {
+    private static final long TIMEOUT_MS = 1_000;
+
+    private HandlerThread mHandlerThread;
+    private Handler mHandler;
+
+    @Spy
+    private Context mTargetContext =
+            new ContextWrapper(InstrumentationRegistry.getInstrumentation().getTargetContext());
+
+    @Spy
+    private TestHandlerCallback mCallback = new TestHandlerCallback();
+
+    @Mock
+    private InputStream mInputStream;
+
+    @Mock
+    private OutputStream mOutputStream;
+
+    private SapServer mSapServer;
+
+    @Before
+    public void setUp() throws Exception {
+        MockitoAnnotations.initMocks(this);
+
+        mHandlerThread = new HandlerThread("SapServerTest");
+        mHandlerThread.start();
+
+        mHandler = new Handler(mHandlerThread.getLooper(), mCallback);
+        mSapServer = spy(new SapServer(mHandler, mTargetContext, mInputStream, mOutputStream));
+    }
+
+    @After
+    public void tearDown() {
+        mHandlerThread.quit();
+    }
+
+    @Test
+    public void setNotification() {
+        NotificationManager notificationManager = mock(NotificationManager.class);
+        when(mTargetContext.getSystemService(NotificationManager.class))
+                .thenReturn(notificationManager);
+
+        ArgumentCaptor<Notification> captor = ArgumentCaptor.forClass(Notification.class);
+        int type = DISC_GRACEFULL;
+        int flags = PendingIntent.FLAG_CANCEL_CURRENT;
+        mSapServer.setNotification(type, flags);
+
+        verify(notificationManager).notify(eq(SapServer.NOTIFICATION_ID), captor.capture());
+        Notification notification = captor.getValue();
+        assertThat(notification.getChannelId()).isEqualTo(SapServer.SAP_NOTIFICATION_CHANNEL);
+    }
+
+    @Test
+    public void clearNotification() {
+        NotificationManager notificationManager = mock(NotificationManager.class);
+        when(mTargetContext.getSystemService(NotificationManager.class))
+                .thenReturn(notificationManager);
+
+        mSapServer.clearNotification();
+
+        verify(notificationManager).cancel(SapServer.NOTIFICATION_ID);
+    }
+
+    @Test
+    public void setTestMode() {
+        int testMode = TEST_MODE_ENABLE;
+        mSapServer.setTestMode(testMode);
+
+        assertThat(mSapServer.mTestMode).isEqualTo(testMode);
+    }
+
+    @Test
+    public void onConnectRequest_whenStateIsConnecting_callsSendRilMessage() {
+        SapRilReceiver mockReceiver = mock(SapRilReceiver.class);
+        ISap mockSapProxy = mock(ISap.class);
+        Object lock = new Object();
+        when(mockReceiver.getSapProxyLock()).thenReturn(lock);
+        when(mockReceiver.getSapProxy()).thenReturn(mockSapProxy);
+        mSapServer.mRilBtReceiver = mockReceiver;
+        mSapServer.mSapHandler = mHandler;
+
+        mSapServer.changeState(SapServer.SAP_STATE.CONNECTING);
+        SapMessage msg = new SapMessage(ID_STATUS_IND);
+        mSapServer.onConnectRequest(msg);
+
+        verify(mSapServer).sendRilMessage(msg);
+    }
+
+    @Test
+    public void onConnectRequest_whenStateIsConnected_sendsErrorConnectionClientMessage() {
+        mSapServer.mSapHandler = mHandler;
+
+        mSapServer.changeState(SapServer.SAP_STATE.CONNECTED);
+        mSapServer.onConnectRequest(mock(SapMessage.class));
+
+        verify(mSapServer).sendClientMessage(argThat(
+                sapMsg -> sapMsg.getMsgType() == ID_CONNECT_RESP
+                        && sapMsg.getConnectionStatus() == CON_STATUS_ERROR_CONNECTION));
+    }
+
+    @Test
+    public void onConnectRequest_whenStateIsCallOngoing_sendsErrorConnectionClientMessage() {
+        mSapServer.mSapHandler = mHandler;
+
+        mSapServer.changeState(SapServer.SAP_STATE.CONNECTING_CALL_ONGOING);
+        mSapServer.onConnectRequest(mock(SapMessage.class));
+
+        verify(mSapServer, atLeastOnce()).sendClientMessage(argThat(
+                sapMsg -> sapMsg.getMsgType() == ID_CONNECT_RESP
+                        && sapMsg.getConnectionStatus() == CON_STATUS_ERROR_CONNECTION));
+    }
+
+    @Test
+    public void getMessageName() {
+        assertThat(SapServer.getMessageName(SAP_MSG_RFC_REPLY)).isEqualTo("SAP_MSG_REPLY");
+        assertThat(SapServer.getMessageName(SAP_MSG_RIL_CONNECT)).isEqualTo("SAP_MSG_RIL_CONNECT");
+        assertThat(SapServer.getMessageName(SAP_MSG_RIL_REQ)).isEqualTo("SAP_MSG_RIL_REQ");
+        assertThat(SapServer.getMessageName(SAP_MSG_RIL_IND)).isEqualTo("SAP_MSG_RIL_IND");
+        assertThat(SapServer.getMessageName(-1)).isEqualTo("Unknown message ID");
+    }
+
+    @Test
+    public void sendReply() throws Exception {
+        SapMessage msg = mock(SapMessage.class);
+        mSapServer.sendReply(msg);
+
+        verify(msg).write(any(OutputStream.class));
+    }
+
+    @Test
+    public void sendRilMessage_success() throws Exception {
+        SapRilReceiver mockReceiver = mock(SapRilReceiver.class);
+        ISap mockSapProxy = mock(ISap.class);
+        Object lock = new Object();
+        when(mockReceiver.getSapProxyLock()).thenReturn(lock);
+        when(mockReceiver.getSapProxy()).thenReturn(mockSapProxy);
+        mSapServer.mRilBtReceiver = mockReceiver;
+        mSapServer.mSapHandler = mHandler;
+
+        SapMessage msg = mock(SapMessage.class);
+        mSapServer.sendRilMessage(msg);
+
+        verify(msg).send(mockSapProxy);
+    }
+
+    @Test
+    public void sendRilMessage_whenSapProxyIsNull_sendsErrorClientMessage() throws Exception {
+        SapRilReceiver mockReceiver = mock(SapRilReceiver.class);
+        Object lock = new Object();
+        when(mockReceiver.getSapProxyLock()).thenReturn(lock);
+        when(mockReceiver.getSapProxy()).thenReturn(null);
+        mSapServer.mRilBtReceiver = mockReceiver;
+        mSapServer.mSapHandler = mHandler;
+
+        SapMessage msg = mock(SapMessage.class);
+        mSapServer.sendRilMessage(msg);
+
+        verify(mSapServer).sendClientMessage(
+                argThat(sapMsg -> sapMsg.getMsgType() == ID_ERROR_RESP));
+    }
+
+    @Test
+    public void sendRilMessage_whenIAEIsThrown_sendsErrorClientMessage() throws Exception {
+        SapRilReceiver mockReceiver = mock(SapRilReceiver.class);
+        Object lock = new Object();
+        ISap mockSapProxy = mock(ISap.class);
+        when(mockReceiver.getSapProxyLock()).thenReturn(lock);
+        when(mockReceiver.getSapProxy()).thenReturn(mockSapProxy);
+        mSapServer.mRilBtReceiver = mockReceiver;
+        mSapServer.mSapHandler = mHandler;
+
+        SapMessage msg = mock(SapMessage.class);
+        doThrow(new IllegalArgumentException()).when(msg).send(any());
+        mSapServer.sendRilMessage(msg);
+
+        verify(mSapServer).sendClientMessage(
+                argThat(sapMsg -> sapMsg.getMsgType() == ID_ERROR_RESP));
+    }
+
+    @Test
+    public void sendRilMessage_whenRemoteExceptionIsThrown_sendsErrorClientMessage()
+            throws Exception {
+        SapRilReceiver mockReceiver = mock(SapRilReceiver.class);
+        Object lock = new Object();
+        ISap mockSapProxy = mock(ISap.class);
+        when(mockReceiver.getSapProxyLock()).thenReturn(lock);
+        when(mockReceiver.getSapProxy()).thenReturn(mockSapProxy);
+        mSapServer.mRilBtReceiver = mockReceiver;
+        mSapServer.mSapHandler = mHandler;
+
+        SapMessage msg = mock(SapMessage.class);
+        doThrow(new RemoteException()).when(msg).send(any());
+        mSapServer.sendRilMessage(msg);
+
+        verify(mSapServer).sendClientMessage(
+                argThat(sapMsg -> sapMsg.getMsgType() == ID_ERROR_RESP));
+        verify(mockReceiver).notifyShutdown();
+        verify(mockReceiver).resetSapProxy();
+    }
+
+    @Test
+    public void handleRilInd_whenMessageIsNull() {
+        try {
+            mSapServer.handleRilInd(null);
+        } catch (Exception e) {
+            assertWithMessage("Exception should not happen.").fail();
+        }
+    }
+
+    @Test
+    public void handleRilInd_whenStateIsConnected_callsSendClientMessage() {
+        int disconnectionType = DISC_GRACEFULL;
+        SapMessage msg = mock(SapMessage.class);
+        when(msg.getMsgType()).thenReturn(ID_RIL_UNSOL_DISCONNECT_IND);
+        when(msg.getDisconnectionType()).thenReturn(disconnectionType);
+        mSapServer.mSapHandler = mHandler;
+
+        mSapServer.changeState(SapServer.SAP_STATE.CONNECTED);
+        mSapServer.handleRilInd(msg);
+
+        verify(mSapServer).sendClientMessage(argThat(
+                sapMsg -> sapMsg.getMsgType() == ID_DISCONNECT_IND
+                        && sapMsg.getDisconnectionType() == disconnectionType));
+    }
+
+    @Test
+    public void handleRilInd_whenStateIsDisconnected_callsSendDisconnectInd() {
+        int disconnectionType = DISC_GRACEFULL;
+        NotificationManager notificationManager = mock(NotificationManager.class);
+        when(mTargetContext.getSystemService(NotificationManager.class))
+                .thenReturn(notificationManager);
+        SapMessage msg = mock(SapMessage.class);
+        when(msg.getMsgType()).thenReturn(ID_RIL_UNSOL_DISCONNECT_IND);
+        when(msg.getDisconnectionType()).thenReturn(disconnectionType);
+        mSapServer.mSapHandler = mHandler;
+
+        mSapServer.changeState(SapServer.SAP_STATE.DISCONNECTED);
+        mSapServer.handleRilInd(msg);
+
+        verify(mSapServer).sendDisconnectInd(disconnectionType);
+    }
+
+    @Test
+    public void handleRfcommReply_whenMessageIsNull() {
+        try {
+            mSapServer.changeState(SapServer.SAP_STATE.CONNECTED_BUSY);
+            mSapServer.handleRfcommReply(null);
+        } catch (Exception e) {
+            assertWithMessage("Exception should not happen.").fail();
+        }
+    }
+
+    @Test
+    public void handleRfcommReply_connectRespMsg_whenInCallOngoingState() {
+        SapMessage msg = mock(SapMessage.class);
+        when(msg.getMsgType()).thenReturn(ID_CONNECT_RESP);
+
+        mSapServer.changeState(SapServer.SAP_STATE.CONNECTING_CALL_ONGOING);
+        when(msg.getConnectionStatus()).thenReturn(CON_STATUS_OK);
+        mSapServer.handleRfcommReply(msg);
+
+        assertThat(mSapServer.mState).isEqualTo(SapServer.SAP_STATE.CONNECTED);
+    }
+
+    @Test
+    public void handleRfcommReply_connectRespMsg_whenNotInCallOngoingState_okStatus() {
+        SapMessage msg = mock(SapMessage.class);
+        when(msg.getMsgType()).thenReturn(ID_CONNECT_RESP);
+
+        mSapServer.changeState(SapServer.SAP_STATE.CONNECTED);
+        when(msg.getConnectionStatus()).thenReturn(CON_STATUS_OK);
+        mSapServer.handleRfcommReply(msg);
+
+        assertThat(mSapServer.mState).isEqualTo(SapServer.SAP_STATE.CONNECTED);
+    }
+
+    @Test
+    public void handleRfcommReply_connectRespMsg_whenNotInCallOngoingState_ongoingCallStatus() {
+        SapMessage msg = mock(SapMessage.class);
+        when(msg.getMsgType()).thenReturn(ID_CONNECT_RESP);
+
+        mSapServer.changeState(SapServer.SAP_STATE.CONNECTED);
+        when(msg.getConnectionStatus()).thenReturn(CON_STATUS_OK_ONGOING_CALL);
+        mSapServer.handleRfcommReply(msg);
+
+        assertThat(mSapServer.mState).isEqualTo(SapServer.SAP_STATE.CONNECTING_CALL_ONGOING);
+    }
+
+    @Test
+    public void handleRfcommReply_connectRespMsg_whenNotInCallOngoingState_errorStatus() {
+        AlarmManager alarmManager = mock(AlarmManager.class);
+        when(mTargetContext.getSystemService(AlarmManager.class)).thenReturn(alarmManager);
+        SapMessage msg = mock(SapMessage.class);
+        when(msg.getMsgType()).thenReturn(ID_CONNECT_RESP);
+
+        mSapServer.changeState(SapServer.SAP_STATE.CONNECTED);
+        when(msg.getConnectionStatus()).thenReturn(CON_STATUS_ERROR_CONNECTION);
+        mSapServer.handleRfcommReply(msg);
+
+        verify(mSapServer).startDisconnectTimer(anyInt(), anyInt());
+    }
+
+    @Test
+    public void handleRfcommReply_disconnectRespMsg_whenInDisconnectingState() {
+        SapMessage msg = mock(SapMessage.class);
+        when(msg.getMsgType()).thenReturn(ID_DISCONNECT_RESP);
+
+        mSapServer.changeState(SapServer.SAP_STATE.DISCONNECTING);
+        mSapServer.handleRfcommReply(msg);
+
+        assertThat(mSapServer.mState).isEqualTo(SapServer.SAP_STATE.DISCONNECTED);
+    }
+
+    @Test
+    public void handleRfcommReply_disconnectRespMsg_whenInConnectedState_shutDown() {
+        SapMessage msg = mock(SapMessage.class);
+        when(msg.getMsgType()).thenReturn(ID_DISCONNECT_RESP);
+
+        mSapServer.mIsLocalInitDisconnect = true;
+        mSapServer.changeState(SapServer.SAP_STATE.CONNECTED);
+        mSapServer.handleRfcommReply(msg);
+
+        verify(mSapServer).shutdown();
+    }
+
+    @Test
+    public void handleRfcommReply_disconnectRespMsg_whenInConnectedState_startsDisconnectTimer() {
+        AlarmManager alarmManager = mock(AlarmManager.class);
+        when(mTargetContext.getSystemService(AlarmManager.class)).thenReturn(alarmManager);
+        SapMessage msg = mock(SapMessage.class);
+        when(msg.getMsgType()).thenReturn(ID_DISCONNECT_RESP);
+
+        mSapServer.mIsLocalInitDisconnect = false;
+        mSapServer.changeState(SapServer.SAP_STATE.CONNECTED);
+        mSapServer.handleRfcommReply(msg);
+
+        verify(mSapServer).startDisconnectTimer(anyInt(), anyInt());
+    }
+
+    @Test
+    public void handleRfcommReply_statusIndMsg_whenInDisonnectingState_doesNotSendMessage()
+            throws Exception {
+        SapMessage msg = mock(SapMessage.class);
+        when(msg.getMsgType()).thenReturn(ID_STATUS_IND);
+
+        mSapServer.changeState(SapServer.SAP_STATE.DISCONNECTING);
+        mSapServer.handleRfcommReply(msg);
+
+        verify(msg, never()).send(any());
+    }
+
+    @Test
+    public void handleRfcommReply_statusIndMsg_whenInConnectedState_setsNotification() {
+        NotificationManager notificationManager = mock(NotificationManager.class);
+        when(mTargetContext.getSystemService(NotificationManager.class))
+                .thenReturn(notificationManager);
+        SapMessage msg = mock(SapMessage.class);
+        when(msg.getMsgType()).thenReturn(ID_STATUS_IND);
+
+        mSapServer.changeState(SapServer.SAP_STATE.CONNECTED);
+        mSapServer.handleRfcommReply(msg);
+
+        verify(notificationManager).notify(eq(SapServer.NOTIFICATION_ID), any());
+    }
+
+    @Test
+    public void startDisconnectTimer_and_stopDisconnectTimer() {
+        AlarmManager alarmManager = mock(AlarmManager.class);
+        when(mTargetContext.getSystemService(AlarmManager.class)).thenReturn(alarmManager);
+
+        mSapServer.startDisconnectTimer(SapMessage.DISC_FORCED, 1_000);
+        verify(alarmManager).set(anyInt(), anyLong(), any(PendingIntent.class));
+
+        mSapServer.stopDisconnectTimer();
+        verify(alarmManager).cancel(any(PendingIntent.class));
+    }
+
+    @Test
+    public void isCallOngoing() {
+        TelephonyManager telephonyManager = mock(TelephonyManager.class);
+        when(mTargetContext.getSystemService(TelephonyManager.class)).thenReturn(telephonyManager);
+
+        when(telephonyManager.getCallState()).thenReturn(TelephonyManager.CALL_STATE_OFFHOOK);
+        assertThat(mSapServer.isCallOngoing()).isTrue();
+
+        when(telephonyManager.getCallState()).thenReturn(TelephonyManager.CALL_STATE_IDLE);
+        assertThat(mSapServer.isCallOngoing()).isFalse();
+    }
+
+    @Test
+    public void sendRilThreadMessage() {
+        mSapServer.mSapHandler = mHandler;
+
+        SapMessage msg = new SapMessage(ID_STATUS_IND);
+        mSapServer.sendRilThreadMessage(msg);
+
+        verify(mCallback, timeout(TIMEOUT_MS)).receiveMessage(eq(SAP_MSG_RIL_REQ), argThat(
+                new ArgumentMatcher<Object>() {
+                    @Override
+                    public boolean matches(Object arg) {
+                        return msg == arg;
+                    }
+                }
+        ));
+    }
+
+    @Test
+    public void sendClientMessage() {
+        mSapServer.mSapHandler = mHandler;
+
+        SapMessage msg = new SapMessage(ID_STATUS_IND);
+        mSapServer.sendClientMessage(msg);
+
+        verify(mCallback, timeout(TIMEOUT_MS)).receiveMessage(eq(SAP_MSG_RFC_REPLY), argThat(
+                new ArgumentMatcher<Object>() {
+                    @Override
+                    public boolean matches(Object arg) {
+                        return msg == arg;
+                    }
+                }
+        ));
+    }
+
+    // TODO: Find a good way to run() method.
+
+    @Test
+    public void clearPendingRilResponses_whenInConnectedBusyState_setsClearRilQueueAsTrue() {
+        SapMessage msg = mock(SapMessage.class);
+
+        mSapServer.changeState(SapServer.SAP_STATE.CONNECTED_BUSY);
+        mSapServer.clearPendingRilResponses(msg);
+
+        verify(msg).setClearRilQueue(true);
+    }
+
+    @Test
+    public void handleMessage_forRfcReplyMsg_callsHandleRfcommReply() {
+        SapMessage sapMsg = mock(SapMessage.class);
+        when(sapMsg.getMsgType()).thenReturn(ID_CONNECT_RESP);
+        when(sapMsg.getConnectionStatus()).thenReturn(CON_STATUS_OK);
+        mSapServer.changeState(SapServer.SAP_STATE.DISCONNECTED);
+
+        Message message = Message.obtain();
+        message.what = SAP_MSG_RFC_REPLY;
+        message.obj = sapMsg;
+
+        try {
+            mSapServer.handleMessage(message);
+
+            verify(mSapServer).handleRfcommReply(sapMsg);
+        } finally {
+            message.recycle();
+        }
+    }
+
+    @Test
+    public void handleMessage_forRilConnectMsg_callsSendRilMessage() throws Exception {
+        SapRilReceiver mockReceiver = mock(SapRilReceiver.class);
+        Object lock = new Object();
+        when(mockReceiver.getSapProxyLock()).thenReturn(lock);
+        mSapServer.mRilBtReceiver = mockReceiver;
+        mSapServer.mSapHandler = mHandler;
+        mSapServer.setTestMode(TEST_MODE_ENABLE);
+
+        Message message = Message.obtain();
+        message.what = SAP_MSG_RIL_CONNECT;
+
+        try {
+            mSapServer.handleMessage(message);
+
+            verify(mSapServer).sendRilMessage(
+                    argThat(sapMsg -> sapMsg.getMsgType() == ID_CONNECT_REQ));
+        } finally {
+            message.recycle();
+        }
+    }
+
+    @Test
+    public void handleMessage_forRilReqMsg_callsSendRilMessage() throws Exception {
+        SapRilReceiver mockReceiver = mock(SapRilReceiver.class);
+        ISap mockSapProxy = mock(ISap.class);
+        Object lock = new Object();
+        when(mockReceiver.getSapProxyLock()).thenReturn(lock);
+        when(mockReceiver.getSapProxy()).thenReturn(mockSapProxy);
+        mSapServer.mRilBtReceiver = mockReceiver;
+        mSapServer.mSapHandler = mHandler;
+
+        SapMessage sapMsg = mock(SapMessage.class);
+        when(sapMsg.getMsgType()).thenReturn(ID_CONNECT_REQ);
+
+        Message message = Message.obtain();
+        message.what = SAP_MSG_RIL_REQ;
+        message.obj = sapMsg;
+
+        try {
+            mSapServer.handleMessage(message);
+
+            verify(mSapServer).sendRilMessage(sapMsg);
+        } finally {
+            message.recycle();
+        }
+    }
+
+    @Test
+    public void handleMessage_forRilIndMsg_callsHandleRilInd() throws Exception {
+        SapMessage sapMsg = mock(SapMessage.class);
+        when(sapMsg.getMsgType()).thenReturn(ID_RIL_UNSOL_DISCONNECT_IND);
+        when(sapMsg.getDisconnectionType()).thenReturn(DISC_GRACEFULL);
+        mSapServer.changeState(SapServer.SAP_STATE.CONNECTED);
+        mSapServer.mSapHandler = mHandler;
+
+        Message message = Message.obtain();
+        message.what = SAP_MSG_RIL_IND;
+        message.obj = sapMsg;
+
+        try {
+            mSapServer.handleMessage(message);
+
+            verify(mSapServer).handleRilInd(sapMsg);
+        } finally {
+            message.recycle();
+        }
+    }
+
+    @Test
+    public void handleMessage_forRilSocketClosedMsg_startsDisconnectTimer() throws Exception {
+        AlarmManager alarmManager = mock(AlarmManager.class);
+        when(mTargetContext.getSystemService(AlarmManager.class)).thenReturn(alarmManager);
+
+        Message message = Message.obtain();
+        message.what = SAP_RIL_SOCK_CLOSED;
+
+        try {
+            mSapServer.handleMessage(message);
+
+            verify(mSapServer).startDisconnectTimer(anyInt(), anyInt());
+        } finally {
+            message.recycle();
+        }
+    }
+
+    @Test
+    public void handleMessage_forProxyDeadMsg_notifiesShutDown() throws Exception {
+        SapRilReceiver mockReceiver = mock(SapRilReceiver.class);
+        AtomicLong cookie = new AtomicLong(23);
+        when(mockReceiver.getSapProxyCookie()).thenReturn(cookie);
+        mSapServer.mRilBtReceiver = mockReceiver;
+
+        Message message = Message.obtain();
+        message.what = SAP_PROXY_DEAD;
+        message.obj = cookie.get();
+
+        try {
+            mSapServer.handleMessage(message);
+
+            verify(mockReceiver).notifyShutdown();
+            verify(mockReceiver).resetSapProxy();
+        } finally {
+            message.recycle();
+        }
+    }
+
+    @Test
+    public void onReceive_phoneStateChangedAction_whenStateIsCallOngoing_callsOnConnectRequest() {
+        mSapServer.mIntentReceiver = mSapServer.new SapServerBroadcastReceiver();
+        mSapServer.mSapHandler = mHandler;
+        Intent intent = new Intent(TelephonyManager.ACTION_PHONE_STATE_CHANGED);
+        intent.putExtra(TelephonyManager.EXTRA_STATE, TelephonyManager.EXTRA_STATE_IDLE);
+
+        mSapServer.changeState(SapServer.SAP_STATE.CONNECTING_CALL_ONGOING);
+        assertThat(mSapServer.mState).isEqualTo(SapServer.SAP_STATE.CONNECTING_CALL_ONGOING);
+        mSapServer.mIntentReceiver.onReceive(mTargetContext, intent);
+
+        verify(mSapServer).onConnectRequest(
+                argThat(sapMsg -> sapMsg.getMsgType() == ID_CONNECT_REQ));
+    }
+
+    @Test
+    public void onReceive_SapDisconnectedAction_forDiscRfcommType_callsShutDown() {
+        mSapServer.mIntentReceiver = mSapServer.new SapServerBroadcastReceiver();
+
+        int disconnectType = SapMessage.DISC_RFCOMM;
+        Intent intent = new Intent(SapServer.SAP_DISCONNECT_ACTION);
+        intent.putExtra(SapServer.SAP_DISCONNECT_TYPE_EXTRA, disconnectType);
+        mSapServer.mIntentReceiver.onReceive(mTargetContext, intent);
+
+        verify(mSapServer).shutdown();
+    }
+
+    @Test
+    public void onReceive_SapDisconnectedAction_forNonDiscRfcommType_callsSendDisconnectInd() {
+        mSapServer.mIntentReceiver = mSapServer.new SapServerBroadcastReceiver();
+        mSapServer.mSapHandler = mHandler;
+
+        int disconnectType = SapMessage.DISC_GRACEFULL;
+        Intent intent = new Intent(SapServer.SAP_DISCONNECT_ACTION);
+        intent.putExtra(SapServer.SAP_DISCONNECT_TYPE_EXTRA, disconnectType);
+        mSapServer.changeState(SapServer.SAP_STATE.CONNECTED);
+        mSapServer.mIntentReceiver.onReceive(mTargetContext, intent);
+
+        verify(mSapServer).sendDisconnectInd(disconnectType);
+    }
+
+    @Test
+    public void onReceive_unknownAction_doesNothing() {
+        Intent intent = new Intent("random intent action");
+
+        try {
+            mSapServer.mIntentReceiver.onReceive(mTargetContext, intent);
+        } catch (Exception e) {
+            assertWithMessage("Exception should not happen.").fail();
+        }
+    }
+
+    public static class TestHandlerCallback implements Handler.Callback {
+
+        @Override
+        public boolean handleMessage(Message msg) {
+            receiveMessage(msg.what, msg.obj);
+            return true;
+        }
+
+        public void receiveMessage(int what, Object obj) {}
+    }
+}
diff --git a/android/app/tests/unit/src/com/android/bluetooth/sap/SapServiceTest.java b/android/app/tests/unit/src/com/android/bluetooth/sap/SapServiceTest.java
index 8295a0c..b9b3dc0 100644
--- a/android/app/tests/unit/src/com/android/bluetooth/sap/SapServiceTest.java
+++ b/android/app/tests/unit/src/com/android/bluetooth/sap/SapServiceTest.java
@@ -13,12 +13,18 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
+
 package com.android.bluetooth.sap;
 
+import static com.google.common.truth.Truth.assertThat;
+
 import static org.mockito.Mockito.anyString;
 import static org.mockito.Mockito.doReturn;
+import static org.mockito.Mockito.when;
 
 import android.bluetooth.BluetoothAdapter;
+import android.bluetooth.BluetoothDevice;
+import android.bluetooth.BluetoothProfile;
 import android.content.Context;
 
 import androidx.test.InstrumentationRegistry;
@@ -26,12 +32,11 @@
 import androidx.test.rule.ServiceTestRule;
 import androidx.test.runner.AndroidJUnit4;
 
-import com.android.bluetooth.R;
 import com.android.bluetooth.TestUtils;
 import com.android.bluetooth.btservice.AdapterService;
+import com.android.bluetooth.btservice.storage.DatabaseManager;
 
 import org.junit.After;
-import org.junit.Assert;
 import org.junit.Assume;
 import org.junit.Before;
 import org.junit.Rule;
@@ -40,9 +45,15 @@
 import org.mockito.Mock;
 import org.mockito.MockitoAnnotations;
 
+import java.util.concurrent.CountDownLatch;
+import java.util.concurrent.TimeUnit;
+import java.util.concurrent.atomic.AtomicBoolean;
+
 @MediumTest
 @RunWith(AndroidJUnit4.class)
 public class SapServiceTest {
+    private static final int TIMEOUT_MS = 5_000;
+
     private SapService mService = null;
     private BluetoothAdapter mAdapter = null;
     private Context mTargetContext;
@@ -50,6 +61,8 @@
     @Rule public final ServiceTestRule mServiceRule = new ServiceTestRule();
 
     @Mock private AdapterService mAdapterService;
+    @Mock private DatabaseManager mDatabaseManager;
+    private BluetoothDevice mDevice;
 
     @Before
     public void setUp() throws Exception {
@@ -61,10 +74,11 @@
         doReturn(true, false).when(mAdapterService).isStartedProfile(anyString());
         TestUtils.startService(mServiceRule, SapService.class);
         mService = SapService.getSapService();
-        Assert.assertNotNull(mService);
+        assertThat(mService).isNotNull();
         // Try getting the Bluetooth adapter
         mAdapter = BluetoothAdapter.getDefaultAdapter();
-        Assert.assertNotNull(mAdapter);
+        assertThat(mAdapter).isNotNull();
+        mDevice = TestUtils.getTestDevice(mAdapter, 0);
     }
 
     @After
@@ -74,12 +88,74 @@
         }
         TestUtils.stopService(mServiceRule, SapService.class);
         mService = SapService.getSapService();
-        Assert.assertNull(mService);
+        assertThat(mService).isNull();
         TestUtils.clearAdapterService(mAdapterService);
     }
 
     @Test
-    public void testInitialize() {
-        Assert.assertNotNull(SapService.getSapService());
+    public void testGetSapService() {
+        assertThat(mService).isEqualTo(SapService.getSapService());
+        assertThat(mService.getConnectedDevices()).isEmpty();
+    }
+
+    /**
+     * Test stop SAP Service
+     */
+    @Test
+    public void testStopSapService() throws Exception {
+        AtomicBoolean stopResult = new AtomicBoolean();
+        AtomicBoolean startResult = new AtomicBoolean();
+        CountDownLatch latch = new CountDownLatch(1);
+
+        // SAP Service is already running: test stop(). Note: must be done on the main thread
+        InstrumentationRegistry.getInstrumentation().runOnMainSync(new Runnable() {
+            public void run() {
+                stopResult.set(mService.stop());
+                startResult.set(mService.start());
+                latch.countDown();
+            }
+        });
+
+        assertThat(latch.await(TIMEOUT_MS, TimeUnit.MILLISECONDS)).isTrue();
+        assertThat(stopResult.get()).isTrue();
+        assertThat(startResult.get()).isTrue();
+    }
+
+    /**
+     * Test get connection policy for BluetoothDevice
+     */
+    @Test
+    public void testGetConnectionPolicy() {
+        when(mAdapterService.getDatabase()).thenReturn(mDatabaseManager);
+        when(mDatabaseManager
+                .getProfileConnectionPolicy(mDevice, BluetoothProfile.SAP))
+                .thenReturn(BluetoothProfile.CONNECTION_POLICY_UNKNOWN);
+        assertThat(mService.getConnectionPolicy(mDevice))
+                .isEqualTo(BluetoothProfile.CONNECTION_POLICY_UNKNOWN);
+
+        when(mDatabaseManager
+                .getProfileConnectionPolicy(mDevice, BluetoothProfile.SAP))
+                .thenReturn(BluetoothProfile.CONNECTION_POLICY_FORBIDDEN);
+        assertThat(mService.getConnectionPolicy(mDevice))
+                .isEqualTo(BluetoothProfile.CONNECTION_POLICY_FORBIDDEN);
+
+        when(mDatabaseManager
+                .getProfileConnectionPolicy(mDevice, BluetoothProfile.SAP))
+                .thenReturn(BluetoothProfile.CONNECTION_POLICY_ALLOWED);
+
+        assertThat(mService.getConnectionPolicy(mDevice))
+                .isEqualTo(BluetoothProfile.CONNECTION_POLICY_ALLOWED);
+    }
+
+    @Test
+    public void testGetRemoteDevice() {
+        assertThat(mService.getRemoteDevice()).isNull();
+    }
+
+    @Test
+    public void testGetRemoteDeviceName() {
+        assertThat(SapService.getRemoteDeviceName()).isNull();
     }
 }
+
+
diff --git a/android/app/tests/unit/src/com/android/bluetooth/tbs/TbsGattTest.java b/android/app/tests/unit/src/com/android/bluetooth/tbs/TbsGattTest.java
index ae817b5..8282b82 100644
--- a/android/app/tests/unit/src/com/android/bluetooth/tbs/TbsGattTest.java
+++ b/android/app/tests/unit/src/com/android/bluetooth/tbs/TbsGattTest.java
@@ -107,6 +107,8 @@
             Looper.prepare();
         }
 
+        getInstrumentation().getUiAutomation().adoptShellPermissionIdentity();
+
         MockitoAnnotations.initMocks(this);
 
         TestUtils.setAdapterService(mAdapterService);
diff --git a/android/app/tests/unit/src/com/android/bluetooth/tbs/TbsGenericTest.java b/android/app/tests/unit/src/com/android/bluetooth/tbs/TbsGenericTest.java
index eae7e09..ac0cc79 100644
--- a/android/app/tests/unit/src/com/android/bluetooth/tbs/TbsGenericTest.java
+++ b/android/app/tests/unit/src/com/android/bluetooth/tbs/TbsGenericTest.java
@@ -35,6 +35,7 @@
 
 import com.android.bluetooth.TestUtils;
 import com.android.bluetooth.btservice.AdapterService;
+import com.android.bluetooth.le_audio.LeAudioService;
 
 import org.junit.After;
 import org.junit.Before;
@@ -81,6 +82,8 @@
         mAdapter = BluetoothAdapter.getDefaultAdapter();
         mContext = getInstrumentation().getTargetContext();
 
+        getInstrumentation().getUiAutomation().adoptShellPermissionIdentity();
+
         // Default TbsGatt mock behavior
         doReturn(true).when(mTbsGatt).init(mGtbsCcidCaptor.capture(), mGtbsUciCaptor.capture(),
                 mDefaultGtbsUriSchemesCaptor.capture(), anyBoolean(), anyBoolean(),
@@ -282,6 +285,9 @@
         Integer ccid = prepareTestBearer();
         reset(mTbsGatt);
 
+        LeAudioService leAudioService = mock(LeAudioService.class);
+        mTbsGeneric.setLeAudioServiceForTesting(leAudioService);
+
         // Prepare the incoming call
         UUID callUuid = UUID.randomUUID();
         List<BluetoothLeCall> tbsCalls = new ArrayList<>();
@@ -310,6 +316,8 @@
             throw e.rethrowFromSystemServer();
         }
         assertThat(callUuidCaptor.getValue().getUuid()).isEqualTo(callUuid);
+        // Active device should be changed
+        verify(leAudioService).setActiveDevice(mCurrentDevice);
 
         // Respond with requestComplete...
         mTbsGeneric.requestResult(ccid, requestIdCaptor.getValue(), BluetoothLeCallControl.RESULT_SUCCESS);
@@ -462,6 +470,9 @@
         Integer ccid = prepareTestBearer();
         reset(mTbsGatt);
 
+        LeAudioService leAudioService = mock(LeAudioService.class);
+        mTbsGeneric.setLeAudioServiceForTesting(leAudioService);
+
         // Act as if peer originates a call via Gtbs
         String uri = "xmpp:123456789";
         mTbsGattCallback.getValue().onCallControlPointRequest(mCurrentDevice,
@@ -476,6 +487,9 @@
             throw e.rethrowFromSystemServer();
         }
 
+        // Active device should be changed
+        verify(leAudioService).setActiveDevice(mCurrentDevice);
+
         // Respond with requestComplete...
         mTbsGeneric.requestResult(ccid, requestIdCaptor.getValue(), BluetoothLeCallControl.RESULT_SUCCESS);
         mTbsGeneric.callAdded(ccid,
diff --git a/android/app/tests/unit/src/com/android/bluetooth/telephony/BluetoothCallTest.java b/android/app/tests/unit/src/com/android/bluetooth/telephony/BluetoothCallTest.java
new file mode 100644
index 0000000..90320e0
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/telephony/BluetoothCallTest.java
@@ -0,0 +1,391 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.telephony;
+
+import static org.junit.Assert.assertThrows;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import android.telecom.Call;
+
+import androidx.test.filters.SmallTest;
+import androidx.test.runner.AndroidJUnit4;
+
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+import java.util.ArrayList;
+import java.util.List;
+import java.util.UUID;
+
+@SmallTest
+@RunWith(AndroidJUnit4.class)
+public class BluetoothCallTest {
+    private BluetoothCall mBluetoothCall;
+
+    @Before
+    public void setUp() {
+        mBluetoothCall = new BluetoothCall(null);
+    }
+
+    @Test
+    public void getCall() {
+        assertThat(mBluetoothCall.getCall()).isNull();
+    }
+
+    @Test
+    public void isCallNull() {
+        assertThat(mBluetoothCall.isCallNull()).isTrue();
+    }
+
+    @Test
+    public void setCall() {
+        mBluetoothCall.setCall(null);
+
+        assertThat(mBluetoothCall.isCallNull()).isTrue();
+    }
+
+    @Test
+    public void constructor_withUuid() {
+        UUID uuid = UUID.randomUUID();
+
+        BluetoothCall bluetoothCall = new BluetoothCall(null, uuid);
+
+        assertThat(bluetoothCall.getTbsCallId()).isEqualTo(uuid);
+    }
+
+    @Test
+    public void setTbsCallId() {
+        UUID uuid = UUID.randomUUID();
+
+        mBluetoothCall.setTbsCallId(uuid);
+
+        assertThat(mBluetoothCall.getTbsCallId()).isEqualTo(uuid);
+    }
+
+    @Test
+    public void getRemainingPostDialSequence_whenInnerCallIsNull_throwsNPE() {
+        assertThrows(NullPointerException.class,
+                () -> mBluetoothCall.getRemainingPostDialSequence());
+    }
+
+    @Test
+    public void answer_whenInnerCallIsNull_throwsNPE() {
+        assertThrows(NullPointerException.class, () -> mBluetoothCall.answer(1));
+    }
+
+    @Test
+    public void deflect_whenInnerCallIsNull_throwsNPE() {
+        assertThrows(NullPointerException.class, () -> mBluetoothCall.deflect(null));
+    }
+
+    @Test
+    public void reject_whenInnerCallIsNull_throwsNPE() {
+        assertThrows(NullPointerException.class, () -> mBluetoothCall.reject(true, "text"));
+    }
+
+    @Test
+    public void disconnect_whenInnerCallIsNull_throwsNPE() {
+        assertThrows(NullPointerException.class, () -> mBluetoothCall.disconnect());
+    }
+
+    @Test
+    public void hold_whenInnerCallIsNull_throwsNPE() {
+        assertThrows(NullPointerException.class, () -> mBluetoothCall.hold());
+    }
+
+    @Test
+    public void unhold_whenInnerCallIsNull_throwsNPE() {
+        assertThrows(NullPointerException.class, () -> mBluetoothCall.unhold());
+    }
+
+    @Test
+    public void enterBackgroundAudioProcessing_whenInnerCallIsNull_throwsNPE() {
+        assertThrows(NullPointerException.class,
+                () -> mBluetoothCall.enterBackgroundAudioProcessing());
+    }
+
+    @Test
+    public void exitBackgroundAudioProcessing_whenInnerCallIsNull_throwsNPE() {
+        assertThrows(NullPointerException.class,
+                () -> mBluetoothCall.exitBackgroundAudioProcessing(true));
+    }
+
+    @Test
+    public void playDtmfTone_whenInnerCallIsNull_throwsNPE() {
+        assertThrows(NullPointerException.class, () -> mBluetoothCall.playDtmfTone('c'));
+    }
+
+    @Test
+    public void stopDtmfTone_whenInnerCallIsNull_throwsNPE() {
+        assertThrows(NullPointerException.class, () -> mBluetoothCall.stopDtmfTone());
+    }
+
+    @Test
+    public void postDialContinue_whenInnerCallIsNull_throwsNPE() {
+        assertThrows(NullPointerException.class, () -> mBluetoothCall.postDialContinue(true));
+    }
+
+    @Test
+    public void phoneAccountSelected_whenInnerCallIsNull_throwsNPE() {
+        assertThrows(NullPointerException.class,
+                () -> mBluetoothCall.phoneAccountSelected(null, true));
+    }
+
+    @Test
+    public void conference_whenInnerCallIsNull_throwsNPE() {
+        BluetoothCall bluetoothCall = new BluetoothCall(null);
+
+        assertThrows(NullPointerException.class, () -> mBluetoothCall.conference(bluetoothCall));
+    }
+
+    @Test
+    public void splitFromConference_whenInnerCallIsNull_throwsNPE() {
+        assertThrows(NullPointerException.class, () -> mBluetoothCall.splitFromConference());
+    }
+
+    @Test
+    public void mergeConference_whenInnerCallIsNull_throwsNPE() {
+        assertThrows(NullPointerException.class, () -> mBluetoothCall.mergeConference());
+    }
+
+    @Test
+    public void swapConference_whenInnerCallIsNull_throwsNPE() {
+        assertThrows(NullPointerException.class, () -> mBluetoothCall.swapConference());
+    }
+
+    @Test
+    public void pullExternalCall_whenInnerCallIsNull_throwsNPE() {
+        assertThrows(NullPointerException.class, () -> mBluetoothCall.pullExternalCall());
+    }
+
+    @Test
+    public void sendCallEvent_whenInnerCallIsNull_throwsNPE() {
+        assertThrows(NullPointerException.class, () -> mBluetoothCall.sendCallEvent("event", null));
+    }
+
+    @Test
+    public void sendRttRequest_whenInnerCallIsNull_throwsNPE() {
+        assertThrows(NullPointerException.class, () -> mBluetoothCall.sendRttRequest());
+    }
+
+    @Test
+    public void respondToRttRequest_whenInnerCallIsNull_throwsNPE() {
+        assertThrows(NullPointerException.class, () -> mBluetoothCall.respondToRttRequest(1, true));
+    }
+
+    @Test
+    public void handoverTo_whenInnerCallIsNull_throwsNPE() {
+        assertThrows(NullPointerException.class, () -> mBluetoothCall.handoverTo(null, 1, null));
+    }
+
+    @Test
+    public void stopRtt_whenInnerCallIsNull_throwsNPE() {
+        assertThrows(NullPointerException.class, () -> mBluetoothCall.stopRtt());
+    }
+
+    @Test
+    public void removeExtras_withArrayListOfStrings_whenInnerCallIsNull_throwsNPE() {
+        ArrayList<String> strings = new ArrayList<>();
+
+        assertThrows(NullPointerException.class, () -> mBluetoothCall.removeExtras(strings));
+    }
+
+    @Test
+    public void removeExtras_withString_whenInnerCallIsNull_throwsNPE() {
+        assertThrows(NullPointerException.class, () -> mBluetoothCall.removeExtras("text"));
+    }
+
+    @Test
+    public void getParentId_whenInnerCallIsNull_throwsNPE() {
+        assertThrows(NullPointerException.class, () -> mBluetoothCall.getParentId());
+    }
+
+    @Test
+    public void getChildrenIds_whenInnerCallIsNull_throwsNPE() {
+        assertThrows(NullPointerException.class, () -> mBluetoothCall.getChildrenIds());
+    }
+
+    @Test
+    public void getConferenceableCalls_whenInnerCallIsNull_throwsNPE() {
+        assertThrows(NullPointerException.class, () -> mBluetoothCall.getConferenceableCalls());
+    }
+
+    @Test
+    public void getState_whenInnerCallIsNull_throwsNPE() {
+        assertThrows(NullPointerException.class, () -> mBluetoothCall.getState());
+    }
+
+    @Test
+    public void getCannedTextResponses_whenInnerCallIsNull_throwsNPE() {
+        assertThrows(NullPointerException.class, () -> mBluetoothCall.getCannedTextResponses());
+    }
+
+    @Test
+    public void getVideoCall_whenInnerCallIsNull_throwsNPE() {
+        assertThrows(NullPointerException.class, () -> mBluetoothCall.getVideoCall());
+    }
+
+    @Test
+    public void getDetails_whenInnerCallIsNull_throwsNPE() {
+        assertThrows(NullPointerException.class, () -> mBluetoothCall.getDetails());
+    }
+
+    @Test
+    public void getRttCall_whenInnerCallIsNull_throwsNPE() {
+        assertThrows(NullPointerException.class, () -> mBluetoothCall.getRttCall());
+    }
+
+    @Test
+    public void isRttActive_whenInnerCallIsNull_throwsNPE() {
+        assertThrows(NullPointerException.class, () -> mBluetoothCall.isRttActive());
+    }
+
+    @Test
+    public void registerCallback_whenInnerCallIsNull_throwsNPE() {
+        assertThrows(NullPointerException.class, () -> mBluetoothCall.registerCallback(null));
+    }
+
+    @Test
+    public void registerCallback_withHandler_whenInnerCallIsNull_throwsNPE() {
+        assertThrows(NullPointerException.class, () -> mBluetoothCall.registerCallback(null, null));
+    }
+
+    @Test
+    public void unregisterCallback_whenInnerCallIsNull_throwsNPE() {
+        assertThrows(NullPointerException.class, () -> mBluetoothCall.unregisterCallback(null));
+    }
+
+    @Test
+    public void toString_throwsException_whenInnerCallIsNull_throwsNPE() {
+        assertThrows(NullPointerException.class, () -> mBluetoothCall.toString());
+    }
+
+    @Test
+    public void addListener_whenInnerCallIsNull_throwsNPE() {
+        assertThrows(NullPointerException.class, () -> mBluetoothCall.addListener(null));
+    }
+
+    @Test
+    public void removeListener_whenInnerCallIsNull_throwsNPE() {
+        assertThrows(NullPointerException.class, () -> mBluetoothCall.removeListener(null));
+    }
+
+    @Test
+    public void getGenericConferenceActiveChildCallId_whenInnerCallIsNull_throwsNPE() {
+        assertThrows(NullPointerException.class,
+                () -> mBluetoothCall.getGenericConferenceActiveChildCallId());
+    }
+
+    @Test
+    public void getContactDisplayName_whenInnerCallIsNull_throwsNPE() {
+        assertThrows(NullPointerException.class, () -> mBluetoothCall.getContactDisplayName());
+    }
+
+    @Test
+    public void getAccountHandle_whenInnerCallIsNull_throwsNPE() {
+        assertThrows(NullPointerException.class, () -> mBluetoothCall.getAccountHandle());
+    }
+
+    @Test
+    public void getVideoState_whenInnerCallIsNull_throwsNPE() {
+        assertThrows(NullPointerException.class, () -> mBluetoothCall.getVideoState());
+    }
+
+    @Test
+    public void getCallerDisplayName_whenInnerCallIsNull_throwsNPE() {
+        assertThrows(NullPointerException.class, () -> mBluetoothCall.getCallerDisplayName());
+    }
+
+    @Test
+    public void equals_withNull() {
+        assertThat(mBluetoothCall.equals(null)).isTrue();
+    }
+
+    @Test
+    public void equals_withBluetoothCall() {
+        BluetoothCall bluetoothCall = new BluetoothCall(null);
+
+        assertThat(mBluetoothCall).isEqualTo(bluetoothCall);
+    }
+
+    @Test
+    public void isSilentRingingRequested_whenInnerCallIsNull_throwsNPE() {
+        assertThrows(NullPointerException.class, () -> mBluetoothCall.isSilentRingingRequested());
+    }
+
+    @Test
+    public void isConference_whenInnerCallIsNull_throwsNPE() {
+        assertThrows(NullPointerException.class, () -> mBluetoothCall.isConference());
+    }
+
+    @Test
+    public void can_whenInnerCallIsNull_throwsNPE() {
+        assertThrows(NullPointerException.class, () -> mBluetoothCall.can(1));
+    }
+
+    @Test
+    public void getHandle_whenInnerCallIsNull_throwsNPE() {
+        assertThrows(NullPointerException.class, () -> mBluetoothCall.getHandle());
+    }
+
+    @Test
+    public void getGatewayInfo_whenInnerCallIsNull_throwsNPE() {
+        assertThrows(NullPointerException.class, () -> mBluetoothCall.getGatewayInfo());
+    }
+
+    @Test
+    public void isIncoming_whenInnerCallIsNull_throwsNPE() {
+        assertThrows(NullPointerException.class, () -> mBluetoothCall.isIncoming());
+    }
+
+    @Test
+    public void isExternalCall_whenInnerCallIsNull_throwsNPE() {
+        assertThrows(NullPointerException.class, () -> mBluetoothCall.isExternalCall());
+    }
+
+    @Test
+    public void getId() {
+        assertThat(mBluetoothCall.getId()).isEqualTo(System.identityHashCode(null));
+    }
+
+    @Test
+    public void wasConferencePreviouslyMerged_whenInnerCallIsNull_throwsNPE() {
+        assertThrows(NullPointerException.class,
+                () -> mBluetoothCall.wasConferencePreviouslyMerged());
+    }
+
+    @Test
+    public void getDisconnectCause_whenInnerCallIsNull_throwsNPE() {
+        assertThrows(NullPointerException.class, () -> mBluetoothCall.getDisconnectCause());
+    }
+
+    @Test
+    public void getIds_withEmptyList() {
+        List<Call> calls = new ArrayList<>();
+
+        List<Integer> result = BluetoothCall.getIds(calls);
+
+        assertThat(result).isEmpty();
+    }
+
+    @Test
+    public void hasProperty_whenInnerCallIsNull_throwsNPE() {
+        assertThrows(NullPointerException.class, () -> mBluetoothCall.hasProperty(1));
+    }
+}
diff --git a/android/app/tests/unit/src/com/android/bluetooth/telephony/BluetoothInCallServiceTest.java b/android/app/tests/unit/src/com/android/bluetooth/telephony/BluetoothInCallServiceTest.java
index 8fcdf79..9332eea 100644
--- a/android/app/tests/unit/src/com/android/bluetooth/telephony/BluetoothInCallServiceTest.java
+++ b/android/app/tests/unit/src/com/android/bluetooth/telephony/BluetoothInCallServiceTest.java
@@ -20,16 +20,21 @@
 import static org.mockito.Mockito.*;
 
 import android.bluetooth.BluetoothAdapter;
+import android.bluetooth.BluetoothLeCallControl;
 import android.content.ComponentName;
+import android.content.Context;
 import android.content.Intent;
 import android.content.IntentFilter;
+import android.content.pm.ApplicationInfo;
 import android.net.Uri;
 import android.os.Binder;
+import android.os.Build;
 import android.os.Bundle;
 import android.os.IBinder;
 import android.telecom.BluetoothCallQualityReport;
 import android.telecom.Call;
 import android.telecom.Connection;
+import android.telecom.DisconnectCause;
 import android.telecom.GatewayInfo;
 import android.telecom.PhoneAccount;
 import android.telecom.PhoneAccountHandle;
@@ -39,6 +44,7 @@
 import android.util.Log;
 
 import androidx.test.core.app.ApplicationProvider;
+import androidx.test.InstrumentationRegistry;
 import androidx.test.filters.MediumTest;
 import androidx.test.rule.ServiceTestRule;
 import androidx.test.runner.AndroidJUnit4;
@@ -91,13 +97,20 @@
     private static final int CHLD_TYPE_ADDHELDTOCONF = 3;
 
     private TestableBluetoothInCallService mBluetoothInCallService;
-    @Rule public final ServiceTestRule mServiceRule
+    @Rule
+    public final ServiceTestRule mServiceRule
             = ServiceTestRule.withTimeout(1, TimeUnit.SECONDS);
 
-    @Mock private BluetoothHeadsetProxy mMockBluetoothHeadset;
-    @Mock private BluetoothLeCallControlProxy mMockBluetoothLeCallControl;
-    @Mock private BluetoothInCallService.CallInfo mMockCallInfo;
-    @Mock private TelephonyManager mMockTelephonyManager;
+    @Mock
+    private BluetoothHeadsetProxy mMockBluetoothHeadset;
+    @Mock
+    private BluetoothLeCallControlProxy mMockBluetoothLeCallControl;
+    @Mock
+    private BluetoothInCallService.CallInfo mMockCallInfo;
+    @Mock
+    private TelephonyManager mMockTelephonyManager;
+    @Mock
+    private Context mContext = ApplicationProvider.getApplicationContext();
 
     public class TestableBluetoothInCallService extends BluetoothInCallService {
         @Override
@@ -109,8 +122,10 @@
             mTelecomManager = getSystemService(TelecomManager.class);
             return binder;
         }
+
         @Override
-        protected void enforceModifyPermission() {}
+        protected void enforceModifyPermission() {
+        }
 
         protected void setOnCreateCalled(boolean called) {
             mOnCreateCalled = called;
@@ -120,6 +135,7 @@
     @Before
     public void setUp() throws Exception {
         MockitoAnnotations.initMocks(this);
+        InstrumentationRegistry.getInstrumentation().getUiAutomation().adoptShellPermissionIdentity();
 
         // Create the service Intent.
         Intent serviceIntent =
@@ -329,7 +345,7 @@
         // still occurring, it will look like there is an active and held BluetoothCall still while
         // we are transitioning into a conference.
         // BluetoothCall has been put into a CDMA "conference" with one BluetoothCall on hold.
-        ArrayList<BluetoothCall>   calls = new ArrayList<>();
+        ArrayList<BluetoothCall> calls = new ArrayList<>();
         BluetoothCall parentCall = createActiveCall();
         final BluetoothCall confCall1 = getMockCall();
         final BluetoothCall confCall2 = createHeldCall();
@@ -663,8 +679,6 @@
     public void testListCurrentCallsImsConference() throws Exception {
         ArrayList<BluetoothCall> calls = new ArrayList<>();
         BluetoothCall parentCall = createActiveCall();
-        calls.add(parentCall);
-        mBluetoothInCallService.onCallAdded(parentCall);
 
         addCallCapability(parentCall, Connection.CAPABILITY_CONFERENCE_HAS_NO_CHILDREN);
         when(parentCall.isConference()).thenReturn(true);
@@ -673,6 +687,9 @@
         when(parentCall.getHandle()).thenReturn(Uri.parse("tel:555-0000"));
         when(mMockCallInfo.getBluetoothCalls()).thenReturn(calls);
 
+        calls.add(parentCall);
+        mBluetoothInCallService.onCallAdded(parentCall);
+
         clearInvocations(mMockBluetoothHeadset);
         mBluetoothInCallService.listCurrentCalls();
 
@@ -702,13 +719,15 @@
         Integer parentId = parentCall.getId();
         when(childCall1.getParentId()).thenReturn(parentId);
         when(childCall2.getParentId()).thenReturn(parentId);
+        List<Integer> childrenIds = Arrays.asList(childCall1.getId(),
+                childCall2.getId());
+        when(parentCall.getChildrenIds()).thenReturn(childrenIds);
 
         when(parentCall.isConference()).thenReturn(true);
         when(parentCall.getState()).thenReturn(Call.STATE_HOLDING);
         when(childCall1.getState()).thenReturn(Call.STATE_ACTIVE);
         when(childCall2.getState()).thenReturn(Call.STATE_ACTIVE);
         when(parentCall.hasProperty(Call.Details.PROPERTY_GENERIC_CONFERENCE)).thenReturn(true);
-
         when(parentCall.isIncoming()).thenReturn(true);
         when(mMockCallInfo.getBluetoothCalls()).thenReturn(calls);
 
@@ -723,6 +742,30 @@
     }
 
     @Test
+    public void testListCurrentCallsConferenceGetChildrenIsEmpty() throws Exception {
+        ArrayList<BluetoothCall> calls = new ArrayList<>();
+        BluetoothCall conferenceCall = createActiveCall();
+        when(conferenceCall.getHandle()).thenReturn(Uri.parse("tel:555-1234"));
+
+        addCallCapability(conferenceCall, Connection.CAPABILITY_MANAGE_CONFERENCE);
+        when(conferenceCall.isConference()).thenReturn(true);
+        when(conferenceCall.getState()).thenReturn(Call.STATE_ACTIVE);
+        when(conferenceCall.hasProperty(Call.Details.PROPERTY_GENERIC_CONFERENCE)).thenReturn(true);
+        when(conferenceCall.can(Connection.CAPABILITY_CONFERENCE_HAS_NO_CHILDREN))
+                .thenReturn(false);
+        when(conferenceCall.isIncoming()).thenReturn(true);
+        when(mMockCallInfo.getBluetoothCalls()).thenReturn(calls);
+
+        calls.add(conferenceCall);
+        mBluetoothInCallService.onCallAdded(conferenceCall);
+
+        clearInvocations(mMockBluetoothHeadset);
+        mBluetoothInCallService.listCurrentCalls();
+        verify(mMockBluetoothHeadset).clccResponse(
+                eq(1), eq(1), eq(0), eq(0), eq(true), eq("5551234"), eq(129));
+    }
+
+    @Test
     public void testQueryPhoneState() throws Exception {
         BluetoothCall ringingCall = createRingingCall();
         when(ringingCall.getHandle()).thenReturn(Uri.parse("tel:5550000"));
@@ -1169,6 +1212,208 @@
                 eq("5550000"), eq(PhoneNumberUtils.TOA_Unknown), nullable(String.class));
     }
 
+    @Test
+    public void testClear() {
+        doNothing().when(mContext).unregisterReceiver(any(
+                BluetoothInCallService.BluetoothAdapterReceiver.class));
+        mBluetoothInCallService.attachBaseContext(mContext);
+        mBluetoothInCallService.mBluetoothAdapterReceiver
+                = mBluetoothInCallService.new BluetoothAdapterReceiver();
+        Assert.assertNotNull(mBluetoothInCallService.mBluetoothAdapterReceiver);
+        Assert.assertNotNull(mBluetoothInCallService.mBluetoothHeadset);
+
+        mBluetoothInCallService.clear();
+
+        Assert.assertNull(mBluetoothInCallService.mBluetoothAdapterReceiver);
+        Assert.assertNull(mBluetoothInCallService.mBluetoothHeadset);
+    }
+
+    @Test
+    public void testGetBearerTechnology() {
+        mBluetoothInCallService.mTelephonyManager = mMockTelephonyManager;
+
+        when(mMockTelephonyManager.getDataNetworkType()).thenReturn(
+                TelephonyManager.NETWORK_TYPE_GSM);
+        Assert.assertEquals(mBluetoothInCallService.getBearerTechnology(),
+                BluetoothLeCallControlProxy.BEARER_TECHNOLOGY_GSM);
+
+        when(mMockTelephonyManager.getDataNetworkType()).thenReturn(
+                TelephonyManager.NETWORK_TYPE_GPRS);
+        Assert.assertEquals(mBluetoothInCallService.getBearerTechnology(),
+                BluetoothLeCallControlProxy.BEARER_TECHNOLOGY_2G);
+
+        when(mMockTelephonyManager.getDataNetworkType()).thenReturn(
+                TelephonyManager.NETWORK_TYPE_EVDO_B);
+        Assert.assertEquals(mBluetoothInCallService.getBearerTechnology(),
+                BluetoothLeCallControlProxy.BEARER_TECHNOLOGY_3G);
+
+        when(mMockTelephonyManager.getDataNetworkType()).thenReturn(
+                TelephonyManager.NETWORK_TYPE_TD_SCDMA);
+        Assert.assertEquals(mBluetoothInCallService.getBearerTechnology(),
+                BluetoothLeCallControlProxy.BEARER_TECHNOLOGY_WCDMA);
+
+        when(mMockTelephonyManager.getDataNetworkType()).thenReturn(
+                TelephonyManager.NETWORK_TYPE_LTE);
+        Assert.assertEquals(mBluetoothInCallService.getBearerTechnology(),
+                BluetoothLeCallControlProxy.BEARER_TECHNOLOGY_LTE);
+
+        when(mMockTelephonyManager.getDataNetworkType()).thenReturn(
+                TelephonyManager.NETWORK_TYPE_1xRTT);
+        Assert.assertEquals(mBluetoothInCallService.getBearerTechnology(),
+                BluetoothLeCallControlProxy.BEARER_TECHNOLOGY_CDMA);
+
+        when(mMockTelephonyManager.getDataNetworkType()).thenReturn(
+                TelephonyManager.NETWORK_TYPE_HSPAP);
+        Assert.assertEquals(mBluetoothInCallService.getBearerTechnology(),
+                BluetoothLeCallControlProxy.BEARER_TECHNOLOGY_4G);
+
+        when(mMockTelephonyManager.getDataNetworkType()).thenReturn(
+                TelephonyManager.NETWORK_TYPE_IWLAN);
+        Assert.assertEquals(mBluetoothInCallService.getBearerTechnology(),
+                BluetoothLeCallControlProxy.BEARER_TECHNOLOGY_WIFI);
+
+        when(mMockTelephonyManager.getDataNetworkType()).thenReturn(
+                TelephonyManager.NETWORK_TYPE_NR);
+        Assert.assertEquals(mBluetoothInCallService.getBearerTechnology(),
+                BluetoothLeCallControlProxy.BEARER_TECHNOLOGY_5G);
+
+        when(mMockTelephonyManager.getDataNetworkType()).thenReturn(
+                TelephonyManager.NETWORK_TYPE_LTE_CA);
+        Assert.assertEquals(mBluetoothInCallService.getBearerTechnology(),
+                BluetoothLeCallControlProxy.BEARER_TECHNOLOGY_GSM);
+    }
+
+    @Test
+    public void testGetTbsTerminationReason() {
+        BluetoothCall call = getMockCall();
+
+        when(call.getDisconnectCause()).thenReturn(null);
+        Assert.assertEquals(mBluetoothInCallService.getTbsTerminationReason(call),
+                BluetoothLeCallControl.TERMINATION_REASON_FAIL);
+
+        DisconnectCause cause = new DisconnectCause(DisconnectCause.BUSY, null, null, null, 1);
+        when(call.getDisconnectCause()).thenReturn(cause);
+        Assert.assertEquals(mBluetoothInCallService.getTbsTerminationReason(call),
+                BluetoothLeCallControl.TERMINATION_REASON_LINE_BUSY);
+
+        cause = new DisconnectCause(DisconnectCause.REJECTED, null, null, null, 1);
+        when(call.getDisconnectCause()).thenReturn(cause);
+        Assert.assertEquals(mBluetoothInCallService.getTbsTerminationReason(call),
+                BluetoothLeCallControl.TERMINATION_REASON_REMOTE_HANGUP);
+
+        cause = new DisconnectCause(DisconnectCause.LOCAL, null, null, null, 1);
+        when(call.getDisconnectCause()).thenReturn(cause);
+        mBluetoothInCallService.mIsTerminatedByClient = false;
+        Assert.assertEquals(mBluetoothInCallService.getTbsTerminationReason(call),
+                BluetoothLeCallControl.TERMINATION_REASON_SERVER_HANGUP);
+
+        cause = new DisconnectCause(DisconnectCause.LOCAL, null, null, null, 1);
+        when(call.getDisconnectCause()).thenReturn(cause);
+        mBluetoothInCallService.mIsTerminatedByClient = true;
+        Assert.assertEquals(mBluetoothInCallService.getTbsTerminationReason(call),
+                BluetoothLeCallControl.TERMINATION_REASON_CLIENT_HANGUP);
+
+        cause = new DisconnectCause(DisconnectCause.ERROR, null, null, null, 1);
+        when(call.getDisconnectCause()).thenReturn(cause);
+        Assert.assertEquals(mBluetoothInCallService.getTbsTerminationReason(call),
+                BluetoothLeCallControl.TERMINATION_REASON_NETWORK_CONGESTION);
+
+        cause = new DisconnectCause(
+                DisconnectCause.CONNECTION_MANAGER_NOT_SUPPORTED, null, null, null, 1);
+        when(call.getDisconnectCause()).thenReturn(cause);
+        Assert.assertEquals(mBluetoothInCallService.getTbsTerminationReason(call),
+                BluetoothLeCallControl.TERMINATION_REASON_INVALID_URI);
+
+        cause = new DisconnectCause(DisconnectCause.ERROR, null, null, null, 1);
+        when(call.getDisconnectCause()).thenReturn(cause);
+        Assert.assertEquals(mBluetoothInCallService.getTbsTerminationReason(call),
+                BluetoothLeCallControl.TERMINATION_REASON_NETWORK_CONGESTION);
+    }
+
+    @Test
+    public void testOnCreate() {
+        ApplicationInfo applicationInfo = new ApplicationInfo();
+        applicationInfo.targetSdkVersion = Build.VERSION_CODES.S;
+        when(mContext.getApplicationInfo()).thenReturn(applicationInfo);
+        mBluetoothInCallService.attachBaseContext(mContext);
+        mBluetoothInCallService.setOnCreateCalled(false);
+        Assert.assertNull(mBluetoothInCallService.mBluetoothAdapterReceiver);
+
+        mBluetoothInCallService.onCreate();
+
+        Assert.assertNotNull(mBluetoothInCallService.mBluetoothAdapterReceiver);
+        Assert.assertTrue(mBluetoothInCallService.mOnCreateCalled);
+    }
+
+    @Test
+    public void testOnDestroy() {
+        Assert.assertTrue(mBluetoothInCallService.mOnCreateCalled);
+
+        mBluetoothInCallService.onDestroy();
+
+        Assert.assertFalse(mBluetoothInCallService.mOnCreateCalled);
+    }
+
+    @Test
+    public void testLeCallControlCallback_onAcceptCall_withUnknownCallId() {
+        BluetoothLeCallControlProxy callControlProxy = mock(BluetoothLeCallControlProxy.class);
+        mBluetoothInCallService.mBluetoothLeCallControl = callControlProxy;
+        BluetoothLeCallControl.Callback callback =
+                mBluetoothInCallService.mBluetoothLeCallControlCallback;
+
+        int requestId = 1;
+        UUID unknownCallId = UUID.randomUUID();
+        callback.onAcceptCall(requestId, unknownCallId);
+
+        verify(callControlProxy).requestResult(
+                requestId, BluetoothLeCallControl.RESULT_ERROR_UNKNOWN_CALL_ID);
+    }
+
+    @Test
+    public void testLeCallControlCallback_onTerminateCall_withUnknownCallId() {
+        BluetoothLeCallControlProxy callControlProxy = mock(BluetoothLeCallControlProxy.class);
+        mBluetoothInCallService.mBluetoothLeCallControl = callControlProxy;
+        BluetoothLeCallControl.Callback callback =
+                mBluetoothInCallService.mBluetoothLeCallControlCallback;
+
+        int requestId = 1;
+        UUID unknownCallId = UUID.randomUUID();
+        callback.onTerminateCall(requestId, unknownCallId);
+
+        verify(callControlProxy).requestResult(
+                requestId, BluetoothLeCallControl.RESULT_ERROR_UNKNOWN_CALL_ID);
+    }
+
+    @Test
+    public void testLeCallControlCallback_onHoldCall_withUnknownCallId() {
+        BluetoothLeCallControlProxy callControlProxy = mock(BluetoothLeCallControlProxy.class);
+        mBluetoothInCallService.mBluetoothLeCallControl = callControlProxy;
+        BluetoothLeCallControl.Callback callback =
+                mBluetoothInCallService.mBluetoothLeCallControlCallback;
+
+        int requestId = 1;
+        UUID unknownCallId = UUID.randomUUID();
+        callback.onHoldCall(requestId, unknownCallId);
+
+        verify(callControlProxy).requestResult(
+                requestId, BluetoothLeCallControl.RESULT_ERROR_UNKNOWN_CALL_ID);
+    }
+
+    @Test
+    public void testLeCallControlCallback_onUnholdCall_withUnknownCallId() {
+        BluetoothLeCallControlProxy callControlProxy = mock(BluetoothLeCallControlProxy.class);
+        mBluetoothInCallService.mBluetoothLeCallControl = callControlProxy;
+        BluetoothLeCallControl.Callback callback =
+                mBluetoothInCallService.mBluetoothLeCallControlCallback;
+
+        int requestId = 1;
+        UUID unknownCallId = UUID.randomUUID();
+        callback.onUnholdCall(requestId, unknownCallId);
+
+        verify(callControlProxy).requestResult(
+                requestId, BluetoothLeCallControl.RESULT_ERROR_UNKNOWN_CALL_ID);
+    }
+
     private void addCallCapability(BluetoothCall call, int capability) {
         when(call.can(capability)).thenReturn(true);
     }
diff --git a/android/app/tests/unit/src/com/android/bluetooth/telephony/CallInfoTest.java b/android/app/tests/unit/src/com/android/bluetooth/telephony/CallInfoTest.java
new file mode 100644
index 0000000..af77f4f
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/telephony/CallInfoTest.java
@@ -0,0 +1,306 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.telephony;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import static org.mockito.Mockito.doReturn;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.spy;
+import static org.mockito.Mockito.when;
+
+import android.content.ComponentName;
+import android.net.Uri;
+import android.os.Process;
+import android.telecom.Call;
+import android.telecom.PhoneAccount;
+import android.telecom.PhoneAccountHandle;
+import android.telecom.TelecomManager;
+
+import androidx.test.filters.SmallTest;
+import androidx.test.runner.AndroidJUnit4;
+
+import org.junit.After;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.Mock;
+import org.mockito.MockitoAnnotations;
+
+import java.util.ArrayList;
+import java.util.LinkedHashSet;
+import java.util.List;
+import java.util.UUID;
+
+@SmallTest
+@RunWith(AndroidJUnit4.class)
+public class CallInfoTest {
+
+    private static final String TEST_ACCOUNT_ADDRESS = "https://foo.com/";
+    private static final int TEST_ACCOUNT_INDEX = 0;
+
+    @Mock
+    private TelecomManager mMockTelecomManager;
+
+    private BluetoothInCallService mBluetoothInCallService;
+    private BluetoothInCallService.CallInfo mMockCallInfo;
+
+    @Before
+    public void setUp() throws Exception {
+        MockitoAnnotations.initMocks(this);
+
+        mBluetoothInCallService = new BluetoothInCallService();
+        mMockCallInfo = spy(mBluetoothInCallService.new CallInfo());
+    }
+
+    @After
+    public void tearDown() throws Exception {
+        mBluetoothInCallService = null;
+    }
+
+    @Test
+    public void getBluetoothCalls() {
+        assertThat(mMockCallInfo.getBluetoothCalls()).isEmpty();
+    }
+
+    @Test
+    public void getActiveCall() {
+        BluetoothCall activeCall = getMockCall();
+        when(activeCall.getState()).thenReturn(Call.STATE_ACTIVE);
+        ArrayList<BluetoothCall> calls = new ArrayList<>();
+        calls.add(activeCall);
+
+        doReturn(calls).when(mMockCallInfo).getBluetoothCalls();
+
+        assertThat(mMockCallInfo.getActiveCall()).isEqualTo(activeCall);
+    }
+
+    @Test
+    public void getHeldCall() {
+        BluetoothCall heldCall = getMockCall();
+        when(heldCall.getState()).thenReturn(Call.STATE_HOLDING);
+        ArrayList<BluetoothCall> calls = new ArrayList<>();
+        calls.add(heldCall);
+
+        doReturn(calls).when(mMockCallInfo).getBluetoothCalls();
+
+        assertThat(mMockCallInfo.getHeldCall()).isEqualTo(heldCall);
+        assertThat(mMockCallInfo.getNumHeldCalls()).isEqualTo(1);
+    }
+
+    @Test
+    public void getOutgoingCall() {
+        BluetoothCall outgoingCall = getMockCall();
+        when(outgoingCall.getState()).thenReturn(Call.STATE_PULLING_CALL);
+        ArrayList<BluetoothCall> calls = new ArrayList<>();
+        calls.add(outgoingCall);
+
+        doReturn(calls).when(mMockCallInfo).getBluetoothCalls();
+
+        assertThat(mMockCallInfo.getOutgoingCall()).isEqualTo(outgoingCall);
+    }
+
+    @Test
+    public void getRingingOrSimulatedRingingCall() {
+        BluetoothCall ringingCall = getMockCall();
+        when(ringingCall.getState()).thenReturn(Call.STATE_SIMULATED_RINGING);
+        ArrayList<BluetoothCall> calls = new ArrayList<>();
+        calls.add(ringingCall);
+
+        doReturn(calls).when(mMockCallInfo).getBluetoothCalls();
+
+        assertThat(mMockCallInfo.getRingingOrSimulatedRingingCall()).isEqualTo(ringingCall);
+    }
+
+    @Test
+    public void hasOnlyDisconnectedCalls_withNoCalls() {
+        assertThat(mMockCallInfo.getBluetoothCalls()).isEmpty();
+
+        assertThat(mMockCallInfo.hasOnlyDisconnectedCalls()).isFalse();
+    }
+
+    @Test
+    public void hasOnlyDisconnectedCalls_withConnectedCall() {
+        BluetoothCall activeCall = getMockCall();
+        when(activeCall.getState()).thenReturn(Call.STATE_ACTIVE);
+        ArrayList<BluetoothCall> calls = new ArrayList<>();
+        calls.add(activeCall);
+
+        doReturn(calls).when(mMockCallInfo).getBluetoothCalls();
+
+        assertThat(mMockCallInfo.hasOnlyDisconnectedCalls()).isFalse();
+    }
+
+    @Test
+    public void hasOnlyDisconnectedCalls_withDisconnectedCallOnly() {
+        BluetoothCall disconnectedCall = getMockCall();
+        when(disconnectedCall.getState()).thenReturn(Call.STATE_DISCONNECTED);
+        ArrayList<BluetoothCall> calls = new ArrayList<>();
+        calls.add(disconnectedCall);
+
+        doReturn(calls).when(mMockCallInfo).getBluetoothCalls();
+
+        assertThat(mMockCallInfo.hasOnlyDisconnectedCalls()).isTrue();
+    }
+
+    @Test
+    public void getForegroundCall_withConnectingCall() {
+        BluetoothCall connectingCall = getMockCall();
+        when(connectingCall.getState()).thenReturn(Call.STATE_CONNECTING);
+        ArrayList<BluetoothCall> calls = new ArrayList<>();
+        calls.add(connectingCall);
+
+        doReturn(calls).when(mMockCallInfo).getBluetoothCalls();
+
+        assertThat(mMockCallInfo.getForegroundCall()).isEqualTo(connectingCall);
+    }
+
+    @Test
+    public void getForegroundCall_withPullingCall() {
+        BluetoothCall pullingCall = getMockCall();
+        when(pullingCall.getState()).thenReturn(Call.STATE_PULLING_CALL);
+        ArrayList<BluetoothCall> calls = new ArrayList<>();
+        calls.add(pullingCall);
+
+        doReturn(calls).when(mMockCallInfo).getBluetoothCalls();
+
+        assertThat(mMockCallInfo.getForegroundCall()).isEqualTo(pullingCall);
+    }
+
+    @Test
+    public void getForegroundCall_withRingingCall() {
+        BluetoothCall ringingCall = getMockCall();
+        when(ringingCall.getState()).thenReturn(Call.STATE_CONNECTING);
+        ArrayList<BluetoothCall> calls = new ArrayList<>();
+        calls.add(ringingCall);
+
+        doReturn(calls).when(mMockCallInfo).getBluetoothCalls();
+
+        assertThat(mMockCallInfo.getForegroundCall()).isEqualTo(ringingCall);
+    }
+
+    @Test
+    public void getForegroundCall_withNoMatchingCall() {
+        BluetoothCall disconnectedCall = getMockCall();
+        when(disconnectedCall.getState()).thenReturn(Call.STATE_DISCONNECTED);
+        ArrayList<BluetoothCall> calls = new ArrayList<>();
+        calls.add(disconnectedCall);
+
+        doReturn(calls).when(mMockCallInfo).getBluetoothCalls();
+
+        assertThat(mMockCallInfo.getForegroundCall()).isNull();
+    }
+
+    @Test
+    public void getCallByState_withNoMatchingCall() {
+        BluetoothCall activeCall = getMockCall();
+        when(activeCall.getState()).thenReturn(Call.STATE_ACTIVE);
+        ArrayList<BluetoothCall> calls = new ArrayList<>();
+        calls.add(activeCall);
+
+        doReturn(calls).when(mMockCallInfo).getBluetoothCalls();
+
+        assertThat(mMockCallInfo.getCallByState(Call.STATE_HOLDING)).isNull();
+    }
+
+    @Test
+    public void getCallByStates_withNoMatchingCall() {
+        LinkedHashSet<Integer> states = new LinkedHashSet<>();
+        states.add(Call.STATE_CONNECTING);
+        BluetoothCall activeCall = getMockCall();
+        when(activeCall.getState()).thenReturn(Call.STATE_ACTIVE);
+        ArrayList<BluetoothCall> calls = new ArrayList<>();
+        calls.add(activeCall);
+
+        doReturn(calls).when(mMockCallInfo).getBluetoothCalls();
+
+        assertThat(mMockCallInfo.getCallByStates(states)).isNull();
+    }
+
+    @Test
+    public void getCallByCallId() {
+        BluetoothCall call = getMockCall();
+        UUID uuid = UUID.randomUUID();
+        when(call.getTbsCallId()).thenReturn(uuid);
+        ArrayList<BluetoothCall> calls = new ArrayList<>();
+        calls.add(call);
+
+        doReturn(calls).when(mMockCallInfo).getBluetoothCalls();
+
+        assertThat(mMockCallInfo.getCallByCallId(uuid)).isEqualTo(call);
+    }
+
+    @Test
+    public void getCallByCallId_withNoCalls() {
+        UUID uuid = UUID.randomUUID();
+        assertThat(mMockCallInfo.getBluetoothCalls()).isEmpty();
+
+        assertThat(mMockCallInfo.getCallByCallId(uuid)).isNull();
+    }
+
+    @Test
+    public void getBestPhoneAccount() {
+        BluetoothCall foregroundCall = getMockCall();
+        when(foregroundCall.getState()).thenReturn(Call.STATE_DIALING);
+        when(foregroundCall.getAccountHandle()).thenReturn(null);
+
+        ArrayList<BluetoothCall> calls = new ArrayList<>();
+        calls.add(foregroundCall);
+        doReturn(calls).when(mMockCallInfo).getBluetoothCalls();
+
+        String testId = "id0";
+        List<PhoneAccountHandle> handles = new ArrayList<>();
+        PhoneAccountHandle testHandle = makeQuickAccountHandle(testId);
+        handles.add(testHandle);
+        when(mMockTelecomManager.getPhoneAccountsSupportingScheme(
+                PhoneAccount.SCHEME_TEL)).thenReturn(handles);
+
+        PhoneAccount fakePhoneAccount = makeQuickAccount(testId, TEST_ACCOUNT_INDEX);
+        when(mMockTelecomManager.getPhoneAccount(testHandle)).thenReturn(fakePhoneAccount);
+        mBluetoothInCallService.mTelecomManager = mMockTelecomManager;
+
+        assertThat(mMockCallInfo.getBestPhoneAccount()).isEqualTo(fakePhoneAccount);
+    }
+
+    private static ComponentName makeQuickConnectionServiceComponentName() {
+        return new ComponentName("com.placeholder.connectionservice.package.name",
+                "com.placeholder.connectionservice.class.name");
+    }
+
+    private static PhoneAccountHandle makeQuickAccountHandle(String id) {
+        return new PhoneAccountHandle(makeQuickConnectionServiceComponentName(), id,
+                Process.myUserHandle());
+    }
+
+    private PhoneAccount.Builder makeQuickAccountBuilder(String id, int idx) {
+        return new PhoneAccount.Builder(makeQuickAccountHandle(id), "label" + idx);
+    }
+
+    private PhoneAccount makeQuickAccount(String id, int idx) {
+        return makeQuickAccountBuilder(id, idx)
+                .setAddress(Uri.parse(TEST_ACCOUNT_ADDRESS + idx))
+                .setSubscriptionAddress(Uri.parse("tel:555-000" + idx))
+                .setCapabilities(idx)
+                .setShortDescription("desc" + idx)
+                .setIsEnabled(true)
+                .build();
+    }
+
+    private BluetoothCall getMockCall() {
+        return mock(BluetoothCall.class);
+    }
+}
\ No newline at end of file
diff --git a/android/app/tests/unit/src/com/android/bluetooth/util/GsmAlphabetTest.java b/android/app/tests/unit/src/com/android/bluetooth/util/GsmAlphabetTest.java
new file mode 100644
index 0000000..8d271e8
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/util/GsmAlphabetTest.java
@@ -0,0 +1,188 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.util;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import androidx.test.InstrumentationRegistry;
+
+import com.android.internal.telephony.uicc.IccUtils;
+
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.junit.runners.JUnit4;
+
+@RunWith(JUnit4.class)
+public final class GsmAlphabetTest {
+
+  private static final String GSM_EXTENDED_CHARS = "{|}\\[~]\f\u20ac";
+
+  @Before
+  public void setUp() throws Exception {
+    InstrumentationRegistry.getInstrumentation().getUiAutomation().adoptShellPermissionIdentity();
+  }
+
+  @Test
+  public void gsm7BitPackedToString() throws Exception {
+    byte[] packed;
+    StringBuilder testString = new StringBuilder(300);
+
+    packed = com.android.internal.telephony.GsmAlphabet.stringToGsm7BitPacked(
+            testString.toString());
+    assertThat(GsmAlphabet.gsm7BitPackedToString(packed, 1, 0xff & packed[0], 0, 0, 0))
+            .isEqualTo(testString.toString());
+
+    // Check all alignment cases
+    for (int i = 0; i < 9; i++, testString.append('@')) {
+      packed = com.android.internal.telephony.GsmAlphabet.stringToGsm7BitPacked(
+              testString.toString());
+      assertThat(GsmAlphabet.gsm7BitPackedToString(packed, 1, 0xff & packed[0], 0, 0, 0))
+              .isEqualTo(testString.toString());
+    }
+
+    // Test extended chars too
+    testString.append(GSM_EXTENDED_CHARS);
+    packed = com.android.internal.telephony.GsmAlphabet.stringToGsm7BitPacked(
+            testString.toString());
+    assertThat(GsmAlphabet.gsm7BitPackedToString(packed, 1, 0xff & packed[0], 0, 0, 0))
+            .isEqualTo(testString.toString());
+
+    // Try 254 septets with 127 extended chars
+    testString.setLength(0);
+    for (int i = 0; i < (255 / 2); i++) {
+      testString.append('{');
+    }
+    packed = com.android.internal.telephony.GsmAlphabet.stringToGsm7BitPacked(
+            testString.toString());
+    assertThat(GsmAlphabet.gsm7BitPackedToString(packed, 1, 0xff & packed[0], 0, 0, 0))
+            .isEqualTo(testString.toString());
+
+    // Reserved for extension to extension table (mapped to space)
+    packed = new byte[]{(byte)(0x1b | 0x80), 0x1b >> 1};
+    assertThat(GsmAlphabet.gsm7BitPackedToString(packed, 0, 2, 0, 0, 0)).isEqualTo(" ");
+
+    // Unmappable (mapped to character in default alphabet table)
+    packed[0] = 0x1b;
+    packed[1] = 0x00;
+    assertThat(GsmAlphabet.gsm7BitPackedToString(packed, 0, 2, 0, 0, 0)).isEqualTo("@");
+    packed[0] = (byte)(0x1b | 0x80);
+    packed[1] = (byte)(0x7f >> 1);
+    assertThat(GsmAlphabet.gsm7BitPackedToString(packed, 0, 2, 0, 0, 0)).isEqualTo("\u00e0");
+  }
+
+  @Test
+  public void stringToGsm8BitPacked() throws Exception {
+    byte unpacked[];
+    unpacked = IccUtils.hexStringToBytes("566F696365204D61696C");
+    assertThat(IccUtils.bytesToHexString(GsmAlphabet.stringToGsm8BitPacked("Voice Mail")))
+            .isEqualTo(IccUtils.bytesToHexString(unpacked));
+
+    unpacked = GsmAlphabet.stringToGsm8BitPacked(GSM_EXTENDED_CHARS);
+    // two bytes for every extended char
+    assertThat(unpacked.length).isEqualTo(2 * GSM_EXTENDED_CHARS.length());
+  }
+
+  @Test
+  public void stringToGsm8BitUnpackedField() throws Exception {
+    byte unpacked[];
+    // Test truncation of unaligned extended chars
+    unpacked = new byte[3];
+    GsmAlphabet.stringToGsm8BitUnpackedField(GSM_EXTENDED_CHARS, unpacked,
+            0, unpacked.length);
+
+    // Should be one extended char and an 0xff at the end
+    assertThat(0xff & unpacked[2]).isEqualTo(0xff);
+    assertThat(com.android.internal.telephony.GsmAlphabet.gsm8BitUnpackedToString(
+            unpacked, 0, unpacked.length)).isEqualTo(GSM_EXTENDED_CHARS.substring(0, 1));
+
+    // Test truncation of normal chars
+    unpacked = new byte[3];
+    GsmAlphabet.stringToGsm8BitUnpackedField("abcd", unpacked,
+            0, unpacked.length);
+
+    assertThat(com.android.internal.telephony.GsmAlphabet.gsm8BitUnpackedToString(
+            unpacked, 0, unpacked.length)).isEqualTo("abc");
+
+    // Test truncation of mixed normal and extended chars
+    unpacked = new byte[3];
+    GsmAlphabet.stringToGsm8BitUnpackedField("a{cd", unpacked,
+            0, unpacked.length);
+
+    assertThat(com.android.internal.telephony.GsmAlphabet.gsm8BitUnpackedToString(
+            unpacked, 0, unpacked.length)).isEqualTo("a{");
+
+    // Test padding after normal char
+    unpacked = new byte[3];
+    GsmAlphabet.stringToGsm8BitUnpackedField("a", unpacked,
+            0, unpacked.length);
+
+    assertThat(com.android.internal.telephony.GsmAlphabet.gsm8BitUnpackedToString(
+            unpacked, 0, unpacked.length)).isEqualTo("a");
+
+    assertThat(0xff & unpacked[1]).isEqualTo(0xff);
+    assertThat(0xff & unpacked[2]).isEqualTo(0xff);
+
+    // Test malformed input -- escape char followed by end of field
+    unpacked[0] = 0;
+    unpacked[1] = 0;
+    unpacked[2] = GsmAlphabet.GSM_EXTENDED_ESCAPE;
+
+    assertThat(com.android.internal.telephony.GsmAlphabet.gsm8BitUnpackedToString(
+            unpacked, 0, unpacked.length)).isEqualTo("@@");
+
+    // non-zero offset
+    assertThat(com.android.internal.telephony.GsmAlphabet.gsm8BitUnpackedToString(
+            unpacked, 1, unpacked.length - 1)).isEqualTo("@");
+
+    // test non-zero offset
+    unpacked[0] = 0;
+    GsmAlphabet.stringToGsm8BitUnpackedField("abcd", unpacked,
+            1, unpacked.length - 1);
+
+
+    assertThat(unpacked[0]).isEqualTo(0);
+
+    assertThat(com.android.internal.telephony.GsmAlphabet.gsm8BitUnpackedToString(
+            unpacked, 1, unpacked.length - 1)).isEqualTo("ab");
+
+    // test non-zero offset with truncated extended char
+    unpacked[0] = 0;
+
+    GsmAlphabet.stringToGsm8BitUnpackedField("a{", unpacked,
+            1, unpacked.length - 1);
+
+    assertThat(unpacked[0]).isEqualTo(0);
+
+    assertThat(com.android.internal.telephony.GsmAlphabet.gsm8BitUnpackedToString(
+            unpacked, 1, unpacked.length - 1)).isEqualTo("a");
+
+    // Reserved for extension to extension table (mapped to space)
+    unpacked[0] = 0x1b;
+    unpacked[1] = 0x1b;
+    assertThat(com.android.internal.telephony.GsmAlphabet.gsm8BitUnpackedToString(
+            unpacked, 0, 2)).isEqualTo(" ");
+
+    // Unmappable (mapped to character in default or national locking shift table)
+    unpacked[1] = 0x00;
+    assertThat(com.android.internal.telephony.GsmAlphabet.gsm8BitUnpackedToString(
+            unpacked, 0, 2)).isEqualTo("@");
+    unpacked[1] = 0x7f;
+    assertThat(com.android.internal.telephony.GsmAlphabet.gsm8BitUnpackedToString(
+            unpacked, 0, 2)).isEqualTo("\u00e0");
+  }
+}
diff --git a/android/app/tests/unit/src/com/android/bluetooth/vc/VolumeControlNativeInterfaceTest.java b/android/app/tests/unit/src/com/android/bluetooth/vc/VolumeControlNativeInterfaceTest.java
new file mode 100644
index 0000000..ebfe57b
--- /dev/null
+++ b/android/app/tests/unit/src/com/android/bluetooth/vc/VolumeControlNativeInterfaceTest.java
@@ -0,0 +1,165 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bluetooth.vc;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import android.bluetooth.BluetoothAdapter;
+import android.bluetooth.BluetoothDevice;
+import android.content.Context;
+
+import androidx.test.InstrumentationRegistry;
+import androidx.test.runner.AndroidJUnit4;
+
+import com.android.bluetooth.TestUtils;
+
+import org.junit.After;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.ArgumentCaptor;
+import org.mockito.Mock;
+import org.mockito.MockitoAnnotations;
+
+@RunWith(AndroidJUnit4.class)
+public class VolumeControlNativeInterfaceTest {
+    @Mock
+    private VolumeControlService mService;
+
+    private VolumeControlNativeInterface mNativeInterface;
+
+    @Before
+    public void setUp() throws Exception {
+        MockitoAnnotations.initMocks(this);
+        when(mService.isAvailable()).thenReturn(true);
+        VolumeControlService.setVolumeControlService(mService);
+        mNativeInterface = VolumeControlNativeInterface.getInstance();
+    }
+
+    @After
+    public void tearDown() {
+        VolumeControlService.setVolumeControlService(null);
+    }
+
+    @Test
+    public void onConnectionStateChanged() {
+        int state = VolumeControlStackEvent.CONNECTION_STATE_CONNECTED;
+        byte[] address = new byte[] { 0x00, 0x01, 0x02, 0x03, 0x04, 0x05 };
+
+        mNativeInterface.onConnectionStateChanged(state, address);
+
+        ArgumentCaptor<VolumeControlStackEvent> event =
+                ArgumentCaptor.forClass(VolumeControlStackEvent.class);
+        verify(mService).messageFromNative(event.capture());
+        assertThat(event.getValue().type).isEqualTo(
+                VolumeControlStackEvent.EVENT_TYPE_CONNECTION_STATE_CHANGED);
+    }
+
+    @Test
+    public void onVolumeStateChanged() {
+        int volume = 3;
+        boolean mute = false;
+        byte[] address = new byte[] { 0x00, 0x01, 0x02, 0x03, 0x04, 0x05 };
+        boolean isAutonomous = false;
+
+        mNativeInterface.onVolumeStateChanged(volume, mute, address, isAutonomous);
+
+        ArgumentCaptor<VolumeControlStackEvent> event =
+                ArgumentCaptor.forClass(VolumeControlStackEvent.class);
+        verify(mService).messageFromNative(event.capture());
+        assertThat(event.getValue().type).isEqualTo(
+                VolumeControlStackEvent.EVENT_TYPE_VOLUME_STATE_CHANGED);
+    }
+
+    @Test
+    public void onGroupVolumeStateChanged() {
+        int volume = 3;
+        boolean mute = false;
+        int groupId = 1;
+        boolean isAutonomous = false;
+
+        mNativeInterface.onGroupVolumeStateChanged(volume, mute, groupId, isAutonomous);
+
+        ArgumentCaptor<VolumeControlStackEvent> event =
+                ArgumentCaptor.forClass(VolumeControlStackEvent.class);
+        verify(mService).messageFromNative(event.capture());
+        assertThat(event.getValue().type).isEqualTo(
+                VolumeControlStackEvent.EVENT_TYPE_VOLUME_STATE_CHANGED);
+        assertThat(event.getValue().valueInt1).isEqualTo(groupId);
+    }
+
+    @Test
+    public void onDeviceAvailable() {
+        int numOfExternalOutputs = 3;
+        byte[] address = new byte[] { 0x00, 0x01, 0x02, 0x03, 0x04, 0x05 };
+
+        mNativeInterface.onDeviceAvailable(numOfExternalOutputs, address);
+
+        ArgumentCaptor<VolumeControlStackEvent> event =
+                ArgumentCaptor.forClass(VolumeControlStackEvent.class);
+        verify(mService).messageFromNative(event.capture());
+        assertThat(event.getValue().type).isEqualTo(
+                VolumeControlStackEvent.EVENT_TYPE_DEVICE_AVAILABLE);
+    }
+    @Test
+    public void onExtAudioOutVolumeOffsetChanged() {
+        int externalOutputId = 2;
+        int offset = 0;
+        byte[] address = new byte[] { 0x00, 0x01, 0x02, 0x03, 0x04, 0x05 };
+
+        mNativeInterface.onExtAudioOutVolumeOffsetChanged(externalOutputId, offset, address);
+
+        ArgumentCaptor<VolumeControlStackEvent> event =
+                ArgumentCaptor.forClass(VolumeControlStackEvent.class);
+        verify(mService).messageFromNative(event.capture());
+        assertThat(event.getValue().type).isEqualTo(
+                VolumeControlStackEvent.EVENT_TYPE_EXT_AUDIO_OUT_VOL_OFFSET_CHANGED);
+    }
+
+    @Test
+    public void onExtAudioOutLocationChanged() {
+        int externalOutputId = 2;
+        int location = 100;
+        byte[] address = new byte[] { 0x00, 0x01, 0x02, 0x03, 0x04, 0x05 };
+
+        mNativeInterface.onExtAudioOutLocationChanged(externalOutputId, location, address);
+
+        ArgumentCaptor<VolumeControlStackEvent> event =
+                ArgumentCaptor.forClass(VolumeControlStackEvent.class);
+        verify(mService).messageFromNative(event.capture());
+        assertThat(event.getValue().type).isEqualTo(
+                VolumeControlStackEvent.EVENT_TYPE_EXT_AUDIO_OUT_LOCATION_CHANGED);
+    }
+
+    @Test
+    public void onExtAudioOutDescriptionChanged() {
+        int externalOutputId = 2;
+        String descr = "test-descr";
+        byte[] address = new byte[] { 0x00, 0x01, 0x02, 0x03, 0x04, 0x05 };
+
+        mNativeInterface.onExtAudioOutDescriptionChanged(externalOutputId, descr, address);
+
+        ArgumentCaptor<VolumeControlStackEvent> event =
+                ArgumentCaptor.forClass(VolumeControlStackEvent.class);
+        verify(mService).messageFromNative(event.capture());
+        assertThat(event.getValue().type).isEqualTo(
+                VolumeControlStackEvent.EVENT_TYPE_EXT_AUDIO_OUT_DESCRIPTION_CHANGED);
+    }
+}
diff --git a/android/app/tests/unit/src/com/android/bluetooth/vc/VolumeControlServiceTest.java b/android/app/tests/unit/src/com/android/bluetooth/vc/VolumeControlServiceTest.java
index 2fbe191..3ad9230 100644
--- a/android/app/tests/unit/src/com/android/bluetooth/vc/VolumeControlServiceTest.java
+++ b/android/app/tests/unit/src/com/android/bluetooth/vc/VolumeControlServiceTest.java
@@ -24,11 +24,14 @@
 import android.bluetooth.BluetoothProfile;
 import android.bluetooth.BluetoothUuid;
 import android.bluetooth.BluetoothVolumeControl;
+import android.bluetooth.IBluetoothVolumeControlCallback;
+import android.content.AttributionSource;
 import android.content.BroadcastReceiver;
 import android.content.Context;
 import android.content.Intent;
 import android.content.IntentFilter;
 import android.media.AudioManager;
+import android.os.Binder;
 import android.os.Looper;
 import android.os.ParcelUuid;
 
@@ -38,9 +41,12 @@
 import androidx.test.runner.AndroidJUnit4;
 
 import com.android.bluetooth.btservice.AdapterService;
+import com.android.bluetooth.btservice.ServiceFactory;
 import com.android.bluetooth.btservice.storage.DatabaseManager;
+import com.android.bluetooth.csip.CsipSetCoordinatorService;
 import com.android.bluetooth.R;
 import com.android.bluetooth.TestUtils;
+import com.android.bluetooth.x.com.android.modules.utils.SynchronousResultReceiver;
 
 import org.junit.After;
 import org.junit.Assert;
@@ -50,22 +56,33 @@
 import org.junit.Test;
 import org.junit.runner.RunWith;
 import org.mockito.Mock;
+import org.mockito.Mockito;
 import org.mockito.MockitoAnnotations;
 
+import java.time.Duration;
 import java.util.HashMap;
 import java.util.List;
 import java.util.concurrent.LinkedBlockingQueue;
 import java.util.concurrent.TimeoutException;
+import java.util.stream.IntStream;
 
 @MediumTest
 @RunWith(AndroidJUnit4.class)
 public class VolumeControlServiceTest {
     private BluetoothAdapter mAdapter;
+    private AttributionSource mAttributionSource;
     private Context mTargetContext;
     private VolumeControlService mService;
+    private VolumeControlService.BluetoothVolumeControlBinder mServiceBinder;
     private BluetoothDevice mDevice;
+    private BluetoothDevice mDeviceTwo;
     private HashMap<BluetoothDevice, LinkedBlockingQueue<Intent>> mDeviceQueueMap;
     private static final int TIMEOUT_MS = 1000;
+    private static final int BT_LE_AUDIO_MAX_VOL = 255;
+    private static final int MEDIA_MIN_VOL = 0;
+    private static final int MEDIA_MAX_VOL = 25;
+    private static final int CALL_MIN_VOL = 1;
+    private static final int CALL_MAX_VOL = 8;
 
     private BroadcastReceiver mVolumeControlIntentReceiver;
 
@@ -73,6 +90,8 @@
     @Mock private DatabaseManager mDatabaseManager;
     @Mock private VolumeControlNativeInterface mNativeInterface;
     @Mock private AudioManager mAudioManager;
+    @Mock private ServiceFactory mServiceFactory;
+    @Mock private CsipSetCoordinatorService mCsipService;
 
     @Rule public final ServiceTestRule mServiceRule = new ServiceTestRule();
 
@@ -91,10 +110,25 @@
         doReturn(true, false).when(mAdapterService).isStartedProfile(anyString());
 
         mAdapter = BluetoothAdapter.getDefaultAdapter();
+        mAttributionSource = mAdapter.getAttributionSource();
+
+        doReturn(MEDIA_MIN_VOL).when(mAudioManager)
+                .getStreamMinVolume(eq(AudioManager.STREAM_MUSIC));
+        doReturn(MEDIA_MAX_VOL).when(mAudioManager)
+                .getStreamMaxVolume(eq(AudioManager.STREAM_MUSIC));
+        doReturn(CALL_MIN_VOL).when(mAudioManager)
+                .getStreamMinVolume(eq(AudioManager.STREAM_VOICE_CALL));
+        doReturn(CALL_MAX_VOL).when(mAudioManager)
+                .getStreamMaxVolume(eq(AudioManager.STREAM_VOICE_CALL));
 
         startService();
         mService.mVolumeControlNativeInterface = mNativeInterface;
         mService.mAudioManager = mAudioManager;
+        mService.mFactory = mServiceFactory;
+        mServiceBinder = (VolumeControlService.BluetoothVolumeControlBinder) mService.initBinder();
+        mServiceBinder.mIsTesting = true;
+
+        doReturn(mCsipService).when(mServiceFactory).getCsipSetCoordinatorService();
 
         // Override the timeout value to speed up the test
         VolumeControlStateMachine.sConnectTimeoutMs = TIMEOUT_MS;    // 1s
@@ -108,8 +142,10 @@
 
         // Get a device for testing
         mDevice = TestUtils.getTestDevice(mAdapter, 0);
+        mDeviceTwo = TestUtils.getTestDevice(mAdapter, 1);
         mDeviceQueueMap = new HashMap<>();
         mDeviceQueueMap.put(mDevice, new LinkedBlockingQueue<>());
+        mDeviceQueueMap.put(mDeviceTwo, new LinkedBlockingQueue<>());
         doReturn(BluetoothDevice.BOND_BONDED).when(mAdapterService)
                 .getBondState(any(BluetoothDevice.class));
         doReturn(new ParcelUuid[]{BluetoothUuid.VOLUME_CONTROL}).when(mAdapterService)
@@ -187,7 +223,7 @@
      * Test stop VolumeControl Service
      */
     @Test
-    public void testStopVolumeControlService() {
+    public void testStopVolumeControlService() throws Exception {
         // Prepare: connect
         connectDevice(mDevice);
         // VolumeControl Service is already running: test stop().
@@ -239,14 +275,18 @@
      * Test if getProfileConnectionPolicy works after the service is stopped.
      */
     @Test
-    public void testGetPolicyAfterStopped() {
+    public void testGetPolicyAfterStopped() throws Exception {
         mService.stop();
         when(mDatabaseManager
                 .getProfileConnectionPolicy(mDevice, BluetoothProfile.VOLUME_CONTROL))
                 .thenReturn(BluetoothProfile.CONNECTION_POLICY_UNKNOWN);
+        final SynchronousResultReceiver<Integer> recv = SynchronousResultReceiver.get();
+        int defaultRecvValue = -1000;
+        mServiceBinder.getConnectionPolicy(mDevice, mAttributionSource, recv);
+        int policy = recv.awaitResultNoInterrupt(Duration.ofMillis(TIMEOUT_MS))
+                .getValue(defaultRecvValue);
         Assert.assertEquals("Initial device policy",
-                BluetoothProfile.CONNECTION_POLICY_UNKNOWN,
-                mService.getConnectionPolicy(mDevice));
+                BluetoothProfile.CONNECTION_POLICY_UNKNOWN, policy);
     }
 
     /**
@@ -315,7 +355,7 @@
      * Test that an outgoing connection to device that have Volume Control UUID is successful
      */
     @Test
-    public void testOutgoingConnectExistingVolumeControlUuid() {
+    public void testOutgoingConnectDisconnectExistingVolumeControlUuid() throws Exception {
         // Update the device policy so okToConnect() returns true
         when(mAdapterService.getDatabase()).thenReturn(mDatabaseManager);
         when(mDatabaseManager
@@ -328,12 +368,25 @@
         doReturn(new ParcelUuid[]{BluetoothUuid.VOLUME_CONTROL}).when(mAdapterService)
                 .getRemoteUuids(any(BluetoothDevice.class));
 
-        // Send a connect request
-        Assert.assertTrue("Connect expected to succeed", mService.connect(mDevice));
+        // Send a connect request via binder
+        SynchronousResultReceiver<Boolean> recv = SynchronousResultReceiver.get();
+        mServiceBinder.connect(mDevice, mAttributionSource, recv);
+        Assert.assertTrue("Connect expected to succeed",
+                recv.awaitResultNoInterrupt(Duration.ofMillis(TIMEOUT_MS)).getValue(false));
 
         // Verify the connection state broadcast, and that we are in Connecting state
         verifyConnectionStateIntent(TIMEOUT_MS, mDevice, BluetoothProfile.STATE_CONNECTING,
                 BluetoothProfile.STATE_DISCONNECTED);
+
+        // Send a disconnect request via binder
+        recv = SynchronousResultReceiver.get();
+        mServiceBinder.disconnect(mDevice, mAttributionSource, recv);
+        Assert.assertTrue("Disconnect expected to succeed",
+                recv.awaitResultNoInterrupt(Duration.ofMillis(TIMEOUT_MS)).getValue(false));
+
+        // Verify the connection state broadcast, and that we are in Connecting state
+        verifyConnectionStateIntent(TIMEOUT_MS, mDevice, BluetoothProfile.STATE_DISCONNECTED,
+                BluetoothProfile.STATE_CONNECTING);
     }
 
     /**
@@ -358,7 +411,7 @@
      * Test that an outgoing connection times out
      */
     @Test
-    public void testOutgoingConnectTimeout() {
+    public void testOutgoingConnectTimeout() throws Exception {
         // Update the device policy so okToConnect() returns true
         when(mAdapterService.getDatabase()).thenReturn(mDatabaseManager);
         when(mDatabaseManager
@@ -380,8 +433,13 @@
         verifyConnectionStateIntent(VolumeControlStateMachine.sConnectTimeoutMs * 2,
                 mDevice, BluetoothProfile.STATE_DISCONNECTED,
                 BluetoothProfile.STATE_CONNECTING);
-        Assert.assertEquals(BluetoothProfile.STATE_DISCONNECTED,
-                mService.getConnectionState(mDevice));
+
+        final SynchronousResultReceiver<Integer> recv = SynchronousResultReceiver.get();
+        int defaultRecvValue = -1000;
+        mServiceBinder.getConnectionState(mDevice, mAttributionSource, recv);
+        int state = recv.awaitResultNoInterrupt(Duration.ofMillis(TIMEOUT_MS))
+                .getValue(defaultRecvValue);
+        Assert.assertEquals(BluetoothProfile.STATE_DISCONNECTED, state);
     }
 
     /**
@@ -514,34 +572,298 @@
         mService.messageFromNative(stackEvent);
     }
 
+    int getLeAudioVolume(int index, int minIndex, int maxIndex, int streamType) {
+        // Note: This has to be the same as mBtHelper.setLeAudioVolume()
+        return (int) Math.round((double) index * BT_LE_AUDIO_MAX_VOL / maxIndex);
+    }
+
+    void testVolumeCalculations(int streamType, int minIdx, int maxIdx) {
+        // Send a message to trigger volume state changed broadcast
+        final VolumeControlStackEvent stackEvent = new VolumeControlStackEvent(
+                VolumeControlStackEvent.EVENT_TYPE_VOLUME_STATE_CHANGED);
+        stackEvent.device = null;
+        stackEvent.valueInt1 = 1;       // groupId
+        stackEvent.valueBool1 = false;  // isMuted
+        stackEvent.valueBool2 = true;   // isAutonomous
+
+        IntStream.range(minIdx, maxIdx).forEach(idx -> {
+            // Given the reference volume index, set the LeAudio Volume
+            stackEvent.valueInt2 = getLeAudioVolume(idx,
+                            mAudioManager.getStreamMinVolume(streamType),
+                            mAudioManager.getStreamMaxVolume(streamType), streamType);
+            mService.messageFromNative(stackEvent);
+
+            // Verify that setting LeAudio Volume, sets the original volume index to Audio FW
+            verify(mAudioManager, times(1)).setStreamVolume(eq(streamType), eq(idx), anyInt());
+        });
+    }
+
+    @Test
+    public void testAutonomousVolumeStateChange() {
+        doReturn(AudioManager.MODE_IN_CALL).when(mAudioManager).getMode();
+        testVolumeCalculations(AudioManager.STREAM_VOICE_CALL, CALL_MIN_VOL, CALL_MAX_VOL);
+
+        doReturn(AudioManager.MODE_NORMAL).when(mAudioManager).getMode();
+        testVolumeCalculations(AudioManager.STREAM_MUSIC, MEDIA_MIN_VOL, MEDIA_MAX_VOL);
+    }
+
     /**
      * Test Volume Control cache.
      */
     @Test
-    public void testVolumeCache() {
+    public void testVolumeCache() throws Exception {
         int groupId = 1;
         int volume = 6;
 
         Assert.assertEquals(-1, mService.getGroupVolume(groupId));
-        mService.setGroupVolume(groupId, volume);
-        Assert.assertEquals(volume, mService.getGroupVolume(groupId));
+        final SynchronousResultReceiver<Void> voidRecv = SynchronousResultReceiver.get();
+        mServiceBinder.setGroupVolume(groupId, volume, mAttributionSource, voidRecv);
+        voidRecv.awaitResultNoInterrupt(Duration.ofMillis(TIMEOUT_MS));
+
+        final SynchronousResultReceiver<Integer> intRecv = SynchronousResultReceiver.get();
+        int defaultRecvValue = -100;
+        mServiceBinder.getGroupVolume(groupId, mAttributionSource, intRecv);
+        int groupVolume = intRecv.awaitResultNoInterrupt(
+                Duration.ofMillis(TIMEOUT_MS)).getValue(defaultRecvValue);
+        Assert.assertEquals(volume, groupVolume);
 
         volume = 10;
-
-        // Send autonomus volume change.
+        // Send autonomous volume change.
         VolumeControlStackEvent stackEvent = new VolumeControlStackEvent(
                 VolumeControlStackEvent.EVENT_TYPE_VOLUME_STATE_CHANGED);
         stackEvent.device = null;
         stackEvent.valueInt1 = groupId;
         stackEvent.valueInt2 = volume;
         stackEvent.valueBool1 = false;
-        stackEvent.valueBool2 = true; /* autonomus */
+        stackEvent.valueBool2 = true; /* autonomous */
         mService.messageFromNative(stackEvent);
 
         Assert.assertEquals(volume, mService.getGroupVolume(groupId));
     }
 
-    private void connectDevice(BluetoothDevice device) {
+    /**
+     * Test setting volume for a group member who connects after the volume level
+     * for a group was already changed and cached.
+     */
+    @Test
+    public void testLateConnectingDevice() throws Exception {
+        int groupId = 1;
+        int groupVolume = 56;
+
+        // Both devices are in the same group
+        when(mCsipService.getGroupId(mDevice, BluetoothUuid.CAP)).thenReturn(groupId);
+        when(mCsipService.getGroupId(mDeviceTwo, BluetoothUuid.CAP)).thenReturn(groupId);
+
+        // Update the device policy so okToConnect() returns true
+        when(mAdapterService.getDatabase()).thenReturn(mDatabaseManager);
+        when(mDatabaseManager
+                .getProfileConnectionPolicy(any(BluetoothDevice.class),
+                        eq(BluetoothProfile.VOLUME_CONTROL)))
+                .thenReturn(BluetoothProfile.CONNECTION_POLICY_ALLOWED);
+        doReturn(true).when(mNativeInterface).connectVolumeControl(any(BluetoothDevice.class));
+        doReturn(true).when(mNativeInterface).disconnectVolumeControl(any(BluetoothDevice.class));
+
+        generateConnectionMessageFromNative(mDevice, BluetoothProfile.STATE_CONNECTED,
+                BluetoothProfile.STATE_DISCONNECTED);
+        Assert.assertEquals(BluetoothProfile.STATE_CONNECTED,
+                mService.getConnectionState(mDevice));
+        Assert.assertTrue(mService.getDevices().contains(mDevice));
+
+        mService.setGroupVolume(groupId, groupVolume);
+        verify(mNativeInterface, times(1)).setGroupVolume(eq(groupId), eq(groupVolume));
+        verify(mNativeInterface, times(0)).setVolume(eq(mDeviceTwo), eq(groupVolume));
+
+        // Verify that second device gets the proper group volume level when connected
+        generateConnectionMessageFromNative(mDeviceTwo, BluetoothProfile.STATE_CONNECTED,
+                BluetoothProfile.STATE_DISCONNECTED);
+        Assert.assertEquals(BluetoothProfile.STATE_CONNECTED,
+                mService.getConnectionState(mDeviceTwo));
+        Assert.assertTrue(mService.getDevices().contains(mDeviceTwo));
+        verify(mNativeInterface, times(1)).setVolume(eq(mDeviceTwo), eq(groupVolume));
+    }
+
+    /**
+     * Test setting volume for a new group member who is discovered after the volume level
+     * for a group was already changed and cached.
+     */
+    @Test
+    public void testLateDiscoveredGroupMember() throws Exception {
+        int groupId = 1;
+        int groupVolume = 56;
+
+        // For now only one device is in the group
+        when(mCsipService.getGroupId(mDevice, BluetoothUuid.CAP)).thenReturn(groupId);
+        when(mCsipService.getGroupId(mDeviceTwo, BluetoothUuid.CAP)).thenReturn(-1);
+
+        // Update the device policy so okToConnect() returns true
+        when(mAdapterService.getDatabase()).thenReturn(mDatabaseManager);
+        when(mDatabaseManager
+                .getProfileConnectionPolicy(any(BluetoothDevice.class),
+                        eq(BluetoothProfile.VOLUME_CONTROL)))
+                .thenReturn(BluetoothProfile.CONNECTION_POLICY_ALLOWED);
+        doReturn(true).when(mNativeInterface).connectVolumeControl(any(BluetoothDevice.class));
+        doReturn(true).when(mNativeInterface).disconnectVolumeControl(any(BluetoothDevice.class));
+
+        generateConnectionMessageFromNative(mDevice, BluetoothProfile.STATE_CONNECTED,
+                BluetoothProfile.STATE_DISCONNECTED);
+        Assert.assertEquals(BluetoothProfile.STATE_CONNECTED,
+                mService.getConnectionState(mDevice));
+        Assert.assertTrue(mService.getDevices().contains(mDevice));
+
+        // Set the group volume
+        mService.setGroupVolume(groupId, groupVolume);
+
+        // Verify that second device will not get the group volume level if it is not a group member
+        generateConnectionMessageFromNative(mDeviceTwo, BluetoothProfile.STATE_CONNECTED,
+                BluetoothProfile.STATE_DISCONNECTED);
+        Assert.assertEquals(BluetoothProfile.STATE_CONNECTED,
+                mService.getConnectionState(mDeviceTwo));
+        Assert.assertTrue(mService.getDevices().contains(mDeviceTwo));
+        verify(mNativeInterface, times(0)).setVolume(eq(mDeviceTwo), eq(groupVolume));
+
+        // But gets the volume when it becomes the group member
+        when(mCsipService.getGroupId(mDeviceTwo, BluetoothUuid.CAP)).thenReturn(groupId);
+        mService.handleGroupNodeAdded(groupId, mDeviceTwo);
+        verify(mNativeInterface, times(1)).setVolume(eq(mDeviceTwo), eq(groupVolume));
+    }
+
+    @Test
+    public void testServiceBinderGetDevicesMatchingConnectionStates() throws Exception {
+        final SynchronousResultReceiver<List<BluetoothDevice>> recv =
+                SynchronousResultReceiver.get();
+        mServiceBinder.getDevicesMatchingConnectionStates(null, mAttributionSource, recv);
+        List<BluetoothDevice> devices = recv.awaitResultNoInterrupt(Duration.ofMillis(TIMEOUT_MS))
+                .getValue(null);
+        Assert.assertEquals(0, devices.size());
+    }
+
+    @Test
+    public void testServiceBinderSetConnectionPolicy() throws Exception {
+        final SynchronousResultReceiver<Boolean> recv = SynchronousResultReceiver.get();
+        boolean defaultRecvValue = false;
+        mServiceBinder.setConnectionPolicy(
+                mDevice, BluetoothProfile.CONNECTION_POLICY_UNKNOWN, mAttributionSource, recv);
+        Assert.assertTrue(recv.awaitResultNoInterrupt(Duration.ofMillis(TIMEOUT_MS))
+                .getValue(defaultRecvValue));
+        verify(mDatabaseManager).setProfileConnectionPolicy(
+                mDevice, BluetoothProfile.VOLUME_CONTROL, BluetoothProfile.CONNECTION_POLICY_UNKNOWN);
+    }
+
+    @Test
+    public void testServiceBinderVolumeOffsetMethods() throws Exception {
+        // Send a message to trigger connection completed
+        VolumeControlStackEvent event = new VolumeControlStackEvent(
+                VolumeControlStackEvent.EVENT_TYPE_DEVICE_AVAILABLE);
+        event.device = mDevice;
+        event.valueInt1 = 2; // number of external outputs
+        mService.messageFromNative(event);
+
+        final SynchronousResultReceiver<Boolean> boolRecv = SynchronousResultReceiver.get();
+        boolean defaultRecvValue = false;
+        mServiceBinder.isVolumeOffsetAvailable(mDevice, mAttributionSource, boolRecv);
+        Assert.assertTrue(boolRecv.awaitResultNoInterrupt(Duration.ofMillis(TIMEOUT_MS))
+                .getValue(defaultRecvValue));
+
+        int volumeOffset = 100;
+        final SynchronousResultReceiver<Void> voidRecv = SynchronousResultReceiver.get();
+        mServiceBinder.setVolumeOffset(mDevice, volumeOffset, mAttributionSource, voidRecv);
+        voidRecv.awaitResultNoInterrupt(Duration.ofMillis(TIMEOUT_MS));
+        verify(mNativeInterface).setExtAudioOutVolumeOffset(mDevice, 1, volumeOffset);
+    }
+
+    @Test
+    public void testServiceBinderRegisterUnregisterCallback() throws Exception {
+        IBluetoothVolumeControlCallback callback =
+                Mockito.mock(IBluetoothVolumeControlCallback.class);
+        Binder binder = Mockito.mock(Binder.class);
+        when(callback.asBinder()).thenReturn(binder);
+
+        int size = mService.mCallbacks.getRegisteredCallbackCount();
+        SynchronousResultReceiver<Void> recv = SynchronousResultReceiver.get();
+        mServiceBinder.registerCallback(callback, mAttributionSource, recv);
+        recv.awaitResultNoInterrupt(Duration.ofMillis(TIMEOUT_MS)).getValue(null);
+        Assert.assertEquals(size + 1, mService.mCallbacks.getRegisteredCallbackCount());
+
+        recv = SynchronousResultReceiver.get();
+        mServiceBinder.unregisterCallback(callback, mAttributionSource, recv);
+        recv.awaitResultNoInterrupt(Duration.ofMillis(TIMEOUT_MS)).getValue(null);
+        Assert.assertEquals(size, mService.mCallbacks.getRegisteredCallbackCount());
+    }
+
+    @Test
+    public void testServiceBinderMuteMethods() throws Exception {
+        SynchronousResultReceiver<Void> voidRecv = SynchronousResultReceiver.get();
+        mServiceBinder.mute(mDevice, mAttributionSource, voidRecv);
+        voidRecv.awaitResultNoInterrupt(Duration.ofMillis(TIMEOUT_MS));
+        verify(mNativeInterface).mute(mDevice);
+
+        voidRecv = SynchronousResultReceiver.get();
+        mServiceBinder.unmute(mDevice, mAttributionSource, voidRecv);
+        voidRecv.awaitResultNoInterrupt(Duration.ofMillis(TIMEOUT_MS));
+        verify(mNativeInterface).unmute(mDevice);
+
+        int groupId = 1;
+        voidRecv = SynchronousResultReceiver.get();
+        mServiceBinder.muteGroup(groupId, mAttributionSource, voidRecv);
+        voidRecv.awaitResultNoInterrupt(Duration.ofMillis(TIMEOUT_MS));
+        verify(mNativeInterface).muteGroup(groupId);
+
+        voidRecv = SynchronousResultReceiver.get();
+        mServiceBinder.unmuteGroup(groupId, mAttributionSource, voidRecv);
+        voidRecv.awaitResultNoInterrupt(Duration.ofMillis(TIMEOUT_MS));
+        verify(mNativeInterface).unmuteGroup(groupId);
+    }
+
+    @Test
+    public void testVolumeControlOffsetDescriptor() {
+        VolumeControlService.VolumeControlOffsetDescriptor descriptor =
+                new VolumeControlService.VolumeControlOffsetDescriptor();
+        int invalidId = -1;
+        int validId = 10;
+        int testValue = 100;
+        String testDesc = "testDescription";
+        int testLocation = 10000;
+
+        Assert.assertEquals(0, descriptor.size());
+        descriptor.add(validId);
+        Assert.assertEquals(1, descriptor.size());
+
+        Assert.assertFalse(descriptor.setValue(invalidId, testValue));
+        Assert.assertTrue(descriptor.setValue(validId, testValue));
+        Assert.assertEquals(0, descriptor.getValue(invalidId));
+        Assert.assertEquals(testValue, descriptor.getValue(validId));
+
+        Assert.assertFalse(descriptor.setDescription(invalidId, testDesc));
+        Assert.assertTrue(descriptor.setDescription(validId, testDesc));
+        Assert.assertEquals(null, descriptor.getDescription(invalidId));
+        Assert.assertEquals(testDesc, descriptor.getDescription(validId));
+
+        Assert.assertFalse(descriptor.setLocation(invalidId, testLocation));
+        Assert.assertTrue(descriptor.setLocation(validId, testLocation));
+        Assert.assertEquals(0, descriptor.getLocation(invalidId));
+        Assert.assertEquals(testLocation, descriptor.getLocation(validId));
+
+        StringBuilder sb = new StringBuilder();
+        descriptor.dump(sb);
+        Assert.assertTrue(sb.toString().contains(testDesc));
+
+        descriptor.add(validId + 1);
+        Assert.assertEquals(2, descriptor.size());
+        descriptor.remove(validId);
+        Assert.assertEquals(1, descriptor.size());
+        descriptor.clear();
+        Assert.assertEquals(0, descriptor.size());
+    }
+
+    @Test
+    public void testDump_doesNotCrash() throws Exception {
+        connectDevice(mDevice);
+
+        StringBuilder sb = new StringBuilder();
+        mService.dump(sb);
+    }
+
+    private void connectDevice(BluetoothDevice device) throws Exception {
         VolumeControlStackEvent connCompletedEvent;
 
         List<BluetoothDevice> prevConnectedDevices = mService.getConnectedDevices();
@@ -576,10 +898,15 @@
                 mService.getConnectionState(device));
 
         // Verify that the device is in the list of connected devices
-        Assert.assertTrue(mService.getConnectedDevices().contains(device));
+        final SynchronousResultReceiver<List<BluetoothDevice>> recv =
+                SynchronousResultReceiver.get();
+        mServiceBinder.getConnectedDevices(mAttributionSource, recv);
+        List<BluetoothDevice> connectedDevices =
+                recv.awaitResultNoInterrupt(Duration.ofMillis(TIMEOUT_MS)).getValue(null);
+        Assert.assertTrue(connectedDevices.contains(device));
         // Verify the list of previously connected devices
         for (BluetoothDevice prevDevice : prevConnectedDevices) {
-            Assert.assertTrue(mService.getConnectedDevices().contains(prevDevice));
+            Assert.assertTrue(connectedDevices.contains(prevDevice));
         }
     }
 
diff --git a/android/app/tests/unit/src/com/android/bluetooth/vc/VolumeControlStateMachineTest.java b/android/app/tests/unit/src/com/android/bluetooth/vc/VolumeControlStateMachineTest.java
index f0cf5b6..2082abd 100644
--- a/android/app/tests/unit/src/com/android/bluetooth/vc/VolumeControlStateMachineTest.java
+++ b/android/app/tests/unit/src/com/android/bluetooth/vc/VolumeControlStateMachineTest.java
@@ -17,7 +17,13 @@
 
 package com.android.bluetooth.vc;
 
-import static org.mockito.Mockito.*;
+import static org.mockito.Mockito.after;
+import static org.mockito.Mockito.any;
+import static org.mockito.Mockito.anyString;
+import static org.mockito.Mockito.doReturn;
+import static org.mockito.Mockito.eq;
+import static org.mockito.Mockito.timeout;
+import static org.mockito.Mockito.verify;
 
 import android.bluetooth.BluetoothAdapter;
 import android.bluetooth.BluetoothDevice;
@@ -25,24 +31,24 @@
 import android.content.Context;
 import android.content.Intent;
 import android.os.HandlerThread;
+import android.os.Message;
 
 import androidx.test.InstrumentationRegistry;
 import androidx.test.filters.MediumTest;
 import androidx.test.runner.AndroidJUnit4;
 
-import com.android.bluetooth.btservice.AdapterService;
-import com.android.bluetooth.R;
 import com.android.bluetooth.TestUtils;
+import com.android.bluetooth.btservice.AdapterService;
 
 import org.hamcrest.core.IsInstanceOf;
 import org.junit.After;
 import org.junit.Assert;
-import org.junit.Assume;
 import org.junit.Before;
 import org.junit.Test;
 import org.junit.runner.RunWith;
 import org.mockito.ArgumentCaptor;
 import org.mockito.Mock;
+import org.mockito.Mockito;
 import org.mockito.MockitoAnnotations;
 
 @MediumTest
@@ -62,6 +68,7 @@
     @Before
     public void setUp() throws Exception {
         mTargetContext = InstrumentationRegistry.getTargetContext();
+        InstrumentationRegistry.getInstrumentation().getUiAutomation().adoptShellPermissionIdentity();
         // Set up mocks and test assets
         MockitoAnnotations.initMocks(this);
         TestUtils.setAdapterService(mAdapterService);
@@ -160,7 +167,7 @@
         connCompletedEvent.device = mTestDevice;
         connCompletedEvent.valueInt1 = VolumeControlStackEvent.CONNECTION_STATE_CONNECTED;
         mVolumeControlStateMachine.sendMessage(VolumeControlStateMachine.STACK_EVENT,
-                                               connCompletedEvent);
+                connCompletedEvent);
 
         // Verify that the expected number of broadcasts are executed:
         // - two calls to broadcastConnectionState(): Disconnected -> Connecting -> Connected
@@ -254,4 +261,135 @@
                 IsInstanceOf.instanceOf(VolumeControlStateMachine.Disconnected.class));
         verify(mVolumeControlNativeInterface).disconnectVolumeControl(eq(mTestDevice));
     }
+
+    @Test
+    public void testStatesChangesWithMessages() {
+        allowConnection(true);
+        doReturn(true).when(mVolumeControlNativeInterface).connectVolumeControl(any(
+                BluetoothDevice.class));
+        doReturn(true).when(mVolumeControlNativeInterface).disconnectVolumeControl(any(
+                BluetoothDevice.class));
+
+        // Check that we are in Disconnected state
+        Assert.assertThat(mVolumeControlStateMachine.getCurrentState(),
+                IsInstanceOf.instanceOf(VolumeControlStateMachine.Disconnected.class));
+
+        mVolumeControlStateMachine.sendMessage(mVolumeControlStateMachine.DISCONNECT);
+        // Check that we are in Disconnected state
+        Assert.assertThat(mVolumeControlStateMachine.getCurrentState(),
+                IsInstanceOf.instanceOf(VolumeControlStateMachine.Disconnected.class));
+
+        // disconnected -> connecting
+        sendMessageAndVerifyTransition(
+                mVolumeControlStateMachine.obtainMessage(mVolumeControlStateMachine.CONNECT),
+                VolumeControlStateMachine.Connecting.class);
+        // connecting -> disconnected
+        sendMessageAndVerifyTransition(
+                mVolumeControlStateMachine.obtainMessage(VolumeControlStateMachine.CONNECT_TIMEOUT),
+                VolumeControlStateMachine.Disconnected.class);
+
+        // disconnected -> connecting
+        VolumeControlStackEvent stackEvent = new VolumeControlStackEvent(
+                VolumeControlStackEvent.EVENT_TYPE_CONNECTION_STATE_CHANGED);
+        stackEvent.device = mTestDevice;
+        stackEvent.valueInt1 = VolumeControlStackEvent.CONNECTION_STATE_CONNECTING;
+        sendMessageAndVerifyTransition(
+                mVolumeControlStateMachine.obtainMessage(
+                        mVolumeControlStateMachine.STACK_EVENT, stackEvent),
+                VolumeControlStateMachine.Connecting.class);
+
+        // connecting -> disconnected
+        sendMessageAndVerifyTransition(
+                mVolumeControlStateMachine.obtainMessage(mVolumeControlStateMachine.DISCONNECT),
+                VolumeControlStateMachine.Disconnected.class);
+
+        // disconnected -> connecting
+        sendMessageAndVerifyTransition(
+                mVolumeControlStateMachine.obtainMessage(mVolumeControlStateMachine.CONNECT),
+                VolumeControlStateMachine.Connecting.class);
+        // connecting -> disconnecting
+        stackEvent = new VolumeControlStackEvent(
+                VolumeControlStackEvent.EVENT_TYPE_CONNECTION_STATE_CHANGED);
+        stackEvent.device = mTestDevice;
+        stackEvent.valueInt1 = VolumeControlStackEvent.CONNECTION_STATE_DISCONNECTING;
+        sendMessageAndVerifyTransition(
+                mVolumeControlStateMachine.obtainMessage(
+                        mVolumeControlStateMachine.STACK_EVENT, stackEvent),
+                VolumeControlStateMachine.Disconnecting.class);
+        // disconnecting -> connecting
+        stackEvent = new VolumeControlStackEvent(
+                VolumeControlStackEvent.EVENT_TYPE_CONNECTION_STATE_CHANGED);
+        stackEvent.device = mTestDevice;
+        stackEvent.valueInt1 = VolumeControlStackEvent.CONNECTION_STATE_CONNECTING;
+        sendMessageAndVerifyTransition(
+                mVolumeControlStateMachine.obtainMessage(
+                        mVolumeControlStateMachine.STACK_EVENT, stackEvent),
+                VolumeControlStateMachine.Connecting.class);
+        // connecting -> connected
+        stackEvent = new VolumeControlStackEvent(
+                VolumeControlStackEvent.EVENT_TYPE_CONNECTION_STATE_CHANGED);
+        stackEvent.device = mTestDevice;
+        stackEvent.valueInt1 = VolumeControlStackEvent.CONNECTION_STATE_CONNECTED;
+        sendMessageAndVerifyTransition(
+                mVolumeControlStateMachine.obtainMessage(
+                        mVolumeControlStateMachine.STACK_EVENT, stackEvent),
+                VolumeControlStateMachine.Connected.class);
+        // connected -> disconnecting
+        stackEvent = new VolumeControlStackEvent(
+                VolumeControlStackEvent.EVENT_TYPE_CONNECTION_STATE_CHANGED);
+        stackEvent.device = mTestDevice;
+        stackEvent.valueInt1 = VolumeControlStackEvent.CONNECTION_STATE_DISCONNECTING;
+        sendMessageAndVerifyTransition(
+                mVolumeControlStateMachine.obtainMessage(
+                        mVolumeControlStateMachine.STACK_EVENT, stackEvent),
+                VolumeControlStateMachine.Disconnecting.class);
+        // disconnecting -> disconnected
+        sendMessageAndVerifyTransition(
+                mVolumeControlStateMachine.obtainMessage(VolumeControlStateMachine.CONNECT_TIMEOUT),
+                VolumeControlStateMachine.Disconnected.class);
+
+        // disconnected -> connected
+        stackEvent = new VolumeControlStackEvent(
+                VolumeControlStackEvent.EVENT_TYPE_CONNECTION_STATE_CHANGED);
+        stackEvent.device = mTestDevice;
+        stackEvent.valueInt1 = VolumeControlStackEvent.CONNECTION_STATE_CONNECTED;
+        sendMessageAndVerifyTransition(
+                mVolumeControlStateMachine.obtainMessage(
+                        mVolumeControlStateMachine.STACK_EVENT, stackEvent),
+                VolumeControlStateMachine.Connected.class);
+        // connected -> disconnected
+        sendMessageAndVerifyTransition(
+                mVolumeControlStateMachine.obtainMessage(
+                        mVolumeControlStateMachine.DISCONNECT),
+                VolumeControlStateMachine.Disconnecting.class);
+
+        // disconnecting -> connected
+        stackEvent = new VolumeControlStackEvent(
+                VolumeControlStackEvent.EVENT_TYPE_CONNECTION_STATE_CHANGED);
+        stackEvent.device = mTestDevice;
+        stackEvent.valueInt1 = VolumeControlStackEvent.CONNECTION_STATE_CONNECTED;
+        sendMessageAndVerifyTransition(
+                mVolumeControlStateMachine.obtainMessage(
+                        mVolumeControlStateMachine.STACK_EVENT, stackEvent),
+                VolumeControlStateMachine.Connected.class);
+        // connected -> disconnected
+        stackEvent = new VolumeControlStackEvent(
+                VolumeControlStackEvent.EVENT_TYPE_CONNECTION_STATE_CHANGED);
+        stackEvent.device = mTestDevice;
+        stackEvent.valueInt1 = VolumeControlStackEvent.CONNECTION_STATE_DISCONNECTED;
+        sendMessageAndVerifyTransition(
+                mVolumeControlStateMachine.obtainMessage(
+                        VolumeControlStateMachine.STACK_EVENT, stackEvent),
+                VolumeControlStateMachine.Disconnected.class);
+    }
+
+    private <T> void sendMessageAndVerifyTransition(Message msg, Class<T> type) {
+        Mockito.clearInvocations(mVolumeControlService);
+        mVolumeControlStateMachine.sendMessage(msg);
+        // Verify that one connection state broadcast is executed
+        verify(mVolumeControlService, timeout(TIMEOUT_MS).times(1)).sendBroadcast(
+                any(Intent.class), anyString());
+        Assert.assertThat(mVolumeControlStateMachine.getCurrentState(),
+                IsInstanceOf.instanceOf(type));
+    }
 }
diff --git a/android/blueberry/server/Android.bp b/android/blueberry/server/Android.bp
deleted file mode 100644
index 1831b8f..0000000
--- a/android/blueberry/server/Android.bp
+++ /dev/null
@@ -1,82 +0,0 @@
-package {
-    default_applicable_licenses: ["Android-Apache-2.0"],
-}
-
-android_test_helper_app {
-    name: "BlueberryServer",
-    srcs: ["src/**/*.kt"],
-    platform_apis: true,
-    certificate: "platform",
-
-    static_libs: [
-        "androidx.test.runner",
-        "androidx.test.core",
-        "grpc-java-netty-shaded-test",
-        "grpc-java-lite",
-        "guava",
-        "opencensus-java-api",
-        "kotlinx_coroutines",
-        "blueberry-grpc-java",
-        "blueberry-proto-java",
-        "opencensus-java-contrib-grpc-metrics",
-    ],
-
-    dex_preopt: {
-        enabled: false,
-    },
-    optimize: {
-        enabled: false,
-    },
-}
-
-android_test {
-    name: "pts-bot",
-    required: ["BlueberryServer"],
-    test_config: "configs/PtsBotTest.xml",
-    data: ["configs/pts_bot_tests_config.json"],
-}
-
-java_library {
-    name: "blueberry-grpc-java",
-    visibility: ["//visibility:private"],
-    srcs: [
-        "proto/blueberry/*.proto",
-    ],
-    static_libs: [
-        "blueberry-proto-java",
-        "grpc-java-lite",
-        "guava",
-        "opencensus-java-api",
-        "libprotobuf-java-lite",
-        "javax_annotation-api_1.3.2",
-    ],
-    proto: {
-        include_dirs: [
-            "packages/modules/Bluetooth/android/blueberry/server/proto",
-            "external/protobuf/src",
-        ],
-        plugin: "grpc-java-plugin",
-        output_params: [
-           "lite",
-        ],
-    },
-}
-
-java_library {
-    name: "blueberry-proto-java",
-    visibility: ["//visibility:private"],
-    srcs: [
-        "proto/blueberry/*.proto",
-        ":libprotobuf-internal-protos",
-    ],
-    static_libs: [
-        "libprotobuf-java-lite",
-    ],
-    proto: {
-        type: "lite",
-        include_dirs: [
-            "packages/modules/Bluetooth/android/blueberry/server/proto",
-            "external/protobuf/src",
-        ],
-    },
-}
diff --git a/android/blueberry/server/AndroidManifest.xml b/android/blueberry/server/AndroidManifest.xml
deleted file mode 100644
index d6b984c..0000000
--- a/android/blueberry/server/AndroidManifest.xml
+++ /dev/null
@@ -1,33 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<!-- Copyright (C) 2022 The Android Open Source Project
-
-     Licensed under the Apache License, Version 2.0 (the "License");
-     you may not use this file except in compliance with the License.
-     You may obtain a copy of the License at
-
-          http://www.apache.org/licenses/LICENSE-2.0
-
-     Unless required by applicable law or agreed to in writing, software
-     distributed under the License is distributed on an "AS IS" BASIS,
-     WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-     See the License for the specific language governing permissions and
-     limitations under the License.
--->
-
-<manifest xmlns:android="http://schemas.android.com/apk/res/android"
-    package="com.android.blueberry">
-
-    <application>
-        <uses-library android:name="android.test.runner" />
-    </application>
-
-    <uses-permission android:name="android.permission.BLUETOOTH_ADMIN" />
-    <uses-permission android:name="android.permission.BLUETOOTH_CONNECT" />
-    <uses-permission android:name="android.permission.BLUETOOTH_PRIVILEGED" />
-    <uses-permission android:name="android.permission.INTERNET" />
-    <uses-permission android:name="android.permission.LOCAL_MAC_ADDRESS" />
-
-    <instrumentation android:name="com.android.blueberry.Main"
-                     android:targetPackage="com.android.blueberry"
-                     android:label="Blueberry Android Server" />
-</manifest>
diff --git a/android/blueberry/server/README.md b/android/blueberry/server/README.md
deleted file mode 100644
index ebeea94..0000000
--- a/android/blueberry/server/README.md
+++ /dev/null
@@ -1,117 +0,0 @@
-# Blueberry Android server
-
-The Blueberry Android server exposes the [Blueberry test interfaces](
-go/blueberry-doc) over gRPC implemented on top of the Android Bluetooth SDK.
-
-## Getting started
-
-Using Blueberry Android server requires to:
-
-* Build AOSP for your DUT, which can be either a physical device or an Android
-  Virtual Device (AVD).
-* [Only for virtual tests] Build Rootcanal, the Android
-  virtual Bluetooth Controller.
-* Setup your test environment.
-* Build, install, and run Blueberry server.
-* Run your tests.
-
-### 1. Build and run AOSP code
-
-Refer to the AOSP documentation to [initialize and sync](
-https://g3doc.corp.google.com/company/teams/android/developing/init-sync.md)
-AOSP code, and [build](
-https://g3doc.corp.google.com/company/teams/android/developing/build-flash.md)
-it for your DUT (`aosp_cf_x86_64_phone-userdebug` for the emulator).
-
-**If your DUT is a physical device**, flash the built image on it. You may
-need to use [Remote Device Proxy](
-https://g3doc.corp.google.com/company/teams/android/wfh/adb/remote_device_proxy.md)
-if you are using a remote instance to build. If you are also using `adb` on
-your local machine, you may need to force kill the local `adb` server (`adb
-kill-server` before using Remote Device Proxy.
-
-**If your DUT is a Cuttlefish virtual device**, then proceed with the following steps:
-
-* Connect to your [Chrome Remote Desktop](
-  https://remotedesktop.corp.google.com/access/).
-* Create a local Cuttlefish instance using your locally built image with the command
-  `acloud create --local-instance --local-image` (see [documentation](
-  go/acloud-manual#local-instance-using-a-locally-built-image))
-
-### 2. Build Rootcanal [only for virtual tests on a physical device]
-
-Rootcanal is a virtual Bluetooth Controller that allows emulating Bluetooth
-communications. It is used by default within Cuttlefish when running it using the [acloud](go/acloud) command (and thus this step is not
-needed) and is required for all virtual tests. However, it does not come
-preinstalled on a build for a physical device.
-
-Proceed with the [following instructions](
-https://docs.google.com/document/d/1-qoK1HtdOKK6sTIKAToFf7nu9ybxs8FQWU09idZijyc/edit#heading=h.x9snb54sjlu9)
-to build and install Rootcanal on your DUT.
-
-### 3. Setup your test environment
-
-Each time when starting a new ADB server to communicate with your DUT, proceed
-with the following steps to setup the test environment:
-
-* If running virtual tests (such as PTS-bot) on a physical device:
-  * Run Rootcanal:
-    `adb root` then
-    `adb shell ./vendor/bin/hw/android.hardware.bluetooth@1.1-service.sim &`
-  * Forward Rootcanal port through ADB:
-    `adb forward tcp:<rootcanal-port> tcp:<rootcanal-port>`.
-    Rootcanal port number may differ depending on its configuration. It is
-    7200 for the AVD, and generally 6211 for physical devices.
-* Forward Blueberry Android server port through ADB:
-  `adb forward tcp:8999 tcp:8999`.
-
-The above steps can be done by executing the `setup.sh` helper script (the
-`-rootcanal` option must be used for virtual tests on a physical device).
-
-Finally, you must also make sure that the machine on which tests are executed
-can access the ports of the Blueberry Android server, Rootcanal (if required),
-and ADB (if required).
-
-You can also check the usage examples provided below.
-
-### 4. Build, install, and run Blueberry Android server
-
-* `m BlueberryServer`
-* `adb install -r -g out/target/product/<device>/testcases/Blueberry/arm64/Blueberry.apk`
-
-* Start the instrumented app:
-* `adb shell am instrument -w -e Debug false com.android.blueberry/.Server`
-
-### 5. Run your tests
-
-You should now be fully set up to run your tests!
-
-### Usage examples
-
-Here are some usage examples:
-
-* **DUT**: physical
-  **Test type**: virtual
-  **Test executer**: remote instance (for instance a Cloudtop) accessed via SSH
-  **Blueberry Android server repository location**: local machine (typically
-  using Android Studio)
-
-  * On your local machine: `./setup.sh --rootcanal`.
-  * On your local machine: build and install the app on your DUT.
-  * Log on your remote instance, and forward Rootcanal port (6211, may change
-    depending on your build) and Blueberry Android server (8999) port:
-    `ssh -R 6211:localhost:6211 -R 8999:localhost:8999 <remote-instance>`.
-    Optionnally, you can also share ADB port to your remote instance (if
-    needed) by adding `-R 5037:localhost:5037` to the command.
-  * On your remote instance: execute your tests.
-
-* **DUT**: virtual (running in remote instance)
-  **Test type**: virtual
-  **Test executer**: remote instance
-  **Blueberry Android server repository location**: remote instance
-
-  On your remote instance:
-  * `./setup.sh`.
-  * Build and install the app on the AVD.
-  * Execute your tests.
-
diff --git a/android/blueberry/server/configs/PtsBotTest.xml b/android/blueberry/server/configs/PtsBotTest.xml
deleted file mode 100644
index 7ee909a..0000000
--- a/android/blueberry/server/configs/PtsBotTest.xml
+++ /dev/null
@@ -1,19 +0,0 @@
-<configuration description="Runs PTS-bot tests">
-
-    <target_preparer class="com.android.tradefed.targetprep.TestAppInstallSetup">
-        <option name="test-file-name" value="BlueberryServer.apk" />
-        <option name="install-arg" value="-r" />
-        <option name="install-arg" value="-g" />
-    </target_preparer>
-    <target_preparer class="com.android.tradefed.targetprep.InstallApkSetup">
-        <option name="post-install-cmd" value="am instrument -e Debug false com.android.blueberry/.Main" />
-    </target_preparer>
-
-    <test class="com.android.tradefed.testtype.blueberry.PtsBotTest" >
-        <option name="mmi2grpc" value="empty" />
-        <option name="tests-config-file" value="pts_bot_tests_config.json" />
-        <option name="physical" value="false" />
-        <option name="profile" value="A2DP/SRC" />
-    </test>
-
-</configuration>
diff --git a/android/blueberry/server/configs/pts_bot_tests_config.json b/android/blueberry/server/configs/pts_bot_tests_config.json
deleted file mode 100644
index 45153df..0000000
--- a/android/blueberry/server/configs/pts_bot_tests_config.json
+++ /dev/null
@@ -1,179 +0,0 @@
-{
-    "ics": {
-      "TSPC_A2DP_9_4": true,
-      "TSPC_A2DP_9_2": true,
-      "TSPC_A2DP_9_1": true,
-      "TSPC_A2DP_8_3": true,
-      "TSPC_A2DP_13_3": true,
-      "TSPC_A2DP_13_2": true,
-      "TSPC_A2DP_9_3": true,
-      "TSPC_A2DP_13_1": true,
-      "TSPC_A2DP_8_2": true,
-      "TSPC_A2DP_12_3": true,
-      "TSPC_A2DP_12_4": true,
-      "TSPC_A2DP_12_2": true,
-      "TSPC_A2DP_8_4": true,
-      "TSPC_A2DP_1_1": true,
-      "TSPC_A2DP_1_2": true,
-      "TSPC_A2DP_2a_3": true,
-      "TSPC_A2DP_2b_2": true,
-      "TSPC_A2DP_2_1": true,
-      "TSPC_A2DP_2_10": true,
-      "TSPC_A2DP_2_10a": true,
-      "TSPC_A2DP_2_13": true,
-      "TSPC_A2DP_2_2": true,
-      "TSPC_A2DP_2_3": true,
-      "TSPC_A2DP_2_4": true,
-      "TSPC_A2DP_2_5": true,
-      "TSPC_A2DP_2_6": true,
-      "TSPC_A2DP_2_7": true,
-      "TSPC_A2DP_2_8": true,
-      "TSPC_A2DP_2_9": true,
-      "TSPC_A2DP_3_1": true,
-      "TSPC_A2DP_3_1a": true,
-      "TSPC_A2DP_3a_1": true,
-      "TSPC_A2DP_3a_10": true,
-      "TSPC_A2DP_3a_11": true,
-      "TSPC_A2DP_3a_12": true,
-      "TSPC_A2DP_3a_2": true,
-      "TSPC_A2DP_3a_3": true,
-      "TSPC_A2DP_3a_4": true,
-      "TSPC_A2DP_3a_5": true,
-      "TSPC_A2DP_3a_6": true,
-      "TSPC_A2DP_3a_7": true,
-      "TSPC_A2DP_3a_8": true,
-      "TSPC_A2DP_3a_9": true,
-      "TSPC_A2DP_4_1": true,
-      "TSPC_A2DP_4_10": true,
-      "TSPC_A2DP_4_10a": true,
-      "TSPC_A2DP_4_13": true,
-      "TSPC_A2DP_4_15": true,
-      "TSPC_A2DP_4_2": true,
-      "TSPC_A2DP_4_3": false,
-      "TSPC_A2DP_4_4": true,
-      "TSPC_A2DP_4_5": true,
-      "TSPC_A2DP_4_6": true,
-      "TSPC_A2DP_4_7": true,
-      "TSPC_A2DP_4_8": false,
-      "TSPC_A2DP_4_9": true,
-      "TSPC_A2DP_7a_3": true,
-      "TSPC_A2DP_7b_2": true,
-      "TSPC_A2DP_5_1": true,
-      "TSPC_A2DP_5_1a": true,
-      "TSPC_A2DP_5a_1": true,
-      "TSPC_A2DP_5a_10": true,
-      "TSPC_A2DP_5a_11": true,
-      "TSPC_A2DP_5a_12": true,
-      "TSPC_A2DP_5a_2": true,
-      "TSPC_A2DP_5a_3": true,
-      "TSPC_A2DP_5a_4": true,
-      "TSPC_A2DP_5a_5": true,
-      "TSPC_A2DP_5a_6": true,
-      "TSPC_A2DP_5a_7": true,
-      "TSPC_A2DP_5a_8": true,
-      "TSPC_A2DP_5a_9": true,
-      "TSPC_AVDTP_1_1": true,
-      "TSPC_AVDTP_1_2": true,
-      "TSPC_AVDTP_1_3": true,
-      "TSPC_AVDTP_1_4": true,
-      "TSPC_AVDTP_16_1": true,
-      "TSPC_AVDTP_16_3": true,
-      "TSPC_AVDTP_2_1": true,
-      "TSPC_AVDTP_2_2": true,
-      "TSPC_AVDTP_2_3": true,
-      "TSPC_AVDTP_2_4": true,
-      "TSPC_AVDTP_2b_1": true,
-      "TSPC_AVDTP_2b_2": true,
-      "TSPC_AVDTP_2b_3": true,
-      "TSPC_AVDTP_2b_4": true,
-      "TSPC_AVDTP_3_1": true,
-      "TSPC_AVDTP_3_2": true,
-      "TSPC_AVDTP_3b_1": true,
-      "TSPC_AVDTP_3b_2": true,
-      "TSPC_AVDTP_4_1": true,
-      "TSPC_AVDTP_4_2": true,
-      "TSPC_AVDTP_4_3": true,
-      "TSPC_AVDTP_4_4": true,
-      "TSPC_AVDTP_4_5": false,
-      "TSPC_AVDTP_4_6": true,
-      "TSPC_AVDTP_4b_1": true,
-      "TSPC_AVDTP_4b_2": true,
-      "TSPC_AVDTP_4b_3": true,
-      "TSPC_AVDTP_4b_4": false,
-      "TSPC_AVDTP_4b_5": false,
-      "TSPC_AVDTP_4b_6": true,
-      "TSPC_AVDTP_5_1": true,
-      "TSPC_AVDTP_5_2": true,
-      "TSPC_AVDTP_5_3": true,
-      "TSPC_AVDTP_5_4": true,
-      "TSPC_AVDTP_5_5": true,
-      "TSPC_AVDTP_5b_1": true,
-      "TSPC_AVDTP_5b_2": false,
-      "TSPC_AVDTP_5b_3": true,
-      "TSPC_AVDTP_5b_4": false,
-      "TSPC_AVDTP_5b_5": true,
-      "TSPC_AVDTP_6b_1": true,
-      "TSPC_AVDTP_7_1": true,
-      "TSPC_AVDTP_7b_1": true,
-      "TSPC_AVDTP_10_1": true,
-      "TSPC_AVDTP_10_2": true,
-      "TSPC_AVDTP_10_3": true,
-      "TSPC_AVDTP_10_4": true,
-      "TSPC_AVDTP_10_5": true,
-      "TSPC_AVDTP_10_6": true,
-      "TSPC_AVDTP_10b_1": true,
-      "TSPC_AVDTP_10b_2": true,
-      "TSPC_AVDTP_10b_3": true,
-      "TSPC_AVDTP_10b_4": true,
-      "TSPC_AVDTP_10b_5": true,
-      "TSPC_AVDTP_10b_6": true,
-      "TSPC_AVDTP_11_1": true,
-      "TSPC_AVDTP_11_2": true,
-      "TSPC_AVDTP_11_3": true,
-      "TSPC_AVDTP_11_4": true,
-      "TSPC_AVDTP_11_5": true,
-      "TSPC_AVDTP_11_6": true,
-      "TSPC_AVDTP_11b_1": true,
-      "TSPC_AVDTP_11b_2": true,
-      "TSPC_AVDTP_11b_3": true,
-      "TSPC_AVDTP_11b_4": true,
-      "TSPC_AVDTP_11b_5": true,
-      "TSPC_AVDTP_11b_6": true,
-      "TSPC_AVDTP_12b_1": true,
-      "TSPC_AVDTP_13_1": true,
-      "TSPC_AVDTP_13b_1": true,
-      "TSPC_AVDTP_8_1": true,
-      "TSPC_AVDTP_8_2": true,
-      "TSPC_AVDTP_8_3": true,
-      "TSPC_AVDTP_8_4": true,
-      "TSPC_AVDTP_8b_1": true,
-      "TSPC_AVDTP_8b_2": true,
-      "TSPC_AVDTP_8b_3": true,
-      "TSPC_AVDTP_8b_4": true,
-      "TSPC_AVDTP_9_1": true,
-      "TSPC_AVDTP_9_2": true,
-      "TSPC_AVDTP_9b_1": true,
-      "TSPC_AVDTP_9b_2": true,
-      "TSPC_AVDTP_14_1": true,
-      "TSPC_AVDTP_14_6": true,
-      "TSPC_AVDTP_14a_3": true,
-      "TSPC_AVDTP_15_1": true,
-      "TSPC_AVDTP_15_6": false,
-      "TSPC_AVDTP_15a_3": true,
-      "TSPC_SUM ICS_31_22": true,
-      "TSPC_PROD_1_2": true,
-      "TSPC_PROD_3_1": true
-    },
-    "ixit": {"default": {}, "A2DP": {}, "AVDTP": {}},
-    "skip": [
-      "A2DP/SRC/SET/BV-05-I",
-      "A2DP/SRC/SET/BV-06-I",
-      "A2DP/SNK/SYN/BV-01-C",
-      "AVDTP/SRC/INT/SIG/SMG/BV-11-C",
-      "AVDTP/SRC/INT/SIG/SMG/BV-23-C",
-      "AVDTP/SNK/INT/SIG/SMG/BV-19-C",
-      "AVDTP/SNK/INT/SIG/SMG/BV-23-C",
-      "A2DP/SRC/CC/BV-09-I"
-    ]
-  }
-
diff --git a/android/blueberry/server/proto/blueberry/a2dp.proto b/android/blueberry/server/proto/blueberry/a2dp.proto
deleted file mode 100644
index 36d571c..0000000
--- a/android/blueberry/server/proto/blueberry/a2dp.proto
+++ /dev/null
@@ -1,250 +0,0 @@
-syntax = "proto3";
-
-option java_outer_classname = "A2dpProto";
-
-package blueberry;
-
-import "blueberry/host.proto";
-import "google/protobuf/wrappers.proto";
-
-// Service to trigger A2DP (Advanced Audio Distribution Profile) procedures.
-//
-// Requirements for the implementor:
-// - Streams must not be automatically opened, even if discovered.
-// - The `Host` service must be implemented
-//
-// References:
-// - [A2DP] Bluetooth SIG, Specification of the Bluetooth System,
-//    Advanced Audio Distribution, Version 1.3 or Later
-// - [AVDTP] Bluetooth SIG, Specification of the Bluetooth System,
-//    Audio/Video Distribution Transport Protocol, Version 1.3 or Later
-service A2DP {
-  // Open a stream from a local **Source** endpoint to a remote **Sink**
-  // endpoint.
-  //
-  // The returned source should be in the AVDTP_OPEN state (see [AVDTP] 9.1).
-  // The rpc must block until the stream has reached this state.
-  //
-  // A cancellation of this call must result in aborting the current
-  // AVDTP procedure (see [AVDTP] 9.9).
-  rpc OpenSource(OpenSourceRequest) returns (OpenSourceResponse);
-  // Open a stream from a local **Sink** endpoint to a remote **Source**
-  // endpoint.
-  //
-  // The returned sink must be in the AVDTP_OPEN state (see [AVDTP] 9.1).
-  // The rpc must block until the stream has reached this state.
-  //
-  // A cancellation of this call must result in aborting the current
-  // AVDTP procedure (see [AVDTP] 9.9).
-  rpc OpenSink(OpenSinkRequest) returns (OpenSinkResponse);
-  // Wait for a stream from a local **Source** endpoint to
-  // a remote **Sink** endpoint to open.
-  //
-  // The returned source should be in the AVDTP_OPEN state (see [AVDTP] 9.1).
-  // The rpc must block until the stream has reached this state.
-  //
-  // If the peer has opened a source prior to this call, the server will
-  // return it. The server must return the same source only once.
-  rpc WaitSource(WaitSourceRequest) returns (WaitSourceResponse);
-  // Wait for a stream from a local **Sink** endpoint to
-  // a remote **Source** endpoint to open.
-  //
-  // The returned sink should be in the AVDTP_OPEN state (see [AVDTP] 9.1).
-  // The rpc must block until the stream has reached this state.
-  //
-  // If the peer has opened a sink prior to this call, the server will
-  // return it. The server must return the same sink only once.
-  rpc WaitSink(WaitSinkRequest) returns (WaitSinkResponse);
-  // Get if the stream is suspended
-  rpc IsSuspended(IsSuspendedRequest) returns (IsSuspendedResponse);
-  // Start a suspended stream.
-  rpc Start(StartRequest) returns (StartResponse);
-  // Suspend a started stream.
-  rpc Suspend(SuspendRequest) returns (SuspendResponse);
-  // Close a stream, the source or sink tokens must not be reused afterwards.
-  rpc Close(CloseRequest) returns (CloseResponse);
-  // Get the `AudioEncoding` value of a stream
-  rpc GetAudioEncoding(GetAudioEncodingRequest) returns (GetAudioEncodingResponse);
-  // Playback audio by a `Source`
-  rpc PlaybackAudio(stream PlaybackAudioRequest) returns (PlaybackAudioResponse);
-  // Capture audio from a `Sink`
-  rpc CaptureAudio(CaptureAudioRequest) returns (stream CaptureAudioResponse);
-}
-
-// Audio encoding formats.
-enum AudioEncoding {
-  // Interleaved stereo frames with 16-bit signed little-endian linear PCM
-  // samples at 44100Hz sample rate
-  PCM_S16_LE_44K1_STEREO = 0;
-  // Interleaved stereo frames with 16-bit signed little-endian linear PCM
-  // samples at 48000Hz sample rate
-  PCM_S16_LE_48K_STEREO = 1;
-}
-
-// A Token representing a Source stream (see [A2DP] 2.2).
-// It's acquired via an OpenSource on the A2DP service.
-message Source {
-  // Opaque value filled by the GRPC server, must not
-  // be modified nor crafted.
-  bytes cookie = 1;
-}
-
-// A Token representing a Sink stream (see [A2DP] 2.2).
-// It's acquired via an OpenSink on the A2DP service.
-message Sink {
-  // Opaque value filled by the GRPC server, must not
-  // be modified nor crafted.
-  bytes cookie = 1;
-}
-
-// Request for the `OpenSource` method.
-message OpenSourceRequest {
-  // The connection that will open the stream.
-  Connection connection = 1;
-}
-
-// Response for the `OpenSource` method.
-message OpenSourceResponse {
-  // Result of the `OpenSource` call:
-  // - If successful: a Source
-  oneof result {
-    Source source = 1;
-  }
-}
-
-// Request for the `OpenSink` method.
-message OpenSinkRequest {
-  // The connection that will open the stream.
-  Connection connection = 1;
-}
-
-// Response for the `OpenSink` method.
-message OpenSinkResponse {
-  // Result of the `OpenSink` call:
-  // - If successful: a Sink
-  oneof result {
-    Sink sink = 1;
-  }
-}
-
-// Request for the `WaitSource` method.
-message WaitSourceRequest {
-  // The connection that is awaiting the stream.
-  Connection connection = 1;
-}
-
-// Response for the `WaitSource` method.
-message WaitSourceResponse {
-  // Result of the `WaitSource` call:
-  // - If successful: a Source
-  oneof result {
-    Source source = 1;
-  }
-}
-
-// Request for the `WaitSink` method.
-message WaitSinkRequest {
-  // The connection that is awaiting the stream.
-  Connection connection = 1;
-}
-
-// Response for the `WaitSink` method.
-message WaitSinkResponse {
-  // Result of the `WaitSink` call:
-  // - If successful: a Sink
-  oneof result {
-    Sink sink = 1;
-  }
-}
-
-// Request for the `IsSuspended` method.
-message IsSuspendedRequest {
-  // The stream on which the function will check if it's suspended
-  oneof target {
-    Sink sink = 1;
-    Source source = 2;
-  }
-}
-
-// Response for the `IsSuspended` method.
-message IsSuspendedResponse {
-  bool is_suspended = 1;
-}
-
-// Request for the `Start` method.
-message StartRequest {
-  // Target of the start, either a Sink or a Source.
-  oneof target {
-    Sink sink = 1;
-    Source source = 2;
-  }
-}
-
-// Response for the `Start` method.
-message StartResponse {}
-
-// Request for the `Suspend` method.
-message SuspendRequest {
-  // Target of the suspend, either a Sink or a Source.
-  oneof target {
-    Sink sink = 1;
-    Source source = 2;
-  }
-}
-
-// Response for the `Suspend` method.
-message SuspendResponse {}
-
-// Request for the `Close` method.
-message CloseRequest {
-  // Target of the close, either a Sink or a Source.
-  oneof target {
-    Sink sink = 1;
-    Source source = 2;
-  }
-}
-
-// Response for the `Close` method.
-message CloseResponse {}
-
-// Request for the `GetAudioEncoding` method.
-message GetAudioEncodingRequest {
-  // The stream on which the function will read the `AudioEncoding`.
-  oneof target {
-    Sink sink = 1;
-    Source source = 2;
-  }
-}
-
-// Response for the `GetAudioEncoding` method.
-message GetAudioEncodingResponse {
-  // Audio encoding of the stream.
-  AudioEncoding encoding = 1;
-}
-
-// Request for the `PlaybackAudio` method.
-message PlaybackAudioRequest {
-  // Source that will playback audio.
-  Source source = 1;
-  // Audio data to playback.
-  // The audio data must be encoded in the specified `AudioEncoding` value
-  // obtained in response of a `GetAudioEncoding` method call.
-  bytes data = 2;
-}
-
-// Response for the `PlaybackAudio` method.
-message PlaybackAudioResponse {}
-
-// Request for the `CaptureAudio` method.
-message CaptureAudioRequest {
-  // Sink that will capture audio
-  Sink sink = 1;
-}
-
-// Response for the `CaptureAudio` method.
-message CaptureAudioResponse {
-  // Captured audio data.
-  // The audio data is encoded in the specified `AudioEncoding` value
-  // obained in response of a `GetAudioEncoding` method call.
-  bytes data = 1;
-}
\ No newline at end of file
diff --git a/android/blueberry/server/proto/blueberry/host.proto b/android/blueberry/server/proto/blueberry/host.proto
deleted file mode 100644
index 6d7b80d..0000000
--- a/android/blueberry/server/proto/blueberry/host.proto
+++ /dev/null
@@ -1,103 +0,0 @@
-syntax = "proto3";
-
-option java_outer_classname = "HostProto";
-
-package blueberry;
-
-import "google/protobuf/empty.proto";
-
-// Service to trigger Bluetooth Host procedures
-//
-// At startup, the Host must be in BR/EDR connectable mode
-// (see GAP connectability modes)
-service Host {
-  // Reset the host.
-  // **After** responding to this command, the GRPC server should loose
-  // all its state.
-  // This is comparable to a process restart or an hardware reset.
-  // The GRPC server might take some time to be available after
-  // this command.
-  rpc Reset(google.protobuf.Empty) returns (google.protobuf.Empty);
-  // Create an ACL BR/EDR connection to a peer.
-  // This should send a CreateConnection on the HCI level.
-  // If the two devices have not established a previous bond,
-  // the peer must be discoverable.
-  rpc Connect(ConnectRequest) returns (ConnectResponse);
-  // Get an active ACL BR/EDR connection to a peer.
-  rpc GetConnection(GetConnectionRequest) returns (GetConnectionResponse);
-  // Wait for an ACL BR/EDR connection from a peer.
-  rpc WaitConnection(WaitConnectionRequest) returns (WaitConnectionResponse);
-  // Disconnect an ACL BR/EDR connection. The Connection must not be reused afterwards.
-  rpc Disconnect(DisconnectRequest) returns (DisconnectResponse);
-  // Read the local Bluetooth device address.
-  // This should return the same value as a Read BD_ADDR HCI command.
-  rpc ReadLocalAddress(google.protobuf.Empty) returns (ReadLocalAddressResponse);
-}
-
-// A Token representing an ACL connection.
-// It's acquired via a Connect on the Host service.
-message Connection {
-  // Opaque value filled by the GRPC server, must not
-  // be modified nor crafted.
-  bytes cookie = 1;
-}
-
-// Request of the `Connect` method.
-message ConnectRequest {
-  // Peer Bluetooth Device Address as array of 6 bytes.
-  bytes address = 1;
-}
-
-// Response of the `Connect` method.
-message ConnectResponse {
-  // Result of the `Connect` call:
-  // - If successful: a Connection
-  oneof result {
-    Connection connection = 1;
-  }
-}
-
-// Request of the `GetConnection` method.
-message GetConnectionRequest {
-  // Peer Bluetooth Device Address as array of 6 bytes.
-  bytes address = 1;
-}
-
-// Response of the `GetConnection` method.
-message GetConnectionResponse {
-  // Result of the `GetConnection` call:
-  // - If successful: a Connection
-  oneof result {
-    Connection connection = 1;
-  }
-}
-
-// Request of the `WaitConnection` method.
-message WaitConnectionRequest {
-  // Peer Bluetooth Device Address as array of 6 bytes.
-  bytes address = 1;
-}
-
-// Response of the `WaitConnection` method.
-message WaitConnectionResponse {
-  // Result of the `WaitConnection` call:
-  // - If successful: a Connection
-  oneof result {
-    Connection connection = 1;
-  }
-}
-
-// Request of the `Disconnect` method.
-message DisconnectRequest {
-  // Connection that should be disconnected.
-  Connection connection = 1;
-}
-
-// Response of the `Disconnect` method.
-message DisconnectResponse {}
-
-// Response of the `ReadLocalAddress` method.
-message ReadLocalAddressResponse {
-  // Local Bluetooth Device Address as array of 6 bytes.
-  bytes address = 1;
-}
\ No newline at end of file
diff --git a/android/blueberry/server/scripts/setup.sh b/android/blueberry/server/scripts/setup.sh
deleted file mode 100755
index 1ade4f5..0000000
--- a/android/blueberry/server/scripts/setup.sh
+++ /dev/null
@@ -1,12 +0,0 @@
-#!/bin/env bash
-
-# Run Rootcanal and forward port
-if [ "$1" == "--rootcanal" ]
-then
-    adb root
-    adb shell ./vendor/bin/hw/android.hardware.bluetooth@1.1-service.sim &
-    adb forward tcp:6211 tcp:6211
-fi
-
-# Forward Blueberry server port
-adb forward tcp:8999 tcp:8999
diff --git a/android/blueberry/server/src/com/android/blueberry/A2dp.kt b/android/blueberry/server/src/com/android/blueberry/A2dp.kt
deleted file mode 100644
index 497aeaa..0000000
--- a/android/blueberry/server/src/com/android/blueberry/A2dp.kt
+++ /dev/null
@@ -1,337 +0,0 @@
-/*
- * Copyright (C) 2022 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package com.android.blueberry
-
-import android.bluetooth.BluetoothA2dp
-import android.bluetooth.BluetoothAdapter
-import android.bluetooth.BluetoothDevice
-import android.bluetooth.BluetoothManager
-import android.bluetooth.BluetoothProfile
-import android.content.Context
-import android.content.Intent
-import android.content.IntentFilter
-import android.media.*
-import android.util.Log
-import blueberry.A2DPGrpc.A2DPImplBase
-import blueberry.A2dpProto.*
-import io.grpc.Status
-import io.grpc.stub.StreamObserver
-import kotlinx.coroutines.CoroutineScope
-import kotlinx.coroutines.Dispatchers
-import kotlinx.coroutines.cancel
-import kotlinx.coroutines.flow.Flow
-import kotlinx.coroutines.flow.SharingStarted
-import kotlinx.coroutines.flow.filter
-import kotlinx.coroutines.flow.first
-import kotlinx.coroutines.flow.map
-import kotlinx.coroutines.flow.shareIn
-
-@kotlinx.coroutines.ExperimentalCoroutinesApi
-class A2dp(val context: Context) : A2DPImplBase() {
-  private val TAG = "BlueberryA2dp"
-
-  private val scope: CoroutineScope
-  private val flow: Flow<Intent>
-
-  private val audioManager: AudioManager =
-    context.getSystemService(Context.AUDIO_SERVICE) as AudioManager
-
-  private val bluetoothManager =
-    context.getSystemService(Context.BLUETOOTH_SERVICE) as BluetoothManager
-  private val bluetoothAdapter = bluetoothManager.adapter
-  private val bluetoothA2dp = getProfileProxy<BluetoothA2dp>(context, BluetoothProfile.A2DP)
-
-  private val audioTrack: AudioTrack =
-    AudioTrack.Builder()
-      .setAudioAttributes(
-        AudioAttributes.Builder()
-          .setUsage(AudioAttributes.USAGE_MEDIA)
-          .setContentType(AudioAttributes.CONTENT_TYPE_MUSIC)
-          .build()
-      )
-      .setAudioFormat(
-        AudioFormat.Builder()
-          .setEncoding(AudioFormat.ENCODING_PCM_16BIT)
-          .setSampleRate(44100)
-          .setChannelMask(AudioFormat.CHANNEL_OUT_STEREO)
-          .build()
-      )
-      .setTransferMode(AudioTrack.MODE_STREAM)
-      .setBufferSizeInBytes(44100 * 2 * 2)
-      .build()
-
-  init {
-    scope = CoroutineScope(Dispatchers.Default)
-    val intentFilter = IntentFilter()
-    intentFilter.addAction(BluetoothA2dp.ACTION_PLAYING_STATE_CHANGED)
-    intentFilter.addAction(BluetoothA2dp.ACTION_CONNECTION_STATE_CHANGED)
-
-    flow = intentFlow(context, intentFilter).shareIn(scope, SharingStarted.Eagerly)
-  }
-
-  fun deinit() {
-    bluetoothAdapter.closeProfileProxy(BluetoothProfile.A2DP, bluetoothA2dp)
-    scope.cancel()
-  }
-
-  override fun openSource(
-    request: OpenSourceRequest,
-    responseObserver: StreamObserver<OpenSourceResponse>
-  ) {
-    grpcUnary<OpenSourceResponse>(scope, responseObserver) {
-      val address = request.connection.cookie.toByteArray().decodeToString()
-      val device = bluetoothAdapter.getRemoteDevice(address)
-      Log.i(TAG, "openSource: address=$address")
-
-      if (device.getBondState() != BluetoothDevice.BOND_BONDED) {
-        Log.e(TAG, "Device is not bonded, cannot openSource")
-        throw Status.UNKNOWN.asException()
-      }
-
-      if (bluetoothA2dp.getConnectionState(device) != BluetoothA2dp.STATE_CONNECTED) {
-        bluetoothA2dp.connect(device)
-        val state =
-          flow
-            .filter { it.getAction() == BluetoothA2dp.ACTION_CONNECTION_STATE_CHANGED }
-            .map { it.getIntExtra(BluetoothProfile.EXTRA_STATE, BluetoothAdapter.ERROR) }
-            .filter {
-              it == BluetoothProfile.STATE_CONNECTED || it == BluetoothProfile.STATE_DISCONNECTED
-            }
-            .first()
-
-        if (state == BluetoothProfile.STATE_DISCONNECTED) {
-          Log.e(TAG, "openSource failed, A2DP has been disconnected")
-          throw Status.UNKNOWN.asException()
-        }
-      }
-      val source = Source.newBuilder().setCookie(request.connection.cookie).build()
-      OpenSourceResponse.newBuilder().setSource(source).build()
-    }
-  }
-
-  override fun waitSource(
-    request: WaitSourceRequest,
-    responseObserver: StreamObserver<WaitSourceResponse>
-  ) {
-    grpcUnary<WaitSourceResponse>(scope, responseObserver) {
-      val address = request.connection.cookie.toByteArray().decodeToString()
-      val device = bluetoothAdapter.getRemoteDevice(address)
-      Log.i(TAG, "waitSource: address=$address")
-
-      if (device.getBondState() != BluetoothDevice.BOND_BONDED) {
-        Log.e(TAG, "Device is not bonded, cannot openSource")
-        throw Status.UNKNOWN.asException()
-      }
-
-      if (bluetoothA2dp.getConnectionState(device) != BluetoothA2dp.STATE_CONNECTED) {
-        val state =
-          flow
-            .filter { it.getAction() == BluetoothA2dp.ACTION_CONNECTION_STATE_CHANGED }
-            .map { it.getIntExtra(BluetoothProfile.EXTRA_STATE, BluetoothAdapter.ERROR) }
-            .filter {
-              it == BluetoothProfile.STATE_CONNECTED || it == BluetoothProfile.STATE_DISCONNECTED
-            }
-            .first()
-
-        if (state == BluetoothProfile.STATE_DISCONNECTED) {
-          Log.e(TAG, "waitSource failed, A2DP has been disconnected")
-          throw Status.UNKNOWN.asException()
-        }
-      }
-      val source = Source.newBuilder().setCookie(request.connection.cookie).build()
-      WaitSourceResponse.newBuilder().setSource(source).build()
-    }
-  }
-
-  override fun start(request: StartRequest, responseObserver: StreamObserver<StartResponse>) {
-    grpcUnary<StartResponse>(scope, responseObserver) {
-      val address = request.source.cookie.toByteArray().decodeToString()
-      val device = bluetoothAdapter.getRemoteDevice(address)
-      Log.i(TAG, "start: address=$address")
-
-      if (bluetoothA2dp.getConnectionState(device) != BluetoothA2dp.STATE_CONNECTED) {
-        Log.e(TAG, "Device is not connected, cannot start")
-        throw Status.UNKNOWN.asException()
-      }
-
-      audioTrack.play()
-
-      // If A2dp is not already playing, wait for it
-      if (!bluetoothA2dp.isA2dpPlaying(device)) {
-        flow
-          .filter { it.getAction() == BluetoothA2dp.ACTION_PLAYING_STATE_CHANGED }
-          .filter {
-            it.getParcelableExtra<BluetoothDevice>(BluetoothDevice.EXTRA_DEVICE).address == address
-          }
-          .map { it.getIntExtra(BluetoothA2dp.EXTRA_STATE, BluetoothAdapter.ERROR) }
-          .filter { it == BluetoothA2dp.STATE_PLAYING }
-          .first()
-      }
-      StartResponse.getDefaultInstance()
-    }
-  }
-
-  override fun suspend(request: SuspendRequest, responseObserver: StreamObserver<SuspendResponse>) {
-    grpcUnary<SuspendResponse>(scope, responseObserver) {
-      val address = request.source.cookie.toByteArray().decodeToString()
-      val device = bluetoothAdapter.getRemoteDevice(address)
-      Log.i(TAG, "suspend: address=$address")
-
-      if (bluetoothA2dp.getConnectionState(device) != BluetoothA2dp.STATE_CONNECTED) {
-        Log.e(TAG, "Device is not connected, cannot suspend")
-        throw Status.UNKNOWN.asException()
-      }
-
-      if (!bluetoothA2dp.isA2dpPlaying(device)) {
-        Log.e(TAG, "Device is already suspended, cannot suspend")
-        throw Status.UNKNOWN.asException()
-      }
-
-      val a2dpPlayingStateFlow =
-        flow
-          .filter { it.getAction() == BluetoothA2dp.ACTION_PLAYING_STATE_CHANGED }
-          .filter {
-            it.getParcelableExtra<BluetoothDevice>(BluetoothDevice.EXTRA_DEVICE).address == address
-          }
-          .map { it.getIntExtra(BluetoothA2dp.EXTRA_STATE, BluetoothAdapter.ERROR) }
-
-      audioTrack.pause()
-      a2dpPlayingStateFlow.filter { it == BluetoothA2dp.STATE_NOT_PLAYING }.first()
-      SuspendResponse.getDefaultInstance()
-    }
-  }
-
-  override fun isSuspended(
-    request: IsSuspendedRequest,
-    responseObserver: StreamObserver<IsSuspendedResponse>
-  ) {
-    grpcUnary<IsSuspendedResponse>(scope, responseObserver) {
-      val address = request.source.cookie.toByteArray().decodeToString()
-      val device = bluetoothAdapter.getRemoteDevice(address)
-      Log.i(TAG, "isSuspended: address=$address")
-
-      if (bluetoothA2dp.getConnectionState(device) != BluetoothA2dp.STATE_CONNECTED) {
-        Log.e(TAG, "Device is not connected, cannot get suspend state")
-        throw Status.UNKNOWN.asException()
-      }
-
-      val isSuspended = bluetoothA2dp.isA2dpPlaying(device)
-      IsSuspendedResponse.newBuilder().setIsSuspended(isSuspended).build()
-    }
-  }
-
-  override fun close(request: CloseRequest, responseObserver: StreamObserver<CloseResponse>) {
-    grpcUnary<CloseResponse>(scope, responseObserver) {
-      val address = request.source.cookie.toByteArray().decodeToString()
-      val device = bluetoothAdapter.getRemoteDevice(address)
-      Log.i(TAG, "close: address=$address")
-
-      if (bluetoothA2dp.getConnectionState(device) != BluetoothA2dp.STATE_CONNECTED) {
-        Log.e(TAG, "Device is not connected, cannot close")
-        throw Status.UNKNOWN.asException()
-      }
-
-      val a2dpConnectionStateChangedFlow =
-        flow
-          .filter { it.getAction() == BluetoothA2dp.ACTION_CONNECTION_STATE_CHANGED }
-          .filter {
-            it.getParcelableExtra<BluetoothDevice>(BluetoothDevice.EXTRA_DEVICE).address == address
-          }
-          .map { it.getIntExtra(BluetoothA2dp.EXTRA_STATE, BluetoothAdapter.ERROR) }
-
-      bluetoothA2dp.disconnect(device)
-      a2dpConnectionStateChangedFlow.filter { it == BluetoothA2dp.STATE_DISCONNECTED }.first()
-
-      CloseResponse.getDefaultInstance()
-    }
-  }
-
-  override fun playbackAudio(
-    responseObserver: StreamObserver<PlaybackAudioResponse>
-  ): StreamObserver<PlaybackAudioRequest> {
-    Log.i(TAG, "playbackAudio")
-
-    if (audioTrack.getPlayState() != AudioTrack.PLAYSTATE_PLAYING) {
-      responseObserver.onError(Status.UNKNOWN.withDescription("AudioTrack is not started").asException())
-    }
-
-    // Volume is maxed out to avoid any amplitude modification of the provided audio data,
-    // enabling the test runner to do comparisons between input and output audio signal.
-    // Any volume modification should be done before providing the audio data.
-    if (audioManager.isVolumeFixed) {
-      Log.w(TAG, "Volume is fixed, cannot max out the volume")
-    } else {
-      val maxVolume = audioManager.getStreamMaxVolume(AudioManager.STREAM_MUSIC)
-      if (audioManager.getStreamVolume(AudioManager.STREAM_MUSIC) < maxVolume) {
-        audioManager.setStreamVolume(
-          AudioManager.STREAM_MUSIC,
-          maxVolume,
-          AudioManager.FLAG_SHOW_UI
-        )
-      }
-    }
-
-    return object : StreamObserver<PlaybackAudioRequest> {
-      override fun onNext(request: PlaybackAudioRequest) {
-        val data = request.data.toByteArray()
-        val written = audioTrack.write(data, 0, data.size)
-        if (written != data.size) {
-          responseObserver.onError(
-            Status.UNKNOWN.withDescription("AudioTrack write failed").asException()
-          )
-        }
-      }
-      override fun onError(t: Throwable?) {
-        Log.e(TAG, t.toString())
-        responseObserver.onError(t)
-      }
-      override fun onCompleted() {
-        responseObserver.onNext(PlaybackAudioResponse.getDefaultInstance())
-        responseObserver.onCompleted()
-      }
-    }
-  }
-
-  override fun getAudioEncoding(
-    request: GetAudioEncodingRequest,
-    responseObserver: StreamObserver<GetAudioEncodingResponse>
-  ) {
-    grpcUnary<GetAudioEncodingResponse>(scope, responseObserver) {
-      val address = request.source.cookie.toByteArray().decodeToString()
-      val device = bluetoothAdapter.getRemoteDevice(address)
-      Log.i(TAG, "getAudioEncoding: address=$address")
-
-      if (bluetoothA2dp.getConnectionState(device) != BluetoothA2dp.STATE_CONNECTED) {
-        Log.e(TAG, "Device is not connected, cannot getAudioEncoding")
-        throw Status.UNKNOWN.asException()
-      }
-
-      // For now, we only support 44100 kHz sampling rate.
-      GetAudioEncodingResponse.newBuilder()
-        .setEncoding(AudioEncoding.PCM_S16_LE_44K1_STEREO)
-        .build()
-    }
-  }
-
-  // TODO: Remove reflection and import framework bluetooth library when it will be available
-  // on AOSP.
-  fun BluetoothA2dp.connect(device: BluetoothDevice) =
-    this.javaClass.getMethod("connect", BluetoothDevice::class.java).invoke(this, device)
-
-  fun BluetoothA2dp.disconnect(device: BluetoothDevice) =
-    this.javaClass.getMethod("disconnect", BluetoothDevice::class.java).invoke(this, device)
-}
diff --git a/android/blueberry/server/src/com/android/blueberry/Host.kt b/android/blueberry/server/src/com/android/blueberry/Host.kt
deleted file mode 100644
index 433c752..0000000
--- a/android/blueberry/server/src/com/android/blueberry/Host.kt
+++ /dev/null
@@ -1,208 +0,0 @@
-/*
- * Copyright (C) 2022 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package com.android.blueberry
-
-import android.bluetooth.BluetoothAdapter
-import android.bluetooth.BluetoothDevice
-import android.bluetooth.BluetoothManager
-import android.content.Context
-import android.content.Intent
-import android.content.IntentFilter
-import android.net.MacAddress
-import android.util.Log
-import blueberry.HostGrpc.HostImplBase
-import blueberry.HostProto.*
-import com.google.protobuf.ByteString
-import com.google.protobuf.Empty
-import io.grpc.Status
-import io.grpc.stub.StreamObserver
-import kotlinx.coroutines.CoroutineScope
-import kotlinx.coroutines.Dispatchers
-import kotlinx.coroutines.cancel
-import kotlinx.coroutines.flow.Flow
-import kotlinx.coroutines.flow.SharingStarted
-import kotlinx.coroutines.flow.filter
-import kotlinx.coroutines.flow.first
-import kotlinx.coroutines.flow.map
-import kotlinx.coroutines.flow.shareIn
-import kotlinx.coroutines.launch
-
-@kotlinx.coroutines.ExperimentalCoroutinesApi
-class Host(private val context: Context, private val server: Server) : HostImplBase() {
-  private val TAG = "BlueberryHost"
-
-  private val scope: CoroutineScope
-  private val flow: Flow<Intent>
-
-  private val bluetoothManager =
-    context.getSystemService(Context.BLUETOOTH_SERVICE) as BluetoothManager
-  private val bluetoothAdapter = bluetoothManager.adapter
-
-  init {
-    scope = CoroutineScope(Dispatchers.Default)
-
-    // Add all intent actions to be listened.
-    val intentFilter = IntentFilter()
-    intentFilter.addAction(BluetoothAdapter.ACTION_STATE_CHANGED)
-    intentFilter.addAction(BluetoothDevice.ACTION_BOND_STATE_CHANGED)
-    intentFilter.addAction(BluetoothAdapter.ACTION_CONNECTION_STATE_CHANGED)
-    intentFilter.addAction(BluetoothDevice.ACTION_PAIRING_REQUEST)
-
-    // Creates a shared flow of intents that can be used in all methods in the coroutine scope.
-    // This flow is started eagerly to make sure that the broadcast receiver is registered before
-    // any function call. This flow is only cancelled when the corresponding scope is cancelled.
-    flow = intentFlow(context, intentFilter).shareIn(scope, SharingStarted.Eagerly)
-  }
-
-  fun deinit() {
-    scope.cancel()
-  }
-
-  override fun reset(request: Empty, responseObserver: StreamObserver<Empty>) {
-    grpcUnary<Empty>(scope, responseObserver) {
-      Log.i(TAG, "reset")
-
-      bluetoothAdapter.clearBluetooth()
-
-      val stateFlow =
-        flow.filter { it.getAction() == BluetoothAdapter.ACTION_STATE_CHANGED }.map {
-          it.getIntExtra(BluetoothAdapter.EXTRA_STATE, BluetoothAdapter.ERROR)
-        }
-
-      if (bluetoothAdapter.isEnabled) {
-        bluetoothAdapter.disable()
-        stateFlow.filter { it == BluetoothAdapter.STATE_OFF }.first()
-      }
-      bluetoothAdapter.enable()
-      stateFlow.filter { it == BluetoothAdapter.STATE_ON }.first()
-
-      // The last expression is the return value.
-      Empty.getDefaultInstance()
-    }
-      .invokeOnCompletion {
-        Log.i(TAG, "Shutdown the gRPC Server")
-        server.shutdownNow()
-      }
-  }
-
-  override fun readLocalAddress(
-    request: Empty,
-    responseObserver: StreamObserver<ReadLocalAddressResponse>
-  ) {
-    grpcUnary<ReadLocalAddressResponse>(scope, responseObserver) {
-      Log.i(TAG, "readLocalAddress")
-      val localMacAddress = MacAddress.fromString(bluetoothAdapter.getAddress())
-      ReadLocalAddressResponse.newBuilder()
-        .setAddress(ByteString.copyFrom(localMacAddress.toByteArray()))
-        .build()
-    }
-  }
-
-  override fun waitConnection(
-    request: WaitConnectionRequest,
-    responseObserver: StreamObserver<WaitConnectionResponse>
-  ) {
-    grpcUnary<WaitConnectionResponse>(scope, responseObserver) {
-      val address = MacAddress.fromBytes(request.address.toByteArray()).toString().uppercase()
-      Log.i(TAG, "waitConnection: address=$address")
-
-      if (!bluetoothAdapter.isEnabled) {
-        Log.e(TAG, "Bluetooth is not enabled, cannot waitConnection")
-        throw Status.UNKNOWN.asException()
-      }
-
-      // Start a new coroutine that will accept any pairing request from the device.
-      val acceptPairingJob =
-        scope.launch {
-          val pairingRequestIntent =
-            flow
-              .filter { it.getAction() == BluetoothDevice.ACTION_PAIRING_REQUEST }
-              .filter {
-                it.getParcelableExtra<BluetoothDevice>(BluetoothDevice.EXTRA_DEVICE).address ==
-                  address
-              }
-              .first()
-
-          val bluetoothDevice =
-            pairingRequestIntent.getParcelableExtra<BluetoothDevice>(BluetoothDevice.EXTRA_DEVICE)
-          val pairingVariant =
-            pairingRequestIntent.getIntExtra(
-              BluetoothDevice.EXTRA_PAIRING_VARIANT,
-              BluetoothDevice.ERROR
-            )
-
-          if (pairingVariant == BluetoothDevice.PAIRING_VARIANT_PASSKEY_CONFIRMATION ||
-              pairingVariant == BluetoothDevice.PAIRING_VARIANT_CONSENT ||
-              pairingVariant == BluetoothDevice.PAIRING_VARIANT_PIN
-          ) {
-            bluetoothDevice.setPairingConfirmation(true)
-          }
-        }
-
-      // We only wait for bonding to be completed since we only need the ACL connection to be
-      // established with the peer device (on Android state connected is sent when all profiles
-      // have been connected).
-      flow
-        .filter { it.getAction() == BluetoothDevice.ACTION_BOND_STATE_CHANGED }
-        .filter {
-          it.getParcelableExtra<BluetoothDevice>(BluetoothDevice.EXTRA_DEVICE).address == address
-        }
-        .map { it.getIntExtra(BluetoothDevice.EXTRA_BOND_STATE, BluetoothAdapter.ERROR) }
-        .filter { it == BluetoothDevice.BOND_BONDED }
-        .first()
-
-      // Cancel the accept pairing coroutine if still active.
-      if (acceptPairingJob.isActive) {
-        acceptPairingJob.cancel()
-      }
-
-      WaitConnectionResponse.newBuilder()
-        .setConnection(Connection.newBuilder().setCookie(ByteString.copyFromUtf8(address)).build())
-        .build()
-    }
-  }
-
-  override fun disconnect(
-    request: DisconnectRequest,
-    responseObserver: StreamObserver<DisconnectResponse>
-  ) {
-    grpcUnary<DisconnectResponse>(scope, responseObserver) {
-      val address = request.connection.cookie.toByteArray().decodeToString()
-      Log.i(TAG, "disconnect: address=$address")
-
-      val bluetoothDevice = bluetoothAdapter.getRemoteDevice(address)
-
-      if (!bluetoothDevice.isConnected()) {
-        Log.e(TAG, "Device is not connected, cannot disconnect")
-        throw Status.UNKNOWN.asException()
-      }
-
-      val connectionStateChangedFlow =
-        flow
-          .filter { it.getAction() == BluetoothAdapter.ACTION_CONNECTION_STATE_CHANGED }
-          .filter {
-            it.getParcelableExtra<BluetoothDevice>(BluetoothDevice.EXTRA_DEVICE).address == address
-          }
-          .map { it.getIntExtra(BluetoothAdapter.EXTRA_CONNECTION_STATE, BluetoothAdapter.ERROR) }
-
-      bluetoothDevice.disconnect()
-      connectionStateChangedFlow.filter { it == BluetoothAdapter.STATE_DISCONNECTED }.first()
-
-      DisconnectResponse.getDefaultInstance()
-    }
-  }
-}
diff --git a/android/blueberry/server/src/com/android/blueberry/Main.kt b/android/blueberry/server/src/com/android/blueberry/Main.kt
deleted file mode 100644
index 807182c..0000000
--- a/android/blueberry/server/src/com/android/blueberry/Main.kt
+++ /dev/null
@@ -1,54 +0,0 @@
-/*
- * Copyright (C) 2022 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package com.android.blueberry
-
-import android.content.Context
-import android.os.Bundle
-import android.os.Debug
-import android.util.Log
-import androidx.test.core.app.ApplicationProvider.getApplicationContext
-import androidx.test.runner.MonitoringInstrumentation
-
-@kotlinx.coroutines.ExperimentalCoroutinesApi
-class Main : MonitoringInstrumentation() {
-
-  private val TAG = "BlueberryMain"
-
-  override fun onCreate(arguments: Bundle) {
-    super.onCreate(arguments)
-
-    // Activate debugger.
-    if (arguments.getString("debug").toBoolean()) {
-      Log.i(TAG, "Waiting for debugger to connect...")
-      Debug.waitForDebugger()
-      Log.i(TAG, "Debugger connected")
-    }
-
-    // Start instrumentation thread.
-    start()
-  }
-
-  override fun onStart() {
-    super.onStart()
-
-    val context: Context = getApplicationContext()
-
-    while (true) {
-      Server(context).awaitTermination()
-    }
-  }
-}
diff --git a/android/blueberry/server/src/com/android/blueberry/Server.kt b/android/blueberry/server/src/com/android/blueberry/Server.kt
deleted file mode 100644
index f02a6f6..0000000
--- a/android/blueberry/server/src/com/android/blueberry/Server.kt
+++ /dev/null
@@ -1,51 +0,0 @@
-/*
- * Copyright (C) 2022 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package com.android.blueberry
-
-import android.content.Context
-import android.util.Log
-import io.grpc.Server as GrpcServer
-import io.grpc.netty.shaded.io.grpc.netty.NettyServerBuilder
-
-@kotlinx.coroutines.ExperimentalCoroutinesApi
-class Server(context: Context) {
-
-  private val TAG = "BlueberryServer"
-  private val GRPC_PORT = 8999
-
-  private var host: Host
-  private var a2dp: A2dp
-  private var grpcServer: GrpcServer
-
-  init {
-    host = Host(context, this)
-    a2dp = A2dp(context)
-    grpcServer = NettyServerBuilder.forPort(GRPC_PORT).addService(host).addService(a2dp).build()
-
-    Log.d(TAG, "Starting Blueberry Server")
-    grpcServer.start()
-    Log.d(TAG, "Blueberry Server started at $GRPC_PORT")
-  }
-
-  fun shutdownNow() {
-    host.deinit()
-    a2dp.deinit()
-    grpcServer.shutdownNow()
-  }
-
-  fun awaitTermination() = grpcServer.awaitTermination()
-}
diff --git a/android/blueberry/server/src/com/android/blueberry/Utils.kt b/android/blueberry/server/src/com/android/blueberry/Utils.kt
deleted file mode 100644
index a816008..0000000
--- a/android/blueberry/server/src/com/android/blueberry/Utils.kt
+++ /dev/null
@@ -1,129 +0,0 @@
-/*
- * Copyright (C) 2022 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package com.android.blueberry
-
-import android.bluetooth.BluetoothManager
-import android.bluetooth.BluetoothProfile
-import android.content.BroadcastReceiver
-import android.content.Context
-import android.content.Intent
-import android.content.IntentFilter
-import io.grpc.stub.StreamObserver
-import kotlinx.coroutines.CoroutineScope
-import kotlinx.coroutines.Job
-import kotlinx.coroutines.channels.awaitClose
-import kotlinx.coroutines.channels.trySendBlocking
-import kotlinx.coroutines.flow.callbackFlow
-import kotlinx.coroutines.flow.first
-import kotlinx.coroutines.launch
-import kotlinx.coroutines.runBlocking
-
-/**
- * Creates a cold flow of intents based on an intent filter. If used multiple times in a same class,
- * this flow should be transformed into a shared flow.
- *
- * @param context context on which to register the broadcast receiver.
- * @param intentFilter intent filter.
- * @return cold flow.
- */
-@kotlinx.coroutines.ExperimentalCoroutinesApi
-fun intentFlow(context: Context, intentFilter: IntentFilter) = callbackFlow {
-  val broadcastReceiver: BroadcastReceiver =
-    object : BroadcastReceiver() {
-      override fun onReceive(context: Context, intent: Intent) {
-        trySendBlocking(intent)
-      }
-    }
-  context.registerReceiver(broadcastReceiver, intentFilter)
-
-  awaitClose { context.unregisterReceiver(broadcastReceiver) }
-}
-
-/**
- * Creates a gRPC coroutine in a given coroutine scope which executes a given suspended function
- * returning a gRPC response and sends it on a given gRPC stream observer.
- *
- * @param T the type of gRPC response.
- * @param scope coroutine scope used to run the coroutine.
- * @param responseObserver the gRPC stream observer on which to send the response.
- * @param block the suspended function to execute to get the response.
- * @return reference to the coroutine as a Job.
- *
- * Example usage:
- * ```
- * override fun grpcMethod(
- *   request: TypeOfRequest,
- *   responseObserver: StreamObserver<TypeOfResponse> {
- *     grpcUnary(scope, responseObserver) {
- *       block
- *     }
- *   }
- * }
- * ```
- */
-@kotlinx.coroutines.ExperimentalCoroutinesApi
-fun <T> grpcUnary(
-  scope: CoroutineScope,
-  responseObserver: StreamObserver<T>,
-  block: suspend () -> T
-): Job {
-  return scope.launch {
-    try {
-      val response = block()
-      responseObserver.onNext(response)
-      responseObserver.onCompleted()
-    } catch (e: Throwable) {
-      e.printStackTrace()
-      responseObserver.onError(e)
-    }
-  }
-}
-
-/**
- * Synchronous method to get a Bluetooth profile proxy.
- *
- * @param T the type of profile proxy (e.g. BluetoothA2dp)
- * @param context context
- * @param bluetoothAdapter local Bluetooth adapter
- * @param profile identifier of the Bluetooth profile (e.g. BluetoothProfile#A2DP)
- * @return T the desired profile proxy
- */
-@Suppress("UNCHECKED_CAST")
-@kotlinx.coroutines.ExperimentalCoroutinesApi
-fun <T> getProfileProxy(context: Context, profile: Int): T {
-  var proxy: T
-  runBlocking {
-    val bluetoothManager = context.getSystemService(Context.BLUETOOTH_SERVICE) as BluetoothManager
-    val bluetoothAdapter = bluetoothManager.adapter
-
-    val flow = callbackFlow {
-      val serviceListener =
-        object : BluetoothProfile.ServiceListener {
-          override fun onServiceConnected(profile: Int, proxy: BluetoothProfile) {
-            trySendBlocking(proxy)
-          }
-          override fun onServiceDisconnected(profile: Int) {}
-        }
-
-      bluetoothAdapter.getProfileProxy(context, serviceListener, profile)
-
-      awaitClose {}
-    }
-    proxy = flow.first() as T
-  }
-  return proxy
-}
diff --git a/android/leaudio/app/src/main/java/com/android/bluetooth/leaudio/BluetoothProxy.java b/android/leaudio/app/src/main/java/com/android/bluetooth/leaudio/BluetoothProxy.java
index e4031a1..2cac893 100644
--- a/android/leaudio/app/src/main/java/com/android/bluetooth/leaudio/BluetoothProxy.java
+++ b/android/leaudio/app/src/main/java/com/android/bluetooth/leaudio/BluetoothProxy.java
@@ -416,10 +416,6 @@
                 LeAudioDeviceStateWrapper valid_device = valid_device_opt.get();
                 LeAudioDeviceStateWrapper.BassData svc_data = valid_device.bassData;
 
-                // TODO: Is the receiver_id same with BluetoothLeBroadcastReceiveState.getSourceId()?
-                //       If not, find getSourceId() usages and fix the issues.
-//                rstate.receiver_id = intent.getIntExtra(
-//                        BluetoothBroadcastAudioScan.EXTRA_BASS_RECEIVER_ID, -1);
                 /**
                  * From "Introducing-Bluetooth-LE-Audio-book" 8.6.3.1:
                  *
@@ -435,8 +431,6 @@
                  */
 
                 /**
-                 * From BluetoothBroadcastAudioScan.EXTRA_BASS_RECEIVER_ID:
-                 *
                  * Broadcast receiver's endpoint identifier.
                  */
                 synchronized(this) {
@@ -1219,6 +1213,15 @@
         return true;
     }
 
+    public boolean hapSetActivePresetForGroup(BluetoothDevice device, int preset_index) {
+        if (bluetoothHapClient == null)
+            return false;
+
+        int groupId = bluetoothLeAudio.getGroupId(device);
+        bluetoothHapClient.selectPresetForGroup(groupId, preset_index);
+        return true;
+    }
+
     public boolean hapChangePresetName(BluetoothDevice device, int preset_index, String name) {
         if (bluetoothHapClient == null)
             return false;
diff --git a/android/leaudio/app/src/main/java/com/android/bluetooth/leaudio/BroadcastScanActivity.java b/android/leaudio/app/src/main/java/com/android/bluetooth/leaudio/BroadcastScanActivity.java
index 368b791..2296d21 100644
--- a/android/leaudio/app/src/main/java/com/android/bluetooth/leaudio/BroadcastScanActivity.java
+++ b/android/leaudio/app/src/main/java/com/android/bluetooth/leaudio/BroadcastScanActivity.java
@@ -19,26 +19,29 @@
 
 import android.bluetooth.BluetoothAdapter;
 import android.bluetooth.BluetoothDevice;
+import android.bluetooth.BluetoothLeBroadcastChannel;
 import android.bluetooth.BluetoothLeBroadcastMetadata;
+import android.bluetooth.BluetoothLeBroadcastSubgroup;
 import android.content.Intent;
 import android.os.Bundle;
+import android.view.LayoutInflater;
+import android.view.View;
+import android.widget.EditText;
 import android.text.TextUtils;
+import android.view.LayoutInflater;
 import android.widget.Toast;
 
+import androidx.appcompat.app.AlertDialog;
 import androidx.appcompat.app.AppCompatActivity;
 import androidx.lifecycle.ViewModelProviders;
 import androidx.recyclerview.widget.LinearLayoutManager;
 import androidx.recyclerview.widget.RecyclerView;
 
 import java.util.Objects;
+import java.util.List;
 
 
 public class BroadcastScanActivity extends AppCompatActivity {
-    // Integer key used for sending/receiving receiver ID.
-    public static final String EXTRA_BASS_RECEIVER_ID = "receiver_id";
-
-    private static final int BIS_ALL = 0xFFFFFFFF;
-
     private BluetoothDevice device;
     private BroadcastScanViewModel mViewModel;
     private BroadcastItemsAdapter adapter;
@@ -72,9 +75,80 @@
 
             // Set broadcast source on peer only if scan delegator device context is available
             if (device != null) {
-                Toast.makeText(recyclerView.getContext(), "Adding broadcast source"
-                                + " broadcastId=" + broadcastId, Toast.LENGTH_SHORT).show();
-                mViewModel.addBroadcastSource(device, broadcast);
+                // Start Dialog with the broadcast input details
+                AlertDialog.Builder alert = new AlertDialog.Builder(this);
+                LayoutInflater inflater = getLayoutInflater();
+                alert.setTitle("Add the Broadcast:");
+
+                View alertView =
+                        inflater.inflate(R.layout.broadcast_scan_add_encrypted_source_dialog,
+                                         null);
+
+                final EditText channels_input_text =
+                        alertView.findViewById(R.id.broadcast_channel_map);
+
+                final EditText code_input_text =
+                        alertView.findViewById(R.id.broadcast_code_input);
+                BluetoothLeBroadcastMetadata.Builder builder = new
+                        BluetoothLeBroadcastMetadata.Builder(broadcast);
+
+                alert.setView(alertView).setNegativeButton("Cancel", (dialog, which) -> {
+                    // Do nothing
+                }).setPositiveButton("Add", (dialog, which) -> {
+                    BluetoothLeBroadcastMetadata metadata;
+                    if (code_input_text.getText() == null) {
+                        Toast.makeText(recyclerView.getContext(), "Invalid broadcast code",
+                                Toast.LENGTH_SHORT).show();
+                        return;
+                    }
+                    if (code_input_text.getText().length() == 0) {
+                        Toast.makeText(recyclerView.getContext(), "Adding not encrypted broadcast "
+                                       + "source broadcastId="
+                                       + broadcastId, Toast.LENGTH_SHORT).show();
+                        metadata = builder.setEncrypted(false).build();
+                    } else {
+                        if ((code_input_text.getText().length() > 16) ||
+                                (code_input_text.getText().length() < 4)) {
+                            Toast.makeText(recyclerView.getContext(),
+                                           "Invalid Broadcast code length",
+                                           Toast.LENGTH_SHORT).show();
+
+                            return;
+                        }
+
+                        metadata = builder.setBroadcastCode(
+                                        code_input_text.getText().toString().getBytes())
+                               .setEncrypted(true)
+                               .build();
+                    }
+
+                    if ((channels_input_text.getText() != null)
+                            && (channels_input_text.getText().length() != 0)) {
+                        int channelMap = Integer.parseInt(channels_input_text.getText().toString());
+                        // Apply a single channel map preference to all subgroups
+                        for (BluetoothLeBroadcastSubgroup subGroup : metadata.getSubgroups()) {
+                            List<BluetoothLeBroadcastChannel> channels = subGroup.getChannels();
+                            for (int i = 0; i < channels.size(); i++) {
+                                BluetoothLeBroadcastChannel channel = channels.get(i);
+                                // Set the channel preference value according to the map
+                                if (channel.getChannelIndex() != 0) {
+                                    if ((channelMap & (1 << (channel.getChannelIndex() - 1))) != 0) {
+                                        BluetoothLeBroadcastChannel.Builder bob
+                                                = new BluetoothLeBroadcastChannel.Builder(channel);
+                                        bob.setSelected(true);
+                                        channels.set(i, bob.build());
+                                    }
+                                }
+                            }
+                        }
+                    }
+
+                    Toast.makeText(recyclerView.getContext(), "Adding broadcast source"
+                                    + " broadcastId=" + broadcastId, Toast.LENGTH_SHORT).show();
+                    mViewModel.addBroadcastSource(device, metadata);
+                });
+
+                alert.show();
             }
         });
         recyclerView.setAdapter(adapter);
diff --git a/android/leaudio/app/src/main/java/com/android/bluetooth/leaudio/BroadcasterActivity.java b/android/leaudio/app/src/main/java/com/android/bluetooth/leaudio/BroadcasterActivity.java
index a3a2a61..3650137 100644
--- a/android/leaudio/app/src/main/java/com/android/bluetooth/leaudio/BroadcasterActivity.java
+++ b/android/leaudio/app/src/main/java/com/android/bluetooth/leaudio/BroadcasterActivity.java
@@ -40,6 +40,7 @@
 import com.android.bluetooth.leaudio.R;
 
 import java.io.ByteArrayOutputStream;
+import java.nio.charset.StandardCharsets;
 
 public class BroadcasterActivity extends AppCompatActivity {
     private BroadcasterViewModel mViewModel;
@@ -148,7 +149,8 @@
                 byte[] code = metadata.getBroadcastCode();
                 addr_text = metaLayout.findViewById(R.id.broadcast_code_text);
                 if (code != null) {
-                    addr_text.setText("Broadcast Code: " + metadata.getBroadcastCode().toString());
+                    addr_text.setText("Broadcast Code: "
+                            + new String(code, StandardCharsets.UTF_8));
                 } else {
                     addr_text.setVisibility(View.INVISIBLE);
                 }
diff --git a/android/leaudio/app/src/main/java/com/android/bluetooth/leaudio/LeAudioRecycleViewAdapter.java b/android/leaudio/app/src/main/java/com/android/bluetooth/leaudio/LeAudioRecycleViewAdapter.java
index 4a8b328..4be87ca 100644
--- a/android/leaudio/app/src/main/java/com/android/bluetooth/leaudio/LeAudioRecycleViewAdapter.java
+++ b/android/leaudio/app/src/main/java/com/android/bluetooth/leaudio/LeAudioRecycleViewAdapter.java
@@ -26,8 +26,6 @@
 import static android.bluetooth.BluetoothLeBroadcastReceiveState.PA_SYNC_STATE_SYNCHRONIZED;
 import static android.bluetooth.BluetoothLeBroadcastReceiveState.PA_SYNC_STATE_SYNCINFO_REQUEST;
 
-import static com.android.bluetooth.leaudio.BroadcastScanActivity.EXTRA_BASS_RECEIVER_ID;
-
 import android.animation.ObjectAnimator;
 import android.bluetooth.BluetoothDevice;
 import android.bluetooth.BluetoothHapClient;
@@ -890,6 +888,8 @@
 
         void onSetActivePresetClicked(BluetoothDevice device, int preset_index);
 
+        void onSetActivePresetForGroupClicked(BluetoothDevice device, int preset_index);
+
         void onNextDevicePresetClicked(BluetoothDevice device);
 
         void onPreviousDevicePresetClicked(BluetoothDevice device);
@@ -947,6 +947,7 @@
         private Spinner leAudioHapPresetsSpinner;
         private Button leAudioHapChangePresetNameButton;
         private Button leAudioHapSetActivePresetButton;
+        private Button leAudioHapSetActivePresetForGroupButton;
         private Button leAudioHapReadPresetInfoButton;
         private Button leAudioHapNextDevicePresetButton;
         private Button leAudioHapPreviousDevicePresetButton;
@@ -1041,6 +1042,8 @@
                     itemView.findViewById(R.id.hap_change_preset_name_button);
             leAudioHapSetActivePresetButton =
                     itemView.findViewById(R.id.hap_set_active_preset_button);
+            leAudioHapSetActivePresetForGroupButton =
+                    itemView.findViewById(R.id.hap_set_active_preset_for_group_button);
             leAudioHapReadPresetInfoButton =
                     itemView.findViewById(R.id.hap_read_preset_info_button);
             leAudioHapNextDevicePresetButton =
@@ -1110,6 +1113,21 @@
                 }
             });
 
+            leAudioHapSetActivePresetForGroupButton.setOnClickListener(view -> {
+                if (hapInteractionListener != null) {
+                    if (leAudioHapPresetsSpinner.getSelectedItem() == null) {
+                        Toast.makeText(view.getContext(), "No known preset, please reconnect.",
+                                Toast.LENGTH_SHORT).show();
+                        return;
+                    }
+
+                    Integer index = Integer.valueOf(
+                            leAudioHapPresetsSpinner.getSelectedItem().toString().split("\\s")[0]);
+                    hapInteractionListener.onSetActivePresetForGroupClicked(
+                            devices.get(ViewHolder.this.getAdapterPosition()).device, index);
+                }
+            });
+
             leAudioHapReadPresetInfoButton.setOnClickListener(view -> {
                 if (hapInteractionListener != null) {
                     if (leAudioHapPresetsSpinner.getSelectedItem() == null) {
@@ -1262,19 +1280,43 @@
             });
 
             leAudioSetLockButton.setOnClickListener(view -> {
-                final Integer group_id =
-                        Integer.parseInt(ViewHolder.this.leAudioGroupIdText.getText().toString());
-                if (leAudioInteractionListener != null)
-                    leAudioInteractionListener.onGroupSetLockClicked(
+                AlertDialog.Builder alert = new AlertDialog.Builder(itemView.getContext());
+                alert.setTitle("Pick a group ID");
+                final EditText input = new EditText(itemView.getContext());
+                input.setInputType(InputType.TYPE_CLASS_NUMBER);
+                input.setRawInputType(Configuration.KEYBOARD_12KEY);
+                alert.setView(input);
+                alert.setPositiveButton("Ok", (dialog, whichButton) -> {
+                    final Integer group_id = Integer.valueOf(input.getText().toString());
+                    if (leAudioInteractionListener != null)
+                        leAudioInteractionListener.onGroupSetLockClicked(
                             devices.get(ViewHolder.this.getAdapterPosition()), group_id, true);
+
+                });
+                alert.setNegativeButton("Cancel", (dialog, whichButton) -> {
+                    // Do nothing
+                });
+                alert.show();
             });
 
             leAudioSetUnlockButton.setOnClickListener(view -> {
-                final Integer group_id =
-                        Integer.parseInt(ViewHolder.this.leAudioGroupIdText.getText().toString());
-                if (leAudioInteractionListener != null)
-                    leAudioInteractionListener.onGroupSetLockClicked(
+                AlertDialog.Builder alert = new AlertDialog.Builder(itemView.getContext());
+                alert.setTitle("Pick a group ID");
+                final EditText input = new EditText(itemView.getContext());
+                input.setInputType(InputType.TYPE_CLASS_NUMBER);
+                input.setRawInputType(Configuration.KEYBOARD_12KEY);
+                alert.setView(input);
+                alert.setPositiveButton("Ok", (dialog, whichButton) -> {
+                    final Integer group_id = Integer.valueOf(input.getText().toString());
+                    if (leAudioInteractionListener != null)
+                        leAudioInteractionListener.onGroupSetLockClicked(
                             devices.get(ViewHolder.this.getAdapterPosition()), group_id, false);
+
+                });
+                alert.setNegativeButton("Cancel", (dialog, whichButton) -> {
+                    // Do nothing
+                });
+                alert.show();
             });
 
             leAudioGroupMicrophoneSwitch.setOnCheckedChangeListener((compoundButton, b) -> {
@@ -1766,27 +1808,27 @@
                     alert.setTitle("Scan and add a source or remove the currently set one.");
 
                     BluetoothDevice device = devices.get(ViewHolder.this.getAdapterPosition()).device;
-                    if (bassReceiverIdSpinner.getSelectedItem() == null) {
-                        Toast.makeText(view.getContext(), "Not available",
-                                Toast.LENGTH_SHORT).show();
-                        return;
+                    int receiver_id = -1;
+                    if (bassReceiverIdSpinner.getSelectedItem() != null) {
+                        receiver_id = Integer.parseInt(bassReceiverIdSpinner.getSelectedItem().toString());
                     }
-                    int receiver_id = Integer.parseInt(bassReceiverIdSpinner.getSelectedItem().toString());
 
                     alert.setPositiveButton("Scan", (dialog, whichButton) -> {
                         // Scan for new announcements
                         Intent intent = new Intent(this.itemView.getContext(), BroadcastScanActivity.class);
                         intent.addFlags(Intent.FLAG_ACTIVITY_REORDER_TO_FRONT);
-                        intent.putExtra(EXTRA_BASS_RECEIVER_ID, receiver_id);
                         intent.putExtra(BluetoothDevice.EXTRA_DEVICE, devices.get(ViewHolder.this.getAdapterPosition()).device);
                         parent.startActivityForResult(intent, 666);
                     });
                     alert.setNeutralButton("Cancel", (dialog, whichButton) -> {
                         // Do nothing
                     });
-                    alert.setNegativeButton("Remove", (dialog, whichButton) -> {
-                        bassInteractionListener.onRemoveSourceReq(device, receiver_id);
-                    });
+                    if (receiver_id != -1) {
+                        final int remove_receiver_id = receiver_id;
+                        alert.setNegativeButton("Remove", (dialog, whichButton) -> {
+                            bassInteractionListener.onRemoveSourceReq(device, remove_receiver_id);
+                        });
+                    }
                     alert.show();
 
                 } else if (bassReceiverStateText.getText().equals(res.getString(R.string.broadcast_state_code_required))) {
@@ -1843,16 +1885,9 @@
                     AlertDialog.Builder alert = new AlertDialog.Builder(itemView.getContext());
                     alert.setTitle("Retry broadcast audio announcement scan?");
 
-                    if (bassReceiverIdSpinner.getSelectedItem() == null) {
-                        Toast.makeText(view.getContext(), "Not available",
-                                Toast.LENGTH_SHORT).show();
-                        return;
-                    }
-                    int receiver_id = Integer.parseInt(bassReceiverIdSpinner.getSelectedItem().toString());
                     alert.setPositiveButton("Yes", (dialog, whichButton) -> {
                         // Scan for new announcements
                         Intent intent = new Intent(view.getContext(), BroadcastScanActivity.class);
-                        intent.putExtra(EXTRA_BASS_RECEIVER_ID, receiver_id);
                         intent.putExtra(BluetoothDevice.EXTRA_DEVICE, devices.get(ViewHolder.this.getAdapterPosition()).device);
                         parent.startActivityForResult(intent, 666);
                     });
diff --git a/android/leaudio/app/src/main/java/com/android/bluetooth/leaudio/LeAudioViewModel.java b/android/leaudio/app/src/main/java/com/android/bluetooth/leaudio/LeAudioViewModel.java
index a9ee880..188440e 100644
--- a/android/leaudio/app/src/main/java/com/android/bluetooth/leaudio/LeAudioViewModel.java
+++ b/android/leaudio/app/src/main/java/com/android/bluetooth/leaudio/LeAudioViewModel.java
@@ -81,6 +81,10 @@
         bluetoothProxy.hapSetActivePreset(device, preset_index);
     }
 
+    public void hapSetActivePresetForGroup(BluetoothDevice device, int preset_index) {
+        bluetoothProxy.hapSetActivePresetForGroup(device, preset_index);
+    }
+
     public void hapChangePresetName(BluetoothDevice device, int preset_index, String name) {
         bluetoothProxy.hapChangePresetName(device, preset_index, name);
     }
diff --git a/android/leaudio/app/src/main/java/com/android/bluetooth/leaudio/MainActivity.java b/android/leaudio/app/src/main/java/com/android/bluetooth/leaudio/MainActivity.java
index 8008700..176a4cf 100644
--- a/android/leaudio/app/src/main/java/com/android/bluetooth/leaudio/MainActivity.java
+++ b/android/leaudio/app/src/main/java/com/android/bluetooth/leaudio/MainActivity.java
@@ -522,6 +522,11 @@
                     }
 
                     @Override
+                    public void onSetActivePresetForGroupClicked(BluetoothDevice device, int preset_index) {
+                        leAudioViewModel.hapSetActivePresetForGroup(device, preset_index);
+                    }
+
+                    @Override
                     public void onChangePresetNameClicked(BluetoothDevice device, int preset_index,
                             String name) {
                         leAudioViewModel.hapChangePresetName(device, preset_index, name);
diff --git a/android/leaudio/app/src/main/res/layout/broadcast_scan_add_encrypted_source_dialog.xml b/android/leaudio/app/src/main/res/layout/broadcast_scan_add_encrypted_source_dialog.xml
new file mode 100644
index 0000000..d2e7459
--- /dev/null
+++ b/android/leaudio/app/src/main/res/layout/broadcast_scan_add_encrypted_source_dialog.xml
@@ -0,0 +1,53 @@
+<?xml version="1.0" encoding="utf-8"?>
+<LinearLayout xmlns:android="http://schemas.android.com/apk/res/android"
+    android:id="@+id/broadcast_scan_add_encrypted_source_dialog"
+    android:layout_width="match_parent"
+    android:layout_height="wrap_content"
+    android:orientation="vertical"
+    android:padding="8dp">
+
+    <LinearLayout
+        android:layout_width="match_parent"
+        android:layout_height="wrap_content"
+        android:orientation="horizontal">
+
+        <TextView
+            android:id="@+id/textView22"
+            android:layout_width="wrap_content"
+            android:layout_height="wrap_content"
+            android:layout_weight="1"
+            android:text="Broadcast code:" />
+
+        <EditText
+            android:id="@+id/broadcast_code_input"
+            android:layout_width="wrap_content"
+            android:layout_height="wrap_content"
+            android:layout_weight="1"
+            android:ems="10"
+            android:gravity="start|top"
+            android:maxLength="16"
+            android:inputType="textMultiLine|textFilter" />
+    </LinearLayout>
+
+    <LinearLayout
+        android:layout_width="match_parent"
+        android:layout_height="wrap_content"
+        android:orientation="horizontal">
+
+        <TextView
+            android:id="@+id/textViewChannelMap"
+            android:layout_width="wrap_content"
+            android:layout_height="wrap_content"
+            android:layout_weight="1"
+            android:text="Channel Map:" />
+        <EditText
+            android:id="@+id/broadcast_channel_map"
+            android:layout_width="wrap_content"
+            android:layout_height="wrap_content"
+            android:layout_weight="2"
+            android:digits="123456789"
+            android:inputType="number"
+            android:maxLength="3"/>
+    </LinearLayout>
+
+</LinearLayout>
diff --git a/android/leaudio/app/src/main/res/layout/hap_layout.xml b/android/leaudio/app/src/main/res/layout/hap_layout.xml
index 741e3c2..6680df1 100644
--- a/android/leaudio/app/src/main/res/layout/hap_layout.xml
+++ b/android/leaudio/app/src/main/res/layout/hap_layout.xml
@@ -159,7 +159,7 @@
             android:layout_width="wrap_content"
             android:layout_height="wrap_content"
             android:layout_weight="1"
-            android:text="Precious group preset" />
+            android:text="Previous group preset" />
 
         <Button
             android:id="@+id/hap_next_group_preset_button"
@@ -168,5 +168,12 @@
             android:layout_weight="1"
             android:text="Next group preset" />
 
+        <Button
+            android:id="@+id/hap_set_active_preset_for_group_button"
+            android:layout_width="wrap_content"
+            android:layout_height="wrap_content"
+            android:layout_weight="1"
+            android:text="Set group active" />
+
     </LinearLayout>
 </LinearLayout>
\ No newline at end of file
diff --git a/android/pandora/.gitignore b/android/pandora/.gitignore
new file mode 100644
index 0000000..cdb0870
--- /dev/null
+++ b/android/pandora/.gitignore
@@ -0,0 +1,3 @@
+trace*
+log*
+out*
diff --git a/android/blueberry/OWNERS b/android/pandora/OWNERS
similarity index 100%
rename from android/blueberry/OWNERS
rename to android/pandora/OWNERS
diff --git a/android/pandora/gen_cov.py b/android/pandora/gen_cov.py
new file mode 100755
index 0000000..f49dc46
--- /dev/null
+++ b/android/pandora/gen_cov.py
@@ -0,0 +1,396 @@
+#!/usr/bin/env python
+
+import argparse
+from datetime import datetime
+import os
+from pathlib import Path
+import shutil
+import subprocess
+import sys
+import xml.etree.ElementTree as ET
+
+JAVA_UNIT_TESTS = 'test/mts/tools/mts-tradefed/res/config/mts-bluetooth-tests-list-shard-01.xml'
+NATIVE_UNIT_TESTS = 'test/mts/tools/mts-tradefed/res/config/mts-bluetooth-tests-list-shard-02.xml'
+DO_NOT_RETRY_TESTS = {
+  'CtsBluetoothTestCases',
+  'GoogleBluetoothInstrumentationTests',
+}
+MAX_TRIES = 3
+
+
+def run_pts_bot(logs_out):
+  run_pts_bot_cmd = [
+      # atest command with verbose mode.
+      'atest',
+      '-d',
+      '-v',
+      'pts-bot',
+      # Coverage tool chains and specify that coverage should be flush to the
+      # disk between each tests.
+      '--',
+      '--coverage',
+      '--coverage-toolchain JACOCO',
+      '--coverage-toolchain CLANG',
+      '--coverage-flush',
+  ]
+  with open(f'{logs_out}/pts_bot.txt', 'w') as f:
+    subprocess.run(run_pts_bot_cmd, stdout=f, stderr=subprocess.STDOUT)
+
+
+def list_unit_tests():
+  android_build_top = os.getenv('ANDROID_BUILD_TOP')
+
+  unit_tests = []
+  java_unit_xml = ET.parse(f'{android_build_top}/{JAVA_UNIT_TESTS}')
+  for child in java_unit_xml.getroot():
+    value = child.attrib['value']
+    if 'enable:true' in value:
+      test = value.replace(':enable:true', '')
+      unit_tests.append(test)
+
+  native_unit_xml = ET.parse(f'{android_build_top}/{NATIVE_UNIT_TESTS}')
+  for child in native_unit_xml.getroot():
+    value = child.attrib['value']
+    if 'enable:true' in value:
+      test = value.replace(':enable:true', '')
+      unit_tests.append(test)
+
+  return unit_tests
+
+
+def run_unit_test(test, logs_out):
+  print(f'Test started: {test}')
+
+  # Env variables necessary for native unit tests.
+  env = os.environ.copy()
+  env['CLANG_COVERAGE_CONTINUOUS_MODE'] = 'true'
+  env['CLANG_COVERAGE'] = 'true'
+  env['NATIVE_COVERAGE_PATHS'] = 'packages/modules/Bluetooth'
+  run_test_cmd = [
+      # atest command with verbose mode.
+      'atest',
+      '-d',
+      '-v',
+      test,
+      # Coverage tool chains and specify that coverage should be flush to the
+      # disk between each tests.
+      '--',
+      '--coverage',
+      '--coverage-toolchain JACOCO',
+      '--coverage-toolchain CLANG',
+      '--coverage-flush',
+      # Allows tests to use hidden APIs.
+      '--test-arg ',
+      'com.android.compatibility.testtype.LibcoreTest:hidden-api-checks:false',
+      '--test-arg ',
+      'com.android.tradefed.testtype.AndroidJUnitTest:hidden-api-checks:false',
+      '--test-arg ',
+      'com.android.tradefed.testtype.InstrumentationTest:hidden-api-checks:false',
+      '--skip-system-status-check ',
+      'com.android.tradefed.suite.checker.ShellStatusChecker',
+  ]
+
+  try_count = 1
+  while (try_count == 1 or test not in DO_NOT_RETRY_TESTS) and try_count <= MAX_TRIES:
+    with open(f'{logs_out}/{test}_{try_count}.txt', 'w') as f:
+      if try_count > 1: print(f'Retrying {test}: count = {try_count}')
+      returncode = subprocess.run(
+          run_test_cmd, env=env, stdout=f, stderr=subprocess.STDOUT).returncode
+      if returncode == 0: break
+      try_count += 1
+
+  print(
+      f'Test ended [{"Success" if returncode == 0 else "Failed"}]: {test}')
+
+
+def pull_and_rename_trace_for_test(test, trace):
+  date = datetime.now().strftime("%Y%m%d")
+  temp_trace = Path('temp_trace')
+  subprocess.run(['adb', 'pull', '/data/misc/trace', temp_trace])
+  for child in temp_trace.iterdir():
+    child = child.rename(f'{child.parent}/{date}_{test}_{child.name}')
+    shutil.copy(child, trace)
+  shutil.rmtree(temp_trace, ignore_errors=True)
+
+
+def generate_java_coverage(bt_apex_name, trace_path, coverage_out):
+
+  out = os.getenv('OUT')
+  android_host_out = os.getenv('ANDROID_HOST_OUT')
+
+  java_coverage_out = Path(f'{coverage_out}/java')
+  temp_path = Path(f'{coverage_out}/temp')
+  if temp_path.exists():
+    shutil.rmtree(temp_path, ignore_errors=True)
+  temp_path.mkdir()
+
+  framework_jar_path = Path(
+      f'{out}/obj/PACKAGING/jacoco_intermediates/JAVA_LIBRARIES/framework-bluetooth.{bt_apex_name}_intermediates'
+  )
+  service_jar_path = Path(
+      f'{out}/obj/PACKAGING/jacoco_intermediates/JAVA_LIBRARIES/service-bluetooth.{bt_apex_name}_intermediates'
+  )
+  app_jar_path = Path(
+      f'{out}/obj/PACKAGING/jacoco_intermediates/ETC/Bluetooth{"Google" if "com.google" in bt_apex_name else ""}.{bt_apex_name}_intermediates'
+  )
+
+  # From google3/configs/wireless/android/testing/atp/prod/mainline-engprod/templates/modules/bluetooth.gcl.
+  framework_exclude_classes = [
+      # Exclude statically linked & jarjar'ed classes.
+      '**/com/android/bluetooth/x/**/*.class',
+      # Exclude AIDL generated interfaces.
+      '**/android/bluetooth/I*$Default.class',
+      '**/android/bluetooth/**/I*$Default.class',
+      '**/android/bluetooth/I*$Stub.class',
+      '**/android/bluetooth/**/I*$Stub.class',
+      '**/android/bluetooth/I*$Stub$Proxy.class',
+      '**/android/bluetooth/**/I*$Stub$Proxy.class',
+      # Exclude annotations.
+      '**/android/bluetooth/annotation/**/*.class',
+  ]
+  service_exclude_classes = [
+      # Exclude statically linked & jarjar'ed classes.
+      '**/android/support/**/*.class',
+      '**/androidx/**/*.class',
+      '**/com/android/bluetooth/x/**/*.class',
+      '**/com/android/internal/**/*.class',
+      '**/com/google/**/*.class',
+      '**/kotlin/**/*.class',
+      '**/kotlinx/**/*.class',
+      '**/org/**/*.class',
+  ]
+  app_exclude_classes = [
+      # Exclude statically linked & jarjar'ed classes.
+      '**/android/hardware/**/*.class',
+      '**/android/hidl/**/*.class',
+      '**/android/net/**/*.class',
+      '**/android/support/**/*.class',
+      '**/androidx/**/*.class',
+      '**/com/android/bluetooth/x/**/*.class',
+      '**/com/android/internal/**/*.class',
+      '**/com/android/obex/**/*.class',
+      '**/com/android/vcard/**/*.class',
+      '**/com/google/**/*.class',
+      '**/kotlin/**/*.class',
+      '**/kotlinx/**/*.class',
+      '**/javax/**/*.class',
+      '**/org/**/*.class',
+      # Exclude SIM Access Profile (SAP) which is being deprecated.
+      '**/com/android/bluetooth/sap/*.class',
+      # Added for local runs.
+      '**/com/android/bluetooth/**/BluetoothMetrics*.class',
+      '**/com/android/bluetooth/**/R*.class',
+  ]
+
+  # Merged ec files.
+  merged_ec_path = Path(f'{temp_path}/merged.ec')
+  subprocess.run((
+      f'java -jar {android_host_out}/framework/jacoco-cli.jar merge {trace_path.absolute()}/*.ec '
+      f'--destfile {merged_ec_path.absolute()}'),
+                 shell=True)
+
+  # Copy and extract jar files.
+  framework_temp_path = Path(f'{temp_path}/{framework_jar_path.name}')
+  service_temp_path = Path(f'{temp_path}/{service_jar_path.name}')
+  app_temp_path = Path(f'{temp_path}/{app_jar_path.name}')
+
+  shutil.copytree(framework_jar_path, framework_temp_path)
+  shutil.copytree(service_jar_path, service_temp_path)
+  shutil.copytree(app_jar_path, app_temp_path)
+
+  current_dir_path = Path.cwd()
+  for p in [framework_temp_path, service_temp_path, app_temp_path]:
+    os.chdir(p.absolute())
+    os.system('jar xf jacoco-report-classes.jar')
+    os.chdir(current_dir_path)
+
+  os.remove(f'{framework_temp_path}/jacoco-report-classes.jar')
+  os.remove(f'{service_temp_path}/jacoco-report-classes.jar')
+  os.remove(f'{app_temp_path}/jacoco-report-classes.jar')
+
+  # Generate coverage report.
+  exclude_classes = []
+  for glob in framework_exclude_classes:
+    exclude_classes.extend(list(framework_temp_path.glob(glob)))
+  for glob in service_exclude_classes:
+    exclude_classes.extend(list(service_temp_path.glob(glob)))
+  for glob in app_exclude_classes:
+    exclude_classes.extend(list(app_temp_path.glob(glob)))
+
+  for c in exclude_classes:
+    if c.exists():
+      os.remove(c.absolute())
+
+  gen_java_cov_report_cmd = [
+      f'java',
+      f'-jar',
+      f'{android_host_out}/framework/jacoco-cli.jar',
+      f'report',
+      f'{merged_ec_path.absolute()}',
+      f'--classfiles',
+      f'{temp_path.absolute()}',
+      f'--html',
+      f'{java_coverage_out.absolute()}',
+      f'--name',
+      f'{java_coverage_out.absolute()}.html',
+  ]
+  subprocess.run(gen_java_cov_report_cmd)
+
+  # Cleanup.
+  shutil.rmtree(temp_path, ignore_errors=True)
+
+
+def generate_native_coverage(bt_apex_name, trace_path, coverage_out):
+
+  out = os.getenv('OUT')
+  android_build_top = os.getenv('ANDROID_BUILD_TOP')
+
+  native_coverage_out = Path(f'{coverage_out}/native')
+  temp_path = Path(f'{coverage_out}/temp')
+  if temp_path.exists():
+    shutil.rmtree(temp_path, ignore_errors=True)
+  temp_path.mkdir()
+
+  # From google3/configs/wireless/android/testing/atp/prod/mainline-engprod/templates/modules/bluetooth.gcl.
+  exclude_files = {
+      'android/',
+      # Exclude AIDLs definition and generated interfaces.
+      'system/.*_aidl.*',
+      'system/binder/',
+      # Exclude tests.
+      'system/.*_test.*',
+      'system/.*_mock.*',
+      'system/.*_unittest.*',
+      'system/blueberry/',
+      'system/test/',
+      # Exclude config and doc.
+      'system/build/',
+      'system/conf/',
+      'system/doc/',
+      # Exclude (currently) unused GD code.
+      'system/gd/att/',
+      'system/gd/l2cap/',
+      'system/gd/neighbor/',
+      'system/gd/rust/',
+      'system/gd/security/',
+      # Exclude legacy AVRCP implementation (to be removed, current AVRCP
+      # implementation is in packages/modules/Bluetooth/system/profile/avrcp)
+      'system/stack/avrc/',
+      # Exclude audio HIDL since AIDL is used instead today (in
+      # packages/modules/Bluetooth/system/audio_hal_interface/aidl)
+      'system/audio_hal_interface/hidl/',
+  }
+
+  # Merge profdata files.
+  profdata_path = Path(f'{temp_path}/coverage.profdata')
+  subprocess.run(
+      f'llvm-profdata merge --sparse -o {profdata_path.absolute()} {trace_path.absolute()}/*.profraw',
+      shell=True)
+
+  gen_native_cov_report_cmd = [
+      f'llvm-cov',
+      f'show',
+      f'-format=html',
+      f'-output-dir={native_coverage_out.absolute()}',
+      f'-instr-profile={profdata_path.absolute()}',
+      f'{out}/symbols/apex/{bt_apex_name}/lib64/libbluetooth_jni.so',
+      f'-path-equivalence=/proc/self/cwd,{android_build_top}',
+      f'/proc/self/cwd/packages/modules/Bluetooth',
+  ]
+  for f in exclude_files:
+    gen_native_cov_report_cmd.append(f'-ignore-filename-regex={f}')
+  subprocess.run(gen_native_cov_report_cmd, cwd=android_build_top)
+
+  # Cleanup.
+  shutil.rmtree(temp_path, ignore_errors=True)
+
+
+if __name__ == '__main__':
+
+  parser = argparse.ArgumentParser()
+  parser.add_argument(
+      '--apex-name',
+      default='com.android.btservices',
+      help='bluetooth apex name. Default: com.android.btservices')
+  parser.add_argument(
+      '--java', action='store_true', help='generate Java coverage')
+  parser.add_argument(
+      '--native', action='store_true', help='generate native coverage')
+  parser.add_argument(
+      '--out',
+      type=str,
+      default='out_coverage',
+      help='out directory for coverage reports. Default: ./out_coverage')
+  parser.add_argument(
+      '--trace',
+      type=str,
+      default='trace',
+      help='trace directory with .ec and .profraw files. Default: ./trace')
+  parser.add_argument(
+      '--full-report',
+      action='store_true',
+      help='run all tests and compute coverage report')
+  args = parser.parse_args()
+
+  coverage_out = Path(args.out)
+  shutil.rmtree(coverage_out, ignore_errors=True)
+  coverage_out.mkdir()
+
+  if not args.full_report:
+    trace_path = Path(args.trace)
+    if (not trace_path.exists() or not trace_path.is_dir()):
+      sys.exit('Trace directory does not exist')
+
+    if (args.java):
+      generate_java_coverage(args.apex_name, trace_path, coverage_out)
+    if (args.native):
+      generate_native_coverage(args.apex_name, trace_path, coverage_out)
+
+  else:
+
+    # Output logs directory
+    logs_out = Path('logs_bt_tests')
+    logs_out.mkdir(exist_ok=True)
+
+    # Compute Pandora tests coverage
+    coverage_out_pandora = Path(f'{coverage_out}/pandora')
+    coverage_out_pandora.mkdir()
+    trace_pandora = Path('trace_pandora')
+    shutil.rmtree(trace_pandora, ignore_errors=True)
+    trace_pandora.mkdir()
+    subprocess.run(['adb', 'shell', 'rm', '/data/misc/trace/*'])
+    run_pts_bot(logs_out)
+    pull_and_rename_trace_for_test('pts_bot', trace_pandora)
+
+    generate_java_coverage(args.apex_name, trace_pandora, coverage_out_pandora)
+    generate_native_coverage(args.apex_name, trace_pandora, coverage_out_pandora)
+
+    # Compute unit tests coverage
+    coverage_out_unit = Path(f'{coverage_out}/unit')
+    coverage_out_unit.mkdir()
+    trace_unit = Path('trace_unit')
+    shutil.rmtree(trace_unit, ignore_errors=True)
+    trace_unit.mkdir()
+
+    unit_tests = list_unit_tests()
+    for test in unit_tests:
+      subprocess.run(['adb', 'shell', 'rm', '/data/misc/trace/*'])
+      run_unit_test(test, logs_out)
+      pull_and_rename_trace_for_test(test, trace_unit)
+
+    generate_java_coverage(args.apex_name, trace_unit, coverage_out_unit)
+    generate_native_coverage(args.apex_name, trace_unit, coverage_out_unit)
+
+    # Compute all tests coverage
+    coverage_out_mainline = Path(f'{coverage_out}/mainline')
+    coverage_out_mainline.mkdir()
+    trace_mainline = Path('trace_mainline')
+    shutil.rmtree(trace_mainline, ignore_errors=True)
+    trace_mainline.mkdir()
+    for child in trace_pandora.iterdir():
+      shutil.copy(child, trace_mainline)
+    for child in trace_unit.iterdir():
+      shutil.copy(child, trace_mainline)
+
+    generate_java_coverage(args.apex_name, trace_mainline, coverage_out_mainline)
+    generate_native_coverage(args.apex_name, trace_mainline, coverage_out_mainline)
diff --git a/android/pandora/mmi2grpc/.gitignore b/android/pandora/mmi2grpc/.gitignore
new file mode 100644
index 0000000..4652040
--- /dev/null
+++ b/android/pandora/mmi2grpc/.gitignore
@@ -0,0 +1,5 @@
+dist
+__pycache__
+pandora/*
+!pandora/__init__.py
+.eggs/
diff --git a/android/pandora/mmi2grpc/Android.bp b/android/pandora/mmi2grpc/Android.bp
new file mode 100644
index 0000000..90f08de
--- /dev/null
+++ b/android/pandora/mmi2grpc/Android.bp
@@ -0,0 +1,41 @@
+package {
+    default_applicable_licenses: [
+        "packages_modules_Bluetooth_android_pandora_mmi2grpc_license",
+    ],
+}
+
+// Added automatically by a large-scale-change
+// See: http://go/android-license-faq
+license {
+    name: "packages_modules_Bluetooth_android_pandora_mmi2grpc_license",
+    visibility: [":__subpackages__"],
+    license_kinds: [
+        "SPDX-license-identifier-Apache-2.0",
+    ],
+    license_text: [
+        "LICENSE",
+    ],
+}
+
+genrule {
+    name: "protoc-gen-mmi2grpc-python-src",
+    srcs: ["_build/protoc-gen-custom_grpc"],
+    cmd: "cp $(in) $(out)",
+    out: ["protoc-gen-custom_grpc.py"],
+}
+
+python_binary_host {
+    name: "protoc-gen-mmi2grpc-python",
+    main: "protoc-gen-custom_grpc.py",
+    srcs: [":protoc-gen-mmi2grpc-python-src"],
+    libs: ["libprotobuf-python"],
+}
+
+filegroup {
+    name: "mmi2grpc",
+    srcs: [
+        "mmi2grpc/*.py",
+        "pandora/*.py",
+        ":pandora_experimental-python-src",
+    ],
+}
diff --git a/android/pandora/mmi2grpc/CONTRIBUTING.md b/android/pandora/mmi2grpc/CONTRIBUTING.md
new file mode 100644
index 0000000..97c24f3
--- /dev/null
+++ b/android/pandora/mmi2grpc/CONTRIBUTING.md
@@ -0,0 +1,30 @@
+# How to Contribute
+
+We'd love to accept your patches and contributions to this project. There are
+just a few small guidelines you need to follow.
+
+## Contributor License Agreement
+
+Contributions to this project must be accompanied by a Contributor License
+Agreement. You (or your employer) retain the copyright to your contribution;
+this simply gives us permission to use and redistribute your contributions as
+part of the project. Head over to <https://cla.developers.google.com/> to see
+your current agreements on file or to sign a new one.
+
+You generally only need to submit a CLA once, so if you've already submitted one
+(even if it was for a different project), you probably don't need to do it
+again.
+
+## Style Guide
+
+Every contributions must follow [Google Python style guide](
+https://google.github.io/styleguide/pyguide.html).
+
+## Code Reviews
+
+All submissions, including submissions by project members, require review.
+
+## Community Guidelines
+
+This project follows [Google's Open Source Community
+Guidelines](https://opensource.google/conduct/).
diff --git a/android/pandora/mmi2grpc/LICENSE b/android/pandora/mmi2grpc/LICENSE
new file mode 100644
index 0000000..d645695
--- /dev/null
+++ b/android/pandora/mmi2grpc/LICENSE
@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
diff --git a/android/pandora/mmi2grpc/README.md b/android/pandora/mmi2grpc/README.md
new file mode 100644
index 0000000..e9233cc
--- /dev/null
+++ b/android/pandora/mmi2grpc/README.md
@@ -0,0 +1,17 @@
+# mmi2grpc
+
+## Install
+
+```bash
+git submodule update --init
+
+pip install -e . # With editable mode
+# Or
+pip install . # Without editable mode
+```
+
+## Rebuild gRPC interfaces
+
+```bash
+./_build/grpc.py
+```
diff --git a/system/hci/test/hci_layer_test.cc b/android/pandora/mmi2grpc/__init__.py
similarity index 100%
rename from system/hci/test/hci_layer_test.cc
rename to android/pandora/mmi2grpc/__init__.py
diff --git a/system/hci/test/hci_layer_test.cc b/android/pandora/mmi2grpc/_build/__init__.py
similarity index 100%
copy from system/hci/test/hci_layer_test.cc
copy to android/pandora/mmi2grpc/_build/__init__.py
diff --git a/android/pandora/mmi2grpc/_build/backend.py b/android/pandora/mmi2grpc/_build/backend.py
new file mode 100644
index 0000000..f25546b
--- /dev/null
+++ b/android/pandora/mmi2grpc/_build/backend.py
@@ -0,0 +1,47 @@
+# Copyright 2022 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""PEP517 build backend."""
+
+from .grpc import build as build_pandora_grpc
+
+from flit_core.wheel import WheelBuilder
+# Use all build hooks from flit
+from flit_core.buildapi import *
+
+
+# Build grpc interfaces when this build backend is invoked
+build_pandora_grpc()
+
+# flit only supports copying one module, but we need to copy two of them
+# because protobuf forces the use of absolute imports.
+# So Monkey patches WheelBuilder#copy_module to copy pandora folder too.
+# To avoid breaking this, the version of flit_core is pinned in pyproject.toml.
+old_copy_module = WheelBuilder.copy_module
+
+
+def copy_module(self):
+    from flit_core.common import Module
+
+    old_copy_module(self)
+
+    module = self.module
+
+    self.module = Module('pandora', self.directory)
+    old_copy_module(self)
+
+    self.module = module
+
+
+WheelBuilder.copy_module = copy_module
diff --git a/android/pandora/mmi2grpc/_build/grpc.py b/android/pandora/mmi2grpc/_build/grpc.py
new file mode 100755
index 0000000..ae020a2
--- /dev/null
+++ b/android/pandora/mmi2grpc/_build/grpc.py
@@ -0,0 +1,44 @@
+#!/usr/bin/env python3
+
+# Copyright 2022 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""Build gRPC pandora interfaces."""
+
+import os
+import pkg_resources
+from grpc_tools import protoc
+
+package_directory = os.path.dirname(os.path.realpath(__file__))
+
+
+def build():
+
+    os.environ['PATH'] = package_directory + ':' + os.environ['PATH']
+
+    proto_include = pkg_resources.resource_filename('grpc_tools', '_proto')
+
+    files = [
+        f'pandora/{f}' for f in os.listdir('proto/pandora') if f.endswith('.proto')]
+    protoc.main([
+        'grpc_tools.protoc',
+        '-Iproto',
+        f'-I{proto_include}',
+        '--python_out=.',
+        '--custom_grpc_out=.',
+    ] + files)
+
+
+if __name__ == '__main__':
+    build()
diff --git a/android/pandora/mmi2grpc/_build/protoc-gen-custom_grpc b/android/pandora/mmi2grpc/_build/protoc-gen-custom_grpc
new file mode 100755
index 0000000..bf09ea5
--- /dev/null
+++ b/android/pandora/mmi2grpc/_build/protoc-gen-custom_grpc
@@ -0,0 +1,194 @@
+#!/usr/bin/env python3
+
+# Copyright 2022 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""Custom mmi2grpc gRPC compiler."""
+
+import sys
+
+from google.protobuf.compiler.plugin_pb2 import CodeGeneratorRequest, \
+    CodeGeneratorResponse
+
+
+def eprint(*args, **kwargs):
+    print(*args, file=sys.stderr, **kwargs)
+
+
+request = CodeGeneratorRequest.FromString(sys.stdin.buffer.read())
+
+
+def has_type(proto_file, type_name):
+    return any(filter(lambda x: x.name == type_name, proto_file.message_type))
+
+
+def import_type(imports, type):
+    package = type[1:type.rindex('.')]
+    type_name = type[type.rindex('.')+1:]
+    file = next(filter(
+        lambda x: x.package == package and has_type(x, type_name),
+        request.proto_file))
+    python_path = file.name.replace('.proto', '').replace('/', '.')
+    as_name = python_path.replace('.', '_dot_') + '__pb2'
+    module_path = python_path[:python_path.rindex('.')]
+    module_name = python_path[python_path.rindex('.')+1:] + '_pb2'
+    imports.add(f'from {module_path} import {module_name} as {as_name}')
+    return f'{as_name}.{type_name}'
+
+
+def generate_method(imports, file, service, method):
+    input_mode = 'stream' if method.client_streaming else 'unary'
+    output_mode = 'stream' if method.server_streaming else 'unary'
+
+    input_type = import_type(imports, method.input_type)
+    output_type = import_type(imports, method.output_type)
+
+    if input_mode == 'stream':
+        if output_mode == 'stream':
+            return (
+                f'def {method.name}(self):\n'
+                f'    from mmi2grpc._streaming import StreamWrapper\n'
+                f'    return StreamWrapper(\n'
+                f'        self.channel.{input_mode}_{output_mode}(\n'
+                f"            '/{file.package}.{service.name}/{method.name}',\n"
+                f'            request_serializer={input_type}.SerializeToString,\n'
+                f'            response_deserializer={output_type}.FromString\n'
+                f'        ),\n'
+                f'        {input_type})'
+            ).split('\n')
+        else:
+            return (
+                f'def {method.name}(self, iterator, **kwargs):\n'
+                f'    return self.channel.{input_mode}_{output_mode}(\n'
+                f"        '/{file.package}.{service.name}/{method.name}',\n"
+                f'        request_serializer={input_type}.SerializeToString,\n'
+                f'        response_deserializer={output_type}.FromString\n'
+                f'    )(iterator, **kwargs)'
+            ).split('\n')
+    else:
+        return (
+            f'def {method.name}(self, wait_for_ready=None, **kwargs):\n'
+            f'    return self.channel.{input_mode}_{output_mode}(\n'
+            f"        '/{file.package}.{service.name}/{method.name}',\n"
+            f'        request_serializer={input_type}.SerializeToString,\n'
+            f'        response_deserializer={output_type}.FromString\n'
+            f'    )({input_type}(**kwargs), wait_for_ready=wait_for_ready)'
+        ).split('\n')
+
+
+def generate_service(imports, file, service):
+    methods = '\n\n    '.join([
+        '\n    '.join(
+            generate_method(imports, file, service, method)
+        ) for method in service.method
+    ])
+    return (
+        f'class {service.name}:\n'
+        f'    def __init__(self, channel):\n'
+        f'        self.channel = channel\n'
+        f'\n'
+        f'    {methods}\n'
+    ).split('\n')
+
+def generate_servicer_method(method):
+    input_mode = 'stream' if method.client_streaming else 'unary'
+
+    if input_mode == 'stream':
+        return (
+            f'def {method.name}(self, request_iterator, context):\n'
+            f'    context.set_code(grpc.StatusCode.UNIMPLEMENTED)\n'
+            f'    context.set_details("Method not implemented!")\n'
+            f'    raise NotImplementedError("Method not implemented!")'
+        ).split('\n')
+    else:
+        return (
+            f'def {method.name}(self, request, context):\n'
+            f'    context.set_code(grpc.StatusCode.UNIMPLEMENTED)\n'
+            f'    context.set_details("Method not implemented!")\n'
+            f'    raise NotImplementedError("Method not implemented!")'
+        ).split('\n')
+
+
+def generate_servicer(service):
+    methods = '\n\n    '.join([
+        '\n    '.join(
+            generate_servicer_method(method)
+        ) for method in service.method
+    ])
+    if len(methods) == 0:
+        methods = 'pass'
+    return (
+        f'class {service.name}Servicer:\n'
+        f'\n'
+        f'    {methods}\n'
+    ).split('\n')
+
+def generate_rpc_method_handler(imports, method):
+    input_mode = 'stream' if method.client_streaming else 'unary'
+    output_mode = 'stream' if method.server_streaming else 'unary'
+
+    input_type = import_type(imports, method.input_type)
+    output_type = import_type(imports, method.output_type)
+
+    return (
+        f"'{method.name}': grpc.{input_mode}_{output_mode}_rpc_method_handler(\n"
+        f'        servicer.{method.name},\n'
+        f'        request_deserializer={input_type}.FromString,\n'
+        f'        response_serializer={output_type}.SerializeToString,\n'
+        f'    ),\n'
+    ).split('\n')
+
+def generate_add_servicer_to_server_method(imports, file, service):
+    method_handlers = '    '.join([
+        '\n    '.join(
+            generate_rpc_method_handler(imports, method)
+        ) for method in service.method
+    ])
+    return (
+        f'def add_{service.name}Servicer_to_server(servicer, server):\n'
+        f'    rpc_method_handlers = {{\n'
+        f'        {method_handlers}\n'
+        f'    }}\n'
+        f'    generic_handler = grpc.method_handlers_generic_handler(\n'
+        f"        '{file.package}.{service.name}', rpc_method_handlers)\n"
+        f'    server.add_generic_rpc_handlers((generic_handler,))'
+    ).split('\n')
+
+files = []
+
+for file_name in request.file_to_generate:
+    file = next(filter(lambda x: x.name == file_name, request.proto_file))
+
+    imports = set(['import grpc'])
+
+    services = '\n'.join(sum([
+        generate_service(imports, file, service) for service in file.service
+    ], []))
+
+    servicers = '\n'.join(sum([
+        generate_servicer(service) for service in file.service
+    ], []))
+
+    add_servicer_methods = '\n'.join(sum([
+        generate_add_servicer_to_server_method(imports, file, service) for service in file.service
+    ], []))
+
+    files.append(CodeGeneratorResponse.File(
+        name=file_name.replace('.proto', '_grpc.py'),
+        content='\n'.join(imports) + '\n\n' + services  + '\n\n' + servicers + '\n\n' + add_servicer_methods + '\n'
+    ))
+
+reponse = CodeGeneratorResponse(file=files)
+
+sys.stdout.buffer.write(reponse.SerializeToString())
diff --git a/android/pandora/mmi2grpc/mmi2grpc/__init__.py b/android/pandora/mmi2grpc/mmi2grpc/__init__.py
new file mode 100644
index 0000000..9723523
--- /dev/null
+++ b/android/pandora/mmi2grpc/mmi2grpc/__init__.py
@@ -0,0 +1,272 @@
+# Copyright 2022 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Map Bluetooth PTS Man Machine Interface to Pandora gRPC calls."""
+
+__version__ = "0.0.1"
+
+from threading import Thread
+from typing import List
+import time
+import sys
+
+import grpc
+
+from mmi2grpc.a2dp import A2DPProxy
+from mmi2grpc.avrcp import AVRCPProxy
+from mmi2grpc.gatt import GATTProxy
+from mmi2grpc.gap import GAPProxy
+from mmi2grpc.hfp import HFPProxy
+from mmi2grpc.hid import HIDProxy
+from mmi2grpc.hogp import HOGPProxy
+from mmi2grpc.l2cap import L2CAPProxy
+from mmi2grpc.map import MAPProxy
+from mmi2grpc.opp import OPPProxy
+from mmi2grpc.pbap import PBAPProxy
+from mmi2grpc.rfcomm import RFCOMMProxy
+from mmi2grpc.sdp import SDPProxy
+from mmi2grpc.sm import SMProxy
+from mmi2grpc._helpers import format_proxy
+from mmi2grpc._rootcanal import RootCanal
+from mmi2grpc._modem import Modem
+
+from pandora_experimental.host_grpc import Host
+
+PANDORA_SERVER_PORT = 8999
+ROOTCANAL_CONTROL_PORT = 6212
+MODEM_SIMULATOR_PORT = 4242
+MAX_RETRIES = 10
+GRPC_SERVER_INIT_TIMEOUT = 10  # seconds
+
+
+class IUT:
+    """IUT class.
+
+    Handles MMI calls from the PTS and routes them to corresponding profile
+    proxy which translates MMI calls to gRPC calls to the IUT.
+    """
+
+    def __init__(self, test: str, args: List[str], **kwargs):
+        """Init IUT class for a given test.
+
+        Args:
+            test: PTS test id.
+            args: test arguments.
+        """
+        self.pandora_server_port = int(args[0]) if len(args) > 0 else PANDORA_SERVER_PORT
+        self.rootcanal_control_port = int(args[1]) if len(args) > 1 else ROOTCANAL_CONTROL_PORT
+        self.modem_simulator_port = int(args[2]) if len(args) > 2 else MODEM_SIMULATOR_PORT
+
+        self.test = test
+        self.rootcanal = None
+        self.modem = None
+
+        # Profile proxies.
+        self._a2dp = None
+        self._avrcp = None
+        self._gatt = None
+        self._gap = None
+        self._hfp = None
+        self._hid = None
+        self._hogp = None
+        self._l2cap = None
+        self._map = None
+        self._opp = None
+        self._pbap = None
+        self._rfcomm = None
+        self._sdp = None
+        self._sm = None
+
+    def __enter__(self):
+        """Resets the IUT when starting a PTS test."""
+        self.rootcanal = RootCanal(port=self.rootcanal_control_port)
+        self.rootcanal.reconnect_phone()
+
+        self.modem = Modem(port=self.modem_simulator_port)
+
+        # Note: we don't keep a single gRPC channel instance in the IUT class
+        # because reset is allowed to close the gRPC server.
+        with grpc.insecure_channel(f'localhost:{self.pandora_server_port}') as channel:
+            self._retry(Host(channel).FactoryReset)(wait_for_ready=True)
+
+    def __exit__(self, exc_type, exc_value, exc_traceback):
+        self.rootcanal.close()
+        self.rootcanal = None
+
+        self.modem.close()
+        self.modem = None
+
+        self._a2dp = None
+        self._avrcp = None
+        self._gatt = None
+        self._gap = None
+        self._hfp = None
+        self._l2cap = None
+        self._hid = None
+        self._hogp = None
+        self._map = None
+        self._opp = None
+        self._pbap = None
+        self._rfcomm = None
+        self._sdp = None
+        self._sm = None
+
+    def _retry(self, func):
+
+        def wrapper(*args, **kwargs):
+            tries = 0
+            while True:
+                try:
+                    return func(*args, **kwargs)
+                except grpc.RpcError or grpc._channel._InactiveRpcError:
+                    tries += 1
+                    if tries >= MAX_RETRIES:
+                        raise
+                    else:
+                        print(f"Retry {func.__name__}: {tries}/{MAX_RETRIES}")
+                        time.sleep(1)
+
+        return wrapper
+
+    @property
+    def address(self) -> bytes:
+        """Bluetooth MAC address of the IUT.
+
+        Raises a timeout exception after GRPC_SERVER_INIT_TIMEOUT seconds.
+        """
+        mut_address = None
+
+        def read_local_address():
+            with grpc.insecure_channel(f"localhost:{self.pandora_server_port}") as channel:
+                nonlocal mut_address
+                mut_address = self._retry(Host(channel).ReadLocalAddress)(wait_for_ready=True).address
+
+        thread = Thread(target=read_local_address)
+        thread.start()
+        thread.join(timeout=GRPC_SERVER_INIT_TIMEOUT)
+
+        if not mut_address:
+            raise Exception("Pandora gRPC server timeout")
+        else:
+            return mut_address
+
+    def interact(
+        self,
+        pts_address: bytes,
+        profile: str,
+        test: str,
+        interaction: str,
+        description: str,
+        style: str,
+        **kwargs,
+    ) -> str:
+        """Routes MMI calls to corresponding profile proxy.
+
+        Args:
+            pts_address: Bluetooth MAC address of the PTS in bytes.
+            profile: Bluetooth profile.
+            test: PTS test id.
+            interaction: MMI name.
+            description: MMI description.
+            style: MMI popup style, unused for now.
+        """
+        print(f"{profile} mmi: {interaction}", file=sys.stderr)
+
+        # Handles A2DP and AVDTP MMIs.
+        if profile in ("A2DP", "AVDTP"):
+            if not self._a2dp:
+                self._a2dp = A2DPProxy(grpc.insecure_channel(f"localhost:{self.pandora_server_port}"))
+            return self._a2dp.interact(test, interaction, description, pts_address)
+        # Handles AVRCP and AVCTP MMIs.
+        if profile in ("AVRCP", "AVCTP"):
+            if not self._avrcp:
+                self._avrcp = AVRCPProxy(grpc.insecure_channel(f"localhost:{self.pandora_server_port}"))
+            return self._avrcp.interact(test, interaction, description, pts_address)
+        # Handles GATT MMIs.
+        if profile in ("GATT"):
+            if not self._gatt:
+                self._gatt = GATTProxy(grpc.insecure_channel(f"localhost:{self.pandora_server_port}"))
+            return self._gatt.interact(test, interaction, description, pts_address)
+        # Handles GAP MMIs.
+        if profile in ("GAP"):
+            if not self._gap:
+                self._gap = GAPProxy(grpc.insecure_channel(f"localhost:{self.pandora_server_port}"))
+            return self._gap.interact(test, interaction, description, pts_address)
+        # Handles HFP MMIs.
+        if profile in ("HFP"):
+            if not self._hfp:
+                self._hfp = HFPProxy(
+                    test,
+                    grpc.insecure_channel(f"localhost:{self.pandora_server_port}"),
+                    self.rootcanal,
+                    self.modem,
+                )
+            return self._hfp.interact(test, interaction, description, pts_address)
+        # Handles HID MMIs.
+        if profile in ("HID"):
+            if not self._hid:
+                self._hid = HIDProxy(
+                    grpc.insecure_channel(f"localhost:{self.pandora_server_port}"),
+                    self.rootcanal,
+                )
+            return self._hid.interact(test, interaction, description, pts_address)
+        # Handles HOGP MMIs.
+        if profile in ("HOGP"):
+            if not self._hogp:
+                self._hogp = HOGPProxy(grpc.insecure_channel(f"localhost:{self.pandora_server_port}"))
+            return self._hogp.interact(test, interaction, description, pts_address)
+        # Instantiates L2CAP proxy and reroutes corresponding MMIs to it.
+        if profile in ("L2CAP"):
+            if not self._l2cap:
+                self._l2cap = L2CAPProxy(grpc.insecure_channel(f"localhost:{self.pandora_server_port}"))
+            return self._l2cap.interact(test, interaction, description, pts_address)
+        # Handles MAP MMIs.
+        if profile in ("MAP"):
+            if not self._map:
+                self._map = MAPProxy(grpc.insecure_channel(f"localhost:{self.pandora_server_port}"))
+            return self._map.interact(test, interaction, description, pts_address)
+        # Handles OPP MMIs.
+        if profile in ("OPP"):
+            if not self._opp:
+                self._opp = OPPProxy(grpc.insecure_channel(f"localhost:{self.pandora_server_port}"))
+            return self._opp.interact(test, interaction, description, pts_address)
+        # Instantiates PBAP proxy and reroutes corresponding MMIs to it.
+        if profile in ("PBAP"):
+            if not self._pbap:
+                self._pbap = PBAPProxy(grpc.insecure_channel(f"localhost:{self.pandora_server_port}"))
+            return self._pbap.interact(test, interaction, description, pts_address)
+        # Handles RFCOMM MMIs.
+        if profile in ("RFCOMM"):
+            if not self._rfcomm:
+                self._rfcomm = RFCOMMProxy(grpc.insecure_channel(f"localhost:{self.pandora_server_port}"))
+            return self._rfcomm.interact(test, interaction, description, pts_address)
+        # Handles SDP MMIs.
+        if profile in ("SDP"):
+            if not self._sdp:
+                self._sdp = SDPProxy(grpc.insecure_channel(f"localhost:{self.pandora_server_port}"))
+            return self._sdp.interact(test, interaction, description, pts_address)
+        # Handles SM MMIs.
+        if profile in ("SM"):
+            if not self._sm:
+                self._sm = SMProxy(grpc.insecure_channel(f"localhost:{self.pandora_server_port}"))
+            return self._sm.interact(test, interaction, description, pts_address)
+
+        # Handles unsupported profiles.
+        code = format_proxy(profile, interaction, description)
+        error_msg = (f"Missing {profile} proxy and mmi: {interaction}\n"
+                     f"Create a {profile.lower()}.py in mmi2grpc/:\n\n{code}\n"
+                     f"Then, instantiate the corresponding proxy in __init__.py\n"
+                     f"Finally, create a {profile.lower()}.proto in proto/pandora/"
+                     f"and generate the corresponding interface.")
+
+        assert False, error_msg
\ No newline at end of file
diff --git a/android/pandora/mmi2grpc/mmi2grpc/_audio.py b/android/pandora/mmi2grpc/mmi2grpc/_audio.py
new file mode 100644
index 0000000..0e2764c
--- /dev/null
+++ b/android/pandora/mmi2grpc/mmi2grpc/_audio.py
@@ -0,0 +1,107 @@
+# Copyright 2022 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""Audio tools."""
+
+import itertools
+import math
+import os
+from threading import Thread
+
+# import numpy as np
+# from scipy.io import wavfile
+
+SINE_FREQUENCY = 440
+SINE_DURATION = 0.1
+
+# File which stores the audio signal output data (after transport).
+# Used for running comparisons with the generated audio signal.
+OUTPUT_WAV_FILE = '/tmp/audiodata'
+
+WAV_RIFF_SIZE_OFFSET = 4
+WAV_DATA_SIZE_OFFSET = 40
+
+
+def _fixup_wav_header(path):
+    with open(path, 'r+b') as f:
+        f.seek(0, os.SEEK_END)
+        file_size = f.tell()
+        for offset in [WAV_RIFF_SIZE_OFFSET, WAV_DATA_SIZE_OFFSET]:
+            size = file_size - offset - 4
+            f.seek(offset)
+            f.write(size.to_bytes(4, byteorder='little'))
+
+
+class AudioSignal:
+    """Audio signal generator and verifier."""
+
+    def __init__(self, transport, amplitude, fs):
+        """Init AudioSignal class.
+
+        Args:
+            transport: function to send the generated audio data to.
+            amplitude: amplitude of the signal to generate.
+            fs: sampling rate of the signal to generate.
+        """
+        self.transport = transport
+        self.amplitude = amplitude
+        self.fs = fs
+        self.thread = None
+
+    def start(self):
+        """Generates the audio signal and send it to the transport."""
+        self.thread = Thread(target=self._run)
+        self.thread.start()
+
+    def _run(self):
+        sine = self._generate_sine(SINE_FREQUENCY, SINE_DURATION)
+
+        # Interleaved audio.
+        stereo = np.zeros(sine.size * 2, dtype=sine.dtype)
+        stereo[0::2] = sine
+
+        # Send 4 second of audio.
+        audio = itertools.repeat(stereo.tobytes(), int(4 / SINE_DURATION))
+
+        self.transport(audio)
+
+    def _generate_sine(self, f, duration):
+        sine = self.amplitude * \
+            np.sin(2 * np.pi * np.arange(self.fs * duration) * (f / self.fs))
+        s16le = (sine * 32767).astype('<i2')
+        return s16le
+
+    def verify(self):
+        """Verifies that the audio signal is correctly output."""
+        assert self.thread is not None
+        self.thread.join()
+        self.thread = None
+
+        _fixup_wav_header(OUTPUT_WAV_FILE)
+
+        samplerate, data = wavfile.read(OUTPUT_WAV_FILE)
+        # Take one second of audio after the first second.
+        audio = data[samplerate:samplerate*2, 0].astype(np.float) / 32767
+        assert len(audio) == samplerate
+
+        spectrum = np.abs(np.fft.fft(audio))
+        frequency = np.fft.fftfreq(samplerate, d=1/samplerate)
+        amplitudes = spectrum / (samplerate/2)
+        index = np.where(frequency == SINE_FREQUENCY)
+        amplitude = amplitudes[index][0]
+
+        match_amplitude = math.isclose(
+            amplitude, self.amplitude, rel_tol=1e-03)
+
+        return match_amplitude
diff --git a/android/pandora/mmi2grpc/mmi2grpc/_helpers.py b/android/pandora/mmi2grpc/mmi2grpc/_helpers.py
new file mode 100644
index 0000000..3eb80bc
--- /dev/null
+++ b/android/pandora/mmi2grpc/mmi2grpc/_helpers.py
@@ -0,0 +1,121 @@
+# Copyright 2022 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Helper functions.
+
+Facilitates the implementation of a new profile proxy or a PTS MMI.
+"""
+
+import functools
+import textwrap
+import unittest
+import re
+
+DOCSTRING_WIDTH = 80 - 8  # 80 cols - 8 indentation spaces
+
+
+def assert_description(f):
+    """Decorator which verifies the description of a PTS MMI implementation.
+
+    Asserts that the docstring of a function implementing a PTS MMI is the same
+    as the corresponding official MMI description.
+
+    Args:
+        f: function implementing a PTS MMI.
+
+    Raises:
+        AssertionError: the docstring of the function does not match the MMI
+            description.
+    """
+
+    @functools.wraps(f)
+    def wrapper(*args, **kwargs):
+        description = textwrap.fill(kwargs['description'], DOCSTRING_WIDTH, replace_whitespace=False)
+        docstring = textwrap.dedent(f.__doc__ or '')
+
+        if docstring.strip() != description.strip():
+            print(f'Expected description of {f.__name__}:')
+            print(description)
+
+            # Generate AssertionError.
+            test = unittest.TestCase()
+            test.maxDiff = None
+            test.assertMultiLineEqual(docstring.strip(), description.strip(),
+                                      f'description does not match with function docstring of'
+                                      f'{f.__name__}')
+
+        return f(*args, **kwargs)
+
+    return wrapper
+
+
+def match_description(f):
+    """Extracts parameters from PTS MMI descriptions.
+
+    Similar to assert_description, but treats the description as an (indented)
+    regex that can be used to extract named capture groups from the PTS command.
+
+    Args:
+        f: function implementing a PTS MMI.
+
+    Raises:
+        AssertionError: the docstring of the function does not match the MMI
+            description.
+    """
+
+    def normalize(desc):
+        return desc.replace("\n", " ").replace("\t", "    ").strip()
+
+    docstring = normalize(textwrap.dedent(f.__doc__))
+    regex = re.compile(docstring)
+
+    @functools.wraps(f)
+    def wrapper(*args, **kwargs):
+        description = normalize(kwargs['description'])
+        match = regex.fullmatch(description)
+
+        assert match is not None, f'description does not match with function docstring of {f.__name__}:\n{repr(description)}\n!=\n{repr(docstring)}'
+
+        return f(*args, **kwargs, **match.groupdict())
+
+    return wrapper
+
+
+def format_function(mmi_name, mmi_description):
+    """Returns the base format of a function implementing a PTS MMI."""
+    wrapped_description = textwrap.fill(mmi_description, DOCSTRING_WIDTH, replace_whitespace=False)
+    return (f'@assert_description\n'
+            f'def {mmi_name}(self, **kwargs):\n'
+            f'    """\n'
+            f'{textwrap.indent(wrapped_description, "    ")}\n'
+            f'    """\n'
+            f'\n'
+            f'    return "OK"\n')
+
+
+def format_proxy(profile, mmi_name, mmi_description):
+    """Returns the base format of a profile proxy including a given MMI."""
+    wrapped_function = textwrap.indent(format_function(mmi_name, mmi_description), '    ')
+    return (f'from mmi2grpc._helpers import assert_description\n'
+            f'from mmi2grpc._proxy import ProfileProxy\n'
+            f'\n'
+            f'from pandora_experimental.{profile.lower()}_grpc import {profile}\n'
+            f'\n'
+            f'\n'
+            f'class {profile}Proxy(ProfileProxy):\n'
+            f'\n'
+            f'    def __init__(self, channel):\n'
+            f'        super().__init__(channel)\n'
+            f'        self.{profile.lower()} = {profile}(channel)\n'
+            f'\n'
+            f'{wrapped_function}')
diff --git a/android/pandora/mmi2grpc/mmi2grpc/_modem.py b/android/pandora/mmi2grpc/mmi2grpc/_modem.py
new file mode 100644
index 0000000..f0b7c4b
--- /dev/null
+++ b/android/pandora/mmi2grpc/mmi2grpc/_modem.py
@@ -0,0 +1,24 @@
+import os
+import socket
+
+
+class Modem:
+
+    def __init__(self, port):
+        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+        s.connect(("127.0.0.1", port))
+        self.active_calls = []
+        self.socket = s
+
+    def close(self):
+        for phone_number in self.active_calls:
+            self.socket.sendall(b'REM0\r\nAT+REMOTECALL=6,0,0,"' + str(phone_number).encode("utf-8") + b'",0\r\n')
+        self.socket.close()
+
+    def call(self, phone_number):
+        self.active_calls.append(phone_number)
+        self.socket.sendall(b'REM0\r\nAT+REMOTECALL=4,0,0,"' + str(phone_number).encode("utf-8") + b'",129\r\n')
+
+    def answer_outgoing_call(self, phone_number):
+        self.active_calls.append(phone_number)
+        self.socket.sendall(b'REM0\r\nAT+REMOTECALL=0,0,0,"' + str(phone_number).encode("utf-8") + b'",129\r\n')
diff --git a/android/pandora/mmi2grpc/mmi2grpc/_proxy.py b/android/pandora/mmi2grpc/mmi2grpc/_proxy.py
new file mode 100644
index 0000000..c849cd2
--- /dev/null
+++ b/android/pandora/mmi2grpc/mmi2grpc/_proxy.py
@@ -0,0 +1,55 @@
+# Copyright 2022 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Profile proxy base module."""
+
+from mmi2grpc._helpers import format_function
+from mmi2grpc._helpers import assert_description
+
+from pandora_experimental._android_grpc import Android
+
+
+class ProfileProxy:
+    """Profile proxy base class."""
+
+    def __init__(self, channel) -> None:
+        self._android = Android(channel)
+
+    def interact(self, test: str, mmi_name: str, mmi_description: str, pts_addr: bytes):
+        """Translate a MMI call to its corresponding implementation.
+
+        Args:
+            test: PTS test id.
+            mmi_name: MMI name.
+            mmi_description: MMI description.
+            pts_addr: Bluetooth MAC address of the PTS in bytes.
+
+        Raises:
+            AttributeError: the MMI is not implemented.
+        """
+        try:
+            if not mmi_name.isidentifier():
+                mmi_name = "_mmi_" + mmi_name
+            self.log(f"starting MMI {mmi_name}")
+            out = getattr(self, mmi_name)(test=test, description=mmi_description, pts_addr=pts_addr)
+            self.log(f"finishing MMI {mmi_name}")
+            return out
+        except AttributeError:
+            code = format_function(mmi_name, mmi_description)
+            assert False, f'Unhandled mmi {mmi_name}\n{code}'
+
+    def log(self, text=""):
+        self._android.Log(text=text)
+
+    def test_started(self, test: str, description: str, pts_addr: bytes):
+        return "OK"
diff --git a/android/pandora/mmi2grpc/mmi2grpc/_rootcanal.py b/android/pandora/mmi2grpc/mmi2grpc/_rootcanal.py
new file mode 100644
index 0000000..c7e6b9a
--- /dev/null
+++ b/android/pandora/mmi2grpc/mmi2grpc/_rootcanal.py
@@ -0,0 +1,171 @@
+"""
+Copied from tools/rootcanal/scripts/test_channel.py
+"""
+
+import socket
+from time import sleep
+
+
+class Connection:
+
+    def __init__(self, port):
+        self._socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+        self._socket.connect(("localhost", port))
+
+    def close(self):
+        self._socket.close()
+
+    def send(self, data):
+        self._socket.sendall(data.encode())
+
+    def receive(self, size):
+        return self._socket.recv(size)
+
+
+class TestChannel:
+
+    def __init__(self, port):
+        self._connection = Connection(port)
+        self._closed = False
+
+    def close(self):
+        self._connection.close()
+        self._closed = True
+
+    def send_command(self, name, args):
+        args = [str(arg) for arg in args]
+        name_size = len(name)
+        args_size = len(args)
+        self.lint_command(name, args, name_size, args_size)
+        encoded_name = chr(name_size) + name
+        encoded_args = chr(args_size) + "".join(chr(len(arg)) + arg for arg in args)
+        command = encoded_name + encoded_args
+        if self._closed:
+            return
+        self._connection.send(command)
+        if name != "CLOSE_TEST_CHANNEL":
+            return self.receive_response().decode()
+
+    def receive_response(self):
+        if self._closed:
+            return b"Closed"
+        size_chars = self._connection.receive(4)
+        if not size_chars:
+            return b"No response, assuming that the connection is broken"
+        response_size = 0
+        for i in range(0, len(size_chars) - 1):
+            response_size |= size_chars[i] << (8 * i)
+        response = self._connection.receive(response_size)
+        return response
+
+    def lint_command(self, name, args, name_size, args_size):
+        assert name_size == len(name) and args_size == len(args)
+        try:
+            name.encode()
+            for arg in args:
+                arg.encode()
+        except UnicodeError:
+            print("Unrecognized characters.")
+            raise
+        if name_size > 255 or args_size > 255:
+            raise ValueError  # Size must be encodable in one octet.
+        for arg in args:
+            if len(arg) > 255:
+                raise ValueError  # Size must be encodable in one octet.
+
+
+class RootCanal:
+
+    def __init__(self, port):
+        self.channel = TestChannel(port)
+        self.disconnected_dev_phys = None
+
+        # discard initialization messages
+        self.channel.receive_response()
+
+    def close(self):
+        self.channel.close()
+
+    @staticmethod
+    def _parse_device_list(raw):
+        # time for some cursed parsing!
+        categories = {}
+        curr_category = None
+        for line in raw.split("\n"):
+            line = line.strip()
+            if not line:
+                continue
+            if line[0].isdigit():
+                # list entry
+                if curr_category is None or ":" not in line:
+                    raise Exception("Failed to parse rootcanal device list output")
+                curr_category.append(line.split(":", 1)[1])
+            else:
+                if line.endswith(":"):
+                    line = line[:-1]
+                curr_category = []
+                categories[line] = curr_category
+        return categories
+
+    @staticmethod
+    def _parse_phy(raw):
+        transport, idxs = raw.split(":")
+        idxs = [int(x) for x in idxs.split(",") if x.strip()]
+        return transport, idxs
+
+    def reconnect_phone(self):
+        raw_devices = None
+        try:
+            raw_devices = self.channel.send_command("list", [])
+            devices = self._parse_device_list(raw_devices)
+
+            for dev_i, name in enumerate(devices["Devices"]):
+                # the default transports are always 0 and 1
+                classic_phy = 0
+                le_phy = 1
+                if "beacon" in name:
+                    target_phys = [le_phy]
+                elif "hci_device" in name:
+                    target_phys = [classic_phy, le_phy]
+                else:
+                    target_phys = []
+
+                for phy in target_phys:
+                    if dev_i not in self._parse_phy(devices["Phys"][phy])[1]:
+                        self.channel.send_command("add_device_to_phy", [dev_i, phy])
+        except Exception as e:
+            print(raw_devices, e)
+
+    def disconnect_phy(self):
+        # first, list all devices
+        devices = self.channel.send_command("list", [])
+        devices = self._parse_device_list(devices)
+        dev_phys = []
+
+        for phy_i, phy in enumerate(devices["Phys"]):
+            _, idxs = self._parse_phy(phy)
+
+            for dev_i in idxs:
+                dev_phys.append((dev_i, phy_i))
+
+        # now, disconnect all pairs
+        for dev_i, phy_i in dev_phys:
+            self.channel.send_command("del_device_from_phy", [dev_i, phy_i])
+
+        devices = self.channel.send_command("list", [])
+        devices = self._parse_device_list(devices)
+
+        self.disconnected_dev_phys = dev_phys
+
+    def reconnect_phy_if_needed(self):
+        if self.disconnected_dev_phys is not None:
+            for dev_i, phy_i in self.disconnected_dev_phys:
+                self.channel.send_command("add_device_to_phy", [dev_i, phy_i])
+
+            self.disconnected_dev_phys = None
+
+    def reconnect_phy(self):
+        if self.disconnected_dev_phys is None:
+            raise Exception("cannot reconnect_phy before disconnect_phy")
+
+        self.reconnect_phy_if_needed()
diff --git a/android/pandora/mmi2grpc/mmi2grpc/_streaming.py b/android/pandora/mmi2grpc/mmi2grpc/_streaming.py
new file mode 100644
index 0000000..7dfacd4
--- /dev/null
+++ b/android/pandora/mmi2grpc/mmi2grpc/_streaming.py
@@ -0,0 +1,46 @@
+import queue
+
+
+class IterableQueue:
+    CLOSE = object()
+
+    def __init__(self):
+        self.queue = queue.Queue()
+
+    def __iter__(self):
+        return iter(self.queue.get, self.CLOSE)
+
+    def put(self, value):
+        self.queue.put(value)
+
+    def close(self):
+        self.put(self.CLOSE)
+
+
+class StreamWrapper:
+
+    def __init__(self, stream, ctor):
+        self.tx_queue = IterableQueue()
+        self.ctor = ctor
+
+        # tx_queue is consumed on a separate thread, so
+        # we don't block here
+        self.rx_iter = stream(iter(self.tx_queue))
+
+    def send(self, **kwargs):
+        self.tx_queue.put(self.ctor(**kwargs))
+
+    def __iter__(self):
+        for value in self.rx_iter:
+            yield value
+        self.tx_queue.close()
+
+    def recv(self):
+        try:
+            return next(self.rx_iter)
+        except StopIteration:
+            self.tx_queue.close()
+            return
+
+    def close(self):
+        self.tx_queue.close()
diff --git a/android/pandora/mmi2grpc/mmi2grpc/a2dp.py b/android/pandora/mmi2grpc/mmi2grpc/a2dp.py
new file mode 100644
index 0000000..c728d80
--- /dev/null
+++ b/android/pandora/mmi2grpc/mmi2grpc/a2dp.py
@@ -0,0 +1,588 @@
+# Copyright 2022 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""A2DP proxy module."""
+
+import time
+from typing import Optional
+
+from grpc import RpcError
+
+from mmi2grpc._audio import AudioSignal
+from mmi2grpc._helpers import assert_description
+from mmi2grpc._proxy import ProfileProxy
+from pandora_experimental.a2dp_grpc import A2DP
+from pandora_experimental.a2dp_pb2 import Sink, Source, PlaybackAudioRequest
+from pandora_experimental.host_grpc import Host
+from pandora_experimental.host_pb2 import Connection
+
+AUDIO_SIGNAL_AMPLITUDE = 0.8
+AUDIO_SIGNAL_SAMPLING_RATE = 44100
+
+
+class A2DPProxy(ProfileProxy):
+    """A2DP proxy.
+
+    Implements A2DP and AVDTP PTS MMIs.
+    """
+
+    connection: Optional[Connection] = None
+    sink: Optional[Sink] = None
+    source: Optional[Source] = None
+
+    def __init__(self, channel):
+        super().__init__(channel)
+
+        self.host = Host(channel)
+        self.a2dp = A2DP(channel)
+
+        def convert_frame(data):
+            return PlaybackAudioRequest(data=data, source=self.source)
+
+        self.audio = AudioSignal(lambda frames: self.a2dp.PlaybackAudio(map(convert_frame, frames)),
+                                 AUDIO_SIGNAL_AMPLITUDE, AUDIO_SIGNAL_SAMPLING_RATE)
+
+    @assert_description
+    def TSC_AVDTP_mmi_iut_accept_connect(self, test: str, pts_addr: bytes, **kwargs):
+        """
+        If necessary, take action to accept the AVDTP Signaling Channel
+        Connection initiated by the tester.
+
+        Description: Make sure the IUT
+        (Implementation Under Test) is in a state to accept incoming Bluetooth
+        connections.  Some devices may need to be on a specific screen, like a
+        Bluetooth settings screen, in order to pair with PTS.  If the IUT is
+        still having problems pairing with PTS, try running a test case where
+        the IUT connects to PTS to establish pairing.
+        """
+
+        if "SRC" in test:
+            self.connection = self.host.WaitConnection(address=pts_addr).connection
+            try:
+                if "INT" in test:
+                    self.source = self.a2dp.OpenSource(connection=self.connection).source
+                else:
+                    self.source = self.a2dp.WaitSource(connection=self.connection).source
+            except RpcError:
+                pass
+        else:
+            self.connection = self.host.WaitConnection(address=pts_addr).connection
+            try:
+                self.sink = self.a2dp.WaitSink(connection=self.connection).sink
+            except RpcError:
+                pass
+        return "OK"
+
+    @assert_description
+    def TSC_AVDTP_mmi_iut_accept_disconnect(self, **kwargs):
+        """
+        If necessary, take action to accept the AVDTP Signaling Channnel
+        Disconnection initiated by the tester.
+
+        Note: If an AVCTP signaling
+        channel was established it will also be disconnected.
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_AVDTP_mmi_iut_initiate_discover(self, **kwargs):
+        """
+        Send a discover command to PTS.
+
+        Action: If the IUT (Implementation
+        Under Test) is already connected to PTS, attempting to send or receive
+        streaming media should trigger this action.  If the IUT is not connected
+        to PTS, attempting to connect may trigger this action.
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_AVDTP_mmi_iut_initiate_start(self, test: str, **kwargs):
+        """
+        Send a start command to PTS.
+
+        Action: If the IUT (Implementation Under
+        Test) is already connected to PTS, attempting to send or receive
+        streaming media should trigger this action.  If the IUT is not connected
+        to PTS, attempting to connect may trigger this action.
+        """
+
+        if "SRC" in test:
+            self.a2dp.Start(source=self.source)
+        else:
+            self.a2dp.Start(sink=self.sink)
+        return "OK"
+
+    @assert_description
+    def TSC_AVDTP_mmi_iut_initiate_suspend(self, test: str, **kwargs):
+        """
+        Suspend the streaming channel.
+        """
+
+        if "SRC" in test:
+            self.a2dp.Suspend(source=self.source)
+        else:
+            assert False
+        return "OK"
+
+    @assert_description
+    def TSC_AVDTP_mmi_iut_initiate_close_stream(self, test: str, **kwargs):
+        """
+        Close the streaming channel.
+
+        Action: Disconnect the streaming channel,
+        or close the Bluetooth connection to the PTS.
+        """
+
+        if "SRC" in test:
+            self.a2dp.Close(source=self.source)
+            self.source = None
+        else:
+            self.a2dp.Close(sink=self.sink)
+            self.sink = None
+        return "OK"
+
+    @assert_description
+    def TSC_AVDTP_mmi_iut_initiate_out_of_range(self, pts_addr: bytes, **kwargs):
+        """
+        Move the IUT out of range to create a link loss scenario.
+
+        Action: This
+        can be also be done by placing the IUT or PTS in an RF shielded box.
+         """
+
+        if self.connection is None:
+            self.connection = self.host.GetConnection(address=pts_addr).connection
+        self.host.Disconnect(connection=self.connection)
+        self.connection = None
+        self.sink = None
+        self.source = None
+        return "OK"
+
+    @assert_description
+    def TSC_AVDTP_mmi_iut_begin_streaming(self, test: str, **kwargs):
+        """
+        Begin streaming media ...
+
+        Note: If the IUT has suspended the stream
+        please restart the stream to begin streaming media.
+        """
+
+        if test == "AVDTP/SRC/ACP/SIG/SMG/BI-29-C":
+            time.sleep(2)  # TODO: Remove, AVRCP SegFault
+        if test in ("A2DP/SRC/CC/BV-09-I", "A2DP/SRC/SET/BV-04-I", "AVDTP/SRC/ACP/SIG/SMG/BV-18-C",
+                    "AVDTP/SRC/ACP/SIG/SMG/BV-20-C", "AVDTP/SRC/ACP/SIG/SMG/BV-22-C"):
+            time.sleep(1)  # TODO: Remove, AVRCP SegFault
+        if test == "A2DP/SRC/SUS/BV-01-I":
+            # Stream is not suspended when we receive the interaction
+            time.sleep(1)
+
+        self.a2dp.Start(source=self.source)
+        self.audio.start()
+        return "OK"
+
+    @assert_description
+    def TSC_AVDTP_mmi_iut_initiate_media(self, **kwargs):
+        """
+        Take action if necessary to start streaming media to the tester.
+        """
+
+        self.audio.start()
+        return "OK"
+
+    @assert_description
+    def TSC_AVDTP_mmi_iut_initiate_stream_media(self, **kwargs):
+        """
+        Stream media to PTS.  If the IUT is a SNK, wait for PTS to start
+        streaming media.
+
+        Action: If the IUT (Implementation Under Test) is
+        already connected to PTS, attempting to send or receive streaming media
+        should trigger this action.  If the IUT is not connected to PTS,
+        attempting to connect may trigger this action.
+        """
+
+        self.audio.start()
+        return "OK"
+
+    @assert_description
+    def TSC_AVDTP_mmi_user_verify_media_playback(self, **kwargs):
+        """
+        Is the test system properly playing back the media being sent by the
+        IUT?
+        """
+
+        result = self.audio.verify()
+        assert result
+
+        return "Yes" if result else "No"
+
+    @assert_description
+    def TSC_AVDTP_mmi_iut_initiate_get_capabilities(self, **kwargs):
+        """
+        Send a get capabilities command to PTS.
+
+        Action: If the IUT
+        (Implementation Under Test) is already connected to PTS, attempting to
+        send or receive streaming media should trigger this action.  If the IUT
+        is not connected to PTS, attempting to connect may trigger this action.
+        """
+
+        # This will be done as part as the a2dp.OpenSource or a2dp.WaitSource
+        return "OK"
+
+    @assert_description
+    def TSC_AVDTP_mmi_iut_accept_discover(self, **kwargs):
+        """
+        If necessary, take action to accept the AVDTP Discover operation
+        initiated by the tester.
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_AVDTP_mmi_iut_initiate_set_configuration(self, **kwargs):
+        """
+        Send a set configuration command to PTS.
+
+        Action: If the IUT
+        (Implementation Under Test) is already connected to PTS, attempting to
+        send or receive streaming media should trigger this action.  If the IUT
+        is not connected to PTS, attempting to connect may trigger this action.
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_AVDTP_mmi_iut_accept_close_stream(self, **kwargs):
+        """
+        If necessary, take action to accept the AVDTP Close operation initiated
+        by the tester.
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_AVDTP_mmi_iut_accept_abort(self, **kwargs):
+        """
+        If necessary, take action to accept the AVDTP Abort operation initiated
+        by the tester..
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_AVDTP_mmi_iut_accept_get_all_capabilities(self, **kwargs):
+        """
+        If necessary, take action to accept the AVDTP Get All Capabilities
+        operation initiated by the tester.
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_AVDTP_mmi_iut_accept_get_capabilities(self, **kwargs):
+        """
+        If necessary, take action to accept the AVDTP Get Capabilities operation
+        initiated by the tester.
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_AVDTP_mmi_iut_accept_set_configuration(self, **kwargs):
+        """
+        If necessary, take action to accept the AVDTP Set Configuration
+        operation initiated by the tester.
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_AVDTP_mmi_iut_accept_get_configuration(self, **kwargs):
+        """
+        Take action to accept the AVDTP Get Configuration command from the
+        tester.
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_AVDTP_mmi_iut_accept_open_stream(self, **kwargs):
+        """
+        If necessary, take action to accept the AVDTP Open operation initiated
+        by the tester.
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_AVDTP_mmi_iut_accept_start(self, **kwargs):
+        """
+        If necessary, take action to accept the AVDTP Start operation initiated
+        by the tester.
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_AVDTP_mmi_iut_accept_suspend(self, **kwargs):
+        """
+        If necessary, take action to accept the AVDTP Suspend operation
+        initiated by the tester.
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_AVDTP_mmi_iut_accept_reconfigure(self, **kwargs):
+        """
+        If necessary, take action to accept the AVDTP Reconfigure operation
+        initiated by the tester.
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_AVDTP_mmi_iut_accept_media_transports(self, **kwargs):
+        """
+        Take action to accept transport channels for the recently configured
+        media stream.
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_AVDTP_mmi_iut_confirm_streaming(self, **kwargs):
+        """
+        Is the IUT (Implementation Under Test) receiving streaming media from
+        PTS?
+
+        Action: Press 'Yes' if the IUT is receiving streaming data from
+        the PTS (in some cases the sound may not be clear, this is normal).
+        """
+
+        # TODO: verify
+        return "OK"
+
+    @assert_description
+    def TSC_AVDTP_mmi_iut_initiate_open_stream(self, **kwargs):
+        """
+        Open a streaming media channel.
+
+        Action: If the IUT (Implementation
+        Under Test) is already connected to PTS, attempting to send or receive
+        streaming media should trigger this action.  If the IUT is not connected
+        to PTS, attempting to connect may trigger this action.
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_AVDTP_mmi_iut_accept_reconnect(self, pts_addr: bytes, **kwargs):
+        """
+        Press OK when the IUT (Implementation Under Test) is ready to allow the
+        PTS to reconnect the AVDTP signaling channel.
+
+        Action: Press OK when the
+        IUT is ready to accept Bluetooth connections again.
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_AVDTP_mmi_iut_initiate_get_all_capabilities(self, **kwargs):
+        """
+        Send a GET ALL CAPABILITIES command to PTS.
+
+        Action: If the IUT
+        (Implementation Under Test) is already connected to PTS, attempting to
+        send or receive streaming media should trigger this action.  If the IUT
+        is not connected to PTS, attempting to connect may trigger this action.
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_AVDTP_mmi_tester_verifying_suspend(self, **kwargs):
+        """
+        Please wait while the tester verifies the IUT does not send media during
+        suspend ...
+        """
+
+        return "Yes"
+
+    @assert_description
+    def TSC_A2DP_mmi_user_confirm_optional_data_attribute(self, **kwargs):
+        """
+        Tester found the optional SDP attribute named 'Supported Features'.
+        Press 'Yes' if the data displayed below is correct.
+
+        Value: 0x0001
+        """
+
+        # TODO: Extract and verify attribute name and value from description
+        return "OK"
+
+    @assert_description
+    def TSC_A2DP_mmi_user_confirm_optional_string_attribute(self, **kwargs):
+        """
+        Tester found the optional SDP attribute named 'Service Name'.  Press
+        'Yes' if the string displayed below is correct.
+
+        Value: Advanced Audio
+        Source
+        """
+
+        # TODO: Extract and verify attribute name and value from description
+        return "OK"
+
+    @assert_description
+    def TSC_A2DP_mmi_user_confirm_no_optional_attribute_support(self, **kwargs):
+        """
+        Tester could not find the optional SDP attribute named 'Provider Name'.
+        Is this correct?
+        """
+
+        # TODO: Extract and verify attribute name from description
+        return "OK"
+
+    @assert_description
+    def TSC_AVDTPEX_mmi_iut_accept_delayreport(self, **kwargs):
+        """
+        Take action if necessary to accept the Delay Reportl command from the
+        tester.
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_AVDTPEX_mmi_iut_initiate_media_transport_connect(self, **kwargs):
+        """
+        Take action to initiate an AVDTP media transport.
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_AVDTPEX_mmi_user_confirm_SIG_SMG_BV_28_C(self, **kwargs):
+        """
+        Were all the service capabilities reported to the upper tester valid?
+        """
+
+        # TODO: verify
+        return "Yes"
+
+    @assert_description
+    def TSC_AVDTPEX_mmi_iut_reject_invalid_command(self, **kwargs):
+        """
+        Take action to reject the invalid command sent by the tester.
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_AVDTPEX_mmi_iut_reject_open(self, **kwargs):
+        """
+        Take action to reject the invalid OPEN command sent by the tester.
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_AVDTPEX_mmi_iut_reject_start(self, **kwargs):
+        """
+        Take action to reject the invalid START command sent by the tester.
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_AVDTPEX_mmi_iut_reject_suspend(self, **kwargs):
+        """
+        Take action to reject the invalid SUSPEND command sent by the tester.
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_AVDTPEX_mmi_iut_reject_reconfigure(self, **kwargs):
+        """
+        Take action to reject the invalid or incompatible RECONFIGURE command
+        sent by the tester.
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_AVDTPEX_mmi_iut_reject_get_all_capabilities(self, **kwargs):
+        """
+        Take action to reject the invalid GET ALL CAPABILITIES command with the
+        error code BAD_LENGTH.
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_AVDTPEX_mmi_iut_reject_get_capabilities(self, **kwargs):
+        """
+        Take action to reject the invalid GET CAPABILITIES command with the
+        error code BAD_LENGTH.
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_AVDTPEX_mmi_iut_reject_set_configuration(self, **kwargs):
+        """
+        Take action to reject the SET CONFIGURATION sent by the tester.  The IUT
+        is expected to respond with SEP_IN_USE because the SEP requested was
+        previously configured.
+        """
+
+        return "OK"
+
+    def TSC_AVDTPEX_mmi_iut_reject_get_configuration(self, **kwargs):
+        """
+        Take action to reject the GET CONFIGURATION sent by the tester.  The IUT
+        is expected to respond with BAD_ACP_SEID because the SEID requested was
+        not previously configured.
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_AVDTPEX_mmi_iut_reject_close(self, **kwargs):
+        """
+        Take action to reject the invalid CLOSE command sent by the tester.
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_AVDTPEX_mmi_user_confirm_SIG_SMG_BV_18_C(self, **kwargs):
+        """
+        Did the IUT receive media with the following information?
+
+        - V = RTP_Ver
+        - P = 0 (no padding bits)
+        - X = 0 (no extension)
+        - CC = 0 (no
+        contributing source)
+        - M = 0
+        """
+
+        # TODO: verify
+        return "OK"
diff --git a/android/pandora/mmi2grpc/mmi2grpc/avrcp.py b/android/pandora/mmi2grpc/mmi2grpc/avrcp.py
new file mode 100644
index 0000000..92972dc
--- /dev/null
+++ b/android/pandora/mmi2grpc/mmi2grpc/avrcp.py
@@ -0,0 +1,961 @@
+# Copyright 2022 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""AVRCP proxy module."""
+
+import time
+from typing import Optional
+
+from grpc import RpcError
+
+from mmi2grpc._audio import AudioSignal
+from mmi2grpc._helpers import assert_description
+from mmi2grpc._proxy import ProfileProxy
+from pandora_experimental.a2dp_grpc import A2DP
+from pandora_experimental.a2dp_pb2 import Sink, Source
+from pandora_experimental.avrcp_grpc import AVRCP
+from pandora_experimental.host_grpc import Host
+from pandora_experimental.host_pb2 import Connection
+from pandora_experimental.mediaplayer_grpc import MediaPlayer
+
+
+class AVRCPProxy(ProfileProxy):
+    """AVRCP proxy.
+
+    Implements AVRCP and AVCTP PTS MMIs.
+    """
+
+    connection: Optional[Connection] = None
+    sink: Optional[Sink] = None
+    source: Optional[Source] = None
+
+    def __init__(self, channel):
+        super().__init__(channel)
+
+        self.host = Host(channel)
+        self.a2dp = A2DP(channel)
+        self.avrcp = AVRCP(channel)
+        self.mediaplayer = MediaPlayer(channel)
+
+    @assert_description
+    def TSC_AVDTP_mmi_iut_accept_connect(self, test: str, pts_addr: bytes, **kwargs):
+        """
+        If necessary, take action to accept the AVDTP Signaling Channel
+        Connection initiated by the tester.
+
+        Description: Make sure the IUT
+        (Implementation Under Test) is in a state to accept incoming Bluetooth
+        connections.  Some devices may need to be on a specific screen, like a
+        Bluetooth settings screen, in order to pair with PTS.  If the IUT is
+        still having problems pairing with PTS, try running a test case where
+        the IUT connects to PTS to establish pairing.
+
+        """
+        # Simulate CSR timeout: b/259102046
+        time.sleep(2)
+        self.connection = self.host.WaitConnection(address=pts_addr).connection
+        if ("TG" in test and "TG/VLH" not in test) or "CT/VLH" in test:
+            try:
+                self.source = self.a2dp.WaitSource(connection=self.connection).source
+            except RpcError:
+                pass
+        else:
+            try:
+                self.sink = self.a2dp.WaitSink(connection=self.connection).sink
+            except RpcError:
+                pass
+        return "OK"
+
+    @assert_description
+    def TSC_AVCTP_mmi_iut_accept_connect_control(self, **kwargs):
+        """
+        Please wait while PTS creates an AVCTP control channel connection.
+        Action: Make sure the IUT is in a connectable state.
+
+        """
+        #TODO: Wait for connection to be established and AVCTP control channel to be open
+        return "OK"
+
+    @assert_description
+    def TSC_AVCTP_mmi_iut_accept_disconnect_control(self, **kwargs):
+        """
+        Please wait while PTS disconnects the AVCTP control channel connection.
+
+        """
+        return "OK"
+
+    @assert_description
+    def TSC_AVRCP_mmi_iut_accept_unit_info(self, **kwargs):
+        """
+        Take action to send a valid response to the [Unit Info] command sent by
+        the PTS.
+
+        """
+        return "OK"
+
+    @assert_description
+    def TSC_AVRCP_mmi_iut_accept_subunit_info(self, **kwargs):
+        """
+        Take action to send a valid response to the [Subunit Info] command sent
+        by the PTS.
+
+        """
+        return "OK"
+
+    @assert_description
+    def TSC_AVCTP_mmi_iut_accept_connect_browsing(self, **kwargs):
+        """
+        Please wait while PTS creates an AVCTP browsing channel connection.
+        Action: Make sure the IUT is in a connectable state.
+
+        """
+        return "OK"
+
+    @assert_description
+    def TSC_AVRCP_mmi_iut_accept_get_folder_items_media_player_list(self, **kwargs):
+        """
+        Take action to send a valid response to the [Get Folder Items] with the
+        scope <Media Player List> command sent by the PTS.
+
+        """
+        return "OK"
+
+    @assert_description
+    def TSC_AVRCP_mmi_user_confirm_media_players(self, **kwargs):
+        """
+        Do the following media players exist on the IUT?
+
+        Media Player:
+        Bluetooth Player
+
+
+        Note: Some media players may not be listed above.
+
+        """
+        #TODO: Verify the media players available
+        return "OK"
+
+    @assert_description
+    def TSC_AVP_mmi_iut_initiate_disconnect(self, **kwargs):
+        """
+        Take action to disconnect all A2DP and/or AVRCP connections.
+
+        """
+        if self.connection is None:
+            self.connection = self.host.GetConnection(address=pts_addr).connection
+        self.host.Disconnect(connection=self.connection)
+
+        return "OK"
+
+    @assert_description
+    def TSC_AVRCP_mmi_iut_accept_set_addressed_player(self, **kwargs):
+        """
+        Take action to send a valid response to the [Set Addressed Player]
+        command sent by the PTS.
+
+        """
+        return "OK"
+
+    @assert_description
+    def _mmi_1002(self, test: str, pts_addr: bytes, **kwargs):
+        """
+        If necessary, take action to accept the AVDTP Signaling Channel
+        Connection initiated by the tester.
+
+        Description: Make sure the IUT
+        (Implementation Under Test) is in a state to accept incoming Bluetooth
+        connections.  Some devices may need to be on a specific screen, like a
+        Bluetooth settings screen, in order to pair with PTS.  If the IUT is
+        still having problems pairing with PTS, try running a test case where
+        the IUT connects to PTS to establish pairing.
+        """
+        self.connection = self.host.WaitConnection(address=pts_addr).connection
+        try:
+            self.sink = self.a2dp.WaitSink(connection=self.connection).sink
+        except RpcError:
+            pass
+
+        return "OK"
+
+    @assert_description
+    def TSC_AVCTP_mmi_send_AVCT_ConnectRsp(self, **kwargs):
+        """
+        Upon a call to the callback function ConnectInd_CBTest_System,  use the
+        Upper Tester to send an AVCT_ConnectRsp message to the IUT with the
+        following parameter values:
+           * BD_ADDR = BD_ADDRLower_Tester
+           *
+        Connect Result = Valid value for L2CAP connect response result.
+           *
+        Status = Valid value for L2CAP connect response status.
+
+        The IUT should
+        then initiate an L2CAP_ConnectRsp and L2CAP_ConfigRsp.
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_AVCTP_mmi_verify_ConnectInd_CB(self, **kwargs):
+        """
+        Press 'OK' if the following conditions were met :
+
+        1. The IUT returns
+        the following AVCT_EventRegistration output parameters to the Upper
+        Tester:
+           * Result = 0x0000 (Event successfully registered)
+
+        2. The IUT
+        calls the ConnectInd_CBTest_System function in the Upper Tester with the
+        following parameter values:
+           * BD_ADDR = BD_ADDRLower_Tester
+
+        3. After
+        reception of any expected AVCT_EventRegistration command from the Upper
+        Tester and the L2CAP_ConnectReq from the Lower Tester, the IUT issues an
+        L2CAP_ConnectRsp to the Lower Tester.
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_AVCTP_mmi_register_ConnectInd_CB(self, **kwargs):
+        """
+        Using the Upper Tester register the function ConnectInd_CBTest_System
+        for callback on the AVCT_Connect_Ind event by sending an
+        AVCT_EventRegistration command to the IUT with the following parameter
+        values:
+           * Event = AVCT_Connect_Ind
+           * Callback =
+        ConnectInd_CBTest_System
+           * PID = PIDTest_System
+
+        Press 'OK' to
+        continue once the IUT has responded.
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_AVCTP_mmi_register_DisconnectInd_CB(self, **kwargs):
+        """
+        Using the Upper Tester register the DisconnectInd_CBTest_System function
+        for callback on the AVCT_Disconnect_Ind event by sending an
+        AVCT_EventRegistration command to the IUT with the following parameter
+        values :
+           * Event = AVCT_Disconnect_Ind
+           * Callback =
+        DisconnectInd_CBTest_System
+           * PID = PIDTest_System
+
+        Press 'OK' to
+        continue once the IUT has responded.
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_AVCTP_mmi_verify_DisconnectInd_CB(self, **kwargs):
+        """
+        Press 'OK' if the following conditions were met :
+
+        1. The IUT returns
+        the following AVCT_EventRegistration output parameters to the Upper
+        Tester:
+           * Result = 0x0000 (Event successfully registered)
+
+        2. The IUT
+        calls the DisconnectInd_CBTest_System function in the Upper Tester with
+        the following parameter values:
+           * BD_ADDR = BD_ADDRLower_Tester
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_AVCTP_mmi_verify_AVCT_SendMessage_TG(self, **kwargs):
+        """
+        Press 'OK' if the following conditions were met :
+
+        1. The IUT returns
+        the following AVCT_EventRegistration output parameters to the Upper
+        Tester:
+           * Result = 0x0000 (Event successfully registered)
+
+        2. The IUT
+        calls the MessageInd_CBTest_System callback function of the test system
+        with the following parameters:
+           * BD_ADDR = BD_ADDRTest_System
+           *
+        Transaction = TRANSTest_System
+           * Type = 0
+           * Data =
+        DATA[]Lower_Tester
+           * Length = LengthOf(DATA[]Lower_Tester)
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_AVCTP_mmi_iut_reject_invalid_profile_id(self, **kwargs):
+        """
+        Take action to reject the AVCTP DATA request with an invalid profile id.
+        The IUT is expected to set the ipid field to invalid and return only the
+        avctp header (no body data should be sent).
+        """
+        return "OK"
+
+    @assert_description
+    def TSC_AVCTP_mmi_verify_fragmented_AVCT_SendMessage_TG(self, **kwargs):
+        """
+        Press 'OK' if the following condition was met :
+
+        The IUT receives three
+        AVCTP packets from the Lower Tester, reassembles the message and calls
+        the MessageInd_CBTestSystem callback function with the following
+        parameters:
+           * BD_ADDR = BD_ADDRTest_System
+           * Transaction =
+        TRANSTest_System
+           * Type = 0x01 (Command Message)
+           * Data =
+        ADDRESSdata_buffer (Buffer holding DATA[]Lower_Tester)
+           * Length =
+        LengthOf(DATA[]Lower_Tester)
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_AVCTP_mmi_iut_initiate_avctp_data_response(self, **kwargs):
+        """
+        Take action to send the data specified in TSPX_avctp_iut_response_data
+        to the tester.
+
+        Note: If TSPX_avctp_psm = '0017'(AVRCP control channel
+        psm), a valid AVRCP response may be sent to the tester.
+        """
+        return "OK"
+
+    @assert_description
+    def TSC_AVCTP_mmi_register_MessageInd_CB_TG(self, **kwargs):
+        """
+        Using the Upper Tester register the function MessageInd_CBTest_System
+        for callback on the AVCT_MessageRec_Ind event by sending an
+        AVCT_EventRegistration command to the IUT with the following parameter
+        values:     
+           * Event = AVCT_MessageRec_Ind
+           * Callback =
+        MessageInd_CBTest_System
+           * PID = PIDTest_System
+
+        Press 'OK' to
+        continue once the IUT has responded.
+        """
+        #TODO: Remove trailing space post "values:" from docstring description
+
+        return "OK"
+
+    @assert_description
+    def TSC_AVDTP_mmi_iut_initiate_connect(self, test: str, pts_addr: bytes, **kwargs):
+        """
+        Create an AVDTP signaling channel.
+
+        Action: Create an audio or video
+        connection with PTS.
+        """
+        self.connection = self.host.Connect(address=pts_addr).connection
+        if ("TG" in test and "TG/VLH" not in test) or "CT/VLH" in test:
+            self.source = self.a2dp.OpenSource(connection=self.connection).source
+
+        return "OK"
+
+    @assert_description
+    def _mmi_690(self, **kwargs):
+        """
+        Press 'YES' if the IUT indicated receiving the [PLAY] command.  Press
+        'NO' otherwise.
+
+        Description: Verify that the Implementation Under Test
+        (IUT) successfully indicated that the current operation was pressed. Not
+        all commands (fast forward and rewind for example) have a noticeable
+        effect when pressed for a short period of time.  For commands like that
+        it is acceptable to assume the effect took place and press 'YES'.
+        """
+
+        return "Yes"
+
+    @assert_description
+    def _mmi_691(self, **kwargs):
+        """
+        Press 'YES' if the IUT indicated receiving the [STOP] command.  Press
+        'NO' otherwise.
+
+        Description: Verify that the Implementation Under Test
+        (IUT) successfully indicated that the current operation was pressed. Not
+        all commands (fast forward and rewind for example) have a noticeable
+        effect when pressed for a short period of time.  For commands like that
+        it is acceptable to assume the effect took place and press 'YES'.
+        """
+
+        return "Yes"
+
+    @assert_description
+    def _mmi_540(self, **kwargs):
+        """
+        Press 'YES' if the IUT supports press and hold functionality for the
+        [PLAY] command.  Press 'NO' otherwise.
+
+        Description: Verify press and
+        hold functionality of passthrough operations that support press and
+        hold.  Not all operations support press and hold, pressing 'NO' will not
+        fail the test case.
+        """
+
+        return "Yes"
+
+    @assert_description
+    def _mmi_615(self, **kwargs):
+        """
+        Press 'YES' if the IUT indicated press and hold functionality for the
+        [PLAY] command.  Press 'NO' otherwise.
+
+        Description: Verify that the
+        Implementation Under Test (IUT) successfully indicated that the current
+        operation was held.
+        """
+
+        return "Yes"
+
+    @assert_description
+    def _mmi_541(self, **kwargs):
+        """
+        Press 'YES' if the IUT supports press and hold functionality for the
+        [STOP] command.  Press 'NO' otherwise.
+
+        Description: Verify press and
+        hold functionality of passthrough operations that support press and
+        hold.  Not all operations support press and hold, pressing 'NO' will not
+        fail the test case.
+        """
+
+        return "Yes"
+
+    @assert_description
+    def _mmi_616(self, **kwargs):
+        """
+        Press 'YES' if the IUT indicated press and hold functionality for the
+        [STOP] command.  Press 'NO' otherwise.
+
+        Description: Verify that the
+        Implementation Under Test (IUT) successfully indicated that the current
+        operation was held.
+        """
+
+        return "Yes"
+
+    @assert_description
+    def TSC_AVRCP_mmi_user_confirm_media_is_streaming(self, **kwargs):
+        """
+        Press 'OK' when the IUT is in a state where media is playing.
+        Description: PTS is preparing the streaming state for the next
+        passthrough command, if the current streaming state is not relevant to
+        this IUT, please press 'OK to continue.
+        """
+        if not self.a2dp.IsSuspended(source=self.source).is_suspended:
+            return "Yes"
+        else:
+            return "No"
+
+    @assert_description
+    def TSC_AVRCP_mmi_iut_reject_invalid_get_capabilities(self, **kwargs):
+        """
+        The IUT should reject the invalid Get Capabilities command sent by PTS.
+        Description: Verify that the IUT can properly reject a Get Capabilities
+        command that contains an invalid capability.
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_AVRCP_mmi_iut_accept_get_capabilities(self, **kwargs):
+        """
+        Take action to send a valid response to the [Get Capabilities] command
+        sent by the PTS.
+        """
+        # This will be done as part as the a2dp.OpenSource or a2dp.WaitSource
+
+        return "OK"
+
+    @assert_description
+    def TSC_AVRCP_mmi_iut_accept_get_element_attributes(self, **kwargs):
+        """
+        Take action to send a valid response to the [Get Element Attributes]
+        command sent by the PTS.
+        """
+        # This will be done as part as the a2dp.OpenSource or a2dp.WaitSource
+
+        return "OK"
+
+    @assert_description
+    def TSC_AVRCP_mmi_iut_reject_invalid_command_control_channel(self, **kwargs):
+        """
+        PTS has sent an invalid command over the control channel.  The IUT must
+        respond with a general reject on the control channel.
+
+        Description:
+        Verify that the IUT can properly reject an invalid command sent over the
+        control channel.
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_AVRCP_mmi_iut_reject_invalid_command_browsing_channel(self, **kwargs):
+        """
+        PTS has sent an invalid command over the browsing channel.  The IUT must
+        respond with a general reject on the browsing channel.
+
+        Description:
+        Verify that the IUT can properly reject an invalid command sent over the
+        browsing channel.
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_AVCTP_mmi_register_ConnectCfm_CB(self, **kwargs):
+        """
+        Using the Upper Tester send an AVCT_EventRegistration command from the
+        AVCTP Upper Interface to the IUT with the following input parameter
+        values:
+           * Event = AVCT_Connect_Cfm
+           * Callback =
+        ConnectCfm_CBTest_System
+           * PID = PIDTest_System
+    
+        Press 'OK' to
+        continue once the IUT has responded.
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_AVRCP_mmi_iut_accept_set_browsed_player(self, **kwargs):
+        """
+        Take action to send a valid response to the [Set Browsed Player] command
+        sent by the PTS.
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_AVRCP_mmi_iut_accept_get_folder_items_virtual_file_system(self, **kwargs):
+        """
+        Take action to send a valid response to the [Get Folder Items] with the
+        scope <Virtual File System> command sent by the PTS.
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_AVRCP_mmi_user_confirm_virtual_file_system(self, **kwargs):
+        """
+        Are the following items found in the current folder?
+    
+        Folder:
+        com.android.pandora
+    
+    
+        Note: Some media elements and folders may not be
+        listed above.
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_AVRCP_mmi_iut_accept_change_path_down(self, **kwargs):
+        """
+        Take action to send a valid response to the [Change Path] <Down> command
+        sent by the PTS.
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_AVRCP_mmi_iut_accept_change_path_up(self, **kwargs):
+        """
+        Take action to send a valid response to the [Change Path] <Up> command
+        sent by the PTS.
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_AVRCP_mmi_user_action_track_playing(self, **kwargs):
+        """
+        Place the IUT into a state where a track is currently playing, then
+        press 'OK' to continue.
+        """
+        self.mediaplayer.Play()
+
+        return "OK"
+
+    @assert_description
+    def TSC_AVRCP_mmi_iut_accept_get_item_attributes(self, **kwargs):
+        """
+        Take action to send a valid response to the [Get Item Attributes]
+        command sent by the PTS.
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_AVRCP_mmi_iut_reject_set_addressed_player_invalid_player_id(self, **kwargs):
+        """
+        PTS has sent a Set Addressed Player command with an invalid Player Id.
+        The IUT must respond with the error code: Invalid Player Id (0x11).
+        Description: Verify that the IUT can properly reject a Set Addressed
+        Player command that contains an invalid player id.
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_AVRCP_mmi_iut_reject_get_folder_items_out_of_range(self, **kwargs):
+        """
+        PTS has sent a Get Folder Items command with invalid values for Start
+        and End.  The IUT must respond with the error code: Range Out Of Bounds
+        (0x0B).
+    
+        Description: Verify that the IUT can properly reject a Get
+        Folder Items command that contains an invalid start and end index.
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_AVRCP_mmi_iut_reject_change_path_down_invalid_uid(self, **kwargs):
+        """
+        PTS has sent a Change Path Down command with an invalid folder UID.  The
+        IUT must respond with the error code: Does Not Exist (0x09).
+        Description: Verify that the IUT can properly reject an Change Path Down
+        command that contains an invalid UID.
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_AVRCP_mmi_iut_reject_get_item_attributes_invalid_uid_counter(self, **kwargs):
+        """
+        PTS has sent a Get Item Attributes command with an invalid UID Counter.
+        The IUT must respond with the error code: UID Changed (0x05).
+        Description: Verify that the IUT can properly reject a Get Item
+        Attributes command that contains an invalid UID Counter.
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_AVRCP_mmi_iut_accept_play_item(self, **kwargs):
+        """
+        Take action to send a valid response to the [Play Item] command sent by
+        the PTS.
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_AVRCP_mmi_iut_reject_play_item_invalid_uid(self, **kwargs):
+        """
+        PTS has sent a Play Item command with an invalid UID.  The IUT must
+        respond with the error code: Does Not Exist (0x09).
+    
+        Description: Verify
+        that the IUT can properly reject a Play Item command that contains an
+        invalid UID.
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_AVRCP_mmi_iut_initiate_register_notification_changed_track_changed(self, **kwargs):
+        """
+        Take action to trigger a [Register Notification, Changed] response for
+        <Track Changed> to the PTS from the IUT.  This can be accomplished by
+        changing the currently playing track on the IUT.
+
+        Description: Verify
+        that the Implementation Under Test (IUT) can update database by sending
+        a valid Track Changed Notification to the PTS.
+        """
+
+        self.mediaplayer.Play()
+        self.mediaplayer.Forward()
+
+        return "OK"
+
+    @assert_description
+    def TSC_AVRCP_mmi_user_action_change_track(self, **kwargs):
+        """
+        Take action to change the currently playing track.
+        """
+        self.mediaplayer.Forward()
+
+        return "OK"
+
+    @assert_description
+    def TSC_AVRCP_mmi_iut_reject_set_browsed_player_invalid_player_id(self, **kwargs):
+        """
+        PTS has sent a Set Browsed Player command with an invalid Player Id.
+        The IUT must respond with the error code: Invalid Player Id (0x11).
+        Description: Verify that the IUT can properly reject a Set Browsed
+        Player command that contains an invalid player id.
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_AVRCP_mmi_iut_reject_register_notification_notify_invalid_event_id(self, **kwargs):
+        """
+        PTS has sent a Register Notification command with an invalid Event Id.
+        The IUT must respond with the error code: Invalid Parameter (0x01).
+        Description: Verify that the IUT can properly reject a Register
+        Notification command that contains an invalid event Id.
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_AVRCP_mmi_user_action_play_large_metadata_media(self, **kwargs):
+        """
+        Start playing a media item with more than 512 bytes worth of metadata,
+        then press 'OK'.
+        """
+
+        self.mediaplayer.SetLargeMetadata()
+
+        return "OK"
+
+    @assert_description
+    def TSC_AVRCP_mmi_user_confirm_now_playing_list_updated_with_local(self, **kwargs):
+        """
+        Is the newly added media item listed below?
+
+        Media Element: Title2
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_AVRCP_mmi_user_action_queue_now_playing(self, **kwargs):
+        """
+        Take action to populate the now playing list with multiple items.  Then
+        make sure a track is playing and press 'OK'.
+
+        Note: If the
+        NOW_PLAYING_CONTENT_CHANGED notification has been registered, this
+        message will disappear when the notification changed is received.
+        """
+        self.mediaplayer.Play()
+
+        return "OK"
+
+    @assert_description
+    def TSC_AVRCP_mmi_iut_accept_get_folder_items_now_playing(self, **kwargs):
+        """
+        Take action to send a valid response to the [Get Folder Items] with the
+        scope <Now Playing> command sent by the PTS.
+        """
+        self.mediaplayer.Forward()
+
+        return "OK"
+
+    @assert_description
+    def TSC_AVRCP_mmi_iut_initiate_register_notification_changed_now_playing_content_changed(self, **kwargs):
+        """
+        Take action to trigger a [Register Notification, Changed] response for
+        <Now Playing Content Changed> to the PTS from the IUT.  This can be
+        accomplished by adding tracks to the Now Playing List on the IUT.
+        Description: Verify that the Implementation Under Test (IUT) can update
+        database by sending a valid Now Playing Changed Notification to the PTS.
+        """
+        self.mediaplayer.Play()
+
+        return "OK"
+
+    @assert_description
+    def _mmi_1016(self, test: str, pts_addr: bytes, **kwargs):
+        """
+        Create an AVDTP signaling channel.
+
+        Action: Create an audio or video
+        connection with PTS.
+        """
+        self.connection = self.host.Connect(address=pts_addr).connection
+        if "TG" in test:
+            try:
+                self.source = self.a2dp.OpenSource(connection=self.connection).source
+            except RpcError:
+                pass
+        else:
+            try:
+                self.sink = self.a2dp.WaitSink(connection=self.connection).sink
+            except RpcError:
+                pass
+
+        return "OK"
+
+    @assert_description
+    def TSC_AVCTP_mmi_send_AVCT_ConnectReq(self, pts_addr: bytes, **kwargs):
+        """
+        Using the Upper Tester, send an AVCT_ConnectReq command to the IUT with
+        the following input parameter values:
+           * BD_ADDR = BD_ADDRLower_Tester
+        * PID = PIDTest_System
+
+        The IUT should then initiate an
+        L2CAP_ConnectReq.
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_AVCTP_mmi_verify_ConnectCfm_CB(self, pts_addr: bytes, **kwargs):
+        """
+        Press 'OK' if the following conditions were met :
+
+        1. The IUT returns
+        the following AVCT_ConnectReq output parameters to the Upper Tester:
+        * Result = 0x0000 (Event successfully registered)
+
+        2. The IUT calls the
+        ConnectCfm_CBTest_System function in the Upper Tester with the following
+        parameters:
+           * BD_ADDR = BD_ADDRLower_Tester
+           * Connect Result =
+        0x0000 (L2CAP Connect Request successful)
+           * Config Result = 0x0000
+        (L2CAP Configure successful)
+           * Status = L2CAP Connect Request Status
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_AVCTP_mmi_register_DisconnectCfm_CB(self, pts_addr: bytes, **kwargs):
+        """
+        Using the Upper Tester register the function DisconnectCfm_CBTest_System
+        for callback on the AVCT_Disconnect_Cfm event by sending an
+        AVCT_EventRegistration command to the IUT with the following parameter
+        values:
+           * Event = AVCT_Disconnect_Cfm
+           * Callback =
+        DisconnectCfm_CBTest_System
+           * PID = PIDTest_System
+
+        Press 'OK' to
+        continue once the IUT has responded.
+        """
+
+        return "OK"
+
+    def TSC_AVCTP_mmi_send_AVCT_Disconnect_Req(self, test: str, pts_addr: bytes, **kwargs):
+        """
+        Using the Upper Tester send an AVCT_DisconnectReq command to the IUT
+        with the following parameter values:
+           * BD_ADDR = BD_ADDRLower_Tester
+        * PID = PIDTest_System
+
+        The IUT should then initiate an
+        L2CAP_DisconnectReq.   
+        """
+        # Currently disconnect is required in TG role
+        if "TG" in test:
+            if self.connection is None:
+                self.connection = self.host.GetConnection(address=pts_addr).connection
+            time.sleep(3)
+            self.host.Disconnect(connection=self.connection)
+            self.connection = None
+
+        return "OK"
+
+    @assert_description
+    def TSC_AVCTP_mmi_verify_DisconnectCfm_CB(self, **kwargs):
+        """
+        Press 'OK' if the following conditions were met :
+
+        1. The IUT returns
+        the following AVCT_EventRegistration output parameters to the Upper
+        Tester:
+           * Result = 0x0000 (Event successfully registered)
+
+        2. The IUT
+        calls the DisconnectCfm_CBTest_System function in the Upper Tester with
+        the following parameter values:
+           * BD_ADDR = BD_ADDRLower_Tester
+           *
+        Disconnect Result = 0x0000 (L2CAP disconnect success)
+
+        3. The IUT
+        returns the following AVCT_DisconnectReq output parameter values to the
+        Upper Tester:
+           * RSP = 0x0000 (Request accepted)
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_AVCTP_mmi_send_AVCT_SendMessage_TG(self, **kwargs):
+        """
+        Upon a call to the call back function MessageInd_CBTest_System, use the
+        Upper Tester to send an AVCT_SendMessage command to the IUT with the
+        following parameter values:
+           * BD_ADDR = BD_ADDRTest_System
+           *
+        Transaction = TRANSTest_System
+           * Type = CRTest_System = 1 (Response
+        Message)
+           * PID = PIDTest_System
+           * Data = ADDRESSdata_buffer
+        (Buffer containing DATA[]Upper_Tester)
+           * Length =
+        LengthOf(DATA[]Upper_Tester) <= MTU – 3bytes
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_AVCTP_mmi_verify_MessageInd_CB_TG(self, **kwargs):
+        """
+        Press 'OK' if the following conditions were met :
+
+        1. The
+        MessageInd_CBTest_System function in the Upper Tester is called with the
+        following parameters:
+           * BD_ADDR = BD_ADDRLower_Tester
+           *
+        Transaction = TRANSTest_System
+           * Type = 0x00 (Command message)
+           *
+        Data = ADDRESSdata_buffer (Buffer containing DATA[]Lower_Tester)
+           *
+        Length = LengthOf(DATA[]Lower_Tester)
+
+        2. the IUT returns the following
+        AVCT_SendMessage output parameters to the Upper Tester:
+           * Result =
+        0x0000 (Request accepted)
+        """
+
+        return "OK"
diff --git a/android/pandora/mmi2grpc/mmi2grpc/gap.py b/android/pandora/mmi2grpc/mmi2grpc/gap.py
new file mode 100644
index 0000000..c2c49b0
--- /dev/null
+++ b/android/pandora/mmi2grpc/mmi2grpc/gap.py
@@ -0,0 +1,921 @@
+from threading import Thread
+from mmi2grpc._helpers import assert_description, match_description
+from mmi2grpc._proxy import ProfileProxy
+from time import sleep
+
+from pandora_experimental.gatt_grpc import GATT
+from pandora_experimental.gatt_pb2 import GattServiceParams, GattCharacteristicParams
+from pandora_experimental.host_grpc import Host
+from pandora_experimental.host_pb2 import ConnectabilityMode, DataTypes, DiscoverabilityMode, OwnAddressType
+from pandora_experimental.security_grpc import Security, SecurityStorage
+from pandora_experimental.security_pb2 import LESecurityLevel
+
+
+class GAPProxy(ProfileProxy):
+
+    def __init__(self, channel):
+        super().__init__(channel)
+        self.gatt = GATT(channel)
+        self.host = Host(channel)
+        self.security = Security(channel)
+        self.security_storage = SecurityStorage(channel)
+
+        self.connection = None
+        self.pairing_events = None
+        self.inquiry_responses = None
+        self.scan_responses = None
+
+        self.counter = 0
+        self.cached_passkey = None
+
+        self._auto_confirm_requests()
+
+    @match_description
+    def TSC_MMI_iut_send_hci_connect_request(self, test: str, pts_addr: bytes, **kwargs):
+        """
+        Please send an HCI connect request to establish a basic rate
+        connection( after the IUT discovers the Lower Tester over BR and LE)?.
+        """
+
+        if test in {"GAP/SEC/AUT/BV-02-C", "GAP/SEC/SEM/BV-05-C", "GAP/SEC/SEM/BV-08-C"}:
+            # we connect then pair, so we have to pair directly in this MMI
+            self.pairing_events = self.security.OnPairing()
+            self.connection = self.host.Connect(address=pts_addr, manually_confirm=True).connection
+        else:
+            self.connection = self.host.Connect(address=pts_addr).connection
+
+        return "OK"
+
+    @assert_description
+    def _mmi_222(self, **kwargs):
+        """
+        Please initiate a BR/EDR security authentication and pairing with
+        interaction of HCI commands.
+
+        Press OK to continue.
+        """
+
+        # pairing already initiated with Connect() on Android
+        self.pairing_events = self.security.OnPairing()
+
+        return "OK"
+
+    @match_description
+    def _mmi_2001(self, passkey: str, **kwargs):
+        """
+        Please verify the passKey is correct: (?P<passkey>[0-9]+)
+        """
+
+        for event in self.pairing_events:
+            assert event.numeric_comparison == int(passkey), (event, passkey)
+            self.pairing_events.send(event=event, confirm=True)
+            return "OK"
+
+        assert False, "did not receive expected pairing event"
+
+    @assert_description
+    def TSC_MMI_iut_send_advertising_report_event_connectable_undirected(self, **kwargs):
+        """
+        Please send a connectable undirected advertising report.
+        """
+
+        self.host.StartAdvertising(
+            connectable=True,
+            own_address_type=OwnAddressType.PUBLIC,
+        )
+
+        self.pairing_events = self.security.OnPairing()
+
+        return "OK"
+
+    @assert_description
+    def TSC_MMI_iut_enter_handle_for_insufficient_authentication(self, pts_addr: bytes, **kwargs):
+        """
+        Please enter the handle(2 octet) to the characteristic in the IUT
+        database where Insufficient Authentication error will be returned :
+        """
+
+        response = self.gatt.RegisterService(
+            service=GattServiceParams(
+                uuid="955798ce-3022-455c-b759-ee8edcd73d1a",
+                characteristics=[
+                    GattCharacteristicParams(
+                        uuid="cf99ed9b-3c43-4343-b8a7-8afa513752ce",
+                        properties=0x02,  # PROPERTY_READ,
+                        permissions=0x04,  # PERMISSION_READ_ENCRYPTED_MITM
+                    ),
+                ],
+            ))
+
+        self.pairing_events = self.security.OnPairing()
+
+        return handle_format(response.service.characteristics[0].handle)
+
+    @match_description
+    def TSC_MMI_the_security_id_is(self, pts_addr: bytes, passkey: str, **kwargs):
+        """
+        The Secure ID is (?P<passkey>[0-9]*)
+        """
+
+        for event in self.pairing_events:
+            if event.address == pts_addr and event.passkey_entry_request:
+                self.pairing_events.send(event=event, passkey=int(passkey))
+                return "OK"
+
+        assert False
+
+    @assert_description
+    def TSC_MMI_iut_send_le_connect_request(self, test: str, pts_addr: bytes, **kwargs):
+        """
+        Please send an LE connect request to establish a connection.
+        """
+
+        if test == "GAP/DM/BON/BV-01-C":
+            # we also begin pairing here if we are not already paired on LE
+            if self.counter == 0:
+                self.counter += 1
+                self.security_storage.DeleteBond(public=pts_addr)
+                self.connection = self.host.ConnectLE(public=pts_addr).connection
+                self.security.Secure(connection=self.connection, le=LESecurityLevel.LE_LEVEL3)
+                return "OK"
+
+        if test == "GAP/SEC/AUT/BV-21-C" and self.connection is not None:
+            # no-op since the peer just disconnected from us,
+            # so we have immediately auto-connected back to it
+            return "OK"
+
+        if test in {"GAP/CONN/GCEP/BV-02-C", "GAP/DM/LEP/BV-06-C", "GAP/CONN/GCEP/BV-01-C"}:
+            # use identity address
+            address = pts_addr
+        else:
+            # the PTS sometimes decides to advertise with an RPA, so we do a scan to find its real address
+            scans = self.host.Scan()
+            for scan in scans:
+                adv_address = scan.public if scan.HasField("public") else scan.random
+                device_name = self.host.GetRemoteName(address=adv_address).name
+                if "pts" in device_name.lower():
+                    address = adv_address
+                    scans.cancel()
+                    break
+
+        self.connection = self.host.ConnectLE(public=address).connection
+        if test in {"GAP/BOND/BON/BV-04-C"}:
+            self.security.Secure(connection=self.connection, le=LESecurityLevel.LE_LEVEL3)
+
+        return "OK"
+
+    @assert_description
+    def TSC_MMI_enter_security_id(self, pts_addr: bytes, **kwargs):
+        """
+        Please enter Secure Id.
+        """
+
+        if self.cached_passkey is not None:
+            self.log(f"Returning cached passkey entry {self.cached_passkey}")
+            return str(self.cached_passkey)
+
+        for event in self.pairing_events:
+            if event.address == pts_addr and event.passkey_entry_notification:
+                self.log(f"Got passkey entry {event.passkey_entry_notification}")
+                self.cached_passkey = event.passkey_entry_notification
+                return str(event.passkey_entry_notification)
+
+        assert False
+
+    @match_description
+    def TSC_MMI_iut_send_att_service_request(self, pts_addr: bytes, handle: str, **kwargs):
+        r"""
+        Please send an ATT service request - read or write request with handle
+        (?P<handle>[0-9a-e]+) \(octet\).Discover services if needed.
+        """
+
+        self.gatt.ReadCharacteristicFromHandle(
+            connection=self.connection,
+            # They want us to read the characteristic value handle using ATT, but the interface only lets us
+            # read the characteristic by its handle. So we offset by one, since in this test the characteristic
+            # value handle is one above the characteristic handle itself.
+            handle=int(handle, base=16) - 1,
+        )
+
+        return "OK"
+
+    @assert_description
+    def TSC_MMI_iut_send_advertising_report_event_service_uuid(self, **kwargs):
+        """
+        Please prepare IUT to send an advertising report with Service UUID.
+        """
+
+        self.host.StartAdvertising(
+            own_address_type=OwnAddressType.PUBLIC,
+            data=DataTypes(complete_service_class_uuids128=["955798ce-3022-455c-b759-ee8edcd73d1a"],))
+        return "OK"
+
+    @assert_description
+    def TSC_MMI_iut_send_advertising_report_event_local_name(self, **kwargs):
+        """
+        Please prepare IUT to send an advertising report with Local Name.
+        """
+
+        self.host.StartAdvertising(
+            own_address_type=OwnAddressType.PUBLIC,
+            data=DataTypes(include_complete_local_name=True, include_shortened_local_name=True,))
+
+        return "OK"
+
+    @assert_description
+    def TSC_MMI_iut_send_advertising_report_event_flags(self, **kwargs):
+        """
+        Please prepare IUT to send an advertising report with Flags.
+        """
+
+        self.host.StartAdvertising(
+            connectable=True,
+            own_address_type=OwnAddressType.PUBLIC,
+        )
+
+        self.pairing_events = self.security.OnPairing()
+
+        return "OK"
+
+    @assert_description
+    def TSC_MMI_iut_send_advertising_report_event_manufacturer_specific_data(self, **kwargs):
+        """
+        Please prepare IUT to send an advertising report with Manufacture
+        Specific Data.
+        """
+
+        self.host.StartAdvertising(
+            own_address_type=OwnAddressType.PUBLIC,
+            data=DataTypes(manufacturer_specific_data=b"d0n't b3 3v1l!",))
+
+        return "OK"
+
+    @assert_description
+    def TSC_MMI_iut_send_advertising_report_event_tx_power_level(self, **kwargs):
+        """
+        Please prepare IUT to send an advertising report with TX Power Level.
+        """
+
+        self.host.StartAdvertising(
+            own_address_type=OwnAddressType.PUBLIC,
+            data=DataTypes(include_tx_power_level=True,))
+
+        return "OK"
+
+    @assert_description
+    def TSC_MMI_iut_send_advertising_report_event_connectable(self, **kwargs):
+        """
+        Please send a connectable advertising report.
+        """
+
+        self.host.StartAdvertising(
+            own_address_type=OwnAddressType.PUBLIC,
+            connectable=True,
+        )
+
+        self.pairing_events = self.security.OnPairing()
+
+        return "OK"
+
+    @assert_description
+    def TSC_MMI_iut_send_advertising_report_event_ADV_IND(self, **kwargs):
+        """
+        Please send connectable undirected advertising report.
+        """
+
+        self.host.StartAdvertising(
+            own_address_type=OwnAddressType.PUBLIC,
+            connectable=True,
+        )
+
+        self.pairing_events = self.security.OnPairing()
+
+        return "OK"
+
+    @assert_description
+    def TSC_MMI_iut_confirm_idle_mode_security_4(self, **kwargs):
+        """
+        Please confirm that IUT is in Idle mode with security mode 4. Press OK
+        when IUT is ready to start device discovery.
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_MMI_iut_start_general_inquiry_found(self, pts_addr: bytes, **kwargs):
+        """
+        Please start general inquiry. Click 'Yes' If IUT does discovers PTS and
+        ready for PTS to initiate LE create connection otherwise click 'No'.
+        """
+
+        inquiry_responses = self.host.Inquiry()
+        for response in inquiry_responses:
+            assert response.address == pts_addr, (response.address, pts_addr)
+            inquiry_responses.cancel()
+            return "Yes"
+
+        assert False
+
+    @assert_description
+    def TSC_MMI_iut_send_att_read_by_type_request_name_request(self, pts_addr: bytes, **kwargs):
+        """
+        Please start the Name Discovery Procedure to retrieve Device Name from
+        the PTS.
+        """
+
+        # Android does RNR when connecting for the first time
+        self.connection = self.host.Connect(address=pts_addr).connection
+
+        return "OK"
+
+    @match_description
+    def TSC_MMI_iut_confirm_device_discovery(self, name: str, pts_addr: bytes, **kwargs):
+        """
+        Please confirm that IUT has discovered PTS and retrieved its name (?P<name>[a-zA-Z\-0-9]*)
+        """
+
+        connection = self.host.GetConnection(address=pts_addr).connection
+        device = self.host.GetDevice(connection=connection)
+        assert name == device.name, (name, device.name)
+
+        return "OK"
+
+    @assert_description
+    def TSC_MMI_check_if_iut_support_non_connectable_advertising(self, **kwargs):
+        """
+        Does the IUT have an ability to send non-connectable advertising report?
+        """
+
+        return "Yes"
+
+    @assert_description
+    def TSC_MMI_iut_send_advertising_report_event_general_discoverable_ok_to_continue(self, **kwargs):
+        """
+        Please prepare IUT into general discoverable mode and send an
+        advertising report. Press OK to continue.
+        """
+
+        self.host.StartAdvertising(
+            data=DataTypes(le_discoverability_mode=DiscoverabilityMode.DISCOVERABLE_GENERAL),
+            own_address_type=OwnAddressType.PUBLIC,
+            connectable=True,
+        )
+
+        self.pairing_events = self.security.OnPairing()
+
+        return "OK"
+
+    @assert_description
+    def TSC_MMI_iut_send_advertising_report_event_general_discoverable_0203(self, **kwargs):
+        """
+        Please prepare IUT into general discoverable mode and send an
+        advertising report using either non - directed advertising or
+        discoverable undirected advertising.
+        """
+
+        self.host.StartAdvertising(
+            data=DataTypes(le_discoverability_mode=DiscoverabilityMode.DISCOVERABLE_GENERAL),
+            own_address_type=OwnAddressType.PUBLIC,
+            connectable=True,
+        )
+
+        self.pairing_events = self.security.OnPairing()
+
+        return "OK"
+
+    @assert_description
+    def TSC_MMI_iut_enter_undirected_connectable_mode_non_discoverable_mode(self, **kwargs):
+        """
+        Please prepare IUT into non-discoverable mode and send an advertising
+        report using connectable undirected advertising.
+        """
+
+        self.host.StartAdvertising(
+            data=DataTypes(le_discoverability_mode=DiscoverabilityMode.NOT_DISCOVERABLE),
+            own_address_type=OwnAddressType.PUBLIC,
+            connectable=True,
+        )
+
+        return "OK"
+
+    def TSC_MMI_iut_send_advertising_report_event_general_discoverable_00(self, **kwargs):
+        """
+        Please prepare IUT into general discoverable mode and send an
+        advertising report using connectable undirected advertising.
+        """
+
+        self.host.StartAdvertising(
+            data=DataTypes(le_discoverability_mode=DiscoverabilityMode.DISCOVERABLE_GENERAL),
+            own_address_type=OwnAddressType.PUBLIC,
+            connectable=True,
+        )
+
+        return "OK"
+
+    @assert_description
+    def TSC_MMI_iut_start_general_discovery(self, **kwargs):
+        """
+        Please start General Discovery. Press OK to continue.
+        """
+
+        self.scan_responses = self.host.Scan()
+
+        return "OK"
+
+    @assert_description
+    def TSC_MMI_iut_start_limited_discovery(self, **kwargs):
+        """
+        Please start Limited Discovery. Press OK to continue.
+        """
+
+        self.scan_responses = self.host.Scan()
+
+        return "OK"
+
+    @assert_description
+    def TSC_MMI_iut_confirm_general_discovered_device(self, pts_addr: bytes, **kwargs):
+        """
+        Please confirm that PTS is discovered.
+        """
+
+        for response in self.scan_responses:
+            assert response.HasField("public")
+            # General Discoverability shall be able to check both limited and general advertising
+            if response.public == pts_addr:
+                self.scan_responses.cancel()
+                return "OK"
+
+        assert False
+
+    @assert_description
+    def TSC_MMI_iut_confirm_limited_discovered_device(self, pts_addr: bytes, **kwargs):
+        """
+        Please confirm that PTS is discovered.
+        """
+
+        for response in self.scan_responses:
+            assert response.HasField("public")
+            if (response.public == pts_addr and
+                response.data.le_discoverability_mode == DiscoverabilityMode.DISCOVERABLE_LIMITED):
+                self.scan_responses.cancel()
+                return "OK"
+
+        assert False
+
+    @assert_description
+    def TSC_MMI_iut_confirm_general_discovered_device_not_found(self, pts_addr: bytes, **kwargs):
+        """
+        Please confirm that PTS is NOT discovered.
+        """
+
+        discovered = False
+
+        def search():
+            nonlocal discovered
+            for response in self.scan_responses:
+                assert response.HasField("public")
+                if (response.public == pts_addr and
+                    response.data.le_discoverability_mode == DiscoverabilityMode.DISCOVERABLE_GENERAL):
+                    self.scan_responses.cancel()
+                    discovered = True
+                    return
+
+        # search for five seconds, if we don't find anything, give up
+        worker = Thread(target=search)
+        worker.start()
+        worker.join(timeout=5)
+
+        assert not discovered
+
+        return "OK"
+
+    @assert_description
+    def TSC_MMI_iut_confirm_limited_discovered_device_not_found(self, pts_addr: bytes, **kwargs):
+        """
+        Please confirm that PTS is NOT discovered.
+        """
+
+        discovered = False
+
+        def search():
+            nonlocal discovered
+            for response in self.scan_responses:
+                assert response.HasField("public")
+                if (response.public == pts_addr and
+                    response.data.le_discoverability_mode == DiscoverabilityMode.DISCOVERABLE_LIMITED):
+                    self.inquiry_responses.cancel()
+                    discovered = True
+                    return
+
+        # search for five seconds, if we don't find anything, give up
+        worker = Thread(target=search)
+        worker.start()
+        worker.join(timeout=5)
+
+        assert not discovered
+
+        return "OK"
+
+    @assert_description
+    def TSC_MMI_iut_send_advertising_report_event_non_discoverable(self, **kwargs):
+        """
+        Please prepare IUT into non-discoverable and non-connectable mode and
+        send an advertising report.
+        """
+
+        self.host.StartAdvertising(own_address_type=OwnAddressType.PUBLIC,)
+
+        return "OK"
+
+    @assert_description
+    def TSC_MMI_set_iut_in_bondable_mode(self, **kwargs):
+        """
+        Please set IUT into bondable mode. Press OK to continue.
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_MMI_iut_send_le_disconnect_request(self, pts_addr: bytes, **kwargs):
+        """
+        Please send a disconnect request to terminate connection.
+        """
+
+        try:
+            self.host.Disconnect(connection=self.host.GetLEConnection(address=pts_addr).connection)
+        except Exception:
+            pass
+
+        return "OK"
+
+    @assert_description
+    def TSC_MMI_iut_start_bonding_procedure_bondable(self, test: str, pts_addr: bytes, **kwargs):
+        """
+        Please start the Bonding Procedure in bondable mode.
+        """
+
+        self.pairing_events = self.security.OnPairing()
+
+        if test == "GAP/DM/BON/BV-01-C":
+            # we already started in the previous test
+            return "OK"
+
+        if test not in {"GAP/SEC/AUT/BV-21-C"}:
+            self.security_storage.DeleteBond(public=pts_addr)
+
+        connection = self.host.GetLEConnection(address=pts_addr).connection
+        self.security.Secure(connection=connection, le=LESecurityLevel.LE_LEVEL3)
+
+        return "OK"
+
+    @assert_description
+    def TSC_MMI_make_iut_connectable(self, **kwargs):
+        """
+        Please make IUT connectable. Press OK to continue.
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_MMI_iut_start_general_discovery_DM(self, pts_addr: bytes, **kwargs):
+        """
+        Please start general discovery over BR/EDR and over LE. If IUT discovers
+        PTS with both BR/EDR and LE method, press OK.
+        """
+
+        discovered_bredr = False
+
+        def search_bredr():
+            nonlocal discovered_bredr
+            inquiry_responses = self.host.Inquiry()
+            for response in inquiry_responses:
+                if response.address == pts_addr:
+                    inquiry_responses.cancel()
+                    discovered_bredr = True
+                    return
+
+        bredr_worker = Thread(target=search_bredr)
+        bredr_worker.start()
+
+        discovered_le = False
+
+        def search_le():
+            nonlocal discovered_le
+            scan_responses = self.host.Scan()
+            for event in scan_responses:
+                address = event.public if event.HasField("public") else event.random
+                if (address == pts_addr and
+                    event.data.le_discoverability_mode):
+                    scan_responses.cancel()
+                    discovered_le = True
+                    return
+
+        le_worker = Thread(target=search_le)
+        le_worker.start()
+
+        # search for five seconds, if we don't find anything, give up
+        bredr_worker.join(timeout=5)
+        le_worker.join(timeout=5)
+
+        assert discovered_bredr and discovered_le, (discovered_bredr, discovered_le)
+
+        return "OK"
+
+    @assert_description
+    def TSC_MMI_make_iut_general_discoverable(self, **kwargs):
+        """
+        Please make IUT general discoverable. Press OK to continue.
+        """
+
+        self.host.SetDiscoverabilityMode(
+            mode=DiscoverabilityMode.DISCOVERABLE_GENERAL)
+
+        self.host.StartAdvertising(
+            data=DataTypes(le_discoverability_mode=DiscoverabilityMode.DISCOVERABLE_GENERAL),
+            own_address_type=OwnAddressType.PUBLIC,
+            connectable=True,
+        )
+
+        return "OK"
+
+    @assert_description
+    def TSC_MMI_iut_start_basic_rate_name_discovery_DM(self, pts_addr: bytes, **kwargs):
+        """
+        Please start device name discovery over BR/EDR . If IUT discovers PTS,
+        press OK to continue.
+        """
+
+        inquiry_responses = self.host.Inquiry()
+        for response in inquiry_responses:
+            if response.address == pts_addr:
+                inquiry_responses.cancel()
+                return "OK"
+
+        assert False
+
+    @assert_description
+    def TSC_MMI_make_iut_not_connectable(self, **kwargs):
+        """
+        Please make IUT not connectable. Press OK to continue.
+        """
+
+        self.host.SetDiscoverabilityMode(
+            mode=DiscoverabilityMode.NOT_DISCOVERABLE)
+
+        self.host.SetConnectabilityMode(mode=ConnectabilityMode.NOT_CONNECTABLE)
+
+        return "OK"
+
+    @assert_description
+    def TSC_MMI_make_iut_not_discoverable(self, **kwargs):
+        """
+        Please make IUT not discoverable. Press OK to continue.
+        """
+
+        self.host.SetDiscoverabilityMode(
+            mode=DiscoverabilityMode.NOT_DISCOVERABLE)
+        self.host.SetConnectabilityMode(mode=ConnectabilityMode.NOT_CONNECTABLE)
+
+        return "OK"
+
+    @assert_description
+    def TSC_MMI_press_ok_to_disconnect(self, test: str, pts_addr: bytes, **kwargs):
+        """
+        Please press ok to disconnect the link.
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_MMI_iut_send_att_disconnect_request(self, **kwargs):
+        """
+        Please send an ATT disconnect request to terminate an L2CAP channel.
+        """
+
+        try:
+            self.host.Disconnect(connection=self.connection)
+        except Exception:
+            # we already disconnected, no-op
+            pass
+
+        return "OK"
+
+    @assert_description
+    def TSC_MMI_iut_start_bonding_procedure_non_bondable(self, pts_addr: bytes, **kwargs):
+        """
+        Please start the Bonding Procedure in non-bondable mode.
+        """
+
+        # No idea how we can bond in non-bondable mode, but this passes the tests...
+        connection = self.host.GetLEConnection(address=pts_addr).connection
+        self.security.Secure(connection=connection, le=LESecurityLevel.LE_LEVEL3)
+
+        return "OK"
+
+    @assert_description
+    def TSC_MMI_iut_send_le_connection_update_request_timeout(self, **kwargs):
+        """
+        Please send an L2CAP Connection Parameter Update request using valid
+        parameters and wait for TSPX_iut_connection_parameter_timeout 30000ms
+        timeout...
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_MMI_iut_perform_direct_connection_establishment_procedure(self, **kwargs):
+        """
+        Please prepare IUT into the Direct Connection Establishment Procedure.
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_MMI_iut_perform_general_connection_establishment_procedure(self, **kwargs):
+        """
+        Please prepare IUT into the General Connection Establishment Procedure.
+        Press ok to continue.
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_MMI_iut_enter_non_connectable_mode(self, **kwargs):
+        """
+        Please enter Non-Connectable mode.
+        """
+
+        self.host.SetConnectabilityMode(mode=ConnectabilityMode.NOT_CONNECTABLE)
+
+        return "OK"
+
+    @assert_description
+    def TSC_MMI_iut_enter_non_connectable_mode_general_discoverable_mode(self, **kwargs):
+        """
+        Please enter General Discoverable and Non-Connectable mode.
+        """
+
+        self.host.SetDiscoverabilityMode(
+            mode=DiscoverabilityMode.DISCOVERABLE_GENERAL)
+        self.host.SetConnectabilityMode(mode=ConnectabilityMode.NOT_CONNECTABLE)
+
+        return "OK"
+
+    @assert_description
+    def TSC_MMI_iut_send_advertising_report_event_0203_general_discoverable(self, **kwargs):
+        """
+        Please send non-connectable undirected advertising report or
+        discoverable undirected advertising report with general discoverable
+        flags turned on.
+        """
+
+        self.host.StartAdvertising(
+            data=DataTypes(le_discoverability_mode=DiscoverabilityMode.DISCOVERABLE_GENERAL),
+            own_address_type=OwnAddressType.PUBLIC,
+            connectable=False,
+        )
+
+        return "OK"
+
+    @assert_description
+    def TSC_MMI_iut_send_advertising_report_event_non_discoverable_and_undirected_connectable(self, **kwargs):
+        """
+        Please prepare IUT into non-discoverable and connectable mode and send
+        an advertising report.
+        """
+
+        self.host.StartAdvertising(
+            data=DataTypes(le_discoverability_mode=DiscoverabilityMode.NOT_DISCOVERABLE),
+            own_address_type=OwnAddressType.PUBLIC,
+            connectable=True,
+        )
+
+        return "OK"
+
+    @assert_description
+    def TSC_MMI_iut_enter_undirected_connectable_mode_general_discoverable_mode(self, **kwargs):
+        """
+        Please prepare IUT into general discoverable mode and send an
+        advertising report using connectable undirected advertising.
+        """
+
+        self.host.StartAdvertising(
+            data=DataTypes(le_discoverability_mode=DiscoverabilityMode.DISCOVERABLE_GENERAL),
+            own_address_type=OwnAddressType.PUBLIC,
+            connectable=True,
+        )
+
+        return "OK"
+
+    @assert_description
+    def TSC_MMI_wait_for_encryption_change_event(self, **kwargs):
+        """
+        Waiting for HCI_ENCRYPTION_CHANGE_EVENT...
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_MMI_iut_enter_security_mode_4(self, **kwargs):
+        """
+        Please order the IUT to go in connectable mode and in security mode 4.
+        Press OK to continue.
+        """
+
+        self.pairing_events = self.security.OnPairing()
+
+        return "OK"
+
+    @assert_description
+    def _mmi_251(self, **kwargs):
+        """
+        Please send L2CAP Connection Response to PTS.
+        """
+
+        return "OK"
+
+    @assert_description
+    def _mmi_230(self, **kwargs):
+        """
+        Please order the IUT to be in security mode 4. Press OK to make
+        connection to Lower Tester.
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_MMI_iut_start_simple_pairing(self, pts_addr: bytes, **kwargs):
+        """
+        Please start simple pairing procedure.
+        """
+
+        # we have always started this already in the connection, so no-op
+
+        return "OK"
+
+    def TSC_MMI_iut_send_l2cap_connect_request(self, pts_addr: bytes, **kwargs):
+        """
+        Please initiate BR/EDR security authentication and pairing to establish
+        a service level enforced security!
+        After that, please create the service
+        channel using L2CAP Connection Request.
+
+        Press OK to continue.
+        """
+
+        def after_that():
+            sleep(5)
+            self.host.Connect(address=pts_addr)
+
+        Thread(target=after_that).start()
+
+        return "OK"
+
+    @assert_description
+    def TSC_MMI_iut_confirm_lost_bond(self, **kwargs):
+        """
+        Please confirm that IUT has informed of a lost bond.
+        """
+
+        return "OK"
+
+    @assert_description
+    def _mmi_231(self, test: str, pts_addr: bytes, **kwargs):
+        """
+        Please start the Bonding Procedure in bondable mode.
+        After Bonding
+        Procedure is completed, please send a disconnect request to terminate
+        connection.
+        """
+
+        if test != "GAP/SEC/SEM/BV-08-C":
+            # we already started in the Connect MMI
+            self.pairing_events = self.security.OnPairing()
+            self.security.Secure(connection=connection, le=LESecurityLevel.LE_LEVEL3)
+
+        connection = self.host.GetConnection(address=pts_addr).connection
+
+        def after_that():
+            self.host.WaitConnection()  # this really waits for bonding
+            sleep(1)
+            self.host.Disconnect(connection=connection)
+
+        Thread(target=after_that).start()
+
+        return "OK"
+
+    def _auto_confirm_requests(self, times=None):
+
+        def task():
+            cnt = 0
+            pairing_events = self.security.OnPairing()
+            for event in pairing_events:
+                if event.WhichOneof('method') in {"just_works", "numeric_comparison"}:
+                    if times is None or cnt < times:
+                        cnt += 1
+                        pairing_events.send(event=event, confirm=True)
+
+        Thread(target=task).start()
+
+def handle_format(handle):
+    return hex(handle)[2:].zfill(4)
diff --git a/android/pandora/mmi2grpc/mmi2grpc/gatt.py b/android/pandora/mmi2grpc/mmi2grpc/gatt.py
new file mode 100644
index 0000000..ff67a90
--- /dev/null
+++ b/android/pandora/mmi2grpc/mmi2grpc/gatt.py
@@ -0,0 +1,1257 @@
+# Copyright 2022 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import re
+import sys
+from threading import Thread
+
+from mmi2grpc._helpers import assert_description
+from mmi2grpc._proxy import ProfileProxy
+
+from pandora_experimental.gatt_grpc import GATT
+from pandora_experimental.host_grpc import Host
+from pandora_experimental.host_pb2 import ConnectabilityMode, OwnAddressType
+from pandora_experimental.gatt_pb2 import AttStatusCode, AttProperties, AttPermissions
+from pandora_experimental.gatt_pb2 import GattServiceParams
+from pandora_experimental.gatt_pb2 import GattCharacteristicParams
+from pandora_experimental.gatt_pb2 import ReadCharacteristicResponse
+from pandora_experimental.gatt_pb2 import ReadCharacteristicsFromUuidResponse
+
+# Tests that need GATT cache cleared before discovering services.
+NEEDS_CACHE_CLEARED = {
+    "GATT/CL/GAD/BV-01-C",
+    "GATT/CL/GAD/BV-06-C",
+}
+
+MMI_SERVER = {
+    "GATT/SR/GAD/BV-01-C",
+}
+
+# These UUIDs are used as reference for GATT server tests
+BASE_READ_WRITE_SERVICE_UUID = "0000fffa-0000-1000-8000-00805f9b34fb"
+BASE_READ_CHARACTERISTIC_UUID = "0000fffb-0000-1000-8000-00805f9b34fb"
+BASE_WRITE_CHARACTERISTIC_UUID = "0000fffc-0000-1000-8000-00805f9b34fb"
+CUSTOM_SERVICE_UUID = "0000fffd-0000-1000-8000-00805f9b34fb"
+CUSTOM_CHARACTERISTIC_UUID = "0000fffe-0000-1000-8000-00805f9b34fb"
+
+
+class GATTProxy(ProfileProxy):
+
+    def __init__(self, channel):
+        super().__init__(channel)
+        self.gatt = GATT(channel)
+        self.host = Host(channel)
+        self.connection = None
+        self.services = None
+        self.characteristics = None
+        self.descriptors = None
+        self.read_response = None
+        self.write_response = None
+        self.written_over_length = False
+        self.last_added_service = None
+
+    @assert_description
+    def MMI_IUT_INITIATE_CONNECTION(self, test, pts_addr: bytes, **kwargs):
+        """
+        Please initiate a GATT connection to the PTS.
+
+        Description: Verify that
+        the Implementation Under Test (IUT) can initiate GATT connect request to
+        PTS.
+        """
+
+        self.connection = self.host.ConnectLE(public=pts_addr).connection
+        if test in NEEDS_CACHE_CLEARED:
+            self.gatt.ClearCache(connection=self.connection)
+        return "OK"
+
+    @assert_description
+    def MMI_IUT_INITIATE_DISCONNECTION(self, **kwargs):
+        """
+        Please initiate a GATT disconnection to the PTS.
+
+        Description: Verify
+        that the Implementation Under Test (IUT) can initiate GATT disconnect
+        request to PTS.
+        """
+
+        assert self.connection is not None
+        self.host.Disconnect(connection=self.connection)
+        self.connection = None
+        self.services = None
+        self.characteristics = None
+        self.descriptors = None
+        self.read_response = None
+        self.write_response = None
+        self.written_over_length = False
+        self.last_added_service = None
+        return "OK"
+
+    @assert_description
+    def MMI_IUT_MTU_EXCHANGE(self, **kwargs):
+        """
+        Please send exchange MTU command to the PTS.
+
+        Description: Verify that
+        the Implementation Under Test (IUT) can send Exchange MTU command to the
+        tester.
+        """
+
+        assert self.connection is not None
+        self.gatt.ExchangeMTU(mtu=512, connection=self.connection)
+        return "OK"
+
+    def MMI_IUT_SEND_PREPARE_WRITE_REQUEST_VALID_SIZE(self, description: str, **kwargs):
+        """
+        Please send prepare write request with handle = 'XXXX'O and size = 'XXX'
+        to the PTS.
+
+        Description: Verify that the Implementation Under Test
+        (IUT) can send data according to negotiate MTU size.
+        """
+
+        assert self.connection is not None
+        matches = re.findall("'([a0-Z9]*)'O and size = '([a0-Z9]*)'", description)
+        handle = int(matches[0][0], 16)
+        data = bytes([1]) * int(matches[0][1])
+        self.gatt.WriteAttFromHandle(connection=self.connection,\
+                handle=handle, value=data)
+        return "OK"
+
+    @assert_description
+    def MMI_IUT_DISCOVER_PRIMARY_SERVICES(self, **kwargs):
+        """
+        Please send discover all primary services command to the PTS.
+        Description: Verify that the Implementation Under Test (IUT) can send
+        Discover All Primary Services.
+        """
+
+        assert self.connection is not None
+        self.services = self.gatt.DiscoverServices(connection=self.connection).services
+        return "OK"
+
+    def MMI_SEND_PRIMARY_SERVICE_UUID(self, description: str, **kwargs):
+        """
+        Please send discover primary services with UUID value set to 'XXXX'O to
+        the PTS.
+
+        Description: Verify that the Implementation Under Test (IUT)
+        can send Discover Primary Services UUID = 'XXXX'O.
+        """
+
+        assert self.connection is not None
+        uuid = formatUuid(re.findall("'([a0-Z9]*)'O", description)[0])
+        self.services = self.gatt.DiscoverServiceByUuid(connection=self.connection,\
+                uuid=uuid).services
+        return "OK"
+
+    def MMI_SEND_PRIMARY_SERVICE_UUID_128(self, description: str, **kwargs):
+        """
+        Please send discover primary services with UUID value set to
+        'XXXX-XXXX-XXXX-XXXX-XXXX-XXXX-XXXX-XXXX'O to the PTS.
+
+        Description:
+        Verify that the Implementation Under Test (IUT) can send Discover
+        Primary Services UUID = 'XXXX-XXXX-XXXX-XXXX-XXXX-XXXX-XXXX-XXXX'O.
+        """
+
+        assert self.connection is not None
+        uuid = formatUuid(re.findall("'([a0-Z9-]*)'O", description)[0])
+        self.services = self.gatt.DiscoverServiceByUuid(connection=self.connection,\
+                uuid=uuid).services
+        return "OK"
+
+    def MMI_CONFIRM_PRIMARY_SERVICE_UUID(self, **kwargs):
+        """
+        Please confirm IUT received primary services uuid = 'XXXX'O , Service
+        start handle = 'XXXX'O, end handle = 'XXXX'O in database. Click Yes if
+        IUT received it, otherwise click No.
+
+        Description: Verify that the
+        Implementation Under Test (IUT) can send Discover primary service by
+        UUID in database.
+        """
+
+        # Android doesn't store services discovered by UUID.
+        return "Yes"
+
+    @assert_description
+    def MMI_CONFIRM_NO_PRIMARY_SERVICE_SMALL(self, **kwargs):
+        """
+        Please confirm that IUT received NO service uuid found in the small
+        database file. Click Yes if NO service found, otherwise click No.
+        Description: Verify that the Implementation Under Test (IUT) can send
+        Discover primary service by UUID in small database.
+        """
+
+        # Android doesn't store services discovered by UUID.
+        return "Yes"
+
+    def MMI_CONFIRM_PRIMARY_SERVICE_UUID_128(self, **kwargs):
+        """
+        Please confirm IUT received primary services uuid=
+        'XXXX-XXXX-XXXX-XXXX-XXXX-XXXX-XXXX-XXXX'O, Service start handle =
+        'XXXX'O, end handle = 'XXXX'O in database. Click Yes if IUT received it,
+        otherwise click No.
+
+        Description: Verify that the Implementation Under
+        Test (IUT) can send Discover primary service by UUID in database.
+        """
+
+        # Android doesn't store services discovered by UUID.
+        return "Yes"
+
+    def MMI_CONFIRM_PRIMARY_SERVICE(self, test, description: str, **kwargs):
+        """
+        Please confirm IUT received primary services Primary Service = 'XXXX'O
+        Primary Service = 'XXXX'O  in database. Click Yes if IUT received it,
+        otherwise click No.
+
+        Description: Verify that the Implementation Under
+        Test (IUT) can send Discover all primary services in database.
+        """
+
+        if test not in MMI_SERVER:
+            assert self.services is not None
+            all_matches = list(map(formatUuid, re.findall("'([a0-Z9]*)'O", description)))
+            assert all(uuid in list(map(lambda service: service.uuid, self.services))\
+                    for uuid in all_matches)
+        return "OK"
+
+    @assert_description
+    def MMI_IUT_FIND_INCLUDED_SERVICES(self, **kwargs):
+        """
+        Please send discover all include services to the PTS to discover all
+        Include Service supported in the PTS. Discover primary service if
+        needed.
+
+        Description: Verify that the Implementation Under Test (IUT)
+        can send Discover all include services command.
+        """
+
+        assert self.connection is not None
+        self.services = self.gatt.DiscoverServices(connection=self.connection).services
+        return "OK"
+
+    @assert_description
+    def MMI_CONFIRM_NO_INCLUDE_SERVICE(self, **kwargs):
+        """
+        There is no include service in the database file.
+
+        Description: Verify
+        that the Implementation Under Test (IUT) can send Discover all include
+        services in database.
+        """
+
+        assert self.connection is not None
+        assert self.services is not None
+        for service in self.services:
+            assert len(service.included_services) == 0
+        return "OK"
+
+    def MMI_CONFIRM_INCLUDE_SERVICE(self, description: str, **kwargs):
+        """
+        Please confirm IUT received include services:
+
+        Attribute Handle = 'XXXX'O, Included Service Attribute handle = 'XXXX'O,
+        End Group Handle = 'XXXX'O, Service UUID = 'XXXX'O
+
+        Click Yes if IUT received it, otherwise click No.
+
+        Description: Verify
+        that the Implementation Under Test (IUT) can send Discover all include
+        services in database.
+        """
+
+        assert self.connection is not None
+        assert self.services is not None
+        """
+        Number of checks can vary but information is always the same,
+        so we need to iterate through the services and check if its included
+        services match one of these.
+        """
+        all_matches = re.findall("'([a0-Z9]*)'O", description)
+        found_services = 0
+        for service in self.services:
+            for i in range(0, len(all_matches), 4):
+                if compareIncludedServices(service,\
+                        (stringHandleToInt(all_matches[i])),\
+                        stringHandleToInt(all_matches[i + 1]),\
+                        formatUuid(all_matches[i + 3])):
+                    found_services += 1
+        assert found_services == (len(all_matches) / 4)
+        return "Yes"
+
+    def MMI_IUT_DISCOVER_SERVICE_UUID(self, description: str, **kwargs):
+        """
+        Discover all characteristics of service UUID= 'XXXX'O,  Service start
+        handle = 'XXXX'O, end handle = 'XXXX'O.
+
+        Description: Verify that the
+        Implementation Under Test (IUT) can send Discover all charactieristics
+        of a service.
+        """
+
+        assert self.connection is not None
+        service_uuid = formatUuid(re.findall("'([a0-Z9]*)'O", description)[0])
+        self.services = self.gatt.DiscoverServices(connection=self.connection).services
+        self.characteristics = getCharacteristicsForServiceUuid(self.services, service_uuid)
+        return "OK"
+
+    def MMI_CONFIRM_ALL_CHARACTERISTICS_SERVICE(self, description: str, **kwargs):
+        """
+        Please confirm IUT received all characteristics of service
+        handle='XXXX'O handle='XXXX'O handle='XXXX'O handle='XXXX'O
+        handle='XXXX'O handle='XXXX'O handle='XXXX'O handle='XXXX'O
+        handle='XXXX'O handle='XXXX'O handle='XXXX'O  in database. Click Yes if
+        IUT received it, otherwise click No.
+
+        Description: Verify that the
+        Implementation Under Test (IUT) can send Discover all characteristics of
+        a service in database.
+        """
+
+        assert self.characteristics is not None
+        all_matches = list(map(stringCharHandleToInt, re.findall("'([a0-Z9]*)'O", description)))
+        assert all(handle in list(map(lambda char: char.handle, self.characteristics))\
+                for handle in all_matches)
+        return "Yes"
+
+    def MMI_IUT_DISCOVER_SERVICE_UUID_RANGE(self, description: str, **kwargs):
+        """
+        Please send discover characteristics by UUID. Range start from handle =
+        'XXXX'O end handle = 'XXXX'O characteristics UUID = 0xXXXX'O.
+        Description: Verify that the Implementation Under Test (IUT) can send
+        Discover characteristics by UUID.
+        """
+
+        assert self.connection is not None
+        handles = re.findall("'([a0-Z9]*)'O", description)
+        """
+        PTS sends UUIDS description formatted differently in this MMI,
+        so we need to check for each known format.
+        """
+        uuid_match = re.findall("0x([a0-Z9]*)'O", description)
+        if len(uuid_match) == 0:
+            uuid_match = re.search("UUID = (.*)'O", description)
+            uuid = formatUuid(uuid_match[1])
+        else:
+            uuid = formatUuid(uuid_match[0])
+        self.services = self.gatt.DiscoverServices(connection=self.connection).services
+        self.characteristics = getCharacteristicsRange(self.services,\
+                stringHandleToInt(handles[0]), stringHandleToInt(handles[1]), uuid)
+        return "OK"
+
+    def MMI_CONFIRM_CHARACTERISTICS(self, description: str, **kwargs):
+        """
+        Please confirm IUT received characteristic handle='XXXX'O UUID='XXXX'O
+        in database. Click Yes if IUT received it, otherwise click No.
+        Description: Verify that the Implementation Under Test (IUT) can send
+        Discover primary service by UUID in database.
+        """
+
+        assert self.characteristics is not None
+        all_matches = re.findall("'([a0-Z9-]*)'O", description)
+        for characteristic in self.characteristics:
+            if characteristic.handle == stringHandleToInt(all_matches[0])\
+                    and characteristic.uuid == formatUuid(all_matches[1]):
+                return "Yes"
+        raise ValueError
+
+    @assert_description
+    def MMI_CONFIRM_NO_CHARACTERISTICSUUID_SMALL(self, **kwargs):
+        """
+        Please confirm that IUT received NO 128 bit uuid in the small database
+        file. Click Yes if NO handle found, otherwise click No.
+
+        Description:
+        Verify that the Implementation Under Test (IUT) can discover
+        characteristics by UUID in small database.
+        """
+
+        assert self.characteristics is not None
+        assert len(self.characteristics) == 0
+        return "OK"
+
+    def MMI_IUT_DISCOVER_DESCRIPTOR_RANGE(self, description: str, **kwargs):
+        """
+        Please send discover characteristics descriptor range start from handle
+        = 'XXXX'O end handle = 'XXXX'O to the PTS.
+
+        Description: Verify that the
+        Implementation Under Test (IUT) can send Discover characteristics
+        descriptor.
+        """
+
+        assert self.connection is not None
+        handles = re.findall("'([a0-Z9]*)'O", description)
+        self.services = self.gatt.DiscoverServices(connection=self.connection).services
+        self.descriptors = getDescriptorsRange(self.services,\
+                stringHandleToInt(handles[0]), stringHandleToInt(handles[1]))
+        return "OK"
+
+    def MMI_CONFIRM_CHARACTERISTICS_DESCRIPTORS(self, description: str, **kwargs):
+        """
+        Please confirm IUT received characteristic descriptors handle='XXXX'O
+        UUID=0xXXXX  in database. Click Yes if IUT received it, otherwise click
+        No.
+
+        Description: Verify that the Implementation Under Test (IUT) can
+        send Discover characteristic descriptors in database.
+        """
+
+        assert self.descriptors is not None
+        handle = stringHandleToInt(re.findall("'([a0-Z9]*)'O", description)[0])
+        uuid = formatUuid(re.search("UUID=0x(.*)  ", description)[1])
+        for descriptor in self.descriptors:
+            if descriptor.handle == handle and descriptor.uuid == uuid:
+                return "Yes"
+        raise ValueError
+
+    def MMI_IUT_DISCOVER_ALL_SERVICE_RECORD(self, pts_addr: bytes, description: str, **kwargs):
+        """
+        Please send Service Discovery to discover all primary Services. Click
+        YES if GATT='XXXX'O services are discovered, otherwise click No.
+        Description: Verify that the Implementation Under Test (IUT) can
+        discover basic rate all primary services.
+        """
+
+        uuid = formatSdpUuid(re.findall("'([a0-Z9]*)'O", description)[0])
+        self.services = self.gatt.DiscoverServicesSdp(address=pts_addr).service_uuids
+        assert uuid in self.services
+        return "Yes"
+
+    def MMI_IUT_SEND_READ_CHARACTERISTIC_HANDLE(self, description: str, **kwargs):
+        """
+        Please send read characteristic handle = 'XXXX'O to the PTS.
+        Description: Verify that the Implementation Under Test (IUT) can send
+        Read characteristic.
+        """
+
+        assert self.connection is not None
+        handle = stringHandleToInt(re.findall("'([a0-Z9]*)'O", description)[0])
+        def read():
+            nonlocal handle
+            self.read_response = self.gatt.ReadCharacteristicFromHandle(\
+                    connection=self.connection, handle=handle)
+        worker = Thread(target=read)
+        worker.start()
+        worker.join(timeout=30)
+        return "OK"
+
+    @assert_description
+    def MMI_IUT_READ_TIMEOUT(self, **kwargs):
+        """
+        Please wait for 30 seconds timeout to abort the procedure.
+
+        Description:
+        Verify that the Implementation Under Test (IUT) can handle timeout after
+        send Read characteristic without receiving response in 30 seconds.
+        """
+
+        return "OK"
+
+    @assert_description
+    def MMI_IUT_CONFIRM_READ_INVALID_HANDLE(self, **kwargs):
+        """
+        Please confirm IUT received Invalid handle error. Click Yes if IUT
+        received it, otherwise click No.
+
+        Description: Verify that the
+        Implementation Under Test (IUT) indicate Invalid handle error when read
+        a characteristic.
+        """
+
+        if type(self.read_response) is ReadCharacteristicResponse:
+            assert self.read_response.status == AttStatusCode.INVALID_HANDLE
+        elif type(self.read_response) is ReadCharacteristicsFromUuidResponse:
+            assert self.read_response.characteristics_read is not None
+            assert AttStatusCode.INVALID_HANDLE in\
+                    list(map(lambda characteristic_read: characteristic_read.status,\
+                            self.read_response.characteristics_read))
+        return "Yes"
+
+    @assert_description
+    def MMI_IUT_CONFIRM_READ_NOT_PERMITTED(self, **kwargs):
+        """
+        Please confirm IUT received read is not permitted error. Click Yes if
+        IUT received it, otherwise click No.
+
+        Description: Verify that the
+        Implementation Under Test (IUT) indicate read is not permitted error
+        when read a characteristic.
+        """
+
+        # Android read error doesn't return an error code so we have to also
+        # compare to the generic error code here.
+        if type(self.read_response) is ReadCharacteristicResponse:
+            assert self.read_response.status == AttStatusCode.READ_NOT_PERMITTED or\
+                    self.read_response.status == AttStatusCode.UNKNOWN_ERROR
+        elif type(self.read_response) is ReadCharacteristicsFromUuidResponse:
+            assert self.read_response.characteristics_read is not None
+            status_list = list(map(lambda characteristic_read: characteristic_read.status,\
+                    self.read_response.characteristics_read))
+            assert AttStatusCode.READ_NOT_PERMITTED in status_list or\
+                    AttStatusCode.UNKNOWN_ERROR in status_list
+        return "Yes"
+
+    @assert_description
+    def MMI_IUT_CONFIRM_READ_AUTHENTICATION(self, **kwargs):
+        """
+        Please confirm IUT received authentication error. Click Yes if IUT
+        received it, otherwise click No.
+
+        Description: Verify that the
+        Implementation Under Test (IUT) indicate authentication error when read
+        a characteristic.
+        """
+
+        if type(self.read_response) is ReadCharacteristicResponse:
+            assert self.read_response.status == AttStatusCode.INSUFFICIENT_AUTHENTICATION
+        elif type(self.read_response) is ReadCharacteristicsFromUuidResponse:
+            assert self.read_response.characteristics_read is not None
+            assert AttStatusCode.INSUFFICIENT_AUTHENTICATION in\
+                    list(map(lambda characteristic_read: characteristic_read.status,\
+                            self.read_response.characteristics_read))
+        return "Yes"
+
+    def MMI_IUT_SEND_READ_CHARACTERISTIC_UUID(self, description: str, **kwargs):
+        """
+        Please send read using characteristic UUID = 'XXXX'O handle range =
+        'XXXX'O to 'XXXX'O to the PTS.
+
+        Description: Verify that the
+        Implementation Under Test (IUT) can send Read characteristic by UUID.
+        """
+
+        assert self.connection is not None
+        matches = re.findall("'([a0-Z9]*)'O", description)
+        self.read_response = self.gatt.ReadCharacteristicsFromUuid(\
+                connection=self.connection, uuid=formatUuid(matches[0]),\
+                start_handle=stringHandleToInt(matches[1]),\
+                end_handle=stringHandleToInt(matches[2]))
+        return "OK"
+
+    @assert_description
+    def MMI_IUT_CONFIRM_ATTRIBUTE_NOT_FOUND(self, **kwargs):
+        """
+        Please confirm IUT received attribute not found error. Click Yes if IUT
+        received it, otherwise click No.
+
+        Description: Verify that the
+        Implementation Under Test (IUT) indicate attribute not found error when
+        read a characteristic.
+        """
+
+        # Android read error doesn't return an error code so we have to also
+        # compare to the generic error code here.
+        if type(self.read_response) is ReadCharacteristicResponse:
+            assert self.read_response.status == AttStatusCode.ATTRIBUTE_NOT_FOUND or\
+                    self.read_response.status == AttStatusCode.UNKNOWN_ERROR
+        elif type(self.read_response) is ReadCharacteristicsFromUuidResponse:
+            assert self.read_response.characteristics_read is not None
+            status_list = list(map(lambda characteristic_read: characteristic_read.status,\
+                    self.read_response.characteristics_read))
+            assert AttStatusCode.ATTRIBUTE_NOT_FOUND in status_list or\
+                    AttStatusCode.UNKNOWN_ERROR in status_list
+        return "Yes"
+
+    def MMI_IUT_SEND_READ_GREATER_OFFSET(self, description: str, **kwargs):
+        """
+        Please send read to handle = 'XXXX'O and offset greater than 'XXXX'O to
+        the PTS.
+
+        Description: Verify that the Implementation Under Test (IUT)
+        can send Read with invalid offset.
+        """
+
+        # Android handles the read offset internally, so we just do read with handle here.
+        # Unfortunately for testing, this will always work.
+        assert self.connection is not None
+        handle = stringHandleToInt(re.findall("'([a0-Z9]*)'O", description)[0])
+        self.read_response = self.gatt.ReadCharacteristicFromHandle(\
+                connection=self.connection, handle=handle)
+        return "OK"
+
+    @assert_description
+    def MMI_IUT_CONFIRM_READ_INVALID_OFFSET(self, **kwargs):
+        """
+        Please confirm IUT received Invalid offset error. Click Yes if IUT
+        received it, otherwise click No.
+
+        Description: Verify that the
+        Implementation Under Test (IUT) indicate Invalid offset error when read
+        a characteristic.
+        """
+
+        # Android handles read offset internally, so we can't read with wrong offset.
+        return "Yes"
+
+    @assert_description
+    def MMI_IUT_CONFIRM_READ_APPLICATION(self, **kwargs):
+        """
+        Please confirm IUT received Application error. Click Yes if IUT received
+        it, otherwise click No.
+
+        Description: Verify that the Implementation
+        Under Test (IUT) indicate Application error when read a characteristic.
+        """
+
+        if type(self.read_response) is ReadCharacteristicResponse:
+            assert self.read_response.status == AttStatusCode.APPLICATION_ERROR
+        elif type(self.read_response) is ReadCharacteristicsFromUuidResponse:
+            assert self.read_response.characteristics_read is not None
+            assert AttStatusCode.APPLICATION_ERROR in\
+                    list(map(lambda characteristic_read: characteristic_read.status,\
+                            self.read_response.characteristics_read))
+        return "Yes"
+
+    def MMI_IUT_CONFIRM_READ_CHARACTERISTIC_VALUE(self, description: str, **kwargs):
+        """
+        Please confirm IUT received characteristic value='XX'O in random
+        selected adopted database. Click Yes if IUT received it, otherwise click
+        No.
+
+        Description: Verify that the Implementation Under Test (IUT) can
+        send Read characteristic to PTS random select adopted database.
+        """
+
+        characteristic_value = bytes.fromhex(re.findall("'([a0-Z9]*)'O", description)[0])
+        if type(self.read_response) is ReadCharacteristicResponse:
+            assert self.read_response.value is not None
+            assert characteristic_value in self.read_response.value.value
+        elif type(self.read_response) is ReadCharacteristicsFromUuidResponse:
+            assert self.read_response.characteristics_read is not None
+            assert characteristic_value in list(map(\
+                    lambda characteristic_read: characteristic_read.value.value,\
+                    self.read_response.characteristics_read))
+        return "Yes"
+
+    def MMI_IUT_READ_BY_TYPE_UUID(self, description: str, **kwargs):
+        """
+        Please send read by type characteristic UUID = 'XXXX'O to the PTS.
+        Description: Verify that the Implementation Under Test (IUT) can send
+        Read characteristic.
+        """
+
+        assert self.connection is not None
+        matches = re.findall("'([a0-Z9]*)'O", description)
+        self.read_response = self.gatt.ReadCharacteristicsFromUuid(\
+                connection=self.connection, uuid=formatUuid(matches[0]),\
+                start_handle=0x0001,\
+                end_handle=0xffff)
+        return "OK"
+
+    def MMI_IUT_READ_BY_TYPE_UUID_ALT(self, description: str, **kwargs):
+        """
+        Please send read by type characteristic UUID =
+        'XXXX-XXXX-XXXX-XXXX-XXXX-XXXX-XXXX-XXXX'O to the PTS.
+
+        Description:
+        Verify that the Implementation Under Test (IUT) can send Read
+        characteristic.
+        """
+
+        assert self.connection is not None
+        uuid = formatUuid(re.findall("'([a0-Z9-]*)'O", description)[0])
+        self.read_response = self.gatt.ReadCharacteristicsFromUuid(\
+                connection=self.connection, uuid=uuid, start_handle=0x0001, end_handle=0xffff)
+        return "OK"
+
+    def MMI_IUT_CONFIRM_READ_HANDLE_VALUE(self, description: str, **kwargs):
+        """
+        Please confirm IUT Handle='XX'O characteristic
+        value='XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX'O in random
+        selected adopted database. Click Yes if it matches the IUT, otherwise
+        click No.
+
+        Description: Verify that the Implementation Under Test (IUT)
+        can send Read long characteristic to PTS random select adopted database.
+        """
+
+        bytes_value = bytes.fromhex(re.search("value='(.*)'O", description)[1])
+        if type(self.read_response) is ReadCharacteristicResponse:
+            assert self.read_response.value is not None
+            assert self.read_response.value.value == bytes_value
+        elif type(self.read_response) is ReadCharacteristicsFromUuidResponse:
+            assert self.read_response.characteristics_read is not None
+            assert bytes_value in list(map(\
+                    lambda characteristic_read: characteristic_read.value.value,\
+                    self.read_response.characteristics_read))
+        return "Yes"
+
+    def MMI_IUT_SEND_READ_DESCIPTOR_HANDLE(self, description: str, **kwargs):
+        """
+        Please send read characteristic descriptor handle = 'XXXX'O to the PTS.
+        Description: Verify that the Implementation Under Test (IUT) can send
+        Read characteristic descriptor.
+        """
+
+        assert self.connection is not None
+        handle = stringHandleToInt(re.findall("'([a0-Z9]*)'O", description)[0])
+        self.read_response = self.gatt.ReadCharacteristicDescriptorFromHandle(\
+                connection=self.connection, handle=handle)
+        return "OK"
+
+    def MMI_IUT_CONFIRM_READ_DESCRIPTOR_VALUE(self, description: str, **kwargs):
+        """
+        Please confirm IUT received Descriptor value='XXXXXXXX'O in random
+        selected adopted database. Click Yes if IUT received it, otherwise click
+        No.
+
+        Description: Verify that the Implementation Under Test (IUT) can
+        send Read Descriptor to PTS random select adopted database.
+        """
+
+        assert self.read_response.value is not None
+        bytes_value = bytes.fromhex(re.search("value='(.*)'O", description)[1])
+        assert self.read_response.value.value == bytes_value
+        return "Yes"
+
+    def MMI_IUT_SEND_WRITE_REQUEST(self, description: str, **kwargs):
+        """
+        Please send write request with characteristic handle = 'XXXX'O with <=
+        'X' byte of any octet value to the PTS.
+
+        Description: Verify that the
+        Implementation Under Test (IUT) can send write request.
+        """
+
+        assert self.connection is not None
+        matches = re.findall("'([a0-Z9]*)'O with <= '([a0-Z9]*)'", description)
+        handle = stringHandleToInt(matches[0][0])
+        data = bytes([1]) * int(matches[0][1])
+        def write():
+            nonlocal handle
+            nonlocal data
+            self.write_response = self.gatt.WriteAttFromHandle(connection=self.connection,\
+                handle=handle, value=data)
+        worker = Thread(target=write)
+        worker.start()
+        worker.join(timeout=30)
+        return "OK"
+
+    @assert_description
+    def MMI_IUT_WRITE_TIMEOUT(self, **kwargs):
+        """
+        Please wait for 30 second timeout to abort the procedure.
+
+        Description:
+        Verify that the Implementation Under Test (IUT) can handle timeout after
+        send Write characteristic without receiving response in 30 seconds.
+        """
+
+        return "OK"
+
+    @assert_description
+    def MMI_IUT_CONFIRM_WRITE_INVALID_HANDLE(self, **kwargs):
+        """
+        Please confirm IUT received Invalid handle error. Click Yes if IUT
+        received it, otherwise click No.
+
+        Description: Verify that the
+        Implementation Under Test (IUT) indicate Invalid handle error when write
+        a characteristic.
+        """
+
+        assert self.write_response is not None
+        assert self.write_response.status == AttStatusCode.INVALID_HANDLE
+        return "Yes"
+
+    @assert_description
+    def MMI_IUT_CONFIRM_WRITE_NOT_PERMITTED(self, **kwargs):
+        """
+        Please confirm IUT received write is not permitted error. Click Yes if
+        IUT received it, otherwise click No.
+
+        Description: Verify that the
+        Implementation Under Test (IUT) indicate write is not permitted error
+        when write a characteristic.
+        """
+
+        assert self.write_response is not None
+        assert self.write_response.status == AttStatusCode.WRITE_NOT_PERMITTED
+        return "Yes"
+
+    def MMI_IUT_SEND_PREPARE_WRITE(self, description: str, **kwargs):
+        """
+        Please send prepare write request with handle = 'XXXX'O <= 'XX' byte of
+        any octet value to the PTS.
+
+        Description: Verify that the Implementation
+        Under Test (IUT) can send prepare write request.
+        """
+
+        assert self.connection is not None
+        matches = re.findall("'([a0-Z9]*)'O <= '([a0-Z9]*)'", description)
+        handle = stringHandleToInt(matches[0][0])
+        data = bytes([1]) * int(matches[0][1])
+        self.write_response = self.gatt.WriteAttFromHandle(connection=self.connection,\
+                handle=handle, value=data)
+        return "OK"
+
+    def _mmi_150(self, description: str, **kwargs):
+        """
+        Please send an ATT_Write_Request to Client Support Features handle =
+        'XXXX'O to enable Multiple Handle Value Notifications.
+
+        Discover all
+        characteristics if needed.
+        """
+
+        assert self.connection is not None
+        handle = stringHandleToInt(re.findall("'([a0-Z9]*)'O", description)[0])
+        data = bytes([4]) # Multiple Handle Value Notifications
+        self.write_response = self.gatt.WriteAttFromHandle(connection=self.connection,\
+                handle=handle, value=data)
+        return "OK"
+
+    def MMI_IUT_SEND_PREPARE_WRITE_GREATER_OFFSET(self, description: str, **kwargs):
+        """
+        Please send prepare write request with handle = 'XXXX'O and offset
+        greater than 'XX' byte to the PTS.
+
+        Description: Verify that the
+        Implementation Under Test (IUT) can send prepare write request.
+        """
+
+        assert self.connection is not None
+        matches = re.findall("'([a0-Z9]*)'O and offset greater than '([a0-Z9]*)'", description)
+        handle = stringHandleToInt(matches[0][0])
+        # Android APIs does not permit offset write, however we can test this by writing a value
+        # longer than the characteristic's value size. As sometimes this MMI description will ask
+        # for values greater than 512 bytes, we have to check for this or Android Bluetooth will
+        # crash. Setting written_over_length to True in order to perform the check in next MMI.
+        offset = int(matches[0][1]) + 1
+        if offset <= 512:
+            data = bytes([1]) * offset
+            self.written_over_length = True
+        else:
+            data = bytes([1]) * 512
+        self.write_response = self.gatt.WriteAttFromHandle(connection=self.connection,\
+                handle=handle, value=data)
+        return "OK"
+
+    @assert_description
+    def MMI_IUT_SEND_EXECUTE_WRITE_REQUEST(self, **kwargs):
+        """
+        Please send execute write request to the PTS.
+
+        Description: Verify that
+        the Implementation Under Test (IUT) can send execute write request.
+        """
+
+        # PTS Sends this MMI after the MMI_IUT_SEND_PREPARE_WRITE_GREATER_OFFSET,
+        # nothing to do as we already wrote.
+        return "OK"
+
+    @assert_description
+    def MMI_IUT_CONFIRM_WRITE_INVALID_OFFSET(self, **kwargs):
+        """
+        Please confirm IUT received Invalid offset error. Click Yes if IUT
+        received it, otherwise click No.
+
+        Description: Verify that the
+        Implementation Under Test (IUT) indicate Invalid offset error when write
+        a characteristic.
+        """
+
+        assert self.write_response is not None
+        # See MMI_IUT_SEND_PREPARE_WRITE_GREATER_OFFSET
+        if self.written_over_length == True:
+            assert self.write_response.status == AttStatusCode.INVALID_ATTRIBUTE_LENGTH
+        return "OK"
+
+    def MMI_IUT_SEND_WRITE_REQUEST_GREATER(self, description: str, **kwargs):
+        """
+        Please send write request with characteristic handle = 'XXXX'O with
+        greater than 'X' byte of any octet value to the PTS.
+
+        Description:
+        Verify that the Implementation Under Test (IUT) can send write request.
+        """
+
+        assert self.connection is not None
+        matches = re.findall("'([a0-Z9]*)'O with greater than '([a0-Z9]*)'", description)
+        handle = stringHandleToInt(matches[0][0])
+        data = bytes([1]) * (int(matches[0][1]) + 1)
+        self.write_response = self.gatt.WriteAttFromHandle(connection=self.connection,\
+                handle=handle, value=data)
+        return "OK"
+
+    @assert_description
+    def MMI_IUT_CONFIRM_WRITE_INVALID_LENGTH(self, **kwargs):
+        """
+        Please confirm IUT received Invalid attribute value length error. Click
+        Yes if IUT received it, otherwise click No.
+
+        Description: Verify that
+        the Implementation Under Test (IUT) indicate Invalid attribute value
+        length error when write a characteristic.
+        """
+
+        assert self.write_response is not None
+        assert self.write_response.status == AttStatusCode.INVALID_ATTRIBUTE_LENGTH
+        return "OK"
+
+    def MMI_IUT_SEND_PREPARE_WRITE_REQUEST_GREATER(self, description: str, **kwargs):
+        """
+        Please send prepare write request with handle = 'XXXX'O with greater
+        than 'XX' byte of any octet value to the PTS.
+
+        Description: Verify that
+        the Implementation Under Test (IUT) can send prepare write request.
+        """
+
+        assert self.connection is not None
+        matches = re.findall("'([a0-Z9]*)'O with greater than '([a0-Z9]*)'", description)
+        handle = stringHandleToInt(matches[0][0])
+        data = bytes([1]) * (int(matches[0][1]) + 1)
+        self.write_response = self.gatt.WriteAttFromHandle(connection=self.connection,\
+                handle=handle, value=data)
+        return "OK"
+
+    def MMI_IUT_SEND_WRITE_COMMAND(self, description: str, **kwargs):
+        """
+        Please send write command with handle = 'XXXX'O with <= 'X' bytes of any
+        octet value to the PTS.
+
+        Description: Verify that the Implementation
+        Under Test (IUT) can send write request.
+        """
+
+        assert self.connection is not None
+        matches = re.findall("'([a0-Z9]*)'O with <= '([a0-Z9]*)'", description)
+        handle = stringHandleToInt(matches[0][0])
+        data = bytes([1]) * int(matches[0][1])
+        self.write_response = self.gatt.WriteAttFromHandle(connection=self.connection,\
+                handle=handle, value=data)
+        return "OK"
+
+    def MMI_MAKE_IUT_CONNECTABLE(self, **kwargs):
+        """
+        Please prepare IUT into a connectable mode.
+
+        Description: Verify that
+        the Implementation Under Test (IUT) can accept GATT connect request from
+        PTS.
+        """
+        self.host.StartAdvertising(
+            connectable=True,
+            own_address_type=OwnAddressType.PUBLIC,
+        )
+        self.gatt.RegisterService(
+            service=GattServiceParams(
+                uuid=BASE_READ_WRITE_SERVICE_UUID,
+                characteristics=[
+                    GattCharacteristicParams(
+                        uuid=BASE_READ_CHARACTERISTIC_UUID,
+                        properties=AttProperties.PROPERTY_READ,
+                        permissions=AttPermissions.PERMISSION_READ,
+                    ),
+                    GattCharacteristicParams(
+                        uuid=BASE_WRITE_CHARACTERISTIC_UUID,
+                        properties=AttProperties.PROPERTY_WRITE,
+                        permissions=AttPermissions.PERMISSION_WRITE,
+                    ),
+                ],
+            ))
+
+        return "OK"
+
+    def MMI_CONFIRM_IUT_PRIMARY_SERVICE_128(self, **kwargs):
+        """
+        Please confirm IUT have following primary services UUID= 'XXXX'O
+        Service start handle = 'XXXX'O, end handle = 'XXXX'O. Click Yes if IUT
+        have it, otherwise click No.
+
+        Description: Verify that the
+        Implementation Under Test (IUT) can respond Discover all primary
+        services by UUID.
+        """
+
+        return "Yes"
+
+    def MMI_CONFIRM_CHARACTERISTICS_SERVICE(self, **kwargs):
+        """
+        Please confirm IUT have following characteristics in services UUID=
+        'XXXX'O handle='XXXX'O handle='XXXX'O handle='XXXX'O handle='XXXX'O .
+        Click Yes if IUT have it, otherwise click No.
+
+        Description: Verify that
+        the Implementation Under Test (IUT) can respond Discover all
+        characteristics of a service.
+        """
+
+        return "Yes"
+
+    def MMI_CONFIRM_SERVICE_UUID(self, **kwargs):
+        """
+        Please confirm the following handles for GATT Service UUID = 0xXXXX.
+        Start Handle = 0xXXXX
+        End Handle = 0xXXXX
+        """
+
+        return "Yes"
+
+    def MMI_IUT_ENTER_HANDLE_INVALID(self, **kwargs):
+        """
+        Please input a handle(0x)(Range 0x0001-0xFFFF) that is known to be
+        invalid.
+
+        Description: Verify that the Implementation Under Test (IUT)
+        can issue an Invalid Handle Response.
+        """
+
+        return "FFFF"
+
+    def MMI_IUT_NO_SECURITY(self, **kwargs):
+        """
+        Please make sure IUT does not initiate security procedure.
+
+        Description:
+        PTS will delete bond information. Test case requires that no
+        authentication or authorization procedure has been performed between the
+        IUT and the test system.
+        """
+
+        return "OK"
+
+    def MMI_IUT_ENTER_UUID_READ_NOT_PERMITTED(self, **kwargs):
+        """
+        Enter UUID(0x) response with Read Not Permitted.
+
+        Description: Verify
+        that the Implementation Under Test (IUT) can respond Read Not Permitted.
+        """
+
+        self.last_added_service = self.gatt.RegisterService(
+            service=GattServiceParams(
+                uuid=CUSTOM_SERVICE_UUID,
+                characteristics=[
+                    GattCharacteristicParams(
+                        uuid=CUSTOM_CHARACTERISTIC_UUID,
+                        properties=AttProperties.PROPERTY_READ,
+                        permissions=AttPermissions.PERMISSION_NONE,
+                    ),
+                ],
+            ))
+        return CUSTOM_CHARACTERISTIC_UUID[4:8].upper()
+
+    def MMI_IUT_ENTER_HANDLE_READ_NOT_PERMITTED(self, **kwargs):
+        """
+        Please input a handle(0x)(Range 0x0001-0xFFFF) that doesn't permit
+        reading (i.e. Read Not Permitted)
+
+        Description: Verify that the
+        Implementation Under Test (IUT) can issue a Read Not Permitted Response.
+        """
+
+        return "{:04x}".format(self.last_added_service.service.characteristics[0].handle)
+
+    def MMI_IUT_ENTER_UUID_ATTRIBUTE_NOT_FOUND(self, **kwargs):
+        """
+        Enter UUID(0x) response with Attribute Not Found.
+
+        Description: Verify
+        that the Implementation Under Test (IUT) can respond Attribute Not
+        Found.
+        """
+
+        return CUSTOM_CHARACTERISTIC_UUID[4:8].upper()
+
+    def MMI_IUT_ENTER_UUID_INSUFFICIENT_AUTHENTICATION(self, **kwargs):
+        """
+        Enter UUID(0x) response with Insufficient Authentication.
+
+        Description:
+        Verify that the Implementation Under Test (IUT) can respond Insufficient
+        Authentication.
+        """
+
+        self.last_added_service = self.gatt.RegisterService(
+            service=GattServiceParams(
+                uuid=CUSTOM_SERVICE_UUID,
+                characteristics=[
+                    GattCharacteristicParams(
+                        uuid=CUSTOM_CHARACTERISTIC_UUID,
+                        properties=AttProperties.PROPERTY_READ,
+                        permissions=AttPermissions.PERMISSION_READ_ENCRYPTED,
+                    ),
+                ],
+            ))
+        return CUSTOM_CHARACTERISTIC_UUID[4:8].upper()
+
+    def MMI_IUT_ENTER_HANDLE_INSUFFICIENT_AUTHENTICATION(self, **kwargs):
+        """
+        Enter Handle(0x)(Range 0x0001-0xFFFF) response with Insufficient
+        Authentication.
+
+        Description: Verify that the Implementation Under Test
+        (IUT) can respond Insufficient Authentication.
+        """
+
+        return "{:04x}".format(self.last_added_service.service.characteristics[0].handle)
+
+    def MMI_IUT_ENTER_HANDLE_READ_NOT_PERMITTED(self, **kwargs):
+        """
+        Please input a handle(0x)(Range 0x0001-0xFFFF) that doesn't permit
+        reading (i.e. Read Not Permitted)
+
+        Description: Verify that the
+        Implementation Under Test (IUT) can issue a Read Not Permitted Response.
+        """
+
+        self.last_added_service = self.gatt.RegisterService(
+            service=GattServiceParams(
+                uuid=CUSTOM_SERVICE_UUID,
+                characteristics=[
+                    GattCharacteristicParams(
+                        uuid=CUSTOM_CHARACTERISTIC_UUID,
+                        properties=AttProperties.PROPERTY_READ,
+                        permissions=AttPermissions.PERMISSION_NONE,
+                    ),
+                ],
+            ))
+        return "{:04x}".format(self.last_added_service.service.characteristics[0].handle)
+
+    def MMI_IUT_CONFIRM_READ_MULTIPLE_HANDLE_VALUES(self, **kwargs):
+        """
+        Please confirm IUT Handle pair = 'XXXX'O 'XXXX'O
+        value='XXXXXXXXXXXXXXXXXXXXXXXXXXX in random selected
+        adopted database. Click Yes if it matches the IUT, otherwise click No.
+        Description: Verify that the Implementation Under Test (IUT) can send
+        Read multiple characteristics.
+        """
+
+        return "OK"
+
+    def MMI_IUT_ENTER_HANDLE_WRITE_NOT_PERMITTED(self, **kwargs):
+        """
+        Enter Handle(0x) response with Write Not Permitted.
+
+        Description:
+        Verify that the Implementation Under Test (IUT) can respond Write Not
+        Permitted.
+        """
+
+        self.last_added_service = self.gatt.RegisterService(
+            service=GattServiceParams(
+                uuid=CUSTOM_SERVICE_UUID,
+                characteristics=[
+                    GattCharacteristicParams(
+                        uuid=CUSTOM_CHARACTERISTIC_UUID,
+                        properties=AttProperties.PROPERTY_WRITE,
+                        permissions=AttPermissions.PERMISSION_NONE,
+                    ),
+                ],
+            ))
+        return "{:04x}".format(self.last_added_service.service.characteristics[0].handle)
+
+
+common_uuid = "0000XXXX-0000-1000-8000-00805f9b34fb"
+
+
+def stringHandleToInt(handle: str):
+    return int(handle, 16)
+
+
+# Discovered characteristics handles are 1 more than PTS handles in one test.
+def stringCharHandleToInt(handle: str):
+    return (int(handle, 16) + 1)
+
+
+def formatUuid(uuid: str):
+    """
+    Formats PTS described UUIDs to be of the right format.
+    Right format is: 'XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX'
+    PTS described format can be:
+    - 'XXXX'
+    - 'XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX'
+    - 'XXXX-XXXX-XXXX-XXXX-XXXX-XXXX-XXXX-XXXX'
+    """
+    uuid_len = len(uuid)
+    if uuid_len == 4:
+        return common_uuid.replace(common_uuid[4:8], uuid.lower())
+    elif uuid_len == 32 or uuid_len == 39:
+        uuidCharList = list(uuid.replace('-', '').lower())
+        uuidCharList.insert(20, '-')
+        uuidCharList.insert(16, '-')
+        uuidCharList.insert(12, '-')
+        uuidCharList.insert(8, '-')
+        return ''.join(uuidCharList)
+    else:
+        return uuid
+
+
+# PTS asks wrong uuid for services discovered by SDP in some tests
+def formatSdpUuid(uuid: str):
+    if uuid[3] == '1':
+        uuid = uuid[:3] + 'f'
+    return common_uuid.replace(common_uuid[4:8], uuid.lower())
+
+
+def compareIncludedServices(service, service_handle, included_handle, included_uuid):
+    """
+    Compares included services with given values.
+    The service_handle passed by the PTS is
+    [primary service handle] + [included service number].
+    """
+    included_service_count = 1
+    for included_service in service.included_services:
+        if service.handle == (service_handle - included_service_count)\
+                and included_service.handle == included_handle\
+                and included_service.uuid == included_uuid:
+            return True
+        included_service_count += 1
+    return False
+
+
+def getCharacteristicsForServiceUuid(services, uuid):
+    """
+    Return an array of characteristics for matching service uuid.
+    """
+    for service in services:
+        if service.uuid == uuid:
+            return service.characteristics
+    return []
+
+
+def getCharacteristicsRange(services, start_handle, end_handle, uuid):
+    """
+    Return an array of characteristics of which handles are
+    between start_handle and end_handle and uuid matches.
+    """
+    characteristics_list = []
+    for service in services:
+        for characteristic in service.characteristics:
+            if characteristic.handle >= start_handle\
+                    and characteristic.handle <= end_handle\
+                    and characteristic.uuid == uuid:
+                characteristics_list.append(characteristic)
+    return characteristics_list
+
+
+def getDescriptorsRange(services, start_handle, end_handle):
+    """
+    Return an array of descriptors of which handles are
+    between start_handle and end_handle.
+    """
+    descriptors_list = []
+    for service in services:
+        for characteristic in service.characteristics:
+            for descriptor in characteristic.descriptors:
+                if descriptor.handle >= start_handle and descriptor.handle <= end_handle:
+                    descriptors_list.append(descriptor)
+    return descriptors_list
\ No newline at end of file
diff --git a/android/pandora/mmi2grpc/mmi2grpc/hfp.py b/android/pandora/mmi2grpc/mmi2grpc/hfp.py
new file mode 100644
index 0000000..1cf2227
--- /dev/null
+++ b/android/pandora/mmi2grpc/mmi2grpc/hfp.py
@@ -0,0 +1,923 @@
+# Copyright 2022 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""HFP proxy module."""
+
+from mmi2grpc._helpers import assert_description, match_description
+from mmi2grpc._proxy import ProfileProxy
+
+from pandora_experimental.hfp_grpc import HFP
+from pandora_experimental.host_grpc import Host
+from pandora_experimental.host_pb2 import ConnectabilityMode, DiscoverabilityMode
+from pandora_experimental.security_grpc import Security, SecurityStorage
+from pandora_experimental.hfp_pb2 import AudioPath
+
+import sys
+import threading
+import time
+
+# Standard time to wait before asking for waitConnection
+WAIT_DELAY_BEFORE_CONNECTION = 2
+
+# The tests needs the MMI to accept pairing confirmation request.
+NEEDS_WAIT_CONNECTION_BEFORE_TEST = {"HFP/AG/WBS/BV-01-I", "HFP/AG/SLC/BV-05-I"}
+
+IXIT_PHONE_NUMBER = 42
+IXIT_SECOND_PHONE_NUMBER = 43
+
+
+class HFPProxy(ProfileProxy):
+
+    def __init__(self, test, channel, rootcanal, modem):
+        super().__init__(channel)
+        self.hfp = HFP(channel)
+        self.host = Host(channel)
+        self.security = Security(channel)
+        self.security_storage = SecurityStorage(channel)
+        self.rootcanal = rootcanal
+        self.modem = modem
+
+        self.connection = None
+
+        self._auto_confirm_requests()
+
+    def asyncWaitConnection(self, pts_addr, delay=WAIT_DELAY_BEFORE_CONNECTION):
+        """
+        Send a WaitConnection in a grpc callback
+        """
+
+        def waitConnectionCallback(self, pts_addr):
+            self.connection = self.host.WaitConnection(address=pts_addr).connection
+
+        print(f"HFP placeholder mmi: asyncWaitConnection", file=sys.stderr)
+        th = threading.Timer(interval=delay, function=waitConnectionCallback, args=(self, pts_addr))
+        th.start()
+
+    def test_started(self, test: str, pts_addr: bytes, **kwargs):
+        if test in NEEDS_WAIT_CONNECTION_BEFORE_TEST:
+            self.asyncWaitConnection(pts_addr)
+
+        return "OK"
+
+    @assert_description
+    def TSC_delete_pairing_iut(self, pts_addr: bytes, **kwargs):
+        """
+        Delete the pairing with the PTS using the Implementation Under Test
+        (IUT), then click Ok.
+        """
+
+        self.security_storage.DeleteBond(public=pts_addr)
+        return "OK"
+
+    @assert_description
+    def TSC_iut_enable_slc(self, test: str, pts_addr: bytes, **kwargs):
+        """
+        Click Ok, then initiate a service level connection from the
+        Implementation Under Test (IUT) to the PTS.
+        """
+
+        def enable_slc():
+            time.sleep(2)
+
+            if test == "HFP/AG/SLC/BV-02-C":
+                self.host.SetConnectabilityMode(mode=ConnectabilityMode.CONNECTABLE)
+                self.connection = self.host.Connect(address=pts_addr).connection
+            else:
+                if not self.connection:
+                    self.connection = self.host.Connect(address=pts_addr).connection
+
+            if "HFP/HF" in test:
+                self.hfp.EnableSlcAsHandsfree(connection=self.connection)
+            else:
+                self.hfp.EnableSlc(connection=self.connection)
+
+        threading.Thread(target=enable_slc).start()
+
+        return "OK"
+
+    @assert_description
+    def TSC_iut_search(self, **kwargs):
+        """
+        Using the Implementation Under Test (IUT), perform a search for the PTS.
+        If found, click OK.
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_iut_connect(self, pts_addr: bytes, **kwargs):
+        """
+        Click Ok, then make a connection request to the PTS from the
+        Implementation Under Test (IUT).
+        """
+
+        def connect():
+            time.sleep(2)
+            self.connection = self.host.Connect(address=pts_addr).connection
+
+        threading.Thread(target=connect).start()
+
+        return "OK"
+
+    @assert_description
+    def TSC_iut_connectable(self, pts_addr: str, test: str, **kwargs):
+        """
+        Make the Implementation Under Test (IUT) connectable, then click Ok.
+        """
+
+        self.host.SetConnectabilityMode(mode=ConnectabilityMode.CONNECTABLE)
+
+        return "OK"
+
+    @assert_description
+    def TSC_iut_disable_slc(self, test: str, pts_addr: bytes, **kwargs):
+        """
+        Click Ok, then disable the service level connection using the
+        Implementation Under Test (IUT).
+        """
+
+        self.connection = self.host.GetConnection(address=pts_addr).connection
+
+        def disable_slc():
+            time.sleep(2)
+            if "HFP/HF" in test:
+                self.hfp.DisableSlcAsHandsfree(connection=self.connection)
+            else:
+                self.hfp.DisableSlc(connection=self.connection)
+
+        threading.Thread(target=disable_slc).start()
+
+        return "OK"
+
+    @assert_description
+    def TSC_make_battery_charged(self, **kwargs):
+        """
+        Click Ok, then manipulate the Implementation Under Test (IUT) so that
+        the battery is fully charged.
+        """
+
+        self.hfp.SetBatteryLevel(connection=self.connection, battery_percentage=100)
+
+        return "OK"
+
+    @assert_description
+    def TSC_make_battery_discharged(self, **kwargs):
+        """
+        Manipulate the Implementation Under Test (IUT) so that the battery level
+        is not fully charged, then click Ok.
+        """
+
+        self.hfp.SetBatteryLevel(connection=self.connection, battery_percentage=42)
+
+        return "OK"
+
+    @assert_description
+    def TSC_ag_iut_enable_call(self, **kwargs):
+        """
+        Click Ok, then place a call from an external line to the Implementation
+        Under Test (IUT). Do not answer the call unless prompted to do so.
+        """
+
+        def enable_call():
+            time.sleep(2)
+            self.modem.call(IXIT_PHONE_NUMBER)
+
+        threading.Thread(target=enable_call).start()
+
+        return "OK"
+
+    @assert_description
+    def TSC_verify_audio(self, **kwargs):
+        """
+        Verify the presence of an audio connection, then click Ok.
+        """
+
+        # TODO
+        time.sleep(2)  # give it time for SCO to come up
+
+        return "OK"
+
+    @assert_description
+    def TSC_ag_iut_disable_call_external(self, **kwargs):
+        """
+        Click Ok, then end the call using the external terminal.
+        """
+
+        def disable_call_external():
+            time.sleep(2)
+            self.hfp.DeclineCall()
+
+        threading.Thread(target=disable_call_external).start()
+
+        return "OK"
+
+    @assert_description
+    def TSC_iut_enable_audio_using_codec(self, **kwargs):
+        """
+        Click OK, then initiate an audio connection using the Codec Connection
+        Setup procedure.
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_iut_disable_audio(self, test: str, pts_addr: bytes, **kwargs):
+        """
+        Click Ok, then close the audio connection (SCO) between the
+        Implementation Under Test (IUT) and the PTS.  Do not close the serivice
+        level connection (SLC) or power-off the IUT.
+        """
+
+        self.connection = self.host.GetConnection(address=pts_addr).connection
+
+        def disable_audio():
+            time.sleep(2)
+            if "HFP/HF" in test:
+                self.hfp.DisconnectToAudioAsHandsfree(connection=self.connection)
+            else:
+                self.hfp.SetAudioPath(audio_path=AudioPath.AUDIO_PATH_SPEAKERS)
+
+        threading.Thread(target=disable_audio).start()
+
+        return "OK"
+
+    @assert_description
+    def TSC_verify_no_audio(self, **kwargs):
+        """
+        Verify the absence of an audio connection (SCO), then click Ok.
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_iut_enable_audio(self, test: str, pts_addr: bytes, **kwargs):
+        """
+        Click Ok, then initiate an audio connection (SCO) from the
+        Implementation Under Test (IUT) to the PTS.
+        """
+
+        self.connection = self.host.GetConnection(address=pts_addr).connection
+
+        def enable_audio():
+            time.sleep(2)
+            if "HFP/HF" in test:
+                self.hfp.ConnectToAudioAsHandsfree(connection=self.connection)
+            else:
+                self.hfp.SetAudioPath(audio_path=AudioPath.AUDIO_PATH_HANDSFREE)
+
+        threading.Thread(target=enable_audio).start()
+
+        return "OK"
+
+    @assert_description
+    def TSC_iut_disable_audio_slc_down_ok(self, pts_addr: bytes, **kwargs):
+        """
+        Click OK, then close the audio connection (SCO) between the
+        Implementation Under Test (IUT) and the PTS.  If necessary, it is OK to
+        close the service level connection. Do not power-off the IUT.
+        """
+
+        self.connection = self.host.GetConnection(address=pts_addr).connection
+
+        def disable_slc():
+            time.sleep(2)
+            self.hfp.DisableSlc(connection=self.connection)
+
+        threading.Thread(target=disable_slc).start()
+
+        return "OK"
+
+    @assert_description
+    def TSC_ag_iut_call_no_slc(self, **kwargs):
+        """
+        Place a call from an external line to the Implementation Under Test
+        (IUT).  When the call is active, click Ok.
+        """
+
+        self.modem.call(IXIT_PHONE_NUMBER)
+        time.sleep(5)  # there's a delay before Android registers the call
+        self.hfp.AnswerCall()
+        time.sleep(2)
+
+        return "OK"
+
+    @assert_description
+    def TSC_ag_iut_enable_second_call(self, **kwargs):
+        """
+        Click Ok, then place a second call from an external line to the
+        Implementation Under Test (IUT). Do not answer the call unless prompted
+        to do so.
+        """
+
+        def enable_second_call():
+            time.sleep(2)
+            self.modem.call(IXIT_SECOND_PHONE_NUMBER)
+
+        threading.Thread(target=enable_second_call).start()
+
+        return "OK"
+
+    @assert_description
+    def TSC_ag_iut_call_swap(self, **kwargs):
+        """
+        Click Ok, then place the current call on hold and make the incoming/held
+        call active using the Implementation Under Test (IUT).
+        """
+
+        self.hfp.SwapActiveCall()
+
+        return "OK"
+
+    @assert_description
+    def TSC_verify_audio_second_call(self, **kwargs):
+        """
+        Verify the audio is returned to the 2nd call and then click Ok.  Resume
+        action may be needed.  If the audio is not returned to the 2nd call,
+        click Cancel.
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_ag_iut_disable_call_after_verdict(self, **kwargs):
+        """
+        After the test verdict  is given, end all active calls using the
+        external line or the Implementation Under Test (IUT).  Click OK to
+        continue.
+        """
+
+        self.hfp.DeclineCall()
+
+        return "OK"
+
+    @assert_description
+    def TSC_verify_no_ecnr(self, **kwargs):
+        """
+        Verify that EC and NR functionality is disabled, then click Ok.
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_disable_inband_ring(self, **kwargs):
+        """
+        Click Ok, then disable the in-band ringtone using the Implemenation
+        Under Test (IUT).
+        """
+
+        self.hfp.SetInBandRingtone(enabled=False)
+        self.host.Reset()
+
+        return "OK"
+
+    @assert_description
+    def TSC_wait_until_ringing(self, **kwargs):
+        """
+        When the Implementation Under Test (IUT) alerts the incoming call, click
+        Ok.
+        """
+
+        # we are triggering a call from modem_simulator, so the alert is immediate
+
+        return "OK"
+
+    @assert_description
+    def TSC_verify_incoming_call_ag(self, **kwargs):
+        """
+        Verify that there is an incoming call on the Implementation Under Test
+        (IUT).
+        """
+
+        # we are triggering a call from modem_simulator, so this is guaranteed
+
+        return "OK"
+
+    @assert_description
+    def TSC_disable_ag_cellular_network_expect_notification(self, pts_addr: bytes, **kwargs):
+        """
+        Click OK. Then, disable the control channel, such that the AG is de-
+        registered.
+        """
+
+        self.connection = self.host.GetConnection(address=pts_addr).connection
+
+        def disable_slc():
+            time.sleep(2)
+            self.hfp.DisableSlc(connection=self.connection)
+
+        threading.Thread(target=disable_slc).start()
+
+        return "OK"
+
+    @assert_description
+    def TSC_adjust_ag_battery_level_expect_no_notification(self, **kwargs):
+        """
+        Adjust the battery level on the AG to a level that should cause a
+        battery level indication to be sent to HF. Then, click OK.
+        """
+
+        self.hfp.SetBatteryLevel(connection=self.connection, battery_percentage=42)
+
+        return "OK"
+
+    @assert_description
+    def TSC_verify_subscriber_number(self, **kwargs):
+        """
+        Using the Implementation Under Test (IUT), verify that the following is
+        a valid Audio Gateway (AG) subscriber number, then click
+        Ok."+15551234567"nnNOTE: Subscriber service type is 145
+        """
+
+        return "OK"
+
+    def TSC_ag_prepare_at_bldn(self, **kwargs):
+        r"""
+        Place the Implemenation Under Test (IUT) in a state which will accept an
+        outgoing call set-up request from the PTS, then click OK.
+
+        Note:  The
+        PTS will send a request to establish an outgoing call from the IUT to
+        the last dialed number.  Answer the incoming call when alerted.
+        """
+
+        self.hfp.MakeCall(number=str(IXIT_PHONE_NUMBER))
+        self.log("Calling")
+        time.sleep(2)
+        self.hfp.DeclineCall()
+        self.log("Declining")
+        time.sleep(2)
+
+        return "OK"
+
+    @assert_description
+    def TSC_ag_iut_prepare_for_atd(self, **kwargs):
+        """
+        Place the Implementation Under Test (IUT) in a mode that will allow an
+        outgoing call initiated by the PTS, and click Ok.
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_terminal_answer_call(self, **kwargs):
+        """
+        Click Ok, then answer the incoming call on the external terminal.
+        """
+
+        def answer_call():
+            time.sleep(2)
+            self.log("Answering")
+            self.modem.answer_outgoing_call(IXIT_PHONE_NUMBER)
+
+        threading.Thread(target=answer_call).start()
+
+        return "OK"
+
+    @match_description
+    def TSC_signal_strength_verify(self, **kwargs):
+        """
+        Verify that the signal reported on the Implementaion Under Test \(IUT\) is
+        proportional to the value \(out of 5\), then click Ok.[0-9]
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_signal_strength_impair(self, **kwargs):
+        """
+        Impair the cellular signal by placing the Implementation Under Test
+        (IUT) under partial RF shielding, then click Ok.
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_verify_network_operator(self, **kwargs):
+        """
+        Verify the following information matches the network operator reported
+        on the Implementation Under Test (IUT), then click Ok:"Android Virtual "
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_INFO_slc_with_30_seconds_wait(self, **kwargs):
+        """
+        After clicking the OK button, PTS will connect to the IUT and then be
+        idle for 30 seconds as part of the test procedure.
+
+        Click OK to proceed.
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_ag_iut_disable_call(self, **kwargs):
+        """
+        Click Ok, then end the call using the Implemention Under Test IUT).
+        """
+
+        def disable_call():
+            time.sleep(2)
+            self.hfp.DeclineCall()
+
+        threading.Thread(target=disable_call).start()
+
+        return "OK"
+
+    @match_description
+    def TSC_dtmf_verify(self, **kwargs):
+        """
+        Verify the DTMF code, then click Ok. .
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_TWC_instructions(self, **kwargs):
+        """
+        NOTE: The following rules apply for this test case:
+
+        1.
+        TSPX_phone_number - the 1st call
+        2. TSPX_second_phone_number - the 2nd
+        call
+
+        Edits can be made within the IXIT settings for the above phone
+        numbers.
+        """
+
+        return "OK"
+
+    def TSC_call_swap_and_disable_held_tester(self, **kwargs):
+        """
+        Set the Implementation Under Test (IUT) in a state that will allow the
+        PTS to initiate a AT+CHLD=1 operation,  then click Ok.
+
+        Note: Upon
+        receiving the said command, the IUT will simultaneously drop the active
+        call and make the held call active.
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_verify_audio_first_call(self, **kwargs):
+        """
+        Verify the audio is returned to the 1st call and click Ok. Resume action
+        my be needed.  If the audio is not present in the 1st call, click
+        Cancel.
+        """
+
+        # TODO
+
+        return "OK"
+
+    @assert_description
+    def TSC_ag_iut_dial_out_second(self, **kwargs):
+        """
+        Verify that the last number dialed on the Implementation Under Test
+        (IUT) matches the TSPX_Second_phone_number entered in the IXIT settings.
+        """
+
+        # TODO
+
+        return "OK"
+
+    @assert_description
+    def TSC_prepare_iut_for_vra(self, pts_addr: bytes, test: str, **kwargs):
+        """
+        Place the Implementation Under Test (IUT) in a state which will allow a
+        request from the PTS to activate voice recognition, then click Ok.
+        """
+
+        if "HFP/HF" not in test:
+            self.hfp.SetVoiceRecognition(
+                enabled=True,
+                connection=self.host.GetConnection(address=pts_addr).connection,
+            )
+
+        return "OK"
+
+    @assert_description
+    def TSC_prepare_iut_for_vrd(self, **kwargs):
+        """
+        Place the Implementation Under Test (IUT) in a state which will allow a
+        voice recognition deactivation from PTS, then click Ok.
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_ag_iut_clear_call_history(self, **kwargs):
+        """
+        Clear the call history on  the Implementation Under Test (IUT) such that
+        there are zero records of any numbers dialed, then click Ok.
+        """
+
+        self.hfp.ClearCallHistory()
+
+        return "OK"
+
+    @assert_description
+    def TSC_reject_call(self, test: str, pts_addr: bytes, **kwargs):
+        """
+        Click Ok, then reject the incoming call using the Implemention Under
+        Test (IUT).
+        """
+
+        self.connection = self.host.GetConnection(address=pts_addr).connection
+
+        def reject_call():
+            time.sleep(2)
+            if "HFP/HF" in test:
+                self.hfp.DeclineCallAsHandsfree(connection=self.connection)
+            else:
+                self.hfp.DeclineCall()
+
+        threading.Thread(target=reject_call).start()
+
+        return "OK"
+
+    @assert_description
+    def TSC_hf_iut_answer_call(self, pts_addr: bytes, **kwargs):
+        """
+        Click Ok, then answer the incoming call using the Implementation Under
+        Test (IUT).
+        """
+
+        self.connection = self.host.GetConnection(address=pts_addr).connection
+
+        def answer_call():
+            time.sleep(2)
+            self.hfp.AnswerCallAsHandsfree(connection=self.connection)
+
+        threading.Thread(target=answer_call).start()
+
+        return "OK"
+
+    @assert_description
+    def TSC_iut_disable_audio_poweroff_ok(self, **kwargs):
+        """
+        Click Ok, then close the audio connection (SCO) by one of the following
+        ways:
+
+        1. Close the service level connection (SLC)
+        2. Powering off the
+        Implementation Under Test (IUT)
+        """
+
+        self.host.Reset()
+
+        return "OK"
+
+    @assert_description
+    def TSC_verify_inband_ring(self, **kwargs):
+        """
+        Verify that the in-band ringtone is audible, then click Ok.
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_verify_inband_ring_muting(self, **kwargs):
+        """
+        Verify that the in-band ringtone is not audible , then click Ok.
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_hf_iut_disable_call(self, pts_addr: bytes, **kwargs):
+        """
+        Click Ok, then end the call process from the Implementation Under Test
+        (IUT).
+        """
+
+        self.connection = self.host.GetConnection(address=pts_addr).connection
+
+        def disable_call():
+            time.sleep(2)
+            self.hfp.EndCallAsHandsfree(connection=self.connection)
+
+        threading.Thread(target=disable_call).start()
+
+        return "OK"
+
+    @assert_description
+    def TSC_mute_inband_ring_iut(self, **kwargs):
+        """
+        Mute the in-band ringtone on the Implementation Under Test (IUT) and
+        then click OK.
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_verify_iut_alerting(self, **kwargs):
+        """
+        Verify that the Implementation Under Test (IUT) is generating a local
+        alert, then click Ok.
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_verify_iut_not_alerting(self, **kwargs):
+        """
+        Verify that the Implementation Under Test (IUT) is not generating a
+        local alert.
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_hf_iut_enable_call_number(self, pts_addr: bytes, **kwargs):
+        """
+        Click Ok, then place an outgoing call from the Implementation Under Test
+        (IUT) using an enterted phone number.
+        """
+
+        self.connection = self.host.GetConnection(address=pts_addr).connection
+
+        def disable_call():
+            time.sleep(2)
+            self.hfp.MakeCallAsHandsfree(connection=self.connection, number="42")
+
+        threading.Thread(target=disable_call).start()
+
+        return "OK"
+
+    @assert_description
+    def TSC_hf_iut_enable_call_memory(self, **kwargs):
+        """
+        Click Ok, then place an outgoing call from the Implementation Under Test
+        (IUT) by entering the memory index.  For further clarification please
+        see the HFP 1.5 Specification.
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_hf_iut_call_swap_then_disable_held_alternative(self, pts_addr: bytes, **kwargs):
+        """
+        Using the Implementation Under Test (IUT), perform one of the following
+        two actions:
+
+        1. Click OK, make the held/waiting call active, disabling
+        the active call.
+        2. Click OK, make the held/waiting call active, placing
+        the active call on hold.
+        """
+
+        self.connection = self.host.GetConnection(address=pts_addr).connection
+
+        def call_swap_then_disable_held_alternative():
+            time.sleep(2)
+            self.hfp.CallTransferAsHandsfree(connection=self.connection)
+
+        threading.Thread(target=call_swap_then_disable_held_alternative).start()
+
+        return "OK"
+
+    @assert_description
+    def TSC_iut_make_discoverable(self, **kwargs):
+        """
+        Place the Implementation Under Test (IUT) in discoverable mode, then
+        click Ok.
+        """
+
+        self.host.SetDiscoverabilityMode(mode=DiscoverabilityMode.DISCOVERABLE_GENERAL)
+
+        return "OK"
+
+    @assert_description
+    def TSC_iut_accept_connection(self, **kwargs):
+        """
+        Click Ok, then accept the pairing and connection requests on the
+        Implementation Under Test (IUT), if prompted.
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_voice_recognition_enable_iut(self, pts_addr: bytes, **kwargs):
+        """
+        Using the Implementation Under Test (IUT), activate voice recognition.
+        """
+
+        self.hfp.SetVoiceRecognitionAsHandsfree(
+            enabled=True,
+            connection=self.host.GetConnection(address=pts_addr).connection,
+        )
+
+        return "OK"
+
+    @assert_description
+    def TSC_voice_recognition_disable_iut(self, pts_addr: bytes, **kwargs):
+        """
+        Using the Implementation Under Test (IUT), deactivate voice recognition.
+        """
+
+        self.hfp.SetVoiceRecognitionAsHandsfree(
+            enabled=False,
+            connection=self.host.GetConnection(address=pts_addr).connection,
+        )
+
+        return "OK"
+
+    @match_description
+    def TSC_dtmf_send(self, pts_addr: bytes, dtmf: str, **kwargs):
+        r"""
+        Send the DTMF code, then click Ok. (?P<dtmf>.*)
+        """
+
+        self.hfp.SendDtmfFromHandsfree(
+            connection=self.host.GetConnection(address=pts_addr).connection,
+            code=dtmf[0].encode("ascii")[0],
+        )
+
+        return "OK"
+
+    @assert_description
+    def TSC_verify_hf_iut_reports_held_and_active_call(self, **kwargs):
+        """
+        Verify that the Implementation Under Test (IUT) interprets both held and
+        active call signals, then click Ok.  If applicable, verify that the
+        information is correctly displayed on the IUT, then click Ok.
+        """
+
+        return "OK"
+
+    def TSC_rf_shield_iut_or_pts(self, **kwargs):
+        """
+        Click Ok, then move the PTS and the Implementation Under Test (IUT) out
+        of range of each other by performing one of the following IUT specific
+        actions:
+
+        1. Hands Free (HF) IUT - Place the IUT in the RF shield box or
+        physically take out of range from the PTS.
+
+        2. Audio Gateway (AG) IUT-
+        Physically take the IUT out range.  Do not place in the RF shield box as
+        it will interfere with the cellular network.
+
+        Note: The PTS can also be
+        placed in the RF shield box if necessary.
+        """
+
+        def shield_iut_or_pts():
+            time.sleep(2)
+            self.rootcanal.disconnect_phy()
+
+        threading.Thread(target=shield_iut_or_pts).start()
+
+        return "OK"
+
+    @assert_description
+    def TSC_rf_shield_open(self, **kwargs):
+        """
+        Click Ok, then remove the Implementation Under Test (IUT) and/or the PTS
+        from the RF shield.  If the out of range method was used, bring the IUT
+        and PTS back within range.
+        """
+
+        def shield_open():
+            time.sleep(2)
+            self.rootcanal.reconnect_phy_if_needed()
+
+        threading.Thread(target=shield_open).start()
+
+        return "OK"
+
+    @match_description
+    def TSC_verify_speaker_volume(self, volume: str, **kwargs):
+        r"""
+        Verify that the Hands Free \(HF\) speaker volume is displayed correctly on
+        the Implementation Under Test \(IUT\).(?P<volume>[0-9]*)
+        """
+
+        return "OK"
+
+    def _auto_confirm_requests(self, times=None):
+
+        def task():
+            cnt = 0
+            pairing_events = self.security.OnPairing()
+            for event in pairing_events:
+                if event.WhichOneof("method") in {"just_works", "numeric_comparison"}:
+                    if times is None or cnt < times:
+                        cnt += 1
+                        pairing_events.send(event=event, confirm=True)
+
+        threading.Thread(target=task).start()
diff --git a/android/pandora/mmi2grpc/mmi2grpc/hid.py b/android/pandora/mmi2grpc/mmi2grpc/hid.py
new file mode 100644
index 0000000..3a0ce4e
--- /dev/null
+++ b/android/pandora/mmi2grpc/mmi2grpc/hid.py
@@ -0,0 +1,185 @@
+from threading import Thread
+from time import sleep
+from mmi2grpc._helpers import assert_description, match_description
+from mmi2grpc._proxy import ProfileProxy
+
+from pandora_experimental.hid_grpc import HID
+from pandora_experimental.host_grpc import Host
+from pandora_experimental.hid_pb2 import HID_REPORT_TYPE_OUTPUT
+from mmi2grpc._rootcanal import RootCanal
+
+
+class HIDProxy(ProfileProxy):
+
+    def __init__(self, channel, rootcanal):
+        super().__init__(channel)
+        self.hid = HID(channel)
+        self.host = Host(channel)
+        self.rootcanal = rootcanal
+        self.connection = None
+
+    @assert_description
+    def TSC_MMI_iut_enable_connection(self, pts_addr: bytes, **kwargs):
+        """
+        Click Ok, then using the Implementation Under Test (IUT) connect to the
+        PTS.
+        """
+
+        self.rootcanal.reconnect_phy_if_needed()
+        self.connection = self.host.Connect(address=pts_addr).connection
+
+        return "OK"
+
+    @assert_description
+    def TSC_MMI_iut_release_connection(self, pts_addr: bytes, **kwargs):
+        """
+        Click Ok, then release the HID connection from the Implementation Under
+        Test (IUT) by closing the Interrupt Channel followed by the Control
+        Channel.
+
+        Description:  This can be done using the anticipated L2CAP
+        Disconnection Requests.  If the host is unable to perform the connection
+        request, the IUT may break the ACL or Baseband Link by going out of
+        range.
+        """
+
+        self.host.Disconnect(connection=self.connection)
+
+        return "OK"
+
+    @assert_description
+    def TSC_MMI_iut_disable_connection(self, pts_addr: bytes, **kwargs):
+        """
+        Disable the connection using the Implementation UnderTest (IUT).
+
+        Note:
+        The IUT may either disconnect the Interupt Control Channels or send a
+        host initiated virtual cable unplug and wait for the PTS to disconnect
+        the channels.
+        """
+
+        self.host.Disconnect(connection=self.connection)
+        self.connection = None
+
+        return "OK"
+
+    @assert_description
+    def TSC_HID_MMI_iut_accept_connection_ready_confirm(self, **kwargs):
+        """
+        Please prepare the IUT to accept connection from PTS and then click OK.
+        """
+
+        self.rootcanal.reconnect_phy_if_needed()
+
+        return "OK"
+
+    @assert_description
+    def TSC_MMI_iut_connectable_enter_pw_dev(self, **kwargs):
+        """
+        Make the Implementation Under Test (IUT) connectable, then click Ok.
+        """
+
+        self.rootcanal.reconnect_phy_if_needed()
+
+        return "OK"
+
+    @assert_description
+    def TSC_HID_MMI_iut_accept_control_channel(self, pts_addr: bytes, **kwargs):
+        """
+        Accept the control channel connection from the Implementation Under Test
+        (IUT).
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_MMI_tester_release_connection(self, **kwargs):
+        """
+        Place the Implementation Under Test (IUT) in a state which will allow
+        the PTS to perform an HID connection release, then click Ok.
+
+        Note:  The
+        PTS will send an L2CAP disconnect request for the Interrupt channel,
+        then the control channel.
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_MMI_host_iut_prepare_to_receive_pointing_data(self, **kwargs):
+        """
+        Place the Implementation Under Test (IUT) in a state to receive and
+        verify HID pointing data, then click Ok.
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_MMI_host_iut_verify_pointing_data(self, **kwargs):
+        """
+        Verify that the pointer on the Implementation Under Test (IUT) moved to
+        the left (X< 0), then click Ok.
+        """
+
+        # TODO: implement!
+
+        return "OK"
+
+    @assert_description
+    def TSC_MMI_host_send_output_report(self, pts_addr: bytes, **kwargs):
+        """
+        Send an output report from the HOST.
+        """
+
+        self.hid.SendHostReport(
+            address=pts_addr,
+            report_type=HID_REPORT_TYPE_OUTPUT,
+            report="8",  # keyboard enable num-lock
+        )
+
+        return "OK"
+
+    @match_description
+    def TSC_MMI_verify_output_report(self, **kwargs):
+        """
+        Verify that the output report is correct.  nnOutput Report =0(?:0|1)'
+        """
+
+        # TODO: check the report matches the num-lock setting
+
+        return "OK"
+
+    @assert_description
+    def TSC_MMI_rf_shield_iut_or_tester(self, pts_addr: bytes, **kwargs):
+        """
+        Click Ok, then perform one of the following actions:
+
+        1. Move the PTS
+        and Implementation Under Test (IUT) out of range of each other.
+        2. Place
+        either the PTS or IUT in an RF sheild box.
+        """
+
+        def disconnect():
+            sleep(2)
+            self.rootcanal.disconnect_phy()
+
+        Thread(target=disconnect).start()
+
+        return "OK"
+
+    @assert_description
+    def TSC_MMI_iut_auto_connection(self, pts_addr: bytes, **kwargs):
+        """
+        Click OK, then initiate a HID connection automatically from the IUT to
+        the PTS
+        """
+
+        def connect():
+            sleep(1)
+            self.rootcanal.reconnect_phy_if_needed()
+            self.connection = self.host.Connect(address=pts_addr).connection
+
+        Thread(target=connect).start()
+
+        return "OK"
diff --git a/android/pandora/mmi2grpc/mmi2grpc/hogp.py b/android/pandora/mmi2grpc/mmi2grpc/hogp.py
new file mode 100644
index 0000000..69dd9a7
--- /dev/null
+++ b/android/pandora/mmi2grpc/mmi2grpc/hogp.py
@@ -0,0 +1,300 @@
+import threading
+import textwrap
+import uuid
+import re
+
+from mmi2grpc._helpers import assert_description, match_description
+from mmi2grpc._proxy import ProfileProxy
+
+from pandora_experimental.host_grpc import Host
+from pandora_experimental.security_grpc import Security
+from pandora_experimental.security_pb2 import LESecurityLevel
+from pandora_experimental.gatt_grpc import GATT
+
+BASE_UUID = uuid.UUID("00000000-0000-1000-8000-00805F9B34FB")
+
+
+def short_uuid(full: uuid.UUID) -> int:
+    return (uuid.UUID(full).int - BASE_UUID.int) >> 96
+
+
+class HOGPProxy(ProfileProxy):
+
+    def __init__(self, channel):
+        super().__init__(channel)
+        self.host = Host(channel)
+        self.security = Security(channel)
+        self.gatt = GATT(channel)
+        self.connection = None
+        self.pairing_stream = None
+        self.characteristic_reads = {}
+
+    @assert_description
+    def IUT_INITIATE_CONNECTION(self, pts_addr: bytes, **kwargs):
+        """
+        Please initiate a GATT connection to the PTS.
+
+        Description: Verify that
+        the Implementation Under Test (IUT) can initiate a GATT connect request
+        to the PTS.
+        """
+
+        self.connection = self.host.ConnectLE(public=pts_addr).connection
+        self.pairing_stream = self.security.OnPairing()
+        def secure():
+            self.security.Secure(connection=self.connection, le=LESecurityLevel.LE_LEVEL3)
+        threading.Thread(target=secure).start()
+
+        return "OK"
+
+    @match_description
+    def _mmi_2004(self, pts_addr: bytes, passkey: str, **kwargs):
+        """
+        Please confirm that 6 digit number is matched with (?P<passkey>[0-9]*).
+        """
+        received = []
+        for event in self.pairing_stream:
+            if event.address == pts_addr and event.numeric_comparison == int(passkey):
+                self.pairing_stream.send(
+                    event=event,
+                    confirm=True,
+                )
+                self.pairing_stream.close()
+                return "OK"
+            received.append(event.numeric_comparison)
+
+        assert False, f"mismatched passcode: expected {passkey}, received {received}"
+
+    @match_description
+    def IUT_SEND_WRITE_REQUEST(self, handle: str, properties: str, **kwargs):
+        r"""
+        Please send write request to handle (?P<handle>\S*) with following value.
+        Client
+        Characteristic Configuration:
+             Properties: \[0x00(?P<properties>\S*)\]
+        """
+
+        self.gatt.WriteAttFromHandle(
+            connection=self.connection,
+            handle=int(handle, base=16),
+            value=bytes([int(f"0x{properties}", base=16), 0]),
+        )
+
+        return "OK"
+
+    @match_description
+    def USER_CONFIRM_CHARACTERISTIC(self, body: str, **kwargs):
+        r"""
+        Please verify that following attribute handle/UUID pair was returned
+        containing the UUID for the (.*)\.
+
+        (?P<body>.*)
+        """
+
+        PATTERN = re.compile(
+            textwrap.dedent(r"""
+                Attribute Handle = (\S*)
+                Characteristic Properties = (?P<properties>\S*)
+                Handle = (?P<handle>\S*)
+                UUID = (?P<uuid>\S*)
+                """).strip().replace("\n", " "))
+
+        targets = set()
+
+        for match in PATTERN.finditer(body):
+            targets.add((
+                int(match.group("properties"), base=16),
+                int(match.group("handle"), base=16),
+                int(match.group("uuid"), base=16),
+            ))
+
+        assert len(targets) == body.count("Characteristic Properties"), "safety check that regex is matching something"
+
+        services = self.gatt.DiscoverServices(connection=self.connection).services
+
+        for service in services:
+            for characteristic in service.characteristics:
+                uuid_16 = short_uuid(characteristic.uuid)
+                key = (characteristic.properties, characteristic.handle, uuid_16)
+                if key in targets:
+                    targets.remove(key)
+
+        assert not targets, f"could not find handles: {targets}"
+
+        return "OK"
+
+    @match_description
+    def USER_CONFIRM_CHARACTERISTIC_DESCRIPTOR(self, body: str, **kwargs):
+        r"""
+        Please verify that following attribute handle/UUID pair was returned
+        containing the UUID for the (.*)\.
+
+        (?P<body>.*)
+        """
+
+        PATTERN = re.compile(rf"handle = (?P<handle>\S*)\s* uuid = (?P<uuid>\S*)")
+
+        targets = set()
+
+        for match in PATTERN.finditer(body):
+            targets.add((
+                int(match.group("handle"), base=16),
+                int(match.group("uuid"), base=16),
+            ))
+
+        assert len(targets) == body.count("uuid = "), "safety check that regex is matching something"
+
+        services = self.gatt.DiscoverServices(connection=self.connection).services
+
+        for service in services:
+            for characteristic in service.characteristics:
+                for descriptor in characteristic.descriptors:
+                    uuid_16 = short_uuid(descriptor.uuid)
+                    key = (descriptor.handle, uuid_16)
+                    if key in targets:
+                        targets.remove(key)
+
+        assert not targets, f"could not find handles: {targets}"
+
+        return "OK"
+
+    @match_description
+    def USER_CONFIRM_SERVICE_HANDLE(self, service_name: str, body: str, **kwargs):
+        r"""
+        Please confirm the following handles for (?P<service_name>.*)\.
+
+        (?P<body>.*)
+        """
+
+        PATTERN = re.compile(r"Start Handle: (?P<start_handle>\S*)     End Handle: (?P<end_handle>\S*)")
+
+        SERVICE_UUIDS = {
+            "Device Information": 0x180A,
+            "Battery Service": 0x180F,
+            "Human Interface Device": 0x1812,
+        }
+
+        target_uuid = SERVICE_UUIDS[service_name]
+
+        services = self.gatt.DiscoverServices(connection=self.connection).services
+
+        assert len(
+            PATTERN.findall(body)) == body.count("Start Handle:"), "safety check that regex is matching something"
+
+        for match in PATTERN.finditer(body):
+            start_handle = match.group("start_handle")
+
+            for service in services:
+                if service.handle == int(start_handle, base=16):
+                    assert (short_uuid(service.uuid) == target_uuid), "service UUID does not match expected type"
+                    break
+            else:
+                assert False, f"cannot find service with start handle {start_handle}"
+
+        return "OK"
+
+    @assert_description
+    def _mmi_1(self, **kwargs):
+        """
+        Please confirm that the IUT ignored the received Notification and did
+        not report the values to the Upper Tester.
+        """
+
+        # TODO
+
+        return "OK"
+
+    @match_description
+    def IUT_CONFIG_NOTIFICATION(self, value: str, **kwargs):
+        r"""
+        Please write to Client Characteristic Configuration Descriptor of Report
+        characteristic to enable notification.
+
+        Descriptor handle value: (?P<value>\S*)
+        """
+
+        self.gatt.WriteAttFromHandle(
+            connection=self.connection,
+            handle=int(value, base=16),
+            value=bytes([0x01, 0x00]),
+        )
+
+        return "OK"
+
+    @match_description
+    def IUT_READ_CHARACTERISTIC(self, test: str, characteristic_name: str, handle: str, **kwargs):
+        r"""
+        Please send Read Request to read (?P<characteristic_name>.*) characteristic with handle =
+        (?P<handle>\S*).
+        """
+
+        TESTS_READING_CHARACTERISTIC_NOT_DESCRIPTORS = [
+            "HOGP/RH/HGRF/BV-01-I",
+            "HOGP/RH/HGRF/BV-10-I",
+            "HOGP/RH/HGRF/BV-12-I",
+        ]
+
+        action = (self.gatt.ReadCharacteristicFromHandle if test in TESTS_READING_CHARACTERISTIC_NOT_DESCRIPTORS else
+                  self.gatt.ReadCharacteristicDescriptorFromHandle)
+
+        handle = int(handle, base=16)
+        self.characteristic_reads[handle] = action(
+            connection=self.connection,
+            handle=handle,
+        ).value.value
+
+        return "OK"
+
+    @match_description
+    def USER_CONFIRM_READ_RESULT(self, characteristic_name: str, body: str, **kwargs):
+        r"""
+        Please verify following (?P<characteristic_name>.*) Characteristic value is Read.
+
+        (?P<body>.*)
+        """
+
+        blocks = re.split("Handle:", body)
+
+        HEX = "[0-9A-F]"
+        PATTERN = re.compile(f"0x{HEX*2}(?:{HEX*2})?")
+
+        num_checks = 0
+
+        for block in blocks:
+            data = PATTERN.findall(block)
+            if not data:
+                continue
+
+            # first hex value is the handle, rest is the expected data
+            handle, *data = data
+
+            handle = int(handle, base=16)
+
+            actual = self.characteristic_reads[handle]
+
+            expected = []
+            for word in data:
+                if len(word) == len("0x0000"):
+                    first = int(word[2:4], base=16)
+                    second = int(word[4:6], base=16)
+
+                    if "bytes in LSB order" in body:
+                        little = first
+                        big = second
+                    else:
+                        little = second
+                        big = first
+
+                    expected.append(little)
+                    expected.append(big)
+                else:
+                    expected.append(int(word, base=16))
+
+            expected = bytes(expected)
+
+            num_checks += 1
+            assert (expected == actual), f"Got unexpected value for handle {handle}: {repr(expected)} != {repr(actual)}"
+
+        assert (body.count("Handle:") == num_checks), "safety check that regex is matching something"
+
+        return "OK"
diff --git a/android/pandora/mmi2grpc/mmi2grpc/l2cap.py b/android/pandora/mmi2grpc/mmi2grpc/l2cap.py
new file mode 100644
index 0000000..b6db482
--- /dev/null
+++ b/android/pandora/mmi2grpc/mmi2grpc/l2cap.py
@@ -0,0 +1,454 @@
+import time
+import sys
+
+from mmi2grpc._helpers import assert_description
+from mmi2grpc._helpers import match_description
+from mmi2grpc._proxy import ProfileProxy
+
+from pandora_experimental.host_grpc import Host
+from pandora_experimental.host_pb2 import Connection, OwnAddressType
+from pandora_experimental.security_grpc import Security
+from pandora_experimental.l2cap_grpc import L2CAP
+
+from typing import Optional
+
+
+class L2CAPProxy(ProfileProxy):
+    test_status_map = {}  # record test status and pass them between MMI
+    LE_DATA_PACKET_LARGE = "data: LE_DATA_PACKET_LARGE"
+    LE_DATA_PACKET1 = "data: LE_PACKET1"
+    connection: Optional[Connection] = None
+
+    def __init__(self, channel):
+        super().__init__(channel)
+        self.l2cap = L2CAP(channel)
+        self.host = Host(channel)
+        self.security = Security(channel)
+
+        self.connection = None
+        self.pairing_events = None
+
+    @assert_description
+    def MMI_IUT_SEND_LE_CREDIT_BASED_CONNECTION_REQUEST(self, test: str, pts_addr: bytes, **kwargs):
+        """
+        Using the Implementation Under Test (IUT), send a LE Credit based
+        connection request to PTS.
+
+        Description: Verify that IUT can setup LE
+        credit based channel.
+        """
+
+        tests_target_to_fail = [
+            'L2CAP/LE/CFC/BV-01-C',
+            'L2CAP/LE/CFC/BV-04-C',
+            'L2CAP/LE/CFC/BV-10-C',
+            'L2CAP/LE/CFC/BV-11-C',
+            'L2CAP/LE/CFC/BV-12-C',
+            'L2CAP/LE/CFC/BV-14-C',
+            'L2CAP/LE/CFC/BV-16-C',
+            'L2CAP/LE/CFC/BV-18-C',
+            'L2CAP/LE/CFC/BV-19-C',
+            "L2CAP/LE/CFC/BV-21-C",
+        ]
+        tests_require_secure_connection = []
+
+        # This MMI is called twice in 'L2CAP/LE/CFC/BV-04-C'
+        # We are not sure whether the lower tester’s BluetoothServerSocket
+        # will be closed after first connection is established.
+        # Based on what we find, the first connection request is successful,
+        # but the 2nd connection fails.
+        # In PTS real world test, the system asks the human tester
+        # whether it is connected. The human tester will press “Yes” twice.
+        # So we use a counter to return “OK” for the 2nd call.
+        if self.connection and test == 'L2CAP/LE/CFC/BV-02-C':
+            return "OK"
+
+        assert self.connection is None, f"the connection should be None for the first call"
+
+        time.sleep(2)  # avoid timing issue
+        self.connection = self.host.GetLEConnection(public=pts_addr).connection
+
+        psm = 0x25  # default TSPX_spsm value
+        if test == 'L2CAP/LE/CFC/BV-04-C':
+            psm = 0xF1  # default TSPX_psm_unsupported value
+        if test == 'L2CAP/LE/CFC/BV-10-C':
+            psm = 0xF2  # default TSPX_psm_authentication_required value
+        if test == 'L2CAP/LE/CFC/BV-12-C':
+            psm = 0xF3  # default TSPX_psm_authorization_required value
+
+        secure_connection = test in tests_require_secure_connection
+
+        try:
+            self.l2cap.CreateLECreditBasedChannel(connection=self.connection, psm=psm, secure=secure_connection)
+        except Exception as e:
+            if test in tests_target_to_fail:
+                self.test_status_map[test] = 'OK'
+                print(test, 'target to fail', file=sys.stderr)
+                return "OK"
+            else:
+                print(test, 'CreateLECreditBasedChannel failed', e, file=sys.stderr)
+                raise e
+
+        return "OK"
+
+    @assert_description
+    def MMI_TESTER_ENABLE_LE_CONNECTION(self, test: str, **kwargs):
+        """
+        Place the IUT into LE connectable mode.
+        """
+        self.host.StartAdvertising(
+            connectable=True,
+            own_address_type=OwnAddressType.PUBLIC,
+        )
+        # not strictly necessary, but can save time on waiting connection
+        tests_to_open_bluetooth_server_socket = [
+            "L2CAP/COS/CFC/BV-01-C",
+            "L2CAP/COS/CFC/BV-02-C",
+            "L2CAP/COS/CFC/BV-03-C",
+            "L2CAP/COS/CFC/BV-04-C",
+            "L2CAP/LE/CFC/BV-03-C",
+            "L2CAP/LE/CFC/BV-05-C",
+            "L2CAP/LE/CFC/BV-06-C",
+            "L2CAP/LE/CFC/BV-09-C",
+            "L2CAP/LE/CFC/BV-13-C",
+            "L2CAP/LE/CFC/BV-20-C",
+            "L2CAP/LE/CFC/BI-01-C",
+        ]
+        tests_require_secure_connection = [
+            "L2CAP/LE/CFC/BV-13-C",
+        ]
+
+        if test in tests_to_open_bluetooth_server_socket:
+            secure_connection = test in tests_require_secure_connection
+            self.l2cap.ListenL2CAPChannel(connection=self.connection, secure=secure_connection)
+            self.l2cap.AcceptL2CAPChannel(connection=self.connection)
+        return "OK"
+
+    @assert_description
+    def MMI_UPPER_TESTER_SEND_LE_DATA_PACKET_LARGE(self, **kwargs):
+        """
+        Upper Tester command IUT to send LE data packet(s) to the PTS.
+        Description : The Implementation Under Test(IUT) should send multiple LE
+        frames of LE data to PTS.
+        """
+        # NOTES: the data packet is made to be only 1 frame because of the
+        # undeterministic behavior of the PTS-bot
+        # this happened on "L2CAP/LE/CFC/BV-03-C"
+        # when multiple frames are used, sometimes pass, sometimes fail
+        # the PTS said "Failed to receive L2CAP data", but snoop log showed
+        # all data frames arrived
+        # it seemed like when the time gap between the 1st frame and 2nd frame
+        # larger than 100ms this problem will occur
+        self.l2cap.SendData(connection=self.connection, data=bytes(self.LE_DATA_PACKET_LARGE, "utf-8"))
+        return "OK"
+
+    @match_description
+    def MMI_UPPER_TESTER_CONFIRM_LE_DATA(self, sent_data: str, test: str, **kwargs):
+        """
+        Did the Upper Tester send the data (?P<sent_data>[0-9A-F]*) to to the
+        PTS\? Click Yes if it matched, otherwise click No.
+
+        Description: The Implementation Under Test
+        \(IUT\) send data is receive correctly in the PTS.
+        """
+        if test == 'L2CAP/COS/CFC/BV-02-C':
+            hex_LE_DATA_PACKET = self.LE_DATA_PACKET1.encode("utf-8").hex().upper()
+        else:
+            hex_LE_DATA_PACKET = self.LE_DATA_PACKET_LARGE.encode("utf-8").hex().upper()
+        if sent_data != hex_LE_DATA_PACKET:
+            print(f"data not match, sent_data:{sent_data} and {hex_LE_DATA_PACKET}", file=sys.stderr)
+            raise Exception(f"data not match, sent_data:{sent_data} and {hex_LE_DATA_PACKET}")
+        return "OK"
+
+    @assert_description
+    def MMI_UPPER_TESTER_SEND_LE_DATA_PACKET4(self, **kwargs):
+        """
+        Upper Tester command IUT to send at least 4 frames of LE data packets to
+        the PTS.
+        """
+        self.l2cap.SendData(
+            connection=self.connection,
+            data=b"this is a large data package with at least 4 frames: MMI_UPPER_TESTER_SEND_LE_DATA_PACKET_LARGE")
+        return "OK"
+
+    @assert_description
+    def MMI_UPPER_TESTER_SEND_LE_DATA_PACKET_CONTINUE(self, **kwargs):
+        """
+        IUT continue to send LE data packet(s) to the PTS.
+        """
+        self.l2cap.SendData(
+            connection=self.connection,
+            data=b"this is a large data package with at least 4 frames: MMI_UPPER_TESTER_SEND_LE_DATA_PACKET_LARGE")
+        return "OK"
+
+    @assert_description
+    def MMI_UPPER_TESTER_CONFIRM_RECEIVE_COMMAND_NOT_UNDERSTAOOD(self, test: str, **kwargs):
+        """
+        Did Implementation Under Test(IUT) receive L2CAP Reject with 'command
+        not understood' error?
+        Click Yes if it is, otherwise click No.
+        Description : Verify that after receiving the Command Reject from the
+        Lower Tester, the IUT inform the Upper Tester.
+        """
+        if self.test_status_map[test] != "OK":
+            print('error in MI_UPPER_TESTER_CONFIRM_RECEIVE_COMMAND_NOT_UNDERSTAOOD', file=sys.stderr)
+            raise Exception("Unexpected RECEIVE_COMMAND")
+        return "OK"
+
+    @assert_description
+    def MMI_UPPER_TESTER_CONFIRM_DATA_RECEIVE(self, **kwargs):
+        """
+        Please confirm the Upper Tester receive data
+        """
+        data = self.l2cap.ReceiveData(connection=self.connection)
+        assert data, "data received should not be empty"
+        return "OK"
+
+    @assert_description
+    def MMI_UPPER_TESTER_CONFIRM_RECEIVE_REJECT_PSM(self, test: str, **kwargs):
+        """
+        Did Implementation Under Test(IUT) receive Request Reject with 'LE_PSM
+        not supported' 0x0002 error.Click Yes if it is, otherwise click No.
+        Description : Verify that after receiving the Credit Based Connection
+        Request reject from the Lower Tester, the IUT inform the Upper Tester.
+        """
+        if self.test_status_map[test] != "OK":
+            print('error in MMI_UPPER_TESTER_CONFIRM_RECEIVE_REJECT_PSM', file=sys.stderr)
+            raise Exception("Unexpected RECEIVE_COMMAND")
+        return "OK"
+
+    @assert_description
+    def MMI_UPPER_TESTER_CONFIRM_RECEIVE_REJECT_AUTHENTICATION(self, test: str, **kwargs):
+        """
+        Did Implementation Under Test(IUT) receive Connection refused
+        'Insufficient Authentication' 0x0005 error?
+
+        Click Yes if IUT received
+        it, otherwise click NO.
+
+        Description: Verify that after receiving the
+        Credit Based Connection Request Refused With No Resources error from the
+        Lower Tester, the IUT informs the Upper Tester.
+        """
+        if self.test_status_map[test] != "OK":
+            print('error in MMI_UPPER_TESTER_CONFIRM_RECEIVE_REJECT_AUTHENTICATION', file=sys.stderr)
+            raise Exception("Unexpected RECEIVE_COMMAND")
+        return "OK"
+
+    @assert_description
+    def _mmi_135(self, test: str, **kwargs):
+        """
+        Please make sure an authentication requirement exists for a channel
+        L2CAP.
+        When receiving Credit Based Connection Request from PTS, please
+        respond with Result 0x0005 (Insufficient Authentication)
+        """
+        if self.test_status_map[test] != "OK":
+            print('error in _mmi_135', file=sys.stderr)
+            raise Exception("Unexpected RECEIVE_COMMAND")
+        return "OK"
+
+    @assert_description
+    def _mmi_136(self, **kwargs):
+        """
+        Please make sure an authorization requirement exists for a channel
+        L2CAP.
+        When receiving Credit Based Connection Request from PTS, please
+        respond with Result 0x0006 (Insufficient Authorization)
+        """
+        return "OK"
+
+    @assert_description
+    def MMI_UPPER_TESTER_CONFIRM_RECEIVE_REJECT_AUTHORIZATION(self, test: str, **kwargs):
+        """
+        Did Implementation Under Test(IUT) receive Connection refused
+        'Insufficient Authorization' 0x0006 error?
+
+        Click Yes if IUT received
+        it, otherwise click NO.
+
+        Description: Verify that after receiving the
+        Credit Based Connection Request Refused With No Resources error from the
+        Lower Tester, the IUT informs the Upper Tester.
+        """
+        if self.test_status_map[test] != "OK":
+            print('error in MMI_UPPER_TESTER_CONFIRM_RECEIVE_REJECT_AUTHORIZATION', file=sys.stderr)
+            raise Exception("Unexpected RECEIVE_COMMAND")
+        return "OK"
+
+    @assert_description
+    def MMI_UPPER_TESTER_CONFIRM_RECEIVE_REJECT_ENCRYPTION_KEY_SIZE(self, test: str, **kwargs):
+        """
+        Did Implementation Under Test(IUT) receive Connection refused
+        'Insufficient Encryption Key Size' 0x0007 error?
+
+        Click Yes if IUT
+        received it, otherwise click NO.
+
+        Description: Verify that after
+        receiving the Credit Based Connection Request Refused With No Resources
+        error from the Lower Tester, the IUT informs the Upper Tester.
+        """
+        if self.test_status_map[test] != "OK":
+            print('error in MMI_UPPER_TESTER_CONFIRM_RECEIVE_REJECT_ENCRYPTION_KEY_SIZE', file=sys.stderr)
+            raise Exception("Unexpected RECEIVE_COMMAND")
+        return "OK"
+
+    @assert_description
+    def MMI_UPPER_TESTER_CONFIRM_RECEIVE_REJECT_INVALID_SOURCE_CID(self, test: str, **kwargs):
+        """
+        Did Implementation Under Test(IUT) receive Connection refused 'Invalid
+        Source CID' 0x0009 error? And does not send anything over refuse LE data
+        channel? Click Yes if it is, otherwise click No.
+        Description : Verify
+        that after receiving the Credit Based Connection Request refused with
+        Invalid Source CID error from the Lower Tester, the IUT inform the Upper
+        Tester.
+        """
+        if self.test_status_map[test] != "OK":
+            print('error in MMI_UPPER_TESTER_CONFIRM_RECEIVE_REJECT_INVALID_SOURCE_CID', file=sys.stderr)
+            raise Exception("Unexpected RECEIVE_COMMAND")
+        return "OK"
+
+    @assert_description
+    def MMI_UPPER_TESTER_CONFIRM_RECEIVE_REJECT_SOURCE_CID_ALREADY_ALLOCATED(self, test: str, **kwargs):
+        """
+        Did Implementation Under Test(IUT) receive Connection refused 'Source
+        CID Already Allocated' 0x000A error? And did not send anything over
+        refuse LE data channel.Click Yes if it is, otherwise click No.
+        Description : Verify that after receiving the Credit Based Connection
+        Request refused with Source CID Already Allocated error from the Lower
+        Tester, the IUT inform the Upper Tester.
+        """
+        if self.test_status_map[test] != "OK":
+            print('error in MMI_UPPER_TESTER_CONFIRM_RECEIVE_REJECT_SOURCE_CID_ALREADY_ALLOCATED', file=sys.stderr)
+            raise Exception("Unexpected RECEIVE_COMMAND")
+        return "OK"
+
+    @assert_description
+    def MMI_UPPER_TESTER_CONFIRM_RECEIVE_REJECT_UNACCEPTABLE_PARAMETERS(self, test: str, **kwargs):
+        """
+        Did Implementation Under Test(IUT) receive Connection refused
+        'Unacceptable Parameters' 0x000B error? Click Yes if it is, otherwise
+        click No.
+        Description: Verify that after receiving the Credit Based
+        Connection Request refused with Unacceptable Parameters error from the
+        Lower Tester, the IUT inform the Upper Tester.
+        """
+        if self.test_status_map[test] != "OK":
+            print('error in MMI_UPPER_TESTER_CONFIRM_RECEIVE_REJECT_UNACCEPTABLE_PARAMETERS', file=sys.stderr)
+            raise Exception("Unexpected RECEIVE_COMMAND")
+        return "OK"
+
+    @assert_description
+    def MMI_UPPER_TESTER_CONFIRM_RECEIVE_REJECT_RESOURCES(self, test: str, **kwargs):
+        """
+        Did Implementation Under Test(IUT) receive Connection refused
+        'Insufficient Resources' 0x0004 error? Click Yes if it is, otherwise
+        click No.
+        Description : Verify that after receiving the Credit Based
+        Connection Request refused with No resources error from the Lower
+        Tester, the IUT inform the Upper Tester.
+        """
+        if self.test_status_map[test] != "OK":
+            print('error in MMI_UPPER_TESTER_CONFIRM_RECEIVE_REJECT_RESOURCES', file=sys.stderr)
+            raise Exception("Unexpected RECEIVE_COMMAND")
+        return "OK"
+
+    def MMI_IUT_ENABLE_LE_CONNECTION(self, pts_addr: bytes, **kwargs):
+        """
+        Initiate or create LE ACL connection to the PTS.
+        """
+        self.connection = self.host.ConnectLE(public=pts_addr).connection
+        return "OK"
+
+    @assert_description
+    def MMI_IUT_SEND_ACL_DISCONNECTION(self, test: str, **kwargs):
+        """
+        Initiate an ACL disconnection from the IUT to the PTS.
+        Description :
+        The Implementation Under Test(IUT) should disconnect ACL channel by
+        sending a disconnect request to PTS.
+        """
+        self.host.Disconnect(connection=self.connection)
+        return "OK"
+
+    def MMI_TESTER_ENABLE_CONNECTION(self, **kwargs):
+        """
+        Action: Place the IUT in connectable mode.
+
+        Description: PTS requires that the IUT be in connectable mode.
+        The PTS will attempt to establish an ACL connection.
+        """
+
+        return "OK"
+
+    @assert_description
+    def MMI_IUT_INITIATE_ACL_CONNECTION(self, pts_addr: bytes, **kwargs):
+        """
+        Using the Implementation Under Test(IUT), initiate ACL Create Connection
+        Request to the PTS.
+
+        Description : The Implementation Under Test(IUT)
+        should create ACL connection request to PTS.
+        """
+        self.pairing_events = self.security.OnPairing()
+        self.connection = self.host.Connect(address=pts_addr, manually_confirm=True).connection
+        return "OK"
+
+    @assert_description
+    def _mmi_2001(self, **kwargs):
+        """
+        Please verify the passKey is correct: 000000
+        """
+        passkey = "000000"
+        for event in self.pairing_events:
+            if event.numeric_comparison == int(passkey):
+                self.pairing_events.send(event=event, confirm=True)
+                return "OK"
+            assert False, "The passkey does not match"
+        assert False, "Unexpected pairing event"
+
+    @assert_description
+    def MMI_IUT_SEND_CONFIG_REQ(self, **kwargs):
+        """
+        Please send Configure Request.
+        """
+
+        return "OK"
+
+    @assert_description
+    def MMI_IUT_SEND_CONFIG_RSP(self, **kwargs):
+        """
+        Please send Configure Response.
+        """
+
+        return "OK"
+
+    @assert_description
+    def MMI_IUT_SEND_DISCONNECT_RSP(self, **kwargs):
+        """
+        Please send L2CAP Disconnection Response to PTS.
+        """
+
+        return "OK"
+
+    @assert_description
+    def MMI_UPPER_TESTER_SEND_LE_DATA_PACKET1(self, **kwargs):
+        """
+        Upper Tester command IUT to send a non-segmented LE data packet to the
+        PTS with any values.
+         Description : The Implementation Under Test(IUT)
+        should send none segmantation LE frame of LE data to the PTS.
+        """
+        self.l2cap.SendData(connection=self.connection, data=bytes(self.LE_DATA_PACKET1, "utf-8"))
+        return "OK"
+
+    @assert_description
+    def MMI_IUT_SEND_L2CAP_DATA(self, **kwargs):
+        """
+        Using the Implementation Under Test(IUT), send L2CAP_Data over the
+        assigned channel with correct DCID to the PTS.
+        """
+
+        return "OK"
diff --git a/android/pandora/mmi2grpc/mmi2grpc/map.py b/android/pandora/mmi2grpc/mmi2grpc/map.py
new file mode 100644
index 0000000..df347e7
--- /dev/null
+++ b/android/pandora/mmi2grpc/mmi2grpc/map.py
@@ -0,0 +1,188 @@
+# Copyright 2022 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""MAP proxy module."""
+
+from typing import Optional
+
+from mmi2grpc._helpers import assert_description
+from mmi2grpc._proxy import ProfileProxy
+
+from pandora_experimental.host_grpc import Host
+from pandora_experimental.host_pb2 import Connection
+from pandora_experimental._android_grpc import Android
+from pandora_experimental._android_pb2 import AccessType
+
+
+class MAPProxy(ProfileProxy):
+    """MAP proxy.
+
+    Implements MAP PTS MMIs.
+    """
+
+    connection: Optional[Connection] = None
+
+    def __init__(self, channel):
+        super().__init__(channel)
+
+        self.host = Host(channel)
+        self._android = Android(channel)
+
+        self.connection = None
+        self._init_send_sms()
+
+    @assert_description
+    def TSC_MMI_iut_connectable(self, **kwargs):
+        """
+        Click OK when the IUT becomes connectable.
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_OBEX_MMI_iut_accept_slc_connect_l2cap(self, pts_addr: bytes, **kwargs):
+        """
+        Please accept the l2cap channel connection for an OBEX connection.
+        """
+
+        self._android.SetAccessPermission(address=pts_addr, access_type=AccessType.ACCESS_MESSAGE)
+        self.connection = self.host.WaitConnection(address=pts_addr).connection
+
+        return "OK"
+
+    @assert_description
+    def TSC_OBEX_MMI_iut_accept_connect(self, test: str, pts_addr: bytes, **kwargs):
+        """
+        Please accept the OBEX CONNECT REQ.
+        """
+
+        if test in {"MAP/MSE/GOEP/BC/BV-01-I", "MAP/MSE/GOEP/BC/BV-03-I", "MAP/MSE/MMN/BV-02-I"}:
+            if self.connection is None:
+                self._android.SetAccessPermission(address=pts_addr, access_type=AccessType.ACCESS_MESSAGE)
+                self.connection = self.host.WaitConnection(address=pts_addr).connection
+
+        return "OK"
+
+    @assert_description
+    def TSC_OBEX_MMI_iut_initiate_slc_connect(self, **kwargs):
+        """
+        Take action to create an l2cap channel or rfcomm channel for an OBEX
+        connection.
+
+        Note:
+        Service Name: MAP-MNS
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_OBEX_MMI_iut_initiate_connect_MAP(self, **kwargs):
+        """
+        Take action to initiate an OBEX CONNECT REQ for MAP.
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_OBEX_MMI_iut_initiate_disconnect(self, **kwargs):
+        """
+        Take action to initiate an OBEX DISCONNECT REQ.
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_OBEX_MMI_iut_accept_disconnect(self, **kwargs):
+        """
+        Please accept the OBEX DISCONNECT REQ command.
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_OBEX_MMI_iut_accept_set_path(self, **kwargs):
+        """
+        Please accept the SET_PATH command.
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_OBEX_MMI_iut_accept_get_srm(self, **kwargs):
+        """
+        Please accept the GET REQUEST with an SRM ENABLED header.
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_OBEX_MMI_iut_accept_browse_folders(self, **kwargs):
+        """
+        Please accept the browse folders (GET) command.
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_MMI_iut_send_set_event_message_MessageRemoved_request(self, **kwargs):
+        """
+        Send Set Event Report with MessageRemoved Message.
+        """
+        return "OK"
+
+    @assert_description
+    def TSC_MMI_iut_verify_message_have_send(self, **kwargs):
+        """
+        Verify that the message has been successfully delivered via the network,
+        then click OK.  Otherwise click Cancel.
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_OBEX_MMI_iut_reject_action(self, **kwargs):
+        """
+        Take action to reject the ACTION command sent by PTS.
+        """
+        return "OK"
+
+    @assert_description
+    def TSC_MMI_iut_send_set_event_message_gsm_request(self, **kwargs):
+        """
+        Send Set Event Report with New GSM Message.
+        """
+
+        self._android.SendSMS()
+
+        return "OK"
+
+    @assert_description
+    def TSC_MMI_iut_send_set_event_1_2_request(self, **kwargs):
+        """
+        Send 1.2 Event Report .
+        """
+        return "OK"
+
+    @assert_description
+    def TSC_OBEX_MMI_iut_reject_session(self, **kwargs):
+        """
+        Take action to reject the SESSION command sent by PTS.
+        """
+
+        return "OK"
+
+    def _init_send_sms(self):
+
+        min_sms_count = 2  # Few test cases requires minimum 2 sms to pass
+        for index in range(min_sms_count):
+            self._android.SendSMS()
diff --git a/android/pandora/mmi2grpc/mmi2grpc/opp.py b/android/pandora/mmi2grpc/mmi2grpc/opp.py
new file mode 100644
index 0000000..d74e5cf
--- /dev/null
+++ b/android/pandora/mmi2grpc/mmi2grpc/opp.py
@@ -0,0 +1,118 @@
+# Copyright 2022 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""OPP proxy module."""
+
+from typing import Optional
+
+from mmi2grpc._helpers import assert_description
+from mmi2grpc._proxy import ProfileProxy
+
+from pandora_experimental.host_grpc import Host
+from pandora_experimental.host_pb2 import Connection
+from pandora_experimental._android_grpc import Android
+from pandora_experimental._android_pb2 import AccessType
+
+
+class OPPProxy(ProfileProxy):
+    """OPP proxy.
+
+    Implements OPP PTS MMIs.
+    """
+    connection: Optional[Connection] = None
+
+    def __init__(self, channel):
+        super().__init__(channel)
+
+        self.host = Host(channel)
+        self._android = Android(channel)
+
+        self.connection = None
+
+    @assert_description
+    def TSC_OBEX_MMI_iut_accept_connect_OPP(self, pts_addr: bytes, **kwargs):
+        """
+        Please accept the OBEX CONNECT REQ command for OPP.
+        """
+        if self.connection is None:
+            self.connection = self.host.WaitConnection(address=pts_addr).connection
+
+        return "OK"
+
+    @assert_description
+    def TSC_OPP_mmi_user_action_remove_object(self, **kwargs):
+        """
+        If necessary take action to remove any file(s) named 'BC_BV01.bmp' from
+        the IUT.  
+
+        Press 'OK' to confirm that the file is not present on the
+        IUT.
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_OBEX_MMI_iut_accept_put(self, **kwargs):
+        """
+         Please accept the PUT REQUEST.
+        """
+        self._android.AcceptIncomingFile()
+
+        return "OK"
+
+    @assert_description
+    def TSC_OPP_mmi_user_verify_does_object_exist(self, **kwargs):
+        """
+        Does the IUT now contain the following files?
+
+        BC_BV01.bmp
+
+        Note: If
+        TSPX_supported_extension is not .bmp, the file content of the file will
+        not be formatted for the TSPX_supported extension, this is normal.
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_OBEX_MMI_iut_accept_slc_connect_l2cap(self, pts_addr: bytes, **kwargs):
+        """
+        Please accept the l2cap channel connection for an OBEX connection.
+        """
+        self.connection = self.host.WaitConnection(address=pts_addr).connection
+
+        return "OK"
+
+    @assert_description
+    def TSC_OBEX_MMI_iut_reject_action(self, **kwargs):
+        """
+         Take action to reject the ACTION command sent by PTS.
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_OBEX_MMI_iut_accept_disconnect(self, **kwargs):
+        """
+         Please accept the OBEX DISCONNECT REQ command.
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_OBEX_MMI_iut_accept_slc_disconnect(self, **kwargs):
+        """
+         Please accept the disconnection of the transport channel.
+        """
+
+        return "OK"
diff --git a/android/pandora/mmi2grpc/mmi2grpc/pbap.py b/android/pandora/mmi2grpc/mmi2grpc/pbap.py
new file mode 100644
index 0000000..8ff5e90
--- /dev/null
+++ b/android/pandora/mmi2grpc/mmi2grpc/pbap.py
@@ -0,0 +1,158 @@
+# Copyright 2022 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""PBAP proxy module."""
+
+from typing import Optional
+
+from grpc import RpcError
+
+from mmi2grpc._helpers import assert_description, match_description
+from mmi2grpc._proxy import ProfileProxy
+from pandora_experimental.host_grpc import Host
+from pandora_experimental.host_pb2 import Connection
+from pandora_experimental._android_grpc import Android
+from pandora_experimental._android_pb2 import AccessType
+from pandora_experimental.pbap_grpc import PBAP
+
+
+class PBAPProxy(ProfileProxy):
+    """PBAP proxy.
+
+    Implements PBAP PTS MMIs.
+    """
+
+    connection: Optional[Connection] = None
+
+    def __init__(self, channel):
+        super().__init__(channel)
+
+        self.host = Host(channel)
+        self.pbap = PBAP(channel)
+        self._android = Android(channel)
+
+        self.connection = None
+
+    @assert_description
+    def TSC_MMI_iut_connectable(self, **kwargs):
+        """
+        Click OK when the IUT becomes connectable.
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_OBEX_MMI_iut_accept_slc_connect_l2cap(self, pts_addr: bytes, **kwargs):
+        """
+        Please accept the l2cap channel connection for an OBEX connection.
+        """
+        self._android.SetAccessPermission(address=pts_addr, access_type=AccessType.ACCESS_PHONEBOOK)
+        self.connection = self.host.WaitConnection(address=pts_addr).connection
+
+        return "OK"
+
+    @assert_description
+    def TSC_OBEX_MMI_iut_accept_connect(self, test: str, pts_addr: bytes, **kwargs):
+        """
+        Please accept the OBEX CONNECT REQ.
+        """
+        if ("PBAP/PSE/GOEP/BC/BV-03-I" in test):
+            if self.connection is None:
+                self._android.SetAccessPermission(address=pts_addr, access_type=AccessType.ACCESS_PHONEBOOK)
+                self.connection = self.host.WaitConnection(address=pts_addr).connection
+
+        return "OK"
+
+    @assert_description
+    def TSC_OBEX_MMI_iut_accept_set_path(self, **kwargs):
+        """
+        Please accept the SET_PATH command.
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_MMI_verify_vcard(self, **kwargs):
+        """
+        Verify the content vcard sent by the IUT is accurate.
+        """
+
+        return "OK"
+
+    @match_description
+    def TSC_MMI_verify_phonebook_size(self, **kwargs):
+        """
+        Verify that the phonebook size = (?P<size>[0-9]+)
+
+        Note: Owner's card is also
+        included in the count.
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_OBEX_MMI_iut_reject_action(self, **kwargs):
+        """
+        Take action to reject the ACTION command sent by PTS.
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_OBEX_MMI_iut_reject_session(self, **kwargs):
+        """
+        Take action to reject the SESSION command sent by PTS.
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_OBEX_MMI_iut_accept_get_srm(self, **kwargs):
+        """
+        Please accept the GET REQUEST with an SRM ENABLED header.
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_OBEX_MMI_iut_accept_disconnect(self, **kwargs):
+        """
+        Please accept the OBEX DISCONNECT REQ command.
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_OBEX_MMI_iut_accept_put(self, **kwargs):
+        """
+        Please accept the PUT REQUEST.
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_MMI_verify_user_confirmation(self, **kwargs):
+        """
+        Click Ok if the Implementation Under Test (IUT) was prompted to accept
+        the PBAP connection.
+        """
+
+        return "OK"
+
+    @match_description
+    def TSC_MMI_verify_newmissedcall(self, **kwargs):
+        """
+         Verify that the new missed calls = (?P<size>[0-9]+)
+        """
+
+        return "OK"
diff --git a/android/pandora/mmi2grpc/mmi2grpc/rfcomm.py b/android/pandora/mmi2grpc/mmi2grpc/rfcomm.py
new file mode 100644
index 0000000..28b6e7c
--- /dev/null
+++ b/android/pandora/mmi2grpc/mmi2grpc/rfcomm.py
@@ -0,0 +1,226 @@
+# Copyright 2022 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Rfcomm proxy module."""
+
+from mmi2grpc._helpers import assert_description
+from mmi2grpc._proxy import ProfileProxy
+
+from pandora_experimental.rfcomm_grpc import RFCOMM
+from pandora_experimental.host_grpc import Host
+
+import sys
+import threading
+import os
+import socket
+
+
+class RFCOMMProxy(ProfileProxy):
+
+    # The UUID for Serial-Port Profile
+    SPP_UUID = "00001101-0000-1000-8000-00805f9b34fb"
+    # TSPX_SERVICE_NAME_TESTER
+    SERVICE_NAME = "COM5"
+
+    def __init__(self, channel: str):
+        super().__init__(channel)
+        self.rfcomm = RFCOMM(channel)
+        self.host = Host(channel)
+        self.server = None
+        self.connection = None
+
+    @assert_description
+    def TSC_RFCOMM_mmi_iut_initiate_slc(self, pts_addr: bytes, test: str, **kwargs):
+        """
+        Take action to initiate an RFCOMM service level connection (l2cap).
+        """
+
+        try:
+            self.connection = self.rfcomm.ConnectToServer(address=pts_addr, uuid=self.SPP_UUID).connection
+        except Exception as e:
+            if test == "RFCOMM/DEVA/RFC/BV-01-C":
+                print(f'{test}: PTS disconnected as expected', file=sys.stderr)
+                return "OK"
+            else:
+                print(f'{test}: PTS disconnected unexpectedly', file=sys.stderr)
+                raise e
+        return "OK"
+
+    @assert_description
+    def TSC_RFCOMM_mmi_iut_accept_slc(self, pts_addr: bytes, **kwargs):
+        """
+        Take action to accept the RFCOMM service level connection from the
+        tester.
+        """
+
+        self.server = self.rfcomm.StartServer(uuid=self.SPP_UUID, name=self.SERVICE_NAME).server
+
+        self.host.WaitConnection(address=pts_addr)
+
+        return "OK"
+
+    @assert_description
+    def TSC_RFCOMM_mmi_iut_accept_sabm(self, **kwargs):
+        """
+        Take action to accept the SABM operation initiated by the tester.
+
+        Note:
+        Make sure that the RFCOMM server channel is set correctly in
+        TSPX_server_channel_iut
+        """
+
+        self.connection = self.rfcomm.AcceptConnection(server=self.server).connection
+        return "OK"
+
+    @assert_description
+    def TSC_RFCOMM_mmi_iut_respond_PN(self, **kwargs):
+        """
+        Take action to respond PN.
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_RFCOMM_mmi_iut_initiate_sabm_control_channel(self, **kwargs):
+        """
+        Take action to initiate an SABM operation for the RFCOMM control
+        channel.
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_RFCOMM_mmi_iut_initiate_PN(self, **kwargs):
+        """
+        Take action to initiate PN.
+        """
+
+        return "OK"
+
+    def TSC_RFCOMM_mmi_iut_initiate_sabm_data_channel(self, **kwargs):
+        """
+        Take action to initiate an SABM operation for an RFCOMM data channel.
+        Note: RFCOMM server channel can be found on PTS's SDP record
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_RFCOMM_mmi_iut_accept_disc(self, **kwargs):
+        """
+        Take action to accept the DISC operation initiated by the tester.
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_RFCOMM_mmi_iut_accept_data_link_connection(self, **kwargs):
+        """
+        Take action to accept a new DLC initiated by the tester.
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_RFCOMM_mmi_iut_initiate_close_session(self, **kwargs):
+        """
+        Take action to close the RFCOMM session.
+        """
+
+        self.rfcomm.Disconnect(connection=self.connection)
+
+        return "OK"
+
+    @assert_description
+    def TSC_RFCOMM_mmi_iut_respond_RLS(self, **kwargs):
+        """
+        Take action to respond RLS command.
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_RFCOMM_mmi_iut_initiate_MSC(self, **kwargs):
+        """
+        Take action to initiate MSC command.
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_RFCOMM_mmi_iut_respond_RPN(self, **kwargs):
+        """
+        Take action to respond RPN.
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_RFCOMM_mmi_iut_respond_NSC(self, **kwargs):
+        """
+        Take action to respond NSC.
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_RFCOMM_mmi_iut_initiate_close_dlc(self, **kwargs):
+        """
+        Take action to close the DLC.
+        """
+
+        self.rfcomm.Disconnect(connection=self.connection)
+
+        return "OK"
+
+    @assert_description
+    def TSC_RFCOMM_mmi_iut_respond_Test(self, **kwargs):
+        """
+        Take action to respond Test.
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_RFCOMM_mmi_iut_respond_MSC(self, **kwargs):
+        """
+        Take action to respond MSC.
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_RFCOMM_mmi_iut_send_data(self, **kwargs):
+        """
+        Take action to send data on the open DLC on PTS with at least 2 frames.
+        """
+
+        self.rfcomm.Send(connection=self.connection, data=b'Some data to send')
+        self.rfcomm.Send(connection=self.connection, data=b'More data to send')
+        return "OK"
+
+    @assert_description
+    def TSC_RFCOMM_mmi_user_wait_no_uih_data(self, **kwargs):
+        """
+        Please wait while the tester confirms no data is sent ...
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_RFCOMM_mmi_iut_initiate_RLS_framing_error(self, **kwargs):
+        """
+        Take action to initiate RLS command with Framing Error status.
+        """
+
+        return "OK"
diff --git a/android/pandora/mmi2grpc/mmi2grpc/sdp.py b/android/pandora/mmi2grpc/mmi2grpc/sdp.py
new file mode 100644
index 0000000..a45b971
--- /dev/null
+++ b/android/pandora/mmi2grpc/mmi2grpc/sdp.py
@@ -0,0 +1,105 @@
+# Copyright 2022 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""SDP proxy module."""
+
+from mmi2grpc._helpers import assert_description
+from mmi2grpc._proxy import ProfileProxy
+
+import sys
+import threading
+import os
+import socket
+
+
+class SDPProxy(ProfileProxy):
+
+    def __init__(self, channel: str):
+        super().__init__(channel)
+
+    @assert_description
+    def _mmi_6000(self, **kwargs):
+        """
+        If necessary take action to accept the SDP channel connection.
+        """
+
+        return "OK"
+
+    @assert_description
+    def _mmi_6001(self, **kwargs):
+        """
+        If necessary take action to respond to the Service Attribute operation
+        appropriately.
+        """
+
+        return "OK"
+
+    @assert_description
+    def _mmi_6002(self, **kwargs):
+        """
+        If necessary take action to accept the Service Search operation.
+        """
+
+        return "OK"
+
+    @assert_description
+    def _mmi_6003(self, **kwargs):
+        """
+        If necessary take action to respond to the Service Search Attribute
+        operation appropriately.
+        """
+
+        return "OK"
+
+    @assert_description
+    def TSC_SDP_mmi_verify_browsable_services(self, **kwargs):
+        """
+        Are all browsable service classes listed below?
+
+        0x1800, 0x110A, 0x110C,
+        0x110E, 0x1112, 0x1203, 0x111F, 0x1203, 0x1132, 0x1116, 0x1115, 0x112F,
+        0x1105
+        """
+        """
+        This is the decoded list of UUIDs:
+            Service Classes and Profiles 0x1105 OBEXObjectPush
+            Service Classes and Profiles 0x110A AudioSource
+            Service Classes and Profiles 0x110C A/V_RemoteControlTarget
+            Service Classes and Profiles 0x110E A/V_RemoteControl
+            Service Classes and Profiles 0x1112 Headset - Audio Gateway
+            Service Classes and Profiles 0x1115 PANU
+            Service Classes and Profiles 0x1116 NAP
+            Service Classes and Profiles 0x111F HandsfreeAudioGateway
+            Service Classes and Profiles 0x112F Phonebook Access - PSE
+            Service Classes and Profiles 0x1132 Message Access Server
+            Service Classes and Profiles 0x1203 GenericAudio
+            GATT Service 0x1800 Generic Access
+            GATT Service 0x1855 TMAS
+
+        The Android API only returns a subset of the profiles:
+            0x110A, 0x1112, 0x111F, 0x112F, 0x1132,
+
+        Since the API doesn't return the full set, this test uses the
+        description to check that the number of profiles does not change
+        from the last time the test was successfully run.
+
+        Adding or Removing services from Android will cause this
+        test to be fail.  Updating the description above will cause
+        it to pass again.
+
+        The other option is to add a call to btif_enable_service() for each
+        profile which is browsable in SDP.  Then you can add a Host GRPC call
+        to BluetoothAdapter.getUuidsList and match the returned UUIDs to the
+        list given by PTS.
+        """
+        return "OK"
diff --git a/android/pandora/mmi2grpc/mmi2grpc/sm.py b/android/pandora/mmi2grpc/mmi2grpc/sm.py
new file mode 100644
index 0000000..a2e871d
--- /dev/null
+++ b/android/pandora/mmi2grpc/mmi2grpc/sm.py
@@ -0,0 +1,183 @@
+# Copyright 2022 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""SMP proxy module."""
+from queue import Empty, Queue
+from threading import Thread
+import sys
+import asyncio
+
+from mmi2grpc._helpers import assert_description, match_description
+from mmi2grpc._proxy import ProfileProxy
+from mmi2grpc._streaming import StreamWrapper
+
+from pandora_experimental.security_grpc import Security
+from pandora_experimental.security_pb2 import LESecurityLevel
+from pandora_experimental.host_grpc import Host
+from pandora_experimental.host_pb2 import ConnectabilityMode, OwnAddressType
+
+
+def debug(*args, **kwargs):
+    print(*args, file=sys.stderr, **kwargs)
+
+
+class SMProxy(ProfileProxy):
+
+    def __init__(self, channel):
+        super().__init__(channel)
+        self.security = Security(channel)
+        self.host = Host(channel)
+        self.connection = None
+        self.pairing_stream = None
+        self.passkey_queue = Queue()
+        self._handle_pairing_requests()
+
+    @assert_description
+    def MMI_IUT_ENABLE_CONNECTION_SM(self, pts_addr: bytes, **kwargs):
+        """
+        Initiate an connection from the IUT to the PTS.
+        """
+        self.connection = self.host.ConnectLE(public=pts_addr).connection
+        return "OK"
+
+    @assert_description
+    def MMI_ASK_IUT_PERFORM_PAIRING_PROCESS(self, **kwargs):
+        """
+        Please start pairing process.
+        """
+        def secure():
+            if self.connection:
+                self.security.Secure(connection=self.connection, le=LESecurityLevel.LE_LEVEL3)
+        Thread(target=secure).start()
+        return "OK"
+
+    @assert_description
+    def MMI_IUT_SEND_DISCONNECTION_REQUEST(self, **kwargs):
+        """
+        Please initiate a disconnection to the PTS.
+
+        Description: Verify that
+        the Implementation Under Test(IUT) can initiate a disconnect request to
+        PTS.
+        """
+        self.host.Disconnect(connection=self.connection)
+        self.connection = None
+        return "OK"
+
+    def MMI_LESC_NUMERIC_COMPARISON(self, **kwargs):
+        """
+        Please confirm the following number matches IUT: 385874.
+        """
+        return "OK"
+
+    @assert_description
+    def MMI_ASK_IUT_PERFORM_RESET(self, **kwargs):
+        """
+        Please reset your device.
+        """
+        self.host.Reset()
+        return "OK"
+
+    @assert_description
+    def MMI_TESTER_ENABLE_CONNECTION_SM(self, **kwargs):
+        """
+        Action: Place the IUT in connectable mode
+        """
+        self.host.StartAdvertising(
+            connectable=True,
+            own_address_type=OwnAddressType.PUBLIC,
+        )
+        return "OK"
+
+    @assert_description
+    def MMI_IUT_SMP_TIMEOUT_30_SECONDS(self, **kwargs):
+        """
+        Wait for the 30 seconds. Lower tester will not send corresponding or
+        next SMP message.
+        """
+        return "OK"
+
+    @assert_description
+    def MMI_IUT_SMP_TIMEOUT_ADDITIONAL_10_SECONDS(self, **kwargs):
+        """
+        Wait for an additional 10 seconds. Lower test will send corresponding or
+        next SMP message.
+        """
+        return "OK"
+
+    @match_description
+    def MMI_DISPLAY_PASSKEY_CODE(self, passkey: str, **kwargs):
+        """
+        Please enter (?P<passkey>[0-9]*) in the IUT.
+        """
+        self.passkey_queue.put(passkey)
+        return "OK"
+
+    @assert_description
+    def MMI_ENTER_PASSKEY_CODE(self, **kwargs):
+        """
+        Please enter 6 digit passkey code.
+        """
+
+        return "OK"
+
+    @assert_description
+    def MMI_ENTER_WRONG_DYNAMIC_PASSKEY_CODE(self, **kwargs):
+        """
+        Please enter invalid 6 digit pin code.
+        """
+
+        return "OK"
+
+    @assert_description
+    def MMI_IUT_ABORT_PAIRING_PROCESS_DISCONNECT(self, **kwargs):
+        """
+        Lower tester expects IUT aborts pairing process, and disconnect.
+        """
+
+        return "OK"
+
+    @assert_description
+    def MMI_IUT_ACCEPT_CONNECTION_BR_EDR(self, **kwargs):
+        """
+        Please prepare IUT into a connectable mode in BR/EDR.
+
+        Description:
+        Verify that the Implementation Under Test (IUT) can accept a connect
+        request from PTS.
+        """
+
+        return "OK"
+
+    @assert_description
+    def _mmi_2001(self, **kwargs):
+        """
+        Please verify the passKey is correct: 000000
+        """
+        return "OK"
+
+    def _handle_pairing_requests(self):
+
+        def task():
+            pairing_events = self.security.OnPairing()
+            for event in pairing_events:
+                if event.just_works or event.numeric_comparison:
+                    pairing_events.send(event=event, confirm=True)
+                if event.passkey_entry_request:
+                    try:
+                        passkey = self.passkey_queue.get(timeout=15)
+                        pairing_events.send(event=event, passkey=int(passkey))
+                    except Empty:
+                        debug("No passkey provided within 15 seconds")
+
+        Thread(target=task).start()
diff --git a/system/hci/test/hci_layer_test.cc b/android/pandora/mmi2grpc/pandora/__init__.py
similarity index 100%
copy from system/hci/test/hci_layer_test.cc
copy to android/pandora/mmi2grpc/pandora/__init__.py
diff --git a/android/pandora/mmi2grpc/pyproject.toml b/android/pandora/mmi2grpc/pyproject.toml
new file mode 100644
index 0000000..6923987
--- /dev/null
+++ b/android/pandora/mmi2grpc/pyproject.toml
@@ -0,0 +1,14 @@
+[project]
+name = "mmi2grpc"
+authors = [{name = "Pandora", email = "pandora-core@google.com"}]
+readme = "README.md"
+dynamic = ["version", "description"]
+dependencies = ["grpcio >=1.41", "numpy >=1.22", "scipy >= 1.8"]
+
+[tool.flit.sdist]
+include = ["_build", "proto", "pandora"]
+
+[build-system]
+requires = ["flit_core==3.7.1", "grpcio-tools >=1.41"]
+build-backend = "_build.backend"
+backend-path = ["."]
diff --git a/android/pandora/server/Android.bp b/android/pandora/server/Android.bp
new file mode 100644
index 0000000..7eb0eeb
--- /dev/null
+++ b/android/pandora/server/Android.bp
@@ -0,0 +1,75 @@
+package {
+    default_applicable_licenses: ["Android-Apache-2.0"],
+}
+
+java_library_static {
+    name: "PandoraServerLib",
+
+    srcs: ["src/**/*.kt"],
+
+    sdk_version: "core_platform",
+
+    libs: [
+        // Access to hidden apis in Bluetooth:
+        "framework-bluetooth.impl",
+        "framework",
+    ],
+
+    static_libs: [
+        "androidx.test.runner",
+        "androidx.test.core",
+        "androidx.test.uiautomator_uiautomator",
+        "grpc-java-netty-shaded-test",
+        "grpc-java-lite",
+        "guava",
+        "opencensus-java-api",
+        "kotlin-test",
+        "kotlinx_coroutines",
+        "pandora_experimental-grpc-java",
+        "pandora_experimental-proto-java",
+        "opencensus-java-contrib-grpc-metrics",
+    ],
+}
+
+android_test_helper_app {
+    name: "PandoraServer",
+
+    static_libs: [
+        "PandoraServerLib",
+    ],
+
+    dex_preopt: {
+        enabled: false,
+    },
+    optimize: {
+        enabled: false,
+    },
+
+    test_suites: [
+        "general-tests",
+        "device-tests",
+        "mts-bluetooth",
+    ],
+}
+
+android_test {
+    name: "pts-bot",
+    required: ["PandoraServer"],
+    test_config: "configs/PtsBotTest.xml",
+    data: [
+        "configs/pts_bot_tests_config.json",
+        ":mmi2grpc"
+    ],
+    test_suites: ["device-tests"],
+}
+
+android_test {
+    name: "pts-bot-mts",
+    required: ["PandoraServer"],
+    test_config: "configs/PtsBotTestMts.xml",
+    data: [
+        "configs/pts_bot_tests_config.json",
+        ":mmi2grpc"
+    ],
+    test_suites: ["mts-bluetooth"],
+}
diff --git a/android/pandora/server/AndroidManifest.xml b/android/pandora/server/AndroidManifest.xml
new file mode 100644
index 0000000..08bf023
--- /dev/null
+++ b/android/pandora/server/AndroidManifest.xml
@@ -0,0 +1,47 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright (C) 2022 The Android Open Source Project
+
+     Licensed under the Apache License, Version 2.0 (the "License");
+     you may not use this file except in compliance with the License.
+     You may obtain a copy of the License at
+
+          http://www.apache.org/licenses/LICENSE-2.0
+
+     Unless required by applicable law or agreed to in writing, software
+     distributed under the License is distributed on an "AS IS" BASIS,
+     WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+     See the License for the specific language governing permissions and
+     limitations under the License.
+-->
+
+<manifest xmlns:android="http://schemas.android.com/apk/res/android"
+    package="com.android.pandora">
+    <uses-sdk android:minSdkVersion="33"/>
+
+    <application>
+        <uses-library android:name="android.test.runner" />
+
+          <service android:name=".MediaPlayerBrowserService"
+               android:exported="true">
+               <intent-filter>
+                    <action android:name="android.media.browse.MediaBrowserService"/>
+               </intent-filter>
+          </service>
+
+      <service
+          android:name=".Hfp$PandoraInCallService"
+          android:permission="android.permission.BIND_INCALL_SERVICE"
+          android:exported="true">
+        <intent-filter>
+          <action android:name="android.telecom.InCallService" />
+        </intent-filter>
+      </service>
+
+    </application>
+
+  <uses-permission android:name="android.permission.INTERNET" />
+
+    <instrumentation android:name="com.android.pandora.Main"
+                     android:targetPackage="com.android.pandora"
+                     android:label="Pandora Android Server" />
+</manifest>
diff --git a/android/pandora/server/README.md b/android/pandora/server/README.md
new file mode 100644
index 0000000..aad1f24
--- /dev/null
+++ b/android/pandora/server/README.md
@@ -0,0 +1,117 @@
+# Pandora Android server
+
+The Pandora Android server exposes the [Pandora test interfaces](
+go/pandora-doc) over gRPC implemented on top of the Android Bluetooth SDK.
+
+## Getting started
+
+Using Pandora Android server requires to:
+
+* Build AOSP for your DUT, which can be either a physical device or an Android
+  Virtual Device (AVD).
+* [Only for virtual tests] Build Rootcanal, the Android
+  virtual Bluetooth Controller.
+* Setup your test environment.
+* Build, install, and run Pandora server.
+* Run your tests.
+
+### 1. Build and run AOSP code
+
+Refer to the AOSP documentation to [initialize and sync](
+https://g3doc.corp.google.com/company/teams/android/developing/init-sync.md)
+AOSP code, and [build](
+https://g3doc.corp.google.com/company/teams/android/developing/build-flash.md)
+it for your DUT (`aosp_cf_x86_64_phone-userdebug` for the emulator).
+
+**If your DUT is a physical device**, flash the built image on it. You may
+need to use [Remote Device Proxy](
+https://g3doc.corp.google.com/company/teams/android/wfh/adb/remote_device_proxy.md)
+if you are using a remote instance to build. If you are also using `adb` on
+your local machine, you may need to force kill the local `adb` server (`adb
+kill-server` before using Remote Device Proxy.
+
+**If your DUT is a Cuttlefish virtual device**, then proceed with the following steps:
+
+* Connect to your [Chrome Remote Desktop](
+  https://remotedesktop.corp.google.com/access/).
+* Create a local Cuttlefish instance using your locally built image with the command
+  `acloud create --local-instance --local-image` (see [documentation](
+  go/acloud-manual#local-instance-using-a-locally-built-image))
+
+### 2. Build Rootcanal [only for virtual tests on a physical device]
+
+Rootcanal is a virtual Bluetooth Controller that allows emulating Bluetooth
+communications. It is used by default within Cuttlefish when running it using the [acloud](go/acloud) command (and thus this step is not
+needed) and is required for all virtual tests. However, it does not come
+preinstalled on a build for a physical device.
+
+Proceed with the [following instructions](
+https://docs.google.com/document/d/1-qoK1HtdOKK6sTIKAToFf7nu9ybxs8FQWU09idZijyc/edit#heading=h.x9snb54sjlu9)
+to build and install Rootcanal on your DUT.
+
+### 3. Setup your test environment
+
+Each time when starting a new ADB server to communicate with your DUT, proceed
+with the following steps to setup the test environment:
+
+* If running virtual tests (such as PTS-bot) on a physical device:
+  * Run Rootcanal:
+    `adb root` then
+    `adb shell ./vendor/bin/hw/android.hardware.bluetooth@1.1-service.sim &`
+  * Forward Rootcanal port through ADB:
+    `adb forward tcp:<rootcanal-port> tcp:<rootcanal-port>`.
+    Rootcanal port number may differ depending on its configuration. It is
+    7200 for the AVD, and generally 6211 for physical devices.
+* Forward Pandora Android server port through ADB:
+  `adb forward tcp:8999 tcp:8999`.
+
+The above steps can be done by executing the `setup.sh` helper script (the
+`-rootcanal` option must be used for virtual tests on a physical device).
+
+Finally, you must also make sure that the machine on which tests are executed
+can access the ports of the Pandora Android server, Rootcanal (if required),
+and ADB (if required).
+
+You can also check the usage examples provided below.
+
+### 4. Build, install, and run Pandora Android server
+
+* `m PandoraServer`
+* `adb install -r -g out/target/product/<device>/testcases/Pandora/arm64/Pandora.apk`
+
+* Start the instrumented app:
+* `adb shell am instrument -w -e Debug false com.android.pandora/.Server`
+
+### 5. Run your tests
+
+You should now be fully set up to run your tests!
+
+### Usage examples
+
+Here are some usage examples:
+
+* **DUT**: physical
+  **Test type**: virtual
+  **Test executer**: remote instance (for instance a Cloudtop) accessed via SSH
+  **Pandora Android server repository location**: local machine (typically
+  using Android Studio)
+
+  * On your local machine: `./setup.sh --rootcanal`.
+  * On your local machine: build and install the app on your DUT.
+  * Log on your remote instance, and forward Rootcanal port (6211, may change
+    depending on your build) and Pandora Android server (8999) port:
+    `ssh -R 6211:localhost:6211 -R 8999:localhost:8999 <remote-instance>`.
+    Optionnally, you can also share ADB port to your remote instance (if
+    needed) by adding `-R 5037:localhost:5037` to the command.
+  * On your remote instance: execute your tests.
+
+* **DUT**: virtual (running in remote instance)
+  **Test type**: virtual
+  **Test executer**: remote instance
+  **Pandora Android server repository location**: remote instance
+
+  On your remote instance:
+  * `./setup.sh`.
+  * Build and install the app on the AVD.
+  * Execute your tests.
+
diff --git a/android/pandora/server/configs/PtsBotTest.xml b/android/pandora/server/configs/PtsBotTest.xml
new file mode 100644
index 0000000..e748a2e
--- /dev/null
+++ b/android/pandora/server/configs/PtsBotTest.xml
@@ -0,0 +1,54 @@
+<configuration description="Runs PTS-bot tests">
+    <target_preparer class="com.android.tradefed.targetprep.TestAppInstallSetup">
+        <option name="test-file-name" value="PandoraServer.apk" />
+        <option name="install-arg" value="-r" />
+        <option name="install-arg" value="-g" />
+    </target_preparer>
+
+    <target_preparer class="com.android.tradefed.targetprep.RootTargetPreparer">
+      <option name="force-root" value="true"/>
+    </target_preparer>
+
+    <target_preparer class="com.android.tradefed.targetprep.RunHostCommandTargetPreparer">
+        <option name="host-background-command" value="adb -s $SERIAL shell am instrument --no-hidden-api-checks -w com.android.pandora/.Main" />
+    </target_preparer>
+
+    <target_preparer class="com.android.tradefed.targetprep.PythonVirtualenvPreparer">
+        <option name="dep-module" value="grpcio" />
+        <option name="dep-module" value="protobuf==3.20.1" />
+        <option name="dep-module" value="scipy" />
+    </target_preparer>
+
+    <test class="com.android.tradefed.testtype.pandora.PtsBotTest" >
+        <!-- Creates a randomized temp dir for pts-bot binaries and avoid
+             conflicts when running multiple pts-bot on the same machine -->
+        <!-- <option name="create-bin-temp-dir" value="true"/> -->
+        <!-- mmi2grpc is contained inside pts-bot folder -->
+        <option name="mmi2grpc" value="pts-bot" />
+        <option name="tests-config-file" value="pts_bot_tests_config.json" />
+        <option name="max-flaky-tests" value="0" />
+        <option name="max-retries-per-test" value="0" />
+        <option name="physical" value="false" />
+        <option name="profile" value="A2DP/SNK" />
+        <option name="profile" value="A2DP/SRC" />
+        <option name="profile" value="AVCTP" />
+        <option name="profile" value="AVDTP/SNK" />
+        <option name="profile" value="AVDTP/SRC" />
+        <option name="profile" value="AVRCP" />
+        <option name="profile" value="GAP" />
+        <option name="profile" value="GATT" />
+        <option name="profile" value="HFP/AG" />
+        <option name="profile" value="HFP/HF" />
+        <option name="profile" value="HID/HOS" />
+        <option name="profile" value="HOGP" />
+        <option name="profile" value="L2CAP/COS" />
+        <option name="profile" value="L2CAP/EXF" />
+        <option name="profile" value="L2CAP/LE" />
+        <option name="profile" value="MAP" />
+        <option name="profile" value="OPP" />
+        <option name="profile" value="PBAP/PSE" />
+        <option name="profile" value="RFCOMM" />
+        <option name="profile" value="SDP" />
+        <option name="profile" value="SM" />
+    </test>
+</configuration>
diff --git a/android/pandora/server/configs/PtsBotTestMts.xml b/android/pandora/server/configs/PtsBotTestMts.xml
new file mode 100644
index 0000000..127cb4f
--- /dev/null
+++ b/android/pandora/server/configs/PtsBotTestMts.xml
@@ -0,0 +1,60 @@
+<configuration description="Runs PTS-bot tests in MTS">
+    <target_preparer class="com.android.tradefed.targetprep.TestAppInstallSetup">
+        <option name="test-file-name" value="PandoraServer.apk" />
+        <option name="install-arg" value="-r" />
+        <option name="install-arg" value="-g" />
+    </target_preparer>
+
+    <target_preparer class="com.android.tradefed.targetprep.RootTargetPreparer">
+      <option name="force-root" value="true"/>
+    </target_preparer>
+
+    <target_preparer class="com.android.tradefed.targetprep.RunHostCommandTargetPreparer">
+        <option name="host-background-command" value="adb -s $SERIAL shell am instrument --no-hidden-api-checks -w com.android.pandora/.Main" />
+    </target_preparer>
+
+    <target_preparer class="com.android.tradefed.targetprep.PythonVirtualenvPreparer">
+        <option name="dep-module" value="grpcio" />
+        <option name="dep-module" value="protobuf==3.20.1" />
+        <option name="dep-module" value="scipy" />
+    </target_preparer>
+
+    <test class="com.android.tradefed.testtype.pandora.PtsBotTest" >
+        <!-- Creates a randomized temp dir for pts-bot binaries and avoid
+             conflicts when running multiple pts-bot on the same machine -->
+        <option name="create-bin-temp-dir" value="true"/>
+        <!-- mmi2grpc is contained inside testcases folder -->
+        <option name="mmi2grpc" value="testcases" />
+        <option name="tests-config-file" value="pts_bot_tests_config.json" />
+        <option name="max-flaky-tests" value="3" />
+        <option name="max-retries-per-test" value="3" />
+        <option name="physical" value="false" />
+        <option name="profile" value="A2DP/SNK" />
+        <option name="profile" value="A2DP/SRC" />
+        <option name="profile" value="AVCTP" />
+        <option name="profile" value="AVDTP/SNK" />
+        <option name="profile" value="AVDTP/SRC" />
+        <option name="profile" value="AVRCP" />
+        <option name="profile" value="GAP" />
+        <option name="profile" value="GATT" />
+        <option name="profile" value="HFP/AG" />
+        <option name="profile" value="HFP/HF" />
+        <option name="profile" value="HID/HOS" />
+        <option name="profile" value="HOGP" />
+        <option name="profile" value="L2CAP/COS" />
+        <option name="profile" value="L2CAP/EXF" />
+        <option name="profile" value="L2CAP/LE" />
+        <option name="profile" value="MAP" />
+        <option name="profile" value="OPP" />
+        <option name="profile" value="PBAP/PSE" />
+        <option name="profile" value="RFCOMM" />
+        <option name="profile" value="SDP" />
+        <option name="profile" value="SM" />
+    </test>
+
+    <object type="module_controller"
+            class="com.android.tradefed.testtype.suite.module.MainlineTestModuleController">
+        <option name="mainline-module-package-name" value="com.android.btservices" />
+        <option name="mainline-module-package-name" value="com.google.android.btservices" />
+    </object>
+</configuration>
diff --git a/android/pandora/server/configs/pts_bot_tests_config.json b/android/pandora/server/configs/pts_bot_tests_config.json
new file mode 100644
index 0000000..19b572f
--- /dev/null
+++ b/android/pandora/server/configs/pts_bot_tests_config.json
@@ -0,0 +1,1953 @@
+{
+  "pass": [
+    "A2DP/SNK/AS/BV-01-I",
+    "A2DP/SNK/AS/BV-02-I",
+    "A2DP/SNK/CC/BV-01-I",
+    "A2DP/SNK/CC/BV-02-I",
+    "A2DP/SNK/CC/BV-05-I",
+    "A2DP/SNK/CC/BV-06-I",
+    "A2DP/SNK/CC/BV-07-I",
+    "A2DP/SNK/CC/BV-08-I",
+    "A2DP/SNK/REL/BV-01-I",
+    "A2DP/SNK/REL/BV-02-I",
+    "A2DP/SNK/SET/BV-01-I",
+    "A2DP/SNK/SET/BV-02-I",
+    "A2DP/SNK/SET/BV-03-I",
+    "A2DP/SNK/SUS/BV-01-I",
+    "A2DP/SRC/CC/BV-09-I",
+    "A2DP/SRC/REL/BV-01-I",
+    "A2DP/SRC/REL/BV-02-I",
+    "A2DP/SRC/SDP/BV-01-I",
+    "A2DP/SRC/SET/BV-01-I",
+    "A2DP/SRC/SET/BV-02-I",
+    "A2DP/SRC/SET/BV-03-I",
+    "A2DP/SRC/SET/BV-04-I",
+    "A2DP/SRC/SUS/BV-01-I",
+    "AVCTP/CT/CCM/BV-03-C",
+    "AVCTP/CT/CCM/BV-04-C",
+    "AVCTP/TG/CCM/BV-01-C",
+    "AVCTP/TG/CCM/BV-02-C",
+    "AVCTP/TG/CCM/BV-03-C",
+    "AVCTP/TG/CCM/BV-04-C",
+    "AVCTP/TG/FRA/BV-03-C",
+    "AVCTP/TG/NFR/BI-01-C",
+    "AVCTP/TG/NFR/BV-02-C",
+    "AVCTP/TG/NFR/BV-03-C",
+    "AVDTP/SNK/ACP/SIG/SMG/BI-05-C",
+    "AVDTP/SNK/ACP/SIG/SMG/BI-08-C",
+    "AVDTP/SNK/ACP/SIG/SMG/BI-14-C",
+    "AVDTP/SNK/ACP/SIG/SMG/BI-17-C",
+    "AVDTP/SNK/ACP/SIG/SMG/BI-20-C",
+    "AVDTP/SNK/ACP/SIG/SMG/BI-26-C",
+    "AVDTP/SNK/ACP/SIG/SMG/BI-33-C",
+    "AVDTP/SNK/ACP/SIG/SMG/BV-06-C",
+    "AVDTP/SNK/ACP/SIG/SMG/BV-08-C",
+    "AVDTP/SNK/ACP/SIG/SMG/BV-10-C",
+    "AVDTP/SNK/ACP/SIG/SMG/BV-12-C",
+    "AVDTP/SNK/ACP/SIG/SMG/BV-16-C",
+    "AVDTP/SNK/ACP/SIG/SMG/BV-18-C",
+    "AVDTP/SNK/ACP/SIG/SMG/BV-22-C",
+    "AVDTP/SNK/ACP/SIG/SMG/BV-24-C",
+    "AVDTP/SNK/ACP/SIG/SMG/BV-26-C",
+    "AVDTP/SNK/ACP/SIG/SMG/ESR04/BI-28-C",
+    "AVDTP/SNK/ACP/SIG/SYN/BV-01-C",
+    "AVDTP/SNK/ACP/TRA/BTR/BI-01-C",
+    "AVDTP/SNK/ACP/TRA/BTR/BV-02-C",
+    "AVDTP/SNK/INT/SIG/SMG/BI-30-C",
+    "AVDTP/SNK/INT/SIG/SMG/BI-35-C",
+    "AVDTP/SNK/INT/SIG/SMG/BI-36-C",
+    "AVDTP/SNK/INT/SIG/SMG/BV-05-C",
+    "AVDTP/SNK/INT/SIG/SMG/BV-07-C",
+    "AVDTP/SNK/INT/SIG/SMG/BV-09-C",
+    "AVDTP/SNK/INT/SIG/SMG/BV-15-C",
+    "AVDTP/SNK/INT/SIG/SMG/BV-25-C",
+    "AVDTP/SNK/INT/SIG/SMG/BV-28-C",
+    "AVDTP/SNK/INT/SIG/SMG/BV-31-C",
+    "AVDTP/SRC/ACP/SIG/SMG/BI-05-C",
+    "AVDTP/SRC/ACP/SIG/SMG/BI-08-C",
+    "AVDTP/SRC/ACP/SIG/SMG/BI-14-C",
+    "AVDTP/SRC/ACP/SIG/SMG/BI-17-C",
+    "AVDTP/SRC/ACP/SIG/SMG/BI-20-C",
+    "AVDTP/SRC/ACP/SIG/SMG/BI-26-C",
+    "AVDTP/SRC/ACP/SIG/SMG/BI-33-C",
+    "AVDTP/SRC/ACP/SIG/SMG/BV-06-C",
+    "AVDTP/SRC/ACP/SIG/SMG/BV-08-C",
+    "AVDTP/SRC/ACP/SIG/SMG/BV-10-C",
+    "AVDTP/SRC/ACP/SIG/SMG/BV-12-C",
+    "AVDTP/SRC/ACP/SIG/SMG/BV-16-C",
+    "AVDTP/SRC/ACP/SIG/SMG/BV-18-C",
+    "AVDTP/SRC/ACP/SIG/SMG/BV-20-C",
+    "AVDTP/SRC/ACP/SIG/SMG/BV-22-C",
+    "AVDTP/SRC/ACP/SIG/SMG/BV-24-C",
+    "AVDTP/SRC/ACP/SIG/SMG/BV-26-C",
+    "AVDTP/SRC/ACP/SIG/SMG/ESR04/BI-28-C",
+    "AVDTP/SRC/ACP/SIG/SYN/BV-06-C",
+    "AVDTP/SRC/ACP/TRA/BTR/BI-01-C",
+    "AVDTP/SRC/INT/SIG/SMG/BI-30-C",
+    "AVDTP/SRC/INT/SIG/SMG/BI-36-C",
+    "AVDTP/SRC/INT/SIG/SMG/BV-05-C",
+    "AVDTP/SRC/INT/SIG/SMG/BV-07-C",
+    "AVDTP/SRC/INT/SIG/SMG/BV-09-C",
+    "AVDTP/SRC/INT/SIG/SMG/BV-15-C",
+    "AVDTP/SRC/INT/SIG/SMG/BV-17-C",
+    "AVDTP/SRC/INT/SIG/SMG/BV-19-C",
+    "AVDTP/SRC/INT/SIG/SMG/BV-21-C",
+    "AVDTP/SRC/INT/SIG/SMG/BV-25-C",
+    "AVDTP/SRC/INT/SIG/SMG/BV-28-C",
+    "AVDTP/SRC/INT/SIG/SMG/BV-31-C",
+    "AVDTP/SRC/INT/SIG/SMG/BI-35-C",
+    "AVDTP/SRC/INT/SIG/SYN/BV-05-C",
+    "AVDTP/SRC/INT/TRA/BTR/BV-01-C",
+    "AVRCP/CT/CEC/BV-02-I",
+    "AVRCP/CT/CRC/BV-02-I",
+    "AVRCP/TG/CEC/BV-01-I",
+    "AVRCP/TG/CFG/BI-01-C",
+    "AVRCP/TG/CFG/BV-02-C",
+    "AVRCP/TG/CON/BV-04-C",
+    "AVRCP/TG/CRC/BV-01-I",
+    "AVRCP/TG/CRC/BV-02-I",
+    "AVRCP/TG/ICC/BV-01-I",
+    "AVRCP/TG/ICC/BV-02-I",
+    "AVRCP/TG/INV/BI-01-C",
+    "AVRCP/TG/INV/BI-02-C",
+    "AVRCP/TG/MCN/CB/BI-01-C",
+    "AVRCP/TG/MCN/CB/BI-03-C",
+    "AVRCP/TG/MCN/CB/BI-04-C",
+    "AVRCP/TG/MCN/CB/BI-05-C",
+    "AVRCP/TG/MCN/CB/BV-02-C",
+    "AVRCP/TG/MCN/CB/BV-02-I",
+    "AVRCP/TG/MCN/CB/BV-03-I",
+    "AVRCP/TG/MCN/CB/BV-05-C",
+    "AVRCP/TG/MCN/CB/BV-06-C",
+    "AVRCP/TG/MCN/CB/BV-06-I",
+    "AVRCP/TG/MCN/CB/BV-08-C",
+    "AVRCP/TG/MCN/NP/BV-02-C",
+    "AVRCP/TG/MCN/NP/BV-06-C",
+    "AVRCP/TG/MCN/NP/BV-07-C",
+    "AVRCP/TG/MCN/NP/BV-09-C",
+    "AVRCP/TG/MCN/NP/BV-04-I",
+    "AVRCP/TG/MCN/NP/BV-05-I",
+    "AVRCP/TG/MDI/BV-02-C",
+    "AVRCP/TG/MDI/BV-04-C",
+    "AVRCP/TG/MDI/BV-05-C",
+    "AVRCP/TG/MPS/BI-01-C",
+    "AVRCP/TG/MPS/BI-02-C",
+    "AVRCP/TG/MPS/BV-02-C",
+    "AVRCP/TG/MPS/BV-02-I",
+    "AVRCP/TG/MPS/BV-03-I",
+    "AVRCP/TG/MPS/BV-04-C",
+    "AVRCP/TG/MPS/BV-06-C",
+    "AVRCP/TG/MPS/BV-09-C",
+    "AVRCP/TG/NFY/BI-01-C",
+    "AVRCP/TG/NFY/BV-02-C",
+    "AVRCP/TG/PTT/BV-01-I",
+    "AVRCP/TG/PTT/BV-05-I",
+    "AVRCP/TG/RCR/BV-04-C",
+    "GAP/ADV/BV-01-C",
+    "GAP/ADV/BV-02-C",
+    "GAP/ADV/BV-03-C",
+    "GAP/ADV/BV-04-C",
+    "GAP/ADV/BV-05-C",
+    "GAP/CONN/DCEP/BV-03-C",
+    "GAP/CONN/NCON/BV-01-C",
+    "GAP/CONN/UCON/BV-01-C",
+    "GAP/CONN/UCON/BV-02-C",
+    "GAP/DISC/GENM/BV-02-C",
+    "GAP/DISC/GENP/BV-01-C",
+    "GAP/DISC/GENP/BV-02-C",
+    "GAP/DISC/GENP/BV-03-C",
+    "GAP/DISC/GENP/BV-04-C",
+    "GAP/DISC/GENP/BV-05-C",
+    "GAP/DISC/NONM/BV-01-C",
+    "GAP/DM/CON/BV-01-C",
+    "GAP/DM/GIN/BV-01-C",
+    "GAP/DM/LEP/BV-04-C",
+    "GAP/DM/NAD/BV-01-C",
+    "GAP/IDLE/GIN/BV-01-C",
+    "GAP/IDLE/NAMP/BV-02-C",
+    "GAP/MOD/CON/BV-01-C",
+    "GAP/MOD/GDIS/BV-01-C",
+    "GAP/MOD/GDIS/BV-02-C",
+    "GAP/MOD/NCON/BV-01-C",
+    "GAP/MOD/NDIS/BV-01-C",
+    "GAP/SEC/AUT/BV-11-C",
+    "GAP/SEC/AUT/BV-12-C",
+    "GAP/SEC/SEM/BV-04-C",
+    "GATT/CL/GAC/BV-01-C",
+    "GATT/CL/GAD/BV-01-C",
+    "GATT/CL/GAD/BV-02-C",
+    "GATT/CL/GAD/BV-03-C",
+    "GATT/CL/GAD/BV-04-C",
+    "GATT/CL/GAD/BV-05-C",
+    "GATT/CL/GAD/BV-06-C",
+    "GATT/CL/GAD/BV-07-C",
+    "GATT/CL/GAD/BV-08-C",
+    "GATT/CL/GAR/BI-01-C",
+    "GATT/CL/GAR/BI-02-C",
+    "GATT/CL/GAR/BI-06-C",
+    "GATT/CL/GAR/BI-07-C",
+    "GATT/CL/GAR/BI-12-C",
+    "GATT/CL/GAR/BI-13-C",
+    "GATT/CL/GAR/BI-14-C",
+    "GATT/CL/GAR/BI-35-C",
+    "GATT/CL/GAR/BV-01-C",
+    "GATT/CL/GAR/BV-04-C",
+    "GATT/CL/GAR/BV-06-C",
+    "GATT/CL/GAR/BV-07-C",
+    "GATT/CL/GAW/BI-02-C",
+    "GATT/CL/GAW/BI-03-C",
+    "GATT/CL/GAW/BI-07-C",
+    "GATT/CL/GAW/BI-08-C",
+    "GATT/CL/GAW/BI-09-C",
+    "GATT/CL/GAW/BI-33-C",
+    "GATT/CL/GAW/BI-34-C",
+    "GATT/CL/GAW/BV-03-C",
+    "GATT/CL/GAW/BV-05-C",
+    "GATT/CL/GAW/BV-08-C",
+    "GATT/CL/GAW/BV-09-C",
+    "GATT/SR/GAC/BV-01-C",
+    "GATT/SR/GAD/BV-01-C",
+    "GATT/SR/GAD/BV-02-C",
+    "GATT/SR/GAD/BV-03-C",
+    "GATT/SR/GAD/BV-04-C",
+    "GATT/SR/GAD/BV-05-C",
+    "GATT/SR/GAD/BV-06-C",
+    "GATT/SR/GAD/BV-07-C",
+    "GATT/SR/GAD/BV-08-C",
+    "GATT/SR/GAR/BI-01-C",
+    "GATT/SR/GAR/BI-02-C",
+    "GATT/SR/GAR/BI-04-C",
+    "GATT/SR/GAR/BI-06-C",
+    "GATT/SR/GAR/BI-07-C",
+    "GATT/SR/GAR/BI-08-C",
+    "GATT/SR/GAR/BI-10-C",
+    "GATT/SR/GAR/BI-12-C",
+    "GATT/SR/GAR/BI-13-C",
+    "GATT/SR/GAR/BI-14-C",
+    "GATT/SR/GAR/BI-16-C",
+    "GATT/SR/GAR/BI-18-C",
+    "GATT/SR/GAR/BI-19-C",
+    "GATT/SR/GAR/BI-21-C",
+    "GATT/SR/GAR/BI-36-C",
+    "GATT/SR/GAR/BI-38-C",
+    "GATT/SR/GAR/BI-42-C",
+    "GATT/SR/GAR/BV-01-C",
+    "GATT/SR/GAR/BV-03-C",
+    "GATT/SR/GAR/BV-04-C",
+    "GATT/SR/GAR/BV-05-C",
+    "GATT/SR/GAR/BV-09-C",
+    "GATT/CL/GAS/BV-05-C",
+    "GATT/CL/GAT/BV-01-C",
+    "GATT/CL/GAT/BV-02-C",
+    "GATT/SR/GAW/BI-02-C",
+    "GATT/SR/GAW/BI-03-C",
+    "GATT/SR/GAW/BI-05-C",
+    "GATT/SR/GAW/BI-07-C",
+    "GATT/SR/GAW/BI-08-C",
+    "GATT/SR/GAW/BI-12-C",
+    "GATT/SR/UNS/BI-01-C",
+    "GATT/SR/UNS/BI-02-C",
+    "HFP/AG/DIS/BV-01-I",
+    "HFP/AG/ACC/BV-08-I",
+    "HFP/AG/ACC/BV-09-I",
+    "HFP/AG/ACC/BV-15-I",
+    "HFP/AG/ACR/BV-01-I",
+    "HFP/AG/ACR/BV-02-I",
+    "HFP/AG/ACS/BI-14-I",
+    "HFP/AG/ACS/BV-04-I",
+    "HFP/AG/ACS/BV-08-I",
+    "HFP/AG/ACS/BV-11-I",
+    "HFP/AG/ATA/BV-02-I",
+    "HFP/AG/ATH/BV-03-I",
+    "HFP/AG/ATH/BV-04-I",
+    "HFP/AG/ATH/BV-06-I",
+    "HFP/AG/CLI/BV-01-I",
+    "HFP/AG/ECS/BV-03-I",
+    "HFP/AG/ENO/BV-01-I",
+    "HFP/AG/HFI/BV-02-I",
+    "HFP/AG/ICA/BV-07-I",
+    "HFP/AG/ICA/BV-08-I",
+    "HFP/AG/ICA/BV-09-I",
+    "HFP/AG/NUM/BV-01-I",
+    "HFP/AG/OCL/BV-02-I",
+    "HFP/AG/PSI/BV-03-C",
+    "HFP/AG/PSI/BV-04-I",
+    "HFP/AG/SDP/BV-01-I",
+    "HFP/AG/SLC/BV-01-C",
+    "HFP/AG/SLC/BV-03-C",
+    "HFP/AG/SLC/BV-09-I",
+    "HFP/AG/SLC/BV-10-I",
+    "HFP/AG/TCA/BV-02-I",
+    "HFP/AG/TCA/BV-03-I",
+    "HFP/AG/TCA/BV-04-I",
+    "HFP/AG/TCA/BV-05-I",
+    "HFP/AG/TDC/BV-01-I",
+    "HFP/AG/TWC/BV-02-I",
+    "HFP/AG/TWC/BV-03-I",
+    "HFP/AG/WBS/BV-01-I",
+    "HID/HOS/DAT/BV-01-C",
+    "HID/HOS/HCE/BV-01-I",
+    "HID/HOS/HCE/BV-03-I",
+    "HID/HOS/HCE/BV-04-I",
+    "HID/HOS/HCR/BV-02-I",
+    "HID/HOS/HDT/BV-01-I ",
+    "HID/HOS/HDT/BV-02-I",
+    "HOGP/RH/HGCF/BV-01-I",
+    "HOGP/RH/HGDC/BV-01-I",
+    "HOGP/RH/HGDC/BV-02-I",
+    "HOGP/RH/HGDC/BV-03-I",
+    "HOGP/RH/HGDC/BV-04-I",
+    "HOGP/RH/HGDC/BV-05-I",
+    "HOGP/RH/HGDC/BV-06-I",
+    "HOGP/RH/HGDC/BV-07-I",
+    "HOGP/RH/HGDC/BV-14-I",
+    "HOGP/RH/HGDC/BV-15-I",
+    "HOGP/RH/HGDC/BV-16-I",
+    "HOGP/RH/HGDR/BV-01-I",
+    "HOGP/RH/HGDS/BV-01-I",
+    "HOGP/RH/HGDS/BV-02-I",
+    "HOGP/RH/HGDS/BV-03-I",
+    "HOGP/RH/HGNF/BI-01-I",
+    "HOGP/RH/HGNF/BI-02-I",
+    "HOGP/RH/HGNF/BV-01-I",
+    "HOGP/RH/HGRF/BV-01-I",
+    "HOGP/RH/HGRF/BV-02-I",
+    "HOGP/RH/HGRF/BV-04-I",
+    "HOGP/RH/HGRF/BV-05-I",
+    "HOGP/RH/HGRF/BV-06-I",
+    "HOGP/RH/HGRF/BV-08-I",
+    "HOGP/RH/HGRF/BV-10-I",
+    "HOGP/RH/HGRF/BV-12-I",
+    "L2CAP/COS/CED/BI-01-C",
+    "L2CAP/COS/CED/BV-03-C",
+    "L2CAP/COS/CED/BV-05-C",
+    "L2CAP/COS/CED/BV-07-C",
+    "L2CAP/COS/CED/BV-08-C",
+    "L2CAP/COS/CED/BV-11-C",
+    "L2CAP/COS/CFC/BV-01-C",
+    "L2CAP/COS/CFC/BV-02-C",
+    "L2CAP/COS/CFC/BV-03-C",
+    "L2CAP/COS/CFC/BV-04-C",
+    "L2CAP/COS/CFD/BV-02-C",
+    "L2CAP/COS/CFD/BV-03-C",
+    "L2CAP/COS/CFD/BV-11-C",
+    "L2CAP/COS/CFD/BV-12-C",
+    "L2CAP/COS/CFD/BV-14-C",
+    "L2CAP/COS/ECH/BV-01-C",
+    "L2CAP/COS/IEX/BV-02-C",
+    "L2CAP/EXF/BV-01-C",
+    "L2CAP/EXF/BV-02-C",
+    "L2CAP/EXF/BV-03-C",
+    "L2CAP/EXF/BV-05-C",
+    "L2CAP/LE/CFC/BI-01-C",
+    "L2CAP/LE/CFC/BV-01-C",
+    "L2CAP/LE/CFC/BV-02-C",
+    "L2CAP/LE/CFC/BV-03-C",
+    "L2CAP/LE/CFC/BV-04-C",
+    "L2CAP/LE/CFC/BV-05-C",
+    "L2CAP/LE/CFC/BV-06-C",
+    "L2CAP/LE/CFC/BV-09-C",
+    "L2CAP/LE/CFC/BV-10-C",
+    "L2CAP/LE/CFC/BV-12-C",
+    "L2CAP/LE/CFC/BV-14-C",
+    "L2CAP/LE/CFC/BV-16-C",
+    "L2CAP/LE/CFC/BV-18-C",
+    "L2CAP/LE/CFC/BV-19-C",
+    "L2CAP/LE/CFC/BV-20-C",
+    "L2CAP/LE/CFC/BV-21-C",
+    "L2CAP/LE/CPU/BI-01-C",
+    "L2CAP/LE/CPU/BI-02-C",
+    "L2CAP/LE/CPU/BV-02-C",
+    "L2CAP/LE/REJ/BI-01-C",
+    "MAP/MSE/GOEP/BC/BV-01-I",
+    "MAP/MSE/GOEP/BC/BV-03-I",
+    "MAP/MSE/GOEP/CON/BV-01-C",
+    "MAP/MSE/GOEP/CON/BV-02-C",
+    "MAP/MSE/GOEP/ROB/BV-01-C",
+    "MAP/MSE/GOEP/ROB/BV-02-C",
+    "MAP/MSE/GOEP/SRM/BI-02-C",
+    "MAP/MSE/GOEP/SRM/BI-03-C",
+    "MAP/MSE/GOEP/SRM/BI-05-C",
+    "MAP/MSE/GOEP/SRM/BV-04-C",
+    "MAP/MSE/GOEP/SRM/BV-08-C",
+    "MAP/MSE/GOEP/SRMP/BV-02-C",
+    "MAP/MSE/MMB/BV-09-I",
+    "MAP/MSE/MMB/BV-10-I",
+    "MAP/MSE/MMB/BV-11-I",
+    "MAP/MSE/MMB/BV-13-I",
+    "MAP/MSE/MMB/BV-14-I",
+    "MAP/MSE/MMB/BV-15-I",
+    "MAP/MSE/MMB/BV-16-I",
+    "MAP/MSE/MMB/BV-20-I",
+    "MAP/MSE/MMB/BV-36-I",
+    "MAP/MSE/MMD/BV-02-I",
+    "MAP/MSE/MMI/BV-02-I",
+    "MAP/MSE/MMN/BV-02-I",
+    "MAP/MSE/MMN/BV-04-I",
+    "MAP/MSE/MMN/BV-06-I",
+    "MAP/MSE/MMU/BV-03-I",
+    "MAP/MSE/MNR/BV-03-I",
+    "MAP/MSE/MNR/BV-04-I",
+    "MAP/MSE/MSM/BV-05-I",
+    "MAP/MSE/MSM/BV-06-I",
+    "MAP/MSE/MSM/BV-07-I",
+    "MAP/MSE/MSM/BV-08-I",
+    "OPP/SR/GOEP/BC/BV-01-I",
+    "OPP/SR/GOEP/CON/BV-02-C",
+    "OPP/SR/GOEP/ROB/BV-01-C",
+    "OPP/SR/GOEP/SRM/BI-03-C",
+    "OPP/SR/OPH/BV-01-I",
+    "OPP/SR/OPH/BV-02-I",
+    "OPP/SR/OPH/BV-34-I",
+    "PBAP/PSE/GOEP/BC/BV-03-I",
+    "PBAP/PSE/GOEP/CON/BV-02-C",
+    "PBAP/PSE/GOEP/ROB/BV-01-C",
+    "PBAP/PSE/GOEP/ROB/BV-02-C",
+    "PBAP/PSE/GOEP/SRM/BI-03-C",
+    "PBAP/PSE/GOEP/SRM/BI-05-C",
+    "PBAP/PSE/GOEP/SRM/BV-08-C",
+    "PBAP/PSE/GOEP/SRMP/BI-02-C",
+    "PBAP/PSE/GOEP/SRMP/BV-02-C",
+    "PBAP/PSE/PBB/BI-01-C",
+    "PBAP/PSE/PBB/BI-07-C",
+    "PBAP/PSE/PBB/BV-06-C",
+    "PBAP/PSE/PBB/BV-07-C",
+    "PBAP/PSE/PBB/BV-08-C",
+    "PBAP/PSE/PBB/BV-09-C",
+    "PBAP/PSE/PBB/BV-10-C",
+    "PBAP/PSE/PBB/BV-11-C",
+    "PBAP/PSE/PBB/BV-12-C",
+    "PBAP/PSE/PBB/BV-19-C",
+    "PBAP/PSE/PBB/BV-20-C",
+    "PBAP/PSE/PBB/BV-21-C",
+    "PBAP/PSE/PBB/BV-22-C",
+    "PBAP/PSE/PBB/BV-23-C",
+    "PBAP/PSE/PBB/BV-31-C",
+    "PBAP/PSE/PBD/BI-01-C",
+    "PBAP/PSE/PBD/BV-02-C",
+    "PBAP/PSE/PBD/BV-03-C",
+    "PBAP/PSE/PBD/BV-17-C",
+    "PBAP/PSE/PBD/BV-24-C",
+    "PBAP/PSE/PBD/BV-25-C",
+    "PBAP/PSE/PBD/BV-26-C",
+    "PBAP/PSE/PBD/BV-27-C",
+    "PBAP/PSE/PBD/BV-28-C",
+    "PBAP/PSE/PBD/BV-36-C",
+    "PBAP/PSE/PBF/BV-01-I",
+    "PBAP/PSE/PBF/BV-02-I",
+    "PBAP/PSE/PBF/BV-03-I",
+    "PBAP/PSE/PDF/BV-01-I",
+    "PBAP/PSE/PDF/BV-06-I",
+    "PBAP/PSE/SSM/BI-02-C",
+    "PBAP/PSE/SSM/BV-03-C",
+    "PBAP/PSE/SSM/BV-05-C",
+    "PBAP/PSE/SSM/BV-08-I",
+    "PBAP/PSE/SSM/BV-11-C",
+    "RFCOMM/DEVA/RFC/BV-01-C",
+    "RFCOMM/DEVB/RFC/BV-02-C",
+    "RFCOMM/DEVA-DEVB/RFC/BV-03-C",
+    "RFCOMM/DEVA-DEVB/RFC/BV-04-C",
+    "RFCOMM/DEVA/RFC/BV-05-C",
+    "RFCOMM/DEVB/RFC/BV-06-C",
+    "RFCOMM/DEVA-DEVB/RFC/BV-07-C",
+    "RFCOMM/DEVA-DEVB/RFC/BV-08-C",
+    "RFCOMM/DEVA-DEVB/RFC/BV-11-C",
+    "RFCOMM/DEVA-DEVB/RFC/BV-13-C",
+    "RFCOMM/DEVA-DEVB/RFC/BV-15-C",
+    "RFCOMM/DEVA-DEVB/RFC/BV-17-C",
+    "RFCOMM/DEVA-DEVB/RFC/BV-19-C",
+    "RFCOMM/DEVA-DEVB/RFC/BV-25-C,",
+    "SDP/SR/BRW/BV-02-C",
+    "SDP/SR/SA/BI-01-C",
+    "SDP/SR/SA/BI-02-C",
+    "SDP/SR/SA/BI-03-C",
+    "SDP/SR/SA/BV-01-C",
+    "SDP/SR/SA/BV-03-C",
+    "SDP/SR/SA/BV-05-C",
+    "SDP/SR/SA/BV-08-C",
+    "SDP/SR/SA/BV-09-C",
+    "SDP/SR/SA/BV-12-C",
+    "SDP/SR/SA/BV-13-C",
+    "SDP/SR/SA/BV-17-C",
+    "SDP/SR/SA/BV-20-C",
+    "SDP/SR/SA/BV-21-C",
+    "SDP/SR/SS/BI-01-C",
+    "SDP/SR/SS/BI-02-C",
+    "SDP/SR/SS/BV-01-C",
+    "SDP/SR/SS/BV-03-C",
+    "SDP/SR/SS/BV-04-C",
+    "SDP/SR/SSA/BI-01-C",
+    "SDP/SR/SSA/BI-02-C",
+    "SDP/SR/SSA/BV-01-C",
+    "SDP/SR/SSA/BV-02-C",
+    "SDP/SR/SSA/BV-03-C",
+    "SDP/SR/SSA/BV-04-C",
+    "SDP/SR/SSA/BV-06-C",
+    "SDP/SR/SSA/BV-11-C",
+    "SDP/SR/SSA/BV-12-C",
+    "SDP/SR/SSA/BV-13-C",
+    "SDP/SR/SSA/BV-16-C",
+    "SDP/SR/SSA/BV-17-C",
+    "SDP/SR/SSA/BV-20-C",
+    "SDP/SR/SSA/BV-23-C",
+    "SM/CEN/EKS/BI-01-C",
+    "SM/CEN/EKS/BV-01-C",
+    "SM/CEN/JW/BI-01-C",
+    "SM/CEN/JW/BI-04-C",
+    "SM/CEN/JW/BV-05-C",
+    "SM/CEN/KDU/BI-01-C",
+    "SM/CEN/KDU/BV-04-C",
+    "SM/CEN/KDU/BV-05-C",
+    "SM/CEN/KDU/BV-06-C",
+    "SM/CEN/KDU/BV-10-C",
+    "SM/CEN/KDU/BV-11-C",
+    "SM/CEN/PKE/BI-01-C",
+    "SM/CEN/PKE/BI-02-C",
+    "SM/CEN/PKE/BV-04-C",
+    "SM/CEN/PROT/BV-01-C",
+    "SM/CEN/SCJW/BI-01-C",
+    "SM/CEN/SCJW/BV-04-C",
+    "SM/CEN/SCPK/BI-01-C",
+    "SM/PER/EKS/BI-02-C",
+    "SM/PER/EKS/BV-02-C",
+    "SM/PER/JW/BI-02-C",
+    "SM/PER/JW/BI-03-C",
+    "SM/PER/JW/BV-02-C",
+    "SM/PER/KDU/BI-01-C",
+    "SM/PER/KDU/BV-01-C",
+    "SM/PER/KDU/BV-02-C",
+    "SM/PER/KDU/BV-03-C",
+    "SM/PER/KDU/BV-07-C",
+    "SM/PER/KDU/BV-08-C",
+    "SM/PER/KDU/BV-09-C",
+    "SM/PER/PKE/BI-03-C",
+    "SM/PER/PKE/BV-02-C",
+    "SM/PER/PKE/BV-05-C",
+    "SM/PER/PROT/BV-02-C",
+    "SM/PER/SCJW/BI-02-C",
+    "SM/PER/SCJW/BV-03-C",
+    "SM/PER/SCPK/BI-03-C",
+    "SM/PER/SCPK/BV-02-C"
+  ],
+  "flaky": [
+    "A2DP/SRC/SUS/BV-02-I",
+    "AVRCP/TG/RCR/BV-02-C"
+  ],
+  "skip": [
+    "A2DP/SNK/SDP/BV-02-I",
+    "A2DP/SNK/SET/BV-04-I",
+    "A2DP/SNK/SET/BV-05-I",
+    "A2DP/SNK/SET/BV-06-I",
+    "A2DP/SNK/SUS/BV-02-I",
+    "A2DP/SNK/SYN/BV-01-C",
+    "A2DP/SRC/AS/BV-01-I",
+    "A2DP/SRC/AS/BV-02-I",
+    "A2DP/SRC/AS/BV-03-I",
+    "A2DP/SRC/CC/BV-10-I",
+    "A2DP/SRC/SET/BV-05-I",
+    "A2DP/SRC/SET/BV-06-I",
+    "A2DP/SRC/SUS/BV-02-I",
+    "A2DP/SRC/SYN/BV-02-I",
+    "AVCTP/CT/CCM/BV-01-C",
+    "AVCTP/CT/CCM/BV-02-C",
+    "AVCTP/CT/FRA/BV-01-C",
+    "AVCTP/CT/FRA/BV-04-C",
+    "AVCTP/CT/NFR/BV-01-C",
+    "AVCTP/CT/NFR/BV-04-C",
+    "AVCTP/TG/FRA/BV-02-C",
+    "AVDTP/SNK/ACP/SIG/SMG/BI-11-C",
+    "AVDTP/SNK/ACP/SIG/SMG/BI-23-C",
+    "AVDTP/SNK/ACP/SIG/SMG/BV-14-C",
+    "AVDTP/SNK/ACP/SIG/SMG/BV-20-C",
+    "AVDTP/SNK/ACP/SIG/SMG/ESR05/BV-14-C",
+    "AVDTP/SNK/ACP/SIG/SYN/BV-03-C",
+    "AVDTP/SNK/INT/SIG/SMG/BV-11-C",
+    "AVDTP/SNK/INT/SIG/SMG/BV-13-C",
+    "AVDTP/SNK/INT/SIG/SMG/BV-19-C",
+    "AVDTP/SNK/INT/SIG/SMG/BV-23-C",
+    "AVDTP/SNK/INT/SIG/SMG/ESR05/BV-13-C",
+    "AVDTP/SNK/INT/SIG/SYN/BV-02-C",
+    "AVDTP/SNK/INT/SIG/SYN/BV-04-C",
+    "AVDTP/SRC/ACP/SIG/SMG/BI-11-C",
+    "AVDTP/SRC/ACP/SIG/SMG/BI-23-C",
+    "AVDTP/SRC/ACP/SIG/SMG/BV-14-C",
+    "AVDTP/SRC/ACP/SIG/SMG/ESR05/BV-14-C",
+    "AVDTP/SRC/INT/SIG/SMG/BV-11-C",
+    "AVDTP/SRC/INT/SIG/SMG/BV-13-C",
+    "AVDTP/SRC/INT/SIG/SMG/BV-23-C",
+    "AVDTP/SRC/INT/SIG/SMG/ESR05/BV-13-C",
+    "AVRCP/CT/CEC/BV-01-I",
+    "AVRCP/CT/CRC/BV-01-I",
+    "AVRCP/CT/PTH/BV-01-C",
+    "AVRCP/CT/PTT/BV-01-I",
+    "AVRCP/TG/MCN/CB/BI-02-C",
+    "AVRCP/TG/MCN/CB/BV-01-I",
+    "AVRCP/TG/MCN/CB/BV-04-I",
+    "AVRCP/TG/MCN/CB/BV-09-C",
+    "AVRCP/TG/MCN/NP/BI-01-C",
+    "AVRCP/TG/MCN/NP/BV-01-I",
+    "AVRCP/TG/MCN/NP/BV-06-I",
+    "AVRCP/TG/MPS/BV-01-I",
+    "AVRCP/TG/NFY/BV-04-C",
+    "AVRCP/TG/NFY/BV-06-C",
+    "AVRCP/TG/NFY/BV-07-C",
+    "AVRCP/TG/RCR/BV-02-C",
+    "GAP/BOND/BON/BV-01-C",
+    "GAP/BOND/BON/BV-02-C",
+    "GAP/BOND/BON/BV-03-C",
+    "GAP/BOND/BON/BV-04-C",
+    "GAP/BOND/NBON/BV-01-C",
+    "GAP/BOND/NBON/BV-02-C",
+    "GAP/BOND/NBON/BV-03-C",
+    "GAP/CONN/ACEP/BV-01-C",
+    "GAP/CONN/CPUP/BV-01-C",
+    "GAP/CONN/CPUP/BV-02-C",
+    "GAP/CONN/CPUP/BV-03-C",
+    "GAP/CONN/CPUP/BV-04-C",
+    "GAP/CONN/CPUP/BV-05-C",
+    "GAP/CONN/CPUP/BV-06-C",
+    "GAP/CONN/CPUP/BV-08-C",
+    "GAP/CONN/DCEP/BV-01-C",
+    "GAP/CONN/GCEP/BV-01-C",
+    "GAP/CONN/GCEP/BV-02-C",
+    "GAP/CONN/NCON/BV-02-C",
+    "GAP/CONN/TERM/BV-01-C",
+    "GAP/DISC/GENM/BV-01-C",
+    "GAP/DISC/NONM/BV-02-C",
+    "GAP/DM/BON/BV-01-C",
+    "GAP/DM/LEP/BV-01-C",
+    "GAP/DM/LEP/BV-02-C",
+    "GAP/DM/LEP/BV-05-C",
+    "GAP/DM/LEP/BV-06-C",
+    "GAP/DM/LEP/BV-07-C",
+    "GAP/DM/LEP/BV-08-C",
+    "GAP/DM/LEP/BV-09-C",
+    "GAP/DM/LEP/BV-10-C",
+    "GAP/DM/LEP/BV-11-C",
+    "GAP/DM/NAD/BV-02-C",
+    "GAP/DM/NCON/BV-01-C",
+    "GAP/IDLE/DED/BV-02-C",
+    "GAP/IDLE/NAMP/BV-01-C",
+    "GAP/SEC/AUT/BV-02-C",
+    "GAP/SEC/AUT/BV-13-C",
+    "GAP/SEC/AUT/BV-14-C",
+    "GAP/SEC/AUT/BV-17-C",
+    "GAP/SEC/AUT/BV-18-C",
+    "GAP/SEC/AUT/BV-19-C",
+    "GAP/SEC/AUT/BV-20-C",
+    "GAP/SEC/AUT/BV-21-C",
+    "GAP/SEC/AUT/BV-22-C",
+    "GAP/SEC/AUT/BV-23-C",
+    "GAP/SEC/AUT/BV-24-C",
+    "GAP/SEC/SEM/BI-01-C",
+    "GAP/SEC/SEM/BI-02-C",
+    "GAP/SEC/SEM/BI-04-C",
+    "GAP/SEC/SEM/BI-05-C",
+    "GAP/SEC/SEM/BI-06-C",
+    "GAP/SEC/SEM/BI-08-C",
+    "GAP/SEC/SEM/BI-09-C",
+    "GAP/SEC/SEM/BI-10-C",
+    "GAP/SEC/SEM/BI-15-C",
+    "GAP/SEC/SEM/BI-18-C",
+    "GAP/SEC/SEM/BV-02-C",
+    "GAP/SEC/SEM/BV-05-C",
+    "GAP/SEC/SEM/BV-06-C",
+    "GAP/SEC/SEM/BV-07-C",
+    "GAP/SEC/SEM/BV-08-C",
+    "GAP/SEC/SEM/BV-09-C",
+    "GAP/SEC/SEM/BV-10-C",
+    "GAP/SEC/SEM/BV-21-C",
+    "GAP/SEC/SEM/BV-22-C",
+    "GAP/SEC/SEM/BV-23-C",
+    "GAP/SEC/SEM/BV-24-C",
+    "GAP/SEC/SEM/BV-26-C",
+    "GAP/SEC/SEM/BV-27-C",
+    "GAP/SEC/SEM/BV-28-C",
+    "GAP/SEC/SEM/BV-29-C",
+    "GAP/SEC/SEM/BV-37-C",
+    "GAP/SEC/SEM/BV-38-C",
+    "GAP/SEC/SEM/BV-39-C",
+    "GAP/SEC/SEM/BV-40-C",
+    "GAP/SEC/SEM/BV-41-C",
+    "GAP/SEC/SEM/BV-42-C",
+    "GAP/SEC/SEM/BV-43-C",
+    "GAP/SEC/SEM/BV-44-C",
+    "GATT/CL/GAI/BV-01-C",
+    "GATT/CL/GAN/BV-01-C",
+    "GATT/CL/GAN/BV-02-C",
+    "GATT/CL/GAR/BI-04-C",
+    "GATT/CL/GAR/BI-05-C",
+    "GATT/CL/GAR/BI-10-C",
+    "GATT/CL/GAR/BI-11-C",
+    "GATT/CL/GAR/BI-16-C",
+    "GATT/CL/GAR/BI-17-C",
+    "GATT/CL/GAR/BV-03-C",
+    "GATT/CL/GAS/BV-01-C",
+    "GATT/CL/GAS/BV-03-C",
+    "GATT/CL/GAT/BV-03-C",
+    "GATT/CL/GAW/BI-05-C",
+    "GATT/CL/GAW/BI-06-C",
+    "GATT/CL/GAW/BI-12-C",
+    "GATT/CL/GAW/BI-13-C",
+    "GATT/CL/GAW/BI-32-C",
+    "GATT/CL/GAW/BV-01-C",
+    "GATT/CL/GAW/BV-06-C",
+    "GATT/SR/GAI/BV-01-C",
+    "GATT/SR/GAN/BV-01-C",
+    "GATT/SR/GAN/BV-02-C",
+    "GATT/SR/GAN/BV-02-C_LT2",
+    "GATT/SR/GAR/BI-05-C",
+    "GATT/SR/GAR/BI-11-C",
+    "GATT/SR/GAR/BI-17-C",
+    "GATT/SR/GAR/BI-22-C",
+    "GATT/SR/GAR/BI-44-C",
+    "GATT/SR/GAR/BV-06-C",
+    "GATT/SR/GAR/BV-07-C",
+    "GATT/SR/GAR/BV-08-C",
+    "GATT/SR/GAS/BV-01-C",
+    "GATT/SR/GAT/BV-01-C",
+    "GATT/SR/GAW/BI-06-C",
+    "GATT/SR/GAW/BI-09-C",
+    "GATT/SR/GAW/BI-13-C",
+    "GATT/SR/GAW/BI-32-C",
+    "GATT/SR/GAW/BI-33-C",
+    "GATT/SR/GAW/BV-01-C",
+    "GATT/SR/GAW/BV-03-C",
+    "GATT/SR/GAW/BV-05-C",
+    "GATT/SR/GAW/BV-06-C",
+    "GATT/SR/GAW/BV-07-C",
+    "GATT/SR/GAW/BV-08-C",
+    "GATT/SR/GAW/BV-09-C",
+    "GATT/SR/GAW/BV-10-C",
+    "GATT/SR/GAW/BV-11-C",
+    "HFP/AG/TRS/BV-01-C",
+    "HFP/AG/PSI/BV-01-C",
+    "HFP/AG/ICA/BV-04-I",
+    "HFP/AG/ATH/BV-03-I",
+    "HFP/AG/ATA/BV-01-I",
+    "HFP/AG/OCL/BV-01-I",
+    "HFP/AG/OCM/BV-01-I",
+    "HFP/AG/OCM/BV-02-I",
+    "HFP/AG/TWC/BV-05-I",
+    "HFP/AG/VRA/BV-01-I",
+    "HFP/AG/SLC/BV-02-C",
+    "HFP/AG/SLC/BV-07-I",
+    "HFP/AG/ACC/BV-10-I",
+    "HFP/AG/ACC/BV-11-I",
+    "HFP/AG/ACC/BI-12-I",
+    "HFP/AG/ACC/BI-13-I",
+    "HFP/AG/ACC/BI-14-I",
+    "HFP/AG/ICA/BV-06-I",
+    "HFP/AG/IIA/BV-01-I",
+    "HFP/AG/IIA/BV-02-I",
+    "HFP/AG/IIC/BV-02-I",
+    "HFP/AG/IID/BV-01-I",
+    "HFP/AG/IID/BV-03-I",
+    "HFP/AG/IIC/BV-01-I",
+    "HFP/AG/IIC/BV-03-I",
+    "HFP/AG/HFI/BI-03-I",
+    "HFP/AG/OCN/BV-01-I",
+    "HFP/AG/SLC/BV-04-C",
+    "HFP/HF/OCM/BV-01-I",
+    "HFP/HF/OCM/BV-02-I",
+    "HFP/HF/OCL/BV-01-I",
+    "HFP/HF/OCL/BV-02-I",
+    "HFP/HF/TWC/BV-02-I",
+    "HFP/HF/TWC/BV-03-I",
+    "HFP/HF/ENO/BV-01-I",
+    "HFP/HF/VRD/BV-01-I",
+    "HFP/HF/NUM/BV-01-I",
+    "HFP/HF/NUM/BI-01-I",
+    "HFP/HF/ACC/BV-01-I",
+    "HFP/HF/ACC/BV-02-I",
+    "HFP/HF/ECC/BV-01-I",
+    "HFP/HF/ECC/BV-02-I",
+    "HFP/HF/ECS/BV-01-I",
+    "HID/HOS/HCR/BV-01-I",
+    "L2CAP/COS/CED/BI-02-C",
+    "L2CAP/COS/CED/BV-01-C",
+    "L2CAP/COS/CED/BV-04-C",
+    "L2CAP/COS/CED/BV-09-C",
+    "L2CAP/COS/CED/BV-10-C",
+    "L2CAP/COS/CED/BV-12-C",
+    "L2CAP/COS/CED/BV-13-C",
+    "L2CAP/COS/CFD/BV-01-C",
+    "L2CAP/COS/CFD/BV-09-C",
+    "L2CAP/COS/CFD/BV-08-C",
+    "L2CAP/COS/CFD/BV-10-C",
+    "L2CAP/COS/CFD/BV-13-C",
+    "L2CAP/COS/CFC/BV-05-C",
+    "L2CAP/COS/ECH/BV-02-C",
+    "L2CAP/COS/IEX/BV-01-C",
+    "L2CAP/LE/CFC/BV-07-C",
+    "L2CAP/LE/CFC/BV-11-C",
+    "L2CAP/LE/CFC/BV-13-C",
+    "L2CAP/LE/CFC/BV-15-C",
+    "L2CAP/LE/CID/BV-01-C",
+    "L2CAP/LE/CID/BV-02-C",
+    "L2CAP/LE/CPU/BV-01-C",
+    "L2CAP/LE/REJ/BI-02-C",
+    "MAP/MSE/GOEP/SRMP/BI-02-C",
+    "MAP/MSE/MMN/BV-07-I",
+    "MAP/MSE/MMN/BV-14-I",
+    "MAP/MSE/MMU/BV-02-I",
+    "PBAP/PSE/SSM/BV-07-C",
+    "OPP/CL/GOEP/BC/BV-02-I",
+    "OPP/CL/GOEP/CON/BV-01-C",
+    "OPP/CL/OPH/BV-01-I",
+    "OPP/CL/OPH/BV-34-I",
+    "OPP/SR/BCP/BV-02-I",
+    "OPP/SR/GOEP/ROB/BV-02-C",
+    "OPP/SR/OPH/BV-10-I",
+    "OPP/SR/OPH/BV-14-I",
+    "OPP/SR/OPH/BV-18-I",
+    "RFCOMM/DEVA-DEVB/RFC/BV-21-C",
+    "RFCOMM/DEVA-DEVB/RFC/BV-22-C",
+    "SM/CEN/PKE/BV-01-C",
+    "SM/CEN/SCCT/BV-03-C",
+    "SM/CEN/SCCT/BV-05-C",
+    "SM/CEN/SCCT/BV-07-C",
+    "SM/CEN/SCCT/BV-09-C",
+    "SM/CEN/SCJW/BV-01-C",
+    "SM/CEN/SCPK/BI-02-C",
+    "SM/CEN/SCPK/BV-01-C",
+    "SM/CEN/SCPK/BV-04-C",
+    "SM/CEN/SIP/BV-02-C",
+    "SM/PER/SCCT/BV-04-C",
+    "SM/PER/SCCT/BV-06-C",
+    "SM/PER/SCCT/BV-08-C",
+    "SM/PER/SCCT/BV-10-C",
+    "SM/PER/SCJW/BV-02-C",
+    "SM/PER/SCPK/BI-04-C",
+    "SM/PER/SCPK/BV-03-C",
+    "SM/PER/SIE/BV-01-C",
+    "SM/PER/SIP/BV-01-C"
+  ],
+  "ics": {
+    "TSPC_4.0HCI_1a_2": true,
+    "TSPC_A2DP_1_1": true,
+    "TSPC_A2DP_1_2": true,
+    "TSPC_A2DP_2_1": true,
+    "TSPC_A2DP_2_2": true,
+    "TSPC_A2DP_2_3": true,
+    "TSPC_A2DP_2_4": true,
+    "TSPC_A2DP_2_5": true,
+    "TSPC_A2DP_2_6": true,
+    "TSPC_A2DP_2_7": true,
+    "TSPC_A2DP_2_8": true,
+    "TSPC_A2DP_2_9": true,
+    "TSPC_A2DP_2_10": true,
+    "TSPC_A2DP_2_13": true,
+    "TSPC_A2DP_2_14": true,
+    "TSPC_A2DP_2_15": true,
+    "TSPC_A2DP_2_17": true,
+    "TSPC_A2DP_2a_3": true,
+    "TSPC_A2DP_2b_2": true,
+    "TSPC_A2DP_3_1": true,
+    "TSPC_A2DP_3_2": true,
+    "TSPC_A2DP_3_5": true,
+    "TSPC_A2DP_3_6": true,
+    "TSPC_A2DP_3a_1": true,
+    "TSPC_A2DP_3a_3": true,
+    "TSPC_A2DP_3a_5": true,
+    "TSPC_A2DP_3a_6": true,
+    "TSPC_A2DP_3a_7": true,
+    "TSPC_A2DP_3a_8": true,
+    "TSPC_A2DP_3a_10": true,
+    "TSPC_A2DP_3a_12": true,
+    "TSPC_A2DP_4_1": true,
+    "TSPC_A2DP_4_2": true,
+    "TSPC_A2DP_4_3": true,
+    "TSPC_A2DP_4_4": true,
+    "TSPC_A2DP_4_5": true,
+    "TSPC_A2DP_4_6": true,
+    "TSPC_A2DP_4_7": true,
+    "TSPC_A2DP_4_8": true,
+    "TSPC_A2DP_4_9": true,
+    "TSPC_A2DP_4_10": true,
+    "TSPC_A2DP_4_13": true,
+    "TSPC_A2DP_4_14": true,
+    "TSPC_A2DP_4_15": true,
+    "TSPC_A2DP_5_1": true,
+    "TSPC_A2DP_5_2": true,
+    "TSPC_A2DP_5_4": true,
+    "TSPC_A2DP_5a_1": true,
+    "TSPC_A2DP_5a_2": true,
+    "TSPC_A2DP_5a_3": true,
+    "TSPC_A2DP_5a_4": true,
+    "TSPC_A2DP_5a_5": true,
+    "TSPC_A2DP_5a_6": true,
+    "TSPC_A2DP_5a_7": true,
+    "TSPC_A2DP_5a_8": true,
+    "TSPC_A2DP_5a_9": true,
+    "TSPC_A2DP_5a_10": true,
+    "TSPC_A2DP_5a_11": true,
+    "TSPC_A2DP_5a_12": true,
+    "TSPC_A2DP_7a_3": true,
+    "TSPC_A2DP_7b_2": true,
+    "TSPC_A2DP_8_2": true,
+    "TSPC_A2DP_8_3": true,
+    "TSPC_A2DP_9_1": true,
+    "TSPC_A2DP_9_2": true,
+    "TSPC_A2DP_12_2": true,
+    "TSPC_A2DP_12_3": true,
+    "TSPC_A2DP_13_1": true,
+    "TSPC_A2DP_13_2": true,
+    "TSPC_A2DP_13_3": true,
+    "TSPC_ATT_1_1": true,
+    "TSPC_ATT_1_2": true,
+    "TSPC_ATT_2_1": true,
+    "TSPC_ATT_2_2": true,
+    "TSPC_ATT_2_3": true,
+    "TSPC_ATT_2_3a": true,
+    "TSPC_ATT_2_3b": true,
+    "TSPC_ATT_3_1": true,
+    "TSPC_ATT_3_2": true,
+    "TSPC_ATT_3_3": true,
+    "TSPC_ATT_3_4": true,
+    "TSPC_ATT_3_5": true,
+    "TSPC_ATT_3_6": true,
+    "TSPC_ATT_3_7": true,
+    "TSPC_ATT_3_8": true,
+    "TSPC_ATT_3_9": true,
+    "TSPC_ATT_3_10": true,
+    "TSPC_ATT_3_11": true,
+    "TSPC_ATT_3_12": true,
+    "TSPC_ATT_3_13": true,
+    "TSPC_ATT_3_14": true,
+    "TSPC_ATT_3_15": true,
+    "TSPC_ATT_3_16": true,
+    "TSPC_ATT_3_17": true,
+    "TSPC_ATT_3_18": true,
+    "TSPC_ATT_3_19": true,
+    "TSPC_ATT_3_20": true,
+    "TSPC_ATT_3_22": true,
+    "TSPC_ATT_3_23": true,
+    "TSPC_ATT_3_24": true,
+    "TSPC_ATT_3_25": true,
+    "TSPC_ATT_3_26": true,
+    "TSPC_ATT_3_27": true,
+    "TSPC_ATT_3_28": true,
+    "TSPC_ATT_3_29": true,
+    "TSPC_ATT_3_30": true,
+    "TSPC_ATT_3_31": true,
+    "TSPC_ATT_3_32": true,
+    "TSPC_ATT_4_1": true,
+    "TSPC_ATT_4_2": true,
+    "TSPC_ATT_4_3": true,
+    "TSPC_ATT_4_4": true,
+    "TSPC_ATT_4_5": true,
+    "TSPC_ATT_4_6": true,
+    "TSPC_ATT_4_7": true,
+    "TSPC_ATT_4_8": true,
+    "TSPC_ATT_4_9": true,
+    "TSPC_ATT_4_10": true,
+    "TSPC_ATT_4_11": true,
+    "TSPC_ATT_4_12": true,
+    "TSPC_ATT_4_13": true,
+    "TSPC_ATT_4_14": true,
+    "TSPC_ATT_4_15": true,
+    "TSPC_ATT_4_16": true,
+    "TSPC_ATT_4_17": true,
+    "TSPC_ATT_4_18": true,
+    "TSPC_ATT_4_19": true,
+    "TSPC_ATT_4_20": true,
+    "TSPC_ATT_4_22": true,
+    "TSPC_ATT_4_23": true,
+    "TSPC_ATT_4_24": true,
+    "TSPC_ATT_4_25": true,
+    "TSPC_ATT_4_26": true,
+    "TSPC_ATT_4_27": true,
+    "TSPC_ATT_4_28": true,
+    "TSPC_ATT_4_29": true,
+    "TSPC_ATT_4_31": true,
+    "TSPC_ATT_4_32": true,
+    "TSPC_ATT_4_33": true,
+    "TSPC_ATT_5_1": true,
+    "TSPC_ATT_5_2": true,
+    "TSPC_ATT_5_3": true,
+    "TSPC_ATT_5_4": true,
+    "TSPC_ATT_5_5": true,
+    "TSPC_ATT_5_6": true,
+    "TSPC_AVCTP_0_4": true,
+    "TSPC_AVCTP_1_1": true,
+    "TSPC_AVCTP_1_2": true,
+    "TSPC_AVCTP_2_1": true,
+    "TSPC_AVCTP_2_2": true,
+    "TSPC_AVCTP_2_3": true,
+    "TSPC_AVCTP_2_4": true,
+    "TSPC_AVCTP_2_5": true,
+    "TSPC_AVCTP_2_6": true,
+    "TSPC_AVCTP_2_7": true,
+    "TSPC_AVCTP_2_8": true,
+    "TSPC_AVCTP_2_9": true,
+    "TSPC_AVCTP_2_10": true,
+    "TSPC_AVCTP_2_11": true,
+    "TSPC_AVCTP_2_12": true,
+    "TSPC_AVCTP_2_13": true,
+    "TSPC_AVCTP_3_1": true,
+    "TSPC_AVCTP_3_2": true,
+    "TSPC_AVCTP_3_3": true,
+    "TSPC_AVCTP_3_4": true,
+    "TSPC_AVCTP_3_5": true,
+    "TSPC_AVCTP_3_6": true,
+    "TSPC_AVCTP_3_7": true,
+    "TSPC_AVCTP_3_8": true,
+    "TSPC_AVCTP_3_9": true,
+    "TSPC_AVCTP_3_10": true,
+    "TSPC_AVCTP_3_11": true,
+    "TSPC_AVCTP_3_12": true,
+    "TSPC_AVCTP_3_13": true,
+    "TSPC_AVDTP_1_1": true,
+    "TSPC_AVDTP_1_2": true,
+    "TSPC_AVDTP_1_3": true,
+    "TSPC_AVDTP_1_4": true,
+    "TSPC_AVDTP_2_1": true,
+    "TSPC_AVDTP_2_2": true,
+    "TSPC_AVDTP_2_3": true,
+    "TSPC_AVDTP_2_4": true,
+    "TSPC_AVDTP_2b_1": true,
+    "TSPC_AVDTP_2b_2": true,
+    "TSPC_AVDTP_2b_3": true,
+    "TSPC_AVDTP_2b_4": true,
+    "TSPC_AVDTP_3_1": true,
+    "TSPC_AVDTP_3_2": true,
+    "TSPC_AVDTP_3b_1": true,
+    "TSPC_AVDTP_3b_2": true,
+    "TSPC_AVDTP_4_1": true,
+    "TSPC_AVDTP_4_2": true,
+    "TSPC_AVDTP_4_3": true,
+    "TSPC_AVDTP_4_4": true,
+    "TSPC_AVDTP_4_5": true,
+    "TSPC_AVDTP_4_6": true,
+    "TSPC_AVDTP_4b_1": true,
+    "TSPC_AVDTP_4b_2": true,
+    "TSPC_AVDTP_4b_3": true,
+    "TSPC_AVDTP_4b_4": true,
+    "TSPC_AVDTP_4b_5": true,
+    "TSPC_AVDTP_4b_6": true,
+    "TSPC_AVDTP_5_1": true,
+    "TSPC_AVDTP_5_2": true,
+    "TSPC_AVDTP_5_3": true,
+    "TSPC_AVDTP_5_4": true,
+    "TSPC_AVDTP_5_5": true,
+    "TSPC_AVDTP_5b_1": true,
+    "TSPC_AVDTP_5b_2": true,
+    "TSPC_AVDTP_5b_3": true,
+    "TSPC_AVDTP_5b_4": true,
+    "TSPC_AVDTP_5b_5": true,
+    "TSPC_AVDTP_7_1": true,
+    "TSPC_AVDTP_7b_1": true,
+    "TSPC_AVDTP_8_1": true,
+    "TSPC_AVDTP_8_2": true,
+    "TSPC_AVDTP_8_3": true,
+    "TSPC_AVDTP_8_4": true,
+    "TSPC_AVDTP_8b_1": true,
+    "TSPC_AVDTP_8b_2": true,
+    "TSPC_AVDTP_8b_3": true,
+    "TSPC_AVDTP_8b_4": true,
+    "TSPC_AVDTP_9_1": true,
+    "TSPC_AVDTP_9_2": true,
+    "TSPC_AVDTP_9b_1": true,
+    "TSPC_AVDTP_9b_2": true,
+    "TSPC_AVDTP_10_1": true,
+    "TSPC_AVDTP_10_2": true,
+    "TSPC_AVDTP_10_3": true,
+    "TSPC_AVDTP_10_4": true,
+    "TSPC_AVDTP_10_5": true,
+    "TSPC_AVDTP_10_6": true,
+    "TSPC_AVDTP_10b_1": true,
+    "TSPC_AVDTP_10b_2": true,
+    "TSPC_AVDTP_10b_3": true,
+    "TSPC_AVDTP_10b_4": true,
+    "TSPC_AVDTP_10b_5": true,
+    "TSPC_AVDTP_10b_6": true,
+    "TSPC_AVDTP_11_1": true,
+    "TSPC_AVDTP_11_2": true,
+    "TSPC_AVDTP_11_3": true,
+    "TSPC_AVDTP_11_4": true,
+    "TSPC_AVDTP_11_5": true,
+    "TSPC_AVDTP_11_6": true,
+    "TSPC_AVDTP_11b_1": true,
+    "TSPC_AVDTP_11b_2": true,
+    "TSPC_AVDTP_11b_3": true,
+    "TSPC_AVDTP_11b_4": true,
+    "TSPC_AVDTP_11b_5": true,
+    "TSPC_AVDTP_11b_6": true,
+    "TSPC_AVDTP_13_1": true,
+    "TSPC_AVDTP_13b_1": true,
+    "TSPC_AVDTP_14_1": true,
+    "TSPC_AVDTP_14_6": true,
+    "TSPC_AVDTP_14a_3": true,
+    "TSPC_AVDTP_15_1": true,
+    "TSPC_AVDTP_15_6": true,
+    "TSPC_AVDTP_15a_3": true,
+    "TSPC_AVDTP_16_1": true,
+    "TSPC_AVDTP_16_3": true,
+    "TSPC_AVRCP_0a_1": true,
+    "TSPC_AVRCP_0a_2": true,
+    "TSPC_AVRCP_0a_3": true,
+    "TSPC_AVRCP_0b_1": true,
+    "TSPC_AVRCP_0b_2": true,
+    "TSPC_AVRCP_0b_3": true,
+    "TSPC_AVRCP_1_1": true,
+    "TSPC_AVRCP_1_2": true,
+    "TSPC_AVRCP_2_1": true,
+    "TSPC_AVRCP_2_2": true,
+    "TSPC_AVRCP_2_3": true,
+    "TSPC_AVRCP_2_4": true,
+    "TSPC_AVRCP_2_7": true,
+    "TSPC_AVRCP_2_52": true,
+    "TSPC_AVRCP_2b_4": true,
+    "TSPC_AVRCP_3_19": true,
+    "TSPC_AVRCP_3_20": true,
+    "TSPC_AVRCP_3_21": true,
+    "TSPC_AVRCP_3_26": true,
+    "TSPC_AVRCP_3_27": true,
+    "TSPC_AVRCP_7_2": true,
+    "TSPC_AVRCP_7_3": true,
+    "TSPC_AVRCP_7_4": true,
+    "TSPC_AVRCP_7_5": true,
+    "TSPC_AVRCP_7_6": true,
+    "TSPC_AVRCP_7_7": true,
+    "TSPC_AVRCP_7_11": true,
+    "TSPC_AVRCP_7_20": true,
+    "TSPC_AVRCP_7_21": true,
+    "TSPC_AVRCP_7_22": true,
+    "TSPC_AVRCP_7_23": true,
+    "TSPC_AVRCP_7_24": true,
+    "TSPC_AVRCP_7_31": true,
+    "TSPC_AVRCP_7_32": true,
+    "TSPC_AVRCP_7_36": true,
+    "TSPC_AVRCP_7_37": true,
+    "TSPC_AVRCP_7_38": true,
+    "TSPC_AVRCP_7_39": true,
+    "TSPC_AVRCP_7_40": true,
+    "TSPC_AVRCP_7_42": true,
+    "TSPC_AVRCP_7_42a": true,
+    "TSPC_AVRCP_7_43": true,
+    "TSPC_AVRCP_7_43a": true,
+    "TSPC_AVRCP_7_44": true,
+    "TSPC_AVRCP_7_45": true,
+    "TSPC_AVRCP_7_46": true,
+    "TSPC_AVRCP_7_47": true,
+    "TSPC_AVRCP_7_48": true,
+    "TSPC_AVRCP_7_54": true,
+    "TSPC_AVRCP_7_55": true,
+    "TSPC_AVRCP_7_56": true,
+    "TSPC_AVRCP_7_58": true,
+    "TSPC_AVRCP_7_63": true,
+    "TSPC_AVRCP_7_64": true,
+    "TSPC_AVRCP_7_65": true,
+    "TSPC_AVRCP_7_66": true,
+    "TSPC_AVRCP_7b_4": true,
+    "TSPC_AVRCP_8_19": true,
+    "TSPC_AVRCP_8_20": true,
+    "TSPC_AVRCP_12_1": true,
+    "TSPC_AVRCP_13_1": true,
+    "TSPC_BNEP_1a_1": true,
+    "TSPC_BNEP_1a_2": true,
+    "TSPC_BNEP_1a_3": true,
+    "TSPC_BNEP_1a_4": true,
+    "TSPC_BNEP_1a_5": true,
+    "TSPC_DID_0_2": true,
+    "TSPC_DID_1_1": true,
+    "TSPC_DID_1_2": true,
+    "TSPC_DID_1_3": true,
+    "TSPC_DID_1_4": true,
+    "TSPC_DID_1_5": true,
+    "TSPC_DID_1_6": true,
+    "TSPC_GAP_0_3": true,
+    "TSPC_GAP_1_1": true,
+    "TSPC_GAP_1_3": true,
+    "TSPC_GAP_1_4": true,
+    "TSPC_GAP_1_5": true,
+    "TSPC_GAP_1_7": true,
+    "TSPC_GAP_2_1": true,
+    "TSPC_GAP_2_2": true,
+    "TSPC_GAP_2_3": true,
+    "TSPC_GAP_2_5": true,
+    "TSPC_GAP_2_7": true,
+    "TSPC_GAP_2_7a": true,
+    "TSPC_GAP_2_7c": true,
+    "TSPC_GAP_2_8": true,
+    "TSPC_GAP_2_9": true,
+    "TSPC_GAP_2_13": true,
+    "TSPC_GAP_3_1": true,
+    "TSPC_GAP_3_3": true,
+    "TSPC_GAP_3_4": true,
+    "TSPC_GAP_3_5": true,
+    "TSPC_GAP_3_6": true,
+    "TSPC_GAP_4_1": true,
+    "TSPC_GAP_4_2": true,
+    "TSPC_GAP_4_3": true,
+    "TSPC_GAP_4_4": true,
+    "TSPC_GAP_4_5": true,
+    "TSPC_GAP_4_6": true,
+    "TSPC_GAP_18_1": true,
+    "TSPC_GAP_18_2": true,
+    "TSPC_GAP_19_1": true,
+    "TSPC_GAP_19_2": true,
+    "TSPC_GAP_19_3": true,
+    "TSPC_GAP_20_1": true,
+    "TSPC_GAP_20_3": true,
+    "TSPC_GAP_20_4": true,
+    "TSPC_GAP_20A_1": true,
+    "TSPC_GAP_20A_2": true,
+    "TSPC_GAP_20A_3": true,
+    "TSPC_GAP_20A_4": true,
+    "TSPC_GAP_20A_5": true,
+    "TSPC_GAP_21_1": true,
+    "TSPC_GAP_21_2": true,
+    "TSPC_GAP_21_3": true,
+    "TSPC_GAP_21_4": true,
+    "TSPC_GAP_21_5": true,
+    "TSPC_GAP_21_6": true,
+    "TSPC_GAP_21_8": true,
+    "TSPC_GAP_21_9": true,
+    "TSPC_GAP_22_1": true,
+    "TSPC_GAP_22_3": true,
+    "TSPC_GAP_22_4": true,
+    "TSPC_GAP_23_1": true,
+    "TSPC_GAP_23_3": true,
+    "TSPC_GAP_23_4": true,
+    "TSPC_GAP_23_5": true,
+    "TSPC_GAP_24_1": true,
+    "TSPC_GAP_24_2": true,
+    "TSPC_GAP_24_3": true,
+    "TSPC_GAP_24_4": true,
+    "TSPC_GAP_25_1": true,
+    "TSPC_GAP_25_2": true,
+    "TSPC_GAP_25_3": true,
+    "TSPC_GAP_25_7": true,
+    "TSPC_GAP_25_8": true,
+    "TSPC_GAP_25_9": true,
+    "TSPC_GAP_25_10": true,
+    "TSPC_GAP_25_13": true,
+    "TSPC_GAP_26_3": true,
+    "TSPC_GAP_26_4": true,
+    "TSPC_GAP_27_1": true,
+    "TSPC_GAP_27_2": true,
+    "TSPC_GAP_28_1": true,
+    "TSPC_GAP_28_2": true,
+    "TSPC_GAP_29_1": true,
+    "TSPC_GAP_29_2": true,
+    "TSPC_GAP_29_3": true,
+    "TSPC_GAP_29_4": true,
+    "TSPC_GAP_30_1": true,
+    "TSPC_GAP_30_2": true,
+    "TSPC_GAP_31_1": true,
+    "TSPC_GAP_31_2": true,
+    "TSPC_GAP_31_3": true,
+    "TSPC_GAP_31_4": true,
+    "TSPC_GAP_31_5": true,
+    "TSPC_GAP_31_6": true,
+    "TSPC_GAP_31_8": true,
+    "TSPC_GAP_31_9": true,
+    "TSPC_GAP_32_2": true,
+    "TSPC_GAP_32_3": true,
+    "TSPC_GAP_33_1": true,
+    "TSPC_GAP_33_2": true,
+    "TSPC_GAP_33_4": true,
+    "TSPC_GAP_33_5": true,
+    "TSPC_GAP_33_6": true,
+    "TSPC_GAP_34_1": true,
+    "TSPC_GAP_34_2": true,
+    "TSPC_GAP_34_3": true,
+    "TSPC_GAP_35_1": true,
+    "TSPC_GAP_35_2": true,
+    "TSPC_GAP_35_3": true,
+    "TSPC_GAP_35_7": true,
+    "TSPC_GAP_35_8": true,
+    "TSPC_GAP_35_9": true,
+    "TSPC_GAP_35_10": true,
+    "TSPC_GAP_35_13": true,
+    "TSPC_GAP_36_3": true,
+    "TSPC_GAP_36_5": true,
+    "TSPC_GAP_37_1": true,
+    "TSPC_GAP_37_2": true,
+    "TSPC_GAP_37_3": true,
+    "TSPC_GAP_38_3": true,
+    "TSPC_GAP_38_4": true,
+    "TSPC_GAP_41_1": true,
+    "TSPC_GAP_41_2a": true,
+    "TSPC_GAP_41_2b": true,
+    "TSPC_GAP_43_1": true,
+    "TSPC_GAP_43_2a": true,
+    "TSPC_GAP_43_2b": true,
+    "TSPC_GAP_44_1": true,
+    "TSPC_GAP_44_2": true,
+    "TSPC_GAP_45_1": true,
+    "TSPC_GAP_45_2": true,
+    "TSPC_GATT_1_1": true,
+    "TSPC_GATT_1_2": true,
+    "TSPC_GATT_1a_1": true,
+    "TSPC_GATT_1a_2": false,
+    "TSPC_GATT_1a_3": true,
+    "TSPC_GATT_1a_4": false,
+    "TSPC_GATT_2_1": false,
+    "TSPC_GATT_2_2": true,
+    "TSPC_GATT_3_1": true,
+    "TSPC_GATT_3_2": true,
+    "TSPC_GATT_3_3": true,
+    "TSPC_GATT_3_4": true,
+    "TSPC_GATT_3_5": true,
+    "TSPC_GATT_3_6": true,
+    "TSPC_GATT_3_7": true,
+    "TSPC_GATT_3_8": true,
+    "TSPC_GATT_3_9": true,
+    "TSPC_GATT_3_10": true,
+    "TSPC_GATT_3_12": true,
+    "TSPC_GATT_3_14": true,
+    "TSPC_GATT_3_15": true,
+    "TSPC_GATT_3_16": true,
+    "TSPC_GATT_3_17": true,
+    "TSPC_GATT_3_18": true,
+    "TSPC_GATT_3_19": true,
+    "TSPC_GATT_3_20": true,
+    "TSPC_GATT_3_21": true,
+    "TSPC_GATT_3_22": true,
+    "TSPC_GATT_3_23": true,
+    "TSPC_GATT_3_25": true,
+    "TSPC_GATT_3_30": true,
+    "TSPC_GATT_4_1": true,
+    "TSPC_GATT_4_2": true,
+    "TSPC_GATT_4_3": true,
+    "TSPC_GATT_4_4": true,
+    "TSPC_GATT_4_5": true,
+    "TSPC_GATT_4_6": true,
+    "TSPC_GATT_4_7": true,
+    "TSPC_GATT_4_8": true,
+    "TSPC_GATT_4_9": true,
+    "TSPC_GATT_4_10": true,
+    "TSPC_GATT_4_11": true,
+    "TSPC_GATT_4_12": true,
+    "TSPC_GATT_4_14": true,
+    "TSPC_GATT_4_15": true,
+    "TSPC_GATT_4_16": true,
+    "TSPC_GATT_4_17": true,
+    "TSPC_GATT_4_18": true,
+    "TSPC_GATT_4_19": true,
+    "TSPC_GATT_4_20": true,
+    "TSPC_GATT_4_21": true,
+    "TSPC_GATT_4_22": true,
+    "TSPC_GATT_4_23": true,
+    "TSPC_GATT_4_25": true,
+    "TSPC_GATT_4_30": true,
+    "TSPC_GATT_4_31": true,
+    "TSPC_GATT_6_2": true,
+    "TSPC_GATT_6_3": true,
+    "TSPC_GATT_7_1": true,
+    "TSPC_GATT_7_2": true,
+    "TSPC_GATT_7_3": true,
+    "TSPC_GATT_7_4": true,
+    "TSPC_GATT_7_5": true,
+    "TSPC_GATT_7_6": true,
+    "TSPC_GAVDP_1_1": true,
+    "TSPC_GAVDP_1_2": true,
+    "TSPC_GAVDP_1_3": true,
+    "TSPC_GAVDP_2_1": true,
+    "TSPC_GAVDP_2_2": true,
+    "TSPC_GAVDP_2_4": true,
+    "TSPC_GAVDP_2_5": true,
+    "TSPC_GAVDP_2_6": true,
+    "TSPC_GAVDP_2a_3": true,
+    "TSPC_GAVDP_3_1": true,
+    "TSPC_GAVDP_3_2": true,
+    "TSPC_GAVDP_3_4": true,
+    "TSPC_GAVDP_3_5": true,
+    "TSPC_GAVDP_3_6": true,
+    "TSPC_GAVDP_3a_3": true,
+    "TSPC_GAVDP_4_1": true,
+    "TSPC_GAVDP_4_2": true,
+    "TSPC_GAVDP_4_3": true,
+    "TSPC_GAVDP_4_4": true,
+    "TSPC_GAVDP_4_5": true,
+    "TSPC_GAVDP_4_6": true,
+    "TSPC_GAVDP_4_7": true,
+    "TSPC_GAVDP_4_8": true,
+    "TSPC_GAVDP_5_1": true,
+    "TSPC_GAVDP_5_2": true,
+    "TSPC_GAVDP_5_3": true,
+    "TSPC_GAVDP_5_4": true,
+    "TSPC_GAVDP_5_5": true,
+    "TSPC_GAVDP_5_6": true,
+    "TSPC_GAVDP_5_7": true,
+    "TSPC_GAVDP_5_8": true,
+    "TSPC_GAVDP_5_9": true,
+    "TSPC_HCI_1a_2": true,
+    "TSPC_HFP_0a_3": true,
+    "TSPC_HFP_0b_3": true,
+    "TSPC_HFP_0c_4": true,
+    "TSPC_HFP_0d_4": true,
+    "TSPC_HFP_1_1": true,
+    "TSPC_HFP_1_2": true,
+    "TSPC_HFP_2_1": true,
+    "TSPC_HFP_2_2": true,
+    "TSPC_HFP_2_3": true,
+    "TSPC_HFP_2_3b": true,
+    "TSPC_HFP_2_3c": true,
+    "TSPC_HFP_2_4a": true,
+    "TSPC_HFP_2_4b": true,
+    "TSPC_HFP_2_5": true,
+    "TSPC_HFP_2_6": true,
+    "TSPC_HFP_2_7": true,
+    "TSPC_HFP_2_7a": true,
+    "TSPC_HFP_2_8": true,
+    "TSPC_HFP_2_9": true,
+    "TSPC_HFP_2_10": true,
+    "TSPC_HFP_2_11": true,
+    "TSPC_HFP_2_12": true,
+    "TSPC_HFP_2_12b": true,
+    "TSPC_HFP_2_13": true,
+    "TSPC_HFP_2_14": true,
+    "TSPC_HFP_2_15": true,
+    "TSPC_HFP_2_17": true,
+    "TSPC_HFP_2_20": true,
+    "TSPC_HFP_2_21a": true,
+    "TSPC_HFP_2_23": true,
+    "TSPC_HFP_2_24": true,
+    "TSPC_HFP_2_26": true,
+    "TSPC_HFP_2_27": true,
+    "TSPC_HFP_3_1": true,
+    "TSPC_HFP_3_2a": true,
+    "TSPC_HFP_3_3": true,
+    "TSPC_HFP_3_3b": true,
+    "TSPC_HFP_3_3c": true,
+    "TSPC_HFP_3_4a": true,
+    "TSPC_HFP_3_4b": true,
+    "TSPC_HFP_3_4c": true,
+    "TSPC_HFP_3_5": true,
+    "TSPC_HFP_3_6": true,
+    "TSPC_HFP_3_7": true,
+    "TSPC_HFP_3_7a": true,
+    "TSPC_HFP_3_8": true,
+    "TSPC_HFP_3_9": true,
+    "TSPC_HFP_3_10": true,
+    "TSPC_HFP_3_11": true,
+    "TSPC_HFP_3_12": true,
+    "TSPC_HFP_3_12b": true,
+    "TSPC_HFP_3_13": true,
+    "TSPC_HFP_3_14": true,
+    "TSPC_HFP_3_15": true,
+    "TSPC_HFP_3_17": true,
+    "TSPC_HFP_3_18a": true,
+    "TSPC_HFP_3_18c": true,
+    "TSPC_HFP_3_20": true,
+    "TSPC_HFP_3_21a": true,
+    "TSPC_HFP_3_21b": true,
+    "TSPC_HFP_3_23": true,
+    "TSPC_HFP_3_24": true,
+    "TSPC_HFP_3_26": true,
+    "TSPC_HFP_4_1": true,
+    "TSPC_HFP_4_2": true,
+    "TSPC_HFP_4_3": true,
+    "TSPC_HFP_4_4": true,
+    "TSPC_HFP_5_1": true,
+    "TSPC_HFP_5_2": true,
+    "TSPC_HFP_6_1": true,
+    "TSPC_HFP_6_2": true,
+    "TSPC_HFP_7_1": true,
+    "TSPC_HFP_7b_1": true,
+    "TSPC_HFP_8_7": true,
+    "TSPC_HFP_8_8": true,
+    "TSPC_HFP_8_9": true,
+    "TSPC_HID_0_1": true,
+    "TSPC_HID_1_1": true,
+    "TSPC_HID_1_2": true,
+    "TSPC_HID_2_1": true,
+    "TSPC_HID_2_2": true,
+    "TSPC_HID_2_3": true,
+    "TSPC_HID_2_4": true,
+    "TSPC_HID_2_5": true,
+    "TSPC_HID_2_6": true,
+    "TSPC_HID_2_7": true,
+    "TSPC_HID_2_8": true,
+    "TSPC_HID_2_9": true,
+    "TSPC_HID_3_1": true,
+    "TSPC_HID_4_3": true,
+    "TSPC_HID_6_1": true,
+    "TSPC_HID_6_2": true,
+    "TSPC_HID_6_3": true,
+    "TSPC_HID_6_4": true,
+    "TSPC_HID_6_8": true,
+    "TSPC_HID_6_9": true,
+    "TSPC_HID_6_10": true,
+    "TSPC_HID_6_12": true,
+    "TSPC_HID_7_1": true,
+    "TSPC_HID_8_1": true,
+    "TSPC_HID_8_2": true,
+    "TSPC_HID_9_1": true,
+    "TSPC_HID_9_2": true,
+    "TSPC_HID_9_3": true,
+    "TSPC_HID_9_4": true,
+    "TSPC_HID_9_5": true,
+    "TSPC_HID_9_6": true,
+    "TSPC_HID_9_7": true,
+    "TSPC_HID_9_8": true,
+    "TSPC_HID_9_9": true,
+    "TSPC_HID_9_10": true,
+    "TSPC_HID_9_11": true,
+    "TSPC_HID_9_12": true,
+    "TSPC_HID_9_13": true,
+    "TSPC_HID_10_3": true,
+    "TSPC_HID_10_4": true,
+    "TSPC_HID_11_3": true,
+    "TSPC_HID_11_4": true,
+    "TSPC_HID_12_1": true,
+    "TSPC_HID_12_2": true,
+    "TSPC_HID_12_3": true,
+    "TSPC_HID_12_4": true,
+    "TSPC_HID_12_5": true,
+    "TSPC_HID_12_6": true,
+    "TSPC_HID_13_1": true,
+    "TSPC_HID_13_2": true,
+    "TSPC_HID_13_5": true,
+    "TSPC_HID_13_7": true,
+    "TSPC_HID_13_8": true,
+    "TSPC_HID_13_9": true,
+    "TSPC_HID_13_10": true,
+    "TSPC_HID_13_12": true,
+    "TSPC_HID_14_2": true,
+    "TSPC_HID_15_1": true,
+    "TSPC_HID_15_2": true,
+    "TSPC_HID_15_3": true,
+    "TSPC_HID_15_4": true,
+    "TSPC_HID_15_5": true,
+    "TSPC_HID_15_6": true,
+    "TSPC_HOGP_0_1": true,
+    "TSPC_HOGP_1_2": true,
+    "TSPC_HOGP_2_2": true,
+    "TSPC_HOGP_7_1": true,
+    "TSPC_HOGP_7_2": true,
+    "TSPC_HOGP_7_3": true,
+    "TSPC_HOGP_7_4": true,
+    "TSPC_HOGP_7a_1": true,
+    "TSPC_HOGP_9_1": true,
+    "TSPC_HOGP_9_2": true,
+    "TSPC_HOGP_9_3": true,
+    "TSPC_HOGP_9_4": true,
+    "TSPC_HOGP_9_5": true,
+    "TSPC_HOGP_9_6": true,
+    "TSPC_HOGP_9_7": true,
+    "TSPC_HOGP_9_8": true,
+    "TSPC_HOGP_9_9": true,
+    "TSPC_HOGP_9_10": true,
+    "TSPC_HOGP_9_11": true,
+    "TSPC_HOGP_9_13": true,
+    "TSPC_HOGP_9_14": true,
+    "TSPC_HOGP_9_15": true,
+    "TSPC_HOGP_9_16": true,
+    "TSPC_HOGP_11_1": true,
+    "TSPC_HOGP_11_2": true,
+    "TSPC_HOGP_11_9": true,
+    "TSPC_HOGP_11_10": true,
+    "TSPC_HOGP_11_11": true,
+    "TSPC_HOGP_11_19": true,
+    "TSPC_HOGP_11_22": true,
+    "TSPC_HOGP_11_23": true,
+    "TSPC_HOGP_11_24": true,
+    "TSPC_HOGP_11_26": true,
+    "TSPC_HSP_0_2": true,
+    "TSPC_HSP_1_1": true,
+    "TSPC_HSP_2_1": true,
+    "TSPC_HSP_2_2": true,
+    "TSPC_HSP_2_4": true,
+    "TSPC_HSP_2_5": true,
+    "TSPC_HSP_2_6": true,
+    "TSPC_HSP_2_7": true,
+    "TSPC_HSP_2_8": true,
+    "TSPC_HSP_2_11": true,
+    "TSPC_HSP_2_15": true,
+    "TSPC_IOP_1_1": true,
+    "TSPC_IOP_2_1": true,
+    "TSPC_IOP_2_2": true,
+    "TSPC_IOP_2_3": true,
+    "TSPC_L2CAP_0_3": true,
+    "TSPC_L2CAP_1_1": true,
+    "TSPC_L2CAP_1_2": true,
+    "TSPC_L2CAP_1_3": true,
+    "TSPC_L2CAP_1_4": true,
+    "TSPC_L2CAP_1_5": true,
+    "TSPC_L2CAP_1_6": true,
+    "TSPC_L2CAP_2_1": true,
+    "TSPC_L2CAP_2_2": true,
+    "TSPC_L2CAP_2_3": true,
+    "TSPC_L2CAP_2_4": true,
+    "TSPC_L2CAP_2_5": true,
+    "TSPC_L2CAP_2_6": true,
+    "TSPC_L2CAP_2_7": true,
+    "TSPC_L2CAP_2_12": true,
+    "TSPC_L2CAP_2_13": true,
+    "TSPC_L2CAP_2_14": true,
+    "TSPC_L2CAP_2_15": true,
+    "TSPC_L2CAP_2_16": true,
+    "TSPC_L2CAP_2_17": true,
+    "TSPC_L2CAP_2_18": true,
+    "TSPC_L2CAP_2_19": true,
+    "TSPC_L2CAP_2_20": true,
+    "TSPC_L2CAP_2_21": true,
+    "TSPC_L2CAP_2_22": true,
+    "TSPC_L2CAP_2_23": true,
+    "TSPC_L2CAP_2_24": true,
+    "TSPC_L2CAP_2_25": true,
+    "TSPC_L2CAP_2_26": true,
+    "TSPC_L2CAP_2_27": true,
+    "TSPC_L2CAP_2_28": true,
+    "TSPC_L2CAP_2_30": true,
+    "TSPC_L2CAP_2_40": true,
+    "TSPC_L2CAP_2_41": true,
+    "TSPC_L2CAP_2_42": true,
+    "TSPC_L2CAP_2_43": true,
+    "TSPC_L2CAP_2_45": true,
+    "TSPC_L2CAP_2_46": true,
+    "TSPC_L2CAP_2_47": true,
+    "TSPC_L2CAP_3_1": true,
+    "TSPC_L2CAP_3_2": true,
+    "TSPC_L2CAP_3_3": true,
+    "TSPC_L2CAP_3_4": true,
+    "TSPC_L2CAP_3_5": true,
+    "TSPC_L2CAP_3_12": true,
+    "TSPC_L2CAP_3_16": true,
+    "TSPC_L2CAP_4_3": true,
+    "TSPC_L2CAP_5_1": true,
+    "TSPC_MAP_0_6": true,
+    "TSPC_MAP_0a_5": true,
+    "TSPC_MAP_1_1": true,
+    "TSPC_MAP_2_6c": false,
+    "TSPC_MAP_3_1": true,
+    "TSPC_MAP_3_1a": true,
+    "TSPC_MAP_3_1b": true,
+    "TSPC_MAP_3_2": true,
+    "TSPC_MAP_3_2a": true,
+    "TSPC_MAP_3_2b": true,
+    "TSPC_MAP_3_2c": true,
+    "TSPC_MAP_3_2d": true,
+    "TSPC_MAP_3_2e": true,
+    "TSPC_MAP_3_2f": true,
+    "TSPC_MAP_3_3": true,
+    "TSPC_MAP_3_3a": true,
+    "TSPC_MAP_3_3b": true,
+    "TSPC_MAP_3_3c": true,
+    "TSPC_MAP_3_4": true,
+    "TSPC_MAP_3_4a": true,
+    "TSPC_MAP_3_5": true,
+    "TSPC_MAP_3_5a": true,
+    "TSPC_MAP_3_6b": true,
+    "TSPC_MAP_3_6c": false,
+    "TSPC_MAP_3_7": true,
+    "TSPC_MAP_3_7a": true,
+    "TSPC_MAP_3_8": true,
+    "TSPC_MAP_3_8a": true,
+    "TSPC_MAP_3_8b": true,
+    "TSPC_MAP_3_9a": true,
+    "TSPC_MAP_3_9b": true,
+    "TSPC_MAP_3_10a": true,
+    "TSPC_MAP_3_10b": true,
+    "TSPC_MAP_3_17": true,
+    "TSPC_MAP_3_18": true,
+    "TSPC_MAP_6_1": true,
+    "TSPC_MAP_6_2": true,
+    "TSPC_MAP_7b_1": true,
+    "TSPC_MAP_7b_2": true,
+    "TSPC_MAP_7b_3": true,
+    "TSPC_MAP_13_1": true,
+    "TSPC_MAP_13_2": true,
+    "TSPC_MAP_13_3": true,
+    "TSPC_MAP_13_4": true,
+    "TSPC_MAP_13_5": true,
+    "TSPC_MAP_13_6": true,
+    "TSPC_MAP_14_1": true,
+    "TSPC_MAP_14_2": true,
+    "TSPC_MAP_14_3": true,
+    "TSPC_MAP_14_4": true,
+    "TSPC_MAP_15_1": true,
+    "TSPC_MAP_15_2": true,
+    "TSPC_MAP_15_3": true,
+    "TSPC_MAP_15_4": true,
+    "TSPC_MAP_15_5": true,
+    "TSPC_MAP_15_6": true,
+    "TSPC_MAP_15_7": true,
+    "TSPC_MAP_15_8": true,
+    "TSPC_MAP_15_9": true,
+    "TSPC_MAP_15_10": true,
+    "TSPC_MAP_16_1": true,
+    "TSPC_MAP_16_2": true,
+    "TSPC_MAP_16_3": true,
+    "TSPC_MAP_16_4": true,
+    "TSPC_MAP_16_6": true,
+    "TSPC_MAP_16_7": true,
+    "TSPC_MAP_16_8": true,
+    "TSPC_MAP_17_1": true,
+    "TSPC_MAP_17_2": true,
+    "TSPC_MAP_17_4": true,
+    "TSPC_MAP_17_5": true,
+    "TSPC_MAP_17_7": true,
+    "TSPC_MAP_19_1": true,
+    "TSPC_MAP_19_2": true,
+    "TSPC_MAP_19_3": true,
+    "TSPC_MCAP_0_1": true,
+    "TSPC_MCAP_1_2": true,
+    "TSPC_MCAP_1a_1": true,
+    "TSPC_MCAP_4_1": true,
+    "TSPC_MCAP_4_2": true,
+    "TSPC_MCAP_4_3": true,
+    "TSPC_MCAP_4_4": true,
+    "TSPC_MCAP_5_2": true,
+    "TSPC_MCAP_5_3": true,
+    "TSPC_MCAP_5_4": true,
+    "TSPC_MCAP_5_5": true,
+    "TSPC_MCAP_5_6": true,
+    "TSPC_MCAP_5_7": true,
+    "TSPC_MCAP_5_9": true,
+    "TSPC_MCAP_5_11": true,
+    "TSPC_MCAP_5_13": true,
+    "TSPC_MCAP_5_15": true,
+    "TSPC_OPP_1_1": true,
+    "TSPC_OPP_1_2": true,
+    "TSPC_OPP_1b_2": true,
+    "TSPC_OPP_1c_1": true,
+    "TSPC_OPP_2_1": true,
+    "TSPC_OPP_2_2": true,
+    "TSPC_OPP_2_2a": true,
+    "TSPC_OPP_2_3": true,
+    "TSPC_OPP_2_17": true,
+    "TSPC_OPP_2_18": true,
+    "TSPC_OPP_2_19": true,
+    "TSPC_OPP_2b_2": true,
+    "TSPC_OPP_2c_1": true,
+    "TSPC_OPP_3_1": true,
+    "TSPC_OPP_3_2": true,
+    "TSPC_OPP_3_3": true,
+    "TSPC_OPP_3_19": true,
+    "TSPC_OPP_3_20": true,
+    "TSPC_OPP_3_21": true,
+    "TSPC_PAN_1_1": true,
+    "TSPC_PAN_1_3": true,
+    "TSPC_PAN_2_1": true,
+    "TSPC_PAN_2_2": true,
+    "TSPC_PAN_2_4": true,
+    "TSPC_PAN_2_17": true,
+    "TSPC_PAN_2_18": true,
+    "TSPC_PAN_4_1": true,
+    "TSPC_PAN_4_2": true,
+    "TSPC_PBAP_1_2": true,
+    "TSPC_PBAP_9_1": true,
+    "TSPC_PBAP_9_2": true,
+    "TSPC_PBAP_9_3": true,
+    "TSPC_PBAP_9_4": true,
+    "TSPC_PBAP_9_5": true,
+    "TSPC_PBAP_9_6": true,
+    "TSPC_PBAP_9_7": true,
+    "TSPC_PBAP_9_12": true,
+    "TSPC_PBAP_9_13a": true,
+    "TSPC_PBAP_9_13d": true,
+    "TSPC_PBAP_9_13e": true,
+    "TSPC_PBAP_9_14a": true,
+    "TSPC_PBAP_9_14b": true,
+    "TSPC_PBAP_9a_3": true,
+    "TSPC_PBAP_9b_3": true,
+    "TSPC_PBAP_10_1": true,
+    "TSPC_PBAP_11_1": true,
+    "TSPC_PBAP_11_2": true,
+    "TSPC_PBAP_11_3": true,
+    "TSPC_PBAP_12_1": true,
+    "TSPC_PBAP_12_2": true,
+    "TSPC_PBAP_13_1": true,
+    "TSPC_PBAP_13_2": true,
+    "TSPC_PBAP_13_3": true,
+    "TSPC_PBAP_13_4": true,
+    "TSPC_PBAP_13_5": true,
+    "TSPC_PBAP_13_7": true,
+    "TSPC_PBAP_14_1": true,
+    "TSPC_PBAP_14_2": true,
+    "TSPC_PBAP_14_3": true,
+    "TSPC_PBAP_14_4": true,
+    "TSPC_PBAP_14_5": true,
+    "TSPC_PBAP_14_6": true,
+    "TSPC_PBAP_14_7": true,
+    "TSPC_PBAP_14_8": true,
+    "TSPC_PBAP_14_9": true,
+    "TSPC_PBAP_14_10": true,
+    "TSPC_PBAP_14_11": true,
+    "TSPC_PBAP_14_12": true,
+    "TSPC_PBAP_15_1": true,
+    "TSPC_PBAP_15_2": true,
+    "TSPC_PBAP_15_4": true,
+    "TSPC_PBAP_15_5": true,
+    "TSPC_PBAP_15_7": true,
+    "TSPC_PBAP_17_1": true,
+    "TSPC_PBAP_17_2": true,
+    "TSPC_PBAP_21_1": true,
+    "TSPC_PBAP_23_1": true,
+    "TSPC_PBAP_23_2": true,
+    "TSPC_PBAP_26_1": true,
+    "TSPC_PBAP_26_2": true,
+    "TSPC_PBAP_26_3": true,
+    "TSPC_PBAP_26_4": true,
+    "TSPC_PBAP_26_6": true,
+    "TSPC_PROD_1_4": true,
+    "TSPC_PROD_3_4": true,
+    "TSPC_RFCOMM_0_2": true,
+    "TSPC_RFCOMM_1_1": true,
+    "TSPC_RFCOMM_1_2": true,
+    "TSPC_RFCOMM_1_3": true,
+    "TSPC_RFCOMM_1_4": true,
+    "TSPC_RFCOMM_1_5": true,
+    "TSPC_RFCOMM_1_6": true,
+    "TSPC_RFCOMM_1_7": true,
+    "TSPC_RFCOMM_1_8": true,
+    "TSPC_RFCOMM_1_9": true,
+    "TSPC_RFCOMM_1_10": true,
+    "TSPC_RFCOMM_1_11": true,
+    "TSPC_RFCOMM_1_12": true,
+    "TSPC_RFCOMM_1_13": true,
+    "TSPC_RFCOMM_1_14": true,
+    "TSPC_RFCOMM_1_15": true,
+    "TSPC_RFCOMM_1_16": true,
+    "TSPC_RFCOMM_1_17": true,
+    "TSPC_RFCOMM_1_18": true,
+    "TSPC_RFCOMM_1_19": true,
+    "TSPC_RFCOMM_1_20": true,
+    "TSPC_RFCOMM_1_21": true,
+    "TSPC_RFCOMM_1_22": true,
+    "TSPC_SAP_0_2": true,
+    "TSPC_SAP_0a_1": true,
+    "TSPC_SAP_1_2": true,
+    "TSPC_SAP_3_1": true,
+    "TSPC_SAP_3_1b": true,
+    "TSPC_SAP_3_2": true,
+    "TSPC_SAP_3_3": true,
+    "TSPC_SAP_3_4": true,
+    "TSPC_SAP_3_6": true,
+    "TSPC_SAP_3_7": true,
+    "TSPC_SAP_3_9": true,
+    "TSPC_SAP_3_9a": true,
+    "TSPC_SAP_3_10": true,
+    "TSPC_SCPP_1_2": true,
+    "TSPC_SCPP_2_2": true,
+    "TSPC_SCPP_6_1": true,
+    "TSPC_SCPP_7_1": true,
+    "TSPC_SCPP_7_2": true,
+    "TSPC_SCPP_7_3": true,
+    "TSPC_SCPP_7_4": true,
+    "TSPC_SCPP_8_1": true,
+    "TSPC_SCPP_8_2": true,
+    "TSPC_SCPP_8_3": true,
+    "TSPC_SCPP_10_1": true,
+    "TSPC_SCPP_10_2": true,
+    "TSPC_SCPP_10_3": true,
+    "TSPC_SCPP_10_4": true,
+    "TSPC_SDP_1_1": true,
+    "TSPC_SDP_1_2": true,
+    "TSPC_SDP_1_3": true,
+    "TSPC_SDP_1b_1": true,
+    "TSPC_SDP_1b_2": true,
+    "TSPC_SDP_2_1": true,
+    "TSPC_SDP_2_2": true,
+    "TSPC_SDP_2_3": true,
+    "TSPC_SDP_3_1": true,
+    "TSPC_SDP_4_1": true,
+    "TSPC_SDP_4_2": true,
+    "TSPC_SDP_4_3": true,
+    "TSPC_SDP_5_1": true,
+    "TSPC_SDP_6_1": true,
+    "TSPC_SDP_6_2": true,
+    "TSPC_SDP_6_3": true,
+    "TSPC_SDP_7_1": true,
+    "TSPC_SDP_8_2": true,
+    "TSPC_SDP_9_2": true,
+    "TSPC_SDP_9_5": true,
+    "TSPC_SDP_9_6": true,
+    "TSPC_SDP_9_9": true,
+    "TSPC_SDP_9_10": true,
+    "TSPC_SDP_9_14": true,
+    "TSPC_SDP_9_17": true,
+    "TSPC_SDP_9_18": true,
+    "TSPC_SDP_9_19": true,
+    "TSPC_SM_1_1": true,
+    "TSPC_SM_1_2": true,
+    "TSPC_SM_2_1": true,
+    "TSPC_SM_2_2": true,
+    "TSPC_SM_2_3": true,
+    "TSPC_SM_2_4": true,
+    "TSPC_SM_2_5": true,
+    "TSPC_SM_3_1": true,
+    "TSPC_SM_4_1": true,
+    "TSPC_SM_4_2": true,
+    "TSPC_SM_5_1": true,
+    "TSPC_SM_5_2": true,
+    "TSPC_SM_5_3": true,
+    "TSPC_SM_5_4": true,
+    "TSPC_SM_5_5": true,
+    "TSPC_SM_5_6": true,
+    "TSPC_SM_7_1": true,
+    "TSPC_SM_7_2": true,
+    "TSPC_SM_7_3": true,
+    "TSPC_SM_8_1": true,
+    "TSPC_SM_8_2": true,
+    "TSPC_SM_8_3": true,
+    "TSPC_SPP_0_2": true,
+    "TSPC_SPP_1_1": true,
+    "TSPC_SPP_1_2": true,
+    "TSPC_SPP_2_1": false,
+    "TSPC_SPP_2_1b": true,
+    "TSPC_SPP_3_1": true,
+    "TSPC_SPP_3_2": true,
+    "TSPC_SPP_3_3": true,
+    "TSPC_SPP_3_4": true,
+    "TSPC_SPP_3_7": true,
+    "TSPC_SPP_4_1": true,
+    "TSPC_SPP_4_2": true,
+    "TSPC_SPP_4_5": true,
+    "TSPC_SPP_4_6": true,
+    "TSPC_SUM ICS_31_22": true,
+    "TSPC_SUM ICS_52_1": true
+  },
+  "ixit": {
+    "default": {},
+    "4.0HCI": {},
+    "A2DP": {},
+    "ATT": {},
+    "AVCTP": {},
+    "AVDTP": {},
+    "AVRCP": {
+      "TSPX_player_feature_bitmask": "0000000000B7010C0A00000000000000"
+    },
+    "BNEP": {},
+    "DID": {},
+    "GAP": {},
+    "GATT": {},
+    "GAVDP": {},
+    "HCI": {},
+    "HFP": {
+      "TSPX_phone_number": "42",
+      "TSPX_second_phone_number": "43"
+    },
+    "HID": {},
+    "HOGP": {},
+    "HSP": {},
+    "IOP": {},
+    "L2CAP": {
+      "TSPX_spsm": "0080",
+      "TSPX_psm_authentication_required": "0080",
+      "TSPX_psm_authorization_required": "0080"
+    },
+    "MAP": {},
+    "MCAP": {},
+    "OPP": {},
+    "PAN": {},
+    "PBAP": {},
+    "PROD": {},
+    "RFCOMM": {
+      "TSPX_server_channel_iut": "7",
+      "TSPX_security_enabled": "FALSE"
+    },
+    "SAP": {},
+    "SCPP": {},
+    "SDP": {},
+    "SM": {},
+    "SPP": {},
+    "SUM ICS": {}
+  }
+}
diff --git a/android/pandora/server/scripts/setup.sh b/android/pandora/server/scripts/setup.sh
new file mode 100755
index 0000000..674dd4c
--- /dev/null
+++ b/android/pandora/server/scripts/setup.sh
@@ -0,0 +1,12 @@
+#!/bin/env bash
+
+# Run Rootcanal and forward port
+if [ "$1" == "--rootcanal" ]
+then
+    adb root
+    adb shell ./vendor/bin/hw/android.hardware.bluetooth@1.1-service.sim &
+    adb forward tcp:6211 tcp:6211
+fi
+
+# Forward Pandora server port
+adb forward tcp:8999 tcp:8999
diff --git a/android/pandora/server/src/com/android/pandora/A2dp.kt b/android/pandora/server/src/com/android/pandora/A2dp.kt
new file mode 100644
index 0000000..72e848f
--- /dev/null
+++ b/android/pandora/server/src/com/android/pandora/A2dp.kt
@@ -0,0 +1,313 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.pandora
+
+import android.bluetooth.BluetoothA2dp
+import android.bluetooth.BluetoothAdapter
+import android.bluetooth.BluetoothDevice
+import android.bluetooth.BluetoothManager
+import android.bluetooth.BluetoothProfile
+import android.content.Context
+import android.content.Intent
+import android.content.IntentFilter
+import android.media.*
+import android.util.Log
+import io.grpc.Status
+import io.grpc.stub.StreamObserver
+import kotlinx.coroutines.CoroutineScope
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.cancel
+import kotlinx.coroutines.delay
+import kotlinx.coroutines.flow.Flow
+import kotlinx.coroutines.flow.SharingStarted
+import kotlinx.coroutines.flow.filter
+import kotlinx.coroutines.flow.first
+import kotlinx.coroutines.flow.map
+import kotlinx.coroutines.flow.shareIn
+import pandora.A2DPGrpc.A2DPImplBase
+import pandora.A2dpProto.*
+
+@kotlinx.coroutines.ExperimentalCoroutinesApi
+class A2dp(val context: Context) : A2DPImplBase() {
+  private val TAG = "PandoraA2dp"
+
+  private val scope: CoroutineScope
+  private val flow: Flow<Intent>
+
+  private val audioManager = context.getSystemService(AudioManager::class.java)!!
+
+  private val bluetoothManager = context.getSystemService(BluetoothManager::class.java)!!
+  private val bluetoothAdapter = bluetoothManager.adapter
+  private val bluetoothA2dp = getProfileProxy<BluetoothA2dp>(context, BluetoothProfile.A2DP)
+
+  private var audioTrack: AudioTrack? = null
+
+  init {
+    scope = CoroutineScope(Dispatchers.Default)
+    val intentFilter = IntentFilter()
+    intentFilter.addAction(BluetoothA2dp.ACTION_PLAYING_STATE_CHANGED)
+    intentFilter.addAction(BluetoothA2dp.ACTION_CONNECTION_STATE_CHANGED)
+
+    flow = intentFlow(context, intentFilter).shareIn(scope, SharingStarted.Eagerly)
+  }
+
+  fun deinit() {
+    bluetoothAdapter.closeProfileProxy(BluetoothProfile.A2DP, bluetoothA2dp)
+    scope.cancel()
+  }
+
+  override fun openSource(
+    request: OpenSourceRequest,
+    responseObserver: StreamObserver<OpenSourceResponse>
+  ) {
+    grpcUnary<OpenSourceResponse>(scope, responseObserver) {
+      val device = request.connection.toBluetoothDevice(bluetoothAdapter)
+      Log.i(TAG, "openSource: device=$device")
+
+      if (device.getBondState() != BluetoothDevice.BOND_BONDED) {
+        Log.e(TAG, "Device is not bonded, cannot openSource")
+        throw Status.UNKNOWN.asException()
+      }
+
+      if (bluetoothA2dp.getConnectionState(device) != BluetoothA2dp.STATE_CONNECTED) {
+        bluetoothA2dp.connect(device)
+        val state =
+          flow
+            .filter { it.getAction() == BluetoothA2dp.ACTION_CONNECTION_STATE_CHANGED }
+            .filter { it.getBluetoothDeviceExtra() == device }
+            .map { it.getIntExtra(BluetoothProfile.EXTRA_STATE, BluetoothAdapter.ERROR) }
+            .filter {
+              it == BluetoothProfile.STATE_CONNECTED || it == BluetoothProfile.STATE_DISCONNECTED
+            }
+            .first()
+
+        if (state == BluetoothProfile.STATE_DISCONNECTED) {
+          Log.e(TAG, "openSource failed, A2DP has been disconnected")
+          throw Status.UNKNOWN.asException()
+        }
+      }
+
+      // TODO: b/234891800, AVDTP start request sometimes never sent if playback starts too early.
+      delay(2000L)
+
+      val source = Source.newBuilder().setConnection(request.connection).build()
+      OpenSourceResponse.newBuilder().setSource(source).build()
+    }
+  }
+
+  override fun waitSource(
+    request: WaitSourceRequest,
+    responseObserver: StreamObserver<WaitSourceResponse>
+  ) {
+    grpcUnary<WaitSourceResponse>(scope, responseObserver) {
+      val device = request.connection.toBluetoothDevice(bluetoothAdapter)
+      Log.i(TAG, "waitSource: device=$device")
+
+      if (device.getBondState() != BluetoothDevice.BOND_BONDED) {
+        Log.e(TAG, "Device is not bonded, cannot openSource")
+        throw Status.UNKNOWN.asException()
+      }
+
+      if (bluetoothA2dp.getConnectionState(device) != BluetoothA2dp.STATE_CONNECTED) {
+        val state =
+          flow
+            .filter { it.getAction() == BluetoothA2dp.ACTION_CONNECTION_STATE_CHANGED }
+            .filter { it.getBluetoothDeviceExtra() == device }
+            .map { it.getIntExtra(BluetoothProfile.EXTRA_STATE, BluetoothAdapter.ERROR) }
+            .filter {
+              it == BluetoothProfile.STATE_CONNECTED || it == BluetoothProfile.STATE_DISCONNECTED
+            }
+            .first()
+
+        if (state == BluetoothProfile.STATE_DISCONNECTED) {
+          Log.e(TAG, "waitSource failed, A2DP has been disconnected")
+          throw Status.UNKNOWN.asException()
+        }
+      }
+
+      // TODO: b/234891800, AVDTP start request sometimes never sent if playback starts too early.
+      delay(2000L)
+
+      val source = Source.newBuilder().setConnection(request.connection).build()
+      WaitSourceResponse.newBuilder().setSource(source).build()
+    }
+  }
+
+  override fun start(request: StartRequest, responseObserver: StreamObserver<StartResponse>) {
+    grpcUnary<StartResponse>(scope, responseObserver) {
+      if (audioTrack == null) {
+        audioTrack = buildAudioTrack()
+      }
+      val device = request.source.connection.toBluetoothDevice(bluetoothAdapter)
+      Log.i(TAG, "start: device=$device")
+
+      if (bluetoothA2dp.getConnectionState(device) != BluetoothA2dp.STATE_CONNECTED) {
+        Log.e(TAG, "Device is not connected, cannot start")
+        throw Status.UNKNOWN.asException()
+      }
+
+      audioTrack!!.play()
+
+      // If A2dp is not already playing, wait for it
+      if (!bluetoothA2dp.isA2dpPlaying(device)) {
+        flow
+          .filter { it.getAction() == BluetoothA2dp.ACTION_PLAYING_STATE_CHANGED }
+          .filter { it.getBluetoothDeviceExtra() == device }
+          .map { it.getIntExtra(BluetoothA2dp.EXTRA_STATE, BluetoothAdapter.ERROR) }
+          .filter { it == BluetoothA2dp.STATE_PLAYING }
+          .first()
+      }
+      StartResponse.getDefaultInstance()
+    }
+  }
+
+  override fun suspend(request: SuspendRequest, responseObserver: StreamObserver<SuspendResponse>) {
+    grpcUnary<SuspendResponse>(scope, responseObserver) {
+      val device = request.source.connection.toBluetoothDevice(bluetoothAdapter)
+      Log.i(TAG, "suspend: device=$device")
+
+      if (bluetoothA2dp.getConnectionState(device) != BluetoothA2dp.STATE_CONNECTED) {
+        Log.e(TAG, "Device is not connected, cannot suspend")
+        throw Status.UNKNOWN.asException()
+      }
+
+      if (!bluetoothA2dp.isA2dpPlaying(device)) {
+        Log.e(TAG, "Device is already suspended, cannot suspend")
+        throw Status.UNKNOWN.asException()
+      }
+
+      val a2dpPlayingStateFlow =
+        flow
+          .filter { it.getAction() == BluetoothA2dp.ACTION_PLAYING_STATE_CHANGED }
+          .filter { it.getBluetoothDeviceExtra() == device }
+          .map { it.getIntExtra(BluetoothA2dp.EXTRA_STATE, BluetoothAdapter.ERROR) }
+
+      audioTrack!!.pause()
+      a2dpPlayingStateFlow.filter { it == BluetoothA2dp.STATE_NOT_PLAYING }.first()
+      SuspendResponse.getDefaultInstance()
+    }
+  }
+
+  override fun isSuspended(
+    request: IsSuspendedRequest,
+    responseObserver: StreamObserver<IsSuspendedResponse>
+  ) {
+    grpcUnary<IsSuspendedResponse>(scope, responseObserver) {
+      val device = request.source.connection.toBluetoothDevice(bluetoothAdapter)
+      Log.i(TAG, "isSuspended: device=$device")
+
+      if (bluetoothA2dp.getConnectionState(device) != BluetoothA2dp.STATE_CONNECTED) {
+        Log.e(TAG, "Device is not connected, cannot get suspend state")
+        throw Status.UNKNOWN.asException()
+      }
+
+      val isSuspended = bluetoothA2dp.isA2dpPlaying(device)
+      IsSuspendedResponse.newBuilder().setIsSuspended(isSuspended).build()
+    }
+  }
+
+  override fun close(request: CloseRequest, responseObserver: StreamObserver<CloseResponse>) {
+    grpcUnary<CloseResponse>(scope, responseObserver) {
+      val device = request.source.connection.toBluetoothDevice(bluetoothAdapter)
+      Log.i(TAG, "close: device=$device")
+
+      if (bluetoothA2dp.getConnectionState(device) != BluetoothA2dp.STATE_CONNECTED) {
+        Log.e(TAG, "Device is not connected, cannot close")
+        throw Status.UNKNOWN.asException()
+      }
+
+      val a2dpConnectionStateChangedFlow =
+        flow
+          .filter { it.getAction() == BluetoothA2dp.ACTION_CONNECTION_STATE_CHANGED }
+          .filter { it.getBluetoothDeviceExtra() == device }
+          .map { it.getIntExtra(BluetoothA2dp.EXTRA_STATE, BluetoothAdapter.ERROR) }
+
+      bluetoothA2dp.disconnect(device)
+      a2dpConnectionStateChangedFlow.filter { it == BluetoothA2dp.STATE_DISCONNECTED }.first()
+
+      CloseResponse.getDefaultInstance()
+    }
+  }
+
+  override fun playbackAudio(
+    responseObserver: StreamObserver<PlaybackAudioResponse>
+  ): StreamObserver<PlaybackAudioRequest> {
+    Log.i(TAG, "playbackAudio")
+
+    if (audioTrack!!.getPlayState() != AudioTrack.PLAYSTATE_PLAYING) {
+      responseObserver.onError(
+        Status.UNKNOWN.withDescription("AudioTrack is not started").asException()
+      )
+    }
+
+    // Volume is maxed out to avoid any amplitude modification of the provided audio data,
+    // enabling the test runner to do comparisons between input and output audio signal.
+    // Any volume modification should be done before providing the audio data.
+    if (audioManager.isVolumeFixed) {
+      Log.w(TAG, "Volume is fixed, cannot max out the volume")
+    } else {
+      val maxVolume = audioManager.getStreamMaxVolume(AudioManager.STREAM_MUSIC)
+      if (audioManager.getStreamVolume(AudioManager.STREAM_MUSIC) < maxVolume) {
+        audioManager.setStreamVolume(
+          AudioManager.STREAM_MUSIC,
+          maxVolume,
+          AudioManager.FLAG_SHOW_UI
+        )
+      }
+    }
+
+    return object : StreamObserver<PlaybackAudioRequest> {
+      override fun onNext(request: PlaybackAudioRequest) {
+        val data = request.data.toByteArray()
+        val written = synchronized(audioTrack!!) { audioTrack!!.write(data, 0, data.size) }
+        if (written != data.size) {
+          responseObserver.onError(
+            Status.UNKNOWN.withDescription("AudioTrack write failed").asException()
+          )
+        }
+      }
+      override fun onError(t: Throwable?) {
+        Log.e(TAG, t.toString())
+        responseObserver.onError(t)
+      }
+      override fun onCompleted() {
+        responseObserver.onNext(PlaybackAudioResponse.getDefaultInstance())
+        responseObserver.onCompleted()
+      }
+    }
+  }
+
+  override fun getAudioEncoding(
+    request: GetAudioEncodingRequest,
+    responseObserver: StreamObserver<GetAudioEncodingResponse>
+  ) {
+    grpcUnary<GetAudioEncodingResponse>(scope, responseObserver) {
+      val device = request.source.connection.toBluetoothDevice(bluetoothAdapter)
+      Log.i(TAG, "getAudioEncoding: device=$device")
+
+      if (bluetoothA2dp.getConnectionState(device) != BluetoothA2dp.STATE_CONNECTED) {
+        Log.e(TAG, "Device is not connected, cannot getAudioEncoding")
+        throw Status.UNKNOWN.asException()
+      }
+
+      // For now, we only support 44100 kHz sampling rate.
+      GetAudioEncodingResponse.newBuilder()
+        .setEncoding(AudioEncoding.PCM_S16_LE_44K1_STEREO)
+        .build()
+    }
+  }
+}
diff --git a/android/pandora/server/src/com/android/pandora/A2dpSink.kt b/android/pandora/server/src/com/android/pandora/A2dpSink.kt
new file mode 100644
index 0000000..d1a0be3
--- /dev/null
+++ b/android/pandora/server/src/com/android/pandora/A2dpSink.kt
@@ -0,0 +1,128 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.pandora
+
+import android.bluetooth.BluetoothA2dpSink
+import android.bluetooth.BluetoothAdapter
+import android.bluetooth.BluetoothDevice
+import android.bluetooth.BluetoothManager
+import android.bluetooth.BluetoothProfile
+import android.content.Context
+import android.content.Intent
+import android.content.IntentFilter
+import android.media.*
+import android.util.Log
+import io.grpc.Status
+import io.grpc.stub.StreamObserver
+import kotlinx.coroutines.CoroutineScope
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.cancel
+import kotlinx.coroutines.flow.Flow
+import kotlinx.coroutines.flow.SharingStarted
+import kotlinx.coroutines.flow.filter
+import kotlinx.coroutines.flow.first
+import kotlinx.coroutines.flow.map
+import kotlinx.coroutines.flow.shareIn
+import pandora.A2DPGrpc.A2DPImplBase
+import pandora.A2dpProto.*
+
+@kotlinx.coroutines.ExperimentalCoroutinesApi
+class A2dpSink(val context: Context) : A2DPImplBase() {
+  private val TAG = "PandoraA2dpSink"
+
+  private val scope: CoroutineScope
+  private val flow: Flow<Intent>
+
+  private val bluetoothManager = context.getSystemService(BluetoothManager::class.java)!!
+  private val bluetoothAdapter = bluetoothManager.adapter
+  private val bluetoothA2dpSink =
+    getProfileProxy<BluetoothA2dpSink>(context, BluetoothProfile.A2DP_SINK)
+
+  init {
+    scope = CoroutineScope(Dispatchers.Default)
+    val intentFilter = IntentFilter()
+    intentFilter.addAction(BluetoothA2dpSink.ACTION_CONNECTION_STATE_CHANGED)
+
+    flow = intentFlow(context, intentFilter).shareIn(scope, SharingStarted.Eagerly)
+  }
+
+  fun deinit() {
+    bluetoothAdapter.closeProfileProxy(BluetoothProfile.A2DP_SINK, bluetoothA2dpSink)
+    scope.cancel()
+  }
+
+  override fun waitSink(
+    request: WaitSinkRequest,
+    responseObserver: StreamObserver<WaitSinkResponse>
+  ) {
+    grpcUnary<WaitSinkResponse>(scope, responseObserver) {
+      val device = request.connection.toBluetoothDevice(bluetoothAdapter)
+      Log.i(TAG, "waitSink: device=$device")
+
+      if (device.getBondState() != BluetoothDevice.BOND_BONDED) {
+        Log.e(TAG, "Device is not bonded, cannot wait for stream")
+        throw Status.UNKNOWN.asException()
+      }
+
+      if (bluetoothA2dpSink.getConnectionState(device) != BluetoothProfile.STATE_CONNECTED) {
+        val state =
+          flow
+            .filter { it.getAction() == BluetoothA2dpSink.ACTION_CONNECTION_STATE_CHANGED }
+            .filter { it.getBluetoothDeviceExtra() == device }
+            .map { it.getIntExtra(BluetoothProfile.EXTRA_STATE, BluetoothAdapter.ERROR) }
+            .filter {
+              it == BluetoothProfile.STATE_CONNECTED || it == BluetoothProfile.STATE_DISCONNECTED
+            }
+            .first()
+
+        if (state == BluetoothProfile.STATE_DISCONNECTED) {
+          Log.e(TAG, "waitStream failed, A2DP has been disconnected")
+          throw Status.UNKNOWN.asException()
+        }
+      }
+
+      val sink = Sink.newBuilder().setConnection(request.connection).build()
+      WaitSinkResponse.newBuilder().setSink(sink).build()
+    }
+  }
+
+  override fun close(request: CloseRequest, responseObserver: StreamObserver<CloseResponse>) {
+    grpcUnary<CloseResponse>(scope, responseObserver) {
+      val device =
+        if (request.hasSink()) {
+          request.sink.connection.toBluetoothDevice(bluetoothAdapter)
+        } else {
+          Log.e(TAG, "Sink device required")
+          throw Status.UNKNOWN.asException()
+        }
+      Log.i(TAG, "close: device=$device")
+      if (bluetoothA2dpSink.getConnectionState(device) != BluetoothProfile.STATE_CONNECTED) {
+        Log.e(TAG, "Device is not connected, cannot close")
+        throw Status.UNKNOWN.asException()
+      }
+
+      val a2dpConnectionStateChangedFlow =
+        flow
+          .filter { it.getAction() == BluetoothA2dpSink.ACTION_CONNECTION_STATE_CHANGED }
+          .filter { it.getBluetoothDeviceExtra() == device }
+          .map { it.getIntExtra(BluetoothProfile.EXTRA_STATE, BluetoothAdapter.ERROR) }
+      bluetoothA2dpSink.setConnectionPolicy(device, BluetoothProfile.CONNECTION_POLICY_FORBIDDEN)
+      a2dpConnectionStateChangedFlow.filter { it == BluetoothProfile.STATE_DISCONNECTED }.first()
+      CloseResponse.getDefaultInstance()
+    }
+  }
+}
diff --git a/android/pandora/server/src/com/android/pandora/AndroidInternal.kt b/android/pandora/server/src/com/android/pandora/AndroidInternal.kt
new file mode 100644
index 0000000..9b70fb0
--- /dev/null
+++ b/android/pandora/server/src/com/android/pandora/AndroidInternal.kt
@@ -0,0 +1,100 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.pandora
+
+import android.util.Log
+import android.content.Context
+import com.google.protobuf.Empty
+import io.grpc.stub.StreamObserver
+import android.provider.Telephony.*
+import android.telephony.SmsManager
+import android.telephony.SubscriptionManager
+import android.telephony.TelephonyManager
+import android.net.Uri
+import android.bluetooth.BluetoothAdapter
+import android.bluetooth.BluetoothDevice
+import android.bluetooth.BluetoothManager
+import androidx.test.InstrumentationRegistry
+import androidx.test.uiautomator.By
+import androidx.test.uiautomator.UiDevice
+import androidx.test.uiautomator.Until
+import kotlinx.coroutines.CoroutineScope
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.cancel
+import pandora.AndroidGrpc.AndroidImplBase
+import pandora.AndroidProto.*
+
+private const val TAG = "PandoraAndroidInternal"
+
+@kotlinx.coroutines.ExperimentalCoroutinesApi
+class AndroidInternal(val context: Context) : AndroidImplBase() {
+
+  private val scope: CoroutineScope = CoroutineScope(Dispatchers.Default)
+  private val INCOMING_FILE_ACCEPT_BTN = "ACCEPT"
+  private val INCOMING_FILE_TITLE = "Incoming file"
+  private val INCOMING_FILE_WAIT_TIMEOUT = 2000L
+
+  private val bluetoothManager = context.getSystemService(BluetoothManager::class.java)!!
+  private val bluetoothAdapter = bluetoothManager.adapter
+  private var telephonyManager = context.getSystemService(TelephonyManager::class.java)
+  private val DEFAULT_MESSAGE_LEN = 130
+  private var device: UiDevice = UiDevice.getInstance(InstrumentationRegistry.getInstrumentation())
+
+  fun deinit() {
+    scope.cancel()
+  }
+
+  override fun log(request: LogRequest, responseObserver: StreamObserver<LogResponse>) {
+    grpcUnary(scope, responseObserver) {
+      Log.i(TAG, request.text)
+      LogResponse.getDefaultInstance()
+    }
+  }
+
+  override fun setAccessPermission(request: SetAccessPermissionRequest, responseObserver: StreamObserver<Empty>) {
+    grpcUnary<Empty>(scope, responseObserver) {
+      val bluetoothDevice = request.address.toBluetoothDevice(bluetoothAdapter)
+      when (request.accessType!!) {
+        AccessType.ACCESS_MESSAGE -> bluetoothDevice.setMessageAccessPermission(BluetoothDevice.ACCESS_ALLOWED)
+        AccessType.ACCESS_PHONEBOOK -> bluetoothDevice.setPhonebookAccessPermission(BluetoothDevice.ACCESS_ALLOWED)
+        AccessType.ACCESS_SIM -> bluetoothDevice.setSimAccessPermission(BluetoothDevice.ACCESS_ALLOWED)
+        else -> {}
+      }
+      Empty.getDefaultInstance()
+    }
+  }
+
+  override fun sendSMS(request: Empty, responseObserver: StreamObserver<Empty>) {
+    grpcUnary<Empty>(scope, responseObserver) {
+      val smsManager = SmsManager.getDefault()
+      val defaultSmsSub = SubscriptionManager.getDefaultSmsSubscriptionId()
+      telephonyManager = telephonyManager.createForSubscriptionId(defaultSmsSub)
+      val avdPhoneNumber = telephonyManager.getLine1Number()
+
+      smsManager.sendTextMessage(avdPhoneNumber, avdPhoneNumber, generateAlphanumericString(DEFAULT_MESSAGE_LEN), null, null)
+      Empty.getDefaultInstance()
+    }
+  }
+
+  override fun acceptIncomingFile(request: Empty, responseObserver: StreamObserver<Empty>) {
+    grpcUnary<Empty>(scope, responseObserver) {
+      device.wait(Until.findObject(By.text(INCOMING_FILE_TITLE)), INCOMING_FILE_WAIT_TIMEOUT).click()
+      device.wait(Until.findObject(By.text(INCOMING_FILE_ACCEPT_BTN)), INCOMING_FILE_WAIT_TIMEOUT).click()
+      Empty.getDefaultInstance()
+    }
+  }
+}
diff --git a/android/pandora/server/src/com/android/pandora/Avrcp.kt b/android/pandora/server/src/com/android/pandora/Avrcp.kt
new file mode 100644
index 0000000..f8cc95b
--- /dev/null
+++ b/android/pandora/server/src/com/android/pandora/Avrcp.kt
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.pandora
+
+import android.bluetooth.BluetoothManager
+import android.content.Context
+import kotlinx.coroutines.CoroutineScope
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.cancel
+import pandora.AVRCPGrpc.AVRCPImplBase
+import pandora.AvrcpProto.*
+
+@kotlinx.coroutines.ExperimentalCoroutinesApi
+class Avrcp(val context: Context) : AVRCPImplBase() {
+  private val TAG = "PandoraAvrcp"
+
+  private val scope: CoroutineScope
+
+  private val bluetoothManager =
+    context.getSystemService(Context.BLUETOOTH_SERVICE) as BluetoothManager
+  private val bluetoothAdapter = bluetoothManager.adapter
+
+  init {
+    // Init the CoroutineScope
+    scope = CoroutineScope(Dispatchers.Default)
+  }
+
+  fun deinit() {
+    // Deinit the CoroutineScope
+    scope.cancel()
+  }
+}
diff --git a/android/pandora/server/src/com/android/pandora/Gatt.kt b/android/pandora/server/src/com/android/pandora/Gatt.kt
new file mode 100644
index 0000000..706bf1a
--- /dev/null
+++ b/android/pandora/server/src/com/android/pandora/Gatt.kt
@@ -0,0 +1,387 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.pandora
+
+import android.bluetooth.BluetoothDevice
+import android.bluetooth.BluetoothGattCharacteristic
+import android.bluetooth.BluetoothGattDescriptor
+import android.bluetooth.BluetoothGattService
+import android.bluetooth.BluetoothGattService.SERVICE_TYPE_PRIMARY
+import android.bluetooth.BluetoothManager
+import android.content.Context
+import android.content.Intent
+import android.content.IntentFilter
+import android.util.Log
+import io.grpc.Status
+import io.grpc.stub.StreamObserver
+import java.util.UUID
+import kotlinx.coroutines.CoroutineScope
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.async
+import kotlinx.coroutines.cancel
+import kotlinx.coroutines.coroutineScope
+import kotlinx.coroutines.delay
+import kotlinx.coroutines.flow.Flow
+import kotlinx.coroutines.flow.SharingStarted
+import kotlinx.coroutines.flow.filter
+import kotlinx.coroutines.flow.first
+import kotlinx.coroutines.flow.shareIn
+import pandora.GATTGrpc.GATTImplBase
+import pandora.GattProto.*
+
+@kotlinx.coroutines.ExperimentalCoroutinesApi
+class Gatt(private val context: Context) : GATTImplBase() {
+  private val TAG = "PandoraGatt"
+
+  private val mScope: CoroutineScope = CoroutineScope(Dispatchers.Default)
+
+  private val mBluetoothManager = context.getSystemService(BluetoothManager::class.java)!!
+  private val mBluetoothAdapter = mBluetoothManager.adapter
+
+  private val serverManager by lazy { GattServerManager(mBluetoothManager, context, mScope) }
+
+  private val flow: Flow<Intent>
+  init {
+    val intentFilter = IntentFilter()
+    intentFilter.addAction(BluetoothDevice.ACTION_UUID)
+
+    flow = intentFlow(context, intentFilter).shareIn(mScope, SharingStarted.Eagerly)
+  }
+
+  fun deinit() {
+    serverManager.server.close()
+    mScope.cancel()
+  }
+
+  override fun exchangeMTU(
+    request: ExchangeMTURequest,
+    responseObserver: StreamObserver<ExchangeMTUResponse>
+  ) {
+    grpcUnary<ExchangeMTUResponse>(mScope, responseObserver) {
+      val mtu = request.mtu
+      Log.i(TAG, "exchangeMTU MTU=$mtu")
+      if (!GattInstance.get(request.connection.address).mGatt.requestMtu(mtu)) {
+        Log.e(TAG, "Error on requesting MTU $mtu")
+        throw Status.UNKNOWN.asException()
+      }
+      ExchangeMTUResponse.newBuilder().build()
+    }
+  }
+
+  override fun writeAttFromHandle(
+    request: WriteRequest,
+    responseObserver: StreamObserver<WriteResponse>
+  ) {
+    grpcUnary<WriteResponse>(mScope, responseObserver) {
+      Log.i(TAG, "writeAttFromHandle handle=${request.handle}")
+      val gattInstance = GattInstance.get(request.connection.address)
+      var characteristic: BluetoothGattCharacteristic? =
+        getCharacteristicWithHandle(request.handle, gattInstance)
+      if (characteristic == null) {
+        val descriptor: BluetoothGattDescriptor? =
+          getDescriptorWithHandle(request.handle, gattInstance)
+        checkNotNull(descriptor) {
+          "Found no characteristic or descriptor with handle ${request.handle}"
+        }
+        val valueWrote =
+          gattInstance.writeDescriptorBlocking(descriptor, request.value.toByteArray())
+        WriteResponse.newBuilder().setHandle(valueWrote.handle).setStatus(valueWrote.status).build()
+      } else {
+        val valueWrote =
+          gattInstance.writeCharacteristicBlocking(characteristic, request.value.toByteArray())
+        WriteResponse.newBuilder().setHandle(valueWrote.handle).setStatus(valueWrote.status).build()
+      }
+    }
+  }
+
+  override fun discoverServiceByUuid(
+    request: DiscoverServiceByUuidRequest,
+    responseObserver: StreamObserver<DiscoverServicesResponse>
+  ) {
+    grpcUnary<DiscoverServicesResponse>(mScope, responseObserver) {
+      val gattInstance = GattInstance.get(request.connection.address)
+      Log.i(TAG, "discoverServiceByUuid uuid=${request.uuid}")
+      // In some cases, GATT starts a discovery immediately after being connected, so
+      // we need to wait until the service discovery is finished to be able to discover again.
+      // This takes between 20s and 28s, and there is no way to know if the service is busy or not.
+      // Delay was originally 30s, but due to flakyness increased to 32s.
+      delay(32000L)
+      check(gattInstance.mGatt.discoverServiceByUuid(UUID.fromString(request.uuid)))
+      // BluetoothGatt#discoverServiceByUuid does not trigger any callback and does not return
+      // any service, the API was made for PTS testing only.
+      DiscoverServicesResponse.newBuilder().build()
+    }
+  }
+
+  override fun discoverServices(
+    request: DiscoverServicesRequest,
+    responseObserver: StreamObserver<DiscoverServicesResponse>
+  ) {
+    grpcUnary<DiscoverServicesResponse>(mScope, responseObserver) {
+      Log.i(TAG, "discoverServices")
+      val gattInstance = GattInstance.get(request.connection.address)
+      check(gattInstance.mGatt.discoverServices())
+      gattInstance.waitForDiscoveryEnd()
+      DiscoverServicesResponse.newBuilder()
+        .addAllServices(generateServicesList(gattInstance.mGatt.services, 1))
+        .build()
+    }
+  }
+
+  override fun discoverServicesSdp(
+    request: DiscoverServicesSdpRequest,
+    responseObserver: StreamObserver<DiscoverServicesSdpResponse>
+  ) {
+    grpcUnary<DiscoverServicesSdpResponse>(mScope, responseObserver) {
+      Log.i(TAG, "discoverServicesSdp")
+      val bluetoothDevice = request.address.toBluetoothDevice(mBluetoothAdapter)
+      check(bluetoothDevice.fetchUuidsWithSdp())
+      flow
+        .filter { it.getAction() == BluetoothDevice.ACTION_UUID }
+        .filter { it.getBluetoothDeviceExtra() == bluetoothDevice }
+        .first()
+      val uuidsList = arrayListOf<String>()
+      for (parcelUuid in bluetoothDevice.getUuids()) {
+        uuidsList.add(parcelUuid.toString())
+      }
+      DiscoverServicesSdpResponse.newBuilder().addAllServiceUuids(uuidsList).build()
+    }
+  }
+
+  override fun clearCache(
+    request: ClearCacheRequest,
+    responseObserver: StreamObserver<ClearCacheResponse>
+  ) {
+    grpcUnary<ClearCacheResponse>(mScope, responseObserver) {
+      Log.i(TAG, "clearCache")
+      val gattInstance = GattInstance.get(request.connection.address)
+      check(gattInstance.mGatt.refresh())
+      ClearCacheResponse.newBuilder().build()
+    }
+  }
+
+  override fun readCharacteristicFromHandle(
+    request: ReadCharacteristicRequest,
+    responseObserver: StreamObserver<ReadCharacteristicResponse>
+  ) {
+    grpcUnary<ReadCharacteristicResponse>(mScope, responseObserver) {
+      Log.i(TAG, "readCharacteristicFromHandle handle=${request.handle}")
+      val gattInstance = GattInstance.get(request.connection.address)
+      val characteristic: BluetoothGattCharacteristic? =
+        getCharacteristicWithHandle(request.handle, gattInstance)
+      checkNotNull(characteristic) { "Characteristic handle ${request.handle} not found." }
+      val readValue = gattInstance.readCharacteristicBlocking(characteristic)
+      ReadCharacteristicResponse.newBuilder()
+        .setValue(AttValue.newBuilder().setHandle(readValue.handle).setValue(readValue.value))
+        .setStatus(readValue.status)
+        .build()
+    }
+  }
+
+  override fun readCharacteristicsFromUuid(
+    request: ReadCharacteristicsFromUuidRequest,
+    responseObserver: StreamObserver<ReadCharacteristicsFromUuidResponse>
+  ) {
+    grpcUnary<ReadCharacteristicsFromUuidResponse>(mScope, responseObserver) {
+      Log.i(TAG, "readCharacteristicsFromUuid uuid=${request.uuid}")
+      val gattInstance = GattInstance.get(request.connection.address)
+      tryDiscoverServices(gattInstance)
+      val readValues =
+        gattInstance.readCharacteristicUuidBlocking(
+          UUID.fromString(request.uuid),
+          request.startHandle,
+          request.endHandle
+        )
+      ReadCharacteristicsFromUuidResponse.newBuilder()
+        .addAllCharacteristicsRead(generateReadValuesList(readValues))
+        .build()
+    }
+  }
+
+  override fun readCharacteristicDescriptorFromHandle(
+    request: ReadCharacteristicDescriptorRequest,
+    responseObserver: StreamObserver<ReadCharacteristicDescriptorResponse>
+  ) {
+    grpcUnary<ReadCharacteristicDescriptorResponse>(mScope, responseObserver) {
+      Log.i(TAG, "readCharacteristicDescriptorFromHandle handle=${request.handle}")
+      val gattInstance = GattInstance.get(request.connection.address)
+      val descriptor: BluetoothGattDescriptor? =
+        getDescriptorWithHandle(request.handle, gattInstance)
+      checkNotNull(descriptor) { "Descriptor handle ${request.handle} not found." }
+      val readValue = gattInstance.readDescriptorBlocking(descriptor)
+      ReadCharacteristicDescriptorResponse.newBuilder()
+        .setValue(AttValue.newBuilder().setHandle(readValue.handle).setValue(readValue.value))
+        .setStatus(readValue.status)
+        .build()
+    }
+  }
+
+  override fun registerService(
+    request: RegisterServiceRequest,
+    responseObserver: StreamObserver<RegisterServiceResponse>
+  ) {
+    grpcUnary(mScope, responseObserver) {
+      Log.i(TAG, "registerService")
+      val service =
+        BluetoothGattService(UUID.fromString(request.service.uuid), SERVICE_TYPE_PRIMARY)
+      for (characteristic in request.service.characteristicsList) {
+        service.addCharacteristic(
+          BluetoothGattCharacteristic(
+            UUID.fromString(characteristic.uuid),
+            characteristic.properties,
+            characteristic.permissions
+          )
+        )
+      }
+
+      val fullService = coroutineScope {
+        val firstService = mScope.async { serverManager.newServiceFlow.first() }
+        serverManager.server.addService(service)
+        firstService.await()
+      }
+
+      RegisterServiceResponse.newBuilder()
+        .setService(
+          GattService.newBuilder()
+            .setHandle(fullService.instanceId)
+            .setType(fullService.type)
+            .setUuid(fullService.uuid.toString())
+            .addAllIncludedServices(generateServicesList(service.includedServices, 1))
+            .addAllCharacteristics(generateCharacteristicsList(service.characteristics))
+            .build()
+        )
+        .build()
+    }
+  }
+
+  /**
+   * Discovers services, then returns characteristic with given handle. BluetoothGatt API is
+   * package-private so we have to redefine it here.
+   */
+  private suspend fun getCharacteristicWithHandle(
+    handle: Int,
+    gattInstance: GattInstance
+  ): BluetoothGattCharacteristic? {
+    tryDiscoverServices(gattInstance)
+    for (service: BluetoothGattService in gattInstance.mGatt.services.orEmpty()) {
+      for (characteristic: BluetoothGattCharacteristic in service.characteristics) {
+        if (characteristic.instanceId == handle) {
+          return characteristic
+        }
+      }
+    }
+    return null
+  }
+
+  /**
+   * Discovers services, then returns descriptor with given handle. BluetoothGatt API is
+   * package-private so we have to redefine it here.
+   */
+  private suspend fun getDescriptorWithHandle(
+    handle: Int,
+    gattInstance: GattInstance
+  ): BluetoothGattDescriptor? {
+    tryDiscoverServices(gattInstance)
+    for (service: BluetoothGattService in gattInstance.mGatt.services.orEmpty()) {
+      for (characteristic: BluetoothGattCharacteristic in service.characteristics) {
+        for (descriptor: BluetoothGattDescriptor in characteristic.descriptors) {
+          if (descriptor.getInstanceId() == handle) {
+            return descriptor
+          }
+        }
+      }
+    }
+    return null
+  }
+
+  /** Generates a list of GattService from a list of BluetoothGattService. */
+  private fun generateServicesList(
+    servicesList: List<BluetoothGattService>,
+    dpth: Int
+  ): ArrayList<GattService> {
+    val newServicesList = arrayListOf<GattService>()
+    for (service in servicesList) {
+      val serviceBuilder =
+        GattService.newBuilder()
+          .setHandle(service.getInstanceId())
+          .setType(service.getType())
+          .setUuid(service.getUuid().toString())
+          .addAllIncludedServices(generateServicesList(service.getIncludedServices(), dpth + 1))
+          .addAllCharacteristics(generateCharacteristicsList(service.characteristics))
+      newServicesList.add(serviceBuilder.build())
+    }
+    return newServicesList
+  }
+
+  /** Generates a list of GattCharacteristic from a list of BluetoothGattCharacteristic. */
+  private fun generateCharacteristicsList(
+    characteristicsList: List<BluetoothGattCharacteristic>
+  ): ArrayList<GattCharacteristic> {
+    val newCharacteristicsList = arrayListOf<GattCharacteristic>()
+    for (characteristic in characteristicsList) {
+      val characteristicBuilder =
+        GattCharacteristic.newBuilder()
+          .setProperties(characteristic.getProperties())
+          .setPermissions(characteristic.getPermissions())
+          .setUuid(characteristic.getUuid().toString())
+          .addAllDescriptors(generateDescriptorsList(characteristic.getDescriptors()))
+          .setHandle(characteristic.getInstanceId())
+      newCharacteristicsList.add(characteristicBuilder.build())
+    }
+    return newCharacteristicsList
+  }
+
+  /** Generates a list of GattCharacteristicDescriptor from a list of BluetoothGattDescriptor. */
+  private fun generateDescriptorsList(
+    descriptorsList: List<BluetoothGattDescriptor>
+  ): ArrayList<GattCharacteristicDescriptor> {
+    val newDescriptorsList = arrayListOf<GattCharacteristicDescriptor>()
+    for (descriptor in descriptorsList) {
+      val descriptorBuilder =
+        GattCharacteristicDescriptor.newBuilder()
+          .setHandle(descriptor.getInstanceId())
+          .setPermissions(descriptor.getPermissions())
+          .setUuid(descriptor.getUuid().toString())
+      newDescriptorsList.add(descriptorBuilder.build())
+    }
+    return newDescriptorsList
+  }
+
+  /** Generates a list of ReadCharacteristicResponse from a list of GattInstanceValueRead. */
+  private fun generateReadValuesList(
+    readValuesList: ArrayList<GattInstance.GattInstanceValueRead>
+  ): ArrayList<ReadCharacteristicResponse> {
+    val newReadValuesList = arrayListOf<ReadCharacteristicResponse>()
+    for (readValue in readValuesList) {
+      val readValueBuilder =
+        ReadCharacteristicResponse.newBuilder()
+          .setValue(AttValue.newBuilder().setHandle(readValue.handle).setValue(readValue.value))
+          .setStatus(readValue.status)
+      newReadValuesList.add(readValueBuilder.build())
+    }
+    return newReadValuesList
+  }
+
+  private suspend fun tryDiscoverServices(gattInstance: GattInstance) {
+    if (!gattInstance.servicesDiscovered() && !gattInstance.mGatt.discoverServices()) {
+      Log.e(TAG, "Error on discovering services for $gattInstance")
+      throw Status.UNKNOWN.asException()
+    } else {
+      gattInstance.waitForDiscoveryEnd()
+    }
+  }
+}
diff --git a/android/pandora/server/src/com/android/pandora/GattInstance.kt b/android/pandora/server/src/com/android/pandora/GattInstance.kt
new file mode 100644
index 0000000..edf5111
--- /dev/null
+++ b/android/pandora/server/src/com/android/pandora/GattInstance.kt
@@ -0,0 +1,364 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.pandora
+
+import android.bluetooth.BluetoothDevice
+import android.bluetooth.BluetoothGatt
+import android.bluetooth.BluetoothGattCallback
+import android.bluetooth.BluetoothGattCharacteristic
+import android.bluetooth.BluetoothGattDescriptor
+import android.bluetooth.BluetoothGattService
+import android.bluetooth.BluetoothProfile
+import android.bluetooth.BluetoothStatusCodes
+import android.content.Context
+import android.util.Log
+import com.google.protobuf.ByteString
+import java.util.UUID
+import kotlinx.coroutines.flow.MutableStateFlow
+import kotlinx.coroutines.flow.first
+import pandora.GattProto.*
+
+/** GattInstance extends and simplifies Android GATT APIs without re-implementing them. */
+@kotlinx.coroutines.ExperimentalCoroutinesApi
+class GattInstance(val mDevice: BluetoothDevice, val mTransport: Int, val mContext: Context) {
+  private val TAG = "GattInstance"
+  public val mGatt: BluetoothGatt
+
+  private var mServiceDiscovered = MutableStateFlow(false)
+  private var mConnectionState = MutableStateFlow(BluetoothProfile.STATE_DISCONNECTED)
+  private var mValuesRead = MutableStateFlow(0)
+  private var mValueWrote = MutableStateFlow(false)
+
+  /**
+   * Wrapper for characteristic and descriptor reading. Uuid, startHandle and endHandle are used to
+   * compare with the callback returned object. Value and status can be read once the read has been
+   * done. ByteString and AttStatusCode are used to ensure compatibility with proto.
+   */
+  class GattInstanceValueRead(
+    var uuid: UUID?,
+    var handle: Int,
+    var value: ByteString?,
+    var status: AttStatusCode
+  ) {}
+  private var mGattInstanceValuesRead = arrayListOf<GattInstanceValueRead>()
+
+  class GattInstanceValueWrote(
+    var uuid: UUID?,
+    var handle: Int,
+    var status: AttStatusCode
+  ) {}
+  private var mGattInstanceValueWrote = GattInstanceValueWrote(null, 0, AttStatusCode.UNKNOWN_ERROR)
+
+  companion object GattManager {
+    val gattInstances: MutableMap<String, GattInstance> = mutableMapOf<String, GattInstance>()
+    fun get(address: String): GattInstance {
+      val instance = gattInstances.get(address)
+      requireNotNull(instance) { "Unable to find GATT instance for $address" }
+      return instance
+    }
+    fun get(address: ByteString): GattInstance {
+      val instance = gattInstances.get(address.toByteArray().decodeToString())
+      requireNotNull(instance) { "Unable to find GATT instance for $address" }
+      return instance
+    }
+  }
+
+  private val mCallback =
+    object : BluetoothGattCallback() {
+      override fun onConnectionStateChange(
+        bluetoothGatt: BluetoothGatt,
+        status: Int,
+        newState: Int
+      ) {
+        Log.i(TAG, "$mDevice connection state changed to $newState")
+        mConnectionState.value = newState
+        if (newState == BluetoothProfile.STATE_DISCONNECTED) {
+          gattInstances.remove(mDevice.address)
+        }
+      }
+
+      override fun onServicesDiscovered(bluetoothGatt: BluetoothGatt, status: Int) {
+        if (status == BluetoothGatt.GATT_SUCCESS) {
+          Log.i(TAG, "Services have been discovered for $mDevice")
+          mServiceDiscovered.value = true
+        }
+      }
+
+      override fun onCharacteristicRead(
+        bluetoothGatt: BluetoothGatt,
+        characteristic: BluetoothGattCharacteristic,
+        value: ByteArray,
+        status: Int
+      ) {
+        Log.i(TAG, "onCharacteristicRead, status: $status")
+        for (gattInstanceValueRead: GattInstanceValueRead in mGattInstanceValuesRead) {
+          if (
+            characteristic.getUuid() == gattInstanceValueRead.uuid &&
+              characteristic.getInstanceId() == gattInstanceValueRead.handle
+          ) {
+            gattInstanceValueRead.value = ByteString.copyFrom(value)
+            gattInstanceValueRead.status = AttStatusCode.forNumber(status)
+            mValuesRead.value++
+          }
+        }
+      }
+
+      override fun onDescriptorRead(
+        bluetoothGatt: BluetoothGatt,
+        descriptor: BluetoothGattDescriptor,
+        status: Int,
+        value: ByteArray
+      ) {
+        Log.i(TAG, "onDescriptorRead, status: $status")
+        for (gattInstanceValueRead: GattInstanceValueRead in mGattInstanceValuesRead) {
+          if (
+            descriptor.getUuid() == gattInstanceValueRead.uuid &&
+              descriptor.getInstanceId() >= gattInstanceValueRead.handle
+          ) {
+            gattInstanceValueRead.value = ByteString.copyFrom(value)
+            gattInstanceValueRead.status = AttStatusCode.forNumber(status)
+            mValuesRead.value++
+          }
+        }
+      }
+
+      override fun onCharacteristicWrite(
+        bluetoothGatt: BluetoothGatt,
+        characteristic: BluetoothGattCharacteristic,
+        status: Int
+      ) {
+        Log.i(TAG, "onCharacteristicWrite, status: $status")
+        mGattInstanceValueWrote.status = AttStatusCode.forNumber(status)
+        mValueWrote.value = true
+      }
+
+      override fun onDescriptorWrite(
+        bluetoothGatt: BluetoothGatt,
+        descriptor: BluetoothGattDescriptor,
+        status: Int
+      ) {
+        Log.i(TAG, "onDescriptorWrite, status: $status")
+        mGattInstanceValueWrote.status = AttStatusCode.forNumber(status)
+        mValueWrote.value = true
+      }
+    }
+
+  init {
+    if (!isBLETransport()) {
+      require(isBonded()) { "Trying to connect non BLE GATT on a not bonded device $mDevice" }
+    }
+    require(gattInstances.get(mDevice.address) == null) {
+      "Trying to connect GATT on an already connected device $mDevice"
+    }
+
+    mGatt = mDevice.connectGatt(mContext, false, mCallback, mTransport)
+
+    checkNotNull(mGatt) { "Failed to connect GATT on $mDevice" }
+    gattInstances.put(mDevice.address, this)
+  }
+
+  public fun isConnected(): Boolean {
+    return mConnectionState.value == BluetoothProfile.STATE_CONNECTED
+  }
+
+  public fun isDisconnected(): Boolean {
+    return mConnectionState.value == BluetoothProfile.STATE_DISCONNECTED
+  }
+
+  public fun isBonded(): Boolean {
+    return mDevice.getBondState() == BluetoothDevice.BOND_BONDED
+  }
+
+  public fun isBLETransport(): Boolean {
+    return mTransport == BluetoothDevice.TRANSPORT_LE
+  }
+
+  public fun servicesDiscovered(): Boolean {
+    return mServiceDiscovered.value
+  }
+
+  public suspend fun waitForState(newState: Int) {
+    if (mConnectionState.value != newState) {
+      mConnectionState.first { it == newState }
+    }
+  }
+
+  public suspend fun waitForDiscoveryEnd() {
+    if (mServiceDiscovered.value != true) {
+      mServiceDiscovered.first { it == true }
+    }
+  }
+
+  public suspend fun waitForValuesReadEnd() {
+    if (mValuesRead.value < mGattInstanceValuesRead.size) {
+      mValuesRead.first { it == mGattInstanceValuesRead.size }
+    }
+    mValuesRead.value = 0
+  }
+
+  public suspend fun waitForValuesRead() {
+    if (mValuesRead.value < mGattInstanceValuesRead.size) {
+      mValuesRead.first { it == mGattInstanceValuesRead.size }
+    }
+  }
+
+  public suspend fun waitForWriteEnd() {
+    if (mValueWrote.value != true) {
+      mValueWrote.first { it == true }
+    }
+    mValueWrote.value = false
+  }
+
+  public suspend fun readCharacteristicBlocking(
+    characteristic: BluetoothGattCharacteristic
+  ): GattInstanceValueRead {
+    // Init mGattInstanceValuesRead with characteristic values.
+    mGattInstanceValuesRead =
+      arrayListOf(
+        GattInstanceValueRead(
+          characteristic.getUuid(),
+          characteristic.getInstanceId(),
+          ByteString.EMPTY,
+          AttStatusCode.UNKNOWN_ERROR
+        )
+      )
+    if (mGatt.readCharacteristic(characteristic)) {
+      waitForValuesReadEnd()
+    }
+    // This method read only one characteristic.
+    return mGattInstanceValuesRead.get(0)
+  }
+
+  public suspend fun readCharacteristicUuidBlocking(
+    uuid: UUID,
+    startHandle: Int,
+    endHandle: Int
+  ): ArrayList<GattInstanceValueRead> {
+    mGattInstanceValuesRead = arrayListOf()
+    // Init mGattInstanceValuesRead with characteristics values.
+    for (service: BluetoothGattService in mGatt.services.orEmpty()) {
+      for (characteristic: BluetoothGattCharacteristic in service.characteristics) {
+        if (
+          characteristic.getUuid() == uuid &&
+            characteristic.getInstanceId() >= startHandle &&
+            characteristic.getInstanceId() <= endHandle
+        ) {
+          mGattInstanceValuesRead.add(
+            GattInstanceValueRead(
+              uuid,
+              characteristic.getInstanceId(),
+              ByteString.EMPTY,
+              AttStatusCode.UNKNOWN_ERROR
+            )
+          )
+          check(
+            mGatt.readUsingCharacteristicUuid(
+              uuid,
+              characteristic.getInstanceId(),
+              characteristic.getInstanceId()
+            )
+          )
+          waitForValuesRead()
+        }
+      }
+    }
+    // All needed characteristics are read.
+    mValuesRead.value = 0
+
+    // When PTS tests with wrong UUID, we return an empty GattInstanceValueRead
+    // with UNKNOWN_ERROR so the MMI can confirm the fail. We also have to try
+    // and read the characteristic anyway for the PTS to validate the test.
+    if (mGattInstanceValuesRead.size == 0) {
+      mGattInstanceValuesRead.add(
+        GattInstanceValueRead(uuid, startHandle, ByteString.EMPTY, AttStatusCode.UNKNOWN_ERROR)
+      )
+      mGatt.readUsingCharacteristicUuid(uuid, startHandle, endHandle)
+    }
+    return mGattInstanceValuesRead
+  }
+
+  public suspend fun readDescriptorBlocking(
+    descriptor: BluetoothGattDescriptor
+  ): GattInstanceValueRead {
+    // Init mGattInstanceValuesRead with descriptor values.
+    mGattInstanceValuesRead =
+      arrayListOf(
+        GattInstanceValueRead(
+          descriptor.getUuid(),
+          descriptor.getInstanceId(),
+          ByteString.EMPTY,
+          AttStatusCode.UNKNOWN_ERROR
+        )
+      )
+    if (mGatt.readDescriptor(descriptor)) {
+      waitForValuesReadEnd()
+    }
+    // This method read only one descriptor.
+    return mGattInstanceValuesRead.get(0)
+  }
+
+  public suspend fun writeCharacteristicBlocking(
+    characteristic: BluetoothGattCharacteristic,
+    value: ByteArray
+  ): GattInstanceValueWrote {
+    GattInstanceValueWrote(
+      characteristic.getUuid(),
+      characteristic.getInstanceId(),
+      AttStatusCode.UNKNOWN_ERROR
+    )
+    if (mGatt.writeCharacteristic(
+        characteristic,
+        value,
+        BluetoothGattCharacteristic.WRITE_TYPE_DEFAULT
+      ) == BluetoothStatusCodes.SUCCESS
+    ) {
+      waitForWriteEnd()
+    }
+    return mGattInstanceValueWrote
+
+  }
+
+  public suspend fun writeDescriptorBlocking(
+    descriptor: BluetoothGattDescriptor,
+    value: ByteArray
+  ): GattInstanceValueWrote {
+    GattInstanceValueWrote(
+      descriptor.getUuid(),
+      descriptor.getInstanceId(),
+      AttStatusCode.UNKNOWN_ERROR
+    )
+    if (mGatt.writeDescriptor(
+        descriptor,
+        value
+      ) == BluetoothStatusCodes.SUCCESS
+    ) {
+      waitForWriteEnd()
+    }
+    return mGattInstanceValueWrote
+
+  }
+
+  public fun disconnectInstance() {
+    require(isConnected()) { "Trying to disconnect an already disconnected device $mDevice" }
+    mGatt.disconnect()
+    gattInstances.remove(mDevice.address)
+  }
+
+  override fun toString(): String {
+    return "GattInstance($mDevice)"
+  }
+}
diff --git a/android/pandora/server/src/com/android/pandora/GattServerManager.kt b/android/pandora/server/src/com/android/pandora/GattServerManager.kt
new file mode 100644
index 0000000..a145344
--- /dev/null
+++ b/android/pandora/server/src/com/android/pandora/GattServerManager.kt
@@ -0,0 +1,93 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.pandora
+
+import android.bluetooth.BluetoothDevice
+import android.bluetooth.BluetoothGatt
+import android.bluetooth.BluetoothGattCharacteristic
+import android.bluetooth.BluetoothGattServer
+import android.bluetooth.BluetoothGattServerCallback
+import android.bluetooth.BluetoothGattService
+import android.bluetooth.BluetoothManager
+import android.content.Context
+import android.util.Log
+import java.util.UUID
+import kotlinx.coroutines.CoroutineScope
+import kotlinx.coroutines.flow.MutableSharedFlow
+
+class GattServerManager(
+  bluetoothManager: BluetoothManager,
+  context: Context,
+  globalScope: CoroutineScope
+) {
+  val TAG = "PandoraGattServerManager"
+
+  val services = mutableMapOf<UUID, BluetoothGattService>()
+  val newServiceFlow = MutableSharedFlow<BluetoothGattService>(extraBufferCapacity = 8)
+  var negociatedMtu = -1
+
+  val callback =
+    object : BluetoothGattServerCallback() {
+      override fun onServiceAdded(status: Int, service: BluetoothGattService) {
+        Log.i(TAG, "onServiceAdded status=$status")
+        check(status == BluetoothGatt.GATT_SUCCESS)
+        check(newServiceFlow.tryEmit(service))
+      }
+      override fun onMtuChanged(device: BluetoothDevice, mtu: Int) {
+        Log.i(TAG, "onMtuChanged mtu=$mtu")
+        negociatedMtu = mtu
+      }
+
+      override fun onCharacteristicReadRequest(
+        device: BluetoothDevice,
+        requestId: Int,
+        offset: Int,
+        characteristic: BluetoothGattCharacteristic
+      ) {
+        Log.i(TAG, "onCharacteristicReadRequest requestId=$requestId")
+        if (negociatedMtu != -1) {
+          server.sendResponse(
+            device,
+            requestId,
+            BluetoothGatt.GATT_SUCCESS,
+            offset,
+            ByteArray(negociatedMtu)
+          )
+        } else {
+          server.sendResponse(device, requestId, BluetoothGatt.GATT_SUCCESS, offset, ByteArray(0))
+        }
+      }
+
+      override fun onCharacteristicWriteRequest(
+        device: BluetoothDevice,
+        requestId: Int,
+        characteristic: BluetoothGattCharacteristic,
+        preparedWrite: Boolean,
+        responseNeeded: Boolean,
+        offset: Int,
+        value: ByteArray
+      ) {
+        Log.i(TAG, "onCharacteristicWriteRequest requestId=$requestId")
+      }
+
+      override fun onExecuteWrite(device: BluetoothDevice, requestId: Int, execute: Boolean) {
+        Log.i(TAG, "onExecuteWrite requestId=$requestId")
+      }
+    }
+
+  val server: BluetoothGattServer = bluetoothManager.openGattServer(context, callback)
+}
diff --git a/android/pandora/server/src/com/android/pandora/Hfp.kt b/android/pandora/server/src/com/android/pandora/Hfp.kt
new file mode 100644
index 0000000..a65c132
--- /dev/null
+++ b/android/pandora/server/src/com/android/pandora/Hfp.kt
@@ -0,0 +1,226 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.pandora
+
+import android.annotation.SuppressLint
+import android.bluetooth.BluetoothDevice
+import android.bluetooth.BluetoothHeadset
+import android.bluetooth.BluetoothManager
+import android.bluetooth.BluetoothProfile
+import android.content.Context
+import android.content.Intent
+import android.content.IntentFilter
+import android.net.Uri
+import android.os.Bundle
+import android.os.IBinder
+import android.provider.CallLog
+import android.telecom.Call
+import android.telecom.CallAudioState
+import android.telecom.InCallService
+import android.telecom.TelecomManager
+import android.telecom.VideoProfile
+import com.google.protobuf.Empty
+import io.grpc.stub.StreamObserver
+import kotlinx.coroutines.CoroutineScope
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.cancel
+import kotlinx.coroutines.flow.Flow
+import kotlinx.coroutines.flow.SharingStarted
+import kotlinx.coroutines.flow.shareIn
+import pandora.HFPGrpc.HFPImplBase
+import pandora.HfpProto.*
+
+private const val TAG = "PandoraHfp"
+
+@kotlinx.coroutines.ExperimentalCoroutinesApi
+class Hfp(val context: Context) : HFPImplBase() {
+  private val scope: CoroutineScope = CoroutineScope(Dispatchers.Default)
+  private val flow: Flow<Intent>
+
+  private val bluetoothManager = context.getSystemService(BluetoothManager::class.java)!!
+  private val telecomManager = context.getSystemService(TelecomManager::class.java)!!
+  private val bluetoothAdapter = bluetoothManager.adapter
+
+  private val bluetoothHfp = getProfileProxy<BluetoothHeadset>(context, BluetoothProfile.HEADSET)
+
+  companion object {
+    @SuppressLint("StaticFieldLeak") private lateinit var inCallService: InCallService
+  }
+
+  init {
+
+    val intentFilter = IntentFilter(BluetoothDevice.ACTION_BOND_STATE_CHANGED)
+    flow = intentFlow(context, intentFilter).shareIn(scope, SharingStarted.Eagerly)
+
+    // kill any existing call
+    telecomManager.endCall()
+
+    shell("su root setprop persist.bluetooth.disableinbandringing false")
+  }
+
+  fun deinit() {
+    // kill any existing call
+    telecomManager.endCall()
+
+    bluetoothAdapter.closeProfileProxy(BluetoothProfile.HEADSET, bluetoothHfp)
+    scope.cancel()
+  }
+
+  class PandoraInCallService : InCallService() {
+    override fun onBind(intent: Intent?): IBinder? {
+      inCallService = this
+      return super.onBind(intent)
+    }
+  }
+
+  override fun enableSlc(request: EnableSlcRequest, responseObserver: StreamObserver<Empty>) {
+    grpcUnary<Empty>(scope, responseObserver) {
+      val device = request.connection.toBluetoothDevice(bluetoothAdapter)
+
+      bluetoothHfp.setConnectionPolicy(device, BluetoothProfile.CONNECTION_POLICY_ALLOWED)
+
+      Empty.getDefaultInstance()
+    }
+  }
+
+  override fun disableSlc(request: DisableSlcRequest, responseObserver: StreamObserver<Empty>) {
+    grpcUnary<Empty>(scope, responseObserver) {
+      val device = request.connection.toBluetoothDevice(bluetoothAdapter)
+
+      bluetoothHfp.setConnectionPolicy(device, BluetoothProfile.CONNECTION_POLICY_FORBIDDEN)
+
+      Empty.getDefaultInstance()
+    }
+  }
+
+  override fun setBatteryLevel(
+    request: SetBatteryLevelRequest,
+    responseObserver: StreamObserver<Empty>,
+  ) {
+    grpcUnary<Empty>(scope, responseObserver) {
+      val action = "android.intent.action.BATTERY_CHANGED"
+      shell("am broadcast -a $action --ei level ${request.batteryPercentage} --ei scale 100")
+      Empty.getDefaultInstance()
+    }
+  }
+
+  override fun declineCall(
+    request: DeclineCallRequest,
+    responseObserver: StreamObserver<DeclineCallResponse>,
+  ) {
+    grpcUnary(scope, responseObserver) {
+      telecomManager.endCall()
+      DeclineCallResponse.getDefaultInstance()
+    }
+  }
+
+  override fun setAudioPath(
+    request: SetAudioPathRequest,
+    responseObserver: StreamObserver<SetAudioPathResponse>,
+  ) {
+    grpcUnary(scope, responseObserver) {
+      when (request.audioPath!!) {
+        AudioPath.AUDIO_PATH_UNKNOWN,
+        AudioPath.UNRECOGNIZED, -> {}
+        AudioPath.AUDIO_PATH_HANDSFREE -> {
+          check(bluetoothHfp.getActiveDevice() != null)
+          inCallService.setAudioRoute(CallAudioState.ROUTE_BLUETOOTH)
+        }
+        AudioPath.AUDIO_PATH_SPEAKERS -> inCallService.setAudioRoute(CallAudioState.ROUTE_SPEAKER)
+      }
+      SetAudioPathResponse.getDefaultInstance()
+    }
+  }
+
+  override fun answerCall(
+    request: AnswerCallRequest,
+    responseObserver: StreamObserver<AnswerCallResponse>,
+  ) {
+    grpcUnary(scope, responseObserver) {
+      telecomManager.acceptRingingCall()
+      AnswerCallResponse.getDefaultInstance()
+    }
+  }
+
+  override fun swapActiveCall(
+    request: SwapActiveCallRequest,
+    responseObserver: StreamObserver<SwapActiveCallResponse>,
+  ) {
+    grpcUnary(scope, responseObserver) {
+      val callsToActivate = mutableListOf<Call>()
+      for (call in inCallService.calls) {
+        if (call.details.state == Call.STATE_ACTIVE) {
+          call.hold()
+        } else {
+          callsToActivate.add(call)
+        }
+      }
+      for (call in callsToActivate) {
+        call.answer(VideoProfile.STATE_AUDIO_ONLY)
+      }
+      inCallService.calls[0].hold()
+      inCallService.calls[1].unhold()
+      SwapActiveCallResponse.getDefaultInstance()
+    }
+  }
+
+  override fun setInBandRingtone(
+    request: SetInBandRingtoneRequest,
+    responseObserver: StreamObserver<SetInBandRingtoneResponse>,
+  ) {
+    grpcUnary(scope, responseObserver) {
+      shell(
+        "su root setprop persist.bluetooth.disableinbandringing " + (!request.enabled).toString()
+      )
+      SetInBandRingtoneResponse.getDefaultInstance()
+    }
+  }
+
+  override fun makeCall(
+    request: MakeCallRequest,
+    responseObserver: StreamObserver<MakeCallResponse>
+  ) {
+    grpcUnary(scope, responseObserver) {
+      telecomManager.placeCall(Uri.fromParts("tel", request.number, null), Bundle())
+      MakeCallResponse.getDefaultInstance()
+    }
+  }
+
+  override fun setVoiceRecognition(
+    request: SetVoiceRecognitionRequest,
+    responseObserver: StreamObserver<SetVoiceRecognitionResponse>
+  ) {
+    grpcUnary(scope, responseObserver) {
+      if (request.enabled) {
+        bluetoothHfp.startVoiceRecognition(request.connection.toBluetoothDevice(bluetoothAdapter))
+      } else {
+        bluetoothHfp.stopVoiceRecognition(request.connection.toBluetoothDevice(bluetoothAdapter))
+      }
+      SetVoiceRecognitionResponse.getDefaultInstance()
+    }
+  }
+
+  override fun clearCallHistory(
+    request: ClearCallHistoryRequest,
+    responseObserver: StreamObserver<ClearCallHistoryResponse>
+  ) {
+    grpcUnary(scope, responseObserver) {
+      context.contentResolver.delete(CallLog.Calls.CONTENT_URI, null, null)
+      ClearCallHistoryResponse.getDefaultInstance()
+    }
+  }
+}
diff --git a/android/pandora/server/src/com/android/pandora/HfpHandsfree.kt b/android/pandora/server/src/com/android/pandora/HfpHandsfree.kt
new file mode 100644
index 0000000..f2af500
--- /dev/null
+++ b/android/pandora/server/src/com/android/pandora/HfpHandsfree.kt
@@ -0,0 +1,190 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.pandora
+
+import android.annotation.SuppressLint
+import android.bluetooth.BluetoothDevice
+import android.bluetooth.BluetoothHeadset
+import android.bluetooth.BluetoothHeadsetClient
+import android.bluetooth.BluetoothManager
+import android.bluetooth.BluetoothProfile
+import android.content.Context
+import android.content.Intent
+import android.content.IntentFilter
+import android.net.Uri
+import android.os.Bundle
+import android.os.IBinder
+import android.provider.CallLog
+import android.telecom.Call
+import android.telecom.CallAudioState
+import android.telecom.InCallService
+import android.telecom.TelecomManager
+import android.telecom.VideoProfile
+import com.google.protobuf.Empty
+import io.grpc.stub.StreamObserver
+import kotlinx.coroutines.CoroutineScope
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.cancel
+import kotlinx.coroutines.flow.Flow
+import kotlinx.coroutines.flow.SharingStarted
+import kotlinx.coroutines.flow.shareIn
+import pandora.HFPGrpc.HFPImplBase
+import pandora.HfpProto.*
+
+private const val TAG = "PandoraHfpHandsfree"
+
+@kotlinx.coroutines.ExperimentalCoroutinesApi
+class HfpHandsfree(val context: Context) : HFPImplBase() {
+  private val scope: CoroutineScope = CoroutineScope(Dispatchers.Default)
+  private val flow: Flow<Intent>
+
+  private val bluetoothManager = context.getSystemService(BluetoothManager::class.java)!!
+  private val telecomManager = context.getSystemService(TelecomManager::class.java)!!
+  private val bluetoothAdapter = bluetoothManager.adapter
+
+  private val bluetoothHfpClient = getProfileProxy<BluetoothHeadsetClient>(context, BluetoothProfile.HEADSET_CLIENT)
+
+  companion object {
+    @SuppressLint("StaticFieldLeak") private lateinit var inCallService: InCallService
+  }
+
+  init {
+    val intentFilter = IntentFilter(BluetoothDevice.ACTION_BOND_STATE_CHANGED)
+    flow = intentFlow(context, intentFilter).shareIn(scope, SharingStarted.Eagerly)
+  }
+
+  fun deinit() {
+    bluetoothAdapter.closeProfileProxy(BluetoothProfile.HEADSET_CLIENT, bluetoothHfpClient)
+    scope.cancel()
+  }
+
+  override fun answerCallAsHandsfree(
+    request: AnswerCallAsHandsfreeRequest,
+    responseObserver: StreamObserver<AnswerCallAsHandsfreeResponse>
+  ) {
+    grpcUnary(scope, responseObserver) {
+      bluetoothHfpClient.acceptCall(request.connection.toBluetoothDevice(bluetoothAdapter), BluetoothHeadsetClient.CALL_ACCEPT_NONE)
+      AnswerCallAsHandsfreeResponse.getDefaultInstance()
+    }
+  }
+
+  override fun endCallAsHandsfree(
+    request: EndCallAsHandsfreeRequest,
+    responseObserver: StreamObserver<EndCallAsHandsfreeResponse>
+  ) {
+    grpcUnary(scope, responseObserver) {
+      for (call in bluetoothHfpClient.getCurrentCalls(request.connection.toBluetoothDevice(bluetoothAdapter))) {
+        bluetoothHfpClient.terminateCall(request.connection.toBluetoothDevice(bluetoothAdapter), call)
+      }
+      EndCallAsHandsfreeResponse.getDefaultInstance()
+    }
+  }
+
+  override fun declineCallAsHandsfree(
+    request: DeclineCallAsHandsfreeRequest,
+    responseObserver: StreamObserver<DeclineCallAsHandsfreeResponse>
+  ) {
+    grpcUnary(scope, responseObserver) {
+      bluetoothHfpClient.rejectCall(request.connection.toBluetoothDevice(bluetoothAdapter))
+      DeclineCallAsHandsfreeResponse.getDefaultInstance()
+    }
+  }
+
+  override fun connectToAudioAsHandsfree(
+    request: ConnectToAudioAsHandsfreeRequest,
+    responseObserver: StreamObserver<ConnectToAudioAsHandsfreeResponse>
+  ) {
+    grpcUnary(scope, responseObserver) {
+      bluetoothHfpClient.connectAudio(request.connection.toBluetoothDevice(bluetoothAdapter))
+      ConnectToAudioAsHandsfreeResponse.getDefaultInstance()
+    }
+  }
+
+  override fun disconnectFromAudioAsHandsfree(
+    request: DisconnectFromAudioAsHandsfreeRequest,
+    responseObserver: StreamObserver<DisconnectFromAudioAsHandsfreeResponse>
+  ) {
+    grpcUnary(scope, responseObserver) {
+      bluetoothHfpClient.disconnectAudio(request.connection.toBluetoothDevice(bluetoothAdapter))
+      DisconnectFromAudioAsHandsfreeResponse.getDefaultInstance()
+    }
+  }
+
+  override fun makeCallAsHandsfree(
+    request: MakeCallAsHandsfreeRequest,
+    responseObserver: StreamObserver<MakeCallAsHandsfreeResponse>
+  ) {
+    grpcUnary(scope, responseObserver) {
+      bluetoothHfpClient.dial(request.connection.toBluetoothDevice(bluetoothAdapter), request.number)
+      MakeCallAsHandsfreeResponse.getDefaultInstance()
+    }
+  }
+
+  override fun callTransferAsHandsfree(
+    request: CallTransferAsHandsfreeRequest,
+    responseObserver: StreamObserver<CallTransferAsHandsfreeResponse>
+  ) {
+    grpcUnary(scope, responseObserver) {
+      bluetoothHfpClient.explicitCallTransfer(request.connection.toBluetoothDevice(bluetoothAdapter))
+      CallTransferAsHandsfreeResponse.getDefaultInstance()
+    }
+  }
+
+  override fun enableSlcAsHandsfree(
+    request: EnableSlcAsHandsfreeRequest,
+    responseObserver: StreamObserver<Empty>
+  ) {
+    grpcUnary(scope, responseObserver) {
+      bluetoothHfpClient.setConnectionPolicy(request.connection.toBluetoothDevice(bluetoothAdapter), BluetoothProfile.CONNECTION_POLICY_ALLOWED)
+      Empty.getDefaultInstance()
+    }
+  }
+
+  override fun disableSlcAsHandsfree(
+    request: DisableSlcAsHandsfreeRequest,
+    responseObserver: StreamObserver<Empty>
+  ) {
+    grpcUnary(scope, responseObserver) {
+      bluetoothHfpClient.setConnectionPolicy(request.connection.toBluetoothDevice(bluetoothAdapter), BluetoothProfile.CONNECTION_POLICY_FORBIDDEN)
+      Empty.getDefaultInstance()
+    }
+  }
+
+  override fun setVoiceRecognitionAsHandsfree(
+    request: SetVoiceRecognitionAsHandsfreeRequest,
+    responseObserver: StreamObserver<SetVoiceRecognitionAsHandsfreeResponse>
+  ) {
+    grpcUnary(scope, responseObserver) {
+      if (request.enabled) {
+        bluetoothHfpClient.startVoiceRecognition(request.connection.toBluetoothDevice(bluetoothAdapter))
+      } else {
+        bluetoothHfpClient.stopVoiceRecognition(request.connection.toBluetoothDevice(bluetoothAdapter))
+      }
+      SetVoiceRecognitionAsHandsfreeResponse.getDefaultInstance()
+    }
+  }
+
+  override fun sendDtmfFromHandsfree(
+    request: SendDtmfFromHandsfreeRequest,
+    responseObserver: StreamObserver<SendDtmfFromHandsfreeResponse>
+  ) {
+    grpcUnary(scope, responseObserver) {
+      bluetoothHfpClient.sendDTMF(request.connection.toBluetoothDevice(bluetoothAdapter), request.code.toByte())
+      SendDtmfFromHandsfreeResponse.getDefaultInstance()
+    }
+  }
+}
diff --git a/android/pandora/server/src/com/android/pandora/Hid.kt b/android/pandora/server/src/com/android/pandora/Hid.kt
new file mode 100644
index 0000000..2bc182f
--- /dev/null
+++ b/android/pandora/server/src/com/android/pandora/Hid.kt
@@ -0,0 +1,42 @@
+package com.android.pandora
+import android.bluetooth.BluetoothHidHost
+import android.bluetooth.BluetoothManager
+import android.bluetooth.BluetoothProfile
+import android.content.Context
+import io.grpc.stub.StreamObserver
+import kotlinx.coroutines.CoroutineScope
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.cancel
+import pandora.HIDGrpc.HIDImplBase
+import pandora.HidProto.SendHostReportRequest
+import pandora.HidProto.SendHostReportResponse
+@kotlinx.coroutines.ExperimentalCoroutinesApi
+
+class Hid(val context: Context) : HIDImplBase() {
+  private val TAG = "PandoraHid"
+
+  private val scope: CoroutineScope = CoroutineScope(Dispatchers.Default)
+
+  private val bluetoothManager =
+      context.getSystemService(Context.BLUETOOTH_SERVICE) as BluetoothManager
+  private val bluetoothAdapter = bluetoothManager.adapter
+  private val bluetoothHidHost = getProfileProxy<BluetoothHidHost>(context, BluetoothProfile.HID_HOST)
+
+  fun deinit() {
+    // Deinit the CoroutineScope
+    scope.cancel()
+  }
+
+  override fun sendHostReport(
+    request: SendHostReportRequest,
+    responseObserver: StreamObserver<SendHostReportResponse>,
+  ) {
+    grpcUnary(scope, responseObserver) {
+      bluetoothHidHost.setReport(
+        request.address.toBluetoothDevice(bluetoothAdapter),
+        request.reportType.number.toByte(),
+        request.report)
+      SendHostReportResponse.getDefaultInstance()
+    }
+  }
+}
diff --git a/android/pandora/server/src/com/android/pandora/Host.kt b/android/pandora/server/src/com/android/pandora/Host.kt
new file mode 100644
index 0000000..324f2b9
--- /dev/null
+++ b/android/pandora/server/src/com/android/pandora/Host.kt
@@ -0,0 +1,695 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.pandora
+
+import android.bluetooth.BluetoothAdapter
+import android.bluetooth.BluetoothAssignedNumbers
+import android.bluetooth.BluetoothDevice
+import android.bluetooth.BluetoothDevice.ADDRESS_TYPE_PUBLIC
+import android.bluetooth.BluetoothDevice.BOND_BONDED
+import android.bluetooth.BluetoothDevice.TRANSPORT_BREDR
+import android.bluetooth.BluetoothDevice.TRANSPORT_LE
+import android.bluetooth.BluetoothManager
+import android.bluetooth.BluetoothProfile
+import android.bluetooth.le.AdvertiseCallback
+import android.bluetooth.le.AdvertiseData
+import android.bluetooth.le.AdvertiseSettings
+import android.bluetooth.le.AdvertisingSetParameters
+import android.bluetooth.le.ScanCallback
+import android.bluetooth.le.ScanRecord
+import android.bluetooth.le.ScanResult
+import android.content.Context
+import android.content.Intent
+import android.content.IntentFilter
+import android.net.MacAddress
+import android.os.ParcelUuid
+import android.util.Log
+import com.google.protobuf.Any
+import com.google.protobuf.ByteString
+import com.google.protobuf.Empty
+import io.grpc.Status
+import io.grpc.stub.StreamObserver
+import java.time.Duration
+import java.util.UUID
+import kotlinx.coroutines.CoroutineScope
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.awaitCancellation
+import kotlinx.coroutines.cancel
+import kotlinx.coroutines.channels.awaitClose
+import kotlinx.coroutines.channels.trySendBlocking
+import kotlinx.coroutines.delay
+import kotlinx.coroutines.flow.Flow
+import kotlinx.coroutines.flow.SharingStarted
+import kotlinx.coroutines.flow.callbackFlow
+import kotlinx.coroutines.flow.filter
+import kotlinx.coroutines.flow.first
+import kotlinx.coroutines.flow.map
+import kotlinx.coroutines.flow.shareIn
+import kotlinx.coroutines.launch
+import kotlinx.coroutines.runBlocking
+import pandora.HostGrpc.HostImplBase
+import pandora.HostProto.*
+
+@kotlinx.coroutines.ExperimentalCoroutinesApi
+class Host(
+  private val context: Context,
+  private val security: Security,
+  private val server: Server
+) : HostImplBase() {
+  private val TAG = "PandoraHost"
+
+  private val scope: CoroutineScope
+  private val flow: Flow<Intent>
+
+  private val bluetoothManager = context.getSystemService(BluetoothManager::class.java)!!
+  private val bluetoothAdapter = bluetoothManager.adapter
+
+  private var connectability = ConnectabilityMode.NOT_CONNECTABLE
+  private var discoverability = DiscoverabilityMode.NOT_DISCOVERABLE
+
+  private val advertisers = mutableMapOf<UUID, AdvertiseCallback>()
+
+  init {
+    scope = CoroutineScope(Dispatchers.Default)
+
+    // Add all intent actions to be listened.
+    val intentFilter = IntentFilter()
+    intentFilter.addAction(BluetoothAdapter.ACTION_STATE_CHANGED)
+    intentFilter.addAction(BluetoothDevice.ACTION_BOND_STATE_CHANGED)
+    intentFilter.addAction(BluetoothAdapter.ACTION_CONNECTION_STATE_CHANGED)
+    intentFilter.addAction(BluetoothDevice.ACTION_PAIRING_REQUEST)
+    intentFilter.addAction(BluetoothDevice.ACTION_ACL_CONNECTED)
+    intentFilter.addAction(BluetoothDevice.ACTION_ACL_DISCONNECTED)
+    intentFilter.addAction(BluetoothDevice.ACTION_FOUND)
+
+    // Creates a shared flow of intents that can be used in all methods in the coroutine scope.
+    // This flow is started eagerly to make sure that the broadcast receiver is registered before
+    // any function call. This flow is only cancelled when the corresponding scope is cancelled.
+    flow = intentFlow(context, intentFilter).shareIn(scope, SharingStarted.Eagerly)
+  }
+
+  fun deinit() {
+    scope.cancel()
+  }
+
+  private suspend fun rebootBluetooth() {
+    Log.i(TAG, "rebootBluetooth")
+
+    val stateFlow =
+      flow
+        .filter { it.getAction() == BluetoothAdapter.ACTION_STATE_CHANGED }
+        .map { it.getIntExtra(BluetoothAdapter.EXTRA_STATE, BluetoothAdapter.ERROR) }
+
+    if (bluetoothAdapter.isEnabled) {
+      bluetoothAdapter.disable()
+      stateFlow.filter { it == BluetoothAdapter.STATE_OFF }.first()
+    }
+
+    // TODO: b/234892968
+    delay(3000L)
+
+    bluetoothAdapter.enable()
+    stateFlow.filter { it == BluetoothAdapter.STATE_ON }.first()
+  }
+
+  override fun factoryReset(request: Empty, responseObserver: StreamObserver<Empty>) {
+    grpcUnary<Empty>(scope, responseObserver, 30) {
+      Log.i(TAG, "factoryReset")
+
+      val stateFlow =
+      flow
+        .filter { it.getAction() == BluetoothAdapter.ACTION_STATE_CHANGED }
+        .map { it.getIntExtra(BluetoothAdapter.EXTRA_STATE, BluetoothAdapter.ERROR) }
+
+      bluetoothAdapter.clearBluetooth()
+
+      stateFlow.filter { it == BluetoothAdapter.STATE_ON }.first()
+      Log.i(TAG, "Shutdown the gRPC Server")
+      server.shutdown()
+
+      // The last expression is the return value.
+      Empty.getDefaultInstance()
+    }
+  }
+
+  override fun reset(request: Empty, responseObserver: StreamObserver<Empty>) {
+    grpcUnary<Empty>(scope, responseObserver) {
+      Log.i(TAG, "reset")
+
+      rebootBluetooth()
+
+      Empty.getDefaultInstance()
+    }
+  }
+
+  override fun readLocalAddress(
+    request: Empty,
+    responseObserver: StreamObserver<ReadLocalAddressResponse>
+  ) {
+    grpcUnary<ReadLocalAddressResponse>(scope, responseObserver) {
+      Log.i(TAG, "readLocalAddress")
+      val localMacAddress = MacAddress.fromString(bluetoothAdapter.getAddress())
+      ReadLocalAddressResponse.newBuilder()
+        .setAddress(ByteString.copyFrom(localMacAddress.toByteArray()))
+        .build()
+    }
+  }
+
+  private suspend fun waitPairingRequestIntent(bluetoothDevice: BluetoothDevice) {
+    Log.i(TAG, "waitPairingRequestIntent: device=$bluetoothDevice")
+    var pairingVariant =
+      flow
+        .filter { it.getAction() == BluetoothDevice.ACTION_PAIRING_REQUEST }
+        .filter { it.getBluetoothDeviceExtra() == bluetoothDevice }
+        .first()
+        .getIntExtra(BluetoothDevice.EXTRA_PAIRING_VARIANT, BluetoothDevice.ERROR)
+
+    val confirmationCases =
+      intArrayOf(
+        BluetoothDevice.PAIRING_VARIANT_PASSKEY_CONFIRMATION,
+        BluetoothDevice.PAIRING_VARIANT_CONSENT,
+        BluetoothDevice.PAIRING_VARIANT_PIN,
+      )
+
+    if (pairingVariant in confirmationCases) {
+      bluetoothDevice.setPairingConfirmation(true)
+    }
+  }
+
+  private suspend fun waitConnectionIntent(bluetoothDevice: BluetoothDevice) {
+    Log.i(TAG, "waitConnectionIntent: device=$bluetoothDevice")
+    flow
+      .filter { it.action == BluetoothAdapter.ACTION_CONNECTION_STATE_CHANGED }
+      .filter { it.getBluetoothDeviceExtra() == bluetoothDevice }
+      .map { it.getIntExtra(BluetoothAdapter.EXTRA_CONNECTION_STATE, BluetoothAdapter.ERROR) }
+      .filter { it == BluetoothAdapter.STATE_CONNECTED }
+      .first()
+  }
+
+  suspend fun waitBondIntent(bluetoothDevice: BluetoothDevice) {
+    // We only wait for bonding to be completed since we only need the ACL connection to be
+    // established with the peer device (on Android state connected is sent when all profiles
+    // have been connected).
+    Log.i(TAG, "waitBondIntent: device=$bluetoothDevice")
+    flow
+      .filter { it.action == BluetoothDevice.ACTION_BOND_STATE_CHANGED }
+      .filter { it.getBluetoothDeviceExtra() == bluetoothDevice }
+      .map { it.getIntExtra(BluetoothDevice.EXTRA_BOND_STATE, BluetoothAdapter.ERROR) }
+      .filter { it == BOND_BONDED }
+      .first()
+  }
+
+  private suspend fun acceptPairingAndAwaitBonded(bluetoothDevice: BluetoothDevice) {
+    val acceptPairingJob = scope.launch { waitPairingRequestIntent(bluetoothDevice) }
+    waitBondIntent(bluetoothDevice)
+    if (acceptPairingJob.isActive) {
+      acceptPairingJob.cancel()
+    }
+  }
+
+  override fun waitConnection(
+    request: WaitConnectionRequest,
+    responseObserver: StreamObserver<WaitConnectionResponse>
+  ) {
+    grpcUnary(scope, responseObserver) {
+      val bluetoothDevice = request.address.toBluetoothDevice(bluetoothAdapter)
+
+      Log.i(TAG, "waitConnection: device=$bluetoothDevice")
+
+      if (!bluetoothAdapter.isEnabled) {
+        Log.e(TAG, "Bluetooth is not enabled, cannot waitConnection")
+        throw Status.UNKNOWN.asException()
+      }
+
+      if (security.manuallyConfirm) {
+        waitBondIntent(bluetoothDevice)
+      } else {
+        acceptPairingAndAwaitBonded(bluetoothDevice)
+      }
+
+      WaitConnectionResponse.newBuilder()
+        .setConnection(bluetoothDevice.toConnection(TRANSPORT_BREDR))
+        .build()
+    }
+  }
+
+  override fun connect(request: ConnectRequest, responseObserver: StreamObserver<ConnectResponse>) {
+    grpcUnary(scope, responseObserver) {
+      val bluetoothDevice = request.address.toBluetoothDevice(bluetoothAdapter)
+
+      Log.i(TAG, "connect: address=$bluetoothDevice")
+
+      bluetoothAdapter.cancelDiscovery()
+
+      if (!bluetoothDevice.isConnected()) {
+        if (bluetoothDevice.bondState == BOND_BONDED) {
+          // already bonded, just reconnect
+          bluetoothDevice.connect()
+          waitConnectionIntent(bluetoothDevice)
+        } else {
+          // need to bond
+          bluetoothDevice.createBond()
+          if (!security.manuallyConfirm) {
+            acceptPairingAndAwaitBonded(bluetoothDevice)
+          }
+        }
+      }
+
+      ConnectResponse.newBuilder()
+        .setConnection(bluetoothDevice.toConnection(TRANSPORT_BREDR))
+        .build()
+    }
+  }
+
+  override fun getConnection(
+    request: GetConnectionRequest,
+    responseObserver: StreamObserver<GetConnectionResponse>
+  ) {
+    grpcUnary(scope, responseObserver) {
+      val bluetoothDevice = bluetoothAdapter.getRemoteDevice(request.address.toByteArray())
+      if (bluetoothDevice.isConnected() && bluetoothDevice.type != BluetoothDevice.DEVICE_TYPE_LE) {
+        GetConnectionResponse.newBuilder()
+          .setConnection(bluetoothDevice.toConnection(TRANSPORT_BREDR))
+          .build()
+      } else {
+        GetConnectionResponse.newBuilder().setPeerNotFound(Empty.getDefaultInstance()).build()
+      }
+    }
+  }
+
+  override fun disconnect(request: DisconnectRequest, responseObserver: StreamObserver<Empty>) {
+    grpcUnary<Empty>(scope, responseObserver) {
+      val bluetoothDevice = request.connection.toBluetoothDevice(bluetoothAdapter)
+      Log.i(TAG, "disconnect: device=$bluetoothDevice")
+
+      if (!bluetoothDevice.isConnected()) {
+        Log.e(TAG, "Device is not connected, cannot disconnect")
+        throw Status.UNKNOWN.asException()
+      }
+
+      when (request.connection.transport) {
+        TRANSPORT_BREDR -> {
+          Log.i(TAG, "disconnect BR_EDR")
+          val connectionStateChangedFlow =
+            flow
+              .filter { it.getAction() == BluetoothAdapter.ACTION_CONNECTION_STATE_CHANGED }
+              .filter { it.getBluetoothDeviceExtra() == bluetoothDevice }
+              .map {
+                it.getIntExtra(BluetoothAdapter.EXTRA_CONNECTION_STATE, BluetoothAdapter.ERROR)
+              }
+
+          bluetoothDevice.disconnect()
+          connectionStateChangedFlow.filter { it == BluetoothAdapter.STATE_DISCONNECTED }.first()
+        }
+        TRANSPORT_LE -> {
+          Log.i(TAG, "disconnect LE")
+          val gattInstance = GattInstance.get(bluetoothDevice.address)
+
+          if (gattInstance.isDisconnected()) {
+            Log.e(TAG, "Device is not connected, cannot disconnect")
+            throw Status.UNKNOWN.asException()
+          }
+
+          gattInstance.disconnectInstance()
+          gattInstance.waitForState(BluetoothProfile.STATE_DISCONNECTED)
+        }
+        else -> {
+          Log.e(TAG, "Device type UNKNOWN")
+          throw Status.UNKNOWN.asException()
+        }
+      }
+
+      Empty.getDefaultInstance()
+    }
+  }
+
+  override fun connectLE(
+    request: ConnectLERequest,
+    responseObserver: StreamObserver<ConnectLEResponse>
+  ) {
+    grpcUnary<ConnectLEResponse>(scope, responseObserver) {
+      if (request.getAddressCase() != ConnectLERequest.AddressCase.PUBLIC) {
+        Log.e(TAG, "connectLE: public address not provided")
+        throw Status.UNKNOWN.asException()
+      }
+      val address = request.public.decodeAsMacAddressToString()
+      Log.i(TAG, "connectLE: $address")
+      val bluetoothDevice = scanLeDevice(address)!!
+      GattInstance(bluetoothDevice, TRANSPORT_LE, context)
+        .waitForState(BluetoothProfile.STATE_CONNECTED)
+      ConnectLEResponse.newBuilder()
+        .setConnection(bluetoothDevice.toConnection(TRANSPORT_LE))
+        .build()
+    }
+  }
+
+  override fun getLEConnection(
+    request: GetLEConnectionRequest,
+    responseObserver: StreamObserver<GetLEConnectionResponse>,
+  ) {
+    grpcUnary<GetLEConnectionResponse>(scope, responseObserver) {
+      if (request.getAddressCase() != GetLEConnectionRequest.AddressCase.PUBLIC) {
+        Log.e(TAG, "connectLE: public address not provided")
+        throw Status.UNKNOWN.asException()
+      }
+      val address = request.public.decodeAsMacAddressToString()
+      Log.i(TAG, "getLEConnection: $address")
+      val bluetoothDevice =
+        bluetoothAdapter.getRemoteLeDevice(address, BluetoothDevice.ADDRESS_TYPE_PUBLIC)
+      if (bluetoothDevice.isConnected()) {
+        GetLEConnectionResponse.newBuilder()
+          .setConnection(bluetoothDevice.toConnection(TRANSPORT_LE))
+          .build()
+      } else {
+        Log.e(TAG, "Device: $bluetoothDevice is not connected")
+        GetLEConnectionResponse.newBuilder().setPeerNotFound(Empty.getDefaultInstance()).build()
+      }
+    }
+  }
+
+  private fun scanLeDevice(address: String): BluetoothDevice? {
+    Log.d(TAG, "scanLeDevice")
+    var bluetoothDevice: BluetoothDevice? = null
+    runBlocking {
+      val flow = callbackFlow {
+        val leScanCallback =
+          object : ScanCallback() {
+            override fun onScanFailed(errorCode: Int) {
+              super.onScanFailed(errorCode)
+              Log.d(TAG, "onScanFailed: errorCode: $errorCode")
+              trySendBlocking(null)
+            }
+            override fun onScanResult(callbackType: Int, result: ScanResult) {
+              super.onScanResult(callbackType, result)
+              val deviceAddress = result.device.address
+              if (deviceAddress == address) {
+                Log.d(TAG, "found device address: $deviceAddress")
+                trySendBlocking(result.device)
+              }
+            }
+          }
+        val bluetoothLeScanner = bluetoothAdapter.bluetoothLeScanner
+        bluetoothLeScanner?.startScan(leScanCallback) ?: run { trySendBlocking(null) }
+        awaitClose { bluetoothLeScanner?.stopScan(leScanCallback) }
+      }
+      bluetoothDevice = flow.first()
+    }
+    return bluetoothDevice
+  }
+
+  override fun startAdvertising(
+    request: StartAdvertisingRequest,
+    responseObserver: StreamObserver<StartAdvertisingResponse>
+  ) {
+    Log.d(TAG, "startAdvertising")
+    grpcUnary(scope, responseObserver) {
+      val handle = UUID.randomUUID()
+
+      callbackFlow {
+          val callback =
+            object : AdvertiseCallback() {
+              override fun onStartSuccess(settingsInEffect: AdvertiseSettings) {
+                trySendBlocking(
+                  StartAdvertisingResponse.newBuilder()
+                    .setSet(
+                      AdvertisingSet.newBuilder()
+                        .setCookie(
+                          Any.newBuilder()
+                            .setValue(ByteString.copyFromUtf8(handle.toString()))
+                            .build()
+                        )
+                        .build()
+                    )
+                    .build()
+                )
+              }
+              override fun onStartFailure(errorCode: Int) {
+                error("failed to start advertising")
+              }
+            }
+
+          advertisers[handle] = callback
+
+          val advertisingDataBuilder = AdvertiseData.Builder()
+          val dataTypesRequest = request.data
+
+          if (
+            !dataTypesRequest.getIncompleteServiceClassUuids16List().isEmpty() or
+              !dataTypesRequest.getIncompleteServiceClassUuids32List().isEmpty() or
+              !dataTypesRequest.getIncompleteServiceClassUuids128List().isEmpty()
+          ) {
+            Log.e(TAG, "Incomplete Service Class Uuids not supported")
+            throw Status.UNKNOWN.asException()
+          }
+
+          for (service_uuid in dataTypesRequest.getCompleteServiceClassUuids16List()) {
+            advertisingDataBuilder.addServiceUuid(ParcelUuid.fromString(service_uuid))
+          }
+          for (service_uuid in dataTypesRequest.getCompleteServiceClassUuids32List()) {
+            advertisingDataBuilder.addServiceUuid(ParcelUuid.fromString(service_uuid))
+          }
+          for (service_uuid in dataTypesRequest.getCompleteServiceClassUuids128List()) {
+            advertisingDataBuilder.addServiceUuid(ParcelUuid.fromString(service_uuid))
+          }
+
+          advertisingDataBuilder
+            .setIncludeDeviceName(
+              dataTypesRequest.includeCompleteLocalName ||
+                dataTypesRequest.includeShortenedLocalName
+            )
+            .setIncludeTxPowerLevel(dataTypesRequest.includeTxPowerLevel)
+            .addManufacturerData(
+              BluetoothAssignedNumbers.GOOGLE,
+              dataTypesRequest.manufacturerSpecificData.toByteArray()
+            )
+          val advertisingData = advertisingDataBuilder.build()
+
+          val ownAddressType =
+            when (request.ownAddressType) {
+              OwnAddressType.RESOLVABLE_OR_PUBLIC,
+              OwnAddressType.PUBLIC -> AdvertisingSetParameters.ADDRESS_TYPE_PUBLIC
+              OwnAddressType.RESOLVABLE_OR_RANDOM,
+              OwnAddressType.RANDOM -> AdvertisingSetParameters.ADDRESS_TYPE_RANDOM
+              else -> AdvertisingSetParameters.ADDRESS_TYPE_DEFAULT
+            }
+          val advertiseSettings =
+            AdvertiseSettings.Builder()
+              .setConnectable(request.connectable)
+              .setOwnAddressType(ownAddressType)
+              .build()
+
+          bluetoothAdapter.bluetoothLeAdvertiser.startAdvertising(
+            advertiseSettings,
+            advertisingData,
+            callback,
+          )
+
+          awaitClose { /* no-op */}
+        }
+        .first()
+    }
+  }
+
+  override fun stopAdvertising(
+    request: StopAdvertisingRequest,
+    responseObserver: StreamObserver<Empty>
+  ) {
+    grpcUnary(scope, responseObserver) {
+      Log.d(TAG, "stopAdvertising")
+      val handle = UUID.fromString(request.set.cookie.value.toString())
+      bluetoothAdapter.bluetoothLeAdvertiser.stopAdvertising(advertisers[handle])
+      advertisers.remove(handle)
+      Empty.getDefaultInstance()
+    }
+  }
+
+  // TODO: Handle request parameters
+  override fun scan(request: ScanRequest, responseObserver: StreamObserver<ScanningResponse>) {
+    Log.d(TAG, "scan")
+    grpcServerStream(scope, responseObserver) {
+      callbackFlow {
+        val callback =
+          object : ScanCallback() {
+            override fun onScanResult(callbackType: Int, result: ScanResult) {
+              val bluetoothDevice = result.device
+              val scanRecord = result.scanRecord
+              val scanData = scanRecord.getAdvertisingDataMap()
+              var dataTypesBuilder =
+                DataTypes.newBuilder().setTxPowerLevel(scanRecord.getTxPowerLevel())
+              scanData[ScanRecord.DATA_TYPE_LOCAL_NAME_SHORT]?.let {
+                dataTypesBuilder.setShortenedLocalName(it.decodeToString())
+              }
+                ?: run { dataTypesBuilder.setIncludeShortenedLocalName(false) }
+              scanData[ScanRecord.DATA_TYPE_LOCAL_NAME_COMPLETE]?.let {
+                dataTypesBuilder.setCompleteLocalName(it.decodeToString())
+              }
+                ?: run { dataTypesBuilder.setIncludeCompleteLocalName(false) }
+              // Flags DataTypes CSSv10 1.3 Flags
+              val mode: DiscoverabilityMode =
+                when (result.scanRecord.advertiseFlags and 0b11) {
+                  0b01 -> DiscoverabilityMode.DISCOVERABLE_LIMITED
+                  0b10 -> DiscoverabilityMode.DISCOVERABLE_GENERAL
+                  else -> DiscoverabilityMode.NOT_DISCOVERABLE
+                }
+              dataTypesBuilder.setLeDiscoverabilityMode(mode)
+              val primaryPhy =
+                when (result.getPrimaryPhy()) {
+                  BluetoothDevice.PHY_LE_1M -> PrimaryPhy.PRIMARY_1M
+                  BluetoothDevice.PHY_LE_CODED -> PrimaryPhy.PRIMARY_CODED
+                  else -> PrimaryPhy.UNRECOGNIZED
+                }
+              var scanningResponseBuilder =
+                ScanningResponse.newBuilder()
+                  .setLegacy(result.isLegacy())
+                  .setConnectable(result.isConnectable())
+                  .setSid(result.getPeriodicAdvertisingInterval())
+                  .setPrimaryPhy(primaryPhy)
+                  .setTxPower(result.getTxPower())
+                  .setRssi(result.getRssi())
+                  .setPeriodicAdvertisingInterval(result.getPeriodicAdvertisingInterval().toFloat())
+                  .setData(dataTypesBuilder.build())
+              when (bluetoothDevice.addressType) {
+                BluetoothDevice.ADDRESS_TYPE_PUBLIC ->
+                  scanningResponseBuilder.setPublic(bluetoothDevice.toByteString())
+                BluetoothDevice.ADDRESS_TYPE_RANDOM ->
+                  scanningResponseBuilder.setRandom(bluetoothDevice.toByteString())
+                else ->
+                  Log.w(TAG, "Address type UNKNOWN: ${bluetoothDevice.type} addr: $bluetoothDevice")
+              }
+              // TODO: Complete the missing field as needed, all the examples are here
+              trySendBlocking(scanningResponseBuilder.build())
+            }
+
+            override fun onScanFailed(errorCode: Int) {
+              error("scan failed")
+            }
+          }
+        bluetoothAdapter.bluetoothLeScanner.startScan(callback)
+
+        awaitClose { bluetoothAdapter.bluetoothLeScanner.stopScan(callback) }
+      }
+    }
+  }
+
+  override fun inquiry(request: Empty, responseObserver: StreamObserver<InquiryResponse>) {
+    Log.d(TAG, "Inquiry")
+    grpcServerStream(scope, responseObserver) {
+      launch {
+        try {
+          bluetoothAdapter.startDiscovery()
+          awaitCancellation()
+        } finally {
+          bluetoothAdapter.cancelDiscovery()
+        }
+      }
+      flow
+        .filter { it.action == BluetoothDevice.ACTION_FOUND }
+        .map {
+          val bluetoothDevice = it.getBluetoothDeviceExtra()
+          Log.i(TAG, "Device found: $bluetoothDevice")
+          InquiryResponse.newBuilder().setAddress(bluetoothDevice.toByteString()).build()
+        }
+    }
+  }
+
+  override fun setDiscoverabilityMode(
+    request: SetDiscoverabilityModeRequest,
+    responseObserver: StreamObserver<Empty>
+  ) {
+    Log.d(TAG, "setDiscoverabilityMode")
+    grpcUnary(scope, responseObserver) {
+      discoverability = request.mode!!
+
+      val scanMode =
+        when (discoverability) {
+          DiscoverabilityMode.UNRECOGNIZED -> null
+          DiscoverabilityMode.NOT_DISCOVERABLE ->
+            if (connectability == ConnectabilityMode.CONNECTABLE) {
+              BluetoothAdapter.SCAN_MODE_CONNECTABLE
+            } else {
+              BluetoothAdapter.SCAN_MODE_NONE
+            }
+          DiscoverabilityMode.DISCOVERABLE_LIMITED,
+          DiscoverabilityMode.DISCOVERABLE_GENERAL ->
+            BluetoothAdapter.SCAN_MODE_CONNECTABLE_DISCOVERABLE
+        }
+
+      if (scanMode != null) {
+        bluetoothAdapter.setScanMode(scanMode)
+      }
+
+      if (discoverability == DiscoverabilityMode.DISCOVERABLE_LIMITED) {
+        bluetoothAdapter.setDiscoverableTimeout(
+          Duration.ofSeconds(120)
+        ) // limited discoverability needs a timeout, 120s is Android default
+      }
+      Empty.getDefaultInstance()
+    }
+  }
+
+  override fun setConnectabilityMode(
+    request: SetConnectabilityModeRequest,
+    responseObserver: StreamObserver<Empty>
+  ) {
+    grpcUnary(scope, responseObserver) {
+      Log.d(TAG, "setConnectabilityMode")
+      connectability = request.mode!!
+
+      val scanMode =
+        when (connectability) {
+          ConnectabilityMode.UNRECOGNIZED -> null
+          ConnectabilityMode.NOT_CONNECTABLE -> {
+            BluetoothAdapter.SCAN_MODE_NONE
+          }
+          ConnectabilityMode.CONNECTABLE -> {
+            if (
+              discoverability == DiscoverabilityMode.DISCOVERABLE_LIMITED ||
+                discoverability == DiscoverabilityMode.DISCOVERABLE_GENERAL
+            ) {
+              BluetoothAdapter.SCAN_MODE_CONNECTABLE_DISCOVERABLE
+            } else {
+              BluetoothAdapter.SCAN_MODE_CONNECTABLE
+            }
+          }
+        }
+      if (scanMode != null) {
+        bluetoothAdapter.setScanMode(scanMode)
+      }
+      Empty.getDefaultInstance()
+    }
+  }
+
+  override fun getRemoteName(
+    request: GetRemoteNameRequest,
+    responseObserver: StreamObserver<GetRemoteNameResponse>
+  ) {
+    grpcUnary(scope, responseObserver) {
+      val device =
+        if (request.hasConnection()) {
+          request.connection.toBluetoothDevice(bluetoothAdapter)
+        } else {
+          request.address.toBluetoothDevice(bluetoothAdapter)
+        }
+      val deviceName = device.name
+      if (deviceName == null) {
+        GetRemoteNameResponse.newBuilder().setRemoteNotFound(Empty.getDefaultInstance()).build()
+      } else {
+        GetRemoteNameResponse.newBuilder().setName(deviceName).build()
+      }
+    }
+  }
+}
diff --git a/android/pandora/server/src/com/android/pandora/L2cap.kt b/android/pandora/server/src/com/android/pandora/L2cap.kt
new file mode 100644
index 0000000..a5d6e10
--- /dev/null
+++ b/android/pandora/server/src/com/android/pandora/L2cap.kt
@@ -0,0 +1,175 @@
+package com.android.pandora
+
+import android.bluetooth.BluetoothManager
+import android.bluetooth.BluetoothServerSocket
+import android.bluetooth.BluetoothSocket
+import android.content.Context
+import android.util.Log
+import com.google.protobuf.ByteString
+import io.grpc.stub.StreamObserver
+import java.io.IOException
+import java.io.InputStream
+import java.io.OutputStream
+import kotlinx.coroutines.CoroutineScope
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.cancel
+import kotlinx.coroutines.withContext
+import pandora.HostProto.Connection
+import pandora.L2CAPGrpc.L2CAPImplBase
+import pandora.L2capProto.AcceptL2CAPChannelRequest
+import pandora.L2capProto.AcceptL2CAPChannelResponse
+import pandora.L2capProto.CreateLECreditBasedChannelRequest
+import pandora.L2capProto.CreateLECreditBasedChannelResponse
+import pandora.L2capProto.ListenL2CAPChannelRequest
+import pandora.L2capProto.ListenL2CAPChannelResponse
+import pandora.L2capProto.ReceiveDataRequest
+import pandora.L2capProto.ReceiveDataResponse
+import pandora.L2capProto.SendDataRequest
+import pandora.L2capProto.SendDataResponse
+
+@kotlinx.coroutines.ExperimentalCoroutinesApi
+class L2cap(val context: Context) : L2CAPImplBase() {
+  private val TAG = "PandoraL2cap"
+  private val scope: CoroutineScope
+  private val BLUETOOTH_SERVER_SOCKET_TIMEOUT: Int = 10000
+  private val BUFFER_SIZE = 512
+
+  private val bluetoothManager =
+    context.getSystemService(Context.BLUETOOTH_SERVICE) as BluetoothManager
+  private val bluetoothAdapter = bluetoothManager.adapter
+  private var connectionInStreamMap: HashMap<Connection, InputStream> = hashMapOf()
+  private var connectionOutStreamMap: HashMap<Connection, OutputStream> = hashMapOf()
+  private var connectionServerSocketMap: HashMap<Connection, BluetoothServerSocket> = hashMapOf()
+
+  init {
+    // Init the CoroutineScope
+    scope = CoroutineScope(Dispatchers.Default)
+  }
+
+  fun deinit() {
+    // Deinit the CoroutineScope
+    scope.cancel()
+  }
+
+  suspend fun receive(inStream: InputStream): ByteArray {
+    return withContext(Dispatchers.IO) {
+      val buf = ByteArray(BUFFER_SIZE)
+      inStream.read(buf, 0, BUFFER_SIZE) // blocking
+      Log.i(TAG, "receive: $buf")
+      buf
+    }
+  }
+
+  /** Open a BluetoothServerSocket to accept connections */
+  override fun listenL2CAPChannel(
+    request: ListenL2CAPChannelRequest,
+    responseObserver: StreamObserver<ListenL2CAPChannelResponse>,
+  ) {
+    grpcUnary(scope, responseObserver) {
+      Log.i(TAG, "listenL2CAPChannel: secure=${request.secure}")
+      val connection = request.connection
+      val bluetoothServerSocket =
+        if (request.secure) {
+          bluetoothAdapter.listenUsingL2capChannel()
+        } else {
+          bluetoothAdapter.listenUsingInsecureL2capChannel()
+        }
+      connectionServerSocketMap[connection] = bluetoothServerSocket
+      ListenL2CAPChannelResponse.newBuilder().build()
+    }
+  }
+
+  override fun acceptL2CAPChannel(
+    request: AcceptL2CAPChannelRequest,
+    responseObserver: StreamObserver<AcceptL2CAPChannelResponse>,
+  ) {
+    grpcUnary(scope, responseObserver) {
+      Log.i(TAG, "acceptL2CAPChannel")
+
+      val connection = request.connection
+      val bluetoothServerSocket = connectionServerSocketMap[connection]
+      try {
+        val bluetoothSocket = bluetoothServerSocket!!.accept(BLUETOOTH_SERVER_SOCKET_TIMEOUT)
+        connectionInStreamMap[connection] = bluetoothSocket.getInputStream()!!
+        connectionOutStreamMap[connection] = bluetoothSocket.getOutputStream()!!
+      } catch (e: IOException) {
+        Log.e(TAG, "bluetoothServerSocket not accepted", e)
+        return@grpcUnary AcceptL2CAPChannelResponse.newBuilder().build()
+      }
+
+      AcceptL2CAPChannelResponse.newBuilder().build()
+    }
+  }
+
+  /** Set device to send LE based connection request */
+  override fun createLECreditBasedChannel(
+    request: CreateLECreditBasedChannelRequest,
+    responseObserver: StreamObserver<CreateLECreditBasedChannelResponse>,
+  ) {
+    // Creates a gRPC coroutine in a given coroutine scope which executes a given suspended function
+    // returning a gRPC response and sends it on a given gRPC stream observer.
+    grpcUnary(scope, responseObserver) {
+      Log.i(TAG, "createLECreditBasedChannel: secure=${request.secure}, psm=${request.psm}")
+      val connection = request.connection
+      val device = request.connection.toBluetoothDevice(bluetoothAdapter)
+      val psm = request.psm
+
+      try {
+        val bluetoothSocket =
+          if (request.secure) {
+            device.createL2capChannel(psm)
+          } else {
+            device.createInsecureL2capChannel(psm)
+          }
+        bluetoothSocket.connect()
+        connectionInStreamMap[connection] = bluetoothSocket.getInputStream()!!
+        connectionOutStreamMap[connection] = bluetoothSocket.getOutputStream()!!
+      } catch (e: IOException) {
+        Log.d(TAG, "bluetoothSocket not connected: $e")
+        throw e
+      }
+
+      // Response sent to client
+      CreateLECreditBasedChannelResponse.newBuilder().build()
+    }
+  }
+
+  /** send data packet */
+  override fun sendData(
+    request: SendDataRequest,
+    responseObserver: StreamObserver<SendDataResponse>,
+  ) {
+    grpcUnary(scope, responseObserver) {
+      Log.i(TAG, "sendDataPacket: data=${request.data}")
+      val buffer = request.data!!.toByteArray()
+      val connection = request.connection
+      val outputStream = connectionOutStreamMap[connection]!!
+
+      withContext(Dispatchers.IO) {
+        try {
+          outputStream.write(buffer)
+          outputStream.flush()
+        } catch (e: IOException) {
+          Log.e(TAG, "Exception during writing to sendDataPacket output stream", e)
+        }
+      }
+
+      // Response sent to client
+      SendDataResponse.newBuilder().build()
+    }
+  }
+
+  override fun receiveData(
+    request: ReceiveDataRequest,
+    responseObserver: StreamObserver<ReceiveDataResponse>,
+  ) {
+    grpcUnary(scope, responseObserver) {
+      Log.i(TAG, "receiveData")
+      val connection = request.connection
+      val inputStream = connectionInStreamMap[connection]!!
+      val buf = receive(inputStream)
+
+      ReceiveDataResponse.newBuilder().setData(ByteString.copyFrom(buf)).build()
+    }
+  }
+}
diff --git a/android/pandora/server/src/com/android/pandora/Main.kt b/android/pandora/server/src/com/android/pandora/Main.kt
new file mode 100644
index 0000000..5f34a12
--- /dev/null
+++ b/android/pandora/server/src/com/android/pandora/Main.kt
@@ -0,0 +1,60 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.pandora
+
+import android.content.Context
+import android.os.Bundle
+import android.os.Debug
+import android.util.Log
+import androidx.test.platform.app.InstrumentationRegistry
+import androidx.test.core.app.ApplicationProvider.getApplicationContext
+import androidx.test.runner.MonitoringInstrumentation
+
+@kotlinx.coroutines.ExperimentalCoroutinesApi
+class Main : MonitoringInstrumentation() {
+
+  private val TAG = "PandoraMain"
+
+  override fun onCreate(arguments: Bundle) {
+    super.onCreate(arguments)
+
+    // Activate debugger.
+    if (arguments.getString("debug").toBoolean()) {
+      Log.i(TAG, "Waiting for debugger to connect...")
+      Debug.waitForDebugger()
+      Log.i(TAG, "Debugger connected")
+    }
+
+    // Start instrumentation thread.
+    start()
+  }
+
+  override fun onStart() {
+    super.onStart()
+
+    val context: Context = getApplicationContext()
+    val uiAutomation = InstrumentationRegistry.getInstrumentation().getUiAutomation()
+    // Adopt all the permissions of the shell
+    uiAutomation.adoptShellPermissionIdentity()
+
+    while (true) {
+      val server = Server(context)
+      server.awaitTermination()
+      server.deinit()
+    }
+  }
+}
diff --git a/android/pandora/server/src/com/android/pandora/MediaPlayer.kt b/android/pandora/server/src/com/android/pandora/MediaPlayer.kt
new file mode 100644
index 0000000..7942a3b
--- /dev/null
+++ b/android/pandora/server/src/com/android/pandora/MediaPlayer.kt
@@ -0,0 +1,104 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.pandora
+
+import android.content.Context
+import android.content.Intent
+import android.media.*
+import com.google.protobuf.Empty
+import io.grpc.stub.StreamObserver
+import kotlinx.coroutines.CoroutineScope
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.cancel
+import pandora.MediaPlayerGrpc.MediaPlayerImplBase
+import pandora.MediaPlayerProto.*
+
+@kotlinx.coroutines.ExperimentalCoroutinesApi
+class MediaPlayer(val context: Context) : MediaPlayerImplBase() {
+  private val TAG = "PandoraMediaPlayer"
+
+  private val scope: CoroutineScope
+
+  init {
+    // Init the CoroutineScope
+    scope = CoroutineScope(Dispatchers.Default)
+    context.startService(Intent(context, MediaPlayerBrowserService::class.java))
+  }
+
+  override fun play(request: Empty, responseObserver: StreamObserver<Empty>) {
+    grpcUnary<Empty>(scope, responseObserver) {
+      MediaPlayerBrowserService.instance.play()
+      Empty.getDefaultInstance()
+    }
+  }
+
+  override fun stop(request: Empty, responseObserver: StreamObserver<Empty>) {
+    grpcUnary<Empty>(scope, responseObserver) {
+      MediaPlayerBrowserService.instance.stop()
+      Empty.getDefaultInstance()
+    }
+  }
+
+  override fun pause(request: Empty, responseObserver: StreamObserver<Empty>) {
+    grpcUnary<Empty>(scope, responseObserver) {
+      MediaPlayerBrowserService.instance.pause()
+      Empty.getDefaultInstance()
+    }
+  }
+
+  override fun rewind(request: Empty, responseObserver: StreamObserver<Empty>) {
+    grpcUnary<Empty>(scope, responseObserver) {
+      MediaPlayerBrowserService.instance.rewind()
+      Empty.getDefaultInstance()
+    }
+  }
+
+  override fun fastForward(request: Empty, responseObserver: StreamObserver<Empty>) {
+    grpcUnary<Empty>(scope, responseObserver) {
+      MediaPlayerBrowserService.instance.fastForward()
+      Empty.getDefaultInstance()
+    }
+  }
+
+  override fun forward(request: Empty, responseObserver: StreamObserver<Empty>) {
+    grpcUnary<Empty>(scope, responseObserver) {
+      MediaPlayerBrowserService.instance.forward()
+      Empty.getDefaultInstance()
+    }
+  }
+
+  override fun backward(request: Empty, responseObserver: StreamObserver<Empty>) {
+    grpcUnary<Empty>(scope, responseObserver) {
+      MediaPlayerBrowserService.instance.backward()
+      Empty.getDefaultInstance()
+    }
+  }
+
+  override fun setLargeMetadata(request: Empty, responseObserver: StreamObserver<Empty>) {
+    grpcUnary<Empty>(scope, responseObserver) {
+      MediaPlayerBrowserService.instance.setLargeMetadata()
+      Empty.getDefaultInstance()
+    }
+  }
+
+  fun deinit() {
+    // Deinit the CoroutineScope
+    scope.cancel()
+    // Stop service
+    context.stopService(Intent(context, MediaPlayerBrowserService::class.java))
+  }
+}
diff --git a/android/pandora/server/src/com/android/pandora/MediaPlayerBrowserService.kt b/android/pandora/server/src/com/android/pandora/MediaPlayerBrowserService.kt
new file mode 100644
index 0000000..e8a783d
--- /dev/null
+++ b/android/pandora/server/src/com/android/pandora/MediaPlayerBrowserService.kt
@@ -0,0 +1,248 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.pandora
+
+import android.content.Intent
+import android.media.*
+import android.media.browse.MediaBrowser.MediaItem
+import android.media.session.*
+import android.os.Bundle
+import android.service.media.MediaBrowserService
+import android.service.media.MediaBrowserService.BrowserRoot
+import android.util.Log
+
+/* MediaBrowserService to handle MediaButton and Browsing */
+class MediaPlayerBrowserService : MediaBrowserService() {
+  private val TAG = "PandoraMediaPlayerBrowserService"
+
+  private lateinit var mediaSession: MediaSession
+  private lateinit var playbackStateBuilder: PlaybackState.Builder
+  private val mediaIdToChildren = mutableMapOf<String, MutableList<MediaItem>>()
+  private var metadataItems = mutableMapOf<String, MediaMetadata>()
+  private var queue = mutableListOf<MediaSession.QueueItem>()
+  private var currentTrack = -1
+
+  override fun onCreate() {
+    super.onCreate()
+    setupMediaSession()
+    initBrowseFolderList()
+    instance = this
+  }
+
+  fun deinit() {
+    // Releasing MediaSession instance
+    mediaSession.setActive(false)
+    mediaSession.release()
+  }
+
+  private fun setupMediaSession() {
+    mediaSession = MediaSession(this, "MediaSession")
+
+    mediaSession.setFlags(
+      MediaSession.FLAG_HANDLES_MEDIA_BUTTONS or MediaSession.FLAG_HANDLES_TRANSPORT_CONTROLS
+    )
+    mediaSession.setCallback(mSessionCallback)
+    playbackStateBuilder =
+      PlaybackState.Builder()
+        .setState(PlaybackState.STATE_NONE, 0, 1.0f)
+        .setActions(getAvailableActions())
+    mediaSession.setPlaybackState(playbackStateBuilder.build())
+    mediaSession.setMetadata(null)
+    mediaSession.setQueue(queue)
+    mediaSession.setQueueTitle(NOW_PLAYING_PREFIX)
+    mediaSession.isActive = true
+    sessionToken = mediaSession.sessionToken
+  }
+
+  private fun getAvailableActions(): Long =
+    PlaybackState.ACTION_SKIP_TO_PREVIOUS or
+      PlaybackState.ACTION_SKIP_TO_NEXT or
+      PlaybackState.ACTION_FAST_FORWARD or
+      PlaybackState.ACTION_REWIND or
+      PlaybackState.ACTION_PLAY or
+      PlaybackState.ACTION_STOP or
+      PlaybackState.ACTION_PAUSE
+
+  private fun setPlaybackState(state: Int) {
+    playbackStateBuilder.setState(state, 0, 1.0f)
+    mediaSession.setPlaybackState(playbackStateBuilder.build())
+  }
+
+  fun play() {
+    if (currentTrack == -1) {
+      currentTrack = QUEUE_START_INDEX
+      initQueue()
+      mediaSession.setQueue(queue)
+    }
+    setPlaybackState(PlaybackState.STATE_PLAYING)
+    mediaSession.setMetadata(metadataItems.get("" + currentTrack))
+  }
+
+  fun stop() {
+    setPlaybackState(PlaybackState.STATE_STOPPED)
+    mediaSession.setMetadata(null)
+  }
+
+  fun pause() {
+    setPlaybackState(PlaybackState.STATE_PAUSED)
+  }
+
+  fun rewind() {
+    setPlaybackState(PlaybackState.STATE_REWINDING)
+  }
+
+  fun fastForward() {
+    setPlaybackState(PlaybackState.STATE_FAST_FORWARDING)
+  }
+
+  fun forward() {
+    if (currentTrack == QUEUE_SIZE) currentTrack = QUEUE_START_INDEX else currentTrack += 1
+    setPlaybackState(PlaybackState.STATE_SKIPPING_TO_NEXT)
+    mediaSession.setMetadata(metadataItems.get("" + currentTrack))
+  }
+
+  fun backward() {
+    if (currentTrack == QUEUE_START_INDEX) currentTrack = QUEUE_SIZE else currentTrack -= 1
+    setPlaybackState(PlaybackState.STATE_SKIPPING_TO_PREVIOUS)
+    mediaSession.setMetadata(metadataItems.get("" + currentTrack))
+  }
+
+  fun setLargeMetadata() {
+    mediaSession.setMetadata(
+      MediaMetadata.Builder()
+        .putString(MediaMetadata.METADATA_KEY_MEDIA_ID, "MEDIA_ID")
+        .putString(MediaMetadata.METADATA_KEY_TITLE, generateAlphanumericString(512))
+        .putString(MediaMetadata.METADATA_KEY_ARTIST, generateAlphanumericString(512))
+        .build()
+    )
+  }
+
+  private val mSessionCallback: MediaSession.Callback =
+    object : MediaSession.Callback() {
+      override fun onPlay() {
+        Log.i(TAG, "onPlay")
+        play()
+      }
+
+      override fun onPause() {
+        Log.i(TAG, "onPause")
+        pause()
+      }
+
+      override fun onSkipToPrevious() {
+        Log.i(TAG, "onSkipToPrevious")
+        // TODO : Need to handle to play previous audio in the list
+      }
+
+      override fun onSkipToNext() {
+        Log.i(TAG, "onSkipToNext")
+        // TODO : Need to handle to play next audio in the list
+      }
+
+      override fun onMediaButtonEvent(mediaButtonEvent: Intent): Boolean {
+        Log.i(TAG, "MediaSessionCallback——》onMediaButtonEvent $mediaButtonEvent")
+        return super.onMediaButtonEvent(mediaButtonEvent)
+      }
+    }
+
+  override fun onGetRoot(p0: String, clientUid: Int, rootHints: Bundle?): BrowserRoot? {
+    Log.i(TAG, "onGetRoot")
+    return BrowserRoot(ROOT, null)
+  }
+
+  override fun onLoadChildren(parentId: String, result: Result<MutableList<MediaItem>>) {
+    Log.i(TAG, "onLoadChildren")
+    if (parentId == ROOT) {
+      val map = mediaIdToChildren[ROOT]
+      Log.i(TAG, "onloadchildren $map")
+      result.sendResult(map)
+    } else if (parentId == NOW_PLAYING_PREFIX) {
+      result.sendResult(mediaIdToChildren[NOW_PLAYING_PREFIX])
+    } else {
+      Log.i(TAG, "onloadchildren inside else")
+      result.sendResult(null)
+    }
+  }
+
+  private fun initMediaItems() {
+    var mediaItems = mutableListOf<MediaItem>()
+    for (item in QUEUE_START_INDEX..QUEUE_SIZE) {
+      val metaData: MediaMetadata =
+        MediaMetadata.Builder()
+          .putString(MediaMetadata.METADATA_KEY_MEDIA_ID, NOW_PLAYING_PREFIX + item)
+          .putString(MediaMetadata.METADATA_KEY_TITLE, "Title$item")
+          .putString(MediaMetadata.METADATA_KEY_ARTIST, "Artist$item")
+          .putLong(MediaMetadata.METADATA_KEY_TRACK_NUMBER, item.toLong())
+          .putLong(MediaMetadata.METADATA_KEY_NUM_TRACKS, QUEUE_SIZE.toLong())
+          .build()
+      val mediaItem = MediaItem(metaData.description, MediaItem.FLAG_PLAYABLE)
+      mediaItems.add(mediaItem)
+      metadataItems.put("" + item, metaData)
+    }
+    mediaIdToChildren[NOW_PLAYING_PREFIX] = mediaItems
+  }
+
+  private fun initQueue() {
+    for ((key, value) in metadataItems.entries) {
+      val mediaItem = MediaItem(value.description, MediaItem.FLAG_PLAYABLE)
+      queue.add(MediaSession.QueueItem(mediaItem.description, key.toLong()))
+    }
+  }
+
+  private fun initBrowseFolderList() {
+    var rootList = mediaIdToChildren[ROOT] ?: mutableListOf()
+
+    val emptyFolderMetaData =
+      MediaMetadata.Builder()
+        .putString(MediaMetadata.METADATA_KEY_MEDIA_ID, EMPTY_FOLDER)
+        .putString(MediaMetadata.METADATA_KEY_TITLE, EMPTY_FOLDER)
+        .putLong(
+          MediaMetadata.METADATA_KEY_BT_FOLDER_TYPE,
+          MediaDescription.BT_FOLDER_TYPE_PLAYLISTS
+        )
+        .build()
+    val emptyFolderMediaItem = MediaItem(emptyFolderMetaData.description, MediaItem.FLAG_BROWSABLE)
+
+    val playlistMetaData =
+      MediaMetadata.Builder()
+        .apply {
+          putString(MediaMetadata.METADATA_KEY_MEDIA_ID, NOW_PLAYING_PREFIX)
+          putString(MediaMetadata.METADATA_KEY_TITLE, NOW_PLAYING_PREFIX)
+          putLong(
+            MediaMetadata.METADATA_KEY_BT_FOLDER_TYPE,
+            MediaDescription.BT_FOLDER_TYPE_PLAYLISTS
+          )
+        }
+        .build()
+
+    val playlistsMediaItem = MediaItem(playlistMetaData.description, MediaItem.FLAG_BROWSABLE)
+
+    rootList += emptyFolderMediaItem
+    rootList += playlistsMediaItem
+    mediaIdToChildren[ROOT] = rootList
+    initMediaItems()
+  }
+
+  companion object {
+    lateinit var instance: MediaPlayerBrowserService
+    const val ROOT = "__ROOT__"
+    const val EMPTY_FOLDER = "@empty@"
+    const val NOW_PLAYING_PREFIX = "NowPlayingId"
+    const val QUEUE_START_INDEX = 1
+    const val QUEUE_SIZE = 6
+  }
+}
diff --git a/android/pandora/server/src/com/android/pandora/Pbap.kt b/android/pandora/server/src/com/android/pandora/Pbap.kt
new file mode 100644
index 0000000..bdc21a7
--- /dev/null
+++ b/android/pandora/server/src/com/android/pandora/Pbap.kt
@@ -0,0 +1,148 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.pandora
+
+import android.bluetooth.BluetoothManager
+import android.content.ContentProviderOperation
+import android.content.Context
+import android.provider.ContactsContract
+import android.provider.ContactsContract.*
+import android.provider.ContactsContract.CommonDataKinds.*
+import android.provider.CallLog
+import android.provider.CallLog.Calls.*
+import android.content.ContentValues
+import android.content.ContentUris
+import android.net.Uri
+import kotlinx.coroutines.CoroutineScope
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.cancel
+import pandora.PBAPGrpc.PBAPImplBase
+import pandora.PbapProto.*
+
+@kotlinx.coroutines.ExperimentalCoroutinesApi
+class Pbap(val context: Context) : PBAPImplBase() {
+  private val TAG = "PandoraPbap"
+
+  private val scope: CoroutineScope
+  private val allowedDigits = ('0'..'9')
+
+  private val bluetoothManager = context.getSystemService(BluetoothManager::class.java)!!
+  private val bluetoothAdapter = bluetoothManager.adapter
+
+  init {
+    // Init the CoroutineScope
+    scope = CoroutineScope(Dispatchers.Default)
+    preparePBAPDatabase()
+  }
+
+  private fun preparePBAPDatabase() {
+    prepareContactList()
+    prepareCallLog()
+  }
+
+  private fun prepareContactList() {
+    var cursor =
+      context
+        .getContentResolver()
+        .query(ContactsContract.Contacts.CONTENT_URI, null, null, null, null)
+
+    if (cursor.getCount() > 0) return // return if contacts are present
+
+    for (item in 1..CONTACT_LIST_SIZE) {
+      addContact(item)
+    }
+  }
+
+  private fun prepareCallLog() {
+    // Delete existing call log
+    context.getContentResolver().delete(CallLog.Calls.CONTENT_URI, null, null);
+
+    addCallLogItem(MISSED_TYPE)
+    addCallLogItem(OUTGOING_TYPE)
+  }
+
+  private fun addCallLogItem(callType: Int) {
+    var contentValues = ContentValues().apply {
+      put(CallLog.Calls.NUMBER, generatePhoneNumber(PHONE_NUM_LENGTH))
+      put(CallLog.Calls.DATE, System.currentTimeMillis())
+      put(CallLog.Calls.DURATION, if(callType == MISSED_TYPE) 0 else 30)
+      put(CallLog.Calls.TYPE, callType)
+      put(CallLog.Calls.NEW, 1)
+    }
+    context.getContentResolver().insert(CallLog.Calls.CONTENT_URI, contentValues)
+  }
+
+  private fun addContact(contactIndex: Int) {
+    val operations = arrayListOf<ContentProviderOperation>()
+
+    val displayName = String.format(DEFAULT_DISPLAY_NAME, contactIndex)
+    val phoneNumber = generatePhoneNumber(PHONE_NUM_LENGTH)
+    val emailID = String.format(DEFAULT_EMAIL_ID, contactIndex)
+
+    val rawContactInsertIndex = operations.size
+    operations.add(
+      ContentProviderOperation.newInsert(RawContacts.CONTENT_URI)
+        .withValue(RawContacts.ACCOUNT_TYPE, null)
+        .withValue(RawContacts.ACCOUNT_NAME, null)
+        .build()
+    )
+
+    operations.add(
+      ContentProviderOperation.newInsert(Data.CONTENT_URI)
+        .withValueBackReference(Data.RAW_CONTACT_ID, rawContactInsertIndex)
+        .withValue(Data.MIMETYPE, StructuredName.CONTENT_ITEM_TYPE)
+        .withValue(StructuredName.DISPLAY_NAME, displayName)
+        .build()
+    )
+
+    operations.add(
+      ContentProviderOperation.newInsert(Data.CONTENT_URI)
+        .withValueBackReference(Data.RAW_CONTACT_ID, rawContactInsertIndex)
+        .withValue(Data.MIMETYPE, Phone.CONTENT_ITEM_TYPE)
+        .withValue(Phone.NUMBER, phoneNumber)
+        .withValue(Phone.TYPE, Phone.TYPE_MOBILE)
+        .build()
+    )
+
+    operations.add(
+      ContentProviderOperation.newInsert(Data.CONTENT_URI)
+        .withValueBackReference(Data.RAW_CONTACT_ID, rawContactInsertIndex)
+        .withValue(Data.MIMETYPE, Email.CONTENT_ITEM_TYPE)
+        .withValue(Email.DATA, emailID)
+        .withValue(Email.TYPE, Email.TYPE_MOBILE)
+        .build()
+    )
+
+    context.getContentResolver().applyBatch(ContactsContract.AUTHORITY, operations)
+  }
+
+  private fun generatePhoneNumber(length: Int): String {
+    return buildString { repeat(length) { append(allowedDigits.random()) } }
+  }
+
+  fun deinit() {
+    // Deinit the CoroutineScope
+    scope.cancel()
+  }
+
+  companion object {
+    const val DEFAULT_DISPLAY_NAME = "Contact Name %d"
+    const val DEFAULT_EMAIL_ID = "user%d@example.com"
+    const val CONTACT_LIST_SIZE = 100
+    const val PHONE_NUM_LENGTH = 10
+  }
+}
diff --git a/android/pandora/server/src/com/android/pandora/Rfcomm.kt b/android/pandora/server/src/com/android/pandora/Rfcomm.kt
new file mode 100644
index 0000000..29da322
--- /dev/null
+++ b/android/pandora/server/src/com/android/pandora/Rfcomm.kt
@@ -0,0 +1,192 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.pandora
+
+import android.bluetooth.BluetoothManager
+import android.bluetooth.BluetoothServerSocket
+import android.bluetooth.BluetoothSocket
+import android.content.Context
+import android.util.Log
+import com.google.protobuf.ByteString
+import io.grpc.Status
+import io.grpc.stub.StreamObserver
+import java.io.IOException
+import java.io.InputStream
+import java.io.OutputStream
+import java.util.UUID
+import kotlinx.coroutines.CoroutineScope
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.cancel
+import kotlinx.coroutines.withContext
+import pandora.RFCOMMGrpc.RFCOMMImplBase
+import pandora.RfcommProto.*
+
+
+@kotlinx.coroutines.ExperimentalCoroutinesApi
+class Rfcomm(val context: Context) : RFCOMMImplBase() {
+
+  private val _bufferSize = 512
+
+  private val TAG = "PandoraRfcomm"
+
+  private val scope: CoroutineScope = CoroutineScope(Dispatchers.Default)
+
+  private val bluetoothManager = context.getSystemService(BluetoothManager::class.java)!!
+  private val bluetoothAdapter = bluetoothManager.adapter
+
+  private var currentCookie = 0x12FC0 // Non-zero cookie RFCo(mm)
+
+  data class Connection(val connection: BluetoothSocket, val inputStream: InputStream, val outputStream: OutputStream)
+
+  private var serverMap: HashMap<Int,BluetoothServerSocket> = hashMapOf()
+  private var connectionMap: HashMap<Int,Connection> = hashMapOf()
+
+  fun deinit() {
+    scope.cancel()
+  }
+
+  override fun connectToServer(
+    request: ConnectionRequest,
+    responseObserver: StreamObserver<ConnectionResponse>,
+  ) {
+    grpcUnary(scope, responseObserver) {
+      Log.i(TAG, "RFCOMM: connect: request=${request.address}")
+      val device = request.address.toBluetoothDevice(bluetoothAdapter)
+      val clientSocket = device.createInsecureRfcommSocketToServiceRecord(UUID.fromString(request.uuid))
+      try {
+        clientSocket.connect()
+      } catch(e: IOException) {
+        Log.e(TAG, "connect threw ${e}.")
+        throw Status.UNKNOWN.asException()
+      }
+      Log.i(TAG, "connected.")
+      val connectedClientSocket = currentCookie++
+      // Get the BluetoothSocket input and output streams
+      try {
+        val tmpIn = clientSocket.inputStream!!
+        val tmpOut = clientSocket.outputStream!!
+        connectionMap[connectedClientSocket] = Connection(clientSocket, tmpIn, tmpOut)
+      } catch (e: IOException) {
+        Log.e(TAG, "temp sockets not created", e)
+      }
+
+      ConnectionResponse.newBuilder()
+        .setConnection(RfcommConnection.newBuilder().setId(connectedClientSocket).build())
+        .build()
+    }
+  }
+
+  override fun disconnect(
+    request: DisconnectionRequest,
+    responseObserver: StreamObserver<DisconnectionResponse>,
+  ) {
+    grpcUnary(scope, responseObserver) {
+      val id = request.connection.id
+      Log.i(TAG, "RFCOMM: disconnect: request=${id}")
+      if (connectionMap.containsKey(id)) {
+        connectionMap[id]!!.connection.close()
+        connectionMap.remove(id)
+      } else {
+        throw Status.UNKNOWN.asException()
+      }
+      DisconnectionResponse.newBuilder().build()
+    }
+  }
+
+  override fun startServer(
+    request: ServerOptions,
+    responseObserver: StreamObserver<StartServerResponse>,
+  ) {
+    grpcUnary(scope, responseObserver) {
+      Log.i(TAG, "startServer")
+      val serverSocket = bluetoothAdapter.listenUsingInsecureRfcommWithServiceRecord(request.name, UUID.fromString(request.uuid))
+      val serverSocketCookie = currentCookie++
+      serverMap[serverSocketCookie] = serverSocket
+
+      StartServerResponse.newBuilder().setServer(
+      ServerId.newBuilder().setId(serverSocketCookie).build()).build()
+    }
+  }
+
+  override fun acceptConnection(
+    request: AcceptConnectionRequest,
+    responseObserver: StreamObserver<AcceptConnectionResponse>,
+  ) {
+    grpcUnary(scope, responseObserver) {
+      Log.i(TAG, "accepting: serverSocket= $(request.id)")
+      val acceptedSocketCookie = currentCookie++
+      try {
+        val acceptedSocket : BluetoothSocket = serverMap[request.server.id]!!.accept(2000)
+        Log.i(TAG, "accepted: acceptedSocket= $acceptedSocket")
+        val tmpIn = acceptedSocket.inputStream!!
+        val tmpOut = acceptedSocket.outputStream!!
+        connectionMap[acceptedSocketCookie] = Connection(acceptedSocket, tmpIn, tmpOut)
+      } catch (e: IOException) {
+        Log.e(TAG, "Caught an IOException while trying to accept and create streams.")
+      }
+
+      Log.i(TAG, "after accept")
+      AcceptConnectionResponse.newBuilder().setConnection(
+      RfcommConnection.newBuilder().setId(acceptedSocketCookie).build()
+      ).build()
+    }
+  }
+
+  override fun send(
+    request: TxRequest,
+    responseObserver: StreamObserver<TxResponse>,
+  ) {
+    grpcUnary(scope, responseObserver) {
+      if (request.data.isEmpty) {
+        throw Status.UNKNOWN.asException()
+      }
+      val data = request.data!!.toByteArray()
+
+      val socketOut = connectionMap[request.connection.id]!!.outputStream
+      withContext(Dispatchers.IO) {
+        try {
+          socketOut.write(data)
+          socketOut.flush()
+        } catch (e: IOException) {
+          Log.e(TAG, "Exception while writing output stream", e)
+        }
+      }
+      Log.i(TAG, "Sent data")
+      TxResponse.newBuilder().build()
+    }
+  }
+
+  override fun receive(
+    request: RxRequest,
+    responseObserver: StreamObserver<RxResponse>,
+  ) {
+    grpcUnary(scope, responseObserver) {
+      val data = ByteArray(_bufferSize)
+
+      val socketIn = connectionMap[request.connection.id]!!.inputStream
+      withContext(Dispatchers.IO) {
+        try {
+          socketIn.read(data)
+        } catch (e: IOException) {
+          Log.e(TAG, "Exception while reading from input stream", e)
+        }
+      }
+      Log.i(TAG, "Read data")
+      RxResponse.newBuilder().setData(ByteString.copyFrom(data)).build()
+    }
+  }
+}
diff --git a/android/pandora/server/src/com/android/pandora/Security.kt b/android/pandora/server/src/com/android/pandora/Security.kt
new file mode 100644
index 0000000..010f107
--- /dev/null
+++ b/android/pandora/server/src/com/android/pandora/Security.kt
@@ -0,0 +1,230 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.pandora
+
+import android.bluetooth.BluetoothAdapter
+import android.bluetooth.BluetoothDevice
+import android.bluetooth.BluetoothDevice.ACTION_PAIRING_REQUEST
+import android.bluetooth.BluetoothDevice.BOND_BONDED
+import android.bluetooth.BluetoothDevice.BOND_NONE
+import android.bluetooth.BluetoothDevice.DEVICE_TYPE_CLASSIC
+import android.bluetooth.BluetoothDevice.DEVICE_TYPE_LE
+import android.bluetooth.BluetoothDevice.EXTRA_PAIRING_VARIANT
+import android.bluetooth.BluetoothDevice.TRANSPORT_BREDR
+import android.bluetooth.BluetoothDevice.TRANSPORT_LE
+import android.bluetooth.BluetoothManager
+import android.content.Context
+import android.content.Intent
+import android.content.IntentFilter
+import android.util.Log
+import com.google.protobuf.ByteString
+import com.google.protobuf.Empty
+import io.grpc.Status
+import io.grpc.stub.StreamObserver
+import kotlinx.coroutines.CoroutineScope
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.cancel
+import kotlinx.coroutines.flow.Flow
+import kotlinx.coroutines.flow.SharingStarted
+import kotlinx.coroutines.flow.filter
+import kotlinx.coroutines.flow.first
+import kotlinx.coroutines.flow.launchIn
+import kotlinx.coroutines.flow.map
+import kotlinx.coroutines.flow.shareIn
+import pandora.HostProto.*
+import pandora.SecurityGrpc.SecurityImplBase
+import pandora.SecurityProto.*
+import pandora.SecurityProto.LESecurityLevel.LE_LEVEL1
+import pandora.SecurityProto.LESecurityLevel.LE_LEVEL2
+import pandora.SecurityProto.LESecurityLevel.LE_LEVEL3
+import pandora.SecurityProto.LESecurityLevel.LE_LEVEL4
+import pandora.SecurityProto.SecurityLevel.LEVEL0
+import pandora.SecurityProto.SecurityLevel.LEVEL1
+import pandora.SecurityProto.SecurityLevel.LEVEL2
+import pandora.SecurityProto.SecurityLevel.LEVEL3
+
+private const val TAG = "PandoraSecurity"
+
+@kotlinx.coroutines.ExperimentalCoroutinesApi
+class Security(private val context: Context) : SecurityImplBase() {
+
+  private val globalScope: CoroutineScope = CoroutineScope(Dispatchers.Default)
+  private val flow: Flow<Intent>
+
+  private val bluetoothManager = context.getSystemService(BluetoothManager::class.java)!!
+  private val bluetoothAdapter = bluetoothManager.adapter
+
+  var manuallyConfirm = false
+
+  init {
+    val intentFilter = IntentFilter()
+    intentFilter.addAction(BluetoothDevice.ACTION_PAIRING_REQUEST)
+    intentFilter.addAction(BluetoothDevice.ACTION_BOND_STATE_CHANGED)
+
+    flow = intentFlow(context, intentFilter).shareIn(globalScope, SharingStarted.Eagerly)
+  }
+
+  fun deinit() {
+    globalScope.cancel()
+  }
+
+  override fun secure(request: SecureRequest, responseObserver: StreamObserver<SecureResponse>) {
+    grpcUnary(globalScope, responseObserver) {
+      val bluetoothDevice = request.connection.toBluetoothDevice(bluetoothAdapter)
+      val transport = request.connection.transport
+      Log.i(TAG, "secure: $bluetoothDevice transport: $transport")
+      var reached =
+        when (transport) {
+          TRANSPORT_LE -> {
+            check(request.getLevelCase() == SecureRequest.LevelCase.LE);
+            val level = request.le
+            if (level == LE_LEVEL1) true
+            if (level == LE_LEVEL4) throw Status.UNKNOWN.asException()
+            false
+          }
+          TRANSPORT_BREDR -> {
+            check(request.getLevelCase() == SecureRequest.LevelCase.CLASSIC)
+            val level = request.classic
+            if (level == LEVEL0) true
+            if (level >= LEVEL3) throw Status.UNKNOWN.asException()
+            false
+          }
+          else -> throw Status.UNKNOWN.asException()
+        }
+      if (!reached) {
+        bluetoothDevice.createBond(transport)
+        val bondState =
+          flow
+            .filter { it.action == BluetoothDevice.ACTION_BOND_STATE_CHANGED }
+            .filter { it.getBluetoothDeviceExtra() == bluetoothDevice }
+            .map { it.getIntExtra(BluetoothDevice.EXTRA_BOND_STATE, BluetoothAdapter.ERROR) }
+            .filter { it == BOND_BONDED || it == BOND_NONE }
+            .first()
+        val isEncrypted = bluetoothDevice.isEncrypted()
+        reached =
+          when (transport) {
+            TRANSPORT_LE -> {
+              val level = request.le
+              when (level) {
+                LE_LEVEL2 -> isEncrypted
+                LE_LEVEL3 -> isEncrypted && bondState == BOND_BONDED
+                else -> throw Status.UNKNOWN.asException()
+              }
+            }
+            TRANSPORT_BREDR -> {
+              val level = request.classic
+              when (level) {
+                LEVEL1 -> !isEncrypted || bondState == BOND_BONDED
+                LEVEL2 -> isEncrypted && bondState == BOND_BONDED
+                else -> throw Status.UNKNOWN.asException()
+              }
+            }
+            else -> throw Status.UNKNOWN.asException()
+          }
+      }
+      val secureResponseBuilder = SecureResponse.newBuilder()
+      if (reached) secureResponseBuilder.setSuccess(Empty.getDefaultInstance())
+      else secureResponseBuilder.setNotReached(Empty.getDefaultInstance())
+      secureResponseBuilder.build()
+    }
+  }
+
+  override fun onPairing(
+    responseObserver: StreamObserver<PairingEvent>
+  ): StreamObserver<PairingEventAnswer> =
+    grpcBidirectionalStream(globalScope, responseObserver) {
+      Log.i(TAG, "OnPairing: Starting stream")
+      manuallyConfirm = true
+      it
+        .map { answer ->
+          Log.i(
+            TAG,
+            "OnPairing: Handling PairingEventAnswer ${answer.answerCase} for device ${answer.event.address}"
+          )
+          val device = answer.event.address.toBluetoothDevice(bluetoothAdapter)
+          when (answer.answerCase!!) {
+            PairingEventAnswer.AnswerCase.CONFIRM -> device.setPairingConfirmation(true)
+            PairingEventAnswer.AnswerCase.PASSKEY ->
+              device.setPin(answer.passkey.toString().toByteArray())
+            PairingEventAnswer.AnswerCase.PIN -> device.setPin(answer.pin.toByteArray())
+            PairingEventAnswer.AnswerCase.ANSWER_NOT_SET -> error("unexpected pairing answer type")
+          }
+        }
+        .launchIn(this)
+
+      flow
+        .filter { intent -> intent.action == ACTION_PAIRING_REQUEST }
+        .map { intent ->
+          val device = intent.getBluetoothDeviceExtra()
+          val variant = intent.getIntExtra(EXTRA_PAIRING_VARIANT, BluetoothDevice.ERROR)
+          Log.i(TAG, "OnPairing: Handling PairingEvent ${variant} for device ${device.address}")
+          val eventBuilder = PairingEvent.newBuilder().setAddress(device.toByteString())
+          when (variant) {
+            // SSP / LE Just Works
+            BluetoothDevice.PAIRING_VARIANT_CONSENT ->
+              eventBuilder.justWorks = Empty.getDefaultInstance()
+
+            // SSP / LE Numeric Comparison
+            BluetoothDevice.PAIRING_VARIANT_PASSKEY_CONFIRMATION ->
+              eventBuilder.numericComparison =
+                intent.getIntExtra(BluetoothDevice.EXTRA_PAIRING_KEY, BluetoothDevice.ERROR)
+            BluetoothDevice.PAIRING_VARIANT_DISPLAY_PASSKEY -> {
+              val passkey =
+                intent.getIntExtra(BluetoothDevice.EXTRA_PAIRING_KEY, BluetoothDevice.ERROR)
+              Log.i(TAG, "OnPairing: passkey=${passkey}")
+              eventBuilder.passkeyEntryNotification = passkey
+            }
+
+            // Out-Of-Band not currently supported
+            BluetoothDevice.PAIRING_VARIANT_OOB_CONSENT ->
+              error("Received OOB pairing confirmation (UNSUPPORTED)")
+
+            // Legacy PIN entry, or LE legacy passkey entry, depending on transport
+            BluetoothDevice.PAIRING_VARIANT_PIN ->
+              when (device.type) {
+                DEVICE_TYPE_CLASSIC -> eventBuilder.pinCodeRequest = Empty.getDefaultInstance()
+                DEVICE_TYPE_LE -> eventBuilder.passkeyEntryRequest = Empty.getDefaultInstance()
+                else ->
+                  error(
+                    "cannot determine pairing variant, since transport is unknown: ${device.type}"
+                  )
+              }
+            BluetoothDevice.PAIRING_VARIANT_PIN_16_DIGITS ->
+              eventBuilder.pinCodeRequest = Empty.getDefaultInstance()
+
+            // Legacy PIN entry or LE legacy passkey entry, except we just generate the PIN in
+            // the
+            // stack and display it to the user for convenience
+            BluetoothDevice.PAIRING_VARIANT_DISPLAY_PIN -> {
+              val passkey =
+                intent.getIntExtra(BluetoothDevice.EXTRA_PAIRING_KEY, BluetoothDevice.ERROR)
+              when (device.type) {
+                DEVICE_TYPE_CLASSIC ->
+                  eventBuilder.pinCodeNotification =
+                    ByteString.copyFrom(passkey.toString().toByteArray())
+                DEVICE_TYPE_LE -> eventBuilder.passkeyEntryNotification = passkey
+                else -> error("cannot determine pairing variant, since transport is unknown")
+              }
+            }
+            else -> {
+              error("Received unknown pairing variant $variant")
+            }
+          }
+          eventBuilder.build()
+        }
+    }
+}
diff --git a/android/pandora/server/src/com/android/pandora/SecurityStorage.kt b/android/pandora/server/src/com/android/pandora/SecurityStorage.kt
new file mode 100644
index 0000000..80be7a7
--- /dev/null
+++ b/android/pandora/server/src/com/android/pandora/SecurityStorage.kt
@@ -0,0 +1,104 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.pandora
+
+import android.bluetooth.BluetoothAdapter
+import android.bluetooth.BluetoothDevice
+import android.bluetooth.BluetoothDevice.BOND_BONDED
+import android.bluetooth.BluetoothDevice.BOND_NONE
+import android.bluetooth.BluetoothManager
+import android.content.Context
+import android.content.Intent
+import android.content.IntentFilter
+import android.util.Log
+import com.google.protobuf.BoolValue
+import com.google.protobuf.Empty
+import io.grpc.stub.StreamObserver
+import kotlinx.coroutines.CoroutineScope
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.async
+import kotlinx.coroutines.cancel
+import kotlinx.coroutines.flow.Flow
+import kotlinx.coroutines.flow.SharingStarted
+import kotlinx.coroutines.flow.filter
+import kotlinx.coroutines.flow.first
+import kotlinx.coroutines.flow.shareIn
+import pandora.HostProto.*
+import pandora.SecurityProto.*
+import pandora.SecurityStorageGrpc.SecurityStorageImplBase
+
+private const val TAG = "PandoraSecurityStorage"
+
+@kotlinx.coroutines.ExperimentalCoroutinesApi
+class SecurityStorage(private val context: Context) : SecurityStorageImplBase() {
+
+  private val globalScope: CoroutineScope = CoroutineScope(Dispatchers.Default)
+  private val flow: Flow<Intent>
+
+  private val bluetoothManager = context.getSystemService(BluetoothManager::class.java)!!
+  private val bluetoothAdapter = bluetoothManager.adapter
+
+  init {
+    val intentFilter = IntentFilter()
+    intentFilter.addAction(BluetoothDevice.ACTION_BOND_STATE_CHANGED)
+
+    flow = intentFlow(context, intentFilter).shareIn(globalScope, SharingStarted.Eagerly)
+  }
+
+  fun deinit() {
+    globalScope.cancel()
+  }
+
+  override fun isBonded(request: IsBondedRequest, responseObserver: StreamObserver<BoolValue>) {
+    grpcUnary(globalScope, responseObserver) {
+      check(request.getAddressCase() == IsBondedRequest.AddressCase.PUBLIC)
+      val bluetoothDevice = request.public.toBluetoothDevice(bluetoothAdapter)
+      Log.i(TAG, "isBonded: $bluetoothDevice")
+      val isBonded = bluetoothDevice.getBondState() == BluetoothDevice.BOND_BONDED
+      BoolValue.newBuilder().setValue(isBonded).build()
+    }
+  }
+
+  override fun deleteBond(request: DeleteBondRequest, responseObserver: StreamObserver<Empty>) {
+    grpcUnary(globalScope, responseObserver) {
+      check(request.getAddressCase() == DeleteBondRequest.AddressCase.PUBLIC)
+      val bluetoothDevice = request.public.toBluetoothDevice(bluetoothAdapter)
+      Log.i(TAG, "deleteBond: device=$bluetoothDevice")
+
+      val unbonded =
+        globalScope.async {
+          flow
+            .filter { it.action == BluetoothDevice.ACTION_BOND_STATE_CHANGED }
+            .filter { it.getBluetoothDeviceExtra() == bluetoothDevice }
+            .filter {
+              it.getIntExtra(BluetoothDevice.EXTRA_BOND_STATE, BluetoothAdapter.ERROR) ==
+                BluetoothDevice.BOND_NONE
+            }
+            .first()
+        }
+
+      if (bluetoothDevice.removeBond()) {
+        Log.i(TAG, "deleteBond: device=$bluetoothDevice - wait BOND_NONE intent")
+        unbonded.await()
+      } else {
+        Log.i(TAG, "deleteBond: device=$bluetoothDevice - Already unpaired")
+        unbonded.cancel()
+      }
+      Empty.getDefaultInstance()
+    }
+  }
+}
diff --git a/android/pandora/server/src/com/android/pandora/Server.kt b/android/pandora/server/src/com/android/pandora/Server.kt
new file mode 100644
index 0000000..7b17dd4
--- /dev/null
+++ b/android/pandora/server/src/com/android/pandora/Server.kt
@@ -0,0 +1,123 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.pandora
+
+import android.bluetooth.BluetoothManager
+import android.bluetooth.BluetoothProfile
+import android.content.Context
+import android.util.Log
+import io.grpc.Server as GrpcServer
+import io.grpc.netty.shaded.io.grpc.netty.NettyServerBuilder
+
+@kotlinx.coroutines.ExperimentalCoroutinesApi
+class Server(context: Context) {
+
+  private val TAG = "PandoraServer"
+  private val GRPC_PORT = 8999
+
+  private var host: Host
+  private var a2dp: A2dp? = null
+  private var a2dpSink: A2dpSink? = null
+  private var avrcp: Avrcp
+  private var gatt: Gatt
+  private var hfp: Hfp? = null
+  private var hfpHandsfree: HfpHandsfree? = null
+  private var hid: Hid
+  private var l2cap: L2cap
+  private var mediaplayer: MediaPlayer
+  private var pbap: Pbap
+  private var rfcomm: Rfcomm
+  private var security: Security
+  private var securityStorage: SecurityStorage
+  private var androidInternal: AndroidInternal
+  private var grpcServer: GrpcServer
+
+  init {
+    security = Security(context)
+    host = Host(context, security, this)
+    avrcp = Avrcp(context)
+    gatt = Gatt(context)
+    hid = Hid(context)
+    l2cap = L2cap(context)
+    mediaplayer = MediaPlayer(context)
+    pbap = Pbap(context)
+    rfcomm = Rfcomm(context)
+    securityStorage = SecurityStorage(context)
+    androidInternal = AndroidInternal(context)
+
+    val grpcServerBuilder =
+      NettyServerBuilder.forPort(GRPC_PORT)
+        .addService(host)
+        .addService(avrcp)
+        .addService(gatt)
+        .addService(hid)
+        .addService(l2cap)
+        .addService(mediaplayer)
+        .addService(pbap)
+        .addService(rfcomm)
+        .addService(security)
+        .addService(securityStorage)
+        .addService(androidInternal)
+
+    val bluetoothAdapter = context.getSystemService(BluetoothManager::class.java)!!.adapter
+    val is_a2dp_source = bluetoothAdapter.getSupportedProfiles().contains(BluetoothProfile.A2DP)
+    if (is_a2dp_source) {
+      a2dp = A2dp(context)
+      grpcServerBuilder.addService(a2dp!!)
+    } else {
+      a2dpSink = A2dpSink(context)
+      grpcServerBuilder.addService(a2dpSink!!)
+    }
+
+    val is_hfp_hf = bluetoothAdapter.getSupportedProfiles().contains(BluetoothProfile.HEADSET_CLIENT)
+    if (is_hfp_hf) {
+      hfpHandsfree = HfpHandsfree(context)
+      grpcServerBuilder.addService(hfpHandsfree!!)
+    } else {
+      hfp = Hfp(context)
+      grpcServerBuilder.addService(hfp!!)
+    }
+
+    grpcServer = grpcServerBuilder.build()
+
+    Log.d(TAG, "Starting Pandora Server")
+    grpcServer.start()
+    Log.d(TAG, "Pandora Server started at $GRPC_PORT")
+  }
+
+  fun shutdown() = grpcServer.shutdown()
+
+  fun awaitTermination() = grpcServer.awaitTermination()
+
+  fun deinit() {
+    host.deinit()
+    a2dp?.deinit()
+    a2dpSink?.deinit()
+    avrcp.deinit()
+    gatt.deinit()
+    hfp?.deinit()
+    hfpHandsfree?.deinit()
+    hid.deinit()
+    l2cap.deinit()
+    mediaplayer.deinit()
+    pbap.deinit()
+    rfcomm.deinit()
+    security.deinit()
+    securityStorage.deinit()
+    androidInternal.deinit()
+  }
+}
diff --git a/android/pandora/server/src/com/android/pandora/Utils.kt b/android/pandora/server/src/com/android/pandora/Utils.kt
new file mode 100644
index 0000000..a88ffae
--- /dev/null
+++ b/android/pandora/server/src/com/android/pandora/Utils.kt
@@ -0,0 +1,353 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.pandora
+
+import android.bluetooth.BluetoothAdapter
+import android.bluetooth.BluetoothDevice
+import android.bluetooth.BluetoothManager
+import android.bluetooth.BluetoothProfile
+import android.content.BroadcastReceiver
+import android.content.Context
+import android.content.Intent
+import android.content.IntentFilter
+import android.media.*
+import android.net.MacAddress
+import android.os.ParcelFileDescriptor
+import android.util.Log
+import androidx.test.platform.app.InstrumentationRegistry
+import com.google.protobuf.Any
+import com.google.protobuf.ByteString
+import io.grpc.stub.ServerCallStreamObserver
+import io.grpc.stub.StreamObserver
+import java.io.BufferedReader
+import java.io.InputStreamReader
+import java.util.concurrent.CancellationException
+import java.util.stream.Collectors
+import kotlinx.coroutines.CoroutineScope
+import kotlinx.coroutines.Job
+import kotlinx.coroutines.channels.Channel
+import kotlinx.coroutines.channels.awaitClose
+import kotlinx.coroutines.channels.trySendBlocking
+import kotlinx.coroutines.flow.Flow
+import kotlinx.coroutines.flow.callbackFlow
+import kotlinx.coroutines.flow.catch
+import kotlinx.coroutines.flow.consumeAsFlow
+import kotlinx.coroutines.flow.first
+import kotlinx.coroutines.flow.launchIn
+import kotlinx.coroutines.flow.onCompletion
+import kotlinx.coroutines.flow.onEach
+import kotlinx.coroutines.launch
+import kotlinx.coroutines.runBlocking
+import kotlinx.coroutines.withTimeout
+import kotlinx.coroutines.withTimeoutOrNull
+import pandora.AndroidProto.InternalConnectionRef
+import pandora.HostProto.Connection
+
+private const val TAG = "PandoraUtils"
+private val alphanumeric = ('A'..'Z') + ('a'..'z') + ('0'..'9')
+
+fun shell(cmd: String): String {
+  val fd = InstrumentationRegistry.getInstrumentation().getUiAutomation().executeShellCommand(cmd)
+  val input_stream = ParcelFileDescriptor.AutoCloseInputStream(fd)
+  return BufferedReader(InputStreamReader(input_stream)).lines().collect(Collectors.joining("\n"))
+}
+
+/**
+ * Creates a cold flow of intents based on an intent filter. If used multiple times in a same class,
+ * this flow should be transformed into a shared flow.
+ *
+ * @param context context on which to register the broadcast receiver.
+ * @param intentFilter intent filter.
+ * @return cold flow.
+ */
+@kotlinx.coroutines.ExperimentalCoroutinesApi
+fun intentFlow(context: Context, intentFilter: IntentFilter) = callbackFlow {
+  val broadcastReceiver: BroadcastReceiver =
+    object : BroadcastReceiver() {
+      override fun onReceive(context: Context, intent: Intent) {
+        trySendBlocking(intent)
+      }
+    }
+  context.registerReceiver(broadcastReceiver, intentFilter)
+
+  awaitClose { context.unregisterReceiver(broadcastReceiver) }
+}
+
+/**
+ * Creates a gRPC coroutine in a given coroutine scope which executes a given suspended function
+ * returning a gRPC response and sends it on a given gRPC stream observer.
+ *
+ * @param T the type of gRPC response.
+ * @param scope coroutine scope used to run the coroutine.
+ * @param responseObserver the gRPC stream observer on which to send the response.
+ * @param timeout the duration in seconds after which the coroutine is automatically cancelled and
+ * returns a timeout error. Default: 60s.
+ * @param block the suspended function to execute to get the response.
+ * @return reference to the coroutine as a Job.
+ *
+ * Example usage:
+ * ```
+ * override fun grpcMethod(
+ *   request: TypeOfRequest,
+ *   responseObserver: StreamObserver<TypeOfResponse> {
+ *     grpcUnary(scope, responseObserver) {
+ *       block
+ *     }
+ *   }
+ * }
+ * ```
+ */
+@kotlinx.coroutines.ExperimentalCoroutinesApi
+fun <T> grpcUnary(
+  scope: CoroutineScope,
+  responseObserver: StreamObserver<T>,
+  timeout: Long = 60,
+  block: suspend () -> T
+): Job {
+  return scope.launch {
+    try {
+      val response = withTimeout(timeout * 1000) { block() }
+      responseObserver.onNext(response)
+      responseObserver.onCompleted()
+    } catch (e: Throwable) {
+      e.printStackTrace()
+      responseObserver.onError(e)
+    }
+  }
+}
+
+/**
+ * Creates a gRPC coroutine in a given coroutine scope which executes a given suspended function
+ * taking in a Flow of gRPC requests and returning a Flow of gRPC responses and sends it on a given
+ * gRPC stream observer.
+ *
+ * @param T the type of gRPC response.
+ * @param scope coroutine scope used to run the coroutine.
+ * @param responseObserver the gRPC stream observer on which to send the response.
+ * @param block the suspended function transforming the request Flow to the response Flow.
+ * @return a StreamObserver for the incoming requests.
+ *
+ * Example usage:
+ * ```
+ * override fun grpcMethod(
+ *   responseObserver: StreamObserver<TypeOfResponse> {
+ *     grpcBidirectionalStream(scope, responseObserver) {
+ *       block
+ *     }
+ *   }
+ * }
+ * ```
+ */
+@kotlinx.coroutines.ExperimentalCoroutinesApi
+fun <T, U> grpcBidirectionalStream(
+  scope: CoroutineScope,
+  responseObserver: StreamObserver<U>,
+  block: CoroutineScope.(Flow<T>) -> Flow<U>
+): StreamObserver<T> {
+
+  val inputChannel = Channel<T>()
+
+  val job =
+    scope.launch {
+      block(inputChannel.consumeAsFlow())
+        .onEach { responseObserver.onNext(it) }
+        .onCompletion { error ->
+          if (error == null) {
+            responseObserver.onCompleted()
+          }
+        }
+        .catch {
+          it.printStackTrace()
+          responseObserver.onError(it)
+        }
+        .launchIn(this)
+    }
+
+  return object : StreamObserver<T> {
+    override fun onNext(req: T) {
+      // Note: this should be made a blocking call, and the handler should run in a separate thread
+      // so we get flow control - but for now we can live with this
+      if (inputChannel.trySend(req).isFailure) {
+        job.cancel(CancellationException("too many incoming requests, buffer exceeded"))
+        responseObserver.onError(
+          CancellationException("too many incoming requests, buffer exceeded")
+        )
+      }
+    }
+
+    override fun onCompleted() {
+      // stop the input flow, but keep the job running
+      inputChannel.close()
+    }
+
+    override fun onError(e: Throwable) {
+      job.cancel()
+      e.printStackTrace()
+    }
+  }
+}
+
+/**
+ * Creates a gRPC coroutine in a given coroutine scope which executes a given suspended function
+ * taking in a Flow of gRPC requests and returning a Flow of gRPC responses and sends it on a given
+ * gRPC stream observer.
+ *
+ * @param T the type of gRPC response.
+ * @param scope coroutine scope used to run the coroutine.
+ * @param responseObserver the gRPC stream observer on which to send the response.
+ * @param block the suspended function producing the response Flow.
+ * @return a StreamObserver for the incoming requests.
+ *
+ * Example usage:
+ * ```
+ * override fun grpcMethod(
+ *   request: TypeOfRequest,
+ *   responseObserver: StreamObserver<TypeOfResponse> {
+ *     grpcServerStream(scope, responseObserver) {
+ *       block
+ *     }
+ *   }
+ * }
+ * ```
+ */
+@kotlinx.coroutines.ExperimentalCoroutinesApi
+fun <T> grpcServerStream(
+  scope: CoroutineScope,
+  responseObserver: StreamObserver<T>,
+  block: CoroutineScope.() -> Flow<T>
+) {
+  val serverCallStreamObserver = responseObserver as ServerCallStreamObserver<T>
+
+  val job =
+    scope.launch {
+      block()
+        .onEach { responseObserver.onNext(it) }
+        .onCompletion { error ->
+          if (error == null) {
+            responseObserver.onCompleted()
+          }
+        }
+        .catch {
+          it.printStackTrace()
+          responseObserver.onError(it)
+        }
+        .launchIn(this)
+    }
+
+  serverCallStreamObserver.setOnCancelHandler { job.cancel() }
+}
+
+/**
+ * Synchronous method to get a Bluetooth profile proxy.
+ *
+ * @param T the type of profile proxy (e.g. BluetoothA2dp)
+ * @param context context
+ * @param bluetoothAdapter local Bluetooth adapter
+ * @param profile identifier of the Bluetooth profile (e.g. BluetoothProfile#A2DP)
+ * @return T the desired profile proxy
+ */
+@Suppress("UNCHECKED_CAST")
+@kotlinx.coroutines.ExperimentalCoroutinesApi
+fun <T> getProfileProxy(context: Context, profile: Int): T {
+  var proxy: BluetoothProfile?
+  runBlocking {
+    val bluetoothManager = context.getSystemService(BluetoothManager::class.java)!!
+    val bluetoothAdapter = bluetoothManager.adapter
+
+    val flow = callbackFlow {
+      val serviceListener =
+        object : BluetoothProfile.ServiceListener {
+          override fun onServiceConnected(profile: Int, proxy: BluetoothProfile) {
+            trySendBlocking(proxy)
+          }
+          override fun onServiceDisconnected(profile: Int) {}
+        }
+
+      bluetoothAdapter.getProfileProxy(context, serviceListener, profile)
+
+      awaitClose {}
+    }
+    proxy = withTimeoutOrNull(5_000) { flow.first() }
+  }
+  if (proxy == null) {
+    Log.w(TAG, "profile proxy $profile is null")
+  }
+  return proxy!! as T
+}
+
+fun Intent.getBluetoothDeviceExtra(): BluetoothDevice =
+  this.getParcelableExtra(BluetoothDevice.EXTRA_DEVICE, BluetoothDevice::class.java)!!
+
+fun ByteString.decodeAsMacAddressToString(): String =
+  MacAddress.fromBytes(this.toByteArray()).toString().uppercase()
+
+fun ByteString.toBluetoothDevice(adapter: BluetoothAdapter): BluetoothDevice =
+  adapter.getRemoteDevice(this.decodeAsMacAddressToString())
+
+fun Connection.toBluetoothDevice(adapter: BluetoothAdapter): BluetoothDevice =
+  adapter.getRemoteDevice(this.address)
+
+val Connection.address: String
+  get() = InternalConnectionRef.parseFrom(this.cookie.value).address.decodeAsMacAddressToString()
+
+val Connection.transport: Int
+  get() = InternalConnectionRef.parseFrom(this.cookie.value).transport
+
+fun BluetoothDevice.toByteString() =
+  ByteString.copyFrom(MacAddress.fromString(this.address).toByteArray())!!
+
+fun BluetoothDevice.toConnection(transport: Int): Connection {
+  val internal_connection_ref =
+    InternalConnectionRef.newBuilder()
+      .setAddress(ByteString.copyFrom(MacAddress.fromString(this.address).toByteArray()))
+      .setTransport(transport)
+      .build()
+  val cookie = Any.newBuilder().setValue(internal_connection_ref.toByteString()).build()
+
+  return Connection.newBuilder().setCookie(cookie).build()
+}
+
+/** Creates Audio track instance and returns the reference. */
+fun buildAudioTrack(): AudioTrack? {
+  return AudioTrack.Builder()
+    .setAudioAttributes(
+      AudioAttributes.Builder()
+        .setUsage(AudioAttributes.USAGE_MEDIA)
+        .setContentType(AudioAttributes.CONTENT_TYPE_MUSIC)
+        .build()
+    )
+    .setAudioFormat(
+      AudioFormat.Builder()
+        .setEncoding(AudioFormat.ENCODING_PCM_16BIT)
+        .setSampleRate(44100)
+        .setChannelMask(AudioFormat.CHANNEL_OUT_STEREO)
+        .build()
+    )
+    .setTransferMode(AudioTrack.MODE_STREAM)
+    .setBufferSizeInBytes(44100 * 2 * 2)
+    .build()
+}
+
+/**
+ * Generates Alpha-numeric string of given length.
+ *
+ * @param length required string size.
+ * @return a generated string
+ */
+fun generateAlphanumericString(length: Int): String {
+  return buildString { repeat(length) { append(alphanumeric.random()) } }
+}
diff --git a/android/pandora/test/Android.bp b/android/pandora/test/Android.bp
new file mode 100644
index 0000000..703a42f
--- /dev/null
+++ b/android/pandora/test/Android.bp
@@ -0,0 +1,45 @@
+// Copyright 2022, The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package {
+    default_applicable_licenses: ["Android-Apache-2.0"],
+}
+
+python_test_host {
+    name: "avatar",
+    main: "example.py",
+    srcs: [
+        "example.py",
+    ],
+    libs: [
+        "libavatar",
+    ],
+    required: ["PandoraServer"],
+    test_suites: ["general-tests"],
+    test_options: {
+        unit_test: false,
+    },
+    data: ["config.yml"],
+}
+
+python_binary_host {
+    name: "avatar_runner",
+    main: "runner.py",
+    srcs: [
+        "runner.py",
+    ],
+    libs: [
+        "libavatar"
+    ],
+}
diff --git a/android/pandora/test/AndroidTest.xml b/android/pandora/test/AndroidTest.xml
new file mode 100644
index 0000000..9f6ce9f
--- /dev/null
+++ b/android/pandora/test/AndroidTest.xml
@@ -0,0 +1,37 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+  ~ Copyright (C) 2020 The Android Open Source Project
+  ~
+  ~ Licensed under the Apache License, Version 2.0 (the "License");
+  ~ you may not use this file except in compliance with the License.
+  ~ You may obtain a copy of the License at
+  ~
+  ~      http://www.apache.org/licenses/LICENSE-2.0
+  ~
+  ~ Unless required by applicable law or agreed to in writing, software
+  ~ distributed under the License is distributed on an "AS IS" BASIS,
+  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  ~ See the License for the specific language governing permissions and
+  ~ limitations under the License.
+  -->
+<configuration description="Avatar tests.">
+    <target_preparer class="com.android.tradefed.targetprep.TestAppInstallSetup">
+        <option name="test-file-name" value="PandoraServer.apk" />
+        <option name="install-arg" value="-r" />
+        <option name="install-arg" value="-g" />
+    </target_preparer>
+    <target_preparer class="com.android.tradefed.targetprep.PythonVirtualenvPreparer">
+        <option name="dep-module" value="mobly" />
+        <option name="dep-module" value="grpcio" />
+        <option name="dep-module" value="pyee" />
+        <option name="dep-module" value="ansicolors" />
+        <option name="dep-module" value="websockets" />
+        <option name="dep-module" value="bitstruct" />
+    </target_preparer>
+    <test class="com.android.tradefed.testtype.mobly.MoblyBinaryHostTest">
+        <option name="mobly-par-file-name" value="avatar" />
+        <option name="mobly-config-file-name" value="config.yml" />
+        <option name="mobly-test-timeout" value="1800000" />
+    </test>
+</configuration>
+
diff --git a/android/pandora/test/config.yml b/android/pandora/test/config.yml
new file mode 100644
index 0000000..bd43582
--- /dev/null
+++ b/android/pandora/test/config.yml
@@ -0,0 +1,12 @@
+---
+
+TestBeds:
+- Name: ExampleTest
+  Controllers:
+    AndroidDevice: '*'
+    PandoraDevice:
+    - class: AndroidPandoraDevice
+      config: '*'
+    - class: BumblePandoraDevice
+      transport: 'tcp-client:127.0.0.1:7300'
+      classic_enabled: true
diff --git a/android/pandora/test/config_bumble_vs_bumble.yml b/android/pandora/test/config_bumble_vs_bumble.yml
new file mode 100644
index 0000000..eaf256c
--- /dev/null
+++ b/android/pandora/test/config_bumble_vs_bumble.yml
@@ -0,0 +1,30 @@
+---
+
+# BumblePandoraDevice configuration:
+#   classic_enabled: [true, false] # (false by default)
+#   class_of_device: 1234 # See assigned numbers
+#   keystore: JsonKeyStore # or empty
+#   io_capability:
+#     no_output_no_input # (default)
+#     keyboard_input_only
+#     display_output_only
+#     display_output_and_yes_no_input
+#     display_output_and_keyboard_input
+
+TestBeds:
+- Name: ExampleTest
+  Controllers:
+    PandoraDevice:
+    # DUT device
+    - class: BumblePandoraDevice
+      transport: 'tcp-client:127.0.0.1:6402'
+      classic_enabled: true
+      class_of_device: 2360324
+      keystore: 'JsonKeyStore'
+      io_capability: display_output_only
+    # Reference device
+    - class: BumblePandoraDevice
+      transport: 'tcp-client:127.0.0.1:6402'
+      classic_enabled: true
+      class_of_device: 2360324
+      keystore: 'JsonKeyStore'
diff --git a/android/pandora/test/example.py b/android/pandora/test/example.py
new file mode 100644
index 0000000..bbe2549
--- /dev/null
+++ b/android/pandora/test/example.py
@@ -0,0 +1,304 @@
+# Copyright 2022 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import avatar
+import asyncio
+import logging
+import grpc
+
+from concurrent import futures
+from contextlib import suppress
+
+from mobly import test_runner, base_test
+
+from bumble.smp import PairingDelegate
+
+from avatar.utils import Address, AsyncQueue
+from avatar.controllers import pandora_device
+from pandora.host_pb2 import (
+    DiscoverabilityMode, DataTypes, OwnAddressType
+)
+from pandora.security_pb2 import (
+    PairingEventAnswer, SecurityLevel, LESecurityLevel
+)
+
+
+class ExampleTest(base_test.BaseTestClass):
+    def setup_class(self):
+        self.pandora_devices = self.register_controller(pandora_device)
+        self.dut: pandora_device.PandoraDevice = self.pandora_devices[0]
+        self.ref: pandora_device.BumblePandoraDevice = self.pandora_devices[1]
+
+    @avatar.asynchronous
+    async def setup_test(self):
+        async def reset(device: pandora_device.PandoraDevice):
+            await device.host.FactoryReset()
+            device.address = (await device.host.ReadLocalAddress(wait_for_ready=True)).address
+
+        await asyncio.gather(reset(self.dut), reset(self.ref))
+
+    def test_print_addresses(self):
+        dut_address = self.dut.address
+        self.dut.log.info(f'Address: {dut_address}')
+        ref_address = self.ref.address
+        self.ref.log.info(f'Address: {ref_address}')
+
+    def test_get_remote_name(self):
+        dut_name = self.ref.host.GetRemoteName(address=self.dut.address).name
+        self.ref.log.info(f'DUT remote name: {dut_name}')
+        ref_name = self.dut.host.GetRemoteName(address=self.ref.address).name
+        self.dut.log.info(f'REF remote name: {ref_name}')
+
+    def test_classic_connect(self):
+        dut_address = self.dut.address
+        self.dut.log.info(f'Address: {dut_address}')
+        connection = self.ref.host.Connect(address=dut_address).connection
+        dut_name = self.ref.host.GetRemoteName(connection=connection).name
+        self.ref.log.info(f'Connected with: "{dut_name}" {dut_address}')
+        self.ref.host.Disconnect(connection=connection)
+
+    # Using this decorator allow us to write one `test_le_connect`, and
+    # run it multiple time with different parameters.
+    # Here we check that no matter the address type we use for both sides
+    # the connection still complete.
+    @avatar.parameterized([
+        (OwnAddressType.PUBLIC, OwnAddressType.PUBLIC),
+        (OwnAddressType.PUBLIC, OwnAddressType.RANDOM),
+        (OwnAddressType.RANDOM, OwnAddressType.RANDOM),
+        (OwnAddressType.RANDOM, OwnAddressType.PUBLIC),
+    ])
+    def test_le_connect(self, dut_address_type: OwnAddressType, ref_address_type: OwnAddressType):
+        self.ref.host.StartAdvertising(legacy=True, connectable=True, own_address_type=ref_address_type)
+        peers = self.dut.host.Scan(own_address_type=dut_address_type)
+        if ref_address_type == OwnAddressType.PUBLIC:
+            scan_response = next((x for x in peers if x.public == self.ref.address))
+            connection = self.dut.host.ConnectLE(public=scan_response.public, own_address_type=dut_address_type).connection
+        else:
+            scan_response = next((x for x in peers if x.random == Address(self.ref.device.random_address)))
+            connection = self.dut.host.ConnectLE(random=scan_response.random, own_address_type=dut_address_type).connection
+        self.dut.host.Disconnect(connection=connection)
+
+    def test_not_discoverable(self):
+        self.dut.host.SetDiscoverabilityMode(mode=DiscoverabilityMode.NOT_DISCOVERABLE)
+        peers = self.ref.host.Inquiry(timeout=3.0)
+        try:
+            assert not next((x for x in peers if x.address == self.dut.address), None)
+        except grpc.RpcError as e:
+            assert e.code() == grpc.StatusCode.DEADLINE_EXCEEDED
+
+    @avatar.parameterized([
+        (DiscoverabilityMode.DISCOVERABLE_LIMITED, ),
+        (DiscoverabilityMode.DISCOVERABLE_GENERAL, ),
+    ])
+    def test_discoverable(self, mode):
+        self.dut.host.SetDiscoverabilityMode(mode=mode)
+        peers = self.ref.host.Inquiry(timeout=15.0)
+        assert next((x for x in peers if x.address == self.dut.address), None)
+
+    @avatar.asynchronous
+    async def test_wait_connection(self):
+        dut_ref = self.dut.host.WaitConnection(address=self.ref.address)
+        ref_dut = await self.ref.host.Connect(address=self.dut.address)
+        dut_ref = await dut_ref
+        assert ref_dut.connection and dut_ref.connection
+
+    @avatar.asynchronous
+    async def test_wait_any_connection(self):
+        dut_ref = self.dut.host.WaitConnection()
+        ref_dut = await self.ref.host.Connect(address=self.dut.address)
+        dut_ref = await dut_ref
+        assert ref_dut.connection and dut_ref.connection
+
+    def test_scan_response_data(self):
+        self.dut.host.StartAdvertising(
+            legacy=True,
+            data=DataTypes(
+                include_shortened_local_name=True,
+                tx_power_level=42,
+                incomplete_service_class_uuids16=['FDF0']
+            ),
+            scan_response_data=DataTypes(include_complete_local_name=True, include_class_of_device=True)
+        )
+
+        peers = self.ref.host.Scan()
+        scan_response = next((x for x in peers if x.public == self.dut.address))
+        assert type(scan_response.data.complete_local_name) == str
+        assert type(scan_response.data.shortened_local_name) == str
+        assert type(scan_response.data.class_of_device) == int
+        assert type(scan_response.data.incomplete_service_class_uuids16[0]) == str
+        assert scan_response.data.tx_power_level == 42
+
+    @avatar.parameterized([
+        (PairingDelegate.NO_OUTPUT_NO_INPUT, ),
+        (PairingDelegate.KEYBOARD_INPUT_ONLY, ),
+        (PairingDelegate.DISPLAY_OUTPUT_ONLY, ),
+        (PairingDelegate.DISPLAY_OUTPUT_AND_YES_NO_INPUT, ),
+        (PairingDelegate.DISPLAY_OUTPUT_AND_KEYBOARD_INPUT, ),
+    ])
+    @avatar.asynchronous
+    async def test_classic_pairing(self, ref_io_capability):
+        # override reference device IO capability
+        self.ref.device.io_capability = ref_io_capability
+
+        await self.ref.security_storage.DeleteBond(public=self.dut.address)
+
+        async def handle_pairing_events():
+            on_ref_pairing = self.ref.security.OnPairing((ref_answer_queue := AsyncQueue()))
+            on_dut_pairing = self.dut.security.OnPairing((dut_answer_queue := AsyncQueue()))
+
+            try:
+                while True:
+                    dut_pairing_event = await anext(aiter(on_dut_pairing))
+                    ref_pairing_event = await anext(aiter(on_ref_pairing))
+
+                    if dut_pairing_event.WhichOneof('method') in ('numeric_comparison', 'just_works'):
+                        assert ref_pairing_event.WhichOneof('method') in ('numeric_comparison', 'just_works')
+                        dut_answer_queue.put_nowait(PairingEventAnswer(
+                            event=dut_pairing_event,
+                            confirm=True,
+                        ))
+                        ref_answer_queue.put_nowait(PairingEventAnswer(
+                            event=ref_pairing_event,
+                            confirm=True,
+                        ))
+                    elif dut_pairing_event.WhichOneof('method') == 'passkey_entry_notification':
+                        assert ref_pairing_event.WhichOneof('method') == 'passkey_entry_request'
+                        ref_answer_queue.put_nowait(PairingEventAnswer(
+                            event=ref_pairing_event,
+                            passkey=dut_pairing_event.passkey_entry_notification,
+                        ))
+                    elif dut_pairing_event.WhichOneof('method') == 'passkey_entry_request':
+                        assert ref_pairing_event.WhichOneof('method') == 'passkey_entry_notification'
+                        dut_answer_queue.put_nowait(PairingEventAnswer(
+                            event=dut_pairing_event,
+                            passkey=ref_pairing_event.passkey_entry_notification,
+                        ))
+                    else:
+                        assert False
+
+            finally:
+                on_ref_pairing.cancel()
+                on_dut_pairing.cancel()
+
+        pairing = asyncio.create_task(handle_pairing_events())
+        ref_dut = (await self.ref.host.Connect(address=self.dut.address)).connection
+        dut_ref = (await self.dut.host.WaitConnection(address=self.ref.address)).connection
+
+        await asyncio.gather(
+            self.ref.security.Secure(connection=ref_dut, classic=SecurityLevel.LEVEL2),
+            self.dut.security.WaitSecurity(connection=dut_ref, classic=SecurityLevel.LEVEL2)
+        )
+
+        pairing.cancel()
+        with suppress(asyncio.CancelledError, futures.CancelledError):
+            await pairing
+
+        await asyncio.gather(
+            self.dut.host.Disconnect(connection=dut_ref),
+            self.ref.host.WaitDisconnection(connection=ref_dut)
+        )
+
+    @avatar.parameterized([
+        (OwnAddressType.PUBLIC, OwnAddressType.PUBLIC, PairingDelegate.NO_OUTPUT_NO_INPUT),
+        (OwnAddressType.PUBLIC, OwnAddressType.PUBLIC, PairingDelegate.KEYBOARD_INPUT_ONLY),
+        (OwnAddressType.PUBLIC, OwnAddressType.PUBLIC, PairingDelegate.DISPLAY_OUTPUT_ONLY),
+        (OwnAddressType.PUBLIC, OwnAddressType.PUBLIC, PairingDelegate.DISPLAY_OUTPUT_AND_YES_NO_INPUT),
+        (OwnAddressType.PUBLIC, OwnAddressType.PUBLIC, PairingDelegate.DISPLAY_OUTPUT_AND_KEYBOARD_INPUT),
+        (OwnAddressType.PUBLIC, OwnAddressType.RANDOM, PairingDelegate.DISPLAY_OUTPUT_AND_KEYBOARD_INPUT),
+        (OwnAddressType.RANDOM, OwnAddressType.RANDOM, PairingDelegate.DISPLAY_OUTPUT_AND_KEYBOARD_INPUT),
+        (OwnAddressType.RANDOM, OwnAddressType.PUBLIC, PairingDelegate.DISPLAY_OUTPUT_AND_KEYBOARD_INPUT),
+    ])
+    @avatar.asynchronous
+    async def test_le_pairing(self,
+        dut_address_type: OwnAddressType,
+        ref_address_type: OwnAddressType,
+        ref_io_capability
+    ):
+        # override reference device IO capability
+        self.ref.device.io_capability = ref_io_capability
+
+        if ref_address_type in (OwnAddressType.PUBLIC, OwnAddressType.RESOLVABLE_OR_PUBLIC):
+            ref_address = {'public': self.ref.address}
+        else:
+            ref_address = {'random': Address(self.ref.device.random_address)}
+
+        await self.dut.security_storage.DeleteBond(**ref_address)
+        await self.dut.host.StartAdvertising(legacy=True, connectable=True, own_address_type=dut_address_type)
+
+        dut = await anext(aiter(self.ref.host.Scan(own_address_type=ref_address_type)))
+        if dut_address_type in (OwnAddressType.PUBLIC, OwnAddressType.RESOLVABLE_OR_PUBLIC):
+            dut_address = {'public': Address(dut.public)}
+        else:
+            dut_address = {'random': Address(dut.random)}
+
+        async def handle_pairing_events():
+            on_ref_pairing = self.ref.security.OnPairing((ref_answer_queue := AsyncQueue()))
+            on_dut_pairing = self.dut.security.OnPairing((dut_answer_queue := AsyncQueue()))
+
+            try:
+                while True:
+                    dut_pairing_event = await anext(aiter(on_dut_pairing))
+                    ref_pairing_event = await anext(aiter(on_ref_pairing))
+
+                    if dut_pairing_event.WhichOneof('method') in ('numeric_comparison', 'just_works'):
+                        assert ref_pairing_event.WhichOneof('method') in ('numeric_comparison', 'just_works')
+                        dut_answer_queue.put_nowait(PairingEventAnswer(
+                            event=dut_pairing_event,
+                            confirm=True,
+                        ))
+                        ref_answer_queue.put_nowait(PairingEventAnswer(
+                            event=ref_pairing_event,
+                            confirm=True,
+                        ))
+                    elif dut_pairing_event.WhichOneof('method') == 'passkey_entry_notification':
+                        assert ref_pairing_event.WhichOneof('method') == 'passkey_entry_request'
+                        ref_answer_queue.put_nowait(PairingEventAnswer(
+                            event=ref_pairing_event,
+                            passkey=dut_pairing_event.passkey_entry_notification,
+                        ))
+                    elif dut_pairing_event.WhichOneof('method') == 'passkey_entry_request':
+                        assert ref_pairing_event.WhichOneof('method') == 'passkey_entry_notification'
+                        dut_answer_queue.put_nowait(PairingEventAnswer(
+                            event=dut_pairing_event,
+                            passkey=ref_pairing_event.passkey_entry_notification,
+                        ))
+                    else:
+                        assert False
+
+            finally:
+                on_ref_pairing.cancel()
+                on_dut_pairing.cancel()
+
+        pairing = asyncio.create_task(handle_pairing_events())
+        ref_dut = (await self.ref.host.ConnectLE(own_address_type=ref_address_type, **dut_address)).connection
+        dut_ref = (await self.dut.host.WaitLEConnection(**ref_address)).connection
+
+        await asyncio.gather(
+            self.ref.security.Secure(connection=ref_dut, le=LESecurityLevel.LE_LEVEL4),
+            self.dut.security.WaitSecurity(connection=dut_ref, le=LESecurityLevel.LE_LEVEL4)
+        )
+
+        pairing.cancel()
+        with suppress(asyncio.CancelledError, futures.CancelledError):
+            await pairing
+
+        await asyncio.gather(
+            self.dut.host.Disconnect(connection=dut_ref),
+            self.ref.host.WaitDisconnection(connection=ref_dut)
+        )
+
+
+if __name__ == '__main__':
+    logging.basicConfig(level=logging.DEBUG)
+    test_runner.main()
diff --git a/android/pandora/test/runner.py b/android/pandora/test/runner.py
new file mode 100644
index 0000000..216e310
--- /dev/null
+++ b/android/pandora/test/runner.py
@@ -0,0 +1,116 @@
+# Copyright 2022 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import os
+import sys
+import logging
+import argparse
+import subprocess
+
+from re import sub
+from pathlib import Path
+from genericpath import exists
+from multiprocessing import Process
+
+ANDROID_BUILD_TOP = os.getenv("ANDROID_BUILD_TOP")
+TARGET_PRODUCT = os.getenv("TARGET_PRODUCT")
+TARGET_BUILD_VARIANT = os.getenv("TARGET_BUILD_VARIANT")
+ANDROID_PRODUCT_OUT = os.getenv("ANDROID_PRODUCT_OUT")
+PANDORA_CF_APK = Path(
+    f'{ANDROID_BUILD_TOP}/out/target/product/vsoc_x86_64/testcases/PandoraServer/x86_64/PandoraServer.apk'
+)
+
+
+def build_pandora_server():
+  target = TARGET_PRODUCT if TARGET_BUILD_VARIANT == "release" else f'{TARGET_PRODUCT}-{TARGET_BUILD_VARIANT}'
+  logging.debug(f'build_pandora_server: {target}')
+  pandora_server_cmd = f'source build/envsetup.sh && lunch {target} && make PandoraServer'
+  subprocess.run(pandora_server_cmd,
+                 cwd=ANDROID_BUILD_TOP,
+                 shell=True,
+                 executable='/bin/bash',
+                 check=True)
+
+
+def install_pandora_server(serial):
+  logging.debug('Install PandoraServer.apk')
+  pandora_apk_path = Path(
+      f'{ANDROID_PRODUCT_OUT}/testcases/PandoraServer/x86_64/PandoraServer.apk')
+  if not pandora_apk_path.exists():
+    logging.error(
+        f"PandoraServer apk is not build or the path is wrong: {pandora_apk_path}"
+    )
+    sys.exit(1)
+  install_apk_cmd = ['adb', 'install', '-r', '-g', str(pandora_apk_path)]
+  if args.serial != "":
+    install_apk_cmd.append(f'-s {serial}')
+  subprocess.run(install_apk_cmd, check=True)
+
+
+def instrument_pandora_server():
+  logging.debug('instrument_pandora_server')
+  instrument_cmd = 'adb shell am instrument --no-hidden-api-checks -w com.android.pandora/.Main'
+  instrument_process = Process(
+      target=lambda: subprocess.run(instrument_cmd, shell=True, check=True))
+  instrument_process.start()
+  return instrument_process
+
+
+def run_test(args):
+  logging.debug(f'run_test config: {args.config} test: {args.test}')
+  test_cmd = ['python3', args.test, '-c', args.config]
+  if args.verbose:
+    test_cmd.append('--verbose')
+  test_cmd.extend(args.mobly_args)
+  p = subprocess.Popen(test_cmd)
+  p.wait(timeout=args.timeout)
+  p.terminate()
+
+
+def run(args):
+  if not PANDORA_CF_APK.exists() or args.build:
+    build_pandora_server()
+  install_pandora_server(args.serial)
+  instrument_process = instrument_pandora_server()
+  run_test(args)
+  instrument_process.terminate()
+
+
+if __name__ == '__main__':
+  parser = argparse.ArgumentParser()
+  parser.add_argument("test", type=str, help="Test script path")
+  parser.add_argument("config", type=str, help="Test config file path")
+  parser.add_argument("-b",
+                      "--build",
+                      action="store_true",
+                      help="Build the PandoraServer.apk")
+  parser.add_argument("-s",
+                      "--serial",
+                      type=str,
+                      default="",
+                      help="Use device with given serial")
+  parser.add_argument("-m",
+                      "--timeout",
+                      type=int,
+                      default=1800000,
+                      help="Mobly test timeout")
+  parser.add_argument("-v",
+                      "--verbose",
+                      action="store_true",
+                      help="Set console logger level to DEBUG")
+  parser.add_argument("mobly_args", nargs='*')
+  args = parser.parse_args()
+  console_level = logging.DEBUG if args.verbose else logging.INFO
+  logging.basicConfig(level=console_level)
+  run(args)
diff --git a/apex/Android.bp b/apex/Android.bp
index 3026a4c..2527a73 100644
--- a/apex/Android.bp
+++ b/apex/Android.bp
@@ -22,27 +22,6 @@
     bootclasspath_fragments: ["com.android.btservices-bootclasspath-fragment"],
     systemserverclasspath_fragments: ["com.android.btservices-systemserverclasspath-fragment"],
     compat_configs: ["bluetooth-compat-config"],
-    apps: ["Bluetooth"],
-
-    multilib: {
-        first: {
-            // Extractor process runs only with the primary ABI.
-            jni_libs: [
-                "libbluetooth_jni",
-            ],
-        },
-    },
-
-    prebuilts: [
-        "audio_set_configurations_bfbs",
-        "audio_set_configurations_json",
-        "audio_set_scenarios_bfbs",
-        "audio_set_scenarios_json",
-        "btservices-linker-config",
-        "bt_did.conf",
-        "bt_stack.conf",
-        "privapp_allowlist_com.android.bluetooth.xml",
-    ],
     key: "com.android.btservices.key",
     certificate: ":com.android.btservices.certificate",
     updatable: false,
diff --git a/apex/apex_manifest.json b/apex/apex_manifest.json
index 64e7fae..b16d5b0 100644
--- a/apex/apex_manifest.json
+++ b/apex/apex_manifest.json
@@ -7,7 +7,5 @@
   ],
   "name": "com.android.btservices",
   "requireNativeLibs": [
-    "libaptX_encoder.so",
-    "libaptXHD_encoder.so"
   ]
 }
diff --git a/apex/permissions/com.android.bluetooth.xml b/apex/permissions/com.android.bluetooth.xml
index a91256f..8714175 100644
--- a/apex/permissions/com.android.bluetooth.xml
+++ b/apex/permissions/com.android.bluetooth.xml
@@ -37,5 +37,6 @@
         <permission name="android.permission.UPDATE_DEVICE_STATS" />
         <permission name="android.permission.PACKAGE_USAGE_STATS" />
         <permission name="android.permission.START_FOREGROUND_SERVICES_FROM_BACKGROUND" />
+        <permission name="android.permission.WRITE_SECURITY_LOG" />
     </privapp-permissions>
 </permissions>
diff --git a/build.py b/build.py
index 2bffdc3..d414bc1 100755
--- a/build.py
+++ b/build.py
@@ -64,6 +64,7 @@
     'docs',  # Build Rust docs
     'main',  # Build the main C++ codebase
     'prepare',  # Prepare the output directory (gn gen + rust setup)
+    'rootcanal',  # Build Rust targets for RootCanal
     'rust',  # Build only the rust components + copy artifacts to output dir
     'test',  # Run the unit tests
     'tools',  # Build the host tools (i.e. packetgen)
@@ -428,6 +429,11 @@
         """
         self._rust_build()
 
+    def _target_rootcanal(self):
+        """ Build rust artifacts for RootCanal in an already prepared environment.
+        """
+        self.run_command('rust', ['cargo', 'build'], cwd=os.path.join(self.platform_dir, 'bt/tools/rootcanal'), env=self.env)
+
     def _target_main(self):
         """ Build the main GN artifacts in an already prepared environment.
         """
@@ -442,6 +448,7 @@
             rust_test_cmd = rust_test_cmd + [self.args.test_name]
 
         self.run_command('test', rust_test_cmd, cwd=os.path.join(self.platform_dir, 'bt'), env=self.env)
+        self.run_command('test', rust_test_cmd, cwd=os.path.join(self.platform_dir, 'bt/tools/rootcanal'), env=self.env)
 
         # Host tests second based on host test list
         for t in HOST_TESTS:
@@ -537,6 +544,8 @@
             self._target_prepare()
         elif self.target == 'tools':
             self._target_tools()
+        elif self.target == 'rootcanal':
+            self._target_rootcanal()
         elif self.target == 'rust':
             self._target_rust()
         elif self.target == 'docs':
diff --git a/framework/Android.bp b/framework/Android.bp
index 92a7793..3d0de59 100644
--- a/framework/Android.bp
+++ b/framework/Android.bp
@@ -70,9 +70,12 @@
         "//external/sl4a/Common",
         "//frameworks/opt/wear",
         "//packages/modules/Bluetooth/android/app/tests/unit",
+        "//packages/modules/Bluetooth/android/pandora/server",
         "//packages/modules/Bluetooth/service",
         "//packages/modules/Connectivity/nearby/tests/multidevices/clients/test_support/fastpair_provider",
         "//packages/services/Car/car-builtin-lib",
+        // TODO(240720385)
+        "//packages/services/Car/tests/carservice_unit_test",
         ":__subpackages__",
     ],
 
diff --git a/framework/java/android/bluetooth/BluetoothAdapter.java b/framework/java/android/bluetooth/BluetoothAdapter.java
index 0cd9254..9ea4275 100644
--- a/framework/java/android/bluetooth/BluetoothAdapter.java
+++ b/framework/java/android/bluetooth/BluetoothAdapter.java
@@ -2952,6 +2952,7 @@
     public @NonNull List<Integer> getSupportedProfiles() {
         final ArrayList<Integer> supportedProfiles = new ArrayList<Integer>();
 
+        mServiceLock.readLock().lock();
         try {
             synchronized (mManagerCallback) {
                 if (mService != null) {
@@ -2974,6 +2975,8 @@
             }
         } catch (RemoteException | TimeoutException e) {
             Log.e(TAG, e.toString() + "\n" + Log.getStackTraceString(new Throwable()));
+        } finally {
+            mServiceLock.readLock().unlock();
         }
         return supportedProfiles;
     }
@@ -4233,14 +4236,18 @@
 
     /*package*/ IBluetooth getBluetoothService() {
         synchronized (sServiceLock) {
-            if (sProxyServiceStateCallbacks.isEmpty()) {
-                throw new IllegalStateException(
-                        "Anonymous service access requires at least one lifecycle in process");
-            }
             return sService;
         }
     }
 
+    /**
+     * Registers a IBluetoothManagerCallback and returns the cached
+     * Bluetooth service proxy object.
+     *
+     * TODO: rename this API to registerBlueoothManagerCallback or something?
+     * the current name does not match what it does very well.
+     *
+     * /
     @UnsupportedAppUsage
     /*package*/ IBluetooth getBluetoothService(IBluetoothManagerCallback cb) {
         Objects.requireNonNull(cb);
diff --git a/framework/java/android/bluetooth/BluetoothCodecConfig.java b/framework/java/android/bluetooth/BluetoothCodecConfig.java
index 9fc9fb3..cd0ffe4 100644
--- a/framework/java/android/bluetooth/BluetoothCodecConfig.java
+++ b/framework/java/android/bluetooth/BluetoothCodecConfig.java
@@ -77,6 +77,11 @@
     public static final int SOURCE_CODEC_TYPE_LC3 = 5;
 
     /**
+     * Source codec type Opus.
+     */
+    private static final int SOURCE_CODEC_TYPE_OPUS = 6;
+
+    /**
      * Source codec type invalid. This is the default value used for codec
      * type.
      */
@@ -85,7 +90,7 @@
     /**
      * Represents the count of valid source codec types.
      */
-    private static final int SOURCE_CODEC_TYPE_MAX = 6;
+    private static final int SOURCE_CODEC_TYPE_MAX = 7;
 
     /** @hide */
     @IntDef(prefix = "CODEC_PRIORITY_", value = {
@@ -462,7 +467,9 @@
             case SOURCE_CODEC_TYPE_LDAC:
                 return "LDAC";
             case SOURCE_CODEC_TYPE_LC3:
-              return "LC3";
+                return "LC3";
+            case SOURCE_CODEC_TYPE_OPUS:
+                return "Opus";
             case SOURCE_CODEC_TYPE_INVALID:
                 return "INVALID CODEC";
             default:
@@ -712,6 +719,7 @@
             case SOURCE_CODEC_TYPE_AAC:
             case SOURCE_CODEC_TYPE_LDAC:
             case SOURCE_CODEC_TYPE_LC3:
+            case SOURCE_CODEC_TYPE_OPUS:
               if (mCodecSpecific1 != other.mCodecSpecific1) {
                 return false;
               }
diff --git a/framework/java/android/bluetooth/BluetoothDevice.java b/framework/java/android/bluetooth/BluetoothDevice.java
index 5c91c94..58895ef 100644
--- a/framework/java/android/bluetooth/BluetoothDevice.java
+++ b/framework/java/android/bluetooth/BluetoothDevice.java
@@ -509,7 +509,10 @@
             METADATA_UNTETHERED_RIGHT_LOW_BATTERY_THRESHOLD,
             METADATA_UNTETHERED_CASE_LOW_BATTERY_THRESHOLD,
             METADATA_SPATIAL_AUDIO,
-            METADATA_FAST_PAIR_CUSTOMIZED_FIELDS})
+            METADATA_FAST_PAIR_CUSTOMIZED_FIELDS,
+            METADATA_LE_AUDIO,
+            METADATA_GMCS_CCCD,
+            METADATA_GTBS_CCCD})
     @Retention(RetentionPolicy.SOURCE)
     public @interface MetadataKey{}
 
@@ -662,6 +665,21 @@
     public static final int METADATA_ENHANCED_SETTINGS_UI_URI = 16;
 
     /**
+     * @hide
+     */
+    public static final String COMPANION_TYPE_PRIMARY = "COMPANION_PRIMARY";
+
+    /**
+     * @hide
+     */
+    public static final String COMPANION_TYPE_SECONDARY = "COMPANION_SECONDARY";
+
+    /**
+     * @hide
+     */
+    public static final String COMPANION_TYPE_NONE = "COMPANION_NONE";
+
+    /**
      * Type of the Bluetooth device, must be within the list of
      * BluetoothDevice.DEVICE_TYPE_*
      * Data type should be {@String} as {@link Byte} array.
@@ -735,6 +753,29 @@
     public static final int METADATA_FAST_PAIR_CUSTOMIZED_FIELDS = 25;
 
     /**
+     * The metadata of the Fast Pair for LE Audio capable devices.
+     * Data type should be {@link Byte} array.
+     * @hide
+     */
+    public static final int METADATA_LE_AUDIO = 26;
+
+    /**
+     * The UUIDs (16-bit) of registered to CCC characteristics from Media Control services.
+     * Data type should be {@link Byte} array.
+     * @hide
+     */
+    public static final int METADATA_GMCS_CCCD = 27;
+
+    /**
+     * The UUIDs (16-bit) of registered to CCC characteristics from Telephony Bearer service.
+     * Data type should be {@link Byte} array.
+     * @hide
+     */
+    public static final int METADATA_GTBS_CCCD = 28;
+
+    private static final int METADATA_MAX_KEY = METADATA_GTBS_CCCD;
+
+    /**
      * Device type which is used in METADATA_DEVICE_TYPE
      * Indicates this Bluetooth device is a standard Bluetooth accessory or
      * not listed in METADATA_DEVICE_TYPE_*.
@@ -1278,56 +1319,15 @@
 
     private static final String NULL_MAC_ADDRESS = "00:00:00:00:00:00";
 
-    /**
-     * Lazy initialization. Guaranteed final after first object constructed, or
-     * getService() called.
-     * TODO: Unify implementation of sService amongst BluetoothFoo API's
-     */
-    private static volatile IBluetooth sService;
-
     private final String mAddress;
     @AddressType private final int mAddressType;
 
     private AttributionSource mAttributionSource;
 
-    /*package*/
     static IBluetooth getService() {
-        synchronized (BluetoothDevice.class) {
-            if (sService == null) {
-                BluetoothAdapter adapter = BluetoothAdapter.getDefaultAdapter();
-                sService = adapter.getBluetoothService(sStateChangeCallback);
-            }
-        }
-        return sService;
+        return BluetoothAdapter.getDefaultAdapter().getBluetoothService();
     }
 
-    static IBluetoothManagerCallback sStateChangeCallback = new IBluetoothManagerCallback.Stub() {
-
-        public void onBluetoothServiceUp(IBluetooth bluetoothService)
-                throws RemoteException {
-            synchronized (BluetoothDevice.class) {
-                if (sService == null) {
-                    sService = bluetoothService;
-                }
-            }
-        }
-
-        public void onBluetoothServiceDown()
-                throws RemoteException {
-            synchronized (BluetoothDevice.class) {
-                sService = null;
-            }
-        }
-
-        public void onBrEdrDown() {
-            if (DBG) Log.d(TAG, "onBrEdrDown: reached BLE ON state");
-        }
-
-        public void onOobData(@Transport int transport, OobData oobData) {
-            if (DBG) Log.d(TAG, "onOobData: got data");
-        }
-    };
-
     /**
      * Create a new BluetoothDevice.
      * Bluetooth MAC address must be upper case, such as "00:11:22:33:AA:BB",
@@ -1340,7 +1340,6 @@
      * @hide
      */
     /*package*/ BluetoothDevice(String address, int addressType) {
-        getService();  // ensures sService is initialized
         if (!BluetoothAdapter.checkBluetoothAddress(address)) {
             throw new IllegalArgumentException(address + " is not a valid Bluetooth address");
         }
@@ -1488,7 +1487,7 @@
     })
     public @Nullable String getIdentityAddress() {
         if (DBG) log("getIdentityAddress()");
-        final IBluetooth service = sService;
+        final IBluetooth service = getService();
         final String defaultValue = null;
         if (service == null || !isBluetoothEnabled()) {
             Log.e(TAG, "BT not enabled. Cannot get identity address");
@@ -1518,7 +1517,7 @@
     @RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)
     public String getName() {
         if (DBG) log("getName()");
-        final IBluetooth service = sService;
+        final IBluetooth service = getService();
         final String defaultValue = null;
         if (service == null || !isBluetoothEnabled()) {
             Log.e(TAG, "BT not enabled. Cannot get Remote Device name");
@@ -1553,7 +1552,7 @@
     @RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)
     public int getType() {
         if (DBG) log("getType()");
-        final IBluetooth service = sService;
+        final IBluetooth service = getService();
         final int defaultValue = DEVICE_TYPE_UNKNOWN;
         if (service == null || !isBluetoothEnabled()) {
             Log.e(TAG, "BT not enabled. Cannot get Remote Device type");
@@ -1582,7 +1581,7 @@
     @RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)
     public String getAlias() {
         if (DBG) log("getAlias()");
-        final IBluetooth service = sService;
+        final IBluetooth service = getService();
         final String defaultValue = null;
         if (service == null || !isBluetoothEnabled()) {
             Log.e(TAG, "BT not enabled. Cannot get Remote Device Alias");
@@ -1643,7 +1642,7 @@
             throw new IllegalArgumentException("alias cannot be the empty string");
         }
         if (DBG) log("setAlias(" + alias + ")");
-        final IBluetooth service = sService;
+        final IBluetooth service = getService();
         final int defaultValue = BluetoothStatusCodes.ERROR_BLUETOOTH_NOT_ENABLED;
         if (service == null || !isBluetoothEnabled()) {
             Log.e(TAG, "BT not enabled. Cannot set Remote Device name");
@@ -1677,7 +1676,7 @@
     @RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)
     public @IntRange(from = -100, to = 100) int getBatteryLevel() {
         if (DBG) log("getBatteryLevel()");
-        final IBluetooth service = sService;
+        final IBluetooth service = getService();
         final int defaultValue = BATTERY_LEVEL_BLUETOOTH_OFF;
         if (service == null || !isBluetoothEnabled()) {
             Log.e(TAG, "Bluetooth disabled. Cannot get remote device battery level");
@@ -1772,7 +1771,7 @@
     private boolean createBondInternal(int transport, @Nullable OobData remoteP192Data,
             @Nullable OobData remoteP256Data) {
         if (DBG) log("createBondOutOfBand()");
-        final IBluetooth service = sService;
+        final IBluetooth service = getService();
         final boolean defaultValue = false;
         if (service == null || !isBluetoothEnabled()) {
             Log.w(TAG, "BT not enabled, createBondOutOfBand failed");
@@ -1805,7 +1804,7 @@
     @RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)
     public boolean isBondingInitiatedLocally() {
         if (DBG) log("isBondingInitiatedLocally()");
-        final IBluetooth service = sService;
+        final IBluetooth service = getService();
         final boolean defaultValue = false;
         if (service == null || !isBluetoothEnabled()) {
             Log.w(TAG, "BT not enabled, isBondingInitiatedLocally failed");
@@ -1832,7 +1831,7 @@
     @RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)
     public boolean cancelBondProcess() {
         if (DBG) log("cancelBondProcess()");
-        final IBluetooth service = sService;
+        final IBluetooth service = getService();
         final boolean defaultValue = false;
         if (service == null || !isBluetoothEnabled()) {
             Log.e(TAG, "BT not enabled. Cannot cancel Remote Device bond");
@@ -1865,7 +1864,7 @@
     @RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)
     public boolean removeBond() {
         if (DBG) log("removeBond()");
-        final IBluetooth service = sService;
+        final IBluetooth service = getService();
         final boolean defaultValue = false;
         if (service == null || !isBluetoothEnabled()) {
             Log.e(TAG, "BT not enabled. Cannot remove Remote Device bond");
@@ -1955,7 +1954,7 @@
     @SuppressLint("AndroidFrameworkRequiresPermission")
     public int getBondState() {
         if (DBG) log("getBondState(" + getAnonymizedAddress() + ")");
-        final IBluetooth service = sService;
+        final IBluetooth service = getService();
         if (service == null) {
             Log.e(TAG, "BT not enabled. Cannot get bond state");
             if (DBG) log(Log.getStackTraceString(new Throwable()));
@@ -1988,7 +1987,7 @@
     })
     public boolean canBondWithoutDialog() {
         if (DBG) log("canBondWithoutDialog, device: " + this);
-        final IBluetooth service = sService;
+        final IBluetooth service = getService();
         final boolean defaultValue = false;
         if (service == null || !isBluetoothEnabled()) {
             Log.e(TAG, "BT not enabled. Cannot check if we can skip pairing dialog");
@@ -2042,7 +2041,7 @@
         if (!BluetoothAdapter.checkBluetoothAddress(getAddress())) {
             throw new IllegalArgumentException("device cannot have an invalid address");
         }
-        final IBluetooth service = sService;
+        final IBluetooth service = getService();
         final int defaultValue = BluetoothStatusCodes.ERROR_BLUETOOTH_NOT_ENABLED;
         if (service == null || !isBluetoothEnabled()) {
             Log.e(TAG, "BT not enabled. Cannot connect to remote device.");
@@ -2089,7 +2088,7 @@
         if (!BluetoothAdapter.checkBluetoothAddress(getAddress())) {
             throw new IllegalArgumentException("device cannot have an invalid address");
         }
-        final IBluetooth service = sService;
+        final IBluetooth service = getService();
         final int defaultValue = BluetoothStatusCodes.ERROR_BLUETOOTH_NOT_ENABLED;
         if (service == null || !isBluetoothEnabled()) {
             Log.e(TAG, "BT not enabled. Cannot disconnect to remote device.");
@@ -2121,7 +2120,7 @@
     @RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)
     public boolean isConnected() {
         if (DBG) log("isConnected()");
-        final IBluetooth service = sService;
+        final IBluetooth service = getService();
         final int defaultValue = CONNECTION_STATE_DISCONNECTED;
         if (service == null || !isBluetoothEnabled()) {
             Log.w(TAG, "Proxy not attached to service");
@@ -2153,7 +2152,7 @@
     @RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)
     public boolean isEncrypted() {
         if (DBG) log("isEncrypted()");
-        final IBluetooth service = sService;
+        final IBluetooth service = getService();
         final int defaultValue = CONNECTION_STATE_DISCONNECTED;
         if (service == null || !isBluetoothEnabled()) {
             Log.w(TAG, "Proxy not attached to service");
@@ -2182,7 +2181,7 @@
     @RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)
     public BluetoothClass getBluetoothClass() {
         if (DBG) log("getBluetoothClass()");
-        final IBluetooth service = sService;
+        final IBluetooth service = getService();
         final int defaultValue = 0;
         if (service == null || !isBluetoothEnabled()) {
             Log.e(TAG, "BT not enabled. Cannot get Bluetooth Class");
@@ -2216,7 +2215,7 @@
     @RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)
     public ParcelUuid[] getUuids() {
         if (DBG) log("getUuids()");
-        final IBluetooth service = sService;
+        final IBluetooth service = getService();
         final ParcelUuid[] defaultValue = null;
         if (service == null || !isBluetoothEnabled()) {
             Log.e(TAG, "BT not enabled. Cannot get remote device Uuids");
@@ -2283,7 +2282,7 @@
     })
     public boolean fetchUuidsWithSdp(@Transport int transport) {
         if (DBG) log("fetchUuidsWithSdp()");
-        final IBluetooth service = sService;
+        final IBluetooth service = getService();
         final boolean defaultValue = false;
         if (service == null || !isBluetoothEnabled()) {
             Log.e(TAG, "BT not enabled. Cannot fetchUuidsWithSdp");
@@ -2325,7 +2324,7 @@
     @RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)
     public boolean sdpSearch(ParcelUuid uuid) {
         if (DBG) log("sdpSearch()");
-        final IBluetooth service = sService;
+        final IBluetooth service = getService();
         final boolean defaultValue = false;
         if (service == null || !isBluetoothEnabled()) {
             Log.e(TAG, "BT not enabled. Cannot query remote device sdp records");
@@ -2352,7 +2351,7 @@
     @RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)
     public boolean setPin(byte[] pin) {
         if (DBG) log("setPin()");
-        final IBluetooth service = sService;
+        final IBluetooth service = getService();
         final boolean defaultValue = false;
         if (service == null || !isBluetoothEnabled()) {
             Log.e(TAG, "BT not enabled. Cannot set Remote Device pin");
@@ -2398,7 +2397,7 @@
     })
     public boolean setPairingConfirmation(boolean confirm) {
         if (DBG) log("setPairingConfirmation()");
-        final IBluetooth service = sService;
+        final IBluetooth service = getService();
         final boolean defaultValue = false;
         if (service == null || !isBluetoothEnabled()) {
             Log.e(TAG, "BT not enabled. Cannot set pairing confirmation");
@@ -2437,7 +2436,7 @@
     @RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)
     public @AccessPermission int getPhonebookAccessPermission() {
         if (DBG) log("getPhonebookAccessPermission()");
-        final IBluetooth service = sService;
+        final IBluetooth service = getService();
         final int defaultValue = ACCESS_UNKNOWN;
         if (service == null || !isBluetoothEnabled()) {
             Log.w(TAG, "Proxy not attached to service");
@@ -2484,7 +2483,7 @@
     })
     public boolean setSilenceMode(boolean silence) {
         if (DBG) log("setSilenceMode()");
-        final IBluetooth service = sService;
+        final IBluetooth service = getService();
         final boolean defaultValue = false;
         if (service == null || !isBluetoothEnabled()) {
             throw new IllegalStateException("Bluetooth is not turned ON");
@@ -2514,7 +2513,7 @@
     })
     public boolean isInSilenceMode() {
         if (DBG) log("isInSilenceMode()");
-        final IBluetooth service = sService;
+        final IBluetooth service = getService();
         final boolean defaultValue = false;
         if (service == null || !isBluetoothEnabled()) {
             throw new IllegalStateException("Bluetooth is not turned ON");
@@ -2545,7 +2544,7 @@
     })
     public boolean setPhonebookAccessPermission(@AccessPermission int value) {
         if (DBG) log("setPhonebookAccessPermission()");
-        final IBluetooth service = sService;
+        final IBluetooth service = getService();
         final boolean defaultValue = false;
         if (service == null || !isBluetoothEnabled()) {
             Log.w(TAG, "Proxy not attached to service");
@@ -2574,7 +2573,7 @@
     @RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)
     public @AccessPermission int getMessageAccessPermission() {
         if (DBG) log("getMessageAccessPermission()");
-        final IBluetooth service = sService;
+        final IBluetooth service = getService();
         final int defaultValue = ACCESS_UNKNOWN;
         if (service == null || !isBluetoothEnabled()) {
             Log.w(TAG, "Proxy not attached to service");
@@ -2611,7 +2610,7 @@
             throw new IllegalArgumentException(value + "is not a valid AccessPermission value");
         }
         if (DBG) log("setMessageAccessPermission()");
-        final IBluetooth service = sService;
+        final IBluetooth service = getService();
         final boolean defaultValue = false;
         if (service == null || !isBluetoothEnabled()) {
             Log.w(TAG, "Proxy not attached to service");
@@ -2640,7 +2639,7 @@
     @RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)
     public @AccessPermission int getSimAccessPermission() {
         if (DBG) log("getSimAccessPermission()");
-        final IBluetooth service = sService;
+        final IBluetooth service = getService();
         final int defaultValue = ACCESS_UNKNOWN;
         if (service == null || !isBluetoothEnabled()) {
             Log.w(TAG, "Proxy not attached to service");
@@ -2673,7 +2672,7 @@
     })
     public boolean setSimAccessPermission(int value) {
         if (DBG) log("setSimAccessPermission()");
-        final IBluetooth service = sService;
+        final IBluetooth service = getService();
         final boolean defaultValue = false;
         if (service == null || !isBluetoothEnabled()) {
             Log.w(TAG, "Proxy not attached to service");
@@ -3184,7 +3183,7 @@
     })
     public boolean setMetadata(@MetadataKey int key, @NonNull byte[] value) {
         if (DBG) log("setMetadata()");
-        final IBluetooth service = sService;
+        final IBluetooth service = getService();
         final boolean defaultValue = false;
         if (service == null || !isBluetoothEnabled()) {
             Log.e(TAG, "Bluetooth is not enabled. Cannot set metadata");
@@ -3219,7 +3218,7 @@
     })
     public byte[] getMetadata(@MetadataKey int key) {
         if (DBG) log("getMetadata()");
-        final IBluetooth service = sService;
+        final IBluetooth service = getService();
         final byte[] defaultValue = null;
         if (service == null || !isBluetoothEnabled()) {
             Log.e(TAG, "Bluetooth is not enabled. Cannot get metadata");
@@ -3243,7 +3242,165 @@
      * @hide
      */
     public static @MetadataKey int getMaxMetadataKey() {
-        return METADATA_FAST_PAIR_CUSTOMIZED_FIELDS;
+        return METADATA_MAX_KEY;
+    }
+
+    /** @hide */
+    @Retention(RetentionPolicy.SOURCE)
+    @IntDef(
+        prefix = { "FEATURE_" },
+        value = {
+            /** Remote support status of audio policy feature is unknown/unconfigured **/
+            BluetoothStatusCodes.FEATURE_NOT_CONFIGURED,
+            /** Remote support status of audio policy feature is supported **/
+            BluetoothStatusCodes.FEATURE_SUPPORTED,
+            /** Remote support status of audio policy feature is not supported **/
+            BluetoothStatusCodes.FEATURE_NOT_SUPPORTED,
+        }
+    )
+
+    public @interface AudioPolicyRemoteSupport {}
+
+    /** @hide */
+    @Retention(RetentionPolicy.SOURCE)
+    @IntDef(value = {
+            BluetoothStatusCodes.SUCCESS,
+            BluetoothStatusCodes.ERROR_BLUETOOTH_NOT_ENABLED,
+            BluetoothStatusCodes.ERROR_BLUETOOTH_NOT_ALLOWED,
+            BluetoothStatusCodes.ERROR_DEVICE_NOT_BONDED,
+            BluetoothStatusCodes.ERROR_MISSING_BLUETOOTH_CONNECT_PERMISSION,
+            BluetoothStatusCodes.ERROR_PROFILE_NOT_CONNECTED,
+    })
+    public @interface AudioPolicyReturnValues{}
+
+    /**
+     * Returns whether the audio policy feature is supported by
+     * both the local and the remote device.
+     * This is configured during initiating the connection between the devices through
+     * one of the transport protocols (e.g. HFP Vendor specific protocol). So if the API
+     * is invoked before this initial configuration is completed, it returns
+     * {@link BluetoothStatusCodes#FEATURE_NOT_CONFIGURED} to indicate the remote
+     * device has not yet relayed this information. After the internal configuration,
+     * the support status will be set to either
+     * {@link BluetoothStatusCodes#FEATURE_NOT_SUPPORTED} or
+     * {@link BluetoothStatusCodes#FEATURE_SUPPORTED}.
+     * The rest of the APIs related to this feature in both {@link BluetoothDevice}
+     * and {@link BluetoothSinkAudioPolicy} should be invoked  only after getting a
+     * {@link BluetoothStatusCodes#FEATURE_SUPPORTED} response from this API.
+     * <p>Note that this API is intended to be used by a client device to send these requests
+     * to the server represented by this BluetoothDevice object.
+     *
+     * @return if call audio policy feature is supported by both local and remote
+     * device or not
+     *
+     * @hide
+     */
+    @RequiresBluetoothConnectPermission
+    @RequiresPermission(allOf = {
+            android.Manifest.permission.BLUETOOTH_CONNECT,
+            android.Manifest.permission.BLUETOOTH_PRIVILEGED,
+    })
+    public @AudioPolicyRemoteSupport int isRequestAudioPolicyAsSinkSupported() {
+        if (DBG) log("isRequestAudioPolicyAsSinkSupported()");
+        final IBluetooth service = getService();
+        final int defaultValue = BluetoothStatusCodes.FEATURE_NOT_CONFIGURED;
+        if (service == null || !isBluetoothEnabled()) {
+            Log.e(TAG, "BT not enabled. Cannot retrieve audio policy support status.");
+            if (DBG) log(Log.getStackTraceString(new Throwable()));
+        } else {
+            try {
+                final SynchronousResultReceiver<Integer> recv = SynchronousResultReceiver.get();
+                service.isRequestAudioPolicyAsSinkSupported(this, mAttributionSource, recv);
+                return recv.awaitResultNoInterrupt(getSyncTimeout()).getValue(defaultValue);
+            } catch (TimeoutException e) {
+                Log.e(TAG, e.toString() + "\n" + Log.getStackTraceString(new Throwable()));
+            } catch (RemoteException e) {
+                Log.e(TAG, "", e);
+                throw e.rethrowFromSystemServer();
+            }
+        }
+        return defaultValue;
+    }
+
+    /**
+     * Sets call audio preferences and sends them to the remote device.
+     * <p>Note that the caller should check if the feature is supported by
+     * invoking {@link BluetoothDevice#isRequestAudioPolicyAsSinkSupported} first.
+     * <p>This API will throw an exception if the feature is not supported but still
+     * invoked.
+     * <p>Note that this API is intended to be used by a client device to send these requests
+     * to the server represented by this BluetoothDevice object.
+     *
+     * @param policies call audio policy preferences
+     * @return whether audio policy was requested successfully or not
+     *
+     * @hide
+     */
+    @RequiresBluetoothConnectPermission
+    @RequiresPermission(allOf = {
+            android.Manifest.permission.BLUETOOTH_CONNECT,
+            android.Manifest.permission.BLUETOOTH_PRIVILEGED,
+    })
+    public @AudioPolicyReturnValues int requestAudioPolicyAsSink(
+            @NonNull BluetoothSinkAudioPolicy policies) {
+        if (DBG) log("requestAudioPolicyAsSink");
+        final IBluetooth service = getService();
+        final int defaultValue = BluetoothStatusCodes.ERROR_BLUETOOTH_NOT_ENABLED;
+        if (service == null || !isBluetoothEnabled()) {
+            Log.e(TAG, "Bluetooth is not enabled. Cannot set Audio Policy.");
+            if (DBG) log(Log.getStackTraceString(new Throwable()));
+        } else {
+            try {
+                final SynchronousResultReceiver<Integer> recv = SynchronousResultReceiver.get();
+                service.requestAudioPolicyAsSink(this, policies, mAttributionSource, recv);
+                return recv.awaitResultNoInterrupt(getSyncTimeout()).getValue(defaultValue);
+            } catch (RemoteException | TimeoutException e) {
+                Log.e(TAG, e.toString() + "\n" + Log.getStackTraceString(new Throwable()));
+            }
+        }
+        return defaultValue;
+    }
+
+    /**
+     * Gets the call audio preferences for the remote device.
+     * <p>Note that the caller should check if the feature is supported by
+     * invoking {@link BluetoothDevice#isRequestAudioPolicyAsSinkSupported} first.
+     * <p>This API will throw an exception if the feature is not supported but still
+     * invoked.
+     * <p>This API will return null if
+     * 1. The bleutooth service is not started yet,
+     * 2. It is invoked for a device which is not bonded, or
+     * 3. The used transport, for example, HFP Client profile is not enabled or
+     * connected yet.
+     * <p>Note that this API is intended to be used by a client device to send these requests
+     * to the server represented by this BluetoothDevice object.
+     *
+     * @return call audio policy as {@link BluetoothSinkAudioPolicy} object
+     *
+     * @hide
+     */
+    @RequiresBluetoothConnectPermission
+    @RequiresPermission(allOf = {
+            android.Manifest.permission.BLUETOOTH_CONNECT,
+            android.Manifest.permission.BLUETOOTH_PRIVILEGED,
+    })
+    public @Nullable BluetoothSinkAudioPolicy getRequestedAudioPolicyAsSink() {
+        if (DBG) log("getRequestedAudioPolicyAsSink");
+        final IBluetooth service = getService();
+        if (service == null || !isBluetoothEnabled()) {
+            Log.e(TAG, "Bluetooth is not enabled. Cannot get Audio Policy.");
+            if (DBG) log(Log.getStackTraceString(new Throwable()));
+        } else {
+            try {
+                final SynchronousResultReceiver<BluetoothSinkAudioPolicy>
+                        recv = SynchronousResultReceiver.get();
+                service.getRequestedAudioPolicyAsSink(this, mAttributionSource, recv);
+                return recv.awaitResultNoInterrupt(getSyncTimeout()).getValue(null);
+            } catch (RemoteException | TimeoutException e) {
+                Log.e(TAG, e.toString() + "\n" + Log.getStackTraceString(new Throwable()));
+            }
+        }
+        return null;
     }
 
     /**
@@ -3262,7 +3419,7 @@
     })
     public boolean setLowLatencyAudioAllowed(boolean allowed) {
         if (DBG) log("setLowLatencyAudioAllowed(" + allowed + ")");
-        final IBluetooth service = sService;
+        final IBluetooth service = getService();
         final boolean defaultValue = false;
         if (service == null || !isBluetoothEnabled()) {
             Log.e(TAG, "Bluetooth is not enabled. Cannot allow low latency");
diff --git a/framework/java/android/bluetooth/BluetoothHeadset.java b/framework/java/android/bluetooth/BluetoothHeadset.java
index dcf0ab7..bc591c9 100644
--- a/framework/java/android/bluetooth/BluetoothHeadset.java
+++ b/framework/java/android/bluetooth/BluetoothHeadset.java
@@ -31,16 +31,10 @@
 import android.bluetooth.annotations.RequiresLegacyBluetoothPermission;
 import android.compat.annotation.UnsupportedAppUsage;
 import android.content.AttributionSource;
-import android.content.ComponentName;
 import android.content.Context;
-import android.content.pm.PackageManager;
 import android.os.Build;
-import android.os.Handler;
 import android.os.IBinder;
-import android.os.Looper;
-import android.os.Message;
 import android.os.RemoteException;
-import android.util.CloseGuard;
 import android.util.Log;
 
 import com.android.modules.utils.SynchronousResultReceiver;
@@ -344,90 +338,25 @@
     public static final String EXTRA_HF_INDICATORS_IND_VALUE =
             "android.bluetooth.headset.extra.HF_INDICATORS_IND_VALUE";
 
-    private static final int MESSAGE_HEADSET_SERVICE_CONNECTED = 100;
-    private static final int MESSAGE_HEADSET_SERVICE_DISCONNECTED = 101;
-
-    private final CloseGuard mCloseGuard = new CloseGuard();
-
-    private Context mContext;
-    private ServiceListener mServiceListener;
-    private volatile IBluetoothHeadset mService;
     private final BluetoothAdapter mAdapter;
     private final AttributionSource mAttributionSource;
-
-    @SuppressLint("AndroidFrameworkBluetoothPermission")
-    private final IBluetoothStateChangeCallback mBluetoothStateChangeCallback =
-            new IBluetoothStateChangeCallback.Stub() {
-                public void onBluetoothStateChange(boolean up) {
-                    if (DBG) Log.d(TAG, "onBluetoothStateChange: up=" + up);
-                    if (!up) {
-                        doUnbind();
-                    } else {
-                        doBind();
-                    }
+    private final BluetoothProfileConnector<IBluetoothHeadset> mProfileConnector =
+            new BluetoothProfileConnector(this, BluetoothProfile.HEADSET, "BluetoothHeadset",
+                    IBluetoothHeadset.class.getName()) {
+                @Override
+                public IBluetoothHeadset getServiceInterface(IBinder service) {
+                    return IBluetoothHeadset.Stub.asInterface(service);
                 }
-            };
+    };
 
     /**
      * Create a BluetoothHeadset proxy object.
      */
-    /* package */ BluetoothHeadset(Context context, ServiceListener l, BluetoothAdapter adapter) {
-        mContext = context;
-        mServiceListener = l;
+    /* package */ BluetoothHeadset(Context context, ServiceListener listener,
+            BluetoothAdapter adapter) {
         mAdapter = adapter;
         mAttributionSource = adapter.getAttributionSource();
-
-        // Preserve legacy compatibility where apps were depending on
-        // registerStateChangeCallback() performing a permissions check which
-        // has been relaxed in modern platform versions
-        if (context.getApplicationInfo().targetSdkVersion <= Build.VERSION_CODES.R
-                && context.checkSelfPermission(android.Manifest.permission.BLUETOOTH)
-                        != PackageManager.PERMISSION_GRANTED) {
-            throw new SecurityException("Need BLUETOOTH permission");
-        }
-
-        IBluetoothManager mgr = mAdapter.getBluetoothManager();
-        if (mgr != null) {
-            try {
-                mgr.registerStateChangeCallback(mBluetoothStateChangeCallback);
-            } catch (RemoteException e) {
-                Log.e(TAG, "", e);
-            }
-        }
-
-        doBind();
-        mCloseGuard.open("close");
-    }
-
-    private boolean doBind() {
-        synchronized (mConnection) {
-            if (mService == null) {
-                if (VDBG) Log.d(TAG, "Binding service...");
-                try {
-                    return mAdapter.getBluetoothManager().bindBluetoothProfileService(
-                            BluetoothProfile.HEADSET, mConnection);
-                } catch (RemoteException e) {
-                    Log.e(TAG, "Unable to bind HeadsetService", e);
-                }
-            }
-        }
-        return false;
-    }
-
-    private void doUnbind() {
-        synchronized (mConnection) {
-            if (mService != null) {
-                if (VDBG) Log.d(TAG, "Unbinding service...");
-                try {
-                    mAdapter.getBluetoothManager().unbindBluetoothProfileService(
-                            BluetoothProfile.HEADSET, mConnection);
-                } catch (RemoteException e) {
-                    Log.e(TAG, "Unable to unbind HeadsetService", e);
-                } finally {
-                    mService = null;
-                }
-            }
-        }
+        mProfileConnector.connect(context, listener);
     }
 
     /**
@@ -438,26 +367,18 @@
      */
     @UnsupportedAppUsage
     /*package*/ void close() {
-        if (VDBG) log("close()");
+        mProfileConnector.disconnect();
+    }
 
-        IBluetoothManager mgr = mAdapter.getBluetoothManager();
-        if (mgr != null) {
-            try {
-                mgr.unregisterStateChangeCallback(mBluetoothStateChangeCallback);
-            } catch (RemoteException re) {
-                Log.e(TAG, "", re);
-            }
-        }
-        mServiceListener = null;
-        doUnbind();
-        mCloseGuard.close();
+    private IBluetoothHeadset getService() {
+        return mProfileConnector.getService();
     }
 
     /** {@hide} */
     @Override
     protected void finalize() throws Throwable {
-        mCloseGuard.warnIfOpen();
-        close();
+        // The empty finalize needs to be kept or the
+        // cts signature tests would fail.
     }
 
     /**
@@ -487,7 +408,7 @@
     })
     public boolean connect(BluetoothDevice device) {
         if (DBG) log("connect(" + device + ")");
-        final IBluetoothHeadset service = mService;
+        final IBluetoothHeadset service = getService();
         final boolean defaultValue = false;
         if (service == null) {
             Log.w(TAG, "Proxy not attached to service");
@@ -532,7 +453,7 @@
     @RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)
     public boolean disconnect(BluetoothDevice device) {
         if (DBG) log("disconnect(" + device + ")");
-        final IBluetoothHeadset service = mService;
+        final IBluetoothHeadset service = getService();
         final boolean defaultValue = false;
         if (service == null) {
             Log.w(TAG, "Proxy not attached to service");
@@ -557,7 +478,7 @@
     @RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)
     public List<BluetoothDevice> getConnectedDevices() {
         if (VDBG) log("getConnectedDevices()");
-        final IBluetoothHeadset service = mService;
+        final IBluetoothHeadset service = getService();
         final List<BluetoothDevice> defaultValue = new ArrayList<BluetoothDevice>();
         if (service == null) {
             Log.w(TAG, "Proxy not attached to service");
@@ -585,7 +506,7 @@
     @RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)
     public List<BluetoothDevice> getDevicesMatchingConnectionStates(int[] states) {
         if (VDBG) log("getDevicesMatchingStates()");
-        final IBluetoothHeadset service = mService;
+        final IBluetoothHeadset service = getService();
         final List<BluetoothDevice> defaultValue = new ArrayList<BluetoothDevice>();
         if (service == null) {
             Log.w(TAG, "Proxy not attached to service");
@@ -613,7 +534,7 @@
     @RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)
     public int getConnectionState(BluetoothDevice device) {
         if (VDBG) log("getConnectionState(" + device + ")");
-        final IBluetoothHeadset service = mService;
+        final IBluetoothHeadset service = getService();
         final int defaultValue = BluetoothProfile.STATE_DISCONNECTED;
         if (service == null) {
             Log.w(TAG, "Proxy not attached to service");
@@ -652,7 +573,7 @@
     public boolean setConnectionPolicy(@NonNull BluetoothDevice device,
             @ConnectionPolicy int connectionPolicy) {
         if (DBG) log("setConnectionPolicy(" + device + ", " + connectionPolicy + ")");
-        final IBluetoothHeadset service = mService;
+        final IBluetoothHeadset service = getService();
         final boolean defaultValue = false;
         if (service == null) {
             Log.w(TAG, "Proxy not attached to service");
@@ -710,7 +631,7 @@
     })
     public @ConnectionPolicy int getConnectionPolicy(@NonNull BluetoothDevice device) {
         if (VDBG) log("getConnectionPolicy(" + device + ")");
-        final IBluetoothHeadset service = mService;
+        final IBluetoothHeadset service = getService();
         final int defaultValue = BluetoothProfile.CONNECTION_POLICY_FORBIDDEN;
         if (service == null) {
             Log.w(TAG, "Proxy not attached to service");
@@ -738,7 +659,7 @@
     @RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)
     public boolean isNoiseReductionSupported(@NonNull BluetoothDevice device) {
         if (DBG) log("isNoiseReductionSupported()");
-        final IBluetoothHeadset service = mService;
+        final IBluetoothHeadset service = getService();
         final boolean defaultValue = false;
         if (service == null) {
             Log.w(TAG, "Proxy not attached to service");
@@ -766,7 +687,7 @@
     @RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)
     public boolean isVoiceRecognitionSupported(@NonNull BluetoothDevice device) {
         if (DBG) log("isVoiceRecognitionSupported()");
-        final IBluetoothHeadset service = mService;
+        final IBluetoothHeadset service = getService();
         final boolean defaultValue = false;
         if (service == null) {
             Log.w(TAG, "Proxy not attached to service");
@@ -810,7 +731,7 @@
     })
     public boolean startVoiceRecognition(BluetoothDevice device) {
         if (DBG) log("startVoiceRecognition()");
-        final IBluetoothHeadset service = mService;
+        final IBluetoothHeadset service = getService();
         final boolean defaultValue = false;
         if (service == null) {
             Log.w(TAG, "Proxy not attached to service");
@@ -844,7 +765,7 @@
     @RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)
     public boolean stopVoiceRecognition(BluetoothDevice device) {
         if (DBG) log("stopVoiceRecognition()");
-        final IBluetoothHeadset service = mService;
+        final IBluetoothHeadset service = getService();
         final boolean defaultValue = false;
         if (service == null) {
             Log.w(TAG, "Proxy not attached to service");
@@ -872,7 +793,7 @@
     @RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)
     public boolean isAudioConnected(BluetoothDevice device) {
         if (VDBG) log("isAudioConnected()");
-        final IBluetoothHeadset service = mService;
+        final IBluetoothHeadset service = getService();
         final boolean defaultValue = false;
         if (service == null) {
             Log.w(TAG, "Proxy not attached to service");
@@ -918,7 +839,7 @@
     public @GetAudioStateReturnValues int getAudioState(@NonNull BluetoothDevice device) {
         if (VDBG) log("getAudioState");
         Objects.requireNonNull(device);
-        final IBluetoothHeadset service = mService;
+        final IBluetoothHeadset service = getService();
         final int defaultValue = BluetoothHeadset.STATE_AUDIO_DISCONNECTED;
         if (service == null) {
             Log.w(TAG, "Proxy not attached to service");
@@ -981,7 +902,7 @@
     })
     public @SetAudioRouteAllowedReturnValues int setAudioRouteAllowed(boolean allowed) {
         if (VDBG) log("setAudioRouteAllowed");
-        final IBluetoothHeadset service = mService;
+        final IBluetoothHeadset service = getService();
         if (service == null) {
             Log.w(TAG, "Proxy not attached to service");
             if (DBG) log(Log.getStackTraceString(new Throwable()));
@@ -1021,7 +942,7 @@
     })
     public @GetAudioRouteAllowedReturnValues int getAudioRouteAllowed() {
         if (VDBG) log("getAudioRouteAllowed");
-        final IBluetoothHeadset service = mService;
+        final IBluetoothHeadset service = getService();
         if (service == null) {
             Log.w(TAG, "Proxy not attached to service");
             if (DBG) log(Log.getStackTraceString(new Throwable()));
@@ -1056,7 +977,7 @@
     @RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)
     public void setForceScoAudio(boolean forced) {
         if (VDBG) log("setForceScoAudio " + String.valueOf(forced));
-        final IBluetoothHeadset service = mService;
+        final IBluetoothHeadset service = getService();
         if (service == null) {
             Log.w(TAG, "Proxy not attached to service");
             if (DBG) log(Log.getStackTraceString(new Throwable()));
@@ -1109,7 +1030,7 @@
     })
     public @ConnectAudioReturnValues int connectAudio() {
         if (VDBG) log("connectAudio()");
-        final IBluetoothHeadset service = mService;
+        final IBluetoothHeadset service = getService();
         final int defaultValue = BluetoothStatusCodes.ERROR_UNKNOWN;
         if (service == null) {
             Log.w(TAG, "Proxy not attached to service");
@@ -1164,7 +1085,7 @@
     })
     public @DisconnectAudioReturnValues int disconnectAudio() {
         if (VDBG) log("disconnectAudio()");
-        final IBluetoothHeadset service = mService;
+        final IBluetoothHeadset service = getService();
         final int defaultValue = BluetoothStatusCodes.ERROR_UNKNOWN;
         if (service == null) {
             Log.w(TAG, "Proxy not attached to service");
@@ -1219,7 +1140,7 @@
     })
     public boolean startScoUsingVirtualVoiceCall() {
         if (DBG) log("startScoUsingVirtualVoiceCall()");
-        final IBluetoothHeadset service = mService;
+        final IBluetoothHeadset service = getService();
         final boolean defaultValue = false;
         if (service == null) {
             Log.w(TAG, "Proxy not attached to service");
@@ -1258,7 +1179,7 @@
     })
     public boolean stopScoUsingVirtualVoiceCall() {
         if (DBG) log("stopScoUsingVirtualVoiceCall()");
-        final IBluetoothHeadset service = mService;
+        final IBluetoothHeadset service = getService();
         final boolean defaultValue = false;
         if (service == null) {
             Log.w(TAG, "Proxy not attached to service");
@@ -1291,7 +1212,7 @@
     })
     public void phoneStateChanged(int numActive, int numHeld, int callState, String number,
             int type, String name) {
-        final IBluetoothHeadset service = mService;
+        final IBluetoothHeadset service = getService();
         if (service == null) {
             Log.w(TAG, "Proxy not attached to service");
             if (DBG) log(Log.getStackTraceString(new Throwable()));
@@ -1317,7 +1238,7 @@
     })
     public void clccResponse(int index, int direction, int status, int mode, boolean mpty,
             String number, int type) {
-        final IBluetoothHeadset service = mService;
+        final IBluetoothHeadset service = getService();
         if (service == null) {
             Log.w(TAG, "Proxy not attached to service");
             if (DBG) log(Log.getStackTraceString(new Throwable()));
@@ -1360,7 +1281,7 @@
         if (command == null) {
             throw new IllegalArgumentException("command is null");
         }
-        final IBluetoothHeadset service = mService;
+        final IBluetoothHeadset service = getService();
         final boolean defaultValue = false;
         if (service == null) {
             Log.w(TAG, "Proxy not attached to service");
@@ -1408,7 +1329,7 @@
         if (DBG) {
             Log.d(TAG, "setActiveDevice: " + device);
         }
-        final IBluetoothHeadset service = mService;
+        final IBluetoothHeadset service = getService();
         final boolean defaultValue = false;
         if (service == null) {
             Log.w(TAG, "Proxy not attached to service");
@@ -1439,7 +1360,7 @@
     @RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)
     public BluetoothDevice getActiveDevice() {
         if (VDBG) Log.d(TAG, "getActiveDevice");
-        final IBluetoothHeadset service = mService;
+        final IBluetoothHeadset service = getService();
         final BluetoothDevice defaultValue = null;
         if (service == null) {
             Log.w(TAG, "Proxy not attached to service");
@@ -1475,7 +1396,7 @@
     })
     public boolean isInbandRingingEnabled() {
         if (DBG) log("isInbandRingingEnabled()");
-        final IBluetoothHeadset service = mService;
+        final IBluetoothHeadset service = getService();
         final boolean defaultValue = false;
         if (service == null) {
             Log.w(TAG, "Proxy not attached to service");
@@ -1492,26 +1413,6 @@
         return defaultValue;
     }
 
-    @SuppressLint("AndroidFrameworkBluetoothPermission")
-    private final IBluetoothProfileServiceConnection mConnection =
-            new IBluetoothProfileServiceConnection.Stub() {
-        @Override
-        public void onServiceConnected(ComponentName className, IBinder service) {
-            if (DBG) Log.d(TAG, "Proxy object connected");
-            mService = IBluetoothHeadset.Stub.asInterface(service);
-            mHandler.sendMessage(mHandler.obtainMessage(
-                    MESSAGE_HEADSET_SERVICE_CONNECTED));
-        }
-
-        @Override
-        public void onServiceDisconnected(ComponentName className) {
-            if (DBG) Log.d(TAG, "Proxy object disconnected");
-            doUnbind();
-            mHandler.sendMessage(mHandler.obtainMessage(
-                    MESSAGE_HEADSET_SERVICE_DISCONNECTED));
-        }
-    };
-
     @UnsupportedAppUsage
     private boolean isEnabled() {
         return mAdapter.getState() == BluetoothAdapter.STATE_ON;
@@ -1528,26 +1429,4 @@
     private static void log(String msg) {
         Log.d(TAG, msg);
     }
-
-    @SuppressLint("AndroidFrameworkBluetoothPermission")
-    private final Handler mHandler = new Handler(Looper.getMainLooper()) {
-        @Override
-        public void handleMessage(Message msg) {
-            switch (msg.what) {
-                case MESSAGE_HEADSET_SERVICE_CONNECTED: {
-                    if (mServiceListener != null) {
-                        mServiceListener.onServiceConnected(BluetoothProfile.HEADSET,
-                                BluetoothHeadset.this);
-                    }
-                    break;
-                }
-                case MESSAGE_HEADSET_SERVICE_DISCONNECTED: {
-                    if (mServiceListener != null) {
-                        mServiceListener.onServiceDisconnected(BluetoothProfile.HEADSET);
-                    }
-                    break;
-                }
-            }
-        }
-    };
 }
diff --git a/framework/java/android/bluetooth/BluetoothLeAudio.java b/framework/java/android/bluetooth/BluetoothLeAudio.java
index ea39b64..685c08e 100644
--- a/framework/java/android/bluetooth/BluetoothLeAudio.java
+++ b/framework/java/android/bluetooth/BluetoothLeAudio.java
@@ -233,7 +233,7 @@
      * Indicates conversation between humans as, for example, in telephony or video calls.
      * @hide
      */
-    public static final int CONTEXT_TYPE_COMMUNICATION = 0x0002;
+    public static final int CONTEXT_TYPE_CONVERSATIONAL = 0x0002;
 
     /**
      * Indicates media as, for example, in music, public radio, podcast or video soundtrack.
@@ -242,64 +242,66 @@
     public static final int CONTEXT_TYPE_MEDIA = 0x0004;
 
     /**
-     * Indicates instructional audio as, for example, in navigation, traffic announcements
-     * or user guidance.
+     * Indicates audio associated with a video gaming.
      * @hide
      */
-    public static final int CONTEXT_TYPE_INSTRUCTIONAL = 0x0008;
+    public static final int CONTEXT_TYPE_GAME = 0x0008;
 
     /**
-     * Indicates attention seeking audio as, for example, in beeps signalling arrival of a message
-     * or keyboard clicks.
+     * Indicates instructional audio as, for example, in navigation, announcements or user
+     * guidance.
      * @hide
      */
-    public static final int CONTEXT_TYPE_ATTENTION_SEEKING = 0x0010;
-
-    /**
-     * Indicates immediate alerts as, for example, in a low battery alarm, timer expiry or alarm
-     * clock.
-     * @hide
-     */
-    public static final int CONTEXT_TYPE_IMMEDIATE_ALERT = 0x0020;
+    public static final int CONTEXT_TYPE_INSTRUCTIONAL = 0x0010;
 
     /**
      * Indicates man machine communication as, for example, with voice recognition or virtual
      * assistant.
      * @hide
      */
-    public static final int CONTEXT_TYPE_MAN_MACHINE = 0x0040;
+    public static final int CONTEXT_TYPE_VOICE_ASSISTANTS = 0x0020;
 
     /**
-     * Indicates emergency alerts as, for example, with fire alarms or other urgent alerts.
+     * Indicates audio associated with a live audio stream.
+     *
      * @hide
      */
-    public static final int CONTEXT_TYPE_EMERGENCY_ALERT = 0x0080;
+    public static final int CONTEXT_TYPE_LIVE = 0x0040;
+
+    /**
+     * Indicates sound effects as, for example, in keyboard, touch feedback; menu and user
+     * interface sounds, and other system sounds.
+     * @hide
+     */
+    public static final int CONTEXT_TYPE_SOUND_EFFECTS = 0x0080;
+
+    /**
+     * Indicates notification and reminder sounds, attention-seeking audio, for example, in beeps
+     * signaling the arrival of a message.
+     * @hide
+     */
+    public static final int CONTEXT_TYPE_NOTIFICATIONS = 0x0100;
+
 
     /**
      * Indicates ringtone as in a call alert.
      * @hide
      */
-    public static final int CONTEXT_TYPE_RINGTONE = 0x0100;
+    public static final int CONTEXT_TYPE_RINGTONE = 0x0200;
 
     /**
-     * Indicates audio associated with a television program and/or with metadata conforming to the
-     * Bluetooth Broadcast TV profile.
+     * Indicates alerts and timers, immediate alerts as, for example, in a low battery alarm,
+     * timer expiry or alarm clock.
      * @hide
      */
-    public static final int CONTEXT_TYPE_TV = 0x0200;
+    public static final int CONTEXT_TYPE_ALERTS = 0x0400;
+
 
     /**
-     * Indicates audio associated with a low latency live audio stream.
-     *
+     * Indicates emergency alarm as, for example, with fire alarms or other urgent alerts.
      * @hide
      */
-    public static final int CONTEXT_TYPE_LIVE = 0x0400;
-
-    /**
-     * Indicates audio associated with a video game stream.
-     * @hide
-     */
-    public static final int CONTEXT_TYPE_GAME = 0x0800;
+    public static final int CONTEXT_TYPE_EMERGENCY_ALARM = 0x0800;
 
     /**
      * This represents an invalid group ID.
diff --git a/framework/java/android/bluetooth/BluetoothLeAudioCodecConfigMetadata.java b/framework/java/android/bluetooth/BluetoothLeAudioCodecConfigMetadata.java
index 4e6fd7f..74c0695 100644
--- a/framework/java/android/bluetooth/BluetoothLeAudioCodecConfigMetadata.java
+++ b/framework/java/android/bluetooth/BluetoothLeAudioCodecConfigMetadata.java
@@ -59,7 +59,7 @@
 
     @Override
     public int hashCode() {
-        return Objects.hash(mAudioLocation, mRawMetadata);
+        return Objects.hash(mAudioLocation, Arrays.hashCode(mRawMetadata));
     }
 
     /**
diff --git a/framework/java/android/bluetooth/BluetoothLeCallControl.java b/framework/java/android/bluetooth/BluetoothLeCallControl.java
index 5ad9e5d..e3d9378 100644
--- a/framework/java/android/bluetooth/BluetoothLeCallControl.java
+++ b/framework/java/android/bluetooth/BluetoothLeCallControl.java
@@ -17,33 +17,23 @@
 
 package android.bluetooth;
 
-import android.Manifest;
 import android.annotation.IntDef;
 import android.annotation.NonNull;
 import android.annotation.Nullable;
 import android.annotation.RequiresPermission;
-import android.bluetooth.annotations.RequiresBluetoothConnectPermission;
-import android.content.ComponentName;
+import android.annotation.SuppressLint;
 import android.content.AttributionSource;
 import android.content.Context;
 import android.os.Binder;
-import android.os.Handler;
 import android.os.IBinder;
-import android.os.Looper;
-import android.os.Message;
 import android.os.ParcelUuid;
 import android.os.RemoteException;
 import android.util.Log;
-import android.annotation.SuppressLint;
 
 import java.lang.annotation.Retention;
 import java.lang.annotation.RetentionPolicy;
 import java.util.ArrayList;
-import java.util.HashMap;
-import java.util.HashSet;
 import java.util.List;
-import java.util.Map;
-import java.util.Set;
 import java.util.UUID;
 import java.util.concurrent.Executor;
 
@@ -199,9 +189,6 @@
      */
     public static final int CAPABILITY_JOIN_CALLS = 0x00000002;
 
-    private static final int MESSAGE_TBS_SERVICE_CONNECTED = 102;
-    private static final int MESSAGE_TBS_SERVICE_DISCONNECTED = 103;
-
     private static final int REG_TIMEOUT = 10000;
 
     /**
@@ -387,83 +374,29 @@
         }
     };
 
-    private Context mContext;
-    private ServiceListener mServiceListener;
-    private volatile IBluetoothLeCallControl mService;
     private BluetoothAdapter mAdapter;
     private final AttributionSource mAttributionSource;
     private int mCcid = 0;
     private String mToken;
     private Callback mCallback = null;
-
-    private final IBluetoothStateChangeCallback mBluetoothStateChangeCallback =
-        new IBluetoothStateChangeCallback.Stub() {
-        public void onBluetoothStateChange(boolean up) {
-            if (DBG)
-                Log.d(TAG, "onBluetoothStateChange: up=" + up);
-            if (!up) {
-                doUnbind();
-            } else {
-                doBind();
-            }
-        }
+    private final BluetoothProfileConnector<IBluetoothLeCallControl> mProfileConnector =
+            new BluetoothProfileConnector(this, BluetoothProfile.LE_CALL_CONTROL,
+                    "BluetoothLeCallControl", IBluetoothLeCallControl.class.getName()) {
+                @Override
+                public IBluetoothLeCallControl getServiceInterface(IBinder service) {
+                    return IBluetoothLeCallControl.Stub.asInterface(service);
+                }
     };
 
+
     /**
      * Create a BluetoothLeCallControl proxy object for interacting with the local Bluetooth
      * telephone bearer service.
      */
     /* package */ BluetoothLeCallControl(Context context, ServiceListener listener) {
-        mContext = context;
         mAdapter = BluetoothAdapter.getDefaultAdapter();
         mAttributionSource = mAdapter.getAttributionSource();
-        mServiceListener = listener;
-
-        IBluetoothManager mgr = mAdapter.getBluetoothManager();
-        if (mgr != null) {
-            try {
-                mgr.registerStateChangeCallback(mBluetoothStateChangeCallback);
-            } catch (RemoteException e) {
-                Log.e(TAG, "", e);
-            }
-        }
-
-        doBind();
-    }
-
-    private boolean doBind() {
-        synchronized (mConnection) {
-            if (mService == null) {
-                if (VDBG)
-                    Log.d(TAG, "Binding service...");
-                try {
-                    return mAdapter.getBluetoothManager().
-                            bindBluetoothProfileService(BluetoothProfile.LE_CALL_CONTROL,
-                            mConnection);
-                } catch (RemoteException e) {
-                    Log.e(TAG, "Unable to bind TelephoneBearerService", e);
-                }
-            }
-        }
-        return false;
-    }
-
-    private void doUnbind() {
-        synchronized (mConnection) {
-            if (mService != null) {
-                if (VDBG)
-                    Log.d(TAG, "Unbinding service...");
-                try {
-                    mAdapter.getBluetoothManager().
-                        unbindBluetoothProfileService(BluetoothProfile.LE_CALL_CONTROL,
-                        mConnection);
-                } catch (RemoteException e) {
-                    Log.e(TAG, "Unable to unbind TelephoneBearerService", e);
-                } finally {
-                    mService = null;
-                }
-            }
-        }
+        mProfileConnector.connect(context, listener);
     }
 
     /* package */ void close() {
@@ -471,20 +404,11 @@
             log("close()");
         unregisterBearer();
 
-        IBluetoothManager mgr = mAdapter.getBluetoothManager();
-        if (mgr != null) {
-            try {
-                mgr.unregisterStateChangeCallback(mBluetoothStateChangeCallback);
-            } catch (RemoteException re) {
-                Log.e(TAG, "", re);
-            }
-        }
-        mServiceListener = null;
-        doUnbind();
+        mProfileConnector.disconnect();
     }
 
     private IBluetoothLeCallControl getService() {
-        return mService;
+        return mProfileConnector.getService();
     }
 
     /**
@@ -863,46 +787,4 @@
     private static void log(String msg) {
         Log.d(TAG, msg);
     }
-
-    private final IBluetoothProfileServiceConnection mConnection =
-                                    new IBluetoothProfileServiceConnection.Stub() {
-        @Override
-        public void onServiceConnected(ComponentName className, IBinder service) {
-            if (DBG) {
-                Log.d(TAG, "Proxy object connected");
-            }
-            mService = IBluetoothLeCallControl.Stub.asInterface(service);
-            mHandler.sendMessage(mHandler.obtainMessage(MESSAGE_TBS_SERVICE_CONNECTED));
-        }
-
-        @Override
-        public void onServiceDisconnected(ComponentName className) {
-            if (DBG) {
-                Log.d(TAG, "Proxy object disconnected");
-            }
-            doUnbind();
-            mHandler.sendMessage(mHandler.obtainMessage(MESSAGE_TBS_SERVICE_DISCONNECTED));
-        }
-    };
-
-    private final Handler mHandler = new Handler(Looper.getMainLooper()) {
-        @Override
-        public void handleMessage(Message msg) {
-            switch (msg.what) {
-            case MESSAGE_TBS_SERVICE_CONNECTED: {
-                if (mServiceListener != null) {
-                    mServiceListener.onServiceConnected(BluetoothProfile.LE_CALL_CONTROL,
-                        BluetoothLeCallControl.this);
-                }
-                break;
-            }
-            case MESSAGE_TBS_SERVICE_DISCONNECTED: {
-                if (mServiceListener != null) {
-                    mServiceListener.onServiceDisconnected(BluetoothProfile.LE_CALL_CONTROL);
-                }
-                break;
-            }
-            }
-        }
-    };
 }
diff --git a/framework/java/android/bluetooth/BluetoothMapClient.java b/framework/java/android/bluetooth/BluetoothMapClient.java
index 5241410..edbe43f 100644
--- a/framework/java/android/bluetooth/BluetoothMapClient.java
+++ b/framework/java/android/bluetooth/BluetoothMapClient.java
@@ -40,6 +40,7 @@
 import com.android.modules.utils.SynchronousResultReceiver;
 
 import java.util.ArrayList;
+import java.util.Arrays;
 import java.util.Collection;
 import java.util.List;
 import java.util.concurrent.TimeoutException;
@@ -615,7 +616,10 @@
     })
     public boolean sendMessage(BluetoothDevice device, Uri[] contacts, String message,
             PendingIntent sentIntent, PendingIntent deliveredIntent) {
-        if (DBG) Log.d(TAG, "sendMessage(" + device + ", " + contacts + ", " + message);
+        if (DBG) {
+            Log.d(TAG, "sendMessage(" + device + ", " + Arrays.toString(contacts)
+                    + ", " + message);
+        }
         final IBluetoothMapClient service = getService();
         final boolean defaultValue = false;
         if (service == null) {
diff --git a/framework/java/android/bluetooth/BluetoothProfileConnector.java b/framework/java/android/bluetooth/BluetoothProfileConnector.java
index dfc35ea..8620ed6 100644
--- a/framework/java/android/bluetooth/BluetoothProfileConnector.java
+++ b/framework/java/android/bluetooth/BluetoothProfileConnector.java
@@ -22,12 +22,14 @@
 import android.content.ComponentName;
 import android.content.Context;
 import android.content.Intent;
-import android.content.ServiceConnection;
 import android.content.pm.ApplicationInfo;
 import android.content.pm.PackageManager;
 import android.content.pm.ResolveInfo;
 import android.os.Build;
+import android.os.Handler;
 import android.os.IBinder;
+import android.os.Looper;
+import android.os.Message;
 import android.os.RemoteException;
 import android.os.UserHandle;
 import android.util.CloseGuard;
@@ -54,6 +56,9 @@
     // -3 match with UserHandle.USER_CURRENT_OR_SELF
     private static final UserHandle USER_HANDLE_CURRENT_OR_SELF = UserHandle.of(-3);
 
+    private static final int MESSAGE_SERVICE_CONNECTED = 100;
+    private static final int MESSAGE_SERVICE_DISCONNECTED = 101;
+
     private final IBluetoothStateChangeCallback mBluetoothStateChangeCallback =
             new IBluetoothStateChangeCallback.Stub() {
         public void onBluetoothStateChange(boolean up) {
@@ -89,22 +94,22 @@
         return comp;
     }
 
-    private final ServiceConnection mConnection = new ServiceConnection() {
+    private final IBluetoothProfileServiceConnection mConnection =
+            new IBluetoothProfileServiceConnection.Stub() {
+        @Override
         public void onServiceConnected(ComponentName className, IBinder service) {
             logDebug("Proxy object connected");
             mService = getServiceInterface(service);
-
-            if (mServiceListener != null) {
-                mServiceListener.onServiceConnected(mProfileId, mProfileProxy);
-            }
+            mHandler.sendMessage(mHandler.obtainMessage(
+                    MESSAGE_SERVICE_CONNECTED));
         }
 
+        @Override
         public void onServiceDisconnected(ComponentName className) {
             logDebug("Proxy object disconnected");
             doUnbind();
-            if (mServiceListener != null) {
-                mServiceListener.onServiceDisconnected(mProfileId);
-            }
+            mHandler.sendMessage(mHandler.obtainMessage(
+                    MESSAGE_SERVICE_DISCONNECTED));
         }
     };
 
@@ -123,23 +128,16 @@
         doUnbind();
     }
 
-    @SuppressLint("AndroidFrameworkRequiresPermission")
     private boolean doBind() {
         synchronized (mConnection) {
             if (mService == null) {
                 logDebug("Binding service...");
                 mCloseGuard.open("doUnbind");
                 try {
-                    Intent intent = new Intent(mServiceName);
-                    ComponentName comp = resolveSystemService(intent, mContext.getPackageManager());
-                    intent.setComponent(comp);
-                    if (comp == null || !mContext.bindServiceAsUser(intent, mConnection, 0,
-                            USER_HANDLE_CURRENT_OR_SELF)) {
-                        logError("Could not bind to Bluetooth Service with " + intent);
-                        return false;
-                    }
-                } catch (SecurityException se) {
-                    logError("Failed to bind service. " + se);
+                    return BluetoothAdapter.getDefaultAdapter().getBluetoothManager()
+                            .bindBluetoothProfileService(mProfileId, mServiceName, mConnection);
+                } catch (RemoteException re) {
+                    logError("Failed to bind service. " + re);
                     return false;
                 }
             }
@@ -153,9 +151,10 @@
                 logDebug("Unbinding service...");
                 mCloseGuard.close();
                 try {
-                    mContext.unbindService(mConnection);
-                } catch (IllegalArgumentException ie) {
-                    logError("Unable to unbind service: " + ie);
+                    BluetoothAdapter.getDefaultAdapter().getBluetoothManager()
+                            .unbindBluetoothProfileService(mProfileId, mConnection);
+                } catch (RemoteException re) {
+                    logError("Unable to unbind service: " + re);
                 } finally {
                     mService = null;
                 }
@@ -188,7 +187,11 @@
     }
 
     void disconnect() {
-        mServiceListener = null;
+        if (mServiceListener != null) {
+            BluetoothProfile.ServiceListener listener = mServiceListener;
+            mServiceListener = null;
+            listener.onServiceDisconnected(mProfileId);
+        }
         IBluetoothManager mgr = BluetoothAdapter.getDefaultAdapter().getBluetoothManager();
         if (mgr != null) {
             try {
@@ -220,4 +223,25 @@
     private void logError(String log) {
         Log.e(mProfileName, log);
     }
+
+    @SuppressLint("AndroidFrameworkBluetoothPermission")
+    private final Handler mHandler = new Handler(Looper.getMainLooper()) {
+        @Override
+        public void handleMessage(Message msg) {
+            switch (msg.what) {
+                case MESSAGE_SERVICE_CONNECTED: {
+                    if (mServiceListener != null) {
+                        mServiceListener.onServiceConnected(mProfileId, mProfileProxy);
+                    }
+                    break;
+                }
+                case MESSAGE_SERVICE_DISCONNECTED: {
+                    if (mServiceListener != null) {
+                        mServiceListener.onServiceDisconnected(mProfileId);
+                    }
+                    break;
+                }
+            }
+        }
+    };
 }
diff --git a/framework/java/android/bluetooth/BluetoothServerSocket.java b/framework/java/android/bluetooth/BluetoothServerSocket.java
index bb4e354..5a23f7e3 100644
--- a/framework/java/android/bluetooth/BluetoothServerSocket.java
+++ b/framework/java/android/bluetooth/BluetoothServerSocket.java
@@ -75,7 +75,7 @@
 public final class BluetoothServerSocket implements Closeable {
 
     private static final String TAG = "BluetoothServerSocket";
-    private static final boolean DBG = false;
+    private static final boolean DBG = Log.isLoggable(TAG, Log.DEBUG);
     @UnsupportedAppUsage(publicAlternatives = "Use public {@link BluetoothServerSocket} API "
             + "instead.")
     /*package*/ final BluetoothSocket mSocket;
diff --git a/framework/java/android/bluetooth/BluetoothSinkAudioPolicy.java b/framework/java/android/bluetooth/BluetoothSinkAudioPolicy.java
new file mode 100644
index 0000000..8641e51
--- /dev/null
+++ b/framework/java/android/bluetooth/BluetoothSinkAudioPolicy.java
@@ -0,0 +1,325 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.bluetooth;
+
+import android.annotation.IntDef;
+import android.annotation.NonNull;
+import android.annotation.Nullable;
+import android.os.Parcel;
+import android.os.Parcelable;
+
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
+import java.util.Objects;
+
+/**
+ * Represents Bluetooth Audio Policies of a Handsfree (HF) device (if HFP is used)
+ * and Call Terminal (CT) device (if BLE Audio is used), which describes the
+ * preferences of allowing or disallowing audio based on the use cases. The HF/CT
+ * devices shall send objects of this class to send its preference to the AG/CG
+ * devices.
+ *
+ * <p>HF/CT side applications on can use {@link BluetoothDevice#requestAudioPolicyAsSink}
+ * API to set and send a {@link BluetoothSinkAudioPolicy} object containing the
+ * preference/policy values. This object will be stored in the memory of HF/CT
+ * side, will be send to the AG/CG side using Android Specific AT Commands and will
+ * be stored in the AG side memory and database.
+ *
+ * <p>HF/CT side API {@link BluetoothDevice#getRequestedAudioPolicyAsSink} can be used to retrieve
+ * the stored audio policies currently.
+ *
+ * <p>Note that the setter APIs of this class will only set the values of the
+ * object. To actually set the policies, API {@link BluetoothDevice#requestAudioPolicyAsSink}
+ * must need to be invoked with the {@link BluetoothSinkAudioPolicy} object.
+ *
+ * <p>Note that any API related to this feature should be used after configuring
+ * the support of the AG device and after checking whether the AG device supports
+ * this feature or not by invoking {@link BluetoothDevice#isRequestAudioPolicyAsSinkSupported}.
+ * Only after getting a {@link BluetoothStatusCodes#FEATURE_SUPPORTED} response
+ * from the API should the APIs related to this feature be used.
+ *
+ *
+ * @hide
+ */
+public final class BluetoothSinkAudioPolicy implements Parcelable {
+
+    /**
+     * @hide
+    */
+    @Retention(RetentionPolicy.SOURCE)
+    @IntDef(
+        prefix = {"POLICY_"},
+        value = {
+            POLICY_UNCONFIGURED,
+            POLICY_ALLOWED,
+            POLICY_NOT_ALLOWED,
+        }
+    )
+    public @interface AudioPolicyValues{}
+
+    /**
+     * Audio behavior not configured for the policy.
+     *
+     * If a policy is set with this value, it means that the policy is not
+     * configured with a value yet and should not be used to make any decision.
+     * @hide
+     */
+    public static final int POLICY_UNCONFIGURED = 0;
+
+    /**
+     * Audio is preferred by HF device for the policy.
+     *
+     * If a policy is set with this value, then the HF device will prefer the
+     * audio for the policy use case. For example, if the Call Establish audio
+     * policy is set with this value, then the HF will prefer the audio
+     * during making or picking up a call.
+     * @hide
+     */
+    public static final int POLICY_ALLOWED = 1;
+
+    /**
+     * Audio is not preferred by HF device for the policy.
+     *
+     * If a policy is set with this value, then the HF device will not prefer the
+     * audio for the policy use case. For example, if the Call Establish audio
+     * policy is set with this value, then the HF will not prefer the audio
+     * during making or picking up a call.
+     * @hide
+     */
+    public static final int POLICY_NOT_ALLOWED = 2;
+
+    @AudioPolicyValues private final int mCallEstablishPolicy;
+    @AudioPolicyValues private final int mConnectingTimePolicy;
+    @AudioPolicyValues private final int mInBandRingtonePolicy;
+
+    /**
+     * @hide
+     */
+    public BluetoothSinkAudioPolicy(int callEstablishPolicy,
+            int connectingTimePolicy, int inBandRingtonePolicy) {
+        mCallEstablishPolicy = callEstablishPolicy;
+        mConnectingTimePolicy = connectingTimePolicy;
+        mInBandRingtonePolicy = inBandRingtonePolicy;
+    }
+
+    /**
+     * Get Call establishment policy audio policy.
+     * <p>This policy is used to determine the audio preference when the
+     * HF device makes or answers a call. That is, if this device
+     * makes or answers a call, is the audio preferred by HF.
+     *
+     * @return the call pick up audio policy value
+     *
+     * @hide
+     */
+    public @AudioPolicyValues int getCallEstablishPolicy() {
+        return mCallEstablishPolicy;
+    }
+
+    /**
+     * Get during connection audio up policy.
+     * <p>This policy is used to determine the audio preference when the
+     * HF device connects with the AG device. That is, when the
+     * HF device gets connected, should the HF become active and get audio
+     * is decided by this policy. This also covers the case of during a call.
+     * If the HF connects with the AG during an ongoing call, should the call
+     * audio be routed to the HF will be decided by this policy.
+     *
+     * @return the during connection audio policy value
+     *
+     * @hide
+     */
+    public @AudioPolicyValues int getActiveDevicePolicyAfterConnection() {
+        return mConnectingTimePolicy;
+    }
+
+    /**
+     * Get In band ringtone audio up policy.
+     * <p>This policy is used to determine the audio preference of the
+     * in band ringtone. That is, if there is an incoming call, should the
+     * inband ringtone audio be routed to the HF will be decided by this policy.
+     *
+     * @return the in band ringtone audio policy value
+     *
+     * @hide
+     */
+    public @AudioPolicyValues int getInBandRingtonePolicy() {
+        return mInBandRingtonePolicy;
+    }
+
+    @Override
+    public String toString() {
+        StringBuilder builder = new StringBuilder("BluetoothSinkAudioPolicy{");
+        builder.append("mCallEstablishPolicy: ");
+        builder.append(mCallEstablishPolicy);
+        builder.append(", mConnectingTimePolicy: ");
+        builder.append(mConnectingTimePolicy);
+        builder.append(", mInBandRingtonePolicy: ");
+        builder.append(mInBandRingtonePolicy);
+        builder.append("}");
+        return builder.toString();
+    }
+
+    /**
+     * {@link Parcelable.Creator} interface implementation.
+     */
+    public static final @android.annotation.NonNull Parcelable.Creator<BluetoothSinkAudioPolicy>
+            CREATOR = new Parcelable.Creator<BluetoothSinkAudioPolicy>() {
+                @Override
+                public BluetoothSinkAudioPolicy createFromParcel(@NonNull Parcel in) {
+                    return new BluetoothSinkAudioPolicy(
+                            in.readInt(), in.readInt(), in.readInt());
+                }
+
+                @Override
+                public BluetoothSinkAudioPolicy[] newArray(int size) {
+                    return new BluetoothSinkAudioPolicy[size];
+                }
+            };
+
+    @Override
+    public void writeToParcel(@NonNull Parcel out, int flags) {
+        out.writeInt(mCallEstablishPolicy);
+        out.writeInt(mConnectingTimePolicy);
+        out.writeInt(mInBandRingtonePolicy);
+    }
+
+    /**
+     * @hide
+     */
+    @Override
+    public int describeContents() {
+        return 0;
+    }
+
+    @Override
+    public boolean equals(@Nullable Object o) {
+        if (o instanceof BluetoothSinkAudioPolicy) {
+            BluetoothSinkAudioPolicy other = (BluetoothSinkAudioPolicy) o;
+            return (other.mCallEstablishPolicy == mCallEstablishPolicy
+                    && other.mConnectingTimePolicy == mConnectingTimePolicy
+                    && other.mInBandRingtonePolicy == mInBandRingtonePolicy);
+        }
+        return false;
+    }
+
+    /**
+     * Returns a hash representation of this BluetoothCodecConfig
+     * based on all the config values.
+     *
+     * @hide
+     */
+    @Override
+    public int hashCode() {
+        return Objects.hash(mCallEstablishPolicy, mConnectingTimePolicy, mInBandRingtonePolicy);
+    }
+
+    /**
+     * Builder for {@link BluetoothSinkAudioPolicy}.
+     * <p> By default, the audio policy values will be set to
+     * {@link BluetoothSinkAudioPolicy#POLICY_UNCONFIGURED}.
+     */
+    public static final class Builder {
+        private int mCallEstablishPolicy = POLICY_UNCONFIGURED;
+        private int mConnectingTimePolicy = POLICY_UNCONFIGURED;
+        private int mInBandRingtonePolicy = POLICY_UNCONFIGURED;
+
+        public Builder() {
+
+        }
+
+        public Builder(@NonNull BluetoothSinkAudioPolicy policies) {
+            mCallEstablishPolicy = policies.mCallEstablishPolicy;
+            mConnectingTimePolicy = policies.mConnectingTimePolicy;
+            mInBandRingtonePolicy = policies.mInBandRingtonePolicy;
+        }
+
+        /**
+         * Set Call Establish (pick up and answer) policy.
+         * <p>This policy is used to determine the audio preference when the
+         * HF device makes or answers a call. That is, if this device
+         * makes or answers a call, is the audio preferred by HF.
+         * <p>If set to {@link BluetoothSinkAudioPolicy#POLICY_ALLOWED}, answering or making
+         * a call from the HF device will route the call audio to it.
+         * If set to {@link BluetoothSinkAudioPolicy#POLICY_NOT_ALLOWED}, answering or making
+         * a call from the HF device will NOT route the call audio to it.
+         *
+         * @return reference to the current object
+         *
+         * @hide
+         */
+        public @NonNull Builder setCallEstablishPolicy(
+                @AudioPolicyValues int callEstablishPolicy) {
+            mCallEstablishPolicy = callEstablishPolicy;
+            return this;
+        }
+
+        /**
+         * Set during connection audio up policy.
+         * <p>This policy is used to determine the audio preference when the
+         * HF device connects with the AG device. That is, when the
+         * HF device gets connected, should the HF become active and get audio
+         * is decided by this policy. This also covers the case of during a call.
+         * If the HF connects with the AG during an ongoing call, should the call
+         * audio be routed to the HF will be decided by this policy.
+         * <p>If set to {@link BluetoothSinkAudioPolicy#POLICY_ALLOWED}, connecting HF
+         * during a call will route the call audio to it.
+         * If set to {@link BluetoothSinkAudioPolicy#POLICY_NOT_ALLOWED}, connecting HF
+         * during a call will NOT route the call audio to it.
+         *
+         * @return reference to the current object
+         *
+         * @hide
+         */
+        public @NonNull Builder setActiveDevicePolicyAfterConnection(
+                @AudioPolicyValues int connectingTimePolicy) {
+            mConnectingTimePolicy = connectingTimePolicy;
+            return this;
+        }
+
+        /**
+         * Set In band ringtone audio up policy.
+         * <p>This policy is used to determine the audio preference of the
+         * in band ringtone. That is, if there is an incoming call, should the
+         * inband ringtone audio be routed to the HF will be decided by this policy.
+         * <p>If set to {@link BluetoothSinkAudioPolicy#POLICY_ALLOWED}, there will be
+         * in band ringtone in the HF device during an incoming call.
+         * If set to {@link BluetoothSinkAudioPolicy#POLICY_NOT_ALLOWED}, there will NOT
+         * be in band ringtone in the HF device during an incoming call.
+         *
+         * @return reference to the current object
+         *
+         * @hide
+         */
+        public @NonNull Builder setInBandRingtonePolicy(
+                @AudioPolicyValues int inBandRingtonePolicy) {
+            mInBandRingtonePolicy = inBandRingtonePolicy;
+            return this;
+        }
+
+        /**
+         * Build {@link BluetoothSinkAudioPolicy}.
+         * @return new BluetoothSinkAudioPolicy object
+         *
+         * @hide
+         */
+        public @NonNull BluetoothSinkAudioPolicy build() {
+            return new BluetoothSinkAudioPolicy(
+                    mCallEstablishPolicy, mConnectingTimePolicy, mInBandRingtonePolicy);
+        }
+    }
+}
diff --git a/framework/java/android/bluetooth/BluetoothSocket.java b/framework/java/android/bluetooth/BluetoothSocket.java
index bf98d97..b57bfca 100644
--- a/framework/java/android/bluetooth/BluetoothSocket.java
+++ b/framework/java/android/bluetooth/BluetoothSocket.java
@@ -285,7 +285,7 @@
         BluetoothSocket as = new BluetoothSocket(this);
         as.mSocketState = SocketState.CONNECTED;
         FileDescriptor[] fds = mSocket.getAncillaryFileDescriptors();
-        if (DBG) Log.d(TAG, "socket fd passed by stack fds: " + Arrays.toString(fds));
+        if (DBG) Log.d(TAG, "acceptSocket: socket fd passed by stack fds:" + Arrays.toString(fds));
         if (fds == null || fds.length != 1) {
             Log.e(TAG, "socket fd passed from stack failed, fds: " + Arrays.toString(fds));
             as.close();
@@ -450,6 +450,7 @@
                     throw new IOException("bt socket closed");
                 }
                 mSocketState = SocketState.CONNECTED;
+                if (DBG) Log.d(TAG, "connect(), socket connected");
             }
         } catch (RemoteException e) {
             Log.e(TAG, e.toString() + "\n" + Log.getStackTraceString(new Throwable()));
@@ -536,8 +537,8 @@
         if (mSocketState != SocketState.LISTENING) {
             throw new IOException("bt socket is not in listen state");
         }
+        Log.d(TAG, "accept(), timeout (ms):" + timeout);
         if (timeout > 0) {
-            Log.d(TAG, "accept() set timeout (ms):" + timeout);
             mSocket.setSoTimeout(timeout);
         }
         String RemoteAddr = waitSocketSignal(mSocketIS);
@@ -845,5 +846,8 @@
         return ret;
     }
 
-
+    @Override
+    public String toString() {
+        return BluetoothUtils.toAnonymizedAddress(mAddress);
+    }
 }
diff --git a/framework/java/android/bluetooth/BluetoothStatusCodes.java b/framework/java/android/bluetooth/BluetoothStatusCodes.java
index 35e03f5..24be7fc 100644
--- a/framework/java/android/bluetooth/BluetoothStatusCodes.java
+++ b/framework/java/android/bluetooth/BluetoothStatusCodes.java
@@ -216,6 +216,12 @@
     public static final int ERROR_REMOTE_OPERATION_NOT_SUPPORTED = 27;
 
     /**
+     * Indicates that the feature status is not configured yet.
+     * @hide
+     */
+    public static final int FEATURE_NOT_CONFIGURED = 30;
+
+    /**
      * A GATT writeCharacteristic request is not permitted on the remote device.
      */
     public static final int ERROR_GATT_WRITE_NOT_ALLOWED = 200;
diff --git a/framework/java/android/bluetooth/BluetoothUtils.java b/framework/java/android/bluetooth/BluetoothUtils.java
index c1d66c5..43d0da9 100644
--- a/framework/java/android/bluetooth/BluetoothUtils.java
+++ b/framework/java/android/bluetooth/BluetoothUtils.java
@@ -175,4 +175,16 @@
         }
         return result;
     }
+
+    /**
+     * Convert an address to an obfuscate one for logging purpose
+     * @param address Mac address to be log
+     * @return Loggable mac address
+     */
+    public static String toAnonymizedAddress(String address) {
+        if (address == null || address.length() != 17) {
+            return null;
+        }
+        return "XX:XX:XX" + address.substring(8);
+    }
 }
diff --git a/framework/tests/Android.bp b/framework/tests/Android.bp
deleted file mode 100644
index efec1dd..0000000
--- a/framework/tests/Android.bp
+++ /dev/null
@@ -1,31 +0,0 @@
-package {
-    default_applicable_licenses: ["Android-Apache-2.0"],
-}
-
-android_test {
-    name: "BluetoothTests",
-
-    defaults: ["framework-bluetooth-tests-defaults"],
-
-    min_sdk_version: "current",
-    target_sdk_version: "current",
-
-    // Include all test java files.
-    srcs: ["src/**/*.java"],
-    jacoco: {
-        include_filter: ["android.bluetooth.*"],
-        exclude_filter: [],
-    },
-    libs: [
-        "android.test.runner",
-        "android.test.base",
-    ],
-    static_libs: [
-        "junit",
-        "modules-utils-bytesmatcher",
-    ],
-    test_suites: [
-        "general-tests",
-        "mts-bluetooth",
-    ],
-}
diff --git a/framework/tests/AndroidManifest.xml b/framework/tests/AndroidManifest.xml
deleted file mode 100644
index 75583d5..0000000
--- a/framework/tests/AndroidManifest.xml
+++ /dev/null
@@ -1,47 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<!-- Copyright (C) 2011 The Android Open Source Project
-
-     Licensed under the Apache License, Version 2.0 (the "License");
-     you may not use this file except in compliance with the License.
-     You may obtain a copy of the License at
-
-          http://www.apache.org/licenses/LICENSE-2.0
-
-     Unless required by applicable law or agreed to in writing, software
-     distributed under the License is distributed on an "AS IS" BASIS,
-     WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-     See the License for the specific language governing permissions and
-     limitations under the License.
--->
-
-<manifest xmlns:android="http://schemas.android.com/apk/res/android"
-          package="com.android.bluetooth.tests"
-          android:sharedUserId="android.uid.bluetooth" >
-
-    <uses-permission android:name="android.permission.BLUETOOTH" />
-    <uses-permission android:name="android.permission.BLUETOOTH_ADMIN" />
-    <uses-permission android:name="android.permission.BLUETOOTH_ADVERTISE"/>
-    <uses-permission android:name="android.permission.BLUETOOTH_CONNECT" />
-    <uses-permission android:name="android.permission.BLUETOOTH_SCAN" />
-    <uses-permission android:name="android.permission.BLUETOOTH_PRIVILEGED" />
-    <uses-permission android:name="android.permission.BROADCAST_STICKY" />
-    <uses-permission android:name="android.permission.CHANGE_NETWORK_STATE" />
-    <uses-permission android:name="android.permission.LOCAL_MAC_ADDRESS" />
-    <uses-permission android:name="android.permission.MODIFY_AUDIO_SETTINGS"/>
-    <uses-permission android:name="android.permission.RECEIVE_SMS" />
-    <uses-permission android:name="android.permission.READ_SMS"/>
-    <uses-permission android:name="android.permission.WRITE_EXTERNAL_STORAGE" />
-    <uses-permission android:name="android.permission.WRITE_SETTINGS" />
-    <uses-permission android:name="android.permission.WRITE_SECURE_SETTINGS" />
-
-    <application >
-        <uses-library android:name="android.test.runner" />
-    </application>
-    <instrumentation android:name="android.bluetooth.BluetoothTestRunner"
-            android:targetPackage="com.android.bluetooth.tests"
-            android:label="Bluetooth Tests" />
-    <instrumentation android:name="android.bluetooth.BluetoothInstrumentation"
-            android:targetPackage="com.android.bluetooth.tests"
-            android:label="Bluetooth Test Utils" />
-
-</manifest>
diff --git a/framework/tests/AndroidTest.xml b/framework/tests/AndroidTest.xml
deleted file mode 100644
index ed89c16..0000000
--- a/framework/tests/AndroidTest.xml
+++ /dev/null
@@ -1,38 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<!-- Copyright 2020 The Android Open Source Project
-
-     Licensed under the Apache License, Version 2.0 (the "License");
-     you may not use this file except in compliance with the License.
-     You may obtain a copy of the License at
-
-          http://www.apache.org/licenses/LICENSE-2.0
-
-     Unless required by applicable law or agreed to in writing, software
-     distributed under the License is distributed on an "AS IS" BASIS,
-     WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-     See the License for the specific language governing permissions and
-     limitations under the License.
--->
-<configuration description="Config for Bluetooth test cases">
-    <option name="test-suite-tag" value="apct"/>
-    <option name="test-suite-tag" value="apct-instrumentation"/>
-    <target_preparer class="com.android.tradefed.targetprep.suite.SuiteApkInstaller">
-        <option name="cleanup-apks" value="true" />
-        <option name="test-file-name" value="BluetoothTests.apk" />
-    </target_preparer>
-
-    <option name="test-suite-tag" value="apct"/>
-    <option name="test-tag" value="BluetoothTests"/>
-
-    <test class="com.android.tradefed.testtype.AndroidJUnitTest" >
-        <option name="package" value="com.android.bluetooth.tests" />
-        <option name="hidden-api-checks" value="false"/>
-        <option name="runner" value="android.bluetooth.BluetoothTestRunner"/>
-    </test>
-
-    <!-- Only run BluetoothTests in MTS if the Bluetooth Mainline module is installed. -->
-    <object type="module_controller"
-            class="com.android.tradefed.testtype.suite.module.MainlineTestModuleController">
-        <option name="mainline-module-package-name" value="com.google.android.bluetooth" />
-    </object>
-</configuration>
diff --git a/framework/tests/src/android/bluetooth/BluetoothCodecConfigTest.java b/framework/tests/src/android/bluetooth/BluetoothCodecConfigTest.java
deleted file mode 100644
index 53623b8..0000000
--- a/framework/tests/src/android/bluetooth/BluetoothCodecConfigTest.java
+++ /dev/null
@@ -1,353 +0,0 @@
-/*
- * Copyright 2018 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package android.bluetooth;
-
-import android.test.suitebuilder.annotation.SmallTest;
-
-import junit.framework.TestCase;
-
-/**
- * Unit test cases for {@link BluetoothCodecConfig}.
- * <p>
- * To run this test, use:
- * runtest --path core/tests/bluetoothtests/src/android/bluetooth/BluetoothCodecConfigTest.java
- */
-public class BluetoothCodecConfigTest extends TestCase {
-  private static final int[] kCodecTypeArray = new int[] {
-      BluetoothCodecConfig.SOURCE_CODEC_TYPE_SBC,
-      BluetoothCodecConfig.SOURCE_CODEC_TYPE_AAC,
-      BluetoothCodecConfig.SOURCE_CODEC_TYPE_APTX,
-      BluetoothCodecConfig.SOURCE_CODEC_TYPE_APTX_HD,
-      BluetoothCodecConfig.SOURCE_CODEC_TYPE_LDAC,
-      BluetoothCodecConfig.SOURCE_CODEC_TYPE_LC3,
-      BluetoothCodecConfig.SOURCE_CODEC_TYPE_INVALID,
-  };
-  private static final int[] kCodecPriorityArray = new int[] {
-      BluetoothCodecConfig.CODEC_PRIORITY_DISABLED,
-      BluetoothCodecConfig.CODEC_PRIORITY_DEFAULT,
-      BluetoothCodecConfig.CODEC_PRIORITY_HIGHEST,
-  };
-  private static final int[] kSampleRateArray = new int[] {
-      BluetoothCodecConfig.SAMPLE_RATE_NONE,
-      BluetoothCodecConfig.SAMPLE_RATE_44100,
-      BluetoothCodecConfig.SAMPLE_RATE_48000,
-      BluetoothCodecConfig.SAMPLE_RATE_88200,
-      BluetoothCodecConfig.SAMPLE_RATE_96000,
-      BluetoothCodecConfig.SAMPLE_RATE_176400,
-      BluetoothCodecConfig.SAMPLE_RATE_192000,
-  };
-  private static final int[] kBitsPerSampleArray = new int[] {
-      BluetoothCodecConfig.BITS_PER_SAMPLE_NONE,
-      BluetoothCodecConfig.BITS_PER_SAMPLE_16,
-      BluetoothCodecConfig.BITS_PER_SAMPLE_24,
-      BluetoothCodecConfig.BITS_PER_SAMPLE_32,
-  };
-  private static final int[] kChannelModeArray = new int[] {
-      BluetoothCodecConfig.CHANNEL_MODE_NONE,
-      BluetoothCodecConfig.CHANNEL_MODE_MONO,
-      BluetoothCodecConfig.CHANNEL_MODE_STEREO,
-  };
-  private static final long[] kCodecSpecific1Array = new long[] {
-      1000,
-      1001,
-      1002,
-      1003,
-  };
-  private static final long[] kCodecSpecific2Array = new long[] {
-      2000,
-      2001,
-      2002,
-      2003,
-  };
-  private static final long[] kCodecSpecific3Array = new long[] {
-      3000,
-      3001,
-      3002,
-      3003,
-  };
-  private static final long[] kCodecSpecific4Array = new long[] {
-      4000,
-      4001,
-      4002,
-      4003,
-  };
-
-  private static final int kTotalConfigs = kCodecTypeArray.length * kCodecPriorityArray.length
-      * kSampleRateArray.length * kBitsPerSampleArray.length * kChannelModeArray.length
-      * kCodecSpecific1Array.length * kCodecSpecific2Array.length * kCodecSpecific3Array.length
-      * kCodecSpecific4Array.length;
-
-  private int selectCodecType(int configId) {
-    int left = kCodecTypeArray.length;
-    int right = kTotalConfigs / left;
-    int index = configId / right;
-    index = index % kCodecTypeArray.length;
-    return kCodecTypeArray[index];
-  }
-
-    private int selectCodecPriority(int configId) {
-        int left = kCodecTypeArray.length * kCodecPriorityArray.length;
-        int right = kTotalConfigs / left;
-        int index = configId / right;
-        index = index % kCodecPriorityArray.length;
-        return kCodecPriorityArray[index];
-    }
-
-    private int selectSampleRate(int configId) {
-        int left = kCodecTypeArray.length * kCodecPriorityArray.length * kSampleRateArray.length;
-        int right = kTotalConfigs / left;
-        int index = configId / right;
-        index = index % kSampleRateArray.length;
-        return kSampleRateArray[index];
-    }
-
-    private int selectBitsPerSample(int configId) {
-        int left = kCodecTypeArray.length * kCodecPriorityArray.length * kSampleRateArray.length *
-            kBitsPerSampleArray.length;
-        int right = kTotalConfigs / left;
-        int index = configId / right;
-        index = index % kBitsPerSampleArray.length;
-        return kBitsPerSampleArray[index];
-    }
-
-    private int selectChannelMode(int configId) {
-        int left = kCodecTypeArray.length * kCodecPriorityArray.length * kSampleRateArray.length *
-            kBitsPerSampleArray.length * kChannelModeArray.length;
-        int right = kTotalConfigs / left;
-        int index = configId / right;
-        index = index % kChannelModeArray.length;
-        return kChannelModeArray[index];
-    }
-
-    private long selectCodecSpecific1(int configId) {
-        int left = kCodecTypeArray.length * kCodecPriorityArray.length * kSampleRateArray.length *
-            kBitsPerSampleArray.length * kChannelModeArray.length * kCodecSpecific1Array.length;
-        int right = kTotalConfigs / left;
-        int index = configId / right;
-        index = index % kCodecSpecific1Array.length;
-        return kCodecSpecific1Array[index];
-    }
-
-    private long selectCodecSpecific2(int configId) {
-        int left = kCodecTypeArray.length * kCodecPriorityArray.length * kSampleRateArray.length *
-            kBitsPerSampleArray.length * kChannelModeArray.length * kCodecSpecific1Array.length *
-            kCodecSpecific2Array.length;
-        int right = kTotalConfigs / left;
-        int index = configId / right;
-        index = index % kCodecSpecific2Array.length;
-        return kCodecSpecific2Array[index];
-    }
-
-    private long selectCodecSpecific3(int configId) {
-        int left = kCodecTypeArray.length * kCodecPriorityArray.length * kSampleRateArray.length *
-            kBitsPerSampleArray.length * kChannelModeArray.length * kCodecSpecific1Array.length *
-            kCodecSpecific2Array.length * kCodecSpecific3Array.length;
-        int right = kTotalConfigs / left;
-        int index = configId / right;
-        index = index % kCodecSpecific3Array.length;
-        return kCodecSpecific3Array[index];
-    }
-
-    private long selectCodecSpecific4(int configId) {
-        int left = kCodecTypeArray.length * kCodecPriorityArray.length * kSampleRateArray.length *
-            kBitsPerSampleArray.length * kChannelModeArray.length * kCodecSpecific1Array.length *
-            kCodecSpecific2Array.length * kCodecSpecific3Array.length *
-            kCodecSpecific4Array.length;
-        int right = kTotalConfigs / left;
-        int index = configId / right;
-        index = index % kCodecSpecific4Array.length;
-        return kCodecSpecific4Array[index];
-    }
-
-    @SmallTest
-    public void testBluetoothCodecConfig_valid_get_methods() {
-
-        for (int config_id = 0; config_id < kTotalConfigs; config_id++) {
-            int codec_type = selectCodecType(config_id);
-            int codec_priority = selectCodecPriority(config_id);
-            int sample_rate = selectSampleRate(config_id);
-            int bits_per_sample = selectBitsPerSample(config_id);
-            int channel_mode = selectChannelMode(config_id);
-            long codec_specific1 = selectCodecSpecific1(config_id);
-            long codec_specific2 = selectCodecSpecific2(config_id);
-            long codec_specific3 = selectCodecSpecific3(config_id);
-            long codec_specific4 = selectCodecSpecific4(config_id);
-
-            BluetoothCodecConfig bcc = buildBluetoothCodecConfig(codec_type, codec_priority,
-                                                                sample_rate, bits_per_sample,
-                                                                channel_mode, codec_specific1,
-                                                                codec_specific2, codec_specific3,
-                                                                codec_specific4);
-
-            if (codec_type == BluetoothCodecConfig.SOURCE_CODEC_TYPE_SBC) {
-                assertTrue(bcc.isMandatoryCodec());
-            } else {
-                assertFalse(bcc.isMandatoryCodec());
-            }
-
-            if (codec_type == BluetoothCodecConfig.SOURCE_CODEC_TYPE_SBC) {
-                assertEquals("SBC", BluetoothCodecConfig.getCodecName(codec_type));
-            }
-            if (codec_type == BluetoothCodecConfig.SOURCE_CODEC_TYPE_AAC) {
-                assertEquals("AAC", BluetoothCodecConfig.getCodecName(codec_type));
-            }
-            if (codec_type == BluetoothCodecConfig.SOURCE_CODEC_TYPE_APTX) {
-                assertEquals("aptX", BluetoothCodecConfig.getCodecName(codec_type));
-            }
-            if (codec_type == BluetoothCodecConfig.SOURCE_CODEC_TYPE_APTX_HD) {
-                assertEquals("aptX HD", BluetoothCodecConfig.getCodecName(codec_type));
-            }
-            if (codec_type == BluetoothCodecConfig.SOURCE_CODEC_TYPE_LDAC) {
-                assertEquals("LDAC", BluetoothCodecConfig.getCodecName(codec_type));
-            }
-            if (codec_type == BluetoothCodecConfig.SOURCE_CODEC_TYPE_LC3) {
-                assertEquals("LC3", BluetoothCodecConfig.getCodecName(codec_type));
-            }
-            if (codec_type == BluetoothCodecConfig.SOURCE_CODEC_TYPE_INVALID) {
-                assertEquals("INVALID CODEC", BluetoothCodecConfig.getCodecName(codec_type));
-            }
-
-            assertEquals(codec_type, bcc.getCodecType());
-            assertEquals(codec_priority, bcc.getCodecPriority());
-            assertEquals(sample_rate, bcc.getSampleRate());
-            assertEquals(bits_per_sample, bcc.getBitsPerSample());
-            assertEquals(channel_mode, bcc.getChannelMode());
-            assertEquals(codec_specific1, bcc.getCodecSpecific1());
-            assertEquals(codec_specific2, bcc.getCodecSpecific2());
-            assertEquals(codec_specific3, bcc.getCodecSpecific3());
-            assertEquals(codec_specific4, bcc.getCodecSpecific4());
-        }
-    }
-
-    @SmallTest
-    public void testBluetoothCodecConfig_equals() {
-        BluetoothCodecConfig bcc1 =
-                buildBluetoothCodecConfig(BluetoothCodecConfig.SOURCE_CODEC_TYPE_SBC,
-                                     BluetoothCodecConfig.CODEC_PRIORITY_DEFAULT,
-                                     BluetoothCodecConfig.SAMPLE_RATE_44100,
-                                     BluetoothCodecConfig.BITS_PER_SAMPLE_16,
-                                     BluetoothCodecConfig.CHANNEL_MODE_STEREO,
-                                     1000, 2000, 3000, 4000);
-
-        BluetoothCodecConfig bcc2_same =
-                buildBluetoothCodecConfig(BluetoothCodecConfig.SOURCE_CODEC_TYPE_SBC,
-                                     BluetoothCodecConfig.CODEC_PRIORITY_DEFAULT,
-                                     BluetoothCodecConfig.SAMPLE_RATE_44100,
-                                     BluetoothCodecConfig.BITS_PER_SAMPLE_16,
-                                     BluetoothCodecConfig.CHANNEL_MODE_STEREO,
-                                     1000, 2000, 3000, 4000);
-        assertTrue(bcc1.equals(bcc2_same));
-
-        BluetoothCodecConfig bcc3_codec_type =
-                buildBluetoothCodecConfig(BluetoothCodecConfig.SOURCE_CODEC_TYPE_AAC,
-                                     BluetoothCodecConfig.CODEC_PRIORITY_DEFAULT,
-                                     BluetoothCodecConfig.SAMPLE_RATE_44100,
-                                     BluetoothCodecConfig.BITS_PER_SAMPLE_16,
-                                     BluetoothCodecConfig.CHANNEL_MODE_STEREO,
-                                     1000, 2000, 3000, 4000);
-        assertFalse(bcc1.equals(bcc3_codec_type));
-
-        BluetoothCodecConfig bcc4_codec_priority =
-                buildBluetoothCodecConfig(BluetoothCodecConfig.SOURCE_CODEC_TYPE_SBC,
-                                     BluetoothCodecConfig.CODEC_PRIORITY_HIGHEST,
-                                     BluetoothCodecConfig.SAMPLE_RATE_44100,
-                                     BluetoothCodecConfig.BITS_PER_SAMPLE_16,
-                                     BluetoothCodecConfig.CHANNEL_MODE_STEREO,
-                                     1000, 2000, 3000, 4000);
-        assertFalse(bcc1.equals(bcc4_codec_priority));
-
-        BluetoothCodecConfig bcc5_sample_rate =
-                buildBluetoothCodecConfig(BluetoothCodecConfig.SOURCE_CODEC_TYPE_SBC,
-                                     BluetoothCodecConfig.CODEC_PRIORITY_DEFAULT,
-                                     BluetoothCodecConfig.SAMPLE_RATE_48000,
-                                     BluetoothCodecConfig.BITS_PER_SAMPLE_16,
-                                     BluetoothCodecConfig.CHANNEL_MODE_STEREO,
-                                     1000, 2000, 3000, 4000);
-        assertFalse(bcc1.equals(bcc5_sample_rate));
-
-        BluetoothCodecConfig bcc6_bits_per_sample =
-                buildBluetoothCodecConfig(BluetoothCodecConfig.SOURCE_CODEC_TYPE_SBC,
-                                     BluetoothCodecConfig.CODEC_PRIORITY_DEFAULT,
-                                     BluetoothCodecConfig.SAMPLE_RATE_44100,
-                                     BluetoothCodecConfig.BITS_PER_SAMPLE_24,
-                                     BluetoothCodecConfig.CHANNEL_MODE_STEREO,
-                                     1000, 2000, 3000, 4000);
-        assertFalse(bcc1.equals(bcc6_bits_per_sample));
-
-        BluetoothCodecConfig bcc7_channel_mode =
-                buildBluetoothCodecConfig(BluetoothCodecConfig.SOURCE_CODEC_TYPE_SBC,
-                                     BluetoothCodecConfig.CODEC_PRIORITY_DEFAULT,
-                                     BluetoothCodecConfig.SAMPLE_RATE_44100,
-                                     BluetoothCodecConfig.BITS_PER_SAMPLE_16,
-                                     BluetoothCodecConfig.CHANNEL_MODE_MONO,
-                                     1000, 2000, 3000, 4000);
-        assertFalse(bcc1.equals(bcc7_channel_mode));
-
-        BluetoothCodecConfig bcc8_codec_specific1 =
-                buildBluetoothCodecConfig(BluetoothCodecConfig.SOURCE_CODEC_TYPE_SBC,
-                                     BluetoothCodecConfig.CODEC_PRIORITY_DEFAULT,
-                                     BluetoothCodecConfig.SAMPLE_RATE_44100,
-                                     BluetoothCodecConfig.BITS_PER_SAMPLE_16,
-                                     BluetoothCodecConfig.CHANNEL_MODE_STEREO,
-                                     1001, 2000, 3000, 4000);
-        assertFalse(bcc1.equals(bcc8_codec_specific1));
-
-        BluetoothCodecConfig bcc9_codec_specific2 =
-                buildBluetoothCodecConfig(BluetoothCodecConfig.SOURCE_CODEC_TYPE_SBC,
-                                     BluetoothCodecConfig.CODEC_PRIORITY_DEFAULT,
-                                     BluetoothCodecConfig.SAMPLE_RATE_44100,
-                                     BluetoothCodecConfig.BITS_PER_SAMPLE_16,
-                                     BluetoothCodecConfig.CHANNEL_MODE_STEREO,
-                                     1000, 2002, 3000, 4000);
-        assertFalse(bcc1.equals(bcc9_codec_specific2));
-
-        BluetoothCodecConfig bcc10_codec_specific3 =
-                buildBluetoothCodecConfig(BluetoothCodecConfig.SOURCE_CODEC_TYPE_SBC,
-                                     BluetoothCodecConfig.CODEC_PRIORITY_DEFAULT,
-                                     BluetoothCodecConfig.SAMPLE_RATE_44100,
-                                     BluetoothCodecConfig.BITS_PER_SAMPLE_16,
-                                     BluetoothCodecConfig.CHANNEL_MODE_STEREO,
-                                     1000, 2000, 3003, 4000);
-        assertFalse(bcc1.equals(bcc10_codec_specific3));
-
-        BluetoothCodecConfig bcc11_codec_specific4 =
-                buildBluetoothCodecConfig(BluetoothCodecConfig.SOURCE_CODEC_TYPE_SBC,
-                                     BluetoothCodecConfig.CODEC_PRIORITY_DEFAULT,
-                                     BluetoothCodecConfig.SAMPLE_RATE_44100,
-                                     BluetoothCodecConfig.BITS_PER_SAMPLE_16,
-                                     BluetoothCodecConfig.CHANNEL_MODE_STEREO,
-                                     1000, 2000, 3000, 4004);
-        assertFalse(bcc1.equals(bcc11_codec_specific4));
-    }
-
-    private BluetoothCodecConfig buildBluetoothCodecConfig(int sourceCodecType,
-            int codecPriority, int sampleRate, int bitsPerSample, int channelMode,
-            long codecSpecific1, long codecSpecific2, long codecSpecific3, long codecSpecific4) {
-        return new BluetoothCodecConfig.Builder()
-                    .setCodecType(sourceCodecType)
-                    .setCodecPriority(codecPriority)
-                    .setSampleRate(sampleRate)
-                    .setBitsPerSample(bitsPerSample)
-                    .setChannelMode(channelMode)
-                    .setCodecSpecific1(codecSpecific1)
-                    .setCodecSpecific2(codecSpecific2)
-                    .setCodecSpecific3(codecSpecific3)
-                    .setCodecSpecific4(codecSpecific4)
-                    .build();
-
-    }
-}
diff --git a/framework/tests/src/android/bluetooth/BluetoothCodecStatusTest.java b/framework/tests/src/android/bluetooth/BluetoothCodecStatusTest.java
deleted file mode 100644
index 1cb2dca..0000000
--- a/framework/tests/src/android/bluetooth/BluetoothCodecStatusTest.java
+++ /dev/null
@@ -1,493 +0,0 @@
-/*
- * Copyright 2018 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package android.bluetooth;
-
-import android.test.suitebuilder.annotation.SmallTest;
-
-import junit.framework.TestCase;
-
-import java.util.ArrayList;
-import java.util.List;
-import java.util.Objects;
-
-/**
- * Unit test cases for {@link BluetoothCodecStatus}.
- * <p>
- * To run this test, use:
- * runtest --path core/tests/bluetoothtests/src/android/bluetooth/BluetoothCodecStatusTest.java
- */
-public class BluetoothCodecStatusTest extends TestCase {
-
-    // Codec configs: A and B are same; C is different
-    private static final BluetoothCodecConfig config_A =
-            buildBluetoothCodecConfig(BluetoothCodecConfig.SOURCE_CODEC_TYPE_SBC,
-                                 BluetoothCodecConfig.CODEC_PRIORITY_DEFAULT,
-                                 BluetoothCodecConfig.SAMPLE_RATE_44100,
-                                 BluetoothCodecConfig.BITS_PER_SAMPLE_16,
-                                 BluetoothCodecConfig.CHANNEL_MODE_STEREO,
-                                 1000, 2000, 3000, 4000);
-
-    private static final BluetoothCodecConfig config_B =
-            buildBluetoothCodecConfig(BluetoothCodecConfig.SOURCE_CODEC_TYPE_SBC,
-                                 BluetoothCodecConfig.CODEC_PRIORITY_DEFAULT,
-                                 BluetoothCodecConfig.SAMPLE_RATE_44100,
-                                 BluetoothCodecConfig.BITS_PER_SAMPLE_16,
-                                 BluetoothCodecConfig.CHANNEL_MODE_STEREO,
-                                 1000, 2000, 3000, 4000);
-
-    private static final BluetoothCodecConfig config_C =
-            buildBluetoothCodecConfig(BluetoothCodecConfig.SOURCE_CODEC_TYPE_AAC,
-                                 BluetoothCodecConfig.CODEC_PRIORITY_DEFAULT,
-                                 BluetoothCodecConfig.SAMPLE_RATE_44100,
-                                 BluetoothCodecConfig.BITS_PER_SAMPLE_16,
-                                 BluetoothCodecConfig.CHANNEL_MODE_STEREO,
-                                 1000, 2000, 3000, 4000);
-
-    // Local capabilities: A and B are same; C is different
-    private static final BluetoothCodecConfig local_capability1_A =
-            buildBluetoothCodecConfig(BluetoothCodecConfig.SOURCE_CODEC_TYPE_SBC,
-                                 BluetoothCodecConfig.CODEC_PRIORITY_DEFAULT,
-                                 BluetoothCodecConfig.SAMPLE_RATE_44100 |
-                                 BluetoothCodecConfig.SAMPLE_RATE_48000,
-                                 BluetoothCodecConfig.BITS_PER_SAMPLE_16,
-                                 BluetoothCodecConfig.CHANNEL_MODE_STEREO |
-                                 BluetoothCodecConfig.CHANNEL_MODE_MONO,
-                                 1000, 2000, 3000, 4000);
-
-    private static final BluetoothCodecConfig local_capability1_B =
-            buildBluetoothCodecConfig(BluetoothCodecConfig.SOURCE_CODEC_TYPE_SBC,
-                                 BluetoothCodecConfig.CODEC_PRIORITY_DEFAULT,
-                                 BluetoothCodecConfig.SAMPLE_RATE_44100 |
-                                 BluetoothCodecConfig.SAMPLE_RATE_48000,
-                                 BluetoothCodecConfig.BITS_PER_SAMPLE_16,
-                                 BluetoothCodecConfig.CHANNEL_MODE_STEREO |
-                                 BluetoothCodecConfig.CHANNEL_MODE_MONO,
-                                 1000, 2000, 3000, 4000);
-
-    private static final BluetoothCodecConfig local_capability1_C =
-            buildBluetoothCodecConfig(BluetoothCodecConfig.SOURCE_CODEC_TYPE_SBC,
-                                 BluetoothCodecConfig.CODEC_PRIORITY_DEFAULT,
-                                 BluetoothCodecConfig.SAMPLE_RATE_44100 |
-                                 BluetoothCodecConfig.SAMPLE_RATE_48000,
-                                 BluetoothCodecConfig.BITS_PER_SAMPLE_16,
-                                 BluetoothCodecConfig.CHANNEL_MODE_STEREO,
-                                 1000, 2000, 3000, 4000);
-
-
-    private static final BluetoothCodecConfig local_capability2_A =
-            buildBluetoothCodecConfig(BluetoothCodecConfig.SOURCE_CODEC_TYPE_AAC,
-                                 BluetoothCodecConfig.CODEC_PRIORITY_DEFAULT,
-                                 BluetoothCodecConfig.SAMPLE_RATE_44100 |
-                                 BluetoothCodecConfig.SAMPLE_RATE_48000,
-                                 BluetoothCodecConfig.BITS_PER_SAMPLE_16,
-                                 BluetoothCodecConfig.CHANNEL_MODE_STEREO |
-                                 BluetoothCodecConfig.CHANNEL_MODE_MONO,
-                                 1000, 2000, 3000, 4000);
-
-    private static final BluetoothCodecConfig local_capability2_B =
-            buildBluetoothCodecConfig(BluetoothCodecConfig.SOURCE_CODEC_TYPE_AAC,
-                                 BluetoothCodecConfig.CODEC_PRIORITY_DEFAULT,
-                                 BluetoothCodecConfig.SAMPLE_RATE_44100 |
-                                 BluetoothCodecConfig.SAMPLE_RATE_48000,
-                                 BluetoothCodecConfig.BITS_PER_SAMPLE_16,
-                                 BluetoothCodecConfig.CHANNEL_MODE_STEREO |
-                                 BluetoothCodecConfig.CHANNEL_MODE_MONO,
-                                 1000, 2000, 3000, 4000);
-
-    private static final BluetoothCodecConfig local_capability2_C =
-            buildBluetoothCodecConfig(BluetoothCodecConfig.SOURCE_CODEC_TYPE_AAC,
-                                 BluetoothCodecConfig.CODEC_PRIORITY_DEFAULT,
-                                 BluetoothCodecConfig.SAMPLE_RATE_44100 |
-                                 BluetoothCodecConfig.SAMPLE_RATE_48000,
-                                 BluetoothCodecConfig.BITS_PER_SAMPLE_16,
-                                 BluetoothCodecConfig.CHANNEL_MODE_STEREO,
-                                 1000, 2000, 3000, 4000);
-
-    private static final BluetoothCodecConfig local_capability3_A =
-            buildBluetoothCodecConfig(BluetoothCodecConfig.SOURCE_CODEC_TYPE_APTX,
-                                 BluetoothCodecConfig.CODEC_PRIORITY_DEFAULT,
-                                 BluetoothCodecConfig.SAMPLE_RATE_44100 |
-                                 BluetoothCodecConfig.SAMPLE_RATE_48000,
-                                 BluetoothCodecConfig.BITS_PER_SAMPLE_16,
-                                 BluetoothCodecConfig.CHANNEL_MODE_STEREO |
-                                 BluetoothCodecConfig.CHANNEL_MODE_MONO,
-                                 1000, 2000, 3000, 4000);
-
-    private static final BluetoothCodecConfig local_capability3_B =
-            buildBluetoothCodecConfig(BluetoothCodecConfig.SOURCE_CODEC_TYPE_APTX,
-                                 BluetoothCodecConfig.CODEC_PRIORITY_DEFAULT,
-                                 BluetoothCodecConfig.SAMPLE_RATE_44100 |
-                                 BluetoothCodecConfig.SAMPLE_RATE_48000,
-                                 BluetoothCodecConfig.BITS_PER_SAMPLE_16,
-                                 BluetoothCodecConfig.CHANNEL_MODE_STEREO |
-                                 BluetoothCodecConfig.CHANNEL_MODE_MONO,
-                                 1000, 2000, 3000, 4000);
-
-    private static final BluetoothCodecConfig local_capability3_C =
-            buildBluetoothCodecConfig(BluetoothCodecConfig.SOURCE_CODEC_TYPE_APTX,
-                                 BluetoothCodecConfig.CODEC_PRIORITY_DEFAULT,
-                                 BluetoothCodecConfig.SAMPLE_RATE_44100 |
-                                 BluetoothCodecConfig.SAMPLE_RATE_48000,
-                                 BluetoothCodecConfig.BITS_PER_SAMPLE_16,
-                                 BluetoothCodecConfig.CHANNEL_MODE_STEREO,
-                                 1000, 2000, 3000, 4000);
-
-    private static final BluetoothCodecConfig local_capability4_A =
-            buildBluetoothCodecConfig(BluetoothCodecConfig.SOURCE_CODEC_TYPE_APTX_HD,
-                                 BluetoothCodecConfig.CODEC_PRIORITY_DEFAULT,
-                                 BluetoothCodecConfig.SAMPLE_RATE_44100 |
-                                 BluetoothCodecConfig.SAMPLE_RATE_48000,
-                                 BluetoothCodecConfig.BITS_PER_SAMPLE_24,
-                                 BluetoothCodecConfig.CHANNEL_MODE_STEREO |
-                                 BluetoothCodecConfig.CHANNEL_MODE_MONO,
-                                 1000, 2000, 3000, 4000);
-
-    private static final BluetoothCodecConfig local_capability4_B =
-            buildBluetoothCodecConfig(BluetoothCodecConfig.SOURCE_CODEC_TYPE_APTX_HD,
-                                 BluetoothCodecConfig.CODEC_PRIORITY_DEFAULT,
-                                 BluetoothCodecConfig.SAMPLE_RATE_44100 |
-                                 BluetoothCodecConfig.SAMPLE_RATE_48000,
-                                 BluetoothCodecConfig.BITS_PER_SAMPLE_24,
-                                 BluetoothCodecConfig.CHANNEL_MODE_STEREO |
-                                 BluetoothCodecConfig.CHANNEL_MODE_MONO,
-                                 1000, 2000, 3000, 4000);
-
-    private static final BluetoothCodecConfig local_capability4_C =
-            buildBluetoothCodecConfig(BluetoothCodecConfig.SOURCE_CODEC_TYPE_APTX_HD,
-                                 BluetoothCodecConfig.CODEC_PRIORITY_DEFAULT,
-                                 BluetoothCodecConfig.SAMPLE_RATE_44100 |
-                                 BluetoothCodecConfig.SAMPLE_RATE_48000,
-                                 BluetoothCodecConfig.BITS_PER_SAMPLE_24,
-                                 BluetoothCodecConfig.CHANNEL_MODE_STEREO,
-                                 1000, 2000, 3000, 4000);
-
-    private static final BluetoothCodecConfig local_capability5_A =
-            buildBluetoothCodecConfig(BluetoothCodecConfig.SOURCE_CODEC_TYPE_LDAC,
-                                 BluetoothCodecConfig.CODEC_PRIORITY_DEFAULT,
-                                 BluetoothCodecConfig.SAMPLE_RATE_44100 |
-                                 BluetoothCodecConfig.SAMPLE_RATE_48000 |
-                                 BluetoothCodecConfig.SAMPLE_RATE_88200 |
-                                 BluetoothCodecConfig.SAMPLE_RATE_96000,
-                                 BluetoothCodecConfig.BITS_PER_SAMPLE_16 |
-                                 BluetoothCodecConfig.BITS_PER_SAMPLE_24 |
-                                 BluetoothCodecConfig.BITS_PER_SAMPLE_32,
-                                 BluetoothCodecConfig.CHANNEL_MODE_STEREO |
-                                 BluetoothCodecConfig.CHANNEL_MODE_MONO,
-                                 1000, 2000, 3000, 4000);
-
-    private static final BluetoothCodecConfig local_capability5_B =
-            buildBluetoothCodecConfig(BluetoothCodecConfig.SOURCE_CODEC_TYPE_LDAC,
-                                 BluetoothCodecConfig.CODEC_PRIORITY_DEFAULT,
-                                 BluetoothCodecConfig.SAMPLE_RATE_44100 |
-                                 BluetoothCodecConfig.SAMPLE_RATE_48000 |
-                                 BluetoothCodecConfig.SAMPLE_RATE_88200 |
-                                 BluetoothCodecConfig.SAMPLE_RATE_96000,
-                                 BluetoothCodecConfig.BITS_PER_SAMPLE_16 |
-                                 BluetoothCodecConfig.BITS_PER_SAMPLE_24 |
-                                 BluetoothCodecConfig.BITS_PER_SAMPLE_32,
-                                 BluetoothCodecConfig.CHANNEL_MODE_STEREO |
-                                 BluetoothCodecConfig.CHANNEL_MODE_MONO,
-                                 1000, 2000, 3000, 4000);
-
-    private static final BluetoothCodecConfig local_capability5_C =
-            buildBluetoothCodecConfig(BluetoothCodecConfig.SOURCE_CODEC_TYPE_LDAC,
-                                 BluetoothCodecConfig.CODEC_PRIORITY_DEFAULT,
-                                 BluetoothCodecConfig.SAMPLE_RATE_44100 |
-                                 BluetoothCodecConfig.SAMPLE_RATE_48000 |
-                                 BluetoothCodecConfig.SAMPLE_RATE_88200 |
-                                 BluetoothCodecConfig.SAMPLE_RATE_96000,
-                                 BluetoothCodecConfig.BITS_PER_SAMPLE_16 |
-                                 BluetoothCodecConfig.BITS_PER_SAMPLE_24 |
-                                 BluetoothCodecConfig.BITS_PER_SAMPLE_32,
-                                 BluetoothCodecConfig.CHANNEL_MODE_STEREO,
-                                 1000, 2000, 3000, 4000);
-
-
-    // Selectable capabilities: A and B are same; C is different
-    private static final BluetoothCodecConfig selectable_capability1_A =
-            buildBluetoothCodecConfig(BluetoothCodecConfig.SOURCE_CODEC_TYPE_SBC,
-                                 BluetoothCodecConfig.CODEC_PRIORITY_DEFAULT,
-                                 BluetoothCodecConfig.SAMPLE_RATE_44100,
-                                 BluetoothCodecConfig.BITS_PER_SAMPLE_16,
-                                 BluetoothCodecConfig.CHANNEL_MODE_STEREO |
-                                 BluetoothCodecConfig.CHANNEL_MODE_MONO,
-                                 1000, 2000, 3000, 4000);
-
-    private static final BluetoothCodecConfig selectable_capability1_B =
-            buildBluetoothCodecConfig(BluetoothCodecConfig.SOURCE_CODEC_TYPE_SBC,
-                                 BluetoothCodecConfig.CODEC_PRIORITY_DEFAULT,
-                                 BluetoothCodecConfig.SAMPLE_RATE_44100,
-                                 BluetoothCodecConfig.BITS_PER_SAMPLE_16,
-                                 BluetoothCodecConfig.CHANNEL_MODE_STEREO |
-                                 BluetoothCodecConfig.CHANNEL_MODE_MONO,
-                                 1000, 2000, 3000, 4000);
-
-    private static final BluetoothCodecConfig selectable_capability1_C =
-            buildBluetoothCodecConfig(BluetoothCodecConfig.SOURCE_CODEC_TYPE_SBC,
-                                 BluetoothCodecConfig.CODEC_PRIORITY_DEFAULT,
-                                 BluetoothCodecConfig.SAMPLE_RATE_44100,
-                                 BluetoothCodecConfig.BITS_PER_SAMPLE_16,
-                                 BluetoothCodecConfig.CHANNEL_MODE_STEREO,
-                                 1000, 2000, 3000, 4000);
-
-    private static final BluetoothCodecConfig selectable_capability2_A =
-            buildBluetoothCodecConfig(BluetoothCodecConfig.SOURCE_CODEC_TYPE_AAC,
-                                 BluetoothCodecConfig.CODEC_PRIORITY_DEFAULT,
-                                 BluetoothCodecConfig.SAMPLE_RATE_44100,
-                                 BluetoothCodecConfig.BITS_PER_SAMPLE_16,
-                                 BluetoothCodecConfig.CHANNEL_MODE_STEREO |
-                                 BluetoothCodecConfig.CHANNEL_MODE_MONO,
-                                 1000, 2000, 3000, 4000);
-
-    private static final BluetoothCodecConfig selectable_capability2_B =
-            buildBluetoothCodecConfig(BluetoothCodecConfig.SOURCE_CODEC_TYPE_AAC,
-                                 BluetoothCodecConfig.CODEC_PRIORITY_DEFAULT,
-                                 BluetoothCodecConfig.SAMPLE_RATE_44100,
-                                 BluetoothCodecConfig.BITS_PER_SAMPLE_16,
-                                 BluetoothCodecConfig.CHANNEL_MODE_STEREO |
-                                 BluetoothCodecConfig.CHANNEL_MODE_MONO,
-                                 1000, 2000, 3000, 4000);
-
-    private static final BluetoothCodecConfig selectable_capability2_C =
-            buildBluetoothCodecConfig(BluetoothCodecConfig.SOURCE_CODEC_TYPE_AAC,
-                                 BluetoothCodecConfig.CODEC_PRIORITY_DEFAULT,
-                                 BluetoothCodecConfig.SAMPLE_RATE_44100,
-                                 BluetoothCodecConfig.BITS_PER_SAMPLE_16,
-                                 BluetoothCodecConfig.CHANNEL_MODE_STEREO,
-                                 1000, 2000, 3000, 4000);
-
-    private static final BluetoothCodecConfig selectable_capability3_A =
-            buildBluetoothCodecConfig(BluetoothCodecConfig.SOURCE_CODEC_TYPE_APTX,
-                                 BluetoothCodecConfig.CODEC_PRIORITY_DEFAULT,
-                                 BluetoothCodecConfig.SAMPLE_RATE_44100,
-                                 BluetoothCodecConfig.BITS_PER_SAMPLE_16,
-                                 BluetoothCodecConfig.CHANNEL_MODE_STEREO |
-                                 BluetoothCodecConfig.CHANNEL_MODE_MONO,
-                                 1000, 2000, 3000, 4000);
-
-    private static final BluetoothCodecConfig selectable_capability3_B =
-            buildBluetoothCodecConfig(BluetoothCodecConfig.SOURCE_CODEC_TYPE_APTX,
-                                 BluetoothCodecConfig.CODEC_PRIORITY_DEFAULT,
-                                 BluetoothCodecConfig.SAMPLE_RATE_44100,
-                                 BluetoothCodecConfig.BITS_PER_SAMPLE_16,
-                                 BluetoothCodecConfig.CHANNEL_MODE_STEREO |
-                                 BluetoothCodecConfig.CHANNEL_MODE_MONO,
-                                 1000, 2000, 3000, 4000);
-
-    private static final BluetoothCodecConfig selectable_capability3_C =
-            buildBluetoothCodecConfig(BluetoothCodecConfig.SOURCE_CODEC_TYPE_APTX,
-                                 BluetoothCodecConfig.CODEC_PRIORITY_DEFAULT,
-                                 BluetoothCodecConfig.SAMPLE_RATE_44100,
-                                 BluetoothCodecConfig.BITS_PER_SAMPLE_16,
-                                 BluetoothCodecConfig.CHANNEL_MODE_STEREO,
-                                 1000, 2000, 3000, 4000);
-
-    private static final BluetoothCodecConfig selectable_capability4_A =
-            buildBluetoothCodecConfig(BluetoothCodecConfig.SOURCE_CODEC_TYPE_APTX_HD,
-                                 BluetoothCodecConfig.CODEC_PRIORITY_DEFAULT,
-                                 BluetoothCodecConfig.SAMPLE_RATE_44100,
-                                 BluetoothCodecConfig.BITS_PER_SAMPLE_24,
-                                 BluetoothCodecConfig.CHANNEL_MODE_STEREO |
-                                 BluetoothCodecConfig.CHANNEL_MODE_MONO,
-                                 1000, 2000, 3000, 4000);
-
-    private static final BluetoothCodecConfig selectable_capability4_B =
-            buildBluetoothCodecConfig(BluetoothCodecConfig.SOURCE_CODEC_TYPE_APTX_HD,
-                                 BluetoothCodecConfig.CODEC_PRIORITY_DEFAULT,
-                                 BluetoothCodecConfig.SAMPLE_RATE_44100,
-                                 BluetoothCodecConfig.BITS_PER_SAMPLE_24,
-                                 BluetoothCodecConfig.CHANNEL_MODE_STEREO |
-                                 BluetoothCodecConfig.CHANNEL_MODE_MONO,
-                                 1000, 2000, 3000, 4000);
-
-    private static final BluetoothCodecConfig selectable_capability4_C =
-            buildBluetoothCodecConfig(BluetoothCodecConfig.SOURCE_CODEC_TYPE_APTX_HD,
-                                 BluetoothCodecConfig.CODEC_PRIORITY_DEFAULT,
-                                 BluetoothCodecConfig.SAMPLE_RATE_44100,
-                                 BluetoothCodecConfig.BITS_PER_SAMPLE_24,
-                                 BluetoothCodecConfig.CHANNEL_MODE_STEREO,
-                                 1000, 2000, 3000, 4000);
-
-    private static final BluetoothCodecConfig selectable_capability5_A =
-            buildBluetoothCodecConfig(BluetoothCodecConfig.SOURCE_CODEC_TYPE_LDAC,
-                                 BluetoothCodecConfig.CODEC_PRIORITY_DEFAULT,
-                                 BluetoothCodecConfig.SAMPLE_RATE_44100 |
-                                 BluetoothCodecConfig.SAMPLE_RATE_48000 |
-                                 BluetoothCodecConfig.SAMPLE_RATE_88200 |
-                                 BluetoothCodecConfig.SAMPLE_RATE_96000,
-                                 BluetoothCodecConfig.BITS_PER_SAMPLE_16 |
-                                 BluetoothCodecConfig.BITS_PER_SAMPLE_24 |
-                                 BluetoothCodecConfig.BITS_PER_SAMPLE_32,
-                                 BluetoothCodecConfig.CHANNEL_MODE_STEREO |
-                                 BluetoothCodecConfig.CHANNEL_MODE_MONO,
-                                 1000, 2000, 3000, 4000);
-
-    private static final BluetoothCodecConfig selectable_capability5_B =
-            buildBluetoothCodecConfig(BluetoothCodecConfig.SOURCE_CODEC_TYPE_LDAC,
-                                 BluetoothCodecConfig.CODEC_PRIORITY_DEFAULT,
-                                 BluetoothCodecConfig.SAMPLE_RATE_44100 |
-                                 BluetoothCodecConfig.SAMPLE_RATE_48000 |
-                                 BluetoothCodecConfig.SAMPLE_RATE_88200 |
-                                 BluetoothCodecConfig.SAMPLE_RATE_96000,
-                                 BluetoothCodecConfig.BITS_PER_SAMPLE_16 |
-                                 BluetoothCodecConfig.BITS_PER_SAMPLE_24 |
-                                 BluetoothCodecConfig.BITS_PER_SAMPLE_32,
-                                 BluetoothCodecConfig.CHANNEL_MODE_STEREO |
-                                 BluetoothCodecConfig.CHANNEL_MODE_MONO,
-                                 1000, 2000, 3000, 4000);
-
-    private static final BluetoothCodecConfig selectable_capability5_C =
-            buildBluetoothCodecConfig(BluetoothCodecConfig.SOURCE_CODEC_TYPE_LDAC,
-                                 BluetoothCodecConfig.CODEC_PRIORITY_DEFAULT,
-                                 BluetoothCodecConfig.SAMPLE_RATE_44100 |
-                                 BluetoothCodecConfig.SAMPLE_RATE_48000 |
-                                 BluetoothCodecConfig.SAMPLE_RATE_88200 |
-                                 BluetoothCodecConfig.SAMPLE_RATE_96000,
-                                 BluetoothCodecConfig.BITS_PER_SAMPLE_16 |
-                                 BluetoothCodecConfig.BITS_PER_SAMPLE_24 |
-                                 BluetoothCodecConfig.BITS_PER_SAMPLE_32,
-                                 BluetoothCodecConfig.CHANNEL_MODE_STEREO,
-                                 1000, 2000, 3000, 4000);
-
-    private static final List<BluetoothCodecConfig> LOCAL_CAPABILITY_A =
-            new ArrayList() {{
-                    add(local_capability1_A);
-                    add(local_capability2_A);
-                    add(local_capability3_A);
-                    add(local_capability4_A);
-                    add(local_capability5_A);
-            }};
-
-    private static final List<BluetoothCodecConfig> LOCAL_CAPABILITY_B =
-            new ArrayList() {{
-                    add(local_capability1_B);
-                    add(local_capability2_B);
-                    add(local_capability3_B);
-                    add(local_capability4_B);
-                    add(local_capability5_B);
-            }};
-
-    private static final List<BluetoothCodecConfig> LOCAL_CAPABILITY_B_REORDERED =
-            new ArrayList() {{
-                    add(local_capability5_B);
-                    add(local_capability4_B);
-                    add(local_capability2_B);
-                    add(local_capability3_B);
-                    add(local_capability1_B);
-            }};
-
-    private static final List<BluetoothCodecConfig> LOCAL_CAPABILITY_C =
-            new ArrayList() {{
-                    add(local_capability1_C);
-                    add(local_capability2_C);
-                    add(local_capability3_C);
-                    add(local_capability4_C);
-                    add(local_capability5_C);
-            }};
-
-    private static final List<BluetoothCodecConfig> SELECTABLE_CAPABILITY_A =
-            new ArrayList() {{
-                    add(selectable_capability1_A);
-                    add(selectable_capability2_A);
-                    add(selectable_capability3_A);
-                    add(selectable_capability4_A);
-                    add(selectable_capability5_A);
-            }};
-
-    private static final List<BluetoothCodecConfig> SELECTABLE_CAPABILITY_B =
-            new ArrayList() {{
-                    add(selectable_capability1_B);
-                    add(selectable_capability2_B);
-                    add(selectable_capability3_B);
-                    add(selectable_capability4_B);
-                    add(selectable_capability5_B);
-            }};
-
-    private static final List<BluetoothCodecConfig> SELECTABLE_CAPABILITY_B_REORDERED =
-            new ArrayList() {{
-                    add(selectable_capability5_B);
-                    add(selectable_capability4_B);
-                    add(selectable_capability2_B);
-                    add(selectable_capability3_B);
-                    add(selectable_capability1_B);
-            }};
-
-    private static final List<BluetoothCodecConfig> SELECTABLE_CAPABILITY_C =
-            new ArrayList() {{
-                    add(selectable_capability1_C);
-                    add(selectable_capability2_C);
-                    add(selectable_capability3_C);
-                    add(selectable_capability4_C);
-                    add(selectable_capability5_C);
-            }};
-
-    private static final BluetoothCodecStatus bcs_A =
-            new BluetoothCodecStatus(config_A, LOCAL_CAPABILITY_A, SELECTABLE_CAPABILITY_A);
-    private static final BluetoothCodecStatus bcs_B =
-            new BluetoothCodecStatus(config_B, LOCAL_CAPABILITY_B, SELECTABLE_CAPABILITY_B);
-    private static final BluetoothCodecStatus bcs_B_reordered =
-            new BluetoothCodecStatus(config_B, LOCAL_CAPABILITY_B_REORDERED,
-                                 SELECTABLE_CAPABILITY_B_REORDERED);
-    private static final BluetoothCodecStatus bcs_C =
-            new BluetoothCodecStatus(config_C, LOCAL_CAPABILITY_C, SELECTABLE_CAPABILITY_C);
-
-    @SmallTest
-    public void testBluetoothCodecStatus_get_methods() {
-
-        assertTrue(Objects.equals(bcs_A.getCodecConfig(), config_A));
-        assertTrue(Objects.equals(bcs_A.getCodecConfig(), config_B));
-        assertFalse(Objects.equals(bcs_A.getCodecConfig(), config_C));
-
-        assertTrue(bcs_A.getCodecsLocalCapabilities().equals(LOCAL_CAPABILITY_A));
-        assertTrue(bcs_A.getCodecsLocalCapabilities().equals(LOCAL_CAPABILITY_B));
-        assertFalse(bcs_A.getCodecsLocalCapabilities().equals(LOCAL_CAPABILITY_C));
-
-        assertTrue(bcs_A.getCodecsSelectableCapabilities()
-                                 .equals(SELECTABLE_CAPABILITY_A));
-        assertTrue(bcs_A.getCodecsSelectableCapabilities()
-                                  .equals(SELECTABLE_CAPABILITY_B));
-        assertFalse(bcs_A.getCodecsSelectableCapabilities()
-                                  .equals(SELECTABLE_CAPABILITY_C));
-    }
-
-    @SmallTest
-    public void testBluetoothCodecStatus_equals() {
-        assertTrue(bcs_A.equals(bcs_B));
-        assertTrue(bcs_B.equals(bcs_A));
-        assertTrue(bcs_A.equals(bcs_B_reordered));
-        assertTrue(bcs_B_reordered.equals(bcs_A));
-        assertFalse(bcs_A.equals(bcs_C));
-        assertFalse(bcs_C.equals(bcs_A));
-    }
-
-    private static BluetoothCodecConfig buildBluetoothCodecConfig(int sourceCodecType,
-            int codecPriority, int sampleRate, int bitsPerSample, int channelMode,
-            long codecSpecific1, long codecSpecific2, long codecSpecific3, long codecSpecific4) {
-        return new BluetoothCodecConfig.Builder()
-                    .setCodecType(sourceCodecType)
-                    .setCodecPriority(codecPriority)
-                    .setSampleRate(sampleRate)
-                    .setBitsPerSample(bitsPerSample)
-                    .setChannelMode(channelMode)
-                    .setCodecSpecific1(codecSpecific1)
-                    .setCodecSpecific2(codecSpecific2)
-                    .setCodecSpecific3(codecSpecific3)
-                    .setCodecSpecific4(codecSpecific4)
-                    .build();
-
-    }
-}
diff --git a/framework/tests/src/android/bluetooth/BluetoothInstrumentation.java b/framework/tests/src/android/bluetooth/BluetoothInstrumentation.java
deleted file mode 100644
index 37b2a50..0000000
--- a/framework/tests/src/android/bluetooth/BluetoothInstrumentation.java
+++ /dev/null
@@ -1,123 +0,0 @@
-/*
- * Copyright (C) 2014 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package android.bluetooth;
-
-import android.app.Activity;
-import android.app.Instrumentation;
-import android.content.Context;
-import android.os.Bundle;
-
-import junit.framework.Assert;
-
-import java.util.Set;
-
-public class BluetoothInstrumentation extends Instrumentation {
-
-    private BluetoothTestUtils mUtils = null;
-    private BluetoothAdapter mAdapter = null;
-    private Bundle mArgs = null;
-    private Bundle mSuccessResult = null;
-
-    private BluetoothTestUtils getBluetoothTestUtils() {
-        if (mUtils == null) {
-            mUtils = new BluetoothTestUtils(getContext(),
-                    BluetoothInstrumentation.class.getSimpleName());
-        }
-        return mUtils;
-    }
-
-    private BluetoothAdapter getBluetoothAdapter() {
-        if (mAdapter == null) {
-            mAdapter = ((BluetoothManager)getContext().getSystemService(
-                    Context.BLUETOOTH_SERVICE)).getAdapter();
-        }
-        return mAdapter;
-    }
-
-    @Override
-    public void onCreate(Bundle arguments) {
-        super.onCreate(arguments);
-        mArgs = arguments;
-        // create the default result response, but only use it in success code path
-        mSuccessResult = new Bundle();
-        mSuccessResult.putString("result", "SUCCESS");
-        start();
-    }
-
-    @Override
-    public void onStart() {
-        String command = mArgs.getString("command");
-        if ("enable".equals(command)) {
-            enable();
-        } else if ("disable".equals(command)) {
-            disable();
-        } else if ("unpairAll".equals(command)) {
-            unpairAll();
-        } else if ("getName".equals(command)) {
-            getName();
-        } else if ("getAddress".equals(command)) {
-            getAddress();
-        } else if ("getBondedDevices".equals(command)) {
-            getBondedDevices();
-        } else {
-            finish(null);
-        }
-    }
-
-    public void enable() {
-        getBluetoothTestUtils().enable(getBluetoothAdapter());
-        finish(mSuccessResult);
-    }
-
-    public void disable() {
-        getBluetoothTestUtils().disable(getBluetoothAdapter());
-        finish(mSuccessResult);
-    }
-
-    public void unpairAll() {
-        getBluetoothTestUtils().unpairAll(getBluetoothAdapter());
-        finish(mSuccessResult);
-    }
-
-    public void getName() {
-        String name = getBluetoothAdapter().getName();
-        mSuccessResult.putString("name", name);
-        finish(mSuccessResult);
-    }
-
-    public void getAddress() {
-        String name = getBluetoothAdapter().getAddress();
-        mSuccessResult.putString("address", name);
-        finish(mSuccessResult);
-    }
-
-    public void getBondedDevices() {
-        Set<BluetoothDevice> devices = getBluetoothAdapter().getBondedDevices();
-        int i = 0;
-        for (BluetoothDevice device : devices) {
-            mSuccessResult.putString(String.format("device-%02d", i), device.getAddress());
-            i++;
-        }
-        finish(mSuccessResult);
-    }
-
-    public void finish(Bundle result) {
-        if (result == null) {
-            result = new Bundle();
-        }
-        finish(Activity.RESULT_OK, result);
-    }
-}
diff --git a/framework/tests/src/android/bluetooth/BluetoothTestRunner.java b/framework/tests/src/android/bluetooth/BluetoothTestRunner.java
deleted file mode 100644
index d19c2c3..0000000
--- a/framework/tests/src/android/bluetooth/BluetoothTestRunner.java
+++ /dev/null
@@ -1,225 +0,0 @@
-/*
- * Copyright (C) 2010 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package android.bluetooth;
-
-import junit.framework.TestSuite;
-
-import android.os.Bundle;
-import android.test.InstrumentationTestRunner;
-import android.test.InstrumentationTestSuite;
-import android.util.Log;
-
-/**
- * Instrumentation test runner for Bluetooth tests.
- * <p>
- * To run:
- * <pre>
- * {@code
- * adb shell am instrument \
- *     [-e enable_iterations <iterations>] \
- *     [-e discoverable_iterations <iterations>] \
- *     [-e scan_iterations <iterations>] \
- *     [-e enable_pan_iterations <iterations>] \
- *     [-e pair_iterations <iterations>] \
- *     [-e connect_a2dp_iterations <iterations>] \
- *     [-e connect_headset_iterations <iterations>] \
- *     [-e connect_input_iterations <iterations>] \
- *     [-e connect_pan_iterations <iterations>] \
- *     [-e start_stop_sco_iterations <iterations>] \
- *     [-e mce_set_message_status_iterations <iterations>] \
- *     [-e pair_address <address>] \
- *     [-e headset_address <address>] \
- *     [-e a2dp_address <address>] \
- *     [-e input_address <address>] \
- *     [-e pan_address <address>] \
- *     [-e pair_pin <pin>] \
- *     [-e pair_passkey <passkey>] \
- *     -w com.android.bluetooth.tests/android.bluetooth.BluetoothTestRunner
- * }
- * </pre>
- */
-public class BluetoothTestRunner extends InstrumentationTestRunner {
-    private static final String TAG = "BluetoothTestRunner";
-
-    public static int sEnableIterations = 100;
-    public static int sDiscoverableIterations = 1000;
-    public static int sScanIterations = 1000;
-    public static int sEnablePanIterations = 1000;
-    public static int sPairIterations = 100;
-    public static int sConnectHeadsetIterations = 100;
-    public static int sConnectA2dpIterations = 100;
-    public static int sConnectInputIterations = 100;
-    public static int sConnectPanIterations = 100;
-    public static int sStartStopScoIterations = 100;
-    public static int sMceSetMessageStatusIterations = 100;
-
-    public static String sDeviceAddress = "";
-    public static byte[] sDevicePairPin = {'1', '2', '3', '4'};
-    public static int sDevicePairPasskey = 123456;
-
-    @Override
-    public TestSuite getAllTests() {
-        TestSuite suite = new InstrumentationTestSuite(this);
-        suite.addTestSuite(BluetoothStressTest.class);
-        return suite;
-    }
-
-    @Override
-    public ClassLoader getLoader() {
-        return BluetoothTestRunner.class.getClassLoader();
-    }
-
-    @Override
-    public void onCreate(Bundle arguments) {
-        String val = arguments.getString("enable_iterations");
-        if (val != null) {
-            try {
-                sEnableIterations = Integer.parseInt(val);
-            } catch (NumberFormatException e) {
-                // Invalid argument, fall back to default value
-            }
-        }
-
-        val = arguments.getString("discoverable_iterations");
-        if (val != null) {
-            try {
-                sDiscoverableIterations = Integer.parseInt(val);
-            } catch (NumberFormatException e) {
-                // Invalid argument, fall back to default value
-            }
-        }
-
-        val = arguments.getString("scan_iterations");
-        if (val != null) {
-            try {
-                sScanIterations = Integer.parseInt(val);
-            } catch (NumberFormatException e) {
-                // Invalid argument, fall back to default value
-            }
-        }
-
-        val = arguments.getString("enable_pan_iterations");
-        if (val != null) {
-            try {
-                sEnablePanIterations = Integer.parseInt(val);
-            } catch (NumberFormatException e) {
-                // Invalid argument, fall back to default value
-            }
-        }
-
-        val = arguments.getString("pair_iterations");
-        if (val != null) {
-            try {
-                sPairIterations = Integer.parseInt(val);
-            } catch (NumberFormatException e) {
-                // Invalid argument, fall back to default value
-            }
-        }
-
-        val = arguments.getString("connect_a2dp_iterations");
-        if (val != null) {
-            try {
-                sConnectA2dpIterations = Integer.parseInt(val);
-            } catch (NumberFormatException e) {
-                // Invalid argument, fall back to default value
-            }
-        }
-
-        val = arguments.getString("connect_headset_iterations");
-        if (val != null) {
-            try {
-                sConnectHeadsetIterations = Integer.parseInt(val);
-            } catch (NumberFormatException e) {
-                // Invalid argument, fall back to default value
-            }
-        }
-
-        val = arguments.getString("connect_input_iterations");
-        if (val != null) {
-            try {
-                sConnectInputIterations = Integer.parseInt(val);
-            } catch (NumberFormatException e) {
-                // Invalid argument, fall back to default value
-            }
-        }
-
-        val = arguments.getString("connect_pan_iterations");
-        if (val != null) {
-            try {
-                sConnectPanIterations = Integer.parseInt(val);
-            } catch (NumberFormatException e) {
-                // Invalid argument, fall back to default value
-            }
-        }
-
-        val = arguments.getString("start_stop_sco_iterations");
-        if (val != null) {
-            try {
-                sStartStopScoIterations = Integer.parseInt(val);
-            } catch (NumberFormatException e) {
-                // Invalid argument, fall back to default value
-            }
-        }
-
-        val = arguments.getString("mce_set_message_status_iterations");
-        if (val != null) {
-            try {
-                sMceSetMessageStatusIterations = Integer.parseInt(val);
-            } catch (NumberFormatException e) {
-                // Invalid argument, fall back to default value
-            }
-        }
-
-        val = arguments.getString("device_address");
-        if (val != null) {
-            sDeviceAddress = val;
-        }
-
-        val = arguments.getString("device_pair_pin");
-        if (val != null) {
-            byte[] pin = BluetoothDevice.convertPinToBytes(val);
-            if (pin != null) {
-                sDevicePairPin = pin;
-            }
-        }
-
-        val = arguments.getString("device_pair_passkey");
-        if (val != null) {
-            try {
-                sDevicePairPasskey = Integer.parseInt(val);
-            } catch (NumberFormatException e) {
-                // Invalid argument, fall back to default value
-            }
-        }
-
-        Log.i(TAG, String.format("enable_iterations=%d", sEnableIterations));
-        Log.i(TAG, String.format("discoverable_iterations=%d", sDiscoverableIterations));
-        Log.i(TAG, String.format("scan_iterations=%d", sScanIterations));
-        Log.i(TAG, String.format("pair_iterations=%d", sPairIterations));
-        Log.i(TAG, String.format("connect_a2dp_iterations=%d", sConnectA2dpIterations));
-        Log.i(TAG, String.format("connect_headset_iterations=%d", sConnectHeadsetIterations));
-        Log.i(TAG, String.format("connect_input_iterations=%d", sConnectInputIterations));
-        Log.i(TAG, String.format("connect_pan_iterations=%d", sConnectPanIterations));
-        Log.i(TAG, String.format("start_stop_sco_iterations=%d", sStartStopScoIterations));
-        Log.i(TAG, String.format("device_address=%s", sDeviceAddress));
-        Log.i(TAG, String.format("device_pair_pin=%s", new String(sDevicePairPin)));
-        Log.i(TAG, String.format("device_pair_passkey=%d", sDevicePairPasskey));
-
-        // Call onCreate last since we want to set the static variables first.
-        super.onCreate(arguments);
-    }
-}
diff --git a/framework/tests/src/android/bluetooth/BluetoothTestUtils.java b/framework/tests/src/android/bluetooth/BluetoothTestUtils.java
deleted file mode 100644
index 12183f8..0000000
--- a/framework/tests/src/android/bluetooth/BluetoothTestUtils.java
+++ /dev/null
@@ -1,1669 +0,0 @@
-/*
- * Copyright (C) 2010 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package android.bluetooth;
-
-import android.bluetooth.BluetoothPan;
-import android.bluetooth.BluetoothProfile;
-import android.content.BroadcastReceiver;
-import android.content.Context;
-import android.content.Intent;
-import android.content.IntentFilter;
-import android.media.AudioManager;
-import android.net.TetheringManager;
-import android.net.TetheringManager.TetheredInterfaceCallback;
-import android.net.TetheringManager.TetheredInterfaceRequest;
-import android.os.Environment;
-import android.util.Log;
-
-import junit.framework.Assert;
-
-import java.io.BufferedWriter;
-import java.io.File;
-import java.io.FileWriter;
-import java.io.IOException;
-import java.util.ArrayList;
-import java.util.List;
-import java.util.Set;
-import java.util.concurrent.Semaphore;
-import java.util.concurrent.TimeUnit;
-
-public class BluetoothTestUtils extends Assert {
-
-    /** Timeout for enable/disable in ms. */
-    private static final int ENABLE_DISABLE_TIMEOUT = 20000;
-    /** Timeout for discoverable/undiscoverable in ms. */
-    private static final int DISCOVERABLE_UNDISCOVERABLE_TIMEOUT = 5000;
-    /** Timeout for starting/stopping a scan in ms. */
-    private static final int START_STOP_SCAN_TIMEOUT = 5000;
-    /** Timeout for pair/unpair in ms. */
-    private static final int PAIR_UNPAIR_TIMEOUT = 20000;
-    /** Timeout for connecting/disconnecting a profile in ms. */
-    private static final int CONNECT_DISCONNECT_PROFILE_TIMEOUT = 20000;
-    /** Timeout to start or stop a SCO channel in ms. */
-    private static final int START_STOP_SCO_TIMEOUT = 10000;
-    /** Timeout to connect a profile proxy in ms. */
-    private static final int CONNECT_PROXY_TIMEOUT = 5000;
-    /** Time between polls in ms. */
-    private static final int POLL_TIME = 100;
-    /** Timeout to get map message in ms. */
-    private static final int GET_UNREAD_MESSAGE_TIMEOUT = 10000;
-    /** Timeout to set map message status in ms. */
-    private static final int SET_MESSAGE_STATUS_TIMEOUT = 2000;
-
-    private abstract class FlagReceiver extends BroadcastReceiver {
-        private int mExpectedFlags = 0;
-        private int mFiredFlags = 0;
-        private long mCompletedTime = -1;
-
-        public FlagReceiver(int expectedFlags) {
-            mExpectedFlags = expectedFlags;
-        }
-
-        public int getFiredFlags() {
-            synchronized (this) {
-                return mFiredFlags;
-            }
-        }
-
-        public long getCompletedTime() {
-            synchronized (this) {
-                return mCompletedTime;
-            }
-        }
-
-        protected void setFiredFlag(int flag) {
-            synchronized (this) {
-                mFiredFlags |= flag;
-                if ((mFiredFlags & mExpectedFlags) == mExpectedFlags) {
-                    mCompletedTime = System.currentTimeMillis();
-                }
-            }
-        }
-    }
-
-    private class BluetoothReceiver extends FlagReceiver {
-        private static final int DISCOVERY_STARTED_FLAG = 1;
-        private static final int DISCOVERY_FINISHED_FLAG = 1 << 1;
-        private static final int SCAN_MODE_NONE_FLAG = 1 << 2;
-        private static final int SCAN_MODE_CONNECTABLE_FLAG = 1 << 3;
-        private static final int SCAN_MODE_CONNECTABLE_DISCOVERABLE_FLAG = 1 << 4;
-        private static final int STATE_OFF_FLAG = 1 << 5;
-        private static final int STATE_TURNING_ON_FLAG = 1 << 6;
-        private static final int STATE_ON_FLAG = 1 << 7;
-        private static final int STATE_TURNING_OFF_FLAG = 1 << 8;
-        private static final int STATE_GET_MESSAGE_FINISHED_FLAG = 1 << 9;
-        private static final int STATE_SET_MESSAGE_STATUS_FINISHED_FLAG = 1 << 10;
-
-        public BluetoothReceiver(int expectedFlags) {
-            super(expectedFlags);
-        }
-
-        @Override
-        public void onReceive(Context context, Intent intent) {
-            if (BluetoothAdapter.ACTION_DISCOVERY_STARTED.equals(intent.getAction())) {
-                setFiredFlag(DISCOVERY_STARTED_FLAG);
-            } else if (BluetoothAdapter.ACTION_DISCOVERY_FINISHED.equals(intent.getAction())) {
-                setFiredFlag(DISCOVERY_FINISHED_FLAG);
-            } else if (BluetoothAdapter.ACTION_SCAN_MODE_CHANGED.equals(intent.getAction())) {
-                int mode = intent.getIntExtra(BluetoothAdapter.EXTRA_SCAN_MODE, -1);
-                assertNotSame(-1, mode);
-                switch (mode) {
-                    case BluetoothAdapter.SCAN_MODE_NONE:
-                        setFiredFlag(SCAN_MODE_NONE_FLAG);
-                        break;
-                    case BluetoothAdapter.SCAN_MODE_CONNECTABLE:
-                        setFiredFlag(SCAN_MODE_CONNECTABLE_FLAG);
-                        break;
-                    case BluetoothAdapter.SCAN_MODE_CONNECTABLE_DISCOVERABLE:
-                        setFiredFlag(SCAN_MODE_CONNECTABLE_DISCOVERABLE_FLAG);
-                        break;
-                }
-            } else if (BluetoothAdapter.ACTION_STATE_CHANGED.equals(intent.getAction())) {
-                int state = intent.getIntExtra(BluetoothAdapter.EXTRA_STATE, -1);
-                assertNotSame(-1, state);
-                switch (state) {
-                    case BluetoothAdapter.STATE_OFF:
-                        setFiredFlag(STATE_OFF_FLAG);
-                        break;
-                    case BluetoothAdapter.STATE_TURNING_ON:
-                        setFiredFlag(STATE_TURNING_ON_FLAG);
-                        break;
-                    case BluetoothAdapter.STATE_ON:
-                        setFiredFlag(STATE_ON_FLAG);
-                        break;
-                    case BluetoothAdapter.STATE_TURNING_OFF:
-                        setFiredFlag(STATE_TURNING_OFF_FLAG);
-                        break;
-                }
-            }
-        }
-    }
-
-    private class PairReceiver extends FlagReceiver {
-        private static final int STATE_BONDED_FLAG = 1;
-        private static final int STATE_BONDING_FLAG = 1 << 1;
-        private static final int STATE_NONE_FLAG = 1 << 2;
-
-        private BluetoothDevice mDevice;
-        private int mPasskey;
-        private byte[] mPin;
-
-        public PairReceiver(BluetoothDevice device, int passkey, byte[] pin, int expectedFlags) {
-            super(expectedFlags);
-
-            mDevice = device;
-            mPasskey = passkey;
-            mPin = pin;
-        }
-
-        @Override
-        public void onReceive(Context context, Intent intent) {
-            if (!mDevice.equals(intent.getParcelableExtra(BluetoothDevice.EXTRA_DEVICE))) {
-                return;
-            }
-
-            if (BluetoothDevice.ACTION_PAIRING_REQUEST.equals(intent.getAction())) {
-                int varient = intent.getIntExtra(BluetoothDevice.EXTRA_PAIRING_VARIANT, -1);
-                assertNotSame(-1, varient);
-                switch (varient) {
-                    case BluetoothDevice.PAIRING_VARIANT_PIN:
-                    case BluetoothDevice.PAIRING_VARIANT_PIN_16_DIGITS:
-                        mDevice.setPin(mPin);
-                        break;
-                    case BluetoothDevice.PAIRING_VARIANT_PASSKEY:
-                        break;
-                    case BluetoothDevice.PAIRING_VARIANT_PASSKEY_CONFIRMATION:
-                    case BluetoothDevice.PAIRING_VARIANT_CONSENT:
-                        mDevice.setPairingConfirmation(true);
-                        break;
-                    case BluetoothDevice.PAIRING_VARIANT_OOB_CONSENT:
-                        break;
-                }
-            } else if (BluetoothDevice.ACTION_BOND_STATE_CHANGED.equals(intent.getAction())) {
-                int state = intent.getIntExtra(BluetoothDevice.EXTRA_BOND_STATE, -1);
-                assertNotSame(-1, state);
-                switch (state) {
-                    case BluetoothDevice.BOND_NONE:
-                        setFiredFlag(STATE_NONE_FLAG);
-                        break;
-                    case BluetoothDevice.BOND_BONDING:
-                        setFiredFlag(STATE_BONDING_FLAG);
-                        break;
-                    case BluetoothDevice.BOND_BONDED:
-                        setFiredFlag(STATE_BONDED_FLAG);
-                        break;
-                }
-            }
-        }
-    }
-
-    private class ConnectProfileReceiver extends FlagReceiver {
-        private static final int STATE_DISCONNECTED_FLAG = 1;
-        private static final int STATE_CONNECTING_FLAG = 1 << 1;
-        private static final int STATE_CONNECTED_FLAG = 1 << 2;
-        private static final int STATE_DISCONNECTING_FLAG = 1 << 3;
-
-        private BluetoothDevice mDevice;
-        private int mProfile;
-        private String mConnectionAction;
-
-        public ConnectProfileReceiver(BluetoothDevice device, int profile, int expectedFlags) {
-            super(expectedFlags);
-
-            mDevice = device;
-            mProfile = profile;
-
-            switch (mProfile) {
-                case BluetoothProfile.A2DP:
-                    mConnectionAction = BluetoothA2dp.ACTION_CONNECTION_STATE_CHANGED;
-                    break;
-                case BluetoothProfile.HEADSET:
-                    mConnectionAction = BluetoothHeadset.ACTION_CONNECTION_STATE_CHANGED;
-                    break;
-                case BluetoothProfile.HID_HOST:
-                    mConnectionAction = BluetoothHidHost.ACTION_CONNECTION_STATE_CHANGED;
-                    break;
-                case BluetoothProfile.PAN:
-                    mConnectionAction = BluetoothPan.ACTION_CONNECTION_STATE_CHANGED;
-                    break;
-                case BluetoothProfile.MAP_CLIENT:
-                    mConnectionAction = BluetoothMapClient.ACTION_CONNECTION_STATE_CHANGED;
-                    break;
-                default:
-                    mConnectionAction = null;
-            }
-        }
-
-        @Override
-        public void onReceive(Context context, Intent intent) {
-            if (mConnectionAction != null && mConnectionAction.equals(intent.getAction())) {
-                if (!mDevice.equals(intent.getParcelableExtra(BluetoothDevice.EXTRA_DEVICE))) {
-                    return;
-                }
-
-                int state = intent.getIntExtra(BluetoothProfile.EXTRA_STATE, -1);
-                assertNotSame(-1, state);
-                switch (state) {
-                    case BluetoothProfile.STATE_DISCONNECTED:
-                        setFiredFlag(STATE_DISCONNECTED_FLAG);
-                        break;
-                    case BluetoothProfile.STATE_CONNECTING:
-                        setFiredFlag(STATE_CONNECTING_FLAG);
-                        break;
-                    case BluetoothProfile.STATE_CONNECTED:
-                        setFiredFlag(STATE_CONNECTED_FLAG);
-                        break;
-                    case BluetoothProfile.STATE_DISCONNECTING:
-                        setFiredFlag(STATE_DISCONNECTING_FLAG);
-                        break;
-                }
-            }
-        }
-    }
-
-    private class ConnectPanReceiver extends ConnectProfileReceiver {
-        private int mRole;
-
-        public ConnectPanReceiver(BluetoothDevice device, int role, int expectedFlags) {
-            super(device, BluetoothProfile.PAN, expectedFlags);
-
-            mRole = role;
-        }
-
-        @Override
-        public void onReceive(Context context, Intent intent) {
-            if (mRole != intent.getIntExtra(BluetoothPan.EXTRA_LOCAL_ROLE, -1)) {
-                return;
-            }
-
-            super.onReceive(context, intent);
-        }
-    }
-
-    private class StartStopScoReceiver extends FlagReceiver {
-        private static final int STATE_CONNECTED_FLAG = 1;
-        private static final int STATE_DISCONNECTED_FLAG = 1 << 1;
-
-        public StartStopScoReceiver(int expectedFlags) {
-            super(expectedFlags);
-        }
-
-        @Override
-        public void onReceive(Context context, Intent intent) {
-            if (AudioManager.ACTION_SCO_AUDIO_STATE_UPDATED.equals(intent.getAction())) {
-                int state = intent.getIntExtra(AudioManager.EXTRA_SCO_AUDIO_STATE,
-                        AudioManager.SCO_AUDIO_STATE_ERROR);
-                assertNotSame(AudioManager.SCO_AUDIO_STATE_ERROR, state);
-                switch(state) {
-                    case AudioManager.SCO_AUDIO_STATE_CONNECTED:
-                        setFiredFlag(STATE_CONNECTED_FLAG);
-                        break;
-                    case AudioManager.SCO_AUDIO_STATE_DISCONNECTED:
-                        setFiredFlag(STATE_DISCONNECTED_FLAG);
-                        break;
-                }
-            }
-        }
-    }
-
-
-    private class MceSetMessageStatusReceiver extends FlagReceiver {
-        private static final int MESSAGE_RECEIVED_FLAG = 1;
-        private static final int STATUS_CHANGED_FLAG = 1 << 1;
-
-        public MceSetMessageStatusReceiver(int expectedFlags) {
-            super(expectedFlags);
-        }
-
-        @Override
-        public void onReceive(Context context, Intent intent) {
-            if (BluetoothMapClient.ACTION_MESSAGE_RECEIVED.equals(intent.getAction())) {
-                String handle = intent.getStringExtra(BluetoothMapClient.EXTRA_MESSAGE_HANDLE);
-                assertNotNull(handle);
-                setFiredFlag(MESSAGE_RECEIVED_FLAG);
-                mMsgHandle = handle;
-            } else if (BluetoothMapClient.ACTION_MESSAGE_DELETED_STATUS_CHANGED.equals(intent.getAction())) {
-                int result = intent.getIntExtra(BluetoothMapClient.EXTRA_RESULT_CODE, BluetoothMapClient.RESULT_FAILURE);
-                assertEquals(result, BluetoothMapClient.RESULT_SUCCESS);
-                setFiredFlag(STATUS_CHANGED_FLAG);
-            } else if (BluetoothMapClient.ACTION_MESSAGE_READ_STATUS_CHANGED.equals(intent.getAction())) {
-                int result = intent.getIntExtra(BluetoothMapClient.EXTRA_RESULT_CODE, BluetoothMapClient.RESULT_FAILURE);
-                assertEquals(result, BluetoothMapClient.RESULT_SUCCESS);
-                setFiredFlag(STATUS_CHANGED_FLAG);
-            }
-        }
-    }
-
-    private BluetoothProfile.ServiceListener mServiceListener =
-            new BluetoothProfile.ServiceListener() {
-        @Override
-        public void onServiceConnected(int profile, BluetoothProfile proxy) {
-            synchronized (this) {
-                switch (profile) {
-                    case BluetoothProfile.A2DP:
-                        mA2dp = (BluetoothA2dp) proxy;
-                        break;
-                    case BluetoothProfile.HEADSET:
-                        mHeadset = (BluetoothHeadset) proxy;
-                        break;
-                    case BluetoothProfile.HID_HOST:
-                        mInput = (BluetoothHidHost) proxy;
-                        break;
-                    case BluetoothProfile.PAN:
-                        mPan = (BluetoothPan) proxy;
-                        break;
-                    case BluetoothProfile.MAP_CLIENT:
-                        mMce = (BluetoothMapClient) proxy;
-                        break;
-                }
-            }
-        }
-
-        @Override
-        public void onServiceDisconnected(int profile) {
-            synchronized (this) {
-                switch (profile) {
-                    case BluetoothProfile.A2DP:
-                        mA2dp = null;
-                        break;
-                    case BluetoothProfile.HEADSET:
-                        mHeadset = null;
-                        break;
-                    case BluetoothProfile.HID_HOST:
-                        mInput = null;
-                        break;
-                    case BluetoothProfile.PAN:
-                        mPan = null;
-                        break;
-                    case BluetoothProfile.MAP_CLIENT:
-                        mMce = null;
-                        break;
-                }
-            }
-        }
-    };
-
-    private List<BroadcastReceiver> mReceivers = new ArrayList<BroadcastReceiver>();
-
-    private BufferedWriter mOutputWriter;
-    private String mTag;
-    private String mOutputFile;
-
-    private Context mContext;
-    private BluetoothA2dp mA2dp = null;
-    private BluetoothHeadset mHeadset = null;
-    private BluetoothHidHost mInput = null;
-    private BluetoothPan mPan = null;
-    private BluetoothMapClient mMce = null;
-    private String mMsgHandle = null;
-    private TetheredInterfaceCallback mPanCallback = null;
-    private TetheredInterfaceRequest mBluetoothIfaceRequest;
-
-    /**
-     * Creates a utility instance for testing Bluetooth.
-     *
-     * @param context The context of the application using the utility.
-     * @param tag The log tag of the application using the utility.
-     */
-    public BluetoothTestUtils(Context context, String tag) {
-        this(context, tag, null);
-    }
-
-    /**
-     * Creates a utility instance for testing Bluetooth.
-     *
-     * @param context The context of the application using the utility.
-     * @param tag The log tag of the application using the utility.
-     * @param outputFile The path to an output file if the utility is to write results to a
-     *        separate file.
-     */
-    public BluetoothTestUtils(Context context, String tag, String outputFile) {
-        mContext = context;
-        mTag = tag;
-        mOutputFile = outputFile;
-
-        if (mOutputFile == null) {
-            mOutputWriter = null;
-        } else {
-            try {
-                mOutputWriter = new BufferedWriter(new FileWriter(new File(
-                        Environment.getExternalStorageDirectory(), mOutputFile), true));
-            } catch (IOException e) {
-                Log.w(mTag, "Test output file could not be opened", e);
-                mOutputWriter = null;
-            }
-        }
-    }
-
-    /**
-     * Closes the utility instance and unregisters any BroadcastReceivers.
-     */
-    public void close() {
-        while (!mReceivers.isEmpty()) {
-            mContext.unregisterReceiver(mReceivers.remove(0));
-        }
-
-        if (mOutputWriter != null) {
-            try {
-                mOutputWriter.close();
-            } catch (IOException e) {
-                Log.w(mTag, "Test output file could not be closed", e);
-            }
-        }
-    }
-
-    /**
-     * Enables Bluetooth and checks to make sure that Bluetooth was turned on and that the correct
-     * actions were broadcast.
-     *
-     * @param adapter The BT adapter.
-     */
-    public void enable(BluetoothAdapter adapter) {
-        writeOutput("Enabling Bluetooth adapter.");
-        assertFalse(adapter.isEnabled());
-        int btState = adapter.getState();
-        final Semaphore completionSemaphore = new Semaphore(0);
-        final BroadcastReceiver receiver = new BroadcastReceiver() {
-            @Override
-            public void onReceive(Context context, Intent intent) {
-                final String action = intent.getAction();
-                if (!BluetoothAdapter.ACTION_STATE_CHANGED.equals(action)) {
-                    return;
-                }
-                final int state = intent.getIntExtra(BluetoothAdapter.EXTRA_STATE,
-                        BluetoothAdapter.ERROR);
-                if (state == BluetoothAdapter.STATE_ON) {
-                    completionSemaphore.release();
-                }
-            }
-        };
-
-        final IntentFilter filter = new IntentFilter(BluetoothAdapter.ACTION_STATE_CHANGED);
-        mContext.registerReceiver(receiver, filter);
-        // Note: for Wear Local Edition builds, which have Permission Review Mode enabled to
-        // obey China CMIIT, BluetoothAdapter may not startup immediately on methods enable/disable.
-        // So no assertion applied here.
-        adapter.enable();
-        boolean success = false;
-        try {
-            success = completionSemaphore.tryAcquire(ENABLE_DISABLE_TIMEOUT, TimeUnit.MILLISECONDS);
-            writeOutput(String.format("enable() completed in 0 ms"));
-        } catch (final InterruptedException e) {
-            // This should never happen but just in case it does, the test will fail anyway.
-        }
-        mContext.unregisterReceiver(receiver);
-        if (!success) {
-            fail(String.format("enable() timeout: state=%d (expected %d)", btState,
-                    BluetoothAdapter.STATE_ON));
-        }
-    }
-
-    /**
-     * Disables Bluetooth and checks to make sure that Bluetooth was turned off and that the correct
-     * actions were broadcast.
-     *
-     * @param adapter The BT adapter.
-     */
-    public void disable(BluetoothAdapter adapter) {
-        writeOutput("Disabling Bluetooth adapter.");
-        assertTrue(adapter.isEnabled());
-        int btState = adapter.getState();
-        final Semaphore completionSemaphore = new Semaphore(0);
-        final BroadcastReceiver receiver = new BroadcastReceiver() {
-            @Override
-            public void onReceive(Context context, Intent intent) {
-                final String action = intent.getAction();
-                if (!BluetoothAdapter.ACTION_STATE_CHANGED.equals(action)) {
-                    return;
-                }
-                final int state = intent.getIntExtra(BluetoothAdapter.EXTRA_STATE,
-                        BluetoothAdapter.ERROR);
-                if (state == BluetoothAdapter.STATE_OFF) {
-                    completionSemaphore.release();
-                }
-            }
-        };
-
-        final IntentFilter filter = new IntentFilter(BluetoothAdapter.ACTION_STATE_CHANGED);
-        mContext.registerReceiver(receiver, filter);
-        // Note: for Wear Local Edition builds, which have Permission Review Mode enabled to
-        // obey China CMIIT, BluetoothAdapter may not startup immediately on methods enable/disable.
-        // So no assertion applied here.
-        adapter.disable();
-        boolean success = false;
-        try {
-            success = completionSemaphore.tryAcquire(ENABLE_DISABLE_TIMEOUT, TimeUnit.MILLISECONDS);
-            writeOutput(String.format("disable() completed in 0 ms"));
-        } catch (final InterruptedException e) {
-            // This should never happen but just in case it does, the test will fail anyway.
-        }
-        mContext.unregisterReceiver(receiver);
-        if (!success) {
-            fail(String.format("disable() timeout: state=%d (expected %d)", btState,
-                    BluetoothAdapter.STATE_OFF));
-        }
-    }
-
-    /**
-     * Puts the local device into discoverable mode and checks to make sure that the local device
-     * is in discoverable mode and that the correct actions were broadcast.
-     *
-     * @param adapter The BT adapter.
-     */
-    public void discoverable(BluetoothAdapter adapter) {
-        if (!adapter.isEnabled()) {
-            fail("discoverable() bluetooth not enabled");
-        }
-
-        int scanMode = adapter.getScanMode();
-        if (scanMode != BluetoothAdapter.SCAN_MODE_CONNECTABLE) {
-            return;
-        }
-
-        final Semaphore completionSemaphore = new Semaphore(0);
-        final BroadcastReceiver receiver = new BroadcastReceiver() {
-            @Override
-            public void onReceive(Context context, Intent intent) {
-                final String action = intent.getAction();
-                if (!BluetoothAdapter.ACTION_SCAN_MODE_CHANGED.equals(action)) {
-                    return;
-                }
-                final int mode = intent.getIntExtra(BluetoothAdapter.EXTRA_SCAN_MODE,
-                        BluetoothAdapter.SCAN_MODE_NONE);
-                if (mode == BluetoothAdapter.SCAN_MODE_CONNECTABLE_DISCOVERABLE) {
-                    completionSemaphore.release();
-                }
-            }
-        };
-
-        final IntentFilter filter = new IntentFilter(BluetoothAdapter.ACTION_SCAN_MODE_CHANGED);
-        mContext.registerReceiver(receiver, filter);
-        assertEquals(adapter.setScanMode(BluetoothAdapter.SCAN_MODE_CONNECTABLE_DISCOVERABLE),
-                BluetoothStatusCodes.SUCCESS);
-        boolean success = false;
-        try {
-            success = completionSemaphore.tryAcquire(DISCOVERABLE_UNDISCOVERABLE_TIMEOUT,
-                    TimeUnit.MILLISECONDS);
-            writeOutput(String.format("discoverable() completed in 0 ms"));
-        } catch (final InterruptedException e) {
-            // This should never happen but just in case it does, the test will fail anyway.
-        }
-        mContext.unregisterReceiver(receiver);
-        if (!success) {
-            fail(String.format("discoverable() timeout: scanMode=%d (expected %d)", scanMode,
-                    BluetoothAdapter.SCAN_MODE_CONNECTABLE_DISCOVERABLE));
-        }
-    }
-
-    /**
-     * Puts the local device into connectable only mode and checks to make sure that the local
-     * device is in in connectable mode and that the correct actions were broadcast.
-     *
-     * @param adapter The BT adapter.
-     */
-    public void undiscoverable(BluetoothAdapter adapter) {
-        if (!adapter.isEnabled()) {
-            fail("undiscoverable() bluetooth not enabled");
-        }
-
-        int scanMode = adapter.getScanMode();
-        if (scanMode != BluetoothAdapter.SCAN_MODE_CONNECTABLE_DISCOVERABLE) {
-            return;
-        }
-
-        final Semaphore completionSemaphore = new Semaphore(0);
-        final BroadcastReceiver receiver = new BroadcastReceiver() {
-            @Override
-            public void onReceive(Context context, Intent intent) {
-                final String action = intent.getAction();
-                if (!BluetoothAdapter.ACTION_SCAN_MODE_CHANGED.equals(action)) {
-                    return;
-                }
-                final int mode = intent.getIntExtra(BluetoothAdapter.EXTRA_SCAN_MODE,
-                        BluetoothAdapter.SCAN_MODE_NONE);
-                if (mode == BluetoothAdapter.SCAN_MODE_CONNECTABLE) {
-                    completionSemaphore.release();
-                }
-            }
-        };
-
-        final IntentFilter filter = new IntentFilter(BluetoothAdapter.ACTION_SCAN_MODE_CHANGED);
-        mContext.registerReceiver(receiver, filter);
-        assertEquals(adapter.setScanMode(BluetoothAdapter.SCAN_MODE_CONNECTABLE),
-                BluetoothStatusCodes.SUCCESS);
-        boolean success = false;
-        try {
-            success = completionSemaphore.tryAcquire(DISCOVERABLE_UNDISCOVERABLE_TIMEOUT,
-                    TimeUnit.MILLISECONDS);
-            writeOutput(String.format("undiscoverable() completed in 0 ms"));
-        } catch (InterruptedException e) {
-            // This should never happen but just in case it does, the test will fail anyway.
-        }
-        mContext.unregisterReceiver(receiver);
-        if (!success) {
-            fail(String.format("undiscoverable() timeout: scanMode=%d (expected %d)", scanMode,
-                    BluetoothAdapter.SCAN_MODE_CONNECTABLE));
-        }
-    }
-
-    /**
-     * Starts a scan for remote devices and checks to make sure that the local device is scanning
-     * and that the correct actions were broadcast.
-     *
-     * @param adapter The BT adapter.
-     */
-    public void startScan(BluetoothAdapter adapter) {
-        int mask = BluetoothReceiver.DISCOVERY_STARTED_FLAG;
-
-        if (!adapter.isEnabled()) {
-            fail("startScan() bluetooth not enabled");
-        }
-
-        if (adapter.isDiscovering()) {
-            return;
-        }
-
-        BluetoothReceiver receiver = getBluetoothReceiver(mask);
-
-        long start = System.currentTimeMillis();
-        assertTrue(adapter.startDiscovery());
-
-        while (System.currentTimeMillis() - start < START_STOP_SCAN_TIMEOUT) {
-            if (adapter.isDiscovering() && ((receiver.getFiredFlags() & mask) == mask)) {
-                writeOutput(String.format("startScan() completed in %d ms",
-                        (receiver.getCompletedTime() - start)));
-                removeReceiver(receiver);
-                return;
-            }
-            sleep(POLL_TIME);
-        }
-
-        int firedFlags = receiver.getFiredFlags();
-        removeReceiver(receiver);
-        fail(String.format("startScan() timeout: isDiscovering=%b, flags=0x%x (expected 0x%x)",
-                adapter.isDiscovering(), firedFlags, mask));
-    }
-
-    /**
-     * Stops a scan for remote devices and checks to make sure that the local device is not scanning
-     * and that the correct actions were broadcast.
-     *
-     * @param adapter The BT adapter.
-     */
-    public void stopScan(BluetoothAdapter adapter) {
-        int mask = BluetoothReceiver.DISCOVERY_FINISHED_FLAG;
-
-        if (!adapter.isEnabled()) {
-            fail("stopScan() bluetooth not enabled");
-        }
-
-        if (!adapter.isDiscovering()) {
-            return;
-        }
-
-        BluetoothReceiver receiver = getBluetoothReceiver(mask);
-
-        long start = System.currentTimeMillis();
-        assertTrue(adapter.cancelDiscovery());
-
-        while (System.currentTimeMillis() - start < START_STOP_SCAN_TIMEOUT) {
-            if (!adapter.isDiscovering() && ((receiver.getFiredFlags() & mask) == mask)) {
-                writeOutput(String.format("stopScan() completed in %d ms",
-                        (receiver.getCompletedTime() - start)));
-                removeReceiver(receiver);
-                return;
-            }
-            sleep(POLL_TIME);
-        }
-
-        int firedFlags = receiver.getFiredFlags();
-        removeReceiver(receiver);
-        fail(String.format("stopScan() timeout: isDiscovering=%b, flags=0x%x (expected 0x%x)",
-                adapter.isDiscovering(), firedFlags, mask));
-
-    }
-
-    /**
-     * Enables PAN tethering on the local device and checks to make sure that tethering is enabled.
-     *
-     * @param adapter The BT adapter.
-     */
-    public void enablePan(BluetoothAdapter adapter) {
-        if (mPan == null) mPan = (BluetoothPan) connectProxy(adapter, BluetoothProfile.PAN);
-        assertNotNull(mPan);
-
-        long start = System.currentTimeMillis();
-        mPanCallback = new TetheringManager.TetheredInterfaceCallback() {
-                    @Override
-                    public void onAvailable(String iface) {
-                    }
-
-                    @Override
-                    public void onUnavailable() {
-                    }
-                };
-        mBluetoothIfaceRequest = mPan.requestTetheredInterface(mContext.getMainExecutor(),
-                mPanCallback);
-        long stop = System.currentTimeMillis();
-        assertTrue(mPan.isTetheringOn());
-
-        writeOutput(String.format("enablePan() completed in %d ms", (stop - start)));
-    }
-
-    /**
-     * Disables PAN tethering on the local device and checks to make sure that tethering is
-     * disabled.
-     *
-     * @param adapter The BT adapter.
-     */
-    public void disablePan(BluetoothAdapter adapter) {
-        if (mPan == null) mPan = (BluetoothPan) connectProxy(adapter, BluetoothProfile.PAN);
-        assertNotNull(mPan);
-
-        long start = System.currentTimeMillis();
-        if (mBluetoothIfaceRequest != null) {
-            mBluetoothIfaceRequest.release();
-            mBluetoothIfaceRequest = null;
-        }
-        long stop = System.currentTimeMillis();
-        assertFalse(mPan.isTetheringOn());
-
-        writeOutput(String.format("disablePan() completed in %d ms", (stop - start)));
-    }
-
-    /**
-     * Initiates a pairing with a remote device and checks to make sure that the devices are paired
-     * and that the correct actions were broadcast.
-     *
-     * @param adapter The BT adapter.
-     * @param device The remote device.
-     * @param passkey The pairing passkey if pairing requires a passkey. Any value if not.
-     * @param pin The pairing pin if pairing requires a pin. Any value if not.
-     */
-    public void pair(BluetoothAdapter adapter, BluetoothDevice device, int passkey, byte[] pin) {
-        pairOrAcceptPair(adapter, device, passkey, pin, true);
-    }
-
-    /**
-     * Accepts a pairing with a remote device and checks to make sure that the devices are paired
-     * and that the correct actions were broadcast.
-     *
-     * @param adapter The BT adapter.
-     * @param device The remote device.
-     * @param passkey The pairing passkey if pairing requires a passkey. Any value if not.
-     * @param pin The pairing pin if pairing requires a pin. Any value if not.
-     */
-    public void acceptPair(BluetoothAdapter adapter, BluetoothDevice device, int passkey,
-            byte[] pin) {
-        pairOrAcceptPair(adapter, device, passkey, pin, false);
-    }
-
-    /**
-     * Helper method used by {@link #pair(BluetoothAdapter, BluetoothDevice, int, byte[])} and
-     * {@link #acceptPair(BluetoothAdapter, BluetoothDevice, int, byte[])} to either pair or accept
-     * a pairing request.
-     *
-     * @param adapter The BT adapter.
-     * @param device The remote device.
-     * @param passkey The pairing passkey if pairing requires a passkey. Any value if not.
-     * @param pin The pairing pin if pairing requires a pin. Any value if not.
-     * @param shouldPair Whether to pair or accept the pair.
-     */
-    private void pairOrAcceptPair(BluetoothAdapter adapter, BluetoothDevice device, int passkey,
-            byte[] pin, boolean shouldPair) {
-        int mask = PairReceiver.STATE_BONDING_FLAG | PairReceiver.STATE_BONDED_FLAG;
-        long start = -1;
-        String methodName;
-        if (shouldPair) {
-            methodName = String.format("pair(device=%s)", device);
-        } else {
-            methodName = String.format("acceptPair(device=%s)", device);
-        }
-
-        if (!adapter.isEnabled()) {
-            fail(String.format("%s bluetooth not enabled", methodName));
-        }
-
-        PairReceiver receiver = getPairReceiver(device, passkey, pin, mask);
-
-        int state = device.getBondState();
-        switch (state) {
-            case BluetoothDevice.BOND_NONE:
-                assertFalse(adapter.getBondedDevices().contains(device));
-                start = System.currentTimeMillis();
-                if (shouldPair) {
-                    assertTrue(device.createBond());
-                }
-                break;
-            case BluetoothDevice.BOND_BONDING:
-                mask = 0; // Don't check for received intents since we might have missed them.
-                break;
-            case BluetoothDevice.BOND_BONDED:
-                assertTrue(adapter.getBondedDevices().contains(device));
-                return;
-            default:
-                removeReceiver(receiver);
-                fail(String.format("%s invalid state: state=%d", methodName, state));
-        }
-
-        long s = System.currentTimeMillis();
-        while (System.currentTimeMillis() - s < PAIR_UNPAIR_TIMEOUT) {
-            state = device.getBondState();
-            if (state == BluetoothDevice.BOND_BONDED && (receiver.getFiredFlags() & mask) == mask) {
-                assertTrue(adapter.getBondedDevices().contains(device));
-                long finish = receiver.getCompletedTime();
-                if (start != -1 && finish != -1) {
-                    writeOutput(String.format("%s completed in %d ms", methodName,
-                            (finish - start)));
-                } else {
-                    writeOutput(String.format("%s completed", methodName));
-                }
-                removeReceiver(receiver);
-                return;
-            }
-            sleep(POLL_TIME);
-        }
-
-        int firedFlags = receiver.getFiredFlags();
-        removeReceiver(receiver);
-        fail(String.format("%s timeout: state=%d (expected %d), flags=0x%x (expected 0x%x)",
-                methodName, state, BluetoothDevice.BOND_BONDED, firedFlags, mask));
-    }
-
-    /**
-     * Deletes a pairing with a remote device and checks to make sure that the devices are unpaired
-     * and that the correct actions were broadcast.
-     *
-     * @param adapter The BT adapter.
-     * @param device The remote device.
-     */
-    public void unpair(BluetoothAdapter adapter, BluetoothDevice device) {
-        int mask = PairReceiver.STATE_NONE_FLAG;
-        long start = -1;
-        String methodName = String.format("unpair(device=%s)", device);
-
-        if (!adapter.isEnabled()) {
-            fail(String.format("%s bluetooth not enabled", methodName));
-        }
-
-        PairReceiver receiver = getPairReceiver(device, 0, null, mask);
-
-        int state = device.getBondState();
-        switch (state) {
-            case BluetoothDevice.BOND_NONE:
-                assertFalse(adapter.getBondedDevices().contains(device));
-                removeReceiver(receiver);
-                return;
-            case BluetoothDevice.BOND_BONDING:
-                start = System.currentTimeMillis();
-                assertTrue(device.removeBond());
-                break;
-            case BluetoothDevice.BOND_BONDED:
-                assertTrue(adapter.getBondedDevices().contains(device));
-                start = System.currentTimeMillis();
-                assertTrue(device.removeBond());
-                break;
-            default:
-                removeReceiver(receiver);
-                fail(String.format("%s invalid state: state=%d", methodName, state));
-        }
-
-        long s = System.currentTimeMillis();
-        while (System.currentTimeMillis() - s < PAIR_UNPAIR_TIMEOUT) {
-            if (device.getBondState() == BluetoothDevice.BOND_NONE
-                    && (receiver.getFiredFlags() & mask) == mask) {
-                assertFalse(adapter.getBondedDevices().contains(device));
-                long finish = receiver.getCompletedTime();
-                if (start != -1 && finish != -1) {
-                    writeOutput(String.format("%s completed in %d ms", methodName,
-                            (finish - start)));
-                } else {
-                    writeOutput(String.format("%s completed", methodName));
-                }
-                removeReceiver(receiver);
-                return;
-            }
-        }
-
-        int firedFlags = receiver.getFiredFlags();
-        removeReceiver(receiver);
-        fail(String.format("%s timeout: state=%d (expected %d), flags=0x%x (expected 0x%x)",
-                methodName, state, BluetoothDevice.BOND_BONDED, firedFlags, mask));
-    }
-
-    /**
-     * Deletes all pairings of remote devices
-     * @param adapter the BT adapter
-     */
-    public void unpairAll(BluetoothAdapter adapter) {
-        Set<BluetoothDevice> devices = adapter.getBondedDevices();
-        for (BluetoothDevice device : devices) {
-            unpair(adapter, device);
-        }
-    }
-
-    /**
-     * Connects a profile from the local device to a remote device and checks to make sure that the
-     * profile is connected and that the correct actions were broadcast.
-     *
-     * @param adapter The BT adapter.
-     * @param device The remote device.
-     * @param profile The profile to connect. One of {@link BluetoothProfile#A2DP},
-     * {@link BluetoothProfile#HEADSET}, {@link BluetoothProfile#HID_HOST} or {@link BluetoothProfile#MAP_CLIENT}..
-     * @param methodName The method name to printed in the logs.  If null, will be
-     * "connectProfile(profile=&lt;profile&gt;, device=&lt;device&gt;)"
-     */
-    public void connectProfile(BluetoothAdapter adapter, BluetoothDevice device, int profile,
-            String methodName) {
-        if (methodName == null) {
-            methodName = String.format("connectProfile(profile=%d, device=%s)", profile, device);
-        }
-        int mask = (ConnectProfileReceiver.STATE_CONNECTING_FLAG
-                | ConnectProfileReceiver.STATE_CONNECTED_FLAG);
-        long start = -1;
-
-        if (!adapter.isEnabled()) {
-            fail(String.format("%s bluetooth not enabled", methodName));
-        }
-
-        if (!adapter.getBondedDevices().contains(device)) {
-            fail(String.format("%s device not paired", methodName));
-        }
-
-        BluetoothProfile proxy = connectProxy(adapter, profile);
-        assertNotNull(proxy);
-
-        ConnectProfileReceiver receiver = getConnectProfileReceiver(device, profile, mask);
-
-        int state = proxy.getConnectionState(device);
-        switch (state) {
-            case BluetoothProfile.STATE_CONNECTED:
-                removeReceiver(receiver);
-                return;
-            case BluetoothProfile.STATE_CONNECTING:
-                mask = 0; // Don't check for received intents since we might have missed them.
-                break;
-            case BluetoothProfile.STATE_DISCONNECTED:
-            case BluetoothProfile.STATE_DISCONNECTING:
-                start = System.currentTimeMillis();
-                if (profile == BluetoothProfile.A2DP) {
-                    assertTrue(((BluetoothA2dp)proxy).connect(device));
-                } else if (profile == BluetoothProfile.HEADSET) {
-                    assertTrue(((BluetoothHeadset)proxy).connect(device));
-                } else if (profile == BluetoothProfile.HID_HOST) {
-                    assertTrue(((BluetoothHidHost)proxy).connect(device));
-                } else if (profile == BluetoothProfile.MAP_CLIENT) {
-                    assertTrue(((BluetoothMapClient)proxy).connect(device));
-                }
-                break;
-            default:
-                removeReceiver(receiver);
-                fail(String.format("%s invalid state: state=%d", methodName, state));
-        }
-
-        long s = System.currentTimeMillis();
-        while (System.currentTimeMillis() - s < CONNECT_DISCONNECT_PROFILE_TIMEOUT) {
-            state = proxy.getConnectionState(device);
-            if (state == BluetoothProfile.STATE_CONNECTED
-                    && (receiver.getFiredFlags() & mask) == mask) {
-                long finish = receiver.getCompletedTime();
-                if (start != -1 && finish != -1) {
-                    writeOutput(String.format("%s completed in %d ms", methodName,
-                            (finish - start)));
-                } else {
-                    writeOutput(String.format("%s completed", methodName));
-                }
-                removeReceiver(receiver);
-                return;
-            }
-            sleep(POLL_TIME);
-        }
-
-        int firedFlags = receiver.getFiredFlags();
-        removeReceiver(receiver);
-        fail(String.format("%s timeout: state=%d (expected %d), flags=0x%x (expected 0x%x)",
-                methodName, state, BluetoothProfile.STATE_CONNECTED, firedFlags, mask));
-    }
-
-    /**
-     * Disconnects a profile between the local device and a remote device and checks to make sure
-     * that the profile is disconnected and that the correct actions were broadcast.
-     *
-     * @param adapter The BT adapter.
-     * @param device The remote device.
-     * @param profile The profile to disconnect. One of {@link BluetoothProfile#A2DP},
-     * {@link BluetoothProfile#HEADSET}, or {@link BluetoothProfile#HID_HOST}.
-     * @param methodName The method name to printed in the logs.  If null, will be
-     * "connectProfile(profile=&lt;profile&gt;, device=&lt;device&gt;)"
-     */
-    public void disconnectProfile(BluetoothAdapter adapter, BluetoothDevice device, int profile,
-            String methodName) {
-        if (methodName == null) {
-            methodName = String.format("disconnectProfile(profile=%d, device=%s)", profile, device);
-        }
-        int mask = (ConnectProfileReceiver.STATE_DISCONNECTING_FLAG
-                | ConnectProfileReceiver.STATE_DISCONNECTED_FLAG);
-        long start = -1;
-
-        if (!adapter.isEnabled()) {
-            fail(String.format("%s bluetooth not enabled", methodName));
-        }
-
-        if (!adapter.getBondedDevices().contains(device)) {
-            fail(String.format("%s device not paired", methodName));
-        }
-
-        BluetoothProfile proxy = connectProxy(adapter, profile);
-        assertNotNull(proxy);
-
-        ConnectProfileReceiver receiver = getConnectProfileReceiver(device, profile, mask);
-
-        int state = proxy.getConnectionState(device);
-        switch (state) {
-            case BluetoothProfile.STATE_CONNECTED:
-            case BluetoothProfile.STATE_CONNECTING:
-                start = System.currentTimeMillis();
-                if (profile == BluetoothProfile.A2DP) {
-                    assertTrue(((BluetoothA2dp)proxy).disconnect(device));
-                } else if (profile == BluetoothProfile.HEADSET) {
-                    assertTrue(((BluetoothHeadset)proxy).disconnect(device));
-                } else if (profile == BluetoothProfile.HID_HOST) {
-                    assertTrue(((BluetoothHidHost)proxy).disconnect(device));
-                } else if (profile == BluetoothProfile.MAP_CLIENT) {
-                    assertTrue(((BluetoothMapClient)proxy).disconnect(device));
-                }
-                break;
-            case BluetoothProfile.STATE_DISCONNECTED:
-                removeReceiver(receiver);
-                return;
-            case BluetoothProfile.STATE_DISCONNECTING:
-                mask = 0; // Don't check for received intents since we might have missed them.
-                break;
-            default:
-                removeReceiver(receiver);
-                fail(String.format("%s invalid state: state=%d", methodName, state));
-        }
-
-        long s = System.currentTimeMillis();
-        while (System.currentTimeMillis() - s < CONNECT_DISCONNECT_PROFILE_TIMEOUT) {
-            state = proxy.getConnectionState(device);
-            if (state == BluetoothProfile.STATE_DISCONNECTED
-                    && (receiver.getFiredFlags() & mask) == mask) {
-                long finish = receiver.getCompletedTime();
-                if (start != -1 && finish != -1) {
-                    writeOutput(String.format("%s completed in %d ms", methodName,
-                            (finish - start)));
-                } else {
-                    writeOutput(String.format("%s completed", methodName));
-                }
-                removeReceiver(receiver);
-                return;
-            }
-            sleep(POLL_TIME);
-        }
-
-        int firedFlags = receiver.getFiredFlags();
-        removeReceiver(receiver);
-        fail(String.format("%s timeout: state=%d (expected %d), flags=0x%x (expected 0x%x)",
-                methodName, state, BluetoothProfile.STATE_DISCONNECTED, firedFlags, mask));
-    }
-
-    /**
-     * Connects the PANU to a remote NAP and checks to make sure that the PANU is connected and that
-     * the correct actions were broadcast.
-     *
-     * @param adapter The BT adapter.
-     * @param device The remote device.
-     */
-    public void connectPan(BluetoothAdapter adapter, BluetoothDevice device) {
-        connectPanOrIncomingPanConnection(adapter, device, true);
-    }
-
-    /**
-     * Checks that a remote PANU connects to the local NAP correctly and that the correct actions
-     * were broadcast.
-     *
-     * @param adapter The BT adapter.
-     * @param device The remote device.
-     */
-    public void incomingPanConnection(BluetoothAdapter adapter, BluetoothDevice device) {
-        connectPanOrIncomingPanConnection(adapter, device, false);
-    }
-
-    /**
-     * Helper method used by {@link #connectPan(BluetoothAdapter, BluetoothDevice)} and
-     * {@link #incomingPanConnection(BluetoothAdapter, BluetoothDevice)} to either connect to a
-     * remote NAP or verify that a remote device connected to the local NAP.
-     *
-     * @param adapter The BT adapter.
-     * @param device The remote device.
-     * @param connect If the method should initiate the connection (is PANU)
-     */
-    private void connectPanOrIncomingPanConnection(BluetoothAdapter adapter, BluetoothDevice device,
-            boolean connect) {
-        long start = -1;
-        int mask, role;
-        String methodName;
-
-        if (connect) {
-            methodName = String.format("connectPan(device=%s)", device);
-            mask = (ConnectProfileReceiver.STATE_CONNECTED_FLAG |
-                    ConnectProfileReceiver.STATE_CONNECTING_FLAG);
-            role = BluetoothPan.LOCAL_PANU_ROLE;
-        } else {
-            methodName = String.format("incomingPanConnection(device=%s)", device);
-            mask = ConnectProfileReceiver.STATE_CONNECTED_FLAG;
-            role = BluetoothPan.LOCAL_NAP_ROLE;
-        }
-
-        if (!adapter.isEnabled()) {
-            fail(String.format("%s bluetooth not enabled", methodName));
-        }
-
-        if (!adapter.getBondedDevices().contains(device)) {
-            fail(String.format("%s device not paired", methodName));
-        }
-
-        mPan = (BluetoothPan) connectProxy(adapter, BluetoothProfile.PAN);
-        assertNotNull(mPan);
-        ConnectPanReceiver receiver = getConnectPanReceiver(device, role, mask);
-
-        int state = mPan.getConnectionState(device);
-        switch (state) {
-            case BluetoothPan.STATE_CONNECTED:
-                removeReceiver(receiver);
-                return;
-            case BluetoothPan.STATE_CONNECTING:
-                mask = 0; // Don't check for received intents since we might have missed them.
-                break;
-            case BluetoothPan.STATE_DISCONNECTED:
-            case BluetoothPan.STATE_DISCONNECTING:
-                start = System.currentTimeMillis();
-                if (role == BluetoothPan.LOCAL_PANU_ROLE) {
-                    Log.i("BT", "connect to pan");
-                    assertTrue(mPan.connect(device));
-                }
-                break;
-            default:
-                removeReceiver(receiver);
-                fail(String.format("%s invalid state: state=%d", methodName, state));
-        }
-
-        long s = System.currentTimeMillis();
-        while (System.currentTimeMillis() - s < CONNECT_DISCONNECT_PROFILE_TIMEOUT) {
-            state = mPan.getConnectionState(device);
-            if (state == BluetoothPan.STATE_CONNECTED
-                    && (receiver.getFiredFlags() & mask) == mask) {
-                long finish = receiver.getCompletedTime();
-                if (start != -1 && finish != -1) {
-                    writeOutput(String.format("%s completed in %d ms", methodName,
-                            (finish - start)));
-                } else {
-                    writeOutput(String.format("%s completed", methodName));
-                }
-                removeReceiver(receiver);
-                return;
-            }
-            sleep(POLL_TIME);
-        }
-
-        int firedFlags = receiver.getFiredFlags();
-        removeReceiver(receiver);
-        fail(String.format("%s timeout: state=%d (expected %d), flags=0x%x (expected 0x%s)",
-                methodName, state, BluetoothPan.STATE_CONNECTED, firedFlags, mask));
-    }
-
-    /**
-     * Disconnects the PANU from a remote NAP and checks to make sure that the PANU is disconnected
-     * and that the correct actions were broadcast.
-     *
-     * @param adapter The BT adapter.
-     * @param device The remote device.
-     */
-    public void disconnectPan(BluetoothAdapter adapter, BluetoothDevice device) {
-        disconnectFromRemoteOrVerifyConnectNap(adapter, device, true);
-    }
-
-    /**
-     * Checks that a remote PANU disconnects from the local NAP correctly and that the correct
-     * actions were broadcast.
-     *
-     * @param adapter The BT adapter.
-     * @param device The remote device.
-     */
-    public void incomingPanDisconnection(BluetoothAdapter adapter, BluetoothDevice device) {
-        disconnectFromRemoteOrVerifyConnectNap(adapter, device, false);
-    }
-
-    /**
-     * Helper method used by {@link #disconnectPan(BluetoothAdapter, BluetoothDevice)} and
-     * {@link #incomingPanDisconnection(BluetoothAdapter, BluetoothDevice)} to either disconnect
-     * from a remote NAP or verify that a remote device disconnected from the local NAP.
-     *
-     * @param adapter The BT adapter.
-     * @param device The remote device.
-     * @param disconnect Whether the method should connect or verify.
-     */
-    private void disconnectFromRemoteOrVerifyConnectNap(BluetoothAdapter adapter,
-            BluetoothDevice device, boolean disconnect) {
-        long start = -1;
-        int mask, role;
-        String methodName;
-
-        if (disconnect) {
-            methodName = String.format("disconnectPan(device=%s)", device);
-            mask = (ConnectProfileReceiver.STATE_DISCONNECTED_FLAG |
-                    ConnectProfileReceiver.STATE_DISCONNECTING_FLAG);
-            role = BluetoothPan.LOCAL_PANU_ROLE;
-        } else {
-            methodName = String.format("incomingPanDisconnection(device=%s)", device);
-            mask = ConnectProfileReceiver.STATE_DISCONNECTED_FLAG;
-            role = BluetoothPan.LOCAL_NAP_ROLE;
-        }
-
-        if (!adapter.isEnabled()) {
-            fail(String.format("%s bluetooth not enabled", methodName));
-        }
-
-        if (!adapter.getBondedDevices().contains(device)) {
-            fail(String.format("%s device not paired", methodName));
-        }
-
-        mPan = (BluetoothPan) connectProxy(adapter, BluetoothProfile.PAN);
-        assertNotNull(mPan);
-        ConnectPanReceiver receiver = getConnectPanReceiver(device, role, mask);
-
-        int state = mPan.getConnectionState(device);
-        switch (state) {
-            case BluetoothPan.STATE_CONNECTED:
-            case BluetoothPan.STATE_CONNECTING:
-                start = System.currentTimeMillis();
-                if (role == BluetoothPan.LOCAL_PANU_ROLE) {
-                    assertTrue(mPan.disconnect(device));
-                }
-                break;
-            case BluetoothPan.STATE_DISCONNECTED:
-                removeReceiver(receiver);
-                return;
-            case BluetoothPan.STATE_DISCONNECTING:
-                mask = 0; // Don't check for received intents since we might have missed them.
-                break;
-            default:
-                removeReceiver(receiver);
-                fail(String.format("%s invalid state: state=%d", methodName, state));
-        }
-
-        long s = System.currentTimeMillis();
-        while (System.currentTimeMillis() - s < CONNECT_DISCONNECT_PROFILE_TIMEOUT) {
-            state = mPan.getConnectionState(device);
-            if (state == BluetoothHidHost.STATE_DISCONNECTED
-                    && (receiver.getFiredFlags() & mask) == mask) {
-                long finish = receiver.getCompletedTime();
-                if (start != -1 && finish != -1) {
-                    writeOutput(String.format("%s completed in %d ms", methodName,
-                            (finish - start)));
-                } else {
-                    writeOutput(String.format("%s completed", methodName));
-                }
-                removeReceiver(receiver);
-                return;
-            }
-            sleep(POLL_TIME);
-        }
-
-        int firedFlags = receiver.getFiredFlags();
-        removeReceiver(receiver);
-        fail(String.format("%s timeout: state=%d (expected %d), flags=0x%x (expected 0x%s)",
-                methodName, state, BluetoothHidHost.STATE_DISCONNECTED, firedFlags, mask));
-    }
-
-    /**
-     * Opens a SCO channel using {@link android.media.AudioManager#startBluetoothSco()} and checks
-     * to make sure that the channel is opened and that the correct actions were broadcast.
-     *
-     * @param adapter The BT adapter.
-     * @param device The remote device.
-     */
-    public void startSco(BluetoothAdapter adapter, BluetoothDevice device) {
-        startStopSco(adapter, device, true);
-    }
-
-    /**
-     * Closes a SCO channel using {@link android.media.AudioManager#stopBluetoothSco()} and checks
-     *  to make sure that the channel is closed and that the correct actions were broadcast.
-     *
-     * @param adapter The BT adapter.
-     * @param device The remote device.
-     */
-    public void stopSco(BluetoothAdapter adapter, BluetoothDevice device) {
-        startStopSco(adapter, device, false);
-    }
-    /**
-     * Helper method for {@link #startSco(BluetoothAdapter, BluetoothDevice)} and
-     * {@link #stopSco(BluetoothAdapter, BluetoothDevice)}.
-     *
-     * @param adapter The BT adapter.
-     * @param device The remote device.
-     * @param isStart Whether the SCO channel should be opened.
-     */
-    private void startStopSco(BluetoothAdapter adapter, BluetoothDevice device, boolean isStart) {
-        long start = -1;
-        int mask;
-        String methodName;
-
-        if (isStart) {
-            methodName = String.format("startSco(device=%s)", device);
-            mask = StartStopScoReceiver.STATE_CONNECTED_FLAG;
-        } else {
-            methodName = String.format("stopSco(device=%s)", device);
-            mask = StartStopScoReceiver.STATE_DISCONNECTED_FLAG;
-        }
-
-        if (!adapter.isEnabled()) {
-            fail(String.format("%s bluetooth not enabled", methodName));
-        }
-
-        if (!adapter.getBondedDevices().contains(device)) {
-            fail(String.format("%s device not paired", methodName));
-        }
-
-        AudioManager manager = (AudioManager) mContext.getSystemService(Context.AUDIO_SERVICE);
-        assertNotNull(manager);
-
-        if (!manager.isBluetoothScoAvailableOffCall()) {
-            fail(String.format("%s device does not support SCO", methodName));
-        }
-
-        boolean isScoOn = manager.isBluetoothScoOn();
-        if (isStart == isScoOn) {
-            return;
-        }
-
-        StartStopScoReceiver receiver = getStartStopScoReceiver(mask);
-        start = System.currentTimeMillis();
-        if (isStart) {
-            manager.startBluetoothSco();
-        } else {
-            manager.stopBluetoothSco();
-        }
-
-        long s = System.currentTimeMillis();
-        while (System.currentTimeMillis() - s < START_STOP_SCO_TIMEOUT) {
-            isScoOn = manager.isBluetoothScoOn();
-            if (isStart == isScoOn && (receiver.getFiredFlags() & mask) == mask) {
-                long finish = receiver.getCompletedTime();
-                if (start != -1 && finish != -1) {
-                    writeOutput(String.format("%s completed in %d ms", methodName,
-                            (finish - start)));
-                } else {
-                    writeOutput(String.format("%s completed", methodName));
-                }
-                removeReceiver(receiver);
-                return;
-            }
-            sleep(POLL_TIME);
-        }
-
-        int firedFlags = receiver.getFiredFlags();
-        removeReceiver(receiver);
-        fail(String.format("%s timeout: on=%b (expected %b), flags=0x%x (expected 0x%x)",
-                methodName, isScoOn, isStart, firedFlags, mask));
-    }
-
-    /**
-     * Writes a string to the logcat and a file if a file has been specified in the constructor.
-     *
-     * @param s The string to be written.
-     */
-    public void writeOutput(String s) {
-        Log.i(mTag, s);
-        if (mOutputWriter == null) {
-            return;
-        }
-        try {
-            mOutputWriter.write(s + "\n");
-            mOutputWriter.flush();
-        } catch (IOException e) {
-            Log.w(mTag, "Could not write to output file", e);
-        }
-    }
-
-    public void mceGetUnreadMessage(BluetoothAdapter adapter, BluetoothDevice device) {
-        int mask;
-        String methodName = "getUnreadMessage";
-
-        if (!adapter.isEnabled()) {
-            fail(String.format("%s bluetooth not enabled", methodName));
-        }
-
-        if (!adapter.getBondedDevices().contains(device)) {
-            fail(String.format("%s device not paired", methodName));
-        }
-
-        mMce = (BluetoothMapClient) connectProxy(adapter, BluetoothProfile.MAP_CLIENT);
-        assertNotNull(mMce);
-
-        if (mMce.getConnectionState(device) != BluetoothProfile.STATE_CONNECTED) {
-            fail(String.format("%s device is not connected", methodName));
-        }
-
-        mMsgHandle = null;
-        mask = MceSetMessageStatusReceiver.MESSAGE_RECEIVED_FLAG;
-        MceSetMessageStatusReceiver receiver = getMceSetMessageStatusReceiver(device, mask);
-        assertTrue(mMce.getUnreadMessages(device));
-
-        long s = System.currentTimeMillis();
-        while (System.currentTimeMillis() - s < GET_UNREAD_MESSAGE_TIMEOUT) {
-            if ((receiver.getFiredFlags() & mask) == mask) {
-                writeOutput(String.format("%s completed", methodName));
-                removeReceiver(receiver);
-                return;
-            }
-            sleep(POLL_TIME);
-        }
-        int firedFlags = receiver.getFiredFlags();
-        removeReceiver(receiver);
-        fail(String.format("%s timeout: state=%d (expected %d), flags=0x%x (expected 0x%s)",
-                methodName, mMce.getConnectionState(device), BluetoothMapClient.STATE_CONNECTED, firedFlags, mask));
-    }
-
-    /**
-     * Set a message to read/unread/deleted/undeleted
-     */
-    public void mceSetMessageStatus(BluetoothAdapter adapter, BluetoothDevice device, int status) {
-        int mask;
-        String methodName = "setMessageStatus";
-
-        if (!adapter.isEnabled()) {
-            fail(String.format("%s bluetooth not enabled", methodName));
-        }
-
-        if (!adapter.getBondedDevices().contains(device)) {
-            fail(String.format("%s device not paired", methodName));
-        }
-
-        mMce = (BluetoothMapClient) connectProxy(adapter, BluetoothProfile.MAP_CLIENT);
-        assertNotNull(mMce);
-
-        if (mMce.getConnectionState(device) != BluetoothProfile.STATE_CONNECTED) {
-            fail(String.format("%s device is not connected", methodName));
-        }
-
-        assertNotNull(mMsgHandle);
-        mask = MceSetMessageStatusReceiver.STATUS_CHANGED_FLAG;
-        MceSetMessageStatusReceiver receiver = getMceSetMessageStatusReceiver(device, mask);
-
-        assertTrue(mMce.setMessageStatus(device, mMsgHandle, status));
-
-        long s = System.currentTimeMillis();
-        while (System.currentTimeMillis() - s < SET_MESSAGE_STATUS_TIMEOUT) {
-            if ((receiver.getFiredFlags() & mask) == mask) {
-                writeOutput(String.format("%s completed", methodName));
-                removeReceiver(receiver);
-                return;
-            }
-            sleep(POLL_TIME);
-        }
-
-        int firedFlags = receiver.getFiredFlags();
-        removeReceiver(receiver);
-        fail(String.format("%s timeout: state=%d (expected %d), flags=0x%x (expected 0x%s)",
-                methodName, mMce.getConnectionState(device), BluetoothPan.STATE_CONNECTED, firedFlags, mask));
-    }
-
-    private void addReceiver(BroadcastReceiver receiver, String[] actions) {
-        IntentFilter filter = new IntentFilter();
-        for (String action: actions) {
-            filter.addAction(action);
-        }
-        mContext.registerReceiver(receiver, filter);
-        mReceivers.add(receiver);
-    }
-
-    private BluetoothReceiver getBluetoothReceiver(int expectedFlags) {
-        String[] actions = {
-                BluetoothAdapter.ACTION_DISCOVERY_FINISHED,
-                BluetoothAdapter.ACTION_DISCOVERY_STARTED,
-                BluetoothAdapter.ACTION_SCAN_MODE_CHANGED,
-                BluetoothAdapter.ACTION_STATE_CHANGED};
-        BluetoothReceiver receiver = new BluetoothReceiver(expectedFlags);
-        addReceiver(receiver, actions);
-        return receiver;
-    }
-
-    private PairReceiver getPairReceiver(BluetoothDevice device, int passkey, byte[] pin,
-            int expectedFlags) {
-        String[] actions = {
-                BluetoothDevice.ACTION_PAIRING_REQUEST,
-                BluetoothDevice.ACTION_BOND_STATE_CHANGED};
-        PairReceiver receiver = new PairReceiver(device, passkey, pin, expectedFlags);
-        addReceiver(receiver, actions);
-        return receiver;
-    }
-
-    private ConnectProfileReceiver getConnectProfileReceiver(BluetoothDevice device, int profile,
-            int expectedFlags) {
-        String[] actions = {
-                BluetoothA2dp.ACTION_CONNECTION_STATE_CHANGED,
-                BluetoothHeadset.ACTION_CONNECTION_STATE_CHANGED,
-                BluetoothHidHost.ACTION_CONNECTION_STATE_CHANGED,
-                BluetoothMapClient.ACTION_CONNECTION_STATE_CHANGED};
-        ConnectProfileReceiver receiver = new ConnectProfileReceiver(device, profile,
-                expectedFlags);
-        addReceiver(receiver, actions);
-        return receiver;
-    }
-
-    private ConnectPanReceiver getConnectPanReceiver(BluetoothDevice device, int role,
-            int expectedFlags) {
-        String[] actions = {BluetoothPan.ACTION_CONNECTION_STATE_CHANGED};
-        ConnectPanReceiver receiver = new ConnectPanReceiver(device, role, expectedFlags);
-        addReceiver(receiver, actions);
-        return receiver;
-    }
-
-    private StartStopScoReceiver getStartStopScoReceiver(int expectedFlags) {
-        String[] actions = {AudioManager.ACTION_SCO_AUDIO_STATE_UPDATED};
-        StartStopScoReceiver receiver = new StartStopScoReceiver(expectedFlags);
-        addReceiver(receiver, actions);
-        return receiver;
-    }
-
-    private MceSetMessageStatusReceiver getMceSetMessageStatusReceiver(BluetoothDevice device,
-            int expectedFlags) {
-        String[] actions = {BluetoothMapClient.ACTION_MESSAGE_RECEIVED,
-            BluetoothMapClient.ACTION_MESSAGE_READ_STATUS_CHANGED,
-            BluetoothMapClient.ACTION_MESSAGE_DELETED_STATUS_CHANGED};
-        MceSetMessageStatusReceiver receiver = new MceSetMessageStatusReceiver(expectedFlags);
-        addReceiver(receiver, actions);
-        return receiver;
-    }
-
-    private void removeReceiver(BroadcastReceiver receiver) {
-        mContext.unregisterReceiver(receiver);
-        mReceivers.remove(receiver);
-    }
-
-    private BluetoothProfile connectProxy(BluetoothAdapter adapter, int profile) {
-        switch (profile) {
-            case BluetoothProfile.A2DP:
-                if (mA2dp != null) {
-                    return mA2dp;
-                }
-                break;
-            case BluetoothProfile.HEADSET:
-                if (mHeadset != null) {
-                    return mHeadset;
-                }
-                break;
-            case BluetoothProfile.HID_HOST:
-                if (mInput != null) {
-                    return mInput;
-                }
-                break;
-            case BluetoothProfile.PAN:
-                if (mPan != null) {
-                    return mPan;
-                }
-            case BluetoothProfile.MAP_CLIENT:
-                if (mMce != null) {
-                    return mMce;
-                }
-                break;
-            default:
-                return null;
-        }
-        adapter.getProfileProxy(mContext, mServiceListener, profile);
-        long s = System.currentTimeMillis();
-        switch (profile) {
-            case BluetoothProfile.A2DP:
-                while (mA2dp == null && System.currentTimeMillis() - s < CONNECT_PROXY_TIMEOUT) {
-                    sleep(POLL_TIME);
-                }
-                return mA2dp;
-            case BluetoothProfile.HEADSET:
-                while (mHeadset == null && System.currentTimeMillis() - s < CONNECT_PROXY_TIMEOUT) {
-                    sleep(POLL_TIME);
-                }
-                return mHeadset;
-            case BluetoothProfile.HID_HOST:
-                while (mInput == null && System.currentTimeMillis() - s < CONNECT_PROXY_TIMEOUT) {
-                    sleep(POLL_TIME);
-                }
-                return mInput;
-            case BluetoothProfile.PAN:
-                while (mPan == null && System.currentTimeMillis() - s < CONNECT_PROXY_TIMEOUT) {
-                    sleep(POLL_TIME);
-                }
-                return mPan;
-            case BluetoothProfile.MAP_CLIENT:
-                while (mMce == null && System.currentTimeMillis() - s < CONNECT_PROXY_TIMEOUT) {
-                    sleep(POLL_TIME);
-                }
-                return mMce;
-            default:
-                return null;
-        }
-    }
-
-    private void sleep(long time) {
-        try {
-            Thread.sleep(time);
-        } catch (InterruptedException e) {
-        }
-    }
-}
diff --git a/framework/tests/src/android/bluetooth/BluetoothUuidTest.java b/framework/tests/src/android/bluetooth/BluetoothUuidTest.java
deleted file mode 100644
index 536d722..0000000
--- a/framework/tests/src/android/bluetooth/BluetoothUuidTest.java
+++ /dev/null
@@ -1,66 +0,0 @@
-/*
- * Copyright (C) 2014 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package android.bluetooth;
-
-import android.os.ParcelUuid;
-import android.test.suitebuilder.annotation.SmallTest;
-
-import junit.framework.TestCase;
-
-/**
- * Unit test cases for {@link BluetoothUuid}.
- * <p>
- * To run this test, use adb shell am instrument -e class 'android.bluetooth.BluetoothUuidTest' -w
- * 'com.android.bluetooth.tests/android.bluetooth.BluetoothTestRunner'
- */
-public class BluetoothUuidTest extends TestCase {
-
-    @SmallTest
-    public void testUuidParser() {
-        byte[] uuid16 = new byte[] {
-                0x0B, 0x11 };
-        assertEquals(ParcelUuid.fromString("0000110B-0000-1000-8000-00805F9B34FB"),
-                BluetoothUuid.parseUuidFrom(uuid16));
-
-        byte[] uuid32 = new byte[] {
-                0x0B, 0x11, 0x33, (byte) 0xFE };
-        assertEquals(ParcelUuid.fromString("FE33110B-0000-1000-8000-00805F9B34FB"),
-                BluetoothUuid.parseUuidFrom(uuid32));
-
-        byte[] uuid128 = new byte[] {
-                0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08,
-                0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F, (byte) 0xFF };
-        assertEquals(ParcelUuid.fromString("FF0F0E0D-0C0B-0A09-0807-0060504030201"),
-                BluetoothUuid.parseUuidFrom(uuid128));
-    }
-
-    @SmallTest
-    public void testUuidType() {
-        assertTrue(BluetoothUuid.is16BitUuid(
-                ParcelUuid.fromString("0000110B-0000-1000-8000-00805F9B34FB")));
-        assertFalse(BluetoothUuid.is32BitUuid(
-                ParcelUuid.fromString("0000110B-0000-1000-8000-00805F9B34FB")));
-
-        assertFalse(BluetoothUuid.is16BitUuid(
-                ParcelUuid.fromString("FE33110B-0000-1000-8000-00805F9B34FB")));
-        assertTrue(BluetoothUuid.is32BitUuid(
-                ParcelUuid.fromString("FE33110B-0000-1000-8000-00805F9B34FB")));
-        assertFalse(BluetoothUuid.is32BitUuid(
-                ParcelUuid.fromString("FE33110B-1000-1000-8000-00805F9B34FB")));
-
-    }
-}
diff --git a/framework/tests/src/android/bluetooth/le/AdvertiseDataTest.java b/framework/tests/src/android/bluetooth/le/AdvertiseDataTest.java
deleted file mode 100644
index e58d905..0000000
--- a/framework/tests/src/android/bluetooth/le/AdvertiseDataTest.java
+++ /dev/null
@@ -1,144 +0,0 @@
-/*
- * Copyright (C) 2014 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package android.bluetooth.le;
-
-import android.os.Parcel;
-import android.os.ParcelUuid;
-import android.test.suitebuilder.annotation.SmallTest;
-
-import junit.framework.TestCase;
-
-/**
- * Unit test cases for {@link AdvertiseData}.
- * <p>
- * To run the test, use adb shell am instrument -e class 'android.bluetooth.le.AdvertiseDataTest' -w
- * 'com.android.bluetooth.tests/android.bluetooth.BluetoothTestRunner'
- */
-public class AdvertiseDataTest extends TestCase {
-
-    private AdvertiseData.Builder mAdvertiseDataBuilder;
-
-    @Override
-    protected void setUp() throws Exception {
-        mAdvertiseDataBuilder = new AdvertiseData.Builder();
-    }
-
-    @SmallTest
-    public void testEmptyData() {
-        Parcel parcel = Parcel.obtain();
-        AdvertiseData data = mAdvertiseDataBuilder.build();
-        data.writeToParcel(parcel, 0);
-        parcel.setDataPosition(0);
-        AdvertiseData dataFromParcel =
-                AdvertiseData.CREATOR.createFromParcel(parcel);
-        assertEquals(data, dataFromParcel);
-    }
-
-    @SmallTest
-    public void testEmptyServiceUuid() {
-        Parcel parcel = Parcel.obtain();
-        AdvertiseData data = mAdvertiseDataBuilder.setIncludeDeviceName(true).build();
-        data.writeToParcel(parcel, 0);
-        parcel.setDataPosition(0);
-        AdvertiseData dataFromParcel =
-                AdvertiseData.CREATOR.createFromParcel(parcel);
-        assertEquals(data, dataFromParcel);
-    }
-
-    @SmallTest
-    public void testEmptyManufacturerData() {
-        Parcel parcel = Parcel.obtain();
-        int manufacturerId = 50;
-        byte[] manufacturerData = new byte[0];
-        AdvertiseData data =
-                mAdvertiseDataBuilder.setIncludeDeviceName(true)
-                        .addManufacturerData(manufacturerId, manufacturerData).build();
-        data.writeToParcel(parcel, 0);
-        parcel.setDataPosition(0);
-        AdvertiseData dataFromParcel =
-                AdvertiseData.CREATOR.createFromParcel(parcel);
-        assertEquals(data, dataFromParcel);
-    }
-
-    @SmallTest
-    public void testEmptyServiceData() {
-        Parcel parcel = Parcel.obtain();
-        ParcelUuid uuid = ParcelUuid.fromString("0000110A-0000-1000-8000-00805F9B34FB");
-        byte[] serviceData = new byte[0];
-        AdvertiseData data =
-                mAdvertiseDataBuilder.setIncludeDeviceName(true)
-                        .addServiceData(uuid, serviceData).build();
-        data.writeToParcel(parcel, 0);
-        parcel.setDataPosition(0);
-        AdvertiseData dataFromParcel =
-                AdvertiseData.CREATOR.createFromParcel(parcel);
-        assertEquals(data, dataFromParcel);
-    }
-
-    @SmallTest
-    public void testServiceUuid() {
-        Parcel parcel = Parcel.obtain();
-        ParcelUuid uuid = ParcelUuid.fromString("0000110A-0000-1000-8000-00805F9B34FB");
-        ParcelUuid uuid2 = ParcelUuid.fromString("0000110B-0000-1000-8000-00805F9B34FB");
-
-        AdvertiseData data =
-                mAdvertiseDataBuilder.setIncludeDeviceName(true)
-                        .addServiceUuid(uuid).addServiceUuid(uuid2).build();
-        data.writeToParcel(parcel, 0);
-        parcel.setDataPosition(0);
-        AdvertiseData dataFromParcel =
-                AdvertiseData.CREATOR.createFromParcel(parcel);
-        assertEquals(data, dataFromParcel);
-    }
-
-    @SmallTest
-    public void testManufacturerData() {
-        Parcel parcel = Parcel.obtain();
-        ParcelUuid uuid = ParcelUuid.fromString("0000110A-0000-1000-8000-00805F9B34FB");
-        ParcelUuid uuid2 = ParcelUuid.fromString("0000110B-0000-1000-8000-00805F9B34FB");
-
-        int manufacturerId = 50;
-        byte[] manufacturerData = new byte[] {
-                (byte) 0xF0, 0x00, 0x02, 0x15 };
-        AdvertiseData data =
-                mAdvertiseDataBuilder.setIncludeDeviceName(true)
-                        .addServiceUuid(uuid).addServiceUuid(uuid2)
-                        .addManufacturerData(manufacturerId, manufacturerData).build();
-
-        data.writeToParcel(parcel, 0);
-        parcel.setDataPosition(0);
-        AdvertiseData dataFromParcel =
-                AdvertiseData.CREATOR.createFromParcel(parcel);
-        assertEquals(data, dataFromParcel);
-    }
-
-    @SmallTest
-    public void testServiceData() {
-        Parcel parcel = Parcel.obtain();
-        ParcelUuid uuid = ParcelUuid.fromString("0000110A-0000-1000-8000-00805F9B34FB");
-        byte[] serviceData = new byte[] {
-                (byte) 0xF0, 0x00, 0x02, 0x15 };
-        AdvertiseData data =
-                mAdvertiseDataBuilder.setIncludeDeviceName(true)
-                        .addServiceData(uuid, serviceData).build();
-        data.writeToParcel(parcel, 0);
-        parcel.setDataPosition(0);
-        AdvertiseData dataFromParcel =
-                AdvertiseData.CREATOR.createFromParcel(parcel);
-        assertEquals(data, dataFromParcel);
-    }
-}
diff --git a/framework/tests/src/android/bluetooth/le/ScanFilterTest.java b/framework/tests/src/android/bluetooth/le/ScanFilterTest.java
deleted file mode 100644
index 35da4bc..0000000
--- a/framework/tests/src/android/bluetooth/le/ScanFilterTest.java
+++ /dev/null
@@ -1,215 +0,0 @@
-/*
- * Copyright (C) 2014 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package android.bluetooth.le;
-
-import android.bluetooth.BluetoothAdapter;
-import android.bluetooth.BluetoothDevice;
-import android.bluetooth.le.ScanFilter;
-import android.bluetooth.le.ScanRecord;
-import android.os.Parcel;
-import android.os.ParcelUuid;
-import android.test.suitebuilder.annotation.SmallTest;
-
-import junit.framework.TestCase;
-
-/**
- * Unit test cases for Bluetooth LE scan filters.
- * <p>
- * To run this test, use adb shell am instrument -e class 'android.bluetooth.ScanFilterTest' -w
- * 'com.android.bluetooth.tests/android.bluetooth.BluetoothTestRunner'
- */
-public class ScanFilterTest extends TestCase {
-
-    private static final String DEVICE_MAC = "01:02:03:04:05:AB";
-    private ScanResult mScanResult;
-    private ScanFilter.Builder mFilterBuilder;
-
-    @Override
-    protected void setUp() throws Exception {
-        byte[] scanRecord = new byte[] {
-                0x02, 0x01, 0x1a, // advertising flags
-                0x05, 0x02, 0x0b, 0x11, 0x0a, 0x11, // 16 bit service uuids
-                0x04, 0x09, 0x50, 0x65, 0x64, // setName
-                0x02, 0x0A, (byte) 0xec, // tx power level
-                0x05, 0x16, 0x0b, 0x11, 0x50, 0x64, // service data
-                0x05, (byte) 0xff, (byte) 0xe0, 0x00, 0x02, 0x15, // manufacturer specific data
-                0x03, 0x50, 0x01, 0x02, // an unknown data type won't cause trouble
-        };
-
-        BluetoothAdapter adapter = BluetoothAdapter.getDefaultAdapter();
-        BluetoothDevice device = adapter.getRemoteDevice(DEVICE_MAC);
-        mScanResult = new ScanResult(device, ScanRecord.parseFromBytes(scanRecord),
-                -10, 1397545200000000L);
-        mFilterBuilder = new ScanFilter.Builder();
-    }
-
-    @SmallTest
-    public void testsetNameFilter() {
-        ScanFilter filter = mFilterBuilder.setDeviceName("Ped").build();
-        assertTrue("setName filter fails", filter.matches(mScanResult));
-
-        filter = mFilterBuilder.setDeviceName("Pem").build();
-        assertFalse("setName filter fails", filter.matches(mScanResult));
-
-    }
-
-    @SmallTest
-    public void testDeviceFilter() {
-        ScanFilter filter = mFilterBuilder.setDeviceAddress(DEVICE_MAC).build();
-        assertTrue("device filter fails", filter.matches(mScanResult));
-
-        filter = mFilterBuilder.setDeviceAddress("11:22:33:44:55:66").build();
-        assertFalse("device filter fails", filter.matches(mScanResult));
-    }
-
-    @SmallTest
-    public void testsetServiceUuidFilter() {
-        ScanFilter filter = mFilterBuilder.setServiceUuid(
-                ParcelUuid.fromString("0000110A-0000-1000-8000-00805F9B34FB")).build();
-        assertTrue("uuid filter fails", filter.matches(mScanResult));
-
-        filter = mFilterBuilder.setServiceUuid(
-                ParcelUuid.fromString("0000110C-0000-1000-8000-00805F9B34FB")).build();
-        assertFalse("uuid filter fails", filter.matches(mScanResult));
-
-        filter = mFilterBuilder
-                .setServiceUuid(ParcelUuid.fromString("0000110C-0000-1000-8000-00805F9B34FB"),
-                        ParcelUuid.fromString("FFFFFFF0-FFFF-FFFF-FFFF-FFFFFFFFFFFF"))
-                .build();
-        assertTrue("uuid filter fails", filter.matches(mScanResult));
-    }
-
-    @SmallTest
-    public void testsetServiceDataFilter() {
-        byte[] setServiceData = new byte[] {
-                0x50, 0x64 };
-        ParcelUuid serviceDataUuid = ParcelUuid.fromString("0000110B-0000-1000-8000-00805F9B34FB");
-        ScanFilter filter = mFilterBuilder.setServiceData(serviceDataUuid, setServiceData).build();
-        assertTrue("service data filter fails", filter.matches(mScanResult));
-
-        byte[] emptyData = new byte[0];
-        filter = mFilterBuilder.setServiceData(serviceDataUuid, emptyData).build();
-        assertTrue("service data filter fails", filter.matches(mScanResult));
-
-        byte[] prefixData = new byte[] {
-                0x50 };
-        filter = mFilterBuilder.setServiceData(serviceDataUuid, prefixData).build();
-        assertTrue("service data filter fails", filter.matches(mScanResult));
-
-        byte[] nonMatchData = new byte[] {
-                0x51, 0x64 };
-        byte[] mask = new byte[] {
-                (byte) 0x00, (byte) 0xFF };
-        filter = mFilterBuilder.setServiceData(serviceDataUuid, nonMatchData, mask).build();
-        assertTrue("partial service data filter fails", filter.matches(mScanResult));
-
-        filter = mFilterBuilder.setServiceData(serviceDataUuid, nonMatchData).build();
-        assertFalse("service data filter fails", filter.matches(mScanResult));
-    }
-
-    @SmallTest
-    public void testManufacturerSpecificData() {
-        byte[] setManufacturerData = new byte[] {
-                0x02, 0x15 };
-        int manufacturerId = 0xE0;
-        ScanFilter filter =
-                mFilterBuilder.setManufacturerData(manufacturerId, setManufacturerData).build();
-        assertTrue("manufacturer data filter fails", filter.matches(mScanResult));
-
-        byte[] emptyData = new byte[0];
-        filter = mFilterBuilder.setManufacturerData(manufacturerId, emptyData).build();
-        assertTrue("manufacturer data filter fails", filter.matches(mScanResult));
-
-        byte[] prefixData = new byte[] {
-                0x02 };
-        filter = mFilterBuilder.setManufacturerData(manufacturerId, prefixData).build();
-        assertTrue("manufacturer data filter fails", filter.matches(mScanResult));
-
-        // Test data mask
-        byte[] nonMatchData = new byte[] {
-                0x02, 0x14 };
-        filter = mFilterBuilder.setManufacturerData(manufacturerId, nonMatchData).build();
-        assertFalse("manufacturer data filter fails", filter.matches(mScanResult));
-        byte[] mask = new byte[] {
-                (byte) 0xFF, (byte) 0x00
-        };
-        filter = mFilterBuilder.setManufacturerData(manufacturerId, nonMatchData, mask).build();
-        assertTrue("partial setManufacturerData filter fails", filter.matches(mScanResult));
-    }
-
-    @SmallTest
-    public void testReadWriteParcel() {
-        ScanFilter filter = mFilterBuilder.build();
-        testReadWriteParcelForFilter(filter);
-
-        filter = mFilterBuilder.setDeviceName("Ped").build();
-        testReadWriteParcelForFilter(filter);
-
-        filter = mFilterBuilder.setDeviceAddress("11:22:33:44:55:66").build();
-        testReadWriteParcelForFilter(filter);
-
-        filter = mFilterBuilder.setServiceUuid(
-                ParcelUuid.fromString("0000110C-0000-1000-8000-00805F9B34FB")).build();
-        testReadWriteParcelForFilter(filter);
-
-        filter = mFilterBuilder.setServiceUuid(
-                ParcelUuid.fromString("0000110C-0000-1000-8000-00805F9B34FB"),
-                ParcelUuid.fromString("FFFFFFF0-FFFF-FFFF-FFFF-FFFFFFFFFFFF")).build();
-        testReadWriteParcelForFilter(filter);
-
-        byte[] serviceData = new byte[] {
-                0x50, 0x64 };
-
-        ParcelUuid serviceDataUuid = ParcelUuid.fromString("0000110B-0000-1000-8000-00805F9B34FB");
-        filter = mFilterBuilder.setServiceData(serviceDataUuid, serviceData).build();
-        testReadWriteParcelForFilter(filter);
-
-        filter = mFilterBuilder.setServiceData(serviceDataUuid, new byte[0]).build();
-        testReadWriteParcelForFilter(filter);
-
-        byte[] serviceDataMask = new byte[] {
-                (byte) 0xFF, (byte) 0xFF };
-        filter = mFilterBuilder.setServiceData(serviceDataUuid, serviceData, serviceDataMask)
-                .build();
-        testReadWriteParcelForFilter(filter);
-
-        byte[] manufacturerData = new byte[] {
-                0x02, 0x15 };
-        int manufacturerId = 0xE0;
-        filter = mFilterBuilder.setManufacturerData(manufacturerId, manufacturerData).build();
-        testReadWriteParcelForFilter(filter);
-
-        filter = mFilterBuilder.setServiceData(serviceDataUuid, new byte[0]).build();
-        testReadWriteParcelForFilter(filter);
-
-        byte[] manufacturerDataMask = new byte[] {
-                (byte) 0xFF, (byte) 0xFF
-        };
-        filter = mFilterBuilder.setManufacturerData(manufacturerId, manufacturerData,
-                manufacturerDataMask).build();
-        testReadWriteParcelForFilter(filter);
-    }
-
-    private void testReadWriteParcelForFilter(ScanFilter filter) {
-        Parcel parcel = Parcel.obtain();
-        filter.writeToParcel(parcel, 0);
-        parcel.setDataPosition(0);
-        ScanFilter filterFromParcel =
-                ScanFilter.CREATOR.createFromParcel(parcel);
-        assertEquals(filter, filterFromParcel);
-    }
-}
diff --git a/framework/tests/src/android/bluetooth/le/ScanRecordTest.java b/framework/tests/src/android/bluetooth/le/ScanRecordTest.java
deleted file mode 100644
index 76f5615..0000000
--- a/framework/tests/src/android/bluetooth/le/ScanRecordTest.java
+++ /dev/null
@@ -1,166 +0,0 @@
-/*
- * Copyright (C) 2014 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package android.bluetooth.le;
-
-import android.os.ParcelUuid;
-import android.test.suitebuilder.annotation.SmallTest;
-
-import com.android.internal.util.HexDump;
-import com.android.modules.utils.BytesMatcher;
-
-import junit.framework.TestCase;
-
-import java.util.ArrayList;
-import java.util.Arrays;
-import java.util.List;
-import java.util.function.Predicate;
-
-/**
- * Unit test cases for {@link ScanRecord}.
- * <p>
- * To run this test, use adb shell am instrument -e class 'android.bluetooth.ScanRecordTest' -w
- * 'com.android.bluetooth.tests/android.bluetooth.BluetoothTestRunner'
- */
-public class ScanRecordTest extends TestCase {
-    /**
-     * Example raw beacons captured from a Blue Charm BC011
-     */
-    private static final String RECORD_URL = "0201060303AAFE1716AAFE10EE01626C7565636861726D626561636F6E730009168020691E0EFE13551109426C7565436861726D5F313639363835000000";
-    private static final String RECORD_UUID = "0201060303AAFE1716AAFE00EE626C7565636861726D31000000000001000009168020691E0EFE13551109426C7565436861726D5F313639363835000000";
-    private static final String RECORD_TLM = "0201060303AAFE1116AAFE20000BF017000008874803FB93540916802069080EFE13551109426C7565436861726D5F313639363835000000000000000000";
-    private static final String RECORD_IBEACON = "0201061AFF4C000215426C7565436861726D426561636F6E730EFE1355C509168020691E0EFE13551109426C7565436861726D5F31363936383500000000";
-
-    /**
-     * Example Eddystone E2EE-EID beacon from design doc
-     */
-    private static final String RECORD_E2EE_EID = "0201061816AAFE400000000000000000000000000000000000000000";
-
-    @SmallTest
-    public void testMatchesAnyField_Eddystone_Parser() {
-        final List<String> found = new ArrayList<>();
-        final Predicate<byte[]> matcher = (v) -> {
-            found.add(HexDump.toHexString(v));
-            return false;
-        };
-        ScanRecord.parseFromBytes(HexDump.hexStringToByteArray(RECORD_URL))
-                .matchesAnyField(matcher);
-
-        assertEquals(Arrays.asList(
-                "020106",
-                "0303AAFE",
-                "1716AAFE10EE01626C7565636861726D626561636F6E7300",
-                "09168020691E0EFE1355",
-                "1109426C7565436861726D5F313639363835"), found);
-    }
-
-    @SmallTest
-    public void testMatchesAnyField_Eddystone() {
-        final BytesMatcher matcher = BytesMatcher.decode("⊆0016AAFE/00FFFFFF");
-        assertMatchesAnyField(RECORD_URL, matcher);
-        assertMatchesAnyField(RECORD_UUID, matcher);
-        assertMatchesAnyField(RECORD_TLM, matcher);
-        assertMatchesAnyField(RECORD_E2EE_EID, matcher);
-        assertNotMatchesAnyField(RECORD_IBEACON, matcher);
-    }
-
-    @SmallTest
-    public void testMatchesAnyField_Eddystone_ExceptE2eeEid() {
-        final BytesMatcher matcher = BytesMatcher
-                .decode("⊈0016AAFE40/00FFFFFFFF,⊆0016AAFE/00FFFFFF");
-        assertMatchesAnyField(RECORD_URL, matcher);
-        assertMatchesAnyField(RECORD_UUID, matcher);
-        assertMatchesAnyField(RECORD_TLM, matcher);
-        assertNotMatchesAnyField(RECORD_E2EE_EID, matcher);
-        assertNotMatchesAnyField(RECORD_IBEACON, matcher);
-    }
-
-    @SmallTest
-    public void testMatchesAnyField_iBeacon_Parser() {
-        final List<String> found = new ArrayList<>();
-        final Predicate<byte[]> matcher = (v) -> {
-            found.add(HexDump.toHexString(v));
-            return false;
-        };
-        ScanRecord.parseFromBytes(HexDump.hexStringToByteArray(RECORD_IBEACON))
-                .matchesAnyField(matcher);
-
-        assertEquals(Arrays.asList(
-                "020106",
-                "1AFF4C000215426C7565436861726D426561636F6E730EFE1355C5",
-                "09168020691E0EFE1355",
-                "1109426C7565436861726D5F313639363835"), found);
-    }
-
-    @SmallTest
-    public void testMatchesAnyField_iBeacon() {
-        final BytesMatcher matcher = BytesMatcher.decode("⊆00FF4C0002/00FFFFFFFF");
-        assertNotMatchesAnyField(RECORD_URL, matcher);
-        assertNotMatchesAnyField(RECORD_UUID, matcher);
-        assertNotMatchesAnyField(RECORD_TLM, matcher);
-        assertNotMatchesAnyField(RECORD_E2EE_EID, matcher);
-        assertMatchesAnyField(RECORD_IBEACON, matcher);
-    }
-
-    @SmallTest
-    public void testParser() {
-        byte[] scanRecord = new byte[] {
-                0x02, 0x01, 0x1a, // advertising flags
-                0x05, 0x02, 0x0b, 0x11, 0x0a, 0x11, // 16 bit service uuids
-                0x04, 0x09, 0x50, 0x65, 0x64, // name
-                0x02, 0x0A, (byte) 0xec, // tx power level
-                0x05, 0x16, 0x0b, 0x11, 0x50, 0x64, // service data
-                0x05, (byte) 0xff, (byte) 0xe0, 0x00, 0x02, 0x15, // manufacturer specific data
-                0x03, 0x50, 0x01, 0x02, // an unknown data type won't cause trouble
-        };
-        ScanRecord data = ScanRecord.parseFromBytes(scanRecord);
-        assertEquals(0x1a, data.getAdvertiseFlags());
-        ParcelUuid uuid1 = ParcelUuid.fromString("0000110A-0000-1000-8000-00805F9B34FB");
-        ParcelUuid uuid2 = ParcelUuid.fromString("0000110B-0000-1000-8000-00805F9B34FB");
-        assertTrue(data.getServiceUuids().contains(uuid1));
-        assertTrue(data.getServiceUuids().contains(uuid2));
-
-        assertEquals("Ped", data.getDeviceName());
-        assertEquals(-20, data.getTxPowerLevel());
-
-        assertTrue(data.getManufacturerSpecificData().get(0x00E0) != null);
-        assertArrayEquals(new byte[] {
-                0x02, 0x15 }, data.getManufacturerSpecificData().get(0x00E0));
-
-        assertTrue(data.getServiceData().containsKey(uuid2));
-        assertArrayEquals(new byte[] {
-                0x50, 0x64 }, data.getServiceData().get(uuid2));
-    }
-
-    // Assert two byte arrays are equal.
-    private static void assertArrayEquals(byte[] expected, byte[] actual) {
-        if (!Arrays.equals(expected, actual)) {
-            fail("expected:<" + Arrays.toString(expected) +
-                    "> but was:<" + Arrays.toString(actual) + ">");
-        }
-
-    }
-
-    private static void assertMatchesAnyField(String record, BytesMatcher matcher) {
-        assertTrue(ScanRecord.parseFromBytes(HexDump.hexStringToByteArray(record))
-                .matchesAnyField(matcher));
-    }
-
-    private static void assertNotMatchesAnyField(String record, BytesMatcher matcher) {
-        assertFalse(ScanRecord.parseFromBytes(HexDump.hexStringToByteArray(record))
-                .matchesAnyField(matcher));
-    }
-}
diff --git a/framework/tests/src/android/bluetooth/le/ScanResultTest.java b/framework/tests/src/android/bluetooth/le/ScanResultTest.java
deleted file mode 100644
index 01d5c59..0000000
--- a/framework/tests/src/android/bluetooth/le/ScanResultTest.java
+++ /dev/null
@@ -1,56 +0,0 @@
-/*
- * Copyright (C) 2014 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package android.bluetooth.le;
-
-import android.bluetooth.BluetoothAdapter;
-import android.bluetooth.BluetoothDevice;
-import android.os.Parcel;
-import android.test.suitebuilder.annotation.SmallTest;
-
-import junit.framework.TestCase;
-
-/**
- * Unit test cases for Bluetooth LE scans.
- * <p>
- * To run this test, use adb shell am instrument -e class 'android.bluetooth.ScanResultTest' -w
- * 'com.android.bluetooth.tests/android.bluetooth.BluetoothTestRunner'
- */
-public class ScanResultTest extends TestCase {
-
-    /**
-     * Test read and write parcel of ScanResult
-     */
-    @SmallTest
-    public void testScanResultParceling() {
-        BluetoothDevice device = BluetoothAdapter.getDefaultAdapter().getRemoteDevice(
-                "01:02:03:04:05:06");
-        byte[] scanRecord = new byte[] {
-                1, 2, 3 };
-        int rssi = -10;
-        long timestampMicros = 10000L;
-
-        ScanResult result = new ScanResult(device, ScanRecord.parseFromBytes(scanRecord), rssi,
-                timestampMicros);
-        Parcel parcel = Parcel.obtain();
-        result.writeToParcel(parcel, 0);
-        // Need to reset parcel data position to the beginning.
-        parcel.setDataPosition(0);
-        ScanResult resultFromParcel = ScanResult.CREATOR.createFromParcel(parcel);
-        assertEquals(result, resultFromParcel);
-    }
-
-}
diff --git a/framework/tests/src/android/bluetooth/le/ScanSettingsTest.java b/framework/tests/src/android/bluetooth/le/ScanSettingsTest.java
deleted file mode 100644
index 7c42c3b..0000000
--- a/framework/tests/src/android/bluetooth/le/ScanSettingsTest.java
+++ /dev/null
@@ -1,64 +0,0 @@
-/*
- * Copyright (C) 2014 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package android.bluetooth.le;
-
-import android.test.suitebuilder.annotation.SmallTest;
-
-import junit.framework.TestCase;
-
-/**
- * Test for Bluetooth LE {@link ScanSettings}.
- */
-public class ScanSettingsTest extends TestCase {
-
-    @SmallTest
-    public void testCallbackType() {
-        ScanSettings.Builder builder = new ScanSettings.Builder();
-        builder.setCallbackType(ScanSettings.CALLBACK_TYPE_ALL_MATCHES);
-        builder.setCallbackType(ScanSettings.CALLBACK_TYPE_FIRST_MATCH);
-        builder.setCallbackType(ScanSettings.CALLBACK_TYPE_MATCH_LOST);
-        builder.setCallbackType(
-                ScanSettings.CALLBACK_TYPE_FIRST_MATCH | ScanSettings.CALLBACK_TYPE_MATCH_LOST);
-        try {
-            builder.setCallbackType(
-                    ScanSettings.CALLBACK_TYPE_ALL_MATCHES | ScanSettings.CALLBACK_TYPE_MATCH_LOST);
-            fail("should have thrown IllegalArgumentException!");
-        } catch (IllegalArgumentException e) {
-            // nothing to do
-        }
-
-        try {
-            builder.setCallbackType(
-                    ScanSettings.CALLBACK_TYPE_ALL_MATCHES |
-                    ScanSettings.CALLBACK_TYPE_FIRST_MATCH);
-            fail("should have thrown IllegalArgumentException!");
-        } catch (IllegalArgumentException e) {
-            // nothing to do
-        }
-
-        try {
-            builder.setCallbackType(
-                    ScanSettings.CALLBACK_TYPE_ALL_MATCHES |
-                    ScanSettings.CALLBACK_TYPE_FIRST_MATCH |
-                    ScanSettings.CALLBACK_TYPE_MATCH_LOST);
-            fail("should have thrown IllegalArgumentException!");
-        } catch (IllegalArgumentException e) {
-            // nothing to do
-        }
-
-    }
-}
diff --git a/framework/tests/stress/Android.bp b/framework/tests/stress/Android.bp
new file mode 100644
index 0000000..f176be0
--- /dev/null
+++ b/framework/tests/stress/Android.bp
@@ -0,0 +1,32 @@
+package {
+    default_applicable_licenses: ["Android-Apache-2.0"],
+}
+
+android_test {
+    name: "BluetoothTests",
+
+    defaults: ["framework-bluetooth-tests-defaults"],
+
+    min_sdk_version: "current",
+    target_sdk_version: "current",
+
+    // Include all test java files.
+    srcs: ["src/**/*.java"],
+    jacoco: {
+        include_filter: ["android.bluetooth.*"],
+        exclude_filter: [],
+    },
+    libs: [
+        "android.test.runner",
+        "android.test.base",
+    ],
+    static_libs: [
+        "androidx.test.rules",
+        "junit",
+        "modules-utils-bytesmatcher",
+    ],
+    test_suites: [
+        "general-tests",
+    ],
+    certificate: ":com.android.bluetooth.certificate",
+}
diff --git a/framework/tests/stress/AndroidManifest.xml b/framework/tests/stress/AndroidManifest.xml
new file mode 100644
index 0000000..e71b876
--- /dev/null
+++ b/framework/tests/stress/AndroidManifest.xml
@@ -0,0 +1,47 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright (C) 2011 The Android Open Source Project
+
+     Licensed under the Apache License, Version 2.0 (the "License");
+     you may not use this file except in compliance with the License.
+     You may obtain a copy of the License at
+
+          http://www.apache.org/licenses/LICENSE-2.0
+
+     Unless required by applicable law or agreed to in writing, software
+     distributed under the License is distributed on an "AS IS" BASIS,
+     WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+     See the License for the specific language governing permissions and
+     limitations under the License.
+-->
+
+<manifest xmlns:android="http://schemas.android.com/apk/res/android"
+          package="com.android.bluetooth.tests"
+          android:sharedUserId="android.uid.bluetooth" >
+
+    <uses-permission android:name="android.permission.BLUETOOTH" />
+    <uses-permission android:name="android.permission.BLUETOOTH_ADMIN" />
+    <uses-permission android:name="android.permission.BLUETOOTH_ADVERTISE"/>
+    <uses-permission android:name="android.permission.BLUETOOTH_CONNECT" />
+    <uses-permission android:name="android.permission.BLUETOOTH_SCAN" />
+    <uses-permission android:name="android.permission.BLUETOOTH_PRIVILEGED" />
+    <uses-permission android:name="android.permission.BROADCAST_STICKY" />
+    <uses-permission android:name="android.permission.CHANGE_NETWORK_STATE" />
+    <uses-permission android:name="android.permission.LOCAL_MAC_ADDRESS" />
+    <uses-permission android:name="android.permission.MODIFY_AUDIO_SETTINGS"/>
+    <uses-permission android:name="android.permission.RECEIVE_SMS" />
+    <uses-permission android:name="android.permission.READ_SMS"/>
+    <uses-permission android:name="android.permission.WRITE_EXTERNAL_STORAGE" />
+    <uses-permission android:name="android.permission.WRITE_SETTINGS" />
+    <uses-permission android:name="android.permission.WRITE_SECURE_SETTINGS" />
+
+    <application >
+        <uses-library android:name="android.test.runner" />
+    </application>
+    <instrumentation android:name="android.bluetooth.BluetoothTestRunner"
+            android:targetPackage="com.android.bluetooth.tests"
+            android:label="Bluetooth Tests" />
+    <instrumentation android:name="android.bluetooth.BluetoothInstrumentation"
+            android:targetPackage="com.android.bluetooth.tests"
+            android:label="Bluetooth Test Utils" />
+
+</manifest>
\ No newline at end of file
diff --git a/framework/tests/stress/AndroidTest.xml b/framework/tests/stress/AndroidTest.xml
new file mode 100644
index 0000000..f93c4eb
--- /dev/null
+++ b/framework/tests/stress/AndroidTest.xml
@@ -0,0 +1,32 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright 2020 The Android Open Source Project
+
+     Licensed under the Apache License, Version 2.0 (the "License");
+     you may not use this file except in compliance with the License.
+     You may obtain a copy of the License at
+
+          http://www.apache.org/licenses/LICENSE-2.0
+
+     Unless required by applicable law or agreed to in writing, software
+     distributed under the License is distributed on an "AS IS" BASIS,
+     WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+     See the License for the specific language governing permissions and
+     limitations under the License.
+-->
+<configuration description="Config for Bluetooth test cases">
+    <option name="test-suite-tag" value="apct"/>
+    <option name="test-suite-tag" value="apct-instrumentation"/>
+    <target_preparer class="com.android.tradefed.targetprep.suite.SuiteApkInstaller">
+        <option name="cleanup-apks" value="true" />
+        <option name="test-file-name" value="BluetoothTests.apk" />
+    </target_preparer>
+
+    <option name="test-suite-tag" value="apct"/>
+    <option name="test-tag" value="BluetoothTests"/>
+
+    <test class="com.android.tradefed.testtype.AndroidJUnitTest" >
+        <option name="package" value="com.android.bluetooth.tests" />
+        <option name="hidden-api-checks" value="false"/>
+        <option name="runner" value="android.bluetooth.BluetoothTestRunner"/>
+    </test>
+</configuration>
diff --git a/framework/tests/stress/src/android/bluetooth/BluetoothInstrumentation.java b/framework/tests/stress/src/android/bluetooth/BluetoothInstrumentation.java
new file mode 100644
index 0000000..f438592
--- /dev/null
+++ b/framework/tests/stress/src/android/bluetooth/BluetoothInstrumentation.java
@@ -0,0 +1,121 @@
+/*
+ * Copyright (C) 2014 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package android.bluetooth;
+
+import android.app.Activity;
+import android.app.Instrumentation;
+import android.content.Context;
+import android.os.Bundle;
+
+import java.util.Set;
+
+public class BluetoothInstrumentation extends Instrumentation {
+
+    private BluetoothTestUtils mUtils = null;
+    private BluetoothAdapter mAdapter = null;
+    private Bundle mArgs = null;
+    private Bundle mSuccessResult = null;
+
+    private BluetoothTestUtils getBluetoothTestUtils() {
+        if (mUtils == null) {
+            mUtils = new BluetoothTestUtils(getContext(),
+                    BluetoothInstrumentation.class.getSimpleName());
+        }
+        return mUtils;
+    }
+
+    private BluetoothAdapter getBluetoothAdapter() {
+        if (mAdapter == null) {
+            mAdapter = ((BluetoothManager) getContext().getSystemService(
+                    Context.BLUETOOTH_SERVICE)).getAdapter();
+        }
+        return mAdapter;
+    }
+
+    @Override
+    public void onCreate(Bundle arguments) {
+        super.onCreate(arguments);
+        mArgs = arguments;
+        // create the default result response, but only use it in success code path
+        mSuccessResult = new Bundle();
+        mSuccessResult.putString("result", "SUCCESS");
+        start();
+    }
+
+    @Override
+    public void onStart() {
+        String command = mArgs.getString("command");
+        if ("enable".equals(command)) {
+            enable();
+        } else if ("disable".equals(command)) {
+            disable();
+        } else if ("unpairAll".equals(command)) {
+            unpairAll();
+        } else if ("getName".equals(command)) {
+            getName();
+        } else if ("getAddress".equals(command)) {
+            getAddress();
+        } else if ("getBondedDevices".equals(command)) {
+            getBondedDevices();
+        } else {
+            finish(null);
+        }
+    }
+
+    public void enable() {
+        getBluetoothTestUtils().enable(getBluetoothAdapter());
+        finish(mSuccessResult);
+    }
+
+    public void disable() {
+        getBluetoothTestUtils().disable(getBluetoothAdapter());
+        finish(mSuccessResult);
+    }
+
+    public void unpairAll() {
+        getBluetoothTestUtils().unpairAll(getBluetoothAdapter());
+        finish(mSuccessResult);
+    }
+
+    public void getName() {
+        String name = getBluetoothAdapter().getName();
+        mSuccessResult.putString("name", name);
+        finish(mSuccessResult);
+    }
+
+    public void getAddress() {
+        String name = getBluetoothAdapter().getAddress();
+        mSuccessResult.putString("address", name);
+        finish(mSuccessResult);
+    }
+
+    public void getBondedDevices() {
+        Set<BluetoothDevice> devices = getBluetoothAdapter().getBondedDevices();
+        int i = 0;
+        for (BluetoothDevice device : devices) {
+            mSuccessResult.putString(String.format("device-%02d", i), device.getAddress());
+            i++;
+        }
+        finish(mSuccessResult);
+    }
+
+    public void finish(Bundle result) {
+        if (result == null) {
+            result = new Bundle();
+        }
+        finish(Activity.RESULT_OK, result);
+    }
+}
diff --git a/framework/tests/src/android/bluetooth/BluetoothRebootStressTest.java b/framework/tests/stress/src/android/bluetooth/BluetoothRebootStressTest.java
similarity index 100%
rename from framework/tests/src/android/bluetooth/BluetoothRebootStressTest.java
rename to framework/tests/stress/src/android/bluetooth/BluetoothRebootStressTest.java
diff --git a/framework/tests/src/android/bluetooth/BluetoothStressTest.java b/framework/tests/stress/src/android/bluetooth/BluetoothStressTest.java
similarity index 100%
rename from framework/tests/src/android/bluetooth/BluetoothStressTest.java
rename to framework/tests/stress/src/android/bluetooth/BluetoothStressTest.java
diff --git a/framework/tests/stress/src/android/bluetooth/BluetoothTestRunner.java b/framework/tests/stress/src/android/bluetooth/BluetoothTestRunner.java
new file mode 100644
index 0000000..905d6ba
--- /dev/null
+++ b/framework/tests/stress/src/android/bluetooth/BluetoothTestRunner.java
@@ -0,0 +1,225 @@
+/*
+ * Copyright (C) 2010 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.bluetooth;
+
+import android.os.Bundle;
+import android.test.InstrumentationTestRunner;
+import android.test.InstrumentationTestSuite;
+import android.util.Log;
+
+import junit.framework.TestSuite;
+
+/**
+ * Instrumentation test runner for Bluetooth tests.
+ * <p>
+ * To run:
+ * <pre>
+ * {@code
+ * adb shell am instrument \
+ *     [-e enable_iterations <iterations>] \
+ *     [-e discoverable_iterations <iterations>] \
+ *     [-e scan_iterations <iterations>] \
+ *     [-e enable_pan_iterations <iterations>] \
+ *     [-e pair_iterations <iterations>] \
+ *     [-e connect_a2dp_iterations <iterations>] \
+ *     [-e connect_headset_iterations <iterations>] \
+ *     [-e connect_input_iterations <iterations>] \
+ *     [-e connect_pan_iterations <iterations>] \
+ *     [-e start_stop_sco_iterations <iterations>] \
+ *     [-e mce_set_message_status_iterations <iterations>] \
+ *     [-e pair_address <address>] \
+ *     [-e headset_address <address>] \
+ *     [-e a2dp_address <address>] \
+ *     [-e input_address <address>] \
+ *     [-e pan_address <address>] \
+ *     [-e pair_pin <pin>] \
+ *     [-e pair_passkey <passkey>] \
+ *     -w com.android.bluetooth.tests/android.bluetooth.BluetoothTestRunner
+ * }
+ * </pre>
+ */
+public class BluetoothTestRunner extends InstrumentationTestRunner {
+    private static final String TAG = "BluetoothTestRunner";
+
+    public static int sEnableIterations = 100;
+    public static int sDiscoverableIterations = 1000;
+    public static int sScanIterations = 1000;
+    public static int sEnablePanIterations = 1000;
+    public static int sPairIterations = 100;
+    public static int sConnectHeadsetIterations = 100;
+    public static int sConnectA2dpIterations = 100;
+    public static int sConnectInputIterations = 100;
+    public static int sConnectPanIterations = 100;
+    public static int sStartStopScoIterations = 100;
+    public static int sMceSetMessageStatusIterations = 100;
+
+    public static String sDeviceAddress = "";
+    public static byte[] sDevicePairPin = {'1', '2', '3', '4'};
+    public static int sDevicePairPasskey = 123456;
+
+    @Override
+    public TestSuite getAllTests() {
+        TestSuite suite = new InstrumentationTestSuite(this);
+        suite.addTestSuite(BluetoothStressTest.class);
+        return suite;
+    }
+
+    @Override
+    public ClassLoader getLoader() {
+        return BluetoothTestRunner.class.getClassLoader();
+    }
+
+    @Override
+    public void onCreate(Bundle arguments) {
+        String val = arguments.getString("enable_iterations");
+        if (val != null) {
+            try {
+                sEnableIterations = Integer.parseInt(val);
+            } catch (NumberFormatException e) {
+                // Invalid argument, fall back to default value
+            }
+        }
+
+        val = arguments.getString("discoverable_iterations");
+        if (val != null) {
+            try {
+                sDiscoverableIterations = Integer.parseInt(val);
+            } catch (NumberFormatException e) {
+                // Invalid argument, fall back to default value
+            }
+        }
+
+        val = arguments.getString("scan_iterations");
+        if (val != null) {
+            try {
+                sScanIterations = Integer.parseInt(val);
+            } catch (NumberFormatException e) {
+                // Invalid argument, fall back to default value
+            }
+        }
+
+        val = arguments.getString("enable_pan_iterations");
+        if (val != null) {
+            try {
+                sEnablePanIterations = Integer.parseInt(val);
+            } catch (NumberFormatException e) {
+                // Invalid argument, fall back to default value
+            }
+        }
+
+        val = arguments.getString("pair_iterations");
+        if (val != null) {
+            try {
+                sPairIterations = Integer.parseInt(val);
+            } catch (NumberFormatException e) {
+                // Invalid argument, fall back to default value
+            }
+        }
+
+        val = arguments.getString("connect_a2dp_iterations");
+        if (val != null) {
+            try {
+                sConnectA2dpIterations = Integer.parseInt(val);
+            } catch (NumberFormatException e) {
+                // Invalid argument, fall back to default value
+            }
+        }
+
+        val = arguments.getString("connect_headset_iterations");
+        if (val != null) {
+            try {
+                sConnectHeadsetIterations = Integer.parseInt(val);
+            } catch (NumberFormatException e) {
+                // Invalid argument, fall back to default value
+            }
+        }
+
+        val = arguments.getString("connect_input_iterations");
+        if (val != null) {
+            try {
+                sConnectInputIterations = Integer.parseInt(val);
+            } catch (NumberFormatException e) {
+                // Invalid argument, fall back to default value
+            }
+        }
+
+        val = arguments.getString("connect_pan_iterations");
+        if (val != null) {
+            try {
+                sConnectPanIterations = Integer.parseInt(val);
+            } catch (NumberFormatException e) {
+                // Invalid argument, fall back to default value
+            }
+        }
+
+        val = arguments.getString("start_stop_sco_iterations");
+        if (val != null) {
+            try {
+                sStartStopScoIterations = Integer.parseInt(val);
+            } catch (NumberFormatException e) {
+                // Invalid argument, fall back to default value
+            }
+        }
+
+        val = arguments.getString("mce_set_message_status_iterations");
+        if (val != null) {
+            try {
+                sMceSetMessageStatusIterations = Integer.parseInt(val);
+            } catch (NumberFormatException e) {
+                // Invalid argument, fall back to default value
+            }
+        }
+
+        val = arguments.getString("device_address");
+        if (val != null) {
+            sDeviceAddress = val;
+        }
+
+        val = arguments.getString("device_pair_pin");
+        if (val != null) {
+            byte[] pin = BluetoothDevice.convertPinToBytes(val);
+            if (pin != null) {
+                sDevicePairPin = pin;
+            }
+        }
+
+        val = arguments.getString("device_pair_passkey");
+        if (val != null) {
+            try {
+                sDevicePairPasskey = Integer.parseInt(val);
+            } catch (NumberFormatException e) {
+                // Invalid argument, fall back to default value
+            }
+        }
+
+        Log.i(TAG, String.format("enable_iterations=%d", sEnableIterations));
+        Log.i(TAG, String.format("discoverable_iterations=%d", sDiscoverableIterations));
+        Log.i(TAG, String.format("scan_iterations=%d", sScanIterations));
+        Log.i(TAG, String.format("pair_iterations=%d", sPairIterations));
+        Log.i(TAG, String.format("connect_a2dp_iterations=%d", sConnectA2dpIterations));
+        Log.i(TAG, String.format("connect_headset_iterations=%d", sConnectHeadsetIterations));
+        Log.i(TAG, String.format("connect_input_iterations=%d", sConnectInputIterations));
+        Log.i(TAG, String.format("connect_pan_iterations=%d", sConnectPanIterations));
+        Log.i(TAG, String.format("start_stop_sco_iterations=%d", sStartStopScoIterations));
+        Log.i(TAG, String.format("device_address=%s", sDeviceAddress));
+        Log.i(TAG, String.format("device_pair_pin=%s", new String(sDevicePairPin)));
+        Log.i(TAG, String.format("device_pair_passkey=%d", sDevicePairPasskey));
+
+        // Call onCreate last since we want to set the static variables first.
+        super.onCreate(arguments);
+    }
+}
diff --git a/framework/tests/stress/src/android/bluetooth/BluetoothTestUtils.java b/framework/tests/stress/src/android/bluetooth/BluetoothTestUtils.java
new file mode 100644
index 0000000..41e1cd5
--- /dev/null
+++ b/framework/tests/stress/src/android/bluetooth/BluetoothTestUtils.java
@@ -0,0 +1,1674 @@
+/*
+ * Copyright (C) 2010 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.bluetooth;
+
+import android.content.BroadcastReceiver;
+import android.content.Context;
+import android.content.Intent;
+import android.content.IntentFilter;
+import android.media.AudioManager;
+import android.net.TetheringManager;
+import android.net.TetheringManager.TetheredInterfaceCallback;
+import android.net.TetheringManager.TetheredInterfaceRequest;
+import android.os.Environment;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.BufferedWriter;
+import java.io.File;
+import java.io.FileWriter;
+import java.io.IOException;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Set;
+import java.util.concurrent.Semaphore;
+import java.util.concurrent.TimeUnit;
+
+public class BluetoothTestUtils extends Assert {
+
+    /** Timeout for enable/disable in ms. */
+    private static final int ENABLE_DISABLE_TIMEOUT = 20000;
+    /** Timeout for discoverable/undiscoverable in ms. */
+    private static final int DISCOVERABLE_UNDISCOVERABLE_TIMEOUT = 5000;
+    /** Timeout for starting/stopping a scan in ms. */
+    private static final int START_STOP_SCAN_TIMEOUT = 5000;
+    /** Timeout for pair/unpair in ms. */
+    private static final int PAIR_UNPAIR_TIMEOUT = 20000;
+    /** Timeout for connecting/disconnecting a profile in ms. */
+    private static final int CONNECT_DISCONNECT_PROFILE_TIMEOUT = 20000;
+    /** Timeout to start or stop a SCO channel in ms. */
+    private static final int START_STOP_SCO_TIMEOUT = 10000;
+    /** Timeout to connect a profile proxy in ms. */
+    private static final int CONNECT_PROXY_TIMEOUT = 5000;
+    /** Time between polls in ms. */
+    private static final int POLL_TIME = 100;
+    /** Timeout to get map message in ms. */
+    private static final int GET_UNREAD_MESSAGE_TIMEOUT = 10000;
+    /** Timeout to set map message status in ms. */
+    private static final int SET_MESSAGE_STATUS_TIMEOUT = 2000;
+
+    private abstract class FlagReceiver extends BroadcastReceiver {
+        private int mExpectedFlags = 0;
+        private int mFiredFlags = 0;
+        private long mCompletedTime = -1;
+
+        FlagReceiver(int expectedFlags) {
+            mExpectedFlags = expectedFlags;
+        }
+
+        public int getFiredFlags() {
+            synchronized (this) {
+                return mFiredFlags;
+            }
+        }
+
+        public long getCompletedTime() {
+            synchronized (this) {
+                return mCompletedTime;
+            }
+        }
+
+        protected void setFiredFlag(int flag) {
+            synchronized (this) {
+                mFiredFlags |= flag;
+                if ((mFiredFlags & mExpectedFlags) == mExpectedFlags) {
+                    mCompletedTime = System.currentTimeMillis();
+                }
+            }
+        }
+    }
+
+    private class BluetoothReceiver extends FlagReceiver {
+        private static final int DISCOVERY_STARTED_FLAG = 1;
+        private static final int DISCOVERY_FINISHED_FLAG = 1 << 1;
+        private static final int SCAN_MODE_NONE_FLAG = 1 << 2;
+        private static final int SCAN_MODE_CONNECTABLE_FLAG = 1 << 3;
+        private static final int SCAN_MODE_CONNECTABLE_DISCOVERABLE_FLAG = 1 << 4;
+        private static final int STATE_OFF_FLAG = 1 << 5;
+        private static final int STATE_TURNING_ON_FLAG = 1 << 6;
+        private static final int STATE_ON_FLAG = 1 << 7;
+        private static final int STATE_TURNING_OFF_FLAG = 1 << 8;
+        private static final int STATE_GET_MESSAGE_FINISHED_FLAG = 1 << 9;
+        private static final int STATE_SET_MESSAGE_STATUS_FINISHED_FLAG = 1 << 10;
+
+        BluetoothReceiver(int expectedFlags) {
+            super(expectedFlags);
+        }
+
+        @Override
+        public void onReceive(Context context, Intent intent) {
+            if (BluetoothAdapter.ACTION_DISCOVERY_STARTED.equals(intent.getAction())) {
+                setFiredFlag(DISCOVERY_STARTED_FLAG);
+            } else if (BluetoothAdapter.ACTION_DISCOVERY_FINISHED.equals(intent.getAction())) {
+                setFiredFlag(DISCOVERY_FINISHED_FLAG);
+            } else if (BluetoothAdapter.ACTION_SCAN_MODE_CHANGED.equals(intent.getAction())) {
+                int mode = intent.getIntExtra(BluetoothAdapter.EXTRA_SCAN_MODE, -1);
+                assertNotSame(-1, mode);
+                switch (mode) {
+                    case BluetoothAdapter.SCAN_MODE_NONE:
+                        setFiredFlag(SCAN_MODE_NONE_FLAG);
+                        break;
+                    case BluetoothAdapter.SCAN_MODE_CONNECTABLE:
+                        setFiredFlag(SCAN_MODE_CONNECTABLE_FLAG);
+                        break;
+                    case BluetoothAdapter.SCAN_MODE_CONNECTABLE_DISCOVERABLE:
+                        setFiredFlag(SCAN_MODE_CONNECTABLE_DISCOVERABLE_FLAG);
+                        break;
+                }
+            } else if (BluetoothAdapter.ACTION_STATE_CHANGED.equals(intent.getAction())) {
+                int state = intent.getIntExtra(BluetoothAdapter.EXTRA_STATE, -1);
+                assertNotSame(-1, state);
+                switch (state) {
+                    case BluetoothAdapter.STATE_OFF:
+                        setFiredFlag(STATE_OFF_FLAG);
+                        break;
+                    case BluetoothAdapter.STATE_TURNING_ON:
+                        setFiredFlag(STATE_TURNING_ON_FLAG);
+                        break;
+                    case BluetoothAdapter.STATE_ON:
+                        setFiredFlag(STATE_ON_FLAG);
+                        break;
+                    case BluetoothAdapter.STATE_TURNING_OFF:
+                        setFiredFlag(STATE_TURNING_OFF_FLAG);
+                        break;
+                }
+            }
+        }
+    }
+
+    private class PairReceiver extends FlagReceiver {
+        private static final int STATE_BONDED_FLAG = 1;
+        private static final int STATE_BONDING_FLAG = 1 << 1;
+        private static final int STATE_NONE_FLAG = 1 << 2;
+
+        private BluetoothDevice mDevice;
+        private int mPasskey;
+        private byte[] mPin;
+
+        PairReceiver(BluetoothDevice device, int passkey, byte[] pin, int expectedFlags) {
+            super(expectedFlags);
+
+            mDevice = device;
+            mPasskey = passkey;
+            mPin = pin;
+        }
+
+        @Override
+        public void onReceive(Context context, Intent intent) {
+            if (!mDevice.equals(intent.getParcelableExtra(BluetoothDevice.EXTRA_DEVICE))) {
+                return;
+            }
+
+            if (BluetoothDevice.ACTION_PAIRING_REQUEST.equals(intent.getAction())) {
+                int varient = intent.getIntExtra(BluetoothDevice.EXTRA_PAIRING_VARIANT, -1);
+                assertNotSame(-1, varient);
+                switch (varient) {
+                    case BluetoothDevice.PAIRING_VARIANT_PIN:
+                    case BluetoothDevice.PAIRING_VARIANT_PIN_16_DIGITS:
+                        mDevice.setPin(mPin);
+                        break;
+                    case BluetoothDevice.PAIRING_VARIANT_PASSKEY:
+                        break;
+                    case BluetoothDevice.PAIRING_VARIANT_PASSKEY_CONFIRMATION:
+                    case BluetoothDevice.PAIRING_VARIANT_CONSENT:
+                        mDevice.setPairingConfirmation(true);
+                        break;
+                    case BluetoothDevice.PAIRING_VARIANT_OOB_CONSENT:
+                        break;
+                }
+            } else if (BluetoothDevice.ACTION_BOND_STATE_CHANGED.equals(intent.getAction())) {
+                int state = intent.getIntExtra(BluetoothDevice.EXTRA_BOND_STATE, -1);
+                assertNotSame(-1, state);
+                switch (state) {
+                    case BluetoothDevice.BOND_NONE:
+                        setFiredFlag(STATE_NONE_FLAG);
+                        break;
+                    case BluetoothDevice.BOND_BONDING:
+                        setFiredFlag(STATE_BONDING_FLAG);
+                        break;
+                    case BluetoothDevice.BOND_BONDED:
+                        setFiredFlag(STATE_BONDED_FLAG);
+                        break;
+                }
+            }
+        }
+    }
+
+    private class ConnectProfileReceiver extends FlagReceiver {
+        private static final int STATE_DISCONNECTED_FLAG = 1;
+        private static final int STATE_CONNECTING_FLAG = 1 << 1;
+        private static final int STATE_CONNECTED_FLAG = 1 << 2;
+        private static final int STATE_DISCONNECTING_FLAG = 1 << 3;
+
+        private BluetoothDevice mDevice;
+        private int mProfile;
+        private String mConnectionAction;
+
+        ConnectProfileReceiver(BluetoothDevice device, int profile, int expectedFlags) {
+            super(expectedFlags);
+
+            mDevice = device;
+            mProfile = profile;
+
+            switch (mProfile) {
+                case BluetoothProfile.A2DP:
+                    mConnectionAction = BluetoothA2dp.ACTION_CONNECTION_STATE_CHANGED;
+                    break;
+                case BluetoothProfile.HEADSET:
+                    mConnectionAction = BluetoothHeadset.ACTION_CONNECTION_STATE_CHANGED;
+                    break;
+                case BluetoothProfile.HID_HOST:
+                    mConnectionAction = BluetoothHidHost.ACTION_CONNECTION_STATE_CHANGED;
+                    break;
+                case BluetoothProfile.PAN:
+                    mConnectionAction = BluetoothPan.ACTION_CONNECTION_STATE_CHANGED;
+                    break;
+                case BluetoothProfile.MAP_CLIENT:
+                    mConnectionAction = BluetoothMapClient.ACTION_CONNECTION_STATE_CHANGED;
+                    break;
+                default:
+                    mConnectionAction = null;
+            }
+        }
+
+        @Override
+        public void onReceive(Context context, Intent intent) {
+            if (mConnectionAction != null && mConnectionAction.equals(intent.getAction())) {
+                if (!mDevice.equals(intent.getParcelableExtra(BluetoothDevice.EXTRA_DEVICE))) {
+                    return;
+                }
+
+                int state = intent.getIntExtra(BluetoothProfile.EXTRA_STATE, -1);
+                assertNotSame(-1, state);
+                switch (state) {
+                    case BluetoothProfile.STATE_DISCONNECTED:
+                        setFiredFlag(STATE_DISCONNECTED_FLAG);
+                        break;
+                    case BluetoothProfile.STATE_CONNECTING:
+                        setFiredFlag(STATE_CONNECTING_FLAG);
+                        break;
+                    case BluetoothProfile.STATE_CONNECTED:
+                        setFiredFlag(STATE_CONNECTED_FLAG);
+                        break;
+                    case BluetoothProfile.STATE_DISCONNECTING:
+                        setFiredFlag(STATE_DISCONNECTING_FLAG);
+                        break;
+                }
+            }
+        }
+    }
+
+    private class ConnectPanReceiver extends ConnectProfileReceiver {
+        private int mRole;
+
+        ConnectPanReceiver(BluetoothDevice device, int role, int expectedFlags) {
+            super(device, BluetoothProfile.PAN, expectedFlags);
+
+            mRole = role;
+        }
+
+        @Override
+        public void onReceive(Context context, Intent intent) {
+            if (mRole != intent.getIntExtra(BluetoothPan.EXTRA_LOCAL_ROLE, -1)) {
+                return;
+            }
+
+            super.onReceive(context, intent);
+        }
+    }
+
+    private class StartStopScoReceiver extends FlagReceiver {
+        private static final int STATE_CONNECTED_FLAG = 1;
+        private static final int STATE_DISCONNECTED_FLAG = 1 << 1;
+
+        StartStopScoReceiver(int expectedFlags) {
+            super(expectedFlags);
+        }
+
+        @Override
+        public void onReceive(Context context, Intent intent) {
+            if (AudioManager.ACTION_SCO_AUDIO_STATE_UPDATED.equals(intent.getAction())) {
+                int state = intent.getIntExtra(AudioManager.EXTRA_SCO_AUDIO_STATE,
+                        AudioManager.SCO_AUDIO_STATE_ERROR);
+                assertNotSame(AudioManager.SCO_AUDIO_STATE_ERROR, state);
+                switch(state) {
+                    case AudioManager.SCO_AUDIO_STATE_CONNECTED:
+                        setFiredFlag(STATE_CONNECTED_FLAG);
+                        break;
+                    case AudioManager.SCO_AUDIO_STATE_DISCONNECTED:
+                        setFiredFlag(STATE_DISCONNECTED_FLAG);
+                        break;
+                }
+            }
+        }
+    }
+
+
+    private class MceSetMessageStatusReceiver extends FlagReceiver {
+        private static final int MESSAGE_RECEIVED_FLAG = 1;
+        private static final int STATUS_CHANGED_FLAG = 1 << 1;
+
+        MceSetMessageStatusReceiver(int expectedFlags) {
+            super(expectedFlags);
+        }
+
+        @Override
+        public void onReceive(Context context, Intent intent) {
+            if (BluetoothMapClient.ACTION_MESSAGE_RECEIVED.equals(intent.getAction())) {
+                String handle = intent.getStringExtra(BluetoothMapClient.EXTRA_MESSAGE_HANDLE);
+                assertNotNull(handle);
+                setFiredFlag(MESSAGE_RECEIVED_FLAG);
+                mMsgHandle = handle;
+            } else if (BluetoothMapClient.ACTION_MESSAGE_DELETED_STATUS_CHANGED
+                    .equals(intent.getAction())) {
+                int result = intent.getIntExtra(BluetoothMapClient.EXTRA_RESULT_CODE,
+                        BluetoothMapClient.RESULT_FAILURE);
+                assertEquals(result, BluetoothMapClient.RESULT_SUCCESS);
+                setFiredFlag(STATUS_CHANGED_FLAG);
+            } else if (BluetoothMapClient.ACTION_MESSAGE_READ_STATUS_CHANGED
+                    .equals(intent.getAction())) {
+                int result = intent.getIntExtra(BluetoothMapClient.EXTRA_RESULT_CODE,
+                        BluetoothMapClient.RESULT_FAILURE);
+                assertEquals(result, BluetoothMapClient.RESULT_SUCCESS);
+                setFiredFlag(STATUS_CHANGED_FLAG);
+            }
+        }
+    }
+
+    private BluetoothProfile.ServiceListener mServiceListener =
+            new BluetoothProfile.ServiceListener() {
+        @Override
+        public void onServiceConnected(int profile, BluetoothProfile proxy) {
+            synchronized (this) {
+                switch (profile) {
+                    case BluetoothProfile.A2DP:
+                        mA2dp = (BluetoothA2dp) proxy;
+                        break;
+                    case BluetoothProfile.HEADSET:
+                        mHeadset = (BluetoothHeadset) proxy;
+                        break;
+                    case BluetoothProfile.HID_HOST:
+                        mInput = (BluetoothHidHost) proxy;
+                        break;
+                    case BluetoothProfile.PAN:
+                        mPan = (BluetoothPan) proxy;
+                        break;
+                    case BluetoothProfile.MAP_CLIENT:
+                        mMce = (BluetoothMapClient) proxy;
+                        break;
+                }
+            }
+        }
+
+        @Override
+        public void onServiceDisconnected(int profile) {
+            synchronized (this) {
+                switch (profile) {
+                    case BluetoothProfile.A2DP:
+                        mA2dp = null;
+                        break;
+                    case BluetoothProfile.HEADSET:
+                        mHeadset = null;
+                        break;
+                    case BluetoothProfile.HID_HOST:
+                        mInput = null;
+                        break;
+                    case BluetoothProfile.PAN:
+                        mPan = null;
+                        break;
+                    case BluetoothProfile.MAP_CLIENT:
+                        mMce = null;
+                        break;
+                }
+            }
+        }
+    };
+
+    private List<BroadcastReceiver> mReceivers = new ArrayList<BroadcastReceiver>();
+
+    private BufferedWriter mOutputWriter;
+    private String mTag;
+    private String mOutputFile;
+
+    private Context mContext;
+    private BluetoothA2dp mA2dp = null;
+    private BluetoothHeadset mHeadset = null;
+    private BluetoothHidHost mInput = null;
+    private BluetoothPan mPan = null;
+    private BluetoothMapClient mMce = null;
+    private String mMsgHandle = null;
+    private TetheredInterfaceCallback mPanCallback = null;
+    private TetheredInterfaceRequest mBluetoothIfaceRequest;
+
+    /**
+     * Creates a utility instance for testing Bluetooth.
+     *
+     * @param context The context of the application using the utility.
+     * @param tag The log tag of the application using the utility.
+     */
+    public BluetoothTestUtils(Context context, String tag) {
+        this(context, tag, null);
+    }
+
+    /**
+     * Creates a utility instance for testing Bluetooth.
+     *
+     * @param context The context of the application using the utility.
+     * @param tag The log tag of the application using the utility.
+     * @param outputFile The path to an output file if the utility is to write results to a
+     *        separate file.
+     */
+    public BluetoothTestUtils(Context context, String tag, String outputFile) {
+        mContext = context;
+        mTag = tag;
+        mOutputFile = outputFile;
+
+        if (mOutputFile == null) {
+            mOutputWriter = null;
+        } else {
+            try {
+                mOutputWriter = new BufferedWriter(new FileWriter(new File(
+                        Environment.getExternalStorageDirectory(), mOutputFile), true));
+            } catch (IOException e) {
+                Log.w(mTag, "Test output file could not be opened", e);
+                mOutputWriter = null;
+            }
+        }
+    }
+
+    /**
+     * Closes the utility instance and unregisters any BroadcastReceivers.
+     */
+    public void close() {
+        while (!mReceivers.isEmpty()) {
+            mContext.unregisterReceiver(mReceivers.remove(0));
+        }
+
+        if (mOutputWriter != null) {
+            try {
+                mOutputWriter.close();
+            } catch (IOException e) {
+                Log.w(mTag, "Test output file could not be closed", e);
+            }
+        }
+    }
+
+    /**
+     * Enables Bluetooth and checks to make sure that Bluetooth was turned on and that the correct
+     * actions were broadcast.
+     *
+     * @param adapter The BT adapter.
+     */
+    public void enable(BluetoothAdapter adapter) {
+        writeOutput("Enabling Bluetooth adapter.");
+        assertFalse(adapter.isEnabled());
+        int btState = adapter.getState();
+        final Semaphore completionSemaphore = new Semaphore(0);
+        final BroadcastReceiver receiver = new BroadcastReceiver() {
+            @Override
+            public void onReceive(Context context, Intent intent) {
+                final String action = intent.getAction();
+                if (!BluetoothAdapter.ACTION_STATE_CHANGED.equals(action)) {
+                    return;
+                }
+                final int state = intent.getIntExtra(BluetoothAdapter.EXTRA_STATE,
+                        BluetoothAdapter.ERROR);
+                if (state == BluetoothAdapter.STATE_ON) {
+                    completionSemaphore.release();
+                }
+            }
+        };
+
+        final IntentFilter filter = new IntentFilter(BluetoothAdapter.ACTION_STATE_CHANGED);
+        mContext.registerReceiver(receiver, filter);
+        // Note: for Wear Local Edition builds, which have Permission Review Mode enabled to
+        // obey China CMIIT, BluetoothAdapter may not startup immediately on methods enable/disable.
+        // So no assertion applied here.
+        adapter.enable();
+        boolean success = false;
+        try {
+            success = completionSemaphore.tryAcquire(ENABLE_DISABLE_TIMEOUT, TimeUnit.MILLISECONDS);
+            writeOutput(String.format("enable() completed in 0 ms"));
+        } catch (final InterruptedException e) {
+            // This should never happen but just in case it does, the test will fail anyway.
+        }
+        mContext.unregisterReceiver(receiver);
+        if (!success) {
+            fail(String.format("enable() timeout: state=%d (expected %d)", btState,
+                    BluetoothAdapter.STATE_ON));
+        }
+    }
+
+    /**
+     * Disables Bluetooth and checks to make sure that Bluetooth was turned off and that the correct
+     * actions were broadcast.
+     *
+     * @param adapter The BT adapter.
+     */
+    public void disable(BluetoothAdapter adapter) {
+        writeOutput("Disabling Bluetooth adapter.");
+        assertTrue(adapter.isEnabled());
+        int btState = adapter.getState();
+        final Semaphore completionSemaphore = new Semaphore(0);
+        final BroadcastReceiver receiver = new BroadcastReceiver() {
+            @Override
+            public void onReceive(Context context, Intent intent) {
+                final String action = intent.getAction();
+                if (!BluetoothAdapter.ACTION_STATE_CHANGED.equals(action)) {
+                    return;
+                }
+                final int state = intent.getIntExtra(BluetoothAdapter.EXTRA_STATE,
+                        BluetoothAdapter.ERROR);
+                if (state == BluetoothAdapter.STATE_OFF) {
+                    completionSemaphore.release();
+                }
+            }
+        };
+
+        final IntentFilter filter = new IntentFilter(BluetoothAdapter.ACTION_STATE_CHANGED);
+        mContext.registerReceiver(receiver, filter);
+        // Note: for Wear Local Edition builds, which have Permission Review Mode enabled to
+        // obey China CMIIT, BluetoothAdapter may not startup immediately on methods enable/disable.
+        // So no assertion applied here.
+        adapter.disable();
+        boolean success = false;
+        try {
+            success = completionSemaphore.tryAcquire(ENABLE_DISABLE_TIMEOUT, TimeUnit.MILLISECONDS);
+            writeOutput(String.format("disable() completed in 0 ms"));
+        } catch (final InterruptedException e) {
+            // This should never happen but just in case it does, the test will fail anyway.
+        }
+        mContext.unregisterReceiver(receiver);
+        if (!success) {
+            fail(String.format("disable() timeout: state=%d (expected %d)", btState,
+                    BluetoothAdapter.STATE_OFF));
+        }
+    }
+
+    /**
+     * Puts the local device into discoverable mode and checks to make sure that the local device
+     * is in discoverable mode and that the correct actions were broadcast.
+     *
+     * @param adapter The BT adapter.
+     */
+    public void discoverable(BluetoothAdapter adapter) {
+        if (!adapter.isEnabled()) {
+            fail("discoverable() bluetooth not enabled");
+        }
+
+        int scanMode = adapter.getScanMode();
+        if (scanMode != BluetoothAdapter.SCAN_MODE_CONNECTABLE) {
+            return;
+        }
+
+        final Semaphore completionSemaphore = new Semaphore(0);
+        final BroadcastReceiver receiver = new BroadcastReceiver() {
+            @Override
+            public void onReceive(Context context, Intent intent) {
+                final String action = intent.getAction();
+                if (!BluetoothAdapter.ACTION_SCAN_MODE_CHANGED.equals(action)) {
+                    return;
+                }
+                final int mode = intent.getIntExtra(BluetoothAdapter.EXTRA_SCAN_MODE,
+                        BluetoothAdapter.SCAN_MODE_NONE);
+                if (mode == BluetoothAdapter.SCAN_MODE_CONNECTABLE_DISCOVERABLE) {
+                    completionSemaphore.release();
+                }
+            }
+        };
+
+        final IntentFilter filter = new IntentFilter(BluetoothAdapter.ACTION_SCAN_MODE_CHANGED);
+        mContext.registerReceiver(receiver, filter);
+        assertEquals(adapter.setScanMode(BluetoothAdapter.SCAN_MODE_CONNECTABLE_DISCOVERABLE),
+                BluetoothStatusCodes.SUCCESS);
+        boolean success = false;
+        try {
+            success = completionSemaphore.tryAcquire(DISCOVERABLE_UNDISCOVERABLE_TIMEOUT,
+                    TimeUnit.MILLISECONDS);
+            writeOutput(String.format("discoverable() completed in 0 ms"));
+        } catch (final InterruptedException e) {
+            // This should never happen but just in case it does, the test will fail anyway.
+        }
+        mContext.unregisterReceiver(receiver);
+        if (!success) {
+            fail(String.format("discoverable() timeout: scanMode=%d (expected %d)", scanMode,
+                    BluetoothAdapter.SCAN_MODE_CONNECTABLE_DISCOVERABLE));
+        }
+    }
+
+    /**
+     * Puts the local device into connectable only mode and checks to make sure that the local
+     * device is in in connectable mode and that the correct actions were broadcast.
+     *
+     * @param adapter The BT adapter.
+     */
+    public void undiscoverable(BluetoothAdapter adapter) {
+        if (!adapter.isEnabled()) {
+            fail("undiscoverable() bluetooth not enabled");
+        }
+
+        int scanMode = adapter.getScanMode();
+        if (scanMode != BluetoothAdapter.SCAN_MODE_CONNECTABLE_DISCOVERABLE) {
+            return;
+        }
+
+        final Semaphore completionSemaphore = new Semaphore(0);
+        final BroadcastReceiver receiver = new BroadcastReceiver() {
+            @Override
+            public void onReceive(Context context, Intent intent) {
+                final String action = intent.getAction();
+                if (!BluetoothAdapter.ACTION_SCAN_MODE_CHANGED.equals(action)) {
+                    return;
+                }
+                final int mode = intent.getIntExtra(BluetoothAdapter.EXTRA_SCAN_MODE,
+                        BluetoothAdapter.SCAN_MODE_NONE);
+                if (mode == BluetoothAdapter.SCAN_MODE_CONNECTABLE) {
+                    completionSemaphore.release();
+                }
+            }
+        };
+
+        final IntentFilter filter = new IntentFilter(BluetoothAdapter.ACTION_SCAN_MODE_CHANGED);
+        mContext.registerReceiver(receiver, filter);
+        assertEquals(adapter.setScanMode(BluetoothAdapter.SCAN_MODE_CONNECTABLE),
+                BluetoothStatusCodes.SUCCESS);
+        boolean success = false;
+        try {
+            success = completionSemaphore.tryAcquire(DISCOVERABLE_UNDISCOVERABLE_TIMEOUT,
+                    TimeUnit.MILLISECONDS);
+            writeOutput(String.format("undiscoverable() completed in 0 ms"));
+        } catch (InterruptedException e) {
+            // This should never happen but just in case it does, the test will fail anyway.
+        }
+        mContext.unregisterReceiver(receiver);
+        if (!success) {
+            fail(String.format("undiscoverable() timeout: scanMode=%d (expected %d)", scanMode,
+                    BluetoothAdapter.SCAN_MODE_CONNECTABLE));
+        }
+    }
+
+    /**
+     * Starts a scan for remote devices and checks to make sure that the local device is scanning
+     * and that the correct actions were broadcast.
+     *
+     * @param adapter The BT adapter.
+     */
+    public void startScan(BluetoothAdapter adapter) {
+        int mask = BluetoothReceiver.DISCOVERY_STARTED_FLAG;
+
+        if (!adapter.isEnabled()) {
+            fail("startScan() bluetooth not enabled");
+        }
+
+        if (adapter.isDiscovering()) {
+            return;
+        }
+
+        BluetoothReceiver receiver = getBluetoothReceiver(mask);
+
+        long start = System.currentTimeMillis();
+        assertTrue(adapter.startDiscovery());
+
+        while (System.currentTimeMillis() - start < START_STOP_SCAN_TIMEOUT) {
+            if (adapter.isDiscovering() && ((receiver.getFiredFlags() & mask) == mask)) {
+                writeOutput(String.format("startScan() completed in %d ms",
+                        (receiver.getCompletedTime() - start)));
+                removeReceiver(receiver);
+                return;
+            }
+            sleep(POLL_TIME);
+        }
+
+        int firedFlags = receiver.getFiredFlags();
+        removeReceiver(receiver);
+        fail(String.format("startScan() timeout: isDiscovering=%b, flags=0x%x (expected 0x%x)",
+                adapter.isDiscovering(), firedFlags, mask));
+    }
+
+    /**
+     * Stops a scan for remote devices and checks to make sure that the local device is not scanning
+     * and that the correct actions were broadcast.
+     *
+     * @param adapter The BT adapter.
+     */
+    public void stopScan(BluetoothAdapter adapter) {
+        int mask = BluetoothReceiver.DISCOVERY_FINISHED_FLAG;
+
+        if (!adapter.isEnabled()) {
+            fail("stopScan() bluetooth not enabled");
+        }
+
+        if (!adapter.isDiscovering()) {
+            return;
+        }
+
+        BluetoothReceiver receiver = getBluetoothReceiver(mask);
+
+        long start = System.currentTimeMillis();
+        assertTrue(adapter.cancelDiscovery());
+
+        while (System.currentTimeMillis() - start < START_STOP_SCAN_TIMEOUT) {
+            if (!adapter.isDiscovering() && ((receiver.getFiredFlags() & mask) == mask)) {
+                writeOutput(String.format("stopScan() completed in %d ms",
+                        (receiver.getCompletedTime() - start)));
+                removeReceiver(receiver);
+                return;
+            }
+            sleep(POLL_TIME);
+        }
+
+        int firedFlags = receiver.getFiredFlags();
+        removeReceiver(receiver);
+        fail(String.format("stopScan() timeout: isDiscovering=%b, flags=0x%x (expected 0x%x)",
+                adapter.isDiscovering(), firedFlags, mask));
+
+    }
+
+    /**
+     * Enables PAN tethering on the local device and checks to make sure that tethering is enabled.
+     *
+     * @param adapter The BT adapter.
+     */
+    public void enablePan(BluetoothAdapter adapter) {
+        if (mPan == null) mPan = (BluetoothPan) connectProxy(adapter, BluetoothProfile.PAN);
+        assertNotNull(mPan);
+
+        long start = System.currentTimeMillis();
+        mPanCallback = new TetheringManager.TetheredInterfaceCallback() {
+                    @Override
+                    public void onAvailable(String iface) {
+                    }
+
+                    @Override
+                    public void onUnavailable() {
+                    }
+                };
+        mBluetoothIfaceRequest = mPan.requestTetheredInterface(mContext.getMainExecutor(),
+                mPanCallback);
+        long stop = System.currentTimeMillis();
+        assertTrue(mPan.isTetheringOn());
+
+        writeOutput(String.format("enablePan() completed in %d ms", (stop - start)));
+    }
+
+    /**
+     * Disables PAN tethering on the local device and checks to make sure that tethering is
+     * disabled.
+     *
+     * @param adapter The BT adapter.
+     */
+    public void disablePan(BluetoothAdapter adapter) {
+        if (mPan == null) mPan = (BluetoothPan) connectProxy(adapter, BluetoothProfile.PAN);
+        assertNotNull(mPan);
+
+        long start = System.currentTimeMillis();
+        if (mBluetoothIfaceRequest != null) {
+            mBluetoothIfaceRequest.release();
+            mBluetoothIfaceRequest = null;
+        }
+        long stop = System.currentTimeMillis();
+        assertFalse(mPan.isTetheringOn());
+
+        writeOutput(String.format("disablePan() completed in %d ms", (stop - start)));
+    }
+
+    /**
+     * Initiates a pairing with a remote device and checks to make sure that the devices are paired
+     * and that the correct actions were broadcast.
+     *
+     * @param adapter The BT adapter.
+     * @param device The remote device.
+     * @param passkey The pairing passkey if pairing requires a passkey. Any value if not.
+     * @param pin The pairing pin if pairing requires a pin. Any value if not.
+     */
+    public void pair(BluetoothAdapter adapter, BluetoothDevice device, int passkey, byte[] pin) {
+        pairOrAcceptPair(adapter, device, passkey, pin, true);
+    }
+
+    /**
+     * Accepts a pairing with a remote device and checks to make sure that the devices are paired
+     * and that the correct actions were broadcast.
+     *
+     * @param adapter The BT adapter.
+     * @param device The remote device.
+     * @param passkey The pairing passkey if pairing requires a passkey. Any value if not.
+     * @param pin The pairing pin if pairing requires a pin. Any value if not.
+     */
+    public void acceptPair(BluetoothAdapter adapter, BluetoothDevice device, int passkey,
+            byte[] pin) {
+        pairOrAcceptPair(adapter, device, passkey, pin, false);
+    }
+
+    /**
+     * Helper method used by {@link #pair(BluetoothAdapter, BluetoothDevice, int, byte[])} and
+     * {@link #acceptPair(BluetoothAdapter, BluetoothDevice, int, byte[])} to either pair or accept
+     * a pairing request.
+     *
+     * @param adapter The BT adapter.
+     * @param device The remote device.
+     * @param passkey The pairing passkey if pairing requires a passkey. Any value if not.
+     * @param pin The pairing pin if pairing requires a pin. Any value if not.
+     * @param shouldPair Whether to pair or accept the pair.
+     */
+    private void pairOrAcceptPair(BluetoothAdapter adapter, BluetoothDevice device, int passkey,
+            byte[] pin, boolean shouldPair) {
+        int mask = PairReceiver.STATE_BONDING_FLAG | PairReceiver.STATE_BONDED_FLAG;
+        long start = -1;
+        String methodName;
+        if (shouldPair) {
+            methodName = String.format("pair(device=%s)", device);
+        } else {
+            methodName = String.format("acceptPair(device=%s)", device);
+        }
+
+        if (!adapter.isEnabled()) {
+            fail(String.format("%s bluetooth not enabled", methodName));
+        }
+
+        PairReceiver receiver = getPairReceiver(device, passkey, pin, mask);
+
+        int state = device.getBondState();
+        switch (state) {
+            case BluetoothDevice.BOND_NONE:
+                assertFalse(adapter.getBondedDevices().contains(device));
+                start = System.currentTimeMillis();
+                if (shouldPair) {
+                    assertTrue(device.createBond());
+                }
+                break;
+            case BluetoothDevice.BOND_BONDING:
+                mask = 0; // Don't check for received intents since we might have missed them.
+                break;
+            case BluetoothDevice.BOND_BONDED:
+                assertTrue(adapter.getBondedDevices().contains(device));
+                return;
+            default:
+                removeReceiver(receiver);
+                fail(String.format("%s invalid state: state=%d", methodName, state));
+        }
+
+        long s = System.currentTimeMillis();
+        while (System.currentTimeMillis() - s < PAIR_UNPAIR_TIMEOUT) {
+            state = device.getBondState();
+            if (state == BluetoothDevice.BOND_BONDED && (receiver.getFiredFlags() & mask) == mask) {
+                assertTrue(adapter.getBondedDevices().contains(device));
+                long finish = receiver.getCompletedTime();
+                if (start != -1 && finish != -1) {
+                    writeOutput(String.format("%s completed in %d ms", methodName,
+                            (finish - start)));
+                } else {
+                    writeOutput(String.format("%s completed", methodName));
+                }
+                removeReceiver(receiver);
+                return;
+            }
+            sleep(POLL_TIME);
+        }
+
+        int firedFlags = receiver.getFiredFlags();
+        removeReceiver(receiver);
+        fail(String.format("%s timeout: state=%d (expected %d), flags=0x%x (expected 0x%x)",
+                methodName, state, BluetoothDevice.BOND_BONDED, firedFlags, mask));
+    }
+
+    /**
+     * Deletes a pairing with a remote device and checks to make sure that the devices are unpaired
+     * and that the correct actions were broadcast.
+     *
+     * @param adapter The BT adapter.
+     * @param device The remote device.
+     */
+    public void unpair(BluetoothAdapter adapter, BluetoothDevice device) {
+        int mask = PairReceiver.STATE_NONE_FLAG;
+        long start = -1;
+        String methodName = String.format("unpair(device=%s)", device);
+
+        if (!adapter.isEnabled()) {
+            fail(String.format("%s bluetooth not enabled", methodName));
+        }
+
+        PairReceiver receiver = getPairReceiver(device, 0, null, mask);
+
+        int state = device.getBondState();
+        switch (state) {
+            case BluetoothDevice.BOND_NONE:
+                assertFalse(adapter.getBondedDevices().contains(device));
+                removeReceiver(receiver);
+                return;
+            case BluetoothDevice.BOND_BONDING:
+                start = System.currentTimeMillis();
+                assertTrue(device.removeBond());
+                break;
+            case BluetoothDevice.BOND_BONDED:
+                assertTrue(adapter.getBondedDevices().contains(device));
+                start = System.currentTimeMillis();
+                assertTrue(device.removeBond());
+                break;
+            default:
+                removeReceiver(receiver);
+                fail(String.format("%s invalid state: state=%d", methodName, state));
+        }
+
+        long s = System.currentTimeMillis();
+        while (System.currentTimeMillis() - s < PAIR_UNPAIR_TIMEOUT) {
+            if (device.getBondState() == BluetoothDevice.BOND_NONE
+                    && (receiver.getFiredFlags() & mask) == mask) {
+                assertFalse(adapter.getBondedDevices().contains(device));
+                long finish = receiver.getCompletedTime();
+                if (start != -1 && finish != -1) {
+                    writeOutput(String.format("%s completed in %d ms", methodName,
+                            (finish - start)));
+                } else {
+                    writeOutput(String.format("%s completed", methodName));
+                }
+                removeReceiver(receiver);
+                return;
+            }
+        }
+
+        int firedFlags = receiver.getFiredFlags();
+        removeReceiver(receiver);
+        fail(String.format("%s timeout: state=%d (expected %d), flags=0x%x (expected 0x%x)",
+                methodName, state, BluetoothDevice.BOND_BONDED, firedFlags, mask));
+    }
+
+    /**
+     * Deletes all pairings of remote devices
+     * @param adapter the BT adapter
+     */
+    public void unpairAll(BluetoothAdapter adapter) {
+        Set<BluetoothDevice> devices = adapter.getBondedDevices();
+        for (BluetoothDevice device : devices) {
+            unpair(adapter, device);
+        }
+    }
+
+    /**
+     * Connects a profile from the local device to a remote device and checks to make sure that the
+     * profile is connected and that the correct actions were broadcast.
+     *
+     * @param adapter The BT adapter.
+     * @param device The remote device.
+     * @param profile The profile to connect. One of {@link BluetoothProfile#A2DP},
+     * {@link BluetoothProfile#HEADSET}, {@link BluetoothProfile#HID_HOST} or {@link BluetoothProfile#MAP_CLIENT}..
+     * @param methodName The method name to printed in the logs.  If null, will be
+     * "connectProfile(profile=&lt;profile&gt;, device=&lt;device&gt;)"
+     */
+    public void connectProfile(BluetoothAdapter adapter, BluetoothDevice device, int profile,
+            String methodName) {
+        if (methodName == null) {
+            methodName = String.format("connectProfile(profile=%d, device=%s)", profile, device);
+        }
+        int mask = (ConnectProfileReceiver.STATE_CONNECTING_FLAG
+                | ConnectProfileReceiver.STATE_CONNECTED_FLAG);
+        long start = -1;
+
+        if (!adapter.isEnabled()) {
+            fail(String.format("%s bluetooth not enabled", methodName));
+        }
+
+        if (!adapter.getBondedDevices().contains(device)) {
+            fail(String.format("%s device not paired", methodName));
+        }
+
+        BluetoothProfile proxy = connectProxy(adapter, profile);
+        assertNotNull(proxy);
+
+        ConnectProfileReceiver receiver = getConnectProfileReceiver(device, profile, mask);
+
+        int state = proxy.getConnectionState(device);
+        switch (state) {
+            case BluetoothProfile.STATE_CONNECTED:
+                removeReceiver(receiver);
+                return;
+            case BluetoothProfile.STATE_CONNECTING:
+                mask = 0; // Don't check for received intents since we might have missed them.
+                break;
+            case BluetoothProfile.STATE_DISCONNECTED:
+            case BluetoothProfile.STATE_DISCONNECTING:
+                start = System.currentTimeMillis();
+                if (profile == BluetoothProfile.A2DP) {
+                    assertTrue(((BluetoothA2dp) proxy).connect(device));
+                } else if (profile == BluetoothProfile.HEADSET) {
+                    assertTrue(((BluetoothHeadset) proxy).connect(device));
+                } else if (profile == BluetoothProfile.HID_HOST) {
+                    assertTrue(((BluetoothHidHost) proxy).connect(device));
+                } else if (profile == BluetoothProfile.MAP_CLIENT) {
+                    assertTrue(((BluetoothMapClient) proxy).connect(device));
+                }
+                break;
+            default:
+                removeReceiver(receiver);
+                fail(String.format("%s invalid state: state=%d", methodName, state));
+        }
+
+        long s = System.currentTimeMillis();
+        while (System.currentTimeMillis() - s < CONNECT_DISCONNECT_PROFILE_TIMEOUT) {
+            state = proxy.getConnectionState(device);
+            if (state == BluetoothProfile.STATE_CONNECTED
+                    && (receiver.getFiredFlags() & mask) == mask) {
+                long finish = receiver.getCompletedTime();
+                if (start != -1 && finish != -1) {
+                    writeOutput(String.format("%s completed in %d ms", methodName,
+                            (finish - start)));
+                } else {
+                    writeOutput(String.format("%s completed", methodName));
+                }
+                removeReceiver(receiver);
+                return;
+            }
+            sleep(POLL_TIME);
+        }
+
+        int firedFlags = receiver.getFiredFlags();
+        removeReceiver(receiver);
+        fail(String.format("%s timeout: state=%d (expected %d), flags=0x%x (expected 0x%x)",
+                methodName, state, BluetoothProfile.STATE_CONNECTED, firedFlags, mask));
+    }
+
+    /**
+     * Disconnects a profile between the local device and a remote device and checks to make sure
+     * that the profile is disconnected and that the correct actions were broadcast.
+     *
+     * @param adapter The BT adapter.
+     * @param device The remote device.
+     * @param profile The profile to disconnect. One of {@link BluetoothProfile#A2DP},
+     * {@link BluetoothProfile#HEADSET}, or {@link BluetoothProfile#HID_HOST}.
+     * @param methodName The method name to printed in the logs.  If null, will be
+     * "connectProfile(profile=&lt;profile&gt;, device=&lt;device&gt;)"
+     */
+    public void disconnectProfile(BluetoothAdapter adapter, BluetoothDevice device, int profile,
+            String methodName) {
+        if (methodName == null) {
+            methodName = String.format("disconnectProfile(profile=%d, device=%s)", profile, device);
+        }
+        int mask = (ConnectProfileReceiver.STATE_DISCONNECTING_FLAG
+                | ConnectProfileReceiver.STATE_DISCONNECTED_FLAG);
+        long start = -1;
+
+        if (!adapter.isEnabled()) {
+            fail(String.format("%s bluetooth not enabled", methodName));
+        }
+
+        if (!adapter.getBondedDevices().contains(device)) {
+            fail(String.format("%s device not paired", methodName));
+        }
+
+        BluetoothProfile proxy = connectProxy(adapter, profile);
+        assertNotNull(proxy);
+
+        ConnectProfileReceiver receiver = getConnectProfileReceiver(device, profile, mask);
+
+        int state = proxy.getConnectionState(device);
+        switch (state) {
+            case BluetoothProfile.STATE_CONNECTED:
+            case BluetoothProfile.STATE_CONNECTING:
+                start = System.currentTimeMillis();
+                if (profile == BluetoothProfile.A2DP) {
+                    assertTrue(((BluetoothA2dp) proxy).disconnect(device));
+                } else if (profile == BluetoothProfile.HEADSET) {
+                    assertTrue(((BluetoothHeadset) proxy).disconnect(device));
+                } else if (profile == BluetoothProfile.HID_HOST) {
+                    assertTrue(((BluetoothHidHost) proxy).disconnect(device));
+                } else if (profile == BluetoothProfile.MAP_CLIENT) {
+                    assertTrue(((BluetoothMapClient) proxy).disconnect(device));
+                }
+                break;
+            case BluetoothProfile.STATE_DISCONNECTED:
+                removeReceiver(receiver);
+                return;
+            case BluetoothProfile.STATE_DISCONNECTING:
+                mask = 0; // Don't check for received intents since we might have missed them.
+                break;
+            default:
+                removeReceiver(receiver);
+                fail(String.format("%s invalid state: state=%d", methodName, state));
+        }
+
+        long s = System.currentTimeMillis();
+        while (System.currentTimeMillis() - s < CONNECT_DISCONNECT_PROFILE_TIMEOUT) {
+            state = proxy.getConnectionState(device);
+            if (state == BluetoothProfile.STATE_DISCONNECTED
+                    && (receiver.getFiredFlags() & mask) == mask) {
+                long finish = receiver.getCompletedTime();
+                if (start != -1 && finish != -1) {
+                    writeOutput(String.format("%s completed in %d ms", methodName,
+                            (finish - start)));
+                } else {
+                    writeOutput(String.format("%s completed", methodName));
+                }
+                removeReceiver(receiver);
+                return;
+            }
+            sleep(POLL_TIME);
+        }
+
+        int firedFlags = receiver.getFiredFlags();
+        removeReceiver(receiver);
+        fail(String.format("%s timeout: state=%d (expected %d), flags=0x%x (expected 0x%x)",
+                methodName, state, BluetoothProfile.STATE_DISCONNECTED, firedFlags, mask));
+    }
+
+    /**
+     * Connects the PANU to a remote NAP and checks to make sure that the PANU is connected and that
+     * the correct actions were broadcast.
+     *
+     * @param adapter The BT adapter.
+     * @param device The remote device.
+     */
+    public void connectPan(BluetoothAdapter adapter, BluetoothDevice device) {
+        connectPanOrIncomingPanConnection(adapter, device, true);
+    }
+
+    /**
+     * Checks that a remote PANU connects to the local NAP correctly and that the correct actions
+     * were broadcast.
+     *
+     * @param adapter The BT adapter.
+     * @param device The remote device.
+     */
+    public void incomingPanConnection(BluetoothAdapter adapter, BluetoothDevice device) {
+        connectPanOrIncomingPanConnection(adapter, device, false);
+    }
+
+    /**
+     * Helper method used by {@link #connectPan(BluetoothAdapter, BluetoothDevice)} and
+     * {@link #incomingPanConnection(BluetoothAdapter, BluetoothDevice)} to either connect to a
+     * remote NAP or verify that a remote device connected to the local NAP.
+     *
+     * @param adapter The BT adapter.
+     * @param device The remote device.
+     * @param connect If the method should initiate the connection (is PANU)
+     */
+    private void connectPanOrIncomingPanConnection(BluetoothAdapter adapter, BluetoothDevice device,
+            boolean connect) {
+        long start = -1;
+        int mask, role;
+        String methodName;
+
+        if (connect) {
+            methodName = String.format("connectPan(device=%s)", device);
+            mask = (ConnectProfileReceiver.STATE_CONNECTED_FLAG
+                    | ConnectProfileReceiver.STATE_CONNECTING_FLAG);
+            role = BluetoothPan.LOCAL_PANU_ROLE;
+        } else {
+            methodName = String.format("incomingPanConnection(device=%s)", device);
+            mask = ConnectProfileReceiver.STATE_CONNECTED_FLAG;
+            role = BluetoothPan.LOCAL_NAP_ROLE;
+        }
+
+        if (!adapter.isEnabled()) {
+            fail(String.format("%s bluetooth not enabled", methodName));
+        }
+
+        if (!adapter.getBondedDevices().contains(device)) {
+            fail(String.format("%s device not paired", methodName));
+        }
+
+        mPan = (BluetoothPan) connectProxy(adapter, BluetoothProfile.PAN);
+        assertNotNull(mPan);
+        ConnectPanReceiver receiver = getConnectPanReceiver(device, role, mask);
+
+        int state = mPan.getConnectionState(device);
+        switch (state) {
+            case BluetoothPan.STATE_CONNECTED:
+                removeReceiver(receiver);
+                return;
+            case BluetoothPan.STATE_CONNECTING:
+                mask = 0; // Don't check for received intents since we might have missed them.
+                break;
+            case BluetoothPan.STATE_DISCONNECTED:
+            case BluetoothPan.STATE_DISCONNECTING:
+                start = System.currentTimeMillis();
+                if (role == BluetoothPan.LOCAL_PANU_ROLE) {
+                    Log.i("BT", "connect to pan");
+                    assertTrue(mPan.connect(device));
+                }
+                break;
+            default:
+                removeReceiver(receiver);
+                fail(String.format("%s invalid state: state=%d", methodName, state));
+        }
+
+        long s = System.currentTimeMillis();
+        while (System.currentTimeMillis() - s < CONNECT_DISCONNECT_PROFILE_TIMEOUT) {
+            state = mPan.getConnectionState(device);
+            if (state == BluetoothPan.STATE_CONNECTED
+                    && (receiver.getFiredFlags() & mask) == mask) {
+                long finish = receiver.getCompletedTime();
+                if (start != -1 && finish != -1) {
+                    writeOutput(String.format("%s completed in %d ms", methodName,
+                            (finish - start)));
+                } else {
+                    writeOutput(String.format("%s completed", methodName));
+                }
+                removeReceiver(receiver);
+                return;
+            }
+            sleep(POLL_TIME);
+        }
+
+        int firedFlags = receiver.getFiredFlags();
+        removeReceiver(receiver);
+        fail(String.format("%s timeout: state=%d (expected %d), flags=0x%x (expected 0x%s)",
+                methodName, state, BluetoothPan.STATE_CONNECTED, firedFlags, mask));
+    }
+
+    /**
+     * Disconnects the PANU from a remote NAP and checks to make sure that the PANU is disconnected
+     * and that the correct actions were broadcast.
+     *
+     * @param adapter The BT adapter.
+     * @param device The remote device.
+     */
+    public void disconnectPan(BluetoothAdapter adapter, BluetoothDevice device) {
+        disconnectFromRemoteOrVerifyConnectNap(adapter, device, true);
+    }
+
+    /**
+     * Checks that a remote PANU disconnects from the local NAP correctly and that the correct
+     * actions were broadcast.
+     *
+     * @param adapter The BT adapter.
+     * @param device The remote device.
+     */
+    public void incomingPanDisconnection(BluetoothAdapter adapter, BluetoothDevice device) {
+        disconnectFromRemoteOrVerifyConnectNap(adapter, device, false);
+    }
+
+    /**
+     * Helper method used by {@link #disconnectPan(BluetoothAdapter, BluetoothDevice)} and
+     * {@link #incomingPanDisconnection(BluetoothAdapter, BluetoothDevice)} to either disconnect
+     * from a remote NAP or verify that a remote device disconnected from the local NAP.
+     *
+     * @param adapter The BT adapter.
+     * @param device The remote device.
+     * @param disconnect Whether the method should connect or verify.
+     */
+    private void disconnectFromRemoteOrVerifyConnectNap(BluetoothAdapter adapter,
+            BluetoothDevice device, boolean disconnect) {
+        long start = -1;
+        int mask, role;
+        String methodName;
+
+        if (disconnect) {
+            methodName = String.format("disconnectPan(device=%s)", device);
+            mask = (ConnectProfileReceiver.STATE_DISCONNECTED_FLAG
+                    | ConnectProfileReceiver.STATE_DISCONNECTING_FLAG);
+            role = BluetoothPan.LOCAL_PANU_ROLE;
+        } else {
+            methodName = String.format("incomingPanDisconnection(device=%s)", device);
+            mask = ConnectProfileReceiver.STATE_DISCONNECTED_FLAG;
+            role = BluetoothPan.LOCAL_NAP_ROLE;
+        }
+
+        if (!adapter.isEnabled()) {
+            fail(String.format("%s bluetooth not enabled", methodName));
+        }
+
+        if (!adapter.getBondedDevices().contains(device)) {
+            fail(String.format("%s device not paired", methodName));
+        }
+
+        mPan = (BluetoothPan) connectProxy(adapter, BluetoothProfile.PAN);
+        assertNotNull(mPan);
+        ConnectPanReceiver receiver = getConnectPanReceiver(device, role, mask);
+
+        int state = mPan.getConnectionState(device);
+        switch (state) {
+            case BluetoothPan.STATE_CONNECTED:
+            case BluetoothPan.STATE_CONNECTING:
+                start = System.currentTimeMillis();
+                if (role == BluetoothPan.LOCAL_PANU_ROLE) {
+                    assertTrue(mPan.disconnect(device));
+                }
+                break;
+            case BluetoothPan.STATE_DISCONNECTED:
+                removeReceiver(receiver);
+                return;
+            case BluetoothPan.STATE_DISCONNECTING:
+                mask = 0; // Don't check for received intents since we might have missed them.
+                break;
+            default:
+                removeReceiver(receiver);
+                fail(String.format("%s invalid state: state=%d", methodName, state));
+        }
+
+        long s = System.currentTimeMillis();
+        while (System.currentTimeMillis() - s < CONNECT_DISCONNECT_PROFILE_TIMEOUT) {
+            state = mPan.getConnectionState(device);
+            if (state == BluetoothHidHost.STATE_DISCONNECTED
+                    && (receiver.getFiredFlags() & mask) == mask) {
+                long finish = receiver.getCompletedTime();
+                if (start != -1 && finish != -1) {
+                    writeOutput(String.format("%s completed in %d ms", methodName,
+                            (finish - start)));
+                } else {
+                    writeOutput(String.format("%s completed", methodName));
+                }
+                removeReceiver(receiver);
+                return;
+            }
+            sleep(POLL_TIME);
+        }
+
+        int firedFlags = receiver.getFiredFlags();
+        removeReceiver(receiver);
+        fail(String.format("%s timeout: state=%d (expected %d), flags=0x%x (expected 0x%s)",
+                methodName, state, BluetoothHidHost.STATE_DISCONNECTED, firedFlags, mask));
+    }
+
+    /**
+     * Opens a SCO channel using {@link android.media.AudioManager#startBluetoothSco()} and checks
+     * to make sure that the channel is opened and that the correct actions were broadcast.
+     *
+     * @param adapter The BT adapter.
+     * @param device The remote device.
+     */
+    public void startSco(BluetoothAdapter adapter, BluetoothDevice device) {
+        startStopSco(adapter, device, true);
+    }
+
+    /**
+     * Closes a SCO channel using {@link android.media.AudioManager#stopBluetoothSco()} and checks
+     *  to make sure that the channel is closed and that the correct actions were broadcast.
+     *
+     * @param adapter The BT adapter.
+     * @param device The remote device.
+     */
+    public void stopSco(BluetoothAdapter adapter, BluetoothDevice device) {
+        startStopSco(adapter, device, false);
+    }
+    /**
+     * Helper method for {@link #startSco(BluetoothAdapter, BluetoothDevice)} and
+     * {@link #stopSco(BluetoothAdapter, BluetoothDevice)}.
+     *
+     * @param adapter The BT adapter.
+     * @param device The remote device.
+     * @param isStart Whether the SCO channel should be opened.
+     */
+    private void startStopSco(BluetoothAdapter adapter, BluetoothDevice device, boolean isStart) {
+        long start = -1;
+        int mask;
+        String methodName;
+
+        if (isStart) {
+            methodName = String.format("startSco(device=%s)", device);
+            mask = StartStopScoReceiver.STATE_CONNECTED_FLAG;
+        } else {
+            methodName = String.format("stopSco(device=%s)", device);
+            mask = StartStopScoReceiver.STATE_DISCONNECTED_FLAG;
+        }
+
+        if (!adapter.isEnabled()) {
+            fail(String.format("%s bluetooth not enabled", methodName));
+        }
+
+        if (!adapter.getBondedDevices().contains(device)) {
+            fail(String.format("%s device not paired", methodName));
+        }
+
+        AudioManager manager = (AudioManager) mContext.getSystemService(Context.AUDIO_SERVICE);
+        assertNotNull(manager);
+
+        if (!manager.isBluetoothScoAvailableOffCall()) {
+            fail(String.format("%s device does not support SCO", methodName));
+        }
+
+        boolean isScoOn = manager.isBluetoothScoOn();
+        if (isStart == isScoOn) {
+            return;
+        }
+
+        StartStopScoReceiver receiver = getStartStopScoReceiver(mask);
+        start = System.currentTimeMillis();
+        if (isStart) {
+            manager.startBluetoothSco();
+        } else {
+            manager.stopBluetoothSco();
+        }
+
+        long s = System.currentTimeMillis();
+        while (System.currentTimeMillis() - s < START_STOP_SCO_TIMEOUT) {
+            isScoOn = manager.isBluetoothScoOn();
+            if (isStart == isScoOn && (receiver.getFiredFlags() & mask) == mask) {
+                long finish = receiver.getCompletedTime();
+                if (start != -1 && finish != -1) {
+                    writeOutput(String.format("%s completed in %d ms", methodName,
+                            (finish - start)));
+                } else {
+                    writeOutput(String.format("%s completed", methodName));
+                }
+                removeReceiver(receiver);
+                return;
+            }
+            sleep(POLL_TIME);
+        }
+
+        int firedFlags = receiver.getFiredFlags();
+        removeReceiver(receiver);
+        fail(String.format("%s timeout: on=%b (expected %b), flags=0x%x (expected 0x%x)",
+                methodName, isScoOn, isStart, firedFlags, mask));
+    }
+
+    /**
+     * Writes a string to the logcat and a file if a file has been specified in the constructor.
+     *
+     * @param s The string to be written.
+     */
+    public void writeOutput(String s) {
+        Log.i(mTag, s);
+        if (mOutputWriter == null) {
+            return;
+        }
+        try {
+            mOutputWriter.write(s + "\n");
+            mOutputWriter.flush();
+        } catch (IOException e) {
+            Log.w(mTag, "Could not write to output file", e);
+        }
+    }
+
+    public void mceGetUnreadMessage(BluetoothAdapter adapter, BluetoothDevice device) {
+        int mask;
+        String methodName = "getUnreadMessage";
+
+        if (!adapter.isEnabled()) {
+            fail(String.format("%s bluetooth not enabled", methodName));
+        }
+
+        if (!adapter.getBondedDevices().contains(device)) {
+            fail(String.format("%s device not paired", methodName));
+        }
+
+        mMce = (BluetoothMapClient) connectProxy(adapter, BluetoothProfile.MAP_CLIENT);
+        assertNotNull(mMce);
+
+        if (mMce.getConnectionState(device) != BluetoothProfile.STATE_CONNECTED) {
+            fail(String.format("%s device is not connected", methodName));
+        }
+
+        mMsgHandle = null;
+        mask = MceSetMessageStatusReceiver.MESSAGE_RECEIVED_FLAG;
+        MceSetMessageStatusReceiver receiver = getMceSetMessageStatusReceiver(device, mask);
+        assertTrue(mMce.getUnreadMessages(device));
+
+        long s = System.currentTimeMillis();
+        while (System.currentTimeMillis() - s < GET_UNREAD_MESSAGE_TIMEOUT) {
+            if ((receiver.getFiredFlags() & mask) == mask) {
+                writeOutput(String.format("%s completed", methodName));
+                removeReceiver(receiver);
+                return;
+            }
+            sleep(POLL_TIME);
+        }
+        int firedFlags = receiver.getFiredFlags();
+        removeReceiver(receiver);
+        fail(String.format("%s timeout: state=%d (expected %d), flags=0x%x (expected 0x%s)",
+                methodName, mMce.getConnectionState(device), BluetoothMapClient.STATE_CONNECTED,
+                firedFlags, mask));
+    }
+
+    /**
+     * Set a message to read/unread/deleted/undeleted
+     */
+    public void mceSetMessageStatus(BluetoothAdapter adapter, BluetoothDevice device, int status) {
+        int mask;
+        String methodName = "setMessageStatus";
+
+        if (!adapter.isEnabled()) {
+            fail(String.format("%s bluetooth not enabled", methodName));
+        }
+
+        if (!adapter.getBondedDevices().contains(device)) {
+            fail(String.format("%s device not paired", methodName));
+        }
+
+        mMce = (BluetoothMapClient) connectProxy(adapter, BluetoothProfile.MAP_CLIENT);
+        assertNotNull(mMce);
+
+        if (mMce.getConnectionState(device) != BluetoothProfile.STATE_CONNECTED) {
+            fail(String.format("%s device is not connected", methodName));
+        }
+
+        assertNotNull(mMsgHandle);
+        mask = MceSetMessageStatusReceiver.STATUS_CHANGED_FLAG;
+        MceSetMessageStatusReceiver receiver = getMceSetMessageStatusReceiver(device, mask);
+
+        assertTrue(mMce.setMessageStatus(device, mMsgHandle, status));
+
+        long s = System.currentTimeMillis();
+        while (System.currentTimeMillis() - s < SET_MESSAGE_STATUS_TIMEOUT) {
+            if ((receiver.getFiredFlags() & mask) == mask) {
+                writeOutput(String.format("%s completed", methodName));
+                removeReceiver(receiver);
+                return;
+            }
+            sleep(POLL_TIME);
+        }
+
+        int firedFlags = receiver.getFiredFlags();
+        removeReceiver(receiver);
+        fail(String.format("%s timeout: state=%d (expected %d), flags=0x%x (expected 0x%s)",
+                methodName, mMce.getConnectionState(device), BluetoothPan.STATE_CONNECTED,
+                firedFlags, mask));
+    }
+
+    private void addReceiver(BroadcastReceiver receiver, String[] actions) {
+        IntentFilter filter = new IntentFilter();
+        for (String action: actions) {
+            filter.addAction(action);
+        }
+        mContext.registerReceiver(receiver, filter);
+        mReceivers.add(receiver);
+    }
+
+    private BluetoothReceiver getBluetoothReceiver(int expectedFlags) {
+        String[] actions = {
+                BluetoothAdapter.ACTION_DISCOVERY_FINISHED,
+                BluetoothAdapter.ACTION_DISCOVERY_STARTED,
+                BluetoothAdapter.ACTION_SCAN_MODE_CHANGED,
+                BluetoothAdapter.ACTION_STATE_CHANGED};
+        BluetoothReceiver receiver = new BluetoothReceiver(expectedFlags);
+        addReceiver(receiver, actions);
+        return receiver;
+    }
+
+    private PairReceiver getPairReceiver(BluetoothDevice device, int passkey, byte[] pin,
+            int expectedFlags) {
+        String[] actions = {
+                BluetoothDevice.ACTION_PAIRING_REQUEST,
+                BluetoothDevice.ACTION_BOND_STATE_CHANGED};
+        PairReceiver receiver = new PairReceiver(device, passkey, pin, expectedFlags);
+        addReceiver(receiver, actions);
+        return receiver;
+    }
+
+    private ConnectProfileReceiver getConnectProfileReceiver(BluetoothDevice device, int profile,
+            int expectedFlags) {
+        String[] actions = {
+                BluetoothA2dp.ACTION_CONNECTION_STATE_CHANGED,
+                BluetoothHeadset.ACTION_CONNECTION_STATE_CHANGED,
+                BluetoothHidHost.ACTION_CONNECTION_STATE_CHANGED,
+                BluetoothMapClient.ACTION_CONNECTION_STATE_CHANGED};
+        ConnectProfileReceiver receiver = new ConnectProfileReceiver(device, profile,
+                expectedFlags);
+        addReceiver(receiver, actions);
+        return receiver;
+    }
+
+    private ConnectPanReceiver getConnectPanReceiver(BluetoothDevice device, int role,
+            int expectedFlags) {
+        String[] actions = {BluetoothPan.ACTION_CONNECTION_STATE_CHANGED};
+        ConnectPanReceiver receiver = new ConnectPanReceiver(device, role, expectedFlags);
+        addReceiver(receiver, actions);
+        return receiver;
+    }
+
+    private StartStopScoReceiver getStartStopScoReceiver(int expectedFlags) {
+        String[] actions = {AudioManager.ACTION_SCO_AUDIO_STATE_UPDATED};
+        StartStopScoReceiver receiver = new StartStopScoReceiver(expectedFlags);
+        addReceiver(receiver, actions);
+        return receiver;
+    }
+
+    private MceSetMessageStatusReceiver getMceSetMessageStatusReceiver(BluetoothDevice device,
+            int expectedFlags) {
+        String[] actions = {BluetoothMapClient.ACTION_MESSAGE_RECEIVED,
+            BluetoothMapClient.ACTION_MESSAGE_READ_STATUS_CHANGED,
+            BluetoothMapClient.ACTION_MESSAGE_DELETED_STATUS_CHANGED};
+        MceSetMessageStatusReceiver receiver = new MceSetMessageStatusReceiver(expectedFlags);
+        addReceiver(receiver, actions);
+        return receiver;
+    }
+
+    private void removeReceiver(BroadcastReceiver receiver) {
+        mContext.unregisterReceiver(receiver);
+        mReceivers.remove(receiver);
+    }
+
+    private BluetoothProfile connectProxy(BluetoothAdapter adapter, int profile) {
+        switch (profile) {
+            case BluetoothProfile.A2DP:
+                if (mA2dp != null) {
+                    return mA2dp;
+                }
+                break;
+            case BluetoothProfile.HEADSET:
+                if (mHeadset != null) {
+                    return mHeadset;
+                }
+                break;
+            case BluetoothProfile.HID_HOST:
+                if (mInput != null) {
+                    return mInput;
+                }
+                break;
+            case BluetoothProfile.PAN:
+                if (mPan != null) {
+                    return mPan;
+                }
+                break;
+            case BluetoothProfile.MAP_CLIENT:
+                if (mMce != null) {
+                    return mMce;
+                }
+                break;
+            default:
+                return null;
+        }
+        adapter.getProfileProxy(mContext, mServiceListener, profile);
+        long s = System.currentTimeMillis();
+        switch (profile) {
+            case BluetoothProfile.A2DP:
+                while (mA2dp == null && System.currentTimeMillis() - s < CONNECT_PROXY_TIMEOUT) {
+                    sleep(POLL_TIME);
+                }
+                return mA2dp;
+            case BluetoothProfile.HEADSET:
+                while (mHeadset == null && System.currentTimeMillis() - s < CONNECT_PROXY_TIMEOUT) {
+                    sleep(POLL_TIME);
+                }
+                return mHeadset;
+            case BluetoothProfile.HID_HOST:
+                while (mInput == null && System.currentTimeMillis() - s < CONNECT_PROXY_TIMEOUT) {
+                    sleep(POLL_TIME);
+                }
+                return mInput;
+            case BluetoothProfile.PAN:
+                while (mPan == null && System.currentTimeMillis() - s < CONNECT_PROXY_TIMEOUT) {
+                    sleep(POLL_TIME);
+                }
+                return mPan;
+            case BluetoothProfile.MAP_CLIENT:
+                while (mMce == null && System.currentTimeMillis() - s < CONNECT_PROXY_TIMEOUT) {
+                    sleep(POLL_TIME);
+                }
+                return mMce;
+            default:
+                return null;
+        }
+    }
+
+    private void sleep(long time) {
+        try {
+            Thread.sleep(time);
+        } catch (InterruptedException e) {
+        }
+    }
+}
diff --git a/framework/tests/unit/Android.bp b/framework/tests/unit/Android.bp
new file mode 100644
index 0000000..a976d96
--- /dev/null
+++ b/framework/tests/unit/Android.bp
@@ -0,0 +1,33 @@
+package {
+    default_applicable_licenses: ["Android-Apache-2.0"],
+}
+
+android_test {
+    name: "FrameworkBluetoothTests",
+
+    defaults: ["framework-bluetooth-tests-defaults"],
+
+    min_sdk_version: "current",
+    target_sdk_version: "current",
+
+    // Include all test java files.
+    srcs: ["src/**/*.java"],
+    jacoco: {
+        include_filter: ["android.bluetooth.*"],
+        exclude_filter: [],
+    },
+    libs: [
+        "android.test.runner",
+        "android.test.base",
+    ],
+    static_libs: [
+        "androidx.test.ext.truth",
+        "androidx.test.rules",
+        "junit",
+        "modules-utils-bytesmatcher",
+    ],
+    test_suites: [
+        "general-tests",
+        "mts-bluetooth",
+    ],
+}
diff --git a/framework/tests/unit/AndroidManifest.xml b/framework/tests/unit/AndroidManifest.xml
new file mode 100644
index 0000000..114ceeb
--- /dev/null
+++ b/framework/tests/unit/AndroidManifest.xml
@@ -0,0 +1,26 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright (C) 2022 The Android Open Source Project
+
+     Licensed under the Apache License, Version 2.0 (the "License");
+     you may not use this file except in compliance with the License.
+     You may obtain a copy of the License at
+
+          http://www.apache.org/licenses/LICENSE-2.0
+
+     Unless required by applicable law or agreed to in writing, software
+     distributed under the License is distributed on an "AS IS" BASIS,
+     WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+     See the License for the specific language governing permissions and
+     limitations under the License.
+-->
+
+<manifest xmlns:android="http://schemas.android.com/apk/res/android"
+          package="com.android.framework.bluetooth.tests">
+
+    <application >
+        <uses-library android:name="android.test.runner" />
+    </application>
+    <instrumentation android:name="androidx.test.runner.AndroidJUnitRunner"
+        android:targetPackage="com.android.bluetooth"
+        android:label="Framework Bluetooth Tests"/>
+</manifest>
diff --git a/framework/tests/unit/AndroidTest.xml b/framework/tests/unit/AndroidTest.xml
new file mode 100644
index 0000000..4c04e11
--- /dev/null
+++ b/framework/tests/unit/AndroidTest.xml
@@ -0,0 +1,41 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright 2022 The Android Open Source Project
+
+     Licensed under the Apache License, Version 2.0 (the "License");
+     you may not use this file except in compliance with the License.
+     You may obtain a copy of the License at
+
+          http://www.apache.org/licenses/LICENSE-2.0
+
+     Unless required by applicable law or agreed to in writing, software
+     distributed under the License is distributed on an "AS IS" BASIS,
+     WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+     See the License for the specific language governing permissions and
+     limitations under the License.
+-->
+<configuration description="Config for Bluetooth test cases">
+    <target_preparer class="com.android.tradefed.targetprep.suite.SuiteApkInstaller">
+        <option name="cleanup-apks" value="true" />
+        <option name="test-file-name" value="FrameworkBluetoothTests.apk" />
+    </target_preparer>
+
+    <target_preparer class="com.android.tradefed.targetprep.RootTargetPreparer">
+        <option name="force-root" value="true" />
+    </target_preparer>
+
+    <option name="test-suite-tag" value="apct"/>
+    <option name="test-tag" value="FrameworkBluetoothTests"/>
+
+    <test class="com.android.tradefed.testtype.AndroidJUnitTest" >
+        <option name="package" value="com.android.framework.bluetooth.tests" />
+        <option name="hidden-api-checks" value="false"/>
+        <option name="runner" value="androidx.test.runner.AndroidJUnitRunner"/>
+    </test>
+
+    <!-- Only run FrameworkBluetoothTests in MTS if the Bluetooth Mainline module is installed. -->
+    <object type="module_controller"
+            class="com.android.tradefed.testtype.suite.module.MainlineTestModuleController">
+        <option name="mainline-module-package-name" value="com.android.btservices" />
+        <option name="mainline-module-package-name" value="com.google.android.btservices" />
+    </object>
+</configuration>
diff --git a/framework/tests/unit/src/android/bluetooth/BluetoothActivityEnergyInfoTest.java b/framework/tests/unit/src/android/bluetooth/BluetoothActivityEnergyInfoTest.java
new file mode 100644
index 0000000..d095a9c
--- /dev/null
+++ b/framework/tests/unit/src/android/bluetooth/BluetoothActivityEnergyInfoTest.java
@@ -0,0 +1,152 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.bluetooth;
+
+import static android.bluetooth.BluetoothActivityEnergyInfo.BT_STACK_STATE_INVALID;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import android.os.Parcel;
+
+import androidx.test.filters.SmallTest;
+import androidx.test.runner.AndroidJUnit4;
+
+import org.junit.Assert;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+import java.util.ArrayList;
+
+/**
+ * Test cases for {@link BluetoothActivityEnergyInfo}.
+ */
+@SmallTest
+@RunWith(AndroidJUnit4.class)
+public class BluetoothActivityEnergyInfoTest {
+
+    @Test
+    public void constructor() {
+        long timestamp = 10000;
+        int stackState = BT_STACK_STATE_INVALID;
+        long txTime = 100;
+        long rxTime = 200;
+        long idleTime = 300;
+        long energyUsed = 10;
+        BluetoothActivityEnergyInfo info = new BluetoothActivityEnergyInfo(
+                timestamp, stackState, txTime, rxTime, idleTime, energyUsed);
+
+        assertThat(info.getTimestampMillis()).isEqualTo(timestamp);
+        assertThat(info.getBluetoothStackState()).isEqualTo(stackState);
+        assertThat(info.getControllerTxTimeMillis()).isEqualTo(txTime);
+        assertThat(info.getControllerRxTimeMillis()).isEqualTo(rxTime);
+        assertThat(info.getControllerIdleTimeMillis()).isEqualTo(idleTime);
+        assertThat(info.getControllerEnergyUsed()).isEqualTo(energyUsed);
+        assertThat(info.getUidTraffic()).isEmpty();
+    }
+
+    @Test
+    public void setUidTraffic() {
+        long timestamp = 10000;
+        int stackState = BT_STACK_STATE_INVALID;
+        long txTime = 100;
+        long rxTime = 200;
+        long idleTime = 300;
+        long energyUsed = 10;
+        BluetoothActivityEnergyInfo info = new BluetoothActivityEnergyInfo(
+                timestamp, stackState, txTime, rxTime, idleTime, energyUsed);
+
+        ArrayList<UidTraffic> traffics = new ArrayList<>();
+        UidTraffic traffic = new UidTraffic(123, 300, 400);
+        traffics.add(traffic);
+        info.setUidTraffic(traffics);
+
+        assertThat(info.getUidTraffic().size()).isEqualTo(1);
+        assertThat(info.getUidTraffic().get(0)).isEqualTo(traffic);
+    }
+
+    @Test
+    public void isValid() {
+        long timestamp = 10000;
+        int stackState = BT_STACK_STATE_INVALID;
+        long txTime = 100;
+        long rxTime = 200;
+        long idleTime = 300;
+        long energyUsed = 10;
+        BluetoothActivityEnergyInfo info = new BluetoothActivityEnergyInfo(
+                timestamp, stackState, txTime, rxTime, idleTime, energyUsed);
+
+        assertThat(info.isValid()).isEqualTo(true);
+
+        info = new BluetoothActivityEnergyInfo(
+                timestamp, stackState, -1, rxTime, idleTime, energyUsed);
+        assertThat(info.isValid()).isEqualTo(false);
+
+        info = new BluetoothActivityEnergyInfo(
+                timestamp, stackState, txTime, -1, idleTime, energyUsed);
+        assertThat(info.isValid()).isEqualTo(false);
+
+        info = new BluetoothActivityEnergyInfo(
+                timestamp, stackState, txTime, rxTime, -1, energyUsed);
+        assertThat(info.isValid()).isEqualTo(false);
+    }
+
+    @Test
+    public void writeToParcel() {
+        long timestamp = 10000;
+        int stackState = BT_STACK_STATE_INVALID;
+        long txTime = 100;
+        long rxTime = 200;
+        long idleTime = 300;
+        long energyUsed = 10;
+        BluetoothActivityEnergyInfo info = new BluetoothActivityEnergyInfo(
+                timestamp, stackState, txTime, rxTime, idleTime, energyUsed);
+
+        Parcel parcel = Parcel.obtain();
+        info.writeToParcel(parcel, 0);
+        parcel.setDataPosition(0);
+
+        BluetoothActivityEnergyInfo infoFromParcel =
+                BluetoothActivityEnergyInfo.CREATOR.createFromParcel(parcel);
+        parcel.recycle();
+
+        assertThat(infoFromParcel.getTimestampMillis()).isEqualTo(timestamp);
+        assertThat(infoFromParcel.getBluetoothStackState()).isEqualTo(stackState);
+        assertThat(infoFromParcel.getControllerTxTimeMillis()).isEqualTo(txTime);
+        assertThat(infoFromParcel.getControllerRxTimeMillis()).isEqualTo(rxTime);
+        assertThat(infoFromParcel.getControllerIdleTimeMillis()).isEqualTo(idleTime);
+        assertThat(infoFromParcel.getControllerEnergyUsed()).isEqualTo(energyUsed);
+        assertThat(infoFromParcel.getUidTraffic()).isEmpty();
+    }
+
+    @Test
+    public void toString_ThrowsNoExceptions() {
+        long timestamp = 10000;
+        int stackState = BT_STACK_STATE_INVALID;
+        long txTime = 100;
+        long rxTime = 200;
+        long idleTime = 300;
+        long energyUsed = 10;
+        BluetoothActivityEnergyInfo info = new BluetoothActivityEnergyInfo(
+                timestamp, stackState, txTime, rxTime, idleTime, energyUsed);
+
+        try {
+            String infoString = info.toString();
+        } catch (Exception e) {
+            Assert.fail("Should throw a RuntimeException");
+        }
+    }
+}
diff --git a/framework/tests/unit/src/android/bluetooth/BluetoothAudioConfigTest.java b/framework/tests/unit/src/android/bluetooth/BluetoothAudioConfigTest.java
new file mode 100644
index 0000000..c18d6ae
--- /dev/null
+++ b/framework/tests/unit/src/android/bluetooth/BluetoothAudioConfigTest.java
@@ -0,0 +1,107 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.bluetooth;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import android.media.AudioFormat;
+import android.os.Parcel;
+
+import androidx.test.filters.SmallTest;
+import androidx.test.runner.AndroidJUnit4;
+
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+/**
+ * Test cases for {@link BluetoothAudioConfig}.
+ */
+@SmallTest
+@RunWith(AndroidJUnit4.class)
+public class BluetoothAudioConfigTest {
+
+    private static final int TEST_SAMPLE_RATE = 44;
+    private static final int TEST_CHANNEL_COUNT = 1;
+
+    @Test
+    public void createBluetoothAudioConfig() {
+        BluetoothAudioConfig audioConfig = new BluetoothAudioConfig(
+                TEST_SAMPLE_RATE,
+                TEST_CHANNEL_COUNT,
+                AudioFormat.ENCODING_PCM_16BIT
+        );
+
+        assertThat(audioConfig.getSampleRate()).isEqualTo(TEST_SAMPLE_RATE);
+        assertThat(audioConfig.getChannelConfig()).isEqualTo(TEST_CHANNEL_COUNT);
+        assertThat(audioConfig.getAudioFormat()).isEqualTo(AudioFormat.ENCODING_PCM_16BIT);
+    }
+
+    @Test
+    public void writeToParcel() {
+        BluetoothAudioConfig originalConfig = new BluetoothAudioConfig(
+                TEST_SAMPLE_RATE,
+                TEST_CHANNEL_COUNT,
+                AudioFormat.ENCODING_PCM_16BIT
+        );
+
+        Parcel parcel = Parcel.obtain();
+        originalConfig.writeToParcel(parcel, 0);
+        parcel.setDataPosition(0);
+
+        BluetoothAudioConfig configOut = BluetoothAudioConfig.CREATOR.createFromParcel(parcel);
+        parcel.recycle();
+
+        assertThat(configOut.getSampleRate())
+                .isEqualTo(originalConfig.getSampleRate());
+        assertThat(configOut.getChannelConfig())
+                .isEqualTo(originalConfig.getChannelConfig());
+        assertThat(configOut.getAudioFormat())
+                .isEqualTo(originalConfig.getAudioFormat());
+    }
+
+    @Test
+    public void bluetoothAudioConfigHashCode() {
+        BluetoothAudioConfig audioConfig = new BluetoothAudioConfig(
+                TEST_SAMPLE_RATE,
+                TEST_CHANNEL_COUNT,
+                AudioFormat.ENCODING_PCM_16BIT
+        );
+
+        int hashCode = audioConfig.getSampleRate() | (audioConfig.getChannelConfig() << 24) | (
+                audioConfig.getAudioFormat() << 28);
+        int describeContents = 0;
+
+        assertThat(audioConfig.hashCode()).isEqualTo(hashCode);
+        assertThat(audioConfig.describeContents()).isEqualTo(describeContents);
+    }
+
+    @Test
+    public void bluetoothAudioConfigToString() {
+        BluetoothAudioConfig audioConfig = new BluetoothAudioConfig(
+                TEST_SAMPLE_RATE,
+                TEST_CHANNEL_COUNT,
+                AudioFormat.ENCODING_PCM_16BIT
+        );
+
+        String audioConfigString = audioConfig.toString();
+        String expectedToString = "{mSampleRate:" + audioConfig.getSampleRate()
+                + ",mChannelConfig:" + audioConfig.getChannelConfig()
+                + ",mAudioFormat:" + audioConfig.getAudioFormat() + "}";
+
+        assertThat(audioConfigString).isEqualTo(expectedToString);
+    }
+}
diff --git a/framework/tests/unit/src/android/bluetooth/BluetoothCodecConfigTest.java b/framework/tests/unit/src/android/bluetooth/BluetoothCodecConfigTest.java
new file mode 100644
index 0000000..19bd3f0
--- /dev/null
+++ b/framework/tests/unit/src/android/bluetooth/BluetoothCodecConfigTest.java
@@ -0,0 +1,356 @@
+/*
+ * Copyright 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.bluetooth;
+
+import android.test.suitebuilder.annotation.SmallTest;
+
+import junit.framework.TestCase;
+
+/**
+ * Unit test cases for {@link BluetoothCodecConfig}.
+ */
+public class BluetoothCodecConfigTest extends TestCase {
+    // TODO(b/240635097): remove in U
+    private static final int SOURCE_CODEC_TYPE_OPUS = 6;
+
+    private static final int[] sCodecTypeArray = new int[] {
+        BluetoothCodecConfig.SOURCE_CODEC_TYPE_SBC,
+        BluetoothCodecConfig.SOURCE_CODEC_TYPE_AAC,
+        BluetoothCodecConfig.SOURCE_CODEC_TYPE_APTX,
+        BluetoothCodecConfig.SOURCE_CODEC_TYPE_APTX_HD,
+        BluetoothCodecConfig.SOURCE_CODEC_TYPE_LDAC,
+        SOURCE_CODEC_TYPE_OPUS, // TODO(b/240635097): update in U
+        BluetoothCodecConfig.SOURCE_CODEC_TYPE_INVALID,
+    };
+    private static final int[] sCodecPriorityArray = new int[] {
+        BluetoothCodecConfig.CODEC_PRIORITY_DISABLED,
+        BluetoothCodecConfig.CODEC_PRIORITY_DEFAULT,
+        BluetoothCodecConfig.CODEC_PRIORITY_HIGHEST,
+    };
+    private static final int[] sSampleRateArray = new int[] {
+        BluetoothCodecConfig.SAMPLE_RATE_NONE,
+        BluetoothCodecConfig.SAMPLE_RATE_44100,
+        BluetoothCodecConfig.SAMPLE_RATE_48000,
+        BluetoothCodecConfig.SAMPLE_RATE_88200,
+        BluetoothCodecConfig.SAMPLE_RATE_96000,
+        BluetoothCodecConfig.SAMPLE_RATE_176400,
+        BluetoothCodecConfig.SAMPLE_RATE_192000,
+    };
+    private static final int[] sBitsPerSampleArray = new int[] {
+        BluetoothCodecConfig.BITS_PER_SAMPLE_NONE,
+        BluetoothCodecConfig.BITS_PER_SAMPLE_16,
+        BluetoothCodecConfig.BITS_PER_SAMPLE_24,
+        BluetoothCodecConfig.BITS_PER_SAMPLE_32,
+    };
+    private static final int[] sChannelModeArray = new int[] {
+        BluetoothCodecConfig.CHANNEL_MODE_NONE,
+        BluetoothCodecConfig.CHANNEL_MODE_MONO,
+        BluetoothCodecConfig.CHANNEL_MODE_STEREO,
+    };
+    private static final long[] sCodecSpecific1Array = new long[] {
+        1000,
+        1001,
+        1002,
+        1003,
+    };
+    private static final long[] sCodecSpecific2Array = new long[] {
+        2000,
+        2001,
+        2002,
+        2003,
+    };
+    private static final long[] sCodecSpecific3Array = new long[] {
+        3000,
+        3001,
+        3002,
+        3003,
+    };
+    private static final long[] sCodecSpecific4Array = new long[] {
+        4000,
+        4001,
+        4002,
+        4003,
+    };
+
+    private static final int sTotalConfigs = sCodecTypeArray.length * sCodecPriorityArray.length
+            * sSampleRateArray.length * sBitsPerSampleArray.length * sChannelModeArray.length
+            * sCodecSpecific1Array.length * sCodecSpecific2Array.length
+            * sCodecSpecific3Array.length * sCodecSpecific4Array.length;
+
+    private int selectCodecType(int configId) {
+        int left = sCodecTypeArray.length;
+        int right = sTotalConfigs / left;
+        int index = configId / right;
+        index = index % sCodecTypeArray.length;
+        return sCodecTypeArray[index];
+    }
+
+    private int selectCodecPriority(int configId) {
+        int left = sCodecTypeArray.length * sCodecPriorityArray.length;
+        int right = sTotalConfigs / left;
+        int index = configId / right;
+        index = index % sCodecPriorityArray.length;
+        return sCodecPriorityArray[index];
+    }
+
+    private int selectSampleRate(int configId) {
+        int left = sCodecTypeArray.length * sCodecPriorityArray.length * sSampleRateArray.length;
+        int right = sTotalConfigs / left;
+        int index = configId / right;
+        index = index % sSampleRateArray.length;
+        return sSampleRateArray[index];
+    }
+
+    private int selectBitsPerSample(int configId) {
+        int left = sCodecTypeArray.length * sCodecPriorityArray.length * sSampleRateArray.length
+                * sBitsPerSampleArray.length;
+        int right = sTotalConfigs / left;
+        int index = configId / right;
+        index = index % sBitsPerSampleArray.length;
+        return sBitsPerSampleArray[index];
+    }
+
+    private int selectChannelMode(int configId) {
+        int left = sCodecTypeArray.length * sCodecPriorityArray.length * sSampleRateArray.length
+                * sBitsPerSampleArray.length * sChannelModeArray.length;
+        int right = sTotalConfigs / left;
+        int index = configId / right;
+        index = index % sChannelModeArray.length;
+        return sChannelModeArray[index];
+    }
+
+    private long selectCodecSpecific1(int configId) {
+        int left = sCodecTypeArray.length * sCodecPriorityArray.length * sSampleRateArray.length
+                * sBitsPerSampleArray.length * sChannelModeArray.length
+                * sCodecSpecific1Array.length;
+        int right = sTotalConfigs / left;
+        int index = configId / right;
+        index = index % sCodecSpecific1Array.length;
+        return sCodecSpecific1Array[index];
+    }
+
+    private long selectCodecSpecific2(int configId) {
+        int left = sCodecTypeArray.length * sCodecPriorityArray.length * sSampleRateArray.length
+                * sBitsPerSampleArray.length * sChannelModeArray.length
+                * sCodecSpecific1Array.length * sCodecSpecific2Array.length;
+        int right = sTotalConfigs / left;
+        int index = configId / right;
+        index = index % sCodecSpecific2Array.length;
+        return sCodecSpecific2Array[index];
+    }
+
+    private long selectCodecSpecific3(int configId) {
+        int left = sCodecTypeArray.length * sCodecPriorityArray.length * sSampleRateArray.length
+                * sBitsPerSampleArray.length * sChannelModeArray.length
+                * sCodecSpecific1Array.length * sCodecSpecific2Array.length
+                * sCodecSpecific3Array.length;
+        int right = sTotalConfigs / left;
+        int index = configId / right;
+        index = index % sCodecSpecific3Array.length;
+        return sCodecSpecific3Array[index];
+    }
+
+    private long selectCodecSpecific4(int configId) {
+        int left = sCodecTypeArray.length * sCodecPriorityArray.length * sSampleRateArray.length
+                * sBitsPerSampleArray.length * sChannelModeArray.length
+                * sCodecSpecific1Array.length * sCodecSpecific2Array.length
+                * sCodecSpecific3Array.length * sCodecSpecific4Array.length;
+        int right = sTotalConfigs / left;
+        int index = configId / right;
+        index = index % sCodecSpecific4Array.length;
+        return sCodecSpecific4Array[index];
+    }
+
+    @SmallTest
+    public void testBluetoothCodecConfig_valid_get_methods() {
+
+        for (int config_id = 0; config_id < sTotalConfigs; config_id++) {
+            int codec_type = selectCodecType(config_id);
+            int codec_priority = selectCodecPriority(config_id);
+            int sample_rate = selectSampleRate(config_id);
+            int bits_per_sample = selectBitsPerSample(config_id);
+            int channel_mode = selectChannelMode(config_id);
+            long codec_specific1 = selectCodecSpecific1(config_id);
+            long codec_specific2 = selectCodecSpecific2(config_id);
+            long codec_specific3 = selectCodecSpecific3(config_id);
+            long codec_specific4 = selectCodecSpecific4(config_id);
+
+            BluetoothCodecConfig bcc = buildBluetoothCodecConfig(codec_type, codec_priority,
+                                                                sample_rate, bits_per_sample,
+                                                                channel_mode, codec_specific1,
+                                                                codec_specific2, codec_specific3,
+                                                                codec_specific4);
+
+            if (codec_type == BluetoothCodecConfig.SOURCE_CODEC_TYPE_SBC) {
+                assertTrue(bcc.isMandatoryCodec());
+            } else {
+                assertFalse(bcc.isMandatoryCodec());
+            }
+
+            if (codec_type == BluetoothCodecConfig.SOURCE_CODEC_TYPE_SBC) {
+                assertEquals("SBC", BluetoothCodecConfig.getCodecName(codec_type));
+            }
+            if (codec_type == BluetoothCodecConfig.SOURCE_CODEC_TYPE_AAC) {
+                assertEquals("AAC", BluetoothCodecConfig.getCodecName(codec_type));
+            }
+            if (codec_type == BluetoothCodecConfig.SOURCE_CODEC_TYPE_APTX) {
+                assertEquals("aptX", BluetoothCodecConfig.getCodecName(codec_type));
+            }
+            if (codec_type == BluetoothCodecConfig.SOURCE_CODEC_TYPE_APTX_HD) {
+                assertEquals("aptX HD", BluetoothCodecConfig.getCodecName(codec_type));
+            }
+            if (codec_type == BluetoothCodecConfig.SOURCE_CODEC_TYPE_LDAC) {
+                assertEquals("LDAC", BluetoothCodecConfig.getCodecName(codec_type));
+            }
+            // TODO(b/240635097): update in U
+            if (codec_type == SOURCE_CODEC_TYPE_OPUS) {
+                assertEquals("Opus", BluetoothCodecConfig.getCodecName(codec_type));
+            }
+            if (codec_type == BluetoothCodecConfig.SOURCE_CODEC_TYPE_INVALID) {
+                assertEquals("INVALID CODEC", BluetoothCodecConfig.getCodecName(codec_type));
+            }
+
+            assertEquals(codec_type, bcc.getCodecType());
+            assertEquals(codec_priority, bcc.getCodecPriority());
+            assertEquals(sample_rate, bcc.getSampleRate());
+            assertEquals(bits_per_sample, bcc.getBitsPerSample());
+            assertEquals(channel_mode, bcc.getChannelMode());
+            assertEquals(codec_specific1, bcc.getCodecSpecific1());
+            assertEquals(codec_specific2, bcc.getCodecSpecific2());
+            assertEquals(codec_specific3, bcc.getCodecSpecific3());
+            assertEquals(codec_specific4, bcc.getCodecSpecific4());
+        }
+    }
+
+    @SmallTest
+    public void testBluetoothCodecConfig_equals() {
+        BluetoothCodecConfig bcc1 =
+                buildBluetoothCodecConfig(BluetoothCodecConfig.SOURCE_CODEC_TYPE_SBC,
+                                     BluetoothCodecConfig.CODEC_PRIORITY_DEFAULT,
+                                     BluetoothCodecConfig.SAMPLE_RATE_44100,
+                                     BluetoothCodecConfig.BITS_PER_SAMPLE_16,
+                                     BluetoothCodecConfig.CHANNEL_MODE_STEREO,
+                                     1000, 2000, 3000, 4000);
+
+        BluetoothCodecConfig bcc2_same =
+                buildBluetoothCodecConfig(BluetoothCodecConfig.SOURCE_CODEC_TYPE_SBC,
+                                     BluetoothCodecConfig.CODEC_PRIORITY_DEFAULT,
+                                     BluetoothCodecConfig.SAMPLE_RATE_44100,
+                                     BluetoothCodecConfig.BITS_PER_SAMPLE_16,
+                                     BluetoothCodecConfig.CHANNEL_MODE_STEREO,
+                                     1000, 2000, 3000, 4000);
+        assertTrue(bcc1.equals(bcc2_same));
+
+        BluetoothCodecConfig bcc3_codec_type =
+                buildBluetoothCodecConfig(BluetoothCodecConfig.SOURCE_CODEC_TYPE_AAC,
+                                     BluetoothCodecConfig.CODEC_PRIORITY_DEFAULT,
+                                     BluetoothCodecConfig.SAMPLE_RATE_44100,
+                                     BluetoothCodecConfig.BITS_PER_SAMPLE_16,
+                                     BluetoothCodecConfig.CHANNEL_MODE_STEREO,
+                                     1000, 2000, 3000, 4000);
+        assertFalse(bcc1.equals(bcc3_codec_type));
+
+        BluetoothCodecConfig bcc4_codec_priority =
+                buildBluetoothCodecConfig(BluetoothCodecConfig.SOURCE_CODEC_TYPE_SBC,
+                                     BluetoothCodecConfig.CODEC_PRIORITY_HIGHEST,
+                                     BluetoothCodecConfig.SAMPLE_RATE_44100,
+                                     BluetoothCodecConfig.BITS_PER_SAMPLE_16,
+                                     BluetoothCodecConfig.CHANNEL_MODE_STEREO,
+                                     1000, 2000, 3000, 4000);
+        assertFalse(bcc1.equals(bcc4_codec_priority));
+
+        BluetoothCodecConfig bcc5_sample_rate =
+                buildBluetoothCodecConfig(BluetoothCodecConfig.SOURCE_CODEC_TYPE_SBC,
+                                     BluetoothCodecConfig.CODEC_PRIORITY_DEFAULT,
+                                     BluetoothCodecConfig.SAMPLE_RATE_48000,
+                                     BluetoothCodecConfig.BITS_PER_SAMPLE_16,
+                                     BluetoothCodecConfig.CHANNEL_MODE_STEREO,
+                                     1000, 2000, 3000, 4000);
+        assertFalse(bcc1.equals(bcc5_sample_rate));
+
+        BluetoothCodecConfig bcc6_bits_per_sample =
+                buildBluetoothCodecConfig(BluetoothCodecConfig.SOURCE_CODEC_TYPE_SBC,
+                                     BluetoothCodecConfig.CODEC_PRIORITY_DEFAULT,
+                                     BluetoothCodecConfig.SAMPLE_RATE_44100,
+                                     BluetoothCodecConfig.BITS_PER_SAMPLE_24,
+                                     BluetoothCodecConfig.CHANNEL_MODE_STEREO,
+                                     1000, 2000, 3000, 4000);
+        assertFalse(bcc1.equals(bcc6_bits_per_sample));
+
+        BluetoothCodecConfig bcc7_channel_mode =
+                buildBluetoothCodecConfig(BluetoothCodecConfig.SOURCE_CODEC_TYPE_SBC,
+                                     BluetoothCodecConfig.CODEC_PRIORITY_DEFAULT,
+                                     BluetoothCodecConfig.SAMPLE_RATE_44100,
+                                     BluetoothCodecConfig.BITS_PER_SAMPLE_16,
+                                     BluetoothCodecConfig.CHANNEL_MODE_MONO,
+                                     1000, 2000, 3000, 4000);
+        assertFalse(bcc1.equals(bcc7_channel_mode));
+
+        BluetoothCodecConfig bcc8_codec_specific1 =
+                buildBluetoothCodecConfig(BluetoothCodecConfig.SOURCE_CODEC_TYPE_SBC,
+                                     BluetoothCodecConfig.CODEC_PRIORITY_DEFAULT,
+                                     BluetoothCodecConfig.SAMPLE_RATE_44100,
+                                     BluetoothCodecConfig.BITS_PER_SAMPLE_16,
+                                     BluetoothCodecConfig.CHANNEL_MODE_STEREO,
+                                     1001, 2000, 3000, 4000);
+        assertFalse(bcc1.equals(bcc8_codec_specific1));
+
+        BluetoothCodecConfig bcc9_codec_specific2 =
+                buildBluetoothCodecConfig(BluetoothCodecConfig.SOURCE_CODEC_TYPE_SBC,
+                                     BluetoothCodecConfig.CODEC_PRIORITY_DEFAULT,
+                                     BluetoothCodecConfig.SAMPLE_RATE_44100,
+                                     BluetoothCodecConfig.BITS_PER_SAMPLE_16,
+                                     BluetoothCodecConfig.CHANNEL_MODE_STEREO,
+                                     1000, 2002, 3000, 4000);
+        assertFalse(bcc1.equals(bcc9_codec_specific2));
+
+        BluetoothCodecConfig bcc10_codec_specific3 =
+                buildBluetoothCodecConfig(BluetoothCodecConfig.SOURCE_CODEC_TYPE_SBC,
+                                     BluetoothCodecConfig.CODEC_PRIORITY_DEFAULT,
+                                     BluetoothCodecConfig.SAMPLE_RATE_44100,
+                                     BluetoothCodecConfig.BITS_PER_SAMPLE_16,
+                                     BluetoothCodecConfig.CHANNEL_MODE_STEREO,
+                                     1000, 2000, 3003, 4000);
+        assertFalse(bcc1.equals(bcc10_codec_specific3));
+
+        BluetoothCodecConfig bcc11_codec_specific4 =
+                buildBluetoothCodecConfig(BluetoothCodecConfig.SOURCE_CODEC_TYPE_SBC,
+                                     BluetoothCodecConfig.CODEC_PRIORITY_DEFAULT,
+                                     BluetoothCodecConfig.SAMPLE_RATE_44100,
+                                     BluetoothCodecConfig.BITS_PER_SAMPLE_16,
+                                     BluetoothCodecConfig.CHANNEL_MODE_STEREO,
+                                     1000, 2000, 3000, 4004);
+        assertFalse(bcc1.equals(bcc11_codec_specific4));
+    }
+
+    private BluetoothCodecConfig buildBluetoothCodecConfig(int sourceCodecType,
+            int codecPriority, int sampleRate, int bitsPerSample, int channelMode,
+            long codecSpecific1, long codecSpecific2, long codecSpecific3, long codecSpecific4) {
+        return new BluetoothCodecConfig.Builder()
+                    .setCodecType(sourceCodecType)
+                    .setCodecPriority(codecPriority)
+                    .setSampleRate(sampleRate)
+                    .setBitsPerSample(bitsPerSample)
+                    .setChannelMode(channelMode)
+                    .setCodecSpecific1(codecSpecific1)
+                    .setCodecSpecific2(codecSpecific2)
+                    .setCodecSpecific3(codecSpecific3)
+                    .setCodecSpecific4(codecSpecific4)
+                    .build();
+
+    }
+}
diff --git a/framework/tests/unit/src/android/bluetooth/BluetoothCodecStatusTest.java b/framework/tests/unit/src/android/bluetooth/BluetoothCodecStatusTest.java
new file mode 100644
index 0000000..9c6674e
--- /dev/null
+++ b/framework/tests/unit/src/android/bluetooth/BluetoothCodecStatusTest.java
@@ -0,0 +1,490 @@
+/*
+ * Copyright 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.bluetooth;
+
+import android.test.suitebuilder.annotation.SmallTest;
+
+import junit.framework.TestCase;
+
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Objects;
+
+/**
+ * Unit test cases for {@link BluetoothCodecStatus}.
+ */
+public class BluetoothCodecStatusTest extends TestCase {
+
+    // Codec configs: A and B are same; C is different
+    private static final BluetoothCodecConfig CONFIG_A =
+            buildBluetoothCodecConfig(BluetoothCodecConfig.SOURCE_CODEC_TYPE_SBC,
+                                BluetoothCodecConfig.CODEC_PRIORITY_DEFAULT,
+                                BluetoothCodecConfig.SAMPLE_RATE_44100,
+                                BluetoothCodecConfig.BITS_PER_SAMPLE_16,
+                                BluetoothCodecConfig.CHANNEL_MODE_STEREO,
+                                1000, 2000, 3000, 4000);
+
+    private static final BluetoothCodecConfig CONFIG_B =
+            buildBluetoothCodecConfig(BluetoothCodecConfig.SOURCE_CODEC_TYPE_SBC,
+                                BluetoothCodecConfig.CODEC_PRIORITY_DEFAULT,
+                                BluetoothCodecConfig.SAMPLE_RATE_44100,
+                                BluetoothCodecConfig.BITS_PER_SAMPLE_16,
+                                BluetoothCodecConfig.CHANNEL_MODE_STEREO,
+                                1000, 2000, 3000, 4000);
+
+    private static final BluetoothCodecConfig CONFIG_C =
+            buildBluetoothCodecConfig(BluetoothCodecConfig.SOURCE_CODEC_TYPE_AAC,
+                                BluetoothCodecConfig.CODEC_PRIORITY_DEFAULT,
+                                BluetoothCodecConfig.SAMPLE_RATE_44100,
+                                BluetoothCodecConfig.BITS_PER_SAMPLE_16,
+                                BluetoothCodecConfig.CHANNEL_MODE_STEREO,
+                                1000, 2000, 3000, 4000);
+
+    // Local capabilities: A and B are same; C is different
+    private static final BluetoothCodecConfig LOCAL_CAPABILITY_1_A =
+            buildBluetoothCodecConfig(BluetoothCodecConfig.SOURCE_CODEC_TYPE_SBC,
+                                BluetoothCodecConfig.CODEC_PRIORITY_DEFAULT,
+                                BluetoothCodecConfig.SAMPLE_RATE_44100
+                                | BluetoothCodecConfig.SAMPLE_RATE_48000,
+                                BluetoothCodecConfig.BITS_PER_SAMPLE_16,
+                                BluetoothCodecConfig.CHANNEL_MODE_STEREO
+                                | BluetoothCodecConfig.CHANNEL_MODE_MONO,
+                                1000, 2000, 3000, 4000);
+
+    private static final BluetoothCodecConfig LOCAL_CAPABILITY_1_B =
+            buildBluetoothCodecConfig(BluetoothCodecConfig.SOURCE_CODEC_TYPE_SBC,
+                                BluetoothCodecConfig.CODEC_PRIORITY_DEFAULT,
+                                BluetoothCodecConfig.SAMPLE_RATE_44100
+                                | BluetoothCodecConfig.SAMPLE_RATE_48000,
+                                BluetoothCodecConfig.BITS_PER_SAMPLE_16,
+                                BluetoothCodecConfig.CHANNEL_MODE_STEREO
+                                | BluetoothCodecConfig.CHANNEL_MODE_MONO,
+                                1000, 2000, 3000, 4000);
+
+    private static final BluetoothCodecConfig LOCAL_CAPABILITY_1_C =
+            buildBluetoothCodecConfig(BluetoothCodecConfig.SOURCE_CODEC_TYPE_SBC,
+                                BluetoothCodecConfig.CODEC_PRIORITY_DEFAULT,
+                                BluetoothCodecConfig.SAMPLE_RATE_44100
+                                | BluetoothCodecConfig.SAMPLE_RATE_48000,
+                                BluetoothCodecConfig.BITS_PER_SAMPLE_16,
+                                BluetoothCodecConfig.CHANNEL_MODE_STEREO,
+                                1000, 2000, 3000, 4000);
+
+
+    private static final BluetoothCodecConfig LOCAL_CAPABILITY_2_A =
+            buildBluetoothCodecConfig(BluetoothCodecConfig.SOURCE_CODEC_TYPE_AAC,
+                                BluetoothCodecConfig.CODEC_PRIORITY_DEFAULT,
+                                BluetoothCodecConfig.SAMPLE_RATE_44100
+                                | BluetoothCodecConfig.SAMPLE_RATE_48000,
+                                BluetoothCodecConfig.BITS_PER_SAMPLE_16,
+                                BluetoothCodecConfig.CHANNEL_MODE_STEREO
+                                | BluetoothCodecConfig.CHANNEL_MODE_MONO,
+                                1000, 2000, 3000, 4000);
+
+    private static final BluetoothCodecConfig LOCAL_CAPABILITY_2_B =
+            buildBluetoothCodecConfig(BluetoothCodecConfig.SOURCE_CODEC_TYPE_AAC,
+                                BluetoothCodecConfig.CODEC_PRIORITY_DEFAULT,
+                                BluetoothCodecConfig.SAMPLE_RATE_44100
+                                | BluetoothCodecConfig.SAMPLE_RATE_48000,
+                                BluetoothCodecConfig.BITS_PER_SAMPLE_16,
+                                BluetoothCodecConfig.CHANNEL_MODE_STEREO
+                                | BluetoothCodecConfig.CHANNEL_MODE_MONO,
+                                1000, 2000, 3000, 4000);
+
+    private static final BluetoothCodecConfig LOCAL_CAPABILITY_2_C =
+            buildBluetoothCodecConfig(BluetoothCodecConfig.SOURCE_CODEC_TYPE_AAC,
+                                BluetoothCodecConfig.CODEC_PRIORITY_DEFAULT,
+                                BluetoothCodecConfig.SAMPLE_RATE_44100
+                                | BluetoothCodecConfig.SAMPLE_RATE_48000,
+                                BluetoothCodecConfig.BITS_PER_SAMPLE_16,
+                                BluetoothCodecConfig.CHANNEL_MODE_STEREO,
+                                1000, 2000, 3000, 4000);
+
+    private static final BluetoothCodecConfig LOCAL_CAPABILITY_3_A =
+            buildBluetoothCodecConfig(BluetoothCodecConfig.SOURCE_CODEC_TYPE_APTX,
+                                BluetoothCodecConfig.CODEC_PRIORITY_DEFAULT,
+                                BluetoothCodecConfig.SAMPLE_RATE_44100
+                                | BluetoothCodecConfig.SAMPLE_RATE_48000,
+                                BluetoothCodecConfig.BITS_PER_SAMPLE_16,
+                                BluetoothCodecConfig.CHANNEL_MODE_STEREO
+                                | BluetoothCodecConfig.CHANNEL_MODE_MONO,
+                                1000, 2000, 3000, 4000);
+
+    private static final BluetoothCodecConfig LOCAL_CAPABILITY_3_B =
+            buildBluetoothCodecConfig(BluetoothCodecConfig.SOURCE_CODEC_TYPE_APTX,
+                                BluetoothCodecConfig.CODEC_PRIORITY_DEFAULT,
+                                BluetoothCodecConfig.SAMPLE_RATE_44100
+                                | BluetoothCodecConfig.SAMPLE_RATE_48000,
+                                BluetoothCodecConfig.BITS_PER_SAMPLE_16,
+                                BluetoothCodecConfig.CHANNEL_MODE_STEREO
+                                | BluetoothCodecConfig.CHANNEL_MODE_MONO,
+                                1000, 2000, 3000, 4000);
+
+    private static final BluetoothCodecConfig LOCAL_CAPABILITY_3_C =
+            buildBluetoothCodecConfig(BluetoothCodecConfig.SOURCE_CODEC_TYPE_APTX,
+                                BluetoothCodecConfig.CODEC_PRIORITY_DEFAULT,
+                                BluetoothCodecConfig.SAMPLE_RATE_44100
+                                | BluetoothCodecConfig.SAMPLE_RATE_48000,
+                                BluetoothCodecConfig.BITS_PER_SAMPLE_16,
+                                BluetoothCodecConfig.CHANNEL_MODE_STEREO,
+                                1000, 2000, 3000, 4000);
+
+    private static final BluetoothCodecConfig LOCAL_CAPABILITY_4_A =
+            buildBluetoothCodecConfig(BluetoothCodecConfig.SOURCE_CODEC_TYPE_APTX_HD,
+                                BluetoothCodecConfig.CODEC_PRIORITY_DEFAULT,
+                                BluetoothCodecConfig.SAMPLE_RATE_44100
+                                | BluetoothCodecConfig.SAMPLE_RATE_48000,
+                                BluetoothCodecConfig.BITS_PER_SAMPLE_24,
+                                BluetoothCodecConfig.CHANNEL_MODE_STEREO
+                                | BluetoothCodecConfig.CHANNEL_MODE_MONO,
+                                1000, 2000, 3000, 4000);
+
+    private static final BluetoothCodecConfig LOCAL_CAPABILITY_4_B =
+            buildBluetoothCodecConfig(BluetoothCodecConfig.SOURCE_CODEC_TYPE_APTX_HD,
+                                BluetoothCodecConfig.CODEC_PRIORITY_DEFAULT,
+                                BluetoothCodecConfig.SAMPLE_RATE_44100
+                                | BluetoothCodecConfig.SAMPLE_RATE_48000,
+                                BluetoothCodecConfig.BITS_PER_SAMPLE_24,
+                                BluetoothCodecConfig.CHANNEL_MODE_STEREO
+                                | BluetoothCodecConfig.CHANNEL_MODE_MONO,
+                                1000, 2000, 3000, 4000);
+
+    private static final BluetoothCodecConfig LOCAL_CAPABILITY_4_C =
+            buildBluetoothCodecConfig(BluetoothCodecConfig.SOURCE_CODEC_TYPE_APTX_HD,
+                                BluetoothCodecConfig.CODEC_PRIORITY_DEFAULT,
+                                BluetoothCodecConfig.SAMPLE_RATE_44100
+                                | BluetoothCodecConfig.SAMPLE_RATE_48000,
+                                BluetoothCodecConfig.BITS_PER_SAMPLE_24,
+                                BluetoothCodecConfig.CHANNEL_MODE_STEREO,
+                                1000, 2000, 3000, 4000);
+
+    private static final BluetoothCodecConfig LOCAL_CAPABILITY_5_A =
+            buildBluetoothCodecConfig(BluetoothCodecConfig.SOURCE_CODEC_TYPE_LDAC,
+                                BluetoothCodecConfig.CODEC_PRIORITY_DEFAULT,
+                                BluetoothCodecConfig.SAMPLE_RATE_44100
+                                | BluetoothCodecConfig.SAMPLE_RATE_48000
+                                | BluetoothCodecConfig.SAMPLE_RATE_88200
+                                | BluetoothCodecConfig.SAMPLE_RATE_96000,
+                                BluetoothCodecConfig.BITS_PER_SAMPLE_16
+                                | BluetoothCodecConfig.BITS_PER_SAMPLE_24
+                                | BluetoothCodecConfig.BITS_PER_SAMPLE_32,
+                                BluetoothCodecConfig.CHANNEL_MODE_STEREO
+                                | BluetoothCodecConfig.CHANNEL_MODE_MONO,
+                                1000, 2000, 3000, 4000);
+
+    private static final BluetoothCodecConfig LOCAL_CAPABILITY_5_B =
+            buildBluetoothCodecConfig(BluetoothCodecConfig.SOURCE_CODEC_TYPE_LDAC,
+                                BluetoothCodecConfig.CODEC_PRIORITY_DEFAULT,
+                                BluetoothCodecConfig.SAMPLE_RATE_44100
+                                | BluetoothCodecConfig.SAMPLE_RATE_48000
+                                | BluetoothCodecConfig.SAMPLE_RATE_88200
+                                | BluetoothCodecConfig.SAMPLE_RATE_96000,
+                                BluetoothCodecConfig.BITS_PER_SAMPLE_16
+                                | BluetoothCodecConfig.BITS_PER_SAMPLE_24
+                                | BluetoothCodecConfig.BITS_PER_SAMPLE_32,
+                                BluetoothCodecConfig.CHANNEL_MODE_STEREO
+                                | BluetoothCodecConfig.CHANNEL_MODE_MONO,
+                                1000, 2000, 3000, 4000);
+
+    private static final BluetoothCodecConfig LOCAL_CAPABILITY_5_C =
+            buildBluetoothCodecConfig(BluetoothCodecConfig.SOURCE_CODEC_TYPE_LDAC,
+                                BluetoothCodecConfig.CODEC_PRIORITY_DEFAULT,
+                                BluetoothCodecConfig.SAMPLE_RATE_44100
+                                | BluetoothCodecConfig.SAMPLE_RATE_48000
+                                | BluetoothCodecConfig.SAMPLE_RATE_88200
+                                | BluetoothCodecConfig.SAMPLE_RATE_96000,
+                                BluetoothCodecConfig.BITS_PER_SAMPLE_16
+                                | BluetoothCodecConfig.BITS_PER_SAMPLE_24
+                                | BluetoothCodecConfig.BITS_PER_SAMPLE_32,
+                                BluetoothCodecConfig.CHANNEL_MODE_STEREO,
+                                1000, 2000, 3000, 4000);
+
+
+    // Selectable capabilities: A and B are same; C is different
+    private static final BluetoothCodecConfig SELECTABE_CAPABILITY_1_A =
+            buildBluetoothCodecConfig(BluetoothCodecConfig.SOURCE_CODEC_TYPE_SBC,
+                                BluetoothCodecConfig.CODEC_PRIORITY_DEFAULT,
+                                BluetoothCodecConfig.SAMPLE_RATE_44100,
+                                BluetoothCodecConfig.BITS_PER_SAMPLE_16,
+                                BluetoothCodecConfig.CHANNEL_MODE_STEREO
+                                | BluetoothCodecConfig.CHANNEL_MODE_MONO,
+                                1000, 2000, 3000, 4000);
+
+    private static final BluetoothCodecConfig SELECTABE_CAPABILITY_1_B =
+            buildBluetoothCodecConfig(BluetoothCodecConfig.SOURCE_CODEC_TYPE_SBC,
+                                BluetoothCodecConfig.CODEC_PRIORITY_DEFAULT,
+                                BluetoothCodecConfig.SAMPLE_RATE_44100,
+                                BluetoothCodecConfig.BITS_PER_SAMPLE_16,
+                                BluetoothCodecConfig.CHANNEL_MODE_STEREO
+                                | BluetoothCodecConfig.CHANNEL_MODE_MONO,
+                                1000, 2000, 3000, 4000);
+
+    private static final BluetoothCodecConfig SELECTABE_CAPABILITY_1_C =
+            buildBluetoothCodecConfig(BluetoothCodecConfig.SOURCE_CODEC_TYPE_SBC,
+                                BluetoothCodecConfig.CODEC_PRIORITY_DEFAULT,
+                                BluetoothCodecConfig.SAMPLE_RATE_44100,
+                                BluetoothCodecConfig.BITS_PER_SAMPLE_16,
+                                BluetoothCodecConfig.CHANNEL_MODE_STEREO,
+                                1000, 2000, 3000, 4000);
+
+    private static final BluetoothCodecConfig SELECTABE_CAPABILITY_2_A =
+            buildBluetoothCodecConfig(BluetoothCodecConfig.SOURCE_CODEC_TYPE_AAC,
+                                BluetoothCodecConfig.CODEC_PRIORITY_DEFAULT,
+                                BluetoothCodecConfig.SAMPLE_RATE_44100,
+                                BluetoothCodecConfig.BITS_PER_SAMPLE_16,
+                                BluetoothCodecConfig.CHANNEL_MODE_STEREO
+                                | BluetoothCodecConfig.CHANNEL_MODE_MONO,
+                                1000, 2000, 3000, 4000);
+
+    private static final BluetoothCodecConfig SELECTABE_CAPABILITY_2_B =
+            buildBluetoothCodecConfig(BluetoothCodecConfig.SOURCE_CODEC_TYPE_AAC,
+                                BluetoothCodecConfig.CODEC_PRIORITY_DEFAULT,
+                                BluetoothCodecConfig.SAMPLE_RATE_44100,
+                                BluetoothCodecConfig.BITS_PER_SAMPLE_16,
+                                BluetoothCodecConfig.CHANNEL_MODE_STEREO
+                                | BluetoothCodecConfig.CHANNEL_MODE_MONO,
+                                1000, 2000, 3000, 4000);
+
+    private static final BluetoothCodecConfig SELECTABE_CAPABILITY_2_C =
+            buildBluetoothCodecConfig(BluetoothCodecConfig.SOURCE_CODEC_TYPE_AAC,
+                                BluetoothCodecConfig.CODEC_PRIORITY_DEFAULT,
+                                BluetoothCodecConfig.SAMPLE_RATE_44100,
+                                BluetoothCodecConfig.BITS_PER_SAMPLE_16,
+                                BluetoothCodecConfig.CHANNEL_MODE_STEREO,
+                                1000, 2000, 3000, 4000);
+
+    private static final BluetoothCodecConfig SELECTABE_CAPABILITY_3_A =
+            buildBluetoothCodecConfig(BluetoothCodecConfig.SOURCE_CODEC_TYPE_APTX,
+                                BluetoothCodecConfig.CODEC_PRIORITY_DEFAULT,
+                                BluetoothCodecConfig.SAMPLE_RATE_44100,
+                                BluetoothCodecConfig.BITS_PER_SAMPLE_16,
+                                BluetoothCodecConfig.CHANNEL_MODE_STEREO
+                                | BluetoothCodecConfig.CHANNEL_MODE_MONO,
+                                1000, 2000, 3000, 4000);
+
+    private static final BluetoothCodecConfig SELECTABE_CAPABILITY_3_B =
+            buildBluetoothCodecConfig(BluetoothCodecConfig.SOURCE_CODEC_TYPE_APTX,
+                                BluetoothCodecConfig.CODEC_PRIORITY_DEFAULT,
+                                BluetoothCodecConfig.SAMPLE_RATE_44100,
+                                BluetoothCodecConfig.BITS_PER_SAMPLE_16,
+                                BluetoothCodecConfig.CHANNEL_MODE_STEREO
+                                | BluetoothCodecConfig.CHANNEL_MODE_MONO,
+                                1000, 2000, 3000, 4000);
+
+    private static final BluetoothCodecConfig SELECTABE_CAPABILITY_3_C =
+            buildBluetoothCodecConfig(BluetoothCodecConfig.SOURCE_CODEC_TYPE_APTX,
+                                BluetoothCodecConfig.CODEC_PRIORITY_DEFAULT,
+                                BluetoothCodecConfig.SAMPLE_RATE_44100,
+                                BluetoothCodecConfig.BITS_PER_SAMPLE_16,
+                                BluetoothCodecConfig.CHANNEL_MODE_STEREO,
+                                1000, 2000, 3000, 4000);
+
+    private static final BluetoothCodecConfig SELECTABE_CAPABILITY_4_A =
+            buildBluetoothCodecConfig(BluetoothCodecConfig.SOURCE_CODEC_TYPE_APTX_HD,
+                                BluetoothCodecConfig.CODEC_PRIORITY_DEFAULT,
+                                BluetoothCodecConfig.SAMPLE_RATE_44100,
+                                BluetoothCodecConfig.BITS_PER_SAMPLE_24,
+                                BluetoothCodecConfig.CHANNEL_MODE_STEREO
+                                | BluetoothCodecConfig.CHANNEL_MODE_MONO,
+                                1000, 2000, 3000, 4000);
+
+    private static final BluetoothCodecConfig SELECTABE_CAPABILITY_4_B =
+            buildBluetoothCodecConfig(BluetoothCodecConfig.SOURCE_CODEC_TYPE_APTX_HD,
+                                BluetoothCodecConfig.CODEC_PRIORITY_DEFAULT,
+                                BluetoothCodecConfig.SAMPLE_RATE_44100,
+                                BluetoothCodecConfig.BITS_PER_SAMPLE_24,
+                                BluetoothCodecConfig.CHANNEL_MODE_STEREO
+                                | BluetoothCodecConfig.CHANNEL_MODE_MONO,
+                                1000, 2000, 3000, 4000);
+
+    private static final BluetoothCodecConfig SELECTABE_CAPABILITY_4_C =
+            buildBluetoothCodecConfig(BluetoothCodecConfig.SOURCE_CODEC_TYPE_APTX_HD,
+                                 BluetoothCodecConfig.CODEC_PRIORITY_DEFAULT,
+                                 BluetoothCodecConfig.SAMPLE_RATE_44100,
+                                 BluetoothCodecConfig.BITS_PER_SAMPLE_24,
+                                 BluetoothCodecConfig.CHANNEL_MODE_STEREO,
+                                 1000, 2000, 3000, 4000);
+
+    private static final BluetoothCodecConfig SELECTABE_CAPABILITY_5_A =
+            buildBluetoothCodecConfig(BluetoothCodecConfig.SOURCE_CODEC_TYPE_LDAC,
+                                BluetoothCodecConfig.CODEC_PRIORITY_DEFAULT,
+                                BluetoothCodecConfig.SAMPLE_RATE_44100
+                                | BluetoothCodecConfig.SAMPLE_RATE_48000
+                                | BluetoothCodecConfig.SAMPLE_RATE_88200
+                                | BluetoothCodecConfig.SAMPLE_RATE_96000,
+                                BluetoothCodecConfig.BITS_PER_SAMPLE_16
+                                | BluetoothCodecConfig.BITS_PER_SAMPLE_24
+                                | BluetoothCodecConfig.BITS_PER_SAMPLE_32,
+                                BluetoothCodecConfig.CHANNEL_MODE_STEREO
+                                | BluetoothCodecConfig.CHANNEL_MODE_MONO,
+                                1000, 2000, 3000, 4000);
+
+    private static final BluetoothCodecConfig SELECTABE_CAPABILITY_5_B =
+            buildBluetoothCodecConfig(BluetoothCodecConfig.SOURCE_CODEC_TYPE_LDAC,
+                                BluetoothCodecConfig.CODEC_PRIORITY_DEFAULT,
+                                BluetoothCodecConfig.SAMPLE_RATE_44100
+                                | BluetoothCodecConfig.SAMPLE_RATE_48000
+                                | BluetoothCodecConfig.SAMPLE_RATE_88200
+                                | BluetoothCodecConfig.SAMPLE_RATE_96000,
+                                BluetoothCodecConfig.BITS_PER_SAMPLE_16
+                                | BluetoothCodecConfig.BITS_PER_SAMPLE_24
+                                | BluetoothCodecConfig.BITS_PER_SAMPLE_32,
+                                BluetoothCodecConfig.CHANNEL_MODE_STEREO
+                                | BluetoothCodecConfig.CHANNEL_MODE_MONO,
+                                1000, 2000, 3000, 4000);
+
+    private static final BluetoothCodecConfig SELECTABE_CAPABILITY_5_C =
+            buildBluetoothCodecConfig(BluetoothCodecConfig.SOURCE_CODEC_TYPE_LDAC,
+                                BluetoothCodecConfig.CODEC_PRIORITY_DEFAULT,
+                                BluetoothCodecConfig.SAMPLE_RATE_44100
+                                | BluetoothCodecConfig.SAMPLE_RATE_48000
+                                | BluetoothCodecConfig.SAMPLE_RATE_88200
+                                | BluetoothCodecConfig.SAMPLE_RATE_96000,
+                                BluetoothCodecConfig.BITS_PER_SAMPLE_16
+                                | BluetoothCodecConfig.BITS_PER_SAMPLE_24
+                                | BluetoothCodecConfig.BITS_PER_SAMPLE_32,
+                                BluetoothCodecConfig.CHANNEL_MODE_STEREO,
+                                1000, 2000, 3000, 4000);
+
+    private static final List<BluetoothCodecConfig> LOCAL_CAPABILITY_A =
+            new ArrayList() {{
+                    add(LOCAL_CAPABILITY_1_A);
+                    add(LOCAL_CAPABILITY_2_A);
+                    add(LOCAL_CAPABILITY_3_A);
+                    add(LOCAL_CAPABILITY_4_A);
+                    add(LOCAL_CAPABILITY_5_A);
+            }};
+
+    private static final List<BluetoothCodecConfig> LOCAL_CAPABILITY_B =
+            new ArrayList() {{
+                    add(LOCAL_CAPABILITY_1_B);
+                    add(LOCAL_CAPABILITY_2_B);
+                    add(LOCAL_CAPABILITY_3_B);
+                    add(LOCAL_CAPABILITY_4_B);
+                    add(LOCAL_CAPABILITY_5_B);
+            }};
+
+    private static final List<BluetoothCodecConfig> LOCAL_CAPABILITY_B_REORDERED =
+            new ArrayList() {{
+                    add(LOCAL_CAPABILITY_5_B);
+                    add(LOCAL_CAPABILITY_4_B);
+                    add(LOCAL_CAPABILITY_2_B);
+                    add(LOCAL_CAPABILITY_3_B);
+                    add(LOCAL_CAPABILITY_1_B);
+            }};
+
+    private static final List<BluetoothCodecConfig> LOCAL_CAPABILITY_C =
+            new ArrayList() {{
+                    add(LOCAL_CAPABILITY_1_C);
+                    add(LOCAL_CAPABILITY_2_C);
+                    add(LOCAL_CAPABILITY_3_C);
+                    add(LOCAL_CAPABILITY_4_C);
+                    add(LOCAL_CAPABILITY_5_C);
+            }};
+
+    private static final List<BluetoothCodecConfig> SELECTABLE_CAPABILITY_A =
+            new ArrayList() {{
+                    add(SELECTABE_CAPABILITY_1_A);
+                    add(SELECTABE_CAPABILITY_2_A);
+                    add(SELECTABE_CAPABILITY_3_A);
+                    add(SELECTABE_CAPABILITY_4_A);
+                    add(SELECTABE_CAPABILITY_5_A);
+            }};
+
+    private static final List<BluetoothCodecConfig> SELECTABLE_CAPABILITY_B =
+            new ArrayList() {{
+                    add(SELECTABE_CAPABILITY_1_B);
+                    add(SELECTABE_CAPABILITY_2_B);
+                    add(SELECTABE_CAPABILITY_3_B);
+                    add(SELECTABE_CAPABILITY_4_B);
+                    add(SELECTABE_CAPABILITY_5_B);
+            }};
+
+    private static final List<BluetoothCodecConfig> SELECTABLE_CAPABILITY_B_REORDERED =
+            new ArrayList() {{
+                    add(SELECTABE_CAPABILITY_5_B);
+                    add(SELECTABE_CAPABILITY_4_B);
+                    add(SELECTABE_CAPABILITY_2_B);
+                    add(SELECTABE_CAPABILITY_3_B);
+                    add(SELECTABE_CAPABILITY_1_B);
+            }};
+
+    private static final List<BluetoothCodecConfig> SELECTABLE_CAPABILITY_C =
+            new ArrayList() {{
+                    add(SELECTABE_CAPABILITY_1_C);
+                    add(SELECTABE_CAPABILITY_2_C);
+                    add(SELECTABE_CAPABILITY_3_C);
+                    add(SELECTABE_CAPABILITY_4_C);
+                    add(SELECTABE_CAPABILITY_5_C);
+            }};
+
+    private static final BluetoothCodecStatus BCS_A =
+            new BluetoothCodecStatus(CONFIG_A, LOCAL_CAPABILITY_A, SELECTABLE_CAPABILITY_A);
+    private static final BluetoothCodecStatus BCS_B =
+            new BluetoothCodecStatus(CONFIG_B, LOCAL_CAPABILITY_B, SELECTABLE_CAPABILITY_B);
+    private static final BluetoothCodecStatus BCS_B_REORDERED =
+            new BluetoothCodecStatus(CONFIG_B, LOCAL_CAPABILITY_B_REORDERED,
+                                 SELECTABLE_CAPABILITY_B_REORDERED);
+    private static final BluetoothCodecStatus BCS_C =
+            new BluetoothCodecStatus(CONFIG_C, LOCAL_CAPABILITY_C, SELECTABLE_CAPABILITY_C);
+
+    @SmallTest
+    public void testBluetoothCodecStatus_get_methods() {
+
+        assertTrue(Objects.equals(BCS_A.getCodecConfig(), CONFIG_A));
+        assertTrue(Objects.equals(BCS_A.getCodecConfig(), CONFIG_B));
+        assertFalse(Objects.equals(BCS_A.getCodecConfig(), CONFIG_C));
+
+        assertTrue(BCS_A.getCodecsLocalCapabilities().equals(LOCAL_CAPABILITY_A));
+        assertTrue(BCS_A.getCodecsLocalCapabilities().equals(LOCAL_CAPABILITY_B));
+        assertFalse(BCS_A.getCodecsLocalCapabilities().equals(LOCAL_CAPABILITY_C));
+
+        assertTrue(BCS_A.getCodecsSelectableCapabilities()
+                                 .equals(SELECTABLE_CAPABILITY_A));
+        assertTrue(BCS_A.getCodecsSelectableCapabilities()
+                                  .equals(SELECTABLE_CAPABILITY_B));
+        assertFalse(BCS_A.getCodecsSelectableCapabilities()
+                                  .equals(SELECTABLE_CAPABILITY_C));
+    }
+
+    @SmallTest
+    public void testBluetoothCodecStatus_equals() {
+        assertTrue(BCS_A.equals(BCS_B));
+        assertTrue(BCS_B.equals(BCS_A));
+        assertTrue(BCS_A.equals(BCS_B_REORDERED));
+        assertTrue(BCS_B_REORDERED.equals(BCS_A));
+        assertFalse(BCS_A.equals(BCS_C));
+        assertFalse(BCS_C.equals(BCS_A));
+    }
+
+    private static BluetoothCodecConfig buildBluetoothCodecConfig(int sourceCodecType,
+            int codecPriority, int sampleRate, int bitsPerSample, int channelMode,
+            long codecSpecific1, long codecSpecific2, long codecSpecific3, long codecSpecific4) {
+        return new BluetoothCodecConfig.Builder()
+                    .setCodecType(sourceCodecType)
+                    .setCodecPriority(codecPriority)
+                    .setSampleRate(sampleRate)
+                    .setBitsPerSample(bitsPerSample)
+                    .setChannelMode(channelMode)
+                    .setCodecSpecific1(codecSpecific1)
+                    .setCodecSpecific2(codecSpecific2)
+                    .setCodecSpecific3(codecSpecific3)
+                    .setCodecSpecific4(codecSpecific4)
+                    .build();
+
+    }
+}
diff --git a/framework/tests/src/android/bluetooth/BluetoothLeAudioCodecConfigTest.java b/framework/tests/unit/src/android/bluetooth/BluetoothLeAudioCodecConfigTest.java
similarity index 100%
rename from framework/tests/src/android/bluetooth/BluetoothLeAudioCodecConfigTest.java
rename to framework/tests/unit/src/android/bluetooth/BluetoothLeAudioCodecConfigTest.java
diff --git a/framework/tests/unit/src/android/bluetooth/BluetoothUuidTest.java b/framework/tests/unit/src/android/bluetooth/BluetoothUuidTest.java
new file mode 100644
index 0000000..514a584
--- /dev/null
+++ b/framework/tests/unit/src/android/bluetooth/BluetoothUuidTest.java
@@ -0,0 +1,63 @@
+/*
+ * Copyright (C) 2014 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.bluetooth;
+
+import android.os.ParcelUuid;
+import android.test.suitebuilder.annotation.SmallTest;
+
+import junit.framework.TestCase;
+
+/**
+ * Unit test cases for {@link BluetoothUuid}.
+ */
+public class BluetoothUuidTest extends TestCase {
+
+    @SmallTest
+    public void testUuidParser() {
+        byte[] uuid16 = new byte[] {
+                0x0B, 0x11 };
+        assertEquals(ParcelUuid.fromString("0000110B-0000-1000-8000-00805F9B34FB"),
+                BluetoothUuid.parseUuidFrom(uuid16));
+
+        byte[] uuid32 = new byte[] {
+                0x0B, 0x11, 0x33, (byte) 0xFE };
+        assertEquals(ParcelUuid.fromString("FE33110B-0000-1000-8000-00805F9B34FB"),
+                BluetoothUuid.parseUuidFrom(uuid32));
+
+        byte[] uuid128 = new byte[] {
+                0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08,
+                0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F, (byte) 0xFF };
+        assertEquals(ParcelUuid.fromString("FF0F0E0D-0C0B-0A09-0807-0060504030201"),
+                BluetoothUuid.parseUuidFrom(uuid128));
+    }
+
+    @SmallTest
+    public void testUuidType() {
+        assertTrue(BluetoothUuid.is16BitUuid(
+                ParcelUuid.fromString("0000110B-0000-1000-8000-00805F9B34FB")));
+        assertFalse(BluetoothUuid.is32BitUuid(
+                ParcelUuid.fromString("0000110B-0000-1000-8000-00805F9B34FB")));
+
+        assertFalse(BluetoothUuid.is16BitUuid(
+                ParcelUuid.fromString("FE33110B-0000-1000-8000-00805F9B34FB")));
+        assertTrue(BluetoothUuid.is32BitUuid(
+                ParcelUuid.fromString("FE33110B-0000-1000-8000-00805F9B34FB")));
+        assertFalse(BluetoothUuid.is32BitUuid(
+                ParcelUuid.fromString("FE33110B-1000-1000-8000-00805F9B34FB")));
+
+    }
+}
diff --git a/framework/tests/unit/src/android/bluetooth/SdpDipRecordTest.java b/framework/tests/unit/src/android/bluetooth/SdpDipRecordTest.java
new file mode 100644
index 0000000..0ce85bf
--- /dev/null
+++ b/framework/tests/unit/src/android/bluetooth/SdpDipRecordTest.java
@@ -0,0 +1,100 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.bluetooth;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import android.os.Parcel;
+
+import androidx.test.filters.SmallTest;
+import androidx.test.runner.AndroidJUnit4;
+
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+/**
+ * Test cases for {@link SdpDipRecord}.
+ */
+@SmallTest
+@RunWith(AndroidJUnit4.class)
+public class SdpDipRecordTest {
+
+    @Test
+    public void createSdpDipRecord() {
+        int specificationId = 1;
+        int vendorId = 1;
+        int vendorIdSource = 1;
+        int productId = 1;
+        int version = 1;
+        boolean primaryRecord = true;
+
+        SdpDipRecord record = new SdpDipRecord(
+                specificationId,
+                vendorId,
+                vendorIdSource,
+                productId,
+                version,
+                primaryRecord
+        );
+
+        assertThat(record.getSpecificationId()).isEqualTo(specificationId);
+        assertThat(record.getVendorId()).isEqualTo(vendorId);
+        assertThat(record.getVendorIdSource()).isEqualTo(vendorIdSource);
+        assertThat(record.getProductId()).isEqualTo(productId);
+        assertThat(record.getVersion()).isEqualTo(version);
+        assertThat(record.getPrimaryRecord()).isEqualTo(primaryRecord);
+    }
+
+    @Test
+    public void writeToParcel() {
+        int specificationId = 1;
+        int vendorId = 1;
+        int vendorIdSource = 1;
+        int productId = 1;
+        int version = 1;
+        boolean primaryRecord = true;
+
+        SdpDipRecord originalRecord = new SdpDipRecord(
+                specificationId,
+                vendorId,
+                vendorIdSource,
+                productId,
+                version,
+                primaryRecord
+        );
+
+        Parcel parcel = Parcel.obtain();
+        originalRecord.writeToParcel(parcel, 0);
+        parcel.setDataPosition(0);
+
+        SdpDipRecord recordOut = (SdpDipRecord) SdpDipRecord.CREATOR.createFromParcel(parcel);
+        parcel.recycle();
+
+        assertThat(recordOut.getSpecificationId())
+                .isEqualTo(originalRecord.getSpecificationId());
+        assertThat(recordOut.getVendorId())
+                .isEqualTo(originalRecord.getVendorId());
+        assertThat(recordOut.getVendorIdSource())
+                .isEqualTo(originalRecord.getVendorIdSource());
+        assertThat(recordOut.getProductId())
+                .isEqualTo(originalRecord.getProductId());
+        assertThat(recordOut.getVersion())
+                .isEqualTo(originalRecord.getVersion());
+        assertThat(recordOut.getPrimaryRecord())
+                .isEqualTo(originalRecord.getPrimaryRecord());
+    }
+}
diff --git a/framework/tests/unit/src/android/bluetooth/SdpMasRecordTest.java b/framework/tests/unit/src/android/bluetooth/SdpMasRecordTest.java
new file mode 100644
index 0000000..724ab7d
--- /dev/null
+++ b/framework/tests/unit/src/android/bluetooth/SdpMasRecordTest.java
@@ -0,0 +1,140 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.bluetooth;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import android.os.Parcel;
+
+import androidx.test.filters.SmallTest;
+import androidx.test.runner.AndroidJUnit4;
+
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+/**
+ * Test cases for {@link SdpMasRecord}.
+ */
+@SmallTest
+@RunWith(AndroidJUnit4.class)
+public class SdpMasRecordTest {
+
+    @Test
+    public void createSdpMasRecord() {
+        int masInstanceId = 1;
+        int l2capPsm = 1;
+        int rfcommChannelNumber = 1;
+        int profileVersion = 1;
+        int supportedFeatures = 1;
+        int supportedMessageTypes = 1;
+        String serviceName = "MasRecord";
+
+        SdpMasRecord record = new SdpMasRecord(
+                masInstanceId,
+                l2capPsm,
+                rfcommChannelNumber,
+                profileVersion,
+                supportedFeatures,
+                supportedMessageTypes,
+                serviceName
+        );
+
+        assertThat(record.getMasInstanceId()).isEqualTo(masInstanceId);
+        assertThat(record.getL2capPsm()).isEqualTo(l2capPsm);
+        assertThat(record.getRfcommCannelNumber()).isEqualTo(rfcommChannelNumber);
+        assertThat(record.getProfileVersion()).isEqualTo(profileVersion);
+        assertThat(record.getSupportedFeatures()).isEqualTo(supportedFeatures);
+        assertThat(record.getSupportedMessageTypes()).isEqualTo(supportedMessageTypes);
+        assertThat(record.getServiceName()).isEqualTo(serviceName);
+    }
+
+    @Test
+    public void writeToParcel() {
+        int masInstanceId = 1;
+        int l2capPsm = 1;
+        int rfcommChannelNumber = 1;
+        int profileVersion = 1;
+        int supportedFeatures = 1;
+        int supportedMessageTypes = 1;
+        String serviceName = "MasRecord";
+
+        SdpMasRecord originalRecord = new SdpMasRecord(
+                masInstanceId,
+                l2capPsm,
+                rfcommChannelNumber,
+                profileVersion,
+                supportedFeatures,
+                supportedMessageTypes,
+                serviceName
+        );
+
+        Parcel parcel = Parcel.obtain();
+        originalRecord.writeToParcel(parcel, 0);
+        parcel.setDataPosition(0);
+
+        SdpMasRecord recordOut = (SdpMasRecord) SdpMasRecord.CREATOR.createFromParcel(parcel);
+        parcel.recycle();
+
+        assertThat(recordOut.getMasInstanceId())
+                .isEqualTo(originalRecord.getMasInstanceId());
+        assertThat(recordOut.getL2capPsm())
+                .isEqualTo(originalRecord.getL2capPsm());
+        assertThat(recordOut.getRfcommCannelNumber())
+                .isEqualTo(originalRecord.getRfcommCannelNumber());
+        assertThat(recordOut.getProfileVersion())
+                .isEqualTo(originalRecord.getProfileVersion());
+        assertThat(recordOut.getSupportedFeatures())
+                .isEqualTo(originalRecord.getSupportedFeatures());
+        assertThat(recordOut.getSupportedMessageTypes())
+                .isEqualTo(originalRecord.getSupportedMessageTypes());
+        assertThat(recordOut.getServiceName())
+                .isEqualTo(originalRecord.getServiceName());
+    }
+
+    @Test
+    public void sdpMasRecordToString() {
+        int masInstanceId = 1;
+        int l2capPsm = 1;
+        int rfcommChannelNumber = 1;
+        int profileVersion = 1;
+        int supportedFeatures = 1;
+        int supportedMessageTypes = 1;
+        String serviceName = "MasRecord";
+
+        SdpMasRecord record = new SdpMasRecord(
+                masInstanceId,
+                l2capPsm,
+                rfcommChannelNumber,
+                profileVersion,
+                supportedFeatures,
+                supportedMessageTypes,
+                serviceName
+        );
+
+        String sdpMasRecordString = record.toString();
+        String expectedToString = "Bluetooth MAS SDP Record:\n"
+                + "Mas Instance Id: " + masInstanceId + "\n"
+                + "RFCOMM Chan Number: " + l2capPsm + "\n"
+                + "L2CAP PSM: " + rfcommChannelNumber + "\n"
+                + "Service Name: " + serviceName + "\n"
+                + "Profile version: " + profileVersion + "\n"
+                + "Supported msg types: " + supportedMessageTypes + "\n"
+                + "Supported features: " + supportedFeatures + "\n";
+
+        assertThat(sdpMasRecordString).isEqualTo(expectedToString);
+    }
+}
diff --git a/framework/tests/unit/src/android/bluetooth/SdpMnsRecordTest.java b/framework/tests/unit/src/android/bluetooth/SdpMnsRecordTest.java
new file mode 100644
index 0000000..d5e1136
--- /dev/null
+++ b/framework/tests/unit/src/android/bluetooth/SdpMnsRecordTest.java
@@ -0,0 +1,120 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.bluetooth;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import android.os.Parcel;
+
+import androidx.test.filters.SmallTest;
+import androidx.test.runner.AndroidJUnit4;
+
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+/**
+ * Test cases for {@link SdpMnsRecord}.
+ */
+@SmallTest
+@RunWith(AndroidJUnit4.class)
+public class SdpMnsRecordTest {
+
+    @Test
+    public void createSdpMnsRecord() {
+        int l2capPsm = 1;
+        int rfcommChannelNumber = 1;
+        int profileVersion = 1;
+        int supportedFeatures = 1;
+        String serviceName = "MnsRecord";
+
+        SdpMnsRecord record = new SdpMnsRecord(
+                l2capPsm,
+                rfcommChannelNumber,
+                profileVersion,
+                supportedFeatures,
+                serviceName
+        );
+
+        assertThat(record.getL2capPsm()).isEqualTo(l2capPsm);
+        assertThat(record.getRfcommChannelNumber()).isEqualTo(rfcommChannelNumber);
+        assertThat(record.getProfileVersion()).isEqualTo(profileVersion);
+        assertThat(record.getSupportedFeatures()).isEqualTo(supportedFeatures);
+        assertThat(record.getServiceName()).isEqualTo(serviceName);
+    }
+
+    @Test
+    public void writeToParcel() {
+        int l2capPsm = 1;
+        int rfcommChannelNumber = 1;
+        int profileVersion = 1;
+        int supportedFeatures = 1;
+        String serviceName = "MnsRecord";
+
+        SdpMnsRecord originalRecord = new SdpMnsRecord(
+                l2capPsm,
+                rfcommChannelNumber,
+                profileVersion,
+                supportedFeatures,
+                serviceName
+        );
+
+        Parcel parcel = Parcel.obtain();
+        originalRecord.writeToParcel(parcel, 0);
+        parcel.setDataPosition(0);
+
+        SdpMnsRecord recordOut = (SdpMnsRecord) SdpMnsRecord.CREATOR.createFromParcel(parcel);
+        parcel.recycle();
+
+        assertThat(recordOut.getL2capPsm())
+                .isEqualTo(originalRecord.getL2capPsm());
+        assertThat(recordOut.getRfcommChannelNumber())
+                .isEqualTo(originalRecord.getRfcommChannelNumber());
+        assertThat(recordOut.getProfileVersion())
+                .isEqualTo(originalRecord.getProfileVersion());
+        assertThat(recordOut.getSupportedFeatures())
+                .isEqualTo(originalRecord.getSupportedFeatures());
+        assertThat(recordOut.getServiceName())
+                .isEqualTo(originalRecord.getServiceName());
+    }
+
+    @Test
+    public void sdpMnsRecordToString() {
+        int l2capPsm = 1;
+        int rfcommChannelNumber = 1;
+        int profileVersion = 1;
+        int supportedFeatures = 1;
+        String serviceName = "MnsRecord";
+
+        SdpMnsRecord record = new SdpMnsRecord(
+                l2capPsm,
+                rfcommChannelNumber,
+                profileVersion,
+                supportedFeatures,
+                serviceName
+        );
+
+        String sdpMnsRecordString = record.toString();
+        String expectedToString = "Bluetooth MNS SDP Record:\n"
+                + "RFCOMM Chan Number: " + rfcommChannelNumber + "\n"
+                + "L2CAP PSM: " + l2capPsm + "\n"
+                + "Service Name: " + serviceName + "\n"
+                + "Supported features: " + supportedFeatures + "\n"
+                + "Profile_version: " + profileVersion + "\n";
+
+        assertThat(sdpMnsRecordString).isEqualTo(expectedToString);
+    }
+}
diff --git a/framework/tests/unit/src/android/bluetooth/SdpOppOpsRecordTest.java b/framework/tests/unit/src/android/bluetooth/SdpOppOpsRecordTest.java
new file mode 100644
index 0000000..521133c
--- /dev/null
+++ b/framework/tests/unit/src/android/bluetooth/SdpOppOpsRecordTest.java
@@ -0,0 +1,125 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.bluetooth;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import android.os.Parcel;
+
+import androidx.test.filters.SmallTest;
+import androidx.test.runner.AndroidJUnit4;
+
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+import java.util.Arrays;
+
+/**
+ * Test cases for {@link SdpOppOpsRecord}.
+ */
+@SmallTest
+@RunWith(AndroidJUnit4.class)
+public class SdpOppOpsRecordTest {
+
+    @Test
+    public void createSdpOppOpsRecord() {
+        String serviceName = "OppOpsRecord";
+        int rfcommChannel = 1;
+        int l2capPsm = 1;
+        int version = 1;
+        byte[] formatsList = new byte[]{0x01};
+
+        SdpOppOpsRecord record = new SdpOppOpsRecord(
+                serviceName,
+                rfcommChannel,
+                l2capPsm,
+                version,
+                formatsList
+        );
+
+        assertThat(record.getServiceName()).isEqualTo(serviceName);
+        assertThat(record.getRfcommChannel()).isEqualTo(rfcommChannel);
+        assertThat(record.getL2capPsm()).isEqualTo(l2capPsm);
+        assertThat(record.getProfileVersion()).isEqualTo(version);
+        assertThat(record.getFormatsList()).isEqualTo(formatsList);
+    }
+
+    @Test
+    public void writeToParcel() {
+        String serviceName = "OppOpsRecord";
+        int rfcommChannel = 1;
+        int l2capPsm = 1;
+        int version = 1;
+        byte[] formatsList = new byte[]{0x01};
+
+        SdpOppOpsRecord originalRecord = new SdpOppOpsRecord(
+                serviceName,
+                rfcommChannel,
+                l2capPsm,
+                version,
+                formatsList
+        );
+
+        Parcel parcel = Parcel.obtain();
+        originalRecord.writeToParcel(parcel, 0);
+        parcel.setDataPosition(0);
+
+        SdpOppOpsRecord recordOut =
+                (SdpOppOpsRecord) SdpOppOpsRecord.CREATOR.createFromParcel(parcel);
+        parcel.recycle();
+
+        assertThat(recordOut.getServiceName())
+                .isEqualTo(originalRecord.getServiceName());
+        assertThat(recordOut.getRfcommChannel())
+                .isEqualTo(originalRecord.getRfcommChannel());
+        assertThat(recordOut.getL2capPsm())
+                .isEqualTo(originalRecord.getL2capPsm());
+        assertThat(recordOut.getProfileVersion())
+                .isEqualTo(originalRecord.getProfileVersion());
+        assertThat(recordOut.getProfileVersion())
+                .isEqualTo(originalRecord.getProfileVersion());
+        assertThat(recordOut.getFormatsList())
+                .isEqualTo(originalRecord.getFormatsList());
+    }
+
+    @Test
+    public void sdpOppOpsRecordToString() {
+        String serviceName = "OppOpsRecord";
+        int rfcommChannel = 1;
+        int l2capPsm = 1;
+        int version = 1;
+        byte[] formatsList = new byte[]{0x01};
+
+        SdpOppOpsRecord record = new SdpOppOpsRecord(
+                serviceName,
+                rfcommChannel,
+                l2capPsm,
+                version,
+                formatsList
+        );
+
+        String sdpOppOpsRecordString = record.toString();
+        String expectedToString = "Bluetooth OPP Server SDP Record:\n"
+                + "  RFCOMM Chan Number: " + rfcommChannel + "\n"
+                + "  L2CAP PSM: " + l2capPsm + "\n"
+                + "  Profile version: " + version + "\n"
+                + "  Service Name: " + serviceName + "\n"
+                + "  Formats List: " + Arrays.toString(formatsList);
+
+        assertThat(sdpOppOpsRecordString).isEqualTo(expectedToString);
+    }
+}
diff --git a/framework/tests/unit/src/android/bluetooth/SdpPseRecordTest.java b/framework/tests/unit/src/android/bluetooth/SdpPseRecordTest.java
new file mode 100644
index 0000000..0332d4a
--- /dev/null
+++ b/framework/tests/unit/src/android/bluetooth/SdpPseRecordTest.java
@@ -0,0 +1,130 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.bluetooth;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import android.os.Parcel;
+
+import androidx.test.filters.SmallTest;
+import androidx.test.runner.AndroidJUnit4;
+
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+/**
+ * Test cases for {@link SdpPseRecord}.
+ */
+@SmallTest
+@RunWith(AndroidJUnit4.class)
+public class SdpPseRecordTest {
+
+    @Test
+    public void createSdpPseRecord() {
+        int l2capPsm = 1;
+        int rfcommChannelNumber = 1;
+        int profileVersion = 1;
+        int supportedFeatures = 1;
+        int supportedRepositories = 1;
+        String serviceName = "PseRecord";
+
+        SdpPseRecord record = new SdpPseRecord(
+                l2capPsm,
+                rfcommChannelNumber,
+                profileVersion,
+                supportedFeatures,
+                supportedRepositories,
+                serviceName
+        );
+
+        assertThat(record.getL2capPsm()).isEqualTo(l2capPsm);
+        assertThat(record.getRfcommChannelNumber()).isEqualTo(rfcommChannelNumber);
+        assertThat(record.getProfileVersion()).isEqualTo(profileVersion);
+        assertThat(record.getSupportedFeatures()).isEqualTo(supportedFeatures);
+        assertThat(record.getSupportedRepositories()).isEqualTo(supportedRepositories);
+        assertThat(record.getServiceName()).isEqualTo(serviceName);
+    }
+
+    @Test
+    public void writeToParcel() {
+        int l2capPsm = 1;
+        int rfcommChannelNumber = 1;
+        int profileVersion = 1;
+        int supportedFeatures = 1;
+        int supportedRepositories = 1;
+        String serviceName = "PseRecord";
+
+        SdpPseRecord originalRecord = new SdpPseRecord(
+                l2capPsm,
+                rfcommChannelNumber,
+                profileVersion,
+                supportedFeatures,
+                supportedRepositories,
+                serviceName
+        );
+
+        Parcel parcel = Parcel.obtain();
+        originalRecord.writeToParcel(parcel, 0);
+        parcel.setDataPosition(0);
+
+        SdpPseRecord recordOut = (SdpPseRecord) SdpPseRecord.CREATOR.createFromParcel(parcel);
+        parcel.recycle();
+
+        assertThat(recordOut.getL2capPsm())
+                .isEqualTo(originalRecord.getL2capPsm());
+        assertThat(recordOut.getRfcommChannelNumber())
+                .isEqualTo(originalRecord.getRfcommChannelNumber());
+        assertThat(recordOut.getProfileVersion())
+                .isEqualTo(originalRecord.getProfileVersion());
+        assertThat(recordOut.getSupportedFeatures())
+                .isEqualTo(originalRecord.getSupportedFeatures());
+        assertThat(recordOut.getSupportedRepositories())
+                .isEqualTo(originalRecord.getSupportedRepositories());
+        assertThat(recordOut.getServiceName())
+                .isEqualTo(originalRecord.getServiceName());
+    }
+
+    @Test
+    public void sdpPseRecordToString() {
+        int l2capPsm = 1;
+        int rfcommChannelNumber = 1;
+        int profileVersion = 1;
+        int supportedFeatures = 1;
+        int supportedRepositories = 1;
+        String serviceName = "PseRecord";
+
+        SdpPseRecord record = new SdpPseRecord(
+                l2capPsm,
+                rfcommChannelNumber,
+                profileVersion,
+                supportedFeatures,
+                supportedRepositories,
+                serviceName
+        );
+
+        String sdpPseRecordString = record.toString();
+        String expectedToString = "Bluetooth MNS SDP Record:\n"
+                + "RFCOMM Chan Number: " + rfcommChannelNumber + "\n"
+                + "L2CAP PSM: " + l2capPsm + "\n"
+                + "profile version: " + profileVersion + "\n"
+                + "Service Name: " + serviceName + "\n"
+                + "Supported features: " + supportedFeatures + "\n"
+                + "Supported repositories: " + supportedRepositories + "\n";
+
+        assertThat(sdpPseRecordString).isEqualTo(expectedToString);
+    }
+}
diff --git a/framework/tests/unit/src/android/bluetooth/SdpRecordTest.java b/framework/tests/unit/src/android/bluetooth/SdpRecordTest.java
new file mode 100644
index 0000000..95a804e
--- /dev/null
+++ b/framework/tests/unit/src/android/bluetooth/SdpRecordTest.java
@@ -0,0 +1,91 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.bluetooth;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import android.os.Parcel;
+
+import androidx.test.filters.SmallTest;
+import androidx.test.runner.AndroidJUnit4;
+
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+import java.util.Arrays;
+
+/**
+ * Test cases for {@link SdpRecord}.
+ */
+@SmallTest
+@RunWith(AndroidJUnit4.class)
+public class SdpRecordTest {
+
+    @Test
+    public void createSdpRecord() {
+        int rawSize = 1;
+        byte[] rawData = new byte[]{0x1};
+
+        SdpRecord record = new SdpRecord(
+                rawSize,
+                rawData
+        );
+
+        assertThat(record.getRawSize()).isEqualTo(rawSize);
+        assertThat(record.getRawData()).isEqualTo(rawData);
+    }
+
+    @Test
+    public void writeToParcel() {
+        int rawSize = 1;
+        byte[] rawData = new byte[]{0x1};
+
+        SdpRecord originalRecord = new SdpRecord(
+                rawSize,
+                rawData
+        );
+
+        Parcel parcel = Parcel.obtain();
+        originalRecord.writeToParcel(parcel, 0);
+        parcel.setDataPosition(0);
+
+        SdpRecord recordOut = (SdpRecord) SdpRecord.CREATOR.createFromParcel(parcel);
+        parcel.recycle();
+
+        assertThat(recordOut.getRawSize())
+                .isEqualTo(originalRecord.getRawSize());
+        assertThat(recordOut.getRawData())
+                .isEqualTo(originalRecord.getRawData());
+    }
+
+    @Test
+    public void sdpRecordToString() {
+        int rawSize = 1;
+        byte[] rawData = new byte[]{0x1};
+
+        SdpRecord record = new SdpRecord(
+                rawSize,
+                rawData
+        );
+
+        String sdpRecordString = record.toString();
+        String expectedToString = "BluetoothSdpRecord [rawData=" + Arrays.toString(rawData)
+                + ", rawSize=" + rawSize + "]";
+
+        assertThat(sdpRecordString).isEqualTo(expectedToString);
+    }
+}
diff --git a/framework/tests/unit/src/android/bluetooth/SdpSapsRecordTest.java b/framework/tests/unit/src/android/bluetooth/SdpSapsRecordTest.java
new file mode 100644
index 0000000..cdca38c
--- /dev/null
+++ b/framework/tests/unit/src/android/bluetooth/SdpSapsRecordTest.java
@@ -0,0 +1,100 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.bluetooth;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import android.os.Parcel;
+
+import androidx.test.filters.SmallTest;
+import androidx.test.runner.AndroidJUnit4;
+
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+/**
+ * Test cases for {@link SdpSapsRecord}.
+ */
+@SmallTest
+@RunWith(AndroidJUnit4.class)
+public class SdpSapsRecordTest {
+
+    @Test
+    public void createSdpSapsRecord() {
+        int rfcommChannelNumber = 1;
+        int profileVersion = 1;
+        String serviceName = "SdpSapsRecord";
+
+        SdpSapsRecord record = new SdpSapsRecord(
+                rfcommChannelNumber,
+                profileVersion,
+                serviceName
+        );
+
+        assertThat(record.getRfcommCannelNumber()).isEqualTo(rfcommChannelNumber);
+        assertThat(record.getProfileVersion()).isEqualTo(profileVersion);
+        assertThat(record.getServiceName()).isEqualTo(serviceName);
+    }
+
+    @Test
+    public void writeToParcel() {
+        int rfcommChannelNumber = 1;
+        int profileVersion = 1;
+        String serviceName = "SdpSapsRecord";
+
+        SdpSapsRecord originalRecord = new SdpSapsRecord(
+                rfcommChannelNumber,
+                profileVersion,
+                serviceName
+        );
+
+        Parcel parcel = Parcel.obtain();
+        originalRecord.writeToParcel(parcel, 0);
+        parcel.setDataPosition(0);
+
+        SdpSapsRecord recordOut = (SdpSapsRecord) SdpSapsRecord.CREATOR.createFromParcel(parcel);
+        parcel.recycle();
+
+        assertThat(recordOut.getRfcommCannelNumber())
+                .isEqualTo(originalRecord.getRfcommCannelNumber());
+        assertThat(recordOut.getProfileVersion())
+                .isEqualTo(originalRecord.getProfileVersion());
+        assertThat(recordOut.getServiceName())
+                .isEqualTo(originalRecord.getServiceName());
+    }
+
+    @Test
+    public void sdpSapsRecordToString() {
+        int rfcommChannelNumber = 1;
+        int profileVersion = 1;
+        String serviceName = "SdpSapsRecord";
+
+        SdpSapsRecord record = new SdpSapsRecord(
+                rfcommChannelNumber,
+                profileVersion,
+                serviceName
+        );
+
+        String sdpSapsRecordString = record.toString();
+        String expectedToString = "Bluetooth MAS SDP Record:\n"
+                + "RFCOMM Chan Number: " + rfcommChannelNumber + "\n"
+                + "Service Name: " + serviceName + "\n"
+                + "Profile version: " + profileVersion + "\n";
+
+        assertThat(sdpSapsRecordString).isEqualTo(expectedToString);
+    }
+}
diff --git a/framework/tests/unit/src/android/bluetooth/le/ScanRecordTest.java b/framework/tests/unit/src/android/bluetooth/le/ScanRecordTest.java
new file mode 100644
index 0000000..b37f805
--- /dev/null
+++ b/framework/tests/unit/src/android/bluetooth/le/ScanRecordTest.java
@@ -0,0 +1,175 @@
+/*
+ * Copyright (C) 2014 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.bluetooth.le;
+
+import android.os.ParcelUuid;
+import android.test.suitebuilder.annotation.SmallTest;
+
+import com.android.internal.util.HexDump;
+import com.android.modules.utils.BytesMatcher;
+
+import junit.framework.TestCase;
+
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.List;
+import java.util.function.Predicate;
+
+/**
+ * Unit test cases for {@link ScanRecord}.
+ * <p>
+ * To run this test, use adb shell am instrument -e class 'android.bluetooth.ScanRecordTest' -w
+ * 'com.android.bluetooth.tests/android.bluetooth.BluetoothTestRunner'
+ */
+public class ScanRecordTest extends TestCase {
+    /**
+     * Example raw beacons captured from a Blue Charm BC011
+     */
+    private static final String RECORD_URL =
+            "0201060303AAFE1716AAFE10EE01626C7565636861726D626561636F6E730"
+            + "009168020691E0EFE13551109426C7565436861726D5F313639363835000000";
+    private static final String RECORD_UUID =
+            "0201060303AAFE1716AAFE00EE626C7565636861726D3100000000000100000"
+            + "9168020691E0EFE13551109426C7565436861726D5F313639363835000000";
+    private static final String RECORD_TLM =
+            "0201060303AAFE1116AAFE20000BF017000008874803FB93540916802069080"
+            + "EFE13551109426C7565436861726D5F313639363835000000000000000000";
+    private static final String RECORD_IBEACON =
+            "0201061AFF4C000215426C7565436861726D426561636F6E730EFE1355C5091"
+            + "68020691E0EFE13551109426C7565436861726D5F31363936383500000000";
+
+    /**
+     * Example Eddystone E2EE-EID beacon from design doc
+     */
+    private static final String RECORD_E2EE_EID =
+            "0201061816AAFE400000000000000000000000000000000000000000";
+
+    @SmallTest
+    public void testMatchesAnyField_Eddystone_Parser() {
+        final List<String> found = new ArrayList<>();
+        final Predicate<byte[]> matcher = (v) -> {
+            found.add(HexDump.toHexString(v));
+            return false;
+        };
+        ScanRecord.parseFromBytes(HexDump.hexStringToByteArray(RECORD_URL))
+                .matchesAnyField(matcher);
+
+        assertEquals(Arrays.asList(
+                "020106",
+                "0303AAFE",
+                "1716AAFE10EE01626C7565636861726D626561636F6E7300",
+                "09168020691E0EFE1355",
+                "1109426C7565436861726D5F313639363835"), found);
+    }
+
+    @SmallTest
+    public void testMatchesAnyField_Eddystone() {
+        final BytesMatcher matcher = BytesMatcher.decode("⊆0016AAFE/00FFFFFF");
+        assertMatchesAnyField(RECORD_URL, matcher);
+        assertMatchesAnyField(RECORD_UUID, matcher);
+        assertMatchesAnyField(RECORD_TLM, matcher);
+        assertMatchesAnyField(RECORD_E2EE_EID, matcher);
+        assertNotMatchesAnyField(RECORD_IBEACON, matcher);
+    }
+
+    @SmallTest
+    public void testMatchesAnyField_Eddystone_ExceptE2eeEid() {
+        final BytesMatcher matcher = BytesMatcher
+                .decode("⊈0016AAFE40/00FFFFFFFF,⊆0016AAFE/00FFFFFF");
+        assertMatchesAnyField(RECORD_URL, matcher);
+        assertMatchesAnyField(RECORD_UUID, matcher);
+        assertMatchesAnyField(RECORD_TLM, matcher);
+        assertNotMatchesAnyField(RECORD_E2EE_EID, matcher);
+        assertNotMatchesAnyField(RECORD_IBEACON, matcher);
+    }
+
+    @SmallTest
+    public void testMatchesAnyField_iBeacon_Parser() {
+        final List<String> found = new ArrayList<>();
+        final Predicate<byte[]> matcher = (v) -> {
+            found.add(HexDump.toHexString(v));
+            return false;
+        };
+        ScanRecord.parseFromBytes(HexDump.hexStringToByteArray(RECORD_IBEACON))
+                .matchesAnyField(matcher);
+
+        assertEquals(Arrays.asList(
+                "020106",
+                "1AFF4C000215426C7565436861726D426561636F6E730EFE1355C5",
+                "09168020691E0EFE1355",
+                "1109426C7565436861726D5F313639363835"), found);
+    }
+
+    @SmallTest
+    public void testMatchesAnyField_iBeacon() {
+        final BytesMatcher matcher = BytesMatcher.decode("⊆00FF4C0002/00FFFFFFFF");
+        assertNotMatchesAnyField(RECORD_URL, matcher);
+        assertNotMatchesAnyField(RECORD_UUID, matcher);
+        assertNotMatchesAnyField(RECORD_TLM, matcher);
+        assertNotMatchesAnyField(RECORD_E2EE_EID, matcher);
+        assertMatchesAnyField(RECORD_IBEACON, matcher);
+    }
+
+    @SmallTest
+    public void testParser() {
+        byte[] scanRecord = new byte[] {
+                0x02, 0x01, 0x1a, // advertising flags
+                0x05, 0x02, 0x0b, 0x11, 0x0a, 0x11, // 16 bit service uuids
+                0x04, 0x09, 0x50, 0x65, 0x64, // name
+                0x02, 0x0A, (byte) 0xec, // tx power level
+                0x05, 0x16, 0x0b, 0x11, 0x50, 0x64, // service data
+                0x05, (byte) 0xff, (byte) 0xe0, 0x00, 0x02, 0x15, // manufacturer specific data
+                0x03, 0x50, 0x01, 0x02, // an unknown data type won't cause trouble
+        };
+        ScanRecord data = ScanRecord.parseFromBytes(scanRecord);
+        assertEquals(0x1a, data.getAdvertiseFlags());
+        ParcelUuid uuid1 = ParcelUuid.fromString("0000110A-0000-1000-8000-00805F9B34FB");
+        ParcelUuid uuid2 = ParcelUuid.fromString("0000110B-0000-1000-8000-00805F9B34FB");
+        assertTrue(data.getServiceUuids().contains(uuid1));
+        assertTrue(data.getServiceUuids().contains(uuid2));
+
+        assertEquals("Ped", data.getDeviceName());
+        assertEquals(-20, data.getTxPowerLevel());
+
+        assertTrue(data.getManufacturerSpecificData().get(0x00E0) != null);
+        assertArrayEquals(new byte[] {
+                0x02, 0x15 }, data.getManufacturerSpecificData().get(0x00E0));
+
+        assertTrue(data.getServiceData().containsKey(uuid2));
+        assertArrayEquals(new byte[] {
+                0x50, 0x64 }, data.getServiceData().get(uuid2));
+    }
+
+    // Assert two byte arrays are equal.
+    private static void assertArrayEquals(byte[] expected, byte[] actual) {
+        if (!Arrays.equals(expected, actual)) {
+            fail("expected:<" + Arrays.toString(expected)
+                    + "> but was:<" + Arrays.toString(actual) + ">");
+        }
+
+    }
+
+    private static void assertMatchesAnyField(String record, BytesMatcher matcher) {
+        assertTrue(ScanRecord.parseFromBytes(HexDump.hexStringToByteArray(record))
+                .matchesAnyField(matcher));
+    }
+
+    private static void assertNotMatchesAnyField(String record, BytesMatcher matcher) {
+        assertFalse(ScanRecord.parseFromBytes(HexDump.hexStringToByteArray(record))
+                .matchesAnyField(matcher));
+    }
+}
diff --git a/framework/tests/unit/src/android/bluetooth/le/ScanSettingsTest.java b/framework/tests/unit/src/android/bluetooth/le/ScanSettingsTest.java
new file mode 100644
index 0000000..180c3be
--- /dev/null
+++ b/framework/tests/unit/src/android/bluetooth/le/ScanSettingsTest.java
@@ -0,0 +1,64 @@
+/*
+ * Copyright (C) 2014 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.bluetooth.le;
+
+import android.test.suitebuilder.annotation.SmallTest;
+
+import junit.framework.TestCase;
+
+/**
+ * Test for Bluetooth LE {@link ScanSettings}.
+ */
+public class ScanSettingsTest extends TestCase {
+
+    @SmallTest
+    public void testCallbackType() {
+        ScanSettings.Builder builder = new ScanSettings.Builder();
+        builder.setCallbackType(ScanSettings.CALLBACK_TYPE_ALL_MATCHES);
+        builder.setCallbackType(ScanSettings.CALLBACK_TYPE_FIRST_MATCH);
+        builder.setCallbackType(ScanSettings.CALLBACK_TYPE_MATCH_LOST);
+        builder.setCallbackType(
+                ScanSettings.CALLBACK_TYPE_FIRST_MATCH | ScanSettings.CALLBACK_TYPE_MATCH_LOST);
+        try {
+            builder.setCallbackType(
+                    ScanSettings.CALLBACK_TYPE_ALL_MATCHES | ScanSettings.CALLBACK_TYPE_MATCH_LOST);
+            fail("should have thrown IllegalArgumentException!");
+        } catch (IllegalArgumentException e) {
+            // nothing to do
+        }
+
+        try {
+            builder.setCallbackType(
+                    ScanSettings.CALLBACK_TYPE_ALL_MATCHES
+                    | ScanSettings.CALLBACK_TYPE_FIRST_MATCH);
+            fail("should have thrown IllegalArgumentException!");
+        } catch (IllegalArgumentException e) {
+            // nothing to do
+        }
+
+        try {
+            builder.setCallbackType(
+                    ScanSettings.CALLBACK_TYPE_ALL_MATCHES
+                    | ScanSettings.CALLBACK_TYPE_FIRST_MATCH
+                    | ScanSettings.CALLBACK_TYPE_MATCH_LOST);
+            fail("should have thrown IllegalArgumentException!");
+        } catch (IllegalArgumentException e) {
+            // nothing to do
+        }
+
+    }
+}
diff --git a/android/blueberry/OWNERS b/pandora/OWNERS
similarity index 100%
copy from android/blueberry/OWNERS
copy to pandora/OWNERS
diff --git a/pandora/interfaces/Android.bp b/pandora/interfaces/Android.bp
new file mode 100644
index 0000000..d83f217
--- /dev/null
+++ b/pandora/interfaces/Android.bp
@@ -0,0 +1,113 @@
+package {
+    default_applicable_licenses: ["Android-Apache-2.0"],
+}
+
+java_library {
+    name: "pandora_experimental-grpc-java",
+    visibility: ["//packages/modules/Bluetooth/android/pandora/server"],
+    srcs: [
+        "pandora_experimental/*.proto",
+    ],
+    static_libs: [
+        "grpc-java-lite",
+        "guava",
+        "javax_annotation-api_1.3.2",
+        "libprotobuf-java-lite",
+        "opencensus-java-api",
+        "pandora_experimental-proto-java",
+    ],
+    proto: {
+        include_dirs: [
+            "external/protobuf/src",
+            "packages/modules/Bluetooth/pandora/interfaces",
+        ],
+        plugin: "grpc-java-plugin",
+        output_params: [
+           "lite",
+        ],
+    },
+}
+
+java_library {
+    name: "pandora_experimental-proto-java",
+    visibility: ["//packages/modules/Bluetooth/android/pandora/server"],
+    srcs: [
+        "pandora_experimental/*.proto",
+        ":libprotobuf-internal-protos",
+    ],
+    static_libs: [
+        "libprotobuf-java-lite",
+    ],
+    proto: {
+        // Disable canonical path as this breaks the identification of
+        // well known protobufs
+        canonical_path_from_root: false,
+        type: "lite",
+        include_dirs: [
+            "external/protobuf/src",
+            "packages/modules/Bluetooth/pandora/interfaces",
+        ],
+    },
+}
+
+genrule {
+    name: "pandora_experimental-python-src",
+    tools: [
+        "aprotoc",
+        "protoc-gen-mmi2grpc-python"
+    ],
+    cmd: "$(location aprotoc)" +
+         "    -Ipackages/modules/Bluetooth/pandora/interfaces" +
+         "    -Iexternal/protobuf/src" +
+         "    --plugin=protoc-gen-grpc=$(location protoc-gen-mmi2grpc-python)" +
+         "    --grpc_out=$(genDir)" +
+         "    --python_out=$(genDir)" +
+         "    $(in)",
+    srcs: [
+        "pandora_experimental/_android.proto",
+        "pandora_experimental/a2dp.proto",
+        "pandora_experimental/avrcp.proto",
+        "pandora_experimental/gatt.proto",
+        "pandora_experimental/hfp.proto",
+        "pandora_experimental/hid.proto",
+        "pandora_experimental/host.proto",
+        "pandora_experimental/l2cap.proto",
+        "pandora_experimental/mediaplayer.proto",
+        "pandora_experimental/pbap.proto",
+        "pandora_experimental/rfcomm.proto",
+        "pandora_experimental/security.proto",
+    ],
+    out: [
+        "pandora_experimental/_android_grpc.py",
+        "pandora_experimental/_android_pb2.py",
+        "pandora_experimental/a2dp_grpc.py",
+        "pandora_experimental/a2dp_pb2.py",
+        "pandora_experimental/avrcp_grpc.py",
+        "pandora_experimental/avrcp_pb2.py",
+        "pandora_experimental/gatt_grpc.py",
+        "pandora_experimental/gatt_pb2.py",
+        "pandora_experimental/hfp_grpc.py",
+        "pandora_experimental/hfp_pb2.py",
+        "pandora_experimental/hid_grpc.py",
+        "pandora_experimental/hid_pb2.py",
+        "pandora_experimental/host_grpc.py",
+        "pandora_experimental/host_pb2.py",
+        "pandora_experimental/l2cap_grpc.py",
+        "pandora_experimental/l2cap_pb2.py",
+        "pandora_experimental/mediaplayer_grpc.py",
+        "pandora_experimental/mediaplayer_pb2.py",
+        "pandora_experimental/pbap_grpc.py",
+        "pandora_experimental/pbap_pb2.py",
+        "pandora_experimental/rfcomm_grpc.py",
+        "pandora_experimental/rfcomm_pb2.py",
+        "pandora_experimental/security_grpc.py",
+        "pandora_experimental/security_pb2.py",
+    ]
+}
+
+python_library_host {
+    name: "pandora_experimental-python",
+    srcs: [
+        ":pandora_experimental-python-src",
+    ],
+}
diff --git a/pandora/interfaces/pandora_experimental/_android.proto b/pandora/interfaces/pandora_experimental/_android.proto
new file mode 100644
index 0000000..cda445e
--- /dev/null
+++ b/pandora/interfaces/pandora_experimental/_android.proto
@@ -0,0 +1,49 @@
+syntax = "proto3";
+
+option java_outer_classname = "AndroidProto";
+
+package pandora;
+
+import "google/protobuf/empty.proto";
+
+// This file contains Android-specific protos and rpcs that should not be part
+// of the general interface. They should not be invoked from MMIs directly since
+// this will couple them too tightly with Android.
+
+// Service for Android-specific operations.
+service Android {
+  // Log text (for utility only)
+  rpc Log(LogRequest) returns (LogResponse);
+  // Set Message, PhoneBook and SIM access permission
+  rpc SetAccessPermission(SetAccessPermissionRequest) returns (google.protobuf.Empty);
+  // Send SMS
+  rpc SendSMS(google.protobuf.Empty) returns (google.protobuf.Empty);
+  // Accept incoming file
+  rpc AcceptIncomingFile(google.protobuf.Empty) returns (google.protobuf.Empty);
+}
+
+message LogRequest {
+  string text = 1;
+}
+
+message LogResponse {}
+
+enum AccessType {
+  ACCESS_MESSAGE = 0;
+  ACCESS_PHONEBOOK = 1;
+  ACCESS_SIM = 2;
+}
+
+message SetAccessPermissionRequest {
+  // Peer Bluetooth Device Address as array of 6 bytes.
+  bytes address = 1;
+  // Set AccessType to Message, PhoneBook and SIM access permission
+  AccessType access_type = 2;
+}
+
+// Internal representation of a Connection - not exposed to clients, included here
+// just for code-generation convenience. This is what we put in the Connection.cookie.
+message InternalConnectionRef {
+  bytes address = 1;
+  int32 transport = 2;
+}
\ No newline at end of file
diff --git a/pandora/interfaces/pandora_experimental/a2dp.proto b/pandora/interfaces/pandora_experimental/a2dp.proto
new file mode 100644
index 0000000..566f899
--- /dev/null
+++ b/pandora/interfaces/pandora_experimental/a2dp.proto
@@ -0,0 +1,264 @@
+
+// Copyright 2022 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+option java_outer_classname = "A2dpProto";
+
+package pandora;
+
+import "pandora_experimental/host.proto";
+
+// Service to trigger A2DP (Advanced Audio Distribution Profile) procedures.
+//
+// Requirements for the implementor:
+// - Streams must not be automatically opened, even if discovered.
+// - The `Host` service must be implemented
+//
+// References:
+// - [A2DP] Bluetooth SIG, Specification of the Bluetooth System,
+//    Advanced Audio Distribution, Version 1.3 or Later
+// - [AVDTP] Bluetooth SIG, Specification of the Bluetooth System,
+//    Audio/Video Distribution Transport Protocol, Version 1.3 or Later
+service A2DP {
+  // Open a stream from a local **Source** endpoint to a remote **Sink**
+  // endpoint.
+  //
+  // The returned source should be in the AVDTP_OPEN state (see [AVDTP] 9.1).
+  // The rpc must block until the stream has reached this state.
+  //
+  // A cancellation of this call must result in aborting the current
+  // AVDTP procedure (see [AVDTP] 9.9).
+  rpc OpenSource(OpenSourceRequest) returns (OpenSourceResponse);
+  // Open a stream from a local **Sink** endpoint to a remote **Source**
+  // endpoint.
+  //
+  // The returned sink must be in the AVDTP_OPEN state (see [AVDTP] 9.1).
+  // The rpc must block until the stream has reached this state.
+  //
+  // A cancellation of this call must result in aborting the current
+  // AVDTP procedure (see [AVDTP] 9.9).
+  rpc OpenSink(OpenSinkRequest) returns (OpenSinkResponse);
+  // Wait for a stream from a local **Source** endpoint to
+  // a remote **Sink** endpoint to open.
+  //
+  // The returned source should be in the AVDTP_OPEN state (see [AVDTP] 9.1).
+  // The rpc must block until the stream has reached this state.
+  //
+  // If the peer has opened a source prior to this call, the server will
+  // return it. The server must return the same source only once.
+  rpc WaitSource(WaitSourceRequest) returns (WaitSourceResponse);
+  // Wait for a stream from a local **Sink** endpoint to
+  // a remote **Source** endpoint to open.
+  //
+  // The returned sink should be in the AVDTP_OPEN state (see [AVDTP] 9.1).
+  // The rpc must block until the stream has reached this state.
+  //
+  // If the peer has opened a sink prior to this call, the server will
+  // return it. The server must return the same sink only once.
+  rpc WaitSink(WaitSinkRequest) returns (WaitSinkResponse);
+  // Get if the stream is suspended
+  rpc IsSuspended(IsSuspendedRequest) returns (IsSuspendedResponse);
+  // Start a suspended stream.
+  rpc Start(StartRequest) returns (StartResponse);
+  // Suspend a started stream.
+  rpc Suspend(SuspendRequest) returns (SuspendResponse);
+  // Close a stream, the source or sink tokens must not be reused afterwards.
+  rpc Close(CloseRequest) returns (CloseResponse);
+  // Get the `AudioEncoding` value of a stream
+  rpc GetAudioEncoding(GetAudioEncodingRequest) returns (GetAudioEncodingResponse);
+  // Playback audio by a `Source`
+  rpc PlaybackAudio(stream PlaybackAudioRequest) returns (PlaybackAudioResponse);
+  // Capture audio from a `Sink`
+  rpc CaptureAudio(CaptureAudioRequest) returns (stream CaptureAudioResponse);
+}
+
+// Audio encoding formats.
+enum AudioEncoding {
+  // Interleaved stereo frames with 16-bit signed little-endian linear PCM
+  // samples at 44100Hz sample rate
+  PCM_S16_LE_44K1_STEREO = 0;
+  // Interleaved stereo frames with 16-bit signed little-endian linear PCM
+  // samples at 48000Hz sample rate
+  PCM_S16_LE_48K_STEREO = 1;
+}
+
+// A Token representing a Source stream (see [A2DP] 2.2).
+// It's acquired via an OpenSource on the A2DP service.
+message Source {
+  // Opaque value filled by the GRPC server, must not
+  // be modified nor crafted.
+  Connection connection = 1;
+}
+
+// A Token representing a Sink stream (see [A2DP] 2.2).
+// It's acquired via an OpenSink on the A2DP service.
+message Sink {
+  // Opaque value filled by the GRPC server, must not
+  // be modified nor crafted.
+  Connection connection = 1;
+}
+
+// Request for the `OpenSource` method.
+message OpenSourceRequest {
+  // The connection that will open the stream.
+  Connection connection = 1;
+}
+
+// Response for the `OpenSource` method.
+message OpenSourceResponse {
+  // Result of the `OpenSource` call:
+  // - If successful: a Source
+  oneof result {
+    Source source = 1;
+  }
+}
+
+// Request for the `OpenSink` method.
+message OpenSinkRequest {
+  // The connection that will open the stream.
+  Connection connection = 1;
+}
+
+// Response for the `OpenSink` method.
+message OpenSinkResponse {
+  // Result of the `OpenSink` call:
+  // - If successful: a Sink
+  oneof result {
+    Sink sink = 1;
+  }
+}
+
+// Request for the `WaitSource` method.
+message WaitSourceRequest {
+  // The connection that is awaiting the stream.
+  Connection connection = 1;
+}
+
+// Response for the `WaitSource` method.
+message WaitSourceResponse {
+  // Result of the `WaitSource` call:
+  // - If successful: a Source
+  oneof result {
+    Source source = 1;
+  }
+}
+
+// Request for the `WaitSink` method.
+message WaitSinkRequest {
+  // The connection that is awaiting the stream.
+  Connection connection = 1;
+}
+
+// Response for the `WaitSink` method.
+message WaitSinkResponse {
+  // Result of the `WaitSink` call:
+  // - If successful: a Sink
+  oneof result {
+    Sink sink = 1;
+  }
+}
+
+// Request for the `IsSuspended` method.
+message IsSuspendedRequest {
+  // The stream on which the function will check if it's suspended
+  oneof target {
+    Sink sink = 1;
+    Source source = 2;
+  }
+}
+
+// Response for the `IsSuspended` method.
+message IsSuspendedResponse {
+  bool is_suspended = 1;
+}
+
+// Request for the `Start` method.
+message StartRequest {
+  // Target of the start, either a Sink or a Source.
+  oneof target {
+    Sink sink = 1;
+    Source source = 2;
+  }
+}
+
+// Response for the `Start` method.
+message StartResponse {}
+
+// Request for the `Suspend` method.
+message SuspendRequest {
+  // Target of the suspend, either a Sink or a Source.
+  oneof target {
+    Sink sink = 1;
+    Source source = 2;
+  }
+}
+
+// Response for the `Suspend` method.
+message SuspendResponse {}
+
+// Request for the `Close` method.
+message CloseRequest {
+  // Target of the close, either a Sink or a Source.
+  oneof target {
+    Sink sink = 1;
+    Source source = 2;
+  }
+}
+
+// Response for the `Close` method.
+message CloseResponse {}
+
+// Request for the `GetAudioEncoding` method.
+message GetAudioEncodingRequest {
+  // The stream on which the function will read the `AudioEncoding`.
+  oneof target {
+    Sink sink = 1;
+    Source source = 2;
+  }
+}
+
+// Response for the `GetAudioEncoding` method.
+message GetAudioEncodingResponse {
+  // Audio encoding of the stream.
+  AudioEncoding encoding = 1;
+}
+
+// Request for the `PlaybackAudio` method.
+message PlaybackAudioRequest {
+  // Source that will playback audio.
+  Source source = 1;
+  // Audio data to playback.
+  // The audio data must be encoded in the specified `AudioEncoding` value
+  // obtained in response of a `GetAudioEncoding` method call.
+  bytes data = 2;
+}
+
+// Response for the `PlaybackAudio` method.
+message PlaybackAudioResponse {}
+
+// Request for the `CaptureAudio` method.
+message CaptureAudioRequest {
+  // Sink that will capture audio
+  Sink sink = 1;
+}
+
+// Response for the `CaptureAudio` method.
+message CaptureAudioResponse {
+  // Captured audio data.
+  // The audio data is encoded in the specified `AudioEncoding` value
+  // obained in response of a `GetAudioEncoding` method call.
+  bytes data = 1;
+}
diff --git a/pandora/interfaces/pandora_experimental/avrcp.proto b/pandora/interfaces/pandora_experimental/avrcp.proto
new file mode 100644
index 0000000..d2a7060
--- /dev/null
+++ b/pandora/interfaces/pandora_experimental/avrcp.proto
@@ -0,0 +1,8 @@
+syntax = "proto3";
+
+option java_outer_classname = "AvrcpProto";
+
+package pandora;
+
+service AVRCP {
+}
\ No newline at end of file
diff --git a/pandora/interfaces/pandora_experimental/gatt.proto b/pandora/interfaces/pandora_experimental/gatt.proto
new file mode 100644
index 0000000..32513dc
--- /dev/null
+++ b/pandora/interfaces/pandora_experimental/gatt.proto
@@ -0,0 +1,209 @@
+syntax = "proto3";
+
+option java_outer_classname = "GattProto";
+
+package pandora;
+
+import "pandora_experimental/host.proto";
+import "google/protobuf/empty.proto";
+
+service GATT {
+  // Request an MTU size.
+  rpc ExchangeMTU(ExchangeMTURequest) returns (ExchangeMTUResponse);
+
+  // Writes on the given characteristic or descriptor with given handle.
+  rpc WriteAttFromHandle(WriteRequest) returns (WriteResponse);
+
+  // Starts service discovery for given uuid.
+  rpc DiscoverServiceByUuid(DiscoverServiceByUuidRequest) returns (DiscoverServicesResponse);
+
+  // Starts services discovery.
+  rpc DiscoverServices(DiscoverServicesRequest) returns (DiscoverServicesResponse);
+
+  // Starts services discovery using SDP.
+  rpc DiscoverServicesSdp(DiscoverServicesSdpRequest) returns (DiscoverServicesSdpResponse);
+
+  // Clears DUT GATT cache.
+  rpc ClearCache(ClearCacheRequest) returns (ClearCacheResponse);
+
+  // Reads characteristic with given handle.
+  rpc ReadCharacteristicFromHandle(ReadCharacteristicRequest) returns (ReadCharacteristicResponse);
+
+  // Reads characteristic with given uuid, start and end handles.
+  rpc ReadCharacteristicsFromUuid(ReadCharacteristicsFromUuidRequest) returns (ReadCharacteristicsFromUuidResponse);
+
+  // Reads characteristic with given descriptor handle.
+  rpc ReadCharacteristicDescriptorFromHandle(ReadCharacteristicDescriptorRequest) returns (ReadCharacteristicDescriptorResponse);
+
+  // Register a GATT service
+  rpc RegisterService(RegisterServiceRequest) returns (RegisterServiceResponse);
+}
+
+enum AttStatusCode {
+  SUCCESS = 0x00;
+  UNKNOWN_ERROR = 0x101;
+  INVALID_HANDLE = 0x01;
+  READ_NOT_PERMITTED = 0x02;
+  WRITE_NOT_PERMITTED = 0x03;
+  INSUFFICIENT_AUTHENTICATION = 0x05;
+  INVALID_OFFSET = 0x07;
+  ATTRIBUTE_NOT_FOUND = 0x0A;
+  INVALID_ATTRIBUTE_LENGTH = 0x0D;
+  APPLICATION_ERROR = 0x80;
+}
+
+enum AttProperties {
+  PROPERTY_NONE = 0x00;
+  PROPERTY_READ = 0x02;
+  PROPERTY_WRITE = 0x08;
+}
+
+enum AttPermissions {
+  PERMISSION_NONE = 0x00;
+  PERMISSION_READ = 0x01;
+  PERMISSION_WRITE = 0x10;
+  PERMISSION_READ_ENCRYPTED = 0x02;
+}
+
+// A message representing a GATT service.
+message GattService {
+  uint32 handle = 1;
+  uint32 type = 2;
+  string uuid = 3;
+  repeated GattService included_services = 4;
+  repeated GattCharacteristic characteristics = 5;
+}
+
+// A message representing a GATT characteristic.
+message GattCharacteristic {
+  uint32 properties = 1;
+  uint32 permissions = 2;
+  string uuid = 3;
+  uint32 handle = 4;
+  repeated GattCharacteristicDescriptor descriptors = 5;
+}
+
+// A message representing a GATT descriptors.
+message GattCharacteristicDescriptor {
+  uint32 handle = 1;
+  uint32 permissions = 2;
+  string uuid = 3;
+}
+
+message AttValue {
+  // Descriptor handle or Characteristic handle (not Characteristic Value handle).
+  uint32 handle = 1;
+  bytes value = 2;
+}
+
+// Request for the `ExchangeMTU` rpc.
+message ExchangeMTURequest {
+  Connection connection = 1;
+  int32 mtu = 2;
+}
+
+// Response for the `ExchangeMTU` rpc.
+message ExchangeMTUResponse {}
+
+// Request for the `WriteAttFromHandle` rpc.
+message WriteRequest {
+  Connection connection = 1;
+  uint32 handle = 2;
+  bytes value = 3;
+}
+
+// Request for the `WriteAttFromHandle` rpc.
+message WriteResponse {
+  uint32 handle = 1;
+  AttStatusCode status = 2;
+}
+
+// Request for the `DiscoverServiceByUuid` rpc.
+message DiscoverServiceByUuidRequest {
+  Connection connection = 1;
+  string uuid = 2;
+}
+
+// Request for the `DiscoverServices` rpc.
+message DiscoverServicesRequest {
+  Connection connection = 1;
+}
+
+// Response for the `DiscoverServices` rpc.
+message DiscoverServicesResponse {
+  repeated GattService services = 1;
+}
+
+// Request for the `DiscoverServicesSdp` rpc.
+message DiscoverServicesSdpRequest {
+  bytes address = 1;
+}
+
+// Response for the `DiscoverServicesSdp` rpc.
+message DiscoverServicesSdpResponse {
+  repeated string service_uuids = 1;
+}
+
+// Request for the `ClearCache` rpc.
+message ClearCacheRequest {
+  Connection connection = 1;
+}
+
+// Response for the `ClearCache` rpc.
+message ClearCacheResponse {}
+
+// Request for the `ReadCharacteristicFromHandle` rpc.
+message ReadCharacteristicRequest {
+  Connection connection = 1;
+  uint32 handle = 2;
+}
+
+// Request for the `ReadCharacteristicsFromUuid` rpc.
+message ReadCharacteristicsFromUuidRequest {
+  Connection connection = 1;
+  string uuid = 2;
+  uint32 start_handle = 3;
+  uint32 end_handle = 4;
+}
+
+// Response for the `ReadCharacteristicFromHandle` rpc.
+message ReadCharacteristicResponse {
+  AttValue value = 1;
+  AttStatusCode status = 2;
+}
+
+// Response for the `ReadCharacteristicsFromUuid` rpc.
+message ReadCharacteristicsFromUuidResponse {
+  repeated ReadCharacteristicResponse characteristics_read = 1;
+}
+
+// Request for the `ReadCharacteristicDescriptorFromHandle` rpc.
+message ReadCharacteristicDescriptorRequest {
+  Connection connection = 1;
+  uint32 handle = 2;
+}
+
+// Response for the `ReadCharacteristicDescriptorFromHandle` rpc.
+message ReadCharacteristicDescriptorResponse {
+  AttValue value = 1;
+  AttStatusCode status = 2;
+}
+
+message GattServiceParams {
+  string uuid = 1;
+  repeated GattCharacteristicParams characteristics = 2;
+}
+
+message GattCharacteristicParams {
+  uint32 properties = 1;
+  uint32 permissions = 2;
+  string uuid = 3;
+}
+
+message RegisterServiceRequest {
+  GattServiceParams service = 1;
+}
+
+message RegisterServiceResponse {
+  GattService service = 1;
+}
diff --git a/pandora/interfaces/pandora_experimental/hfp.proto b/pandora/interfaces/pandora_experimental/hfp.proto
new file mode 100644
index 0000000..2406165
--- /dev/null
+++ b/pandora/interfaces/pandora_experimental/hfp.proto
@@ -0,0 +1,188 @@
+syntax = "proto3";
+
+option java_outer_classname = "HfpProto";
+
+package pandora;
+
+import "pandora_experimental/host.proto";
+import "google/protobuf/empty.proto";
+
+// Service to trigger HFP (Hands Free Profile) procedures.
+service HFP {
+  // Enable Service level connection
+  rpc EnableSlc(EnableSlcRequest) returns (google.protobuf.Empty);
+  // Disable Service level connection
+  rpc DisableSlc(DisableSlcRequest) returns (google.protobuf.Empty);
+  // Change the battery level to the one requested
+  rpc SetBatteryLevel(SetBatteryLevelRequest) returns (google.protobuf.Empty);
+  // Make a call
+  rpc MakeCall(MakeCallRequest) returns (MakeCallResponse);
+  // Answer a call
+  rpc AnswerCall(AnswerCallRequest) returns (AnswerCallResponse);
+  // Decline a call
+  rpc DeclineCall(DeclineCallRequest) returns (DeclineCallResponse);
+  // Set the audio path
+  rpc SetAudioPath(SetAudioPathRequest) returns (SetAudioPathResponse);
+  // Swap the active and held call
+  rpc SwapActiveCall(SwapActiveCallRequest) returns (SwapActiveCallResponse);
+  // Set in-band ringtone
+  rpc SetInBandRingtone(SetInBandRingtoneRequest) returns (SetInBandRingtoneResponse);
+  // Set voice recognition
+  rpc SetVoiceRecognition(SetVoiceRecognitionRequest) returns (SetVoiceRecognitionResponse);
+  // Clear the call history
+  rpc ClearCallHistory(ClearCallHistoryRequest) returns (ClearCallHistoryResponse);
+  // Answer an incoming call from a peer device (as a handsfree)
+  rpc AnswerCallAsHandsfree(AnswerCallAsHandsfreeRequest) returns (AnswerCallAsHandsfreeResponse);
+  // End a call from a peer device (as a handsfree)
+  rpc EndCallAsHandsfree(EndCallAsHandsfreeRequest) returns (EndCallAsHandsfreeResponse);
+  // Decline an incoming call from a peer device (as a handsfree)
+  rpc DeclineCallAsHandsfree(DeclineCallAsHandsfreeRequest) returns (DeclineCallAsHandsfreeResponse);
+  // Connect to an incoming audio stream from a peer device (as a handsfree)
+  rpc ConnectToAudioAsHandsfree(ConnectToAudioAsHandsfreeRequest) returns (ConnectToAudioAsHandsfreeResponse);
+  // Disonnect from an incoming audio stream from a peer device (as a handsfree)
+  rpc DisconnectFromAudioAsHandsfree(DisconnectFromAudioAsHandsfreeRequest) returns (DisconnectFromAudioAsHandsfreeResponse);
+  // Make a call to a given phone number (as a handsfree)
+  rpc MakeCallAsHandsfree(MakeCallAsHandsfreeRequest) returns (MakeCallAsHandsfreeResponse);
+  // Connect a call on hold, and disconnect the current call (as a handsfree)
+  rpc CallTransferAsHandsfree(CallTransferAsHandsfreeRequest) returns (CallTransferAsHandsfreeResponse);
+  // Enable Service level connection (as a handsfree)
+  rpc EnableSlcAsHandsfree(EnableSlcAsHandsfreeRequest) returns (google.protobuf.Empty);
+  // Disable Service level connection (as a handsfree)
+  rpc DisableSlcAsHandsfree(DisableSlcAsHandsfreeRequest) returns (google.protobuf.Empty);
+  // Set voice recognition (as a handsfree)
+  rpc SetVoiceRecognitionAsHandsfree(SetVoiceRecognitionAsHandsfreeRequest) returns (SetVoiceRecognitionAsHandsfreeResponse);
+  // Send DTMF code from the handsfree
+  rpc SendDtmfFromHandsfree(SendDtmfFromHandsfreeRequest) returns (SendDtmfFromHandsfreeResponse);
+}
+
+// Request of the `EnableSlc` method.
+message EnableSlcRequest {
+  // Connection crafted by grpc server
+  Connection connection = 1;
+}
+
+// Request of the `DisableSlc` method.
+message DisableSlcRequest {
+  // Connection crafted by grpc server
+  Connection connection = 1;
+}
+
+// Request of the `SetBatteryLevel` method.
+message SetBatteryLevelRequest {
+  // Connection crafted by grpc server
+  Connection connection = 1;
+  // Battery level to be set on the DUT
+  int32 battery_percentage = 2;
+}
+
+message AnswerCallRequest {}
+
+message AnswerCallResponse {}
+
+message DeclineCallRequest {}
+
+message DeclineCallResponse {}
+
+enum AudioPath {
+  AUDIO_PATH_UNKNOWN = 0;
+  AUDIO_PATH_SPEAKERS = 1;
+  AUDIO_PATH_HANDSFREE = 2;
+}
+
+message SetAudioPathRequest {
+  AudioPath audio_path = 1;
+}
+
+message SetAudioPathResponse {}
+
+message SwapActiveCallRequest {}
+
+message SwapActiveCallResponse {}
+
+message SetInBandRingtoneRequest {
+  bool enabled = 1;
+}
+
+message SetInBandRingtoneResponse {}
+
+message MakeCallRequest {
+  string number = 1;
+}
+
+message MakeCallResponse {}
+
+message SetVoiceRecognitionRequest {
+  Connection connection = 1;
+  bool enabled = 2;
+}
+
+message SetVoiceRecognitionResponse {}
+
+message ClearCallHistoryRequest {}
+
+message ClearCallHistoryResponse {}
+
+message AnswerCallAsHandsfreeRequest {
+  Connection connection = 1;
+}
+
+message AnswerCallAsHandsfreeResponse {}
+
+message EndCallAsHandsfreeRequest {
+  Connection connection = 1;
+}
+
+message EndCallAsHandsfreeResponse {}
+
+message DeclineCallAsHandsfreeRequest {
+  Connection connection = 1;
+}
+
+message DeclineCallAsHandsfreeResponse {}
+
+message ConnectToAudioAsHandsfreeRequest {
+  Connection connection = 1;
+}
+
+message ConnectToAudioAsHandsfreeResponse {}
+
+message DisconnectFromAudioAsHandsfreeRequest {
+  Connection connection = 1;
+}
+
+message DisconnectFromAudioAsHandsfreeResponse {}
+
+message MakeCallAsHandsfreeRequest {
+  Connection connection = 1;
+  string number = 2;
+}
+
+message MakeCallAsHandsfreeResponse {}
+
+message CallTransferAsHandsfreeRequest {
+  Connection connection = 1;
+}
+
+message CallTransferAsHandsfreeResponse {}
+
+message EnableSlcAsHandsfreeRequest {
+  Connection connection = 1;
+}
+
+message DisableSlcAsHandsfreeRequest {
+  Connection connection = 1;
+}
+
+message SetVoiceRecognitionAsHandsfreeRequest {
+  Connection connection = 1;
+  bool enabled = 2;
+}
+
+message SetVoiceRecognitionAsHandsfreeResponse {}
+
+message SendDtmfFromHandsfreeRequest {
+  Connection connection = 1;
+  uint32 code = 2;
+}
+
+message SendDtmfFromHandsfreeResponse {}
diff --git a/pandora/interfaces/pandora_experimental/hid.proto b/pandora/interfaces/pandora_experimental/hid.proto
new file mode 100644
index 0000000..1b95b8c
--- /dev/null
+++ b/pandora/interfaces/pandora_experimental/hid.proto
@@ -0,0 +1,28 @@
+syntax = "proto3";
+
+package pandora;
+
+option java_outer_classname = "HidProto";
+
+service HID {
+  // Send a SET_REPORT command, acting as a HID host, to a connected HID device
+  rpc SendHostReport(SendHostReportRequest) returns (SendHostReportResponse);
+}
+
+// Enum values match those in BluetoothHidHost.java
+enum HidReportType {
+  HID_REPORT_TYPE_UNSPECIFIED = 0;
+  HID_REPORT_TYPE_INPUT = 1;
+  HID_REPORT_TYPE_OUTPUT = 2;
+  HID_REPORT_TYPE_FEATURE = 3;
+}
+
+message SendHostReportRequest {
+  bytes address = 1;
+  HidReportType report_type = 2;
+  string report = 3;
+}
+
+message SendHostReportResponse {
+
+}
\ No newline at end of file
diff --git a/pandora/interfaces/pandora_experimental/host.proto b/pandora/interfaces/pandora_experimental/host.proto
new file mode 100644
index 0000000..d66aba7
--- /dev/null
+++ b/pandora/interfaces/pandora_experimental/host.proto
@@ -0,0 +1,501 @@
+// Copyright 2022 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+option java_outer_classname = "HostProto";
+
+package pandora;
+
+import "google/protobuf/empty.proto";
+import "google/protobuf/any.proto";
+
+// Service to trigger Bluetooth Host procedures
+//
+// At startup, the Host must be in BR/EDR connectable mode
+// (see GAP connectability modes).
+service Host {
+  // Factory reset the host.
+  // **After** responding to this command, the gRPC server should loose
+  // all its state.
+  // This is comparable to a process restart or an hardware reset.
+  // The gRPC server might take some time to be available after
+  // this command.
+  rpc FactoryReset(google.protobuf.Empty) returns (google.protobuf.Empty);
+  // Reset the host by performing an HCI reset. Previous bonds must
+  // not be removed and the gRPC server must not be restarted.
+  rpc Reset(google.protobuf.Empty) returns (google.protobuf.Empty);
+  // Read the local Bluetooth device address.
+  // This should return the same value as a Read BD_ADDR HCI command.
+  rpc ReadLocalAddress(google.protobuf.Empty) returns (ReadLocalAddressResponse);
+  // Create an ACL BR/EDR connection to a peer.
+  // If the two devices have not established a previous bond,
+  // the peer must be discoverable.
+  // Whether this also triggers pairing (i.e. authentication and/or encryption)
+  // is implementation defined:
+  // some Bluetooth Host stack trigger pairing when ACL connection is being
+  // established, others when a profile or service requiring a specific
+  // security level is being opened. If it does trigger pairing, pairing events
+  // shall be handled through `Security.OnPairing` if a corresponding stream
+  // has been opened prior to this call, otherwise, they shall be automatically
+  // confirmed by the host before this method returns.
+  rpc Connect(ConnectRequest) returns (ConnectResponse);
+  // Get an active ACL BR/EDR connection to a peer.
+  rpc GetConnection(GetConnectionRequest) returns (GetConnectionResponse);
+  // Wait for an ACL BR/EDR connection from a peer.
+  rpc WaitConnection(WaitConnectionRequest) returns (WaitConnectionResponse);
+  // Create an ACL LE connection.
+  // Unlike BR/EDR `Connect`, this must not trigger or wait any
+  // pairing/encryption and return as soon as the connection is complete.
+  rpc ConnectLE(ConnectLERequest) returns (ConnectLEResponse);
+  // Get an active ACL LE connection to a peer.
+  rpc GetLEConnection(GetLEConnectionRequest) returns (GetLEConnectionResponse);
+  // Wait for an ACL LE connection from a peer.
+  rpc WaitLEConnection(WaitLEConnectionRequest) returns (WaitLEConnectionResponse);
+  // Disconnect an ACL connection.
+  // The related Connection must not be reused afterwards.
+  rpc Disconnect(DisconnectRequest) returns (google.protobuf.Empty);
+  // Wait for disconnection of an ACL connection.
+  rpc WaitDisconnection(WaitDisconnectionRequest) returns (google.protobuf.Empty);
+  // Create and enable an advertising set using legacy or extended advertising,
+  // except periodic advertising.
+  rpc StartAdvertising(StartAdvertisingRequest) returns (StartAdvertisingResponse);
+  // Remove an advertising set.
+  rpc StopAdvertising(StopAdvertisingRequest) returns (google.protobuf.Empty);
+  // Run LE scanning and return each device found.
+  // Canceling the `Scan` stream shall stop scanning.
+  rpc Scan(ScanRequest) returns (stream ScanningResponse);
+  // Start BR/EDR inquiry and returns each device found.
+  // Canceling the `Inquiry` stream shall stop inquiry.
+  rpc Inquiry(google.protobuf.Empty) returns (stream InquiryResponse);
+  // Set BR/EDR discoverability mode.
+  rpc SetDiscoverabilityMode(SetDiscoverabilityModeRequest) returns (google.protobuf.Empty);
+  // Set BR/EDR connectability mode.
+  rpc SetConnectabilityMode(SetConnectabilityModeRequest) returns (google.protobuf.Empty);
+  // Get remote device name from connection.
+  rpc GetRemoteName(GetRemoteNameRequest) returns (GetRemoteNameResponse);
+}
+
+// Bluetooth device own address type.
+enum OwnAddressType {
+  PUBLIC = 0x0;
+  RANDOM = 0x1;
+  RESOLVABLE_OR_PUBLIC = 0x2;
+  RESOLVABLE_OR_RANDOM = 0x3;
+}
+
+// Advertisement primary PHY types.
+enum PrimaryPhy {
+  PRIMARY_1M = 0;
+  PRIMARY_CODED = 2;
+}
+
+// Advertisement secondary PHY types.
+enum SecondaryPhy {
+  SECONDARY_1M = 0;
+  SECONDARY_2M = 1;
+  SECONDARY_CODED = 2;
+}
+
+// Discoverability modes.
+enum DiscoverabilityMode {
+  NOT_DISCOVERABLE = 0;
+  DISCOVERABLE_LIMITED = 1;
+  DISCOVERABLE_GENERAL = 2;
+}
+
+// Connectability modes (BR/EDR only).
+enum ConnectabilityMode {
+  NOT_CONNECTABLE = 0;
+  CONNECTABLE = 1;
+}
+
+// A Token representing an ACL connection.
+// It's acquired via a `Connect` or `ConnectLE`.
+message Connection {
+  // Opaque value filled by the gRPC server, must not be modified nor crafted.
+  google.protobuf.Any cookie = 1;
+}
+
+// A Token representing an Advertising set.
+// It's acquired via a `StartAdvertising` on the Host service.
+message AdvertisingSet {
+  // Opaque value filled by the gRPC server, must not be modified nor crafted.
+  google.protobuf.Any cookie = 1;
+}
+
+// Data types notably used for Extended Inquiry Response and Advertising Data.
+// The Flags data type is mandatory must be automatically set by the IUT and is
+// not exposed here.
+// include_<data type> are used in advertising requests for data types
+// which may not be exposed to the user and that must be set by the IUT
+// when specified.
+// See Core Supplement, Part A, Data Types for details.
+message DataTypes {
+  repeated string incomplete_service_class_uuids16 = 1; // Incomplete List of 16bit Service Class UUIDs
+  repeated string complete_service_class_uuids16 = 2; // Complete List of 16bit Service Class UUIDs
+  repeated string incomplete_service_class_uuids32 = 3; // Incomplete List of 32bit Service Class UUIDs
+  repeated string complete_service_class_uuids32 = 4; // Complete List of 32bit Service Class UUIDs
+  repeated string incomplete_service_class_uuids128 = 5; // Incomplete List of 128bit Service Class UUIDs
+  repeated string complete_service_class_uuids128 = 6; // Complete List of 128bit Service Class UUIDs
+  // Shortened Local Name
+  oneof shortened_local_name_oneof {
+    string shortened_local_name = 7;
+    bool include_shortened_local_name = 8;
+  }
+  // Complete Local Name
+  oneof complete_local_name_oneof {
+    string complete_local_name = 9;
+    bool include_complete_local_name = 10;
+  }
+  // Tx Power Level
+  oneof tx_power_level_oneof {
+    uint32 tx_power_level = 11;
+    bool include_tx_power_level = 12;
+  }
+  //  Class of Device
+  oneof class_of_device_oneof {
+    uint32 class_of_device = 13;
+    bool include_class_of_device = 14;
+  }
+  uint32 peripheral_connection_interval_min = 15; // Peripheral Connection Interval Range minimum value, 16 bits
+  uint32 peripheral_connection_interval_max = 16; // Peripheral Connection Interval Range maximum value, 16 bits
+  repeated string service_solicitation_uuids16 = 17; // List of 16bit Service Solicitation UUIDs
+  repeated string service_solicitation_uuids128 = 18; // List of 128bit Service Solicitation UUIDs
+  map<string, bytes> service_data_uuid16 = 19; // Service Data 16bit UUID
+  repeated bytes public_target_addresses = 20; // Public Target Addresses
+  repeated bytes random_target_addresses = 21; // Random Target Addresses
+  uint32 appearance = 22; // Appearance (16bits)
+  // Advertising Interval
+  oneof advertising_interval_oneof {
+    uint32 advertising_interval = 23; // 16 bits
+    bool include_advertising_interval = 24;
+  }
+  repeated string service_solicitation_uuids32 = 25; // List of 32bit Service Solicitation UUIDs
+  map<string, bytes> service_data_uuid32 = 26; // Service Data 32bit UUID
+  map<string, bytes> service_data_uuid128 = 27; // Service Data 128bit UUID
+  string uri = 28; // URI
+  bytes le_supported_features = 29; // LE Supported Features
+  bytes manufacturer_specific_data = 30; // Manufacturer Specific Data
+  DiscoverabilityMode le_discoverability_mode = 31; // Flags LE Discoverability Mode
+}
+
+// Response of the `ReadLocalAddress` method.
+message ReadLocalAddressResponse {
+  // Local Bluetooth device address as array of 6 bytes.
+  bytes address = 1;
+}
+
+// Request of the `Connect` method.
+message ConnectRequest {
+  // Peer Bluetooth device address as array of 6 bytes.
+  bytes address = 1;
+}
+
+// Response of the `Connect` method.
+message ConnectResponse {
+  // Response result.
+  oneof result {
+    // Connection on `Connect` success
+    Connection connection = 1;
+    // Peer not found error.
+    google.protobuf.Empty peer_not_found = 2;
+    // A connection with peer already exists.
+    google.protobuf.Empty connection_already_exists = 3;
+    // Pairing failure error.
+    google.protobuf.Empty pairing_failure = 4;
+    // Authentication failure error.
+    google.protobuf.Empty authentication_failure = 5;
+    // Encryption failure error.
+    google.protobuf.Empty encryption_failure = 6;
+  }
+}
+
+// Request of the `GetConnection` method.
+message GetConnectionRequest {
+  // Peer Bluetooth device address as array of 6 bytes.
+  bytes address = 1;
+}
+
+// Response of the `GetConnection` method.
+message GetConnectionResponse {
+  // Response result.
+  oneof result {
+    // Connection on `GetConnection` success
+    Connection connection = 1;
+    // Peer not found error.
+    google.protobuf.Empty peer_not_found = 2;
+  }
+}
+
+// Request of the `WaitConnection` method.
+message WaitConnectionRequest {
+  // Peer Bluetooth device address as array of 6 bytes.
+  bytes address = 1;
+}
+
+// Response of the `WaitConnection` method.
+message WaitConnectionResponse {
+  // Response result.
+  oneof result {
+    // Connection on `WaitConnection` success
+    Connection connection = 1;
+  }
+}
+
+// Request of the `ConnectLE` method.
+message ConnectLERequest {
+  // Own address type.
+  OwnAddressType own_address_type = 1;
+  // Peer Bluetooth device address as array of 6 bytes.
+  oneof address {
+    // Public device address.
+    bytes public = 2;
+    // Random device address.
+    bytes random = 3;
+    // Public identity device address.
+    bytes public_identity = 4;
+    // Random (static) identity device address.
+    bytes random_static_identity = 5;
+  }
+}
+
+// Response of the `ConnectLE` method.
+message ConnectLEResponse {
+  // Response result.
+  oneof result {
+    // Connection on `ConnectLE` success
+    Connection connection = 1;
+    // Peer not found error.
+    google.protobuf.Empty peer_not_found = 2;
+    // A connection with peer already exists.
+    google.protobuf.Empty connection_already_exists = 3;
+  }
+}
+
+// Request of the `GetLEConnection` method.
+message GetLEConnectionRequest {
+  // Peer Bluetooth device address as array of 6 bytes.
+  oneof address {
+    // Public device address.
+    bytes public = 1;
+    // Random device address.
+    bytes random = 2;
+    // Public identity device address.
+    bytes public_identity = 3;
+    // Random (static) identity device address.
+    bytes random_static_identity = 4;
+  }
+}
+
+// Response of the `GetLEConnection` method.
+message GetLEConnectionResponse {
+  // Response result.
+  oneof result {
+    // Connection on `GetLEConnection` success
+    Connection connection = 1;
+    // Peer not found error.
+    google.protobuf.Empty peer_not_found = 2;
+  }
+}
+
+// Request of the `WaitLEConnection` method.
+message WaitLEConnectionRequest {
+  // Peer Bluetooth device address as array of 6 bytes.
+  oneof address {
+    // Public device address.
+    bytes public = 1;
+    // Random device address.
+    bytes random = 2;
+    // Public identity device address.
+    bytes public_identity = 3;
+    // Random (static) identity device address.
+    bytes random_static_identity = 4;
+  }
+}
+
+// Response of the `WaitLEConnection` method.
+message WaitLEConnectionResponse {
+  // Response result.
+  oneof result {
+    // Connection on `WaitLEConnection` success
+    Connection connection = 1;
+  }
+}
+
+// Request of the `Disconnect` method.
+message DisconnectRequest {
+  // Connection that should be disconnected.
+  Connection connection = 1;
+}
+
+// Request of the `WaitDisconnection` method.
+message WaitDisconnectionRequest {
+  // Connection to wait disconnection from.
+  Connection connection = 1;
+}
+
+// Request of the `StartAdvertising` method.
+message StartAdvertisingRequest {
+  // `true` to use legacy advertising.
+  // The implementation shall fail when set to `false` and
+  // extended advertising is not supported.
+  bool legacy = 1;
+  // Advertisement data.
+  DataTypes data = 2;
+  // If none, the device is not scannable.
+  DataTypes scan_response_data = 3;
+  // Target Bluetooth device address as array of 6 bytes.
+  // If none, advertisement is undirected.
+  oneof target {
+    // Public device address or public identity address.
+    bytes public = 4;
+    // Random device address or random (static) identity address.
+    bytes random = 5;
+  }
+  // Own address type to advertise.
+  OwnAddressType own_address_type = 6;
+  // `true` if the device is connectable.
+  bool connectable = 7;
+  // Interval & range of the advertisement.
+  float interval = 8;
+  // If not specified, the IUT is free to select any interval min and max
+  // which comprises the specified interval.
+  float interval_range = 9;
+  // Extended only: primary PHYs.
+  PrimaryPhy primary_phy = 10;
+  // Extended only: secondary PHYs.
+  SecondaryPhy secondary_phy = 11;
+}
+
+// Response of the `StartAdvertising` method.
+message StartAdvertisingResponse {
+  AdvertisingSet set = 1;
+}
+
+// Request of the `StopAdvertising` method.
+message StopAdvertisingRequest {
+  // AdvertisingSet that should be stopped.
+  AdvertisingSet set = 1;
+}
+
+// Request of the `Scan` method.
+message ScanRequest {
+  // `true` the use legacy scanning.
+  // The implementation shall fail when set to `false` and
+  // extended scanning is not supported.
+  bool legacy = 1;
+  // Scan in passive mode (versus active one).
+  bool passive = 2;
+  // Own address type.
+  OwnAddressType own_address_type = 3;
+  // Interval & window of the scan.
+  float interval = 4;
+  float window = 5;
+  // Scanning PHYs.
+  repeated PrimaryPhy phys = 6;
+}
+
+// Response of the `Scan` method.
+message ScanningResponse {
+  // `true` if the response is legacy.
+  bool legacy = 1;
+  // Peer Bluetooth device address as array of 6 bytes.
+  oneof address {
+    // Public device address.
+    bytes public = 2;
+    // Random device address.
+    bytes random = 3;
+    // Public identity device address (corresponds to resolved private address).
+    bytes public_identity = 4;
+    // Random (static) identity device address (corresponds to resolved private address).
+    bytes random_static_identity = 5;
+  }
+  // Direct Bluetooth device address as array of 6 bytes.
+  oneof direct_address {
+    // Public device address.
+    bytes direct_public = 6;
+    // Non-resolvable private address or static device address.
+    bytes direct_non_resolvable_random = 7;
+    // Resolvable private address (resolved by controller).
+    bytes direct_resolved_public = 8;
+    // Resolvable private address (resolved by controller).
+    bytes direct_resolved_random = 9;
+    // Resolvable private address (controller unable to resolve).
+    bytes direct_unresolved_random = 10;
+  }
+  // `true` if the peer is connectable.
+  bool connectable = 11;
+  // `true` if the peer is scannable.
+  bool scannable = 12;
+  // `true` if the `undirected.data` is truncated.
+  // This indicates that the advertisement data are truncated.
+  bool truncated = 13;
+  // Advertising SID from 0x00 to 0x0F.
+  uint32 sid = 14;
+  // On extended only: primary PHYs.
+  PrimaryPhy primary_phy = 15;
+  // On extended only: secondary PHYs.
+  SecondaryPhy secondary_phy = 16;
+  // TX power in dBm, range: -127 to +20.
+  int32 tx_power = 17;
+  // Received Signal Strenght Indication in dBm, range: -127 to +20.
+  int32 rssi = 18;
+  // Interval of the periodic advertising, 0 if not periodic
+  // or within 7.5 ms to 81,918.75 ms range.
+  float periodic_advertising_interval = 19;
+  // Scan response data.
+  DataTypes data = 20;
+}
+
+// Response of the `Inquiry` method.
+message InquiryResponse {
+  bytes address = 1;
+  uint32 page_scan_repetition_mode = 2;
+  uint32 class_of_device = 3;
+  uint32 clock_offset = 4;
+  int32 rssi = 5;
+  DataTypes data = 6;
+}
+
+// Request of the `SetDiscoverabilityMode` method.
+message SetDiscoverabilityModeRequest {
+  DiscoverabilityMode mode = 1;
+}
+
+// Request of the `SetConnectabilityMode` method.
+message SetConnectabilityModeRequest {
+  ConnectabilityMode mode = 1;
+}
+
+// Request of the `GetRemoteName` method.
+message GetRemoteNameRequest {
+  oneof remote {
+    // ACL connection with remote device.
+    Connection connection = 1;
+    // Remote Bluetooth device address as array of 6 bytes.
+    bytes address = 2;
+  }
+}
+
+// Response of the `GetRemoteName` method.
+message GetRemoteNameResponse {
+  // Response result.
+  oneof result {
+    // Remote name on `GetRemoteName` success.
+    string name = 1;
+    // Remote not found error.
+    google.protobuf.Empty remote_not_found = 2;
+  }
+}
diff --git a/pandora/interfaces/pandora_experimental/l2cap.proto b/pandora/interfaces/pandora_experimental/l2cap.proto
new file mode 100644
index 0000000..6aa088d7
--- /dev/null
+++ b/pandora/interfaces/pandora_experimental/l2cap.proto
@@ -0,0 +1,62 @@
+syntax = "proto3";
+
+package pandora;
+
+option java_outer_classname = "L2capProto";
+
+import "google/protobuf/empty.proto";
+import "pandora_experimental/host.proto";
+
+service L2CAP {
+  // Create a L2CAP connection to a peer.
+  rpc CreateLECreditBasedChannel(CreateLECreditBasedChannelRequest) returns (CreateLECreditBasedChannelResponse);
+  // Send some data
+  rpc SendData(SendDataRequest) returns (SendDataResponse);
+  // Receive data
+  rpc ReceiveData(ReceiveDataRequest) returns (ReceiveDataResponse);
+  // Listen L2CAP channel for connection
+  rpc ListenL2CAPChannel(ListenL2CAPChannelRequest) returns (ListenL2CAPChannelResponse);
+  // Accept L2CAP connection
+  rpc AcceptL2CAPChannel(AcceptL2CAPChannelRequest) returns (AcceptL2CAPChannelResponse);
+}
+
+// Request for the `OpenSource` method.
+message CreateLECreditBasedChannelRequest {
+  // The connection that will open the stream.
+  Connection connection = 1;
+  int32 psm = 2;
+  bool secure = 3;
+}
+
+// Request for the `OpenSource` method.
+message CreateLECreditBasedChannelResponse {}
+
+message SendDataRequest {
+  // The connection that will open the stream.
+  Connection connection = 1;
+  bytes data = 2;
+}
+
+message SendDataResponse {}
+
+message ReceiveDataRequest {
+  // The connection that will open the stream.
+  Connection connection = 1;
+}
+
+message ReceiveDataResponse {
+  bytes data = 1;
+}
+
+message ListenL2CAPChannelRequest{
+  Connection connection = 1;
+  bool secure = 2;
+}
+
+message ListenL2CAPChannelResponse {}
+
+message AcceptL2CAPChannelRequest{
+  Connection connection = 1;
+}
+
+message AcceptL2CAPChannelResponse {}
\ No newline at end of file
diff --git a/pandora/interfaces/pandora_experimental/mediaplayer.proto b/pandora/interfaces/pandora_experimental/mediaplayer.proto
new file mode 100644
index 0000000..e6cf1f2
--- /dev/null
+++ b/pandora/interfaces/pandora_experimental/mediaplayer.proto
@@ -0,0 +1,19 @@
+syntax = "proto3";
+
+option java_outer_classname = "MediaPlayerProto";
+
+package pandora;
+
+import "google/protobuf/empty.proto";
+
+
+service MediaPlayer {
+  rpc Play(google.protobuf.Empty) returns (google.protobuf.Empty);
+  rpc Stop(google.protobuf.Empty) returns (google.protobuf.Empty);
+  rpc Pause(google.protobuf.Empty) returns (google.protobuf.Empty);
+  rpc Rewind(google.protobuf.Empty) returns (google.protobuf.Empty);
+  rpc FastForward(google.protobuf.Empty) returns (google.protobuf.Empty);
+  rpc Forward(google.protobuf.Empty) returns (google.protobuf.Empty);
+  rpc Backward(google.protobuf.Empty) returns (google.protobuf.Empty);
+  rpc SetLargeMetadata(google.protobuf.Empty) returns (google.protobuf.Empty);
+}
\ No newline at end of file
diff --git a/pandora/interfaces/pandora_experimental/pbap.proto b/pandora/interfaces/pandora_experimental/pbap.proto
new file mode 100644
index 0000000..adef01d
--- /dev/null
+++ b/pandora/interfaces/pandora_experimental/pbap.proto
@@ -0,0 +1,8 @@
+syntax = "proto3";
+
+option java_outer_classname = "PbapProto";
+
+package pandora;
+
+service PBAP {
+}
diff --git a/pandora/interfaces/pandora_experimental/rfcomm.proto b/pandora/interfaces/pandora_experimental/rfcomm.proto
new file mode 100644
index 0000000..a020e3d
--- /dev/null
+++ b/pandora/interfaces/pandora_experimental/rfcomm.proto
@@ -0,0 +1,80 @@
+syntax = "proto3";
+
+option java_outer_classname = "RfcommProto";
+
+package pandora;
+
+// Service to trigger RFCOMM procedures.
+service RFCOMM {
+  rpc ConnectToServer(ConnectionRequest) returns (ConnectionResponse);
+  rpc StartServer(ServerOptions) returns (StartServerResponse);
+  rpc AcceptConnection(AcceptConnectionRequest) returns (AcceptConnectionResponse);
+  rpc Disconnect(DisconnectionRequest) returns (DisconnectionResponse);
+  rpc StopServer(StopServerRequest) returns (StopServerResponse);
+  rpc Send(TxRequest) returns (TxResponse);
+  rpc Receive(RxRequest) returns (RxResponse);
+}
+
+message ConnectionRequest {
+  bytes address = 1;
+  string uuid = 2;
+}
+
+message RfcommConnection {
+  uint32 id = 1;
+}
+
+message ConnectionResponse {
+  RfcommConnection connection = 1;
+}
+
+message ServerOptions {
+  string name = 1;
+  string uuid = 2;
+}
+
+message ServerId {
+  uint32 id = 1;
+}
+
+message StartServerResponse {
+  ServerId server = 1;
+}
+
+message StopServerRequest {
+  ServerId server = 1;
+}
+
+message StopServerResponse {
+}
+
+message AcceptConnectionRequest {
+  ServerId server = 1;
+}
+
+message AcceptConnectionResponse {
+  RfcommConnection connection = 1;
+}
+
+message DisconnectionRequest {
+  RfcommConnection connection = 1;
+}
+
+message DisconnectionResponse {
+}
+
+message TxRequest {
+  RfcommConnection connection = 1;
+  bytes data = 2;
+}
+
+message TxResponse {
+}
+
+message RxRequest {
+  RfcommConnection connection = 1;
+}
+
+message RxResponse {
+  bytes data = 1;
+}
diff --git a/pandora/interfaces/pandora_experimental/security.proto b/pandora/interfaces/pandora_experimental/security.proto
new file mode 100644
index 0000000..a7a9072
--- /dev/null
+++ b/pandora/interfaces/pandora_experimental/security.proto
@@ -0,0 +1,272 @@
+// Copyright 2022 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+option java_outer_classname = "SecurityProto";
+
+package pandora;
+
+import "google/protobuf/empty.proto";
+import "google/protobuf/wrappers.proto";
+import "pandora_experimental/host.proto";
+
+// Service to trigger Bluetooth Host security pairing procedures.
+service Security {
+  // Listen to pairing events.
+  // This is handled independently from connections for several reasons:
+  // - Pairing can be triggered at any time and multiple times during the
+  //   lifetime of a connection (this also explains why this is a stream).
+  // - In BR/EDR, the specification allows for a device to authenticate before
+  //   connecting when in security mode 3 (link level enforced security).
+  rpc OnPairing(stream PairingEventAnswer) returns (stream PairingEvent);
+  // Secure (i.e. authenticate and/or encrypt) a connection with a specific
+  // security level to reach. Pairing events shall be handled through `OnPairing`
+  // if a corresponding stream has been opened prior to this call, otherwise, they
+  // shall be automatically confirmed by the host.
+  // If authentication and/or encryption procedures necessary to reach the
+  // desired security level have already been triggered before (typically as
+  // part of the connection establishment), this shall not trigger them again
+  // and only wait for the desired security level to be reached. If the desired
+  // security level has already been reached, this shall return immediately.
+  // Note: During the entire life of a connection, the security level can only
+  // be upgraded, see `SecurityLevel` and `LESecurityLevel` enumerable for
+  // details about each security level.
+  rpc Secure(SecureRequest) returns (SecureResponse);
+  // Wait for a specific connection security level to be reached. Events may
+  // be streamed through `OnPairing` if running, otherwise the host shall
+  // automatically confirm.
+  rpc WaitSecurity(WaitSecurityRequest) returns (WaitSecurityResponse);
+}
+
+// Service to trigger Bluetooth Host security persistent storage procedures.
+service SecurityStorage {
+  // Return whether or not a bond exists for a connection in the host
+  // persistent storage.
+  rpc IsBonded(IsBondedRequest) returns (google.protobuf.BoolValue);
+  // Remove a bond for a connection, if exists, from the host
+  // persistent storage.
+  rpc DeleteBond(DeleteBondRequest) returns (google.protobuf.Empty);
+}
+
+// BR/EDR pairing security levels.
+enum SecurityLevel {
+  // Level 0, for services with the following attributes:
+  // - Authentication of the remote device not required.
+  // - MITM protection not required.
+  // - No encryption required.
+  // - No user interaction required.
+  //
+  // No security.
+  // Permitted only for SDP and service data sent via either L2CAP fixed
+  // signaling channels or the L2CAP connection-less channel to PSMs that
+  // correspond to service class UUIDs which are allowed to utilize Level 0.
+  LEVEL0 = 0;
+  // Level 1, for services with the following attributes:
+  // - Authentication of the remote device required when encryption is enabled.
+  // - MITM protection not required.
+  // - Encryption not necessary.
+  // - At least 56-bit equivalent strength for encryption key when encryption is
+  //   enabled should be used.
+  // - Minimal user interaction desired.
+  //
+  // Low security level.
+  LEVEL1 = 1;
+  // Level 2, for services with the following attributes:
+  // - Authentication of the remote device required.
+  // - MITM protection not required.
+  // - Encryption required.
+  // - At least 56-bit equivalent strength for encryption key should be used.
+  //
+  // Medium security level.
+  LEVEL2 = 2;
+  // Level 3, for services with the following attributes:
+  // - Authentication of the remote device required.
+  // - MITM protection required.
+  // - Encryption required.
+  // - At least 56-bit equivalent strength for encryption key should be used.
+  // - User interaction acceptable.
+  //
+  // High security.
+  LEVEL3 = 3;
+  // Level 4, for services with the following attributes:
+  // - Authentication of the remote device required.
+  // - MITM protection required.
+  // - Encryption required.
+  // - 128-bit equivalent strength for link and encryption keys required using FIPS
+  //   approved algorithms (E0 not allowed, SAFER+ not allowed, and P-192 not
+  //   allowed; encryption key not shortened).
+  // - User interaction acceptable.
+  //
+  // Highest security level.
+  // Only possible when both devices support Secure Connections.
+  LEVEL4 = 4;
+}
+
+// Low Energy pairing security levels.
+enum LESecurityLevel {
+  // No security (No authentication and no encryption).
+  LE_LEVEL1 = 0;
+  //  Unauthenticated pairing with encryption.
+  LE_LEVEL2 = 1;
+  // Authenticated pairing with encryption.
+  LE_LEVEL3 = 2;
+  // Authenticated LE Secure Connections pairing with encryption using a 128-
+  // bit strength encryption key.
+  LE_LEVEL4 = 3;
+}
+
+message PairingEvent {
+  // Pairing event remote device.
+  oneof remote {
+    // BR/EDR only. Used when a pairing event is received before the connection
+    // being complete: when the remote controller is set in security mode 3,
+    // it shall automatically pair with the remote device before notifying
+    // the host for a connection complete.
+    bytes address = 1;
+    // BR/EDR or Low Energy connection.
+    Connection connection = 2;
+  }
+  // Pairing method used for this pairing event.
+  oneof method {
+    // "Just Works" SSP / LE pairing association
+    // model. Confirmation is automatic.
+    google.protobuf.Empty just_works = 3;
+    // Numeric Comparison SSP / LE pairing association
+    // model. Confirmation is required.
+    uint32 numeric_comparison = 4;
+    // Passkey Entry SSP / LE pairing association model.
+    // Passkey is typed by the user.
+    // Only for LE legacy pairing or on devices without a display.
+    google.protobuf.Empty passkey_entry_request = 5;
+    // Passkey Entry SSP / LE pairing association model.
+    // Passkey is shown to the user.
+    // The peer device receives a Passkey Entry request.
+    uint32 passkey_entry_notification = 6;
+    // Legacy PIN Pairing.
+    // A PIN Code is typed by the user on IUT.
+    google.protobuf.Empty pin_code_request = 7;
+    // Legacy PIN Pairing.
+    // We generate a PIN code, and the user enters it in the peer
+    // device. While this is not part of the specification, some display
+    // devices automatically generate their PIN Code, instead of asking the
+    // user to type it.
+    bytes pin_code_notification = 8;
+  }
+}
+
+message PairingEventAnswer {
+  // Received pairing event.
+  PairingEvent event = 1;
+  // Answer when needed to the pairing event method.
+  oneof answer {
+    // Numeric Comparison confirmation.
+    // Used when pairing event method is `numeric_comparison` or `just_works`.
+    bool confirm = 2;
+    // Passkey typed by the user.
+    // Used when pairing event method is `passkey_entry_request`.
+    uint32 passkey = 3;
+    // Pin typed by the user.
+    // Used when pairing event method is `pin_code_request`.
+    bytes pin = 4;
+  };
+}
+
+// Request of the `Secure` method.
+message SecureRequest {
+  // Peer connection to secure.
+  Connection connection = 1;
+  // Security level to wait for.
+  oneof level {
+    // BR/EDR (classic) level.
+    SecurityLevel classic = 2;
+    // Low Energy level.
+    LESecurityLevel le = 3;
+  }
+}
+
+// Response of the `Secure` method.
+message SecureResponse {
+  // Response result.
+  oneof result {
+    // `Secure` completed successfully.
+    google.protobuf.Empty success = 1;
+    // `Secure` was unable to reach the desired security level.
+    google.protobuf.Empty not_reached = 2;
+    // Connection died before completion.
+    google.protobuf.Empty connection_died = 3;
+    // Pairing failure error.
+    google.protobuf.Empty pairing_failure = 4;
+    // Authentication failure error.
+    google.protobuf.Empty authentication_failure = 5;
+    // Encryption failure error.
+    google.protobuf.Empty encryption_failure = 6;
+  }
+}
+
+// Request of the `WaitSecurity` method.
+message WaitSecurityRequest {
+  // Peer connection to wait security level to be reached.
+  Connection connection = 1;
+  // Security level to wait for.
+  oneof level {
+    // BR/EDR (classic) level.
+    SecurityLevel classic = 2;
+    // Low Energy level.
+    LESecurityLevel le = 3;
+  }
+}
+
+// Response of the `WaitSecurity` method.
+message WaitSecurityResponse {
+  // Response result.
+  oneof result {
+    // `WaitSecurity` completed successfully.
+    google.protobuf.Empty success = 1;
+    // Connection died before completion.
+    google.protobuf.Empty connection_died = 2;
+    // Pairing failure error.
+    google.protobuf.Empty pairing_failure = 3;
+    // Authentication failure error.
+    google.protobuf.Empty authentication_failure = 4;
+    // Encryption failure error.
+    google.protobuf.Empty encryption_failure = 5;
+  }
+}
+
+// Request of the `RequestPairing` method.
+message RequestPairingRequest {
+  // Peer connection to start pairing with.
+  Connection connection = 1;
+}
+
+// Request of the `IsBonded` method.
+message IsBondedRequest {
+  oneof address {
+    // Public device address.
+    bytes public = 1;
+    // Random device address.
+    bytes random = 2;
+  }
+}
+
+// Request of the `DeleteBond` method.
+message DeleteBondRequest {
+  oneof address {
+    // Public device address.
+    bytes public = 1;
+    // Random device address.
+    bytes random = 2;
+  }
+}
\ No newline at end of file
diff --git a/service/Android.bp b/service/Android.bp
index ca76812..cb29ce4 100644
--- a/service/Android.bp
+++ b/service/Android.bp
@@ -20,6 +20,7 @@
     name: "services.bluetooth-sources",
     srcs: [
         "java/**/*.java",
+        ":statslog-bluetooth-java-gen",
     ],
     visibility: [
         "//frameworks/base/services",
@@ -62,12 +63,14 @@
         "framework-annotations-lib",
         "framework-bluetooth-pre-jarjar",
         "app-compat-annotations",
+        "framework-statsd.stubs.module_lib",
     ],
 
     static_libs: [
         "androidx.annotation_annotation",
         "androidx.appcompat_appcompat",
         "modules-utils-shell-command-handler",
+        "bluetooth-nano-protos",
     ],
 
     apex_available: [
@@ -135,6 +138,23 @@
     output_extension: "srcjar",
 }
 
+java_library {
+    name: "bluetooth-nano-protos",
+    sdk_version: "system_current",
+    min_sdk_version: "Tiramisu",
+    proto: {
+        type: "nano",
+    },
+    srcs: [
+        ":system-messages-proto-src",
+    ],
+    libs: ["libprotobuf-java-nano"],
+    apex_available: [
+        "com.android.bluetooth",
+    ],
+    lint: { strict_updatability_linting: true },
+}
+
 platform_compat_config
 {
     name: "bluetooth-compat-config",
diff --git a/service/java/com/android/server/bluetooth/BluetoothAirplaneModeListener.java b/service/java/com/android/server/bluetooth/BluetoothAirplaneModeListener.java
index d4aad1c..67d7f12 100644
--- a/service/java/com/android/server/bluetooth/BluetoothAirplaneModeListener.java
+++ b/service/java/com/android/server/bluetooth/BluetoothAirplaneModeListener.java
@@ -18,13 +18,17 @@
 
 import android.annotation.RequiresPermission;
 import android.content.Context;
+import android.content.pm.PackageManager;
+import android.content.res.Resources;
 import android.database.ContentObserver;
 import android.os.Handler;
 import android.os.Looper;
 import android.os.Message;
+import android.os.SystemClock;
 import android.provider.Settings;
 import android.util.Log;
 
+import com.android.bluetooth.BluetoothStatsLog;
 import com.android.internal.annotations.VisibleForTesting;
 
 /**
@@ -41,18 +45,57 @@
     private static final String TAG = "BluetoothAirplaneModeListener";
     @VisibleForTesting static final String TOAST_COUNT = "bluetooth_airplane_toast_count";
 
+    // keeps track of whether wifi should remain on in airplane mode
+    public static final String WIFI_APM_STATE = "wifi_apm_state";
+    // keeps track of whether wifi and bt remains on notification was shown
+    public static final String APM_WIFI_BT_NOTIFICATION = "apm_wifi_bt_notification";
+    // keeps track of whether bt remains on notification was shown
+    public static final String APM_BT_NOTIFICATION = "apm_bt_notification";
+    // keeps track of whether airplane mode enhancement feature is enabled
+    public static final String APM_ENHANCEMENT = "apm_enhancement_enabled";
+    // keeps track of whether user changed bt state in airplane mode
+    public static final String APM_USER_TOGGLED_BLUETOOTH = "apm_user_toggled_bluetooth";
+    // keeps track of whether bt should remain on in airplane mode
+    public static final String BLUETOOTH_APM_STATE = "bluetooth_apm_state";
+    // keeps track of what the default value for bt should be in airplane mode
+    public static final String BT_DEFAULT_APM_STATE = "bt_default_apm_state";
+    // keeps track of whether user enabling bt notification was shown
+    public static final String APM_BT_ENABLED_NOTIFICATION = "apm_bt_enabled_notification";
+
     private static final int MSG_AIRPLANE_MODE_CHANGED = 0;
+    public static final int NOTIFICATION_NOT_SHOWN = 0;
+    public static final int NOTIFICATION_SHOWN = 1;
+    public static final int UNUSED = 0;
+    public static final int USED = 1;
 
     @VisibleForTesting static final int MAX_TOAST_COUNT = 10; // 10 times
 
+    /* Tracks the bluetooth state before entering airplane mode*/
+    private boolean mIsBluetoothOnBeforeApmToggle = false;
+    /* Tracks the bluetooth state after entering airplane mode*/
+    private boolean mIsBluetoothOnAfterApmToggle = false;
+    /* Tracks whether user toggled bluetooth in airplane mode */
+    private boolean mUserToggledBluetoothDuringApm = false;
+    /* Tracks whether user toggled bluetooth in airplane mode within one minute */
+    private boolean mUserToggledBluetoothDuringApmWithinMinute = false;
+    /* Tracks whether media profile was connected before entering airplane mode */
+    private boolean mIsMediaProfileConnectedBeforeApmToggle = false;
+    /* Tracks when airplane mode has been enabled */
+    private long mApmEnabledTime = 0;
+
     private final BluetoothManagerService mBluetoothManager;
     private final BluetoothAirplaneModeHandler mHandler;
+    private final Context mContext;
     private BluetoothModeChangeHelper mAirplaneHelper;
+    private BluetoothNotificationManager mNotificationManager;
 
     @VisibleForTesting int mToastCount = 0;
 
-    BluetoothAirplaneModeListener(BluetoothManagerService service, Looper looper, Context context) {
+    BluetoothAirplaneModeListener(BluetoothManagerService service, Looper looper, Context context,
+            BluetoothNotificationManager notificationManager) {
         mBluetoothManager = service;
+        mNotificationManager = notificationManager;
+        mContext = context;
 
         mHandler = new BluetoothAirplaneModeHandler(looper);
         context.getContentResolver().registerContentObserver(
@@ -110,32 +153,137 @@
     @VisibleForTesting
     @RequiresPermission(android.Manifest.permission.BLUETOOTH_PRIVILEGED)
     void handleAirplaneModeChange() {
-        if (shouldSkipAirplaneModeChange()) {
-            Log.i(TAG, "Ignore airplane mode change");
-            // Airplane mode enabled when Bluetooth is being used for audio/headering aid.
-            // Bluetooth is not disabled in such case, only state is changed to
-            // BLUETOOTH_ON_AIRPLANE mode.
-            mAirplaneHelper.setSettingsInt(Settings.Global.BLUETOOTH_ON,
-                    BluetoothManagerService.BLUETOOTH_ON_AIRPLANE);
-            if (shouldPopToast()) {
-                mAirplaneHelper.showToastMessage();
-            }
+        if (mAirplaneHelper == null) {
             return;
         }
-        if (mAirplaneHelper != null) {
-            mAirplaneHelper.onAirplaneModeChanged(mBluetoothManager);
+        if (mAirplaneHelper.isAirplaneModeOn()) {
+            mApmEnabledTime = SystemClock.elapsedRealtime();
+            mIsBluetoothOnBeforeApmToggle = mAirplaneHelper.isBluetoothOn();
+            mIsBluetoothOnAfterApmToggle = shouldSkipAirplaneModeChange();
+            mIsMediaProfileConnectedBeforeApmToggle = mAirplaneHelper.isMediaProfileConnected();
+            if (mIsBluetoothOnAfterApmToggle) {
+                Log.i(TAG, "Ignore airplane mode change");
+                // Airplane mode enabled when Bluetooth is being used for audio/headering aid.
+                // Bluetooth is not disabled in such case, only state is changed to
+                // BLUETOOTH_ON_AIRPLANE mode.
+                mAirplaneHelper.setSettingsInt(Settings.Global.BLUETOOTH_ON,
+                        BluetoothManagerService.BLUETOOTH_ON_AIRPLANE);
+                if (!isApmEnhancementEnabled() || !isBluetoothToggledOnApm()) {
+                    if (shouldPopToast()) {
+                        mAirplaneHelper.showToastMessage();
+                    }
+                } else {
+                    if (isWifiEnabledOnApm() && isFirstTimeNotification(APM_WIFI_BT_NOTIFICATION)) {
+                        try {
+                            sendApmNotification("bluetooth_and_wifi_stays_on_title",
+                                    "bluetooth_and_wifi_stays_on_message",
+                                    APM_WIFI_BT_NOTIFICATION);
+                        } catch (Exception e) {
+                            Log.e(TAG,
+                                    "APM enhancement BT and Wi-Fi stays on notification not shown");
+                        }
+                    } else if (!isWifiEnabledOnApm() && isFirstTimeNotification(
+                            APM_BT_NOTIFICATION)) {
+                        try {
+                            sendApmNotification("bluetooth_stays_on_title",
+                                    "bluetooth_stays_on_message",
+                                    APM_BT_NOTIFICATION);
+                        } catch (Exception e) {
+                            Log.e(TAG, "APM enhancement BT stays on notification not shown");
+                        }
+                    }
+                }
+                return;
+            }
+        } else {
+            BluetoothStatsLog.write(BluetoothStatsLog.AIRPLANE_MODE_SESSION_REPORTED,
+                    BluetoothStatsLog.AIRPLANE_MODE_SESSION_REPORTED__PACKAGE_NAME__BLUETOOTH,
+                    mIsBluetoothOnBeforeApmToggle,
+                    mIsBluetoothOnAfterApmToggle,
+                    mAirplaneHelper.isBluetoothOn(),
+                    isBluetoothToggledOnApm(),
+                    mUserToggledBluetoothDuringApm,
+                    mUserToggledBluetoothDuringApmWithinMinute,
+                    mIsMediaProfileConnectedBeforeApmToggle);
+            mUserToggledBluetoothDuringApm = false;
+            mUserToggledBluetoothDuringApmWithinMinute = false;
         }
+        mAirplaneHelper.onAirplaneModeChanged(mBluetoothManager);
     }
 
     @VisibleForTesting
     boolean shouldSkipAirplaneModeChange() {
-        if (mAirplaneHelper == null) {
-            return false;
+        boolean apmEnhancementUsed = isApmEnhancementEnabled() && isBluetoothToggledOnApm();
+
+        // APM feature disabled or user has not used the feature yet by changing BT state in APM
+        // BT will only remain on in APM when media profile is connected
+        if (!apmEnhancementUsed && mAirplaneHelper.isBluetoothOn()
+                && mAirplaneHelper.isMediaProfileConnected()) {
+            return true;
         }
-        if (!mAirplaneHelper.isBluetoothOn() || !mAirplaneHelper.isAirplaneModeOn()
-                || !mAirplaneHelper.isMediaProfileConnected()) {
-            return false;
+        // APM feature enabled and user has used the feature by changing BT state in APM
+        // BT will only remain on in APM based on user's last action in APM
+        if (apmEnhancementUsed && mAirplaneHelper.isBluetoothOn()
+                && mAirplaneHelper.isBluetoothOnAPM()) {
+            return true;
         }
-        return true;
+        // APM feature enabled and user has not used the feature yet by changing BT state in APM
+        // BT will only remain on in APM if the default value is set to on
+        if (isApmEnhancementEnabled() && !isBluetoothToggledOnApm()
+                && mAirplaneHelper.isBluetoothOn()
+                && mAirplaneHelper.isBluetoothOnAPM()) {
+            return true;
+        }
+        return false;
+    }
+
+    private boolean isApmEnhancementEnabled() {
+        return mAirplaneHelper.getSettingsInt(APM_ENHANCEMENT) == 1;
+    }
+
+    private boolean isBluetoothToggledOnApm() {
+        return mAirplaneHelper.getSettingsSecureInt(APM_USER_TOGGLED_BLUETOOTH, UNUSED) == USED;
+    }
+
+    private boolean isWifiEnabledOnApm() {
+        return mAirplaneHelper.getSettingsInt(Settings.Global.WIFI_ON) != 0
+                && mAirplaneHelper.getSettingsSecureInt(WIFI_APM_STATE, 0) == 1;
+    }
+
+    private boolean isFirstTimeNotification(String name) {
+        return mAirplaneHelper.getSettingsSecureInt(
+                name, NOTIFICATION_NOT_SHOWN) == NOTIFICATION_NOT_SHOWN;
+    }
+
+    /**
+     * Helper method to send APM notification
+     */
+    public void sendApmNotification(String titleId, String messageId, String notificationState)
+            throws PackageManager.NameNotFoundException {
+        String btPackageName = mAirplaneHelper.getBluetoothPackageName();
+        if (btPackageName == null) {
+            Log.e(TAG, "Unable to find Bluetooth package name with "
+                    + "APM notification resources");
+            return;
+        }
+        Resources resources = mContext.getPackageManager()
+                .getResourcesForApplication(btPackageName);
+        int title = resources.getIdentifier(titleId, "string", btPackageName);
+        int message = resources.getIdentifier(messageId, "string", btPackageName);
+        mNotificationManager.sendApmNotification(
+                resources.getString(title), resources.getString(message));
+        mAirplaneHelper.setSettingsSecureInt(notificationState,
+                NOTIFICATION_SHOWN);
+    }
+
+    /**
+     * Helper method to update whether user toggled Bluetooth in airplane mode
+     */
+    public void updateBluetoothToggledTime() {
+        if (!mUserToggledBluetoothDuringApm) {
+            mUserToggledBluetoothDuringApmWithinMinute =
+                    SystemClock.elapsedRealtime() - mApmEnabledTime < 60000;
+        }
+        mUserToggledBluetoothDuringApm = true;
     }
 }
diff --git a/service/java/com/android/server/bluetooth/BluetoothDeviceConfigChangeTracker.java b/service/java/com/android/server/bluetooth/BluetoothDeviceConfigChangeTracker.java
new file mode 100644
index 0000000..a035338
--- /dev/null
+++ b/service/java/com/android/server/bluetooth/BluetoothDeviceConfigChangeTracker.java
@@ -0,0 +1,85 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.server.bluetooth;
+
+import android.provider.DeviceConfig;
+import android.provider.DeviceConfig.Properties;
+import android.util.Log;
+
+import java.util.ArrayList;
+import java.util.HashMap;
+
+/**
+ * The BluetoothDeviceConfigChangeTracker receives changes to the DeviceConfig for
+ * NAMESPACE_BLUETOOTH, and determines whether we should queue a restart, if any Bluetooth-related
+ * INIT_ flags have been changed.
+ *
+ * <p>The initialProperties should be fetched from the BLUETOOTH namespace in DeviceConfig
+ */
+public final class BluetoothDeviceConfigChangeTracker {
+    private static final String TAG = "BluetoothDeviceConfigChangeTracker";
+
+    private final HashMap<String, String> mCurrFlags;
+
+    public BluetoothDeviceConfigChangeTracker(Properties initialProperties) {
+        mCurrFlags = getFlags(initialProperties);
+    }
+
+    /**
+     * Updates the instance state tracking the latest init flag values, and determines whether an
+     * init flag has changed (requiring a restart at some point)
+     */
+    public boolean shouldRestartWhenPropertiesUpdated(Properties newProperties) {
+        if (!newProperties.getNamespace().equals(DeviceConfig.NAMESPACE_BLUETOOTH)) {
+            return false;
+        }
+        ArrayList<String> flags = new ArrayList<>();
+        for (String name : newProperties.getKeyset()) {
+            flags.add(name + "='" + newProperties.getString(name, "") + "'");
+        }
+        Log.d(TAG, "shouldRestartWhenPropertiesUpdated: " + String.join(",", flags));
+        boolean shouldRestart = false;
+        for (String name : newProperties.getKeyset()) {
+            if (!isInitFlag(name)) {
+                continue;
+            }
+            var oldValue = mCurrFlags.get(name);
+            var newValue = newProperties.getString(name, "");
+            if (newValue.equals(oldValue)) {
+                continue;
+            }
+            Log.d(TAG, "Property " + name + " changed from " + oldValue + " -> " + newValue);
+            mCurrFlags.put(name, newValue);
+            shouldRestart = true;
+        }
+        return shouldRestart;
+    }
+
+    private HashMap<String, String> getFlags(Properties initialProperties) {
+        var out = new HashMap();
+        for (var name : initialProperties.getKeyset()) {
+            if (isInitFlag(name)) {
+                out.put(name, initialProperties.getString(name, ""));
+            }
+        }
+        return out;
+    }
+
+    private Boolean isInitFlag(String flagName) {
+        return flagName.startsWith("INIT_");
+    }
+}
diff --git a/service/java/com/android/server/bluetooth/BluetoothDeviceConfigListener.java b/service/java/com/android/server/bluetooth/BluetoothDeviceConfigListener.java
index 62860a5..13490c2 100644
--- a/service/java/com/android/server/bluetooth/BluetoothDeviceConfigListener.java
+++ b/service/java/com/android/server/bluetooth/BluetoothDeviceConfigListener.java
@@ -16,10 +16,13 @@
 
 package com.android.server.bluetooth;
 
-import android.provider.DeviceConfig;
-import android.util.Log;
+import static com.android.server.bluetooth.BluetoothAirplaneModeListener.APM_ENHANCEMENT;
+import static com.android.server.bluetooth.BluetoothAirplaneModeListener.BT_DEFAULT_APM_STATE;
 
-import java.util.ArrayList;
+import android.content.Context;
+import android.provider.DeviceConfig;
+import android.provider.Settings;
+import android.util.Log;
 
 /**
  * The BluetoothDeviceConfigListener handles system device config change callback and checks
@@ -33,44 +36,70 @@
 public class BluetoothDeviceConfigListener {
     private static final String TAG = "BluetoothDeviceConfigListener";
 
+    private static final int DEFAULT_APM_ENHANCEMENT = 0;
+    private static final int DEFAULT_BT_APM_STATE = 0;
+
     private final BluetoothManagerService mService;
     private final boolean mLogDebug;
+    private final Context mContext;
+    private final BluetoothDeviceConfigChangeTracker mConfigChangeTracker;
 
-    BluetoothDeviceConfigListener(BluetoothManagerService service, boolean logDebug) {
+    private boolean mPrevApmEnhancement;
+    private boolean mPrevBtApmState;
+
+    BluetoothDeviceConfigListener(BluetoothManagerService service, boolean logDebug,
+            Context context) {
         mService = service;
         mLogDebug = logDebug;
+        mContext = context;
+        mConfigChangeTracker =
+                new BluetoothDeviceConfigChangeTracker(
+                        DeviceConfig.getProperties(DeviceConfig.NAMESPACE_BLUETOOTH));
+        updateApmConfigs();
         DeviceConfig.addOnPropertiesChangedListener(
                 DeviceConfig.NAMESPACE_BLUETOOTH,
                 (Runnable r) -> r.run(),
                 mDeviceConfigChangedListener);
     }
 
+    private void updateApmConfigs() {
+        mPrevApmEnhancement = DeviceConfig.getBoolean(DeviceConfig.NAMESPACE_BLUETOOTH,
+                APM_ENHANCEMENT, false);
+        mPrevBtApmState = DeviceConfig.getBoolean(DeviceConfig.NAMESPACE_BLUETOOTH,
+                BT_DEFAULT_APM_STATE, false);
+
+        Settings.Global.putInt(mContext.getContentResolver(),
+                APM_ENHANCEMENT, mPrevApmEnhancement ? 1 : 0);
+        Settings.Global.putInt(mContext.getContentResolver(),
+                BT_DEFAULT_APM_STATE, mPrevBtApmState ? 1 : 0);
+    }
+
     private final DeviceConfig.OnPropertiesChangedListener mDeviceConfigChangedListener =
             new DeviceConfig.OnPropertiesChangedListener() {
                 @Override
-                public void onPropertiesChanged(DeviceConfig.Properties properties) {
-                    if (!properties.getNamespace().equals(DeviceConfig.NAMESPACE_BLUETOOTH)) {
-                        return;
+                public void onPropertiesChanged(DeviceConfig.Properties newProperties) {
+                    boolean apmEnhancement = newProperties.getBoolean(
+                            APM_ENHANCEMENT, mPrevApmEnhancement);
+                    if (apmEnhancement != mPrevApmEnhancement) {
+                        mPrevApmEnhancement = apmEnhancement;
+                        Settings.Global.putInt(mContext.getContentResolver(),
+                                APM_ENHANCEMENT, apmEnhancement ? 1 : 0);
                     }
-                    if (mLogDebug) {
-                        ArrayList<String> flags = new ArrayList<>();
-                        for (String name : properties.getKeyset()) {
-                            flags.add(name + "='" + properties.getString(name, "") + "'");
-                        }
-                        Log.d(TAG, "onPropertiesChanged: " + String.join(",", flags));
+
+                    boolean btApmState = newProperties.getBoolean(
+                            BT_DEFAULT_APM_STATE, mPrevBtApmState);
+                    if (btApmState != mPrevBtApmState) {
+                        mPrevBtApmState = btApmState;
+                        Settings.Global.putInt(mContext.getContentResolver(),
+                                BT_DEFAULT_APM_STATE, btApmState ? 1 : 0);
                     }
-                    boolean foundInit = false;
-                    for (String name : properties.getKeyset()) {
-                        if (name.startsWith("INIT_")) {
-                            foundInit = true;
-                            break;
-                        }
+
+                    if (mConfigChangeTracker.shouldRestartWhenPropertiesUpdated(newProperties)) {
+                        Log.d(TAG, "Properties changed, enqueuing restart");
+                        mService.onInitFlagsChanged();
+                    } else {
+                        Log.d(TAG, "All properties unchanged, skipping restart");
                     }
-                    if (!foundInit) {
-                        return;
-                    }
-                    mService.onInitFlagsChanged();
                 }
             };
-
 }
diff --git a/service/java/com/android/server/bluetooth/BluetoothManagerService.java b/service/java/com/android/server/bluetooth/BluetoothManagerService.java
index d3aec71..994b438 100644
--- a/service/java/com/android/server/bluetooth/BluetoothManagerService.java
+++ b/service/java/com/android/server/bluetooth/BluetoothManagerService.java
@@ -21,6 +21,13 @@
 import static android.permission.PermissionManager.PERMISSION_GRANTED;
 import static android.permission.PermissionManager.PERMISSION_HARD_DENIED;
 
+import static com.android.server.bluetooth.BluetoothAirplaneModeListener.APM_BT_ENABLED_NOTIFICATION;
+import static com.android.server.bluetooth.BluetoothAirplaneModeListener.APM_ENHANCEMENT;
+import static com.android.server.bluetooth.BluetoothAirplaneModeListener.APM_USER_TOGGLED_BLUETOOTH;
+import static com.android.server.bluetooth.BluetoothAirplaneModeListener.BLUETOOTH_APM_STATE;
+import static com.android.server.bluetooth.BluetoothAirplaneModeListener.NOTIFICATION_NOT_SHOWN;
+import static com.android.server.bluetooth.BluetoothAirplaneModeListener.USED;
+
 import android.Manifest;
 import android.annotation.NonNull;
 import android.annotation.RequiresPermission;
@@ -39,8 +46,6 @@
 import android.bluetooth.IBluetooth;
 import android.bluetooth.IBluetoothCallback;
 import android.bluetooth.IBluetoothGatt;
-import android.bluetooth.IBluetoothHeadset;
-import android.bluetooth.IBluetoothLeCallControl;
 import android.bluetooth.IBluetoothManager;
 import android.bluetooth.IBluetoothManagerCallback;
 import android.bluetooth.IBluetoothProfileServiceConnection;
@@ -182,6 +187,9 @@
     @VisibleForTesting
     static final int BLUETOOTH_ON_AIRPLANE = 2;
 
+    private static final int BLUETOOTH_OFF_APM = 0;
+    private static final int BLUETOOTH_ON_APM = 1;
+
     private static final int SERVICE_IBLUETOOTH = 1;
     private static final int SERVICE_IBLUETOOTHGATT = 2;
 
@@ -227,6 +235,8 @@
 
     private BluetoothDeviceConfigListener mBluetoothDeviceConfigListener;
 
+    private BluetoothNotificationManager mBluetoothNotificationManager;
+
     // used inside handler thread
     private boolean mQuietEnable = false;
     private boolean mEnable;
@@ -292,6 +302,8 @@
     // Save a ProfileServiceConnections object for each of the bound
     // bluetooth profile services
     private final Map<Integer, ProfileServiceConnections> mProfileServices = new HashMap<>();
+    @GuardedBy("mProfileServices")
+    private boolean mUnbindingAll = false;
 
     private final IBluetoothCallback mBluetoothCallback = new IBluetoothCallback.Stub() {
         @Override
@@ -307,7 +319,6 @@
                 UserManager.DISALLOW_BLUETOOTH, userHandle);
         boolean newBluetoothSharingDisallowed = mUserManager.hasUserRestrictionForUser(
                 UserManager.DISALLOW_BLUETOOTH_SHARING, userHandle);
-
         // DISALLOW_BLUETOOTH can only be set by DO or PO on the system user.
         if (userHandle == UserHandle.SYSTEM) {
             if (newBluetoothDisallowed) {
@@ -324,10 +335,7 @@
 
     @VisibleForTesting
     public void onInitFlagsChanged() {
-        mHandler.removeMessages(MESSAGE_INIT_FLAGS_CHANGED);
-        mHandler.sendEmptyMessageDelayed(
-                MESSAGE_INIT_FLAGS_CHANGED,
-                DELAY_BEFORE_RESTART_DUE_TO_INIT_FLAGS_CHANGED_MS);
+        // TODO(b/265386284)
     }
 
     public boolean onFactoryReset(AttributionSource attributionSource) {
@@ -542,6 +550,8 @@
 
         mUserManager = mContext.getSystemService(UserManager.class);
 
+        mBluetoothNotificationManager = new BluetoothNotificationManager(mContext);
+
         mIsHearingAidProfileSupported =
                 BluetoothProperties.isProfileAshaCentralEnabled().orElse(false);
 
@@ -602,7 +612,8 @@
         if (airplaneModeRadios == null || airplaneModeRadios.contains(
                 Settings.Global.RADIO_BLUETOOTH)) {
             mBluetoothAirplaneModeListener = new BluetoothAirplaneModeListener(
-                    this, mBluetoothHandlerThread.getLooper(), context);
+                    this, mBluetoothHandlerThread.getLooper(), context,
+                    mBluetoothNotificationManager);
         }
 
         int systemUiUid = -1;
@@ -627,6 +638,13 @@
                 Settings.Global.AIRPLANE_MODE_ON, 0) == 1;
     }
 
+    /**
+     *  Returns true if airplane mode enhancement feature is enabled
+     */
+    private boolean isApmEnhancementOn() {
+        return Settings.Global.getInt(mContext.getContentResolver(), APM_ENHANCEMENT, 0) == 1;
+    }
+
     private boolean supportBluetoothPersistedState() {
         // Set default support to true to copy config default.
         return BluetoothProperties.isSupportPersistedStateEnabled().orElse(true);
@@ -686,6 +704,43 @@
     }
 
     /**
+     *  Set the Settings Secure Int value for foreground user
+     */
+    private void setSettingsSecureInt(String name, int value) {
+        if (DBG) {
+            Log.d(TAG, "Persisting Settings Secure Int: " + name + "=" + value);
+        }
+
+        // waive WRITE_SECURE_SETTINGS permission check
+        final long callingIdentity = Binder.clearCallingIdentity();
+        try {
+            Context userContext = mContext.createContextAsUser(
+                    UserHandle.of(ActivityManager.getCurrentUser()), 0);
+            Settings.Secure.putInt(userContext.getContentResolver(), name, value);
+        } finally {
+            Binder.restoreCallingIdentity(callingIdentity);
+        }
+    }
+
+    /**
+     *  Return whether APM notification has been shown
+     */
+    private boolean isFirstTimeNotification(String name) {
+        boolean firstTime = false;
+        // waive WRITE_SECURE_SETTINGS permission check
+        final long callingIdentity = Binder.clearCallingIdentity();
+        try {
+            Context userContext = mContext.createContextAsUser(
+                    UserHandle.of(ActivityManager.getCurrentUser()), 0);
+            firstTime = Settings.Secure.getInt(userContext.getContentResolver(), name,
+                    NOTIFICATION_NOT_SHOWN) == NOTIFICATION_NOT_SHOWN;
+        } finally {
+            Binder.restoreCallingIdentity(callingIdentity);
+        }
+        return firstTime;
+    }
+
+    /**
      * Returns true if the Bluetooth Adapter's name and address is
      * locally cached
      * @return
@@ -913,7 +968,7 @@
     }
 
     public int getState() {
-        if ((Binder.getCallingUid() != Process.SYSTEM_UID) && (!checkIfCallerIsForegroundUser())) {
+        if (!isCallerSystem(getCallingAppId()) && !checkIfCallerIsForegroundUser()) {
             Log.w(TAG, "getState(): report OFF for non-active and non system user");
             return BluetoothAdapter.STATE_OFF;
         }
@@ -1090,11 +1145,11 @@
             }
             return false;
         }
-        // Check if packageName belongs to callingUid
-        final int callingUid = Binder.getCallingUid();
-        final boolean isCallerSystem = UserHandle.getAppId(callingUid) == Process.SYSTEM_UID;
-        if (!isCallerSystem && callingUid != Process.SHELL_UID) {
-            checkPackage(callingUid, attributionSource.getPackageName());
+        int callingAppId = getCallingAppId();
+        if (!isCallerSystem(callingAppId)
+                && !isCallerShell(callingAppId)
+                && !isCallerRoot(callingAppId)) {
+            checkPackage(attributionSource.getPackageName());
 
             if (requireForeground && !checkIfCallerIsForegroundUser()) {
                 Log.w(TAG, "Not allowed for non-active and non system user");
@@ -1321,6 +1376,26 @@
         synchronized (mReceiver) {
             mQuietEnableExternal = false;
             mEnableExternal = true;
+            if (isAirplaneModeOn()) {
+                mBluetoothAirplaneModeListener.updateBluetoothToggledTime();
+                if (isApmEnhancementOn()) {
+                    setSettingsSecureInt(BLUETOOTH_APM_STATE, BLUETOOTH_ON_APM);
+                    setSettingsSecureInt(APM_USER_TOGGLED_BLUETOOTH, USED);
+                    if (isFirstTimeNotification(APM_BT_ENABLED_NOTIFICATION)) {
+                        final long callingIdentity = Binder.clearCallingIdentity();
+                        try {
+                            mBluetoothAirplaneModeListener.sendApmNotification(
+                                    "bluetooth_enabled_apm_title",
+                                    "bluetooth_enabled_apm_message",
+                                    APM_BT_ENABLED_NOTIFICATION);
+                        } catch (Exception e) {
+                            Log.e(TAG, "APM enhancement BT enabled notification not shown");
+                        } finally {
+                            Binder.restoreCallingIdentity(callingIdentity);
+                        }
+                    }
+                }
+            }
             // waive WRITE_SECURE_SETTINGS permission check
             sendEnableMsg(false,
                     BluetoothProtoEnums.ENABLE_DISABLE_REASON_APPLICATION_REQUEST, packageName);
@@ -1361,12 +1436,18 @@
         }
 
         synchronized (mReceiver) {
-            if (!isBluetoothPersistedStateOnAirplane()) {
-                if (persist) {
-                    persistBluetoothSetting(BLUETOOTH_OFF);
+            if (isAirplaneModeOn()) {
+                mBluetoothAirplaneModeListener.updateBluetoothToggledTime();
+                if (isApmEnhancementOn()) {
+                    setSettingsSecureInt(BLUETOOTH_APM_STATE, BLUETOOTH_OFF_APM);
+                    setSettingsSecureInt(APM_USER_TOGGLED_BLUETOOTH, USED);
                 }
-                mEnableExternal = false;
             }
+
+            if (persist) {
+                persistBluetoothSetting(BLUETOOTH_OFF);
+            }
+            mEnableExternal = false;
             sendDisableMsg(BluetoothProtoEnums.ENABLE_DISABLE_REASON_APPLICATION_REQUEST,
                     packageName);
         }
@@ -1374,24 +1455,27 @@
     }
 
     /**
-     * Check if AppOpsManager is available and the packageName belongs to uid
+     * Check if AppOpsManager is available and the packageName belongs to calling uid
      *
      * A null package belongs to any uid
      */
-    private void checkPackage(int uid, String packageName) {
+    private void checkPackage(String packageName) {
+        int callingUid = Binder.getCallingUid();
+
         if (mAppOps == null) {
             Log.w(TAG, "checkPackage(): called before system boot up, uid "
-                    + uid + ", packageName " + packageName);
+                    + callingUid + ", packageName " + packageName);
             throw new IllegalStateException("System has not boot yet");
         }
         if (packageName == null) {
-            Log.w(TAG, "checkPackage(): called with null packageName from " + uid);
+            Log.w(TAG, "checkPackage(): called with null packageName from " + callingUid);
             return;
         }
+
         try {
-            mAppOps.checkPackage(uid, packageName);
+            mAppOps.checkPackage(callingUid, packageName);
         } catch (SecurityException e) {
-            Log.w(TAG, "checkPackage(): " + packageName + " does not belong to uid " + uid);
+            Log.w(TAG, "checkPackage(): " + packageName + " does not belong to uid " + callingUid);
             throw new SecurityException(e.getMessage());
         }
     }
@@ -1457,7 +1541,7 @@
     }
 
     @Override
-    public boolean bindBluetoothProfileService(int bluetoothProfile,
+    public boolean bindBluetoothProfileService(int bluetoothProfile, String serviceName,
             IBluetoothProfileServiceConnection proxy) {
         if (mState != BluetoothAdapter.STATE_ON) {
             if (DBG) {
@@ -1467,23 +1551,19 @@
             return false;
         }
         synchronized (mProfileServices) {
-            ProfileServiceConnections psc = mProfileServices.get(new Integer(bluetoothProfile));
-            Intent intent;
-            if (bluetoothProfile == BluetoothProfile.HEADSET
-                    && mSupportedProfileList.contains(BluetoothProfile.HEADSET)) {
-                intent = new Intent(IBluetoothHeadset.class.getName());
-            } else if (bluetoothProfile == BluetoothProfile.LE_CALL_CONTROL
-                    && mSupportedProfileList.contains(BluetoothProfile.LE_CALL_CONTROL)) {
-                intent = new Intent(IBluetoothLeCallControl.class.getName());
-            } else {
+            if (!mSupportedProfileList.contains(bluetoothProfile)) {
+                Log.w(TAG, "Cannot bind profile: "  + bluetoothProfile
+                        + ", not in supported profiles list");
                 return false;
             }
+            ProfileServiceConnections psc =
+                    mProfileServices.get(Integer.valueOf(bluetoothProfile));
             if (psc == null) {
                 if (DBG) {
                     Log.d(TAG, "Creating new ProfileServiceConnections object for" + " profile: "
                             + bluetoothProfile);
                 }
-                psc = new ProfileServiceConnections(intent);
+                psc = new ProfileServiceConnections(new Intent(serviceName));
                 if (!psc.bindService(DEFAULT_REBIND_COUNT)) {
                     return false;
                 }
@@ -1517,13 +1597,16 @@
                 } catch (IllegalArgumentException e) {
                     Log.e(TAG, "Unable to unbind service with intent: " + psc.mIntent, e);
                 }
-                mProfileServices.remove(profile);
+                if (!mUnbindingAll) {
+                    mProfileServices.remove(profile);
+                }
             }
         }
     }
 
     private void unbindAllBluetoothProfileServices() {
         synchronized (mProfileServices) {
+            mUnbindingAll = true;
             for (Integer i : mProfileServices.keySet()) {
                 ProfileServiceConnections psc = mProfileServices.get(i);
                 try {
@@ -1533,6 +1616,7 @@
                 }
                 psc.removeAllProxies();
             }
+            mUnbindingAll = false;
             mProfileServices.clear();
         }
     }
@@ -1571,7 +1655,7 @@
             mBluetoothAirplaneModeListener.start(mBluetoothModeChangeHelper);
         }
         registerForProvisioningStateChange();
-        mBluetoothDeviceConfigListener = new BluetoothDeviceConfigListener(this, DBG);
+        mBluetoothDeviceConfigListener = new BluetoothDeviceConfigListener(this, DBG, mContext);
     }
 
     /**
@@ -1831,7 +1915,7 @@
             return null;
         }
 
-        if ((Binder.getCallingUid() != Process.SYSTEM_UID) && (!checkIfCallerIsForegroundUser())) {
+        if (!isCallerSystem(getCallingAppId()) && !checkIfCallerIsForegroundUser()) {
             Log.w(TAG, "getAddress(): not allowed for non-active and non system user");
             return null;
         }
@@ -1865,7 +1949,7 @@
             return null;
         }
 
-        if ((Binder.getCallingUid() != Process.SYSTEM_UID) && (!checkIfCallerIsForegroundUser())) {
+        if (!isCallerSystem(getCallingAppId()) && !checkIfCallerIsForegroundUser()) {
             Log.w(TAG, "getName(): not allowed for non-active and non system user");
             return null;
         }
@@ -2428,6 +2512,7 @@
                         Log.d(TAG, "MESSAGE_USER_SWITCHED");
                     }
                     mHandler.removeMessages(MESSAGE_USER_SWITCHED);
+                    mBluetoothNotificationManager.createNotificationChannels();
 
                     /* disable and enable BT when detect a user switch */
                     if (mBluetooth != null && isEnabled()) {
@@ -2636,6 +2721,19 @@
         }
     }
 
+    private static int getCallingAppId() {
+        return UserHandle.getAppId(Binder.getCallingUid());
+    }
+    private static boolean isCallerSystem(int callingAppId) {
+        return callingAppId == Process.SYSTEM_UID;
+    }
+    private static boolean isCallerShell(int callingAppId) {
+        return callingAppId == Process.SHELL_UID;
+    }
+    private static boolean isCallerRoot(int callingAppId) {
+        return callingAppId == Process.ROOT_UID;
+    }
+
     private boolean checkIfCallerIsForegroundUser() {
         int callingUid = Binder.getCallingUid();
         UserHandle callingUser = UserHandle.getUserHandleForUid(callingUid);
@@ -2753,11 +2851,18 @@
             sendBluetoothStateCallback(isUp);
             sendBleStateChanged(prevState, newState);
 
-        } else if (newState == BluetoothAdapter.STATE_BLE_TURNING_ON
-                || newState == BluetoothAdapter.STATE_BLE_TURNING_OFF) {
+        } else if (newState == BluetoothAdapter.STATE_BLE_TURNING_ON) {
             sendBleStateChanged(prevState, newState);
             isStandardBroadcast = false;
-
+        } else if (newState == BluetoothAdapter.STATE_BLE_TURNING_OFF) {
+            sendBleStateChanged(prevState, newState);
+            if (prevState != BluetoothAdapter.STATE_TURNING_OFF) {
+                isStandardBroadcast = false;
+            } else {
+                // Broadcast as STATE_OFF for app that do not receive BLE update
+                newState = BluetoothAdapter.STATE_OFF;
+                sendBrEdrDownCallback(mContext.getAttributionSource());
+            }
         } else if (newState == BluetoothAdapter.STATE_TURNING_ON
                 || newState == BluetoothAdapter.STATE_TURNING_OFF) {
             sendBleStateChanged(prevState, newState);
@@ -2782,15 +2887,25 @@
         }
     }
 
+    boolean waitForManagerState(int state) {
+        return waitForState(Set.of(state), false);
+    }
+
     private boolean waitForState(Set<Integer> states) {
-        int i = 0;
-        while (i < 10) {
+        return waitForState(states, true);
+    }
+    private boolean waitForState(Set<Integer> states, boolean failIfUnbind) {
+        for (int i = 0; i < 10; i++) {
+            mBluetoothLock.readLock().lock();
             try {
-                mBluetoothLock.readLock().lock();
-                if (mBluetooth == null) {
-                    break;
+                if (mBluetooth == null && failIfUnbind) {
+                    Log.e(TAG, "waitForState " + states + " Bluetooth is not unbind");
+                    return false;
                 }
-                if (states.contains(synchronousGetState())) {
+                if (mBluetooth == null && states.contains(BluetoothAdapter.STATE_OFF)) {
+                    return true; // We are so OFF that the bluetooth is not bind
+                }
+                if (mBluetooth != null && states.contains(synchronousGetState())) {
                     return true;
                 }
             } catch (RemoteException | TimeoutException e) {
@@ -2800,7 +2915,6 @@
                 mBluetoothLock.readLock().unlock();
             }
             SystemClock.sleep(300);
-            i++;
         }
         Log.e(TAG, "waitForState " + states + " time out");
         return false;
@@ -2933,7 +3047,18 @@
                 newState = PackageManager.COMPONENT_ENABLED_STATE_DEFAULT;
             }
 
-            String launcherActivity = "com.android.bluetooth.opp.BluetoothOppLauncherActivity";
+            // Bluetooth OPP activities that should always be enabled,
+            // even when Bluetooth is turned OFF.
+            ArrayList<String> baseBluetoothOppActivities = new ArrayList<String>() {
+                {
+                    // Base sharing activity
+                    add("com.android.bluetooth.opp.BluetoothOppLauncherActivity");
+                    // BT enable activities
+                    add("com.android.bluetooth.opp.BluetoothOppBtEnableActivity");
+                    add("com.android.bluetooth.opp.BluetoothOppBtEnablingActivity");
+                    add("com.android.bluetooth.opp.BluetoothOppBtErrorActivity");
+                }
+            };
 
             PackageManager systemPackageManager = mContext.getPackageManager();
             PackageManager userPackageManager = mContext.createContextAsUser(userHandle, 0)
@@ -2963,20 +3088,21 @@
                 }
                 for (var activity : packageInfo.activities) {
                     Log.v(TAG, "Checking activity " + activity.name);
-                    if (launcherActivity.equals(activity.name)) {
-                        final ComponentName oppLauncherComponent = new ComponentName(
-                                candidatePackage, launcherActivity
-                        );
-                        userPackageManager.setComponentEnabledSetting(
-                                oppLauncherComponent, newState, PackageManager.DONT_KILL_APP
-                        );
+                    if (baseBluetoothOppActivities.contains(activity.name)) {
+                        for (String activityName : baseBluetoothOppActivities) {
+                            userPackageManager.setComponentEnabledSetting(
+                                    new ComponentName(candidatePackage, activityName),
+                                    newState,
+                                    PackageManager.DONT_KILL_APP
+                            );
+                        }
                         return;
                     }
                 }
             }
 
             Log.e(TAG,
-                    "Cannot toggle BluetoothOppLauncherActivity, could not find it in any package");
+                    "Cannot toggle Bluetooth OPP activities, could not find them in any package");
         } catch (Exception e) {
             Log.e(TAG, "updateOppLauncherComponentState failed: " + e);
         }
diff --git a/service/java/com/android/server/bluetooth/BluetoothModeChangeHelper.java b/service/java/com/android/server/bluetooth/BluetoothModeChangeHelper.java
index 4d3f22e..359b5d8 100644
--- a/service/java/com/android/server/bluetooth/BluetoothModeChangeHelper.java
+++ b/service/java/com/android/server/bluetooth/BluetoothModeChangeHelper.java
@@ -16,7 +16,11 @@
 
 package com.android.server.bluetooth;
 
+import static com.android.server.bluetooth.BluetoothAirplaneModeListener.BLUETOOTH_APM_STATE;
+import static com.android.server.bluetooth.BluetoothAirplaneModeListener.BT_DEFAULT_APM_STATE;
+
 import android.annotation.RequiresPermission;
+import android.app.ActivityManager;
 import android.bluetooth.BluetoothA2dp;
 import android.bluetooth.BluetoothAdapter;
 import android.bluetooth.BluetoothHearingAid;
@@ -24,8 +28,12 @@
 import android.bluetooth.BluetoothProfile;
 import android.bluetooth.BluetoothProfile.ServiceListener;
 import android.content.Context;
+import android.content.pm.PackageManager;
 import android.content.res.Resources;
+import android.os.Process;
+import android.os.UserHandle;
 import android.provider.Settings;
+import android.util.Log;
 import android.widget.Toast;
 
 import com.android.internal.annotations.VisibleForTesting;
@@ -35,12 +43,16 @@
  * complex logic.
  */
 public class BluetoothModeChangeHelper {
+    private static final String TAG = "BluetoothModeChangeHelper";
+
     private volatile BluetoothA2dp mA2dp;
     private volatile BluetoothHearingAid mHearingAid;
     private volatile BluetoothLeAudio mLeAudio;
     private final BluetoothAdapter mAdapter;
     private final Context mContext;
 
+    private String mBluetoothPackageName;
+
     BluetoothModeChangeHelper(Context context) {
         mAdapter = BluetoothAdapter.getDefaultAdapter();
         mContext = context;
@@ -127,6 +139,24 @@
                 name, value);
     }
 
+    /**
+     * Helper method to get Settings Secure Int value
+     */
+    public int getSettingsSecureInt(String name, int def) {
+        Context userContext = mContext.createContextAsUser(
+                UserHandle.of(ActivityManager.getCurrentUser()), 0);
+        return Settings.Secure.getInt(userContext.getContentResolver(), name, def);
+    }
+
+    /**
+     * Helper method to set Settings Secure Int value
+     */
+    public void setSettingsSecureInt(String name, int value) {
+        Context userContext = mContext.createContextAsUser(
+                UserHandle.of(ActivityManager.getCurrentUser()), 0);
+        Settings.Secure.putInt(userContext.getContentResolver(), name, value);
+    }
+
     @VisibleForTesting
     public void showToastMessage() {
         Resources r = mContext.getResources();
@@ -158,4 +188,45 @@
         }
         return leAudio.getConnectedDevices().size() > 0;
     }
+
+    /**
+     * Helper method to check whether BT should be enabled on APM
+     */
+    public boolean isBluetoothOnAPM() {
+        Context userContext = mContext.createContextAsUser(
+                UserHandle.of(ActivityManager.getCurrentUser()), 0);
+        int defaultBtApmState = getSettingsInt(BT_DEFAULT_APM_STATE);
+        return Settings.Secure.getInt(userContext.getContentResolver(),
+                BLUETOOTH_APM_STATE, defaultBtApmState) == 1;
+    }
+
+    /**
+     * Helper method to retrieve BT package name with APM resources
+     */
+    public String getBluetoothPackageName() {
+        if (mBluetoothPackageName != null) {
+            return mBluetoothPackageName;
+        }
+        var allPackages = mContext.getPackageManager().getPackagesForUid(Process.BLUETOOTH_UID);
+        for (String candidatePackage : allPackages) {
+            Resources resources;
+            try {
+                resources = mContext.getPackageManager()
+                        .getResourcesForApplication(candidatePackage);
+            } catch (PackageManager.NameNotFoundException e) {
+                // ignore, try next package
+                Log.e(TAG, "Could not find package " + candidatePackage);
+                continue;
+            } catch (Exception e) {
+                Log.e(TAG, "Error while loading package" + e);
+                continue;
+            }
+            if (resources.getIdentifier("bluetooth_and_wifi_stays_on_title",
+                    "string", candidatePackage) == 0) {
+                continue;
+            }
+            mBluetoothPackageName = candidatePackage;
+        }
+        return mBluetoothPackageName;
+    }
 }
diff --git a/service/java/com/android/server/bluetooth/BluetoothNotificationManager.java b/service/java/com/android/server/bluetooth/BluetoothNotificationManager.java
new file mode 100644
index 0000000..bfe30f2
--- /dev/null
+++ b/service/java/com/android/server/bluetooth/BluetoothNotificationManager.java
@@ -0,0 +1,176 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.server.bluetooth;
+
+import android.app.Notification;
+import android.app.NotificationChannel;
+import android.app.NotificationManager;
+import android.app.PendingIntent;
+import android.content.Context;
+import android.content.Intent;
+import android.content.pm.PackageManager;
+import android.net.Uri;
+import android.os.Binder;
+import android.os.UserHandle;
+import android.service.notification.StatusBarNotification;
+import android.util.Log;
+
+import com.android.internal.messages.nano.SystemMessageProto.SystemMessage;
+
+import java.util.ArrayList;
+import java.util.List;
+
+/**
+ * Notification manager for Bluetooth. All notification will be sent to the current user.
+ */
+public class BluetoothNotificationManager {
+    private static final String TAG = "BluetoothNotificationManager";
+    private static final String NOTIFICATION_TAG = "com.android.bluetooth";
+    public static final String APM_NOTIFICATION_CHANNEL = "apm_notification_channel";
+    private static final String APM_NOTIFICATION_GROUP = "apm_notification_group";
+    private static final String HELP_PAGE_URL =
+            "https://support.google.com/pixelphone/answer/12639358";
+
+    private final Context mContext;
+    private NotificationManager mNotificationManager;
+
+    private boolean mInitialized = false;
+
+    /**
+     * Constructor
+     *
+     * @param ctx The context to use to obtain access to the Notification Service
+     */
+    BluetoothNotificationManager(Context ctx) {
+        mContext = ctx;
+    }
+
+    private NotificationManager getNotificationManagerForCurrentUser() {
+        final long callingIdentity = Binder.clearCallingIdentity();
+        try {
+            return mContext.createPackageContextAsUser(mContext.getPackageName(), 0,
+                    UserHandle.CURRENT).getSystemService(NotificationManager.class);
+        } catch (PackageManager.NameNotFoundException e) {
+            Log.e(TAG, "Failed to get NotificationManager for current user: " + e.getMessage());
+        } finally {
+            Binder.restoreCallingIdentity(callingIdentity);
+        }
+        return null;
+    }
+
+    /**
+     * Update to the notification manager fot current user and create notification channels.
+     */
+    public void createNotificationChannels() {
+        if (mNotificationManager != null) {
+            // Cancel all active notification from Bluetooth Stack.
+            cleanAllBtNotification();
+        }
+        mNotificationManager = getNotificationManagerForCurrentUser();
+        if (mNotificationManager == null) {
+            return;
+        }
+        List<NotificationChannel> channelsList = new ArrayList<>();
+
+        final NotificationChannel apmChannel = new NotificationChannel(
+                APM_NOTIFICATION_CHANNEL,
+                APM_NOTIFICATION_GROUP,
+                NotificationManager.IMPORTANCE_HIGH);
+        channelsList.add(apmChannel);
+
+        final long callingIdentity = Binder.clearCallingIdentity();
+        try {
+            mNotificationManager.createNotificationChannels(channelsList);
+        } catch (Exception e) {
+            Log.e(TAG, "Error Message: " + e.getMessage());
+            e.printStackTrace();
+        } finally {
+            Binder.restoreCallingIdentity(callingIdentity);
+        }
+    }
+
+    private void cleanAllBtNotification() {
+        for (StatusBarNotification notification : getActiveNotifications()) {
+            if (NOTIFICATION_TAG.equals(notification.getTag())) {
+                cancel(notification.getId());
+            }
+        }
+    }
+
+    /**
+     * Send notification to the current user.
+     */
+    public void notify(int id, Notification notification) {
+        if (!mInitialized) {
+            createNotificationChannels();
+            mInitialized = true;
+        }
+        if (mNotificationManager == null) {
+            return;
+        }
+        mNotificationManager.notify(NOTIFICATION_TAG, id, notification);
+    }
+
+    /**
+     * Build and send the APM notification.
+     */
+    public void sendApmNotification(String title, String message) {
+        if (!mInitialized) {
+            createNotificationChannels();
+            mInitialized = true;
+        }
+
+        Intent openLinkIntent = new Intent(Intent.ACTION_VIEW)
+                .setData(Uri.parse(HELP_PAGE_URL))
+                .addFlags(Intent.FLAG_ACTIVITY_NEW_TASK);
+        PendingIntent tapPendingIntent = PendingIntent.getActivity(
+                mContext.createContextAsUser(UserHandle.CURRENT, 0),
+                PendingIntent.FLAG_UPDATE_CURRENT, openLinkIntent, PendingIntent.FLAG_IMMUTABLE);
+
+        Notification notification =  new Notification.Builder(mContext, APM_NOTIFICATION_CHANNEL)
+                        .setAutoCancel(true)
+                        .setLocalOnly(true)
+                        .setContentTitle(title)
+                        .setContentText(message)
+                        .setContentIntent(tapPendingIntent)
+                        .setVisibility(Notification.VISIBILITY_PUBLIC)
+                        .setStyle(new Notification.BigTextStyle().bigText(message))
+                        .setSmallIcon(android.R.drawable.stat_sys_data_bluetooth)
+                        .build();
+        notify(SystemMessage.NOTE_BT_APM_NOTIFICATION, notification);
+    }
+
+    /**
+     * Cancel the notification fot current user.
+     */
+    public void cancel(int id) {
+        if (mNotificationManager == null) {
+            return;
+        }
+        mNotificationManager.cancel(NOTIFICATION_TAG, id);
+    }
+
+    /**
+     * Get active notifications for current user.
+     */
+    public StatusBarNotification[] getActiveNotifications() {
+        if (mNotificationManager == null) {
+            return new StatusBarNotification[0];
+        }
+        return mNotificationManager.getActiveNotifications();
+    }
+}
diff --git a/service/java/com/android/server/bluetooth/BluetoothShellCommand.java b/service/java/com/android/server/bluetooth/BluetoothShellCommand.java
index 2946650..8beffa4 100644
--- a/service/java/com/android/server/bluetooth/BluetoothShellCommand.java
+++ b/service/java/com/android/server/bluetooth/BluetoothShellCommand.java
@@ -16,6 +16,9 @@
 
 package com.android.server.bluetooth;
 
+import static java.util.Objects.requireNonNull;
+
+import android.bluetooth.BluetoothAdapter;
 import android.content.AttributionSource;
 import android.content.Context;
 import android.os.Binder;
@@ -23,60 +26,127 @@
 import android.os.RemoteException;
 import android.util.Log;
 
+import com.android.internal.annotations.VisibleForTesting;
 import com.android.modules.utils.BasicShellCommandHandler;
 
 import java.io.PrintWriter;
 
 class BluetoothShellCommand extends BasicShellCommandHandler {
-    private static final String TAG = "BluetoothShellCommand";
+    private static final String TAG = BluetoothShellCommand.class.getSimpleName();
 
     private final BluetoothManagerService mManagerService;
     private final Context mContext;
 
-    private final BluetoothCommand[] mBluetoothCommands = {
+    @VisibleForTesting
+    final BluetoothCommand[] mBluetoothCommands = {
         new Enable(),
         new Disable(),
+        new WaitForAdapterState(),
     };
 
-    private abstract class BluetoothCommand {
-        abstract String getName();
-        // require root permission by default, can be override in command implementation
-        boolean isPrivileged() {
-            return true;
+    @VisibleForTesting
+    abstract class BluetoothCommand {
+        final boolean mIsPrivileged;
+        final String mName;
+
+        BluetoothCommand(boolean isPrivileged, String name) {
+            mIsPrivileged = isPrivileged;
+            mName = requireNonNull(name, "Command name cannot be null");
         }
-        abstract int exec(PrintWriter pw) throws RemoteException;
+
+        String getName() {
+            return mName;
+        }
+        boolean isMatch(String cmd) {
+            return mName.equals(cmd);
+        }
+        boolean isPrivileged() {
+            return mIsPrivileged;
+        }
+
+        abstract int exec(String cmd) throws RemoteException;
+        abstract void onHelp(PrintWriter pw);
     }
 
-    private class Enable extends BluetoothCommand {
-        @Override
-        String getName() {
-            return "enable";
+    @VisibleForTesting
+    class Enable extends BluetoothCommand {
+        Enable() {
+            super(false, "enable");
         }
         @Override
-        boolean isPrivileged() {
-            return false;
-        }
-        @Override
-        public int exec(PrintWriter pw) throws RemoteException {
-            pw.println("Enabling Bluetooth");
+        public int exec(String cmd) throws RemoteException {
             return mManagerService.enable(AttributionSource.myAttributionSource()) ? 0 : -1;
         }
+        @Override
+        public void onHelp(PrintWriter pw) {
+            pw.println("  " + getName());
+            pw.println("    Enable Bluetooth on this device.");
+        }
     }
 
-    private class Disable extends BluetoothCommand {
-        @Override
-        String getName() {
-            return "disable";
+    @VisibleForTesting
+    class Disable extends BluetoothCommand {
+        Disable() {
+            super(false, "disable");
         }
         @Override
-        boolean isPrivileged() {
-            return false;
-        }
-        @Override
-        public int exec(PrintWriter pw) throws RemoteException {
-            pw.println("Disabling Bluetooth");
+        public int exec(String cmd) throws RemoteException {
             return mManagerService.disable(AttributionSource.myAttributionSource(), true) ? 0 : -1;
         }
+        @Override
+        public void onHelp(PrintWriter pw) {
+            pw.println("  " + getName());
+            pw.println("    Disable Bluetooth on this device.");
+        }
+    }
+
+    @VisibleForTesting
+    class WaitForAdapterState extends BluetoothCommand {
+        WaitForAdapterState() {
+            super(false, "wait-for-state");
+        }
+        private int getWaitingState(String in) {
+            if (!in.startsWith(getName() + ":")) return -1;
+            String[] split = in.split(":", 2);
+            if (split.length != 2 || !getName().equals(split[0])) {
+                String msg = getName() + ": Invalid state format: " + in;
+                Log.e(TAG, msg);
+                PrintWriter pw = getErrPrintWriter();
+                pw.println(TAG + ": " + msg);
+                printHelp(pw);
+                throw new IllegalArgumentException();
+            }
+            switch (split[1]) {
+                case "STATE_OFF":
+                    return BluetoothAdapter.STATE_OFF;
+                case "STATE_ON":
+                    return BluetoothAdapter.STATE_ON;
+                default:
+                    String msg = getName() + ": Invalid state value: " + split[1] + ". From: " + in;
+                    Log.e(TAG, msg);
+                    PrintWriter pw = getErrPrintWriter();
+                    pw.println(TAG + ": " + msg);
+                    printHelp(pw);
+                    throw new IllegalArgumentException();
+            }
+        }
+        @Override
+        boolean isMatch(String cmd) {
+            return getWaitingState(cmd) != -1;
+        }
+        @Override
+        public int exec(String cmd) throws RemoteException {
+            int ret = mManagerService.waitForManagerState(getWaitingState(cmd)) ? 0 : -1;
+            Log.d(TAG, cmd + ": Return value is " + ret); // logging as this method can take time
+            return ret;
+        }
+        @Override
+        public void onHelp(PrintWriter pw) {
+            pw.println("  " + getName() + ":<STATE>");
+            pw.println("    Wait until the adapter state is <STATE>."
+                    + " <STATE> can be one of STATE_OFF | STATE_ON");
+            pw.println("    Note: This command can timeout and failed");
+        }
     }
 
     BluetoothShellCommand(BluetoothManagerService managerService, Context context) {
@@ -86,40 +156,50 @@
 
     @Override
     public int onCommand(String cmd) {
-        if (cmd == null) {
-            return handleDefaultCommands(null);
-        }
+        if (cmd == null) return handleDefaultCommands(null);
 
         for (BluetoothCommand bt_cmd : mBluetoothCommands) {
-            if (cmd.equals(bt_cmd.getName())) {
-                if (bt_cmd.isPrivileged()) {
-                    final int uid = Binder.getCallingUid();
-                    if (uid != Process.ROOT_UID) {
-                        throw new SecurityException("Uid " + uid + " does not have access to "
-                                + cmd + " bluetooth command (or such command doesn't exist)");
-                    }
+            if (!bt_cmd.isMatch(cmd)) continue;
+            if (bt_cmd.isPrivileged()) {
+                final int uid = Binder.getCallingUid();
+                if (uid != Process.ROOT_UID) {
+                    throw new SecurityException("Uid " + uid + " does not have access to "
+                            + cmd + " bluetooth command");
                 }
-                try {
-                    return bt_cmd.exec(getOutPrintWriter());
-                } catch (RemoteException e) {
-                    Log.w(TAG, cmd + ": error\nException: " + e.getMessage());
-                    getErrPrintWriter().println(cmd + ": error\nException: " + e.getMessage());
-                    e.rethrowFromSystemServer();
+            }
+            try {
+                getOutPrintWriter().println(TAG + ": Exec" + cmd);
+                Log.d(TAG, "Exec " + cmd);
+                int ret = bt_cmd.exec(cmd);
+                if (ret == 0) {
+                    String msg = cmd + ": Success";
+                    Log.d(TAG, msg);
+                    getOutPrintWriter().println(msg);
+                } else {
+                    String msg = cmd + ": Failed with status=" + ret;
+                    Log.e(TAG, msg);
+                    getErrPrintWriter().println(TAG + ": " + msg);
                 }
+                return ret;
+            } catch (RemoteException e) {
+                Log.w(TAG, cmd + ": error\nException: " + e.getMessage());
+                getErrPrintWriter().println(cmd + ": error\nException: " + e.getMessage());
+                e.rethrowFromSystemServer();
             }
         }
         return handleDefaultCommands(cmd);
     }
 
-    @Override
-    public void onHelp() {
-        PrintWriter pw = getOutPrintWriter();
-        pw.println("Bluetooth Commands:");
+    private void printHelp(PrintWriter pw) {
+        pw.println("Bluetooth Manager Commands:");
         pw.println("  help or -h");
         pw.println("    Print this help text.");
-        pw.println("  enable");
-        pw.println("    Enable Bluetooth on this device.");
-        pw.println("  disable");
-        pw.println("    Disable Bluetooth on this device.");
+        for (BluetoothCommand bt_cmd : mBluetoothCommands) {
+            bt_cmd.onHelp(pw);
+        }
+    }
+    @Override
+    public void onHelp() {
+        printHelp(getOutPrintWriter());
     }
 }
diff --git a/service/tests/Android.bp b/service/tests/Android.bp
index c26df88..5225038 100644
--- a/service/tests/Android.bp
+++ b/service/tests/Android.bp
@@ -17,18 +17,6 @@
     default_applicable_licenses: ["Android-Apache-2.0"],
 }
 
-filegroup {
-    name: "service-bluetooth-tests-sources",
-    srcs: [
-        "src/**/*.java",
-    ],
-    visibility: [
-        "//frameworks/base",
-        "//frameworks/base/services",
-        "//frameworks/base/services/tests/servicestests",
-    ],
-}
-
 android_test {
     name: "ServiceBluetoothTests",
 
@@ -42,15 +30,13 @@
 
     static_libs: [
         "androidx.test.rules",
-        "collector-device-lib",
-        "hamcrest-library",
         "mockito-target-extended-minus-junit4",
         "platform-test-annotations",
         "frameworks-base-testutils",
         "truth-prebuilt",
 
         // Statically link service-bluetooth-pre-jarjar since we want to test the working copy of
-        // service-uwb, not the on-device copy.
+        // service-bluetooth, not the on-device copy.
         // Use pre-jarjar version so that we can reference symbols before they are renamed.
         // Then, the jarjar_rules here will perform the rename for the entire APK
         // i.e. service-bluetooth + test code
@@ -68,9 +54,12 @@
 
     jni_libs: [
         // these are needed for Extended Mockito
+        "libdexmakerjvmtiagent",
+        "libstaticjvmtiagent",
         "libbluetooth_jni",
     ],
     compile_multilib: "both",
+    certificate: ":com.android.bluetooth.certificate",
 
     min_sdk_version: "current",
 
diff --git a/service/tests/AndroidManifest.xml b/service/tests/AndroidManifest.xml
index afecc06..a4d88d2 100644
--- a/service/tests/AndroidManifest.xml
+++ b/service/tests/AndroidManifest.xml
@@ -31,12 +31,14 @@
         </activity>
     </application>
 
-    <instrumentation android:name="com.android.server.bluetooth.CustomTestRunner"
+     <instrumentation android:name="androidx.test.runner.AndroidJUnitRunner"
          android:targetPackage="com.android.server.bluetooth.test"
-         android:label="Service Bluetooth Tests">
-    </instrumentation>
+         android:label="Service Bluetooth Tests"/>
 
-    <uses-permission android:name="android.permission.READ_PHONE_STATE"/>
+    <uses-permission android:name="android.permission.BLUETOOTH_CONNECT"/>
+    <uses-permission android:name="android.permission.INTERACT_ACROSS_USERS"/>
     <uses-permission android:name="android.permission.INTERNET"/>
+    <uses-permission android:name="android.permission.READ_PHONE_STATE"/>
+    <uses-permission android:name="android.permission.WRITE_SECURE_SETTINGS"/>
 
 </manifest>
diff --git a/service/tests/AndroidTest.xml b/service/tests/AndroidTest.xml
index c31c6cb..24fda39 100644
--- a/service/tests/AndroidTest.xml
+++ b/service/tests/AndroidTest.xml
@@ -17,20 +17,24 @@
     <target_preparer class="com.android.tradefed.targetprep.suite.SuiteApkInstaller">
         <option name="test-file-name" value="ServiceBluetoothTests.apk" />
     </target_preparer>
+    <target_preparer class="com.android.tradefed.targetprep.RootTargetPreparer">
+        <option name="force-root" value="true" />
+    </target_preparer>
 
     <option name="test-suite-tag" value="apct" />
     <option name="test-tag" value="ServiceBluetoothTests" />
     <option name="config-descriptor:metadata" key="mainline-param"
-            value="com.google.android.bluetooth.apex" />
+            value="com.google.android.btservices.apex" />
     <test class="com.android.tradefed.testtype.AndroidJUnitTest" >
         <option name="package" value="com.android.server.bluetooth.test" />
-        <option name="runner" value="com.android.server.bluetooth.CustomTestRunner" />
+        <option name="runner" value="androidx.test.runner.AndroidJUnitRunner" />
         <option name="hidden-api-checks" value="false"/>
     </test>
 
     <!-- Only run ServiceBluetoothTests in MTS if the Bluetooth Mainline module is installed. -->
     <object type="module_controller"
             class="com.android.tradefed.testtype.suite.module.MainlineTestModuleController">
-        <option name="mainline-module-package-name" value="com.google.android.bluetooth" />
+        <option name="mainline-module-package-name" value="com.android.btservices" />
+        <option name="mainline-module-package-name" value="com.google.android.btservices" />
     </object>
 </configuration>
diff --git a/service/tests/src/com/android/server/BluetoothAirplaneModeListenerTest.java b/service/tests/src/com/android/server/BluetoothAirplaneModeListenerTest.java
deleted file mode 100644
index fb06780..0000000
--- a/service/tests/src/com/android/server/BluetoothAirplaneModeListenerTest.java
+++ /dev/null
@@ -1,123 +0,0 @@
-/*
- * Copyright 2019 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package com.android.server.bluetooth;
-
-import static org.mockito.Mockito.*;
-
-import android.bluetooth.BluetoothAdapter;
-import android.content.Context;
-import android.os.Looper;
-import android.provider.Settings;
-
-import androidx.test.InstrumentationRegistry;
-import androidx.test.filters.MediumTest;
-import androidx.test.runner.AndroidJUnit4;
-
-import org.junit.Assert;
-import org.junit.Before;
-import org.junit.Test;
-import org.junit.runner.RunWith;
-import org.mockito.Mock;
-
-@MediumTest
-@RunWith(AndroidJUnit4.class)
-public class BluetoothAirplaneModeListenerTest {
-    private Context mContext;
-    private BluetoothAirplaneModeListener mBluetoothAirplaneModeListener;
-    private BluetoothAdapter mBluetoothAdapter;
-    private BluetoothModeChangeHelper mHelper;
-
-    @Mock BluetoothManagerService mBluetoothManagerService;
-
-    @Before
-    public void setUp() throws Exception {
-        mContext = InstrumentationRegistry.getTargetContext();
-
-        mHelper = mock(BluetoothModeChangeHelper.class);
-        when(mHelper.getSettingsInt(BluetoothAirplaneModeListener.TOAST_COUNT))
-                .thenReturn(BluetoothAirplaneModeListener.MAX_TOAST_COUNT);
-        doNothing().when(mHelper).setSettingsInt(anyString(), anyInt());
-        doNothing().when(mHelper).showToastMessage();
-        doNothing().when(mHelper).onAirplaneModeChanged(any(BluetoothManagerService.class));
-
-        mBluetoothAirplaneModeListener = new BluetoothAirplaneModeListener(
-                    mBluetoothManagerService, Looper.getMainLooper(), mContext);
-        mBluetoothAirplaneModeListener.start(mHelper);
-    }
-
-    @Test
-    public void testIgnoreOnAirplanModeChange() {
-        Assert.assertFalse(mBluetoothAirplaneModeListener.shouldSkipAirplaneModeChange());
-
-        when(mHelper.isBluetoothOn()).thenReturn(true);
-        Assert.assertFalse(mBluetoothAirplaneModeListener.shouldSkipAirplaneModeChange());
-
-        when(mHelper.isMediaProfileConnected()).thenReturn(true);
-        Assert.assertFalse(mBluetoothAirplaneModeListener.shouldSkipAirplaneModeChange());
-
-        when(mHelper.isAirplaneModeOn()).thenReturn(true);
-        Assert.assertTrue(mBluetoothAirplaneModeListener.shouldSkipAirplaneModeChange());
-    }
-
-    @Test
-    public void testHandleAirplaneModeChange_InvokeAirplaneModeChanged() {
-        mBluetoothAirplaneModeListener.handleAirplaneModeChange();
-        verify(mHelper).onAirplaneModeChanged(mBluetoothManagerService);
-    }
-
-    @Test
-    public void testHandleAirplaneModeChange_NotInvokeAirplaneModeChanged_NotPopToast() {
-        mBluetoothAirplaneModeListener.mToastCount = BluetoothAirplaneModeListener.MAX_TOAST_COUNT;
-        when(mHelper.isBluetoothOn()).thenReturn(true);
-        when(mHelper.isMediaProfileConnected()).thenReturn(true);
-        when(mHelper.isAirplaneModeOn()).thenReturn(true);
-        mBluetoothAirplaneModeListener.handleAirplaneModeChange();
-
-        verify(mHelper).setSettingsInt(Settings.Global.BLUETOOTH_ON,
-                BluetoothManagerService.BLUETOOTH_ON_AIRPLANE);
-        verify(mHelper, times(0)).showToastMessage();
-        verify(mHelper, times(0)).onAirplaneModeChanged(mBluetoothManagerService);
-    }
-
-    @Test
-    public void testHandleAirplaneModeChange_NotInvokeAirplaneModeChanged_PopToast() {
-        mBluetoothAirplaneModeListener.mToastCount = 0;
-        when(mHelper.isBluetoothOn()).thenReturn(true);
-        when(mHelper.isMediaProfileConnected()).thenReturn(true);
-        when(mHelper.isAirplaneModeOn()).thenReturn(true);
-        mBluetoothAirplaneModeListener.handleAirplaneModeChange();
-
-        verify(mHelper).setSettingsInt(Settings.Global.BLUETOOTH_ON,
-                BluetoothManagerService.BLUETOOTH_ON_AIRPLANE);
-        verify(mHelper).showToastMessage();
-        verify(mHelper, times(0)).onAirplaneModeChanged(mBluetoothManagerService);
-    }
-
-    @Test
-    public void testIsPopToast_PopToast() {
-        mBluetoothAirplaneModeListener.mToastCount = 0;
-        Assert.assertTrue(mBluetoothAirplaneModeListener.shouldPopToast());
-        verify(mHelper).setSettingsInt(BluetoothAirplaneModeListener.TOAST_COUNT, 1);
-    }
-
-    @Test
-    public void testIsPopToast_NotPopToast() {
-        mBluetoothAirplaneModeListener.mToastCount = BluetoothAirplaneModeListener.MAX_TOAST_COUNT;
-        Assert.assertFalse(mBluetoothAirplaneModeListener.shouldPopToast());
-        verify(mHelper, times(0)).setSettingsInt(anyString(), anyInt());
-    }
-}
diff --git a/service/tests/src/com/android/server/bluetooth/BluetoothAirplaneModeListenerTest.java b/service/tests/src/com/android/server/bluetooth/BluetoothAirplaneModeListenerTest.java
new file mode 100644
index 0000000..cc3dd45
--- /dev/null
+++ b/service/tests/src/com/android/server/bluetooth/BluetoothAirplaneModeListenerTest.java
@@ -0,0 +1,265 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.server.bluetooth;
+
+import static com.android.server.bluetooth.BluetoothAirplaneModeListener.APM_BT_NOTIFICATION;
+import static com.android.server.bluetooth.BluetoothAirplaneModeListener.APM_ENHANCEMENT;
+import static com.android.server.bluetooth.BluetoothAirplaneModeListener.APM_USER_TOGGLED_BLUETOOTH;
+import static com.android.server.bluetooth.BluetoothAirplaneModeListener.APM_WIFI_BT_NOTIFICATION;
+import static com.android.server.bluetooth.BluetoothAirplaneModeListener.NOTIFICATION_NOT_SHOWN;
+import static com.android.server.bluetooth.BluetoothAirplaneModeListener.NOTIFICATION_SHOWN;
+import static com.android.server.bluetooth.BluetoothAirplaneModeListener.UNUSED;
+import static com.android.server.bluetooth.BluetoothAirplaneModeListener.USED;
+import static com.android.server.bluetooth.BluetoothAirplaneModeListener.WIFI_APM_STATE;
+
+import static org.mockito.Mockito.*;
+
+import android.content.ContentResolver;
+import android.content.Context;
+import android.content.pm.PackageManager;
+import android.content.res.Resources;
+import android.os.Looper;
+import android.provider.Settings;
+
+import androidx.test.filters.MediumTest;
+import androidx.test.runner.AndroidJUnit4;
+
+import org.junit.Assert;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.Mock;
+import org.mockito.MockitoAnnotations;
+
+@MediumTest
+@RunWith(AndroidJUnit4.class)
+public class BluetoothAirplaneModeListenerTest {
+    private static final String PACKAGE_NAME = "TestPackage";
+
+    private BluetoothAirplaneModeListener mBluetoothAirplaneModeListener;
+
+    @Mock private Context mContext;
+    @Mock private ContentResolver mContentResolver;
+    @Mock private BluetoothManagerService mBluetoothManagerService;
+    @Mock private BluetoothModeChangeHelper mHelper;
+    @Mock private BluetoothNotificationManager mBluetoothNotificationManager;
+    @Mock private PackageManager mPackageManager;
+    @Mock private Resources mResources;
+
+    @Before
+    public void setUp() throws Exception {
+        MockitoAnnotations.initMocks(this);
+        when(mContext.getContentResolver()).thenReturn(mContentResolver);
+        when(mHelper.getSettingsInt(BluetoothAirplaneModeListener.TOAST_COUNT))
+                .thenReturn(BluetoothAirplaneModeListener.MAX_TOAST_COUNT);
+        doNothing().when(mHelper).setSettingsInt(anyString(), anyInt());
+        doNothing().when(mHelper).showToastMessage();
+        doNothing().when(mHelper).onAirplaneModeChanged(any(BluetoothManagerService.class));
+
+        mBluetoothAirplaneModeListener = new BluetoothAirplaneModeListener(
+                mBluetoothManagerService, Looper.getMainLooper(), mContext,
+                mBluetoothNotificationManager);
+        mBluetoothAirplaneModeListener.start(mHelper);
+    }
+
+    @Test
+    public void testIgnoreOnAirplanModeChange() {
+        Assert.assertFalse(mBluetoothAirplaneModeListener.shouldSkipAirplaneModeChange());
+
+        when(mHelper.isBluetoothOn()).thenReturn(true);
+        Assert.assertFalse(mBluetoothAirplaneModeListener.shouldSkipAirplaneModeChange());
+
+        when(mHelper.isMediaProfileConnected()).thenReturn(true);
+        Assert.assertTrue(mBluetoothAirplaneModeListener.shouldSkipAirplaneModeChange());
+    }
+
+    @Test
+    public void testIgnoreOnAirplanModeChangeApmEnhancement() {
+        when(mHelper.isAirplaneModeOn()).thenReturn(true);
+        when(mHelper.isBluetoothOn()).thenReturn(true);
+
+        // When APM enhancement is disabled, BT remains on when connected to a media profile
+        when(mHelper.getSettingsInt(APM_ENHANCEMENT)).thenReturn(0);
+        when(mHelper.isMediaProfileConnected()).thenReturn(true);
+        Assert.assertTrue(mBluetoothAirplaneModeListener.shouldSkipAirplaneModeChange());
+
+        // When APM enhancement is disabled, BT turns off when not connected to a media profile
+        when(mHelper.isMediaProfileConnected()).thenReturn(false);
+        Assert.assertFalse(mBluetoothAirplaneModeListener.shouldSkipAirplaneModeChange());
+
+        // When APM enhancement is enabled but not activated by toggling BT in APM,
+        // BT remains on when connected to a media profile
+        when(mHelper.getSettingsInt(APM_ENHANCEMENT)).thenReturn(1);
+        when(mHelper.getSettingsSecureInt(APM_USER_TOGGLED_BLUETOOTH, UNUSED)).thenReturn(UNUSED);
+        when(mHelper.isMediaProfileConnected()).thenReturn(true);
+        Assert.assertTrue(mBluetoothAirplaneModeListener.shouldSkipAirplaneModeChange());
+
+        // When APM enhancement is enabled but not activated by toggling BT in APM,
+        // BT turns off when not connected to a media profile
+        when(mHelper.isMediaProfileConnected()).thenReturn(false);
+        Assert.assertFalse(mBluetoothAirplaneModeListener.shouldSkipAirplaneModeChange());
+
+        // When APM enhancement is enabled but not activated by toggling BT in APM,
+        // BT remains on when the default value for BT in APM is on
+        when(mHelper.isBluetoothOnAPM()).thenReturn(true);
+        Assert.assertTrue(mBluetoothAirplaneModeListener.shouldSkipAirplaneModeChange());
+
+        // When APM enhancement is enabled but not activated by toggling BT in APM,
+        // BT remains off when the default value for BT in APM is off
+        when(mHelper.isBluetoothOnAPM()).thenReturn(false);
+        Assert.assertFalse(mBluetoothAirplaneModeListener.shouldSkipAirplaneModeChange());
+
+        // When APM enhancement is enabled and activated by toggling BT in APM,
+        // BT remains on if user's last choice in APM was on
+        when(mHelper.getSettingsSecureInt(APM_USER_TOGGLED_BLUETOOTH, UNUSED)).thenReturn(USED);
+        when(mHelper.isBluetoothOnAPM()).thenReturn(true);
+        Assert.assertTrue(mBluetoothAirplaneModeListener.shouldSkipAirplaneModeChange());
+
+        // When APM enhancement is enabled and activated by toggling BT in APM,
+        // BT turns off if user's last choice in APM was off
+        when(mHelper.isBluetoothOnAPM()).thenReturn(false);
+        Assert.assertFalse(mBluetoothAirplaneModeListener.shouldSkipAirplaneModeChange());
+
+        // When APM enhancement is enabled and activated by toggling BT in APM,
+        // BT turns off if user's last choice in APM was off even when connected to a media profile
+        when(mHelper.isMediaProfileConnected()).thenReturn(true);
+        Assert.assertFalse(mBluetoothAirplaneModeListener.shouldSkipAirplaneModeChange());
+    }
+
+    @Test
+    public void testHandleAirplaneModeChange_InvokeAirplaneModeChanged() {
+        mBluetoothAirplaneModeListener.handleAirplaneModeChange();
+        verify(mHelper).onAirplaneModeChanged(mBluetoothManagerService);
+    }
+
+    @Test
+    public void testHandleAirplaneModeChange_NotInvokeAirplaneModeChanged_NotPopToast() {
+        mBluetoothAirplaneModeListener.mToastCount = BluetoothAirplaneModeListener.MAX_TOAST_COUNT;
+        when(mHelper.isBluetoothOn()).thenReturn(true);
+        when(mHelper.isMediaProfileConnected()).thenReturn(true);
+        when(mHelper.isAirplaneModeOn()).thenReturn(true);
+        mBluetoothAirplaneModeListener.handleAirplaneModeChange();
+
+        verify(mHelper).setSettingsInt(Settings.Global.BLUETOOTH_ON,
+                BluetoothManagerService.BLUETOOTH_ON_AIRPLANE);
+        verify(mHelper, times(0)).showToastMessage();
+        verify(mHelper, times(0)).onAirplaneModeChanged(mBluetoothManagerService);
+    }
+
+    @Test
+    public void testHandleAirplaneModeChange_NotInvokeAirplaneModeChanged_PopToast() {
+        mBluetoothAirplaneModeListener.mToastCount = 0;
+        when(mHelper.isBluetoothOn()).thenReturn(true);
+        when(mHelper.isMediaProfileConnected()).thenReturn(true);
+        when(mHelper.isAirplaneModeOn()).thenReturn(true);
+        mBluetoothAirplaneModeListener.handleAirplaneModeChange();
+
+        verify(mHelper).setSettingsInt(Settings.Global.BLUETOOTH_ON,
+                BluetoothManagerService.BLUETOOTH_ON_AIRPLANE);
+        verify(mHelper).showToastMessage();
+        verify(mHelper, times(0)).onAirplaneModeChanged(mBluetoothManagerService);
+    }
+
+    private void setUpApmNotificationTests() throws Exception {
+        when(mHelper.isBluetoothOn()).thenReturn(true);
+        when(mHelper.isAirplaneModeOn()).thenReturn(true);
+        when(mHelper.isBluetoothOnAPM()).thenReturn(true);
+        when(mHelper.getSettingsInt(APM_ENHANCEMENT)).thenReturn(1);
+        when(mHelper.getSettingsSecureInt(APM_USER_TOGGLED_BLUETOOTH, UNUSED)).thenReturn(USED);
+        when(mHelper.getBluetoothPackageName()).thenReturn(PACKAGE_NAME);
+        when(mContext.getPackageManager()).thenReturn(mPackageManager);
+        when(mPackageManager.getResourcesForApplication(PACKAGE_NAME)).thenReturn(mResources);
+    }
+
+    @Test
+    public void testHandleAirplaneModeChange_ShowBtAndWifiApmNotification() throws Exception {
+        setUpApmNotificationTests();
+        when(mHelper.getSettingsInt(Settings.Global.WIFI_ON)).thenReturn(1);
+        when(mHelper.getSettingsSecureInt(WIFI_APM_STATE, 0)).thenReturn(1);
+        when(mHelper.getSettingsSecureInt(APM_WIFI_BT_NOTIFICATION, NOTIFICATION_NOT_SHOWN))
+                .thenReturn(NOTIFICATION_NOT_SHOWN);
+
+        mBluetoothAirplaneModeListener.handleAirplaneModeChange();
+
+        verify(mHelper).setSettingsInt(Settings.Global.BLUETOOTH_ON,
+                BluetoothManagerService.BLUETOOTH_ON_AIRPLANE);
+        verify(mBluetoothNotificationManager).sendApmNotification(any(), any());
+        verify(mHelper).setSettingsSecureInt(APM_WIFI_BT_NOTIFICATION, NOTIFICATION_SHOWN);
+    }
+
+    @Test
+    public void testHandleAirplaneModeChange_NotShowBtAndWifiApmNotification() throws Exception {
+        setUpApmNotificationTests();
+        when(mHelper.getSettingsInt(Settings.Global.WIFI_ON)).thenReturn(1);
+        when(mHelper.getSettingsSecureInt(WIFI_APM_STATE, 0)).thenReturn(1);
+        when(mHelper.getSettingsSecureInt(APM_WIFI_BT_NOTIFICATION, NOTIFICATION_NOT_SHOWN))
+                .thenReturn(NOTIFICATION_SHOWN);
+
+        mBluetoothAirplaneModeListener.handleAirplaneModeChange();
+
+        verify(mHelper).setSettingsInt(Settings.Global.BLUETOOTH_ON,
+                BluetoothManagerService.BLUETOOTH_ON_AIRPLANE);
+        verify(mBluetoothNotificationManager, never()).sendApmNotification(any(), any());
+        verify(mHelper, never()).setSettingsSecureInt(APM_WIFI_BT_NOTIFICATION, NOTIFICATION_SHOWN);
+    }
+
+    @Test
+    public void testHandleAirplaneModeChange_ShowBtApmNotification() throws Exception {
+        setUpApmNotificationTests();
+        when(mHelper.getSettingsInt(Settings.Global.WIFI_ON)).thenReturn(1);
+        when(mHelper.getSettingsSecureInt(WIFI_APM_STATE, 0)).thenReturn(0);
+        when(mHelper.getSettingsSecureInt(APM_BT_NOTIFICATION, NOTIFICATION_NOT_SHOWN))
+                .thenReturn(NOTIFICATION_NOT_SHOWN);
+
+        mBluetoothAirplaneModeListener.handleAirplaneModeChange();
+
+        verify(mHelper).setSettingsInt(Settings.Global.BLUETOOTH_ON,
+                BluetoothManagerService.BLUETOOTH_ON_AIRPLANE);
+        verify(mBluetoothNotificationManager).sendApmNotification(any(), any());
+        verify(mHelper).setSettingsSecureInt(APM_BT_NOTIFICATION, NOTIFICATION_SHOWN);
+    }
+
+    @Test
+    public void testHandleAirplaneModeChange_NotShowBtApmNotification() throws Exception {
+        setUpApmNotificationTests();
+        when(mHelper.getSettingsInt(Settings.Global.WIFI_ON)).thenReturn(1);
+        when(mHelper.getSettingsSecureInt(WIFI_APM_STATE, 0)).thenReturn(0);
+        when(mHelper.getSettingsSecureInt(APM_BT_NOTIFICATION, NOTIFICATION_NOT_SHOWN))
+                .thenReturn(NOTIFICATION_SHOWN);
+
+        mBluetoothAirplaneModeListener.handleAirplaneModeChange();
+
+        verify(mHelper).setSettingsInt(Settings.Global.BLUETOOTH_ON,
+                BluetoothManagerService.BLUETOOTH_ON_AIRPLANE);
+        verify(mBluetoothNotificationManager, never()).sendApmNotification(any(), any());
+        verify(mHelper, never()).setSettingsSecureInt(APM_BT_NOTIFICATION, NOTIFICATION_SHOWN);
+    }
+
+    @Test
+    public void testIsPopToast_PopToast() {
+        mBluetoothAirplaneModeListener.mToastCount = 0;
+        Assert.assertTrue(mBluetoothAirplaneModeListener.shouldPopToast());
+        verify(mHelper).setSettingsInt(BluetoothAirplaneModeListener.TOAST_COUNT, 1);
+    }
+
+    @Test
+    public void testIsPopToast_NotPopToast() {
+        mBluetoothAirplaneModeListener.mToastCount = BluetoothAirplaneModeListener.MAX_TOAST_COUNT;
+        Assert.assertFalse(mBluetoothAirplaneModeListener.shouldPopToast());
+        verify(mHelper, times(0)).setSettingsInt(anyString(), anyInt());
+    }
+}
diff --git a/service/tests/src/com/android/server/bluetooth/BluetoothDeviceConfigChangeTrackerTest.java b/service/tests/src/com/android/server/bluetooth/BluetoothDeviceConfigChangeTrackerTest.java
new file mode 100644
index 0000000..9eaffc1
--- /dev/null
+++ b/service/tests/src/com/android/server/bluetooth/BluetoothDeviceConfigChangeTrackerTest.java
@@ -0,0 +1,167 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.server.bluetooth;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import android.provider.DeviceConfig;
+import android.provider.DeviceConfig.Properties;
+
+import androidx.test.filters.SmallTest;
+import androidx.test.runner.AndroidJUnit4;
+
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+@SmallTest
+@RunWith(AndroidJUnit4.class)
+public class BluetoothDeviceConfigChangeTrackerTest {
+    @Test
+    public void testNoProperties() {
+        BluetoothDeviceConfigChangeTracker changeTracker =
+                new BluetoothDeviceConfigChangeTracker(
+                        new Properties.Builder(DeviceConfig.NAMESPACE_BLUETOOTH).build());
+
+        boolean shouldRestart =
+                changeTracker.shouldRestartWhenPropertiesUpdated(
+                        new Properties.Builder(DeviceConfig.NAMESPACE_BLUETOOTH).build());
+
+        assertThat(shouldRestart).isFalse();
+    }
+
+    @Test
+    public void testNewFlag() {
+        BluetoothDeviceConfigChangeTracker changeTracker =
+                new BluetoothDeviceConfigChangeTracker(
+                        new Properties.Builder(DeviceConfig.NAMESPACE_BLUETOOTH)
+                                .setString("INIT_a", "true")
+                                .build());
+
+        boolean shouldRestart =
+                changeTracker.shouldRestartWhenPropertiesUpdated(
+                        new Properties.Builder(DeviceConfig.NAMESPACE_BLUETOOTH)
+                                .setString("INIT_a", "true")
+                                .setString("INIT_b", "true")
+                                .build());
+
+        assertThat(shouldRestart).isTrue();
+    }
+
+    @Test
+    public void testChangedFlag() {
+        BluetoothDeviceConfigChangeTracker changeTracker =
+                new BluetoothDeviceConfigChangeTracker(
+                        new Properties.Builder(DeviceConfig.NAMESPACE_BLUETOOTH)
+                                .setString("INIT_a", "true")
+                                .build());
+
+        boolean shouldRestart =
+                changeTracker.shouldRestartWhenPropertiesUpdated(
+                        new Properties.Builder(DeviceConfig.NAMESPACE_BLUETOOTH)
+                                .setString("INIT_a", "false")
+                                .build());
+
+        assertThat(shouldRestart).isTrue();
+    }
+
+    @Test
+    public void testUnchangedInitFlag() {
+        BluetoothDeviceConfigChangeTracker changeTracker =
+                new BluetoothDeviceConfigChangeTracker(
+                        new Properties.Builder(DeviceConfig.NAMESPACE_BLUETOOTH)
+                                .setString("INIT_a", "true")
+                                .build());
+
+        boolean shouldRestart =
+                changeTracker.shouldRestartWhenPropertiesUpdated(
+                        new Properties.Builder(DeviceConfig.NAMESPACE_BLUETOOTH)
+                                .setString("INIT_a", "true")
+                                .build());
+
+        assertThat(shouldRestart).isFalse();
+    }
+
+    @Test
+    public void testRepeatedChangeInitFlag() {
+        BluetoothDeviceConfigChangeTracker changeTracker =
+                new BluetoothDeviceConfigChangeTracker(
+                        new Properties.Builder(DeviceConfig.NAMESPACE_BLUETOOTH).build());
+
+        changeTracker.shouldRestartWhenPropertiesUpdated(
+                new Properties.Builder(DeviceConfig.NAMESPACE_BLUETOOTH)
+                        .setString("INIT_a", "true")
+                        .build());
+
+        boolean shouldRestart =
+                changeTracker.shouldRestartWhenPropertiesUpdated(
+                        new Properties.Builder(DeviceConfig.NAMESPACE_BLUETOOTH)
+                                .setString("INIT_a", "true")
+                                .build());
+
+        assertThat(shouldRestart).isFalse();
+    }
+
+    @Test
+    public void testWrongNamespace() {
+        BluetoothDeviceConfigChangeTracker changeTracker =
+                new BluetoothDeviceConfigChangeTracker(
+                        new Properties.Builder(DeviceConfig.NAMESPACE_BLUETOOTH).build());
+
+        boolean shouldRestart =
+                changeTracker.shouldRestartWhenPropertiesUpdated(
+                        new Properties.Builder("another_namespace")
+                                .setString("INIT_a", "true")
+                                .build());
+
+        assertThat(shouldRestart).isFalse();
+    }
+
+    @Test
+    public void testSkipProperty() {
+        BluetoothDeviceConfigChangeTracker changeTracker =
+                new BluetoothDeviceConfigChangeTracker(
+                        new Properties.Builder(DeviceConfig.NAMESPACE_BLUETOOTH)
+                                .setString("INIT_a", "true")
+                                .setString("INIT_b", "false")
+                                .build());
+
+        boolean shouldRestart =
+                changeTracker.shouldRestartWhenPropertiesUpdated(
+                        new Properties.Builder(DeviceConfig.NAMESPACE_BLUETOOTH)
+                                .setString("INIT_b", "false")
+                                .build());
+
+        assertThat(shouldRestart).isFalse();
+    }
+
+    @Test
+    public void testNonInitFlag() {
+        BluetoothDeviceConfigChangeTracker changeTracker =
+                new BluetoothDeviceConfigChangeTracker(
+                        new Properties.Builder(DeviceConfig.NAMESPACE_BLUETOOTH)
+                                .setString("a", "true")
+                                .build());
+
+        boolean shouldRestart =
+                changeTracker.shouldRestartWhenPropertiesUpdated(
+                        new Properties.Builder(DeviceConfig.NAMESPACE_BLUETOOTH)
+                                .setString("a", "false")
+                                .build());
+
+        assertThat(shouldRestart).isFalse();
+    }
+}
diff --git a/service/tests/src/com/android/server/bluetooth/BluetoothModeChangeHelperTest.java b/service/tests/src/com/android/server/bluetooth/BluetoothModeChangeHelperTest.java
new file mode 100644
index 0000000..7c50c98
--- /dev/null
+++ b/service/tests/src/com/android/server/bluetooth/BluetoothModeChangeHelperTest.java
@@ -0,0 +1,133 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.server.bluetooth;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import static org.mockito.Mockito.spy;
+import static org.mockito.Mockito.verify;
+
+import android.content.Context;
+import android.content.ContextWrapper;
+import android.provider.Settings;
+import android.text.TextUtils;
+
+import androidx.test.InstrumentationRegistry;
+import androidx.test.annotation.UiThreadTest;
+import androidx.test.filters.SmallTest;
+import androidx.test.runner.AndroidJUnit4;
+
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.Mock;
+import org.mockito.MockitoAnnotations;
+
+@SmallTest
+@RunWith(AndroidJUnit4.class)
+public class BluetoothModeChangeHelperTest {
+
+    @Mock
+    BluetoothManagerService mService;
+
+    Context mContext;
+    BluetoothModeChangeHelper mHelper;
+
+    @Before
+    public void setUp() throws Exception {
+        MockitoAnnotations.initMocks(this);
+        mContext = spy(new ContextWrapper(InstrumentationRegistry.getTargetContext()));
+
+        mHelper = new BluetoothModeChangeHelper(mContext);
+    }
+
+    @Test
+    public void isMediaProfileConnected() {
+        assertThat(mHelper.isMediaProfileConnected()).isFalse();
+    }
+
+    @Test
+    public void isBluetoothOn_doesNotCrash() {
+        // assertThat(mHelper.isBluetoothOn()).isFalse();
+        // TODO: Strangely, isBluetoothOn() does not call BluetoothAdapter.isEnabled().
+        //       Instead, it calls isLeEnabled(). Two results can be different.
+        //       Is this a mistake, or in purpose?
+        mHelper.isBluetoothOn();
+    }
+
+    @Test
+    public void isAirplaneModeOn() {
+        assertThat(mHelper.isAirplaneModeOn()).isFalse();
+    }
+
+    @Test
+    public void onAirplaneModeChanged() {
+        mHelper.onAirplaneModeChanged(mService);
+
+        verify(mService).onAirplaneModeChanged();
+    }
+
+    @Test
+    public void setSettingsInt() {
+        String testSettingsName = "BluetoothModeChangeHelperTest_test_settings_name";
+        int value = 9876;
+
+        try {
+            mHelper.setSettingsInt(testSettingsName, value);
+            assertThat(mHelper.getSettingsInt(testSettingsName)).isEqualTo(value);
+        } finally {
+            Settings.Global.resetToDefaults(mContext.getContentResolver(), null);
+        }
+    }
+
+    @Test
+    public void setSettingsSecureInt() {
+        String testSettingsName = "BluetoothModeChangeHelperTest_test_settings_name";
+        int value = 1234;
+
+        try {
+            mHelper.setSettingsSecureInt(testSettingsName, value);
+            assertThat(mHelper.getSettingsSecureInt(testSettingsName, 0)).isEqualTo(value);
+        } finally {
+            Settings.Global.resetToDefaults(mContext.getContentResolver(), null);
+        }
+    }
+
+    @Test
+    public void isBluetoothOnAPM_doesNotCrash() {
+        mHelper.isBluetoothOnAPM();
+    }
+
+    @UiThreadTest
+    @Test
+    public void showToastMessage_doesNotCrash() {
+        mHelper.showToastMessage();
+    }
+
+    @Test
+    public void getBluetoothPackageName() {
+        // TODO: Find a good way to specify the exact name of bluetooth package.
+        //       mContext.getPackageName() does not work as this is not a test for BT app.
+        String bluetoothPackageName = mHelper.getBluetoothPackageName();
+
+        boolean packageNameFound =
+                TextUtils.equals(bluetoothPackageName, "com.android.bluetooth")
+                || TextUtils.equals(bluetoothPackageName, "com.google.android.bluetooth");
+
+        assertThat(packageNameFound).isTrue();
+    }
+}
diff --git a/service/tests/src/com/android/server/bluetooth/BluetoothNotificationManagerTest.java b/service/tests/src/com/android/server/bluetooth/BluetoothNotificationManagerTest.java
new file mode 100644
index 0000000..a3b9e4c
--- /dev/null
+++ b/service/tests/src/com/android/server/bluetooth/BluetoothNotificationManagerTest.java
@@ -0,0 +1,101 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.server.bluetooth;
+
+import static com.android.internal.messages.nano.SystemMessageProto.SystemMessage.NOTE_BT_APM_NOTIFICATION;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import static org.mockito.Mockito.any;
+import static org.mockito.Mockito.anyInt;
+import static org.mockito.Mockito.anyString;
+import static org.mockito.Mockito.doReturn;
+import static org.mockito.Mockito.eq;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.spy;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import android.app.Notification;
+import android.app.NotificationManager;
+import android.content.Context;
+import android.content.ContextWrapper;
+import android.service.notification.StatusBarNotification;
+
+import androidx.test.InstrumentationRegistry;
+import androidx.test.filters.SmallTest;
+import androidx.test.runner.AndroidJUnit4;
+
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.Mock;
+import org.mockito.MockitoAnnotations;
+
+@SmallTest
+@RunWith(AndroidJUnit4.class)
+public class BluetoothNotificationManagerTest {
+
+    @Mock
+    NotificationManager mNotificationManager;
+
+    Context mContext;
+    BluetoothNotificationManager mBluetoothNotificationManager;
+
+    @Before
+    public void setUp() throws Exception {
+        MockitoAnnotations.initMocks(this);
+        mContext = spy(new ContextWrapper(InstrumentationRegistry.getTargetContext()));
+        doReturn(mNotificationManager).when(mContext).getSystemService(NotificationManager.class);
+        doReturn(mContext).when(mContext).createPackageContextAsUser(anyString(), anyInt(), any());
+
+        mBluetoothNotificationManager = new BluetoothNotificationManager(mContext);
+    }
+
+    @Test
+    public void createNotificationChannels_callsNotificationManagerCreateNotificationChannels() {
+        mBluetoothNotificationManager.createNotificationChannels();
+
+        verify(mNotificationManager).createNotificationChannels(any());
+    }
+
+    @Test
+    public void notify_callsNotificationManagerNotify() {
+        int id = 1234;
+        Notification notification = mock(Notification.class);
+
+        mBluetoothNotificationManager.notify(id, notification);
+
+        verify(mNotificationManager).notify(anyString(), eq(id), eq(notification));
+    }
+
+    @Test
+    public void sendApmNotification_callsNotificationManagerNotify_withApmNotificationId() {
+        mBluetoothNotificationManager.sendApmNotification("test_title", "test_message");
+
+        verify(mNotificationManager).notify(anyString(), eq(NOTE_BT_APM_NOTIFICATION), any());
+    }
+
+    @Test
+    public void getActiveNotifications() {
+        StatusBarNotification[] notifications = new StatusBarNotification[0];
+        when(mNotificationManager.getActiveNotifications()).thenReturn(notifications);
+
+        assertThat(mBluetoothNotificationManager.getActiveNotifications())
+                .isEqualTo(notifications);
+    }
+}
diff --git a/service/tests/src/com/android/server/bluetooth/BluetoothShellCommandTest.java b/service/tests/src/com/android/server/bluetooth/BluetoothShellCommandTest.java
new file mode 100644
index 0000000..db14999
--- /dev/null
+++ b/service/tests/src/com/android/server/bluetooth/BluetoothShellCommandTest.java
@@ -0,0 +1,169 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.server.bluetooth;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import static org.junit.Assert.assertThrows;
+import static org.mockito.ArgumentMatchers.anyBoolean;
+import static org.mockito.Mockito.any;
+import static org.mockito.Mockito.eq;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.spy;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import android.bluetooth.BluetoothAdapter;
+import android.content.Context;
+import android.os.Binder;
+import android.os.RemoteException;
+
+import androidx.test.filters.SmallTest;
+import androidx.test.runner.AndroidJUnit4;
+
+import com.android.server.bluetooth.BluetoothShellCommand.BluetoothCommand;
+
+import com.google.common.truth.Expect;
+
+import org.junit.Before;
+import org.junit.Rule;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.Mock;
+import org.mockito.MockitoAnnotations;
+
+import java.io.FileDescriptor;
+import java.io.PrintWriter;
+
+@SmallTest
+@RunWith(AndroidJUnit4.class)
+public class BluetoothShellCommandTest {
+    @Rule public final Expect expect = Expect.create();
+
+    @Mock
+    BluetoothManagerService mManagerService;
+
+    @Mock
+    Context mContext;
+
+    BluetoothShellCommand mShellCommand;
+
+    @Before
+    public void setUp() throws Exception {
+        MockitoAnnotations.initMocks(this);
+        mShellCommand = new BluetoothShellCommand(mManagerService, mContext);
+        mShellCommand.init(
+                mock(Binder.class), mock(FileDescriptor.class), mock(FileDescriptor.class),
+                mock(FileDescriptor.class), new String[0], -1);
+    }
+
+    @Test
+    public void enableCommand() throws Exception {
+        BluetoothCommand enableCmd = mShellCommand.new Enable();
+        String cmdName = "enable";
+
+        assertThat(enableCmd.getName()).isEqualTo(cmdName);
+        assertThat(enableCmd.isMatch(cmdName)).isTrue();
+        assertThat(enableCmd.isPrivileged()).isFalse();
+        when(mManagerService.enable(any())).thenReturn(true);
+        assertThat(enableCmd.exec(cmdName)).isEqualTo(0);
+    }
+
+    @Test
+    public void disableCommand() throws Exception {
+        BluetoothCommand disableCmd = mShellCommand.new Disable();
+        String cmdName = "disable";
+
+        assertThat(disableCmd.getName()).isEqualTo(cmdName);
+        assertThat(disableCmd.isMatch(cmdName)).isTrue();
+        assertThat(disableCmd.isPrivileged()).isFalse();
+        when(mManagerService.disable(any(), anyBoolean())).thenReturn(true);
+        assertThat(disableCmd.exec(cmdName)).isEqualTo(0);
+    }
+
+    @Test
+    public void waitForStateCommand() throws Exception {
+        BluetoothCommand waitCmd = mShellCommand.new WaitForAdapterState();
+
+        expect.that(waitCmd.getName()).isEqualTo("wait-for-state");
+        String[] validCmd = {
+            "wait-for-state:STATE_OFF",
+            "wait-for-state:STATE_ON",
+        };
+        for (String m : validCmd) {
+            expect.that(waitCmd.isMatch(m)).isTrue();
+        }
+        String[] falseCmd = {
+            "wait-for-stateSTATE_ON",
+            "wait-for-foo:STATE_ON",
+        };
+        for (String m : falseCmd) {
+            expect.that(waitCmd.isMatch(m)).isFalse();
+        }
+        String[] throwCmd = {
+            "wait-for-state:STATE_BLE_TURNING_ON",
+            "wait-for-state:STATE_ON:STATE_OFF",
+            "wait-for-state::STATE_ON",
+            "wait-for-state:STATE_ON:",
+        };
+        for (String m : throwCmd) {
+            assertThrows(m, IllegalArgumentException.class, () -> waitCmd.isMatch(m));
+        }
+
+        expect.that(waitCmd.isPrivileged()).isFalse();
+        when(mManagerService.waitForManagerState(eq(BluetoothAdapter.STATE_OFF))).thenReturn(true);
+
+        expect.that(waitCmd.exec(validCmd[0])).isEqualTo(0);
+    }
+
+    @Test
+    public void onCommand_withNullString_callsOnHelp() {
+        BluetoothShellCommand command = spy(mShellCommand);
+
+        command.onCommand(null);
+
+        verify(command).onHelp();
+    }
+
+    @Test
+    public void onCommand_withEnableString_callsEnableCommand() throws Exception {
+        BluetoothCommand enableCmd = spy(mShellCommand.new Enable());
+        mShellCommand.mBluetoothCommands[0] = enableCmd;
+
+        mShellCommand.onCommand("enable");
+
+        verify(enableCmd).exec(eq("enable"));
+    }
+
+    @Test
+    public void onCommand_withPrivilegedCommandName_throwsSecurityException() {
+        final String privilegedCommandName = "test_privileged_cmd_name";
+        BluetoothCommand privilegedCommand =
+                mShellCommand.new BluetoothCommand(true, privilegedCommandName) {
+                    @Override
+                    int exec(String cmd) throws RemoteException {
+                        return 0;
+                    }
+                    @Override
+                    public void onHelp(PrintWriter pw) { }
+        };
+        mShellCommand.mBluetoothCommands[0] = privilegedCommand;
+
+        assertThrows(SecurityException.class,
+                () -> mShellCommand.onCommand(privilegedCommandName));
+    }
+}
diff --git a/sysprop/Android.bp b/sysprop/Android.bp
new file mode 100644
index 0000000..67cc6eb
--- /dev/null
+++ b/sysprop/Android.bp
@@ -0,0 +1,20 @@
+package {
+    default_applicable_licenses: ["Android-Apache-2.0"],
+}
+
+sysprop_library {
+  name: "com.android.sysprop.bluetooth",
+  host_supported: true,
+  srcs: [
+    "avrcp.sysprop",
+    "bta.sysprop",
+    "hfp.sysprop",
+    "pan.sysprop",
+  ],
+  property_owner: "Platform",
+  api_packages: ["android.sysprop"],
+  cpp: {
+    min_sdk_version: "Tiramisu",
+  },
+  apex_available: ["com.android.btservices"],
+}
diff --git a/sysprop/OWNERS b/sysprop/OWNERS
new file mode 100644
index 0000000..263e053
--- /dev/null
+++ b/sysprop/OWNERS
@@ -0,0 +1,2 @@
+licorne@google.com
+wescande@google.com
diff --git a/sysprop/avrcp.sysprop b/sysprop/avrcp.sysprop
new file mode 100644
index 0000000..6c12087
--- /dev/null
+++ b/sysprop/avrcp.sysprop
@@ -0,0 +1,11 @@
+module: "android.sysprop.bluetooth.Avrcp"
+owner: Platform
+
+prop {
+    api_name: "absolute_volume"
+    type: Boolean
+    scope: Internal
+    access: Readonly
+    prop_name: "bluetooth.avrcp.absolute_volume.enabled"
+}
+
diff --git a/sysprop/bta.sysprop b/sysprop/bta.sysprop
new file mode 100644
index 0000000..a438a10
--- /dev/null
+++ b/sysprop/bta.sysprop
@@ -0,0 +1,12 @@
+module: "android.sysprop.bluetooth.Bta"
+owner: Platform
+
+prop {
+    api_name: "disable_delay"
+    type: Integer
+    scope: Internal
+    access: Readonly
+    prop_name: "bluetooth.bta.disable_delay.millis"
+}
+
+
diff --git a/sysprop/hfp.sysprop b/sysprop/hfp.sysprop
new file mode 100644
index 0000000..f07124f
--- /dev/null
+++ b/sysprop/hfp.sysprop
@@ -0,0 +1,35 @@
+module: "android.sysprop.bluetooth.Hfp"
+owner: Platform
+
+prop {
+    api_name: "hf_client_features"
+    type: Integer
+    scope: Internal
+    access: Readonly
+    prop_name: "bluetooth.hfp.hf_client_features.config"
+}
+
+prop {
+    api_name: "hf_features"
+    type: Integer
+    scope: Internal
+    access: Readonly
+    prop_name: "bluetooth.hfp.hf_features.config"
+}
+
+prop {
+    api_name: "hf_services"
+    type: Integer
+    scope: Internal
+    access: Readonly
+    prop_name: "bluetooth.hfp.hf_services_mask.config"
+}
+
+prop {
+    api_name: "version"
+    type: Integer
+    scope: Internal
+    access: Readonly
+    prop_name: "bluetooth.hfp.version.config"
+}
+
diff --git a/sysprop/pan.sysprop b/sysprop/pan.sysprop
new file mode 100644
index 0000000..fa64bb3
--- /dev/null
+++ b/sysprop/pan.sysprop
@@ -0,0 +1,10 @@
+module: "android.sysprop.bluetooth.Pan"
+owner: Platform
+
+prop {
+    api_name: "nap"
+    type: Boolean
+    scope: Internal
+    access: Readonly
+    prop_name: "bluetooth.pan.nap.enabled"
+}
diff --git a/system/audio_a2dp_hw/Android.bp b/system/audio_a2dp_hw/Android.bp
index 7d77480..408c49f 100644
--- a/system/audio_a2dp_hw/Android.bp
+++ b/system/audio_a2dp_hw/Android.bp
@@ -45,6 +45,9 @@
         "src/audio_a2dp_hw_utils.cc",
     ],
     host_supported: true,
+    apex_available: [
+        "com.android.bluetooth",
+    ],
     min_sdk_version: "29",
 }
 
diff --git a/system/audio_bluetooth_hw/Android.bp b/system/audio_bluetooth_hw/Android.bp
index 9dc7f53..cc89bdf 100644
--- a/system/audio_bluetooth_hw/Android.bp
+++ b/system/audio_bluetooth_hw/Android.bp
@@ -9,8 +9,18 @@
     default_applicable_licenses: ["system_bt_license"],
 }
 
+cc_defaults {
+    name: "audio_bluetooth_hw_defaults",
+    defaults: ["fluoride_common_options"],
+    cflags: [
+        // suppress the warning in stream_apis.cc
+        "-Wno-sign-compare",
+    ],
+}
+
 cc_library_shared {
     name: "audio.bluetooth.default",
+    defaults: ["audio_bluetooth_hw_defaults"],
     relative_install_path: "hw",
     proprietary: true,
     srcs: [
@@ -37,15 +47,11 @@
         "libbluetooth_audio_session",
         "libhidlbase",
     ],
-    cflags: [
-        "-Wall",
-        "-Werror",
-        "-Wno-unused-parameter",
-    ],
 }
 
 cc_test {
     name: "audio_bluetooth_hw_test",
+    defaults: ["audio_bluetooth_hw_defaults"],
     srcs: [
         "utils.cc",
         "utils_unittest.cc",
@@ -56,9 +62,4 @@
         "liblog",
         "libutils",
     ],
-    cflags: [
-        "-Wall",
-        "-Werror",
-        "-Wno-unused-parameter",
-    ],
 }
diff --git a/system/audio_bluetooth_hw/audio_bluetooth_hw.cc b/system/audio_bluetooth_hw/audio_bluetooth_hw.cc
index 887c4e3..35de87d 100644
--- a/system/audio_bluetooth_hw/audio_bluetooth_hw.cc
+++ b/system/audio_bluetooth_hw/audio_bluetooth_hw.cc
@@ -99,6 +99,59 @@
   return -ENOSYS;
 }
 
+static int adev_create_audio_patch(struct audio_hw_device* device,
+                                   unsigned int num_sources,
+                                   const struct audio_port_config* sources,
+                                   unsigned int num_sinks,
+                                   const struct audio_port_config* sinks,
+                                   audio_patch_handle_t* handle) {
+  if (device == nullptr || sources == nullptr || sinks == nullptr ||
+      handle == nullptr || num_sources != 1 || num_sinks == 0 ||
+      num_sinks > AUDIO_PATCH_PORTS_MAX) {
+    return -EINVAL;
+  }
+  if (sources[0].type == AUDIO_PORT_TYPE_DEVICE) {
+    if (num_sinks != 1 || sinks[0].type != AUDIO_PORT_TYPE_MIX) {
+      return -EINVAL;
+    }
+  } else if (sources[0].type == AUDIO_PORT_TYPE_MIX) {
+    for (unsigned int i = 0; i < num_sinks; i++) {
+      if (sinks[i].type != AUDIO_PORT_TYPE_DEVICE) {
+        return -EINVAL;
+      }
+    }
+  } else {
+    return -EINVAL;
+  }
+
+  auto* bluetooth_device = reinterpret_cast<BluetoothAudioDevice*>(device);
+  std::lock_guard<std::mutex> guard(bluetooth_device->mutex_);
+  if (*handle == AUDIO_PATCH_HANDLE_NONE) {
+    *handle = ++bluetooth_device->next_unique_id;
+  }
+
+  LOG(INFO) << __func__ << ": device=" << std::hex << sinks[0].ext.device.type
+            << " handle: " << *handle;
+  return 0;
+}
+
+static int adev_release_audio_patch(struct audio_hw_device* device,
+                                    audio_patch_handle_t patch_handle) {
+  if (device == nullptr) {
+    return -EINVAL;
+  }
+  LOG(INFO) << __func__ << ": patch_handle=" << patch_handle;
+  return 0;
+}
+
+static int adev_get_audio_port(struct audio_hw_device* device,
+                               struct audio_port* port) {
+  if (device == nullptr || port == nullptr) {
+    return -EINVAL;
+  }
+  return -ENOSYS;
+}
+
 static int adev_dump(const audio_hw_device_t* device, int fd) { return 0; }
 
 static int adev_close(hw_device_t* device) {
@@ -117,7 +170,7 @@
   if (!adev) return -ENOMEM;
 
   adev->common.tag = HARDWARE_DEVICE_TAG;
-  adev->common.version = AUDIO_DEVICE_API_VERSION_2_0;
+  adev->common.version = AUDIO_DEVICE_API_VERSION_3_0;
   adev->common.module = (struct hw_module_t*)module;
   adev->common.close = adev_close;
 
@@ -138,6 +191,9 @@
   adev->dump = adev_dump;
   adev->set_master_mute = adev_set_master_mute;
   adev->get_master_mute = adev_get_master_mute;
+  adev->create_audio_patch = adev_create_audio_patch;
+  adev->release_audio_patch = adev_release_audio_patch;
+  adev->get_audio_port = adev_get_audio_port;
 
   *device = &adev->common;
   return 0;
diff --git a/system/audio_bluetooth_hw/stream_apis.cc b/system/audio_bluetooth_hw/stream_apis.cc
index 1f449fc..5facd12 100644
--- a/system/audio_bluetooth_hw/stream_apis.cc
+++ b/system/audio_bluetooth_hw/stream_apis.cc
@@ -34,6 +34,7 @@
 #include "utils.h"
 
 using ::android::base::StringPrintf;
+using ::android::bluetooth::audio::utils::FrameCount;
 using ::android::bluetooth::audio::utils::GetAudioParamString;
 using ::android::bluetooth::audio::utils::ParseAudioParams;
 
@@ -691,10 +692,6 @@
   out->bluetooth_output_->UpdateSourceMetadata(source_metadata);
 }
 
-static size_t frame_count(size_t microseconds, uint32_t sample_rate) {
-  return (microseconds * sample_rate) / 1000000;
-}
-
 int adev_open_output_stream(struct audio_hw_device* dev,
                             audio_io_handle_t handle, audio_devices_t devices,
                             audio_output_flags_t flags,
@@ -782,7 +779,7 @@
   }
 
   out->frames_count_ =
-      frame_count(out->preferred_data_interval_us, out->sample_rate_);
+      FrameCount(out->preferred_data_interval_us, out->sample_rate_);
 
   out->frames_rendered_ = 0;
   out->frames_presented_ = 0;
@@ -1277,7 +1274,7 @@
   }
 
   in->frames_count_ =
-      frame_count(in->preferred_data_interval_us, in->sample_rate_);
+      FrameCount(in->preferred_data_interval_us, in->sample_rate_);
   in->frames_presented_ = 0;
 
   BluetoothStreamIn* in_ptr = in.release();
diff --git a/system/audio_bluetooth_hw/stream_apis.h b/system/audio_bluetooth_hw/stream_apis.h
index 36dd589..d101027 100644
--- a/system/audio_bluetooth_hw/stream_apis.h
+++ b/system/audio_bluetooth_hw/stream_apis.h
@@ -81,6 +81,7 @@
   std::mutex mutex_;
   std::list<BluetoothStreamOut*> opened_stream_outs_ =
       std::list<BluetoothStreamOut*>(0);
+  uint32_t next_unique_id = 1;
 };
 
 struct BluetoothStreamIn {
diff --git a/system/audio_bluetooth_hw/utils.cc b/system/audio_bluetooth_hw/utils.cc
index b3ac7a5..f864fd5 100644
--- a/system/audio_bluetooth_hw/utils.cc
+++ b/system/audio_bluetooth_hw/utils.cc
@@ -57,6 +57,10 @@
   return sout.str();
 }
 
+size_t FrameCount(uint64_t microseconds, uint32_t sample_rate) {
+  return (microseconds * sample_rate) / 1000000;
+}
+
 }  // namespace utils
 }  // namespace audio
 }  // namespace bluetooth
diff --git a/system/audio_bluetooth_hw/utils.h b/system/audio_bluetooth_hw/utils.h
index 817a432..bdd8a9b 100644
--- a/system/audio_bluetooth_hw/utils.h
+++ b/system/audio_bluetooth_hw/utils.h
@@ -42,6 +42,7 @@
 std::string GetAudioParamString(
     std::unordered_map<std::string, std::string>& params_map);
 
+size_t FrameCount(uint64_t microseconds, uint32_t sample_rate);
 }  // namespace utils
 }  // namespace audio
 }  // namespace bluetooth
diff --git a/system/audio_bluetooth_hw/utils_unittest.cc b/system/audio_bluetooth_hw/utils_unittest.cc
index 665dea6..1bcd5dd 100644
--- a/system/audio_bluetooth_hw/utils_unittest.cc
+++ b/system/audio_bluetooth_hw/utils_unittest.cc
@@ -21,6 +21,7 @@
 
 namespace {
 
+using ::android::bluetooth::audio::utils::FrameCount;
 using ::android::bluetooth::audio::utils::ParseAudioParams;
 
 class UtilsTest : public testing::Test {
@@ -133,4 +134,9 @@
   EXPECT_EQ(map_["key1"], "value1");
 }
 
+TEST_F(UtilsTest, FrameCountTest) {
+  EXPECT_EQ(FrameCount(120000, 44100), 5292);
+  EXPECT_EQ(FrameCount(7500, 32000), 240);
+}
+
 }  // namespace
diff --git a/system/audio_hal_interface/Android.bp b/system/audio_hal_interface/Android.bp
index 57a524d..e01847b 100644
--- a/system/audio_hal_interface/Android.bp
+++ b/system/audio_hal_interface/Android.bp
@@ -67,6 +67,9 @@
     cflags: [
         "-DBUILDCFG",
     ],
+    apex_available: [
+        "com.android.bluetooth",
+    ],
     min_sdk_version: "Tiramisu"
 }
 
diff --git a/system/audio_hal_interface/a2dp_encoding.cc b/system/audio_hal_interface/a2dp_encoding.cc
index c8a5316..a234b0a 100644
--- a/system/audio_hal_interface/a2dp_encoding.cc
+++ b/system/audio_hal_interface/a2dp_encoding.cc
@@ -145,6 +145,16 @@
   }
 }
 
+// Check if OPUS codec is supported
+bool is_opus_supported() {
+  // OPUS codec was added after HIDL HAL was frozen
+  if (HalVersionManager::GetHalTransport() ==
+      BluetoothAudioHalTransport::AIDL) {
+    return true;
+  }
+  return false;
+}
+
 }  // namespace a2dp
 }  // namespace audio
 }  // namespace bluetooth
diff --git a/system/audio_hal_interface/a2dp_encoding.h b/system/audio_hal_interface/a2dp_encoding.h
index 51d5c9f..740855a 100644
--- a/system/audio_hal_interface/a2dp_encoding.h
+++ b/system/audio_hal_interface/a2dp_encoding.h
@@ -59,6 +59,9 @@
 // Update A2DP delay report to BluetoothAudio HAL
 void set_remote_delay(uint16_t delay_report);
 
+// Check whether OPUS is supported
+bool is_opus_supported();
+
 }  // namespace a2dp
 }  // namespace audio
 }  // namespace bluetooth
diff --git a/system/audio_hal_interface/a2dp_encoding_host.cc b/system/audio_hal_interface/a2dp_encoding_host.cc
index b0b6340..f09cb45 100644
--- a/system/audio_hal_interface/a2dp_encoding_host.cc
+++ b/system/audio_hal_interface/a2dp_encoding_host.cc
@@ -272,6 +272,9 @@
   return bytes_read;
 }
 
+// Check if OPUS codec is supported
+bool is_opus_supported() { return true; }
+
 }  // namespace a2dp
 }  // namespace audio
 }  // namespace bluetooth
diff --git a/system/audio_hal_interface/a2dp_encoding_host.h b/system/audio_hal_interface/a2dp_encoding_host.h
index 3a03ebb..5ca5ecb 100644
--- a/system/audio_hal_interface/a2dp_encoding_host.h
+++ b/system/audio_hal_interface/a2dp_encoding_host.h
@@ -52,6 +52,8 @@
 // Invoked by audio server to check audio presentation position periodically.
 PresentationPosition GetPresentationPosition();
 
+bool is_opus_supported();
+
 }  // namespace a2dp
 }  // namespace audio
 }  // namespace bluetooth
diff --git a/system/audio_hal_interface/aidl/a2dp_encoding_aidl.cc b/system/audio_hal_interface/aidl/a2dp_encoding_aidl.cc
index faa735a..15738f0 100644
--- a/system/audio_hal_interface/aidl/a2dp_encoding_aidl.cc
+++ b/system/audio_hal_interface/aidl/a2dp_encoding_aidl.cc
@@ -44,6 +44,7 @@
 using ::bluetooth::audio::aidl::codec::A2dpCodecToHalChannelMode;
 using ::bluetooth::audio::aidl::codec::A2dpCodecToHalSampleRate;
 using ::bluetooth::audio::aidl::codec::A2dpLdacToHalConfig;
+using ::bluetooth::audio::aidl::codec::A2dpOpusToHalConfig;
 using ::bluetooth::audio::aidl::codec::A2dpSbcToHalConfig;
 
 /***
@@ -84,19 +85,20 @@
     return a2dp_ack_to_bt_audio_ctrl_ack(A2DP_CTRL_ACK_SUCCESS);
   }
   if (btif_av_stream_ready()) {
+    // check if codec needs to be switched prior to stream start
+    invoke_switch_codec_cb(is_low_latency);
     /*
      * Post start event and wait for audio path to open.
      * If we are the source, the ACK will be sent after the start
      * procedure is completed, othewise send it now.
      */
     a2dp_pending_cmd_ = A2DP_CTRL_CMD_START;
-    btif_av_stream_start();
+    btif_av_stream_start_with_latency(is_low_latency);
     if (btif_av_get_peer_sep() != AVDT_TSEP_SRC) {
       LOG(INFO) << __func__ << ": accepted";
       return a2dp_ack_to_bt_audio_ctrl_ack(A2DP_CTRL_ACK_PENDING);
     }
     a2dp_pending_cmd_ = A2DP_CTRL_CMD_NONE;
-    invoke_switch_codec_cb(is_low_latency);
     return a2dp_ack_to_bt_audio_ctrl_ack(A2DP_CTRL_ACK_SUCCESS);
   }
   LOG(ERROR) << __func__ << ": AV stream is not ready to start";
@@ -138,6 +140,10 @@
   btif_av_stream_stop(RawAddress::kEmpty);
 }
 
+void A2dpTransport::SetLowLatency(bool is_low_latency) {
+  btif_av_set_low_latency(is_low_latency);
+}
+
 bool A2dpTransport::GetPresentationPosition(uint64_t* remote_delay_report_ns,
                                             uint64_t* total_bytes_read,
                                             timespec* data_position) {
@@ -269,6 +275,12 @@
       }
       break;
     }
+    case BTAV_A2DP_CODEC_INDEX_SOURCE_OPUS: {
+      if (!A2dpOpusToHalConfig(codec_config, a2dp_config)) {
+        return false;
+      }
+      break;
+    }
     case BTAV_A2DP_CODEC_INDEX_MAX:
       [[fallthrough]];
     default:
@@ -569,4 +581,4 @@
 }  // namespace a2dp
 }  // namespace aidl
 }  // namespace audio
-}  // namespace bluetooth
\ No newline at end of file
+}  // namespace bluetooth
diff --git a/system/audio_hal_interface/aidl/a2dp_transport.h b/system/audio_hal_interface/aidl/a2dp_transport.h
index 5732754..1b53da0 100644
--- a/system/audio_hal_interface/aidl/a2dp_transport.h
+++ b/system/audio_hal_interface/aidl/a2dp_transport.h
@@ -39,6 +39,8 @@
 
   void StopRequest() override;
 
+  void SetLowLatency(bool is_low_latency) override;
+
   bool GetPresentationPosition(uint64_t* remote_delay_report_ns,
                                uint64_t* total_bytes_read,
                                timespec* data_position) override;
@@ -69,4 +71,4 @@
 }  // namespace a2dp
 }  // namespace aidl
 }  // namespace audio
-}  // namespace bluetooth
\ No newline at end of file
+}  // namespace bluetooth
diff --git a/system/audio_hal_interface/aidl/bluetooth_audio_port_impl.cc b/system/audio_hal_interface/aidl/bluetooth_audio_port_impl.cc
index d9ce929..813648a 100644
--- a/system/audio_hal_interface/aidl/bluetooth_audio_port_impl.cc
+++ b/system/audio_hal_interface/aidl/bluetooth_audio_port_impl.cc
@@ -137,6 +137,7 @@
     LatencyMode latency_mode) {
   bool is_low_latency = latency_mode == LatencyMode::LOW_LATENCY ? true : false;
   invoke_switch_buffer_size_cb(is_low_latency);
+  transport_instance_->SetLowLatency(is_low_latency);
   return ndk::ScopedAStatus::ok();
 }
 
@@ -148,4 +149,4 @@
 
 }  // namespace aidl
 }  // namespace audio
-}  // namespace bluetooth
\ No newline at end of file
+}  // namespace bluetooth
diff --git a/system/audio_hal_interface/aidl/client_interface_aidl.cc b/system/audio_hal_interface/aidl/client_interface_aidl.cc
index 6c7a687..9af2803 100644
--- a/system/audio_hal_interface/aidl/client_interface_aidl.cc
+++ b/system/audio_hal_interface/aidl/client_interface_aidl.cc
@@ -55,9 +55,8 @@
 }
 
 bool BluetoothAudioClientInterface::is_aidl_available() {
-  auto service = AServiceManager_checkService(
+  return AServiceManager_isDeclared(
       kDefaultAudioProviderFactoryInterface.c_str());
-  return (service != nullptr);
 }
 
 std::vector<AudioCapabilities>
@@ -72,7 +71,7 @@
     return capabilities;
   }
   auto provider_factory = IBluetoothAudioProviderFactory::fromBinder(
-      ::ndk::SpAIBinder(AServiceManager_getService(
+      ::ndk::SpAIBinder(AServiceManager_waitForService(
           kDefaultAudioProviderFactoryInterface.c_str())));
 
   if (provider_factory == nullptr) {
@@ -91,16 +90,15 @@
 }
 
 void BluetoothAudioClientInterface::FetchAudioProvider() {
-  if (provider_ != nullptr) {
-    LOG(WARNING) << __func__ << ": refetch";
-  } else if (!is_aidl_available()) {
-    // AIDL availability should only be checked at the beginning.
-    // When refetching, AIDL may not be ready *yet* but it's expected to be
-    // available later.
+  if (!is_aidl_available()) {
+    LOG(ERROR) << __func__ << ": aidl is not supported on this platform.";
     return;
   }
+  if (provider_ != nullptr) {
+    LOG(WARNING) << __func__ << ": refetch";
+  }
   auto provider_factory = IBluetoothAudioProviderFactory::fromBinder(
-      ::ndk::SpAIBinder(AServiceManager_getService(
+      ::ndk::SpAIBinder(AServiceManager_waitForService(
           kDefaultAudioProviderFactoryInterface.c_str())));
 
   if (provider_factory == nullptr) {
@@ -201,13 +199,14 @@
   bool is_a2dp_offload_session =
       (transport_->GetSessionType() ==
        SessionType::A2DP_HARDWARE_OFFLOAD_ENCODING_DATAPATH);
-  bool is_leaudio_offload_session =
+  bool is_leaudio_unicast_offload_session =
       (transport_->GetSessionType() ==
            SessionType::LE_AUDIO_HARDWARE_OFFLOAD_ENCODING_DATAPATH ||
        transport_->GetSessionType() ==
-           SessionType::LE_AUDIO_HARDWARE_OFFLOAD_DECODING_DATAPATH ||
-       transport_->GetSessionType() ==
-           SessionType::LE_AUDIO_BROADCAST_HARDWARE_OFFLOAD_ENCODING_DATAPATH);
+           SessionType::LE_AUDIO_HARDWARE_OFFLOAD_DECODING_DATAPATH);
+  bool is_leaudio_broadcast_offload_session =
+      (transport_->GetSessionType() ==
+       SessionType::LE_AUDIO_BROADCAST_HARDWARE_OFFLOAD_ENCODING_DATAPATH);
   auto audio_config_tag = audio_config.getTag();
   bool is_software_audio_config =
       (is_software_session &&
@@ -215,11 +214,15 @@
   bool is_a2dp_offload_audio_config =
       (is_a2dp_offload_session &&
        audio_config_tag == AudioConfiguration::a2dpConfig);
-  bool is_leaudio_offload_audio_config =
-      (is_leaudio_offload_session &&
+  bool is_leaudio_unicast_offload_audio_config =
+      (is_leaudio_unicast_offload_session &&
        audio_config_tag == AudioConfiguration::leAudioConfig);
+  bool is_leaudio_broadcast_offload_audio_config =
+      (is_leaudio_broadcast_offload_session &&
+       audio_config_tag == AudioConfiguration::leAudioBroadcastConfig);
   if (!is_software_audio_config && !is_a2dp_offload_audio_config &&
-      !is_leaudio_offload_audio_config) {
+      !is_leaudio_unicast_offload_audio_config &&
+      !is_leaudio_broadcast_offload_audio_config) {
     return false;
   }
   transport_->UpdateAudioConfiguration(audio_config);
@@ -298,7 +301,10 @@
              transport_->GetSessionType() ==
                  SessionType::LE_AUDIO_HARDWARE_OFFLOAD_DECODING_DATAPATH ||
              transport_->GetSessionType() ==
-                 SessionType::LE_AUDIO_HARDWARE_OFFLOAD_ENCODING_DATAPATH) {
+                 SessionType::LE_AUDIO_HARDWARE_OFFLOAD_ENCODING_DATAPATH ||
+             transport_->GetSessionType() ==
+                 SessionType::
+                     LE_AUDIO_BROADCAST_HARDWARE_OFFLOAD_ENCODING_DATAPATH) {
     transport_->ResetPresentationPosition();
     session_started_ = true;
     return 0;
@@ -387,7 +393,9 @@
   if (transport_->GetSessionType() ==
           SessionType::LE_AUDIO_HARDWARE_OFFLOAD_ENCODING_DATAPATH ||
       transport_->GetSessionType() ==
-          SessionType::LE_AUDIO_HARDWARE_OFFLOAD_DECODING_DATAPATH) {
+          SessionType::LE_AUDIO_HARDWARE_OFFLOAD_DECODING_DATAPATH ||
+      transport_->GetSessionType() ==
+          SessionType::LE_AUDIO_BROADCAST_HARDWARE_OFFLOAD_ENCODING_DATAPATH) {
     return;
   }
 
diff --git a/system/audio_hal_interface/aidl/codec_status_aidl.cc b/system/audio_hal_interface/aidl/codec_status_aidl.cc
index 6e63fb3..ec62ed7 100644
--- a/system/audio_hal_interface/aidl/codec_status_aidl.cc
+++ b/system/audio_hal_interface/aidl/codec_status_aidl.cc
@@ -46,6 +46,8 @@
 using ::aidl::android::hardware::bluetooth::audio::LdacChannelMode;
 using ::aidl::android::hardware::bluetooth::audio::LdacConfiguration;
 using ::aidl::android::hardware::bluetooth::audio::LdacQualityIndex;
+using ::aidl::android::hardware::bluetooth::audio::OpusCapabilities;
+using ::aidl::android::hardware::bluetooth::audio::OpusConfiguration;
 using ::aidl::android::hardware::bluetooth::audio::SbcAllocMethod;
 using ::aidl::android::hardware::bluetooth::audio::SbcCapabilities;
 using ::aidl::android::hardware::bluetooth::audio::SbcChannelMode;
@@ -144,6 +146,25 @@
             << " capability=" << ldac_capability.toString();
   return true;
 }
+
+bool opus_offloading_capability_match(
+    const std::optional<OpusCapabilities>& opus_capability,
+    const std::optional<OpusConfiguration>& opus_config) {
+  if (!ContainedInVector(opus_capability->channelMode,
+                         opus_config->channelMode) ||
+      !ContainedInVector(opus_capability->frameDurationUs,
+                         opus_config->frameDurationUs) ||
+      !ContainedInVector(opus_capability->samplingFrequencyHz,
+                         opus_config->samplingFrequencyHz)) {
+    LOG(WARNING) << __func__ << ": software codec=" << opus_config->toString()
+                 << " capability=" << opus_capability->toString();
+    return false;
+  }
+  LOG(INFO) << __func__ << ": offloading codec=" << opus_config->toString()
+            << " capability=" << opus_capability->toString();
+  return true;
+}
+
 }  // namespace
 
 const CodecConfiguration kInvalidCodecConfiguration = {};
@@ -453,6 +474,50 @@
   return true;
 }
 
+bool A2dpOpusToHalConfig(CodecConfiguration* codec_config,
+                         A2dpCodecConfig* a2dp_config) {
+  btav_a2dp_codec_config_t current_codec = a2dp_config->getCodecConfig();
+  if (current_codec.codec_type != BTAV_A2DP_CODEC_INDEX_SOURCE_OPUS) {
+    codec_config = {};
+    return false;
+  }
+  tBT_A2DP_OFFLOAD a2dp_offload;
+  a2dp_config->getCodecSpecificConfig(&a2dp_offload);
+  codec_config->codecType = CodecType::OPUS;
+  OpusConfiguration opus_config = {};
+
+  opus_config.pcmBitDepth = A2dpCodecToHalBitsPerSample(current_codec);
+  if (opus_config.pcmBitDepth <= 0) {
+    LOG(ERROR) << __func__ << ": Unknown Opus bits_per_sample="
+               << current_codec.bits_per_sample;
+    return false;
+  }
+  opus_config.samplingFrequencyHz = A2dpCodecToHalSampleRate(current_codec);
+  if (opus_config.samplingFrequencyHz <= 0) {
+    LOG(ERROR) << __func__
+               << ": Unknown Opus sample_rate=" << current_codec.sample_rate;
+    return false;
+  }
+  opus_config.channelMode = A2dpCodecToHalChannelMode(current_codec);
+  if (opus_config.channelMode == ChannelMode::UNKNOWN) {
+    LOG(ERROR) << __func__
+               << ": Unknown Opus channel_mode=" << current_codec.channel_mode;
+    return false;
+  }
+
+  opus_config.frameDurationUs = 20000;
+
+  if (opus_config.channelMode == ChannelMode::STEREO) {
+    opus_config.octetsPerFrame = 640;
+  } else {
+    opus_config.octetsPerFrame = 320;
+  }
+
+  codec_config->config.set<CodecConfiguration::CodecSpecific::opusConfig>(
+      opus_config);
+  return true;
+}
+
 bool UpdateOffloadingCapabilities(
     const std::vector<btav_a2dp_codec_config_t>& framework_preference) {
   audio_hal_capabilities =
@@ -476,6 +541,9 @@
       case BTAV_A2DP_CODEC_INDEX_SOURCE_LDAC:
         codec_type_set.insert(CodecType::LDAC);
         break;
+      case BTAV_A2DP_CODEC_INDEX_SOURCE_OPUS:
+        codec_type_set.insert(CodecType::OPUS);
+        break;
       case BTAV_A2DP_CODEC_INDEX_SINK_SBC:
         [[fallthrough]];
       case BTAV_A2DP_CODEC_INDEX_SINK_AAC:
@@ -560,6 +628,15 @@
                 .get<CodecConfiguration::CodecSpecific::ldacConfig>();
         return ldac_offloading_capability_match(ldac_capability, ldac_config);
       }
+      case CodecType::OPUS: {
+        std::optional<OpusCapabilities> opus_capability =
+            codec_capability.capabilities
+                .get<CodecCapabilities::Capabilities::opusCapabilities>();
+        std::optional<OpusConfiguration> opus_config =
+            codec_config.config
+                .get<CodecConfiguration::CodecSpecific::opusConfig>();
+        return opus_offloading_capability_match(opus_capability, opus_config);
+      }
       case CodecType::UNKNOWN:
         [[fallthrough]];
       default:
@@ -575,4 +652,4 @@
 }  // namespace codec
 }  // namespace aidl
 }  // namespace audio
-}  // namespace bluetooth
\ No newline at end of file
+}  // namespace bluetooth
diff --git a/system/audio_hal_interface/aidl/codec_status_aidl.h b/system/audio_hal_interface/aidl/codec_status_aidl.h
index c2fa819..3caac07 100644
--- a/system/audio_hal_interface/aidl/codec_status_aidl.h
+++ b/system/audio_hal_interface/aidl/codec_status_aidl.h
@@ -46,6 +46,8 @@
                          A2dpCodecConfig* a2dp_config);
 bool A2dpLdacToHalConfig(CodecConfiguration* codec_config,
                          A2dpCodecConfig* a2dp_config);
+bool A2dpOpusToHalConfig(CodecConfiguration* codec_config,
+                         A2dpCodecConfig* a2dp_config);
 
 bool UpdateOffloadingCapabilities(
     const std::vector<btav_a2dp_codec_config_t>& framework_preference);
@@ -59,4 +61,4 @@
 }  // namespace codec
 }  // namespace aidl
 }  // namespace audio
-}  // namespace bluetooth
\ No newline at end of file
+}  // namespace bluetooth
diff --git a/system/audio_hal_interface/aidl/hearing_aid_software_encoding_aidl.cc b/system/audio_hal_interface/aidl/hearing_aid_software_encoding_aidl.cc
index 91b4dca..1cab476 100644
--- a/system/audio_hal_interface/aidl/hearing_aid_software_encoding_aidl.cc
+++ b/system/audio_hal_interface/aidl/hearing_aid_software_encoding_aidl.cc
@@ -74,6 +74,8 @@
     }
   }
 
+  void SetLowLatency(bool is_low_latency) override {}
+
   bool GetPresentationPosition(uint64_t* remote_delay_report_ns,
                                uint64_t* total_bytes_read,
                                timespec* data_position) override {
@@ -267,4 +269,4 @@
 }  // namespace hearing_aid
 }  // namespace aidl
 }  // namespace audio
-}  // namespace bluetooth
\ No newline at end of file
+}  // namespace bluetooth
diff --git a/system/audio_hal_interface/aidl/le_audio_software_aidl.cc b/system/audio_hal_interface/aidl/le_audio_software_aidl.cc
index 40f991e..1b46525 100644
--- a/system/audio_hal_interface/aidl/le_audio_software_aidl.cc
+++ b/system/audio_hal_interface/aidl/le_audio_software_aidl.cc
@@ -19,11 +19,13 @@
 
 #include "le_audio_software_aidl.h"
 
+#include <atomic>
 #include <unordered_map>
 #include <vector>
 
 #include "codec_status_aidl.h"
 #include "hal_version_manager.h"
+#include "osi/include/log.h"
 
 namespace bluetooth {
 namespace audio {
@@ -40,6 +42,7 @@
 using ::bluetooth::audio::aidl::AudioConfiguration;
 using ::bluetooth::audio::aidl::BluetoothAudioCtrlAck;
 using ::bluetooth::audio::le_audio::LeAudioClientInterface;
+using ::bluetooth::audio::le_audio::StartRequestState;
 using ::bluetooth::audio::le_audio::StreamCallbacks;
 using ::le_audio::set_configurations::SetConfiguration;
 using ::le_audio::types::LeAudioLc3Config;
@@ -63,16 +66,38 @@
       total_bytes_processed_(0),
       data_position_({}),
       pcm_config_(std::move(pcm_config)),
-      is_pending_start_request_(false){};
+      start_request_state_(StartRequestState::IDLE){};
 
 BluetoothAudioCtrlAck LeAudioTransport::StartRequest(bool is_low_latency) {
-  LOG(INFO) << __func__;
-
+  SetStartRequestState(StartRequestState::PENDING_BEFORE_RESUME);
   if (stream_cb_.on_resume_(true)) {
-    is_pending_start_request_ = true;
-    return BluetoothAudioCtrlAck::PENDING;
+    auto expected = StartRequestState::CONFIRMED;
+    if (std::atomic_compare_exchange_strong(&start_request_state_, &expected,
+                                            StartRequestState::IDLE)) {
+      LOG_INFO("Start completed.");
+      return BluetoothAudioCtrlAck::SUCCESS_FINISHED;
+    }
+
+    expected = StartRequestState::CANCELED;
+    if (std::atomic_compare_exchange_strong(&start_request_state_, &expected,
+                                            StartRequestState::IDLE)) {
+      LOG_INFO("Start request failed.");
+      return BluetoothAudioCtrlAck::FAILURE;
+    }
+
+    expected = StartRequestState::PENDING_BEFORE_RESUME;
+    if (std::atomic_compare_exchange_strong(
+            &start_request_state_, &expected,
+            StartRequestState::PENDING_AFTER_RESUME)) {
+      LOG_INFO("Start pending.");
+      return BluetoothAudioCtrlAck::PENDING;
+    }
   }
 
+  LOG_ERROR("Start request failed.");
+  auto expected = StartRequestState::PENDING_BEFORE_RESUME;
+  std::atomic_compare_exchange_strong(&start_request_state_, &expected,
+                                      StartRequestState::IDLE);
   return BluetoothAudioCtrlAck::FAILURE;
 }
 
@@ -93,6 +118,8 @@
   }
 }
 
+void LeAudioTransport::SetLowLatency(bool is_low_latency) {}
+
 bool LeAudioTransport::GetPresentationPosition(uint64_t* remote_delay_report_ns,
                                                uint64_t* total_bytes_processed,
                                                timespec* data_position) {
@@ -168,11 +195,39 @@
   pcm_config_.dataIntervalUs = data_interval;
 }
 
-bool LeAudioTransport::IsPendingStartStream(void) {
-  return is_pending_start_request_;
+void LeAudioTransport::LeAudioSetBroadcastConfig(
+    const ::le_audio::broadcast_offload_config& offload_config) {
+  broadcast_config_.streamMap.resize(0);
+  for (auto& [handle, location] : offload_config.stream_map) {
+    Lc3Configuration lc3_config{
+        .pcmBitDepth = static_cast<int8_t>(offload_config.bits_per_sample),
+        .samplingFrequencyHz =
+            static_cast<int32_t>(offload_config.sampling_rate),
+        .frameDurationUs = static_cast<int32_t>(offload_config.frame_duration),
+        .octetsPerFrame = static_cast<int32_t>(offload_config.octets_per_frame),
+        .blocksPerSdu = static_cast<int8_t>(offload_config.blocks_per_sdu),
+    };
+    broadcast_config_.streamMap.push_back({
+        .streamHandle = handle,
+        .audioChannelAllocation = static_cast<int32_t>(location),
+        .leAudioCodecConfig = std::move(lc3_config),
+    });
+  }
 }
-void LeAudioTransport::ClearPendingStartStream(void) {
-  is_pending_start_request_ = false;
+
+const LeAudioBroadcastConfiguration&
+LeAudioTransport::LeAudioGetBroadcastConfig() {
+  return broadcast_config_;
+}
+
+StartRequestState LeAudioTransport::GetStartRequestState(void) {
+  return start_request_state_;
+}
+void LeAudioTransport::ClearStartRequestState(void) {
+  start_request_state_ = StartRequestState::IDLE;
+}
+void LeAudioTransport::SetStartRequestState(StartRequestState state) {
+  start_request_state_ = state;
 }
 
 inline void flush_unicast_sink() {
@@ -219,6 +274,10 @@
 
 void LeAudioSinkTransport::StopRequest() { transport_->StopRequest(); }
 
+void LeAudioSinkTransport::SetLowLatency(bool is_low_latency) {
+  transport_->SetLowLatency(is_low_latency);
+}
+
 bool LeAudioSinkTransport::GetPresentationPosition(
     uint64_t* remote_delay_report_ns, uint64_t* total_bytes_read,
     timespec* data_position) {
@@ -259,11 +318,24 @@
                                              channels_count, data_interval);
 }
 
-bool LeAudioSinkTransport::IsPendingStartStream(void) {
-  return transport_->IsPendingStartStream();
+void LeAudioSinkTransport::LeAudioSetBroadcastConfig(
+    const ::le_audio::broadcast_offload_config& offload_config) {
+  transport_->LeAudioSetBroadcastConfig(offload_config);
 }
-void LeAudioSinkTransport::ClearPendingStartStream(void) {
-  transport_->ClearPendingStartStream();
+
+const LeAudioBroadcastConfiguration&
+LeAudioSinkTransport::LeAudioGetBroadcastConfig() {
+  return transport_->LeAudioGetBroadcastConfig();
+}
+
+StartRequestState LeAudioSinkTransport::GetStartRequestState(void) {
+  return transport_->GetStartRequestState();
+}
+void LeAudioSinkTransport::ClearStartRequestState(void) {
+  transport_->ClearStartRequestState();
+}
+void LeAudioSinkTransport::SetStartRequestState(StartRequestState state) {
+  transport_->SetStartRequestState(state);
 }
 
 void flush_source() {
@@ -292,6 +364,10 @@
 
 void LeAudioSourceTransport::StopRequest() { transport_->StopRequest(); }
 
+void LeAudioSourceTransport::SetLowLatency(bool is_low_latency) {
+  transport_->SetLowLatency(is_low_latency);
+}
+
 bool LeAudioSourceTransport::GetPresentationPosition(
     uint64_t* remote_delay_report_ns, uint64_t* total_bytes_written,
     timespec* data_position) {
@@ -333,11 +409,15 @@
                                              channels_count, data_interval);
 }
 
-bool LeAudioSourceTransport::IsPendingStartStream(void) {
-  return transport_->IsPendingStartStream();
+StartRequestState LeAudioSourceTransport::GetStartRequestState(void) {
+  return transport_->GetStartRequestState();
 }
-void LeAudioSourceTransport::ClearPendingStartStream(void) {
-  transport_->ClearPendingStartStream();
+void LeAudioSourceTransport::ClearStartRequestState(void) {
+  transport_->ClearStartRequestState();
+}
+
+void LeAudioSourceTransport::SetStartRequestState(StartRequestState state) {
+  transport_->SetStartRequestState(state);
 }
 
 std::unordered_map<int32_t, uint8_t> sampling_freq_map{
@@ -503,4 +583,4 @@
 }  // namespace le_audio
 }  // namespace aidl
 }  // namespace audio
-}  // namespace bluetooth
\ No newline at end of file
+}  // namespace bluetooth
diff --git a/system/audio_hal_interface/aidl/le_audio_software_aidl.h b/system/audio_hal_interface/aidl/le_audio_software_aidl.h
index 6b763b7..86e4546 100644
--- a/system/audio_hal_interface/aidl/le_audio_software_aidl.h
+++ b/system/audio_hal_interface/aidl/le_audio_software_aidl.h
@@ -33,6 +33,7 @@
 using ::aidl::android::hardware::bluetooth::audio::SessionType;
 using ::aidl::android::hardware::bluetooth::audio::UnicastCapability;
 using ::bluetooth::audio::aidl::BluetoothAudioCtrlAck;
+using ::bluetooth::audio::le_audio::StartRequestState;
 using ::le_audio::set_configurations::AudioSetConfiguration;
 using ::le_audio::set_configurations::CodecCapabilitySetting;
 
@@ -76,6 +77,8 @@
 
   void StopRequest();
 
+  void SetLowLatency(bool is_low_latency);
+
   bool GetPresentationPosition(uint64_t* remote_delay_report_ns,
                                uint64_t* total_bytes_processed,
                                timespec* data_position);
@@ -96,8 +99,14 @@
                                       uint8_t channels_count,
                                       uint32_t data_interval);
 
-  bool IsPendingStartStream(void);
-  void ClearPendingStartStream(void);
+  void LeAudioSetBroadcastConfig(
+      const ::le_audio::broadcast_offload_config& offload_config);
+
+  const LeAudioBroadcastConfiguration& LeAudioGetBroadcastConfig();
+
+  StartRequestState GetStartRequestState(void);
+  void ClearStartRequestState(void);
+  void SetStartRequestState(StartRequestState state);
 
  private:
   void (*flush_)(void);
@@ -106,7 +115,8 @@
   uint64_t total_bytes_processed_;
   timespec data_position_;
   PcmConfiguration pcm_config_;
-  bool is_pending_start_request_;
+  LeAudioBroadcastConfiguration broadcast_config_;
+  std::atomic<StartRequestState> start_request_state_;
 };
 
 // Sink transport implementation for Le Audio
@@ -123,6 +133,8 @@
 
   void StopRequest() override;
 
+  void SetLowLatency(bool is_low_latency) override;
+
   bool GetPresentationPosition(uint64_t* remote_delay_report_ns,
                                uint64_t* total_bytes_read,
                                timespec* data_position) override;
@@ -143,8 +155,14 @@
                                       uint8_t channels_count,
                                       uint32_t data_interval);
 
-  bool IsPendingStartStream(void);
-  void ClearPendingStartStream(void);
+  void LeAudioSetBroadcastConfig(
+      const ::le_audio::broadcast_offload_config& offload_config);
+
+  const LeAudioBroadcastConfiguration& LeAudioGetBroadcastConfig();
+
+  StartRequestState GetStartRequestState(void);
+  void ClearStartRequestState(void);
+  void SetStartRequestState(StartRequestState state);
 
   static inline LeAudioSinkTransport* instance_unicast_ = nullptr;
   static inline LeAudioSinkTransport* instance_broadcast_ = nullptr;
@@ -170,6 +188,8 @@
 
   void StopRequest() override;
 
+  void SetLowLatency(bool is_low_latency) override;
+
   bool GetPresentationPosition(uint64_t* remote_delay_report_ns,
                                uint64_t* total_bytes_written,
                                timespec* data_position) override;
@@ -190,8 +210,9 @@
                                       uint8_t channels_count,
                                       uint32_t data_interval);
 
-  bool IsPendingStartStream(void);
-  void ClearPendingStartStream(void);
+  StartRequestState GetStartRequestState(void);
+  void ClearStartRequestState(void);
+  void SetStartRequestState(StartRequestState state);
 
   static inline LeAudioSourceTransport* instance = nullptr;
   static inline BluetoothAudioSourceClientInterface* interface = nullptr;
@@ -203,4 +224,4 @@
 }  // namespace le_audio
 }  // namespace aidl
 }  // namespace audio
-}  // namespace bluetooth
\ No newline at end of file
+}  // namespace bluetooth
diff --git a/system/audio_hal_interface/aidl/transport_instance.h b/system/audio_hal_interface/aidl/transport_instance.h
index 11b9a21..e7967ab 100644
--- a/system/audio_hal_interface/aidl/transport_instance.h
+++ b/system/audio_hal_interface/aidl/transport_instance.h
@@ -71,6 +71,8 @@
 
   virtual void StopRequest() = 0;
 
+  virtual void SetLowLatency(bool is_low_latency) = 0;
+
   virtual bool GetPresentationPosition(uint64_t* remote_delay_report_ns,
                                        uint64_t* total_bytes_readed,
                                        timespec* data_position) = 0;
@@ -122,4 +124,4 @@
 
 }  // namespace aidl
 }  // namespace audio
-}  // namespace bluetooth
\ No newline at end of file
+}  // namespace bluetooth
diff --git a/system/audio_hal_interface/fuzzer/Android.bp b/system/audio_hal_interface/fuzzer/Android.bp
index ac74f13..844fdd3 100644
--- a/system/audio_hal_interface/fuzzer/Android.bp
+++ b/system/audio_hal_interface/fuzzer/Android.bp
@@ -72,6 +72,7 @@
         "libudrv-uipc",
         "libbt-common",
         "liblc3",
+        "libopus",
         "libstatslog_bt",
         "libvndksupport",
         "libprocessgroup",
diff --git a/system/audio_hal_interface/hidl/le_audio_software_hidl.cc b/system/audio_hal_interface/hidl/le_audio_software_hidl.cc
index 6903345..fcb0ac7 100644
--- a/system/audio_hal_interface/hidl/le_audio_software_hidl.cc
+++ b/system/audio_hal_interface/hidl/le_audio_software_hidl.cc
@@ -19,6 +19,8 @@
 
 #include "le_audio_software_hidl.h"
 
+#include "osi/include/log.h"
+
 namespace bluetooth {
 namespace audio {
 namespace hidl {
@@ -32,6 +34,7 @@
 using ::bluetooth::audio::hidl::SessionType_2_1;
 
 using ::bluetooth::audio::le_audio::LeAudioClientInterface;
+using ::bluetooth::audio::le_audio::StartRequestState;
 
 /**
  * Helper utils
@@ -103,16 +106,30 @@
       total_bytes_processed_(0),
       data_position_({}),
       pcm_config_(std::move(pcm_config)),
-      is_pending_start_request_(false){};
+      start_request_state_(StartRequestState::IDLE){};
 
 BluetoothAudioCtrlAck LeAudioTransport::StartRequest() {
-  LOG(INFO) << __func__;
-
+  SetStartRequestState(StartRequestState::PENDING_BEFORE_RESUME);
   if (stream_cb_.on_resume_(true)) {
-    is_pending_start_request_ = true;
+    if (start_request_state_ == StartRequestState::CONFIRMED) {
+      LOG_INFO("Start completed.");
+      SetStartRequestState(StartRequestState::IDLE);
+      return BluetoothAudioCtrlAck::SUCCESS_FINISHED;
+    }
+
+    if (start_request_state_ == StartRequestState::CANCELED) {
+      LOG_INFO("Start request failed.");
+      SetStartRequestState(StartRequestState::IDLE);
+      return BluetoothAudioCtrlAck::FAILURE;
+    }
+
+    LOG_INFO("Start pending.");
+    SetStartRequestState(StartRequestState::PENDING_AFTER_RESUME);
     return BluetoothAudioCtrlAck::PENDING;
   }
 
+  LOG_ERROR("Start request failed.");
+  SetStartRequestState(StartRequestState::IDLE);
   return BluetoothAudioCtrlAck::FAILURE;
 }
 
@@ -195,11 +212,14 @@
   pcm_config_.dataIntervalUs = data_interval;
 }
 
-bool LeAudioTransport::IsPendingStartStream(void) {
-  return is_pending_start_request_;
+StartRequestState LeAudioTransport::GetStartRequestState(void) {
+  return start_request_state_;
 }
-void LeAudioTransport::ClearPendingStartStream(void) {
-  is_pending_start_request_ = false;
+void LeAudioTransport::ClearStartRequestState(void) {
+  start_request_state_ = StartRequestState::IDLE;
+}
+void LeAudioTransport::SetStartRequestState(StartRequestState state) {
+  start_request_state_ = state;
 }
 
 void flush_sink() {
@@ -264,11 +284,14 @@
                                              channels_count, data_interval);
 }
 
-bool LeAudioSinkTransport::IsPendingStartStream(void) {
-  return transport_->IsPendingStartStream();
+StartRequestState LeAudioSinkTransport::GetStartRequestState(void) {
+  return transport_->GetStartRequestState();
 }
-void LeAudioSinkTransport::ClearPendingStartStream(void) {
-  transport_->ClearPendingStartStream();
+void LeAudioSinkTransport::ClearStartRequestState(void) {
+  transport_->ClearStartRequestState();
+}
+void LeAudioSinkTransport::SetStartRequestState(StartRequestState state) {
+  transport_->SetStartRequestState(state);
 }
 
 void flush_source() {
@@ -333,11 +356,14 @@
                                              channels_count, data_interval);
 }
 
-bool LeAudioSourceTransport::IsPendingStartStream(void) {
-  return transport_->IsPendingStartStream();
+StartRequestState LeAudioSourceTransport::GetStartRequestState(void) {
+  return transport_->GetStartRequestState();
 }
-void LeAudioSourceTransport::ClearPendingStartStream(void) {
-  transport_->ClearPendingStartStream();
+void LeAudioSourceTransport::ClearStartRequestState(void) {
+  transport_->ClearStartRequestState();
+}
+void LeAudioSourceTransport::SetStartRequestState(StartRequestState state) {
+  transport_->SetStartRequestState(state);
 }
 }  // namespace le_audio
 }  // namespace hidl
diff --git a/system/audio_hal_interface/hidl/le_audio_software_hidl.h b/system/audio_hal_interface/hidl/le_audio_software_hidl.h
index 3b63c07..01bf6fa 100644
--- a/system/audio_hal_interface/hidl/le_audio_software_hidl.h
+++ b/system/audio_hal_interface/hidl/le_audio_software_hidl.h
@@ -30,6 +30,8 @@
 using ::le_audio::set_configurations::AudioSetConfiguration;
 using ::le_audio::set_configurations::CodecCapabilitySetting;
 
+using ::bluetooth::audio::le_audio::StartRequestState;
+
 constexpr uint8_t kChannelNumberMono = 1;
 constexpr uint8_t kChannelNumberStereo = 2;
 
@@ -81,8 +83,9 @@
                                       uint8_t channels_count,
                                       uint32_t data_interval);
 
-  bool IsPendingStartStream(void);
-  void ClearPendingStartStream(void);
+  StartRequestState GetStartRequestState(void);
+  void ClearStartRequestState(void);
+  void SetStartRequestState(StartRequestState state);
 
  private:
   void (*flush_)(void);
@@ -91,7 +94,7 @@
   uint64_t total_bytes_processed_;
   timespec data_position_;
   PcmParameters pcm_config_;
-  bool is_pending_start_request_;
+  std::atomic<StartRequestState> start_request_state_;
 };
 
 // Sink transport implementation for Le Audio
@@ -126,8 +129,9 @@
                                       uint8_t channels_count,
                                       uint32_t data_interval);
 
-  bool IsPendingStartStream(void);
-  void ClearPendingStartStream(void);
+  StartRequestState GetStartRequestState(void);
+  void ClearStartRequestState(void);
+  void SetStartRequestState(StartRequestState state);
 
   static inline LeAudioSinkTransport* instance = nullptr;
   static inline BluetoothAudioSinkClientInterface* interface = nullptr;
@@ -168,8 +172,9 @@
                                       uint8_t channels_count,
                                       uint32_t data_interval);
 
-  bool IsPendingStartStream(void);
-  void ClearPendingStartStream(void);
+  StartRequestState GetStartRequestState(void);
+  void ClearStartRequestState(void);
+  void SetStartRequestState(StartRequestState state);
 
   static inline LeAudioSourceTransport* instance = nullptr;
   static inline BluetoothAudioSourceClientInterface* interface = nullptr;
diff --git a/system/audio_hal_interface/le_audio_software.cc b/system/audio_hal_interface/le_audio_software.cc
index ab8dad1..ac6f1d6 100644
--- a/system/audio_hal_interface/le_audio_software.cc
+++ b/system/audio_hal_interface/le_audio_software.cc
@@ -40,6 +40,7 @@
     ::android::hardware::bluetooth::audio::V2_1::AudioConfiguration;
 using AudioConfigurationAIDL =
     ::aidl::android::hardware::bluetooth::audio::AudioConfiguration;
+using ::aidl::android::hardware::bluetooth::audio::LeAudioCodecConfiguration;
 
 using ::le_audio::CodecManager;
 using ::le_audio::set_configurations::AudioSetConfiguration;
@@ -170,9 +171,9 @@
     AudioConfigurationAIDL audio_config;
     if (is_aidl_offload_encoding_session(is_broadcaster_)) {
       if (is_broadcaster_) {
-        aidl::le_audio::LeAudioBroadcastConfiguration le_audio_config = {};
         audio_config.set<AudioConfigurationAIDL::leAudioBroadcastConfig>(
-            le_audio_config);
+            get_aidl_transport_instance(is_broadcaster_)
+                ->LeAudioGetBroadcastConfig());
       } else {
         aidl::le_audio::LeAudioConfiguration le_audio_config = {};
         audio_config.set<AudioConfigurationAIDL::leAudioConfig>(
@@ -193,61 +194,113 @@
 }
 
 void LeAudioClientInterface::Sink::ConfirmStreamingRequest() {
-  LOG(INFO) << __func__;
-
   if (HalVersionManager::GetHalTransport() ==
       BluetoothAudioHalTransport::HIDL) {
-    if (!hidl::le_audio::LeAudioSinkTransport::instance
-             ->IsPendingStartStream()) {
-      LOG(WARNING) << ", no pending start stream request";
-      return;
+    auto hidl_instance = hidl::le_audio::LeAudioSinkTransport::instance;
+    auto start_request_state = hidl_instance->GetStartRequestState();
+
+    switch (start_request_state) {
+      case StartRequestState::IDLE:
+        LOG_WARN(", no pending start stream request");
+        return;
+      case StartRequestState::PENDING_BEFORE_RESUME:
+        LOG_INFO("Response before sending PENDING to audio HAL");
+        hidl_instance->SetStartRequestState(StartRequestState::CONFIRMED);
+        return;
+      case StartRequestState::PENDING_AFTER_RESUME:
+        LOG_INFO("Response after sending PENDING to audio HAL");
+        hidl_instance->ClearStartRequestState();
+        hidl::le_audio::LeAudioSinkTransport::interface->StreamStarted(
+            hidl::BluetoothAudioCtrlAck::SUCCESS_FINISHED);
+        return;
+      case StartRequestState::CONFIRMED:
+      case StartRequestState::CANCELED:
+        LOG_ERROR("Invalid state, start stream already confirmed");
+        return;
     }
-    hidl::le_audio::LeAudioSinkTransport::instance->ClearPendingStartStream();
-    hidl::le_audio::LeAudioSinkTransport::interface->StreamStarted(
-        hidl::BluetoothAudioCtrlAck::SUCCESS_FINISHED);
-    return;
   }
-  if (!get_aidl_transport_instance(is_broadcaster_)->IsPendingStartStream()) {
-    LOG(WARNING) << ", no pending start stream request";
-    return;
+
+  auto aidl_instance = get_aidl_transport_instance(is_broadcaster_);
+  auto start_request_state = aidl_instance->GetStartRequestState();
+  switch (start_request_state) {
+    case StartRequestState::IDLE:
+      LOG_WARN(", no pending start stream request");
+      return;
+    case StartRequestState::PENDING_BEFORE_RESUME:
+      LOG_INFO("Response before sending PENDING to audio HAL");
+      aidl_instance->SetStartRequestState(StartRequestState::CONFIRMED);
+      return;
+    case StartRequestState::PENDING_AFTER_RESUME:
+      LOG_INFO("Response after sending PENDING to audio HAL");
+      aidl_instance->ClearStartRequestState();
+      get_aidl_client_interface(is_broadcaster_)
+          ->StreamStarted(aidl::BluetoothAudioCtrlAck::SUCCESS_FINISHED);
+      return;
+    case StartRequestState::CONFIRMED:
+    case StartRequestState::CANCELED:
+      LOG_ERROR("Invalid state, start stream already confirmed");
+      return;
   }
-  get_aidl_transport_instance(is_broadcaster_)->ClearPendingStartStream();
-  get_aidl_client_interface(is_broadcaster_)
-      ->StreamStarted(aidl::BluetoothAudioCtrlAck::SUCCESS_FINISHED);
 }
 
 void LeAudioClientInterface::Sink::CancelStreamingRequest() {
-  LOG(INFO) << __func__;
   if (HalVersionManager::GetHalTransport() ==
       BluetoothAudioHalTransport::HIDL) {
-    if (!hidl::le_audio::LeAudioSinkTransport::instance
-             ->IsPendingStartStream()) {
-      LOG(WARNING) << ", no pending start stream request";
-      return;
+    auto hidl_instance = hidl::le_audio::LeAudioSinkTransport::instance;
+    auto start_request_state = hidl_instance->GetStartRequestState();
+    switch (start_request_state) {
+      case StartRequestState::IDLE:
+        LOG_WARN(", no pending start stream request");
+        return;
+      case StartRequestState::PENDING_BEFORE_RESUME:
+        LOG_INFO("Response before sending PENDING to audio HAL");
+        hidl_instance->SetStartRequestState(StartRequestState::CANCELED);
+        return;
+      case StartRequestState::PENDING_AFTER_RESUME:
+        LOG_INFO("Response after sending PENDING to audio HAL");
+        hidl_instance->ClearStartRequestState();
+        hidl::le_audio::LeAudioSinkTransport::interface->StreamStarted(
+            hidl::BluetoothAudioCtrlAck::FAILURE);
+        return;
+      case StartRequestState::CONFIRMED:
+      case StartRequestState::CANCELED:
+        LOG_ERROR("Invalid state, start stream already confirmed");
+        break;
     }
-    hidl::le_audio::LeAudioSinkTransport::instance->ClearPendingStartStream();
-    hidl::le_audio::LeAudioSinkTransport::interface->StreamStarted(
-        hidl::BluetoothAudioCtrlAck::FAILURE);
-    return;
   }
-  if (!get_aidl_transport_instance(is_broadcaster_)->IsPendingStartStream()) {
-    LOG(WARNING) << ", no pending start stream request";
-    return;
+
+  auto aidl_instance = get_aidl_transport_instance(is_broadcaster_);
+  auto start_request_state = aidl_instance->GetStartRequestState();
+  switch (start_request_state) {
+    case StartRequestState::IDLE:
+      LOG_WARN(", no pending start stream request");
+      return;
+    case StartRequestState::PENDING_BEFORE_RESUME:
+      LOG_INFO("Response before sending PENDING to audio HAL");
+      aidl_instance->SetStartRequestState(StartRequestState::CANCELED);
+      return;
+    case StartRequestState::PENDING_AFTER_RESUME:
+      LOG_INFO("Response after sending PENDING to audio HAL");
+      aidl_instance->ClearStartRequestState();
+      get_aidl_client_interface(is_broadcaster_)
+          ->StreamStarted(aidl::BluetoothAudioCtrlAck::FAILURE);
+      return;
+    case StartRequestState::CONFIRMED:
+    case StartRequestState::CANCELED:
+      LOG_ERROR("Invalid state, start stream already confirmed");
+      break;
   }
-  get_aidl_transport_instance(is_broadcaster_)->ClearPendingStartStream();
-  get_aidl_client_interface(is_broadcaster_)
-      ->StreamStarted(aidl::BluetoothAudioCtrlAck::FAILURE);
 }
 
 void LeAudioClientInterface::Sink::StopSession() {
   LOG(INFO) << __func__ << " sink";
   if (HalVersionManager::GetHalTransport() ==
       BluetoothAudioHalTransport::HIDL) {
-    hidl::le_audio::LeAudioSinkTransport::instance->ClearPendingStartStream();
+    hidl::le_audio::LeAudioSinkTransport::instance->ClearStartRequestState();
     hidl::le_audio::LeAudioSinkTransport::interface->EndSession();
     return;
   }
-  get_aidl_transport_instance(is_broadcaster_)->ClearPendingStartStream();
+  get_aidl_transport_instance(is_broadcaster_)->ClearStartRequestState();
   get_aidl_client_interface(is_broadcaster_)->EndSession();
 }
 
@@ -257,12 +310,8 @@
       BluetoothAudioHalTransport::HIDL) {
     return;
   }
-  if (!is_aidl_offload_encoding_session(is_broadcaster_)) {
-    return;
-  }
 
-  if (is_broadcaster_) {
-    LOG(WARNING) << __func__ << ", broadcasting not supported";
+  if (is_broadcaster_ || !is_aidl_offload_encoding_session(is_broadcaster_)) {
     return;
   }
 
@@ -271,6 +320,21 @@
           aidl::le_audio::offload_config_to_hal_audio_config(offload_config));
 }
 
+void LeAudioClientInterface::Sink::UpdateBroadcastAudioConfigToHal(
+    const ::le_audio::broadcast_offload_config& offload_config) {
+  if (HalVersionManager::GetHalTransport() ==
+      BluetoothAudioHalTransport::HIDL) {
+    return;
+  }
+
+  if (!is_broadcaster_ || !is_aidl_offload_encoding_session(is_broadcaster_)) {
+    return;
+  }
+
+  get_aidl_transport_instance(is_broadcaster_)
+      ->LeAudioSetBroadcastConfig(offload_config);
+}
+
 void LeAudioClientInterface::Sink::SuspendedForReconfiguration() {
   if (HalVersionManager::GetHalTransport() ==
       BluetoothAudioHalTransport::HIDL) {
@@ -283,6 +347,18 @@
       ->StreamSuspended(aidl::BluetoothAudioCtrlAck::SUCCESS_RECONFIGURATION);
 }
 
+void LeAudioClientInterface::Sink::ReconfigurationComplete() {
+  // This is needed only for AIDL since SuspendedForReconfiguration()
+  // already calls StreamSuspended(SUCCESS_FINISHED) for HIDL
+  if (HalVersionManager::GetHalTransport() ==
+      BluetoothAudioHalTransport::AIDL) {
+    // FIXME: For now we have to workaround the missing API and use
+    //        StreamSuspended() with SUCCESS_FINISHED ack code.
+    get_aidl_client_interface(is_broadcaster_)
+        ->StreamSuspended(aidl::BluetoothAudioCtrlAck::SUCCESS_FINISHED);
+  }
+}
+
 size_t LeAudioClientInterface::Sink::Read(uint8_t* p_buf, uint32_t len) {
   if (HalVersionManager::GetHalTransport() ==
       BluetoothAudioHalTransport::HIDL) {
@@ -392,63 +468,126 @@
       aidl::BluetoothAudioCtrlAck::SUCCESS_RECONFIGURATION);
 }
 
-void LeAudioClientInterface::Source::ConfirmStreamingRequest() {
-  LOG(INFO) << __func__;
-  if ((hidl::le_audio::LeAudioSourceTransport::instance &&
-       !hidl::le_audio::LeAudioSourceTransport::instance
-            ->IsPendingStartStream()) ||
-      (aidl::le_audio::LeAudioSourceTransport::instance &&
-       !aidl::le_audio::LeAudioSourceTransport::instance
-            ->IsPendingStartStream())) {
-    LOG(WARNING) << ", no pending start stream request";
-    return;
+void LeAudioClientInterface::Source::ReconfigurationComplete() {
+  // This is needed only for AIDL since SuspendedForReconfiguration()
+  // already calls StreamSuspended(SUCCESS_FINISHED) for HIDL
+  if (HalVersionManager::GetHalTransport() ==
+      BluetoothAudioHalTransport::AIDL) {
+    // FIXME: For now we have to workaround the missing API and use
+    //        StreamSuspended() with SUCCESS_FINISHED ack code.
+    aidl::le_audio::LeAudioSourceTransport::interface->StreamSuspended(
+        aidl::BluetoothAudioCtrlAck::SUCCESS_FINISHED);
   }
+}
 
+void LeAudioClientInterface::Source::ConfirmStreamingRequest() {
   if (HalVersionManager::GetHalTransport() ==
       BluetoothAudioHalTransport::HIDL) {
-    hidl::le_audio::LeAudioSourceTransport::instance->ClearPendingStartStream();
-    hidl::le_audio::LeAudioSourceTransport::interface->StreamStarted(
-        hidl::BluetoothAudioCtrlAck::SUCCESS_FINISHED);
-    return;
+    auto hidl_instance = hidl::le_audio::LeAudioSourceTransport::instance;
+    auto start_request_state = hidl_instance->GetStartRequestState();
+
+    switch (start_request_state) {
+      case StartRequestState::IDLE:
+        LOG_WARN(", no pending start stream request");
+        return;
+      case StartRequestState::PENDING_BEFORE_RESUME:
+        LOG_INFO("Response before sending PENDING to audio HAL");
+        hidl_instance->SetStartRequestState(StartRequestState::CONFIRMED);
+        return;
+      case StartRequestState::PENDING_AFTER_RESUME:
+        LOG_INFO("Response after sending PENDING to audio HAL");
+        hidl_instance->ClearStartRequestState();
+        hidl::le_audio::LeAudioSourceTransport::interface->StreamStarted(
+            hidl::BluetoothAudioCtrlAck::SUCCESS_FINISHED);
+        return;
+      case StartRequestState::CONFIRMED:
+      case StartRequestState::CANCELED:
+        LOG_ERROR("Invalid state, start stream already confirmed");
+        return;
+    }
   }
-  aidl::le_audio::LeAudioSourceTransport::instance->ClearPendingStartStream();
-  aidl::le_audio::LeAudioSourceTransport::interface->StreamStarted(
-      aidl::BluetoothAudioCtrlAck::SUCCESS_FINISHED);
+
+  auto aidl_instance = aidl::le_audio::LeAudioSourceTransport::instance;
+  auto start_request_state = aidl_instance->GetStartRequestState();
+  switch (start_request_state) {
+    case StartRequestState::IDLE:
+      LOG_WARN(", no pending start stream request");
+      return;
+    case StartRequestState::PENDING_BEFORE_RESUME:
+      LOG_INFO("Response before sending PENDING to audio HAL");
+      aidl_instance->SetStartRequestState(StartRequestState::CONFIRMED);
+      return;
+    case StartRequestState::PENDING_AFTER_RESUME:
+      LOG_INFO("Response after sending PENDING to audio HAL");
+      aidl_instance->ClearStartRequestState();
+      aidl::le_audio::LeAudioSourceTransport::interface->StreamStarted(
+          aidl::BluetoothAudioCtrlAck::SUCCESS_FINISHED);
+      return;
+    case StartRequestState::CONFIRMED:
+    case StartRequestState::CANCELED:
+      LOG_ERROR("Invalid state, start stream already confirmed");
+      return;
+  }
 }
 
 void LeAudioClientInterface::Source::CancelStreamingRequest() {
-  LOG(INFO) << __func__;
   if (HalVersionManager::GetHalTransport() ==
       BluetoothAudioHalTransport::HIDL) {
-    if (!hidl::le_audio::LeAudioSourceTransport::instance
-             ->IsPendingStartStream()) {
-      LOG(WARNING) << ", no pending start stream request";
-      return;
+    auto hidl_instance = hidl::le_audio::LeAudioSourceTransport::instance;
+    auto start_request_state = hidl_instance->GetStartRequestState();
+    switch (start_request_state) {
+      case StartRequestState::IDLE:
+        LOG_WARN(", no pending start stream request");
+        return;
+      case StartRequestState::PENDING_BEFORE_RESUME:
+        LOG_INFO("Response before sending PENDING to audio HAL");
+        hidl_instance->SetStartRequestState(StartRequestState::CANCELED);
+        return;
+      case StartRequestState::PENDING_AFTER_RESUME:
+        LOG_INFO("Response after sending PENDING to audio HAL");
+        hidl_instance->ClearStartRequestState();
+        hidl::le_audio::LeAudioSourceTransport::interface->StreamStarted(
+            hidl::BluetoothAudioCtrlAck::FAILURE);
+        return;
+      case StartRequestState::CONFIRMED:
+      case StartRequestState::CANCELED:
+        LOG_ERROR("Invalid state, start stream already confirmed");
+        break;
     }
-    hidl::le_audio::LeAudioSourceTransport::instance->ClearPendingStartStream();
-    hidl::le_audio::LeAudioSourceTransport::interface->StreamStarted(
-        hidl::BluetoothAudioCtrlAck::FAILURE);
-    return;
   }
-  if (!aidl::le_audio::LeAudioSourceTransport::instance
-           ->IsPendingStartStream()) {
-    LOG(WARNING) << ", no pending start stream request";
-    return;
+
+  auto aidl_instance = aidl::le_audio::LeAudioSourceTransport::instance;
+  auto start_request_state = aidl_instance->GetStartRequestState();
+  switch (start_request_state) {
+    case StartRequestState::IDLE:
+      LOG_WARN(", no pending start stream request");
+      return;
+    case StartRequestState::PENDING_BEFORE_RESUME:
+      LOG_INFO("Response before sending PENDING to audio HAL");
+      aidl_instance->SetStartRequestState(StartRequestState::CANCELED);
+      return;
+    case StartRequestState::PENDING_AFTER_RESUME:
+      LOG_INFO("Response after sending PENDING to audio HAL");
+      aidl_instance->ClearStartRequestState();
+      aidl::le_audio::LeAudioSourceTransport::interface->StreamStarted(
+          aidl::BluetoothAudioCtrlAck::FAILURE);
+      return;
+    case StartRequestState::CONFIRMED:
+    case StartRequestState::CANCELED:
+      LOG_ERROR("Invalid state, start stream already confirmed");
+      break;
   }
-  aidl::le_audio::LeAudioSourceTransport::instance->ClearPendingStartStream();
-  aidl::le_audio::LeAudioSourceTransport::interface->StreamStarted(
-      aidl::BluetoothAudioCtrlAck::FAILURE);
 }
 
 void LeAudioClientInterface::Source::StopSession() {
   LOG(INFO) << __func__ << " source";
   if (HalVersionManager::GetHalTransport() ==
       BluetoothAudioHalTransport::HIDL) {
-    hidl::le_audio::LeAudioSourceTransport::instance->ClearPendingStartStream();
+    hidl::le_audio::LeAudioSourceTransport::instance->ClearStartRequestState();
     hidl::le_audio::LeAudioSourceTransport::interface->EndSession();
     return;
   }
-  aidl::le_audio::LeAudioSourceTransport::instance->ClearPendingStartStream();
+  aidl::le_audio::LeAudioSourceTransport::instance->ClearStartRequestState();
   aidl::le_audio::LeAudioSourceTransport::interface->EndSession();
 }
 
diff --git a/system/audio_hal_interface/le_audio_software.h b/system/audio_hal_interface/le_audio_software.h
index 078234f..ab4e476 100644
--- a/system/audio_hal_interface/le_audio_software.h
+++ b/system/audio_hal_interface/le_audio_software.h
@@ -28,6 +28,14 @@
 namespace audio {
 namespace le_audio {
 
+enum class StartRequestState {
+  IDLE = 0x00,
+  PENDING_BEFORE_RESUME,
+  PENDING_AFTER_RESUME,
+  CONFIRMED,
+  CANCELED,
+};
+
 constexpr uint8_t kChannelNumberMono = 1;
 constexpr uint8_t kChannelNumberStereo = 2;
 
@@ -75,6 +83,7 @@
     virtual void UpdateAudioConfigToHal(
         const ::le_audio::offload_config& config) = 0;
     virtual void SuspendedForReconfiguration() = 0;
+    virtual void ReconfigurationComplete() = 0;
   };
 
  public:
@@ -92,7 +101,10 @@
     void CancelStreamingRequest() override;
     void UpdateAudioConfigToHal(
         const ::le_audio::offload_config& config) override;
+    void UpdateBroadcastAudioConfigToHal(
+        const ::le_audio::broadcast_offload_config& config);
     void SuspendedForReconfiguration() override;
+    void ReconfigurationComplete() override;
     // Read the stream of bytes sinked to us by the upper layers
     size_t Read(uint8_t* p_buf, uint32_t len);
     bool IsBroadcaster() { return is_broadcaster_; }
@@ -114,6 +126,7 @@
     void UpdateAudioConfigToHal(
         const ::le_audio::offload_config& config) override;
     void SuspendedForReconfiguration() override;
+    void ReconfigurationComplete() override;
     // Source the given stream of bytes to be sinked into the upper layers
     size_t Write(const uint8_t* p_buf, uint32_t len);
   };
diff --git a/system/audio_hal_interface/le_audio_software_host.cc b/system/audio_hal_interface/le_audio_software_host.cc
index 407d78b..7d8dc77 100644
--- a/system/audio_hal_interface/le_audio_software_host.cc
+++ b/system/audio_hal_interface/le_audio_software_host.cc
@@ -17,6 +17,7 @@
 
 #include "audio_hal_interface/hal_version_manager.h"
 #include "audio_hal_interface/le_audio_software.h"
+#include "bta/le_audio/codec_manager.h"
 
 namespace bluetooth {
 namespace audio {
@@ -44,6 +45,11 @@
   return nullptr;
 }
 
+void LeAudioClientInterface::Sink::UpdateBroadcastAudioConfigToHal(
+    ::le_audio::broadcast_offload_config const& config) {
+  return;
+}
+
 size_t LeAudioClientInterface::Sink::Read(uint8_t* p_buf, uint32_t len) {
   return 0;
 }
diff --git a/system/binder/android/bluetooth/BluetoothSinkAudioPolicy.aidl b/system/binder/android/bluetooth/BluetoothSinkAudioPolicy.aidl
new file mode 100644
index 0000000..740249c
--- /dev/null
+++ b/system/binder/android/bluetooth/BluetoothSinkAudioPolicy.aidl
@@ -0,0 +1,19 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.bluetooth;
+
+parcelable BluetoothSinkAudioPolicy;
diff --git a/system/binder/android/bluetooth/IBluetooth.aidl b/system/binder/android/bluetooth/IBluetooth.aidl
index 68237c6..360220c 100644
--- a/system/binder/android/bluetooth/IBluetooth.aidl
+++ b/system/binder/android/bluetooth/IBluetooth.aidl
@@ -25,6 +25,7 @@
 import android.bluetooth.IBluetoothSocketManager;
 import android.bluetooth.IBluetoothStateChangeCallback;
 import android.bluetooth.BluetoothActivityEnergyInfo;
+import android.bluetooth.BluetoothSinkAudioPolicy;
 import android.bluetooth.BluetoothClass;
 import android.bluetooth.BluetoothDevice;
 import android.bluetooth.IncomingRfcommSocketInfo;
@@ -267,6 +268,13 @@
     oneway void allowLowLatencyAudio(in boolean allowed, in BluetoothDevice device, in SynchronousResultReceiver receiver);
 
     @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    void isRequestAudioPolicyAsSinkSupported(in BluetoothDevice device, in AttributionSource attributionSource, in SynchronousResultReceiver receiver);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    void requestAudioPolicyAsSink(in BluetoothDevice device, in BluetoothSinkAudioPolicy policies, in AttributionSource attributionSource, in SynchronousResultReceiver receiver);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    void getRequestedAudioPolicyAsSink(in BluetoothDevice device, in AttributionSource attributionSource, in SynchronousResultReceiver receiver);
+
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
     oneway void startRfcommListener(String name, in ParcelUuid uuid, in PendingIntent intent, in AttributionSource attributionSource, in SynchronousResultReceiver receiver);
     @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
     oneway void stopRfcommListener(in ParcelUuid uuid, in AttributionSource attributionSource, in SynchronousResultReceiver receiver);
diff --git a/system/binder/android/bluetooth/IBluetoothHeadsetClient.aidl b/system/binder/android/bluetooth/IBluetoothHeadsetClient.aidl
index 3e1e83b..ad3316c 100644
--- a/system/binder/android/bluetooth/IBluetoothHeadsetClient.aidl
+++ b/system/binder/android/bluetooth/IBluetoothHeadsetClient.aidl
@@ -17,6 +17,7 @@
 package android.bluetooth;
 
 import android.bluetooth.BluetoothDevice;
+import android.bluetooth.BluetoothSinkAudioPolicy;
 import android.bluetooth.BluetoothHeadsetClientCall;
 import android.content.AttributionSource;
 
@@ -86,6 +87,7 @@
     void setAudioRouteAllowed(in BluetoothDevice device, boolean allowed, in AttributionSource attributionSource, in SynchronousResultReceiver receiver);
     @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
     void getAudioRouteAllowed(in BluetoothDevice device, in AttributionSource attributionSource, in SynchronousResultReceiver receiver);
+
     @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
     void sendVendorAtCommand(in BluetoothDevice device, int vendorId, String atCommand, in AttributionSource attributionSource, in SynchronousResultReceiver receiver);
 
diff --git a/system/binder/android/bluetooth/IBluetoothLeAudio.aidl b/system/binder/android/bluetooth/IBluetoothLeAudio.aidl
index 4e6e345..6fc9c8b 100644
--- a/system/binder/android/bluetooth/IBluetoothLeAudio.aidl
+++ b/system/binder/android/bluetooth/IBluetoothLeAudio.aidl
@@ -65,12 +65,17 @@
     void unregisterCallback(in IBluetoothLeAudioCallback callback, in AttributionSource attributionSource, in SynchronousResultReceiver receiver);
     @JavaPassthrough(annotation="@android.annotation.RequiresPermission(allOf={android.Manifest.permission.BLUETOOTH_CONNECT,android.Manifest.permission.BLUETOOTH_PRIVILEGED})")
     void setCcidInformation(in ParcelUuid userUuid, in int ccid, in int contextType, in AttributionSource attributionSource, in SynchronousResultReceiver receiver);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(allOf={android.Manifest.permission.BLUETOOTH_CONNECT,android.Manifest.permission.BLUETOOTH_PRIVILEGED})")
+    void setInCall(in boolean inCall, in AttributionSource attributionSource, in SynchronousResultReceiver receiver);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(allOf={android.Manifest.permission.BLUETOOTH_CONNECT,android.Manifest.permission.BLUETOOTH_PRIVILEGED})")
+    void setInactiveForHfpHandover(in BluetoothDevice device, in AttributionSource attributionSource, in SynchronousResultReceiver receiver);
 
     /* Same value as bluetooth::groups::kGroupUnknown */
     const int LE_AUDIO_GROUP_ID_INVALID = -1;
 
     const int GROUP_STATUS_INACTIVE = 0;
     const int GROUP_STATUS_ACTIVE = 1;
+    const int GROUP_STATUS_TURNED_IDLE_DURING_CALL = 2;
 
     const int GROUP_NODE_ADDED = 1;
     const int GROUP_NODE_REMOVED = 2;
diff --git a/system/binder/android/bluetooth/IBluetoothManager.aidl b/system/binder/android/bluetooth/IBluetoothManager.aidl
index c0cc204..50c87bd 100644
--- a/system/binder/android/bluetooth/IBluetoothManager.aidl
+++ b/system/binder/android/bluetooth/IBluetoothManager.aidl
@@ -51,7 +51,7 @@
     IBluetoothGatt getBluetoothGatt();
 
     @JavaPassthrough(annotation="@android.annotation.RequiresNoPermission")
-    boolean bindBluetoothProfileService(int profile, IBluetoothProfileServiceConnection proxy);
+    boolean bindBluetoothProfileService(int profile, String serviceName, IBluetoothProfileServiceConnection proxy);
     @JavaPassthrough(annotation="@android.annotation.RequiresNoPermission")
     void unbindBluetoothProfileService(int profile, IBluetoothProfileServiceConnection proxy);
 
diff --git a/system/binder/android/bluetooth/IBluetoothVolumeControl.aidl b/system/binder/android/bluetooth/IBluetoothVolumeControl.aidl
index d5f157c..ca0b0e7 100644
--- a/system/binder/android/bluetooth/IBluetoothVolumeControl.aidl
+++ b/system/binder/android/bluetooth/IBluetoothVolumeControl.aidl
@@ -29,6 +29,9 @@
  * @hide
  */
 oneway interface IBluetoothVolumeControl {
+
+    const int VOLUME_CONTROL_UNKNOWN_VOLUME = -1;
+
     /* Public API */
     @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
     void connect(in BluetoothDevice device, in AttributionSource attributionSource, in SynchronousResultReceiver receiver);
diff --git a/system/blueberry/tests/gd/cert/py_hal.py b/system/blueberry/tests/gd/cert/py_hal.py
index 45bb6bd..5f0e933 100644
--- a/system/blueberry/tests/gd/cert/py_hal.py
+++ b/system/blueberry/tests/gd/cert/py_hal.py
@@ -30,11 +30,11 @@
 from bluetooth_packets_python3.hci_packets import PacketBoundaryFlag
 from bluetooth_packets_python3 import hci_packets
 from blueberry.tests.gd.cert.matchers import HciMatchers
-from bluetooth_packets_python3.hci_packets import LeSetExtendedAdvertisingLegacyParametersBuilder
-from bluetooth_packets_python3.hci_packets import LegacyAdvertisingProperties
+from bluetooth_packets_python3.hci_packets import LeSetExtendedAdvertisingParametersLegacyBuilder
+from bluetooth_packets_python3.hci_packets import LegacyAdvertisingEventProperties
 from bluetooth_packets_python3.hci_packets import PeerAddressType
 from bluetooth_packets_python3.hci_packets import AdvertisingFilterPolicy
-from bluetooth_packets_python3.hci_packets import LeSetExtendedAdvertisingRandomAddressBuilder
+from bluetooth_packets_python3.hci_packets import LeSetAdvertisingSetRandomAddressBuilder
 from bluetooth_packets_python3.hci_packets import GapData
 from bluetooth_packets_python3.hci_packets import GapDataType
 from bluetooth_packets_python3.hci_packets import LeSetExtendedAdvertisingDataBuilder
@@ -42,7 +42,7 @@
 from bluetooth_packets_python3.hci_packets import OwnAddressType
 from bluetooth_packets_python3.hci_packets import Enable
 from bluetooth_packets_python3.hci_packets import FragmentPreference
-from bluetooth_packets_python3.hci_packets import LeSetExtendedAdvertisingScanResponseBuilder
+from bluetooth_packets_python3.hci_packets import LeSetExtendedScanResponseDataBuilder
 from bluetooth_packets_python3.hci_packets import LeSetExtendedAdvertisingEnableBuilder
 from bluetooth_packets_python3.hci_packets import EnabledSet
 from bluetooth_packets_python3.hci_packets import OpCode
@@ -87,9 +87,9 @@
         data.data_type = GapDataType.SHORTENED_LOCAL_NAME
         data.data = list(bytes(shortened_name))
         self.py_hal.send_hci_command(
-            LeSetExtendedAdvertisingScanResponseBuilder(self.handle, Operation.COMPLETE_ADVERTISEMENT,
-                                                        FragmentPreference.CONTROLLER_SHOULD_NOT, [data]))
-        self.py_hal.wait_for_complete(OpCode.LE_SET_EXTENDED_ADVERTISING_SCAN_RESPONSE)
+            LeSetExtendedScanResponseDataBuilder(self.handle, Operation.COMPLETE_ADVERTISEMENT,
+                                                 FragmentPreference.CONTROLLER_SHOULD_NOT, [data]))
+        self.py_hal.wait_for_complete(OpCode.LE_SET_EXTENDED_SCAN_RESPONSE_DATA)
 
     def start(self):
         enabled_set = EnabledSet()
@@ -117,6 +117,7 @@
         self.acl_stream = EventStream(self.device.hal.StreamAcl(empty_proto.Empty()))
 
         self.event_mask = 0x1FFF_FFFF_FFFF  # Default Event Mask (Core Vol 4 [E] 7.3.1)
+        self.le_event_mask = 0x0000_0000_001F  # Default LE Event Mask (Core Vol 4 [E] 7.8.1)
 
         # We don't deal with SCO for now
 
@@ -173,6 +174,11 @@
             self.event_mask |= 1 << (int(event_code) - 1)
         self.send_hci_command(hci_packets.SetEventMaskBuilder(self.event_mask))
 
+    def unmask_le_event(self, *subevent_codes):
+        for subevent_code in subevent_codes:
+            self.le_event_mask |= 1 << (int(subevent_code) - 1)
+        self.send_hci_command(hci_packets.LeSetEventMaskBuilder(self.le_event_mask))
+
     def start_scanning(self):
         self.send_hci_command(
             hci_packets.LeSetExtendedScanEnableBuilder(hci_packets.Enable.ENABLED,
@@ -265,7 +271,7 @@
     def create_advertisement(self,
                              handle,
                              own_address,
-                             properties=LegacyAdvertisingProperties.ADV_IND,
+                             properties=LegacyAdvertisingEventProperties.ADV_IND,
                              min_interval=400,
                              max_interval=450,
                              channel_map=7,
@@ -278,12 +284,12 @@
                              scan_request_notification=Enable.DISABLED):
 
         self.send_hci_command(
-            LeSetExtendedAdvertisingLegacyParametersBuilder(handle, properties, min_interval, max_interval, channel_map,
+            LeSetExtendedAdvertisingParametersLegacyBuilder(handle, properties, min_interval, max_interval, channel_map,
                                                             own_address_type, peer_address_type, peer_address,
                                                             filter_policy, tx_power, sid, scan_request_notification))
         self.wait_for_complete(OpCode.LE_SET_EXTENDED_ADVERTISING_PARAMETERS)
 
-        self.send_hci_command(LeSetExtendedAdvertisingRandomAddressBuilder(handle, own_address))
-        self.wait_for_complete(OpCode.LE_SET_EXTENDED_ADVERTISING_RANDOM_ADDRESS)
+        self.send_hci_command(LeSetAdvertisingSetRandomAddressBuilder(handle, own_address))
+        self.wait_for_complete(OpCode.LE_SET_ADVERTISING_SET_RANDOM_ADDRESS)
 
         return PyHalAdvertisement(handle, self)
diff --git a/system/blueberry/tests/gd/cert/py_hci.py b/system/blueberry/tests/gd/cert/py_hci.py
index f87ecff..a8ba02a 100644
--- a/system/blueberry/tests/gd/cert/py_hci.py
+++ b/system/blueberry/tests/gd/cert/py_hci.py
@@ -27,11 +27,11 @@
 from blueberry.facade.hci import hci_facade_pb2 as hci_facade
 from blueberry.facade import common_pb2 as common
 from blueberry.tests.gd.cert.matchers import HciMatchers
-from bluetooth_packets_python3.hci_packets import LeSetExtendedAdvertisingLegacyParametersBuilder
-from bluetooth_packets_python3.hci_packets import LegacyAdvertisingProperties
+from bluetooth_packets_python3.hci_packets import LeSetExtendedAdvertisingParametersLegacyBuilder
+from bluetooth_packets_python3.hci_packets import LegacyAdvertisingEventProperties
 from bluetooth_packets_python3.hci_packets import PeerAddressType
 from bluetooth_packets_python3.hci_packets import AdvertisingFilterPolicy
-from bluetooth_packets_python3.hci_packets import LeSetExtendedAdvertisingRandomAddressBuilder
+from bluetooth_packets_python3.hci_packets import LeSetAdvertisingSetRandomAddressBuilder
 from bluetooth_packets_python3.hci_packets import GapData
 from bluetooth_packets_python3.hci_packets import GapDataType
 from bluetooth_packets_python3.hci_packets import LeSetExtendedAdvertisingDataBuilder
@@ -39,7 +39,7 @@
 from bluetooth_packets_python3.hci_packets import OwnAddressType
 from bluetooth_packets_python3.hci_packets import Enable
 from bluetooth_packets_python3.hci_packets import FragmentPreference
-from bluetooth_packets_python3.hci_packets import LeSetExtendedAdvertisingScanResponseBuilder
+from bluetooth_packets_python3.hci_packets import LeSetExtendedScanResponseDataBuilder
 from bluetooth_packets_python3.hci_packets import LeSetExtendedAdvertisingEnableBuilder
 from bluetooth_packets_python3.hci_packets import EnabledSet
 from bluetooth_packets_python3.hci_packets import OpCode
@@ -127,8 +127,8 @@
         data.data_type = GapDataType.SHORTENED_LOCAL_NAME
         data.data = list(shortened_name)
         self.py_hci.send_command(
-            LeSetExtendedAdvertisingScanResponseBuilder(self.handle, Operation.COMPLETE_ADVERTISEMENT,
-                                                        FragmentPreference.CONTROLLER_SHOULD_NOT, [data]))
+            LeSetExtendedScanResponseDataBuilder(self.handle, Operation.COMPLETE_ADVERTISEMENT,
+                                                 FragmentPreference.CONTROLLER_SHOULD_NOT, [data]))
 
     def start(self):
         enabled_set = EnabledSet()
@@ -271,7 +271,7 @@
     def create_advertisement(self,
                              handle,
                              own_address,
-                             properties=LegacyAdvertisingProperties.ADV_IND,
+                             properties=LegacyAdvertisingEventProperties.ADV_IND,
                              min_interval=400,
                              max_interval=450,
                              channel_map=7,
@@ -284,9 +284,9 @@
                              scan_request_notification=Enable.DISABLED):
 
         self.send_command(
-            LeSetExtendedAdvertisingLegacyParametersBuilder(handle, properties, min_interval, max_interval, channel_map,
+            LeSetExtendedAdvertisingParametersLegacyBuilder(handle, properties, min_interval, max_interval, channel_map,
                                                             own_address_type, peer_address_type, peer_address,
                                                             filter_policy, tx_power, sid, scan_request_notification))
 
-        self.send_command(LeSetExtendedAdvertisingRandomAddressBuilder(handle, own_address))
+        self.send_command(LeSetAdvertisingSetRandomAddressBuilder(handle, own_address))
         return PyHciAdvertisement(handle, self)
diff --git a/system/blueberry/tests/gd/hal/simple_hal_test.py b/system/blueberry/tests/gd/hal/simple_hal_test.py
index 3a589d6..2247b43 100644
--- a/system/blueberry/tests/gd/hal/simple_hal_test.py
+++ b/system/blueberry/tests/gd/hal/simple_hal_test.py
@@ -72,6 +72,7 @@
 
     def test_le_ad_scan_cert_advertises(self):
         self.dut_hal.unmask_event(hci_packets.EventCode.LE_META_EVENT)
+        self.dut_hal.unmask_le_event(hci_packets.SubeventCode.EXTENDED_ADVERTISING_REPORT)
         self.dut_hal.set_random_le_address('0D:05:04:03:02:01')
 
         self.dut_hal.set_scan_parameters()
diff --git a/system/blueberry/tests/gd/hci/direct_hci_test.py b/system/blueberry/tests/gd/hci/direct_hci_test.py
index c0dbdc4..1f2c4d0 100644
--- a/system/blueberry/tests/gd/hci/direct_hci_test.py
+++ b/system/blueberry/tests/gd/hci/direct_hci_test.py
@@ -39,17 +39,17 @@
 from bluetooth_packets_python3.hci_packets import LeScanningFilterPolicy
 from bluetooth_packets_python3.hci_packets import Enable
 from bluetooth_packets_python3.hci_packets import FilterDuplicates
-from bluetooth_packets_python3.hci_packets import LeSetExtendedAdvertisingLegacyParametersBuilder
-from bluetooth_packets_python3.hci_packets import LegacyAdvertisingProperties
+from bluetooth_packets_python3.hci_packets import LeSetExtendedAdvertisingParametersLegacyBuilder
+from bluetooth_packets_python3.hci_packets import LegacyAdvertisingEventProperties
 from bluetooth_packets_python3.hci_packets import PeerAddressType
 from bluetooth_packets_python3.hci_packets import AdvertisingFilterPolicy
-from bluetooth_packets_python3.hci_packets import LeSetExtendedAdvertisingRandomAddressBuilder
+from bluetooth_packets_python3.hci_packets import LeSetAdvertisingSetRandomAddressBuilder
 from bluetooth_packets_python3.hci_packets import GapData
 from bluetooth_packets_python3.hci_packets import GapDataType
 from bluetooth_packets_python3.hci_packets import LeSetExtendedAdvertisingDataBuilder
 from bluetooth_packets_python3.hci_packets import Operation
 from bluetooth_packets_python3.hci_packets import FragmentPreference
-from bluetooth_packets_python3.hci_packets import LeSetExtendedAdvertisingScanResponseBuilder
+from bluetooth_packets_python3.hci_packets import LeSetExtendedScanResponseDataBuilder
 from bluetooth_packets_python3.hci_packets import LeSetExtendedAdvertisingEnableBuilder
 from bluetooth_packets_python3.hci_packets import LeSetExtendedScanEnableBuilder
 from bluetooth_packets_python3.hci_packets import EnabledSet
@@ -135,9 +135,9 @@
         # CERT Advertises
         advertising_handle = 0
         self.cert_hal.send_hci_command(
-            LeSetExtendedAdvertisingLegacyParametersBuilder(
+            LeSetExtendedAdvertisingParametersLegacyBuilder(
                 advertising_handle,
-                LegacyAdvertisingProperties.ADV_IND,
+                LegacyAdvertisingEventProperties.ADV_IND,
                 512,
                 768,
                 7,
@@ -150,8 +150,7 @@
                 Enable.DISABLED  # Scan request notification
             ))
 
-        self.cert_hal.send_hci_command(
-            LeSetExtendedAdvertisingRandomAddressBuilder(advertising_handle, '0C:05:04:03:02:01'))
+        self.cert_hal.send_hci_command(LeSetAdvertisingSetRandomAddressBuilder(advertising_handle, '0C:05:04:03:02:01'))
         gap_name = GapData()
         gap_name.data_type = GapDataType.COMPLETE_LOCAL_NAME
         gap_name.data = list(bytes(b'Im_A_Cert'))
@@ -165,8 +164,8 @@
         gap_short_name.data = list(bytes(b'Im_A_C'))
 
         self.cert_hal.send_hci_command(
-            LeSetExtendedAdvertisingScanResponseBuilder(advertising_handle, Operation.COMPLETE_ADVERTISEMENT,
-                                                        FragmentPreference.CONTROLLER_SHOULD_NOT, [gap_short_name]))
+            LeSetExtendedScanResponseDataBuilder(advertising_handle, Operation.COMPLETE_ADVERTISEMENT,
+                                                 FragmentPreference.CONTROLLER_SHOULD_NOT, [gap_short_name]))
 
         enabled_set = EnabledSet()
         enabled_set.advertising_handle = 0
diff --git a/system/blueberry/tests/gd/hci/le_acl_manager_test.py b/system/blueberry/tests/gd/hci/le_acl_manager_test.py
index 04fc50f..de10d48 100644
--- a/system/blueberry/tests/gd/hci/le_acl_manager_test.py
+++ b/system/blueberry/tests/gd/hci/le_acl_manager_test.py
@@ -81,7 +81,7 @@
         self.cert_hci.create_advertisement(
             advertising_handle,
             self.cert_random_address,
-            hci_packets.LegacyAdvertisingProperties.ADV_IND,
+            hci_packets.LegacyAdvertisingEventProperties.ADV_IND,
         )
 
         py_hci_adv.set_data(b'Im_A_Cert')
@@ -109,7 +109,7 @@
         self.cert_hci.create_advertisement(
             advertising_handle,
             self.cert_random_address,
-            hci_packets.LegacyAdvertisingProperties.ADV_IND,
+            hci_packets.LegacyAdvertisingEventProperties.ADV_IND,
             own_address_type=hci_packets.OwnAddressType.RESOLVABLE_OR_PUBLIC_ADDRESS,
             peer_address=self.dut_public_address,
             peer_address_type=hci_packets.PeerAddressType.PUBLIC_DEVICE_OR_IDENTITY_ADDRESS)
@@ -331,7 +331,7 @@
         advertising_handle = 0
 
         py_hci_adv = self.cert_hci.create_advertisement(advertising_handle, self.cert_random_address,
-                                                        hci_packets.LegacyAdvertisingProperties.ADV_IND, 155, 165)
+                                                        hci_packets.LegacyAdvertisingEventProperties.ADV_IND, 155, 165)
 
         py_hci_adv.set_data(b'Im_A_Cert')
         py_hci_adv.set_scan_response(b'Im_A_C')
@@ -360,7 +360,7 @@
         advertising_handle = 0
 
         py_hci_adv = self.cert_hci.create_advertisement(advertising_handle, self.cert_random_address,
-                                                        hci_packets.LegacyAdvertisingProperties.ADV_IND, 155, 165)
+                                                        hci_packets.LegacyAdvertisingEventProperties.ADV_IND, 155, 165)
 
         py_hci_adv.set_data(b'Im_A_Cert')
         py_hci_adv.set_scan_response(b'Im_A_C')
@@ -374,7 +374,7 @@
         advertising_handle = 0
 
         py_hci_adv = self.cert_hci.create_advertisement(advertising_handle, '0C:05:04:03:02:02',
-                                                        hci_packets.LegacyAdvertisingProperties.ADV_IND, 155, 165)
+                                                        hci_packets.LegacyAdvertisingEventProperties.ADV_IND, 155, 165)
 
         py_hci_adv.set_data(b'Im_A_Cert')
         py_hci_adv.set_scan_response(b'Im_A_C')
@@ -389,7 +389,7 @@
 
         advertising_handle = 0
         py_hci_adv = self.cert_hci.create_advertisement(advertising_handle, self.cert_random_address,
-                                                        hci_packets.LegacyAdvertisingProperties.ADV_IND, 155, 165)
+                                                        hci_packets.LegacyAdvertisingEventProperties.ADV_IND, 155, 165)
 
         py_hci_adv.set_data(b'Im_A_Cert')
         py_hci_adv.set_scan_response(b'Im_A_C')
@@ -417,7 +417,7 @@
         advertising_handle = 0
 
         py_hci_adv = self.cert_hci.create_advertisement(advertising_handle, self.cert_random_address,
-                                                        hci_packets.LegacyAdvertisingProperties.ADV_IND, 155, 165)
+                                                        hci_packets.LegacyAdvertisingEventProperties.ADV_IND, 155, 165)
 
         py_hci_adv.set_data(b'Im_A_Cert')
         py_hci_adv.set_scan_response(b'Im_A_C')
diff --git a/system/blueberry/tests/sl4a_sl4a/advertising/le_advertising.py b/system/blueberry/tests/sl4a_sl4a/advertising/le_advertising.py
index 4e0f2bc..bd0283c 100644
--- a/system/blueberry/tests/sl4a_sl4a/advertising/le_advertising.py
+++ b/system/blueberry/tests/sl4a_sl4a/advertising/le_advertising.py
@@ -38,7 +38,7 @@
         super().teardown_test()
 
     def test_advertise_name(self):
-        rpa_address = self.cert_advertiser_.advertise_rpa_public_extended_pdu()
+        rpa_address = self.cert_advertiser_.advertise_public_extended_pdu()
         self.dut_scanner_.scan_for_name(self.cert_advertiser_.get_local_advertising_name())
         self.dut_scanner_.stop_scanning()
         self.cert_advertiser_.stop_advertising()
@@ -48,10 +48,10 @@
             self.test_advertise_name()
 
     def test_advertise_name_twice_no_stop(self):
-        rpa_address = self.cert_advertiser_.advertise_rpa_public_extended_pdu()
+        rpa_address = self.cert_advertiser_.advertise_public_extended_pdu()
         self.dut_scanner_.scan_for_name(self.cert_advertiser_.get_local_advertising_name())
         self.dut_scanner_.stop_scanning()
-        rpa_address = self.cert_advertiser_.advertise_rpa_public_extended_pdu()
+        rpa_address = self.cert_advertiser_.advertise_public_extended_pdu()
         self.dut_scanner_.scan_for_name(self.cert_advertiser_.get_local_advertising_name())
         self.dut_scanner_.stop_scanning()
         self.cert_advertiser_.stop_advertising()
diff --git a/system/blueberry/tests/sl4a_sl4a/l2cap/le_l2cap_coc_test.py b/system/blueberry/tests/sl4a_sl4a/l2cap/le_l2cap_coc_test.py
new file mode 100644
index 0000000..ee94901
--- /dev/null
+++ b/system/blueberry/tests/sl4a_sl4a/l2cap/le_l2cap_coc_test.py
@@ -0,0 +1,169 @@
+#!/usr/bin/env python3
+#
+#   Copyright 2022 - The Android Open Source Project
+#
+#   Licensed under the Apache License, Version 2.0 (the "License");
+#   you may not use this file except in compliance with the License.
+#   You may obtain a copy of the License at
+#
+#       http://www.apache.org/licenses/LICENSE-2.0
+#
+#   Unless required by applicable law or agreed to in writing, software
+#   distributed under the License is distributed on an "AS IS" BASIS,
+#   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#   See the License for the specific language governing permissions and
+#   limitations under the License.
+
+import binascii
+import io
+import logging
+import os
+import queue
+import time
+
+from blueberry.tests.gd.cert.context import get_current_context
+from blueberry.tests.gd.cert.truth import assertThat
+from blueberry.tests.gd_sl4a.lib.bt_constants import ble_address_types
+from blueberry.tests.sl4a_sl4a.lib import sl4a_sl4a_base_test
+from blueberry.tests.sl4a_sl4a.lib.security import Security
+
+
+class LeL2capCoCTest(sl4a_sl4a_base_test.Sl4aSl4aBaseTestClass):
+
+    def __get_cert_public_address_and_irk_from_bt_config(self):
+        # Pull IRK from SL4A cert side to pass in from SL4A DUT side when scanning
+        bt_config_file_path = os.path.join(get_current_context().get_full_output_path(),
+                                           "DUT_%s_bt_config.conf" % self.cert.serial)
+        try:
+            self.cert.adb.pull(["/data/misc/bluedroid/bt_config.conf", bt_config_file_path])
+        except AdbError as error:
+            logging.error("Failed to pull SL4A cert BT config")
+            return False
+        logging.debug("Reading SL4A cert BT config")
+        with io.open(bt_config_file_path) as f:
+            for line in f.readlines():
+                stripped_line = line.strip()
+                if (stripped_line.startswith("Address")):
+                    address_fields = stripped_line.split(' ')
+                    # API currently requires public address to be capitalized
+                    address = address_fields[2].upper()
+                    logging.debug("Found cert address: %s" % address)
+                    continue
+                if (stripped_line.startswith("LE_LOCAL_KEY_IRK")):
+                    irk_fields = stripped_line.split(' ')
+                    irk = irk_fields[2]
+                    logging.debug("Found cert IRK: %s" % irk)
+                    continue
+
+        return address, irk
+
+    def setup_class(self):
+        super().setup_class()
+
+    def setup_test(self):
+        assertThat(super().setup_test()).isTrue()
+
+    def teardown_test(self):
+        self.dut_scanner_.stop_scanning()
+        self.cert_advertiser_.stop_advertising()
+        self.dut_security_.remove_all_bonded_devices()
+        self.cert_security_.remove_all_bonded_devices()
+        super().teardown_test()
+
+    # Scans for the cert device by name. We expect to get back a RPA.
+    def __scan_for_cert_by_name(self):
+        cert_public_address, irk = self.__get_cert_public_address_and_irk_from_bt_config()
+        self.cert_advertiser_.advertise_public_extended_pdu()
+        advertising_name = self.cert_advertiser_.get_local_advertising_name()
+
+        # Scan with name and verify we get back a scan result with the RPA
+        scan_result_addr = self.dut_scanner_.scan_for_name(advertising_name)
+        assertThat(scan_result_addr).isNotNone()
+        assertThat(scan_result_addr).isNotEqualTo(cert_public_address)
+
+        return scan_result_addr
+
+    def __scan_for_irk(self):
+        cert_public_address, irk = self.__get_cert_public_address_and_irk_from_bt_config()
+        rpa_address = self.cert_advertiser_.advertise_public_extended_pdu()
+        id_addr = self.dut_scanner_.scan_for_address_with_irk(cert_public_address, ble_address_types["public"], irk)
+        self.dut_scanner_.stop_scanning()
+        return id_addr
+
+    def __create_le_bond_oob_single_sided(self,
+                                          wait_for_oob_data=True,
+                                          wait_for_device_bonded=True,
+                                          addr=None,
+                                          addr_type=ble_address_types["random"]):
+        oob_data = self.cert_security_.generate_oob_data(Security.TRANSPORT_LE, wait_for_oob_data)
+        if wait_for_oob_data:
+            assertThat(oob_data[0]).isEqualTo(0)
+            assertThat(oob_data[1]).isNotNone()
+        self.dut_security_.create_bond_out_of_band(oob_data[1], addr, addr_type, wait_for_device_bonded)
+        return oob_data[1].to_sl4a_address()
+
+    def __create_le_bond_oob_double_sided(self,
+                                          wait_for_oob_data=True,
+                                          wait_for_device_bonded=True,
+                                          addr=None,
+                                          addr_type=ble_address_types["random"]):
+        # Genearte OOB data on DUT, but we don't use it
+        self.dut_security_.generate_oob_data(Security.TRANSPORT_LE, wait_for_oob_data)
+        self.__create_le_bond_oob_single_sided(wait_for_oob_data, wait_for_device_bonded, addr, addr_type)
+
+    def __test_le_l2cap_insecure_coc(self):
+        logging.info("Testing insecure L2CAP CoC")
+        cert_rpa = self.__scan_for_cert_by_name()
+
+        # Listen on an insecure l2cap coc on the cert
+        psm = self.cert_l2cap_.listen_using_l2cap_le_coc(False)
+        self.dut_l2cap_.create_l2cap_le_coc(cert_rpa, psm, False)
+
+        # Cleanup
+        self.dut_scanner_.stop_scanning()
+        self.dut_l2cap_.close_l2cap_le_coc_client()
+        self.cert_advertiser_.stop_advertising()
+        self.cert_l2cap_.close_l2cap_le_coc_server()
+
+    def __test_le_l2cap_secure_coc(self):
+        logging.info("Testing secure L2CAP CoC")
+        cert_rpa = self.__create_le_bond_oob_single_sided()
+
+        # Listen on an secure l2cap coc on the cert
+        psm = self.cert_l2cap_.listen_using_l2cap_le_coc(True)
+        self.dut_l2cap_.create_l2cap_le_coc(cert_rpa, psm, True)
+
+        # Cleanup
+        self.dut_scanner_.stop_scanning()
+        self.dut_l2cap_.close_l2cap_le_coc_client()
+        self.cert_advertiser_.stop_advertising()
+        self.cert_l2cap_.close_l2cap_le_coc_server()
+        self.dut_security_.remove_all_bonded_devices()
+        self.cert_security_.remove_all_bonded_devices()
+
+    def __test_le_l2cap_secure_coc_after_irk_scan(self):
+        logging.info("Testing secure L2CAP CoC after IRK scan")
+        cert_config_addr, irk = self.__get_cert_public_address_and_irk_from_bt_config()
+        cert_id_addr = self.__scan_for_irk()
+
+        assertThat(cert_id_addr).isEqualTo(cert_config_addr)
+        self.__create_le_bond_oob_single_sided(True, True, cert_id_addr, ble_address_types["public"])
+        self.cert_advertiser_.stop_advertising()
+        self.__test_le_l2cap_secure_coc()
+
+    def __test_secure_le_l2cap_coc_stress(self):
+        for i in range(0, 10):
+            self.__test_le_l2cap_secure_coc()
+
+    def __test_insecure_le_l2cap_coc_stress(self):
+        for i in range(0, 10):
+            self.__test_le_l2cap_insecure_coc()
+
+    def __test_le_l2cap_coc_stress(self):
+        #for i in range (0, 10):
+        self.__test_le_l2cap_insecure_coc()
+        self.__test_le_l2cap_secure_coc()
+
+    def __test_secure_le_l2cap_coc_after_irk_scan_stress(self):
+        for i in range(0, 10):
+            self.__test_le_l2cap_secure_coc_after_irk_scan()
diff --git a/system/blueberry/tests/sl4a_sl4a/lib/l2cap.py b/system/blueberry/tests/sl4a_sl4a/lib/l2cap.py
new file mode 100644
index 0000000..9604ab7
--- /dev/null
+++ b/system/blueberry/tests/sl4a_sl4a/lib/l2cap.py
@@ -0,0 +1,70 @@
+#!/usr/bin/env python3
+#
+#   Copyright 2022 - The Android Open Source Project
+#
+#   Licensed under the Apache License, Version 2.0 (the "License");
+#   you may not use this file except in compliance with the License.
+#   You may obtain a copy of the License at
+#
+#       http://www.apache.org/licenses/LICENSE-2.0
+#
+#   Unless required by applicable law or agreed to in writing, software
+#   distributed under the License is distributed on an "AS IS" BASIS,
+#   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#   See the License for the specific language governing permissions and
+#   limitations under the License.
+
+import logging
+import queue
+
+from blueberry.tests.gd.cert.truth import assertThat
+
+
+class L2cap:
+
+    __l2cap_connection_timeout = 10  #seconds
+    __device = None
+    __active_client_coc = False
+    __active_server_coc = False
+
+    def __init__(self, device):
+        self.__device = device
+
+    def __wait_for_event(self, expected_event_name):
+        try:
+            event_info = self.__device.ed.pop_event(expected_event_name, self.__l2cap_connection_timeout)
+            logging.info(event_info)
+        except queue.Empty as error:
+            logging.error("Failed to find event: %s", expected_event_name)
+            return False
+        return True
+
+    def create_l2cap_le_coc(self, address, psm, secure):
+        logging.info("creating l2cap channel with secure=%r and psm %s", secure, psm)
+        self.__device.sl4a.bluetoothSocketConnBeginConnectThreadPsm(address, True, psm, secure)
+        assertThat(self.__wait_for_event("BluetoothSocketConnectSuccess")).isTrue()
+        self.__active_client_coc = True
+
+    # Starts listening on the l2cap server socket, returns the psm
+    def listen_using_l2cap_le_coc(self, secure):
+        logging.info("Listening for l2cap channel with secure=%r", secure)
+        self.__device.sl4a.bluetoothSocketConnBeginAcceptThreadPsm(self.__l2cap_connection_timeout, True, secure)
+        self.__active_server_coc = True
+        return self.__device.sl4a.bluetoothSocketConnGetPsm()
+
+    def close_l2cap_le_coc_client(self):
+        if self.__active_client_coc:
+            logging.info("Closing LE L2CAP CoC Client")
+            self.__device.sl4a.bluetoothSocketConnKillConnThread()
+            self.__active_client_coc = False
+
+    def close_l2cap_le_coc_server(self):
+        if self.__active_server_coc:
+            logging.info("Closing LE L2CAP CoC Server")
+            self.__device.sl4a.bluetoothSocketConnEndAcceptThread()
+            self.__active_server_coc = False
+
+    def close(self):
+        self.close_l2cap_le_coc_client()
+        self.close_l2cap_le_coc_server()
+        self.__device == None
diff --git a/system/blueberry/tests/sl4a_sl4a/lib/le_advertiser.py b/system/blueberry/tests/sl4a_sl4a/lib/le_advertiser.py
index b6d5cfe..1c075a3 100644
--- a/system/blueberry/tests/sl4a_sl4a/lib/le_advertiser.py
+++ b/system/blueberry/tests/sl4a_sl4a/lib/le_advertiser.py
@@ -49,16 +49,17 @@
             return False
         return True
 
-    def advertise_rpa_public_extended_pdu(self, name="SL4A Device"):
+    def advertise_public_extended_pdu(self, address_type=common.RANDOM_DEVICE_ADDRESS, name="SL4A Device"):
         if self.is_advertising:
             logging.info("Already advertising!")
             return
+        logging.info("Configuring advertisement with address type %d", address_type)
         self.is_advertising = True
         self.device.sl4a.bleSetScanSettingsLegacy(False)
         self.device.sl4a.bleSetAdvertiseSettingsIsConnectable(True)
         self.device.sl4a.bleSetAdvertiseDataIncludeDeviceName(True)
         self.device.sl4a.bleSetAdvertiseSettingsAdvertiseMode(ble_advertise_settings_modes['low_latency'])
-        self.device.sl4a.bleSetAdvertiseSettingsOwnAddressType(common.RANDOM_DEVICE_ADDRESS)
+        self.device.sl4a.bleSetAdvertiseSettingsOwnAddressType(address_type)
         self.advertise_callback, self.advertise_data, self.advertise_settings = generate_ble_advertise_objects(
             self.device.sl4a)
         self.device.sl4a.bleStartBleAdvertising(self.advertise_callback, self.advertise_data, self.advertise_settings)
diff --git a/system/blueberry/tests/sl4a_sl4a/lib/le_scanner.py b/system/blueberry/tests/sl4a_sl4a/lib/le_scanner.py
index c7874e6..2e67d8a 100644
--- a/system/blueberry/tests/sl4a_sl4a/lib/le_scanner.py
+++ b/system/blueberry/tests/sl4a_sl4a/lib/le_scanner.py
@@ -49,7 +49,7 @@
     def scan_for_address_expect_none(self, address, addr_type):
         if self.is_scanning:
             print("Already scanning!")
-            return
+            return None
         self.is_scanning = True
         logging.info("Start scanning for identity address {} or type {}".format(address, addr_type))
         self.device.sl4a.bleSetScanSettingsScanMode(ble_scan_settings_modes['low_latency'])
@@ -66,11 +66,12 @@
         advertising_address = self.__wait_for_scan_result_event(expected_event_name, 1)
         assertThat(advertising_address).isNone()
         logging.info("Filter advertisement with address {}".format(advertising_address))
+        return advertising_address
 
     def scan_for_address(self, address, addr_type):
         if self.is_scanning:
             print("Already scanning!")
-            return
+            return None
         self.is_scanning = True
         logging.info("Start scanning for identity address {} or type {}".format(address, addr_type))
         self.device.sl4a.bleSetScanSettingsScanMode(ble_scan_settings_modes['low_latency'])
@@ -87,11 +88,12 @@
         advertising_address = self.__wait_for_scan_result_event(expected_event_name)
         assertThat(advertising_address).isNotNone()
         logging.info("Filter advertisement with address {}".format(advertising_address))
+        return advertising_address
 
     def scan_for_address_with_irk(self, address, addr_type, irk):
         if self.is_scanning:
             print("Already scanning!")
-            return
+            return None
         self.is_scanning = True
         logging.info("Start scanning for identity address {} or type {} using irk {}".format(address, addr_type, irk))
         self.device.sl4a.bleSetScanSettingsScanMode(ble_scan_settings_modes['low_latency'])
@@ -108,11 +110,12 @@
         advertising_address = self.__wait_for_scan_result_event(expected_event_name)
         assertThat(advertising_address).isNotNone()
         logging.info("Filter advertisement with address {}".format(advertising_address))
+        return advertising_address
 
     def scan_for_address_with_irk_pending_intent(self, address, addr_type, irk):
         if self.is_scanning:
             print("Already scanning!")
-            return
+            return None
         self.is_scanning = True
         logging.info("Start scanning for identity address {} or type {} using irk {}".format(address, addr_type, irk))
         self.device.sl4a.bleSetScanSettingsScanMode(ble_scan_settings_modes['low_latency'])
@@ -131,6 +134,7 @@
         advertising_address = self.__wait_for_scan_result_event(expected_event_name)
         assertThat(advertising_address).isNotNone()
         logging.info("Filter advertisement with address {}".format(advertising_address))
+        return advertising_address
 
     def scan_for_name(self, name):
         if self.is_scanning:
@@ -142,6 +146,7 @@
         self.device.sl4a.bleSetScanSettingsLegacy(False)
         self.filter_list, self.scan_settings, self.scan_callback = generate_ble_scan_objects(self.device.sl4a)
         expected_event_name = scan_result.format(1)
+        self.device.ed.clear_events(expected_event_name)
 
         # Start scanning on SL4A DUT
         self.device.sl4a.bleSetScanFilterDeviceName(name)
diff --git a/system/blueberry/tests/sl4a_sl4a/lib/oob_data.py b/system/blueberry/tests/sl4a_sl4a/lib/oob_data.py
index d37f3f4..e54c467 100644
--- a/system/blueberry/tests/sl4a_sl4a/lib/oob_data.py
+++ b/system/blueberry/tests/sl4a_sl4a/lib/oob_data.py
@@ -24,6 +24,8 @@
     confirmation = None
     randomizer = None
 
+    ADDRESS_WITH_TYPE_LENGTH = 14
+
     def __init__(self, address, confirmation, randomizer):
         self.address = address
         self.confirmation = confirmation
@@ -43,3 +45,8 @@
         address_str_octets = address_str_octets[:6]
         address_str_octets.reverse()
         return ":".join(address_str_octets)
+
+    def to_sl4a_address_type(self):
+        if len(self.address) != self.ADDRESS_WITH_TYPE_LENGTH:
+            return -1
+        return self.address.upper()[-1]
diff --git a/system/blueberry/tests/sl4a_sl4a/lib/security.py b/system/blueberry/tests/sl4a_sl4a/lib/security.py
index 05a6645..78cc758 100644
--- a/system/blueberry/tests/sl4a_sl4a/lib/security.py
+++ b/system/blueberry/tests/sl4a_sl4a/lib/security.py
@@ -25,8 +25,8 @@
 class Security:
 
     # Events sent from SL4A
-    SL4A_EVENT_GENERATED = "GeneratedOobData"
-    SL4A_EVENT_ERROR = "ErrorOobData"
+    SL4A_EVENT_GENERATE_OOB_DATA_SUCCESS = "GeneratedOobData"
+    SL4A_EVENT_GENERATE_OOB_DATA_ERROR = "ErrorOobData"
     SL4A_EVENT_BONDED = "Bonded"
     SL4A_EVENT_UNBONDED = "Unbonded"
 
@@ -37,22 +37,42 @@
     TRANSPORT_LE = "2"
 
     __default_timeout = 10  # seconds
-    __default_bonding_timeout = 30  # seconds
+    __default_bonding_timeout = 60  # seconds
     __device = None
 
     def __init__(self, device):
         self.__device = device
         self.__device.sl4a.bluetoothStartPairingHelper(True)
 
-    def generate_oob_data(self, transport):
+    # Returns a tuple formatted as <statuscode, OobData>. The OobData is
+    # populated if the statuscode is 0 (SUCCESS), else it will be None
+    def generate_oob_data(self, transport, wait_for_oob_data_callback=True):
+        logging.info("Generating local OOB data")
         self.__device.sl4a.bluetoothGenerateLocalOobData(transport)
-        try:
-            event_info = self.__device.ed.pop_event(self.SL4A_EVENT_GENERATED, self.__default_timeout)
-        except queue.Empty as error:
-            logging.error("Failed to generate OOB data!")
-            return None
-        return OobData(event_info["data"]["address_with_type"], event_info["data"]["confirmation"],
-                       event_info["data"]["randomizer"])
+
+        if wait_for_oob_data_callback is False:
+            return 0, None
+        else:
+            # Check for oob data generation success
+            try:
+                generate_success_event = self.__device.ed.pop_event(self.SL4A_EVENT_GENERATE_OOB_DATA_SUCCESS,
+                                                                    self.__default_timeout)
+            except queue.Empty as error:
+                logging.error("Failed to generate OOB data!")
+                # Check if generating oob data failed without blocking
+                try:
+                    generate_failure_event = self.__device.ed.pop_event(self.SL4A_EVENT_GENERATE_OOB_DATA_FAILURE, 0)
+                except queue.Empty as error:
+                    logging.error("Failed to generate OOB Data without error code")
+                    assertThat(True).isFalse()
+
+                errorcode = generate_failure_event["data"]["Error"]
+                logging.info("Generating local oob data failed with error code %d", errorcode)
+                return errorcode, None
+
+        logging.info("OOB ADDR with Type: %s", generate_success_event["data"]["address_with_type"])
+        return 0, OobData(generate_success_event["data"]["address_with_type"],
+                          generate_success_event["data"]["confirmation"], generate_success_event["data"]["randomizer"])
 
     def ensure_device_bonded(self):
         bond_state = None
@@ -65,14 +85,32 @@
         logging.info("Bonded: %s", bond_state["data"]["bonded_state"])
         assertThat(bond_state["data"]["bonded_state"]).isEqualTo(True)
 
-    def create_bond_out_of_band(self, oob_data):
+    def create_bond_out_of_band(self,
+                                oob_data,
+                                bt_device_object_address=None,
+                                bt_device_object_address_type=-1,
+                                wait_for_device_bonded=True):
         assertThat(oob_data).isNotNone()
-        address = oob_data.to_sl4a_address()
-        self.__device.sl4a.bluetoothCreateBondOutOfBand(address, self.TRANSPORT_LE, oob_data.confirmation,
-                                                        oob_data.randomizer)
-        self.ensure_device_bonded()
+        oob_data_address = oob_data.to_sl4a_address()
+        oob_data_address_type = oob_data.to_sl4a_address_type()
 
-    def create_bond_numeric_comparison(self, address, transport=TRANSPORT_LE):
+        # If a BT Device object address isn't specified, default to the oob data
+        # address and type
+        if bt_device_object_address is None:
+            bt_device_object_address = oob_data_address
+            bt_device_object_address_type = oob_data_address_type
+
+        logging.info("Bonding OOB with device addr=%s, device addr type=%s, oob addr=%s, oob addr type=%s",
+                     bt_device_object_address, bt_device_object_address_type, oob_data_address, oob_data_address_type)
+        bond_start = self.__device.sl4a.bluetoothCreateLeBondOutOfBand(
+            oob_data_address, oob_data_address_type, oob_data.confirmation, oob_data.randomizer,
+            bt_device_object_address, bt_device_object_address_type)
+        assertThat(bond_start).isTrue()
+
+        if wait_for_device_bonded:
+            self.ensure_device_bonded()
+
+    def create_bond_numeric_comparison(self, address, transport=TRANSPORT_LE, wait_for_device_bonded=True):
         assertThat(address).isNotNone()
         if transport == self.TRANSPORT_LE:
             self.__device.sl4a.bluetoothLeBond(address)
@@ -83,18 +121,20 @@
     def remove_all_bonded_devices(self):
         bonded_devices = self.__device.sl4a.bluetoothGetBondedDevices()
         for device in bonded_devices:
+            logging.info(device)
             self.remove_bond(device["address"])
 
     def remove_bond(self, address):
-        self.__device.sl4a.bluetoothUnbond(address)
-        bond_state = None
-        try:
-            bond_state = self.__device.ed.pop_event(self.SL4A_EVENT_UNBONDED, self.__default_timeout)
-        except queue.Empty as error:
-            logging.error("Failed to get bond event!")
-
-        assertThat(bond_state).isNotNone()
-        assertThat(bond_state["data"]["bonded_state"]).isEqualTo(False)
+        if self.__device.sl4a.bluetoothUnbond(address):
+            bond_state = None
+            try:
+                bond_state = self.__device.ed.pop_event(self.SL4A_EVENT_UNBONDED, self.__default_timeout)
+            except queue.Empty as error:
+                logging.error("Failed to get bond event!")
+            assertThat(bond_state).isNotNone()
+            assertThat(bond_state["data"]["bonded_state"]).isEqualTo(False)
+        else:
+            logging.info("remove_bond: Bluetooth Device with address: %s does not exist", address)
 
     def close(self):
         self.remove_all_bonded_devices()
diff --git a/system/blueberry/tests/sl4a_sl4a/lib/sl4a_sl4a_base_test.py b/system/blueberry/tests/sl4a_sl4a/lib/sl4a_sl4a_base_test.py
index fe37b00..0184288 100644
--- a/system/blueberry/tests/sl4a_sl4a/lib/sl4a_sl4a_base_test.py
+++ b/system/blueberry/tests/sl4a_sl4a/lib/sl4a_sl4a_base_test.py
@@ -26,6 +26,7 @@
 from blueberry.tests.gd_sl4a.lib.ble_lib import enable_bluetooth
 from blueberry.tests.sl4a_sl4a.lib.le_advertiser import LeAdvertiser
 from blueberry.tests.sl4a_sl4a.lib.le_scanner import LeScanner
+from blueberry.tests.sl4a_sl4a.lib.l2cap import L2cap
 from blueberry.tests.sl4a_sl4a.lib.security import Security
 from blueberry.utils.mobly_sl4a_utils import setup_sl4a
 from blueberry.utils.mobly_sl4a_utils import teardown_sl4a
@@ -43,11 +44,13 @@
     dut_advertiser_ = None
     dut_scanner_ = None
     dut_security_ = None
+    dut_l2cap_ = None
 
     # CERT
     cert_advertiser_ = None
     cert_scanner_ = None
     cert_security_ = None
+    cert_l2cap_ = None
 
     SUBPROCESS_WAIT_TIMEOUT_SECONDS = 10
 
@@ -111,9 +114,11 @@
         self.dut_advertiser_ = LeAdvertiser(self.dut)
         self.dut_scanner_ = LeScanner(self.dut)
         self.dut_security_ = Security(self.dut)
+        self.dut_l2cap_ = L2cap(self.dut)
         self.cert_advertiser_ = LeAdvertiser(self.cert)
         self.cert_scanner_ = LeScanner(self.cert)
         self.cert_security_ = Security(self.cert)
+        self.cert_l2cap_ = L2cap(self.cert)
         return True
 
     def teardown_test(self):
@@ -121,13 +126,16 @@
         safeClose(self.dut_advertiser_)
         safeClose(self.dut_scanner_)
         safeClose(self.dut_security_)
+        safeClose(self.dut_l2cap_)
         safeClose(self.cert_advertiser_)
         safeClose(self.cert_scanner_)
         safeClose(self.cert_security_)
+        safeClose(self.cert_l2cap_)
         self.dut_advertiser_ = None
         self.dut_scanner_ = None
         self.dut_security_ = None
         self.cert_advertiser_ = None
+        self.cert_l2cap_ = None
         self.cert_scanner_ = None
         self.cert_security_ = None
 
diff --git a/system/blueberry/tests/sl4a_sl4a/scanning/le_scanning.py b/system/blueberry/tests/sl4a_sl4a/scanning/le_scanning.py
new file mode 100644
index 0000000..f21ba28
--- /dev/null
+++ b/system/blueberry/tests/sl4a_sl4a/scanning/le_scanning.py
@@ -0,0 +1,91 @@
+#!/usr/bin/env python3
+#
+#   Copyright 2022 - The Android Open Source Project
+#
+#   Licensed under the Apache License, Version 2.0 (the "License");
+#   you may not use this file except in compliance with the License.
+#   You may obtain a copy of the License at
+#
+#       http://www.apache.org/licenses/LICENSE-2.0
+#
+#   Unless required by applicable law or agreed to in writing, software
+#   distributed under the License is distributed on an "AS IS" BASIS,
+#   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#   See the License for the specific language governing permissions and
+#   limitations under the License.
+
+import binascii
+import io
+import logging
+import os
+import queue
+import time
+
+from blueberry.tests.gd.cert.context import get_current_context
+from blueberry.tests.gd.cert.truth import assertThat
+from blueberry.tests.gd_sl4a.lib.bt_constants import ble_address_types
+from blueberry.tests.sl4a_sl4a.lib import sl4a_sl4a_base_test
+from blueberry.tests.sl4a_sl4a.lib.security import Security
+
+
+class LeScanningTest(sl4a_sl4a_base_test.Sl4aSl4aBaseTestClass):
+
+    def __get_cert_public_address_and_irk_from_bt_config(self):
+        # Pull IRK from SL4A cert side to pass in from SL4A DUT side when scanning
+        bt_config_file_path = os.path.join(get_current_context().get_full_output_path(),
+                                           "DUT_%s_bt_config.conf" % self.cert.serial)
+        try:
+            self.cert.adb.pull(["/data/misc/bluedroid/bt_config.conf", bt_config_file_path])
+        except AdbError as error:
+            logging.error("Failed to pull SL4A cert BT config")
+            return False
+        logging.debug("Reading SL4A cert BT config")
+        with io.open(bt_config_file_path) as f:
+            for line in f.readlines():
+                stripped_line = line.strip()
+                if (stripped_line.startswith("Address")):
+                    address_fields = stripped_line.split(' ')
+                    # API currently requires public address to be capitalized
+                    address = address_fields[2].upper()
+                    logging.debug("Found cert address: %s" % address)
+                    continue
+                if (stripped_line.startswith("LE_LOCAL_KEY_IRK")):
+                    irk_fields = stripped_line.split(' ')
+                    irk = irk_fields[2]
+                    logging.debug("Found cert IRK: %s" % irk)
+                    continue
+
+        return address, irk
+
+    def setup_class(self):
+        super().setup_class()
+
+    def setup_test(self):
+        assertThat(super().setup_test()).isTrue()
+
+    def teardown_test(self):
+        super().teardown_test()
+
+    def test_scan_result_address(self):
+        cert_public_address, irk = self.__get_cert_public_address_and_irk_from_bt_config()
+        self.cert_advertiser_.advertise_public_extended_pdu()
+        advertising_name = self.cert_advertiser_.get_local_advertising_name()
+
+        # Scan with name and verify we get back a scan result with the RPA
+        scan_result_addr = self.dut_scanner_.scan_for_name(advertising_name)
+        assertThat(scan_result_addr).isNotNone()
+        assertThat(scan_result_addr).isNotEqualTo(cert_public_address)
+
+        # Bond
+        logging.info("Bonding with %s", scan_result_addr)
+        self.dut_security_.create_bond_numeric_comparison(scan_result_addr)
+        self.dut_scanner_.stop_scanning()
+
+        # Start advertising again and scan for identity address
+        scan_result_addr = self.dut_scanner_.scan_for_address(cert_public_address, ble_address_types["public"])
+        assertThat(scan_result_addr).isNotNone()
+        assertThat(scan_result_addr).isNotEqualTo(cert_public_address)
+
+        # Teardown advertiser and scanner
+        self.dut_scanner_.stop_scanning()
+        self.cert_advertiser_.stop_advertising()
diff --git a/system/blueberry/tests/sl4a_sl4a/security/irk_rotation_test.py b/system/blueberry/tests/sl4a_sl4a/security/irk_rotation_test.py
new file mode 100644
index 0000000..9061f13
--- /dev/null
+++ b/system/blueberry/tests/sl4a_sl4a/security/irk_rotation_test.py
@@ -0,0 +1,168 @@
+#!/usr/bin/env python3
+#
+#   Copyright 2022 - The Android Open Source Project
+#
+#   Licensed under the Apache License, Version 2.0 (the "License");
+#   you may not use this file except in compliance with the License.
+#   You may obtain a copy of the License at
+#
+#       http://www.apache.org/licenses/LICENSE-2.0
+#
+#   Unless required by applicable law or agreed to in writing, software
+#   distributed under the License is distributed on an "AS IS" BASIS,
+#   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#   See the License for the specific language governing permissions and
+#   limitations under the License.
+
+import binascii
+import io
+import logging
+import os
+import queue
+
+from blueberry.facade import common_pb2 as common
+from blueberry.tests.gd.cert.context import get_current_context
+from blueberry.tests.gd.cert.truth import assertThat
+from blueberry.tests.gd_sl4a.lib.ble_lib import disable_bluetooth
+from blueberry.tests.gd_sl4a.lib.ble_lib import enable_bluetooth
+from blueberry.tests.gd_sl4a.lib.bt_constants import ble_address_types
+from blueberry.tests.sl4a_sl4a.lib import sl4a_sl4a_base_test
+from blueberry.tests.sl4a_sl4a.lib.security import Security
+from blueberry.utils.bt_gatt_constants import GattCallbackString
+from blueberry.utils.bt_gatt_constants import GattTransport
+
+
+class IrkRotationTest(sl4a_sl4a_base_test.Sl4aSl4aBaseTestClass):
+
+    def setup_class(self):
+        super().setup_class()
+        self.default_timeout = 10  # seconds
+
+    def setup_test(self):
+        assertThat(super().setup_test()).isTrue()
+
+    def teardown_test(self):
+        current_test_dir = get_current_context().get_full_output_path()
+        self.cert.adb.pull([
+            "/data/misc/bluetooth/logs/btsnoop_hci.log",
+            os.path.join(current_test_dir, "CERT_%s_btsnoop_hci.log" % self.cert.serial)
+        ])
+        self.cert.adb.pull([
+            "/data/misc/bluetooth/logs/btsnoop_hci.log.last",
+            os.path.join(current_test_dir, "CERT_%s_btsnoop_hci.log.last" % self.cert.serial)
+        ])
+        super().teardown_test()
+        self.cert.adb.shell("setprop bluetooth.core.gap.le.privacy.enabled \'\'")
+
+    def _wait_for_event(self, expected_event_name, device):
+        try:
+            event_info = device.ed.pop_event(expected_event_name, self.default_timeout)
+            logging.info(event_info)
+        except queue.Empty as error:
+            logging.error("Failed to find event: %s", expected_event_name)
+            return False
+        return True
+
+    def __get_cert_public_address_and_irk_from_bt_config(self):
+        # Pull IRK from SL4A cert side to pass in from SL4A DUT side when scanning
+        bt_config_file_path = os.path.join(get_current_context().get_full_output_path(),
+                                           "DUT_%s_bt_config.conf" % self.cert.serial)
+        try:
+            self.cert.adb.pull(["/data/misc/bluedroid/bt_config.conf", bt_config_file_path])
+        except AdbError as error:
+            logging.error("Failed to pull SL4A cert BT config")
+            return False
+        logging.debug("Reading SL4A cert BT config")
+        with io.open(bt_config_file_path) as f:
+            for line in f.readlines():
+                stripped_line = line.strip()
+                if (stripped_line.startswith("Address")):
+                    address_fields = stripped_line.split(' ')
+                    # API currently requires public address to be capitalized
+                    address = address_fields[2].upper()
+                    logging.debug("Found cert address: %s" % address)
+                    continue
+                if (stripped_line.startswith("LE_LOCAL_KEY_IRK")):
+                    irk_fields = stripped_line.split(' ')
+                    irk = irk_fields[2]
+                    logging.debug("Found cert IRK: %s" % irk)
+                    continue
+
+        return address, irk
+
+    def test_le_reconnect_after_irk_rotation_cert_privacy_enabled(self):
+        self._test_le_reconnect_after_irk_rotation(True)
+
+    def test_le_reconnect_after_irk_rotation_cert_privacy_disabled(self):
+        self.cert.sl4a.bluetoothDisableBLE()
+        disable_bluetooth(self.cert.sl4a, self.cert.ed)
+        self.cert.adb.shell("setprop bluetooth.core.gap.le.privacy.enabled false")
+        self.cert.adb.shell("device_config put bluetooth INIT_logging_debug_enabled_for_all true")
+        enable_bluetooth(self.cert.sl4a, self.cert.ed)
+        self.cert.sl4a.bluetoothDisableBLE()
+        self._test_le_reconnect_after_irk_rotation(False)
+
+    def _bond_remote_device(self, cert_privacy_enabled, cert_public_address):
+        if cert_privacy_enabled:
+            self.cert_advertiser_.advertise_public_extended_pdu()
+        else:
+            self.cert_advertiser_.advertise_public_extended_pdu(common.PUBLIC_DEVICE_ADDRESS)
+
+        advertising_device_name = self.cert_advertiser_.get_local_advertising_name()
+        connect_address = self.dut_scanner_.scan_for_name(advertising_device_name)
+
+        # Bond
+        logging.info("Bonding with %s", connect_address)
+        self.dut_security_.create_bond_numeric_comparison(connect_address)
+        self.dut_scanner_.stop_scanning()
+        self.cert_advertiser_.stop_advertising()
+
+        return connect_address
+
+    def _test_le_reconnect_after_irk_rotation(self, cert_privacy_enabled):
+
+        cert_public_address, irk = self.__get_cert_public_address_and_irk_from_bt_config()
+        self._bond_remote_device(cert_privacy_enabled, cert_public_address)
+
+        # Remove all bonded devices to rotate the IRK
+        logging.info("Unbonding all devices")
+        self.dut_security_.remove_all_bonded_devices()
+        self.cert_security_.remove_all_bonded_devices()
+
+        # Bond again
+        logging.info("Rebonding remote device")
+        connect_address = self._bond_remote_device(cert_privacy_enabled, cert_public_address)
+
+        # Connect GATT
+        logging.info("Connecting GATT to %s", connect_address)
+        gatt_callback = self.dut.sl4a.gattCreateGattCallback()
+        bluetooth_gatt = self.dut.sl4a.gattClientConnectGatt(gatt_callback, connect_address, False,
+                                                             GattTransport.TRANSPORT_LE, False, None)
+        assertThat(bluetooth_gatt).isNotNone()
+        expected_event_name = GattCallbackString.GATT_CONN_CHANGE.format(gatt_callback)
+        assertThat(self._wait_for_event(expected_event_name, self.dut)).isTrue()
+
+        # Close GATT connection
+        logging.info("Closing GATT connection")
+        self.dut.sl4a.gattClientClose(bluetooth_gatt)
+
+        # Reconnect GATT
+        logging.info("Reconnecting GATT")
+        gatt_callback = self.dut.sl4a.gattCreateGattCallback()
+        bluetooth_gatt = self.dut.sl4a.gattClientConnectGatt(gatt_callback, connect_address, False,
+                                                             GattTransport.TRANSPORT_LE, False, None)
+        assertThat(bluetooth_gatt).isNotNone()
+        expected_event_name = GattCallbackString.GATT_CONN_CHANGE.format(gatt_callback)
+        assertThat(self._wait_for_event(expected_event_name, self.dut)).isTrue()
+
+        # Disconnect GATT
+        logging.info("Disconnecting GATT")
+        self.dut.sl4a.gattClientDisconnect(gatt_callback)
+        expected_event_name = GattCallbackString.GATT_CONN_CHANGE.format(gatt_callback)
+        assertThat(self._wait_for_event(expected_event_name, self.dut)).isTrue()
+
+        # Reconnect GATT
+        logging.info("Reconnecting GATT")
+        self.dut.sl4a.gattClientReconnect(gatt_callback)
+        expected_event_name = GattCallbackString.GATT_CONN_CHANGE.format(gatt_callback)
+        assertThat(self._wait_for_event(expected_event_name, self.dut)).isTrue()
diff --git a/system/blueberry/tests/sl4a_sl4a/security/oob_pairing_test.py b/system/blueberry/tests/sl4a_sl4a/security/oob_pairing_test.py
index becdbc7..5bb2dce 100644
--- a/system/blueberry/tests/sl4a_sl4a/security/oob_pairing_test.py
+++ b/system/blueberry/tests/sl4a_sl4a/security/oob_pairing_test.py
@@ -19,6 +19,7 @@
 import logging
 import os
 import queue
+import time
 
 from blueberry.tests.gd.cert.context import get_current_context
 from blueberry.tests.gd.cert.truth import assertThat
@@ -67,23 +68,34 @@
 
     def __test_scan(self, address_type="public"):
         cert_public_address, irk = self.__get_cert_public_address_and_irk_from_bt_config()
-        rpa_address = self.cert_advertiser_.advertise_rpa_public_extended_pdu()
+        rpa_address = self.cert_advertiser_.advertise_public_extended_pdu()
         self.dut_scanner_.start_identity_address_scan(cert_public_address, ble_address_types[address_type])
         self.dut_scanner_.stop_scanning()
         self.cert_advertiser_.stop_advertising()
 
+    def __create_le_bond_oob_single_sided(self, wait_for_oob_data=True, wait_for_device_bonded=True):
+        oob_data = self.cert_security_.generate_oob_data(Security.TRANSPORT_LE, wait_for_oob_data)
+        if wait_for_oob_data:
+            assertThat(oob_data[0]).isEqualTo(0)
+            assertThat(oob_data[1]).isNotNone()
+        self.dut_security_.create_bond_out_of_band(oob_data[1], wait_for_device_bonded)
+
+    def __create_le_bond_oob_double_sided(self, wait_for_oob_data=True, wait_for_device_bonded=True):
+        # Genearte OOB data on DUT, but we don't use it
+        self.dut_security_.generate_oob_data(Security.TRANSPORT_LE, wait_for_oob_data)
+        self.__create_le_bond_oob_single_sided(wait_for_oob_data, wait_for_device_bonded)
+
     def test_classic_generate_local_oob_data(self):
         oob_data = self.dut_security_.generate_oob_data(Security.TRANSPORT_BREDR)
-        assertThat(oob_data).isNotNone()
+        assertThat(oob_data[0]).isEqualTo(0)
+        assertThat(oob_data[1]).isNotNone()
         oob_data = self.dut_security_.generate_oob_data(Security.TRANSPORT_BREDR)
-        assertThat(oob_data).isNotNone()
+        assertThat(oob_data[0]).isEqualTo(0)
+        assertThat(oob_data[1]).isNotNone()
 
     def test_classic_generate_local_oob_data_stress(self):
         for i in range(1, 20):
-            oob_data = self.dut_security_.generate_oob_data(Security.TRANSPORT_BREDR)
-            assertThat(oob_data).isNotNone()
-            oob_data = self.dut_security_.generate_oob_data(Security.TRANSPORT_BREDR)
-            assertThat(oob_data).isNotNone()
+            self.test_classic_generate_local_oob_data()
 
     def test_le_generate_local_oob_data(self):
         oob_data = self.dut_security_.generate_oob_data(Security.TRANSPORT_LE)
@@ -93,23 +105,25 @@
 
     def test_le_generate_local_oob_data_stress(self):
         for i in range(1, 20):
-            oob_data = self.dut_security_.generate_oob_data(Security.TRANSPORT_LE)
-            assertThat(oob_data).isNotNone()
-            oob_data = self.cert_security_.generate_oob_data(Security.TRANSPORT_LE)
-            assertThat(oob_data).isNotNone()
+            self.test_le_generate_local_oob_data()
 
-    def test_le_bond_oob(self):
-        oob_data = self.cert_security_.generate_oob_data(Security.TRANSPORT_LE)
-        assertThat(oob_data).isNotNone()
-        self.dut_security_.create_bond_out_of_band(oob_data)
+    def test_le_bond(self):
+        self.__create_le_bond_oob_single_sided()
 
     def test_le_bond_oob_stress(self):
         for i in range(0, 10):
             logging.info("Stress #%d" % i)
-            self.test_le_bond_oob()
+            self.__create_le_bond_oob_single_sided()
             self.dut_security_.remove_all_bonded_devices()
             self.cert_security_.remove_all_bonded_devices()
 
     def test_le_generate_local_oob_data_after_le_bond_oob(self):
-        self.test_le_bond_oob()
+        self.__create_le_bond_oob_single_sided()
         self.test_le_generate_local_oob_data()
+
+    def test_le_generate_oob_data_while_bonding(self):
+        self.__create_le_bond_oob_double_sided(True, False)
+        self.dut_security_.generate_oob_data(Security.TRANSPORT_LE, False)
+        for i in range(0, 10):
+            oob_data = self.dut_security_.generate_oob_data(Security.TRANSPORT_LE, True)
+            logging.info("OOB Data came back with code: %d", oob_data[0])
diff --git a/system/blueberry/tests/sl4a_sl4a/sl4a_sl4a_test_runner.py b/system/blueberry/tests/sl4a_sl4a/sl4a_sl4a_test_runner.py
index c08836d..3081aa4 100644
--- a/system/blueberry/tests/sl4a_sl4a/sl4a_sl4a_test_runner.py
+++ b/system/blueberry/tests/sl4a_sl4a/sl4a_sl4a_test_runner.py
@@ -18,6 +18,9 @@
 from blueberry.tests.sl4a_sl4a.gatt.gatt_connect_test import GattConnectTest
 from blueberry.tests.sl4a_sl4a.gatt.gatt_connect_with_irk_test import GattConnectWithIrkTest
 from blueberry.tests.sl4a_sl4a.gatt.gatt_notify_test import GattNotifyTest
+from blueberry.tests.sl4a_sl4a.l2cap.le_l2cap_coc_test import LeL2capCoCTest
+from blueberry.tests.sl4a_sl4a.scanning.le_scanning import LeScanningTest
+from blueberry.tests.sl4a_sl4a.security.irk_rotation_test import IrkRotationTest
 from blueberry.tests.sl4a_sl4a.security.oob_pairing_test import OobPairingTest
 
 from mobly import suite_runner
@@ -27,7 +30,10 @@
     GattConnectTest,
     GattConnectWithIrkTest,
     GattNotifyTest,
+    IrkRotationTest,
     LeAdvertisingTest,
+    LeL2capCoCTest,
+    LeScanningTest,
     OobPairingTest,
 ]
 
diff --git a/system/bta/Android.bp b/system/bta/Android.bp
index b6eb470..513599e 100644
--- a/system/bta/Android.bp
+++ b/system/bta/Android.bp
@@ -97,8 +97,11 @@
         "le_audio/devices.cc",
         "le_audio/hal_verifier.cc",
         "le_audio/state_machine.cc",
+        "le_audio/storage_helper.cc",
         "le_audio/client_parser.cc",
-        "le_audio/client_audio.cc",
+        "le_audio/audio_hal_client/audio_sink_hal_client.cc",
+        "le_audio/audio_hal_client/audio_source_hal_client.cc",
+        "le_audio/le_audio_utils.cc",
         "le_audio/le_audio_set_configuration_provider.cc",
         "le_audio/le_audio_set_configuration_provider_json.cc",
         "le_audio/le_audio_types.cc",
@@ -123,6 +126,7 @@
         "hh/bta_hh_le.cc",
         "hh/bta_hh_main.cc",
         "hh/bta_hh_utils.cc",
+        "hfp/bta_hfp_api.cc",
         "hd/bta_hd_act.cc",
         "hd/bta_hd_api.cc",
         "hd/bta_hd_main.cc",
@@ -144,6 +148,7 @@
     static_libs: [
         "avrcp-target-service",
         "lib-bt-packets",
+        "libcom.android.sysprop.bluetooth",
     ],
     generated_headers: [
         "LeAudioSetConfigSchemas_h",
@@ -184,6 +189,7 @@
         "libbt-audio-hal-interface",
         "libbluetooth-types",
         "libbt-protos-lite",
+        "libcom.android.sysprop.bluetooth",
         "libosi",
         "libbt-common",
     ],
@@ -294,6 +300,7 @@
         "libbt-common",
         "libbt-protos-lite",
         "libbtcore",
+        "libcom.android.sysprop.bluetooth",
         "libflatbuffers-cpp",
         "libgmock",
     ],
@@ -323,6 +330,7 @@
         "packages/modules/Bluetooth/system/utils/include",
     ],
     srcs: [
+        "hf_client/bta_hf_client_api.cc",
         "test/bta_hf_client_add_record_test.cc",
     ],
     header_libs: ["libbluetooth_headers"],
@@ -332,6 +340,7 @@
     ],
     static_libs: [
         "libbluetooth-types",
+        "libcom.android.sysprop.bluetooth",
         "libosi",
     ],
     cflags: ["-DBUILDCFG"],
@@ -589,10 +598,12 @@
         "test/common/bta_gatt_api_mock.cc",
         "test/common/bta_gatt_queue_mock.cc",
         "test/common/btm_api_mock.cc",
-        "le_audio/client_audio.cc",
-        "le_audio/client_audio_test.cc",
+        "le_audio/audio_hal_client/audio_sink_hal_client.cc",
+        "le_audio/audio_hal_client/audio_source_hal_client.cc",
+        "le_audio/audio_hal_client/audio_hal_client_test.cc",
         "le_audio/client_parser.cc",
         "le_audio/client_parser_test.cc",
+        "le_audio/content_control_id_keeper.cc",
         "le_audio/devices.cc",
         "le_audio/devices_test.cc",
         "le_audio/le_audio_set_configuration_provider_json.cc",
@@ -600,9 +611,13 @@
         "le_audio/le_audio_types_test.cc",
         "le_audio/metrics_collector_linux.cc",
         "le_audio/mock_iso_manager.cc",
+        "test/common/btif_storage_mock.cc",
         "test/common/mock_controller.cc",
+        "test/common/mock_csis_client.cc",
         "le_audio/state_machine.cc",
         "le_audio/state_machine_test.cc",
+        "le_audio/storage_helper.cc",
+        "le_audio/storage_helper_test.cc",
         "le_audio/mock_codec_manager.cc",
     ],
     data: [
@@ -643,6 +658,8 @@
         "mts_defaults",
     ],
     host_supported: true,
+    // TODO(b/231993739): Reenable isolated:true by deleting the explicit disable below
+    isolated: false,
     include_dirs: [
         "packages/modules/Bluetooth/system",
         "packages/modules/Bluetooth/system/bta/include",
@@ -655,10 +672,10 @@
         "gatt/database.cc",
         "gatt/database_builder.cc",
         "le_audio/client.cc",
-        "le_audio/client_audio.cc",
         "le_audio/client_parser.cc",
         "le_audio/content_control_id_keeper.cc",
         "le_audio/devices.cc",
+        "le_audio/le_audio_utils.cc",
         "le_audio/le_audio_client_test.cc",
         "le_audio/le_audio_set_configuration_provider_json.cc",
         "le_audio/le_audio_types.cc",
@@ -666,6 +683,7 @@
         "le_audio/metrics_collector_test.cc",
         "le_audio/mock_iso_manager.cc",
         "le_audio/mock_state_machine.cc",
+        "le_audio/storage_helper.cc",
         "test/common/btm_api_mock.cc",
         "test/common/bta_gatt_api_mock.cc",
         "test/common/bta_gatt_queue_mock.cc",
@@ -725,7 +743,7 @@
 }
 
 cc_test {
-    name: "bluetooth_test_broadcaster_sm",
+    name: "bluetooth_test_broadcaster_state_machine",
     test_suites: ["device-tests"],
     defaults: [
         "fluoride_bta_defaults",
@@ -733,6 +751,8 @@
         "mts_defaults",
     ],
     host_supported: true,
+    // TODO(b/231993739): Reenable isolated:true by deleting the explicit disable below
+    isolated: false,
     include_dirs: [
         "packages/modules/Bluetooth/system",
         "packages/modules/Bluetooth/system/bta/include",
@@ -749,6 +769,7 @@
         "le_audio/le_audio_types.cc",
         "le_audio/mock_iso_manager.cc",
         "le_audio/mock_codec_manager.cc",
+        ":TestCommonStackConfig",
     ],
     shared_libs: [
         "libprotobuf-cpp-lite",
@@ -798,11 +819,12 @@
         "le_audio/broadcaster/mock_ble_advertising_manager.cc",
         "le_audio/broadcaster/mock_state_machine.cc",
         "le_audio/content_control_id_keeper.cc",
-        "le_audio/client_audio.cc",
+        "le_audio/le_audio_utils.cc",
         "le_audio/le_audio_types.cc",
         "le_audio/mock_iso_manager.cc",
         "test/common/mock_controller.cc",
         "le_audio/mock_codec_manager.cc",
+        ":TestCommonStackConfig",
     ],
     shared_libs: [
         "libprotobuf-cpp-lite",
@@ -850,6 +872,8 @@
         "mts_defaults",
     ],
     host_supported: true,
+    // TODO(b/231993739): Reenable isolated:true by deleting the explicit disable below
+    isolated: false,
     include_dirs: [
         "packages/modules/Bluetooth/system",
         "packages/modules/Bluetooth/system/bta/include",
@@ -871,6 +895,7 @@
         "test/common/btm_api_mock.cc",
         "test/common/mock_controller.cc",
         "test/common/mock_csis_client.cc",
+        ":TestStubOsi",
     ],
     shared_libs: [
         "libprotobuf-cpp-lite",
diff --git a/system/bta/BUILD.gn b/system/bta/BUILD.gn
index db8db54..22cf22e 100644
--- a/system/bta/BUILD.gn
+++ b/system/bta/BUILD.gn
@@ -74,6 +74,7 @@
     "hh/bta_hh_le.cc",
     "hh/bta_hh_main.cc",
     "hh/bta_hh_utils.cc",
+    "hfp/bta_hfp_api.cc",
     "hd/bta_hd_act.cc",
     "hd/bta_hd_api.cc",
     "hd/bta_hd_main.cc",
diff --git a/system/bta/ag/bta_ag_at.cc b/system/bta/ag/bta_ag_at.cc
index 613a64b..a3ff49a 100644
--- a/system/bta/ag/bta_ag_at.cc
+++ b/system/bta/ag/bta_ag_at.cc
@@ -99,7 +99,6 @@
     p_arg = p_cb->p_cmd_buf + strlen(p_cb->p_at_tbl[idx].p_cmd);
     if (p_arg > p_end) {
       (*p_cb->p_err_cback)((tBTA_AG_SCB*)p_cb->p_user, false, nullptr);
-      android_errorWriteLog(0x534e4554, "112860487");
       return;
     }
 
diff --git a/system/bta/ag/bta_ag_cmd.cc b/system/bta/ag/bta_ag_cmd.cc
index 7d06226..251e688 100644
--- a/system/bta/ag/bta_ag_cmd.cc
+++ b/system/bta/ag/bta_ag_cmd.cc
@@ -379,7 +379,6 @@
 
     /* get integer value */
     if (p > p_end) {
-      android_errorWriteLog(0x534e4554, "112860487");
       return false;
     }
     *p = 0;
@@ -453,7 +452,6 @@
 
     /* get integer value */
     if (p > p_end) {
-      android_errorWriteLog(0x534e4554, "112860487");
       break;
     }
     bool cont = false;  // Continue processing
@@ -595,7 +593,6 @@
   if ((p_end - p_arg + 1) >= (long)sizeof(val.str)) {
     APPL_TRACE_ERROR("%s: p_arg is too long, send error and return", __func__);
     bta_ag_send_error(p_scb, BTA_AG_ERR_TEXT_TOO_LONG);
-    android_errorWriteLog(0x534e4554, "112860487");
     return;
   }
   strlcpy(val.str, p_arg, sizeof(val.str));
@@ -763,7 +760,7 @@
 
     bta_ag_send_ok(p_scb);
 
-    /* If the service level connection wan't already open, now it's open */
+    /* If the service level connection wasn't already open, now it's open */
     if (!p_scb->svc_conn) {
       bta_ag_svc_conn_open(p_scb, tBTA_AG_DATA::kEmpty);
     }
@@ -872,7 +869,6 @@
   if ((p_end - p_arg + 1) >= (long)sizeof(val.str)) {
     LOG_ERROR("p_arg is too long for cmd 0x%x, send error and return", cmd);
     bta_ag_send_error(p_scb, BTA_AG_ERR_TEXT_TOO_LONG);
-    android_errorWriteLog(0x534e4554, "112860487");
     return;
   }
   strlcpy(val.str, p_arg, sizeof(val.str));
diff --git a/system/bta/ag/bta_ag_sco.cc b/system/bta/ag/bta_ag_sco.cc
index f33530a..81c9be1 100644
--- a/system/bta/ag/bta_ag_sco.cc
+++ b/system/bta/ag/bta_ag_sco.cc
@@ -569,6 +569,7 @@
   }
 
   if ((p_scb->codec_updated || p_scb->codec_fallback) &&
+      (p_scb->features & BTA_AG_FEAT_CODEC) &&
       (p_scb->peer_features & BTA_AG_PEER_FEAT_CODEC)) {
     LOG_INFO("Starting codec negotiation");
     /* Change the power mode to Active until SCO open is completed. */
diff --git a/system/bta/ag/bta_ag_sdp.cc b/system/bta/ag/bta_ag_sdp.cc
index e9af15c..27503b1 100644
--- a/system/bta/ag/bta_ag_sdp.cc
+++ b/system/bta/ag/bta_ag_sdp.cc
@@ -161,7 +161,7 @@
   /* add profile descriptor list */
   if (service_uuid == UUID_SERVCLASS_AG_HANDSFREE) {
     profile_uuid = UUID_SERVCLASS_HF_HANDSFREE;
-    version = BTA_HFP_VERSION;
+    version = get_default_hfp_version();
   } else {
     profile_uuid = UUID_SERVCLASS_HEADSET;
     version = HSP_VERSION_1_2;
@@ -271,7 +271,6 @@
         bta_ag_cb.profile[i].sdp_handle = 0;
       }
       BTM_FreeSCN(bta_ag_cb.profile[i].scn);
-      RFCOMM_ClearSecurityRecord(bta_ag_cb.profile[i].scn);
       bta_sys_remove_uuid(bta_ag_uuid[i]);
     }
   }
@@ -477,7 +476,6 @@
   }
 
   if (p_scb->p_disc_db != nullptr) {
-    android_errorWriteLog(0x534e4554, "174052148");
     LOG_ERROR("Discovery already in progress... returning.");
     return;
   }
diff --git a/system/bta/av/bta_av_aact.cc b/system/bta/av/bta_av_aact.cc
index 9e48782..d0db36e 100644
--- a/system/bta/av/bta_av_aact.cc
+++ b/system/bta/av/bta_av_aact.cc
@@ -1824,6 +1824,9 @@
     if (p_scb->role & BTA_AV_ROLE_SUSPEND) {
       notify_start_failed(p_scb);
     } else {
+      if (p_data) {
+        bta_av_set_use_latency_mode(p_scb, p_data->do_start.use_latency_mode);
+      }
       bta_av_start_ok(p_scb, NULL);
     }
     return;
@@ -1858,6 +1861,8 @@
     LOG_ERROR("%s: AVDT_StartReq failed for peer %s result:%d", __func__,
               p_scb->PeerAddress().ToString().c_str(), result);
     bta_av_start_failed(p_scb, p_data);
+  } else if (p_data) {
+    bta_av_set_use_latency_mode(p_scb, p_data->do_start.use_latency_mode);
   }
   LOG_INFO(
       "%s: peer %s start requested: sco_occupied:%s role:0x%x "
@@ -3208,6 +3213,9 @@
     case BTAV_A2DP_CODEC_INDEX_SOURCE_LDAC:
       codec_type = BTA_AV_CODEC_TYPE_LDAC;
       break;
+    case BTAV_A2DP_CODEC_INDEX_SOURCE_OPUS:
+      codec_type = BTA_AV_CODEC_TYPE_OPUS;
+      break;
     default:
       APPL_TRACE_ERROR("%s: Unknown Codec type ", __func__);
       return;
diff --git a/system/bta/av/bta_av_act.cc b/system/bta/av/bta_av_act.cc
index 10019e7..be199a4 100644
--- a/system/bta/av/bta_av_act.cc
+++ b/system/bta/av/bta_av_act.cc
@@ -791,7 +791,6 @@
         /* process GetCapabilities command without reporting the event to app */
         evt = 0;
         if (p_vendor->vendor_len != 5) {
-          android_errorWriteLog(0x534e4554, "111893951");
           p_rc_rsp->get_caps.status = AVRC_STS_INTERNAL_ERR;
           break;
         }
@@ -1339,6 +1338,38 @@
   alarm_cancel(p_scb->link_signalling_timer);
 }
 
+/*******************************************************************************
+ *
+ * Function         bta_av_set_use_latency_mode
+ *
+ * Description      Sets stream use latency mode.
+ *
+ * Returns          void
+ *
+ ******************************************************************************/
+void bta_av_set_use_latency_mode(tBTA_AV_SCB* p_scb, bool use_latency_mode) {
+  L2CA_UseLatencyMode(p_scb->PeerAddress(), use_latency_mode);
+}
+
+/*******************************************************************************
+ *
+ * Function         bta_av_api_set_latency
+ *
+ * Description      set stream latency.
+ *
+ * Returns          void
+ *
+ ******************************************************************************/
+void bta_av_api_set_latency(tBTA_AV_DATA* p_data) {
+  tBTA_AV_SCB* p_scb =
+      bta_av_hndl_to_scb(p_data->api_set_latency.hdr.layer_specific);
+
+  tL2CAP_LATENCY latency = p_data->api_set_latency.is_low_latency
+                               ? L2CAP_LATENCY_LOW
+                               : L2CAP_LATENCY_NORMAL;
+  L2CA_SetAclLatency(p_scb->PeerAddress(), latency);
+}
+
 /**
  * Find the index for the free LCB entry to use.
  *
diff --git a/system/bta/av/bta_av_api.cc b/system/bta/av/bta_av_api.cc
index 9a8ccfd..defaea1 100644
--- a/system/bta/av/bta_av_api.cc
+++ b/system/bta/av/bta_av_api.cc
@@ -215,13 +215,17 @@
  * Returns          void
  *
  ******************************************************************************/
-void BTA_AvStart(tBTA_AV_HNDL handle) {
-  LOG_INFO("Starting audio/video stream data transfer bta_handle:%hhu", handle);
+void BTA_AvStart(tBTA_AV_HNDL handle, bool use_latency_mode) {
+  LOG_INFO(
+      "Starting audio/video stream data transfer bta_handle:%hhu, "
+      "use_latency_mode:%s",
+      handle, use_latency_mode ? "true" : "false");
 
-  BT_HDR_RIGID* p_buf = (BT_HDR_RIGID*)osi_malloc(sizeof(BT_HDR_RIGID));
-
-  p_buf->event = BTA_AV_API_START_EVT;
-  p_buf->layer_specific = handle;
+  tBTA_AV_DO_START* p_buf =
+      (tBTA_AV_DO_START*)osi_malloc(sizeof(tBTA_AV_DO_START));
+  p_buf->hdr.event = BTA_AV_API_START_EVT;
+  p_buf->hdr.layer_specific = handle;
+  p_buf->use_latency_mode = use_latency_mode;
 
   bta_sys_sendmsg(p_buf);
 }
@@ -613,3 +617,26 @@
 
   bta_sys_sendmsg(p_buf);
 }
+
+/*******************************************************************************
+ *
+ * Function         BTA_AvSetLatency
+ *
+ * Description      Set audio/video stream latency.
+ *
+ * Returns          void
+ *
+ ******************************************************************************/
+void BTA_AvSetLatency(tBTA_AV_HNDL handle, bool is_low_latency) {
+  LOG_INFO(
+      "Set audio/video stream low latency bta_handle:%hhu, is_low_latency:%s",
+      handle, is_low_latency ? "true" : "false");
+
+  tBTA_AV_API_SET_LATENCY* p_buf =
+      (tBTA_AV_API_SET_LATENCY*)osi_malloc(sizeof(tBTA_AV_API_SET_LATENCY));
+  p_buf->hdr.event = BTA_AV_API_SET_LATENCY_EVT;
+  p_buf->hdr.layer_specific = handle;
+  p_buf->is_low_latency = is_low_latency;
+
+  bta_sys_sendmsg(p_buf);
+}
diff --git a/system/bta/av/bta_av_cfg.cc b/system/bta/av/bta_av_cfg.cc
index d2a7d8a..bebd05e 100644
--- a/system/bta/av/bta_av_cfg.cc
+++ b/system/bta/av/bta_av_cfg.cc
@@ -92,16 +92,16 @@
   (sizeof(bta_av_meta_caps_evt_ids) / sizeof(bta_av_meta_caps_evt_ids[0]))
 #endif /* BTA_AV_NUM_RC_EVT_IDS */
 
-const uint8_t bta_avk_meta_caps_evt_ids[] = {
-#if (AVRC_ADV_CTRL_INCLUDED == TRUE)
-    AVRC_EVT_VOLUME_CHANGE,
-#endif
-};
-
-#ifndef BTA_AVK_NUM_RC_EVT_IDS
-#define BTA_AVK_NUM_RC_EVT_IDS \
-  (sizeof(bta_avk_meta_caps_evt_ids) / sizeof(bta_avk_meta_caps_evt_ids[0]))
-#endif /* BTA_AVK_NUM_RC_EVT_IDS */
+const uint8_t* get_bta_avk_meta_caps_evt_ids() {
+  if (avrcp_absolute_volume_is_enabled()) {
+    static const uint8_t bta_avk_meta_caps_evt_ids[] = {
+        AVRC_EVT_VOLUME_CHANGE,
+    };
+    return bta_avk_meta_caps_evt_ids;
+  } else {
+    return {};
+  }
+}
 
 // These are the only events used with AVRCP1.3
 const uint8_t bta_av_meta_caps_evt_ids_avrcp13[] = {
@@ -113,7 +113,7 @@
 #define BTA_AV_NUM_RC_EVT_IDS_AVRCP13         \
   (sizeof(bta_av_meta_caps_evt_ids_avrcp13) / \
    sizeof(bta_av_meta_caps_evt_ids_avrcp13[0]))
-#endif /* BTA_AVK_NUM_RC_EVT_IDS_AVRCP13 */
+#endif /* BTA_AV_NUM_RC_EVT_IDS_AVRCP13 */
 
 /* This configuration to be used when we are Src + TG + CT( only for abs vol) */
 extern const tBTA_AV_CFG bta_av_cfg = {
@@ -136,23 +136,29 @@
 
 /* This configuration to be used when we are Sink + CT + TG( only for abs vol)
  */
-extern const tBTA_AV_CFG bta_avk_cfg = {
-    AVRC_CO_METADATA,   /* AVRCP Company ID */
-    BTA_AVK_RC_SUPF_CT, /* AVRCP controller categories */
-    BTA_AVK_RC_SUPF_TG, /* AVRCP target categories */
-    6,                  /* AVDTP audio channel max data queue size */
-    false,              /* true, to accept AVRC 1.3 group nevigation command */
-    2,                  /* company id count in p_meta_co_ids */
-    BTA_AVK_NUM_RC_EVT_IDS,    /* event id count in p_meta_evt_ids */
-    BTA_AV_RC_PASS_RSP_CODE,   /* the default response code for pass
-                                  through commands */
-    bta_av_meta_caps_co_ids,   /* the metadata Get Capabilities response
-                                  for company id */
-    bta_avk_meta_caps_evt_ids, /* the the metadata Get Capabilities
-                                  response for event id */
-    {0},                       /* Default AVRCP controller name */
-    {0},                       /* Default AVRCP target name */
-};
+
+const tBTA_AV_CFG* get_bta_avk_cfg() {
+  static const tBTA_AV_CFG bta_avk_cfg = {
+      AVRC_CO_METADATA,   /* AVRCP Company ID */
+      BTA_AVK_RC_SUPF_CT, /* AVRCP controller categories */
+      BTA_AVK_RC_SUPF_TG, /* AVRCP target categories */
+      6,                  /* AVDTP audio channel max data queue size */
+      false, /* true, to accept AVRC 1.3 group nevigation command */
+      2,     /* company id count in p_meta_co_ids */
+      (uint8_t)(avrcp_absolute_volume_is_enabled()
+                    ? 1
+                    : 0),              /* event id count in p_meta_evt_ids */
+      BTA_AV_RC_PASS_RSP_CODE,         /* the default response code for pass
+                                          through commands */
+      bta_av_meta_caps_co_ids,         /* the metadata Get Capabilities response
+                                          for company id */
+      get_bta_avk_meta_caps_evt_ids(), /* the metadata Get Capabilities response
+                                          for event id */
+      {0},                             /* Default AVRCP controller name */
+      {0},                             /* Default AVRCP target name */
+  };
+  return &bta_avk_cfg;
+}
 
 /* This configuration to be used when we are using AVRCP1.3 */
 extern const tBTA_AV_CFG bta_av_cfg_compatibility = {
diff --git a/system/bta/av/bta_av_int.h b/system/bta/av/bta_av_int.h
index 0b3e914..f50f5bc 100644
--- a/system/bta/av/bta_av_int.h
+++ b/system/bta/av/bta_av_int.h
@@ -114,7 +114,8 @@
   BTA_AV_AVDT_RPT_CONN_EVT,
   BTA_AV_API_START_EVT, /* the following 2 events must be in the same order as
                            the *AP_*EVT */
-  BTA_AV_API_STOP_EVT
+  BTA_AV_API_STOP_EVT,
+  BTA_AV_API_SET_LATENCY_EVT,
 };
 
 /* events for AV control block state machine */
@@ -126,13 +127,13 @@
 
 /* events that do not go through state machine */
 #define BTA_AV_FIRST_NSM_EVT BTA_AV_API_ENABLE_EVT
-#define BTA_AV_LAST_NSM_EVT BTA_AV_API_STOP_EVT
+#define BTA_AV_LAST_NSM_EVT BTA_AV_API_SET_LATENCY_EVT
 
 /* API events passed to both SSMs (by bta_av_api_to_ssm) */
 #define BTA_AV_FIRST_A2S_API_EVT BTA_AV_API_START_EVT
 #define BTA_AV_FIRST_A2S_SSM_EVT BTA_AV_AP_START_EVT
 
-#define BTA_AV_LAST_EVT BTA_AV_API_STOP_EVT
+#define BTA_AV_LAST_EVT BTA_AV_API_SET_LATENCY_EVT
 
 /* maximum number of SEPS in stream discovery results */
 #define BTA_AV_NUM_SEPS 32
@@ -264,6 +265,18 @@
   uint16_t uuid; /* uuid of initiator */
 } tBTA_AV_API_OPEN;
 
+/* data type for BTA_AV_API_SET_LATENCY_EVT */
+typedef struct {
+  BT_HDR_RIGID hdr;
+  bool is_low_latency;
+} tBTA_AV_API_SET_LATENCY;
+
+/* data type for BTA_AV_API_START_EVT and bta_av_do_start */
+typedef struct {
+  BT_HDR_RIGID hdr;
+  bool use_latency_mode;
+} tBTA_AV_DO_START;
+
 /* data type for BTA_AV_API_STOP_EVT */
 typedef struct {
   BT_HDR_RIGID hdr;
@@ -429,6 +442,8 @@
   tBTA_AV_API_ENABLE api_enable;
   tBTA_AV_API_REG api_reg;
   tBTA_AV_API_OPEN api_open;
+  tBTA_AV_API_SET_LATENCY api_set_latency;
+  tBTA_AV_DO_START do_start;
   tBTA_AV_API_STOP api_stop;
   tBTA_AV_API_DISCNT api_discnt;
   tBTA_AV_API_PROTECT_REQ api_protect_req;
@@ -675,7 +690,7 @@
 
 /* config struct */
 extern const tBTA_AV_CFG* p_bta_av_cfg;
-extern const tBTA_AV_CFG bta_avk_cfg;
+const tBTA_AV_CFG* get_bta_avk_cfg();
 extern const tBTA_AV_CFG bta_av_cfg;
 extern const tBTA_AV_CFG bta_av_cfg_compatibility;
 
@@ -724,6 +739,9 @@
 
 /* nsm action functions */
 extern void bta_av_api_disconnect(tBTA_AV_DATA* p_data);
+extern void bta_av_set_use_latency_mode(tBTA_AV_SCB* p_scb,
+                                        bool use_latency_mode);
+extern void bta_av_api_set_latency(tBTA_AV_DATA* p_data);
 extern void bta_av_sig_chg(tBTA_AV_DATA* p_data);
 extern void bta_av_signalling_timer(tBTA_AV_DATA* p_data);
 extern void bta_av_rc_disc_done(tBTA_AV_DATA* p_data);
diff --git a/system/bta/av/bta_av_main.cc b/system/bta/av/bta_av_main.cc
index d20c1c7..dfbd90d 100644
--- a/system/bta/av/bta_av_main.cc
+++ b/system/bta/av/bta_av_main.cc
@@ -432,7 +432,7 @@
 
   uint16_t profile_initialized = p_data->api_reg.service_uuid;
   if (profile_initialized == UUID_SERVCLASS_AUDIO_SINK) {
-    p_bta_av_cfg = &bta_avk_cfg;
+    p_bta_av_cfg = get_bta_avk_cfg();
   } else if (profile_initialized == UUID_SERVCLASS_AUDIO_SOURCE) {
     p_bta_av_cfg = &bta_av_cfg;
 
@@ -1105,6 +1105,9 @@
     case BTA_AV_API_DISCONNECT_EVT:
       bta_av_api_disconnect(p_data);
       break;
+    case BTA_AV_API_SET_LATENCY_EVT:
+      bta_av_api_set_latency(p_data);
+      break;
     case BTA_AV_CI_SRC_DATA_READY_EVT:
       bta_av_ci_data(p_data);
       break;
diff --git a/system/bta/csis/csis_client.cc b/system/bta/csis/csis_client.cc
index 9ae6450..d24c02c 100644
--- a/system/bta/csis/csis_client.cc
+++ b/system/bta/csis/csis_client.cc
@@ -236,7 +236,7 @@
       device->connecting_actively = true;
     }
 
-    BTA_GATTC_Open(gatt_if_, address, true, false);
+    BTA_GATTC_Open(gatt_if_, address, BTM_BLE_DIRECT_CONNECTION, false);
   }
 
   void Disconnect(const RawAddress& addr) override {
@@ -338,11 +338,16 @@
       }
 
       /* In case of GATT ERROR */
-      LOG(ERROR) << __func__ << " Incorrect write status "
-                 << loghex((int)(status));
+      LOG_ERROR("Incorrect write status=0x%02x", (int)(status));
 
       /* Unlock previous devices */
       HandleCsisLockProcedureError(csis_group, device);
+
+      if (status == GATT_DATABASE_OUT_OF_SYNC) {
+        LOG_INFO("Database out of sync for %s",
+                 device->addr.ToString().c_str());
+        ClearDeviceInformationAndStartSearch(device);
+      }
       return;
     }
 
@@ -525,6 +530,16 @@
     }
   }
 
+  int GetDesiredSize(int group_id) override {
+    auto csis_group = FindCsisGroup(group_id);
+    if (!csis_group) {
+      LOG_INFO("Unknown group %d", group_id);
+      return -1;
+    }
+
+    return csis_group->GetDesiredSize();
+  }
+
   bool SerializeSets(const RawAddress& addr, std::vector<uint8_t>& out) const {
     auto device = FindDeviceByAddress(addr);
     if (device == nullptr) {
@@ -644,7 +659,7 @@
     }
 
     if (autoconnect) {
-      BTA_GATTC_Open(gatt_if_, addr, false, false);
+      BTA_GATTC_Open(gatt_if_, addr, BTM_BLE_BKG_CONNECT_ALLOW_LIST, false);
     }
   }
 
@@ -829,6 +844,11 @@
       BtaGattQueue::Clean(conn_id);
       return;
     }
+
+    if (status == GATT_DATABASE_OUT_OF_SYNC) {
+      LOG_INFO("Database out of sync for %s", device->addr.ToString().c_str());
+      ClearDeviceInformationAndStartSearch(device);
+    }
   }
 
   void OnCsisNotification(uint16_t conn_id, uint16_t handle, uint16_t len,
@@ -945,13 +965,17 @@
       return;
     }
 
-    DLOG(INFO) << __func__ << " " << device->addr
-               << " status: " << loghex(+status);
+    LOG_DEBUG("%s, status: 0x%02x", device->addr.ToString().c_str(), status);
 
     if (status != GATT_SUCCESS) {
-      LOG(ERROR) << __func__ << " Could not read characteristic at handle="
-                 << loghex(handle);
-      BTA_GATTC_Close(device->conn_id);
+      if (status == GATT_DATABASE_OUT_OF_SYNC) {
+        LOG_INFO("Database out of sync for %s",
+                 device->addr.ToString().c_str());
+        ClearDeviceInformationAndStartSearch(device);
+      } else {
+        LOG_ERROR("Could not read characteristic at handle=0x%04x", handle);
+        BTA_GATTC_Close(device->conn_id);
+      }
       return;
     }
 
@@ -974,7 +998,11 @@
       return;
     }
 
-    csis_group->SetDesiredSize(value[0]);
+    auto new_size = value[0];
+    csis_group->SetDesiredSize(new_size);
+    if (new_size > csis_group->GetCurrentSize()) {
+      CsisActiveDiscovery(csis_group);
+    }
   }
 
   void OnCsisLockReadRsp(uint16_t conn_id, tGATT_STATUS status, uint16_t handle,
@@ -985,13 +1013,17 @@
       return;
     }
 
-    LOG(INFO) << __func__ << " " << device->addr
-              << " status: " << loghex(+status);
+    LOG_INFO("%s, status 0x%02x", device->addr.ToString().c_str(), status);
 
     if (status != GATT_SUCCESS) {
-      LOG(ERROR) << __func__ << " Could not read characteristic at handle="
-                 << loghex(handle);
-      BTA_GATTC_Close(device->conn_id);
+      if (status == GATT_DATABASE_OUT_OF_SYNC) {
+        LOG_INFO("Database out of sync for %s",
+                 device->addr.ToString().c_str());
+        ClearDeviceInformationAndStartSearch(device);
+      } else {
+        LOG_ERROR("Could not read characteristic at handle=0x%04x", handle);
+        BTA_GATTC_Close(device->conn_id);
+      }
       return;
     }
 
@@ -1020,13 +1052,18 @@
       return;
     }
 
-    DLOG(INFO) << __func__ << " " << device->addr
-               << " status: " << loghex(+status) << " rank:" << int(value[0]);
+    LOG_DEBUG("%s, status: 0x%02x, rank: %d", device->addr.ToString().c_str(),
+              status, value[0]);
 
     if (status != GATT_SUCCESS) {
-      LOG(ERROR) << __func__ << " Could not read characteristic at handle="
-                 << loghex(handle);
-      BTA_GATTC_Close(device->conn_id);
+      if (status == GATT_DATABASE_OUT_OF_SYNC) {
+        LOG_INFO("Database out of sync for %s",
+                 device->addr.ToString().c_str());
+        ClearDeviceInformationAndStartSearch(device);
+      } else {
+        LOG_ERROR("Could not read characteristic at handle=0x%04x", handle);
+        BTA_GATTC_Close(device->conn_id);
+      }
       return;
     }
 
@@ -1117,14 +1154,14 @@
   std::vector<RawAddress> GetAllRsiFromAdvertising(
       const tBTA_DM_INQ_RES* result) {
     const uint8_t* p_service_data = result->p_eir;
-    uint16_t remaining_data_len = result->eir_len;
     std::vector<RawAddress> devices;
     uint8_t service_data_len = 0;
 
     while ((p_service_data = AdvertiseDataParser::GetFieldByType(
                 p_service_data + service_data_len,
-                (remaining_data_len -= service_data_len), BTM_BLE_AD_TYPE_RSI,
-                &service_data_len))) {
+                result->eir_len - (p_service_data - result->p_eir) -
+                    service_data_len,
+                BTM_BLE_AD_TYPE_RSI, &service_data_len))) {
       RawAddress bda;
       STREAM_TO_BDADDR(bda, p_service_data);
       devices.push_back(std::move(bda));
@@ -1169,9 +1206,16 @@
   }
 
   void CsisActiveObserverSet(bool enable) {
-    LOG(INFO) << __func__ << " CSIS Discovery SET: " << enable;
+    bool is_ad_type_filter_supported =
+        bluetooth::shim::is_ad_type_filter_supported();
+    LOG_INFO("CSIS Discovery SET: %d, is_ad_type_filter_supported: %d", enable,
+             is_ad_type_filter_supported);
+    if (is_ad_type_filter_supported) {
+      bluetooth::shim::set_ad_type_rsi_filter(enable);
+    } else {
+      bluetooth::shim::set_empty_filter(enable);
+    }
 
-    bluetooth::shim::set_empty_filter(enable);
     BTA_DmBleCsisObserve(
         enable, [](tBTA_DM_SEARCH_EVT event, tBTA_DM_SEARCH* p_data) {
           /* If there's no instance we are most likely shutting
@@ -1203,7 +1247,31 @@
     }
   }
 
+  void CheckForGroupInInqDb(const std::shared_ptr<CsisGroup>& csis_group) {
+    // Check if last inquiry already found devices with RSI matching this group
+    for (tBTM_INQ_INFO* inq_ent = BTM_InqDbFirst(); inq_ent != nullptr;
+         inq_ent = BTM_InqDbNext(inq_ent)) {
+      RawAddress rsi = inq_ent->results.ble_ad_rsi;
+      if (!csis_group->IsRsiMatching(rsi)) continue;
+
+      RawAddress address = inq_ent->results.remote_bd_addr;
+      auto device = FindDeviceByAddress(address);
+      if (device && csis_group->IsDeviceInTheGroup(device)) {
+        // InqDb will also contain existing devices, already in group - skip
+        // them
+        continue;
+      }
+
+      LOG_INFO("Device %s from inquiry cache match to group id %d",
+               address.ToString().c_str(), csis_group->GetGroupId());
+      callbacks_->OnSetMemberAvailable(address, csis_group->GetGroupId());
+      break;
+    }
+  }
+
   void CsisActiveDiscovery(std::shared_ptr<CsisGroup> csis_group) {
+    CheckForGroupInInqDb(csis_group);
+
     if ((csis_group->GetDiscoveryState() !=
          CsisDiscoveryState::CSIS_DISCOVERY_IDLE)) {
       LOG(ERROR) << __func__
@@ -1224,7 +1292,7 @@
 
     auto csis_device = FindDeviceByAddress(result->bd_addr);
     if (csis_device) {
-      DLOG(INFO) << __func__ << " Drop same device .." << result->bd_addr;
+      LOG_DEBUG("Drop known device %s", result->bd_addr.ToString().c_str());
       return;
     }
 
@@ -1235,8 +1303,15 @@
     for (auto& group : csis_groups_) {
       for (auto& rsi : all_rsi) {
         if (group->IsRsiMatching(rsi)) {
-          DLOG(INFO) << " Found set member in background scan "
-                     << result->bd_addr;
+          LOG_INFO("Device %s match to group id %d",
+                   result->bd_addr.ToString().c_str(), group->GetGroupId());
+          if (group->GetDesiredSize() > 0 &&
+              (group->GetCurrentSize() == group->GetDesiredSize())) {
+            LOG_WARN(
+                "Group is already completed. Some other device use same SIRK");
+            break;
+          }
+
           callbacks_->OnSetMemberAvailable(result->bd_addr,
                                            group->GetGroupId());
           break;
@@ -1281,17 +1356,21 @@
       return;
     }
 
-    DLOG(INFO) << __func__ << " " << device->addr
-               << " status: " << loghex(+status);
+    LOG_DEBUG("%s, status: 0x%02x", device->addr.ToString().c_str(), status);
 
     if (status != GATT_SUCCESS) {
       /* TODO handle error codes:
        * kCsisErrorCodeLockAccessSirkRejected
        * kCsisErrorCodeLockOobSirkOnly
        */
-      LOG(ERROR) << __func__ << " Could not read characteristic at handle="
-                 << loghex(handle);
-      BTA_GATTC_Close(device->conn_id);
+      if (status == GATT_DATABASE_OUT_OF_SYNC) {
+        LOG_INFO("Database out of sync for %s",
+                 device->addr.ToString().c_str());
+        ClearDeviceInformationAndStartSearch(device);
+      } else {
+        LOG_ERROR("Could not read characteristic at handle=0x%04x", handle);
+        BTA_GATTC_Close(device->conn_id);
+      }
       return;
     }
 
@@ -1386,9 +1465,7 @@
       CsisActiveDiscovery(csis_group);
   }
 
-  void DoDisconnectCleanUp(std::shared_ptr<CsisDevice> device) {
-    DLOG(INFO) << __func__ << ": device=" << device->addr;
-
+  void DeregisterNotifications(std::shared_ptr<CsisDevice> device) {
     device->ForEachCsisInstance(
         [&](const std::shared_ptr<CsisInstance>& csis_inst) {
           DisableGattNotification(device->conn_id, device->addr,
@@ -1398,6 +1475,12 @@
           DisableGattNotification(device->conn_id, device->addr,
                                   csis_inst->svc_data.size_handle.val_hdl);
         });
+  }
+
+  void DoDisconnectCleanUp(std::shared_ptr<CsisDevice> device) {
+    LOG_INFO("%s", device->addr.ToString().c_str());
+
+    DeregisterNotifications(device);
 
     if (device->IsConnected()) {
       BtaGattQueue::Clean(device->conn_id);
@@ -1793,6 +1876,22 @@
     }
   }
 
+  void ClearDeviceInformationAndStartSearch(
+      std::shared_ptr<CsisDevice> device) {
+    LOG_INFO("%s ", device->addr.ToString().c_str());
+    if (device->is_gatt_service_valid == false) {
+      LOG_DEBUG("Device database already invalidated.");
+      return;
+    }
+
+    /* Invalidate service discovery results */
+    BtaGattQueue::Clean(device->conn_id);
+    device->first_connection = true;
+    DeregisterNotifications(device);
+    device->ClearSvcData();
+    BTA_GATTC_ServiceSearchRequest(device->conn_id, &kCsisServiceUuid);
+  }
+
   void OnGattServiceChangeEvent(const RawAddress& address) {
     auto device = FindDeviceByAddress(address);
     if (!device) {
@@ -1800,12 +1899,8 @@
       return;
     }
 
-    DLOG(INFO) << __func__ << ": address=" << address;
-
-    /* Invalidate service discovery results */
-    BtaGattQueue::Clean(device->conn_id);
-    device->first_connection = true;
-    device->ClearSvcData();
+    LOG_INFO("%s", address.ToString().c_str());
+    ClearDeviceInformationAndStartSearch(device);
   }
 
   void OnGattServiceDiscoveryDoneEvent(const RawAddress& address) {
diff --git a/system/bta/csis/csis_client_test.cc b/system/bta/csis/csis_client_test.cc
index 95aad31..b7ca1db 100644
--- a/system/bta/csis/csis_client_test.cc
+++ b/system/bta/csis/csis_client_test.cc
@@ -426,7 +426,8 @@
         .WillByDefault(
             DoAll(SetArgPointee<1>(BTM_SEC_FLAG_ENCRYPTED), Return(true)));
 
-    EXPECT_CALL(gatt_interface, Open(gatt_if, address, true, _));
+    EXPECT_CALL(gatt_interface,
+                Open(gatt_if, address, BTM_BLE_DIRECT_CONNECTION, _));
     CsisClient::Get()->Connect(address);
     Mock::VerifyAndClearExpectations(&gatt_interface);
     Mock::VerifyAndClearExpectations(&btm_interface);
@@ -449,7 +450,8 @@
                 OnConnectionState(address, ConnectionState::CONNECTED))
         .Times(1);
     EXPECT_CALL(*callbacks, OnDeviceAvailable(address, _, _, _, _)).Times(1);
-    EXPECT_CALL(gatt_interface, Open(gatt_if, address, false, _))
+    EXPECT_CALL(gatt_interface,
+                Open(gatt_if, address, BTM_BLE_BKG_CONNECT_ALLOW_LIST, _))
         .WillOnce(Invoke([this, conn_id](tGATT_IF client_if,
                                          const RawAddress& remote_bda,
                                          bool is_direct, bool opportunistic) {
@@ -758,13 +760,7 @@
   ASSERT_FALSE(g_1->IsEmpty());
 }
 
-TEST_F(CsisClientTest, test_set_desired_size) {
-  auto g_1 = std::make_shared<CsisGroup>(666, bluetooth::Uuid::kEmpty);
-  g_1->SetDesiredSize(10);
-  ASSERT_EQ((int)sizeof(g_1), 16);
-}
-
-TEST_F(CsisClientTest, test_get_desired_size) {
+TEST_F(CsisClientTest, test_get_set_desired_size) {
   auto g_1 = std::make_shared<CsisGroup>(666, bluetooth::Uuid::kEmpty);
   g_1->SetDesiredSize(10);
   ASSERT_EQ(g_1->GetDesiredSize(), 10);
@@ -1128,6 +1124,42 @@
   TestAppUnregister();
 }
 
+TEST_F(CsisClientTest, test_database_out_of_sync) {
+  auto test_address = GetTestAddress(0);
+  auto conn_id = 1;
+
+  TestAppRegister();
+  SetSampleDatabaseCsis(conn_id, 1);
+  TestConnect(test_address);
+  InjectConnectedEvent(test_address, conn_id);
+  GetSearchCompleteEvent(conn_id);
+  ASSERT_EQ(1, CsisClient::Get()->GetGroupId(
+                   test_address, bluetooth::Uuid::From16Bit(0x0000)));
+
+  // Simulated database changed on the remote side.
+  ON_CALL(gatt_queue, WriteCharacteristic(_, _, _, _, _, _))
+      .WillByDefault(
+          Invoke([this](uint16_t conn_id, uint16_t handle,
+                        std::vector<uint8_t> value, tGATT_WRITE_TYPE write_type,
+                        GATT_WRITE_OP_CB cb, void* cb_data) {
+            auto* svc = gatt::FindService(services_map[conn_id], handle);
+            if (svc == nullptr) return;
+
+            tGATT_STATUS status = GATT_DATABASE_OUT_OF_SYNC;
+            if (cb)
+              cb(conn_id, status, handle, value.size(), value.data(), cb_data);
+          }));
+
+  ON_CALL(gatt_interface, ServiceSearchRequest(_, _)).WillByDefault(Return());
+  EXPECT_CALL(gatt_interface, ServiceSearchRequest(_, _));
+  CsisClient::Get()->LockGroup(
+      1, true,
+      base::BindOnce([](int group_id, bool locked, CsisGroupLockStatus status) {
+        csis_lock_callback_mock->CsisGroupLockCb(group_id, locked, status);
+      }));
+  TestAppUnregister();
+}
+
 }  // namespace
 }  // namespace internal
 }  // namespace csis
diff --git a/system/bta/csis/csis_types.h b/system/bta/csis/csis_types.h
index 466a1d4..75783a4 100644
--- a/system/bta/csis/csis_types.h
+++ b/system/bta/csis/csis_types.h
@@ -64,7 +64,7 @@
 
 /* CSIS Types */
 static constexpr uint8_t kDefaultScanDurationS = 5;
-static constexpr uint8_t kDefaultCsisSetSize = 2;
+static constexpr uint8_t kDefaultCsisSetSize = 1;
 static constexpr uint8_t kUnknownRank = 0xff;
 
 /* Enums */
diff --git a/system/bta/dm/bta_dm_act.cc b/system/bta/dm/bta_dm_act.cc
index 477702b..0ad1e18 100644
--- a/system/bta/dm/bta_dm_act.cc
+++ b/system/bta/dm/bta_dm_act.cc
@@ -26,6 +26,9 @@
 #define LOG_TAG "bt_bta_dm"
 
 #include <base/logging.h>
+#ifdef OS_ANDROID
+#include <bta.sysprop.h>
+#endif
 
 #include <cstdint>
 
@@ -38,6 +41,7 @@
 #include "btif/include/stack_manager.h"
 #include "device/include/controller.h"
 #include "device/include/interop.h"
+#include "gd/common/init_flags.h"
 #include "main/shim/acl_api.h"
 #include "main/shim/btm_api.h"
 #include "main/shim/dumpsys.h"
@@ -47,6 +51,7 @@
 #include "osi/include/fixed_queue.h"
 #include "osi/include/log.h"
 #include "osi/include/osi.h"
+#include "osi/include/properties.h"
 #include "stack/btm/btm_ble_int.h"
 #include "stack/btm/btm_dev.h"
 #include "stack/btm/btm_sec.h"
@@ -87,7 +92,8 @@
 static uint8_t bta_dm_new_link_key_cback(const RawAddress& bd_addr,
                                          DEV_CLASS dev_class,
                                          tBTM_BD_NAME bd_name,
-                                         const LinkKey& key, uint8_t key_type);
+                                         const LinkKey& key, uint8_t key_type,
+                                         bool is_ctkd);
 static void bta_dm_authentication_complete_cback(const RawAddress& bd_addr,
                                                  DEV_CLASS dev_class,
                                                  tBTM_BD_NAME bd_name,
@@ -154,16 +160,18 @@
 #define BTA_DM_SWITCH_DELAY_TIMER_MS 500
 #endif
 
-namespace {
-
 // Time to wait after receiving shutdown request to delay the actual shutdown
 // process. This time may be zero which invokes immediate shutdown.
-#ifndef BTA_DISABLE_DELAY
-constexpr uint64_t kDisableDelayTimerInMs = 0;
+static uint64_t get_DisableDelayTimerInMs() {
+#ifndef OS_ANDROID
+  return 200;
 #else
-constexpr uint64_t kDisableDelayTimerInMs =
-    static_cast<uint64_t>(BTA_DISABLE_DELAY);
+  static const uint64_t kDisableDelayTimerInMs =
+      android::sysprop::bluetooth::Bta::disable_delay().value_or(200);
+  return kDisableDelayTimerInMs;
 #endif
+}
+namespace {
 
 struct WaitForAllAclConnectionsToDrain {
   uint64_t time_to_wait_in_ms;
@@ -350,8 +358,10 @@
    * graceful shutdown.
    */
   bta_dm_search_cb.search_timer = alarm_new("bta_dm_search.search_timer");
+  bool delay_close_gatt =
+      osi_property_get_bool("bluetooth.gatt.delay_close.enabled", true);
   bta_dm_search_cb.gatt_close_timer =
-      alarm_new("bta_dm_search.gatt_close_timer");
+      delay_close_gatt ? alarm_new("bta_dm_search.gatt_close_timer") : nullptr;
   bta_dm_search_cb.pending_discovery_queue = fixed_queue_new(SIZE_MAX);
 
   memset(&bta_dm_conn_srvcs, 0, sizeof(bta_dm_conn_srvcs));
@@ -445,15 +455,15 @@
 
   if (BTM_GetNumAclLinks() == 0) {
     // We can shut down faster if there are no ACL links
-    switch (kDisableDelayTimerInMs) {
+    switch (get_DisableDelayTimerInMs()) {
       case 0:
         LOG_DEBUG("Immediately disabling device manager");
         bta_dm_disable_conn_down_timer_cback(nullptr);
         break;
       default:
         LOG_DEBUG("Set timer to delay disable initiation:%lu ms",
-                  static_cast<unsigned long>(kDisableDelayTimerInMs));
-        alarm_set_on_mloop(bta_dm_cb.disable_timer, kDisableDelayTimerInMs,
+                  static_cast<unsigned long>(get_DisableDelayTimerInMs()));
+        alarm_set_on_mloop(bta_dm_cb.disable_timer, get_DisableDelayTimerInMs(),
                            bta_dm_disable_conn_down_timer_cback, nullptr);
     }
   } else {
@@ -626,6 +636,15 @@
   if (other_address == bd_addr) other_address = other_address2;
 
   if (other_address_connected) {
+    // Get real transport
+    if (other_transport == BT_TRANSPORT_AUTO) {
+      bool connected_with_br_edr =
+          BTM_IsAclConnectionUp(other_address, BT_TRANSPORT_BR_EDR);
+      other_transport =
+          connected_with_br_edr ? BT_TRANSPORT_BR_EDR : BT_TRANSPORT_LE;
+    }
+    LOG_INFO("other_address %s with transport %d connected",
+             PRIVATE_ADDRESS(other_address), other_transport);
     /* Take the link down first, and mark the device for removal when
      * disconnected */
     for (int i = 0; i < bta_dm_cb.device_list.count; i++) {
@@ -633,6 +652,7 @@
       if (peer_device.peer_bdaddr == other_address &&
           peer_device.transport == other_transport) {
         peer_device.conn_state = BTA_DM_UNPAIRING;
+        LOG_INFO("Remove ACL of address %s", PRIVATE_ADDRESS(other_address));
 
         /* Make sure device is not in acceptlist before we disconnect */
         GATT_CancelConnect(0, bd_addr, false);
@@ -905,6 +925,10 @@
   bta_dm_search_cb.transport = p_data->discover.transport;
 
   bta_dm_search_cb.name_discover_done = false;
+
+  LOG_INFO("bta_dm_discovery: starting service discovery to %s , transport: %s",
+           PRIVATE_ADDRESS(p_data->discover.bd_addr),
+           bt_transport_text(p_data->discover.transport).c_str());
   bta_dm_discover_device(p_data->discover.bd_addr);
 }
 
@@ -1126,7 +1150,8 @@
                   BD_NAME_LEN + 1);
 
           result.disc_ble_res.services = &gatt_uuids;
-          bta_dm_search_cb.p_search_cback(BTA_DM_DISC_BLE_RES_EVT, &result);
+          bta_dm_search_cb.p_search_cback(BTA_DM_GATT_OVER_SDP_RES_EVT,
+                                          &result);
         }
       } else {
         /* SDP_DB_FULL means some records with the
@@ -1283,45 +1308,57 @@
 
   uint16_t conn_id = bta_dm_search_cb.conn_id;
 
-  /* no BLE connection, i.e. Classic service discovery end */
-  if (conn_id == GATT_INVALID_CONN_ID) {
-    bta_dm_search_cb.p_search_cback(BTA_DM_DISC_CMPL_EVT, nullptr);
-    bta_dm_execute_queued_request();
-    return;
-  }
-
-  btgatt_db_element_t* db = NULL;
-  int count = 0;
-  BTA_GATTC_GetGattDb(conn_id, 0x0000, 0xFFFF, &db, &count);
-
-  if (count == 0) {
-    LOG_INFO("Empty GATT database - no BLE services discovered");
-    bta_dm_search_cb.p_search_cback(BTA_DM_DISC_CMPL_EVT, nullptr);
-    bta_dm_execute_queued_request();
-    return;
-  }
-
-  std::vector<Uuid> gatt_services;
-
-  for (int i = 0; i < count; i++) {
-    // we process service entries only
-    if (db[i].type == BTGATT_DB_PRIMARY_SERVICE) {
-      gatt_services.push_back(db[i].uuid);
-    }
-  }
-  osi_free(db);
-
   tBTA_DM_SEARCH result;
+  std::vector<Uuid> gatt_services;
   result.disc_ble_res.services = &gatt_services;
   result.disc_ble_res.bd_addr = bta_dm_search_cb.peer_bdaddr;
   strlcpy((char*)result.disc_ble_res.bd_name, (char*)bta_dm_search_cb.peer_name,
           BD_NAME_LEN + 1);
 
-  LOG_INFO("GATT services discovered using LE Transport");
+  bool send_gatt_results =
+      bluetooth::common::init_flags::
+              always_send_services_if_gatt_disc_done_is_enabled()
+          ? bta_dm_search_cb.gatt_disc_active
+          : false;
+
+  /* no BLE connection, i.e. Classic service discovery end */
+  if (conn_id == GATT_INVALID_CONN_ID) {
+    if (bta_dm_search_cb.gatt_disc_active) {
+      LOG_WARN(
+          "GATT active but no BLE connection, likely disconnected midway "
+          "through");
+    } else {
+      LOG_INFO("No BLE connection, processing classic results");
+    }
+  } else {
+    btgatt_db_element_t* db = NULL;
+    int count = 0;
+    BTA_GATTC_GetGattDb(conn_id, 0x0000, 0xFFFF, &db, &count);
+    if (count != 0) {
+      for (int i = 0; i < count; i++) {
+        // we process service entries only
+        if (db[i].type == BTGATT_DB_PRIMARY_SERVICE) {
+          gatt_services.push_back(db[i].uuid);
+        }
+      }
+      osi_free(db);
+      LOG_INFO(
+          "GATT services discovered using LE Transport, will always send to "
+          "upper layer");
+      send_gatt_results = true;
+    } else {
+      LOG_WARN("Empty GATT database - no BLE services discovered");
+    }
+  }
+
   // send all result back to app
-  bta_dm_search_cb.p_search_cback(BTA_DM_DISC_BLE_RES_EVT, &result);
+  if (send_gatt_results) {
+    LOG_INFO("Sending GATT results to upper layer");
+    bta_dm_search_cb.p_search_cback(BTA_DM_GATT_OVER_LE_RES_EVT, &result);
+  }
 
   bta_dm_search_cb.p_search_cback(BTA_DM_DISC_CMPL_EVT, nullptr);
+  bta_dm_search_cb.gatt_disc_active = false;
 
   bta_dm_execute_queued_request();
 }
@@ -1339,10 +1376,15 @@
 void bta_dm_disc_result(tBTA_DM_MSG* p_data) {
   APPL_TRACE_EVENT("%s", __func__);
 
+  /* disc_res.device_type is set only when GATT discovery is finished in
+   * bta_dm_gatt_disc_complete */
+  bool is_gatt_over_ble = ((p_data->disc_result.result.disc_res.device_type &
+                            BT_DEVICE_TYPE_BLE) != 0);
+
   /* if any BR/EDR service discovery has been done, report the event */
-  if ((bta_dm_search_cb.services &
-       ((BTA_ALL_SERVICE_MASK | BTA_USER_SERVICE_MASK) &
-        ~BTA_BLE_SERVICE_MASK)))
+  if (!is_gatt_over_ble && (bta_dm_search_cb.services &
+                            ((BTA_ALL_SERVICE_MASK | BTA_USER_SERVICE_MASK) &
+                             ~BTA_BLE_SERVICE_MASK)))
     bta_dm_search_cb.p_search_cback(BTA_DM_DISC_RES_EVT,
                                     &p_data->disc_result.result);
 
@@ -1445,6 +1487,9 @@
   tBTA_DM_MSG* p_pending_discovery =
       (tBTA_DM_MSG*)osi_malloc(sizeof(tBTA_DM_API_DISCOVER));
   memcpy(p_pending_discovery, p_data, sizeof(tBTA_DM_API_DISCOVER));
+
+  LOG_INFO("bta_dm_discovery: queuing service discovery to %s",
+           p_pending_discovery->discover.bd_addr.ToString().c_str());
   fixed_queue_enqueue(bta_dm_search_cb.pending_discovery_queue,
                       p_pending_discovery);
 }
@@ -1497,7 +1542,10 @@
  ******************************************************************************/
 void bta_dm_search_clear_queue() {
   osi_free_and_reset((void**)&bta_dm_search_cb.p_pending_search);
-  fixed_queue_flush(bta_dm_search_cb.pending_discovery_queue, osi_free);
+  if (bluetooth::common::InitFlags::
+          IsBtmDmFlushDiscoveryQueueOnSearchCancel()) {
+    fixed_queue_flush(bta_dm_search_cb.pending_discovery_queue, osi_free);
+  }
 }
 
 /*******************************************************************************
@@ -1686,6 +1734,14 @@
     /* Do not perform RNR for LE devices at inquiry complete*/
     bta_dm_search_cb.name_discover_done = true;
   }
+  // If we already have the name we can skip getting the name
+  if (BTM_IsRemoteNameKnown(remote_bd_addr, transport) &&
+      bluetooth::common::init_flags::sdp_skip_rnr_if_known_is_enabled()) {
+    LOG_DEBUG("Security record already known skipping read remote name peer:%s",
+              PRIVATE_ADDRESS(remote_bd_addr));
+    bta_dm_search_cb.name_discover_done = true;
+  }
+
   /* if name discovery is not done and application needs remote name */
   if ((!bta_dm_search_cb.name_discover_done) &&
       ((bta_dm_search_cb.p_btm_inq_info == NULL) ||
@@ -1737,6 +1793,8 @@
 
       if (transport == BT_TRANSPORT_LE) {
         if (bta_dm_search_cb.services_to_search & BTA_BLE_SERVICE_MASK) {
+          LOG_INFO("bta_dm_discovery: starting GATT discovery on %s",
+                   PRIVATE_ADDRESS(bta_dm_search_cb.peer_bdaddr));
           // set the raw data buffer here
           memset(g_disc_raw_data_buf, 0, sizeof(g_disc_raw_data_buf));
           /* start GATT for service discovery */
@@ -1744,6 +1802,8 @@
           return;
         }
       } else {
+        LOG_INFO("bta_dm_discovery: starting SDP discovery on %s",
+                 PRIVATE_ADDRESS(bta_dm_search_cb.peer_bdaddr));
         bta_dm_search_cb.sdp_results = false;
         bta_dm_find_services(bta_dm_search_cb.peer_bdaddr);
         return;
@@ -1820,6 +1880,8 @@
   result.inq_res.p_eir = const_cast<uint8_t*>(p_eir);
   result.inq_res.eir_len = eir_len;
 
+  result.inq_res.ble_evt_type = p_inq->ble_evt_type;
+
   p_inq_info = BTM_InqDbRead(p_inq->remote_bd_addr);
   if (p_inq_info != NULL) {
     /* initialize remt_name_not_required to false so that we get the name by
@@ -1865,7 +1927,7 @@
 static void bta_dm_service_search_remname_cback(const RawAddress& bd_addr,
                                                 UNUSED_ATTR DEV_CLASS dc,
                                                 tBTM_BD_NAME bd_name) {
-  tBTM_REMOTE_DEV_NAME rem_name;
+  tBTM_REMOTE_DEV_NAME rem_name = {};
   tBTM_STATUS btm_status;
 
   APPL_TRACE_DEBUG("%s name=<%s>", __func__, bd_name);
@@ -1879,7 +1941,7 @@
       rem_name.length = BD_NAME_LEN;
     }
     rem_name.status = BTM_SUCCESS;
-
+    rem_name.hci_status = HCI_SUCCESS;
     bta_dm_remname_cback(&rem_name);
   } else {
     /* get name of device */
@@ -1900,6 +1962,7 @@
       rem_name.length = 0;
       rem_name.remote_bd_name[0] = 0;
       rem_name.status = btm_status;
+      rem_name.hci_status = HCI_SUCCESS;
       bta_dm_remname_cback(&rem_name);
     }
   }
@@ -1927,11 +1990,28 @@
       BTM_SecDeleteRmtNameNotifyCallback(&bta_dm_service_search_remname_cback);
     }
   } else {
-    // if we got a different response, ignore it
+    // if we got a different response, maybe ignore it
     // we will have made a request directly from BTM_ReadRemoteDeviceName so we
     // expect a dedicated response for us
-    LOG_INFO("ignoring remote name response in DM callback since it's for the wrong bd_addr");
-    return;
+    if (p_remote_name->hci_status == HCI_ERR_CONNECTION_EXISTS) {
+      if (bluetooth::shim::is_gd_security_enabled()) {
+        bluetooth::shim::BTM_SecDeleteRmtNameNotifyCallback(
+            &bta_dm_service_search_remname_cback);
+      } else {
+        BTM_SecDeleteRmtNameNotifyCallback(
+            &bta_dm_service_search_remname_cback);
+      }
+      LOG_INFO(
+          "Assume command failed due to disconnection hci_status:%s peer:%s",
+          hci_error_code_text(p_remote_name->hci_status).c_str(),
+          PRIVATE_ADDRESS(p_remote_name->bd_addr));
+    } else {
+      LOG_INFO(
+          "Ignored remote name response for the wrong address exp:%s act:%s",
+          PRIVATE_ADDRESS(bta_dm_search_cb.peer_bdaddr),
+          PRIVATE_ADDRESS(p_remote_name->bd_addr));
+      return;
+    }
   }
 
   /* remote name discovery is done but it could be failed */
@@ -2065,7 +2145,8 @@
 static uint8_t bta_dm_new_link_key_cback(const RawAddress& bd_addr,
                                          UNUSED_ATTR DEV_CLASS dev_class,
                                          tBTM_BD_NAME bd_name,
-                                         const LinkKey& key, uint8_t key_type) {
+                                         const LinkKey& key, uint8_t key_type,
+                                         bool is_ctkd) {
   tBTA_DM_SEC sec_event;
   tBTA_DM_AUTH_CMPL* p_auth_cmpl;
   tBTA_DM_SEC_EVT event = BTA_DM_AUTH_CMPL_EVT;
@@ -2082,6 +2163,8 @@
   p_auth_cmpl->key_type = key_type;
   p_auth_cmpl->success = true;
   p_auth_cmpl->key = key;
+  p_auth_cmpl->is_ctkd = is_ctkd;
+
   sec_event.auth_cmpl.fail_reason = HCI_SUCCESS;
 
   // Report the BR link key based on the BR/EDR address and type
@@ -3613,7 +3696,8 @@
                 (static_cast<uint8_t>(p_data->complt.reason))));
 
         if (btm_sec_is_a_bonded_dev(bda) &&
-            p_data->complt.reason == SMP_CONN_TOUT) {
+            p_data->complt.reason == SMP_CONN_TOUT &&
+            !p_data->complt.smp_over_br) {
           // Bonded device failed to encrypt - to test this remove battery from
           // HID device right after connection, but before encryption is
           // established
@@ -3936,13 +4020,26 @@
   bta_sys_sendmsg(p_msg);
 
   if (conn_id != GATT_INVALID_CONN_ID) {
-    /* start a GATT channel close delay timer */
-    bta_sys_start_timer(bta_dm_search_cb.gatt_close_timer,
-                        BTA_DM_GATT_CLOSE_DELAY_TOUT,
-                        BTA_DM_DISC_CLOSE_TOUT_EVT, 0);
     bta_dm_search_cb.pending_close_bda = bta_dm_search_cb.peer_bdaddr;
+    // Gatt will be close immediately if bluetooth.gatt.delay_close.enabled is
+    // set to false. If property is true / unset there will be a delay
+    if (bta_dm_search_cb.gatt_close_timer != nullptr) {
+      /* start a GATT channel close delay timer */
+      bta_sys_start_timer(bta_dm_search_cb.gatt_close_timer,
+                          BTA_DM_GATT_CLOSE_DELAY_TOUT,
+                          BTA_DM_DISC_CLOSE_TOUT_EVT, 0);
+    } else {
+      p_msg = (tBTA_DM_MSG*)osi_malloc(sizeof(tBTA_DM_MSG));
+      p_msg->hdr.event = BTA_DM_DISC_CLOSE_TOUT_EVT;
+      p_msg->hdr.layer_specific = 0;
+      bta_sys_sendmsg(p_msg);
+    }
+  } else {
+    if (bluetooth::common::init_flags::
+            bta_dm_clear_conn_id_on_client_close_is_enabled()) {
+      bta_dm_search_cb.conn_id = GATT_INVALID_CONN_ID;
+    }
   }
-  bta_dm_search_cb.gatt_disc_active = false;
 }
 
 /*******************************************************************************
@@ -3983,9 +4080,11 @@
     BTA_GATTC_ServiceSearchRequest(bta_dm_search_cb.conn_id, nullptr);
   } else {
     if (BTM_IsAclConnectionUp(bd_addr, BT_TRANSPORT_LE)) {
-      BTA_GATTC_Open(bta_dm_search_cb.client_if, bd_addr, true, true);
+      BTA_GATTC_Open(bta_dm_search_cb.client_if, bd_addr,
+                     BTM_BLE_DIRECT_CONNECTION, true);
     } else {
-      BTA_GATTC_Open(bta_dm_search_cb.client_if, bd_addr, true, false);
+      BTA_GATTC_Open(bta_dm_search_cb.client_if, bd_addr,
+                     BTM_BLE_DIRECT_CONNECTION, false);
     }
   }
 }
@@ -4071,7 +4170,8 @@
       break;
 
     case BTA_GATTC_CLOSE_EVT:
-      LOG_DEBUG("BTA_GATTC_CLOSE_EVT reason = %d", p_data->close.reason);
+      LOG_INFO("BTA_GATTC_CLOSE_EVT reason = %d", p_data->close.reason);
+
       /* in case of disconnect before search is completed */
       if ((bta_dm_search_cb.state != BTA_DM_SEARCH_IDLE) &&
           (bta_dm_search_cb.state != BTA_DM_SEARCH_ACTIVE) &&
@@ -4127,6 +4227,8 @@
   return ::allocate_device_for(bd_addr, transport);
 }
 
+void bta_dm_remname_cback(void* p) { ::bta_dm_remname_cback(p); }
+
 }  // namespace testing
 }  // namespace legacy
 }  // namespace bluetooth
diff --git a/system/bta/dm/bta_dm_api.cc b/system/bta/dm/bta_dm_api.cc
index eded208..0703594 100644
--- a/system/bta/dm/bta_dm_api.cc
+++ b/system/bta/dm/bta_dm_api.cc
@@ -689,3 +689,14 @@
   APPL_TRACE_API("BTA_DmBleResetId");
   do_in_main_thread(FROM_HERE, base::Bind(bta_dm_ble_reset_id));
 }
+
+bool BTA_DmCheckLeAudioCapable(const RawAddress& address) {
+  for (tBTM_INQ_INFO* inq_ent = BTM_InqDbFirst(); inq_ent != nullptr;
+       inq_ent = BTM_InqDbNext(inq_ent)) {
+    if (inq_ent->results.remote_bd_addr != address) continue;
+
+    LOG_INFO("Device is LE Audio capable based on AD content");
+    return inq_ent->results.ble_ad_is_le_audio_capable;
+  }
+  return false;
+}
\ No newline at end of file
diff --git a/system/bta/dm/bta_dm_cfg.cc b/system/bta/dm/bta_dm_cfg.cc
index 4a05f8e..fed90db 100644
--- a/system/bta/dm/bta_dm_cfg.cc
+++ b/system/bta/dm/bta_dm_cfg.cc
@@ -26,12 +26,12 @@
 #include <cstdint>
 
 #include "bt_target.h"  // Must be first to define build configuration
-
 #include "bta/dm/bta_dm_int.h"
 #include "bta/include/bta_api.h"
 #include "bta/include/bta_hh_api.h"
 #include "bta/include/bta_jv_api.h"
 #include "bta/sys/bta_sys.h"
+#include "osi/include/properties.h"
 #include "types/raw_address.h"
 
 /* page timeout in 625uS */
@@ -44,14 +44,6 @@
 #define BTA_DM_AVOID_SCATTER_A2DP TRUE
 #endif
 
-/* For Insight, PM cfg lookup tables are runtime configurable (to allow tweaking
- * of params for power consumption measurements) */
-#ifndef BTE_SIM_APP
-#define tBTA_DM_PM_TYPE_QUALIFIER const
-#else
-#define tBTA_DM_PM_TYPE_QUALIFIER
-#endif
-
 const tBTA_DM_CFG bta_dm_cfg = {
     /* page timeout in 625uS */
     BTA_DM_PAGE_TIMEOUT,
@@ -134,317 +126,388 @@
         {BTA_ID_GATTS, BTA_ALL_APP_ID, 15}  /* gatts spec table */
 };
 
-tBTA_DM_PM_TYPE_QUALIFIER tBTA_DM_PM_SPEC bta_dm_pm_spec[BTA_DM_NUM_PM_SPEC] = {
-    /* AG : 0 */
-    {(BTA_DM_PM_SNIFF | BTA_DM_PM_PARK), /* allow park & sniff */
-     (BTA_DM_PM_SSR2), /* the SSR entry */
-     {
-         {{BTA_DM_PM_SNIFF_A2DP_IDX, 7000},
-          {BTA_DM_PM_NO_ACTION, 0}}, /* conn open sniff  */
-         {{BTA_DM_PM_NO_PREF, 0}, {BTA_DM_PM_NO_ACTION, 0}},   /* conn close  */
-         {{BTA_DM_PM_NO_ACTION, 0}, {BTA_DM_PM_NO_ACTION, 0}}, /* app open */
-         {{BTA_DM_PM_NO_ACTION, 0}, {BTA_DM_PM_NO_ACTION, 0}}, /* app close */
-         {{BTA_DM_PM_SNIFF_SCO_OPEN_IDX, 7000},
-          {BTA_DM_PM_NO_ACTION, 0}}, /* sco open, active */
-         {{BTA_DM_PM_SNIFF_A2DP_IDX, 7000},
-          {BTA_DM_PM_NO_ACTION, 0}}, /* sco close sniff  */
-         {{BTA_DM_PM_SNIFF_A2DP_IDX, 7000},
-          {BTA_DM_PM_NO_ACTION, 0}},                        /* idle */
-         {{BTA_DM_PM_ACTIVE, 0}, {BTA_DM_PM_NO_ACTION, 0}}, /* busy */
-         {{BTA_DM_PM_RETRY, 7000},
-          {BTA_DM_PM_NO_ACTION, 0}} /* mode change retry */
-     }},
+tBTA_DM_PM_TYPE_QUALIFIER tBTA_DM_PM_SPEC* get_bta_dm_pm_spec() {
+  static uint16_t hs_sniff_delay = uint16_t(
+      osi_property_get_int32("bluetooth.bta_hs_sniff_delay_ms.config", 7000));
 
-    /* CT, CG : 1 */
-    {(BTA_DM_PM_SNIFF | BTA_DM_PM_PARK), /* allow park & sniff */
-     (BTA_DM_PM_SSR2), /* the SSR entry */
-     {
-         {{BTA_DM_PM_PARK, 5000},
-          {BTA_DM_PM_NO_ACTION, 0}}, /* conn open  park */
-         {{BTA_DM_PM_NO_PREF, 0}, {BTA_DM_PM_NO_ACTION, 0}},   /* conn close  */
-         {{BTA_DM_PM_NO_ACTION, 0}, {BTA_DM_PM_NO_ACTION, 0}}, /* app open */
-         {{BTA_DM_PM_NO_ACTION, 0}, {BTA_DM_PM_NO_ACTION, 0}}, /* app close */
-         {{BTA_DM_PM_SNIFF_A2DP_IDX, 5000},
-          {BTA_DM_PM_NO_ACTION, 0}}, /* sco open sniff */
-         {{BTA_DM_PM_PARK, 5000},
-          {BTA_DM_PM_NO_ACTION, 0}}, /* sco close  park */
-         {{BTA_DM_PM_NO_ACTION, 0}, {BTA_DM_PM_NO_ACTION, 0}}, /* idle */
-         {{BTA_DM_PM_NO_ACTION, 0}, {BTA_DM_PM_NO_ACTION, 0}}, /* busy */
-         {{BTA_DM_PM_RETRY, 5000},
-          {BTA_DM_PM_NO_ACTION, 0}} /* mode change retry */
-     }},
+  static tBTA_DM_PM_TYPE_QUALIFIER tBTA_DM_PM_SPEC
+      bta_dm_pm_spec[BTA_DM_NUM_PM_SPEC] = {
+          /* AG : 0 */
+          {(BTA_DM_PM_SNIFF | BTA_DM_PM_PARK), /* allow park & sniff */
+           (BTA_DM_PM_SSR2),                   /* the SSR entry */
+           {
+               {{BTA_DM_PM_SNIFF_A2DP_IDX, 7000},
+                {BTA_DM_PM_NO_ACTION, 0}}, /* conn open sniff  */
+               {{BTA_DM_PM_NO_PREF, 0},
+                {BTA_DM_PM_NO_ACTION, 0}}, /* conn close  */
+               {{BTA_DM_PM_NO_ACTION, 0},
+                {BTA_DM_PM_NO_ACTION, 0}}, /* app open */
+               {{BTA_DM_PM_NO_ACTION, 0},
+                {BTA_DM_PM_NO_ACTION, 0}}, /* app close */
+               {{BTA_DM_PM_SNIFF_SCO_OPEN_IDX, 7000},
+                {BTA_DM_PM_NO_ACTION, 0}}, /* sco open, active */
+               {{BTA_DM_PM_SNIFF_A2DP_IDX, 7000},
+                {BTA_DM_PM_NO_ACTION, 0}}, /* sco close sniff  */
+               {{BTA_DM_PM_SNIFF_A2DP_IDX, 7000},
+                {BTA_DM_PM_NO_ACTION, 0}},                        /* idle */
+               {{BTA_DM_PM_ACTIVE, 0}, {BTA_DM_PM_NO_ACTION, 0}}, /* busy */
+               {{BTA_DM_PM_RETRY, 7000},
+                {BTA_DM_PM_NO_ACTION, 0}} /* mode change retry */
+           }},
 
-    /* DG, PBC : 2 */
-    {(BTA_DM_PM_ACTIVE), /* no power saving mode allowed */
-     (BTA_DM_PM_SSR2), /* the SSR entry */
-     {
-         {{BTA_DM_PM_SNIFF, 5000},
-          {BTA_DM_PM_NO_ACTION, 0}}, /* conn open active */
-         {{BTA_DM_PM_NO_PREF, 0}, {BTA_DM_PM_NO_ACTION, 0}},   /* conn close  */
-         {{BTA_DM_PM_ACTIVE, 0}, {BTA_DM_PM_NO_ACTION, 0}},    /* app open */
-         {{BTA_DM_PM_NO_ACTION, 0}, {BTA_DM_PM_NO_ACTION, 0}}, /* app close */
-         {{BTA_DM_PM_NO_ACTION, 0}, {BTA_DM_PM_NO_ACTION, 0}}, /* sco open  */
-         {{BTA_DM_PM_NO_ACTION, 0}, {BTA_DM_PM_NO_ACTION, 0}}, /* sco close   */
-         {{BTA_DM_PM_SNIFF, 1000}, {BTA_DM_PM_NO_ACTION, 0}},  /* idle */
-         {{BTA_DM_PM_ACTIVE, 0}, {BTA_DM_PM_NO_ACTION, 0}},    /* busy */
-         {{BTA_DM_PM_NO_ACTION, 0},
-          {BTA_DM_PM_NO_ACTION, 0}} /* mode change retry */
-     }},
+          /* CT, CG : 1 */
+          {(BTA_DM_PM_SNIFF | BTA_DM_PM_PARK), /* allow park & sniff */
+           (BTA_DM_PM_SSR2),                   /* the SSR entry */
+           {
+               {{BTA_DM_PM_PARK, 5000},
+                {BTA_DM_PM_NO_ACTION, 0}}, /* conn open  park */
+               {{BTA_DM_PM_NO_PREF, 0},
+                {BTA_DM_PM_NO_ACTION, 0}}, /* conn close  */
+               {{BTA_DM_PM_NO_ACTION, 0},
+                {BTA_DM_PM_NO_ACTION, 0}}, /* app open */
+               {{BTA_DM_PM_NO_ACTION, 0},
+                {BTA_DM_PM_NO_ACTION, 0}}, /* app close */
+               {{BTA_DM_PM_SNIFF_A2DP_IDX, 5000},
+                {BTA_DM_PM_NO_ACTION, 0}}, /* sco open sniff */
+               {{BTA_DM_PM_PARK, 5000},
+                {BTA_DM_PM_NO_ACTION, 0}}, /* sco close  park */
+               {{BTA_DM_PM_NO_ACTION, 0}, {BTA_DM_PM_NO_ACTION, 0}}, /* idle */
+               {{BTA_DM_PM_NO_ACTION, 0}, {BTA_DM_PM_NO_ACTION, 0}}, /* busy */
+               {{BTA_DM_PM_RETRY, 5000},
+                {BTA_DM_PM_NO_ACTION, 0}} /* mode change retry */
+           }},
 
-    /* HD : 3 */
-    {(BTA_DM_PM_SNIFF | BTA_DM_PM_PARK), /* allow park & sniff */
-     (BTA_DM_PM_SSR3), /* the SSR entry */
-     {
-         {{BTA_DM_PM_SNIFF_HD_ACTIVE_IDX, 5000},
-          {BTA_DM_PM_NO_ACTION, 0}}, /* conn open sniff */
-         {{BTA_DM_PM_NO_PREF, 0}, {BTA_DM_PM_NO_ACTION, 0}},   /* conn close */
-         {{BTA_DM_PM_NO_ACTION, 0}, {BTA_DM_PM_NO_ACTION, 0}}, /* app open */
-         {{BTA_DM_PM_NO_ACTION, 0}, {BTA_DM_PM_NO_ACTION, 0}}, /* app close */
-         {{BTA_DM_PM_NO_ACTION, 0}, {BTA_DM_PM_NO_ACTION, 0}}, /* sco open  */
-         {{BTA_DM_PM_NO_ACTION, 0}, {BTA_DM_PM_NO_ACTION, 0}}, /* sco close */
-         {{BTA_DM_PM_SNIFF_HD_IDLE_IDX, 5000},
-          {BTA_DM_PM_NO_ACTION, 0}}, /* idle */
-         {{BTA_DM_PM_SNIFF_HD_ACTIVE_IDX, 0},
-          {BTA_DM_PM_NO_ACTION, 0}}, /* busy */
-         {{BTA_DM_PM_NO_ACTION, 0},
-          {BTA_DM_PM_NO_ACTION, 0}} /* mode change retry */
-     }},
+          /* DG, PBC : 2 */
+          {(BTA_DM_PM_ACTIVE), /* no power saving mode allowed */
+           (BTA_DM_PM_SSR2),   /* the SSR entry */
+           {
+               {{BTA_DM_PM_SNIFF, 5000},
+                {BTA_DM_PM_NO_ACTION, 0}}, /* conn open active */
+               {{BTA_DM_PM_NO_PREF, 0},
+                {BTA_DM_PM_NO_ACTION, 0}}, /* conn close  */
+               {{BTA_DM_PM_ACTIVE, 0}, {BTA_DM_PM_NO_ACTION, 0}}, /* app open */
+               {{BTA_DM_PM_NO_ACTION, 0},
+                {BTA_DM_PM_NO_ACTION, 0}}, /* app close */
+               {{BTA_DM_PM_NO_ACTION, 0},
+                {BTA_DM_PM_NO_ACTION, 0}}, /* sco open  */
+               {{BTA_DM_PM_NO_ACTION, 0},
+                {BTA_DM_PM_NO_ACTION, 0}}, /* sco close   */
+               {{BTA_DM_PM_SNIFF, 1000}, {BTA_DM_PM_NO_ACTION, 0}}, /* idle */
+               {{BTA_DM_PM_ACTIVE, 0}, {BTA_DM_PM_NO_ACTION, 0}},   /* busy */
+               {{BTA_DM_PM_NO_ACTION, 0},
+                {BTA_DM_PM_NO_ACTION, 0}} /* mode change retry */
+           }},
 
-    /* AV : 4 */
-    {(BTA_DM_PM_SNIFF), /* allow sniff */
-     (BTA_DM_PM_SSR2), /* the SSR entry */
-     {
-         {{BTA_DM_PM_SNIFF_A2DP_IDX, 7000},
-          {BTA_DM_PM_NO_ACTION, 0}}, /* conn open  sniff */
-         {{BTA_DM_PM_NO_PREF, 0}, {BTA_DM_PM_NO_ACTION, 0}},   /* conn close  */
-         {{BTA_DM_PM_NO_ACTION, 0}, {BTA_DM_PM_NO_ACTION, 0}}, /* app open */
-         {{BTA_DM_PM_NO_ACTION, 0}, {BTA_DM_PM_NO_ACTION, 0}}, /* app close */
-         {{BTA_DM_PM_NO_ACTION, 0}, {BTA_DM_PM_NO_ACTION, 0}}, /* sco open  */
-         {{BTA_DM_PM_NO_ACTION, 0}, {BTA_DM_PM_NO_ACTION, 0}}, /* sco close   */
-         {{BTA_DM_PM_SNIFF_A2DP_IDX, 7000},
-          {BTA_DM_PM_NO_ACTION, 0}},                        /* idle */
-         {{BTA_DM_PM_ACTIVE, 0}, {BTA_DM_PM_NO_ACTION, 0}}, /* busy */
-         {{BTA_DM_PM_NO_ACTION, 0},
-          {BTA_DM_PM_NO_ACTION, 0}} /* mode change retry */
-     }},
+          /* HD : 3 */
+          {(BTA_DM_PM_SNIFF | BTA_DM_PM_PARK), /* allow park & sniff */
+           (BTA_DM_PM_SSR3),                   /* the SSR entry */
+           {
+               {{BTA_DM_PM_SNIFF_HD_ACTIVE_IDX, 5000},
+                {BTA_DM_PM_NO_ACTION, 0}}, /* conn open sniff */
+               {{BTA_DM_PM_NO_PREF, 0},
+                {BTA_DM_PM_NO_ACTION, 0}}, /* conn close */
+               {{BTA_DM_PM_NO_ACTION, 0},
+                {BTA_DM_PM_NO_ACTION, 0}}, /* app open */
+               {{BTA_DM_PM_NO_ACTION, 0},
+                {BTA_DM_PM_NO_ACTION, 0}}, /* app close */
+               {{BTA_DM_PM_NO_ACTION, 0},
+                {BTA_DM_PM_NO_ACTION, 0}}, /* sco open  */
+               {{BTA_DM_PM_NO_ACTION, 0},
+                {BTA_DM_PM_NO_ACTION, 0}}, /* sco close */
+               {{BTA_DM_PM_SNIFF_HD_IDLE_IDX, 5000},
+                {BTA_DM_PM_NO_ACTION, 0}}, /* idle */
+               {{BTA_DM_PM_SNIFF_HD_ACTIVE_IDX, 0},
+                {BTA_DM_PM_NO_ACTION, 0}}, /* busy */
+               {{BTA_DM_PM_NO_ACTION, 0},
+                {BTA_DM_PM_NO_ACTION, 0}} /* mode change retry */
+           }},
 
-    /* HH for joysticks and gamepad : 5 */
-    {(BTA_DM_PM_SNIFF | BTA_DM_PM_PARK), /* allow park & sniff */
-     (BTA_DM_PM_SSR1), /* the SSR entry */
-     {
-         {{BTA_DM_PM_SNIFF6, BTA_DM_PM_HH_OPEN_DELAY},
-          {BTA_DM_PM_NO_ACTION, 0}}, /* conn open  sniff */
-         {{BTA_DM_PM_NO_PREF, 0}, {BTA_DM_PM_NO_ACTION, 0}},   /* conn close  */
-         {{BTA_DM_PM_NO_ACTION, 0}, {BTA_DM_PM_NO_ACTION, 0}}, /* app open */
-         {{BTA_DM_PM_NO_ACTION, 0}, {BTA_DM_PM_NO_ACTION, 0}}, /* app close */
-         {{BTA_DM_PM_NO_ACTION, 0}, {BTA_DM_PM_NO_ACTION, 0}}, /* sco open  */
-         {{BTA_DM_PM_NO_ACTION, 0},
-          {BTA_DM_PM_NO_ACTION, 0}}, /* sco close, used for HH suspend   */
-         {{BTA_DM_PM_SNIFF6, BTA_DM_PM_HH_IDLE_DELAY},
-          {BTA_DM_PM_NO_ACTION, 0}}, /* idle */
-         {{BTA_DM_PM_SNIFF6, BTA_DM_PM_HH_ACTIVE_DELAY},
-          {BTA_DM_PM_NO_ACTION, 0}}, /* busy */
-         {{BTA_DM_PM_NO_ACTION, 0},
-          {BTA_DM_PM_NO_ACTION, 0}} /* mode change retry */
-     }},
+          /* AV : 4 */
+          {(BTA_DM_PM_SNIFF), /* allow sniff */
+           (BTA_DM_PM_SSR2),  /* the SSR entry */
+           {
+               {{BTA_DM_PM_SNIFF_A2DP_IDX, 7000},
+                {BTA_DM_PM_NO_ACTION, 0}}, /* conn open  sniff */
+               {{BTA_DM_PM_NO_PREF, 0},
+                {BTA_DM_PM_NO_ACTION, 0}}, /* conn close  */
+               {{BTA_DM_PM_NO_ACTION, 0},
+                {BTA_DM_PM_NO_ACTION, 0}}, /* app open */
+               {{BTA_DM_PM_NO_ACTION, 0},
+                {BTA_DM_PM_NO_ACTION, 0}}, /* app close */
+               {{BTA_DM_PM_NO_ACTION, 0},
+                {BTA_DM_PM_NO_ACTION, 0}}, /* sco open  */
+               {{BTA_DM_PM_NO_ACTION, 0},
+                {BTA_DM_PM_NO_ACTION, 0}}, /* sco close   */
+               {{BTA_DM_PM_SNIFF_A2DP_IDX, 7000},
+                {BTA_DM_PM_NO_ACTION, 0}},                        /* idle */
+               {{BTA_DM_PM_ACTIVE, 0}, {BTA_DM_PM_NO_ACTION, 0}}, /* busy */
+               {{BTA_DM_PM_NO_ACTION, 0},
+                {BTA_DM_PM_NO_ACTION, 0}} /* mode change retry */
+           }},
 
-    /* HH : 6 */
-    {(BTA_DM_PM_SNIFF | BTA_DM_PM_PARK), /* allow park & sniff */
-     (BTA_DM_PM_SSR1), /* the SSR entry */
-     {
-         {{BTA_DM_PM_SNIFF_HH_OPEN_IDX, BTA_DM_PM_HH_OPEN_DELAY},
-          {BTA_DM_PM_NO_ACTION, 0}}, /* conn open  sniff */
-         {{BTA_DM_PM_NO_PREF, 0}, {BTA_DM_PM_NO_ACTION, 0}},   /* conn close  */
-         {{BTA_DM_PM_NO_ACTION, 0}, {BTA_DM_PM_NO_ACTION, 0}}, /* app open */
-         {{BTA_DM_PM_NO_ACTION, 0}, {BTA_DM_PM_NO_ACTION, 0}}, /* app close */
-         {{BTA_DM_PM_NO_ACTION, 0}, {BTA_DM_PM_NO_ACTION, 0}}, /* sco open  */
-         {{BTA_DM_PM_NO_ACTION, 0},
-          {BTA_DM_PM_NO_ACTION, 0}}, /* sco close, used for HH suspend   */
-         {{BTA_DM_PM_SNIFF_HH_IDLE_IDX, BTA_DM_PM_HH_IDLE_DELAY},
-          {BTA_DM_PM_NO_ACTION, 0}}, /* idle */
-         {{BTA_DM_PM_SNIFF_HH_ACTIVE_IDX, BTA_DM_PM_HH_ACTIVE_DELAY},
-          {BTA_DM_PM_NO_ACTION, 0}}, /* busy */
-         {{BTA_DM_PM_NO_ACTION, 0},
-          {BTA_DM_PM_NO_ACTION, 0}} /* mode change retry */
-     }},
+          /* HH for joysticks and gamepad : 5 */
+          {(BTA_DM_PM_SNIFF | BTA_DM_PM_PARK), /* allow park & sniff */
+           (BTA_DM_PM_SSR1),                   /* the SSR entry */
+           {
+               {{BTA_DM_PM_SNIFF6, BTA_DM_PM_HH_OPEN_DELAY},
+                {BTA_DM_PM_NO_ACTION, 0}}, /* conn open  sniff */
+               {{BTA_DM_PM_NO_PREF, 0},
+                {BTA_DM_PM_NO_ACTION, 0}}, /* conn close  */
+               {{BTA_DM_PM_NO_ACTION, 0},
+                {BTA_DM_PM_NO_ACTION, 0}}, /* app open */
+               {{BTA_DM_PM_NO_ACTION, 0},
+                {BTA_DM_PM_NO_ACTION, 0}}, /* app close */
+               {{BTA_DM_PM_NO_ACTION, 0},
+                {BTA_DM_PM_NO_ACTION, 0}}, /* sco open  */
+               {{BTA_DM_PM_NO_ACTION, 0},
+                {BTA_DM_PM_NO_ACTION, 0}}, /* sco close, used for HH suspend */
+               {{BTA_DM_PM_SNIFF6, BTA_DM_PM_HH_IDLE_DELAY},
+                {BTA_DM_PM_NO_ACTION, 0}}, /* idle */
+               {{BTA_DM_PM_SNIFF6, BTA_DM_PM_HH_ACTIVE_DELAY},
+                {BTA_DM_PM_NO_ACTION, 0}}, /* busy */
+               {{BTA_DM_PM_NO_ACTION, 0},
+                {BTA_DM_PM_NO_ACTION, 0}} /* mode change retry */
+           }},
 
-    /* FTC, OPC, JV : 7 */
-    {(BTA_DM_PM_SNIFF), /* allow sniff */
-     (BTA_DM_PM_SSR2), /* the SSR entry */
-     {
-         {{BTA_DM_PM_ACTIVE, 0},
-          {BTA_DM_PM_NO_ACTION, 0}}, /* conn open  active */
-         {{BTA_DM_PM_NO_PREF, 0}, {BTA_DM_PM_NO_ACTION, 0}},   /* conn close  */
-         {{BTA_DM_PM_ACTIVE, 0}, {BTA_DM_PM_NO_ACTION, 0}},    /* app open */
-         {{BTA_DM_PM_NO_ACTION, 0}, {BTA_DM_PM_NO_ACTION, 0}}, /* app close */
-         {{BTA_DM_PM_NO_ACTION, 0}, {BTA_DM_PM_NO_ACTION, 0}}, /* sco open  */
-         {{BTA_DM_PM_NO_ACTION, 0}, {BTA_DM_PM_NO_ACTION, 0}}, /* sco close   */
-         {{BTA_DM_PM_SNIFF_A2DP_IDX, BTA_FTC_IDLE_TO_SNIFF_DELAY_MS},
-          {BTA_DM_PM_NO_ACTION, 0}},                        /* idle */
-         {{BTA_DM_PM_ACTIVE, 0}, {BTA_DM_PM_NO_ACTION, 0}}, /* busy */
-         {{BTA_DM_PM_NO_ACTION, 0},
-          {BTA_DM_PM_NO_ACTION, 0}} /* mode change retry */
-     }},
+          /* HH : 6 */
+          {(BTA_DM_PM_SNIFF | BTA_DM_PM_PARK), /* allow park & sniff */
+           (BTA_DM_PM_SSR1),                   /* the SSR entry */
+           {
+               {{BTA_DM_PM_SNIFF_HH_OPEN_IDX, BTA_DM_PM_HH_OPEN_DELAY},
+                {BTA_DM_PM_NO_ACTION, 0}}, /* conn open  sniff */
+               {{BTA_DM_PM_NO_PREF, 0},
+                {BTA_DM_PM_NO_ACTION, 0}}, /* conn close  */
+               {{BTA_DM_PM_NO_ACTION, 0},
+                {BTA_DM_PM_NO_ACTION, 0}}, /* app open */
+               {{BTA_DM_PM_NO_ACTION, 0},
+                {BTA_DM_PM_NO_ACTION, 0}}, /* app close */
+               {{BTA_DM_PM_NO_ACTION, 0},
+                {BTA_DM_PM_NO_ACTION, 0}}, /* sco open  */
+               {{BTA_DM_PM_NO_ACTION, 0},
+                {BTA_DM_PM_NO_ACTION, 0}}, /* sco close, used for HH suspend */
+               {{BTA_DM_PM_SNIFF_HH_IDLE_IDX, BTA_DM_PM_HH_IDLE_DELAY},
+                {BTA_DM_PM_NO_ACTION, 0}}, /* idle */
+               {{BTA_DM_PM_SNIFF_HH_ACTIVE_IDX, BTA_DM_PM_HH_ACTIVE_DELAY},
+                {BTA_DM_PM_NO_ACTION, 0}}, /* busy */
+               {{BTA_DM_PM_NO_ACTION, 0},
+                {BTA_DM_PM_NO_ACTION, 0}} /* mode change retry */
+           }},
 
-    /* FTS, PBS, OPS, MSE, BTA_JV_PM_ID_1 : 8 */
-    {(BTA_DM_PM_SNIFF), /* allow sniff */
-     (BTA_DM_PM_SSR2), /* the SSR entry */
-     {
-         {{BTA_DM_PM_ACTIVE, 0},
-          {BTA_DM_PM_NO_ACTION, 0}}, /* conn open  active */
-         {{BTA_DM_PM_NO_PREF, 0}, {BTA_DM_PM_NO_ACTION, 0}},   /* conn close  */
-         {{BTA_DM_PM_ACTIVE, 0}, {BTA_DM_PM_NO_ACTION, 0}},    /* app open */
-         {{BTA_DM_PM_NO_ACTION, 0}, {BTA_DM_PM_NO_ACTION, 0}}, /* app close */
-         {{BTA_DM_PM_NO_ACTION, 0}, {BTA_DM_PM_NO_ACTION, 0}}, /* sco open  */
-         {{BTA_DM_PM_NO_ACTION, 0}, {BTA_DM_PM_NO_ACTION, 0}}, /* sco close   */
-         {{BTA_DM_PM_SNIFF_A2DP_IDX, BTA_FTS_OPS_IDLE_TO_SNIFF_DELAY_MS},
-          {BTA_DM_PM_NO_ACTION, 0}},                        /* idle */
-         {{BTA_DM_PM_ACTIVE, 0}, {BTA_DM_PM_NO_ACTION, 0}}, /* busy */
-         {{BTA_DM_PM_NO_ACTION, 0},
-          {BTA_DM_PM_NO_ACTION, 0}} /* mode change retry */
-     }},
+          /* FTC, OPC, JV : 7 */
+          {(BTA_DM_PM_SNIFF), /* allow sniff */
+           (BTA_DM_PM_SSR2),  /* the SSR entry */
+           {
+               {{BTA_DM_PM_ACTIVE, 0},
+                {BTA_DM_PM_NO_ACTION, 0}}, /* conn open  active */
+               {{BTA_DM_PM_NO_PREF, 0},
+                {BTA_DM_PM_NO_ACTION, 0}}, /* conn close  */
+               {{BTA_DM_PM_ACTIVE, 0}, {BTA_DM_PM_NO_ACTION, 0}}, /* app open */
+               {{BTA_DM_PM_NO_ACTION, 0},
+                {BTA_DM_PM_NO_ACTION, 0}}, /* app close */
+               {{BTA_DM_PM_NO_ACTION, 0},
+                {BTA_DM_PM_NO_ACTION, 0}}, /* sco open  */
+               {{BTA_DM_PM_NO_ACTION, 0},
+                {BTA_DM_PM_NO_ACTION, 0}}, /* sco close   */
+               {{BTA_DM_PM_SNIFF_A2DP_IDX, BTA_FTC_IDLE_TO_SNIFF_DELAY_MS},
+                {BTA_DM_PM_NO_ACTION, 0}},                        /* idle */
+               {{BTA_DM_PM_ACTIVE, 0}, {BTA_DM_PM_NO_ACTION, 0}}, /* busy */
+               {{BTA_DM_PM_NO_ACTION, 0},
+                {BTA_DM_PM_NO_ACTION, 0}} /* mode change retry */
+           }},
 
-    /* HL : 9 */
-    {(BTA_DM_PM_SNIFF), /* allow sniff */
-     (BTA_DM_PM_SSR2), /* the SSR entry */
-     {
-         {{BTA_DM_PM_SNIFF_A2DP_IDX, 5000},
-          {BTA_DM_PM_NO_ACTION, 0}}, /* conn open sniff  */
-         {{BTA_DM_PM_NO_PREF, 0}, {BTA_DM_PM_NO_ACTION, 0}},   /* conn close  */
-         {{BTA_DM_PM_NO_ACTION, 0}, {BTA_DM_PM_NO_ACTION, 0}}, /* app open */
-         {{BTA_DM_PM_NO_ACTION, 0}, {BTA_DM_PM_NO_ACTION, 0}}, /* app close */
-         {{BTA_DM_PM_NO_ACTION, 0},
-          {BTA_DM_PM_NO_ACTION, 0}}, /* sco open, active */
-         {{BTA_DM_PM_NO_ACTION, 0},
-          {BTA_DM_PM_NO_ACTION, 0}}, /* sco close sniff  */
-         {{BTA_DM_PM_NO_ACTION, 0}, {BTA_DM_PM_NO_ACTION, 0}}, /* idle */
-         {{BTA_DM_PM_ACTIVE, 0}, {BTA_DM_PM_NO_ACTION, 0}},    /* busy */
-         {{BTA_DM_PM_NO_ACTION, 0},
-          {BTA_DM_PM_NO_ACTION, 0}} /* mode change retry */
-     }},
+          /* FTS, PBS, OPS, MSE, BTA_JV_PM_ID_1 : 8 */
+          {(BTA_DM_PM_SNIFF), /* allow sniff */
+           (BTA_DM_PM_SSR2),  /* the SSR entry */
+           {
+               {{BTA_DM_PM_ACTIVE, 0},
+                {BTA_DM_PM_NO_ACTION, 0}}, /* conn open  active */
+               {{BTA_DM_PM_NO_PREF, 0},
+                {BTA_DM_PM_NO_ACTION, 0}}, /* conn close  */
+               {{BTA_DM_PM_ACTIVE, 0}, {BTA_DM_PM_NO_ACTION, 0}}, /* app open */
+               {{BTA_DM_PM_NO_ACTION, 0},
+                {BTA_DM_PM_NO_ACTION, 0}}, /* app close */
+               {{BTA_DM_PM_NO_ACTION, 0},
+                {BTA_DM_PM_NO_ACTION, 0}}, /* sco open  */
+               {{BTA_DM_PM_NO_ACTION, 0},
+                {BTA_DM_PM_NO_ACTION, 0}}, /* sco close   */
+               {{BTA_DM_PM_SNIFF_A2DP_IDX, BTA_FTS_OPS_IDLE_TO_SNIFF_DELAY_MS},
+                {BTA_DM_PM_NO_ACTION, 0}},                        /* idle */
+               {{BTA_DM_PM_ACTIVE, 0}, {BTA_DM_PM_NO_ACTION, 0}}, /* busy */
+               {{BTA_DM_PM_NO_ACTION, 0},
+                {BTA_DM_PM_NO_ACTION, 0}} /* mode change retry */
+           }},
 
-    /* PANU : 10 */
-    {(BTA_DM_PM_SNIFF), /* allow sniff */
-     (BTA_DM_PM_SSR2), /* the SSR entry */
-     {
-         {{BTA_DM_PM_ACTIVE, 0},
-          {BTA_DM_PM_NO_ACTION, 0}}, /* conn open  active */
-         {{BTA_DM_PM_NO_PREF, 0}, {BTA_DM_PM_NO_ACTION, 0}},   /* conn close  */
-         {{BTA_DM_PM_ACTIVE, 0}, {BTA_DM_PM_NO_ACTION, 0}},    /* app open */
-         {{BTA_DM_PM_NO_ACTION, 0}, {BTA_DM_PM_NO_ACTION, 0}}, /* app close */
-         {{BTA_DM_PM_NO_ACTION, 0}, {BTA_DM_PM_NO_ACTION, 0}}, /* sco open  */
-         {{BTA_DM_PM_NO_ACTION, 0}, {BTA_DM_PM_NO_ACTION, 0}}, /* sco close   */
-         {{BTA_DM_PM_SNIFF_A2DP_IDX, 5000},
-          {BTA_DM_PM_NO_ACTION, 0}},                        /* idle */
-         {{BTA_DM_PM_ACTIVE, 0}, {BTA_DM_PM_NO_ACTION, 0}}, /* busy */
-         {{BTA_DM_PM_NO_ACTION, 0},
-          {BTA_DM_PM_NO_ACTION, 0}} /* mode change retry */
-     }},
+          /* HL : 9 */
+          {(BTA_DM_PM_SNIFF), /* allow sniff */
+           (BTA_DM_PM_SSR2),  /* the SSR entry */
+           {
+               {{BTA_DM_PM_SNIFF_A2DP_IDX, 5000},
+                {BTA_DM_PM_NO_ACTION, 0}}, /* conn open sniff  */
+               {{BTA_DM_PM_NO_PREF, 0},
+                {BTA_DM_PM_NO_ACTION, 0}}, /* conn close  */
+               {{BTA_DM_PM_NO_ACTION, 0},
+                {BTA_DM_PM_NO_ACTION, 0}}, /* app open */
+               {{BTA_DM_PM_NO_ACTION, 0},
+                {BTA_DM_PM_NO_ACTION, 0}}, /* app close */
+               {{BTA_DM_PM_NO_ACTION, 0},
+                {BTA_DM_PM_NO_ACTION, 0}}, /* sco open, active */
+               {{BTA_DM_PM_NO_ACTION, 0},
+                {BTA_DM_PM_NO_ACTION, 0}}, /* sco close sniff  */
+               {{BTA_DM_PM_NO_ACTION, 0}, {BTA_DM_PM_NO_ACTION, 0}}, /* idle */
+               {{BTA_DM_PM_ACTIVE, 0}, {BTA_DM_PM_NO_ACTION, 0}},    /* busy */
+               {{BTA_DM_PM_NO_ACTION, 0},
+                {BTA_DM_PM_NO_ACTION, 0}} /* mode change retry */
+           }},
 
-    /* NAP : 11 */
-    {(BTA_DM_PM_SNIFF), /* allow sniff */
-     (BTA_DM_PM_SSR2), /* the SSR entry */
-     {
-         {{BTA_DM_PM_ACTIVE, 0},
-          {BTA_DM_PM_NO_ACTION, 0}}, /* conn open  active */
-         {{BTA_DM_PM_NO_PREF, 0}, {BTA_DM_PM_NO_ACTION, 0}},   /* conn close  */
-         {{BTA_DM_PM_ACTIVE, 0}, {BTA_DM_PM_NO_ACTION, 0}},    /* app open */
-         {{BTA_DM_PM_NO_ACTION, 0}, {BTA_DM_PM_NO_ACTION, 0}}, /* app close */
-         {{BTA_DM_PM_NO_ACTION, 0}, {BTA_DM_PM_NO_ACTION, 0}}, /* sco open  */
-         {{BTA_DM_PM_NO_ACTION, 0}, {BTA_DM_PM_NO_ACTION, 0}}, /* sco close   */
-         {{BTA_DM_PM_SNIFF_A2DP_IDX, 5000},
-          {BTA_DM_PM_NO_ACTION, 0}},                        /* idle */
-         {{BTA_DM_PM_ACTIVE, 0}, {BTA_DM_PM_NO_ACTION, 0}}, /* busy */
+          /* PANU : 10 */
+          {(BTA_DM_PM_SNIFF), /* allow sniff */
+           (BTA_DM_PM_SSR2),  /* the SSR entry */
+           {
+               {{BTA_DM_PM_ACTIVE, 0},
+                {BTA_DM_PM_NO_ACTION, 0}}, /* conn open  active */
+               {{BTA_DM_PM_NO_PREF, 0},
+                {BTA_DM_PM_NO_ACTION, 0}}, /* conn close  */
+               {{BTA_DM_PM_ACTIVE, 0}, {BTA_DM_PM_NO_ACTION, 0}}, /* app open */
+               {{BTA_DM_PM_NO_ACTION, 0},
+                {BTA_DM_PM_NO_ACTION, 0}}, /* app close */
+               {{BTA_DM_PM_NO_ACTION, 0},
+                {BTA_DM_PM_NO_ACTION, 0}}, /* sco open  */
+               {{BTA_DM_PM_NO_ACTION, 0},
+                {BTA_DM_PM_NO_ACTION, 0}}, /* sco close   */
+               {{BTA_DM_PM_SNIFF_A2DP_IDX, 5000},
+                {BTA_DM_PM_NO_ACTION, 0}},                        /* idle */
+               {{BTA_DM_PM_ACTIVE, 0}, {BTA_DM_PM_NO_ACTION, 0}}, /* busy */
+               {{BTA_DM_PM_NO_ACTION, 0},
+                {BTA_DM_PM_NO_ACTION, 0}} /* mode change retry */
+           }},
 
-         {{BTA_DM_PM_NO_ACTION, 0},
-          {BTA_DM_PM_NO_ACTION, 0}} /* mode change retry */
-     }},
+          /* NAP : 11 */
+          {(BTA_DM_PM_SNIFF), /* allow sniff */
+           (BTA_DM_PM_SSR2),  /* the SSR entry */
+           {
+               {{BTA_DM_PM_ACTIVE, 0},
+                {BTA_DM_PM_NO_ACTION, 0}}, /* conn open  active */
+               {{BTA_DM_PM_NO_PREF, 0},
+                {BTA_DM_PM_NO_ACTION, 0}}, /* conn close  */
+               {{BTA_DM_PM_ACTIVE, 0}, {BTA_DM_PM_NO_ACTION, 0}}, /* app open */
+               {{BTA_DM_PM_NO_ACTION, 0},
+                {BTA_DM_PM_NO_ACTION, 0}}, /* app close */
+               {{BTA_DM_PM_NO_ACTION, 0},
+                {BTA_DM_PM_NO_ACTION, 0}}, /* sco open  */
+               {{BTA_DM_PM_NO_ACTION, 0},
+                {BTA_DM_PM_NO_ACTION, 0}}, /* sco close   */
+               {{BTA_DM_PM_SNIFF_A2DP_IDX, 5000},
+                {BTA_DM_PM_NO_ACTION, 0}},                        /* idle */
+               {{BTA_DM_PM_ACTIVE, 0}, {BTA_DM_PM_NO_ACTION, 0}}, /* busy */
 
-    /* HS : 12 */
-    {(BTA_DM_PM_SNIFF | BTA_DM_PM_PARK), /* allow park & sniff */
-     (BTA_DM_PM_SSR2), /* the SSR entry */
-     {
-         {{BTA_DM_PM_SNIFF, 7000},
-          {BTA_DM_PM_NO_ACTION, 0}}, /* conn open sniff  */
-         {{BTA_DM_PM_NO_PREF, 0}, {BTA_DM_PM_NO_ACTION, 0}},   /* conn close  */
-         {{BTA_DM_PM_NO_ACTION, 0}, {BTA_DM_PM_NO_ACTION, 0}}, /* app open */
-         {{BTA_DM_PM_NO_ACTION, 0}, {BTA_DM_PM_NO_ACTION, 0}}, /* app close */
-         {{BTA_DM_PM_SNIFF3, 7000},
-          {BTA_DM_PM_NO_ACTION, 0}}, /* sco open, active */
-         {{BTA_DM_PM_SNIFF, 7000},
-          {BTA_DM_PM_NO_ACTION, 0}}, /* sco close sniff  */
-         {{BTA_DM_PM_SNIFF, 7000}, {BTA_DM_PM_NO_ACTION, 0}}, /* idle */
-         {{BTA_DM_PM_ACTIVE, 0}, {BTA_DM_PM_NO_ACTION, 0}},   /* busy */
-         {{BTA_DM_PM_RETRY, 7000},
-          {BTA_DM_PM_NO_ACTION, 0}} /* mode change retry */
-     }},
+               {{BTA_DM_PM_NO_ACTION, 0},
+                {BTA_DM_PM_NO_ACTION, 0}} /* mode change retry */
+           }},
 
-    /* AVK : 13 */
-    {(BTA_DM_PM_SNIFF), /* allow sniff */
-     (BTA_DM_PM_SSR2), /* the SSR entry */
-     {
-         {{BTA_DM_PM_SNIFF, 3000},
-          {BTA_DM_PM_NO_ACTION, 0}}, /* conn open  sniff */
-         {{BTA_DM_PM_NO_PREF, 0}, {BTA_DM_PM_NO_ACTION, 0}},   /* conn close  */
-         {{BTA_DM_PM_NO_ACTION, 0}, {BTA_DM_PM_NO_ACTION, 0}}, /* app open */
-         {{BTA_DM_PM_NO_ACTION, 0}, {BTA_DM_PM_NO_ACTION, 0}}, /* app close */
-         {{BTA_DM_PM_NO_ACTION, 0}, {BTA_DM_PM_NO_ACTION, 0}}, /* sco open  */
-         {{BTA_DM_PM_NO_ACTION, 0}, {BTA_DM_PM_NO_ACTION, 0}}, /* sco close   */
-         {{BTA_DM_PM_SNIFF4, 3000}, {BTA_DM_PM_NO_ACTION, 0}}, /* idle */
-         {{BTA_DM_PM_ACTIVE, 0}, {BTA_DM_PM_NO_ACTION, 0}},    /* busy */
-         {{BTA_DM_PM_NO_ACTION, 0},
-          {BTA_DM_PM_NO_ACTION, 0}} /* mode change retry */
-     }}
+          /* HS : 12 */
+          {(BTA_DM_PM_SNIFF | BTA_DM_PM_PARK), /* allow park & sniff */
+           (BTA_DM_PM_SSR2),                   /* the SSR entry */
+           {
+               {{BTA_DM_PM_SNIFF, hs_sniff_delay},
+                {BTA_DM_PM_NO_ACTION, 0}}, /* conn open sniff  */
+               {{BTA_DM_PM_NO_PREF, 0},
+                {BTA_DM_PM_NO_ACTION, 0}}, /* conn close  */
+               {{BTA_DM_PM_NO_ACTION, 0},
+                {BTA_DM_PM_NO_ACTION, 0}}, /* app open */
+               {{BTA_DM_PM_NO_ACTION, 0},
+                {BTA_DM_PM_NO_ACTION, 0}}, /* app close */
+               {{BTA_DM_PM_SNIFF3, 7000},
+                {BTA_DM_PM_NO_ACTION, 0}}, /* sco open, active */
+               {{BTA_DM_PM_SNIFF, 7000},
+                {BTA_DM_PM_NO_ACTION, 0}}, /* sco close sniff  */
+               {{BTA_DM_PM_SNIFF, hs_sniff_delay},
+                {BTA_DM_PM_NO_ACTION, 0}},                        /* idle */
+               {{BTA_DM_PM_ACTIVE, 0}, {BTA_DM_PM_NO_ACTION, 0}}, /* busy */
+               {{BTA_DM_PM_RETRY, 7000},
+                {BTA_DM_PM_NO_ACTION, 0}} /* mode change retry */
+           }},
 
-    /* GATTC : 14 */
-    ,
-    {(BTA_DM_PM_SNIFF | BTA_DM_PM_PARK), /* allow park & sniff */
-     (BTA_DM_PM_SSR2), /* the SSR entry */
-     {
-         {{BTA_DM_PM_SNIFF_A2DP_IDX, 10000},
-          {BTA_DM_PM_NO_ACTION, 0}}, /* conn open  active */
-         {{BTA_DM_PM_NO_PREF, 0}, {BTA_DM_PM_NO_ACTION, 0}},   /* conn close  */
-         {{BTA_DM_PM_ACTIVE, 0}, {BTA_DM_PM_NO_ACTION, 0}},    /* app open */
-         {{BTA_DM_PM_NO_ACTION, 0}, {BTA_DM_PM_NO_ACTION, 0}}, /* app close */
-         {{BTA_DM_PM_NO_ACTION, 0}, {BTA_DM_PM_NO_ACTION, 0}}, /* sco open  */
-         {{BTA_DM_PM_NO_ACTION, 0}, {BTA_DM_PM_NO_ACTION, 0}}, /* sco close   */
-         {{BTA_DM_PM_SNIFF_A2DP_IDX, 10000},
-          {BTA_DM_PM_NO_ACTION, 0}},                        /* idle */
-         {{BTA_DM_PM_ACTIVE, 0}, {BTA_DM_PM_NO_ACTION, 0}}, /* busy */
-         {{BTA_DM_PM_RETRY, 5000},
-          {BTA_DM_PM_NO_ACTION, 0}} /* mode change retry */
-     }}
-    /* GATTS : 15 */
-    ,
-    {(BTA_DM_PM_SNIFF | BTA_DM_PM_PARK), /* allow park & sniff */
-     (BTA_DM_PM_SSR2), /* the SSR entry */
-     {
-         {{BTA_DM_PM_NO_PREF, 0},
-          {BTA_DM_PM_NO_ACTION, 0}}, /* conn open  active */
-         {{BTA_DM_PM_NO_PREF, 0}, {BTA_DM_PM_NO_ACTION, 0}}, /* conn close  */
-         {{BTA_DM_PM_NO_PREF, 0}, {BTA_DM_PM_NO_ACTION, 0}}, /* app open */
-         {{BTA_DM_PM_NO_PREF, 0}, {BTA_DM_PM_NO_ACTION, 0}}, /* app close */
-         {{BTA_DM_PM_NO_PREF, 0}, {BTA_DM_PM_NO_ACTION, 0}}, /* sco open  */
-         {{BTA_DM_PM_NO_PREF, 0}, {BTA_DM_PM_NO_ACTION, 0}}, /* sco close */
-         {{BTA_DM_PM_NO_PREF, 0}, {BTA_DM_PM_NO_ACTION, 0}}, /* idle */
-         {{BTA_DM_PM_NO_PREF, 0}, {BTA_DM_PM_NO_ACTION, 0}}, /* busy */
-         {{BTA_DM_PM_RETRY, 5000},
-          {BTA_DM_PM_NO_ACTION, 0}} /* mode change retry */
-     }}
+          /* AVK : 13 */
+          {(BTA_DM_PM_SNIFF), /* allow sniff */
+           (BTA_DM_PM_SSR2),  /* the SSR entry */
+           {
+               {{BTA_DM_PM_SNIFF, 3000},
+                {BTA_DM_PM_NO_ACTION, 0}}, /* conn open  sniff */
+               {{BTA_DM_PM_NO_PREF, 0},
+                {BTA_DM_PM_NO_ACTION, 0}}, /* conn close  */
+               {{BTA_DM_PM_NO_ACTION, 0},
+                {BTA_DM_PM_NO_ACTION, 0}}, /* app open */
+               {{BTA_DM_PM_NO_ACTION, 0},
+                {BTA_DM_PM_NO_ACTION, 0}}, /* app close */
+               {{BTA_DM_PM_NO_ACTION, 0},
+                {BTA_DM_PM_NO_ACTION, 0}}, /* sco open  */
+               {{BTA_DM_PM_NO_ACTION, 0},
+                {BTA_DM_PM_NO_ACTION, 0}}, /* sco close   */
+               {{BTA_DM_PM_SNIFF4, 3000}, {BTA_DM_PM_NO_ACTION, 0}}, /* idle */
+               {{BTA_DM_PM_ACTIVE, 0}, {BTA_DM_PM_NO_ACTION, 0}},    /* busy */
+               {{BTA_DM_PM_NO_ACTION, 0},
+                {BTA_DM_PM_NO_ACTION, 0}} /* mode change retry */
+           }},
+
+          /* GATTC : 14 */
+          {(BTA_DM_PM_SNIFF | BTA_DM_PM_PARK), /* allow park & sniff */
+           (BTA_DM_PM_SSR2),                   /* the SSR entry */
+           {
+               {{BTA_DM_PM_SNIFF_A2DP_IDX, 10000},
+                {BTA_DM_PM_NO_ACTION, 0}}, /* conn open  active */
+               {{BTA_DM_PM_NO_PREF, 0},
+                {BTA_DM_PM_NO_ACTION, 0}}, /* conn close  */
+               {{BTA_DM_PM_ACTIVE, 0}, {BTA_DM_PM_NO_ACTION, 0}}, /* app open */
+               {{BTA_DM_PM_NO_ACTION, 0},
+                {BTA_DM_PM_NO_ACTION, 0}}, /* app close */
+               {{BTA_DM_PM_NO_ACTION, 0},
+                {BTA_DM_PM_NO_ACTION, 0}}, /* sco open  */
+               {{BTA_DM_PM_NO_ACTION, 0},
+                {BTA_DM_PM_NO_ACTION, 0}}, /* sco close   */
+               {{BTA_DM_PM_SNIFF_A2DP_IDX, 10000},
+                {BTA_DM_PM_NO_ACTION, 0}},                        /* idle */
+               {{BTA_DM_PM_ACTIVE, 0}, {BTA_DM_PM_NO_ACTION, 0}}, /* busy */
+               {{BTA_DM_PM_RETRY, 5000},
+                {BTA_DM_PM_NO_ACTION, 0}} /* mode change retry */
+           }},
+
+          /* GATTS : 15 */
+          {(BTA_DM_PM_SNIFF | BTA_DM_PM_PARK), /* allow park & sniff */
+           (BTA_DM_PM_SSR2),                   /* the SSR entry */
+           {
+               {{BTA_DM_PM_NO_PREF, 0},
+                {BTA_DM_PM_NO_ACTION, 0}}, /* conn open  active */
+               {{BTA_DM_PM_NO_PREF, 0},
+                {BTA_DM_PM_NO_ACTION, 0}}, /* conn close  */
+               {{BTA_DM_PM_NO_PREF, 0},
+                {BTA_DM_PM_NO_ACTION, 0}}, /* app open */
+               {{BTA_DM_PM_NO_PREF, 0},
+                {BTA_DM_PM_NO_ACTION, 0}}, /* app close */
+               {{BTA_DM_PM_NO_PREF, 0},
+                {BTA_DM_PM_NO_ACTION, 0}}, /* sco open  */
+               {{BTA_DM_PM_NO_PREF, 0},
+                {BTA_DM_PM_NO_ACTION, 0}}, /* sco close */
+               {{BTA_DM_PM_NO_PREF, 0}, {BTA_DM_PM_NO_ACTION, 0}}, /* idle */
+               {{BTA_DM_PM_NO_PREF, 0}, {BTA_DM_PM_NO_ACTION, 0}}, /* busy */
+               {{BTA_DM_PM_RETRY, 5000},
+                {BTA_DM_PM_NO_ACTION, 0}} /* mode change retry */
+           }}
 
 #ifdef BTE_SIM_APP /* For Insight builds only */
-    /* Entries at the end of the pm_spec table are user-defined (runtime
-       configurable),
-       for power consumption experiments.
-       Insight finds the first user-defined entry by looking for the first
-       BTA_DM_PM_NO_PREF.
-       The number of user_defined specs is defined by
-       BTA_SWRAP_UD_PM_SPEC_COUNT */
-    ,
-    {BTA_DM_PM_NO_PREF}, /* pm_spec USER_DEFINED_0 */
-    {BTA_DM_PM_NO_PREF}  /* pm_spec USER_DEFINED_1 */
+          /* Entries at the end of the pm_spec table are user-defined (runtime
+             configurable),
+             for power consumption experiments.
+             Insight finds the first user-defined entry by looking for the first
+             BTA_DM_PM_NO_PREF.
+             The number of user_defined specs is defined by
+             BTA_SWRAP_UD_PM_SPEC_COUNT */
+          ,
+          {BTA_DM_PM_NO_PREF}, /* pm_spec USER_DEFINED_0 */
+          {BTA_DM_PM_NO_PREF}  /* pm_spec USER_DEFINED_1 */
 #endif                   /* BTE_SIM_APP */
-};
+      };
+  return bta_dm_pm_spec;
+}
 
 /* Please refer to the SNIFF table definitions in bta_api.h.
  *
@@ -541,7 +604,6 @@
 tBTA_DM_SSR_SPEC* p_bta_dm_ssr_spec = &bta_dm_ssr_spec[0];
 
 const tBTA_DM_PM_CFG* p_bta_dm_pm_cfg = &bta_dm_pm_cfg[0];
-const tBTA_DM_PM_SPEC* p_bta_dm_pm_spec = &bta_dm_pm_spec[0];
 const tBTM_PM_PWR_MD* p_bta_dm_pm_md = &bta_dm_pm_md[0];
 
 /* The performance impact of EIR packet size
diff --git a/system/bta/dm/bta_dm_int.h b/system/bta/dm/bta_dm_int.h
index d952dcc..7acec5d 100644
--- a/system/bta/dm/bta_dm_int.h
+++ b/system/bta/dm/bta_dm_int.h
@@ -61,7 +61,7 @@
 #define BTA_SERVICE_ID_TO_SERVICE_MASK(id) (1 << (id))
 
 /* DM search events */
-enum {
+typedef enum : uint16_t {
   /* DM search API events */
   BTA_DM_API_SEARCH_EVT = BTA_SYS_EVT_START(BTA_ID_DM_SEARCH),
   BTA_DM_API_DISCOVER_EVT,
@@ -71,7 +71,22 @@
   BTA_DM_SEARCH_CMPL_EVT,
   BTA_DM_DISCOVERY_RESULT_EVT,
   BTA_DM_DISC_CLOSE_TOUT_EVT,
-};
+} tBTA_DM_EVT;
+
+inline std::string bta_dm_event_text(const tBTA_DM_EVT& event) {
+  switch (event) {
+    CASE_RETURN_TEXT(BTA_DM_API_SEARCH_EVT);
+    CASE_RETURN_TEXT(BTA_DM_API_DISCOVER_EVT);
+    CASE_RETURN_TEXT(BTA_DM_INQUIRY_CMPL_EVT);
+    CASE_RETURN_TEXT(BTA_DM_REMT_NAME_EVT);
+    CASE_RETURN_TEXT(BTA_DM_SDP_RESULT_EVT);
+    CASE_RETURN_TEXT(BTA_DM_SEARCH_CMPL_EVT);
+    CASE_RETURN_TEXT(BTA_DM_DISCOVERY_RESULT_EVT);
+    CASE_RETURN_TEXT(BTA_DM_DISC_CLOSE_TOUT_EVT);
+    default:
+      return base::StringPrintf("UNKNOWN[0x%04x]", event);
+  }
+}
 
 /* data type for BTA_DM_API_SEARCH_EVT */
 typedef struct {
@@ -381,14 +396,25 @@
 } tBTA_DM_DI_CB;
 
 /* DM search state */
-enum {
+typedef enum {
 
   BTA_DM_SEARCH_IDLE,
   BTA_DM_SEARCH_ACTIVE,
   BTA_DM_SEARCH_CANCELLING,
   BTA_DM_DISCOVER_ACTIVE
 
-};
+} tBTA_DM_STATE;
+
+inline std::string bta_dm_state_text(const tBTA_DM_STATE& state) {
+  switch (state) {
+    CASE_RETURN_TEXT(BTA_DM_SEARCH_IDLE);
+    CASE_RETURN_TEXT(BTA_DM_SEARCH_ACTIVE);
+    CASE_RETURN_TEXT(BTA_DM_SEARCH_CANCELLING);
+    CASE_RETURN_TEXT(BTA_DM_DISCOVER_ACTIVE);
+    default:
+      return base::StringPrintf("UNKNOWN[%d]", state);
+  }
+}
 
 typedef struct {
   uint16_t page_timeout; /* timeout for page in slots */
@@ -444,8 +470,16 @@
 
 extern const uint16_t bta_service_id_to_uuid_lkup_tbl[];
 
+/* For Insight, PM cfg lookup tables are runtime configurable (to allow tweaking
+ * of params for power consumption measurements) */
+#ifndef BTE_SIM_APP
+#define tBTA_DM_PM_TYPE_QUALIFIER const
+#else
+#define tBTA_DM_PM_TYPE_QUALIFIER
+#endif
+
 extern const tBTA_DM_PM_CFG* p_bta_dm_pm_cfg;
-extern const tBTA_DM_PM_SPEC* p_bta_dm_pm_spec;
+tBTA_DM_PM_TYPE_QUALIFIER tBTA_DM_PM_SPEC* get_bta_dm_pm_spec();
 extern const tBTM_PM_PWR_MD* p_bta_dm_pm_md;
 extern tBTA_DM_SSR_SPEC* p_bta_dm_ssr_spec;
 
diff --git a/system/bta/dm/bta_dm_main.cc b/system/bta/dm/bta_dm_main.cc
index e844790..59bf00c 100644
--- a/system/bta/dm/bta_dm_main.cc
+++ b/system/bta/dm/bta_dm_main.cc
@@ -61,8 +61,8 @@
  *
  ******************************************************************************/
 bool bta_dm_search_sm_execute(BT_HDR_RIGID* p_msg) {
-  APPL_TRACE_EVENT("bta_dm_search_sm_execute state:%d, event:0x%x",
-                   bta_dm_search_cb.state, p_msg->event);
+  LOG_INFO("bta_dm_search_sm_execute state:%d, event:0x%x",
+           bta_dm_search_get_state(), p_msg->event);
 
   tBTA_DM_MSG* message = (tBTA_DM_MSG*)p_msg;
   switch (bta_dm_search_cb.state) {
@@ -123,6 +123,16 @@
           bta_dm_search_cancel_notify();
           bta_dm_execute_queued_request();
           break;
+        case BTA_DM_DISC_CLOSE_TOUT_EVT:
+          if (bluetooth::common::init_flags::
+                  bta_dm_clear_conn_id_on_client_close_is_enabled()) {
+            bta_dm_close_gatt_conn(message);
+            break;
+          }
+          [[fallthrough]];
+        default:
+          LOG_INFO("Received unexpected event 0x%x in state %d", p_msg->event,
+                   bta_dm_search_cb.state);
       }
       break;
     case BTA_DM_DISCOVER_ACTIVE:
@@ -145,6 +155,16 @@
         case BTA_DM_API_DISCOVER_EVT:
           bta_dm_queue_disc(message);
           break;
+        case BTA_DM_DISC_CLOSE_TOUT_EVT:
+          if (bluetooth::common::init_flags::
+                  bta_dm_clear_conn_id_on_client_close_is_enabled()) {
+            bta_dm_close_gatt_conn(message);
+            break;
+          }
+          [[fallthrough]];
+        default:
+          LOG_INFO("Received unexpected event 0x%x in state %d", p_msg->event,
+                   bta_dm_search_cb.state);
       }
       break;
   }
diff --git a/system/bta/dm/bta_dm_pm.cc b/system/bta/dm/bta_dm_pm.cc
index 504799f..c86329c 100644
--- a/system/bta/dm/bta_dm_pm.cc
+++ b/system/bta/dm/bta_dm_pm.cc
@@ -344,7 +344,8 @@
       break;
   }
 
-  /* if no entries are there for the app_id and subsystem in p_bta_dm_pm_spec*/
+  /* if no entries are there for the app_id and subsystem in
+   * get_bta_dm_pm_spec()*/
   if (i > p_bta_dm_pm_cfg[0].app_id) {
     LOG_DEBUG("Ignoring power management callback as no service entries exist");
     return;
@@ -365,18 +366,18 @@
   int index = BTA_DM_PM_SSR0;
   if ((BTA_SYS_CONN_OPEN == status) && p_dev &&
       (p_dev->Info() & BTA_DM_DI_USE_SSR)) {
-    index = p_bta_dm_pm_spec[p_bta_dm_pm_cfg[i].spec_idx].ssr;
+    index = get_bta_dm_pm_spec()[p_bta_dm_pm_cfg[i].spec_idx].ssr;
   } else if (BTA_ID_AV == id) {
     if (BTA_SYS_CONN_BUSY == status) {
       /* set SSR4 for A2DP on SYS CONN BUSY */
       index = BTA_DM_PM_SSR4;
     } else if (BTA_SYS_CONN_IDLE == status) {
-      index = p_bta_dm_pm_spec[p_bta_dm_pm_cfg[i].spec_idx].ssr;
+      index = get_bta_dm_pm_spec()[p_bta_dm_pm_cfg[i].spec_idx].ssr;
     }
   }
 
   /* if no action for the event */
-  if (p_bta_dm_pm_spec[p_bta_dm_pm_cfg[i].spec_idx]
+  if (get_bta_dm_pm_spec()[p_bta_dm_pm_cfg[i].spec_idx]
           .actn_tbl[status][0]
           .power_mode == BTA_DM_PM_NO_ACTION) {
     if (BTA_DM_PM_SSR0 == index) /* and do not need to set SSR, return. */
@@ -395,7 +396,7 @@
 
   /* if subsystem has no more preference on the power mode remove
  the cb */
-  if (p_bta_dm_pm_spec[p_bta_dm_pm_cfg[i].spec_idx]
+  if (get_bta_dm_pm_spec()[p_bta_dm_pm_cfg[i].spec_idx]
           .actn_tbl[status][0]
           .power_mode == BTA_DM_PM_NO_PREF) {
     if (j != bta_dm_conn_srvcs.count) {
@@ -532,7 +533,7 @@
       }
 
       p_pm_cfg = &p_bta_dm_pm_cfg[j];
-      p_pm_spec = &p_bta_dm_pm_spec[p_pm_cfg->spec_idx];
+      p_pm_spec = &get_bta_dm_pm_spec()[p_pm_cfg->spec_idx];
       p_act0 = &p_pm_spec->actn_tbl[p_srvcs->state][0];
       p_act1 = &p_pm_spec->actn_tbl[p_srvcs->state][1];
 
@@ -781,7 +782,7 @@
     for (int j = 1; j <= p_bta_dm_pm_cfg[0].app_id; j++) {
       /* find the associated p_bta_dm_pm_cfg */
       const tBTA_DM_PM_CFG& config = p_bta_dm_pm_cfg[j];
-      current_ssr_index = p_bta_dm_pm_spec[config.spec_idx].ssr;
+      current_ssr_index = get_bta_dm_pm_spec()[config.spec_idx].ssr;
       if ((config.id == service.id) && ((config.app_id == BTA_ALL_APP_ID) ||
                                         (config.app_id == service.app_id))) {
         LOG_INFO("Found connected service:%s app_id:%d peer:%s spec_name:%s",
diff --git a/system/bta/gatt/bta_gattc_act.cc b/system/bta/gatt/bta_gattc_act.cc
index 783ab69..c9c791a 100644
--- a/system/bta/gatt/bta_gattc_act.cc
+++ b/system/bta/gatt/bta_gattc_act.cc
@@ -34,6 +34,7 @@
 #include "bta/hh/bta_hh_int.h"
 #include "btif/include/btif_debug_conn.h"
 #include "device/include/controller.h"
+#include "device/include/interop.h"
 #include "main/shim/dumpsys.h"
 #include "osi/include/allocator.h"
 #include "osi/include/log.h"
@@ -274,7 +275,7 @@
     return;
   }
 
-  if (!p_msg->api_conn.is_direct) {
+  if (p_msg->api_conn.connection_type != BTM_BLE_DIRECT_CONNECTION) {
     bta_gattc_init_bk_conn(&p_msg->api_conn, p_clreg);
     return;
   }
@@ -377,8 +378,9 @@
   tBTA_GATTC_DATA gattc_data;
 
   /* open/hold a connection */
-  if (!GATT_Connect(p_clcb->p_rcb->client_if, p_data->api_conn.remote_bda, true,
-                    p_data->api_conn.transport, p_data->api_conn.opportunistic,
+  if (!GATT_Connect(p_clcb->p_rcb->client_if, p_data->api_conn.remote_bda,
+                    BTM_BLE_DIRECT_CONNECTION, p_data->api_conn.transport,
+                    p_data->api_conn.opportunistic,
                     p_data->api_conn.initiating_phys)) {
     LOG(ERROR) << "Connection open failure";
     bta_gattc_sm_execute(p_clcb, BTA_GATTC_INT_OPEN_FAIL_EVT, p_data);
@@ -417,8 +419,8 @@
   }
 
   /* always call open to hold a connection */
-  if (!GATT_Connect(p_data->client_if, p_data->remote_bda, false,
-                    p_data->transport, false)) {
+  if (!GATT_Connect(p_data->client_if, p_data->remote_bda,
+                    p_data->connection_type, p_data->transport, false)) {
     LOG_ERROR("Unable to connect to remote bd_addr=%s",
               p_data->remote_bda.ToString().c_str());
     bta_gattc_send_open_cback(p_clreg, GATT_ERROR, p_data->remote_bda,
@@ -536,12 +538,9 @@
       p_clcb->p_srcb->state != BTA_GATTC_SERV_IDLE) {
     if (p_clcb->p_srcb->state == BTA_GATTC_SERV_IDLE) {
       p_clcb->p_srcb->state = BTA_GATTC_SERV_LOAD;
-      // Consider the case that if GATT Server is changed, but no service
-      // changed indication is received, the database might be out of date. So
-      // if robust caching is enabled, any time when connection is established,
-      // always check the db hash first, not just load the stored database.
+      // For bonded devices, read cache directly, and back to connected state.
       gatt::Database db = bta_gattc_cache_load(p_clcb->p_srcb->server_bda);
-      if (!bta_gattc_is_robust_caching_enabled() && !db.IsEmpty()) {
+      if (!db.IsEmpty() && btm_sec_is_a_bonded_dev(p_clcb->p_srcb->server_bda)) {
         p_clcb->p_srcb->gatt_database = db;
         p_clcb->p_srcb->state = BTA_GATTC_SERV_IDLE;
         bta_gattc_reset_discover_st(p_clcb->p_srcb, GATT_SUCCESS);
@@ -597,6 +596,7 @@
     cb_data.close.conn_id = p_data->hdr.layer_specific;
     cb_data.close.remote_bda = p_clcb->bda;
     cb_data.close.reason = BTA_GATT_CONN_NONE;
+    cb_data.close.status = GATT_ERROR;
 
     LOG(WARNING) << __func__ << ": conn_id=" << loghex(cb_data.close.conn_id)
                  << ". Returns GATT_ERROR(" << +GATT_ERROR << ").";
@@ -632,10 +632,22 @@
     }
   }
 
+  if (p_data->hdr.event == BTA_GATTC_INT_DISCONN_EVT) {
+    /* Since link has been disconnected by and it is possible that here are
+     * already some new p_clcb created for the background connect, the number of
+     * p_srcb->num_clcb is NOT 0. This will prevent p_srcb to be cleared inside
+     * the bta_gattc_clcb_dealloc.
+     *
+     * In this point of time, we know that link does not exist, so let's make
+     * sure the connection state, mtu and database is cleared.
+     */
+    bta_gattc_server_disconnected(p_clcb->p_srcb);
+  }
+
   bta_gattc_clcb_dealloc(p_clcb);
 
   if (p_data->hdr.event == BTA_GATTC_API_CLOSE_EVT) {
-    GATT_Disconnect(p_data->hdr.layer_specific);
+    cb_data.close.status = GATT_Disconnect(p_data->hdr.layer_specific);
     cb_data.close.reason = GATT_CONN_TERMINATE_LOCAL_HOST;
     LOG_DEBUG("Local close event client_if:%hu conn_id:%hu reason:%s",
               cb_data.close.client_if, cb_data.close.conn_id,
@@ -643,6 +655,7 @@
                   static_cast<tGATT_DISCONN_REASON>(cb_data.close.reason))
                   .c_str());
   } else if (p_data->hdr.event == BTA_GATTC_INT_DISCONN_EVT) {
+    cb_data.close.status = static_cast<tGATT_STATUS>(p_data->int_conn.reason);
     cb_data.close.reason = p_data->int_conn.reason;
     LOG_DEBUG("Peer close disconnect event client_if:%hu conn_id:%hu reason:%s",
               cb_data.close.client_if, cb_data.close.conn_id,
@@ -714,7 +727,7 @@
 
 /** Configure MTU size on the GATT connection */
 void bta_gattc_cfg_mtu(tBTA_GATTC_CLCB* p_clcb, const tBTA_GATTC_DATA* p_data) {
-  if (!bta_gattc_enqueue(p_clcb, p_data)) return;
+  if (bta_gattc_enqueue(p_clcb, p_data) == ENQUEUED_FOR_LATER) return;
 
   tGATT_STATUS status =
       GATTC_ConfigureMTU(p_clcb->bta_conn_id, p_data->api_mtu.mtu);
@@ -726,6 +739,7 @@
 
     bta_gattc_cmpl_sendmsg(p_clcb->bta_conn_id, GATTC_OPTYPE_CONFIG, status,
                            NULL);
+    bta_gattc_continue(p_clcb);
   }
 }
 
@@ -771,6 +785,38 @@
       p_clcb->p_srcb->update_count = 0;
       p_clcb->p_srcb->state = BTA_GATTC_SERV_DISC_ACT;
 
+      /* This is workaround for the embedded devices being already on the market
+       * and having a serious problem with handle Read By Type with
+       * GATT_UUID_DATABASE_HASH. With this workaround, Android will assume that
+       * embedded device having LMP version lower than 5.1 (0x0a), it does not
+       * support GATT Caching.
+       */
+      uint8_t lmp_version = 0;
+      if (!BTM_ReadRemoteVersion(p_clcb->bda, &lmp_version, nullptr, nullptr)) {
+        LOG_WARN("Could not read remote version for %s",
+                 p_clcb->bda.ToString().c_str());
+      }
+
+      if (lmp_version < 0x0a) {
+        LOG_WARN(
+            " Device LMP version 0x%02x < Bluetooth 5.1. Ignore database cache "
+            "read.",
+            lmp_version);
+        p_clcb->p_srcb->srvc_hdl_db_hash = false;
+      }
+
+      // Some LMP 5.2 devices also don't support robust caching. This workaround
+      // conditionally disables the feature based on a combination of LMP
+      // version and OUI prefix.
+      if (lmp_version < 0x0c &&
+          interop_match_addr(INTEROP_DISABLE_ROBUST_CACHING, &p_clcb->bda)) {
+        LOG_WARN(
+            "Device LMP version 0x%02x <= Bluetooth 5.2 and MAC addr on "
+            "interop list, skipping robust caching",
+            lmp_version);
+        p_clcb->p_srcb->srvc_hdl_db_hash = false;
+      }
+
       /* read db hash if db hash characteristic exists */
       if (bta_gattc_is_robust_caching_enabled() &&
           p_clcb->p_srcb->srvc_hdl_db_hash &&
@@ -838,6 +884,8 @@
      * referenced by p_clcb->p_q_cmd
      */
     if (p_q_cmd != p_clcb->p_q_cmd) osi_free_and_reset((void**)&p_q_cmd);
+  } else {
+    bta_gattc_continue(p_clcb);
   }
 
   if (p_clcb->p_rcb->p_cback) {
@@ -849,7 +897,7 @@
 
 /** Read an attribute */
 void bta_gattc_read(tBTA_GATTC_CLCB* p_clcb, const tBTA_GATTC_DATA* p_data) {
-  if (!bta_gattc_enqueue(p_clcb, p_data)) return;
+  if (bta_gattc_enqueue(p_clcb, p_data) == ENQUEUED_FOR_LATER) return;
 
   tGATT_STATUS status;
   if (p_data->api_read.handle != 0) {
@@ -876,13 +924,14 @@
 
     bta_gattc_cmpl_sendmsg(p_clcb->bta_conn_id, GATTC_OPTYPE_READ, status,
                            NULL);
+    bta_gattc_continue(p_clcb);
   }
 }
 
 /** read multiple */
 void bta_gattc_read_multi(tBTA_GATTC_CLCB* p_clcb,
                           const tBTA_GATTC_DATA* p_data) {
-  if (!bta_gattc_enqueue(p_clcb, p_data)) return;
+  if (bta_gattc_enqueue(p_clcb, p_data) == ENQUEUED_FOR_LATER) return;
 
   tGATT_READ_PARAM read_param;
   memset(&read_param, 0, sizeof(tGATT_READ_PARAM));
@@ -901,12 +950,13 @@
 
     bta_gattc_cmpl_sendmsg(p_clcb->bta_conn_id, GATTC_OPTYPE_READ, status,
                            NULL);
+    bta_gattc_continue(p_clcb);
   }
 }
 
 /** Write an attribute */
 void bta_gattc_write(tBTA_GATTC_CLCB* p_clcb, const tBTA_GATTC_DATA* p_data) {
-  if (!bta_gattc_enqueue(p_clcb, p_data)) return;
+  if (bta_gattc_enqueue(p_clcb, p_data) == ENQUEUED_FOR_LATER) return;
 
   tGATT_STATUS status = GATT_SUCCESS;
   tGATT_VALUE attr;
@@ -930,12 +980,13 @@
 
     bta_gattc_cmpl_sendmsg(p_clcb->bta_conn_id, GATTC_OPTYPE_WRITE, status,
                            NULL);
+    bta_gattc_continue(p_clcb);
   }
 }
 
 /** send execute write */
 void bta_gattc_execute(tBTA_GATTC_CLCB* p_clcb, const tBTA_GATTC_DATA* p_data) {
-  if (!bta_gattc_enqueue(p_clcb, p_data)) return;
+  if (bta_gattc_enqueue(p_clcb, p_data) == ENQUEUED_FOR_LATER) return;
 
   tGATT_STATUS status =
       GATTC_ExecuteWrite(p_clcb->bta_conn_id, p_data->api_exec.is_execute);
@@ -945,6 +996,7 @@
 
     bta_gattc_cmpl_sendmsg(p_clcb->bta_conn_id, GATTC_OPTYPE_EXE_WRITE, status,
                            NULL);
+    bta_gattc_continue(p_clcb);
   }
 }
 
diff --git a/system/bta/gatt/bta_gattc_api.cc b/system/bta/gatt/bta_gattc_api.cc
index dafe028..5791875 100644
--- a/system/bta/gatt/bta_gattc_api.cc
+++ b/system/bta/gatt/bta_gattc_api.cc
@@ -119,7 +119,7 @@
  *
  * Parameters       client_if: server interface.
  *                  remote_bda: remote device BD address.
- *                  is_direct: direct connection or background auto connection
+ *                  connection_type: connection type used for the peer device
  *                  transport: Transport to be used for GATT connection
  *                             (BREDR/LE)
  *                  initiating_phys: LE PHY to use, optional
@@ -128,15 +128,15 @@
  *
  ******************************************************************************/
 void BTA_GATTC_Open(tGATT_IF client_if, const RawAddress& remote_bda,
-                    bool is_direct, bool opportunistic) {
+                    tBTM_BLE_CONN_TYPE connection_type, bool opportunistic) {
   uint8_t phy = controller_get_interface()->get_le_all_initiating_phys();
-  BTA_GATTC_Open(client_if, remote_bda, is_direct, BT_TRANSPORT_LE,
+  BTA_GATTC_Open(client_if, remote_bda, connection_type, BT_TRANSPORT_LE,
                  opportunistic, phy);
 }
 
 void BTA_GATTC_Open(tGATT_IF client_if, const RawAddress& remote_bda,
-                    bool is_direct, tBT_TRANSPORT transport, bool opportunistic,
-                    uint8_t initiating_phys) {
+                    tBTM_BLE_CONN_TYPE connection_type, tBT_TRANSPORT transport,
+                    bool opportunistic, uint8_t initiating_phys) {
   tBTA_GATTC_DATA data = {
       .api_conn =
           {
@@ -146,7 +146,7 @@
                   },
               .remote_bda = remote_bda,
               .client_if = client_if,
-              .is_direct = is_direct,
+              .connection_type = connection_type,
               .transport = transport,
               .initiating_phys = initiating_phys,
               .opportunistic = opportunistic,
diff --git a/system/bta/gatt/bta_gattc_cache.cc b/system/bta/gatt/bta_gattc_cache.cc
index a477e1f..0123908 100644
--- a/system/bta/gatt/bta_gattc_cache.cc
+++ b/system/bta/gatt/bta_gattc_cache.cc
@@ -313,6 +313,7 @@
         !GATT_HANDLE_IS_VALID(end_handle)) {
       LOG(ERROR) << "invalid start_handle=" << loghex(start_handle)
                  << ", end_handle=" << loghex(end_handle);
+      p_sdp_rec = SDP_FindServiceInDb(cb_data->p_sdp_db, 0, p_sdp_rec);
       continue;
     }
 
diff --git a/system/bta/gatt/bta_gattc_int.h b/system/bta/gatt/bta_gattc_int.h
index 1df5e53..ef70b83 100644
--- a/system/bta/gatt/bta_gattc_int.h
+++ b/system/bta/gatt/bta_gattc_int.h
@@ -25,6 +25,7 @@
 #define BTA_GATTC_INT_H
 
 #include <cstdint>
+#include <deque>
 
 #include "bt_target.h"  // Must be first to define build configuration
 #include "bta/gatt/database.h"
@@ -88,13 +89,21 @@
   BT_HDR_RIGID hdr;
   RawAddress remote_bda;
   tGATT_IF client_if;
-  bool is_direct;
+  tBTM_BLE_CONN_TYPE connection_type;
   tBT_TRANSPORT transport;
   uint8_t initiating_phys;
   bool opportunistic;
 } tBTA_GATTC_API_OPEN;
 
-typedef tBTA_GATTC_API_OPEN tBTA_GATTC_API_CANCEL_OPEN;
+typedef struct {
+  BT_HDR_RIGID hdr;
+  RawAddress remote_bda;
+  tGATT_IF client_if;
+  bool is_direct;
+  tBT_TRANSPORT transport;
+  uint8_t initiating_phys;
+  bool opportunistic;
+} tBTA_GATTC_API_CANCEL_OPEN;
 
 typedef struct {
   BT_HDR_RIGID hdr;
@@ -254,6 +263,7 @@
   tBTA_GATTC_RCB* p_rcb;    /* pointer to the registration CB */
   tBTA_GATTC_SERV* p_srcb;  /* server cache CB */
   const tBTA_GATTC_DATA* p_q_cmd; /* command in queue waiting for execution */
+  std::deque<const tBTA_GATTC_DATA*> p_q_cmd_queue;
 
 // request during discover state
 #define BTA_GATTC_DISCOVER_REQ_NONE 0
@@ -413,6 +423,7 @@
                                              const RawAddress& remote_bda,
                                              tBT_TRANSPORT transport);
 extern void bta_gattc_clcb_dealloc(tBTA_GATTC_CLCB* p_clcb);
+extern void bta_gattc_server_disconnected(tBTA_GATTC_SERV* p_srcb);
 extern tBTA_GATTC_CLCB* bta_gattc_find_alloc_clcb(tGATT_IF client_if,
                                                   const RawAddress& remote_bda,
                                                   tBT_TRANSPORT transport);
@@ -423,8 +434,16 @@
 extern tBTA_GATTC_CLCB* bta_gattc_find_int_conn_clcb(tBTA_GATTC_DATA* p_msg);
 extern tBTA_GATTC_CLCB* bta_gattc_find_int_disconn_clcb(tBTA_GATTC_DATA* p_msg);
 
-extern bool bta_gattc_enqueue(tBTA_GATTC_CLCB* p_clcb,
-                              const tBTA_GATTC_DATA* p_data);
+enum BtaEnqueuedResult_t {
+  ENQUEUED_READY_TO_SEND,
+  ENQUEUED_FOR_LATER,
+};
+
+extern BtaEnqueuedResult_t bta_gattc_enqueue(tBTA_GATTC_CLCB* p_clcb,
+                                             const tBTA_GATTC_DATA* p_data);
+extern bool bta_gattc_is_data_queued(tBTA_GATTC_CLCB* p_clcb,
+                                     const tBTA_GATTC_DATA* p_data);
+extern void bta_gattc_continue(tBTA_GATTC_CLCB* p_clcb);
 
 extern bool bta_gattc_check_notif_registry(tBTA_GATTC_RCB* p_clreg,
                                            tBTA_GATTC_SERV* p_srcb,
diff --git a/system/bta/gatt/bta_gattc_main.cc b/system/bta/gatt/bta_gattc_main.cc
index bba20b5..b624c5a 100644
--- a/system/bta/gatt/bta_gattc_main.cc
+++ b/system/bta/gatt/bta_gattc_main.cc
@@ -328,7 +328,7 @@
     action = state_table[event][i];
     if (action != BTA_GATTC_IGNORE) {
       (*bta_gattc_action[action])(p_clcb, p_data);
-      if (p_clcb->p_q_cmd == p_data) {
+      if (bta_gattc_is_data_queued(p_clcb, p_data)) {
         /* buffer is queued, don't free in the bta dispatcher.
          * we free it ourselves when a completion event is received.
          */
diff --git a/system/bta/gatt/bta_gattc_utils.cc b/system/bta/gatt/bta_gattc_utils.cc
index 1412702..2861873 100644
--- a/system/bta/gatt/bta_gattc_utils.cc
+++ b/system/bta/gatt/bta_gattc_utils.cc
@@ -24,6 +24,8 @@
 
 #define LOG_TAG "bt_bta_gattc"
 
+#include <base/logging.h>
+
 #include <cstdint>
 
 #include "bt_target.h"  // Must be first to define build configuration
@@ -31,12 +33,11 @@
 #include "device/include/controller.h"
 #include "gd/common/init_flags.h"
 #include "osi/include/allocator.h"
+#include "osi/include/log.h"
 #include "types/bt_transport.h"
 #include "types/hci_role.h"
 #include "types/raw_address.h"
 
-#include <base/logging.h>
-
 static uint8_t ble_acceptlist_size() {
   const controller_t* controller = controller_get_interface();
   if (!controller->supports_ble()) {
@@ -146,6 +147,7 @@
       p_clcb->status = GATT_SUCCESS;
       p_clcb->transport = transport;
       p_clcb->bda = remote_bda;
+      p_clcb->p_q_cmd = NULL;
 
       p_clcb->p_rcb = bta_gattc_cl_get_regcb(client_if);
 
@@ -189,6 +191,26 @@
 
 /*******************************************************************************
  *
+ * Function         bta_gattc_server_disconnected
+ *
+ * Description      Set server cache disconnected
+ *
+ * Returns          pointer to the srcb
+ *
+ ******************************************************************************/
+void bta_gattc_server_disconnected(tBTA_GATTC_SERV* p_srcb) {
+  if (p_srcb && p_srcb->connected) {
+    p_srcb->connected = false;
+    p_srcb->state = BTA_GATTC_SERV_IDLE;
+    p_srcb->mtu = 0;
+
+    // clear reallocating
+    p_srcb->gatt_database.Clear();
+  }
+}
+
+/*******************************************************************************
+ *
  * Function         bta_gattc_clcb_dealloc
  *
  * Description      Deallocte a clcb
@@ -217,8 +239,29 @@
     p_srcb->gatt_database.Clear();
   }
 
-  osi_free_and_reset((void**)&p_clcb->p_q_cmd);
-  memset(p_clcb, 0, sizeof(tBTA_GATTC_CLCB));
+  while (!p_clcb->p_q_cmd_queue.empty()) {
+    auto p_q_cmd = p_clcb->p_q_cmd_queue.front();
+    p_clcb->p_q_cmd_queue.pop_front();
+    osi_free_and_reset((void**)&p_q_cmd);
+  }
+
+  if (p_clcb->p_q_cmd != NULL) {
+    osi_free_and_reset((void**)&p_clcb->p_q_cmd);
+  }
+
+  /* Clear p_clcb. Some of the fields are already reset e.g. p_q_cmd_queue and
+   * p_q_cmd. */
+  p_clcb->bta_conn_id = 0;
+  p_clcb->bda = {};
+  p_clcb->transport = 0;
+  p_clcb->p_rcb = NULL;
+  p_clcb->p_srcb = NULL;
+  p_clcb->request_during_discovery = 0;
+  p_clcb->auto_update = 0;
+  p_clcb->disc_active = 0;
+  p_clcb->in_use = 0;
+  p_clcb->state = BTA_GATTC_IDLE_ST;
+  p_clcb->status = GATT_SUCCESS;
 }
 
 /*******************************************************************************
@@ -315,24 +358,57 @@
   }
   return p_tcb;
 }
+
+void bta_gattc_continue(tBTA_GATTC_CLCB* p_clcb) {
+  if (p_clcb->p_q_cmd != NULL) {
+    LOG_INFO("Already scheduled another request for conn_id = 0x%04x",
+             p_clcb->bta_conn_id);
+    return;
+  }
+
+  if (p_clcb->p_q_cmd_queue.empty()) {
+    LOG_INFO("Nothing to do for conn_id = 0x%04x", p_clcb->bta_conn_id);
+    return;
+  }
+
+  const tBTA_GATTC_DATA* p_q_cmd = p_clcb->p_q_cmd_queue.front();
+  p_clcb->p_q_cmd_queue.pop_front();
+  bta_gattc_sm_execute(p_clcb, p_q_cmd->hdr.event, p_q_cmd);
+}
+
+bool bta_gattc_is_data_queued(tBTA_GATTC_CLCB* p_clcb,
+                              const tBTA_GATTC_DATA* p_data) {
+  if (p_clcb->p_q_cmd == p_data) {
+    return true;
+  }
+
+  auto it = std::find(p_clcb->p_q_cmd_queue.begin(),
+                      p_clcb->p_q_cmd_queue.end(), p_data);
+  return it != p_clcb->p_q_cmd_queue.end();
+}
 /*******************************************************************************
  *
  * Function         bta_gattc_enqueue
  *
  * Description      enqueue a client request in clcb.
  *
- * Returns          success or failure.
+ * Returns          BtaEnqueuedResult_t
  *
  ******************************************************************************/
-bool bta_gattc_enqueue(tBTA_GATTC_CLCB* p_clcb, const tBTA_GATTC_DATA* p_data) {
+BtaEnqueuedResult_t bta_gattc_enqueue(tBTA_GATTC_CLCB* p_clcb,
+                                      const tBTA_GATTC_DATA* p_data) {
   if (p_clcb->p_q_cmd == NULL) {
     p_clcb->p_q_cmd = p_data;
-    return true;
+    return ENQUEUED_READY_TO_SEND;
   }
 
-  LOG(ERROR) << __func__ << ": already has a pending command";
-  /* skip the callback now. ----- need to send callback ? */
-  return false;
+  LOG_INFO(
+      "Already has a pending command to executer. Queuing for later %s conn "
+      "id=0x%04x",
+      p_clcb->bda.ToString().c_str(), p_clcb->bta_conn_id);
+  p_clcb->p_q_cmd_queue.push_back(p_data);
+
+  return ENQUEUED_FOR_LATER;
 }
 
 /*******************************************************************************
diff --git a/system/bta/gatt/bta_gatts_act.cc b/system/bta/gatt/bta_gatts_act.cc
index 3cd143d..800fbf0 100644
--- a/system/bta/gatt/bta_gatts_act.cc
+++ b/system/bta/gatt/bta_gatts_act.cc
@@ -120,6 +120,8 @@
 
     p_cb->enabled = true;
 
+    gatt_load_bonded();
+
     if (!GATTS_NVRegister(&bta_gatts_nv_cback)) {
       LOG(ERROR) << "BTA GATTS NV register failed.";
     }
@@ -420,7 +422,7 @@
   if (p_rcb != NULL) {
     /* should always get the connection ID */
     if (GATT_Connect(p_rcb->gatt_if, p_msg->api_open.remote_bda,
-                     p_msg->api_open.is_direct, p_msg->api_open.transport,
+                     p_msg->api_open.connection_type, p_msg->api_open.transport,
                      false)) {
       status = GATT_SUCCESS;
 
diff --git a/system/bta/gatt/bta_gatts_api.cc b/system/bta/gatt/bta_gatts_api.cc
index b3769ac..5c69ab4 100644
--- a/system/bta/gatt/bta_gatts_api.cc
+++ b/system/bta/gatt/bta_gatts_api.cc
@@ -317,7 +317,11 @@
 
   p_buf->hdr.event = BTA_GATTS_API_OPEN_EVT;
   p_buf->server_if = server_if;
-  p_buf->is_direct = is_direct;
+  if (is_direct) {
+    p_buf->connection_type = BTM_BLE_DIRECT_CONNECTION;
+  } else {
+    p_buf->connection_type = BTM_BLE_BKG_CONNECT_ALLOW_LIST;
+  }
   p_buf->transport = transport;
   p_buf->remote_bda = remote_bda;
 
@@ -370,3 +374,11 @@
 
   bta_sys_sendmsg(p_buf);
 }
+
+void BTA_GATTS_InitBonded(void) {
+  LOG(INFO) << __func__;
+
+  BT_HDR_RIGID* p_buf = (BT_HDR_RIGID*)osi_malloc(sizeof(BT_HDR_RIGID));
+  p_buf->event = BTA_GATTS_API_INIT_BONDED_EVT;
+  bta_sys_sendmsg(p_buf);
+}
diff --git a/system/bta/gatt/bta_gatts_int.h b/system/bta/gatt/bta_gatts_int.h
index 74f5a2d..7672130 100644
--- a/system/bta/gatt/bta_gatts_int.h
+++ b/system/bta/gatt/bta_gatts_int.h
@@ -51,7 +51,9 @@
   BTA_GATTS_API_OPEN_EVT,
   BTA_GATTS_API_CANCEL_OPEN_EVT,
   BTA_GATTS_API_CLOSE_EVT,
-  BTA_GATTS_API_DISABLE_EVT
+  BTA_GATTS_API_DISABLE_EVT,
+
+  BTA_GATTS_API_INIT_BONDED_EVT,
 };
 typedef uint16_t tBTA_GATTS_INT_EVT;
 
@@ -107,12 +109,17 @@
   BT_HDR_RIGID hdr;
   RawAddress remote_bda;
   tGATT_IF server_if;
-  bool is_direct;
+  tBTM_BLE_CONN_TYPE connection_type;
   tBT_TRANSPORT transport;
-
 } tBTA_GATTS_API_OPEN;
 
-typedef tBTA_GATTS_API_OPEN tBTA_GATTS_API_CANCEL_OPEN;
+typedef struct {
+  BT_HDR_RIGID hdr;
+  RawAddress remote_bda;
+  tGATT_IF server_if;
+  bool is_direct;
+  tBT_TRANSPORT transport;
+} tBTA_GATTS_API_CANCEL_OPEN;
 
 typedef union {
   BT_HDR_RIGID hdr;
diff --git a/system/bta/gatt/bta_gatts_main.cc b/system/bta/gatt/bta_gatts_main.cc
index 97e9a3d..458f5e2 100644
--- a/system/bta/gatt/bta_gatts_main.cc
+++ b/system/bta/gatt/bta_gatts_main.cc
@@ -105,6 +105,10 @@
       break;
     }
 
+    case BTA_GATTS_API_INIT_BONDED_EVT:
+      gatt_load_bonded();
+      break;
+
     default:
       break;
   }
diff --git a/system/bta/has/has_client.cc b/system/bta/has/has_client.cc
index 875a41c..02d0a23 100644
--- a/system/bta/has/has_client.cc
+++ b/system/bta/has/has_client.cc
@@ -39,6 +39,7 @@
 #include "gap_api.h"
 #include "gatt_api.h"
 #include "has_types.h"
+#include "osi/include/log.h"
 #include "osi/include/osi.h"
 #include "osi/include/properties.h"
 
@@ -83,6 +84,7 @@
                                            uint8_t features);
 void btif_storage_set_leaudio_has_active_preset(const RawAddress& address,
                                                 uint8_t active_preset);
+void btif_storage_remove_leaudio_has(const RawAddress& address);
 
 extern bool gatt_profile_get_eatt_support(const RawAddress& remote_bda);
 
@@ -165,11 +167,12 @@
                                  HasDevice::MatchAddress(addr));
       if (device == devices_.end()) {
         devices_.emplace_back(addr, true);
-        BTA_GATTC_Open(gatt_if_, addr, true, false);
+        BTA_GATTC_Open(gatt_if_, addr, BTM_BLE_DIRECT_CONNECTION, false);
 
       } else {
         device->is_connecting_actively = true;
-        if (!device->IsConnected()) BTA_GATTC_Open(gatt_if_, addr, true, false);
+        if (!device->IsConnected())
+          BTA_GATTC_Open(gatt_if_, addr, BTM_BLE_DIRECT_CONNECTION, false);
       }
     }
   }
@@ -189,7 +192,7 @@
         devices_.push_back(HasDevice(address, features));
 
       /* Connect in background */
-      BTA_GATTC_Open(gatt_if_, address, false, false);
+      BTA_GATTC_Open(gatt_if_, address, BTM_BLE_BKG_CONNECT_ALLOW_LIST, false);
     }
   }
 
@@ -307,6 +310,11 @@
     auto op = op_opt.value();
     callbacks_->OnActivePresetSelectError(op.addr_or_group,
                                           GattStatus2SvcErrorCode(status));
+
+    if (status == GATT_DATABASE_OUT_OF_SYNC) {
+      LOG_INFO("Database out of sync for %s", device->addr.ToString().c_str());
+      ClearDeviceInformationAndStartSearch(device);
+    }
   }
 
   void OnHasPresetNameSetStatus(uint16_t conn_id, tGATT_STATUS status,
@@ -337,6 +345,10 @@
     auto op = op_opt.value();
     callbacks_->OnSetPresetNameError(device->addr, op.index,
                                      GattStatus2SvcErrorCode(status));
+    if (status == GATT_DATABASE_OUT_OF_SYNC) {
+      LOG_INFO("Database out of sync for %s", device->addr.ToString().c_str());
+      ClearDeviceInformationAndStartSearch(device);
+    }
   }
 
   void OnHasPresetNameGetStatus(uint16_t conn_id, tGATT_STATUS status,
@@ -364,6 +376,15 @@
     auto op = op_opt.value();
     callbacks_->OnPresetInfoError(device->addr, op.index,
                                   GattStatus2SvcErrorCode(status));
+
+    if (status == GATT_DATABASE_OUT_OF_SYNC) {
+      LOG_INFO("Database out of sync for %s", device->addr.ToString().c_str());
+      ClearDeviceInformationAndStartSearch(device);
+    } else {
+      LOG_ERROR("Devices %s: Control point not usable. Disconnecting!",
+                device->addr.ToString().c_str());
+      BTA_GATTC_Close(device->conn_id);
+    }
   }
 
   void OnHasPresetIndexOperation(uint16_t conn_id, tGATT_STATUS status,
@@ -403,6 +424,15 @@
       callbacks_->OnActivePresetSelectError(op.addr_or_group,
                                             GattStatus2SvcErrorCode(status));
     }
+
+    if (status == GATT_DATABASE_OUT_OF_SYNC) {
+      LOG_INFO("Database out of sync for %s", device->addr.ToString().c_str());
+      ClearDeviceInformationAndStartSearch(device);
+    } else {
+      LOG_ERROR("Devices %s: Control point not usable. Disconnecting!",
+                device->addr.ToString().c_str());
+      BTA_GATTC_Close(device->conn_id);
+    }
   }
 
   void CpReadAllPresetsOperation(HasCtpOp operation) {
@@ -890,6 +920,36 @@
   }
 
  private:
+  void WriteAllNeededCcc(const HasDevice& device) {
+    if (device.conn_id == GATT_INVALID_CONN_ID) {
+      LOG_ERROR("Device %s is not connected", device.addr.ToString().c_str());
+      return;
+    }
+
+    /* Write CCC values even remote should have it */
+    LOG_INFO("Subscribing for notification/indications");
+    if (device.SupportsFeaturesNotification()) {
+      SubscribeForNotifications(device.conn_id, device.addr,
+                                device.features_handle,
+                                device.features_ccc_handle);
+    }
+
+    if (device.SupportsPresets()) {
+      SubscribeForNotifications(device.conn_id, device.addr, device.cp_handle,
+                                device.cp_ccc_handle, device.cp_ccc_val);
+      SubscribeForNotifications(device.conn_id, device.addr,
+                                device.active_preset_handle,
+                                device.active_preset_ccc_handle);
+    }
+
+    if (osi_property_get_bool("persist.bluetooth.has.always_use_preset_cache",
+                              true) == false) {
+      CpReadAllPresetsOperation(HasCtpOp(
+          device.addr, PresetCtpOpcode::READ_PRESETS,
+          le_audio::has::kStartPresetIndex, le_audio::has::kMaxNumOfPresets));
+    }
+  }
+
   void OnEncrypted(HasDevice& device) {
     DLOG(INFO) << __func__ << ": " << device.addr;
 
@@ -900,7 +960,7 @@
                                device.GetAllPresetInfo());
       callbacks_->OnActivePresetSelected(device.addr,
                                          device.currently_active_preset);
-
+      WriteAllNeededCcc(device);
     } else {
       BTA_GATTC_ServiceSearchRequest(device.conn_id,
                                      &kUuidHearingAccessService);
@@ -949,6 +1009,12 @@
       return;
     }
 
+    if (status == GATT_DATABASE_OUT_OF_SYNC) {
+      LOG_INFO("Database out of sync for %s", device->addr.ToString().c_str());
+      ClearDeviceInformationAndStartSearch(device);
+      return;
+    }
+
     HasGattOpContext context(user_data);
     bool enabling_ntf = context.context_flags &
                         HasGattOpContext::kContextFlagsEnableNotification;
@@ -1019,9 +1085,14 @@
     }
 
     if (status != GATT_SUCCESS) {
-      LOG(ERROR) << __func__ << ": Could not read characteristic at handle="
-                 << loghex(handle);
-      BTA_GATTC_Close(device->conn_id);
+      if (status == GATT_DATABASE_OUT_OF_SYNC) {
+        LOG_INFO("Database out of sync for %s",
+                 device->addr.ToString().c_str());
+        ClearDeviceInformationAndStartSearch(device);
+      } else {
+        LOG_ERROR("Could not read characteristic at handle=0x%04x", handle);
+        BTA_GATTC_Close(device->conn_id);
+      }
       return;
     }
 
@@ -1395,10 +1466,14 @@
     }
 
     if (status != GATT_SUCCESS) {
-      LOG(ERROR) << __func__ << ": Could not read characteristic at handle="
-                 << loghex(handle);
-      BTA_GATTC_Close(device->conn_id);
-      return;
+      if (status == GATT_DATABASE_OUT_OF_SYNC) {
+        LOG_INFO("Database out of sync for %s",
+                 device->addr.ToString().c_str());
+        ClearDeviceInformationAndStartSearch(device);
+      } else {
+        LOG_ERROR("Could not read characteristic at handle=0x%04x", handle);
+        BTA_GATTC_Close(device->conn_id);
+      }
     }
 
     if (len != 1) {
@@ -1468,11 +1543,7 @@
     }
   }
 
-  /* Cleans up after the device disconnection */
-  void DoDisconnectCleanUp(HasDevice& device,
-                           bool invalidate_gatt_service = true) {
-    DLOG(INFO) << __func__ << ": device=" << device.addr;
-
+  void DeregisterNotifications(HasDevice& device) {
     /* Deregister from optional features notifications */
     if (device.features_ccc_handle != GAP_INVALID_HANDLE) {
       BTA_GATTC_DeregisterForNotifications(gatt_if_, device.addr,
@@ -1490,6 +1561,14 @@
       BTA_GATTC_DeregisterForNotifications(gatt_if_, device.addr,
                                            device.cp_handle);
     }
+  }
+
+  /* Cleans up after the device disconnection */
+  void DoDisconnectCleanUp(HasDevice& device,
+                           bool invalidate_gatt_service = true) {
+    LOG_DEBUG(": device=%s", device.addr.ToString().c_str());
+
+    DeregisterNotifications(device);
 
     if (device.conn_id != GATT_INVALID_CONN_ID) {
       BtaGattQueue::Clean(device.conn_id);
@@ -1538,9 +1617,22 @@
                      << ": no HAS Control Point CCC descriptor found!";
           return false;
         }
+        uint8_t ccc_val = 0;
+        if (charac.properties & GATT_CHAR_PROP_BIT_NOTIFY)
+          ccc_val |= GATT_CHAR_CLIENT_CONFIG_NOTIFICATION;
+
+        if (charac.properties & GATT_CHAR_PROP_BIT_INDICATE)
+          ccc_val |= GATT_CHAR_CLIENT_CONFIG_INDICTION;
+
+        if (ccc_val == 0) {
+          LOG_ERROR("Invalid properties for the control point 0x%02x",
+                    charac.properties);
+          return false;
+        }
 
         device->cp_ccc_handle = ccc_handle;
         device->cp_handle = charac.value_handle;
+        device->cp_ccc_val = ccc_val;
       } else if (charac.uuid == kUuidHearingAidFeatures) {
         /* Find the optional CCC descriptor */
         uint16_t ccc_handle =
@@ -1570,30 +1662,6 @@
 
     device->currently_active_preset = active_preset;
 
-    /* Register for optional features notifications */
-    if (device->features_ccc_handle != GAP_INVALID_HANDLE) {
-      tGATT_STATUS register_status = BTA_GATTC_RegisterForNotifications(
-          gatt_if_, device->addr, device->features_handle);
-      DLOG(INFO) << __func__ << " Registering for notifications, status="
-                 << loghex(+register_status);
-    }
-
-    /* Register for presets control point notifications */
-    if (device->cp_ccc_handle != GAP_INVALID_HANDLE) {
-      tGATT_STATUS register_status = BTA_GATTC_RegisterForNotifications(
-          gatt_if_, device->addr, device->cp_handle);
-      DLOG(INFO) << __func__ << " Registering for notifications, status="
-                 << loghex(+register_status);
-    }
-
-    /* Register for active presets notifications if presets exist */
-    if (device->active_preset_ccc_handle != GAP_INVALID_HANDLE) {
-      tGATT_STATUS register_status = BTA_GATTC_RegisterForNotifications(
-          gatt_if_, device->addr, device->active_preset_handle);
-      DLOG(INFO) << __func__ << " Registering for notifications, status="
-                 << loghex(+register_status);
-    }
-
     /* Update features and refresh opcode support map */
     uint8_t val;
     if (btif_storage_get_leaudio_has_features(device->addr, val))
@@ -1608,6 +1676,12 @@
                              device->GetAllPresetInfo());
     callbacks_->OnActivePresetSelected(device->addr,
                                        device->currently_active_preset);
+    if (device->conn_id == GATT_INVALID_CONN_ID) return true;
+
+    /* Be mistrustful here: write CCC values even remote should have it */
+    LOG_INFO("Subscribing for notification/indications");
+    WriteAllNeededCcc(*device);
+
     return true;
   }
 
@@ -1653,13 +1727,14 @@
      * mandatory active preset index notifications.
      */
     if (device->SupportsPresets()) {
-      uint16_t ccc_val = gatt_profile_get_eatt_support(device->addr)
-                             ? GATT_CHAR_CLIENT_CONFIG_INDICTION |
-                                   GATT_CHAR_CLIENT_CONFIG_NOTIFICATION
-                             : GATT_CHAR_CLIENT_CONFIG_INDICTION;
+      /* Subscribe for active preset notifications */
+      SubscribeForNotifications(device->conn_id, device->addr,
+                                device->active_preset_handle,
+                                device->active_preset_ccc_handle);
+
       SubscribeForNotifications(device->conn_id, device->addr,
                                 device->cp_handle, device->cp_ccc_handle,
-                                ccc_val);
+                                device->cp_ccc_val);
 
       /* Get all the presets */
       CpReadAllPresetsOperation(HasCtpOp(
@@ -1676,11 +1751,6 @@
                                                value, user_data);
           },
           nullptr);
-
-      /* Subscribe for active preset notifications */
-      SubscribeForNotifications(device->conn_id, device->addr,
-                                device->active_preset_handle,
-                                device->active_preset_ccc_handle);
     } else {
       LOG(WARNING) << __func__
                    << ": server can only report HAS features, other "
@@ -1730,7 +1800,8 @@
         break;
 
       case BTA_GATTC_ENC_CMPL_CB_EVT:
-        OnLeEncryptionComplete(p_data->enc_cmpl.remote_bda, BTM_SUCCESS);
+        OnLeEncryptionComplete(p_data->enc_cmpl.remote_bda,
+            BTM_IsEncrypted(p_data->enc_cmpl.remote_bda, BT_TRANSPORT_LE));
         break;
 
       case BTA_GATTC_SRVC_CHG_EVT:
@@ -1796,7 +1867,8 @@
         evt.remote_bda, BT_TRANSPORT_LE,
         [](const RawAddress* bd_addr, tBT_TRANSPORT transport, void* p_ref_data,
            tBTM_STATUS status) {
-          if (instance) instance->OnLeEncryptionComplete(*bd_addr, status);
+          if (instance)
+            instance->OnLeEncryptionComplete(*bd_addr, status == BTM_SUCCESS);
         },
         nullptr, BTM_BLE_SEC_ENCRYPT);
 
@@ -1824,7 +1896,9 @@
     DoDisconnectCleanUp(*device, peer_disconnected ? false : true);
 
     /* Connect in background - is this ok? */
-    if (peer_disconnected) BTA_GATTC_Open(gatt_if_, device->addr, false, false);
+    if (peer_disconnected)
+      BTA_GATTC_Open(gatt_if_, device->addr, BTM_BLE_BKG_CONNECT_ALLOW_LIST,
+                     false);
   }
 
   void OnGattServiceSearchComplete(const tBTA_GATTC_SEARCH_CMPL& evt) {
@@ -1876,12 +1950,12 @@
       LOG(ERROR) << __func__ << ": rejected BTA_GATTC_NOTIF_EVT. is_notify = "
                  << evt.is_notify << ", len=" << static_cast<int>(evt.len);
     }
-    if (!evt.is_notify) BTA_GATTC_SendIndConfirm(evt.conn_id, evt.handle);
+    if (!evt.is_notify) BTA_GATTC_SendIndConfirm(evt.conn_id, evt.cid);
 
     OnHasNotification(evt.conn_id, evt.handle, evt.len, evt.value);
   }
 
-  void OnLeEncryptionComplete(const RawAddress& address, uint8_t status) {
+  void OnLeEncryptionComplete(const RawAddress& address, bool success) {
     DLOG(INFO) << __func__ << ": " << address;
 
     auto device = std::find_if(devices_.begin(), devices_.end(),
@@ -1891,9 +1965,8 @@
       return;
     }
 
-    if (status != BTM_SUCCESS) {
-      LOG(ERROR) << "encryption failed"
-                 << " status: " << +status;
+    if (!success) {
+      LOG(ERROR) << "Encryption failed for device " << address;
 
       BTA_GATTC_Close(device->conn_id);
       return;
@@ -1907,6 +1980,27 @@
     }
   }
 
+  void ClearDeviceInformationAndStartSearch(HasDevice* device) {
+    if (!device) {
+      LOG_ERROR("Device is null");
+      return;
+    }
+
+    LOG_INFO("%s", device->addr.ToString().c_str());
+
+    if (!device->isGattServiceValid()) {
+      LOG_INFO("Service already invalidated");
+      return;
+    }
+
+    /* Invalidate service discovery results */
+    DeregisterNotifications(*device);
+    BtaGattQueue::Clean(device->conn_id);
+    device->ClearSvcData();
+    btif_storage_remove_leaudio_has(device->addr);
+    BTA_GATTC_ServiceSearchRequest(device->conn_id, &kUuidHearingAccessService);
+  }
+
   void OnGattServiceChangeEvent(const RawAddress& address) {
     auto device = std::find_if(devices_.begin(), devices_.end(),
                                HasDevice::MatchAddress(address));
@@ -1914,12 +2008,8 @@
       LOG(WARNING) << "Skipping unknown device" << address;
       return;
     }
-
-    DLOG(INFO) << __func__ << ": address=" << address;
-
-    /* Invalidate service discovery results */
-    BtaGattQueue::Clean(device->conn_id);
-    device->ClearSvcData();
+    LOG_INFO("%s", address.ToString().c_str());
+    ClearDeviceInformationAndStartSearch(&(*device));
   }
 
   void OnGattServiceDiscoveryDoneEvent(const RawAddress& address) {
diff --git a/system/bta/has/has_client_test.cc b/system/bta/has/has_client_test.cc
index 0c28ad7..ca8ca63 100644
--- a/system/bta/has/has_client_test.cc
+++ b/system/bta/has/has_client_test.cc
@@ -21,7 +21,6 @@
 #include <gmock/gmock.h>
 #include <gtest/gtest.h>
 #include <osi/include/alarm.h>
-#include <osi/test/alarm_mock.h>
 #include <sys/socket.h>
 
 #include <variant>
@@ -39,19 +38,10 @@
 #include "mock_controller.h"
 #include "mock_csis_client.h"
 
-static std::map<const char*, bool> fake_osi_bool_props;
-
-bool osi_property_get_bool(const char* key, bool default_value) {
-  if (fake_osi_bool_props.count(key)) return fake_osi_bool_props.at(key);
-
-  return default_value;
-}
-
-void osi_property_set_bool(const char* key, bool value) {
-  fake_osi_bool_props.insert_or_assign(key, value);
-}
-
 bool gatt_profile_get_eatt_support(const RawAddress& addr) { return true; }
+void osi_property_set_bool(const char* key, bool value);
+
+std::map<std::string, int> mock_function_count_map;
 
 namespace bluetooth {
 namespace has {
@@ -655,8 +645,7 @@
   }
 
   void SetUp(void) override {
-    fake_osi_bool_props.clear();
-
+    mock_function_count_map.clear();
     controller::SetMockControllerInterface(&controller_interface_);
     bluetooth::manager::SetMockBtmInterface(&btm_interface);
     bluetooth::storage::SetMockBtifStorageInterface(&btif_storage_interface_);
@@ -737,8 +726,8 @@
     ON_CALL(gatt_interface, Open(_, _, _, _))
         .WillByDefault(
             Invoke([&](tGATT_IF client_if, const RawAddress& remote_bda,
-                       bool is_direct, bool opportunistic) {
-              if (is_direct)
+                       tBTM_BLE_CONN_TYPE connection_type, bool opportunistic) {
+              if (connection_type == BTM_BLE_DIRECT_CONNECTION)
                 InjectConnectedEvent(remote_bda, GetTestConnId(remote_bda));
             }));
 
@@ -784,7 +773,8 @@
     ON_CALL(btm_interface, BTM_IsEncrypted(address, _))
         .WillByDefault(DoAll(Return(encryption_result)));
 
-    EXPECT_CALL(gatt_interface, Open(gatt_if, address, true, _));
+    EXPECT_CALL(gatt_interface,
+                Open(gatt_if, address, BTM_BLE_DIRECT_CONNECTION, _));
     HasClient::Get()->Connect(address);
 
     Mock::VerifyAndClearExpectations(&*callbacks);
@@ -807,7 +797,8 @@
   void TestAddFromStorage(const RawAddress& address, uint8_t features,
                           bool auto_connect) {
     if (auto_connect) {
-      EXPECT_CALL(gatt_interface, Open(gatt_if, address, false, _));
+      EXPECT_CALL(gatt_interface,
+                  Open(gatt_if, address, BTM_BLE_BKG_CONNECT_ALLOW_LIST, _));
       HasClient::Get()->AddFromStorage(address, features, auto_connect);
 
       /* Inject connected event for autoconnect/background connection */
@@ -1233,7 +1224,8 @@
   const RawAddress test_address = GetTestAddress(1);
 
   /* Override the default action to prevent us sendind the connected event */
-  EXPECT_CALL(gatt_interface, Open(gatt_if, test_address, true, _))
+  EXPECT_CALL(gatt_interface,
+              Open(gatt_if, test_address, BTM_BLE_DIRECT_CONNECTION, _))
       .WillOnce(Return());
   HasClient::Get()->Connect(test_address);
   TestDisconnect(test_address, GATT_INVALID_CONN_ID);
@@ -1341,7 +1333,7 @@
   InjectConnectedEvent(test_address, GetTestConnId(test_address));
 }
 
-TEST_F(HasClientTest, test_load_from_storage) {
+TEST_F(HasClientTest, test_load_from_storage_and_connect) {
   const RawAddress test_address = GetTestAddress(1);
   SetSampleDatabaseHasPresetsNtf(test_address, kFeatureBitDynamicPresets, {{}});
   SetEncryptionResult(test_address, true);
@@ -1392,7 +1384,7 @@
 
   /* Expect no read or write operations when loading from storage */
   EXPECT_CALL(gatt_queue, ReadCharacteristic(1, _, _, _)).Times(0);
-  EXPECT_CALL(gatt_queue, WriteDescriptor(1, _, _, _, _, _)).Times(0);
+  EXPECT_CALL(gatt_queue, WriteDescriptor(1, _, _, _, _, _)).Times(3);
 
   TestAddFromStorage(test_address,
                      kFeatureBitWritablePresets |
@@ -1411,6 +1403,58 @@
   }
 }
 
+TEST_F(HasClientTest, test_load_from_storage) {
+  const RawAddress test_address = GetTestAddress(1);
+  SetSampleDatabaseHasPresetsNtf(test_address, kFeatureBitDynamicPresets, {{}});
+  SetEncryptionResult(test_address, true);
+
+  std::set<HasPreset, HasPreset::ComparatorDesc> has_presets = {{
+      HasPreset(5, HasPreset::kPropertyAvailable | HasPreset::kPropertyWritable,
+                "YourWritablePreset5"),
+      HasPreset(55, HasPreset::kPropertyAvailable, "YourPreset55"),
+  }};
+
+  /* Load persistent storage data */
+  ON_CALL(btif_storage_interface_, GetLeaudioHasPresets(test_address, _, _))
+      .WillByDefault([&has_presets](const RawAddress& address,
+                                    std::vector<uint8_t>& presets_bin,
+                                    uint8_t& active_preset) {
+        /* Generate presets binary to be used instead the attribute values */
+        HasDevice device(address, 0);
+        device.has_presets = has_presets;
+        active_preset = 55;
+
+        if (device.SerializePresets(presets_bin)) return true;
+
+        return false;
+      });
+
+  EXPECT_CALL(gatt_interface, RegisterForNotifications(gatt_if, _, _))
+      .Times(0);  // features
+
+  EXPECT_CALL(*callbacks,
+              OnDeviceAvailable(test_address,
+                                (kFeatureBitWritablePresets |
+                                 kFeatureBitPresetSynchronizationSupported |
+                                 kFeatureBitHearingAidTypeBanded)));
+
+  std::vector<PresetInfo> loaded_preset_details;
+  EXPECT_CALL(*callbacks,
+              OnPresetInfo(std::variant<RawAddress, int>(test_address),
+                           PresetInfoReason::ALL_PRESET_INFO, _))
+      .Times(0);
+
+  /* Expect no read or write operations when loading from storage */
+  EXPECT_CALL(gatt_queue, ReadCharacteristic(1, _, _, _)).Times(0);
+  EXPECT_CALL(gatt_queue, WriteDescriptor(1, _, _, _, _, _)).Times(0);
+
+  TestAddFromStorage(test_address,
+                     kFeatureBitWritablePresets |
+                         kFeatureBitPresetSynchronizationSupported |
+                         kFeatureBitHearingAidTypeBanded,
+                     false);
+}
+
 TEST_F(HasClientTest, test_write_to_storage) {
   const RawAddress test_address = GetTestAddress(1);
 
@@ -2882,9 +2926,52 @@
   ASSERT_TRUE(SimpleJsonValidator(sv[1], &dumpsys_byte_cnt));
 }
 
+TEST_F(HasClientTest, test_connect_database_out_of_sync) {
+  osi_property_set_bool("persist.bluetooth.has.always_use_preset_cache", false);
+
+  const RawAddress test_address = GetTestAddress(1);
+  std::set<HasPreset, HasPreset::ComparatorDesc> has_presets = {{
+      HasPreset(1, HasPreset::kPropertyAvailable, "Universal"),
+      HasPreset(2, HasPreset::kPropertyAvailable | HasPreset::kPropertyWritable,
+                "Preset2"),
+  }};
+  SetSampleDatabaseHasPresetsNtf(
+      test_address,
+      bluetooth::has::kFeatureBitHearingAidTypeBanded |
+          bluetooth::has::kFeatureBitWritablePresets |
+          bluetooth::has::kFeatureBitDynamicPresets,
+      has_presets);
+
+  EXPECT_CALL(*callbacks, OnDeviceAvailable(
+                              test_address,
+                              bluetooth::has::kFeatureBitHearingAidTypeBanded |
+                                  bluetooth::has::kFeatureBitWritablePresets |
+                                  bluetooth::has::kFeatureBitDynamicPresets));
+  EXPECT_CALL(*callbacks,
+              OnConnectionState(ConnectionState::CONNECTED, test_address));
+  TestConnect(test_address);
+
+  ON_CALL(gatt_queue, WriteCharacteristic(_, _, _, _, _, _))
+      .WillByDefault(
+          Invoke([this](uint16_t conn_id, uint16_t handle,
+                        std::vector<uint8_t> value, tGATT_WRITE_TYPE write_type,
+                        GATT_WRITE_OP_CB cb, void* cb_data) {
+            auto* svc = gatt::FindService(services_map[conn_id], handle);
+            if (svc == nullptr) return;
+
+            tGATT_STATUS status = GATT_DATABASE_OUT_OF_SYNC;
+            if (cb)
+              cb(conn_id, status, handle, value.size(), value.data(), cb_data);
+          }));
+
+  ON_CALL(gatt_interface, ServiceSearchRequest(_, _)).WillByDefault(Return());
+  EXPECT_CALL(gatt_interface, ServiceSearchRequest(_, _));
+  HasClient::Get()->GetPresetInfo(test_address, 1);
+}
+
 class HasTypesTest : public ::testing::Test {
  protected:
-  void SetUp(void) override { fake_osi_bool_props.clear(); }
+  void SetUp(void) override { mock_function_count_map.clear(); }
 
   void TearDown(void) override {}
 };  // namespace
@@ -3021,15 +3108,16 @@
   auto address1 = GetTestAddress(1);
   auto address2 = GetTestAddress(2);
 
-  EXPECT_CALL(*AlarmMock::Get(), AlarmNew(_)).Times(1);
   HasCtpGroupOpCoordinator wrapper(
       {address1, address2},
       HasCtpOp(0x01, ::le_audio::has::PresetCtpOpcode::READ_PRESETS, 6));
   ASSERT_EQ(2u, wrapper.ref_cnt);
 
-  EXPECT_CALL(*AlarmMock::Get(), AlarmFree(_)).Times(1);
   HasCtpGroupOpCoordinator::Cleanup();
   ASSERT_EQ(0u, wrapper.ref_cnt);
+
+  ASSERT_EQ(1, mock_function_count_map["alarm_free"]);
+  ASSERT_EQ(1, mock_function_count_map["alarm_new"]);
 }
 
 TEST_F(HasTypesTest, test_group_op_coordinator_copy) {
@@ -3040,7 +3128,6 @@
   auto address1 = GetTestAddress(1);
   auto address2 = GetTestAddress(2);
 
-  EXPECT_CALL(*AlarmMock::Get(), AlarmNew(_)).Times(1);
   HasCtpGroupOpCoordinator wrapper(
       {address1, address2},
       HasCtpOp(0x01, ::le_audio::has::PresetCtpOpcode::READ_PRESETS, 6));
@@ -3056,9 +3143,11 @@
   delete wrapper4;
   ASSERT_EQ(4u, wrapper.ref_cnt);
 
-  EXPECT_CALL(*AlarmMock::Get(), AlarmFree(_)).Times(1);
   HasCtpGroupOpCoordinator::Cleanup();
   ASSERT_EQ(0u, wrapper.ref_cnt);
+
+  ASSERT_EQ(1, mock_function_count_map["alarm_free"]);
+  ASSERT_EQ(1, mock_function_count_map["alarm_new"]);
 }
 
 TEST_F(HasTypesTest, test_group_op_coordinator_completion) {
@@ -3071,7 +3160,6 @@
   auto address2 = GetTestAddress(2);
   auto address3 = GetTestAddress(3);
 
-  EXPECT_CALL(*AlarmMock::Get(), AlarmNew(_)).Times(1);
   HasCtpGroupOpCoordinator wrapper(
       {address1, address3},
       HasCtpOp(0x01, ::le_audio::has::PresetCtpOpcode::READ_PRESETS, 6));
@@ -3080,7 +3168,6 @@
       HasCtpOp(0x01, ::le_audio::has::PresetCtpOpcode::READ_PRESETS, 6));
   ASSERT_EQ(3u, wrapper.ref_cnt);
 
-  EXPECT_CALL(*AlarmMock::Get(), AlarmFree(_)).Times(0);
   ASSERT_FALSE(wrapper.IsFullyCompleted());
 
   wrapper.SetCompleted(address1);
@@ -3089,23 +3176,20 @@
   wrapper.SetCompleted(address3);
   ASSERT_EQ(1u, wrapper.ref_cnt);
   ASSERT_FALSE(wrapper.IsFullyCompleted());
-  Mock::VerifyAndClearExpectations(&*AlarmMock::Get());
 
   /* Non existing address completion */
-  EXPECT_CALL(*AlarmMock::Get(), AlarmFree(_)).Times(0);
   wrapper.SetCompleted(address2);
-  Mock::VerifyAndClearExpectations(&*AlarmMock::Get());
   ASSERT_EQ(1u, wrapper.ref_cnt);
 
   /* Last device address completion */
-  EXPECT_CALL(*AlarmMock::Get(), AlarmFree(_)).Times(1);
   wrapper2.SetCompleted(address2);
-  Mock::VerifyAndClearExpectations(&*AlarmMock::Get());
   ASSERT_TRUE(wrapper.IsFullyCompleted());
   ASSERT_EQ(0u, wrapper.ref_cnt);
 
-  EXPECT_CALL(*AlarmMock::Get(), AlarmFree(_)).Times(0);
   HasCtpGroupOpCoordinator::Cleanup();
+
+  ASSERT_EQ(1, mock_function_count_map["alarm_free"]);
+  ASSERT_EQ(1, mock_function_count_map["alarm_new"]);
 }
 
 }  // namespace
diff --git a/system/bta/has/has_types.h b/system/bta/has/has_types.h
index e7d691d..66d0dd3 100644
--- a/system/bta/has/has_types.h
+++ b/system/bta/has/has_types.h
@@ -170,6 +170,7 @@
   uint16_t active_preset_ccc_handle = GAP_INVALID_HANDLE;
   uint16_t cp_handle = GAP_INVALID_HANDLE;
   uint16_t cp_ccc_handle = GAP_INVALID_HANDLE;
+  uint8_t cp_ccc_val = 0;
   uint16_t features_handle = GAP_INVALID_HANDLE;
   uint16_t features_ccc_handle = GAP_INVALID_HANDLE;
 
diff --git a/system/bta/hd/bta_hd_act.cc b/system/bta/hd/bta_hd_act.cc
index 3d455d6..f78455e 100644
--- a/system/bta/hd/bta_hd_act.cc
+++ b/system/bta/hd/bta_hd_act.cc
@@ -509,7 +509,6 @@
 
   if (bta_hd_cb.use_report_id || bta_hd_cb.boot_mode) {
     if (len < 1) {
-      android_errorWriteLog(0x534e4554, "109757986");
       return;
     }
     ret.report_id = *p_buf;
@@ -548,7 +547,6 @@
 
   uint16_t remaining_len = p_msg->len;
   if (remaining_len < 1) {
-    android_errorWriteLog(0x534e4554, "109757168");
     return;
   }
 
@@ -558,7 +556,6 @@
 
   if (bta_hd_cb.use_report_id) {
     if (remaining_len < 1) {
-      android_errorWriteLog(0x534e4554, "109757168");
       return;
     }
     ret.report_id = *p_buf;
@@ -568,7 +565,6 @@
 
   if (rep_size_follows) {
     if (remaining_len < 2) {
-      android_errorWriteLog(0x534e4554, "109757168");
       return;
     }
     ret.buffer_size = *p_buf | (*(p_buf + 1) << 8);
@@ -598,7 +594,6 @@
   APPL_TRACE_API("%s", __func__);
 
   if (len < 1) {
-    android_errorWriteLog(0x534e4554, "110846194");
     return;
   }
   ret.report_type = *p_buf & HID_PAR_REP_TYPE_MASK;
@@ -607,7 +602,6 @@
 
   if (bta_hd_cb.use_report_id || bta_hd_cb.boot_mode) {
     if (len < 1) {
-      android_errorWriteLog(0x534e4554, "109757435");
       return;
     }
     ret.report_id = *p_buf;
diff --git a/system/bta/hd/bta_hd_api.cc b/system/bta/hd/bta_hd_api.cc
index 0259a22..93a9155 100644
--- a/system/bta/hd/bta_hd_api.cc
+++ b/system/bta/hd/bta_hd_api.cc
@@ -79,7 +79,10 @@
 void BTA_HdDisable(void) {
   APPL_TRACE_API("%s", __func__);
 
-  bta_sys_deregister(BTA_ID_HD);
+  if (!bluetooth::common::init_flags::
+          delay_hidh_cleanup_until_hidh_ready_start_is_enabled()) {
+    bta_sys_deregister(BTA_ID_HD);
+  }
 
   BT_HDR_RIGID* p_buf = (BT_HDR_RIGID*)osi_malloc(sizeof(BT_HDR_RIGID));
   p_buf->event = BTA_HD_API_DISABLE_EVT;
@@ -128,7 +131,6 @@
 
   if (p_app_info->descriptor.dl_len > BTA_HD_APP_DESCRIPTOR_LEN) {
     p_app_info->descriptor.dl_len = BTA_HD_APP_DESCRIPTOR_LEN;
-    android_errorWriteLog(0x534e4554, "113111784");
   }
   p_buf->d_len = p_app_info->descriptor.dl_len;
   memcpy(p_buf->d_data, p_app_info->descriptor.dsc_list,
diff --git a/system/bta/hearing_aid/hearing_aid.cc b/system/bta/hearing_aid/hearing_aid.cc
index 774add2..8637f89 100644
--- a/system/bta/hearing_aid/hearing_aid.cc
+++ b/system/bta/hearing_aid/hearing_aid.cc
@@ -182,7 +182,8 @@
     int read_rssi_start_interval_count = 0;
 
     for (auto& d : devices) {
-      VLOG(1) << __func__ << ": device=" << d.address << ", read_rssi_count=" << d.read_rssi_count;
+      LOG_DEBUG("device=%s, read_rssi_count=%d",
+                d.address.ToStringForLogging().c_str(), d.read_rssi_count);
 
       // Reset the count
       if (d.read_rssi_count <= 0) {
@@ -211,9 +212,8 @@
                                  uint16_t handle, uint16_t len,
                                  const uint8_t* value, void* data) {
   if (status != GATT_SUCCESS) {
-    LOG(ERROR) << __func__ << ": handle=" << handle << ", conn_id=" << conn_id
-               << ", status=" << loghex(static_cast<uint8_t>(status))
-               << ", length=" << len;
+    LOG_ERROR("handle= %hu, conn_id=%hu, status= %s, length=%u", handle,
+              conn_id, loghex(static_cast<uint8_t>(status)).c_str(), len);
   }
 }
 
@@ -222,7 +222,7 @@
 
 inline void encoder_state_init() {
   if (encoder_state_left != nullptr) {
-    LOG(WARNING) << __func__ << ": encoder already initialized";
+    LOG_WARN("encoder already initialized");
     return;
   }
   encoder_state_left = g722_encode_init(nullptr, 64000, G722_PACKED);
@@ -261,19 +261,16 @@
         "persist.bluetooth.hearingaid.interval", (int32_t)HA_INTERVAL_20_MS);
     if ((default_data_interval_ms != HA_INTERVAL_10_MS) &&
         (default_data_interval_ms != HA_INTERVAL_20_MS)) {
-      LOG(ERROR) << __func__
-                 << ": invalid interval=" << default_data_interval_ms
-                 << "ms. Overwriting back to default";
+      LOG_ERROR("invalid interval= %ums. Overwrriting back to default",
+                default_data_interval_ms);
       default_data_interval_ms = HA_INTERVAL_20_MS;
     }
-    VLOG(2) << __func__
-            << ", default_data_interval_ms=" << default_data_interval_ms;
+    LOG_DEBUG("default_data_interval_ms=%u", default_data_interval_ms);
 
     overwrite_min_ce_len = (uint16_t)osi_property_get_int32(
         "persist.bluetooth.hearingaidmincelen", 0);
     if (overwrite_min_ce_len) {
-      LOG(INFO) << __func__
-                << ": Overwrites MIN_CE_LEN=" << overwrite_min_ce_len;
+      LOG_INFO("Overwrites MIN_CE_LEN=%u", overwrite_min_ce_len);
     }
 
     BTA_GATTC_AppRegister(
@@ -281,14 +278,15 @@
         base::Bind(
             [](Closure initCb, uint8_t client_id, uint8_t status) {
               if (status != GATT_SUCCESS) {
-                LOG(ERROR) << "Can't start Hearing Aid profile - no gatt "
-                              "clients left!";
+                LOG_ERROR(
+                    "Can't start Hearing Aid profile - no gatt clients left!");
                 return;
               }
               instance->gatt_if = client_id;
               initCb.Run();
             },
-            initCb), false);
+            initCb),
+        false);
   }
 
   uint16_t UpdateBleConnParams(const RawAddress& address) {
@@ -306,15 +304,15 @@
         connection_interval = CONNECTION_INTERVAL_20MS_PARAM;
         break;
       default:
-        LOG(ERROR) << __func__ << ":Error: invalid default_data_interval_ms="
-                   << default_data_interval_ms;
+        LOG_ERROR("invalid default_data_interval_ms=%u",
+                  default_data_interval_ms);
         min_ce_len = MIN_CE_LEN_10MS_CI;
         connection_interval = CONNECTION_INTERVAL_10MS_PARAM;
     }
 
     if (overwrite_min_ce_len != 0) {
-      VLOG(2) << __func__ << ": min_ce_len=" << min_ce_len
-              << " is overwritten to " << overwrite_min_ce_len;
+      LOG_DEBUG("min_ce_len=%u is overwritten to %u", min_ce_len,
+                overwrite_min_ce_len);
       min_ce_len = overwrite_min_ce_len;
     }
 
@@ -323,22 +321,22 @@
     return connection_interval;
   }
 
-  void Connect(const RawAddress& address) override {
-    DVLOG(2) << __func__ << " " << address;
+  void Connect(const RawAddress& address) {
+    LOG_DEBUG("%s", address.ToStringForLogging().c_str());
     hearingDevices.Add(HearingDevice(address, true));
-    BTA_GATTC_Open(gatt_if, address, true, false);
+    BTA_GATTC_Open(gatt_if, address, BTM_BLE_DIRECT_CONNECTION, false);
   }
 
-  void AddToAcceptlist(const RawAddress& address) override {
-    VLOG(2) << __func__ << " address: " << address;
+  void AddToAcceptlist(const RawAddress& address) {
+    LOG_DEBUG("%s", address.ToStringForLogging().c_str());
     hearingDevices.Add(HearingDevice(address, true));
-    BTA_GATTC_Open(gatt_if, address, false, false);
+    BTA_GATTC_Open(gatt_if, address, BTM_BLE_BKG_CONNECT_ALLOW_LIST, false);
   }
 
   void AddFromStorage(const HearingDevice& dev_info, uint16_t is_acceptlisted) {
-    DVLOG(2) << __func__ << " " << dev_info.address
-             << ", hiSyncId=" << loghex(dev_info.hi_sync_id)
-             << ", isAcceptlisted=" << is_acceptlisted;
+    LOG_DEBUG("%s, hiSyncId=%s, isAcceptlisted=%u",
+              dev_info.address.ToStringForLogging().c_str(),
+              loghex(dev_info.hi_sync_id).c_str(), is_acceptlisted);
     if (is_acceptlisted) {
       hearingDevices.Add(dev_info);
 
@@ -347,7 +345,8 @@
       // BTM_BleSetConnScanParams(2048, 1024);
 
       /* add device into BG connection to accept remote initiated connection */
-      BTA_GATTC_Open(gatt_if, dev_info.address, false, false);
+      BTA_GATTC_Open(gatt_if, dev_info.address, BTM_BLE_BKG_CONNECT_ALLOW_LIST,
+                     false);
     }
 
     callbacks->OnDeviceAvailable(dev_info.capabilities, dev_info.hi_sync_id,
@@ -363,13 +362,14 @@
     if (!hearingDevice) {
       /* When Hearing Aid is quickly disabled and enabled in settings, this case
        * might happen */
-      LOG(WARNING) << "Closing connection to non hearing-aid device, address="
-                   << address;
+      LOG_WARN("Closing connection to non hearing-aid device, address=%s",
+               address.ToStringForLogging().c_str());
       BTA_GATTC_Close(conn_id);
       return;
     }
 
-    LOG(INFO) << __func__ << ": address=" << address << ", conn_id=" << conn_id;
+    LOG_INFO("address=%s, conn_id=%u", address.ToStringForLogging().c_str(),
+             conn_id);
 
     if (status != GATT_SUCCESS) {
       if (!hearingDevice->connecting_actively) {
@@ -377,7 +377,7 @@
         return;
       }
 
-      LOG(INFO) << "Failed to connect to Hearing Aid device";
+      LOG_INFO("Failed to connect to Hearing Aid device");
       hearingDevices.Remove(address);
       callbacks->OnConnectionState(ConnectionState::DISCONNECTED, address);
       return;
@@ -403,7 +403,7 @@
     }
 
     if (controller_get_interface()->supports_ble_2m_phy()) {
-      LOG(INFO) << address << " set preferred 2M PHY";
+      LOG_INFO("%s set preferred 2M PHY", address.ToStringForLogging().c_str());
       BTM_BleSetPhy(address, PHY_LE_2M, PHY_LE_2M, 0);
     }
 
@@ -438,7 +438,7 @@
   void OnConnectionUpdateComplete(uint16_t conn_id, tBTA_GATTC* p_data) {
     HearingDevice* hearingDevice = hearingDevices.FindByConnId(conn_id);
     if (!hearingDevice) {
-      DVLOG(2) << "Skipping unknown device, conn_id=" << loghex(conn_id);
+      LOG_DEBUG("Skipping unknown device, conn_id=%s", loghex(conn_id).c_str());
       return;
     }
 
@@ -451,31 +451,29 @@
         switch (hearingDevice->connection_update_status) {
           case COMPLETED:
             if (!same_conn_interval) {
-              LOG(WARNING) << __func__
-                           << ": Unexpected change. Redo. connection interval="
-                           << p_data->conn_update.interval << ", expected="
-                           << hearingDevice->requested_connection_interval
-                           << ", conn_id=" << conn_id
-                           << ", connection_update_status="
-                           << hearingDevice->connection_update_status;
+              LOG_WARN(
+                  "Unexpected change. Redo. connection interval=%u, "
+                  "expected=%u, conn_id=%u, connection_update_status=%u",
+                  p_data->conn_update.interval,
+                  hearingDevice->requested_connection_interval, conn_id,
+                  hearingDevice->connection_update_status);
               // Redo this connection interval change.
               hearingDevice->connection_update_status = AWAITING;
             }
             break;
           case STARTED:
             if (same_conn_interval) {
-              LOG(INFO) << __func__
-                        << ": Connection update completed. conn_id=" << conn_id
-                        << ", device=" << hearingDevice->address;
+              LOG_INFO("Connection update completed. conn_id=%u, device=%s",
+                       conn_id,
+                       hearingDevice->address.ToStringForLogging().c_str());
               hearingDevice->connection_update_status = COMPLETED;
             } else {
-              LOG(WARNING) << __func__
-                           << ": Ignored. Different connection interval="
-                           << p_data->conn_update.interval << ", expected="
-                           << hearingDevice->requested_connection_interval
-                           << ", conn_id=" << conn_id
-                           << ", connection_update_status="
-                           << hearingDevice->connection_update_status;
+              LOG_WARN(
+                  "Ignored. Different connection interval=%u, expected=%u, "
+                  "conn_id=%u, connection_update_status=%u",
+                  p_data->conn_update.interval,
+                  hearingDevice->requested_connection_interval, conn_id,
+                  hearingDevice->connection_update_status);
               // Wait for the right Connection Update Completion.
               return;
             }
@@ -493,16 +491,15 @@
         send_state_change_to_other_side(hearingDevice, conn_update);
         send_state_change(hearingDevice, conn_update);
       } else {
-        LOG(INFO) << __func__ << ": error status="
-                  << loghex(static_cast<uint8_t>(p_data->conn_update.status))
-                  << ", conn_id=" << conn_id
-                  << ", device=" << hearingDevice->address
-                  << ", connection_update_status="
-                  << hearingDevice->connection_update_status;
-
+        LOG_INFO(
+            "error status=%s, conn_id=%u,device=%s, "
+            "connection_update_status=%u",
+            loghex(static_cast<uint8_t>(p_data->conn_update.status)).c_str(),
+            conn_id, hearingDevice->address.ToStringForLogging().c_str(),
+            hearingDevice->connection_update_status);
         if (hearingDevice->connection_update_status == STARTED) {
           // Redo this connection interval change.
-          LOG(ERROR) << __func__ << ": Redo Connection Interval change";
+          LOG_ERROR("Redo Connection Interval change");
           hearingDevice->connection_update_status = AWAITING;
         }
       }
@@ -530,15 +527,18 @@
   void OnReadRssiComplete(const RawAddress& address, int8_t rssi_value) {
     HearingDevice* hearingDevice = hearingDevices.FindByAddress(address);
     if (!hearingDevice) {
-      LOG(INFO) << "Skipping unknown device" << address;
+      LOG_INFO("Skipping unknown device %s",
+               address.ToStringForLogging().c_str());
       return;
     }
 
-    VLOG(1) << __func__ << ": device=" << address << ", rssi=" << (int)rssi_value;
+    LOG_DEBUG("device=%s, rss=%d", address.ToStringForLogging().c_str(),
+              (int)rssi_value);
 
     if (hearingDevice->read_rssi_count <= 0) {
-      LOG(ERROR) << __func__ << ": device=" << address
-                 << ", invalid read_rssi_count=" << hearingDevice->read_rssi_count;
+      LOG_ERROR(" device=%s, invalid read_rssi_count=%d",
+                address.ToStringForLogging().c_str(),
+                hearingDevice->read_rssi_count);
       return;
     }
 
@@ -547,7 +547,8 @@
     if (hearingDevice->read_rssi_count == READ_RSSI_NUM_TRIES) {
       // Store the timestamp only for the first one after packet flush
       clock_gettime(CLOCK_REALTIME, &last_log_set.timestamp);
-      LOG(INFO) << __func__ << ": store time. device=" << address << ", rssi=" << (int)rssi_value;
+      LOG_INFO("store time, device=%s, rssi=%d",
+               address.ToStringForLogging().c_str(), (int)rssi_value);
     }
 
     last_log_set.rssi.emplace_back(rssi_value);
@@ -557,12 +558,13 @@
   void OnEncryptionComplete(const RawAddress& address, bool success) {
     HearingDevice* hearingDevice = hearingDevices.FindByAddress(address);
     if (!hearingDevice) {
-      DVLOG(2) << "Skipping unknown device" << address;
+      LOG_DEBUG("Skipping unknown device %s",
+                address.ToStringForLogging().c_str());
       return;
     }
 
     if (!success) {
-      LOG(ERROR) << "encryption failed";
+      LOG_ERROR("encryption failed");
       BTA_GATTC_Close(hearingDevice->conn_id);
       if (hearingDevice->first_connection) {
         callbacks->OnConnectionState(ConnectionState::DISCONNECTED, address);
@@ -570,7 +572,7 @@
       return;
     }
 
-    LOG(INFO) << __func__ << ": " << address;
+    LOG_INFO("%s", address.ToStringForLogging().c_str());
 
     if (hearingDevice->audio_control_point_handle &&
         hearingDevice->audio_status_handle &&
@@ -579,8 +581,8 @@
       // Use cached data, jump to read PSM
       ReadPSM(hearingDevice);
     } else {
-      LOG(INFO) << __func__ << ": " << address
-                << ": do BTA_GATTC_ServiceSearchRequest";
+      LOG_INFO("%s: do BTA_GATTC_ServiceSearchRequest",
+               address.ToStringForLogging().c_str());
       hearingDevice->first_connection = true;
       BTA_GATTC_ServiceSearchRequest(hearingDevice->conn_id, &HEARING_AID_UUID);
     }
@@ -591,32 +593,34 @@
                         tGATT_STATUS status) {
     HearingDevice* hearingDevice = hearingDevices.FindByConnId(conn_id);
     if (!hearingDevice) {
-      DVLOG(2) << "Skipping unknown device, conn_id=" << loghex(conn_id);
+      LOG_DEBUG("Skipping unknown device, conn_id=%s", loghex(conn_id).c_str());
       return;
     }
     if (status != GATT_SUCCESS) {
-      LOG(WARNING) << hearingDevice->address
-                   << " phy update fail with status: " << status;
+      LOG_WARN("%s phy update fail with status: %hu",
+               hearingDevice->address.ToStringForLogging().c_str(), status);
       return;
     }
     if (tx_phys == PHY_LE_2M && rx_phys == PHY_LE_2M) {
-      LOG(INFO) << hearingDevice->address << " phy update to 2M successful";
+      LOG_INFO("%s phy update to 2M successful",
+               hearingDevice->address.ToStringForLogging().c_str());
       return;
     }
-    LOG(INFO)
-        << hearingDevice->address
-        << " phy update successful but not target phy, try again. tx_phys: "
-        << tx_phys << ", rx_phys: " << rx_phys;
+    LOG_INFO(
+        "%s phy update successful but not target phy, try again. tx_phys: "
+        "%u,rx_phys: %u",
+        hearingDevice->address.ToStringForLogging().c_str(), tx_phys, rx_phys);
     BTM_BleSetPhy(hearingDevice->address, PHY_LE_2M, PHY_LE_2M, 0);
   }
 
   void OnServiceChangeEvent(const RawAddress& address) {
     HearingDevice* hearingDevice = hearingDevices.FindByAddress(address);
     if (!hearingDevice) {
-      VLOG(2) << "Skipping unknown device" << address;
+      LOG_DEBUG("Skipping unknown device %s",
+                address.ToStringForLogging().c_str());
       return;
     }
-    LOG(INFO) << __func__ << ": address=" << address;
+    LOG_INFO("address=%s", address.ToStringForLogging().c_str());
     hearingDevice->first_connection = true;
     hearingDevice->service_changed_rcvd = true;
     BtaGattQueue::Clean(hearingDevice->conn_id);
@@ -629,17 +633,18 @@
   void OnServiceDiscDoneEvent(const RawAddress& address) {
     HearingDevice* hearingDevice = hearingDevices.FindByAddress(address);
     if (!hearingDevice) {
-      VLOG(2) << "Skipping unknown device" << address;
+      LOG_DEBUG("Skipping unknown device %s",
+                address.ToStringForLogging().c_str());
       return;
     }
-    LOG(INFO) << __func__ << ": " << address;
+    LOG_INFO("%s", address.ToStringForLogging().c_str());
     if (hearingDevice->service_changed_rcvd ||
         !(hearingDevice->audio_control_point_handle &&
           hearingDevice->audio_status_handle &&
           hearingDevice->audio_status_ccc_handle &&
           hearingDevice->volume_handle && hearingDevice->read_psm_handle)) {
-      LOG(INFO) << __func__ << ": " << address
-                << ": do BTA_GATTC_ServiceSearchRequest";
+      LOG_INFO("%s: do BTA_GATTC_ServiceSearchRequest",
+               address.ToStringForLogging().c_str());
       BTA_GATTC_ServiceSearchRequest(hearingDevice->conn_id, &HEARING_AID_UUID);
     }
   }
@@ -647,7 +652,7 @@
   void OnServiceSearchComplete(uint16_t conn_id, tGATT_STATUS status) {
     HearingDevice* hearingDevice = hearingDevices.FindByConnId(conn_id);
     if (!hearingDevice) {
-      DVLOG(2) << "Skipping unknown device, conn_id=" << loghex(conn_id);
+      LOG_DEBUG("Skipping unknown device, conn_id=%s", loghex(conn_id).c_str());
       return;
     }
 
@@ -656,7 +661,7 @@
 
     if (status != GATT_SUCCESS) {
       /* close connection and report service discovery complete with error */
-      LOG(ERROR) << "Service discovery failed";
+      LOG_ERROR("Service discovery failed");
       if (hearingDevice->first_connection) {
         callbacks->OnConnectionState(ConnectionState::DISCONNECTED,
                                      hearingDevice->address);
@@ -669,18 +674,19 @@
     const gatt::Service* service = nullptr;
     for (const gatt::Service& tmp : *services) {
       if (tmp.uuid == Uuid::From16Bit(UUID_SERVCLASS_GATT_SERVER)) {
-        LOG(INFO) << "Found UUID_SERVCLASS_GATT_SERVER, handle="
-                  << loghex(tmp.handle);
+        LOG_INFO("Found UUID_SERVCLASS_GATT_SERVER, handle=%s",
+                 loghex(tmp.handle).c_str());
         const gatt::Service* service_changed_service = &tmp;
         find_server_changed_ccc_handle(conn_id, service_changed_service);
       } else if (tmp.uuid == HEARING_AID_UUID) {
-        LOG(INFO) << "Found Hearing Aid service, handle=" << loghex(tmp.handle);
+        LOG_INFO("Found Hearing Aid service, handle=%s",
+                 loghex(tmp.handle).c_str());
         service = &tmp;
       }
     }
 
     if (!service) {
-      LOG(ERROR) << "No Hearing Aid service found";
+      LOG_ERROR("No Hearing Aid service found");
       callbacks->OnConnectionState(ConnectionState::DISCONNECTED,
                                    hearingDevice->address);
       return;
@@ -692,8 +698,8 @@
                 hearingDevice->address, &hearingDevice->capabilities,
                 &hearingDevice->hi_sync_id, &hearingDevice->render_delay,
                 &hearingDevice->preparation_delay, &hearingDevice->codecs)) {
-          VLOG(2) << "Reading read only properties "
-                  << loghex(charac.value_handle);
+          LOG_DEBUG("Reading read only properties %s",
+                    loghex(charac.value_handle).c_str());
           BtaGattQueue::ReadCharacteristic(
               conn_id, charac.value_handle,
               HearingAidImpl::OnReadOnlyPropertiesReadStatic, nullptr);
@@ -707,19 +713,20 @@
         hearingDevice->audio_status_ccc_handle =
             find_ccc_handle(conn_id, charac.value_handle);
         if (!hearingDevice->audio_status_ccc_handle) {
-          LOG(ERROR) << __func__ << ": cannot find Audio Status CCC descriptor";
+          LOG_ERROR("cannot find Audio Status CCC descriptor");
           continue;
         }
 
-        LOG(INFO) << __func__
-                  << ": audio_status_handle=" << loghex(charac.value_handle)
-                  << ", ccc=" << loghex(hearingDevice->audio_status_ccc_handle);
+        LOG_INFO("audio_status_handle=%s, ccc=%s",
+                 loghex(charac.value_handle).c_str(),
+                 loghex(hearingDevice->audio_status_ccc_handle).c_str());
       } else if (charac.uuid == VOLUME_UUID) {
         hearingDevice->volume_handle = charac.value_handle;
       } else if (charac.uuid == LE_PSM_UUID) {
         hearingDevice->read_psm_handle = charac.value_handle;
       } else {
-        LOG(WARNING) << "Unknown characteristic found:" << charac.uuid;
+        LOG_WARN("Unknown characteristic found:%s",
+                 charac.uuid.ToString().c_str());
       }
     }
 
@@ -732,8 +739,9 @@
 
   void ReadPSM(HearingDevice* hearingDevice) {
     if (hearingDevice->read_psm_handle) {
-      LOG(INFO) << "Reading PSM " << loghex(hearingDevice->read_psm_handle)
-                << ", device=" << hearingDevice->address;
+      LOG_INFO("Reading PSM %s, device=%s",
+               loghex(hearingDevice->read_psm_handle).c_str(),
+               hearingDevice->address.ToStringForLogging().c_str());
       BtaGattQueue::ReadCharacteristic(
           hearingDevice->conn_id, hearingDevice->read_psm_handle,
           HearingAidImpl::OnPsmReadStatic, nullptr);
@@ -744,33 +752,29 @@
                            uint8_t* value) {
     HearingDevice* device = hearingDevices.FindByConnId(conn_id);
     if (!device) {
-      LOG(INFO) << __func__
-                << ": Skipping unknown device, conn_id=" << loghex(conn_id);
+      LOG_INFO("Skipping unknown device, conn_id=%s", loghex(conn_id).c_str());
       return;
     }
 
     if (device->audio_status_handle != handle) {
-      LOG(INFO) << __func__ << ": Mismatched handle, "
-                << loghex(device->audio_status_handle)
-                << "!=" << loghex(handle);
+      LOG_INFO("Mismatched handle, %s!=%s",
+               loghex(device->audio_status_handle).c_str(),
+               loghex(handle).c_str());
       return;
     }
 
     if (len < 1) {
-      LOG(ERROR) << __func__ << ": Data Length too small, len=" << len
-                 << ", expecting at least 1";
+      LOG_ERROR("Data Length too small, len=%u, expecting at least 1", len);
       return;
     }
 
     if (value[0] != 0) {
-      LOG(INFO) << __func__
-                << ": Invalid returned status. data=" << loghex(value[0]);
+      LOG_INFO("Invalid returned status. data=%s", loghex(value[0]).c_str());
       return;
     }
 
-    LOG(INFO) << __func__
-              << ": audio status success notification. command_acked="
-              << device->command_acked;
+    LOG_INFO("audio status success notification. command_acked=%u",
+             device->command_acked);
     device->command_acked = true;
   }
 
@@ -779,11 +783,11 @@
                                 void* data) {
     HearingDevice* hearingDevice = hearingDevices.FindByConnId(conn_id);
     if (!hearingDevice) {
-      DVLOG(2) << __func__ << "unknown conn_id=" << loghex(conn_id);
+      LOG_DEBUG("unknown conn_id=%s", loghex(conn_id).c_str());
       return;
     }
 
-    VLOG(2) << __func__ << " " << base::HexEncode(value, len);
+    LOG_DEBUG("%s", base::HexEncode(value, len).c_str());
 
     uint8_t* p = value;
 
@@ -791,13 +795,13 @@
     STREAM_TO_UINT8(version, p);
 
     if (version != 0x01) {
-      LOG(WARNING) << "Unknown version: " << loghex(version);
+      LOG_WARN("Unknown version: %s", loghex(version).c_str());
       return;
     }
 
     // version 0x01 of read only properties:
     if (len < 17) {
-      LOG(WARNING) << "Read only properties too short: " << loghex(len);
+      LOG_WARN("Read only properties too short: %s", loghex(len).c_str());
       return;
     }
     uint8_t capabilities;
@@ -805,35 +809,34 @@
     hearingDevice->capabilities = capabilities;
     bool side = capabilities & CAPABILITY_SIDE;
     bool standalone = capabilities & CAPABILITY_BINAURAL;
-    VLOG(2) << __func__ << " capabilities: " << (side ? "right" : "left")
-            << ", " << (standalone ? "binaural" : "monaural");
+    LOG_DEBUG("capabilities: %s, %s", (side ? "right" : "left"),
+              (standalone ? "binaural" : "monaural"));
 
     if (capabilities & CAPABILITY_RESERVED) {
-      LOG(WARNING) << __func__ << " reserved capabilities are set";
+      LOG_WARN("reserved capabilities are set");
     }
 
     STREAM_TO_UINT64(hearingDevice->hi_sync_id, p);
-    VLOG(2) << __func__ << " hiSyncId: " << loghex(hearingDevice->hi_sync_id);
+    LOG_DEBUG("hiSyncId: %s", loghex(hearingDevice->hi_sync_id).c_str());
     uint8_t feature_map;
     STREAM_TO_UINT8(feature_map, p);
 
     STREAM_TO_UINT16(hearingDevice->render_delay, p);
-    VLOG(2) << __func__
-            << " render delay: " << loghex(hearingDevice->render_delay);
+    LOG_DEBUG("render delay: %s", loghex(hearingDevice->render_delay).c_str());
 
     STREAM_TO_UINT16(hearingDevice->preparation_delay, p);
-    VLOG(2) << __func__ << " preparation delay: "
-            << loghex(hearingDevice->preparation_delay);
+    LOG_DEBUG("preparation delay: %s",
+              loghex(hearingDevice->preparation_delay).c_str());
 
     uint16_t codecs;
     STREAM_TO_UINT16(codecs, p);
     hearingDevice->codecs = codecs;
-    VLOG(2) << __func__ << " supported codecs: " << loghex(codecs);
-    if (codecs & (1 << CODEC_G722_16KHZ)) VLOG(2) << "\tG722@16kHz";
-    if (codecs & (1 << CODEC_G722_24KHZ)) VLOG(2) << "\tG722@24kHz";
+    LOG_DEBUG("supported codecs: %s", loghex(codecs).c_str());
+    if (codecs & (1 << CODEC_G722_16KHZ)) LOG_INFO("%s\tG722@16kHz", __func__);
+    if (codecs & (1 << CODEC_G722_24KHZ)) LOG_INFO("%s\tG722@24kHz", __func__);
 
     if (!(codecs & (1 << CODEC_G722_16KHZ))) {
-      LOG(WARNING) << __func__ << " Mandatory codec, G722@16kHz not supported";
+      LOG_WARN("Mandatory codec, G722@16kHz not supported");
     }
   }
 
@@ -882,29 +885,31 @@
 
   void OnAudioStatus(uint16_t conn_id, tGATT_STATUS status, uint16_t handle,
                      uint16_t len, uint8_t* value, void* data) {
-    LOG(INFO) << __func__ << " " << base::HexEncode(value, len);
+    LOG_INFO("%s", base::HexEncode(value, len).c_str());
   }
 
   void OnPsmRead(uint16_t conn_id, tGATT_STATUS status, uint16_t handle,
                  uint16_t len, uint8_t* value, void* data) {
     HearingDevice* hearingDevice = hearingDevices.FindByConnId(conn_id);
     if (!hearingDevice) {
-      DVLOG(2) << "Skipping unknown read event, conn_id=" << loghex(conn_id);
+      LOG_DEBUG("Skipping unknown read event, conn_id=%s",
+                loghex(conn_id).c_str());
       return;
     }
 
     if (status != GATT_SUCCESS) {
-      LOG(ERROR) << "Error reading PSM for device" << hearingDevice->address;
+      LOG_ERROR("Error reading PSM for device %s",
+                hearingDevice->address.ToStringForLogging().c_str());
       return;
     }
 
     if (len > 2) {
-      LOG(ERROR) << "Bad PSM length";
+      LOG_ERROR("Bad PSM Lengh");
       return;
     }
 
     uint16_t psm = *((uint16_t*)value);
-    VLOG(2) << "read psm:" << loghex(psm);
+    LOG_DEBUG("read psm:%s", loghex(psm).c_str());
 
     if (hearingDevice->gap_handle == GAP_INVALID_HANDLE &&
         BTM_IsEncrypted(hearingDevice->address, BT_TRANSPORT_LE)) {
@@ -925,12 +930,12 @@
         &cfg_info, nullptr, BTM_SEC_NONE /* TODO: request security ? */,
         HearingAidImpl::GapCallbackStatic, BT_TRANSPORT_LE);
     if (gap_handle == GAP_INVALID_HANDLE) {
-      LOG(ERROR) << "UNABLE TO GET gap_handle";
+      LOG_ERROR("UNABLE TO GET gap_handle");
       return;
     }
 
     hearingDevice->gap_handle = gap_handle;
-    LOG(INFO) << "Successfully sent GAP connect request";
+    LOG_INFO("Successfully sent GAP connect request");
   }
 
   static void OnReadOnlyPropertiesReadStatic(uint16_t conn_id,
@@ -959,7 +964,8 @@
   void OnDeviceReady(const RawAddress& address) {
     HearingDevice* hearingDevice = hearingDevices.FindByAddress(address);
     if (!hearingDevice) {
-      LOG(INFO) << "Device not connected to profile" << address;
+      LOG_INFO("Device not connected to profile %s",
+               address.ToStringForLogging().c_str());
       return;
     }
 
@@ -969,19 +975,17 @@
       hearingDevice->first_connection = false;
     }
 
-    LOG(INFO) << __func__ << ": audio_status_handle="
-              << loghex(hearingDevice->audio_status_handle)
-              << ", audio_status_ccc_handle="
-              << loghex(hearingDevice->audio_status_ccc_handle);
+    LOG_INFO("audio_status_handle=%s, audio_status_ccc_handle=%s",
+             loghex(hearingDevice->audio_status_handle).c_str(),
+             loghex(hearingDevice->audio_status_ccc_handle).c_str());
 
     /* Register and enable the Audio Status Notification */
     tGATT_STATUS register_status;
     register_status = BTA_GATTC_RegisterForNotifications(
         gatt_if, address, hearingDevice->audio_status_handle);
     if (register_status != GATT_SUCCESS) {
-      LOG(ERROR) << __func__
-                 << ": BTA_GATTC_RegisterForNotifications failed, status="
-                 << loghex(static_cast<uint8_t>(register_status));
+      LOG_ERROR("BTA_GATTC_RegisterForNotifications failed, status=%s",
+                loghex(static_cast<uint8_t>(register_status)).c_str());
       return;
     }
     std::vector<uint8_t> value(2);
@@ -1004,10 +1008,10 @@
 
     hearingDevice->connecting_actively = false;
     hearingDevice->accepting_audio = true;
-    LOG(INFO) << __func__ << ": address=" << address
-              << ", hi_sync_id=" << loghex(hearingDevice->hi_sync_id)
-              << ", codec_in_use=" << loghex(codec_in_use)
-              << ", audio_running=" << audio_running;
+    LOG_INFO("address=%s, hi_sync_id=%s, codec_in_use=%s, audio_running=%i",
+             address.ToStringForLogging().c_str(),
+             loghex(hearingDevice->hi_sync_id).c_str(),
+             loghex(codec_in_use).c_str(), audio_running);
 
     StartSendingAudio(*hearingDevice);
 
@@ -1017,7 +1021,7 @@
   }
 
   void StartSendingAudio(const HearingDevice& hearingDevice) {
-    VLOG(0) << __func__ << ": device=" << hearingDevice.address;
+    LOG_DEBUG("device=%s", hearingDevice.address.ToStringForLogging().c_str());
 
     if (encoder_state_left == nullptr) {
       encoder_state_init();
@@ -1047,9 +1051,9 @@
     CHECK(stop_audio_ticks) << "stop_audio_ticks is empty";
 
     if (!audio_running) {
-      LOG(WARNING) << __func__ << ": Unexpected audio suspend";
+      LOG_WARN("Unexpected audio suspend");
     } else {
-      LOG(INFO) << __func__ << ": audio_running=" << audio_running;
+      LOG_INFO("audio_running=%i", audio_running);
     }
     audio_running = false;
     stop_audio_ticks();
@@ -1059,11 +1063,11 @@
       if (!device.accepting_audio) continue;
 
       if (!device.playback_started) {
-        LOG(WARNING) << __func__
-                     << ": Playback not started, skip send Stop cmd, device="
-                     << device.address;
+        LOG_WARN("Playback not started, skip send Stop cmd, device=%s",
+                 device.address.ToStringForLogging().c_str());
       } else {
-        LOG(INFO) << __func__ << ": send Stop cmd, device=" << device.address;
+        LOG_INFO("send Stop cmd, device=%s",
+                 device.address.ToStringForLogging().c_str());
         device.playback_started = false;
         device.command_acked = false;
         BtaGattQueue::WriteCharacteristic(device.conn_id,
@@ -1077,9 +1081,9 @@
     CHECK(start_audio_ticks) << "start_audio_ticks is empty";
 
     if (audio_running) {
-      LOG(ERROR) << __func__ << ": Unexpected Audio Resume";
+      LOG_ERROR("Unexpected Audio Resume");
     } else {
-      LOG(INFO) << __func__ << ": audio_running=" << audio_running;
+      LOG_INFO("audio_running=%i", audio_running);
     }
 
     for (auto& device : hearingDevices.devices) {
@@ -1089,8 +1093,7 @@
     }
 
     if (!audio_running) {
-      LOG(INFO) << __func__ << ": No device (0/" << GetDeviceCount()
-                << ") ready to start";
+      LOG_INFO("No device (0/%d) ready to start", GetDeviceCount());
       return;
     }
 
@@ -1118,8 +1121,8 @@
   }
 
   void SendEnableServiceChangedInd(HearingDevice* device) {
-    VLOG(2) << __func__ << " Enable " << device->address
-            << "service changed ind.";
+    LOG_DEBUG("Enable service changed ind.%s",
+              device->address.ToStringForLogging().c_str());
     std::vector<uint8_t> value(2);
     uint8_t* ptr = value.data();
     UINT16_TO_STREAM(ptr, GATT_CHAR_CLIENT_CONFIG_INDICTION);
@@ -1135,13 +1138,11 @@
 
     if (!audio_running) {
       if (!device->playback_started) {
-        LOG(INFO) << __func__
-                  << ": Skip Send Start since audio is not running, device="
-                  << device->address;
+        LOG_INFO("Skip Send Start since audio is not running, device=%s",
+                 device->address.ToStringForLogging().c_str());
       } else {
-        LOG(ERROR) << __func__
-                   << ": Audio not running but Playback has started, device="
-                   << device->address;
+        LOG_ERROR("Audio not running but Playback has started, device=%s",
+                  device->address.ToStringForLogging().c_str());
       }
       return;
     }
@@ -1149,15 +1150,16 @@
     if (current_volume == VOLUME_UNKNOWN) start[3] = (uint8_t)VOLUME_MIN;
 
     if (device->playback_started) {
-      LOG(ERROR) << __func__
-                 << ": Playback already started, skip send Start cmd, device="
-                 << device->address;
+      LOG_ERROR("Playback already started, skip send Start cmd, device=%s",
+                device->address.ToStringForLogging().c_str());
     } else {
       start[4] = GetOtherSideStreamStatus(device);
-      LOG(INFO) << __func__ << ": send Start cmd, volume=" << loghex(start[3])
-                << ", audio type=" << loghex(start[2])
-                << ", device=" << device->address
-                << ", other side streaming=" << loghex(start[4]);
+      LOG_INFO(
+          "send Start cmd, volume=%s, audio type=%s, device=%s, other side "
+          "streaming=%s",
+          loghex(start[3]).c_str(), loghex(start[2]).c_str(),
+          device->address.ToStringForLogging().c_str(),
+          loghex(start[4]).c_str());
       device->command_acked = false;
       BtaGattQueue::WriteCharacteristic(
           device->conn_id, device->audio_control_point_handle, start,
@@ -1170,12 +1172,12 @@
                                            uint16_t len, const uint8_t* value,
                                            void* data) {
     if (status != GATT_SUCCESS) {
-      LOG(ERROR) << __func__ << ": handle=" << handle << ", conn_id=" << conn_id
-                 << ", status=" << loghex(static_cast<uint8_t>(status));
+      LOG_ERROR("handle=%u, conn_id=%u, status=%s", handle, conn_id,
+                loghex(static_cast<uint8_t>(status)).c_str());
       return;
     }
     if (!instance) {
-      LOG(ERROR) << __func__ << ": instance is null.";
+      LOG_ERROR("instance is null");
       return;
     }
     instance->StartAudioCtrlCallback(conn_id);
@@ -1184,10 +1186,10 @@
   void StartAudioCtrlCallback(uint16_t conn_id) {
     HearingDevice* hearingDevice = hearingDevices.FindByConnId(conn_id);
     if (!hearingDevice) {
-      LOG(ERROR) << "Skipping unknown device, conn_id=" << loghex(conn_id);
+      LOG_ERROR("Skipping unknown device, conn_id=%s", loghex(conn_id).c_str());
       return;
     }
-    LOG(INFO) << __func__ << ": device: " << hearingDevice->address;
+    LOG_INFO("device: %s", hearingDevice->address.ToStringForLogging().c_str());
     hearingDevice->playback_started = true;
   }
 
@@ -1202,7 +1204,7 @@
   bool NeedToDropPacket(HearingDevice* target_side, HearingDevice* other_side) {
     // Just drop packet if the other side does not exist.
     if (!other_side) {
-      VLOG(2) << __func__ << ": other side not connected to profile";
+      LOG_DEBUG("other side not connected to profile");
       return true;
     }
 
@@ -1211,14 +1213,14 @@
     uint16_t target_current_credit = L2CA_GetPeerLECocCredit(
         target_side->address, GAP_ConnGetL2CAPCid(target_side->gap_handle));
     if (target_current_credit == L2CAP_LE_CREDIT_MAX) {
-      LOG(ERROR) << __func__ << ": Get target side credit value fail.";
+      LOG_ERROR("Get target side credit value fail.");
       return true;
     }
 
     uint16_t other_current_credit = L2CA_GetPeerLECocCredit(
         other_side->address, GAP_ConnGetL2CAPCid(other_side->gap_handle));
     if (other_current_credit == L2CAP_LE_CREDIT_MAX) {
-      LOG(ERROR) << __func__ << ": Get other side credit value fail.";
+      LOG_ERROR("Get other side credit value fail.");
       return true;
     }
 
@@ -1227,24 +1229,23 @@
     } else {
       diff_credit = other_current_credit - target_current_credit;
     }
-    VLOG(2) << __func__ << ": Target(" << target_side->address
-            << ") Credit: " << target_current_credit << ", Other("
-            << other_side->address << ") Credit: " << other_current_credit
-            << ", Init Credit: " << init_credit;
+    LOG_DEBUG("Target(%s) Credit: %u, Other(%s) Credit: %u, Init Credit: %u",
+              target_side->address.ToStringForLogging().c_str(),
+              target_current_credit,
+              other_side->address.ToStringForLogging().c_str(),
+              other_current_credit, init_credit);
     return diff_credit < (init_credit / 2 - 1);
   }
 
   void OnAudioDataReady(const std::vector<uint8_t>& data) {
     /* For now we assume data comes in as 16bit per sample 16kHz PCM stereo */
-    DVLOG(2) << __func__;
-
     bool need_drop = false;
     int num_samples =
         data.size() / (2 /*bytes_per_sample*/ * 2 /*number of channels*/);
 
     // The G.722 codec accept only even number of samples for encoding
     if (num_samples % 2 != 0)
-      LOG(FATAL) << "num_samples is not even: " << num_samples;
+      LOG_ALWAYS_FATAL("num_samples is not even: %d", num_samples);
 
     // TODO: we should cache left/right and current state, instad of recomputing
     // it for each packet, 100 times a second.
@@ -1260,8 +1261,7 @@
     }
 
     if (left == nullptr && right == nullptr) {
-      LOG(WARNING) << __func__ << ": No more (0/" << GetDeviceCount()
-                   << ") devices ready";
+      LOG_WARN("No more (0/%d) devices ready", GetDeviceCount());
       DoDisconnectAudioStop();
       return;
     }
@@ -1317,13 +1317,15 @@
         // Compare the two sides LE CoC credit value to confirm need to drop or
         // skip audio packet.
         if (NeedToDropPacket(left, right)) {
-          LOG(INFO) << left->address << " triggers dropping, "
-                    << packets_in_chans << " packets in channel";
+          LOG_INFO("%s triggers dropping, %u packets in channel",
+                   left->address.ToStringForLogging().c_str(),
+                   packets_in_chans);
           need_drop = true;
           left->audio_stats.trigger_drop_count++;
         } else {
-          LOG(INFO) << left->address << " skipping " << packets_in_chans
-                    << " packets";
+          LOG_INFO("%s skipping %u packets",
+                   left->address.ToStringForLogging().c_str(),
+                   packets_in_chans);
           left->audio_stats.packet_flush_count += packets_in_chans;
           left->audio_stats.frame_flush_count++;
           L2CA_FlushChannel(cid, 0xffff);
@@ -1349,13 +1351,15 @@
         // Compare the two sides LE CoC credit value to confirm need to drop or
         // skip audio packet.
         if (NeedToDropPacket(right, left)) {
-          LOG(INFO) << right->address << " triggers dropping, "
-                    << packets_in_chans << " packets in channel";
+          LOG_INFO("%s triggers dropping, %u packets in channel",
+                   right->address.ToStringForLogging().c_str(),
+                   packets_in_chans);
           need_drop = true;
           right->audio_stats.trigger_drop_count++;
         } else {
-          LOG(INFO) << right->address << " skipping " << packets_in_chans
-                    << " packets";
+          LOG_INFO("%s skipping %u packets",
+                   right->address.ToStringForLogging().c_str(),
+                   packets_in_chans);
           right->audio_stats.packet_flush_count += packets_in_chans;
           right->audio_stats.frame_flush_count++;
           L2CA_FlushChannel(cid, 0xffff);
@@ -1399,10 +1403,9 @@
   void SendAudio(uint8_t* encoded_data, uint16_t packet_size,
                  HearingDevice* hearingAid) {
     if (!hearingAid->playback_started || !hearingAid->command_acked) {
-      VLOG(2) << __func__
-              << ": Playback stalled, device=" << hearingAid->address
-              << ", cmd send=" << hearingAid->playback_started
-              << ", cmd acked=" << hearingAid->command_acked;
+      LOG_DEBUG("Playback stalled, device=%s,cmd send=%i, cmd acked=%i",
+                hearingAid->address.ToStringForLogging().c_str(),
+                hearingAid->playback_started, hearingAid->command_acked);
       return;
     }
 
@@ -1412,19 +1415,20 @@
     p++;
     memcpy(p, encoded_data, packet_size);
 
-    DVLOG(2) << hearingAid->address << " : " << base::HexEncode(p, packet_size);
+    LOG_DEBUG("%s : %s", hearingAid->address.ToStringForLogging().c_str(),
+              base::HexEncode(p, packet_size).c_str());
 
     uint16_t result = GAP_ConnWriteData(hearingAid->gap_handle, audio_packet);
 
     if (result != BT_PASS) {
-      LOG(ERROR) << " Error sending data: " << loghex(result);
+      LOG_ERROR("Error sending data: %s", loghex(result).c_str());
     }
   }
 
   void GapCallback(uint16_t gap_handle, uint16_t event, tGAP_CB_DATA* data) {
     HearingDevice* hearingDevice = hearingDevices.FindByGapHandle(gap_handle);
     if (!hearingDevice) {
-      LOG(INFO) << "Skipping unknown device, gap_handle=" << gap_handle;
+      LOG_INFO("Skipping unknown device, gap_handle=%u", gap_handle);
       return;
     }
 
@@ -1436,12 +1440,13 @@
         init_credit =
             L2CA_GetPeerLECocCredit(address, GAP_ConnGetL2CAPCid(gap_handle));
 
-        LOG(INFO) << "GAP_EVT_CONN_OPENED " << address << ", tx_mtu=" << tx_mtu
-                  << ", init_credit=" << init_credit;
+        LOG_INFO("GAP_EVT_CONN_OPENED %s, tx_mtu=%u, init_credit=%u",
+                 address.ToStringForLogging().c_str(), tx_mtu, init_credit);
 
         HearingDevice* hearingDevice = hearingDevices.FindByAddress(address);
         if (!hearingDevice) {
-          LOG(INFO) << "Skipping unknown device" << address;
+          LOG_INFO("Skipping unknown device %s",
+                   address.ToStringForLogging().c_str());
           return;
         }
         hearingDevice->gap_opened = true;
@@ -1452,10 +1457,11 @@
       }
 
       case GAP_EVT_CONN_CLOSED:
-        LOG(INFO) << __func__
-                  << ": GAP_EVT_CONN_CLOSED: " << hearingDevice->address
-                  << ", playback_started=" << hearingDevice->playback_started
-                  << ", accepting_audio=" << hearingDevice->accepting_audio;
+        LOG_INFO(
+            "GAP_EVT_CONN_CLOSED: %s, playback_started=%i, "
+            "accepting_audio=%i",
+            hearingDevice->address.ToStringForLogging().c_str(),
+            hearingDevice->playback_started, hearingDevice->accepting_audio);
         if (!hearingDevice->accepting_audio) {
           /* Disconnect connection when data channel is not available */
           BTA_GATTC_Close(hearingDevice->conn_id);
@@ -1470,7 +1476,7 @@
         }
         break;
       case GAP_EVT_CONN_DATA_AVAIL: {
-        DVLOG(2) << "GAP_EVT_CONN_DATA_AVAIL";
+        LOG_DEBUG("GAP_EVT_CONN_DATA_AVAIL");
 
         // only data we receive back from hearing aids are some stats, not
         // really important, but useful now for debugging.
@@ -1483,28 +1489,28 @@
         GAP_ConnReadData(gap_handle, buffer.data(), buffer.size(), &bytes_read);
 
         if (bytes_read < 4) {
-          LOG(WARNING) << " Wrong data length";
+          LOG_WARN("Wrong data length");
           return;
         }
 
         uint8_t* p = buffer.data();
 
-        DVLOG(1) << "stats from the hearing aid:";
+        LOG_DEBUG("stats from the hearing aid:");
         for (size_t i = 0; i + 4 <= buffer.size(); i += 4) {
           uint16_t event_counter, frame_index;
           STREAM_TO_UINT16(event_counter, p);
           STREAM_TO_UINT16(frame_index, p);
-          DVLOG(1) << "event_counter=" << event_counter
-                   << " frame_index: " << frame_index;
+          LOG_DEBUG("event_counter=%u frame_index: %u", event_counter,
+                    frame_index);
         }
         break;
       }
 
       case GAP_EVT_TX_EMPTY:
-        DVLOG(2) << "GAP_EVT_TX_EMPTY";
+        LOG_DEBUG("GAP_EVT_TX_EMPTY");
         break;
       case GAP_EVT_CONN_CONGESTED:
-        DVLOG(2) << "GAP_EVT_CONN_CONGESTED";
+        LOG_DEBUG("GAP_EVT_CONN_CONGESTED");
 
         // TODO: make it into function
         HearingAidAudioSource::Stop();
@@ -1514,7 +1520,7 @@
         // encoder_state_right = nulllptr;
         break;
       case GAP_EVT_CONN_UNCONGESTED:
-        DVLOG(2) << "GAP_EVT_CONN_UNCONGESTED";
+        LOG_DEBUG("GAP_EVT_CONN_UNCONGESTED");
         break;
     }
   }
@@ -1543,8 +1549,8 @@
       char temptime[20];
       struct tm* tstamp = localtime(&rssi_logs.timestamp.tv_sec);
       if (!strftime(temptime, sizeof(temptime), "%H:%M:%S", tstamp)) {
-        LOG(ERROR) << __func__ << ": strftime fails. tm_sec=" << tstamp->tm_sec << ", tm_min=" << tstamp->tm_min
-                   << ", tm_hour=" << tstamp->tm_hour;
+        LOG_ERROR("strftime fails. tm_sec=%d, tm_min=%d, tm_hour=%d",
+                  tstamp->tm_sec, tstamp->tm_min, tstamp->tm_hour);
         strlcpy(temptime, "UNKNOWN TIME", sizeof(temptime));
       }
       snprintf(eventtime, sizeof(eventtime), "%s.%03ld", temptime, rssi_logs.timestamp.tv_nsec / 1000000);
@@ -1585,22 +1591,22 @@
     dprintf(fd, "%s", stream.str().c_str());
   }
 
-  void Disconnect(const RawAddress& address) override {
-    DVLOG(2) << __func__;
+  void Disconnect(const RawAddress& address) {
     HearingDevice* hearingDevice = hearingDevices.FindByAddress(address);
     if (!hearingDevice) {
-      LOG(INFO) << "Device not connected to profile" << address;
+      LOG_INFO("Device not connected to profile %s",
+               address.ToStringForLogging().c_str());
       return;
     }
 
-    VLOG(2) << __func__ << ": " << address;
+    LOG_DEBUG("%s", address.ToStringForLogging().c_str());
 
     bool connected = hearingDevice->accepting_audio;
     bool connecting_by_user = hearingDevice->connecting_actively;
 
-    LOG(INFO) << __func__ << ": " << hearingDevice->address
-              << ", playback_started=" << hearingDevice->playback_started
-              << ", accepting_audio=" << hearingDevice->accepting_audio;
+    LOG_INFO("%s, playback_started=%i, accepting_audio=%i",
+             hearingDevice->address.ToStringForLogging().c_str(),
+             hearingDevice->playback_started, hearingDevice->accepting_audio);
 
     if (hearingDevice->connecting_actively) {
       // cancel pending direct connect
@@ -1633,8 +1639,7 @@
     for (const auto& device : hearingDevices.devices) {
       if (device.accepting_audio) return;
     }
-    LOG(INFO) << __func__ << ": No more (0/" << GetDeviceCount()
-              << ") devices ready";
+    LOG_INFO("No more (0/%d) devices ready", GetDeviceCount());
     DoDisconnectAudioStop();
   }
 
@@ -1642,12 +1647,12 @@
                           RawAddress remote_bda) {
     HearingDevice* hearingDevice = hearingDevices.FindByConnId(conn_id);
     if (!hearingDevice) {
-      VLOG(2) << "Skipping unknown device disconnect, conn_id="
-              << loghex(conn_id);
+      LOG_DEBUG("Skipping unknown device disconnect, conn_id=%s",
+                loghex(conn_id).c_str());
       return;
     }
-    VLOG(2) << __func__ << ": conn_id=" << loghex(conn_id)
-            << ", remote_bda=" << remote_bda;
+    LOG_DEBUG("conn_id=%s, remote_bda=%s", loghex(conn_id).c_str(),
+              remote_bda.ToStringForLogging().c_str());
 
     // Inform the other side (if any) of this disconnection
     std::vector<uint8_t> inform_disconn_state(
@@ -1658,23 +1663,23 @@
 
     // This is needed just for the first connection. After stack is restarted,
     // code that loads device will add them to acceptlist.
-    BTA_GATTC_Open(gatt_if, hearingDevice->address, false, false);
+    BTA_GATTC_Open(gatt_if, hearingDevice->address,
+                   BTM_BLE_BKG_CONNECT_ALLOW_LIST, false);
 
     callbacks->OnConnectionState(ConnectionState::DISCONNECTED, remote_bda);
 
     for (const auto& device : hearingDevices.devices) {
       if (device.accepting_audio) return;
     }
-    LOG(INFO) << __func__ << ": No more (0/" << GetDeviceCount()
-              << ") devices ready";
+    LOG_INFO("No more (0/%d) devices ready", GetDeviceCount());
     DoDisconnectAudioStop();
   }
 
   void DoDisconnectCleanUp(HearingDevice* hearingDevice) {
     if (hearingDevice->connection_update_status != COMPLETED) {
-      LOG(INFO) << __func__ << ": connection update not completed. Current="
-                << hearingDevice->connection_update_status
-                << ", device=" << hearingDevice->address;
+      LOG_INFO("connection update not completed. Current=%u, device=%s",
+               hearingDevice->connection_update_status,
+               hearingDevice->address.ToStringForLogging().c_str());
 
       if (hearingDevice->connection_update_status == STARTED) {
         OnConnectionUpdateComplete(hearingDevice->conn_id, NULL);
@@ -1695,8 +1700,9 @@
     }
 
     hearingDevice->accepting_audio = false;
-    LOG(INFO) << __func__ << ": device=" << hearingDevice->address
-              << ", playback_started=" << hearingDevice->playback_started;
+    LOG_INFO("device=%s, playback_started=%i",
+             hearingDevice->address.ToStringForLogging().c_str(),
+             hearingDevice->playback_started);
     hearingDevice->playback_started = false;
     hearingDevice->command_acked = false;
   }
@@ -1708,8 +1714,8 @@
     current_volume = VOLUME_UNKNOWN;
   }
 
-  void SetVolume(int8_t volume) override {
-    VLOG(2) << __func__ << ": " << +volume;
+  void SetVolume(int8_t volume) {
+    LOG_DEBUG("%d", volume);
     current_volume = volume;
     for (HearingDevice& device : hearingDevices.devices) {
       if (!device.accepting_audio) continue;
@@ -1752,7 +1758,7 @@
                                       const gatt::Service* service) {
     HearingDevice* hearingDevice = hearingDevices.FindByConnId(conn_id);
     if (!hearingDevice) {
-      DVLOG(2) << "Skipping unknown device, conn_id=" << loghex(conn_id);
+      LOG_DEBUG("Skipping unknown device, conn_id=%s", loghex(conn_id).c_str());
       return;
     }
     for (const gatt::Characteristic& charac : service->characteristics) {
@@ -1760,12 +1766,11 @@
         hearingDevice->service_changed_ccc_handle =
             find_ccc_handle(conn_id, charac.value_handle);
         if (!hearingDevice->service_changed_ccc_handle) {
-          LOG(ERROR) << __func__
-                     << ": cannot find service changed CCC descriptor";
+          LOG_ERROR("cannot find service changed CCC descriptor");
           continue;
         }
-        LOG(INFO) << __func__ << " service_changed_ccc="
-                  << loghex(hearingDevice->service_changed_ccc_handle);
+        LOG_INFO("service_changed_ccc=%s",
+                 loghex(hearingDevice->service_changed_ccc_handle).c_str());
         break;
       }
     }
@@ -1778,7 +1783,7 @@
         BTA_GATTC_GetCharacteristic(conn_id, char_handle);
 
     if (!p_char) {
-      LOG(WARNING) << __func__ << ": No such characteristic: " << char_handle;
+      LOG_WARN("No such characteristic: %u", char_handle);
       return 0;
     }
 
@@ -1793,14 +1798,14 @@
   void send_state_change(HearingDevice* device, std::vector<uint8_t> payload) {
     if (device->conn_id != 0) {
       if (device->service_changed_rcvd) {
-        LOG(INFO)
-            << __func__
-            << ": service discover is in progress, skip send State Change cmd.";
+        LOG_INFO(
+            "service discover is in progress, skip send State Change cmd.");
         return;
       }
       // Send the data packet
-      LOG(INFO) << __func__ << ": Send State Change. device=" << device->address
-                << ", status=" << loghex(payload[1]);
+      LOG_INFO("Send State Change. device=%s, status=%s",
+               device->address.ToStringForLogging().c_str(),
+               loghex(payload[1]).c_str());
       BtaGattQueue::WriteCharacteristic(
           device->conn_id, device->audio_control_point_handle, payload,
           GATT_WRITE_NO_RSP, nullptr, nullptr);
@@ -1823,7 +1828,7 @@
       device->num_intervals_since_last_rssi_read++;
       if (device->num_intervals_since_last_rssi_read >= PERIOD_TO_READ_RSSI_IN_INTERVALS) {
         device->num_intervals_since_last_rssi_read = 0;
-        VLOG(1) << __func__ << ": device=" << device->address;
+        LOG_DEBUG("device=%s", device->address.ToStringForLogging().c_str());
         BTM_ReadRSSI(device->address, read_rssi_cb);
       }
     }
@@ -1841,7 +1846,7 @@
 }
 
 void hearingaid_gattc_callback(tBTA_GATTC_EVT event, tBTA_GATTC* p_data) {
-  VLOG(2) << __func__ << " event = " << +event;
+  LOG_DEBUG("event = %u", event);
 
   if (p_data == nullptr) return;
 
@@ -1872,9 +1877,8 @@
     case BTA_GATTC_NOTIF_EVT:
       if (!instance) return;
       if (!p_data->notify.is_notify || p_data->notify.len > GATT_MAX_ATTR_LEN) {
-        LOG(ERROR) << __func__ << ": rejected BTA_GATTC_NOTIF_EVT. is_notify="
-                   << p_data->notify.is_notify
-                   << ", len=" << p_data->notify.len;
+        LOG_ERROR("rejected BTA_GATTC_NOTIF_EVT. is_notify=%i, len=%u",
+                  p_data->notify.is_notify, p_data->notify.len);
         break;
       }
       instance->OnNotificationEvent(p_data->notify.conn_id,
@@ -1943,7 +1947,8 @@
 void HearingAid::Initialize(
     bluetooth::hearing_aid::HearingAidCallbacks* callbacks, Closure initCb) {
   if (instance) {
-    LOG(ERROR) << "Already initialized!";
+    LOG_ERROR("Already initialized!");
+    return;
   }
 
   audioReceiver = &audioReceiverImpl;
@@ -1953,15 +1958,42 @@
 
 bool HearingAid::IsHearingAidRunning() { return instance; }
 
-HearingAid* HearingAid::Get() {
-  CHECK(instance);
-  return instance;
-};
+void HearingAid::Connect(const RawAddress& address) {
+  if (!instance) {
+    LOG_ERROR("Hearing Aid instance is not available");
+    return;
+  }
+  instance->Connect(address);
+}
+
+void HearingAid::Disconnect(const RawAddress& address) {
+  if (!instance) {
+    LOG_ERROR("Hearing Aid instance is not available");
+    return;
+  }
+  instance->Disconnect(address);
+}
+
+void HearingAid::AddToAcceptlist(const RawAddress& address) {
+  if (!instance) {
+    LOG_ERROR("Hearing Aid instance is not available");
+    return;
+  }
+  instance->AddToAcceptlist(address);
+}
+
+void HearingAid::SetVolume(int8_t volume) {
+  if (!instance) {
+    LOG_ERROR("Hearing Aid instance is not available");
+    return;
+  }
+  instance->SetVolume(volume);
+}
 
 void HearingAid::AddFromStorage(const HearingDevice& dev_info,
                                 uint16_t is_acceptlisted) {
   if (!instance) {
-    LOG(ERROR) << "Not initialized yet";
+    LOG_ERROR("Not initialized yet");
   }
 
   instance->AddFromStorage(dev_info, is_acceptlisted);
@@ -1969,7 +2001,7 @@
 
 int HearingAid::GetDeviceCount() {
   if (!instance) {
-    LOG(INFO) << __func__ << ": Not initialized yet";
+    LOG_INFO("Not initialized yet");
     return 0;
   }
 
diff --git a/system/bta/hearing_aid/hearing_aid_audio_source.cc b/system/bta/hearing_aid/hearing_aid_audio_source.cc
index c7dc6ae..e347f87 100644
--- a/system/bta/hearing_aid/hearing_aid_audio_source.cc
+++ b/system/bta/hearing_aid/hearing_aid_audio_source.cc
@@ -18,6 +18,7 @@
 
 #include <base/files/file_util.h>
 #include <base/logging.h>
+
 #include <cstdint>
 #include <memory>
 #include <sstream>
@@ -28,6 +29,7 @@
 #include "bta/include/bta_hearing_aid_api.h"
 #include "common/repeating_timer.h"
 #include "common/time_util.h"
+#include "osi/include/log.h"
 #include "osi/include/wakelock.h"
 #include "stack/include/btu.h"  // get_main_thread
 #include "udrv/include/uipc.h"
@@ -98,7 +100,7 @@
                            bytes_per_tick);
   }
 
-  VLOG(2) << "bytes_read: " << bytes_read;
+  LOG_DEBUG("bytes_read: %u", bytes_read);
   if (bytes_read < bytes_per_tick) {
     stats.media_read_total_underflow_bytes += bytes_per_tick - bytes_read;
     stats.media_read_total_underflow_count++;
@@ -115,14 +117,14 @@
 
 void hearing_aid_send_ack(tHEARING_AID_CTRL_ACK status) {
   uint8_t ack = status;
-  DVLOG(2) << "Hearing Aid audio ctrl ack: " << status;
+  LOG_DEBUG("Hearing Aid audio ctrl ack: %u", status);
   UIPC_Send(*uipc_hearing_aid, UIPC_CH_ID_AV_CTRL, 0, &ack, sizeof(ack));
 }
 
 void start_audio_ticks() {
   if (data_interval_ms != HA_INTERVAL_10_MS &&
       data_interval_ms != HA_INTERVAL_20_MS) {
-    LOG(FATAL) << " Unsupported data interval: " << data_interval_ms;
+    LOG_ALWAYS_FATAL("Unsupported data interval: %d", data_interval_ms);
   }
 
   wakelock_acquire();
@@ -133,20 +135,20 @@
 #else
       base::Milliseconds(data_interval_ms));
 #endif
-  LOG(INFO) << __func__ << ": running with data interval: " << data_interval_ms;
+  LOG_INFO("running with data interval: %d", data_interval_ms);
 }
 
 void stop_audio_ticks() {
-  LOG(INFO) << __func__ << ": stopped";
+  LOG_INFO("stopped");
   audio_timer.CancelAndWait();
   wakelock_release();
 }
 
 void hearing_aid_data_cb(tUIPC_CH_ID, tUIPC_EVENT event) {
-  DVLOG(2) << "Hearing Aid audio data event: " << event;
+  LOG_DEBUG("Hearing Aid audio data event: %u", event);
   switch (event) {
     case UIPC_OPEN_EVT:
-      LOG(INFO) << __func__ << ": UIPC_OPEN_EVT";
+      LOG_INFO("UIPC_OPEN_EVT");
       /*
        * Read directly from media task from here on (keep callback for
        * connection events.
@@ -159,12 +161,12 @@
       do_in_main_thread(FROM_HERE, base::BindOnce(start_audio_ticks));
       break;
     case UIPC_CLOSE_EVT:
-      LOG(INFO) << __func__ << ": UIPC_CLOSE_EVT";
+      LOG_INFO("UIPC_CLOSE_EVT");
       hearing_aid_send_ack(HEARING_AID_CTRL_ACK_SUCCESS);
       do_in_main_thread(FROM_HERE, base::BindOnce(stop_audio_ticks));
       break;
     default:
-      LOG(ERROR) << "Hearing Aid audio data event not recognized:" << event;
+      LOG_ERROR("Hearing Aid audio data event not recognized: %u", event);
   }
 }
 
@@ -178,12 +180,12 @@
 
   /* detach on ctrl channel means audioflinger process was terminated */
   if (n == 0) {
-    LOG(WARNING) << __func__ << "CTRL CH DETACHED";
+    LOG_WARN("CTRL CH DETACHED");
     UIPC_Close(*uipc_hearing_aid, UIPC_CH_ID_AV_CTRL);
     return;
   }
 
-  LOG(INFO) << __func__ << " " << audio_ha_hw_dump_ctrl_event(cmd);
+  LOG_INFO("%s", audio_ha_hw_dump_ctrl_event(cmd));
   //  a2dp_cmd_pending = cmd;
 
   tHEARING_AID_CTRL_ACK ctrl_ack_status;
@@ -207,7 +209,9 @@
 
     case HEARING_AID_CTRL_CMD_STOP:
       if (!hearing_aid_on_suspend_req()) {
-        LOG(INFO) << __func__ << ":HEARING_AID_CTRL_CMD_STOP: hearing_aid_on_suspend_req() errs, but ignored.";
+        LOG_INFO(
+            "HEARING_AID_CTRL_CMD_STOP: hearing_aid_on_suspend_req() errs, but "
+            "ignored.");
       }
       hearing_aid_send_ack(HEARING_AID_CTRL_ACK_SUCCESS);
       break;
@@ -230,7 +234,7 @@
         codec_config.sample_rate = BTAV_A2DP_CODEC_SAMPLE_RATE_24000;
         codec_capability.sample_rate = BTAV_A2DP_CODEC_SAMPLE_RATE_24000;
       } else {
-        LOG(FATAL) << "unsupported sample rate: " << sample_rate;
+        LOG_ALWAYS_FATAL("unsupported sample rate: %d", sample_rate);
       }
 
       codec_config.bits_per_sample = BTAV_A2DP_CODEC_BITS_PER_SAMPLE_16;
@@ -278,15 +282,14 @@
                     reinterpret_cast<uint8_t*>(&codec_config.sample_rate),
                     sizeof(btav_a2dp_codec_sample_rate_t)) !=
           sizeof(btav_a2dp_codec_sample_rate_t)) {
-        LOG(ERROR) << __func__ << "Error reading sample rate from audio HAL";
+        LOG_ERROR("Error reading sample rate from audio HAL");
         break;
       }
       if (UIPC_Read(*uipc_hearing_aid, UIPC_CH_ID_AV_CTRL,
                     reinterpret_cast<uint8_t*>(&codec_config.bits_per_sample),
                     sizeof(btav_a2dp_codec_bits_per_sample_t)) !=
           sizeof(btav_a2dp_codec_bits_per_sample_t)) {
-        LOG(ERROR) << __func__
-                   << "Error reading bits per sample from audio HAL";
+        LOG_ERROR("Error reading bits per sample from audio HAL");
 
         break;
       }
@@ -294,29 +297,28 @@
                     reinterpret_cast<uint8_t*>(&codec_config.channel_mode),
                     sizeof(btav_a2dp_codec_channel_mode_t)) !=
           sizeof(btav_a2dp_codec_channel_mode_t)) {
-        LOG(ERROR) << __func__ << "Error reading channel mode from audio HAL";
+        LOG_ERROR("Error reading channel mode from audio HAL");
 
         break;
       }
-      LOG(INFO) << __func__ << " HEARING_AID_CTRL_SET_OUTPUT_AUDIO_CONFIG: "
-                << "sample_rate=" << codec_config.sample_rate
-                << "bits_per_sample=" << codec_config.bits_per_sample
-                << "channel_mode=" << codec_config.channel_mode;
+      LOG_INFO(
+          "HEARING_AID_CTRL_SET_OUTPUT_AUDIO_CONFIG: sample_rate=%u, "
+          "bits_per_sample=%u,channel_mode=%u",
+          codec_config.sample_rate, codec_config.bits_per_sample,
+          codec_config.channel_mode);
       break;
     }
 
     default:
-      LOG(ERROR) << __func__ << "UNSUPPORTED CMD: " << cmd;
+      LOG_ERROR("UNSUPPORTED CMD: %u", cmd);
       hearing_aid_send_ack(HEARING_AID_CTRL_ACK_FAILURE);
       break;
   }
-  LOG(INFO) << __func__
-            << " a2dp-ctrl-cmd : " << audio_ha_hw_dump_ctrl_event(cmd)
-            << " DONE";
+  LOG_INFO("a2dp-ctrl-cmd : %s DONE", audio_ha_hw_dump_ctrl_event(cmd));
 }
 
 void hearing_aid_ctrl_cb(tUIPC_CH_ID, tUIPC_EVENT event) {
-  VLOG(2) << "Hearing Aid audio ctrl event: " << event;
+  LOG_DEBUG("Hearing Aid audio ctrl event: %u", event);
   switch (event) {
     case UIPC_OPEN_EVT:
       break;
@@ -331,14 +333,13 @@
       hearing_aid_recv_ctrl_data();
       break;
     default:
-      LOG(ERROR) << "Hearing Aid audio ctrl unrecognized event: " << event;
+      LOG_ERROR("Hearing Aid audio ctrl unrecognized event: %u", event);
   }
 }
 
 bool hearing_aid_on_resume_req(bool start_media_task) {
   if (localAudioReceiver == nullptr) {
-    LOG(ERROR) << __func__
-               << ": HEARING_AID_CTRL_CMD_START: audio receiver not started";
+    LOG_ERROR("HEARING_AID_CTRL_CMD_START: audio receiver not started");
     return false;
   }
   bt_status_t status;
@@ -349,7 +350,7 @@
                                   start_audio_ticks));
   } else {
     auto start_dummy_ticks = []() {
-      LOG(INFO) << "start_audio_ticks: waiting for data path opened";
+      LOG_INFO("start_audio_ticks: waiting for data path opened");
     };
     status = do_in_main_thread(
         FROM_HERE, base::BindOnce(&HearingAidAudioReceiver::OnAudioResume,
@@ -357,9 +358,7 @@
                                   start_dummy_ticks));
   }
   if (status != BT_STATUS_SUCCESS) {
-    LOG(ERROR) << __func__
-               << ": HEARING_AID_CTRL_CMD_START: do_in_main_thread err="
-               << status;
+    LOG_ERROR("HEARING_AID_CTRL_CMD_START: do_in_main_thread err=%u", status);
     return false;
   }
   return true;
@@ -367,8 +366,7 @@
 
 bool hearing_aid_on_suspend_req() {
   if (localAudioReceiver == nullptr) {
-    LOG(ERROR) << __func__
-               << ": HEARING_AID_CTRL_CMD_SUSPEND: audio receiver not started";
+    LOG_ERROR("HEARING_AID_CTRL_CMD_SUSPEND: audio receiver not started");
     return false;
   }
   bt_status_t status = do_in_main_thread(
@@ -376,9 +374,7 @@
       base::BindOnce(&HearingAidAudioReceiver::OnAudioSuspend,
                      base::Unretained(localAudioReceiver), stop_audio_ticks));
   if (status != BT_STATUS_SUCCESS) {
-    LOG(ERROR) << __func__
-               << ": HEARING_AID_CTRL_CMD_SUSPEND: do_in_main_thread err="
-               << status;
+    LOG_ERROR("HEARING_AID_CTRL_CMD_SUSPEND: do_in_main_thread err=%u", status);
     return false;
   }
   return true;
@@ -388,7 +384,7 @@
 void HearingAidAudioSource::Start(const CodecConfiguration& codecConfiguration,
                                   HearingAidAudioReceiver* audioReceiver,
                                   uint16_t remote_delay_ms) {
-  LOG(INFO) << __func__ << ": Hearing Aid Source Open";
+  LOG_INFO("Hearing Aid Source Open");
 
   bit_rate = codecConfiguration.bit_rate;
   sample_rate = codecConfiguration.sample_rate;
@@ -404,7 +400,7 @@
 }
 
 void HearingAidAudioSource::Stop() {
-  LOG(INFO) << __func__ << ": Hearing Aid Source Close";
+  LOG_INFO("Hearing Aid Source Close");
 
   localAudioReceiver = nullptr;
   if (bluetooth::audio::hearing_aid::is_hal_enabled()) {
@@ -420,7 +416,7 @@
       .on_suspend_ = hearing_aid_on_suspend_req,
   };
   if (!bluetooth::audio::hearing_aid::init(stream_cb, get_main_thread())) {
-    LOG(WARNING) << __func__ << ": Using legacy HAL";
+    LOG_WARN("Using legacy HAL");
     uipc_hearing_aid = UIPC_Init();
     UIPC_Open(*uipc_hearing_aid, UIPC_CH_ID_AV_CTRL, hearing_aid_ctrl_cb, HEARING_AID_CTRL_PATH);
   }
diff --git a/system/bta/hf_client/bta_hf_client_api.cc b/system/bta/hf_client/bta_hf_client_api.cc
index 15d57fe..d64b5ed 100644
--- a/system/bta/hf_client/bta_hf_client_api.cc
+++ b/system/bta/hf_client/bta_hf_client_api.cc
@@ -28,6 +28,10 @@
 
 #include <cstdint>
 
+#ifdef OS_ANDROID
+#include <hfp.sysprop.h>
+#endif
+
 #include "bt_trace.h"  // Legacy trace logging
 #include "bta/hf_client/bta_hf_client_int.h"
 #include "bta/sys/bta_sys.h"
@@ -80,17 +84,17 @@
  * Description      Opens up a RF connection to the remote device and
  *                  subsequently set it up for a HF SLC
  *
- * Returns          void
+ * Returns          bt_status_t
  *
  ******************************************************************************/
-void BTA_HfClientOpen(const RawAddress& bd_addr, uint16_t* p_handle) {
+bt_status_t BTA_HfClientOpen(const RawAddress& bd_addr, uint16_t* p_handle) {
   APPL_TRACE_DEBUG("%s", __func__);
   tBTA_HF_CLIENT_API_OPEN* p_buf =
       (tBTA_HF_CLIENT_API_OPEN*)osi_malloc(sizeof(tBTA_HF_CLIENT_API_OPEN));
 
   if (!bta_hf_client_allocate_handle(bd_addr, p_handle)) {
     APPL_TRACE_ERROR("%s: could not allocate handle", __func__);
-    return;
+    return BT_STATUS_FAIL;
   }
 
   p_buf->hdr.event = BTA_HF_CLIENT_API_OPEN_EVT;
@@ -98,6 +102,7 @@
   p_buf->bd_addr = bd_addr;
 
   bta_sys_sendmsg(p_buf);
+  return BT_STATUS_SUCCESS;
 }
 
 /*******************************************************************************
@@ -203,3 +208,29 @@
  *
  ******************************************************************************/
 void BTA_HfClientDumpStatistics(int fd) { bta_hf_client_dump_statistics(fd); }
+
+/*******************************************************************************
+ *
+ * function         get_default_hf_client_features
+ *
+ * description      return the hf_client features.
+ *                  value can be override via system property
+ *
+ * returns          int
+ *
+ ******************************************************************************/
+int get_default_hf_client_features() {
+#define DEFAULT_BTIF_HF_CLIENT_FEATURES                                        \
+  (BTA_HF_CLIENT_FEAT_ECNR | BTA_HF_CLIENT_FEAT_3WAY |                         \
+   BTA_HF_CLIENT_FEAT_CLI | BTA_HF_CLIENT_FEAT_VREC | BTA_HF_CLIENT_FEAT_VOL | \
+   BTA_HF_CLIENT_FEAT_ECS | BTA_HF_CLIENT_FEAT_ECC | BTA_HF_CLIENT_FEAT_CODEC)
+
+#ifdef OS_ANDROID
+  static const int features =
+      android::sysprop::bluetooth::Hfp::hf_client_features().value_or(
+          DEFAULT_BTIF_HF_CLIENT_FEATURES);
+  return features;
+#else
+  return DEFAULT_BTIF_HF_CLIENT_FEATURES;
+#endif
+}
diff --git a/system/bta/hf_client/bta_hf_client_at.cc b/system/bta/hf_client/bta_hf_client_at.cc
index 5c08331..97fcb97 100644
--- a/system/bta/hf_client/bta_hf_client_at.cc
+++ b/system/bta/hf_client/bta_hf_client_at.cc
@@ -20,11 +20,11 @@
 #define LOG_TAG "bt_hf_client"
 
 #include "bt_trace.h"  // Legacy trace logging
-
 #include "bta/hf_client/bta_hf_client_int.h"
 #include "osi/include/allocator.h"
 #include "osi/include/compat.h"
 #include "osi/include/log.h"
+#include "osi/include/properties.h"
 #include "stack/include/port_api.h"
 
 /* Uncomment to enable AT traffic dumping */
@@ -124,7 +124,7 @@
   tBTA_HF_CLIENT_AT_QCMD* new_cmd =
       (tBTA_HF_CLIENT_AT_QCMD*)osi_malloc(sizeof(tBTA_HF_CLIENT_AT_QCMD));
 
-  APPL_TRACE_DEBUG("%s", __func__);
+  APPL_TRACE_DEBUG("%s: cmd:%d", __func__, (int)cmd);
 
   new_cmd->cmd = cmd;
   new_cmd->buf_len = buf_len;
@@ -169,7 +169,7 @@
 static void bta_hf_client_send_at(tBTA_HF_CLIENT_CB* client_cb,
                                   tBTA_HF_CLIENT_AT_CMD cmd, const char* buf,
                                   uint16_t buf_len) {
-  APPL_TRACE_DEBUG("%s", __func__);
+  APPL_TRACE_DEBUG("%s %d", __func__, cmd);
   if ((client_cb->at_cb.current_cmd == BTA_HF_CLIENT_AT_NONE ||
        !client_cb->svc_conn) &&
       !alarm_is_scheduled(client_cb->at_cb.hold_timer)) {
@@ -197,6 +197,7 @@
     return;
   }
 
+  APPL_TRACE_DEBUG("%s: busy! queued: %d", __func__, cmd);
   bta_hf_client_queue_at(client_cb, cmd, buf, buf_len);
 }
 
@@ -240,7 +241,8 @@
  ******************************************************************************/
 
 static void bta_hf_client_handle_ok(tBTA_HF_CLIENT_CB* client_cb) {
-  APPL_TRACE_DEBUG("%s", __func__);
+  APPL_TRACE_DEBUG("%s: current_cmd:%d", __func__,
+                   client_cb->at_cb.current_cmd);
 
   bta_hf_client_stop_at_resp_timer(client_cb);
 
@@ -265,6 +267,9 @@
     case BTA_HF_CLIENT_AT_NONE:
       bta_hf_client_stop_at_hold_timer(client_cb);
       break;
+    case BTA_HF_CLIENT_AT_ANDROID:
+      bta_hf_client_at_result(client_cb, BTA_HF_CLIENT_AT_RESULT_OK, 0);
+      break;
     default:
       if (client_cb->send_at_reply) {
         bta_hf_client_at_result(client_cb, BTA_HF_CLIENT_AT_RESULT_OK, 0);
@@ -280,7 +285,8 @@
 static void bta_hf_client_handle_error(tBTA_HF_CLIENT_CB* client_cb,
                                        tBTA_HF_CLIENT_AT_RESULT_TYPE type,
                                        uint16_t cme) {
-  APPL_TRACE_DEBUG("%s: %u %u", __func__, type, cme);
+  APPL_TRACE_DEBUG("%s: type:%u cme:%u current_cmd:%d", __func__, type, cme,
+                   client_cb->at_cb.current_cmd);
 
   bta_hf_client_stop_at_resp_timer(client_cb);
 
@@ -301,6 +307,9 @@
         client_cb->send_at_reply = true;
       }
       break;
+    case BTA_HF_CLIENT_AT_ANDROID:
+      bta_hf_client_at_result(client_cb, type, cme);
+      break;
     default:
       if (client_cb->send_at_reply) {
         bta_hf_client_at_result(client_cb, type, cme);
@@ -1724,7 +1733,6 @@
   /* prevent buffer overflow in cases where LEN exceeds available buffer space
    */
   if (len > BTA_HF_CLIENT_AT_PARSER_MAX_LEN - client_cb->at_cb.offset) {
-    android_errorWriteWithInfoLog(0x534e4554, "231156521", -1, NULL, 0);
     return;
   }
 
@@ -2140,19 +2148,19 @@
 
   at_len = snprintf(buf, sizeof(buf), "AT+BIA=");
 
+  const int32_t position = osi_property_get_int32(
+      "bluetooth.headset_client.disable_indicator.position", -1);
+
   for (i = 0; i < BTA_HF_CLIENT_AT_INDICATOR_COUNT; i++) {
     int sup = client_cb->at_cb.indicator_lookup[i] == -1 ? 0 : 1;
 
-/* If this value matches the position of SIGNAL in the indicators array,
- * then hardcode disable signal strength indicators.
- * indicator_lookup[i] points to the position in the bta_hf_client_indicators
- * array defined at the top of this file */
-#ifdef BTA_HF_CLIENT_INDICATOR_SIGNAL_POS
-    if (client_cb->at_cb.indicator_lookup[i] ==
-        BTA_HF_CLIENT_INDICATOR_SIGNAL_POS) {
+    /* If this value matches the position of SIGNAL in the indicators array,
+     * then hardcode disable signal strength indicators.
+     * indicator_lookup[i] points to the position in the
+     * bta_hf_client_indicators array defined at the top of this file */
+    if (client_cb->at_cb.indicator_lookup[i] == position) {
       sup = 0;
     }
-#endif
 
     at_len += snprintf(buf + at_len, sizeof(buf) - at_len, "%u,", sup);
   }
@@ -2186,6 +2194,22 @@
                         at_len);
 }
 
+void bta_hf_client_send_at_android(tBTA_HF_CLIENT_CB* client_cb,
+                                   const char* str) {
+  char buf[BTA_HF_CLIENT_AT_MAX_LEN];
+  int at_len;
+
+  APPL_TRACE_DEBUG("%s", __func__);
+
+  at_len = snprintf(buf, sizeof(buf), "AT%s\r", str);
+  if (at_len < 0) {
+    APPL_TRACE_ERROR("%s: AT command Framing error", __func__);
+    return;
+  }
+
+  bta_hf_client_send_at(client_cb, BTA_HF_CLIENT_AT_ANDROID, buf, at_len);
+}
+
 void bta_hf_client_at_init(tBTA_HF_CLIENT_CB* client_cb) {
   alarm_free(client_cb->at_cb.resp_timer);
   alarm_free(client_cb->at_cb.hold_timer);
@@ -2285,6 +2309,9 @@
     case BTA_HF_CLIENT_AT_CMD_VENDOR_SPECIFIC_CMD:
       bta_hf_client_send_at_vendor_specific_cmd(client_cb, p_val->str);
       break;
+    case BTA_HF_CLIENT_AT_CMD_ANDROID:
+      bta_hf_client_send_at_android(client_cb, p_val->str);
+      break;
     default:
       APPL_TRACE_ERROR("Default case");
       snprintf(buf, BTA_HF_CLIENT_AT_MAX_LEN,
diff --git a/system/bta/hf_client/bta_hf_client_int.h b/system/bta/hf_client/bta_hf_client_int.h
index 3c13e6c..cfa63bf 100755
--- a/system/bta/hf_client/bta_hf_client_int.h
+++ b/system/bta/hf_client/bta_hf_client_int.h
@@ -105,6 +105,7 @@
   BTA_HF_CLIENT_AT_BIND_READ_ENABLED_IND,
   BTA_HF_CLIENT_AT_BIEV,
   BTA_HF_CLIENT_AT_VENDOR_SPECIFIC,
+  BTA_HF_CLIENT_AT_ANDROID,
 };
 
 /*****************************************************************************
diff --git a/system/bta/hf_client/bta_hf_client_sdp.cc b/system/bta/hf_client/bta_hf_client_sdp.cc
index 96b7a6d..cfb88d3 100755
--- a/system/bta/hf_client/bta_hf_client_sdp.cc
+++ b/system/bta/hf_client/bta_hf_client_sdp.cc
@@ -46,6 +46,22 @@
 /* Number of elements in service class id list. */
 #define BTA_HF_CLIENT_NUM_SVC_ELEMS 2
 
+#ifdef OS_ANDROID
+#include <hfp.sysprop.h>
+#endif
+
+#define DEFAULT_BTA_HFP_VERSION HFP_VERSION_1_7
+int get_default_hfp_version() {
+#ifdef OS_ANDROID
+  static const int version =
+      android::sysprop::bluetooth::Hfp::version().value_or(
+          DEFAULT_BTA_HFP_VERSION);
+  return version;
+#else
+  return DEFAULT_BTA_HFP_VERSION;
+#endif
+}
+
 /*******************************************************************************
  *
  * Function         bta_hf_client_sdp_cback
@@ -124,7 +140,7 @@
 
   /* add profile descriptor list */
   profile_uuid = UUID_SERVCLASS_HF_HANDSFREE;
-  version = BTA_HFP_VERSION;
+  version = get_default_hfp_version();
 
   result &= SDP_AddProfileDescriptorList(sdp_handle, profile_uuid, version);
 
@@ -204,7 +220,6 @@
     SDP_DeleteRecord(client_cb->sdp_handle);
     client_cb->sdp_handle = 0;
     BTM_FreeSCN(client_cb->scn);
-    RFCOMM_ClearSecurityRecord(client_cb->scn);
     bta_sys_remove_uuid(UUID_SERVCLASS_HF_HANDSFREE);
   }
 }
diff --git a/system/bta/hfp/bta_hfp_api.cc b/system/bta/hfp/bta_hfp_api.cc
new file mode 100644
index 0000000..63ece44
--- /dev/null
+++ b/system/bta/hfp/bta_hfp_api.cc
@@ -0,0 +1,34 @@
+/*
+ * Copyright 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "bta_hfp_api.h"
+
+#ifdef OS_ANDROID
+#include <hfp.sysprop.h>
+#endif
+
+#define DEFAULT_BTA_HFP_VERSION HFP_VERSION_1_7
+
+int get_default_hfp_version() {
+#ifdef OS_ANDROID
+  static const int version =
+      android::sysprop::bluetooth::Hfp::version().value_or(
+          DEFAULT_BTA_HFP_VERSION);
+  return version;
+#else
+  return DEFAULT_BTA_HFP_VERSION;
+#endif
+}
diff --git a/system/bta/hh/bta_hh_act.cc b/system/bta/hh/bta_hh_act.cc
index dd9decd..e768975 100644
--- a/system/bta/hh/bta_hh_act.cc
+++ b/system/bta/hh/bta_hh_act.cc
@@ -159,14 +159,13 @@
  ******************************************************************************/
 void bta_hh_disc_cmpl(void) {
   LOG_DEBUG("Disconnect complete");
-
-  HID_HostDeregister();
-  bta_hh_le_deregister();
   tBTA_HH_STATUS status = BTA_HH_OK;
 
   /* Deregister with lower layer */
   if (HID_HostDeregister() != HID_SUCCESS) status = BTA_HH_ERR;
 
+  bta_hh_le_deregister();
+
   bta_hh_cleanup_disable(status);
 }
 
@@ -710,7 +709,6 @@
   APPL_TRACE_DEBUG("Ctrl DATA received w4: event[%s]",
                    bta_hh_get_w4_event(p_cb->w4_evt));
   if (pdata->len == 0) {
-    android_errorWriteLog(0x534e4554, "116108738");
     p_cb->w4_evt = 0;
     osi_free_and_reset((void**)&pdata);
     return;
diff --git a/system/bta/hh/bta_hh_le.cc b/system/bta/hh/bta_hh_le.cc
index aa095ff..ffcbf7f 100644
--- a/system/bta/hh/bta_hh_le.cc
+++ b/system/bta/hh/bta_hh_le.cc
@@ -271,7 +271,8 @@
   bta_hh_cb.le_cb_index[BTA_HH_GET_LE_CB_IDX(p_cb->hid_handle)] = p_cb->index;
   p_cb->in_use = true;
 
-  BTA_GATTC_Open(bta_hh_cb.gatt_if, remote_bda, true, false);
+  BTA_GATTC_Open(bta_hh_cb.gatt_if, remote_bda, BTM_BLE_DIRECT_CONNECTION,
+                 false);
 }
 
 /*******************************************************************************
@@ -2010,13 +2011,15 @@
 
   if (!p_cb->in_bg_conn && to_add) {
     /* add device into BG connection to accept remote initiated connection */
-    BTA_GATTC_Open(bta_hh_cb.gatt_if, p_cb->addr, false, false);
+    BTA_GATTC_Open(bta_hh_cb.gatt_if, p_cb->addr,
+                   BTM_BLE_BKG_CONNECT_ALLOW_LIST, false);
     p_cb->in_bg_conn = true;
   } else {
     // Let the lower layers manage acceptlist and do not cache
     // at the higher layer
     p_cb->in_bg_conn = true;
-    BTA_GATTC_Open(bta_hh_cb.gatt_if, p_cb->addr, false, false);
+    BTA_GATTC_Open(bta_hh_cb.gatt_if, p_cb->addr,
+                   BTM_BLE_BKG_CONNECT_ALLOW_LIST, false);
   }
 }
 
diff --git a/system/bta/include/bta_api.h b/system/bta/include/bta_api.h
index 98182f4..2efb326 100644
--- a/system/bta/include/bta_api.h
+++ b/system/bta/include/bta_api.h
@@ -304,6 +304,7 @@
       fail_reason; /* The HCI reason/error code for when success=false */
   tBLE_ADDR_TYPE addr_type; /* Peer device address type */
   tBT_DEVICE_TYPE dev_type;
+  bool is_ctkd; /* True if key is derived using CTKD procedure */
 } tBTA_DM_AUTH_CMPL;
 
 /* Structure associated with BTA_DM_LINK_UP_EVT */
@@ -418,10 +419,12 @@
 #define BTA_DM_INQ_RES_EVT 0  /* Inquiry result for a peer device. */
 #define BTA_DM_INQ_CMPL_EVT 1 /* Inquiry complete. */
 #define BTA_DM_DISC_RES_EVT 2 /* Discovery result for a peer device. */
-#define BTA_DM_DISC_BLE_RES_EVT \
-  3 /* Discovery result for BLE GATT based servoce on a peer device. */
+#define BTA_DM_GATT_OVER_LE_RES_EVT \
+  3 /* GATT services over LE transport discovered */
 #define BTA_DM_DISC_CMPL_EVT 4          /* Discovery complete. */
 #define BTA_DM_SEARCH_CANCEL_CMPL_EVT 6 /* Search cancelled */
+#define BTA_DM_DID_RES_EVT 7            /* Vendor/Product ID search result */
+#define BTA_DM_GATT_OVER_SDP_RES_EVT 8  /* GATT services over SDP discovered */
 
 typedef uint8_t tBTA_DM_SEARCH_EVT;
 
@@ -1221,4 +1224,14 @@
  ******************************************************************************/
 extern void BTA_DmBleResetId(void);
 
+/*******************************************************************************
+ *
+ * Function         BTA_DmCheckLeAudioCapable
+ *
+ * Description      Checks if device should be considered as LE Audio capable
+ *
+ * Returns          True if Le Audio capable device, false otherwise
+ *
+ ******************************************************************************/
+extern bool BTA_DmCheckLeAudioCapable(const RawAddress& address);
 #endif /* BTA_API_H */
diff --git a/system/bta/include/bta_av_api.h b/system/bta/include/bta_av_api.h
index fd1dd00..686f59d 100644
--- a/system/bta/include/bta_av_api.h
+++ b/system/bta/include/bta_av_api.h
@@ -154,7 +154,8 @@
   BTA_AV_CODEC_TYPE_AAC = 0x02,
   BTA_AV_CODEC_TYPE_APTX = 0x04,
   BTA_AV_CODEC_TYPE_APTXHD = 0x08,
-  BTA_AV_CODEC_TYPE_LDAC = 0x10
+  BTA_AV_CODEC_TYPE_LDAC = 0x10,
+  BTA_AV_CODEC_TYPE_OPUS = 0x20
 } tBTA_AV_CODEC_TYPE;
 
 /* Event associated with BTA_AV_ENABLE_EVT */
@@ -500,7 +501,7 @@
  * Returns          void
  *
  ******************************************************************************/
-void BTA_AvStart(tBTA_AV_HNDL handle);
+void BTA_AvStart(tBTA_AV_HNDL handle, bool use_latency_mode);
 
 /*******************************************************************************
  *
@@ -676,6 +677,17 @@
 
 /*******************************************************************************
  *
+ * Function         BTA_AvSetLatency
+ *
+ * Description      Set audio/video stream latency.
+ *
+ * Returns          void
+ *
+ ******************************************************************************/
+void BTA_AvSetLatency(tBTA_AV_HNDL handle, bool is_low_latency);
+
+/*******************************************************************************
+ *
  * Function         BTA_AvOffloadStart
  *
  * Description      Request Starting of A2DP Offload.
diff --git a/system/bta/include/bta_csis_api.h b/system/bta/include/bta_csis_api.h
index fe864f5..44dca04 100644
--- a/system/bta/include/bta_csis_api.h
+++ b/system/bta/include/bta_csis_api.h
@@ -47,6 +47,7 @@
       bluetooth::Uuid uuid = bluetooth::groups::kGenericContextUuid) = 0;
   virtual void LockGroup(int group_id, bool lock, CsisLockCb cb) = 0;
   virtual std::vector<RawAddress> GetDeviceList(int group_id) = 0;
+  virtual int GetDesiredSize(int group_id) = 0;
 };
 }  // namespace csis
 }  // namespace bluetooth
diff --git a/system/bta/include/bta_gatt_api.h b/system/bta/include/bta_gatt_api.h
index 52cfe8b..9fd4db8 100644
--- a/system/bta/include/bta_gatt_api.h
+++ b/system/bta/include/bta_gatt_api.h
@@ -445,15 +445,17 @@
  *
  * Parameters       client_if: server interface.
  *                  remote_bda: remote device BD address.
- *                  is_direct: direct connection or background auto connection
+ *                  connection_type: connection type used for the peer device
  *                  initiating_phys: LE PHY to use, optional
  *
  ******************************************************************************/
 extern void BTA_GATTC_Open(tGATT_IF client_if, const RawAddress& remote_bda,
-                           bool is_direct, bool opportunistic);
+                           tBTM_BLE_CONN_TYPE connection_type,
+                           bool opportunistic);
 extern void BTA_GATTC_Open(tGATT_IF client_if, const RawAddress& remote_bda,
-                           bool is_direct, tBT_TRANSPORT transport,
-                           bool opportunistic, uint8_t initiating_phys);
+                           tBTM_BLE_CONN_TYPE connection_type,
+                           tBT_TRANSPORT transport, bool opportunistic,
+                           uint8_t initiating_phys);
 
 /*******************************************************************************
  *
@@ -997,4 +999,7 @@
  ******************************************************************************/
 extern void BTA_GATTS_Close(uint16_t conn_id);
 
+// Adds bonded device for GATT server tracking service changes
+extern void BTA_GATTS_InitBonded(void);
+
 #endif /* BTA_GATT_API_H */
diff --git a/system/bta/include/bta_hearing_aid_api.h b/system/bta/include/bta_hearing_aid_api.h
index 90803c5..d1b930b 100644
--- a/system/bta/include/bta_hearing_aid_api.h
+++ b/system/bta/include/bta_hearing_aid_api.h
@@ -228,7 +228,6 @@
                          base::Closure initCb);
   static void CleanUp();
   static bool IsHearingAidRunning();
-  static HearingAid* Get();
   static void DebugDump(int fd);
 
   static void AddFromStorage(const HearingDevice& dev_info,
@@ -236,10 +235,10 @@
 
   static int GetDeviceCount();
 
-  virtual void Connect(const RawAddress& address) = 0;
-  virtual void Disconnect(const RawAddress& address) = 0;
-  virtual void AddToAcceptlist(const RawAddress& address) = 0;
-  virtual void SetVolume(int8_t volume) = 0;
+  static void Connect(const RawAddress& address);
+  static void Disconnect(const RawAddress& address);
+  static void AddToAcceptlist(const RawAddress& address);
+  static void SetVolume(int8_t volume);
 };
 
 /* Represents configuration of audio codec, as exchanged between hearing aid and
diff --git a/system/bta/include/bta_hf_client_api.h b/system/bta/include/bta_hf_client_api.h
old mode 100755
new mode 100644
index 32822c2..fe0728e
--- a/system/bta/include/bta_hf_client_api.h
+++ b/system/bta/include/bta_hf_client_api.h
@@ -172,6 +172,7 @@
 #define BTA_HF_CLIENT_AT_CMD_NREC 15
 #define BTA_HF_CLIENT_AT_CMD_VENDOR_SPECIFIC_CMD 16
 #define BTA_HF_CLIENT_AT_CMD_BIEV 17
+#define BTA_HF_CLIENT_AT_CMD_ANDROID 18
 
 typedef uint8_t tBTA_HF_CLIENT_AT_CMD_TYPE;
 
@@ -321,10 +322,10 @@
  *                  calls to do any AT operations
  *
  *
- * Returns          void
+ * Returns          bt_status_t
  *
  ******************************************************************************/
-void BTA_HfClientOpen(const RawAddress& bd_addr, uint16_t* p_handle);
+bt_status_t BTA_HfClientOpen(const RawAddress& bd_addr, uint16_t* p_handle);
 
 /*******************************************************************************
  *
@@ -390,4 +391,15 @@
  ******************************************************************************/
 void BTA_HfClientDumpStatistics(int fd);
 
+/*******************************************************************************
+ *
+ * function         get_default_hf_client_features
+ *
+ * description      return the hf_client features.
+ *                  value can be override via system property
+ *
+ * returns          int
+ *
+ ******************************************************************************/
+int get_default_hf_client_features();
 #endif /* BTA_HF_CLIENT_API_H */
diff --git a/system/bta/include/bta_hfp_api.h b/system/bta/include/bta_hfp_api.h
index a3dd3a9..5c3b59b 100644
--- a/system/bta/include/bta_hfp_api.h
+++ b/system/bta/include/bta_hfp_api.h
@@ -24,6 +24,7 @@
 #define HFP_VERSION_1_5 0x0105
 #define HFP_VERSION_1_6 0x0106
 #define HFP_VERSION_1_7 0x0107
+#define HFP_VERSION_1_8 0x0108
 
 #define HSP_VERSION_1_0 0x0100
 #define HSP_VERSION_1_2 0x0102
@@ -31,9 +32,6 @@
 #define HFP_VERSION_CONFIG_KEY "HfpVersion"
 #define HFP_SDP_FEATURES_CONFIG_KEY "HfpSdpFeatures"
 
-/* Default HFP Version */
-#ifndef BTA_HFP_VERSION
-#define BTA_HFP_VERSION HFP_VERSION_1_7
-#endif
+int get_default_hfp_version();
 
 #endif /* BTA_HFP_API_H */
\ No newline at end of file
diff --git a/system/bta/include/bta_le_audio_api.h b/system/bta/include/bta_le_audio_api.h
index 2d44f9b..5a9950f 100644
--- a/system/bta/include/bta_le_audio_api.h
+++ b/system/bta/include/bta_le_audio_api.h
@@ -24,9 +24,6 @@
 
 #include <vector>
 
-class LeAudioUnicastClientAudioSource;
-class LeAudioUnicastClientAudioSink;
-
 class LeAudioHalVerifier {
  public:
   static bool SupportsLeAudio();
@@ -46,9 +43,6 @@
           offloading_preference);
   static void Cleanup(base::Callback<void()> cleanupCb);
   static LeAudioClient* Get(void);
-  static void InitializeAudioClients(
-      LeAudioUnicastClientAudioSource* clientAudioSource,
-      LeAudioUnicastClientAudioSink* clientAudioSink);
   static void DebugDump(int fd);
 
   virtual void RemoveDevice(const RawAddress& address) = 0;
@@ -66,8 +60,25 @@
       bluetooth::le_audio::btle_audio_codec_config_t input_codec_config,
       bluetooth::le_audio::btle_audio_codec_config_t output_codec_config) = 0;
   virtual void SetCcidInformation(int ccid, int context_type) = 0;
+  virtual void SetInCall(bool in_call) = 0;
+
   virtual std::vector<RawAddress> GetGroupDevices(const int group_id) = 0;
-  static void AddFromStorage(const RawAddress& addr, bool autoconnect);
+  static void AddFromStorage(const RawAddress& addr, bool autoconnect,
+                             int sink_audio_location, int source_audio_location,
+                             int sink_supported_context_types,
+                             int source_supported_context_types,
+                             const std::vector<uint8_t>& handles,
+                             const std::vector<uint8_t>& sink_pacs,
+                             const std::vector<uint8_t>& source_pacs,
+                             const std::vector<uint8_t>& ases);
+  static bool GetHandlesForStorage(const RawAddress& addr,
+                                   std::vector<uint8_t>& out);
+  static bool GetSinkPacsForStorage(const RawAddress& addr,
+                                    std::vector<uint8_t>& out);
+  static bool GetSourcePacsForStorage(const RawAddress& addr,
+                                      std::vector<uint8_t>& out);
+  static bool GetAsesForStorage(const RawAddress& addr,
+                                std::vector<uint8_t>& out);
   static bool IsLeAudioClientRunning();
 
   static void InitializeAudioSetConfigurationProvider(void);
diff --git a/system/bta/include/bta_le_audio_broadcaster_api.h b/system/bta/include/bta_le_audio_broadcaster_api.h
index a8f1daa..d790803 100644
--- a/system/bta/include/bta_le_audio_broadcaster_api.h
+++ b/system/bta/include/bta_le_audio_broadcaster_api.h
@@ -23,8 +23,6 @@
 
 #include "bta/include/bta_le_audio_api.h"
 
-class LeAudioBroadcastClientAudioSource;
-
 /* Interface class */
 class LeAudioBroadcaster {
  public:
@@ -39,8 +37,6 @@
   static void Cleanup(void);
   static LeAudioBroadcaster* Get(void);
   static bool IsLeAudioBroadcasterRunning(void);
-  static void InitializeAudioClient(
-      LeAudioBroadcastClientAudioSource* clientAudioSource);
   static void DebugDump(int fd);
 
   virtual void CreateAudioBroadcast(
diff --git a/system/bta/jv/bta_jv_act.cc b/system/bta/jv/bta_jv_act.cc
index 6f50077..db8b05c 100644
--- a/system/bta/jv/bta_jv_act.cc
+++ b/system/bta/jv/bta_jv_act.cc
@@ -317,15 +317,11 @@
     p_pcb->handle = 0;
     p_cb->curr_sess--;
     if (p_cb->curr_sess == 0) {
-      RFCOMM_ClearSecurityRecord(p_cb->scn);
       p_cb->scn = 0;
       p_cb->p_cback = NULL;
       p_cb->handle = 0;
       p_cb->curr_sess = -1;
     }
-    if (remove_server) {
-      RFCOMM_ClearSecurityRecord(p_cb->scn);
-    }
   }
   return status;
 }
@@ -1356,7 +1352,6 @@
   bta_jv.rfc_cl_init = evt_data;
   p_cback(BTA_JV_RFCOMM_CL_INIT_EVT, &bta_jv, rfcomm_slot_id);
   if (bta_jv.rfc_cl_init.status == BTA_JV_FAILURE) {
-    RFCOMM_ClearSecurityRecord(remote_scn);
     if (handle) RFCOMM_RemoveConnection(handle);
   }
 }
@@ -1532,6 +1527,7 @@
   tPORT_STATE port_state;
   uint32_t event_mask = BTA_JV_RFC_EV_MASK;
   tBTA_JV_PCB* p_pcb = NULL;
+  tBTA_SEC sec_mask;
   if (p_cb->max_sess > 1) {
     for (i = 0; i < p_cb->max_sess; i++) {
       if (p_cb->rfc_hdl[i] != 0) {
@@ -1562,10 +1558,16 @@
             << ", si=" << si;
     if (used < p_cb->max_sess && listen == 1 && si) {
       si--;
-      if (RFCOMM_CreateConnection(p_cb->sec_id, p_cb->scn, true,
-                                  BTA_JV_DEF_RFC_MTU, RawAddress::kAny,
-                                  &(p_cb->rfc_hdl[si]),
-                                  bta_jv_port_mgmt_sr_cback) == PORT_SUCCESS) {
+      if (PORT_GetSecurityMask(p_pcb_open->port_handle, &sec_mask) !=
+          PORT_SUCCESS) {
+        LOG(ERROR) << __func__
+                   << ": RFCOMM_CreateConnection failed: invalid port_handle";
+      }
+
+      if (RFCOMM_CreateConnectionWithSecurity(
+              p_cb->sec_id, p_cb->scn, true, BTA_JV_DEF_RFC_MTU,
+              RawAddress::kAny, &(p_cb->rfc_hdl[si]), bta_jv_port_mgmt_sr_cback,
+              sec_mask) == PORT_SUCCESS) {
         p_cb->curr_sess++;
         p_pcb = &bta_jv_cb.port_cb[p_cb->rfc_hdl[si] - 1];
         p_pcb->state = BTA_JV_ST_SR_LISTEN;
@@ -1652,7 +1654,6 @@
   if (bta_jv.rfc_start.status == BTA_JV_SUCCESS) {
     PORT_SetDataCOCallback(handle, bta_jv_port_data_co_cback);
   } else {
-    RFCOMM_ClearSecurityRecord(local_scn);
     if (handle) RFCOMM_RemoveConnection(handle);
   }
 }
diff --git a/system/bta/le_audio/audio_hal_client/audio_hal_client.h b/system/bta/le_audio/audio_hal_client/audio_hal_client.h
new file mode 100644
index 0000000..d24ab7e
--- /dev/null
+++ b/system/bta/le_audio/audio_hal_client/audio_hal_client.h
@@ -0,0 +1,170 @@
+/*
+ * Copyright 2020 HIMSA II K/S - www.himsa.com.
+ * Represented by EHIMA - www.ehima.com
+ * Copyright (c) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#pragma once
+
+#include <future>
+#include <memory>
+
+#include "audio_hal_interface/le_audio_software.h"
+#include "common/repeating_timer.h"
+
+namespace le_audio {
+/* Represents configuration of audio codec, as exchanged between le audio and
+ * phone.
+ * It can also be passed to the audio source to configure its parameters.
+ */
+struct LeAudioCodecConfiguration {
+  static constexpr uint8_t kChannelNumberMono =
+      bluetooth::audio::le_audio::kChannelNumberMono;
+  static constexpr uint8_t kChannelNumberStereo =
+      bluetooth::audio::le_audio::kChannelNumberStereo;
+
+  static constexpr uint32_t kSampleRate48000 =
+      bluetooth::audio::le_audio::kSampleRate48000;
+  static constexpr uint32_t kSampleRate44100 =
+      bluetooth::audio::le_audio::kSampleRate44100;
+  static constexpr uint32_t kSampleRate32000 =
+      bluetooth::audio::le_audio::kSampleRate32000;
+  static constexpr uint32_t kSampleRate24000 =
+      bluetooth::audio::le_audio::kSampleRate24000;
+  static constexpr uint32_t kSampleRate16000 =
+      bluetooth::audio::le_audio::kSampleRate16000;
+  static constexpr uint32_t kSampleRate8000 =
+      bluetooth::audio::le_audio::kSampleRate8000;
+
+  static constexpr uint8_t kBitsPerSample16 =
+      bluetooth::audio::le_audio::kBitsPerSample16;
+  static constexpr uint8_t kBitsPerSample24 =
+      bluetooth::audio::le_audio::kBitsPerSample24;
+  static constexpr uint8_t kBitsPerSample32 =
+      bluetooth::audio::le_audio::kBitsPerSample32;
+
+  static constexpr uint32_t kInterval7500Us = 7500;
+  static constexpr uint32_t kInterval10000Us = 10000;
+
+  /** number of channels */
+  uint8_t num_channels;
+
+  /** sampling rate that the codec expects to receive from audio framework */
+  uint32_t sample_rate;
+
+  /** bits per sample that codec expects to receive from audio framework */
+  uint8_t bits_per_sample;
+
+  /** Data interval determines how often we send samples to the remote. This
+   * should match how often we grab data from audio source, optionally we can
+   * grab data every 2 or 3 intervals, but this would increase latency.
+   *
+   * Value is provided in us.
+   */
+  uint32_t data_interval_us;
+
+  bool operator!=(const LeAudioCodecConfiguration& other) {
+    return !((num_channels == other.num_channels) &&
+             (sample_rate == other.sample_rate) &&
+             (bits_per_sample == other.bits_per_sample) &&
+             (data_interval_us == other.data_interval_us));
+  }
+
+  bool operator==(const LeAudioCodecConfiguration& other) const {
+    return ((num_channels == other.num_channels) &&
+            (sample_rate == other.sample_rate) &&
+            (bits_per_sample == other.bits_per_sample) &&
+            (data_interval_us == other.data_interval_us));
+  }
+
+  bool IsInvalid() {
+    return (num_channels == 0) || (sample_rate == 0) ||
+           (bits_per_sample == 0) || (data_interval_us == 0);
+  }
+};
+
+/* Used by the local BLE Audio Sink device to pass the audio data
+ * received from a remote BLE Audio Source to the Audio HAL.
+ */
+class LeAudioSinkAudioHalClient {
+ public:
+  class Callbacks {
+   public:
+    virtual ~Callbacks() = default;
+    virtual void OnAudioSuspend(std::promise<void> do_suspend_promise) = 0;
+    virtual void OnAudioResume(void) = 0;
+    virtual void OnAudioMetadataUpdate(
+        std::vector<struct record_track_metadata> sink_metadata) = 0;
+  };
+
+  virtual ~LeAudioSinkAudioHalClient() = default;
+  virtual bool Start(const LeAudioCodecConfiguration& codecConfiguration,
+                     Callbacks* audioReceiver) = 0;
+  virtual void Stop() = 0;
+  virtual size_t SendData(uint8_t* data, uint16_t size) = 0;
+
+  virtual void ConfirmStreamingRequest() = 0;
+  virtual void CancelStreamingRequest() = 0;
+
+  virtual void UpdateRemoteDelay(uint16_t remote_delay_ms) = 0;
+  virtual void UpdateAudioConfigToHal(
+      const ::le_audio::offload_config& config) = 0;
+  virtual void SuspendedForReconfiguration() = 0;
+  virtual void ReconfigurationComplete() = 0;
+
+  static std::unique_ptr<LeAudioSinkAudioHalClient> AcquireUnicast();
+  static void DebugDump(int fd);
+
+ protected:
+  LeAudioSinkAudioHalClient() = default;
+};
+
+/* Used by the local BLE Audio Source device to get data from the
+ * Audio HAL, so we could send it over to a remote BLE Audio Sink device.
+ */
+class LeAudioSourceAudioHalClient {
+ public:
+  class Callbacks {
+   public:
+    virtual ~Callbacks() = default;
+    virtual void OnAudioDataReady(const std::vector<uint8_t>& data) = 0;
+    virtual void OnAudioSuspend(std::promise<void> do_suspend_promise) = 0;
+    virtual void OnAudioResume(void) = 0;
+    virtual void OnAudioMetadataUpdate(
+        std::vector<struct playback_track_metadata> source_metadata) = 0;
+  };
+
+  virtual ~LeAudioSourceAudioHalClient() = default;
+  virtual bool Start(const LeAudioCodecConfiguration& codecConfiguration,
+                     Callbacks* audioReceiver) = 0;
+  virtual void Stop() = 0;
+  virtual size_t SendData(uint8_t* data, uint16_t size) { return 0; }
+  virtual void ConfirmStreamingRequest() = 0;
+  virtual void CancelStreamingRequest() = 0;
+  virtual void UpdateRemoteDelay(uint16_t remote_delay_ms) = 0;
+  virtual void UpdateAudioConfigToHal(
+      const ::le_audio::offload_config& config) = 0;
+  virtual void UpdateBroadcastAudioConfigToHal(
+      const ::le_audio::broadcast_offload_config& config) = 0;
+  virtual void SuspendedForReconfiguration() = 0;
+  virtual void ReconfigurationComplete() = 0;
+
+  static std::unique_ptr<LeAudioSourceAudioHalClient> AcquireUnicast();
+  static std::unique_ptr<LeAudioSourceAudioHalClient> AcquireBroadcast();
+  static void DebugDump(int fd);
+
+ protected:
+  LeAudioSourceAudioHalClient() = default;
+};
+}  // namespace le_audio
diff --git a/system/bta/le_audio/audio_hal_client/audio_hal_client_test.cc b/system/bta/le_audio/audio_hal_client/audio_hal_client_test.cc
new file mode 100644
index 0000000..dfbb026
--- /dev/null
+++ b/system/bta/le_audio/audio_hal_client/audio_hal_client_test.cc
@@ -0,0 +1,550 @@
+/*
+ * Copyright 2021 HIMSA II K/S - www.himsa.com.
+ * Represented by EHIMA - www.ehima.com
+ * Copyright (c) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "audio_hal_client.h"
+
+#include <gmock/gmock.h>
+#include <gtest/gtest.h>
+
+#include <chrono>
+#include <future>
+
+#include "audio_hal_interface/le_audio_software.h"
+#include "base/bind_helpers.h"
+#include "common/message_loop_thread.h"
+#include "hardware/bluetooth.h"
+#include "osi/include/wakelock.h"
+
+using ::testing::_;
+using ::testing::Assign;
+using ::testing::AtLeast;
+using ::testing::DoAll;
+using ::testing::DoDefault;
+using ::testing::Invoke;
+using ::testing::Mock;
+using ::testing::Return;
+using ::testing::ReturnPointee;
+using ::testing::SaveArg;
+using std::chrono_literals::operator""ms;
+
+using le_audio::LeAudioCodecConfiguration;
+using le_audio::LeAudioSinkAudioHalClient;
+using le_audio::LeAudioSourceAudioHalClient;
+
+bluetooth::common::MessageLoopThread message_loop_thread("test message loop");
+bluetooth::common::MessageLoopThread* get_main_thread() {
+  return &message_loop_thread;
+}
+bt_status_t do_in_main_thread(const base::Location& from_here,
+                              base::OnceClosure task) {
+  if (!message_loop_thread.DoInThread(from_here, std::move(task))) {
+    LOG(ERROR) << __func__ << ": failed from " << from_here.ToString();
+    return BT_STATUS_FAIL;
+  }
+  return BT_STATUS_SUCCESS;
+}
+
+static base::MessageLoop* message_loop_;
+base::MessageLoop* get_main_message_loop() { return message_loop_; }
+
+static void init_message_loop_thread() {
+  message_loop_thread.StartUp();
+  if (!message_loop_thread.IsRunning()) {
+    FAIL() << "unable to create message loop thread.";
+  }
+
+  if (!message_loop_thread.EnableRealTimeScheduling())
+    LOG(ERROR) << "Unable to set real time scheduling";
+
+  message_loop_ = message_loop_thread.message_loop();
+  if (message_loop_ == nullptr) FAIL() << "unable to get message loop.";
+}
+
+static void cleanup_message_loop_thread() {
+  message_loop_ = nullptr;
+  message_loop_thread.ShutDown();
+}
+
+using bluetooth::audio::le_audio::LeAudioClientInterface;
+
+class MockLeAudioClientInterfaceSink : public LeAudioClientInterface::Sink {
+ public:
+  MOCK_METHOD((void), Cleanup, (), (override));
+  MOCK_METHOD((void), SetPcmParameters,
+              (const LeAudioClientInterface::PcmParameters& params),
+              (override));
+  MOCK_METHOD((void), SetRemoteDelay, (uint16_t delay_report_ms), (override));
+  MOCK_METHOD((void), StartSession, (), (override));
+  MOCK_METHOD((void), StopSession, (), (override));
+  MOCK_METHOD((void), ConfirmStreamingRequest, (), (override));
+  MOCK_METHOD((void), CancelStreamingRequest, (), (override));
+  MOCK_METHOD((void), UpdateAudioConfigToHal,
+              (const ::le_audio::offload_config&));
+  MOCK_METHOD((void), UpdateBroadcastAudioConfigToHal,
+              (const ::le_audio::broadcast_offload_config&));
+  MOCK_METHOD((size_t), Read, (uint8_t * p_buf, uint32_t len));
+};
+
+class MockLeAudioClientInterfaceSource : public LeAudioClientInterface::Source {
+ public:
+  MOCK_METHOD((void), Cleanup, (), (override));
+  MOCK_METHOD((void), SetPcmParameters,
+              (const LeAudioClientInterface::PcmParameters& params),
+              (override));
+  MOCK_METHOD((void), SetRemoteDelay, (uint16_t delay_report_ms), (override));
+  MOCK_METHOD((void), StartSession, (), (override));
+  MOCK_METHOD((void), StopSession, (), (override));
+  MOCK_METHOD((void), ConfirmStreamingRequest, (), (override));
+  MOCK_METHOD((void), CancelStreamingRequest, (), (override));
+  MOCK_METHOD((void), UpdateAudioConfigToHal,
+              (const ::le_audio::offload_config&));
+  MOCK_METHOD((size_t), Write, (const uint8_t* p_buf, uint32_t len));
+};
+
+class MockLeAudioClientInterface : public LeAudioClientInterface {
+ public:
+  MockLeAudioClientInterface() = default;
+  ~MockLeAudioClientInterface() = default;
+
+  MOCK_METHOD((Sink*), GetSink,
+              (bluetooth::audio::le_audio::StreamCallbacks stream_cb,
+               bluetooth::common::MessageLoopThread* message_loop,
+               bool is_broadcasting_session_type));
+  MOCK_METHOD((Source*), GetSource,
+              (bluetooth::audio::le_audio::StreamCallbacks stream_cb,
+               bluetooth::common::MessageLoopThread* message_loop));
+};
+
+LeAudioClientInterface* mockInterface;
+
+namespace bluetooth {
+namespace audio {
+namespace le_audio {
+MockLeAudioClientInterface* interface_mock;
+MockLeAudioClientInterfaceSink* sink_mock;
+MockLeAudioClientInterfaceSource* source_mock;
+
+LeAudioClientInterface* LeAudioClientInterface::Get() { return interface_mock; }
+
+LeAudioClientInterface::Sink* LeAudioClientInterface::GetSink(
+    StreamCallbacks stream_cb,
+    bluetooth::common::MessageLoopThread* message_loop,
+    bool is_broadcasting_session_type) {
+  return interface_mock->GetSink(stream_cb, message_loop,
+                                 is_broadcasting_session_type);
+}
+
+LeAudioClientInterface::Source* LeAudioClientInterface::GetSource(
+    StreamCallbacks stream_cb,
+    bluetooth::common::MessageLoopThread* message_loop) {
+  return interface_mock->GetSource(stream_cb, message_loop);
+}
+
+bool LeAudioClientInterface::ReleaseSink(LeAudioClientInterface::Sink* sink) {
+  return true;
+}
+bool LeAudioClientInterface::ReleaseSource(
+    LeAudioClientInterface::Source* source) {
+  return true;
+}
+
+void LeAudioClientInterface::Sink::Cleanup() {}
+void LeAudioClientInterface::Sink::SetPcmParameters(
+    const PcmParameters& params) {}
+void LeAudioClientInterface::Sink::SetRemoteDelay(uint16_t delay_report_ms) {}
+void LeAudioClientInterface::Sink::StartSession() {}
+void LeAudioClientInterface::Sink::StopSession() {}
+void LeAudioClientInterface::Sink::ConfirmStreamingRequest(){};
+void LeAudioClientInterface::Sink::CancelStreamingRequest(){};
+void LeAudioClientInterface::Sink::UpdateAudioConfigToHal(
+    const ::le_audio::offload_config& config){};
+void LeAudioClientInterface::Sink::UpdateBroadcastAudioConfigToHal(
+    const ::le_audio::broadcast_offload_config& config){};
+void LeAudioClientInterface::Sink::SuspendedForReconfiguration() {}
+void LeAudioClientInterface::Sink::ReconfigurationComplete() {}
+
+void LeAudioClientInterface::Source::Cleanup() {}
+void LeAudioClientInterface::Source::SetPcmParameters(
+    const PcmParameters& params) {}
+void LeAudioClientInterface::Source::SetRemoteDelay(uint16_t delay_report_ms) {}
+void LeAudioClientInterface::Source::StartSession() {}
+void LeAudioClientInterface::Source::StopSession() {}
+void LeAudioClientInterface::Source::ConfirmStreamingRequest(){};
+void LeAudioClientInterface::Source::CancelStreamingRequest(){};
+void LeAudioClientInterface::Source::UpdateAudioConfigToHal(
+    const ::le_audio::offload_config& config){};
+void LeAudioClientInterface::Source::SuspendedForReconfiguration() {}
+void LeAudioClientInterface::Source::ReconfigurationComplete() {}
+
+size_t LeAudioClientInterface::Source::Write(const uint8_t* p_buf,
+                                             uint32_t len) {
+  return source_mock->Write(p_buf, len);
+}
+
+size_t LeAudioClientInterface::Sink::Read(uint8_t* p_buf, uint32_t len) {
+  return sink_mock->Read(p_buf, len);
+}
+}  // namespace le_audio
+}  // namespace audio
+}  // namespace bluetooth
+
+class MockLeAudioClientAudioSinkEventReceiver
+    : public LeAudioSourceAudioHalClient::Callbacks {
+ public:
+  MOCK_METHOD((void), OnAudioDataReady, (const std::vector<uint8_t>& data),
+              (override));
+  MOCK_METHOD((void), OnAudioSuspend, (std::promise<void> do_suspend_promise),
+              (override));
+  MOCK_METHOD((void), OnAudioResume, (), (override));
+  MOCK_METHOD((void), OnAudioMetadataUpdate,
+              (std::vector<struct playback_track_metadata> source_metadata),
+              (override));
+};
+
+class MockAudioHalClientEventReceiver
+    : public LeAudioSinkAudioHalClient::Callbacks {
+ public:
+  MOCK_METHOD((void), OnAudioSuspend, (std::promise<void> do_suspend_promise),
+              (override));
+  MOCK_METHOD((void), OnAudioResume, (), (override));
+  MOCK_METHOD((void), OnAudioMetadataUpdate,
+              (std::vector<struct record_track_metadata> sink_metadata),
+              (override));
+};
+
+class LeAudioClientAudioTest : public ::testing::Test {
+ protected:
+  void SetUp(void) override {
+    init_message_loop_thread();
+    bluetooth::audio::le_audio::interface_mock = &mock_client_interface_;
+    bluetooth::audio::le_audio::sink_mock = &mock_hal_interface_audio_sink_;
+    bluetooth::audio::le_audio::source_mock = &mock_hal_interface_audio_source_;
+
+    // Init sink Audio HAL mock
+    is_sink_audio_hal_acquired = false;
+    sink_audio_hal_stream_cb = {.on_suspend_ = nullptr, .on_resume_ = nullptr};
+
+    ON_CALL(mock_client_interface_, GetSink(_, _, _))
+        .WillByDefault(DoAll(SaveArg<0>(&sink_audio_hal_stream_cb),
+                             Assign(&is_sink_audio_hal_acquired, true),
+                             Return(bluetooth::audio::le_audio::sink_mock)));
+    ON_CALL(mock_hal_interface_audio_sink_, Cleanup())
+        .WillByDefault(Assign(&is_sink_audio_hal_acquired, false));
+
+    // Init source Audio HAL mock
+    is_source_audio_hal_acquired = false;
+    source_audio_hal_stream_cb = {.on_suspend_ = nullptr,
+                                  .on_resume_ = nullptr};
+
+    ON_CALL(mock_client_interface_, GetSource(_, _))
+        .WillByDefault(DoAll(SaveArg<0>(&source_audio_hal_stream_cb),
+                             Assign(&is_source_audio_hal_acquired, true),
+                             Return(bluetooth::audio::le_audio::source_mock)));
+    ON_CALL(mock_hal_interface_audio_source_, Cleanup())
+        .WillByDefault(Assign(&is_source_audio_hal_acquired, false));
+  }
+
+  bool AcquireLeAudioSinkHalClient(void) {
+    audio_sink_instance_ = LeAudioSinkAudioHalClient::AcquireUnicast();
+    return is_source_audio_hal_acquired;
+  }
+
+  bool ReleaseLeAudioSinkHalClient(void) {
+    audio_sink_instance_.reset();
+    return !is_source_audio_hal_acquired;
+  }
+
+  bool AcquireLeAudioSourceHalClient(void) {
+    audio_source_instance_ = LeAudioSourceAudioHalClient::AcquireUnicast();
+    return is_sink_audio_hal_acquired;
+  }
+
+  bool ReleaseLeAudioSourceHalClient(void) {
+    audio_source_instance_.reset();
+    return !is_sink_audio_hal_acquired;
+  }
+
+  void TearDown(void) override {
+    /* We have to call Cleanup to tidy up some static variables.
+     * If on the HAL end Source is running it means we are running the Sink
+     * on our end, and vice versa.
+     */
+    if (is_source_audio_hal_acquired == true) ReleaseLeAudioSinkHalClient();
+    if (is_sink_audio_hal_acquired == true) ReleaseLeAudioSourceHalClient();
+
+    cleanup_message_loop_thread();
+
+    bluetooth::audio::le_audio::sink_mock = nullptr;
+    bluetooth::audio::le_audio::source_mock = nullptr;
+  }
+
+  MockLeAudioClientInterface mock_client_interface_;
+  MockLeAudioClientInterfaceSink mock_hal_interface_audio_sink_;
+  MockLeAudioClientInterfaceSource mock_hal_interface_audio_source_;
+
+  MockLeAudioClientAudioSinkEventReceiver mock_hal_sink_event_receiver_;
+  MockAudioHalClientEventReceiver mock_hal_source_event_receiver_;
+
+  bool is_source_audio_hal_acquired = false;
+  bool is_sink_audio_hal_acquired = false;
+  std::unique_ptr<LeAudioSinkAudioHalClient> audio_sink_instance_;
+  std::unique_ptr<LeAudioSourceAudioHalClient> audio_source_instance_;
+
+  bluetooth::audio::le_audio::StreamCallbacks source_audio_hal_stream_cb;
+  bluetooth::audio::le_audio::StreamCallbacks sink_audio_hal_stream_cb;
+
+  const LeAudioCodecConfiguration default_codec_conf{
+      .num_channels = LeAudioCodecConfiguration::kChannelNumberMono,
+      .sample_rate = LeAudioCodecConfiguration::kSampleRate44100,
+      .bits_per_sample = LeAudioCodecConfiguration::kBitsPerSample24,
+      .data_interval_us = LeAudioCodecConfiguration::kInterval10000Us,
+  };
+};
+
+TEST_F(LeAudioClientAudioTest, testLeAudioClientAudioSinkInitializeCleanup) {
+  EXPECT_CALL(mock_client_interface_, GetSource(_, _));
+  ASSERT_TRUE(AcquireLeAudioSinkHalClient());
+
+  EXPECT_CALL(mock_hal_interface_audio_source_, Cleanup());
+  ASSERT_TRUE(ReleaseLeAudioSinkHalClient());
+}
+
+TEST_F(LeAudioClientAudioTest, testAudioHalClientInitializeCleanup) {
+  EXPECT_CALL(mock_client_interface_, GetSink(_, _, _));
+  ASSERT_TRUE(AcquireLeAudioSourceHalClient());
+
+  EXPECT_CALL(mock_hal_interface_audio_sink_, Cleanup());
+  ASSERT_TRUE(ReleaseLeAudioSourceHalClient());
+}
+
+TEST_F(LeAudioClientAudioTest, testLeAudioClientAudioSinkStartStop) {
+  LeAudioClientInterface::PcmParameters params;
+  EXPECT_CALL(mock_hal_interface_audio_source_, SetPcmParameters(_))
+      .Times(1)
+      .WillOnce(SaveArg<0>(&params));
+  EXPECT_CALL(mock_hal_interface_audio_source_, StartSession()).Times(1);
+
+  ASSERT_TRUE(AcquireLeAudioSinkHalClient());
+  ASSERT_TRUE(audio_sink_instance_->Start(default_codec_conf,
+                                          &mock_hal_source_event_receiver_));
+
+  ASSERT_EQ(params.channels_count,
+            bluetooth::audio::le_audio::kChannelNumberMono);
+  ASSERT_EQ(params.sample_rate, bluetooth::audio::le_audio::kSampleRate44100);
+  ASSERT_EQ(params.bits_per_sample,
+            bluetooth::audio::le_audio::kBitsPerSample24);
+  ASSERT_EQ(params.data_interval_us, 10000u);
+
+  EXPECT_CALL(mock_hal_interface_audio_source_, StopSession()).Times(1);
+
+  audio_sink_instance_->Stop();
+}
+
+TEST_F(LeAudioClientAudioTest, testAudioHalClientStartStop) {
+  LeAudioClientInterface::PcmParameters params;
+  EXPECT_CALL(mock_hal_interface_audio_sink_, SetPcmParameters(_))
+      .Times(1)
+      .WillOnce(SaveArg<0>(&params));
+  EXPECT_CALL(mock_hal_interface_audio_sink_, StartSession()).Times(1);
+
+  ASSERT_TRUE(AcquireLeAudioSourceHalClient());
+  ASSERT_TRUE(audio_source_instance_->Start(default_codec_conf,
+                                            &mock_hal_sink_event_receiver_));
+
+  ASSERT_EQ(params.channels_count,
+            bluetooth::audio::le_audio::kChannelNumberMono);
+  ASSERT_EQ(params.sample_rate, bluetooth::audio::le_audio::kSampleRate44100);
+  ASSERT_EQ(params.bits_per_sample,
+            bluetooth::audio::le_audio::kBitsPerSample24);
+  ASSERT_EQ(params.data_interval_us, 10000u);
+
+  EXPECT_CALL(mock_hal_interface_audio_sink_, StopSession()).Times(1);
+
+  audio_source_instance_->Stop();
+}
+
+TEST_F(LeAudioClientAudioTest, testLeAudioClientAudioSinkSendData) {
+  ASSERT_TRUE(AcquireLeAudioSinkHalClient());
+  ASSERT_TRUE(audio_sink_instance_->Start(default_codec_conf,
+                                          &mock_hal_source_event_receiver_));
+
+  const uint8_t* exp_p = nullptr;
+  uint32_t exp_len = 0;
+  uint8_t input_buf[] = {
+      0x02,
+      0x03,
+      0x05,
+      0x19,
+  };
+  ON_CALL(mock_hal_interface_audio_source_, Write(_, _))
+      .WillByDefault(DoAll(SaveArg<0>(&exp_p), SaveArg<1>(&exp_len),
+                           ReturnPointee(&exp_len)));
+
+  ASSERT_EQ(audio_sink_instance_->SendData(input_buf, sizeof(input_buf)),
+            sizeof(input_buf));
+  ASSERT_EQ(exp_len, sizeof(input_buf));
+  ASSERT_EQ(exp_p, input_buf);
+
+  audio_sink_instance_->Stop();
+}
+
+TEST_F(LeAudioClientAudioTest, testLeAudioClientAudioSinkSuspend) {
+  ASSERT_TRUE(AcquireLeAudioSinkHalClient());
+  ASSERT_TRUE(audio_sink_instance_->Start(default_codec_conf,
+                                          &mock_hal_source_event_receiver_));
+
+  ASSERT_NE(source_audio_hal_stream_cb.on_suspend_, nullptr);
+
+  /* Expect LeAudio registered event listener to get called when HAL calls the
+   * audio_hal_client's internal suspend callback.
+   */
+  EXPECT_CALL(mock_hal_source_event_receiver_, OnAudioSuspend(_)).Times(1);
+  ASSERT_TRUE(source_audio_hal_stream_cb.on_suspend_());
+}
+
+TEST_F(LeAudioClientAudioTest, testAudioHalClientSuspend) {
+  ASSERT_TRUE(AcquireLeAudioSourceHalClient());
+  ASSERT_TRUE(audio_source_instance_->Start(default_codec_conf,
+                                            &mock_hal_sink_event_receiver_));
+
+  ASSERT_NE(sink_audio_hal_stream_cb.on_suspend_, nullptr);
+
+  /* Expect LeAudio registered event listener to get called when HAL calls the
+   * audio_hal_client's internal suspend callback.
+   */
+  EXPECT_CALL(mock_hal_sink_event_receiver_, OnAudioSuspend(_)).Times(1);
+  ASSERT_TRUE(sink_audio_hal_stream_cb.on_suspend_());
+}
+
+TEST_F(LeAudioClientAudioTest, testLeAudioClientAudioSinkResume) {
+  ASSERT_TRUE(AcquireLeAudioSinkHalClient());
+  ASSERT_TRUE(audio_sink_instance_->Start(default_codec_conf,
+                                          &mock_hal_source_event_receiver_));
+
+  ASSERT_NE(source_audio_hal_stream_cb.on_resume_, nullptr);
+
+  /* Expect LeAudio registered event listener to get called when HAL calls the
+   * audio_hal_client's internal resume callback.
+   */
+  EXPECT_CALL(mock_hal_source_event_receiver_, OnAudioResume()).Times(1);
+  bool start_media_task = false;
+  ASSERT_TRUE(source_audio_hal_stream_cb.on_resume_(start_media_task));
+}
+
+TEST_F(LeAudioClientAudioTest, testAudioHalClientResumeStartSourceTask) {
+  const LeAudioCodecConfiguration codec_conf{
+      .num_channels = LeAudioCodecConfiguration::kChannelNumberStereo,
+      .sample_rate = LeAudioCodecConfiguration::kSampleRate16000,
+      .bits_per_sample = LeAudioCodecConfiguration::kBitsPerSample24,
+      .data_interval_us = LeAudioCodecConfiguration::kInterval10000Us,
+  };
+  ASSERT_TRUE(AcquireLeAudioSourceHalClient());
+  ASSERT_TRUE(audio_source_instance_->Start(codec_conf,
+                                            &mock_hal_sink_event_receiver_));
+
+  std::chrono::time_point<std::chrono::system_clock> resumed_ts;
+  std::chrono::time_point<std::chrono::system_clock> executed_ts;
+  std::promise<void> promise;
+  auto future = promise.get_future();
+
+  uint32_t calculated_bytes_per_tick = 0;
+  EXPECT_CALL(mock_hal_interface_audio_sink_, Read(_, _))
+      .Times(AtLeast(1))
+      .WillOnce(Invoke([&](uint8_t* p_buf, uint32_t len) -> uint32_t {
+        executed_ts = std::chrono::system_clock::now();
+        calculated_bytes_per_tick = len;
+
+        // fake some data from audio framework
+        for (uint32_t i = 0u; i < len; ++i) {
+          p_buf[i] = i;
+        }
+
+        // Return exactly as much data as requested
+        promise.set_value();
+        return len;
+      }))
+      .WillRepeatedly(Invoke([](uint8_t* p_buf, uint32_t len) -> uint32_t {
+        // fake some data from audio framework
+        for (uint32_t i = 0u; i < len; ++i) {
+          p_buf[i] = i;
+        }
+        return len;
+      }));
+
+  std::promise<void> data_promise;
+  auto data_future = data_promise.get_future();
+
+  /* Expect this callback to be called to Client by the HAL glue layer */
+  std::vector<uint8_t> media_data_to_send;
+  EXPECT_CALL(mock_hal_sink_event_receiver_, OnAudioDataReady(_))
+      .Times(AtLeast(1))
+      .WillOnce(Invoke([&](const std::vector<uint8_t>& data) -> void {
+        media_data_to_send = std::move(data);
+        data_promise.set_value();
+      }))
+      .WillRepeatedly(DoDefault());
+
+  /* Expect LeAudio registered event listener to get called when HAL calls the
+   * audio_hal_client's internal resume callback.
+   */
+  ASSERT_NE(sink_audio_hal_stream_cb.on_resume_, nullptr);
+  EXPECT_CALL(mock_hal_sink_event_receiver_, OnAudioResume()).Times(1);
+  resumed_ts = std::chrono::system_clock::now();
+  bool start_media_task = true;
+  ASSERT_TRUE(sink_audio_hal_stream_cb.on_resume_(start_media_task));
+  audio_source_instance_->ConfirmStreamingRequest();
+
+  ASSERT_EQ(future.wait_for(std::chrono::seconds(1)),
+            std::future_status::ready);
+
+  ASSERT_EQ(data_future.wait_for(std::chrono::seconds(1)),
+            std::future_status::ready);
+
+  // Check agains expected payload size
+  // 24 bit audio stream is sent as unpacked, each sample takes 4 bytes.
+  const uint32_t channel_bytes_per_sample = 4;
+  const uint32_t channel_bytes_per_10ms_at_16000Hz =
+      ((10ms).count() * channel_bytes_per_sample * 16000 /*Hz*/) /
+      (1000ms).count();
+
+  // Expect 2 channel (stereo) data
+  ASSERT_EQ(calculated_bytes_per_tick, 2 * channel_bytes_per_10ms_at_16000Hz);
+
+  // Verify callback call interval for the requested 10ms (+2ms error margin)
+  auto delta = std::chrono::duration_cast<std::chrono::milliseconds>(
+      executed_ts - resumed_ts);
+  EXPECT_TRUE((delta >= 10ms) && (delta <= 12ms));
+
+  // Verify if we got just right amount of data in the callback call
+  ASSERT_EQ(media_data_to_send.size(), calculated_bytes_per_tick);
+}
+
+TEST_F(LeAudioClientAudioTest, testAudioHalClientResume) {
+  ASSERT_TRUE(AcquireLeAudioSourceHalClient());
+  ASSERT_TRUE(audio_source_instance_->Start(default_codec_conf,
+                                            &mock_hal_sink_event_receiver_));
+
+  ASSERT_NE(sink_audio_hal_stream_cb.on_resume_, nullptr);
+
+  /* Expect LeAudio registered event listener to get called when HAL calls the
+   * audio_hal_client's internal resume callback.
+   */
+  EXPECT_CALL(mock_hal_sink_event_receiver_, OnAudioResume()).Times(1);
+  bool start_media_task = false;
+  ASSERT_TRUE(sink_audio_hal_stream_cb.on_resume_(start_media_task));
+}
diff --git a/system/bta/le_audio/audio_hal_client/audio_sink_hal_client.cc b/system/bta/le_audio/audio_hal_client/audio_sink_hal_client.cc
new file mode 100644
index 0000000..8d43590
--- /dev/null
+++ b/system/bta/le_audio/audio_hal_client/audio_sink_hal_client.cc
@@ -0,0 +1,343 @@
+/******************************************************************************
+ *
+ * Copyright 2019 HIMSA II K/S - www.himsa.com.Represented by EHIMA -
+ * www.ehima.com
+ * Copyright (c) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ ******************************************************************************/
+
+#include "audio_hal_client.h"
+#include "audio_hal_interface/le_audio_software.h"
+#include "bta/le_audio/codec_manager.h"
+#include "btu.h"
+#include "common/time_util.h"
+#include "osi/include/log.h"
+#include "osi/include/wakelock.h"
+
+using bluetooth::audio::le_audio::LeAudioClientInterface;
+
+namespace le_audio {
+namespace {
+// TODO: HAL state should be in the HAL implementation
+enum {
+  HAL_UNINITIALIZED,
+  HAL_STOPPED,
+  HAL_STARTED,
+} le_audio_source_hal_state;
+
+class SinkImpl : public LeAudioSinkAudioHalClient {
+ public:
+  // Interface implementation
+  bool Start(const LeAudioCodecConfiguration& codecConfiguration,
+             LeAudioSinkAudioHalClient::Callbacks* audioReceiver) override;
+  void Stop();
+  size_t SendData(uint8_t* data, uint16_t size) override;
+  void ConfirmStreamingRequest() override;
+  void CancelStreamingRequest() override;
+  void UpdateRemoteDelay(uint16_t remote_delay_ms) override;
+  void UpdateAudioConfigToHal(
+      const ::le_audio::offload_config& config) override;
+  void SuspendedForReconfiguration() override;
+  void ReconfigurationComplete() override;
+
+  // Internal functionality
+  SinkImpl() = default;
+  ~SinkImpl() override {
+    if (le_audio_source_hal_state != HAL_UNINITIALIZED) Release();
+  }
+
+  bool OnResumeReq(bool start_media_task);
+  bool OnSuspendReq();
+  bool OnMetadataUpdateReq(const sink_metadata_t& sink_metadata);
+  bool Acquire();
+  void Release();
+
+  bluetooth::audio::le_audio::LeAudioClientInterface::Source*
+      halSourceInterface_ = nullptr;
+  LeAudioSinkAudioHalClient::Callbacks* audioSinkCallbacks_ = nullptr;
+};
+
+bool SinkImpl::Acquire() {
+  auto source_stream_cb = bluetooth::audio::le_audio::StreamCallbacks{
+      .on_resume_ =
+          std::bind(&SinkImpl::OnResumeReq, this, std::placeholders::_1),
+      .on_suspend_ = std::bind(&SinkImpl::OnSuspendReq, this),
+      .on_sink_metadata_update_ = std::bind(&SinkImpl::OnMetadataUpdateReq,
+                                            this, std::placeholders::_1),
+  };
+
+  auto halInterface = LeAudioClientInterface::Get();
+  if (halInterface == nullptr) {
+    LOG_ERROR("Can't get LE Audio HAL interface");
+    return false;
+  }
+
+  halSourceInterface_ =
+      halInterface->GetSource(source_stream_cb, get_main_thread());
+
+  if (halSourceInterface_ == nullptr) {
+    LOG_ERROR("Can't get Audio HAL Audio source interface");
+    return false;
+  }
+
+  LOG_INFO();
+  le_audio_source_hal_state = HAL_STOPPED;
+  return true;
+}
+
+void SinkImpl::Release() {
+  if (le_audio_source_hal_state == HAL_UNINITIALIZED) {
+    LOG_WARN("Audio HAL Audio source is not running");
+    return;
+  }
+
+  LOG_INFO();
+  if (halSourceInterface_) {
+    halSourceInterface_->Cleanup();
+
+    auto halInterface = LeAudioClientInterface::Get();
+    if (halInterface != nullptr) {
+      halInterface->ReleaseSource(halSourceInterface_);
+    } else {
+      LOG_ERROR("Can't get LE Audio HAL interface");
+    }
+
+    le_audio_source_hal_state = HAL_UNINITIALIZED;
+    halSourceInterface_ = nullptr;
+  }
+}
+
+bool SinkImpl::OnResumeReq(bool start_media_task) {
+  if (audioSinkCallbacks_ == nullptr) {
+    LOG_ERROR("audioSinkCallbacks_ not set");
+    return false;
+  }
+
+  bt_status_t status = do_in_main_thread(
+      FROM_HERE,
+      base::BindOnce(&LeAudioSinkAudioHalClient::Callbacks::OnAudioResume,
+                     base::Unretained(audioSinkCallbacks_)));
+  if (status == BT_STATUS_SUCCESS) {
+    return true;
+  }
+
+  LOG_ERROR("do_in_main_thread err=%d", status);
+  return false;
+}
+
+bool SinkImpl::OnSuspendReq() {
+  if (audioSinkCallbacks_ == nullptr) {
+    LOG_ERROR("audioSinkCallbacks_ not set");
+    return false;
+  }
+
+  std::promise<void> do_suspend_promise;
+  std::future<void> do_suspend_future = do_suspend_promise.get_future();
+
+  bt_status_t status = do_in_main_thread(
+      FROM_HERE,
+      base::BindOnce(&LeAudioSinkAudioHalClient::Callbacks::OnAudioSuspend,
+                     base::Unretained(audioSinkCallbacks_),
+                     std::move(do_suspend_promise)));
+  if (status == BT_STATUS_SUCCESS) {
+    do_suspend_future.wait();
+    return true;
+  }
+
+  LOG_ERROR("do_in_main_thread err=%d", status);
+  return false;
+}
+
+bool SinkImpl::OnMetadataUpdateReq(const sink_metadata_t& sink_metadata) {
+  if (audioSinkCallbacks_ == nullptr) {
+    LOG_ERROR("audioSinkCallbacks_ not set");
+    return false;
+  }
+
+  std::vector<struct record_track_metadata> metadata;
+  for (size_t i = 0; i < sink_metadata.track_count; i++) {
+    metadata.push_back(sink_metadata.tracks[i]);
+  }
+
+  bt_status_t status = do_in_main_thread(
+      FROM_HERE,
+      base::BindOnce(
+          &LeAudioSinkAudioHalClient::Callbacks::OnAudioMetadataUpdate,
+          base::Unretained(audioSinkCallbacks_), metadata));
+  if (status == BT_STATUS_SUCCESS) {
+    return true;
+  }
+
+  LOG_ERROR("do_in_main_thread err=%d", status);
+  return false;
+}
+
+bool SinkImpl::Start(const LeAudioCodecConfiguration& codec_configuration,
+                     LeAudioSinkAudioHalClient::Callbacks* audioReceiver) {
+  if (!halSourceInterface_) {
+    LOG_ERROR("Audio HAL Audio source interface not acquired");
+    return false;
+  }
+
+  if (le_audio_source_hal_state == HAL_STARTED) {
+    LOG_ERROR("Audio HAL Audio source is already in use");
+    return false;
+  }
+
+  LOG_INFO("bit rate: %d, num channels: %d, sample rate: %d, data interval: %d",
+           codec_configuration.bits_per_sample,
+           codec_configuration.num_channels, codec_configuration.sample_rate,
+           codec_configuration.data_interval_us);
+
+  LeAudioClientInterface::PcmParameters pcmParameters = {
+      .data_interval_us = codec_configuration.data_interval_us,
+      .sample_rate = codec_configuration.sample_rate,
+      .bits_per_sample = codec_configuration.bits_per_sample,
+      .channels_count = codec_configuration.num_channels};
+
+  halSourceInterface_->SetPcmParameters(pcmParameters);
+  halSourceInterface_->StartSession();
+
+  audioSinkCallbacks_ = audioReceiver;
+  le_audio_source_hal_state = HAL_STARTED;
+  return true;
+}
+
+void SinkImpl::Stop() {
+  if (!halSourceInterface_) {
+    LOG_ERROR("Audio HAL Audio source interface already stopped");
+    return;
+  }
+
+  if (le_audio_source_hal_state != HAL_STARTED) {
+    LOG_ERROR("Audio HAL Audio source was not started!");
+    return;
+  }
+
+  LOG_INFO();
+
+  halSourceInterface_->StopSession();
+  le_audio_source_hal_state = HAL_STOPPED;
+  audioSinkCallbacks_ = nullptr;
+}
+
+size_t SinkImpl::SendData(uint8_t* data, uint16_t size) {
+  size_t bytes_written;
+  if (!halSourceInterface_) {
+    LOG_ERROR("Audio HAL Audio source interface not initialized");
+    return 0;
+  }
+
+  if (le_audio_source_hal_state != HAL_STARTED) {
+    LOG_ERROR("Audio HAL Audio source was not started!");
+    return 0;
+  }
+
+  /* TODO: What to do if not all data is written ? */
+  bytes_written = halSourceInterface_->Write(data, size);
+  if (bytes_written != size) {
+    LOG_ERROR(
+        "Not all data is written to source HAL. Bytes written: %zu, total: %d",
+        bytes_written, size);
+  }
+
+  return bytes_written;
+}
+
+void SinkImpl::ConfirmStreamingRequest() {
+  if ((halSourceInterface_ == nullptr) ||
+      (le_audio_source_hal_state != HAL_STARTED)) {
+    LOG_ERROR("Audio HAL Audio source was not started!");
+    return;
+  }
+
+  LOG_INFO();
+  halSourceInterface_->ConfirmStreamingRequest();
+}
+
+void SinkImpl::SuspendedForReconfiguration() {
+  if ((halSourceInterface_ == nullptr) ||
+      (le_audio_source_hal_state != HAL_STARTED)) {
+    LOG_ERROR("Audio HAL Audio source was not started!");
+    return;
+  }
+
+  LOG_INFO();
+  halSourceInterface_->SuspendedForReconfiguration();
+}
+
+void SinkImpl::ReconfigurationComplete() {
+  if ((halSourceInterface_ == nullptr) ||
+      (le_audio_source_hal_state != HAL_STARTED)) {
+    LOG_ERROR("Audio HAL Audio source was not started!");
+    return;
+  }
+
+  LOG_INFO();
+  halSourceInterface_->ReconfigurationComplete();
+}
+
+void SinkImpl::CancelStreamingRequest() {
+  if ((halSourceInterface_ == nullptr) ||
+      (le_audio_source_hal_state != HAL_STARTED)) {
+    LOG_ERROR("Audio HAL Audio source was not started!");
+    return;
+  }
+
+  LOG_INFO();
+  halSourceInterface_->CancelStreamingRequest();
+}
+
+void SinkImpl::UpdateRemoteDelay(uint16_t remote_delay_ms) {
+  if ((halSourceInterface_ == nullptr) ||
+      (le_audio_source_hal_state != HAL_STARTED)) {
+    LOG_ERROR("Audio HAL Audio source was not started!");
+    return;
+  }
+
+  LOG_INFO();
+  halSourceInterface_->SetRemoteDelay(remote_delay_ms);
+}
+
+void SinkImpl::UpdateAudioConfigToHal(
+    const ::le_audio::offload_config& config) {
+  if ((halSourceInterface_ == nullptr) ||
+      (le_audio_source_hal_state != HAL_STARTED)) {
+    LOG_ERROR("Audio HAL Audio source was not started!");
+    return;
+  }
+
+  LOG_INFO();
+  halSourceInterface_->UpdateAudioConfigToHal(config);
+}
+}  // namespace
+
+std::unique_ptr<LeAudioSinkAudioHalClient>
+LeAudioSinkAudioHalClient::AcquireUnicast() {
+  std::unique_ptr<SinkImpl> impl(new SinkImpl());
+  if (!impl->Acquire()) {
+    LOG_ERROR("Could not acquire Unicast Sink on LE Audio HAL enpoint");
+    impl.reset();
+    return nullptr;
+  }
+
+  LOG_INFO();
+  return std::move(impl);
+}
+
+void LeAudioSinkAudioHalClient::DebugDump(int fd) {
+  /* TODO: Add some statistic for LeAudioSink Audio HAL interface */
+}
+}  // namespace le_audio
diff --git a/system/bta/le_audio/audio_hal_client/audio_source_hal_client.cc b/system/bta/le_audio/audio_hal_client/audio_source_hal_client.cc
new file mode 100644
index 0000000..6cf54f1
--- /dev/null
+++ b/system/bta/le_audio/audio_hal_client/audio_source_hal_client.cc
@@ -0,0 +1,485 @@
+/******************************************************************************
+ *
+ * Copyright 2019 HIMSA II K/S - www.himsa.com.Represented by EHIMA -
+ * www.ehima.com
+ * Copyright (c) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ ******************************************************************************/
+
+#include "audio_hal_client.h"
+#include "audio_hal_interface/le_audio_software.h"
+#include "bta/le_audio/codec_manager.h"
+#include "btu.h"
+#include "common/time_util.h"
+#include "osi/include/log.h"
+#include "osi/include/wakelock.h"
+
+using bluetooth::audio::le_audio::LeAudioClientInterface;
+
+namespace le_audio {
+namespace {
+// TODO: HAL state should be in the HAL implementation
+enum {
+  HAL_UNINITIALIZED,
+  HAL_STOPPED,
+  HAL_STARTED,
+} le_audio_sink_hal_state;
+
+struct AudioHalStats {
+  size_t media_read_total_underflow_bytes;
+  size_t media_read_total_underflow_count;
+  uint64_t media_read_last_underflow_us;
+
+  AudioHalStats() { Reset(); }
+
+  void Reset() {
+    media_read_total_underflow_bytes = 0;
+    media_read_total_underflow_count = 0;
+    media_read_last_underflow_us = 0;
+  }
+} sStats;
+
+class SourceImpl : public LeAudioSourceAudioHalClient {
+ public:
+  // Interface implementation
+  bool Start(const LeAudioCodecConfiguration& codec_configuration,
+             LeAudioSourceAudioHalClient::Callbacks* audioReceiver) override;
+  void Stop() override;
+  void ConfirmStreamingRequest() override;
+  void CancelStreamingRequest() override;
+  void UpdateRemoteDelay(uint16_t remote_delay_ms) override;
+  void UpdateAudioConfigToHal(
+      const ::le_audio::offload_config& config) override;
+  void UpdateBroadcastAudioConfigToHal(
+      const ::le_audio::broadcast_offload_config& config) override;
+  void SuspendedForReconfiguration() override;
+  void ReconfigurationComplete() override;
+
+  // Internal functionality
+  SourceImpl(bool is_broadcaster) : is_broadcaster_(is_broadcaster){};
+  ~SourceImpl() override {
+    if (le_audio_sink_hal_state != HAL_UNINITIALIZED) Release();
+  }
+
+  bool OnResumeReq(bool start_media_task);
+  bool OnSuspendReq();
+  bool OnMetadataUpdateReq(const source_metadata_t& source_metadata);
+  bool Acquire();
+  void Release();
+  bool InitAudioSinkThread();
+
+  bluetooth::common::MessageLoopThread* worker_thread_;
+  bluetooth::common::RepeatingTimer audio_timer_;
+  LeAudioCodecConfiguration source_codec_config_;
+  void StartAudioTicks();
+  void StopAudioTicks();
+  void SendAudioData();
+
+  bool is_broadcaster_;
+
+  bluetooth::audio::le_audio::LeAudioClientInterface::Sink* halSinkInterface_ =
+      nullptr;
+  LeAudioSourceAudioHalClient::Callbacks* audioSourceCallbacks_ = nullptr;
+  std::mutex audioSourceCallbacksMutex_;
+};
+
+bool SourceImpl::Acquire() {
+  auto sink_stream_cb = bluetooth::audio::le_audio::StreamCallbacks{
+      .on_resume_ =
+          std::bind(&SourceImpl::OnResumeReq, this, std::placeholders::_1),
+      .on_suspend_ = std::bind(&SourceImpl::OnSuspendReq, this),
+      .on_metadata_update_ = std::bind(&SourceImpl::OnMetadataUpdateReq, this,
+                                       std::placeholders::_1),
+      .on_sink_metadata_update_ =
+          [](const sink_metadata_t& sink_metadata) {
+            // TODO: update microphone configuration based on sink metadata
+            return true;
+          },
+  };
+
+  /* Get pointer to singleton LE audio client interface */
+  auto halInterface = LeAudioClientInterface::Get();
+  if (halInterface == nullptr) {
+    LOG_ERROR("Can't get LE Audio HAL interface");
+    return false;
+  }
+
+  halSinkInterface_ =
+      halInterface->GetSink(sink_stream_cb, get_main_thread(), is_broadcaster_);
+
+  if (halSinkInterface_ == nullptr) {
+    LOG_ERROR("Can't get Audio HAL Audio sink interface");
+    return false;
+  }
+
+  LOG_INFO();
+  le_audio_sink_hal_state = HAL_STOPPED;
+  return this->InitAudioSinkThread();
+}
+
+void SourceImpl::Release() {
+  if (le_audio_sink_hal_state == HAL_UNINITIALIZED) {
+    LOG_WARN("Audio HAL Audio sink is not running");
+    return;
+  }
+
+  LOG_INFO();
+  worker_thread_->ShutDown();
+
+  if (halSinkInterface_) {
+    halSinkInterface_->Cleanup();
+
+    auto halInterface = LeAudioClientInterface::Get();
+    if (halInterface != nullptr) {
+      halInterface->ReleaseSink(halSinkInterface_);
+    } else {
+      LOG_ERROR("Can't get LE Audio HAL interface");
+    }
+
+    le_audio_sink_hal_state = HAL_UNINITIALIZED;
+    halSinkInterface_ = nullptr;
+  }
+}
+
+bool SourceImpl::OnResumeReq(bool start_media_task) {
+  std::lock_guard<std::mutex> guard(audioSourceCallbacksMutex_);
+  if (audioSourceCallbacks_ == nullptr) {
+    LOG_ERROR("audioSourceCallbacks_ not set");
+    return false;
+  }
+  bt_status_t status = do_in_main_thread(
+      FROM_HERE,
+      base::BindOnce(&LeAudioSourceAudioHalClient::Callbacks::OnAudioResume,
+                     base::Unretained(audioSourceCallbacks_)));
+  if (status == BT_STATUS_SUCCESS) {
+    return true;
+  }
+
+  LOG_ERROR("do_in_main_thread err=%d", status);
+  return false;
+}
+
+void SourceImpl::SendAudioData() {
+  if (halSinkInterface_ == nullptr) {
+    LOG_ERROR("Audio HAL Audio sink interface not acquired - aborting");
+    return;
+  }
+
+  // 24 bit audio is aligned to 32bit
+  int bytes_per_sample = (source_codec_config_.bits_per_sample == 24)
+                             ? 4
+                             : (source_codec_config_.bits_per_sample / 8);
+  uint32_t bytes_per_tick =
+      (source_codec_config_.num_channels * source_codec_config_.sample_rate *
+       source_codec_config_.data_interval_us / 1000 * bytes_per_sample) /
+      1000;
+  std::vector<uint8_t> data(bytes_per_tick);
+
+  uint32_t bytes_read = halSinkInterface_->Read(data.data(), bytes_per_tick);
+  if (bytes_read < bytes_per_tick) {
+    sStats.media_read_total_underflow_bytes += bytes_per_tick - bytes_read;
+    sStats.media_read_total_underflow_count++;
+    sStats.media_read_last_underflow_us =
+        bluetooth::common::time_get_os_boottime_us();
+  }
+
+  std::lock_guard<std::mutex> guard(audioSourceCallbacksMutex_);
+  if (audioSourceCallbacks_ != nullptr) {
+    audioSourceCallbacks_->OnAudioDataReady(data);
+  }
+}
+
+bool SourceImpl::InitAudioSinkThread() {
+  const std::string thread_name =
+      is_broadcaster_ ? "bt_le_audio_broadcast_sink_worker_thread"
+                      : "bt_le_audio_unicast_sink_worker_thread";
+  worker_thread_ = new bluetooth::common::MessageLoopThread(thread_name);
+
+  worker_thread_->StartUp();
+  if (!worker_thread_->IsRunning()) {
+    LOG_ERROR("Unable to start up the BLE audio sink worker thread");
+    return false;
+  }
+
+  /* Schedule the rest of the operations */
+  if (!worker_thread_->EnableRealTimeScheduling()) {
+#if defined(OS_ANDROID)
+    LOG(FATAL) << __func__ << ", Failed to increase media thread priority";
+#endif
+  }
+
+  return true;
+}
+
+void SourceImpl::StartAudioTicks() {
+  wakelock_acquire();
+  audio_timer_.SchedulePeriodic(
+      worker_thread_->GetWeakPtr(), FROM_HERE,
+      base::Bind(&SourceImpl::SendAudioData, base::Unretained(this)),
+#if BASE_VER < 931007
+      base::TimeDelta::FromMicroseconds(source_codec_config_.data_interval_us));
+#else
+      base::Microseconds(source_codec_config_.data_interval_us));
+#endif
+}
+
+void SourceImpl::StopAudioTicks() {
+  audio_timer_.CancelAndWait();
+  wakelock_release();
+}
+
+bool SourceImpl::OnSuspendReq() {
+  std::lock_guard<std::mutex> guard(audioSourceCallbacksMutex_);
+  if (CodecManager::GetInstance()->GetCodecLocation() ==
+      types::CodecLocation::HOST) {
+    StopAudioTicks();
+  }
+
+  if (audioSourceCallbacks_ == nullptr) {
+    LOG_ERROR("audioSourceCallbacks_ not set");
+    return false;
+  }
+
+  // Call OnAudioSuspend and block till it returns.
+  std::promise<void> do_suspend_promise;
+  std::future<void> do_suspend_future = do_suspend_promise.get_future();
+  bt_status_t status = do_in_main_thread(
+      FROM_HERE,
+      base::BindOnce(&LeAudioSourceAudioHalClient::Callbacks::OnAudioSuspend,
+                     base::Unretained(audioSourceCallbacks_),
+                     std::move(do_suspend_promise)));
+  if (status == BT_STATUS_SUCCESS) {
+    do_suspend_future.wait();
+    return true;
+  }
+
+  LOG_ERROR("do_in_main_thread err=%d", status);
+  return false;
+}
+
+bool SourceImpl::OnMetadataUpdateReq(const source_metadata_t& source_metadata) {
+  std::lock_guard<std::mutex> guard(audioSourceCallbacksMutex_);
+  if (audioSourceCallbacks_ == nullptr) {
+    LOG(ERROR) << __func__ << ", audio receiver not started";
+    return false;
+  }
+
+  std::vector<struct playback_track_metadata> metadata;
+  for (size_t i = 0; i < source_metadata.track_count; i++) {
+    metadata.push_back(source_metadata.tracks[i]);
+  }
+
+  bt_status_t status = do_in_main_thread(
+      FROM_HERE,
+      base::BindOnce(
+          &LeAudioSourceAudioHalClient::Callbacks::OnAudioMetadataUpdate,
+          base::Unretained(audioSourceCallbacks_), metadata));
+  if (status == BT_STATUS_SUCCESS) {
+    return true;
+  }
+
+  LOG_ERROR("do_in_main_thread err=%d", status);
+  return false;
+}
+
+bool SourceImpl::Start(const LeAudioCodecConfiguration& codec_configuration,
+                       LeAudioSourceAudioHalClient::Callbacks* audioReceiver) {
+  if (!halSinkInterface_) {
+    LOG_ERROR("Audio HAL Audio sink interface not acquired");
+    return false;
+  }
+
+  if (le_audio_sink_hal_state == HAL_STARTED) {
+    LOG_ERROR("Audio HAL Audio sink is already in use");
+    return false;
+  }
+
+  LOG_INFO("bit rate: %d, num channels: %d, sample rate: %d, data interval: %d",
+           codec_configuration.bits_per_sample,
+           codec_configuration.num_channels, codec_configuration.sample_rate,
+           codec_configuration.data_interval_us);
+
+  sStats.Reset();
+
+  /* Global config for periodic audio data */
+  source_codec_config_ = codec_configuration;
+  LeAudioClientInterface::PcmParameters pcmParameters = {
+      .data_interval_us = codec_configuration.data_interval_us,
+      .sample_rate = codec_configuration.sample_rate,
+      .bits_per_sample = codec_configuration.bits_per_sample,
+      .channels_count = codec_configuration.num_channels};
+
+  halSinkInterface_->SetPcmParameters(pcmParameters);
+  halSinkInterface_->StartSession();
+
+  std::lock_guard<std::mutex> guard(audioSourceCallbacksMutex_);
+  audioSourceCallbacks_ = audioReceiver;
+  le_audio_sink_hal_state = HAL_STARTED;
+  return true;
+}
+
+void SourceImpl::Stop() {
+  if (!halSinkInterface_) {
+    LOG_ERROR("Audio HAL Audio sink interface already stopped");
+    return;
+  }
+
+  if (le_audio_sink_hal_state != HAL_STARTED) {
+    LOG_ERROR("Audio HAL Audio sink was not started!");
+    return;
+  }
+
+  LOG_INFO();
+
+  halSinkInterface_->StopSession();
+  le_audio_sink_hal_state = HAL_STOPPED;
+
+  if (CodecManager::GetInstance()->GetCodecLocation() ==
+      types::CodecLocation::HOST) {
+    StopAudioTicks();
+  }
+
+  std::lock_guard<std::mutex> guard(audioSourceCallbacksMutex_);
+  audioSourceCallbacks_ = nullptr;
+}
+
+void SourceImpl::ConfirmStreamingRequest() {
+  if ((halSinkInterface_ == nullptr) ||
+      (le_audio_sink_hal_state != HAL_STARTED)) {
+    LOG_ERROR("Audio HAL Audio sink was not started!");
+    return;
+  }
+
+  LOG_INFO();
+  halSinkInterface_->ConfirmStreamingRequest();
+  if (CodecManager::GetInstance()->GetCodecLocation() !=
+      types::CodecLocation::HOST)
+    return;
+
+  StartAudioTicks();
+}
+
+void SourceImpl::SuspendedForReconfiguration() {
+  if ((halSinkInterface_ == nullptr) ||
+      (le_audio_sink_hal_state != HAL_STARTED)) {
+    LOG_ERROR("Audio HAL Audio sink was not started!");
+    return;
+  }
+
+  LOG_INFO();
+  halSinkInterface_->SuspendedForReconfiguration();
+}
+
+void SourceImpl::ReconfigurationComplete() {
+  if ((halSinkInterface_ == nullptr) ||
+      (le_audio_sink_hal_state != HAL_STARTED)) {
+    LOG_ERROR("Audio HAL Audio sink was not started!");
+    return;
+  }
+
+  LOG_INFO();
+  halSinkInterface_->ReconfigurationComplete();
+}
+
+void SourceImpl::CancelStreamingRequest() {
+  if ((halSinkInterface_ == nullptr) ||
+      (le_audio_sink_hal_state != HAL_STARTED)) {
+    LOG_ERROR("Audio HAL Audio sink was not started!");
+    return;
+  }
+
+  LOG_INFO();
+  halSinkInterface_->CancelStreamingRequest();
+}
+
+void SourceImpl::UpdateRemoteDelay(uint16_t remote_delay_ms) {
+  if ((halSinkInterface_ == nullptr) ||
+      (le_audio_sink_hal_state != HAL_STARTED)) {
+    LOG_ERROR("Audio HAL Audio sink was not started!");
+    return;
+  }
+
+  LOG_INFO();
+  halSinkInterface_->SetRemoteDelay(remote_delay_ms);
+}
+
+void SourceImpl::UpdateAudioConfigToHal(
+    const ::le_audio::offload_config& config) {
+  if ((halSinkInterface_ == nullptr) ||
+      (le_audio_sink_hal_state != HAL_STARTED)) {
+    LOG_ERROR("Audio HAL Audio sink was not started!");
+    return;
+  }
+
+  LOG_INFO();
+  halSinkInterface_->UpdateAudioConfigToHal(config);
+}
+
+void SourceImpl::UpdateBroadcastAudioConfigToHal(
+    const ::le_audio::broadcast_offload_config& config) {
+  if (halSinkInterface_ == nullptr) {
+    LOG_ERROR("Audio HAL Audio sink interface not acquired");
+    return;
+  }
+
+  LOG_INFO();
+  halSinkInterface_->UpdateBroadcastAudioConfigToHal(config);
+}
+}  // namespace
+
+std::unique_ptr<LeAudioSourceAudioHalClient>
+LeAudioSourceAudioHalClient::AcquireUnicast() {
+  std::unique_ptr<SourceImpl> impl(new SourceImpl(false));
+  if (!impl->Acquire()) {
+    LOG_ERROR("Could not acquire Unicast Source on LE Audio HAL enpoint");
+    impl.reset();
+    return nullptr;
+  }
+
+  LOG_INFO();
+  return std::move(impl);
+}
+
+std::unique_ptr<LeAudioSourceAudioHalClient>
+LeAudioSourceAudioHalClient::AcquireBroadcast() {
+  std::unique_ptr<SourceImpl> impl(new SourceImpl(true));
+  if (!impl->Acquire()) {
+    LOG_ERROR("Could not acquire Broadcast Source on LE Audio HAL enpoint");
+    impl.reset();
+    return nullptr;
+  }
+
+  LOG_INFO();
+  return std::move(impl);
+}
+
+void LeAudioSourceAudioHalClient::DebugDump(int fd) {
+  uint64_t now_us = bluetooth::common::time_get_os_boottime_us();
+  std::stringstream stream;
+  stream << "  LE AudioHalClient:"
+         << "\n    Counts (underflow)                                      : "
+         << sStats.media_read_total_underflow_count
+         << "\n    Bytes (underflow)                                       : "
+         << sStats.media_read_total_underflow_bytes
+         << "\n    Last update time ago in ms (underflow)                  : "
+         << (sStats.media_read_last_underflow_us > 0
+                 ? (unsigned long long)(now_us -
+                                        sStats.media_read_last_underflow_us) /
+                       1000
+                 : 0)
+         << std::endl;
+  dprintf(fd, "%s", stream.str().c_str());
+}
+}  // namespace le_audio
diff --git a/system/bta/le_audio/audio_set_configurations.json b/system/bta/le_audio/audio_set_configurations.json
index c3b9200..fd157c0 100644
--- a/system/bta/le_audio/audio_set_configurations.json
+++ b/system/bta/le_audio/audio_set_configurations.json
@@ -133,6 +133,26 @@
             "qos_config_name": ["QoS_Config_16_2_2"]
         },
         {
+            "name": "SingleDev_OneChanMonoSnk_32_1_Server_Preferred",
+            "codec_config_name": "SingleDev_OneChanMonoSnk_32_1",
+            "qos_config_name": ["QoS_Config_Server_Preferred"]
+        },
+        {
+            "name": "SingleDev_OneChanMonoSnk_32_1_1",
+            "codec_config_name": "SingleDev_OneChanMonoSnk_32_1",
+            "qos_config_name": ["QoS_Config_32_1_1"]
+        },
+        {
+            "name": "SingleDev_OneChanMonoSnk_32_2_Server_Preferred",
+            "codec_config_name": "SingleDev_OneChanMonoSnk_32_2",
+            "qos_config_name": ["QoS_Config_Server_Preferred"]
+        },
+        {
+            "name": "SingleDev_OneChanMonoSnk_32_2_1",
+            "codec_config_name": "SingleDev_OneChanMonoSnk_32_2",
+            "qos_config_name": ["QoS_Config_32_2_1"]
+        },
+        {
             "name": "SingleDev_OneChanMonoSnk_16_1_Server_Preferred",
             "codec_config_name": "SingleDev_OneChanMonoSnk_16_1",
             "qos_config_name": ["QoS_Config_Server_Preferred"]
@@ -148,6 +168,11 @@
             "qos_config_name": ["QoS_Config_16_1_2"]
         },
         {
+            "name": "DualDev_OneChanMonoSnk_16_2_Server_Preferred",
+            "codec_config_name": "DualDev_OneChanMonoSnk_16_2",
+            "qos_config_name": ["QoS_Config_Server_Preferred"]
+        },
+        {
             "name": "SingleDev_OneChanMonoSnk_16_2_Server_Preferred",
             "codec_config_name": "SingleDev_OneChanMonoSnk_16_2",
             "qos_config_name": ["QoS_Config_Server_Preferred"]
@@ -373,16 +398,56 @@
             "qos_config_name": ["QoS_Config_Server_Preferred"]
         },
         {
+            "name": "SingleDev_OneChanMonoSrc_48_4_Server_Preferred",
+            "codec_config_name": "SingleDev_OneChanMonoSrc_48_4",
+            "qos_config_name": ["QoS_Config_Server_Preferred"]
+        },
+        {
+            "name": "SingleDev_OneChanMonoSrc_48_3_Server_Preferred",
+            "codec_config_name": "SingleDev_OneChanMonoSrc_48_3",
+            "qos_config_name": ["QoS_Config_Server_Preferred"]
+        },
+        {
+            "name": "SingleDev_OneChanMonoSrc_48_2_Server_Preferred",
+            "codec_config_name": "SingleDev_OneChanMonoSrc_48_2",
+            "qos_config_name": ["QoS_Config_Server_Preferred"]
+        },
+        {
+            "name": "SingleDev_OneChanMonoSrc_48_1_Server_Preferred",
+            "codec_config_name": "SingleDev_OneChanMonoSrc_48_1",
+            "qos_config_name": ["QoS_Config_Server_Preferred"]
+        },
+        {
+            "name": "SingleDev_OneChanMonoSrc_32_2_Server_Preferred",
+            "codec_config_name": "SingleDev_OneChanMonoSrc_32_2",
+            "qos_config_name": ["QoS_Config_Server_Preferred"]
+        },
+        {
+            "name": "SingleDev_OneChanMonoSrc_32_1_Server_Preferred",
+            "codec_config_name": "SingleDev_OneChanMonoSrc_32_1",
+            "qos_config_name": ["QoS_Config_Server_Preferred"]
+        },
+        {
             "name": "SingleDev_OneChanMonoSrc_24_2_Server_Preferred",
             "codec_config_name": "SingleDev_OneChanMonoSrc_24_2",
             "qos_config_name": ["QoS_Config_Server_Preferred"]
         },
         {
+            "name": "SingleDev_OneChanMonoSrc_24_1_Server_Preferred",
+            "codec_config_name": "SingleDev_OneChanMonoSrc_24_1",
+            "qos_config_name": ["QoS_Config_Server_Preferred"]
+        },
+        {
             "name": "SingleDev_OneChanMonoSrc_16_2_Server_Preferred",
             "codec_config_name": "SingleDev_OneChanMonoSrc_16_2",
             "qos_config_name": ["QoS_Config_Server_Preferred"]
         },
         {
+            "name": "SingleDev_OneChanMonoSrc_16_1_Server_Preferred",
+            "codec_config_name": "SingleDev_OneChanMonoSrc_16_1",
+            "qos_config_name": ["QoS_Config_Server_Preferred"]
+        },
+        {
             "name": "SingleDev_OneChanMonoSnk_OneChanMonoSrc_16_1_2",
             "codec_config_name": "SingleDev_OneChanMonoSnk_OneChanMonoSrc_16_1",
             "qos_config_name": ["QoS_Config_16_1_2"]
@@ -943,6 +1008,16 @@
             "qos_config_name": ["QoS_Config_Server_Preferred"]
         },
         {
+            "name": "DualDev_OneChanStereoSnk_OneChanStereoSrc_48_1_Server_Preferred",
+            "codec_config_name": "DualDev_OneChanStereoSnk_OneChanStereoSrc_48_1",
+            "qos_config_name": ["QoS_Config_Server_Preferred"]
+        },
+        {
+            "name": "DualDev_OneChanStereoSnk_OneChanStereoSrc_48_2_Server_Preferred",
+            "codec_config_name": "DualDev_OneChanStereoSnk_OneChanStereoSrc_48_2",
+            "qos_config_name": ["QoS_Config_Server_Preferred"]
+        },
+        {
             "name": "VND_SingleDev_TwoChanStereoSrc_48khz_100octs_Server_Preferred_1",
             "codec_config_name": "VND_SingleDev_TwoChanStereoSrc_48khz_100octs_1",
             "qos_config_name": ["QoS_Config_Server_Preferred"]
@@ -1500,6 +1575,207 @@
             ]
         },
         {
+            "name": "SingleDev_OneChanMonoSnk_32_2",
+            "subconfigurations": [
+                {
+                    "device_cnt": 1,
+                    "ase_cnt": 1,
+                    "direction": "SINK",
+                    "configuration_strategy": "MONO_ONE_CIS_PER_DEVICE",
+                    "codec_id": {
+                        "coding_format": 6,
+                        "vendor_company_id": 0,
+                        "vendor_codec_id": 0
+                    },
+                    "codec_configuration": [
+                        {
+                            "name": "sampling_frequency",
+                            "type": 1,
+                            "compound_value": {
+                                "value": [
+                                    6
+                                ]
+                            }
+                        },
+                        {
+                            "name": "frame_duration",
+                            "type": 2,
+                            "compound_value": {
+                                "value": [
+                                    1
+                                ]
+                            }
+                        },
+                        {
+                            "name": "audio_channel_allocation",
+                            "type": 3,
+                            "compound_value": {
+                                "value": [
+                                    1,
+                                    0,
+                                    0,
+                                    0
+                                ]
+                            }
+                        },
+                        {
+                            "name": "octets_per_codec_frame",
+                            "type": 4,
+                            "compound_value": {
+                                "value": [
+                                    80,
+                                    0
+                                ]
+                            }
+                        },
+                        {
+                            "name": "codec_frame_blocks_per_sdu",
+                            "type": 5,
+                            "compound_value": {
+                                "value": [
+                                    1
+                                ]
+                            }
+                        }
+                    ]
+                }
+            ]
+        },
+        {
+            "name": "SingleDev_OneChanMonoSnk_32_1",
+            "subconfigurations": [
+                {
+                    "device_cnt": 1,
+                    "ase_cnt": 1,
+                    "direction": "SINK",
+                    "configuration_strategy": "MONO_ONE_CIS_PER_DEVICE",
+                    "codec_id": {
+                        "coding_format": 6,
+                        "vendor_company_id": 0,
+                        "vendor_codec_id": 0
+                    },
+                    "codec_configuration": [
+                        {
+                            "name": "sampling_frequency",
+                            "type": 1,
+                            "compound_value": {
+                                "value": [
+                                    6
+                                ]
+                            }
+                        },
+                        {
+                            "name": "frame_duration",
+                            "type": 2,
+                            "compound_value": {
+                                "value": [
+                                    0
+                                ]
+                            }
+                        },
+                        {
+                            "name": "audio_channel_allocation",
+                            "type": 3,
+                            "compound_value": {
+                                "value": [
+                                    1,
+                                    0,
+                                    0,
+                                    0
+                                ]
+                            }
+                        },
+                        {
+                            "name": "octets_per_codec_frame",
+                            "type": 4,
+                            "compound_value": {
+                                "value": [
+                                    60,
+                                    0
+                                ]
+                            }
+                        },
+                        {
+                            "name": "codec_frame_blocks_per_sdu",
+                            "type": 5,
+                            "compound_value": {
+                                "value": [
+                                    1
+                                ]
+                            }
+                        }
+                    ]
+                }
+            ]
+        },
+        {
+            "name": "DualDev_OneChanMonoSnk_16_2",
+            "subconfigurations": [
+                {
+                    "device_cnt": 2,
+                    "ase_cnt": 2,
+                    "direction": "SINK",
+                    "configuration_strategy": "MONO_ONE_CIS_PER_DEVICE",
+                    "codec_id": {
+                        "coding_format": 6,
+                        "vendor_company_id": 0,
+                        "vendor_codec_id": 0
+                    },
+                    "codec_configuration": [
+                        {
+                            "name": "sampling_frequency",
+                            "type": 1,
+                            "compound_value": {
+                                "value": [
+                                    3
+                                ]
+                            }
+                        },
+                        {
+                            "name": "frame_duration",
+                            "type": 2,
+                            "compound_value": {
+                                "value": [
+                                    1
+                                ]
+                            }
+                        },
+                        {
+                            "name": "audio_channel_allocation",
+                            "type": 3,
+                            "compound_value": {
+                                "value": [
+                                    1,
+                                    0,
+                                    0,
+                                    0
+                                ]
+                            }
+                        },
+                        {
+                            "name": "octets_per_codec_frame",
+                            "type": 4,
+                            "compound_value": {
+                                "value": [
+                                    40,
+                                    0
+                                ]
+                            }
+                        },
+                        {
+                            "name": "codec_frame_blocks_per_sdu",
+                            "type": 5,
+                            "compound_value": {
+                                "value": [
+                                    1
+                                ]
+                            }
+                        }
+                    ]
+                }
+            ]
+        },
+        {
             "name": "SingleDev_OneChanMonoSnk_16_2",
             "subconfigurations": [
                 {
@@ -1637,6 +1913,7 @@
             "name": "DualDev_OneChanStereoSnk_OneChanMonoSrc_16_2",
             "subconfigurations": [
                 {
+                    "target_latency": "LOW",
                     "device_cnt": 2,
                     "ase_cnt": 2,
                     "direction": "SINK",
@@ -1698,6 +1975,7 @@
                     ]
                 },
                 {
+                    "target_latency": "LOW",
                     "device_cnt": 1,
                     "ase_cnt": 1,
                     "direction": "SOURCE",
@@ -1764,6 +2042,7 @@
             "name": "DualDev_OneChanStereoSnk_OneChanStereoSrc_16_2",
             "subconfigurations": [
                 {
+                    "target_latency": "LOW",
                     "device_cnt": 2,
                     "ase_cnt": 2,
                     "direction": "SINK",
@@ -1825,6 +2104,7 @@
                     ]
                 },
                 {
+                    "target_latency": "LOW",
                     "device_cnt": 2,
                     "ase_cnt": 2,
                     "direction": "SOURCE",
@@ -1891,6 +2171,7 @@
             "name": "DualDev_OneChanStereoSnk_OneChanStereoSrc_16_1",
             "subconfigurations": [
                 {
+                    "target_latency": "LOW",
                     "device_cnt": 2,
                     "ase_cnt": 2,
                     "direction": "SINK",
@@ -1952,6 +2233,7 @@
                     ]
                 },
                 {
+                    "target_latency": "LOW",
                     "device_cnt": 2,
                     "ase_cnt": 2,
                     "direction": "SOURCE",
@@ -2018,6 +2300,7 @@
             "name": "DualDev_OneChanStereoSnk_OneChanMonoSrc_16_1",
             "subconfigurations": [
                 {
+                    "target_latency": "LOW",
                     "device_cnt": 2,
                     "ase_cnt": 2,
                     "direction": "SINK",
@@ -2079,6 +2362,7 @@
                     ]
                 },
                 {
+                    "target_latency": "LOW",
                     "device_cnt": 1,
                     "ase_cnt": 1,
                     "direction": "SOURCE",
@@ -2145,6 +2429,7 @@
             "name": "DualDev_OneChanDoubleStereoSnk_OneChanMonoSrc_16_2",
             "subconfigurations": [
                 {
+                    "target_latency": "LOW",
                     "device_cnt": 2,
                     "ase_cnt": 4,
                     "direction": "SINK",
@@ -2207,6 +2492,7 @@
                     ]
                 },
                 {
+                    "target_latency": "LOW",
                     "device_cnt": 1,
                     "ase_cnt": 1,
                     "direction": "SOURCE",
@@ -2273,6 +2559,7 @@
             "name": "DualDev_OneChanDoubleStereoSnk_OneChanMonoSrc_16_1",
             "subconfigurations": [
                 {
+                    "target_latency": "LOW",
                     "device_cnt": 2,
                     "ase_cnt": 4,
                     "direction": "SINK",
@@ -2335,6 +2622,7 @@
                     ]
                 },
                 {
+                    "target_latency": "LOW",
                     "device_cnt": 1,
                     "ase_cnt": 1,
                     "direction": "SOURCE",
@@ -2401,6 +2689,7 @@
             "name": "SingleDev_TwoChanStereoSnk_TwoChanStereoSrc_32_2",
             "subconfigurations": [
                 {
+                    "target_latency": "LOW",
                     "device_cnt": 1,
                     "ase_cnt": 1,
                     "direction": "SINK",
@@ -2463,6 +2752,7 @@
                     ]
                 },
                 {
+                    "target_latency": "LOW",
                     "device_cnt": 1,
                     "ase_cnt": 1,
                     "direction": "SOURCE",
@@ -2530,6 +2820,7 @@
             "name": "SingleDev_TwoChanStereoSnk_TwoChanStereoSrc_16_2",
             "subconfigurations": [
                 {
+                    "target_latency": "LOW",
                     "device_cnt": 1,
                     "ase_cnt": 1,
                     "direction": "SINK",
@@ -2592,6 +2883,7 @@
                     ]
                 },
                 {
+                    "target_latency": "LOW",
                     "device_cnt": 1,
                     "ase_cnt": 1,
                     "direction": "SOURCE",
@@ -2659,6 +2951,7 @@
             "name": "SingleDev_TwoChanStereoSnk_TwoChanStereoSrc_16_1",
             "subconfigurations": [
                 {
+                    "target_latency": "LOW",
                     "device_cnt": 1,
                     "ase_cnt": 1,
                     "direction": "SINK",
@@ -2721,6 +3014,7 @@
                     ]
                 },
                 {
+                    "target_latency": "LOW",
                     "device_cnt": 1,
                     "ase_cnt": 1,
                     "direction": "SOURCE",
@@ -2788,6 +3082,7 @@
             "name": "SingleDev_TwoChanStereoSnk_OneChanMonoSrc_16_2",
             "subconfigurations": [
                 {
+                    "target_latency": "LOW",
                     "device_cnt": 1,
                     "ase_cnt": 1,
                     "direction": "SINK",
@@ -2850,6 +3145,7 @@
                     ]
                 },
                 {
+                    "target_latency": "LOW",
                     "device_cnt": 1,
                     "ase_cnt": 1,
                     "direction": "SOURCE",
@@ -2916,6 +3212,7 @@
             "name": "SingleDev_TwoChanStereoSnk_OneChanMonoSrc_16_1",
             "subconfigurations": [
                 {
+                    "target_latency": "LOW",
                     "device_cnt": 1,
                     "ase_cnt": 1,
                     "direction": "SINK",
@@ -2978,6 +3275,7 @@
                     ]
                 },
                 {
+                    "target_latency": "LOW",
                     "device_cnt": 1,
                     "ase_cnt": 1,
                     "direction": "SOURCE",
@@ -3044,6 +3342,7 @@
             "name": "SingleDev_OneChanStereoSnk_OneChanMonoSrc_16_2",
             "subconfigurations": [
                 {
+                    "target_latency": "LOW",
                     "device_cnt": 1,
                     "ase_cnt": 2,
                     "direction": "SINK",
@@ -3106,6 +3405,7 @@
                     ]
                 },
                 {
+                    "target_latency": "LOW",
                     "device_cnt": 1,
                     "ase_cnt": 1,
                     "direction": "SOURCE",
@@ -3172,6 +3472,7 @@
             "name": "SingleDev_OneChanStereoSnk_OneChanMonoSrc_16_1",
             "subconfigurations": [
                 {
+                    "target_latency": "LOW",
                     "device_cnt": 1,
                     "ase_cnt": 2,
                     "direction": "SINK",
@@ -3234,6 +3535,7 @@
                     ]
                 },
                 {
+                    "target_latency": "LOW",
                     "device_cnt": 1,
                     "ase_cnt": 1,
                     "direction": "SOURCE",
@@ -3300,6 +3602,7 @@
             "name": "SingleDev_OneChanMonoSnk_OneChanMonoSrc_16_2",
             "subconfigurations": [
                 {
+                    "target_latency": "LOW",
                     "device_cnt": 1,
                     "ase_cnt": 1,
                     "direction": "SINK",
@@ -3361,6 +3664,7 @@
                     ]
                 },
                 {
+                    "target_latency": "LOW",
                     "device_cnt": 1,
                     "ase_cnt": 1,
                     "direction": "SOURCE",
@@ -3427,6 +3731,7 @@
             "name": "SingleDev_OneChanMonoSnk_OneChanMonoSrc_16_1",
             "subconfigurations": [
                 {
+                    "target_latency": "LOW",
                     "device_cnt": 1,
                     "ase_cnt": 1,
                     "direction": "SINK",
@@ -3488,6 +3793,7 @@
                     ]
                 },
                 {
+                    "target_latency": "LOW",
                     "device_cnt": 1,
                     "ase_cnt": 1,
                     "direction": "SOURCE",
@@ -3617,6 +3923,534 @@
             ]
         },
         {
+            "name": "SingleDev_OneChanMonoSrc_48_4",
+            "subconfigurations": [
+                {
+                    "device_cnt": 1,
+                    "ase_cnt": 1,
+                    "direction": "SOURCE",
+                    "codec_id": {
+                        "coding_format": 6,
+                        "vendor_company_id": 0,
+                        "vendor_codec_id": 0
+                    },
+                    "codec_configuration": [
+                        {
+                            "name": "sampling_frequency",
+                            "type": 1,
+                            "compound_value": {
+                                "value": [
+                                    8
+                                ]
+                            }
+                        },
+                        {
+                            "name": "frame_duration",
+                            "type": 2,
+                            "compound_value": {
+                                "value": [
+                                    1
+                                ]
+                            }
+                        },
+                        {
+                            "name": "audio_channel_allocation",
+                            "type": 3,
+                            "compound_value": {
+                                "value": [
+                                    1,
+                                    0,
+                                    0,
+                                    0
+                                ]
+                            }
+                        },
+                        {
+                            "name": "octets_per_codec_frame",
+                            "type": 4,
+                            "compound_value": {
+                                "value": [
+                                    120,
+                                    0
+                                ]
+                            }
+                        },
+                        {
+                            "name": "codec_frame_blocks_per_sdu",
+                            "type": 5,
+                            "compound_value": {
+                                "value": [
+                                    1
+                                ]
+                            }
+                        }
+                    ]
+                }
+            ]
+        },
+        {
+            "name": "SingleDev_OneChanMonoSrc_48_3",
+            "subconfigurations": [
+                {
+                    "device_cnt": 1,
+                    "ase_cnt": 1,
+                    "direction": "SOURCE",
+                    "codec_id": {
+                        "coding_format": 6,
+                        "vendor_company_id": 0,
+                        "vendor_codec_id": 0
+                    },
+                    "codec_configuration": [
+                        {
+                            "name": "sampling_frequency",
+                            "type": 1,
+                            "compound_value": {
+                                "value": [
+                                    8
+                                ]
+                            }
+                        },
+                        {
+                            "name": "frame_duration",
+                            "type": 2,
+                            "compound_value": {
+                                "value": [
+                                    0
+                                ]
+                            }
+                        },
+                        {
+                            "name": "audio_channel_allocation",
+                            "type": 3,
+                            "compound_value": {
+                                "value": [
+                                    1,
+                                    0,
+                                    0,
+                                    0
+                                ]
+                            }
+                        },
+                        {
+                            "name": "octets_per_codec_frame",
+                            "type": 4,
+                            "compound_value": {
+                                "value": [
+                                    90,
+                                    0
+                                ]
+                            }
+                        },
+                        {
+                            "name": "codec_frame_blocks_per_sdu",
+                            "type": 5,
+                            "compound_value": {
+                                "value": [
+                                    1
+                                ]
+                            }
+                        }
+                    ]
+                }
+            ]
+        },
+        {
+            "name": "SingleDev_OneChanMonoSrc_48_2",
+            "subconfigurations": [
+                {
+                    "device_cnt": 1,
+                    "ase_cnt": 1,
+                    "direction": "SOURCE",
+                    "codec_id": {
+                        "coding_format": 6,
+                        "vendor_company_id": 0,
+                        "vendor_codec_id": 0
+                    },
+                    "codec_configuration": [
+                        {
+                            "name": "sampling_frequency",
+                            "type": 1,
+                            "compound_value": {
+                                "value": [
+                                    8
+                                ]
+                            }
+                        },
+                        {
+                            "name": "frame_duration",
+                            "type": 2,
+                            "compound_value": {
+                                "value": [
+                                    1
+                                ]
+                            }
+                        },
+                        {
+                            "name": "audio_channel_allocation",
+                            "type": 3,
+                            "compound_value": {
+                                "value": [
+                                    1,
+                                    0,
+                                    0,
+                                    0
+                                ]
+                            }
+                        },
+                        {
+                            "name": "octets_per_codec_frame",
+                            "type": 4,
+                            "compound_value": {
+                                "value": [
+                                    100,
+                                    0
+                                ]
+                            }
+                        },
+                        {
+                            "name": "codec_frame_blocks_per_sdu",
+                            "type": 5,
+                            "compound_value": {
+                                "value": [
+                                    1
+                                ]
+                            }
+                        }
+                    ]
+                }
+            ]
+        },
+        {
+            "name": "SingleDev_OneChanMonoSrc_48_1",
+            "subconfigurations": [
+                {
+                    "device_cnt": 1,
+                    "ase_cnt": 1,
+                    "direction": "SOURCE",
+                    "codec_id": {
+                        "coding_format": 6,
+                        "vendor_company_id": 0,
+                        "vendor_codec_id": 0
+                    },
+                    "codec_configuration": [
+                        {
+                            "name": "sampling_frequency",
+                            "type": 1,
+                            "compound_value": {
+                                "value": [
+                                    8
+                                ]
+                            }
+                        },
+                        {
+                            "name": "frame_duration",
+                            "type": 2,
+                            "compound_value": {
+                                "value": [
+                                    0
+                                ]
+                            }
+                        },
+                        {
+                            "name": "audio_channel_allocation",
+                            "type": 3,
+                            "compound_value": {
+                                "value": [
+                                    1,
+                                    0,
+                                    0,
+                                    0
+                                ]
+                            }
+                        },
+                        {
+                            "name": "octets_per_codec_frame",
+                            "type": 4,
+                            "compound_value": {
+                                "value": [
+                                    75,
+                                    0
+                                ]
+                            }
+                        },
+                        {
+                            "name": "codec_frame_blocks_per_sdu",
+                            "type": 5,
+                            "compound_value": {
+                                "value": [
+                                    1
+                                ]
+                            }
+                        }
+                    ]
+                }
+            ]
+        },
+        {
+            "name": "SingleDev_OneChanMonoSrc_32_2",
+            "subconfigurations": [
+                {
+                    "device_cnt": 1,
+                    "ase_cnt": 1,
+                    "direction": "SOURCE",
+                    "codec_id": {
+                        "coding_format": 6,
+                        "vendor_company_id": 0,
+                        "vendor_codec_id": 0
+                    },
+                    "codec_configuration": [
+                        {
+                            "name": "sampling_frequency",
+                            "type": 1,
+                            "compound_value": {
+                                "value": [
+                                    6
+                                ]
+                            }
+                        },
+                        {
+                            "name": "frame_duration",
+                            "type": 2,
+                            "compound_value": {
+                                "value": [
+                                    1
+                                ]
+                            }
+                        },
+                        {
+                            "name": "audio_channel_allocation",
+                            "type": 3,
+                            "compound_value": {
+                                "value": [
+                                    1,
+                                    0,
+                                    0,
+                                    0
+                                ]
+                            }
+                        },
+                        {
+                            "name": "octets_per_codec_frame",
+                            "type": 4,
+                            "compound_value": {
+                                "value": [
+                                    80,
+                                    0
+                                ]
+                            }
+                        },
+                        {
+                            "name": "codec_frame_blocks_per_sdu",
+                            "type": 5,
+                            "compound_value": {
+                                "value": [
+                                    1
+                                ]
+                            }
+                        }
+                    ]
+                }
+            ]
+        },
+        {
+            "name": "SingleDev_OneChanMonoSrc_32_1",
+            "subconfigurations": [
+                {
+                    "device_cnt": 1,
+                    "ase_cnt": 1,
+                    "direction": "SOURCE",
+                    "codec_id": {
+                        "coding_format": 6,
+                        "vendor_company_id": 0,
+                        "vendor_codec_id": 0
+                    },
+                    "codec_configuration": [
+                        {
+                            "name": "sampling_frequency",
+                            "type": 1,
+                            "compound_value": {
+                                "value": [
+                                    6
+                                ]
+                            }
+                        },
+                        {
+                            "name": "frame_duration",
+                            "type": 2,
+                            "compound_value": {
+                                "value": [
+                                    0
+                                ]
+                            }
+                        },
+                        {
+                            "name": "audio_channel_allocation",
+                            "type": 3,
+                            "compound_value": {
+                                "value": [
+                                    1,
+                                    0,
+                                    0,
+                                    0
+                                ]
+                            }
+                        },
+                        {
+                            "name": "octets_per_codec_frame",
+                            "type": 4,
+                            "compound_value": {
+                                "value": [
+                                    60,
+                                    0
+                                ]
+                            }
+                        },
+                        {
+                            "name": "codec_frame_blocks_per_sdu",
+                            "type": 5,
+                            "compound_value": {
+                                "value": [
+                                    1
+                                ]
+                            }
+                        }
+                    ]
+                }
+            ]
+        },
+        {
+            "name": "SingleDev_OneChanMonoSrc_24_2",
+            "subconfigurations": [
+                {
+                    "device_cnt": 1,
+                    "ase_cnt": 1,
+                    "direction": "SOURCE",
+                    "codec_id": {
+                        "coding_format": 6,
+                        "vendor_company_id": 0,
+                        "vendor_codec_id": 0
+                    },
+                    "codec_configuration": [
+                        {
+                            "name": "sampling_frequency",
+                            "type": 1,
+                            "compound_value": {
+                                "value": [
+                                    5
+                                ]
+                            }
+                        },
+                        {
+                            "name": "frame_duration",
+                            "type": 2,
+                            "compound_value": {
+                                "value": [
+                                    1
+                                ]
+                            }
+                        },
+                        {
+                            "name": "audio_channel_allocation",
+                            "type": 3,
+                            "compound_value": {
+                                "value": [
+                                    1,
+                                    0,
+                                    0,
+                                    0
+                                ]
+                            }
+                        },
+                        {
+                            "name": "octets_per_codec_frame",
+                            "type": 4,
+                            "compound_value": {
+                                "value": [
+                                    60,
+                                    0
+                                ]
+                            }
+                        },
+                        {
+                            "name": "codec_frame_blocks_per_sdu",
+                            "type": 5,
+                            "compound_value": {
+                                "value": [
+                                    1
+                                ]
+                            }
+                        }
+                    ]
+                }
+            ]
+        },
+        {
+            "name": "SingleDev_OneChanMonoSrc_24_1",
+            "subconfigurations": [
+                {
+                    "device_cnt": 1,
+                    "ase_cnt": 1,
+                    "direction": "SOURCE",
+                    "codec_id": {
+                        "coding_format": 6,
+                        "vendor_company_id": 0,
+                        "vendor_codec_id": 0
+                    },
+                    "codec_configuration": [
+                        {
+                            "name": "sampling_frequency",
+                            "type": 1,
+                            "compound_value": {
+                                "value": [
+                                    5
+                                ]
+                            }
+                        },
+                        {
+                            "name": "frame_duration",
+                            "type": 2,
+                            "compound_value": {
+                                "value": [
+                                    0
+                                ]
+                            }
+                        },
+                        {
+                            "name": "audio_channel_allocation",
+                            "type": 3,
+                            "compound_value": {
+                                "value": [
+                                    1,
+                                    0,
+                                    0,
+                                    0
+                                ]
+                            }
+                        },
+                        {
+                            "name": "octets_per_codec_frame",
+                            "type": 4,
+                            "compound_value": {
+                                "value": [
+                                    45,
+                                    0
+                                ]
+                            }
+                        },
+                        {
+                            "name": "codec_frame_blocks_per_sdu",
+                            "type": 5,
+                            "compound_value": {
+                                "value": [
+                                    1
+                                ]
+                            }
+                        }
+                    ]
+                }
+            ]
+        },
+        {
             "name": "SingleDev_OneChanMonoSrc_16_2",
             "subconfigurations": [
                 {
@@ -3683,9 +4517,76 @@
             ]
         },
         {
+            "name": "SingleDev_OneChanMonoSrc_16_1",
+            "subconfigurations": [
+                {
+                    "device_cnt": 1,
+                    "ase_cnt": 1,
+                    "direction": "SOURCE",
+                    "codec_id": {
+                        "coding_format": 6,
+                        "vendor_company_id": 0,
+                        "vendor_codec_id": 0
+                    },
+                    "codec_configuration": [
+                        {
+                            "name": "sampling_frequency",
+                            "type": 1,
+                            "compound_value": {
+                                "value": [
+                                    3
+                                ]
+                            }
+                        },
+                        {
+                            "name": "frame_duration",
+                            "type": 2,
+                            "compound_value": {
+                                "value": [
+                                    0
+                                ]
+                            }
+                        },
+                        {
+                            "name": "audio_channel_allocation",
+                            "type": 3,
+                            "compound_value": {
+                                "value": [
+                                    1,
+                                    0,
+                                    0,
+                                    0
+                                ]
+                            }
+                        },
+                        {
+                            "name": "octets_per_codec_frame",
+                            "type": 4,
+                            "compound_value": {
+                                "value": [
+                                    30,
+                                    0
+                                ]
+                            }
+                        },
+                        {
+                            "name": "codec_frame_blocks_per_sdu",
+                            "type": 5,
+                            "compound_value": {
+                                "value": [
+                                    1
+                                ]
+                            }
+                        }
+                    ]
+                }
+            ]
+        },
+        {
             "name": "DualDev_OneChanStereoSnk_48_4",
             "subconfigurations": [
                 {
+                    "target_latency": "HIGH_RELIABILITY",
                     "device_cnt": 2,
                     "ase_cnt": 2,
                     "direction": "SINK",
@@ -3753,6 +4654,7 @@
             "name": "DualDev_OneChanStereoSnk_48_3",
             "subconfigurations": [
                 {
+                    "target_latency": "HIGH_RELIABILITY",
                     "device_cnt": 2,
                     "ase_cnt": 2,
                     "direction": "SINK",
@@ -3820,6 +4722,7 @@
             "name": "DualDev_OneChanStereoSnk_48_2",
             "subconfigurations": [
                 {
+                    "target_latency": "HIGH_RELIABILITY",
                     "device_cnt": 2,
                     "ase_cnt": 2,
                     "direction": "SINK",
@@ -3887,6 +4790,7 @@
             "name": "DualDev_OneChanStereoSnk_48_1",
             "subconfigurations": [
                 {
+                    "target_latency": "HIGH_RELIABILITY",
                     "device_cnt": 2,
                     "ase_cnt": 2,
                     "direction": "SINK",
@@ -3954,6 +4858,7 @@
             "name": "SingleDev_OneChanStereoSnk_48_4",
             "subconfigurations": [
                 {
+                    "target_latency": "HIGH_RELIABILITY",
                     "device_cnt": 1,
                     "ase_cnt": 2,
                     "direction": "SINK",
@@ -4021,6 +4926,7 @@
             "name": "SingleDev_OneChanStereoSnk_48_3",
             "subconfigurations": [
                 {
+                    "target_latency": "HIGH_RELIABILITY",
                     "device_cnt": 1,
                     "ase_cnt": 2,
                     "direction": "SINK",
@@ -4088,6 +4994,7 @@
             "name": "SingleDev_OneChanStereoSnk_48_2",
             "subconfigurations": [
                 {
+                    "target_latency": "HIGH_RELIABILITY",
                     "device_cnt": 1,
                     "ase_cnt": 2,
                     "direction": "SINK",
@@ -4155,6 +5062,7 @@
             "name": "SingleDev_OneChanStereoSnk_48_1",
             "subconfigurations": [
                 {
+                    "target_latency": "HIGH_RELIABILITY",
                     "device_cnt": 1,
                     "ase_cnt": 2,
                     "direction": "SINK",
@@ -4222,6 +5130,7 @@
             "name": "SingleDev_TwoChanStereoSnk_48_4",
             "subconfigurations": [
                 {
+                    "target_latency": "HIGH_RELIABILITY",
                     "device_cnt": 1,
                     "ase_cnt": 1,
                     "direction": "SINK",
@@ -4289,6 +5198,7 @@
             "name": "SingleDev_TwoChanStereoSnk_48_3",
             "subconfigurations": [
                 {
+                    "target_latency": "HIGH_RELIABILITY",
                     "device_cnt": 1,
                     "ase_cnt": 1,
                     "direction": "SINK",
@@ -4356,6 +5266,7 @@
             "name": "SingleDev_TwoChanStereoSnk_48_2",
             "subconfigurations": [
                 {
+                    "target_latency": "HIGH_RELIABILITY",
                     "device_cnt": 1,
                     "ase_cnt": 1,
                     "direction": "SINK",
@@ -4423,6 +5334,7 @@
             "name": "SingleDev_TwoChanStereoSnk_48_1",
             "subconfigurations": [
                 {
+                    "target_latency": "HIGH_RELIABILITY",
                     "device_cnt": 1,
                     "ase_cnt": 1,
                     "direction": "SINK",
@@ -4490,6 +5402,7 @@
             "name": "SingleDev_OneChanMonoSnk_48_4",
             "subconfigurations": [
                 {
+                    "target_latency": "HIGH_RELIABILITY",
                     "device_cnt": 1,
                     "ase_cnt": 1,
                     "direction": "SINK",
@@ -4557,6 +5470,7 @@
             "name": "SingleDev_OneChanMonoSnk_48_3",
             "subconfigurations": [
                 {
+                    "target_latency": "HIGH_RELIABILITY",
                     "device_cnt": 1,
                     "ase_cnt": 1,
                     "direction": "SINK",
@@ -4624,6 +5538,7 @@
             "name": "SingleDev_OneChanMonoSnk_48_2",
             "subconfigurations": [
                 {
+                    "target_latency": "HIGH_RELIABILITY",
                     "device_cnt": 1,
                     "ase_cnt": 1,
                     "direction": "SINK",
@@ -4691,6 +5606,7 @@
             "name": "SingleDev_OneChanMonoSnk_48_1",
             "subconfigurations": [
                 {
+                    "target_latency": "HIGH_RELIABILITY",
                     "device_cnt": 1,
                     "ase_cnt": 1,
                     "direction": "SINK",
@@ -4758,6 +5674,7 @@
             "name": "VND_SingleDev_TwoChanStereoSnk_48khz_100octs_1",
             "subconfigurations": [
                 {
+                    "target_latency": "HIGH_RELIABILITY",
                     "device_cnt": 1,
                     "ase_cnt": 1,
                     "direction": "SINK",
@@ -4825,6 +5742,7 @@
             "name": "VND_DualDev_OneChanStereoSnk_48khz_100octs_1",
             "subconfigurations": [
                 {
+                    "target_latency": "HIGH_RELIABILITY",
                     "device_cnt": 2,
                     "ase_cnt": 2,
                     "direction": "SINK",
@@ -4892,6 +5810,7 @@
             "name": "VND_SingleDev_OneChanStereoSnk_48khz_100octs_1",
             "subconfigurations": [
                 {
+                    "target_latency": "HIGH_RELIABILITY",
                     "device_cnt": 1,
                     "ase_cnt": 2,
                     "direction": "SINK",
@@ -4959,6 +5878,7 @@
             "name": "VND_SingleDev_TwoChanStereoSnk_48khz_75octs_1",
             "subconfigurations": [
                 {
+                    "target_latency": "HIGH_RELIABILITY",
                     "device_cnt": 1,
                     "ase_cnt": 1,
                     "direction": "SINK",
@@ -7705,6 +8625,268 @@
             ]
         },
         {
+            "name": "DualDev_OneChanStereoSnk_OneChanStereoSrc_48_1",
+            "subconfigurations": [
+                {
+                    "target_latency": "BALANCED_RELIABILITY",
+                    "device_cnt": 2,
+                    "ase_cnt": 2,
+                    "direction": "SOURCE",
+                    "configuration_strategy": "STEREO_ONE_CIS_PER_DEVICE",
+                    "codec_id": {
+                        "coding_format": 6,
+                        "vendor_company_id": 0,
+                        "vendor_codec_id": 0
+                    },
+                    "codec_configuration": [
+                        {
+                            "name": "sampling_frequency",
+                            "type": 1,
+                            "compound_value": {
+                                "value": [
+                                    8
+                                ]
+                            }
+                        },
+                        {
+                            "name": "frame_duration",
+                            "type": 2,
+                            "compound_value": {
+                                "value": [
+                                    0
+                                ]
+                            }
+                        },
+                        {
+                            "name": "audio_channel_allocation",
+                            "type": 3,
+                            "compound_value": {
+                                "value": [
+                                    3,
+                                    0,
+                                    0,
+                                    0
+                                ]
+                            }
+                        },
+                        {
+                            "name": "octets_per_codec_frame",
+                            "type": 4,
+                            "compound_value": {
+                                "value": [
+                                    75,
+                                    0
+                                ]
+                            }
+                        },
+                        {
+                            "name": "codec_frame_blocks_per_sdu",
+                            "type": 5,
+                            "compound_value": {
+                                "value": [
+                                    1
+                                ]
+                            }
+                        }
+                    ]
+                },
+                {
+                    "target_latency": "BALANCED_RELIABILITY",
+                    "device_cnt": 2,
+                    "ase_cnt": 2,
+                    "direction": "SINK",
+                    "configuration_strategy": "STEREO_ONE_CIS_PER_DEVICE",
+                    "codec_id": {
+                        "coding_format": 6,
+                        "vendor_company_id": 0,
+                        "vendor_codec_id": 0
+                    },
+                    "codec_configuration": [
+                        {
+                            "name": "sampling_frequency",
+                            "type": 1,
+                            "compound_value": {
+                                "value": [
+                                    8
+                                ]
+                            }
+                        },
+                        {
+                            "name": "frame_duration",
+                            "type": 2,
+                            "compound_value": {
+                                "value": [
+                                    0
+                                ]
+                            }
+                        },
+                        {
+                            "name": "audio_channel_allocation",
+                            "type": 3,
+                            "compound_value": {
+                                "value": [
+                                    3,
+                                    0,
+                                    0,
+                                    0
+                                ]
+                            }
+                        },
+                        {
+                            "name": "octets_per_codec_frame",
+                            "type": 4,
+                            "compound_value": {
+                                "value": [
+                                    75,
+                                    0
+                                ]
+                            }
+                        },
+                        {
+                            "name": "codec_frame_blocks_per_sdu",
+                            "type": 5,
+                            "compound_value": {
+                                "value": [
+                                    1
+                                ]
+                            }
+                        }
+                    ]
+                }
+            ]
+        },
+        {
+            "name": "DualDev_OneChanStereoSnk_OneChanStereoSrc_48_2",
+            "subconfigurations": [
+                {
+                    "target_latency": "BALANCED_RELIABILITY",
+                    "device_cnt": 2,
+                    "ase_cnt": 2,
+                    "direction": "SOURCE",
+                    "configuration_strategy": "STEREO_ONE_CIS_PER_DEVICE",
+                    "codec_id": {
+                        "coding_format": 6,
+                        "vendor_company_id": 0,
+                        "vendor_codec_id": 0
+                    },
+                    "codec_configuration": [
+                        {
+                            "name": "sampling_frequency",
+                            "type": 1,
+                            "compound_value": {
+                                "value": [
+                                    8
+                                ]
+                            }
+                        },
+                        {
+                            "name": "frame_duration",
+                            "type": 2,
+                            "compound_value": {
+                                "value": [
+                                    1
+                                ]
+                            }
+                        },
+                        {
+                            "name": "audio_channel_allocation",
+                            "type": 3,
+                            "compound_value": {
+                                "value": [
+                                    3,
+                                    0,
+                                    0,
+                                    0
+                                ]
+                            }
+                        },
+                        {
+                            "name": "octets_per_codec_frame",
+                            "type": 4,
+                            "compound_value": {
+                                "value": [
+                                    100,
+                                    0
+                                ]
+                            }
+                        },
+                        {
+                            "name": "codec_frame_blocks_per_sdu",
+                            "type": 5,
+                            "compound_value": {
+                                "value": [
+                                    1
+                                ]
+                            }
+                        }
+                    ]
+                },
+                {
+                    "target_latency": "BALANCED_RELIABILITY",
+                    "device_cnt": 2,
+                    "ase_cnt": 2,
+                    "direction": "SINK",
+                    "configuration_strategy": "STEREO_ONE_CIS_PER_DEVICE",
+                    "codec_id": {
+                        "coding_format": 6,
+                        "vendor_company_id": 0,
+                        "vendor_codec_id": 0
+                    },
+                    "codec_configuration": [
+                        {
+                            "name": "sampling_frequency",
+                            "type": 1,
+                            "compound_value": {
+                                "value": [
+                                    8
+                                ]
+                            }
+                        },
+                        {
+                            "name": "frame_duration",
+                            "type": 2,
+                            "compound_value": {
+                                "value": [
+                                    1
+                                ]
+                            }
+                        },
+                        {
+                            "name": "audio_channel_allocation",
+                            "type": 3,
+                            "compound_value": {
+                                "value": [
+                                    3,
+                                    0,
+                                    0,
+                                    0
+                                ]
+                            }
+                        },
+                        {
+                            "name": "octets_per_codec_frame",
+                            "type": 4,
+                            "compound_value": {
+                                "value": [
+                                    100,
+                                    0
+                                ]
+                            }
+                        },
+                        {
+                            "name": "codec_frame_blocks_per_sdu",
+                            "type": 5,
+                            "compound_value": {
+                                "value": [
+                                    1
+                                ]
+                            }
+                        }
+                    ]
+                }
+            ]
+        },
+        {
             "name": "VND_SingleDev_TwoChanStereoSrc_48khz_100octs_1",
             "subconfigurations": [
                 {
@@ -7775,6 +8957,7 @@
             "name": "VND_SingleDev_TwoChanStereoSnk_OneChanStereoSrc_32khz_60octs_1",
             "subconfigurations": [
                 {
+                    "target_latency": "LOW",
                     "device_cnt": 1,
                     "ase_cnt": 1,
                     "direction": "SINK",
@@ -7837,6 +9020,7 @@
                     ]
                 },
                 {
+                    "target_latency": "LOW",
                     "device_cnt": 1,
                     "ase_cnt": 1,
                     "direction": "SOURCE",
@@ -8300,6 +9484,7 @@
             "name": "DualDev_OneChanStereoSnk_OneChanStereoSrc_32_2",
             "subconfigurations": [
                 {
+                    "target_latency": "LOW",
                     "device_cnt": 2,
                     "ase_cnt": 2,
                     "direction": "SINK",
@@ -8361,6 +9546,7 @@
                     ]
                 },
                 {
+                    "target_latency": "LOW",
                     "device_cnt": 2,
                     "ase_cnt": 2,
                     "direction": "SOURCE",
@@ -8427,6 +9613,7 @@
             "name": "DualDev_OneChanStereoSnk_OneChanMonoSrc_32_2",
             "subconfigurations": [
                 {
+                    "target_latency": "LOW",
                     "device_cnt": 2,
                     "ase_cnt": 2,
                     "direction": "SINK",
@@ -8488,6 +9675,7 @@
                     ]
                 },
                 {
+                    "target_latency": "LOW",
                     "device_cnt": 1,
                     "ase_cnt": 1,
                     "direction": "SOURCE",
@@ -8554,6 +9742,7 @@
             "name": "DualDev_OneChanDoubleStereoSnk_OneChanMonoSrc_32_2",
             "subconfigurations": [
                 {
+                    "target_latency": "LOW",
                     "device_cnt": 2,
                     "ase_cnt": 4,
                     "direction": "SINK",
@@ -8616,6 +9805,7 @@
                     ]
                 },
                 {
+                    "target_latency": "LOW",
                     "device_cnt": 1,
                     "ase_cnt": 1,
                     "direction": "SOURCE",
@@ -8682,6 +9872,7 @@
             "name": "SingleDev_TwoChanStereoSnk_OneChanMonoSrc_32_2",
             "subconfigurations": [
                 {
+                    "target_latency": "LOW",
                     "device_cnt": 1,
                     "ase_cnt": 1,
                     "direction": "SINK",
@@ -8744,6 +9935,7 @@
                     ]
                 },
                 {
+                    "target_latency": "LOW",
                     "device_cnt": 1,
                     "ase_cnt": 1,
                     "direction": "SOURCE",
@@ -8810,6 +10002,7 @@
             "name": "SingleDev_OneChanStereoSnk_OneChanMonoSrc_32_2",
             "subconfigurations": [
                 {
+                    "target_latency": "LOW",
                     "device_cnt": 1,
                     "ase_cnt": 2,
                     "direction": "SINK",
@@ -8872,6 +10065,7 @@
                     ]
                 },
                 {
+                    "target_latency": "LOW",
                     "device_cnt": 1,
                     "ase_cnt": 1,
                     "direction": "SOURCE",
@@ -8938,6 +10132,7 @@
             "name": "SingleDev_OneChanMonoSnk_OneChanMonoSrc_32_2",
             "subconfigurations": [
                 {
+                    "target_latency": "LOW",
                     "device_cnt": 1,
                     "ase_cnt": 1,
                     "direction": "SINK",
@@ -8999,6 +10194,7 @@
                     ]
                 },
                 {
+                    "target_latency": "LOW",
                     "device_cnt": 1,
                     "ase_cnt": 1,
                     "direction": "SOURCE",
@@ -9084,16 +10280,46 @@
             "max_transport_latency": 95
         },
         {
+            "name": "QoS_Config_24_1_1",
+            "retransmission_number": 2,
+            "max_transport_latency": 8
+        },
+        {
+            "name": "QoS_Config_24_1_2",
+            "retransmission_number": 13,
+            "max_transport_latency": 75
+        },
+        {
+            "name": "QoS_Config_24_2_1",
+            "retransmission_number": 2,
+            "max_transport_latency": 10
+        },
+        {
             "name": "QoS_Config_24_2_2",
             "retransmission_number": 13,
             "max_transport_latency": 95
         },
         {
+            "name": "QoS_Config_32_1_1",
+            "retransmission_number": 2,
+            "max_transport_latency": 8
+        },
+        {
+            "name": "QoS_Config_32_1_2",
+            "retransmission_number": 13,
+            "max_transport_latency": 75
+        },
+        {
             "name": "QoS_Config_32_2_1",
             "retransmission_number": 2,
             "max_transport_latency": 10
         },
         {
+            "name": "QoS_Config_32_2_2",
+            "retransmission_number": 13,
+            "max_transport_latency": 95
+        },
+        {
             "name": "QoS_Config_48_1_2",
             "retransmission_number": 13,
             "max_transport_latency": 75
diff --git a/system/bta/le_audio/audio_set_scenarios.json b/system/bta/le_audio/audio_set_scenarios.json
index 4013e7e..b0381cf 100644
--- a/system/bta/le_audio/audio_set_scenarios.json
+++ b/system/bta/le_audio/audio_set_scenarios.json
@@ -6,41 +6,6 @@
     ],
     "scenarios": [
         {
-            "name": "Ringtone",
-            "configurations": [
-                "DualDev_OneChanStereoSnk_OneChanStereoSrc_32_2_Server_Preferred",
-                "DualDev_OneChanStereoSnk_OneChanStereoSrc_32_2_1",
-                "DualDev_OneChanStereoSnk_OneChanMonoSrc_32_2_Server_Preferred",
-                "DualDev_OneChanStereoSnk_OneChanMonoSrc_32_2_1",
-                "DualDev_OneChanDoubleStereoSnk_OneChanMonoSrc_32_2_Server_Preferred",
-                "DualDev_OneChanDoubleStereoSnk_OneChanMonoSrc_32_2_1",
-                "SingleDev_TwoChanStereoSnk_TwoChanStereoSrc_32_2_Server_Preferred",
-                "SingleDev_TwoChanStereoSnk_TwoChanStereoSrc_32_2_1",
-                "SingleDev_TwoChanStereoSnk_OneChanMonoSrc_32_2_Server_Preferred",
-                "SingleDev_TwoChanStereoSnk_OneChanMonoSrc_32_2_1",
-                "SingleDev_OneChanStereoSnk_OneChanMonoSrc_32_2_Server_Preferred",
-                "SingleDev_OneChanStereoSnk_OneChanMonoSrc_32_2_1",
-                "SingleDev_OneChanMonoSnk_OneChanMonoSrc_32_2_Server_Preferred",
-                "SingleDev_OneChanMonoSnk_OneChanMonoSrc_32_2_1",
-                "DualDev_OneChanStereoSnk_16_2_Server_Preferred",
-                "DualDev_OneChanStereoSnk_16_2_1",
-                "DualDev_OneChanStereoSnk_16_1_Server_Preferred",
-                "DualDev_OneChanStereoSnk_16_1_1",
-                "SingleDev_OneChanStereoSnk_16_2_Server_Preferred",
-                "SingleDev_OneChanStereoSnk_16_2_1",
-                "SingleDev_OneChanStereoSnk_16_1_Server_Preferred",
-                "SingleDev_OneChanStereoSnk_16_1_1",
-                "SingleDev_TwoChanStereoSnk_16_2_Server_Preferred",
-                "SingleDev_TwoChanStereoSnk_16_2_1",
-                "SingleDev_TwoChanStereoSnk_16_1_Server_Preferred",
-                "SingleDev_TwoChanStereoSnk_16_1_1",
-                "SingleDev_OneChanMonoSnk_16_2_Server_Preferred",
-                "SingleDev_OneChanMonoSnk_16_2_1",
-                "SingleDev_OneChanMonoSnk_16_1_Server_Preferred",
-                "SingleDev_OneChanMonoSnk_16_1_1"
-            ]
-        },
-        {
             "name": "Conversational",
             "configurations": [
                 "DualDev_OneChanStereoSnk_OneChanStereoSrc_32_2_Server_Preferred",
@@ -91,10 +56,22 @@
                 "SingleDev_OneChanMonoSnk_OneChanMonoSrc_16_1_1",
                 "DualDev_OneChanMonoSrc_16_2_Server_Preferred",
                 "SingleDev_OneChanStereoSrc_16_2_Server_Preferred",
+                "SingleDev_OneChanMonoSrc_48_4_Server_Preferred",
+                "SingleDev_OneChanMonoSrc_48_3_Server_Preferred",
+                "SingleDev_OneChanMonoSrc_48_2_Server_Preferred",
+                "SingleDev_OneChanMonoSrc_48_1_Server_Preferred",
+                "SingleDev_OneChanMonoSrc_32_2_Server_Preferred",
+                "SingleDev_OneChanMonoSrc_32_1_Server_Preferred",
                 "SingleDev_OneChanMonoSrc_24_2_Server_Preferred",
+                "SingleDev_OneChanMonoSrc_24_1_Server_Preferred",
                 "SingleDev_OneChanMonoSrc_16_2_Server_Preferred",
+                "SingleDev_OneChanMonoSrc_16_1_Server_Preferred",
                 "VND_SingleDev_TwoChanStereoSnk_TwoChanStereoSrc_32khz_Server_Prefered_1",
-                "VND_SingleDev_TwoChanStereoSnk_TwoChanStereoSrc_32khz_60oct_R3_L22_1"
+                "VND_SingleDev_TwoChanStereoSnk_TwoChanStereoSrc_32khz_60oct_R3_L22_1",
+                "DualDev_OneChanMonoSnk_16_2_Server_Preferred",
+                "SingleDev_OneChanStereoSnk_16_2_Server_Preferred",
+                "SingleDev_TwoChanStereoSnk_16_2_Server_Preferred",
+                "SingleDev_OneChanMonoSnk_16_2_Server_Preferred"
             ]
         },
         {
@@ -152,6 +129,10 @@
                 "SingleDev_OneChanMonoSnk_48_2_2",
                 "SingleDev_OneChanMonoSnk_48_1_Server_Preferred",
                 "SingleDev_OneChanMonoSnk_48_1_2",
+                "SingleDev_OneChanMonoSnk_32_2_Server_Preferred",
+                "SingleDev_OneChanMonoSnk_32_2_2",
+                "SingleDev_OneChanMonoSnk_32_1_Server_Preferred",
+                "SingleDev_OneChanMonoSnk_32_1_2",
                 "SingleDev_OneChanMonoSnk_24_2_Server_Preferred",
                 "SingleDev_OneChanMonoSnk_24_2_2",
                 "SingleDev_OneChanMonoSnk_16_2_Server_Preferred",
@@ -163,7 +144,10 @@
                 "VND_SingleDev_TwoChanStereoSnk_48khz_100octs_Server_Preferred_1",
                 "VND_SingleDev_TwoChanStereoSnk_48khz_100octs_R15_L70_1",
                 "VND_SingleDev_OneChanStereoSnk_48khz_100octs_Server_Preferred_1",
-                "VND_SingleDev_OneChanStereoSnk_48khz_100octs_R15_L70_1"
+                "VND_SingleDev_OneChanStereoSnk_48khz_100octs_R15_L70_1",
+                "DualDev_OneChanMonoSrc_16_2_Server_Preferred",
+                "SingleDev_OneChanStereoSrc_16_2_Server_Preferred",
+                "SingleDev_OneChanMonoSrc_16_2_Server_Preferred"
             ]
         },
         {
@@ -179,6 +163,32 @@
         {
             "name": "VoiceAssistants",
             "configurations": [
+                "DualDev_OneChanStereoSnk_OneChanStereoSrc_48_1_Server_Preferred",
+                "DualDev_OneChanStereoSnk_OneChanStereoSrc_48_2_Server_Preferred",
+                "DualDev_OneChanStereoSnk_OneChanStereoSrc_32_2_Server_Preferred",
+                "DualDev_OneChanStereoSnk_OneChanStereoSrc_32_2_1",
+                "DualDev_OneChanStereoSnk_OneChanStereoSrc_16_1_Server_Preferred",
+                "DualDev_OneChanStereoSnk_OneChanStereoSrc_16_1_1",
+                "DualDev_OneChanStereoSnk_OneChanStereoSrc_16_2_Server_Preferred",
+                "DualDev_OneChanStereoSnk_OneChanStereoSrc_16_2_1",
+                "SingleDev_TwoChanStereoSnk_TwoChanStereoSrc_32_2_Server_Preferred",
+                "SingleDev_TwoChanStereoSnk_TwoChanStereoSrc_32_2_1",
+                "SingleDev_TwoChanStereoSnk_TwoChanStereoSrc_16_2_Server_Preferred",
+                "SingleDev_TwoChanStereoSnk_TwoChanStereoSrc_16_2_1",
+                "SingleDev_TwoChanStereoSnk_TwoChanStereoSrc_16_1_Server_Preferred",
+                "SingleDev_TwoChanStereoSnk_TwoChanStereoSrc_16_1_1",
+                "SingleDev_TwoChanStereoSnk_OneChanMonoSrc_32_2_Server_Preferred",
+                "SingleDev_TwoChanStereoSnk_OneChanMonoSrc_32_2_1",
+                "SingleDev_TwoChanStereoSnk_OneChanMonoSrc_16_2_Server_Preferred",
+                "SingleDev_TwoChanStereoSnk_OneChanMonoSrc_16_2_1",
+                "SingleDev_TwoChanStereoSnk_OneChanMonoSrc_16_1_Server_Preferred",
+                "SingleDev_TwoChanStereoSnk_OneChanMonoSrc_16_1_1",
+                "SingleDev_OneChanMonoSnk_OneChanMonoSrc_32_2_Server_Preferred",
+                "SingleDev_OneChanMonoSnk_OneChanMonoSrc_32_2_1",
+                "SingleDev_OneChanMonoSnk_OneChanMonoSrc_16_2_Server_Preferred",
+                "SingleDev_OneChanMonoSnk_OneChanMonoSrc_16_2_1",
+                "SingleDev_OneChanMonoSnk_OneChanMonoSrc_16_1_Server_Preferred",
+                "SingleDev_OneChanMonoSnk_OneChanMonoSrc_16_1_1",
                 "DualDev_OneChanStereoSnk_48_4_1_OneChanStereoSrc_32_2_1_Server_Preferred",
                 "DualDev_OneChanStereoSnk_48_4_2_OneChanStereoSrc_32_2_2_Server_Preferred",
                 "DualDev_OneChanStereoSnk_48_4_1_OneChanStereoSrc_24_2_1_Server_Preferred",
@@ -224,23 +234,42 @@
             ]
         },
         {
-            "name": "Recording",
+            "name": "Live",
             "configurations": [
                 "VND_SingleDev_TwoChanStereoSrc_48khz_100octs_Server_Preferred_1",
-                "VND_SingleDev_TwoChanStereoSrc_48khz_100octs_R11_L40_1"
-            ]
-        },
-        {
-            "name": "Default",
-            "configurations": [
-                "DualDev_OneChanStereoSnk_16_2_Server_Preferred",
-                "DualDev_OneChanStereoSnk_16_2_1",
-                "SingleDev_OneChanStereoSnk_16_2_Server_Preferred",
-                "SingleDev_OneChanStereoSnk_16_2_1",
-                "SingleDev_TwoChanStereoSnk_16_2_Server_Preferred",
-                "SingleDev_TwoChanStereoSnk_16_2_1",
-                "SingleDev_OneChanMonoSnk_16_2_Server_Preferred",
-                "SingleDev_OneChanMonoSnk_16_2_1"
+                "VND_SingleDev_TwoChanStereoSrc_48khz_100octs_R11_L40_1",
+                "DualDev_OneChanStereoSnk_OneChanStereoSrc_48_1_Server_Preferred",
+                "DualDev_OneChanStereoSnk_OneChanStereoSrc_48_2_Server_Preferred",
+                "DualDev_OneChanStereoSnk_OneChanStereoSrc_32_2_Server_Preferred",
+                "DualDev_OneChanStereoSnk_OneChanStereoSrc_32_2_1",
+                "DualDev_OneChanStereoSnk_OneChanStereoSrc_16_1_Server_Preferred",
+                "DualDev_OneChanStereoSnk_OneChanStereoSrc_16_1_1",
+                "DualDev_OneChanStereoSnk_OneChanStereoSrc_16_2_Server_Preferred",
+                "DualDev_OneChanStereoSnk_OneChanStereoSrc_16_2_1",
+                "SingleDev_TwoChanStereoSnk_TwoChanStereoSrc_32_2_Server_Preferred",
+                "SingleDev_TwoChanStereoSnk_TwoChanStereoSrc_32_2_1",
+                "SingleDev_TwoChanStereoSnk_TwoChanStereoSrc_16_2_Server_Preferred",
+                "SingleDev_TwoChanStereoSnk_TwoChanStereoSrc_16_2_1",
+                "SingleDev_TwoChanStereoSnk_TwoChanStereoSrc_16_1_Server_Preferred",
+                "SingleDev_TwoChanStereoSnk_TwoChanStereoSrc_16_1_1",
+                "SingleDev_TwoChanStereoSnk_OneChanMonoSrc_32_2_Server_Preferred",
+                "SingleDev_TwoChanStereoSnk_OneChanMonoSrc_32_2_1",
+                "SingleDev_TwoChanStereoSnk_OneChanMonoSrc_16_2_Server_Preferred",
+                "SingleDev_TwoChanStereoSnk_OneChanMonoSrc_16_2_1",
+                "SingleDev_TwoChanStereoSnk_OneChanMonoSrc_16_1_Server_Preferred",
+                "SingleDev_TwoChanStereoSnk_OneChanMonoSrc_16_1_1",
+                "SingleDev_OneChanMonoSnk_OneChanMonoSrc_32_2_Server_Preferred",
+                "SingleDev_OneChanMonoSnk_OneChanMonoSrc_32_2_1",
+                "SingleDev_OneChanMonoSnk_OneChanMonoSrc_16_2_Server_Preferred",
+                "SingleDev_OneChanMonoSnk_OneChanMonoSrc_16_2_1",
+                "SingleDev_OneChanMonoSnk_OneChanMonoSrc_16_1_Server_Preferred",
+                "SingleDev_OneChanMonoSnk_OneChanMonoSrc_16_1_1",
+                "SingleDev_OneChanMonoSrc_48_2_Server_Preferred",
+                "SingleDev_OneChanMonoSrc_48_1_Server_Preferred",
+                "SingleDev_OneChanMonoSrc_32_2_Server_Preferred",
+                "SingleDev_OneChanMonoSrc_32_1_Server_Preferred",
+                "SingleDev_OneChanMonoSrc_16_2_Server_Preferred",
+                "SingleDev_OneChanMonoSrc_16_1_Server_Preferred"
             ]
         }
     ]
diff --git a/system/bta/le_audio/broadcaster/broadcaster.cc b/system/bta/le_audio/broadcaster/broadcaster.cc
index f152957..a4b0e9d 100644
--- a/system/bta/le_audio/broadcaster/broadcaster.cc
+++ b/system/bta/le_audio/broadcaster/broadcaster.cc
@@ -20,11 +20,12 @@
 #include "bta/include/bta_le_audio_api.h"
 #include "bta/include/bta_le_audio_broadcaster_api.h"
 #include "bta/le_audio/broadcaster/state_machine.h"
-#include "bta/le_audio/content_control_id_keeper.h"
 #include "bta/le_audio/le_audio_types.h"
+#include "bta/le_audio/le_audio_utils.h"
 #include "device/include/controller.h"
 #include "embdrv/lc3/include/lc3.h"
 #include "gd/common/strings.h"
+#include "internal_include/stack_config.h"
 #include "osi/include/log.h"
 #include "osi/include/properties.h"
 #include "stack/include/btm_api_types.h"
@@ -37,21 +38,26 @@
 using bluetooth::hci::iso_manager::BigCallbacks;
 using bluetooth::le_audio::BasicAudioAnnouncementData;
 using bluetooth::le_audio::BroadcastId;
-using le_audio::ContentControlIdKeeper;
+using le_audio::CodecManager;
+using le_audio::LeAudioCodecConfiguration;
+using le_audio::LeAudioSourceAudioHalClient;
 using le_audio::broadcaster::BigConfig;
 using le_audio::broadcaster::BroadcastCodecWrapper;
 using le_audio::broadcaster::BroadcastQosConfig;
 using le_audio::broadcaster::BroadcastStateMachine;
 using le_audio::broadcaster::BroadcastStateMachineConfig;
 using le_audio::broadcaster::IBroadcastStateMachineCallbacks;
+using le_audio::types::AudioContexts;
+using le_audio::types::CodecLocation;
 using le_audio::types::kLeAudioCodingFormatLC3;
 using le_audio::types::LeAudioContextType;
 using le_audio::types::LeAudioLtvMap;
+using le_audio::utils::GetAllCcids;
+using le_audio::utils::GetAllowedAudioContextsFromSourceMetadata;
 
 namespace {
 class LeAudioBroadcasterImpl;
 LeAudioBroadcasterImpl* instance;
-LeAudioBroadcastClientAudioSource* leAudioClientAudioSource;
 
 /* Class definitions */
 
@@ -74,7 +80,7 @@
       : callbacks_(callbacks_),
         current_phy_(PHY_LE_2M),
         audio_data_path_state_(AudioDataPathState::INACTIVE),
-        audio_instance_(nullptr) {
+        le_audio_source_hal_client_(nullptr) {
     LOG_INFO();
 
     /* Register State machine callbacks */
@@ -110,10 +116,9 @@
     broadcasts_.clear();
     callbacks_ = nullptr;
 
-    if (audio_instance_) {
-      leAudioClientAudioSource->Stop();
-      leAudioClientAudioSource->Release(audio_instance_);
-      audio_instance_ = nullptr;
+    if (le_audio_source_hal_client_) {
+      le_audio_source_hal_client_->Stop();
+      le_audio_source_hal_client_.reset();
     }
   }
 
@@ -163,6 +168,80 @@
     return announcement;
   }
 
+  void UpdateStreamingContextTypeOnAllSubgroups(const AudioContexts& contexts) {
+    LOG_DEBUG("%s context_type_map=%s", __func__, contexts.to_string().c_str());
+
+    auto ccids = GetAllCcids(contexts);
+    if (ccids.empty()) {
+      LOG_WARN("%s No content providers available for context_type_map=%s.",
+               __func__, contexts.to_string().c_str());
+    }
+
+    std::vector<uint8_t> stream_context_vec(2);
+    auto pp = stream_context_vec.data();
+    UINT16_TO_STREAM(pp, contexts.value());
+
+    for (auto const& kv_it : broadcasts_) {
+      auto& broadcast = kv_it.second;
+      if (broadcast->GetState() == BroadcastStateMachine::State::STREAMING) {
+        auto announcement = broadcast->GetBroadcastAnnouncement();
+        bool broadcast_update = false;
+
+        // Replace context type and CCID list
+        for (auto& subgroup : announcement.subgroup_configs) {
+          auto subgroup_ltv = LeAudioLtvMap(subgroup.metadata);
+          bool subgroup_update = false;
+
+          auto existing_context = subgroup_ltv.Find(
+              le_audio::types::kLeAudioMetadataTypeStreamingAudioContext);
+          if (existing_context) {
+            if (memcmp(stream_context_vec.data(), existing_context->data(),
+                       existing_context->size()) != 0) {
+              subgroup_ltv.Add(
+                  le_audio::types::kLeAudioMetadataTypeStreamingAudioContext,
+                  stream_context_vec);
+              subgroup_update = true;
+            }
+          } else {
+            subgroup_ltv.Add(
+                le_audio::types::kLeAudioMetadataTypeStreamingAudioContext,
+                stream_context_vec);
+            subgroup_update = true;
+          }
+
+          auto existing_ccid_list =
+              subgroup_ltv.Find(le_audio::types::kLeAudioMetadataTypeCcidList);
+          if (existing_ccid_list) {
+            if (ccids.empty()) {
+              subgroup_ltv.Remove(
+                  le_audio::types::kLeAudioMetadataTypeCcidList);
+              subgroup_update = true;
+
+            } else if (!std::is_permutation(ccids.begin(), ccids.end(),
+                                            existing_ccid_list->begin())) {
+              subgroup_ltv.Add(le_audio::types::kLeAudioMetadataTypeCcidList,
+                               ccids);
+              subgroup_update = true;
+            }
+          } else if (!ccids.empty()) {
+            subgroup_ltv.Add(le_audio::types::kLeAudioMetadataTypeCcidList,
+                             ccids);
+            subgroup_update = true;
+          }
+
+          if (subgroup_update) {
+            subgroup.metadata = subgroup_ltv.Values();
+            broadcast_update = true;
+          }
+        }
+
+        if (broadcast_update) {
+          broadcast->UpdateBroadcastAnnouncement(std::move(announcement));
+        }
+      }
+    }
+  }
+
   void UpdateMetadata(uint32_t broadcast_id,
                       std::vector<uint8_t> metadata) override {
     if (broadcasts_.count(broadcast_id) == 0) {
@@ -183,6 +262,38 @@
       return;
     }
 
+    auto context_type = AudioContexts(LeAudioContextType::MEDIA);
+
+    /* Adds multiple contexts and CCIDs regardless of the incoming audio
+     * context. Android has only two CCIDs, one for Media and one for
+     * Conversational context. Even though we are not broadcasting
+     * Conversational streams, some PTS test cases wants multiple CCIDs.
+     */
+    if (stack_config_get_interface()
+            ->get_pts_force_le_audio_multiple_contexts_metadata()) {
+      context_type =
+          LeAudioContextType::MEDIA | LeAudioContextType::CONVERSATIONAL;
+      auto stream_context_vec =
+          ltv.Find(le_audio::types::kLeAudioMetadataTypeStreamingAudioContext);
+      if (stream_context_vec) {
+        auto pp = stream_context_vec.value().data();
+        UINT16_TO_STREAM(pp, context_type.value());
+      }
+    }
+
+    auto stream_context_vec =
+        ltv.Find(le_audio::types::kLeAudioMetadataTypeStreamingAudioContext);
+    if (stream_context_vec) {
+      auto pp = stream_context_vec.value().data();
+      STREAM_TO_UINT16(context_type.value_ref(), pp);
+    }
+
+    // Append the CCID list
+    auto ccid_vec = GetAllCcids(context_type);
+    if (!ccid_vec.empty()) {
+      ltv.Add(le_audio::types::kLeAudioMetadataTypeCcidList, ccid_vec);
+    }
+
     BasicAudioAnnouncementData announcement =
         prepareAnnouncement(codec_config, std::move(ltv));
 
@@ -206,44 +317,87 @@
       return;
     }
 
-    uint16_t context_type =
-        static_cast<std::underlying_type<LeAudioContextType>::type>(
-            LeAudioContextType::MEDIA);
+    auto context_type = AudioContexts(LeAudioContextType::MEDIA);
+
+    /* Adds multiple contexts and CCIDs regardless of the incoming audio
+     * context. Android has only two CCIDs, one for Media and one for
+     * Conversational context. Even though we are not broadcasting
+     * Conversational streams, some PTS test cases wants multiple CCIDs.
+     */
+    if (stack_config_get_interface()
+            ->get_pts_force_le_audio_multiple_contexts_metadata()) {
+      context_type =
+          LeAudioContextType::MEDIA | LeAudioContextType::CONVERSATIONAL;
+      auto stream_context_vec =
+          ltv.Find(le_audio::types::kLeAudioMetadataTypeStreamingAudioContext);
+      if (stream_context_vec) {
+        auto pp = stream_context_vec.value().data();
+        UINT16_TO_STREAM(pp, context_type.value());
+      }
+    }
+
     auto stream_context_vec =
         ltv.Find(le_audio::types::kLeAudioMetadataTypeStreamingAudioContext);
     if (stream_context_vec) {
       auto pp = stream_context_vec.value().data();
-      STREAM_TO_UINT16(context_type, pp);
+      STREAM_TO_UINT16(context_type.value_ref(), pp);
     }
 
     // Append the CCID list
-    // TODO: We currently support only one context (and CCID) at a time for both
-    //       Unicast and broadcast.
-    auto ccid = ContentControlIdKeeper::GetInstance()->GetCcid(context_type);
-    if (ccid != -1) {
-      ltv.Add(le_audio::types::kLeAudioMetadataTypeCcidList,
-              {static_cast<uint8_t>(ccid)});
+    auto ccid_vec = GetAllCcids(context_type);
+    if (!ccid_vec.empty()) {
+      ltv.Add(le_audio::types::kLeAudioMetadataTypeCcidList, ccid_vec);
     }
 
-    auto codec_qos_pair =
-        le_audio::broadcaster::getStreamConfigForContext(context_type);
-    BroadcastStateMachineConfig msg = {
-        .broadcast_id = broadcast_id,
-        .streaming_phy = GetStreamingPhy(),
-        .codec_wrapper = codec_qos_pair.first,
-        .qos_config = codec_qos_pair.second,
-        .announcement =
-            prepareAnnouncement(codec_qos_pair.first, std::move(ltv)),
-        .broadcast_code = std::move(broadcast_code)};
+    if (CodecManager::GetInstance()->GetCodecLocation() ==
+        CodecLocation::ADSP) {
+      auto offload_config =
+          CodecManager::GetInstance()->GetBroadcastOffloadConfig();
+      BroadcastCodecWrapper codec_config(
+          {.coding_format = le_audio::types::kLeAudioCodingFormatLC3,
+           .vendor_company_id =
+               le_audio::types::kLeAudioVendorCompanyIdUndefined,
+           .vendor_codec_id = le_audio::types::kLeAudioVendorCodecIdUndefined},
+          {.num_channels =
+               static_cast<uint8_t>(offload_config->stream_map.size()),
+           .sample_rate = offload_config->sampling_rate,
+           .bits_per_sample = offload_config->bits_per_sample,
+           .data_interval_us = offload_config->frame_duration},
+          offload_config->codec_bitrate, offload_config->octets_per_frame);
+      BroadcastQosConfig qos_config(offload_config->retransmission_number,
+                                    offload_config->max_transport_latency);
+
+      BroadcastStateMachineConfig msg = {
+          .broadcast_id = broadcast_id,
+          .streaming_phy = GetStreamingPhy(),
+          .codec_wrapper = codec_config,
+          .qos_config = qos_config,
+          .announcement = prepareAnnouncement(codec_config, std::move(ltv)),
+          .broadcast_code = std::move(broadcast_code)};
+
+      pending_broadcasts_.push_back(
+          std::move(BroadcastStateMachine::CreateInstance(std::move(msg))));
+    } else {
+      auto codec_qos_pair =
+          le_audio::broadcaster::getStreamConfigForContext(context_type);
+      BroadcastStateMachineConfig msg = {
+          .broadcast_id = broadcast_id,
+          .streaming_phy = GetStreamingPhy(),
+          .codec_wrapper = codec_qos_pair.first,
+          .qos_config = codec_qos_pair.second,
+          .announcement =
+              prepareAnnouncement(codec_qos_pair.first, std::move(ltv)),
+          .broadcast_code = std::move(broadcast_code)};
+
+      /* Create the broadcaster instance - we'll receive it's init state in the
+       * async callback
+       */
+      pending_broadcasts_.push_back(
+          std::move(BroadcastStateMachine::CreateInstance(std::move(msg))));
+    }
 
     LOG_INFO("CreateAudioBroadcast");
 
-    /* Create the broadcaster instance - we'll receive it's init state in the
-     * async callback
-     */
-    pending_broadcasts_.push_back(
-        std::move(BroadcastStateMachine::CreateInstance(std::move(msg))));
-
     // Notify the error instead just fail silently
     if (!pending_broadcasts_.back()->Initialize()) {
       pending_broadcasts_.pop_back();
@@ -256,8 +410,8 @@
     LOG_INFO("broadcast_id=%d", broadcast_id);
 
     if (broadcasts_.count(broadcast_id) != 0) {
-      LOG_INFO("Stopping LeAudioClientAudioSource");
-      leAudioClientAudioSource->Stop();
+      LOG_INFO("Stopping AudioHalClient");
+      if (le_audio_source_hal_client_) le_audio_source_hal_client_->Stop();
       broadcasts_[broadcast_id]->SetMuted(true);
       broadcasts_[broadcast_id]->ProcessMessage(
           BroadcastStateMachine::Message::SUSPEND, nullptr);
@@ -287,9 +441,10 @@
     }
 
     if (broadcasts_.count(broadcast_id) != 0) {
-      if (!audio_instance_) {
-        audio_instance_ = leAudioClientAudioSource->Acquire();
-        if (!audio_instance_) {
+      if (!le_audio_source_hal_client_) {
+        le_audio_source_hal_client_ =
+            LeAudioSourceAudioHalClient::AcquireBroadcast();
+        if (!le_audio_source_hal_client_) {
           LOG_ERROR("Could not acquire le audio");
           return;
         }
@@ -308,9 +463,9 @@
       return;
     }
 
-    LOG_INFO("Stopping LeAudioClientAudioSource, broadcast_id=%d",
-             broadcast_id);
-    leAudioClientAudioSource->Stop();
+    LOG_INFO("Stopping AudioHalClient, broadcast_id=%d", broadcast_id);
+
+    if (le_audio_source_hal_client_) le_audio_source_hal_client_->Stop();
     broadcasts_[broadcast_id]->SetMuted(true);
     broadcasts_[broadcast_id]->ProcessMessage(
         BroadcastStateMachine::Message::STOP, nullptr);
@@ -437,8 +592,7 @@
         CHECK(broadcasts_.count(broadcast_id) != 0);
         broadcasts_[broadcast_id]->HandleHciEvent(HCI_BLE_TERM_BIG_CPL_EVT,
                                                   evt);
-        leAudioClientAudioSource->Release(audio_instance_);
-        audio_instance_ = nullptr;
+        le_audio_source_hal_client_.reset();
       } break;
       default:
         LOG_ERROR("Invalid event=%d", event);
@@ -522,7 +676,7 @@
           break;
         case BroadcastStateMachine::State::STREAMING:
           if (getStreamerCount() == 1) {
-            LOG_INFO("Starting LeAudioClientAudioSource");
+            LOG_INFO("Starting AudioHalClient");
 
             if (instance->broadcasts_.count(broadcast_id) != 0) {
               const auto& broadcast = instance->broadcasts_.at(broadcast_id);
@@ -534,8 +688,8 @@
 
               broadcast->SetMuted(false);
               auto cfg = static_cast<const LeAudioCodecConfiguration*>(data);
-              auto is_started =
-                  leAudioClientAudioSource->Start(*cfg, &audio_receiver_);
+              auto is_started = instance->le_audio_source_hal_client_->Start(
+                  *cfg, &audio_receiver_);
               if (!is_started) {
                 /* Audio Source setup failed - stop the broadcast */
                 instance->StopAudioBroadcast(broadcast_id);
@@ -557,17 +711,24 @@
                               RawAddress addr) override {
       /* Not used currently */
     }
+
+    void OnBigCreated(const std::vector<uint16_t>& conn_handle) {
+      CodecManager::GetInstance()->UpdateBroadcastConnHandle(
+          conn_handle,
+          std::bind(
+              &LeAudioSourceAudioHalClient::UpdateBroadcastAudioConfigToHal,
+              instance->le_audio_source_hal_client_.get(),
+              std::placeholders::_1));
+    }
   } state_machine_callbacks_;
 
-  static class LeAudioClientAudioSinkReceiverImpl
-      : public LeAudioClientAudioSinkReceiver {
+  static class LeAudioSourceCallbacksImpl
+      : public LeAudioSourceAudioHalClient::Callbacks {
    public:
-    LeAudioClientAudioSinkReceiverImpl()
-        : codec_wrapper_(
-              le_audio::broadcaster::getStreamConfigForContext(
-                  static_cast<std::underlying_type<LeAudioContextType>::type>(
-                      le_audio::types::LeAudioContextType::UNSPECIFIED))
-                  .first) {}
+    LeAudioSourceCallbacksImpl()
+        : codec_wrapper_(le_audio::broadcaster::getStreamConfigForContext(
+                             AudioContexts(LeAudioContextType::UNSPECIFIED))
+                             .first) {}
 
     void CheckAndReconfigureEncoders() {
       auto const& codec_id = codec_wrapper_.GetLeAudioCodecId();
@@ -687,28 +848,37 @@
 
     virtual void OnAudioResume(void) override {
       LOG_INFO();
+      if (!instance) return;
+
       /* TODO: Should we resume all broadcasts - recreate BIGs? */
-      if (instance)
-        instance->audio_data_path_state_ = AudioDataPathState::ACTIVE;
+      instance->audio_data_path_state_ = AudioDataPathState::ACTIVE;
 
       if (!IsAnyoneStreaming()) {
-        leAudioClientAudioSource->CancelStreamingRequest();
+        instance->le_audio_source_hal_client_->CancelStreamingRequest();
         return;
       }
 
-      leAudioClientAudioSource->ConfirmStreamingRequest();
+      instance->le_audio_source_hal_client_->ConfirmStreamingRequest();
     }
 
     virtual void OnAudioMetadataUpdate(
-        std::promise<void> do_update_metadata_promise,
-        const source_metadata_t& source_metadata) override {
+        std::vector<struct playback_track_metadata> source_metadata) override {
       LOG_INFO();
       if (!instance) return;
-      do_update_metadata_promise.set_value();
-      /* TODO: We probably don't want to change stream type or update the
-       * advertized metadata on each call. We should rather make sure we get
-       * only a single content audio stream from the media frameworks.
-       */
+
+      /* TODO: Should we take supported contexts from ASCS? */
+      auto supported_context_types = le_audio::types::kLeAudioContextAllTypes;
+      auto contexts = GetAllowedAudioContextsFromSourceMetadata(
+          source_metadata, supported_context_types);
+      if (contexts.any()) {
+        /* NOTICE: We probably don't want to change the stream configuration
+         * on each metadata change, so just update the context type metadata.
+         * Since we are not able to identify individual track streams and
+         * they are all mixed inside a single data stream, we will update
+         * the metadata of all BIS subgroups with the same combined context.
+         */
+        instance->UpdateStreamingContextTypeOnAllSubgroups(contexts);
+      }
     }
 
    private:
@@ -725,14 +895,14 @@
   /* Some BIG params are set globally */
   uint8_t current_phy_;
   AudioDataPathState audio_data_path_state_;
-  const void* audio_instance_;
+  std::unique_ptr<LeAudioSourceAudioHalClient> le_audio_source_hal_client_;
   std::vector<BroadcastId> available_broadcast_ids_;
 };
 
 /* Static members definitions */
 LeAudioBroadcasterImpl::BroadcastStateMachineCallbacks
     LeAudioBroadcasterImpl::state_machine_callbacks_;
-LeAudioBroadcasterImpl::LeAudioClientAudioSinkReceiverImpl
+LeAudioBroadcasterImpl::LeAudioSourceCallbacksImpl
     LeAudioBroadcasterImpl::audio_receiver_;
 
 } /* namespace */
@@ -756,8 +926,6 @@
     LOG_ALWAYS_FATAL("HAL requirements not met. Init aborted.");
   }
 
-  /* Create new client audio broadcast instance */
-  InitializeAudioClient(nullptr);
   IsoManager::GetInstance()->Start();
 
   instance = new LeAudioBroadcasterImpl(callbacks);
@@ -790,10 +958,6 @@
   instance = nullptr;
 
   ptr->CleanUp();
-  if (leAudioClientAudioSource) {
-    delete leAudioClientAudioSource;
-    leAudioClientAudioSource = nullptr;
-  }
   delete ptr;
 }
 
@@ -802,19 +966,3 @@
   if (instance) instance->Dump(fd);
   dprintf(fd, "\n");
 }
-
-void LeAudioBroadcaster::InitializeAudioClient(
-    LeAudioBroadcastClientAudioSource* clientAudioSource) {
-  if (leAudioClientAudioSource) {
-    LOG(WARNING) << __func__ << ", audio clients already initialized";
-    return;
-  }
-
-  if (!clientAudioSource) {
-    /* Create new instance if no pre-created is delivered */
-    leAudioClientAudioSource = new LeAudioBroadcastClientAudioSource();
-  } else {
-    /* Use pre-created instance e.g. from test suit */
-    leAudioClientAudioSource = clientAudioSource;
-  }
-}
diff --git a/system/bta/le_audio/broadcaster/broadcaster_test.cc b/system/bta/le_audio/broadcaster/broadcaster_test.cc
index 8aa9147..bfb5f3f 100644
--- a/system/bta/le_audio/broadcaster/broadcaster_test.cc
+++ b/system/bta/le_audio/broadcaster/broadcaster_test.cc
@@ -17,6 +17,7 @@
 
 #include <gmock/gmock.h>
 #include <gtest/gtest.h>
+#include <hardware/audio.h>
 
 #include <chrono>
 
@@ -30,11 +31,15 @@
 #include "device/include/controller.h"
 #include "stack/include/btm_iso_api.h"
 
+using namespace std::chrono_literals;
+
+using le_audio::types::AudioContexts;
 using le_audio::types::LeAudioContextType;
 
 using testing::_;
 using testing::AtLeast;
 using testing::DoAll;
+using testing::Matcher;
 using testing::Mock;
 using testing::NotNull;
 using testing::Return;
@@ -44,6 +49,11 @@
 
 using namespace bluetooth::le_audio;
 
+using le_audio::LeAudioCodecConfiguration;
+using le_audio::LeAudioSourceAudioHalClient;
+using le_audio::broadcaster::BigConfig;
+using le_audio::broadcaster::BroadcastCodecWrapper;
+
 std::map<std::string, int> mock_function_count_map;
 
 // Disables most likely false-positives from base::SplitString()
@@ -106,8 +116,22 @@
 }
 
 namespace le_audio {
-namespace broadcaster {
-namespace {
+class MockAudioHalClientEndpoint;
+MockAudioHalClientEndpoint* mock_audio_source_;
+bool is_audio_hal_acquired;
+
+std::unique_ptr<LeAudioSourceAudioHalClient>
+LeAudioSourceAudioHalClient::AcquireBroadcast() {
+  if (mock_audio_source_) {
+    std::unique_ptr<LeAudioSourceAudioHalClient> ptr(
+        (LeAudioSourceAudioHalClient*)mock_audio_source_);
+    is_audio_hal_acquired = true;
+    return std::move(ptr);
+  }
+  return nullptr;
+}
+
+static constexpr uint8_t default_ccid = 0xDE;
 static constexpr auto default_context =
     static_cast<std::underlying_type<LeAudioContextType>::type>(
         LeAudioContextType::ALERTS);
@@ -145,21 +169,26 @@
               (override));
 };
 
-class MockLeAudioBroadcastClientAudioSource
-    : public LeAudioBroadcastClientAudioSource {
+class MockAudioHalClientEndpoint : public LeAudioSourceAudioHalClient {
  public:
+  MockAudioHalClientEndpoint() = default;
   MOCK_METHOD((bool), Start,
               (const LeAudioCodecConfiguration& codecConfiguration,
-               LeAudioClientAudioSinkReceiver* audioReceiver));
-  MOCK_METHOD((void), Stop, ());
-  MOCK_METHOD((const void*), Acquire, ());
-  MOCK_METHOD((void), Release, (const void*));
-  MOCK_METHOD((void), ConfirmStreamingRequest, ());
-  MOCK_METHOD((void), CancelStreamingRequest, ());
-  MOCK_METHOD((void), UpdateRemoteDelay, (uint16_t delay));
-  MOCK_METHOD((void), DebugDump, (int fd));
+               LeAudioSourceAudioHalClient::Callbacks* audioReceiver),
+              (override));
+  MOCK_METHOD((void), Stop, (), (override));
+  MOCK_METHOD((void), ConfirmStreamingRequest, (), (override));
+  MOCK_METHOD((void), CancelStreamingRequest, (), (override));
+  MOCK_METHOD((void), UpdateRemoteDelay, (uint16_t delay), (override));
   MOCK_METHOD((void), UpdateAudioConfigToHal,
-              (const ::le_audio::offload_config&));
+              (const ::le_audio::offload_config&), (override));
+  MOCK_METHOD((void), UpdateBroadcastAudioConfigToHal,
+              (const ::le_audio::broadcast_offload_config&), (override));
+  MOCK_METHOD((void), SuspendedForReconfiguration, (), (override));
+  MOCK_METHOD((void), ReconfigurationComplete, (), (override));
+
+  MOCK_METHOD((void), OnDestroyed, ());
+  virtual ~MockAudioHalClientEndpoint() { OnDestroyed(); }
 };
 
 class BroadcasterTest : public Test {
@@ -176,33 +205,20 @@
     ASSERT_NE(iso_manager_, nullptr);
     iso_manager_->Start();
 
-    mock_audio_source_ = new MockLeAudioBroadcastClientAudioSource();
-
-    ON_CALL(*mock_audio_source_, Start).WillByDefault(Return(true));
-
     is_audio_hal_acquired = false;
-    ON_CALL(*mock_audio_source_, Acquire).WillByDefault([this]() -> void* {
-      if (!is_audio_hal_acquired) {
-        is_audio_hal_acquired = true;
-        return mock_audio_source_;
-      }
-
-      return nullptr;
+    mock_audio_source_ = new MockAudioHalClientEndpoint();
+    ON_CALL(*mock_audio_source_, Start).WillByDefault(Return(true));
+    ON_CALL(*mock_audio_source_, OnDestroyed).WillByDefault([]() {
+      mock_audio_source_ = nullptr;
+      is_audio_hal_acquired = false;
     });
 
-    ON_CALL(*mock_audio_source_, Release)
-        .WillByDefault([this](const void* inst) -> void {
-          if (is_audio_hal_acquired) {
-            is_audio_hal_acquired = false;
-          }
-        });
-
     ASSERT_FALSE(LeAudioBroadcaster::IsLeAudioBroadcasterRunning());
-    LeAudioBroadcaster::InitializeAudioClient(mock_audio_source_);
     LeAudioBroadcaster::Initialize(&mock_broadcaster_callbacks_,
                                    base::Bind([]() -> bool { return true; }));
 
     ContentControlIdKeeper::GetInstance()->Start();
+    ContentControlIdKeeper::GetInstance()->SetCcid(0x0004, media_ccid);
 
     /* Simulate random generator */
     uint8_t random[] = {0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08};
@@ -238,11 +254,9 @@
   }
 
  protected:
-  MockLeAudioBroadcastClientAudioSource* mock_audio_source_;
   MockLeAudioBroadcasterCallbacks mock_broadcaster_callbacks_;
   controller::MockControllerInterface controller_interface_;
   bluetooth::hci::IsoManager* iso_manager_;
-  bool is_audio_hal_acquired;
 };
 
 TEST_F(BroadcasterTest, Initialize) {
@@ -292,7 +306,7 @@
               OnBroadcastStateChanged(broadcast_id, BroadcastState::STREAMING))
       .Times(1);
 
-  LeAudioClientAudioSinkReceiver* audio_receiver;
+  LeAudioSourceAudioHalClient::Callbacks* audio_receiver;
   EXPECT_CALL(*mock_audio_source_, Start)
       .WillOnce(DoAll(SaveArg<1>(&audio_receiver), Return(true)));
 
@@ -324,7 +338,7 @@
               OnBroadcastStateChanged(broadcast_id, BroadcastState::STREAMING))
       .Times(1);
 
-  LeAudioClientAudioSinkReceiver* audio_receiver;
+  LeAudioSourceAudioHalClient::Callbacks* audio_receiver;
   EXPECT_CALL(*mock_audio_source_, Start)
       .WillOnce(DoAll(SaveArg<1>(&audio_receiver), Return(true)));
 
@@ -405,12 +419,29 @@
 
 TEST_F(BroadcasterTest, UpdateMetadata) {
   auto broadcast_id = InstantiateBroadcast();
-
+  std::vector<uint8_t> ccid_list;
   EXPECT_CALL(*MockBroadcastStateMachine::GetLastInstance(),
               UpdateBroadcastAnnouncement)
-      .Times(1);
+      .WillOnce(
+          [&](bluetooth::le_audio::BasicAudioAnnouncementData announcement) {
+            for (auto subgroup : announcement.subgroup_configs) {
+              if (subgroup.metadata.count(
+                      types::kLeAudioMetadataTypeCcidList)) {
+                ccid_list =
+                    subgroup.metadata.at(types::kLeAudioMetadataTypeCcidList);
+                break;
+              }
+            }
+          });
+
+  ContentControlIdKeeper::GetInstance()->SetCcid(0x0400, default_ccid);
   LeAudioBroadcaster::Get()->UpdateMetadata(
-      broadcast_id, std::vector<uint8_t>({0x02, 0x01, 0x02}));
+      broadcast_id,
+      std::vector<uint8_t>({0x02, 0x01, 0x02, 0x03, 0x02, 0x04, 0x04}));
+
+  ASSERT_EQ(2u, ccid_list.size());
+  ASSERT_NE(0, std::count(ccid_list.begin(), ccid_list.end(), media_ccid));
+  ASSERT_NE(0, std::count(ccid_list.begin(), ccid_list.end(), default_ccid));
 }
 
 static BasicAudioAnnouncementData prepareAnnouncement(
@@ -444,10 +475,78 @@
   return announcement;
 }
 
+TEST_F(BroadcasterTest, UpdateMetadataFromAudioTrackMetadata) {
+  ContentControlIdKeeper::GetInstance()->SetCcid(media_context, media_ccid);
+  auto broadcast_id = InstantiateBroadcast();
+
+  LeAudioSourceAudioHalClient::Callbacks* audio_receiver;
+  EXPECT_CALL(*mock_audio_source_, Start)
+      .WillOnce(DoAll(SaveArg<1>(&audio_receiver), Return(true)));
+
+  LeAudioBroadcaster::Get()->StartAudioBroadcast(broadcast_id);
+  ASSERT_NE(audio_receiver, nullptr);
+
+  auto sm = MockBroadcastStateMachine::GetLastInstance();
+  std::vector<uint8_t> ccid_list;
+  std::vector<uint8_t> context_types_map;
+  EXPECT_CALL(*sm, UpdateBroadcastAnnouncement)
+      .WillOnce(
+          [&](bluetooth::le_audio::BasicAudioAnnouncementData announcement) {
+            for (auto subgroup : announcement.subgroup_configs) {
+              if (subgroup.metadata.count(
+                      types::kLeAudioMetadataTypeCcidList)) {
+                ccid_list =
+                    subgroup.metadata.at(types::kLeAudioMetadataTypeCcidList);
+              }
+              if (subgroup.metadata.count(
+                      types::kLeAudioMetadataTypeStreamingAudioContext)) {
+                context_types_map = subgroup.metadata.at(
+                    types::kLeAudioMetadataTypeStreamingAudioContext);
+              }
+            }
+          });
+
+  std::map<uint8_t, std::vector<uint8_t>> meta = {};
+  BroadcastCodecWrapper codec_config(
+      {.coding_format = le_audio::types::kLeAudioCodingFormatLC3,
+       .vendor_company_id = le_audio::types::kLeAudioVendorCompanyIdUndefined,
+       .vendor_codec_id = le_audio::types::kLeAudioVendorCodecIdUndefined},
+      {.num_channels = LeAudioCodecConfiguration::kChannelNumberMono,
+       .sample_rate = LeAudioCodecConfiguration::kSampleRate16000,
+       .bits_per_sample = LeAudioCodecConfiguration::kBitsPerSample16,
+       .data_interval_us = LeAudioCodecConfiguration::kInterval10000Us},
+      32000, 40);
+  auto announcement = prepareAnnouncement(codec_config, meta);
+
+  ON_CALL(*sm, GetBroadcastAnnouncement())
+      .WillByDefault(ReturnRef(announcement));
+
+  std::vector<struct playback_track_metadata> multitrack_source_metadata = {
+      {{AUDIO_USAGE_GAME, AUDIO_CONTENT_TYPE_SONIFICATION, 0},
+       {AUDIO_USAGE_MEDIA, AUDIO_CONTENT_TYPE_MUSIC, 0},
+       {AUDIO_USAGE_VOICE_COMMUNICATION_SIGNALLING, AUDIO_CONTENT_TYPE_SPEECH,
+        0},
+       {AUDIO_USAGE_UNKNOWN, AUDIO_CONTENT_TYPE_UNKNOWN, 0}}};
+
+  audio_receiver->OnAudioMetadataUpdate(multitrack_source_metadata);
+
+  // Verify ccid
+  ASSERT_NE(ccid_list.size(), 0u);
+  ASSERT_TRUE(std::find(ccid_list.begin(), ccid_list.end(), media_ccid) !=
+              ccid_list.end());
+
+  // Verify context type
+  ASSERT_NE(context_types_map.size(), 0u);
+  AudioContexts context_type;
+  auto pp = context_types_map.data();
+  STREAM_TO_UINT16(context_type.value_ref(), pp);
+  ASSERT_TRUE(context_type.test_all(LeAudioContextType::MEDIA |
+                                    LeAudioContextType::GAME));
+}
+
 TEST_F(BroadcasterTest, GetMetadata) {
   auto broadcast_id = InstantiateBroadcast();
   bluetooth::le_audio::BroadcastMetadata metadata;
-  // bluetooth::le_audio::BasicAudioAnnouncementData announcement;
 
   static const uint8_t test_adv_sid = 0x14;
   std::optional<bluetooth::le_audio::BroadcastCode> test_broadcast_code =
@@ -537,6 +636,4 @@
   // Note: Num of bises at IsoManager level is verified by state machine tests
 }
 
-}  // namespace
-}  // namespace broadcaster
 }  // namespace le_audio
diff --git a/system/bta/le_audio/broadcaster/broadcaster_types.cc b/system/bta/le_audio/broadcaster/broadcaster_types.cc
index 66048a0..17f304f 100644
--- a/system/bta/le_audio/broadcaster/broadcaster_types.cc
+++ b/system/bta/le_audio/broadcaster/broadcaster_types.cc
@@ -23,6 +23,7 @@
 #include "bta_le_audio_broadcaster_api.h"
 #include "btm_ble_api_types.h"
 #include "embdrv/lc3/include/lc3.h"
+#include "internal_include/stack_config.h"
 #include "osi/include/properties.h"
 
 using bluetooth::le_audio::BasicAudioAnnouncementBisConfig;
@@ -223,6 +224,54 @@
     // Frame len.
     60);
 
+static const BroadcastCodecWrapper lc3_stereo_48_1 = BroadcastCodecWrapper(
+    kLeAudioCodecIdLc3,
+    // LeAudioCodecConfiguration
+    {.num_channels = LeAudioCodecConfiguration::kChannelNumberStereo,
+     .sample_rate = LeAudioCodecConfiguration::kSampleRate48000,
+     .bits_per_sample = LeAudioCodecConfiguration::kBitsPerSample16,
+     .data_interval_us = LeAudioCodecConfiguration::kInterval7500Us},
+    // Bitrate
+    80000,
+    // Frame len.
+    75);
+
+static const BroadcastCodecWrapper lc3_stereo_48_2 = BroadcastCodecWrapper(
+    kLeAudioCodecIdLc3,
+    // LeAudioCodecConfiguration
+    {.num_channels = LeAudioCodecConfiguration::kChannelNumberStereo,
+     .sample_rate = LeAudioCodecConfiguration::kSampleRate48000,
+     .bits_per_sample = LeAudioCodecConfiguration::kBitsPerSample16,
+     .data_interval_us = LeAudioCodecConfiguration::kInterval10000Us},
+    // Bitrate
+    80000,
+    // Frame len.
+    100);
+
+static const BroadcastCodecWrapper lc3_stereo_48_3 = BroadcastCodecWrapper(
+    kLeAudioCodecIdLc3,
+    // LeAudioCodecConfiguration
+    {.num_channels = LeAudioCodecConfiguration::kChannelNumberStereo,
+     .sample_rate = LeAudioCodecConfiguration::kSampleRate48000,
+     .bits_per_sample = LeAudioCodecConfiguration::kBitsPerSample16,
+     .data_interval_us = LeAudioCodecConfiguration::kInterval7500Us},
+    // Bitrate
+    96000,
+    // Frame len.
+    90);
+
+static const BroadcastCodecWrapper lc3_stereo_48_4 = BroadcastCodecWrapper(
+    kLeAudioCodecIdLc3,
+    // LeAudioCodecConfiguration
+    {.num_channels = LeAudioCodecConfiguration::kChannelNumberStereo,
+     .sample_rate = LeAudioCodecConfiguration::kSampleRate48000,
+     .bits_per_sample = LeAudioCodecConfiguration::kBitsPerSample16,
+     .data_interval_us = LeAudioCodecConfiguration::kInterval10000Us},
+    // Bitrate
+    96000,
+    // Frame len.
+    120);
+
 const std::map<uint32_t, uint8_t> sample_rate_to_sampling_freq_map = {
     {LeAudioCodecConfiguration::kSampleRate8000,
      codec_spec_conf::kLeAudioSamplingFreq8000Hz},
@@ -318,8 +367,12 @@
 
 static const BroadcastQosConfig qos_config_2_10 = BroadcastQosConfig(2, 10);
 
+static const BroadcastQosConfig qos_config_4_50 = BroadcastQosConfig(4, 50);
+
 static const BroadcastQosConfig qos_config_4_60 = BroadcastQosConfig(4, 60);
 
+static const BroadcastQosConfig qos_config_4_65 = BroadcastQosConfig(4, 65);
+
 std::ostream& operator<<(
     std::ostream& os, const le_audio::broadcaster::BroadcastQosConfig& config) {
   os << " BroadcastQosConfig=[";
@@ -344,44 +397,47 @@
 static const std::pair<const BroadcastCodecWrapper&, const BroadcastQosConfig&>
     lc3_stereo_24_2_2 = {lc3_stereo_24_2, qos_config_4_60};
 
+static const std::pair<const BroadcastCodecWrapper&, const BroadcastQosConfig&>
+    lc3_stereo_48_1_2 = {lc3_stereo_48_1, qos_config_4_50};
+
+static const std::pair<const BroadcastCodecWrapper&, const BroadcastQosConfig&>
+    lc3_stereo_48_2_2 = {lc3_stereo_48_2, qos_config_4_65};
+
+static const std::pair<const BroadcastCodecWrapper&, const BroadcastQosConfig&>
+    lc3_stereo_48_3_2 = {lc3_stereo_48_3, qos_config_4_50};
+
+static const std::pair<const BroadcastCodecWrapper&, const BroadcastQosConfig&>
+    lc3_stereo_48_4_2 = {lc3_stereo_48_4, qos_config_4_65};
+
 std::pair<const BroadcastCodecWrapper&, const BroadcastQosConfig&>
-getStreamConfigForContext(uint16_t context) {
+getStreamConfigForContext(types::AudioContexts context) {
+  const std::string* options =
+      stack_config_get_interface()->get_pts_broadcast_audio_config_options();
+  if (options) {
+    if (!options->compare("lc3_stereo_48_1_2")) return lc3_stereo_48_1_2;
+    if (!options->compare("lc3_stereo_48_2_2")) return lc3_stereo_48_2_2;
+    if (!options->compare("lc3_stereo_48_3_2")) return lc3_stereo_48_3_2;
+    if (!options->compare("lc3_stereo_48_4_2")) return lc3_stereo_48_4_2;
+  }
   // High quality, Low Latency
-  auto contexts_stereo_24_2_1 =
-      static_cast<std::underlying_type<LeAudioContextType>::type>(
-          LeAudioContextType::GAME) |
-      static_cast<std::underlying_type<LeAudioContextType>::type>(
-          LeAudioContextType::LIVE);
-  if (context & contexts_stereo_24_2_1) return lc3_stereo_24_2_1;
+  if (context.test_any(LeAudioContextType::GAME | LeAudioContextType::LIVE))
+    return lc3_stereo_24_2_1;
 
   // Low quality, Low Latency
-  auto contexts_mono_16_2_1 =
-      static_cast<std::underlying_type<LeAudioContextType>::type>(
-          LeAudioContextType::INSTRUCTIONAL);
-  if (context & contexts_mono_16_2_1) return lc3_mono_16_2_1;
+  if (context.test(LeAudioContextType::INSTRUCTIONAL)) return lc3_mono_16_2_1;
 
   // Low quality, High Reliability
-  auto contexts_stereo_16_2_2 =
-      static_cast<std::underlying_type<LeAudioContextType>::type>(
-          LeAudioContextType::SOUNDEFFECTS) |
-      static_cast<std::underlying_type<LeAudioContextType>::type>(
-          LeAudioContextType::UNSPECIFIED);
-  if (context & contexts_stereo_16_2_2) return lc3_stereo_16_2_2;
+  if (context.test_any(LeAudioContextType::SOUNDEFFECTS |
+                       LeAudioContextType::UNSPECIFIED))
+    return lc3_stereo_16_2_2;
 
-  auto contexts_mono_16_2_2 =
-      static_cast<std::underlying_type<LeAudioContextType>::type>(
-          LeAudioContextType::ALERTS) |
-      static_cast<std::underlying_type<LeAudioContextType>::type>(
-          LeAudioContextType::NOTIFICATIONS) |
-      static_cast<std::underlying_type<LeAudioContextType>::type>(
-          LeAudioContextType::EMERGENCYALARM);
-  if (context & contexts_mono_16_2_2) return lc3_mono_16_2_2;
+  if (context.test_any(LeAudioContextType::ALERTS |
+                       LeAudioContextType::NOTIFICATIONS |
+                       LeAudioContextType::EMERGENCYALARM))
+    return lc3_mono_16_2_2;
 
   // High quality, High Reliability
-  auto contexts_stereo_24_2_2 =
-      static_cast<std::underlying_type<LeAudioContextType>::type>(
-          LeAudioContextType::MEDIA);
-  if (context & contexts_stereo_24_2_2) return lc3_stereo_24_2_2;
+  if (context.test(LeAudioContextType::MEDIA)) return lc3_stereo_24_2_2;
 
   // Defaults: Low quality, High Reliability
   return lc3_mono_16_2_2;
diff --git a/system/bta/le_audio/broadcaster/broadcaster_types.h b/system/bta/le_audio/broadcaster/broadcaster_types.h
index 9e97da8..51824ab 100644
--- a/system/bta/le_audio/broadcaster/broadcaster_types.h
+++ b/system/bta/le_audio/broadcaster/broadcaster_types.h
@@ -19,7 +19,7 @@
 
 #include <variant>
 
-#include "bta/le_audio/client_audio.h"
+#include "bta/le_audio/audio_hal_client/audio_hal_client.h"
 #include "bta/le_audio/le_audio_types.h"
 #include "bta_le_audio_api.h"
 #include "bta_le_audio_broadcaster_api.h"
@@ -87,7 +87,7 @@
   }
 
   uint16_t GetMaxSduSize() const {
-    return GetNumChannels() * GetMaxSduSizePerChannel();
+    return GetNumChannelsPerBis() * GetMaxSduSizePerChannel();
   }
 
   const LeAudioCodecConfiguration& GetLeAudioCodecConfiguration() const {
@@ -112,6 +112,11 @@
     return source_codec_config.data_interval_us;
   }
 
+  uint8_t GetNumChannelsPerBis() const {
+    // TODO: Need to handle each BIS has more than one channel case
+    return 1;
+  }
+
  private:
   types::LeAudioCodecId codec_id;
   LeAudioCodecConfiguration source_codec_config;
@@ -148,7 +153,7 @@
     std::ostream& os, const le_audio::broadcaster::BroadcastQosConfig& config);
 
 std::pair<const BroadcastCodecWrapper&, const BroadcastQosConfig&>
-getStreamConfigForContext(uint16_t context);
+getStreamConfigForContext(types::AudioContexts context);
 
 }  // namespace broadcaster
 }  // namespace le_audio
diff --git a/system/bta/le_audio/broadcaster/mock_state_machine.h b/system/bta/le_audio/broadcaster/mock_state_machine.h
index 3b1532c..eb34673 100644
--- a/system/bta/le_audio/broadcaster/mock_state_machine.h
+++ b/system/bta/le_audio/broadcaster/mock_state_machine.h
@@ -131,6 +131,7 @@
   std::optional<le_audio::broadcaster::BigConfig> big_config_ = std::nullopt;
   le_audio::broadcaster::BroadcastStateMachineConfig cfg;
   le_audio::broadcaster::IBroadcastStateMachineCallbacks* cb;
+  void SetExpectedState(BroadcastStateMachine::State state) { SetState(state); }
   void SetExpectedResult(bool result) { result_ = result; }
   void SetExpectedBigConfig(
       std::optional<le_audio::broadcaster::BigConfig> big_cfg) {
diff --git a/system/bta/le_audio/broadcaster/state_machine.cc b/system/bta/le_audio/broadcaster/state_machine.cc
index 1014f9a..7cd20f4 100644
--- a/system/bta/le_audio/broadcaster/state_machine.cc
+++ b/system/bta/le_audio/broadcaster/state_machine.cc
@@ -40,6 +40,9 @@
 using bluetooth::hci::iso_manager::big_create_cmpl_evt;
 using bluetooth::hci::iso_manager::big_terminate_cmpl_evt;
 
+using le_audio::CodecManager;
+using le_audio::types::CodecLocation;
+
 using namespace le_audio::broadcaster;
 
 namespace {
@@ -290,10 +293,11 @@
       adv_params.advertising_event_properties = 0;
       adv_params.channel_map = bluetooth::kAdvertisingChannelAll;
       adv_params.adv_filter_policy = 0;
-      adv_params.tx_power = -15;
+      adv_params.tx_power = 8;
       adv_params.primary_advertising_phy = PHY_LE_1M;
       adv_params.secondary_advertising_phy = streaming_phy;
       adv_params.scan_request_notification_enable = 0;
+      adv_params.own_address_type = BLE_ADDR_RANDOM;
 
       periodic_params.max_interval = BroadcastStateMachine::kPaIntervalMax;
       periodic_params.min_interval = BroadcastStateMachine::kPaIntervalMin;
@@ -462,11 +466,17 @@
   void TriggerIsoDatapathSetup(uint16_t conn_handle) {
     LOG_INFO("conn_hdl=%d", conn_handle);
     LOG_ASSERT(active_config_ != std::nullopt);
+    auto data_path_id = bluetooth::hci::iso_manager::kIsoDataPathHci;
+    if (CodecManager::GetInstance()->GetCodecLocation() !=
+        CodecLocation::HOST) {
+      data_path_id = bluetooth::hci::iso_manager::kIsoDataPathPlatformDefault;
+    }
 
-    /* Note: For the LC3 software encoding on the Host side, the coding format
+    /* Note: If the LC3 encoding isn't in the controller side, the coding format
      * should be set to 'Transparent' and no codec configuration shall be sent
      * to the controller. 'codec_id_company' and 'codec_id_vendor' shall be
-     * ignored if 'codec_id_format' is not set to 'Vendor'.
+     * ignored if 'codec_id_format' is not set to 'Vendor'. We currently only
+     * support the codecLocation in the Host or ADSP side.
      */
     auto codec_id = sm_config_.codec_wrapper.GetLeAudioCodecId();
     uint8_t hci_coding_format =
@@ -475,7 +485,7 @@
             : bluetooth::hci::kIsoCodingFormatVendorSpecific;
     bluetooth::hci::iso_manager::iso_data_path_params param = {
         .data_path_dir = bluetooth::hci::iso_manager::kIsoDataPathDirectionIn,
-        .data_path_id = bluetooth::hci::iso_manager::kIsoDataPathHci,
+        .data_path_id = data_path_id,
         .codec_id_format = hci_coding_format,
         .codec_id_company = codec_id.vendor_company_id,
         .codec_id_vendor = codec_id.vendor_codec_id,
@@ -539,6 +549,10 @@
               .iso_interval = evt->iso_interval,
               .connection_handles = evt->conn_handles,
           };
+          if (CodecManager::GetInstance()->GetCodecLocation() ==
+              CodecLocation::ADSP) {
+            callbacks_->OnBigCreated(evt->conn_handles);
+          }
           TriggerIsoDatapathSetup(evt->conn_handles[0]);
         } else {
           LOG_ERROR(
diff --git a/system/bta/le_audio/broadcaster/state_machine.h b/system/bta/le_audio/broadcaster/state_machine.h
index c1cca06..e4d8eff 100644
--- a/system/bta/le_audio/broadcaster/state_machine.h
+++ b/system/bta/le_audio/broadcaster/state_machine.h
@@ -191,6 +191,7 @@
                                    const void* data = nullptr) = 0;
   virtual void OnOwnAddressResponse(uint32_t broadcast_id, uint8_t addr_type,
                                     RawAddress address) = 0;
+  virtual void OnBigCreated(const std::vector<uint16_t>& conn_handle) = 0;
 };
 
 std::ostream& operator<<(
diff --git a/system/bta/le_audio/broadcaster/state_machine_test.cc b/system/bta/le_audio/broadcaster/state_machine_test.cc
index d2a84ad..c634a8f 100644
--- a/system/bta/le_audio/broadcaster/state_machine_test.cc
+++ b/system/bta/le_audio/broadcaster/state_machine_test.cc
@@ -72,6 +72,8 @@
   MOCK_METHOD((void), OnOwnAddressResponse,
               (uint32_t broadcast_id, uint8_t addr_type, RawAddress addr),
               (override));
+  MOCK_METHOD((void), OnBigCreated, (const std::vector<uint16_t>& conn_handle),
+              (override));
 };
 
 class StateMachineTest : public Test {
@@ -242,10 +244,8 @@
 
     static uint8_t broadcast_id_lsb = 1;
 
-    auto context_int = static_cast<
-        std::underlying_type<le_audio::types::LeAudioContextType>::type>(
-        context);
-    auto codec_qos_pair = getStreamConfigForContext(context_int);
+    auto codec_qos_pair =
+        getStreamConfigForContext(types::AudioContexts(context));
     auto broadcast_id = broadcast_id_lsb++;
     pending_broadcasts_.push_back(BroadcastStateMachine::CreateInstance({
         .broadcast_id = broadcast_id,
@@ -855,12 +855,13 @@
             broadcasts_[broadcast_id]->GetBroadcastAnnouncement());
 }
 
-TEST_F(StateMachineTest, AnnouncementUUIDs) {
+TEST_F(StateMachineTest, AnnouncementTest) {
+  tBTM_BLE_ADV_PARAMS adv_params;
   std::vector<uint8_t> a_data;
   std::vector<uint8_t> p_data;
 
   EXPECT_CALL(*mock_ble_advertising_manager_, StartAdvertisingSet)
-      .WillOnce([&p_data, &a_data](
+      .WillOnce([&p_data, &a_data, &adv_params](
                     base::Callback<void(uint8_t, int8_t, uint8_t)> cb,
                     tBTM_BLE_ADV_PARAMS* params,
                     std::vector<uint8_t> advertise_data,
@@ -878,6 +879,8 @@
         a_data = std::move(advertise_data);
         p_data = std::move(periodic_data);
 
+        adv_params = *params;
+
         cb.Run(advertiser_id, tx_power, status);
       });
 
@@ -899,6 +902,9 @@
   ASSERT_EQ(p_data[1], 0x16);  // BTM_BLE_AD_TYPE_SERVICE_DATA_TYPE
   ASSERT_EQ(p_data[2], (kBasicAudioAnnouncementServiceUuid & 0x00FF));
   ASSERT_EQ(p_data[3], ((kBasicAudioAnnouncementServiceUuid >> 8) & 0x00FF));
+
+  // Check advertising parameters
+  ASSERT_EQ(adv_params.own_address_type, BLE_ADDR_RANDOM);
 }
 
 }  // namespace
diff --git a/system/bta/le_audio/client.cc b/system/bta/le_audio/client.cc
index f12a078..1d3cb3f 100644
--- a/system/bta/le_audio/client.cc
+++ b/system/bta/le_audio/client.cc
@@ -18,7 +18,11 @@
 #include <base/bind.h>
 #include <base/strings/string_number_conversions.h>
 
+#include <deque>
+#include <optional>
+
 #include "advertise_data_parser.h"
+#include "audio_hal_client/audio_hal_client.h"
 #include "audio_hal_interface/le_audio_software.h"
 #include "bta/csis/csis_types.h"
 #include "bta_api.h"
@@ -28,7 +32,6 @@
 #include "bta_le_audio_api.h"
 #include "btif_storage.h"
 #include "btm_iso_api.h"
-#include "client_audio.h"
 #include "client_parser.h"
 #include "codec_manager.h"
 #include "common/time_util.h"
@@ -38,8 +41,10 @@
 #include "embdrv/lc3/include/lc3.h"
 #include "gatt/bta_gattc_int.h"
 #include "gd/common/strings.h"
+#include "internal_include/stack_config.h"
 #include "le_audio_set_configuration_provider.h"
 #include "le_audio_types.h"
+#include "le_audio_utils.h"
 #include "metrics_collector.h"
 #include "osi/include/log.h"
 #include "osi/include/osi.h"
@@ -47,6 +52,7 @@
 #include "stack/btm/btm_sec.h"
 #include "stack/include/btu.h"  // do_in_main_thread
 #include "state_machine.h"
+#include "storage_helper.h"
 
 using base::Closure;
 using bluetooth::Uuid;
@@ -63,19 +69,28 @@
 using bluetooth::le_audio::GroupStreamStatus;
 using le_audio::CodecManager;
 using le_audio::ContentControlIdKeeper;
+using le_audio::DeviceConnectState;
+using le_audio::LeAudioCodecConfiguration;
 using le_audio::LeAudioDevice;
 using le_audio::LeAudioDeviceGroup;
 using le_audio::LeAudioDeviceGroups;
 using le_audio::LeAudioDevices;
 using le_audio::LeAudioGroupStateMachine;
+using le_audio::LeAudioSinkAudioHalClient;
+using le_audio::LeAudioSourceAudioHalClient;
 using le_audio::types::ase;
 using le_audio::types::AseState;
 using le_audio::types::AudioContexts;
 using le_audio::types::AudioLocations;
 using le_audio::types::AudioStreamDataPathState;
+using le_audio::types::BidirectionalPair;
 using le_audio::types::hdl_pair;
 using le_audio::types::kDefaultScanDurationS;
 using le_audio::types::LeAudioContextType;
+using le_audio::utils::GetAllCcids;
+using le_audio::utils::GetAllowedAudioContextsFromSinkMetadata;
+using le_audio::utils::GetAllowedAudioContextsFromSourceMetadata;
+using le_audio::utils::IsContextForAudioSource;
 
 using le_audio::client_parser::ascs::
     kCtpResponseCodeInvalidConfigurationParameterValue;
@@ -163,10 +178,8 @@
 
 class LeAudioClientImpl;
 LeAudioClientImpl* instance;
-LeAudioClientAudioSinkReceiver* audioSinkReceiver;
-LeAudioClientAudioSourceReceiver* audioSourceReceiver;
-LeAudioUnicastClientAudioSource* leAudioClientAudioSource;
-LeAudioUnicastClientAudioSink* leAudioClientAudioSink;
+LeAudioSourceAudioHalClient::Callbacks* audioSinkReceiver;
+LeAudioSinkAudioHalClient::Callbacks* audioSourceReceiver;
 CigCallbacks* stateMachineHciCallbacks;
 LeAudioGroupStateMachine::Callbacks* stateMachineCallbacks;
 DeviceGroupsCallbacks* device_group_callbacks;
@@ -204,8 +217,9 @@
 class LeAudioClientImpl : public LeAudioClient {
  public:
   ~LeAudioClientImpl() {
+    alarm_free(close_vbc_timeout_);
+    alarm_free(disable_timer_);
     alarm_free(suspend_timeout_);
-    suspend_timeout_ = nullptr;
   };
 
   LeAudioClientImpl(
@@ -215,11 +229,14 @@
       : gatt_if_(0),
         callbacks_(callbacks_),
         active_group_id_(bluetooth::groups::kGroupUnknown),
-        current_context_type_(LeAudioContextType::MEDIA),
+        configuration_context_type_(LeAudioContextType::UNINITIALIZED),
+        metadata_context_types_(
+            {sink : AudioContexts(), source : AudioContexts()}),
         stream_setup_start_timestamp_(0),
         stream_setup_end_timestamp_(0),
         audio_receiver_state_(AudioState::IDLE),
         audio_sender_state_(AudioState::IDLE),
+        in_call_(false),
         current_source_codec_config({0, 0, 0, 0}),
         current_sink_codec_config({0, 0, 0, 0}),
         lc3_encoder_left_mem(nullptr),
@@ -228,12 +245,23 @@
         lc3_decoder_right_mem(nullptr),
         lc3_decoder_left(nullptr),
         lc3_decoder_right(nullptr),
-        audio_source_instance_(nullptr),
-        audio_sink_instance_(nullptr),
-        suspend_timeout_(alarm_new("LeAudioSuspendTimeout")) {
+        le_audio_source_hal_client_(nullptr),
+        le_audio_sink_hal_client_(nullptr),
+        close_vbc_timeout_(alarm_new("LeAudioCloseVbcTimeout")),
+        suspend_timeout_(alarm_new("LeAudioSuspendTimeout")),
+        disable_timer_(alarm_new("LeAudioDisableTimer")) {
     LeAudioGroupStateMachine::Initialize(state_machine_callbacks_);
     groupStateMachine_ = LeAudioGroupStateMachine::Get();
 
+    if (bluetooth::common::InitFlags::
+            IsTargetedAnnouncementReconnectionMode()) {
+      LOG_INFO(" Reconnection mode: TARGETED_ANNOUNCEMENTS");
+      reconnection_mode_ = BTM_BLE_BKG_CONNECT_TARGETED_ANNOUNCEMENTS;
+    } else {
+      LOG_INFO(" Reconnection mode: ALLOW_LIST");
+      reconnection_mode_ = BTM_BLE_BKG_CONNECT_ALLOW_LIST;
+    }
+
     BTA_GATTC_AppRegister(
         le_audio_gattc_callback,
         base::Bind(
@@ -252,6 +280,69 @@
     DeviceGroups::Get()->Initialize(device_group_callbacks);
   }
 
+  void ReconfigureAfterVbcClose() {
+    LOG_DEBUG("VBC close timeout");
+
+    auto group = aseGroups_.FindById(active_group_id_);
+    if (!group) {
+      LOG_ERROR("Invalid group: %d", active_group_id_);
+      return;
+    }
+
+    /* For sonification events we don't really need to reconfigure to HQ
+     * configuration, but if the previous configuration was for HQ Media,
+     * we might want to go back to that scenario.
+     */
+
+    if ((configuration_context_type_ != LeAudioContextType::MEDIA) &&
+        (configuration_context_type_ != LeAudioContextType::GAME)) {
+      LOG_INFO(
+          "Keeping the old configuration as no HQ Media playback is needed "
+          "right now.");
+      return;
+    }
+
+    /* Test the existing metadata against the recent availability */
+    metadata_context_types_.sink &= group->GetAvailableContexts();
+    if (metadata_context_types_.sink.none()) {
+      LOG_WARN("invalid/unknown context metadata, using 'MEDIA' instead");
+      metadata_context_types_.sink = AudioContexts(LeAudioContextType::MEDIA);
+    }
+
+    /* Choose the right configuration context */
+    auto new_configuration_context =
+        ChooseConfigurationContextType(metadata_context_types_.sink);
+
+    LOG_DEBUG("new_configuration_context= %s",
+              ToString(new_configuration_context).c_str());
+    ReconfigureOrUpdateMetadata(group, new_configuration_context,
+                                metadata_context_types_.sink);
+  }
+
+  void StartVbcCloseTimeout() {
+    if (alarm_is_scheduled(close_vbc_timeout_)) {
+      StopVbcCloseTimeout();
+    }
+
+    static const uint64_t timeoutMs = 2000;
+    LOG_DEBUG("Start VBC close timeout with %lu ms",
+              static_cast<unsigned long>(timeoutMs));
+
+    alarm_set_on_mloop(
+        close_vbc_timeout_, timeoutMs,
+        [](void*) {
+          if (instance) instance->ReconfigureAfterVbcClose();
+        },
+        nullptr);
+  }
+
+  void StopVbcCloseTimeout() {
+    if (alarm_is_scheduled(close_vbc_timeout_)) {
+      LOG_DEBUG("Cancel VBC close timeout");
+      alarm_cancel(close_vbc_timeout_);
+    }
+  }
+
   void AseInitialStateReadRequest(LeAudioDevice* leAudioDevice) {
     int ases_num = leAudioDevice->ases_.size();
     void* notify_flag_ptr = NULL;
@@ -292,6 +383,16 @@
     group_add_node(group_id, address);
   }
 
+  /* If device participates in streaming the group, it has to be stopped and
+   * group needs to be reconfigured if needed to new configuration without
+   * considering this removing device.
+   */
+  void SetDeviceAsRemovePendingAndStopGroup(LeAudioDevice* leAudioDevice) {
+    LOG_INFO("device %s", leAudioDevice->address_.ToString().c_str());
+    leAudioDevice->SetConnectionState(DeviceConnectState::PENDING_REMOVAL);
+    GroupStop(leAudioDevice->group_id_);
+  }
+
   void OnGroupMemberAddedCb(const RawAddress& address, int group_id) {
     LOG(INFO) << __func__ << " address: " << address
               << " group_id: " << group_id;
@@ -319,8 +420,9 @@
 
     LeAudioDevice* leAudioDevice = leAudioDevices_.FindByAddress(address);
     if (!leAudioDevice) return;
-    if (leAudioDevice->group_id_ == bluetooth::groups::kGroupUnknown) {
-      LOG(INFO) << __func__ << " device already not assigned to the group.";
+    if (leAudioDevice->group_id_ != group_id) {
+      LOG_WARN("Device: %s not assigned to the group.",
+               leAudioDevice->address_.ToString().c_str());
       return;
     }
 
@@ -332,11 +434,12 @@
       return;
     }
 
-    group_remove_node(group, address);
-  }
+    if (leAudioDevice->HaveActiveAse()) {
+      SetDeviceAsRemovePendingAndStopGroup(leAudioDevice);
+      return;
+    }
 
-  int GetCcid(uint16_t context_type) {
-    return ContentControlIdKeeper::GetInstance()->GetCcid(context_type);
+    group_remove_node(group, address);
   }
 
   /* This callback happens if kLeAudioDeviceSetStateTimeoutMs timeout happens
@@ -357,6 +460,8 @@
         ToString(group->GetTargetState()).c_str());
     group->SetTargetState(AseState::BTA_LE_AUDIO_ASE_STATE_IDLE);
 
+    group->PrintDebugState();
+
     /* There is an issue with a setting up stream or any other operation which
      * are gatt operations. It means peer is not responsable. Lets close ACL
      */
@@ -380,34 +485,53 @@
 
   void UpdateContextAndLocations(LeAudioDeviceGroup* group,
                                  LeAudioDevice* leAudioDevice) {
-    std::optional<AudioContexts> new_group_updated_contexts =
-        group->UpdateActiveContextsMap(leAudioDevice->GetAvailableContexts());
+    if (leAudioDevice->GetConnectionState() != DeviceConnectState::CONNECTED) {
+      LOG_DEBUG("%s not yet connected ",
+                leAudioDevice->address_.ToString().c_str());
+      return;
+    }
 
-    if (new_group_updated_contexts || group->ReloadAudioLocations()) {
+    /* Make sure location and direction are updated for the group. */
+    auto location_update = group->ReloadAudioLocations();
+    group->ReloadAudioDirections();
+
+    auto contexts_updated = group->UpdateAudioContextTypeAvailability(
+        leAudioDevice->GetAvailableContexts());
+
+    if (contexts_updated || location_update) {
       callbacks_->OnAudioConf(group->audio_directions_, group->group_id_,
                               group->snk_audio_locations_.to_ulong(),
                               group->src_audio_locations_.to_ulong(),
-                              group->GetActiveContexts().to_ulong());
+                              group->GetAvailableContexts().value());
     }
   }
 
   void SuspendedForReconfiguration() {
     if (audio_sender_state_ > AudioState::IDLE) {
-      leAudioClientAudioSource->SuspendedForReconfiguration();
+      le_audio_source_hal_client_->SuspendedForReconfiguration();
     }
     if (audio_receiver_state_ > AudioState::IDLE) {
-      leAudioClientAudioSink->SuspendedForReconfiguration();
+      le_audio_sink_hal_client_->SuspendedForReconfiguration();
+    }
+  }
+
+  void ReconfigurationComplete(uint8_t directions) {
+    if (directions & le_audio::types::kLeAudioDirectionSink) {
+      le_audio_source_hal_client_->ReconfigurationComplete();
+    }
+    if (directions & le_audio::types::kLeAudioDirectionSource) {
+      le_audio_sink_hal_client_->ReconfigurationComplete();
     }
   }
 
   void CancelStreamingRequest() {
     if (audio_sender_state_ >= AudioState::READY_TO_START) {
-      leAudioClientAudioSource->CancelStreamingRequest();
+      le_audio_source_hal_client_->CancelStreamingRequest();
       audio_sender_state_ = AudioState::IDLE;
     }
 
     if (audio_receiver_state_ >= AudioState::READY_TO_START) {
-      leAudioClientAudioSink->CancelStreamingRequest();
+      le_audio_sink_hal_client_->CancelStreamingRequest();
       audio_receiver_state_ = AudioState::IDLE;
     }
   }
@@ -451,7 +575,7 @@
       if (group_id == bluetooth::groups::kGroupUnknown) return;
 
       LOG(INFO) << __func__ << "Set member adding ...";
-      leAudioDevices_.Add(address, true);
+      leAudioDevices_.Add(address, DeviceConnectState::CONNECTING_BY_USER);
       leAudioDevice = leAudioDevices_.FindByAddress(address);
     } else {
       if (leAudioDevice->group_id_ != bluetooth::groups::kGroupUnknown) {
@@ -507,18 +631,18 @@
     /* Group may be destroyed once moved its last node to new group */
     if (aseGroups_.FindById(old_group_id) != nullptr) {
       /* Removing node from group may touch its context integrity */
-      std::optional<AudioContexts> old_group_updated_contexts =
-          old_group->UpdateActiveContextsMap(old_group->GetActiveContexts());
+      auto contexts_updated = old_group->UpdateAudioContextTypeAvailability(
+          old_group->GetAvailableContexts());
 
       bool group_conf_changed = old_group->ReloadAudioLocations();
       group_conf_changed |= old_group->ReloadAudioDirections();
-      group_conf_changed |= old_group_updated_contexts.has_value();
+      group_conf_changed |= contexts_updated;
 
       if (group_conf_changed) {
         callbacks_->OnAudioConf(old_group->audio_directions_, old_group_id,
                                 old_group->snk_audio_locations_.to_ulong(),
                                 old_group->src_audio_locations_.to_ulong(),
-                                old_group->GetActiveContexts().to_ulong());
+                                old_group->GetAvailableContexts().value());
       }
     }
 
@@ -574,18 +698,18 @@
     }
 
     /* Removing node from group touch its context integrity */
-    std::optional<AudioContexts> updated_contexts =
-        group->UpdateActiveContextsMap(group->GetActiveContexts());
+    bool contexts_updated = group->UpdateAudioContextTypeAvailability(
+        group->GetAvailableContexts());
 
     bool group_conf_changed = group->ReloadAudioLocations();
     group_conf_changed |= group->ReloadAudioDirections();
-    group_conf_changed |= updated_contexts.has_value();
+    group_conf_changed |= contexts_updated;
 
     if (group_conf_changed)
       callbacks_->OnAudioConf(group->audio_directions_, group->group_id_,
                               group->snk_audio_locations_.to_ulong(),
                               group->src_audio_locations_.to_ulong(),
-                              group->GetActiveContexts().to_ulong());
+                              group->GetAvailableContexts().value());
   }
 
   void GroupRemoveNode(const int group_id, const RawAddress& address) override {
@@ -612,17 +736,70 @@
       return;
     }
 
+    if (leAudioDevice->HaveActiveAse()) {
+      SetDeviceAsRemovePendingAndStopGroup(leAudioDevice);
+      return;
+    }
+
     group_remove_node(group, address, true);
   }
 
-  bool InternalGroupStream(const int group_id, const uint16_t context_type) {
+  AudioContexts ChooseMetadataContextType(AudioContexts metadata_context_type) {
+    /* This function takes already filtered contexts which we are plannig to use
+     * in the Enable or UpdateMetadata command.
+     * Note we are not changing stream configuration here, but just the list of
+     * the contexts in the Metadata which will be provide to remote side.
+     * Ideally, we should send all the bits we have, but not all headsets like
+     * it.
+     */
+    if (osi_property_get_bool(kAllowMultipleContextsInMetadata, true)) {
+      return metadata_context_type;
+    }
+
+    LOG_DEBUG("Converting to single context type: %s",
+              metadata_context_type.to_string().c_str());
+
+    /* Mini policy */
+    if (metadata_context_type.any()) {
+      LeAudioContextType context_priority_list[] = {
+          /* Highest priority first */
+          LeAudioContextType::CONVERSATIONAL,
+          LeAudioContextType::RINGTONE,
+          LeAudioContextType::LIVE,
+          LeAudioContextType::VOICEASSISTANTS,
+          LeAudioContextType::GAME,
+          LeAudioContextType::MEDIA,
+          LeAudioContextType::EMERGENCYALARM,
+          LeAudioContextType::ALERTS,
+          LeAudioContextType::INSTRUCTIONAL,
+          LeAudioContextType::NOTIFICATIONS,
+          LeAudioContextType::SOUNDEFFECTS,
+      };
+      for (auto ct : context_priority_list) {
+        if (metadata_context_type.test(ct)) {
+          LOG_DEBUG("Converted to single context type: %s",
+                    ToString(ct).c_str());
+          return AudioContexts(ct);
+        }
+      }
+    }
+
+    /* Fallback to BAP mandated context type */
+    LOG_WARN("Invalid/unknown context, using 'UNSPECIFIED'");
+    return AudioContexts(LeAudioContextType::UNSPECIFIED);
+  }
+
+  bool GroupStream(const int group_id, LeAudioContextType context_type,
+                   AudioContexts metadata_context_type) {
     LeAudioDeviceGroup* group = aseGroups_.FindById(group_id);
     auto final_context_type = context_type;
 
+    auto adjusted_metadata_context_type =
+        ChooseMetadataContextType(metadata_context_type);
     DLOG(INFO) << __func__;
-    if (context_type >= static_cast<uint16_t>(LeAudioContextType::RFU)) {
+    if (context_type >= LeAudioContextType::RFU) {
       LOG(ERROR) << __func__ << ", stream context type is not supported: "
-                 << loghex(context_type);
+                 << ToHexString(context_type);
       return false;
     }
 
@@ -631,12 +808,14 @@
       return false;
     }
 
-    auto supported_context_type = group->GetActiveContexts();
-    if (!(context_type & supported_context_type.to_ulong())) {
+    LOG_DEBUG("group state=%s, target_state=%s",
+              ToString(group->GetState()).c_str(),
+              ToString(group->GetTargetState()).c_str());
+
+    if (!group->GetAvailableContexts().test(context_type)) {
       LOG(ERROR) << " Unsupported context type by remote device: "
-                 << loghex(context_type) << ". Switching to unspecified";
-      final_context_type =
-          static_cast<uint16_t>(LeAudioContextType::UNSPECIFIED);
+                 << ToHexString(context_type) << ". Switching to unspecified";
+      final_context_type = LeAudioContextType::UNSPECIFIED;
     }
 
     if (!group->IsAnyDeviceConnected()) {
@@ -645,24 +824,40 @@
     }
 
     /* Check if any group is in the transition state. If so, we don't allow to
-     * start new group to stream */
-    if (aseGroups_.IsAnyInTransition()) {
-      LOG(INFO) << __func__ << " some group is already in the transition state";
+     * start new group to stream
+     */
+    if (group->IsInTransition()) {
+      /* WARNING: Due to group state machine limitations, we should not
+       * interrupt any ongoing transition. We will check if another
+       * reconfiguration is needed once the group reaches streaming state.
+       */
+      LOG_WARN(
+          "Group is already in the transition state. Waiting for the target "
+          "state to be reached.");
       return false;
     }
 
-    bool result = groupStateMachine_->StartStream(
-        group, static_cast<LeAudioContextType>(final_context_type),
-        GetCcid(final_context_type));
-    if (result)
+    if (group->IsPendingConfiguration()) {
+      LOG_WARN("Group %d is reconfiguring right now. Drop the update",
+               group->group_id_);
+      return false;
+    }
+
+    if (group->GetState() != AseState::BTA_LE_AUDIO_ASE_STATE_STREAMING) {
       stream_setup_start_timestamp_ =
           bluetooth::common::time_get_os_boottime_us();
+    }
+
+    bool result = groupStateMachine_->StartStream(
+        group, final_context_type, adjusted_metadata_context_type,
+        GetAllCcids(adjusted_metadata_context_type));
 
     return result;
   }
 
   void GroupStream(const int group_id, const uint16_t context_type) override {
-    InternalGroupStream(group_id, context_type);
+    GroupStream(group_id, LeAudioContextType(context_type),
+                AudioContexts(context_type));
   }
 
   void GroupSuspend(const int group_id) override {
@@ -747,17 +942,22 @@
     ContentControlIdKeeper::GetInstance()->SetCcid(context_type, ccid);
   }
 
+  void SetInCall(bool in_call) override {
+    LOG_DEBUG("in_call: %d", in_call);
+    in_call_ = in_call;
+  }
+
   void StartAudioSession(LeAudioDeviceGroup* group,
-                          LeAudioCodecConfiguration* source_config,
-                          LeAudioCodecConfiguration* sink_config) {
+                         LeAudioCodecConfiguration* source_config,
+                         LeAudioCodecConfiguration* sink_config) {
     /* This function is called when group is not yet set to active.
      * This is why we don't have to check if session is started already.
      * Just check if it is acquired.
      */
     ASSERT_LOG(active_group_id_ == bluetooth::groups::kGroupUnknown,
                "Active group is not set.");
-    ASSERT_LOG(audio_source_instance_, "Source session not acquired");
-    ASSERT_LOG(audio_sink_instance_, "Sink session not acquired");
+    ASSERT_LOG(le_audio_source_hal_client_, "Source session not acquired");
+    ASSERT_LOG(le_audio_sink_hal_client_, "Sink session not acquired");
 
     /* We assume that peer device always use same frame duration */
     uint32_t frame_duration_us = 0;
@@ -770,8 +970,8 @@
     }
 
     audio_framework_source_config.data_interval_us = frame_duration_us;
-    leAudioClientAudioSource->Start(audio_framework_source_config,
-                                    audioSinkReceiver);
+    le_audio_source_hal_client_->Start(audio_framework_source_config,
+                                       audioSinkReceiver);
 
     /* We use same frame duration for sink/source */
     audio_framework_sink_config.data_interval_us = frame_duration_us;
@@ -789,8 +989,8 @@
       audio_framework_sink_config.sample_rate = sink_configuration->sample_rate;
     }
 
-    leAudioClientAudioSink->Start(audio_framework_sink_config,
-                                  audioSourceReceiver);
+    le_audio_sink_hal_client_->Start(audio_framework_sink_config,
+                                     audioSourceReceiver);
   }
 
   void GroupSetActive(const int group_id) override {
@@ -802,15 +1002,16 @@
         return;
       }
 
+      auto group_id_to_close = active_group_id_;
+      active_group_id_ = bluetooth::groups::kGroupUnknown;
+
       if (alarm_is_scheduled(suspend_timeout_)) alarm_cancel(suspend_timeout_);
 
       StopAudio();
       ClientAudioIntefraceRelease();
 
-      GroupStop(active_group_id_);
-      callbacks_->OnGroupStatus(active_group_id_, GroupStatus::INACTIVE);
-      active_group_id_ = group_id;
-
+      GroupStop(group_id_to_close);
+      callbacks_->OnGroupStatus(group_id_to_close, GroupStatus::INACTIVE);
       return;
     }
 
@@ -831,24 +1032,24 @@
       LOG(INFO) << __func__ << ", switching active group to: " << group_id;
     }
 
-    if (!audio_source_instance_) {
-      audio_source_instance_ = leAudioClientAudioSource->Acquire();
-      if (!audio_source_instance_) {
+    if (!le_audio_source_hal_client_) {
+      le_audio_source_hal_client_ =
+          LeAudioSourceAudioHalClient::AcquireUnicast();
+      if (!le_audio_source_hal_client_) {
         LOG(ERROR) << __func__ << ", could not acquire audio source interface";
         return;
       }
     }
 
-    if (!audio_sink_instance_) {
-      audio_sink_instance_ = leAudioClientAudioSink->Acquire();
-      if (!audio_sink_instance_) {
+    if (!le_audio_sink_hal_client_) {
+      le_audio_sink_hal_client_ = LeAudioSinkAudioHalClient::AcquireUnicast();
+      if (!le_audio_sink_hal_client_) {
         LOG(ERROR) << __func__ << ", could not acquire audio sink interface";
-        leAudioClientAudioSource->Release(audio_source_instance_);
         return;
       }
     }
 
-    /* Try configure audio HAL sessions with most frequent context.
+    /* Mini policy: Try configure audio HAL sessions with most frequent context.
      * If reconfiguration is not needed it means, context type is not supported.
      * If most frequest scenario is not supported, try to find first supported.
      */
@@ -875,10 +1076,11 @@
     if (active_group_id_ == bluetooth::groups::kGroupUnknown) {
       /* Expose audio sessions if there was no previous active group */
       StartAudioSession(group, &current_source_codec_config,
-                         &current_sink_codec_config);
+                        &current_sink_codec_config);
     } else {
       /* In case there was an active group. Stop the stream */
       GroupStop(active_group_id_);
+      callbacks_->OnGroupStatus(active_group_id_, GroupStatus::INACTIVE);
     }
 
     active_group_id_ = group_id;
@@ -893,7 +1095,7 @@
 
     if (leAudioDevice->conn_id_ != GATT_INVALID_CONN_ID) {
       Disconnect(address);
-      leAudioDevice->removing_device_ = true;
+      leAudioDevice->SetConnectionState(DeviceConnectState::REMOVING);
       return;
     }
 
@@ -912,16 +1114,25 @@
   void Connect(const RawAddress& address) override {
     LeAudioDevice* leAudioDevice = leAudioDevices_.FindByAddress(address);
     if (!leAudioDevice) {
-      leAudioDevices_.Add(address, true);
+      leAudioDevices_.Add(address, DeviceConnectState::CONNECTING_BY_USER);
     } else {
-      leAudioDevice->connecting_actively_ = true;
+      auto current_connect_state = leAudioDevice->GetConnectionState();
+      if ((current_connect_state == DeviceConnectState::CONNECTED) ||
+          (current_connect_state == DeviceConnectState::CONNECTING_BY_USER)) {
+        LOG_ERROR("Device %s is in invalid state: %s",
+                  leAudioDevice->address_.ToString().c_str(),
+                  bluetooth::common::ToString(current_connect_state).c_str());
+
+        return;
+      }
+      leAudioDevice->SetConnectionState(DeviceConnectState::CONNECTING_BY_USER);
 
       le_audio::MetricsCollector::Get()->OnConnectionStateChanged(
           leAudioDevice->group_id_, address, ConnectionState::CONNECTING,
           le_audio::ConnectionStatus::SUCCESS);
     }
 
-    BTA_GATTC_Open(gatt_if_, address, true, false);
+    BTA_GATTC_Open(gatt_if_, address, BTM_BLE_DIRECT_CONNECTION, false);
   }
 
   std::vector<RawAddress> GetGroupDevices(const int group_id) override {
@@ -940,25 +1151,108 @@
   }
 
   /* Restore paired device from storage to recreate groups */
-  void AddFromStorage(const RawAddress& address, bool autoconnect) {
+  void AddFromStorage(const RawAddress& address, bool autoconnect,
+                      int sink_audio_location, int source_audio_location,
+                      int sink_supported_context_types,
+                      int source_supported_context_types,
+                      const std::vector<uint8_t>& handles,
+                      const std::vector<uint8_t>& sink_pacs,
+                      const std::vector<uint8_t>& source_pacs,
+                      const std::vector<uint8_t>& ases) {
     LeAudioDevice* leAudioDevice = leAudioDevices_.FindByAddress(address);
 
-    LOG(INFO) << __func__ << ", restoring: " << address;
-
-    if (!leAudioDevice) {
-      leAudioDevices_.Add(address, false);
-      leAudioDevice = leAudioDevices_.FindByAddress(address);
+    if (leAudioDevice) {
+      LOG_ERROR("Device is already loaded. Nothing to do.");
+      return;
     }
 
+    LOG_INFO(
+        "restoring: %s, autoconnect %d, sink_audio_location: %d, "
+        "source_audio_location: %d, sink_supported_context_types : 0x%04x, "
+        "source_supported_context_types 0x%04x ",
+        address.ToString().c_str(), autoconnect, sink_audio_location,
+        source_audio_location, sink_supported_context_types,
+        source_supported_context_types);
+
+    leAudioDevices_.Add(address, DeviceConnectState::DISCONNECTED);
+    leAudioDevice = leAudioDevices_.FindByAddress(address);
+
     int group_id = DeviceGroups::Get()->GetGroupId(
         address, le_audio::uuid::kCapServiceUuid);
     if (group_id != bluetooth::groups::kGroupUnknown) {
       group_add_node(group_id, address);
     }
 
-    if (autoconnect) {
-      BTA_GATTC_Open(gatt_if_, address, false, false);
+    leAudioDevice->snk_audio_locations_ = sink_audio_location;
+    if (sink_audio_location != 0) {
+      leAudioDevice->audio_directions_ |=
+          le_audio::types::kLeAudioDirectionSink;
     }
+
+    callbacks_->OnSinkAudioLocationAvailable(
+        leAudioDevice->address_,
+        leAudioDevice->snk_audio_locations_.to_ulong());
+
+    leAudioDevice->src_audio_locations_ = source_audio_location;
+    if (source_audio_location != 0) {
+      leAudioDevice->audio_directions_ |=
+          le_audio::types::kLeAudioDirectionSource;
+    }
+
+    leAudioDevice->SetSupportedContexts(
+        AudioContexts(sink_supported_context_types),
+        AudioContexts(source_supported_context_types));
+
+    /* Use same as or supported ones for now. */
+    leAudioDevice->SetAvailableContexts(
+        AudioContexts(sink_supported_context_types),
+        AudioContexts(source_supported_context_types));
+
+    if (!DeserializeHandles(leAudioDevice, handles)) {
+      LOG_WARN("Could not load Handles");
+    }
+
+    if (!DeserializeSinkPacs(leAudioDevice, sink_pacs)) {
+      LOG_WARN("Could not load sink pacs");
+    }
+
+    if (!DeserializeSourcePacs(leAudioDevice, source_pacs)) {
+      LOG_WARN("Could not load source pacs");
+    }
+
+    if (!DeserializeAses(leAudioDevice, ases)) {
+      LOG_WARN("Could not load ases");
+    }
+
+    leAudioDevice->autoconnect_flag_ = autoconnect;
+    /* When adding from storage, make sure that autoconnect is used
+     * by all the devices in the group.
+     */
+    leAudioDevices_.SetInitialGroupAutoconnectState(
+        group_id, gatt_if_, reconnection_mode_, autoconnect);
+  }
+
+  bool GetHandlesForStorage(const RawAddress& addr, std::vector<uint8_t>& out) {
+    LeAudioDevice* leAudioDevice = leAudioDevices_.FindByAddress(addr);
+    return SerializeHandles(leAudioDevice, out);
+  }
+
+  bool GetSinkPacsForStorage(const RawAddress& addr,
+                             std::vector<uint8_t>& out) {
+    LeAudioDevice* leAudioDevice = leAudioDevices_.FindByAddress(addr);
+    return SerializeSinkPacs(leAudioDevice, out);
+  }
+
+  bool GetSourcePacsForStorage(const RawAddress& addr,
+                               std::vector<uint8_t>& out) {
+    LeAudioDevice* leAudioDevice = leAudioDevices_.FindByAddress(addr);
+    return SerializeSourcePacs(leAudioDevice, out);
+  }
+
+  bool GetAsesForStorage(const RawAddress& addr, std::vector<uint8_t>& out) {
+    LeAudioDevice* leAudioDevice = leAudioDevices_.FindByAddress(addr);
+
+    return SerializeAses(leAudioDevice, out);
   }
 
   void BackgroundConnectIfGroupConnected(LeAudioDevice* leAudioDevice) {
@@ -975,11 +1269,14 @@
       return;
     }
 
-    DLOG(INFO) << __func__ << "Add " << leAudioDevice->address_
+    DLOG(INFO) << __func__ << " Add " << leAudioDevice->address_
                << " to background connect to connected group: "
                << leAudioDevice->group_id_;
 
-    BTA_GATTC_Open(gatt_if_, leAudioDevice->address_, false, false);
+    leAudioDevice->SetConnectionState(
+        DeviceConnectState::CONNECTING_AUTOCONNECT);
+    BTA_GATTC_Open(gatt_if_, leAudioDevice->address_, reconnection_mode_,
+                   false);
   }
 
   void Disconnect(const RawAddress& address) override {
@@ -992,20 +1289,42 @@
     }
 
     /* cancel pending direct connect */
-    if (leAudioDevice->connecting_actively_) {
+    if (leAudioDevice->GetConnectionState() ==
+        DeviceConnectState::CONNECTING_BY_USER) {
       BTA_GATTC_CancelOpen(gatt_if_, address, true);
-      leAudioDevice->connecting_actively_ = false;
     }
 
     /* Removes all registrations for connection */
     BTA_GATTC_CancelOpen(0, address, false);
 
     if (leAudioDevice->conn_id_ != GATT_INVALID_CONN_ID) {
-      /* User is disconnecting the device, we shall remove the autoconnect flag
+      /* User is disconnecting the device, we shall remove the autoconnect
+       * flag for this device and all others
        */
-      btif_storage_set_leaudio_autoconnect(address, false);
+      LOG_INFO("Removing autoconnect flag for group_id %d",
+               leAudioDevice->group_id_);
 
       auto group = aseGroups_.FindById(leAudioDevice->group_id_);
+
+      if (leAudioDevice->autoconnect_flag_) {
+        btif_storage_set_leaudio_autoconnect(address, false);
+        leAudioDevice->autoconnect_flag_ = false;
+      }
+
+      if (group) {
+        /* Remove devices from auto connect mode */
+        for (auto dev = group->GetFirstDevice(); dev;
+             dev = group->GetNextDevice(dev)) {
+          if (dev->GetConnectionState() ==
+              DeviceConnectState::CONNECTING_AUTOCONNECT) {
+            btif_storage_set_leaudio_autoconnect(address, false);
+            dev->autoconnect_flag_ = false;
+            BTA_GATTC_CancelOpen(gatt_if_, address, false);
+            dev->SetConnectionState(DeviceConnectState::DISCONNECTED);
+          }
+        }
+      }
+
       if (group &&
           group->GetState() ==
               le_audio::types::AseState::BTA_LE_AUDIO_ASE_STATE_STREAMING) {
@@ -1029,14 +1348,17 @@
       return;
     }
 
-    if (acl_force_disconnect) {
-     leAudioDevice->DisconnectAcl();
-     return;
-    }
+    leAudioDevice->SetConnectionState(DeviceConnectState::DISCONNECTING);
 
     BtaGattQueue::Clean(leAudioDevice->conn_id_);
     BTA_GATTC_Close(leAudioDevice->conn_id_);
     leAudioDevice->conn_id_ = GATT_INVALID_CONN_ID;
+    leAudioDevice->mtu_ = 0;
+
+    /* Remote in bad state, force ACL Disconnection. */
+    if (acl_force_disconnect) {
+      leAudioDevice->DisconnectAcl();
+    }
   }
 
   void DeregisterNotifications(LeAudioDevice* leAudioDevice) {
@@ -1079,7 +1401,7 @@
    * are dispatched to correct elements e.g. ASEs, PACs, audio locations etc.
    */
   void LeAudioCharValueHandle(uint16_t conn_id, uint16_t hdl, uint16_t len,
-                              uint8_t* value) {
+                              uint8_t* value, bool notify = false) {
     LeAudioDevice* leAudioDevice = leAudioDevices_.FindByConnId(conn_id);
     struct ase* ase;
 
@@ -1106,7 +1428,7 @@
       std::vector<struct le_audio::types::acs_ac_record> pac_recs;
 
       /* Guard consistency of PAC records structure */
-      if (!le_audio::client_parser::pacs::ParsePac(pac_recs, len, value))
+      if (!le_audio::client_parser::pacs::ParsePacs(pac_recs, len, value))
         return;
 
       LOG(INFO) << __func__ << ", Registering sink PACs";
@@ -1115,17 +1437,20 @@
       /* Update supported context types including internal capabilities */
       LeAudioDeviceGroup* group = aseGroups_.FindById(leAudioDevice->group_id_);
 
-      /* Active context map should be considered to be updated in response to
+      /* Available context map should be considered to be updated in response to
        * PACs update.
        * Read of available context during initial attribute discovery.
        * Group would be assigned once service search is completed.
        */
-      if (group && group->UpdateActiveContextsMap(
+      if (group && group->UpdateAudioContextTypeAvailability(
                        leAudioDevice->GetAvailableContexts())) {
         callbacks_->OnAudioConf(group->audio_directions_, group->group_id_,
                                 group->snk_audio_locations_.to_ulong(),
                                 group->src_audio_locations_.to_ulong(),
-                                group->GetActiveContexts().to_ulong());
+                                group->GetAvailableContexts().value());
+      }
+      if (notify) {
+        btif_storage_leaudio_update_pacs_bin(leAudioDevice->address_);
       }
       return;
     }
@@ -1137,7 +1462,7 @@
       std::vector<struct le_audio::types::acs_ac_record> pac_recs;
 
       /* Guard consistency of PAC records structure */
-      if (!le_audio::client_parser::pacs::ParsePac(pac_recs, len, value))
+      if (!le_audio::client_parser::pacs::ParsePacs(pac_recs, len, value))
         return;
 
       LOG(INFO) << __func__ << ", Registering source PACs";
@@ -1146,17 +1471,21 @@
       /* Update supported context types including internal capabilities */
       LeAudioDeviceGroup* group = aseGroups_.FindById(leAudioDevice->group_id_);
 
-      /* Active context map should be considered to be updated in response to
+      /* Available context map should be considered to be updated in response to
        * PACs update.
        * Read of available context during initial attribute discovery.
        * Group would be assigned once service search is completed.
        */
-      if (group && group->UpdateActiveContextsMap(
+      if (group && group->UpdateAudioContextTypeAvailability(
                        leAudioDevice->GetAvailableContexts())) {
         callbacks_->OnAudioConf(group->audio_directions_, group->group_id_,
                                 group->snk_audio_locations_.to_ulong(),
                                 group->src_audio_locations_.to_ulong(),
-                                group->GetActiveContexts().to_ulong());
+                                group->GetAvailableContexts().value());
+      }
+
+      if (notify) {
+        btif_storage_leaudio_update_pacs_bin(leAudioDevice->address_);
       }
       return;
     }
@@ -1183,6 +1512,14 @@
       LeAudioDeviceGroup* group = aseGroups_.FindById(leAudioDevice->group_id_);
       callbacks_->OnSinkAudioLocationAvailable(leAudioDevice->address_,
                                                snk_audio_locations.to_ulong());
+
+      if (notify) {
+        btif_storage_set_leaudio_audio_location(
+            leAudioDevice->address_,
+            leAudioDevice->snk_audio_locations_.to_ulong(),
+            leAudioDevice->src_audio_locations_.to_ulong());
+      }
+
       /* Read of source audio locations during initial attribute discovery.
        * Group would be assigned once service search is completed.
        */
@@ -1195,7 +1532,7 @@
         callbacks_->OnAudioConf(group->audio_directions_, group->group_id_,
                                 group->snk_audio_locations_.to_ulong(),
                                 group->src_audio_locations_.to_ulong(),
-                                group->GetActiveContexts().to_ulong());
+                                group->GetAvailableContexts().value());
       }
     } else if (hdl == leAudioDevice->src_audio_locations_hdls_.val_hdl) {
       AudioLocations src_audio_locations;
@@ -1217,6 +1554,14 @@
       leAudioDevice->src_audio_locations_ = src_audio_locations;
 
       LeAudioDeviceGroup* group = aseGroups_.FindById(leAudioDevice->group_id_);
+
+      if (notify) {
+        btif_storage_set_leaudio_audio_location(
+            leAudioDevice->address_,
+            leAudioDevice->snk_audio_locations_.to_ulong(),
+            leAudioDevice->src_audio_locations_.to_ulong());
+      }
+
       /* Read of source audio locations during initial attribute discovery.
        * Group would be assigned once service search is completed.
        */
@@ -1229,21 +1574,20 @@
         callbacks_->OnAudioConf(group->audio_directions_, group->group_id_,
                                 group->snk_audio_locations_.to_ulong(),
                                 group->src_audio_locations_.to_ulong(),
-                                group->GetActiveContexts().to_ulong());
+                                group->GetAvailableContexts().value());
       }
     } else if (hdl == leAudioDevice->audio_avail_hdls_.val_hdl) {
-      auto avail_audio_contexts = std::make_unique<
-          struct le_audio::client_parser::pacs::acs_available_audio_contexts>();
-
+      le_audio::client_parser::pacs::acs_available_audio_contexts
+          avail_audio_contexts;
       le_audio::client_parser::pacs::ParseAvailableAudioContexts(
-          *avail_audio_contexts, len, value);
+          avail_audio_contexts, len, value);
 
       auto updated_avail_contexts = leAudioDevice->SetAvailableContexts(
-          avail_audio_contexts->snk_avail_cont,
-          avail_audio_contexts->src_avail_cont);
+          avail_audio_contexts.snk_avail_cont,
+          avail_audio_contexts.src_avail_cont);
 
       if (updated_avail_contexts.any()) {
-        /* Update scenario map considering changed active context types */
+        /* Update scenario map considering changed available context types */
         LeAudioDeviceGroup* group =
             aseGroups_.FindById(leAudioDevice->group_id_);
         /* Read of available context during initial attribute discovery.
@@ -1257,29 +1601,33 @@
           if (group->IsInTransition() ||
               (group->GetState() ==
                AseState::BTA_LE_AUDIO_ASE_STATE_STREAMING)) {
-            group->SetPendingUpdateAvailableContexts(updated_avail_contexts);
+            group->SetPendingAvailableContextsChange(updated_avail_contexts);
             return;
           }
 
-          std::optional<AudioContexts> updated_contexts =
-              group->UpdateActiveContextsMap(updated_avail_contexts);
-          if (updated_contexts) {
+          auto contexts_updated =
+              group->UpdateAudioContextTypeAvailability(updated_avail_contexts);
+          if (contexts_updated) {
             callbacks_->OnAudioConf(group->audio_directions_, group->group_id_,
                                     group->snk_audio_locations_.to_ulong(),
                                     group->src_audio_locations_.to_ulong(),
-                                    group->GetActiveContexts().to_ulong());
+                                    group->GetAvailableContexts().value());
           }
         }
       }
     } else if (hdl == leAudioDevice->audio_supp_cont_hdls_.val_hdl) {
-      auto supp_audio_contexts = std::make_unique<
-          struct le_audio::client_parser::pacs::acs_supported_audio_contexts>();
-
+      le_audio::client_parser::pacs::acs_supported_audio_contexts
+          supp_audio_contexts;
       le_audio::client_parser::pacs::ParseSupportedAudioContexts(
-          *supp_audio_contexts, len, value);
+          supp_audio_contexts, len, value);
       /* Just store if for now */
-      leAudioDevice->SetSupportedContexts(supp_audio_contexts->snk_supp_cont,
-                                          supp_audio_contexts->src_supp_cont);
+      leAudioDevice->SetSupportedContexts(supp_audio_contexts.snk_supp_cont,
+                                          supp_audio_contexts.src_supp_cont);
+
+      btif_storage_set_leaudio_supported_context_types(
+          leAudioDevice->address_, supp_audio_contexts.snk_supp_cont.value(),
+          supp_audio_contexts.src_supp_cont.value());
+
     } else if (hdl == leAudioDevice->ctp_hdls_.val_hdl) {
       auto ntf =
           std::make_unique<struct le_audio::client_parser::ascs::ctp_ntf>();
@@ -1308,7 +1656,13 @@
 
     if (status != GATT_SUCCESS) {
       /* autoconnect connection failed, that's ok */
-      if (!leAudioDevice->connecting_actively_) return;
+      if (leAudioDevice->GetConnectionState() ==
+          DeviceConnectState::CONNECTING_AUTOCONNECT) {
+        leAudioDevice->SetConnectionState(DeviceConnectState::DISCONNECTED);
+        return;
+      }
+
+      leAudioDevice->SetConnectionState(DeviceConnectState::DISCONNECTED);
 
       LOG(ERROR) << "Failed to connect to LeAudio leAudioDevice, status: "
                  << +status;
@@ -1326,14 +1680,18 @@
 
     BTM_RequestPeerSCA(leAudioDevice->address_, transport);
 
-    leAudioDevice->connecting_actively_ = false;
-    leAudioDevice->conn_id_ = conn_id;
-
-    if (mtu == GATT_DEF_BLE_MTU_SIZE) {
-      LOG(INFO) << __func__ << ", Configure MTU";
-      BtaGattQueue::ConfigureMtu(leAudioDevice->conn_id_, 240);
+    if (leAudioDevice->GetConnectionState() ==
+        DeviceConnectState::CONNECTING_AUTOCONNECT) {
+      leAudioDevice->SetConnectionState(
+          DeviceConnectState::CONNECTED_AUTOCONNECT_GETTING_READY);
+    } else {
+      leAudioDevice->SetConnectionState(
+          DeviceConnectState::CONNECTED_BY_USER_GETTING_READY);
     }
 
+    leAudioDevice->conn_id_ = conn_id;
+    leAudioDevice->mtu_ = mtu;
+
     if (BTM_SecIsSecurityPending(address)) {
       /* if security collision happened, wait for encryption done
        * (BTA_GATTC_ENC_CMPL_CB_EVT) */
@@ -1348,13 +1706,8 @@
     }
 
     if (BTM_IsLinkKeyKnown(address, BT_TRANSPORT_LE)) {
-      int result = BTM_SetEncryption(
-          address, BT_TRANSPORT_LE,
-          [](const RawAddress* bd_addr, tBT_TRANSPORT transport,
-             void* p_ref_data, tBTM_STATUS status) {
-            if (instance) instance->OnEncryptionComplete(*bd_addr, status);
-          },
-          nullptr, BTM_BLE_SEC_ENCRYPT);
+      int result = BTM_SetEncryption(address, BT_TRANSPORT_LE, nullptr, nullptr,
+                                     BTM_BLE_SEC_ENCRYPT);
 
       LOG(INFO) << __func__
                 << "Encryption required. Request result: " << result;
@@ -1370,39 +1723,58 @@
   void RegisterKnownNotifications(LeAudioDevice* leAudioDevice) {
     LOG(INFO) << __func__ << " device: " << leAudioDevice->address_;
 
+    if (leAudioDevice->ctp_hdls_.val_hdl == 0) {
+      LOG_ERROR(
+          "Control point characteristic is mandatory - disconnecting device %s",
+          leAudioDevice->address_.ToString().c_str());
+      DisconnectDevice(leAudioDevice);
+      return;
+    }
+
     /* GATTC will ommit not registered previously handles */
     for (auto pac_tuple : leAudioDevice->snk_pacs_) {
-      BTA_GATTC_RegisterForNotifications(gatt_if_, leAudioDevice->address_,
-                                         std::get<0>(pac_tuple).val_hdl);
+      subscribe_for_notification(leAudioDevice->conn_id_,
+                                 leAudioDevice->address_,
+                                 std::get<0>(pac_tuple));
     }
     for (auto pac_tuple : leAudioDevice->src_pacs_) {
-      BTA_GATTC_RegisterForNotifications(gatt_if_, leAudioDevice->address_,
-                                         std::get<0>(pac_tuple).val_hdl);
+      subscribe_for_notification(leAudioDevice->conn_id_,
+                                 leAudioDevice->address_,
+                                 std::get<0>(pac_tuple));
     }
 
     if (leAudioDevice->snk_audio_locations_hdls_.val_hdl != 0)
-      BTA_GATTC_RegisterForNotifications(
-          gatt_if_, leAudioDevice->address_,
-          leAudioDevice->snk_audio_locations_hdls_.val_hdl);
+      subscribe_for_notification(leAudioDevice->conn_id_,
+                                 leAudioDevice->address_,
+                                 leAudioDevice->snk_audio_locations_hdls_);
     if (leAudioDevice->src_audio_locations_hdls_.val_hdl != 0)
-      BTA_GATTC_RegisterForNotifications(
-          gatt_if_, leAudioDevice->address_,
-          leAudioDevice->src_audio_locations_hdls_.val_hdl);
+      subscribe_for_notification(leAudioDevice->conn_id_,
+                                 leAudioDevice->address_,
+                                 leAudioDevice->src_audio_locations_hdls_);
+
     if (leAudioDevice->audio_avail_hdls_.val_hdl != 0)
-      BTA_GATTC_RegisterForNotifications(
-          gatt_if_, leAudioDevice->address_,
-          leAudioDevice->audio_avail_hdls_.val_hdl);
+      subscribe_for_notification(leAudioDevice->conn_id_,
+                                 leAudioDevice->address_,
+                                 leAudioDevice->audio_avail_hdls_);
+
     if (leAudioDevice->audio_supp_cont_hdls_.val_hdl != 0)
-      BTA_GATTC_RegisterForNotifications(
-          gatt_if_, leAudioDevice->address_,
-          leAudioDevice->audio_supp_cont_hdls_.val_hdl);
-    if (leAudioDevice->ctp_hdls_.val_hdl != 0)
-      BTA_GATTC_RegisterForNotifications(gatt_if_, leAudioDevice->address_,
-                                         leAudioDevice->ctp_hdls_.val_hdl);
+      subscribe_for_notification(leAudioDevice->conn_id_,
+                                 leAudioDevice->address_,
+                                 leAudioDevice->audio_supp_cont_hdls_);
 
     for (struct ase& ase : leAudioDevice->ases_)
-      BTA_GATTC_RegisterForNotifications(gatt_if_, leAudioDevice->address_,
-                                         ase.hdls.val_hdl);
+      subscribe_for_notification(leAudioDevice->conn_id_,
+                                 leAudioDevice->address_, ase.hdls);
+
+    subscribe_for_notification(leAudioDevice->conn_id_, leAudioDevice->address_,
+                               leAudioDevice->ctp_hdls_);
+  }
+
+  void changeMtuIfPossible(LeAudioDevice* leAudioDevice) {
+    if (leAudioDevice->mtu_ == GATT_DEF_BLE_MTU_SIZE) {
+      LOG(INFO) << __func__ << ", Configure MTU";
+      BtaGattQueue::ConfigureMtu(leAudioDevice->conn_id_, GATT_MAX_MTU_SIZE);
+    }
   }
 
   void OnEncryptionComplete(const RawAddress& address, uint8_t status) {
@@ -1417,32 +1789,38 @@
     if (status != BTM_SUCCESS) {
       LOG(ERROR) << "Encryption failed"
                  << " status: " << int{status};
-      BTA_GATTC_Close(leAudioDevice->conn_id_);
-      if (leAudioDevice->connecting_actively_) {
+      if (leAudioDevice->GetConnectionState() ==
+          DeviceConnectState::CONNECTED_BY_USER_GETTING_READY) {
         callbacks_->OnConnectionState(ConnectionState::DISCONNECTED, address);
         le_audio::MetricsCollector::Get()->OnConnectionStateChanged(
             leAudioDevice->group_id_, address, ConnectionState::CONNECTED,
             le_audio::ConnectionStatus::FAILED);
       }
+
+      leAudioDevice->SetConnectionState(DeviceConnectState::DISCONNECTING);
+
+      BTA_GATTC_Close(leAudioDevice->conn_id_);
       return;
     }
 
-    /* If we know services, register for notifications */
-    if (leAudioDevice->known_service_handles_)
-      RegisterKnownNotifications(leAudioDevice);
-
     if (leAudioDevice->encrypted_) {
       LOG(INFO) << __func__ << " link already encrypted, nothing to do";
       return;
     }
 
+    changeMtuIfPossible(leAudioDevice);
+
+    /* If we know services, register for notifications */
+    if (leAudioDevice->known_service_handles_)
+      RegisterKnownNotifications(leAudioDevice);
+
     leAudioDevice->encrypted_ = true;
 
     /* If we know services and read is not ongoing, this is reconnection and
      * just notify connected  */
     if (leAudioDevice->known_service_handles_ &&
         !leAudioDevice->notify_connected_after_read_) {
-      connectionReady(leAudioDevice);
+      LOG_INFO("Wait for CCC registration and MTU change request");
       return;
     }
 
@@ -1460,6 +1838,7 @@
       return;
     }
 
+    BtaGattQueue::Clean(leAudioDevice->conn_id_);
     LeAudioDeviceGroup* group = aseGroups_.FindById(leAudioDevice->group_id_);
 
     groupStateMachine_->ProcessHciNotifAclDisconnected(group, leAudioDevice);
@@ -1468,6 +1847,7 @@
 
     callbacks_->OnConnectionState(ConnectionState::DISCONNECTED, address);
     leAudioDevice->conn_id_ = GATT_INVALID_CONN_ID;
+    leAudioDevice->mtu_ = 0;
     leAudioDevice->closing_stream_for_disconnection_ = false;
     leAudioDevice->encrypted_ = false;
 
@@ -1475,7 +1855,7 @@
         leAudioDevice->group_id_, address, ConnectionState::DISCONNECTED,
         le_audio::ConnectionStatus::SUCCESS);
 
-    if (leAudioDevice->removing_device_) {
+    if (leAudioDevice->GetConnectionState() == DeviceConnectState::REMOVING) {
       if (leAudioDevice->group_id_ != bluetooth::groups::kGroupUnknown) {
         auto group = aseGroups_.FindById(leAudioDevice->group_id_);
         group_remove_node(group, address, true);
@@ -1483,18 +1863,29 @@
       leAudioDevices_.Remove(address);
       return;
     }
-    /* Attempt background re-connect if disconnect was not intended locally */
-    if (reason != GATT_CONN_TERMINATE_LOCAL_HOST) {
-      BTA_GATTC_Open(gatt_if_, address, false, false);
+    /* Attempt background re-connect if disconnect was not intended locally
+     * or if autoconnect is set and device got disconnected because of some
+     * issues
+     */
+    if (reason != GATT_CONN_TERMINATE_LOCAL_HOST ||
+        leAudioDevice->autoconnect_flag_) {
+      leAudioDevice->SetConnectionState(
+          DeviceConnectState::CONNECTING_AUTOCONNECT);
+      BTA_GATTC_Open(gatt_if_, address, reconnection_mode_, false);
+    } else {
+      leAudioDevice->SetConnectionState(DeviceConnectState::DISCONNECTED);
     }
   }
 
-  bool subscribe_for_indications(uint16_t conn_id, const RawAddress& address,
-                                 uint16_t handle, uint16_t ccc_handle,
-                                 bool ntf) {
+  bool subscribe_for_notification(
+      uint16_t conn_id, const RawAddress& address,
+      struct le_audio::types::hdl_pair handle_pair) {
     std::vector<uint8_t> value(2);
     uint8_t* ptr = value.data();
+    uint16_t handle = handle_pair.val_hdl;
+    uint16_t ccc_handle = handle_pair.ccc_hdl;
 
+    LOG_INFO("conn id %d", conn_id);
     if (BTA_GATTC_RegisterForNotifications(gatt_if_, address, handle) !=
         GATT_SUCCESS) {
       LOG(ERROR) << __func__ << ", cannot register for notification: "
@@ -1502,8 +1893,7 @@
       return false;
     }
 
-    UINT16_TO_STREAM(ptr, ntf ? GATT_CHAR_CLIENT_CONFIG_NOTIFICATION
-                              : GATT_CHAR_CLIENT_CONFIG_INDICTION);
+    UINT16_TO_STREAM(ptr, GATT_CHAR_CLIENT_CONFIG_NOTIFICATION);
 
     BtaGattQueue::WriteDescriptor(
         conn_id, ccc_handle, std::move(value), GATT_WRITE,
@@ -1528,19 +1918,53 @@
     return iter == charac.descriptors.end() ? 0 : (*iter).handle;
   }
 
-  void OnServiceChangeEvent(const RawAddress& address) {
-    LeAudioDevice* leAudioDevice = leAudioDevices_.FindByAddress(address);
+  void ClearDeviceInformationAndStartSearch(LeAudioDevice* leAudioDevice) {
     if (!leAudioDevice) {
-      DLOG(ERROR) << __func__
-                  << ", skipping unknown leAudioDevice, address: " << address;
+      LOG_WARN("leAudioDevice is null");
       return;
     }
 
-    LOG(INFO) << __func__ << ": address=" << address;
+    LOG_INFO("%s", leAudioDevice->address_.ToString().c_str());
+
+    if (leAudioDevice->known_service_handles_ == false) {
+      LOG_DEBUG("Database already invalidated");
+      return;
+    }
+
     leAudioDevice->known_service_handles_ = false;
     leAudioDevice->csis_member_ = false;
     BtaGattQueue::Clean(leAudioDevice->conn_id_);
     DeregisterNotifications(leAudioDevice);
+
+    if (leAudioDevice->GetConnectionState() == DeviceConnectState::CONNECTED) {
+      leAudioDevice->SetConnectionState(
+          DeviceConnectState::CONNECTED_BY_USER_GETTING_READY);
+    }
+
+    btif_storage_remove_leaudio(leAudioDevice->address_);
+
+    BTA_GATTC_ServiceSearchRequest(
+        leAudioDevice->conn_id_,
+        &le_audio::uuid::kPublishedAudioCapabilityServiceUuid);
+  }
+
+  void OnServiceChangeEvent(const RawAddress& address) {
+    LeAudioDevice* leAudioDevice = leAudioDevices_.FindByAddress(address);
+    if (!leAudioDevice) {
+      LOG_WARN("Skipping unknown leAudioDevice %s", address.ToString().c_str());
+      return;
+    }
+    ClearDeviceInformationAndStartSearch(leAudioDevice);
+  }
+
+  void OnMtuChanged(uint16_t conn_id, uint16_t mtu) {
+    LeAudioDevice* leAudioDevice = leAudioDevices_.FindByConnId(conn_id);
+    if (!leAudioDevice) {
+      LOG_DEBUG("Unknown connectect id %d", conn_id);
+      return;
+    }
+
+    leAudioDevice->mtu_ = mtu;
   }
 
   void OnGattServiceDiscoveryDone(const RawAddress& address) {
@@ -1551,6 +1975,11 @@
       return;
     }
 
+    if (!leAudioDevice->encrypted_) {
+      LOG_DEBUG("Wait for device to be encrypted");
+      return;
+    }
+
     if (!leAudioDevice->known_service_handles_)
       BTA_GATTC_ServiceSearchRequest(
           leAudioDevice->conn_id_,
@@ -1655,9 +2084,8 @@
           return;
         }
 
-        if (!subscribe_for_indications(conn_id, leAudioDevice->address_,
-                                       hdl_pair.val_hdl, hdl_pair.ccc_hdl,
-                                       true)) {
+        if (!subscribe_for_notification(conn_id, leAudioDevice->address_,
+                                        hdl_pair)) {
           DisconnectDevice(leAudioDevice);
           return;
         }
@@ -1686,9 +2114,8 @@
           return;
         }
 
-        if (!subscribe_for_indications(conn_id, leAudioDevice->address_,
-                                       hdl_pair.val_hdl, hdl_pair.ccc_hdl,
-                                       true)) {
+        if (!subscribe_for_notification(conn_id, leAudioDevice->address_,
+                                        hdl_pair)) {
           DisconnectDevice(leAudioDevice);
           return;
         }
@@ -1715,10 +2142,9 @@
                        "ccc";
 
         if (leAudioDevice->snk_audio_locations_hdls_.ccc_hdl != 0 &&
-            !subscribe_for_indications(
+            !subscribe_for_notification(
                 conn_id, leAudioDevice->address_,
-                leAudioDevice->snk_audio_locations_hdls_.val_hdl,
-                leAudioDevice->snk_audio_locations_hdls_.ccc_hdl, true)) {
+                leAudioDevice->snk_audio_locations_hdls_)) {
           DisconnectDevice(leAudioDevice);
           return;
         }
@@ -1743,10 +2169,9 @@
                        "ccc";
 
         if (leAudioDevice->src_audio_locations_hdls_.ccc_hdl != 0 &&
-            !subscribe_for_indications(
+            !subscribe_for_notification(
                 conn_id, leAudioDevice->address_,
-                leAudioDevice->src_audio_locations_hdls_.val_hdl,
-                leAudioDevice->src_audio_locations_hdls_.ccc_hdl, true)) {
+                leAudioDevice->src_audio_locations_hdls_)) {
           DisconnectDevice(leAudioDevice);
           return;
         }
@@ -1771,10 +2196,8 @@
           return;
         }
 
-        if (!subscribe_for_indications(conn_id, leAudioDevice->address_,
-                                       leAudioDevice->audio_avail_hdls_.val_hdl,
-                                       leAudioDevice->audio_avail_hdls_.ccc_hdl,
-                                       true)) {
+        if (!subscribe_for_notification(conn_id, leAudioDevice->address_,
+                                        leAudioDevice->audio_avail_hdls_)) {
           DisconnectDevice(leAudioDevice);
           return;
         }
@@ -1796,10 +2219,8 @@
           LOG(INFO) << __func__ << ", audio avails char doesn't have ccc";
 
         if (leAudioDevice->audio_supp_cont_hdls_.ccc_hdl != 0 &&
-            !subscribe_for_indications(
-                conn_id, leAudioDevice->address_,
-                leAudioDevice->audio_supp_cont_hdls_.val_hdl,
-                leAudioDevice->audio_supp_cont_hdls_.ccc_hdl, true)) {
+            !subscribe_for_notification(conn_id, leAudioDevice->address_,
+                                        leAudioDevice->audio_supp_cont_hdls_)) {
           DisconnectDevice(leAudioDevice);
           return;
         }
@@ -1829,9 +2250,9 @@
           DisconnectDevice(leAudioDevice);
           return;
         }
-
-        if (!subscribe_for_indications(conn_id, leAudioDevice->address_,
-                                       charac.value_handle, ccc_handle, true)) {
+        struct le_audio::types::hdl_pair hdls(charac.value_handle, ccc_handle);
+        if (!subscribe_for_notification(conn_id, leAudioDevice->address_,
+                                        hdls)) {
           DisconnectDevice(leAudioDevice);
           return;
         }
@@ -1861,10 +2282,8 @@
           return;
         }
 
-        if (!subscribe_for_indications(conn_id, leAudioDevice->address_,
-                                       leAudioDevice->ctp_hdls_.val_hdl,
-                                       leAudioDevice->ctp_hdls_.ccc_hdl,
-                                       true)) {
+        if (!subscribe_for_notification(conn_id, leAudioDevice->address_,
+                                        leAudioDevice->ctp_hdls_)) {
           DisconnectDevice(leAudioDevice);
           return;
         }
@@ -1895,6 +2314,8 @@
     }
 
     leAudioDevice->known_service_handles_ = true;
+    btif_storage_leaudio_update_handles_bin(leAudioDevice->address_);
+
     leAudioDevice->notify_connected_after_read_ = true;
 
     /* If already known group id */
@@ -1936,9 +2357,25 @@
       return;
     }
 
+    if (status == GATT_DATABASE_OUT_OF_SYNC) {
+      LOG_INFO("Database out of sync for %s, conn_id: 0x%04x",
+               leAudioDevice->address_.ToString().c_str(), conn_id);
+      ClearDeviceInformationAndStartSearch(leAudioDevice);
+      return;
+    }
+
     if (status == GATT_SUCCESS) {
       LOG(INFO) << __func__
                 << ", successfully registered on ccc: " << loghex(hdl);
+
+      if (leAudioDevice->ctp_hdls_.ccc_hdl == hdl &&
+          leAudioDevice->known_service_handles_ &&
+          !leAudioDevice->notify_connected_after_read_) {
+        /* Reconnection case. Control point is the last CCC LeAudio is
+         * registering for on reconnection */
+        connectionReady(leAudioDevice);
+      }
+
       return;
     }
 
@@ -1982,77 +2419,83 @@
       return;
     }
 
-    auto num_of_devices =
-        get_num_of_devices_in_configuration(stream_conf->conf);
-
-    if (num_of_devices < group->NumOfConnected()) {
-      /* Second device got just paired. We need to reconfigure CIG */
-      group->SetPendingConfiguration();
-      groupStateMachine_->StopStream(group);
+    if (!stream_conf->conf) {
+      LOG_INFO("Configuration not yet set. Nothing to do now");
       return;
     }
 
-    /* Second device got reconnect. Try to get it to the stream seamlessly */
-    le_audio::types::AudioLocations sink_group_audio_locations = 0;
-    uint8_t sink_num_of_active_ases = 0;
+    auto num_of_devices =
+        get_num_of_devices_in_configuration(stream_conf->conf);
 
-    for (auto [cis_handle, audio_location] : stream_conf->sink_streams) {
-      sink_group_audio_locations |= audio_location;
-      sink_num_of_active_ases++;
+    if (num_of_devices < group->NumOfConnected() &&
+        !group->IsConfigurationSupported(leAudioDevice, stream_conf->conf)) {
+      /* Reconfigure if newly connected member device cannot support current
+       * codec configuration */
+      group->SetPendingConfiguration();
+      groupStateMachine_->StopStream(group);
+      stream_setup_start_timestamp_ =
+          bluetooth::common::time_get_os_boottime_us();
+      return;
     }
 
-    le_audio::types::AudioLocations source_group_audio_locations = 0;
-    uint8_t source_num_of_active_ases = 0;
-
-    for (auto [cis_handle, audio_location] : stream_conf->source_streams) {
-      source_group_audio_locations |= audio_location;
-      source_num_of_active_ases++;
+    if (!groupStateMachine_->AttachToStream(group, leAudioDevice)) {
+      LOG_WARN("Could not add device %s to the group %d streaming. ",
+               leAudioDevice->address_.ToString().c_str(), group->group_id_);
+      scheduleAttachDeviceToTheStream(leAudioDevice->address_);
+    } else {
+      stream_setup_start_timestamp_ =
+          bluetooth::common::time_get_os_boottime_us();
     }
+  }
 
-    for (auto& ent : stream_conf->conf->confs) {
-      if (ent.direction == le_audio::types::kLeAudioDirectionSink) {
-        /* Sink*/
-        if (!leAudioDevice->ConfigureAses(ent, group->GetCurrentContextType(),
-                                          &sink_num_of_active_ases,
-                                          sink_group_audio_locations,
-                                          source_group_audio_locations, true)) {
-          LOG(INFO) << __func__ << " Could not set sink configuration of "
-                    << stream_conf->conf->name;
-          return;
-        }
-      } else {
-        /* Source*/
-        if (!leAudioDevice->ConfigureAses(ent, group->GetCurrentContextType(),
-                                          &source_num_of_active_ases,
-                                          sink_group_audio_locations,
-                                          source_group_audio_locations, true)) {
-          LOG(INFO) << __func__ << " Could not set source configuration of "
-                    << stream_conf->conf->name;
-          return;
-        }
-      }
+  void restartAttachToTheStream(const RawAddress& addr) {
+    LeAudioDevice* leAudioDevice = leAudioDevices_.FindByAddress(addr);
+    if (leAudioDevice == nullptr ||
+        leAudioDevice->conn_id_ == GATT_INVALID_CONN_ID) {
+      LOG_INFO("Device %s not available anymore", addr.ToString().c_str());
+      return;
     }
+    AttachToStreamingGroupIfNeeded(leAudioDevice);
+  }
 
-    groupStateMachine_->AttachToStream(group, leAudioDevice);
+  void scheduleAttachDeviceToTheStream(const RawAddress& addr) {
+    LOG_INFO("Device %s scheduler for stream ", addr.ToString().c_str());
+    do_in_main_thread_delayed(
+        FROM_HERE,
+        base::BindOnce(&LeAudioClientImpl::restartAttachToTheStream,
+                       base::Unretained(this), addr),
+#if BASE_VER < 931007
+        base::TimeDelta::FromMilliseconds(kDeviceAttachDelayMs)
+#else
+        base::Milliseconds(kDeviceAttachDelayMs)
+#endif
+    );
   }
 
   void connectionReady(LeAudioDevice* leAudioDevice) {
+    LOG_DEBUG("%s,  %s", leAudioDevice->address_.ToString().c_str(),
+              bluetooth::common::ToString(leAudioDevice->GetConnectionState())
+                  .c_str());
     callbacks_->OnConnectionState(ConnectionState::CONNECTED,
                                   leAudioDevice->address_);
 
+    if (leAudioDevice->GetConnectionState() ==
+            DeviceConnectState::CONNECTED_BY_USER_GETTING_READY &&
+        (leAudioDevice->autoconnect_flag_ == false)) {
+      btif_storage_set_leaudio_autoconnect(leAudioDevice->address_, true);
+      leAudioDevice->autoconnect_flag_ = true;
+    }
+
+    leAudioDevice->SetConnectionState(DeviceConnectState::CONNECTED);
+    le_audio::MetricsCollector::Get()->OnConnectionStateChanged(
+        leAudioDevice->group_id_, leAudioDevice->address_,
+        ConnectionState::CONNECTED, le_audio::ConnectionStatus::SUCCESS);
+
     if (leAudioDevice->group_id_ != bluetooth::groups::kGroupUnknown) {
       LeAudioDeviceGroup* group = aseGroups_.FindById(leAudioDevice->group_id_);
       UpdateContextAndLocations(group, leAudioDevice);
       AttachToStreamingGroupIfNeeded(leAudioDevice);
     }
-
-    if (leAudioDevice->first_connection_) {
-      btif_storage_set_leaudio_autoconnect(leAudioDevice->address_, true);
-      leAudioDevice->first_connection_ = false;
-    }
-    le_audio::MetricsCollector::Get()->OnConnectionStateChanged(
-        leAudioDevice->group_id_, leAudioDevice->address_,
-        ConnectionState::CONNECTED, le_audio::ConnectionStatus::SUCCESS);
   }
 
   bool IsAseAcceptingAudioData(struct ase* ase) {
@@ -2214,119 +2657,17 @@
                                            chan_encoded.size());
   }
 
-  struct le_audio::stream_configuration* GetStreamConfigurationByDirection(
-      LeAudioDeviceGroup* group, uint8_t direction) {
-    struct le_audio::stream_configuration* stream_conf = &group->stream_conf;
-    int num_of_devices = 0;
-    int num_of_channels = 0;
-    uint32_t sample_freq_hz = 0;
-    uint32_t frame_duration_us = 0;
-    uint32_t audio_channel_allocation = 0;
-    uint16_t octets_per_frame = 0;
-    uint16_t codec_frames_blocks_per_sdu = 0;
-
-    LOG(INFO) << __func__ << " group_id: " << group->group_id_;
-
-    /* This contains pair of cis handle and audio location */
-    std::vector<std::pair<uint16_t, uint32_t>> streams;
-
-    for (auto* device = group->GetFirstActiveDevice(); device != nullptr;
-         device = group->GetNextActiveDevice(device)) {
-      auto* ase = device->GetFirstActiveAseByDirection(direction);
-
-      if (ase) {
-        LOG(INFO) << __func__ << "device: " << device->address_;
-        num_of_devices++;
-      }
-
-      for (; ase != nullptr;
-           ase = device->GetNextActiveAseWithSameDirection(ase)) {
-        streams.emplace_back(std::make_pair(
-            ase->cis_conn_hdl, *ase->codec_config.audio_channel_allocation));
-        audio_channel_allocation |= *ase->codec_config.audio_channel_allocation;
-        num_of_channels += ase->codec_config.channel_count;
-        if (sample_freq_hz == 0) {
-          sample_freq_hz = ase->codec_config.GetSamplingFrequencyHz();
-        } else {
-          LOG_ASSERT(sample_freq_hz ==
-                     ase->codec_config.GetSamplingFrequencyHz())
-              << __func__ << " sample freq mismatch: " << +sample_freq_hz
-              << " != " << ase->codec_config.GetSamplingFrequencyHz();
-        }
-
-        if (frame_duration_us == 0) {
-          frame_duration_us = ase->codec_config.GetFrameDurationUs();
-        } else {
-          LOG_ASSERT(frame_duration_us ==
-                     ase->codec_config.GetFrameDurationUs())
-              << __func__ << " frame duration mismatch: " << +frame_duration_us
-              << " != " << ase->codec_config.GetFrameDurationUs();
-        }
-
-        if (octets_per_frame == 0) {
-          octets_per_frame = *ase->codec_config.octets_per_codec_frame;
-        } else {
-          LOG_ASSERT(octets_per_frame ==
-                     ase->codec_config.octets_per_codec_frame)
-              << __func__ << " octets per frame mismatch: " << +octets_per_frame
-              << " != " << *ase->codec_config.octets_per_codec_frame;
-        }
-
-        if (codec_frames_blocks_per_sdu == 0) {
-          codec_frames_blocks_per_sdu =
-              *ase->codec_config.codec_frames_blocks_per_sdu;
-        } else {
-          LOG_ASSERT(codec_frames_blocks_per_sdu ==
-                     ase->codec_config.codec_frames_blocks_per_sdu)
-              << __func__ << " codec_frames_blocks_per_sdu: "
-              << +codec_frames_blocks_per_sdu
-              << " != " << *ase->codec_config.codec_frames_blocks_per_sdu;
-        }
-
-        LOG(INFO) << __func__ << " Added CIS: " << +ase->cis_conn_hdl
-                  << " to stream. Allocation: "
-                  << +(*ase->codec_config.audio_channel_allocation)
-                  << " sample_freq: " << +sample_freq_hz
-                  << " frame_duration: " << +frame_duration_us
-                  << " octects per frame: " << +octets_per_frame
-                  << " codec_frame_blocks_per_sdu: "
-                  << +codec_frames_blocks_per_sdu;
-      }
-    }
-
-    if (streams.empty()) return nullptr;
-
-    if (direction == le_audio::types::kLeAudioDirectionSource) {
-      stream_conf->source_streams = std::move(streams);
-      stream_conf->source_num_of_devices = num_of_devices;
-      stream_conf->source_num_of_channels = num_of_channels;
-      stream_conf->source_sample_frequency_hz = sample_freq_hz;
-      stream_conf->source_frame_duration_us = frame_duration_us;
-      stream_conf->source_audio_channel_allocation = audio_channel_allocation;
-      stream_conf->source_octets_per_codec_frame = octets_per_frame;
-      stream_conf->source_codec_frames_blocks_per_sdu =
-          codec_frames_blocks_per_sdu;
-    } else if (direction == le_audio::types::kLeAudioDirectionSink) {
-      stream_conf->sink_streams = std::move(streams);
-      stream_conf->sink_num_of_devices = num_of_devices;
-      stream_conf->sink_num_of_channels = num_of_channels;
-      stream_conf->sink_sample_frequency_hz = sample_freq_hz;
-      stream_conf->sink_frame_duration_us = frame_duration_us;
-      stream_conf->sink_audio_channel_allocation = audio_channel_allocation;
-      stream_conf->sink_octets_per_codec_frame = octets_per_frame;
-      stream_conf->sink_codec_frames_blocks_per_sdu =
-          codec_frames_blocks_per_sdu;
-    }
-
-    LOG(INFO) << __func__ << " configuration: " << stream_conf->conf->name;
-
-    return stream_conf;
-  }
-
-  struct le_audio::stream_configuration* GetStreamSinkConfiguration(
+  const struct le_audio::stream_configuration* GetStreamSinkConfiguration(
       LeAudioDeviceGroup* group) {
-    return GetStreamConfigurationByDirection(
-        group, le_audio::types::kLeAudioDirectionSink);
+    const struct le_audio::stream_configuration* stream_conf =
+        &group->stream_conf;
+    LOG_INFO("group_id: %d", group->group_id_);
+    if (stream_conf->sink_streams.size() == 0) {
+      return nullptr;
+    }
+
+    LOG_INFO("configuration: %s", stream_conf->conf->name.c_str());
+    return stream_conf;
   }
 
   void OnAudioDataReady(const std::vector<uint8_t>& data) {
@@ -2350,7 +2691,7 @@
 
     if (stream_conf.sink_num_of_devices == 2) {
       PrepareAndSendToTwoCises(data, &stream_conf);
-    } else if (stream_conf.sink_streams.size() == 2 ) {
+    } else if (stream_conf.sink_streams.size() == 2) {
       /* Streaming to one device but 2 CISes */
       PrepareAndSendToTwoCises(data, &stream_conf);
     } else {
@@ -2364,8 +2705,9 @@
     cached_channel_is_left_ = false;
   }
 
-  void SendAudioData(uint8_t* data, uint16_t size, uint16_t cis_conn_hdl,
-                     uint32_t timestamp) {
+  /* Handles audio data packets coming from the controller */
+  void HandleIncomingCisData(uint8_t* data, uint16_t size,
+                             uint16_t cis_conn_hdl, uint32_t timestamp) {
     /* Get only one channel for MONO microphone */
     /* Gather data for channel */
     if ((active_group_id_ == bluetooth::groups::kGroupUnknown) ||
@@ -2529,45 +2871,36 @@
                          std::vector<int16_t>* right) {
     uint16_t to_write = 0;
     uint16_t written = 0;
-    if (!bt_got_stereo && !af_is_stereo) {
-      std::vector<int16_t>* mono = left ? left : right;
-      /* mono audio over bluetooth, audio framework expects mono */
-      to_write = sizeof(int16_t) * mono->size();
-      written =
-          leAudioClientAudioSink->SendData((uint8_t*)mono->data(), to_write);
-    } else if (bt_got_stereo && af_is_stereo) {
-      /* stero audio over bluetooth, audio framework expects stereo */
-      std::vector<uint16_t> mixed(left->size() * 2);
-
-      for (size_t i = 0; i < left->size(); i++) {
-        mixed[2 * i] = (*right)[i];
-        mixed[2 * i + 1] = (*left)[i];
+    if (!af_is_stereo) {
+      if (!bt_got_stereo) {
+        std::vector<int16_t>* mono = left ? left : right;
+        /* mono audio over bluetooth, audio framework expects mono */
+        to_write = sizeof(int16_t) * mono->size();
+        written = le_audio_sink_hal_client_->SendData((uint8_t*)mono->data(),
+                                                      to_write);
+      } else {
+        /* stereo audio over bluetooth, audio framework expects mono */
+        for (size_t i = 0; i < left->size(); i++) {
+          (*left)[i] = ((*left)[i] + (*right)[i]) / 2;
+        }
+        to_write = sizeof(int16_t) * left->size();
+        written = le_audio_sink_hal_client_->SendData((uint8_t*)left->data(),
+                                                      to_write);
       }
-      to_write = sizeof(int16_t) * mixed.size();
-      written =
-          leAudioClientAudioSink->SendData((uint8_t*)mixed.data(), to_write);
-    } else if (bt_got_stereo && !af_is_stereo) {
-      /* stero audio over bluetooth, audio framework expects mono */
-      std::vector<uint16_t> mixed(left->size() * 2);
-
-      for (size_t i = 0; i < left->size(); i++) {
-        (*left)[i] = ((*left)[i] + (*right)[i]) / 2;
-      }
-      to_write = sizeof(int16_t) * left->size();
-      written =
-          leAudioClientAudioSink->SendData((uint8_t*)left->data(), to_write);
-    } else if (!bt_got_stereo && af_is_stereo) {
-      /* mono audio over bluetooth, audio framework expects stereo */
+    } else {
+      /* mono audio over bluetooth, audio framework expects stereo
+       * Here we handle stream without checking bt_got_stereo flag.
+       */
       const size_t mono_size = left ? left->size() : right->size();
       std::vector<uint16_t> mixed(mono_size * 2);
 
       for (size_t i = 0; i < mono_size; i++) {
-        mixed[2 * i] = right ? (*right)[i] : 0;
-        mixed[2 * i + 1] = left ? (*left)[i] : 0;
+        mixed[2 * i] = left ? (*left)[i] : (*right)[i];
+        mixed[2 * i + 1] = right ? (*right)[i] : (*left)[i];
       }
       to_write = sizeof(int16_t) * mixed.size();
       written =
-          leAudioClientAudioSink->SendData((uint8_t*)mixed.data(), to_write);
+          le_audio_sink_hal_client_->SendData((uint8_t*)mixed.data(), to_write);
     }
 
     /* TODO: What to do if not all data sinked ? */
@@ -2589,6 +2922,19 @@
       return false;
     }
 
+    LOG_DEBUG("Sink stream config (#%d):\n",
+              static_cast<int>(stream_conf->sink_streams.size()));
+    for (auto stream : stream_conf->sink_streams) {
+      LOG_DEBUG("Cis handle: 0x%02x, allocation 0x%04x\n", stream.first,
+                stream.second);
+    }
+    LOG_DEBUG("Source stream config (#%d):\n",
+              static_cast<int>(stream_conf->source_streams.size()));
+    for (auto stream : stream_conf->source_streams) {
+      LOG_DEBUG("Cis handle: 0x%02x, allocation 0x%04x\n", stream.first,
+                stream.second);
+    }
+
     uint16_t remote_delay_ms =
         group->GetRemoteDelay(le_audio::types::kLeAudioDirectionSink);
     if (CodecManager::GetInstance()->GetCodecLocation() ==
@@ -2613,26 +2959,30 @@
           lc3_setup_encoder(dt_us, sr_hz, af_hz, lc3_encoder_left_mem);
       lc3_encoder_right =
           lc3_setup_encoder(dt_us, sr_hz, af_hz, lc3_encoder_right_mem);
-
-    } else if (CodecManager::GetInstance()->GetCodecLocation() ==
-               le_audio::types::CodecLocation::ADSP) {
-      CodecManager::GetInstance()->UpdateActiveSourceAudioConfig(
-          *stream_conf, remote_delay_ms,
-          std::bind(&LeAudioUnicastClientAudioSource::UpdateAudioConfigToHal,
-                    leAudioClientAudioSource, std::placeholders::_1));
     }
 
-    leAudioClientAudioSource->UpdateRemoteDelay(remote_delay_ms);
-    leAudioClientAudioSource->ConfirmStreamingRequest();
+    le_audio_source_hal_client_->UpdateRemoteDelay(remote_delay_ms);
+    le_audio_source_hal_client_->ConfirmStreamingRequest();
     audio_sender_state_ = AudioState::STARTED;
+    /* We update the target audio allocation before streamStarted that the
+     * offloder would know how to configure offloader encoder. We should check
+     * if we need to update the current
+     * allocation here as the target allocation and the current allocation is
+     * different */
+    updateOffloaderIfNeeded(group);
 
     return true;
   }
 
-  struct le_audio::stream_configuration* GetStreamSourceConfiguration(
+  const struct le_audio::stream_configuration* GetStreamSourceConfiguration(
       LeAudioDeviceGroup* group) {
-    return GetStreamConfigurationByDirection(
-        group, le_audio::types::kLeAudioDirectionSource);
+    const struct le_audio::stream_configuration* stream_conf =
+        &group->stream_conf;
+    if (stream_conf->source_streams.size() == 0) {
+      return nullptr;
+    }
+    LOG_INFO("configuration: %s", stream_conf->conf->name.c_str());
+    return stream_conf;
   }
 
   void StartReceivingAudio(int group_id) {
@@ -2674,17 +3024,16 @@
           lc3_setup_decoder(dt_us, sr_hz, af_hz, lc3_decoder_left_mem);
       lc3_decoder_right =
           lc3_setup_decoder(dt_us, sr_hz, af_hz, lc3_decoder_right_mem);
-    } else if (CodecManager::GetInstance()->GetCodecLocation() ==
-               le_audio::types::CodecLocation::ADSP) {
-      CodecManager::GetInstance()->UpdateActiveSinkAudioConfig(
-          *stream_conf, remote_delay_ms,
-          std::bind(&LeAudioUnicastClientAudioSink::UpdateAudioConfigToHal,
-                    leAudioClientAudioSink, std::placeholders::_1));
     }
-
-    leAudioClientAudioSink->UpdateRemoteDelay(remote_delay_ms);
-    leAudioClientAudioSink->ConfirmStreamingRequest();
+    le_audio_sink_hal_client_->UpdateRemoteDelay(remote_delay_ms);
+    le_audio_sink_hal_client_->ConfirmStreamingRequest();
     audio_receiver_state_ = AudioState::STARTED;
+    /* We update the target audio allocation before streamStarted that the
+     * offloder would know how to configure offloader decoder. We should check
+     * if we need to update the current
+     * allocation here as the target allocation and the current allocation is
+     * different */
+    updateOffloaderIfNeeded(group);
   }
 
   void SuspendAudio(void) {
@@ -2712,16 +3061,16 @@
     std::stringstream stream;
     if (print_audio_state) {
       if (sender) {
-        stream << "   audio sender state: " << audio_sender_state_ << "\n";
+        stream << "\taudio sender state: " << audio_sender_state_ << "\n";
       } else {
-        stream << "   audio receiver state: " << audio_receiver_state_ << "\n";
+        stream << "\taudio receiver state: " << audio_receiver_state_ << "\n";
       }
     }
 
-    stream << "   num_channels: " << +conf->num_channels << "\n"
-           << "   sample rate: " << +conf->sample_rate << "\n"
-           << "   bits pers sample: " << +conf->bits_per_sample << "\n"
-           << "   data_interval_us: " << +conf->data_interval_us << "\n";
+    stream << "\tsample rate: " << +conf->sample_rate
+           << ",\tchan: " << +conf->num_channels
+           << ",\tbits: " << +conf->bits_per_sample
+           << ",\tdata_interval_us: " << +conf->data_interval_us << "\n";
 
     dprintf(fd, "%s", stream.str().c_str());
   }
@@ -2754,20 +3103,33 @@
 
   void Dump(int fd) {
     dprintf(fd, "  Active group: %d\n", active_group_id_);
-    dprintf(fd, "    current content type: 0x%08hx\n", current_context_type_);
-    dprintf(
-        fd, "    stream setup time if started: %d ms\n",
-        (int)((stream_setup_end_timestamp_ - stream_setup_start_timestamp_) /
-              1000));
+    dprintf(fd, "    reconnection mode: %s \n",
+            (reconnection_mode_ == BTM_BLE_BKG_CONNECT_ALLOW_LIST
+                 ? " Allow List"
+                 : " Targeted Announcements"));
+    dprintf(fd, "    configuration: %s  (0x%08hx)\n",
+            bluetooth::common::ToString(configuration_context_type_).c_str(),
+            configuration_context_type_);
+    dprintf(fd, "    source metadata context type mask: %s\n",
+            metadata_context_types_.source.to_string().c_str());
+    dprintf(fd, "    sink metadata context type mask: %s\n",
+            metadata_context_types_.sink.to_string().c_str());
+    dprintf(fd, "    TBS state: %s\n", in_call_ ? " In call" : "No calls");
+    dprintf(fd, "    Start time: ");
+    for (auto t : stream_start_history_queue_) {
+      dprintf(fd, ", %d ms", static_cast<int>(t));
+    }
+    dprintf(fd, "\n");
     printCurrentStreamConfiguration(fd);
     dprintf(fd, "  ----------------\n ");
     dprintf(fd, "  LE Audio Groups:\n");
-    aseGroups_.Dump(fd);
-    dprintf(fd, "  Not grouped devices:\n");
+    aseGroups_.Dump(fd, active_group_id_);
+    dprintf(fd, "\n  Not grouped devices:\n");
     leAudioDevices_.Dump(fd, bluetooth::groups::kGroupUnknown);
   }
 
   void Cleanup(base::Callback<void()> cleanupCb) {
+    StopVbcCloseTimeout();
     if (alarm_is_scheduled(suspend_timeout_)) alarm_cancel(suspend_timeout_);
 
     if (active_group_id_ != bluetooth::groups::kGroupUnknown) {
@@ -2777,7 +3139,7 @@
     }
     groupStateMachine_->Cleanup();
     aseGroups_.Cleanup();
-    leAudioDevices_.Cleanup();
+    leAudioDevices_.Cleanup(gatt_if_);
     if (gatt_if_) BTA_GATTC_AppDeregister(gatt_if_);
 
     std::move(cleanupCb).Run();
@@ -2789,6 +3151,10 @@
     bool sink_cfg_available = true;
     bool source_cfg_available = true;
 
+    LOG_DEBUG("Checking whether to reconfigure from %s to %s",
+              ToString(configuration_context_type_).c_str(),
+              ToString(context_type).c_str());
+
     auto group = aseGroups_.FindById(group_id);
     if (!group) {
       LOG(ERROR) << __func__
@@ -2831,7 +3197,7 @@
     }
 
     LOG_DEBUG(
-        " Context: %s Reconfigufation_needed = %d, sink_cfg_available = %d, "
+        " Context: %s Reconfiguration_needed = %d, sink_cfg_available = %d, "
         "source_cfg_available = %d",
         ToString(context_type).c_str(), reconfiguration_needed,
         sink_cfg_available, source_cfg_available);
@@ -2845,9 +3211,9 @@
     }
 
     LOG_INFO(" Session reconfiguration needed group: %d for context type: %s",
-             group->group_id_, ToString(context_type).c_str());
+             group->group_id_, ToHexString(context_type).c_str());
 
-    current_context_type_ = context_type;
+    configuration_context_type_ = context_type;
     return AudioReconfigurationResult::RECONFIGURATION_NEEDED;
   }
 
@@ -2855,8 +3221,8 @@
     if (group->GetTargetState() == AseState::BTA_LE_AUDIO_ASE_STATE_STREAMING) {
       return true;
     }
-    return InternalGroupStream(active_group_id_,
-                               static_cast<uint16_t>(current_context_type_));
+    return GroupStream(active_group_id_, configuration_context_type_,
+                       get_bidirectional(metadata_context_types_));
   }
 
   void OnAudioSuspend() {
@@ -2865,13 +3231,31 @@
       return;
     }
 
+    if (stack_config_get_interface()
+            ->get_pts_le_audio_disable_ases_before_stopping()) {
+      LOG_INFO("Stream disable_timer_ started");
+      if (alarm_is_scheduled(disable_timer_)) alarm_cancel(disable_timer_);
+
+      alarm_set_on_mloop(
+          disable_timer_, kAudioDisableTimeoutMs,
+          [](void* data) {
+            if (instance) instance->GroupSuspend(PTR_TO_INT(data));
+          },
+          INT_TO_PTR(active_group_id_));
+    }
+
     /* Group should tie in time to get requested status */
     uint64_t timeoutMs = kAudioSuspentKeepIsoAliveTimeoutMs;
     timeoutMs = osi_property_get_int32(kAudioSuspentKeepIsoAliveTimeoutMsProp,
                                        timeoutMs);
 
-    DLOG(INFO) << __func__
-               << " Stream suspend_timeout_ started: " << suspend_timeout_;
+    if (stack_config_get_interface()
+           ->get_pts_le_audio_disable_ases_before_stopping()) {
+        timeoutMs += kAudioDisableTimeoutMs;
+    }
+
+    LOG_DEBUG("Stream suspend_timeout_ started: %d ms",
+              static_cast<int>(timeoutMs));
     if (alarm_is_scheduled(suspend_timeout_)) alarm_cancel(suspend_timeout_);
 
     alarm_set_on_mloop(
@@ -2882,10 +3266,10 @@
         INT_TO_PTR(active_group_id_));
   }
 
-  void OnAudioSinkSuspend() {
-    DLOG(INFO) << __func__
-               << " IN: audio_receiver_state_: " << audio_receiver_state_
-               << " audio_sender_state_: " << audio_sender_state_;
+  void OnLocalAudioSourceSuspend() {
+    LOG_INFO("IN: audio_receiver_state_: %s,  audio_sender_state_: %s",
+             ToString(audio_receiver_state_).c_str(),
+             ToString(audio_sender_state_).c_str());
 
     /* Note: This callback is from audio hal driver.
      * Bluetooth peer is a Sink for Audio Framework.
@@ -2914,14 +3298,15 @@
       le_audio::MetricsCollector::Get()->OnStreamEnded(active_group_id_);
     }
 
-    DLOG(INFO) << __func__
-               << " OUT: audio_receiver_state_: " << audio_receiver_state_
-               << " audio_sender_state_: " << audio_sender_state_;
+    LOG_INFO("OUT: audio_receiver_state_: %s,  audio_sender_state_: %s",
+             ToString(audio_receiver_state_).c_str(),
+             ToString(audio_sender_state_).c_str());
   }
 
-  void OnAudioSinkResume() {
-    LOG(INFO) << __func__;
-
+  void OnLocalAudioSourceResume() {
+    LOG_INFO("IN: audio_receiver_state_: %s,  audio_sender_state_: %s",
+             ToString(audio_receiver_state_).c_str(),
+             ToString(audio_sender_state_).c_str());
     /* Note: This callback is from audio hal driver.
      * Bluetooth peer is a Sink for Audio Framework.
      * e.g. Peer is a speaker
@@ -2935,24 +3320,25 @@
 
     /* Check if the device resume is expected */
     if (!group->GetCodecConfigurationByDirection(
-            current_context_type_, le_audio::types::kLeAudioDirectionSink)) {
+            configuration_context_type_,
+            le_audio::types::kLeAudioDirectionSink)) {
       LOG(ERROR) << __func__ << ", invalid resume request for context type: "
-                 << loghex(static_cast<int>(current_context_type_));
-      leAudioClientAudioSource->CancelStreamingRequest();
+                 << ToHexString(configuration_context_type_);
+      le_audio_source_hal_client_->CancelStreamingRequest();
       return;
     }
 
     DLOG(INFO) << __func__ << " active_group_id: " << active_group_id_ << "\n"
                << " audio_receiver_state: " << audio_receiver_state_ << "\n"
                << " audio_sender_state: " << audio_sender_state_ << "\n"
-               << " current_context_type_: "
-               << static_cast<int>(current_context_type_) << "\n"
+               << " configuration_context_type_: "
+               << ToHexString(configuration_context_type_) << "\n"
                << " group " << (group ? " exist " : " does not exist ") << "\n";
 
     switch (audio_sender_state_) {
       case AudioState::STARTED:
         /* Looks like previous Confirm did not get to the Audio Framework*/
-        leAudioClientAudioSource->ConfirmStreamingRequest();
+        le_audio_source_hal_client_->ConfirmStreamingRequest();
         break;
       case AudioState::IDLE:
         switch (audio_receiver_state_) {
@@ -2961,7 +3347,7 @@
             if (OnAudioResume(group)) {
               audio_sender_state_ = AudioState::READY_TO_START;
             } else {
-              leAudioClientAudioSource->CancelStreamingRequest();
+              le_audio_source_hal_client_->CancelStreamingRequest();
             }
             break;
           case AudioState::READY_TO_START:
@@ -3009,9 +3395,9 @@
             audio_sender_state_ = AudioState::STARTED;
             if (alarm_is_scheduled(suspend_timeout_))
               alarm_cancel(suspend_timeout_);
-            leAudioClientAudioSource->ConfirmStreamingRequest();
+            le_audio_source_hal_client_->ConfirmStreamingRequest();
             le_audio::MetricsCollector::Get()->OnStreamStarted(
-                active_group_id_, current_context_type_);
+                active_group_id_, configuration_context_type_);
             break;
           case AudioState::RELEASING:
             /* Keep wainting. After release is done, Audio Hal will be notified
@@ -3025,10 +3411,12 @@
     }
   }
 
-  void OnAudioSourceSuspend() {
-    DLOG(INFO) << __func__
-               << " IN: audio_receiver_state_: " << audio_receiver_state_
-               << " audio_sender_state_: " << audio_sender_state_;
+  void OnLocalAudioSinkSuspend() {
+    LOG_INFO("IN: audio_receiver_state_: %s,  audio_sender_state_: %s",
+             ToString(audio_receiver_state_).c_str(),
+             ToString(audio_sender_state_).c_str());
+
+    StartVbcCloseTimeout();
 
     /* Note: This callback is from audio hal driver.
      * Bluetooth peer is a Source for Audio Framework.
@@ -3055,22 +3443,25 @@
         (audio_sender_state_ == AudioState::READY_TO_RELEASE))
       OnAudioSuspend();
 
-    DLOG(INFO) << __func__
-               << " OUT: audio_receiver_state_: " << audio_receiver_state_
-               << " audio_sender_state_: " << audio_sender_state_;
+    LOG_INFO("OUT: audio_receiver_state_: %s,  audio_sender_state_: %s",
+             ToString(audio_receiver_state_).c_str(),
+             ToString(audio_sender_state_).c_str());
   }
 
-  bool IsAudioSourceAvailableForCurrentContentType() {
-    if (current_context_type_ == LeAudioContextType::CONVERSATIONAL ||
-        current_context_type_ == LeAudioContextType::VOICEASSISTANTS) {
-      return true;
-    }
-
-    return false;
+  inline bool IsDirectionAvailableForCurrentConfiguration(
+      const LeAudioDeviceGroup* group, uint8_t direction) const {
+    return group
+        ->GetCodecConfigurationByDirection(configuration_context_type_,
+                                           direction)
+        .has_value();
   }
 
-  void OnAudioSourceResume() {
-    LOG(INFO) << __func__;
+  void OnLocalAudioSinkResume() {
+    LOG_INFO("IN: audio_receiver_state_: %s,  audio_sender_state_: %s",
+             ToString(audio_receiver_state_).c_str(),
+             ToString(audio_sender_state_).c_str());
+    /* Stop the VBC close watchdog if needed */
+    StopVbcCloseTimeout();
 
     /* Note: This callback is from audio hal driver.
      * Bluetooth peer is a Source for Audio Framework.
@@ -3085,23 +3476,24 @@
 
     /* Check if the device resume is expected */
     if (!group->GetCodecConfigurationByDirection(
-            current_context_type_, le_audio::types::kLeAudioDirectionSource)) {
+            configuration_context_type_,
+            le_audio::types::kLeAudioDirectionSource)) {
       LOG(ERROR) << __func__ << ", invalid resume request for context type: "
-                 << loghex(static_cast<int>(current_context_type_));
-      leAudioClientAudioSink->CancelStreamingRequest();
+                 << ToHexString(configuration_context_type_);
+      le_audio_sink_hal_client_->CancelStreamingRequest();
       return;
     }
 
     DLOG(INFO) << __func__ << " active_group_id: " << active_group_id_ << "\n"
                << " audio_receiver_state: " << audio_receiver_state_ << "\n"
                << " audio_sender_state: " << audio_sender_state_ << "\n"
-               << " current_context_type_: "
-               << static_cast<int>(current_context_type_) << "\n"
+               << " configuration_context_type_: "
+               << ToHexString(configuration_context_type_) << "\n"
                << " group " << (group ? " exist " : " does not exist ") << "\n";
 
     switch (audio_receiver_state_) {
       case AudioState::STARTED:
-        leAudioClientAudioSink->ConfirmStreamingRequest();
+        le_audio_sink_hal_client_->ConfirmStreamingRequest();
         break;
       case AudioState::IDLE:
         switch (audio_sender_state_) {
@@ -3109,7 +3501,7 @@
             if (OnAudioResume(group)) {
               audio_receiver_state_ = AudioState::READY_TO_START;
             } else {
-              leAudioClientAudioSink->CancelStreamingRequest();
+              le_audio_sink_hal_client_->CancelStreamingRequest();
             }
             break;
           case AudioState::READY_TO_START:
@@ -3120,11 +3512,16 @@
              */
             if (group->GetState() ==
                 AseState::BTA_LE_AUDIO_ASE_STATE_STREAMING) {
-              if (!IsAudioSourceAvailableForCurrentContentType()) {
-                StopStreamIfNeeded(group, LeAudioContextType::VOICEASSISTANTS);
+              if (!IsDirectionAvailableForCurrentConfiguration(
+                      group, le_audio::types::kLeAudioDirectionSource)) {
+                LOG_WARN(
+                    "Local audio sink was resumed when not in a proper "
+                    "configuration. This should not happen. Reconfiguring to "
+                    "VOICEASSISTANTS.");
+                SetConfigurationAndStopStreamWhenNeeded(
+                    group, LeAudioContextType::VOICEASSISTANTS);
                 break;
               }
-
               StartReceivingAudio(active_group_id_);
             }
             break;
@@ -3162,7 +3559,7 @@
             audio_receiver_state_ = AudioState::STARTED;
             if (alarm_is_scheduled(suspend_timeout_))
               alarm_cancel(suspend_timeout_);
-            leAudioClientAudioSink->ConfirmStreamingRequest();
+            le_audio_sink_hal_client_->ConfirmStreamingRequest();
             break;
           case AudioState::RELEASING:
             /* Wait until releasing is completed */
@@ -3176,66 +3573,76 @@
     }
   }
 
-  LeAudioContextType AudioContentToLeAudioContext(
-      audio_content_type_t content_type, audio_usage_t usage) {
-    /* Check audio attribute usage of stream */
-    switch (usage) {
-      case AUDIO_USAGE_MEDIA:
-        return LeAudioContextType::MEDIA;
-      case AUDIO_USAGE_VOICE_COMMUNICATION:
-      case AUDIO_USAGE_CALL_ASSISTANT:
-        return LeAudioContextType::CONVERSATIONAL;
-      case AUDIO_USAGE_VOICE_COMMUNICATION_SIGNALLING:
-        if (content_type == AUDIO_CONTENT_TYPE_SPEECH)
-          return LeAudioContextType::CONVERSATIONAL;
-        else
-          return LeAudioContextType::MEDIA;
-      case AUDIO_USAGE_GAME:
-        return LeAudioContextType::GAME;
-      case AUDIO_USAGE_NOTIFICATION:
-        return LeAudioContextType::NOTIFICATIONS;
-      case AUDIO_USAGE_NOTIFICATION_TELEPHONY_RINGTONE:
-        return LeAudioContextType::RINGTONE;
-      case AUDIO_USAGE_ALARM:
-        return LeAudioContextType::ALERTS;
-      case AUDIO_USAGE_EMERGENCY:
-        return LeAudioContextType::EMERGENCYALARM;
-      case AUDIO_USAGE_ASSISTANCE_NAVIGATION_GUIDANCE:
-        return LeAudioContextType::INSTRUCTIONAL;
-      default:
-        break;
+  /* Chooses a single context type to use as a key for selecting a single
+   * audio set configuration. Contexts used for the metadata can be different
+   * than this, but it's reasonable to select a configuration context from
+   * the metadata context types.
+   */
+  LeAudioContextType ChooseConfigurationContextType(
+      AudioContexts available_remote_contexts) {
+    LOG_DEBUG("Got contexts=%s in config_context=%s",
+              bluetooth::common::ToString(available_remote_contexts).c_str(),
+              bluetooth::common::ToString(configuration_context_type_).c_str());
+
+    if (in_call_) {
+      LOG_DEBUG(" In Call preference used.");
+      return LeAudioContextType::CONVERSATIONAL;
     }
 
-    return LeAudioContextType::MEDIA;
+    /* Mini policy - always prioritize sink+source configurations so that we are
+     * sure that for a mixed content we enable all the needed directions.
+     */
+    if (available_remote_contexts.any()) {
+      LeAudioContextType context_priority_list[] = {
+          /* Highest priority first */
+          LeAudioContextType::CONVERSATIONAL,
+          /* Skip the RINGTONE to avoid reconfigurations when adjusting
+           * call volume slider while not in a call.
+           * LeAudioContextType::RINGTONE,
+           */
+          LeAudioContextType::LIVE,
+          LeAudioContextType::VOICEASSISTANTS,
+          LeAudioContextType::GAME,
+          LeAudioContextType::MEDIA,
+          LeAudioContextType::EMERGENCYALARM,
+          LeAudioContextType::ALERTS,
+          LeAudioContextType::INSTRUCTIONAL,
+          LeAudioContextType::NOTIFICATIONS,
+          LeAudioContextType::SOUNDEFFECTS,
+      };
+      for (auto ct : context_priority_list) {
+        if (available_remote_contexts.test(ct)) {
+          LOG_DEBUG("Selecting configuration context type: %s",
+                    ToString(ct).c_str());
+          return ct;
+        }
+      }
+    }
+
+    /* We keepo the existing configuration, when not in a call, but the user
+     * adjusts the ringtone volume while there is no other valid audio stream.
+     */
+    if (available_remote_contexts.test(LeAudioContextType::RINGTONE)) {
+      return configuration_context_type_;
+    }
+
+    /* Fallback to BAP mandated context type */
+    LOG_WARN("Invalid/unknown context, using 'UNSPECIFIED'");
+    return LeAudioContextType::UNSPECIFIED;
   }
 
-  LeAudioContextType ChooseContextType(
-      std::vector<LeAudioContextType>& available_contents) {
-    /* Mini policy. Voice is prio 1, game prio 2, media is prio 3 */
-    auto iter = find(available_contents.begin(), available_contents.end(),
-                     LeAudioContextType::CONVERSATIONAL);
-    if (iter != available_contents.end())
-      return LeAudioContextType::CONVERSATIONAL;
-
-    iter = find(available_contents.begin(), available_contents.end(),
-                LeAudioContextType::GAME);
-    if (iter != available_contents.end()) return LeAudioContextType::GAME;
-
-    iter = find(available_contents.begin(), available_contents.end(),
-                LeAudioContextType::MEDIA);
-    if (iter != available_contents.end()) return LeAudioContextType::MEDIA;
-
-    /*TODO do something smarter here */
-    return available_contents[0];
-  }
-
-  bool StopStreamIfNeeded(LeAudioDeviceGroup* group,
-                          LeAudioContextType new_context_type) {
+  bool SetConfigurationAndStopStreamWhenNeeded(
+      LeAudioDeviceGroup* group, LeAudioContextType new_context_type) {
     auto reconfig_result = UpdateConfigAndCheckIfReconfigurationIsNeeded(
         group->group_id_, new_context_type);
+    /* Even though the reconfiguration may not be needed, this has
+     * to be set here as it might be the initial configuration.
+     */
+    configuration_context_type_ = new_context_type;
 
-    LOG_INFO("group_id %d, context type %s, reconfig_needed %s",
-             group->group_id_, ToString(new_context_type).c_str(),
+    LOG_INFO("group_id %d, context type %s (%s), %s", group->group_id_,
+             ToString(new_context_type).c_str(),
+             ToHexString(new_context_type).c_str(),
              ToString(reconfig_result).c_str());
     if (reconfig_result ==
         AudioReconfigurationResult::RECONFIGURATION_NOT_NEEDED) {
@@ -3260,10 +3667,8 @@
     return true;
   }
 
-  void OnAudioMetadataUpdate(const source_metadata_t& source_metadata) {
-    auto tracks = source_metadata.tracks;
-    auto track_count = source_metadata.track_count;
-
+  void OnLocalAudioSourceMetadataUpdate(
+      std::vector<struct playback_track_metadata> source_metadata) {
     if (active_group_id_ == bluetooth::groups::kGroupUnknown) {
       LOG(WARNING) << ", cannot start streaming if no active group set";
       return;
@@ -3275,82 +3680,120 @@
                  << ", Invalid group: " << static_cast<int>(active_group_id_);
       return;
     }
-    bool is_group_streaming =
-        (group->GetTargetState() == AseState::BTA_LE_AUDIO_ASE_STATE_STREAMING);
 
-    std::vector<LeAudioContextType> contexts;
+    /* Stop the VBC close timeout timer, since we will reconfigure anyway if the
+     * VBC was suspended.
+     */
+    StopVbcCloseTimeout();
 
-    auto supported_context_type = group->GetActiveContexts();
+    LOG_DEBUG("group state=%s, target_state=%s",
+              ToString(group->GetState()).c_str(),
+              ToString(group->GetTargetState()).c_str());
 
-    while (track_count) {
-      if (tracks->content_type == 0 && tracks->usage == 0) {
-        --track_count;
-        ++tracks;
-        continue;
+    auto new_metadata_context_types_ = AudioContexts();
+
+    /* If the local sink is started, ready to start or any direction is
+     * reconfiguring to start sit remote source configuration, then take
+     * into the account current context type. If the metadata seem
+     * invalid, keep the old one, but verify against the availability.
+     * Otherwise start empty and add the tracks contexts.
+     */
+    auto is_releasing_for_reconfiguration =
+        (((audio_receiver_state_ == AudioState::RELEASING) ||
+          (audio_sender_state_ == AudioState::RELEASING)) &&
+         group->IsPendingConfiguration() &&
+         IsDirectionAvailableForCurrentConfiguration(
+             group, le_audio::types::kLeAudioDirectionSource));
+    if (is_releasing_for_reconfiguration ||
+        (audio_receiver_state_ == AudioState::STARTED) ||
+        (audio_receiver_state_ == AudioState::READY_TO_START)) {
+      LOG_DEBUG("Other direction is streaming. Taking its contexts %s",
+                ToString(metadata_context_types_.source).c_str());
+      new_metadata_context_types_ =
+          ChooseMetadataContextType(metadata_context_types_.source);
+
+    } else if (source_metadata.empty()) {
+      LOG_DEBUG("Not a valid sink metadata update. Keeping the old contexts");
+      new_metadata_context_types_ &= group->GetAvailableContexts();
+
+    } else {
+      LOG_DEBUG("No other direction is streaming. Start with empty contexts.");
+    }
+
+    /* Set the remote sink metadata context from the playback tracks metadata */
+    metadata_context_types_.sink = GetAllowedAudioContextsFromSourceMetadata(
+        source_metadata, group->GetAvailableContexts());
+    new_metadata_context_types_ |= metadata_context_types_.sink;
+
+    if (stack_config_get_interface()
+            ->get_pts_force_le_audio_multiple_contexts_metadata()) {
+      // Use common audio stream contexts exposed by the PTS
+      metadata_context_types_.sink = AudioContexts(0xFFFF);
+      for (auto device = group->GetFirstDevice(); device != nullptr;
+           device = group->GetNextDevice(device)) {
+        metadata_context_types_.sink &= device->GetAvailableContexts();
       }
-
-      LOG_INFO("%s: usage=%d, content_type=%d, gain=%f", __func__,
-               tracks->usage, tracks->content_type, tracks->gain);
-
-      auto new_context =
-          AudioContentToLeAudioContext(tracks->content_type, tracks->usage);
-
-      /* Check only supported context types.*/
-      if (static_cast<int>(new_context) & supported_context_type.to_ulong()) {
-        contexts.push_back(new_context);
-      } else {
-        LOG_WARN(" Context type %s not supported by remote device",
-                 ToString(new_context).c_str());
+      if (metadata_context_types_.sink.value() == 0xFFFF) {
+        metadata_context_types_.sink =
+            AudioContexts(LeAudioContextType::UNSPECIFIED);
       }
+      LOG_WARN("Overriding metadata_context_types_ with: %s",
+               metadata_context_types_.sink.to_string().c_str());
 
-      --track_count;
-      ++tracks;
-    }
+      /* Choose the right configuration context */
+      auto new_configuration_context =
+          ChooseConfigurationContextType(metadata_context_types_.sink);
 
-    if (contexts.empty()) {
-      LOG_WARN(" invalid/unknown metadata update");
+      LOG_DEBUG("new_configuration_context= %s.",
+                ToString(new_configuration_context).c_str());
+      GroupStream(active_group_id_, new_configuration_context,
+                  metadata_context_types_.sink);
       return;
     }
 
-    auto new_context = ChooseContextType(contexts);
-    LOG_DEBUG("new_context_type: %s", ToString(new_context).c_str());
-
-    if (new_context == current_context_type_) {
-      LOG_INFO("Context did not changed.");
-      return;
+    if (new_metadata_context_types_.none()) {
+      LOG_WARN("invalid/unknown context metadata, using 'UNSPECIFIED' instead");
+      new_metadata_context_types_ =
+          AudioContexts(LeAudioContextType::UNSPECIFIED);
     }
 
-    current_context_type_ = new_context;
-    if (StopStreamIfNeeded(group, new_context)) {
-      return;
+    /* Choose the right configuration context */
+    auto new_configuration_context =
+        ChooseConfigurationContextType(new_metadata_context_types_);
+
+    /* For the following contexts we don't actually need HQ audio:
+     * LeAudioContextType::NOTIFICATIONS
+     * LeAudioContextType::SOUNDEFFECTS
+     * LeAudioContextType::INSTRUCTIONAL
+     * LeAudioContextType::ALERTS
+     * LeAudioContextType::EMERGENCYALARM
+     * So do not reconfigure if the remote sink is already available at any
+     * quality and these are the only contributors to the current audio stream.
+     */
+    auto no_reconfigure_contexts =
+        LeAudioContextType::NOTIFICATIONS | LeAudioContextType::SOUNDEFFECTS |
+        LeAudioContextType::INSTRUCTIONAL | LeAudioContextType::ALERTS |
+        LeAudioContextType::EMERGENCYALARM;
+    if ((new_metadata_context_types_ & ~no_reconfigure_contexts).none() &&
+        IsDirectionAvailableForCurrentConfiguration(
+            group, le_audio::types::kLeAudioDirectionSink)) {
+      LOG_INFO(
+          "There is no need to reconfigure for the sonification events. Keep "
+          "the configuration unchanged.");
+      new_configuration_context = configuration_context_type_;
     }
 
-    if (is_group_streaming) {
-      /* Configuration is the same for new context, just will do update
-       * metadata of stream
-       */
-      GroupStream(active_group_id_, static_cast<uint16_t>(new_context));
-    }
+    LOG_DEBUG("new_configuration_context= %s",
+              ToString(new_configuration_context).c_str());
+    ReconfigureOrUpdateMetadata(group, new_configuration_context,
+                                std::move(new_metadata_context_types_));
   }
 
-  void OnAudioSourceMetadataUpdate(const sink_metadata_t& sink_metadata) {
-    auto tracks = sink_metadata.tracks;
-    auto track_count = sink_metadata.track_count;
-    bool is_audio_source_invalid = true;
-
-    while (track_count) {
-      LOG_INFO(
-          "%s: source=%d, gain=%f, destination device=%d, "
-          "destination device address=%.32s",
-          __func__, tracks->source, tracks->gain, tracks->dest_device,
-          tracks->dest_device_address);
-
-      /* Don't differentiate source types, just check if it's valid */
-      if (is_audio_source_invalid && tracks->source != AUDIO_SOURCE_INVALID)
-        is_audio_source_invalid = false;
-
-      --track_count;
-      ++tracks;
+  void OnLocalAudioSinkMetadataUpdate(
+      std::vector<struct record_track_metadata> sink_metadata) {
+    if (active_group_id_ == bluetooth::groups::kGroupUnknown) {
+      LOG(WARNING) << ", cannot start streaming if no active group set";
+      return;
     }
 
     auto group = aseGroups_.FindById(active_group_id_);
@@ -3360,30 +3803,154 @@
       return;
     }
 
-    /* Do nothing, since audio source is not valid and if voice assistant
-     * scenario is currently not supported by group
+    LOG_DEBUG("group state=%s, target_state=%s",
+              ToString(group->GetState()).c_str(),
+              ToString(group->GetTargetState()).c_str());
+
+    auto new_metadata_context_types = AudioContexts();
+
+    /* If the local source is started, ready to start or any direction is
+     * reconfiguring to start sit remote sink configuration, then take
+     * into the account current context type. If the metadata seem
+     * invalid, keep the old one, but verify against the availability.
+     * Otherwise start empty and add the tracks contexts.
      */
-    if (is_audio_source_invalid ||
-        !group->IsContextSupported(LeAudioContextType::VOICEASSISTANTS) ||
-        IsAudioSourceAvailableForCurrentContentType()) {
+    auto is_releasing_for_reconfiguration =
+        (((audio_receiver_state_ == AudioState::RELEASING) ||
+          (audio_sender_state_ == AudioState::RELEASING)) &&
+         group->IsPendingConfiguration() &&
+         IsDirectionAvailableForCurrentConfiguration(
+             group, le_audio::types::kLeAudioDirectionSink));
+    if (is_releasing_for_reconfiguration ||
+        (audio_sender_state_ == AudioState::STARTED) ||
+        (audio_sender_state_ == AudioState::READY_TO_START)) {
+      LOG_DEBUG("Other direction is streaming. Taking its contexts %s",
+                ToString(metadata_context_types_.sink).c_str());
+      new_metadata_context_types =
+          ChooseMetadataContextType(metadata_context_types_.sink);
+
+    } else if (sink_metadata.empty()) {
+      LOG_DEBUG("Not a valid sink metadata update. Keeping the old contexts");
+      new_metadata_context_types &= group->GetAvailableContexts();
+
+    } else {
+      LOG_DEBUG("No other direction is streaming. Start with empty contexts.");
+    }
+
+    /* Set remote source metadata context from the recording tracks metadata */
+    metadata_context_types_.source = GetAllowedAudioContextsFromSinkMetadata(
+        sink_metadata, group->GetAvailableContexts());
+
+    /* Make sure we have CONVERSATIONAL when in a call */
+    if (in_call_) {
+      LOG_DEBUG(" In Call preference used.");
+      metadata_context_types_.source |=
+          AudioContexts(LeAudioContextType::CONVERSATIONAL);
+    }
+
+    /* Append the remote source context types */
+    new_metadata_context_types |= metadata_context_types_.source;
+
+    if (stack_config_get_interface()
+            ->get_pts_force_le_audio_multiple_contexts_metadata()) {
+      // Use common audio stream contexts exposed by the PTS
+      new_metadata_context_types = AudioContexts(0xFFFF);
+      for (auto device = group->GetFirstDevice(); device != nullptr;
+           device = group->GetNextDevice(device)) {
+        new_metadata_context_types &= device->GetAvailableContexts();
+      }
+      if (new_metadata_context_types.value() == 0xFFFF) {
+        new_metadata_context_types =
+            AudioContexts(LeAudioContextType::UNSPECIFIED);
+      }
+      LOG_WARN("Overriding new_metadata_context_types with: %su",
+               new_metadata_context_types.to_string().c_str());
+
+      /* Choose the right configuration context */
+      const auto new_configuration_context =
+          ChooseConfigurationContextType(new_metadata_context_types);
+
+      LOG_DEBUG("new_configuration_context= %s.",
+                ToString(new_configuration_context).c_str());
+      new_metadata_context_types.set(new_configuration_context);
+    }
+
+    if (new_metadata_context_types.none()) {
+      LOG_WARN("invalid/unknown context metadata, using 'UNSPECIFIED' instead");
+      new_metadata_context_types =
+          AudioContexts(LeAudioContextType::UNSPECIFIED);
+    }
+
+    /* Choose the right configuration context */
+    const auto new_configuration_context =
+        ChooseConfigurationContextType(new_metadata_context_types);
+    LOG_DEBUG("new_configuration_context= %s",
+              ToString(new_configuration_context).c_str());
+
+    /* Do nothing if audio source is not valid for the new configuration */
+    const auto is_audio_source_context =
+        IsContextForAudioSource(new_configuration_context);
+    if (!is_audio_source_context) {
+      LOG_WARN(
+          "No valid remote audio source configuration context in %s, staying "
+          "with the existing configuration context of %s",
+          ToString(new_configuration_context).c_str(),
+          ToString(configuration_context_type_).c_str());
       return;
     }
 
-    auto new_context = LeAudioContextType::VOICEASSISTANTS;
-
-    if (StopStreamIfNeeded(group, new_context)) return;
-
-    if (group->GetTargetState() == AseState::BTA_LE_AUDIO_ASE_STATE_STREAMING) {
-      /* Configuration is the same for new context, just will do update
-       * metadata of stream
-       */
-      GroupStream(active_group_id_, static_cast<uint16_t>(new_context));
+    /* Do nothing if group already has Voiceback channel configured.
+     * WARNING: This eliminates additional reconfigurations but can
+     * lead to unsatisfying audio quality when that direction was
+     * already configured with a lower quality.
+     */
+    const auto has_audio_source_configured =
+        IsDirectionAvailableForCurrentConfiguration(
+            group, le_audio::types::kLeAudioDirectionSource) &&
+        (group->GetState() == AseState::BTA_LE_AUDIO_ASE_STATE_STREAMING);
+    if (has_audio_source_configured) {
+      LOG_DEBUG(
+          "Audio source is already available in the current configuration "
+          "context in %s. Not switching to %s right now.",
+          ToString(configuration_context_type_).c_str(),
+          ToString(new_configuration_context).c_str());
+      return;
     }
 
-    /* Audio sessions are not resumed yet and not streaming, let's pick voice
-     * assistant as possible current context type.
-     */
-    current_context_type_ = new_context;
+    ReconfigureOrUpdateMetadata(group, new_configuration_context,
+                                std::move(new_metadata_context_types));
+  }
+
+  void ReconfigureOrUpdateMetadata(LeAudioDeviceGroup* group,
+                                   LeAudioContextType new_configuration_context,
+                                   AudioContexts new_metadata_context_types) {
+    if (new_configuration_context != configuration_context_type_) {
+      LOG_DEBUG(
+          "Changing configuration context from %s to %s, new "
+          "metadata_contexts: %s",
+          ToString(configuration_context_type_).c_str(),
+          ToString(new_configuration_context).c_str(),
+          ToString(new_metadata_context_types).c_str());
+      // TODO: This should also cache the combined metadata context for the
+      //       reconfiguration, so that once the group reaches IDLE state and
+      //       is about to reconfigure, we would know if we reconfigure with
+      //       sink or source or both metadata.
+      if (SetConfigurationAndStopStreamWhenNeeded(group,
+                                                  new_configuration_context)) {
+        return;
+      }
+    }
+
+    if (group->GetTargetState() == AseState::BTA_LE_AUDIO_ASE_STATE_STREAMING) {
+      LOG_DEBUG(
+          "The %s configuration did not change. Changing only the metadata "
+          "contexts from %s to %s",
+          ToString(configuration_context_type_).c_str(),
+          ToString(get_bidirectional(metadata_context_types_)).c_str(),
+          ToString(new_metadata_context_types).c_str());
+      GroupStream(group->group_id_, new_configuration_context,
+                  new_metadata_context_types);
+    }
   }
 
   static void OnGattReadRspStatic(uint16_t conn_id, tGATT_STATUS status,
@@ -3391,16 +3958,29 @@
                                   void* data) {
     if (!instance) return;
 
+    LeAudioDevice* leAudioDevice =
+        instance->leAudioDevices_.FindByConnId(conn_id);
+
     if (status == GATT_SUCCESS) {
-      instance->LeAudioCharValueHandle(conn_id, hdl, len,
-                                       static_cast<uint8_t*>(value));
+      instance->LeAudioCharValueHandle(conn_id, hdl, len, value);
+    } else if (status == GATT_DATABASE_OUT_OF_SYNC) {
+      instance->ClearDeviceInformationAndStartSearch(leAudioDevice);
+      return;
     }
 
     /* We use data to keep notify connected flag. */
     if (data && !!PTR_TO_INT(data)) {
-      LeAudioDevice* leAudioDevice =
-          instance->leAudioDevices_.FindByConnId(conn_id);
       leAudioDevice->notify_connected_after_read_ = false;
+
+      /* Update PACs and ASEs when all is read.*/
+      btif_storage_leaudio_update_pacs_bin(leAudioDevice->address_);
+      btif_storage_leaudio_update_ase_bin(leAudioDevice->address_);
+
+      btif_storage_set_leaudio_audio_location(
+          leAudioDevice->address_,
+          leAudioDevice->snk_audio_locations_.to_ulong(),
+          leAudioDevice->src_audio_locations_.to_ulong());
+
       instance->connectionReady(leAudioDevice);
     }
   }
@@ -3433,21 +4013,22 @@
             static_cast<bluetooth::hci::iso_manager::cis_data_evt*>(data);
 
         if (audio_receiver_state_ != AudioState::STARTED) {
-          LOG(ERROR) << __func__ << " receiver state not ready ";
+          LOG_ERROR("receiver state not ready, current state=%s",
+                    ToString(audio_receiver_state_).c_str());
           break;
         }
 
-        SendAudioData(event->p_msg->data + event->p_msg->offset,
-                      event->p_msg->len - event->p_msg->offset,
-                      event->cis_conn_hdl, event->ts);
+        HandleIncomingCisData(event->p_msg->data + event->p_msg->offset,
+                              event->p_msg->len - event->p_msg->offset,
+                              event->cis_conn_hdl, event->ts);
       } break;
       case bluetooth::hci::iso_manager::kIsoEventCisEstablishCmpl: {
         auto* event =
             static_cast<bluetooth::hci::iso_manager::cis_establish_cmpl_evt*>(
                 data);
 
-        LeAudioDevice* leAudioDevice =
-            leAudioDevices_.FindByCisConnHdl(event->cis_conn_hdl);
+        LeAudioDevice* leAudioDevice = leAudioDevices_.FindByCisConnHdl(
+            event->cig_id, event->cis_conn_hdl);
         if (!leAudioDevice) {
           LOG(ERROR) << __func__ << ", no bonded Le Audio Device with CIS: "
                      << +event->cis_conn_hdl;
@@ -3471,8 +4052,8 @@
             static_cast<bluetooth::hci::iso_manager::cis_disconnected_evt*>(
                 data);
 
-        LeAudioDevice* leAudioDevice =
-            leAudioDevices_.FindByCisConnHdl(event->cis_conn_hdl);
+        LeAudioDevice* leAudioDevice = leAudioDevices_.FindByCisConnHdl(
+            event->cig_id, event->cis_conn_hdl);
         if (!leAudioDevice) {
           LOG(ERROR) << __func__ << ", no bonded Le Audio Device with CIS: "
                      << +event->cis_conn_hdl;
@@ -3491,9 +4072,15 @@
   }
 
   void IsoSetupIsoDataPathCb(uint8_t status, uint16_t conn_handle,
-                             uint8_t /* cig_id */) {
+                             uint8_t cig_id) {
     LeAudioDevice* leAudioDevice =
-        leAudioDevices_.FindByCisConnHdl(conn_handle);
+        leAudioDevices_.FindByCisConnHdl(cig_id, conn_handle);
+    /* In case device has been disconnected before data path was setup */
+    if (!leAudioDevice) {
+      LOG_WARN("Device for CIG %d and using cis_handle 0x%04x is disconnected.",
+               cig_id, conn_handle);
+      return;
+    }
     LeAudioDeviceGroup* group = aseGroups_.FindById(leAudioDevice->group_id_);
 
     instance->groupStateMachine_->ProcessHciNotifSetupIsoDataPath(
@@ -3501,9 +4088,20 @@
   }
 
   void IsoRemoveIsoDataPathCb(uint8_t status, uint16_t conn_handle,
-                              uint8_t /* cig_id */) {
+                              uint8_t cig_id) {
     LeAudioDevice* leAudioDevice =
-        leAudioDevices_.FindByCisConnHdl(conn_handle);
+        leAudioDevices_.FindByCisConnHdl(cig_id, conn_handle);
+
+    /* If CIS has been disconnected just before ACL being disconnected by the
+     * remote device, leAudioDevice might be already cleared i.e. has no
+     * information about conn_handle, when the data path remove compete arrives.
+     */
+    if (!leAudioDevice) {
+      LOG_WARN("Device for CIG %d and using cis_handle 0x%04x is disconnected.",
+               cig_id, conn_handle);
+      return;
+    }
+
     LeAudioDeviceGroup* group = aseGroups_.FindById(leAudioDevice->group_id_);
 
     instance->groupStateMachine_->ProcessHciNotifRemoveIsoDataPath(
@@ -3516,7 +4114,7 @@
       uint32_t retransmittedPackets, uint32_t crcErrorPackets,
       uint32_t rxUnreceivedPackets, uint32_t duplicatePackets) {
     LeAudioDevice* leAudioDevice =
-        leAudioDevices_.FindByCisConnHdl(conn_handle);
+        leAudioDevices_.FindByCisConnHdl(cig_id, conn_handle);
     if (!leAudioDevice) {
       LOG(WARNING) << __func__ << ", device under connection handle: "
                    << loghex(conn_handle)
@@ -3531,24 +4129,35 @@
         rxUnreceivedPackets, duplicatePackets);
   }
 
-  void HandlePendingAvailableContexts(LeAudioDeviceGroup* group) {
+  void HandlePendingAvailableContextsChange(LeAudioDeviceGroup* group) {
     if (!group) return;
 
-    /* Update group configuration with pending available context */
-    std::optional<AudioContexts> pending_update_available_contexts =
-        group->GetPendingUpdateAvailableContexts();
-    if (pending_update_available_contexts) {
-      std::optional<AudioContexts> updated_contexts =
-          group->UpdateActiveContextsMap(*pending_update_available_contexts);
-
-      if (updated_contexts) {
+    /* Update group configuration with pending available context change */
+    auto contexts = group->GetPendingAvailableContextsChange();
+    if (contexts.any()) {
+      auto success = group->UpdateAudioContextTypeAvailability(contexts);
+      if (success) {
         callbacks_->OnAudioConf(group->audio_directions_, group->group_id_,
                                 group->snk_audio_locations_.to_ulong(),
                                 group->src_audio_locations_.to_ulong(),
-                                group->GetActiveContexts().to_ulong());
+                                group->GetAvailableContexts().value());
       }
+      group->ClearPendingAvailableContextsChange();
+    }
+  }
 
-      group->SetPendingUpdateAvailableContexts(std::nullopt);
+  void HandlePendingDeviceRemove(LeAudioDeviceGroup* group) {
+    for (auto device = group->GetFirstDevice(); device != nullptr;
+         device = group->GetNextDevice(device)) {
+      if (device->GetConnectionState() == DeviceConnectState::PENDING_REMOVAL) {
+        if (device->closing_stream_for_disconnection_) {
+          device->closing_stream_for_disconnection_ = false;
+          LOG_INFO("Disconnecting group id: %d, address: %s", group->group_id_,
+                   device->address_.ToString().c_str());
+          DisconnectDevice(device);
+        }
+        group_remove_node(group, device->address_, true);
+      }
     }
   }
 
@@ -3566,25 +4175,113 @@
     }
   }
 
-  void StatusReportCb(int group_id, GroupStreamStatus status) {
-    LOG(INFO) << __func__ << "status: " << static_cast<int>(status)
-              << " audio_sender_state_: " << audio_sender_state_
-              << " audio_receiver_state_: " << audio_receiver_state_;
+  void updateOffloaderIfNeeded(LeAudioDeviceGroup* group) {
+    if (CodecManager::GetInstance()->GetCodecLocation() !=
+        le_audio::types::CodecLocation::ADSP) {
+      return;
+    }
+
+    LOG_INFO("Group %p, group_id %d", group, group->group_id_);
+
+    const auto* stream_conf = &group->stream_conf;
+
+    if (stream_conf->sink_offloader_changed || stream_conf->sink_is_initial) {
+      LOG_INFO("Update sink offloader streams");
+      uint16_t remote_delay_ms =
+          group->GetRemoteDelay(le_audio::types::kLeAudioDirectionSink);
+      CodecManager::GetInstance()->UpdateActiveSourceAudioConfig(
+          *stream_conf, remote_delay_ms,
+          std::bind(&LeAudioSourceAudioHalClient::UpdateAudioConfigToHal,
+                    le_audio_source_hal_client_.get(), std::placeholders::_1));
+      group->StreamOffloaderUpdated(le_audio::types::kLeAudioDirectionSink);
+    }
+
+    if (stream_conf->source_offloader_changed ||
+        stream_conf->source_is_initial) {
+      LOG_INFO("Update source offloader streams");
+      uint16_t remote_delay_ms =
+          group->GetRemoteDelay(le_audio::types::kLeAudioDirectionSource);
+      CodecManager::GetInstance()->UpdateActiveSinkAudioConfig(
+          *stream_conf, remote_delay_ms,
+          std::bind(&LeAudioSinkAudioHalClient::UpdateAudioConfigToHal,
+                    le_audio_sink_hal_client_.get(), std::placeholders::_1));
+      group->StreamOffloaderUpdated(le_audio::types::kLeAudioDirectionSource);
+    }
+  }
+
+  void NotifyUpperLayerGroupTurnedIdleDuringCall(int group_id) {
+    if (!osi_property_get_bool(kNotifyUpperLayerAboutGroupBeingInIdleDuringCall,
+                               false)) {
+      return;
+    }
+    /* If group is inactive, phone is in call and Group is not having CIS
+     * connected, notify upper layer about it, so it can decide to create SCO if
+     * it is in the handover case
+     */
+    if (in_call_ && active_group_id_ == bluetooth::groups::kGroupUnknown) {
+      callbacks_->OnGroupStatus(group_id, GroupStatus::TURNED_IDLE_DURING_CALL);
+    }
+  }
+
+  void take_stream_time(void) {
+    if (stream_setup_start_timestamp_ == 0) {
+      return;
+    }
+
+    if (stream_start_history_queue_.size() == 10) {
+      stream_start_history_queue_.pop_back();
+    }
+
+    stream_setup_end_timestamp_ = bluetooth::common::time_get_os_boottime_us();
+    stream_start_history_queue_.emplace_front(
+        (stream_setup_end_timestamp_ - stream_setup_start_timestamp_) / 1000);
+
+    stream_setup_end_timestamp_ = 0;
+    stream_setup_start_timestamp_ = 0;
+  }
+
+  void OnStateMachineStatusReportCb(int group_id, GroupStreamStatus status) {
+    LOG_INFO("status: %d , audio_sender_state %s, audio_receiver_state %s",
+             static_cast<int>(status),
+             bluetooth::common::ToString(audio_sender_state_).c_str(),
+             bluetooth::common::ToString(audio_receiver_state_).c_str());
     LeAudioDeviceGroup* group = aseGroups_.FindById(group_id);
     switch (status) {
       case GroupStreamStatus::STREAMING:
-        LOG_ASSERT(group_id == active_group_id_)
-            << __func__ << " invalid group id " << group_id
-            << " active_group_id_ " << active_group_id_;
+        ASSERT_LOG(group_id == active_group_id_, "invalid group id %d!=%d",
+                   group_id, active_group_id_);
+
+        /* It might happen that the configuration has already changed, while
+         * the group was in the ongoing reconfiguration. We should stop the
+         * stream and reconfigure once again.
+         */
+        if (group && group->GetConfigurationContextType() !=
+                         configuration_context_type_) {
+          LOG_DEBUG(
+              "The configuration %s is no longer valid. Stopping the stream to"
+              " reconfigure to %s",
+              ToString(group->GetConfigurationContextType()).c_str(),
+              ToString(configuration_context_type_).c_str());
+          group->SetPendingConfiguration();
+          groupStateMachine_->StopStream(group);
+          stream_setup_start_timestamp_ =
+              bluetooth::common::time_get_os_boottime_us();
+          return;
+        }
+
+        if (group) {
+          updateOffloaderIfNeeded(group);
+        }
+
         if (audio_sender_state_ == AudioState::READY_TO_START)
           StartSendingAudio(group_id);
         if (audio_receiver_state_ == AudioState::READY_TO_START)
           StartReceivingAudio(group_id);
 
-        stream_setup_end_timestamp_ =
-            bluetooth::common::time_get_os_boottime_us();
+        take_stream_time();
+
         le_audio::MetricsCollector::Get()->OnStreamStarted(
-            active_group_id_, current_context_type_);
+            active_group_id_, configuration_context_type_);
         break;
       case GroupStreamStatus::SUSPENDED:
         stream_setup_end_timestamp_ = 0;
@@ -3592,14 +4289,26 @@
         /** Stop Audio but don't release all the Audio resources */
         SuspendAudio();
         break;
-      case GroupStreamStatus::CONFIGURED_BY_USER:
+      case GroupStreamStatus::CONFIGURED_BY_USER: {
+        // Check which directions were suspended
+        uint8_t previously_active_directions = 0;
+        if (audio_sender_state_ >= AudioState::READY_TO_START) {
+          previously_active_directions |=
+              le_audio::types::kLeAudioDirectionSink;
+        }
+        if (audio_receiver_state_ >= AudioState::READY_TO_START) {
+          previously_active_directions |=
+              le_audio::types::kLeAudioDirectionSource;
+        }
+
         /* We are done with reconfiguration.
          * Clean state and if Audio HAL is waiting, cancel the request
          * so Audio HAL can Resume again.
          */
         CancelStreamingRequest();
-        HandlePendingAvailableContexts(group);
-        break;
+        HandlePendingAvailableContextsChange(group);
+        ReconfigurationComplete(previously_active_directions);
+      } break;
       case GroupStreamStatus::CONFIGURED_AUTONOMOUS:
         /* This state is notified only when
          * groups stays into CONFIGURED state after
@@ -3608,22 +4317,30 @@
          */
         FALLTHROUGH;
       case GroupStreamStatus::IDLE: {
-        stream_setup_end_timestamp_ = 0;
-        stream_setup_start_timestamp_ = 0;
         if (group && group->IsPendingConfiguration()) {
           SuspendedForReconfiguration();
+          // TODO: It is not certain to which directions we will
+          //       reconfigure. We would have know the exact
+          //       configuration but this is yet to be selected or have
+          //       the metadata cached from earlier when reconfiguration
+          //       was scheduled.
+          auto adjusted_metedata_context_type = ChooseMetadataContextType(
+              get_bidirectional(metadata_context_types_));
           if (groupStateMachine_->ConfigureStream(
-                  group, current_context_type_,
-                  GetCcid(static_cast<
-                          std::underlying_type<LeAudioContextType>::type>(
-                      current_context_type_)))) {
+                  group, configuration_context_type_,
+                  adjusted_metedata_context_type,
+                  GetAllCcids(adjusted_metedata_context_type))) {
             /* If configuration succeed wait for new status. */
             return;
           }
         }
+        stream_setup_end_timestamp_ = 0;
+        stream_setup_start_timestamp_ = 0;
         CancelStreamingRequest();
         if (group) {
-          HandlePendingAvailableContexts(group);
+          NotifyUpperLayerGroupTurnedIdleDuringCall(group->group_id_);
+          HandlePendingAvailableContextsChange(group);
+          HandlePendingDeviceRemove(group);
           HandlePendingDeviceDisconnection(group);
         }
         break;
@@ -3649,14 +4366,26 @@
   LeAudioDeviceGroups aseGroups_;
   LeAudioGroupStateMachine* groupStateMachine_;
   int active_group_id_;
-  LeAudioContextType current_context_type_;
+  LeAudioContextType configuration_context_type_;
+  static constexpr char kAllowMultipleContextsInMetadata[] =
+      "persist.bluetooth.leaudio.allow.multiple.contexts";
+  BidirectionalPair<AudioContexts> metadata_context_types_;
   uint64_t stream_setup_start_timestamp_;
   uint64_t stream_setup_end_timestamp_;
+  std::deque<uint64_t> stream_start_history_queue_;
 
   /* Microphone (s) */
   AudioState audio_receiver_state_;
   /* Speaker(s) */
   AudioState audio_sender_state_;
+  /* Keep in call state. */
+  bool in_call_;
+
+  /* Reconnection mode */
+  tBTM_BLE_CONN_TYPE reconnection_mode_;
+
+  static constexpr char kNotifyUpperLayerAboutGroupBeingInIdleDuringCall[] =
+      "persist.bluetooth.leaudio.notify.idle.during.call";
 
   /* Current stream configuration */
   LeAudioCodecConfiguration current_source_codec_config;
@@ -3692,28 +4421,30 @@
   lc3_decoder_t lc3_decoder_right;
 
   std::vector<uint8_t> encoded_data;
-  const void* audio_source_instance_;
-  const void* audio_sink_instance_;
+  std::unique_ptr<LeAudioSourceAudioHalClient> le_audio_source_hal_client_;
+  std::unique_ptr<LeAudioSinkAudioHalClient> le_audio_sink_hal_client_;
   static constexpr uint64_t kAudioSuspentKeepIsoAliveTimeoutMs = 5000;
+  static constexpr uint64_t kAudioDisableTimeoutMs = 3000;
   static constexpr char kAudioSuspentKeepIsoAliveTimeoutMsProp[] =
       "persist.bluetooth.leaudio.audio.suspend.timeoutms";
+  alarm_t* close_vbc_timeout_;
   alarm_t* suspend_timeout_;
+  alarm_t* disable_timer_;
+  static constexpr uint64_t kDeviceAttachDelayMs = 500;
 
   std::vector<int16_t> cached_channel_data_;
   uint32_t cached_channel_timestamp_ = 0;
   uint32_t cached_channel_is_left_;
 
   void ClientAudioIntefraceRelease() {
-    if (audio_source_instance_) {
-      leAudioClientAudioSource->Stop();
-      leAudioClientAudioSource->Release(audio_source_instance_);
-      audio_source_instance_ = nullptr;
+    if (le_audio_source_hal_client_) {
+      le_audio_source_hal_client_->Stop();
+      le_audio_source_hal_client_.reset();
     }
 
-    if (audio_sink_instance_) {
-      leAudioClientAudioSink->Stop();
-      leAudioClientAudioSink->Release(audio_sink_instance_);
-      audio_sink_instance_ = nullptr;
+    if (le_audio_sink_hal_client_) {
+      le_audio_sink_hal_client_->Stop();
+      le_audio_sink_hal_client_.reset();
     }
     le_audio::MetricsCollector::Get()->OnStreamEnded(active_group_id_);
   }
@@ -3725,7 +4456,7 @@
 void le_audio_gattc_callback(tBTA_GATTC_EVT event, tBTA_GATTC* p_data) {
   if (!p_data || !instance) return;
 
-  DLOG(INFO) << __func__ << " event = " << +event;
+  LOG_DEBUG("event = %d", static_cast<int>(event));
 
   switch (event) {
     case BTA_GATTC_DEREG_EVT:
@@ -3734,7 +4465,7 @@
     case BTA_GATTC_NOTIF_EVT:
       instance->LeAudioCharValueHandle(
           p_data->notify.conn_id, p_data->notify.handle, p_data->notify.len,
-          static_cast<uint8_t*>(p_data->notify.value));
+          static_cast<uint8_t*>(p_data->notify.value), true);
 
       if (!p_data->notify.is_notify)
         BTA_GATTC_SendIndConfirm(p_data->notify.conn_id, p_data->notify.handle);
@@ -3777,6 +4508,7 @@
       instance->OnServiceChangeEvent(p_data->remote_bda);
       break;
     case BTA_GATTC_CFG_MTU_EVT:
+      instance->OnMtuChanged(p_data->cfg_mtu.conn_id, p_data->cfg_mtu.mtu);
       break;
 
     default:
@@ -3822,7 +4554,7 @@
 class CallbacksImpl : public LeAudioGroupStateMachine::Callbacks {
  public:
   void StatusReportCb(int group_id, GroupStreamStatus status) override {
-    if (instance) instance->StatusReportCb(group_id, status);
+    if (instance) instance->OnStateMachineStatusReportCb(group_id, status);
   }
 
   void OnStateTransitionTimeout(int group_id) override {
@@ -3832,49 +4564,46 @@
 
 CallbacksImpl stateMachineCallbacksImpl;
 
-class LeAudioClientAudioSinkReceiverImpl
-    : public LeAudioClientAudioSinkReceiver {
+class SourceCallbacksImpl : public LeAudioSourceAudioHalClient::Callbacks {
  public:
   void OnAudioDataReady(const std::vector<uint8_t>& data) override {
     if (instance) instance->OnAudioDataReady(data);
   }
   void OnAudioSuspend(std::promise<void> do_suspend_promise) override {
-    if (instance) instance->OnAudioSinkSuspend();
+    if (instance) instance->OnLocalAudioSourceSuspend();
     do_suspend_promise.set_value();
   }
 
   void OnAudioResume(void) override {
-    if (instance) instance->OnAudioSinkResume();
+    if (instance) instance->OnLocalAudioSourceResume();
   }
 
   void OnAudioMetadataUpdate(
-      std::promise<void> do_metadata_update_promise,
-      const source_metadata_t& source_metadata) override {
-    if (instance) instance->OnAudioMetadataUpdate(source_metadata);
-    do_metadata_update_promise.set_value();
+      std::vector<struct playback_track_metadata> source_metadata) override {
+    if (instance)
+      instance->OnLocalAudioSourceMetadataUpdate(std::move(source_metadata));
   }
 };
 
-class LeAudioClientAudioSourceReceiverImpl
-    : public LeAudioClientAudioSourceReceiver {
+class SinkCallbacksImpl : public LeAudioSinkAudioHalClient::Callbacks {
  public:
   void OnAudioSuspend(std::promise<void> do_suspend_promise) override {
-    if (instance) instance->OnAudioSourceSuspend();
+    if (instance) instance->OnLocalAudioSinkSuspend();
     do_suspend_promise.set_value();
   }
   void OnAudioResume(void) override {
-    if (instance) instance->OnAudioSourceResume();
+    if (instance) instance->OnLocalAudioSinkResume();
   }
 
-  void OnAudioMetadataUpdate(std::promise<void> do_metadata_update_promise,
-                             const sink_metadata_t& sink_metadata) override {
-    if (instance) instance->OnAudioSourceMetadataUpdate(sink_metadata);
-    do_metadata_update_promise.set_value();
+  void OnAudioMetadataUpdate(
+      std::vector<struct record_track_metadata> sink_metadata) override {
+    if (instance)
+      instance->OnLocalAudioSinkMetadataUpdate(std::move(sink_metadata));
   }
 };
 
-LeAudioClientAudioSinkReceiverImpl audioSinkReceiverImpl;
-LeAudioClientAudioSourceReceiverImpl audioSourceReceiverImpl;
+SourceCallbacksImpl audioSinkReceiverImpl;
+SinkCallbacksImpl audioSourceReceiverImpl;
 
 class DeviceGroupsCallbacksImpl : public DeviceGroupsCallbacks {
  public:
@@ -3902,13 +4631,61 @@
 
 }  // namespace
 
-void LeAudioClient::AddFromStorage(const RawAddress& addr, bool autoconnect) {
+void LeAudioClient::AddFromStorage(
+    const RawAddress& addr, bool autoconnect, int sink_audio_location,
+    int source_audio_location, int sink_supported_context_types,
+    int source_supported_context_types, const std::vector<uint8_t>& handles,
+    const std::vector<uint8_t>& sink_pacs,
+    const std::vector<uint8_t>& source_pacs, const std::vector<uint8_t>& ases) {
   if (!instance) {
     LOG(ERROR) << "Not initialized yet";
     return;
   }
 
-  instance->AddFromStorage(addr, autoconnect);
+  instance->AddFromStorage(addr, autoconnect, sink_audio_location,
+                           source_audio_location, sink_supported_context_types,
+                           source_supported_context_types, handles, sink_pacs,
+                           source_pacs, ases);
+}
+
+bool LeAudioClient::GetHandlesForStorage(const RawAddress& addr,
+                                         std::vector<uint8_t>& out) {
+  if (!instance) {
+    LOG_ERROR("Not initialized yet");
+    return false;
+  }
+
+  return instance->GetHandlesForStorage(addr, out);
+}
+
+bool LeAudioClient::GetSinkPacsForStorage(const RawAddress& addr,
+                                          std::vector<uint8_t>& out) {
+  if (!instance) {
+    LOG_ERROR("Not initialized yet");
+    return false;
+  }
+
+  return instance->GetSinkPacsForStorage(addr, out);
+}
+
+bool LeAudioClient::GetSourcePacsForStorage(const RawAddress& addr,
+                                            std::vector<uint8_t>& out) {
+  if (!instance) {
+    LOG_ERROR("Not initialized yet");
+    return false;
+  }
+
+  return instance->GetSourcePacsForStorage(addr, out);
+}
+
+bool LeAudioClient::GetAsesForStorage(const RawAddress& addr,
+                                      std::vector<uint8_t>& out) {
+  if (!instance) {
+    LOG_ERROR("Not initialized yet");
+    return false;
+  }
+
+  return instance->GetAsesForStorage(addr, out);
 }
 
 bool LeAudioClient::IsLeAudioClientRunning(void) { return instance != nullptr; }
@@ -3945,11 +4722,6 @@
 
   IsoManager::GetInstance()->Start();
 
-  if (leAudioClientAudioSource == nullptr)
-    leAudioClientAudioSource = new LeAudioUnicastClientAudioSource();
-  if (leAudioClientAudioSink == nullptr)
-    leAudioClientAudioSink = new LeAudioUnicastClientAudioSink();
-
   audioSinkReceiver = &audioSinkReceiverImpl;
   audioSourceReceiver = &audioSourceReceiverImpl;
   stateMachineHciCallbacks = &stateMachineHciCallbacksImpl;
@@ -3973,9 +4745,9 @@
   else
     dprintf(fd, "  Not initialized \n");
 
-  LeAudioUnicastClientAudioSource::DebugDump(fd);
-  LeAudioUnicastClientAudioSink::DebugDump(fd);
-  le_audio::AudioSetConfigurationProvider::Get()->DebugDump(fd);
+  LeAudioSinkAudioHalClient::DebugDump(fd);
+  LeAudioSourceAudioHalClient::DebugDump(fd);
+  le_audio::AudioSetConfigurationProvider::DebugDump(fd);
   IsoManager::GetInstance()->Dump(fd);
   dprintf(fd, "\n");
 }
@@ -3991,15 +4763,6 @@
   ptr->Cleanup(cleanupCb);
   delete ptr;
   ptr = nullptr;
-  if (leAudioClientAudioSource) {
-    delete leAudioClientAudioSource;
-    leAudioClientAudioSource = nullptr;
-  }
-
-  if (leAudioClientAudioSink) {
-    delete leAudioClientAudioSink;
-    leAudioClientAudioSink = nullptr;
-  }
 
   CodecManager::GetInstance()->Stop();
   ContentControlIdKeeper::GetInstance()->Stop();
@@ -4007,15 +4770,3 @@
   IsoManager::GetInstance()->Stop();
   le_audio::MetricsCollector::Get()->Flush();
 }
-
-void LeAudioClient::InitializeAudioClients(
-    LeAudioUnicastClientAudioSource* clientAudioSource,
-    LeAudioUnicastClientAudioSink* clientAudioSink) {
-  if (leAudioClientAudioSource || leAudioClientAudioSink) {
-    LOG(WARNING) << __func__ << ", audio clients already initialized";
-    return;
-  }
-
-  leAudioClientAudioSource = clientAudioSource;
-  leAudioClientAudioSink = clientAudioSink;
-}
diff --git a/system/bta/le_audio/client_audio.cc b/system/bta/le_audio/client_audio.cc
deleted file mode 100644
index 612b277..0000000
--- a/system/bta/le_audio/client_audio.cc
+++ /dev/null
@@ -1,695 +0,0 @@
-/******************************************************************************
- *
- * Copyright 2019 HIMSA II K/S - www.himsa.com. Represented by EHIMA -
- * www.ehima.com
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at:
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- *
- ******************************************************************************/
-
-#include "client_audio.h"
-
-#include "audio_hal_interface/le_audio_software.h"
-#include "bta/le_audio/codec_manager.h"
-#include "btu.h"
-#include "common/time_util.h"
-#include "osi/include/wakelock.h"
-
-using bluetooth::audio::le_audio::LeAudioClientInterface;
-using ::le_audio::CodecManager;
-using ::le_audio::types::CodecLocation;
-
-namespace {
-LeAudioClientInterface* leAudioClientInterface = nullptr;
-
-enum {
-  HAL_UNINITIALIZED,
-  HAL_STOPPED,
-  HAL_STARTED,
-} le_audio_sink_hal_state,
-    le_audio_source_hal_state;
-
-struct AudioHalStats {
-  size_t media_read_total_underflow_bytes;
-  size_t media_read_total_underflow_count;
-  uint64_t media_read_last_underflow_us;
-
-  AudioHalStats() { Reset(); }
-
-  void Reset() {
-    media_read_total_underflow_bytes = 0;
-    media_read_total_underflow_count = 0;
-    media_read_last_underflow_us = 0;
-  }
-};
-
-AudioHalStats stats;
-
-bool le_audio_source_on_metadata_update_req(
-    const sink_metadata_t& sink_metadata) {
-  // TODO: update microphone configuration based on sink metadata
-  return true;
-}
-
-}  // namespace
-
-bool LeAudioClientAudioSource::SinkOnResumeReq(bool start_media_task) {
-  std::lock_guard<std::mutex> guard(sinkInterfaceMutex_);
-  if (audioSinkReceiver_ == nullptr) {
-    LOG(ERROR) << __func__ << ": audioSinkReceiver is nullptr";
-    return false;
-  }
-  bt_status_t status = do_in_main_thread(
-      FROM_HERE, base::BindOnce(&LeAudioClientAudioSinkReceiver::OnAudioResume,
-                                base::Unretained(audioSinkReceiver_)));
-  if (status != BT_STATUS_SUCCESS) {
-    LOG(ERROR) << __func__
-               << ": LE_AUDIO_CTRL_CMD_START: do_in_main_thread err=" << status;
-    return false;
-  }
-
-  return true;
-}
-
-void LeAudioClientAudioSource::SendAudioData() {
-  // 24 bit audio is aligned to 32bit
-  int bytes_per_sample = (source_codec_config_.bits_per_sample == 24)
-                             ? 4
-                             : (source_codec_config_.bits_per_sample / 8);
-
-  uint32_t bytes_per_tick =
-      (source_codec_config_.num_channels * source_codec_config_.sample_rate *
-       source_codec_config_.data_interval_us / 1000 * bytes_per_sample) /
-      1000;
-
-  std::vector<uint8_t> data(bytes_per_tick);
-
-  uint32_t bytes_read = 0;
-  if (sinkClientInterface_ != nullptr) {
-    bytes_read = sinkClientInterface_->Read(data.data(), bytes_per_tick);
-  } else {
-    LOG(ERROR) << __func__ << ", no LE Audio sink client interface - aborting.";
-    return;
-  }
-
-  // LOG(INFO) << __func__ << ", bytes_read: " << static_cast<int>(bytes_read)
-  //          << ", bytes_per_tick: " << static_cast<int>(bytes_per_tick);
-
-  if (bytes_read < bytes_per_tick) {
-    stats.media_read_total_underflow_bytes += bytes_per_tick - bytes_read;
-    stats.media_read_total_underflow_count++;
-    stats.media_read_last_underflow_us =
-        bluetooth::common::time_get_os_boottime_us();
-  }
-
-  std::lock_guard<std::mutex> guard(sinkInterfaceMutex_);
-  if (audioSinkReceiver_ != nullptr) {
-    audioSinkReceiver_->OnAudioDataReady(data);
-  }
-}
-
-bool LeAudioClientAudioSource::InitAudioSinkThread(const std::string name) {
-  worker_thread_ = new bluetooth::common::MessageLoopThread(name);
-  worker_thread_->StartUp();
-  if (!worker_thread_->IsRunning()) {
-    LOG(ERROR) << __func__ << ", unable to start up media thread";
-    return false;
-  }
-
-  /* Schedule the rest of the operations */
-  if (!worker_thread_->EnableRealTimeScheduling()) {
-#if defined(OS_ANDROID)
-    LOG(FATAL) << __func__ << ", Failed to increase media thread priority";
-#endif
-  }
-
-  return true;
-}
-
-void LeAudioClientAudioSource::StartAudioTicks() {
-  wakelock_acquire();
-  audio_timer_.SchedulePeriodic(
-      worker_thread_->GetWeakPtr(), FROM_HERE,
-      base::Bind(&LeAudioClientAudioSource::SendAudioData,
-                 base::Unretained(this)),
-#if BASE_VER < 931007
-      base::TimeDelta::FromMicroseconds(source_codec_config_.data_interval_us));
-#else
-      base::Microseconds(source_codec_config_.data_interval_us));
-#endif
-}
-
-void LeAudioClientAudioSource::StopAudioTicks() {
-  audio_timer_.CancelAndWait();
-  wakelock_release();
-}
-
-bool LeAudioClientAudioSource::SinkOnSuspendReq() {
-  std::lock_guard<std::mutex> guard(sinkInterfaceMutex_);
-  if (CodecManager::GetInstance()->GetCodecLocation() == CodecLocation::HOST) {
-    StopAudioTicks();
-  }
-  if (audioSinkReceiver_ != nullptr) {
-    // Call OnAudioSuspend and block till it returns.
-    std::promise<void> do_suspend_promise;
-    std::future<void> do_suspend_future = do_suspend_promise.get_future();
-    bt_status_t status = do_in_main_thread(
-        FROM_HERE,
-        base::BindOnce(&LeAudioClientAudioSinkReceiver::OnAudioSuspend,
-                       base::Unretained(audioSinkReceiver_),
-                       std::move(do_suspend_promise)));
-    if (status == BT_STATUS_SUCCESS) {
-      do_suspend_future.wait();
-      return true;
-    } else {
-      LOG(ERROR) << __func__
-                 << ": LE_AUDIO_CTRL_CMD_SUSPEND: do_in_main_thread err="
-                 << status;
-    }
-  } else {
-    LOG(ERROR) << __func__
-               << ": LE_AUDIO_CTRL_CMD_SUSPEND: audio receiver not started";
-  }
-  return false;
-}
-
-bool LeAudioClientAudioSource::SinkOnMetadataUpdateReq(
-    const source_metadata_t& source_metadata) {
-  std::lock_guard<std::mutex> guard(sinkInterfaceMutex_);
-  if (audioSinkReceiver_ == nullptr) {
-    LOG(ERROR) << __func__ << ", audio receiver not started";
-    return false;
-  }
-
-  // Call OnAudioSuspend and block till it returns.
-  std::promise<void> do_update_metadata_promise;
-  std::future<void> do_update_metadata_future =
-      do_update_metadata_promise.get_future();
-  bt_status_t status = do_in_main_thread(
-      FROM_HERE,
-      base::BindOnce(&LeAudioClientAudioSinkReceiver::OnAudioMetadataUpdate,
-                     base::Unretained(audioSinkReceiver_),
-                     std::move(do_update_metadata_promise), source_metadata));
-
-  if (status == BT_STATUS_SUCCESS) {
-    do_update_metadata_future.wait();
-    return true;
-  }
-
-  LOG(ERROR) << __func__ << ", do_in_main_thread err=" << status;
-
-  return false;
-}
-
-bool LeAudioUnicastClientAudioSink::SourceOnResumeReq(bool start_media_task) {
-  if (audioSourceReceiver_ == nullptr) {
-    LOG(ERROR) << __func__ << ": audioSourceReceiver is nullptr";
-    return false;
-  }
-
-  bt_status_t status = do_in_main_thread(
-      FROM_HERE,
-      base::BindOnce(&LeAudioClientAudioSourceReceiver::OnAudioResume,
-                     base::Unretained(audioSourceReceiver_)));
-  if (status != BT_STATUS_SUCCESS) {
-    LOG(ERROR) << __func__
-               << ": LE_AUDIO_CTRL_CMD_START: do_in_main_thread err=" << status;
-    return false;
-  }
-
-  return true;
-}
-
-bool LeAudioUnicastClientAudioSink::SourceOnSuspendReq() {
-  if (audioSourceReceiver_ != nullptr) {
-    // Call OnAudioSuspend and block till it returns.
-    std::promise<void> do_suspend_promise;
-    std::future<void> do_suspend_future = do_suspend_promise.get_future();
-    bt_status_t status = do_in_main_thread(
-        FROM_HERE,
-        base::BindOnce(&LeAudioClientAudioSourceReceiver::OnAudioSuspend,
-                       base::Unretained(audioSourceReceiver_),
-                       std::move(do_suspend_promise)));
-    if (status == BT_STATUS_SUCCESS) {
-      do_suspend_future.wait();
-      return true;
-    } else {
-      LOG(ERROR) << __func__
-                 << ": LE_AUDIO_CTRL_CMD_SUSPEND: do_in_main_thread err="
-                 << status;
-    }
-  } else {
-    LOG(ERROR) << __func__
-               << ": LE_AUDIO_CTRL_CMD_SUSPEND: audio receiver not started";
-  }
-  return false;
-}
-
-bool LeAudioUnicastClientAudioSink::SourceOnMetadataUpdateReq(
-    const sink_metadata_t& sink_metadata) {
-  if (audioSourceReceiver_ == nullptr) {
-    LOG(ERROR) << __func__ << ", audio receiver not started";
-    return false;
-  }
-
-  // Call OnAudioSuspend and block till it returns.
-  std::promise<void> do_update_metadata_promise;
-  std::future<void> do_update_metadata_future =
-      do_update_metadata_promise.get_future();
-  bt_status_t status = do_in_main_thread(
-      FROM_HERE,
-      base::BindOnce(&LeAudioClientAudioSourceReceiver::OnAudioMetadataUpdate,
-                     base::Unretained(audioSourceReceiver_),
-                     std::move(do_update_metadata_promise), sink_metadata));
-
-  if (status == BT_STATUS_SUCCESS) {
-    do_update_metadata_future.wait();
-    return true;
-  }
-
-  LOG(ERROR) << __func__ << ", do_in_main_thread err=" << status;
-
-  return false;
-}
-
-bool LeAudioClientAudioSource::Start(
-    const LeAudioCodecConfiguration& codec_configuration,
-    LeAudioClientAudioSinkReceiver* audioReceiver) {
-  LOG(INFO) << __func__;
-
-  if (!sinkClientInterface_) {
-    LOG(ERROR) << "sinkClientInterface is not Acquired!";
-    return false;
-  }
-
-  if (le_audio_sink_hal_state == HAL_STARTED) {
-    LOG(ERROR) << "LE audio device HAL is already in use!";
-    return false;
-  }
-
-  LOG(INFO) << __func__ << ": Le Audio Source Open, bits per sample: "
-            << int{codec_configuration.bits_per_sample}
-            << ", num channels: " << int{codec_configuration.num_channels}
-            << ", sample rate: " << codec_configuration.sample_rate
-            << ", data interval: " << codec_configuration.data_interval_us;
-
-  stats.Reset();
-
-  /* Global config for periodic audio data */
-  source_codec_config_ = codec_configuration;
-  LeAudioClientInterface::PcmParameters pcmParameters = {
-      .data_interval_us = codec_configuration.data_interval_us,
-      .sample_rate = codec_configuration.sample_rate,
-      .bits_per_sample = codec_configuration.bits_per_sample,
-      .channels_count = codec_configuration.num_channels};
-
-  sinkClientInterface_->SetPcmParameters(pcmParameters);
-  sinkClientInterface_->StartSession();
-
-  std::lock_guard<std::mutex> guard(sinkInterfaceMutex_);
-  audioSinkReceiver_ = audioReceiver;
-  le_audio_sink_hal_state = HAL_STARTED;
-
-  return true;
-}
-
-void LeAudioClientAudioSource::Stop() {
-  LOG(INFO) << __func__;
-  if (!sinkClientInterface_) {
-    LOG(ERROR) << __func__ << " sinkClientInterface stopped";
-    return;
-  }
-
-  if (le_audio_sink_hal_state != HAL_STARTED) {
-    LOG(ERROR) << "LE audio device HAL was not started!";
-    return;
-  }
-
-  LOG(INFO) << __func__ << ": Le Audio Source Close";
-
-  sinkClientInterface_->StopSession();
-  le_audio_sink_hal_state = HAL_STOPPED;
-
-  if (CodecManager::GetInstance()->GetCodecLocation() == CodecLocation::HOST) {
-    StopAudioTicks();
-  }
-
-  std::lock_guard<std::mutex> guard(sinkInterfaceMutex_);
-  audioSinkReceiver_ = nullptr;
-}
-
-const void* LeAudioClientAudioSource::Acquire(
-    bool is_broadcasting_session_type) {
-  LOG(INFO) << __func__;
-
-  /* Get pointer to singleton LE audio client interface */
-  if (leAudioClientInterface == nullptr) {
-    leAudioClientInterface = LeAudioClientInterface::Get();
-
-    if (leAudioClientInterface == nullptr) {
-      LOG(ERROR) << __func__ << ", can't get LE audio client interface";
-      return nullptr;
-    }
-  }
-
-  auto sink_stream_cb = bluetooth::audio::le_audio::StreamCallbacks{
-      .on_resume_ = std::bind(&LeAudioClientAudioSource::SinkOnResumeReq, this,
-                              std::placeholders::_1),
-      .on_suspend_ =
-          std::bind(&LeAudioClientAudioSource::SinkOnSuspendReq, this),
-      .on_metadata_update_ =
-          std::bind(&LeAudioClientAudioSource::SinkOnMetadataUpdateReq, this,
-                    std::placeholders::_1),
-      .on_sink_metadata_update_ = le_audio_source_on_metadata_update_req,
-  };
-
-  sinkClientInterface_ = leAudioClientInterface->GetSink(
-      sink_stream_cb, get_main_thread(), is_broadcasting_session_type);
-
-  if (sinkClientInterface_ == nullptr) {
-    LOG(ERROR) << __func__ << ", can't get LE audio sink client interface";
-    return nullptr;
-  }
-
-  le_audio_sink_hal_state = HAL_STOPPED;
-  return sinkClientInterface_;
-}
-
-const void* LeAudioUnicastClientAudioSource::Acquire() {
-  const void* sinkClientInterface = LeAudioClientAudioSource::Acquire(false);
-
-  if (!sinkClientInterface) return nullptr;
-  if (!InitAudioSinkThread("bt_le_audio_unicast_sink_worker_thread_"))
-    return nullptr;
-
-  return sinkClientInterface;
-}
-
-const void* LeAudioBroadcastClientAudioSource::Acquire() {
-  const void* sinkClientInterface = LeAudioClientAudioSource::Acquire(true);
-
-  if (!sinkClientInterface) return nullptr;
-  if (!InitAudioSinkThread("bt_le_audio_sink_broadcast_worker_thread_"))
-    return nullptr;
-
-  return sinkClientInterface;
-}
-
-void LeAudioClientAudioSource::Release(const void* instance) {
-  LOG(INFO) << __func__;
-  if (sinkClientInterface_ != instance) {
-    LOG(WARNING) << "Trying to release not own session";
-    return;
-  }
-
-  if (le_audio_sink_hal_state == HAL_UNINITIALIZED) {
-    LOG(WARNING) << "LE audio device HAL is not running.";
-    return;
-  }
-
-  worker_thread_->ShutDown();
-  sinkClientInterface_->Cleanup();
-  leAudioClientInterface->ReleaseSink(sinkClientInterface_);
-  le_audio_sink_hal_state = HAL_UNINITIALIZED;
-  sinkClientInterface_ = nullptr;
-}
-
-void LeAudioClientAudioSource::ConfirmStreamingRequest() {
-  LOG(INFO) << __func__;
-  if ((sinkClientInterface_ == nullptr) ||
-      (le_audio_sink_hal_state != HAL_STARTED)) {
-    LOG(ERROR) << "LE audio device HAL was not started!";
-    return;
-  }
-
-  sinkClientInterface_->ConfirmStreamingRequest();
-  if (CodecManager::GetInstance()->GetCodecLocation() != CodecLocation::HOST)
-    return;
-
-  StartAudioTicks();
-}
-
-void LeAudioClientAudioSource::SuspendedForReconfiguration() {
-  LOG(INFO) << __func__;
-  if ((sinkClientInterface_ == nullptr) ||
-      (le_audio_sink_hal_state != HAL_STARTED)) {
-    LOG(ERROR) << "LE audio device HAL was not started!";
-    return;
-  }
-
-  sinkClientInterface_->SuspendedForReconfiguration();
-}
-
-void LeAudioClientAudioSource::CancelStreamingRequest() {
-  LOG(INFO) << __func__;
-  if ((sinkClientInterface_ == nullptr) ||
-      (le_audio_sink_hal_state != HAL_STARTED)) {
-    LOG(ERROR) << "LE audio device HAL was not started!";
-    return;
-  }
-
-  sinkClientInterface_->CancelStreamingRequest();
-}
-
-void LeAudioClientAudioSource::UpdateRemoteDelay(uint16_t remote_delay_ms) {
-  LOG(INFO) << __func__;
-  if ((sinkClientInterface_ == nullptr) ||
-      (le_audio_sink_hal_state != HAL_STARTED)) {
-    LOG(ERROR) << "LE audio device HAL was not started!";
-    return;
-  }
-
-  sinkClientInterface_->SetRemoteDelay(remote_delay_ms);
-}
-
-void LeAudioClientAudioSource::DebugDump(int fd) {
-  uint64_t now_us = bluetooth::common::time_get_os_boottime_us();
-  std::stringstream stream;
-  stream << "  Le Audio Audio HAL:"
-         << "\n    Counts (underflow)                                      : "
-         << stats.media_read_total_underflow_count
-         << "\n    Bytes (underflow)                                       : "
-         << stats.media_read_total_underflow_bytes
-         << "\n    Last update time ago in ms (underflow)                  : "
-         << (stats.media_read_last_underflow_us > 0
-                 ? (unsigned long long)(now_us -
-                                        stats.media_read_last_underflow_us) /
-                       1000
-                 : 0)
-         << std::endl;
-  dprintf(fd, "%s", stream.str().c_str());
-}
-
-void LeAudioClientAudioSource::UpdateAudioConfigToHal(
-    const ::le_audio::offload_config& config) {
-  LOG(INFO) << __func__;
-  if ((sinkClientInterface_ == nullptr) ||
-      (le_audio_sink_hal_state != HAL_STARTED)) {
-    LOG(ERROR) << "LE audio device HAL was not started!";
-    return;
-  }
-
-  sinkClientInterface_->UpdateAudioConfigToHal(config);
-}
-
-bool LeAudioUnicastClientAudioSink::Start(
-    const LeAudioCodecConfiguration& codec_configuration,
-    LeAudioClientAudioSourceReceiver* audioReceiver) {
-  LOG(INFO) << __func__;
-  if (!sourceClientInterface_) {
-    LOG(ERROR) << "sourceClientInterface is not Acquired!";
-    return false;
-  }
-
-  if (le_audio_source_hal_state == HAL_STARTED) {
-    LOG(ERROR) << "LE audio device HAL is already in use!";
-    return false;
-  }
-
-  LOG(INFO) << __func__ << ": Le Audio Sink Open, bit rate: "
-            << int{codec_configuration.bits_per_sample}
-            << ", num channels: " << int{codec_configuration.num_channels}
-            << ", sample rate: " << codec_configuration.sample_rate
-            << ", data interval: " << codec_configuration.data_interval_us;
-
-  LeAudioClientInterface::PcmParameters pcmParameters = {
-      .data_interval_us = codec_configuration.data_interval_us,
-      .sample_rate = codec_configuration.sample_rate,
-      .bits_per_sample = codec_configuration.bits_per_sample,
-      .channels_count = codec_configuration.num_channels};
-
-  sourceClientInterface_->SetPcmParameters(pcmParameters);
-  sourceClientInterface_->StartSession();
-
-  audioSourceReceiver_ = audioReceiver;
-  le_audio_source_hal_state = HAL_STARTED;
-  return true;
-}
-
-void LeAudioUnicastClientAudioSink::Stop() {
-  LOG(INFO) << __func__;
-  if (!sourceClientInterface_) {
-    LOG(ERROR) << __func__ << " sourceClientInterface stopped";
-    return;
-  }
-
-  if (le_audio_source_hal_state != HAL_STARTED) {
-    LOG(ERROR) << "LE audio device HAL was not started!";
-    return;
-  }
-
-  LOG(INFO) << __func__ << ": Le Audio Sink Close";
-
-  sourceClientInterface_->StopSession();
-  le_audio_source_hal_state = HAL_STOPPED;
-  audioSourceReceiver_ = nullptr;
-}
-
-const void* LeAudioUnicastClientAudioSink::Acquire() {
-  LOG(INFO) << __func__;
-  if (sourceClientInterface_ != nullptr) {
-    LOG(WARNING) << __func__ << ", Source client interface already initialized";
-    return nullptr;
-  }
-
-  /* Get pointer to singleton LE audio client interface */
-  if (leAudioClientInterface == nullptr) {
-    leAudioClientInterface = LeAudioClientInterface::Get();
-
-    if (leAudioClientInterface == nullptr) {
-      LOG(ERROR) << __func__ << ", can't get LE audio client interface";
-      return nullptr;
-    }
-  }
-
-  auto source_stream_cb = bluetooth::audio::le_audio::StreamCallbacks{
-      .on_resume_ = std::bind(&LeAudioUnicastClientAudioSink::SourceOnResumeReq,
-                              this, std::placeholders::_1),
-      .on_suspend_ =
-          std::bind(&LeAudioUnicastClientAudioSink::SourceOnSuspendReq, this),
-      .on_sink_metadata_update_ =
-          std::bind(&LeAudioUnicastClientAudioSink::SourceOnMetadataUpdateReq,
-                    this, std::placeholders::_1),
-  };
-
-  sourceClientInterface_ =
-      leAudioClientInterface->GetSource(source_stream_cb, get_main_thread());
-
-  if (sourceClientInterface_ == nullptr) {
-    LOG(ERROR) << __func__ << ", can't get LE audio source client interface";
-    return nullptr;
-  }
-
-  le_audio_source_hal_state = HAL_STOPPED;
-  return sourceClientInterface_;
-}
-
-void LeAudioUnicastClientAudioSink::Release(const void* instance) {
-  LOG(INFO) << __func__;
-  if (sourceClientInterface_ != instance) {
-    LOG(WARNING) << "Trying to release not own session";
-    return;
-  }
-
-  if (le_audio_source_hal_state == HAL_UNINITIALIZED) {
-    LOG(WARNING) << ", LE audio device source HAL is not running.";
-    return;
-  }
-
-  sourceClientInterface_->Cleanup();
-  leAudioClientInterface->ReleaseSource(sourceClientInterface_);
-  le_audio_source_hal_state = HAL_UNINITIALIZED;
-  sourceClientInterface_ = nullptr;
-}
-
-size_t LeAudioUnicastClientAudioSink::SendData(uint8_t* data, uint16_t size) {
-  size_t bytes_written;
-  if (!sourceClientInterface_) {
-    LOG(ERROR) << "sourceClientInterface not initialized!";
-    return 0;
-  }
-
-  if (le_audio_source_hal_state != HAL_STARTED) {
-    LOG(ERROR) << "LE audio device HAL was not started!";
-    return 0;
-  }
-
-  /* TODO: What to do if not all data is written ? */
-  bytes_written = sourceClientInterface_->Write(data, size);
-  if (bytes_written != size)
-    LOG(ERROR) << ", Not all data is written to source HAL. bytes written: "
-               << static_cast<int>(bytes_written)
-               << ", total: " << static_cast<int>(size);
-
-  return bytes_written;
-}
-
-void LeAudioUnicastClientAudioSink::ConfirmStreamingRequest() {
-  LOG(INFO) << __func__;
-  if ((sourceClientInterface_ == nullptr) ||
-      (le_audio_source_hal_state != HAL_STARTED)) {
-    LOG(ERROR) << "LE audio device HAL was not started!";
-    return;
-  }
-
-  sourceClientInterface_->ConfirmStreamingRequest();
-}
-
-void LeAudioUnicastClientAudioSink::CancelStreamingRequest() {
-  LOG(INFO) << __func__;
-  if ((sourceClientInterface_ == nullptr) ||
-      (le_audio_source_hal_state != HAL_STARTED)) {
-    LOG(ERROR) << "LE audio device HAL was not started!";
-    return;
-  }
-
-  sourceClientInterface_->CancelStreamingRequest();
-}
-
-void LeAudioUnicastClientAudioSink::UpdateRemoteDelay(
-    uint16_t remote_delay_ms) {
-  if ((sourceClientInterface_ == nullptr) ||
-      (le_audio_source_hal_state != HAL_STARTED)) {
-    LOG(ERROR) << "LE audio device HAL was not started!";
-    return;
-  }
-
-  sourceClientInterface_->SetRemoteDelay(remote_delay_ms);
-}
-
-void LeAudioUnicastClientAudioSink::DebugDump(int fd) {
-  /* TODO: Add some statistic for source client interface */
-}
-
-void LeAudioUnicastClientAudioSink::UpdateAudioConfigToHal(
-    const ::le_audio::offload_config& config) {
-  LOG(INFO) << __func__;
-  if ((sourceClientInterface_ == nullptr) ||
-      (le_audio_source_hal_state != HAL_STARTED)) {
-    LOG(ERROR) << "LE audio device HAL was not started!";
-    return;
-  }
-
-  sourceClientInterface_->UpdateAudioConfigToHal(config);
-}
-
-void LeAudioUnicastClientAudioSink::SuspendedForReconfiguration() {
-  LOG(INFO) << __func__;
-  if ((sourceClientInterface_ == nullptr) ||
-      (le_audio_source_hal_state != HAL_STARTED)) {
-    LOG(ERROR) << "LE audio device HAL was not started!";
-    return;
-  }
-
-  sourceClientInterface_->SuspendedForReconfiguration();
-}
diff --git a/system/bta/le_audio/client_audio.h b/system/bta/le_audio/client_audio.h
deleted file mode 100644
index 8ba9116..0000000
--- a/system/bta/le_audio/client_audio.h
+++ /dev/null
@@ -1,194 +0,0 @@
-/*
- * Copyright 2020 HIMSA II K/S - www.himsa.com.
- * Represented by EHIMA - www.ehima.com
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-#pragma once
-
-#include <future>
-
-#include "audio_hal_interface/le_audio_software.h"
-#include "common/repeating_timer.h"
-
-/* Implementations of Le Audio will also implement this interface */
-class LeAudioClientAudioSinkReceiver {
- public:
-  virtual ~LeAudioClientAudioSinkReceiver() = default;
-  virtual void OnAudioDataReady(const std::vector<uint8_t>& data) = 0;
-  virtual void OnAudioSuspend(std::promise<void> do_suspend_promise) = 0;
-  virtual void OnAudioResume(void) = 0;
-  virtual void OnAudioMetadataUpdate(
-      std::promise<void> do_update_metadata_promise,
-      const source_metadata_t& source_metadata) = 0;
-};
-class LeAudioClientAudioSourceReceiver {
- public:
-  virtual ~LeAudioClientAudioSourceReceiver() = default;
-  virtual void OnAudioSuspend(std::promise<void> do_suspend_promise) = 0;
-  virtual void OnAudioResume(void) = 0;
-  virtual void OnAudioMetadataUpdate(
-      std::promise<void> do_update_metadata_promise,
-      const sink_metadata_t& sink_metadata) = 0;
-};
-
-/* Represents configuration of audio codec, as exchanged between le audio and
- * phone.
- * It can also be passed to the audio source to configure its parameters.
- */
-struct LeAudioCodecConfiguration {
-  static constexpr uint8_t kChannelNumberMono =
-      bluetooth::audio::le_audio::kChannelNumberMono;
-  static constexpr uint8_t kChannelNumberStereo =
-      bluetooth::audio::le_audio::kChannelNumberStereo;
-
-  static constexpr uint32_t kSampleRate48000 =
-      bluetooth::audio::le_audio::kSampleRate48000;
-  static constexpr uint32_t kSampleRate44100 =
-      bluetooth::audio::le_audio::kSampleRate44100;
-  static constexpr uint32_t kSampleRate32000 =
-      bluetooth::audio::le_audio::kSampleRate32000;
-  static constexpr uint32_t kSampleRate24000 =
-      bluetooth::audio::le_audio::kSampleRate24000;
-  static constexpr uint32_t kSampleRate16000 =
-      bluetooth::audio::le_audio::kSampleRate16000;
-  static constexpr uint32_t kSampleRate8000 =
-      bluetooth::audio::le_audio::kSampleRate8000;
-
-  static constexpr uint8_t kBitsPerSample16 =
-      bluetooth::audio::le_audio::kBitsPerSample16;
-  static constexpr uint8_t kBitsPerSample24 =
-      bluetooth::audio::le_audio::kBitsPerSample24;
-  static constexpr uint8_t kBitsPerSample32 =
-      bluetooth::audio::le_audio::kBitsPerSample32;
-
-  static constexpr uint32_t kInterval7500Us = 7500;
-  static constexpr uint32_t kInterval10000Us = 10000;
-
-  /** number of channels */
-  uint8_t num_channels;
-
-  /** sampling rate that the codec expects to receive from audio framework */
-  uint32_t sample_rate;
-
-  /** bits per sample that codec expects to receive from audio framework */
-  uint8_t bits_per_sample;
-
-  /** Data interval determines how often we send samples to the remote. This
-   * should match how often we grab data from audio source, optionally we can
-   * grab data every 2 or 3 intervals, but this would increase latency.
-   *
-   * Value is provided in us.
-   */
-  uint32_t data_interval_us;
-
-  bool operator!=(const LeAudioCodecConfiguration& other) {
-    return !((num_channels == other.num_channels) &&
-             (sample_rate == other.sample_rate) &&
-             (bits_per_sample == other.bits_per_sample) &&
-             (data_interval_us == other.data_interval_us));
-  }
-
-  bool operator==(const LeAudioCodecConfiguration& other) const {
-    return ((num_channels == other.num_channels) &&
-            (sample_rate == other.sample_rate) &&
-            (bits_per_sample == other.bits_per_sample) &&
-            (data_interval_us == other.data_interval_us));
-  }
-
-  bool IsInvalid() {
-    return (num_channels == 0) || (sample_rate == 0) ||
-           (bits_per_sample == 0) || (data_interval_us == 0);
-  }
-};
-
-/* Represents source of audio for le audio client */
-class LeAudioClientAudioSource {
- public:
-  virtual ~LeAudioClientAudioSource() = default;
-
-  virtual bool Start(const LeAudioCodecConfiguration& codecConfiguration,
-                     LeAudioClientAudioSinkReceiver* audioReceiver);
-  virtual void Stop();
-  virtual void Release(const void* instance);
-  virtual void ConfirmStreamingRequest();
-  virtual void CancelStreamingRequest();
-  virtual void UpdateRemoteDelay(uint16_t remote_delay_ms);
-  virtual void UpdateAudioConfigToHal(const ::le_audio::offload_config& config);
-  virtual void SuspendedForReconfiguration();
-
-  static void DebugDump(int fd);
-
- protected:
-  const void* Acquire(bool is_broadcasting_session_type);
-  bool InitAudioSinkThread(const std::string name);
-
-  bluetooth::common::MessageLoopThread* worker_thread_;
-
- private:
-  bool SinkOnResumeReq(bool start_media_task);
-  bool SinkOnSuspendReq();
-  bool SinkOnMetadataUpdateReq(const source_metadata_t& source_metadata);
-
-  void StartAudioTicks();
-  void StopAudioTicks();
-  void SendAudioData();
-
-  bluetooth::common::RepeatingTimer audio_timer_;
-  LeAudioCodecConfiguration source_codec_config_;
-  LeAudioClientAudioSinkReceiver* audioSinkReceiver_;
-  bluetooth::audio::le_audio::LeAudioClientInterface::Sink*
-      sinkClientInterface_;
-
-  /* Guard audio sink receiver mutual access from stack with internal mutex */
-  std::mutex sinkInterfaceMutex_;
-};
-
-/* Represents audio sink for le audio client */
-class LeAudioUnicastClientAudioSink {
- public:
-  virtual ~LeAudioUnicastClientAudioSink() = default;
-
-  virtual bool Start(const LeAudioCodecConfiguration& codecConfiguration,
-                     LeAudioClientAudioSourceReceiver* audioReceiver);
-  virtual void Stop();
-  virtual const void* Acquire();
-  virtual void Release(const void* instance);
-  virtual size_t SendData(uint8_t* data, uint16_t size);
-  virtual void ConfirmStreamingRequest();
-  virtual void CancelStreamingRequest();
-  virtual void UpdateRemoteDelay(uint16_t remote_delay_ms);
-  virtual void UpdateAudioConfigToHal(const ::le_audio::offload_config& config);
-  virtual void SuspendedForReconfiguration();
-
-  static void DebugDump(int fd);
-
- private:
-  bool SourceOnResumeReq(bool start_media_task);
-  bool SourceOnSuspendReq();
-  bool SourceOnMetadataUpdateReq(const sink_metadata_t& sink_metadata);
-
-  LeAudioClientAudioSourceReceiver* audioSourceReceiver_;
-  bluetooth::audio::le_audio::LeAudioClientInterface::Source*
-      sourceClientInterface_;
-};
-
-class LeAudioUnicastClientAudioSource : public LeAudioClientAudioSource {
- public:
-  virtual const void* Acquire();
-};
-
-class LeAudioBroadcastClientAudioSource : public LeAudioClientAudioSource {
- public:
-  virtual const void* Acquire();
-};
diff --git a/system/bta/le_audio/client_audio_test.cc b/system/bta/le_audio/client_audio_test.cc
deleted file mode 100644
index f95cbc2..0000000
--- a/system/bta/le_audio/client_audio_test.cc
+++ /dev/null
@@ -1,544 +0,0 @@
-/*
- * Copyright 2021 HIMSA II K/S - www.himsa.com.
- * Represented by EHIMA - www.ehima.com
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#include "client_audio.h"
-
-#include <gmock/gmock.h>
-#include <gtest/gtest.h>
-
-#include <chrono>
-#include <future>
-
-#include "audio_hal_interface/le_audio_software.h"
-#include "base/bind_helpers.h"
-#include "common/message_loop_thread.h"
-#include "hardware/bluetooth.h"
-#include "osi/include/wakelock.h"
-
-using ::testing::_;
-using ::testing::Assign;
-using ::testing::AtLeast;
-using ::testing::DoAll;
-using ::testing::Invoke;
-using ::testing::Mock;
-using ::testing::Return;
-using ::testing::ReturnPointee;
-using ::testing::SaveArg;
-using std::chrono_literals::operator""ms;
-
-bluetooth::common::MessageLoopThread message_loop_thread("test message loop");
-bluetooth::common::MessageLoopThread* get_main_thread() {
-  return &message_loop_thread;
-}
-bt_status_t do_in_main_thread(const base::Location& from_here,
-                              base::OnceClosure task) {
-  if (!message_loop_thread.DoInThread(from_here, std::move(task))) {
-    LOG(ERROR) << __func__ << ": failed from " << from_here.ToString();
-    return BT_STATUS_FAIL;
-  }
-  return BT_STATUS_SUCCESS;
-}
-
-static base::MessageLoop* message_loop_;
-base::MessageLoop* get_main_message_loop() { return message_loop_; }
-
-static void init_message_loop_thread() {
-  message_loop_thread.StartUp();
-  if (!message_loop_thread.IsRunning()) {
-    FAIL() << "unable to create message loop thread.";
-  }
-
-  if (!message_loop_thread.EnableRealTimeScheduling())
-    LOG(ERROR) << "Unable to set real time scheduling";
-
-  message_loop_ = message_loop_thread.message_loop();
-  if (message_loop_ == nullptr) FAIL() << "unable to get message loop.";
-}
-
-static void cleanup_message_loop_thread() {
-  message_loop_ = nullptr;
-  message_loop_thread.ShutDown();
-}
-
-using bluetooth::audio::le_audio::LeAudioClientInterface;
-
-class MockLeAudioClientInterfaceSink : public LeAudioClientInterface::Sink {
- public:
-  MockLeAudioClientInterfaceSink() = delete;
-  MockLeAudioClientInterfaceSink(bool is_broadcaster = false)
-      : LeAudioClientInterface::Sink(is_broadcaster){};
-  ~MockLeAudioClientInterfaceSink() = default;
-
-  MOCK_METHOD((void), Cleanup, (), (override));
-  MOCK_METHOD((void), SetPcmParameters,
-              (const LeAudioClientInterface::PcmParameters& params),
-              (override));
-  MOCK_METHOD((void), SetRemoteDelay, (uint16_t delay_report_ms), (override));
-  MOCK_METHOD((void), StartSession, (), (override));
-  MOCK_METHOD((void), StopSession, (), (override));
-  MOCK_METHOD((void), ConfirmStreamingRequest, (), (override));
-  MOCK_METHOD((void), CancelStreamingRequest, (), (override));
-  MOCK_METHOD((void), UpdateAudioConfigToHal,
-              (const ::le_audio::offload_config&));
-  MOCK_METHOD((size_t), Read, (uint8_t * p_buf, uint32_t len));
-};
-
-class MockLeAudioClientInterfaceSource : public LeAudioClientInterface::Source {
- public:
-  MOCK_METHOD((void), Cleanup, (), (override));
-  MOCK_METHOD((void), SetPcmParameters,
-              (const LeAudioClientInterface::PcmParameters& params),
-              (override));
-  MOCK_METHOD((void), SetRemoteDelay, (uint16_t delay_report_ms), (override));
-  MOCK_METHOD((void), StartSession, (), (override));
-  MOCK_METHOD((void), StopSession, (), (override));
-  MOCK_METHOD((void), ConfirmStreamingRequest, (), (override));
-  MOCK_METHOD((void), CancelStreamingRequest, (), (override));
-  MOCK_METHOD((void), UpdateAudioConfigToHal,
-              (const ::le_audio::offload_config&));
-  MOCK_METHOD((size_t), Write, (const uint8_t* p_buf, uint32_t len));
-};
-
-class MockLeAudioClientInterface : public LeAudioClientInterface {
- public:
-  MockLeAudioClientInterface() = default;
-  ~MockLeAudioClientInterface() = default;
-
-  MOCK_METHOD((Sink*), GetSink,
-              (bluetooth::audio::le_audio::StreamCallbacks stream_cb,
-               bluetooth::common::MessageLoopThread* message_loop,
-               bool is_broadcasting_session_type));
-  MOCK_METHOD((Source*), GetSource,
-              (bluetooth::audio::le_audio::StreamCallbacks stream_cb,
-               bluetooth::common::MessageLoopThread* message_loop));
-};
-
-LeAudioClientInterface* mockInterface;
-
-namespace bluetooth {
-namespace audio {
-namespace le_audio {
-MockLeAudioClientInterface* interface_mock;
-MockLeAudioClientInterfaceSink* sink_mock;
-MockLeAudioClientInterfaceSource* source_mock;
-
-LeAudioClientInterface* LeAudioClientInterface::Get() { return interface_mock; }
-
-LeAudioClientInterface::Sink* LeAudioClientInterface::GetSink(
-    StreamCallbacks stream_cb,
-    bluetooth::common::MessageLoopThread* message_loop,
-    bool is_broadcasting_session_type) {
-  return interface_mock->GetSink(stream_cb, message_loop,
-                                 is_broadcasting_session_type);
-}
-
-LeAudioClientInterface::Source* LeAudioClientInterface::GetSource(
-    StreamCallbacks stream_cb,
-    bluetooth::common::MessageLoopThread* message_loop) {
-  return interface_mock->GetSource(stream_cb, message_loop);
-}
-
-bool LeAudioClientInterface::ReleaseSink(LeAudioClientInterface::Sink* sink) {
-  return true;
-}
-bool LeAudioClientInterface::ReleaseSource(
-    LeAudioClientInterface::Source* source) {
-  return true;
-}
-
-void LeAudioClientInterface::Sink::Cleanup() {}
-void LeAudioClientInterface::Sink::SetPcmParameters(
-    const PcmParameters& params) {}
-void LeAudioClientInterface::Sink::SetRemoteDelay(uint16_t delay_report_ms) {}
-void LeAudioClientInterface::Sink::StartSession() {}
-void LeAudioClientInterface::Sink::StopSession() {}
-void LeAudioClientInterface::Sink::ConfirmStreamingRequest(){};
-void LeAudioClientInterface::Sink::CancelStreamingRequest(){};
-void LeAudioClientInterface::Sink::UpdateAudioConfigToHal(
-    const ::le_audio::offload_config& config){};
-void LeAudioClientInterface::Sink::SuspendedForReconfiguration() {}
-
-void LeAudioClientInterface::Source::Cleanup() {}
-void LeAudioClientInterface::Source::SetPcmParameters(
-    const PcmParameters& params) {}
-void LeAudioClientInterface::Source::SetRemoteDelay(uint16_t delay_report_ms) {}
-void LeAudioClientInterface::Source::StartSession() {}
-void LeAudioClientInterface::Source::StopSession() {}
-void LeAudioClientInterface::Source::ConfirmStreamingRequest(){};
-void LeAudioClientInterface::Source::CancelStreamingRequest(){};
-void LeAudioClientInterface::Source::UpdateAudioConfigToHal(
-    const ::le_audio::offload_config& config){};
-void LeAudioClientInterface::Source::SuspendedForReconfiguration() {}
-
-size_t LeAudioClientInterface::Source::Write(const uint8_t* p_buf,
-                                             uint32_t len) {
-  return source_mock->Write(p_buf, len);
-}
-
-size_t LeAudioClientInterface::Sink::Read(uint8_t* p_buf, uint32_t len) {
-  return sink_mock->Read(p_buf, len);
-}
-}  // namespace le_audio
-}  // namespace audio
-}  // namespace bluetooth
-
-class MockLeAudioClientAudioSinkEventReceiver
-    : public LeAudioClientAudioSinkReceiver {
- public:
-  MOCK_METHOD((void), OnAudioDataReady, (const std::vector<uint8_t>& data),
-              (override));
-  MOCK_METHOD((void), OnAudioSuspend, (std::promise<void> do_suspend_promise),
-              (override));
-  MOCK_METHOD((void), OnAudioResume, (), (override));
-  MOCK_METHOD((void), OnAudioMetadataUpdate,
-              (std::promise<void> do_update_metadata_promise,
-               const source_metadata_t& source_metadata),
-              (override));
-};
-
-class MockLeAudioClientAudioSourceEventReceiver
-    : public LeAudioClientAudioSourceReceiver {
- public:
-  MOCK_METHOD((void), OnAudioSuspend, (std::promise<void> do_suspend_promise),
-              (override));
-  MOCK_METHOD((void), OnAudioResume, (), (override));
-  MOCK_METHOD((void), OnAudioMetadataUpdate,
-              (std::promise<void> do_update_metadata_promise,
-               const sink_metadata_t& sink_metadata),
-              (override));
-};
-
-class LeAudioClientAudioTest : public ::testing::Test {
- public:
-  LeAudioClientAudioTest() : mock_client_interface_sink_(false) {}
-  void SetUp(void) override {
-    init_message_loop_thread();
-    bluetooth::audio::le_audio::interface_mock = &mock_client_interface_;
-    bluetooth::audio::le_audio::sink_mock = &mock_client_interface_sink_;
-    bluetooth::audio::le_audio::source_mock = &mock_client_interface_source_;
-
-    // Init sink Audio HAL mock
-    is_sink_acquired = false;
-    hal_sink_stream_cb = {.on_suspend_ = nullptr, .on_resume_ = nullptr};
-
-    ON_CALL(mock_client_interface_, GetSink(_, _, _))
-        .WillByDefault(DoAll(SaveArg<0>(&hal_sink_stream_cb),
-                             Assign(&is_sink_acquired, true),
-                             Return(bluetooth::audio::le_audio::sink_mock)));
-    ON_CALL(mock_client_interface_sink_, Cleanup())
-        .WillByDefault(Assign(&is_sink_acquired, false));
-
-    // Init source Audio HAL mock
-    is_source_acquired = false;
-    hal_source_stream_cb = {.on_suspend_ = nullptr, .on_resume_ = nullptr};
-
-    ON_CALL(mock_client_interface_, GetSource(_, _))
-        .WillByDefault(DoAll(SaveArg<0>(&hal_source_stream_cb),
-                             Assign(&is_source_acquired, true),
-                             Return(bluetooth::audio::le_audio::source_mock)));
-    ON_CALL(mock_client_interface_source_, Cleanup())
-        .WillByDefault(Assign(&is_source_acquired, false));
-  }
-
-  void AcquireAudioSink(void) {
-    audio_sink_instance_ = leAudioClientAudioSink.Acquire();
-  }
-
-  void ReleaseAudioSink(void) {
-    leAudioClientAudioSink.Release(audio_sink_instance_);
-    audio_sink_instance_ = nullptr;
-  }
-
-  void AcquireAudioSource(void) {
-    audio_source_instance_ = leAudioUnicastClientAudioSource.Acquire();
-  }
-
-  void ReleaseAudioSource(void) {
-    leAudioUnicastClientAudioSource.Release(audio_source_instance_);
-    audio_source_instance_ = nullptr;
-  }
-
-  void TearDown(void) override {
-    /* We have to call Cleanup to tidy up some static variables.
-     * If on the HAL end Source is running it means we are running the Sink
-     * on our end, and vice versa.
-     */
-    if (is_source_acquired == true) ReleaseAudioSink();
-    if (is_sink_acquired == true) ReleaseAudioSource();
-
-    cleanup_message_loop_thread();
-
-    bluetooth::audio::le_audio::sink_mock = nullptr;
-    bluetooth::audio::le_audio::source_mock = nullptr;
-  }
-
-  LeAudioUnicastClientAudioSource leAudioUnicastClientAudioSource;
-  LeAudioUnicastClientAudioSink leAudioClientAudioSink;
-
-  MockLeAudioClientInterface mock_client_interface_;
-  MockLeAudioClientInterfaceSink mock_client_interface_sink_;
-  MockLeAudioClientInterfaceSource mock_client_interface_source_;
-
-  MockLeAudioClientAudioSinkEventReceiver mock_hal_sink_event_receiver_;
-  MockLeAudioClientAudioSourceEventReceiver mock_hal_source_event_receiver_;
-
-  bool is_source_acquired = false;
-  bool is_sink_acquired = false;
-  const void* audio_sink_instance_ = nullptr;
-  const void* audio_source_instance_ = nullptr;
-
-  bluetooth::audio::le_audio::StreamCallbacks hal_source_stream_cb;
-  bluetooth::audio::le_audio::StreamCallbacks hal_sink_stream_cb;
-
-  const LeAudioCodecConfiguration default_codec_conf{
-      .num_channels = LeAudioCodecConfiguration::kChannelNumberMono,
-      .sample_rate = LeAudioCodecConfiguration::kSampleRate44100,
-      .bits_per_sample = LeAudioCodecConfiguration::kBitsPerSample24,
-      .data_interval_us = LeAudioCodecConfiguration::kInterval10000Us,
-  };
-};
-
-TEST_F(LeAudioClientAudioTest, testLeAudioClientAudioSinkInitializeCleanup) {
-  EXPECT_CALL(mock_client_interface_, GetSource(_, _))
-      .WillOnce(DoAll(Assign(&is_source_acquired, true),
-                      Return(bluetooth::audio::le_audio::source_mock)));
-  AcquireAudioSink();
-
-  EXPECT_CALL(mock_client_interface_source_, Cleanup())
-      .WillOnce(Assign(&is_source_acquired, false));
-  ReleaseAudioSink();
-}
-
-TEST_F(LeAudioClientAudioTest, testLeAudioClientAudioSourceInitializeCleanup) {
-  EXPECT_CALL(mock_client_interface_, GetSink(_, _, _))
-      .WillOnce(DoAll(Assign(&is_sink_acquired, true),
-                      Return(bluetooth::audio::le_audio::sink_mock)));
-  AcquireAudioSource();
-
-  EXPECT_CALL(mock_client_interface_sink_, Cleanup())
-      .WillOnce(Assign(&is_sink_acquired, false));
-  ReleaseAudioSource();
-}
-
-TEST_F(LeAudioClientAudioTest, testLeAudioClientAudioSinkStartStop) {
-  LeAudioClientInterface::PcmParameters params;
-  EXPECT_CALL(mock_client_interface_source_, SetPcmParameters(_))
-      .Times(1)
-      .WillOnce(SaveArg<0>(&params));
-  EXPECT_CALL(mock_client_interface_source_, StartSession()).Times(1);
-
-  AcquireAudioSink();
-  ASSERT_TRUE(leAudioClientAudioSink.Start(default_codec_conf,
-                                           &mock_hal_source_event_receiver_));
-
-  ASSERT_EQ(params.channels_count,
-            bluetooth::audio::le_audio::kChannelNumberMono);
-  ASSERT_EQ(params.sample_rate, bluetooth::audio::le_audio::kSampleRate44100);
-  ASSERT_EQ(params.bits_per_sample,
-            bluetooth::audio::le_audio::kBitsPerSample24);
-  ASSERT_EQ(params.data_interval_us, 10000u);
-
-  EXPECT_CALL(mock_client_interface_source_, StopSession()).Times(1);
-
-  leAudioClientAudioSink.Stop();
-}
-
-TEST_F(LeAudioClientAudioTest, testLeAudioClientAudioSourceStartStop) {
-  LeAudioClientInterface::PcmParameters params;
-  EXPECT_CALL(mock_client_interface_sink_, SetPcmParameters(_))
-      .Times(1)
-      .WillOnce(SaveArg<0>(&params));
-  EXPECT_CALL(mock_client_interface_sink_, StartSession()).Times(1);
-
-  AcquireAudioSource();
-  ASSERT_TRUE(leAudioUnicastClientAudioSource.Start(
-      default_codec_conf, &mock_hal_sink_event_receiver_));
-
-  ASSERT_EQ(params.channels_count,
-            bluetooth::audio::le_audio::kChannelNumberMono);
-  ASSERT_EQ(params.sample_rate, bluetooth::audio::le_audio::kSampleRate44100);
-  ASSERT_EQ(params.bits_per_sample,
-            bluetooth::audio::le_audio::kBitsPerSample24);
-  ASSERT_EQ(params.data_interval_us, 10000u);
-
-  EXPECT_CALL(mock_client_interface_sink_, StopSession()).Times(1);
-
-  leAudioUnicastClientAudioSource.Stop();
-}
-
-TEST_F(LeAudioClientAudioTest, testLeAudioClientAudioSinkSendData) {
-  AcquireAudioSink();
-  ASSERT_TRUE(leAudioClientAudioSink.Start(default_codec_conf,
-                                           &mock_hal_source_event_receiver_));
-
-  const uint8_t* exp_p = nullptr;
-  uint32_t exp_len = 0;
-  uint8_t input_buf[] = {
-      0x02,
-      0x03,
-      0x05,
-      0x19,
-  };
-  ON_CALL(mock_client_interface_source_, Write(_, _))
-      .WillByDefault(DoAll(SaveArg<0>(&exp_p), SaveArg<1>(&exp_len),
-                           ReturnPointee(&exp_len)));
-
-  ASSERT_EQ(leAudioClientAudioSink.SendData(input_buf, sizeof(input_buf)),
-            sizeof(input_buf));
-  ASSERT_EQ(exp_len, sizeof(input_buf));
-  ASSERT_EQ(exp_p, input_buf);
-
-  leAudioUnicastClientAudioSource.Stop();
-}
-
-TEST_F(LeAudioClientAudioTest, testLeAudioClientAudioSinkSuspend) {
-  AcquireAudioSink();
-  ASSERT_TRUE(leAudioClientAudioSink.Start(default_codec_conf,
-                                           &mock_hal_source_event_receiver_));
-
-  ASSERT_NE(hal_source_stream_cb.on_suspend_, nullptr);
-
-  /* Expect LeAudio registered event listener to get called when HAL calls the
-   * client_audio's internal suspend callback.
-   */
-  EXPECT_CALL(mock_hal_source_event_receiver_, OnAudioSuspend(_)).Times(1);
-  ASSERT_TRUE(hal_source_stream_cb.on_suspend_());
-}
-
-TEST_F(LeAudioClientAudioTest, testLeAudioClientAudioSourceSuspend) {
-  AcquireAudioSource();
-  ASSERT_TRUE(leAudioUnicastClientAudioSource.Start(
-      default_codec_conf, &mock_hal_sink_event_receiver_));
-
-  ASSERT_NE(hal_sink_stream_cb.on_suspend_, nullptr);
-
-  /* Expect LeAudio registered event listener to get called when HAL calls the
-   * client_audio's internal suspend callback.
-   */
-  EXPECT_CALL(mock_hal_sink_event_receiver_, OnAudioSuspend(_)).Times(1);
-  ASSERT_TRUE(hal_sink_stream_cb.on_suspend_());
-}
-
-TEST_F(LeAudioClientAudioTest, testLeAudioClientAudioSinkResume) {
-  AcquireAudioSink();
-  ASSERT_TRUE(leAudioClientAudioSink.Start(default_codec_conf,
-                                           &mock_hal_source_event_receiver_));
-
-  ASSERT_NE(hal_source_stream_cb.on_resume_, nullptr);
-
-  /* Expect LeAudio registered event listener to get called when HAL calls the
-   * client_audio's internal resume callback.
-   */
-  EXPECT_CALL(mock_hal_source_event_receiver_, OnAudioResume()).Times(1);
-  bool start_media_task = false;
-  ASSERT_TRUE(hal_source_stream_cb.on_resume_(start_media_task));
-}
-
-TEST_F(LeAudioClientAudioTest,
-       testLeAudioClientAudioSourceResumeStartSourceTask) {
-  const LeAudioCodecConfiguration codec_conf{
-      .num_channels = LeAudioCodecConfiguration::kChannelNumberStereo,
-      .sample_rate = LeAudioCodecConfiguration::kSampleRate16000,
-      .bits_per_sample = LeAudioCodecConfiguration::kBitsPerSample24,
-      .data_interval_us = LeAudioCodecConfiguration::kInterval10000Us,
-  };
-  AcquireAudioSource();
-  ASSERT_TRUE(leAudioUnicastClientAudioSource.Start(
-      codec_conf, &mock_hal_sink_event_receiver_));
-
-  std::chrono::time_point<std::chrono::system_clock> resumed_ts;
-  std::chrono::time_point<std::chrono::system_clock> executed_ts;
-  std::promise<void> promise;
-  auto future = promise.get_future();
-
-  uint32_t calculated_bytes_per_tick = 0;
-  EXPECT_CALL(mock_client_interface_sink_, Read(_, _))
-      .Times(AtLeast(1))
-      .WillOnce(Invoke([&](uint8_t* p_buf, uint32_t len) -> uint32_t {
-        executed_ts = std::chrono::system_clock::now();
-        calculated_bytes_per_tick = len;
-
-        // fake some data from audio framework
-        for (uint32_t i = 0u; i < len; ++i) {
-          p_buf[i] = i;
-        }
-
-        // Return exactly as much data as requested
-        promise.set_value();
-        return len;
-      }));
-
-  std::promise<void> data_promise;
-  auto data_future = data_promise.get_future();
-
-  /* Expect this callback to be called to Client by the HAL glue layer */
-  std::vector<uint8_t> media_data_to_send;
-  EXPECT_CALL(mock_hal_sink_event_receiver_, OnAudioDataReady(_))
-      .WillOnce(Invoke([&](const std::vector<uint8_t>& data) -> void {
-        media_data_to_send = std::move(data);
-        data_promise.set_value();
-      }));
-
-  /* Expect LeAudio registered event listener to get called when HAL calls the
-   * client_audio's internal resume callback.
-   */
-  ASSERT_NE(hal_sink_stream_cb.on_resume_, nullptr);
-  EXPECT_CALL(mock_hal_sink_event_receiver_, OnAudioResume()).Times(1);
-  resumed_ts = std::chrono::system_clock::now();
-  bool start_media_task = true;
-  ASSERT_TRUE(hal_sink_stream_cb.on_resume_(start_media_task));
-  leAudioUnicastClientAudioSource.ConfirmStreamingRequest();
-
-  ASSERT_EQ(future.wait_for(std::chrono::seconds(1)),
-            std::future_status::ready);
-
-  ASSERT_EQ(data_future.wait_for(std::chrono::seconds(1)),
-            std::future_status::ready);
-
-  // Check agains expected payload size
-  // 24 bit audio stream is sent as unpacked, each sample takes 4 bytes.
-  const uint32_t channel_bytes_per_sample = 4;
-  const uint32_t channel_bytes_per_10ms_at_16000Hz =
-      ((10ms).count() * channel_bytes_per_sample * 16000 /*Hz*/) /
-      (1000ms).count();
-
-  // Expect 2 channel (stereo) data
-  ASSERT_EQ(calculated_bytes_per_tick, 2 * channel_bytes_per_10ms_at_16000Hz);
-
-  // Verify callback call interval for the requested 10ms (+2ms error margin)
-  auto delta = std::chrono::duration_cast<std::chrono::milliseconds>(
-      executed_ts - resumed_ts);
-  EXPECT_TRUE((delta >= 10ms) && (delta <= 12ms));
-
-  // Verify if we got just right amount of data in the callback call
-  ASSERT_EQ(media_data_to_send.size(), calculated_bytes_per_tick);
-}
-
-TEST_F(LeAudioClientAudioTest, testLeAudioClientAudioSourceResume) {
-  AcquireAudioSource();
-  ASSERT_TRUE(leAudioUnicastClientAudioSource.Start(
-      default_codec_conf, &mock_hal_sink_event_receiver_));
-
-  ASSERT_NE(hal_sink_stream_cb.on_resume_, nullptr);
-
-  /* Expect LeAudio registered event listener to get called when HAL calls the
-   * client_audio's internal resume callback.
-   */
-  EXPECT_CALL(mock_hal_sink_event_receiver_, OnAudioResume()).Times(1);
-  bool start_media_task = false;
-  ASSERT_TRUE(hal_sink_stream_cb.on_resume_(start_media_task));
-}
diff --git a/system/bta/le_audio/client_linux.cc b/system/bta/le_audio/client_linux.cc
index bde6996..13f4563 100644
--- a/system/bta/le_audio/client_linux.cc
+++ b/system/bta/le_audio/client_linux.cc
@@ -39,6 +39,7 @@
       bluetooth::le_audio::btle_audio_codec_config_t output_codec_config)
       override {}
   void SetCcidInformation(int ccid, int context_type) override {}
+  void SetInCall(bool in_call) override {}
   std::vector<RawAddress> GetGroupDevices(const int group_id) override {
     return {};
   }
@@ -52,7 +53,31 @@
 void LeAudioClient::Cleanup(base::Callback<void()> cleanupCb) {}
 LeAudioClient* LeAudioClient::Get(void) { return nullptr; }
 void LeAudioClient::DebugDump(int fd) {}
-void LeAudioClient::AddFromStorage(const RawAddress& addr, bool autoconnect) {}
+void LeAudioClient::AddFromStorage(const RawAddress& addr, bool autoconnect,
+                                   int sink_audio_location,
+                                   int source_audio_location,
+                                   int sink_supported_context_types,
+                                   int source_supported_context_types,
+                                   const std::vector<uint8_t>& handles,
+                                   const std::vector<uint8_t>& sink_pacs,
+                                   const std::vector<uint8_t>& source_pacs,
+                                   const std::vector<uint8_t>& ases) {}
+bool LeAudioClient::GetHandlesForStorage(const RawAddress& addr,
+                                         std::vector<uint8_t>& out) {
+  return false;
+}
+bool LeAudioClient::GetSinkPacsForStorage(const RawAddress& addr,
+                                          std::vector<uint8_t>& out) {
+  return false;
+}
+bool LeAudioClient::GetSourcePacsForStorage(const RawAddress& addr,
+                                            std::vector<uint8_t>& out) {
+  return false;
+}
+bool LeAudioClient::GetAsesForStorage(const RawAddress& addr,
+                                      std::vector<uint8_t>& out) {
+  return false;
+}
 bool LeAudioClient::IsLeAudioClientRunning() { return false; }
 void LeAudioClient::InitializeAudioSetConfigurationProvider(void) {}
 void LeAudioClient::CleanupAudioSetConfigurationProvider(void) {}
diff --git a/system/bta/le_audio/client_parser.cc b/system/bta/le_audio/client_parser.cc
index ddd744f..8f7f5cc 100644
--- a/system/bta/le_audio/client_parser.cc
+++ b/system/bta/le_audio/client_parser.cc
@@ -543,10 +543,61 @@
 
 namespace pacs {
 
-bool ParsePac(std::vector<struct acs_ac_record>& pac_recs, uint16_t len,
-              const uint8_t* value) {
+int ParseSinglePac(std::vector<struct acs_ac_record>& pac_recs, uint16_t len,
+                   const uint8_t* value) {
+  struct acs_ac_record rec;
+  uint8_t codec_spec_cap_len, metadata_len;
+
+  if (len < kAcsPacRecordMinLen) {
+    LOG_ERROR("Wrong len of PAC record (%d!=%d)", len, kAcsPacRecordMinLen);
+    pac_recs.clear();
+    return -1;
+  }
+
+  STREAM_TO_UINT8(rec.codec_id.coding_format, value);
+  STREAM_TO_UINT16(rec.codec_id.vendor_company_id, value);
+  STREAM_TO_UINT16(rec.codec_id.vendor_codec_id, value);
+  STREAM_TO_UINT8(codec_spec_cap_len, value);
+  len -= kAcsPacRecordMinLen - kAcsPacMetadataLenLen;
+
+  if (len < codec_spec_cap_len + kAcsPacMetadataLenLen) {
+    LOG_ERROR("Wrong len of PAC record (codec specific capabilities) (%d!=%d)",
+              len, codec_spec_cap_len + kAcsPacMetadataLenLen);
+    pac_recs.clear();
+    return -1;
+  }
+
+  bool parsed;
+  rec.codec_spec_caps =
+      types::LeAudioLtvMap::Parse(value, codec_spec_cap_len, parsed);
+  if (!parsed) return -1;
+
+  value += codec_spec_cap_len;
+  len -= codec_spec_cap_len;
+
+  STREAM_TO_UINT8(metadata_len, value);
+  len -= kAcsPacMetadataLenLen;
+
+  if (len < metadata_len) {
+    LOG_ERROR("Wrong len of PAC record (metadata) (%d!=%d)", len, metadata_len);
+    pac_recs.clear();
+    return -1;
+  }
+
+  rec.metadata = std::vector<uint8_t>(value, value + metadata_len);
+  value += metadata_len;
+  len -= metadata_len;
+
+  pac_recs.push_back(std::move(rec));
+
+  return len;
+}
+
+bool ParsePacs(std::vector<struct acs_ac_record>& pac_recs, uint16_t len,
+               const uint8_t* value) {
   if (len < kAcsPacDiscoverRspMinLen) {
-    LOG(ERROR) << "Wrong len of PAC characteristic";
+    LOG_ERROR("Wrong len of PAC characteristic (%d!=%d)", len,
+              kAcsPacDiscoverRspMinLen);
     return false;
   }
 
@@ -556,49 +607,11 @@
 
   pac_recs.reserve(pac_rec_nb);
   for (int i = 0; i < pac_rec_nb; i++) {
-    struct acs_ac_record rec;
-    uint8_t codec_spec_cap_len, metadata_len;
+    int remaining_len = ParseSinglePac(pac_recs, len, value);
+    if (remaining_len < 0) return false;
 
-    if (len < kAcsPacRecordMinLen) {
-      LOG(ERROR) << "Wrong len of PAC record";
-      pac_recs.clear();
-      return false;
-    }
-
-    STREAM_TO_UINT8(rec.codec_id.coding_format, value);
-    STREAM_TO_UINT16(rec.codec_id.vendor_company_id, value);
-    STREAM_TO_UINT16(rec.codec_id.vendor_codec_id, value);
-    STREAM_TO_UINT8(codec_spec_cap_len, value);
-    len -= kAcsPacRecordMinLen - kAcsPacMetadataLenLen;
-
-    if (len < codec_spec_cap_len + kAcsPacMetadataLenLen) {
-      LOG(ERROR) << "Wrong len of PAC record (codec specific capabilities)";
-      pac_recs.clear();
-      return false;
-    }
-
-    bool parsed;
-    rec.codec_spec_caps =
-        types::LeAudioLtvMap::Parse(value, codec_spec_cap_len, parsed);
-    if (!parsed) return false;
-
-    value += codec_spec_cap_len;
-    len -= codec_spec_cap_len;
-
-    STREAM_TO_UINT8(metadata_len, value);
-    len -= kAcsPacMetadataLenLen;
-
-    if (len < metadata_len) {
-      LOG(ERROR) << "Wrong len of PAC record (metadata)";
-      pac_recs.clear();
-      return false;
-    }
-
-    rec.metadata = std::vector<uint8_t>(value, value + metadata_len);
-    value += metadata_len;
-    len -= metadata_len;
-
-    pac_recs.push_back(std::move(rec));
+    value += (len - remaining_len);
+    len = remaining_len;
   }
 
   return true;
@@ -625,8 +638,8 @@
     return false;
   }
 
-  STREAM_TO_UINT16(contexts.snk_supp_cont, value);
-  STREAM_TO_UINT16(contexts.src_supp_cont, value);
+  STREAM_TO_UINT16(contexts.snk_supp_cont.value_ref(), value);
+  STREAM_TO_UINT16(contexts.src_supp_cont.value_ref(), value);
 
   LOG(INFO) << "Supported Audio Contexts: "
             << "\n\tSupported Sink Contexts: "
@@ -644,8 +657,8 @@
     return false;
   }
 
-  STREAM_TO_UINT16(contexts.snk_avail_cont, value);
-  STREAM_TO_UINT16(contexts.src_avail_cont, value);
+  STREAM_TO_UINT16(contexts.snk_avail_cont.value_ref(), value);
+  STREAM_TO_UINT16(contexts.src_avail_cont.value_ref(), value);
 
   LOG(INFO) << "Available Audio Contexts: "
             << "\n\tAvailable Sink Contexts: "
diff --git a/system/bta/le_audio/client_parser.h b/system/bta/le_audio/client_parser.h
index 8974989..a88ac9c 100644
--- a/system/bta/le_audio/client_parser.h
+++ b/system/bta/le_audio/client_parser.h
@@ -221,18 +221,20 @@
 
 constexpr uint16_t kAseAudioAvailRspMinLen = 4;
 struct acs_available_audio_contexts {
-  std::bitset<16> snk_avail_cont;
-  std::bitset<16> src_avail_cont;
+  types::AudioContexts snk_avail_cont;
+  types::AudioContexts src_avail_cont;
 };
 
 constexpr uint16_t kAseAudioSuppContRspMinLen = 4;
 struct acs_supported_audio_contexts {
-  std::bitset<16> snk_supp_cont;
-  std::bitset<16> src_supp_cont;
+  types::AudioContexts snk_supp_cont;
+  types::AudioContexts src_supp_cont;
 };
 
-bool ParsePac(std::vector<struct types::acs_ac_record>& pac_recs, uint16_t len,
-              const uint8_t* value);
+int ParseSinglePac(std::vector<struct types::acs_ac_record>& pac_recs,
+                   uint16_t len, const uint8_t* value);
+bool ParsePacs(std::vector<struct types::acs_ac_record>& pac_recs, uint16_t len,
+               const uint8_t* value);
 bool ParseAudioLocations(types::AudioLocations& audio_locations, uint16_t len,
                          const uint8_t* value);
 bool ParseAvailableAudioContexts(struct acs_available_audio_contexts& rsp,
diff --git a/system/bta/le_audio/client_parser_test.cc b/system/bta/le_audio/client_parser_test.cc
index c54c237..839400b 100644
--- a/system/bta/le_audio/client_parser_test.cc
+++ b/system/bta/le_audio/client_parser_test.cc
@@ -26,12 +26,12 @@
 namespace client_parser {
 namespace pacs {
 
-TEST(LeAudioClientParserTest, testParsePacInvalidLength) {
+TEST(LeAudioClientParserTest, testParsePacsInvalidLength) {
   std::vector<struct types::acs_ac_record> pac_recs;
 
   const uint8_t invalid_num_records[] = {0x01};
   ASSERT_FALSE(
-      ParsePac(pac_recs, sizeof(invalid_num_records), invalid_num_records));
+      ParsePacs(pac_recs, sizeof(invalid_num_records), invalid_num_records));
 
   const uint8_t no_caps_len[] = {
       // Num records
@@ -43,7 +43,7 @@
       0x04,
       0x05,
   };
-  ASSERT_FALSE(ParsePac(pac_recs, sizeof(no_caps_len), no_caps_len));
+  ASSERT_FALSE(ParsePacs(pac_recs, sizeof(no_caps_len), no_caps_len));
 
   const uint8_t no_metalen[] = {
       // Num records
@@ -57,17 +57,17 @@
       // Codec Spec. Caps. Len
       0x00,
   };
-  ASSERT_FALSE(ParsePac(pac_recs, sizeof(no_metalen), no_metalen));
+  ASSERT_FALSE(ParsePacs(pac_recs, sizeof(no_metalen), no_metalen));
 }
 
-TEST(LeAudioClientParserTest, testParsePacEmpty) {
+TEST(LeAudioClientParserTest, testParsePacsEmpty) {
   std::vector<struct types::acs_ac_record> pac_recs;
   const uint8_t value[] = {0x00};
 
-  ASSERT_TRUE(ParsePac(pac_recs, sizeof(value), value));
+  ASSERT_TRUE(ParsePacs(pac_recs, sizeof(value), value));
 }
 
-TEST(LeAudioClientParserTest, testParsePacEmptyCapsEmptyMeta) {
+TEST(LeAudioClientParserTest, testParsePacsEmptyCapsEmptyMeta) {
   std::vector<struct types::acs_ac_record> pac_recs;
 
   const uint8_t value[] = {
@@ -84,7 +84,7 @@
       // Metadata Length
       0x00,
   };
-  ASSERT_TRUE(ParsePac(pac_recs, sizeof(value), value));
+  ASSERT_TRUE(ParsePacs(pac_recs, sizeof(value), value));
 
   ASSERT_EQ(pac_recs.size(), 1u);
   ASSERT_EQ(pac_recs[0].codec_id.coding_format, 0x01u);
@@ -92,7 +92,7 @@
   ASSERT_EQ(pac_recs[0].codec_id.vendor_codec_id, 0x0405u);
 }
 
-TEST(LeAudioClientParserTest, testParsePacInvalidCapsLen) {
+TEST(LeAudioClientParserTest, testParsePacsInvalidCapsLen) {
   std::vector<struct types::acs_ac_record> pac_recs;
 
   const uint8_t bad_capslem[] = {
@@ -117,7 +117,7 @@
       // Metadata Length
       0x00,
   };
-  ASSERT_FALSE(ParsePac(pac_recs, sizeof(bad_capslem), bad_capslem));
+  ASSERT_FALSE(ParsePacs(pac_recs, sizeof(bad_capslem), bad_capslem));
 
   std::vector<struct types::acs_ac_record> pac_recs2;
 
@@ -143,10 +143,10 @@
       // Metadata Length
       0x00,
   };
-  ASSERT_FALSE(ParsePac(pac_recs2, sizeof(bad_capslen2), bad_capslen2));
+  ASSERT_FALSE(ParsePacs(pac_recs2, sizeof(bad_capslen2), bad_capslen2));
 }
 
-TEST(LeAudioClientParserTest, testParsePacInvalidCapsLtvLen) {
+TEST(LeAudioClientParserTest, testParsePacsInvalidCapsLtvLen) {
   std::vector<struct types::acs_ac_record> pac_recs;
 
   const uint8_t bad_ltv_len[] = {
@@ -171,7 +171,7 @@
       // Metadata Length
       0x00,
   };
-  ASSERT_FALSE(ParsePac(pac_recs, sizeof(bad_ltv_len), bad_ltv_len));
+  ASSERT_FALSE(ParsePacs(pac_recs, sizeof(bad_ltv_len), bad_ltv_len));
 
   const uint8_t bad_ltv_len2[] = {
       // Num records
@@ -195,10 +195,10 @@
       // Metadata Length
       0x00,
   };
-  ASSERT_FALSE(ParsePac(pac_recs, sizeof(bad_ltv_len2), bad_ltv_len2));
+  ASSERT_FALSE(ParsePacs(pac_recs, sizeof(bad_ltv_len2), bad_ltv_len2));
 }
 
-TEST(LeAudioClientParserTest, testParsePacNullLtv) {
+TEST(LeAudioClientParserTest, testParsePacsNullLtv) {
   std::vector<struct types::acs_ac_record> pac_recs;
 
   const uint8_t value[] = {
@@ -226,7 +226,7 @@
       // Metadata Length
       0x00,
   };
-  ASSERT_TRUE(ParsePac(pac_recs, sizeof(value), value));
+  ASSERT_TRUE(ParsePacs(pac_recs, sizeof(value), value));
 
   ASSERT_EQ(pac_recs.size(), 1u);
   ASSERT_EQ(pac_recs[0].codec_id.coding_format, 0x01u);
@@ -246,7 +246,7 @@
   ASSERT_EQ(codec_spec_caps[0x04u].size(), 0u);
 }
 
-TEST(LeAudioClientParserTest, testParsePacEmptyMeta) {
+TEST(LeAudioClientParserTest, testParsePacsEmptyMeta) {
   std::vector<struct types::acs_ac_record> pac_recs;
 
   const uint8_t value[] = {
@@ -271,7 +271,7 @@
       // Metadata Length
       0x00,
   };
-  ASSERT_TRUE(ParsePac(pac_recs, sizeof(value), value));
+  ASSERT_TRUE(ParsePacs(pac_recs, sizeof(value), value));
 
   ASSERT_EQ(pac_recs.size(), 1u);
   ASSERT_EQ(pac_recs[0].codec_id.coding_format, 0x01u);
@@ -289,7 +289,7 @@
   ASSERT_EQ(codec_spec_caps[0x03u][1], 0x05u);
 }
 
-TEST(LeAudioClientParserTest, testParsePacInvalidMetaLength) {
+TEST(LeAudioClientParserTest, testParsePacsInvalidMetaLength) {
   std::vector<struct types::acs_ac_record> pac_recs;
 
   const uint8_t value[] = {
@@ -315,10 +315,10 @@
       0x01,  // [0].value[0]
       0x00,  // [0].value[1]
   };
-  ASSERT_FALSE(ParsePac(pac_recs, sizeof(value), value));
+  ASSERT_FALSE(ParsePacs(pac_recs, sizeof(value), value));
 }
 
-TEST(LeAudioClientParserTest, testParsePacValidMeta) {
+TEST(LeAudioClientParserTest, testParsePacsValidMeta) {
   std::vector<struct types::acs_ac_record> pac_recs;
 
   const uint8_t value[] = {
@@ -344,7 +344,7 @@
       0x01,  // [0].value[0]
       0x00,  // [0].value[1]
   };
-  ASSERT_TRUE(ParsePac(pac_recs, sizeof(value), value));
+  ASSERT_TRUE(ParsePacs(pac_recs, sizeof(value), value));
 
   ASSERT_EQ(pac_recs.size(), 1u);
   ASSERT_EQ(pac_recs[0].codec_id.coding_format, 0x01u);
@@ -368,7 +368,7 @@
   ASSERT_EQ(pac_recs[0].metadata[3], 0x00u);
 }
 
-TEST(LeAudioClientParserTest, testParsePacInvalidNumRecords) {
+TEST(LeAudioClientParserTest, testParsePacsInvalidNumRecords) {
   std::vector<struct types::acs_ac_record> pac_recs;
 
   const uint8_t value[] = {
@@ -394,10 +394,10 @@
       0x01,  // [0].value[0]
       0x00,  // [0].value[1]
   };
-  ASSERT_FALSE(ParsePac(pac_recs, sizeof(value), value));
+  ASSERT_FALSE(ParsePacs(pac_recs, sizeof(value), value));
 }
 
-TEST(LeAudioClientParserTest, testParsePacMultipleRecords) {
+TEST(LeAudioClientParserTest, testParsePacsMultipleRecords) {
   std::vector<struct types::acs_ac_record> pac_recs;
 
   const uint8_t value[] = {
@@ -444,7 +444,7 @@
       0x11,  // [0].value[0]
       0x10,  // [0].value[1]
   };
-  ASSERT_TRUE(ParsePac(pac_recs, sizeof(value), value));
+  ASSERT_TRUE(ParsePacs(pac_recs, sizeof(value), value));
   ASSERT_EQ(pac_recs.size(), 3u);
 
   // Verify 1st record
@@ -530,8 +530,8 @@
   };
 
   ParseAvailableAudioContexts(avail_contexts, sizeof(value1), value1);
-  ASSERT_EQ(avail_contexts.snk_avail_cont, 0u);
-  ASSERT_EQ(avail_contexts.src_avail_cont, 0u);
+  ASSERT_EQ(avail_contexts.snk_avail_cont.value(), 0u);
+  ASSERT_EQ(avail_contexts.src_avail_cont.value(), 0u);
 }
 
 TEST(LeAudioClientParserTest, testParseAvailableAudioContexts) {
@@ -546,8 +546,8 @@
   };
 
   ParseAvailableAudioContexts(avail_contexts, sizeof(value1), value1);
-  ASSERT_EQ(avail_contexts.snk_avail_cont, 0x0201u);
-  ASSERT_EQ(avail_contexts.src_avail_cont, 0x0403u);
+  ASSERT_EQ(avail_contexts.snk_avail_cont.value(), 0x0201u);
+  ASSERT_EQ(avail_contexts.src_avail_cont.value(), 0x0403u);
 }
 
 TEST(LeAudioClientParserTest, testParseSupportedAudioContextsInvalidLength) {
@@ -559,8 +559,8 @@
   };
 
   ParseSupportedAudioContexts(supp_contexts, sizeof(value1), value1);
-  ASSERT_EQ(supp_contexts.snk_supp_cont, 0u);
-  ASSERT_EQ(supp_contexts.src_supp_cont, 0u);
+  ASSERT_EQ(supp_contexts.snk_supp_cont.value(), 0u);
+  ASSERT_EQ(supp_contexts.src_supp_cont.value(), 0u);
 }
 
 TEST(LeAudioClientParserTest, testParseSupportedAudioContexts) {
@@ -575,8 +575,8 @@
   };
 
   ParseSupportedAudioContexts(supp_contexts, sizeof(value1), value1);
-  ASSERT_EQ(supp_contexts.snk_supp_cont, 0x0201u);
-  ASSERT_EQ(supp_contexts.src_supp_cont, 0x0403u);
+  ASSERT_EQ(supp_contexts.snk_supp_cont.value(), 0x0201u);
+  ASSERT_EQ(supp_contexts.src_supp_cont.value(), 0x0403u);
 }
 
 }  // namespace pacs
diff --git a/system/bta/le_audio/codec_manager.cc b/system/bta/le_audio/codec_manager.cc
index 44b625f..098c6b4 100644
--- a/system/bta/le_audio/codec_manager.cc
+++ b/system/bta/le_audio/codec_manager.cc
@@ -16,13 +16,13 @@
 
 #include "codec_manager.h"
 
-#include "client_audio.h"
+#include "audio_hal_client/audio_hal_client.h"
 #include "device/include/controller.h"
+#include "le_audio_set_configuration_provider.h"
 #include "osi/include/log.h"
 #include "osi/include/properties.h"
 #include "stack/acl/acl.h"
 #include "stack/include/acl_api.h"
-#include "le_audio_set_configuration_provider.h"
 
 namespace {
 
@@ -89,7 +89,13 @@
           update_receiver) {
     if (stream_conf.sink_streams.empty()) return;
 
-    sink_config.stream_map = std::move(stream_conf.sink_streams);
+    if (stream_conf.sink_is_initial) {
+      sink_config.stream_map =
+          stream_conf.sink_offloader_streams_target_allocation;
+    } else {
+      sink_config.stream_map =
+          stream_conf.sink_offloader_streams_current_allocation;
+    }
     // TODO: set the default value 16 for now, would change it if we support
     // mode bits_per_sample
     sink_config.bits_per_sample = 16;
@@ -107,7 +113,13 @@
           update_receiver) {
     if (stream_conf.source_streams.empty()) return;
 
-    source_config.stream_map = std::move(stream_conf.source_streams);
+    if (stream_conf.source_is_initial) {
+      source_config.stream_map =
+          stream_conf.source_offloader_streams_target_allocation;
+    } else {
+      source_config.stream_map =
+          stream_conf.source_offloader_streams_current_allocation;
+    }
     // TODO: set the default value 16 for now, would change it if we support
     // mode bits_per_sample
     source_config.bits_per_sample = 16;
@@ -125,6 +137,46 @@
     return &context_type_offload_config_map_[ctx_type];
   }
 
+  const broadcast_offload_config* GetBroadcastOffloadConfig() {
+    // TODO: Need to check the offload capabilities and audio policy further
+    // Use 48_1_2 for the media quality as default by now.
+    broadcast_config.stream_map.resize(
+        LeAudioCodecConfiguration::kChannelNumberStereo);
+    broadcast_config.bits_per_sample =
+        LeAudioCodecConfiguration::kBitsPerSample16;
+    broadcast_config.sampling_rate =
+        LeAudioCodecConfiguration::kSampleRate48000;
+    broadcast_config.frame_duration =
+        LeAudioCodecConfiguration::kInterval7500Us;
+    broadcast_config.octets_per_frame = 75;
+    broadcast_config.blocks_per_sdu = 1;
+    broadcast_config.codec_bitrate = 80000;
+    broadcast_config.retransmission_number = 4;
+    broadcast_config.max_transport_latency = 60;
+    return &broadcast_config;
+  }
+
+  void UpdateBroadcastConnHandle(
+      const std::vector<uint16_t>& conn_handle,
+      std::function<void(const ::le_audio::broadcast_offload_config& config)>
+          update_receiver) {
+    LOG_ASSERT(conn_handle.size() == broadcast_config.stream_map.size());
+
+    if (broadcast_config.stream_map.size() ==
+        LeAudioCodecConfiguration::kChannelNumberStereo) {
+      broadcast_config.stream_map[0] = std::pair<uint16_t, uint32_t>{
+          conn_handle[0], codec_spec_conf::kLeAudioLocationFrontLeft};
+      broadcast_config.stream_map[1] = std::pair<uint16_t, uint32_t>{
+          conn_handle[1], codec_spec_conf::kLeAudioLocationFrontRight};
+    } else if (broadcast_config.stream_map.size() ==
+               LeAudioCodecConfiguration::kChannelNumberMono) {
+      broadcast_config.stream_map[0] = std::pair<uint16_t, uint32_t>{
+          conn_handle[0], codec_spec_conf::kLeAudioLocationFrontCenter};
+    }
+
+    update_receiver(broadcast_config);
+  }
+
  private:
   void SetCodecLocation(CodecLocation location) {
     if (offload_enable_ == false) return;
@@ -262,6 +314,7 @@
   bool offload_enable_ = false;
   le_audio::offload_config sink_config;
   le_audio::offload_config source_config;
+  le_audio::broadcast_offload_config broadcast_config;
   std::unordered_map<types::LeAudioContextType, AudioSetConfigurations>
       context_type_offload_config_map_;
   std::unordered_map<btle_audio_codec_index_t, uint8_t>
@@ -337,4 +390,23 @@
   return nullptr;
 }
 
+const ::le_audio::broadcast_offload_config*
+CodecManager::GetBroadcastOffloadConfig() {
+  if (pimpl_->IsRunning()) {
+    return pimpl_->codec_manager_impl_->GetBroadcastOffloadConfig();
+  }
+
+  return nullptr;
+}
+
+void CodecManager::UpdateBroadcastConnHandle(
+    const std::vector<uint16_t>& conn_handle,
+    std::function<void(const ::le_audio::broadcast_offload_config& config)>
+        update_receiver) {
+  if (pimpl_->IsRunning()) {
+    return pimpl_->codec_manager_impl_->UpdateBroadcastConnHandle(
+        conn_handle, update_receiver);
+  }
+}
+
 }  // namespace le_audio
diff --git a/system/bta/le_audio/codec_manager.h b/system/bta/le_audio/codec_manager.h
index 1eed274..52215c2 100644
--- a/system/bta/le_audio/codec_manager.h
+++ b/system/bta/le_audio/codec_manager.h
@@ -30,6 +30,18 @@
   uint16_t peer_delay_ms;
 };
 
+struct broadcast_offload_config {
+  std::vector<std::pair<uint16_t, uint32_t>> stream_map;
+  uint8_t bits_per_sample;
+  uint32_t sampling_rate;
+  uint32_t frame_duration;
+  uint16_t octets_per_frame;
+  uint8_t blocks_per_sdu;
+  uint32_t codec_bitrate;
+  uint8_t retransmission_number;
+  uint16_t max_transport_latency;
+};
+
 class CodecManager {
  public:
   CodecManager();
@@ -50,8 +62,14 @@
       const stream_configuration& stream_conf, uint16_t delay_ms,
       std::function<void(const ::le_audio::offload_config& config)>
           update_receiver);
-  const ::le_audio::set_configurations::AudioSetConfigurations*
+  virtual const ::le_audio::set_configurations::AudioSetConfigurations*
   GetOffloadCodecConfig(::le_audio::types::LeAudioContextType ctx_type);
+  virtual const ::le_audio::broadcast_offload_config*
+  GetBroadcastOffloadConfig();
+  virtual void UpdateBroadcastConnHandle(
+      const std::vector<uint16_t>& conn_handle,
+      std::function<void(const ::le_audio::broadcast_offload_config& config)>
+          update_receiver);
 
  private:
   struct impl;
diff --git a/system/bta/le_audio/devices.cc b/system/bta/le_audio/devices.cc
index a74c027..13cfa78 100644
--- a/system/bta/le_audio/devices.cc
+++ b/system/bta/le_audio/devices.cc
@@ -21,12 +21,14 @@
 
 #include <map>
 
+#include "audio_hal_client/audio_hal_client.h"
+#include "bta_csis_api.h"
 #include "bta_gatt_queue.h"
 #include "bta_groups.h"
 #include "bta_le_audio_api.h"
+#include "btif_storage.h"
 #include "btm_iso_api.h"
 #include "btm_iso_api_types.h"
-#include "client_audio.h"
 #include "device/include/controller.h"
 #include "gd/common/strings.h"
 #include "le_audio_set_configuration_provider.h"
@@ -41,6 +43,7 @@
 using bluetooth::hci::kIsoCigPhy2M;
 using bluetooth::hci::iso_manager::kIsoSca0To20Ppm;
 using le_audio::AudioSetConfigurationProvider;
+using le_audio::DeviceConnectState;
 using le_audio::set_configurations::CodecCapabilitySetting;
 using le_audio::types::ase;
 using le_audio::types::AseState;
@@ -48,11 +51,51 @@
 using le_audio::types::AudioLocations;
 using le_audio::types::AudioStreamDataPathState;
 using le_audio::types::BidirectAsesPair;
+using le_audio::types::CisType;
 using le_audio::types::LeAudioCodecId;
 using le_audio::types::LeAudioContextType;
 using le_audio::types::LeAudioLc3Config;
 
 namespace le_audio {
+std::ostream& operator<<(std::ostream& os, const DeviceConnectState& state) {
+  const char* char_value_ = "UNKNOWN";
+
+  switch (state) {
+    case DeviceConnectState::CONNECTED:
+      char_value_ = "CONNECTED";
+      break;
+    case DeviceConnectState::DISCONNECTED:
+      char_value_ = "DISCONNECTED";
+      break;
+    case DeviceConnectState::REMOVING:
+      char_value_ = "REMOVING";
+      break;
+    case DeviceConnectState::DISCONNECTING:
+      char_value_ = "DISCONNECTING";
+      break;
+    case DeviceConnectState::PENDING_REMOVAL:
+      char_value_ = "PENDING_REMOVAL";
+      break;
+    case DeviceConnectState::CONNECTING_BY_USER:
+      char_value_ = "CONNECTING_BY_USER";
+      break;
+    case DeviceConnectState::CONNECTED_BY_USER_GETTING_READY:
+      char_value_ = "CONNECTED_BY_USER_GETTING_READY";
+      break;
+    case DeviceConnectState::CONNECTING_AUTOCONNECT:
+      char_value_ = "CONNECTING_AUTOCONNECT";
+      break;
+    case DeviceConnectState::CONNECTED_AUTOCONNECT_GETTING_READY:
+      char_value_ = "CONNECTED_AUTOCONNECT_GETTING_READY";
+      break;
+  }
+
+  os << char_value_ << " ("
+     << "0x" << std::setfill('0') << std::setw(2) << static_cast<int>(state)
+     << ")";
+  return os;
+}
+
 /* LeAudioDeviceGroup Class methods implementation */
 void LeAudioDeviceGroup::AddNode(
     const std::shared_ptr<LeAudioDevice>& leAudioDevice) {
@@ -90,7 +133,7 @@
   if (leAudioDevices_.empty()) return 0;
 
   bool check_context_type = (context_type != LeAudioContextType::RFU);
-  AudioContexts type_set = static_cast<uint16_t>(context_type);
+  AudioContexts type_set(context_type);
 
   /* return number of connected devices from the set*/
   return std::count_if(
@@ -101,10 +144,45 @@
 
         if (!check_context_type) return true;
 
-        return (iter.lock()->GetAvailableContexts() & type_set).any();
+        return iter.lock()->GetAvailableContexts().test_any(type_set);
       });
 }
 
+void LeAudioDeviceGroup::ClearSinksFromConfiguration(void) {
+  LOG_INFO("Group %p, group_id %d", this, group_id_);
+  stream_conf.sink_streams.clear();
+  stream_conf.sink_offloader_streams_target_allocation.clear();
+  stream_conf.sink_offloader_streams_current_allocation.clear();
+  stream_conf.sink_audio_channel_allocation = 0;
+  stream_conf.sink_num_of_channels = 0;
+  stream_conf.sink_num_of_devices = 0;
+  stream_conf.sink_sample_frequency_hz = 0;
+  stream_conf.sink_codec_frames_blocks_per_sdu = 0;
+  stream_conf.sink_octets_per_codec_frame = 0;
+  stream_conf.sink_frame_duration_us = 0;
+}
+
+void LeAudioDeviceGroup::ClearSourcesFromConfiguration(void) {
+  LOG_INFO("Group %p, group_id %d", this, group_id_);
+  stream_conf.source_streams.clear();
+  stream_conf.source_offloader_streams_target_allocation.clear();
+  stream_conf.source_offloader_streams_current_allocation.clear();
+  stream_conf.source_audio_channel_allocation = 0;
+  stream_conf.source_num_of_channels = 0;
+  stream_conf.source_num_of_devices = 0;
+  stream_conf.source_sample_frequency_hz = 0;
+  stream_conf.source_codec_frames_blocks_per_sdu = 0;
+  stream_conf.source_octets_per_codec_frame = 0;
+  stream_conf.source_frame_duration_us = 0;
+}
+
+void LeAudioDeviceGroup::CigClearCis(void) {
+  LOG_INFO("group_id: %d", group_id_);
+  cises_.clear();
+  ClearSinksFromConfiguration();
+  ClearSourcesFromConfiguration();
+}
+
 void LeAudioDeviceGroup::Cleanup(void) {
   /* Bluetooth is off while streaming - disconnect CISes and remove CIG */
   if (GetState() == AseState::BTA_LE_AUDIO_ASE_STATE_STREAMING) {
@@ -140,6 +218,7 @@
    */
 
   leAudioDevices_.clear();
+  this->CigClearCis();
 }
 
 void LeAudioDeviceGroup::Deactivate(void) {
@@ -152,12 +231,33 @@
   }
 }
 
-void LeAudioDeviceGroup::Activate(LeAudioContextType context_type) {
+le_audio::types::CigState LeAudioDeviceGroup::GetCigState(void) {
+  return cig_state_;
+}
+
+void LeAudioDeviceGroup::SetCigState(le_audio::types::CigState state) {
+  LOG_VERBOSE("%s -> %s", bluetooth::common::ToString(cig_state_).c_str(),
+              bluetooth::common::ToString(state).c_str());
+  cig_state_ = state;
+}
+
+bool LeAudioDeviceGroup::Activate(LeAudioContextType context_type) {
+  bool is_activate = false;
   for (auto leAudioDevice : leAudioDevices_) {
     if (leAudioDevice.expired()) continue;
 
-    leAudioDevice.lock()->ActivateConfiguredAses(context_type);
+    bool activated = leAudioDevice.lock()->ActivateConfiguredAses(context_type);
+    LOG_INFO("Device %s is %s",
+             leAudioDevice.lock().get()->address_.ToString().c_str(),
+             activated ? "activated" : " not activated");
+    if (activated) {
+      if (!CigAssignCisIds(leAudioDevice.lock().get())) {
+        return false;
+      }
+      is_activate = true;
+    }
   }
+  return is_activate;
 }
 
 LeAudioDevice* LeAudioDeviceGroup::GetFirstDevice(void) {
@@ -171,12 +271,11 @@
 
 LeAudioDevice* LeAudioDeviceGroup::GetFirstDeviceWithActiveContext(
     types::LeAudioContextType context_type) {
-  AudioContexts type_set = static_cast<uint16_t>(context_type);
-
   auto iter = std::find_if(
-      leAudioDevices_.begin(), leAudioDevices_.end(), [&type_set](auto& iter) {
+      leAudioDevices_.begin(), leAudioDevices_.end(),
+      [&context_type](auto& iter) {
         if (iter.expired()) return false;
-        return (iter.lock()->GetAvailableContexts() & type_set).any();
+        return iter.lock()->GetAvailableContexts().test(context_type);
       });
 
   if ((iter == leAudioDevices_.end()) || (iter->expired())) return nullptr;
@@ -207,8 +306,6 @@
 
 LeAudioDevice* LeAudioDeviceGroup::GetNextDeviceWithActiveContext(
     LeAudioDevice* leAudioDevice, types::LeAudioContextType context_type) {
-  AudioContexts type_set = static_cast<uint16_t>(context_type);
-
   auto iter = std::find_if(leAudioDevices_.begin(), leAudioDevices_.end(),
                            [&leAudioDevice](auto& d) {
                              if (d.expired())
@@ -224,11 +321,11 @@
   /* If reference device is last in group */
   if (iter == leAudioDevices_.end()) return nullptr;
 
-  iter = std::find_if(iter, leAudioDevices_.end(), [&type_set](auto& d) {
+  iter = std::find_if(iter, leAudioDevices_.end(), [&context_type](auto& d) {
     if (d.expired())
       return false;
     else
-      return (d.lock()->GetAvailableContexts() & type_set).any();
+      return d.lock()->GetAvailableContexts().test(context_type);
     ;
   });
 
@@ -299,15 +396,57 @@
   return (iter == leAudioDevices_.end()) ? nullptr : (iter->lock()).get();
 }
 
-bool LeAudioDeviceGroup::SetContextType(LeAudioContextType context_type) {
-  /* XXX: group context policy ? / may it disallow to change type ?) */
-  context_type_ = context_type;
+LeAudioDevice* LeAudioDeviceGroup::GetFirstActiveDeviceByDataPathState(
+    AudioStreamDataPathState data_path_state) {
+  auto iter = std::find_if(leAudioDevices_.begin(), leAudioDevices_.end(),
+                           [&data_path_state](auto& d) {
+                             if (d.expired()) {
+                               return false;
+                             }
 
-  return true;
+                             return (((d.lock()).get())
+                                         ->GetFirstActiveAseByDataPathState(
+                                             data_path_state) != nullptr);
+                           });
+
+  if (iter == leAudioDevices_.end()) {
+    return nullptr;
+  }
+
+  return iter->lock().get();
 }
 
-LeAudioContextType LeAudioDeviceGroup::GetContextType(void) {
-  return context_type_;
+LeAudioDevice* LeAudioDeviceGroup::GetNextActiveDeviceByDataPathState(
+    LeAudioDevice* leAudioDevice, AudioStreamDataPathState data_path_state) {
+  auto iter = std::find_if(leAudioDevices_.begin(), leAudioDevices_.end(),
+                           [&leAudioDevice](auto& d) {
+                             if (d.expired()) {
+                               return false;
+                             }
+
+                             return d.lock().get() == leAudioDevice;
+                           });
+
+  if (std::distance(iter, leAudioDevices_.end()) < 1) {
+    return nullptr;
+  }
+
+  iter = std::find_if(
+      std::next(iter, 1), leAudioDevices_.end(), [&data_path_state](auto& d) {
+        if (d.expired()) {
+          return false;
+        }
+
+        return (((d.lock()).get())
+                    ->GetFirstActiveAseByDataPathState(data_path_state) !=
+                nullptr);
+      });
+
+  if (iter == leAudioDevices_.end()) {
+    return nullptr;
+  }
+
+  return iter->lock().get();
 }
 
 uint32_t LeAudioDeviceGroup::GetSduInterval(uint8_t direction) {
@@ -447,6 +586,44 @@
   *transport_latency_us = new_transport_latency_us;
 }
 
+uint8_t LeAudioDeviceGroup::GetRtn(uint8_t direction, uint8_t cis_id) {
+  LeAudioDevice* leAudioDevice = GetFirstActiveDevice();
+  LOG_ASSERT(leAudioDevice)
+      << __func__ << " Shouldn't be called without an active device.";
+
+  do {
+    auto ases_pair = leAudioDevice->GetAsesByCisId(cis_id);
+
+    if (ases_pair.sink && direction == types::kLeAudioDirectionSink) {
+      return ases_pair.sink->retrans_nb;
+    } else if (ases_pair.source &&
+               direction == types::kLeAudioDirectionSource) {
+      return ases_pair.source->retrans_nb;
+    }
+  } while ((leAudioDevice = GetNextActiveDevice(leAudioDevice)));
+
+  return 0;
+}
+
+uint16_t LeAudioDeviceGroup::GetMaxSduSize(uint8_t direction, uint8_t cis_id) {
+  LeAudioDevice* leAudioDevice = GetFirstActiveDevice();
+  LOG_ASSERT(leAudioDevice)
+      << __func__ << " Shouldn't be called without an active device.";
+
+  do {
+    auto ases_pair = leAudioDevice->GetAsesByCisId(cis_id);
+
+    if (ases_pair.sink && direction == types::kLeAudioDirectionSink) {
+      return ases_pair.sink->max_sdu_size;
+    } else if (ases_pair.source &&
+               direction == types::kLeAudioDirectionSource) {
+      return ases_pair.source->max_sdu_size;
+    }
+  } while ((leAudioDevice = GetNextActiveDevice(leAudioDevice)));
+
+  return 0;
+}
+
 uint8_t LeAudioDeviceGroup::GetPhyBitmask(uint8_t direction) {
   LeAudioDevice* leAudioDevice = GetFirstActiveDevice();
   LOG_ASSERT(leAudioDevice)
@@ -471,7 +648,17 @@
         phy_bitfield &= leAudioDevice->GetPhyBitmask();
 
         // A value of 0x00 denotes no preference
-        if (ase->preferred_phy) phy_bitfield &= ase->preferred_phy;
+        if (ase->preferred_phy && (phy_bitfield & ase->preferred_phy)) {
+          phy_bitfield &= ase->preferred_phy;
+          LOG_DEBUG("Using ASE preferred phy 0x%02x",
+                    static_cast<int>(phy_bitfield));
+        } else {
+          LOG_WARN(
+              "ASE preferred 0x%02x has nothing common with phy_bitfield "
+              "0x%02x ",
+              static_cast<int>(ase->preferred_phy),
+              static_cast<int>(phy_bitfield));
+        }
       }
     } while ((ase = leAudioDevice->GetNextActiveAseWithSameDirection(ase)));
   } while ((leAudioDevice = GetNextActiveDevice(leAudioDevice)));
@@ -549,35 +736,34 @@
   return remote_delay_ms;
 }
 
-/* This method returns AudioContext value if support for any type has changed */
-std::optional<AudioContexts> LeAudioDeviceGroup::UpdateActiveContextsMap(void) {
-  LOG_DEBUG(" group id: %d, active contexts: 0x%04lx", group_id_,
-            active_contexts_mask_.to_ulong());
-  return UpdateActiveContextsMap(active_contexts_mask_);
+void LeAudioDeviceGroup::UpdateAudioContextTypeAvailability(void) {
+  LOG_DEBUG(" group id: %d, available contexts: %s", group_id_,
+            group_available_contexts_.to_string().c_str());
+  UpdateAudioContextTypeAvailability(group_available_contexts_);
 }
 
-/* This method returns AudioContext value if support for any type has changed */
-std::optional<AudioContexts> LeAudioDeviceGroup::UpdateActiveContextsMap(
+/* Returns true if support for any type in the whole group has changed,
+ * otherwise false. */
+bool LeAudioDeviceGroup::UpdateAudioContextTypeAvailability(
     AudioContexts update_contexts) {
-  AudioContexts contexts = 0x0000;
+  auto new_contexts = AudioContexts();
   bool active_contexts_has_been_modified = false;
 
   if (update_contexts.none()) {
     LOG_DEBUG("No context updated");
-    return contexts;
+    return false;
   }
 
+  LOG_DEBUG("Updated context: %s", update_contexts.to_string().c_str());
+
   for (LeAudioContextType ctx_type : types::kLeAudioContextAllTypesArray) {
-    AudioContexts type_set = static_cast<uint16_t>(ctx_type);
-    LOG_DEBUG("Taking context: %s, 0x%04lx",
-              bluetooth::common::ToString(ctx_type).c_str(),
-              update_contexts.to_ulong());
-    if ((type_set & update_contexts).none()) {
-      LOG_INFO("Configuration not in updated context %s",
-               bluetooth::common::ToString(ctx_type).c_str());
+    LOG_DEBUG("Checking context: %s", ToHexString(ctx_type).c_str());
+
+    if (!update_contexts.test(ctx_type)) {
+      LOG_DEBUG("Configuration not in updated context");
       /* Fill context bitset for possible returned value if updated */
-      if (active_context_to_configuration_map.count(ctx_type) > 0)
-        contexts |= type_set;
+      if (available_context_to_configuration_map.count(ctx_type) > 0)
+        new_contexts.set(ctx_type);
 
       continue;
     }
@@ -585,8 +771,8 @@
     auto new_conf = FindFirstSupportedConfiguration(ctx_type);
 
     bool ctx_previously_not_supported =
-        (active_context_to_configuration_map.count(ctx_type) == 0 ||
-         active_context_to_configuration_map[ctx_type] == nullptr);
+        (available_context_to_configuration_map.count(ctx_type) == 0 ||
+         available_context_to_configuration_map[ctx_type] == nullptr);
     /* Check if support for context type has changed */
     if (ctx_previously_not_supported) {
       /* Current configuration for context type is empty */
@@ -595,45 +781,42 @@
         continue;
       } else {
         /* Configuration changes from empty to some */
-        contexts |= type_set;
+        new_contexts.set(ctx_type);
         active_contexts_has_been_modified = true;
       }
     } else {
       /* Current configuration for context type is not empty */
       if (new_conf == nullptr) {
         /* Configuration changed to empty */
-        contexts &= ~type_set;
+        new_contexts.unset(ctx_type);
         active_contexts_has_been_modified = true;
-      } else if (new_conf != active_context_to_configuration_map[ctx_type]) {
+      } else if (new_conf != available_context_to_configuration_map[ctx_type]) {
         /* Configuration changed to any other */
-        contexts |= type_set;
+        new_contexts.set(ctx_type);
         active_contexts_has_been_modified = true;
       } else {
         /* Configuration is the same */
-        contexts |= type_set;
+        new_contexts.set(ctx_type);
         continue;
       }
     }
 
     LOG_INFO(
-        "updated context: %s, %s -> %s",
-        bluetooth::common::ToString(ctx_type).c_str(),
+        "updated context: %s, %s -> %s", ToHexString(ctx_type).c_str(),
         (ctx_previously_not_supported
              ? "empty"
-             : active_context_to_configuration_map[ctx_type]->name.c_str()),
+             : available_context_to_configuration_map[ctx_type]->name.c_str()),
         (new_conf != nullptr ? new_conf->name.c_str() : "empty"));
 
-    active_context_to_configuration_map[ctx_type] = new_conf;
+    available_context_to_configuration_map[ctx_type] = new_conf;
   }
 
-  /* Some contexts have changed, return new active context bitset */
+  /* Some contexts have changed, return new available context bitset */
   if (active_contexts_has_been_modified) {
-    active_contexts_mask_ = contexts;
-    return contexts;
+    group_available_contexts_ = new_contexts;
   }
 
-  /* Nothing has changed */
-  return std::nullopt;
+  return active_contexts_has_been_modified;
 }
 
 bool LeAudioDeviceGroup::ReloadAudioLocations(void) {
@@ -643,7 +826,9 @@
       codec_spec_conf::kLeAudioLocationNotAllowed;
 
   for (const auto& device : leAudioDevices_) {
-    if (device.expired()) continue;
+    if (device.expired() || (device.lock().get()->GetConnectionState() !=
+                             DeviceConnectState::CONNECTED))
+      continue;
     updated_snk_audio_locations_ |= device.lock().get()->snk_audio_locations_;
     updated_src_audio_locations_ |= device.lock().get()->src_audio_locations_;
   }
@@ -663,7 +848,9 @@
   uint8_t updated_audio_directions = 0x00;
 
   for (const auto& device : leAudioDevices_) {
-    if (device.expired()) continue;
+    if (device.expired() || (device.lock().get()->GetConnectionState() !=
+                             DeviceConnectState::CONNECTED))
+      continue;
     updated_audio_directions |= device.lock().get()->audio_directions_;
   }
 
@@ -679,8 +866,9 @@
   return target_state_ != current_state_;
 }
 
-bool LeAudioDeviceGroup::IsReleasing(void) {
-  return target_state_ == AseState::BTA_LE_AUDIO_ASE_STATE_IDLE;
+bool LeAudioDeviceGroup::IsReleasingOrIdle(void) {
+  return (target_state_ == AseState::BTA_LE_AUDIO_ASE_STATE_IDLE) ||
+         (current_state_ == AseState::BTA_LE_AUDIO_ASE_STATE_IDLE);
 }
 
 bool LeAudioDeviceGroup::IsGroupStreamReady(void) {
@@ -695,16 +883,12 @@
   return iter == leAudioDevices_.end();
 }
 
-bool LeAudioDeviceGroup::HaveAllActiveDevicesCisDisc(void) {
-  auto iter =
-      std::find_if(leAudioDevices_.begin(), leAudioDevices_.end(), [](auto& d) {
-        if (d.expired())
-          return false;
-        else
-          return !(((d.lock()).get())->HaveAllAsesCisDisc());
-      });
-
-  return iter == leAudioDevices_.end();
+bool LeAudioDeviceGroup::HaveAllCisesDisconnected(void) {
+  for (auto const dev : leAudioDevices_) {
+    if (dev.expired()) continue;
+    if (dev.lock().get()->HaveAnyCisConnected()) return false;
+  }
+  return true;
 }
 
 uint8_t LeAudioDeviceGroup::GetFirstFreeCisId(void) {
@@ -723,6 +907,293 @@
   return kInvalidCisId;
 }
 
+uint8_t LeAudioDeviceGroup::GetFirstFreeCisId(CisType cis_type) {
+  LOG_DEBUG("Group: %p, group_id: %d cis_type: %d", this, group_id_,
+            static_cast<int>(cis_type));
+  for (size_t id = 0; id < cises_.size(); id++) {
+    if (cises_[id].addr.IsEmpty() && cises_[id].type == cis_type) {
+      return id;
+    }
+  }
+  return kInvalidCisId;
+}
+
+types::LeAudioConfigurationStrategy LeAudioDeviceGroup::GetGroupStrategy(void) {
+  /* Simple strategy picker */
+  LOG_INFO(" Group %d size %d", group_id_, Size());
+  if (Size() > 1) {
+    return types::LeAudioConfigurationStrategy::MONO_ONE_CIS_PER_DEVICE;
+  }
+
+  LOG_INFO("audio location 0x%04lx", snk_audio_locations_.to_ulong());
+  if (!(snk_audio_locations_.to_ulong() &
+        codec_spec_conf::kLeAudioLocationAnyLeft) ||
+      !(snk_audio_locations_.to_ulong() &
+        codec_spec_conf::kLeAudioLocationAnyRight)) {
+    return types::LeAudioConfigurationStrategy::MONO_ONE_CIS_PER_DEVICE;
+  }
+
+  auto device = GetFirstDevice();
+  auto channel_cnt =
+      device->GetLc3SupportedChannelCount(types::kLeAudioDirectionSink);
+  LOG_INFO("Channel count for group %d is %d (device %s)", group_id_,
+           channel_cnt, device->address_.ToString().c_str());
+  if (channel_cnt == 1) {
+    return types::LeAudioConfigurationStrategy::STEREO_TWO_CISES_PER_DEVICE;
+  }
+
+  return types::LeAudioConfigurationStrategy::STEREO_ONE_CIS_PER_DEVICE;
+}
+
+int LeAudioDeviceGroup::GetAseCount(uint8_t direction) {
+  int result = 0;
+  for (const auto& device_iter : leAudioDevices_) {
+    result += device_iter.lock()->GetAseCount(direction);
+  }
+
+  return result;
+}
+
+void LeAudioDeviceGroup::CigGenerateCisIds(
+    types::LeAudioContextType context_type) {
+  LOG_INFO("Group %p, group_id: %d, context_type: %s", this, group_id_,
+           bluetooth::common::ToString(context_type).c_str());
+
+  if (cises_.size() > 0) {
+    LOG_INFO("CIS IDs already generated");
+    return;
+  }
+
+  const set_configurations::AudioSetConfigurations* confs =
+      AudioSetConfigurationProvider::Get()->GetConfigurations(context_type);
+
+  uint8_t cis_count_bidir = 0;
+  uint8_t cis_count_unidir_sink = 0;
+  uint8_t cis_count_unidir_source = 0;
+  int csis_group_size =
+      bluetooth::csis::CsisClient::Get()->GetDesiredSize(group_id_);
+  /* If this is CSIS group, the csis_group_size will be > 0, otherwise -1.
+   * If the last happen it means, group size is 1 */
+  int group_size = csis_group_size > 0 ? csis_group_size : 1;
+
+  get_cis_count(*confs, group_size, GetGroupStrategy(),
+                GetAseCount(types::kLeAudioDirectionSink),
+                GetAseCount(types::kLeAudioDirectionSource), cis_count_bidir,
+                cis_count_unidir_sink, cis_count_unidir_source);
+
+  uint8_t idx = 0;
+  while (cis_count_bidir > 0) {
+    struct le_audio::types::cis cis_entry = {
+        .id = idx,
+        .addr = RawAddress::kEmpty,
+        .type = CisType::CIS_TYPE_BIDIRECTIONAL,
+        .conn_handle = 0,
+    };
+    cises_.push_back(cis_entry);
+    cis_count_bidir--;
+    idx++;
+  }
+
+  while (cis_count_unidir_sink > 0) {
+    struct le_audio::types::cis cis_entry = {
+        .id = idx,
+        .addr = RawAddress::kEmpty,
+        .type = CisType::CIS_TYPE_UNIDIRECTIONAL_SINK,
+        .conn_handle = 0,
+    };
+    cises_.push_back(cis_entry);
+    cis_count_unidir_sink--;
+    idx++;
+  }
+
+  while (cis_count_unidir_source > 0) {
+    struct le_audio::types::cis cis_entry = {
+        .id = idx,
+        .addr = RawAddress::kEmpty,
+        .type = CisType::CIS_TYPE_UNIDIRECTIONAL_SOURCE,
+        .conn_handle = 0,
+    };
+    cises_.push_back(cis_entry);
+    cis_count_unidir_source--;
+    idx++;
+  }
+}
+
+bool LeAudioDeviceGroup::CigAssignCisIds(LeAudioDevice* leAudioDevice) {
+  ASSERT_LOG(leAudioDevice, "invalid device");
+  LOG_INFO("device: %s", leAudioDevice->address_.ToString().c_str());
+
+  struct ase* ase = leAudioDevice->GetFirstActiveAse();
+  if (!ase) {
+    LOG_ERROR(" Device %s shouldn't be called without an active ASE",
+              leAudioDevice->address_.ToString().c_str());
+    return false;
+  }
+
+  for (; ase != nullptr; ase = leAudioDevice->GetNextActiveAse(ase)) {
+    uint8_t cis_id = kInvalidCisId;
+    /* CIS ID already set */
+    if (ase->cis_id != kInvalidCisId) {
+      LOG_INFO("ASE ID: %d, is already assigned CIS ID: %d, type %d", ase->id,
+               ase->cis_id, cises_[ase->cis_id].type);
+      if (!cises_[ase->cis_id].addr.IsEmpty()) {
+        LOG_INFO("Bidirectional ASE already assigned");
+        continue;
+      }
+      /* Reuse existing CIS ID if available*/
+      cis_id = ase->cis_id;
+    }
+
+    /* First check if we have bidirectional ASEs. If so, assign same CIS ID.*/
+    struct ase* matching_bidir_ase =
+        leAudioDevice->GetNextActiveAseWithDifferentDirection(ase);
+
+    if (matching_bidir_ase) {
+      if (cis_id == kInvalidCisId) {
+        cis_id = GetFirstFreeCisId(CisType::CIS_TYPE_BIDIRECTIONAL);
+      }
+
+      if (cis_id != kInvalidCisId) {
+        ase->cis_id = cis_id;
+        matching_bidir_ase->cis_id = cis_id;
+        cises_[cis_id].addr = leAudioDevice->address_;
+
+        LOG_INFO(
+            " ASE ID: %d and ASE ID: %d, assigned Bi-Directional CIS ID: %d",
+            +ase->id, +matching_bidir_ase->id, +ase->cis_id);
+        continue;
+      }
+
+      LOG_WARN(
+          " ASE ID: %d, unable to get free Bi-Directional CIS ID but maybe "
+          "thats fine. Try using unidirectional.",
+          ase->id);
+    }
+
+    if (ase->direction == types::kLeAudioDirectionSink) {
+      if (cis_id == kInvalidCisId) {
+        cis_id = GetFirstFreeCisId(CisType::CIS_TYPE_UNIDIRECTIONAL_SINK);
+      }
+
+      if (cis_id == kInvalidCisId) {
+        LOG_WARN(
+            " Unable to get free Uni-Directional Sink CIS ID - maybe there is "
+            "bi-directional available");
+        /* This could happen when scenarios for given context type allows for
+         * Sink and Source configuration but also only Sink configuration.
+         */
+        cis_id = GetFirstFreeCisId(CisType::CIS_TYPE_BIDIRECTIONAL);
+        if (cis_id == kInvalidCisId) {
+          LOG_ERROR("Unable to get free Uni-Directional Sink CIS ID");
+          return false;
+        }
+      }
+
+      ase->cis_id = cis_id;
+      cises_[cis_id].addr = leAudioDevice->address_;
+      LOG_INFO("ASE ID: %d, assigned Uni-Directional Sink CIS ID: %d", ase->id,
+               ase->cis_id);
+      continue;
+    }
+
+    /* Source direction */
+    ASSERT_LOG(ase->direction == types::kLeAudioDirectionSource,
+               "Expected Source direction, actual=%d", ase->direction);
+
+    if (cis_id == kInvalidCisId) {
+      cis_id = GetFirstFreeCisId(CisType::CIS_TYPE_UNIDIRECTIONAL_SOURCE);
+    }
+
+    if (cis_id == kInvalidCisId) {
+      /* This could happen when scenarios for given context type allows for
+       * Sink and Source configuration but also only Sink configuration.
+       */
+      LOG_WARN(
+          "Unable to get free Uni-Directional Source CIS ID - maybe there "
+          "is bi-directional available");
+      cis_id = GetFirstFreeCisId(CisType::CIS_TYPE_BIDIRECTIONAL);
+      if (cis_id == kInvalidCisId) {
+        LOG_ERROR("Unable to get free Uni-Directional Source CIS ID");
+        return false;
+      }
+    }
+
+    ase->cis_id = cis_id;
+    cises_[cis_id].addr = leAudioDevice->address_;
+    LOG_INFO("ASE ID: %d, assigned Uni-Directional Source CIS ID: %d", ase->id,
+             ase->cis_id);
+  }
+
+  return true;
+}
+
+void LeAudioDeviceGroup::CigAssignCisConnHandles(
+    const std::vector<uint16_t>& conn_handles) {
+  LOG_INFO("num of cis handles %d", static_cast<int>(conn_handles.size()));
+  for (size_t i = 0; i < cises_.size(); i++) {
+    cises_[i].conn_handle = conn_handles[i];
+    LOG_INFO("assigning cis[%d] conn_handle: %d", cises_[i].id,
+             cises_[i].conn_handle);
+  }
+}
+
+void LeAudioDeviceGroup::CigAssignCisConnHandlesToAses(
+    LeAudioDevice* leAudioDevice) {
+  ASSERT_LOG(leAudioDevice, "Invalid device");
+  LOG_INFO("group: %p, group_id: %d, device: %s", this, group_id_,
+           leAudioDevice->address_.ToString().c_str());
+
+  /* Assign all CIS connection handles to ases */
+  struct le_audio::types::ase* ase =
+      leAudioDevice->GetFirstActiveAseByDataPathState(
+          AudioStreamDataPathState::IDLE);
+  if (!ase) {
+    LOG_WARN("No active ASE with AudioStreamDataPathState IDLE");
+    return;
+  }
+
+  for (; ase != nullptr; ase = leAudioDevice->GetFirstActiveAseByDataPathState(
+                             AudioStreamDataPathState::IDLE)) {
+    auto ases_pair = leAudioDevice->GetAsesByCisId(ase->cis_id);
+
+    if (ases_pair.sink && ases_pair.sink->active) {
+      ases_pair.sink->cis_conn_hdl = cises_[ase->cis_id].conn_handle;
+      ases_pair.sink->data_path_state = AudioStreamDataPathState::CIS_ASSIGNED;
+    }
+    if (ases_pair.source && ases_pair.source->active) {
+      ases_pair.source->cis_conn_hdl = cises_[ase->cis_id].conn_handle;
+      ases_pair.source->data_path_state =
+          AudioStreamDataPathState::CIS_ASSIGNED;
+    }
+  }
+}
+
+void LeAudioDeviceGroup::CigAssignCisConnHandlesToAses(void) {
+  LeAudioDevice* leAudioDevice = GetFirstActiveDevice();
+  ASSERT_LOG(leAudioDevice, "Shouldn't be called without an active device.");
+
+  LOG_INFO("Group %p, group_id %d", this, group_id_);
+
+  /* Assign all CIS connection handles to ases */
+  for (; leAudioDevice != nullptr;
+       leAudioDevice = GetNextActiveDevice(leAudioDevice)) {
+    CigAssignCisConnHandlesToAses(leAudioDevice);
+  }
+}
+
+void LeAudioDeviceGroup::CigUnassignCis(LeAudioDevice* leAudioDevice) {
+  ASSERT_LOG(leAudioDevice, "Invalid device");
+
+  LOG_INFO("Group %p, group_id %d, device: %s", this, group_id_,
+           leAudioDevice->address_.ToString().c_str());
+
+  for (struct le_audio::types::cis& cis_entry : cises_) {
+    if (cis_entry.addr == leAudioDevice->address_) {
+      cis_entry.addr = RawAddress::kEmpty;
+    }
+  }
+}
+
 bool CheckIfStrategySupported(types::LeAudioConfigurationStrategy strategy,
                               types::AudioLocations audio_locations,
                               uint8_t requested_channel_count,
@@ -779,6 +1250,8 @@
     return false;
   }
 
+  auto required_snk_strategy = GetGroupStrategy();
+
   /* TODO For now: set ase if matching with first pac.
    * 1) We assume as well that devices will match requirements in order
    *    e.g. 1 Device - 1 Requirement, 2 Device - 2 Requirement etc.
@@ -803,6 +1276,14 @@
         +required_device_cnt, +ent.ase_cnt, +max_required_ase_per_dev,
         static_cast<int>(strategy));
 
+    if (ent.direction == types::kLeAudioDirectionSink &&
+        strategy != required_snk_strategy) {
+      LOG_INFO(" Sink strategy mismatch group!=cfg.entry (%d!=%d)",
+               static_cast<int>(required_snk_strategy),
+               static_cast<int>(strategy));
+      return false;
+    }
+
     for (auto* device = GetFirstDeviceWithActiveContext(context_type);
          device != nullptr && required_device_cnt > 0;
          device = GetNextDeviceWithActiveContext(device, context_type)) {
@@ -847,6 +1328,11 @@
         if (needed_ase == 0) break;
       }
 
+      if (needed_ase > 0) {
+        LOG_DEBUG("Device has too less ASEs. Still needed ases %d", needed_ase);
+        return false;
+      }
+
       required_device_cnt--;
     }
 
@@ -862,7 +1348,7 @@
   return true;
 }
 
-uint32_t GetFirstLeft(const types::AudioLocations audio_locations) {
+static uint32_t GetFirstLeft(const types::AudioLocations& audio_locations) {
   uint32_t audio_location_ulong = audio_locations.to_ulong();
 
   if (audio_location_ulong & codec_spec_conf::kLeAudioLocationFrontLeft)
@@ -895,11 +1381,10 @@
   if (audio_location_ulong & codec_spec_conf::kLeAudioLocationLeftSurround)
     return codec_spec_conf::kLeAudioLocationLeftSurround;
 
-  LOG_ASSERT(0) << __func__ << " shall not happen";
   return 0;
 }
 
-uint32_t GetFirstRight(const types::AudioLocations audio_locations) {
+static uint32_t GetFirstRight(const types::AudioLocations& audio_locations) {
   uint32_t audio_location_ulong = audio_locations.to_ulong();
 
   if (audio_location_ulong & codec_spec_conf::kLeAudioLocationFrontRight)
@@ -933,47 +1418,45 @@
   if (audio_location_ulong & codec_spec_conf::kLeAudioLocationRightSurround)
     return codec_spec_conf::kLeAudioLocationRightSurround;
 
-  LOG_ASSERT(0) << __func__ << " shall not happen";
   return 0;
 }
 
 uint32_t PickAudioLocation(types::LeAudioConfigurationStrategy strategy,
-                           types::AudioLocations audio_locations,
-                           types::AudioLocations* group_audio_locations) {
-  DLOG(INFO) << __func__ << " strategy: " << (int)strategy
-             << " locations: " << +audio_locations.to_ulong()
-             << " group locations: " << +group_audio_locations->to_ulong();
+                           types::AudioLocations device_locations,
+                           types::AudioLocations* group_locations) {
+  LOG_DEBUG("strategy: %d, locations: 0x%lx, group locations: 0x%lx",
+            (int)strategy, device_locations.to_ulong(),
+            group_locations->to_ulong());
+
+  auto is_left_not_yet_assigned =
+      !(group_locations->to_ulong() & codec_spec_conf::kLeAudioLocationAnyLeft);
+  auto is_right_not_yet_assigned = !(group_locations->to_ulong() &
+                                     codec_spec_conf::kLeAudioLocationAnyRight);
+  uint32_t left_device_loc = GetFirstLeft(device_locations);
+  uint32_t right_device_loc = GetFirstRight(device_locations);
+
+  if (left_device_loc == 0 && right_device_loc == 0) {
+    LOG_WARN("Can't find device able to render left  and right audio channel");
+  }
 
   switch (strategy) {
     case types::LeAudioConfigurationStrategy::MONO_ONE_CIS_PER_DEVICE:
     case types::LeAudioConfigurationStrategy::STEREO_TWO_CISES_PER_DEVICE:
-      if ((audio_locations.to_ulong() &
-           codec_spec_conf::kLeAudioLocationAnyLeft) &&
-          !(group_audio_locations->to_ulong() &
-            codec_spec_conf::kLeAudioLocationAnyLeft)) {
-        uint32_t left_location = GetFirstLeft(audio_locations);
-        *group_audio_locations |= left_location;
-        return left_location;
+      if (left_device_loc && is_left_not_yet_assigned) {
+        *group_locations |= left_device_loc;
+        return left_device_loc;
       }
 
-      if ((audio_locations.to_ulong() &
-           codec_spec_conf::kLeAudioLocationAnyRight) &&
-          !(group_audio_locations->to_ulong() &
-            codec_spec_conf::kLeAudioLocationAnyRight)) {
-        uint32_t right_location = GetFirstRight(audio_locations);
-        *group_audio_locations |= right_location;
-        return right_location;
+      if (right_device_loc && is_right_not_yet_assigned) {
+        *group_locations |= right_device_loc;
+        return right_device_loc;
       }
       break;
+
     case types::LeAudioConfigurationStrategy::STEREO_ONE_CIS_PER_DEVICE:
-      if ((audio_locations.to_ulong() &
-           codec_spec_conf::kLeAudioLocationAnyLeft) &&
-          (audio_locations.to_ulong() &
-           codec_spec_conf::kLeAudioLocationAnyRight)) {
-        uint32_t left_location = GetFirstLeft(audio_locations);
-        uint32_t right_location = GetFirstRight(audio_locations);
-        *group_audio_locations |= left_location | right_location;
-        return left_location | right_location;
+      if (left_device_loc && right_device_loc) {
+        *group_locations |= left_device_loc | right_device_loc;
+        return left_device_loc | right_device_loc;
       }
       break;
     default:
@@ -981,12 +1464,15 @@
       return 0;
   }
 
-  LOG_ALWAYS_FATAL(
-      "%s: Shall never exit switch statement, strategy: %hhu, "
-      "locations: %lx, group_locations: %lx",
-      __func__, strategy, audio_locations.to_ulong(),
-      group_audio_locations->to_ulong());
-  return 0;
+  LOG_ERROR(
+      "Can't find device for left/right channel. Strategy: %hhu, "
+      "device_locations: %lx, group_locations: %lx.",
+      strategy, device_locations.to_ulong(), group_locations->to_ulong());
+
+  /* Return either any left or any right audio location. It might result with
+   * multiple devices within the group having the same location.
+   */
+  return left_device_loc ? left_device_loc : right_device_loc;
 }
 
 bool LeAudioDevice::ConfigureAses(
@@ -995,10 +1481,27 @@
     uint8_t* number_of_already_active_group_ase,
     types::AudioLocations& group_snk_audio_locations,
     types::AudioLocations& group_src_audio_locations, bool reuse_cis_id,
-    int ccid) {
-  struct ase* ase = GetFirstInactiveAse(ent.direction, reuse_cis_id);
-  if (!ase) return false;
+    AudioContexts metadata_context_type,
+    const std::vector<uint8_t>& ccid_list) {
+  /* First try to use the already configured ASE */
+  auto ase = GetFirstActiveAseByDirection(ent.direction);
+  if (ase) {
+    LOG_INFO("Using an already active ASE id=%d", ase->id);
+  } else {
+    ase = GetFirstInactiveAse(ent.direction, reuse_cis_id);
+  }
 
+  if (!ase) {
+    LOG_ERROR("Unable to find an ASE to configure");
+    return false;
+  }
+
+  /* The number_of_already_active_group_ase keeps all the active ases
+   * in other devices in the group.
+   * This function counts active ases only for this device, and we count here
+   * new active ases and already active ases which we want to reuse in the
+   * scenario
+   */
   uint8_t active_ases = *number_of_already_active_group_ase;
   uint8_t max_required_ase_per_dev =
       ent.ase_cnt / ent.device_cnt + (ent.ase_cnt % ent.device_cnt);
@@ -1026,41 +1529,62 @@
     ase->configured_for_context_type = context_type;
     active_ases++;
 
-    if (ase->state == AseState::BTA_LE_AUDIO_ASE_STATE_CODEC_CONFIGURED)
-      ase->reconfigure = true;
+    /* In case of late connect, we could be here for STREAMING ase.
+     * in such case, it is needed to mark ase as known active ase which
+     * is important to validate scenario and is done already few lines above.
+     * Nothing more to do is needed here.
+     */
+    if (ase->state != AseState::BTA_LE_AUDIO_ASE_STATE_STREAMING) {
+      if (ase->state == AseState::BTA_LE_AUDIO_ASE_STATE_CODEC_CONFIGURED)
+        ase->reconfigure = true;
 
-    ase->target_latency = ent.target_latency;
-    ase->codec_id = ent.codec.id;
-    /* TODO: find better way to not use LC3 explicitly */
-    ase->codec_config = std::get<LeAudioLc3Config>(ent.codec.config);
+      ase->target_latency = ent.target_latency;
+      ase->codec_id = ent.codec.id;
+      /* TODO: find better way to not use LC3 explicitly */
+      ase->codec_config = std::get<LeAudioLc3Config>(ent.codec.config);
 
-    /*Let's choose audio channel allocation if not set */
-    ase->codec_config.audio_channel_allocation =
-        PickAudioLocation(strategy, audio_locations, group_audio_locations);
+      /*Let's choose audio channel allocation if not set */
+      ase->codec_config.audio_channel_allocation =
+          PickAudioLocation(strategy, audio_locations, group_audio_locations);
 
-    /* Get default value if no requirement for specific frame blocks per sdu */
-    if (!ase->codec_config.codec_frames_blocks_per_sdu) {
-      ase->codec_config.codec_frames_blocks_per_sdu =
-          GetMaxCodecFramesPerSduFromPac(pac);
+      /* Get default value if no requirement for specific frame blocks per sdu
+       */
+      if (!ase->codec_config.codec_frames_blocks_per_sdu) {
+        ase->codec_config.codec_frames_blocks_per_sdu =
+            GetMaxCodecFramesPerSduFromPac(pac);
+      }
+      ase->max_sdu_size = codec_spec_caps::GetAudioChannelCounts(
+                              *ase->codec_config.audio_channel_allocation) *
+                          *ase->codec_config.octets_per_codec_frame *
+                          *ase->codec_config.codec_frames_blocks_per_sdu;
+
+      ase->retrans_nb = ent.qos.retransmission_number;
+      ase->max_transport_latency = ent.qos.max_transport_latency;
+
+      /* Filter multidirectional audio context for each ase direction */
+      auto directional_audio_context =
+          metadata_context_type & GetAvailableContexts(ase->direction);
+      if (directional_audio_context.any()) {
+        ase->metadata = GetMetadata(directional_audio_context, ccid_list);
+      } else {
+        ase->metadata =
+            GetMetadata(AudioContexts(LeAudioContextType::UNSPECIFIED),
+                        std::vector<uint8_t>());
+      }
     }
-    ase->max_sdu_size = codec_spec_caps::GetAudioChannelCounts(
-                            *ase->codec_config.audio_channel_allocation) *
-                        *ase->codec_config.octets_per_codec_frame *
-                        *ase->codec_config.codec_frames_blocks_per_sdu;
 
-    ase->retrans_nb = ent.qos.retransmission_number;
-    ase->max_transport_latency = ent.qos.max_transport_latency;
+    LOG_DEBUG(
+        "device=%s, activated ASE id=%d, direction=%s, max_sdu_size=%d, "
+        "cis_id=%d, target_latency=%d",
+        address_.ToString().c_str(), ase->id,
+        (ent.direction == 1 ? "snk" : "src"), ase->max_sdu_size, ase->cis_id,
+        ent.target_latency);
 
-    ase->metadata = GetMetadata(context_type, ccid);
-
-    DLOG(INFO) << __func__ << " device=" << address_
-               << ", activated ASE id=" << +ase->id
-               << ", direction=" << +ase->direction
-               << ", max_sdu_size=" << +ase->max_sdu_size
-               << ", cis_id=" << +ase->cis_id
-               << ", target_latency=" << +ent.target_latency;
-
-    ase = GetFirstInactiveAse(ent.direction, reuse_cis_id);
+    /* Try to use the already active ASE */
+    ase = GetNextActiveAseWithSameDirection(ase);
+    if (ase == nullptr) {
+      ase = GetFirstInactiveAse(ent.direction, reuse_cis_id);
+    }
   }
 
   *number_of_already_active_group_ase = active_ases;
@@ -1072,7 +1596,8 @@
  */
 bool LeAudioDeviceGroup::ConfigureAses(
     const set_configurations::AudioSetConfiguration* audio_set_conf,
-    types::LeAudioContextType context_type, int ccid) {
+    types::LeAudioContextType context_type, AudioContexts metadata_context_type,
+    const std::vector<uint8_t>& ccid_list) {
   if (!set_configurations::check_if_may_cover_scenario(
           audio_set_conf, NumOfConnected(context_type)))
     return false;
@@ -1092,9 +1617,9 @@
   types::AudioLocations group_src_audio_locations = 0;
 
   for (const auto& ent : (*audio_set_conf).confs) {
-    DLOG(INFO) << __func__
-               << " Looking for requirements: " << audio_set_conf->name << " - "
-               << (ent.direction == 1 ? "snk" : "src");
+    LOG_DEBUG(" Looking for requirements: %s,  - %s",
+              audio_set_conf->name.c_str(),
+              (ent.direction == 1 ? "snk" : "src"));
 
     uint8_t required_device_cnt = ent.device_cnt;
     uint8_t max_required_ase_per_dev =
@@ -1102,23 +1627,30 @@
     uint8_t active_ase_num = 0;
     le_audio::types::LeAudioConfigurationStrategy strategy = ent.strategy;
 
-    DLOG(INFO) << __func__ << " Number of devices: " << +required_device_cnt
-               << " number of ASEs: " << +ent.ase_cnt
-               << " Max ASE per device: " << +max_required_ase_per_dev
-               << " strategy: " << (int)strategy;
+    LOG_DEBUG(
+        "Number of devices: %d number of ASEs: %d, Max ASE per device: %d "
+        "strategy: %d",
+        required_device_cnt, ent.ase_cnt, max_required_ase_per_dev,
+        (int)strategy);
 
     for (auto* device = GetFirstDeviceWithActiveContext(context_type);
          device != nullptr && required_device_cnt > 0;
          device = GetNextDeviceWithActiveContext(device, context_type)) {
-      /* Skip if device has ASE configured in this direction already */
-      if (device->GetFirstActiveAseByDirection(ent.direction)) continue;
-
-      /* For the moment, we configure only connected devices. */
-      if (device->conn_id_ == GATT_INVALID_CONN_ID) continue;
+      /* For the moment, we configure only connected devices and when it is
+       * ready to stream i.e. All ASEs are discovered and device is reported as
+       * connected
+       */
+      if (device->GetConnectionState() != DeviceConnectState::CONNECTED) {
+        LOG_WARN(
+            "Device %s, in the state %s", device->address_.ToString().c_str(),
+            bluetooth::common::ToString(device->GetConnectionState()).c_str());
+        continue;
+      }
 
       if (!device->ConfigureAses(ent, context_type, &active_ase_num,
                                  group_snk_audio_locations,
-                                 group_src_audio_locations, reuse_cis_id, ccid))
+                                 group_src_audio_locations, reuse_cis_id,
+                                 metadata_context_type, ccid_list))
         continue;
 
       required_device_cnt--;
@@ -1126,32 +1658,36 @@
 
     if (required_device_cnt > 0) {
       /* Don't left any active devices if requirements are not met */
-      LOG(ERROR) << __func__ << " could not configure all the devices";
+      LOG_ERROR(" could not configure all the devices");
       Deactivate();
       return false;
     }
   }
 
-  LOG(INFO) << "Choosed ASE Configuration for group: " << this->group_id_
-            << " configuration: " << audio_set_conf->name;
+  LOG_INFO("Choosed ASE Configuration for group: %d, configuration: %s",
+           group_id_, audio_set_conf->name.c_str());
 
-  active_context_type_ = context_type;
+  configuration_context_type_ = context_type;
+  metadata_context_type_ = metadata_context_type;
   return true;
 }
 
 const set_configurations::AudioSetConfiguration*
 LeAudioDeviceGroup::GetActiveConfiguration(void) {
-  return active_context_to_configuration_map[active_context_type_];
-}
-AudioContexts LeAudioDeviceGroup::GetActiveContexts(void) {
-  return active_contexts_mask_;
+  return available_context_to_configuration_map[configuration_context_type_];
 }
 
 std::optional<LeAudioCodecConfiguration>
 LeAudioDeviceGroup::GetCodecConfigurationByDirection(
-    types::LeAudioContextType group_context_type, uint8_t direction) {
+    types::LeAudioContextType group_context_type, uint8_t direction) const {
+  if (available_context_to_configuration_map.count(group_context_type) == 0) {
+    LOG_DEBUG("Context type %s, not supported",
+              bluetooth::common::ToString(group_context_type).c_str());
+    return std::nullopt;
+  }
+
   const set_configurations::AudioSetConfiguration* audio_set_conf =
-      active_context_to_configuration_map[group_context_type];
+      available_context_to_configuration_map.at(group_context_type);
   LeAudioCodecConfiguration group_config = {0, 0, 0, 0};
   if (!audio_set_conf) return std::nullopt;
 
@@ -1199,24 +1735,146 @@
 
 bool LeAudioDeviceGroup::IsContextSupported(
     types::LeAudioContextType group_context_type) {
-  auto iter = active_context_to_configuration_map.find(group_context_type);
-  if (iter == active_context_to_configuration_map.end()) return false;
+  auto iter = available_context_to_configuration_map.find(group_context_type);
+  if (iter == available_context_to_configuration_map.end()) return false;
 
-  return active_context_to_configuration_map[group_context_type] != nullptr;
+  return available_context_to_configuration_map[group_context_type] != nullptr;
 }
 
 bool LeAudioDeviceGroup::IsMetadataChanged(
-    types::LeAudioContextType context_type, int ccid) {
+    types::AudioContexts context_type, const std::vector<uint8_t>& ccid_list) {
   for (auto* leAudioDevice = GetFirstActiveDevice(); leAudioDevice;
        leAudioDevice = GetNextActiveDevice(leAudioDevice)) {
-    if (leAudioDevice->IsMetadataChanged(context_type, ccid)) return true;
+    if (leAudioDevice->IsMetadataChanged(context_type, ccid_list)) return true;
   }
 
   return false;
 }
 
-types::LeAudioContextType LeAudioDeviceGroup::GetCurrentContextType(void) {
-  return active_context_type_;
+void LeAudioDeviceGroup::StreamOffloaderUpdated(uint8_t direction) {
+  if (direction == le_audio::types::kLeAudioDirectionSource) {
+    stream_conf.source_is_initial = false;
+  } else {
+    stream_conf.sink_is_initial = false;
+  }
+}
+
+void LeAudioDeviceGroup::CreateStreamVectorForOffloader(uint8_t direction) {
+  if (CodecManager::GetInstance()->GetCodecLocation() !=
+      le_audio::types::CodecLocation::ADSP) {
+    return;
+  }
+
+  CisType cis_type;
+  std::vector<std::pair<uint16_t, uint32_t>>* streams;
+  std::vector<std::pair<uint16_t, uint32_t>>*
+      offloader_streams_target_allocation;
+  std::vector<std::pair<uint16_t, uint32_t>>*
+      offloader_streams_current_allocation;
+  std::string tag;
+  uint32_t available_allocations = 0;
+  bool* changed_flag;
+  bool* is_initial;
+  if (direction == le_audio::types::kLeAudioDirectionSource) {
+    changed_flag = &stream_conf.source_offloader_changed;
+    is_initial = &stream_conf.source_is_initial;
+    cis_type = CisType::CIS_TYPE_UNIDIRECTIONAL_SOURCE;
+    streams = &stream_conf.source_streams;
+    offloader_streams_target_allocation =
+        &stream_conf.source_offloader_streams_target_allocation;
+    offloader_streams_current_allocation =
+        &stream_conf.source_offloader_streams_current_allocation;
+    tag = "Source";
+    available_allocations = AdjustAllocationForOffloader(
+        stream_conf.source_audio_channel_allocation);
+  } else {
+    changed_flag = &stream_conf.sink_offloader_changed;
+    is_initial = &stream_conf.sink_is_initial;
+    cis_type = CisType::CIS_TYPE_UNIDIRECTIONAL_SINK;
+    streams = &stream_conf.sink_streams;
+    offloader_streams_target_allocation =
+        &stream_conf.sink_offloader_streams_target_allocation;
+    offloader_streams_current_allocation =
+        &stream_conf.sink_offloader_streams_current_allocation;
+    tag = "Sink";
+    available_allocations =
+        AdjustAllocationForOffloader(stream_conf.sink_audio_channel_allocation);
+  }
+
+  if (available_allocations == 0) {
+    LOG_ERROR("There is no CIS connected");
+    return;
+  }
+
+  if (offloader_streams_target_allocation->size() == 0) {
+    *is_initial = true;
+  } else if (*is_initial) {
+    // As multiple CISes phone call case, the target_allocation already have the
+    // previous data, but the is_initial flag not be cleared. We need to clear
+    // here to avoid make duplicated target allocation stream map.
+    offloader_streams_target_allocation->clear();
+  }
+
+  offloader_streams_current_allocation->clear();
+  *changed_flag = true;
+  bool not_all_cises_connected = false;
+  if (available_allocations != codec_spec_conf::kLeAudioLocationStereo) {
+    not_all_cises_connected = true;
+  }
+
+  /* If the all cises are connected as stream started, reset changed_flag that
+   * the bt stack wouldn't send another audio configuration for the connection
+   * status */
+  if (*is_initial && !not_all_cises_connected) {
+    *changed_flag = false;
+  }
+
+  /* Note: For the offloader case we simplify allocation to only Left and Right.
+   * If we need 2 CISes and only one is connected, the connected one will have
+   * allocation set to stereo (left | right) and other one will have allocation
+   * set to 0. Offloader in this case shall mix left and right and send it on
+   * connected CIS. If there is only single CIS with stereo allocation, it means
+   * that peer device support channel count 2 and offloader shall send two
+   * channels in the single CIS.
+   */
+
+  for (auto& cis_entry : cises_) {
+    if ((cis_entry.type == CisType::CIS_TYPE_BIDIRECTIONAL ||
+         cis_entry.type == cis_type) &&
+        cis_entry.conn_handle != 0) {
+      uint32_t target_allocation = 0;
+      uint32_t current_allocation = 0;
+      for (const auto& s : *streams) {
+        if (s.first == cis_entry.conn_handle) {
+          target_allocation = AdjustAllocationForOffloader(s.second);
+          current_allocation = target_allocation;
+          if (not_all_cises_connected) {
+            /* Tell offloader to mix on this CIS.*/
+            current_allocation = codec_spec_conf::kLeAudioLocationStereo;
+          }
+          break;
+        }
+      }
+
+      if (target_allocation == 0) {
+        /* Take missing allocation for that one .*/
+        target_allocation =
+            codec_spec_conf::kLeAudioLocationStereo & ~available_allocations;
+      }
+
+      LOG_INFO(
+          "%s: Cis handle 0x%04x, target allocation  0x%08x, current "
+          "allocation 0x%08x",
+          tag.c_str(), cis_entry.conn_handle, target_allocation,
+          current_allocation);
+      if (*is_initial) {
+        offloader_streams_target_allocation->emplace_back(
+            std::make_pair(cis_entry.conn_handle, target_allocation));
+      }
+      offloader_streams_current_allocation->emplace_back(
+          std::make_pair(cis_entry.conn_handle, current_allocation));
+    }
+  }
 }
 
 bool LeAudioDeviceGroup::IsPendingConfiguration(void) {
@@ -1227,6 +1885,30 @@
   stream_conf.pending_configuration = true;
 }
 
+void LeAudioDeviceGroup::ClearPendingConfiguration(void) {
+  stream_conf.pending_configuration = false;
+}
+
+bool LeAudioDeviceGroup::IsConfigurationSupported(
+    LeAudioDevice* leAudioDevice,
+    const set_configurations::AudioSetConfiguration* audio_set_conf) {
+  for (const auto& ent : (*audio_set_conf).confs) {
+    LOG_INFO("Looking for requirements: %s - %s", audio_set_conf->name.c_str(),
+             (ent.direction == 1 ? "snk" : "src"));
+    auto pac = leAudioDevice->GetCodecConfigurationSupportedPac(ent.direction,
+                                                                ent.codec);
+    if (pac != nullptr) {
+      LOG_INFO("Configuration is supported by device %s",
+               leAudioDevice->address_.ToString().c_str());
+      return true;
+    }
+  }
+
+  LOG_INFO("Configuration is NOT supported by device %s",
+           leAudioDevice->address_.ToString().c_str());
+  return false;
+}
+
 const set_configurations::AudioSetConfiguration*
 LeAudioDeviceGroup::FindFirstSupportedConfiguration(
     LeAudioContextType context_type) {
@@ -1259,25 +1941,28 @@
 /* This method should choose aproperiate ASEs to be active and set a cached
  * configuration for codec and qos.
  */
-bool LeAudioDeviceGroup::Configure(LeAudioContextType context_type, int ccid) {
+bool LeAudioDeviceGroup::Configure(LeAudioContextType context_type,
+                                   AudioContexts metadata_context_type,
+                                   std::vector<uint8_t> ccid_list) {
   const set_configurations::AudioSetConfiguration* conf =
-      active_context_to_configuration_map[context_type];
-
-  DLOG(INFO) << __func__;
+      available_context_to_configuration_map[context_type];
 
   if (!conf) {
-    LOG(ERROR) << __func__ << ", requested context type: "
-               << loghex(static_cast<uint16_t>(context_type))
-               << ", is in mismatch with cached active contexts";
+    LOG_ERROR(
+        ", requested context type: %s , is in mismatch with cached available "
+        "contexts ",
+        bluetooth::common::ToString(context_type).c_str());
     return false;
   }
 
-  DLOG(INFO) << __func__ << " setting context type: " << int(context_type);
+  LOG_DEBUG(" setting context type: %s",
+            bluetooth::common::ToString(context_type).c_str());
 
-  if (!ConfigureAses(conf, context_type, ccid)) {
-    LOG(ERROR) << __func__ << ", requested pick ASE config context type: "
-               << loghex(static_cast<uint16_t>(context_type))
-               << ", is in mismatch with cached active contexts";
+  if (!ConfigureAses(conf, context_type, metadata_context_type, ccid_list)) {
+    LOG_ERROR(
+        ", requested context type: %s , is in mismatch with cached available "
+        "contexts",
+        bluetooth::common::ToString(context_type).c_str());
     return false;
   }
 
@@ -1289,56 +1974,119 @@
 }
 
 LeAudioDeviceGroup::~LeAudioDeviceGroup(void) { this->Cleanup(); }
-void LeAudioDeviceGroup::Dump(int fd) {
+
+void LeAudioDeviceGroup::PrintDebugState(void) {
+  auto* active_conf = GetActiveConfiguration();
+  std::stringstream debug_str;
+
+  debug_str << "\n Groupd id: " << group_id_
+            << ", state: " << bluetooth::common::ToString(GetState())
+            << ", target state: "
+            << bluetooth::common::ToString(GetTargetState())
+            << ", cig state: " << bluetooth::common::ToString(cig_state_)
+            << ", \n group available contexts: "
+            << bluetooth::common::ToString(GetAvailableContexts())
+            << ", \n configuration context type: "
+            << bluetooth::common::ToString(GetConfigurationContextType())
+            << ", \n active configuration name: "
+            << (active_conf ? active_conf->name : " not set");
+
+  if (cises_.size() > 0) {
+    LOG_INFO("\n Allocated CISes: %d", static_cast<int>(cises_.size()));
+    for (auto cis : cises_) {
+      LOG_INFO("\n cis id: %d, type: %d, conn_handle %d, addr: %s", cis.id,
+               cis.type, cis.conn_handle, cis.addr.ToString().c_str());
+    }
+  }
+
+  if (GetFirstActiveDevice() != nullptr) {
+    uint32_t sink_delay = 0;
+    uint32_t source_delay = 0;
+    GetPresentationDelay(&sink_delay, le_audio::types::kLeAudioDirectionSink);
+    GetPresentationDelay(&source_delay,
+                         le_audio::types::kLeAudioDirectionSource);
+    auto phy_mtos = GetPhyBitmask(le_audio::types::kLeAudioDirectionSink);
+    auto phy_stom = GetPhyBitmask(le_audio::types::kLeAudioDirectionSource);
+    auto max_transport_latency_mtos = GetMaxTransportLatencyMtos();
+    auto max_transport_latency_stom = GetMaxTransportLatencyStom();
+    auto sdu_mts = GetSduInterval(le_audio::types::kLeAudioDirectionSink);
+    auto sdu_stom = GetSduInterval(le_audio::types::kLeAudioDirectionSource);
+
+    debug_str << "\n resentation_delay for sink (speaker): " << +sink_delay
+              << " us, presentation_delay for source (microphone): "
+              << +source_delay << "us, \n MtoS transport latency:  "
+              << +max_transport_latency_mtos
+              << ", StoM transport latency: " << +max_transport_latency_stom
+              << ", \n MtoS Phy: " << loghex(phy_mtos)
+              << ", MtoS sdu: " << loghex(phy_stom)
+              << " \n MtoS sdu: " << +sdu_mts << ", StoM sdu: " << +sdu_stom;
+  }
+
+  LOG_INFO("%s", debug_str.str().c_str());
+
+  for (const auto& device_iter : leAudioDevices_) {
+    device_iter.lock()->PrintDebugState();
+  }
+}
+
+void LeAudioDeviceGroup::Dump(int fd, int active_group_id) {
+  bool is_active = (group_id_ == active_group_id);
   std::stringstream stream;
   auto* active_conf = GetActiveConfiguration();
 
-  stream << "    == Group id: " << group_id_ << " == \n"
-         << "      state: " << GetState() << "\n"
-         << "      target state: " << GetTargetState() << "\n"
-         << "      cig state: " << cig_state_ << "\n"
-         << "      number of devices: " << Size() << "\n"
-         << "      number of connected devices: " << NumOfConnected() << "\n"
-         << "      active context types: "
-         << loghex(GetActiveContexts().to_ulong()) << "\n"
-         << "      current context type: "
-         << static_cast<int>(GetCurrentContextType()) << "\n"
-         << "      active stream configuration name: "
+  stream << "\n    == Group id: " << group_id_
+         << " == " << (is_active ? ",\tActive\n" : ",\tInactive\n")
+         << "      state: " << GetState()
+         << ",\ttarget state: " << GetTargetState()
+         << ",\tcig state: " << cig_state_ << "\n"
+         << "      group available contexts: " << GetAvailableContexts()
+         << "      configuration context type: "
+         << bluetooth::common::ToString(GetConfigurationContextType()).c_str()
+         << "      active configuration name: "
          << (active_conf ? active_conf->name : " not set") << "\n"
-         << "    Last used stream configuration: \n"
-         << "      pending_configuration: " << stream_conf.pending_configuration
+         << "      stream configuration: "
+         << (stream_conf.conf != nullptr ? stream_conf.conf->name : " unknown ")
          << "\n"
-         << "      codec id : " << +(stream_conf.id.coding_format) << "\n"
-         << "      name: "
-         << (stream_conf.conf != nullptr ? stream_conf.conf->name : " null ")
+         << "      codec id: " << +(stream_conf.id.coding_format)
+         << ",\tpending_configuration: " << stream_conf.pending_configuration
          << "\n"
-         << "      number of sinks in the configuration "
-         << stream_conf.sink_num_of_devices << "\n"
-         << "      number of sink_streams connected: "
-         << stream_conf.sink_streams.size() << "\n"
-         << "      number of sources in the configuration "
-         << stream_conf.source_num_of_devices << "\n"
-         << "      number of source_streams connected: "
-         << stream_conf.source_streams.size() << "\n";
+         << "      num of devices(connected): " << Size() << "("
+         << NumOfConnected() << ")\n"
+         << ",     num of sinks(connected): " << stream_conf.sink_num_of_devices
+         << "(" << stream_conf.sink_streams.size() << ")\n"
+         << "      num of sources(connected): "
+         << stream_conf.source_num_of_devices << "("
+         << stream_conf.source_streams.size() << ")\n"
+         << "      allocated CISes: " << static_cast<int>(cises_.size());
+
+  if (cises_.size() > 0) {
+    stream << "\n\t == CISes == ";
+    for (auto cis : cises_) {
+      stream << "\n\t cis id: " << static_cast<int>(cis.id)
+             << ",\ttype: " << static_cast<int>(cis.type)
+             << ",\tconn_handle: " << static_cast<int>(cis.conn_handle)
+             << ",\taddr: " << cis.addr;
+    }
+    stream << "\n\t ====";
+  }
 
   if (GetFirstActiveDevice() != nullptr) {
     uint32_t sink_delay;
-    stream << "      presentation_delay for sink (speaker): ";
-    if (GetPresentationDelay(&sink_delay, le_audio::types::kLeAudioDirectionSink)) {
-      stream << sink_delay << " us";
+    if (GetPresentationDelay(&sink_delay,
+                             le_audio::types::kLeAudioDirectionSink)) {
+      stream << "\n      presentation_delay for sink (speaker): " << sink_delay
+             << " us";
     }
-    stream << "\n      presentation_delay for source (microphone): ";
+
     uint32_t source_delay;
-    if (GetPresentationDelay(&source_delay, le_audio::types::kLeAudioDirectionSource)) {
-      stream << source_delay << " us";
+    if (GetPresentationDelay(&source_delay,
+                             le_audio::types::kLeAudioDirectionSource)) {
+      stream << "\n      presentation_delay for source (microphone): "
+             << source_delay << " us";
     }
-    stream << "\n";
-  } else {
-    stream << "      presentation_delay for sink (speaker):\n"
-           << "      presentation_delay for source (microphone): \n";
   }
 
-  stream << "      === devices: ===\n";
+  stream << "\n      == devices: ==";
 
   dprintf(fd, "%s", stream.str().c_str());
 
@@ -1348,6 +2096,17 @@
 }
 
 /* LeAudioDevice Class methods implementation */
+void LeAudioDevice::SetConnectionState(DeviceConnectState state) {
+  LOG_DEBUG(" %s --> %s",
+            bluetooth::common::ToString(connection_state_).c_str(),
+            bluetooth::common::ToString(state).c_str());
+  connection_state_ = state;
+}
+
+DeviceConnectState LeAudioDevice::GetConnectionState(void) {
+  return connection_state_;
+}
+
 void LeAudioDevice::ClearPACs(void) {
   snk_pacs_.clear();
   src_pacs_.clear();
@@ -1390,8 +2149,14 @@
   return (iter == ases_.end()) ? nullptr : &(*iter);
 }
 
-struct ase* LeAudioDevice::GetFirstInactiveAseWithState(uint8_t direction,
-                                                        AseState state) {
+int LeAudioDevice::GetAseCount(uint8_t direction) {
+  return std::count_if(ases_.begin(), ases_.end(), [direction](const auto& a) {
+    return a.direction == direction;
+  });
+}
+
+struct ase* LeAudioDevice::GetFirstAseWithState(uint8_t direction,
+                                                AseState state) {
   auto iter = std::find_if(
       ases_.begin(), ases_.end(), [direction, state](const auto& ase) {
         return ((ase.direction == direction) && (ase.state == state));
@@ -1433,6 +2198,29 @@
   return (iter == ases_.end()) ? nullptr : &(*iter);
 }
 
+struct ase* LeAudioDevice::GetNextActiveAseWithDifferentDirection(
+    struct ase* base_ase) {
+  auto iter = std::find_if(ases_.begin(), ases_.end(),
+                           [&base_ase](auto& ase) { return base_ase == &ase; });
+
+  /* Invalid ase given */
+  if (std::distance(iter, ases_.end()) < 1) {
+    LOG_DEBUG("ASE %d does not use bidirectional CIS", base_ase->id);
+    return nullptr;
+  }
+
+  iter =
+      std::find_if(std::next(iter, 1), ases_.end(), [&iter](const auto& ase) {
+        return ase.active && iter->direction != ase.direction;
+      });
+
+  if (iter == ases_.end()) {
+    return nullptr;
+  }
+
+  return &(*iter);
+}
+
 struct ase* LeAudioDevice::GetFirstActiveAseByDataPathState(
     types::AudioStreamDataPathState state) {
   auto iter =
@@ -1496,7 +2284,7 @@
 }
 
 BidirectAsesPair LeAudioDevice::GetAsesByCisConnHdl(uint16_t conn_hdl) {
-  BidirectAsesPair ases;
+  BidirectAsesPair ases = {nullptr, nullptr};
 
   for (auto& ase : ases_) {
     if (ase.cis_conn_hdl == conn_hdl) {
@@ -1512,7 +2300,7 @@
 }
 
 BidirectAsesPair LeAudioDevice::GetAsesByCisId(uint8_t cis_id) {
-  BidirectAsesPair ases;
+  BidirectAsesPair ases = {nullptr, nullptr};
 
   for (auto& ase : ases_) {
     if (ase.cis_id == cis_id) {
@@ -1596,6 +2384,11 @@
 }
 
 bool LeAudioDevice::HaveAllActiveAsesCisEst(void) {
+  if (ases_.empty()) {
+    LOG_WARN("No ases for device %s", address_.ToString().c_str());
+    return false;
+  }
+
   auto iter = std::find_if(ases_.begin(), ases_.end(), [](const auto& ase) {
     return ase.active &&
            (ase.data_path_state != AudioStreamDataPathState::CIS_ESTABLISHED);
@@ -1604,13 +2397,15 @@
   return iter == ases_.end();
 }
 
-bool LeAudioDevice::HaveAllAsesCisDisc(void) {
-  auto iter = std::find_if(ases_.begin(), ases_.end(), [](const auto& ase) {
-    return ase.active &&
-           (ase.data_path_state != AudioStreamDataPathState::CIS_ASSIGNED);
-  });
-
-  return iter == ases_.end();
+bool LeAudioDevice::HaveAnyCisConnected(void) {
+  /* Pending and Disconnecting is considered as connected in this function */
+  for (auto const ase : ases_) {
+    if (ase.data_path_state != AudioStreamDataPathState::CIS_ASSIGNED &&
+        ase.data_path_state != AudioStreamDataPathState::IDLE) {
+      return true;
+    }
+  }
+  return false;
 }
 
 bool LeAudioDevice::HasCisId(uint8_t id) {
@@ -1671,6 +2466,11 @@
       auto supported_channel_count_ltv = pac.codec_spec_caps.Find(
           codec_spec_caps::kLeAudioCodecLC3TypeAudioChannelCounts);
 
+      if (supported_channel_count_ltv == std::nullopt ||
+          supported_channel_count_ltv->size() == 0L) {
+        return 1;
+      }
+
       return VEC_UINT8_TO_UINT8(supported_channel_count_ltv.value());
     };
   }
@@ -1721,25 +2521,79 @@
 
 void LeAudioDevice::SetSupportedContexts(AudioContexts snk_contexts,
                                          AudioContexts src_contexts) {
-  supp_snk_context_ = snk_contexts;
-  supp_src_context_ = src_contexts;
+  supp_contexts_.sink = snk_contexts;
+  supp_contexts_.source = src_contexts;
+}
+
+void LeAudioDevice::PrintDebugState(void) {
+  std::stringstream debug_str;
+
+  debug_str << " address: " << address_ << ", "
+            << bluetooth::common::ToString(connection_state_)
+            << ", conn_id: " << +conn_id_ << ", mtu: " << +mtu_
+            << ", num_of_ase: " << static_cast<int>(ases_.size());
+
+  if (ases_.size() > 0) {
+    debug_str << "\n  == ASEs == ";
+    for (auto& ase : ases_) {
+      debug_str << "\n  id: " << +ase.id << ", active: " << ase.active
+                << ", dir: "
+                << (ase.direction == types::kLeAudioDirectionSink ? "sink"
+                                                                  : "source")
+                << ", cis_id: " << +ase.cis_id
+                << ", cis_handle: " << +ase.cis_conn_hdl << ", state: "
+                << bluetooth::common::ToString(ase.data_path_state)
+                << "\n ase max_latency: " << +ase.max_transport_latency
+                << ", rtn: " << +ase.retrans_nb
+                << ", max_sdu: " << +ase.max_sdu_size
+                << ", target latency: " << +ase.target_latency;
+    }
+  }
+
+  LOG_INFO("%s", debug_str.str().c_str());
 }
 
 void LeAudioDevice::Dump(int fd) {
+  uint16_t acl_handle = BTM_GetHCIConnHandle(address_, BT_TRANSPORT_LE);
+  std::string location = "unknown location";
+
+  if (snk_audio_locations_.to_ulong() &
+      codec_spec_conf::kLeAudioLocationAnyLeft) {
+    std::string location_left = "left";
+    location.swap(location_left);
+  } else if (snk_audio_locations_.to_ulong() &
+             codec_spec_conf::kLeAudioLocationAnyRight) {
+    std::string location_right = "right";
+    location.swap(location_right);
+  }
+
   std::stringstream stream;
-  stream << std::boolalpha;
-  stream << "\taddress: " << address_
-         << (conn_id_ == GATT_INVALID_CONN_ID ? "\n\t  Not connected "
-                                              : "\n\t  Connected conn_id =")
+  stream << "\n\taddress: " << address_ << ": " << connection_state_ << ": "
          << (conn_id_ == GATT_INVALID_CONN_ID ? "" : std::to_string(conn_id_))
-         << "\n\t  set member: " << csis_member_
-         << "\n\t  known_service_handles_: " << known_service_handles_
-         << "\n\t  notify_connected_after_read_: " << notify_connected_after_read_
-         << "\n\t  removing_device_: " << removing_device_
-         << "\n\t  first_connection_: " << first_connection_
-         << "\n\t  encrypted_: " << encrypted_
-         << "\n\t  connecting_actively_: " << connecting_actively_
-         << "\n";
+         << ", acl_handle: " << std::to_string(acl_handle) << ", " << location
+         << ",\t" << (encrypted_ ? "Encrypted" : "Unecrypted")
+         << ",mtu: " << std::to_string(mtu_)
+         << "\n\tnumber of ases_: " << static_cast<int>(ases_.size());
+
+  if (ases_.size() > 0) {
+    stream << "\n\t== ASEs == \n\t";
+    stream
+        << "id  active dir     cis_id  cis_handle  sdu  latency rtn  state";
+    for (auto& ase : ases_) {
+      stream << std::setfill('\xA0') << "\n\t" << std::left << std::setw(4)
+             << static_cast<int>(ase.id) << std::left << std::setw(7)
+             << (ase.active ? "true" : "false") << std::left << std::setw(8)
+             << (ase.direction == types::kLeAudioDirectionSink ? "sink"
+                                                               : "source")
+             << std::left << std::setw(8) << static_cast<int>(ase.cis_id)
+             << std::left << std::setw(12) << ase.cis_conn_hdl << std::left
+             << std::setw(5) << ase.max_sdu_size << std::left << std::setw(8)
+             << ase.max_transport_latency << std::left << std::setw(5)
+             << static_cast<int>(ase.retrans_nb) << std::left << std::setw(12)
+             << bluetooth::common::ToString(ase.data_path_state);
+    }
+  }
+  stream << "\n\t====";
 
   dprintf(fd, "%s", stream.str().c_str());
 }
@@ -1755,8 +2609,14 @@
   }
 }
 
-AudioContexts LeAudioDevice::GetAvailableContexts(void) {
-  return avail_snk_contexts_ | avail_src_contexts_;
+types::AudioContexts LeAudioDevice::GetAvailableContexts(int direction) {
+  if (direction ==
+      (types::kLeAudioDirectionSink | types::kLeAudioDirectionSource)) {
+    return get_bidirectional(avail_contexts_);
+  } else if (direction == types::kLeAudioDirectionSink) {
+    return avail_contexts_.sink;
+  }
+  return avail_contexts_.source;
 }
 
 /* Returns XOR of updated sink and source bitset context types */
@@ -1764,67 +2624,80 @@
                                                   AudioContexts src_contexts) {
   AudioContexts updated_contexts;
 
-  updated_contexts = snk_contexts ^ avail_snk_contexts_;
-  updated_contexts |= src_contexts ^ avail_src_contexts_;
+  updated_contexts = snk_contexts ^ avail_contexts_.sink;
+  updated_contexts |= src_contexts ^ avail_contexts_.source;
 
   LOG_DEBUG(
-      "\n\t avail_snk_contexts_: %s \n\t avail_src_contexts_: %s  \n\t "
+      "\n\t avail_contexts_.sink: %s \n\t avail_contexts_.source: %s  \n\t "
       "snk_contexts: %s \n\t src_contexts: %s \n\t updated_contexts: %s",
-      avail_snk_contexts_.to_string().c_str(),
-      avail_src_contexts_.to_string().c_str(), snk_contexts.to_string().c_str(),
-      src_contexts.to_string().c_str(), updated_contexts.to_string().c_str());
+      avail_contexts_.sink.to_string().c_str(),
+      avail_contexts_.source.to_string().c_str(),
+      snk_contexts.to_string().c_str(), src_contexts.to_string().c_str(),
+      updated_contexts.to_string().c_str());
 
-  avail_snk_contexts_ = snk_contexts;
-  avail_src_contexts_ = src_contexts;
+  avail_contexts_.sink = snk_contexts;
+  avail_contexts_.source = src_contexts;
 
   return updated_contexts;
 }
 
-void LeAudioDevice::ActivateConfiguredAses(LeAudioContextType context_type) {
+bool LeAudioDevice::ActivateConfiguredAses(LeAudioContextType context_type) {
   if (conn_id_ == GATT_INVALID_CONN_ID) {
-    LOG_DEBUG(" Device %s is not connected ", address_.ToString().c_str());
-    return;
+    LOG_WARN(" Device %s is not connected ", address_.ToString().c_str());
+    return false;
   }
 
-  LOG_DEBUG(" Configuring device %s", address_.ToString().c_str());
+  bool ret = false;
+
+  LOG_INFO(" Configuring device %s", address_.ToString().c_str());
   for (auto& ase : ases_) {
-    if (!ase.active &&
-        ase.state == AseState::BTA_LE_AUDIO_ASE_STATE_CODEC_CONFIGURED &&
+    if (ase.state == AseState::BTA_LE_AUDIO_ASE_STATE_CODEC_CONFIGURED &&
         ase.configured_for_context_type == context_type) {
-      LOG_DEBUG(" Ase id %d, cis id %d activated.", ase.id, ase.cis_id);
+      LOG_INFO(
+          " conn_id: %d, ase id %d, cis id %d, cis_handle 0x%04x is activated.",
+          conn_id_, ase.id, ase.cis_id, ase.cis_conn_hdl);
       ase.active = true;
+      ret = true;
     }
   }
+
+  return ret;
 }
 
 void LeAudioDevice::DeactivateAllAses(void) {
-  /* Just clear states and keep previous configuration for use
-   * in case device will get reconnected
-   */
   for (auto& ase : ases_) {
-    if (ase.active) {
-      ase.state = AseState::BTA_LE_AUDIO_ASE_STATE_IDLE;
-      ase.data_path_state = AudioStreamDataPathState::IDLE;
-      ase.active = false;
+    if (ase.active == false &&
+        ase.data_path_state != AudioStreamDataPathState::IDLE) {
+      LOG_WARN(
+          " %s, ase_id: %d, ase.cis_id: %d, cis_handle: 0x%02x, "
+          "ase.data_path=%s",
+          address_.ToString().c_str(), ase.id, ase.cis_id, ase.cis_conn_hdl,
+          bluetooth::common::ToString(ase.data_path_state).c_str());
     }
+    ase.state = AseState::BTA_LE_AUDIO_ASE_STATE_IDLE;
+    ase.data_path_state = AudioStreamDataPathState::IDLE;
+    ase.active = false;
+    ase.cis_id = le_audio::kInvalidCisId;
+    ase.cis_conn_hdl = 0;
   }
 }
 
-std::vector<uint8_t> LeAudioDevice::GetMetadata(LeAudioContextType context_type,
-                                                int ccid) {
+std::vector<uint8_t> LeAudioDevice::GetMetadata(
+    AudioContexts context_type, const std::vector<uint8_t>& ccid_list) {
   std::vector<uint8_t> metadata;
 
   AppendMetadataLtvEntryForStreamingContext(metadata, context_type);
-  AppendMetadataLtvEntryForCcidList(metadata, ccid);
+  AppendMetadataLtvEntryForCcidList(metadata, ccid_list);
 
   return std::move(metadata);
 }
 
-bool LeAudioDevice::IsMetadataChanged(types::LeAudioContextType context_type,
-                                      int ccid) {
+bool LeAudioDevice::IsMetadataChanged(AudioContexts context_type,
+                                      const std::vector<uint8_t>& ccid_list) {
   for (auto* ase = this->GetFirstActiveAse(); ase;
        ase = this->GetNextActiveAse(ase)) {
-    if (this->GetMetadata(context_type, ccid) != ase->metadata) return true;
+    if (this->GetMetadata(context_type, ccid_list) != ase->metadata)
+      return true;
   }
 
   return false;
@@ -1871,9 +2744,9 @@
   groups_.clear();
 }
 
-void LeAudioDeviceGroups::Dump(int fd) {
+void LeAudioDeviceGroups::Dump(int fd, int active_group_id) {
   for (auto& g : groups_) {
-    g->Dump(fd);
+    g->Dump(fd, active_group_id);
   }
 }
 
@@ -1901,7 +2774,7 @@
 }
 
 /* LeAudioDevices Class methods implementation */
-void LeAudioDevices::Add(const RawAddress& address, bool first_connection,
+void LeAudioDevices::Add(const RawAddress& address, DeviceConnectState state,
                          int group_id) {
   auto device = FindByAddress(address);
   if (device != nullptr) {
@@ -1911,7 +2784,7 @@
   }
 
   leAudioDevices_.emplace_back(
-      std::make_shared<LeAudioDevice>(address, first_connection, group_id));
+      std::make_shared<LeAudioDevice>(address, state, group_id));
 }
 
 void LeAudioDevices::Remove(const RawAddress& address) {
@@ -1956,13 +2829,18 @@
   return (iter == leAudioDevices_.end()) ? nullptr : iter->get();
 }
 
-LeAudioDevice* LeAudioDevices::FindByCisConnHdl(const uint16_t conn_hdl) {
+LeAudioDevice* LeAudioDevices::FindByCisConnHdl(uint8_t cig_id,
+                                                uint16_t conn_hdl) {
   auto iter = std::find_if(leAudioDevices_.begin(), leAudioDevices_.end(),
-                           [&conn_hdl](auto& d) {
+                           [&conn_hdl, &cig_id](auto& d) {
                              LeAudioDevice* dev;
                              BidirectAsesPair ases;
 
                              dev = d.get();
+                             if (dev->group_id_ != cig_id) {
+                               return false;
+                             }
+
                              ases = dev->GetAsesByCisConnHdl(conn_hdl);
                              if (ases.sink || ases.source)
                                return true;
@@ -1975,6 +2853,42 @@
   return iter->get();
 }
 
+void LeAudioDevices::SetInitialGroupAutoconnectState(
+    int group_id, int gatt_if, tBTM_BLE_CONN_TYPE reconnection_mode,
+    bool current_dev_autoconnect_flag) {
+  if (!current_dev_autoconnect_flag) {
+    /* If current device autoconnect flag is false, check if there is other
+     * device in the group which is in autoconnect mode.
+     * If yes, assume whole group is in autoconnect.
+     */
+    auto iter = std::find_if(leAudioDevices_.begin(), leAudioDevices_.end(),
+                             [&group_id](auto& d) {
+                               LeAudioDevice* dev;
+                               dev = d.get();
+                               if (dev->group_id_ != group_id) {
+                                 return false;
+                               }
+                               return dev->autoconnect_flag_;
+                             });
+
+    current_dev_autoconnect_flag = !(iter == leAudioDevices_.end());
+  }
+
+  if (!current_dev_autoconnect_flag) {
+    return;
+  }
+
+  for (auto dev : leAudioDevices_) {
+    if ((dev->group_id_ == group_id) &&
+        (dev->GetConnectionState() == DeviceConnectState::DISCONNECTED)) {
+      dev->SetConnectionState(DeviceConnectState::CONNECTING_AUTOCONNECT);
+      dev->autoconnect_flag_ = true;
+      btif_storage_set_leaudio_autoconnect(dev->address_, true);
+      BTA_GATTC_Open(gatt_if, dev->address_, reconnection_mode, false);
+    }
+  }
+}
+
 size_t LeAudioDevices::Size() { return (leAudioDevices_.size()); }
 
 void LeAudioDevices::Dump(int fd, int group_id) {
@@ -1985,9 +2899,20 @@
   }
 }
 
-void LeAudioDevices::Cleanup(void) {
+void LeAudioDevices::Cleanup(tGATT_IF client_if) {
   for (auto const& device : leAudioDevices_) {
-    device->DisconnectAcl();
+    auto connection_state = device->GetConnectionState();
+    if (connection_state == DeviceConnectState::DISCONNECTED) {
+      continue;
+    }
+
+    if (connection_state == DeviceConnectState::CONNECTING_AUTOCONNECT) {
+      BTA_GATTC_CancelOpen(client_if, device->address_, false);
+    } else {
+      BtaGattQueue::Clean(device->conn_id_);
+      BTA_GATTC_Close(device->conn_id_);
+      device->DisconnectAcl();
+    }
   }
   leAudioDevices_.clear();
 }
diff --git a/system/bta/le_audio/devices.h b/system/bta/le_audio/devices.h
index 60881d0..d9f4900 100644
--- a/system/bta/le_audio/devices.h
+++ b/system/bta/le_audio/devices.h
@@ -23,16 +23,46 @@
 #include <tuple>
 #include <vector>
 
+#include "audio_hal_client/audio_hal_client.h"
 #include "bt_types.h"
 #include "bta_groups.h"
 #include "btm_iso_api_types.h"
-#include "client_audio.h"
 #include "gatt_api.h"
 #include "le_audio_types.h"
 #include "osi/include/alarm.h"
+#include "osi/include/properties.h"
 #include "raw_address.h"
 
 namespace le_audio {
+
+/* Enums */
+enum class DeviceConnectState : uint8_t {
+  /* Initial state */
+  DISCONNECTED,
+  /* When ACL connected, encrypted, CCC registered and initial characteristics
+     read is completed */
+  CONNECTED,
+  /* Used when device is unbonding (RemoveDevice() API is called) */
+  REMOVING,
+  /* Disconnecting */
+  DISCONNECTING,
+  /* Device will be removed after scheduled action is finished: One of such
+   * action is taking Stream to IDLE
+   */
+  PENDING_REMOVAL,
+  /* 2 states below are used when user creates connection. Connect API is
+     called. */
+  CONNECTING_BY_USER,
+  /* Always used after CONNECTING_BY_USER */
+  CONNECTED_BY_USER_GETTING_READY,
+  /* 2 states are used when autoconnect was used for the connection.*/
+  CONNECTING_AUTOCONNECT,
+  /* Always used after CONNECTING_AUTOCONNECT */
+  CONNECTED_AUTOCONNECT_GETTING_READY,
+};
+
+std::ostream& operator<<(std::ostream& os, const DeviceConnectState& state);
+
 /* Class definitions */
 
 /* LeAudioDevice class represents GATT server device with ASCS, PAC services as
@@ -49,16 +79,13 @@
  public:
   RawAddress address_;
 
+  DeviceConnectState connection_state_;
   bool known_service_handles_;
   bool notify_connected_after_read_;
-  bool removing_device_;
-
-  /* we are making active attempt to connect to this device, 'direct connect'.
-   * This is true only during initial phase of first connection. */
-  bool first_connection_;
-  bool connecting_actively_;
   bool closing_stream_for_disconnection_;
+  bool autoconnect_flag_;
   uint16_t conn_id_;
+  uint16_t mtu_;
   bool encrypted_;
   int group_id_;
   bool csis_member_;
@@ -82,16 +109,16 @@
   alarm_t* link_quality_timer;
   uint16_t link_quality_timer_data;
 
-  LeAudioDevice(const RawAddress& address_, bool first_connection,
+  LeAudioDevice(const RawAddress& address_, DeviceConnectState state,
                 int group_id = bluetooth::groups::kGroupUnknown)
       : address_(address_),
+        connection_state_(state),
         known_service_handles_(false),
         notify_connected_after_read_(false),
-        removing_device_(false),
-        first_connection_(first_connection),
-        connecting_actively_(first_connection),
         closing_stream_for_disconnection_(false),
+        autoconnect_flag_(false),
         conn_id_(GATT_INVALID_CONN_ID),
+        mtu_(0),
         encrypted_(false),
         group_id_(group_id),
         csis_member_(false),
@@ -99,20 +126,25 @@
         link_quality_timer(nullptr) {}
   ~LeAudioDevice(void);
 
+  void SetConnectionState(DeviceConnectState state);
+  DeviceConnectState GetConnectionState(void);
   void ClearPACs(void);
   void RegisterPACs(std::vector<struct types::acs_ac_record>* apr_db,
                     std::vector<struct types::acs_ac_record>* apr);
   struct types::ase* GetAseByValHandle(uint16_t val_hdl);
+  int GetAseCount(uint8_t direction);
   struct types::ase* GetFirstActiveAse(void);
   struct types::ase* GetFirstActiveAseByDirection(uint8_t direction);
   struct types::ase* GetNextActiveAseWithSameDirection(
       struct types::ase* base_ase);
+  struct types::ase* GetNextActiveAseWithDifferentDirection(
+      struct types::ase* base_ase);
   struct types::ase* GetFirstActiveAseByDataPathState(
       types::AudioStreamDataPathState state);
   struct types::ase* GetFirstInactiveAse(uint8_t direction,
                                          bool reconnect = false);
-  struct types::ase* GetFirstInactiveAseWithState(uint8_t direction,
-                                                  types::AseState state);
+  struct types::ase* GetFirstAseWithState(uint8_t direction,
+                                          types::AseState state);
   struct types::ase* GetNextActiveAse(struct types::ase* ase);
   struct types::ase* GetAseToMatchBidirectionCis(struct types::ase* ase);
   types::BidirectAsesPair GetAsesByCisConnHdl(uint16_t conn_hdl);
@@ -123,7 +155,7 @@
   bool IsReadyToCreateStream(void);
   bool IsReadyToSuspendStream(void);
   bool HaveAllActiveAsesCisEst(void);
-  bool HaveAllAsesCisDisc(void);
+  bool HaveAnyCisConnected(void);
   bool HasCisId(uint8_t id);
   uint8_t GetMatchingBidirectionCisId(const struct types::ase* base_ase);
   const struct types::acs_ac_record* GetCodecConfigurationSupportedPac(
@@ -136,25 +168,30 @@
                      uint8_t* number_of_already_active_group_ase,
                      types::AudioLocations& group_snk_audio_locations,
                      types::AudioLocations& group_src_audio_locations,
-                     bool reconnect = false, int ccid = -1);
+                     bool reconnect, types::AudioContexts metadata_context_type,
+                     const std::vector<uint8_t>& ccid_list);
   void SetSupportedContexts(types::AudioContexts snk_contexts,
                             types::AudioContexts src_contexts);
-  types::AudioContexts GetAvailableContexts(void);
+  types::AudioContexts GetAvailableContexts(
+      int direction = (types::kLeAudioDirectionSink |
+                       types::kLeAudioDirectionSource));
   types::AudioContexts SetAvailableContexts(types::AudioContexts snk_cont_val,
                                             types::AudioContexts src_cont_val);
   void DeactivateAllAses(void);
-  void ActivateConfiguredAses(types::LeAudioContextType context_type);
+  bool ActivateConfiguredAses(types::LeAudioContextType context_type);
+
+  void PrintDebugState(void);
   void Dump(int fd);
+
   void DisconnectAcl(void);
-  std::vector<uint8_t> GetMetadata(types::LeAudioContextType context_type,
-                                   int ccid);
-  bool IsMetadataChanged(types::LeAudioContextType context_type, int ccid);
+  std::vector<uint8_t> GetMetadata(types::AudioContexts context_type,
+                                   const std::vector<uint8_t>& ccid_list);
+  bool IsMetadataChanged(types::AudioContexts context_type,
+                         const std::vector<uint8_t>& ccid_list);
 
  private:
-  types::AudioContexts avail_snk_contexts_;
-  types::AudioContexts avail_src_contexts_;
-  types::AudioContexts supp_snk_context_;
-  types::AudioContexts supp_src_context_;
+  types::BidirectionalPair<types::AudioContexts> avail_contexts_;
+  types::BidirectionalPair<types::AudioContexts> supp_contexts_;
 };
 
 /* LeAudioDevices class represents a wraper helper over all devices in le audio
@@ -163,16 +200,19 @@
  */
 class LeAudioDevices {
  public:
-  void Add(const RawAddress& address, bool first_connection,
+  void Add(const RawAddress& address, le_audio::DeviceConnectState state,
            int group_id = bluetooth::groups::kGroupUnknown);
   void Remove(const RawAddress& address);
   LeAudioDevice* FindByAddress(const RawAddress& address);
   std::shared_ptr<LeAudioDevice> GetByAddress(const RawAddress& address);
   LeAudioDevice* FindByConnId(uint16_t conn_id);
-  LeAudioDevice* FindByCisConnHdl(const uint16_t conn_hdl);
+  LeAudioDevice* FindByCisConnHdl(uint8_t cig_id, uint16_t conn_hdl);
+  void SetInitialGroupAutoconnectState(int group_id, int gatt_if,
+                                       tBTM_BLE_CONN_TYPE reconnection_mode,
+                                       bool current_dev_autoconnect_flag);
   size_t Size(void);
   void Dump(int fd, int group_id);
-  void Cleanup(void);
+  void Cleanup(tGATT_IF client_if);
 
  private:
   std::vector<std::shared_ptr<LeAudioDevice>> leAudioDevices_;
@@ -196,6 +236,7 @@
   types::AudioLocations snk_audio_locations_;
   types::AudioLocations src_audio_locations_;
 
+  std::vector<struct types::cis> cises_;
   explicit LeAudioDeviceGroup(const int group_id)
       : group_id_(group_id),
         cig_state_(types::CigState::NONE),
@@ -203,11 +244,13 @@
         audio_directions_(0),
         transport_latency_mtos_us_(0),
         transport_latency_stom_us_(0),
-        active_context_type_(types::LeAudioContextType::UNINITIALIZED),
-        pending_update_available_contexts_(std::nullopt),
+        configuration_context_type_(types::LeAudioContextType::UNINITIALIZED),
+        metadata_context_type_(types::LeAudioContextType::UNINITIALIZED),
+        group_available_contexts_(types::LeAudioContextType::UNINITIALIZED),
+        pending_group_available_contexts_change_(
+            types::LeAudioContextType::UNINITIALIZED),
         target_state_(types::AseState::BTA_LE_AUDIO_ASE_STATE_IDLE),
-        current_state_(types::AseState::BTA_LE_AUDIO_ASE_STATE_IDLE),
-        context_type_(types::LeAudioContextType::UNINITIALIZED) {}
+        current_state_(types::AseState::BTA_LE_AUDIO_ASE_STATE_IDLE) {}
   ~LeAudioDeviceGroup(void);
 
   void AddNode(const std::shared_ptr<LeAudioDevice>& leAudioDevice);
@@ -217,25 +260,44 @@
   int Size(void);
   int NumOfConnected(
       types::LeAudioContextType context_type = types::LeAudioContextType::RFU);
-  void Activate(types::LeAudioContextType context_type);
+  bool Activate(types::LeAudioContextType context_type);
   void Deactivate(void);
+  types::CigState GetCigState(void);
+  void SetCigState(le_audio::types::CigState state);
+  void CigClearCis(void);
+  void ClearSinksFromConfiguration(void);
+  void ClearSourcesFromConfiguration(void);
   void Cleanup(void);
   LeAudioDevice* GetFirstDevice(void);
   LeAudioDevice* GetFirstDeviceWithActiveContext(
       types::LeAudioContextType context_type);
+  le_audio::types::LeAudioConfigurationStrategy GetGroupStrategy(void);
+  int GetAseCount(uint8_t direction);
   LeAudioDevice* GetNextDevice(LeAudioDevice* leAudioDevice);
   LeAudioDevice* GetNextDeviceWithActiveContext(
       LeAudioDevice* leAudioDevice, types::LeAudioContextType context_type);
   LeAudioDevice* GetFirstActiveDevice(void);
   LeAudioDevice* GetNextActiveDevice(LeAudioDevice* leAudioDevice);
+  LeAudioDevice* GetFirstActiveDeviceByDataPathState(
+      types::AudioStreamDataPathState data_path_state);
+  LeAudioDevice* GetNextActiveDeviceByDataPathState(
+      LeAudioDevice* leAudioDevice,
+      types::AudioStreamDataPathState data_path_state);
   bool IsDeviceInTheGroup(LeAudioDevice* leAudioDevice);
   bool HaveAllActiveDevicesAsesTheSameState(types::AseState state);
   bool IsGroupStreamReady(void);
-  bool HaveAllActiveDevicesCisDisc(void);
+  bool HaveAllCisesDisconnected(void);
   uint8_t GetFirstFreeCisId(void);
-  bool Configure(types::LeAudioContextType context_type, int ccid = 1);
-  bool SetContextType(types::LeAudioContextType context_type);
-  types::LeAudioContextType GetContextType(void);
+  uint8_t GetFirstFreeCisId(types::CisType cis_type);
+  void CigGenerateCisIds(types::LeAudioContextType context_type);
+  bool CigAssignCisIds(LeAudioDevice* leAudioDevice);
+  void CigAssignCisConnHandles(const std::vector<uint16_t>& conn_handles);
+  void CigAssignCisConnHandlesToAses(LeAudioDevice* leAudioDevice);
+  void CigAssignCisConnHandlesToAses(void);
+  void CigUnassignCis(LeAudioDevice* leAudioDevice);
+  bool Configure(types::LeAudioContextType context_type,
+                 types::AudioContexts metadata_context_type,
+                 std::vector<uint8_t> ccid_list = {});
   uint32_t GetSduInterval(uint8_t direction);
   uint8_t GetSCA(void);
   uint8_t GetPacking(void);
@@ -243,25 +305,30 @@
   uint16_t GetMaxTransportLatencyStom(void);
   uint16_t GetMaxTransportLatencyMtos(void);
   void SetTransportLatency(uint8_t direction, uint32_t transport_latency_us);
+  uint8_t GetRtn(uint8_t direction, uint8_t cis_id);
+  uint16_t GetMaxSduSize(uint8_t direction, uint8_t cis_id);
   uint8_t GetPhyBitmask(uint8_t direction);
   uint8_t GetTargetPhy(uint8_t direction);
   bool GetPresentationDelay(uint32_t* delay, uint8_t direction);
   uint16_t GetRemoteDelay(uint8_t direction);
-  std::optional<types::AudioContexts> UpdateActiveContextsMap(
-      types::AudioContexts contexts);
-  std::optional<types::AudioContexts> UpdateActiveContextsMap(void);
+  bool UpdateAudioContextTypeAvailability(types::AudioContexts contexts);
+  void UpdateAudioContextTypeAvailability(void);
   bool ReloadAudioLocations(void);
   bool ReloadAudioDirections(void);
   const set_configurations::AudioSetConfiguration* GetActiveConfiguration(void);
-  types::LeAudioContextType GetCurrentContextType(void);
   bool IsPendingConfiguration(void);
   void SetPendingConfiguration(void);
-  types::AudioContexts GetActiveContexts(void);
+  void ClearPendingConfiguration(void);
+  bool IsConfigurationSupported(
+      LeAudioDevice* leAudioDevice,
+      const set_configurations::AudioSetConfiguration* audio_set_conf);
   std::optional<LeAudioCodecConfiguration> GetCodecConfigurationByDirection(
-      types::LeAudioContextType group_context_type, uint8_t direction);
+      types::LeAudioContextType group_context_type, uint8_t direction) const;
   bool IsContextSupported(types::LeAudioContextType group_context_type);
-  bool IsMetadataChanged(types::LeAudioContextType group_context_type,
-                         int ccid);
+  bool IsMetadataChanged(types::AudioContexts group_context_type,
+                         const std::vector<uint8_t>& ccid_list);
+  void CreateStreamVectorForOffloader(uint8_t direction);
+  void StreamOffloaderUpdated(uint8_t direction);
 
   inline types::AseState GetState(void) const { return current_state_; }
   void SetState(types::AseState state) {
@@ -277,18 +344,38 @@
     target_state_ = state;
   }
 
-  inline std::optional<types::AudioContexts> GetPendingUpdateAvailableContexts()
-      const {
-    return pending_update_available_contexts_;
+  /* Returns context types for which support was recently added or removed */
+  inline types::AudioContexts GetPendingAvailableContextsChange() const {
+    return pending_group_available_contexts_change_;
   }
-  inline void SetPendingUpdateAvailableContexts(
-      std::optional<types::AudioContexts> audio_contexts) {
-    pending_update_available_contexts_ = audio_contexts;
+
+  /* Set which context types were recently added or removed */
+  inline void SetPendingAvailableContextsChange(
+      types::AudioContexts audio_contexts) {
+    pending_group_available_contexts_change_ = audio_contexts;
+  }
+
+  inline void ClearPendingAvailableContextsChange() {
+    pending_group_available_contexts_change_.clear();
+  }
+
+  inline types::LeAudioContextType GetConfigurationContextType(void) const {
+    return configuration_context_type_;
+  }
+
+  inline types::AudioContexts GetMetadataContexts(void) const {
+    return metadata_context_type_;
+  }
+
+  inline types::AudioContexts GetAvailableContexts(void) {
+    return group_available_contexts_;
   }
 
   bool IsInTransition(void);
-  bool IsReleasing(void);
-  void Dump(int fd);
+  bool IsReleasingOrIdle(void);
+
+  void PrintDebugState(void);
+  void Dump(int fd, int active_group_id);
 
  private:
   uint32_t transport_latency_mtos_us_;
@@ -298,23 +385,39 @@
   FindFirstSupportedConfiguration(types::LeAudioContextType context_type);
   bool ConfigureAses(
       const set_configurations::AudioSetConfiguration* audio_set_conf,
-      types::LeAudioContextType context_type, int ccid = 1);
+      types::LeAudioContextType context_type,
+      types::AudioContexts metadata_context_type,
+      const std::vector<uint8_t>& ccid_list);
   bool IsConfigurationSupported(
       const set_configurations::AudioSetConfiguration* audio_set_configuration,
       types::LeAudioContextType context_type);
   uint32_t GetTransportLatencyUs(uint8_t direction);
 
-  /* Mask and table of currently supported contexts */
-  types::LeAudioContextType active_context_type_;
-  types::AudioContexts active_contexts_mask_;
-  std::optional<types::AudioContexts> pending_update_available_contexts_;
+  /* Current configuration and metadata context types */
+  types::LeAudioContextType configuration_context_type_;
+  types::AudioContexts metadata_context_type_;
+
+  /* Mask of contexts that the whole group can handle at it's current state
+   * It's being updated each time group members connect, disconnect or their
+   * individual available audio contexts are changed.
+   */
+  types::AudioContexts group_available_contexts_;
+
+  /* A temporary mask for bits which were either added or removed when the
+   * group available context type changes. It usually means we should refresh
+   * our group configuration capabilities to clear this.
+   */
+  types::AudioContexts pending_group_available_contexts_change_;
+
+  /* Possible configuration cache - refreshed on each group context availability
+   * change
+   */
   std::map<types::LeAudioContextType,
            const set_configurations::AudioSetConfiguration*>
-      active_context_to_configuration_map;
+      available_context_to_configuration_map;
 
   types::AseState target_state_;
   types::AseState current_state_;
-  types::LeAudioContextType context_type_;
   std::vector<std::weak_ptr<LeAudioDevice>> leAudioDevices_;
 };
 
@@ -331,7 +434,7 @@
   size_t Size();
   bool IsAnyInTransition();
   void Cleanup(void);
-  void Dump(int fd);
+  void Dump(int fd, int active_group_id);
 
  private:
   std::vector<std::unique_ptr<LeAudioDeviceGroup>> groups_;
diff --git a/system/bta/le_audio/devices_test.cc b/system/bta/le_audio/devices_test.cc
index 2cb62d6..a7a3cda 100644
--- a/system/bta/le_audio/devices_test.cc
+++ b/system/bta/le_audio/devices_test.cc
@@ -24,6 +24,8 @@
 #include "le_audio_set_configuration_provider.h"
 #include "le_audio_types.h"
 #include "mock_controller.h"
+#include "mock_csis_client.h"
+#include "os/log.h"
 #include "stack/btm/btm_int_types.h"
 
 tACL_CONN* btm_bda_to_acl(const RawAddress& bda, tBT_TRANSPORT transport) {
@@ -35,12 +37,16 @@
 namespace internal {
 namespace {
 
+using ::le_audio::DeviceConnectState;
 using ::le_audio::LeAudioDevice;
 using ::le_audio::LeAudioDeviceGroup;
 using ::le_audio::LeAudioDevices;
 using ::le_audio::types::AseState;
 using ::le_audio::types::AudioContexts;
 using ::le_audio::types::LeAudioContextType;
+using testing::_;
+using testing::Invoke;
+using testing::Return;
 using testing::Test;
 
 RawAddress GetTestAddress(int index) {
@@ -72,23 +78,23 @@
 TEST_F(LeAudioDevicesTest, test_add) {
   RawAddress test_address_0 = GetTestAddress(0);
   ASSERT_EQ((size_t)0, devices_->Size());
-  devices_->Add(test_address_0, true);
+  devices_->Add(test_address_0, DeviceConnectState::CONNECTING_BY_USER);
   ASSERT_EQ((size_t)1, devices_->Size());
-  devices_->Add(GetTestAddress(1), true, 1);
+  devices_->Add(GetTestAddress(1), DeviceConnectState::CONNECTING_BY_USER, 1);
   ASSERT_EQ((size_t)2, devices_->Size());
-  devices_->Add(test_address_0, true);
+  devices_->Add(test_address_0, DeviceConnectState::CONNECTING_BY_USER);
   ASSERT_EQ((size_t)2, devices_->Size());
-  devices_->Add(GetTestAddress(1), true, 2);
+  devices_->Add(GetTestAddress(1), DeviceConnectState::CONNECTING_BY_USER, 2);
   ASSERT_EQ((size_t)2, devices_->Size());
 }
 
 TEST_F(LeAudioDevicesTest, test_remove) {
   RawAddress test_address_0 = GetTestAddress(0);
-  devices_->Add(test_address_0, true);
+  devices_->Add(test_address_0, DeviceConnectState::CONNECTING_BY_USER);
   RawAddress test_address_1 = GetTestAddress(1);
-  devices_->Add(test_address_1, true);
+  devices_->Add(test_address_1, DeviceConnectState::CONNECTING_BY_USER);
   RawAddress test_address_2 = GetTestAddress(2);
-  devices_->Add(test_address_2, true);
+  devices_->Add(test_address_2, DeviceConnectState::CONNECTING_BY_USER);
   ASSERT_EQ((size_t)3, devices_->Size());
   devices_->Remove(test_address_0);
   ASSERT_EQ((size_t)2, devices_->Size());
@@ -100,11 +106,11 @@
 
 TEST_F(LeAudioDevicesTest, test_find_by_address_success) {
   RawAddress test_address_0 = GetTestAddress(0);
-  devices_->Add(test_address_0, true);
+  devices_->Add(test_address_0, DeviceConnectState::CONNECTING_BY_USER);
   RawAddress test_address_1 = GetTestAddress(1);
-  devices_->Add(test_address_1, false);
+  devices_->Add(test_address_1, DeviceConnectState::DISCONNECTED);
   RawAddress test_address_2 = GetTestAddress(2);
-  devices_->Add(test_address_2, true);
+  devices_->Add(test_address_2, DeviceConnectState::CONNECTING_BY_USER);
   LeAudioDevice* device = devices_->FindByAddress(test_address_1);
   ASSERT_NE(nullptr, device);
   ASSERT_EQ(test_address_1, device->address_);
@@ -112,20 +118,20 @@
 
 TEST_F(LeAudioDevicesTest, test_find_by_address_failed) {
   RawAddress test_address_0 = GetTestAddress(0);
-  devices_->Add(test_address_0, true);
+  devices_->Add(test_address_0, DeviceConnectState::CONNECTING_BY_USER);
   RawAddress test_address_2 = GetTestAddress(2);
-  devices_->Add(test_address_2, true);
+  devices_->Add(test_address_2, DeviceConnectState::CONNECTING_BY_USER);
   LeAudioDevice* device = devices_->FindByAddress(GetTestAddress(1));
   ASSERT_EQ(nullptr, device);
 }
 
 TEST_F(LeAudioDevicesTest, test_get_by_address_success) {
   RawAddress test_address_0 = GetTestAddress(0);
-  devices_->Add(test_address_0, true);
+  devices_->Add(test_address_0, DeviceConnectState::CONNECTING_BY_USER);
   RawAddress test_address_1 = GetTestAddress(1);
-  devices_->Add(test_address_1, false);
+  devices_->Add(test_address_1, DeviceConnectState::DISCONNECTED);
   RawAddress test_address_2 = GetTestAddress(2);
-  devices_->Add(test_address_2, true);
+  devices_->Add(test_address_2, DeviceConnectState::CONNECTING_BY_USER);
   std::shared_ptr<LeAudioDevice> device =
       devices_->GetByAddress(test_address_1);
   ASSERT_NE(nullptr, device);
@@ -134,28 +140,28 @@
 
 TEST_F(LeAudioDevicesTest, test_get_by_address_failed) {
   RawAddress test_address_0 = GetTestAddress(0);
-  devices_->Add(test_address_0, true);
+  devices_->Add(test_address_0, DeviceConnectState::CONNECTING_BY_USER);
   RawAddress test_address_2 = GetTestAddress(2);
-  devices_->Add(test_address_2, true);
+  devices_->Add(test_address_2, DeviceConnectState::CONNECTING_BY_USER);
   std::shared_ptr<LeAudioDevice> device =
       devices_->GetByAddress(GetTestAddress(1));
   ASSERT_EQ(nullptr, device);
 }
 
 TEST_F(LeAudioDevicesTest, test_find_by_conn_id_success) {
-  devices_->Add(GetTestAddress(1), true);
+  devices_->Add(GetTestAddress(1), DeviceConnectState::CONNECTING_BY_USER);
   RawAddress test_address_0 = GetTestAddress(0);
-  devices_->Add(test_address_0, true);
-  devices_->Add(GetTestAddress(4), true);
+  devices_->Add(test_address_0, DeviceConnectState::CONNECTING_BY_USER);
+  devices_->Add(GetTestAddress(4), DeviceConnectState::CONNECTING_BY_USER);
   LeAudioDevice* device = devices_->FindByAddress(test_address_0);
   device->conn_id_ = 0x0005;
   ASSERT_EQ(device, devices_->FindByConnId(0x0005));
 }
 
 TEST_F(LeAudioDevicesTest, test_find_by_conn_id_failed) {
-  devices_->Add(GetTestAddress(1), true);
-  devices_->Add(GetTestAddress(0), true);
-  devices_->Add(GetTestAddress(4), true);
+  devices_->Add(GetTestAddress(1), DeviceConnectState::CONNECTING_BY_USER);
+  devices_->Add(GetTestAddress(0), DeviceConnectState::CONNECTING_BY_USER);
+  devices_->Add(GetTestAddress(4), DeviceConnectState::CONNECTING_BY_USER);
   ASSERT_EQ(nullptr, devices_->FindByConnId(0x0006));
 }
 
@@ -199,20 +205,23 @@
   /* Update those values, on any change of codec linked with content type */
   switch (context_type) {
     case LeAudioContextType::RINGTONE:
-      if (id == Lc3SettingId::LC3_16_2 || id == Lc3SettingId::LC3_16_1 ||
-          id == Lc3SettingId::LC3_32_2)
-        return true;
-
-      break;
-
     case LeAudioContextType::CONVERSATIONAL:
       if (id == Lc3SettingId::LC3_16_1 || id == Lc3SettingId::LC3_16_2 ||
-          id == Lc3SettingId::LC3_24_2 || id == Lc3SettingId::LC3_32_2)
+          id == Lc3SettingId::LC3_24_1 || id == Lc3SettingId::LC3_24_2 ||
+          id == Lc3SettingId::LC3_32_1 || id == Lc3SettingId::LC3_32_2 ||
+          id == Lc3SettingId::LC3_48_1 || id == Lc3SettingId::LC3_48_2 ||
+          id == Lc3SettingId::LC3_48_3 || id == Lc3SettingId::LC3_48_4 ||
+          id == Lc3SettingId::LC3_VND_1)
         return true;
 
       break;
 
     case LeAudioContextType::MEDIA:
+    case LeAudioContextType::ALERTS:
+    case LeAudioContextType::INSTRUCTIONAL:
+    case LeAudioContextType::NOTIFICATIONS:
+    case LeAudioContextType::EMERGENCYALARM:
+    case LeAudioContextType::UNSPECIFIED:
       if (id == Lc3SettingId::LC3_16_1 || id == Lc3SettingId::LC3_16_2 ||
           id == Lc3SettingId::LC3_48_4 || id == Lc3SettingId::LC3_48_2 ||
           id == Lc3SettingId::LC3_VND_1 || id == Lc3SettingId::LC3_24_2)
@@ -383,8 +392,9 @@
   uint8_t audio_channel_counts_snk;
   uint8_t audio_channel_counts_src;
 
-  uint8_t active_channel_num_snk;
-  uint8_t active_channel_num_src;
+  /* Note, do not confuse ASEs with channels num. */
+  uint8_t expected_active_channel_num_snk;
+  uint8_t expected_active_channel_num_src;
 };
 
 class LeAudioAseConfigurationTest : public Test {
@@ -394,12 +404,23 @@
     bluetooth::manager::SetMockBtmInterface(&btm_interface_);
     controller::SetMockControllerInterface(&controller_interface_);
     ::le_audio::AudioSetConfigurationProvider::Initialize();
+    MockCsisClient::SetMockInstanceForTesting(&mock_csis_client_module_);
+    ON_CALL(mock_csis_client_module_, Get())
+        .WillByDefault(Return(&mock_csis_client_module_));
+    ON_CALL(mock_csis_client_module_, IsCsisClientRunning())
+        .WillByDefault(Return(true));
+    ON_CALL(mock_csis_client_module_, GetDeviceList(_))
+        .WillByDefault(Invoke([this](int group_id) { return addresses_; }));
+    ON_CALL(mock_csis_client_module_, GetDesiredSize(_))
+        .WillByDefault(
+            Invoke([this](int group_id) { return (int)(addresses_.size()); }));
   }
 
   void TearDown() override {
     controller::SetMockControllerInterface(nullptr);
     bluetooth::manager::SetMockBtmInterface(nullptr);
     devices_.clear();
+    addresses_.clear();
     delete group_;
     ::le_audio::AudioSetConfigurationProvider::Cleanup();
   }
@@ -408,35 +429,42 @@
                                int snk_ase_num_cached = 0,
                                int src_ase_num_cached = 0) {
     int index = group_->Size() + 1;
-    auto device =
-        (std::make_shared<LeAudioDevice>(GetTestAddress(index), false));
+    auto device = (std::make_shared<LeAudioDevice>(
+        GetTestAddress(index), DeviceConnectState::DISCONNECTED));
     devices_.push_back(device);
+    LOG_INFO(" addresses %d", (int)(addresses_.size()));
+    addresses_.push_back(device->address_);
+    LOG_INFO(" Addresses %d", (int)(addresses_.size()));
+
     group_->AddNode(device);
 
+    int ase_id = 1;
     for (int i = 0; i < src_ase_num; i++) {
-      device->ases_.emplace_back(0x0000, 0x0000, kLeAudioDirectionSource);
+      device->ases_.emplace_back(0x0000, 0x0000, kLeAudioDirectionSource,
+                                 ase_id++);
     }
 
     for (int i = 0; i < snk_ase_num; i++) {
-      device->ases_.emplace_back(0x0000, 0x0000, kLeAudioDirectionSink);
+      device->ases_.emplace_back(0x0000, 0x0000, kLeAudioDirectionSink,
+                                 ase_id++);
     }
 
     for (int i = 0; i < src_ase_num_cached; i++) {
-      struct ase ase(0x0000, 0x0000, kLeAudioDirectionSource);
+      struct ase ase(0x0000, 0x0000, kLeAudioDirectionSource, ase_id++);
       ase.state = AseState::BTA_LE_AUDIO_ASE_STATE_CODEC_CONFIGURED;
       device->ases_.push_back(ase);
     }
 
     for (int i = 0; i < snk_ase_num_cached; i++) {
-      struct ase ase(0x0000, 0x0000, kLeAudioDirectionSink);
+      struct ase ase(0x0000, 0x0000, kLeAudioDirectionSink, ase_id++);
       ase.state = AseState::BTA_LE_AUDIO_ASE_STATE_CODEC_CONFIGURED;
       device->ases_.push_back(ase);
     }
 
-    device->SetSupportedContexts((uint16_t)kLeAudioContextAllTypes,
-                                 (uint16_t)kLeAudioContextAllTypes);
-    device->SetAvailableContexts((uint16_t)kLeAudioContextAllTypes,
-                                 (uint16_t)kLeAudioContextAllTypes);
+    device->SetSupportedContexts(AudioContexts(kLeAudioContextAllTypes),
+                                 AudioContexts(kLeAudioContextAllTypes));
+    device->SetAvailableContexts(AudioContexts(kLeAudioContextAllTypes),
+                                 AudioContexts(kLeAudioContextAllTypes));
     device->snk_audio_locations_ =
         ::le_audio::codec_spec_conf::kLeAudioLocationFrontLeft |
         ::le_audio::codec_spec_conf::kLeAudioLocationFrontRight;
@@ -445,17 +473,19 @@
         ::le_audio::codec_spec_conf::kLeAudioLocationFrontRight;
 
     device->conn_id_ = index;
+    device->SetConnectionState(DeviceConnectState::CONNECTED);
+    group_->ReloadAudioDirections();
+    group_->ReloadAudioLocations();
     return device.get();
   }
 
-  void TestGroupAseConfigurationVerdict(
-      const TestGroupAseConfigurationData& data) {
+  bool TestGroupAseConfigurationVerdict(
+      const TestGroupAseConfigurationData& data, uint8_t directions_to_verify) {
     uint8_t active_channel_num_snk = 0;
     uint8_t active_channel_num_src = 0;
 
-    bool have_active_ase =
-        data.active_channel_num_snk + data.active_channel_num_src;
-    ASSERT_EQ(have_active_ase, data.device->HaveActiveAse());
+    if (directions_to_verify == 0) return false;
+    if (data.device->HaveActiveAse() == 0) return false;
 
     for (ase* ase = data.device->GetFirstActiveAse(); ase;
          ase = data.device->GetNextActiveAse(ase)) {
@@ -467,8 +497,17 @@
             GetAudioChannelCounts(*ase->codec_config.audio_channel_allocation);
     }
 
-    ASSERT_EQ(data.active_channel_num_snk, active_channel_num_snk);
-    ASSERT_EQ(data.active_channel_num_src, active_channel_num_src);
+    bool result = true;
+    if (directions_to_verify & kLeAudioDirectionSink) {
+      result &=
+          (data.expected_active_channel_num_snk == active_channel_num_snk);
+    }
+    if (directions_to_verify & kLeAudioDirectionSource) {
+      result &=
+          (data.expected_active_channel_num_src == active_channel_num_src);
+    }
+
+    return result;
   }
 
   void SetCisInformationToActiveAse(void) {
@@ -488,19 +527,24 @@
   void TestSingleAseConfiguration(LeAudioContextType context_type,
                                   TestGroupAseConfigurationData* data,
                                   uint8_t data_size,
-                                  const AudioSetConfiguration* audio_set_conf) {
+                                  const AudioSetConfiguration* audio_set_conf,
+                                  uint8_t directions_to_verify) {
     // the configuration should fail if there are no active ases expected
     bool success_expected = data_size > 0;
+    uint8_t configuration_directions = 0;
+
     for (int i = 0; i < data_size; i++) {
-      success_expected &=
-          (data[i].active_channel_num_snk + data[i].active_channel_num_src) > 0;
+      success_expected &= (data[i].expected_active_channel_num_snk +
+                           data[i].expected_active_channel_num_src) > 0;
 
       /* Prepare PAC's */
       PublishedAudioCapabilitiesBuilder snk_pac_builder, src_pac_builder;
       for (const auto& entry : (*audio_set_conf).confs) {
         if (entry.direction == kLeAudioDirectionSink) {
+          configuration_directions |= kLeAudioDirectionSink;
           snk_pac_builder.Add(entry.codec, data[i].audio_channel_counts_snk);
         } else {
+          configuration_directions |= kLeAudioDirectionSource;
           src_pac_builder.Add(entry.codec, data[i].audio_channel_counts_src);
         }
       }
@@ -509,80 +553,121 @@
       data[i].device->src_pacs_ = src_pac_builder.Get();
     }
 
-    /* Stimulate update of active context map */
-    group_->UpdateActiveContextsMap(static_cast<uint16_t>(context_type));
-    ASSERT_EQ(success_expected, group_->Configure(context_type));
+    /* Stimulate update of available context map */
+    group_->UpdateAudioContextTypeAvailability(AudioContexts(context_type));
+    ASSERT_EQ(success_expected,
+              group_->Configure(context_type, AudioContexts(context_type)));
 
+    bool result = true;
     for (int i = 0; i < data_size; i++) {
-      TestGroupAseConfigurationVerdict(data[i]);
+      result &= TestGroupAseConfigurationVerdict(
+          data[i], directions_to_verify & configuration_directions);
     }
+    ASSERT_TRUE(result);
   }
 
-  void TestGroupAseConfiguration(LeAudioContextType context_type,
-                                 TestGroupAseConfigurationData* data,
-                                 uint8_t data_size) {
+  int getNumOfAses(LeAudioDevice* device, uint8_t direction) {
+    return std::count_if(
+        device->ases_.begin(), device->ases_.end(),
+        [direction](auto& a) { return a.direction == direction; });
+  }
+
+  void TestGroupAseConfiguration(
+      LeAudioContextType context_type, TestGroupAseConfigurationData* data,
+      uint8_t data_size,
+      uint8_t directions_to_verify = kLeAudioDirectionSink |
+                                     kLeAudioDirectionSource) {
     const auto* configurations =
         ::le_audio::AudioSetConfigurationProvider::Get()->GetConfigurations(
             context_type);
+
+    bool success_expected = directions_to_verify != 0;
+    int num_of_matching_configurations = 0;
     for (const auto& audio_set_conf : *configurations) {
+      bool interesting_configuration = true;
+      uint8_t configuration_directions = 0;
+
       // the configuration should fail if there are no active ases expected
-      bool success_expected = data_size > 0;
-      bool not_matching_scenario = false;
-      uint8_t snk_ases_cnt = 0;
-      uint8_t src_ases_cnt = 0;
       PublishedAudioCapabilitiesBuilder snk_pac_builder, src_pac_builder;
       snk_pac_builder.Reset();
       src_pac_builder.Reset();
 
+      /* Let's go thru devices in the group and configure them*/
       for (int i = 0; i < data_size; i++) {
-        success_expected &= (data[i].active_channel_num_snk +
-                             data[i].active_channel_num_src) > 0;
+        int num_of_ase_snk_per_dev = 0;
+        int num_of_ase_src_per_dev = 0;
 
-        /* Prepare PAC's */
-        /* Note this test requires that reach TwoStereoChan configuration
-         * version has similar version for OneStereoChan (both SingleDev,
-         * DualDev). This is just how the test is created and this limitation
-         * should be removed b/230107540
-         */
+        /* Prepare PAC's for each device. Also make sure configuration is in our
+         * interest to test */
         for (const auto& entry : (*audio_set_conf).confs) {
-          /* Configuration requires more devices than are supplied */
-          if (entry.device_cnt > data_size) {
-            not_matching_scenario = true;
-            break;
+          /* We are interested in the configurations which contains exact number
+           * of devices and number of ases is same the number of expected ases
+           * to active
+           */
+          if (entry.device_cnt != data_size) {
+            interesting_configuration = false;
           }
+
+          /* Make sure the strategy is the expected one */
+          if (entry.direction == kLeAudioDirectionSink &&
+              group_->GetGroupStrategy() != entry.strategy) {
+            interesting_configuration = false;
+          }
+
           if (entry.direction == kLeAudioDirectionSink) {
-            snk_ases_cnt += entry.ase_cnt;
+            configuration_directions |= kLeAudioDirectionSink;
+            num_of_ase_snk_per_dev = entry.ase_cnt / data_size;
             snk_pac_builder.Add(entry.codec, data[i].audio_channel_counts_snk);
           } else {
+            configuration_directions |= kLeAudioDirectionSource;
+            num_of_ase_src_per_dev = entry.ase_cnt / data_size;
             src_pac_builder.Add(entry.codec, data[i].audio_channel_counts_src);
           }
+
+          data[i].device->snk_pacs_ = snk_pac_builder.Get();
+          data[i].device->src_pacs_ = src_pac_builder.Get();
         }
 
-        /* Scenario requires more ASEs than defined requirement */
-        if (snk_ases_cnt < data[i].audio_channel_counts_snk ||
-            src_ases_cnt < data[i].audio_channel_counts_src) {
-          not_matching_scenario = true;
+        /* Make sure configuration can satisfy number of expected active ASEs*/
+        if (num_of_ase_snk_per_dev >
+            data[i].device->GetAseCount(kLeAudioDirectionSink)) {
+          interesting_configuration = false;
         }
 
-        if (not_matching_scenario) break;
-
-        data[i].device->snk_pacs_ = snk_pac_builder.Get();
-        data[i].device->src_pacs_ = src_pac_builder.Get();
+        if (num_of_ase_src_per_dev >
+            data[i].device->GetAseCount(kLeAudioDirectionSource)) {
+          interesting_configuration = false;
+        }
       }
+      /* Stimulate update of available context map */
+      group_->UpdateAudioContextTypeAvailability(AudioContexts(context_type));
+      auto configuration_result =
+          group_->Configure(context_type, AudioContexts(context_type));
 
-      if (not_matching_scenario) continue;
+      /* In case of configuration #ase is same as the one we expected to be
+       * activated verify, ASEs are actually active */
+      if (interesting_configuration &&
+          (directions_to_verify == configuration_directions)) {
+        ASSERT_TRUE(configuration_result);
 
-      /* Stimulate update of active context map */
-      group_->UpdateActiveContextsMap(static_cast<uint16_t>(context_type));
-      ASSERT_EQ(success_expected, group_->Configure(context_type));
+        bool matching_conf = true;
+        /* Check if each of the devices has activated ASEs as expected */
+        for (int i = 0; i < data_size; i++) {
+          matching_conf &= TestGroupAseConfigurationVerdict(
+              data[i], configuration_directions);
+        }
 
-      for (int i = 0; i < data_size; i++) {
-        TestGroupAseConfigurationVerdict(data[i]);
+        if (matching_conf) num_of_matching_configurations++;
       }
-
       group_->Deactivate();
       TestAsesInactive();
     }
+
+    if (success_expected) {
+      ASSERT_TRUE((num_of_matching_configurations > 0));
+    } else {
+      ASSERT_TRUE(num_of_matching_configurations == 0);
+    }
   }
 
   void TestAsesActive(LeAudioCodecId codec_id, uint8_t sampling_frequency,
@@ -624,6 +709,8 @@
   void TestAsesInactivated(const LeAudioDevice* device) {
     for (const auto& ase : device->ases_) {
       ASSERT_FALSE(ase.active);
+      ASSERT_TRUE(ase.cis_id == ::le_audio::kInvalidCisId);
+      ASSERT_TRUE(ase.cis_conn_hdl == 0);
     }
   }
 
@@ -652,9 +739,11 @@
             uint16_t octets_per_frame = GetOctetsPerCodecFrame(opcf_variant);
 
             PublishedAudioCapabilitiesBuilder pac_builder;
-            pac_builder.Add(
-                LeAudioCodecIdLc3, sampling_frequency, frame_duration,
-                kLeAudioCodecLC3ChannelCountSingleChannel, octets_per_frame);
+            pac_builder.Add(LeAudioCodecIdLc3, sampling_frequency,
+                            frame_duration,
+                            kLeAudioCodecLC3ChannelCountSingleChannel |
+                                kLeAudioCodecLC3ChannelCountTwoChannel,
+                            octets_per_frame);
             for (auto& device : devices_) {
               /* For simplicity configure both PACs with the same
               parameters*/
@@ -670,10 +759,12 @@
               success_expected = false;
             }
 
-            /* Stimulate update of active context map */
-            group_->UpdateActiveContextsMap(
-                static_cast<uint16_t>(context_type));
-            ASSERT_EQ(success_expected, group_->Configure(context_type));
+            /* Stimulate update of available context map */
+            group_->UpdateAudioContextTypeAvailability(
+                AudioContexts(context_type));
+            ASSERT_EQ(
+                success_expected,
+                group_->Configure(context_type, AudioContexts(context_type)));
             if (success_expected) {
               TestAsesActive(LeAudioCodecIdLc3, sampling_frequency,
                              frame_duration, octets_per_frame);
@@ -689,27 +780,44 @@
 
   const int group_id_ = 6;
   std::vector<std::shared_ptr<LeAudioDevice>> devices_;
+  std::vector<RawAddress> addresses_;
   LeAudioDeviceGroup* group_ = nullptr;
   bluetooth::manager::MockBtmInterface btm_interface_;
   controller::MockControllerInterface controller_interface_;
+  MockCsisClient mock_csis_client_module_;
 };
 
 TEST_F(LeAudioAseConfigurationTest, test_mono_speaker_ringtone) {
-  LeAudioDevice* mono_speaker = AddTestDevice(1, 1);
+  LeAudioDevice* mono_speaker = AddTestDevice(1, 0);
   TestGroupAseConfigurationData data(
       {mono_speaker, kLeAudioCodecLC3ChannelCountSingleChannel,
        kLeAudioCodecLC3ChannelCountSingleChannel, 1, 0});
 
-  TestGroupAseConfiguration(LeAudioContextType::RINGTONE, &data, 1);
+  /* mono, change location as by default it is stereo */
+  mono_speaker->snk_audio_locations_ =
+      ::le_audio::codec_spec_conf::kLeAudioLocationFrontLeft;
+  group_->ReloadAudioLocations();
+
+  uint8_t direction_to_verify = kLeAudioDirectionSink;
+  TestGroupAseConfiguration(LeAudioContextType::RINGTONE, &data, 1,
+                            direction_to_verify);
 }
 
-TEST_F(LeAudioAseConfigurationTest, test_mono_speaker_conversional) {
+TEST_F(LeAudioAseConfigurationTest, test_mono_speaker_conversational) {
   LeAudioDevice* mono_speaker = AddTestDevice(1, 0);
   TestGroupAseConfigurationData data({mono_speaker,
                                       kLeAudioCodecLC3ChannelCountSingleChannel,
-                                      kLeAudioCodecLC3ChannelCountNone, 0, 0});
+                                      kLeAudioCodecLC3ChannelCountNone, 1, 0});
 
-  TestGroupAseConfiguration(LeAudioContextType::CONVERSATIONAL, &data, 1);
+  /* mono, change location as by default it is stereo */
+  mono_speaker->snk_audio_locations_ =
+      ::le_audio::codec_spec_conf::kLeAudioLocationFrontLeft;
+  group_->ReloadAudioLocations();
+
+  /* Microphone should be used on the phone */
+  uint8_t direction_to_verify = kLeAudioDirectionSink;
+  TestGroupAseConfiguration(LeAudioContextType::CONVERSATIONAL, &data, 1,
+                            direction_to_verify);
 }
 
 TEST_F(LeAudioAseConfigurationTest, test_mono_speaker_media) {
@@ -718,25 +826,36 @@
                                       kLeAudioCodecLC3ChannelCountSingleChannel,
                                       kLeAudioCodecLC3ChannelCountNone, 1, 0});
 
-  TestGroupAseConfiguration(LeAudioContextType::MEDIA, &data, 1);
+  /* mono, change location as by default it is stereo */
+  mono_speaker->snk_audio_locations_ =
+      ::le_audio::codec_spec_conf::kLeAudioLocationFrontLeft;
+  group_->ReloadAudioLocations();
+
+  uint8_t direction_to_verify = kLeAudioDirectionSink;
+  TestGroupAseConfiguration(LeAudioContextType::MEDIA, &data, 1,
+                            direction_to_verify);
 }
 
 TEST_F(LeAudioAseConfigurationTest, test_bounded_headphones_ringtone) {
-  LeAudioDevice* bounded_headphones = AddTestDevice(2, 1);
+  LeAudioDevice* bounded_headphones = AddTestDevice(2, 0);
   TestGroupAseConfigurationData data(
       {bounded_headphones, kLeAudioCodecLC3ChannelCountTwoChannel,
        kLeAudioCodecLC3ChannelCountSingleChannel, 2, 0});
 
-  TestGroupAseConfiguration(LeAudioContextType::RINGTONE, &data, 1);
+  uint8_t direction_to_verify = kLeAudioDirectionSink;
+  TestGroupAseConfiguration(LeAudioContextType::RINGTONE, &data, 1,
+                            direction_to_verify);
 }
 
 TEST_F(LeAudioAseConfigurationTest, test_bounded_headphones_conversional) {
   LeAudioDevice* bounded_headphones = AddTestDevice(2, 0);
   TestGroupAseConfigurationData data({bounded_headphones,
                                       kLeAudioCodecLC3ChannelCountTwoChannel,
-                                      kLeAudioCodecLC3ChannelCountNone, 0, 0});
+                                      kLeAudioCodecLC3ChannelCountNone, 2, 0});
 
-  TestGroupAseConfiguration(LeAudioContextType::CONVERSATIONAL, &data, 1);
+  uint8_t direction_to_verify = kLeAudioDirectionSink;
+  TestGroupAseConfiguration(LeAudioContextType::CONVERSATIONAL, &data, 1,
+                            direction_to_verify);
 }
 
 TEST_F(LeAudioAseConfigurationTest, test_bounded_headphones_media) {
@@ -745,14 +864,36 @@
                                       kLeAudioCodecLC3ChannelCountTwoChannel,
                                       kLeAudioCodecLC3ChannelCountNone, 2, 0});
 
-  TestGroupAseConfiguration(LeAudioContextType::MEDIA, &data, 1);
+  uint8_t direction_to_verify = kLeAudioDirectionSink;
+  TestGroupAseConfiguration(LeAudioContextType::MEDIA, &data, 1,
+                            direction_to_verify);
 }
 
-TEST_F(LeAudioAseConfigurationTest, test_bounded_headset_ringtone) {
+TEST_F(LeAudioAseConfigurationTest,
+       test_bounded_headset_ringtone_mono_microphone) {
   LeAudioDevice* bounded_headset = AddTestDevice(2, 1);
   TestGroupAseConfigurationData data(
       {bounded_headset, kLeAudioCodecLC3ChannelCountTwoChannel,
-       kLeAudioCodecLC3ChannelCountSingleChannel, 2, 0});
+       kLeAudioCodecLC3ChannelCountSingleChannel, 2, 1});
+
+  /* mono, change location as by default it is stereo */
+  bounded_headset->src_audio_locations_ =
+      ::le_audio::codec_spec_conf::kLeAudioLocationFrontLeft;
+  group_->ReloadAudioLocations();
+
+  TestGroupAseConfiguration(LeAudioContextType::RINGTONE, &data, 1);
+}
+
+TEST_F(LeAudioAseConfigurationTest,
+       test_bounded_headset_ringtone_stereo_microphone) {
+  LeAudioDevice* bounded_headset = AddTestDevice(2, 2);
+  TestGroupAseConfigurationData data(
+      {bounded_headset,
+       kLeAudioCodecLC3ChannelCountSingleChannel |
+           kLeAudioCodecLC3ChannelCountTwoChannel,
+       kLeAudioCodecLC3ChannelCountSingleChannel |
+           kLeAudioCodecLC3ChannelCountTwoChannel,
+       2, 2});
 
   TestGroupAseConfiguration(LeAudioContextType::RINGTONE, &data, 1);
 }
@@ -772,7 +913,9 @@
       {bounded_headset, kLeAudioCodecLC3ChannelCountTwoChannel,
        kLeAudioCodecLC3ChannelCountSingleChannel, 2, 0});
 
-  TestGroupAseConfiguration(LeAudioContextType::MEDIA, &data, 1);
+  uint8_t directions_to_verify = kLeAudioDirectionSink;
+  TestGroupAseConfiguration(LeAudioContextType::MEDIA, &data, 1,
+                            directions_to_verify);
 }
 
 TEST_F(LeAudioAseConfigurationTest, test_earbuds_ringtone) {
@@ -780,9 +923,20 @@
   LeAudioDevice* right = AddTestDevice(1, 1);
   TestGroupAseConfigurationData data[] = {
       {left, kLeAudioCodecLC3ChannelCountSingleChannel,
-       kLeAudioCodecLC3ChannelCountSingleChannel, 1, 0},
+       kLeAudioCodecLC3ChannelCountSingleChannel, 1, 1},
       {right, kLeAudioCodecLC3ChannelCountSingleChannel,
-       kLeAudioCodecLC3ChannelCountSingleChannel, 1, 0}};
+       kLeAudioCodecLC3ChannelCountSingleChannel, 1, 1}};
+
+  /* Change location as by default it is stereo */
+  left->snk_audio_locations_ =
+      ::le_audio::codec_spec_conf::kLeAudioLocationFrontLeft;
+  left->src_audio_locations_ =
+      ::le_audio::codec_spec_conf::kLeAudioLocationFrontLeft;
+  right->snk_audio_locations_ =
+      ::le_audio::codec_spec_conf::kLeAudioLocationFrontRight;
+  right->src_audio_locations_ =
+      ::le_audio::codec_spec_conf::kLeAudioLocationFrontRight;
+  group_->ReloadAudioLocations();
 
   TestGroupAseConfiguration(LeAudioContextType::RINGTONE, data, 2);
 }
@@ -796,6 +950,17 @@
       {right, kLeAudioCodecLC3ChannelCountSingleChannel,
        kLeAudioCodecLC3ChannelCountSingleChannel, 1, 1}};
 
+  /* Change location as by default it is stereo */
+  left->snk_audio_locations_ =
+      ::le_audio::codec_spec_conf::kLeAudioLocationFrontLeft;
+  left->src_audio_locations_ =
+      ::le_audio::codec_spec_conf::kLeAudioLocationFrontLeft;
+  right->snk_audio_locations_ =
+      ::le_audio::codec_spec_conf::kLeAudioLocationFrontRight;
+  right->src_audio_locations_ =
+      ::le_audio::codec_spec_conf::kLeAudioLocationFrontRight;
+  group_->ReloadAudioLocations();
+
   TestGroupAseConfiguration(LeAudioContextType::CONVERSATIONAL, data, 2);
 }
 
@@ -808,32 +973,81 @@
       {right, kLeAudioCodecLC3ChannelCountSingleChannel,
        kLeAudioCodecLC3ChannelCountSingleChannel, 1, 0}};
 
-  TestGroupAseConfiguration(LeAudioContextType::MEDIA, data, 2);
+  /* Change location as by default it is stereo */
+  left->snk_audio_locations_ =
+      ::le_audio::codec_spec_conf::kLeAudioLocationFrontLeft;
+  left->src_audio_locations_ =
+      ::le_audio::codec_spec_conf::kLeAudioLocationFrontLeft;
+  right->snk_audio_locations_ =
+      ::le_audio::codec_spec_conf::kLeAudioLocationFrontRight;
+  right->src_audio_locations_ =
+      ::le_audio::codec_spec_conf::kLeAudioLocationFrontRight;
+  group_->ReloadAudioLocations();
+
+  uint8_t directions_to_verify = kLeAudioDirectionSink;
+  TestGroupAseConfiguration(LeAudioContextType::MEDIA, data, 2,
+                            directions_to_verify);
 }
 
-TEST_F(LeAudioAseConfigurationTest, test_handsfree_ringtone) {
-  LeAudioDevice* handsfree = AddTestDevice(1, 1);
-  TestGroupAseConfigurationData data(
-      {handsfree, kLeAudioCodecLC3ChannelCountSingleChannel,
-       kLeAudioCodecLC3ChannelCountSingleChannel, 1, 0});
-
-  TestGroupAseConfiguration(LeAudioContextType::RINGTONE, &data, 1);
-}
-
-TEST_F(LeAudioAseConfigurationTest, test_handsfree_conversional) {
+TEST_F(LeAudioAseConfigurationTest, test_handsfree_mono_ringtone) {
   LeAudioDevice* handsfree = AddTestDevice(1, 1);
   TestGroupAseConfigurationData data(
       {handsfree, kLeAudioCodecLC3ChannelCountSingleChannel,
        kLeAudioCodecLC3ChannelCountSingleChannel, 1, 1});
 
+  handsfree->snk_audio_locations_ =
+      ::le_audio::codec_spec_conf::kLeAudioLocationFrontLeft;
+  handsfree->src_audio_locations_ =
+      ::le_audio::codec_spec_conf::kLeAudioLocationFrontLeft;
+  group_->ReloadAudioLocations();
+
+  TestGroupAseConfiguration(LeAudioContextType::RINGTONE, &data, 1);
+}
+
+TEST_F(LeAudioAseConfigurationTest, test_handsfree_stereo_ringtone) {
+  LeAudioDevice* handsfree = AddTestDevice(1, 1);
+  TestGroupAseConfigurationData data(
+      {handsfree,
+       kLeAudioCodecLC3ChannelCountSingleChannel |
+           kLeAudioCodecLC3ChannelCountTwoChannel,
+       kLeAudioCodecLC3ChannelCountSingleChannel, 2, 1});
+
+  TestGroupAseConfiguration(LeAudioContextType::RINGTONE, &data, 1);
+}
+
+TEST_F(LeAudioAseConfigurationTest, test_handsfree_mono_conversional) {
+  LeAudioDevice* handsfree = AddTestDevice(1, 1);
+  TestGroupAseConfigurationData data(
+      {handsfree, kLeAudioCodecLC3ChannelCountSingleChannel,
+       kLeAudioCodecLC3ChannelCountSingleChannel, 1, 1});
+
+  handsfree->snk_audio_locations_ =
+      ::le_audio::codec_spec_conf::kLeAudioLocationFrontLeft;
+  handsfree->src_audio_locations_ =
+      ::le_audio::codec_spec_conf::kLeAudioLocationFrontLeft;
+  group_->ReloadAudioLocations();
+
+  TestGroupAseConfiguration(LeAudioContextType::CONVERSATIONAL, &data, 1);
+}
+
+TEST_F(LeAudioAseConfigurationTest, test_handsfree_stereo_conversional) {
+  LeAudioDevice* handsfree = AddTestDevice(1, 1);
+  TestGroupAseConfigurationData data(
+      {handsfree,
+       kLeAudioCodecLC3ChannelCountSingleChannel |
+           kLeAudioCodecLC3ChannelCountTwoChannel,
+       kLeAudioCodecLC3ChannelCountSingleChannel, 2, 1});
+
   TestGroupAseConfiguration(LeAudioContextType::CONVERSATIONAL, &data, 1);
 }
 
 TEST_F(LeAudioAseConfigurationTest, test_handsfree_full_cached_conversional) {
   LeAudioDevice* handsfree = AddTestDevice(0, 0, 1, 1);
   TestGroupAseConfigurationData data(
-      {handsfree, kLeAudioCodecLC3ChannelCountSingleChannel,
-       kLeAudioCodecLC3ChannelCountSingleChannel, 1, 1});
+      {handsfree,
+       kLeAudioCodecLC3ChannelCountSingleChannel |
+           kLeAudioCodecLC3ChannelCountTwoChannel,
+       kLeAudioCodecLC3ChannelCountSingleChannel, 2, 1});
 
   TestGroupAseConfiguration(LeAudioContextType::CONVERSATIONAL, &data, 1);
 }
@@ -842,19 +1056,26 @@
        test_handsfree_partial_cached_conversional) {
   LeAudioDevice* handsfree = AddTestDevice(1, 0, 0, 1);
   TestGroupAseConfigurationData data(
-      {handsfree, kLeAudioCodecLC3ChannelCountSingleChannel,
-       kLeAudioCodecLC3ChannelCountSingleChannel, 1, 1});
+      {handsfree,
+       kLeAudioCodecLC3ChannelCountSingleChannel |
+           kLeAudioCodecLC3ChannelCountTwoChannel,
+       kLeAudioCodecLC3ChannelCountSingleChannel, 2, 1});
 
   TestGroupAseConfiguration(LeAudioContextType::CONVERSATIONAL, &data, 1);
 }
 
-TEST_F(LeAudioAseConfigurationTest, test_handsfree_media) {
+TEST_F(LeAudioAseConfigurationTest,
+       test_handsfree_media_two_channels_allocation_stereo) {
   LeAudioDevice* handsfree = AddTestDevice(1, 1);
   TestGroupAseConfigurationData data(
-      {handsfree, kLeAudioCodecLC3ChannelCountSingleChannel,
-       kLeAudioCodecLC3ChannelCountSingleChannel, 1, 0});
+      {handsfree,
+       kLeAudioCodecLC3ChannelCountSingleChannel |
+           kLeAudioCodecLC3ChannelCountTwoChannel,
+       kLeAudioCodecLC3ChannelCountSingleChannel, 2, 0});
 
-  TestGroupAseConfiguration(LeAudioContextType::MEDIA, &data, 1);
+  uint8_t directions_to_verify = kLeAudioDirectionSink;
+  TestGroupAseConfiguration(LeAudioContextType::MEDIA, &data, 1,
+                            directions_to_verify);
 }
 
 TEST_F(LeAudioAseConfigurationTest, test_lc3_config_ringtone) {
@@ -870,7 +1091,7 @@
 }
 
 TEST_F(LeAudioAseConfigurationTest, test_lc3_config_media) {
-  AddTestDevice(1, 0);
+  AddTestDevice(1, 1);
 
   TestLc3CodecConfig(LeAudioContextType::MEDIA);
 }
@@ -893,7 +1114,9 @@
   device->snk_pacs_ = pac_builder.Get();
   device->src_pacs_ = pac_builder.Get();
 
-  ASSERT_FALSE(group_->Configure(LeAudioContextType::RINGTONE));
+  ASSERT_FALSE(group_->Configure(
+      LeAudioContextType::RINGTONE,
+      AudioContexts(static_cast<uint16_t>(LeAudioContextType::RINGTONE))));
   TestAsesInactive();
 }
 
@@ -901,6 +1124,17 @@
   LeAudioDevice* left = AddTestDevice(2, 1);
   LeAudioDevice* right = AddTestDevice(2, 1);
 
+  /* Change location as by default it is stereo */
+  left->snk_audio_locations_ =
+      ::le_audio::codec_spec_conf::kLeAudioLocationFrontLeft;
+  left->src_audio_locations_ =
+      ::le_audio::codec_spec_conf::kLeAudioLocationFrontLeft;
+  right->snk_audio_locations_ =
+      ::le_audio::codec_spec_conf::kLeAudioLocationFrontRight;
+  right->src_audio_locations_ =
+      ::le_audio::codec_spec_conf::kLeAudioLocationFrontRight;
+  group_->ReloadAudioLocations();
+
   TestGroupAseConfigurationData data[] = {
       {left, kLeAudioCodecLC3ChannelCountSingleChannel,
        kLeAudioCodecLC3ChannelCountSingleChannel, 1, 0},
@@ -914,12 +1148,24 @@
   ASSERT_NE(all_configurations->end(), all_configurations->begin());
   auto configuration = *all_configurations->begin();
 
-  TestSingleAseConfiguration(LeAudioContextType::MEDIA, data, 2, configuration);
+  uint8_t direction_to_verify = kLeAudioDirectionSink;
+  TestSingleAseConfiguration(LeAudioContextType::MEDIA, data, 2, configuration,
+                             direction_to_verify);
 
-  SetCisInformationToActiveAse();
+  /* Generate CISes, symulate CIG creation and assign cis handles to ASEs.*/
+  group_->CigGenerateCisIds(LeAudioContextType::MEDIA);
+  std::vector<uint16_t> handles = {0x0012, 0x0013};
+  group_->CigAssignCisConnHandles(handles);
+  group_->CigAssignCisIds(left);
+  group_->CigAssignCisIds(right);
 
+  TestActiveAses();
   /* Left got disconnected */
   left->DeactivateAllAses();
+
+  /* Unassign from the group*/
+  group_->CigUnassignCis(left);
+
   TestAsesInactivated(left);
 
   /* Prepare reconfiguration */
@@ -931,21 +1177,30 @@
       *ase->codec_config.audio_channel_allocation;
 
   /* Get entry for the sink direction and use it to set configuration */
+  std::vector<uint8_t> ccid_list;
   for (auto& ent : configuration->confs) {
     if (ent.direction == ::le_audio::types::kLeAudioDirectionSink) {
-      left->ConfigureAses(ent, group_->GetCurrentContextType(),
+      left->ConfigureAses(ent, group_->GetConfigurationContextType(),
                           &number_of_active_ases, group_snk_audio_location,
-                          group_src_audio_location);
+                          group_src_audio_location, false,
+                          ::le_audio::types::AudioContexts(), ccid_list);
     }
   }
 
   ASSERT_TRUE(number_of_active_ases == 2);
   ASSERT_TRUE(group_snk_audio_location == kChannelAllocationStereo);
 
+  uint8_t directions_to_verify = ::le_audio::types::kLeAudioDirectionSink;
   for (int i = 0; i < 2; i++) {
-    TestGroupAseConfigurationVerdict(data[i]);
+    TestGroupAseConfigurationVerdict(data[i], directions_to_verify);
   }
 
+  /* Before device is rejoining, and group already exist, cis handles are
+   * assigned before sending codec config
+   */
+  group_->CigAssignCisIds(left);
+  group_->CigAssignCisConnHandlesToAses(left);
+
   TestActiveAses();
 }
 }  // namespace
diff --git a/system/bta/le_audio/le_audio_client_test.cc b/system/bta/le_audio/le_audio_client_test.cc
index 2525d23..69978b3 100644
--- a/system/bta/le_audio/le_audio_client_test.cc
+++ b/system/bta/le_audio/le_audio_client_test.cc
@@ -33,6 +33,7 @@
 #include "fake_osi.h"
 #include "gatt/database_builder.h"
 #include "hardware/bt_gatt_types.h"
+#include "internal_include/stack_config.h"
 #include "le_audio_set_configuration_provider.h"
 #include "le_audio_types.h"
 #include "mock_controller.h"
@@ -40,13 +41,16 @@
 #include "mock_device_groups.h"
 #include "mock_iso_manager.h"
 #include "mock_state_machine.h"
+#include "osi/include/log.h"
 
 using testing::_;
 using testing::AnyNumber;
 using testing::AtLeast;
 using testing::AtMost;
 using testing::DoAll;
+using testing::Expectation;
 using testing::Invoke;
+using testing::Matcher;
 using testing::Mock;
 using testing::MockFunction;
 using testing::NotNull;
@@ -60,9 +64,24 @@
 
 using namespace bluetooth::le_audio;
 
+using le_audio::LeAudioCodecConfiguration;
+using le_audio::LeAudioSinkAudioHalClient;
+using le_audio::LeAudioSourceAudioHalClient;
+
 extern struct fake_osi_alarm_set_on_mloop fake_osi_alarm_set_on_mloop_;
 
 std::map<std::string, int> mock_function_count_map;
+constexpr int max_num_of_ases = 5;
+
+static constexpr char kNotifyUpperLayerAboutGroupBeingInIdleDuringCall[] =
+    "persist.bluetooth.leaudio.notify.idle.during.call";
+const char* test_flags[] = {
+    "INIT_logging_debug_enabled_for_all=true",
+    "INIT_leaudio_targeted_announcement_reconnection_mode=true",
+    nullptr,
+};
+
+void osi_property_set_bool(const char* key, bool value);
 
 // Disables most likely false-positives from base::SplitString()
 extern "C" const char* __asan_default_options() {
@@ -93,6 +112,13 @@
   return BT_STATUS_SUCCESS;
 }
 
+bt_status_t do_in_main_thread_delayed(const base::Location& from_here,
+                                      base::OnceClosure task,
+                                      const base::TimeDelta& delay) {
+  /* For testing purpose it is ok to just skip delay */
+  return do_in_main_thread(from_here, std::move(task));
+}
+
 static base::MessageLoop* message_loop_;
 base::MessageLoop* get_main_message_loop() { return message_loop_; }
 
@@ -118,9 +144,81 @@
 void invoke_switch_codec_cb(bool is_low_latency_buffer_size) {}
 void invoke_switch_buffer_size_cb(bool is_low_latency_buffer_size) {}
 
+const std::string kSmpOptions("mock smp options");
+bool get_trace_config_enabled(void) { return false; }
+bool get_pts_avrcp_test(void) { return false; }
+bool get_pts_secure_only_mode(void) { return false; }
+bool get_pts_conn_updates_disabled(void) { return false; }
+bool get_pts_crosskey_sdp_disable(void) { return false; }
+const std::string* get_pts_smp_options(void) { return &kSmpOptions; }
+int get_pts_smp_failure_case(void) { return 123; }
+bool get_pts_force_eatt_for_notifications(void) { return false; }
+bool get_pts_connect_eatt_unconditionally(void) { return false; }
+bool get_pts_connect_eatt_before_encryption(void) { return false; }
+bool get_pts_unencrypt_broadcast(void) { return false; }
+bool get_pts_eatt_peripheral_collision_support(void) { return false; }
+bool get_pts_force_le_audio_multiple_contexts_metadata(void) { return false; }
+bool get_pts_le_audio_disable_ases_before_stopping(void) { return false; }
+config_t* get_all(void) { return nullptr; }
+
+stack_config_t mock_stack_config{
+    .get_trace_config_enabled = get_trace_config_enabled,
+    .get_pts_avrcp_test = get_pts_avrcp_test,
+    .get_pts_secure_only_mode = get_pts_secure_only_mode,
+    .get_pts_conn_updates_disabled = get_pts_conn_updates_disabled,
+    .get_pts_crosskey_sdp_disable = get_pts_crosskey_sdp_disable,
+    .get_pts_smp_options = get_pts_smp_options,
+    .get_pts_smp_failure_case = get_pts_smp_failure_case,
+    .get_pts_force_eatt_for_notifications =
+        get_pts_force_eatt_for_notifications,
+    .get_pts_connect_eatt_unconditionally =
+        get_pts_connect_eatt_unconditionally,
+    .get_pts_connect_eatt_before_encryption =
+        get_pts_connect_eatt_before_encryption,
+    .get_pts_unencrypt_broadcast = get_pts_unencrypt_broadcast,
+    .get_pts_eatt_peripheral_collision_support =
+        get_pts_eatt_peripheral_collision_support,
+    .get_pts_force_le_audio_multiple_contexts_metadata =
+        get_pts_force_le_audio_multiple_contexts_metadata,
+    .get_pts_le_audio_disable_ases_before_stopping =
+        get_pts_le_audio_disable_ases_before_stopping,
+    .get_all = get_all,
+};
+const stack_config_t* stack_config_get_interface(void) {
+  return &mock_stack_config;
+}
+
 namespace le_audio {
-namespace {
-class MockLeAudioClientCallbacks
+class MockLeAudioSourceHalClient;
+MockLeAudioSourceHalClient* mock_le_audio_source_hal_client_;
+std::unique_ptr<LeAudioSourceAudioHalClient>
+    owned_mock_le_audio_source_hal_client_;
+bool is_audio_unicast_source_acquired;
+
+std::unique_ptr<LeAudioSourceAudioHalClient>
+LeAudioSourceAudioHalClient::AcquireUnicast() {
+  if (is_audio_unicast_source_acquired) return nullptr;
+  is_audio_unicast_source_acquired = true;
+  return std::move(owned_mock_le_audio_source_hal_client_);
+}
+
+void LeAudioSourceAudioHalClient::DebugDump(int fd) {}
+
+class MockLeAudioSinkHalClient;
+MockLeAudioSinkHalClient* mock_le_audio_sink_hal_client_;
+std::unique_ptr<LeAudioSinkAudioHalClient> owned_mock_le_audio_sink_hal_client_;
+bool is_audio_unicast_sink_acquired;
+
+std::unique_ptr<LeAudioSinkAudioHalClient>
+LeAudioSinkAudioHalClient::AcquireUnicast() {
+  if (is_audio_unicast_sink_acquired) return nullptr;
+  is_audio_unicast_sink_acquired = true;
+  return std::move(owned_mock_le_audio_sink_hal_client_);
+}
+
+void LeAudioSinkAudioHalClient::DebugDump(int fd) {}
+
+class MockAudioHalClientCallbacks
     : public bluetooth::le_audio::LeAudioClientCallbacks {
  public:
   MOCK_METHOD((void), OnInitialized, (), (override));
@@ -153,97 +251,95 @@
       (override));
 };
 
-class MockLeAudioClientAudioSink : public LeAudioUnicastClientAudioSink {
+class MockLeAudioSinkHalClient : public LeAudioSinkAudioHalClient {
  public:
+  MockLeAudioSinkHalClient() = default;
   MOCK_METHOD((bool), Start,
               (const LeAudioCodecConfiguration& codecConfiguration,
-               LeAudioClientAudioSourceReceiver* audioReceiver));
-  MOCK_METHOD((void), Stop, ());
-  MOCK_METHOD((const void*), Acquire, ());
-  MOCK_METHOD((void), Release, (const void*));
-  MOCK_METHOD((size_t), SendData, (uint8_t * data, uint16_t size));
-  MOCK_METHOD((void), ConfirmStreamingRequest, ());
-  MOCK_METHOD((void), CancelStreamingRequest, ());
-  MOCK_METHOD((void), UpdateRemoteDelay, (uint16_t delay));
-  MOCK_METHOD((void), DebugDump, (int fd));
-  MOCK_METHOD((void), UpdateAudioConfigToHal,
-              (const ::le_audio::offload_config&));
-};
-
-class MockLeAudioUnicastClientAudioSource
-    : public LeAudioUnicastClientAudioSource {
- public:
-  MOCK_METHOD((bool), Start,
-              (const LeAudioCodecConfiguration& codecConfiguration,
-               LeAudioClientAudioSinkReceiver* audioReceiver),
+               LeAudioSinkAudioHalClient::Callbacks* audioReceiver),
               (override));
   MOCK_METHOD((void), Stop, (), (override));
-  MOCK_METHOD((const void*), Acquire, (), (override));
-  MOCK_METHOD((void), Release, (const void*), (override));
+  MOCK_METHOD((size_t), SendData, (uint8_t * data, uint16_t size), (override));
   MOCK_METHOD((void), ConfirmStreamingRequest, (), (override));
   MOCK_METHOD((void), CancelStreamingRequest, (), (override));
   MOCK_METHOD((void), UpdateRemoteDelay, (uint16_t delay), (override));
-  MOCK_METHOD((void), DebugDump, (int fd));
   MOCK_METHOD((void), UpdateAudioConfigToHal,
               (const ::le_audio::offload_config&), (override));
   MOCK_METHOD((void), SuspendedForReconfiguration, (), (override));
+  MOCK_METHOD((void), ReconfigurationComplete, (), (override));
+
+  MOCK_METHOD((void), OnDestroyed, ());
+  virtual ~MockLeAudioSinkHalClient() override { OnDestroyed(); }
+};
+
+class MockLeAudioSourceHalClient : public LeAudioSourceAudioHalClient {
+ public:
+  MockLeAudioSourceHalClient() = default;
+  MOCK_METHOD((bool), Start,
+              (const LeAudioCodecConfiguration& codecConfiguration,
+               LeAudioSourceAudioHalClient::Callbacks* audioReceiver),
+              (override));
+  MOCK_METHOD((void), Stop, (), (override));
+  MOCK_METHOD((void), ConfirmStreamingRequest, (), (override));
+  MOCK_METHOD((void), CancelStreamingRequest, (), (override));
+  MOCK_METHOD((void), UpdateRemoteDelay, (uint16_t delay), (override));
+  MOCK_METHOD((void), UpdateAudioConfigToHal,
+              (const ::le_audio::offload_config&), (override));
+  MOCK_METHOD((void), UpdateBroadcastAudioConfigToHal,
+              (const ::le_audio::broadcast_offload_config&), (override));
+  MOCK_METHOD((void), SuspendedForReconfiguration, (), (override));
+  MOCK_METHOD((void), ReconfigurationComplete, (), (override));
+
+  MOCK_METHOD((void), OnDestroyed, ());
+  virtual ~MockLeAudioSourceHalClient() override { OnDestroyed(); }
 };
 
 class UnicastTestNoInit : public Test {
  protected:
   void SetUpMockAudioHal() {
-    // Unicast Source
+    bluetooth::common::InitFlags::Load(test_flags);
+
+    /* Since these are returned by the Acquire() methods as unique_ptrs, we
+     * will not free them manually.
+     */
+
+    owned_mock_le_audio_sink_hal_client_.reset(new MockLeAudioSinkHalClient());
+    mock_le_audio_sink_hal_client_ =
+        (MockLeAudioSinkHalClient*)owned_mock_le_audio_sink_hal_client_.get();
+
+    owned_mock_le_audio_source_hal_client_.reset(
+        new MockLeAudioSourceHalClient());
+    mock_le_audio_source_hal_client_ =
+        (MockLeAudioSourceHalClient*)
+            owned_mock_le_audio_source_hal_client_.get();
+
     is_audio_unicast_source_acquired = false;
-    is_audio_broadcast_hal_source_acquired = false;
-
-    ON_CALL(*mock_unicast_audio_source_, Start(_, _))
+    ON_CALL(*mock_le_audio_source_hal_client_, Start(_, _))
         .WillByDefault(
             [this](const LeAudioCodecConfiguration& codec_configuration,
-                   LeAudioClientAudioSinkReceiver* audioReceiver) {
-              audio_unicast_sink_receiver_ = audioReceiver;
+                   LeAudioSourceAudioHalClient::Callbacks* audioReceiver) {
+              unicast_source_hal_cb_ = audioReceiver;
               return true;
             });
-    ON_CALL(*mock_unicast_audio_source_, Acquire)
-        .WillByDefault([this]() -> void* {
-          if (!is_audio_unicast_source_acquired) {
-            is_audio_unicast_source_acquired = true;
-            return mock_unicast_audio_source_;
-          }
-
-          return nullptr;
-        });
-    ON_CALL(*mock_unicast_audio_source_, Release)
-        .WillByDefault([this](const void* inst) -> void {
-          if (is_audio_unicast_source_acquired) {
-            is_audio_unicast_source_acquired = false;
-          }
-        });
-
-    // Sink
-    is_audio_hal_sink_acquired = false;
-
-    ON_CALL(*mock_audio_sink_, Start(_, _))
-        .WillByDefault(
-            [this](const LeAudioCodecConfiguration& codec_configuration,
-                   LeAudioClientAudioSourceReceiver* audioReceiver) {
-              audio_source_receiver_ = audioReceiver;
-              return true;
-            });
-    ON_CALL(*mock_audio_sink_, Acquire).WillByDefault([this]() -> void* {
-      if (!is_audio_hal_sink_acquired) {
-        is_audio_hal_sink_acquired = true;
-        return mock_audio_sink_;
-      }
-
-      return nullptr;
+    ON_CALL(*mock_le_audio_source_hal_client_, OnDestroyed).WillByDefault([]() {
+      mock_le_audio_source_hal_client_ = nullptr;
+      is_audio_unicast_source_acquired = false;
     });
-    ON_CALL(*mock_audio_sink_, Release)
-        .WillByDefault([this](const void* inst) -> void {
-          if (is_audio_hal_sink_acquired) {
-            is_audio_hal_sink_acquired = false;
-          }
-        });
-    ON_CALL(*mock_audio_sink_, SendData)
+
+    is_audio_unicast_sink_acquired = false;
+    ON_CALL(*mock_le_audio_sink_hal_client_, Start(_, _))
+        .WillByDefault(
+            [this](const LeAudioCodecConfiguration& codec_configuration,
+                   LeAudioSinkAudioHalClient::Callbacks* audioReceiver) {
+              unicast_sink_hal_cb_ = audioReceiver;
+              return true;
+            });
+    ON_CALL(*mock_le_audio_sink_hal_client_, OnDestroyed).WillByDefault([]() {
+      mock_le_audio_sink_hal_client_ = nullptr;
+      is_audio_unicast_sink_acquired = false;
+    });
+
+    ON_CALL(*mock_le_audio_sink_hal_client_, SendData)
         .WillByDefault([](uint8_t* data, uint16_t size) { return size; });
 
     // HAL
@@ -438,7 +534,7 @@
         }));
 
     global_conn_id = 1;
-    ON_CALL(mock_gatt_interface_, Open(_, _, true, _))
+    ON_CALL(mock_gatt_interface_, Open(_, _, BTM_BLE_DIRECT_CONNECTION, _))
         .WillByDefault(
             Invoke([&](tGATT_IF client_if, const RawAddress& remote_bda,
                        bool is_direct, bool opportunistic) {
@@ -549,16 +645,36 @@
     ON_CALL(mock_state_machine_, Initialize(_))
         .WillByDefault(SaveArg<0>(&state_machine_callbacks_));
 
-    ON_CALL(mock_state_machine_, ConfigureStream(_, _, _))
+    ON_CALL(mock_state_machine_, ConfigureStream(_, _, _, _))
         .WillByDefault([this](LeAudioDeviceGroup* group,
                               types::LeAudioContextType context_type,
-                              int ccid) {
+                              types::AudioContexts metadata_context_type,
+                              std::vector<uint8_t> ccid_list) {
           bool isReconfiguration = group->IsPendingConfiguration();
 
           /* This shall be called only for user reconfiguration */
           if (!isReconfiguration) return false;
 
-          group->Configure(context_type);
+          /* Do what ReleaseCisIds(group) does: start */
+          LeAudioDevice* leAudioDevice = group->GetFirstDevice();
+          while (leAudioDevice != nullptr) {
+            for (auto& ase : leAudioDevice->ases_) {
+              ase.cis_id = le_audio::kInvalidCisId;
+            }
+            leAudioDevice = group->GetNextDevice(leAudioDevice);
+          }
+          group->CigClearCis();
+          /* end */
+
+          if (!group->Configure(context_type, metadata_context_type,
+                                ccid_list)) {
+            LOG_ERROR("Could not configure ASEs for group %d content type %d",
+                      group->group_id_, int(context_type));
+
+            return false;
+          }
+
+          group->CigGenerateCisIds(context_type);
 
           for (LeAudioDevice* device = group->GetFirstDevice();
                device != nullptr; device = group->GetNextDevice(device)) {
@@ -574,6 +690,7 @@
           group->SetTargetState(
               types::AseState::BTA_LE_AUDIO_ASE_STATE_CODEC_CONFIGURED);
           group->SetState(group->GetTargetState());
+          group->ClearPendingConfiguration();
           do_in_main_thread(
               FROM_HERE, base::BindOnce(
                              [](int group_id,
@@ -589,13 +706,20 @@
         });
 
     ON_CALL(mock_state_machine_, AttachToStream(_, _))
-        .WillByDefault([this](LeAudioDeviceGroup* group,
-                              LeAudioDevice* leAudioDevice) {
+        .WillByDefault([](LeAudioDeviceGroup* group,
+                          LeAudioDevice* leAudioDevice) {
           if (group->GetState() !=
               types::AseState::BTA_LE_AUDIO_ASE_STATE_STREAMING) {
             return false;
           }
+
+          group->Configure(group->GetConfigurationContextType(),
+                           group->GetMetadataContexts(), {});
+          if (!group->CigAssignCisIds(leAudioDevice)) return false;
+          group->CigAssignCisConnHandlesToAses(leAudioDevice);
+
           auto* stream_conf = &group->stream_conf;
+
           for (auto& ase : leAudioDevice->ases_) {
             if (!ase.active) continue;
 
@@ -603,43 +727,115 @@
             // be tested as part of the state machine unit tests
             ase.data_path_state =
                 types::AudioStreamDataPathState::DATA_PATH_ESTABLISHED;
-            ase.cis_conn_hdl = iso_con_counter_++;
-            ase.active = true;
             ase.state = types::AseState::BTA_LE_AUDIO_ASE_STATE_STREAMING;
 
-            /* Copied from state_machine.cc Enabling->Streaming*/
+            uint16_t cis_conn_hdl = ase.cis_conn_hdl;
+
+            /* Copied from state_machine.cc ProcessHciNotifSetupIsoDataPath */
             if (ase.direction == le_audio::types::kLeAudioDirectionSource) {
-              stream_conf->source_streams.emplace_back(
-                  std::make_pair(ase.cis_conn_hdl,
-                                 *ase.codec_config.audio_channel_allocation));
+              auto iter = std::find_if(stream_conf->source_streams.begin(),
+                                       stream_conf->source_streams.end(),
+                                       [cis_conn_hdl](auto& pair) {
+                                         return cis_conn_hdl == pair.first;
+                                       });
+
+              if (iter == stream_conf->source_streams.end()) {
+                stream_conf->source_streams.emplace_back(
+                    std::make_pair(ase.cis_conn_hdl,
+                                   *ase.codec_config.audio_channel_allocation));
+
+                stream_conf->source_num_of_devices++;
+                stream_conf->source_num_of_channels +=
+                    ase.codec_config.channel_count;
+
+                LOG_INFO(
+                    " Added Source Stream Configuration. CIS Connection "
+                    "Handle: %d"
+                    ", Audio Channel Allocation: %d"
+                    ", Source Number Of Devices: %d"
+                    ", Source Number Of Channels: %d",
+                    +ase.cis_conn_hdl,
+                    +(*ase.codec_config.audio_channel_allocation),
+                    +stream_conf->source_num_of_devices,
+                    +stream_conf->source_num_of_channels);
+              }
             } else {
-              stream_conf->sink_streams.emplace_back(
-                  std::make_pair(ase.cis_conn_hdl,
-                                 *ase.codec_config.audio_channel_allocation));
+              auto iter = std::find_if(stream_conf->sink_streams.begin(),
+                                       stream_conf->sink_streams.end(),
+                                       [cis_conn_hdl](auto& pair) {
+                                         return cis_conn_hdl == pair.first;
+                                       });
+
+              if (iter == stream_conf->sink_streams.end()) {
+                stream_conf->sink_streams.emplace_back(
+                    std::make_pair(ase.cis_conn_hdl,
+                                   *ase.codec_config.audio_channel_allocation));
+
+                stream_conf->sink_num_of_devices++;
+                stream_conf->sink_num_of_channels +=
+                    ase.codec_config.channel_count;
+
+                LOG_INFO(
+                    " Added Sink Stream Configuration. CIS Connection Handle: "
+                    "%d"
+                    ", Audio Channel Allocation: %d"
+                    ", Sink Number Of Devices: %d"
+                    ", Sink Number Of Channels: %d",
+                    +ase.cis_conn_hdl,
+                    +(*ase.codec_config.audio_channel_allocation),
+                    +stream_conf->sink_num_of_devices,
+                    +stream_conf->sink_num_of_channels);
+              }
             }
           }
 
           return true;
         });
 
-    ON_CALL(mock_state_machine_, StartStream(_, _, _))
+    ON_CALL(mock_state_machine_, StartStream(_, _, _, _))
         .WillByDefault([this](LeAudioDeviceGroup* group,
                               types::LeAudioContextType context_type,
-                              int ccid) {
-          if (group->GetState() ==
-              types::AseState::BTA_LE_AUDIO_ASE_STATE_STREAMING) {
-            if (group->GetContextType() != context_type) {
-              /* TODO: Switch context of group */
-              group->SetContextType(context_type);
+                              types::AudioContexts metadata_context_type,
+                              std::vector<uint8_t> ccid_list) {
+          /* Do what ReleaseCisIds(group) does: start */
+          LeAudioDevice* leAudioDevice = group->GetFirstDevice();
+          while (leAudioDevice != nullptr) {
+            for (auto& ase : leAudioDevice->ases_) {
+              ase.cis_id = le_audio::kInvalidCisId;
             }
-            return true;
+            leAudioDevice = group->GetNextDevice(leAudioDevice);
+          }
+          group->CigClearCis();
+          /* end */
+
+          if (!group->Configure(context_type, metadata_context_type,
+                                ccid_list)) {
+            LOG(ERROR) << __func__ << ", failed to set ASE configuration";
+            return false;
           }
 
-          group->Configure(context_type);
+          if (group->GetState() ==
+              types::AseState::BTA_LE_AUDIO_ASE_STATE_IDLE) {
+            group->CigGenerateCisIds(context_type);
+
+            std::vector<uint16_t> conn_handles;
+            for (uint8_t i = 0; i < (uint8_t)(group->cises_.size()); i++) {
+              conn_handles.push_back(iso_con_counter_++);
+            }
+            group->CigAssignCisConnHandles(conn_handles);
+            for (LeAudioDevice* device = group->GetFirstActiveDevice();
+                 device != nullptr;
+                 device = group->GetNextActiveDevice(device)) {
+              if (!group->CigAssignCisIds(device)) return false;
+              group->CigAssignCisConnHandlesToAses(device);
+            }
+          }
+
+          auto* stream_conf = &group->stream_conf;
 
           // Fake ASE configuration
-          for (LeAudioDevice* device = group->GetFirstDevice();
-               device != nullptr; device = group->GetNextDevice(device)) {
+          for (LeAudioDevice* device = group->GetFirstActiveDevice();
+               device != nullptr; device = group->GetNextActiveDevice(device)) {
             for (auto& ase : device->ases_) {
               if (!ase.active) continue;
 
@@ -647,9 +843,139 @@
               // be tested as part of the state machine unit tests
               ase.data_path_state =
                   types::AudioStreamDataPathState::DATA_PATH_ESTABLISHED;
-              ase.cis_conn_hdl = iso_con_counter_++;
-              ase.active = true;
               ase.state = types::AseState::BTA_LE_AUDIO_ASE_STATE_STREAMING;
+
+              uint16_t cis_conn_hdl = ase.cis_conn_hdl;
+
+              /* Copied from state_machine.cc ProcessHciNotifSetupIsoDataPath */
+              if (ase.direction == le_audio::types::kLeAudioDirectionSource) {
+                auto iter = std::find_if(stream_conf->source_streams.begin(),
+                                         stream_conf->source_streams.end(),
+                                         [cis_conn_hdl](auto& pair) {
+                                           return cis_conn_hdl == pair.first;
+                                         });
+
+                if (iter == stream_conf->source_streams.end()) {
+                  stream_conf->source_streams.emplace_back(std::make_pair(
+                      ase.cis_conn_hdl,
+                      *ase.codec_config.audio_channel_allocation));
+
+                  stream_conf->source_num_of_devices++;
+                  stream_conf->source_num_of_channels +=
+                      ase.codec_config.channel_count;
+                  stream_conf->source_audio_channel_allocation |=
+                      *ase.codec_config.audio_channel_allocation;
+
+                  if (stream_conf->source_sample_frequency_hz == 0) {
+                    stream_conf->source_sample_frequency_hz =
+                        ase.codec_config.GetSamplingFrequencyHz();
+                  } else {
+                    ASSERT_LOG(stream_conf->source_sample_frequency_hz ==
+                                   ase.codec_config.GetSamplingFrequencyHz(),
+                               "sample freq mismatch: %d!=%d",
+                               stream_conf->source_sample_frequency_hz,
+                               ase.codec_config.GetSamplingFrequencyHz());
+                  }
+
+                  if (stream_conf->source_octets_per_codec_frame == 0) {
+                    stream_conf->source_octets_per_codec_frame =
+                        *ase.codec_config.octets_per_codec_frame;
+                  } else {
+                    ASSERT_LOG(stream_conf->source_octets_per_codec_frame ==
+                                   *ase.codec_config.octets_per_codec_frame,
+                               "octets per frame mismatch: %d!=%d",
+                               stream_conf->source_octets_per_codec_frame,
+                               *ase.codec_config.octets_per_codec_frame);
+                  }
+
+                  if (stream_conf->source_codec_frames_blocks_per_sdu == 0) {
+                    stream_conf->source_codec_frames_blocks_per_sdu =
+                        *ase.codec_config.codec_frames_blocks_per_sdu;
+                  } else {
+                    ASSERT_LOG(
+                        stream_conf->source_codec_frames_blocks_per_sdu ==
+                            *ase.codec_config.codec_frames_blocks_per_sdu,
+                        "codec_frames_blocks_per_sdu: %d!=%d",
+                        stream_conf->source_codec_frames_blocks_per_sdu,
+                        *ase.codec_config.codec_frames_blocks_per_sdu);
+                  }
+
+                  LOG_INFO(
+                      " Added Source Stream Configuration. CIS Connection "
+                      "Handle: %d"
+                      ", Audio Channel Allocation: %d"
+                      ", Source Number Of Devices: %d"
+                      ", Source Number Of Channels: %d",
+                      +ase.cis_conn_hdl,
+                      +(*ase.codec_config.audio_channel_allocation),
+                      +stream_conf->source_num_of_devices,
+                      +stream_conf->source_num_of_channels);
+                }
+              } else {
+                auto iter = std::find_if(stream_conf->sink_streams.begin(),
+                                         stream_conf->sink_streams.end(),
+                                         [cis_conn_hdl](auto& pair) {
+                                           return cis_conn_hdl == pair.first;
+                                         });
+
+                if (iter == stream_conf->sink_streams.end()) {
+                  stream_conf->sink_streams.emplace_back(std::make_pair(
+                      ase.cis_conn_hdl,
+                      *ase.codec_config.audio_channel_allocation));
+
+                  stream_conf->sink_num_of_devices++;
+                  stream_conf->sink_num_of_channels +=
+                      ase.codec_config.channel_count;
+
+                  stream_conf->sink_audio_channel_allocation |=
+                      *ase.codec_config.audio_channel_allocation;
+
+                  if (stream_conf->sink_sample_frequency_hz == 0) {
+                    stream_conf->sink_sample_frequency_hz =
+                        ase.codec_config.GetSamplingFrequencyHz();
+                  } else {
+                    ASSERT_LOG(stream_conf->sink_sample_frequency_hz ==
+                                   ase.codec_config.GetSamplingFrequencyHz(),
+                               "sample freq mismatch: %d!=%d",
+                               stream_conf->sink_sample_frequency_hz,
+                               ase.codec_config.GetSamplingFrequencyHz());
+                  }
+
+                  if (stream_conf->sink_octets_per_codec_frame == 0) {
+                    stream_conf->sink_octets_per_codec_frame =
+                        *ase.codec_config.octets_per_codec_frame;
+                  } else {
+                    ASSERT_LOG(stream_conf->sink_octets_per_codec_frame ==
+                                   *ase.codec_config.octets_per_codec_frame,
+                               "octets per frame mismatch: %d!=%d",
+                               stream_conf->sink_octets_per_codec_frame,
+                               *ase.codec_config.octets_per_codec_frame);
+                  }
+
+                  if (stream_conf->sink_codec_frames_blocks_per_sdu == 0) {
+                    stream_conf->sink_codec_frames_blocks_per_sdu =
+                        *ase.codec_config.codec_frames_blocks_per_sdu;
+                  } else {
+                    ASSERT_LOG(
+                        stream_conf->sink_codec_frames_blocks_per_sdu ==
+                            *ase.codec_config.codec_frames_blocks_per_sdu,
+                        "codec_frames_blocks_per_sdu: %d!=%d",
+                        stream_conf->sink_codec_frames_blocks_per_sdu,
+                        *ase.codec_config.codec_frames_blocks_per_sdu);
+                  }
+
+                  LOG_INFO(
+                      " Added Sink Stream Configuration. CIS Connection "
+                      "Handle: %d"
+                      ", Audio Channel Allocation: %d"
+                      ", Sink Number Of Devices: %d"
+                      ", Sink Number Of Channels: %d",
+                      +ase.cis_conn_hdl,
+                      +(*ase.codec_config.audio_channel_allocation),
+                      +stream_conf->sink_num_of_devices,
+                      +stream_conf->sink_num_of_channels);
+                }
+              }
             }
           }
 
@@ -707,9 +1033,20 @@
             stream_conf->sink_streams.erase(
                 std::remove_if(stream_conf->sink_streams.begin(),
                                stream_conf->sink_streams.end(),
-                               [leAudioDevice](auto& pair) {
+                               [leAudioDevice, &stream_conf](auto& pair) {
                                  auto ases = leAudioDevice->GetAsesByCisConnHdl(
                                      pair.first);
+                                 if (ases.sink) {
+                                   stream_conf->sink_num_of_devices--;
+                                   stream_conf->sink_num_of_channels -=
+                                       ases.sink->codec_config.channel_count;
+
+                                   LOG_INFO(
+                                       ", Source Number Of Devices: %d"
+                                       ", Source Number Of Channels: %d",
+                                       +stream_conf->source_num_of_devices,
+                                       +stream_conf->source_num_of_channels);
+                                 }
                                  return ases.sink;
                                }),
                 stream_conf->sink_streams.end());
@@ -717,14 +1054,27 @@
             stream_conf->source_streams.erase(
                 std::remove_if(stream_conf->source_streams.begin(),
                                stream_conf->source_streams.end(),
-                               [leAudioDevice](auto& pair) {
+                               [leAudioDevice, &stream_conf](auto& pair) {
                                  auto ases = leAudioDevice->GetAsesByCisConnHdl(
                                      pair.first);
+                                 if (ases.source) {
+                                   stream_conf->source_num_of_devices--;
+                                   stream_conf->source_num_of_channels -=
+                                       ases.source->codec_config.channel_count;
+
+                                   LOG_INFO(
+                                       ", Source Number Of Devices: %d"
+                                       ", Source Number Of Channels: %d",
+                                       +stream_conf->source_num_of_devices,
+                                       +stream_conf->source_num_of_channels);
+                                 }
                                  return ases.source;
                                }),
                 stream_conf->source_streams.end());
           }
 
+          group->CigUnassignCis(leAudioDevice);
+
           if (group->IsEmpty()) {
             group->cig_state_ = le_audio::types::CigState::NONE;
             InjectCigRemoved(group->group_id_);
@@ -756,13 +1106,25 @@
                     std::remove_if(
                         stream_conf->sink_streams.begin(),
                         stream_conf->sink_streams.end(),
-                        [leAudioDevice](auto& pair) {
+                        [leAudioDevice, &stream_conf](auto& pair) {
                           auto ases =
                               leAudioDevice->GetAsesByCisConnHdl(pair.first);
-                          LOG(INFO) << __func__
-                                    << " sink ase to delete. Cis handle:  "
-                                    << (int)(pair.first)
-                                    << " ase pointer: " << ases.sink;
+
+                          LOG_INFO(
+                              ", sink ase to delete. Cis handle: %d"
+                              ", ase pointer: %p",
+                              +(int)(pair.first), +ases.sink);
+                          if (ases.sink) {
+                            stream_conf->sink_num_of_devices--;
+                            stream_conf->sink_num_of_channels -=
+                                ases.sink->codec_config.channel_count;
+
+                            LOG_INFO(
+                                " Sink Number Of Devices: %d"
+                                ", Sink Number Of Channels: %d",
+                                +stream_conf->sink_num_of_devices,
+                                +stream_conf->sink_num_of_channels);
+                          }
                           return ases.sink;
                         }),
                     stream_conf->sink_streams.end());
@@ -771,27 +1133,101 @@
                     std::remove_if(
                         stream_conf->source_streams.begin(),
                         stream_conf->source_streams.end(),
-                        [leAudioDevice](auto& pair) {
+                        [leAudioDevice, &stream_conf](auto& pair) {
                           auto ases =
                               leAudioDevice->GetAsesByCisConnHdl(pair.first);
-                          LOG(INFO)
-                              << __func__ << " source to delete. Cis handle: "
-                              << (int)(pair.first)
-                              << " ase pointer:  " << ases.source;
+
+                          LOG_INFO(
+                              ", source to delete. Cis handle: %d"
+                              ", ase pointer: %p",
+                              +(int)(pair.first), ases.source);
+                          if (ases.source) {
+                            stream_conf->source_num_of_devices--;
+                            stream_conf->source_num_of_channels -=
+                                ases.source->codec_config.channel_count;
+
+                            LOG_INFO(
+                                ", Source Number Of Devices: %d"
+                                ", Source Number Of Channels: %d",
+                                +stream_conf->source_num_of_devices,
+                                +stream_conf->source_num_of_channels);
+                          }
                           return ases.source;
                         }),
                     stream_conf->source_streams.end());
               }
+
+              group->CigUnassignCis(leAudioDevice);
             });
 
     ON_CALL(mock_state_machine_, StopStream(_))
         .WillByDefault([this](LeAudioDeviceGroup* group) {
           for (LeAudioDevice* device = group->GetFirstDevice();
                device != nullptr; device = group->GetNextDevice(device)) {
+            /* Invalidate stream configuration if needed */
+            auto* stream_conf = &group->stream_conf;
+            if (!stream_conf->sink_streams.empty() ||
+                !stream_conf->source_streams.empty()) {
+              stream_conf->sink_streams.erase(
+                  std::remove_if(stream_conf->sink_streams.begin(),
+                                 stream_conf->sink_streams.end(),
+                                 [device, &stream_conf](auto& pair) {
+                                   auto ases =
+                                       device->GetAsesByCisConnHdl(pair.first);
+
+                                   LOG_INFO(
+                                       ", sink ase to delete. Cis handle: %d"
+                                       ", ase pointer: %p",
+                                       +(int)(pair.first), +ases.sink);
+                                   if (ases.sink) {
+                                     stream_conf->sink_num_of_devices--;
+                                     stream_conf->sink_num_of_channels -=
+                                         ases.sink->codec_config.channel_count;
+
+                                     LOG_INFO(
+                                         " Sink Number Of Devices: %d"
+                                         ", Sink Number Of Channels: %d",
+                                         +stream_conf->sink_num_of_devices,
+                                         +stream_conf->sink_num_of_channels);
+                                   }
+                                   return ases.sink;
+                                 }),
+                  stream_conf->sink_streams.end());
+
+              stream_conf->source_streams.erase(
+                  std::remove_if(
+                      stream_conf->source_streams.begin(),
+                      stream_conf->source_streams.end(),
+                      [device, &stream_conf](auto& pair) {
+                        auto ases = device->GetAsesByCisConnHdl(pair.first);
+
+                        LOG_INFO(
+                            ", source to delete. Cis handle: %d"
+                            ", ase pointer: %p",
+                            +(int)(pair.first), +ases.source);
+                        if (ases.source) {
+                          stream_conf->source_num_of_devices--;
+                          stream_conf->source_num_of_channels -=
+                              ases.source->codec_config.channel_count;
+
+                          LOG_INFO(
+                              ", Source Number Of Devices: %d"
+                              ", Source Number Of Channels: %d",
+                              +stream_conf->source_num_of_devices,
+                              +stream_conf->source_num_of_channels);
+                        }
+                        return ases.source;
+                      }),
+                  stream_conf->source_streams.end());
+            }
+
+            group->CigUnassignCis(device);
+
             for (auto& ase : device->ases_) {
               ase.data_path_state = types::AudioStreamDataPathState::IDLE;
               ase.active = false;
               ase.state = types::AseState::BTA_LE_AUDIO_ASE_STATE_IDLE;
+              ase.cis_id = 0;
               ase.cis_conn_hdl = 0;
             }
           }
@@ -828,20 +1264,31 @@
     ON_CALL(*mock_iso_manager_, RegisterCigCallbacks(_))
         .WillByDefault(SaveArg<0>(&cig_callbacks_));
 
-    mock_unicast_audio_source_ = new MockLeAudioUnicastClientAudioSource();
-    mock_audio_sink_ = new MockLeAudioClientAudioSink();
-    LeAudioClient::InitializeAudioClients(mock_unicast_audio_source_,
-                                          mock_audio_sink_);
-
     SetUpMockAudioHal();
     SetUpMockGroups();
     SetUpMockGatt();
 
+    supported_snk_context_types_ = 0xffff;
+    supported_src_context_types_ = 0xffff;
     le_audio::AudioSetConfigurationProvider::Initialize();
     ASSERT_FALSE(LeAudioClient::IsLeAudioClientRunning());
   }
 
   void TearDown() override {
+    if (is_audio_unicast_source_acquired) {
+      if (unicast_source_hal_cb_ != nullptr) {
+        EXPECT_CALL(*mock_le_audio_source_hal_client_, Stop).Times(1);
+      }
+      EXPECT_CALL(*mock_le_audio_source_hal_client_, OnDestroyed()).Times(1);
+    }
+
+    if (is_audio_unicast_sink_acquired) {
+      if (unicast_sink_hal_cb_ != nullptr) {
+        EXPECT_CALL(*mock_le_audio_sink_hal_client_, Stop).Times(1);
+      }
+      EXPECT_CALL(*mock_le_audio_sink_hal_client_, OnDestroyed()).Times(1);
+    }
+
     // Message loop cleanup should wait for all the 'till now' scheduled calls
     // so it should be called right at the very begginning of teardown.
     cleanup_message_loop_thread();
@@ -849,7 +1296,7 @@
     // This is required since Stop() and Cleanup() may trigger some callbacks or
     // drop unique pointers to mocks we have raw pointer for and we want to
     // verify them all.
-    Mock::VerifyAndClearExpectations(&mock_client_callbacks_);
+    Mock::VerifyAndClearExpectations(&mock_audio_hal_client_callbacks_);
 
     if (LeAudioClient::IsLeAudioClientRunning()) {
       EXPECT_CALL(mock_gatt_interface_, AppDeregister(gatt_if)).Times(1);
@@ -946,10 +1393,10 @@
 
     struct ascs_mock : public IGattHandlers {
       uint16_t start = 0;
-      uint16_t sink_ase_char = 0;
-      uint16_t sink_ase_ccc = 0;
-      uint16_t source_ase_char = 0;
-      uint16_t source_ase_ccc = 0;
+      uint16_t sink_ase_char[max_num_of_ases] = {0};
+      uint16_t sink_ase_ccc[max_num_of_ases] = {0};
+      uint16_t source_ase_char[max_num_of_ases] = {0};
+      uint16_t source_ase_ccc[max_num_of_ases] = {0};
       uint16_t ctp_char = 0;
       uint16_t ctp_ccc = 0;
       uint16_t end = 0;
@@ -1007,19 +1454,22 @@
     ON_CALL(mock_btm_interface_, BTM_IsEncrypted(address, _))
         .WillByDefault(DoAll(Return(isEncrypted)));
 
-    EXPECT_CALL(mock_gatt_interface_, Open(gatt_if, address, true, _)).Times(1);
+    EXPECT_CALL(mock_gatt_interface_,
+                Open(gatt_if, address, BTM_BLE_DIRECT_CONNECTION, _))
+        .Times(1);
 
     do_in_main_thread(
         FROM_HERE, base::Bind(&LeAudioClient::Connect,
                               base::Unretained(LeAudioClient::Get()), address));
 
     SyncOnMainLoop();
+    Mock::VerifyAndClearExpectations(&mock_gatt_interface_);
   }
 
   void DisconnectLeAudio(const RawAddress& address, uint16_t conn_id) {
     SyncOnMainLoop();
     EXPECT_CALL(mock_gatt_interface_, Close(conn_id)).Times(1);
-    EXPECT_CALL(mock_client_callbacks_,
+    EXPECT_CALL(mock_audio_hal_client_callbacks_,
                 OnConnectionState(ConnectionState::DISCONNECTED, address))
         .Times(1);
     do_in_main_thread(
@@ -1034,19 +1484,20 @@
                          bool connect_through_csis = false,
                          bool new_device = true) {
     SetSampleDatabaseEarbudsValid(conn_id, addr, sink_audio_allocation,
-                                  source_audio_allocation,
+                                  source_audio_allocation, default_channel_cnt,
+                                  default_channel_cnt,
                                   0x0004, /* source sample freq 16khz */
                                   true,   /*add_csis*/
                                   true,   /*add_cas*/
                                   true,   /*add_pacs*/
                                   true,   /*add_ascs*/
                                   group_size, rank);
-    EXPECT_CALL(mock_client_callbacks_,
+    EXPECT_CALL(mock_audio_hal_client_callbacks_,
                 OnConnectionState(ConnectionState::CONNECTED, addr))
         .Times(1);
 
     if (new_device) {
-      EXPECT_CALL(mock_client_callbacks_,
+      EXPECT_CALL(mock_audio_hal_client_callbacks_,
                   OnGroupNodeStatus(addr, group_id, GroupNodeStatus::ADDED))
           .Times(1);
     }
@@ -1071,13 +1522,14 @@
                             uint32_t sink_audio_allocation,
                             uint32_t source_audio_allocation) {
     SetSampleDatabaseEarbudsValid(
-        conn_id, addr, sink_audio_allocation, source_audio_allocation, 0x0004,
+        conn_id, addr, sink_audio_allocation, source_audio_allocation,
+        default_channel_cnt, default_channel_cnt, 0x0004,
         /* source sample freq 16khz */ false, /*add_csis*/
         true,                                 /*add_cas*/
         true,                                 /*add_pacs*/
         true,                                 /*add_ascs*/
         0, 0);
-    EXPECT_CALL(mock_client_callbacks_,
+    EXPECT_CALL(mock_audio_hal_client_callbacks_,
                 OnConnectionState(ConnectionState::CONNECTED, addr))
         .Times(1);
 
@@ -1086,71 +1538,63 @@
 
   void UpdateMetadata(audio_usage_t usage, audio_content_type_t content_type,
                       bool reconfigure_existing_stream = false) {
-    std::promise<void> do_metadata_update_promise;
+    std::vector<struct playback_track_metadata> source_metadata = {
+        {{AUDIO_USAGE_UNKNOWN, AUDIO_CONTENT_TYPE_UNKNOWN, 0},
+         {AUDIO_USAGE_UNKNOWN, AUDIO_CONTENT_TYPE_UNKNOWN, 0}}};
 
-    struct playback_track_metadata tracks_[2] = {
-        {AUDIO_USAGE_UNKNOWN, AUDIO_CONTENT_TYPE_UNKNOWN, 0},
-        {AUDIO_USAGE_UNKNOWN, AUDIO_CONTENT_TYPE_UNKNOWN, 0}};
-
-    source_metadata_t source_metadata = {.track_count = 1,
-                                         .tracks = &tracks_[0]};
-
-    tracks_[0].usage = usage;
-    tracks_[0].content_type = content_type;
+    source_metadata[0].usage = usage;
+    source_metadata[0].content_type = content_type;
 
     if (reconfigure_existing_stream) {
-      EXPECT_CALL(*mock_unicast_audio_source_, SuspendedForReconfiguration())
+      Expectation reconfigure = EXPECT_CALL(*mock_le_audio_source_hal_client_,
+                                            SuspendedForReconfiguration())
+                                    .Times(1);
+      EXPECT_CALL(*mock_le_audio_source_hal_client_, CancelStreamingRequest())
           .Times(1);
-      EXPECT_CALL(*mock_unicast_audio_source_, ConfirmStreamingRequest())
-          .Times(1);
+      EXPECT_CALL(*mock_le_audio_source_hal_client_, ReconfigurationComplete())
+          .Times(1)
+          .After(reconfigure);
     } else {
-      EXPECT_CALL(*mock_unicast_audio_source_, SuspendedForReconfiguration())
+      EXPECT_CALL(*mock_le_audio_source_hal_client_,
+                  SuspendedForReconfiguration())
+          .Times(0);
+      EXPECT_CALL(*mock_le_audio_source_hal_client_, ReconfigurationComplete())
           .Times(0);
     }
 
-    auto do_metadata_update_future = do_metadata_update_promise.get_future();
-    audio_unicast_sink_receiver_->OnAudioMetadataUpdate(
-        std::move(do_metadata_update_promise), source_metadata);
-    do_metadata_update_future.wait();
+    ASSERT_NE(unicast_source_hal_cb_, nullptr);
+    unicast_source_hal_cb_->OnAudioMetadataUpdate(source_metadata);
   }
 
   void UpdateSourceMetadata(audio_source_t audio_source) {
-    std::promise<void> do_metadata_update_promise;
+    std::vector<struct record_track_metadata> sink_metadata = {
+        {{AUDIO_SOURCE_INVALID, 0.5, AUDIO_DEVICE_NONE, "00:11:22:33:44:55"},
+         {AUDIO_SOURCE_MIC, 0.7, AUDIO_DEVICE_OUT_BLE_HEADSET,
+          "AA:BB:CC:DD:EE:FF"}}};
 
-    struct record_track_metadata tracks_[2] = {
-        {AUDIO_SOURCE_INVALID, 0.5, AUDIO_DEVICE_NONE, "00:11:22:33:44:55"},
-        {AUDIO_SOURCE_MIC, 0.7, AUDIO_DEVICE_OUT_BLE_HEADSET,
-         "AA:BB:CC:DD:EE:FF"}};
-
-    sink_metadata_t sink_metadata = {.track_count = 2, .tracks = tracks_};
-
-    tracks_[1].source = audio_source;
-
-    auto do_metadata_update_future = do_metadata_update_promise.get_future();
-    audio_source_receiver_->OnAudioMetadataUpdate(
-        std::move(do_metadata_update_promise), sink_metadata);
-    do_metadata_update_future.wait();
+    sink_metadata[1].source = audio_source;
+    unicast_sink_hal_cb_->OnAudioMetadataUpdate(sink_metadata);
   }
 
   void SinkAudioResume(void) {
-    EXPECT_CALL(*mock_unicast_audio_source_, ConfirmStreamingRequest())
+    EXPECT_CALL(*mock_le_audio_source_hal_client_, ConfirmStreamingRequest())
         .Times(1);
     do_in_main_thread(FROM_HERE,
                       base::BindOnce(
-                          [](LeAudioClientAudioSinkReceiver* sink_receiver) {
-                            sink_receiver->OnAudioResume();
+                          [](LeAudioSourceAudioHalClient::Callbacks* cb) {
+                            cb->OnAudioResume();
                           },
-                          audio_unicast_sink_receiver_));
+                          unicast_source_hal_cb_));
 
     SyncOnMainLoop();
-    Mock::VerifyAndClearExpectations(mock_unicast_audio_source_);
+    Mock::VerifyAndClearExpectations(&*mock_le_audio_source_hal_client_);
   }
 
   void StartStreaming(audio_usage_t usage, audio_content_type_t content_type,
                       int group_id,
                       audio_source_t audio_source = AUDIO_SOURCE_INVALID,
                       bool reconfigure_existing_stream = false) {
-    ASSERT_NE(audio_unicast_sink_receiver_, nullptr);
+    ASSERT_NE(unicast_source_hal_cb_, nullptr);
 
     UpdateMetadata(usage, content_type, reconfigure_existing_stream);
     if (audio_source != AUDIO_SOURCE_INVALID) {
@@ -1166,18 +1610,18 @@
 
     if (usage == AUDIO_USAGE_VOICE_COMMUNICATION ||
         audio_source != AUDIO_SOURCE_INVALID) {
-      ASSERT_NE(audio_source_receiver_, nullptr);
-      do_in_main_thread(
-          FROM_HERE, base::BindOnce(
-                         [](LeAudioClientAudioSourceReceiver* source_receiver) {
-                           source_receiver->OnAudioResume();
-                         },
-                         audio_source_receiver_));
+      ASSERT_NE(unicast_sink_hal_cb_, nullptr);
+      do_in_main_thread(FROM_HERE,
+                        base::BindOnce(
+                            [](LeAudioSinkAudioHalClient::Callbacks* cb) {
+                              cb->OnAudioResume();
+                            },
+                            unicast_sink_hal_cb_));
     }
   }
 
   void StopStreaming(int group_id, bool suspend_source = false) {
-    ASSERT_NE(audio_unicast_sink_receiver_, nullptr);
+    ASSERT_NE(unicast_source_hal_cb_, nullptr);
 
     /* TODO We should have a way to confirm Stop() otherwise, audio framework
      * might have different state that it is in the le_audio code - as tearing
@@ -1192,15 +1636,14 @@
      * If there will be such test oriented scenario, such resume choose logic
      * should be applied.
      */
-    audio_unicast_sink_receiver_->OnAudioSuspend(
-        std::move(do_suspend_sink_promise));
+    unicast_source_hal_cb_->OnAudioSuspend(std::move(do_suspend_sink_promise));
     do_suspend_sink_future.wait();
 
     if (suspend_source) {
-      ASSERT_NE(audio_source_receiver_, nullptr);
+      ASSERT_NE(unicast_sink_hal_cb_, nullptr);
       std::promise<void> do_suspend_source_promise;
       auto do_suspend_source_future = do_suspend_source_promise.get_future();
-      audio_source_receiver_->OnAudioSuspend(
+      unicast_sink_hal_cb_->OnAudioSuspend(
           std::move(do_suspend_source_promise));
       do_suspend_source_future.wait();
     }
@@ -1343,21 +1786,25 @@
       bob.AddService(ascs->start, ascs->end,
                      le_audio::uuid::kAudioStreamControlServiceUuid,
                      is_primary);
-      if (ascs->sink_ase_char) {
-        bob.AddCharacteristic(ascs->sink_ase_char, ascs->sink_ase_char + 1,
-                              le_audio::uuid::kSinkAudioStreamEndpointUuid,
-                              GATT_CHAR_PROP_BIT_READ);
-        if (ascs->sink_ase_ccc)
-          bob.AddDescriptor(ascs->sink_ase_ccc,
-                            Uuid::From16Bit(GATT_UUID_CHAR_CLIENT_CONFIG));
-      }
-      if (ascs->source_ase_char) {
-        bob.AddCharacteristic(ascs->source_ase_char, ascs->source_ase_char + 1,
-                              le_audio::uuid::kSourceAudioStreamEndpointUuid,
-                              GATT_CHAR_PROP_BIT_READ);
-        if (ascs->source_ase_ccc)
-          bob.AddDescriptor(ascs->source_ase_ccc,
-                            Uuid::From16Bit(GATT_UUID_CHAR_CLIENT_CONFIG));
+      for (int i = 0; i < max_num_of_ases; i++) {
+        if (ascs->sink_ase_char[i]) {
+          bob.AddCharacteristic(ascs->sink_ase_char[i],
+                                ascs->sink_ase_char[i] + 1,
+                                le_audio::uuid::kSinkAudioStreamEndpointUuid,
+                                GATT_CHAR_PROP_BIT_READ);
+          if (ascs->sink_ase_ccc[i])
+            bob.AddDescriptor(ascs->sink_ase_ccc[i],
+                              Uuid::From16Bit(GATT_UUID_CHAR_CLIENT_CONFIG));
+        }
+        if (ascs->source_ase_char[i]) {
+          bob.AddCharacteristic(ascs->source_ase_char[i],
+                                ascs->source_ase_char[i] + 1,
+                                le_audio::uuid::kSourceAudioStreamEndpointUuid,
+                                GATT_CHAR_PROP_BIT_READ);
+          if (ascs->source_ase_ccc[i])
+            bob.AddDescriptor(ascs->source_ase_ccc[i],
+                              Uuid::From16Bit(GATT_UUID_CHAR_CLIENT_CONFIG));
+        }
       }
       if (ascs->ctp_char) {
         bob.AddCharacteristic(
@@ -1386,13 +1833,12 @@
                         std::move(ascs), std::move(pacs));
   }
 
-  void SetSampleDatabaseEarbudsValid(uint16_t conn_id, RawAddress addr,
-                                     uint32_t sink_audio_allocation,
-                                     uint32_t source_audio_allocation,
-                                     uint16_t sample_freq_mask = 0x0004,
-                                     bool add_csis = true, bool add_cas = true,
-                                     bool add_pacs = true, bool add_ascs = true,
-                                     uint8_t set_size = 2, uint8_t rank = 1) {
+  void SetSampleDatabaseEarbudsValid(
+      uint16_t conn_id, RawAddress addr, uint32_t sink_audio_allocation,
+      uint32_t source_audio_allocation, uint8_t sink_channel_cnt = 0x03,
+      uint8_t source_channel_cnt = 0x03, uint16_t sample_freq_mask = 0x0004,
+      bool add_csis = true, bool add_cas = true, bool add_pacs = true,
+      int add_ascs_cnt = 1, uint8_t set_size = 2, uint8_t rank = 1) {
     auto csis = std::make_unique<MockDeviceWrapper::csis_mock>();
     if (add_csis) {
       // attribute handles
@@ -1440,16 +1886,30 @@
     }
 
     auto ascs = std::make_unique<MockDeviceWrapper::ascs_mock>();
-    if (add_ascs) {
+    if (add_ascs_cnt > 0) {
       // attribute handles
       ascs->start = 0x0090;
-      ascs->sink_ase_char = 0x0091;
-      ascs->sink_ase_ccc = 0x0093;
-      ascs->source_ase_char = 0x0094;
-      ascs->source_ase_ccc = 0x0096;
-      ascs->ctp_char = 0x0097;
-      ascs->ctp_ccc = 0x0099;
-      ascs->end = 0x00A0;
+      uint16_t handle = 0x0091;
+      for (int i = 0; i < add_ascs_cnt; i++) {
+        if (sink_audio_allocation != 0) {
+          ascs->sink_ase_char[i] = handle;
+          handle += 2;
+          ascs->sink_ase_ccc[i] = handle;
+          handle++;
+        }
+
+        if (source_audio_allocation != 0) {
+          ascs->source_ase_char[i] = handle;
+          handle += 2;
+          ascs->source_ase_ccc[i] = handle;
+          handle++;
+        }
+      }
+      ascs->ctp_char = handle;
+      handle += 2;
+      ascs->ctp_ccc = handle;
+      handle++;
+      ascs->end = handle;
       // other params
     }
 
@@ -1477,7 +1937,8 @@
       // Set pacs default read values
       ON_CALL(*peer_devices.at(conn_id)->pacs, OnReadCharacteristic(_, _, _))
           .WillByDefault(
-              [this, conn_id, snk_allocation, src_allocation, sample_freq](
+              [this, conn_id, snk_allocation, src_allocation, sample_freq,
+               sink_channel_cnt, source_channel_cnt](
                   uint16_t handle, GATT_READ_OP_CB cb, void* cb_data) {
                 auto& pacs = peer_devices.at(conn_id)->pacs;
                 std::vector<uint8_t> value;
@@ -1493,16 +1954,16 @@
                       0x00,
                       // Codec Spec. Caps. Len
                       0x10,
-                      0x03,
+                      0x03, /* sample freq */
                       0x01,
                       sample_freq[0],
                       sample_freq[1],
                       0x02,
-                      0x02,
+                      0x02, /* frame duration */
                       0x03,
-                      0x02,
+                      0x02, /* channel count */
                       0x03,
-                      0x03,
+                      sink_channel_cnt,
                       0x05,
                       0x04,
                       0x1E,
@@ -1519,17 +1980,17 @@
                       0x00,
                       // Codec Spec. Caps. Len
                       0x10,
-                      0x03,
+                      0x03, /* sample freq */
                       0x01,
                       0x80,
                       0x00,
-                      0x02,
+                      0x02, /* frame duration */
                       0x02,
                       0x03,
-                      0x02,
+                      0x02, /* channel count */
                       0x03,
-                      0x03,
-                      0x05,
+                      sink_channel_cnt,
+                      0x05, /* octects per frame */
                       0x04,
                       0x78,
                       0x00,
@@ -1567,7 +2028,7 @@
                       0x03,
                       0x02,
                       0x03,
-                      0x03,
+                      source_channel_cnt,
                       0x05,
                       0x04,
                       0x1E,
@@ -1593,7 +2054,7 @@
                       0x03,
                       0x02,
                       0x03,
-                      0x03,
+                      source_channel_cnt,
                       0x05,
                       0x04,
                       0x1E,
@@ -1614,20 +2075,20 @@
                 } else if (handle == pacs->avail_contexts_char + 1) {
                   value = {
                       // Sink Avail Contexts
-                      0xff,
-                      0xff,
+                      (uint8_t)(supported_snk_context_types_ >> 8),
+                      (uint8_t)(supported_snk_context_types_),
                       // Source Avail Contexts
-                      0xff,
-                      0xff,
+                      (uint8_t)(supported_src_context_types_ >> 8),
+                      (uint8_t)(supported_src_context_types_),
                   };
                 } else if (handle == pacs->supp_contexts_char + 1) {
                   value = {
                       // Sink Avail Contexts
-                      0xff,
-                      0xff,
+                      (uint8_t)(supported_snk_context_types_ >> 8),
+                      (uint8_t)(supported_snk_context_types_),
                       // Source Avail Contexts
-                      0xff,
-                      0xff,
+                      (uint8_t)(supported_src_context_types_ >> 8),
+                      (uint8_t)(supported_src_context_types_),
                   };
                 }
                 cb(conn_id, GATT_SUCCESS, handle, value.size(), value.data(),
@@ -1635,26 +2096,40 @@
               });
     }
 
-    if (add_ascs) {
+    if (add_ascs_cnt > 0) {
       // Set ascs default read values
       ON_CALL(*peer_devices.at(conn_id)->ascs, OnReadCharacteristic(_, _, _))
           .WillByDefault([this, conn_id](uint16_t handle, GATT_READ_OP_CB cb,
                                          void* cb_data) {
             auto& ascs = peer_devices.at(conn_id)->ascs;
             std::vector<uint8_t> value;
-            if (handle == ascs->sink_ase_char + 1) {
+            bool is_ase_sink_request = false;
+            bool is_ase_src_request = false;
+            uint8_t idx;
+            for (idx = 0; idx < max_num_of_ases; idx++) {
+              if (handle == ascs->sink_ase_char[idx] + 1) {
+                is_ase_sink_request = true;
+                break;
+              }
+              if (handle == ascs->source_ase_char[idx] + 1) {
+                is_ase_src_request = true;
+                break;
+              }
+            }
+
+            if (is_ase_sink_request) {
               value = {
                   // ASE ID
-                  0x01,
+                  static_cast<uint8_t>(idx + 1),
                   // State
                   static_cast<uint8_t>(
                       le_audio::types::AseState::BTA_LE_AUDIO_ASE_STATE_IDLE),
                   // No Additional ASE params for IDLE state
               };
-            } else if (handle == ascs->source_ase_char + 1) {
+            } else if (is_ase_src_request) {
               value = {
                   // ASE ID
-                  0x02,
+                  static_cast<uint8_t>(idx + 6),
                   // State
                   static_cast<uint8_t>(
                       le_audio::types::AseState::BTA_LE_AUDIO_ASE_STATE_IDLE),
@@ -1670,7 +2145,7 @@
   void TestAudioDataTransfer(int group_id, uint8_t cis_count_out,
                              uint8_t cis_count_in, int data_len,
                              int in_data_len = 40) {
-    ASSERT_NE(audio_unicast_sink_receiver_, nullptr);
+    ASSERT_NE(unicast_source_hal_cb_, nullptr);
 
     // Expect two channels ISO Data to be sent
     std::vector<uint16_t> handles;
@@ -1680,15 +2155,15 @@
             [&handles](uint16_t iso_handle, const uint8_t* data,
                        uint16_t data_len) { handles.push_back(iso_handle); });
     std::vector<uint8_t> data(data_len);
-    audio_unicast_sink_receiver_->OnAudioDataReady(data);
+    unicast_source_hal_cb_->OnAudioDataReady(data);
 
     // Inject microphone data from group
-    EXPECT_CALL(*mock_audio_sink_, SendData(_, _))
+    EXPECT_CALL(*mock_le_audio_sink_hal_client_, SendData(_, _))
         .Times(cis_count_in > 0 ? 1 : 0);
     ASSERT_EQ(streaming_groups.count(group_id), 1u);
 
     if (cis_count_in) {
-      ASSERT_NE(audio_source_receiver_, nullptr);
+      ASSERT_NE(unicast_sink_hal_cb_, nullptr);
 
       auto group = streaming_groups.at(group_id);
       for (LeAudioDevice* device = group->GetFirstDevice(); device != nullptr;
@@ -1706,13 +2181,10 @@
 
     SyncOnMainLoop();
     std::sort(handles.begin(), handles.end());
-    ASSERT_EQ(std::unique(handles.begin(), handles.end()) - handles.begin(),
-              cis_count_out);
     ASSERT_EQ(cis_count_in, 0);
     handles.clear();
 
     Mock::VerifyAndClearExpectations(mock_iso_manager_);
-    Mock::VerifyAndClearExpectations(mock_audio_sink_);
   }
 
   void InjectIncomingIsoData(uint16_t cig_id, uint16_t cis_con_hdl,
@@ -1757,16 +2229,12 @@
         bluetooth::hci::iso_manager::kIsoEventCigOnRemoveCmpl, &evt);
   }
 
-  MockLeAudioClientCallbacks mock_client_callbacks_;
-  MockLeAudioUnicastClientAudioSource* mock_unicast_audio_source_;
-  MockLeAudioClientAudioSink* mock_audio_sink_;
-  LeAudioClientAudioSinkReceiver* audio_unicast_sink_receiver_ = nullptr;
-  LeAudioClientAudioSinkReceiver* audio_broadcast_sink_receiver_ = nullptr;
-  LeAudioClientAudioSourceReceiver* audio_source_receiver_ = nullptr;
+  MockAudioHalClientCallbacks mock_audio_hal_client_callbacks_;
+  LeAudioSourceAudioHalClient::Callbacks* unicast_source_hal_cb_ = nullptr;
+  LeAudioSinkAudioHalClient::Callbacks* unicast_sink_hal_cb_ = nullptr;
 
-  bool is_audio_unicast_source_acquired;
-  bool is_audio_broadcast_hal_source_acquired;
-  bool is_audio_hal_sink_acquired;
+  uint8_t default_channel_cnt = 0x03;
+  uint8_t default_ase_cnt = 1;
 
   MockCsisClient mock_csis_client_module_;
   MockDeviceGroups mock_groups_module_;
@@ -1791,6 +2259,9 @@
   bluetooth::hci::iso_manager::CigCallbacks* cig_callbacks_ = nullptr;
   uint16_t iso_con_counter_ = 1;
 
+  uint16_t supported_snk_context_types_ = 0xffff;
+  uint16_t supported_src_context_types_ = 0xffff;
+
   bluetooth::storage::MockBtifStorageInterface mock_btif_storage_;
 
   std::map<uint16_t, std::unique_ptr<MockDeviceWrapper>> peer_devices;
@@ -1813,7 +2284,7 @@
         .WillOnce(DoAll(SaveArg<0>(&gatt_callback),
                         SaveArg<1>(&app_register_callback)));
     LeAudioClient::Initialize(
-        &mock_client_callbacks_,
+        &mock_audio_hal_client_callbacks_,
         base::Bind([](MockFunction<void()>* foo) { foo->Call(); },
                    &mock_storage_load),
         base::Bind([](MockFunction<bool()>* foo) { return foo->Call(); },
@@ -1862,7 +2333,7 @@
 
   EXPECT_DEATH(
       LeAudioClient::Initialize(
-          &mock_client_callbacks_,
+          &mock_audio_hal_client_callbacks_,
           base::Bind([](MockFunction<void()>* foo) { foo->Call(); },
                      &mock_storage_load),
           base::Bind([](MockFunction<bool()>* foo) { return foo->Call(); },
@@ -1875,7 +2346,7 @@
 TEST_F(UnicastTest, ConnectOneEarbudEmpty) {
   const RawAddress test_address0 = GetTestAddress(0);
   SetSampleDatabaseEmpty(1, test_address0);
-  EXPECT_CALL(mock_client_callbacks_,
+  EXPECT_CALL(mock_audio_hal_client_callbacks_,
               OnConnectionState(ConnectionState::DISCONNECTED, test_address0))
       .Times(1);
   EXPECT_CALL(mock_gatt_interface_, Close(_)).Times(1);
@@ -1886,12 +2357,13 @@
   const RawAddress test_address0 = GetTestAddress(0);
   SetSampleDatabaseEarbudsValid(
       1, test_address0, codec_spec_conf::kLeAudioLocationStereo,
-      codec_spec_conf::kLeAudioLocationStereo, 0x0004,
+      codec_spec_conf::kLeAudioLocationStereo, default_channel_cnt,
+      default_channel_cnt, 0x0004,
       /* source sample freq 16khz */ true, /*add_csis*/
       true,                                /*add_cas*/
       false,                               /*add_pacs*/
-      true /*add_ascs*/);
-  EXPECT_CALL(mock_client_callbacks_,
+      default_ase_cnt /*add_ascs*/);
+  EXPECT_CALL(mock_audio_hal_client_callbacks_,
               OnConnectionState(ConnectionState::DISCONNECTED, test_address0))
       .Times(1);
   EXPECT_CALL(mock_gatt_interface_, Close(_)).Times(1);
@@ -1902,12 +2374,13 @@
   const RawAddress test_address0 = GetTestAddress(0);
   SetSampleDatabaseEarbudsValid(
       1, test_address0, codec_spec_conf::kLeAudioLocationStereo,
-      codec_spec_conf::kLeAudioLocationStereo, 0x0004,
+      codec_spec_conf::kLeAudioLocationStereo, default_channel_cnt,
+      default_channel_cnt, 0x0004,
       /* source sample freq 16khz */ true, /*add_csis*/
       true,                                /*add_cas*/
       true,                                /*add_pacs*/
-      false /*add_ascs*/);
-  EXPECT_CALL(mock_client_callbacks_,
+      0 /*add_ascs*/);
+  EXPECT_CALL(mock_audio_hal_client_callbacks_,
               OnConnectionState(ConnectionState::DISCONNECTED, test_address0))
       .Times(1);
   EXPECT_CALL(mock_gatt_interface_, Close(_)).Times(1);
@@ -1919,13 +2392,14 @@
   uint16_t conn_id = 1;
   SetSampleDatabaseEarbudsValid(
       conn_id, test_address0, codec_spec_conf::kLeAudioLocationStereo,
-      codec_spec_conf::kLeAudioLocationStereo, 0x0004,
+      codec_spec_conf::kLeAudioLocationStereo, default_channel_cnt,
+      default_channel_cnt, 0x0004,
       /* source sample freq 16khz */ true, /*add_csis*/
       false,                               /*add_cas*/
       true,                                /*add_pacs*/
-      true /*add_ascs*/);
+      default_ase_cnt /*add_ascs*/);
 
-  EXPECT_CALL(mock_client_callbacks_,
+  EXPECT_CALL(mock_audio_hal_client_callbacks_,
               OnConnectionState(ConnectionState::CONNECTED, test_address0))
       .Times(1);
   ConnectLeAudio(test_address0);
@@ -1935,12 +2409,13 @@
   const RawAddress test_address0 = GetTestAddress(0);
   SetSampleDatabaseEarbudsValid(
       1, test_address0, codec_spec_conf::kLeAudioLocationStereo,
-      codec_spec_conf::kLeAudioLocationStereo, 0x0004,
+      codec_spec_conf::kLeAudioLocationStereo, default_channel_cnt,
+      default_channel_cnt, 0x0004,
       /* source sample freq 16khz */ false, /*add_csis*/
       true,                                 /*add_cas*/
       true,                                 /*add_pacs*/
-      true /*add_ascs*/);
-  EXPECT_CALL(mock_client_callbacks_,
+      default_ase_cnt /*add_ascs*/);
+  EXPECT_CALL(mock_audio_hal_client_callbacks_,
               OnConnectionState(ConnectionState::CONNECTED, test_address0))
       .Times(1);
   ConnectLeAudio(test_address0);
@@ -1951,7 +2426,7 @@
   SetSampleDatabaseEarbudsValid(1, test_address0,
                                 codec_spec_conf::kLeAudioLocationStereo,
                                 codec_spec_conf::kLeAudioLocationStereo);
-  EXPECT_CALL(mock_client_callbacks_,
+  EXPECT_CALL(mock_audio_hal_client_callbacks_,
               OnConnectionState(ConnectionState::CONNECTED, test_address0))
       .Times(1);
   ConnectLeAudio(test_address0);
@@ -1964,18 +2439,20 @@
   SetSampleDatabaseEarbudsValid(1, test_address0,
                                 codec_spec_conf::kLeAudioLocationStereo,
                                 codec_spec_conf::kLeAudioLocationStereo);
-  EXPECT_CALL(mock_client_callbacks_,
+  EXPECT_CALL(mock_audio_hal_client_callbacks_,
               OnConnectionState(ConnectionState::CONNECTED, test_address0))
       .Times(1);
   ConnectLeAudio(test_address0);
-  EXPECT_CALL(mock_client_callbacks_,
+  EXPECT_CALL(mock_audio_hal_client_callbacks_,
               OnConnectionState(ConnectionState::DISCONNECTED, test_address0))
       .Times(1);
   /* For remote disconnection, expect stack to try background re-connect */
-  EXPECT_CALL(mock_gatt_interface_, Open(gatt_if, test_address0, false, _))
+  EXPECT_CALL(mock_gatt_interface_,
+              Open(gatt_if, test_address0,
+                   BTM_BLE_BKG_CONNECT_TARGETED_ANNOUNCEMENTS, _))
       .Times(1);
 
-  EXPECT_CALL(mock_client_callbacks_,
+  EXPECT_CALL(mock_audio_hal_client_callbacks_,
               OnConnectionState(ConnectionState::CONNECTED, test_address0))
       .Times(1);
   InjectDisconnectedEvent(1, GATT_CONN_TERMINATE_PEER_USER);
@@ -2079,48 +2556,78 @@
   const RawAddress test_address0 = GetTestAddress(0);
   SetSampleDatabaseEarbudsValid(
       1, test_address0, codec_spec_conf::kLeAudioLocationFrontLeft,
-      codec_spec_conf::kLeAudioLocationFrontLeft, 0x0004,
+      codec_spec_conf::kLeAudioLocationFrontLeft, default_channel_cnt,
+      default_channel_cnt, 0x0004,
       /* source sample freq 16khz */ true, /*add_csis*/
       true,                                /*add_cas*/
       true,                                /*add_pacs*/
-      true,                                /*add_ascs*/
+      default_ase_cnt,                     /*add_ascs_cnt*/
       group_size, 1);
 
   const RawAddress test_address1 = GetTestAddress(1);
   SetSampleDatabaseEarbudsValid(
       2, test_address1, codec_spec_conf::kLeAudioLocationFrontRight,
-      codec_spec_conf::kLeAudioLocationFrontRight, 0x0004,
+      codec_spec_conf::kLeAudioLocationFrontRight, default_channel_cnt,
+      default_channel_cnt, 0x0004,
       /* source sample freq 16khz */ true, /*add_csis*/
       true,                                /*add_cas*/
       true,                                /*add_pacs*/
-      true,                                /*add_ascs*/
+      default_ase_cnt,                     /*add_ascs_cnt*/
       group_size, 2);
 
   // Load devices from the storage when storage API is called
   bool autoconnect = true;
+
+  /* Common storage values */
+  std::vector<uint8_t> handles;
+  LeAudioClient::GetHandlesForStorage(test_address0, handles);
+
+  std::vector<uint8_t> ases;
+  LeAudioClient::GetAsesForStorage(test_address0, ases);
+
+  std::vector<uint8_t> src_pacs;
+  LeAudioClient::GetSourcePacsForStorage(test_address0, src_pacs);
+
+  std::vector<uint8_t> snk_pacs;
+  LeAudioClient::GetSinkPacsForStorage(test_address0, snk_pacs);
+
   EXPECT_CALL(mock_storage_load, Call()).WillOnce([&]() {
-    do_in_main_thread(FROM_HERE, base::Bind(&LeAudioClient::AddFromStorage,
-                                            test_address0, autoconnect));
-    do_in_main_thread(FROM_HERE, base::Bind(&LeAudioClient::AddFromStorage,
-                                            test_address1, autoconnect));
+    do_in_main_thread(
+        FROM_HERE,
+        base::Bind(&LeAudioClient::AddFromStorage, test_address0, autoconnect,
+                   codec_spec_conf::kLeAudioLocationFrontLeft,
+                   codec_spec_conf::kLeAudioLocationFrontLeft, 0xff, 0xff,
+                   std::move(handles), std::move(snk_pacs), std::move(src_pacs),
+                   std::move(ases)));
+    do_in_main_thread(
+        FROM_HERE,
+        base::Bind(&LeAudioClient::AddFromStorage, test_address1, autoconnect,
+                   codec_spec_conf::kLeAudioLocationFrontRight,
+                   codec_spec_conf::kLeAudioLocationFrontRight, 0xff, 0xff,
+                   std::move(handles), std::move(snk_pacs), std::move(src_pacs),
+                   std::move(ases)));
   });
 
   // Expect stored device0 to connect automatically
-  EXPECT_CALL(mock_client_callbacks_,
+  EXPECT_CALL(mock_audio_hal_client_callbacks_,
               OnConnectionState(ConnectionState::CONNECTED, test_address0))
       .Times(1);
   ON_CALL(mock_btm_interface_, BTM_IsEncrypted(test_address0, _))
       .WillByDefault(DoAll(Return(true)));
-  EXPECT_CALL(mock_gatt_interface_, Open(gatt_if, test_address0, false, _))
+  EXPECT_CALL(mock_gatt_interface_,
+              Open(gatt_if, test_address0,
+                   BTM_BLE_BKG_CONNECT_TARGETED_ANNOUNCEMENTS, _))
       .Times(1);
 
   // Expect stored device1 to connect automatically
-  EXPECT_CALL(mock_client_callbacks_,
+  EXPECT_CALL(mock_audio_hal_client_callbacks_,
               OnConnectionState(ConnectionState::CONNECTED, test_address1))
       .Times(1);
   ON_CALL(mock_btm_interface_, BTM_IsEncrypted(test_address1, _))
       .WillByDefault(DoAll(Return(true)));
-  EXPECT_CALL(mock_gatt_interface_, Open(gatt_if, test_address1, false, _))
+  EXPECT_CALL(mock_gatt_interface_,
+              Open(gatt_if, test_address1,
+                   BTM_BLE_BKG_CONNECT_TARGETED_ANNOUNCEMENTS, _))
       .Times(1);
 
   ON_CALL(mock_groups_module_, GetGroupId(_, _))
@@ -2140,7 +2647,7 @@
       .WillByDefault(DoAll(SaveArg<0>(&gatt_callback),
                            SaveArg<1>(&app_register_callback)));
   LeAudioClient::Initialize(
-      &mock_client_callbacks_,
+      &mock_audio_hal_client_callbacks_,
       base::Bind([](MockFunction<void()>* foo) { foo->Call(); },
                  &mock_storage_load),
       base::Bind([](MockFunction<bool()>* foo) { return foo->Call(); },
@@ -2192,40 +2699,68 @@
   const RawAddress test_address1 = GetTestAddress(1);
   SetSampleDatabaseEarbudsValid(
       2, test_address1, codec_spec_conf::kLeAudioLocationFrontRight,
-      codec_spec_conf::kLeAudioLocationFrontRight, 0x0004,
+      codec_spec_conf::kLeAudioLocationFrontRight, default_channel_cnt,
+      default_channel_cnt, 0x0004,
       /* source sample freq 16khz */ true, /*add_csis*/
       true,                                /*add_cas*/
       true,                                /*add_pacs*/
-      true,                                /*add_ascs*/
+      default_ase_cnt,                     /*add_ascs_cnt*/
       group_size, 2);
 
   ON_CALL(mock_groups_module_, GetGroupId(test_address1, _))
       .WillByDefault(DoAll(Return(group_id1)));
 
+  /* Commont storage values */
+  std::vector<uint8_t> handles;
+  LeAudioClient::GetHandlesForStorage(test_address0, handles);
+
+  std::vector<uint8_t> ases;
+  LeAudioClient::GetAsesForStorage(test_address0, ases);
+
+  std::vector<uint8_t> src_pacs;
+  LeAudioClient::GetSourcePacsForStorage(test_address0, src_pacs);
+
+  std::vector<uint8_t> snk_pacs;
+  LeAudioClient::GetSinkPacsForStorage(test_address0, snk_pacs);
+
   // Load devices from the storage when storage API is called
   EXPECT_CALL(mock_storage_load, Call()).WillOnce([&]() {
-    do_in_main_thread(FROM_HERE, base::Bind(&LeAudioClient::AddFromStorage,
-                                            test_address0, autoconnect0));
-    do_in_main_thread(FROM_HERE, base::Bind(&LeAudioClient::AddFromStorage,
-                                            test_address1, autoconnect1));
+    do_in_main_thread(
+        FROM_HERE,
+        base::Bind(&LeAudioClient::AddFromStorage, test_address0, autoconnect0,
+                   codec_spec_conf::kLeAudioLocationFrontLeft,
+                   codec_spec_conf::kLeAudioLocationFrontLeft, 0xff, 0xff,
+                   std::move(handles), std::move(snk_pacs), std::move(src_pacs),
+                   std::move(ases)));
+    do_in_main_thread(
+        FROM_HERE,
+        base::Bind(&LeAudioClient::AddFromStorage, test_address1, autoconnect1,
+                   codec_spec_conf::kLeAudioLocationFrontRight,
+                   codec_spec_conf::kLeAudioLocationFrontRight, 0xff, 0xff,
+                   std::move(handles), std::move(snk_pacs), std::move(src_pacs),
+                   std::move(ases)));
   });
 
   // Expect stored device0 to connect automatically
-  EXPECT_CALL(mock_client_callbacks_,
+  EXPECT_CALL(mock_audio_hal_client_callbacks_,
               OnConnectionState(ConnectionState::CONNECTED, test_address0))
       .Times(1);
   ON_CALL(mock_btm_interface_, BTM_IsEncrypted(test_address0, _))
       .WillByDefault(DoAll(Return(true)));
-  EXPECT_CALL(mock_gatt_interface_, Open(gatt_if, test_address0, false, _))
+  EXPECT_CALL(mock_gatt_interface_,
+              Open(gatt_if, test_address0,
+                   BTM_BLE_BKG_CONNECT_TARGETED_ANNOUNCEMENTS, _))
       .Times(1);
 
   // Expect stored device1 to NOT connect automatically
-  EXPECT_CALL(mock_client_callbacks_,
+  EXPECT_CALL(mock_audio_hal_client_callbacks_,
               OnConnectionState(ConnectionState::CONNECTED, test_address1))
       .Times(0);
   ON_CALL(mock_btm_interface_, BTM_IsEncrypted(test_address1, _))
       .WillByDefault(DoAll(Return(true)));
-  EXPECT_CALL(mock_gatt_interface_, Open(gatt_if, test_address1, false, _))
+  EXPECT_CALL(mock_gatt_interface_,
+              Open(gatt_if, test_address1,
+                   BTM_BLE_BKG_CONNECT_TARGETED_ANNOUNCEMENTS, _))
       .Times(0);
 
   // Initialize
@@ -2236,7 +2771,7 @@
   std::vector<::bluetooth::le_audio::btle_audio_codec_config_t>
       framework_encode_preference;
   LeAudioClient::Initialize(
-      &mock_client_callbacks_,
+      &mock_audio_hal_client_callbacks_,
       base::Bind([](MockFunction<void()>* foo) { foo->Call(); },
                  &mock_storage_load),
       base::Bind([](MockFunction<bool()>* foo) { return foo->Call(); },
@@ -2244,7 +2779,7 @@
       framework_encode_preference);
   if (app_register_callback) app_register_callback.Run(gatt_if, GATT_SUCCESS);
 
- /* For background connect, test needs to Inject Connected Event */
+  /* For background connect, test needs to Inject Connected Event */
   InjectConnectedEvent(test_address0, 1);
 
   // We need to wait for the storage callback before verifying stuff
@@ -2301,10 +2836,10 @@
   int dev1_new_group = bluetooth::groups::kGroupUnknown;
 
   EXPECT_CALL(
-      mock_client_callbacks_,
+      mock_audio_hal_client_callbacks_,
       OnGroupNodeStatus(test_address1, group_id1, GroupNodeStatus::REMOVED))
       .Times(AtLeast(1));
-  EXPECT_CALL(mock_client_callbacks_,
+  EXPECT_CALL(mock_audio_hal_client_callbacks_,
               OnGroupNodeStatus(test_address1, _, GroupNodeStatus::ADDED))
       .WillRepeatedly(SaveArg<1>(&dev1_new_group));
   EXPECT_CALL(mock_groups_module_, RemoveDevice(test_address1, group_id1))
@@ -2338,6 +2873,75 @@
   ASSERT_NE(std::find(devs.begin(), devs.end(), test_address1), devs.end());
 }
 
+TEST_F(UnicastTest, RemoveNodeWhileStreaming) {
+  const RawAddress test_address0 = GetTestAddress(0);
+  int group_id = bluetooth::groups::kGroupUnknown;
+
+  SetSampleDatabaseEarbudsValid(
+      1, test_address0, codec_spec_conf::kLeAudioLocationStereo,
+      codec_spec_conf::kLeAudioLocationStereo, default_channel_cnt,
+      default_channel_cnt, 0x0004,
+      /* source sample freq 16khz */ false /*add_csis*/, true /*add_cas*/,
+      true /*add_pacs*/, default_ase_cnt /*add_ascs_cnt*/, 1 /*set_size*/,
+      0 /*rank*/);
+  EXPECT_CALL(mock_audio_hal_client_callbacks_,
+              OnConnectionState(ConnectionState::CONNECTED, test_address0))
+      .Times(1);
+  EXPECT_CALL(mock_audio_hal_client_callbacks_,
+              OnGroupNodeStatus(test_address0, _, GroupNodeStatus::ADDED))
+      .WillOnce(DoAll(SaveArg<1>(&group_id)));
+
+  ConnectLeAudio(test_address0);
+  ASSERT_NE(group_id, bluetooth::groups::kGroupUnknown);
+
+  // Start streaming
+  constexpr uint8_t cis_count_out = 1;
+  constexpr uint8_t cis_count_in = 0;
+
+  constexpr int gmcs_ccid = 1;
+  constexpr int gtbs_ccid = 2;
+
+  // Audio sessions are started only when device gets active
+  EXPECT_CALL(*mock_le_audio_source_hal_client_, Start(_, _)).Times(1);
+  EXPECT_CALL(*mock_le_audio_sink_hal_client_, Start(_, _)).Times(1);
+  LeAudioClient::Get()->SetCcidInformation(gmcs_ccid, 4 /* Media */);
+  LeAudioClient::Get()->SetCcidInformation(gtbs_ccid, 2 /* Phone */);
+  LeAudioClient::Get()->GroupSetActive(group_id);
+
+  EXPECT_CALL(mock_state_machine_, StartStream(_, _, _, {{gmcs_ccid}}))
+      .Times(1);
+
+  StartStreaming(AUDIO_USAGE_MEDIA, AUDIO_CONTENT_TYPE_MUSIC, group_id);
+
+  SyncOnMainLoop();
+  Mock::VerifyAndClearExpectations(&mock_audio_hal_client_callbacks_);
+  Mock::VerifyAndClearExpectations(&mock_le_audio_source_hal_client_);
+  Mock::VerifyAndClearExpectations(&mock_state_machine_);
+  SyncOnMainLoop();
+
+  // Verify Data transfer on one audio source cis
+  TestAudioDataTransfer(group_id, cis_count_out, cis_count_in, 1920);
+
+  EXPECT_CALL(mock_groups_module_, RemoveDevice(test_address0, group_id))
+      .Times(1);
+  EXPECT_CALL(mock_state_machine_, StopStream(_)).Times(1);
+  EXPECT_CALL(mock_state_machine_, ProcessHciNotifAclDisconnected(_, _))
+      .Times(0);
+  EXPECT_CALL(
+      mock_audio_hal_client_callbacks_,
+      OnGroupNodeStatus(test_address0, group_id, GroupNodeStatus::REMOVED));
+  EXPECT_CALL(mock_audio_hal_client_callbacks_,
+              OnConnectionState(ConnectionState::DISCONNECTED, test_address0))
+      .Times(0);
+
+  LeAudioClient::Get()->GroupRemoveNode(group_id, test_address0);
+
+  SyncOnMainLoop();
+  Mock::VerifyAndClearExpectations(&mock_groups_module_);
+  Mock::VerifyAndClearExpectations(&mock_state_machine_);
+  Mock::VerifyAndClearExpectations(&mock_audio_hal_client_callbacks_);
+}
+
 TEST_F(UnicastTest, GroupingAddTwiceNoRemove) {
   // Earbud connects without known grouping
   uint8_t group_id0 = bluetooth::groups::kGroupUnknown;
@@ -2376,10 +2980,10 @@
   int dev1_new_group = bluetooth::groups::kGroupUnknown;
 
   EXPECT_CALL(
-      mock_client_callbacks_,
+      mock_audio_hal_client_callbacks_,
       OnGroupNodeStatus(test_address1, group_id1, GroupNodeStatus::REMOVED))
       .Times(AtLeast(1));
-  EXPECT_CALL(mock_client_callbacks_,
+  EXPECT_CALL(mock_audio_hal_client_callbacks_,
               OnGroupNodeStatus(test_address1, _, GroupNodeStatus::ADDED))
       .WillRepeatedly(SaveArg<1>(&dev1_new_group));
 
@@ -2478,24 +3082,25 @@
   EXPECT_CALL(mock_groups_module_, RemoveDevice(test_address1, group_id0))
       .Times(1);
   EXPECT_CALL(
-      mock_client_callbacks_,
+      mock_audio_hal_client_callbacks_,
       OnGroupNodeStatus(test_address0, group_id0, GroupNodeStatus::REMOVED));
   EXPECT_CALL(
-      mock_client_callbacks_,
+      mock_audio_hal_client_callbacks_,
       OnGroupNodeStatus(test_address1, group_id0, GroupNodeStatus::REMOVED));
-  EXPECT_CALL(mock_client_callbacks_,
+  EXPECT_CALL(mock_audio_hal_client_callbacks_,
               OnConnectionState(ConnectionState::DISCONNECTED, test_address0))
       .Times(1);
-  EXPECT_CALL(mock_client_callbacks_,
+  EXPECT_CALL(mock_audio_hal_client_callbacks_,
               OnConnectionState(ConnectionState::DISCONNECTED, test_address1))
       .Times(1);
 
   // Expect the other groups to be left as is
-  EXPECT_CALL(mock_client_callbacks_, OnGroupStatus(group_id1, _)).Times(0);
-  EXPECT_CALL(mock_client_callbacks_,
+  EXPECT_CALL(mock_audio_hal_client_callbacks_, OnGroupStatus(group_id1, _))
+      .Times(0);
+  EXPECT_CALL(mock_audio_hal_client_callbacks_,
               OnConnectionState(ConnectionState::DISCONNECTED, test_address2))
       .Times(0);
-  EXPECT_CALL(mock_client_callbacks_,
+  EXPECT_CALL(mock_audio_hal_client_callbacks_,
               OnConnectionState(ConnectionState::DISCONNECTED, test_address3))
       .Times(0);
 
@@ -2513,13 +3118,15 @@
 
   SetSampleDatabaseEarbudsValid(
       1, test_address0, codec_spec_conf::kLeAudioLocationStereo,
-      codec_spec_conf::kLeAudioLocationStereo, 0x0004,
+      codec_spec_conf::kLeAudioLocationStereo, default_channel_cnt,
+      default_channel_cnt, 0x0004,
       /* source sample freq 16khz */ false /*add_csis*/, true /*add_cas*/,
-      true /*add_pacs*/, true /*add_ascs*/, 1 /*set_size*/, 0 /*rank*/);
-  EXPECT_CALL(mock_client_callbacks_,
+      true /*add_pacs*/, default_ase_cnt /*add_ascs_cnt*/, 1 /*set_size*/,
+      0 /*rank*/);
+  EXPECT_CALL(mock_audio_hal_client_callbacks_,
               OnConnectionState(ConnectionState::CONNECTED, test_address0))
       .Times(1);
-  EXPECT_CALL(mock_client_callbacks_,
+  EXPECT_CALL(mock_audio_hal_client_callbacks_,
               OnGroupNodeStatus(test_address0, _, GroupNodeStatus::ADDED))
       .WillOnce(DoAll(SaveArg<1>(&group_id)));
 
@@ -2527,26 +3134,27 @@
   ASSERT_NE(group_id, bluetooth::groups::kGroupUnknown);
 
   // Start streaming
-  uint8_t cis_count_out = 1;
-  uint8_t cis_count_in = 0;
+  constexpr uint8_t cis_count_out = 1;
+  constexpr uint8_t cis_count_in = 0;
 
-  int gmcs_ccid = 1;
-  int gtbs_ccid = 2;
+  constexpr int gmcs_ccid = 1;
+  constexpr int gtbs_ccid = 2;
 
   // Audio sessions are started only when device gets active
-  EXPECT_CALL(*mock_unicast_audio_source_, Start(_, _)).Times(1);
-  EXPECT_CALL(*mock_audio_sink_, Start(_, _)).Times(1);
+  EXPECT_CALL(*mock_le_audio_source_hal_client_, Start(_, _)).Times(1);
+  EXPECT_CALL(*mock_le_audio_sink_hal_client_, Start(_, _)).Times(1);
   LeAudioClient::Get()->SetCcidInformation(gmcs_ccid, 4 /* Media */);
   LeAudioClient::Get()->SetCcidInformation(gtbs_ccid, 2 /* Phone */);
   LeAudioClient::Get()->GroupSetActive(group_id);
 
-  EXPECT_CALL(mock_state_machine_, StartStream(_, _, gmcs_ccid)).Times(1);
+  EXPECT_CALL(mock_state_machine_, StartStream(_, _, _, {{gmcs_ccid}}))
+      .Times(1);
 
   StartStreaming(AUDIO_USAGE_MEDIA, AUDIO_CONTENT_TYPE_MUSIC, group_id);
 
   SyncOnMainLoop();
-  Mock::VerifyAndClearExpectations(&mock_client_callbacks_);
-  Mock::VerifyAndClearExpectations(mock_unicast_audio_source_);
+  Mock::VerifyAndClearExpectations(&mock_audio_hal_client_callbacks_);
+  Mock::VerifyAndClearExpectations(&mock_le_audio_source_hal_client_);
   Mock::VerifyAndClearExpectations(&mock_state_machine_);
   SyncOnMainLoop();
 
@@ -2560,10 +3168,10 @@
   EXPECT_CALL(mock_state_machine_, ProcessHciNotifAclDisconnected(_, _))
       .WillOnce(DoAll(SaveArg<0>(&group)));
   EXPECT_CALL(
-      mock_client_callbacks_,
+      mock_audio_hal_client_callbacks_,
       OnGroupNodeStatus(test_address0, group_id, GroupNodeStatus::REMOVED));
 
-  EXPECT_CALL(mock_client_callbacks_,
+  EXPECT_CALL(mock_audio_hal_client_callbacks_,
               OnConnectionState(ConnectionState::DISCONNECTED, test_address0))
       .Times(1);
 
@@ -2572,24 +3180,116 @@
   SyncOnMainLoop();
   Mock::VerifyAndClearExpectations(&mock_groups_module_);
   Mock::VerifyAndClearExpectations(&mock_state_machine_);
-  Mock::VerifyAndClearExpectations(&mock_client_callbacks_);
+  Mock::VerifyAndClearExpectations(&mock_audio_hal_client_callbacks_);
 
   ASSERT_NE(group, nullptr);
 }
 
+TEST_F(UnicastTest, EarbudsTwsStyleStreaming) {
+  const RawAddress test_address0 = GetTestAddress(0);
+  int group_id = bluetooth::groups::kGroupUnknown;
+
+  SetSampleDatabaseEarbudsValid(
+      1, test_address0, codec_spec_conf::kLeAudioLocationStereo,
+      codec_spec_conf::kLeAudioLocationStereo, 0x01, 0x01, 0x0004,
+      /* source sample freq 16khz */ false /*add_csis*/, true /*add_cas*/,
+      true /*add_pacs*/, 2 /*add_ascs_cnt*/, 1 /*set_size*/, 0 /*rank*/);
+  EXPECT_CALL(mock_audio_hal_client_callbacks_,
+              OnConnectionState(ConnectionState::CONNECTED, test_address0))
+      .Times(1);
+  EXPECT_CALL(mock_audio_hal_client_callbacks_,
+              OnGroupNodeStatus(test_address0, _, GroupNodeStatus::ADDED))
+      .WillOnce(DoAll(SaveArg<1>(&group_id)));
+
+  ConnectLeAudio(test_address0);
+  ASSERT_NE(group_id, bluetooth::groups::kGroupUnknown);
+
+  // Start streaming
+  uint8_t cis_count_out = 2;
+  uint8_t cis_count_in = 0;
+
+  // Audio sessions are started only when device gets active
+  EXPECT_CALL(*mock_le_audio_source_hal_client_, Start(_, _)).Times(1);
+  EXPECT_CALL(*mock_le_audio_sink_hal_client_, Start(_, _)).Times(1);
+  LeAudioClient::Get()->GroupSetActive(group_id);
+
+  StartStreaming(AUDIO_USAGE_MEDIA, AUDIO_CONTENT_TYPE_MUSIC, group_id);
+
+  Mock::VerifyAndClearExpectations(&mock_audio_hal_client_callbacks_);
+  Mock::VerifyAndClearExpectations(&mock_le_audio_source_hal_client_);
+  SyncOnMainLoop();
+
+  // Verify Data transfer on one audio source cis
+  TestAudioDataTransfer(group_id, cis_count_out, cis_count_in, 1920);
+
+  // Suspend
+  /*TODO Need a way to verify STOP */
+  LeAudioClient::Get()->GroupSuspend(group_id);
+  Mock::VerifyAndClearExpectations(&mock_audio_hal_client_callbacks_);
+  Mock::VerifyAndClearExpectations(&mock_le_audio_source_hal_client_);
+
+  // Resume
+  StartStreaming(AUDIO_USAGE_MEDIA, AUDIO_CONTENT_TYPE_MUSIC, group_id);
+  Mock::VerifyAndClearExpectations(&mock_audio_hal_client_callbacks_);
+  Mock::VerifyAndClearExpectations(&mock_le_audio_source_hal_client_);
+
+  // Stop
+  StopStreaming(group_id);
+  Mock::VerifyAndClearExpectations(&mock_audio_hal_client_callbacks_);
+
+  // Release
+  EXPECT_CALL(*mock_le_audio_source_hal_client_, Stop()).Times(1);
+  EXPECT_CALL(*mock_le_audio_source_hal_client_, OnDestroyed()).Times(1);
+  EXPECT_CALL(*mock_le_audio_sink_hal_client_, OnDestroyed()).Times(1);
+  LeAudioClient::Get()->GroupSetActive(bluetooth::groups::kGroupUnknown);
+  Mock::VerifyAndClearExpectations(&mock_le_audio_source_hal_client_);
+}
+
+TEST_F(UnicastTest, SpeakerFailedConversationalStreaming) {
+  const RawAddress test_address0 = GetTestAddress(0);
+  int group_id = bluetooth::groups::kGroupUnknown;
+
+  supported_src_context_types_ = 0;
+  supported_snk_context_types_ = 0x0004;
+
+  SetSampleDatabaseEarbudsValid(
+      1, test_address0, codec_spec_conf::kLeAudioLocationStereo,
+      0, default_channel_cnt,
+      default_channel_cnt, 0x0004,
+      /* source sample freq 16khz */ false /*add_csis*/, true /*add_cas*/,
+      true /*add_pacs*/, default_ase_cnt /*add_ascs_cnt*/, 1 /*set_size*/,
+      0 /*rank*/);
+  EXPECT_CALL(mock_audio_hal_client_callbacks_,
+              OnConnectionState(ConnectionState::CONNECTED, test_address0))
+      .Times(1);
+  EXPECT_CALL(mock_audio_hal_client_callbacks_,
+              OnGroupNodeStatus(test_address0, _, GroupNodeStatus::ADDED))
+      .WillOnce(DoAll(SaveArg<1>(&group_id)));
+
+  ConnectLeAudio(test_address0);
+  ASSERT_NE(group_id, bluetooth::groups::kGroupUnknown);
+
+  // Audio sessions are started only when device gets active
+  LeAudioClient::Get()->GroupSetActive(group_id);
+
+  /* Nothing to do - expect no crash */
+}
+
 TEST_F(UnicastTest, SpeakerStreaming) {
   const RawAddress test_address0 = GetTestAddress(0);
   int group_id = bluetooth::groups::kGroupUnknown;
 
   SetSampleDatabaseEarbudsValid(
       1, test_address0, codec_spec_conf::kLeAudioLocationStereo,
-      codec_spec_conf::kLeAudioLocationStereo, 0x0004,
+      codec_spec_conf::kLeAudioLocationStereo, default_channel_cnt,
+      default_channel_cnt, 0x0004,
       /* source sample freq 16khz */ false /*add_csis*/, true /*add_cas*/,
-      true /*add_pacs*/, true /*add_ascs*/, 1 /*set_size*/, 0 /*rank*/);
-  EXPECT_CALL(mock_client_callbacks_,
+      true /*add_pacs*/, default_ase_cnt /*add_ascs_cnt*/, 1 /*set_size*/,
+      0 /*rank*/);
+  EXPECT_CALL(mock_audio_hal_client_callbacks_,
               OnConnectionState(ConnectionState::CONNECTED, test_address0))
       .Times(1);
-  EXPECT_CALL(mock_client_callbacks_,
+  EXPECT_CALL(mock_audio_hal_client_callbacks_,
               OnGroupNodeStatus(test_address0, _, GroupNodeStatus::ADDED))
       .WillOnce(DoAll(SaveArg<1>(&group_id)));
 
@@ -2601,14 +3301,14 @@
   uint8_t cis_count_in = 0;
 
   // Audio sessions are started only when device gets active
-  EXPECT_CALL(*mock_unicast_audio_source_, Start(_, _)).Times(1);
-  EXPECT_CALL(*mock_audio_sink_, Start(_, _)).Times(1);
+  EXPECT_CALL(*mock_le_audio_source_hal_client_, Start(_, _)).Times(1);
+  EXPECT_CALL(*mock_le_audio_sink_hal_client_, Start(_, _)).Times(1);
   LeAudioClient::Get()->GroupSetActive(group_id);
 
   StartStreaming(AUDIO_USAGE_MEDIA, AUDIO_CONTENT_TYPE_MUSIC, group_id);
 
-  Mock::VerifyAndClearExpectations(&mock_client_callbacks_);
-  Mock::VerifyAndClearExpectations(mock_unicast_audio_source_);
+  Mock::VerifyAndClearExpectations(&mock_audio_hal_client_callbacks_);
+  Mock::VerifyAndClearExpectations(&mock_le_audio_source_hal_client_);
   SyncOnMainLoop();
 
   // Verify Data transfer on one audio source cis
@@ -2617,24 +3317,24 @@
   // Suspend
   /*TODO Need a way to verify STOP */
   LeAudioClient::Get()->GroupSuspend(group_id);
-  Mock::VerifyAndClearExpectations(&mock_client_callbacks_);
-  Mock::VerifyAndClearExpectations(mock_unicast_audio_source_);
+  Mock::VerifyAndClearExpectations(&mock_audio_hal_client_callbacks_);
+  Mock::VerifyAndClearExpectations(&mock_le_audio_source_hal_client_);
 
   // Resume
   StartStreaming(AUDIO_USAGE_MEDIA, AUDIO_CONTENT_TYPE_MUSIC, group_id);
-  Mock::VerifyAndClearExpectations(&mock_client_callbacks_);
-  Mock::VerifyAndClearExpectations(mock_unicast_audio_source_);
+  Mock::VerifyAndClearExpectations(&mock_audio_hal_client_callbacks_);
+  Mock::VerifyAndClearExpectations(&mock_le_audio_source_hal_client_);
 
   // Stop
   StopStreaming(group_id);
-  Mock::VerifyAndClearExpectations(&mock_client_callbacks_);
+  Mock::VerifyAndClearExpectations(&mock_audio_hal_client_callbacks_);
 
   // Release
-  EXPECT_CALL(*mock_unicast_audio_source_, Stop()).Times(1);
-  EXPECT_CALL(*mock_unicast_audio_source_, Release(_)).Times(1);
-  EXPECT_CALL(*mock_audio_sink_, Release(_)).Times(1);
+  EXPECT_CALL(*mock_le_audio_source_hal_client_, Stop()).Times(1);
+  EXPECT_CALL(*mock_le_audio_source_hal_client_, OnDestroyed()).Times(1);
+  EXPECT_CALL(*mock_le_audio_sink_hal_client_, OnDestroyed()).Times(1);
   LeAudioClient::Get()->GroupSetActive(bluetooth::groups::kGroupUnknown);
-  Mock::VerifyAndClearExpectations(mock_unicast_audio_source_);
+  Mock::VerifyAndClearExpectations(&mock_le_audio_source_hal_client_);
 }
 
 TEST_F(UnicastTest, SpeakerStreamingAutonomousRelease) {
@@ -2643,13 +3343,15 @@
 
   SetSampleDatabaseEarbudsValid(
       1, test_address0, codec_spec_conf::kLeAudioLocationStereo,
-      codec_spec_conf::kLeAudioLocationStereo, 0x0004,
+      codec_spec_conf::kLeAudioLocationStereo, default_channel_cnt,
+      default_channel_cnt, 0x0004,
       /* source sample freq 16khz */ false /*add_csis*/, true /*add_cas*/,
-      true /*add_pacs*/, true /*add_ascs*/, 1 /*set_size*/, 0 /*rank*/);
-  EXPECT_CALL(mock_client_callbacks_,
+      true /*add_pacs*/, default_ase_cnt /*add_ascs_cnt*/, 1 /*set_size*/,
+      0 /*rank*/);
+  EXPECT_CALL(mock_audio_hal_client_callbacks_,
               OnConnectionState(ConnectionState::CONNECTED, test_address0))
       .Times(1);
-  EXPECT_CALL(mock_client_callbacks_,
+  EXPECT_CALL(mock_audio_hal_client_callbacks_,
               OnGroupNodeStatus(test_address0, _, GroupNodeStatus::ADDED))
       .WillOnce(DoAll(SaveArg<1>(&group_id)));
 
@@ -2657,14 +3359,14 @@
   ASSERT_NE(group_id, bluetooth::groups::kGroupUnknown);
 
   // Start streaming
-  EXPECT_CALL(*mock_unicast_audio_source_, Start(_, _)).Times(1);
-  EXPECT_CALL(*mock_audio_sink_, Start(_, _)).Times(1);
+  EXPECT_CALL(*mock_le_audio_source_hal_client_, Start(_, _)).Times(1);
+  EXPECT_CALL(*mock_le_audio_sink_hal_client_, Start(_, _)).Times(1);
   LeAudioClient::Get()->GroupSetActive(group_id);
 
   StartStreaming(AUDIO_USAGE_MEDIA, AUDIO_CONTENT_TYPE_MUSIC, group_id);
 
-  Mock::VerifyAndClearExpectations(&mock_client_callbacks_);
-  Mock::VerifyAndClearExpectations(mock_unicast_audio_source_);
+  Mock::VerifyAndClearExpectations(&mock_audio_hal_client_callbacks_);
+  Mock::VerifyAndClearExpectations(&mock_le_audio_source_hal_client_);
   SyncOnMainLoop();
 
   // Verify Data transfer on one audio source cis
@@ -2714,18 +3416,20 @@
                     codec_spec_conf::kLeAudioLocationFrontRight, group_size,
                     group_id, 2 /* rank*/, true /*connect_through_csis*/);
 
+  ON_CALL(mock_csis_client_module_, GetDesiredSize(group_id))
+      .WillByDefault(Invoke([&](int group_id) { return 2; }));
+
   // Start streaming
-  EXPECT_CALL(*mock_unicast_audio_source_, Start(_, _)).Times(1);
-  EXPECT_CALL(*mock_audio_sink_, Start(_, _)).Times(1);
+  EXPECT_CALL(*mock_le_audio_source_hal_client_, Start(_, _)).Times(1);
+  EXPECT_CALL(*mock_le_audio_sink_hal_client_, Start(_, _)).Times(1);
   LeAudioClient::Get()->GroupSetActive(group_id);
-  Mock::VerifyAndClearExpectations(mock_unicast_audio_source_);
+  Mock::VerifyAndClearExpectations(&mock_le_audio_source_hal_client_);
 
   StartStreaming(AUDIO_USAGE_VOICE_COMMUNICATION, AUDIO_CONTENT_TYPE_SPEECH,
                  group_id);
 
-  Mock::VerifyAndClearExpectations(&mock_client_callbacks_);
-  Mock::VerifyAndClearExpectations(mock_unicast_audio_source_);
-  Mock::VerifyAndClearExpectations(mock_audio_sink_);
+  Mock::VerifyAndClearExpectations(&mock_audio_hal_client_callbacks_);
+  Mock::VerifyAndClearExpectations(&mock_le_audio_source_hal_client_);
   SyncOnMainLoop();
 
   // Verify Data transfer on two peer sinks and one source
@@ -2741,27 +3445,25 @@
   StartStreaming(AUDIO_USAGE_VOICE_COMMUNICATION, AUDIO_CONTENT_TYPE_SPEECH,
                  group_id);
   SyncOnMainLoop();
-  Mock::VerifyAndClearExpectations(mock_unicast_audio_source_);
-  Mock::VerifyAndClearExpectations(mock_audio_sink_);
+  Mock::VerifyAndClearExpectations(&mock_le_audio_source_hal_client_);
 
   // Verify Data transfer still works
   TestAudioDataTransfer(group_id, cis_count_out, cis_count_in, 1920, 40);
 
   // Stop
   StopStreaming(group_id, true);
-  Mock::VerifyAndClearExpectations(&mock_client_callbacks_);
+  Mock::VerifyAndClearExpectations(&mock_audio_hal_client_callbacks_);
 
   // Release
-  EXPECT_CALL(*mock_unicast_audio_source_, Stop()).Times(1);
-  EXPECT_CALL(*mock_unicast_audio_source_, Release(_)).Times(1);
-  EXPECT_CALL(*mock_audio_sink_, Stop()).Times(1);
-  EXPECT_CALL(*mock_audio_sink_, Release(_)).Times(1);
+  EXPECT_CALL(*mock_le_audio_source_hal_client_, Stop()).Times(1);
+  EXPECT_CALL(*mock_le_audio_source_hal_client_, OnDestroyed()).Times(1);
+  EXPECT_CALL(*mock_le_audio_sink_hal_client_, Stop()).Times(1);
+  EXPECT_CALL(*mock_le_audio_sink_hal_client_, OnDestroyed()).Times(1);
   LeAudioClient::Get()->GroupSetActive(bluetooth::groups::kGroupUnknown);
-  Mock::VerifyAndClearExpectations(mock_unicast_audio_source_);
-  Mock::VerifyAndClearExpectations(mock_audio_sink_);
+  Mock::VerifyAndClearExpectations(&mock_le_audio_source_hal_client_);
 }
 
-TEST_F(UnicastTest, TwoEarbudsStreamingContextSwitchSimple) {
+TEST_F(UnicastTest, TwoEarbudsStreamingContextSwitchNoReconfigure) {
   uint8_t group_size = 2;
   int group_id = 2;
 
@@ -2787,47 +3489,76 @@
                     codec_spec_conf::kLeAudioLocationFrontRight, group_size,
                     group_id, 2 /* rank*/, true /*connect_through_csis*/);
 
-  // Start streaming
-  EXPECT_CALL(*mock_unicast_audio_source_, Start(_, _)).Times(1);
-  EXPECT_CALL(*mock_audio_sink_, Start(_, _)).Times(1);
-  LeAudioClient::Get()->GroupSetActive(group_id);
-  Mock::VerifyAndClearExpectations(mock_unicast_audio_source_);
+  ON_CALL(mock_csis_client_module_, GetDesiredSize(group_id))
+      .WillByDefault(Invoke([&](int group_id) { return 2; }));
 
-  // Start streaming with reconfiguration from default media stream setup
+  // Start streaming
+  EXPECT_CALL(*mock_le_audio_source_hal_client_, Start(_, _)).Times(1);
+  EXPECT_CALL(*mock_le_audio_sink_hal_client_, Start(_, _)).Times(1);
+  LeAudioClient::Get()->GroupSetActive(group_id);
+  Mock::VerifyAndClearExpectations(&mock_le_audio_source_hal_client_);
+
+  // Start streaming with new metadata, but use the existing configuration
   EXPECT_CALL(
       mock_state_machine_,
-      StartStream(_, le_audio::types::LeAudioContextType::NOTIFICATIONS, _))
+      StartStream(
+          _, types::LeAudioContextType::MEDIA,
+          types::AudioContexts(types::LeAudioContextType::NOTIFICATIONS), _))
       .Times(1);
 
   StartStreaming(AUDIO_USAGE_NOTIFICATION, AUDIO_CONTENT_TYPE_UNKNOWN,
                  group_id);
 
-  Mock::VerifyAndClearExpectations(&mock_client_callbacks_);
-  Mock::VerifyAndClearExpectations(mock_unicast_audio_source_);
+  Mock::VerifyAndClearExpectations(&mock_audio_hal_client_callbacks_);
+  Mock::VerifyAndClearExpectations(&mock_le_audio_source_hal_client_);
   SyncOnMainLoop();
 
-  // Do a content switch to ALERTS
-  EXPECT_CALL(*mock_unicast_audio_source_, Release).Times(0);
-  EXPECT_CALL(*mock_unicast_audio_source_, Stop).Times(0);
-  EXPECT_CALL(*mock_unicast_audio_source_, Start).Times(0);
-  EXPECT_CALL(mock_state_machine_,
-              StartStream(_, le_audio::types::LeAudioContextType::ALERTS, _))
+  // Do a metadata content switch to ALERTS but stay on MEDIA configuration
+  EXPECT_CALL(*mock_le_audio_source_hal_client_, OnDestroyed()).Times(0);
+  EXPECT_CALL(*mock_le_audio_source_hal_client_, Stop).Times(0);
+  EXPECT_CALL(*mock_le_audio_source_hal_client_, Start).Times(0);
+  EXPECT_CALL(
+      mock_state_machine_,
+      StartStream(
+          _, le_audio::types::LeAudioContextType::MEDIA,
+          types::AudioContexts(le_audio::types::LeAudioContextType::ALERTS), _))
       .Times(1);
   UpdateMetadata(AUDIO_USAGE_ALARM, AUDIO_CONTENT_TYPE_UNKNOWN);
-  Mock::VerifyAndClearExpectations(&mock_client_callbacks_);
-  Mock::VerifyAndClearExpectations(mock_unicast_audio_source_);
+  Mock::VerifyAndClearExpectations(&mock_audio_hal_client_callbacks_);
+  Mock::VerifyAndClearExpectations(&mock_le_audio_source_hal_client_);
 
-  // Do a content switch to EMERGENCY
-  EXPECT_CALL(*mock_unicast_audio_source_, Release).Times(0);
-  EXPECT_CALL(*mock_unicast_audio_source_, Stop).Times(0);
-  EXPECT_CALL(*mock_unicast_audio_source_, Start).Times(0);
+  // Do a metadata content switch to EMERGENCY but stay on MEDIA configuration
+  EXPECT_CALL(*mock_le_audio_source_hal_client_, OnDestroyed()).Times(0);
+  EXPECT_CALL(*mock_le_audio_source_hal_client_, Stop).Times(0);
+  EXPECT_CALL(*mock_le_audio_source_hal_client_, Start).Times(0);
 
   EXPECT_CALL(
       mock_state_machine_,
-      StartStream(_, le_audio::types::LeAudioContextType::EMERGENCYALARM, _))
+      StartStream(_, le_audio::types::LeAudioContextType::MEDIA,
+                  types::AudioContexts(
+                      le_audio::types::LeAudioContextType::EMERGENCYALARM),
+                  _))
       .Times(1);
   UpdateMetadata(AUDIO_USAGE_EMERGENCY, AUDIO_CONTENT_TYPE_UNKNOWN);
-  Mock::VerifyAndClearExpectations(mock_unicast_audio_source_);
+  Mock::VerifyAndClearExpectations(&mock_audio_hal_client_callbacks_);
+  Mock::VerifyAndClearExpectations(&mock_le_audio_source_hal_client_);
+
+  // Do a metadata content switch to INSTRUCTIONAL but stay on MEDIA
+  // configuration
+  EXPECT_CALL(*mock_le_audio_source_hal_client_, OnDestroyed()).Times(0);
+  EXPECT_CALL(*mock_le_audio_source_hal_client_, Stop).Times(0);
+  EXPECT_CALL(*mock_le_audio_source_hal_client_, Start).Times(0);
+  EXPECT_CALL(
+      mock_state_machine_,
+      StartStream(_, le_audio::types::LeAudioContextType::MEDIA,
+                  types::AudioContexts(
+                      le_audio::types::LeAudioContextType::INSTRUCTIONAL),
+                  _))
+      .Times(1);
+  UpdateMetadata(AUDIO_USAGE_ASSISTANCE_NAVIGATION_GUIDANCE,
+                 AUDIO_CONTENT_TYPE_UNKNOWN);
+  Mock::VerifyAndClearExpectations(&mock_audio_hal_client_callbacks_);
+  Mock::VerifyAndClearExpectations(&mock_le_audio_source_hal_client_);
 }
 
 TEST_F(UnicastTest, TwoEarbudsStreamingContextSwitchReconfigure) {
@@ -2856,21 +3587,25 @@
                     codec_spec_conf::kLeAudioLocationFrontRight, group_size,
                     group_id, 2 /* rank*/, true /*connect_through_csis*/);
 
-  int gmcs_ccid = 1;
-  int gtbs_ccid = 2;
+  constexpr int gmcs_ccid = 1;
+  constexpr int gtbs_ccid = 2;
+
+  ON_CALL(mock_csis_client_module_, GetDesiredSize(group_id))
+      .WillByDefault(Invoke([&](int group_id) { return 2; }));
 
   // Start streaming MEDIA
-  EXPECT_CALL(*mock_unicast_audio_source_, Start(_, _)).Times(1);
-  EXPECT_CALL(*mock_audio_sink_, Start(_, _)).Times(1);
+  EXPECT_CALL(*mock_le_audio_source_hal_client_, Start(_, _)).Times(1);
+  EXPECT_CALL(*mock_le_audio_sink_hal_client_, Start(_, _)).Times(1);
   LeAudioClient::Get()->SetCcidInformation(gmcs_ccid, 4 /* Media */);
   LeAudioClient::Get()->SetCcidInformation(gtbs_ccid, 2 /* Phone */);
   LeAudioClient::Get()->GroupSetActive(group_id);
 
-  EXPECT_CALL(mock_state_machine_, StartStream(_, _, gmcs_ccid)).Times(1);
+  EXPECT_CALL(mock_state_machine_, StartStream(_, _, _, {{gmcs_ccid}}))
+      .Times(1);
   StartStreaming(AUDIO_USAGE_MEDIA, AUDIO_CONTENT_TYPE_MUSIC, group_id);
 
-  Mock::VerifyAndClearExpectations(&mock_client_callbacks_);
-  Mock::VerifyAndClearExpectations(mock_unicast_audio_source_);
+  Mock::VerifyAndClearExpectations(&mock_audio_hal_client_callbacks_);
+  Mock::VerifyAndClearExpectations(&mock_le_audio_source_hal_client_);
   SyncOnMainLoop();
 
   // Verify Data transfer on two peer sinks
@@ -2882,15 +3617,15 @@
   StopStreaming(group_id);
   // simulate suspend timeout passed, alarm executing
   fake_osi_alarm_set_on_mloop_.cb(fake_osi_alarm_set_on_mloop_.data);
-  Mock::VerifyAndClearExpectations(&mock_client_callbacks_);
+  Mock::VerifyAndClearExpectations(&mock_audio_hal_client_callbacks_);
 
-  EXPECT_CALL(mock_state_machine_, StartStream(_, _, gtbs_ccid)).Times(1);
+  EXPECT_CALL(mock_state_machine_, StartStream(_, _, _, {{gtbs_ccid}}))
+      .Times(1);
   StartStreaming(AUDIO_USAGE_VOICE_COMMUNICATION, AUDIO_CONTENT_TYPE_SPEECH,
                  group_id);
 
-  Mock::VerifyAndClearExpectations(&mock_client_callbacks_);
-  Mock::VerifyAndClearExpectations(mock_unicast_audio_source_);
-  Mock::VerifyAndClearExpectations(mock_audio_sink_);
+  Mock::VerifyAndClearExpectations(&mock_audio_hal_client_callbacks_);
+  Mock::VerifyAndClearExpectations(&mock_le_audio_source_hal_client_);
   SyncOnMainLoop();
 
   // Verify Data transfer on two peer sinks and one source
@@ -2907,22 +3642,27 @@
   ON_CALL(mock_csis_client_module_, IsCsisClientRunning())
       .WillByDefault(Return(true));
 
-  // First earbud
   const RawAddress test_address0 = GetTestAddress(0);
+  const RawAddress test_address1 = GetTestAddress(1);
+
+  // First earbud
   ConnectCsisDevice(test_address0, 1 /*conn_id*/,
                     codec_spec_conf::kLeAudioLocationFrontLeft,
                     codec_spec_conf::kLeAudioLocationFrontLeft, group_size,
                     group_id, 1 /* rank*/);
 
   // Start streaming
-  EXPECT_CALL(*mock_unicast_audio_source_, Start(_, _)).Times(1);
-  EXPECT_CALL(*mock_audio_sink_, Start(_, _)).Times(1);
+  EXPECT_CALL(*mock_le_audio_source_hal_client_, Start(_, _)).Times(1);
+  EXPECT_CALL(*mock_le_audio_sink_hal_client_, Start(_, _)).Times(1);
   LeAudioClient::Get()->GroupSetActive(group_id);
 
+  ON_CALL(mock_csis_client_module_, GetDesiredSize(group_id))
+      .WillByDefault(Invoke([&](int group_id) { return 2; }));
+
   StartStreaming(AUDIO_USAGE_MEDIA, AUDIO_CONTENT_TYPE_MUSIC, group_id);
 
-  Mock::VerifyAndClearExpectations(&mock_client_callbacks_);
-  Mock::VerifyAndClearExpectations(mock_unicast_audio_source_);
+  Mock::VerifyAndClearExpectations(&mock_audio_hal_client_callbacks_);
+  Mock::VerifyAndClearExpectations(&mock_le_audio_source_hal_client_);
   SyncOnMainLoop();
 
   // Expect one iso channel to be fed with data
@@ -2931,7 +3671,6 @@
   TestAudioDataTransfer(group_id, cis_count_out, cis_count_in, 1920);
 
   // Second earbud connects during stream
-  const RawAddress test_address1 = GetTestAddress(1);
   ConnectCsisDevice(test_address1, 2 /*conn_id*/,
                     codec_spec_conf::kLeAudioLocationFrontRight,
                     codec_spec_conf::kLeAudioLocationFrontRight, group_size,
@@ -2969,15 +3708,18 @@
                     codec_spec_conf::kLeAudioLocationFrontRight, group_size,
                     group_id, 2 /* rank*/, true /*connect_through_csis*/);
 
+  ON_CALL(mock_csis_client_module_, GetDesiredSize(group_id))
+      .WillByDefault(Invoke([&](int group_id) { return 2; }));
+
   // Audio sessions are started only when device gets active
-  EXPECT_CALL(*mock_unicast_audio_source_, Start(_, _)).Times(1);
-  EXPECT_CALL(*mock_audio_sink_, Start(_, _)).Times(1);
+  EXPECT_CALL(*mock_le_audio_source_hal_client_, Start(_, _)).Times(1);
+  EXPECT_CALL(*mock_le_audio_sink_hal_client_, Start(_, _)).Times(1);
   LeAudioClient::Get()->GroupSetActive(group_id);
 
   StartStreaming(AUDIO_USAGE_MEDIA, AUDIO_CONTENT_TYPE_MUSIC, group_id);
 
-  Mock::VerifyAndClearExpectations(&mock_client_callbacks_);
-  Mock::VerifyAndClearExpectations(mock_unicast_audio_source_);
+  Mock::VerifyAndClearExpectations(&mock_audio_hal_client_callbacks_);
+  Mock::VerifyAndClearExpectations(&mock_le_audio_source_hal_client_);
   SyncOnMainLoop();
 
   // Expect two iso channels to be fed with data
@@ -2993,13 +3735,15 @@
     InjectCisDisconnected(group_id, ase.cis_conn_hdl);
   }
 
-  EXPECT_CALL(mock_gatt_interface_, Open(_, device->address_, false, false))
+  EXPECT_CALL(mock_gatt_interface_,
+              Open(_, device->address_,
+                   BTM_BLE_BKG_CONNECT_TARGETED_ANNOUNCEMENTS, false))
       .Times(1);
 
   auto conn_id = device->conn_id_;
   InjectDisconnectedEvent(device->conn_id_, GATT_CONN_TERMINATE_PEER_USER);
   SyncOnMainLoop();
-  Mock::VerifyAndClearExpectations(&mock_client_callbacks_);
+  Mock::VerifyAndClearExpectations(&mock_audio_hal_client_callbacks_);
 
   // Expect one channel ISO Data to be sent
   cis_count_out = 1;
@@ -3037,15 +3781,18 @@
                     codec_spec_conf::kLeAudioLocationFrontRight, group_size,
                     group_id, 2 /* rank*/, true /*connect_through_csis*/);
 
+  ON_CALL(mock_csis_client_module_, GetDesiredSize(group_id))
+      .WillByDefault(Invoke([&](int group_id) { return 2; }));
+
   // Audio sessions are started only when device gets active
-  EXPECT_CALL(*mock_unicast_audio_source_, Start(_, _)).Times(1);
-  EXPECT_CALL(*mock_audio_sink_, Start(_, _)).Times(1);
+  EXPECT_CALL(*mock_le_audio_source_hal_client_, Start(_, _)).Times(1);
+  EXPECT_CALL(*mock_le_audio_sink_hal_client_, Start(_, _)).Times(1);
   LeAudioClient::Get()->GroupSetActive(group_id);
 
   StartStreaming(AUDIO_USAGE_MEDIA, AUDIO_CONTENT_TYPE_MUSIC, group_id);
 
-  Mock::VerifyAndClearExpectations(&mock_client_callbacks_);
-  Mock::VerifyAndClearExpectations(mock_unicast_audio_source_);
+  Mock::VerifyAndClearExpectations(&mock_audio_hal_client_callbacks_);
+  Mock::VerifyAndClearExpectations(&mock_le_audio_source_hal_client_);
   SyncOnMainLoop();
 
   // Expect two iso channels to be fed with data
@@ -3061,7 +3808,7 @@
   DisconnectLeAudio(test_address1, 2);
 
   SyncOnMainLoop();
-  Mock::VerifyAndClearExpectations(&mock_client_callbacks_);
+  Mock::VerifyAndClearExpectations(&mock_audio_hal_client_callbacks_);
 }
 
 TEST_F(UnicastTest, TwoEarbudsWithSourceSupporting32kHz) {
@@ -3069,12 +3816,13 @@
   int group_id = 0;
   SetSampleDatabaseEarbudsValid(
       1, test_address0, codec_spec_conf::kLeAudioLocationStereo,
-      codec_spec_conf::kLeAudioLocationStereo, 0x0024,
+      codec_spec_conf::kLeAudioLocationStereo, default_channel_cnt,
+      default_channel_cnt, 0x0024,
       /* source sample freq 32/16khz */ true, /*add_csis*/
       true,                                   /*add_cas*/
       true,                                   /*add_pacs*/
-      true /*add_ascs*/);
-  EXPECT_CALL(mock_client_callbacks_,
+      default_ase_cnt /*add_ascs_cnt*/);
+  EXPECT_CALL(mock_audio_hal_client_callbacks_,
               OnConnectionState(ConnectionState::CONNECTED, test_address0))
       .Times(1);
   ConnectLeAudio(test_address0);
@@ -3088,8 +3836,10 @@
   };
 
   // Audio sessions are started only when device gets active
-  EXPECT_CALL(*mock_unicast_audio_source_, Start(_, _)).Times(1);
-  EXPECT_CALL(*mock_audio_sink_, Start(expected_af_sink_config, _)).Times(1);
+  EXPECT_CALL(*mock_le_audio_source_hal_client_, Start(_, _)).Times(1);
+  EXPECT_CALL(*mock_le_audio_sink_hal_client_,
+              Start(expected_af_sink_config, _))
+      .Times(1);
   LeAudioClient::Get()->GroupSetActive(group_id);
   SyncOnMainLoop();
 }
@@ -3100,65 +3850,62 @@
 
   SetSampleDatabaseEarbudsValid(
       1, test_address0, codec_spec_conf::kLeAudioLocationStereo,
-      codec_spec_conf::kLeAudioLocationStereo, 0x0024, false /*add_csis*/,
-      true /*add_cas*/, true /*add_pacs*/, true /*add_ascs*/, 1 /*set_size*/,
+      codec_spec_conf::kLeAudioLocationStereo, default_channel_cnt,
+      default_channel_cnt, 0x0024, false /*add_csis*/, true /*add_cas*/,
+      true /*add_pacs*/, default_ase_cnt /*add_ascs_cnt*/, 1 /*set_size*/,
       0 /*rank*/);
-  EXPECT_CALL(mock_client_callbacks_,
+  EXPECT_CALL(mock_audio_hal_client_callbacks_,
               OnConnectionState(ConnectionState::CONNECTED, test_address0))
       .Times(1);
-  EXPECT_CALL(mock_client_callbacks_,
+  EXPECT_CALL(mock_audio_hal_client_callbacks_,
               OnGroupNodeStatus(test_address0, _, GroupNodeStatus::ADDED))
       .WillOnce(DoAll(SaveArg<1>(&group_id)));
 
   ConnectLeAudio(test_address0);
   ASSERT_NE(group_id, bluetooth::groups::kGroupUnknown);
 
-  // Start streaming
-  uint8_t cis_count_out = 1;
-  uint8_t cis_count_in = 0;
-
   // Audio sessions are started only when device gets active
-  EXPECT_CALL(*mock_unicast_audio_source_, Start(_, _)).Times(1);
-  EXPECT_CALL(*mock_audio_sink_, Start(_, _)).Times(1);
+  EXPECT_CALL(*mock_le_audio_source_hal_client_, Start(_, _)).Times(1);
+  EXPECT_CALL(*mock_le_audio_sink_hal_client_, Start(_, _)).Times(1);
   LeAudioClient::Get()->GroupSetActive(group_id);
 
+  EXPECT_CALL(mock_state_machine_,
+              StartStream(_, le_audio::types::LeAudioContextType::LIVE, _, _))
+      .Times(1);
+
   StartStreaming(AUDIO_USAGE_MEDIA, AUDIO_CONTENT_TYPE_MUSIC, group_id,
                  AUDIO_SOURCE_MIC);
-
-  EXPECT_CALL(
-      mock_state_machine_,
-      StartStream(_, le_audio::types::LeAudioContextType::VOICEASSISTANTS, _))
-      .Times(1);
-  Mock::VerifyAndClearExpectations(&mock_client_callbacks_);
-  Mock::VerifyAndClearExpectations(mock_unicast_audio_source_);
+  Mock::VerifyAndClearExpectations(&mock_audio_hal_client_callbacks_);
+  Mock::VerifyAndClearExpectations(&mock_le_audio_source_hal_client_);
   SyncOnMainLoop();
 
   // Verify Data transfer on one audio source cis
+  uint8_t cis_count_out = 1;
+  uint8_t cis_count_in = 0;
   TestAudioDataTransfer(group_id, cis_count_out, cis_count_in, 1920);
 
   // Suspend
   /*TODO Need a way to verify STOP */
   LeAudioClient::Get()->GroupSuspend(group_id);
-  Mock::VerifyAndClearExpectations(&mock_client_callbacks_);
-  Mock::VerifyAndClearExpectations(mock_unicast_audio_source_);
-  Mock::VerifyAndClearExpectations(mock_audio_sink_);
+  Mock::VerifyAndClearExpectations(&mock_audio_hal_client_callbacks_);
+  Mock::VerifyAndClearExpectations(&mock_le_audio_source_hal_client_);
 
   // Resume
   StartStreaming(AUDIO_USAGE_MEDIA, AUDIO_CONTENT_TYPE_MUSIC, group_id,
                  AUDIO_SOURCE_MIC);
-  Mock::VerifyAndClearExpectations(&mock_client_callbacks_);
-  Mock::VerifyAndClearExpectations(mock_unicast_audio_source_);
+  Mock::VerifyAndClearExpectations(&mock_audio_hal_client_callbacks_);
+  Mock::VerifyAndClearExpectations(&mock_le_audio_source_hal_client_);
 
   // Stop
   StopStreaming(group_id);
-  Mock::VerifyAndClearExpectations(&mock_client_callbacks_);
+  Mock::VerifyAndClearExpectations(&mock_audio_hal_client_callbacks_);
 
   // Release
-  EXPECT_CALL(*mock_unicast_audio_source_, Stop()).Times(1);
-  EXPECT_CALL(*mock_unicast_audio_source_, Release(_)).Times(1);
-  EXPECT_CALL(*mock_audio_sink_, Release(_)).Times(1);
+  EXPECT_CALL(*mock_le_audio_source_hal_client_, Stop()).Times(1);
+  EXPECT_CALL(*mock_le_audio_source_hal_client_, OnDestroyed()).Times(1);
+  EXPECT_CALL(*mock_le_audio_sink_hal_client_, OnDestroyed()).Times(1);
   LeAudioClient::Get()->GroupSetActive(bluetooth::groups::kGroupUnknown);
-  Mock::VerifyAndClearExpectations(mock_unicast_audio_source_);
+  Mock::VerifyAndClearExpectations(&mock_le_audio_source_hal_client_);
 }
 
 TEST_F(UnicastTest, StartNotSupportedContextType) {
@@ -3167,13 +3914,14 @@
 
   SetSampleDatabaseEarbudsValid(
       1, test_address0, codec_spec_conf::kLeAudioLocationStereo,
-      codec_spec_conf::kLeAudioLocationStereo, 0x0004, false /*add_csis*/,
-      true /*add_cas*/, true /*add_pacs*/, true /*add_ascs*/, 1 /*set_size*/,
+      codec_spec_conf::kLeAudioLocationStereo, default_channel_cnt,
+      default_channel_cnt, 0x0004, false /*add_csis*/, true /*add_cas*/,
+      true /*add_pacs*/, default_ase_cnt /*add_ascs_cnt*/, 1 /*set_size*/,
       0 /*rank*/);
-  EXPECT_CALL(mock_client_callbacks_,
+  EXPECT_CALL(mock_audio_hal_client_callbacks_,
               OnConnectionState(ConnectionState::CONNECTED, test_address0))
       .Times(1);
-  EXPECT_CALL(mock_client_callbacks_,
+  EXPECT_CALL(mock_audio_hal_client_callbacks_,
               OnGroupNodeStatus(test_address0, _, GroupNodeStatus::ADDED))
       .WillOnce(DoAll(SaveArg<1>(&group_id)));
 
@@ -3184,23 +3932,215 @@
   uint8_t cis_count_out = 1;
   uint8_t cis_count_in = 0;
 
+  LeAudioClient::Get()->SetInCall(true);
+
   // Audio sessions are started only when device gets active
-  EXPECT_CALL(*mock_unicast_audio_source_, Start(_, _)).Times(1);
-  EXPECT_CALL(*mock_audio_sink_, Start(_, _)).Times(1);
+  EXPECT_CALL(*mock_le_audio_source_hal_client_, Start(_, _)).Times(1);
+  EXPECT_CALL(*mock_le_audio_sink_hal_client_, Start(_, _)).Times(1);
   LeAudioClient::Get()->GroupSetActive(group_id);
 
   StartStreaming(AUDIO_USAGE_NOTIFICATION_TELEPHONY_RINGTONE,
                  AUDIO_CONTENT_TYPE_UNKNOWN, group_id);
 
-  Mock::VerifyAndClearExpectations(&mock_client_callbacks_);
-  Mock::VerifyAndClearExpectations(mock_unicast_audio_source_);
+  Mock::VerifyAndClearExpectations(&mock_audio_hal_client_callbacks_);
+  Mock::VerifyAndClearExpectations(&mock_le_audio_source_hal_client_);
   SyncOnMainLoop();
 
   // Verify Data transfer on one audio source cis
   TestAudioDataTransfer(group_id, cis_count_out, cis_count_in, 1920);
 
-  EXPECT_CALL(mock_state_machine_, StopStream(_)).Times(0);
-  UpdateMetadata(AUDIO_USAGE_GAME, AUDIO_CONTENT_TYPE_UNKNOWN);
+  LeAudioClient::Get()->SetInCall(false);
+
+  /* Fallback scenario now supports 48Khz just like Media so we will reconfigure
+   * Note: Fallback is forced by the frequency on the remote device.
+   */
+  EXPECT_CALL(mock_state_machine_, StopStream(_)).Times(1);
+  UpdateMetadata(AUDIO_USAGE_GAME, AUDIO_CONTENT_TYPE_UNKNOWN, true);
+
+  /* The above will trigger reconfiguration. After that Audio Hal action
+   * is needed to restart the stream */
+  SinkAudioResume();
 }
-}  // namespace
+
+TEST_F(UnicastTest, NotifyAboutGroupTunrnedIdleEnabled) {
+  const RawAddress test_address0 = GetTestAddress(0);
+  int group_id = bluetooth::groups::kGroupUnknown;
+
+  osi_property_set_bool(kNotifyUpperLayerAboutGroupBeingInIdleDuringCall, true);
+
+  SetSampleDatabaseEarbudsValid(
+      1, test_address0, codec_spec_conf::kLeAudioLocationStereo,
+      codec_spec_conf::kLeAudioLocationStereo, default_channel_cnt,
+      default_channel_cnt, 0x0004, false /*add_csis*/, true /*add_cas*/,
+      true /*add_pacs*/, default_ase_cnt /*add_ascs_cnt*/, 1 /*set_size*/,
+      0 /*rank*/);
+  EXPECT_CALL(mock_audio_hal_client_callbacks_,
+              OnConnectionState(ConnectionState::CONNECTED, test_address0))
+      .Times(1);
+  EXPECT_CALL(mock_audio_hal_client_callbacks_,
+              OnGroupNodeStatus(test_address0, _, GroupNodeStatus::ADDED))
+      .WillOnce(DoAll(SaveArg<1>(&group_id)));
+
+  ConnectLeAudio(test_address0);
+  ASSERT_NE(group_id, bluetooth::groups::kGroupUnknown);
+
+  // Start streaming
+  uint8_t cis_count_out = 1;
+  uint8_t cis_count_in = 0;
+
+  LeAudioClient::Get()->SetInCall(true);
+
+  // Audio sessions are started only when device gets active
+  EXPECT_CALL(*mock_le_audio_source_hal_client_, Start(_, _)).Times(1);
+  EXPECT_CALL(*mock_le_audio_sink_hal_client_, Start(_, _)).Times(1);
+  LeAudioClient::Get()->GroupSetActive(group_id);
+
+  StartStreaming(AUDIO_USAGE_NOTIFICATION_TELEPHONY_RINGTONE,
+                 AUDIO_CONTENT_TYPE_UNKNOWN, group_id);
+
+  Mock::VerifyAndClearExpectations(&mock_audio_hal_client_callbacks_);
+  Mock::VerifyAndClearExpectations(&mock_le_audio_source_hal_client_);
+  SyncOnMainLoop();
+
+  // Verify Data transfer on one audio source cis
+  TestAudioDataTransfer(group_id, cis_count_out, cis_count_in, 1920);
+
+  // Release
+
+  /* To be called twice
+   * 1. GroupStatus::INACTIVE
+   * 2. GroupStatus::TURNED_IDLE_DURING_CALL
+   */
+  EXPECT_CALL(mock_audio_hal_client_callbacks_, OnGroupStatus(group_id, _))
+      .Times(2);
+
+  EXPECT_CALL(*mock_le_audio_source_hal_client_, Stop()).Times(1);
+  EXPECT_CALL(*mock_le_audio_source_hal_client_, OnDestroyed()).Times(1);
+  EXPECT_CALL(*mock_le_audio_sink_hal_client_, OnDestroyed()).Times(1);
+
+  LeAudioClient::Get()->GroupSetActive(bluetooth::groups::kGroupUnknown);
+
+  Mock::VerifyAndClearExpectations(&mock_le_audio_source_hal_client_);
+
+  LeAudioClient::Get()->SetInCall(false);
+  osi_property_set_bool(kNotifyUpperLayerAboutGroupBeingInIdleDuringCall,
+                        false);
+}
+
+TEST_F(UnicastTest, NotifyAboutGroupTunrnedIdleDisabled) {
+  const RawAddress test_address0 = GetTestAddress(0);
+  int group_id = bluetooth::groups::kGroupUnknown;
+
+  SetSampleDatabaseEarbudsValid(
+      1, test_address0, codec_spec_conf::kLeAudioLocationStereo,
+      codec_spec_conf::kLeAudioLocationStereo, default_channel_cnt,
+      default_channel_cnt, 0x0004, false /*add_csis*/, true /*add_cas*/,
+      true /*add_pacs*/, default_ase_cnt /*add_ascs_cnt*/, 1 /*set_size*/,
+      0 /*rank*/);
+  EXPECT_CALL(mock_audio_hal_client_callbacks_,
+              OnConnectionState(ConnectionState::CONNECTED, test_address0))
+      .Times(1);
+  EXPECT_CALL(mock_audio_hal_client_callbacks_,
+              OnGroupNodeStatus(test_address0, _, GroupNodeStatus::ADDED))
+      .WillOnce(DoAll(SaveArg<1>(&group_id)));
+
+  ConnectLeAudio(test_address0);
+  ASSERT_NE(group_id, bluetooth::groups::kGroupUnknown);
+
+  // Start streaming
+  uint8_t cis_count_out = 1;
+  uint8_t cis_count_in = 0;
+
+  LeAudioClient::Get()->SetInCall(true);
+
+  // Audio sessions are started only when device gets active
+  EXPECT_CALL(*mock_le_audio_source_hal_client_, Start(_, _)).Times(1);
+  EXPECT_CALL(*mock_le_audio_sink_hal_client_, Start(_, _)).Times(1);
+  LeAudioClient::Get()->GroupSetActive(group_id);
+
+  StartStreaming(AUDIO_USAGE_NOTIFICATION_TELEPHONY_RINGTONE,
+                 AUDIO_CONTENT_TYPE_UNKNOWN, group_id);
+
+  Mock::VerifyAndClearExpectations(&mock_audio_hal_client_callbacks_);
+  Mock::VerifyAndClearExpectations(&mock_le_audio_source_hal_client_);
+  SyncOnMainLoop();
+
+  // Verify Data transfer on one audio source cis
+  TestAudioDataTransfer(group_id, cis_count_out, cis_count_in, 1920);
+
+  // Release
+
+  /* To be called once only
+   * 1. GroupStatus::INACTIVE
+   */
+  EXPECT_CALL(mock_audio_hal_client_callbacks_, OnGroupStatus(group_id, _))
+      .Times(1);
+
+  EXPECT_CALL(*mock_le_audio_source_hal_client_, Stop()).Times(1);
+  EXPECT_CALL(*mock_le_audio_source_hal_client_, OnDestroyed()).Times(1);
+  EXPECT_CALL(*mock_le_audio_sink_hal_client_, OnDestroyed()).Times(1);
+  LeAudioClient::Get()->GroupSetActive(bluetooth::groups::kGroupUnknown);
+
+  Mock::VerifyAndClearExpectations(&mock_le_audio_source_hal_client_);
+
+  LeAudioClient::Get()->SetInCall(false);
+}
+
+TEST_F(UnicastTest, HandleDatabaseOutOfSync) {
+  const RawAddress test_address0 = GetTestAddress(0);
+  int group_id = bluetooth::groups::kGroupUnknown;
+
+  SetSampleDatabaseEarbudsValid(
+      1, test_address0, codec_spec_conf::kLeAudioLocationStereo,
+      codec_spec_conf::kLeAudioLocationStereo, default_channel_cnt,
+      default_channel_cnt, 0x0004, false /*add_csis*/, true /*add_cas*/,
+      true /*add_pacs*/, default_ase_cnt /*add_ascs_cnt*/, 1 /*set_size*/,
+      0 /*rank*/);
+  EXPECT_CALL(mock_audio_hal_client_callbacks_,
+              OnConnectionState(ConnectionState::CONNECTED, test_address0))
+      .Times(1);
+  EXPECT_CALL(mock_audio_hal_client_callbacks_,
+              OnGroupNodeStatus(test_address0, _, GroupNodeStatus::ADDED))
+      .WillOnce(DoAll(SaveArg<1>(&group_id)));
+
+  ConnectLeAudio(test_address0);
+  ASSERT_NE(group_id, bluetooth::groups::kGroupUnknown);
+
+  SyncOnMainLoop();
+  Mock::VerifyAndClearExpectations(&mock_audio_hal_client_callbacks_);
+
+  EXPECT_CALL(mock_audio_hal_client_callbacks_,
+              OnConnectionState(ConnectionState::DISCONNECTED, test_address0))
+      .Times(1);
+  InjectDisconnectedEvent(1, GATT_CONN_TERMINATE_PEER_USER);
+  SyncOnMainLoop();
+  Mock::VerifyAndClearExpectations(&mock_audio_hal_client_callbacks_);
+
+  // default action for WriteDescriptor function call
+  ON_CALL(mock_gatt_queue_, WriteDescriptor(_, _, _, _, _, _))
+      .WillByDefault(Invoke([](uint16_t conn_id, uint16_t handle,
+                               std::vector<uint8_t> value,
+                               tGATT_WRITE_TYPE write_type, GATT_WRITE_OP_CB cb,
+                               void* cb_data) -> void {
+        if (cb)
+          do_in_main_thread(
+              FROM_HERE,
+              base::BindOnce(
+                  [](GATT_WRITE_OP_CB cb, uint16_t conn_id, uint16_t handle,
+                     uint16_t len, uint8_t* value, void* cb_data) {
+                    cb(conn_id, GATT_DATABASE_OUT_OF_SYNC, handle, len, value,
+                       cb_data);
+                  },
+                  cb, conn_id, handle, value.size(), value.data(), cb_data));
+      }));
+
+  ON_CALL(mock_gatt_interface_, ServiceSearchRequest(_, _))
+      .WillByDefault(Return());
+  EXPECT_CALL(mock_gatt_interface_, ServiceSearchRequest(_, _));
+
+  InjectConnectedEvent(test_address0, 1);
+  SyncOnMainLoop();
+  Mock::VerifyAndClearExpectations(&mock_gatt_interface_);
+}
+
 }  // namespace le_audio
diff --git a/system/bta/le_audio/le_audio_set_configuration_provider_json.cc b/system/bta/le_audio/le_audio_set_configuration_provider_json.cc
index 719db5f..3437a35 100644
--- a/system/bta/le_audio/le_audio_set_configuration_provider_json.cc
+++ b/system/bta/le_audio/le_audio_set_configuration_provider_json.cc
@@ -25,6 +25,7 @@
 #include "flatbuffers/util.h"
 #include "le_audio_set_configuration_provider.h"
 #include "osi/include/log.h"
+#include "osi/include/osi.h"
 
 using le_audio::set_configurations::AudioSetConfiguration;
 using le_audio::set_configurations::AudioSetConfigurations;
@@ -64,11 +65,69 @@
 
 /** Provides a set configurations for the given context type */
 struct AudioSetConfigurationProviderJson {
+  static constexpr auto kDefaultScenario = "Media";
+
   AudioSetConfigurationProviderJson() {
     ASSERT_LOG(LoadContent(kLeAudioSetConfigs, kLeAudioSetScenarios),
                ": Unable to load le audio set configuration files.");
   }
 
+  /* Use the same scenario configurations for different contexts to avoid
+   * internal reconfiguration and handover that produces time gap. When using
+   * the same scenario for different contexts, quality and configuration remains
+   * the same while changing to same scenario based context type.
+   */
+  static auto ScenarioToContextTypes(const std::string& scenario) {
+    static const std::multimap<std::string,
+                               ::le_audio::types::LeAudioContextType>
+        scenarios = {
+            {"Media", types::LeAudioContextType::ALERTS},
+            {"Media", types::LeAudioContextType::INSTRUCTIONAL},
+            {"Media", types::LeAudioContextType::NOTIFICATIONS},
+            {"Media", types::LeAudioContextType::EMERGENCYALARM},
+            {"Media", types::LeAudioContextType::UNSPECIFIED},
+            {"Media", types::LeAudioContextType::MEDIA},
+            {"Conversational", types::LeAudioContextType::RINGTONE},
+            {"Conversational", types::LeAudioContextType::CONVERSATIONAL},
+            {"Live", types::LeAudioContextType::LIVE},
+            {"Game", types::LeAudioContextType::GAME},
+            {"VoiceAssistants", types::LeAudioContextType::VOICEASSISTANTS},
+        };
+    return scenarios.equal_range(scenario);
+  }
+
+  static std::string ContextTypeToScenario(
+      ::le_audio::types::LeAudioContextType context_type) {
+    switch (context_type) {
+      case types::LeAudioContextType::ALERTS:
+        FALLTHROUGH_INTENDED;
+      case types::LeAudioContextType::INSTRUCTIONAL:
+        FALLTHROUGH_INTENDED;
+      case types::LeAudioContextType::NOTIFICATIONS:
+        FALLTHROUGH_INTENDED;
+      case types::LeAudioContextType::EMERGENCYALARM:
+        FALLTHROUGH_INTENDED;
+      case types::LeAudioContextType::UNSPECIFIED:
+        FALLTHROUGH_INTENDED;
+      case types::LeAudioContextType::SOUNDEFFECTS:
+        FALLTHROUGH_INTENDED;
+      case types::LeAudioContextType::MEDIA:
+        return "Media";
+      case types::LeAudioContextType::RINGTONE:
+        FALLTHROUGH_INTENDED;
+      case types::LeAudioContextType::CONVERSATIONAL:
+        return "Conversational";
+      case types::LeAudioContextType::LIVE:
+        return "Live";
+      case types::LeAudioContextType::GAME:
+        return "Game";
+      case types::LeAudioContextType::VOICEASSISTANTS:
+        return "VoiceAssistants";
+      default:
+        return kDefaultScenario;
+    }
+  }
+
   const AudioSetConfigurations* GetConfigurationsByContextType(
       LeAudioContextType context_type) const {
     if (context_configurations_.count(context_type))
@@ -77,17 +136,16 @@
     LOG_WARN(": No predefined scenario for the context %d was found.",
              (int)context_type);
 
-    auto fallback_scenario = "Default";
-    context_type = ScenarioToContextType(fallback_scenario);
-
-    if (context_configurations_.count(context_type)) {
-      LOG_WARN(": Using %s scenario by default.", fallback_scenario);
-      return &context_configurations_.at(context_type);
+    auto [it_begin, it_end] = ScenarioToContextTypes(kDefaultScenario);
+    if (it_begin != it_end) {
+      LOG_WARN(": Using '%s' scenario by default.", kDefaultScenario);
+      return &context_configurations_.at(it_begin->second);
     }
 
     LOG_ERROR(
-        ": No fallback configuration for the 'Default' scenario or"
-        " no valid audio set configurations loaded at all.");
+        ": No valid configuration for the default '%s' scenario, or no audio "
+        "set configurations loaded at all.",
+        kDefaultScenario);
     return nullptr;
   };
 
@@ -446,9 +504,12 @@
 
     LOG_DEBUG(": Updating %d scenarios.", flat_scenarios->size());
     for (auto const& scenario : *flat_scenarios) {
-      context_configurations_.insert_or_assign(
-          ScenarioToContextType(scenario->name()->c_str()),
-          AudioSetConfigurationsFromFlatScenario(scenario));
+      auto [it_begin, it_end] =
+          ScenarioToContextTypes(scenario->name()->c_str());
+      for (auto it = it_begin; it != it_end; ++it) {
+        context_configurations_.insert_or_assign(
+            it->second, AudioSetConfigurationsFromFlatScenario(scenario));
+      }
     }
 
     return true;
@@ -468,38 +529,6 @@
     }
     return true;
   }
-
-  std::string ContextTypeToScenario(
-      ::le_audio::types::LeAudioContextType context_type) {
-    switch (context_type) {
-      case types::LeAudioContextType::MEDIA:
-        return "Media";
-      case types::LeAudioContextType::CONVERSATIONAL:
-        return "Conversational";
-      case types::LeAudioContextType::VOICEASSISTANTS:
-        return "VoiceAssinstants";
-      case types::LeAudioContextType::RINGTONE:
-        return "Ringtone";
-      default:
-        return "Default";
-    }
-  }
-
-  static ::le_audio::types::LeAudioContextType ScenarioToContextType(
-      std::string scenario) {
-    static const std::map<std::string, ::le_audio::types::LeAudioContextType>
-        scenarios = {
-            {"Media", types::LeAudioContextType::MEDIA},
-            {"Conversational", types::LeAudioContextType::CONVERSATIONAL},
-            {"Ringtone", types::LeAudioContextType::RINGTONE},
-            {"Recording", types::LeAudioContextType::LIVE},
-            {"Game", types::LeAudioContextType::GAME},
-            {"VoiceAssistants", types::LeAudioContextType::VOICEASSISTANTS},
-            {"Default", types::LeAudioContextType::UNSPECIFIED},
-        };
-    return scenarios.count(scenario) ? scenarios.at(scenario)
-                                     : types::LeAudioContextType::RFU;
-  }
 };
 
 struct AudioSetConfigurationProvider::impl {
@@ -526,7 +555,7 @@
       auto confs = Get()->GetConfigurations(context);
       stream << "\n  === Configurations for context type: " << (int)context
              << ", num: " << (confs == nullptr ? 0 : confs->size()) << " \n";
-      if (confs->size() > 0) {
+      if (confs && confs->size() > 0) {
         for (const auto& conf : *confs) {
           stream << "  name: " << conf->name << " \n";
           for (const auto& ent : conf->confs) {
diff --git a/system/bta/le_audio/le_audio_types.cc b/system/bta/le_audio/le_audio_types.cc
index 69e958b..29d69ec 100644
--- a/system/bta/le_audio/le_audio_types.cc
+++ b/system/bta/le_audio/le_audio_types.cc
@@ -24,11 +24,12 @@
 
 #include <base/strings/string_number_conversions.h>
 
+#include "audio_hal_client/audio_hal_client.h"
 #include "bt_types.h"
 #include "bta_api.h"
 #include "bta_le_audio_api.h"
-#include "client_audio.h"
 #include "client_parser.h"
+#include "gd/common/strings.h"
 
 namespace le_audio {
 using types::acs_ac_record;
@@ -69,6 +70,156 @@
   return curr_min_req_devices_cnt;
 }
 
+inline void get_cis_count(const AudioSetConfiguration& audio_set_conf,
+                          int expected_device_cnt,
+                          types::LeAudioConfigurationStrategy strategy,
+                          int avail_group_sink_ase_count,
+                          int avail_group_source_ase_count,
+                          uint8_t& out_current_cis_count_bidir,
+                          uint8_t& out_current_cis_count_unidir_sink,
+                          uint8_t& out_current_cis_count_unidir_source) {
+  LOG_INFO("%s", audio_set_conf.name.c_str());
+
+  /* Sum up the requirements from all subconfigs. They usually have different
+   * directions.
+   */
+  types::BidirectionalPair<uint8_t> config_ase_count = {0, 0};
+  int config_device_cnt = 0;
+
+  for (auto ent : audio_set_conf.confs) {
+    if ((ent.direction == kLeAudioDirectionSink) &&
+        (ent.strategy != strategy)) {
+      LOG_DEBUG("Strategy does not match (%d != %d)- skip this configuration",
+                static_cast<int>(ent.strategy), static_cast<int>(strategy));
+      return;
+    }
+
+    /* Sum up sink and source ases */
+    if (ent.direction == kLeAudioDirectionSink) {
+      config_ase_count.sink += ent.ase_cnt;
+    }
+    if (ent.direction == kLeAudioDirectionSource) {
+      config_ase_count.source += ent.ase_cnt;
+    }
+
+    /* Calculate the max device count */
+    config_device_cnt =
+        std::max(static_cast<uint8_t>(config_device_cnt), ent.device_cnt);
+  }
+
+  LOG_DEBUG("Config sink ases: %d, source ases: %d, device count: %d",
+            config_ase_count.sink, config_ase_count.source, config_device_cnt);
+
+  /* Reject configurations not matching our device count */
+  if (expected_device_cnt != config_device_cnt) {
+    LOG_DEBUG(" Device cnt %d != %d", expected_device_cnt, config_device_cnt);
+    return;
+  }
+
+  /* Reject configurations requiring sink ASES if our group has none */
+  if ((avail_group_sink_ase_count == 0) && (config_ase_count.sink > 0)) {
+    LOG_DEBUG("Group does not have sink ASEs");
+    return;
+  }
+
+  /* Reject configurations requiring source ASES if our group has none */
+  if ((avail_group_source_ase_count == 0) && (config_ase_count.source > 0)) {
+    LOG_DEBUG("Group does not have source ASEs");
+    return;
+  }
+
+  /* If expected group size is 1, then make sure device has enough ASEs */
+  if (expected_device_cnt == 1) {
+    if ((config_ase_count.sink > avail_group_sink_ase_count) ||
+        (config_ase_count.source > avail_group_source_ase_count)) {
+      LOG_DEBUG("Single device group with not enought sink/source ASEs");
+      return;
+    }
+  }
+
+  /* Configuration list is set in the prioritized order.
+   * it might happen that a higher prio configuration can be supported
+   * and is already taken into account (out_current_cis_count_* is non zero).
+   * Now let's try to ignore ortogonal configuration which would just
+   * increase our demant on number of CISes but will never happen
+   */
+  if (config_ase_count.sink == 0 && (out_current_cis_count_unidir_sink > 0 ||
+                                     out_current_cis_count_bidir > 0)) {
+    LOG_INFO(
+        "Higher prio configuration using sink ASEs has been taken into "
+        "account");
+    return;
+  }
+
+  if (config_ase_count.source == 0 &&
+      (out_current_cis_count_unidir_source > 0 ||
+       out_current_cis_count_bidir > 0)) {
+    LOG_INFO(
+        "Higher prio configuration using source ASEs has been taken into "
+        "account");
+    return;
+  }
+
+  /* Check how many bidirectional cises we can use */
+  uint8_t config_bidir_cis_count =
+      std::min(config_ase_count.sink, config_ase_count.source);
+  /* Count the remaining unidirectional cises */
+  uint8_t config_unidir_sink_cis_count =
+      config_ase_count.sink - config_bidir_cis_count;
+  uint8_t config_unidir_source_cis_count =
+      config_ase_count.source - config_bidir_cis_count;
+
+  /* WARNING: Minipolicy which prioritizes bidirectional configs */
+  if (config_bidir_cis_count > out_current_cis_count_bidir) {
+    /* Correct all counters to represent this single config */
+    out_current_cis_count_bidir = config_bidir_cis_count;
+    out_current_cis_count_unidir_sink = config_unidir_sink_cis_count;
+    out_current_cis_count_unidir_source = config_unidir_source_cis_count;
+
+  } else if (out_current_cis_count_bidir == 0) {
+    /* No bidirectionals possible yet. Calculate for unidirectional cises. */
+    if ((out_current_cis_count_unidir_sink == 0) &&
+        (out_current_cis_count_unidir_source == 0)) {
+      out_current_cis_count_unidir_sink = config_unidir_sink_cis_count;
+      out_current_cis_count_unidir_source = config_unidir_source_cis_count;
+    }
+  }
+}
+
+void get_cis_count(const AudioSetConfigurations& audio_set_confs,
+                   int expected_device_cnt,
+                   types::LeAudioConfigurationStrategy strategy,
+                   int avail_group_ase_snk_cnt, int avail_group_ase_src_count,
+                   uint8_t& out_cis_count_bidir,
+                   uint8_t& out_cis_count_unidir_sink,
+                   uint8_t& out_cis_count_unidir_source) {
+  LOG_INFO(
+      " strategy %d, group avail sink ases: %d, group avail source ases %d "
+      "expected_device_count %d",
+      static_cast<int>(strategy), avail_group_ase_snk_cnt,
+      avail_group_ase_src_count, expected_device_cnt);
+
+  /* Look for the most optimal configuration and store the needed cis counts */
+  for (auto audio_set_conf : audio_set_confs) {
+    get_cis_count(*audio_set_conf, expected_device_cnt, strategy,
+                  avail_group_ase_snk_cnt, avail_group_ase_src_count,
+                  out_cis_count_bidir, out_cis_count_unidir_sink,
+                  out_cis_count_unidir_source);
+
+    LOG_DEBUG(
+        "Intermediate step:  Bi-Directional: %d,"
+        " Uni-Directional Sink: %d, Uni-Directional Source: %d ",
+        out_cis_count_bidir, out_cis_count_unidir_sink,
+        out_cis_count_unidir_source);
+  }
+
+  LOG_INFO(
+      " Maximum CIS count, Bi-Directional: %d,"
+      " Uni-Directional Sink: %d, Uni-Directional Source: %d",
+      out_cis_count_bidir, out_cis_count_unidir_sink,
+      out_cis_count_unidir_source);
+}
+
 bool check_if_may_cover_scenario(const AudioSetConfigurations* audio_set_confs,
                                  uint8_t group_size) {
   if (!audio_set_confs) {
@@ -399,24 +550,21 @@
 }  // namespace types
 
 void AppendMetadataLtvEntryForCcidList(std::vector<uint8_t>& metadata,
-                                       int ccid) {
-  if (ccid < 0) return;
+                                       const std::vector<uint8_t>& ccid_list) {
+  if (ccid_list.size() == 0) {
+    LOG_WARN("Empty CCID list.");
+    return;
+  }
 
-  std::vector<uint8_t> ccid_ltv_entry;
-  std::vector<uint8_t> ccid_value = {static_cast<uint8_t>(ccid)};
+  metadata.push_back(
+      static_cast<uint8_t>(types::kLeAudioMetadataTypeLen + ccid_list.size()));
+  metadata.push_back(static_cast<uint8_t>(types::kLeAudioMetadataTypeCcidList));
 
-  ccid_ltv_entry.push_back(
-      static_cast<uint8_t>(types::kLeAudioMetadataTypeLen + ccid_value.size()));
-  ccid_ltv_entry.push_back(
-      static_cast<uint8_t>(types::kLeAudioMetadataTypeCcidList));
-  ccid_ltv_entry.insert(ccid_ltv_entry.end(), ccid_value.begin(),
-                        ccid_value.end());
-
-  metadata.insert(metadata.end(), ccid_ltv_entry.begin(), ccid_ltv_entry.end());
+  metadata.insert(metadata.end(), ccid_list.begin(), ccid_list.end());
 }
 
 void AppendMetadataLtvEntryForStreamingContext(
-    std::vector<uint8_t>& metadata, LeAudioContextType context_type) {
+    std::vector<uint8_t>& metadata, types::AudioContexts context_type) {
   std::vector<uint8_t> streaming_context_ltv_entry;
 
   streaming_context_ltv_entry.resize(
@@ -429,8 +577,7 @@
                       types::kLeAudioMetadataStreamingAudioContextLen);
   UINT8_TO_STREAM(streaming_context_ltv_entry_buf,
                   types::kLeAudioMetadataTypeStreamingAudioContext);
-  UINT16_TO_STREAM(streaming_context_ltv_entry_buf,
-                   static_cast<uint16_t>(context_type));
+  UINT16_TO_STREAM(streaming_context_ltv_entry_buf, context_type.value());
 
   metadata.insert(metadata.end(), streaming_context_ltv_entry.begin(),
                   streaming_context_ltv_entry.end());
@@ -445,10 +592,36 @@
   return 1;
 }
 
+uint32_t AdjustAllocationForOffloader(uint32_t allocation) {
+  if ((allocation & codec_spec_conf::kLeAudioLocationAnyLeft) &&
+      (allocation & codec_spec_conf::kLeAudioLocationAnyRight)) {
+    return codec_spec_conf::kLeAudioLocationStereo;
+  }
+  if (allocation & codec_spec_conf::kLeAudioLocationAnyLeft) {
+    return codec_spec_conf::kLeAudioLocationFrontLeft;
+  }
+
+  if (allocation & codec_spec_conf::kLeAudioLocationAnyRight) {
+    return codec_spec_conf::kLeAudioLocationFrontRight;
+  }
+  return 0;
+}
+
 namespace types {
+std::ostream& operator<<(std::ostream& os,
+                         const AudioStreamDataPathState& state) {
+  static const char* char_value_[6] = {
+      "IDLE",        "CIS_DISCONNECTING", "CIS_ASSIGNED",
+      "CIS_PENDING", "CIS_ESTABLISHED",   "DATA_PATH_ESTABLISHED"};
+
+  os << char_value_[static_cast<uint8_t>(state)] << " ("
+     << "0x" << std::setfill('0') << std::setw(2) << static_cast<int>(state)
+     << ")";
+  return os;
+}
 std::ostream& operator<<(std::ostream& os, const types::CigState& state) {
-  static const char* char_value_[4] = {"NONE", "CREATING", "CREATED",
-                                       "REMOVING"};
+  static const char* char_value_[5] = {"NONE", "CREATING", "CREATED",
+                                       "REMOVING", "RECOVERING"};
 
   os << char_value_[static_cast<uint8_t>(state)] << " ("
      << "0x" << std::setfill('0') << std::setw(2) << static_cast<int>(state)
@@ -511,6 +684,9 @@
     case LeAudioContextType::RINGTONE:
       os << "RINGTONE";
       break;
+    case LeAudioContextType::ALERTS:
+      os << "ALERTS";
+      break;
     case LeAudioContextType::EMERGENCYALARM:
       os << "EMERGENCYALARM";
       break;
@@ -520,5 +696,50 @@
   }
   return os;
 }
+
+AudioContexts operator|(std::underlying_type<LeAudioContextType>::type lhs,
+                        const LeAudioContextType rhs) {
+  using T = std::underlying_type<LeAudioContextType>::type;
+  return AudioContexts(lhs | static_cast<T>(rhs));
+}
+
+AudioContexts& operator|=(AudioContexts& lhs, AudioContexts const& rhs) {
+  lhs = AudioContexts(lhs.value() | rhs.value());
+  return lhs;
+}
+
+AudioContexts& operator&=(AudioContexts& lhs, AudioContexts const& rhs) {
+  lhs = AudioContexts(lhs.value() & rhs.value());
+  return lhs;
+}
+
+std::string ToHexString(const LeAudioContextType& value) {
+  using T = std::underlying_type<LeAudioContextType>::type;
+  return bluetooth::common::ToHexString(static_cast<T>(value));
+}
+
+std::string AudioContexts::to_string() const {
+  std::stringstream s;
+  for (auto ctx : le_audio::types::kLeAudioContextAllTypesArray) {
+    if (test(ctx)) {
+      if (s.tellp() != 0) s << " | ";
+      s << ctx;
+    }
+  }
+  s << " (" << bluetooth::common::ToHexString(mValue) << ")";
+  return s.str();
+}
+
+std::ostream& operator<<(std::ostream& os, const AudioContexts& contexts) {
+  os << contexts.to_string();
+  return os;
+}
+
+/* Bidirectional getter trait for AudioContexts bidirectional pair */
+template <>
+AudioContexts get_bidirectional(BidirectionalPair<AudioContexts> p) {
+  return p.sink | p.source;
+}
+
 }  // namespace types
 }  // namespace le_audio
diff --git a/system/bta/le_audio/le_audio_types.h b/system/bta/le_audio/le_audio_types.h
index a41742c..94a722e 100644
--- a/system/bta/le_audio/le_audio_types.h
+++ b/system/bta/le_audio/le_audio_types.h
@@ -310,8 +310,7 @@
 constexpr uint16_t kMaxTransportLatencyMin = 0x0005;
 constexpr uint16_t kMaxTransportLatencyMax = 0x0FA0;
 
-/* Enums */
-enum class CigState : uint8_t { NONE, CREATING, CREATED, REMOVING };
+enum class CigState : uint8_t { NONE, CREATING, CREATED, REMOVING, RECOVERING };
 
 /* ASE states according to BAP defined state machine states */
 enum class AseState : uint8_t {
@@ -333,6 +332,19 @@
   DATA_PATH_ESTABLISHED,
 };
 
+enum class CisType {
+  CIS_TYPE_BIDIRECTIONAL,
+  CIS_TYPE_UNIDIRECTIONAL_SINK,
+  CIS_TYPE_UNIDIRECTIONAL_SOURCE,
+};
+
+struct cis {
+  uint8_t id;
+  CisType type;
+  uint16_t conn_handle;
+  RawAddress addr;
+};
+
 enum class CodecLocation {
   HOST,
   ADSP,
@@ -357,6 +369,95 @@
   RFU = 0x1000,
 };
 
+class AudioContexts {
+  using T = std::underlying_type<LeAudioContextType>::type;
+  T mValue;
+
+ public:
+  explicit constexpr AudioContexts()
+      : mValue(static_cast<T>(LeAudioContextType::UNINITIALIZED)) {}
+  explicit constexpr AudioContexts(const T& v) : mValue(v) {}
+  explicit constexpr AudioContexts(const LeAudioContextType& v)
+      : mValue(static_cast<T>(v)) {}
+  constexpr AudioContexts(const AudioContexts& other)
+      : mValue(static_cast<T>(other.value())) {}
+
+  constexpr T value() const { return mValue; }
+  T& value_ref() { return mValue; }
+  bool none() const {
+    return mValue == static_cast<T>(LeAudioContextType::UNINITIALIZED);
+  }
+  bool any() const { return !none(); }
+
+  void set(LeAudioContextType const& v) { mValue |= static_cast<T>(v); }
+  void unset(const LeAudioContextType& v) { mValue &= ~static_cast<T>(v); }
+
+  bool test(const LeAudioContextType& v) const {
+    return (mValue & static_cast<T>(v)) != 0;
+  }
+  bool test_all(const AudioContexts& v) const {
+    return (mValue & v.value()) == v.value();
+  }
+  bool test_any(const AudioContexts& v) const {
+    return (mValue & v.value()) != 0;
+  }
+  void clear() { mValue = static_cast<T>(LeAudioContextType::UNINITIALIZED); }
+
+  std::string to_string() const;
+
+  AudioContexts& operator=(AudioContexts&& other) = default;
+  AudioContexts& operator=(const AudioContexts&) = default;
+  bool operator==(const AudioContexts& other) const {
+    return value() == other.value();
+  };
+  constexpr AudioContexts operator~() const { return AudioContexts(~value()); }
+};
+
+AudioContexts operator|(std::underlying_type<LeAudioContextType>::type lhs,
+                        const LeAudioContextType rhs);
+AudioContexts& operator|=(AudioContexts& lhs, AudioContexts const& rhs);
+AudioContexts& operator&=(AudioContexts& lhs, AudioContexts const& rhs);
+
+constexpr AudioContexts operator^(const AudioContexts& lhs,
+                                  const AudioContexts& rhs) {
+  return AudioContexts(lhs.value() ^ rhs.value());
+}
+constexpr AudioContexts operator|(const AudioContexts& lhs,
+                                  const AudioContexts& rhs) {
+  return AudioContexts(lhs.value() | rhs.value());
+}
+constexpr AudioContexts operator&(const AudioContexts& lhs,
+                                  const AudioContexts& rhs) {
+  return AudioContexts(lhs.value() & rhs.value());
+}
+constexpr AudioContexts operator|(const LeAudioContextType& lhs,
+                                  const LeAudioContextType& rhs) {
+  using T = std::underlying_type<LeAudioContextType>::type;
+  return AudioContexts(static_cast<T>(lhs) | static_cast<T>(rhs));
+}
+constexpr AudioContexts operator|(const LeAudioContextType& lhs,
+                                  const AudioContexts& rhs) {
+  return AudioContexts(lhs) | rhs;
+}
+constexpr AudioContexts operator|(const AudioContexts& lhs,
+                                  const LeAudioContextType& rhs) {
+  return lhs | AudioContexts(rhs);
+}
+
+std::string ToHexString(const types::LeAudioContextType& value);
+
+template <typename T>
+struct BidirectionalPair {
+  T sink;
+  T source;
+};
+
+template <typename T>
+T get_bidirectional(BidirectionalPair<T> p);
+
+template <>
+AudioContexts get_bidirectional(BidirectionalPair<AudioContexts> p);
+
 /* Configuration strategy */
 enum class LeAudioConfigurationStrategy : uint8_t {
   MONO_ONE_CIS_PER_DEVICE = 0x00, /* Common true wireless speakers */
@@ -366,13 +467,6 @@
   RFU = 0x03,
 };
 
-constexpr LeAudioContextType operator|(LeAudioContextType lhs,
-                                       LeAudioContextType rhs) {
-  return static_cast<LeAudioContextType>(
-      static_cast<std::underlying_type<LeAudioContextType>::type>(lhs) |
-      static_cast<std::underlying_type<LeAudioContextType>::type>(rhs));
-}
-
 constexpr LeAudioContextType kLeAudioContextAllTypesArray[] = {
     LeAudioContextType::UNSPECIFIED,   LeAudioContextType::CONVERSATIONAL,
     LeAudioContextType::MEDIA,         LeAudioContextType::GAME,
@@ -382,7 +476,7 @@
     LeAudioContextType::ALERTS,        LeAudioContextType::EMERGENCYALARM,
 };
 
-constexpr LeAudioContextType kLeAudioContextAllTypes =
+constexpr AudioContexts kLeAudioContextAllTypes =
     LeAudioContextType::UNSPECIFIED | LeAudioContextType::CONVERSATIONAL |
     LeAudioContextType::MEDIA | LeAudioContextType::GAME |
     LeAudioContextType::INSTRUCTIONAL | LeAudioContextType::VOICEASSISTANTS |
@@ -401,6 +495,7 @@
   void Add(uint8_t type, std::vector<uint8_t> value) {
     values.insert_or_assign(type, std::move(value));
   }
+  void Remove(uint8_t type) { values.erase(type); }
   bool IsEmpty() const { return values.empty(); }
   void Clear() { values.clear(); }
   size_t Size() const { return values.size(); }
@@ -520,9 +615,10 @@
 struct ase {
   static constexpr uint8_t kAseIdInvalid = 0x00;
 
-  ase(uint16_t val_hdl, uint16_t ccc_hdl, uint8_t direction)
+  ase(uint16_t val_hdl, uint16_t ccc_hdl, uint8_t direction,
+      uint8_t initial_id = kAseIdInvalid)
       : hdls(val_hdl, ccc_hdl),
-        id(kAseIdInvalid),
+        id(initial_id),
         cis_id(kInvalidCisId),
         direction(direction),
         target_latency(types::kTargetLatencyBalancedLatencyReliability),
@@ -531,6 +627,13 @@
         data_path_state(AudioStreamDataPathState::IDLE),
         configured_for_context_type(LeAudioContextType::UNINITIALIZED),
         preferred_phy(0),
+        max_sdu_size(0),
+        retrans_nb(0),
+        max_transport_latency(0),
+        pres_delay_min(0),
+        pres_delay_max(0),
+        preferred_pres_delay_min(0),
+        preferred_pres_delay_max(0),
         state(AseState::BTA_LE_AUDIO_ASE_STATE_IDLE) {}
 
   struct hdl_pair hdls;
@@ -579,12 +682,14 @@
 using PublishedAudioCapabilities =
     std::vector<std::tuple<hdl_pair, std::vector<acs_ac_record>>>;
 using AudioLocations = std::bitset<32>;
-using AudioContexts = std::bitset<16>;
 
 std::ostream& operator<<(std::ostream& os, const AseState& state);
 std::ostream& operator<<(std::ostream& os, const CigState& state);
 std::ostream& operator<<(std::ostream& os, const LeAudioLc3Config& config);
 std::ostream& operator<<(std::ostream& os, const LeAudioContextType& context);
+std::ostream& operator<<(std::ostream& os,
+                         const AudioStreamDataPathState& state);
+std::ostream& operator<<(std::ostream& os, const AudioContexts& contexts);
 }  // namespace types
 
 namespace set_configurations {
@@ -653,6 +758,12 @@
     codec_spec_conf::kLeAudioLocationFrontRight;
 
 /* Declarations */
+void get_cis_count(const AudioSetConfigurations& audio_set_configurations,
+                   int expected_device_cnt,
+                   types::LeAudioConfigurationStrategy strategy,
+                   int group_ase_snk_cnt, int group_ase_src_count,
+                   uint8_t& cis_count_bidir, uint8_t& cis_count_unidir_sink,
+                   uint8_t& cis_count_unidir_source);
 bool check_if_may_cover_scenario(
     const AudioSetConfigurations* audio_set_configurations, uint8_t group_size);
 bool check_if_may_cover_scenario(
@@ -684,6 +795,14 @@
   int sink_num_of_devices;
   /* cis_handle, audio location*/
   std::vector<std::pair<uint16_t, uint32_t>> sink_streams;
+  /* cis_handle, target allocation */
+  std::vector<std::pair<uint16_t, uint32_t>>
+      sink_offloader_streams_target_allocation;
+  /* cis_handle, current allocation */
+  std::vector<std::pair<uint16_t, uint32_t>>
+      sink_offloader_streams_current_allocation;
+  bool sink_offloader_changed;
+  bool sink_is_initial;
 
   /* Source configuration */
   /* For now we have always same frequency for all the channels */
@@ -697,11 +816,20 @@
   int source_num_of_devices;
   /* cis_handle, audio location*/
   std::vector<std::pair<uint16_t, uint32_t>> source_streams;
+  /* cis_handle, target allocation */
+  std::vector<std::pair<uint16_t, uint32_t>>
+      source_offloader_streams_target_allocation;
+  /* cis_handle, current allocation */
+  std::vector<std::pair<uint16_t, uint32_t>>
+      source_offloader_streams_current_allocation;
+  bool source_offloader_changed;
+  bool source_is_initial;
 };
 
 void AppendMetadataLtvEntryForCcidList(std::vector<uint8_t>& metadata,
-                                       int ccid);
+                                       const std::vector<uint8_t>& ccid_list);
 void AppendMetadataLtvEntryForStreamingContext(
-    std::vector<uint8_t>& metadata, types::LeAudioContextType context_type);
+    std::vector<uint8_t>& metadata, types::AudioContexts context_type);
 uint8_t GetMaxCodecFramesPerSduFromPac(const types::acs_ac_record* pac_record);
+uint32_t AdjustAllocationForOffloader(uint32_t allocation);
 }  // namespace le_audio
\ No newline at end of file
diff --git a/system/bta/le_audio/le_audio_utils.cc b/system/bta/le_audio/le_audio_utils.cc
new file mode 100644
index 0000000..6b76124
--- /dev/null
+++ b/system/bta/le_audio/le_audio_utils.cc
@@ -0,0 +1,246 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "le_audio_utils.h"
+
+#include "bta/le_audio/content_control_id_keeper.h"
+#include "gd/common/strings.h"
+#include "le_audio_types.h"
+#include "osi/include/log.h"
+
+using bluetooth::common::ToString;
+using le_audio::types::AudioContexts;
+using le_audio::types::LeAudioContextType;
+
+namespace le_audio {
+namespace utils {
+
+/* The returned LeAudioContextType should have its entry in the
+ * AudioSetConfigurationProvider's ContextTypeToScenario mapping table.
+ * Otherwise the AudioSetConfigurationProvider will fall back
+ * to default scenario.
+ */
+LeAudioContextType AudioContentToLeAudioContext(
+    audio_content_type_t content_type, audio_usage_t usage) {
+  /* Check audio attribute usage of stream */
+  switch (usage) {
+    case AUDIO_USAGE_MEDIA:
+      return LeAudioContextType::MEDIA;
+    case AUDIO_USAGE_ASSISTANT:
+      return LeAudioContextType::VOICEASSISTANTS;
+    case AUDIO_USAGE_VOICE_COMMUNICATION:
+    case AUDIO_USAGE_CALL_ASSISTANT:
+      return LeAudioContextType::CONVERSATIONAL;
+    case AUDIO_USAGE_VOICE_COMMUNICATION_SIGNALLING:
+      if (content_type == AUDIO_CONTENT_TYPE_SPEECH)
+        return LeAudioContextType::CONVERSATIONAL;
+      else
+        return LeAudioContextType::MEDIA;
+    case AUDIO_USAGE_GAME:
+      return LeAudioContextType::GAME;
+    case AUDIO_USAGE_NOTIFICATION:
+      return LeAudioContextType::NOTIFICATIONS;
+    case AUDIO_USAGE_NOTIFICATION_TELEPHONY_RINGTONE:
+      return LeAudioContextType::RINGTONE;
+    case AUDIO_USAGE_ALARM:
+      return LeAudioContextType::ALERTS;
+    case AUDIO_USAGE_EMERGENCY:
+      return LeAudioContextType::EMERGENCYALARM;
+    case AUDIO_USAGE_ASSISTANCE_NAVIGATION_GUIDANCE:
+      return LeAudioContextType::INSTRUCTIONAL;
+    case AUDIO_USAGE_ASSISTANCE_SONIFICATION:
+      return LeAudioContextType::SOUNDEFFECTS;
+    default:
+      break;
+  }
+
+  return LeAudioContextType::MEDIA;
+}
+
+static std::string usageToString(audio_usage_t usage) {
+  switch (usage) {
+    case AUDIO_USAGE_UNKNOWN:
+      return "USAGE_UNKNOWN";
+    case AUDIO_USAGE_MEDIA:
+      return "USAGE_MEDIA";
+    case AUDIO_USAGE_VOICE_COMMUNICATION:
+      return "USAGE_VOICE_COMMUNICATION";
+    case AUDIO_USAGE_VOICE_COMMUNICATION_SIGNALLING:
+      return "USAGE_VOICE_COMMUNICATION_SIGNALLING";
+    case AUDIO_USAGE_ALARM:
+      return "USAGE_ALARM";
+    case AUDIO_USAGE_NOTIFICATION:
+      return "USAGE_NOTIFICATION";
+    case AUDIO_USAGE_NOTIFICATION_TELEPHONY_RINGTONE:
+      return "USAGE_NOTIFICATION_TELEPHONY_RINGTONE";
+    case AUDIO_USAGE_NOTIFICATION_COMMUNICATION_REQUEST:
+      return "USAGE_NOTIFICATION_COMMUNICATION_REQUEST";
+    case AUDIO_USAGE_NOTIFICATION_COMMUNICATION_INSTANT:
+      return "USAGE_NOTIFICATION_COMMUNICATION_INSTANT";
+    case AUDIO_USAGE_NOTIFICATION_COMMUNICATION_DELAYED:
+      return "USAGE_NOTIFICATION_COMMUNICATION_DELAYED";
+    case AUDIO_USAGE_NOTIFICATION_EVENT:
+      return "USAGE_NOTIFICATION_EVENT";
+    case AUDIO_USAGE_ASSISTANCE_ACCESSIBILITY:
+      return "USAGE_ASSISTANCE_ACCESSIBILITY";
+    case AUDIO_USAGE_ASSISTANCE_NAVIGATION_GUIDANCE:
+      return "USAGE_ASSISTANCE_NAVIGATION_GUIDANCE";
+    case AUDIO_USAGE_ASSISTANCE_SONIFICATION:
+      return "USAGE_ASSISTANCE_SONIFICATION";
+    case AUDIO_USAGE_GAME:
+      return "USAGE_GAME";
+    case AUDIO_USAGE_ASSISTANT:
+      return "USAGE_ASSISTANT";
+    case AUDIO_USAGE_CALL_ASSISTANT:
+      return "USAGE_CALL_ASSISTANT";
+    case AUDIO_USAGE_EMERGENCY:
+      return "USAGE_EMERGENCY";
+    case AUDIO_USAGE_SAFETY:
+      return "USAGE_SAFETY";
+    case AUDIO_USAGE_VEHICLE_STATUS:
+      return "USAGE_VEHICLE_STATUS";
+    case AUDIO_USAGE_ANNOUNCEMENT:
+      return "USAGE_ANNOUNCEMENT";
+    default:
+      return "unknown usage ";
+  }
+}
+
+static std::string contentTypeToString(audio_content_type_t content_type) {
+  switch (content_type) {
+    case AUDIO_CONTENT_TYPE_UNKNOWN:
+      return "CONTENT_TYPE_UNKNOWN";
+    case AUDIO_CONTENT_TYPE_SPEECH:
+      return "CONTENT_TYPE_SPEECH";
+    case AUDIO_CONTENT_TYPE_MUSIC:
+      return "CONTENT_TYPE_MUSIC";
+    case AUDIO_CONTENT_TYPE_MOVIE:
+      return "CONTENT_TYPE_MOVIE";
+    case AUDIO_CONTENT_TYPE_SONIFICATION:
+      return "CONTENT_TYPE_SONIFICATION";
+    default:
+      return "unknown content type ";
+  }
+}
+
+static const char* audioSourceToStr(audio_source_t source) {
+  const char* strArr[] = {
+      "AUDIO_SOURCE_DEFAULT",           "AUDIO_SOURCE_MIC",
+      "AUDIO_SOURCE_VOICE_UPLINK",      "AUDIO_SOURCE_VOICE_DOWNLINK",
+      "AUDIO_SOURCE_VOICE_CALL",        "AUDIO_SOURCE_CAMCORDER",
+      "AUDIO_SOURCE_VOICE_RECOGNITION", "AUDIO_SOURCE_VOICE_COMMUNICATION",
+      "AUDIO_SOURCE_REMOTE_SUBMIX",     "AUDIO_SOURCE_UNPROCESSED",
+      "AUDIO_SOURCE_VOICE_PERFORMANCE"};
+
+  if (static_cast<uint32_t>(source) < (sizeof(strArr) / sizeof(strArr[0])))
+    return strArr[source];
+  return "UNKNOWN";
+}
+
+AudioContexts GetAllowedAudioContextsFromSourceMetadata(
+    const std::vector<struct playback_track_metadata>& source_metadata,
+    AudioContexts allowed_contexts) {
+  AudioContexts track_contexts;
+  for (auto& track : source_metadata) {
+    if (track.content_type == 0 && track.usage == 0) continue;
+
+    LOG_INFO("%s: usage=%s(%d), content_type=%s(%d), gain=%f", __func__,
+             usageToString(track.usage).c_str(), track.usage,
+             contentTypeToString(track.content_type).c_str(),
+             track.content_type, track.gain);
+
+    track_contexts.set(
+        AudioContentToLeAudioContext(track.content_type, track.usage));
+  }
+  track_contexts &= allowed_contexts;
+  LOG_INFO("%s: allowed context= %s", __func__,
+           track_contexts.to_string().c_str());
+
+  return track_contexts;
+}
+
+AudioContexts GetAllowedAudioContextsFromSinkMetadata(
+    const std::vector<struct record_track_metadata>& sink_metadata,
+    AudioContexts allowed_contexts) {
+  AudioContexts all_track_contexts;
+
+  for (auto& track : sink_metadata) {
+    if (track.source == AUDIO_SOURCE_INVALID) continue;
+    LeAudioContextType track_context;
+
+    LOG_DEBUG(
+        "source=%s(0x%02x), gain=%f, destination device=0x%08x, destination "
+        "device address=%.32s, allowed_contexts=%s",
+        audioSourceToStr(track.source), track.source, track.gain,
+        track.dest_device, track.dest_device_address,
+        bluetooth::common::ToString(allowed_contexts).c_str());
+
+    if ((track.source == AUDIO_SOURCE_MIC) &&
+        (allowed_contexts.test(LeAudioContextType::LIVE))) {
+      track_context = LeAudioContextType::LIVE;
+
+    } else if ((track.source == AUDIO_SOURCE_VOICE_COMMUNICATION) &&
+               (allowed_contexts.test(LeAudioContextType::CONVERSATIONAL))) {
+      track_context = LeAudioContextType::CONVERSATIONAL;
+
+    } else if (allowed_contexts.test(LeAudioContextType::VOICEASSISTANTS)) {
+      /* Fallback to voice assistant
+       * This will handle also a case when the device is
+       * AUDIO_SOURCE_VOICE_RECOGNITION
+       */
+      track_context = LeAudioContextType::VOICEASSISTANTS;
+      LOG_WARN(
+          "Could not match the recording track type to group available "
+          "context. Using context %s.",
+          ToString(track_context).c_str());
+    }
+
+    all_track_contexts.set(track_context);
+  }
+
+  if (all_track_contexts.none()) {
+    all_track_contexts = AudioContexts(
+        static_cast<std::underlying_type<LeAudioContextType>::type>(
+            LeAudioContextType::UNSPECIFIED));
+    LOG_DEBUG(
+        "Unable to find supported audio source context for the remote audio "
+        "sink device. This may result in voice back channel malfunction.");
+  }
+
+  LOG_DEBUG("Allowed contexts from sink metadata: %s (0x%08hx)",
+            bluetooth::common::ToString(all_track_contexts).c_str(),
+            all_track_contexts.value());
+  return all_track_contexts;
+}
+
+std::vector<uint8_t> GetAllCcids(const AudioContexts& contexts) {
+  auto ccid_keeper = ContentControlIdKeeper::GetInstance();
+  std::vector<uint8_t> ccid_vec;
+
+  for (LeAudioContextType context : types::kLeAudioContextAllTypesArray) {
+    if (!contexts.test(context)) continue;
+    using T = std::underlying_type<LeAudioContextType>::type;
+    auto ccid = ccid_keeper->GetCcid(static_cast<T>(context));
+    if (ccid != -1) {
+      ccid_vec.push_back(static_cast<uint8_t>(ccid));
+    }
+  }
+
+  return ccid_vec;
+}
+
+}  // namespace utils
+}  // namespace le_audio
diff --git a/system/bta/le_audio/le_audio_utils.h b/system/bta/le_audio/le_audio_utils.h
new file mode 100644
index 0000000..cac6c84
--- /dev/null
+++ b/system/bta/le_audio/le_audio_utils.h
@@ -0,0 +1,49 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include <hardware/audio.h>
+
+#include <bitset>
+#include <vector>
+
+#include "le_audio_types.h"
+
+namespace le_audio {
+namespace utils {
+types::LeAudioContextType AudioContentToLeAudioContext(
+    audio_content_type_t content_type, audio_usage_t usage);
+types::AudioContexts GetAllowedAudioContextsFromSourceMetadata(
+    const std::vector<struct playback_track_metadata>& source_metadata,
+    types::AudioContexts allowed_contexts);
+types::AudioContexts GetAllowedAudioContextsFromSinkMetadata(
+    const std::vector<struct record_track_metadata>& source_metadata,
+    types::AudioContexts allowed_contexts);
+std::vector<uint8_t> GetAllCcids(const types::AudioContexts& contexts);
+
+static inline bool IsContextForAudioSource(types::LeAudioContextType c) {
+  if (c == types::LeAudioContextType::CONVERSATIONAL ||
+      c == types::LeAudioContextType::VOICEASSISTANTS ||
+      c == types::LeAudioContextType::LIVE ||
+      c == types::LeAudioContextType::GAME) {
+    return true;
+  }
+  return false;
+}
+
+}  // namespace utils
+}  // namespace le_audio
diff --git a/system/bta/le_audio/mock_codec_manager.cc b/system/bta/le_audio/mock_codec_manager.cc
index d433b5f..cc5f4db 100644
--- a/system/bta/le_audio/mock_codec_manager.cc
+++ b/system/bta/le_audio/mock_codec_manager.cc
@@ -61,6 +61,20 @@
   return pimpl_->GetOffloadCodecConfig(ctx_type);
 }
 
+const ::le_audio::broadcast_offload_config*
+CodecManager::GetBroadcastOffloadConfig() {
+  if (!pimpl_) return nullptr;
+  return pimpl_->GetBroadcastOffloadConfig();
+}
+
+void CodecManager::UpdateBroadcastConnHandle(
+    const std::vector<uint16_t>& conn_handle,
+    std::function<void(const ::le_audio::broadcast_offload_config& config)>
+        update_receiver) {
+  if (pimpl_)
+    return pimpl_->UpdateBroadcastConnHandle(conn_handle, update_receiver);
+}
+
 void CodecManager::Start(
     const std::vector<bluetooth::le_audio::btle_audio_codec_config_t>&
         offloading_preference) {
diff --git a/system/bta/le_audio/mock_codec_manager.h b/system/bta/le_audio/mock_codec_manager.h
index bb28861..d73132d 100644
--- a/system/bta/le_audio/mock_codec_manager.h
+++ b/system/bta/le_audio/mock_codec_manager.h
@@ -44,6 +44,13 @@
   MOCK_METHOD((le_audio::set_configurations::AudioSetConfigurations*),
               GetOffloadCodecConfig,
               (le_audio::types::LeAudioContextType ctx_type), (const));
+  MOCK_METHOD((le_audio::broadcast_offload_config*), GetBroadcastOffloadConfig,
+              (), (const));
+  MOCK_METHOD(
+      (void), UpdateBroadcastConnHandle,
+      (const std::vector<uint16_t>& conn_handle,
+       std::function<void(const ::le_audio::broadcast_offload_config& config)>
+           update_receiver));
 
   MOCK_METHOD((void), Start, ());
   MOCK_METHOD((void), Stop, ());
diff --git a/system/bta/le_audio/mock_iso_manager.cc b/system/bta/le_audio/mock_iso_manager.cc
index fe521eb..a276be6 100644
--- a/system/bta/le_audio/mock_iso_manager.cc
+++ b/system/bta/le_audio/mock_iso_manager.cc
@@ -58,7 +58,9 @@
   pimpl_->ReconfigureCig(cig_id, std::move(cig_params));
 }
 
-void IsoManager::RemoveCig(uint8_t cig_id) { pimpl_->RemoveCig(cig_id); }
+void IsoManager::RemoveCig(uint8_t cig_id, bool force) {
+  pimpl_->RemoveCig(cig_id, force);
+}
 
 void IsoManager::EstablishCis(
     struct iso_manager::cis_establish_params conn_params) {
diff --git a/system/bta/le_audio/mock_iso_manager.h b/system/bta/le_audio/mock_iso_manager.h
index 8db3ade..e5a3247 100644
--- a/system/bta/le_audio/mock_iso_manager.h
+++ b/system/bta/le_audio/mock_iso_manager.h
@@ -43,7 +43,7 @@
       (void), ReconfigureCig,
       (uint8_t cig_id,
        struct bluetooth::hci::iso_manager::cig_create_params cig_params));
-  MOCK_METHOD((void), RemoveCig, (uint8_t cig_id));
+  MOCK_METHOD((void), RemoveCig, (uint8_t cig_id, bool force));
   MOCK_METHOD(
       (void), EstablishCis,
       (struct bluetooth::hci::iso_manager::cis_establish_params conn_params));
diff --git a/system/bta/le_audio/mock_state_machine.h b/system/bta/le_audio/mock_state_machine.h
index 63e850b..ac98e45 100644
--- a/system/bta/le_audio/mock_state_machine.h
+++ b/system/bta/le_audio/mock_state_machine.h
@@ -25,7 +25,9 @@
  public:
   MOCK_METHOD((bool), StartStream,
               (le_audio::LeAudioDeviceGroup * group,
-               le_audio::types::LeAudioContextType context_type, int ccid),
+               le_audio::types::LeAudioContextType context_type,
+               le_audio::types::AudioContexts metadata_context_type,
+               std::vector<uint8_t> ccid_list),
               (override));
   MOCK_METHOD((bool), AttachToStream,
               (le_audio::LeAudioDeviceGroup * group,
@@ -35,7 +37,9 @@
               (override));
   MOCK_METHOD((bool), ConfigureStream,
               (le_audio::LeAudioDeviceGroup * group,
-               le_audio::types::LeAudioContextType context_type, int ccid),
+               le_audio::types::LeAudioContextType context_type,
+               le_audio::types::AudioContexts metadata_context_type,
+               std::vector<uint8_t> ccid_list),
               (override));
   MOCK_METHOD((void), StopStream, (le_audio::LeAudioDeviceGroup * group),
               (override));
diff --git a/system/bta/le_audio/state_machine.cc b/system/bta/le_audio/state_machine.cc
index 686d9a0..9b91b43 100644
--- a/system/bta/le_audio/state_machine.cc
+++ b/system/bta/le_audio/state_machine.cc
@@ -28,6 +28,7 @@
 #include "btm_iso_api.h"
 #include "client_parser.h"
 #include "codec_manager.h"
+#include "content_control_id_keeper.h"
 #include "devices.h"
 #include "gd/common/strings.h"
 #include "hcimsgs.h"
@@ -98,8 +99,11 @@
 
 using le_audio::types::ase;
 using le_audio::types::AseState;
+using le_audio::types::AudioContexts;
 using le_audio::types::AudioStreamDataPathState;
+using le_audio::types::CigState;
 using le_audio::types::CodecLocation;
+using le_audio::types::LeAudioContextType;
 
 namespace {
 
@@ -141,34 +145,56 @@
       return false;
     }
 
+    auto context_type = group->GetConfigurationContextType();
+    auto metadata_context_type = group->GetMetadataContexts();
+
+    auto ccid = le_audio::ContentControlIdKeeper::GetInstance()->GetCcid(
+        static_cast<uint16_t>(context_type));
+    std::vector<uint8_t> ccids;
+    if (ccid != -1) {
+      ccids.push_back(static_cast<uint8_t>(ccid));
+    }
+
+    if (!group->Configure(context_type, metadata_context_type, ccids)) {
+      LOG_ERROR(" failed to set ASE configuration");
+      return false;
+    }
+
     PrepareAndSendCodecConfigure(group, leAudioDevice);
     return true;
   }
 
   bool StartStream(LeAudioDeviceGroup* group,
                    le_audio::types::LeAudioContextType context_type,
-                   int ccid) override {
+                   AudioContexts metadata_context_type,
+                   std::vector<uint8_t> ccid_list) override {
     LOG_INFO(" current state: %s", ToString(group->GetState()).c_str());
 
     switch (group->GetState()) {
       case AseState::BTA_LE_AUDIO_ASE_STATE_CODEC_CONFIGURED:
-        if (group->GetCurrentContextType() == context_type) {
-          group->Activate(context_type);
-          SetTargetState(group, AseState::BTA_LE_AUDIO_ASE_STATE_STREAMING);
-          CigCreate(group);
-          return true;
+        if (group->GetConfigurationContextType() == context_type) {
+          if (group->Activate(context_type)) {
+            SetTargetState(group, AseState::BTA_LE_AUDIO_ASE_STATE_STREAMING);
+            if (CigCreate(group)) {
+              return true;
+            }
+          }
+          LOG_INFO("Could not activate device, try to configure it again");
         }
 
+        /* We are going to reconfigure whole group. Clear Cises.*/
+        ReleaseCisIds(group);
+
         /* If configuration is needed */
         FALLTHROUGH;
       case AseState::BTA_LE_AUDIO_ASE_STATE_IDLE:
-        if (!group->Configure(context_type, ccid)) {
+        if (!group->Configure(context_type, metadata_context_type, ccid_list)) {
           LOG(ERROR) << __func__ << ", failed to set ASE configuration";
           return false;
         }
 
+        group->CigGenerateCisIds(context_type);
         /* All ASEs should aim to achieve target state */
-        group->SetContextType(context_type);
         SetTargetState(group, AseState::BTA_LE_AUDIO_ASE_STATE_STREAMING);
         PrepareAndSendCodecConfigure(group, group->GetFirstActiveDevice());
         break;
@@ -188,9 +214,11 @@
 
       case AseState::BTA_LE_AUDIO_ASE_STATE_STREAMING: {
         /* This case just updates the metadata for the stream, in case
-         * stream configuration is satisfied
+         * stream configuration is satisfied. We can do that already for
+         * all the devices in a group, without any state transitions.
          */
-        if (!group->IsMetadataChanged(context_type, ccid)) return true;
+        if (!group->IsMetadataChanged(metadata_context_type, ccid_list))
+          return true;
 
         LeAudioDevice* leAudioDevice = group->GetFirstActiveDevice();
         if (!leAudioDevice) {
@@ -198,7 +226,11 @@
           return false;
         }
 
-        PrepareAndSendUpdateMetadata(group, leAudioDevice, context_type, ccid);
+        while (leAudioDevice) {
+          PrepareAndSendUpdateMetadata(leAudioDevice, metadata_context_type,
+                                       ccid_list);
+          leAudioDevice = group->GetNextActiveDevice(leAudioDevice);
+        }
         break;
       }
 
@@ -213,7 +245,8 @@
 
   bool ConfigureStream(LeAudioDeviceGroup* group,
                        le_audio::types::LeAudioContextType context_type,
-                       int ccid) override {
+                       AudioContexts metadata_context_type,
+                       std::vector<uint8_t> ccid_list) override {
     if (group->GetState() > AseState::BTA_LE_AUDIO_ASE_STATE_CODEC_CONFIGURED) {
       LOG_ERROR(
           "Stream should be stopped or in configured stream. Current state: %s",
@@ -221,13 +254,16 @@
       return false;
     }
 
-    if (!group->Configure(context_type, ccid)) {
+    ReleaseCisIds(group);
+
+    if (!group->Configure(context_type, metadata_context_type, ccid_list)) {
       LOG_ERROR("Could not configure ASEs for group %d content type %d",
                 group->group_id_, int(context_type));
 
       return false;
     }
 
+    group->CigGenerateCisIds(context_type);
     SetTargetState(group, AseState::BTA_LE_AUDIO_ASE_STATE_CODEC_CONFIGURED);
     PrepareAndSendCodecConfigure(group, group->GetFirstActiveDevice());
 
@@ -247,7 +283,7 @@
   }
 
   void StopStream(LeAudioDeviceGroup* group) override {
-    if (group->IsReleasing()) {
+    if (group->IsReleasingOrIdle()) {
       LOG(INFO) << __func__ << ", group: " << group->group_id_
                 << " already in releasing process";
       return;
@@ -320,10 +356,6 @@
   void ProcessHciNotifOnCigCreate(LeAudioDeviceGroup* group, uint8_t status,
                                   uint8_t cig_id,
                                   std::vector<uint16_t> conn_handles) override {
-    uint8_t i = 0;
-    LeAudioDevice* leAudioDevice;
-    struct le_audio::types::ase* ase;
-
     /* TODO: What if not all cises will be configured ?
      * conn_handle.size() != active ases in group
      */
@@ -334,55 +366,39 @@
     }
 
     if (status != HCI_SUCCESS) {
-      group->cig_state_ = le_audio::types::CigState::NONE;
+      if (status == HCI_ERR_COMMAND_DISALLOWED) {
+        /*
+         * We are here, because stack has no chance to remove CIG when it was
+         * shut during streaming. In the same time, controller probably was not
+         * Reseted, which creates the issue. Lets remove CIG and try to create
+         * it again.
+         */
+        group->SetCigState(CigState::RECOVERING);
+        IsoManager::GetInstance()->RemoveCig(group->group_id_, true);
+        return;
+      }
+
+      group->SetCigState(CigState::NONE);
       LOG_ERROR(", failed to create CIG, reason: 0x%02x, new cig state: %s",
                 +status, ToString(group->cig_state_).c_str());
       StopStream(group);
       return;
     }
 
-    ASSERT_LOG(group->cig_state_ == le_audio::types::CigState::CREATING,
+    ASSERT_LOG(group->GetCigState() == CigState::CREATING,
                "Unexpected CIG creation group id: %d, cig state: %s",
                group->group_id_, ToString(group->cig_state_).c_str());
 
-    group->cig_state_ = le_audio::types::CigState::CREATED;
+    group->SetCigState(CigState::CREATED);
     LOG_INFO("Group: %p, id: %d cig state: %s, number of cis handles: %d",
              group, group->group_id_, ToString(group->cig_state_).c_str(),
              static_cast<int>(conn_handles.size()));
 
-    /* Assign all connection handles to ases. CIS ID order is represented by the
-     * order of active ASEs in active leAudioDevices
-     */
-
-    leAudioDevice = group->GetFirstActiveDevice();
-    LOG_ASSERT(leAudioDevice)
-        << __func__ << " Shouldn't be called without an active device.";
+    /* Assign all connection handles to cis ids */
+    group->CigAssignCisConnHandles(conn_handles);
 
     /* Assign all connection handles to ases */
-    do {
-      ase = leAudioDevice->GetFirstActiveAseByDataPathState(
-          AudioStreamDataPathState::IDLE);
-      LOG_ASSERT(ase) << __func__
-                      << " shouldn't be called without an active ASE";
-      do {
-        auto ases_pair = leAudioDevice->GetAsesByCisId(ase->cis_id);
-
-        if (ases_pair.sink && ases_pair.sink->active) {
-          ases_pair.sink->cis_conn_hdl = conn_handles[i];
-          ases_pair.sink->data_path_state =
-              AudioStreamDataPathState::CIS_ASSIGNED;
-        }
-        if (ases_pair.source && ases_pair.source->active) {
-          ases_pair.source->cis_conn_hdl = conn_handles[i];
-          ases_pair.source->data_path_state =
-              AudioStreamDataPathState::CIS_ASSIGNED;
-        }
-        i++;
-      } while ((ase = leAudioDevice->GetFirstActiveAseByDataPathState(
-                    AudioStreamDataPathState::IDLE)) &&
-               (i < conn_handles.size()));
-    } while ((leAudioDevice = group->GetNextActiveDevice(leAudioDevice)) &&
-             (i < conn_handles.size()));
+    group->CigAssignCisConnHandlesToAses();
 
     /* Last node configured, process group to codec configured state */
     group->SetState(AseState::BTA_LE_AUDIO_ASE_STATE_QOS_CONFIGURED);
@@ -405,21 +421,46 @@
     leAudioDevice->link_quality_timer = nullptr;
   }
 
+  void ProcessHciNotifyOnCigRemoveRecovering(uint8_t status,
+                                             LeAudioDeviceGroup* group) {
+    group->SetCigState(CigState::NONE);
+
+    if (status != HCI_SUCCESS) {
+      LOG_ERROR(
+          "Could not recover from the COMMAND DISALLOAD on CigCreate. Status "
+          "on CIG remove is 0x%02x",
+          status);
+      StopStream(group);
+      return;
+    }
+    LOG_INFO("Succeed on CIG Recover - back to creating CIG");
+    if (!CigCreate(group)) {
+      LOG_ERROR("Could not create CIG. Stop the stream for group %d",
+                group->group_id_);
+      StopStream(group);
+    }
+  }
+
   void ProcessHciNotifOnCigRemove(uint8_t status,
                                   LeAudioDeviceGroup* group) override {
-    if (status) {
-      group->cig_state_ = le_audio::types::CigState::CREATED;
-      LOG_ERROR(
-          "failed to remove cig, id: %d, status 0x%02x, new cig state: %s",
-          group->group_id_, +status, ToString(group->cig_state_).c_str());
+    if (group->GetCigState() == CigState::RECOVERING) {
+      ProcessHciNotifyOnCigRemoveRecovering(status, group);
       return;
     }
 
-    ASSERT_LOG(group->cig_state_ == le_audio::types::CigState::REMOVING,
-               "Unexpected CIG remove group id: %d, cig state %s",
-               group->group_id_, ToString(group->cig_state_).c_str());
+    if (status != HCI_SUCCESS) {
+      group->SetCigState(CigState::CREATED);
+      LOG_ERROR(
+          "failed to remove cig, id: %d, status 0x%02x, new cig state: %s",
+          group->group_id_, +status, ToString(group->GetCigState()).c_str());
+      return;
+    }
 
-    group->cig_state_ = le_audio::types::CigState::NONE;
+    ASSERT_LOG(group->GetCigState() == CigState::REMOVING,
+               "Unexpected CIG remove group id: %d, cig state %s",
+               group->group_id_, ToString(group->GetCigState()).c_str());
+
+    group->SetCigState(CigState::NONE);
 
     LeAudioDevice* leAudioDevice = group->GetFirstDevice();
     if (!leAudioDevice) return;
@@ -461,9 +502,13 @@
       return;
     }
 
-    ase = leAudioDevice->GetNextActiveAse(ase);
+    AddCisToStreamConfiguration(group, ase);
+
+    ase = leAudioDevice->GetFirstActiveAseByDataPathState(
+        AudioStreamDataPathState::CIS_ESTABLISHED);
     if (!ase) {
-      leAudioDevice = group->GetNextActiveDevice(leAudioDevice);
+      leAudioDevice = group->GetNextActiveDeviceByDataPathState(
+          leAudioDevice, AudioStreamDataPathState::CIS_ESTABLISHED);
 
       if (!leAudioDevice) {
         state_machine_callbacks_->StatusReportCb(group->group_id_,
@@ -471,15 +516,12 @@
         return;
       }
 
-      ase = leAudioDevice->GetFirstActiveAse();
+      ase = leAudioDevice->GetFirstActiveAseByDataPathState(
+          AudioStreamDataPathState::CIS_ESTABLISHED);
     }
 
-    LOG_ASSERT(ase) << __func__ << " shouldn't be called without an active ASE";
-    if (ase->data_path_state == AudioStreamDataPathState::CIS_ESTABLISHED)
-      PrepareDataPath(ase);
-    else
-      LOG(ERROR) << __func__
-                 << " CIS got disconnected? handle: " << +ase->cis_conn_hdl;
+    ASSERT_LOG(ase, "shouldn't be called without an active ASE");
+    PrepareDataPath(ase);
   }
 
   void ProcessHciNotifRemoveIsoDataPath(LeAudioDeviceGroup* group,
@@ -487,11 +529,11 @@
                                         uint8_t status,
                                         uint16_t conn_hdl) override {
     if (status != HCI_SUCCESS) {
-      LOG(ERROR) << __func__ << ", failed to remove ISO data path, reason: "
-                 << loghex(status);
-      StopStream(group);
-
-      return;
+      LOG_ERROR(
+          "failed to remove ISO data path, reason: 0x%0x - contining stream "
+          "closing",
+          status);
+      /* Just continue - disconnecting CIS removes data path as well.*/
     }
 
     bool do_disconnect = false;
@@ -512,8 +554,10 @@
       do_disconnect = true;
     }
 
-    if (do_disconnect)
+    if (do_disconnect) {
+      RemoveCisFromStreamConfiguration(group, leAudioDevice, conn_hdl);
       IsoManager::GetInstance()->DisconnectCis(conn_hdl, HCI_ERR_PEER_USER);
+    }
   }
 
   void ProcessHciNotifIsoLinkQualityRead(
@@ -543,21 +587,24 @@
     while (leAudioDevice != nullptr) {
       for (auto& ase : leAudioDevice->ases_) {
         ase.cis_id = le_audio::kInvalidCisId;
+        ase.cis_conn_hdl = 0;
       }
       leAudioDevice = group->GetNextDevice(leAudioDevice);
     }
+
+    group->CigClearCis();
   }
 
   void RemoveCigForGroup(LeAudioDeviceGroup* group) {
     LOG_DEBUG("Group: %p, id: %d cig state: %s", group, group->group_id_,
               ToString(group->cig_state_).c_str());
-    if (group->cig_state_ != le_audio::types::CigState::CREATED) {
+    if (group->GetCigState() != CigState::CREATED) {
       LOG_WARN("Group: %p, id: %d cig state: %s cannot be removed", group,
                group->group_id_, ToString(group->cig_state_).c_str());
       return;
     }
 
-    group->cig_state_ = le_audio::types::CigState::REMOVING;
+    group->SetCigState(CigState::REMOVING);
     IsoManager::GetInstance()->RemoveCig(group->group_id_);
     LOG_DEBUG("Group: %p, id: %d cig state: %s", group, group->group_id_,
               ToString(group->cig_state_).c_str());
@@ -567,6 +614,8 @@
                                       LeAudioDevice* leAudioDevice) {
     FreeLinkQualityReports(leAudioDevice);
     leAudioDevice->conn_id_ = GATT_INVALID_CONN_ID;
+    /* mark ASEs as not used. */
+    leAudioDevice->DeactivateAllAses();
 
     if (!group) {
       LOG(ERROR) << __func__
@@ -575,55 +624,39 @@
       return;
     }
 
-    /* If group is in Idle there is nothing to do here */
+    /* If group is in Idle and not transitioning, just update the current group
+     * audio context availability which could change due to disconnected group
+     * member.
+     */
     if ((group->GetState() == AseState::BTA_LE_AUDIO_ASE_STATE_IDLE) &&
-        (group->GetTargetState() == AseState::BTA_LE_AUDIO_ASE_STATE_IDLE)) {
+        !group->IsInTransition()) {
       LOG(INFO) << __func__ << " group: " << group->group_id_ << " is in IDLE";
-      group->UpdateActiveContextsMap();
+      group->UpdateAudioContextTypeAvailability();
       return;
     }
 
-    auto* stream_conf = &group->stream_conf;
-    if (!stream_conf->sink_streams.empty() ||
-        !stream_conf->source_streams.empty()) {
-      stream_conf->sink_streams.erase(
-          std::remove_if(stream_conf->sink_streams.begin(),
-                         stream_conf->sink_streams.end(),
-                         [leAudioDevice](auto& pair) {
-                           auto ases =
-                               leAudioDevice->GetAsesByCisConnHdl(pair.first);
-                           return ases.sink;
-                         }),
-          stream_conf->sink_streams.end());
-
-      stream_conf->source_streams.erase(
-          std::remove_if(stream_conf->source_streams.begin(),
-                         stream_conf->source_streams.end(),
-                         [leAudioDevice](auto& pair) {
-                           auto ases =
-                               leAudioDevice->GetAsesByCisConnHdl(pair.first);
-                           return ases.source;
-                         }),
-          stream_conf->source_streams.end());
-    }
-
-    /* mark ASEs as not used. */
-    leAudioDevice->DeactivateAllAses();
-
     LOG_DEBUG(
         " device: %s, group connected: %d, all active ase disconnected:: %d",
         leAudioDevice->address_.ToString().c_str(),
-        group->IsAnyDeviceConnected(), group->HaveAllActiveDevicesCisDisc());
+        group->IsAnyDeviceConnected(), group->HaveAllCisesDisconnected());
 
-    /* Group has changed. Lets update available contexts */
-    group->UpdateActiveContextsMap();
+    /* Update the current group audio context availability which could change
+     * due to disconnected group member.
+     */
+    group->UpdateAudioContextTypeAvailability();
 
     /* ACL of one of the device has been dropped.
-     * If there is active CIS, do nothing here. Just update the active contexts
-     * table
+     * If there is active CIS, do nothing here. Just update the available
+     * contexts table.
      */
-    if (group->IsAnyDeviceConnected() &&
-        !group->HaveAllActiveDevicesCisDisc()) {
+    if (group->IsAnyDeviceConnected() && !group->HaveAllCisesDisconnected()) {
+      if (group->GetState() == AseState::BTA_LE_AUDIO_ASE_STATE_STREAMING) {
+        /* We keep streaming but want others to let know user that it might be
+         * need to update offloader with new CIS configuration
+         */
+        state_machine_callbacks_->StatusReportCb(group->group_id_,
+                                                 GroupStreamStatus::STREAMING);
+      }
       return;
     }
 
@@ -632,6 +665,11 @@
      */
     group->SetState(AseState::BTA_LE_AUDIO_ASE_STATE_IDLE);
     group->SetTargetState(AseState::BTA_LE_AUDIO_ASE_STATE_IDLE);
+
+    /* Clear group pending status */
+    group->ClearPendingAvailableContextsChange();
+    group->ClearPendingConfiguration();
+
     if (alarm_is_scheduled(watchdog_)) alarm_cancel(watchdog_);
     ReleaseCisIds(group);
     state_machine_callbacks_->StatusReportCb(group->group_id_,
@@ -643,8 +681,6 @@
       LeAudioDeviceGroup* group, LeAudioDevice* leAudioDevice,
       const bluetooth::hci::iso_manager::cis_establish_cmpl_evt* event)
       override {
-    std::vector<uint8_t> value;
-
     auto ases_pair = leAudioDevice->GetAsesByCisConnHdl(event->cis_conn_hdl);
 
     if (event->status) {
@@ -659,7 +695,7 @@
        * or pending. If CIS is established, this will be handled in disconnected
        * complete event
        */
-      if (group->HaveAllActiveDevicesCisDisc()) {
+      if (group->HaveAllCisesDisconnected()) {
         RemoveCigForGroup(group);
       }
 
@@ -696,11 +732,17 @@
     }
 
     if (!leAudioDevice->HaveAllActiveAsesCisEst()) {
-      /* More cis established event has to come */
+      /* More cis established events has to come */
       return;
     }
 
-    std::vector<uint8_t> ids;
+    if (!leAudioDevice->IsReadyToCreateStream()) {
+      /* Device still remains in ready to create stream state. It means that
+       * more enabling status notifications has to come. This may only happen
+       * for reconnection scenario for bi-directional CIS.
+       */
+      return;
+    }
 
     /* All CISes created. Send start ready for source ASE before we can go
      * to streaming state.
@@ -711,21 +753,8 @@
                "id: %d, cis handle 0x%04x",
                leAudioDevice->address_.ToString().c_str(), event->cig_id,
                event->cis_conn_hdl);
-    do {
-      if (ase->direction == le_audio::types::kLeAudioDirectionSource)
-        ids.push_back(ase->id);
-    } while ((ase = leAudioDevice->GetNextActiveAse(ase)));
 
-    if (ids.size() > 0) {
-      le_audio::client_parser::ascs::PrepareAseCtpAudioReceiverStartReady(
-          ids, value);
-
-      BtaGattQueue::WriteCharacteristic(leAudioDevice->conn_id_,
-                                        leAudioDevice->ctp_hdls_.val_hdl, value,
-                                        GATT_WRITE_NO_RSP, NULL, NULL);
-
-      return;
-    }
+    PrepareAndSendReceiverStartReady(leAudioDevice, ase);
 
     /* Cis establishment may came after setting group state to streaming, e.g.
      * for autonomous scenario when ase is sink */
@@ -740,14 +769,25 @@
   static void RemoveDataPathByCisHandle(LeAudioDevice* leAudioDevice,
                                         uint16_t cis_conn_hdl) {
     auto ases_pair = leAudioDevice->GetAsesByCisConnHdl(cis_conn_hdl);
-    IsoManager::GetInstance()->RemoveIsoDataPath(
-        cis_conn_hdl,
-        (ases_pair.sink
-             ? bluetooth::hci::iso_manager::kRemoveIsoDataPathDirectionInput
-             : 0x00) |
-            (ases_pair.source ? bluetooth::hci::iso_manager::
-                                    kRemoveIsoDataPathDirectionOutput
-                              : 0x00));
+    uint8_t value = 0;
+
+    if (ases_pair.sink && ases_pair.sink->data_path_state ==
+                              AudioStreamDataPathState::DATA_PATH_ESTABLISHED) {
+      value |= bluetooth::hci::iso_manager::kRemoveIsoDataPathDirectionInput;
+    }
+
+    if (ases_pair.source &&
+        ases_pair.source->data_path_state ==
+            AudioStreamDataPathState::DATA_PATH_ESTABLISHED) {
+      value |= bluetooth::hci::iso_manager::kRemoveIsoDataPathDirectionOutput;
+    }
+
+    if (value == 0) {
+      LOG_INFO("Data path was not set. Nothing to do here.");
+      return;
+    }
+
+    IsoManager::GetInstance()->RemoveIsoDataPath(cis_conn_hdl, value);
   }
 
   void ProcessHciNotifCisDisconnected(
@@ -758,6 +798,23 @@
     FreeLinkQualityReports(leAudioDevice);
 
     auto ases_pair = leAudioDevice->GetAsesByCisConnHdl(event->cis_conn_hdl);
+
+    /* If this is peer disconnecting CIS, make sure to clear data path */
+    if (event->reason != HCI_ERR_CONN_CAUSE_LOCAL_HOST) {
+      RemoveDataPathByCisHandle(leAudioDevice, event->cis_conn_hdl);
+      // Make sure we won't stay in STREAMING state
+      if (ases_pair.sink &&
+          ases_pair.sink->state == AseState::BTA_LE_AUDIO_ASE_STATE_STREAMING) {
+        ases_pair.sink->state =
+            AseState::BTA_LE_AUDIO_ASE_STATE_CODEC_CONFIGURED;
+      }
+      if (ases_pair.source && ases_pair.source->state ==
+                                  AseState::BTA_LE_AUDIO_ASE_STATE_STREAMING) {
+        ases_pair.source->state =
+            AseState::BTA_LE_AUDIO_ASE_STATE_CODEC_CONFIGURED;
+      }
+    }
+
     if (ases_pair.sink) {
       ases_pair.sink->data_path_state = AudioStreamDataPathState::CIS_ASSIGNED;
     }
@@ -766,30 +823,7 @@
           AudioStreamDataPathState::CIS_ASSIGNED;
     }
 
-    /* Invalidate stream configuration if needed */
-    auto* stream_conf = &group->stream_conf;
-    if (!stream_conf->sink_streams.empty() ||
-        !stream_conf->source_streams.empty()) {
-      if (ases_pair.sink) {
-        stream_conf->sink_streams.erase(
-            std::remove_if(stream_conf->sink_streams.begin(),
-                           stream_conf->sink_streams.end(),
-                           [&event](auto& pair) {
-                             return event->cis_conn_hdl == pair.first;
-                           }),
-            stream_conf->sink_streams.end());
-      }
-
-      if (ases_pair.source) {
-        stream_conf->source_streams.erase(
-            std::remove_if(stream_conf->source_streams.begin(),
-                           stream_conf->source_streams.end(),
-                           [&event](auto& pair) {
-                             return event->cis_conn_hdl == pair.first;
-                           }),
-            stream_conf->source_streams.end());
-      }
-    }
+    RemoveCisFromStreamConfiguration(group, leAudioDevice, event->cis_conn_hdl);
 
     auto target_state = group->GetTargetState();
     switch (target_state) {
@@ -798,7 +832,7 @@
          * If there is other device connected and streaming, just leave it as it
          * is, otherwise stop the stream.
          */
-        if (!group->HaveAllActiveDevicesCisDisc()) {
+        if (!group->HaveAllCisesDisconnected()) {
           /* There is ASE streaming for some device. Continue streaming. */
           LOG_WARN(
               "Group member disconnected during streaming. Cis handle 0x%04x",
@@ -807,6 +841,7 @@
         }
 
         LOG_INFO("Lost all members from the group %d", group->group_id_);
+        group->cises_.clear();
         RemoveCigForGroup(group);
 
         group->SetState(AseState::BTA_LE_AUDIO_ASE_STATE_IDLE);
@@ -824,7 +859,7 @@
          */
         if ((group->GetState() ==
              AseState::BTA_LE_AUDIO_ASE_STATE_QOS_CONFIGURED) &&
-            group->HaveAllActiveDevicesCisDisc()) {
+            group->HaveAllCisesDisconnected()) {
           /* No more transition for group */
           alarm_cancel(watchdog_);
 
@@ -834,15 +869,61 @@
         }
         break;
       case AseState::BTA_LE_AUDIO_ASE_STATE_IDLE:
-      case AseState::BTA_LE_AUDIO_ASE_STATE_CODEC_CONFIGURED:
+      case AseState::BTA_LE_AUDIO_ASE_STATE_CODEC_CONFIGURED: {
         /* Those two are used when closing the stream and CIS disconnection is
          * expected */
-        if (group->HaveAllActiveDevicesCisDisc()) {
-          RemoveCigForGroup(group);
+        if (!group->HaveAllCisesDisconnected()) {
+          LOG_DEBUG(
+              "Still waiting for all CISes being disconnected for group:%d",
+              group->group_id_);
           return;
         }
 
-        break;
+        auto current_group_state = group->GetState();
+        LOG_INFO("group %d current state: %s, target state: %s",
+                 group->group_id_,
+                 bluetooth::common::ToString(current_group_state).c_str(),
+                 bluetooth::common::ToString(target_state).c_str());
+        /* It might happen that controller notified about CIS disconnection
+         * later, after ASE state already changed.
+         * In such an event, there is need to notify upper layer about state
+         * from here.
+         */
+        if (alarm_is_scheduled(watchdog_)) {
+          alarm_cancel(watchdog_);
+        }
+
+        if (current_group_state == AseState::BTA_LE_AUDIO_ASE_STATE_IDLE) {
+          LOG_INFO(
+              "Cises disconnected for group %d, we are good in Idle state.",
+              group->group_id_);
+          ReleaseCisIds(group);
+          state_machine_callbacks_->StatusReportCb(group->group_id_,
+                                                   GroupStreamStatus::IDLE);
+        } else if (current_group_state ==
+                   AseState::BTA_LE_AUDIO_ASE_STATE_CODEC_CONFIGURED) {
+          auto reconfig = group->IsPendingConfiguration();
+          LOG_INFO(
+              "Cises disconnected for group: %d, we are good in Configured "
+              "state, reconfig=%d.",
+              group->group_id_, reconfig);
+
+          if (reconfig) {
+            group->ClearPendingConfiguration();
+            state_machine_callbacks_->StatusReportCb(
+                group->group_id_, GroupStreamStatus::CONFIGURED_BY_USER);
+          } else {
+            /* This is Autonomous change if both, target and current state
+             * is CODEC_CONFIGURED
+             */
+            if (target_state == current_group_state) {
+              state_machine_callbacks_->StatusReportCb(
+                  group->group_id_, GroupStreamStatus::CONFIGURED_AUTONOMOUS);
+            }
+          }
+        }
+        RemoveCigForGroup(group);
+      } break;
       default:
         break;
     }
@@ -891,6 +972,10 @@
   }
 
   void SetTargetState(LeAudioDeviceGroup* group, AseState state) {
+    LOG_DEBUG("Watchdog watch started for group=%d transition from %s to %s",
+              group->group_id_, ToString(group->GetTargetState()).c_str(),
+              ToString(state).c_str());
+
     group->SetTargetState(state);
 
     /* Group should tie in time to get requested status */
@@ -908,25 +993,254 @@
         INT_TO_PTR(group->group_id_));
   }
 
-  void CigCreate(LeAudioDeviceGroup* group) {
-    LeAudioDevice* leAudioDevice = group->GetFirstActiveDevice();
-    struct ase* ase;
+  void AddCisToStreamConfiguration(LeAudioDeviceGroup* group,
+                                   const struct ase* ase) {
+    uint16_t cis_conn_hdl = ase->cis_conn_hdl;
+    LOG_INFO("Adding cis handle 0x%04x (%s) to stream list", cis_conn_hdl,
+             ase->direction == le_audio::types::kLeAudioDirectionSink
+                 ? "sink"
+                 : "source");
+    auto* stream_conf = &group->stream_conf;
+    if (ase->direction == le_audio::types::kLeAudioDirectionSink) {
+      auto iter = std::find_if(
+          stream_conf->sink_streams.begin(), stream_conf->sink_streams.end(),
+          [cis_conn_hdl](auto& pair) { return cis_conn_hdl == pair.first; });
+
+      ASSERT_LOG(iter == stream_conf->sink_streams.end(),
+                 "Stream is already there 0x%04x", cis_conn_hdl);
+
+      stream_conf->sink_streams.emplace_back(std::make_pair(
+          ase->cis_conn_hdl, *ase->codec_config.audio_channel_allocation));
+
+      stream_conf->sink_num_of_devices++;
+      stream_conf->sink_num_of_channels += ase->codec_config.channel_count;
+      stream_conf->sink_audio_channel_allocation |=
+          *ase->codec_config.audio_channel_allocation;
+
+      if (stream_conf->sink_sample_frequency_hz == 0) {
+        stream_conf->sink_sample_frequency_hz =
+            ase->codec_config.GetSamplingFrequencyHz();
+      } else {
+        ASSERT_LOG(stream_conf->sink_sample_frequency_hz ==
+                       ase->codec_config.GetSamplingFrequencyHz(),
+                   "sample freq mismatch: %d!=%d",
+                   stream_conf->sink_sample_frequency_hz,
+                   ase->codec_config.GetSamplingFrequencyHz());
+      }
+
+      if (stream_conf->sink_octets_per_codec_frame == 0) {
+        stream_conf->sink_octets_per_codec_frame =
+            *ase->codec_config.octets_per_codec_frame;
+      } else {
+        ASSERT_LOG(stream_conf->sink_octets_per_codec_frame ==
+                       *ase->codec_config.octets_per_codec_frame,
+                   "octets per frame mismatch: %d!=%d",
+                   stream_conf->sink_octets_per_codec_frame,
+                   *ase->codec_config.octets_per_codec_frame);
+      }
+
+      if (stream_conf->sink_codec_frames_blocks_per_sdu == 0) {
+        stream_conf->sink_codec_frames_blocks_per_sdu =
+            *ase->codec_config.codec_frames_blocks_per_sdu;
+      } else {
+        ASSERT_LOG(stream_conf->sink_codec_frames_blocks_per_sdu ==
+                       *ase->codec_config.codec_frames_blocks_per_sdu,
+                   "codec_frames_blocks_per_sdu: %d!=%d",
+                   stream_conf->sink_codec_frames_blocks_per_sdu,
+                   *ase->codec_config.codec_frames_blocks_per_sdu);
+      }
+
+      if (stream_conf->sink_frame_duration_us == 0) {
+        stream_conf->sink_frame_duration_us =
+            ase->codec_config.GetFrameDurationUs();
+      } else {
+        ASSERT_LOG(stream_conf->sink_frame_duration_us ==
+                       ase->codec_config.GetFrameDurationUs(),
+                   "frame_duration_us: %d!=%d",
+                   stream_conf->sink_frame_duration_us,
+                   ase->codec_config.GetFrameDurationUs());
+      }
+
+      LOG_INFO(
+          " Added Sink Stream Configuration. CIS Connection Handle: %d"
+          ", Audio Channel Allocation: %d"
+          ", Sink Number Of Devices: %d"
+          ", Sink Number Of Channels: %d",
+          ase->cis_conn_hdl, *ase->codec_config.audio_channel_allocation,
+          stream_conf->sink_num_of_devices, stream_conf->sink_num_of_channels);
+
+    } else {
+      /* Source case */
+      auto iter = std::find_if(
+          stream_conf->source_streams.begin(),
+          stream_conf->source_streams.end(),
+          [cis_conn_hdl](auto& pair) { return cis_conn_hdl == pair.first; });
+
+      ASSERT_LOG(iter == stream_conf->source_streams.end(),
+                 "Stream is already there 0x%04x", cis_conn_hdl);
+
+      stream_conf->source_streams.emplace_back(std::make_pair(
+          ase->cis_conn_hdl, *ase->codec_config.audio_channel_allocation));
+
+      stream_conf->source_num_of_devices++;
+      stream_conf->source_num_of_channels += ase->codec_config.channel_count;
+      stream_conf->source_audio_channel_allocation |=
+          *ase->codec_config.audio_channel_allocation;
+
+      if (stream_conf->source_sample_frequency_hz == 0) {
+        stream_conf->source_sample_frequency_hz =
+            ase->codec_config.GetSamplingFrequencyHz();
+      } else {
+        ASSERT_LOG(stream_conf->source_sample_frequency_hz ==
+                       ase->codec_config.GetSamplingFrequencyHz(),
+                   "sample freq mismatch: %d!=%d",
+                   stream_conf->source_sample_frequency_hz,
+                   ase->codec_config.GetSamplingFrequencyHz());
+      }
+
+      if (stream_conf->source_octets_per_codec_frame == 0) {
+        stream_conf->source_octets_per_codec_frame =
+            *ase->codec_config.octets_per_codec_frame;
+      } else {
+        ASSERT_LOG(stream_conf->source_octets_per_codec_frame ==
+                       *ase->codec_config.octets_per_codec_frame,
+                   "octets per frame mismatch: %d!=%d",
+                   stream_conf->source_octets_per_codec_frame,
+                   *ase->codec_config.octets_per_codec_frame);
+      }
+
+      if (stream_conf->source_codec_frames_blocks_per_sdu == 0) {
+        stream_conf->source_codec_frames_blocks_per_sdu =
+            *ase->codec_config.codec_frames_blocks_per_sdu;
+      } else {
+        ASSERT_LOG(stream_conf->source_codec_frames_blocks_per_sdu ==
+                       *ase->codec_config.codec_frames_blocks_per_sdu,
+                   "codec_frames_blocks_per_sdu: %d!=%d",
+                   stream_conf->source_codec_frames_blocks_per_sdu,
+                   *ase->codec_config.codec_frames_blocks_per_sdu);
+      }
+
+      if (stream_conf->source_frame_duration_us == 0) {
+        stream_conf->source_frame_duration_us =
+            ase->codec_config.GetFrameDurationUs();
+      } else {
+        ASSERT_LOG(stream_conf->source_frame_duration_us ==
+                       ase->codec_config.GetFrameDurationUs(),
+                   "frame_duration_us: %d!=%d",
+                   stream_conf->source_frame_duration_us,
+                   ase->codec_config.GetFrameDurationUs());
+      }
+
+      LOG_INFO(
+          " Added Source Stream Configuration. CIS Connection Handle: %d"
+          ", Audio Channel Allocation: %d"
+          ", Source Number Of Devices: %d"
+          ", Source Number Of Channels: %d",
+          ase->cis_conn_hdl, *ase->codec_config.audio_channel_allocation,
+          stream_conf->source_num_of_devices,
+          stream_conf->source_num_of_channels);
+    }
+
+    /* Update offloader streams */
+    group->CreateStreamVectorForOffloader(ase->direction);
+  }
+
+  void RemoveCisFromStreamConfiguration(LeAudioDeviceGroup* group,
+                                        LeAudioDevice* leAudioDevice,
+                                        uint16_t cis_conn_hdl) {
+    auto* stream_conf = &group->stream_conf;
+
+    LOG_INFO(" CIS Connection Handle: %d", cis_conn_hdl);
+
+    auto sink_channels = stream_conf->sink_num_of_channels;
+    auto source_channels = stream_conf->source_num_of_channels;
+
+    if (!stream_conf->sink_streams.empty() ||
+        !stream_conf->source_streams.empty()) {
+      stream_conf->sink_streams.erase(
+          std::remove_if(
+              stream_conf->sink_streams.begin(),
+              stream_conf->sink_streams.end(),
+              [leAudioDevice, &cis_conn_hdl, &stream_conf](auto& pair) {
+                if (!cis_conn_hdl) {
+                  cis_conn_hdl = pair.first;
+                }
+                auto ases_pair =
+                    leAudioDevice->GetAsesByCisConnHdl(cis_conn_hdl);
+                if (ases_pair.sink && cis_conn_hdl == pair.first) {
+                  stream_conf->sink_num_of_devices--;
+                  stream_conf->sink_num_of_channels -=
+                      ases_pair.sink->codec_config.channel_count;
+                  stream_conf->sink_audio_channel_allocation &= ~pair.second;
+                }
+                return (ases_pair.sink && cis_conn_hdl == pair.first);
+              }),
+          stream_conf->sink_streams.end());
+
+      stream_conf->source_streams.erase(
+          std::remove_if(
+              stream_conf->source_streams.begin(),
+              stream_conf->source_streams.end(),
+              [leAudioDevice, &cis_conn_hdl, &stream_conf](auto& pair) {
+                if (!cis_conn_hdl) {
+                  cis_conn_hdl = pair.first;
+                }
+                auto ases_pair =
+                    leAudioDevice->GetAsesByCisConnHdl(cis_conn_hdl);
+                if (ases_pair.source && cis_conn_hdl == pair.first) {
+                  stream_conf->source_num_of_devices--;
+                  stream_conf->source_num_of_channels -=
+                      ases_pair.source->codec_config.channel_count;
+                  stream_conf->source_audio_channel_allocation &= ~pair.second;
+                }
+                return (ases_pair.source && cis_conn_hdl == pair.first);
+              }),
+          stream_conf->source_streams.end());
+
+      LOG_INFO(
+          " Sink Number Of Devices: %d"
+          ", Sink Number Of Channels: %d"
+          ", Source Number Of Devices: %d"
+          ", Source Number Of Channels: %d",
+          stream_conf->sink_num_of_devices, stream_conf->sink_num_of_channels,
+          stream_conf->source_num_of_devices,
+          stream_conf->source_num_of_channels);
+    }
+
+    if (stream_conf->sink_num_of_channels == 0) {
+      group->ClearSinksFromConfiguration();
+    }
+
+    if (stream_conf->source_num_of_channels == 0) {
+      group->ClearSourcesFromConfiguration();
+    }
+
+    /* Update offloader streams if needed */
+    if (sink_channels > stream_conf->sink_num_of_channels) {
+      group->CreateStreamVectorForOffloader(
+          le_audio::types::kLeAudioDirectionSink);
+    }
+    if (source_channels > stream_conf->source_num_of_channels) {
+      group->CreateStreamVectorForOffloader(
+          le_audio::types::kLeAudioDirectionSource);
+    }
+
+    group->CigUnassignCis(leAudioDevice);
+  }
+
+  bool CigCreate(LeAudioDeviceGroup* group) {
     uint32_t sdu_interval_mtos, sdu_interval_stom;
+    uint16_t max_trans_lat_mtos, max_trans_lat_stom;
     uint8_t packing, framing, sca;
     std::vector<EXT_CIS_CFG> cis_cfgs;
 
     LOG_DEBUG("Group: %p, id: %d cig state: %s", group, group->group_id_,
               ToString(group->cig_state_).c_str());
 
-    if (group->cig_state_ != le_audio::types::CigState::NONE) {
+    if (group->GetCigState() != CigState::NONE) {
       LOG_WARN(" Group %p, id: %d has invalid cig state: %s ", group,
                group->group_id_, ToString(group->cig_state_).c_str());
-      return;
-    }
-
-    if (!leAudioDevice) {
-      LOG_ERROR("No active devices in group id: %d", group->group_id_);
-      return;
+      return false;
     }
 
     sdu_interval_mtos =
@@ -936,45 +1250,81 @@
     sca = group->GetSCA();
     packing = group->GetPacking();
     framing = group->GetFraming();
-    uint16_t max_trans_lat_mtos = group->GetMaxTransportLatencyMtos();
-    uint16_t max_trans_lat_stom = group->GetMaxTransportLatencyStom();
+    max_trans_lat_mtos = group->GetMaxTransportLatencyMtos();
+    max_trans_lat_stom = group->GetMaxTransportLatencyStom();
 
-    do {
-      ase = leAudioDevice->GetFirstActiveAse();
-      LOG_ASSERT(ase) << __func__
-                      << " shouldn't be called without an active ASE";
-      do {
-        auto& cis = ase->cis_id;
-        ASSERT_LOG(ase->cis_id != le_audio::kInvalidCisId,
-                   " ase id %d has invalid cis id %d", ase->id, ase->cis_id);
-        auto iter =
-            find_if(cis_cfgs.begin(), cis_cfgs.end(),
-                    [&cis](auto const& cfg) { return cis == cfg.cis_id; });
+    uint16_t max_sdu_size_mtos = 0;
+    uint16_t max_sdu_size_stom = 0;
+    uint8_t phy_mtos =
+        group->GetPhyBitmask(le_audio::types::kLeAudioDirectionSink);
+    uint8_t phy_stom =
+        group->GetPhyBitmask(le_audio::types::kLeAudioDirectionSource);
+    uint8_t rtn_mtos = 0;
+    uint8_t rtn_stom = 0;
 
-        /* CIS configuration already on list */
-        if (iter != cis_cfgs.end()) continue;
+    /* Currently assumed Sink/Source configuration is same across cis types.
+     * If a cis in cises_ is currently associated with active device/ASE(s),
+     * use the Sink/Source configuration for the same.
+     * If a cis in cises_ is not currently associated with active device/ASE(s),
+     * use the Sink/Source configuration for the cis in cises_
+     * associated with a active device/ASE(s). When the same cis is associated
+     * later, with active device/ASE(s), check if current configuration is
+     * supported or not, if not, reconfigure CIG.
+     */
+    for (struct le_audio::types::cis& cis : group->cises_) {
+      uint16_t max_sdu_size_mtos_temp =
+          group->GetMaxSduSize(le_audio::types::kLeAudioDirectionSink, cis.id);
+      uint16_t max_sdu_size_stom_temp = group->GetMaxSduSize(
+          le_audio::types::kLeAudioDirectionSource, cis.id);
+      uint8_t rtn_mtos_temp =
+          group->GetRtn(le_audio::types::kLeAudioDirectionSink, cis.id);
+      uint8_t rtn_stom_temp =
+          group->GetRtn(le_audio::types::kLeAudioDirectionSource, cis.id);
 
-        auto ases_pair = leAudioDevice->GetAsesByCisId(cis);
-        EXT_CIS_CFG cis_cfg = {0, 0, 0, 0, 0, 0, 0};
+      max_sdu_size_mtos =
+          max_sdu_size_mtos_temp ? max_sdu_size_mtos_temp : max_sdu_size_mtos;
+      max_sdu_size_stom =
+          max_sdu_size_stom_temp ? max_sdu_size_stom_temp : max_sdu_size_stom;
+      rtn_mtos = rtn_mtos_temp ? rtn_mtos_temp : rtn_mtos;
+      rtn_stom = rtn_stom_temp ? rtn_stom_temp : rtn_stom;
+    }
 
-        cis_cfg.cis_id = ase->cis_id;
-        cis_cfg.phy_mtos =
-            group->GetPhyBitmask(le_audio::types::kLeAudioDirectionSink);
-        cis_cfg.phy_stom =
-            group->GetPhyBitmask(le_audio::types::kLeAudioDirectionSource);
+    for (struct le_audio::types::cis& cis : group->cises_) {
+      EXT_CIS_CFG cis_cfg = {};
 
-        if (ases_pair.sink) {
-          cis_cfg.max_sdu_size_mtos = ases_pair.sink->max_sdu_size;
-          cis_cfg.rtn_mtos = ases_pair.sink->retrans_nb;
-        }
-        if (ases_pair.source) {
-          cis_cfg.max_sdu_size_stom = ases_pair.source->max_sdu_size;
-          cis_cfg.rtn_stom = ases_pair.source->retrans_nb;
-        }
-
+      cis_cfg.cis_id = cis.id;
+      cis_cfg.phy_mtos = phy_mtos;
+      cis_cfg.phy_stom = phy_stom;
+      if (cis.type == le_audio::types::CisType::CIS_TYPE_BIDIRECTIONAL) {
+        cis_cfg.max_sdu_size_mtos = max_sdu_size_mtos;
+        cis_cfg.rtn_mtos = rtn_mtos;
+        cis_cfg.max_sdu_size_stom = max_sdu_size_stom;
+        cis_cfg.rtn_stom = rtn_stom;
         cis_cfgs.push_back(cis_cfg);
-      } while ((ase = leAudioDevice->GetNextActiveAse(ase)));
-    } while ((leAudioDevice = group->GetNextActiveDevice(leAudioDevice)));
+      } else if (cis.type ==
+                 le_audio::types::CisType::CIS_TYPE_UNIDIRECTIONAL_SINK) {
+        cis_cfg.max_sdu_size_mtos = max_sdu_size_mtos;
+        cis_cfg.rtn_mtos = rtn_mtos;
+        cis_cfg.max_sdu_size_stom = 0;
+        cis_cfg.rtn_stom = 0;
+        cis_cfgs.push_back(cis_cfg);
+      } else {
+        cis_cfg.max_sdu_size_mtos = 0;
+        cis_cfg.rtn_mtos = 0;
+        cis_cfg.max_sdu_size_stom = max_sdu_size_stom;
+        cis_cfg.rtn_stom = rtn_stom;
+        cis_cfgs.push_back(cis_cfg);
+      }
+    }
+
+    if ((sdu_interval_mtos == 0 && sdu_interval_stom == 0) ||
+        (max_trans_lat_mtos == le_audio::types::kMaxTransportLatencyMin &&
+         max_trans_lat_stom == le_audio::types::kMaxTransportLatencyMin) ||
+        (max_sdu_size_mtos == 0 && max_sdu_size_stom == 0)) {
+      LOG_ERROR(" Trying to create invalid group");
+      group->PrintDebugState();
+      return false;
+    }
 
     bluetooth::hci::iso_manager::cig_create_params param = {
         .sdu_itv_mtos = sdu_interval_mtos,
@@ -986,10 +1336,11 @@
         .max_trans_lat_mtos = max_trans_lat_mtos,
         .cis_cfgs = std::move(cis_cfgs),
     };
-    group->cig_state_ = le_audio::types::CigState::CREATING;
+    group->SetCigState(CigState::CREATING);
     IsoManager::GetInstance()->CreateCig(group->group_id_, std::move(param));
     LOG_DEBUG("Group: %p, id: %d cig state: %s", group, group->group_id_,
               ToString(group->cig_state_).c_str());
+    return true;
   }
 
   static void CisCreateForDevice(LeAudioDevice* leAudioDevice) {
@@ -1090,11 +1441,13 @@
   }
 
   static inline void PrepareDataPath(LeAudioDeviceGroup* group) {
-    auto* leAudioDevice = group->GetFirstActiveDevice();
+    auto* leAudioDevice = group->GetFirstActiveDeviceByDataPathState(
+        AudioStreamDataPathState::CIS_ESTABLISHED);
     LOG_ASSERT(leAudioDevice)
         << __func__ << " Shouldn't be called without an active device.";
 
-    auto* ase = leAudioDevice->GetFirstActiveAse();
+    auto* ase = leAudioDevice->GetFirstActiveAseByDataPathState(
+        AudioStreamDataPathState::CIS_ESTABLISHED);
     LOG_ASSERT(ase) << __func__ << " shouldn't be called without an active ASE";
     PrepareDataPath(ase);
   }
@@ -1157,9 +1510,21 @@
           PrepareAndSendRelease(leAudioDeviceNext);
         } else {
           /* Last node is in releasing state*/
-          if (alarm_is_scheduled(watchdog_)) alarm_cancel(watchdog_);
-
           group->SetState(AseState::BTA_LE_AUDIO_ASE_STATE_IDLE);
+
+          group->PrintDebugState();
+          /* If all CISes are disconnected, notify upper layer about IDLE state,
+           * otherwise wait for */
+          if (!group->HaveAllCisesDisconnected()) {
+            LOG_WARN(
+                "Not all CISes removed before going to IDLE for group %d, "
+                "waiting...",
+                group->group_id_);
+            group->PrintDebugState();
+            return;
+          }
+
+          if (alarm_is_scheduled(watchdog_)) alarm_cancel(watchdog_);
           ReleaseCisIds(group);
           state_machine_callbacks_->StatusReportCb(group->group_id_,
                                                    GroupStreamStatus::IDLE);
@@ -1192,36 +1557,28 @@
     std::vector<struct le_audio::client_parser::ascs::ctp_codec_conf> confs;
     struct ase* ase;
 
+    if (!group->CigAssignCisIds(leAudioDevice)) {
+      LOG_ERROR(" unable to assign CIS IDs");
+      StopStream(group);
+      return;
+    }
+
+    if (group->GetCigState() == CigState::CREATED)
+      group->CigAssignCisConnHandlesToAses(leAudioDevice);
+
     ase = leAudioDevice->GetFirstActiveAse();
-    LOG_ASSERT(ase) << __func__ << " shouldn't be called without an active ASE";
-    do {
-      uint8_t cis_id = ase->cis_id;
-      if (cis_id == le_audio::kInvalidCisId) {
-        /* Get completive (to be bi-directional CIS) CIS ID for ASE */
-        cis_id = leAudioDevice->GetMatchingBidirectionCisId(ase);
-        if (cis_id == le_audio::kInvalidCisId) {
-          /* Get next free CIS ID for group */
-          cis_id = group->GetFirstFreeCisId();
-          if (cis_id == le_audio::kInvalidCisId) {
-            LOG(ERROR) << __func__ << ", failed to get free CIS ID";
-            StopStream(group);
-            return;
-          }
-        }
-      }
-
-      LOG_INFO(" Configure ase_id %d, cis_id %d, ase state %s", ase->id, cis_id,
-               ToString(ase->state).c_str());
-
-      ase->cis_id = cis_id;
-
+    ASSERT_LOG(ase, "shouldn't be called without an active ASE");
+    for (; ase != nullptr; ase = leAudioDevice->GetNextActiveAse(ase)) {
+      LOG_DEBUG("device: %s, ase_id: %d, cis_id: %d, ase state: %s",
+                leAudioDevice->address_.ToString().c_str(), ase->id,
+                ase->cis_id, ToString(ase->state).c_str());
       conf.ase_id = ase->id;
       conf.target_latency = ase->target_latency;
       conf.target_phy = group->GetTargetPhy(ase->direction);
       conf.codec_id = ase->codec_id;
       conf.codec_config = ase->codec_config;
       confs.push_back(conf);
-    } while ((ase = leAudioDevice->GetNextActiveAse(ase)));
+    }
 
     std::vector<uint8_t> value;
     le_audio::client_parser::ascs::PrepareAseCtpCodecConfig(confs, value);
@@ -1262,6 +1619,28 @@
           StopStream(group);
           return;
         }
+
+        uint16_t cig_curr_max_trans_lat_mtos =
+            group->GetMaxTransportLatencyMtos();
+        uint16_t cig_curr_max_trans_lat_stom =
+            group->GetMaxTransportLatencyStom();
+
+        if (group->GetState() == AseState::BTA_LE_AUDIO_ASE_STATE_STREAMING) {
+          /* We are here because of the reconnection of the single device.
+           * Reconfigure CIG if current CIG supported Max Transport Latency for
+           * a direction, cannot be supported by the newly connected member
+           * device's ASE for the direction.
+           */
+          if ((ase->direction == le_audio::types::kLeAudioDirectionSink &&
+               cig_curr_max_trans_lat_mtos > rsp.max_transport_latency) ||
+              (ase->direction == le_audio::types::kLeAudioDirectionSource &&
+               cig_curr_max_trans_lat_stom > rsp.max_transport_latency)) {
+            group->SetPendingConfiguration();
+            StopStream(group);
+            return;
+          }
+        }
+
         ase->framing = rsp.framing;
         ase->preferred_phy = rsp.preferred_phy;
         /* Validate and update QoS settings to be consistent */
@@ -1314,15 +1693,32 @@
 
           if (group->GetTargetState() ==
               AseState::BTA_LE_AUDIO_ASE_STATE_STREAMING) {
-            CigCreate(group);
+            if (!CigCreate(group)) {
+              LOG_ERROR("Could not create CIG. Stop the stream for group %d",
+                        group->group_id_);
+              StopStream(group);
+            }
             return;
           }
 
           if (group->GetTargetState() ==
                   AseState::BTA_LE_AUDIO_ASE_STATE_CODEC_CONFIGURED &&
-              group->stream_conf.pending_configuration) {
+              group->IsPendingConfiguration()) {
             LOG_INFO(" Configured state completed ");
-            group->stream_conf.pending_configuration = false;
+
+            /* If all CISes are disconnected, notify upper layer about IDLE
+             * state, otherwise wait for */
+            if (!group->HaveAllCisesDisconnected()) {
+              LOG_WARN(
+                  "Not all CISes removed before going to CONFIGURED for group "
+                  "%d, "
+                  "waiting...",
+                  group->group_id_);
+              group->PrintDebugState();
+              return;
+            }
+
+            group->ClearPendingConfiguration();
             state_machine_callbacks_->StatusReportCb(
                 group->group_id_, GroupStreamStatus::CONFIGURED_BY_USER);
 
@@ -1399,15 +1795,19 @@
 
           if (group->GetTargetState() ==
               AseState::BTA_LE_AUDIO_ASE_STATE_STREAMING) {
-            CigCreate(group);
+            if (!CigCreate(group)) {
+              LOG_ERROR("Could not create CIG. Stop the stream for group %d",
+                        group->group_id_);
+              StopStream(group);
+            }
             return;
           }
 
           if (group->GetTargetState() ==
                   AseState::BTA_LE_AUDIO_ASE_STATE_CODEC_CONFIGURED &&
-              group->stream_conf.pending_configuration) {
+              group->IsPendingConfiguration()) {
             LOG_INFO(" Configured state completed ");
-            group->stream_conf.pending_configuration = false;
+            group->ClearPendingConfiguration();
             state_machine_callbacks_->StatusReportCb(
                 group->group_id_, GroupStreamStatus::CONFIGURED_BY_USER);
 
@@ -1456,7 +1856,6 @@
           PrepareAndSendRelease(leAudioDeviceNext);
         } else {
           /* Last node is in releasing state*/
-          if (alarm_is_scheduled(watchdog_)) alarm_cancel(watchdog_);
 
           group->SetState(AseState::BTA_LE_AUDIO_ASE_STATE_CODEC_CONFIGURED);
           /* Remote device has cache and keep staying in configured state after
@@ -1464,6 +1863,18 @@
            * remote device.
            */
           group->SetTargetState(group->GetState());
+
+          if (!group->HaveAllCisesDisconnected()) {
+            LOG_WARN(
+                "Not all CISes removed before going to IDLE for group %d, "
+                "waiting...",
+                group->group_id_);
+            group->PrintDebugState();
+            return;
+          }
+
+          if (alarm_is_scheduled(watchdog_)) alarm_cancel(watchdog_);
+
           state_machine_callbacks_->StatusReportCb(
               group->group_id_, GroupStreamStatus::CONFIGURED_AUTONOMOUS);
         }
@@ -1552,7 +1963,7 @@
 
         group->SetState(AseState::BTA_LE_AUDIO_ASE_STATE_QOS_CONFIGURED);
 
-        if (!group->HaveAllActiveDevicesCisDisc()) return;
+        if (!group->HaveAllCisesDisconnected()) return;
 
         if (group->GetTargetState() ==
             AseState::BTA_LE_AUDIO_ASE_STATE_QOS_CONFIGURED) {
@@ -1589,6 +2000,9 @@
     ase = leAudioDevice->GetFirstActiveAse();
     LOG_ASSERT(ase) << __func__ << " shouldn't be called without an active ASE";
     do {
+      LOG_DEBUG("device: %s, ase_id: %d, cis_id: %d, ase state: %s",
+                leAudioDevice->address_.ToString().c_str(), ase->id,
+                ase->cis_id, ToString(ase->state).c_str());
       conf.ase_id = ase->id;
       conf.metadata = ase->metadata;
       confs.push_back(conf);
@@ -1607,6 +2021,9 @@
 
     std::vector<uint8_t> ids;
     do {
+      LOG_DEBUG("device: %s, ase_id: %d, cis_id: %d, ase state: %s",
+                leAudioDevice->address_.ToString().c_str(), ase->id,
+                ase->cis_id, ToString(ase->state).c_str());
       ids.push_back(ase->id);
     } while ((ase = leAudioDevice->GetNextActiveAse(ase)));
 
@@ -1624,6 +2041,9 @@
 
     std::vector<uint8_t> ids;
     do {
+      LOG_DEBUG("device: %s, ase_id: %d, cis_id: %d, ase state: %s",
+                leAudioDevice->address_.ToString().c_str(), ase->id,
+                ase->cis_id, ToString(ase->state).c_str());
       ids.push_back(ase->id);
     } while ((ase = leAudioDevice->GetNextActiveAse(ase)));
 
@@ -1639,8 +2059,15 @@
                                LeAudioDevice* leAudioDevice) {
     std::vector<struct le_audio::client_parser::ascs::ctp_qos_conf> confs;
 
+    bool validate_transport_latency = false;
+    bool validate_max_sdu_size = false;
+
     for (struct ase* ase = leAudioDevice->GetFirstActiveAse(); ase != nullptr;
          ase = leAudioDevice->GetNextActiveAse(ase)) {
+      LOG_DEBUG("device: %s, ase_id: %d, cis_id: %d, ase state: %s",
+                leAudioDevice->address_.ToString().c_str(), ase->id,
+                ase->cis_id, ToString(ase->state).c_str());
+
       /* TODO: Configure first ASE qos according to context type */
       struct le_audio::client_parser::ascs::ctp_qos_conf conf;
       conf.ase_id = ase->id;
@@ -1651,14 +2078,16 @@
       conf.max_sdu = ase->max_sdu_size;
       conf.retrans_nb = ase->retrans_nb;
       if (!group->GetPresentationDelay(&conf.pres_delay, ase->direction)) {
-        LOG(ERROR) << __func__ << ", inconsistent presentation delay for group";
+        LOG_ERROR("inconsistent presentation delay for group");
+        group->PrintDebugState();
         StopStream(group);
         return;
       }
 
       conf.sdu_interval = group->GetSduInterval(ase->direction);
       if (!conf.sdu_interval) {
-        LOG(ERROR) << __func__ << ", unsupported SDU interval for group";
+        LOG_ERROR("unsupported SDU interval for group");
+        group->PrintDebugState();
         StopStream(group);
         return;
       }
@@ -1668,49 +2097,105 @@
       } else {
         conf.max_transport_latency = group->GetMaxTransportLatencyStom();
       }
+
+      if (conf.max_transport_latency >
+          le_audio::types::kMaxTransportLatencyMin) {
+        validate_transport_latency = true;
+      }
+
+      if (conf.max_sdu > 0) {
+        validate_max_sdu_size = true;
+      }
       confs.push_back(conf);
     }
 
-    LOG_ASSERT(confs.size() > 0)
-        << __func__ << " shouldn't be called without an active ASE";
+    if (confs.size() == 0 || !validate_transport_latency ||
+        !validate_max_sdu_size) {
+      LOG_ERROR("Invalid configuration or latency or sdu size");
+      group->PrintDebugState();
+      StopStream(group);
+      return;
+    }
 
     std::vector<uint8_t> value;
     le_audio::client_parser::ascs::PrepareAseCtpConfigQos(confs, value);
-
     BtaGattQueue::WriteCharacteristic(leAudioDevice->conn_id_,
                                       leAudioDevice->ctp_hdls_.val_hdl, value,
                                       GATT_WRITE_NO_RSP, NULL, NULL);
   }
 
-  void PrepareAndSendUpdateMetadata(
-      LeAudioDeviceGroup* group, LeAudioDevice* leAudioDevice,
-      le_audio::types::LeAudioContextType context_type, int ccid) {
+  void PrepareAndSendUpdateMetadata(LeAudioDevice* leAudioDevice,
+                                    le_audio::types::AudioContexts context_type,
+                                    const std::vector<uint8_t>& ccid_list) {
     std::vector<struct le_audio::client_parser::ascs::ctp_update_metadata>
         confs;
 
-    for (; leAudioDevice;
-         leAudioDevice = group->GetNextActiveDevice(leAudioDevice)) {
-      if (!leAudioDevice->IsMetadataChanged(context_type, ccid)) continue;
+    if (!leAudioDevice->IsMetadataChanged(context_type, ccid_list)) return;
 
-      auto new_metadata = leAudioDevice->GetMetadata(context_type, ccid);
+    /* Request server to update ASEs with new metadata */
+    for (struct ase* ase = leAudioDevice->GetFirstActiveAse(); ase != nullptr;
+         ase = leAudioDevice->GetNextActiveAse(ase)) {
+      LOG_DEBUG("device: %s, ase_id: %d, cis_id: %d, ase state: %s",
+                leAudioDevice->address_.ToString().c_str(), ase->id,
+                ase->cis_id, ToString(ase->state).c_str());
 
-      /* Request server to update ASEs with new metadata */
-      for (struct ase* ase = leAudioDevice->GetFirstActiveAse(); ase != nullptr;
-           ase = leAudioDevice->GetNextActiveAse(ase)) {
-        struct le_audio::client_parser::ascs::ctp_update_metadata conf;
-
-        conf.ase_id = ase->id;
-        conf.metadata = new_metadata;
-
-        confs.push_back(conf);
+      if (ase->state != AseState::BTA_LE_AUDIO_ASE_STATE_ENABLING &&
+          ase->state != AseState::BTA_LE_AUDIO_ASE_STATE_STREAMING) {
+        /* This might happen when update metadata happens on late connect */
+        LOG_DEBUG(
+            "Metadata for ase_id %d cannot be updated due to invalid ase state "
+            "- see log above",
+            ase->id);
+        continue;
       }
 
+      /* Filter multidirectional audio context for each ase direction */
+      auto directional_audio_context =
+          context_type & leAudioDevice->GetAvailableContexts(ase->direction);
+      if (directional_audio_context.any()) {
+        ase->metadata =
+            leAudioDevice->GetMetadata(directional_audio_context, ccid_list);
+      } else {
+        ase->metadata = leAudioDevice->GetMetadata(
+            AudioContexts(LeAudioContextType::UNSPECIFIED),
+            std::vector<uint8_t>());
+      }
+
+      struct le_audio::client_parser::ascs::ctp_update_metadata conf;
+
+      conf.ase_id = ase->id;
+      conf.metadata = ase->metadata;
+
+      confs.push_back(conf);
+    }
+
+    if (confs.size() != 0) {
       std::vector<uint8_t> value;
       le_audio::client_parser::ascs::PrepareAseCtpUpdateMetadata(confs, value);
 
       BtaGattQueue::WriteCharacteristic(leAudioDevice->conn_id_,
                                         leAudioDevice->ctp_hdls_.val_hdl, value,
                                         GATT_WRITE_NO_RSP, NULL, NULL);
+    }
+  }
+
+  void PrepareAndSendReceiverStartReady(LeAudioDevice* leAudioDevice,
+                                        struct ase* ase) {
+    std::vector<uint8_t> ids;
+    std::vector<uint8_t> value;
+
+    do {
+      if (ase->direction == le_audio::types::kLeAudioDirectionSource)
+        ids.push_back(ase->id);
+    } while ((ase = leAudioDevice->GetNextActiveAse(ase)));
+
+    if (ids.size() > 0) {
+      le_audio::client_parser::ascs::PrepareAseCtpAudioReceiverStartReady(
+          ids, value);
+
+      BtaGattQueue::WriteCharacteristic(leAudioDevice->conn_id_,
+                                        leAudioDevice->ctp_hdls_.val_hdl, value,
+                                        GATT_WRITE_NO_RSP, NULL, NULL);
 
       return;
     }
@@ -1724,17 +2209,40 @@
       return;
     }
 
-    if (group->GetState() == AseState::BTA_LE_AUDIO_ASE_STATE_STREAMING) {
-      /* We are here because of the reconnection of the single device. */
-      ase->state = AseState::BTA_LE_AUDIO_ASE_STATE_ENABLING;
-      CisCreateForDevice(leAudioDevice);
-      return;
-    }
-
     switch (ase->state) {
       case AseState::BTA_LE_AUDIO_ASE_STATE_QOS_CONFIGURED:
         ase->state = AseState::BTA_LE_AUDIO_ASE_STATE_ENABLING;
 
+        if (group->GetState() == AseState::BTA_LE_AUDIO_ASE_STATE_STREAMING) {
+          if (ase->data_path_state < AudioStreamDataPathState::CIS_PENDING) {
+            /* We are here because of the reconnection of the single device. */
+            CisCreateForDevice(leAudioDevice);
+          }
+
+          if (!leAudioDevice->HaveAllActiveAsesCisEst()) {
+            /* More cis established events has to come */
+            return;
+          }
+
+          if (!leAudioDevice->IsReadyToCreateStream()) {
+            /* Device still remains in ready to create stream state. It means
+             * that more enabling status notifications has to come.
+             */
+            return;
+          }
+
+          /* All CISes created. Send start ready for source ASE before we can go
+           * to streaming state.
+           */
+          struct ase* ase = leAudioDevice->GetFirstActiveAse();
+          ASSERT_LOG(ase != nullptr,
+                     "shouldn't be called without an active ASE, device %s",
+                     leAudioDevice->address_.ToString().c_str());
+          PrepareAndSendReceiverStartReady(leAudioDevice, ase);
+
+          return;
+        }
+
         if (leAudioDevice->IsReadyToCreateStream())
           ProcessGroupEnable(group, leAudioDevice);
 
@@ -1786,6 +2294,7 @@
 
         if (group->GetState() == AseState::BTA_LE_AUDIO_ASE_STATE_STREAMING) {
           /* We are here because of the reconnection of the single device. */
+          PrepareDataPath(group);
           return;
         }
 
@@ -1799,20 +2308,6 @@
 
         ase->state = AseState::BTA_LE_AUDIO_ASE_STATE_STREAMING;
 
-        if (group->GetState() == AseState::BTA_LE_AUDIO_ASE_STATE_STREAMING) {
-          /* We are here because of the reconnection of the single device. */
-          auto* stream_conf = &group->stream_conf;
-          if (ase->direction == le_audio::types::kLeAudioDirectionSource) {
-            stream_conf->source_streams.emplace_back(
-                std::make_pair(ase->cis_conn_hdl,
-                               *ase->codec_config.audio_channel_allocation));
-          } else {
-            stream_conf->sink_streams.emplace_back(
-                std::make_pair(ase->cis_conn_hdl,
-                               *ase->codec_config.audio_channel_allocation));
-          }
-        }
-
         if (!group->HaveAllActiveDevicesAsesTheSameState(
                 AseState::BTA_LE_AUDIO_ASE_STATE_STREAMING)) {
           /* More ASEs notification form this device has to come for this group
@@ -1823,6 +2318,7 @@
 
         if (group->GetState() == AseState::BTA_LE_AUDIO_ASE_STATE_STREAMING) {
           /* We are here because of the reconnection of the single device. */
+          PrepareDataPath(group);
           return;
         }
 
@@ -1959,6 +2455,8 @@
                        AudioStreamDataPathState::CIS_ESTABLISHED ||
                    ase->data_path_state ==
                        AudioStreamDataPathState::CIS_PENDING) {
+          RemoveCisFromStreamConfiguration(group, leAudioDevice,
+                                           ase->cis_conn_hdl);
           IsoManager::GetInstance()->DisconnectCis(ase->cis_conn_hdl,
                                                    HCI_ERR_PEER_USER);
         } else {
diff --git a/system/bta/le_audio/state_machine.h b/system/bta/le_audio/state_machine.h
index 06b63fb..d4e97c1 100644
--- a/system/bta/le_audio/state_machine.h
+++ b/system/bta/le_audio/state_machine.h
@@ -49,11 +49,13 @@
                               LeAudioDevice* leAudioDevice) = 0;
   virtual bool StartStream(LeAudioDeviceGroup* group,
                            types::LeAudioContextType context_type,
-                           int ccid = -1) = 0;
+                           types::AudioContexts metadata_context_type,
+                           std::vector<uint8_t> ccid_list = {}) = 0;
   virtual void SuspendStream(LeAudioDeviceGroup* group) = 0;
   virtual bool ConfigureStream(LeAudioDeviceGroup* group,
-                               le_audio::types::LeAudioContextType context_type,
-                               int ccid = -1) = 0;
+                               types::LeAudioContextType context_type,
+                               types::AudioContexts metadata_context_type,
+                               std::vector<uint8_t> ccid_list = {}) = 0;
   virtual void StopStream(LeAudioDeviceGroup* group) = 0;
   virtual void ProcessGattNotifEvent(uint8_t* value, uint16_t len,
                                      struct types::ase* ase,
diff --git a/system/bta/le_audio/state_machine_test.cc b/system/bta/le_audio/state_machine_test.cc
index 62af3b1..dc5cfe9 100644
--- a/system/bta/le_audio/state_machine_test.cc
+++ b/system/bta/le_audio/state_machine_test.cc
@@ -22,6 +22,7 @@
 
 #include <functional>
 
+#include "bta/le_audio/content_control_id_keeper.h"
 #include "bta_gatt_api_mock.h"
 #include "bta_gatt_queue_mock.h"
 #include "btm_api_mock.h"
@@ -31,9 +32,14 @@
 #include "le_audio_set_configuration_provider.h"
 #include "mock_codec_manager.h"
 #include "mock_controller.h"
+#include "mock_csis_client.h"
 #include "mock_iso_manager.h"
 #include "types/bt_transport.h"
 
+using ::le_audio::DeviceConnectState;
+using ::le_audio::codec_spec_caps::kLeAudioCodecLC3ChannelCountSingleChannel;
+using ::le_audio::codec_spec_caps::kLeAudioCodecLC3ChannelCountTwoChannel;
+using ::le_audio::types::LeAudioContextType;
 using ::testing::_;
 using ::testing::AnyNumber;
 using ::testing::AtLeast;
@@ -45,9 +51,24 @@
 using ::testing::Test;
 
 std::map<std::string, int> mock_function_count_map;
-
 extern struct fake_osi_alarm_set_on_mloop fake_osi_alarm_set_on_mloop_;
 
+void osi_property_set_bool(const char* key, bool value);
+static const char* test_flags[] = {
+    "INIT_logging_debug_enabled_for_all=true",
+    nullptr,
+};
+
+constexpr uint8_t media_ccid = 0xC0;
+constexpr auto media_context =
+    static_cast<std::underlying_type<LeAudioContextType>::type>(
+        LeAudioContextType::MEDIA);
+
+constexpr uint8_t call_ccid = 0xD0;
+constexpr auto call_context =
+    static_cast<std::underlying_type<LeAudioContextType>::type>(
+        LeAudioContextType::CONVERSATIONAL);
+
 namespace le_audio {
 namespace internal {
 
@@ -55,17 +76,16 @@
 #define ATTR_HANDLE_ASCS_POOL_START (0x0000 | 32)
 #define ATTR_HANDLE_PACS_POOL_START (0xFF00 | 64)
 
-constexpr uint16_t kContextTypeUnspecified = 0x0001;
-constexpr uint16_t kContextTypeConversational = 0x0002;
-constexpr uint16_t kContextTypeMedia = 0x0004;
-// constexpr uint16_t kContextTypeInstructional = 0x0008;
-// constexpr uint16_t kContextTypeAttentionSeeking = 0x0010;
-// constexpr uint16_t kContextTypeImmediateAllert = 0x0020;
-// constexpr uint16_t kContextTypeManMachine = 0x0040;
-// constexpr uint16_t kContextTypeEmergencyAlert = 0x0080;
-constexpr uint16_t kContextTypeRingtone = 0x0100;
-// constexpr uint16_t kContextTypeTV = 0x0200;
-// constexpr uint16_t kContextTypeRFULive = 0x0400;
+constexpr LeAudioContextType kContextTypeUnspecified =
+    static_cast<LeAudioContextType>(0x0001);
+constexpr LeAudioContextType kContextTypeConversational =
+    static_cast<LeAudioContextType>(0x0002);
+constexpr LeAudioContextType kContextTypeMedia =
+    static_cast<LeAudioContextType>(0x0004);
+constexpr LeAudioContextType kContextTypeSoundEffects =
+    static_cast<LeAudioContextType>(0x0080);
+constexpr LeAudioContextType kContextTypeRingtone =
+    static_cast<LeAudioContextType>(0x0200);
 
 namespace codec_specific {
 
@@ -83,9 +103,9 @@
 constexpr uint8_t kCapSamplingFrequency16000Hz = 0x0004;
 // constexpr uint8_t kCapSamplingFrequency22050Hz = 0x0008;
 // constexpr uint8_t kCapSamplingFrequency24000Hz = 0x0010;
-// constexpr uint8_t kCapSamplingFrequency32000Hz = 0x0020;
+constexpr uint8_t kCapSamplingFrequency32000Hz = 0x0020;
 // constexpr uint8_t kCapSamplingFrequency44100Hz = 0x0040;
-// constexpr uint8_t kCapSamplingFrequency48000Hz = 0x0080;
+constexpr uint8_t kCapSamplingFrequency48000Hz = 0x0080;
 // constexpr uint8_t kCapSamplingFrequency88200Hz = 0x0100;
 // constexpr uint8_t kCapSamplingFrequency96000Hz = 0x0200;
 // constexpr uint8_t kCapSamplingFrequency176400Hz = 0x0400;
@@ -133,9 +153,6 @@
   return {{0xC0, 0xDE, 0xC0, 0xDE, 0x00, index}};
 }
 
-static uint8_t ase_id_last_assigned;
-static uint8_t additional_ases = 0;
-
 class MockLeAudioGroupStateMachineCallbacks
     : public LeAudioGroupStateMachine::Callbacks {
  public:
@@ -154,18 +171,36 @@
 
 class StateMachineTest : public Test {
  protected:
+  uint8_t ase_id_last_assigned = types::ase::kAseIdInvalid;
+  uint8_t additional_snk_ases = 0;
+  uint8_t additional_src_ases = 0;
+  uint8_t channel_count_ = kLeAudioCodecLC3ChannelCountSingleChannel;
+  uint16_t sample_freq_ = codec_specific::kCapSamplingFrequency16000Hz;
+
   void SetUp() override {
+    bluetooth::common::InitFlags::Load(test_flags);
     mock_function_count_map.clear();
     controller::SetMockControllerInterface(&mock_controller_);
     bluetooth::manager::SetMockBtmInterface(&btm_interface);
     gatt::SetMockBtaGattInterface(&gatt_interface);
     gatt::SetMockBtaGattQueue(&gatt_queue);
 
-    ase_id_last_assigned = types::ase::kAseIdInvalid;
-    additional_ases = 0;
     ::le_audio::AudioSetConfigurationProvider::Initialize();
     LeAudioGroupStateMachine::Initialize(&mock_callbacks_);
 
+    ContentControlIdKeeper::GetInstance()->Start();
+
+    MockCsisClient::SetMockInstanceForTesting(&mock_csis_client_module_);
+    ON_CALL(mock_csis_client_module_, Get())
+        .WillByDefault(Return(&mock_csis_client_module_));
+    ON_CALL(mock_csis_client_module_, IsCsisClientRunning())
+        .WillByDefault(Return(true));
+    ON_CALL(mock_csis_client_module_, GetDeviceList(_))
+        .WillByDefault(Invoke([this](int group_id) { return addresses_; }));
+    ON_CALL(mock_csis_client_module_, GetDesiredSize(_))
+        .WillByDefault(
+            Invoke([this](int group_id) { return (int)(addresses_.size()); }));
+
     // Support 2M Phy
     ON_CALL(mock_controller_, SupportsBle2mPhy()).WillByDefault(Return(true));
     ON_CALL(btm_interface, IsPhy2mSupported(_, _)).WillByDefault(Return(true));
@@ -240,13 +275,19 @@
                 for (auto i = 0u; i < p.cis_cfgs.size(); ++i) {
                   conn_handles.push_back(UNIQUE_CIS_CONN_HANDLE(cig_id, i));
                 }
+                auto status = HCI_SUCCESS;
+                if (group_create_command_disallowed_) {
+                  group_create_command_disallowed_ = false;
+                  status = HCI_ERR_COMMAND_DISALLOWED;
+                }
+
                 LeAudioGroupStateMachine::Get()->ProcessHciNotifOnCigCreate(
-                    group.get(), 0, cig_id, conn_handles);
+                    group.get(), status, cig_id, conn_handles);
               }
             });
 
     ON_CALL(*mock_iso_manager_, RemoveCig)
-        .WillByDefault([this](uint8_t cig_id) {
+        .WillByDefault([this](uint8_t cig_id, bool force) {
           DLOG(INFO) << "CreateRemove";
 
           auto& group = le_audio_device_groups_[cig_id];
@@ -373,6 +414,12 @@
             return;
           }
 
+          // When we disconnect the remote with HCI_ERR_PEER_USER, we
+          // should be getting HCI_ERR_CONN_CAUSE_LOCAL_HOST from HCI.
+          if (reason == HCI_ERR_PEER_USER) {
+            reason = HCI_ERR_CONN_CAUSE_LOCAL_HOST;
+          }
+
           for (auto& kv_pair : le_audio_device_groups_) {
             auto& group = kv_pair.second;
             if (group->IsDeviceInTheGroup(dev_it->get())) {
@@ -402,6 +449,11 @@
   }
 
   void TearDown() override {
+    /* Clear the alarm on tear down in case test case ends when the
+     * alarm is scheduled
+     */
+    alarm_cancel(nullptr);
+
     iso_manager_->Stop();
     mock_iso_manager_ = nullptr;
     codec_manager_->Stop();
@@ -416,19 +468,20 @@
       ase_ctp_handlers[i] = nullptr;
 
     le_audio_devices_.clear();
+    addresses_.clear();
     cached_codec_configuration_map_.clear();
     cached_ase_to_cis_id_map_.clear();
     LeAudioGroupStateMachine::Cleanup();
     ::le_audio::AudioSetConfigurationProvider::Cleanup();
   }
 
-  std::shared_ptr<LeAudioDevice> PrepareConnectedDevice(uint8_t id,
-                                                        bool first_connection,
-                                                        uint8_t num_ase_snk,
-                                                        uint8_t num_ase_src) {
-    auto leAudioDevice =
-        std::make_shared<LeAudioDevice>(GetTestAddress(id), first_connection);
+  std::shared_ptr<LeAudioDevice> PrepareConnectedDevice(
+      uint8_t id, DeviceConnectState initial_connect_state, uint8_t num_ase_snk,
+      uint8_t num_ase_src) {
+    auto leAudioDevice = std::make_shared<LeAudioDevice>(GetTestAddress(id),
+                                                         initial_connect_state);
     leAudioDevice->conn_id_ = id;
+    leAudioDevice->SetConnectionState(DeviceConnectState::CONNECTED);
 
     uint16_t attr_handle = ATTR_HANDLE_ASCS_POOL_START;
     leAudioDevice->snk_audio_locations_hdls_.val_hdl = attr_handle++;
@@ -463,6 +516,7 @@
     }
 
     le_audio_devices_.push_back(leAudioDevice);
+    addresses_.push_back(leAudioDevice->address_);
 
     return std::move(leAudioDevice);
   }
@@ -482,10 +536,9 @@
     return &(*group);
   }
 
-  static void InjectAseStateNotification(types::ase* ase, LeAudioDevice* device,
-                                         LeAudioDeviceGroup* group,
-                                         uint8_t new_state,
-                                         void* new_state_params) {
+  void InjectAseStateNotification(types::ase* ase, LeAudioDevice* device,
+                                  LeAudioDeviceGroup* group, uint8_t new_state,
+                                  void* new_state_params) {
     // Prepare additional params
     switch (new_state) {
       case ascs::kAseStateCodecConfigured: {
@@ -632,7 +685,7 @@
     });
   }
 
-  static void InjectInitialIdleNotification(LeAudioDeviceGroup* group) {
+  void InjectInitialIdleNotification(LeAudioDeviceGroup* group) {
     for (auto* device = group->GetFirstDevice(); device != nullptr;
          device = group->GetNextDevice(device)) {
       for (auto& ase : device->ases_) {
@@ -642,12 +695,14 @@
     }
   }
 
-  void MultipleTestDevicePrepare(int leaudio_group_id, uint16_t context_type,
+  void MultipleTestDevicePrepare(int leaudio_group_id,
+                                 LeAudioContextType context_type,
                                  uint16_t device_cnt,
-                                 uint16_t update_context_type,
+                                 types::AudioContexts update_contexts,
                                  bool insert_default_pac_records = true) {
     // Prepare fake connected device group
-    bool first_connections = true;
+    DeviceConnectState initial_connect_state =
+        DeviceConnectState::CONNECTING_BY_USER;
     int total_devices = device_cnt;
     le_audio::LeAudioDeviceGroup* group = nullptr;
 
@@ -655,18 +710,18 @@
     uint8_t num_ase_src;
     switch (context_type) {
       case kContextTypeRingtone:
-        num_ase_snk = 1 + additional_ases;
-        num_ase_src = 0;
+        num_ase_snk = 1 + additional_snk_ases;
+        num_ase_src = 0 + additional_src_ases;
         break;
 
       case kContextTypeMedia:
-        num_ase_snk = 2 + additional_ases;
-        num_ase_src = 0;
+        num_ase_snk = 2 + additional_snk_ases;
+        num_ase_src = 0 + additional_src_ases;
         break;
 
       case kContextTypeConversational:
-        num_ase_snk = 1 + additional_ases;
-        num_ase_src = 1;
+        num_ase_snk = 1 + additional_snk_ases;
+        num_ase_src = 1 + additional_src_ases;
         break;
 
       default:
@@ -675,30 +730,27 @@
 
     while (device_cnt) {
       auto leAudioDevice = PrepareConnectedDevice(
-          device_cnt--, first_connections, num_ase_snk, num_ase_src);
+          device_cnt--, initial_connect_state, num_ase_snk, num_ase_src);
 
       if (insert_default_pac_records) {
         uint16_t attr_handle = ATTR_HANDLE_PACS_POOL_START;
 
         /* As per spec, unspecified shall be supported */
-        types::AudioContexts snk_context_type =
-            kContextTypeUnspecified | update_context_type;
-        types::AudioContexts src_context_type =
-            kContextTypeUnspecified | update_context_type;
+        auto snk_context_type = kContextTypeUnspecified | update_contexts;
+        auto src_context_type = kContextTypeUnspecified | update_contexts;
 
         // Prepare Sink Published Audio Capability records
-        if ((context_type & kContextTypeRingtone) ||
-            (context_type & kContextTypeMedia) ||
-            (context_type & kContextTypeConversational)) {
+        if ((kContextTypeRingtone | kContextTypeMedia |
+             kContextTypeConversational)
+                .test(context_type)) {
           // Set target ASE configurations
           std::vector<types::acs_ac_record> pac_recs;
 
-          InsertPacRecord(pac_recs,
-                          codec_specific::kCapSamplingFrequency16000Hz,
+          InsertPacRecord(pac_recs, sample_freq_,
                           codec_specific::kCapFrameDuration10ms |
                               codec_specific::kCapFrameDuration7p5ms |
                               codec_specific::kCapFrameDuration10msPreferred,
-                          0b00000001, 30, 120);
+                          channel_count_, 30, 120);
 
           types::hdl_pair handle_pair;
           handle_pair.val_hdl = attr_handle++;
@@ -707,14 +759,14 @@
           leAudioDevice->snk_pacs_.emplace_back(
               std::make_tuple(std::move(handle_pair), pac_recs));
 
-          snk_context_type |= context_type;
+          snk_context_type.set(static_cast<LeAudioContextType>(context_type));
           leAudioDevice->snk_audio_locations_ =
               ::le_audio::codec_spec_conf::kLeAudioLocationFrontLeft |
               ::le_audio::codec_spec_conf::kLeAudioLocationFrontRight;
         }
 
         // Prepare Source Published Audio Capability records
-        if (context_type & kContextTypeConversational) {
+        if (context_type == kContextTypeConversational) {
           // Set target ASE configurations
           std::vector<types::acs_ac_record> pac_recs;
 
@@ -731,7 +783,8 @@
 
           leAudioDevice->src_pacs_.emplace_back(
               std::make_tuple(std::move(handle_pair), pac_recs));
-          src_context_type |= kContextTypeConversational;
+          src_context_type.set(
+              static_cast<LeAudioContextType>(kContextTypeConversational));
 
           leAudioDevice->src_audio_locations_ =
               ::le_audio::codec_spec_conf::kLeAudioLocationFrontLeft |
@@ -743,23 +796,26 @@
       }
 
       group = GroupTheDevice(leaudio_group_id, std::move(leAudioDevice));
+      /* Set the location and direction to the group (done in client.cc)*/
+      group->ReloadAudioLocations();
+      group->ReloadAudioDirections();
     }
 
-    /* Stimulate update of active context map */
-    types::AudioContexts type_set = static_cast<uint16_t>(
-        update_context_type == 0 ? context_type
-                                 : context_type | update_context_type);
-    group->UpdateActiveContextsMap(type_set);
+    /* Stimulate update of available context map */
+    auto types_set = update_contexts.any() ? context_type | update_contexts
+                                           : types::AudioContexts(context_type);
+    group->UpdateAudioContextTypeAvailability(types_set);
 
     ASSERT_NE(group, nullptr);
     ASSERT_EQ(group->Size(), total_devices);
   }
 
   LeAudioDeviceGroup* PrepareSingleTestDeviceGroup(
-      int leaudio_group_id, uint16_t context_type, uint16_t device_cnt = 1,
-      uint16_t update_context_type = 0) {
+      int leaudio_group_id, LeAudioContextType context_type,
+      uint16_t device_cnt = 1,
+      types::AudioContexts update_contexts = types::AudioContexts()) {
     MultipleTestDevicePrepare(leaudio_group_id, context_type, device_cnt,
-                              update_context_type);
+                              update_contexts);
     return le_audio_device_groups_.count(leaudio_group_id)
                ? le_audio_device_groups_[leaudio_group_id].get()
                : nullptr;
@@ -814,7 +870,7 @@
             codec_configured_state_params.framing =
                 ascs::kAseParamFramingUnframedSupported;
             codec_configured_state_params.preferred_retrans_nb = 0x04;
-            codec_configured_state_params.max_transport_latency = 0x0005;
+            codec_configured_state_params.max_transport_latency = 0x0010;
             codec_configured_state_params.pres_delay_min = 0xABABAB;
             codec_configured_state_params.pres_delay_max = 0xCDCDCD;
             codec_configured_state_params.preferred_pres_delay_min =
@@ -909,7 +965,7 @@
   void PrepareEnableHandler(LeAudioDeviceGroup* group, int verify_ase_count = 0,
                             bool inject_enabling = true) {
     ase_ctp_handlers[ascs::kAseCtpOpcodeEnable] =
-        [group, verify_ase_count, inject_enabling](
+        [group, verify_ase_count, inject_enabling, this](
             LeAudioDevice* device, std::vector<uint8_t> value,
             GATT_WRITE_OP_CB cb, void* cb_data) {
           auto num_ase = value[1];
@@ -957,9 +1013,9 @@
   void PrepareDisableHandler(LeAudioDeviceGroup* group,
                              int verify_ase_count = 0) {
     ase_ctp_handlers[ascs::kAseCtpOpcodeDisable] =
-        [group, verify_ase_count](LeAudioDevice* device,
-                                  std::vector<uint8_t> value,
-                                  GATT_WRITE_OP_CB cb, void* cb_data) {
+        [group, verify_ase_count, this](LeAudioDevice* device,
+                                        std::vector<uint8_t> value,
+                                        GATT_WRITE_OP_CB cb, void* cb_data) {
           auto num_ase = value[1];
 
           // Verify ase count if needed
@@ -1003,9 +1059,9 @@
   void PrepareReceiverStartReady(LeAudioDeviceGroup* group,
                                  int verify_ase_count = 0) {
     ase_ctp_handlers[ascs::kAseCtpOpcodeReceiverStartReady] =
-        [group, verify_ase_count](LeAudioDevice* device,
-                                  std::vector<uint8_t> value,
-                                  GATT_WRITE_OP_CB cb, void* cb_data) {
+        [group, verify_ase_count, this](LeAudioDevice* device,
+                                        std::vector<uint8_t> value,
+                                        GATT_WRITE_OP_CB cb, void* cb_data) {
           auto num_ase = value[1];
 
           // Verify ase count if needed
@@ -1041,9 +1097,9 @@
   void PrepareReceiverStopReady(LeAudioDeviceGroup* group,
                                 int verify_ase_count = 0) {
     ase_ctp_handlers[ascs::kAseCtpOpcodeReceiverStopReady] =
-        [group, verify_ase_count](LeAudioDevice* device,
-                                  std::vector<uint8_t> value,
-                                  GATT_WRITE_OP_CB cb, void* cb_data) {
+        [group, verify_ase_count, this](LeAudioDevice* device,
+                                        std::vector<uint8_t> value,
+                                        GATT_WRITE_OP_CB cb, void* cb_data) {
           auto num_ase = value[1];
 
           // Verify ase count if needed
@@ -1111,6 +1167,7 @@
         };
   }
 
+  MockCsisClient mock_csis_client_module_;
   NiceMock<controller::MockControllerInterface> mock_controller_;
   NiceMock<bluetooth::manager::MockBtmInterface> btm_interface;
   gatt::MockBtaGattInterface gatt_interface;
@@ -1131,8 +1188,10 @@
 
   MockLeAudioGroupStateMachineCallbacks mock_callbacks_;
   std::vector<std::shared_ptr<LeAudioDevice>> le_audio_devices_;
+  std::vector<RawAddress> addresses_;
   std::map<uint8_t, std::unique_ptr<LeAudioDeviceGroup>>
       le_audio_device_groups_;
+  bool group_create_command_disallowed_ = false;
 };
 
 TEST_F(StateMachineTest, testInit) {
@@ -1146,8 +1205,13 @@
 }
 
 TEST_F(StateMachineTest, testConfigureCodecSingle) {
+  /* Device is banded headphones with 1x snk + 0x src ase
+   * (1xunidirectional CIS) with channel count 2 (for stereo
+   */
   const auto context_type = kContextTypeRingtone;
   const int leaudio_group_id = 2;
+  channel_count_ = kLeAudioCodecLC3ChannelCountSingleChannel |
+                   kLeAudioCodecLC3ChannelCountTwoChannel;
 
   // Prepare fake connected device group
   auto* group = PrepareSingleTestDeviceGroup(leaudio_group_id, context_type);
@@ -1173,11 +1237,15 @@
   InjectInitialIdleNotification(group);
 
   ASSERT_TRUE(LeAudioGroupStateMachine::Get()->StartStream(
-      group, static_cast<types::LeAudioContextType>(context_type)));
+      group, static_cast<LeAudioContextType>(context_type),
+      types::AudioContexts(context_type)));
 
   // Check if group has transitioned to a proper state
   ASSERT_EQ(group->GetState(),
             types::AseState::BTA_LE_AUDIO_ASE_STATE_CODEC_CONFIGURED);
+
+  /* Cancel is called when group goes to streaming. */
+  ASSERT_EQ(0, mock_function_count_map["alarm_cancel"]);
 }
 
 TEST_F(StateMachineTest, testConfigureCodecMulti) {
@@ -1214,14 +1282,23 @@
 
   // Start the configuration and stream the content
   ASSERT_TRUE(LeAudioGroupStateMachine::Get()->StartStream(
-      group, static_cast<types::LeAudioContextType>(context_type)));
+      group, static_cast<LeAudioContextType>(context_type),
+      types::AudioContexts(context_type)));
 
   // Check if group has transitioned to a proper state
   ASSERT_EQ(group->GetState(),
             types::AseState::BTA_LE_AUDIO_ASE_STATE_CODEC_CONFIGURED);
+
+  /* Cancel is called when group goes to streaming. */
+  ASSERT_EQ(0, mock_function_count_map["alarm_cancel"]);
 }
 
 TEST_F(StateMachineTest, testConfigureQosSingle) {
+  /* Device is banded headphones with 2x snk + 1x src ase
+   * (1x bidirectional + 1xunidirectional CIS)
+   */
+  additional_snk_ases = 1;
+  additional_src_ases = 1;
   const auto context_type = kContextTypeRingtone;
   const int leaudio_group_id = 3;
 
@@ -1232,8 +1309,8 @@
    * should have been configured.
    */
   auto* leAudioDevice = group->GetFirstDevice();
-  PrepareConfigureCodecHandler(group, 1);
-  PrepareConfigureQosHandler(group, 1);
+  PrepareConfigureCodecHandler(group, 2);
+  PrepareConfigureQosHandler(group, 2);
 
   // Start the configuration and stream Media content
   EXPECT_CALL(gatt_queue,
@@ -1246,16 +1323,65 @@
   EXPECT_CALL(*mock_iso_manager_, SetupIsoDataPath(_, _)).Times(0);
   EXPECT_CALL(*mock_iso_manager_, RemoveIsoDataPath(_, _)).Times(0);
   EXPECT_CALL(*mock_iso_manager_, DisconnectCis(_, _)).Times(0);
-  EXPECT_CALL(*mock_iso_manager_, RemoveCig(_)).Times(0);
+  EXPECT_CALL(*mock_iso_manager_, RemoveCig(_, _)).Times(0);
 
   InjectInitialIdleNotification(group);
 
   ASSERT_TRUE(LeAudioGroupStateMachine::Get()->StartStream(
-      group, static_cast<types::LeAudioContextType>(context_type)));
+      group, context_type, types::AudioContexts(context_type)));
 
   // Check if group has transitioned to a proper state
   ASSERT_EQ(group->GetState(),
             types::AseState::BTA_LE_AUDIO_ASE_STATE_QOS_CONFIGURED);
+
+  ASSERT_EQ(0, mock_function_count_map["alarm_cancel"]);
+}
+
+TEST_F(StateMachineTest, testConfigureQosSingleRecoverCig) {
+  /* Device is banded headphones with 2x snk + 1x src ase
+   * (1x bidirectional + 1xunidirectional CIS)
+   */
+  additional_snk_ases = 1;
+  additional_src_ases = 1;
+  const auto context_type = kContextTypeRingtone;
+  const int leaudio_group_id = 3;
+
+  /* Assume that on previous BT OFF CIG was not removed */
+  group_create_command_disallowed_ = true;
+
+  // Prepare fake connected device group
+  auto* group = PrepareSingleTestDeviceGroup(leaudio_group_id, context_type);
+
+  /* Since we prepared device with Ringtone context in mind, only one ASE
+   * should have been configured.
+   */
+  auto* leAudioDevice = group->GetFirstDevice();
+  PrepareConfigureCodecHandler(group, 2);
+  PrepareConfigureQosHandler(group, 2);
+
+  // Start the configuration and stream Media content
+  EXPECT_CALL(gatt_queue,
+              WriteCharacteristic(1, leAudioDevice->ctp_hdls_.val_hdl, _,
+                                  GATT_WRITE_NO_RSP, _, _))
+      .Times(3);
+
+  EXPECT_CALL(*mock_iso_manager_, CreateCig(_, _)).Times(2);
+  EXPECT_CALL(*mock_iso_manager_, RemoveCig(_, _)).Times(1);
+  EXPECT_CALL(*mock_iso_manager_, EstablishCis(_)).Times(0);
+  EXPECT_CALL(*mock_iso_manager_, SetupIsoDataPath(_, _)).Times(0);
+  EXPECT_CALL(*mock_iso_manager_, RemoveIsoDataPath(_, _)).Times(0);
+  EXPECT_CALL(*mock_iso_manager_, DisconnectCis(_, _)).Times(0);
+
+  InjectInitialIdleNotification(group);
+
+  ASSERT_TRUE(LeAudioGroupStateMachine::Get()->StartStream(
+      group, static_cast<LeAudioContextType>(context_type),
+      types::AudioContexts(context_type)));
+
+  // Check if group has transitioned to a proper state
+  ASSERT_EQ(group->GetState(),
+            types::AseState::BTA_LE_AUDIO_ASE_STATE_QOS_CONFIGURED);
+  ASSERT_EQ(0, mock_function_count_map["alarm_cancel"]);
 }
 
 TEST_F(StateMachineTest, testConfigureQosMultiple) {
@@ -1289,28 +1415,35 @@
   EXPECT_CALL(*mock_iso_manager_, SetupIsoDataPath(_, _)).Times(0);
   EXPECT_CALL(*mock_iso_manager_, RemoveIsoDataPath(_, _)).Times(0);
   EXPECT_CALL(*mock_iso_manager_, DisconnectCis(_, _)).Times(0);
-  EXPECT_CALL(*mock_iso_manager_, RemoveCig(_)).Times(0);
+  EXPECT_CALL(*mock_iso_manager_, RemoveCig(_, _)).Times(0);
 
   InjectInitialIdleNotification(group);
 
   // Start the configuration and stream Media content
   ASSERT_TRUE(LeAudioGroupStateMachine::Get()->StartStream(
-      group, static_cast<types::LeAudioContextType>(context_type)));
+      group, static_cast<LeAudioContextType>(context_type),
+      types::AudioContexts(context_type)));
 
   // Check if group has transitioned to a proper state
   ASSERT_EQ(group->GetState(),
             types::AseState::BTA_LE_AUDIO_ASE_STATE_QOS_CONFIGURED);
+  ASSERT_EQ(0, mock_function_count_map["alarm_cancel"]);
 }
 
 TEST_F(StateMachineTest, testStreamSingle) {
+  /* Device is banded headphones with 1x snk + 0x src ase
+   * (1xunidirectional CIS) with channel count 2 (for stereo
+   */
   const auto context_type = kContextTypeRingtone;
   const int leaudio_group_id = 4;
+  channel_count_ = kLeAudioCodecLC3ChannelCountSingleChannel |
+                   kLeAudioCodecLC3ChannelCountTwoChannel;
 
   // Prepare fake connected device group
   auto* group = PrepareSingleTestDeviceGroup(leaudio_group_id, context_type);
 
-  /* Since we prepared device with Ringtone context in mind, only one ASE
-   * should have been configured.
+  /* Ringtone with channel count 1 for single device and 1 ASE sink will
+   * end up with 1 Sink ASE being configured.
    */
   PrepareConfigureCodecHandler(group, 1);
   PrepareConfigureQosHandler(group, 1);
@@ -1327,7 +1460,7 @@
   EXPECT_CALL(*mock_iso_manager_, SetupIsoDataPath(_, _)).Times(1);
   EXPECT_CALL(*mock_iso_manager_, RemoveIsoDataPath(_, _)).Times(0);
   EXPECT_CALL(*mock_iso_manager_, DisconnectCis(_, _)).Times(0);
-  EXPECT_CALL(*mock_iso_manager_, RemoveCig(_)).Times(0);
+  EXPECT_CALL(*mock_iso_manager_, RemoveCig(_, _)).Times(0);
 
   InjectInitialIdleNotification(group);
 
@@ -1339,26 +1472,31 @@
 
   // Start the configuration and stream Media content
   ASSERT_TRUE(LeAudioGroupStateMachine::Get()->StartStream(
-      group, static_cast<types::LeAudioContextType>(context_type)));
+      group, static_cast<LeAudioContextType>(context_type),
+      types::AudioContexts(context_type)));
 
   // Check if group has transitioned to a proper state
   ASSERT_EQ(group->GetState(),
             types::AseState::BTA_LE_AUDIO_ASE_STATE_STREAMING);
+  ASSERT_EQ(1, mock_function_count_map["alarm_cancel"]);
 }
 
 TEST_F(StateMachineTest, testStreamSkipEnablingSink) {
-  const auto context_type = kContextTypeRingtone;
+  /* Device is banded headphones with 2x snk + none src ase
+   * (2x unidirectional CIS)
+   */
+  const auto context_type = kContextTypeMedia;
   const int leaudio_group_id = 4;
 
   // Prepare fake connected device group
   auto* group = PrepareSingleTestDeviceGroup(leaudio_group_id, context_type);
 
-  /* Since we prepared device with Ringtone context in mind, only one ASE
-   * should have been configured.
+  /* For Media context type with channel count 1 and two ASEs,
+   * there should have be 2 Ases configured configured.
    */
-  PrepareConfigureCodecHandler(group, 1);
-  PrepareConfigureQosHandler(group, 1);
-  PrepareEnableHandler(group, 1, false);
+  PrepareConfigureCodecHandler(group, 2);
+  PrepareConfigureQosHandler(group, 2);
+  PrepareEnableHandler(group, 2, false);
 
   auto* leAudioDevice = group->GetFirstDevice();
   EXPECT_CALL(gatt_queue,
@@ -1368,10 +1506,10 @@
 
   EXPECT_CALL(*mock_iso_manager_, CreateCig(_, _)).Times(1);
   EXPECT_CALL(*mock_iso_manager_, EstablishCis(_)).Times(1);
-  EXPECT_CALL(*mock_iso_manager_, SetupIsoDataPath(_, _)).Times(1);
+  EXPECT_CALL(*mock_iso_manager_, SetupIsoDataPath(_, _)).Times(2);
   EXPECT_CALL(*mock_iso_manager_, RemoveIsoDataPath(_, _)).Times(0);
   EXPECT_CALL(*mock_iso_manager_, DisconnectCis(_, _)).Times(0);
-  EXPECT_CALL(*mock_iso_manager_, RemoveCig(_)).Times(0);
+  EXPECT_CALL(*mock_iso_manager_, RemoveCig(_, _)).Times(0);
 
   InjectInitialIdleNotification(group);
 
@@ -1383,26 +1521,34 @@
 
   // Start the configuration and stream Media content
   ASSERT_TRUE(LeAudioGroupStateMachine::Get()->StartStream(
-      group, static_cast<types::LeAudioContextType>(context_type)));
+      group, static_cast<LeAudioContextType>(context_type),
+      types::AudioContexts(context_type)));
 
   // Check if group has transitioned to a proper state
   ASSERT_EQ(group->GetState(),
             types::AseState::BTA_LE_AUDIO_ASE_STATE_STREAMING);
+
+  ASSERT_EQ(1, mock_function_count_map["alarm_cancel"]);
 }
 
 TEST_F(StateMachineTest, testStreamSkipEnablingSinkSource) {
+  /* Device is banded headphones with 2x snk + 1x src ase
+   * (1x bidirectional CIS)
+   */
   const auto context_type = kContextTypeConversational;
   const int leaudio_group_id = 4;
 
+  additional_snk_ases = 1;
+
   // Prepare fake connected device group
   auto* group = PrepareSingleTestDeviceGroup(leaudio_group_id, context_type);
 
-  /* Since we prepared device with Conversional context in mind, one Sink ASE
-   * and one Source ASE should have been configured.
+  /* Since we prepared device with Conversional context in mind,
+   * 2 Sink ASEs and 1 Source ASE should have been configured.
    */
-  PrepareConfigureCodecHandler(group, 2);
-  PrepareConfigureQosHandler(group, 2);
-  PrepareEnableHandler(group, 2, false);
+  PrepareConfigureCodecHandler(group, 3);
+  PrepareConfigureQosHandler(group, 3);
+  PrepareEnableHandler(group, 3, false);
   PrepareReceiverStartReady(group, 1);
 
   auto* leAudioDevice = group->GetFirstDevice();
@@ -1413,10 +1559,10 @@
 
   EXPECT_CALL(*mock_iso_manager_, CreateCig(_, _)).Times(1);
   EXPECT_CALL(*mock_iso_manager_, EstablishCis(_)).Times(1);
-  EXPECT_CALL(*mock_iso_manager_, SetupIsoDataPath(_, _)).Times(2);
+  EXPECT_CALL(*mock_iso_manager_, SetupIsoDataPath(_, _)).Times(3);
   EXPECT_CALL(*mock_iso_manager_, RemoveIsoDataPath(_, _)).Times(0);
   EXPECT_CALL(*mock_iso_manager_, DisconnectCis(_, _)).Times(0);
-  EXPECT_CALL(*mock_iso_manager_, RemoveCig(_)).Times(0);
+  EXPECT_CALL(*mock_iso_manager_, RemoveCig(_, _)).Times(0);
 
   InjectInitialIdleNotification(group);
 
@@ -1428,11 +1574,13 @@
 
   // Start the configuration and stream Media content
   ASSERT_TRUE(LeAudioGroupStateMachine::Get()->StartStream(
-      group, static_cast<types::LeAudioContextType>(context_type)));
+      group, static_cast<LeAudioContextType>(context_type),
+      types::AudioContexts(context_type)));
 
   // Check if group has transitioned to a proper state
   ASSERT_EQ(group->GetState(),
             types::AseState::BTA_LE_AUDIO_ASE_STATE_STREAMING);
+  ASSERT_EQ(1, mock_function_count_map["alarm_cancel"]);
 }
 
 TEST_F(StateMachineTest, testStreamMultipleConversational) {
@@ -1455,7 +1603,7 @@
   EXPECT_CALL(*mock_iso_manager_, SetupIsoDataPath(_, _)).Times(4);
   EXPECT_CALL(*mock_iso_manager_, RemoveIsoDataPath(_, _)).Times(0);
   EXPECT_CALL(*mock_iso_manager_, DisconnectCis(_, _)).Times(0);
-  EXPECT_CALL(*mock_iso_manager_, RemoveCig(_)).Times(0);
+  EXPECT_CALL(*mock_iso_manager_, RemoveCig(_, _)).Times(0);
 
   InjectInitialIdleNotification(group);
 
@@ -1480,11 +1628,13 @@
 
   // Start the configuration and stream Media content
   ASSERT_TRUE(LeAudioGroupStateMachine::Get()->StartStream(
-      group, static_cast<types::LeAudioContextType>(context_type)));
+      group, static_cast<LeAudioContextType>(context_type),
+      types::AudioContexts(context_type)));
 
   // Check if group has transitioned to a proper state
   ASSERT_EQ(group->GetState(),
             types::AseState::BTA_LE_AUDIO_ASE_STATE_STREAMING);
+  ASSERT_EQ(1, mock_function_count_map["alarm_cancel"]);
 }
 
 TEST_F(StateMachineTest, testStreamMultiple) {
@@ -1506,7 +1656,7 @@
   EXPECT_CALL(*mock_iso_manager_, SetupIsoDataPath(_, _)).Times(2);
   EXPECT_CALL(*mock_iso_manager_, RemoveIsoDataPath(_, _)).Times(0);
   EXPECT_CALL(*mock_iso_manager_, DisconnectCis(_, _)).Times(0);
-  EXPECT_CALL(*mock_iso_manager_, RemoveCig(_)).Times(0);
+  EXPECT_CALL(*mock_iso_manager_, RemoveCig(_, _)).Times(0);
 
   InjectInitialIdleNotification(group);
 
@@ -1531,27 +1681,113 @@
 
   // Start the configuration and stream Media content
   ASSERT_TRUE(LeAudioGroupStateMachine::Get()->StartStream(
-      group, static_cast<types::LeAudioContextType>(context_type)));
+      group, static_cast<LeAudioContextType>(context_type),
+      types::AudioContexts(context_type)));
 
   // Check if group has transitioned to a proper state
   ASSERT_EQ(group->GetState(),
             types::AseState::BTA_LE_AUDIO_ASE_STATE_STREAMING);
+  ASSERT_EQ(1, mock_function_count_map["alarm_cancel"]);
+}
+
+TEST_F(StateMachineTest, testUpdateMetadataMultiple) {
+  const auto context_type = kContextTypeMedia;
+  const auto leaudio_group_id = 4;
+  const auto num_devices = 2;
+
+  // Prepare multiple fake connected devices in a group
+  auto* group =
+      PrepareSingleTestDeviceGroup(leaudio_group_id, context_type, num_devices);
+  ASSERT_EQ(group->Size(), num_devices);
+
+  PrepareConfigureCodecHandler(group);
+  PrepareConfigureQosHandler(group);
+  PrepareEnableHandler(group);
+
+  EXPECT_CALL(*mock_iso_manager_, CreateCig(_, _)).Times(1);
+  EXPECT_CALL(*mock_iso_manager_, EstablishCis(_)).Times(AtLeast(1));
+  EXPECT_CALL(*mock_iso_manager_, SetupIsoDataPath(_, _)).Times(2);
+  EXPECT_CALL(*mock_iso_manager_, RemoveIsoDataPath(_, _)).Times(0);
+  EXPECT_CALL(*mock_iso_manager_, DisconnectCis(_, _)).Times(0);
+  EXPECT_CALL(*mock_iso_manager_, RemoveCig(_, _)).Times(0);
+
+  InjectInitialIdleNotification(group);
+
+  auto* leAudioDevice = group->GetFirstDevice();
+  auto expected_devices_written = 0;
+  while (leAudioDevice) {
+    EXPECT_CALL(gatt_queue,
+                WriteCharacteristic(leAudioDevice->conn_id_,
+                                    leAudioDevice->ctp_hdls_.val_hdl, _,
+                                    GATT_WRITE_NO_RSP, _, _))
+        .Times(AtLeast(3));
+    expected_devices_written++;
+    leAudioDevice = group->GetNextDevice(leAudioDevice);
+  }
+  ASSERT_EQ(expected_devices_written, num_devices);
+
+  // Validate GroupStreamStatus
+  EXPECT_CALL(
+      mock_callbacks_,
+      StatusReportCb(leaudio_group_id,
+                     bluetooth::le_audio::GroupStreamStatus::STREAMING));
+
+  // Start the configuration and stream Media content
+  ASSERT_TRUE(LeAudioGroupStateMachine::Get()->StartStream(
+      group, static_cast<LeAudioContextType>(context_type),
+      types::AudioContexts(context_type)));
+
+  testing::Mock::VerifyAndClearExpectations(&gatt_queue);
+
+  // Check if group has transitioned to a proper state
+  ASSERT_EQ(group->GetState(),
+            types::AseState::BTA_LE_AUDIO_ASE_STATE_STREAMING);
+
+  ASSERT_EQ(1, mock_function_count_map["alarm_cancel"]);
+  mock_function_count_map["alarm_cancel"] = 0;
+
+  // Make sure all devices get the metadata update
+  leAudioDevice = group->GetFirstDevice();
+  expected_devices_written = 0;
+  while (leAudioDevice) {
+    EXPECT_CALL(gatt_queue,
+                WriteCharacteristic(leAudioDevice->conn_id_,
+                                    leAudioDevice->ctp_hdls_.val_hdl, _,
+                                    GATT_WRITE_NO_RSP, _, _))
+        .Times(1);
+    expected_devices_written++;
+    leAudioDevice = group->GetNextDevice(leAudioDevice);
+  }
+  ASSERT_EQ(expected_devices_written, num_devices);
+
+  const auto metadata_context_type =
+      kContextTypeMedia | kContextTypeSoundEffects;
+  ASSERT_TRUE(LeAudioGroupStateMachine::Get()->StartStream(
+      group, static_cast<LeAudioContextType>(context_type),
+      metadata_context_type));
+
+  /* This is just update metadata - watchdog is not used */
+  ASSERT_EQ(0, mock_function_count_map["alarm_cancel"]);
 }
 
 TEST_F(StateMachineTest, testDisableSingle) {
+  /* Device is banded headphones with 2x snk + 0x src ase
+   * (2xunidirectional CIS)
+   */
+  additional_snk_ases = 1;
   const auto context_type = kContextTypeRingtone;
   const int leaudio_group_id = 4;
 
   // Prepare fake connected device group
   auto* group = PrepareSingleTestDeviceGroup(leaudio_group_id, context_type);
 
-  /* Since we prepared device with Ringtone context in mind, only one ASE
-   * should have been configured.
+  /* Ringtone context plus additional ASE with channel count 1
+   * gives us 2 ASE which should have been configured.
    */
-  PrepareConfigureCodecHandler(group, 1);
-  PrepareConfigureQosHandler(group, 1);
-  PrepareEnableHandler(group, 1);
-  PrepareDisableHandler(group, 1);
+  PrepareConfigureCodecHandler(group, 2);
+  PrepareConfigureQosHandler(group, 2);
+  PrepareEnableHandler(group, 2);
+  PrepareDisableHandler(group, 2);
 
   auto* leAudioDevice = group->GetFirstDevice();
   EXPECT_CALL(gatt_queue,
@@ -1561,21 +1797,35 @@
 
   EXPECT_CALL(*mock_iso_manager_, CreateCig(_, _)).Times(1);
   EXPECT_CALL(*mock_iso_manager_, EstablishCis(_)).Times(1);
-  EXPECT_CALL(*mock_iso_manager_, SetupIsoDataPath(_, _)).Times(1);
-  EXPECT_CALL(*mock_iso_manager_, RemoveIsoDataPath(_, _)).Times(1);
-  EXPECT_CALL(*mock_iso_manager_, DisconnectCis(_, _)).Times(1);
-  EXPECT_CALL(*mock_iso_manager_, RemoveCig(_)).Times(0);
+  EXPECT_CALL(*mock_iso_manager_, SetupIsoDataPath(_, _)).Times(2);
+  EXPECT_CALL(
+      *mock_iso_manager_,
+      RemoveIsoDataPath(
+          _, bluetooth::hci::iso_manager::kRemoveIsoDataPathDirectionInput))
+      .Times(2);
+  EXPECT_CALL(*mock_iso_manager_, DisconnectCis(_, _)).Times(2);
+  EXPECT_CALL(*mock_iso_manager_, RemoveCig(_, _)).Times(0);
 
   InjectInitialIdleNotification(group);
 
+  EXPECT_CALL(
+      mock_callbacks_,
+      StatusReportCb(leaudio_group_id,
+                     bluetooth::le_audio::GroupStreamStatus::STREAMING));
+
   // Start the configuration and stream Media content
   LeAudioGroupStateMachine::Get()->StartStream(
-      group, static_cast<types::LeAudioContextType>(context_type));
+      group, static_cast<LeAudioContextType>(context_type),
+      types::AudioContexts(context_type));
 
   // Check if group has transitioned to a proper state
   ASSERT_EQ(group->GetState(),
             types::AseState::BTA_LE_AUDIO_ASE_STATE_STREAMING);
 
+  testing::Mock::VerifyAndClearExpectations(&mock_callbacks_);
+  ASSERT_EQ(1, mock_function_count_map["alarm_cancel"]);
+  mock_function_count_map["alarm_cancel"] = 0;
+
   // Validate GroupStreamStatus
   EXPECT_CALL(
       mock_callbacks_,
@@ -1592,6 +1842,9 @@
   // Check if group has transition to a proper state
   ASSERT_EQ(group->GetState(),
             types::AseState::BTA_LE_AUDIO_ASE_STATE_QOS_CONFIGURED);
+
+  testing::Mock::VerifyAndClearExpectations(&mock_callbacks_);
+  ASSERT_EQ(1, mock_function_count_map["alarm_cancel"]);
 }
 
 TEST_F(StateMachineTest, testDisableMultiple) {
@@ -1625,19 +1878,26 @@
   EXPECT_CALL(*mock_iso_manager_, CreateCig(_, _)).Times(1);
   EXPECT_CALL(*mock_iso_manager_, EstablishCis(_)).Times(1);
   EXPECT_CALL(*mock_iso_manager_, SetupIsoDataPath(_, _)).Times(2);
-  EXPECT_CALL(*mock_iso_manager_, RemoveIsoDataPath(_, _)).Times(2);
+  EXPECT_CALL(
+      *mock_iso_manager_,
+      RemoveIsoDataPath(
+          _, bluetooth::hci::iso_manager::kRemoveIsoDataPathDirectionInput))
+      .Times(2);
   EXPECT_CALL(*mock_iso_manager_, DisconnectCis(_, _)).Times(2);
-  EXPECT_CALL(*mock_iso_manager_, RemoveCig(_)).Times(0);
+  EXPECT_CALL(*mock_iso_manager_, RemoveCig(_, _)).Times(0);
 
   InjectInitialIdleNotification(group);
 
   // Start the configuration and stream Media content
   LeAudioGroupStateMachine::Get()->StartStream(
-      group, static_cast<types::LeAudioContextType>(context_type));
+      group, static_cast<LeAudioContextType>(context_type),
+      types::AudioContexts(context_type));
 
   // Check if group has transitioned to a proper state
   ASSERT_EQ(group->GetState(),
             types::AseState::BTA_LE_AUDIO_ASE_STATE_STREAMING);
+  ASSERT_EQ(1, mock_function_count_map["alarm_cancel"]);
+  mock_function_count_map["alarm_cancel"] = 0;
 
   // Validate GroupStreamStatus
   EXPECT_CALL(
@@ -1655,9 +1915,15 @@
   // Check if group has transitioned to a proper state
   ASSERT_EQ(group->GetState(),
             types::AseState::BTA_LE_AUDIO_ASE_STATE_QOS_CONFIGURED);
+  testing::Mock::VerifyAndClearExpectations(&mock_callbacks_);
+  ASSERT_EQ(1, mock_function_count_map["alarm_cancel"]);
 }
 
 TEST_F(StateMachineTest, testDisableBidirectional) {
+  /* Device is banded headphones with 2x snk + 1x src ase
+   * (1x bidirectional + 1xunidirectional CIS)
+   */
+  additional_snk_ases = 1;
   const auto context_type = kContextTypeConversational;
   const int leaudio_group_id = 4;
 
@@ -1667,10 +1933,10 @@
   /* Since we prepared device with Conversional context in mind, Sink and Source
    * ASEs should have been configured.
    */
-  PrepareConfigureCodecHandler(group, 2);
-  PrepareConfigureQosHandler(group, 2);
-  PrepareEnableHandler(group, 2);
-  PrepareDisableHandler(group, 2);
+  PrepareConfigureCodecHandler(group, 3);
+  PrepareConfigureQosHandler(group, 3);
+  PrepareEnableHandler(group, 3);
+  PrepareDisableHandler(group, 3);
   PrepareReceiverStartReady(group, 1);
   PrepareReceiverStopReady(group, 1);
 
@@ -1682,30 +1948,93 @@
 
   EXPECT_CALL(*mock_iso_manager_, CreateCig(_, _)).Times(1);
   EXPECT_CALL(*mock_iso_manager_, EstablishCis(_)).Times(1);
-  EXPECT_CALL(*mock_iso_manager_, SetupIsoDataPath(_, _)).Times(2);
-  EXPECT_CALL(*mock_iso_manager_, RemoveIsoDataPath(_, _)).Times(1);
-  EXPECT_CALL(*mock_iso_manager_, DisconnectCis(_, _)).Times(1);
-  EXPECT_CALL(*mock_iso_manager_, RemoveCig(_)).Times(0);
+  EXPECT_CALL(*mock_iso_manager_, SetupIsoDataPath(_, _)).Times(3);
+  bool removed_bidirectional = false;
+  bool removed_unidirectional = false;
+
+  /* Check data path removal */
+  ON_CALL(*mock_iso_manager_, RemoveIsoDataPath)
+      .WillByDefault(Invoke([&removed_bidirectional, &removed_unidirectional,
+                             this](uint16_t conn_handle,
+                                   uint8_t data_path_dir) {
+        /* Set flags for verification */
+        if (data_path_dir ==
+            (bluetooth::hci::iso_manager::kRemoveIsoDataPathDirectionInput |
+             bluetooth::hci::iso_manager::kRemoveIsoDataPathDirectionOutput)) {
+          removed_bidirectional = true;
+        } else if (data_path_dir == bluetooth::hci::iso_manager::
+                                        kRemoveIsoDataPathDirectionInput) {
+          removed_unidirectional = true;
+        }
+
+        /* Copied from default handler of RemoveIsoDataPath*/
+        auto dev_it =
+            std::find_if(le_audio_devices_.begin(), le_audio_devices_.end(),
+                         [&conn_handle](auto& dev) {
+                           auto ases = dev->GetAsesByCisConnHdl(conn_handle);
+                           return (ases.sink || ases.source);
+                         });
+        if (dev_it == le_audio_devices_.end()) {
+          return;
+        }
+
+        for (auto& kv_pair : le_audio_device_groups_) {
+          auto& group = kv_pair.second;
+          if (group->IsDeviceInTheGroup(dev_it->get())) {
+            LeAudioGroupStateMachine::Get()->ProcessHciNotifRemoveIsoDataPath(
+                group.get(), dev_it->get(), 0, conn_handle);
+            return;
+          }
+        }
+        /* End of copy */
+      }));
+
+  EXPECT_CALL(*mock_iso_manager_, DisconnectCis(_, _)).Times(2);
+  EXPECT_CALL(*mock_iso_manager_, RemoveCig(_, _)).Times(0);
 
   // Start the configuration and stream Media content
   LeAudioGroupStateMachine::Get()->StartStream(
-      group, static_cast<types::LeAudioContextType>(context_type));
+      group, static_cast<LeAudioContextType>(context_type),
+      types::AudioContexts(context_type));
 
   // Check if group has transitioned to a proper state
   ASSERT_EQ(group->GetState(),
             types::AseState::BTA_LE_AUDIO_ASE_STATE_STREAMING);
 
+  ASSERT_EQ(1, mock_function_count_map["alarm_cancel"]);
+  mock_function_count_map["alarm_cancel"] = 0;
+
+  // Validate GroupStreamStatus
+  EXPECT_CALL(
+      mock_callbacks_,
+      StatusReportCb(leaudio_group_id,
+                     bluetooth::le_audio::GroupStreamStatus::SUSPENDING));
+  EXPECT_CALL(
+      mock_callbacks_,
+      StatusReportCb(leaudio_group_id,
+                     bluetooth::le_audio::GroupStreamStatus::SUSPENDED));
+
   // Suspend the stream
   LeAudioGroupStateMachine::Get()->SuspendStream(group);
 
   // Check if group has transitioned to a proper state
   ASSERT_EQ(group->GetState(),
             types::AseState::BTA_LE_AUDIO_ASE_STATE_QOS_CONFIGURED);
+  ASSERT_EQ(removed_bidirectional, true);
+  ASSERT_EQ(removed_unidirectional, true);
+
+  testing::Mock::VerifyAndClearExpectations(&mock_callbacks_);
+  ASSERT_EQ(1, mock_function_count_map["alarm_cancel"]);
 }
 
 TEST_F(StateMachineTest, testReleaseSingle) {
+  /* Device is banded headphones with 1x snk + 0x src ase
+   * (1xunidirectional CIS) with channel count 2 (for stereo)
+   */
   const auto context_type = kContextTypeRingtone;
   const int leaudio_group_id = 4;
+  channel_count_ = kLeAudioCodecLC3ChannelCountSingleChannel |
+                   kLeAudioCodecLC3ChannelCountTwoChannel;
 
   // Prepare fake connected device group
   auto* group = PrepareSingleTestDeviceGroup(leaudio_group_id, context_type);
@@ -1730,18 +2059,20 @@
   EXPECT_CALL(*mock_iso_manager_, SetupIsoDataPath(_, _)).Times(1);
   EXPECT_CALL(*mock_iso_manager_, RemoveIsoDataPath(_, _)).Times(1);
   EXPECT_CALL(*mock_iso_manager_, DisconnectCis(_, _)).Times(1);
-  EXPECT_CALL(*mock_iso_manager_, RemoveCig(_)).Times(1);
+  EXPECT_CALL(*mock_iso_manager_, RemoveCig(_, _)).Times(1);
 
   InjectInitialIdleNotification(group);
 
   // Start the configuration and stream Media content
   LeAudioGroupStateMachine::Get()->StartStream(
-      group, static_cast<types::LeAudioContextType>(context_type));
+      group, static_cast<LeAudioContextType>(context_type),
+      types::AudioContexts(context_type));
 
   // Check if group has transitioned to a proper state
   ASSERT_EQ(group->GetState(),
             types::AseState::BTA_LE_AUDIO_ASE_STATE_STREAMING);
-
+  ASSERT_EQ(1, mock_function_count_map["alarm_cancel"]);
+  mock_function_count_map["alarm_cancel"] = 0;
   // Validate GroupStreamStatus
   EXPECT_CALL(
       mock_callbacks_,
@@ -1756,11 +2087,17 @@
 
   // Check if group has transitioned to a proper state
   ASSERT_EQ(group->GetState(), types::AseState::BTA_LE_AUDIO_ASE_STATE_IDLE);
+  ASSERT_EQ(1, mock_function_count_map["alarm_cancel"]);
 }
 
 TEST_F(StateMachineTest, testReleaseCachingSingle) {
+  /* Device is banded headphones with 1x snk + 0x src ase
+   * (1xunidirectional CIS)
+   */
   const auto context_type = kContextTypeRingtone;
   const int leaudio_group_id = 4;
+  channel_count_ = kLeAudioCodecLC3ChannelCountSingleChannel |
+                   kLeAudioCodecLC3ChannelCountTwoChannel;
 
   // Prepare fake connected device group
   auto* group = PrepareSingleTestDeviceGroup(leaudio_group_id, context_type);
@@ -1785,7 +2122,7 @@
   EXPECT_CALL(*mock_iso_manager_, SetupIsoDataPath(_, _)).Times(1);
   EXPECT_CALL(*mock_iso_manager_, RemoveIsoDataPath(_, _)).Times(1);
   EXPECT_CALL(*mock_iso_manager_, DisconnectCis(_, _)).Times(1);
-  EXPECT_CALL(*mock_iso_manager_, RemoveCig(_)).Times(1);
+  EXPECT_CALL(*mock_iso_manager_, RemoveCig(_, _)).Times(1);
 
   InjectInitialIdleNotification(group);
 
@@ -1807,36 +2144,45 @@
 
   // Start the configuration and stream Media content
   LeAudioGroupStateMachine::Get()->StartStream(
-      group, static_cast<types::LeAudioContextType>(context_type));
+      group, static_cast<LeAudioContextType>(context_type),
+      types::AudioContexts(context_type));
 
   // Check if group has transitioned to a proper state
   ASSERT_EQ(group->GetState(),
             types::AseState::BTA_LE_AUDIO_ASE_STATE_STREAMING);
 
+  ASSERT_EQ(1, mock_function_count_map["alarm_cancel"]);
+  mock_function_count_map["alarm_cancel"] = 0;
+
   // Stop the stream
   LeAudioGroupStateMachine::Get()->StopStream(group);
 
   // Check if group has transitioned to a proper state
   ASSERT_EQ(group->GetState(),
             types::AseState::BTA_LE_AUDIO_ASE_STATE_CODEC_CONFIGURED);
+
+  ASSERT_EQ(1, mock_function_count_map["alarm_cancel"]);
 }
 
-TEST_F(StateMachineTest, testStreamCachingSingle) {
+TEST_F(StateMachineTest,
+       testStreamCaching_NoReconfigurationNeeded_SingleDevice) {
   const auto context_type = kContextTypeRingtone;
   const int leaudio_group_id = 4;
+  channel_count_ = kLeAudioCodecLC3ChannelCountSingleChannel |
+                   kLeAudioCodecLC3ChannelCountTwoChannel;
 
-  additional_ases = 2;
+  additional_snk_ases = 2;
   // Prepare fake connected device group
   auto* group = PrepareSingleTestDeviceGroup(leaudio_group_id, context_type);
 
-  /* Since we prepared device with Ringtone context in mind, only one ASE
-   * should have been configured.
+  /* Since we prepared device with Ringtone context in mind and with no Source
+   * ASEs, therefor only one ASE should have been configured.
    */
-  PrepareConfigureCodecHandler(group, 2, true);
-  PrepareConfigureQosHandler(group, 2, true);
-  PrepareEnableHandler(group, 2);
-  PrepareDisableHandler(group, 2);
-  PrepareReleaseHandler(group, 2);
+  PrepareConfigureCodecHandler(group, 1, true);
+  PrepareConfigureQosHandler(group, 1, true);
+  PrepareEnableHandler(group, 1);
+  PrepareDisableHandler(group, 1);
+  PrepareReleaseHandler(group, 1);
 
   /* Ctp messages we expect:
    * 1. Codec Config
@@ -1854,10 +2200,10 @@
 
   EXPECT_CALL(*mock_iso_manager_, CreateCig(_, _)).Times(2);
   EXPECT_CALL(*mock_iso_manager_, EstablishCis(_)).Times(2);
-  EXPECT_CALL(*mock_iso_manager_, SetupIsoDataPath(_, _)).Times(4);
-  EXPECT_CALL(*mock_iso_manager_, RemoveIsoDataPath(_, _)).Times(2);
-  EXPECT_CALL(*mock_iso_manager_, DisconnectCis(_, _)).Times(2);
-  EXPECT_CALL(*mock_iso_manager_, RemoveCig(_)).Times(1);
+  EXPECT_CALL(*mock_iso_manager_, SetupIsoDataPath(_, _)).Times(2);
+  EXPECT_CALL(*mock_iso_manager_, RemoveIsoDataPath(_, _)).Times(1);
+  EXPECT_CALL(*mock_iso_manager_, DisconnectCis(_, _)).Times(1);
+  EXPECT_CALL(*mock_iso_manager_, RemoveCig(_, _)).Times(1);
 
   InjectInitialIdleNotification(group);
 
@@ -1880,12 +2226,16 @@
 
   // Start the configuration and stream Ringtone content
   LeAudioGroupStateMachine::Get()->StartStream(
-      group, static_cast<types::LeAudioContextType>(context_type));
+      group, static_cast<LeAudioContextType>(context_type),
+      types::AudioContexts(context_type));
 
   // Check if group has transitioned to a proper state
   ASSERT_EQ(group->GetState(),
             types::AseState::BTA_LE_AUDIO_ASE_STATE_STREAMING);
 
+  ASSERT_EQ(1, mock_function_count_map["alarm_cancel"]);
+  mock_function_count_map["alarm_cancel"] = 0;
+
   // Stop the stream
   LeAudioGroupStateMachine::Get()->StopStream(group);
 
@@ -1893,20 +2243,30 @@
   ASSERT_EQ(group->GetState(),
             types::AseState::BTA_LE_AUDIO_ASE_STATE_CODEC_CONFIGURED);
 
+  ASSERT_EQ(1, mock_function_count_map["alarm_cancel"]);
+  mock_function_count_map["alarm_cancel"] = 0;
+
   // Start the configuration and stream Media content
   LeAudioGroupStateMachine::Get()->StartStream(
-      group, static_cast<types::LeAudioContextType>(context_type));
+      group, static_cast<LeAudioContextType>(context_type),
+      types::AudioContexts(context_type));
 
   // Check if group has transitioned to a proper state
   ASSERT_EQ(group->GetState(),
             types::AseState::BTA_LE_AUDIO_ASE_STATE_STREAMING);
+
+  ASSERT_EQ(1, mock_function_count_map["alarm_cancel"]);
+  mock_function_count_map["alarm_cancel"] = 0;
 }
 
-TEST_F(StateMachineTest, testActivateStreamCachingSingle) {
+TEST_F(StateMachineTest,
+       test_StreamCaching_ReconfigureForContextChange_SingleDevice) {
   auto context_type = kContextTypeConversational;
   const int leaudio_group_id = 4;
+  channel_count_ = kLeAudioCodecLC3ChannelCountSingleChannel |
+                   kLeAudioCodecLC3ChannelCountTwoChannel;
 
-  additional_ases = 2;
+  additional_snk_ases = 2;
   /* Prepare fake connected device group with update of Media and Conversational
    * contexts
    */
@@ -1914,8 +2274,10 @@
       leaudio_group_id, context_type, 1,
       kContextTypeConversational | kContextTypeMedia);
 
-  /* Since we prepared device with Conversational context in mind, only one ASE
-   * should have been configured.
+  /* Don't validate ASE here, as after reconfiguration different ASE number
+   * will be used.
+   * For the first configuration (CONVERSTATIONAL) there will be 2 ASEs (Sink
+   * and Source) After reconfiguration (MEDIA) there will be single ASE.
    */
   PrepareConfigureCodecHandler(group, 0, true);
   PrepareConfigureQosHandler(group, 0, true);
@@ -1928,8 +2290,9 @@
    * 2. QoS Config
    * 3. Enable
    * 4. Release
-   * 5. QoS Config (because device stays in Configured state)
-   * 6. Enable
+   * 5. Codec Config
+   * 6. QoS Config
+   * 7. Enable
    */
   auto* leAudioDevice = group->GetFirstDevice();
   EXPECT_CALL(gatt_queue,
@@ -1939,10 +2302,17 @@
 
   EXPECT_CALL(*mock_iso_manager_, CreateCig(_, _)).Times(2);
   EXPECT_CALL(*mock_iso_manager_, EstablishCis(_)).Times(2);
-  EXPECT_CALL(*mock_iso_manager_, SetupIsoDataPath(_, _)).Times(5);
-  EXPECT_CALL(*mock_iso_manager_, RemoveIsoDataPath(_, _)).Times(2);
-  EXPECT_CALL(*mock_iso_manager_, DisconnectCis(_, _)).Times(2);
-  EXPECT_CALL(*mock_iso_manager_, RemoveCig(_)).Times(1);
+
+  /* 2 times for first configuration (1 Sink, 1 Source), 1 time for second
+   * configuration (1 Sink)*/
+  EXPECT_CALL(*mock_iso_manager_, SetupIsoDataPath(_, _)).Times(3);
+
+  uint8_t value =
+      bluetooth::hci::iso_manager::kRemoveIsoDataPathDirectionOutput |
+      bluetooth::hci::iso_manager::kRemoveIsoDataPathDirectionInput;
+  EXPECT_CALL(*mock_iso_manager_, RemoveIsoDataPath(_, value)).Times(1);
+  EXPECT_CALL(*mock_iso_manager_, DisconnectCis(_, _)).Times(1);
+  EXPECT_CALL(*mock_iso_manager_, RemoveCig(_, _)).Times(1);
 
   InjectInitialIdleNotification(group);
 
@@ -1965,12 +2335,16 @@
 
   // Start the configuration and stream Conversational content
   LeAudioGroupStateMachine::Get()->StartStream(
-      group, static_cast<types::LeAudioContextType>(context_type));
+      group, static_cast<LeAudioContextType>(context_type),
+      types::AudioContexts(context_type));
 
   // Check if group has transitioned to a proper state
   ASSERT_EQ(group->GetState(),
             types::AseState::BTA_LE_AUDIO_ASE_STATE_STREAMING);
 
+  ASSERT_EQ(1, mock_function_count_map["alarm_cancel"]);
+  mock_function_count_map["alarm_cancel"] = 0;
+
   // Stop the stream
   LeAudioGroupStateMachine::Get()->StopStream(group);
 
@@ -1978,14 +2352,19 @@
   ASSERT_EQ(group->GetState(),
             types::AseState::BTA_LE_AUDIO_ASE_STATE_CODEC_CONFIGURED);
 
+  ASSERT_EQ(1, mock_function_count_map["alarm_cancel"]);
+  mock_function_count_map["alarm_cancel"] = 0;
+
   // Start the configuration and stream Media content
   context_type = kContextTypeMedia;
   LeAudioGroupStateMachine::Get()->StartStream(
-      group, static_cast<types::LeAudioContextType>(context_type));
+      group, static_cast<LeAudioContextType>(context_type),
+      types::AudioContexts(context_type));
 
   // Check if group has transitioned to a proper state
   ASSERT_EQ(group->GetState(),
             types::AseState::BTA_LE_AUDIO_ASE_STATE_STREAMING);
+  ASSERT_EQ(1, mock_function_count_map["alarm_cancel"]);
 }
 
 TEST_F(StateMachineTest, testReleaseMultiple) {
@@ -2022,18 +2401,22 @@
   EXPECT_CALL(*mock_iso_manager_, SetupIsoDataPath(_, _)).Times(2);
   EXPECT_CALL(*mock_iso_manager_, RemoveIsoDataPath(_, _)).Times(2);
   EXPECT_CALL(*mock_iso_manager_, DisconnectCis(_, _)).Times(2);
-  EXPECT_CALL(*mock_iso_manager_, RemoveCig(_)).Times(1);
+  EXPECT_CALL(*mock_iso_manager_, RemoveCig(_, _)).Times(1);
 
   InjectInitialIdleNotification(group);
 
   // Start the configuration and stream Media content
   LeAudioGroupStateMachine::Get()->StartStream(
-      group, static_cast<types::LeAudioContextType>(context_type));
+      group, static_cast<LeAudioContextType>(context_type),
+      types::AudioContexts(context_type));
 
   // Check if group has transitioned to a proper state
   ASSERT_EQ(group->GetState(),
             types::AseState::BTA_LE_AUDIO_ASE_STATE_STREAMING);
 
+  ASSERT_EQ(1, mock_function_count_map["alarm_cancel"]);
+  mock_function_count_map["alarm_cancel"] = 0;
+
   // Validate GroupStreamStatus
   EXPECT_CALL(
       mock_callbacks_,
@@ -2048,9 +2431,14 @@
 
   // Check if group has transitioned to a proper state
   ASSERT_EQ(group->GetState(), types::AseState::BTA_LE_AUDIO_ASE_STATE_IDLE);
+  ASSERT_EQ(1, mock_function_count_map["alarm_cancel"]);
 }
 
 TEST_F(StateMachineTest, testReleaseBidirectional) {
+  /* Device is banded headphones with 2x snk + 1x src ase
+   * (1x bidirectional + 1xunidirectional CIS)
+   */
+  additional_snk_ases = 1;
   const auto context_type = kContextTypeConversational;
   const auto leaudio_group_id = 6;
 
@@ -2060,12 +2448,12 @@
   /* Since we prepared device with Conversional context in mind, Sink and Source
    * ASEs should have been configured.
    */
-  PrepareConfigureCodecHandler(group, 2);
-  PrepareConfigureQosHandler(group, 2);
-  PrepareEnableHandler(group, 2);
-  PrepareDisableHandler(group, 2);
+  PrepareConfigureCodecHandler(group, 3);
+  PrepareConfigureQosHandler(group, 3);
+  PrepareEnableHandler(group, 3);
+  PrepareDisableHandler(group, 3);
   PrepareReceiverStartReady(group, 1);
-  PrepareReleaseHandler(group, 2);
+  PrepareReleaseHandler(group, 3);
 
   auto* leAudioDevice = group->GetFirstDevice();
   EXPECT_CALL(gatt_queue,
@@ -2075,29 +2463,39 @@
 
   EXPECT_CALL(*mock_iso_manager_, CreateCig(_, _)).Times(1);
   EXPECT_CALL(*mock_iso_manager_, EstablishCis(_)).Times(1);
-  EXPECT_CALL(*mock_iso_manager_, SetupIsoDataPath(_, _)).Times(2);
-  EXPECT_CALL(*mock_iso_manager_, RemoveIsoDataPath(_, _)).Times(1);
-  EXPECT_CALL(*mock_iso_manager_, DisconnectCis(_, _)).Times(1);
-  EXPECT_CALL(*mock_iso_manager_, RemoveCig(_)).Times(1);
+  EXPECT_CALL(*mock_iso_manager_, SetupIsoDataPath(_, _)).Times(3);
+  EXPECT_CALL(*mock_iso_manager_, RemoveIsoDataPath(_, _)).Times(2);
+  EXPECT_CALL(*mock_iso_manager_, DisconnectCis(_, _)).Times(2);
+  EXPECT_CALL(*mock_iso_manager_, RemoveCig(_, _)).Times(1);
 
   InjectInitialIdleNotification(group);
 
   // Start the configuration and stream Media content
   LeAudioGroupStateMachine::Get()->StartStream(
-      group, static_cast<types::LeAudioContextType>(context_type));
+      group, static_cast<LeAudioContextType>(context_type),
+      types::AudioContexts(context_type));
 
   // Check if group has transitioned to a proper state
   ASSERT_EQ(group->GetState(),
             types::AseState::BTA_LE_AUDIO_ASE_STATE_STREAMING);
 
+  ASSERT_EQ(1, mock_function_count_map["alarm_cancel"]);
+  mock_function_count_map["alarm_cancel"] = 0;
+
   // Stop the stream
   LeAudioGroupStateMachine::Get()->StopStream(group);
 
   // Check if group has transitioned to a proper state
   ASSERT_EQ(group->GetState(), types::AseState::BTA_LE_AUDIO_ASE_STATE_IDLE);
+  ASSERT_EQ(1, mock_function_count_map["alarm_cancel"]);
+  mock_function_count_map["alarm_cancel"] = 0;
 }
 
 TEST_F(StateMachineTest, testDisableAndReleaseBidirectional) {
+  /* Device is banded headphones with 2x snk + 1x src ase
+   * (1x bidirectional + 1xunidirectional CIS)
+   */
+  additional_snk_ases = 1;
   const auto context_type = kContextTypeConversational;
   const int leaudio_group_id = 4;
 
@@ -2107,13 +2505,13 @@
   /* Since we prepared device with Conversional context in mind, Sink and Source
    * ASEs should have been configured.
    */
-  PrepareConfigureCodecHandler(group, 2);
-  PrepareConfigureQosHandler(group, 2);
-  PrepareEnableHandler(group, 2);
-  PrepareDisableHandler(group, 2);
+  PrepareConfigureCodecHandler(group, 3);
+  PrepareConfigureQosHandler(group, 3);
+  PrepareEnableHandler(group, 3);
+  PrepareDisableHandler(group, 3);
   PrepareReceiverStartReady(group, 1);
   PrepareReceiverStopReady(group, 1);
-  PrepareReleaseHandler(group, 2);
+  PrepareReleaseHandler(group, 3);
 
   auto* leAudioDevice = group->GetFirstDevice();
   EXPECT_CALL(gatt_queue,
@@ -2123,14 +2521,15 @@
 
   EXPECT_CALL(*mock_iso_manager_, CreateCig(_, _)).Times(1);
   EXPECT_CALL(*mock_iso_manager_, EstablishCis(_)).Times(1);
-  EXPECT_CALL(*mock_iso_manager_, SetupIsoDataPath(_, _)).Times(2);
-  EXPECT_CALL(*mock_iso_manager_, RemoveIsoDataPath(_, _)).Times(1);
-  EXPECT_CALL(*mock_iso_manager_, DisconnectCis(_, _)).Times(1);
-  EXPECT_CALL(*mock_iso_manager_, RemoveCig(_)).Times(1);
+  EXPECT_CALL(*mock_iso_manager_, SetupIsoDataPath(_, _)).Times(3);
+  EXPECT_CALL(*mock_iso_manager_, RemoveIsoDataPath(_, _)).Times(2);
+  EXPECT_CALL(*mock_iso_manager_, DisconnectCis(_, _)).Times(2);
+  EXPECT_CALL(*mock_iso_manager_, RemoveCig(_, _)).Times(1);
 
   // Start the configuration and stream Media content
   LeAudioGroupStateMachine::Get()->StartStream(
-      group, static_cast<types::LeAudioContextType>(context_type));
+      group, static_cast<LeAudioContextType>(context_type),
+      types::AudioContexts(context_type));
 
   // Suspend the stream
   LeAudioGroupStateMachine::Get()->SuspendStream(group);
@@ -2159,7 +2558,7 @@
   EXPECT_CALL(*mock_iso_manager_, SetupIsoDataPath(_, _)).Times(0);
   EXPECT_CALL(*mock_iso_manager_, RemoveIsoDataPath(_, _)).Times(0);
   EXPECT_CALL(*mock_iso_manager_, DisconnectCis(_, _)).Times(0);
-  EXPECT_CALL(*mock_iso_manager_, RemoveCig(_)).Times(0);
+  EXPECT_CALL(*mock_iso_manager_, RemoveCig(_, _)).Times(0);
 
   for (auto* device = group->GetFirstDevice(); device != nullptr;
        device = group->GetNextDevice(device)) {
@@ -2189,7 +2588,7 @@
   EXPECT_CALL(*mock_iso_manager_, SetupIsoDataPath(_, _)).Times(0);
   EXPECT_CALL(*mock_iso_manager_, RemoveIsoDataPath(_, _)).Times(0);
   EXPECT_CALL(*mock_iso_manager_, DisconnectCis(_, _)).Times(0);
-  EXPECT_CALL(*mock_iso_manager_, RemoveCig(_)).Times(0);
+  EXPECT_CALL(*mock_iso_manager_, RemoveCig(_, _)).Times(0);
 
   for (auto* device = group->GetFirstDevice(); device != nullptr;
        device = group->GetNextDevice(device)) {
@@ -2207,6 +2606,10 @@
 }
 
 TEST_F(StateMachineTest, testAseAutonomousRelease) {
+  /* Device is banded headphones with 2x snk + 1x src ase
+   * (1x bidirectional + 1xunidirectional CIS)
+   */
+  additional_snk_ases = 1;
   const auto context_type = kContextTypeConversational;
   const int leaudio_group_id = 4;
 
@@ -2216,13 +2619,13 @@
   /* Since we prepared device with Conversional context in mind, Sink and Source
    * ASEs should have been configured.
    */
-  PrepareConfigureCodecHandler(group, 2);
-  PrepareConfigureQosHandler(group, 2);
-  PrepareEnableHandler(group, 2);
-  PrepareDisableHandler(group, 2);
+  PrepareConfigureCodecHandler(group, 3);
+  PrepareConfigureQosHandler(group, 3);
+  PrepareEnableHandler(group, 3);
+  PrepareDisableHandler(group, 3);
   PrepareReceiverStartReady(group, 1);
   PrepareReceiverStopReady(group, 1);
-  PrepareReleaseHandler(group, 2);
+  PrepareReleaseHandler(group, 3);
 
   InjectInitialIdleNotification(group);
 
@@ -2234,7 +2637,8 @@
 
   // Start the configuration and stream Media content
   ASSERT_TRUE(LeAudioGroupStateMachine::Get()->StartStream(
-      group, static_cast<types::LeAudioContextType>(context_type)));
+      group, static_cast<LeAudioContextType>(context_type),
+      types::AudioContexts(context_type)));
 
   // Validate new GroupStreamStatus
   EXPECT_CALL(mock_callbacks_,
@@ -2243,7 +2647,10 @@
       .Times(AtLeast(1));
 
   /* Single disconnect as it is bidirectional Cis*/
-  EXPECT_CALL(*mock_iso_manager_, DisconnectCis(_, _)).Times(1);
+  EXPECT_CALL(*mock_iso_manager_, DisconnectCis(_, _)).Times(2);
+
+  ASSERT_EQ(1, mock_function_count_map["alarm_cancel"]);
+  mock_function_count_map["alarm_cancel"] = 0;
 
   for (auto* device = group->GetFirstDevice(); device != nullptr;
        device = group->GetNextDevice(device)) {
@@ -2268,6 +2675,8 @@
       ASSERT_EQ(ase.state, types::AseState::BTA_LE_AUDIO_ASE_STATE_IDLE);
     }
   }
+
+  ASSERT_EQ(0, mock_function_count_map["alarm_cancel"]);
 }
 
 TEST_F(StateMachineTest, testAseAutonomousRelease2Devices) {
@@ -2300,7 +2709,8 @@
 
   // Start the configuration and stream Media content
   ASSERT_TRUE(LeAudioGroupStateMachine::Get()->StartStream(
-      group, static_cast<types::LeAudioContextType>(context_type)));
+      group, static_cast<LeAudioContextType>(context_type),
+      types::AudioContexts(context_type)));
 
   // Check streaming will continue
   EXPECT_CALL(mock_callbacks_,
@@ -2329,6 +2739,8 @@
 TEST_F(StateMachineTest, testStateTransitionTimeoutOnIdleState) {
   const auto context_type = kContextTypeRingtone;
   const int leaudio_group_id = 4;
+  channel_count_ = kLeAudioCodecLC3ChannelCountSingleChannel |
+                   kLeAudioCodecLC3ChannelCountTwoChannel;
 
   // Prepare fake connected device group
   auto* group = PrepareSingleTestDeviceGroup(leaudio_group_id, context_type);
@@ -2341,7 +2753,8 @@
 
   // Start the configuration and stream Media content
   ASSERT_TRUE(LeAudioGroupStateMachine::Get()->StartStream(
-      group, static_cast<types::LeAudioContextType>(context_type)));
+      group, static_cast<LeAudioContextType>(context_type),
+      types::AudioContexts(context_type)));
 
   // Disconnect device
   LeAudioGroupStateMachine::Get()->ProcessHciNotifAclDisconnected(
@@ -2354,6 +2767,8 @@
 TEST_F(StateMachineTest, testStateTransitionTimeout) {
   const auto context_type = kContextTypeRingtone;
   const int leaudio_group_id = 4;
+  channel_count_ = kLeAudioCodecLC3ChannelCountSingleChannel |
+                   kLeAudioCodecLC3ChannelCountTwoChannel;
 
   // Prepare fake connected device group
   auto* group = PrepareSingleTestDeviceGroup(leaudio_group_id, context_type);
@@ -2372,7 +2787,8 @@
 
   // Start the configuration and stream Media content
   ASSERT_TRUE(LeAudioGroupStateMachine::Get()->StartStream(
-      group, static_cast<types::LeAudioContextType>(context_type)));
+      group, static_cast<LeAudioContextType>(context_type),
+      types::AudioContexts(context_type)));
 
   // Check if timeout is fired
   EXPECT_CALL(mock_callbacks_, OnStateTransitionTimeout(leaudio_group_id));
@@ -2387,6 +2803,19 @@
 TEST_F(StateMachineTest, testConfigureDataPathForHost) {
   const auto context_type = kContextTypeRingtone;
   const int leaudio_group_id = 4;
+  channel_count_ = kLeAudioCodecLC3ChannelCountSingleChannel |
+                   kLeAudioCodecLC3ChannelCountTwoChannel;
+
+  /* Should be called 3 times because
+   * 1 - calling GetConfigurations just after connection
+   * (UpdateAudioContextTypeAvailability)
+   * 2 - when doing configuration of the context type
+   * 3 - AddCisToStreamConfiguration -> CreateStreamVectorForOffloader
+   * 4 - Data Path
+   */
+  EXPECT_CALL(*mock_codec_manager_, GetCodecLocation())
+      .Times(4)
+      .WillRepeatedly(Return(types::CodecLocation::HOST));
 
   // Prepare fake connected device group
   auto* group = PrepareSingleTestDeviceGroup(leaudio_group_id, context_type);
@@ -2398,9 +2827,6 @@
   PrepareConfigureQosHandler(group, 1);
   PrepareEnableHandler(group, 1);
 
-  EXPECT_CALL(*mock_codec_manager_, GetCodecLocation())
-      .WillOnce(Return(types::CodecLocation::HOST));
-
   EXPECT_CALL(
       *mock_iso_manager_,
       SetupIsoDataPath(
@@ -2411,11 +2837,25 @@
 
   // Start the configuration and stream Media content
   ASSERT_TRUE(LeAudioGroupStateMachine::Get()->StartStream(
-      group, static_cast<types::LeAudioContextType>(context_type)));
+      group, static_cast<LeAudioContextType>(context_type),
+      types::AudioContexts(context_type)));
 }
 TEST_F(StateMachineTest, testConfigureDataPathForAdsp) {
   const auto context_type = kContextTypeRingtone;
   const int leaudio_group_id = 4;
+  channel_count_ = kLeAudioCodecLC3ChannelCountSingleChannel |
+                   kLeAudioCodecLC3ChannelCountTwoChannel;
+
+  /* Should be called 3 times because
+   * 1 - calling GetConfigurations just after connection
+   * (UpdateAudioContextTypeAvailability)
+   * 2 - when doing configuration of the context type
+   * 3 - AddCisToStreamConfiguration -> CreateStreamVectorForOffloader
+   * 4 - data path
+   */
+  EXPECT_CALL(*mock_codec_manager_, GetCodecLocation())
+      .Times(4)
+      .WillRepeatedly(Return(types::CodecLocation::ADSP));
 
   // Prepare fake connected device group
   auto* group = PrepareSingleTestDeviceGroup(leaudio_group_id, context_type);
@@ -2427,9 +2867,6 @@
   PrepareConfigureQosHandler(group, 1);
   PrepareEnableHandler(group, 1);
 
-  EXPECT_CALL(*mock_codec_manager_, GetCodecLocation())
-      .WillOnce(Return(types::CodecLocation::ADSP));
-
   EXPECT_CALL(
       *mock_iso_manager_,
       SetupIsoDataPath(
@@ -2441,23 +2878,8 @@
 
   // Start the configuration and stream Media content
   ASSERT_TRUE(LeAudioGroupStateMachine::Get()->StartStream(
-      group, static_cast<types::LeAudioContextType>(context_type)));
-}
-
-static void InjectCisDisconnected(LeAudioDeviceGroup* group,
-                                  LeAudioDevice* leAudioDevice) {
-  bluetooth::hci::iso_manager::cis_disconnected_evt event;
-
-  auto* ase = leAudioDevice->GetFirstActiveAse();
-  while (ase) {
-    event.reason = 0x08;
-    event.cig_id = group->group_id_;
-    event.cis_conn_hdl = ase->cis_conn_hdl;
-    LeAudioGroupStateMachine::Get()->ProcessHciNotifCisDisconnected(
-        group, leAudioDevice, &event);
-
-    ase = leAudioDevice->GetNextActiveAse(ase);
-  }
+      group, static_cast<LeAudioContextType>(context_type),
+      types::AudioContexts(context_type)));
 }
 
 static void InjectAclDisconnected(LeAudioDeviceGroup* group,
@@ -2466,11 +2888,118 @@
       group, leAudioDevice);
 }
 
+TEST_F(StateMachineTest, testStreamConfigurationAdspDownMix) {
+  const auto context_type = kContextTypeConversational;
+  const int leaudio_group_id = 4;
+  const int num_devices = 2;
+
+  // Prepare fake connected device group
+  auto* group = PrepareSingleTestDeviceGroup(
+      leaudio_group_id, context_type, num_devices,
+      types::AudioContexts(kContextTypeConversational));
+
+  /* Should be called 5 times because
+   * 1 - calling GetConfigurations just after connection
+   * (UpdateAudioContextTypeAvailability),
+   * 2 - when doing configuration of the context type
+   * 3 - AddCisToStreamConfiguration -> CreateStreamVectorForOffloader (sink)
+   * 4 - AddCisToStreamConfiguration -> CreateStreamVectorForOffloader (source)
+   * 5,6 - Data Path
+   */
+  EXPECT_CALL(*mock_codec_manager_, GetCodecLocation())
+      .Times(6)
+      .WillRepeatedly(Return(types::CodecLocation::ADSP));
+
+  PrepareConfigureCodecHandler(group);
+  PrepareConfigureQosHandler(group);
+  PrepareEnableHandler(group);
+  PrepareReceiverStartReady(group);
+
+  InjectInitialIdleNotification(group);
+
+  auto* leAudioDevice = group->GetFirstDevice();
+  InjectAclDisconnected(group, leAudioDevice);
+
+  // Start the configuration and stream Media content
+  ASSERT_TRUE(LeAudioGroupStateMachine::Get()->StartStream(
+      group, static_cast<LeAudioContextType>(context_type),
+      types::AudioContexts(context_type)));
+
+  ASSERT_EQ(
+      static_cast<int>(
+          group->stream_conf.sink_offloader_streams_target_allocation.size()),
+      2);
+  ASSERT_EQ(
+      static_cast<int>(
+          group->stream_conf.source_offloader_streams_target_allocation.size()),
+      2);
+
+  ASSERT_EQ(
+      static_cast<int>(
+          group->stream_conf.sink_offloader_streams_current_allocation.size()),
+      2);
+  ASSERT_EQ(
+      static_cast<int>(group->stream_conf
+                           .source_offloader_streams_current_allocation.size()),
+      2);
+
+  // Check if group has transitioned to a proper state
+  ASSERT_EQ(group->GetState(),
+            types::AseState::BTA_LE_AUDIO_ASE_STATE_STREAMING);
+
+  uint32_t allocation = 0;
+  for (const auto& s :
+       group->stream_conf.sink_offloader_streams_target_allocation) {
+    allocation |= s.second;
+    ASSERT_FALSE(allocation == 0);
+  }
+  ASSERT_TRUE(allocation == codec_spec_conf::kLeAudioLocationStereo);
+
+  allocation = 0;
+  for (const auto& s :
+       group->stream_conf.source_offloader_streams_target_allocation) {
+    allocation |= s.second;
+    ASSERT_FALSE(allocation == 0);
+  }
+  ASSERT_TRUE(allocation == codec_spec_conf::kLeAudioLocationStereo);
+
+  for (const auto& s :
+       group->stream_conf.sink_offloader_streams_current_allocation) {
+    ASSERT_TRUE((s.second == 0) ||
+                (s.second == codec_spec_conf::kLeAudioLocationStereo));
+  }
+
+  for (const auto& s :
+       group->stream_conf.source_offloader_streams_current_allocation) {
+    ASSERT_TRUE((s.second == 0) ||
+                (s.second == codec_spec_conf::kLeAudioLocationStereo));
+  }
+}
+
+static void InjectCisDisconnected(LeAudioDeviceGroup* group,
+                                  LeAudioDevice* leAudioDevice,
+                                  uint8_t reason) {
+  bluetooth::hci::iso_manager::cis_disconnected_evt event;
+
+  for (auto const ase : leAudioDevice->ases_) {
+    if (ase.data_path_state != types::AudioStreamDataPathState::CIS_ASSIGNED &&
+        ase.data_path_state != types::AudioStreamDataPathState::IDLE) {
+      event.reason = reason;
+      event.cig_id = group->group_id_;
+      event.cis_conn_hdl = ase.cis_conn_hdl;
+      LeAudioGroupStateMachine::Get()->ProcessHciNotifCisDisconnected(
+          group, leAudioDevice, &event);
+    }
+  }
+}
+
 TEST_F(StateMachineTest, testAttachDeviceToTheStream) {
   const auto context_type = kContextTypeMedia;
   const auto leaudio_group_id = 6;
   const auto num_devices = 2;
 
+  ContentControlIdKeeper::GetInstance()->SetCcid(media_context, media_ccid);
+
   // Prepare multiple fake connected devices in a group
   auto* group =
       PrepareSingleTestDeviceGroup(leaudio_group_id, context_type, num_devices);
@@ -2484,6 +3013,7 @@
 
   auto* leAudioDevice = group->GetFirstDevice();
   LeAudioDevice* lastDevice;
+  LeAudioDevice* fistDevice = leAudioDevice;
 
   auto expected_devices_written = 0;
   while (leAudioDevice) {
@@ -2504,21 +3034,23 @@
   ASSERT_EQ(expected_devices_written, num_devices);
 
   EXPECT_CALL(*mock_iso_manager_, CreateCig(_, _)).Times(1);
-  EXPECT_CALL(*mock_iso_manager_, EstablishCis(_)).Times(2);
+  EXPECT_CALL(*mock_iso_manager_, EstablishCis(_)).Times(1);
   EXPECT_CALL(*mock_iso_manager_, SetupIsoDataPath(_, _)).Times(2);
 
   InjectInitialIdleNotification(group);
 
   // Start the configuration and stream Media content
   LeAudioGroupStateMachine::Get()->StartStream(
-      group, static_cast<types::LeAudioContextType>(context_type));
+      group, static_cast<LeAudioContextType>(context_type),
+      types::AudioContexts(context_type));
 
   // Check if group has transitioned to a proper state
   ASSERT_EQ(group->GetState(),
             types::AseState::BTA_LE_AUDIO_ASE_STATE_STREAMING);
+  testing::Mock::VerifyAndClearExpectations(&mock_iso_manager_);
 
   // Inject CIS and ACL disconnection of first device
-  InjectCisDisconnected(group, lastDevice);
+  InjectCisDisconnected(group, lastDevice, HCI_ERR_CONNECTION_TOUT);
   InjectAclDisconnected(group, lastDevice);
 
   // Check if group keeps streaming
@@ -2526,58 +3058,893 @@
             types::AseState::BTA_LE_AUDIO_ASE_STATE_STREAMING);
 
   lastDevice->conn_id_ = 3;
-  group->UpdateActiveContextsMap();
-  auto* stream_conf = &group->stream_conf;
+  group->UpdateAudioContextTypeAvailability();
 
-  /* Second device got reconnect. Try to get it to the stream seamlessly
-   * Code take from client.cc
-   */
-  le_audio::types::AudioLocations sink_group_audio_locations = 0;
-  uint8_t sink_num_of_active_ases = 0;
-
-  for (auto [cis_handle, audio_location] : stream_conf->sink_streams) {
-    sink_group_audio_locations |= audio_location;
-    sink_num_of_active_ases++;
-  }
-
-  le_audio::types::AudioLocations source_group_audio_locations = 0;
-  uint8_t source_num_of_active_ases = 0;
-
-  for (auto [cis_handle, audio_location] : stream_conf->source_streams) {
-    source_group_audio_locations |= audio_location;
-    source_num_of_active_ases++;
-  }
-
-  for (auto& ent : stream_conf->conf->confs) {
-    if (ent.direction == le_audio::types::kLeAudioDirectionSink) {
-      /* Sink*/
-      if (!lastDevice->ConfigureAses(
-              ent, group->GetCurrentContextType(), &sink_num_of_active_ases,
-              sink_group_audio_locations, source_group_audio_locations, true)) {
-        FAIL() << __func__ << " Could not set sink configuration of "
-               << stream_conf->conf->name;
-      }
-    } else {
-      /* Source*/
-      if (!lastDevice->ConfigureAses(
-              ent, group->GetCurrentContextType(), &source_num_of_active_ases,
-              sink_group_audio_locations, source_group_audio_locations, true)) {
-        FAIL() << __func__ << " Could not set source configuration of "
-               << stream_conf->conf->name;
-      }
-    }
-  }
+  // Make sure ASE with disconnected CIS are not left in STREAMING
+  ASSERT_EQ(lastDevice->GetFirstAseWithState(
+                ::le_audio::types::kLeAudioDirectionSink,
+                types::AseState::BTA_LE_AUDIO_ASE_STATE_STREAMING),
+            nullptr);
+  ASSERT_EQ(lastDevice->GetFirstAseWithState(
+                ::le_audio::types::kLeAudioDirectionSource,
+                types::AseState::BTA_LE_AUDIO_ASE_STATE_STREAMING),
+            nullptr);
 
   EXPECT_CALL(gatt_queue, WriteCharacteristic(lastDevice->conn_id_,
                                               lastDevice->ctp_hdls_.val_hdl, _,
                                               GATT_WRITE_NO_RSP, _, _))
       .Times(AtLeast(3));
 
+  EXPECT_CALL(*mock_iso_manager_, EstablishCis(_)).Times(1);
+  EXPECT_CALL(*mock_iso_manager_, SetupIsoDataPath(_, _)).Times(1);
   LeAudioGroupStateMachine::Get()->AttachToStream(group, lastDevice);
 
   // Check if group keeps streaming
   ASSERT_EQ(group->GetState(),
             types::AseState::BTA_LE_AUDIO_ASE_STATE_STREAMING);
+
+  // Verify that the joining device receives the right CCID list
+  auto lastMeta = lastDevice->GetFirstActiveAse()->metadata;
+  bool parsedOk = false;
+  auto ltv = le_audio::types::LeAudioLtvMap::Parse(lastMeta.data(),
+                                                   lastMeta.size(), parsedOk);
+  ASSERT_TRUE(parsedOk);
+
+  auto ccids = ltv.Find(le_audio::types::kLeAudioMetadataTypeCcidList);
+  ASSERT_TRUE(ccids.has_value());
+  ASSERT_NE(std::find(ccids->begin(), ccids->end(), media_ccid), ccids->end());
+
+  /* Verify that ASE of first device are still good*/
+  auto ase = fistDevice->GetFirstActiveAse();
+  ASSERT_NE(ase->max_transport_latency, 0);
+  ASSERT_NE(ase->retrans_nb, 0);
+}
+
+TEST_F(StateMachineTest, testAttachDeviceToTheConversationalStream) {
+  const auto context_type = kContextTypeConversational;
+  const auto leaudio_group_id = 6;
+  const auto num_devices = 2;
+
+  ContentControlIdKeeper::GetInstance()->SetCcid(call_context, call_ccid);
+
+  // Prepare multiple fake connected devices in a group
+  auto* group =
+      PrepareSingleTestDeviceGroup(leaudio_group_id, context_type, num_devices);
+  ASSERT_EQ(group->Size(), num_devices);
+
+  PrepareConfigureCodecHandler(group);
+  PrepareConfigureQosHandler(group);
+  PrepareEnableHandler(group);
+  PrepareReceiverStartReady(group);
+  PrepareDisableHandler(group);
+  PrepareReleaseHandler(group);
+
+  auto* leAudioDevice = group->GetFirstDevice();
+  LeAudioDevice* lastDevice;
+  LeAudioDevice* fistDevice = leAudioDevice;
+
+  auto expected_devices_written = 0;
+  while (leAudioDevice) {
+    /* Three Writes:
+     * 1: Codec Config
+     * 2: Codec QoS
+     * 3: Enabling
+     */
+    lastDevice = leAudioDevice;
+    EXPECT_CALL(gatt_queue,
+                WriteCharacteristic(leAudioDevice->conn_id_,
+                                    leAudioDevice->ctp_hdls_.val_hdl, _,
+                                    GATT_WRITE_NO_RSP, _, _))
+        .Times(AtLeast(3));
+    expected_devices_written++;
+    leAudioDevice = group->GetNextDevice(leAudioDevice);
+  }
+  ASSERT_EQ(expected_devices_written, num_devices);
+
+  EXPECT_CALL(*mock_iso_manager_, CreateCig(_, _)).Times(1);
+  EXPECT_CALL(*mock_iso_manager_, EstablishCis(_)).Times(1);
+  EXPECT_CALL(*mock_iso_manager_, SetupIsoDataPath(_, _)).Times(4);
+
+  InjectInitialIdleNotification(group);
+
+  // Start the configuration and stream Conversational content
+  LeAudioGroupStateMachine::Get()->StartStream(
+      group, static_cast<LeAudioContextType>(context_type),
+      types::AudioContexts(context_type));
+
+  // Check if group has transitioned to a proper state
+  ASSERT_EQ(group->GetState(),
+            types::AseState::BTA_LE_AUDIO_ASE_STATE_STREAMING);
+  testing::Mock::VerifyAndClearExpectations(&mock_iso_manager_);
+
+  // Inject CIS and ACL disconnection of first device
+  InjectCisDisconnected(group, lastDevice, HCI_ERR_CONNECTION_TOUT);
+  InjectAclDisconnected(group, lastDevice);
+
+  // Check if group keeps streaming
+  ASSERT_EQ(group->GetState(),
+            types::AseState::BTA_LE_AUDIO_ASE_STATE_STREAMING);
+
+  lastDevice->conn_id_ = 3;
+  group->UpdateAudioContextTypeAvailability();
+
+  // Make sure ASE with disconnected CIS are not left in STREAMING
+  ASSERT_EQ(lastDevice->GetFirstAseWithState(
+                ::le_audio::types::kLeAudioDirectionSink,
+                types::AseState::BTA_LE_AUDIO_ASE_STATE_STREAMING),
+            nullptr);
+  ASSERT_EQ(lastDevice->GetFirstAseWithState(
+                ::le_audio::types::kLeAudioDirectionSource,
+                types::AseState::BTA_LE_AUDIO_ASE_STATE_STREAMING),
+            nullptr);
+
+  EXPECT_CALL(gatt_queue, WriteCharacteristic(lastDevice->conn_id_,
+                                              lastDevice->ctp_hdls_.val_hdl, _,
+                                              GATT_WRITE_NO_RSP, _, _))
+      .Times(AtLeast(3));
+
+  EXPECT_CALL(*mock_iso_manager_, EstablishCis(_)).Times(1);
+  EXPECT_CALL(*mock_iso_manager_, SetupIsoDataPath(_, _)).Times(2);
+  LeAudioGroupStateMachine::Get()->AttachToStream(group, lastDevice);
+
+  // Check if group keeps streaming
+  ASSERT_EQ(group->GetState(),
+            types::AseState::BTA_LE_AUDIO_ASE_STATE_STREAMING);
+
+  // Verify that the joining device receives the right CCID list
+  auto lastMeta = lastDevice->GetFirstActiveAse()->metadata;
+  bool parsedOk = false;
+  auto ltv = le_audio::types::LeAudioLtvMap::Parse(lastMeta.data(),
+                                                   lastMeta.size(), parsedOk);
+  ASSERT_TRUE(parsedOk);
+
+  auto ccids = ltv.Find(le_audio::types::kLeAudioMetadataTypeCcidList);
+  ASSERT_TRUE(ccids.has_value());
+  ASSERT_NE(std::find(ccids->begin(), ccids->end(), call_ccid), ccids->end());
+
+  /* Verify that ASE of first device are still good*/
+  auto ase = fistDevice->GetFirstActiveAse();
+  ASSERT_NE(ase->max_transport_latency, 0);
+  ASSERT_NE(ase->retrans_nb, 0);
+
+  // Make sure ASEs with reconnected CIS are in STREAMING state
+  ASSERT_TRUE(lastDevice->HaveAllActiveAsesSameState(
+      types::AseState::BTA_LE_AUDIO_ASE_STATE_STREAMING));
+}
+
+TEST_F(StateMachineTest, StartStreamAfterConfigure) {
+  const auto context_type = kContextTypeMedia;
+  const auto leaudio_group_id = 6;
+  const auto num_devices = 2;
+
+  ContentControlIdKeeper::GetInstance()->SetCcid(media_context, media_ccid);
+
+  // Prepare multiple fake connected devices in a group
+  auto* group =
+      PrepareSingleTestDeviceGroup(leaudio_group_id, context_type, num_devices);
+  ASSERT_EQ(group->Size(), num_devices);
+
+  PrepareConfigureCodecHandler(group, 0, true);
+  PrepareConfigureQosHandler(group);
+  PrepareEnableHandler(group);
+  PrepareDisableHandler(group);
+  PrepareReleaseHandler(group);
+
+  InjectInitialIdleNotification(group);
+
+  auto* leAudioDevice = group->GetFirstDevice();
+  auto expected_devices_written = 0;
+  while (leAudioDevice) {
+    /* Three Writes:
+     * 1. Codec configure
+     * 2: Codec QoS
+     * 3: Enabling
+     */
+    EXPECT_CALL(gatt_queue,
+                WriteCharacteristic(leAudioDevice->conn_id_,
+                                    leAudioDevice->ctp_hdls_.val_hdl, _,
+                                    GATT_WRITE_NO_RSP, _, _))
+        .Times(3);
+    expected_devices_written++;
+    leAudioDevice = group->GetNextDevice(leAudioDevice);
+  }
+  ASSERT_EQ(expected_devices_written, num_devices);
+
+  // Validate GroupStreamStatus
+  EXPECT_CALL(mock_callbacks_,
+              StatusReportCb(
+                  leaudio_group_id,
+                  bluetooth::le_audio::GroupStreamStatus::CONFIGURED_BY_USER));
+
+  // Start the configuration and stream Media content
+  group->SetPendingConfiguration();
+  LeAudioGroupStateMachine::Get()->ConfigureStream(
+      group, context_type, types::AudioContexts(context_type));
+
+  testing::Mock::VerifyAndClearExpectations(&mock_callbacks_);
+
+  group->ClearPendingConfiguration();
+  // Validate GroupStreamStatus
+  EXPECT_CALL(
+      mock_callbacks_,
+      StatusReportCb(leaudio_group_id,
+                     bluetooth::le_audio::GroupStreamStatus::STREAMING));
+
+  // Start the configuration and stream Media content
+  LeAudioGroupStateMachine::Get()->StartStream(
+      group, context_type, types::AudioContexts(context_type));
+
+  testing::Mock::VerifyAndClearExpectations(&mock_callbacks_);
+}
+
+TEST_F(StateMachineTest, StartStreamCachedConfig) {
+  const auto context_type = kContextTypeMedia;
+  const auto leaudio_group_id = 6;
+  const auto num_devices = 2;
+
+  ContentControlIdKeeper::GetInstance()->SetCcid(media_context, media_ccid);
+
+  // Prepare multiple fake connected devices in a group
+  auto* group =
+      PrepareSingleTestDeviceGroup(leaudio_group_id, context_type, num_devices);
+  ASSERT_EQ(group->Size(), num_devices);
+
+  PrepareConfigureCodecHandler(group, 0, true);
+  PrepareConfigureQosHandler(group);
+  PrepareEnableHandler(group);
+  PrepareDisableHandler(group);
+  PrepareReleaseHandler(group);
+
+  InjectInitialIdleNotification(group);
+
+  auto* leAudioDevice = group->GetFirstDevice();
+  auto expected_devices_written = 0;
+  while (leAudioDevice) {
+    /* Three Writes:
+     * 1: Codec config
+     * 2: Codec QoS (+1 after restart)
+     * 3: Enabling (+1 after restart)
+     * 4: Release (1)
+     */
+    EXPECT_CALL(gatt_queue,
+                WriteCharacteristic(leAudioDevice->conn_id_,
+                                    leAudioDevice->ctp_hdls_.val_hdl, _,
+                                    GATT_WRITE_NO_RSP, _, _))
+        .Times(6);
+    expected_devices_written++;
+    leAudioDevice = group->GetNextDevice(leAudioDevice);
+  }
+  ASSERT_EQ(expected_devices_written, num_devices);
+
+  // Validate GroupStreamStatus
+  EXPECT_CALL(
+      mock_callbacks_,
+      StatusReportCb(leaudio_group_id,
+                     bluetooth::le_audio::GroupStreamStatus::STREAMING));
+
+  // Start the configuration and stream Media content
+  LeAudioGroupStateMachine::Get()->StartStream(
+      group, context_type, types::AudioContexts(context_type));
+
+  testing::Mock::VerifyAndClearExpectations(&mock_callbacks_);
+
+  ASSERT_EQ(1, mock_function_count_map["alarm_cancel"]);
+  mock_function_count_map["alarm_cancel"] = 0;
+
+  // Validate GroupStreamStatus
+  EXPECT_CALL(
+      mock_callbacks_,
+      StatusReportCb(leaudio_group_id,
+                     bluetooth::le_audio::GroupStreamStatus::RELEASING));
+
+  EXPECT_CALL(
+      mock_callbacks_,
+      StatusReportCb(
+          leaudio_group_id,
+          bluetooth::le_audio::GroupStreamStatus::CONFIGURED_AUTONOMOUS));
+  // Start the configuration and stream Media content
+  LeAudioGroupStateMachine::Get()->StopStream(group);
+
+  testing::Mock::VerifyAndClearExpectations(&mock_callbacks_);
+
+  ASSERT_EQ(1, mock_function_count_map["alarm_cancel"]);
+  mock_function_count_map["alarm_cancel"] = 0;
+
+  // Restart stream
+  EXPECT_CALL(
+      mock_callbacks_,
+      StatusReportCb(leaudio_group_id,
+                     bluetooth::le_audio::GroupStreamStatus::STREAMING));
+
+  // Start the configuration and stream Media content
+  LeAudioGroupStateMachine::Get()->StartStream(
+      group, context_type, types::AudioContexts(context_type));
+
+  testing::Mock::VerifyAndClearExpectations(&mock_callbacks_);
+  ASSERT_EQ(1, mock_function_count_map["alarm_cancel"]);
+}
+
+TEST_F(StateMachineTest, BoundedHeadphonesConversationalToMediaChannelCount_2) {
+  const auto initial_context_type = kContextTypeConversational;
+  const auto new_context_type = kContextTypeMedia;
+  const auto leaudio_group_id = 6;
+  const auto num_devices = 1;
+  channel_count_ = kLeAudioCodecLC3ChannelCountSingleChannel |
+                   kLeAudioCodecLC3ChannelCountTwoChannel;
+
+  sample_freq_ |= codec_specific::kCapSamplingFrequency48000Hz |
+                  codec_specific::kCapSamplingFrequency32000Hz;
+  additional_snk_ases = 3;
+  additional_src_ases = 1;
+
+  ContentControlIdKeeper::GetInstance()->SetCcid(media_context, media_ccid);
+  ContentControlIdKeeper::GetInstance()->SetCcid(call_context, call_ccid);
+
+  // Prepare multiple fake connected devices in a group
+  auto* group = PrepareSingleTestDeviceGroup(
+      leaudio_group_id, initial_context_type, num_devices,
+      kContextTypeConversational | kContextTypeMedia);
+  ASSERT_EQ(group->Size(), num_devices);
+
+  PrepareConfigureCodecHandler(group, 0, true);
+  PrepareConfigureQosHandler(group);
+  PrepareEnableHandler(group);
+  PrepareDisableHandler(group);
+  PrepareReleaseHandler(group);
+  PrepareReceiverStartReady(group);
+
+  InjectInitialIdleNotification(group);
+
+  auto* leAudioDevice = group->GetFirstDevice();
+  auto expected_devices_written = 0;
+  while (leAudioDevice) {
+    /* 8 Writes:
+     * 1: Codec config (+1 after reconfig)
+     * 2: Codec QoS (+1 after reconfig)
+     * 3: Enabling (+1 after reconfig)
+     * 4: ReceiverStartReady (only for conversational)
+     * 5: Release
+     */
+    EXPECT_CALL(gatt_queue,
+                WriteCharacteristic(leAudioDevice->conn_id_,
+                                    leAudioDevice->ctp_hdls_.val_hdl, _,
+                                    GATT_WRITE_NO_RSP, _, _))
+        .Times(8);
+    expected_devices_written++;
+    leAudioDevice = group->GetNextDevice(leAudioDevice);
+  }
+  ASSERT_EQ(expected_devices_written, num_devices);
+
+  // Validate GroupStreamStatus
+  EXPECT_CALL(
+      mock_callbacks_,
+      StatusReportCb(leaudio_group_id,
+                     bluetooth::le_audio::GroupStreamStatus::STREAMING));
+
+  // Start the configuration and stream Media content
+  LeAudioGroupStateMachine::Get()->StartStream(
+      group, initial_context_type, types::AudioContexts(initial_context_type));
+
+  testing::Mock::VerifyAndClearExpectations(&mock_callbacks_);
+
+  // Validate GroupStreamStatus
+  EXPECT_CALL(
+      mock_callbacks_,
+      StatusReportCb(leaudio_group_id,
+                     bluetooth::le_audio::GroupStreamStatus::RELEASING));
+
+  EXPECT_CALL(
+      mock_callbacks_,
+      StatusReportCb(
+          leaudio_group_id,
+          bluetooth::le_audio::GroupStreamStatus::CONFIGURED_AUTONOMOUS));
+  // Start the configuration and stream Media content
+  LeAudioGroupStateMachine::Get()->StopStream(group);
+
+  testing::Mock::VerifyAndClearExpectations(&mock_callbacks_);
+
+  // Restart stream
+  EXPECT_CALL(
+      mock_callbacks_,
+      StatusReportCb(leaudio_group_id,
+                     bluetooth::le_audio::GroupStreamStatus::STREAMING));
+
+  // Start the configuration and stream Media content
+  LeAudioGroupStateMachine::Get()->StartStream(
+      group, new_context_type, types::AudioContexts(new_context_type));
+
+  testing::Mock::VerifyAndClearExpectations(&mock_callbacks_);
+}
+
+TEST_F(StateMachineTest, BoundedHeadphonesConversationalToMediaChannelCount_1) {
+  const auto initial_context_type = kContextTypeConversational;
+  const auto new_context_type = kContextTypeMedia;
+  const auto leaudio_group_id = 6;
+  const auto num_devices = 1;
+  channel_count_ = kLeAudioCodecLC3ChannelCountSingleChannel;
+
+  sample_freq_ |= codec_specific::kCapSamplingFrequency48000Hz |
+                  codec_specific::kCapSamplingFrequency32000Hz;
+  additional_snk_ases = 3;
+  additional_src_ases = 1;
+
+  ContentControlIdKeeper::GetInstance()->SetCcid(media_context, media_ccid);
+  ContentControlIdKeeper::GetInstance()->SetCcid(call_context, call_ccid);
+
+  // Prepare one fake connected devices in a group
+  auto* group = PrepareSingleTestDeviceGroup(
+      leaudio_group_id, initial_context_type, num_devices,
+      kContextTypeConversational | kContextTypeMedia);
+  ASSERT_EQ(group->Size(), num_devices);
+
+  // Cannot verify here as we will change the number of ases on reconfigure
+  PrepareConfigureCodecHandler(group, 0, true);
+  PrepareConfigureQosHandler(group);
+  PrepareEnableHandler(group);
+  PrepareDisableHandler(group);
+  PrepareReleaseHandler(group);
+  PrepareReceiverStartReady(group);
+
+  InjectInitialIdleNotification(group);
+
+  auto* leAudioDevice = group->GetFirstDevice();
+  auto expected_devices_written = 0;
+  while (leAudioDevice) {
+    /* 8 Writes:
+     * 1: Codec config (+1 after reconfig)
+     * 2: Codec QoS (+1 after reconfig)
+     * 3: Enabling (+1 after reconfig)
+     * 4: ReceiverStartReady (only for conversational)
+     * 5: Release
+     */
+    EXPECT_CALL(gatt_queue,
+                WriteCharacteristic(leAudioDevice->conn_id_,
+                                    leAudioDevice->ctp_hdls_.val_hdl, _,
+                                    GATT_WRITE_NO_RSP, _, _))
+        .Times(8);
+    expected_devices_written++;
+    leAudioDevice = group->GetNextDevice(leAudioDevice);
+  }
+  ASSERT_EQ(expected_devices_written, num_devices);
+
+  // Validate GroupStreamStatus
+  EXPECT_CALL(
+      mock_callbacks_,
+      StatusReportCb(leaudio_group_id,
+                     bluetooth::le_audio::GroupStreamStatus::STREAMING));
+
+  // Start the configuration and stream Media content
+  LeAudioGroupStateMachine::Get()->StartStream(
+      group, initial_context_type, types::AudioContexts(initial_context_type));
+
+  testing::Mock::VerifyAndClearExpectations(&mock_callbacks_);
+
+  ASSERT_EQ(1, mock_function_count_map["alarm_cancel"]);
+  mock_function_count_map["alarm_cancel"] = 0;
+
+  // Validate GroupStreamStatus
+  EXPECT_CALL(
+      mock_callbacks_,
+      StatusReportCb(leaudio_group_id,
+                     bluetooth::le_audio::GroupStreamStatus::RELEASING));
+
+  EXPECT_CALL(
+      mock_callbacks_,
+      StatusReportCb(
+          leaudio_group_id,
+          bluetooth::le_audio::GroupStreamStatus::CONFIGURED_AUTONOMOUS));
+  // Start the configuration and stream Media content
+  LeAudioGroupStateMachine::Get()->StopStream(group);
+
+  testing::Mock::VerifyAndClearExpectations(&mock_callbacks_);
+  ASSERT_EQ(1, mock_function_count_map["alarm_cancel"]);
+  mock_function_count_map["alarm_cancel"] = 0;
+
+  // Restart stream
+  EXPECT_CALL(
+      mock_callbacks_,
+      StatusReportCb(leaudio_group_id,
+                     bluetooth::le_audio::GroupStreamStatus::STREAMING));
+
+  // Start the configuration and stream Media content
+  LeAudioGroupStateMachine::Get()->StartStream(
+      group, new_context_type, types::AudioContexts(new_context_type));
+
+  testing::Mock::VerifyAndClearExpectations(&mock_callbacks_);
+  ASSERT_EQ(1, mock_function_count_map["alarm_cancel"]);
+}
+
+TEST_F(StateMachineTest, lateCisDisconnectedEvent_ConfiguredByUser) {
+  const auto context_type = kContextTypeMedia;
+  const auto leaudio_group_id = 6;
+  const auto num_devices = 1;
+
+  ContentControlIdKeeper::GetInstance()->SetCcid(media_context, media_ccid);
+
+  // Prepare multiple fake connected devices in a group
+  auto* group =
+      PrepareSingleTestDeviceGroup(leaudio_group_id, context_type, num_devices);
+  ASSERT_EQ(group->Size(), num_devices);
+
+  PrepareConfigureCodecHandler(group, 0, true);
+  PrepareConfigureQosHandler(group);
+  PrepareEnableHandler(group);
+  PrepareDisableHandler(group);
+  PrepareReleaseHandler(group);
+
+  auto* leAudioDevice = group->GetFirstDevice();
+  auto expected_devices_written = 0;
+
+  /* Three Writes:
+   * 1: Codec Config
+   * 2: Codec QoS
+   * 3: Enabling
+   */
+  EXPECT_CALL(gatt_queue, WriteCharacteristic(leAudioDevice->conn_id_,
+                                              leAudioDevice->ctp_hdls_.val_hdl,
+                                              _, GATT_WRITE_NO_RSP, _, _))
+      .Times(AtLeast(3));
+  expected_devices_written++;
+
+  ASSERT_EQ(expected_devices_written, num_devices);
+
+  EXPECT_CALL(*mock_iso_manager_, CreateCig(_, _)).Times(1);
+  EXPECT_CALL(*mock_iso_manager_, EstablishCis(_)).Times(1);
+  EXPECT_CALL(*mock_iso_manager_, SetupIsoDataPath(_, _)).Times(2);
+
+  InjectInitialIdleNotification(group);
+
+  // Start the configuration and stream Media content
+  LeAudioGroupStateMachine::Get()->StartStream(
+      group, static_cast<LeAudioContextType>(context_type),
+      types::AudioContexts(context_type));
+
+  // Check if group has transitioned to a proper state
+  ASSERT_EQ(group->GetState(),
+            types::AseState::BTA_LE_AUDIO_ASE_STATE_STREAMING);
+  testing::Mock::VerifyAndClearExpectations(&mock_iso_manager_);
+
+  ASSERT_EQ(1, mock_function_count_map["alarm_cancel"]);
+  mock_function_count_map["alarm_cancel"] = 0;
+
+  /* Prepare DisconnectCis mock to not symulate CisDisconnection */
+  ON_CALL(*mock_iso_manager_, DisconnectCis).WillByDefault(Return());
+
+  /* Do reconfiguration */
+  group->SetPendingConfiguration();
+
+  // Validate GroupStreamStatus
+  EXPECT_CALL(
+      mock_callbacks_,
+      StatusReportCb(leaudio_group_id,
+                     bluetooth::le_audio::GroupStreamStatus::RELEASING));
+
+  EXPECT_CALL(mock_callbacks_,
+              StatusReportCb(
+                  leaudio_group_id,
+                  bluetooth::le_audio::GroupStreamStatus::CONFIGURED_BY_USER))
+      .Times(0);
+  LeAudioGroupStateMachine::Get()->StopStream(group);
+
+  testing::Mock::VerifyAndClearExpectations(&mock_callbacks_);
+
+  ASSERT_EQ(0, mock_function_count_map["alarm_cancel"]);
+
+  EXPECT_CALL(mock_callbacks_,
+              StatusReportCb(
+                  leaudio_group_id,
+                  bluetooth::le_audio::GroupStreamStatus::CONFIGURED_BY_USER));
+
+  // Inject CIS and ACL disconnection of first device
+  InjectCisDisconnected(group, leAudioDevice, HCI_ERR_CONN_CAUSE_LOCAL_HOST);
+  testing::Mock::VerifyAndClearExpectations(&mock_callbacks_);
+  ASSERT_EQ(1, mock_function_count_map["alarm_cancel"]);
+}
+
+TEST_F(StateMachineTest, lateCisDisconnectedEvent_AutonomousConfigured) {
+  const auto context_type = kContextTypeMedia;
+  const auto leaudio_group_id = 6;
+  const auto num_devices = 1;
+
+  ContentControlIdKeeper::GetInstance()->SetCcid(media_context, media_ccid);
+
+  // Prepare multiple fake connected devices in a group
+  auto* group =
+      PrepareSingleTestDeviceGroup(leaudio_group_id, context_type, num_devices);
+  ASSERT_EQ(group->Size(), num_devices);
+
+  PrepareConfigureCodecHandler(group, 0, true);
+  PrepareConfigureQosHandler(group);
+  PrepareEnableHandler(group);
+  PrepareDisableHandler(group);
+  PrepareReleaseHandler(group);
+
+  auto* leAudioDevice = group->GetFirstDevice();
+  auto expected_devices_written = 0;
+
+  /* Three Writes:
+   * 1: Codec Config
+   * 2: Codec QoS
+   * 3: Enabling
+   */
+  EXPECT_CALL(gatt_queue, WriteCharacteristic(leAudioDevice->conn_id_,
+                                              leAudioDevice->ctp_hdls_.val_hdl,
+                                              _, GATT_WRITE_NO_RSP, _, _))
+      .Times(AtLeast(3));
+  expected_devices_written++;
+
+  ASSERT_EQ(expected_devices_written, num_devices);
+
+  EXPECT_CALL(*mock_iso_manager_, CreateCig(_, _)).Times(1);
+  EXPECT_CALL(*mock_iso_manager_, EstablishCis(_)).Times(1);
+  EXPECT_CALL(*mock_iso_manager_, SetupIsoDataPath(_, _)).Times(2);
+
+  InjectInitialIdleNotification(group);
+
+  // Start the configuration and stream Media content
+  LeAudioGroupStateMachine::Get()->StartStream(
+      group, static_cast<LeAudioContextType>(context_type),
+      types::AudioContexts(context_type));
+
+  // Check if group has transitioned to a proper state
+  ASSERT_EQ(group->GetState(),
+            types::AseState::BTA_LE_AUDIO_ASE_STATE_STREAMING);
+  testing::Mock::VerifyAndClearExpectations(&mock_iso_manager_);
+
+  ASSERT_EQ(1, mock_function_count_map["alarm_cancel"]);
+  mock_function_count_map["alarm_cancel"] = 0;
+
+  /* Prepare DisconnectCis mock to not symulate CisDisconnection */
+  ON_CALL(*mock_iso_manager_, DisconnectCis).WillByDefault(Return());
+
+  // Validate GroupStreamStatus
+  EXPECT_CALL(
+      mock_callbacks_,
+      StatusReportCb(leaudio_group_id,
+                     bluetooth::le_audio::GroupStreamStatus::RELEASING));
+
+  EXPECT_CALL(
+      mock_callbacks_,
+      StatusReportCb(
+          leaudio_group_id,
+          bluetooth::le_audio::GroupStreamStatus::CONFIGURED_AUTONOMOUS))
+      .Times(0);
+
+  // Stop the stream
+  LeAudioGroupStateMachine::Get()->StopStream(group);
+
+  // Check if group has transitioned to a proper state
+  ASSERT_EQ(group->GetState(),
+            types::AseState::BTA_LE_AUDIO_ASE_STATE_CODEC_CONFIGURED);
+
+  testing::Mock::VerifyAndClearExpectations(&mock_callbacks_);
+
+  ASSERT_EQ(0, mock_function_count_map["alarm_cancel"]);
+
+  EXPECT_CALL(
+      mock_callbacks_,
+      StatusReportCb(
+          leaudio_group_id,
+          bluetooth::le_audio::GroupStreamStatus::CONFIGURED_AUTONOMOUS));
+
+  // Inject CIS and ACL disconnection of first device
+  InjectCisDisconnected(group, leAudioDevice, HCI_ERR_CONN_CAUSE_LOCAL_HOST);
+  testing::Mock::VerifyAndClearExpectations(&mock_callbacks_);
+  ASSERT_EQ(1, mock_function_count_map["alarm_cancel"]);
+}
+
+TEST_F(StateMachineTest, lateCisDisconnectedEvent_Idle) {
+  const auto context_type = kContextTypeMedia;
+  const auto leaudio_group_id = 6;
+  const auto num_devices = 1;
+
+  ContentControlIdKeeper::GetInstance()->SetCcid(media_context, media_ccid);
+
+  // Prepare multiple fake connected devices in a group
+  auto* group =
+      PrepareSingleTestDeviceGroup(leaudio_group_id, context_type, num_devices);
+  ASSERT_EQ(group->Size(), num_devices);
+
+  PrepareConfigureCodecHandler(group);
+  PrepareConfigureQosHandler(group);
+  PrepareEnableHandler(group);
+  PrepareDisableHandler(group);
+  PrepareReleaseHandler(group);
+
+  auto* leAudioDevice = group->GetFirstDevice();
+  auto expected_devices_written = 0;
+
+  /* Three Writes:
+   * 1: Codec Config
+   * 2: Codec QoS
+   * 3: Enabling
+   */
+  EXPECT_CALL(gatt_queue, WriteCharacteristic(leAudioDevice->conn_id_,
+                                              leAudioDevice->ctp_hdls_.val_hdl,
+                                              _, GATT_WRITE_NO_RSP, _, _))
+      .Times(AtLeast(3));
+  expected_devices_written++;
+
+  ASSERT_EQ(expected_devices_written, num_devices);
+
+  EXPECT_CALL(*mock_iso_manager_, CreateCig(_, _)).Times(1);
+  EXPECT_CALL(*mock_iso_manager_, EstablishCis(_)).Times(1);
+  EXPECT_CALL(*mock_iso_manager_, SetupIsoDataPath(_, _)).Times(2);
+
+  InjectInitialIdleNotification(group);
+
+  // Start the configuration and stream Media content
+  LeAudioGroupStateMachine::Get()->StartStream(
+      group, static_cast<LeAudioContextType>(context_type),
+      types::AudioContexts(context_type));
+
+  // Check if group has transitioned to a proper state
+  ASSERT_EQ(group->GetState(),
+            types::AseState::BTA_LE_AUDIO_ASE_STATE_STREAMING);
+  testing::Mock::VerifyAndClearExpectations(&mock_iso_manager_);
+
+  ASSERT_EQ(1, mock_function_count_map["alarm_cancel"]);
+  mock_function_count_map["alarm_cancel"] = 0;
+  /* Prepare DisconnectCis mock to not symulate CisDisconnection */
+  ON_CALL(*mock_iso_manager_, DisconnectCis).WillByDefault(Return());
+
+  // Validate GroupStreamStatus
+  EXPECT_CALL(
+      mock_callbacks_,
+      StatusReportCb(leaudio_group_id,
+                     bluetooth::le_audio::GroupStreamStatus::RELEASING));
+
+  EXPECT_CALL(mock_callbacks_,
+              StatusReportCb(leaudio_group_id,
+                             bluetooth::le_audio::GroupStreamStatus::IDLE))
+      .Times(0);
+
+  // Stop the stream
+  LeAudioGroupStateMachine::Get()->StopStream(group);
+
+  // Check if group has transitioned to a proper state
+  ASSERT_EQ(group->GetState(), types::AseState::BTA_LE_AUDIO_ASE_STATE_IDLE);
+  ASSERT_EQ(0, mock_function_count_map["alarm_cancel"]);
+
+  testing::Mock::VerifyAndClearExpectations(&mock_callbacks_);
+
+  EXPECT_CALL(mock_callbacks_,
+              StatusReportCb(leaudio_group_id,
+                             bluetooth::le_audio::GroupStreamStatus::IDLE));
+
+  // Inject CIS and ACL disconnection of first device
+  InjectCisDisconnected(group, leAudioDevice, HCI_ERR_CONN_CAUSE_LOCAL_HOST);
+  testing::Mock::VerifyAndClearExpectations(&mock_callbacks_);
+  ASSERT_EQ(1, mock_function_count_map["alarm_cancel"]);
+}
+
+TEST_F(StateMachineTest, StreamReconfigureAfterCisLostTwoDevices) {
+  auto context_type = kContextTypeConversational;
+  const auto leaudio_group_id = 4;
+  const auto num_devices = 2;
+
+  // Prepare multiple fake connected devices in a group
+  auto* group = PrepareSingleTestDeviceGroup(
+      leaudio_group_id, context_type, num_devices,
+      kContextTypeConversational | kContextTypeMedia);
+  ASSERT_EQ(group->Size(), num_devices);
+
+  PrepareConfigureCodecHandler(group);
+  PrepareConfigureQosHandler(group);
+  PrepareEnableHandler(group);
+  PrepareReceiverStartReady(group);
+
+  /* Prepare DisconnectCis mock to not symulate CisDisconnection */
+  ON_CALL(*mock_iso_manager_, DisconnectCis).WillByDefault(Return());
+
+  EXPECT_CALL(*mock_iso_manager_, CreateCig(_, _)).Times(2);
+  EXPECT_CALL(*mock_iso_manager_, EstablishCis(_)).Times(2);
+  EXPECT_CALL(*mock_iso_manager_, SetupIsoDataPath(_, _)).Times(6);
+  EXPECT_CALL(*mock_iso_manager_, RemoveIsoDataPath(_, _)).Times(0);
+  EXPECT_CALL(*mock_iso_manager_, DisconnectCis(_, _)).Times(0);
+  EXPECT_CALL(*mock_iso_manager_, RemoveCig(_, _)).Times(1);
+
+  InjectInitialIdleNotification(group);
+
+  auto* leAudioDevice = group->GetFirstDevice();
+  auto expected_devices_written = 0;
+  while (leAudioDevice) {
+    EXPECT_CALL(gatt_queue,
+                WriteCharacteristic(leAudioDevice->conn_id_,
+                                    leAudioDevice->ctp_hdls_.val_hdl, _,
+                                    GATT_WRITE_NO_RSP, _, _))
+        .Times(3);
+    expected_devices_written++;
+    leAudioDevice = group->GetNextDevice(leAudioDevice);
+  }
+  ASSERT_EQ(expected_devices_written, num_devices);
+
+  // Validate GroupStreamStatus
+  EXPECT_CALL(
+      mock_callbacks_,
+      StatusReportCb(leaudio_group_id,
+                     bluetooth::le_audio::GroupStreamStatus::STREAMING));
+
+  // Start the configuration and stream Media content
+  context_type = kContextTypeMedia;
+  ASSERT_TRUE(LeAudioGroupStateMachine::Get()->StartStream(
+      group, static_cast<LeAudioContextType>(context_type),
+      types::AudioContexts(context_type)));
+
+  // Check if group has transitioned to a proper state
+  ASSERT_EQ(group->GetState(),
+            types::AseState::BTA_LE_AUDIO_ASE_STATE_STREAMING);
+  ASSERT_EQ(1, mock_function_count_map["alarm_cancel"]);
+  testing::Mock::VerifyAndClearExpectations(&mock_iso_manager_);
+  testing::Mock::VerifyAndClearExpectations(&gatt_queue);
+  testing::Mock::VerifyAndClearExpectations(&mock_callbacks_);
+
+  // Device disconnects due to timeout of CIS
+  leAudioDevice = group->GetFirstDevice();
+  while (leAudioDevice) {
+    InjectCisDisconnected(group, leAudioDevice, HCI_ERR_CONN_CAUSE_LOCAL_HOST);
+    // Disconnect device
+    LeAudioGroupStateMachine::Get()->ProcessHciNotifAclDisconnected(
+        group, leAudioDevice);
+
+    leAudioDevice = group->GetNextDevice(leAudioDevice);
+  }
+
+  LOG(INFO) << "GK A1";
+  group->ReloadAudioLocations();
+  group->ReloadAudioDirections();
+  group->UpdateAudioContextTypeAvailability();
+
+  // Start conversational scenario
+  leAudioDevice = group->GetFirstDevice();
+  int device_cnt = num_devices;
+  while (leAudioDevice) {
+    LOG(INFO) << "GK A11";
+    leAudioDevice->conn_id_ = device_cnt--;
+    leAudioDevice->SetConnectionState(DeviceConnectState::CONNECTED);
+    leAudioDevice = group->GetNextDevice(leAudioDevice);
+  }
+
+  LOG(INFO) << "GK A2";
+  InjectInitialIdleNotification(group);
+
+  group->ReloadAudioLocations();
+  group->ReloadAudioDirections();
+  group->UpdateAudioContextTypeAvailability(kContextTypeConversational |
+                                            kContextTypeMedia);
+
+  leAudioDevice = group->GetFirstDevice();
+  expected_devices_written = 0;
+  while (leAudioDevice) {
+    EXPECT_CALL(gatt_queue,
+                WriteCharacteristic(leAudioDevice->conn_id_,
+                                    leAudioDevice->ctp_hdls_.val_hdl, _,
+                                    GATT_WRITE_NO_RSP, _, _))
+        .Times(4);
+    expected_devices_written++;
+    leAudioDevice = group->GetNextDevice(leAudioDevice);
+  }
+  ASSERT_EQ(expected_devices_written, num_devices);
+
+  // Validate GroupStreamStatus
+  EXPECT_CALL(
+      mock_callbacks_,
+      StatusReportCb(leaudio_group_id,
+                     bluetooth::le_audio::GroupStreamStatus::STREAMING));
+
+  // Start the configuration and stream Conversational content
+  context_type = kContextTypeConversational;
+  ASSERT_TRUE(LeAudioGroupStateMachine::Get()->StartStream(
+      group, static_cast<LeAudioContextType>(context_type),
+      types::AudioContexts(context_type)));
+
+  // Check if group has transitioned to a proper state
+  ASSERT_EQ(group->GetState(),
+            types::AseState::BTA_LE_AUDIO_ASE_STATE_STREAMING);
+  ASSERT_EQ(2, mock_function_count_map["alarm_cancel"]);
+  testing::Mock::VerifyAndClearExpectations(&mock_iso_manager_);
+  testing::Mock::VerifyAndClearExpectations(&gatt_queue);
+  testing::Mock::VerifyAndClearExpectations(&mock_callbacks_);
 }
 
 }  // namespace internal
diff --git a/system/bta/le_audio/storage_helper.cc b/system/bta/le_audio/storage_helper.cc
new file mode 100644
index 0000000..ca64f31
--- /dev/null
+++ b/system/bta/le_audio/storage_helper.cc
@@ -0,0 +1,467 @@
+/******************************************************************************
+ *
+ *  Copyright 2022 The Android Open Source Project
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at:
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ ******************************************************************************/
+
+#include "storage_helper.h"
+
+#include "client_parser.h"
+#include "gd/common/strings.h"
+#include "le_audio_types.h"
+#include "osi/include/log.h"
+
+using le_audio::types::hdl_pair;
+
+namespace le_audio {
+static constexpr uint8_t LEAUDIO_PACS_STORAGE_CURRENT_LAYOUT_MAGIC = 0x00;
+static constexpr uint8_t LEAUDIO_ASE_STORAGE_CURRENT_LAYOUT_MAGIC = 0x00;
+static constexpr uint8_t LEAUDIO_HANDLES_STORAGE_CURRENT_LAYOUT_MAGIC = 0x00;
+static constexpr uint8_t LEAUDIO_CODEC_ID_SZ = 5;
+
+static constexpr size_t LEAUDIO_STORAGE_MAGIC_SZ =
+    sizeof(uint8_t) /* magic is always uint8_t */;
+
+static constexpr size_t LEAUDIO_STORAGE_HEADER_WITH_ENTRIES_SZ =
+    LEAUDIO_STORAGE_MAGIC_SZ + sizeof(uint8_t); /* num_of_entries */
+
+static constexpr size_t LEAUDIO_PACS_ENTRY_HDR_SZ =
+    sizeof(uint16_t) /*handle*/ + sizeof(uint16_t) /*ccc handle*/ +
+    sizeof(uint8_t) /* number of pack records in single characteristic */;
+
+static constexpr size_t LEAUDIO_PACS_ENTRY_SZ =
+    sizeof(uint8_t) /* size of single pac record */ +
+    LEAUDIO_CODEC_ID_SZ /*codec id*/ +
+    sizeof(uint8_t) /*codec capabilities len*/ +
+    sizeof(uint8_t) /*metadata len*/;
+
+static constexpr size_t LEAUDIO_ASES_ENTRY_SZ =
+    sizeof(uint16_t) /*handle*/ + sizeof(uint16_t) /*ccc handle*/ +
+    sizeof(uint8_t) /*direction*/ + sizeof(uint8_t) /*ase id*/;
+
+static constexpr size_t LEAUDIO_STORAGE_HANDLES_ENTRIES_SZ =
+    LEAUDIO_STORAGE_MAGIC_SZ + sizeof(uint16_t) /*control point handle*/ +
+    sizeof(uint16_t) /*ccc handle*/ +
+    sizeof(uint16_t) /*sink audio location handle*/ +
+    sizeof(uint16_t) /*ccc handle*/ +
+    sizeof(uint16_t) /*source audio location handle*/ +
+    sizeof(uint16_t) /*ccc handle*/ +
+    sizeof(uint16_t) /*supported context type handle*/ +
+    sizeof(uint16_t) /*ccc handle*/ +
+    sizeof(uint16_t) /*available context type handle*/ +
+    sizeof(uint16_t) /*ccc handle*/ + sizeof(uint16_t) /* tmas handle */;
+
+bool serializePacs(const le_audio::types::PublishedAudioCapabilities& pacs,
+                   std::vector<uint8_t>& out) {
+  auto num_of_pacs = pacs.size();
+  if (num_of_pacs == 0 || (num_of_pacs > std::numeric_limits<uint8_t>::max())) {
+    LOG_WARN("No pacs available");
+    return false;
+  }
+
+  /* Calculate the total size */
+  auto pac_bin_size = LEAUDIO_STORAGE_HEADER_WITH_ENTRIES_SZ;
+  for (auto pac_tuple : pacs) {
+    auto& pac_recs = std::get<1>(pac_tuple);
+    pac_bin_size += LEAUDIO_PACS_ENTRY_HDR_SZ;
+    for (const auto& pac : pac_recs) {
+      pac_bin_size += LEAUDIO_PACS_ENTRY_SZ;
+      pac_bin_size += pac.metadata.size();
+      pac_bin_size += pac.codec_spec_caps.RawPacketSize();
+    }
+  }
+
+  out.resize(pac_bin_size);
+  auto* ptr = out.data();
+
+  /* header */
+  UINT8_TO_STREAM(ptr, LEAUDIO_PACS_STORAGE_CURRENT_LAYOUT_MAGIC);
+  UINT8_TO_STREAM(ptr, num_of_pacs);
+
+  /* pacs entries */
+  for (auto pac_tuple : pacs) {
+    auto& pac_recs = std::get<1>(pac_tuple);
+    uint16_t handle = std::get<0>(pac_tuple).val_hdl;
+    uint16_t ccc_handle = std::get<0>(pac_tuple).ccc_hdl;
+
+    UINT16_TO_STREAM(ptr, handle);
+    UINT16_TO_STREAM(ptr, ccc_handle);
+    UINT8_TO_STREAM(ptr, pac_recs.size());
+
+    LOG_VERBOSE(" Handle: 0x%04x, ccc handle: 0x%04x, pac count: %d", handle,
+                ccc_handle, static_cast<int>(pac_recs.size()));
+
+    for (const auto& pac : pac_recs) {
+      /* Pac len */
+      auto pac_len = LEAUDIO_PACS_ENTRY_SZ +
+                     pac.codec_spec_caps.RawPacketSize() + pac.metadata.size();
+      LOG_VERBOSE("Pac size %d", static_cast<int>(pac_len));
+      UINT8_TO_STREAM(ptr, pac_len - 1 /* Minus size */);
+
+      /* Codec ID*/
+      UINT8_TO_STREAM(ptr, pac.codec_id.coding_format);
+      UINT16_TO_STREAM(ptr, pac.codec_id.vendor_company_id);
+      UINT16_TO_STREAM(ptr, pac.codec_id.vendor_codec_id);
+
+      /* Codec caps */
+      LOG_VERBOSE("Codec capability size %d",
+                  static_cast<int>(pac.codec_spec_caps.RawPacketSize()));
+      UINT8_TO_STREAM(ptr, pac.codec_spec_caps.RawPacketSize());
+      if (pac.codec_spec_caps.RawPacketSize() > 0) {
+        ptr = pac.codec_spec_caps.RawPacket(ptr);
+      }
+
+      /* Metadata */
+      LOG_VERBOSE("Metadata size %d", static_cast<int>(pac.metadata.size()));
+      UINT8_TO_STREAM(ptr, pac.metadata.size());
+      if (pac.metadata.size() > 0) {
+        ARRAY_TO_STREAM(ptr, pac.metadata.data(), (int)pac.metadata.size());
+      }
+    }
+  }
+  return true;
+}
+
+bool SerializeSinkPacs(const le_audio::LeAudioDevice* leAudioDevice,
+                       std::vector<uint8_t>& out) {
+  if (leAudioDevice == nullptr) {
+    LOG_WARN(" Skipping unknown device");
+    return false;
+  }
+  LOG_VERBOSE("Device %s, num of PAC characteristics: %d",
+              leAudioDevice->address_.ToString().c_str(),
+              static_cast<int>(leAudioDevice->snk_pacs_.size()));
+  return serializePacs(leAudioDevice->snk_pacs_, out);
+}
+
+bool SerializeSourcePacs(const le_audio::LeAudioDevice* leAudioDevice,
+                         std::vector<uint8_t>& out) {
+  if (leAudioDevice == nullptr) {
+    LOG_WARN(" Skipping unknown device");
+    return false;
+  }
+  LOG_VERBOSE("Device %s, num of PAC characteristics: %d",
+              leAudioDevice->address_.ToString().c_str(),
+              static_cast<int>(leAudioDevice->src_pacs_.size()));
+  return serializePacs(leAudioDevice->src_pacs_, out);
+}
+
+bool deserializePacs(LeAudioDevice* leAudioDevice,
+                     types::PublishedAudioCapabilities& pacs_db,
+                     const std::vector<uint8_t>& in) {
+  if (in.size() <
+      LEAUDIO_STORAGE_HEADER_WITH_ENTRIES_SZ + LEAUDIO_PACS_ENTRY_SZ) {
+    LOG_WARN("There is not single PACS stored");
+    return false;
+  }
+
+  auto* ptr = in.data();
+
+  uint8_t magic;
+  STREAM_TO_UINT8(magic, ptr);
+
+  if (magic != LEAUDIO_PACS_STORAGE_CURRENT_LAYOUT_MAGIC) {
+    LOG_ERROR("Invalid magic (%d!=%d) for device %s", magic,
+              LEAUDIO_PACS_STORAGE_CURRENT_LAYOUT_MAGIC,
+              leAudioDevice->address_.ToString().c_str());
+    return false;
+  }
+
+  uint8_t num_of_pacs_chars;
+  STREAM_TO_UINT8(num_of_pacs_chars, ptr);
+
+  if (in.size() < LEAUDIO_STORAGE_HEADER_WITH_ENTRIES_SZ +
+                      (num_of_pacs_chars * LEAUDIO_PACS_ENTRY_SZ)) {
+    LOG_ERROR("Invalid persistent storage data for device %s",
+              leAudioDevice->address_.ToString().c_str());
+    return false;
+  }
+
+  /* pacs entries */
+  while (num_of_pacs_chars--) {
+    struct hdl_pair hdl_pair;
+    uint8_t pac_count;
+
+    STREAM_TO_UINT16(hdl_pair.val_hdl, ptr);
+    STREAM_TO_UINT16(hdl_pair.ccc_hdl, ptr);
+    STREAM_TO_UINT8(pac_count, ptr);
+
+    LOG_VERBOSE(" Handle: 0x%04x, ccc handle: 0x%04x, pac_count: %d",
+                hdl_pair.val_hdl, hdl_pair.ccc_hdl, pac_count);
+
+    pacs_db.push_back(std::make_tuple(
+        hdl_pair, std::vector<struct le_audio::types::acs_ac_record>()));
+
+    auto hdl = hdl_pair.val_hdl;
+    auto pac_tuple_iter = std::find_if(
+        pacs_db.begin(), pacs_db.end(),
+        [&hdl](auto& pac_ent) { return std::get<0>(pac_ent).val_hdl == hdl; });
+
+    std::vector<struct le_audio::types::acs_ac_record> pac_recs;
+    while (pac_count--) {
+      uint8_t pac_len;
+      STREAM_TO_UINT8(pac_len, ptr);
+      LOG_VERBOSE("Pac len %d", pac_len);
+
+      if (client_parser::pacs::ParseSinglePac(pac_recs, pac_len, ptr) < 0) {
+        LOG_ERROR("Cannot parse stored PACs (impossible)");
+        return false;
+      }
+      ptr += pac_len;
+    }
+    leAudioDevice->RegisterPACs(&std::get<1>(*pac_tuple_iter), &pac_recs);
+  }
+
+  return true;
+}
+
+bool DeserializeSinkPacs(le_audio::LeAudioDevice* leAudioDevice,
+                         const std::vector<uint8_t>& in) {
+  LOG_VERBOSE("");
+  if (leAudioDevice == nullptr) {
+    LOG_WARN(" Skipping unknown device");
+    return false;
+  }
+  return deserializePacs(leAudioDevice, leAudioDevice->snk_pacs_, in);
+}
+
+bool DeserializeSourcePacs(le_audio::LeAudioDevice* leAudioDevice,
+                           const std::vector<uint8_t>& in) {
+  LOG_VERBOSE("");
+  if (leAudioDevice == nullptr) {
+    LOG_WARN(" Skipping unknown device");
+    return false;
+  }
+  return deserializePacs(leAudioDevice, leAudioDevice->src_pacs_, in);
+}
+
+bool SerializeAses(const le_audio::LeAudioDevice* leAudioDevice,
+                   std::vector<uint8_t>& out) {
+  if (leAudioDevice == nullptr) {
+    LOG_WARN(" Skipping unknown device");
+    return false;
+  }
+
+  auto num_of_ases = leAudioDevice->ases_.size();
+  LOG_DEBUG(" device: %s, number of ases %d",
+            leAudioDevice->address_.ToString().c_str(),
+            static_cast<int>(num_of_ases));
+
+  if (num_of_ases == 0 || (num_of_ases > std::numeric_limits<uint8_t>::max())) {
+    LOG_WARN("No ases available for device %s",
+             leAudioDevice->address_.ToString().c_str());
+    return false;
+  }
+
+  /* Calculate the total size */
+  auto ases_bin_size = LEAUDIO_STORAGE_HEADER_WITH_ENTRIES_SZ +
+                       num_of_ases * LEAUDIO_ASES_ENTRY_SZ;
+  out.resize(ases_bin_size);
+  auto* ptr = out.data();
+
+  /* header */
+  UINT8_TO_STREAM(ptr, LEAUDIO_ASE_STORAGE_CURRENT_LAYOUT_MAGIC);
+  UINT8_TO_STREAM(ptr, num_of_ases);
+
+  /* pacs entries */
+  for (const auto& ase : leAudioDevice->ases_) {
+    LOG_VERBOSE(
+        "Storing ASE ID: %d, direction %s, handle 0x%04x, ccc_handle 0x%04x",
+        ase.id,
+        ase.direction == le_audio::types::kLeAudioDirectionSink ? "sink "
+                                                                : "source",
+        ase.hdls.val_hdl, ase.hdls.ccc_hdl);
+
+    UINT16_TO_STREAM(ptr, ase.hdls.val_hdl);
+    UINT16_TO_STREAM(ptr, ase.hdls.ccc_hdl);
+    UINT8_TO_STREAM(ptr, ase.id);
+    UINT8_TO_STREAM(ptr, ase.direction);
+  }
+
+  return true;
+}
+
+bool DeserializeAses(le_audio::LeAudioDevice* leAudioDevice,
+                     const std::vector<uint8_t>& in) {
+  if (leAudioDevice == nullptr) {
+    LOG_WARN(" Skipping unknown device");
+    return false;
+  }
+
+  if (in.size() <
+      LEAUDIO_STORAGE_HEADER_WITH_ENTRIES_SZ + LEAUDIO_ASES_ENTRY_SZ) {
+    LOG_WARN("There is not single ASE stored for device %s",
+             leAudioDevice->address_.ToString().c_str());
+    return false;
+  }
+
+  auto* ptr = in.data();
+
+  uint8_t magic;
+  STREAM_TO_UINT8(magic, ptr);
+
+  if (magic != LEAUDIO_ASE_STORAGE_CURRENT_LAYOUT_MAGIC) {
+    LOG_ERROR("Invalid magic (%d!=%d", magic,
+              LEAUDIO_PACS_STORAGE_CURRENT_LAYOUT_MAGIC);
+    return false;
+  }
+
+  uint8_t num_of_ases;
+  STREAM_TO_UINT8(num_of_ases, ptr);
+
+  if (in.size() < LEAUDIO_STORAGE_HEADER_WITH_ENTRIES_SZ +
+                      (num_of_ases * LEAUDIO_ASES_ENTRY_SZ)) {
+    LOG_ERROR("Invalid persistent storage data for device %s",
+              leAudioDevice->address_.ToString().c_str());
+    return false;
+  }
+
+  LOG_DEBUG("Loading %d Ases for device %s", num_of_ases,
+            leAudioDevice->address_.ToString().c_str());
+  /* sets entries */
+  while (num_of_ases--) {
+    uint16_t handle;
+    uint16_t ccc_handle;
+    uint8_t direction;
+    uint8_t ase_id;
+
+    STREAM_TO_UINT16(handle, ptr);
+    STREAM_TO_UINT16(ccc_handle, ptr);
+    STREAM_TO_UINT8(ase_id, ptr);
+    STREAM_TO_UINT8(direction, ptr);
+
+    leAudioDevice->ases_.emplace_back(handle, ccc_handle, direction, ase_id);
+    LOG_VERBOSE(
+        " Loading ASE ID: %d, direction %s, handle 0x%04x, ccc_handle 0x%04x",
+        ase_id,
+        direction == le_audio::types::kLeAudioDirectionSink ? "sink "
+                                                            : "source",
+        handle, ccc_handle);
+  }
+
+  return true;
+}
+
+bool SerializeHandles(const LeAudioDevice* leAudioDevice,
+                      std::vector<uint8_t>& out) {
+  if (leAudioDevice == nullptr) {
+    LOG_WARN(" Skipping unknown device");
+    return false;
+  }
+
+  /* Calculate the total size */
+  out.resize(LEAUDIO_STORAGE_HANDLES_ENTRIES_SZ);
+  auto* ptr = out.data();
+
+  /* header */
+  UINT8_TO_STREAM(ptr, LEAUDIO_HANDLES_STORAGE_CURRENT_LAYOUT_MAGIC);
+
+  if (leAudioDevice->ctp_hdls_.val_hdl == 0 ||
+      leAudioDevice->ctp_hdls_.ccc_hdl == 0) {
+    LOG_WARN("Invalid control point handles for device %s",
+             leAudioDevice->address_.ToString().c_str());
+    return false;
+  }
+
+  UINT16_TO_STREAM(ptr, leAudioDevice->ctp_hdls_.val_hdl);
+  UINT16_TO_STREAM(ptr, leAudioDevice->ctp_hdls_.ccc_hdl);
+
+  UINT16_TO_STREAM(ptr, leAudioDevice->snk_audio_locations_hdls_.val_hdl);
+  UINT16_TO_STREAM(ptr, leAudioDevice->snk_audio_locations_hdls_.ccc_hdl);
+
+  UINT16_TO_STREAM(ptr, leAudioDevice->src_audio_locations_hdls_.val_hdl);
+  UINT16_TO_STREAM(ptr, leAudioDevice->src_audio_locations_hdls_.ccc_hdl);
+
+  UINT16_TO_STREAM(ptr, leAudioDevice->audio_supp_cont_hdls_.val_hdl);
+  UINT16_TO_STREAM(ptr, leAudioDevice->audio_supp_cont_hdls_.ccc_hdl);
+
+  UINT16_TO_STREAM(ptr, leAudioDevice->audio_avail_hdls_.val_hdl);
+  UINT16_TO_STREAM(ptr, leAudioDevice->audio_avail_hdls_.ccc_hdl);
+
+  UINT16_TO_STREAM(ptr, leAudioDevice->tmap_role_hdl_);
+
+  return true;
+}
+
+bool DeserializeHandles(LeAudioDevice* leAudioDevice,
+                        const std::vector<uint8_t>& in) {
+  if (leAudioDevice == nullptr) {
+    LOG_WARN(" Skipping unknown device");
+    return false;
+  }
+
+  if (in.size() != LEAUDIO_STORAGE_HANDLES_ENTRIES_SZ) {
+    LOG_WARN("There is not single ASE stored for device %s",
+             leAudioDevice->address_.ToString().c_str());
+    return false;
+  }
+
+  auto* ptr = in.data();
+
+  uint8_t magic;
+  STREAM_TO_UINT8(magic, ptr);
+
+  if (magic != LEAUDIO_HANDLES_STORAGE_CURRENT_LAYOUT_MAGIC) {
+    LOG_ERROR("Invalid magic (%d!=%d) for device %s", magic,
+              LEAUDIO_PACS_STORAGE_CURRENT_LAYOUT_MAGIC,
+              leAudioDevice->address_.ToString().c_str());
+    return false;
+  }
+
+  STREAM_TO_UINT16(leAudioDevice->ctp_hdls_.val_hdl, ptr);
+  STREAM_TO_UINT16(leAudioDevice->ctp_hdls_.ccc_hdl, ptr);
+  LOG_VERBOSE("ctp.val_hdl: 0x%04x, ctp.ccc_hdl: 0x%04x",
+              leAudioDevice->ctp_hdls_.val_hdl,
+              leAudioDevice->ctp_hdls_.ccc_hdl);
+
+  STREAM_TO_UINT16(leAudioDevice->snk_audio_locations_hdls_.val_hdl, ptr);
+  STREAM_TO_UINT16(leAudioDevice->snk_audio_locations_hdls_.ccc_hdl, ptr);
+  LOG_VERBOSE(
+      "snk_audio_locations_hdls_.val_hdl: 0x%04x,"
+      "snk_audio_locations_hdls_.ccc_hdl: 0x%04x",
+      leAudioDevice->snk_audio_locations_hdls_.val_hdl,
+      leAudioDevice->snk_audio_locations_hdls_.ccc_hdl);
+
+  STREAM_TO_UINT16(leAudioDevice->src_audio_locations_hdls_.val_hdl, ptr);
+  STREAM_TO_UINT16(leAudioDevice->src_audio_locations_hdls_.ccc_hdl, ptr);
+  LOG_VERBOSE(
+      "src_audio_locations_hdls_.val_hdl: 0x%04x,"
+      "src_audio_locations_hdls_.ccc_hdl: 0x%04x",
+      leAudioDevice->src_audio_locations_hdls_.val_hdl,
+      leAudioDevice->src_audio_locations_hdls_.ccc_hdl);
+
+  STREAM_TO_UINT16(leAudioDevice->audio_supp_cont_hdls_.val_hdl, ptr);
+  STREAM_TO_UINT16(leAudioDevice->audio_supp_cont_hdls_.ccc_hdl, ptr);
+  LOG_VERBOSE(
+      "audio_supp_cont_hdls_.val_hdl: 0x%04x,"
+      "audio_supp_cont_hdls_.ccc_hdl: 0x%04x",
+      leAudioDevice->audio_supp_cont_hdls_.val_hdl,
+      leAudioDevice->audio_supp_cont_hdls_.ccc_hdl);
+
+  STREAM_TO_UINT16(leAudioDevice->audio_avail_hdls_.val_hdl, ptr);
+  STREAM_TO_UINT16(leAudioDevice->audio_avail_hdls_.ccc_hdl, ptr);
+  LOG_VERBOSE(
+      "audio_avail_hdls_.val_hdl: 0x%04x,"
+      "audio_avail_hdls_.ccc_hdl: 0x%04x",
+      leAudioDevice->audio_avail_hdls_.val_hdl,
+      leAudioDevice->audio_avail_hdls_.ccc_hdl);
+
+  STREAM_TO_UINT16(leAudioDevice->tmap_role_hdl_, ptr);
+  LOG_VERBOSE("tmap_role_hdl_: 0x%04x", leAudioDevice->tmap_role_hdl_);
+
+  leAudioDevice->known_service_handles_ = true;
+  return true;
+}
+}  // namespace le_audio
\ No newline at end of file
diff --git a/system/bta/le_audio/storage_helper.h b/system/bta/le_audio/storage_helper.h
new file mode 100644
index 0000000..dd73b7b
--- /dev/null
+++ b/system/bta/le_audio/storage_helper.h
@@ -0,0 +1,42 @@
+/******************************************************************************
+ *
+ *  Copyright 2022 The Android Open Source Project
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at:
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ ******************************************************************************/
+
+#include <stdint.h>
+
+#include <vector>
+
+#include "devices.h"
+
+namespace le_audio {
+bool SerializeSinkPacs(const LeAudioDevice* leAudioDevice,
+                       std::vector<uint8_t>& out);
+bool DeserializeSinkPacs(LeAudioDevice* leAudioDevice,
+                         const std::vector<uint8_t>& in);
+bool SerializeSourcePacs(const LeAudioDevice* leAudioDevice,
+                         std::vector<uint8_t>& out);
+bool DeserializeSourcePacs(LeAudioDevice* leAudioDevice,
+                           const std::vector<uint8_t>& in);
+bool SerializeAses(const LeAudioDevice* leAudioDevice,
+                   std::vector<uint8_t>& out);
+bool DeserializeAses(LeAudioDevice* leAudioDevice,
+                     const std::vector<uint8_t>& in);
+bool SerializeHandles(const LeAudioDevice* leAudioDevice,
+                      std::vector<uint8_t>& out);
+bool DeserializeHandles(LeAudioDevice* leAudioDevice,
+                        const std::vector<uint8_t>& in);
+}  // namespace le_audio
\ No newline at end of file
diff --git a/system/bta/le_audio/storage_helper_test.cc b/system/bta/le_audio/storage_helper_test.cc
new file mode 100644
index 0000000..fe99f52
--- /dev/null
+++ b/system/bta/le_audio/storage_helper_test.cc
@@ -0,0 +1,322 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "storage_helper.h"
+
+#include <gtest/gtest.h>
+
+#include "common/init_flags.h"
+
+using le_audio::LeAudioDevice;
+
+const char* test_flags[] = {
+    "INIT_logging_debug_enabled_for_all=true",
+    nullptr,
+};
+
+namespace le_audio {
+RawAddress GetTestAddress(uint8_t index) {
+  CHECK_LT(index, UINT8_MAX);
+  RawAddress result = {{0xC0, 0xDE, 0xC0, 0xDE, 0x00, index}};
+  return result;
+}
+
+class StorageHelperTest : public ::testing::Test {
+ protected:
+  void SetUp() override { bluetooth::common::InitFlags::Load(test_flags); }
+
+  void TearDown() override {}
+};
+
+TEST(StorageHelperTest, DeserializeSinkPacs) {
+  // clang-format off
+        const std::vector<uint8_t> validSinkPack = {
+                0x00, // Magic
+                0x01, // Num of PACs
+                0x02,0x12, // handle
+                0x03,0x12, // cc handle
+                0x02, // Number of records in PAC
+                0x1e, // PAC entry size
+                0x06,0x00,0x00,0x00,0x00, // Codec Id
+                0x13, // Codec specific cap. size
+                0x03,0x01,0x04,0x00,0x02,0x02,0x01,0x02,0x03,0x01,0x05,0x04,0x1e,0x00,0x1e,0x00,0x02,0x05,0x01, // Codec specific capa
+                0x04, // Metadata size
+                0x03,0x01,0xff,0x0f, // Metadata
+                0x1e, //
+                0x06,0x00,0x00,0x00,0x00, // Codec ID
+                0x13, // Codec specific cap. size
+                0x03,0x01,0x20,0x00,0x02,0x02,0x01,0x02,0x03,0x01,0x05,0x04,0x3c,0x00,0x3c,0x00,0x02,0x05,0x01, // Codec specific capa
+                0x04,  // Codec specific capa
+                0x03,0x01,0xff,0x0f, // Metadata
+        };
+
+        const std::vector<uint8_t> invalidSinkPackNumOfPacs = {
+                0x00, // Magic
+                0x05, // Num of PACs
+                0x02,0x12, // handle
+                0x03,0x12, // cc handle
+                0x01, // Number of records in PAC
+                0x1e, // PAC entry size
+                0x06,0x00,0x00,0x00,0x00, // Codec Id
+                0x13, // Codec specific cap. size
+                0x03,0x01,0x04,0x00,0x02,0x02,0x01,0x02,0x03,0x01,0x05,0x04,0x1e,0x00,0x1e,0x00,0x02,0x05,0x01, // Codec specific capa
+                0x04, // Metadata size
+                0x03,0x01,0xff,0x0f, // Metadata
+                0x1e, //
+                0x06,0x00,0x00,0x00,0x00, // Codec ID
+                0x13, // Codec specific cap. size
+                0x03,0x01,0x20,0x00,0x02,0x02,0x01,0x02,0x03,0x01,0x05,0x04,0x3c,0x00,0x3c,0x00,0x02,0x05,0x01, // Codec specific capa
+                0x04,  // Codec specific capa
+                0x03,0x01,0xff,0x0f, // Metadata
+        };
+
+        const std::vector<uint8_t> invalidSinkPackMagic = {
+                0x01, // Magic
+                0x01, // Num of PACs
+                0x02,0x12, // handle
+                0x03,0x12, // cc handle
+                0x02, // Number of records in PAC
+                0x1e, // PAC entry size
+                0x06,0x00,0x00,0x00,0x00, // Codec Id
+                0x13, // Codec specific cap. size
+                0x03,0x01,0x04,0x00,0x02,0x02,0x01,0x02,0x03,0x01,0x05,0x04,0x1e,0x00,0x1e,0x00,0x02,0x05,0x01, // Codec specific capa
+                0x04, // Metadata size
+                0x03,0x01,0xff,0x0f, // Metadata
+                0x1e, //
+                0x06,0x00,0x00,0x00,0x00, // Codec ID
+                0x13, // Codec specific cap. size
+                0x03,0x01,0x20,0x00,0x02,0x02,0x01,0x02,0x03,0x01,0x05,0x04,0x3c,0x00,0x3c,0x00,0x02,0x05,0x01, // Codec specific capa
+                0x04,  // Codec specific capa
+                0x03,0x01,0xff,0x0f, // Metadata
+        };
+  // clang-format on
+
+  RawAddress test_address0 = GetTestAddress(0);
+  LeAudioDevice leAudioDevice(test_address0, DeviceConnectState::DISCONNECTED);
+  ASSERT_TRUE(DeserializeSinkPacs(&leAudioDevice, validSinkPack));
+  std::vector<uint8_t> serialize;
+  ASSERT_TRUE(SerializeSinkPacs(&leAudioDevice, serialize));
+  ASSERT_TRUE(serialize == validSinkPack);
+
+  ASSERT_FALSE(DeserializeSinkPacs(&leAudioDevice, invalidSinkPackMagic));
+  ASSERT_FALSE(DeserializeSinkPacs(&leAudioDevice, invalidSinkPackNumOfPacs));
+}
+
+TEST(StorageHelperTest, DeserializeSourcePacs) {
+  // clang-format off
+  const std::vector<uint8_t> validSourcePack = {
+        0x00, // Magic
+        0x01, // Num of PACs
+        0x08,0x12, // handle
+        0x09,0x12, // cc handle
+        0x02, // Number of records in PAC
+        0x1e, // PAC entry size
+        0x06,0x00,0x00,0x00,0x00, // Codec Id
+        0x13, // Codec specific cap. size
+        0x03,0x01,0x04,0x00,0x02,0x02,0x01,0x02,0x03,0x01,0x05,0x04,0x1e,0x00,0x1e,0x00,0x02,0x05,0x01,
+        0x04, // Metadata size
+        0x03,0x01,0x03,0x00, // Metadata
+        0x1e, // PAC entry size
+        0x06,0x00,0x00,0x00,0x00, // Codec Id
+        0x13, // Codec specific cap. size
+        0x03,0x01,0x20,0x00,0x02,0x02,0x01,0x02, // Codec specific capa
+        0x03,0x01,0x05,0x04,0x3c,0x00,0x3c,0x00, // Codec specific capa
+        0x02,0x05,0x01,                          // Codec specific capa
+        0x04, // Metadata size
+        0x03,0x01,0x03,0x00 // Metadata
+  };
+
+  const std::vector<uint8_t> invalidSourcePackNumOfPacs = {
+        0x00, // Magic
+        0x04, // Num of PACs
+        0x08,0x12, // handle
+        0x09,0x12, // cc handle
+        0x01, // Number of records in PAC
+        0x1e, // PAC entry size
+        0x06,0x00,0x00,0x00,0x00, // Codec Id
+        0x13, // Codec specific cap. size
+        0x03,0x01,0x04,0x00,0x02,0x02,0x01,0x02, // Codec specific capa
+        0x03,0x01,0x05,0x04,0x1e,0x00,0x1e,0x00, // Codec specific capa
+        0x02,0x05,0x01,                          // Codec specific capa
+        0x04, // Metadata size
+        0x03,0x01,0x03,0x00, // Metadata
+        0x1e, // PAC entry size
+        0x06,0x00,0x00,0x00,0x00, // Codec Id
+        0x13, // Codec specific cap. size
+        0x03,0x01,0x20,0x00,0x02,0x02,0x01,0x02, // Codec specific capa
+        0x03,0x01,0x05,0x04,0x3c,0x00,0x3c,0x00, // Codec specific capa
+        0x02,0x05,0x01,                          // Codec specific capa
+        0x04, // Metadata size
+        0x03,0x01,0x03,0x00 // Metadata
+ };
+
+  const std::vector<uint8_t> invalidSourcePackMagic = {
+        0x01, // Magic
+        0x01, // Num of PACs
+        0x08,0x12, // handle
+        0x09,0x12, // cc handle
+        0x02, // Number of records in PAC
+        0x1e, // PAC entry size
+        0x06,0x00,0x00,0x00,0x00, // Codec Id
+        0x13, // Codec specific cap. size
+        0x03,0x01,0x04,0x00,0x02,0x02,0x01,0x02, // Codec specific capa
+        0x03,0x01,0x05,0x04,0x1e,0x00,0x1e,0x00, // Codec specific capa
+        0x02,0x05,0x01,                          // Codec specific capa
+        0x04, // Metadata size
+        0x03,0x01,0x03,0x00, // Metadata
+        0x1e, // PAC entry size
+        0x06,0x00,0x00,0x00,0x00, // Codec Id
+        0x13, // Codec specific cap. size
+        0x03,0x01,0x20,0x00,0x02,0x02,0x01,0x02, // Codec specific capa
+        0x03,0x01,0x05,0x04,0x3c,0x00,0x3c,0x00, // Codec specific capa
+        0x02,0x05,0x01,                          // Codec specific capa
+        0x04, // Metadata size
+        0x03,0x01,0x03,0x00 // Metadata
+  };
+  // clang-format on
+
+  RawAddress test_address0 = GetTestAddress(0);
+  LeAudioDevice leAudioDevice(test_address0, DeviceConnectState::DISCONNECTED);
+  ASSERT_TRUE(DeserializeSourcePacs(&leAudioDevice, validSourcePack));
+  std::vector<uint8_t> serialize;
+  ASSERT_TRUE(SerializeSourcePacs(&leAudioDevice, serialize));
+  ASSERT_TRUE(serialize == validSourcePack);
+
+  ASSERT_FALSE(DeserializeSourcePacs(&leAudioDevice, invalidSourcePackMagic));
+  ASSERT_FALSE(
+      DeserializeSourcePacs(&leAudioDevice, invalidSourcePackNumOfPacs));
+}
+
+TEST(StorageHelperTest, DeserializeAses) {
+  // clang-format off
+  const std::vector<uint8_t> validAses {
+        0x00, // Magic
+        0x03, // Num of ASEs
+        0x05, 0x11, // handle
+        0x06, 0x11, // ccc handle
+        0x01,  // ASE id
+        0x01,  // direction
+        0x08, 0x11, // handle
+        0x09, 0x11, // ccc handle
+        0x02, // ASE id
+        0x01, // direction
+        0x0b, 0x11, // handle
+        0x0c, 0x11, // ccc handle
+        0x03, // ASE id
+        0x02 // direction
+  };
+  const std::vector<uint8_t> invalidAsesNumOfAses {
+        0x00, // Magic
+        0x05, // Num of ASEs
+        0x05, 0x11, // handle
+        0x06, 0x11, // ccc handle
+        0x01,  // ASE id
+        0x01,  // direction
+        0x08, 0x11, // handle
+        0x09, 0x11, // ccc handle
+        0x02, // ASE id
+        0x01, // direction
+        0x0b, 0x11, // handle
+        0x0c, 0x11, // ccc handle
+        0x03, // ASE id
+        0x02 // direction
+  };
+  const std::vector<uint8_t> invalidAsesMagic {
+        0x01, // Magic
+        0x03, // Num of ASEs
+        0x05, 0x11, // handle
+        0x06, 0x11, // ccc handle
+        0x01,  // ASE id
+        0x01,  // direction
+        0x08, 0x11, // handle
+        0x09, 0x11, // ccc handle
+        0x02, // ASE id
+        0x01, // direction
+        0x0b, 0x11, // handle
+        0x0c, 0x11, // ccc handle
+        0x03, // ASE id
+        0x02 // direction
+  };
+  // clang-format on
+  RawAddress test_address0 = GetTestAddress(0);
+  LeAudioDevice leAudioDevice(test_address0, DeviceConnectState::DISCONNECTED);
+  ASSERT_TRUE(DeserializeAses(&leAudioDevice, validAses));
+
+  std::vector<uint8_t> serialize;
+  ASSERT_TRUE(SerializeAses(&leAudioDevice, serialize));
+  ASSERT_TRUE(serialize == validAses);
+
+  ASSERT_FALSE(DeserializeAses(&leAudioDevice, invalidAsesNumOfAses));
+  ASSERT_FALSE(DeserializeAses(&leAudioDevice, invalidAsesMagic));
+}
+
+TEST(StorageHelperTest, DeserializeHandles) {
+  // clang-format off
+  const std::vector<uint8_t> validHandles {
+        0x00, // Magic
+        0x0e, 0x11, // Control point handle
+        0x0f, 0x11, // Control point ccc handle
+        0x05, 0x12, // Sink audio location handle
+        0x06, 0x12, // Sink audio location ccc handle
+        0x0b, 0x12, // Source audio location handle
+        0x0c, 0x12, // Source audio location ccc handle
+        0x11, 0x12, // Supported context types handle
+        0x12, 0x12, // Supported context types ccc handle
+        0x0e, 0x12, // Available context types handle
+        0x0f, 0x12, // Available context types ccc handle
+        0x03, 0xa3  // TMAP role handle
+  };
+  const std::vector<uint8_t> invalidHandlesMagic {
+        0x01, // Magic
+        0x0e, 0x11, // Control point handle
+        0x0f, 0x11, // Control point ccc handle
+        0x05, 0x12, // Sink audio location handle
+        0x06, 0x12, // Sink audio location ccc handle
+        0x0b, 0x12, // Source audio location handle
+        0x0c, 0x12, // Source audio location ccc handle
+        0x11, 0x12, // Supported context types handle
+        0x12, 0x12, // Supported context types ccc handle
+        0x0e, 0x12, // Available context types handle
+        0x0f, 0x12, // Available context types ccc handle
+        0x03, 0xa3  // TMAP role handle
+  };
+    const std::vector<uint8_t> invalidHandles {
+        0x00, // Magic
+        0x0e, 0x11, // Control point handle
+        0x0f, 0x11, // Control point ccc handle
+        0x05, 0x12, // Sink audio location handle
+        0x06, 0x12, // Sink audio location ccc handle
+        0x0b, 0x12, // Source audio location handle
+        0x0c, 0x12, // Source audio location ccc handle
+        0x11, 0x12, // Supported context types handle
+        0x12, 0x12, // Supported context types ccc handle
+        0x0e, 0x12, // Available context types handle
+        0x0f, 0x12, // Available context types ccc handle
+        0x03, 0xa3,  // TMAP role handle
+        0x00, 0x00, // corrupted
+  };
+  // clang-format on
+  RawAddress test_address0 = GetTestAddress(0);
+  LeAudioDevice leAudioDevice(test_address0, DeviceConnectState::DISCONNECTED);
+  ASSERT_TRUE(DeserializeHandles(&leAudioDevice, validHandles));
+  std::vector<uint8_t> serialize;
+  ASSERT_TRUE(SerializeHandles(&leAudioDevice, serialize));
+  ASSERT_TRUE(serialize == validHandles);
+
+  ASSERT_FALSE(DeserializeHandles(&leAudioDevice, invalidHandlesMagic));
+  ASSERT_FALSE(DeserializeHandles(&leAudioDevice, invalidHandles));
+}
+}  // namespace le_audio
\ No newline at end of file
diff --git a/system/bta/pan/bta_pan_act.cc b/system/bta/pan/bta_pan_act.cc
index 2772ec5..4ffce80 100644
--- a/system/bta/pan/bta_pan_act.cc
+++ b/system/bta/pan/bta_pan_act.cc
@@ -182,7 +182,6 @@
 
   if (sizeof(BT_HDR) + sizeof(tBTA_PAN_DATA_PARAMS) + p_buf->len >
       PAN_BUF_SIZE) {
-    android_errorWriteLog(0x534e4554, "63146237");
     APPL_TRACE_ERROR("%s: received buffer length too large: %d", __func__,
                      p_buf->len);
     return;
diff --git a/system/bta/test/bta_dm_test.cc b/system/bta/test/bta_dm_test.cc
index cddece7..b108067 100644
--- a/system/bta/test/bta_dm_test.cc
+++ b/system/bta/test/bta_dm_test.cc
@@ -27,8 +27,11 @@
 #include "bta/include/bta_hf_client_api.h"
 #include "btif/include/stack_manager.h"
 #include "common/message_loop_thread.h"
+#include "osi/include/compat.h"
 #include "stack/include/btm_status.h"
+#include "test/common/main_handler.h"
 #include "test/mock/mock_osi_alarm.h"
+#include "test/mock/mock_osi_allocator.h"
 #include "test/mock/mock_stack_acl.h"
 #include "test/mock/mock_stack_btm_sec.h"
 
@@ -46,12 +49,21 @@
 
 namespace {
 constexpr uint8_t kUnusedTimer = BTA_ID_MAX;
+const RawAddress kRawAddress({0x11, 0x22, 0x33, 0x44, 0x55, 0x66});
+const RawAddress kRawAddress2({0x12, 0x34, 0x56, 0x78, 0x9a, 0xbc});
+constexpr char kRemoteName[] = "TheRemoteName";
 
 const char* test_flags[] = {
     "INIT_logging_debug_enabled_for_all=true",
     nullptr,
 };
 
+bool bta_dm_search_sm_execute(BT_HDR_RIGID* p_msg) { return true; }
+void bta_dm_search_sm_disable() { bta_sys_deregister(BTA_ID_DM_SEARCH); }
+
+const tBTA_SYS_REG bta_dm_search_reg = {bta_dm_search_sm_execute,
+                                        bta_dm_search_sm_disable};
+
 }  // namespace
 
 struct alarm_t {
@@ -70,7 +82,22 @@
     test::mock::osi_alarm::alarm_free.body = [](alarm_t* alarm) {
       delete alarm;
     };
+    test::mock::osi_allocator::osi_malloc.body = [](size_t size) {
+      return malloc(size);
+    };
+    test::mock::osi_allocator::osi_calloc.body = [](size_t size) {
+      return calloc(1UL, size);
+    };
+    test::mock::osi_allocator::osi_free.body = [](void* ptr) { free(ptr); };
+    test::mock::osi_allocator::osi_free_and_reset.body = [](void** ptr) {
+      free(*ptr);
+      *ptr = nullptr;
+    };
 
+    main_thread_start_up();
+    post_on_bt_main([]() { LOG_INFO("Main thread started up"); });
+
+    bta_sys_register(BTA_ID_DM_SEARCH, &bta_dm_search_reg);
     bta_dm_init_cb();
 
     for (int i = 0; i < BTA_DM_NUM_PM_TIMER; i++) {
@@ -80,9 +107,17 @@
     }
   }
   void TearDown() override {
+    bta_sys_deregister(BTA_ID_DM_SEARCH);
     bta_dm_deinit_cb();
+    post_on_bt_main([]() { LOG_INFO("Main thread shutting down"); });
+    main_thread_shut_down();
+
     test::mock::osi_alarm::alarm_new = {};
     test::mock::osi_alarm::alarm_free = {};
+    test::mock::osi_allocator::osi_malloc = {};
+    test::mock::osi_allocator::osi_calloc = {};
+    test::mock::osi_allocator::osi_free = {};
+    test::mock::osi_allocator::osi_free_and_reset = {};
   }
 };
 
@@ -212,6 +247,9 @@
 namespace testing {
 tBTA_DM_PEER_DEVICE* allocate_device_for(const RawAddress& bd_addr,
                                          tBT_TRANSPORT transport);
+
+void bta_dm_remname_cback(void* p);
+
 }  // namespace testing
 }  // namespace legacy
 }  // namespace bluetooth
@@ -323,3 +361,116 @@
   BTA_DM_ENCRYPT_CBACK_queue.pop();
   ASSERT_EQ(BTA_FAILURE, params_BTM_ILLEGAL_VALUE.result);
 }
+
+TEST_F(BtaDmTest, bta_dm_event_text) {
+  std::vector<std::pair<tBTA_DM_EVT, std::string>> events = {
+      std::make_pair(BTA_DM_API_SEARCH_EVT, "BTA_DM_API_SEARCH_EVT"),
+      std::make_pair(BTA_DM_API_DISCOVER_EVT, "BTA_DM_API_DISCOVER_EVT"),
+      std::make_pair(BTA_DM_INQUIRY_CMPL_EVT, "BTA_DM_INQUIRY_CMPL_EVT"),
+      std::make_pair(BTA_DM_REMT_NAME_EVT, "BTA_DM_REMT_NAME_EVT"),
+      std::make_pair(BTA_DM_SDP_RESULT_EVT, "BTA_DM_SDP_RESULT_EVT"),
+      std::make_pair(BTA_DM_SEARCH_CMPL_EVT, "BTA_DM_SEARCH_CMPL_EVT"),
+      std::make_pair(BTA_DM_DISCOVERY_RESULT_EVT,
+                     "BTA_DM_DISCOVERY_RESULT_EVT"),
+      std::make_pair(BTA_DM_DISC_CLOSE_TOUT_EVT, "BTA_DM_DISC_CLOSE_TOUT_EVT"),
+  };
+  for (const auto& event : events) {
+    ASSERT_STREQ(event.second.c_str(), bta_dm_event_text(event.first).c_str());
+  }
+  ASSERT_STREQ(base::StringPrintf("UNKNOWN[0x%04x]",
+                                  std::numeric_limits<uint16_t>::max())
+                   .c_str(),
+               bta_dm_event_text(static_cast<tBTA_DM_EVT>(
+                                     std::numeric_limits<uint16_t>::max()))
+                   .c_str());
+}
+
+TEST_F(BtaDmTest, bta_dm_state_text) {
+  std::vector<std::pair<tBTA_DM_STATE, std::string>> states = {
+      std::make_pair(BTA_DM_SEARCH_IDLE, "BTA_DM_SEARCH_IDLE"),
+      std::make_pair(BTA_DM_SEARCH_ACTIVE, "BTA_DM_SEARCH_ACTIVE"),
+      std::make_pair(BTA_DM_SEARCH_CANCELLING, "BTA_DM_SEARCH_CANCELLING"),
+      std::make_pair(BTA_DM_DISCOVER_ACTIVE, "BTA_DM_DISCOVER_ACTIVE"),
+  };
+  for (const auto& state : states) {
+    ASSERT_STREQ(state.second.c_str(), bta_dm_state_text(state.first).c_str());
+  }
+  auto unknown =
+      base::StringPrintf("UNKNOWN[%d]", std::numeric_limits<int>::max());
+  ASSERT_STREQ(unknown.c_str(),
+               bta_dm_state_text(
+                   static_cast<tBTA_DM_STATE>(std::numeric_limits<int>::max()))
+                   .c_str());
+}
+
+TEST_F(BtaDmTest, bta_dm_remname_cback__typical) {
+  bta_dm_search_cb = {
+      .name_discover_done = false,
+      .peer_bdaddr = kRawAddress,
+  };
+
+  tBTM_REMOTE_DEV_NAME name = {
+      .status = BTM_SUCCESS,
+      .bd_addr = kRawAddress,
+      .length = static_cast<uint16_t>(strlen(kRemoteName)),
+      .remote_bd_name = {},
+      .hci_status = HCI_SUCCESS,
+  };
+  strlcpy(reinterpret_cast<char*>(&name.remote_bd_name), kRemoteName,
+          strlen(kRemoteName));
+
+  bluetooth::legacy::testing::bta_dm_remname_cback(static_cast<void*>(&name));
+
+  sync_main_handler();
+
+  ASSERT_EQ(1, mock_function_count_map["BTM_SecDeleteRmtNameNotifyCallback"]);
+  ASSERT_TRUE(bta_dm_search_cb.name_discover_done);
+}
+
+TEST_F(BtaDmTest, bta_dm_remname_cback__wrong_address) {
+  bta_dm_search_cb = {
+      .name_discover_done = false,
+      .peer_bdaddr = kRawAddress,
+  };
+
+  tBTM_REMOTE_DEV_NAME name = {
+      .status = BTM_SUCCESS,
+      .bd_addr = kRawAddress2,
+      .length = static_cast<uint16_t>(strlen(kRemoteName)),
+      .remote_bd_name = {},
+      .hci_status = HCI_SUCCESS,
+  };
+  strlcpy(reinterpret_cast<char*>(&name.remote_bd_name), kRemoteName,
+          strlen(kRemoteName));
+
+  bluetooth::legacy::testing::bta_dm_remname_cback(static_cast<void*>(&name));
+
+  sync_main_handler();
+
+  ASSERT_EQ(0, mock_function_count_map["BTM_SecDeleteRmtNameNotifyCallback"]);
+  ASSERT_FALSE(bta_dm_search_cb.name_discover_done);
+}
+
+TEST_F(BtaDmTest, bta_dm_remname_cback__HCI_ERR_CONNECTION_EXISTS) {
+  bta_dm_search_cb = {
+      .name_discover_done = false,
+      .peer_bdaddr = kRawAddress,
+  };
+
+  tBTM_REMOTE_DEV_NAME name = {
+      .status = BTM_SUCCESS,
+      .bd_addr = RawAddress::kEmpty,
+      .length = static_cast<uint16_t>(strlen(kRemoteName)),
+      .remote_bd_name = {},
+      .hci_status = HCI_ERR_CONNECTION_EXISTS,
+  };
+  strlcpy(reinterpret_cast<char*>(&name.remote_bd_name), kRemoteName,
+          strlen(kRemoteName));
+
+  bluetooth::legacy::testing::bta_dm_remname_cback(static_cast<void*>(&name));
+
+  sync_main_handler();
+
+  ASSERT_EQ(1, mock_function_count_map["BTM_SecDeleteRmtNameNotifyCallback"]);
+  ASSERT_TRUE(bta_dm_search_cb.name_discover_done);
+}
diff --git a/system/bta/test/bta_hf_client_add_record_test.cc b/system/bta/test/bta_hf_client_add_record_test.cc
index 5e50cc0..63b1b03 100644
--- a/system/bta/test/bta_hf_client_add_record_test.cc
+++ b/system/bta/test/bta_hf_client_add_record_test.cc
@@ -63,11 +63,11 @@
 };
 
 TEST_F(BtaHfClientAddRecordTest, test_hf_client_add_record) {
-  tBTA_HF_CLIENT_FEAT features = BTIF_HF_CLIENT_FEATURES;
+  tBTA_HF_CLIENT_FEAT features = get_default_hf_client_features();
   uint32_t sdp_handle = 0;
   uint8_t scn = 0;
 
   bta_hf_client_add_record("Handsfree", scn, features, sdp_handle);
-  ASSERT_EQ(gVersion, BTA_HFP_VERSION);
+  ASSERT_EQ(gVersion, get_default_hfp_version());
 }
 
diff --git a/system/bta/test/common/bta_gatt_api_mock.cc b/system/bta/test/common/bta_gatt_api_mock.cc
index de91e6f..52adc0b 100644
--- a/system/bta/test/common/bta_gatt_api_mock.cc
+++ b/system/bta/test/common/bta_gatt_api_mock.cc
@@ -39,17 +39,17 @@
 }
 
 void BTA_GATTC_Open(tGATT_IF client_if, const RawAddress& remote_bda,
-                    bool is_direct, tBT_TRANSPORT transport, bool opportunistic,
-                    uint8_t initiating_phys) {
+                    tBTM_BLE_CONN_TYPE connection_type, tBT_TRANSPORT transport,
+                    bool opportunistic, uint8_t initiating_phys) {
   LOG_ASSERT(gatt_interface) << "Mock GATT interface not set!";
-  gatt_interface->Open(client_if, remote_bda, is_direct, transport,
+  gatt_interface->Open(client_if, remote_bda, connection_type, transport,
                        opportunistic, initiating_phys);
 }
 
 void BTA_GATTC_Open(tGATT_IF client_if, const RawAddress& remote_bda,
-                    bool is_direct, bool opportunistic) {
+                    tBTM_BLE_CONN_TYPE connection_type, bool opportunistic) {
   LOG_ASSERT(gatt_interface) << "Mock GATT interface not set!";
-  gatt_interface->Open(client_if, remote_bda, is_direct, opportunistic);
+  gatt_interface->Open(client_if, remote_bda, connection_type, opportunistic);
 }
 
 void BTA_GATTC_CancelOpen(tGATT_IF client_if, const RawAddress& remote_bda,
diff --git a/system/bta/test/common/bta_gatt_api_mock.h b/system/bta/test/common/bta_gatt_api_mock.h
index 71dadb9..1ea43ff 100644
--- a/system/bta/test/common/bta_gatt_api_mock.h
+++ b/system/bta/test/common/bta_gatt_api_mock.h
@@ -31,10 +31,10 @@
                            BtaAppRegisterCallback cb, bool eatt_support) = 0;
   virtual void AppDeregister(tGATT_IF client_if) = 0;
   virtual void Open(tGATT_IF client_if, const RawAddress& remote_bda,
-                    bool is_direct, tBT_TRANSPORT transport, bool opportunistic,
-                    uint8_t initiating_phys) = 0;
+                    tBTM_BLE_CONN_TYPE connection_type, tBT_TRANSPORT transport,
+                    bool opportunistic, uint8_t initiating_phys) = 0;
   virtual void Open(tGATT_IF client_if, const RawAddress& remote_bda,
-                    bool is_direct, bool opportunistic) = 0;
+                    tBTM_BLE_CONN_TYPE connection_type, bool opportunistic) = 0;
   virtual void CancelOpen(tGATT_IF client_if, const RawAddress& remote_bda,
                           bool is_direct) = 0;
   virtual void Close(uint16_t conn_id) = 0;
@@ -63,13 +63,13 @@
               (override));
   MOCK_METHOD((void), AppDeregister, (tGATT_IF client_if), (override));
   MOCK_METHOD((void), Open,
-              (tGATT_IF client_if, const RawAddress& remote_bda, bool is_direct,
-               tBT_TRANSPORT transport, bool opportunistic,
-               uint8_t initiating_phys),
+              (tGATT_IF client_if, const RawAddress& remote_bda,
+               tBTM_BLE_CONN_TYPE connection_type, tBT_TRANSPORT transport,
+               bool opportunistic, uint8_t initiating_phys),
               (override));
   MOCK_METHOD((void), Open,
-              (tGATT_IF client_if, const RawAddress& remote_bda, bool is_direct,
-               bool opportunistic));
+              (tGATT_IF client_if, const RawAddress& remote_bda,
+               tBTM_BLE_CONN_TYPE connection_type, bool opportunistic));
   MOCK_METHOD((void), CancelOpen,
               (tGATT_IF client_if, const RawAddress& remote_bda,
                bool is_direct));
diff --git a/system/bta/test/common/btif_storage_mock.cc b/system/bta/test/common/btif_storage_mock.cc
index ab481e4..9440394 100644
--- a/system/bta/test/common/btif_storage_mock.cc
+++ b/system/bta/test/common/btif_storage_mock.cc
@@ -33,6 +33,37 @@
   btif_storage_interface->AddLeaudioAutoconnect(addr, autoconnect);
 }
 
+void btif_storage_leaudio_update_pacs_bin(const RawAddress& addr) {
+  LOG_ASSERT(btif_storage_interface) << "Mock storage module not set!";
+  btif_storage_interface->LeAudioUpdatePacs(addr);
+}
+
+void btif_storage_leaudio_update_ase_bin(const RawAddress& addr) {
+  LOG_ASSERT(btif_storage_interface) << "Mock storage module not set!";
+  btif_storage_interface->LeAudioUpdateAses(addr);
+}
+
+void btif_storage_leaudio_update_handles_bin(const RawAddress& addr) {
+  LOG_ASSERT(btif_storage_interface) << "Mock storage module not set!";
+  btif_storage_interface->LeAudioUpdateHandles(addr);
+}
+
+void btif_storage_set_leaudio_audio_location(const RawAddress& addr,
+                                             uint32_t sink_location,
+                                             uint32_t source_location) {
+  LOG_ASSERT(btif_storage_interface) << "Mock storage module not set!";
+  btif_storage_interface->SetLeAudioLocations(addr, sink_location,
+                                              source_location);
+}
+
+void btif_storage_set_leaudio_supported_context_types(
+    const RawAddress& addr, uint16_t sink_supported_context_type,
+    uint16_t source_supported_context_type) {
+  LOG_ASSERT(btif_storage_interface) << "Mock storage module not set!";
+  btif_storage_interface->SetLeAudioContexts(addr, sink_supported_context_type,
+                                             source_supported_context_type);
+}
+
 void btif_storage_remove_leaudio(RawAddress const& addr) {
   LOG_ASSERT(btif_storage_interface) << "Mock storage module not set!";
   btif_storage_interface->RemoveLeaudio(addr);
@@ -79,4 +110,9 @@
                                                 uint8_t active_preset) {
   LOG_ASSERT(btif_storage_interface) << "Mock storage module not set!";
   btif_storage_interface->SetLeaudioHasActivePreset(address, active_preset);
+}
+
+void btif_storage_remove_leaudio_has(const RawAddress& address) {
+  LOG_ASSERT(btif_storage_interface) << "Mock storage module not set!";
+  btif_storage_interface->RemoveLeaudioHas(address);
 }
\ No newline at end of file
diff --git a/system/bta/test/common/btif_storage_mock.h b/system/bta/test/common/btif_storage_mock.h
index e4ff516..77fb91d 100644
--- a/system/bta/test/common/btif_storage_mock.h
+++ b/system/bta/test/common/btif_storage_mock.h
@@ -27,6 +27,14 @@
  public:
   virtual void AddLeaudioAutoconnect(RawAddress const& addr,
                                      bool autoconnect) = 0;
+  virtual void LeAudioUpdatePacs(RawAddress const& addr) = 0;
+  virtual void LeAudioUpdateAses(RawAddress const& addr) = 0;
+  virtual void LeAudioUpdateHandles(RawAddress const& addr) = 0;
+  virtual void SetLeAudioLocations(RawAddress const& addr,
+                                   uint32_t sink_location,
+                                   uint32_t source_location) = 0;
+  virtual void SetLeAudioContexts(RawAddress const& addr, uint16_t sink_context,
+                                  uint16_t source_context) = 0;
   virtual void RemoveLeaudio(RawAddress const& addr) = 0;
   virtual void AddLeaudioHasDevice(const RawAddress& address,
                                    std::vector<uint8_t> presets_bin,
@@ -42,6 +50,7 @@
   virtual bool GetLeaudioHasPresets(const RawAddress& address,
                                     std::vector<uint8_t>& presets_bin,
                                     uint8_t& active_preset) = 0;
+  virtual void RemoveLeaudioHas(const RawAddress& address) = 0;
 
   virtual ~BtifStorageInterface() = default;
 };
@@ -50,6 +59,18 @@
  public:
   MOCK_METHOD((void), AddLeaudioAutoconnect,
               (RawAddress const& addr, bool autoconnect), (override));
+  MOCK_METHOD((void), LeAudioUpdatePacs, (RawAddress const& addr), (override));
+  MOCK_METHOD((void), LeAudioUpdateAses, (RawAddress const& addr), (override));
+  MOCK_METHOD((void), LeAudioUpdateHandles, (RawAddress const& addr),
+              (override));
+  MOCK_METHOD((void), SetLeAudioLocations,
+              (RawAddress const& addr, uint32_t sink_location,
+               uint32_t source_location),
+              (override));
+  MOCK_METHOD((void), SetLeAudioContexts,
+              (RawAddress const& addr, uint16_t sink_context,
+               uint16_t source_context),
+              (override));
   MOCK_METHOD((void), RemoveLeaudio, (RawAddress const& addr), (override));
   MOCK_METHOD((void), AddLeaudioHasDevice,
               (const RawAddress& address, std::vector<uint8_t> presets_bin,
@@ -68,6 +89,8 @@
               (const RawAddress& address, uint8_t features), (override));
   MOCK_METHOD((void), SetLeaudioHasActivePreset,
               (const RawAddress& address, uint8_t active_preset), (override));
+  MOCK_METHOD((void), RemoveLeaudioHas, (const RawAddress& address),
+              (override));
 };
 
 /**
diff --git a/system/bta/test/common/btm_api_mock.cc b/system/bta/test/common/btm_api_mock.cc
index bdecae2..935a930 100644
--- a/system/bta/test/common/btm_api_mock.cc
+++ b/system/bta/test/common/btm_api_mock.cc
@@ -100,3 +100,12 @@
   LOG_ASSERT(btm_interface) << "Mock btm interface not set!";
   return btm_interface->ConfigureDataPath(direction, path_id, vendor_config);
 }
+
+tBTM_INQ_INFO* BTM_InqDbFirst(void) {
+  LOG_ASSERT(btm_interface) << "Mock btm interface not set!";
+  return btm_interface->BTM_InqDbFirst();
+}
+tBTM_INQ_INFO* BTM_InqDbNext(tBTM_INQ_INFO* p_cur) {
+  LOG_ASSERT(btm_interface) << "Mock btm interface not set!";
+  return btm_interface->BTM_InqDbNext(p_cur);
+}
\ No newline at end of file
diff --git a/system/bta/test/common/btm_api_mock.h b/system/bta/test/common/btm_api_mock.h
index a9abd39..90c00e1 100644
--- a/system/bta/test/common/btm_api_mock.h
+++ b/system/bta/test/common/btm_api_mock.h
@@ -54,6 +54,8 @@
   virtual void AclDisconnectFromHandle(uint16_t handle, tHCI_STATUS reason) = 0;
   virtual void ConfigureDataPath(uint8_t direction, uint8_t path_id,
                                  std::vector<uint8_t> vendor_config) = 0;
+  virtual tBTM_INQ_INFO* BTM_InqDbFirst() = 0;
+  virtual tBTM_INQ_INFO* BTM_InqDbNext(tBTM_INQ_INFO* p_cur) = 0;
   virtual ~BtmInterface() = default;
 };
 
@@ -96,6 +98,9 @@
               (uint8_t direction, uint8_t path_id,
                std::vector<uint8_t> vendor_config),
               (override));
+  MOCK_METHOD((tBTM_INQ_INFO*), BTM_InqDbFirst, (), (override));
+  MOCK_METHOD((tBTM_INQ_INFO*), BTM_InqDbNext, (tBTM_INQ_INFO * p_cur),
+              (override));
 };
 
 /**
diff --git a/system/bta/test/common/mock_csis_client.h b/system/bta/test/common/mock_csis_client.h
index 33c106a..bd28233 100644
--- a/system/bta/test/common/mock_csis_client.h
+++ b/system/bta/test/common/mock_csis_client.h
@@ -33,6 +33,7 @@
               (override));
   MOCK_METHOD((std::vector<RawAddress>), GetDeviceList, (int group_id),
               (override));
+  MOCK_METHOD((int), GetDesiredSize, (int group_id), (override));
 
   /* Called from static methods */
   MOCK_METHOD((void), Initialize,
diff --git a/system/bta/vc/device.cc b/system/bta/vc/device.cc
index 290a2f7..33f509b 100644
--- a/system/bta/vc/device.cc
+++ b/system/bta/vc/device.cc
@@ -29,26 +29,27 @@
 
 using namespace bluetooth::vc::internal;
 
+void VolumeControlDevice::DeregisterNotifications(tGATT_IF gatt_if) {
+  if (volume_state_handle != 0)
+    BTA_GATTC_DeregisterForNotifications(gatt_if, address, volume_state_handle);
+
+  if (volume_flags_handle != 0)
+    BTA_GATTC_DeregisterForNotifications(gatt_if, address, volume_flags_handle);
+
+  for (const VolumeOffset& of : audio_offsets.volume_offsets) {
+    BTA_GATTC_DeregisterForNotifications(gatt_if, address,
+                                         of.audio_descr_handle);
+    BTA_GATTC_DeregisterForNotifications(gatt_if, address,
+                                         of.audio_location_handle);
+    BTA_GATTC_DeregisterForNotifications(gatt_if, address, of.state_handle);
+  }
+}
+
 void VolumeControlDevice::Disconnect(tGATT_IF gatt_if) {
   LOG(INFO) << __func__ << ": " << this->ToString();
 
   if (IsConnected()) {
-    if (volume_state_handle != 0)
-      BTA_GATTC_DeregisterForNotifications(gatt_if, address,
-                                           volume_state_handle);
-
-    if (volume_flags_handle != 0)
-      BTA_GATTC_DeregisterForNotifications(gatt_if, address,
-                                           volume_flags_handle);
-
-    for (const VolumeOffset& of : audio_offsets.volume_offsets) {
-      BTA_GATTC_DeregisterForNotifications(gatt_if, address,
-                                           of.audio_descr_handle);
-      BTA_GATTC_DeregisterForNotifications(gatt_if, address,
-                                           of.audio_location_handle);
-      BTA_GATTC_DeregisterForNotifications(gatt_if, address, of.state_handle);
-    }
-
+    DeregisterNotifications(gatt_if);
     BtaGattQueue::Clean(connection_id);
     BTA_GATTC_Close(connection_id);
     connection_id = GATT_INVALID_CONN_ID;
@@ -415,10 +416,8 @@
   return BTM_IsEncrypted(address, BT_TRANSPORT_LE);
 }
 
-bool VolumeControlDevice::EnableEncryption(tBTM_SEC_CALLBACK* callback) {
-  int result = BTM_SetEncryption(address, BT_TRANSPORT_LE, callback, nullptr,
+void VolumeControlDevice::EnableEncryption() {
+  int result = BTM_SetEncryption(address, BT_TRANSPORT_LE, nullptr, nullptr,
                                  BTM_BLE_SEC_ENCRYPT);
   LOG(INFO) << __func__ << ": result=" << +result;
-  // TODO: should we care about the result??
-  return true;
 }
diff --git a/system/bta/vc/devices.h b/system/bta/vc/devices.h
index dcf22b0..321a530 100644
--- a/system/bta/vc/devices.h
+++ b/system/bta/vc/devices.h
@@ -109,6 +109,8 @@
 
   void Disconnect(tGATT_IF gatt_if);
 
+  void DeregisterNotifications(tGATT_IF gatt_if);
+
   bool UpdateHandles(void);
 
   void ResetHandles(void);
@@ -130,13 +132,14 @@
                                         GATT_WRITE_OP_CB cb, void* cb_data);
   bool IsEncryptionEnabled();
 
-  bool EnableEncryption(tBTM_SEC_CALLBACK* callback);
+  void EnableEncryption();
 
   bool EnqueueInitialRequests(tGATT_IF gatt_if, GATT_READ_OP_CB chrc_read_cb,
                               GATT_WRITE_OP_CB cccd_write_cb);
   void EnqueueRemainingRequests(tGATT_IF gatt_if, GATT_READ_OP_CB chrc_read_cb,
                                 GATT_WRITE_OP_CB cccd_write_cb);
   bool VerifyReady(uint16_t handle);
+  bool IsReady() { return device_ready; }
 
  private:
   /*
diff --git a/system/bta/vc/vc.cc b/system/bta/vc/vc.cc
index 43d9ac1..196816e 100644
--- a/system/bta/vc/vc.cc
+++ b/system/bta/vc/vc.cc
@@ -102,9 +102,24 @@
       volume_control_devices_.Add(address, true);
     } else {
       device->connecting_actively = true;
+
+      if (device->IsConnected()) {
+        LOG(WARNING) << __func__ << ": address=" << address
+                     << ", connection_id=" << device->connection_id
+                     << " already connected.";
+
+        if (device->IsReady()) {
+          callbacks_->OnConnectionState(ConnectionState::CONNECTED,
+                                        device->address);
+        } else {
+          OnGattConnected(GATT_SUCCESS, device->connection_id, gatt_if_,
+                          device->address, BT_TRANSPORT_LE, GATT_MAX_MTU_SIZE);
+        }
+        return;
+      }
     }
 
-    BTA_GATTC_Open(gatt_if_, address, true, false);
+    BTA_GATTC_Open(gatt_if_, address, BTM_BLE_DIRECT_CONNECTION, false);
   }
 
   void AddFromStorage(const RawAddress& address, bool auto_connect) {
@@ -115,7 +130,7 @@
       volume_control_devices_.Add(address, false);
 
       /* Add device into BG connection to accept remote initiated connection */
-      BTA_GATTC_Open(gatt_if_, address, false, false);
+      BTA_GATTC_Open(gatt_if_, address, BTM_BLE_BKG_CONNECT_ALLOW_LIST, false);
     }
   }
 
@@ -145,9 +160,7 @@
       return;
     }
 
-    if (!device->EnableEncryption(enc_callback_static)) {
-      device_cleanup_helper(device, device->connecting_actively);
-    }
+    device->EnableEncryption();
   }
 
   void OnEncryptionComplete(const RawAddress& address, uint8_t success) {
@@ -184,6 +197,29 @@
     }
   }
 
+  void ClearDeviceInformationAndStartSearch(VolumeControlDevice* device) {
+    if (!device) {
+      LOG_ERROR("Device is null");
+      return;
+    }
+
+    LOG_INFO(": address=%s", device->address.ToString().c_str());
+    if (device->service_changed_rcvd) {
+      LOG_INFO("Device already is waiting for new services");
+      return;
+    }
+
+    std::vector<RawAddress> devices = {device->address};
+    device->DeregisterNotifications(gatt_if_);
+
+    RemovePendingVolumeControlOperations(devices,
+                                         bluetooth::groups::kGroupUnknown);
+    device->first_connection = true;
+    device->service_changed_rcvd = true;
+    BtaGattQueue::Clean(device->connection_id);
+    BTA_GATTC_ServiceSearchRequest(device->connection_id, &kVolumeControlUuid);
+  }
+
   void OnServiceChangeEvent(const RawAddress& address) {
     VolumeControlDevice* device =
         volume_control_devices_.FindByAddress(address);
@@ -191,10 +227,8 @@
       LOG(ERROR) << __func__ << "Skipping unknown device " << address;
       return;
     }
-    LOG(INFO) << __func__ << ": address=" << address;
-    device->first_connection = true;
-    device->service_changed_rcvd = true;
-    BtaGattQueue::Clean(device->connection_id);
+
+    ClearDeviceInformationAndStartSearch(device);
   }
 
   void OnServiceDiscDoneEvent(const RawAddress& address) {
@@ -251,7 +285,12 @@
     }
 
     if (status != GATT_SUCCESS) {
-      LOG(INFO) << __func__ << ": status=" << static_cast<int>(status);
+      LOG_INFO(": status=0x%02x", static_cast<int>(status));
+      if (status == GATT_DATABASE_OUT_OF_SYNC) {
+        LOG_INFO("Database out of sync for %s",
+                 device->address.ToString().c_str());
+        ClearDeviceInformationAndStartSearch(device);
+      }
       return;
     }
 
@@ -341,6 +380,13 @@
       }
     }
 
+    if (devices.empty() && (is_volume_change || is_mute_change)) {
+      LOG_INFO("No more devices in the group right now");
+      callbacks_->OnGroupVolumeStateChanged(group_id, device->volume,
+                                            device->mute, true);
+      return;
+    }
+
     if (is_volume_change) {
       std::vector<uint8_t> arg({device->volume});
       PrepareVolumeControlOperation(devices, group_id, true,
@@ -382,7 +428,11 @@
               << loghex(device->mute) << " change_counter "
               << loghex(device->change_counter);
 
-    if (!device->device_ready) return;
+    if (!device->IsReady()) {
+      LOG_INFO("Device: %s is not ready yet.",
+               device->address.ToString().c_str());
+      return;
+    }
 
     /* This is just a read, send single notification */
     if (!is_notification) {
@@ -455,7 +505,11 @@
               << " offset: " << loghex(offset->offset)
               << " counter: " << loghex(offset->change_counter);
 
-    if (!device->device_ready) return;
+    if (!device->IsReady()) {
+      LOG_INFO("Device: %s is not ready yet.",
+               device->address.ToString().c_str());
+      return;
+    }
 
     callbacks_->OnExtAudioOutVolumeOffsetChanged(device->address, offset->id,
                                                  offset->offset);
@@ -476,7 +530,11 @@
     LOG(INFO) << __func__ << "id " << loghex(offset->id) << "location "
               << loghex(offset->location);
 
-    if (!device->device_ready) return;
+    if (!device->IsReady()) {
+      LOG_INFO("Device: %s is not ready yet.",
+               device->address.ToString().c_str());
+      return;
+    }
 
     callbacks_->OnExtAudioOutLocationChanged(device->address, offset->id,
                                              offset->location);
@@ -507,7 +565,11 @@
 
     LOG(INFO) << __func__ << " " << description;
 
-    if (!device->device_ready) return;
+    if (!device->IsReady()) {
+      LOG_INFO("Device: %s is not ready yet.",
+               device->address.ToString().c_str());
+      return;
+    }
 
     callbacks_->OnExtAudioOutDescriptionChanged(device->address, offset->id,
                                                 std::move(description));
@@ -526,10 +588,15 @@
     }
 
     if (status != GATT_SUCCESS) {
-      LOG(ERROR) << __func__
-                 << "Failed to register for notification: " << loghex(handle)
-                 << " status: " << status;
-      device_cleanup_helper(device, true);
+      if (status == GATT_DATABASE_OUT_OF_SYNC) {
+        LOG_INFO("Database out of sync for %s, conn_id: 0x%04x",
+                 device->address.ToString().c_str(), connection_id);
+        ClearDeviceInformationAndStartSearch(device);
+      } else {
+        LOG_ERROR("Failed to register for notification: 0x%04x, status 0x%02x",
+                  handle, status);
+        device_cleanup_helper(device, true);
+      }
       return;
     }
 
@@ -576,16 +643,26 @@
       return;
     }
 
+    if (!device->IsConnected()) {
+      LOG(ERROR) << __func__
+                 << " Skipping disconnect of the already disconnected device, "
+                    "connection_id="
+                 << loghex(connection_id);
+      return;
+    }
+
     // If we get here, it means, device has not been exlicitly disconnected.
-    bool device_ready = device->device_ready;
+    bool device_ready = device->IsReady();
 
     device_cleanup_helper(device, device->connecting_actively);
 
     if (device_ready) {
-      volume_control_devices_.Add(remote_bda, true);
+      device->first_connection = true;
+      device->connecting_actively = true;
 
       /* Add device into BG connection to accept remote initiated connection */
-      BTA_GATTC_Open(gatt_if_, remote_bda, false, false);
+      BTA_GATTC_Open(gatt_if_, remote_bda, BTM_BLE_BKG_CONNECT_ALLOW_LIST,
+                     false);
     }
   }
 
@@ -612,6 +689,37 @@
     }
   }
 
+  void RemovePendingVolumeControlOperations(std::vector<RawAddress>& devices,
+                                            int group_id) {
+    for (auto op = ongoing_operations_.begin();
+         op != ongoing_operations_.end();) {
+      // We only remove operations that don't affect the mute field.
+      if (op->IsStarted() ||
+          (op->opcode_ != kControlPointOpcodeSetAbsoluteVolume &&
+           op->opcode_ != kControlPointOpcodeVolumeUp &&
+           op->opcode_ != kControlPointOpcodeVolumeDown)) {
+        op++;
+        continue;
+      }
+      if (group_id != bluetooth::groups::kGroupUnknown &&
+          op->group_id_ == group_id) {
+        op = ongoing_operations_.erase(op);
+        continue;
+      }
+      for (auto const& addr : devices) {
+        auto it = find(op->devices_.begin(), op->devices_.end(), addr);
+        if (it != op->devices_.end()) {
+          op->devices_.erase(it);
+        }
+      }
+      if (op->devices_.empty()) {
+        op = ongoing_operations_.erase(op);
+      } else {
+        op++;
+      }
+    }
+  }
+
   void OnWriteControlResponse(uint16_t connection_id, tGATT_STATUS status,
                               uint16_t handle, void* data) {
     VolumeControlDevice* device =
@@ -630,6 +738,12 @@
 
     /* In case of error, remove device from the tracking operation list */
     RemoveDeviceFromOperationList(device->address, PTR_TO_INT(data));
+
+    if (status == GATT_DATABASE_OUT_OF_SYNC) {
+      LOG_INFO("Database out of sync for %s",
+               device->address.ToString().c_str());
+      ClearDeviceInformationAndStartSearch(device);
+    }
   }
 
   static void operation_callback(void* data) {
@@ -701,17 +815,38 @@
     devices_control_point_helper(op->devices_, op->opcode_, &(op->arguments_));
   }
 
-  void PrepareVolumeControlOperation(std::vector<RawAddress>& devices,
+  void PrepareVolumeControlOperation(std::vector<RawAddress> devices,
                                      int group_id, bool is_autonomous,
                                      uint8_t opcode,
                                      std::vector<uint8_t>& arguments) {
-    DLOG(INFO) << __func__ << " num of devices: " << devices.size()
-               << " group_id: " << group_id
-               << " is_autonomous: " << is_autonomous << " opcode: " << +opcode
-               << " arg size: " << arguments.size();
+    LOG_DEBUG(
+        "num of devices: %zu, group_id: %d, is_autonomous: %s  opcode: %d, arg "
+        "size: %zu",
+        devices.size(), group_id, is_autonomous ? "true" : "false", +opcode,
+        arguments.size());
 
-    ongoing_operations_.emplace_back(latest_operation_id_++, group_id,
-                                     is_autonomous, opcode, arguments, devices);
+    if (std::find_if(ongoing_operations_.begin(), ongoing_operations_.end(),
+                     [opcode, &devices, &arguments](const VolumeOperation& op) {
+                       if (op.opcode_ != opcode) return false;
+                       if (!std::equal(op.arguments_.begin(),
+                                       op.arguments_.end(), arguments.begin()))
+                         return false;
+                       // Filter out all devices which have the exact operation
+                       // already scheduled
+                       devices.erase(
+                           std::remove_if(devices.begin(), devices.end(),
+                                          [&op](auto d) {
+                                            return find(op.devices_.begin(),
+                                                        op.devices_.end(),
+                                                        d) != op.devices_.end();
+                                          }),
+                           devices.end());
+                       return devices.empty();
+                     }) == ongoing_operations_.end()) {
+      ongoing_operations_.emplace_back(latest_operation_id_++, group_id,
+                                       is_autonomous, opcode, arguments,
+                                       devices);
+    }
   }
 
   void MuteUnmute(std::variant<RawAddress, int> addr_or_group_id, bool mute) {
@@ -720,13 +855,17 @@
     uint8_t opcode = mute ? kControlPointOpcodeMute : kControlPointOpcodeUnmute;
 
     if (std::holds_alternative<RawAddress>(addr_or_group_id)) {
-      LOG_DEBUG("Address: %s: ",
-                (std::get<RawAddress>(addr_or_group_id)).ToString().c_str());
-      std::vector<RawAddress> devices = {
-          std::get<RawAddress>(addr_or_group_id)};
-
-      PrepareVolumeControlOperation(devices, bluetooth::groups::kGroupUnknown,
-                                    false, opcode, arg);
+      VolumeControlDevice* dev = volume_control_devices_.FindByAddress(
+          std::get<RawAddress>(addr_or_group_id));
+      if (dev != nullptr) {
+        LOG_DEBUG("Address: %s: isReady: %s", dev->address.ToString().c_str(),
+                  dev->IsReady() ? "true" : "false");
+        if (dev->IsReady()) {
+          std::vector<RawAddress> devices = {dev->address};
+          PrepareVolumeControlOperation(
+              devices, bluetooth::groups::kGroupUnknown, false, opcode, arg);
+        }
+      }
     } else {
       /* Handle group change */
       auto group_id = std::get<int>(addr_or_group_id);
@@ -740,7 +879,7 @@
       auto devices = csis_api->GetDeviceList(group_id);
       for (auto it = devices.begin(); it != devices.end();) {
         auto dev = volume_control_devices_.FindByAddress(*it);
-        if (!dev || !dev->IsConnected()) {
+        if (!dev || !dev->IsReady()) {
           it = devices.erase(it);
         } else {
           it++;
@@ -777,12 +916,21 @@
     uint8_t opcode = kControlPointOpcodeSetAbsoluteVolume;
 
     if (std::holds_alternative<RawAddress>(addr_or_group_id)) {
-      DLOG(INFO) << __func__ << " " << std::get<RawAddress>(addr_or_group_id);
-      std::vector<RawAddress> devices = {
-          std::get<RawAddress>(addr_or_group_id)};
-
-      PrepareVolumeControlOperation(devices, bluetooth::groups::kGroupUnknown,
-                                    false, opcode, arg);
+      LOG_DEBUG("Address: %s: ",
+                std::get<RawAddress>(addr_or_group_id).ToString().c_str());
+      VolumeControlDevice* dev = volume_control_devices_.FindByAddress(
+          std::get<RawAddress>(addr_or_group_id));
+      if (dev != nullptr) {
+        LOG_DEBUG("Address: %s: isReady: %s", dev->address.ToString().c_str(),
+                  dev->IsReady() ? "true" : "false");
+        if (dev->IsReady() && (dev->volume != volume)) {
+          std::vector<RawAddress> devices = {dev->address};
+          RemovePendingVolumeControlOperations(
+              devices, bluetooth::groups::kGroupUnknown);
+          PrepareVolumeControlOperation(
+              devices, bluetooth::groups::kGroupUnknown, false, opcode, arg);
+        }
+      }
     } else {
       /* Handle group change */
       auto group_id = std::get<int>(addr_or_group_id);
@@ -796,7 +944,7 @@
       auto devices = csis_api->GetDeviceList(group_id);
       for (auto it = devices.begin(); it != devices.end();) {
         auto dev = volume_control_devices_.FindByAddress(*it);
-        if (!dev || !dev->IsConnected()) {
+        if (!dev || !dev->IsReady()) {
           it = devices.erase(it);
         } else {
           it++;
@@ -809,6 +957,7 @@
         return;
       }
 
+      RemovePendingVolumeControlOperations(devices, group_id);
       PrepareVolumeControlOperation(devices, group_id, false, opcode, arg);
     }
 
@@ -908,7 +1057,7 @@
   int latest_operation_id_;
 
   void verify_device_ready(VolumeControlDevice* device, uint16_t handle) {
-    if (device->device_ready) return;
+    if (device->IsReady()) return;
 
     // VerifyReady sets the device_ready flag if all remaining GATT operations
     // are completed
@@ -943,7 +1092,6 @@
     if (notify)
       callbacks_->OnConnectionState(ConnectionState::DISCONNECTED,
                                     device->address);
-    volume_control_devices_.Remove(device->address);
   }
 
   void devices_control_point_helper(std::vector<RawAddress>& devices,
@@ -1017,7 +1165,7 @@
 
       case BTA_GATTC_ENC_CMPL_CB_EVT: {
         uint8_t encryption_status;
-        if (!BTM_IsEncrypted(p_data->enc_cmpl.remote_bda, BT_TRANSPORT_LE)) {
+        if (BTM_IsEncrypted(p_data->enc_cmpl.remote_bda, BT_TRANSPORT_LE)) {
           encryption_status = BTM_SUCCESS;
         } else {
           encryption_status = BTM_FAILED_ON_SECURITY;
@@ -1042,11 +1190,6 @@
     if (instance) instance->gattc_callback(event, p_data);
   }
 
-  static void enc_callback_static(const RawAddress* address, tBT_TRANSPORT,
-                                  void*, tBTM_STATUS status) {
-    if (instance) instance->OnEncryptionComplete(*address, status);
-  }
-
   static void chrc_read_callback_static(uint16_t conn_id, tGATT_STATUS status,
                                         uint16_t handle, uint16_t len,
                                         uint8_t* value, void* data) {
diff --git a/system/bta/vc/vc_test.cc b/system/bta/vc/vc_test.cc
index 7225f59..ca1bb02 100644
--- a/system/bta/vc/vc_test.cc
+++ b/system/bta/vc/vc_test.cc
@@ -77,10 +77,12 @@
   MOCK_METHOD((void), OnDeviceAvailable,
               (const RawAddress& address, uint8_t num_offset), (override));
   MOCK_METHOD((void), OnVolumeStateChanged,
-              (const RawAddress& address, uint8_t volume, bool mute, bool isAutonomous),
+              (const RawAddress& address, uint8_t volume, bool mute,
+               bool isAutonomous),
               (override));
   MOCK_METHOD((void), OnGroupVolumeStateChanged,
-              (int group_id, uint8_t volume, bool mute, bool isAutonomous), (override));
+              (int group_id, uint8_t volume, bool mute, bool isAutonomous),
+              (override));
   MOCK_METHOD((void), OnExtAudioOutVolumeOffsetChanged,
               (const RawAddress& address, uint8_t ext_output_id,
                int16_t offset),
@@ -229,12 +231,15 @@
               return;
           }
 
+          if (do_not_respond_to_reads) return;
           cb(conn_id, GATT_SUCCESS, handle, value.size(), value.data(),
              cb_data);
         }));
   }
 
  protected:
+  bool do_not_respond_to_reads = false;
+
   void SetUp(void) override {
     bluetooth::manager::SetMockBtmInterface(&btm_interface);
     MockCsisClient::SetMockInstanceForTesting(&mock_csis_client_module_);
@@ -332,8 +337,10 @@
     ON_CALL(btm_interface, BTM_IsEncrypted(address, _))
         .WillByDefault(DoAll(Return(true)));
 
-    EXPECT_CALL(gatt_interface, Open(gatt_if, address, true, _));
+    EXPECT_CALL(gatt_interface,
+                Open(gatt_if, address, BTM_BLE_DIRECT_CONNECTION, _));
     VolumeControl::Get()->Connect(address);
+    Mock::VerifyAndClearExpectations(&gatt_interface);
   }
 
   void TestDisconnect(const RawAddress& address, uint16_t conn_id) {
@@ -343,6 +350,7 @@
       EXPECT_CALL(gatt_interface, CancelOpen(gatt_if, address, _));
     }
     VolumeControl::Get()->Disconnect(address);
+    Mock::VerifyAndClearExpectations(&gatt_interface);
   }
 
   void TestAddFromStorage(const RawAddress& address, bool auto_connect) {
@@ -351,7 +359,8 @@
         .WillByDefault(DoAll(Return(true)));
 
     if (auto_connect) {
-      EXPECT_CALL(gatt_interface, Open(gatt_if, address, false, _));
+      EXPECT_CALL(gatt_interface,
+                  Open(gatt_if, address, BTM_BLE_BKG_CONNECT_ALLOW_LIST, _));
     } else {
       EXPECT_CALL(gatt_interface, Open(gatt_if, address, _, _)).Times(0);
     }
@@ -436,19 +445,32 @@
     gatt_callback(BTA_GATTC_SEARCH_CMPL_EVT, (tBTA_GATTC*)&event_data);
   }
 
+  void GetEncryptionCompleteEvt(const RawAddress& bda) {
+    tBTA_GATTC cb_data{};
+
+    cb_data.enc_cmpl.client_if = gatt_if;
+    cb_data.enc_cmpl.remote_bda = bda;
+    gatt_callback(BTA_GATTC_ENC_CMPL_CB_EVT, &cb_data);
+  }
+
   void SetEncryptionResult(const RawAddress& address, bool success) {
     ON_CALL(btm_interface, BTM_IsEncrypted(address, _))
         .WillByDefault(DoAll(Return(false)));
-    EXPECT_CALL(btm_interface,
-                SetEncryption(address, _, NotNull(), _, BTM_BLE_SEC_ENCRYPT))
-        .WillOnce(Invoke(
-            [&success](const RawAddress& bd_addr, tBT_TRANSPORT transport,
-                       tBTM_SEC_CALLBACK* p_callback, void* p_ref_data,
-                       tBTM_BLE_SEC_ACT sec_act) -> tBTM_STATUS {
-              p_callback(&bd_addr, transport, p_ref_data,
-                         success ? BTM_SUCCESS : BTM_FAILED_ON_SECURITY);
+    ON_CALL(btm_interface, SetEncryption(address, _, _, _, BTM_BLE_SEC_ENCRYPT))
+        .WillByDefault(Invoke(
+            [&success, this](const RawAddress& bd_addr, tBT_TRANSPORT transport,
+                             tBTM_SEC_CALLBACK* p_callback, void* p_ref_data,
+                             tBTM_BLE_SEC_ACT sec_act) -> tBTM_STATUS {
+              if (p_callback) {
+                p_callback(&bd_addr, transport, p_ref_data,
+                           success ? BTM_SUCCESS : BTM_FAILED_ON_SECURITY);
+              }
+              GetEncryptionCompleteEvt(bd_addr);
               return BTM_SUCCESS;
             }));
+    EXPECT_CALL(btm_interface,
+                SetEncryption(address, _, _, _, BTM_BLE_SEC_ENCRYPT))
+        .Times(1);
   }
 
   void SetSampleDatabaseVCS(uint16_t conn_id) {
@@ -525,6 +547,55 @@
   TestAppUnregister();
 }
 
+TEST_F(VolumeControlTest, test_reconnect_after_interrupted_discovery) {
+  const RawAddress test_address = GetTestAddress(0);
+
+  // Initial connection - no callback calls yet as we want to disconnect in the
+  // middle
+  SetSampleDatabaseVOCS(1);
+  TestAppRegister();
+  TestConnect(test_address);
+  EXPECT_CALL(*callbacks,
+              OnConnectionState(ConnectionState::CONNECTED, test_address))
+      .Times(0);
+  EXPECT_CALL(*callbacks, OnDeviceAvailable(test_address, 2)).Times(0);
+  GetConnectedEvent(test_address, 1);
+  Mock::VerifyAndClearExpectations(callbacks.get());
+
+  // Remote disconnects in the middle of the service discovery
+  EXPECT_CALL(*callbacks,
+              OnConnectionState(ConnectionState::DISCONNECTED, test_address));
+  GetDisconnectedEvent(test_address, 1);
+  Mock::VerifyAndClearExpectations(callbacks.get());
+
+  // This time let the service discovery pass
+  ON_CALL(gatt_interface, ServiceSearchRequest(_, _))
+      .WillByDefault(Invoke(
+          [&](uint16_t conn_id, const bluetooth::Uuid* p_srvc_uuid) -> void {
+            if (*p_srvc_uuid == kVolumeControlUuid)
+              GetSearchCompleteEvent(conn_id);
+          }));
+
+  // Remote is being connected by another GATT client
+  EXPECT_CALL(*callbacks,
+              OnConnectionState(ConnectionState::CONNECTED, test_address));
+  EXPECT_CALL(*callbacks, OnDeviceAvailable(test_address, 2));
+  GetConnectedEvent(test_address, 1);
+  Mock::VerifyAndClearExpectations(callbacks.get());
+
+  // Request connect when the remote was already connected by another service
+  EXPECT_CALL(*callbacks, OnDeviceAvailable(test_address, 2)).Times(0);
+  EXPECT_CALL(*callbacks,
+              OnConnectionState(ConnectionState::CONNECTED, test_address));
+  VolumeControl::Get()->Connect(test_address);
+  // The GetConnectedEvent(test_address, 1); should not be triggered here, since
+  // GATT implementation will not send this event for the already connected
+  // device
+  Mock::VerifyAndClearExpectations(callbacks.get());
+
+  TestAppUnregister();
+}
+
 TEST_F(VolumeControlTest, test_add_from_storage) {
   TestAppRegister();
   TestAddFromStorage(GetTestAddress(0), true);
@@ -732,6 +803,46 @@
   TestAppUnregister();
 }
 
+TEST_F(VolumeControlTest, test_read_vcs_database_out_of_sync) {
+  const RawAddress test_address = GetTestAddress(0);
+  EXPECT_CALL(*callbacks, OnVolumeStateChanged(test_address, _, _, false));
+  std::vector<uint16_t> handles({0x0021});
+  uint16_t conn_id = 1;
+
+  SetSampleDatabase(conn_id);
+  TestAppRegister();
+  TestConnect(test_address);
+  GetConnectedEvent(test_address, conn_id);
+
+  EXPECT_CALL(gatt_queue, ReadCharacteristic(conn_id, _, _, _))
+      .WillRepeatedly(DoDefault());
+  for (auto const& handle : handles) {
+    EXPECT_CALL(gatt_queue, ReadCharacteristic(conn_id, handle, _, _))
+        .WillOnce(DoDefault());
+  }
+  GetSearchCompleteEvent(conn_id);
+
+  /* Simulate database change on the remote side. */
+  ON_CALL(gatt_queue, WriteCharacteristic(_, _, _, _, _, _))
+      .WillByDefault(
+          Invoke([this](uint16_t conn_id, uint16_t handle,
+                        std::vector<uint8_t> value, tGATT_WRITE_TYPE write_type,
+                        GATT_WRITE_OP_CB cb, void* cb_data) {
+            auto* svc = gatt::FindService(services_map[conn_id], handle);
+            if (svc == nullptr) return;
+
+            tGATT_STATUS status = GATT_DATABASE_OUT_OF_SYNC;
+            if (cb)
+              cb(conn_id, status, handle, value.size(), value.data(), cb_data);
+          }));
+
+  ON_CALL(gatt_interface, ServiceSearchRequest(_, _)).WillByDefault(Return());
+  EXPECT_CALL(gatt_interface, ServiceSearchRequest(_, _));
+  VolumeControl::Get()->SetVolume(test_address, 15);
+  Mock::VerifyAndClearExpectations(&gatt_interface);
+  TestAppUnregister();
+}
+
 class VolumeControlCallbackTest : public VolumeControlTest {
  protected:
   const RawAddress test_address = GetTestAddress(0);
@@ -913,10 +1024,37 @@
 };
 
 TEST_F(VolumeControlValueSetTest, test_set_volume) {
-  std::vector<uint8_t> expected_data({0x04, 0x00, 0x10});
-  EXPECT_CALL(gatt_queue, WriteCharacteristic(conn_id, 0x0024, expected_data,
-                                              GATT_WRITE, _, _));
+  ON_CALL(gatt_queue, WriteCharacteristic(conn_id, 0x0024, _, GATT_WRITE, _, _))
+      .WillByDefault([this](uint16_t conn_id, uint16_t handle,
+                            std::vector<uint8_t> value,
+                            tGATT_WRITE_TYPE write_type, GATT_WRITE_OP_CB cb,
+                            void* cb_data) {
+        std::vector<uint8_t> ntf_value({
+            value[2],                            // volume level
+            0,                                   // muted
+            static_cast<uint8_t>(value[1] + 1),  // change counter
+        });
+        GetNotificationEvent(0x0021, ntf_value);
+      });
+
+  const std::vector<uint8_t> vol_x10({0x04, 0x00, 0x10});
+  EXPECT_CALL(gatt_queue,
+              WriteCharacteristic(conn_id, 0x0024, vol_x10, GATT_WRITE, _, _))
+      .Times(1);
   VolumeControl::Get()->SetVolume(test_address, 0x10);
+
+  // Same volume level should not be applied twice
+  const std::vector<uint8_t> vol_x10_2({0x04, 0x01, 0x10});
+  EXPECT_CALL(gatt_queue,
+              WriteCharacteristic(conn_id, 0x0024, vol_x10_2, GATT_WRITE, _, _))
+      .Times(0);
+  VolumeControl::Get()->SetVolume(test_address, 0x10);
+
+  const std::vector<uint8_t> vol_x20({0x04, 0x01, 0x20});
+  EXPECT_CALL(gatt_queue,
+              WriteCharacteristic(conn_id, 0x0024, vol_x20, GATT_WRITE, _, _))
+      .Times(1);
+  VolumeControl::Get()->SetVolume(test_address, 0x20);
 }
 
 TEST_F(VolumeControlValueSetTest, test_mute) {
@@ -998,13 +1136,6 @@
     SetSampleDatabase(conn_id_2);
 
     TestAppRegister();
-
-    TestConnect(test_address_1);
-    GetConnectedEvent(test_address_1, conn_id_1);
-    GetSearchCompleteEvent(conn_id_1);
-    TestConnect(test_address_2);
-    GetConnectedEvent(test_address_2, conn_id_2);
-    GetSearchCompleteEvent(conn_id_2);
   }
 
   void TearDown(void) override {
@@ -1028,6 +1159,13 @@
 };
 
 TEST_F(VolumeControlCsis, test_set_volume) {
+  TestConnect(test_address_1);
+  GetConnectedEvent(test_address_1, conn_id_1);
+  GetSearchCompleteEvent(conn_id_1);
+  TestConnect(test_address_2);
+  GetConnectedEvent(test_address_2, conn_id_2);
+  GetSearchCompleteEvent(conn_id_2);
+
   /* Set value for the group */
   EXPECT_CALL(gatt_queue,
               WriteCharacteristic(conn_id_1, 0x0024, _, GATT_WRITE, _, _));
@@ -1037,21 +1175,93 @@
   VolumeControl::Get()->SetVolume(group_id, 10);
 
   /* Now inject notification and make sure callback is sent up to Java layer */
-  EXPECT_CALL(*callbacks, OnGroupVolumeStateChanged(group_id, 0x03, true, false));
+  EXPECT_CALL(*callbacks,
+              OnGroupVolumeStateChanged(group_id, 0x03, true, false));
 
   std::vector<uint8_t> value({0x03, 0x01, 0x02});
   GetNotificationEvent(conn_id_1, test_address_1, 0x0021, value);
   GetNotificationEvent(conn_id_2, test_address_2, 0x0021, value);
+
+  /* Verify exactly one operation with this exact value is queued for each
+   * device */
+  EXPECT_CALL(gatt_queue,
+              WriteCharacteristic(conn_id_1, 0x0024, _, GATT_WRITE, _, _))
+      .Times(1);
+  EXPECT_CALL(gatt_queue,
+              WriteCharacteristic(conn_id_2, 0x0024, _, GATT_WRITE, _, _))
+      .Times(1);
+  VolumeControl::Get()->SetVolume(test_address_1, 20);
+  VolumeControl::Get()->SetVolume(test_address_2, 20);
+  VolumeControl::Get()->SetVolume(test_address_1, 20);
+  VolumeControl::Get()->SetVolume(test_address_2, 20);
+
+  std::vector<uint8_t> value2({20, 0x00, 0x03});
+  GetNotificationEvent(conn_id_1, test_address_1, 0x0021, value2);
+  GetNotificationEvent(conn_id_2, test_address_2, 0x0021, value2);
+}
+
+TEST_F(VolumeControlCsis, test_set_volume_device_not_ready) {
+  /* Make sure we did not get responds to the initial reads,
+   * so that the device was not marked as ready yet.
+   */
+  do_not_respond_to_reads = true;
+
+  TestConnect(test_address_1);
+  GetConnectedEvent(test_address_1, conn_id_1);
+  GetSearchCompleteEvent(conn_id_1);
+  TestConnect(test_address_2);
+  GetConnectedEvent(test_address_2, conn_id_2);
+  GetSearchCompleteEvent(conn_id_2);
+
+  /* Set value for the group */
+  EXPECT_CALL(gatt_queue,
+              WriteCharacteristic(conn_id_1, 0x0024, _, GATT_WRITE, _, _))
+      .Times(0);
+  EXPECT_CALL(gatt_queue,
+              WriteCharacteristic(conn_id_2, 0x0024, _, GATT_WRITE, _, _))
+      .Times(0);
+
+  VolumeControl::Get()->SetVolume(group_id, 10);
 }
 
 TEST_F(VolumeControlCsis, autonomus_test_set_volume) {
+  TestConnect(test_address_1);
+  GetConnectedEvent(test_address_1, conn_id_1);
+  GetSearchCompleteEvent(conn_id_1);
+  TestConnect(test_address_2);
+  GetConnectedEvent(test_address_2, conn_id_2);
+  GetSearchCompleteEvent(conn_id_2);
+
   /* Now inject notification and make sure callback is sent up to Java layer */
-  EXPECT_CALL(*callbacks, OnGroupVolumeStateChanged(group_id, 0x03, false, true));
+  EXPECT_CALL(*callbacks,
+              OnGroupVolumeStateChanged(group_id, 0x03, false, true));
 
   std::vector<uint8_t> value({0x03, 0x00, 0x02});
   GetNotificationEvent(conn_id_1, test_address_1, 0x0021, value);
   GetNotificationEvent(conn_id_2, test_address_2, 0x0021, value);
 }
+
+TEST_F(VolumeControlCsis, autonomus_single_device_test_set_volume) {
+  TestConnect(test_address_1);
+  GetConnectedEvent(test_address_1, conn_id_1);
+  GetSearchCompleteEvent(conn_id_1);
+  TestConnect(test_address_2);
+  GetConnectedEvent(test_address_2, conn_id_2);
+  GetSearchCompleteEvent(conn_id_2);
+
+  /* Disconnect one device. */
+  EXPECT_CALL(*callbacks,
+              OnConnectionState(ConnectionState::DISCONNECTED, test_address_1));
+  GetDisconnectedEvent(test_address_1, conn_id_1);
+
+  /* Now inject notification and make sure callback is sent up to Java layer */
+  EXPECT_CALL(*callbacks,
+              OnGroupVolumeStateChanged(group_id, 0x03, false, true));
+
+  std::vector<uint8_t> value({0x03, 0x00, 0x02});
+  GetNotificationEvent(conn_id_2, test_address_2, 0x0021, value);
+}
+
 }  // namespace
 }  // namespace internal
 }  // namespace vc
diff --git a/system/btif/Android.bp b/system/btif/Android.bp
index 079d12c..ad0de3b 100644
--- a/system/btif/Android.bp
+++ b/system/btif/Android.bp
@@ -35,14 +35,11 @@
 
 cc_library {
     name: "libstatslog_bt",
+    defaults: ["fluoride_common_options"],
     host_supported: true,
     generated_sources: ["statslog_bt.cpp"],
     generated_headers: ["statslog_bt.h"],
     export_generated_headers: ["statslog_bt.h"],
-    cflags: [
-        "-Wall",
-        "-Werror",
-    ],
     shared_libs: [
         "libcutils",
     ],
@@ -105,7 +102,6 @@
         "co/bta_gatts_co.cc",
         // HAL layer
         "src/bluetooth.cc",
-        "src/bluetooth_data_migration.cc",
         // BTIF implementation
         "src/btif_a2dp.cc",
         "src/btif_a2dp_control.cc",
@@ -180,6 +176,7 @@
         "lib-bt-packets-base",
         "lib-bt-packets-avrcp",
         "libbt-audio-hal-interface",
+        "libcom.android.sysprop.bluetooth",
         "libaudio-a2dp-hw-utils",
     ],
     cflags: [
@@ -238,6 +235,7 @@
         "libFraunhoferAAC",
         "libg722codec",
         "liblc3",
+        "libopus",
         "libosi",
         "libudrv-uipc",
    ],
@@ -387,11 +385,131 @@
     ],
     static_libs: [
         "libbluetooth-types",
+        "libcom.android.sysprop.bluetooth",
         "libosi",
     ],
     cflags: ["-DBUILDCFG"],
 }
 
+cc_test {
+    name: "net_test_btif_hh",
+    host_supported: true,
+    defaults: [
+        "fluoride_defaults",
+        "mts_defaults",
+    ],
+    test_suites: ["device-tests"],
+    include_dirs: [
+        "frameworks/av/media/libaaudio/include",
+        "packages/modules/Bluetooth/system",
+        "packages/modules/Bluetooth/system/bta/dm",
+        "packages/modules/Bluetooth/system/bta/include",
+        "packages/modules/Bluetooth/system/bta/sys",
+        "packages/modules/Bluetooth/system/btif/avrcp",
+        "packages/modules/Bluetooth/system/btif/co",
+        "packages/modules/Bluetooth/system/btif/include",
+        "packages/modules/Bluetooth/system/device/include",
+        "packages/modules/Bluetooth/system/embdrv/sbc/decoder/include",
+        "packages/modules/Bluetooth/system/embdrv/sbc/encoder/include",
+        "packages/modules/Bluetooth/system/gd",
+        "packages/modules/Bluetooth/system/include",
+        "packages/modules/Bluetooth/system/internal_include",
+        "packages/modules/Bluetooth/system/stack/a2dp",
+        "packages/modules/Bluetooth/system/stack/avdt",
+        "packages/modules/Bluetooth/system/stack/btm",
+        "packages/modules/Bluetooth/system/stack/include",
+        "packages/modules/Bluetooth/system/stack/l2cap",
+        "packages/modules/Bluetooth/system/udrv/include",
+        "packages/modules/Bluetooth/system/utils/include",
+        "packages/modules/Bluetooth/system/vnd/include",
+        "system/libfmq/include",
+        "system/libhwbinder/include",
+        ],
+      srcs: [
+          ":LibBluetoothSources",
+          ":TestCommonMainHandler",
+          ":TestCommonMockFunctions",
+          ":TestMockAndroidHardware",
+          ":BtaDmSources",
+          ":TestMockBtaAg",
+          ":TestMockBtaAr",
+          ":TestMockBtaAv",
+          ":TestMockBtaCsis",
+          ":TestMockBtaGatt",
+          ":TestMockBtaGroups",
+          ":TestMockBtaHas",
+          ":TestMockBtaHd",
+          ":TestMockBtaHearingAid",
+          ":TestMockBtaHf",
+          ":TestMockBtaHh",
+          ":TestMockBtaJv",
+          ":TestMockBtaLeAudio",
+          ":TestMockBtaLeAudioHalVerifier",
+          ":TestMockBtaPan",
+          ":TestMockBtaSdp",
+          ":TestMockBtaSys",
+          ":TestMockBtaVc",
+          ":TestMockBtu",
+          ":TestMockBtcore",
+          ":TestMockCommon",
+          ":TestMockFrameworks",
+          ":TestMockHci",
+          ":TestMockMainShim",
+          ":TestMockOsi",
+          ":TestMockStack",
+          ":TestMockSystemLibfmq",
+          ":TestMockUdrv",
+          ":TestMockUtils",
+          "test/btif_hh_test.cc",
+      ],
+      generated_headers: [
+        "BluetoothGeneratedDumpsysDataSchema_h",
+        "BluetoothGeneratedPackets_h",
+      ],
+      header_libs: ["libbluetooth_headers"],
+      shared_libs: [
+          "android.hardware.bluetooth.audio@2.0",
+          "android.hardware.bluetooth.audio@2.1",
+          "libcrypto",
+          "libcutils",
+          "libhidlbase",
+          "liblog",
+          "libtinyxml2",
+      ],
+      whole_static_libs: [
+          "libbtif",
+      ],
+      static_libs: [
+          "android.hardware.bluetooth.a2dp@1.0",
+          "avrcp-target-service",
+          "libaudio-a2dp-hw-utils",
+          "libbluetooth-types",
+          "libbt-audio-hal-interface",
+          "libbt-stack",
+          "libbtdevice",
+          "lib-bt-packets",
+          "lib-bt-packets-avrcp",
+          "lib-bt-packets-base",
+          "libcom.android.sysprop.bluetooth",
+          "libc++fs",
+          "libflatbuffers-cpp",
+          "libgmock",
+      ],
+      cflags: ["-DBUILDCFG"],
+      target: {
+          android: {
+              shared_libs: [
+                  "libbinder_ndk",
+                  "android.hardware.bluetooth.audio-V2-ndk",
+              ],
+          },
+      },
+      sanitize: {
+        address: true,
+        cfi: true,
+        misc_undefined: ["bounds"],
+    },
+}
 // Cycle stack test
 cc_test {
     name: "net_test_btif_stack",
@@ -490,6 +608,7 @@
           "lib-bt-packets",
           "lib-bt-packets-avrcp",
           "lib-bt-packets-base",
+          "libcom.android.sysprop.bluetooth",
           "libc++fs",
           "libflatbuffers-cpp",
           "libgmock",
diff --git a/system/btif/co/bta_hh_co.cc b/system/btif/co/bta_hh_co.cc
index 764e519..ace8b0c 100644
--- a/system/btif/co/bta_hh_co.cc
+++ b/system/btif/co/bta_hh_co.cc
@@ -157,7 +157,12 @@
       if (p_dev->get_rpt_id_queue) {
         uint32_t* get_rpt_id = (uint32_t*)osi_malloc(sizeof(uint32_t));
         *get_rpt_id = ev.u.feature.id;
-        fixed_queue_enqueue(p_dev->get_rpt_id_queue, (void*)get_rpt_id);
+        auto ok = fixed_queue_try_enqueue(p_dev->get_rpt_id_queue, (void*)get_rpt_id);
+        if (!ok) {
+            LOG_ERROR("get_rpt_id_queue is full, dropping event %d", *get_rpt_id);
+            osi_free(get_rpt_id);
+            return -EFAULT;
+        }
       }
       if (ev.u.feature.rtype == UHID_FEATURE_REPORT)
         btif_hh_getreport(p_dev, BTHH_FEATURE_REPORT, ev.u.feature.rnum, 0);
@@ -196,7 +201,12 @@
       if (sent && p_dev->set_rpt_id_queue) {
         uint32_t* set_rpt_id = (uint32_t*)osi_malloc(sizeof(uint32_t));
         *set_rpt_id = ev.u.set_report.id;
-        fixed_queue_enqueue(p_dev->set_rpt_id_queue, (void*)set_rpt_id);
+        auto ok = fixed_queue_try_enqueue(p_dev->set_rpt_id_queue, (void*)set_rpt_id);
+        if (!ok) {
+            LOG_ERROR("set_rpt_id_queue is full, dropping event %d", *set_rpt_id);
+            osi_free(set_rpt_id);
+            return -EFAULT;
+        }
       }
       break;
     }
@@ -604,7 +614,7 @@
   // Send the HID set report reply to the kernel.
   if (p_dev->fd >= 0) {
     uint32_t* set_rpt_id =
-        (uint32_t*)fixed_queue_dequeue(p_dev->set_rpt_id_queue);
+        (uint32_t*)fixed_queue_try_dequeue(p_dev->set_rpt_id_queue);
     if (set_rpt_id) {
       struct uhid_event ev = {};
 
@@ -654,7 +664,11 @@
   // Send the HID report to the kernel.
   if (p_dev->fd >= 0 && p_dev->get_rpt_snt > 0 && p_dev->get_rpt_snt--) {
     uint32_t* get_rpt_id =
-        (uint32_t*)fixed_queue_dequeue(p_dev->get_rpt_id_queue);
+        (uint32_t*)fixed_queue_try_dequeue(p_dev->get_rpt_id_queue);
+    if (get_rpt_id == nullptr) {
+      APPL_TRACE_WARNING("%s: Error: UHID_GET_REPORT queue is empty", __func__);
+      return;
+    }
     memset(&ev, 0, sizeof(ev));
     ev.type = UHID_FEATURE_ANSWER;
     ev.u.feature_answer.id = *get_rpt_id;
diff --git a/system/btif/include/btif_a2dp_source.h b/system/btif/include/btif_a2dp_source.h
index f0b4b24..df20319 100644
--- a/system/btif/include/btif_a2dp_source.h
+++ b/system/btif/include/btif_a2dp_source.h
@@ -63,7 +63,7 @@
 
 // Shutdown the A2DP Source module.
 // This function should be called by the BTIF state machine to stop streaming.
-void btif_a2dp_source_shutdown(void);
+void btif_a2dp_source_shutdown(std::promise<void>);
 
 // Cleanup the A2DP Source module.
 // This function should be called by the BTIF state machine during graceful
diff --git a/system/btif/include/btif_av.h b/system/btif/include/btif_av.h
index 0a3095e..09c0e27 100644
--- a/system/btif/include/btif_av.h
+++ b/system/btif/include/btif_av.h
@@ -52,6 +52,11 @@
 void btif_av_stream_start(void);
 
 /**
+ * Start streaming with latency setting.
+ */
+void btif_av_stream_start_with_latency(bool use_latency_mode);
+
+/**
  * Stop streaming.
  *
  * @param peer_address the peer address or RawAddress::kEmpty to stop all peers
@@ -228,4 +233,11 @@
  */
 void btif_av_set_dynamic_audio_buffer_size(uint8_t dynamic_audio_buffer_size);
 
+/**
+ * Enable/disable the low latency
+ *
+ * @param is_low_latency to set
+ */
+void btif_av_set_low_latency(bool is_low_latency);
+
 #endif /* BTIF_AV_H */
diff --git a/system/btif/include/btif_bqr.h b/system/btif/include/btif_bqr.h
index 5afa713..b0778ab 100644
--- a/system/btif/include/btif_bqr.h
+++ b/system/btif/include/btif_bqr.h
@@ -49,6 +49,10 @@
 //     When the controller encounters an error it shall report Root Inflammation
 //     event indicating the error code to the host.
 //
+//   [Vendor Specific Quality]
+//     Used for the controller vendor to define the vendor proprietary quality
+//     event(s).
+//
 //   [LMP/LL message trace]
 //     The controller sends the LMP/LL message handshaking with the remote
 //     device to the host.
@@ -63,22 +67,28 @@
 //     just can autonomously report debug logging information via the Controller
 //     Debug Info sub-event to the host.
 //
+//   [Vendor Specific Trace]
+//     Used for the controller vendor to define the vendor proprietary trace(s).
+//
 
 // Bit masks for the selected quality event reporting.
 static constexpr uint32_t kQualityEventMaskAllOff = 0;
-static constexpr uint32_t kQualityEventMaskMonitorMode = 0x00000001;
-static constexpr uint32_t kQualityEventMaskApproachLsto = 0x00000002;
-static constexpr uint32_t kQualityEventMaskA2dpAudioChoppy = 0x00000004;
-static constexpr uint32_t kQualityEventMaskScoVoiceChoppy = 0x00000008;
-static constexpr uint32_t kQualityEventMaskRootInflammation = 0x00000010;
-static constexpr uint32_t kQualityEventMaskLmpMessageTrace = 0x00010000;
-static constexpr uint32_t kQualityEventMaskBtSchedulingTrace = 0x00020000;
-static constexpr uint32_t kQualityEventMaskControllerDbgInfo = 0x00040000;
+static constexpr uint32_t kQualityEventMaskMonitorMode = 0x1 << 0;
+static constexpr uint32_t kQualityEventMaskApproachLsto = 0x1 << 1;
+static constexpr uint32_t kQualityEventMaskA2dpAudioChoppy = 0x1 << 2;
+static constexpr uint32_t kQualityEventMaskScoVoiceChoppy = 0x1 << 3;
+static constexpr uint32_t kQualityEventMaskRootInflammation = 0x1 << 4;
+static constexpr uint32_t kQualityEventMaskVendorSpecificQuality = 0x1 << 15;
+static constexpr uint32_t kQualityEventMaskLmpMessageTrace = 0x1 << 16;
+static constexpr uint32_t kQualityEventMaskBtSchedulingTrace = 0x1 << 17;
+static constexpr uint32_t kQualityEventMaskControllerDbgInfo = 0x1 << 18;
+static constexpr uint32_t kQualityEventMaskVendorSpecificTrace = 0x1 << 31;
 static constexpr uint32_t kQualityEventMaskAll =
     kQualityEventMaskMonitorMode | kQualityEventMaskApproachLsto |
     kQualityEventMaskA2dpAudioChoppy | kQualityEventMaskScoVoiceChoppy |
-    kQualityEventMaskRootInflammation | kQualityEventMaskLmpMessageTrace |
-    kQualityEventMaskBtSchedulingTrace | kQualityEventMaskControllerDbgInfo;
+    kQualityEventMaskRootInflammation | kQualityEventMaskVendorSpecificQuality |
+    kQualityEventMaskLmpMessageTrace | kQualityEventMaskBtSchedulingTrace |
+    kQualityEventMaskControllerDbgInfo | kQualityEventMaskVendorSpecificTrace;
 // Define the minimum time interval (in ms) of quality event reporting for the
 // selected quality event(s). Controller Firmware should not report the next
 // event within the defined time interval.
@@ -152,9 +162,11 @@
   QUALITY_REPORT_ID_SCO_VOICE_CHOPPY = 0x04,
   QUALITY_REPORT_ID_ROOT_INFLAMMATION = 0x05,
   QUALITY_REPORT_ID_LE_AUDIO_CHOPPY = 0x07,
+  QUALITY_REPORT_ID_VENDOR_SPECIFIC_QUALITY = 0x10,
   QUALITY_REPORT_ID_LMP_LL_MESSAGE_TRACE = 0x11,
   QUALITY_REPORT_ID_BT_SCHEDULING_TRACE = 0x12,
-  QUALITY_REPORT_ID_CONTROLLER_DBG_INFO = 0x13
+  QUALITY_REPORT_ID_CONTROLLER_DBG_INFO = 0x13,
+  QUALITY_REPORT_ID_VENDOR_SPECIFIC_TRACE = 0x20,
 };
 
 // Packet Type definition
diff --git a/system/btif/include/btif_dm.h b/system/btif/include/btif_dm.h
index 5645992..20b6b06 100644
--- a/system/btif/include/btif_dm.h
+++ b/system/btif/include/btif_dm.h
@@ -74,6 +74,9 @@
 
 void btif_dm_clear_event_filter();
 
+void btif_dm_metadata_changed(const RawAddress& remote_bd_addr, int key,
+                              std::vector<uint8_t> value);
+
 /*callout for reading SMP properties from Text file*/
 bool btif_dm_get_smp_config(tBTE_APPL_CFG* p_cfg);
 
diff --git a/system/btif/include/btif_sock.h b/system/btif/include/btif_sock.h
index cb0378e..494782e 100644
--- a/system/btif/include/btif_sock.h
+++ b/system/btif/include/btif_sock.h
@@ -18,11 +18,35 @@
 
 #pragma once
 
-#include "btif_uid.h"
-
 #include <hardware/bt_sock.h>
 
+#include "btif_uid.h"
+#include "types/raw_address.h"
+
+enum {
+  SOCKET_CONNECTION_STATE_UNKNOWN,
+  // Socket acts as a server waiting for connection
+  SOCKET_CONNECTION_STATE_LISTENING,
+  // Socket acts as a client trying to connect
+  SOCKET_CONNECTION_STATE_CONNECTING,
+  // Socket is connected
+  SOCKET_CONNECTION_STATE_CONNECTED,
+  // Socket tries to disconnect from remote
+  SOCKET_CONNECTION_STATE_DISCONNECTING,
+  // This socket is closed
+  SOCKET_CONNECTION_STATE_DISCONNECTED,
+};
+
+enum {
+  SOCKET_ROLE_UNKNOWN,
+  SOCKET_ROLE_LISTEN,
+  SOCKET_ROLE_CONNECTION,
+};
+
 const btsock_interface_t* btif_sock_get_interface(void);
 
 bt_status_t btif_sock_init(uid_set_t* uid_set);
 void btif_sock_cleanup(void);
+
+void btif_sock_connection_logger(int state, int role, const RawAddress& addr);
+void btif_sock_dump(int fd);
diff --git a/system/btif/include/btif_storage.h b/system/btif/include/btif_storage.h
index 0d3225f..5ffb9da 100644
--- a/system/btif/include/btif_storage.h
+++ b/system/btif/include/btif_storage.h
@@ -285,6 +285,25 @@
 void btif_storage_set_leaudio_autoconnect(const RawAddress& addr,
                                           bool autoconnect);
 
+/** Store PACs information */
+void btif_storage_leaudio_update_pacs_bin(const RawAddress& addr);
+
+/** Store ASEs information */
+void btif_storage_leaudio_update_ase_bin(const RawAddress& addr);
+
+/** Store Handles information */
+void btif_storage_leaudio_update_handles_bin(const RawAddress& addr);
+
+/** Store Le Audio device audio locations */
+void btif_storage_set_leaudio_audio_location(const RawAddress& addr,
+                                             uint32_t sink_location,
+                                             uint32_t source_location);
+
+/** Store Le Audio device context types */
+void btif_storage_set_leaudio_supported_context_types(
+    const RawAddress& addr, uint16_t sink_supported_context_type,
+    uint16_t source_supported_context_type);
+
 /** Remove Le Audio device from the storage */
 void btif_storage_remove_leaudio(const RawAddress& address);
 
diff --git a/system/btif/src/bluetooth.cc b/system/btif/src/bluetooth.cc
index 58d6da0..9e089f7 100644
--- a/system/btif/src/bluetooth.cc
+++ b/system/btif/src/bluetooth.cc
@@ -58,6 +58,7 @@
 #include "bta/include/bta_le_audio_broadcaster_api.h"
 #include "bta/include/bta_vc_api.h"
 #include "btif/avrcp/avrcp_service.h"
+#include "btif/include/btif_sock.h"
 #include "btif/include/stack_manager.h"
 #include "btif_a2dp.h"
 #include "btif_activity_attribution.h"
@@ -172,25 +173,17 @@
  *
  ****************************************************************************/
 
-const std::vector<std::string> get_allowed_bt_package_name(void);
-void handle_migration(const std::string& dst,
-                      const std::vector<std::string>& allowed_bt_package_name);
-
 static int init(bt_callbacks_t* callbacks, bool start_restricted,
                 bool is_common_criteria_mode, int config_compare_result,
                 const char** init_flags, bool is_atv,
                 const char* user_data_directory) {
+  (void)user_data_directory;
   LOG_INFO(
       "%s: start restricted = %d ; common criteria mode = %d, config compare "
       "result = %d",
       __func__, start_restricted, is_common_criteria_mode,
       config_compare_result);
 
-  if (user_data_directory != nullptr) {
-    handle_migration(std::string(user_data_directory),
-                     get_allowed_bt_package_name());
-  }
-
   bluetooth::common::InitFlags::Load(init_flags);
 
   if (interface_ready()) return BT_STATUS_DONE;
@@ -442,6 +435,7 @@
   btif_debug_av_dump(fd);
   bta_debug_av_dump(fd);
   stack_debug_avdtp_api_dump(fd);
+  btif_sock_dump(fd);
   bluetooth::avrcp::AvrcpService::DebugDump(fd);
   btif_debug_config_dump(fd);
   BTA_HfClientDumpStatistics(fd);
@@ -648,6 +642,18 @@
   return true;
 }
 
+static void metadata_changed(const RawAddress& remote_bd_addr, int key,
+                             std::vector<uint8_t> value) {
+  if (!interface_ready()) {
+    LOG_ERROR("Interface not ready!");
+    return;
+  }
+
+  do_in_main_thread(
+      FROM_HERE, base::BindOnce(btif_dm_metadata_changed, remote_bd_addr, key,
+                                std::move(value)));
+}
+
 EXPORT_SYMBOL bt_interface_t bluetoothInterface = {
     sizeof(bluetoothInterface),
     init,
@@ -688,7 +694,8 @@
     set_dynamic_audio_buffer_size,
     generate_local_oob_data,
     allow_low_latency_audio,
-    clear_event_filter};
+    clear_event_filter,
+    metadata_changed};
 
 // callback reporting helpers
 
diff --git a/system/btif/src/bluetooth_data_migration.cc b/system/btif/src/bluetooth_data_migration.cc
deleted file mode 100644
index 45d0bda..0000000
--- a/system/btif/src/bluetooth_data_migration.cc
+++ /dev/null
@@ -1,126 +0,0 @@
-/******************************************************************************
- *
- *  Copyright 2022 Google LLC
- *
- *  Licensed under the Apache License, Version 2.0 (the "License");
- *  you may not use this file except in compliance with the License.
- *  You may obtain a copy of the License at:
- *
- *  http://www.apache.org/licenses/LICENSE-2.0
- *
- *  Unless required by applicable law or agreed to in writing, software
- *  distributed under the License is distributed on an "AS IS" BASIS,
- *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- *  See the License for the specific language governing permissions and
- *  limitations under the License.
- *
- ******************************************************************************/
-
-#include <base/logging.h>
-
-#include <filesystem>
-#include <string>
-#include <vector>
-
-namespace fs = std::filesystem;
-
-// The user data should be stored in the subdirectory of |USER_DE_PATH|
-static const std::string USER_DE_PATH = "/data/user_de/0";
-
-// The migration process start only if |MIGRATION_FILE_CHECKER| is found in a
-// previous location
-static const std::string MIGRATION_FILE_CHECKER = "databases/bluetooth_db";
-
-// List of possible package_name for bluetooth to get the data from / to
-static const std::vector<std::string> ALLOWED_BT_PACKAGE_NAME = {
-    "com.android.bluetooth",                  // legacy name
-    "com.android.bluetooth.services",         // Beta users
-    "com.google.android.bluetooth.services",  // Droid fooder users
-};
-
-// Accessor to get the default allowed package list to be used in migration
-// OEM can call their own method with their own allowed list
-const std::vector<std::string> get_allowed_bt_package_name(void) {
-  return ALLOWED_BT_PACKAGE_NAME;
-}
-
-// Check if |dst| is in |base_dir| subdirectory and check the package name in
-// |dst| is a allowed package name in the |pkg_list|
-//
-// Return an empty string if an issue occurred
-// or the package name contained in |dst| on success
-static std::string parse_destination_package_name(
-    const std::string& dst, const std::string& base_dir,
-    const std::vector<std::string>& pkg_list) {
-  const std::size_t found = dst.rfind("/");
-  // |dst| must contain a '/'
-  if (found == std::string::npos) {
-    LOG(ERROR) << "Destination format not valid " << dst;
-    return "";
-  }
-  // |dst| directory is supposed to be in |base_dir|
-  if (found != base_dir.length()) {
-    LOG(ERROR) << "Destination location not allowed: " << dst;
-    return "";
-  }
-  // This check prevent a '/' to be at the end of |dst|
-  if (found >= dst.length() - 1) {
-    LOG(ERROR) << "Destination format not valid " << dst;
-    return "";
-  }
-
-  const std::string dst_package_name = dst.substr(found + 1);  // +1 for '/'
-
-  if (std::find(pkg_list.begin(), pkg_list.end(), dst_package_name) ==
-      pkg_list.end()) {
-    LOG(ERROR) << "Destination package_name not valid: " << dst_package_name
-               << " Created from " << dst;
-    return "";
-  }
-  LOG(INFO) << "Current Bluetooth package name is: " << dst_package_name;
-  return dst_package_name;
-}
-
-// Check for data to migrate from the |allowed_bt_package_name|
-// A migration will be performed if:
-// * |dst| is different than |allowed_bt_package_name|
-// * the following file is found:
-//    |USER_DE_PATH|/|allowed_bt_package_name|/|MIGRATION_FILE_CHECKER|
-//
-// After migration occurred, the |MIGRATION_FILE_CHECKER| is deleted to ensure
-// the migration is only performed once
-void handle_migration(const std::string& dst,
-                      const std::vector<std::string>& allowed_bt_package_name) {
-  const std::string dst_package_name = parse_destination_package_name(
-      dst, USER_DE_PATH, allowed_bt_package_name);
-  if (dst_package_name.empty()) return;
-
-  for (const auto& pkg_name : allowed_bt_package_name) {
-    std::error_code error;
-
-    if (dst_package_name == pkg_name) {
-      LOG(INFO) << "Same location skipped: " << dst_package_name;
-      continue;
-    }
-    const fs::path dst_path = dst;
-    const fs::path pkg_path = USER_DE_PATH + "/" + pkg_name;
-    const fs::path local_migration_file_checker =
-        pkg_path.string() + "/" + MIGRATION_FILE_CHECKER;
-    if (!fs::exists(local_migration_file_checker, error)) {
-      LOG(INFO) << "Not a valid candidate for migration: " << pkg_path;
-      continue;
-    }
-
-    const fs::copy_options copy_flag =
-        fs::copy_options::overwrite_existing | fs::copy_options::recursive;
-    fs::copy(pkg_path, dst_path, copy_flag, error);
-
-    if (error) {
-      LOG(ERROR) << "Migration failed: " << error.message();
-    } else {
-      fs::remove(local_migration_file_checker);
-      LOG(INFO) << "Migration completed from " << pkg_path << " to " << dst;
-    }
-    break;  // Copy from one and only one directory
-  }
-}
diff --git a/system/btif/src/btif_a2dp_sink.cc b/system/btif/src/btif_a2dp_sink.cc
index 665965a..9d52524 100644
--- a/system/btif/src/btif_a2dp_sink.cc
+++ b/system/btif/src/btif_a2dp_sink.cc
@@ -386,8 +386,8 @@
       break;
   }
 
-  osi_free(p_msg);
   LOG_VERBOSE("%s: %s DONE", __func__, dump_media_event(p_msg->event));
+  osi_free(p_msg);
 }
 
 void btif_a2dp_sink_update_decoder(const uint8_t* p_codec_info) {
diff --git a/system/btif/src/btif_a2dp_source.cc b/system/btif/src/btif_a2dp_source.cc
index f13abac..4ca2c8c 100644
--- a/system/btif/src/btif_a2dp_source.cc
+++ b/system/btif/src/btif_a2dp_source.cc
@@ -30,6 +30,7 @@
 #include <string.h>
 
 #include <algorithm>
+#include <future>
 
 #include "audio_a2dp_hw/include/audio_a2dp_hw.h"
 #include "audio_hal_interface/a2dp_encoding.h"
@@ -242,7 +243,7 @@
     const RawAddress& peer_address, std::promise<void> start_session_promise);
 static void btif_a2dp_source_end_session_delayed(
     const RawAddress& peer_address);
-static void btif_a2dp_source_shutdown_delayed(void);
+static void btif_a2dp_source_shutdown_delayed(std::promise<void>);
 static void btif_a2dp_source_cleanup_delayed(void);
 static void btif_a2dp_source_audio_tx_start_event(void);
 static void btif_a2dp_source_audio_tx_stop_event(void);
@@ -483,7 +484,7 @@
   }
 }
 
-void btif_a2dp_source_shutdown(void) {
+void btif_a2dp_source_shutdown(std::promise<void> shutdown_complete_promise) {
   LOG_INFO("%s: state=%s", __func__, btif_a2dp_source_cb.StateStr().c_str());
 
   if ((btif_a2dp_source_cb.State() == BtifA2dpSource::kStateOff) ||
@@ -495,10 +496,12 @@
   btif_a2dp_source_cb.SetState(BtifA2dpSource::kStateShuttingDown);
 
   btif_a2dp_source_thread.DoInThread(
-      FROM_HERE, base::Bind(&btif_a2dp_source_shutdown_delayed));
+      FROM_HERE, base::BindOnce(&btif_a2dp_source_shutdown_delayed,
+                                std::move(shutdown_complete_promise)));
 }
 
-static void btif_a2dp_source_shutdown_delayed(void) {
+static void btif_a2dp_source_shutdown_delayed(
+    std::promise<void> shutdown_complete_promise) {
   LOG_INFO("%s: state=%s", __func__, btif_a2dp_source_cb.StateStr().c_str());
 
   // Stop the timer
@@ -514,13 +517,16 @@
   btif_a2dp_source_cb.tx_audio_queue = nullptr;
 
   btif_a2dp_source_cb.SetState(BtifA2dpSource::kStateOff);
+
+  shutdown_complete_promise.set_value();
 }
 
 void btif_a2dp_source_cleanup(void) {
   LOG_INFO("%s: state=%s", __func__, btif_a2dp_source_cb.StateStr().c_str());
 
   // Make sure the source is shutdown
-  btif_a2dp_source_shutdown();
+  std::promise<void> shutdown_complete_promise;
+  btif_a2dp_source_shutdown(std::move(shutdown_complete_promise));
 
   btif_a2dp_source_thread.DoInThread(
       FROM_HERE, base::Bind(&btif_a2dp_source_cleanup_delayed));
diff --git a/system/btif/src/btif_av.cc b/system/btif/src/btif_av.cc
index 8ae8db8..b05ed16 100644
--- a/system/btif/src/btif_av.cc
+++ b/system/btif/src/btif_av.cc
@@ -26,6 +26,7 @@
 #include <frameworks/proto_logging/stats/enums/bluetooth/a2dp/enums.pb.h>
 #include <frameworks/proto_logging/stats/enums/bluetooth/enums.pb.h>
 
+#include <chrono>
 #include <cstdint>
 #include <future>
 #include <memory>
@@ -52,6 +53,7 @@
 #include "main/shim/dumpsys.h"
 #include "osi/include/allocator.h"
 #include "osi/include/properties.h"
+#include "stack/include/avrc_api.h"
 #include "stack/include/bt_hdr.h"
 #include "stack/include/btm_api.h"
 #include "stack/include/btu.h"  // do_in_main_thread
@@ -80,6 +82,14 @@
   RawAddress peer_address;
 } btif_av_sink_config_req_t;
 
+typedef struct {
+  bool use_latency_mode;
+} btif_av_start_stream_req_t;
+
+typedef struct {
+  bool is_low_latency;
+} btif_av_set_latency_req_t;
+
 /**
  * BTIF AV events
  */
@@ -96,6 +106,7 @@
   BTIF_AV_AVRCP_OPEN_EVT,
   BTIF_AV_AVRCP_CLOSE_EVT,
   BTIF_AV_AVRCP_REMOTE_PLAY_EVT,
+  BTIF_AV_SET_LATENCY_REQ_EVT,
 } btif_av_sm_event_t;
 
 class BtifAvEvent {
@@ -340,6 +351,11 @@
   bool SelfInitiatedConnection() const { return self_initiated_connection_; }
   void SetSelfInitiatedConnection(bool v) { self_initiated_connection_ = v; }
 
+  bool UseLatencyMode() const { return use_latency_mode_; }
+  void SetUseLatencyMode(bool use_latency_mode) {
+    use_latency_mode_ = use_latency_mode;
+  }
+
  private:
   const RawAddress peer_address_;
   const uint8_t peer_sep_;  // SEP type of peer device
@@ -353,6 +369,7 @@
   bool is_silenced_;
   uint16_t delay_report_;
   bool mandatory_codec_preferred_ = false;
+  bool use_latency_mode_ = false;
 };
 
 class BtifAvSource {
@@ -485,7 +502,15 @@
                      << ": unable to set active peer to empty in BtaAvCo";
       }
       btif_a2dp_source_end_session(active_peer_);
-      btif_a2dp_source_shutdown();
+      std::promise<void> shutdown_complete_promise;
+      std::future<void> shutdown_complete_future =
+          shutdown_complete_promise.get_future();
+      btif_a2dp_source_shutdown(std::move(shutdown_complete_promise));
+      using namespace std::chrono_literals;
+      if (shutdown_complete_future.wait_for(1s) ==
+          std::future_status::timeout) {
+        LOG_ERROR("Timed out waiting for A2DP source shutdown to complete.");
+      }
       active_peer_ = peer_address;
       peer_ready_promise.set_value();
       return true;
@@ -769,11 +794,16 @@
     CASE_RETURN_STR(BTIF_AV_AVRCP_OPEN_EVT)
     CASE_RETURN_STR(BTIF_AV_AVRCP_CLOSE_EVT)
     CASE_RETURN_STR(BTIF_AV_AVRCP_REMOTE_PLAY_EVT)
+    CASE_RETURN_STR(BTIF_AV_SET_LATENCY_REQ_EVT)
     default:
       return "UNKNOWN_EVENT";
   }
 }
 
+const char* dump_av_sm_event_name(int event) {
+  return dump_av_sm_event_name(static_cast<btif_av_sm_event_t>(event));
+}
+
 BtifAvEvent::BtifAvEvent(uint32_t event, const void* p_data, size_t data_length)
     : event_(event), data_(nullptr), data_length_(0) {
   DeepCopy(event, p_data, data_length);
@@ -1908,14 +1938,22 @@
     case BTIF_AV_ACL_DISCONNECTED:
       break;  // Ignore
 
-    case BTIF_AV_START_STREAM_REQ_EVT:
+    case BTIF_AV_START_STREAM_REQ_EVT: {
       LOG_INFO("%s: Peer %s : event=%s flags=%s", __PRETTY_FUNCTION__,
                peer_.PeerAddress().ToString().c_str(),
                BtifAvEvent::EventName(event).c_str(),
                peer_.FlagsToString().c_str());
-      BTA_AvStart(peer_.BtaHandle());
+      if (p_data) {
+        const btif_av_start_stream_req_t* p_start_steam_req =
+            static_cast<const btif_av_start_stream_req_t*>(p_data);
+        LOG_INFO("Stream use_latency_mode=%s",
+                 p_start_steam_req->use_latency_mode ? "true" : "false");
+        peer_.SetUseLatencyMode(p_start_steam_req->use_latency_mode);
+      }
+
+      BTA_AvStart(peer_.BtaHandle(), peer_.UseLatencyMode());
       peer_.SetFlags(BtifAvPeer::kFlagPendingStart);
-      break;
+    } break;
 
     case BTA_AV_START_EVT: {
       LOG_INFO(
@@ -2039,7 +2077,7 @@
         LOG(INFO) << __PRETTY_FUNCTION__ << " : Peer " << peer_.PeerAddress()
                   << " : Reconfig done - calling BTA_AvStart("
                   << loghex(peer_.BtaHandle()) << ")";
-        BTA_AvStart(peer_.BtaHandle());
+        BTA_AvStart(peer_.BtaHandle(), peer_.UseLatencyMode());
       }
       break;
 
@@ -2070,6 +2108,18 @@
 
       CHECK_RC_EVENT(event, (tBTA_AV*)p_data);
 
+    case BTIF_AV_SET_LATENCY_REQ_EVT: {
+      const btif_av_set_latency_req_t* p_set_latency_req =
+          static_cast<const btif_av_set_latency_req_t*>(p_data);
+      LOG_INFO("Peer %s : event=%s flags=%s is_low_latency=%s",
+               peer_.PeerAddress().ToString().c_str(),
+               BtifAvEvent::EventName(event).c_str(),
+               peer_.FlagsToString().c_str(),
+               p_set_latency_req->is_low_latency ? "true" : "false");
+
+      BTA_AvSetLatency(peer_.BtaHandle(), p_set_latency_req->is_low_latency);
+    } break;
+
     default:
       BTIF_TRACE_WARNING("%s: Peer %s : Unhandled event=%s",
                          __PRETTY_FUNCTION__,
@@ -2273,6 +2323,18 @@
       btif_a2dp_on_offload_started(peer_.PeerAddress(), p_av->status);
       break;
 
+    case BTIF_AV_SET_LATENCY_REQ_EVT: {
+      const btif_av_set_latency_req_t* p_set_latency_req =
+          static_cast<const btif_av_set_latency_req_t*>(p_data);
+      LOG_INFO("Peer %s : event=%s flags=%s is_low_latency=%s",
+               peer_.PeerAddress().ToString().c_str(),
+               BtifAvEvent::EventName(event).c_str(),
+               peer_.FlagsToString().c_str(),
+               p_set_latency_req->is_low_latency ? "true" : "false");
+
+      BTA_AvSetLatency(peer_.BtaHandle(), p_set_latency_req->is_low_latency);
+    } break;
+
       CHECK_RC_EVENT(event, (tBTA_AV*)p_data);
 
     default:
@@ -3117,6 +3179,24 @@
                                    BTIF_AV_START_STREAM_REQ_EVT);
 }
 
+void btif_av_stream_start_with_latency(bool use_latency_mode) {
+  LOG_INFO("%s", __func__);
+
+  btif_av_start_stream_req_t start_stream_req;
+  start_stream_req.use_latency_mode = use_latency_mode;
+  BtifAvEvent btif_av_event(BTIF_AV_START_STREAM_REQ_EVT, &start_stream_req,
+                            sizeof(start_stream_req));
+  LOG_INFO("peer_address=%s event=%s use_latency_mode=%s",
+           btif_av_source_active_peer().ToString().c_str(),
+           btif_av_event.ToString().c_str(),
+           use_latency_mode ? "true" : "false");
+
+  do_in_main_thread(FROM_HERE, base::Bind(&btif_av_handle_event,
+                                          AVDT_TSEP_SNK,  // peer_sep
+                                          btif_av_source_active_peer(),
+                                          kBtaHandleUnknown, btif_av_event));
+}
+
 void src_do_suspend_in_main_thread(btif_av_sm_event_t event) {
   if (event != BTIF_AV_SUSPEND_STREAM_REQ_EVT &&
       event != BTIF_AV_STOP_STREAM_REQ_EVT)
@@ -3262,9 +3342,10 @@
       features |= BTA_AV_FEAT_DELAY_RPT;
     }
 
-#if (AVRC_ADV_CTRL_INCLUDED == TRUE)
-    features |= BTA_AV_FEAT_RCCT | BTA_AV_FEAT_ADV_CTRL | BTA_AV_FEAT_BROWSE;
-#endif
+    if (avrcp_absolute_volume_is_enabled()) {
+      features |= BTA_AV_FEAT_RCCT | BTA_AV_FEAT_ADV_CTRL | BTA_AV_FEAT_BROWSE;
+    }
+
     BTA_AvEnable(features, bta_av_source_callback);
     btif_av_source.RegisterAllBtaHandles();
     return BT_STATUS_SUCCESS;
@@ -3534,3 +3615,19 @@
 void btif_av_set_dynamic_audio_buffer_size(uint8_t dynamic_audio_buffer_size) {
   btif_a2dp_source_set_dynamic_audio_buffer_size(dynamic_audio_buffer_size);
 }
+
+void btif_av_set_low_latency(bool is_low_latency) {
+  LOG_INFO("is_low_latency: %s", is_low_latency ? "true" : "false");
+
+  btif_av_set_latency_req_t set_latency_req;
+  set_latency_req.is_low_latency = is_low_latency;
+  BtifAvEvent btif_av_event(BTIF_AV_SET_LATENCY_REQ_EVT, &set_latency_req,
+                            sizeof(set_latency_req));
+  LOG_INFO("peer_address=%s event=%s",
+           btif_av_source_active_peer().ToString().c_str(),
+           btif_av_event.ToString().c_str());
+  do_in_main_thread(FROM_HERE, base::Bind(&btif_av_handle_event,
+                                          AVDT_TSEP_SNK,  // peer_sep
+                                          btif_av_source_active_peer(),
+                                          kBtaHandleUnknown, btif_av_event));
+}
diff --git a/system/btif/src/btif_config.cc b/system/btif/src/btif_config.cc
index 4b99365..a777ba8 100644
--- a/system/btif/src/btif_config.cc
+++ b/system/btif/src/btif_config.cc
@@ -112,7 +112,7 @@
     metrics_salt.fill(0);
   }
   if (!AddressObfuscator::IsSaltValid(metrics_salt)) {
-    LOG(INFO) << __func__ << ": Metrics salt is not invalid, creating new one";
+    LOG(INFO) << __func__ << ": Metrics salt is invalid, creating new one";
     if (RAND_bytes(metrics_salt.data(), metrics_salt.size()) != 1) {
       LOG(FATAL) << __func__ << "Failed to generate salt for metrics";
     }
diff --git a/system/btif/src/btif_config_cache.cc b/system/btif/src/btif_config_cache.cc
index e66dc67..160ede4 100644
--- a/system/btif/src/btif_config_cache.cc
+++ b/system/btif/src/btif_config_cache.cc
@@ -171,10 +171,9 @@
 
 void BtifConfigCache::SetString(std::string section_name, std::string key,
                                 std::string value) {
-  if (trim_new_line(section_name) || trim_new_line(key) ||
-      trim_new_line(value)) {
-    android_errorWriteLog(0x534e4554, "70808273");
-  }
+  trim_new_line(section_name);
+  trim_new_line(key);
+  trim_new_line(value);
   if (section_name.empty()) {
     LOG(FATAL) << "Empty section not allowed";
     return;
diff --git a/system/btif/src/btif_dm.cc b/system/btif/src/btif_dm.cc
index ee6c2f2..9b0569d 100644
--- a/system/btif/src/btif_dm.cc
+++ b/system/btif/src/btif_dm.cc
@@ -75,6 +75,7 @@
 #include "btif_sdp.h"
 #include "btif_storage.h"
 #include "btif_util.h"
+#include "common/lru.h"
 #include "common/metrics.h"
 #include "device/include/controller.h"
 #include "device/include/interop.h"
@@ -107,10 +108,9 @@
 const Uuid UUID_HAS = Uuid::FromString("1854");
 const Uuid UUID_BASS = Uuid::FromString("184F");
 const Uuid UUID_BATTERY = Uuid::FromString("180F");
+const Uuid UUID_A2DP_SINK = Uuid::FromString("110B");
 const bool enable_address_consolidate = true;  // TODO remove
 
-#define COD_MASK 0x07FF
-
 #define COD_UNCLASSIFIED ((0x1F) << 8)
 #define COD_HID_KEYBOARD 0x0540
 #define COD_HID_POINTING 0x0580
@@ -123,6 +123,8 @@
 #define COD_AV_PORTABLE_AUDIO 0x041C
 #define COD_AV_HIFI_AUDIO 0x0428
 
+#define COD_CLASS_LE_AUDIO (1 << 14)
+
 #define BTIF_DM_MAX_SDP_ATTEMPTS_AFTER_PAIRING 2
 
 #ifndef PROPERTY_CLASS_OF_DEVICE
@@ -148,7 +150,7 @@
 #define ENCRYPTED_BREDR 2
 #define ENCRYPTED_LE 4
 
-typedef struct {
+struct btif_dm_pairing_cb_t {
   bt_bond_state_t state;
   RawAddress static_bdaddr;
   RawAddress bd_addr;
@@ -165,7 +167,12 @@
   bool is_le_nc; /* LE Numeric comparison */
   btif_dm_ble_cb_t ble;
   uint8_t fail_reason;
-} btif_dm_pairing_cb_t;
+
+  enum ServiceDiscoveryState { NOT_STARTED, SCHEDULED, FINISHED };
+
+  ServiceDiscoveryState gatt_over_le;
+  ServiceDiscoveryState sdp_over_classic;
+};
 
 // TODO(jpawlowski): unify ?
 // btif_dm_local_key_id_t == tBTM_BLE_LOCAL_ID_KEYS == tBTA_BLE_LOCAL_ID_KEYS
@@ -194,6 +201,10 @@
 
 typedef struct { unsigned int manufact_id; } skip_sdp_entry_t;
 
+typedef struct {
+  bluetooth::common::LruCache<RawAddress, std::vector<uint8_t>> le_audio_cache;
+} btif_dm_metadata_cb_t;
+
 typedef enum {
   BTIF_DM_FUNC_CREATE_BOND,
   BTIF_DM_FUNC_CANCEL_BOND,
@@ -248,6 +259,7 @@
 static void btif_dm_save_ble_bonding_keys(RawAddress& bd_addr);
 static btif_dm_pairing_cb_t pairing_cb;
 static btif_dm_oob_cb_t oob_cb;
+static btif_dm_metadata_cb_t metadata_cb{.le_audio_cache{40}};
 static void btif_dm_cb_create_bond(const RawAddress bd_addr,
                                    tBT_TRANSPORT transport);
 static void btif_update_remote_properties(const RawAddress& bd_addr,
@@ -445,7 +457,7 @@
   if (btif_storage_get_remote_device_property(
           (RawAddress*)remote_bdaddr, &prop_name) == BT_STATUS_SUCCESS) {
     LOG_INFO("%s remote_cod = 0x%08x", __func__, remote_cod);
-    return remote_cod & COD_MASK;
+    return remote_cod;
   }
 
   return 0;
@@ -463,6 +475,9 @@
   return (get_cod(&bd_addr) & COD_HID_MASK) == COD_HID_MAJOR;
 }
 
+bool check_cod_le_audio(const RawAddress& bd_addr) {
+  return (get_cod(&bd_addr) & COD_CLASS_LE_AUDIO) == COD_CLASS_LE_AUDIO;
+}
 /*****************************************************************************
  *
  * Function        check_sdp_bl
@@ -535,11 +550,15 @@
   }
 
   if (state == BT_BOND_STATE_BONDING ||
-      (state == BT_BOND_STATE_BONDED && pairing_cb.sdp_attempts > 0)) {
-    // Save state for the device is bonding or SDP.
+      (state == BT_BOND_STATE_BONDED &&
+       (pairing_cb.sdp_attempts > 0 ||
+        pairing_cb.gatt_over_le ==
+            btif_dm_pairing_cb_t::ServiceDiscoveryState::SCHEDULED))) {
+    // Save state for the device is bonding or SDP or GATT over LE discovery
     pairing_cb.state = state;
     pairing_cb.bd_addr = bd_addr;
   } else {
+    LOG_INFO("clearing btif pairing_cb");
     pairing_cb = {};
   }
 }
@@ -657,6 +676,33 @@
                                      properties);
 }
 
+/* If device is LE Audio capable, we prefer LE connection first, this speeds
+ * up LE profile connection, and limits all possible service discovery
+ * ordering issues (first Classic, GATT over SDP, etc) */
+static bool is_device_le_audio_capable(const RawAddress bd_addr) {
+  if (!LeAudioClient::IsLeAudioClientRunning()) {
+    /* If LE Audio profile is not enabled, do nothing. */
+    return false;
+  }
+
+  if (!check_cod_le_audio(bd_addr) && !BTA_DmCheckLeAudioCapable(bd_addr)) {
+    /* LE Audio not present in CoD or in LE Advertisement, do nothing.*/
+    return false;
+  }
+
+  tBT_DEVICE_TYPE tmp_dev_type;
+  tBLE_ADDR_TYPE addr_type = BLE_ADDR_PUBLIC;
+  BTM_ReadDevInfo(bd_addr, &tmp_dev_type, &addr_type);
+  if (tmp_dev_type & BT_DEVICE_TYPE_BLE) {
+    /* LE Audio capable device is discoverable over both LE and Classic using
+     * same address. Prefer to use LE transport, as we don't know if it can do
+     * CTKD from Classic to LE */
+    return true;
+  }
+
+  return false;
+}
+
 /*******************************************************************************
  *
  * Function         btif_dm_cb_create_bond
@@ -672,6 +718,11 @@
   bool is_hid = check_cod(&bd_addr, COD_HID_POINTING);
   bond_state_changed(BT_STATUS_SUCCESS, bd_addr, BT_BOND_STATE_BONDING);
 
+  if (transport == BT_TRANSPORT_AUTO && is_device_le_audio_capable(bd_addr)) {
+    LOG_INFO("LE Audio capable, forcing LE transport for Bonding");
+    transport = BT_TRANSPORT_LE;
+  }
+
   int device_type = 0;
   tBLE_ADDR_TYPE addr_type = BLE_ADDR_PUBLIC;
   std::string addrstr = bd_addr.ToString();
@@ -1044,8 +1095,7 @@
     }
 
     bool is_crosskey = false;
-    if (pairing_cb.state == BT_BOND_STATE_BONDING &&
-        p_auth_cmpl->bd_addr != pairing_cb.bd_addr) {
+    if (pairing_cb.state == BT_BOND_STATE_BONDING && p_auth_cmpl->is_ctkd) {
       LOG_INFO("bonding initiated due to cross key pairing");
       is_crosskey = true;
     }
@@ -1078,8 +1128,7 @@
       invoke_remote_device_properties_cb(BT_STATUS_SUCCESS, bd_addr, 1, &prop);
     } else {
       /* If bonded due to cross-key, save the static address too*/
-      if (pairing_cb.state == BT_BOND_STATE_BONDING &&
-          p_auth_cmpl->bd_addr != pairing_cb.bd_addr) {
+      if (is_crosskey) {
         BTIF_TRACE_DEBUG(
             "%s: bonding initiated due to cross key, adding static address",
             __func__);
@@ -1104,7 +1153,14 @@
         } else {
           bond_state_changed(BT_STATUS_SUCCESS, bd_addr, BT_BOND_STATE_BONDED);
         }
-        btif_dm_get_remote_services(bd_addr, BT_TRANSPORT_AUTO);
+
+        if (pairing_cb.sdp_over_classic ==
+            btif_dm_pairing_cb_t::ServiceDiscoveryState::NOT_STARTED) {
+          LOG_INFO("scheduling SDP for %s", PRIVATE_ADDRESS(bd_addr));
+          pairing_cb.sdp_over_classic =
+              btif_dm_pairing_cb_t::ServiceDiscoveryState::SCHEDULED;
+          btif_dm_get_remote_services(bd_addr, BT_TRANSPORT_AUTO);
+        }
       }
     }
     // Do not call bond_state_changed_cb yet. Wait until remote service
@@ -1325,6 +1381,17 @@
         status = btif_storage_set_remote_addr_type(&bdaddr, addr_type);
         ASSERTC(status == BT_STATUS_SUCCESS,
                 "failed to save remote addr type (inquiry)", status);
+
+        bool restrict_report = osi_property_get_bool(
+            "bluetooth.restrict_discovered_device.enabled", false);
+        if (restrict_report &&
+            p_search_data->inq_res.device_type == BT_DEVICE_TYPE_BLE &&
+            !(p_search_data->inq_res.ble_evt_type & BTM_BLE_CONNECTABLE_MASK)) {
+          LOG_INFO("%s: Ble device is not connectable",
+                   bdaddr.ToString().c_str());
+          break;
+        }
+
         /* Callback to notify upper layer of device */
         invoke_device_found_cb(num_properties, properties);
       }
@@ -1369,6 +1436,10 @@
   btif_storage_get_remote_device_property(bd_addr, &tmp_prop);
 }
 
+static bool btif_should_ignore_uuid(const Uuid& uuid) {
+  return uuid.IsEmpty() || uuid.IsBase();
+}
+
 /*******************************************************************************
  *
  * Function         btif_dm_search_services_evt
@@ -1387,6 +1458,7 @@
       bt_status_t ret;
       std::vector<uint8_t> property_value;
       std::set<Uuid> uuids;
+      bool a2dp_sink_capable = false;
 
       RawAddress& bd_addr = p_data->disc_res.bd_addr;
 
@@ -1396,7 +1468,8 @@
           pairing_cb.state == BT_BOND_STATE_BONDED &&
           pairing_cb.sdp_attempts < BTIF_DM_MAX_SDP_ATTEMPTS_AFTER_PAIRING) {
         if (pairing_cb.sdp_attempts) {
-          LOG_WARN("SDP failed after bonding re-attempting");
+          LOG_WARN("SDP failed after bonding re-attempting for %s",
+                   PRIVATE_ADDRESS(bd_addr));
           pairing_cb.sdp_attempts++;
           btif_dm_get_remote_services(bd_addr, BT_TRANSPORT_AUTO);
         } else {
@@ -1404,6 +1477,14 @@
         }
         return;
       }
+
+      if ((bd_addr == pairing_cb.bd_addr ||
+           bd_addr == pairing_cb.static_bdaddr)) {
+        LOG_INFO("SDP finished for %s:", PRIVATE_ADDRESS(bd_addr));
+        pairing_cb.sdp_over_classic =
+            btif_dm_pairing_cb_t::ServiceDiscoveryState::FINISHED;
+      }
+
       prop.type = BT_PROPERTY_UUIDS;
       prop.len = 0;
       if ((p_data->disc_res.result == BTA_SUCCESS) &&
@@ -1411,7 +1492,7 @@
         LOG_INFO("New UUIDs for %s:", bd_addr.ToString().c_str());
         for (i = 0; i < p_data->disc_res.num_uuids; i++) {
           auto uuid = p_data->disc_res.p_uuid_list + i;
-          if (uuid->IsEmpty()) {
+          if (btif_should_ignore_uuid(*uuid)) {
             continue;
           }
           LOG_INFO("index:%d uuid:%s", i, uuid->ToString().c_str());
@@ -1423,7 +1504,7 @@
 
         for (int i = 0; i < BT_MAX_NUM_UUIDS; i++) {
           Uuid uuid = existing_uuids[i];
-          if (uuid.IsEmpty()) {
+          if (btif_should_ignore_uuid(uuid)) {
             continue;
           }
           if (btif_is_interesting_le_service(uuid)) {
@@ -1436,11 +1517,30 @@
           auto uuid_128bit = uuid.To128BitBE();
           property_value.insert(property_value.end(), uuid_128bit.begin(),
                                 uuid_128bit.end());
+          if (uuid == UUID_A2DP_SINK) {
+            a2dp_sink_capable = true;
+          }
         }
         prop.val = (void*)property_value.data();
         prop.len = Uuid::kNumBytes128 * uuids.size();
       }
 
+      bool skip_reporting_wait_for_le = false;
+      /* If we are doing service discovery for device that just bonded, that is
+       * capable of a2dp, and both sides can do LE Audio, and it haven't
+       * finished GATT over LE yet, then wait for LE service discovery to finish
+       * before before passing services to upper layers. */
+      if ((bd_addr == pairing_cb.bd_addr ||
+           bd_addr == pairing_cb.static_bdaddr) &&
+          a2dp_sink_capable && LeAudioClient::IsLeAudioClientRunning() &&
+          pairing_cb.gatt_over_le !=
+              btif_dm_pairing_cb_t::ServiceDiscoveryState::FINISHED &&
+          (check_cod_le_audio(bd_addr) ||
+           metadata_cb.le_audio_cache.contains(bd_addr) ||
+           BTA_DmCheckLeAudioCapable(bd_addr))) {
+        skip_reporting_wait_for_le = true;
+      }
+
       /* onUuidChanged requires getBondedDevices to be populated.
       ** bond_state_changed needs to be sent prior to remote_device_property
       */
@@ -1480,6 +1580,7 @@
         // Both SDP and bonding are done, clear pairing control block in case
         // it is not already cleared
         pairing_cb = {};
+        LOG_INFO("clearing btif pairing_cb");
       }
 
       if (p_data->disc_res.num_uuids != 0 || num_eir_uuids != 0) {
@@ -1487,6 +1588,19 @@
         ret = btif_storage_set_remote_device_property(&bd_addr, &prop);
         ASSERTC(ret == BT_STATUS_SUCCESS, "storing remote services failed",
                 ret);
+
+        if (skip_reporting_wait_for_le) {
+          LOG_INFO(
+              "Bonding LE Audio sink - must wait for le services discovery "
+              "to pass all services to java %s",
+              PRIVATE_ADDRESS(bd_addr));
+          /* For LE Audio capable devices, we care more about passing GATT LE
+           * services than about just finishing pairing. Service discovery
+           * should be scheduled when LE pairing finishes, by call to
+           * btif_dm_get_remote_services(bd_addr, BT_TRANSPORT_LE) */
+          return;
+        }
+
         /* Send the event to the BTIF */
         invoke_remote_device_properties_cb(BT_STATUS_SUCCESS, bd_addr, 1,
                                            &prop);
@@ -1501,17 +1615,44 @@
       /* no-op */
       break;
 
-    case BTA_DM_DISC_BLE_RES_EVT: {
+    case BTA_DM_GATT_OVER_SDP_RES_EVT:
+    case BTA_DM_GATT_OVER_LE_RES_EVT: {
       int num_properties = 0;
       bt_property_t prop[2];
       std::vector<uint8_t> property_value;
       std::set<Uuid> uuids;
       RawAddress& bd_addr = p_data->disc_ble_res.bd_addr;
 
-      LOG_INFO("New BLE UUIDs for %s:", bd_addr.ToString().c_str());
+      if (event == BTA_DM_GATT_OVER_LE_RES_EVT) {
+        LOG_INFO("New GATT over LE UUIDs for %s:",
+                 PRIVATE_ADDRESS(bd_addr));
+        if ((bd_addr == pairing_cb.bd_addr ||
+             bd_addr == pairing_cb.static_bdaddr)) {
+          if (pairing_cb.gatt_over_le !=
+              btif_dm_pairing_cb_t::ServiceDiscoveryState::SCHEDULED) {
+            LOG_ERROR(
+                "gatt_over_le should be SCHEDULED, did someone clear the "
+                "control block for %s ?",
+                PRIVATE_ADDRESS(bd_addr));
+          }
+          pairing_cb.gatt_over_le =
+              btif_dm_pairing_cb_t::ServiceDiscoveryState::FINISHED;
+
+          if (pairing_cb.sdp_over_classic !=
+              btif_dm_pairing_cb_t::ServiceDiscoveryState::SCHEDULED) {
+            // Both SDP and bonding are either done, or not scheduled,
+            // we are safe to clear the service discovery part of CB.
+            LOG_INFO("clearing pairing_cb");
+            pairing_cb = {};
+          }
+        }
+      } else {
+        LOG_INFO("New GATT over SDP UUIDs for %s:", PRIVATE_ADDRESS(bd_addr));
+      }
+
       for (Uuid uuid : *p_data->disc_ble_res.services) {
         if (btif_is_interesting_le_service(uuid)) {
-          if (uuid.IsEmpty()) {
+          if (btif_should_ignore_uuid(uuid)) {
             continue;
           }
           LOG_INFO("index:%d uuid:%s", static_cast<int>(uuids.size()),
@@ -1521,7 +1662,7 @@
       }
 
       if (uuids.empty()) {
-        LOG_INFO("No well known BLE services discovered");
+        LOG_INFO("No well known GATT services discovered");
         return;
       }
 
@@ -1563,6 +1704,12 @@
         num_properties++;
       }
 
+      /* If services were returned as part of SDP discovery, we will immediately
+       * send them with rest of SDP results in BTA_DM_DISC_RES_EVT */
+      if (event == BTA_DM_GATT_OVER_SDP_RES_EVT) {
+        return;
+      }
+
       /* Send the event to the BTIF */
       invoke_remote_device_properties_cb(BT_STATUS_SUCCESS, bd_addr,
                                          num_properties, prop);
@@ -2652,7 +2799,11 @@
         stop_oob_advertiser();
       }
       waiting_on_oob_advertiser_start = true;
-      SMP_CrLocScOobData();
+      if (!SMP_CrLocScOobData()) {
+        waiting_on_oob_advertiser_start = false;
+        invoke_oob_data_request_cb(transport, false, Octet16{}, Octet16{},
+                                 RawAddress{}, 0x00);
+      }
     } else {
       invoke_oob_data_request_cb(transport, false, Octet16{}, Octet16{},
                                  RawAddress{}, 0x00);
@@ -2713,7 +2864,7 @@
   LOG_ERROR("oob_advertiser_id: %s", oob_advertiser_id_.get());
 
   auto advertiser = get_ble_advertiser_instance();
-  AdvertiseParameters parameters;
+  AdvertiseParameters parameters{};
   parameters.advertising_event_properties = 0x0041 /* connectable, tx power */;
   parameters.min_interval = 0xa0;   // 100 ms
   parameters.max_interval = 0x500;  // 800 ms
@@ -2722,6 +2873,7 @@
   parameters.primary_advertising_phy = 1;
   parameters.secondary_advertising_phy = 2;
   parameters.scan_request_notification_enable = 0;
+  parameters.own_address_type = BLE_ADDR_RANDOM;
 
   std::vector<uint8_t> advertisement{0x02, 0x01 /* Flags */,
                                      0x02 /* Connectable */};
@@ -2923,8 +3075,21 @@
       btif_storage_remove_bonded_device(&bdaddr);
       state = BT_BOND_STATE_NONE;
     } else {
-      btif_dm_save_ble_bonding_keys(bdaddr);
-      btif_dm_get_remote_services(bd_addr, BT_TRANSPORT_LE);
+      btif_dm_save_ble_bonding_keys(bd_addr);
+
+      if (pairing_cb.gatt_over_le ==
+          btif_dm_pairing_cb_t::ServiceDiscoveryState::NOT_STARTED) {
+        LOG_INFO("scheduling GATT discovery over LE for %s",
+                 PRIVATE_ADDRESS(bd_addr));
+        pairing_cb.gatt_over_le =
+            btif_dm_pairing_cb_t::ServiceDiscoveryState::SCHEDULED;
+        btif_dm_get_remote_services(bd_addr, BT_TRANSPORT_LE);
+      } else {
+        LOG_INFO(
+            "skipping GATT discovery over LE - was already scheduled or "
+            "finished for %s, state: %d",
+            PRIVATE_ADDRESS(bd_addr), pairing_cb.gatt_over_le);
+      }
     }
   } else {
     /*Map the HCI fail reason  to  bt status  */
@@ -3477,3 +3642,13 @@
   LOG_VERBOSE("%s: called", __func__);
   bta_dm_clear_event_filter();
 }
+
+void btif_dm_metadata_changed(const RawAddress& remote_bd_addr, int key,
+                              std::vector<uint8_t> value) {
+  static const int METADATA_LE_AUDIO = 26;
+  /* If METADATA_LE_AUDIO is present, device is LE Audio capable */
+  if (key == METADATA_LE_AUDIO) {
+    LOG_INFO("Device is LE Audio Capable %s", PRIVATE_ADDRESS(remote_bd_addr));
+    metadata_cb.le_audio_cache.insert_or_assign(remote_bd_addr, value);
+  }
+}
diff --git a/system/btif/src/btif_gatt.cc b/system/btif/src/btif_gatt.cc
index d8076b0..2d0944f 100644
--- a/system/btif/src/btif_gatt.cc
+++ b/system/btif/src/btif_gatt.cc
@@ -55,6 +55,7 @@
  ******************************************************************************/
 static bt_status_t btif_gatt_init(const btgatt_callbacks_t* callbacks) {
   bt_gatt_callbacks = callbacks;
+  BTA_GATTS_InitBonded();
   return BT_STATUS_SUCCESS;
 }
 
diff --git a/system/btif/src/btif_gatt_client.cc b/system/btif/src/btif_gatt_client.cc
index ae8962e..4b4ac76 100644
--- a/system/btif/src/btif_gatt_client.cc
+++ b/system/btif/src/btif_gatt_client.cc
@@ -363,7 +363,9 @@
   // Connect!
   LOG_INFO("Transport=%d, device type=%d, address type =%d, phy=%d", transport,
            device_type, addr_type, initiating_phys);
-  BTA_GATTC_Open(client_if, address, is_direct, transport, opportunistic,
+  tBTM_BLE_CONN_TYPE type =
+      is_direct ? BTM_BLE_DIRECT_CONNECTION : BTM_BLE_BKG_CONNECT_ALLOW_LIST;
+  BTA_GATTC_Open(client_if, address, type, transport, opportunistic,
                  initiating_phys);
 }
 
diff --git a/system/btif/src/btif_gatt_test.cc b/system/btif/src/btif_gatt_test.cc
index 7903844..f2739dd 100644
--- a/system/btif/src/btif_gatt_test.cc
+++ b/system/btif/src/btif_gatt_test.cc
@@ -201,8 +201,8 @@
         BTM_SecAddBleDevice(*params->bda1, BT_DEVICE_TYPE_BLE,
                             static_cast<tBLE_ADDR_TYPE>(params->u2));
 
-      if (!GATT_Connect(test_cb.gatt_if, *params->bda1, true, BT_TRANSPORT_LE,
-                        false)) {
+      if (!GATT_Connect(test_cb.gatt_if, *params->bda1,
+                        BTM_BLE_DIRECT_CONNECTION, BT_TRANSPORT_LE, false)) {
         LOG_ERROR("%s: GATT_Connect failed!", __func__);
       }
       break;
diff --git a/system/btif/src/btif_gatt_util.cc b/system/btif/src/btif_gatt_util.cc
index 290c431..55788b0 100644
--- a/system/btif/src/btif_gatt_util.cc
+++ b/system/btif/src/btif_gatt_util.cc
@@ -36,6 +36,7 @@
 #include "btif_gatt.h"
 #include "btif_storage.h"
 #include "btif_util.h"
+#include "gd/os/system_properties.h"
 #include "osi/include/allocator.h"
 #include "osi/include/osi.h"
 #include "stack/btm/btm_sec.h"
@@ -75,6 +76,12 @@
 
 void btif_gatt_check_encrypted_link(RawAddress bd_addr,
                                     tBT_TRANSPORT transport_link) {
+  static const bool check_encrypted = bluetooth::os::GetSystemPropertyBool(
+      "bluetooth.gatt.check_encrypted_link.enabled", true);
+  if (!check_encrypted) {
+    LOG_DEBUG("Check skipped due to system config");
+    return;
+  }
   tBTM_LE_PENC_KEYS key;
   if ((btif_storage_get_ble_bonding_key(
            bd_addr, BTM_LE_KEY_PENC, (uint8_t*)&key,
diff --git a/system/btif/src/btif_hd.cc b/system/btif/src/btif_hd.cc
index 9d3a2ed..c41713a 100644
--- a/system/btif/src/btif_hd.cc
+++ b/system/btif/src/btif_hd.cc
@@ -32,10 +32,12 @@
 #include "bt_target.h"  // Must be first to define build configuration
 
 #include "bta/include/bta_hd_api.h"
+#include "bta/sys/bta_sys.h"
 #include "btif/include/btif_common.h"
 #include "btif/include/btif_hd.h"
 #include "btif/include/btif_storage.h"
 #include "btif/include/btif_util.h"
+#include "gd/common/init_flags.h"
 #include "include/hardware/bt_hd.h"
 #include "osi/include/allocator.h"
 #include "osi/include/compat.h"
@@ -162,6 +164,7 @@
       BTIF_TRACE_DEBUG("%s: status=%d", __func__, p_data->status);
       btif_hd_cb.status = BTIF_HD_DISABLED;
       if (btif_hd_cb.service_dereg_active) {
+        bta_sys_deregister(BTA_ID_HD);
         BTIF_TRACE_WARNING("registering hid host now");
         btif_hh_service_registration(TRUE);
         btif_hd_cb.service_dereg_active = FALSE;
@@ -181,6 +184,7 @@
         addr = NULL;
       }
 
+      LOG_INFO("Registering HID device app");
       btif_hd_cb.app_registered = TRUE;
       HAL_CBACK(bt_hd_callbacks, application_state_cb, addr,
                 BTHD_APP_STATE_REGISTERED);
@@ -192,7 +196,10 @@
                 BTHD_APP_STATE_NOT_REGISTERED);
       if (btif_hd_cb.service_dereg_active) {
         BTIF_TRACE_WARNING("disabling hid device service now");
-        btif_hd_free_buf();
+        if (!bluetooth::common::init_flags::
+                delay_hidh_cleanup_until_hidh_ready_start_is_enabled()) {
+          btif_hd_free_buf();
+        }
         BTA_HdDisable();
       }
       break;
@@ -396,11 +403,6 @@
     return BT_STATUS_BUSY;
   }
 
-  if (strlen(p_app_param->name) >= BTIF_HD_APP_NAME_LEN ||
-      strlen(p_app_param->description) >= BTIF_HD_APP_DESCRIPTION_LEN ||
-      strlen(p_app_param->provider) >= BTIF_HD_APP_PROVIDER_LEN) {
-    android_errorWriteLog(0x534e4554, "113037220");
-  }
   app_info.p_name = (char*)osi_calloc(BTIF_HD_APP_NAME_LEN);
   strlcpy(app_info.p_name, p_app_param->name, BTIF_HD_APP_NAME_LEN);
   app_info.p_description = (char*)osi_calloc(BTIF_HD_APP_DESCRIPTION_LEN);
diff --git a/system/btif/src/btif_hearing_aid.cc b/system/btif/src/btif_hearing_aid.cc
index 3b51ede..7820f42 100644
--- a/system/btif/src/btif_hearing_aid.cc
+++ b/system/btif/src/btif_hearing_aid.cc
@@ -85,30 +85,26 @@
 
   void Connect(const RawAddress& address) override {
     DVLOG(2) << __func__ << " address: " << address;
-    do_in_main_thread(FROM_HERE, Bind(&HearingAid::Connect,
-                                      Unretained(HearingAid::Get()), address));
+    do_in_main_thread(FROM_HERE, Bind(&HearingAid::Connect, address));
   }
 
   void Disconnect(const RawAddress& address) override {
     DVLOG(2) << __func__ << " address: " << address;
-    do_in_main_thread(FROM_HERE, Bind(&HearingAid::Disconnect,
-                                      Unretained(HearingAid::Get()), address));
+    do_in_main_thread(FROM_HERE, Bind(&HearingAid::Disconnect, address));
     do_in_jni_thread(FROM_HERE, Bind(&btif_storage_set_hearing_aid_acceptlist,
                                      address, false));
   }
 
   void AddToAcceptlist(const RawAddress& address) override {
     VLOG(2) << __func__ << " address: " << address;
-    do_in_main_thread(FROM_HERE, Bind(&HearingAid::AddToAcceptlist,
-                                      Unretained(HearingAid::Get()), address));
+    do_in_main_thread(FROM_HERE, Bind(&HearingAid::AddToAcceptlist, address));
     do_in_jni_thread(FROM_HERE, Bind(&btif_storage_set_hearing_aid_acceptlist,
                                      address, true));
   }
 
   void SetVolume(int8_t volume) override {
     DVLOG(2) << __func__ << " volume: " << +volume;
-    do_in_main_thread(FROM_HERE, Bind(&HearingAid::SetVolume,
-                                      Unretained(HearingAid::Get()), volume));
+    do_in_main_thread(FROM_HERE, Bind(&HearingAid::SetVolume, volume));
   }
 
   void RemoveDevice(const RawAddress& address) override {
@@ -116,9 +112,7 @@
 
     // RemoveDevice can be called on devices that don't have HA enabled
     if (HearingAid::IsHearingAidRunning()) {
-      do_in_main_thread(FROM_HERE,
-                        Bind(&HearingAid::Disconnect,
-                             Unretained(HearingAid::Get()), address));
+      do_in_main_thread(FROM_HERE, Bind(&HearingAid::Disconnect, address));
     }
 
     do_in_jni_thread(FROM_HERE,
diff --git a/system/btif/src/btif_hf.cc b/system/btif/src/btif_hf.cc
index 334cbf0..4d5aa1e 100644
--- a/system/btif/src/btif_hf.cc
+++ b/system/btif/src/btif_hf.cc
@@ -27,6 +27,10 @@
 
 #define LOG_TAG "bt_btif_hf"
 
+#ifdef OS_ANDROID
+#include <hfp.sysprop.h>
+#endif
+
 #include <cstdint>
 #include <string>
 
@@ -64,25 +68,14 @@
 #define BTIF_HFAG_SERVICE_NAME ("Handsfree Gateway")
 #endif
 
-#ifndef BTIF_HF_SERVICES
-#define BTIF_HF_SERVICES (BTA_HSP_SERVICE_MASK | BTA_HFP_SERVICE_MASK)
-#endif
-
 #ifndef BTIF_HF_SERVICE_NAMES
 #define BTIF_HF_SERVICE_NAMES \
   { BTIF_HSAG_SERVICE_NAME, BTIF_HFAG_SERVICE_NAME }
 #endif
 
-#ifndef BTIF_HF_FEATURES
-#define BTIF_HF_FEATURES                                          \
-  (BTA_AG_FEAT_3WAY | BTA_AG_FEAT_ECNR | BTA_AG_FEAT_REJECT |     \
-   BTA_AG_FEAT_ECS | BTA_AG_FEAT_EXTERR | BTA_AG_FEAT_VREC |      \
-   BTA_AG_FEAT_CODEC | BTA_AG_FEAT_HF_IND | BTA_AG_FEAT_ESCO_S4 | \
-   BTA_AG_FEAT_UNAT)
-#endif
-
+static uint32_t get_hf_features();
 /* HF features supported at runtime */
-static uint32_t btif_hf_features = BTIF_HF_FEATURES;
+static uint32_t btif_hf_features = get_hf_features();
 
 #define BTIF_HF_INVALID_IDX (-1)
 
@@ -145,6 +138,36 @@
   return !active_bda.IsEmpty() && active_bda == bd_addr;
 }
 
+static tBTA_SERVICE_MASK get_BTIF_HF_SERVICES() {
+#ifdef OS_ANDROID
+  static const tBTA_SERVICE_MASK hf_services =
+      android::sysprop::bluetooth::Hfp::hf_services().value_or(
+          BTA_HSP_SERVICE_MASK | BTA_HFP_SERVICE_MASK);
+  return hf_services;
+#else
+  return BTA_HSP_SERVICE_MASK | BTA_HFP_SERVICE_MASK;
+#endif
+}
+
+/* HF features supported at runtime */
+static uint32_t get_hf_features() {
+#define DEFAULT_BTIF_HF_FEATURES                                  \
+  (BTA_AG_FEAT_3WAY | BTA_AG_FEAT_ECNR | BTA_AG_FEAT_REJECT |     \
+   BTA_AG_FEAT_ECS | BTA_AG_FEAT_EXTERR | BTA_AG_FEAT_VREC |      \
+   BTA_AG_FEAT_CODEC | BTA_AG_FEAT_HF_IND | BTA_AG_FEAT_ESCO_S4 | \
+   BTA_AG_FEAT_UNAT)
+#ifdef OS_ANDROID
+  static const uint32_t hf_features =
+      android::sysprop::bluetooth::Hfp::hf_features().value_or(
+          DEFAULT_BTIF_HF_FEATURES);
+  return hf_features;
+#elif TARGET_FLOSS
+  return BTA_AG_FEAT_ECS | BTA_AG_FEAT_CODEC;
+#else
+  return DEFAULT_BTIF_HF_FEATURES;
+#endif
+}
+
 /*******************************************************************************
  *
  * Function         is_connected
@@ -773,11 +796,11 @@
 // Invoke the enable service API to the core to set the appropriate service_id
 // Internally, the HSP_SERVICE_ID shall also be enabled if HFP is enabled
 // (phone) otherwise only HSP is enabled (tablet)
-#if (defined(BTIF_HF_SERVICES) && (BTIF_HF_SERVICES & BTA_HFP_SERVICE_MASK))
-  btif_enable_service(BTA_HFP_SERVICE_ID);
-#else
-  btif_enable_service(BTA_HSP_SERVICE_ID);
-#endif
+  if (get_BTIF_HF_SERVICES() & BTA_HFP_SERVICE_MASK) {
+    btif_enable_service(BTA_HFP_SERVICE_ID);
+  } else {
+    btif_enable_service(BTA_HSP_SERVICE_ID);
+  }
 
   return BT_STATUS_SUCCESS;
 }
@@ -1090,7 +1113,6 @@
       }
       for (size_t i = 0; number[i] != 0; i++) {
         if (newidx >= (sizeof(dialnum) - res_strlen - 1)) {
-          android_errorWriteLog(0x534e4554, "79266386");
           break;
         }
         if (utl_isdialchar(number[i])) {
@@ -1263,7 +1285,6 @@
               13 + static_cast<int>(number_str.length() + name_str.length()) -
               static_cast<int>(sizeof(ag_res.str));
           if (overflow_size > 0) {
-            android_errorWriteLog(0x534e4554, "79431031");
             int extra_overflow_size =
                 overflow_size - static_cast<int>(name_str.length());
             if (extra_overflow_size > 0) {
@@ -1403,15 +1424,16 @@
   btif_queue_cleanup(UUID_SERVCLASS_AG_HANDSFREE);
 
   tBTA_SERVICE_MASK mask = btif_get_enabled_services_mask();
-#if (defined(BTIF_HF_SERVICES) && (BTIF_HF_SERVICES & BTA_HFP_SERVICE_MASK))
-  if ((mask & (1 << BTA_HFP_SERVICE_ID)) != 0) {
-    btif_disable_service(BTA_HFP_SERVICE_ID);
+  if (get_BTIF_HF_SERVICES() & BTA_HFP_SERVICE_MASK) {
+    if ((mask & (1 << BTA_HFP_SERVICE_ID)) != 0) {
+      btif_disable_service(BTA_HFP_SERVICE_ID);
+    }
+  } else {
+    if ((mask & (1 << BTA_HSP_SERVICE_ID)) != 0) {
+      btif_disable_service(BTA_HSP_SERVICE_ID);
+    }
   }
-#else
-  if ((mask & (1 << BTA_HSP_SERVICE_ID)) != 0) {
-    btif_disable_service(BTA_HSP_SERVICE_ID);
-  }
-#endif
+
   do_in_jni_thread(FROM_HERE, base::Bind([]() { bt_hf_callbacks = nullptr; }));
 }
 
@@ -1468,7 +1490,8 @@
     /* Enable and register with BTA-AG */
     BTA_AgEnable(bte_hf_evt);
     for (uint8_t app_id = 0; app_id < btif_max_hf_clients; app_id++) {
-      BTA_AgRegister(BTIF_HF_SERVICES, btif_hf_features, service_names, app_id);
+      BTA_AgRegister(get_BTIF_HF_SERVICES(), btif_hf_features, service_names,
+                     app_id);
     }
   } else {
     /* De-register AG */
diff --git a/system/btif/src/btif_hf_client.cc b/system/btif/src/btif_hf_client.cc
index 0826368..ed94e0d 100644
--- a/system/btif/src/btif_hf_client.cc
+++ b/system/btif/src/btif_hf_client.cc
@@ -68,13 +68,6 @@
 #define BTIF_HF_CLIENT_SERVICE_NAME ("Handsfree")
 #endif
 
-#ifndef BTIF_HF_CLIENT_FEATURES
-#define BTIF_HF_CLIENT_FEATURES                                                \
-  (BTA_HF_CLIENT_FEAT_ECNR | BTA_HF_CLIENT_FEAT_3WAY |                         \
-   BTA_HF_CLIENT_FEAT_CLI | BTA_HF_CLIENT_FEAT_VREC | BTA_HF_CLIENT_FEAT_VOL | \
-   BTA_HF_CLIENT_FEAT_ECS | BTA_HF_CLIENT_FEAT_ECC | BTA_HF_CLIENT_FEAT_CODEC)
-#endif
-
 /*******************************************************************************
  *  Local type definitions
  ******************************************************************************/
@@ -313,9 +306,7 @@
    * The handle is valid until we have called BTA_HfClientClose or the LL
    * has notified us of channel close due to remote closing, error etc.
    */
-  BTA_HfClientOpen(cb->peer_bda, &cb->handle);
-
-  return BT_STATUS_SUCCESS;
+  return BTA_HfClientOpen(cb->peer_bda, &cb->handle);
 }
 
 static bt_status_t connect(RawAddress* bd_addr) {
@@ -360,7 +351,7 @@
 
   CHECK_BTHF_CLIENT_SLC_CONNECTED(cb);
 
-  if ((BTIF_HF_CLIENT_FEATURES & BTA_HF_CLIENT_FEAT_CODEC) &&
+  if ((get_default_hf_client_features() & BTA_HF_CLIENT_FEAT_CODEC) &&
       (cb->peer_feat & BTA_HF_CLIENT_PEER_CODEC)) {
     BTA_HfClientSendAT(cb->handle, BTA_HF_CLIENT_AT_CMD_BCC, 0, 0, NULL);
   } else {
@@ -745,6 +736,27 @@
   return BT_STATUS_SUCCESS;
 }
 
+/*******************************************************************************
+ *
+ * Function         send_hfp_audio_policy
+ *
+ * Description      Send requested audio policies to remote device.
+ *
+ * Returns          bt_status_t
+ *
+ ******************************************************************************/
+static bt_status_t send_android_at(const RawAddress* bd_addr, const char* arg) {
+  btif_hf_client_cb_t* cb = btif_hf_client_get_cb_by_bda(*bd_addr);
+  if (cb == NULL || !is_connected(cb)) return BT_STATUS_FAIL;
+
+  CHECK_BTHF_CLIENT_SLC_CONNECTED(cb);
+
+  BTIF_TRACE_EVENT("%s: val1 %s", __func__, arg);
+  BTA_HfClientSendAT(cb->handle, BTA_HF_CLIENT_AT_CMD_ANDROID, 0, 0, arg);
+
+  return BT_STATUS_SUCCESS;
+}
+
 static const bthf_client_interface_t bthfClientInterface = {
     .size = sizeof(bthf_client_interface_t),
     .init = init,
@@ -765,6 +777,7 @@
     .request_last_voice_tag_number = request_last_voice_tag_number,
     .cleanup = cleanup,
     .send_at_cmd = send_at_cmd,
+    .send_android_at = send_android_at,
 };
 
 static void process_ind_evt(tBTA_HF_CLIENT_IND* ind) {
@@ -852,6 +865,7 @@
         cb->state = BTHF_CLIENT_CONNECTION_STATE_CONNECTED;
         cb->peer_feat = 0;
         cb->chld_feat = 0;
+        cb->handle = p_data->open.handle;
       } else if (cb->state == BTHF_CLIENT_CONNECTION_STATE_CONNECTING) {
         cb->state = BTHF_CLIENT_CONNECTION_STATE_DISCONNECTED;
       } else {
@@ -897,6 +911,22 @@
       cb->peer_bda = RawAddress::kAny;
       cb->peer_feat = 0;
       cb->chld_feat = 0;
+      cb->handle = 0;
+
+      /* Clean up any btif_hf_client_cb for the same disconnected bd_addr.
+       * when there is an Incoming hf_client connection is in progress and
+       * at the same time, outgoing hf_client connection is initiated then
+       * due to race condition two btif_hf_client_cb is created. This creates
+       * problem for successive connections
+       */
+      while ((cb = btif_hf_client_get_cb_by_bda(p_data->bd_addr)) != NULL) {
+        cb->state = BTHF_CLIENT_CONNECTION_STATE_DISCONNECTED;
+        cb->peer_bda = RawAddress::kAny;
+        cb->peer_feat = 0;
+        cb->chld_feat = 0;
+        cb->handle = 0;
+      }
+
       btif_queue_advance();
       break;
 
@@ -1048,8 +1078,8 @@
 bt_status_t btif_hf_client_execute_service(bool b_enable) {
   BTIF_TRACE_EVENT("%s: enable: %d", __func__, b_enable);
 
-  tBTA_HF_CLIENT_FEAT features = BTIF_HF_CLIENT_FEATURES;
-  uint16_t hfp_version = BTA_HFP_VERSION;
+  tBTA_HF_CLIENT_FEAT features = get_default_hf_client_features();
+  uint16_t hfp_version = get_default_hfp_version();
   if (hfp_version >= HFP_VERSION_1_7) {
     features |= BTA_HF_CLIENT_FEAT_ESCO_S4;
   }
diff --git a/system/btif/src/btif_hh.cc b/system/btif/src/btif_hh.cc
index 3280a95..38986b9 100644
--- a/system/btif/src/btif_hh.cc
+++ b/system/btif/src/btif_hh.cc
@@ -538,6 +538,15 @@
        (btif_hh_cb.status == BTIF_HH_DEV_CONNECTING)) {
           btif_hh_cb.status = (BTIF_HH_STATUS)BTIF_HH_DEV_DISCONNECTED;
           btif_hh_cb.pending_conn_address = RawAddress::kEmpty;
+
+      /* need to notify up-layer device is disconnected to avoid
+       * state out of sync with up-layer */
+      do_in_jni_thread(base::Bind(
+            [](RawAddress bd_addrcb) {
+              HAL_CBACK(bt_hh_callbacks, connection_state_cb, &bd_addrcb,
+                        BTHH_CONN_STATE_DISCONNECTED);
+            },
+           *bd_addr));
     }
     return BT_STATUS_FAIL;
   }
diff --git a/system/btif/src/btif_le_audio.cc b/system/btif/src/btif_le_audio.cc
index b6d79b4..61b71ab 100644
--- a/system/btif/src/btif_le_audio.cc
+++ b/system/btif/src/btif_le_audio.cc
@@ -199,6 +199,13 @@
                         Unretained(LeAudioClient::Get()), ccid, context_type));
   }
 
+  void SetInCall(bool in_call) {
+    DVLOG(2) << __func__ << " in_call: " << in_call;
+    do_in_main_thread(FROM_HERE,
+                      Bind(&LeAudioClient::SetInCall,
+                           Unretained(LeAudioClient::Get()), in_call));
+  }
+
  private:
   LeAudioClientCallbacks* callbacks;
 };
diff --git a/system/btif/src/btif_pan.cc b/system/btif/src/btif_pan.cc
index df71187..99be952 100644
--- a/system/btif/src/btif_pan.cc
+++ b/system/btif/src/btif_pan.cc
@@ -34,6 +34,9 @@
 #include <linux/if_ether.h>
 #include <linux/if_tun.h>
 #include <net/if.h>
+#ifdef OS_ANDROID
+#include <pan.sysprop.h>
+#endif
 #include <poll.h>
 #include <sys/ioctl.h>
 #include <unistd.h>
@@ -93,6 +96,16 @@
 
 const btpan_interface_t* btif_pan_get_interface() { return &pan_if; }
 
+static bool pan_nap_is_enabled() {
+#ifdef OS_ANDROID
+  // replace build time config PAN_NAP_DISABLED with runtime
+  static const bool nap_is_enabled =
+      android::sysprop::bluetooth::Pan::nap().value_or(true);
+  return nap_is_enabled;
+#else
+  return true;
+#endif
+}
 /*******************************************************************************
  **
  ** Function        btif_pan_init
@@ -118,9 +131,9 @@
     btpan_cb.enabled = 1;
 
     int role = BTPAN_ROLE_NONE;
-#if PAN_NAP_DISABLED == FALSE
-    role |= BTPAN_ROLE_PANNAP;
-#endif
+    if (pan_nap_is_enabled()) {
+      role |= BTPAN_ROLE_PANNAP;
+    }
 #if PANU_DISABLED == FALSE
     role |= BTPAN_ROLE_PANU;
 #endif
diff --git a/system/btif/src/btif_rc.cc b/system/btif/src/btif_rc.cc
index dae4b5c..8b3d744 100644
--- a/system/btif/src/btif_rc.cc
+++ b/system/btif/src/btif_rc.cc
@@ -599,22 +599,23 @@
     rc_features = (btrc_remote_features_t)(rc_features | BTRC_FEAT_BROWSE);
   }
 
-#if (AVRC_ADV_CTRL_INCLUDED == TRUE)
+  if (p_dev->rc_features & BTA_AV_FEAT_METADATA) {
+    rc_features = (btrc_remote_features_t)(rc_features | BTRC_FEAT_METADATA);
+  }
+
+  if (!avrcp_absolute_volume_is_enabled()) {
+    return;
+  }
+
   if ((p_dev->rc_features & BTA_AV_FEAT_ADV_CTRL) &&
       (p_dev->rc_features & BTA_AV_FEAT_RCTG)) {
     rc_features =
         (btrc_remote_features_t)(rc_features | BTRC_FEAT_ABSOLUTE_VOLUME);
   }
-#endif
-
-  if (p_dev->rc_features & BTA_AV_FEAT_METADATA) {
-    rc_features = (btrc_remote_features_t)(rc_features | BTRC_FEAT_METADATA);
-  }
 
   BTIF_TRACE_DEBUG("%s: rc_features: 0x%x", __func__, rc_features);
   HAL_CBACK(bt_rc_callbacks, remote_features_cb, p_dev->rc_addr, rc_features);
 
-#if (AVRC_ADV_CTRL_INCLUDED == TRUE)
   BTIF_TRACE_DEBUG(
       "%s: Checking for feature flags in btif_rc_handler with label: %d",
       __func__, p_dev->rc_vol_label);
@@ -640,7 +641,6 @@
       register_volumechange(p_dev->rc_vol_label, p_dev);
     }
   }
-#endif
 }
 
 /***************************************************************************
@@ -734,12 +734,12 @@
     do_in_jni_thread(FROM_HERE,
                      base::Bind(bt_rc_ctrl_callbacks->connection_state_cb, true,
                                 false, p_dev->rc_addr));
-  }
-  /* report connection state if remote device is AVRCP target */
-  handle_rc_ctrl_features(p_dev);
+    /* report connection state if remote device is AVRCP target */
+    handle_rc_ctrl_features(p_dev);
 
-  /* report psm if remote device is AVRCP target */
-  handle_rc_ctrl_psm(p_dev);
+    /* report psm if remote device is AVRCP target */
+    handle_rc_ctrl_psm(p_dev);
+  }
 }
 
 /***************************************************************************
@@ -3598,7 +3598,6 @@
   app_settings.num_attr = p_rsp->num_val;
 
   if (app_settings.num_attr > BTRC_MAX_APP_SETTINGS) {
-    android_errorWriteLog(0x534e4554, "73824150");
     app_settings.num_attr = BTRC_MAX_APP_SETTINGS;
   }
 
diff --git a/system/btif/src/btif_sdp_server.cc b/system/btif/src/btif_sdp_server.cc
index 7a36204..64dab16 100644
--- a/system/btif/src/btif_sdp_server.cc
+++ b/system/btif/src/btif_sdp_server.cc
@@ -216,7 +216,6 @@
   int handle = -1;
   bluetooth_sdp_record* record = NULL;
   if (id < 0 || id >= MAX_SDP_SLOTS) {
-    android_errorWriteLog(0x534e4554, "37502513");
     APPL_TRACE_ERROR("%s() failed - id %d is invalid", __func__, id);
     return handle;
   }
diff --git a/system/btif/src/btif_sock.cc b/system/btif/src/btif_sock.cc
index b945f4b..bcbce01 100644
--- a/system/btif/src/btif_sock.cc
+++ b/system/btif/src/btif_sock.cc
@@ -18,10 +18,13 @@
 
 #define LOG_TAG "bt_btif_sock"
 
+#include "btif/include/btif_sock.h"
+
 #include <base/logging.h>
 #include <frameworks/proto_logging/stats/enums/bluetooth/enums.pb.h>
 #include <hardware/bluetooth.h>
 #include <hardware/bt_sock.h>
+#include <time.h>
 
 #include <atomic>
 
@@ -60,6 +63,22 @@
 static std::atomic_int thread_handle{-1};
 static thread_t* thread;
 
+#define SOCK_LOGGER_SIZE_MAX 16
+
+struct SockConnectionEvent {
+  bool used;
+  RawAddress addr;
+  int state;
+  int role;
+  struct timespec timestamp;
+
+  void dump(const int fd);
+};
+
+static std::atomic<uint8_t> logger_index;
+
+static SockConnectionEvent connection_logger[SOCK_LOGGER_SIZE_MAX];
+
 const btsock_interface_t* btif_sock_get_interface(void) {
   static btsock_interface_t interface = {
       sizeof(interface), btsock_listen, /* listen */
@@ -131,6 +150,88 @@
   thread = NULL;
 }
 
+void btif_sock_connection_logger(int state, int role, const RawAddress& addr) {
+  LOG_INFO("address=%s, role=%d, state=%d", addr.ToString().c_str(), state,
+           role);
+
+  uint8_t index = logger_index++ % SOCK_LOGGER_SIZE_MAX;
+
+  connection_logger[index] = {
+      .used = true,
+      .addr = addr,
+      .state = state,
+      .role = role,
+  };
+  clock_gettime(CLOCK_REALTIME, &connection_logger[index].timestamp);
+}
+
+void btif_sock_dump(int fd) {
+  dprintf(fd, "\nSocket Events: \n");
+  dprintf(fd, "  Time        \tAddress          \tState             \tRole\n");
+
+  const uint8_t head = logger_index.load() % SOCK_LOGGER_SIZE_MAX;
+
+  uint8_t index = head;
+  do {
+    connection_logger[index].dump(fd);
+
+    index++;
+    index %= SOCK_LOGGER_SIZE_MAX;
+  } while (index != head);
+  dprintf(fd, "\n");
+}
+
+void SockConnectionEvent::dump(const int fd) {
+  if (!used) {
+    return;
+  }
+
+  char eventtime[20];
+  char temptime[20];
+  struct tm* tstamp = localtime(&timestamp.tv_sec);
+  strftime(temptime, sizeof(temptime), "%H:%M:%S", tstamp);
+  snprintf(eventtime, sizeof(eventtime), "%s.%03ld", temptime,
+           timestamp.tv_nsec / 1000000);
+
+  const char* str_state;
+  switch (state) {
+    case SOCKET_CONNECTION_STATE_LISTENING:
+      str_state = "STATE_LISTENING";
+      break;
+    case SOCKET_CONNECTION_STATE_CONNECTING:
+      str_state = "STATE_CONNECTING";
+      break;
+    case SOCKET_CONNECTION_STATE_CONNECTED:
+      str_state = "STATE_CONNECTED";
+      break;
+    case SOCKET_CONNECTION_STATE_DISCONNECTING:
+      str_state = "STATE_DISCONNECTING";
+      break;
+    case SOCKET_CONNECTION_STATE_DISCONNECTED:
+      str_state = "STATE_DISCONNECTED";
+      break;
+    default:
+      str_state = "STATE_UNKNOWN";
+      break;
+  }
+
+  const char* str_role;
+  switch (role) {
+    case SOCKET_ROLE_LISTEN:
+      str_role = "ROLE_LISTEN";
+      break;
+    case SOCKET_ROLE_CONNECTION:
+      str_role = "ROLE_CONNECTION";
+      break;
+    default:
+      str_role = "ROLE_UNKNOWN";
+      break;
+  }
+
+  dprintf(fd, "  %s\t%s\t%s   \t%s\n", eventtime,
+          addr.ToString().c_str(), str_state, str_role);
+}
+
 static bt_status_t btsock_listen(btsock_type_t type, const char* service_name,
                                  const Uuid* service_uuid, int channel,
                                  int* sock_fd, int flags, int app_uid) {
@@ -142,6 +243,8 @@
   bt_status_t status = BT_STATUS_FAIL;
   int original_channel = channel;
 
+  btif_sock_connection_logger(SOCKET_CONNECTION_STATE_LISTENING,
+                              SOCKET_ROLE_LISTEN, RawAddress::kEmpty);
   log_socket_connection_state(RawAddress::kEmpty, 0, type,
                               android::bluetooth::SocketConnectionstateEnum::
                                   SOCKET_CONNECTION_STATE_LISTENING,
@@ -183,6 +286,8 @@
       break;
   }
   if (status != BT_STATUS_SUCCESS) {
+    btif_sock_connection_logger(SOCKET_CONNECTION_STATE_DISCONNECTED,
+                                SOCKET_ROLE_LISTEN, RawAddress::kEmpty);
     log_socket_connection_state(RawAddress::kEmpty, 0, type,
                                 android::bluetooth::SocketConnectionstateEnum::
                                     SOCKET_CONNECTION_STATE_DISCONNECTED,
@@ -198,9 +303,13 @@
   CHECK(bd_addr != NULL);
   CHECK(sock_fd != NULL);
 
+  LOG_INFO("%s", __func__);
+
   *sock_fd = INVALID_FD;
   bt_status_t status = BT_STATUS_FAIL;
 
+  btif_sock_connection_logger(SOCKET_CONNECTION_STATE_CONNECTING,
+                              SOCKET_ROLE_CONNECTION, *bd_addr);
   log_socket_connection_state(*bd_addr, 0, type,
                               android::bluetooth::SocketConnectionstateEnum::
                                   SOCKET_CONNECTION_STATE_CONNECTING,
@@ -245,6 +354,8 @@
       break;
   }
   if (status != BT_STATUS_SUCCESS) {
+    btif_sock_connection_logger(SOCKET_CONNECTION_STATE_DISCONNECTED,
+                                SOCKET_ROLE_CONNECTION, *bd_addr);
     log_socket_connection_state(*bd_addr, 0, type,
                                 android::bluetooth::SocketConnectionstateEnum::
                                     SOCKET_CONNECTION_STATE_DISCONNECTED,
diff --git a/system/btif/src/btif_sock_l2cap.cc b/system/btif/src/btif_sock_l2cap.cc
index 9d5a5bd..8f42316 100644
--- a/system/btif/src/btif_sock_l2cap.cc
+++ b/system/btif/src/btif_sock_l2cap.cc
@@ -15,6 +15,7 @@
  * limitations under the License.
  */
 
+#include <base/logging.h>
 #include <sys/ioctl.h>
 #include <sys/socket.h>
 #include <sys/types.h>
@@ -24,6 +25,7 @@
 
 #include "bta/include/bta_jv_api.h"
 #include "btif/include/btif_metrics_logging.h"
+#include "btif/include/btif_sock.h"
 #include "btif/include/btif_sock_thread.h"
 #include "btif/include/btif_sock_util.h"
 #include "btif/include/btif_uid.h"
@@ -37,8 +39,6 @@
 #include "stack/include/bt_types.h"
 #include "types/raw_address.h"
 
-#include <base/logging.h>
-
 struct packet {
   struct packet *next, *prev;
   uint32_t len;
@@ -206,6 +206,10 @@
   if (!t) /* prever double-frees */
     return;
 
+  btif_sock_connection_logger(
+      SOCKET_CONNECTION_STATE_DISCONNECTED,
+      sock->server ? SOCKET_ROLE_LISTEN : SOCKET_ROLE_CONNECTION, sock->addr);
+
   // Whenever a socket is freed, the connection must be dropped
   log_socket_connection_state(
       sock->addr, sock->id, sock->is_le_coc ? BTSOCK_L2CAP_LE : BTSOCK_L2CAP,
@@ -389,6 +393,10 @@
 
   sock->handle = p_start->handle;
 
+  btif_sock_connection_logger(
+      SOCKET_CONNECTION_STATE_LISTENING,
+      sock->server ? SOCKET_ROLE_LISTEN : SOCKET_ROLE_CONNECTION, sock->addr);
+
   log_socket_connection_state(
       sock->addr, sock->id, sock->is_le_coc ? BTSOCK_L2CAP_LE : BTSOCK_L2CAP,
       android::bluetooth::SocketConnectionstateEnum::
@@ -452,6 +460,11 @@
   accept_rs->id = sock->id;
   sock->id = new_listen_id;
 
+  btif_sock_connection_logger(
+      SOCKET_CONNECTION_STATE_CONNECTED,
+      accept_rs->server ? SOCKET_ROLE_LISTEN : SOCKET_ROLE_CONNECTION,
+      accept_rs->addr);
+
   log_socket_connection_state(
       accept_rs->addr, accept_rs->id,
       accept_rs->is_le_coc ? BTSOCK_L2CAP_LE : BTSOCK_L2CAP,
@@ -492,6 +505,10 @@
     return;
   }
 
+  btif_sock_connection_logger(
+      SOCKET_CONNECTION_STATE_CONNECTED,
+      sock->server ? SOCKET_ROLE_LISTEN : SOCKET_ROLE_CONNECTION, sock->addr);
+
   log_socket_connection_state(
       sock->addr, sock->id, sock->is_le_coc ? BTSOCK_L2CAP_LE : BTSOCK_L2CAP,
       android::bluetooth::SOCKET_CONNECTION_STATE_CONNECTED, 0, 0,
@@ -544,6 +561,10 @@
     return;
   }
 
+  btif_sock_connection_logger(
+      SOCKET_CONNECTION_STATE_DISCONNECTING,
+      sock->server ? SOCKET_ROLE_LISTEN : SOCKET_ROLE_CONNECTION, sock->addr);
+
   log_socket_connection_state(
       sock->addr, sock->id, sock->is_le_coc ? BTSOCK_L2CAP_LE : BTSOCK_L2CAP,
       android::bluetooth::SOCKET_CONNECTION_STATE_DISCONNECTING, 0, 0,
diff --git a/system/btif/src/btif_sock_rfc.cc b/system/btif/src/btif_sock_rfc.cc
index 7452f86..0a6a26e 100644
--- a/system/btif/src/btif_sock_rfc.cc
+++ b/system/btif/src/btif_sock_rfc.cc
@@ -31,6 +31,7 @@
 #include "btif/include/btif_metrics_logging.h"
 /* The JV interface can have only one user, hence we need to call a few
  * L2CAP functions from this file. */
+#include "btif/include/btif_sock.h"
 #include "btif/include/btif_sock_l2cap.h"
 #include "btif/include/btif_sock_sdp.h"
 #include "btif/include/btif_sock_thread.h"
@@ -404,6 +405,10 @@
   if (slot->fd != INVALID_FD) {
     shutdown(slot->fd, SHUT_RDWR);
     close(slot->fd);
+    btif_sock_connection_logger(
+        SOCKET_CONNECTION_STATE_DISCONNECTED,
+        slot->f.server ? SOCKET_ROLE_LISTEN : SOCKET_ROLE_CONNECTION,
+        slot->addr);
     log_socket_connection_state(
         slot->addr, slot->id, BTSOCK_RFCOMM,
         android::bluetooth::SOCKET_CONNECTION_STATE_DISCONNECTED,
@@ -485,6 +490,10 @@
 
   if (p_start->status == BTA_JV_SUCCESS) {
     slot->rfc_handle = p_start->handle;
+    btif_sock_connection_logger(
+        SOCKET_CONNECTION_STATE_LISTENING,
+        slot->f.server ? SOCKET_ROLE_LISTEN : SOCKET_ROLE_CONNECTION,
+        slot->addr);
     log_socket_connection_state(
         slot->addr, slot->id, BTSOCK_RFCOMM,
         android::bluetooth::SocketConnectionstateEnum::
@@ -508,6 +517,10 @@
       srv_rs, &p_open->rem_bda, p_open->handle, p_open->new_listen_handle);
   if (!accept_rs) return 0;
 
+  btif_sock_connection_logger(
+      SOCKET_CONNECTION_STATE_CONNECTED,
+      accept_rs->f.server ? SOCKET_ROLE_LISTEN : SOCKET_ROLE_CONNECTION,
+      accept_rs->addr);
   log_socket_connection_state(
       accept_rs->addr, accept_rs->id, BTSOCK_RFCOMM,
       android::bluetooth::SOCKET_CONNECTION_STATE_CONNECTED, 0, 0,
@@ -540,6 +553,9 @@
   slot->rfc_port_handle = BTA_JvRfcommGetPortHdl(p_open->handle);
   slot->addr = p_open->rem_bda;
 
+  btif_sock_connection_logger(
+      SOCKET_CONNECTION_STATE_CONNECTED,
+      slot->f.server ? SOCKET_ROLE_LISTEN : SOCKET_ROLE_CONNECTION, slot->addr);
   log_socket_connection_state(
       slot->addr, slot->id, BTSOCK_RFCOMM,
       android::bluetooth::SOCKET_CONNECTION_STATE_CONNECTED, 0, 0,
diff --git a/system/btif/src/btif_storage.cc b/system/btif/src/btif_storage.cc
index b3653c1..7be5f37 100644
--- a/system/btif/src/btif_storage.cc
+++ b/system/btif/src/btif_storage.cc
@@ -100,6 +100,16 @@
 #define BTIF_STORAGE_CSIS_AUTOCONNECT "CsisAutoconnect"
 #define BTIF_STORAGE_CSIS_SET_INFO_BIN "CsisSetInfoBin"
 #define BTIF_STORAGE_LEAUDIO_AUTOCONNECT "LeAudioAutoconnect"
+#define BTIF_STORAGE_LEAUDIO_HANDLES_BIN "LeAudioHandlesBin"
+#define BTIF_STORAGE_LEAUDIO_SINK_PACS_BIN "SinkPacsBin"
+#define BTIF_STORAGE_LEAUDIO_SOURCE_PACS_BIN "SourcePacsBin"
+#define BTIF_STORAGE_LEAUDIO_ASES_BIN "AsesBin"
+#define BTIF_STORAGE_LEAUDIO_SINK_AUDIOLOCATION "SinkAudioLocation"
+#define BTIF_STORAGE_LEAUDIO_SOURCE_AUDIOLOCATION "SourceAudioLocation"
+#define BTIF_STORAGE_LEAUDIO_SINK_SUPPORTED_CONTEXT_TYPE \
+  "SinkSupportedContextType"
+#define BTIF_STORAGE_LEAUDIO_SOURCE_SUPPORTED_CONTEXT_TYPE \
+  "SourceSupportedContextType"
 
 /* This is a local property to add a device found */
 #define BT_PROPERTY_REMOTE_DEVICE_TIMESTAMP 0xFF
@@ -933,7 +943,6 @@
   }
 
   for (RawAddress address : bad_ltk) {
-    android_errorWriteLog(0x534e4554, "128437297");
     LOG(ERROR) << __func__
                << ": removing bond to device using test TLK: " << address;
 
@@ -1862,6 +1871,116 @@
                                   addr, autoconnect));
 }
 
+/** Store ASEs information */
+void btif_storage_leaudio_update_handles_bin(const RawAddress& addr) {
+  std::vector<uint8_t> handles;
+
+  if (LeAudioClient::GetHandlesForStorage(addr, handles)) {
+    do_in_jni_thread(
+        FROM_HERE,
+        Bind(
+            [](const RawAddress& bd_addr, std::vector<uint8_t> handles) {
+              auto bdstr = bd_addr.ToString();
+              btif_config_set_bin(bdstr, BTIF_STORAGE_LEAUDIO_HANDLES_BIN,
+                                  handles.data(), handles.size());
+              btif_config_save();
+            },
+            addr, std::move(handles)));
+  }
+}
+
+/** Store PACs information */
+void btif_storage_leaudio_update_pacs_bin(const RawAddress& addr) {
+  std::vector<uint8_t> sink_pacs;
+
+  if (LeAudioClient::GetSinkPacsForStorage(addr, sink_pacs)) {
+    do_in_jni_thread(
+        FROM_HERE,
+        Bind(
+            [](const RawAddress& bd_addr, std::vector<uint8_t> sink_pacs) {
+              auto bdstr = bd_addr.ToString();
+              btif_config_set_bin(bdstr, BTIF_STORAGE_LEAUDIO_SINK_PACS_BIN,
+                                  sink_pacs.data(), sink_pacs.size());
+              btif_config_save();
+            },
+            addr, std::move(sink_pacs)));
+  }
+
+  std::vector<uint8_t> source_pacs;
+  if (LeAudioClient::GetSourcePacsForStorage(addr, source_pacs)) {
+    do_in_jni_thread(
+        FROM_HERE,
+        Bind(
+            [](const RawAddress& bd_addr, std::vector<uint8_t> source_pacs) {
+              auto bdstr = bd_addr.ToString();
+              btif_config_set_bin(bdstr, BTIF_STORAGE_LEAUDIO_SOURCE_PACS_BIN,
+                                  source_pacs.data(), source_pacs.size());
+              btif_config_save();
+            },
+            addr, std::move(source_pacs)));
+  }
+}
+
+/** Store ASEs information */
+void btif_storage_leaudio_update_ase_bin(const RawAddress& addr) {
+  std::vector<uint8_t> ases;
+
+  if (LeAudioClient::GetAsesForStorage(addr, ases)) {
+    do_in_jni_thread(
+        FROM_HERE,
+        Bind(
+            [](const RawAddress& bd_addr, std::vector<uint8_t> ases) {
+              auto bdstr = bd_addr.ToString();
+              btif_config_set_bin(bdstr, BTIF_STORAGE_LEAUDIO_ASES_BIN,
+                                  ases.data(), ases.size());
+              btif_config_save();
+            },
+            addr, std::move(ases)));
+  }
+}
+
+/** Store Le Audio device audio locations */
+void btif_storage_set_leaudio_audio_location(const RawAddress& addr,
+                                             uint32_t sink_location,
+                                             uint32_t source_location) {
+  do_in_jni_thread(
+      FROM_HERE,
+      Bind(
+          [](const RawAddress& addr, int sink_location, int source_location) {
+            std::string bdstr = addr.ToString();
+            LOG_DEBUG("saving le audio device: %s", bdstr.c_str());
+            btif_config_set_int(bdstr, BTIF_STORAGE_LEAUDIO_SINK_AUDIOLOCATION,
+                                sink_location);
+            btif_config_set_int(bdstr,
+                                BTIF_STORAGE_LEAUDIO_SOURCE_AUDIOLOCATION,
+                                source_location);
+            btif_config_save();
+          },
+          addr, sink_location, source_location));
+}
+
+/** Store Le Audio device context types */
+void btif_storage_set_leaudio_supported_context_types(
+    const RawAddress& addr, uint16_t sink_supported_context_type,
+    uint16_t source_supported_context_type) {
+  do_in_jni_thread(
+      FROM_HERE,
+      Bind(
+          [](const RawAddress& addr, int sink_supported_context_type,
+             int source_supported_context_type) {
+            std::string bdstr = addr.ToString();
+            LOG_DEBUG("saving le audio device: %s", bdstr.c_str());
+            btif_config_set_int(
+                bdstr, BTIF_STORAGE_LEAUDIO_SINK_SUPPORTED_CONTEXT_TYPE,
+                sink_supported_context_type);
+            btif_config_set_int(
+                bdstr, BTIF_STORAGE_LEAUDIO_SOURCE_SUPPORTED_CONTEXT_TYPE,
+                source_supported_context_type);
+            btif_config_save();
+          },
+          addr, sink_supported_context_type, source_supported_context_type));
+}
+
 /** Loads information about bonded Le Audio devices */
 void btif_storage_load_bonded_leaudio() {
   for (const auto& bd_addr : btif_config_get_paired_devices()) {
@@ -1893,8 +2012,65 @@
     if (btif_config_get_int(name, BTIF_STORAGE_LEAUDIO_AUTOCONNECT, &value))
       autoconnect = !!value;
 
+    int sink_audio_location = 0;
+    if (btif_config_get_int(name, BTIF_STORAGE_LEAUDIO_SINK_AUDIOLOCATION,
+                            &value))
+      sink_audio_location = value;
+
+    int source_audio_location = 0;
+    if (btif_config_get_int(name, BTIF_STORAGE_LEAUDIO_SOURCE_AUDIOLOCATION,
+                            &value))
+      source_audio_location = value;
+
+    int sink_supported_context_type = 0;
+    if (btif_config_get_int(
+            name, BTIF_STORAGE_LEAUDIO_SINK_SUPPORTED_CONTEXT_TYPE, &value))
+      sink_supported_context_type = value;
+
+    int source_supported_context_type = 0;
+    if (btif_config_get_int(
+            name, BTIF_STORAGE_LEAUDIO_SOURCE_SUPPORTED_CONTEXT_TYPE, &value))
+      source_supported_context_type = value;
+
+    size_t buffer_size =
+        btif_config_get_bin_length(name, BTIF_STORAGE_LEAUDIO_HANDLES_BIN);
+    std::vector<uint8_t> handles(buffer_size);
+    if (buffer_size > 0) {
+      btif_config_get_bin(name, BTIF_STORAGE_LEAUDIO_HANDLES_BIN,
+                          handles.data(), &buffer_size);
+    }
+
+    buffer_size =
+        btif_config_get_bin_length(name, BTIF_STORAGE_LEAUDIO_SINK_PACS_BIN);
+    std::vector<uint8_t> sink_pacs(buffer_size);
+    if (buffer_size > 0) {
+      btif_config_get_bin(name, BTIF_STORAGE_LEAUDIO_SINK_PACS_BIN,
+                          sink_pacs.data(), &buffer_size);
+    }
+
+    buffer_size =
+        btif_config_get_bin_length(name, BTIF_STORAGE_LEAUDIO_SOURCE_PACS_BIN);
+    std::vector<uint8_t> source_pacs(buffer_size);
+    if (buffer_size > 0) {
+      btif_config_get_bin(name, BTIF_STORAGE_LEAUDIO_SOURCE_PACS_BIN,
+                          source_pacs.data(), &buffer_size);
+    }
+
+    buffer_size =
+        btif_config_get_bin_length(name, BTIF_STORAGE_LEAUDIO_ASES_BIN);
+    std::vector<uint8_t> ases(buffer_size);
+    if (buffer_size > 0) {
+      btif_config_get_bin(name, BTIF_STORAGE_LEAUDIO_ASES_BIN, ases.data(),
+                          &buffer_size);
+    }
+
     do_in_main_thread(
-        FROM_HERE, Bind(&LeAudioClient::AddFromStorage, bd_addr, autoconnect));
+        FROM_HERE,
+        Bind(&LeAudioClient::AddFromStorage, bd_addr, autoconnect,
+             sink_audio_location, source_audio_location,
+             sink_supported_context_type, source_supported_context_type,
+             std::move(handles), std::move(sink_pacs), std::move(source_pacs),
+             std::move(ases)));
   }
 }
 
diff --git a/system/btif/src/btif_util.cc b/system/btif/src/btif_util.cc
index bcd0ef9..00776d9 100644
--- a/system/btif/src/btif_util.cc
+++ b/system/btif/src/btif_util.cc
@@ -112,9 +112,10 @@
     CASE_RETURN_STR(BTA_DM_INQ_RES_EVT)
     CASE_RETURN_STR(BTA_DM_INQ_CMPL_EVT)
     CASE_RETURN_STR(BTA_DM_DISC_RES_EVT)
-    CASE_RETURN_STR(BTA_DM_DISC_BLE_RES_EVT)
+    CASE_RETURN_STR(BTA_DM_GATT_OVER_LE_RES_EVT)
     CASE_RETURN_STR(BTA_DM_DISC_CMPL_EVT)
     CASE_RETURN_STR(BTA_DM_SEARCH_CANCEL_CMPL_EVT)
+    CASE_RETURN_STR(BTA_DM_GATT_OVER_SDP_RES_EVT)
 
     default:
       return "UNKNOWN MSG ID";
diff --git a/system/btif/test/btif_core_test.cc b/system/btif/test/btif_core_test.cc
index 82f86dc..832ba45 100644
--- a/system/btif/test/btif_core_test.cc
+++ b/system/btif/test/btif_core_test.cc
@@ -20,9 +20,16 @@
 #include <map>
 
 #include "bta/include/bta_ag_api.h"
+#include "bta/include/bta_av_api.h"
+#include "bta/include/bta_hd_api.h"
+#include "bta/include/bta_hf_client_api.h"
+#include "bta/include/bta_hh_api.h"
 #include "btcore/include/module.h"
 #include "btif/include/btif_api.h"
 #include "btif/include/btif_common.h"
+#include "btif/include/btif_util.h"
+#include "include/hardware/bluetooth.h"
+#include "include/hardware/bt_av.h"
 #include "types/raw_address.h"
 
 void set_hal_cbacks(bt_callbacks_t* callbacks);
@@ -174,3 +181,459 @@
   ASSERT_EQ(std::future_status::ready, future.wait_for(timeout_time));
   ASSERT_EQ(val, future.get());
 }
+
+extern const char* dump_av_sm_event_name(int event);
+TEST_F(BtifCoreTest, dump_av_sm_event_name) {
+  std::vector<std::pair<int, std::string>> events = {
+      std::make_pair(BTA_AV_ENABLE_EVT, "BTA_AV_ENABLE_EVT"),
+      std::make_pair(BTA_AV_REGISTER_EVT, "BTA_AV_REGISTER_EVT"),
+      std::make_pair(BTA_AV_OPEN_EVT, "BTA_AV_OPEN_EVT"),
+      std::make_pair(BTA_AV_CLOSE_EVT, "BTA_AV_CLOSE_EVT"),
+      std::make_pair(BTA_AV_START_EVT, "BTA_AV_START_EVT"),
+      std::make_pair(BTA_AV_STOP_EVT, "BTA_AV_STOP_EVT"),
+      std::make_pair(BTA_AV_PROTECT_REQ_EVT, "BTA_AV_PROTECT_REQ_EVT"),
+      std::make_pair(BTA_AV_PROTECT_RSP_EVT, "BTA_AV_PROTECT_RSP_EVT"),
+      std::make_pair(BTA_AV_RC_OPEN_EVT, "BTA_AV_RC_OPEN_EVT"),
+      std::make_pair(BTA_AV_RC_CLOSE_EVT, "BTA_AV_RC_CLOSE_EVT"),
+      std::make_pair(BTA_AV_RC_BROWSE_OPEN_EVT, "BTA_AV_RC_BROWSE_OPEN_EVT"),
+      std::make_pair(BTA_AV_RC_BROWSE_CLOSE_EVT, "BTA_AV_RC_BROWSE_CLOSE_EVT"),
+      std::make_pair(BTA_AV_REMOTE_CMD_EVT, "BTA_AV_REMOTE_CMD_EVT"),
+      std::make_pair(BTA_AV_REMOTE_RSP_EVT, "BTA_AV_REMOTE_RSP_EVT"),
+      std::make_pair(BTA_AV_VENDOR_CMD_EVT, "BTA_AV_VENDOR_CMD_EVT"),
+      std::make_pair(BTA_AV_VENDOR_RSP_EVT, "BTA_AV_VENDOR_RSP_EVT"),
+      std::make_pair(BTA_AV_RECONFIG_EVT, "BTA_AV_RECONFIG_EVT"),
+      std::make_pair(BTA_AV_SUSPEND_EVT, "BTA_AV_SUSPEND_EVT"),
+      std::make_pair(BTA_AV_PENDING_EVT, "BTA_AV_PENDING_EVT"),
+      std::make_pair(BTA_AV_META_MSG_EVT, "BTA_AV_META_MSG_EVT"),
+      std::make_pair(BTA_AV_REJECT_EVT, "BTA_AV_REJECT_EVT"),
+      std::make_pair(BTA_AV_RC_FEAT_EVT, "BTA_AV_RC_FEAT_EVT"),
+      std::make_pair(BTA_AV_RC_PSM_EVT, "BTA_AV_RC_PSM_EVT"),
+      std::make_pair(BTA_AV_OFFLOAD_START_RSP_EVT,
+                     "BTA_AV_OFFLOAD_START_RSP_EVT"),
+  };
+  for (const auto& event : events) {
+    ASSERT_STREQ(event.second.c_str(), dump_av_sm_event_name(event.first));
+  }
+  std::ostringstream oss;
+  oss << "UNKNOWN_EVENT";
+  ASSERT_STREQ(oss.str().c_str(),
+               dump_av_sm_event_name(std::numeric_limits<int>::max()));
+}
+
+TEST_F(BtifCoreTest, dump_dm_search_event) {
+  std::vector<std::pair<uint16_t, std::string>> events = {
+      std::make_pair(BTA_DM_INQ_RES_EVT, "BTA_DM_INQ_RES_EVT"),
+      std::make_pair(BTA_DM_INQ_CMPL_EVT, "BTA_DM_INQ_CMPL_EVT"),
+      std::make_pair(BTA_DM_DISC_RES_EVT, "BTA_DM_DISC_RES_EVT"),
+      std::make_pair(BTA_DM_GATT_OVER_LE_RES_EVT,
+                     "BTA_DM_GATT_OVER_LE_RES_EVT"),
+      std::make_pair(BTA_DM_DISC_CMPL_EVT, "BTA_DM_DISC_CMPL_EVT"),
+      std::make_pair(BTA_DM_SEARCH_CANCEL_CMPL_EVT,
+                     "BTA_DM_SEARCH_CANCEL_CMPL_EVT"),
+      std::make_pair(BTA_DM_GATT_OVER_SDP_RES_EVT,
+                     "BTA_DM_GATT_OVER_SDP_RES_EVT"),
+  };
+  for (const auto& event : events) {
+    ASSERT_STREQ(event.second.c_str(), dump_dm_search_event(event.first));
+  }
+  std::ostringstream oss;
+  oss << "UNKNOWN MSG ID";
+  ASSERT_STREQ(oss.str().c_str(),
+               dump_dm_search_event(std::numeric_limits<uint16_t>::max()));
+}
+
+TEST_F(BtifCoreTest, dump_property_type) {
+  std::vector<std::pair<bt_property_type_t, std::string>> types = {
+      std::make_pair(BT_PROPERTY_BDNAME, "BT_PROPERTY_BDNAME"),
+      std::make_pair(BT_PROPERTY_BDADDR, "BT_PROPERTY_BDADDR"),
+      std::make_pair(BT_PROPERTY_UUIDS, "BT_PROPERTY_UUIDS"),
+      std::make_pair(BT_PROPERTY_CLASS_OF_DEVICE,
+                     "BT_PROPERTY_CLASS_OF_DEVICE"),
+      std::make_pair(BT_PROPERTY_TYPE_OF_DEVICE, "BT_PROPERTY_TYPE_OF_DEVICE"),
+      std::make_pair(BT_PROPERTY_REMOTE_RSSI, "BT_PROPERTY_REMOTE_RSSI"),
+      std::make_pair(BT_PROPERTY_ADAPTER_DISCOVERABLE_TIMEOUT,
+                     "BT_PROPERTY_ADAPTER_DISCOVERABLE_TIMEOUT"),
+      std::make_pair(BT_PROPERTY_ADAPTER_BONDED_DEVICES,
+                     "BT_PROPERTY_ADAPTER_BONDED_DEVICES"),
+      std::make_pair(BT_PROPERTY_ADAPTER_SCAN_MODE,
+                     "BT_PROPERTY_ADAPTER_SCAN_MODE"),
+      std::make_pair(BT_PROPERTY_REMOTE_FRIENDLY_NAME,
+                     "BT_PROPERTY_REMOTE_FRIENDLY_NAME"),
+  };
+  for (const auto& type : types) {
+    ASSERT_STREQ(type.second.c_str(), dump_property_type(type.first));
+  }
+  std::ostringstream oss;
+  oss << "UNKNOWN PROPERTY ID";
+  ASSERT_STREQ(oss.str().c_str(),
+               dump_property_type(static_cast<bt_property_type_t>(
+                   std::numeric_limits<uint16_t>::max())));
+}
+
+TEST_F(BtifCoreTest, dump_dm_event) {
+  std::vector<std::pair<uint8_t, std::string>> events = {
+      std::make_pair(BTA_DM_PIN_REQ_EVT, "BTA_DM_PIN_REQ_EVT"),
+      std::make_pair(BTA_DM_AUTH_CMPL_EVT, "BTA_DM_AUTH_CMPL_EVT"),
+      std::make_pair(BTA_DM_LINK_UP_EVT, "BTA_DM_LINK_UP_EVT"),
+      std::make_pair(BTA_DM_LINK_DOWN_EVT, "BTA_DM_LINK_DOWN_EVT"),
+      std::make_pair(BTA_DM_BOND_CANCEL_CMPL_EVT,
+                     "BTA_DM_BOND_CANCEL_CMPL_EVT"),
+      std::make_pair(BTA_DM_SP_CFM_REQ_EVT, "BTA_DM_SP_CFM_REQ_EVT"),
+      std::make_pair(BTA_DM_SP_KEY_NOTIF_EVT, "BTA_DM_SP_KEY_NOTIF_EVT"),
+      std::make_pair(BTA_DM_BLE_KEY_EVT, "BTA_DM_BLE_KEY_EVT"),
+      std::make_pair(BTA_DM_BLE_SEC_REQ_EVT, "BTA_DM_BLE_SEC_REQ_EVT"),
+      std::make_pair(BTA_DM_BLE_PASSKEY_NOTIF_EVT,
+                     "BTA_DM_BLE_PASSKEY_NOTIF_EVT"),
+      std::make_pair(BTA_DM_BLE_PASSKEY_REQ_EVT, "BTA_DM_BLE_PASSKEY_REQ_EVT"),
+      std::make_pair(BTA_DM_BLE_OOB_REQ_EVT, "BTA_DM_BLE_OOB_REQ_EVT"),
+      std::make_pair(BTA_DM_BLE_SC_OOB_REQ_EVT, "BTA_DM_BLE_SC_OOB_REQ_EVT"),
+      std::make_pair(BTA_DM_BLE_LOCAL_IR_EVT, "BTA_DM_BLE_LOCAL_IR_EVT"),
+      std::make_pair(BTA_DM_BLE_LOCAL_ER_EVT, "BTA_DM_BLE_LOCAL_ER_EVT"),
+      std::make_pair(BTA_DM_BLE_AUTH_CMPL_EVT, "BTA_DM_BLE_AUTH_CMPL_EVT"),
+      std::make_pair(BTA_DM_DEV_UNPAIRED_EVT, "BTA_DM_DEV_UNPAIRED_EVT"),
+      std::make_pair(BTA_DM_ENER_INFO_READ, "BTA_DM_ENER_INFO_READ"),
+      std::make_pair(BTA_DM_REPORT_BONDING_EVT, "BTA_DM_REPORT_BONDING_EVT"),
+  };
+  for (const auto& event : events) {
+    ASSERT_STREQ(event.second.c_str(), dump_dm_event(event.first));
+  }
+  std::ostringstream oss;
+  oss << "UNKNOWN DM EVENT";
+  ASSERT_STREQ(oss.str().c_str(),
+               dump_dm_event(std::numeric_limits<uint8_t>::max()));
+}
+
+TEST_F(BtifCoreTest, dump_hf_event) {
+  std::vector<std::pair<uint8_t, std::string>> events = {
+      std::make_pair(BTA_AG_ENABLE_EVT, "BTA_AG_ENABLE_EVT"),
+      std::make_pair(BTA_AG_REGISTER_EVT, "BTA_AG_REGISTER_EVT"),
+      std::make_pair(BTA_AG_OPEN_EVT, "BTA_AG_OPEN_EVT"),
+      std::make_pair(BTA_AG_CLOSE_EVT, "BTA_AG_CLOSE_EVT"),
+      std::make_pair(BTA_AG_CONN_EVT, "BTA_AG_CONN_EVT"),
+      std::make_pair(BTA_AG_AUDIO_OPEN_EVT, "BTA_AG_AUDIO_OPEN_EVT"),
+      std::make_pair(BTA_AG_AUDIO_CLOSE_EVT, "BTA_AG_AUDIO_CLOSE_EVT"),
+      std::make_pair(BTA_AG_SPK_EVT, "BTA_AG_SPK_EVT"),
+      std::make_pair(BTA_AG_MIC_EVT, "BTA_AG_MIC_EVT"),
+      std::make_pair(BTA_AG_AT_CKPD_EVT, "BTA_AG_AT_CKPD_EVT"),
+      std::make_pair(BTA_AG_DISABLE_EVT, "BTA_AG_DISABLE_EVT"),
+      std::make_pair(BTA_AG_WBS_EVT, "BTA_AG_WBS_EVT"),
+      std::make_pair(BTA_AG_AT_A_EVT, "BTA_AG_AT_A_EVT"),
+      std::make_pair(BTA_AG_AT_D_EVT, "BTA_AG_AT_D_EVT"),
+      std::make_pair(BTA_AG_AT_CHLD_EVT, "BTA_AG_AT_CHLD_EVT"),
+      std::make_pair(BTA_AG_AT_CHUP_EVT, "BTA_AG_AT_CHUP_EVT"),
+      std::make_pair(BTA_AG_AT_CIND_EVT, "BTA_AG_AT_CIND_EVT"),
+      std::make_pair(BTA_AG_AT_VTS_EVT, "BTA_AG_AT_VTS_EVT"),
+      std::make_pair(BTA_AG_AT_BINP_EVT, "BTA_AG_AT_BINP_EVT"),
+      std::make_pair(BTA_AG_AT_BLDN_EVT, "BTA_AG_AT_BLDN_EVT"),
+      std::make_pair(BTA_AG_AT_BVRA_EVT, "BTA_AG_AT_BVRA_EVT"),
+      std::make_pair(BTA_AG_AT_NREC_EVT, "BTA_AG_AT_NREC_EVT"),
+      std::make_pair(BTA_AG_AT_CNUM_EVT, "BTA_AG_AT_CNUM_EVT"),
+      std::make_pair(BTA_AG_AT_BTRH_EVT, "BTA_AG_AT_BTRH_EVT"),
+      std::make_pair(BTA_AG_AT_CLCC_EVT, "BTA_AG_AT_CLCC_EVT"),
+      std::make_pair(BTA_AG_AT_COPS_EVT, "BTA_AG_AT_COPS_EVT"),
+      std::make_pair(BTA_AG_AT_UNAT_EVT, "BTA_AG_AT_UNAT_EVT"),
+      std::make_pair(BTA_AG_AT_CBC_EVT, "BTA_AG_AT_CBC_EVT"),
+      std::make_pair(BTA_AG_AT_BAC_EVT, "BTA_AG_AT_BAC_EVT"),
+      std::make_pair(BTA_AG_AT_BCS_EVT, "BTA_AG_AT_BCS_EVT"),
+      std::make_pair(BTA_AG_AT_BIND_EVT, "BTA_AG_AT_BIND_EVT"),
+      std::make_pair(BTA_AG_AT_BIEV_EVT, "BTA_AG_AT_BIEV_EVT"),
+      std::make_pair(BTA_AG_AT_BIA_EVT, "BTA_AG_AT_BIA_EVT"),
+  };
+  for (const auto& event : events) {
+    ASSERT_STREQ(event.second.c_str(), dump_hf_event(event.first));
+  }
+  std::ostringstream oss;
+  oss << "UNKNOWN MSG ID";
+  ASSERT_STREQ(oss.str().c_str(),
+               dump_hf_event(std::numeric_limits<uint8_t>::max()));
+}
+
+TEST_F(BtifCoreTest, dump_hf_client_event) {
+  std::vector<std::pair<int, std::string>> events = {
+      std::make_pair(BTA_HF_CLIENT_ENABLE_EVT, "BTA_HF_CLIENT_ENABLE_EVT"),
+      std::make_pair(BTA_HF_CLIENT_REGISTER_EVT, "BTA_HF_CLIENT_REGISTER_EVT"),
+      std::make_pair(BTA_HF_CLIENT_OPEN_EVT, "BTA_HF_CLIENT_OPEN_EVT"),
+      std::make_pair(BTA_HF_CLIENT_CLOSE_EVT, "BTA_HF_CLIENT_CLOSE_EVT"),
+      std::make_pair(BTA_HF_CLIENT_CONN_EVT, "BTA_HF_CLIENT_CONN_EVT"),
+      std::make_pair(BTA_HF_CLIENT_AUDIO_OPEN_EVT,
+                     "BTA_HF_CLIENT_AUDIO_OPEN_EVT"),
+      std::make_pair(BTA_HF_CLIENT_AUDIO_MSBC_OPEN_EVT,
+                     "BTA_HF_CLIENT_AUDIO_MSBC_OPEN_EVT"),
+      std::make_pair(BTA_HF_CLIENT_AUDIO_CLOSE_EVT,
+                     "BTA_HF_CLIENT_AUDIO_CLOSE_EVT"),
+      std::make_pair(BTA_HF_CLIENT_SPK_EVT, "BTA_HF_CLIENT_SPK_EVT"),
+      std::make_pair(BTA_HF_CLIENT_MIC_EVT, "BTA_HF_CLIENT_MIC_EVT"),
+      std::make_pair(BTA_HF_CLIENT_DISABLE_EVT, "BTA_HF_CLIENT_DISABLE_EVT"),
+      std::make_pair(BTA_HF_CLIENT_IND_EVT, "BTA_HF_CLIENT_IND_EVT"),
+      std::make_pair(BTA_HF_CLIENT_VOICE_REC_EVT,
+                     "BTA_HF_CLIENT_VOICE_REC_EVT"),
+      std::make_pair(BTA_HF_CLIENT_OPERATOR_NAME_EVT,
+                     "BTA_HF_CLIENT_OPERATOR_NAME_EVT"),
+      std::make_pair(BTA_HF_CLIENT_CLIP_EVT, "BTA_HF_CLIENT_CLIP_EVT"),
+      std::make_pair(BTA_HF_CLIENT_CCWA_EVT, "BTA_HF_CLIENT_CCWA_EVT"),
+      std::make_pair(BTA_HF_CLIENT_AT_RESULT_EVT,
+                     "BTA_HF_CLIENT_AT_RESULT_EVT"),
+      std::make_pair(BTA_HF_CLIENT_CLCC_EVT, "BTA_HF_CLIENT_CLCC_EVT"),
+      std::make_pair(BTA_HF_CLIENT_CNUM_EVT, "BTA_HF_CLIENT_CNUM_EVT"),
+      std::make_pair(BTA_HF_CLIENT_BTRH_EVT, "BTA_HF_CLIENT_BTRH_EVT"),
+      std::make_pair(BTA_HF_CLIENT_BSIR_EVT, "BTA_HF_CLIENT_BSIR_EVT"),
+      std::make_pair(BTA_HF_CLIENT_BINP_EVT, "BTA_HF_CLIENT_BINP_EVT"),
+      std::make_pair(BTA_HF_CLIENT_RING_INDICATION,
+                     "BTA_HF_CLIENT_RING_INDICATION"),
+  };
+  for (const auto& event : events) {
+    ASSERT_STREQ(event.second.c_str(), dump_hf_client_event(event.first));
+  }
+  std::ostringstream oss;
+  oss << "UNKNOWN MSG ID";
+  ASSERT_STREQ(oss.str().c_str(),
+               dump_hf_client_event(std::numeric_limits<uint16_t>::max()));
+}
+
+TEST_F(BtifCoreTest, dump_hh_event) {
+  std::vector<std::pair<int, std::string>> events = {
+      std::make_pair(BTA_HH_ENABLE_EVT, "BTA_HH_ENABLE_EVT"),
+      std::make_pair(BTA_HH_DISABLE_EVT, "BTA_HH_DISABLE_EVT"),
+      std::make_pair(BTA_HH_OPEN_EVT, "BTA_HH_OPEN_EVT"),
+      std::make_pair(BTA_HH_CLOSE_EVT, "BTA_HH_CLOSE_EVT"),
+      std::make_pair(BTA_HH_GET_DSCP_EVT, "BTA_HH_GET_DSCP_EVT"),
+      std::make_pair(BTA_HH_GET_PROTO_EVT, "BTA_HH_GET_PROTO_EVT"),
+      std::make_pair(BTA_HH_GET_RPT_EVT, "BTA_HH_GET_RPT_EVT"),
+      std::make_pair(BTA_HH_GET_IDLE_EVT, "BTA_HH_GET_IDLE_EVT"),
+      std::make_pair(BTA_HH_SET_PROTO_EVT, "BTA_HH_SET_PROTO_EVT"),
+      std::make_pair(BTA_HH_SET_RPT_EVT, "BTA_HH_SET_RPT_EVT"),
+      std::make_pair(BTA_HH_SET_IDLE_EVT, "BTA_HH_SET_IDLE_EVT"),
+      std::make_pair(BTA_HH_VC_UNPLUG_EVT, "BTA_HH_VC_UNPLUG_EVT"),
+      std::make_pair(BTA_HH_ADD_DEV_EVT, "BTA_HH_ADD_DEV_EVT"),
+      std::make_pair(BTA_HH_RMV_DEV_EVT, "BTA_HH_RMV_DEV_EVT"),
+      std::make_pair(BTA_HH_API_ERR_EVT, "BTA_HH_API_ERR_EVT"),
+  };
+  for (const auto& event : events) {
+    ASSERT_STREQ(event.second.c_str(), dump_hh_event(event.first));
+  }
+  std::ostringstream oss;
+  oss << "UNKNOWN MSG ID";
+  ASSERT_STREQ(oss.str().c_str(),
+               dump_hh_event(std::numeric_limits<uint16_t>::max()));
+}
+
+TEST_F(BtifCoreTest, dump_hd_event) {
+  std::vector<std::pair<uint16_t, std::string>> events = {
+      std::make_pair(BTA_HD_ENABLE_EVT, "BTA_HD_ENABLE_EVT"),
+      std::make_pair(BTA_HD_DISABLE_EVT, "BTA_HD_DISABLE_EVT"),
+      std::make_pair(BTA_HD_REGISTER_APP_EVT, "BTA_HD_REGISTER_APP_EVT"),
+      std::make_pair(BTA_HD_UNREGISTER_APP_EVT, "BTA_HD_UNREGISTER_APP_EVT"),
+      std::make_pair(BTA_HD_OPEN_EVT, "BTA_HD_OPEN_EVT"),
+      std::make_pair(BTA_HD_CLOSE_EVT, "BTA_HD_CLOSE_EVT"),
+      std::make_pair(BTA_HD_GET_REPORT_EVT, "BTA_HD_GET_REPORT_EVT"),
+      std::make_pair(BTA_HD_SET_REPORT_EVT, "BTA_HD_SET_REPORT_EVT"),
+      std::make_pair(BTA_HD_SET_PROTOCOL_EVT, "BTA_HD_SET_PROTOCOL_EVT"),
+      std::make_pair(BTA_HD_INTR_DATA_EVT, "BTA_HD_INTR_DATA_EVT"),
+      std::make_pair(BTA_HD_VC_UNPLUG_EVT, "BTA_HD_VC_UNPLUG_EVT"),
+      std::make_pair(BTA_HD_CONN_STATE_EVT, "BTA_HD_CONN_STATE_EVT"),
+      std::make_pair(BTA_HD_API_ERR_EVT, "BTA_HD_API_ERR_EVT"),
+  };
+  for (const auto& event : events) {
+    ASSERT_STREQ(event.second.c_str(), dump_hd_event(event.first));
+  }
+  std::ostringstream oss;
+  oss << "UNKNOWN MSG ID";
+  ASSERT_STREQ(oss.str().c_str(),
+               dump_hd_event(std::numeric_limits<uint16_t>::max()));
+}
+
+TEST_F(BtifCoreTest, dump_thread_evt) {
+  std::vector<std::pair<bt_cb_thread_evt, std::string>> events = {
+      std::make_pair(ASSOCIATE_JVM, "ASSOCIATE_JVM"),
+      std::make_pair(DISASSOCIATE_JVM, "DISASSOCIATE_JVM"),
+  };
+  for (const auto& event : events) {
+    ASSERT_STREQ(event.second.c_str(), dump_thread_evt(event.first));
+  }
+  std::ostringstream oss;
+  oss << "unknown thread evt";
+  ASSERT_STREQ(oss.str().c_str(), dump_thread_evt(static_cast<bt_cb_thread_evt>(
+                                      std::numeric_limits<uint16_t>::max())));
+}
+
+TEST_F(BtifCoreTest, dump_av_conn_state) {
+  std::vector<std::pair<uint16_t, std::string>> events = {
+      std::make_pair(BTAV_CONNECTION_STATE_DISCONNECTED,
+                     "BTAV_CONNECTION_STATE_DISCONNECTED"),
+      std::make_pair(BTAV_CONNECTION_STATE_CONNECTING,
+                     "BTAV_CONNECTION_STATE_CONNECTING"),
+      std::make_pair(BTAV_CONNECTION_STATE_CONNECTED,
+                     "BTAV_CONNECTION_STATE_CONNECTED"),
+      std::make_pair(BTAV_CONNECTION_STATE_DISCONNECTING,
+                     "BTAV_CONNECTION_STATE_DISCONNECTING"),
+  };
+  for (const auto& event : events) {
+    ASSERT_STREQ(event.second.c_str(), dump_av_conn_state(event.first));
+  }
+  std::ostringstream oss;
+  oss << "UNKNOWN MSG ID";
+  ASSERT_STREQ(oss.str().c_str(),
+               dump_av_conn_state(std::numeric_limits<uint16_t>::max()));
+}
+
+TEST_F(BtifCoreTest, dump_av_audio_state) {
+  std::vector<std::pair<uint16_t, std::string>> events = {
+      std::make_pair(BTAV_AUDIO_STATE_REMOTE_SUSPEND,
+                     "BTAV_AUDIO_STATE_REMOTE_SUSPEND"),
+      std::make_pair(BTAV_AUDIO_STATE_STOPPED, "BTAV_AUDIO_STATE_STOPPED"),
+      std::make_pair(BTAV_AUDIO_STATE_STARTED, "BTAV_AUDIO_STATE_STARTED"),
+  };
+  for (const auto& event : events) {
+    ASSERT_STREQ(event.second.c_str(), dump_av_audio_state(event.first));
+  }
+  std::ostringstream oss;
+  oss << "UNKNOWN MSG ID";
+  ASSERT_STREQ(oss.str().c_str(),
+               dump_av_audio_state(std::numeric_limits<uint16_t>::max()));
+}
+
+TEST_F(BtifCoreTest, dump_adapter_scan_mode) {
+  std::vector<std::pair<bt_scan_mode_t, std::string>> events = {
+      std::make_pair(BT_SCAN_MODE_NONE, "BT_SCAN_MODE_NONE"),
+      std::make_pair(BT_SCAN_MODE_CONNECTABLE, "BT_SCAN_MODE_CONNECTABLE"),
+      std::make_pair(BT_SCAN_MODE_CONNECTABLE_DISCOVERABLE,
+                     "BT_SCAN_MODE_CONNECTABLE_DISCOVERABLE"),
+  };
+  for (const auto& event : events) {
+    ASSERT_STREQ(event.second.c_str(), dump_adapter_scan_mode(event.first));
+  }
+  std::ostringstream oss;
+  oss << "unknown scan mode";
+  ASSERT_STREQ(oss.str().c_str(),
+               dump_adapter_scan_mode(static_cast<bt_scan_mode_t>(
+                   std::numeric_limits<int>::max())));
+}
+
+TEST_F(BtifCoreTest, dump_bt_status) {
+  std::vector<std::pair<bt_status_t, std::string>> events = {
+      std::make_pair(BT_STATUS_SUCCESS, "BT_STATUS_SUCCESS"),
+      std::make_pair(BT_STATUS_FAIL, "BT_STATUS_FAIL"),
+      std::make_pair(BT_STATUS_NOT_READY, "BT_STATUS_NOT_READY"),
+      std::make_pair(BT_STATUS_NOMEM, "BT_STATUS_NOMEM"),
+      std::make_pair(BT_STATUS_BUSY, "BT_STATUS_BUSY"),
+      std::make_pair(BT_STATUS_UNSUPPORTED, "BT_STATUS_UNSUPPORTED"),
+  };
+  for (const auto& event : events) {
+    ASSERT_STREQ(event.second.c_str(), dump_bt_status(event.first));
+  }
+  std::ostringstream oss;
+  oss << "unknown scan mode";
+  ASSERT_STREQ(oss.str().c_str(), dump_bt_status(static_cast<bt_status_t>(
+                                      std::numeric_limits<int>::max())));
+}
+
+TEST_F(BtifCoreTest, dump_rc_event) {
+  std::vector<std::pair<uint8_t, std::string>> events = {
+      std::make_pair(BTA_AV_RC_OPEN_EVT, "BTA_AV_RC_OPEN_EVT"),
+      std::make_pair(BTA_AV_RC_CLOSE_EVT, "BTA_AV_RC_CLOSE_EVT"),
+      std::make_pair(BTA_AV_RC_BROWSE_OPEN_EVT, "BTA_AV_RC_BROWSE_OPEN_EVT"),
+      std::make_pair(BTA_AV_RC_BROWSE_CLOSE_EVT, "BTA_AV_RC_BROWSE_CLOSE_EVT"),
+      std::make_pair(BTA_AV_REMOTE_CMD_EVT, "BTA_AV_REMOTE_CMD_EVT"),
+      std::make_pair(BTA_AV_REMOTE_RSP_EVT, "BTA_AV_REMOTE_RSP_EVT"),
+      std::make_pair(BTA_AV_VENDOR_CMD_EVT, "BTA_AV_VENDOR_CMD_EVT"),
+      std::make_pair(BTA_AV_VENDOR_RSP_EVT, "BTA_AV_VENDOR_RSP_EVT"),
+      std::make_pair(BTA_AV_META_MSG_EVT, "BTA_AV_META_MSG_EVT"),
+      std::make_pair(BTA_AV_RC_FEAT_EVT, "BTA_AV_RC_FEAT_EVT"),
+      std::make_pair(BTA_AV_RC_PSM_EVT, "BTA_AV_RC_PSM_EVT"),
+  };
+  for (const auto& event : events) {
+    ASSERT_STREQ(event.second.c_str(), dump_rc_event(event.first));
+  }
+  std::ostringstream oss;
+  oss << "UNKNOWN_EVENT";
+  ASSERT_STREQ(oss.str().c_str(),
+               dump_rc_event(std::numeric_limits<uint8_t>::max()));
+}
+
+TEST_F(BtifCoreTest, dump_rc_notification_event_id) {
+  std::vector<std::pair<uint8_t, std::string>> events = {
+      std::make_pair(AVRC_EVT_PLAY_STATUS_CHANGE,
+                     "AVRC_EVT_PLAY_STATUS_CHANGE"),
+      std::make_pair(AVRC_EVT_TRACK_CHANGE, "AVRC_EVT_TRACK_CHANGE"),
+      std::make_pair(AVRC_EVT_TRACK_REACHED_END, "AVRC_EVT_TRACK_REACHED_END"),
+      std::make_pair(AVRC_EVT_TRACK_REACHED_START,
+                     "AVRC_EVT_TRACK_REACHED_START"),
+      std::make_pair(AVRC_EVT_PLAY_POS_CHANGED, "AVRC_EVT_PLAY_POS_CHANGED"),
+      std::make_pair(AVRC_EVT_BATTERY_STATUS_CHANGE,
+                     "AVRC_EVT_BATTERY_STATUS_CHANGE"),
+      std::make_pair(AVRC_EVT_SYSTEM_STATUS_CHANGE,
+                     "AVRC_EVT_SYSTEM_STATUS_CHANGE"),
+      std::make_pair(AVRC_EVT_APP_SETTING_CHANGE,
+                     "AVRC_EVT_APP_SETTING_CHANGE"),
+      std::make_pair(AVRC_EVT_VOLUME_CHANGE, "AVRC_EVT_VOLUME_CHANGE"),
+      std::make_pair(AVRC_EVT_ADDR_PLAYER_CHANGE,
+                     "AVRC_EVT_ADDR_PLAYER_CHANGE"),
+      std::make_pair(AVRC_EVT_AVAL_PLAYERS_CHANGE,
+                     "AVRC_EVT_AVAL_PLAYERS_CHANGE"),
+      std::make_pair(AVRC_EVT_NOW_PLAYING_CHANGE,
+                     "AVRC_EVT_NOW_PLAYING_CHANGE"),
+      std::make_pair(AVRC_EVT_UIDS_CHANGE, "AVRC_EVT_UIDS_CHANGE"),
+  };
+  for (const auto& event : events) {
+    ASSERT_STREQ(event.second.c_str(),
+                 dump_rc_notification_event_id(event.first));
+  }
+  std::ostringstream oss;
+  oss << "Unhandled Event ID";
+  ASSERT_STREQ(oss.str().c_str(), dump_rc_notification_event_id(
+                                      std::numeric_limits<uint8_t>::max()));
+}
+
+TEST_F(BtifCoreTest, dump_rc_pdu) {
+  std::vector<std::pair<uint8_t, std::string>> pdus = {
+      std::make_pair(AVRC_PDU_LIST_PLAYER_APP_ATTR,
+                     "AVRC_PDU_LIST_PLAYER_APP_ATTR"),
+      std::make_pair(AVRC_PDU_LIST_PLAYER_APP_VALUES,
+                     "AVRC_PDU_LIST_PLAYER_APP_VALUES"),
+      std::make_pair(AVRC_PDU_GET_CUR_PLAYER_APP_VALUE,
+                     "AVRC_PDU_GET_CUR_PLAYER_APP_VALUE"),
+      std::make_pair(AVRC_PDU_SET_PLAYER_APP_VALUE,
+                     "AVRC_PDU_SET_PLAYER_APP_VALUE"),
+      std::make_pair(AVRC_PDU_GET_PLAYER_APP_ATTR_TEXT,
+                     "AVRC_PDU_GET_PLAYER_APP_ATTR_TEXT"),
+      std::make_pair(AVRC_PDU_GET_PLAYER_APP_VALUE_TEXT,
+                     "AVRC_PDU_GET_PLAYER_APP_VALUE_TEXT"),
+      std::make_pair(AVRC_PDU_INFORM_DISPLAY_CHARSET,
+                     "AVRC_PDU_INFORM_DISPLAY_CHARSET"),
+      std::make_pair(AVRC_PDU_INFORM_BATTERY_STAT_OF_CT,
+                     "AVRC_PDU_INFORM_BATTERY_STAT_OF_CT"),
+      std::make_pair(AVRC_PDU_GET_ELEMENT_ATTR, "AVRC_PDU_GET_ELEMENT_ATTR"),
+      std::make_pair(AVRC_PDU_GET_PLAY_STATUS, "AVRC_PDU_GET_PLAY_STATUS"),
+      std::make_pair(AVRC_PDU_REGISTER_NOTIFICATION,
+                     "AVRC_PDU_REGISTER_NOTIFICATION"),
+      std::make_pair(AVRC_PDU_REQUEST_CONTINUATION_RSP,
+                     "AVRC_PDU_REQUEST_CONTINUATION_RSP"),
+      std::make_pair(AVRC_PDU_ABORT_CONTINUATION_RSP,
+                     "AVRC_PDU_ABORT_CONTINUATION_RSP"),
+      std::make_pair(AVRC_PDU_SET_ABSOLUTE_VOLUME,
+                     "AVRC_PDU_SET_ABSOLUTE_VOLUME"),
+      std::make_pair(AVRC_PDU_SET_ADDRESSED_PLAYER,
+                     "AVRC_PDU_SET_ADDRESSED_PLAYER"),
+      std::make_pair(AVRC_PDU_CHANGE_PATH, "AVRC_PDU_CHANGE_PATH"),
+      std::make_pair(AVRC_PDU_GET_CAPABILITIES, "AVRC_PDU_GET_CAPABILITIES"),
+      std::make_pair(AVRC_PDU_SET_BROWSED_PLAYER,
+                     "AVRC_PDU_SET_BROWSED_PLAYER"),
+      std::make_pair(AVRC_PDU_GET_FOLDER_ITEMS, "AVRC_PDU_GET_FOLDER_ITEMS"),
+      std::make_pair(AVRC_PDU_GET_ITEM_ATTRIBUTES,
+                     "AVRC_PDU_GET_ITEM_ATTRIBUTES"),
+      std::make_pair(AVRC_PDU_PLAY_ITEM, "AVRC_PDU_PLAY_ITEM"),
+      std::make_pair(AVRC_PDU_SEARCH, "AVRC_PDU_SEARCH"),
+      std::make_pair(AVRC_PDU_ADD_TO_NOW_PLAYING,
+                     "AVRC_PDU_ADD_TO_NOW_PLAYING"),
+      std::make_pair(AVRC_PDU_GET_TOTAL_NUM_OF_ITEMS,
+                     "AVRC_PDU_GET_TOTAL_NUM_OF_ITEMS"),
+      std::make_pair(AVRC_PDU_GENERAL_REJECT, "AVRC_PDU_GENERAL_REJECT"),
+  };
+  for (const auto& pdu : pdus) {
+    ASSERT_STREQ(pdu.second.c_str(), dump_rc_pdu(pdu.first));
+  }
+  std::ostringstream oss;
+  oss << "Unknown PDU";
+  ASSERT_STREQ(oss.str().c_str(),
+               dump_rc_pdu(std::numeric_limits<uint8_t>::max()));
+}
diff --git a/system/btif/test/btif_hf_client_service_test.cc b/system/btif/test/btif_hf_client_service_test.cc
index db48af1..5a8863b 100644
--- a/system/btif/test/btif_hf_client_service_test.cc
+++ b/system/btif/test/btif_hf_client_service_test.cc
@@ -2,11 +2,42 @@
 #include <gtest/gtest.h>
 #include "bta_hfp_api.h"
 
+#ifdef OS_ANDROID
+#include <hfp.sysprop.h>
+#endif
+
 #undef LOG_TAG
 #include "btif/src/btif_hf_client.cc"
 
 static tBTA_HF_CLIENT_FEAT gFeatures;
 
+#define DEFAULT_BTA_HFP_VERSION HFP_VERSION_1_7
+int get_default_hfp_version() {
+#ifdef OS_ANDROID
+  static const int version =
+      android::sysprop::bluetooth::Hfp::version().value_or(
+          DEFAULT_BTA_HFP_VERSION);
+  return version;
+#else
+  return DEFAULT_BTA_HFP_VERSION;
+#endif
+}
+
+int get_default_hf_client_features() {
+#define DEFAULT_BTIF_HF_CLIENT_FEATURES                                        \
+  (BTA_HF_CLIENT_FEAT_ECNR | BTA_HF_CLIENT_FEAT_3WAY |                         \
+   BTA_HF_CLIENT_FEAT_CLI | BTA_HF_CLIENT_FEAT_VREC | BTA_HF_CLIENT_FEAT_VOL | \
+   BTA_HF_CLIENT_FEAT_ECS | BTA_HF_CLIENT_FEAT_ECC | BTA_HF_CLIENT_FEAT_CODEC)
+
+#ifdef OS_ANDROID
+  static const int features =
+      android::sysprop::bluetooth::Hfp::hf_client_features().value_or(
+          DEFAULT_BTIF_HF_CLIENT_FEATURES);
+  return features;
+#else
+  return DEFAULT_BTIF_HF_CLIENT_FEATURES;
+#endif
+}
 
 uint8_t btif_trace_level = BT_TRACE_LEVEL_WARNING;
 void LogMsg(uint32_t trace_set_mask, const char* fmt_str, ...) {}
@@ -29,9 +60,7 @@
 
 class BtifHfClientTest : public ::testing::Test {
  protected:
-  void SetUp() override {
-    gFeatures = BTIF_HF_CLIENT_FEATURES;
-  }
+  void SetUp() override { gFeatures = get_default_hf_client_features(); }
 
   void TearDown() override {}
 };
@@ -41,5 +70,5 @@
 
   btif_hf_client_execute_service(enable);
   ASSERT_EQ((gFeatures & BTA_HF_CLIENT_FEAT_ESCO_S4) > 0,
-            BTA_HFP_VERSION >= HFP_VERSION_1_7);
+            get_default_hfp_version() >= HFP_VERSION_1_7);
 }
diff --git a/system/btif/test/btif_hh_test.cc b/system/btif/test/btif_hh_test.cc
new file mode 100644
index 0000000..9c1fc9d
--- /dev/null
+++ b/system/btif/test/btif_hh_test.cc
@@ -0,0 +1,284 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "btif/include/btif_hh.h"
+
+#include <gtest/gtest.h>
+
+#include <algorithm>
+#include <array>
+#include <future>
+#include <vector>
+
+#include "bta/hh/bta_hh_int.h"
+#include "bta/include/bta_ag_api.h"
+#include "bta/include/bta_hh_api.h"
+#include "btcore/include/module.h"
+#include "btif/include/btif_api.h"
+#include "btif/include/stack_manager.h"
+#include "include/hardware/bt_hh.h"
+#include "test/common/mock_functions.h"
+#include "test/mock/mock_osi_allocator.h"
+
+using namespace std::chrono_literals;
+
+void set_hal_cbacks(bt_callbacks_t* callbacks);
+
+uint8_t appl_trace_level = BT_TRACE_LEVEL_DEBUG;
+uint8_t btif_trace_level = BT_TRACE_LEVEL_DEBUG;
+uint8_t btu_trace_level = BT_TRACE_LEVEL_DEBUG;
+
+module_t bt_utils_module;
+module_t gd_controller_module;
+module_t gd_idle_module;
+module_t gd_shim_module;
+module_t osi_module;
+
+const tBTA_AG_RES_DATA tBTA_AG_RES_DATA::kEmpty = {};
+
+extern void bte_hh_evt(tBTA_HH_EVT event, tBTA_HH* p_data);
+extern const bthh_interface_t* btif_hh_get_interface();
+
+namespace test {
+namespace mock {
+extern bool bluetooth_shim_is_gd_stack_started_up;
+}
+}  // namespace test
+
+#if __GLIBC__
+size_t strlcpy(char* dst, const char* src, size_t siz) {
+  char* d = dst;
+  const char* s = src;
+  size_t n = siz;
+
+  /* Copy as many bytes as will fit */
+  if (n != 0) {
+    while (--n != 0) {
+      if ((*d++ = *s++) == '\0') break;
+    }
+  }
+
+  /* Not enough room in dst, add NUL and traverse rest of src */
+  if (n == 0) {
+    if (siz != 0) *d = '\0'; /* NUL-terminate dst */
+    while (*s++)
+      ;
+  }
+
+  return (s - src - 1); /* count does not include NUL */
+}
+
+pid_t gettid(void) throw() { return syscall(SYS_gettid); }
+#endif
+
+namespace {
+std::array<uint8_t, 32> data32 = {
+    0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b,
+    0x0c, 0x0d, 0x0e, 0x0f, 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16,
+    0x17, 0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f, 0x20,
+};
+
+const RawAddress kDeviceAddress({0x11, 0x22, 0x33, 0x44, 0x55, 0x66});
+const uint16_t kHhHandle = 123;
+
+// Callback parameters grouped into a structure
+struct get_report_cb_t {
+  RawAddress raw_address;
+  bthh_status_t status;
+  std::vector<uint8_t> data;
+} get_report_cb_;
+
+// Globals allow usage within function pointers
+std::promise<bt_cb_thread_evt> g_thread_evt_promise;
+std::promise<bt_status_t> g_status_promise;
+std::promise<get_report_cb_t> g_bthh_callbacks_get_report_promise;
+
+}  // namespace
+
+bt_callbacks_t bt_callbacks = {
+    .size = sizeof(bt_callbacks_t),
+    .adapter_state_changed_cb = nullptr,  // adapter_state_changed_callback
+    .adapter_properties_cb = nullptr,     // adapter_properties_callback
+    .remote_device_properties_cb =
+        nullptr,                            // remote_device_properties_callback
+    .device_found_cb = nullptr,             // device_found_callback
+    .discovery_state_changed_cb = nullptr,  // discovery_state_changed_callback
+    .pin_request_cb = nullptr,              // pin_request_callback
+    .ssp_request_cb = nullptr,              // ssp_request_callback
+    .bond_state_changed_cb = nullptr,       // bond_state_changed_callback
+    .address_consolidate_cb = nullptr,      // address_consolidate_callback
+    .le_address_associate_cb = nullptr,     // le_address_associate_callback
+    .acl_state_changed_cb = nullptr,        // acl_state_changed_callback
+    .thread_evt_cb = nullptr,               // callback_thread_event
+    .dut_mode_recv_cb = nullptr,            // dut_mode_recv_callback
+    .le_test_mode_cb = nullptr,             // le_test_mode_callback
+    .energy_info_cb = nullptr,              // energy_info_callback
+    .link_quality_report_cb = nullptr,      // link_quality_report_callback
+    .generate_local_oob_data_cb = nullptr,  // generate_local_oob_data_callback
+    .switch_buffer_size_cb = nullptr,       // switch_buffer_size_callback
+    .switch_codec_cb = nullptr,             // switch_codec_callback
+};
+
+bthh_callbacks_t bthh_callbacks = {
+    .size = sizeof(bthh_callbacks_t),
+    .connection_state_cb = nullptr,  // bthh_connection_state_callback
+    .hid_info_cb = nullptr,          // bthh_hid_info_callback
+    .protocol_mode_cb = nullptr,     // bthh_protocol_mode_callback
+    .idle_time_cb = nullptr,         // bthh_idle_time_callback
+    .get_report_cb = nullptr,        // bthh_get_report_callback
+    .virtual_unplug_cb = nullptr,    // bthh_virtual_unplug_callback
+    .handshake_cb = nullptr,         // bthh_handshake_callback
+};
+
+class BtifHhWithMockTest : public ::testing::Test {
+ protected:
+  void SetUp() override {
+    reset_mock_function_count_map();
+    test::mock::osi_allocator::osi_malloc.body = [](size_t size) {
+      return malloc(size);
+    };
+    test::mock::osi_allocator::osi_calloc.body = [](size_t size) {
+      return calloc(1UL, size);
+    };
+    test::mock::osi_allocator::osi_free.body = [](void* ptr) { free(ptr); };
+    test::mock::osi_allocator::osi_free_and_reset.body = [](void** ptr) {
+      free(*ptr);
+      *ptr = nullptr;
+    };
+  }
+
+  void TearDown() override {
+    test::mock::osi_allocator::osi_malloc = {};
+    test::mock::osi_allocator::osi_calloc = {};
+    test::mock::osi_allocator::osi_free = {};
+    test::mock::osi_allocator::osi_free_and_reset = {};
+  }
+};
+
+class BtifHhWithHalCallbacksTest : public BtifHhWithMockTest {
+ protected:
+  void SetUp() override {
+    bluetooth::common::InitFlags::SetAllForTesting();
+    BtifHhWithMockTest::SetUp();
+    g_thread_evt_promise = std::promise<bt_cb_thread_evt>();
+    auto future = g_thread_evt_promise.get_future();
+    bt_callbacks.thread_evt_cb = [](bt_cb_thread_evt evt) {
+      g_thread_evt_promise.set_value(evt);
+    };
+    set_hal_cbacks(&bt_callbacks);
+    // Start the jni callback thread
+    ASSERT_EQ(BT_STATUS_SUCCESS, btif_init_bluetooth());
+    ASSERT_EQ(std::future_status::ready, future.wait_for(2s));
+    ASSERT_EQ(ASSOCIATE_JVM, future.get());
+
+    bt_callbacks.thread_evt_cb = [](bt_cb_thread_evt evt) {};
+  }
+
+  void TearDown() override {
+    g_thread_evt_promise = std::promise<bt_cb_thread_evt>();
+    auto future = g_thread_evt_promise.get_future();
+    bt_callbacks.thread_evt_cb = [](bt_cb_thread_evt evt) {
+      g_thread_evt_promise.set_value(evt);
+    };
+    // Shutdown the jni callback thread
+    ASSERT_EQ(BT_STATUS_SUCCESS, btif_cleanup_bluetooth());
+    ASSERT_EQ(std::future_status::ready, future.wait_for(2s));
+    ASSERT_EQ(DISASSOCIATE_JVM, future.get());
+
+    bt_callbacks.thread_evt_cb = [](bt_cb_thread_evt evt) {};
+    BtifHhWithMockTest::TearDown();
+  }
+};
+
+class BtifHhAdapterReady : public BtifHhWithHalCallbacksTest {
+ protected:
+  void SetUp() override {
+    BtifHhWithHalCallbacksTest::SetUp();
+    test::mock::bluetooth_shim_is_gd_stack_started_up = true;
+    ASSERT_EQ(BT_STATUS_SUCCESS,
+              btif_hh_get_interface()->init(&bthh_callbacks));
+  }
+
+  void TearDown() override {
+    test::mock::bluetooth_shim_is_gd_stack_started_up = false;
+    BtifHhWithHalCallbacksTest::TearDown();
+  }
+};
+
+class BtifHhWithDevice : public BtifHhAdapterReady {
+ protected:
+  void SetUp() override {
+    BtifHhAdapterReady::SetUp();
+
+    // Short circuit a connected device
+    btif_hh_cb.devices[0].bd_addr = kDeviceAddress;
+    btif_hh_cb.devices[0].dev_status = BTHH_CONN_STATE_CONNECTED;
+    btif_hh_cb.devices[0].dev_handle = kHhHandle;
+  }
+
+  void TearDown() override { BtifHhAdapterReady::TearDown(); }
+};
+
+TEST_F(BtifHhAdapterReady, lifecycle) {}
+
+TEST_F(BtifHhWithDevice, BTA_HH_GET_RPT_EVT) {
+  tBTA_HH data = {
+      .hs_data =
+          {
+              .status = BTA_HH_OK,
+              .handle = kHhHandle,
+              .rsp_data =
+                  {
+                      .p_rpt_data = static_cast<BT_HDR*>(
+                          osi_calloc(data32.size() + sizeof(BT_HDR))),
+                  },
+          },
+  };
+
+  // Fill out the deep copy data
+  data.hs_data.rsp_data.p_rpt_data->len = static_cast<uint16_t>(data32.size());
+  std::copy(data32.begin(), data32.begin() + data32.size(),
+            reinterpret_cast<uint8_t*>((data.hs_data.rsp_data.p_rpt_data + 1)));
+
+  g_bthh_callbacks_get_report_promise = std::promise<get_report_cb_t>();
+  auto future = g_bthh_callbacks_get_report_promise.get_future();
+  bthh_callbacks.get_report_cb = [](RawAddress* bd_addr,
+                                    bthh_status_t hh_status, uint8_t* rpt_data,
+                                    int rpt_size) {
+    get_report_cb_t report = {
+        .raw_address = *bd_addr,
+        .status = hh_status,
+        .data = std::vector<uint8_t>(),
+    };
+    report.data.assign(rpt_data, rpt_data + rpt_size),
+        g_bthh_callbacks_get_report_promise.set_value(report);
+  };
+
+  bte_hh_evt(BTA_HH_GET_RPT_EVT, &data);
+  osi_free(data.hs_data.rsp_data.p_rpt_data);
+
+  ASSERT_EQ(std::future_status::ready, future.wait_for(2s));
+  auto report = future.get();
+
+  // Verify data was delivered
+  ASSERT_STREQ(kDeviceAddress.ToString().c_str(),
+               report.raw_address.ToString().c_str());
+  ASSERT_EQ(BTHH_OK, report.status);
+  int i = 0;
+  for (const auto& data : data32) {
+    ASSERT_EQ(data, report.data[i++]);
+  }
+}
diff --git a/system/btif/test/btif_rc_test.cc b/system/btif/test/btif_rc_test.cc
index 155b52e..a1ef7cc 100644
--- a/system/btif/test/btif_rc_test.cc
+++ b/system/btif/test/btif_rc_test.cc
@@ -41,6 +41,7 @@
 uint8_t appl_trace_level = BT_TRACE_LEVEL_WARNING;
 uint8_t btif_trace_level = BT_TRACE_LEVEL_WARNING;
 
+bool avrcp_absolute_volume_is_enabled() { return true; }
 tAVRC_STS AVRC_BldCommand(tAVRC_COMMAND* p_cmd, BT_HDR** pp_pkt) { return 0; }
 tAVRC_STS AVRC_BldResponse(uint8_t handle, tAVRC_RESPONSE* p_rsp,
                            BT_HDR** pp_pkt) {
diff --git a/system/build/Android.bp b/system/build/Android.bp
index 9a0c996..a21bb47 100644
--- a/system/build/Android.bp
+++ b/system/build/Android.bp
@@ -23,8 +23,20 @@
     pluginFor: ["soong_build"],
 }
 
+cc_defaults {
+    name: "fluoride_common_options",
+    cflags: [
+        "-Wall",
+        "-Wextra",
+        "-Werror",
+        // there are too many unused parameters in all the code.
+        "-Wno-unused-parameter",
+    ],
+}
+
 fluoride_defaults {
     name: "libchrome_support_defaults",
+    defaults: ["fluoride_common_options"],
     static_libs: [
         "libchrome",
         "libmodpb64",
@@ -33,11 +45,6 @@
     shared_libs: [
       "libbase",
     ],
-    cflags: [
-        "-Wall",
-        "-Wextra",
-        "-Werror",
-    ],
     target: {
         darwin: {
             enabled: false,
@@ -54,12 +61,8 @@
 // default to be used only on platform libs that can rely on shared libchrome
 fluoride_defaults {
     name: "libchrome_shared_support_defaults",
+    defaults: ["fluoride_common_options"],
     shared_libs: ["libchrome"],
-    cflags: [
-        "-Wall",
-        "-Wextra",
-        "-Werror",
-    ],
     target: {
         darwin: {
             enabled: false,
@@ -72,13 +75,12 @@
 // requires no shared libraries, and no explicit sanitization.
 fluoride_defaults {
     name: "fluoride_types_defaults_fuzzable",
+    defaults: ["fluoride_common_options"],
     cflags: [
         "-DEXPORT_SYMBOL=__attribute__((visibility(\"default\")))",
         "-fvisibility=hidden",
         // struct BT_HDR is defined as a variable-size header in a struct.
         "-Wno-gnu-variable-sized-type-not-at-end",
-        // there are too many unused parameters in all the code.
-        "-Wno-unused-parameter",
         "-DLOG_NDEBUG=1",
     ],
     conlyflags: [
@@ -207,6 +209,7 @@
         "libFraunhoferAAC",
         "libg722codec",
         "liblc3",
+        "libopus",
         "libprotobuf-cpp-lite",
         "libstatslog_bt",
         "libudrv-uipc",
diff --git a/system/common/metrics.cc b/system/common/metrics.cc
index 0664186..72454e3 100644
--- a/system/common/metrics.cc
+++ b/system/common/metrics.cc
@@ -20,6 +20,7 @@
 
 #include <base/base64.h>
 #include <base/logging.h>
+#include <frameworks/proto_logging/stats/enums/bluetooth/le/enums.pb.h>
 #include <include/hardware/bt_av.h>
 #include <statslog_bt.h>
 #include <unistd.h>
@@ -35,6 +36,9 @@
 
 #include "address_obfuscator.h"
 #include "bluetooth/metrics/bluetooth.pb.h"
+#include "gd/metrics/metrics_state.h"
+#include "gd/hci/address.h"
+#include "gd/os/metrics.h"
 #include "leaky_bonded_queue.h"
 #include "metric_id_allocator.h"
 #include "osi/include/osi.h"
@@ -68,6 +72,7 @@
 using bluetooth::metrics::BluetoothMetricsProto::ScanEvent_ScanTechnologyType;
 using bluetooth::metrics::BluetoothMetricsProto::WakeEvent;
 using bluetooth::metrics::BluetoothMetricsProto::WakeEvent_WakeEventType;
+using bluetooth::hci::Address;
 
 static float combine_averages(float avg_a, int64_t ct_a, float avg_b,
                               int64_t ct_b) {
@@ -962,6 +967,19 @@
   }
 }
 
+void LogLeBluetoothConnectionMetricEventReported(
+    const Address& address,
+    android::bluetooth::le::LeConnectionOriginType origin_type,
+    android::bluetooth::le::LeConnectionType connection_type,
+    android::bluetooth::le::LeConnectionState transaction_state,
+    std::vector<std::pair<os::ArgumentType, int>>
+        argument_list) {
+  // Log the events for the State Management
+  metrics::MetricsCollector::GetLEConnectionMetricsCollector()
+      ->AddStateChangedEvent(address, origin_type, connection_type,
+                             transaction_state, argument_list);
+}
+
 }  // namespace common
 
 }  // namespace bluetooth
diff --git a/system/common/metrics.h b/system/common/metrics.h
index 9d33e1b..335625c 100644
--- a/system/common/metrics.h
+++ b/system/common/metrics.h
@@ -21,13 +21,16 @@
 #include <bta/include/bta_api.h>
 #include <frameworks/proto_logging/stats/enums/bluetooth/enums.pb.h>
 #include <frameworks/proto_logging/stats/enums/bluetooth/hci/enums.pb.h>
+#include <frameworks/proto_logging/stats/enums/bluetooth/le/enums.pb.h>
 #include <stdint.h>
 
 #include <memory>
 #include <string>
 #include <vector>
 
+#include "gd/os/metrics.h"
 #include "types/raw_address.h"
+#include "hci/address.h"
 
 namespace bluetooth {
 
@@ -518,6 +521,14 @@
     std::vector<int64_t>& streaming_duration_nanos,
     std::vector<int32_t>& streaming_context_type);
 
+void LogLeBluetoothConnectionMetricEventReported(
+    const RawAddress& raw_address,
+    android::bluetooth::le::LeConnectionOriginType origin_type,
+    android::bluetooth::le::LeConnectionType connection_type,
+    android::bluetooth::le::LeConnectionState transaction_state,
+    std::vector<std::pair<os::ArgumentType, int>>
+        argument_list);
+
 }  // namespace common
 
 }  // namespace bluetooth
diff --git a/system/conf/bt_stack.conf b/system/conf/bt_stack.conf
index 942dfdc..f82351b 100644
--- a/system/conf/bt_stack.conf
+++ b/system/conf/bt_stack.conf
@@ -47,13 +47,39 @@
 # Use EATT for the notifications
 #PTS_ForceEattForNotifications=true
 
+# PTS L2CAP Ecoc upper tester (hijack eatt)
+#PTS_L2capEcocUpperTester=true
+
+# PTS L2CAP initial number of channels
+#note: PTS_EnableL2capUpperTester shall be true
+#PTS_L2capEcocInitialChanCnt=3
+
+# PTS Min key size for L2CAP ECOC upper tester
+# note: PTS_EnableL2capUpperTester shall be true
+#PTS_L2capEcocMinKeySize=16
+
+# PTS Send connect request after connect confirmation
+# note: PTS_L2capEcocInitialChanCnt shall be less than 5
+#PTS_L2capEcocConnectRemaining=true
+
+#PTS L2CAP CoC schedule sending data after connection
+# note: PTS_EnableL2capUpperTester shall be true
+#PTS_L2capEcocSendNumOfSdu=2
+
 # Start EATT without validation Server Supported Features
+# note: PTS_EnableL2capUpperTester shall be true
 #PTS_ConnectEattUncondictionally=true
 
+# Trigger reconfiguration after connection
+# note: PTS_EnableL2capUpperTester shall be true
+#PTS_L2capEcocReconfigure=true
+
 # Start EATT on unecrypted link
+# note: PTS_EnableL2capUpperTester shall be true
 #PTS_ConnectEattUnencrypted=true
 
 # Force EATT implementation to connect EATT as a peripheral for collision test case
+# note: PTS_EnableL2capUpperTester shall be true
 #PTS_EattPeripheralCollionSupport=true
 
 # Disable BR/EDR discovery after LE pairing to avoid cross key derivation errors
@@ -68,6 +94,15 @@
 # Start broadcast with unecryption mode
 #PTS_BroadcastUnencrypted=true
 
+# Use EATT for all services
+#PTS_UseEattForAllServices=true
+
+# Suspend stream after some timeout in LE Audio client module
+#PTS_LeAudioSuspendStreaming=true
+
+# Force to update metadata with multiple CCIDs
+#PTS_ForceLeAudioMultipleContextsMetadata=true
+
 # SMP Certification Failure Cases
 # Set any of the following SMP error values (from smp_api_types.h)
 # to induce pairing failues for various PTS SMP test cases.
@@ -84,3 +119,11 @@
 #  SMP_NUMERIC_COMPAR_FAIL = 12
 #PTS_SmpFailureCase=0
 
+
+# PTS Broadcast audio configuration option
+# Option:
+# lc3_stereo_48_1_2
+# lc3_stereo_48_2_2
+# lc3_stereo_48_3_2
+# lc3_stereo_48_4_2
+#PTS_BroadcastAudioConfigOption=lc3_stereo_48_1_2
diff --git a/system/device/fuzzer/README.md b/system/device/fuzzer/README.md
index 40bb0ba..ad2e971 100644
--- a/system/device/fuzzer/README.md
+++ b/system/device/fuzzer/README.md
@@ -14,7 +14,7 @@
 
 | Parameter| Valid Values| Configured Value|
 |------------- |-------------| ----- |
-| `interopFeature` | 0.`INTEROP_DISABLE_LE_SECURE_CONNECTIONS` 1.`INTEROP_AUTO_RETRY_PAIRING` 2.`INTEROP_DISABLE_ABSOLUTE_VOLUME` 3.`INTEROP_DISABLE_AUTO_PAIRING` 4.`INTEROP_KEYBOARD_REQUIRES_FIXED_PIN` 5.`INTEROP_2MBPS_LINK_ONLY` 6.`INTEROP_HID_PREF_CONN_SUP_TIMEOUT_3S` 7.`INTEROP_GATTC_NO_SERVICE_CHANGED_IND` 8.`INTEROP_DISABLE_AVDTP_RECONFIGURE` 9.`INTEROP_DYNAMIC_ROLE_SWITCH` 10.`INTEROP_DISABLE_ROLE_SWITCH` 11.`INTEROP_HID_HOST_LIMIT_SNIFF_INTERVAL` 12.`INTEROP_DISABLE_NAME_REQUEST` 13.`INTEROP_AVRCP_1_4_ONLY` 14.`INTEROP_DISABLE_SNIFF` 15.`INTEROP_DISABLE_AVDTP_SUSPEND`| Value obtained from FuzzedDataProvider |
+| `interopFeature` | 0.`INTEROP_DISABLE_LE_SECURE_CONNECTIONS` 1.`INTEROP_AUTO_RETRY_PAIRING` 2.`INTEROP_DISABLE_ABSOLUTE_VOLUME` 3.`INTEROP_DISABLE_AUTO_PAIRING` 4.`INTEROP_KEYBOARD_REQUIRES_FIXED_PIN` 5.`INTEROP_2MBPS_LINK_ONLY` 6.`INTEROP_HID_PREF_CONN_SUP_TIMEOUT_3S` 7.`INTEROP_GATTC_NO_SERVICE_CHANGED_IND` 8.`INTEROP_DISABLE_AVDTP_RECONFIGURE` 9.`INTEROP_DYNAMIC_ROLE_SWITCH` 10.`INTEROP_DISABLE_ROLE_SWITCH` 11.`INTEROP_HID_HOST_LIMIT_SNIFF_INTERVAL` 12.`INTEROP_DISABLE_NAME_REQUEST` 13.`INTEROP_AVRCP_1_4_ONLY` 14.`INTEROP_DISABLE_SNIFF` 15.`INTEROP_DISABLE_AVDTP_SUSPEND` 16.`INTEROP_SLC_SKIP_BIND_COMMAND` 17.`INTEROP_AVRCP_1_3_ONLY`| Value obtained from FuzzedDataProvider |
 | `escoCodec` | 0.`SCO_CODEC_CVSD_D1` 1.`ESCO_CODEC_CVSD_S3` 2.`ESCO_CODEC_CVSD_S4` 3.`ESCO_CODEC_MSBC_T1` 4.`ESCO_CODEC_MSBC_T2`| Value obtained from FuzzedDataProvider |
 This also ensures that the plugins are always deterministic for any given input.
 
diff --git a/system/device/fuzzer/btdevice_esco_fuzzer.cpp b/system/device/fuzzer/btdevice_esco_fuzzer.cpp
index 73116bf..7c356af 100644
--- a/system/device/fuzzer/btdevice_esco_fuzzer.cpp
+++ b/system/device/fuzzer/btdevice_esco_fuzzer.cpp
@@ -41,6 +41,8 @@
     interop_feature_t::INTEROP_AVRCP_1_4_ONLY,
     interop_feature_t::INTEROP_DISABLE_SNIFF,
     interop_feature_t::INTEROP_DISABLE_AVDTP_SUSPEND,
+    interop_feature_t::INTEROP_SLC_SKIP_BIND_COMMAND,
+    interop_feature_t::INTEROP_AVRCP_1_3_ONLY,
 };
 constexpr esco_codec_t kEscoCodec[] = {
     esco_codec_t::SCO_CODEC_CVSD_D1,  esco_codec_t::ESCO_CODEC_CVSD_S3,
diff --git a/system/device/include/interop.h b/system/device/include/interop.h
index 2e9a266..7b8eb1a 100644
--- a/system/device/include/interop.h
+++ b/system/device/include/interop.h
@@ -115,7 +115,17 @@
 
   // Some car kits do not send the AT+BIND command while establishing the SLC
   // which causes an HFP profile connection failure
-  INTEROP_SLC_SKIP_BIND_COMMAND
+  INTEROP_SLC_SKIP_BIND_COMMAND,
+
+  // Respond AVRCP profile version only 1.3 for some device.
+  INTEROP_AVRCP_1_3_ONLY,
+
+  // Some remote devices have LMP version in[5.0, 5.2] but do not support
+  // robust
+  // caching or correctly response with an error. We disable the
+  // database hash
+  // lookup for such devices.
+  INTEROP_DISABLE_ROBUST_CACHING,
 } interop_feature_t;
 
 // Check if a given |addr| matches a known interoperability workaround as
diff --git a/system/device/include/interop_database.h b/system/device/include/interop_database.h
index 03c584f..b6c509d 100644
--- a/system/device/include/interop_database.h
+++ b/system/device/include/interop_database.h
@@ -119,6 +119,8 @@
 
     // Kenwood KMM-BT518HD - no audio when A2DP codec sample rate is changed
     {{{0x00, 0x1d, 0x86, 0, 0, 0}}, 3, INTEROP_DISABLE_AVDTP_RECONFIGURE},
+    // http://b/255387998
+    {{{0x00, 0x1d, 0x86, 0, 0, 0}}, 3, INTEROP_DISABLE_ROLE_SWITCH},
 
     // NAC FORD-2013 - Lincoln
     {{{0x00, 0x26, 0xb4, 0, 0, 0}}, 3, INTEROP_DISABLE_ROLE_SWITCH},
@@ -126,6 +128,9 @@
     // Toyota Prius - 2015
     {{{0xfc, 0xc2, 0xde, 0, 0, 0}}, 3, INTEROP_DISABLE_ROLE_SWITCH},
 
+    // Toyota Prius - b/231092023
+    {{{0x9c, 0xdf, 0x03, 0, 0, 0}}, 3, INTEROP_DISABLE_ROLE_SWITCH},
+
     // OBU II Bluetooth dongle
     {{{0x00, 0x04, 0x3e, 0, 0, 0}}, 3, INTEROP_DISABLE_ROLE_SWITCH},
 
@@ -150,9 +155,6 @@
     // AirPods 2 - unacceptably loud volume
     {{{0x9c, 0x64, 0x8b, 0, 0, 0}}, 3, INTEROP_DISABLE_ABSOLUTE_VOLUME},
 
-    // Phonak AG - volume level not change
-    {{{0x00, 0x0f, 0x59, 0, 0, 0}}, 3, INTEROP_DISABLE_ABSOLUTE_VOLUME},
-
     // for skip name request,
     // because BR/EDR address and ADV random address are the same
     {{{0xd4, 0x7a, 0xe2, 0, 0, 0}}, 3, INTEROP_DISABLE_NAME_REQUEST},
@@ -179,14 +181,63 @@
     // Honda Civic Carkit
     {{{0x0c, 0xd9, 0xc1, 0, 0, 0}}, 3, INTEROP_AVRCP_1_4_ONLY},
 
-    // BMW Carkit
-    {{{0x9c, 0xdf, 0x03, 0, 0, 0}}, 3, INTEROP_AVRCP_1_4_ONLY},
-
     // KDDI Carkit
     {{{0x44, 0xea, 0xd8, 0, 0, 0}}, 3, INTEROP_DISABLE_SNIFF},
 
     // Toyota Camry 2018 Carkit HFP AT+BIND missing
     {{{0x94, 0xb2, 0xcc, 0x30, 0, 0}}, 4, INTEROP_SLC_SKIP_BIND_COMMAND},
+
+    // BMW Carkit
+    {{{0x00, 0x0a, 0x08, 0, 0, 0}}, 3, INTEROP_AVRCP_1_3_ONLY},
+
+    // Harman/Becker Automotive Systems GmbH (BMW Carkit) - b/234548635
+    {{{0x9c, 0xdf, 0x03, 0, 0, 0}}, 3, INTEROP_AVRCP_1_3_ONLY},
+
+    // Eero Wi-Fi Router
+    {{{0x08, 0x9b, 0xf1, 0, 0, 0}}, 3, INTEROP_DISABLE_ROBUST_CACHING},
+    {{{0x20, 0xbe, 0xcd, 0, 0, 0}}, 3, INTEROP_DISABLE_ROBUST_CACHING},
+    {{{0x30, 0x34, 0x22, 0, 0, 0}}, 3, INTEROP_DISABLE_ROBUST_CACHING},
+    {{{0x3c, 0x5c, 0xf1, 0, 0, 0}}, 3, INTEROP_DISABLE_ROBUST_CACHING},
+    {{{0x40, 0x47, 0x5e, 0, 0, 0}}, 3, INTEROP_DISABLE_ROBUST_CACHING},
+    {{{0x50, 0x27, 0xa9, 0, 0, 0}}, 3, INTEROP_DISABLE_ROBUST_CACHING},
+    {{{0x64, 0x97, 0x14, 0, 0, 0}}, 3, INTEROP_DISABLE_ROBUST_CACHING},
+    {{{0x64, 0xc2, 0x69, 0, 0, 0}}, 3, INTEROP_DISABLE_ROBUST_CACHING},
+    {{{0x68, 0x4a, 0x76, 0, 0, 0}}, 3, INTEROP_DISABLE_ROBUST_CACHING},
+    {{{0x6c, 0xae, 0xf6, 0, 0, 0}}, 3, INTEROP_DISABLE_ROBUST_CACHING},
+    {{{0x78, 0x76, 0x89, 0, 0, 0}}, 3, INTEROP_DISABLE_ROBUST_CACHING},
+    {{{0x78, 0xd6, 0xd6, 0, 0, 0}}, 3, INTEROP_DISABLE_ROBUST_CACHING},
+    {{{0x84, 0x70, 0xd7, 0, 0, 0}}, 3, INTEROP_DISABLE_ROBUST_CACHING},
+    {{{0x98, 0xed, 0x7e, 0, 0, 0}}, 3, INTEROP_DISABLE_ROBUST_CACHING},
+    {{{0x9c, 0x0b, 0x05, 0, 0, 0}}, 3, INTEROP_DISABLE_ROBUST_CACHING},
+    {{{0x9c, 0x57, 0xbc, 0, 0, 0}}, 3, INTEROP_DISABLE_ROBUST_CACHING},
+    {{{0x9c, 0xa5, 0x70, 0, 0, 0}}, 3, INTEROP_DISABLE_ROBUST_CACHING},
+    {{{0xa0, 0x8e, 0x24, 0, 0, 0}}, 3, INTEROP_DISABLE_ROBUST_CACHING},
+    {{{0xac, 0xec, 0x85, 0, 0, 0}}, 3, INTEROP_DISABLE_ROBUST_CACHING},
+    {{{0xb4, 0x20, 0x46, 0, 0, 0}}, 3, INTEROP_DISABLE_ROBUST_CACHING},
+    {{{0xb4, 0xb9, 0xe6, 0, 0, 0}}, 3, INTEROP_DISABLE_ROBUST_CACHING},
+    {{{0xc0, 0x36, 0x53, 0, 0, 0}}, 3, INTEROP_DISABLE_ROBUST_CACHING},
+    {{{0xc4, 0xf1, 0x74, 0, 0, 0}}, 3, INTEROP_DISABLE_ROBUST_CACHING},
+    {{{0xc8, 0xb8, 0x2f, 0, 0, 0}}, 3, INTEROP_DISABLE_ROBUST_CACHING},
+    {{{0xc8, 0xe3, 0x06, 0, 0, 0}}, 3, INTEROP_DISABLE_ROBUST_CACHING},
+    {{{0xd4, 0x05, 0xde, 0, 0, 0}}, 3, INTEROP_DISABLE_ROBUST_CACHING},
+    {{{0xd4, 0x3f, 0x32, 0, 0, 0}}, 3, INTEROP_DISABLE_ROBUST_CACHING},
+    {{{0xec, 0x74, 0x27, 0, 0, 0}}, 3, INTEROP_DISABLE_ROBUST_CACHING},
+    {{{0xf0, 0x21, 0xe0, 0, 0, 0}}, 3, INTEROP_DISABLE_ROBUST_CACHING},
+    {{{0xf0, 0xb6, 0x61, 0, 0, 0}}, 3, INTEROP_DISABLE_ROBUST_CACHING},
+    {{{0xfc, 0x3f, 0xa6, 0, 0, 0}}, 3, INTEROP_DISABLE_ROBUST_CACHING},
+};
+
+typedef struct {
+  RawAddress addr_start;
+  RawAddress addr_end;
+  interop_feature_t feature;
+} interop_addr_range_entry_t;
+
+static const interop_addr_range_entry_t interop_addr_range_database[] = {
+    // Phonak AG - volume level not change
+    {{{0x00, 0x0f, 0x59, 0x50, 0x00, 0x00}},
+     {{0x00, 0x0f, 0x59, 0x6f, 0xff, 0xff}},
+     INTEROP_DISABLE_ABSOLUTE_VOLUME},
 };
 
 typedef struct {
diff --git a/system/device/src/interop.cc b/system/device/src/interop.cc
index 7dfcd3e..bc6b691 100644
--- a/system/device/src/interop.cc
+++ b/system/device/src/interop.cc
@@ -44,6 +44,8 @@
                                  const RawAddress* addr);
 static bool interop_match_dynamic_(const interop_feature_t feature,
                                    const RawAddress* addr);
+static bool interop_match_range_(const interop_feature_t feature,
+                                 const RawAddress* addr);
 
 // Interface functions
 
@@ -52,7 +54,8 @@
   CHECK(addr);
 
   if (interop_match_fixed_(feature, addr) ||
-      interop_match_dynamic_(feature, addr)) {
+      interop_match_dynamic_(feature, addr) ||
+      interop_match_range_(feature, addr)) {
     LOG_INFO("%s() Device %s is a match for interop workaround %s.", __func__,
              addr->ToString().c_str(), interop_feature_string_(feature));
     return true;
@@ -137,7 +140,9 @@
     CASE_RETURN_STR(INTEROP_AVRCP_1_4_ONLY)
     CASE_RETURN_STR(INTEROP_DISABLE_SNIFF)
     CASE_RETURN_STR(INTEROP_DISABLE_AVDTP_SUSPEND)
-    CASE_RETURN_STR(INTEROP_SLC_SKIP_BIND_COMMAND);
+    CASE_RETURN_STR(INTEROP_SLC_SKIP_BIND_COMMAND)
+    CASE_RETURN_STR(INTEROP_AVRCP_1_3_ONLY)
+    CASE_RETURN_STR(INTEROP_DISABLE_ROBUST_CACHING);
   }
 
   return "UNKNOWN";
@@ -189,3 +194,20 @@
 
   return false;
 }
+
+static bool interop_match_range_(const interop_feature_t feature,
+                                 const RawAddress* addr) {
+  CHECK(addr);
+
+  const size_t db_size =
+      sizeof(interop_addr_range_database) / sizeof(interop_addr_range_entry_t);
+  for (size_t i = 0; i != db_size; ++i) {
+    if (feature == interop_addr_range_database[i].feature &&
+        *addr >= interop_addr_range_database[i].addr_start &&
+        *addr <= interop_addr_range_database[i].addr_end) {
+      return true;
+    }
+  }
+
+  return false;
+}
diff --git a/system/device/test/interop_test.cc b/system/device/test/interop_test.cc
index 2e1598e..6c7803a 100644
--- a/system/device/test/interop_test.cc
+++ b/system/device/test/interop_test.cc
@@ -82,3 +82,26 @@
   EXPECT_FALSE(interop_match_name(INTEROP_DISABLE_AUTO_PAIRING, "audi"));
   EXPECT_FALSE(interop_match_name(INTEROP_AUTO_RETRY_PAIRING, "BMW M3"));
 }
+
+TEST(InteropTest, test_range_hit) {
+  RawAddress test_address;
+  RawAddress::FromString("00:0f:59:50:00:00", test_address);
+  ASSERT_TRUE(
+      interop_match_addr(INTEROP_DISABLE_ABSOLUTE_VOLUME, &test_address));
+  RawAddress::FromString("00:0f:59:59:12:34", test_address);
+  ASSERT_TRUE(
+      interop_match_addr(INTEROP_DISABLE_ABSOLUTE_VOLUME, &test_address));
+  RawAddress::FromString("00:0f:59:6f:ff:ff", test_address);
+  ASSERT_TRUE(
+      interop_match_addr(INTEROP_DISABLE_ABSOLUTE_VOLUME, &test_address));
+}
+
+TEST(InteropTest, test_range_miss) {
+  RawAddress test_address;
+  RawAddress::FromString("00:0f:59:49:12:34", test_address);
+  ASSERT_FALSE(
+      interop_match_addr(INTEROP_DISABLE_ABSOLUTE_VOLUME, &test_address));
+  RawAddress::FromString("00:0f:59:70:12:34", test_address);
+  ASSERT_FALSE(
+      interop_match_addr(INTEROP_DISABLE_ABSOLUTE_VOLUME, &test_address));
+}
diff --git a/system/embdrv/encoder_for_aptx/Android.bp b/system/embdrv/encoder_for_aptx/Android.bp
new file mode 100644
index 0000000..e619c09
--- /dev/null
+++ b/system/embdrv/encoder_for_aptx/Android.bp
@@ -0,0 +1,37 @@
+tidy_errors = [
+    "*",
+    "-altera-struct-pack-align",
+    "-altera-unroll-loops",
+    "-bugprone-narrowing-conversions",
+    "-cppcoreguidelines-avoid-magic-numbers",
+    "-cppcoreguidelines-init-variables",
+    "-cppcoreguidelines-narrowing-conversions",
+    "-hicpp-signed-bitwise",
+    "-llvm-header-guard",
+    "-readability-avoid-const-params-in-decls",
+    "-readability-identifier-length",
+    "-readability-magic-numbers",
+]
+
+cc_library_static {
+    name: "libaptx_enc",
+    host_supported: true,
+    export_include_dirs: ["include"],
+    srcs: [
+        "src/aptXbtenc.c",
+        "src/ProcessSubband.c",
+        "src/QmfConv.c",
+        "src/QuantiseDifference.c",
+    ],
+    cflags: ["-O2", "-Werror", "-Wall", "-Wextra"],
+    tidy: true,
+    tidy_checks: tidy_errors,
+    tidy_checks_as_errors: tidy_errors,
+    min_sdk_version: "Tiramisu",
+    apex_available: [
+        "com.android.btservices",
+    ],
+    visibility: [
+        "//packages/modules/Bluetooth:__subpackages__",
+    ],
+}
diff --git a/system/embdrv/encoder_for_aptx/include/aptXbtenc.h b/system/embdrv/encoder_for_aptx/include/aptXbtenc.h
new file mode 100644
index 0000000..bce6ee7
--- /dev/null
+++ b/system/embdrv/encoder_for_aptx/include/aptXbtenc.h
@@ -0,0 +1,71 @@
+/**
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/*------------------------------------------------------------------------------
+ *
+ *  This file exposes a public interface to allow clients to invoke aptX
+ *  encoding on 4 new PCM samples, generating 2 new codeword (one for the
+ *  left channel and one for the right channel).
+ *
+ *----------------------------------------------------------------------------*/
+
+#ifndef APTXBTENC_H
+#define APTXBTENC_H
+
+#include <stdint.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#ifdef _DLLEXPORT
+#define APTXBTENCEXPORT __declspec(dllexport)
+#else
+#define APTXBTENCEXPORT
+#endif
+
+/* SizeofAptxbtenc returns the size (in byte) of the memory
+ * allocation required to store the state of the encoder */
+APTXBTENCEXPORT int SizeofAptxbtenc(void);
+
+/* aptxbtenc_version can be used to extract the version number
+ * of the aptX encoder */
+APTXBTENCEXPORT const char* aptxbtenc_version(void);
+
+/* aptxbtenc_init is used to initialise the encoder structure.
+ * _state should be a pointer to the encoder structure (stereo).
+ * endian represent the endianness of the output data
+ * (0=little endian. Big endian otherwise)
+ * The function returns 1 if an error occurred during the initialisation.
+ * The function returns 0 if no error occurred during the initialisation. */
+APTXBTENCEXPORT int aptxbtenc_init(void* _state, short endian);
+
+/* aptxbtenc_setsync_mode is used to initialise the sync mode in the encoder
+ * state structure. _state should be a pointer to the encoder structure (stereo,
+ * though strictly-speaking it is dual channel). 'sync_mode' is an enumerated
+ * type  {stereo=0, dualmono=1, no_sync=2} The function returns 0 if no error
+ * occurred during the initialisation. */
+APTXBTENCEXPORT int aptxbtenc_setsync_mode(void* _state, int32_t sync_mode);
+
+/* StereoEncode will take 8 audio samples (16-bit per sample)
+ * and generate one 32-bit codeword with autosync inserted. */
+APTXBTENCEXPORT int aptxbtenc_encodestereo(void* _state, void* _pcmL,
+                                           void* _pcmR, void* _buffer);
+
+#ifdef __cplusplus
+}  //  /extern "C"
+#endif
+
+#endif  // APTXBTENC_H
diff --git a/system/embdrv/encoder_for_aptx/src/AptxEncoder.h b/system/embdrv/encoder_for_aptx/src/AptxEncoder.h
new file mode 100644
index 0000000..229029b
--- /dev/null
+++ b/system/embdrv/encoder_for_aptx/src/AptxEncoder.h
@@ -0,0 +1,101 @@
+/**
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/*------------------------------------------------------------------------------
+ *
+ *  All declarations relevant for aptxEncode. This function allows clients
+ *  to invoke bt-aptX encoding on 4 new PCM samples,
+ *  generating 4 new quantised codes. A separate function allows the
+ *  packing of the 4 codes into a 16-bit word.
+ *
+ *----------------------------------------------------------------------------*/
+
+#ifndef APTXENCODER_H
+#define APTXENCODER_H
+#ifdef _GCC
+#pragma GCC visibility push(hidden)
+#endif
+
+#include "AptxParameters.h"
+#include "DitherGenerator.h"
+#include "Qmf.h"
+#include "Quantiser.h"
+#include "SubbandFunctionsCommon.h"
+
+/* Function to carry out a single-channel aptX encode on 4 new PCM samples */
+XBT_INLINE_ void aptxEncode(const int32_t pcm[4], Qmf_storage* Qmf_St,
+                            Encoder_data* EncoderDataPt) {
+  int32_t predVals[4];
+  int32_t qCodes[4];
+  int32_t aqmfOutputs[4];
+
+  /* Extract the previous predicted values and quantised codes into arrays */
+  for (int i = 0; i < 4; i++) {
+    predVals[i] = EncoderDataPt->m_SubbandData[i].m_predData.m_predVal;
+    qCodes[i] = EncoderDataPt->m_qdata[i].qCode;
+  }
+
+  /* Update codeword history, then generate new dither values. */
+  EncoderDataPt->m_codewordHistory =
+      xbtEncupdateCodewordHistory(qCodes, EncoderDataPt->m_codewordHistory);
+  EncoderDataPt->m_dithSyncRandBit = xbtEncgenerateDither(
+      EncoderDataPt->m_codewordHistory, EncoderDataPt->m_ditherOutputs);
+
+  /* Run the analysis QMF */
+  QmfAnalysisFilter(pcm, Qmf_St, predVals, aqmfOutputs);
+
+  /* Run the quantiser for each subband */
+  quantiseDifferenceLL(aqmfOutputs[0], EncoderDataPt->m_ditherOutputs[0],
+                       EncoderDataPt->m_SubbandData[0].m_iqdata.delta,
+                       &EncoderDataPt->m_qdata[0]);
+  quantiseDifferenceLH(aqmfOutputs[1], EncoderDataPt->m_ditherOutputs[1],
+                       EncoderDataPt->m_SubbandData[1].m_iqdata.delta,
+                       &EncoderDataPt->m_qdata[1]);
+  quantiseDifferenceHL(aqmfOutputs[2], EncoderDataPt->m_ditherOutputs[2],
+                       EncoderDataPt->m_SubbandData[2].m_iqdata.delta,
+                       &EncoderDataPt->m_qdata[2]);
+  quantiseDifferenceHH(aqmfOutputs[3], EncoderDataPt->m_ditherOutputs[3],
+                       EncoderDataPt->m_SubbandData[3].m_iqdata.delta,
+                       &EncoderDataPt->m_qdata[3]);
+}
+
+XBT_INLINE_ void aptxPostEncode(Encoder_data* EncoderDataPt) {
+  /* Run the remaining subband processing for each subband */
+  /* Manual inlining on the 4 subband */
+  processSubbandLL(EncoderDataPt->m_qdata[0].qCode,
+                   EncoderDataPt->m_ditherOutputs[0],
+                   &EncoderDataPt->m_SubbandData[0],
+                   &EncoderDataPt->m_SubbandData[0].m_iqdata);
+
+  processSubband(EncoderDataPt->m_qdata[1].qCode,
+                 EncoderDataPt->m_ditherOutputs[1],
+                 &EncoderDataPt->m_SubbandData[1],
+                 &EncoderDataPt->m_SubbandData[1].m_iqdata);
+
+  processSubbandHL(EncoderDataPt->m_qdata[2].qCode,
+                   EncoderDataPt->m_ditherOutputs[2],
+                   &EncoderDataPt->m_SubbandData[2],
+                   &EncoderDataPt->m_SubbandData[2].m_iqdata);
+
+  processSubband(EncoderDataPt->m_qdata[3].qCode,
+                 EncoderDataPt->m_ditherOutputs[3],
+                 &EncoderDataPt->m_SubbandData[3],
+                 &EncoderDataPt->m_SubbandData[3].m_iqdata);
+}
+
+#ifdef _GCC
+#pragma GCC visibility pop
+#endif
+#endif  // APTXENCODER_H
diff --git a/system/embdrv/encoder_for_aptx/src/AptxParameters.h b/system/embdrv/encoder_for_aptx/src/AptxParameters.h
new file mode 100644
index 0000000..b4f9093
--- /dev/null
+++ b/system/embdrv/encoder_for_aptx/src/AptxParameters.h
@@ -0,0 +1,255 @@
+/**
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/*------------------------------------------------------------------------------
+ *
+ *  General shared aptX parameters.
+ *
+ *----------------------------------------------------------------------------*/
+
+#ifndef APTXPARAMETERS_H
+#define APTXPARAMETERS_H
+#ifdef _GCC
+#pragma GCC visibility push(hidden)
+#endif
+
+#include <stdint.h>
+
+#include "CBStruct.h"
+
+#if defined _MSC_VER
+#define XBT_INLINE_ inline
+#define _STDQMFOUTERCOEFF 1
+#elif defined __clang__
+#define XBT_INLINE_ static inline
+#define _STDQMFOUTERCOEFF 1
+#elif defined __GNUC__
+#define XBT_INLINE_ inline
+#define _STDQMFOUTERCOEFF 1
+#else
+#define XBT_INLINE_ static
+#define _STDQMFOUTERCOEFF 1
+#endif
+
+/* Signed saturate to a 24bit value */
+XBT_INLINE_ int32_t ssat24(int32_t val) {
+  if (val > 8388607) {
+    val = 8388607;
+  }
+  if (val < -8388608) {
+    val = -8388608;
+  }
+  return val;
+}
+
+typedef union u_reg64 {
+  uint64_t u64;
+  int64_t s64;
+  struct s_u32 {
+#ifdef __BIGENDIAN
+    uint32_t h;
+    uint32_t l;
+#else
+    uint32_t l;
+    uint32_t h;
+#endif
+  } u32;
+
+  struct s_s32 {
+#ifdef __BIGENDIAN
+    int32_t h;
+    int32_t l;
+#else
+    int32_t l;
+    int32_t h;
+#endif
+  } s32;
+} reg64_t;
+
+typedef union u_reg32 {
+  uint32_t u32;
+  int32_t s32;
+
+  struct s_u16 {
+#ifdef __BIGENDIAN
+    uint16_t h;
+    uint16_t l;
+#else
+    uint16_t l;
+    uint16_t h;
+#endif
+  } u16;
+  struct s_s16 {
+#ifdef __BIGENDIAN
+    int16_t h;
+    int16_t l;
+#else
+    int16_t l;
+    int16_t h;
+#endif
+  } s16;
+} reg32_t;
+
+/* Each aptX enc/dec round consumes/produces 4 PCM samples */
+static const uint32_t numPcmSamples = 4;
+
+/* Symbolic constants for PCM data indices. */
+enum { FirstPcm = 0, SecondPcm = 1, ThirdPcm = 2, FourthPcm = 3 };
+
+/* Symbolic constants for sync modes. */
+enum { stereo = 0, dualmono = 1, no_sync = 2 };
+
+/* Number of subbands is fixed at 4 */
+#define NUMSUBBANDS 4
+
+/* Symbolic constants for subband identification. */
+typedef enum { LL = 0, LH = 1, HL = 2, HH = 3 } bands;
+
+/* Structure declaration to bind a set of subband parameters */
+typedef struct {
+  const int32_t* threshTable;
+  const int32_t* threshTable_sl1;
+  const int32_t* dithTable;
+  const int32_t* dithTable_sh1;
+  const int32_t* minusLambdaDTable;
+  const int32_t* incrTable;
+  int32_t numBits;
+  int32_t maxLogDelta;
+  int32_t minLogDelta;
+  int32_t numZeros;
+} SubbandParameters;
+
+/* Struct required for the polecoeffcalculator function of bt-aptX encoder and
+ * decoder*/
+/* Size of structure: 16 Bytes */
+typedef struct {
+  /* 2-tap delay line for previous sgn values */
+  reg32_t m_poleAdaptDelayLine;
+  /* 2 pole filter coeffs */
+  int32_t m_poleCoeff[2];
+} PoleCoeff_data;
+
+/* Struct required for the zerocoeffcalculator function of bt-aptX encoder and
+ * decoder*/
+/* Size of structure: 100 Bytes */
+typedef struct {
+  /* The zero filter length for this subband */
+  int32_t m_numZeros;
+  /* Maximum number of zeros for any subband is 24. */
+  /* 24 zero filter coeffs */
+  int32_t m_zeroCoeff[24];
+} ZeroCoeff_data;
+
+/* Struct required for the prediction filtering function of bt-aptX encoder and
+ * decoder*/
+/* Size of structure: 200+20=220 Bytes */
+typedef struct {
+  /* Number of zeros associated with this subband */
+  int32_t m_numZeros;
+  /* Zero data delay line (circular) */
+  circularBuffer m_zeroDelayLine;
+  /* 2-tap pole data delay line */
+  int32_t m_poleDelayLine[2];
+  /* Output from zero filter */
+  int32_t m_zeroVal;
+  /* Output from overall ARMA filter */
+  int32_t m_predVal;
+} Predictor_data;
+
+/* Struct required for the Quantisation function of bt-aptX encoder and
+ * decoder*/
+/* Size of structure: 24 Bytes */
+typedef struct {
+  /* Number of bits in the quantised code for this subband */
+  int32_t codeBits;
+  /* Pointer to threshold table */
+  const int32_t* thresholdTablePtr;
+  const int32_t* thresholdTablePtr_sl1;
+  /* Pointer to dither table */
+  const int32_t* ditherTablePtr;
+  /* Pointer to minus Lambda table */
+  const int32_t* minusLambdaDTable;
+  /* Output quantised code */
+  int32_t qCode;
+  /* Alternative quantised code for sync purposes */
+  int32_t altQcode;
+  /* Penalty associated with choosing alternative code */
+  int32_t distPenalty;
+} Quantiser_data;
+
+/* Struct required for the inverse Quantisation function of bt-aptX encoder and
+ * decoder*/
+/* Size of structure: 32 Bytes */
+typedef struct {
+  /* Pointer to threshold table */
+  const int32_t* thresholdTablePtr;
+  const int32_t* thresholdTablePtr_sl1;
+  /* Pointer to dither table */
+  const int32_t* ditherTablePtr_sf1;
+  /* Pointer to increment table */
+  const int32_t* incrTablePtr;
+  /* Upper and lower bounds for logDelta */
+  int32_t maxLogDelta;
+  int32_t minLogDelta;
+  /* Delta (quantisation step size */
+  int32_t delta;
+  /* Delta, expressed as a log base 2 */
+  uint16_t logDelta;
+  /* Output dequantised signal */
+  int32_t invQ;
+  /* pointer to IQuant_tableLogT */
+  const int32_t* iquantTableLogPtr;
+} IQuantiser_data;
+
+/* Subband data structure bt-aptX encoder*/
+/* Size of structure: 116+220+32= 368 Bytes */
+typedef struct {
+  /* Subband processing consists of inverse quantisation, predictor
+   * coefficient update, and predictor filtering. */
+  ZeroCoeff_data m_ZeroCoeffData;
+  PoleCoeff_data m_PoleCoeffData;
+  /* structure holding the data associated with the predictor */
+  Predictor_data m_predData;
+  /* iqdata holds the data associated with the instance of inverse quantiser */
+  IQuantiser_data m_iqdata;
+} Subband_data;
+
+/* Encoder data structure bt-aptX encoder*/
+/* Size of structure: 368*4+24+4*24 = 1592 Bytes */
+typedef struct {
+  /* Subband processing consists of inverse quantisation, predictor
+   * coefficient update, and predictor filtering. */
+  Subband_data m_SubbandData[4];
+  int32_t m_codewordHistory;
+  int32_t m_dithSyncRandBit;
+  int32_t m_ditherOutputs[4];
+  /* structure holding data values for this quantiser */
+  Quantiser_data m_qdata[4];
+} Encoder_data;
+
+/* Number of predictor pole filter coefficients is fixed at 2 for all subbands
+ */
+static const uint32_t numPoleFilterCoeffs = 2;
+
+/* Subband-specific number of predictor zero filter coefficients. */
+static const uint32_t numZeroFilterCoeffs[4] = {24, 12, 6, 12};
+
+/* Delta is scaled by 4 positions within the quantiser and inverse quantiser. */
+static const uint32_t deltaScale = 4;
+
+#ifdef _GCC
+#pragma GCC visibility pop
+#endif
+#endif  // APTXPARAMETERS_H
diff --git a/system/embdrv/encoder_for_aptx/src/AptxTables.h b/system/embdrv/encoder_for_aptx/src/AptxTables.h
new file mode 100644
index 0000000..7c017bf
--- /dev/null
+++ b/system/embdrv/encoder_for_aptx/src/AptxTables.h
@@ -0,0 +1,152 @@
+/**
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/*------------------------------------------------------------------------------
+ *
+ *  All table definitions used for the quantizer.
+ *
+ *----------------------------------------------------------------------------*/
+
+#ifndef APTXTABLES_H
+#define APTXTABLES_H
+
+#include "AptxParameters.h"
+
+/* Quantisation threshold, logDelta increment and dither tables for 2-bit codes
+ */
+static const int32_t dq2bit16_sl1[3] = {
+    -194080,
+    194080,
+    890562,
+};
+
+static const int32_t q2incr16[3] = {
+    0,
+    -33,
+    136,
+};
+
+static const int32_t dq2dith16_sf1[3] = {
+    194080,
+    194080,
+    502402,
+};
+
+static const int32_t dq2mLamb16[2] = {
+    0,
+    -77081,
+};
+
+/* Quantisation threshold, logDelta increment and dither tables for 3-bit codes
+ */
+static const int32_t dq3bit16_sl1[5] = {
+    -163006, 163006, 542708, 1120554, 2669238,
+};
+
+static const int32_t q3incr16[5] = {
+    0, -8, 33, 95, 262,
+};
+
+static const int32_t dq3dith16_sf1[5] = {
+    163006, 163006, 216698, 361148, 1187538,
+};
+
+static const int32_t dq3mLamb16[4] = {
+    0,
+    -13423,
+    -36113,
+    -206598,
+};
+
+/* Quantisation threshold, logDelta increment and dither tables for 4-bit codes
+ */
+static const int32_t dq4bit16_sl1[9] = {
+    -89806, 89806, 278502, 494338, 759442, 1113112, 1652322, 2720256, 5190186,
+};
+
+static const int32_t q4incr16[9] = {
+    0, -14, 6, 29, 58, 96, 154, 270, 521,
+};
+
+static const int32_t dq4dith16_sf1[9] = {
+    89806, 89806, 98890, 116946, 148158, 205512, 333698, 734236, 1735696,
+};
+
+static const int32_t dq4mLamb16[8] = {
+    0, -2271, -4514, -7803, -14339, -32047, -100135, -250365,
+};
+
+/* Quantisation threshold, logDelta increment and dither tables for 7-bit codes
+ */
+static const int32_t dq7bit16_sl1[65] = {
+    -9948,   9948,    29860,   49808,   69822,   89926,   110144,  130502,
+    151026,  171738,  192666,  213832,  235264,  256982,  279014,  301384,
+    324118,  347244,  370790,  394782,  419250,  444226,  469742,  495832,
+    522536,  549890,  577936,  606720,  636290,  666700,  698006,  730270,
+    763562,  797958,  833538,  870398,  908640,  948376,  989740,  1032874,
+    1077948, 1125150, 1174700, 1226850, 1281900, 1340196, 1402156, 1468282,
+    1539182, 1615610, 1698514, 1789098, 1888944, 2000168, 2125700, 2269750,
+    2438670, 2642660, 2899462, 3243240, 3746078, 4535138, 5664098, 7102424,
+    8897462,
+};
+
+static const int32_t q7incr16[65] = {
+    0,   -21, -19, -17, -15, -12, -10, -8,  -6,  -4,  -1,  1,   3,
+    6,   8,   10,  13,  15,  18,  20,  23,  26,  29,  31,  34,  37,
+    40,  43,  47,  50,  53,  57,  60,  64,  68,  72,  76,  80,  85,
+    89,  94,  99,  105, 110, 116, 123, 129, 136, 144, 152, 161, 171,
+    182, 194, 207, 223, 241, 263, 291, 328, 382, 467, 522, 522, 522,
+};
+
+static const int32_t dq7dith16_sf1[65] = {
+    9948,   9948,    9962,  9988,   10026,  10078,  10142,  10218,  10306,
+    10408,  10520,   10646, 10784,  10934,  11098,  11274,  11462,  11664,
+    11880,  12112,   12358, 12618,  12898,  13194,  13510,  13844,  14202,
+    14582,  14988,   15422, 15884,  16380,  16912,  17484,  18098,  18762,
+    19480,  20258,   21106, 22030,  23044,  24158,  25390,  26760,  28290,
+    30008,  31954,   34172, 36728,  39700,  43202,  47382,  52462,  58762,
+    66770,  77280,   91642, 112348, 144452, 199326, 303512, 485546, 643414,
+    794914, 1000124,
+};
+
+static const int32_t dq7mLamb16[65] = {
+    0,      -4,     -7,     -10,    -13,   -16,   -19,   -22,   -26,    -28,
+    -32,    -35,    -38,    -41,    -44,   -47,   -51,   -54,   -58,    -62,
+    -65,    -70,    -74,    -79,    -84,   -90,   -95,   -102,  -109,   -116,
+    -124,   -133,   -143,   -154,   -166,  -180,  -195,  -212,  -231,   -254,
+    -279,   -308,   -343,   -383,   -430,  -487,  -555,  -639,  -743,   -876,
+    -1045,  -1270,  -1575,  -2002,  -2628, -3591, -5177, -8026, -13719, -26047,
+    -45509, -39467, -37875, -51303, 0,
+};
+
+/* Array of structures containing subband parameters. */
+static const SubbandParameters subbandParameters[NUMSUBBANDS] = {
+    /* LL band */
+    {0, dq7bit16_sl1, 0, dq7dith16_sf1, dq7mLamb16, q7incr16, 7, (18 * 256) - 1,
+     -20, 24},
+
+    /* LH band */
+    {0, dq4bit16_sl1, 0, dq4dith16_sf1, dq4mLamb16, q4incr16, 4, (21 * 256) - 1,
+     -23, 12},
+
+    /* HL band */
+    {0, dq2bit16_sl1, 0, dq2dith16_sf1, dq2mLamb16, q2incr16, 2, (23 * 256) - 1,
+     -25, 6},
+
+    /* HH band */
+    {0, dq3bit16_sl1, 0, dq3dith16_sf1, dq3mLamb16, q3incr16, 3, (22 * 256) - 1,
+     -24, 12}};
+
+#endif  // APTXTABLES_H
diff --git a/system/embdrv/encoder_for_aptx/src/CBStruct.h b/system/embdrv/encoder_for_aptx/src/CBStruct.h
new file mode 100644
index 0000000..eb968d6
--- /dev/null
+++ b/system/embdrv/encoder_for_aptx/src/CBStruct.h
@@ -0,0 +1,40 @@
+/**
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/*------------------------------------------------------------------------------
+ *
+ *  Structure required to implement a circular buffer.
+ *
+ *----------------------------------------------------------------------------*/
+
+#ifndef CBSTRUCT_H
+#define CBSTRUCT_H
+#ifdef _GCC
+#pragma GCC visibility push(hidden)
+#endif
+
+typedef struct circularBuffer_t {
+  /* Buffer storage */
+  int32_t buffer[48];
+  /* Pointer to current buffer location */
+  uint32_t pointer;
+  /* Modulo length of circular buffer */
+  uint32_t modulo;
+} circularBuffer;
+
+#ifdef _GCC
+#pragma GCC visibility pop
+#endif
+#endif  // CBSTRUCT_H
\ No newline at end of file
diff --git a/system/embdrv/encoder_for_aptx/src/CodewordPacker.h b/system/embdrv/encoder_for_aptx/src/CodewordPacker.h
new file mode 100644
index 0000000..a4b96eb
--- /dev/null
+++ b/system/embdrv/encoder_for_aptx/src/CodewordPacker.h
@@ -0,0 +1,64 @@
+/**
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/*------------------------------------------------------------------------------
+ *
+ *  Prototype declaration of the CodewordPacker Function
+ *
+ *  This functions allows a client to supply an array of 4 quantised codes
+ *  (1 per subband) and obtain a packed version as a 16-bit aptX codeword.
+ *
+ *----------------------------------------------------------------------------*/
+
+#ifndef CODEWORDPACKER_H
+#define CODEWORDPACKER_H
+
+#include "AptxParameters.h"
+
+XBT_INLINE_ int16_t packCodeword(Encoder_data* EncoderDataPt,
+                                 uint32_t aligned) {
+  int32_t syncContribution;
+  int32_t hhCode;
+  int32_t codeword;
+
+  /* The per-channel contribution to derive the current sync bit is the XOR of
+   * the 4 code lsbs and the random dither bit. The SyncInserter engineers it
+   * such that the XOR of the sync contributions from the left and right
+   * channel give the actual sync bit value. The per-channel sync bit
+   * contribution overwrites the HH code lsb in the packed codeword. */
+  if (aligned != no_sync) {
+    syncContribution =
+        (EncoderDataPt->m_qdata[0].qCode ^ EncoderDataPt->m_qdata[1].qCode ^
+         EncoderDataPt->m_qdata[2].qCode ^ EncoderDataPt->m_qdata[3].qCode ^
+         EncoderDataPt->m_dithSyncRandBit) &
+        0x1;
+    hhCode = (EncoderDataPt->m_qdata[HH].qCode & 0x6) | syncContribution;
+
+    /* Pack the 16-bit codeword with the appropriate number of lsbs from each
+     * quantised code (LL=7, LH=4, HL=2, HH=3). */
+    codeword = (EncoderDataPt->m_qdata[LL].qCode & 0x7fL) |
+               ((EncoderDataPt->m_qdata[LH].qCode & 0xfL) << 7) |
+               ((EncoderDataPt->m_qdata[HL].qCode & 0x3L) << 11) |
+               (hhCode << 13);
+  } else {  // don't add sync contribution for non-autosync mode
+    codeword = (EncoderDataPt->m_qdata[LL].qCode & 0x7fL) |
+               ((EncoderDataPt->m_qdata[LH].qCode & 0xfL) << 7) |
+               ((EncoderDataPt->m_qdata[HL].qCode & 0x3L) << 11) |
+               ((EncoderDataPt->m_qdata[HH].qCode & 0x7L) << 13);
+  }
+  return (int16_t)codeword;
+}
+
+#endif  // CODEWORDPACKER_H
diff --git a/system/embdrv/encoder_for_aptx/src/DitherGenerator.h b/system/embdrv/encoder_for_aptx/src/DitherGenerator.h
new file mode 100644
index 0000000..baa5605
--- /dev/null
+++ b/system/embdrv/encoder_for_aptx/src/DitherGenerator.h
@@ -0,0 +1,115 @@
+/**
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/*------------------------------------------------------------------------------
+ *
+ *  These functions allow clients to update an internal codeword history
+ *  attribute from previously-generated quantised codes, and to generate a new
+ *  pseudo-random dither value per subband from this internal attribute.
+ *
+ *----------------------------------------------------------------------------*/
+
+#ifndef DITHERGENERATOR_H
+#define DITHERGENERATOR_H
+
+#include "AptxParameters.h"
+
+/* This function updates an internal bit-pool (private
+ * variable in DitherGenerator) based on bits obtained from
+ * previously encoded or received aptX codewords. */
+XBT_INLINE_ int32_t xbtEncupdateCodewordHistory(const int32_t quantisedCodes[4],
+                                                int32_t m_codewordHistory) {
+  int32_t newBits;
+  int32_t updatedCodewordHistory;
+
+  const int32_t llMask = 0x3L;
+  const int32_t lhMask = 0x2L;
+  const int32_t hlMask = 0x1L;
+  const uint32_t lhShift = 1;
+  const uint32_t hlShift = 3;
+  /* Shift value to left-justify a 24-bit value in a 32-bit signed variable*/
+  const uint32_t leftJustifyShift = 8;
+  const uint32_t numNewBits = 4;
+
+  /* Make a 4-bit vector from particular bits from 3 quantised codes */
+  newBits = (quantisedCodes[LL] & llMask) +
+            ((quantisedCodes[LH] & lhMask) << lhShift) +
+            ((quantisedCodes[HL] & hlMask) << hlShift);
+
+  /* Add the 4 new bits to the codeword history. Note that this is a 24-bit
+   * value LEFT-JUSTIFIED in a 32-bit signed variable. Maintaining the history
+   * as signed is useful in the dither generation process below. */
+  updatedCodewordHistory =
+      (m_codewordHistory << numNewBits) + (newBits << leftJustifyShift);
+
+  return updatedCodewordHistory;
+}
+
+/* Function to generate a dither value for each subband based
+ * on the current contents of the codewordHistory bit-pool. */
+XBT_INLINE_ int32_t xbtEncgenerateDither(int32_t m_codewordHistory,
+                                         int32_t* m_ditherOutputs) {
+  int32_t history24b;
+  int32_t upperAcc;
+  int32_t lowerAcc;
+  int32_t accSum;
+  int64_t tmp_acc;
+  int32_t ditherSample;
+  int32_t m_dithSyncRandBit;
+
+  /* Fixed value to multiply codeword history variable by */
+  const uint32_t dithConstMultiplier = 0x4f1bbbL;
+  /* Shift value to left-justify a 24-bit value in a 32-bit signed variable*/
+  const uint32_t leftJustifyShift = 8;
+
+  /* AND mask to retain only the lower 24 bits of a variable */
+  const int32_t keepLower24bitsMask = 0xffffffL;
+
+  /* Convert the codeword history to a 24-bit signed value. This can be done
+   * cheaply with a 8-position right-shift since it is maintained as 24-bits
+   * value left-justified in a signed 32-bit variable. */
+  history24b = m_codewordHistory >> (leftJustifyShift - 1);
+
+  /* Multiply the history by a fixed constant. The constant has already been
+   * shifted right by 1 position to compensate for the left-shift introduced
+   * on the product by the fractional multiplier. */
+  tmp_acc = ((int64_t)history24b * (int64_t)dithConstMultiplier);
+
+  /* Get the upper and lower 24-bit values from the accumulator, and form
+   * their sum. */
+  upperAcc = ((int32_t)(tmp_acc >> 24)) & 0x00FFFFFFL;
+  lowerAcc = ((int32_t)tmp_acc) & 0x00FFFFFFL;
+  accSum = upperAcc + lowerAcc;
+
+  /* The dither sample is the 2 msbs of lowerAcc and the 22 lsbs of accSum */
+  ditherSample = ((lowerAcc >> 22) + (accSum << 2)) & keepLower24bitsMask;
+
+  /* The sign bit of 24-bit accSum is saved as a random bit to
+   * assist in the aptX sync insertion process. */
+  m_dithSyncRandBit = (accSum >> 23) & 0x1;
+
+  /* Successive dither outputs for the 4 subbands are versions of ditherSample
+   * offset by a further 5-position left shift for each subband. Also apply a
+   * constant left-shift of 8 to turn the values into signed 24-bit values
+   * left-justified in the 32-bit ditherOutput variable. */
+  m_ditherOutputs[HH] = ditherSample << leftJustifyShift;
+  m_ditherOutputs[HL] = ditherSample << (5 + leftJustifyShift);
+  m_ditherOutputs[LH] = ditherSample << (10 + leftJustifyShift);
+  m_ditherOutputs[LL] = ditherSample << (15 + leftJustifyShift);
+
+  return m_dithSyncRandBit;
+};
+
+#endif  // DITHERGENERATOR_H
diff --git a/system/embdrv/encoder_for_aptx/src/ProcessSubband.c b/system/embdrv/encoder_for_aptx/src/ProcessSubband.c
new file mode 100644
index 0000000..e1cc1e3
--- /dev/null
+++ b/system/embdrv/encoder_for_aptx/src/ProcessSubband.c
@@ -0,0 +1,64 @@
+/**
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#include "AptxParameters.h"
+#include "SubbandFunctions.h"
+#include "SubbandFunctionsCommon.h"
+
+/*  This function carries out all subband processing (common to both encode and
+ * decode). */
+void processSubband(const int32_t qCode, const int32_t ditherVal,
+                    Subband_data* SubbandDataPt, IQuantiser_data* iqDataPt) {
+  /* Inverse quantisation */
+  invertQuantisation(qCode, ditherVal, iqDataPt);
+
+  /* Predictor pole coefficient update */
+  updatePredictorPoleCoefficients(iqDataPt->invQ,
+                                  SubbandDataPt->m_predData.m_zeroVal,
+                                  &SubbandDataPt->m_PoleCoeffData);
+
+  /* Predictor filtering */
+  performPredictionFiltering(iqDataPt->invQ, SubbandDataPt);
+}
+
+/* processSubbandLL is used for the LL subband only. */
+void processSubbandLL(const int32_t qCode, const int32_t ditherVal,
+                      Subband_data* SubbandDataPt, IQuantiser_data* iqDataPt) {
+  /* Inverse quantisation */
+  invertQuantisation(qCode, ditherVal, iqDataPt);
+
+  /* Predictor pole coefficient update */
+  updatePredictorPoleCoefficients(iqDataPt->invQ,
+                                  SubbandDataPt->m_predData.m_zeroVal,
+                                  &SubbandDataPt->m_PoleCoeffData);
+
+  /* Predictor filtering */
+  performPredictionFilteringLL(iqDataPt->invQ, SubbandDataPt);
+}
+
+/* processSubbandHL is used for the HL subband only. */
+void processSubbandHL(const int32_t qCode, const int32_t ditherVal,
+                      Subband_data* SubbandDataPt, IQuantiser_data* iqDataPt) {
+  /* Inverse quantisation */
+  invertQuantisationHL(qCode, ditherVal, iqDataPt);
+
+  /* Predictor pole coefficient update */
+  updatePredictorPoleCoefficients(iqDataPt->invQ,
+                                  SubbandDataPt->m_predData.m_zeroVal,
+                                  &SubbandDataPt->m_PoleCoeffData);
+
+  /* Predictor filtering */
+  performPredictionFilteringHL(iqDataPt->invQ, SubbandDataPt);
+}
diff --git a/system/embdrv/encoder_for_aptx/src/Qmf.h b/system/embdrv/encoder_for_aptx/src/Qmf.h
new file mode 100644
index 0000000..0d7fa7f
--- /dev/null
+++ b/system/embdrv/encoder_for_aptx/src/Qmf.h
@@ -0,0 +1,162 @@
+/**
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/*------------------------------------------------------------------------------
+ *
+ *  This file includes the coefficient tables or the two convolution function
+ *  It also includes the definition of Qmf_storage and the prototype of all
+ *  necessary functions required to implement the QMF filtering.
+ *
+ *----------------------------------------------------------------------------*/
+
+#ifndef QMF_H
+#define QMF_H
+
+#include "AptxParameters.h"
+
+typedef struct {
+  int16_t QmfL_buf[32];
+  int16_t QmfH_buf[32];
+  int32_t QmfLH_buf[32];
+  int32_t QmfHL_buf[32];
+  int32_t QmfLL_buf[32];
+  int32_t QmfHH_buf[32];
+  int32_t QmfI_pt;
+  int32_t QmfO_pt;
+} Qmf_storage;
+
+/* Outer QMF filter for Enhanced aptX is a symmetrical 32-tap filter (16
+ * different coefficients). The table in defined in QmfConv.c */
+#ifndef _STDQMFOUTERCOEFF
+static const int32_t Qmf_outerCoeffs[12] = {
+    /* (C(1/30)C(3/28)), C(5/26), C(7/24) */
+    0xFE6302DA,
+    0xFFFFDA75,
+    0x0000AA6A,
+    /*  C(9/22), C(11/20), C(13/18), C(15/16) */
+    0xFFFE273E,
+    0x00041E95,
+    0xFFF710B5,
+    0x002AC12E,
+    /*  C(17/14), C(19/12), (C(21/10)C(23/8)) */
+    0x000AA328,
+    0xFFFD8D1F,
+    0x211E6BDB,
+    /* (C(25/6)C(27/4)), (C(29/2)C(31/0)) */
+    0x0DB7D8C5,
+    0xFC7F02B0,
+};
+#else
+static const int32_t Qmf_outerCoeffs[16] = {
+    730,    -413,    -9611, 43626, -121026, 269973, -585547, 2801966,
+    697128, -160481, 27611, 8478,  -10043,  3511,   688,     -897,
+};
+#endif
+
+/* Each inner QMF filter for Enhanced aptX is a symmetrical 32-tap filter (16
+ * different coefficients) */
+static const int32_t Qmf_innerCoeffs[16] = {
+    1033,   -584,    -13592, 61697, -171156, 381799, -828088, 3962579,
+    985888, -226954, 39048,  11990, -14203,  4966,   973,     -1268,
+};
+
+void AsmQmfConvI(const int32_t* p1dl_buffPtr, const int32_t* p2dl_buffPtr,
+                 const int32_t* coeffPtr, int32_t* filterOutputs);
+void AsmQmfConvO(const int16_t* p1dl_buffPtr, const int16_t* p2dl_buffPtr,
+                 const int32_t* coeffPtr, int32_t* convSumDiff);
+
+XBT_INLINE_ void QmfAnalysisFilter(const int32_t pcm[4], Qmf_storage* Qmf_St,
+                                   const int32_t predVals[4],
+                                   int32_t* aqmfOutputs) {
+  int32_t convSumDiff[4];
+  int32_t filterOutputs[4];
+
+  int32_t lc_QmfO_pt = (Qmf_St->QmfO_pt);
+  int32_t lc_QmfI_pt = (Qmf_St->QmfI_pt);
+
+  /* Symbolic constants to represent the first and second set out outer filter
+   * outputs. */
+  enum { FirstOuterOutputs = 0, SecondOuterOutputs = 1 };
+
+  /* Load outer filter phase1 and phase2 delay lines with the first 2 PCM
+   * samples. Convolve the filter and get the 2 convolution results. */
+  Qmf_St->QmfL_buf[lc_QmfO_pt + 16] = (int16_t)pcm[FirstPcm];
+  Qmf_St->QmfL_buf[lc_QmfO_pt] = (int16_t)pcm[FirstPcm];
+  Qmf_St->QmfH_buf[lc_QmfO_pt + 16] = (int16_t)pcm[SecondPcm];
+  Qmf_St->QmfH_buf[lc_QmfO_pt++] = (int16_t)pcm[SecondPcm];
+  lc_QmfO_pt &= 0xF;
+
+  AsmQmfConvO(&Qmf_St->QmfL_buf[lc_QmfO_pt + 15], &Qmf_St->QmfH_buf[lc_QmfO_pt],
+              Qmf_outerCoeffs, &convSumDiff[0]);
+
+  /* Load outer filter phase1 and phase2 delay lines with the second 2 PCM
+   * samples. Convolve the filter and get the 2 convolution results. */
+  Qmf_St->QmfL_buf[lc_QmfO_pt + 16] = (int16_t)pcm[ThirdPcm];
+  Qmf_St->QmfL_buf[lc_QmfO_pt] = (int16_t)pcm[ThirdPcm];
+  Qmf_St->QmfH_buf[lc_QmfO_pt + 16] = (int16_t)pcm[FourthPcm];
+  Qmf_St->QmfH_buf[lc_QmfO_pt++] = (int16_t)pcm[FourthPcm];
+  lc_QmfO_pt &= 0xF;
+
+  AsmQmfConvO(&Qmf_St->QmfL_buf[lc_QmfO_pt + 15], &Qmf_St->QmfH_buf[lc_QmfO_pt],
+              Qmf_outerCoeffs, &convSumDiff[1]);
+
+  /* Load the first inner filter phase1 and phase2 delay lines with the 2
+   * convolution sum (low-pass) outer filter outputs. Convolve the filter and
+   * get the 2 convolution results. The first 2 analysis filter outputs are
+   * the sum and difference values for the first inner filter convolutions. */
+  Qmf_St->QmfLL_buf[lc_QmfI_pt + 16] = convSumDiff[0];
+  Qmf_St->QmfLL_buf[lc_QmfI_pt] = convSumDiff[0];
+  Qmf_St->QmfLH_buf[lc_QmfI_pt + 16] = convSumDiff[1];
+  Qmf_St->QmfLH_buf[lc_QmfI_pt] = convSumDiff[1];
+
+  AsmQmfConvI(&Qmf_St->QmfLL_buf[lc_QmfI_pt + 16],
+              &Qmf_St->QmfLH_buf[lc_QmfI_pt + 1], &Qmf_innerCoeffs[0],
+              &filterOutputs[LL]);
+
+  /* Load the second inner filter phase1 and phase2 delay lines with the 2
+   * convolution difference (high-pass) outer filter outputs. Convolve the
+   * filter and get the 2 convolution results. The second 2 analysis filter
+   * outputs are the sum and difference values for the second inner filter
+   * convolutions. */
+  Qmf_St->QmfHL_buf[lc_QmfI_pt + 16] = convSumDiff[2];
+  Qmf_St->QmfHL_buf[lc_QmfI_pt] = convSumDiff[2];
+  Qmf_St->QmfHH_buf[lc_QmfI_pt + 16] = convSumDiff[3];
+  Qmf_St->QmfHH_buf[lc_QmfI_pt++] = convSumDiff[3];
+  lc_QmfI_pt &= 0xF;
+
+  AsmQmfConvI(&Qmf_St->QmfHL_buf[lc_QmfI_pt + 15],
+              &Qmf_St->QmfHH_buf[lc_QmfI_pt], &Qmf_innerCoeffs[0],
+              &filterOutputs[HL]);
+
+  /* Subtracted the previous predicted value from the filter output on a
+   * per-subband basis. Ensure these values are saturated, if necessary.
+   * Manual unrolling */
+  aqmfOutputs[LL] = filterOutputs[LL] - predVals[LL];
+  aqmfOutputs[LL] = ssat24(aqmfOutputs[LL]);
+
+  aqmfOutputs[LH] = filterOutputs[LH] - predVals[LH];
+  aqmfOutputs[LH] = ssat24(aqmfOutputs[LH]);
+
+  aqmfOutputs[HL] = filterOutputs[HL] - predVals[HL];
+  aqmfOutputs[HL] = ssat24(aqmfOutputs[HL]);
+
+  aqmfOutputs[HH] = filterOutputs[HH] - predVals[HH];
+  aqmfOutputs[HH] = ssat24(aqmfOutputs[HH]);
+
+  (Qmf_St->QmfO_pt) = lc_QmfO_pt;
+  (Qmf_St->QmfI_pt) = lc_QmfI_pt;
+}
+
+#endif  // QMF_H
diff --git a/system/embdrv/encoder_for_aptx/src/QmfConv.c b/system/embdrv/encoder_for_aptx/src/QmfConv.c
new file mode 100644
index 0000000..4f24d1e
--- /dev/null
+++ b/system/embdrv/encoder_for_aptx/src/QmfConv.c
@@ -0,0 +1,360 @@
+/**
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/*------------------------------------------------------------------------------
+ *
+ *  This file includes convolution functions required for the Qmf.
+ *
+ *----------------------------------------------------------------------------*/
+
+#include "Qmf.h"
+
+void AsmQmfConvO(const int16_t* p1dl_buffPtr, const int16_t* p2dl_buffPtr,
+                 const int32_t* coeffPtr, int32_t* convSumDiff) {
+  /* Since all manipulated data are "int16_t" it is possible to
+   * reduce the number of loads by using int32_t type and manipulating
+   * pairs of data
+   */
+  int32_t acc;
+  // Manual inlining as IAR compiler does not seem to do it itself...
+  // WARNING: This inlining assumes that m_qmfDelayLineLength == 16
+  int32_t tmp_round0;
+  int64_t local_acc0;
+  int64_t local_acc1;
+  int32_t coeffVal0;
+  int32_t coeffVal1;
+  int16_t data0;
+  int16_t data1;
+  int16_t data2;
+  int16_t data3;
+  int32_t phaseConv[2];
+  int32_t convSum;
+  int32_t convDiff;
+
+  coeffVal0 = (*(coeffPtr));
+  coeffVal1 = (*(coeffPtr + 1));
+  data0 = (*(p1dl_buffPtr));
+  data1 = (*(p2dl_buffPtr));
+  data2 = (*(p1dl_buffPtr - 1));
+  data3 = (*(p2dl_buffPtr + 1));
+
+  local_acc0 = ((int64_t)(coeffVal0) * (int64_t)data0);
+  local_acc1 = ((int64_t)(coeffVal0) * (int64_t)data1);
+  local_acc0 += ((int64_t)(coeffVal1) * (int64_t)data2);
+  local_acc1 += ((int64_t)(coeffVal1) * (int64_t)data3);
+
+  coeffVal0 = (*(coeffPtr + 2));
+  coeffVal1 = (*(coeffPtr + 3));
+  data0 = (*(p1dl_buffPtr - 2));
+  data1 = (*(p2dl_buffPtr + 2));
+  data2 = (*(p1dl_buffPtr - 3));
+  data3 = (*(p2dl_buffPtr + 3));
+
+  local_acc0 += ((int64_t)(coeffVal0) * (int64_t)data0);
+  local_acc1 += ((int64_t)(coeffVal0) * (int64_t)data1);
+  local_acc0 += ((int64_t)(coeffVal1) * (int64_t)data2);
+  local_acc1 += ((int64_t)(coeffVal1) * (int64_t)data3);
+
+  coeffVal0 = (*(coeffPtr + 4));
+  coeffVal1 = (*(coeffPtr + 5));
+  data0 = (*(p1dl_buffPtr - 4));
+  data1 = (*(p2dl_buffPtr + 4));
+  data2 = (*(p1dl_buffPtr - 5));
+  data3 = (*(p2dl_buffPtr + 5));
+
+  local_acc0 += ((int64_t)(coeffVal0) * (int64_t)data0);
+  local_acc1 += ((int64_t)(coeffVal0) * (int64_t)data1);
+  local_acc0 += ((int64_t)(coeffVal1) * (int64_t)data2);
+  local_acc1 += ((int64_t)(coeffVal1) * (int64_t)data3);
+
+  coeffVal0 = (*(coeffPtr + 6));
+  coeffVal1 = (*(coeffPtr + 7));
+  data0 = (*(p1dl_buffPtr - 6));
+  data1 = (*(p2dl_buffPtr + 6));
+  data2 = (*(p1dl_buffPtr - 7));
+  data3 = (*(p2dl_buffPtr + 7));
+
+  local_acc0 += ((int64_t)(coeffVal0) * (int64_t)data0);
+  local_acc1 += ((int64_t)(coeffVal0) * (int64_t)data1);
+  local_acc0 += ((int64_t)(coeffVal1) * (int64_t)data2);
+  local_acc1 += ((int64_t)(coeffVal1) * (int64_t)data3);
+
+  coeffVal0 = (*(coeffPtr + 8));
+  coeffVal1 = (*(coeffPtr + 9));
+  data0 = (*(p1dl_buffPtr - 8));
+  data1 = (*(p2dl_buffPtr + 8));
+  data2 = (*(p1dl_buffPtr - 9));
+  data3 = (*(p2dl_buffPtr + 9));
+
+  local_acc0 += ((int64_t)(coeffVal0) * (int64_t)data0);
+  local_acc1 += ((int64_t)(coeffVal0) * (int64_t)data1);
+  local_acc0 += ((int64_t)(coeffVal1) * (int64_t)data2);
+  local_acc1 += ((int64_t)(coeffVal1) * (int64_t)data3);
+
+  coeffVal0 = (*(coeffPtr + 10));
+  coeffVal1 = (*(coeffPtr + 11));
+  data0 = (*(p1dl_buffPtr - 10));
+  data1 = (*(p2dl_buffPtr + 10));
+  data2 = (*(p1dl_buffPtr - 11));
+  data3 = (*(p2dl_buffPtr + 11));
+
+  local_acc0 += ((int64_t)(coeffVal0) * (int64_t)data0);
+  local_acc1 += ((int64_t)(coeffVal0) * (int64_t)data1);
+  local_acc0 += ((int64_t)(coeffVal1) * (int64_t)data2);
+  local_acc1 += ((int64_t)(coeffVal1) * (int64_t)data3);
+
+  coeffVal0 = (*(coeffPtr + 12));
+  coeffVal1 = (*(coeffPtr + 13));
+  data0 = (*(p1dl_buffPtr - 12));
+  data1 = (*(p2dl_buffPtr + 12));
+  data2 = (*(p1dl_buffPtr - 13));
+  data3 = (*(p2dl_buffPtr + 13));
+
+  local_acc0 += ((int64_t)(coeffVal0) * (int64_t)data0);
+  local_acc1 += ((int64_t)(coeffVal0) * (int64_t)data1);
+  local_acc0 += ((int64_t)(coeffVal1) * (int64_t)data2);
+  local_acc1 += ((int64_t)(coeffVal1) * (int64_t)data3);
+
+  coeffVal0 = (*(coeffPtr + 14));
+  coeffVal1 = (*(coeffPtr + 15));
+  data0 = (*(p1dl_buffPtr - 14));
+  data1 = (*(p2dl_buffPtr + 14));
+  data2 = (*(p1dl_buffPtr - 15));
+  data3 = (*(p2dl_buffPtr + 15));
+
+  local_acc0 += ((int64_t)(coeffVal0) * (int64_t)data0);
+  local_acc1 += ((int64_t)(coeffVal0) * (int64_t)data1);
+  local_acc0 += ((int64_t)(coeffVal1) * (int64_t)data2);
+  local_acc1 += ((int64_t)(coeffVal1) * (int64_t)data3);
+
+  tmp_round0 = (int32_t)local_acc0 & 0x00FFFFL;
+
+  local_acc0 += 0x004000L;
+  acc = (int32_t)(local_acc0 >> 15);
+  if (tmp_round0 == 0x004000L) {
+    acc--;
+  }
+  if (acc > 8388607) {
+    acc = 8388607;
+  }
+  if (acc < -8388608) {
+    acc = -8388608;
+  }
+
+  phaseConv[0] = acc;
+
+  tmp_round0 = (int32_t)local_acc1 & 0x00FFFFL;
+
+  local_acc1 += 0x004000L;
+  acc = (int32_t)(local_acc1 >> 15);
+  if (tmp_round0 == 0x004000L) {
+    acc--;
+  }
+  if (acc > 8388607) {
+    acc = 8388607;
+  }
+  if (acc < -8388608) {
+    acc = -8388608;
+  }
+
+  phaseConv[1] = acc;
+
+  convSum = phaseConv[1] + phaseConv[0];
+  if (convSum > 8388607) {
+    convSum = 8388607;
+  }
+  if (convSum < -8388608) {
+    convSum = -8388608;
+  }
+
+  convDiff = phaseConv[1] - phaseConv[0];
+  if (convDiff > 8388607) {
+    convDiff = 8388607;
+  }
+  if (convDiff < -8388608) {
+    convDiff = -8388608;
+  }
+
+  *(convSumDiff) = convSum;
+  *(convSumDiff + 2) = convDiff;
+}
+
+void AsmQmfConvI(const int32_t* p1dl_buffPtr, const int32_t* p2dl_buffPtr,
+                 const int32_t* coeffPtr, int32_t* filterOutputs) {
+  int32_t acc;
+  // WARNING: This inlining assumes that m_qmfDelayLineLength == 16
+  int32_t tmp_round0;
+  int64_t local_acc0;
+  int64_t local_acc1;
+  int32_t coeffVal0;
+  int32_t coeffVal1;
+  int32_t data0;
+  int32_t data1;
+  int32_t data2;
+  int32_t data3;
+  int32_t phaseConv[2];
+  int32_t convSum;
+  int32_t convDiff;
+
+  coeffVal0 = (*(coeffPtr));
+  coeffVal1 = (*(coeffPtr + 1));
+  data0 = (*(p1dl_buffPtr));
+  data1 = (*(p2dl_buffPtr));
+  data2 = (*(p1dl_buffPtr - 1));
+  data3 = (*(p2dl_buffPtr + 1));
+
+  local_acc0 = ((int64_t)(coeffVal0)*data0);
+  local_acc1 = ((int64_t)(coeffVal0)*data1);
+  local_acc0 += ((int64_t)(coeffVal1)*data2);
+  local_acc1 += ((int64_t)(coeffVal1)*data3);
+
+  coeffVal0 = (*(coeffPtr + 2));
+  coeffVal1 = (*(coeffPtr + 3));
+  data0 = (*(p1dl_buffPtr - 2));
+  data1 = (*(p2dl_buffPtr + 2));
+  data2 = (*(p1dl_buffPtr - 3));
+  data3 = (*(p2dl_buffPtr + 3));
+
+  local_acc0 += ((int64_t)(coeffVal0)*data0);
+  local_acc1 += ((int64_t)(coeffVal0)*data1);
+  local_acc0 += ((int64_t)(coeffVal1)*data2);
+  local_acc1 += ((int64_t)(coeffVal1)*data3);
+
+  coeffVal0 = (*(coeffPtr + 4));
+  coeffVal1 = (*(coeffPtr + 5));
+  data0 = (*(p1dl_buffPtr - 4));
+  data1 = (*(p2dl_buffPtr + 4));
+  data2 = (*(p1dl_buffPtr - 5));
+  data3 = (*(p2dl_buffPtr + 5));
+
+  local_acc0 += ((int64_t)(coeffVal0)*data0);
+  local_acc1 += ((int64_t)(coeffVal0)*data1);
+  local_acc0 += ((int64_t)(coeffVal1)*data2);
+  local_acc1 += ((int64_t)(coeffVal1)*data3);
+
+  coeffVal0 = (*(coeffPtr + 6));
+  coeffVal1 = (*(coeffPtr + 7));
+  data0 = (*(p1dl_buffPtr - 6));
+  data1 = (*(p2dl_buffPtr + 6));
+  data2 = (*(p1dl_buffPtr - 7));
+  data3 = (*(p2dl_buffPtr + 7));
+
+  local_acc0 += ((int64_t)(coeffVal0)*data0);
+  local_acc1 += ((int64_t)(coeffVal0)*data1);
+  local_acc0 += ((int64_t)(coeffVal1)*data2);
+  local_acc1 += ((int64_t)(coeffVal1)*data3);
+
+  coeffVal0 = (*(coeffPtr + 8));
+  coeffVal1 = (*(coeffPtr + 9));
+  data0 = (*(p1dl_buffPtr - 8));
+  data1 = (*(p2dl_buffPtr + 8));
+  data2 = (*(p1dl_buffPtr - 9));
+  data3 = (*(p2dl_buffPtr + 9));
+
+  local_acc0 += ((int64_t)(coeffVal0)*data0);
+  local_acc1 += ((int64_t)(coeffVal0)*data1);
+  local_acc0 += ((int64_t)(coeffVal1)*data2);
+  local_acc1 += ((int64_t)(coeffVal1)*data3);
+
+  coeffVal0 = (*(coeffPtr + 10));
+  coeffVal1 = (*(coeffPtr + 11));
+  data0 = (*(p1dl_buffPtr - 10));
+  data1 = (*(p2dl_buffPtr + 10));
+  data2 = (*(p1dl_buffPtr - 11));
+  data3 = (*(p2dl_buffPtr + 11));
+
+  local_acc0 += ((int64_t)(coeffVal0)*data0);
+  local_acc1 += ((int64_t)(coeffVal0)*data1);
+  local_acc0 += ((int64_t)(coeffVal1)*data2);
+  local_acc1 += ((int64_t)(coeffVal1)*data3);
+
+  coeffVal0 = (*(coeffPtr + 12));
+  coeffVal1 = (*(coeffPtr + 13));
+  data0 = (*(p1dl_buffPtr - 12));
+  data1 = (*(p2dl_buffPtr + 12));
+  data2 = (*(p1dl_buffPtr - 13));
+  data3 = (*(p2dl_buffPtr + 13));
+
+  local_acc0 += ((int64_t)(coeffVal0)*data0);
+  local_acc1 += ((int64_t)(coeffVal0)*data1);
+  local_acc0 += ((int64_t)(coeffVal1)*data2);
+  local_acc1 += ((int64_t)(coeffVal1)*data3);
+
+  coeffVal0 = (*(coeffPtr + 14));
+  coeffVal1 = (*(coeffPtr + 15));
+  data0 = (*(p1dl_buffPtr - 14));
+  data1 = (*(p2dl_buffPtr + 14));
+  data2 = (*(p1dl_buffPtr - 15));
+  data3 = (*(p2dl_buffPtr + 15));
+
+  local_acc0 += ((int64_t)(coeffVal0)*data0);
+  local_acc1 += ((int64_t)(coeffVal0)*data1);
+  local_acc0 += ((int64_t)(coeffVal1)*data2);
+  local_acc1 += ((int64_t)(coeffVal1)*data3);
+
+  tmp_round0 = (int32_t)local_acc0;
+
+  local_acc0 += 0x00400000L;
+  acc = (int32_t)(local_acc0 >> 23);
+
+  if ((((tmp_round0 << 8) ^ 0x40000000) == 0)) {
+    acc--;
+  }
+
+  if (acc > 8388607) {
+    acc = 8388607;
+  }
+  if (acc < -8388608) {
+    acc = -8388608;
+  }
+
+  phaseConv[0] = acc;
+  tmp_round0 = (int32_t)local_acc1;
+
+  local_acc1 += 0x00400000L;
+  acc = (int32_t)(local_acc1 >> 23);
+  if ((((tmp_round0 << 8) ^ 0x40000000) == 0)) {
+    acc--;
+  }
+
+  if (acc > 8388607) {
+    acc = 8388607;
+  }
+  if (acc < -8388608) {
+    acc = -8388608;
+  }
+
+  phaseConv[1] = acc;
+
+  convSum = phaseConv[1] + phaseConv[0];
+  if (convSum > 8388607) {
+    convSum = 8388607;
+  }
+  if (convSum < -8388608) {
+    convSum = -8388608;
+  }
+
+  *(filterOutputs) = convSum;
+
+  convDiff = phaseConv[1] - phaseConv[0];
+  if (convDiff > 8388607) {
+    convDiff = 8388607;
+  }
+  if (convDiff < -8388608) {
+    convDiff = -8388608;
+  }
+
+  *(filterOutputs + 1) = convDiff;
+}
diff --git a/system/embdrv/encoder_for_aptx/src/QuantiseDifference.c b/system/embdrv/encoder_for_aptx/src/QuantiseDifference.c
new file mode 100644
index 0000000..5f6c865
--- /dev/null
+++ b/system/embdrv/encoder_for_aptx/src/QuantiseDifference.c
@@ -0,0 +1,771 @@
+/**
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#include "AptxParameters.h"
+#include "AptxTables.h"
+#include "Quantiser.h"
+
+XBT_INLINE_ int32_t BsearchLL(const int32_t absDiffSignalShifted,
+                              const int32_t delta,
+                              const int32_t* dqbitTablePrt) {
+  int32_t qCode;
+  reg64_t tmp_acc;
+  int32_t tmp;
+  int32_t lc_delta = delta << 8;
+
+  qCode = 0;
+
+  tmp_acc.s64 = (int64_t)lc_delta * (int64_t)dqbitTablePrt[32];
+  tmp_acc.s32.h -= absDiffSignalShifted;
+  tmp = tmp_acc.s32.h | (tmp_acc.u32.l >> 1);
+  if (tmp <= 0) {
+    qCode = 32;
+  }
+
+  tmp_acc.s64 = (int64_t)lc_delta * (int64_t)dqbitTablePrt[qCode + 16];
+  tmp_acc.s32.h -= absDiffSignalShifted;
+  tmp = tmp_acc.s32.h | (tmp_acc.u32.l >> 1);
+  if (tmp <= 0) {
+    qCode += 16;
+  }
+  tmp_acc.s64 = (int64_t)lc_delta * (int64_t)dqbitTablePrt[qCode + 8];
+  tmp_acc.s32.h -= absDiffSignalShifted;
+  tmp = tmp_acc.s32.h | (tmp_acc.u32.l >> 1);
+  if (tmp <= 0) {
+    qCode += 8;
+  }
+
+  tmp_acc.s64 = (int64_t)lc_delta * (int64_t)dqbitTablePrt[qCode + 4];
+  tmp_acc.s32.h -= absDiffSignalShifted;
+  tmp = tmp_acc.s32.h | (tmp_acc.u32.l >> 1);
+  if (tmp <= 0) {
+    qCode += 4;
+  }
+
+  tmp_acc.s64 = (int64_t)lc_delta * (int64_t)dqbitTablePrt[qCode + 2];
+  tmp_acc.s32.h -= absDiffSignalShifted;
+  tmp = tmp_acc.s32.h | (tmp_acc.u32.l >> 1);
+  if (tmp <= 0) {
+    qCode += 2;
+  }
+
+  tmp_acc.s64 = (int64_t)lc_delta * (int64_t)dqbitTablePrt[qCode + 1];
+  tmp_acc.s32.h -= absDiffSignalShifted;
+  tmp = tmp_acc.s32.h | (tmp_acc.u32.l >> 1);
+  if (tmp <= 0) {
+    qCode++;
+  }
+
+  return (qCode);
+}
+
+XBT_INLINE_ int32_t BsearchHL(const int32_t absDiffSignalShifted,
+                              const int32_t delta) {
+  reg64_t tmp_acc;
+  int32_t lc_delta = delta << 8;
+
+  /* first iteration */
+  tmp_acc.s64 = (int64_t)lc_delta * (int64_t)(97040 << 1);
+  tmp_acc.s32.h -= absDiffSignalShifted;
+  return (tmp_acc.s64 <= 0);
+}
+
+XBT_INLINE_ int32_t BsearchHH(const int32_t absDiffSignalShifted,
+                              const int32_t delta,
+                              const int32_t* dqbitTablePrt) {
+  int32_t qCode;
+  reg64_t tmp_acc;
+  int32_t tmp;
+  int32_t lc_delta = delta << 8;
+  qCode = 0;
+
+  /* first iteration */
+  tmp_acc.s64 = (int64_t)lc_delta * (int64_t)dqbitTablePrt[2];
+  tmp_acc.s32.h -= absDiffSignalShifted;
+  tmp = tmp_acc.s32.h | (tmp_acc.u32.l >> 1);
+  if (tmp <= 0) {
+    qCode += 2;
+  }
+  tmp_acc.s64 = (int64_t)lc_delta * (int64_t)dqbitTablePrt[qCode + 1];
+  tmp_acc.s32.h -= absDiffSignalShifted;
+  tmp = tmp_acc.s32.h | (tmp_acc.u32.l >> 1);
+  if (tmp <= 0) {
+    qCode++;
+  }
+
+  return (qCode);
+}
+
+XBT_INLINE_ int32_t BsearchLH(const int32_t absDiffSignalShifted,
+                              const int32_t delta,
+                              const int32_t* dqbitTablePrt) {
+  int32_t qCode;
+  reg64_t tmp_acc;
+  int32_t tmp;
+  int32_t lc_delta = delta << 8;
+
+  /* first iteration */
+  qCode = 0;
+
+  tmp_acc.s64 = (int64_t)lc_delta * (int64_t)dqbitTablePrt[4];
+  tmp_acc.s32.h -= absDiffSignalShifted;
+  tmp = tmp_acc.s32.h | (tmp_acc.u32.l >> 1);
+  if (tmp <= 0) {
+    qCode = 4;
+  }
+
+  tmp_acc.s64 = (int64_t)lc_delta * (int64_t)dqbitTablePrt[qCode + 2];
+  tmp_acc.s32.h -= absDiffSignalShifted;
+  tmp = tmp_acc.s32.h | (tmp_acc.u32.l >> 1);
+  if (tmp <= 0) {
+    qCode += 2;
+  }
+  tmp_acc.s64 = (int64_t)lc_delta * (int64_t)dqbitTablePrt[qCode + 1];
+  tmp_acc.s32.h -= absDiffSignalShifted;
+  tmp = tmp_acc.s32.h | (tmp_acc.u32.l >> 1);
+  if (tmp <= 0) {
+    qCode++;
+  }
+
+  return (qCode);
+}
+
+void quantiseDifferenceHL(const int32_t diffSignal, const int32_t ditherVal,
+                          const int32_t delta, Quantiser_data* qdata_pt) {
+  int32_t absDiffSignal;
+  int32_t absDiffSignalShifted;
+  int32_t index;
+  int32_t dithSquared;
+  int32_t minusLambdaD;
+  int32_t acc;
+  int32_t threshDiff;
+  reg64_t tmp_acc;
+  reg64_t tmp_reg64;
+  int32_t tmp_accL;
+  int32_t tmp_qCode;
+  int32_t tmp_altQcode;
+  uint32_t tmp_round0;
+  int32_t _delta;
+
+  /* Form the absolute value of the difference signal and maintain a version
+   * that is right-shifted 4 places for delta scaling. */
+  absDiffSignal = -diffSignal;
+  if (diffSignal >= 0) {
+    absDiffSignal = diffSignal;
+  }
+  absDiffSignal = ssat24(absDiffSignal);
+  absDiffSignalShifted = absDiffSignal >> deltaScale;
+  absDiffSignalShifted = ssat24(absDiffSignalShifted);
+
+  /* Binary search for the quantised code. This search terminates with the
+   * table index of the LARGEST threshold table value for which
+   * absDiffSignalShifted >= (delta * threshold)
+   */
+  index = BsearchHL(absDiffSignalShifted, delta);
+
+  /* We actually wanted the SMALLEST magnitude quantised code for which
+   * absDiffSignalShifted < (delta * threshold)
+   * i.e. the code with the next highest magnitude than the one we actually
+   * found. We could add +1 to the code magnitude to do this, but we need to
+   * subtract 1 from the code magnitude to compensate for the "phantom
+   * element" at the base of the quantisation table. These two effects cancel
+   * out, so we leave the value of code alone. However, we need to form code+1
+   * to get the proper index into the both the threshold and dither tables,
+   * since we must skip over the phantom element at the base. */
+  qdata_pt->qCode = index;
+
+  /* Square the dither and get the value back from the ALU
+   * (saturated/rounded). */
+  tmp_acc.s64 = ((int64_t)ditherVal * (int64_t)ditherVal);
+
+  acc = tmp_acc.s32.h;
+
+  tmp_round0 = (uint32_t)acc << 8;
+
+  acc = (acc >> 6) + 1;
+  acc >>= 1;
+  if (tmp_round0 == 0x40000000L) {
+    acc--;
+  }
+
+  acc = ssat24(acc);
+
+  dithSquared = acc;
+
+  /* Form the negative difference of the dither values at index and index-1.
+   * Load the accumulator with this value divided by 2. Ensure saturation is
+   * applied to the difference calculation. */
+  minusLambdaD = qdata_pt->minusLambdaDTable[index];
+
+  tmp_accL = (1 << 23) - dithSquared;
+  tmp_acc.s64 = (int64_t)tmp_accL * minusLambdaD;
+
+  tmp_round0 = tmp_acc.s32.l << 8;
+
+  acc = (tmp_acc.u32.l >> 22) | (tmp_acc.s32.h << 10);
+  acc++;
+  acc >>= 1;
+  if (tmp_round0 == 0x40000000L) {
+    acc--;
+  }
+
+  // worst case value for acc = 0x000d3e08
+  // no saturation required
+
+  /* Add the threshold table values at index and index-1 to the accumulated
+   * value. */
+  acc += qdata_pt->thresholdTablePtr_sl1[index + 1] >> 1;
+  //// worst case value for acc = 0x000d3e08 + 0x43E1DB = 511FE3
+  acc += qdata_pt->thresholdTablePtr_sl1[index] >> 1;
+  //// worst case value for acc = 0x511FE3 + 0x362FEC = 874FCF
+
+  /* Form the threshold table difference at index and index-1. Ensure
+   * saturation is applied to the difference calculation. */
+  threshDiff = qdata_pt->thresholdTablePtr_sl1[index + 1] -
+               qdata_pt->thresholdTablePtr_sl1[index];
+
+  /* Based on the sign of the difference signal, either add or subtract the
+   * threshold table difference from the accumulated value. Recover the final
+   * accumulated value (saturated/rounded) */
+  if (diffSignal < 0) {
+    threshDiff = -threshDiff;
+  }
+  tmp_reg64.s64 = ((int64_t)ditherVal * (int64_t)threshDiff);
+
+  tmp_reg64.s32.h += acc;
+  acc = tmp_reg64.s32.h;
+
+  if (tmp_reg64.u32.l >= 0x80000000) {
+    acc++;
+  }
+  tmp_round0 = (tmp_reg64.u32.l >> 1) | (tmp_reg64.s32.h << 31);
+
+  acc = ssat24(acc);
+
+  if (tmp_round0 == 0x40000000L) {
+    acc--;
+  }
+  _delta = -delta << 8;
+
+  acc = (int32_t)((uint32_t)acc << 4);
+
+  /* Form (absDiffSignal * 0.125) - (acc * delta), which is the final distance
+   * signal used to determine if dithering alters the quantised code value or
+   * not. */
+  // worst case value for delta is 0x7d400
+  tmp_reg64.s64 = ((int64_t)acc * (int64_t)_delta);
+  tmp_reg64.s32.h += absDiffSignal;
+  tmp_round0 = (tmp_reg64.u32.l >> 4) | (tmp_reg64.s32.h << 28);
+  acc = tmp_reg64.s32.h + (1 << 2);
+  acc >>= 3;
+  if (tmp_round0 == 0x40000000L) {
+    acc--;
+  }
+
+  tmp_qCode = qdata_pt->qCode;
+  tmp_altQcode = tmp_qCode - 1;
+  /* Check the sign of the distance penalty. Get the sign from the
+   * full-precision accumulator, as done in the Kalimba code. */
+  if (tmp_reg64.s32.h < 0) {
+    /* The distance is -ve. The optimum code needs decremented by 1 and the
+     * alternative code is 1 greater than this. Get the rounded version of the
+     * -ve distance penalty and negate this (form distance magnitude) before
+     *  writing the value out */
+    tmp_qCode = tmp_altQcode;
+    tmp_altQcode++;
+    acc = -acc;
+  }
+
+  qdata_pt->distPenalty = acc;
+  /* If the difference signal is negative, bitwise invert the code (restores
+   * sign to the magnitude). */
+  if (diffSignal < 0) {
+    tmp_qCode = ~tmp_qCode;
+    tmp_altQcode = ~tmp_altQcode;
+  }
+  qdata_pt->altQcode = tmp_altQcode;
+  qdata_pt->qCode = tmp_qCode;
+}
+
+void quantiseDifferenceHH(const int32_t diffSignal, const int32_t ditherVal,
+                          const int32_t delta, Quantiser_data* qdata_pt) {
+  int32_t absDiffSignal;
+  int32_t absDiffSignalShifted;
+  int32_t index;
+  int32_t dithSquared;
+  int32_t minusLambdaD;
+  int32_t acc;
+  int32_t threshDiff;
+  reg64_t tmp_acc;
+  reg64_t tmp_reg64;
+  int32_t tmp_accL;
+  int32_t tmp_qCode;
+  int32_t tmp_altQcode;
+  uint32_t tmp_round0;
+  int32_t _delta;
+
+  /* Form the absolute value of the difference signal and maintain a version
+   * that is right-shifted 4 places for delta scaling. */
+  absDiffSignal = -diffSignal;
+  if (diffSignal >= 0) {
+    absDiffSignal = diffSignal;
+  }
+  absDiffSignal = ssat24(absDiffSignal);
+  absDiffSignalShifted = absDiffSignal >> deltaScale;
+  absDiffSignalShifted = ssat24(absDiffSignalShifted);
+
+  /* Binary search for the quantised code. This search terminates with the
+   * table index of the LARGEST threshold table value for which
+   * absDiffSignalShifted >= (delta * threshold)
+   */
+  index =
+      BsearchHH(absDiffSignalShifted, delta, qdata_pt->thresholdTablePtr_sl1);
+
+  /* We actually wanted the SMALLEST magnitude quantised code for which
+   * absDiffSignalShifted < (delta * threshold)
+   * i.e. the code with the next highest magnitude than the one we actually
+   * found. We could add +1 to the code magnitude to do this, but we need to
+   * subtract 1 from the code magnitude to compensate for the "phantom
+   * element" at the base of the quantisation table. These two effects cancel
+   * out, so we leave the value of code alone. However, we need to form code+1
+   * to get the proper index into the both the threshold and dither tables,
+   * since we must skip over the phantom element at the base. */
+  qdata_pt->qCode = index;
+
+  /* Square the dither and get the value back from the ALU
+   * (saturated/rounded). */
+  tmp_acc.s64 = ((int64_t)ditherVal * (int64_t)ditherVal);
+
+  acc = tmp_acc.s32.h;
+
+  tmp_round0 = (uint32_t)acc << 8;
+
+  acc = (acc >> 6) + 1;
+  acc >>= 1;
+  if (tmp_round0 == 0x40000000L) {
+    acc--;
+  }
+
+  acc = ssat24(acc);
+
+  dithSquared = acc;
+
+  /* Form the negative difference of the dither values at index and index-1.
+   * Load the accumulator with this value divided by 2. Ensure saturation is
+   * applied to the difference calculation. */
+  minusLambdaD = qdata_pt->minusLambdaDTable[index];
+
+  tmp_accL = (1 << 23) - dithSquared;
+  tmp_acc.s64 = (int64_t)tmp_accL * minusLambdaD;
+
+  tmp_round0 = tmp_acc.s32.l << 8;
+
+  acc = (tmp_acc.u32.l >> 22) | (tmp_acc.s32.h << 10);
+  acc++;
+  acc >>= 1;
+  if (tmp_round0 == 0x40000000L) {
+    acc--;
+  }
+
+  // worst case value for acc = 0x000d3e08
+  // no saturation required
+
+  /* Add the threshold table values at index and index-1 to the accumulated
+   * value. */
+  acc += qdata_pt->thresholdTablePtr_sl1[index + 1] >> 1;
+  //// worst case value for acc = 0x000d3e08 + 0x43E1DB = 511FE3
+  acc += qdata_pt->thresholdTablePtr_sl1[index] >> 1;
+  //// worst case value for acc = 0x511FE3 + 0x362FEC = 874FCF
+
+  /* Form the threshold table difference at index and index-1. Ensure
+   * saturation is applied to the difference calculation. */
+  threshDiff = qdata_pt->thresholdTablePtr_sl1[index + 1] -
+               qdata_pt->thresholdTablePtr_sl1[index];
+
+  /* Based on the sign of the difference signal, either add or subtract the
+   * threshold table difference from the accumulated value. Recover the final
+   * accumulated value (saturated/rounded) */
+  if (diffSignal < 0) {
+    threshDiff = -threshDiff;
+  }
+  tmp_reg64.s64 = ((int64_t)ditherVal * (int64_t)threshDiff);
+  tmp_reg64.s32.h += acc;
+  acc = tmp_reg64.s32.h;
+
+  if (tmp_reg64.u32.l >= 0x80000000) {
+    acc++;
+  }
+  tmp_round0 = (tmp_reg64.u32.l >> 1) | (tmp_reg64.s32.h << 31);
+
+  acc = ssat24(acc);
+
+  if (tmp_round0 == 0x40000000L) {
+    acc--;
+  }
+  _delta = -delta << 8;
+
+  acc = (int32_t)((uint32_t)acc << 4);
+
+  /* Form (absDiffSignal * 0.125) - (acc * delta), which is the final distance
+   * signal used to determine if dithering alters the quantised code value or
+   * not. */
+  // worst case value for delta is 0x7d400
+  tmp_reg64.s64 = ((int64_t)acc * (int64_t)_delta);
+  tmp_reg64.s32.h += absDiffSignal;
+  tmp_round0 = (tmp_reg64.u32.l >> 4) | (tmp_reg64.s32.h << 28);
+  acc = tmp_reg64.s32.h + (1 << 2);
+  acc >>= 3;
+  if (tmp_round0 == 0x40000000L) {
+    acc--;
+  }
+
+  tmp_qCode = qdata_pt->qCode;
+  tmp_altQcode = tmp_qCode - 1;
+  /* Check the sign of the distance penalty. Get the sign from the
+   * full-precision accumulator, as done in the Kalimba code. */
+  if (tmp_reg64.s32.h < 0) {
+    /* The distance is -ve. The optimum code needs decremented by 1 and the
+     * alternative code is 1 greater than this. Get the rounded version of the
+     * -ve distance penalty and negate this (form distance magnitude) before
+     *  writing the value out */
+    tmp_qCode = tmp_altQcode;
+    tmp_altQcode++;
+    acc = -acc;
+  }
+
+  qdata_pt->distPenalty = acc;
+  /* If the difference signal is negative, bitwise invert the code (restores
+   * sign to the magnitude). */
+  if (diffSignal < 0) {
+    tmp_qCode = ~tmp_qCode;
+    tmp_altQcode = ~tmp_altQcode;
+  }
+  qdata_pt->altQcode = tmp_altQcode;
+  qdata_pt->qCode = tmp_qCode;
+}
+
+void quantiseDifferenceLL(const int32_t diffSignal, const int32_t ditherVal,
+                          const int32_t delta, Quantiser_data* qdata_pt) {
+  int32_t absDiffSignal;
+  int32_t absDiffSignalShifted;
+  int32_t index;
+  int32_t dithSquared;
+  int32_t minusLambdaD;
+  int32_t acc;
+  int32_t threshDiff;
+  reg64_t tmp_acc;
+  reg64_t tmp_reg64;
+  int32_t tmp_accL;
+  int32_t tmp_qCode;
+  int32_t tmp_altQcode;
+  uint32_t tmp_round0;
+  int32_t _delta;
+
+  /* Form the absolute value of the difference signal and maintain a version
+   * that is right-shifted 4 places for delta scaling. */
+  absDiffSignal = -diffSignal;
+  if (diffSignal >= 0) {
+    absDiffSignal = diffSignal;
+  }
+  absDiffSignal = ssat24(absDiffSignal);
+  absDiffSignalShifted = absDiffSignal >> deltaScale;
+
+  /* Binary search for the quantised code. This search terminates with the
+   * table index of the LARGEST threshold table value for which
+   * absDiffSignalShifted >= (delta * threshold)
+   */
+  index =
+      BsearchLL(absDiffSignalShifted, delta, qdata_pt->thresholdTablePtr_sl1);
+
+  /* We actually wanted the SMALLEST magnitude quantised code for which
+   * absDiffSignalShifted < (delta * threshold)
+   * i.e. the code with the next highest magnitude than the one we actually
+   * found. We could add +1 to the code magnitude to do this, but we need to
+   * subtract 1 from the code magnitude to compensate for the "phantom
+   * element" at the base of the quantisation table. These two effects cancel
+   * out, so we leave the value of code alone. However, we need to form code+1
+   * to get the proper index into the both the threshold and dither tables,
+   * since we must skip over the phantom element at the base. */
+  qdata_pt->qCode = index;
+
+  /* Square the dither and get the value back from the ALU
+   * (saturated/rounded). */
+  tmp_acc.s64 = ((int64_t)ditherVal * (int64_t)ditherVal);
+
+  acc = tmp_acc.s32.h;
+
+  tmp_round0 = (uint32_t)acc << 8;
+
+  acc = (acc >> 6) + 1;
+  acc >>= 1;
+  if (tmp_round0 == 0x40000000L) {
+    acc--;
+  }
+
+  acc = ssat24(acc);
+
+  dithSquared = acc;
+
+  /* Form the negative difference of the dither values at index and index-1.
+   * Load the accumulator with this value divided by 2. Ensure saturation is
+   * applied to the difference calculation. */
+  minusLambdaD = qdata_pt->minusLambdaDTable[index];
+
+  tmp_accL = (1 << 23) - dithSquared;
+  tmp_acc.s64 = (int64_t)tmp_accL * minusLambdaD;
+
+  tmp_round0 = tmp_acc.s32.l << 8;
+
+  tmp_acc.s64 >>= 22;
+  acc = tmp_acc.s32.l;
+  acc++;
+  acc >>= 1;
+  if (tmp_round0 == 0x40000000L) {
+    acc--;
+  }
+
+  // worst case value for acc = 0x000d3e08
+  // no saturation required
+
+  /* Add the threshold table values at index and index-1 to the accumulated
+   * value. */
+  acc += qdata_pt->thresholdTablePtr_sl1[index + 1] >> 1;
+  //// worst case value for acc = 0x000d3e08 + 0x43E1DB = 511FE3
+  acc += qdata_pt->thresholdTablePtr_sl1[index] >> 1;
+  //// worst case value for acc = 0x511FE3 + 0x362FEC = 874FCF
+
+  /* Form the threshold table difference at index and index-1. Ensure
+   * saturation is applied to the difference calculation. */
+  threshDiff = qdata_pt->thresholdTablePtr_sl1[index + 1] -
+               qdata_pt->thresholdTablePtr_sl1[index];
+
+  /* Based on the sign of the difference signal, either add or subtract the
+   * threshold table difference from the accumulated value. Recover the final
+   * accumulated value (saturated/rounded) */
+  if (diffSignal < 0) {
+    threshDiff = -threshDiff;
+  }
+  tmp_reg64.s64 = ((int64_t)ditherVal * (int64_t)threshDiff);
+  tmp_reg64.s32.h += acc;
+  acc = tmp_reg64.s32.h;
+
+  if (tmp_reg64.u32.l >= 0x80000000) {
+    acc++;
+  }
+  tmp_round0 = (tmp_reg64.u32.l >> 1) | (tmp_reg64.s32.h << 31);
+
+  acc = ssat24(acc);
+
+  if (tmp_round0 == 0x40000000L) {
+    acc--;
+  }
+  _delta = -delta << 8;
+
+  acc = (int32_t)((uint32_t)acc << 4);
+
+  /* Form (absDiffSignal * 0.125) - (acc * delta), which is the final distance
+   * signal used to determine if dithering alters the quantised code value or
+   * not. */
+  // worst case value for delta is 0x7d400
+
+  tmp_reg64.s64 = ((int64_t)acc * (int64_t)_delta);
+  tmp_reg64.s32.h += absDiffSignal;
+  tmp_round0 = (tmp_reg64.u32.l >> 4) | (tmp_reg64.s32.h << 28);
+  acc = tmp_reg64.s32.h + (1 << 2);
+  acc >>= 3;
+  if (tmp_round0 == 0x40000000L) {
+    acc--;
+  }
+
+  tmp_qCode = qdata_pt->qCode;
+  tmp_altQcode = tmp_qCode - 1;
+  /* Check the sign of the distance penalty. Get the sign from the
+   * full-precision accumulator, as done in the Kalimba code. */
+  if (tmp_reg64.s32.h < 0) {
+    /* The distance is -ve. The optimum code needs decremented by 1 and the
+     * alternative code is 1 greater than this. Get the rounded version of the
+     * -ve distance penalty and negate this (form distance magnitude) before
+     *  writing the value out */
+    tmp_qCode = tmp_altQcode;
+    tmp_altQcode++;
+    acc = -acc;
+  }
+
+  qdata_pt->distPenalty = acc;
+  /* If the difference signal is negative, bitwise invert the code (restores
+   * sign to the magnitude). */
+  if (diffSignal < 0) {
+    tmp_qCode = ~tmp_qCode;
+    tmp_altQcode = ~tmp_altQcode;
+  }
+  qdata_pt->altQcode = tmp_altQcode;
+  qdata_pt->qCode = tmp_qCode;
+}
+
+void quantiseDifferenceLH(const int32_t diffSignal, const int32_t ditherVal,
+                          const int32_t delta, Quantiser_data* qdata_pt) {
+  int32_t absDiffSignal;
+  int32_t absDiffSignalShifted;
+  int32_t index;
+  int32_t dithSquared;
+  int32_t minusLambdaD;
+  int32_t acc;
+  int32_t threshDiff;
+  reg64_t tmp_acc;
+  reg64_t tmp_reg64;
+  int32_t tmp_accL;
+  int32_t tmp_qCode;
+  int32_t tmp_altQcode;
+  uint32_t tmp_round0;
+  int32_t _delta;
+
+  /* Form the absolute value of the difference signal and maintain a version
+   * that is right-shifted 4 places for delta scaling. */
+  absDiffSignal = -diffSignal;
+  if (diffSignal >= 0) {
+    absDiffSignal = diffSignal;
+  }
+  absDiffSignal = ssat24(absDiffSignal);
+  absDiffSignalShifted = absDiffSignal >> deltaScale;
+
+  /* Binary search for the quantised code. This search terminates with the
+   * table index of the LARGEST threshold table value for which
+   * absDiffSignalShifted >= (delta * threshold)
+   */
+  index =
+      BsearchLH(absDiffSignalShifted, delta, qdata_pt->thresholdTablePtr_sl1);
+
+  /* We actually wanted the SMALLEST magnitude quantised code for which
+   * absDiffSignalShifted < (delta * threshold)
+   * i.e. the code with the next highest magnitude than the one we actually
+   * found. We could add +1 to the code magnitude to do this, but we need to
+   * subtract 1 from the code magnitude to compensate for the "phantom
+   * element" at the base of the quantisation table. These two effects cancel
+   * out, so we leave the value of code alone. However, we need to form code+1
+   * to get the proper index into the both the threshold and dither tables,
+   * since we must skip over the phantom element at the base. */
+  qdata_pt->qCode = index;
+
+  /* Square the dither and get the value back from the ALU
+   * (saturated/rounded). */
+  tmp_reg64.s64 = ((int64_t)ditherVal * (int64_t)ditherVal);
+
+  acc = tmp_reg64.s32.h;
+
+  tmp_round0 = (uint32_t)acc << 8;
+
+  acc = (acc >> 6) + 1;
+  acc >>= 1;
+  if (tmp_round0 == 0x40000000L) {
+    acc--;
+  }
+
+  acc = ssat24(acc);
+
+  dithSquared = acc;
+
+  /* Form the negative difference of the dither values at index and index-1.
+   * Load the accumulator with this value divided by 2. Ensure saturation is
+   * applied to the difference calculation. */
+  minusLambdaD = qdata_pt->minusLambdaDTable[index];
+
+  tmp_accL = (1 << 23) - dithSquared;
+  tmp_acc.s64 = (int64_t)tmp_accL * minusLambdaD;
+
+  tmp_round0 = tmp_acc.s32.l << 8;
+
+  acc = (tmp_acc.u32.l >> 22) | (tmp_acc.s32.h << 10);
+  if (tmp_round0 == 0x40000000L) {
+    acc -= 2;
+  }
+  acc++;
+
+  // worst case value for acc = 0x000d3e08
+  // no saturation required
+  /* Add the threshold table values at index and index-1 to the accumulated
+   * value. */
+  acc += qdata_pt->thresholdTablePtr_sl1[index + 1];
+  //// worst case value for acc = 0x000d3e08 + 0x43E1DB = 511FE3
+  acc += qdata_pt->thresholdTablePtr_sl1[index];
+  acc >>= 1;
+
+  /* Form the threshold table difference at index and index-1. Ensure
+   * saturation is applied to the difference calculation. */
+  threshDiff = qdata_pt->thresholdTablePtr_sl1[index + 1] -
+               qdata_pt->thresholdTablePtr_sl1[index];
+
+  /* Based on the sign of the difference signal, either add or subtract the
+   * threshold table difference from the accumulated value. Recover the final
+   * accumulated value (saturated/rounded) */
+  if (diffSignal < 0) {
+    threshDiff = -threshDiff;
+  }
+  tmp_reg64.s64 = ((int64_t)ditherVal * (int64_t)threshDiff);
+
+  tmp_reg64.s32.h += acc;
+  acc = tmp_reg64.s32.h;
+
+  if (tmp_reg64.u32.l >= 0x80000000) {
+    acc++;
+  }
+  tmp_round0 = (tmp_reg64.u32.l >> 1) | (tmp_reg64.s32.h << 31);
+
+  acc = ssat24(acc);
+
+  if (tmp_round0 == 0x40000000L) {
+    acc--;
+  }
+  _delta = -delta << 8;
+
+  acc = (int32_t)((uint32_t)acc << 4);
+
+  /* Form (absDiffSignal * 0.125) - (acc * delta), which is the final distance
+   * signal used to determine if dithering alters the quantised code value or
+   * not. */
+  // worst case value for delta is 0x7d400
+  tmp_reg64.s64 = ((int64_t)acc * (int64_t)_delta);
+  tmp_reg64.s32.h += absDiffSignal;
+  tmp_round0 = (tmp_reg64.u32.l >> 4) | (tmp_reg64.s32.h << 28);
+  acc = tmp_reg64.s32.h + (1 << 2);
+  acc >>= 3;
+  if (tmp_round0 == 0x40000000L) {
+    acc--;
+  }
+
+  tmp_qCode = qdata_pt->qCode;
+  tmp_altQcode = tmp_qCode - 1;
+  /* Check the sign of the distance penalty. Get the sign from the
+   * full-precision accumulator, as done in the Kalimba code. */
+
+  if (tmp_reg64.s32.h < 0) {
+    /* The distance is -ve. The optimum code needs decremented by 1 and the
+     * alternative code is 1 greater than this. Get the rounded version of the
+     * -ve distance penalty and negate this (form distance magnitude) before
+     *  writing the value out */
+    tmp_qCode = tmp_altQcode;
+    tmp_altQcode++;
+    acc = -acc;
+  }
+
+  qdata_pt->distPenalty = acc;
+  /* If the difference signal is negative, bitwise invert the code (restores
+   * sign to the magnitude). */
+  if (diffSignal < 0) {
+    tmp_qCode = ~tmp_qCode;
+    tmp_altQcode = ~tmp_altQcode;
+  }
+  qdata_pt->altQcode = tmp_altQcode;
+  qdata_pt->qCode = tmp_qCode;
+}
diff --git a/system/embdrv/encoder_for_aptx/src/Quantiser.h b/system/embdrv/encoder_for_aptx/src/Quantiser.h
new file mode 100644
index 0000000..16f0416
--- /dev/null
+++ b/system/embdrv/encoder_for_aptx/src/Quantiser.h
@@ -0,0 +1,43 @@
+/**
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/*------------------------------------------------------------------------------
+ *
+ *  Function to calculate a quantised representation of an input
+ *  difference signal, based on additional dither values and step-size inputs.
+ *
+ *-----------------------------------------------------------------------------*/
+
+#ifndef QUANTISER_H
+#define QUANTISER_H
+#ifdef _GCC
+#pragma GCC visibility push(hidden)
+#endif
+
+#include "AptxParameters.h"
+
+void quantiseDifferenceLL(const int32_t diffSignal, const int32_t ditherVal,
+                          const int32_t delta, Quantiser_data* qdata_pt);
+void quantiseDifferenceHL(const int32_t diffSignal, const int32_t ditherVal,
+                          const int32_t delta, Quantiser_data* qdata_pt);
+void quantiseDifferenceLH(const int32_t diffSignal, const int32_t ditherVal,
+                          const int32_t delta, Quantiser_data* qdata_pt);
+void quantiseDifferenceHH(const int32_t diffSignal, const int32_t ditherVal,
+                          const int32_t delta, Quantiser_data* qdata_pt);
+
+#ifdef _GCC
+#pragma GCC visibility pop
+#endif
+#endif  // QUANTISER_H
diff --git a/system/embdrv/encoder_for_aptx/src/SubbandFunctions.h b/system/embdrv/encoder_for_aptx/src/SubbandFunctions.h
new file mode 100644
index 0000000..ef5bee8
--- /dev/null
+++ b/system/embdrv/encoder_for_aptx/src/SubbandFunctions.h
@@ -0,0 +1,186 @@
+/**
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/*------------------------------------------------------------------------------
+ *
+ *  Subband processing consists of:
+ *  inverse quantisation (defined in a separate file),
+ *  predictor coefficient update (Pole and Zero Coeff update),
+ *  predictor filtering.
+ *
+ *----------------------------------------------------------------------------*/
+
+#ifndef SUBBANDFUNCTIONS_H
+#define SUBBANDFUNCTIONS_H
+#ifdef _GCC
+#pragma GCC visibility push(hidden)
+#endif
+
+#include "AptxParameters.h"
+
+XBT_INLINE_ void updatePredictorPoleCoefficients(
+    const int32_t invQ, const int32_t prevZfiltOutput,
+    PoleCoeff_data* PoleCoeffDataPt) {
+  int32_t adaptSum;
+  int32_t sgnP[3];
+  int32_t newCoeffs[2];
+  int32_t Bacc;
+  int32_t acc;
+  int32_t acc2;
+  int32_t tmp3_round0;
+  int16_t tmp2_round0;
+  int16_t tmp_round0;
+  /* Various constants in various Q formats */
+  const int32_t oneQ22 = 4194304L;
+  const int32_t minusOneQ22 = -4194304L;
+  const int32_t pointFiveQ21 = 1048576L;
+  const int32_t minusPointFiveQ21 = -1048576L;
+  const int32_t pointSevenFiveQ22 = 3145728L;
+  const int32_t minusPointSevenFiveQ22 = -3145728L;
+  const int32_t oneMinusTwoPowerMinusFourQ22 = 3932160L;
+
+  /* Symbolic indices for the pole coefficient arrays. Here we are using a1
+   * to represent the first pole filter coefficient and a2 the second. This
+   * seems to be common ADPCM terminology. */
+  enum { a1 = 0, a2 = 1 };
+
+  /* Symbolic indices for the sgn array (k, k-1 and k-2 respectively) */
+  enum { k = 0, k_1 = 1, k_2 = 2 };
+
+  /* Form the sum of the inverse quantiser and previous zero filter values */
+  adaptSum = invQ + prevZfiltOutput;
+  adaptSum = ssat24(adaptSum);
+
+  /* Form the sgn of the sum just formed (note +1 and -1 are Q22) */
+  if (adaptSum < 0L) {
+    sgnP[k] = minusOneQ22;
+    sgnP[k_1] = -(((int32_t)PoleCoeffDataPt->m_poleAdaptDelayLine.s16.l) << 22);
+    sgnP[k_2] = -(((int32_t)PoleCoeffDataPt->m_poleAdaptDelayLine.s16.h) << 22);
+    PoleCoeffDataPt->m_poleAdaptDelayLine.s16.h =
+        PoleCoeffDataPt->m_poleAdaptDelayLine.s16.l;
+    PoleCoeffDataPt->m_poleAdaptDelayLine.s16.l = -1;
+  } else if (adaptSum == 0L) {
+    sgnP[k] = 0L;
+    sgnP[k_1] = 0L;
+    sgnP[k_2] = 0L;
+    PoleCoeffDataPt->m_poleAdaptDelayLine.s16.h =
+        PoleCoeffDataPt->m_poleAdaptDelayLine.s16.l;
+    PoleCoeffDataPt->m_poleAdaptDelayLine.s16.l = 1;
+  } else {  // adaptSum > 0L
+    sgnP[k] = oneQ22;
+    sgnP[k_1] = ((int32_t)PoleCoeffDataPt->m_poleAdaptDelayLine.s16.l) << 22;
+    sgnP[k_2] = ((int32_t)PoleCoeffDataPt->m_poleAdaptDelayLine.s16.h) << 22;
+    PoleCoeffDataPt->m_poleAdaptDelayLine.s16.h =
+        PoleCoeffDataPt->m_poleAdaptDelayLine.s16.l;
+    PoleCoeffDataPt->m_poleAdaptDelayLine.s16.l = 1;
+  }
+
+  /* Clear the accumulator and form -a1(k) * sgn(p(k))sgn(p(k-1)) in Q21. Clip
+   * it to +/- 0.5 (Q21) so that we can take f(a1) = 4 * a1. This is a partial
+   * result for the new a2 */
+  acc = 0;
+  acc -= PoleCoeffDataPt->m_poleCoeff[a1] * (sgnP[k_1] >> 22);
+
+  tmp3_round0 = acc & 0x3L;
+
+  acc += 0x001;
+  acc >>= 1;
+  if (tmp3_round0 == 0x001L) {
+    acc--;
+  }
+
+  newCoeffs[a2] = acc;
+
+  if (newCoeffs[a2] < minusPointFiveQ21) {
+    newCoeffs[a2] = minusPointFiveQ21;
+  }
+  if (newCoeffs[a2] > pointFiveQ21) {
+    newCoeffs[a2] = pointFiveQ21;
+  }
+
+  /* Load the accumulator with sgn(p(k))sgn(p(k-2)) right-shifted by 3. The
+   * 3-position shift is to multiply it by 0.25 and convert from Q22 to Q21.
+   */
+  Bacc = (sgnP[k_2] >> 3);
+  /* Add the current a2 update value to the accumulator (Q21) */
+  Bacc += newCoeffs[a2];
+  /* Shift the accumulator right by 4 positions.
+   * Right 7 places to multiply by 2^(-7)
+   * Left 2 places to scale by 4 (0.25A + B -> A + 4B)
+   * Left 1 place to convert from Q21 to Q22
+   */
+  Bacc >>= 4;
+  /* Add a2(k-1) * (1 - 2^(-7)) to the accumulator. Note that the constant is
+   * expressed as Q23, hence the product is Q22. Get the accumulator value
+   * back out. */
+  acc2 = PoleCoeffDataPt->m_poleCoeff[a2] << 8;
+  acc2 -= PoleCoeffDataPt->m_poleCoeff[a2] << 1;
+  Bacc = (int32_t)((uint32_t)Bacc << 8);
+  Bacc += acc2;
+
+  tmp2_round0 = (int16_t)Bacc & 0x01FFL;
+
+  Bacc += 0x0080L;
+  Bacc >>= 8;
+
+  if (tmp2_round0 == 0x0080L) {
+    Bacc--;
+  }
+
+  newCoeffs[a2] = Bacc;
+
+  /* Clip the new a2(k) value to +/- 0.75 (Q22) */
+  if (newCoeffs[a2] < minusPointSevenFiveQ22) {
+    newCoeffs[a2] = minusPointSevenFiveQ22;
+  }
+  if (newCoeffs[a2] > pointSevenFiveQ22) {
+    newCoeffs[a2] = pointSevenFiveQ22;
+  }
+  PoleCoeffDataPt->m_poleCoeff[a2] = newCoeffs[a2];
+
+  /* Form sgn(p(k))sgn(p(k-1)) * (3 * 2^(-8)). The constant is Q23, hence the
+   * product is Q22. */
+  /* Add a1(k-1) * (1 - 2^(-8)) to the accumulator. The constant is Q23, hence
+   * the product is Q22. Get the value from the accumulator. */
+  acc2 = PoleCoeffDataPt->m_poleCoeff[a1] << 8;
+  acc2 -= PoleCoeffDataPt->m_poleCoeff[a1];
+  acc2 += (sgnP[k_1] << 2);
+  acc2 -= (sgnP[k_1]);
+
+  tmp_round0 = (int16_t)acc2 & 0x01FF;
+
+  acc2 += 0x0080;
+  acc = (acc2 >> 8);
+  if (tmp_round0 == 0x0080) {
+    acc--;
+  }
+
+  newCoeffs[a1] = acc;
+
+  /* Clip the new value of a1(k) to +/- (1 - 2^4 - a2(k)). The constant 1 -
+   * 2^4 is expressed in Q22 format (as is a1 and a2) */
+  if (newCoeffs[a1] < (newCoeffs[a2] - oneMinusTwoPowerMinusFourQ22)) {
+    newCoeffs[a1] = newCoeffs[a2] - oneMinusTwoPowerMinusFourQ22;
+  }
+  if (newCoeffs[a1] > (oneMinusTwoPowerMinusFourQ22 - newCoeffs[a2])) {
+    newCoeffs[a1] = oneMinusTwoPowerMinusFourQ22 - newCoeffs[a2];
+  }
+  PoleCoeffDataPt->m_poleCoeff[a1] = newCoeffs[a1];
+}
+
+#ifdef _GCC
+#pragma GCC visibility pop
+#endif
+#endif  // SUBBANDFUNCTIONS_H
diff --git a/system/embdrv/encoder_for_aptx/src/SubbandFunctionsCommon.h b/system/embdrv/encoder_for_aptx/src/SubbandFunctionsCommon.h
new file mode 100644
index 0000000..cfd16e2
--- /dev/null
+++ b/system/embdrv/encoder_for_aptx/src/SubbandFunctionsCommon.h
@@ -0,0 +1,552 @@
+/**
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/*------------------------------------------------------------------------------
+ *
+ *  Subband processing consists of:
+ *  inverse quantisation (defined in a separate file),
+ *  predictor coefficient update (Pole and Zero Coeff update),
+ *  predictor filtering.
+ *
+ *----------------------------------------------------------------------------*/
+
+#ifndef SUBBANDFUNCTIONSCOMMON_H
+#define SUBBANDFUNCTIONSCOMMON_H
+
+enum reg64_reg { reg64_H = 1, reg64_L = 0 };
+
+void processSubband(const int32_t qCode, const int32_t ditherVal,
+                    Subband_data* SubbandDataPt, IQuantiser_data* iqDataPt);
+void processSubbandLL(const int32_t qCode, const int32_t ditherVal,
+                      Subband_data* SubbandDataPt, IQuantiser_data* iqDataPt);
+void processSubbandHL(const int32_t qCode, const int32_t ditherVal,
+                      Subband_data* SubbandDataPt, IQuantiser_data* iqDataPt);
+
+/* Function to carry out inverse quantisation for LL, LH and HH subband types */
+XBT_INLINE_ void invertQuantisation(const int32_t qCode,
+                                    const int32_t ditherVal,
+                                    IQuantiser_data* iqdata_pt) {
+  int32_t invQ;
+  int32_t index;
+  int32_t acc;
+  reg64_t tmp_r64;
+  int64_t tmp_acc;
+  int32_t tmp_accL;
+  int32_t tmp_accH;
+  uint32_t tmp_round0;
+  uint32_t tmp_round1;
+
+  unsigned u16t;
+  /* log delta leak value (Q23) */
+  const uint32_t logDeltaLeakVal = 0x7F6CL;
+
+  /* Turn the quantised code back into an index into the threshold table. This
+   * involves bitwise inversion of the code (if -ve) and adding 1 (phantom
+   * element at table base). Then set invQ to be +/- the threshold value,
+   * depending on the code sign. */
+  index = qCode;
+  if (qCode < 0) {
+    index = (~index);
+  }
+  index = index + 1;
+  invQ = iqdata_pt->thresholdTablePtr_sl1[index];
+  if (qCode < 0) {
+    invQ = -invQ;
+  }
+
+  /* Load invQ into the accumulator. Add the product of the dither value times
+   * the indexed dither table value. Then get the result back from the
+   * accumulator as an updated invQ. */
+  tmp_r64.s64 = ((int64_t)ditherVal * iqdata_pt->ditherTablePtr_sf1[index]);
+  tmp_r64.s32.h += invQ >> 1;
+
+  acc = tmp_r64.s32.h;
+
+  tmp_round1 = tmp_r64.s32.h & 0x00000001L;
+  if (tmp_r64.u32.l >= 0x80000000) {
+    acc++;
+  }
+  if (tmp_round1 == 0 && tmp_r64.s32.l == (int32_t)0x80000000L) {
+    acc--;
+  }
+  acc = ssat24(acc);
+
+  invQ = acc;
+
+  /* Scale invQ by the current delta value. Left-shift the result (in the
+   * accumulator) by 4 positions for the delta scaling. Get the updated invQ
+   * back from the accumulator. */
+
+  u16t = iqdata_pt->logDelta;
+  tmp_acc = ((int64_t)invQ * iqdata_pt->delta);
+  tmp_accL = u16t * logDeltaLeakVal;
+  tmp_accH = iqdata_pt->incrTablePtr[index];
+  acc = (int32_t)(tmp_acc >> (23 - deltaScale));
+  invQ = ssat24(acc);
+
+  /* Now update the value of logDelta. Load the accumulator with the index
+   * value of the logDelta increment table. Add the product of the current
+   * logDelta scaled by a leaky coefficient (16310 in Q14). Get the value back
+   * from the accumulator. */
+  tmp_accH += tmp_accL >> (32 - 17);
+
+  acc = tmp_accH;
+
+  tmp_r64.u32.l = ((uint32_t)tmp_accL << 17);
+  tmp_r64.s32.h = tmp_accH;
+
+  tmp_round0 = tmp_r64.u32.l;
+  tmp_round1 = (int32_t)(tmp_r64.u64 >> 1);
+  if (tmp_round0 >= 0x80000000L) {
+    acc++;
+  }
+  if (tmp_round1 == 0x40000000L) {
+    acc--;
+  }
+
+  /* Limit the updated logDelta between 0 and its subband-specific maximum. */
+  if (acc < 0) {
+    acc = 0;
+  }
+  if (acc > iqdata_pt->maxLogDelta) {
+    acc = iqdata_pt->maxLogDelta;
+  }
+
+  iqdata_pt->logDelta = (uint16_t)acc;
+
+  /* The updated value of delta is the logTable output (indexed by 5 bits from
+   * the updated logDelta) shifted by a value involving the logDelta minimum
+   * and the updated logDelta itself. */
+  iqdata_pt->delta = iqdata_pt->iquantTableLogPtr[(acc >> 3) & 0x1f] >>
+                     (22 - 25 - iqdata_pt->minLogDelta - (acc >> 8));
+
+  iqdata_pt->invQ = invQ;
+}
+
+/* Function to carry out inverse quantisation for a HL subband type */
+XBT_INLINE_ void invertQuantisationHL(const int32_t qCode,
+                                      const int32_t ditherVal,
+                                      IQuantiser_data* iqdata_pt) {
+  int32_t invQ;
+  int32_t index;
+  int32_t acc;
+  reg64_t tmp_r64;
+  int64_t tmp_acc;
+  int32_t tmp_accL;
+  int32_t tmp_accH;
+  uint32_t tmp_round0;
+  uint32_t tmp_round1;
+
+  unsigned u16t;
+  /* log delta leak value (Q23) */
+  const uint32_t logDeltaLeakVal = 0x7F6CL;
+
+  /* Turn the quantised code back into an index into the threshold table. This
+   * involves bitwise inversion of the code (if -ve) and adding 1 (phantom
+   * element at table base). Then set invQ to be +/- the threshold value,
+   * depending on the code sign. */
+  index = qCode;
+  if (qCode < 0) {
+    index = (~index);
+  }
+  index = index + 1;
+  invQ = iqdata_pt->thresholdTablePtr_sl1[index];
+  if (qCode < 0) {
+    invQ = -invQ;
+  }
+
+  /* Load invQ into the accumulator. Add the product of the dither value times
+   * the indexed dither table value. Then get the result back from the
+   * accumulator as an updated invQ. */
+  tmp_r64.s64 = ((int64_t)ditherVal * iqdata_pt->ditherTablePtr_sf1[index]);
+  tmp_r64.s32.h += invQ >> 1;
+
+  acc = tmp_r64.s32.h;
+
+  tmp_round1 = tmp_r64.s32.h & 0x00000001L;
+  if (tmp_r64.u32.l >= 0x80000000) {
+    acc++;
+  }
+  if (tmp_round1 == 0 && tmp_r64.u32.l == 0x80000000L) {
+    acc--;
+  }
+  acc = ssat24(acc);
+
+  invQ = acc;
+
+  /* Scale invQ by the current delta value. Left-shift the result (in the
+   * accumulator) by 4 positions for the delta scaling. Get the updated invQ
+   * back from the accumulator. */
+  u16t = iqdata_pt->logDelta;
+  tmp_acc = ((int64_t)invQ * iqdata_pt->delta);
+  tmp_accL = u16t * logDeltaLeakVal;
+  tmp_accH = iqdata_pt->incrTablePtr[index];
+  acc = (int32_t)(tmp_acc >> (23 - deltaScale));
+  invQ = acc;
+
+  /* Now update the value of logDelta. Load the accumulator with the index
+   * value of the logDelta increment table. Add the product of the current
+   * logDelta scaled by a leaky coefficient (16310 in Q14). Get the value back
+   * from the accumulator. */
+  tmp_accH += tmp_accL >> (32 - 17);
+
+  acc = tmp_accH;
+
+  tmp_r64.u32.l = ((uint32_t)tmp_accL << 17);
+  tmp_r64.s32.h = tmp_accH;
+
+  tmp_round0 = tmp_r64.u32.l;
+  tmp_round1 = (int32_t)(tmp_r64.u64 >> 1);
+  if (tmp_round0 >= 0x80000000L) {
+    acc++;
+  }
+  if (tmp_round1 == 0x40000000L) {
+    acc--;
+  }
+
+  /* Limit the updated logDelta between 0 and its subband-specific maximum. */
+  if (acc < 0) {
+    acc = 0;
+  }
+  if (acc > iqdata_pt->maxLogDelta) {
+    acc = iqdata_pt->maxLogDelta;
+  }
+
+  iqdata_pt->logDelta = (uint16_t)acc;
+
+  /* The updated value of delta is the logTable output (indexed by 5 bits from
+   * the updated logDelta) shifted by a value involving the logDelta minimum
+   * and the updated logDelta itself. */
+  iqdata_pt->delta = iqdata_pt->iquantTableLogPtr[(acc >> 3) & 0x1f] >>
+                     (22 - 25 - iqdata_pt->minLogDelta - (acc >> 8));
+
+  iqdata_pt->invQ = invQ;
+}
+
+/* Function to carry out prediction ARMA filtering for the current subband
+ * performPredictionFiltering should only be used for HH and LH subband! */
+XBT_INLINE_ void performPredictionFiltering(const int32_t invQ,
+                                            Subband_data* SubbandDataPt) {
+  int32_t poleVal;
+  int32_t acc;
+  int64_t accL;
+  uint32_t pointer;
+  int32_t poleDelayLine;
+  int32_t predVal;
+  int32_t* zeroCoeffPt = SubbandDataPt->m_ZeroCoeffData.m_zeroCoeff;
+  int32_t* poleCoeff = SubbandDataPt->m_PoleCoeffData.m_poleCoeff;
+  int32_t zData0;
+  int32_t* cbuf_pt;
+  int32_t invQincr_pos;
+  int32_t invQincr_neg;
+  int32_t k;
+  int32_t oldZData;
+  /* Pole coefficient and data indices */
+  enum { a1 = 0, a2 = 1 };
+
+  /* Write the newest pole input sample to the pole delay line.
+   * Ensure the sum of the current dequantised error and the previous
+   * predictor output is saturated if necessary. */
+  poleDelayLine = invQ + SubbandDataPt->m_predData.m_predVal;
+
+  poleDelayLine = ssat24(poleDelayLine);
+
+  /* Pole filter convolution. Shift convolution result 1 place to the left
+   * before retrieving it, since the pole coefficients are Q22 (data is Q23)
+   * and we want a Q23 result */
+  accL = ((int64_t)poleCoeff[a2] *
+          (int64_t)SubbandDataPt->m_predData.m_poleDelayLine[a2]);
+  /* Update the pole delay line for the next pass by writing the new input
+   * sample into the 2nd element */
+  SubbandDataPt->m_predData.m_poleDelayLine[a2] = poleDelayLine;
+  accL += ((int64_t)poleCoeff[a1] * (int64_t)poleDelayLine);
+  poleVal = (int32_t)(accL >> 22);
+  poleVal = ssat24(poleVal);
+
+  /* Create (2^(-7)) * sgn(invQ) in Q22 format. */
+  if (invQ == 0) {
+    invQincr_pos = 0L;
+  } else {
+    invQincr_pos = 0x800000;
+  }
+  if (invQ < 0L) {
+    invQincr_pos = -invQincr_pos;
+  }
+
+  invQincr_neg = 0x0080 - invQincr_pos;
+  invQincr_pos += 0x0080;
+
+  pointer = (SubbandDataPt->m_predData.m_zeroDelayLine.pointer++) + 12;
+  cbuf_pt = &SubbandDataPt->m_predData.m_zeroDelayLine.buffer[pointer];
+  /* partial manual unrolling to improve performance */
+  if (SubbandDataPt->m_predData.m_zeroDelayLine.pointer >= 12) {
+    SubbandDataPt->m_predData.m_zeroDelayLine.pointer = 0;
+  }
+
+  SubbandDataPt->m_predData.m_zeroDelayLine.modulo = invQ;
+
+  /* Iterate over the number of coefficients for this subband */
+  oldZData = invQ;
+  accL = 0;
+  for (k = 0; k < 12; k++) {
+    uint32_t tmp_round0;
+    int32_t coeffValue;
+
+    zData0 = (*(cbuf_pt--));
+    coeffValue = *(zeroCoeffPt + k);
+    if (zData0 < 0L) {
+      acc = invQincr_neg - coeffValue;
+    } else {
+      acc = invQincr_pos - coeffValue;
+    }
+    tmp_round0 = acc;
+    acc = (acc >> 8) + coeffValue;
+    if (((tmp_round0 << 23) ^ 0x80000000) == 0) {
+      acc--;
+    }
+    accL += (int64_t)acc * (int64_t)(oldZData);
+    oldZData = zData0;
+    *(zeroCoeffPt + k) = acc;
+  }
+
+  acc = (int32_t)(accL >> 22);
+  acc = ssat24(acc);
+  /* Predictor output is the sum of the pole and zero filter outputs. Ensure
+   * this is saturated, if necessary. */
+  predVal = acc + poleVal;
+  predVal = ssat24(predVal);
+  SubbandDataPt->m_predData.m_zeroVal = acc;
+  SubbandDataPt->m_predData.m_predVal = predVal;
+
+  /* Update the zero filter delay line by writing the new input sample to the
+   * circular buffer. */
+  SubbandDataPt->m_predData.m_zeroDelayLine
+      .buffer[SubbandDataPt->m_predData.m_zeroDelayLine.pointer] =
+      SubbandDataPt->m_predData.m_zeroDelayLine.modulo;
+  SubbandDataPt->m_predData.m_zeroDelayLine
+      .buffer[SubbandDataPt->m_predData.m_zeroDelayLine.pointer + 12] =
+      SubbandDataPt->m_predData.m_zeroDelayLine.modulo;
+}
+
+XBT_INLINE_ void performPredictionFilteringLL(const int32_t invQ,
+                                              Subband_data* SubbandDataPt) {
+  int32_t poleVal;
+  int32_t acc;
+  int64_t accL;
+  uint32_t pointer;
+  int32_t poleDelayLine;
+  int32_t predVal;
+  int32_t* zeroCoeffPt = SubbandDataPt->m_ZeroCoeffData.m_zeroCoeff;
+  int32_t* poleCoeff = SubbandDataPt->m_PoleCoeffData.m_poleCoeff;
+  int32_t* cbuf_pt;
+  int32_t invQincr_pos;
+  int32_t invQincr_neg;
+  int32_t k;
+  int32_t oldZData;
+  /* Pole coefficient and data indices */
+  enum { a1 = 0, a2 = 1 };
+
+  /* Write the newest pole input sample to the pole delay line.
+   * Ensure the sum of the current dequantised error and the previous
+   * predictor output is saturated if necessary. */
+  poleDelayLine = invQ + SubbandDataPt->m_predData.m_predVal;
+
+  poleDelayLine = ssat24(poleDelayLine);
+
+  /* Pole filter convolution. Shift convolution result 1 place to the left
+   * before retrieving it, since the pole coefficients are Q22 (data is Q23)
+   * and we want a Q23 result */
+  accL = ((int64_t)poleCoeff[a2] *
+          (int64_t)SubbandDataPt->m_predData.m_poleDelayLine[a2]);
+  /* Update the pole delay line for the next pass by writing the new input
+   * sample into the 2nd element */
+  SubbandDataPt->m_predData.m_poleDelayLine[a2] = poleDelayLine;
+  accL += ((int64_t)poleCoeff[a1] * (int64_t)poleDelayLine);
+  poleVal = (int32_t)(accL >> 22);
+  poleVal = ssat24(poleVal);
+  // store poleVal to free one register.
+  SubbandDataPt->m_predData.m_predVal = poleVal;
+
+  /* Create (2^(-7)) * sgn(invQ) in Q22 format. */
+  if (invQ == 0) {
+    invQincr_pos = 0L;
+  } else {
+    invQincr_pos = 0x800000;
+  }
+  if (invQ < 0L) {
+    invQincr_pos = -invQincr_pos;
+  }
+
+  invQincr_neg = 0x0080 - invQincr_pos;
+  invQincr_pos += 0x0080;
+
+  pointer = (SubbandDataPt->m_predData.m_zeroDelayLine.pointer++) + 24;
+  cbuf_pt = &SubbandDataPt->m_predData.m_zeroDelayLine.buffer[pointer];
+  /* partial manual unrolling to improve performance */
+  if (SubbandDataPt->m_predData.m_zeroDelayLine.pointer >= 24) {
+    SubbandDataPt->m_predData.m_zeroDelayLine.pointer = 0;
+  }
+
+  SubbandDataPt->m_predData.m_zeroDelayLine.modulo = invQ;
+
+  /* Iterate over the number of coefficients for this subband */
+
+  oldZData = invQ;
+  accL = 0;
+  for (k = 0; k < 24; k++) {
+    int32_t zData0;
+    int32_t coeffValue;
+
+    zData0 = (*(cbuf_pt--));
+    coeffValue = *(zeroCoeffPt + k);
+    if (zData0 < 0L) {
+      acc = invQincr_neg - coeffValue;
+    } else {
+      acc = invQincr_pos - coeffValue;
+    }
+    if (((acc << 23) ^ 0x80000000) == 0) {
+      coeffValue--;
+    }
+    acc = (acc >> 8) + coeffValue;
+    accL += (int64_t)acc * (int64_t)(oldZData);
+    oldZData = zData0;
+    *(zeroCoeffPt + k) = acc;
+  }
+
+  acc = (int32_t)(accL >> 22);
+  acc = ssat24(acc);
+  /* Predictor output is the sum of the pole and zero filter outputs. Ensure
+   * this is saturated, if necessary. */
+  // recover value of PoleVal stored at beginning of routine...
+  predVal = acc + SubbandDataPt->m_predData.m_predVal;
+  predVal = ssat24(predVal);
+  SubbandDataPt->m_predData.m_zeroVal = acc;
+  SubbandDataPt->m_predData.m_predVal = predVal;
+
+  /* Update the zero filter delay line by writing the new input sample to the
+   * circular buffer. */
+  SubbandDataPt->m_predData.m_zeroDelayLine
+      .buffer[SubbandDataPt->m_predData.m_zeroDelayLine.pointer] =
+      SubbandDataPt->m_predData.m_zeroDelayLine.modulo;
+  SubbandDataPt->m_predData.m_zeroDelayLine
+      .buffer[SubbandDataPt->m_predData.m_zeroDelayLine.pointer + 24] =
+      SubbandDataPt->m_predData.m_zeroDelayLine.modulo;
+}
+
+XBT_INLINE_ void performPredictionFilteringHL(const int32_t invQ,
+                                              Subband_data* SubbandDataPt) {
+  int32_t poleVal;
+  int32_t acc;
+  int64_t accL;
+  uint32_t pointer;
+  int32_t poleDelayLine;
+  int32_t predVal;
+  int32_t* zeroCoeffPt = SubbandDataPt->m_ZeroCoeffData.m_zeroCoeff;
+  int32_t* poleCoeff = SubbandDataPt->m_PoleCoeffData.m_poleCoeff;
+  int32_t zData0;
+  int32_t* cbuf_pt;
+  int32_t invQincr_pos;
+  int32_t invQincr_neg;
+  int32_t k;
+  int32_t oldZData;
+  const int32_t roundCte = 0x80000000;
+  /* Pole coefficient and data indices */
+  enum { a1 = 0, a2 = 1 };
+
+  /* Write the newest pole input sample to the pole delay line.
+   * Ensure the sum of the current dequantised error and the previous
+   * predictor output is saturated if necessary. */
+  poleDelayLine = invQ + SubbandDataPt->m_predData.m_predVal;
+
+  poleDelayLine = ssat24(poleDelayLine);
+
+  /* Pole filter convolution. Shift convolution result 1 place to the left
+   * before retrieving it, since the pole coefficients are Q22 (data is Q23)
+   * and we want a Q23 result */
+  accL = ((int64_t)poleCoeff[a2] *
+          (int64_t)SubbandDataPt->m_predData.m_poleDelayLine[a2]);
+  /* Update the pole delay line for the next pass by writing the new input
+   * sample into the 2nd element */
+  SubbandDataPt->m_predData.m_poleDelayLine[a2] = poleDelayLine;
+  accL += ((int64_t)poleCoeff[a1] * (int64_t)poleDelayLine);
+  poleVal = (int32_t)(accL >> 22);
+  poleVal = ssat24(poleVal);
+
+  /* Create (2^(-7)) * sgn(invQ) in Q22 format. */
+  invQincr_pos = 0L;
+  if (invQ != 0) {
+    invQincr_pos = 0x800000;
+  }
+  if (invQ < 0L) {
+    invQincr_pos = -invQincr_pos;
+  }
+
+  invQincr_neg = 0x0080 - invQincr_pos;
+  invQincr_pos += 0x0080;
+
+  pointer = (SubbandDataPt->m_predData.m_zeroDelayLine.pointer++) + 6;
+  cbuf_pt = &SubbandDataPt->m_predData.m_zeroDelayLine.buffer[pointer];
+  /* partial manual unrolling to improve performance */
+  if (SubbandDataPt->m_predData.m_zeroDelayLine.pointer >= 6) {
+    SubbandDataPt->m_predData.m_zeroDelayLine.pointer = 0;
+  }
+
+  SubbandDataPt->m_predData.m_zeroDelayLine.modulo = invQ;
+
+  /* Iterate over the number of coefficients for this subband */
+  oldZData = invQ;
+  accL = 0;
+
+  for (k = 0; k < 6; k++) {
+    uint32_t tmp_round0;
+    int32_t coeffValue;
+
+    zData0 = (*(cbuf_pt--));
+    coeffValue = *(zeroCoeffPt + k);
+    if (zData0 < 0L) {
+      acc = invQincr_neg - coeffValue;
+    } else {
+      acc = invQincr_pos - coeffValue;
+    }
+    tmp_round0 = acc;
+    acc = (acc >> 8) + coeffValue;
+    if (((tmp_round0 << 23) ^ roundCte) == 0) {
+      acc--;
+    }
+    accL += (int64_t)acc * (int64_t)(oldZData);
+    oldZData = zData0;
+    *(zeroCoeffPt + k) = acc;
+  }
+
+  acc = (int32_t)(accL >> 22);
+  acc = ssat24(acc);
+  /* Predictor output is the sum of the pole and zero filter outputs. Ensure
+   * this is saturated, if necessary. */
+  predVal = acc + poleVal;
+  predVal = ssat24(predVal);
+  SubbandDataPt->m_predData.m_zeroVal = acc;
+  SubbandDataPt->m_predData.m_predVal = predVal;
+
+  /* Update the zero filter delay line by writing the new input sample to the
+   * circular buffer. */
+  SubbandDataPt->m_predData.m_zeroDelayLine
+      .buffer[SubbandDataPt->m_predData.m_zeroDelayLine.pointer] =
+      SubbandDataPt->m_predData.m_zeroDelayLine.modulo;
+  SubbandDataPt->m_predData.m_zeroDelayLine
+      .buffer[SubbandDataPt->m_predData.m_zeroDelayLine.pointer + 6] =
+      SubbandDataPt->m_predData.m_zeroDelayLine.modulo;
+}
+
+#endif  // SUBBANDFUNCTIONSCOMMON_H
diff --git a/system/embdrv/encoder_for_aptx/src/SyncInserter.h b/system/embdrv/encoder_for_aptx/src/SyncInserter.h
new file mode 100644
index 0000000..c55ac53
--- /dev/null
+++ b/system/embdrv/encoder_for_aptx/src/SyncInserter.h
@@ -0,0 +1,237 @@
+/**
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/*------------------------------------------------------------------------------
+ *
+ *  All declarations relevant for the SyncInserter class. This class exposes a
+ *  public interface that lets a client supply two aptX encoder objects (left
+ *  and right stereo channel) and have the current quantised codes adjusted to
+ *  bury an autosync bit.
+ *
+ *----------------------------------------------------------------------------*/
+
+#ifndef SYNCINSERTER_H
+#define SYNCINSERTER_H
+#ifdef _GCC
+#pragma GCC visibility push(hidden)
+#endif
+
+#include "AptxParameters.h"
+
+/* Function to insert sync information into one of the 8 quantised codes
+ * spread across 2 aptX codewords (1 codeword per channel) */
+XBT_INLINE_ void xbtEncinsertSync(Encoder_data* leftChannelEncoder,
+                                  Encoder_data* rightChannelEncoder,
+                                  uint32_t* syncWordPhase) {
+  /* Currently using 0x1 as the 8-bit sync pattern */
+  static const uint32_t syncWord = 0x1;
+  uint32_t tmp_var;
+
+  uint32_t i;
+
+  /* Variable to hold the XOR of all the quantised code lsbs */
+  uint32_t xorCodeLsbs;
+
+  /* Variable to point to the quantiser with the minimum calculated distance
+   * penalty. */
+  Quantiser_data* minPenaltyQuantiser;
+
+  /* Get the vector of quantiser pointers from the left and right encoders */
+  Quantiser_data* leftQuant[4];
+  Quantiser_data* rightQuant[4];
+  leftQuant[0] = &leftChannelEncoder->m_qdata[0];
+  leftQuant[1] = &leftChannelEncoder->m_qdata[1];
+  leftQuant[2] = &leftChannelEncoder->m_qdata[2];
+  leftQuant[3] = &leftChannelEncoder->m_qdata[3];
+  rightQuant[0] = &rightChannelEncoder->m_qdata[0];
+  rightQuant[1] = &rightChannelEncoder->m_qdata[1];
+  rightQuant[2] = &rightChannelEncoder->m_qdata[2];
+  rightQuant[3] = &rightChannelEncoder->m_qdata[3];
+
+  /* Starting quantiser traversal with the LL quantiser from the left channel.
+   * Initialise the pointer to the minimum penalty quantiser with the details
+   * of the left LL quantiser. Initialise the code lsbs XOR variable with the
+   * left LL quantised code lsbs and also XOR in the left and right random
+   * dither bit generated by the 2 encoders. */
+  xorCodeLsbs = ((rightQuant[LL]->qCode) & 0x1) ^
+                leftChannelEncoder->m_dithSyncRandBit ^
+                rightChannelEncoder->m_dithSyncRandBit;
+  minPenaltyQuantiser = rightQuant[LH];
+
+  /* Traverse across the LH, HL and HH quantisers from the right channel */
+  for (i = LH; i <= HH; i++) {
+    /* XOR in the lsb of the quantised code currently examined */
+    xorCodeLsbs ^= (rightQuant[i]->qCode) & 0x1;
+  }
+
+  /* If the distance penalty associated with a quantiser is less than the
+   * current minimum, then make that quantiser the minimum penalty
+   * quantiser. */
+  if (rightQuant[HL]->distPenalty < minPenaltyQuantiser->distPenalty) {
+    minPenaltyQuantiser = rightQuant[HL];
+  }
+  if (rightQuant[LL]->distPenalty < minPenaltyQuantiser->distPenalty) {
+    minPenaltyQuantiser = rightQuant[LL];
+  }
+  if (rightQuant[HH]->distPenalty < minPenaltyQuantiser->distPenalty) {
+    minPenaltyQuantiser = rightQuant[HH];
+  }
+
+  /* Traverse across all quantisers from the left channel */
+  for (i = LL; i <= HH; i++) {
+    /* XOR in the lsb of the quantised code currently examined */
+    xorCodeLsbs ^= (leftQuant[i]->qCode) & 0x1;
+  }
+
+  /* If the distance penalty associated with a quantiser is less than the
+   * current minimum, then make that quantiser the minimum penalty
+   * quantiser. */
+  if (leftQuant[LH]->distPenalty < minPenaltyQuantiser->distPenalty) {
+    minPenaltyQuantiser = leftQuant[LH];
+  }
+  if (leftQuant[HL]->distPenalty < minPenaltyQuantiser->distPenalty) {
+    minPenaltyQuantiser = leftQuant[HL];
+  }
+  if (leftQuant[LL]->distPenalty < minPenaltyQuantiser->distPenalty) {
+    minPenaltyQuantiser = leftQuant[LL];
+  }
+  if (leftQuant[HH]->distPenalty < minPenaltyQuantiser->distPenalty) {
+    minPenaltyQuantiser = leftQuant[HH];
+  }
+
+  /* If the lsbs of all 8 quantised codes don't happen to equal the desired
+   * sync bit to embed, then force them to be by replacing the optimum code
+   * with the alternate code in the minimum penalty quantiser (changes the lsb
+   * of the code in this quantiser) */
+  if (xorCodeLsbs != ((syncWord >> (*syncWordPhase)) & 0x1)) {
+    minPenaltyQuantiser->qCode = minPenaltyQuantiser->altQcode;
+  }
+
+  /* Decrement the selected sync word bit modulo 8 for the next pass. */
+  tmp_var = --(*syncWordPhase);
+  (*syncWordPhase) = tmp_var & 0x7;
+}
+
+XBT_INLINE_ void xbtEncinsertSyncDualMono(Encoder_data* leftChannelEncoder,
+                                          Encoder_data* rightChannelEncoder,
+                                          uint32_t* syncWordPhase) {
+  /* Currently using 0x1 as the 8-bit sync pattern */
+  static const uint32_t syncWord = 0x1;
+  uint32_t tmp_var;
+
+  uint32_t i;
+
+  /* Variable to hold the XOR of all the quantised code lsbs */
+  uint32_t xorCodeLsbs;
+
+  /* Variable to point to the quantiser with the minimum calculated distance
+   * penalty. */
+  Quantiser_data* minPenaltyQuantiser;
+
+  /* Get the vector of quantiser pointers from the left and right encoders */
+  Quantiser_data* leftQuant[4];
+  Quantiser_data* rightQuant[4];
+  leftQuant[0] = &leftChannelEncoder->m_qdata[0];
+  leftQuant[1] = &leftChannelEncoder->m_qdata[1];
+  leftQuant[2] = &leftChannelEncoder->m_qdata[2];
+  leftQuant[3] = &leftChannelEncoder->m_qdata[3];
+  rightQuant[0] = &rightChannelEncoder->m_qdata[0];
+  rightQuant[1] = &rightChannelEncoder->m_qdata[1];
+  rightQuant[2] = &rightChannelEncoder->m_qdata[2];
+  rightQuant[3] = &rightChannelEncoder->m_qdata[3];
+
+  /* Starting quantiser traversal with the LL quantiser from the left channel.
+   * Initialise the pointer to the minimum penalty quantiser with the details
+   * of the left LL quantiser. Initialise the code lsbs XOR variable with the
+   * left LL quantised code lsbs */
+  xorCodeLsbs = leftChannelEncoder->m_dithSyncRandBit;
+
+  minPenaltyQuantiser = leftQuant[LH];
+
+  /* Traverse across all the quantisers from the left channel */
+  for (i = LL; i <= HH; i++) {
+    /* XOR in the lsb of the quantised code currently examined */
+    xorCodeLsbs ^= (leftQuant[i]->qCode) & 0x1;
+  }
+
+  /* If the distance penalty associated with a quantiser is less than the
+   * current minimum, then make that quantiser the minimum penalty
+   * quantiser. */
+  if (leftQuant[LH]->distPenalty < minPenaltyQuantiser->distPenalty) {
+    minPenaltyQuantiser = leftQuant[LH];
+  }
+  if (leftQuant[HL]->distPenalty < minPenaltyQuantiser->distPenalty) {
+    minPenaltyQuantiser = leftQuant[HL];
+  }
+  if (leftQuant[LL]->distPenalty < minPenaltyQuantiser->distPenalty) {
+    minPenaltyQuantiser = leftQuant[LL];
+  }
+  if (leftQuant[HH]->distPenalty < minPenaltyQuantiser->distPenalty) {
+    minPenaltyQuantiser = leftQuant[HH];
+  }
+
+  /* If the lsbs of all 4 quantised codes don't happen to equal the desired
+   * sync bit to embed, then force them to be by replacing the optimum code
+   * with the alternate code in the minimum penalty quantiser (changes the lsb
+   * of the code in this quantiser) */
+  if (xorCodeLsbs != ((syncWord >> (*syncWordPhase)) & 0x1)) {
+    minPenaltyQuantiser->qCode = minPenaltyQuantiser->altQcode;
+  }
+
+  /****  Insert sync on the Right channel  ****/
+  xorCodeLsbs = rightChannelEncoder->m_dithSyncRandBit;
+
+  minPenaltyQuantiser = rightQuant[LH];
+
+  /* Traverse across all quantisers from the right channel */
+  for (i = LL; i <= HH; i++) {
+    /* XOR in the lsb of the quantised code currently examined */
+    xorCodeLsbs ^= (rightQuant[i]->qCode) & 0x1;
+  }
+
+  /* If the distance penalty associated with a quantiser is less than the
+   * current minimum, then make that quantiser the minimum penalty
+   * quantiser. */
+  if (rightQuant[LH]->distPenalty < minPenaltyQuantiser->distPenalty) {
+    minPenaltyQuantiser = rightQuant[LH];
+  }
+  if (rightQuant[HL]->distPenalty < minPenaltyQuantiser->distPenalty) {
+    minPenaltyQuantiser = rightQuant[HL];
+  }
+  if (rightQuant[LL]->distPenalty < minPenaltyQuantiser->distPenalty) {
+    minPenaltyQuantiser = rightQuant[LL];
+  }
+  if (rightQuant[HH]->distPenalty < minPenaltyQuantiser->distPenalty) {
+    minPenaltyQuantiser = rightQuant[HH];
+  }
+
+  /* If the lsbs of all 4 quantised codes don't happen to equal the desired
+   * sync bit to embed, then force them to be by replacing the optimum code
+   * with the alternate code in the minimum penalty quantiser (changes the lsb
+   * of the code in this quantiser) */
+  if (xorCodeLsbs != ((syncWord >> (*syncWordPhase)) & 0x1)) {
+    minPenaltyQuantiser->qCode = minPenaltyQuantiser->altQcode;
+  }
+
+  /*  End of Right channel autosync insert*/
+  /* Decrement the selected sync word bit modulo 8 for the next pass. */
+  tmp_var = --(*syncWordPhase);
+  (*syncWordPhase) = tmp_var & 0x7;
+}
+
+#ifdef _GCC
+#pragma GCC visibility pop
+#endif
+#endif  // SYNCINSERTER_H
diff --git a/system/embdrv/encoder_for_aptx/src/aptXbtenc.c b/system/embdrv/encoder_for_aptx/src/aptXbtenc.c
new file mode 100644
index 0000000..6286ca9
--- /dev/null
+++ b/system/embdrv/encoder_for_aptx/src/aptXbtenc.c
@@ -0,0 +1,227 @@
+/**
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#include "aptXbtenc.h"
+
+#include "AptxEncoder.h"
+#include "AptxParameters.h"
+#include "AptxTables.h"
+#include "CodewordPacker.h"
+#include "SyncInserter.h"
+#include "swversion.h"
+
+typedef struct aptxbtenc_t {
+  /* m_endian should either be 0 (little endian) or 8 (big endian). */
+  int32_t m_endian;
+
+  /* m_sync_mode is an enumerated type and will be
+     0 (stereo sync),
+     1 (for dual mono sync), or
+     2 (for dual channel with no autosync).
+  */
+  int32_t m_sync_mode;
+
+  /* Autosync inserter & Checker for use with the stereo aptX codec. */
+  /* The current phase of the sync word insertion (7 down to 0) */
+  uint32_t m_syncWordPhase;
+
+  /* Stereo channel aptX encoder (annotated to produce Kalimba test vectors
+   * for it's I/O. This will process valid PCM from a WAV file). */
+  /* Each Encoder_data structure requires 1592 bytes */
+  Encoder_data m_encoderData[2];
+  Qmf_storage m_qmf_l;
+  Qmf_storage m_qmf_r;
+} aptxbtenc;
+
+/* Log to linear lookup table used in inverse quantiser*/
+/* Size of Table: 32*4 = 128 bytes */
+static const int32_t IQuant_tableLogT[32] = {
+    16384 * 256, 16744 * 256, 17112 * 256, 17488 * 256, 17864 * 256,
+    18256 * 256, 18656 * 256, 19064 * 256, 19480 * 256, 19912 * 256,
+    20344 * 256, 20792 * 256, 21248 * 256, 21712 * 256, 22192 * 256,
+    22672 * 256, 23168 * 256, 23680 * 256, 24200 * 256, 24728 * 256,
+    25264 * 256, 25824 * 256, 26384 * 256, 26968 * 256, 27552 * 256,
+    28160 * 256, 28776 * 256, 29408 * 256, 30048 * 256, 30704 * 256,
+    31376 * 256, 32064 * 256};
+
+static void clearmem(void* mem, int32_t sz) {
+  int8_t* m = (int8_t*)mem;
+  int32_t i = 0;
+  for (; i < sz; i++) {
+    *m = 0;
+    m++;
+  }
+}
+
+APTXBTENCEXPORT int SizeofAptxbtenc(void) { return (sizeof(aptxbtenc)); }
+
+APTXBTENCEXPORT const char* aptxbtenc_version() { return (swversion); }
+
+APTXBTENCEXPORT int aptxbtenc_init(void* _state, short endian) {
+  aptxbtenc* state = (aptxbtenc*)_state;
+  int32_t j = 0;
+  int32_t k;
+  int32_t t;
+
+  clearmem(_state, sizeof(aptxbtenc));
+
+  if (state == 0) {
+    return 1;
+  }
+  state->m_syncWordPhase = 7L;
+
+  if (endian == 0) {
+    state->m_endian = 0;
+  } else {
+    state->m_endian = 8;
+  }
+
+  /* default setting should be stereo autosync,
+  for backwards-compatibility with legacy applications that use this library */
+  state->m_sync_mode = stereo;
+
+  for (j = 0; j < 2; j++) {
+    Encoder_data* encode_dat = &state->m_encoderData[j];
+    uint32_t i;
+
+    /* Create a quantiser and subband processor for each subband */
+    for (i = LL; i <= HH; i++) {
+      encode_dat->m_codewordHistory = 0L;
+
+      encode_dat->m_qdata[i].thresholdTablePtr =
+          subbandParameters[i].threshTable;
+      encode_dat->m_qdata[i].thresholdTablePtr_sl1 =
+          subbandParameters[i].threshTable_sl1;
+      encode_dat->m_qdata[i].ditherTablePtr = subbandParameters[i].dithTable;
+      encode_dat->m_qdata[i].minusLambdaDTable =
+          subbandParameters[i].minusLambdaDTable;
+      encode_dat->m_qdata[i].codeBits = subbandParameters[i].numBits;
+      encode_dat->m_qdata[i].qCode = 0L;
+      encode_dat->m_qdata[i].altQcode = 0L;
+      encode_dat->m_qdata[i].distPenalty = 0L;
+
+      /* initialisation of inverseQuantiser data */
+      encode_dat->m_SubbandData[i].m_iqdata.thresholdTablePtr =
+          subbandParameters[i].threshTable;
+      encode_dat->m_SubbandData[i].m_iqdata.thresholdTablePtr_sl1 =
+          subbandParameters[i].threshTable_sl1;
+      encode_dat->m_SubbandData[i].m_iqdata.ditherTablePtr_sf1 =
+          subbandParameters[i].dithTable_sh1;
+      encode_dat->m_SubbandData[i].m_iqdata.incrTablePtr =
+          subbandParameters[i].incrTable;
+      encode_dat->m_SubbandData[i].m_iqdata.maxLogDelta =
+          subbandParameters[i].maxLogDelta;
+      encode_dat->m_SubbandData[i].m_iqdata.minLogDelta =
+          subbandParameters[i].minLogDelta;
+      encode_dat->m_SubbandData[i].m_iqdata.delta = 0;
+      encode_dat->m_SubbandData[i].m_iqdata.logDelta = 0;
+      encode_dat->m_SubbandData[i].m_iqdata.invQ = 0;
+      encode_dat->m_SubbandData[i].m_iqdata.iquantTableLogPtr =
+          &IQuant_tableLogT[0];
+
+      // Initializing data for predictor filter
+      encode_dat->m_SubbandData[i].m_predData.m_zeroDelayLine.modulo =
+          subbandParameters[i].numZeros;
+
+      for (t = 0; t < 48; t++) {
+        encode_dat->m_SubbandData[i].m_predData.m_zeroDelayLine.buffer[t] = 0;
+      }
+
+      encode_dat->m_SubbandData[i].m_predData.m_zeroDelayLine.pointer = 0;
+      /* Initialise the previous zero filter output and predictor output to zero
+       */
+      encode_dat->m_SubbandData[i].m_predData.m_zeroVal = 0L;
+      encode_dat->m_SubbandData[i].m_predData.m_predVal = 0L;
+      encode_dat->m_SubbandData[i].m_predData.m_numZeros =
+          subbandParameters[i].numZeros;
+      /* Initialise the contents of the pole data delay line to zero */
+      encode_dat->m_SubbandData[i].m_predData.m_poleDelayLine[0] = 0L;
+      encode_dat->m_SubbandData[i].m_predData.m_poleDelayLine[1] = 0L;
+
+      for (k = 0; k < 24; k++) {
+        encode_dat->m_SubbandData[i].m_ZeroCoeffData.m_zeroCoeff[k] = 0;
+      }
+      // Initializing data for zerocoeff update function.
+      encode_dat->m_SubbandData[i].m_ZeroCoeffData.m_numZeros =
+          subbandParameters[i].numZeros;
+
+      /* Initializing data for PoleCoeff Update function.
+       * Fill the adaptation delay line with +1 initially */
+      encode_dat->m_SubbandData[i].m_PoleCoeffData.m_poleAdaptDelayLine.s32 =
+          0x00010001;
+
+      /* Zero the pole coefficients */
+      encode_dat->m_SubbandData[i].m_PoleCoeffData.m_poleCoeff[0] = 0L;
+      encode_dat->m_SubbandData[i].m_PoleCoeffData.m_poleCoeff[1] = 0L;
+    }
+  }
+  return 0;
+}
+
+APTXBTENCEXPORT int aptxbtenc_setsync_mode(void* _state, int32_t sync_mode) {
+  aptxbtenc* state = (aptxbtenc*)_state;
+  state->m_sync_mode = sync_mode;
+
+  return 0;
+}
+
+APTXBTENCEXPORT int aptxbtenc_encodestereo(void* _state, void* _pcmL,
+                                           void* _pcmR, void* _buffer) {
+  aptxbtenc* state = (aptxbtenc*)_state;
+  int32_t* pcmL = (int32_t*)_pcmL;
+  int32_t* pcmR = (int32_t*)_pcmR;
+  int16_t* buffer = (int16_t*)_buffer;
+  int16_t tmp_reg;
+  int16_t tmp_out;
+  // Feed the PCM to the dual aptX encoders
+  aptxEncode(pcmL, &state->m_qmf_l, &state->m_encoderData[0]);
+  aptxEncode(pcmR, &state->m_qmf_r, &state->m_encoderData[1]);
+
+  // only insert sync information if we are not in non-autosync mode.
+  // The Non-autosync mode changes only take effect in the packCodeword()
+  // function.
+  if (state->m_sync_mode != no_sync) {
+    if (state->m_sync_mode == stereo) {
+      // Insert the autosync information into the stereo quantised codes
+      xbtEncinsertSync(&state->m_encoderData[0], &state->m_encoderData[1],
+                       &state->m_syncWordPhase);
+    } else {
+      // Insert the autosync information into the two individual mono quantised
+      // codes
+      xbtEncinsertSyncDualMono(&state->m_encoderData[0],
+                               &state->m_encoderData[1],
+                               &state->m_syncWordPhase);
+    }
+  }
+
+  aptxPostEncode(&state->m_encoderData[0]);
+  aptxPostEncode(&state->m_encoderData[1]);
+
+  // Pack the (possibly adjusted) codes into a 16-bit codeword per channel
+  tmp_reg = packCodeword(&state->m_encoderData[0], state->m_sync_mode);
+  // Swap bytes to output data in big-endian as expected by bc5 code...
+  tmp_out = tmp_reg >> state->m_endian;
+  tmp_out |= tmp_reg << state->m_endian;
+
+  buffer[0] = tmp_out;
+  tmp_reg = packCodeword(&state->m_encoderData[1], state->m_sync_mode);
+  // Swap bytes to output data in big-endian as expected by bc5 code...
+  tmp_out = tmp_reg >> state->m_endian;
+  tmp_out |= tmp_reg << state->m_endian;
+
+  buffer[1] = tmp_out;
+
+  return 0;
+}
diff --git a/system/embdrv/encoder_for_aptx/src/swversion.h b/system/embdrv/encoder_for_aptx/src/swversion.h
new file mode 100644
index 0000000..07ad8dc
--- /dev/null
+++ b/system/embdrv/encoder_for_aptx/src/swversion.h
@@ -0,0 +1,21 @@
+/**
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#ifndef SWVERSION_H
+#define SWVERSION_H
+
+static const char* const swversion = "1.0.0";
+
+#endif  // SWVERSION_H
diff --git a/system/embdrv/encoder_for_aptxhd/Android.bp b/system/embdrv/encoder_for_aptxhd/Android.bp
new file mode 100644
index 0000000..7f90809
--- /dev/null
+++ b/system/embdrv/encoder_for_aptxhd/Android.bp
@@ -0,0 +1,37 @@
+tidy_errors = [
+    "*",
+    "-altera-struct-pack-align",
+    "-altera-unroll-loops",
+    "-bugprone-narrowing-conversions",
+    "-cppcoreguidelines-avoid-magic-numbers",
+    "-cppcoreguidelines-init-variables",
+    "-cppcoreguidelines-narrowing-conversions",
+    "-hicpp-signed-bitwise",
+    "-llvm-header-guard",
+    "-readability-avoid-const-params-in-decls",
+    "-readability-identifier-length",
+    "-readability-magic-numbers",
+]
+
+cc_library_static {
+    name: "libaptxhd_enc",
+    host_supported: true,
+    export_include_dirs: ["include"],
+    srcs: [
+        "src/aptXHDbtenc.c",
+        "src/ProcessSubband.c",
+        "src/QmfConv.c",
+        "src/QuantiseDifference.c",
+    ],
+    cflags: ["-O2", "-Werror", "-Wall", "-Wextra"],
+    tidy: true,
+    tidy_checks: tidy_errors,
+    tidy_checks_as_errors: tidy_errors,
+    min_sdk_version: "Tiramisu",
+    apex_available: [
+        "com.android.btservices",
+    ],
+    visibility: [
+        "//packages/modules/Bluetooth:__subpackages__",
+    ],
+}
diff --git a/system/embdrv/encoder_for_aptxhd/include/aptXHDbtenc.h b/system/embdrv/encoder_for_aptxhd/include/aptXHDbtenc.h
new file mode 100644
index 0000000..9c18ab1
--- /dev/null
+++ b/system/embdrv/encoder_for_aptxhd/include/aptXHDbtenc.h
@@ -0,0 +1,63 @@
+/**
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/*-----------------------------------------------------------------------------
+ *
+ *  This file exposes a public interface to allow clients to invoke aptX HD
+ *  encoding on 4 new PCM samples, generating 2 new codeword (one for the
+ *  left channel and one for the right channel).
+ *
+ *----------------------------------------------------------------------------*/
+
+#ifndef APTXHDBTENC_H
+#define APTXHDBTENC_H
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#ifdef _DLLEXPORT
+#define APTXHDBTENCEXPORT __declspec(dllexport)
+#else
+#define APTXHDBTENCEXPORT
+#endif
+
+/* SizeofAptxhdbtenc returns the size (in byte) of the memory
+ * allocation required to store the state of the encoder */
+APTXHDBTENCEXPORT int SizeofAptxhdbtenc(void);
+
+/* aptxhdbtenc_version can be used to extract the version number
+ * of the aptX HD encoder */
+APTXHDBTENCEXPORT const char* aptxhdbtenc_version(void);
+
+/* aptxhdbtenc_init is used to initialise the encoder structure.
+ * _state should be a pointer to the encoder structure (stereo).
+ * endian represent the endianness of the output data
+ * (0=little endian. Big endian otherwise)
+ * The function returns 1 if an error occurred during the initialisation.
+ * The function returns 0 if no error occurred during the initialisation. */
+APTXHDBTENCEXPORT int aptxhdbtenc_init(void* _state, short endian);
+
+/* StereoEncode will take 8 audio samples (24-bit per sample)
+ * and generate two 24-bit codeword with autosync inserted.
+ * The bitstream is compatible with be BC05 implementation. */
+APTXHDBTENCEXPORT int aptxhdbtenc_encodestereo(void* _state, void* _pcmL,
+                                               void* _pcmR, void* _buffer);
+
+#ifdef __cplusplus
+}  //  /extern "C"
+#endif
+
+#endif  // APTXHDBTENC_H
diff --git a/system/embdrv/encoder_for_aptxhd/src/AptxEncoder.h b/system/embdrv/encoder_for_aptxhd/src/AptxEncoder.h
new file mode 100644
index 0000000..600ff34
--- /dev/null
+++ b/system/embdrv/encoder_for_aptxhd/src/AptxEncoder.h
@@ -0,0 +1,108 @@
+/**
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/*------------------------------------------------------------------------------
+ *
+ *  All declarations relevant for aptxhdEncode. This function allows clients
+ *  to invoke aptX HD encoding on 4 new PCM samples,
+ *  generating 4 new quantised codes. A separate function allows the
+ *  packing of the 4 codes into a 24-bit word.
+ *
+ *----------------------------------------------------------------------------*/
+
+#ifndef APTXENCODER_H
+#define APTXENCODER_H
+#ifdef _GCC
+#pragma GCC visibility push(hidden)
+#endif
+
+#include "AptxParameters.h"
+#include "DitherGenerator.h"
+#include "Qmf.h"
+#include "Quantiser.h"
+#include "SubbandFunctionsCommon.h"
+
+/* Function to carry out a single-channel aptX HD encode on 4 new PCM samples */
+XBT_INLINE_ void aptxhdEncode(int32_t pcm[4], Qmf_storage* Qmf_St,
+                              Encoder_data* EncoderDataPt) {
+  int32_t predVals[4];
+  int32_t qCodes[4];
+  int32_t aqmfOutputs[4];
+
+  /* Extract the previous predicted values and quantised codes into arrays */
+  predVals[0] = EncoderDataPt->m_SubbandData[0].m_predData.m_predVal;
+  qCodes[0] = EncoderDataPt->m_qdata[0].qCode;
+
+  predVals[1] = EncoderDataPt->m_SubbandData[1].m_predData.m_predVal;
+  qCodes[1] = EncoderDataPt->m_qdata[1].qCode;
+
+  predVals[2] = EncoderDataPt->m_SubbandData[2].m_predData.m_predVal;
+  qCodes[2] = EncoderDataPt->m_qdata[2].qCode;
+
+  predVals[3] = EncoderDataPt->m_SubbandData[3].m_predData.m_predVal;
+  qCodes[3] = EncoderDataPt->m_qdata[3].qCode;
+
+  /* Update codeword history, then generate new dither values. */
+  EncoderDataPt->m_codewordHistory =
+      xbtEncupdateCodewordHistory(qCodes, EncoderDataPt->m_codewordHistory);
+  EncoderDataPt->m_dithSyncRandBit = xbtEncgenerateDither(
+      EncoderDataPt->m_codewordHistory, EncoderDataPt->m_ditherOutputs);
+
+  /* Run the analysis QMF */
+  QmfAnalysisFilter(pcm, Qmf_St, predVals, aqmfOutputs);
+
+  /* Run the quantiser for each subband */
+  quantiseDifference_HDLL(aqmfOutputs[0], EncoderDataPt->m_ditherOutputs[0],
+                          EncoderDataPt->m_SubbandData[0].m_iqdata.delta,
+                          &EncoderDataPt->m_qdata[0]);
+  quantiseDifference_HDLH(aqmfOutputs[1], EncoderDataPt->m_ditherOutputs[1],
+                          EncoderDataPt->m_SubbandData[1].m_iqdata.delta,
+                          &EncoderDataPt->m_qdata[1]);
+  quantiseDifference_HDHL(aqmfOutputs[2], EncoderDataPt->m_ditherOutputs[2],
+                          EncoderDataPt->m_SubbandData[2].m_iqdata.delta,
+                          &EncoderDataPt->m_qdata[2]);
+  quantiseDifference_HDHH(aqmfOutputs[3], EncoderDataPt->m_ditherOutputs[3],
+                          EncoderDataPt->m_SubbandData[3].m_iqdata.delta,
+                          &EncoderDataPt->m_qdata[3]);
+}
+
+XBT_INLINE_ void aptxhdPostEncode(Encoder_data* EncoderDataPt) {
+  /* Run the remaining subband processing for each subband */
+  /* Manual inlining on the 4 subband */
+  processSubband_HDLL(EncoderDataPt->m_qdata[0].qCode,
+                      EncoderDataPt->m_ditherOutputs[0],
+                      &EncoderDataPt->m_SubbandData[0],
+                      &EncoderDataPt->m_SubbandData[0].m_iqdata);
+
+  processSubband_HD(EncoderDataPt->m_qdata[1].qCode,
+                    EncoderDataPt->m_ditherOutputs[1],
+                    &EncoderDataPt->m_SubbandData[1],
+                    &EncoderDataPt->m_SubbandData[1].m_iqdata);
+
+  processSubband_HDHL(EncoderDataPt->m_qdata[2].qCode,
+                      EncoderDataPt->m_ditherOutputs[2],
+                      &EncoderDataPt->m_SubbandData[2],
+                      &EncoderDataPt->m_SubbandData[2].m_iqdata);
+
+  processSubband_HD(EncoderDataPt->m_qdata[3].qCode,
+                    EncoderDataPt->m_ditherOutputs[3],
+                    &EncoderDataPt->m_SubbandData[3],
+                    &EncoderDataPt->m_SubbandData[3].m_iqdata);
+}
+
+#ifdef _GCC
+#pragma GCC visibility pop
+#endif
+#endif  // APTXENCODER_H
diff --git a/system/embdrv/encoder_for_aptxhd/src/AptxParameters.h b/system/embdrv/encoder_for_aptxhd/src/AptxParameters.h
new file mode 100644
index 0000000..e1092d3
--- /dev/null
+++ b/system/embdrv/encoder_for_aptxhd/src/AptxParameters.h
@@ -0,0 +1,248 @@
+/**
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/*------------------------------------------------------------------------------
+ *
+ * General shared aptX HD parameters.
+ *
+ *-----------------------------------------------------------------------------*/
+
+#ifndef APTXPARAMETERS_H
+#define APTXPARAMETERS_H
+#ifdef _GCC
+#pragma GCC visibility push(hidden)
+#endif
+
+#include <stdint.h>
+
+#include "CBStruct.h"
+
+#if defined _MSC_VER
+#define XBT_INLINE_ inline
+#define _STDQMFOUTERCOEFF 1
+#elif defined __clang__
+#define XBT_INLINE_ static inline
+#define _STDQMFOUTERCOEFF 1
+#elif defined __GNUC__
+#define XBT_INLINE_ inline
+#define _STDQMFOUTERCOEFF 1
+#else
+#define XBT_INLINE_ static
+#define _STDQMFOUTERCOEFF 1
+#endif
+
+/* Signed saturate to a 24bit value */
+XBT_INLINE_ int32_t ssat24(int32_t val) {
+  if (val > 0x7FFFFF) {
+    val = 0x7FFFFF;
+  }
+  if (val < -0x800000) {
+    val = -0x800000;
+  }
+  return val;
+}
+
+typedef union u_reg64 {
+  uint64_t u64;
+  int64_t s64;
+  struct s_u32 {
+#ifdef __BIGENDIAN
+    uint32_t h;
+    uint32_t l;
+#else
+    uint32_t l;
+    uint32_t h;
+#endif
+  } u32;
+  struct s_s32 {
+#ifdef __BIGENDIAN
+    int32_t h;
+    int32_t l;
+#else
+    int32_t l;
+    int32_t h;
+#endif
+  } s32;
+} reg64_t;
+
+typedef union u_reg32 {
+  uint32_t u32;
+  int32_t s32;
+  struct s_u16 {
+#ifdef __BIGENDIAN
+    uint16_t h;
+    uint16_t l;
+#else
+    uint16_t l;
+    uint16_t h;
+#endif
+  } u16;
+  struct s_s16 {
+#ifdef __BIGENDIAN
+    int16_t h;
+    int16_t l;
+#else
+    int16_t l;
+    int16_t h;
+#endif
+  } s16;
+} reg32_t;
+
+/* Each aptX HD enc/dec round consumes/produces 4 PCM samples */
+static const uint32_t numPcmSamples = 4;
+
+/* Symbolic constants for PCM data indices. */
+enum { FirstPcm = 0, SecondPcm = 1, ThirdPcm = 2, FourthPcm = 3 };
+
+/* Number of subbands is fixed at 4 */
+#define NUMSUBBANDS 4
+
+/* Symbolic constants for subband identification. */
+typedef enum { LL = 0, LH = 1, HL = 2, HH = 3 } bands;
+
+/* Structure declaration to bind a set of subband parameters */
+typedef struct {
+  const int32_t* threshTable;
+  const int32_t* threshTable_sl1;
+  const int32_t* dithTable;
+  const int32_t* dithTable_sh1;
+  const int32_t* minusLambdaDTable;
+  const int32_t* incrTable;
+  int32_t numBits;
+  int32_t maxLogDelta;
+  int32_t minLogDelta;
+  int32_t numZeros;
+} SubbandParameters;
+
+/* Struct required for the polecoeffcalculator function of btaptXHD encoder and
+ * decoder*/
+/* Size of structure: 16 Bytes */
+typedef struct {
+  /* delay line for previous sgn values */
+  reg32_t m_poleAdaptDelayLine;
+  /* 2 pole filter coeffs */
+  int32_t m_poleCoeff[2];
+} PoleCoeff_data;
+
+/* Struct required for the zerocoeffcalculator function of btaptXHD encoder and
+ * decoder*/
+/* Size of structure: 100 Bytes */
+typedef struct {
+  /* The zero filter length for this subband */
+  int32_t m_numZeros;
+  /* Maximum number of zeros for any subband is 24. */
+  /* 24 zero filter coeffs */
+  int32_t m_zeroCoeff[24];
+} ZeroCoeff_data;
+
+/* Struct required for the prediction filtering function of btaptXHD encoder and
+ * decoder*/
+/* Size of structure: 200+20=220 Bytes */
+typedef struct {
+  /* Number of zeros associated with this subband */
+  int32_t m_numZeros;
+  /* Zero data delay line (circular) */
+  circularBuffer m_zeroDelayLine;
+  /* 2-tap pole data delay line */
+  int32_t m_poleDelayLine[2];
+  /* Output from zero filter */
+  int32_t m_zeroVal;
+  /* Output from overall ARMA filter */
+  int32_t m_predVal;
+} Predictor_data;
+
+/* Struct required for the Quantisation function of btaptXHD encoder and
+ * decoder*/
+/* Size of structure: 24 Bytes */
+typedef struct {
+  /* Number of bits in the quantised code for this subband */
+  int32_t codeBits;
+  /* Pointer to threshold table */
+  const int32_t* thresholdTablePtr;
+  const int32_t* thresholdTablePtr_sl1;
+
+  /* Pointer to dither table */
+  const int32_t* ditherTablePtr;
+  /* Pointer to minus Lambda table */
+  const int32_t* minusLambdaDTable;
+  /* Output quantised code */
+  int32_t qCode;
+  /* Alternative quantised code for sync purposes */
+  int32_t altQcode;
+  /* Penalty associated with choosing alternative code */
+  int32_t distPenalty;
+} Quantiser_data;
+
+/* Struct required for the inverse Quantisation function of btaptXHD encoder and
+ * decoder*/
+/* Size of structure: 32 Bytes */
+typedef struct {
+  /* Pointer to threshold table */
+  const int32_t* thresholdTablePtr;
+  const int32_t* thresholdTablePtr_sl1;
+  /* Pointer to dither table */
+  const int32_t* ditherTablePtr_sf1;
+
+  /* Pointer to increment table */
+  const int32_t* incrTablePtr;
+  /* Upper and lower bounds for logDelta */
+  int32_t maxLogDelta;
+  int32_t minLogDelta;
+  /* Delta (quantisation step size */
+  int32_t delta;
+  /* Delta, expressed as a log base 2 */
+  uint16_t logDelta;
+  /* Output dequantised signal */
+  int32_t invQ;
+  /* pointer to IQuant_tableLogT */
+  const int32_t* iquantTableLogPtr;
+} IQuantiser_data;
+
+/* Subband data structure btaptXHD encoder*/
+/* Size of structure: 116+220+32= 368 Bytes */
+typedef struct {
+  /* Subband processing consists of inverse quantisation, predictor
+   * coefficient update, and predictor filtering. */
+  ZeroCoeff_data m_ZeroCoeffData;
+  PoleCoeff_data m_PoleCoeffData;
+  /* structure holding the data associated with the predictor */
+  Predictor_data m_predData;
+  /* iqdata holds the data associated with the instance of inverse quantiser */
+  IQuantiser_data m_iqdata;
+} Subband_data;
+
+/* Encoder data structure btaptXHD encoder*/
+/* Size of structure: 368*4+24+4*24 = 1592 Bytes */
+typedef struct {
+  /* Subband processing consists of inverse quantisation, predictor
+   * coefficient update, and predictor filtering. */
+  Subband_data m_SubbandData[4];
+  int32_t m_codewordHistory;
+  int32_t m_dithSyncRandBit;
+  int32_t m_ditherOutputs[4];
+  /* structure holding data values for this quantiser */
+  Quantiser_data m_qdata[4];
+} Encoder_data;
+
+/* Subband-specific number of predcitor zero filter coefficients. */
+static const uint32_t numZeroFilterCoeffs[4] = {24, 12, 6, 12};
+
+/* Delta is scaled by 4 positions within the quantiser and inverse quantiser. */
+static const uint32_t deltaScale = 4;
+
+#ifdef _GCC
+#pragma GCC visibility pop
+#endif
+#endif  // APTXPARAMETERS_H
diff --git a/system/embdrv/encoder_for_aptxhd/src/AptxTables.h b/system/embdrv/encoder_for_aptxhd/src/AptxTables.h
new file mode 100644
index 0000000..460e7ab
--- /dev/null
+++ b/system/embdrv/encoder_for_aptxhd/src/AptxTables.h
@@ -0,0 +1,233 @@
+/**
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/*------------------------------------------------------------------------------
+ *
+ *  All table definitions used for the quantizer.
+ *
+ *----------------------------------------------------------------------------*/
+
+#ifndef APTXTABLES_H
+#define APTXTABLES_H
+
+#include "AptxParameters.h"
+
+/* Quantisation threshold, logDelta increment and dither tables for 4-bit codes
+ */
+static const int32_t dq4bit24_sl1[9] = {
+    -95044, 95044, 295844, 528780, 821332, 1226438, 1890540, 3344850, 6450664,
+};
+
+static const int32_t q4incr24[9] = {
+    0, -17, 5, 30, 62, 105, 177, 334, 518,
+};
+
+static const int32_t dq4dith24_sf1[9] = {
+    95044, 95044, 105754, 127180, 165372, 39736, 424366, 1029946, 2075866,
+};
+
+static const int32_t dq4mLamb24[8] = {
+    0, -2678, -5357, -9548, 31409, -96158, -151395, -261480,
+};
+
+/* Quantisation threshold, logDelta increment and dither tables for 5-bit codes
+ */
+static const int32_t dq5bit24_sl1[17] = {
+    -45754,  45754,   138496,  234896,  337336,  448310,
+    570738,  708380,  866534,  1053262, 1281958, 1577438,
+    1993050, 2665984, 3900982, 5902844, 8897462,
+};
+
+static const int32_t q5incr24[17] = {
+    0, -18, -8, 2, 13, 25, 38, 53, 70, 90, 115, 147, 192, 264, 398, 521, 521,
+};
+
+static const int32_t dq5dith24_sf1[17] = {
+    45754,  45754,  46988,  49412,  53026,  57950,  64478,   73164,   84988,
+    101740, 126958, 168522, 247092, 425842, 809154, 1192708, 1801910,
+};
+
+static const int32_t dq5mLamb24[16] = {
+    0,     -309,  -606,   -904,   -1231,  -1632,  -2172,  -2956,
+    -4188, -6305, -10391, -19643, -44688, -95828, -95889, -152301,
+};
+
+/* Quantisation threshold, logDelta increment and dither tables for 6-bit codes
+ */
+static const int32_t dq6bit24_sl1[33] = {
+    -21236,  21236,   63830,   106798,  150386,   194832,  240376,
+    287258,  335726,  386034,  438460,  493308,   550924,  611696,
+    676082,  744626,  817986,  896968,  982580,   1076118, 1179278,
+    1294344, 1424504, 1574386, 1751090, 1966260,  2240868, 2617662,
+    3196432, 4176450, 5658260, 7671068, 10380372,
+};
+
+static const int32_t q6incr24[33] = {
+    0,   -21, -16, -12, -7,  -2,  3,   8,   13,  19,  24,
+    30,  36,  43,  50,  57,  65,  74,  83,  93,  104, 117,
+    131, 147, 166, 189, 219, 259, 322, 427, 521, 521, 521,
+};
+
+static const int32_t dq6dith24_sf1[33] = {
+    21236,  21236,  21360,  21608,  21978,   22468,   23076, 23806,  24660,
+    25648,  26778,  28070,  29544,  31228,   33158,   35386, 37974,  41008,
+    44606,  48934,  54226,  60840,  69320,   80564,   96140, 119032, 155576,
+    221218, 357552, 622468, 859344, 1153464, 1555840,
+};
+
+static const int32_t dq6mLamb24[32] = {
+    0,     -31,   -62,    -93,    -123,   -152,   -183,   -214,
+    -247,  -283,  -323,   -369,   -421,   -483,   -557,   -647,
+    -759,  -900,  -1082,  -1323,  -1654,  -2120,  -2811,  -3894,
+    -5723, -9136, -16411, -34084, -66229, -59219, -73530, -100594,
+};
+
+/* Quantisation threshold, logDelta increment and dither tables for 9-bit codes
+ */
+static const int32_t dq9bit24_sl1[257] = {
+    -2436,    2436,    7308,    12180,   17054,   21930,   26806,   31686,
+    36566,    41450,   46338,   51230,   56124,   61024,   65928,   70836,
+    75750,    80670,   85598,   90530,   95470,   100418,  105372,  110336,
+    115308,   120288,  125278,  130276,  135286,  140304,  145334,  150374,
+    155426,   160490,  165566,  170654,  175756,  180870,  185998,  191138,
+    196294,   201466,  206650,  211850,  217068,  222300,  227548,  232814,
+    238096,   243396,  248714,  254050,  259406,  264778,  270172,  275584,
+    281018,   286470,  291944,  297440,  302956,  308496,  314056,  319640,
+    325248,   330878,  336532,  342212,  347916,  353644,  359398,  365178,
+    370986,   376820,  382680,  388568,  394486,  400430,  406404,  412408,
+    418442,   424506,  430600,  436726,  442884,  449074,  455298,  461554,
+    467844,   474168,  480528,  486922,  493354,  499820,  506324,  512866,
+    519446,   526064,  532722,  539420,  546160,  552940,  559760,  566624,
+    573532,   580482,  587478,  594520,  601606,  608740,  615920,  623148,
+    630426,   637754,  645132,  652560,  660042,  667576,  675164,  682808,
+    690506,   698262,  706074,  713946,  721876,  729868,  737920,  746036,
+    754216,   762460,  770770,  779148,  787594,  796108,  804694,  813354,
+    822086,   830892,  839774,  848736,  857776,  866896,  876100,  885386,
+    894758,   904218,  913766,  923406,  933138,  942964,  952886,  962908,
+    973030,   983254,  993582,  1004020, 1014566, 1025224, 1035996, 1046886,
+    1057894,  1069026, 1080284, 1091670, 1103186, 1114838, 1126628, 1138558,
+    1150634,  1162858, 1175236, 1187768, 1200462, 1213320, 1226346, 1239548,
+    1252928,  1266490, 1280242, 1294188, 1308334, 1322688, 1337252, 1352034,
+    1367044,  1382284, 1397766, 1413494, 1429478, 1445728, 1462252, 1479058,
+    1496158,  1513562, 1531280, 1549326, 1567710, 1586446, 1605550, 1625034,
+    1644914,  1665208, 1685932, 1707108, 1728754, 1750890, 1773542, 1796732,
+    1820488,  1844840, 1869816, 1895452, 1921780, 1948842, 1976680, 2005338,
+    2034868,  2065322, 2096766, 2129260, 2162880, 2197708, 2233832, 2271352,
+    2310384,  2351050, 2393498, 2437886, 2484404, 2533262, 2584710, 2639036,
+    2696578,  2757738, 2822998, 2892940, 2968278, 3049896, 3138912, 3236760,
+    3345312,  3467068, 3605434, 3765154, 3952904, 4177962, 4452178, 4787134,
+    5187290,  5647128, 6159120, 6720518, 7332904, 8000032, 8726664, 9518152,
+    10380372,
+};
+
+static const int32_t q9incr24[257] = {
+    0,   -22, -21, -21, -20, -20, -19, -19, -18, -18, -17, -17, -16, -16, -15,
+    -14, -14, -13, -13, -12, -12, -11, -11, -10, -10, -9,  -9,  -8,  -7,  -7,
+    -6,  -6,  -5,  -5,  -4,  -4,  -3,  -3,  -2,  -1,  -1,  0,   0,   1,   1,
+    2,   2,   3,   4,   4,   5,   5,   6,   6,   7,   8,   8,   9,   9,   10,
+    11,  11,  12,  12,  13,  14,  14,  15,  15,  16,  17,  17,  18,  19,  19,
+    20,  20,  21,  22,  22,  23,  24,  24,  25,  26,  26,  27,  28,  28,  29,
+    30,  30,  31,  32,  33,  33,  34,  35,  35,  36,  37,  38,  38,  39,  40,
+    41,  41,  42,  43,  44,  44,  45,  46,  47,  48,  48,  49,  50,  51,  52,
+    52,  53,  54,  55,  56,  57,  58,  58,  59,  60,  61,  62,  63,  64,  65,
+    66,  67,  68,  69,  69,  70,  71,  72,  73,  74,  75,  77,  78,  79,  80,
+    81,  82,  83,  84,  85,  86,  87,  89,  90,  91,  92,  93,  94,  96,  97,
+    98,  99,  101, 102, 103, 105, 106, 107, 109, 110, 112, 113, 115, 116, 118,
+    119, 121, 122, 124, 125, 127, 129, 130, 132, 134, 136, 137, 139, 141, 143,
+    145, 147, 149, 151, 153, 155, 158, 160, 162, 164, 167, 169, 172, 174, 177,
+    180, 182, 185, 188, 191, 194, 197, 201, 204, 208, 211, 215, 219, 223, 227,
+    232, 236, 241, 246, 251, 257, 263, 269, 275, 283, 290, 298, 307, 317, 327,
+    339, 352, 367, 384, 404, 429, 458, 494, 522, 522, 522, 522, 522, 522, 522,
+    522, 522,
+};
+
+static const int32_t dq9dith24_sf1[257] = {
+    2436,   2436,   2436,   2436,   2438,   2438,   2438,   2440,   2442,
+    2442,   2444,   2446,   2448,   2450,   2454,   2456,   2458,   2462,
+    2464,   2468,   2472,   2476,   2480,   2484,   2488,   2492,   2498,
+    2502,   2506,   2512,   2518,   2524,   2528,   2534,   2540,   2548,
+    2554,   2560,   2568,   2574,   2582,   2588,   2596,   2604,   2612,
+    2620,   2628,   2636,   2646,   2654,   2664,   2672,   2682,   2692,
+    2702,   2712,   2722,   2732,   2742,   2752,   2764,   2774,   2786,
+    2798,   2810,   2822,   2834,   2846,   2858,   2870,   2884,   2896,
+    2910,   2924,   2938,   2952,   2966,   2980,   2994,   3010,   3024,
+    3040,   3056,   3070,   3086,   3104,   3120,   3136,   3154,   3170,
+    3188,   3206,   3224,   3242,   3262,   3280,   3300,   3320,   3338,
+    3360,   3380,   3400,   3422,   3442,   3464,   3486,   3508,   3532,
+    3554,   3578,   3602,   3626,   3652,   3676,   3702,   3728,   3754,
+    3780,   3808,   3836,   3864,   3892,   3920,   3950,   3980,   4010,
+    4042,   4074,   4106,   4138,   4172,   4206,   4240,   4276,   4312,
+    4348,   4384,   4422,   4460,   4500,   4540,   4580,   4622,   4664,
+    4708,   4752,   4796,   4842,   4890,   4938,   4986,   5036,   5086,
+    5138,   5192,   5246,   5300,   5358,   5416,   5474,   5534,   5596,
+    5660,   5726,   5792,   5860,   5930,   6002,   6074,   6150,   6226,
+    6306,   6388,   6470,   6556,   6644,   6736,   6828,   6924,   7022,
+    7124,   7228,   7336,   7448,   7562,   7680,   7802,   7928,   8058,
+    8192,   8332,   8476,   8624,   8780,   8940,   9106,   9278,   9458,
+    9644,   9840,   10042,  10252,  10472,  10702,  10942,  11194,  11458,
+    11734,  12024,  12328,  12648,  12986,  13342,  13720,  14118,  14540,
+    14990,  15466,  15976,  16520,  17102,  17726,  18398,  19124,  19908,
+    20760,  21688,  22702,  23816,  25044,  26404,  27922,  29622,  31540,
+    33720,  36222,  39116,  42502,  46514,  51334,  57218,  64536,  73830,
+    85890,  101860, 123198, 151020, 183936, 216220, 243618, 268374, 293022,
+    319362, 347768, 378864, 412626, 449596,
+};
+
+static const int32_t dq9mLamb24[256] = {
+    0,     0,     0,     -1,    0,     0,     -1,    -1,    0,     -1,    -1,
+    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,
+    -1,    -1,    -1,    -2,    -1,    -1,    -2,    -2,    -2,    -1,    -2,
+    -2,    -2,    -2,    -2,    -2,    -2,    -2,    -2,    -2,    -2,    -2,
+    -2,    -2,    -2,    -3,    -2,    -3,    -2,    -3,    -3,    -3,    -3,
+    -3,    -3,    -3,    -3,    -3,    -3,    -3,    -3,    -3,    -3,    -3,
+    -3,    -3,    -3,    -4,    -3,    -4,    -4,    -4,    -4,    -4,    -4,
+    -4,    -4,    -4,    -4,    -4,    -4,    -4,    -5,    -4,    -4,    -5,
+    -4,    -5,    -5,    -5,    -5,    -5,    -5,    -5,    -5,    -5,    -6,
+    -5,    -5,    -6,    -5,    -6,    -6,    -6,    -6,    -6,    -6,    -6,
+    -6,    -7,    -6,    -7,    -7,    -7,    -7,    -7,    -7,    -7,    -7,
+    -7,    -8,    -8,    -8,    -8,    -8,    -8,    -8,    -9,    -9,    -9,
+    -9,    -9,    -9,    -9,    -10,   -10,   -10,   -10,   -10,   -11,   -11,
+    -11,   -11,   -11,   -12,   -12,   -12,   -12,   -13,   -13,   -13,   -14,
+    -14,   -14,   -15,   -15,   -15,   -15,   -16,   -16,   -17,   -17,   -17,
+    -18,   -18,   -18,   -19,   -19,   -20,   -21,   -21,   -22,   -22,   -23,
+    -23,   -24,   -25,   -26,   -26,   -27,   -28,   -29,   -30,   -31,   -32,
+    -33,   -34,   -35,   -36,   -37,   -39,   -40,   -42,   -43,   -45,   -47,
+    -49,   -51,   -53,   -55,   -58,   -60,   -63,   -66,   -69,   -73,   -76,
+    -80,   -85,   -89,   -95,   -100,  -106,  -113,  -119,  -128,  -136,  -146,
+    -156,  -168,  -182,  -196,  -213,  -232,  -254,  -279,  -307,  -340,  -380,
+    -425,  -480,  -545,  -626,  -724,  -847,  -1003, -1205, -1471, -1830, -2324,
+    -3015, -3993, -5335, -6956, -8229, -8071, -6850, -6189, -6162, -6585, -7102,
+    -7774, -8441, -9243,
+};
+
+/* Array of structures containing subband parameters. */
+static const SubbandParameters subbandParameters[NUMSUBBANDS] = {
+    /* LL band */
+    {0, dq9bit24_sl1, 0, dq9dith24_sf1, dq9mLamb24, q9incr24, 9, (18 * 256) - 1,
+     -20, 24},
+
+    /* LH band */
+    {0, dq6bit24_sl1, 0, dq6dith24_sf1, dq6mLamb24, q6incr24, 6, (21 * 256) - 1,
+     -23, 12},
+
+    /* HL band */
+    {0, dq4bit24_sl1, 0, dq4dith24_sf1, dq4mLamb24, q4incr24, 4, (23 * 256) - 1,
+     -25, 6},
+
+    /* HH band */
+    {0, dq5bit24_sl1, 0, dq5dith24_sf1, dq5mLamb24, q5incr24, 5, (22 * 256) - 1,
+     -24, 12}};
+
+#endif  // APTXTABLES_H
diff --git a/system/embdrv/encoder_for_aptxhd/src/CBStruct.h b/system/embdrv/encoder_for_aptxhd/src/CBStruct.h
new file mode 100644
index 0000000..97b25f9
--- /dev/null
+++ b/system/embdrv/encoder_for_aptxhd/src/CBStruct.h
@@ -0,0 +1,40 @@
+/**
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/*------------------------------------------------------------------------------
+ *
+ * Structure required to implement a circular buffer.
+ *
+ *-----------------------------------------------------------------------------*/
+
+#ifndef CBSTRUCT_H
+#define CBSTRUCT_H
+#ifdef _GCC
+#pragma GCC visibility push(hidden)
+#endif
+
+typedef struct circularBuffer_t {
+  /* Buffer storage */
+  int32_t buffer[48];
+  /* Pointer to current buffer location */
+  uint32_t pointer;
+  /* Modulo length of circular buffer */
+  uint32_t modulo;
+} circularBuffer;
+
+#ifdef _GCC
+#pragma GCC visibility pop
+#endif
+#endif  // CBSTRUCT_H
diff --git a/system/embdrv/encoder_for_aptxhd/src/CodewordPacker.h b/system/embdrv/encoder_for_aptxhd/src/CodewordPacker.h
new file mode 100644
index 0000000..90f8c4c
--- /dev/null
+++ b/system/embdrv/encoder_for_aptxhd/src/CodewordPacker.h
@@ -0,0 +1,58 @@
+/**
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/*------------------------------------------------------------------------------
+ *
+ *  Prototype declaration of the CodewordPacker Function
+ *
+ *  This functions allows a client to supply an array of 4 quantised codes
+ *  (1 per subband) and obtain a packed version as a 24-bit aptX HD codeword.
+ *
+ *----------------------------------------------------------------------------*/
+
+#ifndef CODEWORDPACKER_H
+#define CODEWORDPACKER_H
+
+#include "AptxParameters.h"
+
+/* This functions allows a client to supply an array of 4 quantised codes
+ * (1 per subband) and obtain a packed version as a 24-bit aptX HD codeword. */
+XBT_INLINE_ int32_t packCodeword(Encoder_data* EncoderDataPt) {
+  int32_t syncContribution;
+  int32_t hhCode;
+  int32_t codeword;
+
+  /* The per-channel contribution to derive the current sync bit is the XOR of
+   * the 4 code lsbs and the random dither bit. The SyncInserter engineers it
+   * such that the XOR of the sync contributions from the left and right
+   * channel give the actual sync bit value. The per-channel sync bit
+   * contribution overwrites the HH code lsb in the packed codeword. */
+  syncContribution =
+      (EncoderDataPt->m_qdata[0].qCode ^ EncoderDataPt->m_qdata[1].qCode ^
+       EncoderDataPt->m_qdata[2].qCode ^ EncoderDataPt->m_qdata[3].qCode ^
+       EncoderDataPt->m_dithSyncRandBit) &
+      0x1;
+  hhCode = (EncoderDataPt->m_qdata[HH].qCode & 0x1eL) | syncContribution;
+
+  /* Pack the 24-bit codeword with the appropriate number of lsbs from each
+   * quantised code (LL=9, LH=6, HL=4, HH=5). */
+  codeword = (EncoderDataPt->m_qdata[LL].qCode & 0x1ff) |
+             ((EncoderDataPt->m_qdata[LH].qCode & 0x3f) << 9) |
+             ((EncoderDataPt->m_qdata[HL].qCode & 0xf) << 15) | (hhCode << 19);
+
+  return codeword;
+}
+
+#endif  // CODEWORDPACKER_H
diff --git a/system/embdrv/encoder_for_aptxhd/src/DitherGenerator.h b/system/embdrv/encoder_for_aptxhd/src/DitherGenerator.h
new file mode 100644
index 0000000..26a6071
--- /dev/null
+++ b/system/embdrv/encoder_for_aptxhd/src/DitherGenerator.h
@@ -0,0 +1,115 @@
+/**
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/*------------------------------------------------------------------------------
+ *
+ *  These functions allow clients to update an internal codeword history
+ *  attribute from previously-generated quantised codes, and to generate a new
+ *  pseudo-random dither value per subband from this internal attribute.
+ *
+ *----------------------------------------------------------------------------*/
+
+#ifndef DITHERGENERATOR_H
+#define DITHERGENERATOR_H
+
+#include "AptxParameters.h"
+
+/* This function updates an internal bit-pool (private variable in
+ * DitherGenerator) based on bits obtained from previously-encoded or received
+ * aptX HD codewords. */
+XBT_INLINE_ int32_t xbtEncupdateCodewordHistory(const int32_t quantisedCodes[4],
+                                                int32_t m_codewordHistory) {
+  int32_t newBits;
+  int32_t updatedCodewordHistory;
+
+  const int32_t llMask = 0x3L;
+  const int32_t lhMask = 0x2L;
+  const int32_t hlMask = 0x1L;
+  const uint32_t lhShift = 1;
+  const uint32_t hlShift = 3;
+  /* Shift value to left-justify a 24-bit value in a 32-bit signed variable*/
+  const uint32_t leftJustifyShift = 8;
+  const uint32_t numNewBits = 4;
+
+  /* Make a 4-bit vector from particular bits from 3 quantised codes */
+  newBits = (quantisedCodes[LL] & llMask) +
+            ((quantisedCodes[LH] & lhMask) << lhShift) +
+            ((quantisedCodes[HL] & hlMask) << hlShift);
+
+  /* Add the 4 new bits to the codeword history. Note that this is a 24-bit
+   * value LEFT-JUSTIFIED in a 32-bit signed variable. Maintaining the history
+   * as signed is useful in the dither generation process below. */
+  updatedCodewordHistory =
+      (m_codewordHistory << numNewBits) + (newBits << leftJustifyShift);
+
+  return updatedCodewordHistory;
+}
+
+/* Function to generate a dither value for each subband based
+ * on the current contents of the codewordHistory bit-pool. */
+XBT_INLINE_ int32_t xbtEncgenerateDither(int32_t m_codewordHistory,
+                                         int32_t* m_ditherOutputs) {
+  int32_t history24b;
+  int32_t upperAcc;
+  int32_t lowerAcc;
+  int32_t accSum;
+  int64_t tmp_acc;
+  int32_t ditherSample;
+  int32_t m_dithSyncRandBit;
+
+  /* Fixed value to multiply codeword history variable by */
+  const uint32_t dithConstMultiplier = 0x4f1bbbL;
+  /* Shift value to left-justify a 24-bit value in a 32-bit signed variable*/
+  const uint32_t leftJustifyShift = 8;
+
+  /* AND mask to retain only the lower 24 bits of a variable */
+  const int32_t keepLower24bitsMask = 0xffffffL;
+
+  /* Convert the codeword history to a 24-bit signed value. This can be done
+   * cheaply with a 8-position right-shift since it is maintained as 24-bits
+   * value left-justified in a signed 32-bit variable. */
+  history24b = m_codewordHistory >> (leftJustifyShift - 1);
+
+  /* Multiply the history by a fixed constant. The constant has already been
+   * shifted right by 1 position to compensate for the left-shift introduced
+   * on the product by the fractional multiplier. */
+  tmp_acc = ((int64_t)history24b * (int64_t)dithConstMultiplier);
+
+  /* Get the upper and lower 24-bit values from the accumulator, and form
+   * their sum. */
+  upperAcc = ((int32_t)(tmp_acc >> 24)) & 0x00FFFFFFL;
+  lowerAcc = ((int32_t)tmp_acc) & 0x00FFFFFFL;
+  accSum = upperAcc + lowerAcc;
+
+  /* The dither sample is the 2 msbs of lowerAcc and the 22 lsbs of accSum */
+  ditherSample = ((lowerAcc >> 22) + (accSum << 2)) & keepLower24bitsMask;
+
+  /* The sign bit of 24-bit accSum is saved as a random bit to
+   * assist in the apt-X sync insertion process. */
+  m_dithSyncRandBit = (accSum >> 23) & 0x1;
+
+  /* Successive dither outputs for the 4 subbands are versions of ditherSample
+   * offset by a further 5-position left shift for each subband. Also apply a
+   * constant left-shift of 8 to turn the values into signed 24-bit values
+   * left-justified in the 32-bit ditherOutput variable. */
+  m_ditherOutputs[HH] = ditherSample << leftJustifyShift;
+  m_ditherOutputs[HL] = ditherSample << (5 + leftJustifyShift);
+  m_ditherOutputs[LH] = ditherSample << (10 + leftJustifyShift);
+  m_ditherOutputs[LL] = ditherSample << (15 + leftJustifyShift);
+
+  return m_dithSyncRandBit;
+}
+
+#endif  // DITHERGENERATOR_H
diff --git a/system/embdrv/encoder_for_aptxhd/src/ProcessSubband.c b/system/embdrv/encoder_for_aptxhd/src/ProcessSubband.c
new file mode 100644
index 0000000..12c4571
--- /dev/null
+++ b/system/embdrv/encoder_for_aptxhd/src/ProcessSubband.c
@@ -0,0 +1,66 @@
+/**
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#include "AptxParameters.h"
+#include "SubbandFunctions.h"
+#include "SubbandFunctionsCommon.h"
+
+/* This function carries out all subband processing (common to both encode and
+ * decode). */
+void processSubband_HD(const int32_t qCode, const int32_t ditherVal,
+                       Subband_data* SubbandDataPt, IQuantiser_data* iqDataPt) {
+  /* Inverse quantisation */
+  invertQuantisation(qCode, ditherVal, iqDataPt);
+
+  /* Predictor pole coefficient update */
+  updatePredictorPoleCoefficients(iqDataPt->invQ,
+                                  SubbandDataPt->m_predData.m_zeroVal,
+                                  &SubbandDataPt->m_PoleCoeffData);
+
+  /* Predictor filtering */
+  performPredictionFiltering(iqDataPt->invQ, SubbandDataPt);
+}
+
+/* processSubband_HDLL is used for the LL subband only. */
+void processSubband_HDLL(const int32_t qCode, const int32_t ditherVal,
+                         Subband_data* SubbandDataPt,
+                         IQuantiser_data* iqDataPt) {
+  /* Inverse quantisation */
+  invertQuantisation(qCode, ditherVal, iqDataPt);
+
+  /* Predictor pole coefficient update */
+  updatePredictorPoleCoefficients(iqDataPt->invQ,
+                                  SubbandDataPt->m_predData.m_zeroVal,
+                                  &SubbandDataPt->m_PoleCoeffData);
+
+  /* Predictor filtering */
+  performPredictionFilteringLL(iqDataPt->invQ, SubbandDataPt);
+}
+
+/* processSubband_HDLL is used for the HL subband only. */
+void processSubband_HDHL(const int32_t qCode, const int32_t ditherVal,
+                         Subband_data* SubbandDataPt,
+                         IQuantiser_data* iqDataPt) {
+  /* Inverse quantisation */
+  invertQuantisationHL(qCode, ditherVal, iqDataPt);
+
+  /* Predictor pole coefficient update */
+  updatePredictorPoleCoefficients(iqDataPt->invQ,
+                                  SubbandDataPt->m_predData.m_zeroVal,
+                                  &SubbandDataPt->m_PoleCoeffData);
+
+  /* Predictor filtering */
+  performPredictionFilteringHL(iqDataPt->invQ, SubbandDataPt);
+}
diff --git a/system/embdrv/encoder_for_aptxhd/src/Qmf.h b/system/embdrv/encoder_for_aptxhd/src/Qmf.h
new file mode 100644
index 0000000..984c93b
--- /dev/null
+++ b/system/embdrv/encoder_for_aptxhd/src/Qmf.h
@@ -0,0 +1,185 @@
+/**
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/*------------------------------------------------------------------------------
+ *
+ *  This file includes the coefficient tables or the two convolution function
+ *  It also includes the definition of Qmf_storage and the prototype of all
+ *  necessary functions required to implement the QMF filtering.
+ *
+ *----------------------------------------------------------------------------*/
+
+#ifndef QMF_H
+#define QMF_H
+
+#include "AptxParameters.h"
+
+typedef struct {
+  int32_t QmfL_buf[32];
+  int32_t QmfH_buf[32];
+  int32_t QmfLH_buf[32];
+  int32_t QmfHL_buf[32];
+  int32_t QmfLL_buf[32];
+  int32_t QmfHH_buf[32];
+  int32_t QmfI_pt;
+  int32_t QmfO_pt;
+} Qmf_storage;
+
+/* Outer QMF filter for aptX HD is a symmetrical 32-tap filter (16
+ * different coefficients). The table defined in QmfConv.c */
+#ifndef _STDQMFOUTERCOEFF
+static const int32_t Qmf_outerCoeffs[12] = {
+    /* (C(1/30)C(3/28)), C(5/26), C(7/24) */
+    0xFE6302DA,
+    0xFFFFDA75,
+    0x0000AA6A,
+    /*  C(9/22), C(11/20), C(13/18), C(15/16) */
+    0xFFFE273E,
+    0x00041E95,
+    0xFFF710B5,
+    0x002AC12E,
+    /*  C(17/14), C(19/12), (C(21/10)C(23/8)) */
+    0x000AA328,
+    0xFFFD8D1F,
+    0x211E6BDB,
+    /* (C(25/6)C(27/4)), (C(29/2)C(31/0)) */
+    0x0DB7D8C5,
+    0xFC7F02B0,
+};
+#else
+static const int32_t Qmf_outerCoeffs[16] = {
+    730,    -413,    -9611, 43626, -121026, 269973, -585547, 2801966,
+    697128, -160481, 27611, 8478,  -10043,  3511,   688,     -897,
+};
+#endif
+
+/* Each inner QMF filter for aptX HD is a symmetrical 32-tap filter (16
+ * different coefficients) */
+static const int32_t Qmf_innerCoeffs[16] = {
+    1033,   -584,    -13592, 61697, -171156, 381799, -828088, 3962579,
+    985888, -226954, 39048,  11990, -14203,  4966,   973,     -1268,
+};
+
+void AsmQmfConvI_HD(const int32_t* p1dl_buffPtr, const int32_t* p2dl_buffPtr,
+                    const int32_t* coeffPtr, int32_t* filterOutputs);
+void AsmQmfConvO_HD(const int32_t* p1dl_buffPtr, const int32_t* p2dl_buffPtr,
+                    const int32_t* coeffPtr, int32_t* convSumDiff);
+
+XBT_INLINE_ void QmfAnalysisFilter(const int32_t pcm[4], Qmf_storage* Qmf_St,
+                                   const int32_t* predVals,
+                                   int32_t* aqmfOutputs) {
+  int32_t convSumDiff[4];
+  int32_t filterOutputs[4];
+
+  int32_t lc_QmfO_pt = (Qmf_St->QmfO_pt);
+  int32_t lc_QmfI_pt = (Qmf_St->QmfI_pt);
+
+  /* Run the analysis QMF */
+  /* Symbolic constants to represent the first and second set out outer filter
+   * outputs. */
+  enum { FirstOuterOutputs = 0, SecondOuterOutputs = 1 };
+
+  /* Load outer filter phase1 and phase2 delay lines with the first 2 PCM
+   * samples. Convolve the filter and get the 2 convolution results. */
+  Qmf_St->QmfL_buf[lc_QmfO_pt + 16] = pcm[FirstPcm];
+  Qmf_St->QmfL_buf[lc_QmfO_pt] = pcm[FirstPcm];
+  Qmf_St->QmfH_buf[lc_QmfO_pt + 16] = pcm[SecondPcm];
+  Qmf_St->QmfH_buf[lc_QmfO_pt++] = pcm[SecondPcm];
+  lc_QmfO_pt &= 0xF;
+
+  AsmQmfConvO_HD(&Qmf_St->QmfL_buf[lc_QmfO_pt + 15],
+                 &Qmf_St->QmfH_buf[lc_QmfO_pt], Qmf_outerCoeffs,
+                 &convSumDiff[0]);
+
+  /* Load outer filter phase1 and phase2 delay lines with the second 2 PCM
+   * samples. Convolve the filter and get the 2 convolution results. */
+  Qmf_St->QmfL_buf[lc_QmfO_pt + 16] = pcm[ThirdPcm];
+  Qmf_St->QmfL_buf[lc_QmfO_pt] = pcm[ThirdPcm];
+  Qmf_St->QmfH_buf[lc_QmfO_pt + 16] = pcm[FourthPcm];
+  Qmf_St->QmfH_buf[lc_QmfO_pt++] = pcm[FourthPcm];
+  lc_QmfO_pt &= 0xF;
+
+  AsmQmfConvO_HD(&Qmf_St->QmfL_buf[lc_QmfO_pt + 15],
+                 &Qmf_St->QmfH_buf[lc_QmfO_pt], Qmf_outerCoeffs,
+                 &convSumDiff[1]);
+
+  /* Load the first inner filter phase1 and phase2 delay lines with the 2
+   * convolution sum (low-pass) outer filter outputs. Convolve the filter and
+   * get the 2 convolution results. The first 2 analysis filter outputs are
+   * the sum and difference values for the first inner filter convolutions. */
+  Qmf_St->QmfLL_buf[lc_QmfI_pt + 16] = convSumDiff[0];
+  Qmf_St->QmfLL_buf[lc_QmfI_pt] = convSumDiff[0];
+  Qmf_St->QmfLH_buf[lc_QmfI_pt + 16] = convSumDiff[1];
+  Qmf_St->QmfLH_buf[lc_QmfI_pt] = convSumDiff[1];
+
+  AsmQmfConvI_HD(&Qmf_St->QmfLL_buf[lc_QmfI_pt + 16],
+                 &Qmf_St->QmfLH_buf[lc_QmfI_pt + 1], &Qmf_innerCoeffs[0],
+                 &filterOutputs[LL]);
+
+  /* Load the second inner filter phase1 and phase2 delay lines with the 2
+   * convolution difference (high-pass) outer filter outputs. Convolve the
+   * filter and get the 2 convolution results. The second 2 analysis filter
+   * outputs are the sum and difference values for the second inner filter
+   * convolutions. */
+  Qmf_St->QmfHL_buf[lc_QmfI_pt + 16] = convSumDiff[2];
+  Qmf_St->QmfHL_buf[lc_QmfI_pt] = convSumDiff[2];
+  Qmf_St->QmfHH_buf[lc_QmfI_pt + 16] = convSumDiff[3];
+  Qmf_St->QmfHH_buf[lc_QmfI_pt++] = convSumDiff[3];
+  lc_QmfI_pt &= 0xF;
+
+  AsmQmfConvI_HD(&Qmf_St->QmfHL_buf[lc_QmfI_pt + 15],
+                 &Qmf_St->QmfHH_buf[lc_QmfI_pt], &Qmf_innerCoeffs[0],
+                 &filterOutputs[HL]);
+
+  /* Subtracted the previous predicted value from the filter output on a
+   * per-subband basis. Ensure these values are saturated, if necessary.
+   * Manual unrolling */
+  aqmfOutputs[LL] = filterOutputs[LL] - predVals[LL];
+  if (aqmfOutputs[LL] > 8388607) {
+    aqmfOutputs[LL] = 8388607;
+  }
+  if (aqmfOutputs[LL] < -8388608) {
+    aqmfOutputs[LL] = -8388608;
+  }
+
+  aqmfOutputs[LH] = filterOutputs[LH] - predVals[LH];
+  if (aqmfOutputs[LH] > 8388607) {
+    aqmfOutputs[LH] = 8388607;
+  }
+  if (aqmfOutputs[LH] < -8388608) {
+    aqmfOutputs[LH] = -8388608;
+  }
+
+  aqmfOutputs[HL] = filterOutputs[HL] - predVals[HL];
+  if (aqmfOutputs[HL] > 8388607) {
+    aqmfOutputs[HL] = 8388607;
+  }
+  if (aqmfOutputs[HL] < -8388608) {
+    aqmfOutputs[HL] = -8388608;
+  }
+
+  aqmfOutputs[HH] = filterOutputs[HH] - predVals[HH];
+  if (aqmfOutputs[HH] > 8388607) {
+    aqmfOutputs[HH] = 8388607;
+  }
+  if (aqmfOutputs[HH] < -8388608) {
+    aqmfOutputs[HH] = -8388608;
+  }
+
+  (Qmf_St->QmfO_pt) = lc_QmfO_pt;
+  (Qmf_St->QmfI_pt) = lc_QmfI_pt;
+}
+
+#endif  // QMF_H
diff --git a/system/embdrv/encoder_for_aptxhd/src/QmfConv.c b/system/embdrv/encoder_for_aptxhd/src/QmfConv.c
new file mode 100644
index 0000000..5312f65
--- /dev/null
+++ b/system/embdrv/encoder_for_aptxhd/src/QmfConv.c
@@ -0,0 +1,367 @@
+/**
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/*------------------------------------------------------------------------------
+ *
+ *  This file includes convolution functions required for the Qmf.
+ *
+ *----------------------------------------------------------------------------*/
+
+#include "Qmf.h"
+
+void AsmQmfConvO_HD(const int32_t* p1dl_buffPtr, const int32_t* p2dl_buffPtr,
+                    const int32_t* coeffPtr, int32_t* convSumDiff) {
+  /* Since all manipulated data are "int16_t" it is possible to
+   * reduce the number of loads by using int32_t type and manipulating
+   * pairs of data
+   */
+
+  int32_t acc;
+  // Manual inlining as IAR compiler does not seem to do it itself...
+  // WARNING: This inlining assumes that m_qmfDelayLineLength == 16
+  int32_t tmp_round0;
+  int64_t local_acc0;
+  int64_t local_acc1;
+
+  int32_t coeffVal0;
+  int32_t coeffVal1;
+  int32_t data0;
+  int32_t data1;
+  int32_t data2;
+  int32_t data3;
+  int32_t phaseConv[2];
+  int32_t convSum;
+  int32_t convDiff;
+
+  coeffVal0 = (*(coeffPtr));
+  coeffVal1 = (*(coeffPtr + 1));
+  data0 = (*(p1dl_buffPtr));
+  data1 = (*(p2dl_buffPtr));
+  data2 = (*(p1dl_buffPtr - 1));
+  data3 = (*(p2dl_buffPtr + 1));
+
+  local_acc0 = ((int64_t)(coeffVal0) * (int64_t)data0);
+  local_acc1 = ((int64_t)(coeffVal0) * (int64_t)data1);
+  local_acc0 += ((int64_t)(coeffVal1) * (int64_t)data2);
+  local_acc1 += ((int64_t)(coeffVal1) * (int64_t)data3);
+
+  coeffVal0 = (*(coeffPtr + 2));
+  coeffVal1 = (*(coeffPtr + 3));
+  data0 = (*(p1dl_buffPtr - 2));
+  data1 = (*(p2dl_buffPtr + 2));
+  data2 = (*(p1dl_buffPtr - 3));
+  data3 = (*(p2dl_buffPtr + 3));
+
+  local_acc0 += ((int64_t)(coeffVal0) * (int64_t)data0);
+  local_acc1 += ((int64_t)(coeffVal0) * (int64_t)data1);
+  local_acc0 += ((int64_t)(coeffVal1) * (int64_t)data2);
+  local_acc1 += ((int64_t)(coeffVal1) * (int64_t)data3);
+
+  coeffVal0 = (*(coeffPtr + 4));
+  coeffVal1 = (*(coeffPtr + 5));
+  data0 = (*(p1dl_buffPtr - 4));
+  data1 = (*(p2dl_buffPtr + 4));
+  data2 = (*(p1dl_buffPtr - 5));
+  data3 = (*(p2dl_buffPtr + 5));
+
+  local_acc0 += ((int64_t)(coeffVal0) * (int64_t)data0);
+  local_acc1 += ((int64_t)(coeffVal0) * (int64_t)data1);
+  local_acc0 += ((int64_t)(coeffVal1) * (int64_t)data2);
+  local_acc1 += ((int64_t)(coeffVal1) * (int64_t)data3);
+
+  coeffVal0 = (*(coeffPtr + 6));
+  coeffVal1 = (*(coeffPtr + 7));
+  data0 = (*(p1dl_buffPtr - 6));
+  data1 = (*(p2dl_buffPtr + 6));
+  data2 = (*(p1dl_buffPtr - 7));
+  data3 = (*(p2dl_buffPtr + 7));
+
+  local_acc0 += ((int64_t)(coeffVal0) * (int64_t)data0);
+  local_acc1 += ((int64_t)(coeffVal0) * (int64_t)data1);
+  local_acc0 += ((int64_t)(coeffVal1) * (int64_t)data2);
+  local_acc1 += ((int64_t)(coeffVal1) * (int64_t)data3);
+
+  coeffVal0 = (*(coeffPtr + 8));
+  coeffVal1 = (*(coeffPtr + 9));
+  data0 = (*(p1dl_buffPtr - 8));
+  data1 = (*(p2dl_buffPtr + 8));
+  data2 = (*(p1dl_buffPtr - 9));
+  data3 = (*(p2dl_buffPtr + 9));
+
+  local_acc0 += ((int64_t)(coeffVal0) * (int64_t)data0);
+  local_acc1 += ((int64_t)(coeffVal0) * (int64_t)data1);
+  local_acc0 += ((int64_t)(coeffVal1) * (int64_t)data2);
+  local_acc1 += ((int64_t)(coeffVal1) * (int64_t)data3);
+
+  coeffVal0 = (*(coeffPtr + 10));
+  coeffVal1 = (*(coeffPtr + 11));
+  data0 = (*(p1dl_buffPtr - 10));
+  data1 = (*(p2dl_buffPtr + 10));
+  data2 = (*(p1dl_buffPtr - 11));
+  data3 = (*(p2dl_buffPtr + 11));
+
+  local_acc0 += ((int64_t)(coeffVal0) * (int64_t)data0);
+  local_acc1 += ((int64_t)(coeffVal0) * (int64_t)data1);
+  local_acc0 += ((int64_t)(coeffVal1) * (int64_t)data2);
+  local_acc1 += ((int64_t)(coeffVal1) * (int64_t)data3);
+
+  coeffVal0 = (*(coeffPtr + 12));
+  coeffVal1 = (*(coeffPtr + 13));
+  data0 = (*(p1dl_buffPtr - 12));
+  data1 = (*(p2dl_buffPtr + 12));
+  data2 = (*(p1dl_buffPtr - 13));
+  data3 = (*(p2dl_buffPtr + 13));
+
+  local_acc0 += ((int64_t)(coeffVal0) * (int64_t)data0);
+  local_acc1 += ((int64_t)(coeffVal0) * (int64_t)data1);
+  local_acc0 += ((int64_t)(coeffVal1) * (int64_t)data2);
+  local_acc1 += ((int64_t)(coeffVal1) * (int64_t)data3);
+
+  coeffVal0 = (*(coeffPtr + 14));
+  coeffVal1 = (*(coeffPtr + 15));
+  data0 = (*(p1dl_buffPtr - 14));
+  data1 = (*(p2dl_buffPtr + 14));
+  data2 = (*(p1dl_buffPtr - 15));
+  data3 = (*(p2dl_buffPtr + 15));
+
+  local_acc0 += ((int64_t)(coeffVal0) * (int64_t)data0);
+  local_acc1 += ((int64_t)(coeffVal0) * (int64_t)data1);
+  local_acc0 += ((int64_t)(coeffVal1) * (int64_t)data2);
+  local_acc1 += ((int64_t)(coeffVal1) * (int64_t)data3);
+
+  tmp_round0 = (int32_t)local_acc0;
+
+  local_acc0 += 0x00400000L;
+  acc = (int32_t)(local_acc0 >> 23);
+
+  if ((((tmp_round0 << 8) ^ 0x40000000) == 0)) {
+    acc--;
+  }
+
+  if (acc > 8388607) {
+    acc = 8388607;
+  }
+  if (acc < -8388608) {
+    acc = -8388608;
+  }
+
+  phaseConv[0] = acc;
+
+  tmp_round0 = (int32_t)local_acc1;
+
+  local_acc1 += 0x00400000L;
+  acc = (int32_t)(local_acc1 >> 23);
+  if ((((tmp_round0 << 8) ^ 0x40000000) == 0)) {
+    acc--;
+  }
+
+  if (acc > 8388607) {
+    acc = 8388607;
+  }
+  if (acc < -8388608) {
+    acc = -8388608;
+  }
+
+  phaseConv[1] = acc;
+
+  convSum = phaseConv[1] + phaseConv[0];
+  if (convSum > 8388607) {
+    convSum = 8388607;
+  }
+  if (convSum < -8388608) {
+    convSum = -8388608;
+  }
+
+  convDiff = phaseConv[1] - phaseConv[0];
+  if (convDiff > 8388607) {
+    convDiff = 8388607;
+  }
+  if (convDiff < -8388608) {
+    convDiff = -8388608;
+  }
+
+  *(convSumDiff) = convSum;
+  *(convSumDiff + 2) = convDiff;
+}
+
+void AsmQmfConvI_HD(const int32_t* p1dl_buffPtr, const int32_t* p2dl_buffPtr,
+                    const int32_t* coeffPtr, int32_t* filterOutputs) {
+  int32_t acc;
+  // WARNING: This inlining assumes that m_qmfDelayLineLength == 16
+  int32_t tmp_round0;
+  int64_t local_acc0;
+  int64_t local_acc1;
+
+  int32_t coeffVal0;
+  int32_t coeffVal1;
+  int32_t data0;
+  int32_t data1;
+  int32_t data2;
+  int32_t data3;
+  int32_t phaseConv[2];
+  int32_t convSum;
+  int32_t convDiff;
+
+  coeffVal0 = (*(coeffPtr));
+  coeffVal1 = (*(coeffPtr + 1));
+  data0 = (*(p1dl_buffPtr));
+  data1 = (*(p2dl_buffPtr));
+  data2 = (*(p1dl_buffPtr - 1));
+  data3 = (*(p2dl_buffPtr + 1));
+
+  local_acc0 = ((int64_t)(coeffVal0)*data0);
+  local_acc1 = ((int64_t)(coeffVal0)*data1);
+  local_acc0 += ((int64_t)(coeffVal1)*data2);
+  local_acc1 += ((int64_t)(coeffVal1)*data3);
+
+  coeffVal0 = (*(coeffPtr + 2));
+  coeffVal1 = (*(coeffPtr + 3));
+  data0 = (*(p1dl_buffPtr - 2));
+  data1 = (*(p2dl_buffPtr + 2));
+  data2 = (*(p1dl_buffPtr - 3));
+  data3 = (*(p2dl_buffPtr + 3));
+
+  local_acc0 += ((int64_t)(coeffVal0)*data0);
+  local_acc1 += ((int64_t)(coeffVal0)*data1);
+  local_acc0 += ((int64_t)(coeffVal1)*data2);
+  local_acc1 += ((int64_t)(coeffVal1)*data3);
+
+  coeffVal0 = (*(coeffPtr + 4));
+  coeffVal1 = (*(coeffPtr + 5));
+  data0 = (*(p1dl_buffPtr - 4));
+  data1 = (*(p2dl_buffPtr + 4));
+  data2 = (*(p1dl_buffPtr - 5));
+  data3 = (*(p2dl_buffPtr + 5));
+
+  local_acc0 += ((int64_t)(coeffVal0)*data0);
+  local_acc1 += ((int64_t)(coeffVal0)*data1);
+  local_acc0 += ((int64_t)(coeffVal1)*data2);
+  local_acc1 += ((int64_t)(coeffVal1)*data3);
+
+  coeffVal0 = (*(coeffPtr + 6));
+  coeffVal1 = (*(coeffPtr + 7));
+  data0 = (*(p1dl_buffPtr - 6));
+  data1 = (*(p2dl_buffPtr + 6));
+  data2 = (*(p1dl_buffPtr - 7));
+  data3 = (*(p2dl_buffPtr + 7));
+
+  local_acc0 += ((int64_t)(coeffVal0)*data0);
+  local_acc1 += ((int64_t)(coeffVal0)*data1);
+  local_acc0 += ((int64_t)(coeffVal1)*data2);
+  local_acc1 += ((int64_t)(coeffVal1)*data3);
+
+  coeffVal0 = (*(coeffPtr + 8));
+  coeffVal1 = (*(coeffPtr + 9));
+  data0 = (*(p1dl_buffPtr - 8));
+  data1 = (*(p2dl_buffPtr + 8));
+  data2 = (*(p1dl_buffPtr - 9));
+  data3 = (*(p2dl_buffPtr + 9));
+
+  local_acc0 += ((int64_t)(coeffVal0)*data0);
+  local_acc1 += ((int64_t)(coeffVal0)*data1);
+  local_acc0 += ((int64_t)(coeffVal1)*data2);
+  local_acc1 += ((int64_t)(coeffVal1)*data3);
+
+  coeffVal0 = (*(coeffPtr + 10));
+  coeffVal1 = (*(coeffPtr + 11));
+  data0 = (*(p1dl_buffPtr - 10));
+  data1 = (*(p2dl_buffPtr + 10));
+  data2 = (*(p1dl_buffPtr - 11));
+  data3 = (*(p2dl_buffPtr + 11));
+
+  local_acc0 += ((int64_t)(coeffVal0)*data0);
+  local_acc1 += ((int64_t)(coeffVal0)*data1);
+  local_acc0 += ((int64_t)(coeffVal1)*data2);
+  local_acc1 += ((int64_t)(coeffVal1)*data3);
+
+  coeffVal0 = (*(coeffPtr + 12));
+  coeffVal1 = (*(coeffPtr + 13));
+  data0 = (*(p1dl_buffPtr - 12));
+  data1 = (*(p2dl_buffPtr + 12));
+  data2 = (*(p1dl_buffPtr - 13));
+  data3 = (*(p2dl_buffPtr + 13));
+
+  local_acc0 += ((int64_t)(coeffVal0)*data0);
+  local_acc1 += ((int64_t)(coeffVal0)*data1);
+  local_acc0 += ((int64_t)(coeffVal1)*data2);
+  local_acc1 += ((int64_t)(coeffVal1)*data3);
+
+  coeffVal0 = (*(coeffPtr + 14));
+  coeffVal1 = (*(coeffPtr + 15));
+  data0 = (*(p1dl_buffPtr - 14));
+  data1 = (*(p2dl_buffPtr + 14));
+  data2 = (*(p1dl_buffPtr - 15));
+  data3 = (*(p2dl_buffPtr + 15));
+
+  local_acc0 += ((int64_t)(coeffVal0)*data0);
+  local_acc1 += ((int64_t)(coeffVal0)*data1);
+  local_acc0 += ((int64_t)(coeffVal1)*data2);
+  local_acc1 += ((int64_t)(coeffVal1)*data3);
+
+  tmp_round0 = (int32_t)local_acc0;
+
+  local_acc0 += 0x00400000L;
+  acc = (int32_t)(local_acc0 >> 23);
+
+  if ((((tmp_round0 << 8) ^ 0x40000000) == 0)) {
+    acc--;
+  }
+
+  if (acc > 8388607) {
+    acc = 8388607;
+  }
+  if (acc < -8388608) {
+    acc = -8388608;
+  }
+
+  phaseConv[0] = acc;
+
+  tmp_round0 = (int32_t)local_acc1;
+
+  local_acc1 += 0x00400000L;
+  acc = (int32_t)(local_acc1 >> 23);
+  if ((((tmp_round0 << 8) ^ 0x40000000) == 0)) {
+    acc--;
+  }
+
+  if (acc > 8388607) {
+    acc = 8388607;
+  }
+  if (acc < -8388608) {
+    acc = -8388608;
+  }
+
+  phaseConv[1] = acc;
+
+  convSum = phaseConv[1] + phaseConv[0];
+  if (convSum > 8388607) {
+    convSum = 8388607;
+  }
+  if (convSum < -8388608) {
+    convSum = -8388608;
+  }
+
+  *(filterOutputs) = convSum;
+
+  convDiff = phaseConv[1] - phaseConv[0];
+  if (convDiff > 8388607) {
+    convDiff = 8388607;
+  }
+  if (convDiff < -8388608) {
+    convDiff = -8388608;
+  }
+
+  *(filterOutputs + 1) = convDiff;
+}
diff --git a/system/embdrv/encoder_for_aptxhd/src/QuantiseDifference.c b/system/embdrv/encoder_for_aptxhd/src/QuantiseDifference.c
new file mode 100644
index 0000000..cac8bf3
--- /dev/null
+++ b/system/embdrv/encoder_for_aptxhd/src/QuantiseDifference.c
@@ -0,0 +1,834 @@
+/**
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "Quantiser.h"
+
+XBT_INLINE_ int32_t BsearchLL(const int32_t absDiffSignalShifted,
+                              const int32_t delta,
+                              const int32_t* dqbitTablePrt) {
+  int32_t qCode = 0;
+  reg64_t tmp_acc;
+  int32_t tmp = 0;
+  int32_t lc_delta = delta << 8;
+
+  tmp_acc.s64 = (int64_t)lc_delta * (int64_t)dqbitTablePrt[128];
+  tmp_acc.s32.h -= absDiffSignalShifted;
+  tmp = tmp_acc.s32.h | (tmp_acc.u32.l >> 1);
+  if (tmp <= 0) {
+    qCode = 128;
+  }
+
+  tmp_acc.s64 = (int64_t)lc_delta * (int64_t)dqbitTablePrt[qCode + 64];
+  tmp_acc.s32.h -= absDiffSignalShifted;
+  tmp = tmp_acc.s32.h | (tmp_acc.u32.l >> 1);
+  if (tmp <= 0) {
+    qCode += 64;
+  }
+
+  tmp_acc.s64 = (int64_t)lc_delta * (int64_t)dqbitTablePrt[qCode + 32];
+  tmp_acc.s32.h -= absDiffSignalShifted;
+  tmp = tmp_acc.s32.h | (tmp_acc.u32.l >> 1);
+  if (tmp <= 0) {
+    qCode += 32;
+  }
+
+  tmp_acc.s64 = (int64_t)lc_delta * (int64_t)dqbitTablePrt[qCode + 16];
+  tmp_acc.s32.h -= absDiffSignalShifted;
+  tmp = tmp_acc.s32.h | (tmp_acc.u32.l >> 1);
+  if (tmp <= 0) {
+    qCode += 16;
+  }
+  tmp_acc.s64 = (int64_t)lc_delta * (int64_t)dqbitTablePrt[qCode + 8];
+  tmp_acc.s32.h -= absDiffSignalShifted;
+  tmp = tmp_acc.s32.h | (tmp_acc.u32.l >> 1);
+  if (tmp <= 0) {
+    qCode += 8;
+  }
+
+  tmp_acc.s64 = (int64_t)lc_delta * (int64_t)dqbitTablePrt[qCode + 4];
+  tmp_acc.s32.h -= absDiffSignalShifted;
+  tmp = tmp_acc.s32.h | (tmp_acc.u32.l >> 1);
+  if (tmp <= 0) {
+    qCode += 4;
+  }
+
+  tmp_acc.s64 = (int64_t)lc_delta * (int64_t)dqbitTablePrt[qCode + 2];
+  tmp_acc.s32.h -= absDiffSignalShifted;
+  tmp = tmp_acc.s32.h | (tmp_acc.u32.l >> 1);
+  if (tmp <= 0) {
+    qCode += 2;
+  }
+
+  tmp_acc.s64 = (int64_t)lc_delta * (int64_t)dqbitTablePrt[qCode + 1];
+  tmp_acc.s32.h -= absDiffSignalShifted;
+  tmp = tmp_acc.s32.h | (tmp_acc.u32.l >> 1);
+  if (tmp <= 0) {
+    qCode++;
+  }
+
+  return (qCode);
+}
+
+XBT_INLINE_ int32_t BsearchHL(const int32_t absDiffSignalShifted,
+                              const int32_t delta,
+                              const int32_t* dqbitTablePrt) {
+  int32_t qCode = 0;
+  reg64_t tmp_acc;
+  int32_t tmp = 0;
+  int32_t lc_delta = delta << 8;
+
+  tmp_acc.s64 = (int64_t)lc_delta * (int64_t)dqbitTablePrt[4];
+  tmp_acc.s32.h -= absDiffSignalShifted;
+  tmp = tmp_acc.s32.h | (tmp_acc.u32.l >> 1);
+  if (tmp <= 0) {
+    qCode = 4;
+  }
+
+  tmp_acc.s64 = (int64_t)lc_delta * (int64_t)dqbitTablePrt[qCode + 2];
+  tmp_acc.s32.h -= absDiffSignalShifted;
+  tmp = tmp_acc.s32.h | (tmp_acc.u32.l >> 1);
+  if (tmp <= 0) {
+    qCode += 2;
+  }
+
+  tmp_acc.s64 = (int64_t)lc_delta * (int64_t)dqbitTablePrt[qCode + 1];
+  tmp_acc.s32.h -= absDiffSignalShifted;
+  tmp = tmp_acc.s32.h | (tmp_acc.u32.l >> 1);
+  if (tmp <= 0) {
+    qCode++;
+  }
+
+  return (qCode);
+}
+
+XBT_INLINE_ int32_t BsearchHH(const int32_t absDiffSignalShifted,
+                              const int32_t delta,
+                              const int32_t* dqbitTablePrt) {
+  int32_t qCode = 0;
+  reg64_t tmp_acc;
+  int32_t tmp = 0;
+  int32_t lc_delta = delta << 8;
+
+  tmp_acc.s64 = (int64_t)lc_delta * (int64_t)dqbitTablePrt[8];
+  tmp_acc.s32.h -= absDiffSignalShifted;
+  tmp = tmp_acc.s32.h | (tmp_acc.u32.l >> 1);
+  if (tmp <= 0) {
+    qCode = 8;
+  }
+
+  tmp_acc.s64 = (int64_t)lc_delta * (int64_t)dqbitTablePrt[qCode + 4];
+  tmp_acc.s32.h -= absDiffSignalShifted;
+  tmp = tmp_acc.s32.h | (tmp_acc.u32.l >> 1);
+  if (tmp <= 0) {
+    qCode += 4;
+  }
+
+  tmp_acc.s64 = (int64_t)lc_delta * (int64_t)dqbitTablePrt[qCode + 2];
+  tmp_acc.s32.h -= absDiffSignalShifted;
+  tmp = tmp_acc.s32.h | (tmp_acc.u32.l >> 1);
+  if (tmp <= 0) {
+    qCode += 2;
+  }
+
+  tmp_acc.s64 = (int64_t)lc_delta * (int64_t)dqbitTablePrt[qCode + 1];
+  tmp_acc.s32.h -= absDiffSignalShifted;
+  tmp = tmp_acc.s32.h | (tmp_acc.u32.l >> 1);
+  if (tmp <= 0) {
+    qCode++;
+  }
+
+  return (qCode);
+}
+
+void quantiseDifference_HDHL(const int32_t diffSignal, const int32_t ditherVal,
+                             const int32_t delta, Quantiser_data* qdata_pt) {
+  int32_t absDiffSignal = 0;
+  int32_t absDiffSignalShifted = 0;
+  int32_t index = 0;
+  int32_t dithSquared = 0;
+  int32_t minusLambdaD = 0;
+  int32_t acc = 0;
+  int32_t threshDiff = 0;
+  reg64_t tmp_acc;
+  reg64_t tmp_reg64;
+  int32_t tmp_accL = 0;
+  int32_t tmp_qCode = 0;
+  int32_t tmp_altQcode = 0;
+  uint32_t tmp_round0 = 0;
+  int32_t _delta = 0;
+
+  /* Form the absolute value of the difference signal and maintain a version
+   * that is right-shifted 4 places for delta scaling. */
+  absDiffSignal = -diffSignal;
+  if (diffSignal >= 0) {
+    absDiffSignal = diffSignal;
+  }
+  absDiffSignal = ssat24(absDiffSignal);
+  absDiffSignalShifted = absDiffSignal >> deltaScale;
+
+  /* Binary search for the quantised code. This search terminates with the
+   * table index of the LARGEST threshold table value for which
+   * absDiffSignalShifted >= (delta * threshold)
+   */
+  index =
+      BsearchHL(absDiffSignalShifted, delta, qdata_pt->thresholdTablePtr_sl1);
+
+  /* We actually wanted the SMALLEST magnitude quantised code for which
+   * absDiffSignalShifted < (delta * threshold)
+   * i.e. the code with the next highest magnitude than the one we actually
+   * found. We could add +1 to the code magnitude to do this, but we need to
+   * subtract 1 from the code magnitude to compensate for the "phantom
+   * element" at the base of the quantisation table. These two effects cancel
+   * out, so we leave the value of code alone. However, we need to form code+1
+   * to get the proper index into the both the threshold and dither tables,
+   * since we must skip over the phantom element at the base. */
+  qdata_pt->qCode = index;
+
+  /* Square the dither and get the value back from the ALU
+   * (saturated/rounded). */
+  tmp_acc.s64 = ((int64_t)ditherVal * (int64_t)ditherVal);
+
+  acc = tmp_acc.s32.h;
+  tmp_round0 = (uint32_t)acc << 8;
+
+  acc = (acc >> 6) + 1;
+  acc >>= 1;
+  if (tmp_round0 == 0x40000000L) {
+    acc--;
+  }
+  acc = ssat24(acc);
+
+  dithSquared = acc;
+
+  /* Form the negative difference of the dither values at index and index-1.
+   * Load the accumulator with this value divided by 2. Ensure saturation is
+   * applied to the difference calculation. */
+  minusLambdaD = qdata_pt->minusLambdaDTable[index];
+
+  tmp_accL = (1 << 23) - dithSquared;
+  tmp_acc.s64 = (int64_t)tmp_accL * minusLambdaD;
+
+  tmp_round0 = tmp_acc.s32.l << 8;
+
+  acc = (tmp_acc.u32.l >> 22) | (tmp_acc.s32.h << 10);
+  acc++;
+  acc >>= 1;
+  if (tmp_round0 == 0x40000000L) {
+    acc--;
+  }
+
+  /* Add the threshold table values at index and index-1 to the accumulated
+   * value. */
+  acc += qdata_pt->thresholdTablePtr_sl1[index + 1] >> 1;
+  //// worst case value for acc = 0x000d3e08 + 0x43E1DB = 511FE3
+  acc += qdata_pt->thresholdTablePtr_sl1[index] >> 1;
+  //// worst case value for acc = 0x511FE3 + 0x362FEC = 874FCF
+
+  // saturation required
+  acc = ssat24(acc);
+
+  /* Form the threshold table difference at index and index-1. Ensure
+   * saturation is applied to the difference calculation. */
+  threshDiff = qdata_pt->thresholdTablePtr_sl1[index + 1] -
+               qdata_pt->thresholdTablePtr_sl1[index];
+
+  /* Based on the sign of the difference signal, either add or subtract the
+   * threshold table difference from the accumulated value. Recover the final
+   * accumulated value (saturated/rounded) */
+  if (diffSignal < 0) {
+    threshDiff = -threshDiff;
+  }
+  tmp_reg64.s64 = ((int64_t)ditherVal * (int64_t)threshDiff);
+
+  tmp_reg64.s32.h += acc;
+  acc = tmp_reg64.s32.h;
+
+  if (tmp_reg64.u32.l >= 0x80000000) {
+    acc++;
+  }
+  tmp_round0 = (tmp_reg64.u32.l >> 1) | (tmp_reg64.s32.h << 31);
+
+  acc = ssat24(acc);
+
+  if (tmp_round0 == 0x40000000L) {
+    acc--;
+  }
+  _delta = -delta << 8;
+
+  acc = (int32_t)((uint32_t)acc << 4);
+
+  /* Form (absDiffSignal * 0.125) - (acc * delta), which is the final distance
+   * signal used to determine if dithering alters the quantised code value or
+   * not. */
+  // worst case value for delta is 0x7d400
+  tmp_reg64.s64 = ((int64_t)acc * (int64_t)_delta);
+  tmp_reg64.s32.h += absDiffSignal;
+  tmp_round0 = (tmp_reg64.u32.l >> 4) | (tmp_reg64.s32.h << 28);
+  acc = tmp_reg64.s32.h + (1 << 2);
+  acc >>= 3;
+  if (tmp_round0 == 0x40000000L) {
+    acc--;
+  }
+
+  tmp_qCode = qdata_pt->qCode;
+  tmp_altQcode = tmp_qCode - 1;
+  /* Check the sign of the distance penalty. Get the sign from the
+   * full-precision accumulator, as done in the Kalimba code. */
+  if (tmp_reg64.s32.h < 0) {
+    /* The distance is -ve. The optimum code needs decremented by 1 and the
+     * alternative code is 1 greater than this. Get the rounded version of the
+     * -ve distance penalty and negate this (form distance magnitude) before
+     *  writing the value out */
+    tmp_qCode = tmp_altQcode;
+    tmp_altQcode++;
+    acc = -acc;
+  }
+
+  qdata_pt->distPenalty = acc;
+  /* If the difference signal is negative, bitwise invert the code (restores
+   * sign to the magnitude). */
+  if (diffSignal < 0) {
+    tmp_qCode = ~tmp_qCode;
+    tmp_altQcode = ~tmp_altQcode;
+  }
+  qdata_pt->altQcode = tmp_altQcode;
+  qdata_pt->qCode = tmp_qCode;
+}
+
+void quantiseDifference_HDHH(const int32_t diffSignal, const int32_t ditherVal,
+                             const int32_t delta, Quantiser_data* qdata_pt) {
+  int32_t absDiffSignal;
+  int32_t absDiffSignalShifted;
+  int32_t index;
+  int32_t dithSquared;
+  int32_t minusLambdaD;
+  int32_t acc;
+  int32_t threshDiff;
+  reg64_t tmp_acc;
+  reg64_t tmp_reg64;
+  int32_t tmp_accL;
+  int32_t tmp_qCode;
+  int32_t tmp_altQcode;
+  uint32_t tmp_round0;
+  int32_t _delta;
+
+  /* Form the absolute value of the difference signal and maintain a version
+   * that is right-shifted 4 places for delta scaling. */
+  absDiffSignal = -diffSignal;
+  if (diffSignal >= 0) {
+    absDiffSignal = diffSignal;
+  }
+  absDiffSignal = ssat24(absDiffSignal);
+  absDiffSignalShifted = absDiffSignal >> deltaScale;
+
+  /* Binary search for the quantised code. This search terminates with the
+   * table index of the LARGEST threshold table value for which
+   * absDiffSignalShifted >= (delta * threshold)
+   */
+  index =
+      BsearchHH(absDiffSignalShifted, delta, qdata_pt->thresholdTablePtr_sl1);
+
+  /* We actually wanted the SMALLEST magnitude quantised code for which
+   * absDiffSignalShifted < (delta * threshold)
+   * i.e. the code with the next highest magnitude than the one we actually
+   * found. We could add +1 to the code magnitude to do this, but we need to
+   * subtract 1 from the code magnitude to compensate for the "phantom
+   * element" at the base of the quantisation table. These two effects cancel
+   * out, so we leave the value of code alone. However, we need to form code+1
+   * to get the proper index into the both the threshold and dither tables,
+   * since we must skip over the phantom element at the base. */
+  qdata_pt->qCode = index;
+
+  /* Square the dither and get the value back from the ALU
+   * (saturated/rounded). */
+  tmp_acc.s64 = ((int64_t)ditherVal * (int64_t)ditherVal);
+
+  acc = tmp_acc.s32.h;
+  tmp_round0 = (uint32_t)acc << 8;
+
+  acc = (acc >> 6) + 1;
+  acc >>= 1;
+  if (tmp_round0 == 0x40000000L) {
+    acc--;
+  }
+
+  acc = ssat24(acc);
+
+  dithSquared = acc;
+
+  /* Form the negative difference of the dither values at index and index-1.
+   * Load the accumulator with this value divided by 2. Ensure saturation is
+   * applied to the difference calculation. */
+  minusLambdaD = qdata_pt->minusLambdaDTable[index];
+
+  tmp_accL = (1 << 23) - dithSquared;
+  tmp_acc.s64 = (int64_t)tmp_accL * minusLambdaD;
+
+  tmp_round0 = tmp_acc.s32.l << 8;
+
+  acc = (tmp_acc.u32.l >> 22) | (tmp_acc.s32.h << 10);
+  acc++;
+  acc >>= 1;
+  if (tmp_round0 == 0x40000000L) {
+    acc--;
+  }
+
+  /* Add the threshold table values at index and index-1 to the accumulated
+   * value. */
+  acc += qdata_pt->thresholdTablePtr_sl1[index + 1] >> 1;
+  //// worst case value for acc = 0x000d3e08 + 0x43E1DB = 511FE3
+  acc += qdata_pt->thresholdTablePtr_sl1[index] >> 1;
+  //// worst case value for acc = 0x511FE3 + 0x362FEC = 874FCF
+
+  // saturation required
+  acc = ssat24(acc);
+
+  /* Form the threshold table difference at index and index-1. Ensure
+   * saturation is applied to the difference calculation. */
+  threshDiff = qdata_pt->thresholdTablePtr_sl1[index + 1] -
+               qdata_pt->thresholdTablePtr_sl1[index];
+
+  /* Based on the sign of the difference signal, either add or subtract the
+   * threshold table difference from the accumulated value. Recover the final
+   * accumulated value (saturated/rounded) */
+  if (diffSignal < 0) {
+    threshDiff = -threshDiff;
+  }
+  tmp_reg64.s64 = ((int64_t)ditherVal * (int64_t)threshDiff);
+  tmp_reg64.s32.h += acc;
+  acc = tmp_reg64.s32.h;
+
+  if (tmp_reg64.u32.l >= 0x80000000) {
+    acc++;
+  }
+  tmp_round0 = (tmp_reg64.u32.l >> 1) | (tmp_reg64.s32.h << 31);
+
+  acc = ssat24(acc);
+
+  if (tmp_round0 == 0x40000000L) {
+    acc--;
+  }
+  _delta = -delta << 8;
+
+  acc = (int32_t)((uint32_t)acc << 4);
+
+  /* Form (absDiffSignal * 0.125) - (acc * delta), which is the final distance
+   * signal used to determine if dithering alters the quantised code value or
+   * not. */
+  // worst case value for delta is 0x7d400
+  tmp_reg64.s64 = ((int64_t)acc * (int64_t)_delta);
+  tmp_reg64.s32.h += absDiffSignal;
+  tmp_round0 = (tmp_reg64.u32.l >> 4) | (tmp_reg64.s32.h << 28);
+  acc = tmp_reg64.s32.h + (1 << 2);
+  acc >>= 3;
+  if (tmp_round0 == 0x40000000L) {
+    acc--;
+  }
+
+  tmp_qCode = qdata_pt->qCode;
+  tmp_altQcode = tmp_qCode - 1;
+  /* Check the sign of the distance penalty. Get the sign from the
+   * full-precision accumulator, as done in the Kalimba code. */
+  if (tmp_reg64.s32.h < 0) {
+    /* The distance is -ve. The optimum code needs decremented by 1 and the
+     * alternative code is 1 greater than this. Get the rounded version of the
+     * -ve distance penalty and negate this (form distance magnitude) before
+     *  writing the value out */
+    tmp_qCode = tmp_altQcode;
+    tmp_altQcode++;
+    acc = -acc;
+  }
+
+  qdata_pt->distPenalty = acc;
+  /* If the difference signal is negative, bitwise invert the code (restores
+   * sign to the magnitude). */
+  if (diffSignal < 0) {
+    tmp_qCode = ~tmp_qCode;
+    tmp_altQcode = ~tmp_altQcode;
+  }
+  qdata_pt->altQcode = tmp_altQcode;
+  qdata_pt->qCode = tmp_qCode;
+}
+
+void quantiseDifference_HDLL(const int32_t diffSignal, const int32_t ditherVal,
+                             const int32_t delta, Quantiser_data* qdata_pt) {
+  int32_t absDiffSignal;
+  int32_t absDiffSignalShifted;
+  int32_t index;
+  int32_t dithSquared;
+  int32_t minusLambdaD;
+  int32_t acc;
+  int32_t threshDiff;
+  reg64_t tmp_acc;
+  reg64_t tmp_reg64;
+  int32_t tmp_accL;
+  int32_t tmp_qCode;
+  int32_t tmp_altQcode;
+  uint32_t tmp_round0;
+  int32_t _delta;
+
+  /* Form the absolute value of the difference signal and maintain a version
+   * that is right-shifted 4 places for delta scaling. */
+  absDiffSignal = -diffSignal;
+  if (diffSignal >= 0) {
+    absDiffSignal = diffSignal;
+  }
+  absDiffSignal = ssat24(absDiffSignal);
+  absDiffSignalShifted = absDiffSignal >> deltaScale;
+
+  /* Binary search for the quantised code. This search terminates with the
+   * table index of the LARGEST threshold table value for which
+   * absDiffSignalShifted >= (delta * threshold)
+   */
+  index =
+      BsearchLL(absDiffSignalShifted, delta, qdata_pt->thresholdTablePtr_sl1);
+
+  /* We actually wanted the SMALLEST magnitude quantised code for which
+   * absDiffSignalShifted < (delta * threshold)
+   * i.e. the code with the next highest magnitude than the one we actually
+   * found. We could add +1 to the code magnitude to do this, but we need to
+   * subtract 1 from the code magnitude to compensate for the "phantom
+   * element" at the base of the quantisation table. These two effects cancel
+   * out, so we leave the value of code alone. However, we need to form code+1
+   * to get the proper index into the both the threshold and dither tables,
+   * since we must skip over the phantom element at the base. */
+  qdata_pt->qCode = index;
+
+  /* Square the dither and get the value back from the ALU
+   * (saturated/rounded). */
+
+  tmp_acc.s64 = ((int64_t)ditherVal * (int64_t)ditherVal);
+
+  acc = tmp_acc.s32.h;
+  tmp_round0 = (uint32_t)acc << 8;
+
+  acc = (acc >> 6) + 1;
+  acc >>= 1;
+  if (tmp_round0 == 0x40000000L) {
+    acc--;
+  }
+
+  acc = ssat24(acc);
+
+  dithSquared = acc;
+
+  /* Form the negative difference of the dither values at index and index-1.
+   * Load the accumulator with this value divided by 2. Ensure saturation is
+   * applied to the difference calculation. */
+  minusLambdaD = qdata_pt->minusLambdaDTable[index];
+
+  tmp_accL = (1 << 23) - dithSquared;
+  tmp_acc.s64 = (int64_t)tmp_accL * minusLambdaD;
+
+  tmp_round0 = tmp_acc.s32.l << 8;
+
+  acc = (tmp_acc.u32.l >> 22) | (tmp_acc.s32.h << 10);
+  acc++;
+  acc >>= 1;
+  if (tmp_round0 == 0x40000000L) {
+    acc--;
+  }
+
+  /* Add the threshold table values at index and index-1 to the accumulated
+   * value. */
+
+  acc += qdata_pt->thresholdTablePtr_sl1[index + 1] >> 1;
+  //// worst case value for acc = 0x000d3e08 + 0x43E1DB = 511FE3
+  acc += qdata_pt->thresholdTablePtr_sl1[index] >> 1;
+  //// worst case value for acc = 0x511FE3 + 0x362FEC = 874FCF
+  // saturation required
+  acc = ssat24(acc);
+
+  /* Form the threshold table difference at index and index-1. Ensure
+   * saturation is applied to the difference calculation. */
+  threshDiff = qdata_pt->thresholdTablePtr_sl1[index + 1] -
+               qdata_pt->thresholdTablePtr_sl1[index];
+
+  /* Based on the sign of the difference signal, either add or subtract the
+   * threshold table difference from the accumulated value. Recover the final
+   * accumulated value (saturated/rounded) */
+
+  if (diffSignal < 0) {
+    threshDiff = -threshDiff;
+  }
+  tmp_reg64.s64 = ((int64_t)ditherVal * (int64_t)threshDiff);
+  tmp_reg64.s32.h += acc;
+  acc = tmp_reg64.s32.h;
+
+  if (tmp_reg64.u32.l >= 0x80000000) {
+    acc++;
+  }
+  tmp_round0 = (tmp_reg64.u32.l >> 1) | (tmp_reg64.s32.h << 31);
+
+  acc = ssat24(acc);
+
+  if (tmp_round0 == 0x40000000L) {
+    acc--;
+  }
+  _delta = -delta << 8;
+
+  acc = (int32_t)((uint32_t)acc << 4);
+
+  /* Form (absDiffSignal * 0.125) - (acc * delta), which is the final distance
+   * signal used to determine if dithering alters the quantised code value or
+   * not. */
+  // worst case value for delta is 0x7d400
+
+  tmp_reg64.s64 = ((int64_t)acc * (int64_t)_delta);
+  tmp_reg64.s32.h += absDiffSignal;
+  tmp_round0 = (tmp_reg64.u32.l >> 4) | (tmp_reg64.s32.h << 28);
+  acc = tmp_reg64.s32.h + (1 << 2);
+  acc >>= 3;
+  if (tmp_round0 == 0x40000000L) {
+    acc--;
+  }
+
+  tmp_qCode = qdata_pt->qCode;
+  tmp_altQcode = tmp_qCode - 1;
+  /* Check the sign of the distance penalty. Get the sign from the
+   * full-precision accumulator, as done in the Kalimba code. */
+
+  if (tmp_reg64.s32.h < 0) {
+    /* The distance is -ve. The optimum code needs decremented by 1 and the
+     * alternative code is 1 greater than this. Get the rounded version of the
+     * -ve distance penalty and negate this (form distance magnitude) before
+     *  writing the value out */
+    tmp_qCode = tmp_altQcode;
+    tmp_altQcode++;
+    acc = -acc;
+  }
+
+  qdata_pt->distPenalty = acc;
+  /* If the difference signal is negative, bitwise invert the code (restores
+   * sign to the magnitude). */
+  if (diffSignal < 0) {
+    tmp_qCode = ~tmp_qCode;
+    tmp_altQcode = ~tmp_altQcode;
+  }
+  qdata_pt->altQcode = tmp_altQcode;
+  qdata_pt->qCode = tmp_qCode;
+}
+
+static int32_t BsearchLH(const int32_t absDiffSignalShifted,
+                         const int32_t delta, const int32_t* dqbitTablePrt) {
+  int32_t qCode;
+  reg64_t tmp_acc;
+  int32_t tmp;
+  int32_t lc_delta = delta << 8;
+
+  qCode = 0;
+
+  tmp_acc.s64 = (int64_t)lc_delta * (int64_t)dqbitTablePrt[16];
+  tmp_acc.s32.h -= absDiffSignalShifted;
+  tmp = tmp_acc.s32.h | (tmp_acc.u32.l >> 1);
+  if (tmp <= 0) {
+    qCode = 16;
+  }
+
+  tmp_acc.s64 = (int64_t)lc_delta * (int64_t)dqbitTablePrt[qCode + 8];
+  tmp_acc.s32.h -= absDiffSignalShifted;
+  tmp = tmp_acc.s32.h | (tmp_acc.u32.l >> 1);
+  if (tmp <= 0) {
+    qCode += 8;
+  }
+
+  tmp_acc.s64 = (int64_t)lc_delta * (int64_t)dqbitTablePrt[qCode + 4];
+  tmp_acc.s32.h -= absDiffSignalShifted;
+  tmp = tmp_acc.s32.h | (tmp_acc.u32.l >> 1);
+  if (tmp <= 0) {
+    qCode += 4;
+  }
+
+  tmp_acc.s64 = (int64_t)lc_delta * (int64_t)dqbitTablePrt[qCode + 2];
+  tmp_acc.s32.h -= absDiffSignalShifted;
+  tmp = tmp_acc.s32.h | (tmp_acc.u32.l >> 1);
+  if (tmp <= 0) {
+    qCode += 2;
+  }
+
+  tmp_acc.s64 = (int64_t)lc_delta * (int64_t)dqbitTablePrt[qCode + 1];
+  tmp_acc.s32.h -= absDiffSignalShifted;
+  tmp = tmp_acc.s32.h | (tmp_acc.u32.l >> 1);
+  if (tmp <= 0) {
+    qCode++;
+  }
+
+  return (qCode);
+}
+
+void quantiseDifference_HDLH(const int32_t diffSignal, const int32_t ditherVal,
+                             const int32_t delta, Quantiser_data* qdata_pt) {
+  int32_t absDiffSignal = 0;
+  int32_t absDiffSignalShifted = 0;
+  int32_t index = 0;
+  int32_t dithSquared = 0;
+  int32_t minusLambdaD = 0;
+  int32_t acc = 0;
+  int32_t threshDiff = 0;
+  reg64_t tmp_acc;
+  reg64_t tmp_reg64;
+  int32_t tmp_accL = 0;
+  int32_t tmp_qCode = 0;
+  int32_t tmp_altQcode = 0;
+
+  uint32_t tmp_round0 = 0;
+  int32_t _delta = 0;
+
+  /* Form the absolute value of the difference signal and maintain a version
+   * that is right-shifted 4 places for delta scaling. */
+  absDiffSignal = -diffSignal;
+  if (diffSignal >= 0) {
+    absDiffSignal = diffSignal;
+  }
+  absDiffSignal = ssat24(absDiffSignal);
+  absDiffSignalShifted = absDiffSignal >> deltaScale;
+
+  /* Binary search for the quantised code. This search terminates with the
+   * table index of the LARGEST threshold table value for which
+   * absDiffSignalShifted >= (delta * threshold)
+   */
+
+  /* first iteration */
+  index =
+      BsearchLH(absDiffSignalShifted, delta, qdata_pt->thresholdTablePtr_sl1);
+
+  /* We actually wanted the SMALLEST magnitude quantised code for which
+   * absDiffSignalShifted < (delta * threshold)
+   * i.e. the code with the next highest magnitude than the one we actually
+   * found. We could add +1 to the code magnitude to do this, but we need to
+   * subtract 1 from the code magnitude to compensate for the "phantom
+   * element" at the base of the quantisation table. These two effects cancel
+   * out, so we leave the value of code alone. However, we need to form code+1
+   * to get the proper index into the both the threshold and dither tables,
+   * since we must skip over the phantom element at the base. */
+  qdata_pt->qCode = index;
+
+  /* Square the dither and get the value back from the ALU
+   * (saturated/rounded). */
+
+  tmp_reg64.s64 = ((int64_t)ditherVal * (int64_t)ditherVal);
+
+  acc = tmp_reg64.s32.h;
+
+  tmp_round0 = (uint32_t)acc << 8;
+
+  acc = (acc >> 6) + 1;
+  acc >>= 1;
+  if (tmp_round0 == 0x40000000L) {
+    acc--;
+  }
+  acc = ssat24(acc);
+
+  dithSquared = acc;
+
+  /* Form the negative difference of the dither values at index and index-1.
+   * Load the accumulator with this value divided by 2. Ensure saturation is
+   * applied to the difference calculation. */
+
+  minusLambdaD = qdata_pt->minusLambdaDTable[index];
+
+  tmp_accL = (1 << 23) - dithSquared;
+  tmp_acc.s64 = (int64_t)tmp_accL * minusLambdaD;
+
+  tmp_round0 = tmp_acc.s32.l << 8;
+
+  acc = (int32_t)(tmp_acc.u32.l >> 22) | (tmp_acc.s32.h << 10);
+  if (tmp_round0 == 0x40000000L) {
+    acc -= 2;
+  }
+  acc++;
+
+  /* Add the threshold table values at index and index-1 to the accumulated
+   * value. */
+
+  acc += qdata_pt->thresholdTablePtr_sl1[index + 1];
+  //// worst case value for acc = 0x000d3e08 + 0x43E1DB = 511FE3
+  acc += qdata_pt->thresholdTablePtr_sl1[index];
+  acc >>= 1;
+
+  // saturation required
+  acc = ssat24(acc);
+
+  /* Form the threshold table difference at index and index-1. Ensure
+   * saturation is applied to the difference calculation. */
+  threshDiff = qdata_pt->thresholdTablePtr_sl1[index + 1] -
+               qdata_pt->thresholdTablePtr_sl1[index];
+
+  /* Based on the sign of the difference signal, either add or subtract the
+   * threshold table difference from the accumulated value. Recover the final
+   * accumulated value (saturated/rounded) */
+
+  if (diffSignal < 0) {
+    threshDiff = -threshDiff;
+  }
+  tmp_reg64.s64 = ((int64_t)ditherVal * (int64_t)threshDiff);
+
+  tmp_reg64.s32.h += acc;
+  acc = tmp_reg64.s32.h;
+
+  if (tmp_reg64.u32.l >= 0x80000000) {
+    acc++;
+  }
+  tmp_round0 = (tmp_reg64.u32.l >> 1) | (tmp_reg64.s32.h << 31);
+
+  acc = ssat24(acc);
+
+  if (tmp_round0 == 0x40000000L) {
+    acc--;
+  }
+  _delta = -delta << 8;
+
+  acc = (int32_t)((uint32_t)acc << 4);
+
+  /* Form (absDiffSignal * 0.125) - (acc * delta), which is the final distance
+   * signal used to determine if dithering alters the quantised code value or
+   * not. */
+  // worst case value for delta is 0x7d400
+
+  tmp_reg64.s64 = ((int64_t)acc * (int64_t)_delta);
+  tmp_reg64.s32.h += absDiffSignal;
+  tmp_round0 = (tmp_reg64.u32.l >> 4) | (tmp_reg64.s32.h << 28);
+  acc = tmp_reg64.s32.h + (1 << 2);
+  acc >>= 3;
+  if (tmp_round0 == 0x40000000L) {
+    acc--;
+  }
+
+  tmp_qCode = qdata_pt->qCode;
+  tmp_altQcode = tmp_qCode - 1;
+  /* Check the sign of the distance penalty. Get the sign from the
+   * full-precision accumulator, as done in the Kalimba code. */
+
+  if (tmp_reg64.s32.h < 0) {
+    /* The distance is -ve. The optimum code needs decremented by 1 and the
+     * alternative code is 1 greater than this. Get the rounded version of the
+     * -ve distance penalty and negate this (form distance magnitude) before
+     *  writing the value out */
+    tmp_qCode = tmp_altQcode;
+    tmp_altQcode++;
+    acc = -acc;
+  }
+
+  qdata_pt->distPenalty = acc;
+  /* If the difference signal is negative, bitwise invert the code (restores
+   * sign to the magnitude). */
+  if (diffSignal < 0) {
+    tmp_qCode = ~tmp_qCode;
+    tmp_altQcode = ~tmp_altQcode;
+  }
+  qdata_pt->altQcode = tmp_altQcode;
+  qdata_pt->qCode = tmp_qCode;
+}
diff --git a/system/embdrv/encoder_for_aptxhd/src/Quantiser.h b/system/embdrv/encoder_for_aptxhd/src/Quantiser.h
new file mode 100644
index 0000000..119f193
--- /dev/null
+++ b/system/embdrv/encoder_for_aptxhd/src/Quantiser.h
@@ -0,0 +1,43 @@
+/**
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/*------------------------------------------------------------------------------
+ *
+ *  Function to calculate a quantised representation of an input
+ *  difference signal, based on additional dither values and step-size inputs.
+ *
+ *-----------------------------------------------------------------------------*/
+
+#ifndef QUANTISER_H
+#define QUANTISER_H
+#ifdef _GCC
+#pragma GCC visibility push(hidden)
+#endif
+
+#include "AptxParameters.h"
+
+void quantiseDifference_HDLL(const int32_t diffSignal, const int32_t ditherVal,
+                             const int32_t delta, Quantiser_data* qdata_pt);
+void quantiseDifference_HDHL(const int32_t diffSignal, const int32_t ditherVal,
+                             const int32_t delta, Quantiser_data* qdata_pt);
+void quantiseDifference_HDLH(const int32_t diffSignal, const int32_t ditherVal,
+                             const int32_t delta, Quantiser_data* qdata_pt);
+void quantiseDifference_HDHH(const int32_t diffSignal, const int32_t ditherVal,
+                             const int32_t delta, Quantiser_data* qdata_p);
+
+#ifdef _GCC
+#pragma GCC visibility pop
+#endif
+#endif  // QUANTISER_H
diff --git a/system/embdrv/encoder_for_aptxhd/src/SubbandFunctions.h b/system/embdrv/encoder_for_aptxhd/src/SubbandFunctions.h
new file mode 100644
index 0000000..8802af7
--- /dev/null
+++ b/system/embdrv/encoder_for_aptxhd/src/SubbandFunctions.h
@@ -0,0 +1,187 @@
+/**
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/*------------------------------------------------------------------------------
+ *
+ *  Subband processing consists of:
+ *  inverse quantisation (defined in a separate file),
+ *  predictor coefficient update (Pole and Zero Coeff update),
+ *  predictor filtering.
+ *
+ *----------------------------------------------------------------------------*/
+
+#ifndef SUBBANDFUNCTIONS_H
+#define SUBBANDFUNCTIONS_H
+#ifdef _GCC
+#pragma GCC visibility push(hidden)
+#endif
+
+#include "AptxParameters.h"
+
+XBT_INLINE_ void updatePredictorPoleCoefficients(
+    const int32_t invQ, const int32_t prevZfiltOutput,
+    PoleCoeff_data* PoleCoeffDataPt) {
+  int32_t adaptSum;
+  int32_t sgnP[3];
+  int32_t newCoeffs[2];
+  int32_t Bacc;
+  int32_t acc;
+  int32_t acc2;
+  int32_t tmp3_round0;
+  int16_t tmp2_round0;
+  int16_t tmp_round0;
+  /* Various constants in various Q formats */
+  const int32_t oneQ22 = 4194304L;
+  const int32_t minusOneQ22 = -4194304L;
+  const int32_t pointFiveQ21 = 1048576L;
+  const int32_t minusPointFiveQ21 = -1048576L;
+  const int32_t pointSevenFiveQ22 = 3145728L;
+  const int32_t minusPointSevenFiveQ22 = -3145728L;
+  const int32_t oneMinusTwoPowerMinusFourQ22 = 3932160L;
+
+  /* Symbolic indices for the pole coefficient arrays. Here we are using a1
+   * to represent the first pole filter coefficient and a2 the second. This
+   * seems to be common ADPCM terminology. */
+  enum { a1 = 0, a2 = 1 };
+
+  /* Symbolic indices for the sgn array (k, k-1 and k-2 respectively) */
+  enum { k = 0, k_1 = 1, k_2 = 2 };
+
+  /* Form the sum of the inverse quantiser and previous zero filter values */
+  adaptSum = invQ + prevZfiltOutput;
+  adaptSum = ssat24(adaptSum);
+
+  /* Form the sgn of the sum just formed (note +1 and -1 are Q22) */
+  if (adaptSum < 0L) {
+    sgnP[k] = minusOneQ22;
+    sgnP[k_1] = -(((int32_t)PoleCoeffDataPt->m_poleAdaptDelayLine.s16.l) << 22);
+    sgnP[k_2] = -(((int32_t)PoleCoeffDataPt->m_poleAdaptDelayLine.s16.h) << 22);
+    PoleCoeffDataPt->m_poleAdaptDelayLine.s16.h =
+        PoleCoeffDataPt->m_poleAdaptDelayLine.s16.l;
+    PoleCoeffDataPt->m_poleAdaptDelayLine.s16.l = -1;
+  }
+  if (adaptSum == 0L) {
+    sgnP[k] = 0L;
+    sgnP[k_1] = 0L;
+    sgnP[k_2] = 0L;
+    PoleCoeffDataPt->m_poleAdaptDelayLine.s16.h =
+        PoleCoeffDataPt->m_poleAdaptDelayLine.s16.l;
+    PoleCoeffDataPt->m_poleAdaptDelayLine.s16.l = 1;
+  }
+  if (adaptSum > 0L) {
+    sgnP[k] = oneQ22;
+    sgnP[k_1] = ((int32_t)PoleCoeffDataPt->m_poleAdaptDelayLine.s16.l) << 22;
+    sgnP[k_2] = ((int32_t)PoleCoeffDataPt->m_poleAdaptDelayLine.s16.h) << 22;
+    PoleCoeffDataPt->m_poleAdaptDelayLine.s16.h =
+        PoleCoeffDataPt->m_poleAdaptDelayLine.s16.l;
+    PoleCoeffDataPt->m_poleAdaptDelayLine.s16.l = 1;
+  }
+
+  /* Clear the accumulator and form -a1(k) * sgn(p(k))sgn(p(k-1)) in Q21. Clip
+   * it to +/- 0.5 (Q21) so that we can take f(a1) = 4 * a1. This is a partial
+   * result for the new a2 */
+  acc = 0;
+  acc -= PoleCoeffDataPt->m_poleCoeff[a1] * (sgnP[k_1] >> 22);
+
+  tmp3_round0 = acc & 0x3L;
+
+  acc += 0x001;
+  acc >>= 1;
+  if (tmp3_round0 == 0x001L) {
+    acc--;
+  }
+
+  newCoeffs[a2] = acc;
+
+  if (newCoeffs[a2] < minusPointFiveQ21) {
+    newCoeffs[a2] = minusPointFiveQ21;
+  }
+  if (newCoeffs[a2] > pointFiveQ21) {
+    newCoeffs[a2] = pointFiveQ21;
+  }
+
+  /* Load the accumulator with sgn(p(k))sgn(p(k-2)) right-shifted by 3. The
+   * 3-position shift is to multiply it by 0.25 and convert from Q22 to Q21. */
+  Bacc = (sgnP[k_2] >> 3);
+  /* Add the current a2 update value to the accumulator (Q21) */
+  Bacc += newCoeffs[a2];
+  /* Shift the accumulator right by 4 positions.
+   * Right 7 places to multiply by 2^(-7)
+   * Left 2 places to scale by 4 (0.25A + B -> A + 4B)
+   * Left 1 place to convert from Q21 to Q22 */
+  Bacc >>= 4;
+  /* Add a2(k-1) * (1 - 2^(-7)) to the accumulator. Note that the constant is
+   * expressed as Q23, hence the product is Q22. Get the accumulator value
+   * back out. */
+  acc2 = PoleCoeffDataPt->m_poleCoeff[a2] << 8;
+  acc2 -= PoleCoeffDataPt->m_poleCoeff[a2] << 1;
+  Bacc = (int32_t)((uint32_t)Bacc << 8);
+  Bacc += acc2;
+
+  tmp2_round0 = (int16_t)Bacc & 0x01FFL;
+
+  Bacc += 0x0080L;
+  Bacc >>= 8;
+
+  if (tmp2_round0 == 0x0080L) {
+    Bacc--;
+  }
+
+  newCoeffs[a2] = Bacc;
+
+  /* Clip the new a2(k) value to +/- 0.75 (Q22) */
+  if (newCoeffs[a2] < minusPointSevenFiveQ22) {
+    newCoeffs[a2] = minusPointSevenFiveQ22;
+  }
+  if (newCoeffs[a2] > pointSevenFiveQ22) {
+    newCoeffs[a2] = pointSevenFiveQ22;
+  }
+  PoleCoeffDataPt->m_poleCoeff[a2] = newCoeffs[a2];
+
+  /* Form sgn(p(k))sgn(p(k-1)) * (3 * 2^(-8)). The constant is Q23, hence the
+   * product is Q22. */
+  /* Add a1(k-1) * (1 - 2^(-8)) to the accumulator. The constant is Q23, hence
+   * the product is Q22. Get the value from the accumulator. */
+  acc2 = PoleCoeffDataPt->m_poleCoeff[a1] << 8;
+  acc2 -= PoleCoeffDataPt->m_poleCoeff[a1];
+  acc2 += (sgnP[k_1] << 2);
+  acc2 -= (sgnP[k_1]);
+
+  tmp_round0 = (int16_t)acc2 & 0x01FF;
+
+  acc2 += 0x0080;
+  acc = (acc2 >> 8);
+  if (tmp_round0 == 0x0080) {
+    acc--;
+  }
+
+  newCoeffs[a1] = acc;
+
+  /* Clip the new value of a1(k) to +/- (1 - 2^4 - a2(k)). The constant 1 -
+   * 2^4 is expressed in Q22 format (as is a1 and a2) */
+  if (newCoeffs[a1] < (newCoeffs[a2] - oneMinusTwoPowerMinusFourQ22)) {
+    newCoeffs[a1] = newCoeffs[a2] - oneMinusTwoPowerMinusFourQ22;
+  }
+  if (newCoeffs[a1] > (oneMinusTwoPowerMinusFourQ22 - newCoeffs[a2])) {
+    newCoeffs[a1] = oneMinusTwoPowerMinusFourQ22 - newCoeffs[a2];
+  }
+
+  PoleCoeffDataPt->m_poleCoeff[a1] = newCoeffs[a1];
+}
+
+#ifdef _GCC
+#pragma GCC visibility pop
+#endif
+#endif  // SUBBANDFUNCTIONS_H
diff --git a/system/embdrv/encoder_for_aptxhd/src/SubbandFunctionsCommon.h b/system/embdrv/encoder_for_aptxhd/src/SubbandFunctionsCommon.h
new file mode 100644
index 0000000..c52b7c6
--- /dev/null
+++ b/system/embdrv/encoder_for_aptxhd/src/SubbandFunctionsCommon.h
@@ -0,0 +1,554 @@
+/**
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/*------------------------------------------------------------------------------
+ *
+ *  Subband processing consists of:
+ *  inverse quantisation (defined in a separate file),
+ *  predictor coefficient update (Pole and Zero Coeff update),
+ *  predictor filtering.
+ *
+ *----------------------------------------------------------------------------*/
+
+#ifndef SUBBANDFUNCTIONSCOMMON_H
+#define SUBBANDFUNCTIONSCOMMON_H
+
+enum reg64_reg { reg64_H = 1, reg64_L = 0 };
+
+void processSubband_HD(const int32_t qCode, const int32_t ditherVal,
+                       Subband_data* SubbandDataPt, IQuantiser_data* iqDataPt);
+void processSubband_HDLL(const int32_t qCode, const int32_t ditherVal,
+                         Subband_data* SubbandDataPt,
+                         IQuantiser_data* iqDataPt);
+void processSubband_HDHL(const int32_t qCode, const int32_t ditherVal,
+                         Subband_data* SubbandDataPt,
+                         IQuantiser_data* iqDataPt);
+
+/* Function to carry out inverse quantisation for a subband */
+XBT_INLINE_ void invertQuantisation(const int32_t qCode,
+                                    const int32_t ditherVal,
+                                    IQuantiser_data* iqdata_pt) {
+  int32_t invQ;
+  int32_t index;
+  int32_t acc;
+  reg64_t tmp_r64;
+  int64_t tmp_acc;
+  int32_t tmp_accL;
+  int32_t tmp_accH;
+  uint32_t tmp_round0;
+  uint32_t tmp_round1;
+  unsigned u16t;
+  /* log delta leak value (Q23) */
+  const uint32_t logDeltaLeakVal = 0x7F6CL;
+
+  /* Turn the quantised code back into an index into the threshold table. This
+   * involves bitwise inversion of the code (if -ve) and adding 1 (phantom
+   * element at table base). Then set invQ to be +/- the threshold value,
+   * depending on the code sign. */
+  index = qCode;
+  if (qCode < 0) {
+    index = (~index);
+  }
+  index = index + 1;
+  invQ = iqdata_pt->thresholdTablePtr_sl1[index];
+  if (qCode < 0) {
+    invQ = -invQ;
+  }
+
+  /* Load invQ into the accumulator. Add the product of the dither value times
+   * the indexed dither table value. Then get the result back from the
+   * accumulator as an updated invQ. */
+  tmp_r64.s64 = ((int64_t)ditherVal * iqdata_pt->ditherTablePtr_sf1[index]);
+  tmp_r64.s32.h += invQ >> 1;
+
+  acc = tmp_r64.s32.h;
+
+  tmp_round1 = tmp_r64.s32.h & 0x00000001L;
+  if (tmp_r64.u32.l >= 0x80000000) {
+    acc++;
+  }
+  if (tmp_round1 == 0 && tmp_r64.s32.l == (int32_t)0x80000000L) {
+    acc--;
+  }
+  acc = ssat24(acc);
+
+  invQ = acc;
+
+  /* Scale invQ by the current delta value. Left-shift the result (in the
+   * accumulator) by 4 positions for the delta scaling. Get the updated invQ
+   * back from the accumulator. */
+  u16t = iqdata_pt->logDelta;
+  tmp_acc = ((int64_t)invQ * iqdata_pt->delta);
+  tmp_accL = u16t * logDeltaLeakVal;
+  tmp_accH = iqdata_pt->incrTablePtr[index];
+  acc = (int32_t)(tmp_acc >> (23 - deltaScale));
+  invQ = ssat24(acc);
+
+  /* Now update the value of logDelta. Load the accumulator with the index
+   * value of the logDelta increment table. Add the product of the current
+   * logDelta scaled by a leaky coefficient (16310 in Q14). Get the value back
+   * from the accumulator. */
+  tmp_accH += tmp_accL >> (32 - 17);
+
+  acc = tmp_accH;
+
+  tmp_r64.u32.l = ((uint32_t)tmp_accL << 17);
+  tmp_r64.s32.h = tmp_accH;
+
+  tmp_round0 = tmp_r64.u32.l;
+  tmp_round1 = (int32_t)(tmp_r64.u64 >> 1);
+  if (tmp_round0 >= 0x80000000L) {
+    acc++;
+  }
+  if (tmp_round1 == 0x40000000L) {
+    acc--;
+  }
+
+  /* Limit the updated logDelta between 0 and its subband-specific maximum. */
+  if (acc < 0) {
+    acc = 0;
+  }
+  if (acc > iqdata_pt->maxLogDelta) {
+    acc = iqdata_pt->maxLogDelta;
+  }
+
+  iqdata_pt->logDelta = (uint16_t)acc;
+
+  /* The updated value of delta is the logTable output (indexed by 5 bits from
+   * the updated logDelta) shifted by a value involving the logDelta minimum
+   * and the updated logDelta itself. */
+  iqdata_pt->delta = iqdata_pt->iquantTableLogPtr[(acc >> 3) & 0x1f] >>
+                     (22 - 25 - iqdata_pt->minLogDelta - (acc >> 8));
+
+  iqdata_pt->invQ = invQ;
+}
+
+XBT_INLINE_ void invertQuantisationHL(const int32_t qCode,
+                                      const int32_t ditherVal,
+                                      IQuantiser_data* iqdata_pt) {
+  int32_t invQ;
+  int32_t index;
+  int32_t acc;
+  reg64_t tmp_r64;
+  int64_t tmp_acc;
+  int32_t tmp_accL;
+  int32_t tmp_accH;
+  uint32_t tmp_round0;
+  uint32_t tmp_round1;
+  unsigned u16t;
+  /* log delta leak value (Q23) */
+  const uint32_t logDeltaLeakVal = 0x7F6CL;
+
+  /* Turn the quantised code back into an index into the threshold table. This
+   * involves bitwise inversion of the code (if -ve) and adding 1 (phantom
+   * element at table base). Then set invQ to be +/- the threshold value,
+   * depending on the code sign. */
+  index = qCode;
+  if (qCode < 0) {
+    index = (~index);
+  }
+  index = index + 1;
+  invQ = iqdata_pt->thresholdTablePtr_sl1[index];
+  if (qCode < 0) {
+    invQ = -invQ;
+  }
+
+  /* Load invQ into the accumulator. Add the product of the dither value times
+   * the indexed dither table value. Then get the result back from the
+   * accumulator as an updated invQ. */
+  tmp_r64.s64 = ((int64_t)ditherVal * iqdata_pt->ditherTablePtr_sf1[index]);
+  tmp_r64.s32.h += invQ >> 1;
+
+  acc = tmp_r64.s32.h;
+
+  tmp_round1 = tmp_r64.s32.h & 0x00000001L;
+  if (tmp_r64.u32.l >= 0x80000000) {
+    acc++;
+  }
+  if (tmp_round1 == 0 && tmp_r64.u32.l == 0x80000000L) {
+    acc--;
+  }
+  acc = ssat24(acc);
+
+  invQ = acc;
+
+  /* Scale invQ by the current delta value. Left-shift the result (in the
+   * accumulator) by 4 positions for the delta scaling. Get the updated invQ
+   * back from the accumulator. */
+  u16t = iqdata_pt->logDelta;
+  tmp_acc = ((int64_t)invQ * iqdata_pt->delta);
+  tmp_accL = u16t * logDeltaLeakVal;
+  tmp_accH = iqdata_pt->incrTablePtr[index];
+  acc = (int32_t)(tmp_acc >> (23 - deltaScale));
+  invQ = ssat24(acc);
+
+  /* Now update the value of logDelta. Load the accumulator with the index
+   * value of the logDelta increment table. Add the product of the current
+   * logDelta scaled by a leaky coefficient (16310 in Q14). Get the value back
+   * from the accumulator. */
+  tmp_accH += tmp_accL >> (32 - 17);
+
+  acc = tmp_accH;
+
+  tmp_r64.u32.l = ((uint32_t)tmp_accL << 17);
+  tmp_r64.s32.h = tmp_accH;
+
+  tmp_round0 = tmp_r64.u32.l;
+  tmp_round1 = (int32_t)(tmp_r64.u64 >> 1);
+  if (tmp_round0 >= 0x80000000L) {
+    acc++;
+  }
+  if (tmp_round1 == 0x40000000L) {
+    acc--;
+  }
+
+  /* Limit the updated logDelta between 0 and its subband-specific maximum. */
+  if (acc < 0) {
+    acc = 0;
+  }
+  if (acc > iqdata_pt->maxLogDelta) {
+    acc = iqdata_pt->maxLogDelta;
+  }
+
+  iqdata_pt->logDelta = (uint16_t)acc;
+
+  /* The updated value of delta is the logTable output (indexed by 5 bits from
+   * the updated logDelta) shifted by a value involving the logDelta minimum
+   * and the updated logDelta itself. */
+  iqdata_pt->delta = iqdata_pt->iquantTableLogPtr[(acc >> 3) & 0x1f] >>
+                     (22 - 25 - iqdata_pt->minLogDelta - (acc >> 8));
+
+  iqdata_pt->invQ = invQ;
+}
+
+/* Function to carry out prediction ARMA filtering for the current subband
+ * performPredictionFiltering should only be used for HH and LH subband! */
+XBT_INLINE_ void performPredictionFiltering(const int32_t invQ,
+                                            Subband_data* SubbandDataPt) {
+  int32_t poleVal;
+  int32_t acc;
+  int64_t accL;
+  uint32_t pointer;
+  int32_t poleDelayLine;
+  int32_t predVal;
+  int32_t* zeroCoeffPt = SubbandDataPt->m_ZeroCoeffData.m_zeroCoeff;
+  int32_t* poleCoeff = SubbandDataPt->m_PoleCoeffData.m_poleCoeff;
+  int32_t* cbuf_pt;
+  int32_t invQincr_pos;
+  int32_t invQincr_neg;
+  int32_t k;
+  int32_t oldZData;
+  /* Pole coefficient and data indices */
+  enum { a1 = 0, a2 = 1 };
+
+  /* Write the newest pole input sample to the pole delay line.
+   * Ensure the sum of the current dequantised error and the previous
+   * predictor output is saturated if necessary. */
+  poleDelayLine = invQ + SubbandDataPt->m_predData.m_predVal;
+
+  poleDelayLine = ssat24(poleDelayLine);
+
+  /* Pole filter convolution. Shift convolution result 1 place to the left
+   * before retrieving it, since the pole coefficients are Q22 (data is Q23)
+   * and we want a Q23 result */
+  accL = ((int64_t)poleCoeff[a2] *
+          (int64_t)SubbandDataPt->m_predData.m_poleDelayLine[a2]);
+  /* Update the pole delay line for the next pass by writing the new input
+   * sample into the 2nd element */
+  SubbandDataPt->m_predData.m_poleDelayLine[a2] = poleDelayLine;
+  accL += ((int64_t)poleCoeff[a1] * (int64_t)poleDelayLine);
+  poleVal = (int32_t)(accL >> 22);
+  poleVal = ssat24(poleVal);
+
+  /* Create (2^(-7)) * sgn(invQ) in Q22 format. */
+  if (invQ == 0) {
+    invQincr_pos = 0L;
+  } else {
+    invQincr_pos = 0x800000;
+  }
+  if (invQ < 0L) {
+    invQincr_pos = -invQincr_pos;
+  }
+
+  invQincr_neg = 0x0080 - invQincr_pos;
+  invQincr_pos += 0x0080;
+
+  pointer = (SubbandDataPt->m_predData.m_zeroDelayLine.pointer++) + 12;
+  cbuf_pt = &SubbandDataPt->m_predData.m_zeroDelayLine.buffer[pointer];
+  /* partial manual unrolling to improve performance */
+  if (SubbandDataPt->m_predData.m_zeroDelayLine.pointer >= 12) {
+    SubbandDataPt->m_predData.m_zeroDelayLine.pointer = 0;
+  }
+
+  SubbandDataPt->m_predData.m_zeroDelayLine.modulo = invQ;
+
+  /* Iterate over the number of coefficients for this subband */
+  oldZData = invQ;
+  accL = 0;
+  for (k = 0; k < 12; k++) {
+    uint32_t tmp_round0;
+    int32_t coeffValue;
+    int32_t zData0;
+
+    /* ------------------------------------------------------------------*/
+    zData0 = (*(cbuf_pt--));
+    coeffValue = *(zeroCoeffPt + k);
+    if (zData0 < 0L) {
+      acc = invQincr_neg - coeffValue;
+    } else {
+      acc = invQincr_pos - coeffValue;
+    }
+    tmp_round0 = acc;
+    acc = (acc >> 8) + coeffValue;
+    if (((tmp_round0 << 23) ^ 0x80000000) == 0) {
+      acc--;
+    }
+    accL += (int64_t)acc * (int64_t)(oldZData);
+    oldZData = zData0;
+    *(zeroCoeffPt + k) = acc;
+  }
+
+  acc = (int32_t)(accL >> 22);
+  acc = ssat24(acc);
+
+  /* Predictor output is the sum of the pole and zero filter outputs. Ensure
+   * this is saturated, if necessary. */
+  predVal = acc + poleVal;
+  predVal = ssat24(predVal);
+  SubbandDataPt->m_predData.m_zeroVal = acc;
+  SubbandDataPt->m_predData.m_predVal = predVal;
+
+  /* Update the zero filter delay line by writing the new input sample to the
+   * circular buffer. */
+  SubbandDataPt->m_predData.m_zeroDelayLine
+      .buffer[SubbandDataPt->m_predData.m_zeroDelayLine.pointer] =
+      SubbandDataPt->m_predData.m_zeroDelayLine.modulo;
+  SubbandDataPt->m_predData.m_zeroDelayLine
+      .buffer[SubbandDataPt->m_predData.m_zeroDelayLine.pointer + 12] =
+      SubbandDataPt->m_predData.m_zeroDelayLine.modulo;
+}
+
+XBT_INLINE_ void performPredictionFilteringLL(const int32_t invQ,
+                                              Subband_data* SubbandDataPt) {
+  int32_t poleVal;
+  int32_t acc;
+  int64_t accL;
+  uint32_t pointer;
+  int32_t poleDelayLine;
+  int32_t predVal;
+  int32_t* zeroCoeffPt = SubbandDataPt->m_ZeroCoeffData.m_zeroCoeff;
+  int32_t* poleCoeff = SubbandDataPt->m_PoleCoeffData.m_poleCoeff;
+  int32_t* cbuf_pt;
+  int32_t invQincr_pos;
+  int32_t invQincr_neg;
+  int32_t k;
+  int32_t oldZData;
+  /* Pole coefficient and data indices */
+  enum { a1 = 0, a2 = 1 };
+
+  /* Write the newest pole input sample to the pole delay line.
+   * Ensure the sum of the current dequantised error and the previous
+   * predictor output is saturated if necessary. */
+  poleDelayLine = invQ + SubbandDataPt->m_predData.m_predVal;
+
+  poleDelayLine = ssat24(poleDelayLine);
+
+  /* Pole filter convolution. Shift convolution result 1 place to the left
+   * before retrieving it, since the pole coefficients are Q22 (data is Q23)
+   * and we want a Q23 result */
+  accL = ((int64_t)poleCoeff[a2] *
+          (int64_t)SubbandDataPt->m_predData.m_poleDelayLine[a2]);
+  /* Update the pole delay line for the next pass by writing the new input
+   * sample into the 2nd element */
+  SubbandDataPt->m_predData.m_poleDelayLine[a2] = poleDelayLine;
+  accL += ((int64_t)poleCoeff[a1] * (int64_t)poleDelayLine);
+  poleVal = (int32_t)(accL >> 22);
+  poleVal = ssat24(poleVal);
+  /* store poleVal to free one register. */
+  SubbandDataPt->m_predData.m_predVal = poleVal;
+
+  /* Create (2^(-7)) * sgn(invQ) in Q22 format. */
+  if (invQ == 0) {
+    invQincr_pos = 0L;
+  } else {
+    invQincr_pos = 0x800000;
+  }
+  if (invQ < 0L) {
+    invQincr_pos = -invQincr_pos;
+  }
+
+  invQincr_neg = 0x0080 - invQincr_pos;
+  invQincr_pos += 0x0080;
+
+  pointer = (SubbandDataPt->m_predData.m_zeroDelayLine.pointer++) + 24;
+  cbuf_pt = &SubbandDataPt->m_predData.m_zeroDelayLine.buffer[pointer];
+  /* partial manual unrolling to improve performance */
+  if (SubbandDataPt->m_predData.m_zeroDelayLine.pointer >= 24) {
+    SubbandDataPt->m_predData.m_zeroDelayLine.pointer = 0;
+  }
+
+  SubbandDataPt->m_predData.m_zeroDelayLine.modulo = invQ;
+
+  /* Iterate over the number of coefficients for this subband */
+  oldZData = invQ;
+  accL = 0;
+  for (k = 0; k < 24; k++) {
+    int32_t zData0;
+    int32_t coeffValue;
+
+    zData0 = (*(cbuf_pt--));
+    coeffValue = *(zeroCoeffPt + k);
+    if (zData0 < 0L) {
+      acc = invQincr_neg - coeffValue;
+    } else {
+      acc = invQincr_pos - coeffValue;
+    }
+    if (((acc << 23) ^ 0x80000000) == 0) {
+      coeffValue--;
+    }
+    acc = (acc >> 8) + coeffValue;
+    accL += (int64_t)acc * (int64_t)(oldZData);
+    oldZData = zData0;
+    *(zeroCoeffPt + k) = acc;
+  }
+
+  acc = (int32_t)(accL >> 22);
+  acc = ssat24(acc);
+
+  /* Predictor output is the sum of the pole and zero filter outputs. Ensure
+   * this is saturated, if necessary.
+   * recover value of PoleVal stored at beginning of routine... */
+  predVal = acc + SubbandDataPt->m_predData.m_predVal;
+  predVal = ssat24(predVal);
+  SubbandDataPt->m_predData.m_zeroVal = acc;
+  SubbandDataPt->m_predData.m_predVal = predVal;
+
+  /* Update the zero filter delay line by writing the new input sample to the
+   * circular buffer. */
+  SubbandDataPt->m_predData.m_zeroDelayLine
+      .buffer[SubbandDataPt->m_predData.m_zeroDelayLine.pointer] =
+      SubbandDataPt->m_predData.m_zeroDelayLine.modulo;
+  SubbandDataPt->m_predData.m_zeroDelayLine
+      .buffer[SubbandDataPt->m_predData.m_zeroDelayLine.pointer + 24] =
+      SubbandDataPt->m_predData.m_zeroDelayLine.modulo;
+}
+
+XBT_INLINE_ void performPredictionFilteringHL(const int32_t invQ,
+                                              Subband_data* SubbandDataPt) {
+  int32_t poleVal;
+  int32_t acc;
+  int64_t accL;
+  uint32_t pointer;
+  int32_t poleDelayLine;
+  int32_t predVal;
+  int32_t* zeroCoeffPt = SubbandDataPt->m_ZeroCoeffData.m_zeroCoeff;
+  int32_t* poleCoeff = SubbandDataPt->m_PoleCoeffData.m_poleCoeff;
+  int32_t* cbuf_pt;
+  int32_t invQincr_pos;
+  int32_t invQincr_neg;
+  int32_t k;
+  int32_t oldZData;
+  const int32_t roundCte = 0x80000000;
+  /* Pole coefficient and data indices */
+  enum { a1 = 0, a2 = 1 };
+
+  /* Write the newest pole input sample to the pole delay line.
+   * Ensure the sum of the current dequantised error and the previous
+   * predictor output is saturated if necessary. */
+  poleDelayLine = invQ + SubbandDataPt->m_predData.m_predVal;
+
+  poleDelayLine = ssat24(poleDelayLine);
+
+  /* Pole filter convolution. Shift convolution result 1 place to the left
+   * before retrieving it, since the pole coefficients are Q22 (data is Q23)
+   * and we want a Q23 result */
+  accL = ((int64_t)poleCoeff[a2] *
+          (int64_t)SubbandDataPt->m_predData.m_poleDelayLine[a2]);
+  /* Update the pole delay line for the next pass by writing the new input
+   * sample into the 2nd element */
+  SubbandDataPt->m_predData.m_poleDelayLine[a2] = poleDelayLine;
+  accL += ((int64_t)poleCoeff[a1] * (int64_t)poleDelayLine);
+  poleVal = (int32_t)(accL >> 22);
+  poleVal = ssat24(poleVal);
+
+  /* Create (2^(-7)) * sgn(invQ) in Q22 format. */
+  invQincr_pos = 0L;
+  if (invQ != 0) {
+    invQincr_pos = 0x800000;
+  }
+  if (invQ < 0L) {
+    invQincr_pos = -invQincr_pos;
+  }
+
+  invQincr_neg = 0x0080 - invQincr_pos;
+  invQincr_pos += 0x0080;
+
+  pointer = (SubbandDataPt->m_predData.m_zeroDelayLine.pointer++) + 6;
+  cbuf_pt = &SubbandDataPt->m_predData.m_zeroDelayLine.buffer[pointer];
+  /* partial manual unrolling to improve performance */
+  if (SubbandDataPt->m_predData.m_zeroDelayLine.pointer >= 6) {
+    SubbandDataPt->m_predData.m_zeroDelayLine.pointer = 0;
+  }
+
+  SubbandDataPt->m_predData.m_zeroDelayLine.modulo = invQ;
+
+  /* Iterate over the number of coefficients for this subband */
+  oldZData = invQ;
+  accL = 0;
+
+  for (k = 0; k < 6; k++) {
+    uint32_t tmp_round0;
+    int32_t coeffValue;
+    int32_t zData0;
+
+    /* ------------------------------------------------------------------*/
+    zData0 = (*(cbuf_pt--));
+    coeffValue = *(zeroCoeffPt + k);
+    if (zData0 < 0L) {
+      acc = invQincr_neg - coeffValue;
+    } else {
+      acc = invQincr_pos - coeffValue;
+    }
+    tmp_round0 = acc;
+    acc = (acc >> 8) + coeffValue;
+    if (((tmp_round0 << 23) ^ roundCte) == 0) {
+      acc--;
+    }
+    accL += (int64_t)acc * (int64_t)(oldZData);
+    oldZData = zData0;
+    *(zeroCoeffPt + k) = acc;
+  }
+
+  acc = (int32_t)(accL >> 22);
+  acc = ssat24(acc);
+
+  /* Predictor output is the sum of the pole and zero filter outputs. Ensure
+   * this is saturated, if necessary. */
+  predVal = acc + poleVal;
+  predVal = ssat24(predVal);
+  SubbandDataPt->m_predData.m_zeroVal = acc;
+  SubbandDataPt->m_predData.m_predVal = predVal;
+
+  /* Update the zero filter delay line by writing the new input sample to the
+   * circular buffer. */
+  SubbandDataPt->m_predData.m_zeroDelayLine
+      .buffer[SubbandDataPt->m_predData.m_zeroDelayLine.pointer] =
+      SubbandDataPt->m_predData.m_zeroDelayLine.modulo;
+  SubbandDataPt->m_predData.m_zeroDelayLine
+      .buffer[SubbandDataPt->m_predData.m_zeroDelayLine.pointer + 6] =
+      SubbandDataPt->m_predData.m_zeroDelayLine.modulo;
+}
+
+#endif  // SUBBANDFUNCTIONSCOMMON_H
diff --git a/system/embdrv/encoder_for_aptxhd/src/SyncInserter.h b/system/embdrv/encoder_for_aptxhd/src/SyncInserter.h
new file mode 100644
index 0000000..1e21e8b
--- /dev/null
+++ b/system/embdrv/encoder_for_aptxhd/src/SyncInserter.h
@@ -0,0 +1,130 @@
+/**
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/*------------------------------------------------------------------------------
+ *
+ *  All declarations relevant for the SyncInserter class. This class exposes a
+ *  public interface that lets a client supply two aptX HD encoder objects (left
+ *  and right stereo channel) and have the current quantised codes adjusted to
+ *  bury an autosync bit.
+ *
+ *----------------------------------------------------------------------------*/
+#ifndef SYNCINSERTER_H
+#define SYNCINSERTER_H
+#ifdef _GCC
+#pragma GCC visibility push(hidden)
+#endif
+
+#include "AptxParameters.h"
+
+/* Function to insert sync information into one of the 8
+ * quantised codes spread across 2 aptX HD codewords (1 codeword
+ * per channel) */
+XBT_INLINE_ void xbtEncinsertSync(Encoder_data* leftChannelEncoder,
+                                  Encoder_data* rightChannelEncoder,
+                                  uint32_t* syncWordPhase) {
+  /* Currently using 0x1 as the 8-bit sync pattern */
+  static const uint32_t syncWord = 0x1;
+  uint32_t tmp_var;
+
+  uint32_t i;
+
+  /* Variable to hold the XOR of all the quantised code lsbs */
+  uint32_t xorCodeLsbs;
+
+  /* Variable to point to the quantiser with the minimum calculated distance
+   * penalty. */
+  Quantiser_data* minPenaltyQuantiser;
+
+  /* Get the vector of quantiser pointers from the left and right encoders */
+  Quantiser_data* leftQuant[4];
+  Quantiser_data* rightQuant[4];
+  leftQuant[0] = &leftChannelEncoder->m_qdata[0];
+  leftQuant[1] = &leftChannelEncoder->m_qdata[1];
+  leftQuant[2] = &leftChannelEncoder->m_qdata[2];
+  leftQuant[3] = &leftChannelEncoder->m_qdata[3];
+  rightQuant[0] = &rightChannelEncoder->m_qdata[0];
+  rightQuant[1] = &rightChannelEncoder->m_qdata[1];
+  rightQuant[2] = &rightChannelEncoder->m_qdata[2];
+  rightQuant[3] = &rightChannelEncoder->m_qdata[3];
+
+  /* Starting quantiser traversal with the LL quantiser from the left channel.
+   * Initialise the pointer to the minimum penalty quantiser with the details
+   * of the left LL quantiser. Initialise the code lsbs XOR variable with the
+   * left LL quantised code lsbs and also XOR in the left and right random
+   * dither bit generated by the 2 encoders. */
+  xorCodeLsbs = ((rightQuant[LL]->qCode) & 0x1) ^
+                leftChannelEncoder->m_dithSyncRandBit ^
+                rightChannelEncoder->m_dithSyncRandBit;
+  minPenaltyQuantiser = rightQuant[LH];
+
+  /* Traverse across the LH, HL and HH quantisers from the right channel */
+  for (i = LH; i <= HH; i++) {
+    /* XOR in the lsb of the quantised code currently examined */
+    xorCodeLsbs ^= (rightQuant[i]->qCode) & 0x1;
+  }
+
+  /* If the distance penalty associated with a quantiser is less than the
+   * current minimum, then make that quantiser the minimum penalty
+   * quantiser. */
+  if (rightQuant[HL]->distPenalty < minPenaltyQuantiser->distPenalty) {
+    minPenaltyQuantiser = rightQuant[HL];
+  }
+  if (rightQuant[LL]->distPenalty < minPenaltyQuantiser->distPenalty) {
+    minPenaltyQuantiser = rightQuant[LL];
+  }
+  if (rightQuant[HH]->distPenalty < minPenaltyQuantiser->distPenalty) {
+    minPenaltyQuantiser = rightQuant[HH];
+  }
+
+  /* Traverse across all quantisers from the left channel */
+  for (i = LL; i <= HH; i++) {
+    /* XOR in the lsb of the quantised code currently examined */
+    xorCodeLsbs ^= (leftQuant[i]->qCode) & 0x1;
+  }
+
+  /* If the distance penalty associated with a quantiser is less than the
+   * current minimum, then make that quantiser the minimum penalty
+   * quantiser. */
+  if (leftQuant[LH]->distPenalty < minPenaltyQuantiser->distPenalty) {
+    minPenaltyQuantiser = leftQuant[LH];
+  }
+  if (leftQuant[HL]->distPenalty < minPenaltyQuantiser->distPenalty) {
+    minPenaltyQuantiser = leftQuant[HL];
+  }
+  if (leftQuant[LL]->distPenalty < minPenaltyQuantiser->distPenalty) {
+    minPenaltyQuantiser = leftQuant[LL];
+  }
+  if (leftQuant[HH]->distPenalty < minPenaltyQuantiser->distPenalty) {
+    minPenaltyQuantiser = leftQuant[HH];
+  }
+
+  /* If the lsbs of all 8 quantised codes don't happen to equal the desired
+   * sync bit to embed, then force them to be by replacing the optimum code
+   * with the alternate code in the minimum penalty quantiser (changes the lsb
+   * of the code in this quantiser) */
+  if (xorCodeLsbs != ((syncWord >> (*syncWordPhase)) & 0x1)) {
+    minPenaltyQuantiser->qCode = minPenaltyQuantiser->altQcode;
+  }
+
+  /* Decrement the selected sync word bit modulo 8 for the next pass. */
+  tmp_var = --(*syncWordPhase);
+  (*syncWordPhase) = tmp_var & 0x7;
+}
+
+#ifdef _GCC
+#pragma GCC visibility pop
+#endif
+#endif  // SYNCINSERTER_H
diff --git a/system/embdrv/encoder_for_aptxhd/src/aptXHDbtenc.c b/system/embdrv/encoder_for_aptxhd/src/aptXHDbtenc.c
new file mode 100644
index 0000000..8d93d9d
--- /dev/null
+++ b/system/embdrv/encoder_for_aptxhd/src/aptXHDbtenc.c
@@ -0,0 +1,184 @@
+/**
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#include "aptXHDbtenc.h"
+
+#include "AptxEncoder.h"
+#include "AptxParameters.h"
+#include "AptxTables.h"
+#include "CodewordPacker.h"
+#include "SyncInserter.h"
+#include "swversion.h"
+
+typedef struct aptxhdbtenc_t {
+  /* m_endian should either be 0 (little endian) or 8 (big endian). */
+  int32_t m_endian;
+
+  /* Autosync inserter & Checker for use with the stereo aptX HD codec. */
+  /* The current phase of the sync word insertion (7 down to 0) */
+  uint32_t m_syncWordPhase;
+
+  /* Stereo channel aptX HD encoder (annotated to produce Kalimba test vectors
+   * for it's I/O. This will process valid PCM from a WAV file). */
+  /* Each Encoder_data structure requires 1592 bytes */
+  Encoder_data m_encoderData[2];
+  Qmf_storage m_qmf_l;
+  Qmf_storage m_qmf_r;
+} aptxhdbtenc;
+
+/* Constants */
+/* Log to linear lookup table used in inverse quantiser*/
+/* Size of Table: 32*4 = 128 bytes */
+static const int32_t IQuant_tableLogT[32] = {
+    16384 * 256, 16744 * 256, 17112 * 256, 17488 * 256, 17864 * 256,
+    18256 * 256, 18656 * 256, 19064 * 256, 19480 * 256, 19912 * 256,
+    20344 * 256, 20792 * 256, 21248 * 256, 21712 * 256, 22192 * 256,
+    22672 * 256, 23168 * 256, 23680 * 256, 24200 * 256, 24728 * 256,
+    25264 * 256, 25824 * 256, 26384 * 256, 26968 * 256, 27552 * 256,
+    28160 * 256, 28776 * 256, 29408 * 256, 30048 * 256, 30704 * 256,
+    31376 * 256, 32064 * 256};
+
+static void clearmem_HD(void* mem, int32_t sz) {
+  int8_t* m = (int8_t*)mem;
+  int32_t i = 0;
+  for (; i < sz; i++) {
+    *m = 0;
+    m++;
+  }
+}
+
+APTXHDBTENCEXPORT int SizeofAptxhdbtenc() { return (sizeof(aptxhdbtenc)); }
+
+APTXHDBTENCEXPORT const char* aptxhdbtenc_version() { return (swversion); }
+
+APTXHDBTENCEXPORT int aptxhdbtenc_init(void* _state, short endian) {
+  aptxhdbtenc* state = (aptxhdbtenc*)_state;
+
+  clearmem_HD(_state, sizeof(aptxhdbtenc));
+
+  if (state == 0) {
+    return 1;
+  }
+  state->m_syncWordPhase = 7L;
+
+  if (endian == 0) {
+    state->m_endian = 0;
+  } else {
+    state->m_endian = 8;
+  }
+
+  for (int j = 0; j < 2; j++) {
+    Encoder_data* encode_dat = &state->m_encoderData[j];
+    uint32_t i;
+
+    /* Create a quantiser and subband processor for each suband */
+    for (i = LL; i <= HH; i++) {
+      encode_dat->m_codewordHistory = 0L;
+
+      encode_dat->m_qdata[i].thresholdTablePtr =
+          subbandParameters[i].threshTable;
+      encode_dat->m_qdata[i].thresholdTablePtr_sl1 =
+          subbandParameters[i].threshTable_sl1;
+      encode_dat->m_qdata[i].ditherTablePtr = subbandParameters[i].dithTable;
+      encode_dat->m_qdata[i].minusLambdaDTable =
+          subbandParameters[i].minusLambdaDTable;
+      encode_dat->m_qdata[i].codeBits = subbandParameters[i].numBits;
+      encode_dat->m_qdata[i].qCode = 0L;
+      encode_dat->m_qdata[i].altQcode = 0L;
+      encode_dat->m_qdata[i].distPenalty = 0L;
+
+      /* initialisation of inverseQuantiser data */
+      encode_dat->m_SubbandData[i].m_iqdata.thresholdTablePtr =
+          subbandParameters[i].threshTable;
+      encode_dat->m_SubbandData[i].m_iqdata.thresholdTablePtr_sl1 =
+          subbandParameters[i].threshTable_sl1;
+      encode_dat->m_SubbandData[i].m_iqdata.ditherTablePtr_sf1 =
+          subbandParameters[i].dithTable_sh1;
+      encode_dat->m_SubbandData[i].m_iqdata.incrTablePtr =
+          subbandParameters[i].incrTable;
+      encode_dat->m_SubbandData[i].m_iqdata.maxLogDelta =
+          subbandParameters[i].maxLogDelta;
+      encode_dat->m_SubbandData[i].m_iqdata.minLogDelta =
+          subbandParameters[i].minLogDelta;
+      encode_dat->m_SubbandData[i].m_iqdata.delta = 0;
+      encode_dat->m_SubbandData[i].m_iqdata.logDelta = 0;
+      encode_dat->m_SubbandData[i].m_iqdata.invQ = 0;
+      encode_dat->m_SubbandData[i].m_iqdata.iquantTableLogPtr =
+          &IQuant_tableLogT[0];
+
+      // Initializing data for predictor filter
+      encode_dat->m_SubbandData[i].m_predData.m_zeroDelayLine.modulo =
+          subbandParameters[i].numZeros;
+
+      for (int t = 0; t < 48; t++) {
+        encode_dat->m_SubbandData[i].m_predData.m_zeroDelayLine.buffer[t] = 0;
+      }
+
+      encode_dat->m_SubbandData[i].m_predData.m_zeroDelayLine.pointer = 0;
+      /* Initialise the previous zero filter output and predictor output to zero
+       */
+      encode_dat->m_SubbandData[i].m_predData.m_zeroVal = 0L;
+      encode_dat->m_SubbandData[i].m_predData.m_predVal = 0L;
+      encode_dat->m_SubbandData[i].m_predData.m_numZeros =
+          subbandParameters[i].numZeros;
+      /* Initialise the contents of the pole data delay line to zero */
+      encode_dat->m_SubbandData[i].m_predData.m_poleDelayLine[0] = 0L;
+      encode_dat->m_SubbandData[i].m_predData.m_poleDelayLine[1] = 0L;
+
+      for (int k = 0; k < 24; k++) {
+        encode_dat->m_SubbandData[i].m_ZeroCoeffData.m_zeroCoeff[k] = 0;
+      }
+
+      // Initializing data for zerocoeff update function.
+      encode_dat->m_SubbandData[i].m_ZeroCoeffData.m_numZeros =
+          subbandParameters[i].numZeros;
+
+      /* Initializing data for PoleCoeff Update function.
+       * Fill the adaptation delay line with +1 initially */
+      encode_dat->m_SubbandData[i].m_PoleCoeffData.m_poleAdaptDelayLine.s32 =
+          0x00010001;
+
+      /* Zero the pole coefficients */
+      encode_dat->m_SubbandData[i].m_PoleCoeffData.m_poleCoeff[0] = 0L;
+      encode_dat->m_SubbandData[i].m_PoleCoeffData.m_poleCoeff[1] = 0L;
+    }
+  }
+  return 0;
+}
+
+APTXHDBTENCEXPORT int aptxhdbtenc_encodestereo(void* _state, void* _pcmL,
+                                               void* _pcmR, void* _buffer) {
+  aptxhdbtenc* state = (aptxhdbtenc*)_state;
+  int32_t* pcmL = (int32_t*)_pcmL;
+  int32_t* pcmR = (int32_t*)_pcmR;
+  int32_t* buffer = (int32_t*)_buffer;
+
+  // Feed the PCM to the dual aptX HD encoders
+  aptxhdEncode(pcmL, &state->m_qmf_l, &state->m_encoderData[0]);
+  aptxhdEncode(pcmR, &state->m_qmf_r, &state->m_encoderData[1]);
+
+  // Insert the autosync information into the stereo quantised codes
+  xbtEncinsertSync(&state->m_encoderData[0], &state->m_encoderData[1],
+                   &state->m_syncWordPhase);
+
+  aptxhdPostEncode(&state->m_encoderData[0]);
+  aptxhdPostEncode(&state->m_encoderData[1]);
+
+  // Pack the (possibly adjusted) codes into a 24-bit codeword per channel
+  buffer[0] = packCodeword(&state->m_encoderData[0]);
+  buffer[1] = packCodeword(&state->m_encoderData[1]);
+
+  return 0;
+}
diff --git a/system/embdrv/encoder_for_aptxhd/src/swversion.h b/system/embdrv/encoder_for_aptxhd/src/swversion.h
new file mode 100644
index 0000000..07ad8dc
--- /dev/null
+++ b/system/embdrv/encoder_for_aptxhd/src/swversion.h
@@ -0,0 +1,21 @@
+/**
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#ifndef SWVERSION_H
+#define SWVERSION_H
+
+static const char* const swversion = "1.0.0";
+
+#endif  // SWVERSION_H
diff --git a/system/embdrv/lc3/Android.bp b/system/embdrv/lc3/Android.bp
index 68c9724..f9d8506 100644
--- a/system/embdrv/lc3/Android.bp
+++ b/system/embdrv/lc3/Android.bp
@@ -21,9 +21,7 @@
     cflags: [
         "-O3",
         "-ffast-math",
-        "-Werror",
         "-Wmissing-braces",
-        "-Wno-unused-parameter",
         "-Wno-#warnings",
         "-Wuninitialized",
         "-Wno-self-assign",
diff --git a/system/embdrv/sbc/decoder/Android.bp b/system/embdrv/sbc/decoder/Android.bp
index 7d377b0..3d1ce6a 100644
--- a/system/embdrv/sbc/decoder/Android.bp
+++ b/system/embdrv/sbc/decoder/Android.bp
@@ -32,6 +32,9 @@
         "srce",
     ],
     host_supported: true,
+    apex_available: [
+        "com.android.bluetooth",
+    ],
     min_sdk_version: "Tiramisu"
 }
 
diff --git a/system/embdrv/sbc/encoder/Android.bp b/system/embdrv/sbc/encoder/Android.bp
index 642f7c6..4126870 100644
--- a/system/embdrv/sbc/encoder/Android.bp
+++ b/system/embdrv/sbc/encoder/Android.bp
@@ -30,5 +30,8 @@
         "packages/modules/Bluetooth/system/stack/include",
     ],
     host_supported: true,
+    apex_available: [
+        "com.android.bluetooth",
+    ],
     min_sdk_version: "Tiramisu"
 }
diff --git a/system/embdrv/tests/Android.bp b/system/embdrv/tests/Android.bp
new file mode 100644
index 0000000..4b57d76
--- /dev/null
+++ b/system/embdrv/tests/Android.bp
@@ -0,0 +1,35 @@
+cc_test {
+    name: "libaptx_enc_tests",
+    defaults: [
+        "mts_defaults",
+    ],
+    test_suites: ["device-tests"],
+    host_supported: true,
+    test_options: {
+        unit_test: true,
+    },
+    srcs: [ "src/aptx.cc" ],
+    whole_static_libs: [ "libaptx_enc" ],
+    sanitize: {
+        address: true,
+        cfi: true,
+    },
+}
+
+cc_test {
+    name: "libaptxhd_enc_tests",
+    defaults: [
+        "mts_defaults",
+    ],
+    test_suites: ["device-tests"],
+    host_supported: true,
+    test_options: {
+        unit_test: true,
+    },
+    srcs: [ "src/aptxhd.cc" ],
+    whole_static_libs: [ "libaptxhd_enc" ],
+    sanitize: {
+        address: true,
+        cfi: true,
+    },
+}
diff --git a/system/embdrv/tests/src/aptx.cc b/system/embdrv/tests/src/aptx.cc
new file mode 100644
index 0000000..bc27363
--- /dev/null
+++ b/system/embdrv/tests/src/aptx.cc
@@ -0,0 +1,79 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <fcntl.h>
+#include <gtest/gtest.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+
+#include <fstream>
+#include <iostream>
+
+#include "aptXbtenc.h"
+
+#define BYTES_PER_CODEWORD 16
+
+class LibAptxEncTest : public ::testing::Test {
+ private:
+  void* aptxbtenc = nullptr;
+
+ protected:
+  void SetUp() override {
+    aptxbtenc = malloc(SizeofAptxbtenc());
+    ASSERT_NE(aptxbtenc, nullptr);
+    ASSERT_EQ(aptxbtenc_init(aptxbtenc, 0), 0);
+  }
+
+  void TearDown() override { free(aptxbtenc); }
+
+  void codeword_cmp(const uint16_t pcm[8], const uint32_t codeword) {
+    uint32_t pcmL[4];
+    uint32_t pcmR[4];
+    for (size_t i = 0; i < 4; i++) {
+      pcmL[i] = pcm[0];
+      pcmR[i] = pcm[1];
+      pcm += 2;
+    }
+    uint32_t encoded_sample;
+    aptxbtenc_encodestereo(aptxbtenc, &pcmL, &pcmR, &encoded_sample);
+    ASSERT_EQ(encoded_sample, codeword);
+  }
+};
+
+TEST_F(LibAptxEncTest, encoder_size) { ASSERT_EQ(SizeofAptxbtenc(), 5008); }
+
+TEST_F(LibAptxEncTest, encode_fake_data) {
+  const char input[] =
+      "012345678901234567890123456789012345678901234567890123456789012345678901"
+      "23456789";
+  const uint32_t aptx_codeword[] = {1270827967, 134154239, 670640127,
+                                    1280265295, 2485752873};
+
+  ASSERT_EQ((sizeof(input) - 1) % BYTES_PER_CODEWORD, 0);
+  ASSERT_EQ((sizeof(input) - 1) / BYTES_PER_CODEWORD,
+            sizeof(aptx_codeword) / sizeof(uint32_t));
+
+  size_t idx = 0;
+
+  uint16_t pcm[8];
+
+  while (idx * BYTES_PER_CODEWORD < sizeof(input) - 1) {
+    memcpy(pcm, input + idx * BYTES_PER_CODEWORD, BYTES_PER_CODEWORD);
+    codeword_cmp(pcm, aptx_codeword[idx]);
+    ++idx;
+  }
+}
diff --git a/system/embdrv/tests/src/aptxhd.cc b/system/embdrv/tests/src/aptxhd.cc
new file mode 100644
index 0000000..f1a7722
--- /dev/null
+++ b/system/embdrv/tests/src/aptxhd.cc
@@ -0,0 +1,82 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <fcntl.h>
+#include <gtest/gtest.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+
+#include <fstream>
+#include <iostream>
+
+#include "aptXHDbtenc.h"
+
+#define BYTES_PER_CODEWORD 24
+
+class LibAptxHdEncTest : public ::testing::Test {
+ private:
+ protected:
+  void* aptxhdbtenc = nullptr;
+  void SetUp() override {
+    aptxhdbtenc = malloc(SizeofAptxhdbtenc());
+    ASSERT_NE(aptxhdbtenc, nullptr);
+    ASSERT_EQ(aptxhdbtenc_init(aptxhdbtenc, 0), 0);
+  }
+
+  void TearDown() override { free(aptxhdbtenc); }
+
+  void codeword_cmp(const uint8_t p[BYTES_PER_CODEWORD],
+                    const uint32_t codeword[2]) {
+    uint32_t pcmL[4];
+    uint32_t pcmR[4];
+    for (size_t i = 0; i < 4; i++) {
+      pcmL[i] = ((p[0] << 0) | (p[1] << 8) | (((int8_t)p[2]) << 16));
+      p += 3;
+      pcmR[i] = ((p[0] << 0) | (p[1] << 8) | (((int8_t)p[2]) << 16));
+      p += 3;
+    }
+    uint32_t encoded_sample[2];
+    aptxhdbtenc_encodestereo(aptxhdbtenc, &pcmL, &pcmR, (void*)encoded_sample);
+
+    ASSERT_EQ(encoded_sample[0], codeword[0]);
+    ASSERT_EQ(encoded_sample[1], codeword[1]);
+  }
+};
+
+TEST_F(LibAptxHdEncTest, encoder_size) { ASSERT_EQ(SizeofAptxhdbtenc(), 5256); }
+
+TEST_F(LibAptxHdEncTest, encode_fake_data) {
+  const char input[] =
+      "012345678901234567890123456789012345678901234567890123456789012345678901"
+      "234567890123456789012345678901234567890123456789";
+  const uint32_t aptxhd_codeword[] = {7585535, 7585535, 32767,   32767,
+                                      557055,  557027,  7586105, 7586109,
+                                      9748656, 10764446};
+
+  ASSERT_EQ((sizeof(input) - 1) % BYTES_PER_CODEWORD, 0);
+  ASSERT_EQ((sizeof(input) - 1) / BYTES_PER_CODEWORD,
+            sizeof(aptxhd_codeword) / sizeof(uint32_t) / 2);
+
+  size_t idx = 0;
+
+  uint8_t pcm[BYTES_PER_CODEWORD];
+  while (idx * BYTES_PER_CODEWORD < sizeof(input) - 1) {
+    memcpy(pcm, input + idx * BYTES_PER_CODEWORD, BYTES_PER_CODEWORD);
+    codeword_cmp(pcm, aptxhd_codeword + idx * 2);
+    ++idx;
+  }
+}
diff --git a/system/gd/Android.bp b/system/gd/Android.bp
index 0f104f3..a3ee5ba 100644
--- a/system/gd/Android.bp
+++ b/system/gd/Android.bp
@@ -10,6 +10,9 @@
 
 cc_defaults {
     name: "gd_defaults",
+    defaults: [
+        "fluoride_common_options",
+    ],
     tidy_checks: [
         "-performance-unnecessary-value-param",
     ],
@@ -42,14 +45,12 @@
         "-fvisibility=hidden",
         "-DLOG_NDEBUG=1",
         "-DGOOGLE_PROTOBUF_NO_RTTI",
-        "-Wno-unused-parameter",
         "-Wno-unused-result",
     ],
     conlyflags: [
         "-std=c99",
     ],
     header_libs: ["jni_headers"],
-
 }
 
 // Enables code coverage for a set of source files. Must be combined with
@@ -216,6 +217,9 @@
     defaults: [
         "libbluetooth_gd_defaults",
     ],
+    apex_available: [
+        "com.android.bluetooth",
+    ],
     min_sdk_version: "31",
 }
 
@@ -225,10 +229,24 @@
         "libbluetooth_gd_defaults",
     ],
     srcs: [
-        ":BluetoothOsSources_fuzz",
+        ":BluetoothOsSources_fake_timer",
     ],
     cflags: [
         "-DFUZZ_TARGET",
+        "-DUSE_FAKE_TIMERS",
+    ],
+}
+
+cc_library {
+    name: "libbluetooth_gd_unit_tests",
+    defaults: [
+        "libbluetooth_gd_defaults",
+    ],
+    srcs: [
+        ":BluetoothOsSources_fake_timer",
+    ],
+    cflags: [
+        "-DUSE_FAKE_TIMERS",
     ],
 }
 
@@ -277,12 +295,12 @@
         "libbt_shim_ffi",
     ],
     shared_libs: [
-        "libbacktrace",
         "libcrypto",
         "libgrpc++",
         "libgrpc++_unsecure",
         "libgrpc_wrap",
         "libprotobuf-cpp-full",
+        "libunwindstack",
     ],
     target: {
         android: {
@@ -322,9 +340,8 @@
         "mts_defaults",
     ],
     host_supported: true,
-    test_options: {
-        unit_test: true,
-    },
+    // TODO(b/231993739): Reenable isolated:true by deleting the explicit disable below
+    isolated: false,
     target: {
         linux: {
             srcs: [
@@ -335,12 +352,16 @@
             srcs: [
                 ":BluetoothHalTestSources_hci_host",
                 ":BluetoothOsTestSources_host",
+                ":BluetoothHostTestingLogCapture",
+                ":BluetoothHostTestingLogCaptureTest",
             ],
         },
         android: {
             srcs: [
                 ":BluetoothHalTestSources_hci_android_hidl",
                 ":BluetoothOsTestSources_android",
+                ":BluetoothAndroidTestingLogCapture",
+                ":BluetoothAndroidTestingLogCaptureTest",
             ],
             static_libs: [
                 "android.system.suspend.control-V1-ndk",
@@ -386,7 +407,7 @@
         "libbluetooth-dumpsys-test",
         "libbluetooth-dumpsys-unittest",
         "libbluetooth-protos",
-        "libbluetooth_gd",
+        "libbluetooth_gd_unit_tests",
         "libc++fs",
         "libflatbuffers-cpp",
         "libgmock",
@@ -394,6 +415,7 @@
         "libbt_callbacks_cxx",
         "libbt_shim_bridge",
         "libbt_shim_ffi",
+        "libbt-platform-protos-lite"
     ],
     shared_libs: [
         "libcrypto",
@@ -488,6 +510,7 @@
     ],
     cflags: [
         "-DFUZZ_TARGET",
+        "-DUSE_FAKE_TIMERS",
     ],
     target: {
         android: {
@@ -601,6 +624,7 @@
     crate_name: "bt_packets",
     srcs: ["rust/packets/lib.rs", ":BluetoothGeneratedPackets_rust"],
     edition: "2018",
+    vendor_available : true,
     host_supported: true,
     proc_macros: ["libnum_derive"],
     rustlibs: [
@@ -615,6 +639,24 @@
     min_sdk_version: "30",
 }
 
+rust_library {
+    name: "libbt_packets_nonapex",
+    defaults: ["gd_rust_defaults"],
+    crate_name: "bt_packets",
+    srcs: ["rust/packets/lib.rs", ":BluetoothGeneratedPackets_rust"],
+    edition: "2018",
+    vendor_available : true,
+    host_supported: true,
+    proc_macros: ["libnum_derive"],
+    rustlibs: [
+        "libbytes",
+        "libnum_traits",
+        "libthiserror",
+        "liblog_rust",
+    ],
+    min_sdk_version: "30",
+}
+
 rust_test_host {
     name: "libbt_packets_test",
     defaults: [
@@ -678,6 +720,7 @@
         "common/init_flags.fbs",
         "dumpsys_data.fbs",
         "hci/hci_acl_manager.fbs",
+        "hci/hci_controller.fbs",
         "l2cap/classic/l2cap_classic_module.fbs",
         "shim/dumpsys.fbs",
         "os/wakelock_manager.fbs",
@@ -688,6 +731,7 @@
         "dumpsys.bfbs",
         "dumpsys_data.bfbs",
         "hci_acl_manager.bfbs",
+        "hci_controller.bfbs",
         "l2cap_classic_module.bfbs",
         "wakelock_manager.bfbs",
     ],
@@ -704,6 +748,7 @@
         "common/init_flags.fbs",
         "dumpsys_data.fbs",
         "hci/hci_acl_manager.fbs",
+        "hci/hci_controller.fbs",
         "l2cap/classic/l2cap_classic_module.fbs",
         "shim/dumpsys.fbs",
         "os/wakelock_manager.fbs",
@@ -713,6 +758,7 @@
         "dumpsys_data_generated.h",
         "dumpsys_generated.h",
         "hci_acl_manager_generated.h",
+        "hci_controller_generated.h",
         "init_flags_generated.h",
         "l2cap_classic_module_generated.h",
         "wakelock_manager_generated.h",
diff --git a/system/gd/AndroidTestTemplate.xml b/system/gd/AndroidTestTemplate.xml
index 4fb4bf9..8332422 100644
--- a/system/gd/AndroidTestTemplate.xml
+++ b/system/gd/AndroidTestTemplate.xml
@@ -24,7 +24,8 @@
     </target_preparer>
   <target_preparer class="com.android.tradefed.targetprep.RunCommandTargetPreparer">
     <option name="run-command" value="settings put global ble_scan_always_enabled 0" />
-    <option name="run-command" value="svc bluetooth disable" />
+    <option name="run-command" value="cmd bluetooth_manager disable" />
+    <option name="run-command" value="cmd bluetooth_manager wait-for-state:STATE_OFF" />
   </target_preparer>
   <target_preparer class="com.android.tradefed.targetprep.FolderSaver">
     <option name="device-path" value="/data/vendor/ssrdump" />
@@ -38,6 +39,7 @@
   <!-- Only run tests in MTS if the Bluetooth Mainline module is installed. -->
   <object type="module_controller"
           class="com.android.tradefed.testtype.suite.module.MainlineTestModuleController">
-      <option name="mainline-module-package-name" value="com.google.android.bluetooth" />
+      <option name="mainline-module-package-name" value="com.android.btservices" />
+      <option name="mainline-module-package-name" value="com.google.android.btservices" />
   </object>
 </configuration>
diff --git a/system/gd/BUILD.gn b/system/gd/BUILD.gn
index 11aa01d..dcd23cd 100644
--- a/system/gd/BUILD.gn
+++ b/system/gd/BUILD.gn
@@ -88,6 +88,7 @@
     "common/init_flags.fbs",
     "dumpsys_data.fbs",
     "hci/hci_acl_manager.fbs",
+    "hci/hci_controller.fbs",
     "l2cap/classic/l2cap_classic_module.fbs",
     "os/wakelock_manager.fbs",
     "shim/dumpsys.fbs",
@@ -100,6 +101,7 @@
     "common/init_flags.fbs",
     "dumpsys_data.fbs",
     "hci/hci_acl_manager.fbs",
+    "hci/hci_controller.fbs",
     "l2cap/classic/l2cap_classic_module.fbs",
     "os/wakelock_manager.fbs",
     "shim/dumpsys.fbs",
diff --git a/system/gd/btaa/linux_generic/cmd_evt_classification.cc b/system/gd/btaa/linux_generic/cmd_evt_classification.cc
index e068d30..b7a5334 100644
--- a/system/gd/btaa/linux_generic/cmd_evt_classification.cc
+++ b/system/gd/btaa/linux_generic/cmd_evt_classification.cc
@@ -268,7 +268,7 @@
     case hci::OpCode::LE_SET_SCAN_RESPONSE_DATA:
     case hci::OpCode::LE_SET_ADVERTISING_ENABLE:
     case hci::OpCode::LE_SET_EXTENDED_ADVERTISING_DATA:
-    case hci::OpCode::LE_SET_EXTENDED_ADVERTISING_SCAN_RESPONSE:
+    case hci::OpCode::LE_SET_EXTENDED_SCAN_RESPONSE_DATA:
     case hci::OpCode::LE_SET_EXTENDED_ADVERTISING_ENABLE:
     case hci::OpCode::LE_READ_MAXIMUM_ADVERTISING_DATA_LENGTH:
     case hci::OpCode::LE_READ_NUMBER_OF_SUPPORTED_ADVERTISING_SETS:
@@ -277,7 +277,7 @@
     case hci::OpCode::LE_SET_PERIODIC_ADVERTISING_PARAM:
     case hci::OpCode::LE_SET_PERIODIC_ADVERTISING_DATA:
     case hci::OpCode::LE_SET_PERIODIC_ADVERTISING_ENABLE:
-    case hci::OpCode::LE_SET_EXTENDED_ADVERTISING_RANDOM_ADDRESS:
+    case hci::OpCode::LE_SET_ADVERTISING_SET_RANDOM_ADDRESS:
       classification = {.activity = Activity::ADVERTISE, .connection_handle_pos = 0, .address_pos = 0};
       break;
 
diff --git a/system/gd/common/Android.bp b/system/gd/common/Android.bp
index 348e532..147025e 100644
--- a/system/gd/common/Android.bp
+++ b/system/gd/common/Android.bp
@@ -10,7 +10,7 @@
 filegroup {
     name: "BluetoothCommonSources",
     srcs: [
-        "init_flags.cc",
+        "audit_log.cc",
         "metric_id_manager.cc",
         "strings.cc",
         "stop_watch.cc",
diff --git a/system/gd/common/BUILD.gn b/system/gd/common/BUILD.gn
index a63b1c2..0678f6f 100644
--- a/system/gd/common/BUILD.gn
+++ b/system/gd/common/BUILD.gn
@@ -16,7 +16,7 @@
 
 source_set("BluetoothCommonSources") {
   sources = [
-    "init_flags.cc",
+    "audit_log.cc",
     "metric_id_manager.cc",
     "stop_watch.cc",
     "strings.cc",
diff --git a/system/gd/common/audit_log.cc b/system/gd/common/audit_log.cc
new file mode 100644
index 0000000..56d1368
--- /dev/null
+++ b/system/gd/common/audit_log.cc
@@ -0,0 +1,51 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "common/audit_log.h"
+
+#include "common/strings.h"
+#include "hci/hci_packets.h"
+#include "os/log.h"
+
+namespace {
+#if defined(OS_ANDROID)
+
+constexpr char kPrivateAddressPrefix[] = "xx:xx:xx:xx";
+#define PRIVATE_ADDRESS(addr) \
+  ((addr).ToString().replace(0, strlen(kPrivateAddressPrefix), kPrivateAddressPrefix).c_str())
+
+// Tags for security logging, should be in sync with
+// frameworks/base/core/java/android/app/admin/SecurityLogTags.logtags
+constexpr int SEC_TAG_BLUETOOTH_CONNECTION = 210039;
+
+#endif /* defined(OS_ANDROID) */
+}  // namespace
+
+namespace bluetooth {
+namespace common {
+
+void LogConnectionAdminAuditEvent(const char* action, const hci::Address& address, hci::ErrorCode status) {
+#if defined(OS_ANDROID)
+
+  android_log_event_list(SEC_TAG_BLUETOOTH_CONNECTION)
+      << PRIVATE_ADDRESS(address) << /* success */ int32_t(status == hci::ErrorCode::SUCCESS)
+      << common::StringFormat("%s: %s", action, ErrorCodeText(status).c_str()).c_str() << LOG_ID_SECURITY;
+
+#endif /* defined(OS_ANDROID) */
+}
+
+}  // namespace common
+}  // namespace bluetooth
\ No newline at end of file
diff --git a/system/gd/common/audit_log.h b/system/gd/common/audit_log.h
new file mode 100644
index 0000000..d96aab2
--- /dev/null
+++ b/system/gd/common/audit_log.h
@@ -0,0 +1,27 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include "hci/hci_packets.h"
+
+namespace bluetooth {
+namespace common {
+
+void LogConnectionAdminAuditEvent(const char* action, const hci::Address& address, hci::ErrorCode status);
+
+}  // namespace common
+}  // namespace bluetooth
\ No newline at end of file
diff --git a/system/gd/common/circular_buffer_test.cc b/system/gd/common/circular_buffer_test.cc
index dc238c2..9a2ef4e 100644
--- a/system/gd/common/circular_buffer_test.cc
+++ b/system/gd/common/circular_buffer_test.cc
@@ -68,6 +68,7 @@
 }
 
 TEST(CircularBufferTest, test_timestamps) {
+  timestamp_ = 0;
   bluetooth::common::TimestampedCircularBuffer<std::string> buffer(10, std::make_unique<TestTimestamper>());
 
   buffer.Push(std::string("One"));
diff --git a/system/gd/common/init_flags.cc b/system/gd/common/init_flags.cc
deleted file mode 100644
index c119aa6..0000000
--- a/system/gd/common/init_flags.cc
+++ /dev/null
@@ -1,122 +0,0 @@
-/******************************************************************************
- *
- *  Copyright 2019 The Android Open Source Project
- *
- *  Licensed under the Apache License, Version 2.0 (the "License");
- *  you may not use this file except in compliance with the License.
- *  You may obtain a copy of the License at:
- *
- *  http://www.apache.org/licenses/LICENSE-2.0
- *
- *  Unless required by applicable law or agreed to in writing, software
- *  distributed under the License is distributed on an "AS IS" BASIS,
- *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- *  See the License for the specific language governing permissions and
- *  limitations under the License.
- *
- ******************************************************************************/
-
-#include "init_flags.h"
-
-#include <cstdlib>
-#include <string>
-
-#include "common/strings.h"
-#include "os/log.h"
-
-namespace bluetooth {
-namespace common {
-
-bool InitFlags::logging_debug_enabled_for_all = false;
-int InitFlags::hci_adapter = 0;
-std::unordered_map<std::string, bool> InitFlags::logging_debug_explicit_tag_settings = {};
-
-bool ParseBoolFlag(const std::vector<std::string>& flag_pair, const std::string& flag, bool* variable) {
-  if (flag != flag_pair[0]) {
-    return false;
-  }
-  auto value = BoolFromString(flag_pair[1]);
-  if (!value) {
-    return false;
-  }
-  *variable = *value;
-  return true;
-}
-
-bool ParseIntFlag(const std::vector<std::string>& flag_pair, const std::string& flag, int* variable) {
-  if (flag != flag_pair[0]) {
-    return false;
-  }
-  auto value = Int64FromString(flag_pair[1]);
-  if (!value || *value > INT32_MAX) {
-    return false;
-  }
-
-  *variable = *value;
-  return true;
-}
-
-void InitFlags::Load(const char** flags) {
-  const char** flags_copy = flags;
-  SetAll(false);
-  while (flags != nullptr && *flags != nullptr) {
-    std::string flag_element = *flags;
-    auto flag_pair = StringSplit(flag_element, "=", 2);
-    if (flag_pair.size() != 2) {
-      flags++;
-      continue;
-    }
-
-    // Parse adapter index (defaults to 0)
-    ParseIntFlag(flag_pair, "--hci", &hci_adapter);
-
-    ParseBoolFlag(flag_pair, "INIT_logging_debug_enabled_for_all", &logging_debug_enabled_for_all);
-    if ("INIT_logging_debug_enabled_for_tags" == flag_pair[0]) {
-      auto tags = StringSplit(flag_pair[1], ",");
-      for (const auto& tag : tags) {
-        auto setting = logging_debug_explicit_tag_settings.find(tag);
-        if (setting == logging_debug_explicit_tag_settings.end()) {
-          logging_debug_explicit_tag_settings.insert_or_assign(tag, true);
-        }
-      }
-    }
-    if ("INIT_logging_debug_disabled_for_tags" == flag_pair[0]) {
-      auto tags = StringSplit(flag_pair[1], ",");
-      for (const auto& tag : tags) {
-        logging_debug_explicit_tag_settings.insert_or_assign(tag, false);
-      }
-    }
-    flags++;
-  }
-
-  std::vector<std::string> logging_debug_enabled_tags;
-  std::vector<std::string> logging_debug_disabled_tags;
-  for (const auto& tag_setting : logging_debug_explicit_tag_settings) {
-    if (tag_setting.second) {
-      logging_debug_enabled_tags.emplace_back(tag_setting.first);
-    } else {
-      logging_debug_disabled_tags.emplace_back(tag_setting.first);
-    }
-  }
-
-  flags = flags_copy;
-  rust::Vec<rust::String> rusted_flags = rust::Vec<rust::String>();
-  while (flags != nullptr && *flags != nullptr) {
-    rusted_flags.push_back(rust::String(*flags));
-    flags++;
-  }
-  init_flags::load(std::move(rusted_flags));
-}
-
-void InitFlags::SetAll(bool value) {
-  logging_debug_enabled_for_all = value;
-  logging_debug_explicit_tag_settings.clear();
-}
-
-void InitFlags::SetAllForTesting() {
-  init_flags::set_all_for_testing();
-  SetAll(true);
-}
-
-}  // namespace common
-}  // namespace bluetooth
diff --git a/system/gd/common/init_flags.fbs b/system/gd/common/init_flags.fbs
index aba1b07..fe11a84 100644
--- a/system/gd/common/init_flags.fbs
+++ b/system/gd/common/init_flags.fbs
@@ -2,16 +2,42 @@
 
 attribute "privacy";
 
+// LINT.IfChange
 table InitFlagsData {
     title:string (privacy:"Any");
+    // Legacy flags
     gd_advertising_enabled:bool (privacy:"Any");
     gd_scanning_enabled:bool (privacy:"Any");
-    gd_security_enabled:bool (privacy:"Any");
     gd_acl_enabled:bool (privacy:"Any");
     gd_hci_enabled:bool (privacy:"Any");
     gd_controller_enabled:bool (privacy:"Any");
-    gd_core_enabled:bool (privacy:"Any");
-    btaa_hci_log_enabled:bool (privacy:"Any");
+
+    always_send_services_if_gatt_disc_done_is_enabled:bool (private:"Any");
+    asynchronously_start_l2cap_coc_is_enabled:bool (privacy:"Any");
+    btaa_hci_is_enabled:bool (privacy:"Any");
+    bta_dm_clear_conn_id_on_client_close_is_enabled:bool (privacy:"Any");
+    btm_dm_flush_discovery_queue_on_search_cancel_is_enabled:bool (privacy:"Any");
+    clear_hidd_interrupt_cid_on_disconnect_is_enabled:bool (privacy:"Any");
+    delay_hidh_cleanup_until_hidh_ready_start_is_enabled:bool (privacy:"Any");
+    gatt_robust_caching_client_is_enabled:bool (privacy:"Any");
+    gatt_robust_caching_server_is_enabled:bool (privacy:"Any");
+    gd_core_is_enabled:bool (privacy:"Any");
+    gd_l2cap_is_enabled:bool (privacy:"Any");
+    gd_link_policy_is_enabled:bool (privacy:"Any");
+    gd_remote_name_request_is_enabled:bool (privacy:"Any");
+    gd_rust_is_enabled:bool (privacy:"Any");
+    gd_security_is_enabled:bool (privacy:"Any");
+    get_hci_adapter:int (privacy:"Any");
+    irk_rotation_is_enabled:bool (privacy:"Any");
+    // is_debug_logging_enabled_for_tag -- skipped in dumpsys
+    leaudio_targeted_announcement_reconnection_mode_is_enabled: bool (privacy:"Any");
+    logging_debug_enabled_for_all_is_enabled:bool (privacy:"Any");
+    pass_phy_update_callback_is_enabled:bool (privacy:"Any");
+    queue_l2cap_coc_while_encrypting_is_enabled:bool (privacy:"Any");
+    sdp_serialization_is_enabled:bool (privacy:"Any");
+    sdp_skip_rnr_if_known_is_enabled:bool (privacy:"Any");
+    trigger_advertising_callbacks_on_first_resume_after_pause_is_enabled:bool (privacy:"Any");
 }
+// LINT.ThenChange(/system/gd/dumpsys/init_flags.cc)
 
 root_type InitFlagsData;
diff --git a/system/gd/common/init_flags.h b/system/gd/common/init_flags.h
index 250e4f5..49a4ffc 100644
--- a/system/gd/common/init_flags.h
+++ b/system/gd/common/init_flags.h
@@ -27,32 +27,38 @@
 
 class InitFlags final {
  public:
-  static void Load(const char** flags);
+  inline static void Load(const char** flags) {
+    rust::Vec<rust::String> rusted_flags = rust::Vec<rust::String>();
+    while (flags != nullptr && *flags != nullptr) {
+      rusted_flags.push_back(rust::String(*flags));
+      flags++;
+    }
+    init_flags::load(std::move(rusted_flags));
+  }
 
   inline static bool IsDebugLoggingEnabledForTag(const std::string& tag) {
-    auto tag_setting = logging_debug_explicit_tag_settings.find(tag);
-    if (tag_setting != logging_debug_explicit_tag_settings.end()) {
-      return tag_setting->second;
-    }
-    return logging_debug_enabled_for_all;
+    return init_flags::is_debug_logging_enabled_for_tag(tag);
   }
 
   inline static bool IsDebugLoggingEnabledForAll() {
-    return logging_debug_enabled_for_all;
+    return init_flags::logging_debug_enabled_for_all_is_enabled();
+  }
+
+  inline static bool IsBtmDmFlushDiscoveryQueueOnSearchCancel() {
+    return init_flags::btm_dm_flush_discovery_queue_on_search_cancel_is_enabled();
+  }
+
+  inline static bool IsTargetedAnnouncementReconnectionMode() {
+    return init_flags::leaudio_targeted_announcement_reconnection_mode_is_enabled();
   }
 
   inline static int GetAdapterIndex() {
-    return hci_adapter;
+    return init_flags::get_hci_adapter();
   }
 
-  static void SetAllForTesting();
-
- private:
-  static void SetAll(bool value);
-  static bool logging_debug_enabled_for_all;
-  static int hci_adapter;
-  // save both log allow list and block list in the map to save hashing time
-  static std::unordered_map<std::string, bool> logging_debug_explicit_tag_settings;
+  inline static void SetAllForTesting() {
+    init_flags::set_all_for_testing();
+  }
 };
 
 }  // namespace common
diff --git a/system/gd/common/init_flags_test.cc b/system/gd/common/init_flags_test.cc
index 76babcc..7bfc55b 100644
--- a/system/gd/common/init_flags_test.cc
+++ b/system/gd/common/init_flags_test.cc
@@ -22,6 +22,18 @@
 
 using bluetooth::common::InitFlags;
 
+TEST(InitFlagsTest, test_enable_btm_flush_discovery_queue_on_search_cancel) {
+  const char* input[] = {"INIT_btm_dm_flush_discovery_queue_on_search_cancel=true", nullptr};
+  InitFlags::Load(input);
+  ASSERT_TRUE(InitFlags::IsBtmDmFlushDiscoveryQueueOnSearchCancel());
+}
+
+TEST(InitFlagsTest, test_leaudio_targeted_announcement_reconnection_mode) {
+  const char* input[] = {"INIT_leaudio_targeted_announcement_reconnection_mode=true", nullptr};
+  InitFlags::Load(input);
+  ASSERT_TRUE(InitFlags::IsTargetedAnnouncementReconnectionMode());
+}
+
 TEST(InitFlagsTest, test_enable_debug_logging_for_all) {
   const char* input[] = {"INIT_logging_debug_enabled_for_all=true", nullptr};
   InitFlags::Load(input);
diff --git a/system/gd/common/interfaces/ILoggable.h b/system/gd/common/interfaces/ILoggable.h
new file mode 100644
index 0000000..ad2b8ab
--- /dev/null
+++ b/system/gd/common/interfaces/ILoggable.h
@@ -0,0 +1,45 @@
+/******************************************************************************
+ *
+ *  Copyright 2022 Google, Inc.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at:
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ ******************************************************************************/
+
+#pragma once
+
+#include <string>
+
+namespace bluetooth {
+namespace common {
+
+class ILoggable {
+ public:
+  // the interface for
+  // converting an object to a string for feeding to loggers
+  // e.g.. logcat
+  virtual std::string ToStringForLogging() const = 0;
+  virtual ~ILoggable() = default;
+};
+
+class IRedactableLoggable : public ILoggable {
+ public:
+  // the interface for
+  // converting an object to a string with sensitive info redacted
+  // to avoid violating privacy
+  virtual std::string ToRedactedStringForLogging() const = 0;
+  virtual ~IRedactableLoggable() = default;
+};
+
+}  // namespace common
+}  // namespace bluetooth
diff --git a/system/gd/common/testing/Android.bp b/system/gd/common/testing/Android.bp
new file mode 100644
index 0000000..f72aee5
--- /dev/null
+++ b/system/gd/common/testing/Android.bp
@@ -0,0 +1,36 @@
+package {
+    // See: http://go/android-license-faq
+    // A large-scale-change added 'default_applicable_licenses' to import
+    // all of the 'license_kinds' from "system_bt_license"
+    // to get the below license kinds:
+    //   SPDX-license-identifier-Apache-2.0
+    default_applicable_licenses: ["system_bt_license"],
+}
+
+filegroup {
+    name: "BluetoothAndroidTestingLogCapture",
+    srcs: [
+            "android/log_capture.cc",
+  ],
+}
+
+filegroup {
+    name: "BluetoothAndroidTestingLogCaptureTest",
+    srcs: [
+            "android/log_capture_test.cc",
+    ],
+}
+
+filegroup {
+    name: "BluetoothHostTestingLogCapture",
+    srcs: [
+            "host/log_capture.cc",
+  ],
+}
+
+filegroup {
+    name: "BluetoothHostTestingLogCaptureTest",
+    srcs: [
+            "host/log_capture_test.cc",
+    ],
+}
diff --git a/system/gd/common/testing/android/log_capture.cc b/system/gd/common/testing/android/log_capture.cc
new file mode 100644
index 0000000..174bc3d
--- /dev/null
+++ b/system/gd/common/testing/android/log_capture.cc
@@ -0,0 +1,84 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "common/testing/log_capture.h"
+
+#include <errno.h>
+#include <fcntl.h>
+#include <sys/stat.h>
+
+#include <cstddef>
+#include <sstream>
+#include <string>
+
+#include "os/log.h"
+
+namespace bluetooth {
+namespace testing {
+
+LogCapture::LogCapture() {
+  LOG_INFO(
+      "Log capture disabled for android build dup_fd:%d fd:%d original_stderr_fd:%d",
+      dup_fd_,
+      fd_,
+      original_stderr_fd_);
+}
+
+LogCapture::~LogCapture() {}
+
+LogCapture* LogCapture::Rewind() {
+  return this;
+}
+
+bool LogCapture::Find(std::string to_find) {
+  // For |atest| assume all log captures succeed
+  return true;
+}
+
+void LogCapture::Flush() {}
+
+void LogCapture::Sync() {}
+
+void LogCapture::Reset() {}
+
+std::string LogCapture::Read() {
+  return std::string();
+}
+
+size_t LogCapture::Size() const {
+  size_t size{0UL};
+  return size;
+}
+
+void LogCapture::WaitUntilLogContains(std::promise<void>* promise, std::string text) {
+  std::async([promise, text]() { promise->set_value(); });
+  promise->get_future().wait();
+}
+
+std::pair<int, int> LogCapture::create_backing_store() const {
+  int dup_fd = -1;
+  int fd = -1;
+  return std::make_pair(dup_fd, fd);
+}
+
+bool LogCapture::set_non_blocking(int fd) const {
+  return true;
+}
+
+void LogCapture::clean_up() {}
+
+}  // namespace testing
+}  // namespace bluetooth
diff --git a/system/gd/common/testing/android/log_capture_test.cc b/system/gd/common/testing/android/log_capture_test.cc
new file mode 100644
index 0000000..a85eac0
--- /dev/null
+++ b/system/gd/common/testing/android/log_capture_test.cc
@@ -0,0 +1,41 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "../log_capture.h"
+
+#include <gtest/gtest.h>
+
+#include <cstring>
+#include <memory>
+#include <string>
+
+#include "common/init_flags.h"
+#include "os/log.h"
+
+namespace bluetooth {
+namespace testing {
+
+class LogCaptureTest : public ::testing::Test {
+ protected:
+  void SetUp() override {}
+
+  void TearDown() override {}
+};
+
+TEST_F(LogCaptureTest, not_working_over_atest) {}
+
+}  // namespace testing
+}  // namespace bluetooth
diff --git a/system/gd/common/testing/host/log_capture.cc b/system/gd/common/testing/host/log_capture.cc
new file mode 100644
index 0000000..4d034b4
--- /dev/null
+++ b/system/gd/common/testing/host/log_capture.cc
@@ -0,0 +1,190 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "common/testing/log_capture.h"
+
+#include <errno.h>
+#include <fcntl.h>
+#include <sys/stat.h>
+
+#include <cstddef>
+#include <sstream>
+#include <string>
+
+#include "os/log.h"
+
+namespace {
+constexpr char kTempFilename[] = "/tmp/bt_gtest_log_capture-XXXXXX";
+constexpr size_t kTempFilenameMaxSize = 64;
+constexpr size_t kBufferSize = 4096;
+constexpr int kStandardErrorFd = STDERR_FILENO;
+}  // namespace
+
+namespace bluetooth {
+namespace testing {
+
+LogCapture::LogCapture() {
+  std::tie(dup_fd_, fd_) = create_backing_store();
+  if (dup_fd_ == -1 || fd_ == -1) {
+    LOG_ERROR("Unable to create backing storage : %s", strerror(errno));
+    return;
+  }
+  if (!set_non_blocking(dup_fd_)) {
+    LOG_ERROR("Unable to set socket non-blocking : %s", strerror(errno));
+    return;
+  }
+  original_stderr_fd_ = fcntl(kStandardErrorFd, F_DUPFD_CLOEXEC);
+  if (original_stderr_fd_ == -1) {
+    LOG_ERROR("Unable to save original fd : %s", strerror(errno));
+    return;
+  }
+  if (dup3(dup_fd_, kStandardErrorFd, O_CLOEXEC) == -1) {
+    LOG_ERROR("Unable to duplicate stderr fd : %s", strerror(errno));
+    return;
+  }
+}
+
+LogCapture::~LogCapture() {
+  Rewind()->Flush();
+  clean_up();
+}
+
+LogCapture* LogCapture::Rewind() {
+  if (fd_ != -1) {
+    if (lseek(fd_, 0, SEEK_SET) != 0) {
+      LOG_ERROR("Unable to rewind log capture : %s", strerror(errno));
+    }
+  }
+  return this;
+}
+
+bool LogCapture::Find(std::string to_find) {
+  std::string str = this->Read();
+  return str.find(to_find) != std::string::npos;
+}
+
+void LogCapture::Flush() {
+  if (fd_ != -1 && original_stderr_fd_ != -1) {
+    ssize_t sz{-1};
+    do {
+      char buf[kBufferSize];
+      sz = read(fd_, buf, sizeof(buf));
+      if (sz > 0) {
+        write(original_stderr_fd_, buf, sz);
+      }
+    } while (sz == kBufferSize);
+  }
+}
+
+void LogCapture::Sync() {
+  if (fd_ != -1) {
+    fsync(fd_);
+  }
+}
+
+void LogCapture::Reset() {
+  if (fd_ != -1) {
+    if (ftruncate(fd_, 0UL) == -1) {
+      LOG_ERROR("Unable to truncate backing storage : %s", strerror(errno));
+    }
+    this->Rewind();
+    // The only time we rewind the dup()'ed fd is during Reset()
+    if (dup_fd_ != -1) {
+      if (lseek(dup_fd_, 0, SEEK_SET) != 0) {
+        LOG_ERROR("Unable to rewind log capture : %s", strerror(errno));
+      }
+    }
+  }
+}
+
+std::string LogCapture::Read() {
+  if (fd_ == -1) {
+    return std::string();
+  }
+  std::ostringstream oss;
+  ssize_t sz{-1};
+  do {
+    char buf[kBufferSize];
+    sz = read(fd_, buf, sizeof(buf));
+    if (sz > 0) {
+      oss << buf;
+    }
+  } while (sz == kBufferSize);
+  return oss.str();
+}
+
+size_t LogCapture::Size() const {
+  size_t size{0UL};
+  struct stat statbuf;
+  if (fd_ != -1 && fstat(fd_, &statbuf) != -1) {
+    size = statbuf.st_size;
+  }
+  return size;
+}
+
+void LogCapture::WaitUntilLogContains(std::promise<void>* promise, std::string text) {
+  std::async([this, promise, text]() {
+    bool found = false;
+    do {
+      found = this->Rewind()->Find(text);
+    } while (!found);
+    promise->set_value();
+  });
+  promise->get_future().wait();
+}
+
+std::pair<int, int> LogCapture::create_backing_store() const {
+  char backing_store_filename[kTempFilenameMaxSize];
+  strncpy(backing_store_filename, kTempFilename, kTempFilenameMaxSize);
+  int dup_fd = mkstemp(backing_store_filename);
+  int fd = open(backing_store_filename, O_RDWR);
+  if (dup_fd != -1) {
+    unlink(backing_store_filename);
+  }
+  return std::make_pair(dup_fd, fd);
+}
+
+bool LogCapture::set_non_blocking(int fd) const {
+  int flags = fcntl(fd, F_GETFL, 0);
+  if (flags == -1) {
+    LOG_ERROR("Unable to get file descriptor flags : %s", strerror(errno));
+    return false;
+  }
+  if (fcntl(fd, F_SETFL, flags | O_NONBLOCK) == -1) {
+    LOG_ERROR("Unable to set file descriptor flags : %s", strerror(errno));
+    return false;
+  }
+  return true;
+}
+
+void LogCapture::clean_up() {
+  if (original_stderr_fd_ != -1) {
+    if (dup3(original_stderr_fd_, kStandardErrorFd, O_CLOEXEC) != kStandardErrorFd) {
+      LOG_ERROR("Unable to restore original fd : %s", strerror(errno));
+    }
+  }
+  if (dup_fd_ != -1) {
+    close(dup_fd_);
+    dup_fd_ = -1;
+  }
+  if (fd_ != -1) {
+    close(fd_);
+    fd_ = -1;
+  }
+}
+
+}  // namespace testing
+}  // namespace bluetooth
diff --git a/system/gd/common/testing/host/log_capture_test.cc b/system/gd/common/testing/host/log_capture_test.cc
new file mode 100644
index 0000000..320b4fe
--- /dev/null
+++ b/system/gd/common/testing/host/log_capture_test.cc
@@ -0,0 +1,155 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "../log_capture.h"
+
+#include <gtest/gtest.h>
+
+#include <cstring>
+#include <memory>
+#include <string>
+
+#include "common/init_flags.h"
+#include "os/log.h"
+
+namespace {
+const char* test_flags[] = {
+    "INIT_logging_debug_enabled_for_all=true",
+    nullptr,
+};
+
+constexpr char kEmptyLine[] = "";
+constexpr char kLogError[] = "LOG_ERROR";
+constexpr char kLogWarn[] = "LOG_WARN";
+constexpr char kLogInfo[] = "LOG_INFO";
+constexpr char kLogDebug[] = "LOG_DEBUG";
+constexpr char kLogVerbose[] = "LOG_VERBOSE";
+
+}  // namespace
+
+namespace bluetooth {
+namespace testing {
+
+class LogCaptureTest : public ::testing::Test {
+ protected:
+  void SetUp() override {}
+
+  void TearDown() override {}
+
+  // The line number is part of the log output and must be factored out
+  size_t CalibrateOneLine(const char* log_line) {
+    LOG_INFO("%s", log_line);
+    return strlen(log_line);
+  }
+};
+
+TEST_F(LogCaptureTest, no_output) {
+  std::unique_ptr<LogCapture> log_capture = std::make_unique<LogCapture>();
+
+  ASSERT_TRUE(log_capture->Size() == 0);
+}
+
+// b/260917913
+TEST_F(LogCaptureTest, DISABLED_truncate) {
+  std::unique_ptr<LogCapture> log_capture = std::make_unique<LogCapture>();
+
+  CalibrateOneLine(kLogError);
+  size_t size = log_capture->Size();
+  ASSERT_TRUE(size > 0);
+
+  log_capture->Reset();
+  ASSERT_EQ(0UL, log_capture->Size());
+
+  CalibrateOneLine(kLogError);
+  ASSERT_EQ(size, log_capture->Size());
+}
+
+// b/260917913
+TEST_F(LogCaptureTest, DISABLED_log_size) {
+  std::unique_ptr<LogCapture> log_capture = std::make_unique<LogCapture>();
+
+  CalibrateOneLine(kEmptyLine);
+  size_t empty_line_size = log_capture->Size();
+  log_capture->Reset();
+
+  std::vector<std::string> log_lines = {
+      kLogError,
+      kLogWarn,
+      kLogInfo,
+  };
+
+  size_t msg_size{0};
+  for (auto& log_line : log_lines) {
+    msg_size += CalibrateOneLine(log_line.c_str());
+  }
+
+  ASSERT_EQ(empty_line_size * log_lines.size() + msg_size, log_capture->Size());
+
+  ASSERT_TRUE(log_capture->Rewind()->Find(kLogError));
+  ASSERT_TRUE(log_capture->Rewind()->Find(kLogWarn));
+  ASSERT_TRUE(log_capture->Rewind()->Find(kLogInfo));
+}
+
+// b/260917913
+TEST_F(LogCaptureTest, DISABLED_typical) {
+  bluetooth::common::InitFlags::Load(nullptr);
+  std::unique_ptr<LogCapture> log_capture = std::make_unique<LogCapture>();
+
+  LOG_ERROR("%s", kLogError);
+  LOG_WARN("%s", kLogWarn);
+  LOG_INFO("%s", kLogInfo);
+  LOG_DEBUG("%s", kLogDebug);
+  LOG_VERBOSE("%s", kLogVerbose);
+
+  ASSERT_TRUE(log_capture->Rewind()->Find(kLogError));
+  ASSERT_TRUE(log_capture->Rewind()->Find(kLogWarn));
+  ASSERT_TRUE(log_capture->Rewind()->Find(kLogInfo));
+  ASSERT_FALSE(log_capture->Rewind()->Find(kLogDebug));
+  ASSERT_FALSE(log_capture->Rewind()->Find(kLogVerbose));
+}
+
+// b/260917913
+TEST_F(LogCaptureTest, DISABLED_with_logging_debug_enabled_for_all) {
+  bluetooth::common::InitFlags::Load(test_flags);
+  std::unique_ptr<LogCapture> log_capture = std::make_unique<LogCapture>();
+
+  LOG_ERROR("%s", kLogError);
+  LOG_WARN("%s", kLogWarn);
+  LOG_INFO("%s", kLogInfo);
+  LOG_DEBUG("%s", kLogDebug);
+  LOG_VERBOSE("%s", kLogVerbose);
+
+  ASSERT_TRUE(log_capture->Rewind()->Find(kLogError));
+  ASSERT_TRUE(log_capture->Rewind()->Find(kLogWarn));
+  ASSERT_TRUE(log_capture->Rewind()->Find(kLogInfo));
+  ASSERT_TRUE(log_capture->Rewind()->Find(kLogDebug));
+  ASSERT_TRUE(log_capture->Rewind()->Find(kLogVerbose));
+  bluetooth::common::InitFlags::Load(nullptr);
+}
+
+// b/260917913
+TEST_F(LogCaptureTest, DISABLED_wait_until_log_contains) {
+  bluetooth::common::InitFlags::Load(test_flags);
+  std::unique_ptr<LogCapture> log_capture = std::make_unique<LogCapture>();
+
+  LOG_DEBUG("%s", kLogDebug);
+  std::promise<void> promise;
+  log_capture->WaitUntilLogContains(&promise, kLogDebug);
+  bluetooth::common::InitFlags::Load(nullptr);
+}
+
+}  // namespace testing
+}  // namespace bluetooth
diff --git a/system/gd/common/testing/log_capture.h b/system/gd/common/testing/log_capture.h
new file mode 100644
index 0000000..e08c0fa
--- /dev/null
+++ b/system/gd/common/testing/log_capture.h
@@ -0,0 +1,59 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <cstddef>
+#include <future>
+#include <string>
+
+namespace bluetooth {
+namespace testing {
+
+class LogCapture {
+ public:
+  LogCapture();
+  ~LogCapture();
+
+  // Rewind file pointer to start of log
+  // Returns a |this| pointer for chaining.  See |Find|
+  LogCapture* Rewind();
+  // Searches from filepointer to end of file for |to_find| string
+  // Returns true if found, false otherwise
+  bool Find(std::string to_find);
+  // Reads and returns the entirety of the backing store into a string
+  std::string Read();
+  // Flushes contents of log capture back to |stderr|
+  void Flush();
+  // Synchronize buffer contents to file descriptor
+  void Sync();
+  // Returns the backing store size in bytes
+  size_t Size() const;
+  // Truncates and resets the file pointer discarding all logs up to this point
+  void Reset();
+  // Wait until the provided string shows up in the logs
+  void WaitUntilLogContains(std::promise<void>* promise, std::string text);
+
+ private:
+  std::pair<int, int> create_backing_store() const;
+  bool set_non_blocking(int fd) const;
+  void clean_up();
+
+  int dup_fd_{-1};
+  int fd_{-1};
+  int original_stderr_fd_{-1};
+};
+
+}  // namespace testing
+}  // namespace bluetooth
diff --git a/system/gd/common/testing/log_capture_test.cc b/system/gd/common/testing/log_capture_test.cc
new file mode 100644
index 0000000..333128b
--- /dev/null
+++ b/system/gd/common/testing/log_capture_test.cc
@@ -0,0 +1,149 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "log_capture.h"
+
+#include <gtest/gtest.h>
+
+#include <cstring>
+#include <memory>
+#include <string>
+
+#include "common/init_flags.h"
+#include "os/log.h"
+
+namespace {
+const char* test_flags[] = {
+    "INIT_logging_debug_enabled_for_all=true",
+    nullptr,
+};
+
+constexpr char kEmptyLine[] = "";
+constexpr char kLogError[] = "LOG_ERROR";
+constexpr char kLogWarn[] = "LOG_WARN";
+constexpr char kLogInfo[] = "LOG_INFO";
+constexpr char kLogDebug[] = "LOG_DEBUG";
+constexpr char kLogVerbose[] = "LOG_VERBOSE";
+
+}  // namespace
+
+namespace bluetooth {
+namespace testing {
+
+class LogCaptureTest : public ::testing::Test {
+ protected:
+  void SetUp() override {}
+
+  void TearDown() override {}
+
+  // The line number is part of the log output and must be factored out
+  size_t CalibrateOneLine(const char* log_line) {
+    LOG_INFO("%s", log_line);
+    return strlen(log_line);
+  }
+};
+
+TEST_F(LogCaptureTest, no_output) {
+  std::unique_ptr<LogCapture> log_capture = std::make_unique<LogCapture>();
+
+  ASSERT_TRUE(log_capture->Size() == 0);
+}
+
+TEST_F(LogCaptureTest, truncate) {
+  std::unique_ptr<LogCapture> log_capture = std::make_unique<LogCapture>();
+
+  CalibrateOneLine(kLogError);
+  size_t size = log_capture->Size();
+  ASSERT_TRUE(size > 0);
+
+  log_capture->Reset();
+  ASSERT_EQ(0UL, log_capture->Size());
+
+  CalibrateOneLine(kLogError);
+  ASSERT_EQ(size, log_capture->Size());
+}
+
+TEST_F(LogCaptureTest, log_size) {
+  std::unique_ptr<LogCapture> log_capture = std::make_unique<LogCapture>();
+
+  CalibrateOneLine(kEmptyLine);
+  size_t empty_line_size = log_capture->Size();
+  log_capture->Reset();
+
+  std::vector<std::string> log_lines = {
+      kLogError,
+      kLogWarn,
+      kLogInfo,
+  };
+
+  size_t msg_size{0};
+  for (auto& log_line : log_lines) {
+    msg_size += CalibrateOneLine(log_line.c_str());
+  }
+
+  ASSERT_EQ(empty_line_size * log_lines.size() + msg_size, log_capture->Size());
+
+  ASSERT_TRUE(log_capture->Rewind()->Find(kLogError));
+  ASSERT_TRUE(log_capture->Rewind()->Find(kLogWarn));
+  ASSERT_TRUE(log_capture->Rewind()->Find(kLogInfo));
+}
+
+TEST_F(LogCaptureTest, typical) {
+  std::unique_ptr<LogCapture> log_capture = std::make_unique<LogCapture>();
+
+  LOG_ERROR("%s", kLogError);
+  LOG_WARN("%s", kLogWarn);
+  LOG_INFO("%s", kLogInfo);
+  LOG_DEBUG("%s", kLogDebug);
+  LOG_VERBOSE("%s", kLogVerbose);
+
+  ASSERT_TRUE(log_capture->Rewind()->Find(kLogError));
+  ASSERT_TRUE(log_capture->Rewind()->Find(kLogWarn));
+  ASSERT_TRUE(log_capture->Rewind()->Find(kLogInfo));
+  ASSERT_FALSE(log_capture->Rewind()->Find(kLogDebug));
+  ASSERT_FALSE(log_capture->Rewind()->Find(kLogVerbose));
+}
+
+TEST_F(LogCaptureTest, with_logging_debug_enabled_for_all) {
+  bluetooth::common::InitFlags::Load(test_flags);
+  std::unique_ptr<LogCapture> log_capture = std::make_unique<LogCapture>();
+
+  LOG_ERROR("%s", kLogError);
+  LOG_WARN("%s", kLogWarn);
+  LOG_INFO("%s", kLogInfo);
+  LOG_DEBUG("%s", kLogDebug);
+  LOG_VERBOSE("%s", kLogVerbose);
+
+  ASSERT_TRUE(log_capture->Rewind()->Find(kLogError));
+  ASSERT_TRUE(log_capture->Rewind()->Find(kLogWarn));
+  ASSERT_TRUE(log_capture->Rewind()->Find(kLogInfo));
+  ASSERT_TRUE(log_capture->Rewind()->Find(kLogDebug));
+  ASSERT_TRUE(log_capture->Rewind()->Find(kLogVerbose));
+  bluetooth::common::InitFlags::Load(nullptr);
+}
+
+TEST_F(LogCaptureTest, wait_until_log_contains) {
+  bluetooth::common::InitFlags::Load(test_flags);
+  std::unique_ptr<LogCapture> log_capture = std::make_unique<LogCapture>();
+
+  LOG_DEBUG("%s", kLogDebug);
+  std::promise<void> promise;
+  log_capture->WaitUntilLogContains(&promise, kLogDebug);
+  bluetooth::common::InitFlags::Load(nullptr);
+}
+
+}  // namespace testing
+}  // namespace bluetooth
diff --git a/system/gd/dumpsys/Android.bp b/system/gd/dumpsys/Android.bp
index 0241b00..a309bb2 100644
--- a/system/gd/dumpsys/Android.bp
+++ b/system/gd/dumpsys/Android.bp
@@ -177,7 +177,7 @@
 cc_test {
     name: "bluetooth_flatbuffer_tests",
     test_suites: ["device-tests"],
-    defaults: ["mts_defaults"],
+    defaults: ["fluoride_common_options", "mts_defaults"],
     host_supported: true,
     test_options: {
         unit_test: true,
@@ -192,9 +192,4 @@
     generated_headers: [
         "BluetoothFlatbufferTestData_h",
     ],
-    cflags: [
-        "-Werror",
-        "-Wall",
-        "-Wextra",
-    ],
 }
diff --git a/system/gd/dumpsys/bundler/Android.bp b/system/gd/dumpsys/bundler/Android.bp
index ce2c4e2..41f5549 100644
--- a/system/gd/dumpsys/bundler/Android.bp
+++ b/system/gd/dumpsys/bundler/Android.bp
@@ -46,13 +46,8 @@
 
 cc_defaults {
     name: "bluetooth_flatbuffer_bundler_defaults",
+    defaults: ["fluoride_common_options"],
     cpp_std: "c++17",
-    cflags: [
-        "-Wall",
-        "-Werror",
-        "-Wno-unused-parameter",
-        "-Wno-unused-variable",
-    ],
     generated_headers: [
         "BluetoothGeneratedBundlerSchema_h_bfbs",
     ],
@@ -74,9 +69,8 @@
     ],
 }
 
-cc_test {
+cc_test_host {
     name: "bluetooth_flatbuffer_bundler_test",
-    host_supported: true,
     srcs: [
         ":BluetoothFlatbufferBundlerTestSources",
     ],
diff --git a/system/gd/dumpsys/bundler/bundler.cc b/system/gd/dumpsys/bundler/bundler.cc
index 08a2cca..f2e6559 100644
--- a/system/gd/dumpsys/bundler/bundler.cc
+++ b/system/gd/dumpsys/bundler/bundler.cc
@@ -153,7 +153,7 @@
   fprintf(fp, "extern const std::string& GetBundledSchemaData();\n");
   fprintf(fp, "const unsigned char %sdata_[%zu] = {\n", namespace_prefix.c_str(), data_len);
 
-  for (auto i = 0; i < data_len; i++) {
+  for (size_t i = 0; i < data_len; i++) {
     fprintf(fp, " 0x%02x", data[i]);
     if (i != data_len - 1) {
       fprintf(fp, ",");
diff --git a/system/gd/dumpsys/bundler/test.cc b/system/gd/dumpsys/bundler/test.cc
index 929b6ff..24d2f91 100644
--- a/system/gd/dumpsys/bundler/test.cc
+++ b/system/gd/dumpsys/bundler/test.cc
@@ -66,7 +66,7 @@
   std::vector<flatbuffers::Offset<bluetooth::dumpsys::BundledSchemaMap>> vector_map;
   std::list<std::string> bundled_names;
   ASSERT_TRUE(CreateBinarySchemaBundle(&builder, filenames, &vector_map, &bundled_names));
-  ASSERT_EQ(0, vector_map.size());
+  ASSERT_EQ((unsigned int)0, vector_map.size());
 }
 
 TEST_F(BundlerTest, WriteHeaderFile) {
diff --git a/system/gd/dumpsys/init_flags.cc b/system/gd/dumpsys/init_flags.cc
index 237219e..f1e3aec 100644
--- a/system/gd/dumpsys/init_flags.cc
+++ b/system/gd/dumpsys/init_flags.cc
@@ -15,9 +15,13 @@
  */
 
 #include "common/init_flags.h"
+
 #include "dumpsys/init_flags.h"
 #include "init_flags_generated.h"
 
+namespace initFlags = bluetooth::common::init_flags;
+
+// LINT.IfChange
 flatbuffers::Offset<bluetooth::common::InitFlagsData> bluetooth::dumpsys::InitFlags::Dump(
     flatbuffers::FlatBufferBuilder* fb_builder) {
   auto title = fb_builder->CreateString("----- Init Flags -----");
@@ -25,11 +29,41 @@
   builder.add_title(title);
   builder.add_gd_advertising_enabled(true);
   builder.add_gd_scanning_enabled(true);
-  builder.add_gd_security_enabled(bluetooth::common::init_flags::gd_security_is_enabled());
   builder.add_gd_acl_enabled(true);
   builder.add_gd_hci_enabled(true);
   builder.add_gd_controller_enabled(true);
-  builder.add_gd_core_enabled(bluetooth::common::init_flags::gd_core_is_enabled());
-  builder.add_btaa_hci_log_enabled(bluetooth::common::init_flags::btaa_hci_is_enabled());
+
+  builder.add_always_send_services_if_gatt_disc_done_is_enabled(
+      initFlags::always_send_services_if_gatt_disc_done_is_enabled());
+  builder.add_asynchronously_start_l2cap_coc_is_enabled(initFlags::asynchronously_start_l2cap_coc_is_enabled());
+  builder.add_btaa_hci_is_enabled(initFlags::btaa_hci_is_enabled());
+  builder.add_bta_dm_clear_conn_id_on_client_close_is_enabled(
+      initFlags::bta_dm_clear_conn_id_on_client_close_is_enabled());
+  builder.add_btm_dm_flush_discovery_queue_on_search_cancel_is_enabled(
+      initFlags::btm_dm_flush_discovery_queue_on_search_cancel_is_enabled());
+  builder.add_clear_hidd_interrupt_cid_on_disconnect_is_enabled(
+      initFlags::clear_hidd_interrupt_cid_on_disconnect_is_enabled());
+  builder.add_delay_hidh_cleanup_until_hidh_ready_start_is_enabled(
+      initFlags::delay_hidh_cleanup_until_hidh_ready_start_is_enabled());
+  builder.add_gatt_robust_caching_server_is_enabled(initFlags::gatt_robust_caching_server_is_enabled());
+  builder.add_gd_core_is_enabled(initFlags::gd_core_is_enabled());
+  builder.add_gd_l2cap_is_enabled(initFlags::gd_l2cap_is_enabled());
+  builder.add_gd_link_policy_is_enabled(initFlags::gd_link_policy_is_enabled());
+  builder.add_gd_rust_is_enabled(initFlags::gd_rust_is_enabled());
+  builder.add_gd_security_is_enabled(initFlags::gd_security_is_enabled());
+  builder.add_get_hci_adapter(initFlags::get_hci_adapter());
+  builder.add_irk_rotation_is_enabled(initFlags::irk_rotation_is_enabled());
+  // is_debug_logging_enabled_for_tag -- skipped in dumpsys
+  builder.add_leaudio_targeted_announcement_reconnection_mode_is_enabled(
+      initFlags::leaudio_targeted_announcement_reconnection_mode_is_enabled());
+  builder.add_logging_debug_enabled_for_all_is_enabled(initFlags::logging_debug_enabled_for_all_is_enabled());
+  builder.add_pass_phy_update_callback_is_enabled(initFlags::pass_phy_update_callback_is_enabled());
+  builder.add_queue_l2cap_coc_while_encrypting_is_enabled(initFlags::queue_l2cap_coc_while_encrypting_is_enabled());
+  builder.add_sdp_serialization_is_enabled(initFlags::sdp_serialization_is_enabled());
+  builder.add_sdp_skip_rnr_if_known_is_enabled(initFlags::sdp_skip_rnr_if_known_is_enabled());
+  builder.add_trigger_advertising_callbacks_on_first_resume_after_pause_is_enabled(
+      initFlags::trigger_advertising_callbacks_on_first_resume_after_pause_is_enabled());
+
   return builder.Finish();
 }
+// LINT.ThenChange(/system/gd/rust/common/src/init_flags.rs)
diff --git a/system/gd/dumpsys_data.fbs b/system/gd/dumpsys_data.fbs
index 85992b1..326d211 100644
--- a/system/gd/dumpsys_data.fbs
+++ b/system/gd/dumpsys_data.fbs
@@ -12,6 +12,7 @@
 include "btaa/activity_attribution.fbs";
 include "common/init_flags.fbs";
 include "hci/hci_acl_manager.fbs";
+include "hci/hci_controller.fbs";
 include "l2cap/classic/l2cap_classic_module.fbs";
 include "module_unittest.fbs";
 include "os/wakelock_manager.fbs";
@@ -28,6 +29,7 @@
     shim_dumpsys_data:bluetooth.shim.DumpsysModuleData (privacy:"Any");
     l2cap_classic_dumpsys_data:bluetooth.l2cap.classic.L2capClassicModuleData (privacy:"Any");
     hci_acl_manager_dumpsys_data:bluetooth.hci.AclManagerData (privacy:"Any");
+    hci_controller_dumpsys_data:bluetooth.hci.ControllerData (privacy:"Any");
     module_unittest_data:bluetooth.ModuleUnitTestData; // private
     activity_attribution_dumpsys_data:bluetooth.activity_attribution.ActivityAttributionData (privacy:"Any");
 }
diff --git a/system/gd/facade/facade_main.cc b/system/gd/facade/facade_main.cc
index a48df00..bda4e00 100644
--- a/system/gd/facade/facade_main.cc
+++ b/system/gd/facade/facade_main.cc
@@ -20,6 +20,7 @@
 #include <csignal>
 #include <cstring>
 #include <memory>
+#include <optional>
 #include <string>
 #include <thread>
 
@@ -27,8 +28,7 @@
 
 // clang-format off
 #include <client/linux/handler/exception_handler.h>
-#include <backtrace/Backtrace.h>
-#include <backtrace/backtrace_constants.h>
+#include <unwindstack/AndroidUnwinder.h>
 // clang-format on
 
 #include "common/init_flags.h"
@@ -71,7 +71,7 @@
 struct sigaction new_act = {.sa_handler = interrupt_handler};
 
 bool crash_callback(const void* crash_context, size_t crash_context_size, void* context) {
-  pid_t tid = BACKTRACE_CURRENT_THREAD;
+  std::optional<pid_t> tid;
   if (crash_context_size >= sizeof(google_breakpad::ExceptionHandler::CrashContext)) {
     auto* ctx = static_cast<const google_breakpad::ExceptionHandler::CrashContext*>(crash_context);
     tid = ctx->tid;
@@ -80,18 +80,15 @@
   } else {
     LOG_ERROR("Process crashed, signal: unknown, tid: unknown");
   }
-  std::unique_ptr<Backtrace> backtrace(Backtrace::Create(BACKTRACE_CURRENT_PROCESS, tid));
-  if (backtrace == nullptr) {
-    LOG_ERROR("Failed to create backtrace object");
-    return false;
-  }
-  if (!backtrace->Unwind(0)) {
-    LOG_ERROR("backtrace->Unwind failed");
+  unwindstack::AndroidLocalUnwinder unwinder;
+  unwindstack::AndroidUnwinderData data;
+  if (!unwinder.Unwind(tid, data)) {
+    LOG_ERROR("Unwind failed");
     return false;
   }
   LOG_ERROR("Backtrace:");
-  for (size_t i = 0; i < backtrace->NumFrames(); i++) {
-    LOG_ERROR("%s", backtrace->FormatFrameData(i).c_str());
+  for (const auto& frame : data.frames) {
+    LOG_ERROR("%s", unwinder.FormatFrame(frame).c_str());
   }
   return true;
 }
diff --git a/system/gd/hal/snoop_logger.cc b/system/gd/hal/snoop_logger.cc
index 72e20e9..e3b585c 100644
--- a/system/gd/hal/snoop_logger.cc
+++ b/system/gd/hal/snoop_logger.cc
@@ -27,12 +27,16 @@
 #include "common/circular_buffer.h"
 #include "common/init_flags.h"
 #include "common/strings.h"
+#include "os/fake_timer/fake_timerfd.h"
 #include "os/files.h"
 #include "os/log.h"
 #include "os/parameter_provider.h"
 #include "os/system_properties.h"
 
 namespace bluetooth {
+#ifdef USE_FAKE_TIMERS
+using os::fake_timer::fake_timerfd_get_clock;
+#endif
 namespace hal {
 
 namespace {
@@ -109,13 +113,18 @@
 void delete_old_btsnooz_files(const std::string& log_path, const std::chrono::milliseconds log_life_time) {
   auto opt_created_ts = os::FileCreatedTime(log_path);
   if (!opt_created_ts) return;
-
+#ifdef USE_FAKE_TIMERS
+  auto diff = fake_timerfd_get_clock() - file_creation_time;
+  uint64_t log_lifetime = log_life_time.count();
+  if (diff >= log_lifetime) {
+#else
   using namespace std::chrono;
   auto created_tp = opt_created_ts.value();
   auto current_tp = std::chrono::system_clock::now();
 
   auto diff = duration_cast<milliseconds>(current_tp - created_tp);
   if (diff >= log_life_time) {
+#endif
     delete_btsnoop_files(log_path);
   }
 }
@@ -184,6 +193,7 @@
 }  // namespace
 
 const std::string SnoopLogger::kBtSnoopLogModeDisabled = "disabled";
+const std::string SnoopLogger::kBtSnoopLogModeTruncated = "truncated";
 const std::string SnoopLogger::kBtSnoopLogModeFiltered = "filtered";
 const std::string SnoopLogger::kBtSnoopLogModeFull = "full";
 const std::string SnoopLogger::kSoCManufacturerQualcomm = "Qualcomm";
@@ -194,6 +204,10 @@
 const std::string SnoopLogger::kBtSnoopDefaultLogModeProperty = "persist.bluetooth.btsnoopdefaultmode";
 const std::string SnoopLogger::kSoCManufacturerProperty = "ro.soc.manufacturer";
 
+// The max ACL packet size (in bytes) in truncated logging mode. All information
+// past this point is truncated from a packet.
+static constexpr uint32_t kMaxTruncatedAclPacketSize = 100;
+
 SnoopLogger::SnoopLogger(
     std::string snoop_log_path,
     std::string snooz_log_path,
@@ -227,6 +241,15 @@
     delete_btsnoop_files(get_btsnoop_log_path(snoop_log_path_, true));
     // delete snooz logs
     delete_btsnoop_files(snooz_log_path_);
+  } else if (btsnoop_mode == kBtSnoopLogModeTruncated) {
+    LOG_INFO("Snoop Logs truncated. Limiting to %u", kMaxTruncatedAclPacketSize);
+    is_enabled_ = true;
+    is_truncated_ = true;
+    is_filtered_ = false;
+    // delete filtered logs
+    delete_btsnoop_files(get_btsnoop_log_path(snoop_log_path_, true));
+    // delete snooz logs
+    delete_btsnoop_files(snooz_log_path_);
   } else {
     LOG_INFO("Snoop Logs disabled");
     is_enabled_ = false;
@@ -268,6 +291,9 @@
   mode_t prevmask = umask(0);
   // do not use std::ios::app as we want override the existing file
   btsnoop_ostream_.open(snoop_log_path_, std::ios::binary | std::ios::out);
+#ifdef USE_FAKE_TIMERS
+  file_creation_time = fake_timerfd_get_clock();
+#endif
   if (!btsnoop_ostream_.good()) {
     LOG_ALWAYS_FATAL("Unable to open snoop log at \"%s\", error: \"%s\"", snoop_log_path_.c_str(), strerror(errno));
   }
@@ -308,6 +334,9 @@
                              .dropped_packets = 0,
                              .timestamp = htonll(timestamp_us + kBtSnoopEpochDelta),
                              .type = static_cast<uint8_t>(type)};
+  if (is_truncated_ && type == PacketType::ACL) {
+    header.length_captured = htonl(std::min(length, kMaxTruncatedAclPacketSize));
+  }
   {
     std::lock_guard<std::recursive_mutex> lock(file_mutex_);
     if (!is_enabled_) {
@@ -433,9 +462,8 @@
 size_t SnoopLogger::GetMaxPacketsPerBuffer() {
   // We want to use at most 256 KB memory for btsnooz log for release builds
   // and 512 KB memory for userdebug/eng builds
-  auto is_debuggable = os::GetSystemProperty(kIsDebuggableProperty);
-  size_t btsnooz_max_memory_usage_bytes =
-      ((is_debuggable.has_value() && common::StringTrim(is_debuggable.value()) == "1") ? 1024 : 256) * 1024;
+  auto is_debuggable = os::GetSystemPropertyBool(kIsDebuggableProperty, false);
+  size_t btsnooz_max_memory_usage_bytes = (is_debuggable ? 1024 : 256) * 1024;
   // Calculate max number of packets based on max memory usage and max packet size
   return btsnooz_max_memory_usage_bytes / kDefaultBtSnoozMaxBytesPerPacket;
 }
@@ -445,8 +473,8 @@
   // In userdebug/eng build, it can also be overwritten by modifying the global setting
   std::string default_mode = kBtSnoopLogModeDisabled;
   {
-    auto is_debuggable = os::GetSystemProperty(kIsDebuggableProperty);
-    if (is_debuggable.has_value() && common::StringTrim(is_debuggable.value()) == "1") {
+    auto is_debuggable = os::GetSystemPropertyBool(kIsDebuggableProperty, false);
+    if (is_debuggable) {
       auto default_mode_property = os::GetSystemProperty(kBtSnoopDefaultLogModeProperty);
       if (default_mode_property) {
         default_mode = std::move(default_mode_property.value());
diff --git a/system/gd/hal/snoop_logger.h b/system/gd/hal/snoop_logger.h
index fac4036..f879798 100644
--- a/system/gd/hal/snoop_logger.h
+++ b/system/gd/hal/snoop_logger.h
@@ -29,11 +29,16 @@
 namespace bluetooth {
 namespace hal {
 
+#ifdef USE_FAKE_TIMERS
+static uint64_t file_creation_time;
+#endif
+
 class SnoopLogger : public ::bluetooth::Module {
  public:
   static const ModuleFactory Factory;
 
   static const std::string kBtSnoopLogModeDisabled;
+  static const std::string kBtSnoopLogModeTruncated;
   static const std::string kBtSnoopLogModeFiltered;
   static const std::string kBtSnoopLogModeFull;
   static const std::string kSoCManufacturerQualcomm;
@@ -120,6 +125,7 @@
   std::ofstream btsnoop_ostream_;
   bool is_enabled_ = false;
   bool is_filtered_ = false;
+  bool is_truncated_ = false;
   size_t max_packets_per_file_;
   common::CircularBuffer<std::string> btsnooz_buffer_;
   bool qualcomm_debug_log_enabled_ = false;
diff --git a/system/gd/hal/snoop_logger_test.cc b/system/gd/hal/snoop_logger_test.cc
index 222a481..0b5050d 100644
--- a/system/gd/hal/snoop_logger_test.cc
+++ b/system/gd/hal/snoop_logger_test.cc
@@ -19,8 +19,13 @@
 #include <gmock/gmock.h>
 #include <gtest/gtest.h>
 
+#include "os/fake_timer/fake_timerfd.h"
+
 namespace testing {
 
+using bluetooth::os::fake_timer::fake_timerfd_advance;
+using bluetooth::os::fake_timer::fake_timerfd_reset;
+
 namespace {
 std::vector<uint8_t> kInformationRequest = {
     0xfe,
@@ -107,6 +112,7 @@
   void TearDown() override {
     DeleteSnoopLogFiles();
     delete builder_;
+    fake_timerfd_reset();
   }
 
   void DeleteSnoopLogFiles() {
@@ -279,11 +285,13 @@
 
   std::filesystem::create_directories(temp_snooz_log_);
 
+  auto* handler = test_registry.GetTestModuleHandler(&SnoopLogger::Factory);
   ASSERT_TRUE(std::filesystem::exists(temp_snooz_log_));
-  std::this_thread::sleep_for(10ms);
+  handler->Post(bluetooth::common::BindOnce(fake_timerfd_advance, 10));
   ASSERT_TRUE(std::filesystem::exists(temp_snooz_log_));
-  std::this_thread::sleep_for(15ms);
-  ASSERT_FALSE(std::filesystem::exists(temp_snooz_log_));
+  handler->Post(bluetooth::common::BindOnce(fake_timerfd_advance, 15));
+  handler->Post(bluetooth::common::BindOnce(
+      [](std::filesystem::path path) { ASSERT_FALSE(std::filesystem::exists(path)); }, temp_snooz_log_));
   test_registry.StopAll();
 }
 
diff --git a/system/gd/hci/Android.bp b/system/gd/hci/Android.bp
index 519bf6f..3dad0d6 100644
--- a/system/gd/hci/Android.bp
+++ b/system/gd/hci/Android.bp
@@ -33,28 +33,25 @@
 filegroup {
     name: "BluetoothHciUnitTestSources",
     srcs: [
-        "acl_manager/le_impl_test.cc",
         "acl_builder_test.cc",
+        "acl_manager_test.cc",
         "acl_manager_unittest.cc",
+        "acl_manager/classic_acl_connection_test.cc",
+        "acl_manager/le_impl_test.cc",
+        "acl_manager/round_robin_scheduler_test.cc",
         "address_unittest.cc",
         "address_with_type_test.cc",
         "class_of_device_unittest.cc",
+        "controller_test.cc",
+        "hci_layer_fake.cc",
+        "hci_layer_test.cc",
+        "hci_layer_unittest.cc",
         "hci_packets_test.cc",
         "uuid_unittest.cc",
-        "le_periodic_sync_manager_test.cc"
-    ],
-}
-
-filegroup {
-    name: "BluetoothHciTestSources",
-    srcs: [
-        "acl_manager/round_robin_scheduler_test.cc",
-        "acl_manager_test.cc",
-        "controller_test.cc",
-        "hci_layer_test.cc",
-        "le_address_manager_test.cc",
-        "le_advertising_manager_test.cc",
+        "le_periodic_sync_manager_test.cc",
         "le_scanning_manager_test.cc",
+        "le_advertising_manager_test.cc",
+        "le_address_manager_test.cc",
     ],
 }
 
diff --git a/system/gd/hci/acl_manager.cc b/system/gd/hci/acl_manager.cc
index 4000681..7cce6a0 100644
--- a/system/gd/hci/acl_manager.cc
+++ b/system/gd/hci/acl_manager.cc
@@ -18,6 +18,7 @@
 
 #include <atomic>
 #include <future>
+#include <mutex>
 #include <set>
 
 #include "common/bidi_queue.h"
@@ -64,14 +65,23 @@
     hci_queue_end_->RegisterDequeue(
         handler_, common::Bind(&impl::dequeue_and_route_acl_packet_to_connection, common::Unretained(this)));
     bool crash_on_unknown_handle = false;
-    classic_impl_ =
-        new classic_impl(hci_layer_, controller_, handler_, round_robin_scheduler_, crash_on_unknown_handle);
-    le_impl_ = new le_impl(hci_layer_, controller_, handler_, round_robin_scheduler_, crash_on_unknown_handle);
+    {
+      const std::lock_guard<std::mutex> lock(dumpsys_mutex_);
+      classic_impl_ =
+          new classic_impl(hci_layer_, controller_, handler_, round_robin_scheduler_, crash_on_unknown_handle);
+      le_impl_ = new le_impl(hci_layer_, controller_, handler_, round_robin_scheduler_, crash_on_unknown_handle);
+    }
   }
 
   void Stop() {
-    delete le_impl_;
-    delete classic_impl_;
+    {
+      const std::lock_guard<std::mutex> lock(dumpsys_mutex_);
+      delete le_impl_;
+      delete classic_impl_;
+      le_impl_ = nullptr;
+      classic_impl_ = nullptr;
+    }
+
     hci_queue_end_->UnregisterDequeue();
     delete round_robin_scheduler_;
     if (enqueue_registered_.exchange(false)) {
@@ -115,6 +125,7 @@
   common::BidiQueueEnd<AclBuilder, AclView>* hci_queue_end_ = nullptr;
   std::atomic_bool enqueue_registered_ = false;
   uint16_t default_link_policy_settings_ = 0xffff;
+  mutable std::mutex dumpsys_mutex_;
 };
 
 AclManager::AclManager() : pimpl_(std::make_unique<impl>(*this)) {}
@@ -324,9 +335,31 @@
 
 void AclManager::impl::Dump(
     std::promise<flatbuffers::Offset<AclManagerData>> promise, flatbuffers::FlatBufferBuilder* fb_builder) const {
+  const std::lock_guard<std::mutex> lock(dumpsys_mutex_);
+  const auto connect_list = (le_impl_ != nullptr) ? le_impl_->connect_list : std::unordered_set<AddressWithType>();
+  const auto le_connectability_state_text =
+      (le_impl_ != nullptr) ? connectability_state_machine_text(le_impl_->connectability_state_) : "INDETERMINATE";
+  const auto le_create_connection_timeout_alarms_count =
+      (le_impl_ != nullptr) ? (int)le_impl_->create_connection_timeout_alarms_.size() : 0;
+
   auto title = fb_builder->CreateString("----- Acl Manager Dumpsys -----");
+  auto le_connectability_state = fb_builder->CreateString(le_connectability_state_text);
+
+  flatbuffers::Offset<flatbuffers::String> strings[connect_list.size()];
+
+  size_t cnt = 0;
+  for (const auto& it : connect_list) {
+    strings[cnt++] = fb_builder->CreateString(it.ToString());
+  }
+  auto vecofstrings = fb_builder->CreateVector(strings, connect_list.size());
+
   AclManagerDataBuilder builder(*fb_builder);
   builder.add_title(title);
+  builder.add_le_filter_accept_list_count(connect_list.size());
+  builder.add_le_filter_accept_list(vecofstrings);
+  builder.add_le_connectability_state(le_connectability_state);
+  builder.add_le_create_connection_timeout_alarms_count(le_create_connection_timeout_alarms_count);
+
   flatbuffers::Offset<AclManagerData> dumpsys_data = builder.Finish();
   promise.set_value(dumpsys_data);
 }
diff --git a/system/gd/hci/acl_manager/classic_acl_connection_test.cc b/system/gd/hci/acl_manager/classic_acl_connection_test.cc
new file mode 100644
index 0000000..9ba38c9
--- /dev/null
+++ b/system/gd/hci/acl_manager/classic_acl_connection_test.cc
@@ -0,0 +1,340 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "hci/acl_manager/classic_acl_connection.h"
+
+#include <gmock/gmock.h>
+#include <gtest/gtest.h>
+
+#include <chrono>
+#include <cstdint>
+#include <future>
+#include <list>
+#include <memory>
+#include <mutex>
+#include <queue>
+#include <vector>
+
+#include "hci/acl_connection_interface.h"
+#include "hci/acl_manager/connection_management_callbacks.h"
+#include "hci/address.h"
+#include "hci/hci_packets.h"
+#include "os/handler.h"
+#include "os/log.h"
+#include "os/thread.h"
+
+using namespace bluetooth;
+using namespace std::chrono_literals;
+
+namespace {
+constexpr char kAddress[] = "00:11:22:33:44:55";
+constexpr uint16_t kConnectionHandle = 123;
+constexpr size_t kQueueSize = 10;
+
+std::vector<hci::DisconnectReason> disconnect_reason_vector = {
+    hci::DisconnectReason::AUTHENTICATION_FAILURE,
+    hci::DisconnectReason::REMOTE_USER_TERMINATED_CONNECTION,
+    hci::DisconnectReason::REMOTE_DEVICE_TERMINATED_CONNECTION_LOW_RESOURCES,
+    hci::DisconnectReason::REMOTE_DEVICE_TERMINATED_CONNECTION_POWER_OFF,
+    hci::DisconnectReason::UNSUPPORTED_REMOTE_FEATURE,
+    hci::DisconnectReason::PAIRING_WITH_UNIT_KEY_NOT_SUPPORTED,
+    hci::DisconnectReason::UNACCEPTABLE_CONNECTION_PARAMETERS,
+};
+
+std::vector<hci::ErrorCode> error_code_vector = {
+    hci::ErrorCode::SUCCESS,
+    hci::ErrorCode::UNKNOWN_HCI_COMMAND,
+    hci::ErrorCode::UNKNOWN_CONNECTION,
+    hci::ErrorCode::HARDWARE_FAILURE,
+    hci::ErrorCode::PAGE_TIMEOUT,
+    hci::ErrorCode::AUTHENTICATION_FAILURE,
+    hci::ErrorCode::PIN_OR_KEY_MISSING,
+    hci::ErrorCode::MEMORY_CAPACITY_EXCEEDED,
+    hci::ErrorCode::CONNECTION_TIMEOUT,
+    hci::ErrorCode::CONNECTION_LIMIT_EXCEEDED,
+    hci::ErrorCode::SYNCHRONOUS_CONNECTION_LIMIT_EXCEEDED,
+    hci::ErrorCode::CONNECTION_ALREADY_EXISTS,
+    hci::ErrorCode::COMMAND_DISALLOWED,
+    hci::ErrorCode::CONNECTION_REJECTED_LIMITED_RESOURCES,
+    hci::ErrorCode::CONNECTION_REJECTED_SECURITY_REASONS,
+    hci::ErrorCode::CONNECTION_REJECTED_UNACCEPTABLE_BD_ADDR,
+    hci::ErrorCode::CONNECTION_ACCEPT_TIMEOUT,
+    hci::ErrorCode::UNSUPPORTED_FEATURE_OR_PARAMETER_VALUE,
+    hci::ErrorCode::INVALID_HCI_COMMAND_PARAMETERS,
+    hci::ErrorCode::REMOTE_USER_TERMINATED_CONNECTION,
+    hci::ErrorCode::REMOTE_DEVICE_TERMINATED_CONNECTION_LOW_RESOURCES,
+    hci::ErrorCode::REMOTE_DEVICE_TERMINATED_CONNECTION_POWER_OFF,
+    hci::ErrorCode::CONNECTION_TERMINATED_BY_LOCAL_HOST,
+    hci::ErrorCode::REPEATED_ATTEMPTS,
+    hci::ErrorCode::PAIRING_NOT_ALLOWED,
+    hci::ErrorCode::UNKNOWN_LMP_PDU,
+    hci::ErrorCode::UNSUPPORTED_REMOTE_OR_LMP_FEATURE,
+    hci::ErrorCode::SCO_OFFSET_REJECTED,
+    hci::ErrorCode::SCO_INTERVAL_REJECTED,
+    hci::ErrorCode::SCO_AIR_MODE_REJECTED,
+    hci::ErrorCode::INVALID_LMP_OR_LL_PARAMETERS,
+    hci::ErrorCode::UNSPECIFIED_ERROR,
+    hci::ErrorCode::UNSUPPORTED_LMP_OR_LL_PARAMETER,
+    hci::ErrorCode::ROLE_CHANGE_NOT_ALLOWED,
+    hci::ErrorCode::TRANSACTION_RESPONSE_TIMEOUT,
+    hci::ErrorCode::LINK_LAYER_COLLISION,
+    hci::ErrorCode::ENCRYPTION_MODE_NOT_ACCEPTABLE,
+    hci::ErrorCode::ROLE_SWITCH_FAILED,
+    hci::ErrorCode::CONTROLLER_BUSY,
+    hci::ErrorCode::ADVERTISING_TIMEOUT,
+    hci::ErrorCode::CONNECTION_FAILED_ESTABLISHMENT,
+    hci::ErrorCode::LIMIT_REACHED,
+    hci::ErrorCode::STATUS_UNKNOWN,
+};
+
+// Generic template for all commands
+template <typename T, typename U>
+T CreateCommand(U u) {
+  T command;
+  return command;
+}
+
+template <>
+hci::DisconnectView CreateCommand(std::shared_ptr<std::vector<uint8_t>> bytes) {
+  return hci::DisconnectView::Create(
+      hci::AclCommandView::Create(hci::CommandView::Create(hci::PacketView<hci::kLittleEndian>(bytes))));
+}
+
+}  // namespace
+
+class TestAclConnectionInterface : public hci::AclConnectionInterface {
+ private:
+  void EnqueueCommand(
+      std::unique_ptr<hci::AclCommandBuilder> command,
+      common::ContextualOnceCallback<void(hci::CommandStatusView)> on_status) override {
+    const std::lock_guard<std::mutex> lock(command_queue_mutex_);
+    command_queue_.push(std::move(command));
+    command_status_callbacks.push_back(std::move(on_status));
+    if (command_promise_ != nullptr) {
+      std::promise<void>* prom = command_promise_.release();
+      prom->set_value();
+      delete prom;
+    }
+  }
+
+  void EnqueueCommand(
+      std::unique_ptr<hci::AclCommandBuilder> command,
+      common::ContextualOnceCallback<void(hci::CommandCompleteView)> on_complete) override {
+    const std::lock_guard<std::mutex> lock(command_queue_mutex_);
+    command_queue_.push(std::move(command));
+    command_complete_callbacks.push_back(std::move(on_complete));
+    if (command_promise_ != nullptr) {
+      std::promise<void>* prom = command_promise_.release();
+      prom->set_value();
+      delete prom;
+    }
+  }
+
+ public:
+  virtual ~TestAclConnectionInterface() = default;
+
+  std::unique_ptr<hci::CommandBuilder> DequeueCommand() {
+    const std::lock_guard<std::mutex> lock(command_queue_mutex_);
+    auto packet = std::move(command_queue_.front());
+    command_queue_.pop();
+    return std::move(packet);
+  }
+
+  std::shared_ptr<std::vector<uint8_t>> DequeueCommandBytes() {
+    auto command = DequeueCommand();
+    auto bytes = std::make_shared<std::vector<uint8_t>>();
+    packet::BitInserter bi(*bytes);
+    command->Serialize(bi);
+    return bytes;
+  }
+
+  bool IsPacketQueueEmpty() const {
+    const std::lock_guard<std::mutex> lock(command_queue_mutex_);
+    return command_queue_.empty();
+  }
+
+  size_t NumberOfQueuedCommands() const {
+    const std::lock_guard<std::mutex> lock(command_queue_mutex_);
+    return command_queue_.size();
+  }
+
+ private:
+  std::list<common::ContextualOnceCallback<void(hci::CommandCompleteView)>> command_complete_callbacks;
+  std::list<common::ContextualOnceCallback<void(hci::CommandStatusView)>> command_status_callbacks;
+  std::queue<std::unique_ptr<hci::CommandBuilder>> command_queue_;
+  mutable std::mutex command_queue_mutex_;
+  std::unique_ptr<std::promise<void>> command_promise_;
+  std::unique_ptr<std::future<void>> command_future_;
+};
+
+class TestConnectionManagementCallbacks : public hci::acl_manager::ConnectionManagementCallbacks {
+ public:
+  ~TestConnectionManagementCallbacks() = default;
+  void OnConnectionPacketTypeChanged(uint16_t packet_type) override {}
+  void OnAuthenticationComplete(hci::ErrorCode hci_status) override {}
+  void OnEncryptionChange(hci::EncryptionEnabled enabled) override {}
+  void OnChangeConnectionLinkKeyComplete() override {}
+  void OnReadClockOffsetComplete(uint16_t clock_offset) override {}
+  void OnModeChange(hci::ErrorCode status, hci::Mode current_mode, uint16_t interval) override {}
+  void OnSniffSubrating(
+      hci::ErrorCode hci_status,
+      uint16_t maximum_transmit_latency,
+      uint16_t maximum_receive_latency,
+      uint16_t minimum_remote_timeout,
+      uint16_t minimum_local_timeout) override {}
+  void OnQosSetupComplete(
+      hci::ServiceType service_type,
+      uint32_t token_rate,
+      uint32_t peak_bandwidth,
+      uint32_t latency,
+      uint32_t delay_variation) override {}
+  void OnFlowSpecificationComplete(
+      hci::FlowDirection flow_direction,
+      hci::ServiceType service_type,
+      uint32_t token_rate,
+      uint32_t token_bucket_size,
+      uint32_t peak_bandwidth,
+      uint32_t access_latency) override {}
+  void OnFlushOccurred() override {}
+  void OnRoleDiscoveryComplete(hci::Role current_role) override {}
+  void OnReadLinkPolicySettingsComplete(uint16_t link_policy_settings) override {}
+  void OnReadAutomaticFlushTimeoutComplete(uint16_t flush_timeout) override {}
+  void OnReadTransmitPowerLevelComplete(uint8_t transmit_power_level) override {}
+  void OnReadLinkSupervisionTimeoutComplete(uint16_t link_supervision_timeout) override {}
+  void OnReadFailedContactCounterComplete(uint16_t failed_contact_counter) override {}
+  void OnReadLinkQualityComplete(uint8_t link_quality) override {}
+  void OnReadAfhChannelMapComplete(hci::AfhMode afh_mode, std::array<uint8_t, 10> afh_channel_map) override {}
+  void OnReadRssiComplete(uint8_t rssi) override {}
+  void OnReadClockComplete(uint32_t clock, uint16_t accuracy) override {}
+  void OnCentralLinkKeyComplete(hci::KeyFlag key_flag) override {}
+  void OnRoleChange(hci::ErrorCode hci_status, hci::Role new_role) override {}
+  void OnDisconnection(hci::ErrorCode reason) override {
+    on_disconnection_error_code_queue_.push(reason);
+  }
+  void OnReadRemoteVersionInformationComplete(
+      hci::ErrorCode hci_status, uint8_t lmp_version, uint16_t manufacturer_name, uint16_t sub_version) override {}
+  void OnReadRemoteSupportedFeaturesComplete(uint64_t features) override {}
+  void OnReadRemoteExtendedFeaturesComplete(uint8_t page_number, uint8_t max_page_number, uint64_t features) override {}
+
+  std::queue<hci::ErrorCode> on_disconnection_error_code_queue_;
+};
+
+namespace bluetooth {
+namespace hci {
+namespace acl_manager {
+
+class ClassicAclConnectionTest : public ::testing::Test {
+ protected:
+  void SetUp() override {
+    ASSERT_TRUE(hci::Address::FromString(kAddress, address_));
+    thread_ = new os::Thread("thread", os::Thread::Priority::NORMAL);
+    handler_ = new os::Handler(thread_);
+    queue_ = std::make_shared<hci::acl_manager::AclConnection::Queue>(kQueueSize);
+    sync_handler();
+  }
+
+  void TearDown() override {
+    handler_->Clear();
+    delete handler_;
+    delete thread_;
+  }
+
+  void sync_handler() {
+    ASSERT(handler_ != nullptr);
+
+    auto promise = std::promise<void>();
+    auto future = promise.get_future();
+    handler_->BindOnceOn(&promise, &std::promise<void>::set_value).Invoke();
+    auto status = future.wait_for(2s);
+    ASSERT_EQ(status, std::future_status::ready);
+  }
+
+  Address address_;
+  os::Handler* handler_{nullptr};
+  os::Thread* thread_{nullptr};
+  std::shared_ptr<hci::acl_manager::AclConnection::Queue> queue_;
+
+  TestAclConnectionInterface acl_connection_interface_;
+  TestConnectionManagementCallbacks callbacks_;
+};
+
+TEST_F(ClassicAclConnectionTest, simple) {
+  AclConnectionInterface* acl_connection_interface = nullptr;
+  ClassicAclConnection* connection =
+      new ClassicAclConnection(queue_, acl_connection_interface, kConnectionHandle, address_);
+  connection->RegisterCallbacks(&callbacks_, handler_);
+
+  delete connection;
+}
+
+class ClassicAclConnectionWithCallbacksTest : public ClassicAclConnectionTest {
+ protected:
+  void SetUp() override {
+    ClassicAclConnectionTest::SetUp();
+    connection_ =
+        std::make_unique<ClassicAclConnection>(queue_, &acl_connection_interface_, kConnectionHandle, address_);
+    connection_->RegisterCallbacks(&callbacks_, handler_);
+    is_callbacks_registered_ = true;
+    connection_management_callbacks_ =
+        connection_->GetEventCallbacks([this](uint16_t hci_handle) { is_callbacks_invalidated_ = true; });
+    is_callbacks_invalidated_ = false;
+  }
+
+  void TearDown() override {
+    connection_.reset();
+    ASSERT_TRUE(is_callbacks_invalidated_);
+    ClassicAclConnectionTest::TearDown();
+  }
+
+ protected:
+  std::unique_ptr<ClassicAclConnection> connection_;
+  ConnectionManagementCallbacks* connection_management_callbacks_;
+  bool is_callbacks_registered_{false};
+  bool is_callbacks_invalidated_{false};
+};
+
+TEST_F(ClassicAclConnectionWithCallbacksTest, Disconnect) {
+  for (const auto& reason : disconnect_reason_vector) {
+    ASSERT_TRUE(connection_->Disconnect(reason));
+  }
+
+  for (const auto& reason : disconnect_reason_vector) {
+    ASSERT_FALSE(acl_connection_interface_.IsPacketQueueEmpty());
+    auto command = CreateCommand<DisconnectView>(acl_connection_interface_.DequeueCommandBytes());
+    ASSERT_TRUE(command.IsValid());
+    ASSERT_EQ(reason, command.GetReason());
+    ASSERT_EQ(kConnectionHandle, command.GetConnectionHandle());
+  }
+  ASSERT_TRUE(acl_connection_interface_.IsPacketQueueEmpty());
+}
+
+TEST_F(ClassicAclConnectionWithCallbacksTest, OnDisconnection) {
+  for (const auto& error_code : error_code_vector) {
+    connection_management_callbacks_->OnDisconnection(error_code);
+  }
+
+  sync_handler();
+  ASSERT_TRUE(!callbacks_.on_disconnection_error_code_queue_.empty());
+
+  for (const auto& error_code : error_code_vector) {
+    ASSERT_EQ(error_code, callbacks_.on_disconnection_error_code_queue_.front());
+    callbacks_.on_disconnection_error_code_queue_.pop();
+  }
+}
+
+}  // namespace acl_manager
+}  // namespace hci
+}  // namespace bluetooth
diff --git a/system/gd/hci/acl_manager/classic_impl.h b/system/gd/hci/acl_manager/classic_impl.h
index 13b0615..87b18b4 100644
--- a/system/gd/hci/acl_manager/classic_impl.h
+++ b/system/gd/hci/acl_manager/classic_impl.h
@@ -25,6 +25,7 @@
 #include "hci/acl_manager/event_checkers.h"
 #include "hci/acl_manager/round_robin_scheduler.h"
 #include "hci/controller.h"
+#include "os/metrics.h"
 #include "security/security_manager_listener.h"
 #include "security/security_module.h"
 
@@ -209,6 +210,14 @@
       }
       return kIllegalConnectionHandle;
     }
+    Address get_address(uint16_t handle) const {
+      std::unique_lock<std::mutex> lock(acl_connections_guard_);
+      auto connection = acl_connections_.find(handle);
+      if (connection == acl_connections_.end()) {
+        return Address::kEmpty;
+      }
+      return connection->second.address_with_type_.GetAddress();
+    }
     bool is_classic_link_already_connected(const Address& address) const {
       std::unique_lock<std::mutex> lock(acl_connections_guard_);
       for (const auto& connection : acl_connections_) {
@@ -282,32 +291,100 @@
     std::unique_ptr<CreateConnectionBuilder> packet = CreateConnectionBuilder::Create(
         address, packet_type, page_scan_repetition_mode, clock_offset, clock_offset_valid, allow_role_switch);
 
-    if (incoming_connecting_address_set_.empty() && outgoing_connecting_address_ == Address::kEmpty) {
-      if (is_classic_link_already_connected(address)) {
-        LOG_WARN("already connected: %s", address.ToString().c_str());
-        return;
+    pending_outgoing_connections_.emplace(address, std::move(packet));
+    dequeue_next_connection();
+  }
+
+  void dequeue_next_connection() {
+    if (incoming_connecting_address_set_.empty() && outgoing_connecting_address_.IsEmpty()) {
+      while (!pending_outgoing_connections_.empty()) {
+        LOG_INFO("Pending connections is not empty; so sending next connection");
+        auto create_connection_packet_and_address = std::move(pending_outgoing_connections_.front());
+        pending_outgoing_connections_.pop();
+        if (!is_classic_link_already_connected(create_connection_packet_and_address.first)) {
+          outgoing_connecting_address_ = create_connection_packet_and_address.first;
+          acl_connection_interface_->EnqueueCommand(
+              std::move(create_connection_packet_and_address.second),
+              handler_->BindOnceOn(this, &classic_impl::on_create_connection_status));
+          break;
+        }
       }
-      outgoing_connecting_address_ = address;
-      acl_connection_interface_->EnqueueCommand(std::move(packet), handler_->BindOnce([](CommandStatusView status) {
-        ASSERT(status.IsValid());
-        ASSERT(status.GetCommandOpCode() == OpCode::CREATE_CONNECTION);
-      }));
-    } else {
-      pending_outgoing_connections_.emplace(address, std::move(packet));
     }
   }
 
+  void on_create_connection_status(CommandStatusView status) {
+    ASSERT(status.IsValid());
+    ASSERT(status.GetCommandOpCode() == OpCode::CREATE_CONNECTION);
+    if (status.GetStatus() != hci::ErrorCode::SUCCESS /* = pending */) {
+      // something went wrong, but unblock queue and report to caller
+      LOG_ERROR(
+          "Failed to create connection to %s, reporting failure and continuing",
+          outgoing_connecting_address_.ToString().c_str());
+      ASSERT(client_callbacks_ != nullptr);
+      client_handler_->Post(common::BindOnce(
+          &ConnectionCallbacks::OnConnectFail,
+          common::Unretained(client_callbacks_),
+          outgoing_connecting_address_,
+          status.GetStatus()));
+      outgoing_connecting_address_ = Address::kEmpty;
+      dequeue_next_connection();
+    } else {
+      // everything is good, resume when a connection_complete event arrives
+      return;
+    }
+  }
+
+  enum class Initiator {
+    LOCALLY_INITIATED,
+    REMOTE_INITIATED,
+  };
+
+  void create_and_announce_connection(
+      ConnectionCompleteView connection_complete, Role current_role, Initiator initiator) {
+    auto status = connection_complete.GetStatus();
+    auto address = connection_complete.GetBdAddr();
+    if (client_callbacks_ == nullptr) {
+      LOG_WARN("No client callbacks registered for connection");
+      return;
+    }
+    if (status != ErrorCode::SUCCESS) {
+      client_handler_->Post(common::BindOnce(
+          &ConnectionCallbacks::OnConnectFail, common::Unretained(client_callbacks_), address, status));
+      return;
+    }
+    uint16_t handle = connection_complete.GetConnectionHandle();
+    auto queue = std::make_shared<AclConnection::Queue>(10);
+    auto queue_down_end = queue->GetDownEnd();
+    round_robin_scheduler_->Register(RoundRobinScheduler::ConnectionType::CLASSIC, handle, queue);
+    std::unique_ptr<ClassicAclConnection> connection(
+        new ClassicAclConnection(std::move(queue), acl_connection_interface_, handle, address));
+    connection->locally_initiated_ = initiator == Initiator::LOCALLY_INITIATED;
+    connections.add(
+        handle,
+        AddressWithType{address, AddressType::PUBLIC_DEVICE_ADDRESS},
+        queue_down_end,
+        handler_,
+        connection->GetEventCallbacks([this](uint16_t handle) { this->connections.invalidate(handle); }));
+    connections.execute(address, [=](ConnectionManagementCallbacks* callbacks) {
+      if (delayed_role_change_ == nullptr) {
+        callbacks->OnRoleChange(hci::ErrorCode::SUCCESS, current_role);
+      } else if (delayed_role_change_->GetBdAddr() == address) {
+        LOG_INFO("Sending delayed role change for %s", delayed_role_change_->GetBdAddr().ToString().c_str());
+        callbacks->OnRoleChange(delayed_role_change_->GetStatus(), delayed_role_change_->GetNewRole());
+        delayed_role_change_.reset();
+      }
+    });
+    client_handler_->Post(common::BindOnce(
+        &ConnectionCallbacks::OnConnectSuccess, common::Unretained(client_callbacks_), std::move(connection)));
+  }
+
   void on_connection_complete(EventView packet) {
     ConnectionCompleteView connection_complete = ConnectionCompleteView::Create(packet);
     ASSERT(connection_complete.IsValid());
     auto status = connection_complete.GetStatus();
     auto address = connection_complete.GetBdAddr();
-    if (client_callbacks_ == nullptr) {
-      LOG_WARN("No client callbacks registered for connection");
-      return;
-    }
     Role current_role = Role::CENTRAL;
-    bool locally_initiated = true;
+    auto initiator = Initiator::LOCALLY_INITIATED;
     if (outgoing_connecting_address_ == address) {
       outgoing_connecting_address_ = Address::kEmpty;
     } else {
@@ -324,53 +401,10 @@
       }
       incoming_connecting_address_set_.erase(incoming_address);
       current_role = Role::PERIPHERAL;
-      locally_initiated = false;
+      initiator = Initiator::REMOTE_INITIATED;
     }
-    if (status != ErrorCode::SUCCESS) {
-      client_handler_->Post(common::BindOnce(&ConnectionCallbacks::OnConnectFail, common::Unretained(client_callbacks_),
-                                             address, status));
-    } else {
-      uint16_t handle = connection_complete.GetConnectionHandle();
-      auto queue = std::make_shared<AclConnection::Queue>(10);
-      auto queue_down_end = queue->GetDownEnd();
-      round_robin_scheduler_->Register(RoundRobinScheduler::ConnectionType::CLASSIC, handle, queue);
-      std::unique_ptr<ClassicAclConnection> connection(
-          new ClassicAclConnection(std::move(queue), acl_connection_interface_, handle, address));
-      connection->locally_initiated_ = locally_initiated;
-      connections.add(
-          handle,
-          AddressWithType{address, AddressType::PUBLIC_DEVICE_ADDRESS},
-          queue_down_end,
-          handler_,
-          connection->GetEventCallbacks([this](uint16_t handle) { this->connections.invalidate(handle); }));
-      connections.execute(address, [=](ConnectionManagementCallbacks* callbacks) {
-        if (delayed_role_change_ == nullptr) {
-          callbacks->OnRoleChange(hci::ErrorCode::SUCCESS, current_role);
-        } else if (delayed_role_change_->GetBdAddr() == address) {
-          LOG_INFO("Sending delayed role change for %s", delayed_role_change_->GetBdAddr().ToString().c_str());
-          callbacks->OnRoleChange(delayed_role_change_->GetStatus(), delayed_role_change_->GetNewRole());
-          delayed_role_change_.reset();
-        }
-      });
-      client_handler_->Post(common::BindOnce(
-          &ConnectionCallbacks::OnConnectSuccess, common::Unretained(client_callbacks_), std::move(connection)));
-    }
-    if (outgoing_connecting_address_.IsEmpty()) {
-      while (!pending_outgoing_connections_.empty()) {
-        LOG_INFO("Pending connections is not empty; so sending next connection");
-        auto create_connection_packet_and_address = std::move(pending_outgoing_connections_.front());
-        pending_outgoing_connections_.pop();
-        if (!is_classic_link_already_connected(create_connection_packet_and_address.first)) {
-          outgoing_connecting_address_ = create_connection_packet_and_address.first;
-          acl_connection_interface_->EnqueueCommand(
-              std::move(create_connection_packet_and_address.second), handler_->BindOnce([](CommandStatusView status) {
-                ASSERT(status.IsValid());
-                ASSERT(status.GetCommandOpCode() == OpCode::CREATE_CONNECTION);
-              }));
-          break;
-        }
-      }
-    }
+    create_and_announce_connection(connection_complete, current_role, initiator);
+    dequeue_next_connection();
   }
 
   void cancel_connect(Address address) {
@@ -386,6 +420,8 @@
   static constexpr bool kRemoveConnectionAfterwards = true;
   void on_classic_disconnect(uint16_t handle, ErrorCode reason) {
     bool event_also_routes_to_other_receivers = connections.crash_on_unknown_handle_;
+    bluetooth::os::LogMetricBluetoothDisconnectionReasonReported(
+        static_cast<uint32_t>(reason), connections.get_address(handle), handle);
     connections.crash_on_unknown_handle_ = false;
     connections.execute(
         handle,
@@ -579,6 +615,8 @@
     auto view = ReadRemoteSupportedFeaturesCompleteView::Create(packet);
     ASSERT_LOG(view.IsValid(), "Read remote supported features packet invalid");
     uint16_t handle = view.GetConnectionHandle();
+    bluetooth::os::LogMetricBluetoothRemoteSupportedFeatures(
+        connections.get_address(handle), 0, view.GetLmpFeatures(), handle);
     connections.execute(handle, [=](ConnectionManagementCallbacks* callbacks) {
       callbacks->OnReadRemoteSupportedFeaturesComplete(view.GetLmpFeatures());
     });
@@ -588,6 +626,8 @@
     auto view = ReadRemoteExtendedFeaturesCompleteView::Create(packet);
     ASSERT_LOG(view.IsValid(), "Read remote extended features packet invalid");
     uint16_t handle = view.GetConnectionHandle();
+    bluetooth::os::LogMetricBluetoothRemoteSupportedFeatures(
+        connections.get_address(handle), view.GetPageNumber(), view.GetExtendedLmpFeatures(), handle);
     connections.execute(handle, [=](ConnectionManagementCallbacks* callbacks) {
       callbacks->OnReadRemoteExtendedFeaturesComplete(
           view.GetPageNumber(), view.GetMaximumPageNumber(), view.GetExtendedLmpFeatures());
diff --git a/system/gd/hci/acl_manager/le_impl.h b/system/gd/hci/acl_manager/le_impl.h
index 6e7c272..baa38c2 100644
--- a/system/gd/hci/acl_manager/le_impl.h
+++ b/system/gd/hci/acl_manager/le_impl.h
@@ -37,6 +37,8 @@
 #include "hci/le_address_manager.h"
 #include "os/alarm.h"
 #include "os/handler.h"
+#include "os/metrics.h"
+#include "os/system_properties.h"
 #include "packet/packet_view.h"
 
 using bluetooth::crypto_toolbox::Octet16;
@@ -289,42 +291,79 @@
     auto status = connection_complete.GetStatus();
     auto address = connection_complete.GetPeerAddress();
     auto peer_address_type = connection_complete.GetPeerAddressType();
-    connectability_state_ = ConnectabilityState::DISARMED;
-    if (status == ErrorCode::UNKNOWN_CONNECTION && pause_connection) {
-      on_le_connection_canceled_on_pause();
-      return;
-    }
+    auto role = connection_complete.GetRole();
     AddressWithType remote_address(address, peer_address_type);
     AddressWithType local_address = le_address_manager_->GetCurrentAddress();
-    on_common_le_connection_complete(remote_address);
-    if (status == ErrorCode::UNKNOWN_CONNECTION) {
-      if (remote_address.GetAddress() != Address::kEmpty) {
-        LOG_INFO("Controller send non-empty address field:%s", remote_address.GetAddress().ToString().c_str());
-      }
-      // direct connect canceled due to connection timeout, start background connect
-      create_le_connection(remote_address, false, false);
-      return;
-    }
-
-    arm_on_resume_ = false;
-    ready_to_unregister = true;
     const bool in_filter_accept_list = is_device_in_connect_list(remote_address);
-    remove_device_from_connect_list(remote_address);
+    auto argument_list = std::vector<std::pair<bluetooth::os::ArgumentType, int>>();
+    argument_list.push_back(
+        std::make_pair(os::ArgumentType::ACL_STATUS_CODE, static_cast<int>(status)));
 
-    if (!connect_list.empty()) {
-      AddressWithType empty(Address::kEmpty, AddressType::RANDOM_DEVICE_ADDRESS);
-      handler_->Post(common::BindOnce(&le_impl::create_le_connection, common::Unretained(this), empty, false, false));
-    }
+    bluetooth::os::LogMetricBluetoothLEConnectionMetricEvent(
+        address,
+        android::bluetooth::le::LeConnectionOriginType::ORIGIN_NATIVE,
+        android::bluetooth::le::LeConnectionType::CONNECTION_TYPE_LE_ACL,
+        android::bluetooth::le::LeConnectionState::STATE_LE_ACL_END,
+        argument_list);
 
-    if (le_client_handler_ == nullptr) {
-      LOG_ERROR("No callbacks to call");
-      return;
-    }
+    if (role == hci::Role::CENTRAL) {
+      connectability_state_ = ConnectabilityState::DISARMED;
+      if (status == ErrorCode::UNKNOWN_CONNECTION && pause_connection) {
+        on_le_connection_canceled_on_pause();
+        return;
+      }
+      on_common_le_connection_complete(remote_address);
+      if (status == ErrorCode::UNKNOWN_CONNECTION) {
+        if (remote_address.GetAddress() != Address::kEmpty) {
+          LOG_INFO("Controller send non-empty address field:%s", remote_address.GetAddress().ToString().c_str());
+        }
+        // direct connect canceled due to connection timeout, start background connect
+        create_le_connection(remote_address, false, false);
+        return;
+      }
 
-    if (status != ErrorCode::SUCCESS) {
-      le_client_handler_->Post(common::BindOnce(&LeConnectionCallbacks::OnLeConnectFail,
-                                                common::Unretained(le_client_callbacks_), remote_address, status));
-      return;
+      arm_on_resume_ = false;
+      ready_to_unregister = true;
+      remove_device_from_connect_list(remote_address);
+
+      if (!connect_list.empty()) {
+        AddressWithType empty(Address::kEmpty, AddressType::RANDOM_DEVICE_ADDRESS);
+        handler_->Post(common::BindOnce(&le_impl::create_le_connection, common::Unretained(this), empty, false, false));
+      }
+
+      if (le_client_handler_ == nullptr) {
+        LOG_ERROR("No callbacks to call");
+        return;
+      }
+
+      if (status != ErrorCode::SUCCESS) {
+        le_client_handler_->Post(common::BindOnce(
+            &LeConnectionCallbacks::OnLeConnectFail, common::Unretained(le_client_callbacks_), remote_address, status));
+        return;
+      }
+    } else {
+      LOG_INFO("Received connection complete with Peripheral role");
+      if (le_client_handler_ == nullptr) {
+        LOG_ERROR("No callbacks to call");
+        return;
+      }
+
+      if (status != ErrorCode::SUCCESS) {
+        std::string error_code = ErrorCodeText(status);
+        LOG_WARN("Received on_le_connection_complete with error code %s", error_code.c_str());
+        return;
+      }
+
+      if (in_filter_accept_list) {
+        LOG_INFO(
+            "Received incoming connection of device in filter accept_list, %s",
+            PRIVATE_ADDRESS_WITH_TYPE(remote_address));
+        remove_device_from_connect_list(remote_address);
+        if (create_connection_timeout_alarms_.find(remote_address) != create_connection_timeout_alarms_.end()) {
+          create_connection_timeout_alarms_.at(remote_address).Cancel();
+          create_connection_timeout_alarms_.erase(remote_address);
+        }
+      }
     }
 
     uint16_t conn_interval = connection_complete.GetConnInterval();
@@ -335,7 +374,6 @@
       return;
     }
 
-    auto role = connection_complete.GetRole();
     uint16_t handle = connection_complete.GetConnectionHandle();
     auto queue = std::make_shared<AclConnection::Queue>(10);
     auto queue_down_end = queue->GetDownEnd();
@@ -363,14 +401,9 @@
     auto address = connection_complete.GetPeerAddress();
     auto peer_address_type = connection_complete.GetPeerAddressType();
     auto peer_resolvable_address = connection_complete.GetPeerResolvablePrivateAddress();
-    connectability_state_ = ConnectabilityState::DISARMED;
-    if (status == ErrorCode::UNKNOWN_CONNECTION && pause_connection) {
-      on_le_connection_canceled_on_pause();
-      return;
-    }
+    auto role = connection_complete.GetRole();
 
     AddressType remote_address_type;
-
     switch (peer_address_type) {
       case AddressType::PUBLIC_DEVICE_ADDRESS:
       case AddressType::PUBLIC_IDENTITY_ADDRESS:
@@ -382,39 +415,81 @@
         break;
     }
     AddressWithType remote_address(address, remote_address_type);
-
-    on_common_le_connection_complete(remote_address);
-    if (status == ErrorCode::UNKNOWN_CONNECTION) {
-      if (remote_address.GetAddress() != Address::kEmpty) {
-        LOG_INFO("Controller send non-empty address field:%s", remote_address.GetAddress().ToString().c_str());
-      }
-      // direct connect canceled due to connection timeout, start background connect
-      create_le_connection(remote_address, false, false);
-      return;
-    }
-
-    arm_on_resume_ = false;
-    ready_to_unregister = true;
     const bool in_filter_accept_list = is_device_in_connect_list(remote_address);
-    remove_device_from_connect_list(remote_address);
+    auto argument_list = std::vector<std::pair<bluetooth::os::ArgumentType, int>>();
+    argument_list.push_back(
+        std::make_pair(os::ArgumentType::ACL_STATUS_CODE, static_cast<int>(status)));
 
-    if (!connect_list.empty()) {
-      AddressWithType empty(Address::kEmpty, AddressType::RANDOM_DEVICE_ADDRESS);
-      handler_->Post(common::BindOnce(&le_impl::create_le_connection, common::Unretained(this), empty, false, false));
+    bluetooth::os::LogMetricBluetoothLEConnectionMetricEvent(
+        address,
+        android::bluetooth::le::LeConnectionOriginType::ORIGIN_NATIVE,
+        android::bluetooth::le::LeConnectionType::CONNECTION_TYPE_LE_ACL,
+        android::bluetooth::le::LeConnectionState::STATE_LE_ACL_END,
+        argument_list);
+
+    if (role == hci::Role::CENTRAL) {
+      connectability_state_ = ConnectabilityState::DISARMED;
+
+      if (status == ErrorCode::UNKNOWN_CONNECTION && pause_connection) {
+        on_le_connection_canceled_on_pause();
+        return;
+      }
+
+      on_common_le_connection_complete(remote_address);
+      if (status == ErrorCode::UNKNOWN_CONNECTION) {
+        if (remote_address.GetAddress() != Address::kEmpty) {
+          LOG_INFO("Controller send non-empty address field:%s", remote_address.GetAddress().ToString().c_str());
+        }
+        // direct connect canceled due to connection timeout, start background connect
+        create_le_connection(remote_address, false, false);
+        return;
+      }
+
+      arm_on_resume_ = false;
+      ready_to_unregister = true;
+      remove_device_from_connect_list(remote_address);
+
+      if (!connect_list.empty()) {
+        AddressWithType empty(Address::kEmpty, AddressType::RANDOM_DEVICE_ADDRESS);
+        handler_->Post(common::BindOnce(&le_impl::create_le_connection, common::Unretained(this), empty, false, false));
+      }
+
+      if (le_client_handler_ == nullptr) {
+        LOG_ERROR("No callbacks to call");
+        return;
+      }
+
+      if (status != ErrorCode::SUCCESS) {
+        le_client_handler_->Post(common::BindOnce(
+            &LeConnectionCallbacks::OnLeConnectFail, common::Unretained(le_client_callbacks_), remote_address, status));
+        return;
+      }
+
+    } else {
+      LOG_INFO("Received connection complete with Peripheral role");
+      if (le_client_handler_ == nullptr) {
+        LOG_ERROR("No callbacks to call");
+        return;
+      }
+
+      if (status != ErrorCode::SUCCESS) {
+        std::string error_code = ErrorCodeText(status);
+        LOG_WARN("Received on_le_enhanced_connection_complete with error code %s", error_code.c_str());
+        return;
+      }
+
+      if (in_filter_accept_list) {
+        LOG_INFO(
+            "Received incoming connection of device in filter accept_list, %s",
+            PRIVATE_ADDRESS_WITH_TYPE(remote_address));
+        remove_device_from_connect_list(remote_address);
+        if (create_connection_timeout_alarms_.find(remote_address) != create_connection_timeout_alarms_.end()) {
+          create_connection_timeout_alarms_.at(remote_address).Cancel();
+          create_connection_timeout_alarms_.erase(remote_address);
+        }
+      }
     }
 
-    if (le_client_handler_ == nullptr) {
-      LOG_ERROR("No callbacks to call");
-      return;
-    }
-
-    if (status != ErrorCode::SUCCESS) {
-      le_client_handler_->Post(common::BindOnce(&LeConnectionCallbacks::OnLeConnectFail,
-                                                common::Unretained(le_client_callbacks_), remote_address, status));
-      return;
-    }
-
-    auto role = connection_complete.GetRole();
     AddressWithType local_address;
     if (role == hci::Role::CENTRAL) {
       local_address = le_address_manager_->GetCurrentAddress();
@@ -615,28 +690,43 @@
         address_with_type.ToPeerAddressType(), address_with_type.GetAddress());
   }
 
+  void update_connectability_state_after_armed(const ErrorCode& status) {
+    switch (connectability_state_) {
+      case ConnectabilityState::DISARMED:
+      case ConnectabilityState::ARMED:
+      case ConnectabilityState::DISARMING:
+        LOG_ERROR(
+            "Received connectability arm notification for unexpected state:%s status:%s",
+            connectability_state_machine_text(connectability_state_).c_str(),
+            ErrorCodeText(status).c_str());
+        break;
+      case ConnectabilityState::ARMING:
+        if (status != ErrorCode::SUCCESS) {
+          LOG_ERROR("Le connection state machine armed failed status:%s", ErrorCodeText(status).c_str());
+        }
+        connectability_state_ =
+            (status == ErrorCode::SUCCESS) ? ConnectabilityState::ARMED : ConnectabilityState::DISARMED;
+        LOG_INFO(
+            "Le connection state machine armed state:%s status:%s",
+            connectability_state_machine_text(connectability_state_).c_str(),
+            ErrorCodeText(status).c_str());
+        if (disarmed_while_arming_) {
+          disarmed_while_arming_ = false;
+          disarm_connectability();
+        }
+    }
+  }
+
   void on_extended_create_connection(CommandStatusView status) {
     ASSERT(status.IsValid());
     ASSERT(status.GetCommandOpCode() == OpCode::LE_EXTENDED_CREATE_CONNECTION);
-    if (connectability_state_ != ConnectabilityState::ARMING) {
-      LOG_ERROR(
-          "Received connectability arm notification for unexpected state:%s",
-          connectability_state_machine_text(connectability_state_).c_str());
-    }
-    connectability_state_ =
-        (status.GetStatus() == ErrorCode::SUCCESS) ? ConnectabilityState::ARMED : ConnectabilityState::DISARMED;
+    update_connectability_state_after_armed(status.GetStatus());
   }
 
   void on_create_connection(CommandStatusView status) {
     ASSERT(status.IsValid());
     ASSERT(status.GetCommandOpCode() == OpCode::LE_CREATE_CONNECTION);
-    if (connectability_state_ != ConnectabilityState::ARMING) {
-      LOG_ERROR(
-          "Received connectability arm notification for unexpected state:%s",
-          connectability_state_machine_text(connectability_state_).c_str());
-    }
-    connectability_state_ =
-        (status.GetStatus() == ErrorCode::SUCCESS) ? ConnectabilityState::ARMED : ConnectabilityState::DISARMED;
+    update_connectability_state_after_armed(status.GetStatus());
   }
 
   void arm_connectability() {
@@ -742,23 +832,42 @@
               conn_interval_max,
               conn_latency,
               supervision_timeout,
-              kMinimumCeLength,
-              kMaximumCeLength),
+              0x00,
+              0x00),
           handler_->BindOnce(&le_impl::on_create_connection, common::Unretained(this)));
     }
   }
 
   void disarm_connectability() {
-    if (connectability_state_ != ConnectabilityState::ARMED && connectability_state_ != ConnectabilityState::ARMING) {
-      LOG_ERROR(
-          "Attempting to disarm le connection state machine in unexpected state:%s",
-          connectability_state_machine_text(connectability_state_).c_str());
-      return;
+
+    auto argument_list = std::vector<std::pair<os::ArgumentType, int>>();
+    bluetooth::os::LogMetricBluetoothLEConnectionMetricEvent(
+        Address::kEmpty,
+        os::LeConnectionOriginType::ORIGIN_UNSPECIFIED,
+        os::LeConnectionType::CONNECTION_TYPE_LE_ACL,
+        os::LeConnectionState::STATE_LE_ACL_CANCEL,
+        argument_list);
+
+    switch (connectability_state_) {
+      case ConnectabilityState::ARMED:
+        LOG_INFO("Disarming LE connection state machine with create connection cancel");
+        connectability_state_ = ConnectabilityState::DISARMING;
+        le_acl_connection_interface_->EnqueueCommand(
+            LeCreateConnectionCancelBuilder::Create(),
+            handler_->BindOnce(&le_impl::on_create_connection_cancel_complete, common::Unretained(this)));
+        break;
+
+      case ConnectabilityState::ARMING:
+        LOG_INFO("Queueing cancel connect until after connection state machine is armed");
+        disarmed_while_arming_ = true;
+        break;
+      case ConnectabilityState::DISARMING:
+      case ConnectabilityState::DISARMED:
+        LOG_ERROR(
+            "Attempting to disarm le connection state machine in unexpected state:%s",
+            connectability_state_machine_text(connectability_state_).c_str());
+        break;
     }
-    connectability_state_ = ConnectabilityState::DISARMING;
-    le_acl_connection_interface_->EnqueueCommand(
-        LeCreateConnectionCancelBuilder::Create(),
-        handler_->BindOnce(&le_impl::on_create_connection_cancel_complete, common::Unretained(this)));
   }
 
   void create_le_connection(AddressWithType address_with_type, bool add_to_connect_list, bool is_direct) {
@@ -832,6 +941,17 @@
     if (create_connection_timeout_alarms_.find(address_with_type) != create_connection_timeout_alarms_.end()) {
       create_connection_timeout_alarms_.at(address_with_type).Cancel();
       create_connection_timeout_alarms_.erase(address_with_type);
+      auto argument_list = std::vector<std::pair<os::ArgumentType, int>>();
+      argument_list.push_back(std::make_pair(
+          os::ArgumentType::ACL_STATUS_CODE,
+          static_cast<int>(android::bluetooth::hci::StatusEnum::STATUS_CONNECTION_TOUT)));
+      bluetooth::os::LogMetricBluetoothLEConnectionMetricEvent(
+          address_with_type.GetAddress(),
+          android::bluetooth::le::LeConnectionOriginType::ORIGIN_NATIVE,
+          android::bluetooth::le::LeConnectionType::CONNECTION_TYPE_LE_ACL,
+          android::bluetooth::le::LeConnectionState::STATE_LE_ACL_TIMEOUT,
+          argument_list);
+
       if (background_connections_.find(address_with_type) != background_connections_.end()) {
         direct_connections_.erase(address_with_type);
         disarm_connectability();
@@ -946,6 +1066,10 @@
   }
 
   void OnPause() override {  // bluetooth::hci::LeAddressManagerCallback
+    if (!address_manager_registered) {
+      LOG_WARN("Unregistered!");
+      return;
+    }
     pause_connection = true;
     if (connectability_state_ == ConnectabilityState::DISARMED) {
       le_address_manager_->AckPause(this);
@@ -956,6 +1080,10 @@
   }
 
   void OnResume() override {  // bluetooth::hci::LeAddressManagerCallback
+    if (!address_manager_registered) {
+      LOG_WARN("Unregistered!");
+      return;
+    }
     pause_connection = false;
     if (arm_on_resume_) {
       arm_connectability();
@@ -1002,8 +1130,6 @@
     }
   }
 
-  static constexpr uint16_t kMinimumCeLength = 0x0002;
-  static constexpr uint16_t kMaximumCeLength = 0x0C00;
   HciLayer* hci_layer_ = nullptr;
   Controller* controller_ = nullptr;
   os::Handler* handler_ = nullptr;
@@ -1022,6 +1148,7 @@
   bool address_manager_registered = false;
   bool ready_to_unregister = false;
   bool pause_connection = false;
+  bool disarmed_while_arming_ = false;
   ConnectabilityState connectability_state_{ConnectabilityState::DISARMED};
   std::map<AddressWithType, os::Alarm> create_connection_timeout_alarms_;
 };
diff --git a/system/gd/hci/acl_manager/le_impl_test.cc b/system/gd/hci/acl_manager/le_impl_test.cc
index 1f3c17f..d84f95b 100644
--- a/system/gd/hci/acl_manager/le_impl_test.cc
+++ b/system/gd/hci/acl_manager/le_impl_test.cc
@@ -16,33 +16,174 @@
 
 #include "hci/acl_manager/le_impl.h"
 
+#include <gmock/gmock.h>
 #include <gtest/gtest.h>
 
 #include <chrono>
+#include <mutex>
 
 #include "common/bidi_queue.h"
 #include "common/callback.h"
+#include "common/testing/log_capture.h"
 #include "hci/acl_manager.h"
+#include "hci/acl_manager/le_connection_callbacks.h"
+#include "hci/acl_manager/le_connection_management_callbacks.h"
 #include "hci/address_with_type.h"
 #include "hci/controller.h"
 #include "hci/hci_packets.h"
 #include "os/handler.h"
 #include "os/log.h"
+#include "packet/bit_inserter.h"
 #include "packet/raw_builder.h"
 
+using namespace bluetooth;
 using namespace std::chrono_literals;
 
 using ::bluetooth::common::BidiQueue;
 using ::bluetooth::common::Callback;
 using ::bluetooth::os::Handler;
 using ::bluetooth::os::Thread;
+using ::bluetooth::packet::BitInserter;
+using ::bluetooth::packet::RawBuilder;
+using ::bluetooth::testing::LogCapture;
+
+using ::testing::_;
+using ::testing::DoAll;
+using ::testing::SaveArg;
+
+namespace {
+constexpr char kFixedAddress[] = "c0:aa:bb:cc:dd:ee";
+constexpr char kRemoteAddress[] = "00:11:22:33:44:55";
+constexpr bool kCrashOnUnknownHandle = true;
+constexpr char kLocalRandomAddress[] = "04:c0:aa:bb:cc:dd:ee";
+constexpr char kRemoteRandomAddress[] = "04:11:22:33:44:55";
+constexpr uint16_t kHciHandle = 123;
+[[maybe_unused]] constexpr bool kAddToFilterAcceptList = true;
+[[maybe_unused]] constexpr bool kSkipFilterAcceptList = !kAddToFilterAcceptList;
+[[maybe_unused]] constexpr bool kIsDirectConnection = true;
+[[maybe_unused]] constexpr bool kIsBackgroundConnection = !kIsDirectConnection;
+constexpr crypto_toolbox::Octet16 kRotationIrk = {};
+constexpr std::chrono::milliseconds kMinimumRotationTime(14 * 1000);
+constexpr std::chrono::milliseconds kMaximumRotationTime(16 * 1000);
+constexpr uint16_t kIntervalMax = 0x40;
+constexpr uint16_t kIntervalMin = 0x20;
+constexpr uint16_t kLatency = 0x60;
+constexpr uint16_t kLength = 0x5678;
+constexpr uint16_t kTime = 0x1234;
+constexpr uint16_t kTimeout = 0x80;
+constexpr std::array<uint8_t, 16> kPeerIdentityResolvingKey({
+    0x00,
+    0x01,
+    0x02,
+    0x03,
+    0x04,
+    0x05,
+    0x06,
+    0x07,
+    0x08,
+    0x09,
+    0x0a,
+    0x0b,
+    0x0c,
+    0x0d,
+    0x0e,
+    0x0f,
+});
+constexpr std::array<uint8_t, 16> kLocalIdentityResolvingKey({
+    0x80,
+    0x81,
+    0x82,
+    0x83,
+    0x84,
+    0x85,
+    0x86,
+    0x87,
+    0x88,
+    0x89,
+    0x8a,
+    0x8b,
+    0x8c,
+    0x8d,
+    0x8e,
+    0x8f,
+});
+
+template <typename B>
+std::shared_ptr<std::vector<uint8_t>> Serialize(std::unique_ptr<B> build) {
+  auto bytes = std::make_shared<std::vector<uint8_t>>();
+  BitInserter bi(*bytes);
+  build->Serialize(bi);
+  return bytes;
+}
+
+template <typename T>
+T CreateCommandView(std::shared_ptr<std::vector<uint8_t>> bytes) {
+  return T::Create(hci::CommandView::Create(hci::PacketView<hci::kLittleEndian>(bytes)));
+}
+
+template <typename T>
+T CreateAclCommandView(std::shared_ptr<std::vector<uint8_t>> bytes) {
+  return T::Create(CreateCommandView<hci::AclCommandView>(bytes));
+}
+
+template <typename T>
+T CreateLeConnectionManagementCommandView(std::shared_ptr<std::vector<uint8_t>> bytes) {
+  return T::Create(CreateAclCommandView<hci::LeConnectionManagementCommandView>(bytes));
+}
+
+template <typename T>
+T CreateLeSecurityCommandView(std::shared_ptr<std::vector<uint8_t>> bytes) {
+  return T::Create(CreateCommandView<hci::LeSecurityCommandView>(bytes));
+}
+
+template <typename T>
+T CreateLeEventView(std::shared_ptr<std::vector<uint8_t>> bytes) {
+  return T::Create(hci::LeMetaEventView::Create(hci::EventView::Create(hci::PacketView<hci::kLittleEndian>(bytes))));
+}
+
+[[maybe_unused]] hci::CommandCompleteView ReturnCommandComplete(hci::OpCode op_code, hci::ErrorCode error_code) {
+  std::vector<uint8_t> success_vector{static_cast<uint8_t>(error_code)};
+  auto builder = hci::CommandCompleteBuilder::Create(uint8_t{1}, op_code, std::make_unique<RawBuilder>(success_vector));
+  auto bytes = Serialize<hci::CommandCompleteBuilder>(std::move(builder));
+  return hci::CommandCompleteView::Create(hci::EventView::Create(hci::PacketView<hci::kLittleEndian>(bytes)));
+}
+
+[[maybe_unused]] hci::CommandStatusView ReturnCommandStatus(hci::OpCode op_code, hci::ErrorCode error_code) {
+  std::vector<uint8_t> success_vector{static_cast<uint8_t>(error_code)};
+  auto builder = hci::CommandStatusBuilder::Create(
+      hci::ErrorCode::SUCCESS, uint8_t{1}, op_code, std::make_unique<RawBuilder>(success_vector));
+  auto bytes = Serialize<hci::CommandStatusBuilder>(std::move(builder));
+  return hci::CommandStatusView::Create(hci::EventView::Create(hci::PacketView<hci::kLittleEndian>(bytes)));
+}
+
+}  // namespace
 
 namespace bluetooth {
 namespace hci {
 namespace acl_manager {
 
+namespace {
+
+PacketView<kLittleEndian> GetPacketView(std::unique_ptr<packet::BasePacketBuilder> packet) {
+  auto bytes = std::make_shared<std::vector<uint8_t>>();
+  BitInserter i(*bytes);
+  bytes->reserve(packet->size());
+  packet->Serialize(i);
+  return packet::PacketView<packet::kLittleEndian>(bytes);
+}
+
 class TestController : public Controller {
  public:
+  bool IsSupported(OpCode op_code) const override {
+    LOG_INFO("IsSupported");
+    return supported_opcodes_.count(op_code) == 1;
+  }
+
+  void AddSupported(OpCode op_code) {
+    LOG_INFO("AddSupported");
+    supported_opcodes_.insert(op_code);
+  }
+
   uint16_t GetNumAclPacketBuffers() const {
     return max_acl_packet_credits_;
   }
@@ -70,6 +211,12 @@
     acl_credits_callback_ = {};
   }
 
+  bool SupportsBlePrivacy() const override {
+    return supports_ble_privacy_;
+  }
+  bool supports_ble_privacy_{false};
+
+ public:
   const uint16_t max_acl_packet_credits_ = 10;
   const uint16_t hci_mtu_ = 1024;
   const uint16_t le_max_acl_packet_credits_ = 15;
@@ -77,9 +224,12 @@
 
  private:
   CompletedAclPacketsCallback acl_credits_callback_;
+  std::set<OpCode> supported_opcodes_{};
 };
 
 class TestHciLayer : public HciLayer {
+  // This is a springboard class that converts from `AclCommandBuilder`
+  // to `ComandBuilder` for use in the hci layer.
   template <typename T>
   class CommandInterfaceImpl : public CommandInterface<T> {
    public:
@@ -98,7 +248,119 @@
     HciLayer& hci_;
   };
 
+  void EnqueueCommand(
+      std::unique_ptr<CommandBuilder> command,
+      common::ContextualOnceCallback<void(CommandStatusView)> on_status) override {
+    const std::lock_guard<std::mutex> lock(command_queue_mutex_);
+    command_queue_.push(std::move(command));
+    command_status_callbacks.push_back(std::move(on_status));
+    if (command_promise_ != nullptr) {
+      std::promise<void>* prom = command_promise_.release();
+      prom->set_value();
+      delete prom;
+    }
+  }
+
+  void EnqueueCommand(
+      std::unique_ptr<CommandBuilder> command,
+      common::ContextualOnceCallback<void(CommandCompleteView)> on_complete) override {
+    const std::lock_guard<std::mutex> lock(command_queue_mutex_);
+    command_queue_.push(std::move(command));
+    command_complete_callbacks.push_back(std::move(on_complete));
+    if (command_promise_ != nullptr) {
+      std::promise<void>* prom = command_promise_.release();
+      prom->set_value();
+      delete prom;
+    }
+  }
+
  public:
+  std::unique_ptr<CommandBuilder> DequeueCommand() {
+    const std::lock_guard<std::mutex> lock(command_queue_mutex_);
+    auto packet = std::move(command_queue_.front());
+    command_queue_.pop();
+    return std::move(packet);
+  }
+
+  std::shared_ptr<std::vector<uint8_t>> DequeueCommandBytes() {
+    auto command = DequeueCommand();
+    auto bytes = std::make_shared<std::vector<uint8_t>>();
+    packet::BitInserter bi(*bytes);
+    command->Serialize(bi);
+    return bytes;
+  }
+
+  bool IsPacketQueueEmpty() const {
+    const std::lock_guard<std::mutex> lock(command_queue_mutex_);
+    return command_queue_.empty();
+  }
+
+  size_t NumberOfQueuedCommands() const {
+    const std::lock_guard<std::mutex> lock(command_queue_mutex_);
+    return command_queue_.size();
+  }
+
+  void SetCommandFuture() {
+    ASSERT_EQ(command_promise_, nullptr) << "Promises, Promises, ... Only one at a time.";
+    command_promise_ = std::make_unique<std::promise<void>>();
+    command_future_ = std::make_unique<std::future<void>>(command_promise_->get_future());
+  }
+
+  CommandView GetLastCommand() {
+    if (command_queue_.empty()) {
+      return CommandView::Create(PacketView<kLittleEndian>(std::make_shared<std::vector<uint8_t>>()));
+    }
+    auto last = std::move(command_queue_.front());
+    command_queue_.pop();
+    return CommandView::Create(GetPacketView(std::move(last)));
+  }
+
+  CommandView GetCommand(OpCode op_code) {
+    if (!command_queue_.empty()) {
+      std::lock_guard<std::mutex> lock(command_queue_mutex_);
+      if (command_future_ != nullptr) {
+        command_future_.reset();
+        command_promise_.reset();
+      }
+    } else if (command_future_ != nullptr) {
+      auto result = command_future_->wait_for(std::chrono::milliseconds(1000));
+      EXPECT_NE(std::future_status::timeout, result);
+    }
+    std::lock_guard<std::mutex> lock(command_queue_mutex_);
+    ASSERT_LOG(
+        !command_queue_.empty(), "Expecting command %s but command queue was empty", OpCodeText(op_code).c_str());
+    CommandView command_packet_view = GetLastCommand();
+    EXPECT_TRUE(command_packet_view.IsValid());
+    EXPECT_EQ(command_packet_view.GetOpCode(), op_code);
+    return command_packet_view;
+  }
+
+  void CommandCompleteCallback(std::unique_ptr<EventBuilder> event_builder) {
+    auto event = EventView::Create(GetPacketView(std::move(event_builder)));
+    CommandCompleteView complete_view = CommandCompleteView::Create(event);
+    ASSERT_TRUE(complete_view.IsValid());
+    ASSERT_NE((uint16_t)command_complete_callbacks.size(), 0);
+    std::move(command_complete_callbacks.front()).Invoke(complete_view);
+    command_complete_callbacks.pop_front();
+  }
+
+  void CommandStatusCallback(std::unique_ptr<EventBuilder> event_builder) {
+    auto event = EventView::Create(GetPacketView(std::move(event_builder)));
+    CommandStatusView status_view = CommandStatusView::Create(event);
+    ASSERT_TRUE(status_view.IsValid());
+    ASSERT_NE((uint16_t)command_status_callbacks.size(), 0);
+    std::move(command_status_callbacks.front()).Invoke(status_view);
+    command_status_callbacks.pop_front();
+  }
+
+  void IncomingLeMetaEvent(std::unique_ptr<LeMetaEventBuilder> event_builder) {
+    auto packet = GetPacketView(std::move(event_builder));
+    EventView event = EventView::Create(packet);
+    LeMetaEventView meta_event_view = LeMetaEventView::Create(event);
+    EXPECT_TRUE(meta_event_view.IsValid());
+    le_event_handler_.Invoke(meta_event_view);
+  }
+
   LeAclConnectionInterface* GetLeAclConnectionInterface(
       common::ContextualCallback<void(LeMetaEventView)> event_handler,
       common::ContextualCallback<void(uint16_t, ErrorCode)> on_disconnect,
@@ -107,17 +369,64 @@
           on_read_remote_version) override {
     disconnect_handlers_.push_back(on_disconnect);
     read_remote_version_handlers_.push_back(on_read_remote_version);
-    return &le_acl_connection_manager_interface_2_;
+    le_event_handler_ = event_handler;
+    return &le_acl_connection_manager_interface_;
   }
 
   void PutLeAclConnectionInterface() override {}
 
-  CommandInterfaceImpl<AclCommandBuilder> le_acl_connection_manager_interface_2_{*this};
+ private:
+  std::list<common::ContextualOnceCallback<void(CommandCompleteView)>> command_complete_callbacks;
+  std::list<common::ContextualOnceCallback<void(CommandStatusView)>> command_status_callbacks;
+  common::ContextualCallback<void(LeMetaEventView)> le_event_handler_;
+  std::queue<std::unique_ptr<CommandBuilder>> command_queue_;
+  mutable std::mutex command_queue_mutex_;
+  std::unique_ptr<std::promise<void>> command_promise_;
+  std::unique_ptr<std::future<void>> command_future_;
+  CommandInterfaceImpl<AclCommandBuilder> le_acl_connection_manager_interface_{*this};
+};
+}  // namespace
+
+class MockLeConnectionCallbacks : public LeConnectionCallbacks {
+ public:
+  MOCK_METHOD(
+      void,
+      OnLeConnectSuccess,
+      (AddressWithType address_with_type, std::unique_ptr<LeAclConnection> connection),
+      (override));
+  MOCK_METHOD(void, OnLeConnectFail, (AddressWithType address_with_type, ErrorCode reason), (override));
+};
+
+class MockLeConnectionManagementCallbacks : public LeConnectionManagementCallbacks {
+ public:
+  MOCK_METHOD(
+      void,
+      OnConnectionUpdate,
+      (hci::ErrorCode hci_status,
+       uint16_t connection_interval,
+       uint16_t connection_latency,
+       uint16_t supervision_timeout),
+      (override));
+  MOCK_METHOD(
+      void,
+      OnDataLengthChange,
+      (uint16_t tx_octets, uint16_t tx_time, uint16_t rx_octets, uint16_t rx_time),
+      (override));
+  MOCK_METHOD(void, OnDisconnection, (ErrorCode reason), (override));
+  MOCK_METHOD(
+      void,
+      OnReadRemoteVersionInformationComplete,
+      (hci::ErrorCode hci_status, uint8_t lmp_version, uint16_t manufacturer_name, uint16_t sub_version),
+      (override));
+  MOCK_METHOD(void, OnLeReadRemoteFeaturesComplete, (hci::ErrorCode hci_status, uint64_t features), (override));
+  MOCK_METHOD(void, OnPhyUpdate, (hci::ErrorCode hci_status, uint8_t tx_phy, uint8_t rx_phy), (override));
+  MOCK_METHOD(void, OnLocalAddressUpdate, (AddressWithType address_with_type), (override));
 };
 
 class LeImplTest : public ::testing::Test {
- public:
+ protected:
   void SetUp() override {
+    bluetooth::common::InitFlags::SetAllForTesting();
     thread_ = new Thread("thread", Thread::Priority::NORMAL);
     handler_ = new Handler(thread_);
     controller_ = new TestController();
@@ -126,10 +435,48 @@
     round_robin_scheduler_ = new RoundRobinScheduler(handler_, controller_, hci_queue_.GetUpEnd());
     hci_queue_.GetDownEnd()->RegisterDequeue(
         handler_, common::Bind(&LeImplTest::HciDownEndDequeue, common::Unretained(this)));
-    le_impl_ = new le_impl(hci_layer_, controller_, handler_, round_robin_scheduler_, true);
+    le_impl_ = new le_impl(hci_layer_, controller_, handler_, round_robin_scheduler_, kCrashOnUnknownHandle);
+    le_impl_->handle_register_le_callbacks(&mock_le_connection_callbacks_, handler_);
+
+    Address address;
+    Address::FromString(kFixedAddress, address);
+    fixed_address_ = AddressWithType(address, AddressType::PUBLIC_DEVICE_ADDRESS);
+
+    Address::FromString(kRemoteAddress, remote_address_);
+    remote_public_address_with_type_ = AddressWithType(remote_address_, AddressType::PUBLIC_DEVICE_ADDRESS);
+
+    Address::FromString(kLocalRandomAddress, local_rpa_);
+    Address::FromString(kRemoteRandomAddress, remote_rpa_);
+  }
+
+  void set_random_device_address_policy() {
+    // Set address policy
+    ASSERT_NO_FATAL_FAILURE(hci_layer_->SetCommandFuture());
+    hci::Address address;
+    Address::FromString("D0:05:04:03:02:01", address);
+    hci::AddressWithType address_with_type(address, hci::AddressType::RANDOM_DEVICE_ADDRESS);
+    crypto_toolbox::Octet16 rotation_irk{};
+    auto minimum_rotation_time = std::chrono::milliseconds(7 * 60 * 1000);
+    auto maximum_rotation_time = std::chrono::milliseconds(15 * 60 * 1000);
+    le_impl_->set_privacy_policy_for_initiator_address(
+        LeAddressManager::AddressPolicy::USE_STATIC_ADDRESS,
+        address_with_type,
+        rotation_irk,
+        minimum_rotation_time,
+        maximum_rotation_time);
+    hci_layer_->GetCommand(OpCode::LE_SET_RANDOM_ADDRESS);
+    hci_layer_->CommandCompleteCallback(LeSetRandomAddressCompleteBuilder::Create(0x01, ErrorCode::SUCCESS));
   }
 
   void TearDown() override {
+    // We cannot teardown our structure without unregistering
+    // from our own structure we created.
+    if (le_impl_->address_manager_registered) {
+      le_impl_->ready_to_unregister = true;
+      le_impl_->check_for_unregister();
+      sync_handler();
+    }
+
     sync_handler();
     delete le_impl_;
 
@@ -148,7 +495,7 @@
     std::promise<void> promise;
     auto future = promise.get_future();
     handler_->BindOnceOn(&promise, &std::promise<void>::set_value).Invoke();
-    auto status = future.wait_for(10ms);
+    auto status = future.wait_for(2s);
     ASSERT_EQ(status, std::future_status::ready);
   }
 
@@ -172,6 +519,20 @@
     }
   }
 
+ protected:
+  void set_privacy_policy_for_initiator_address(
+      const AddressWithType& address, const LeAddressManager::AddressPolicy& policy) {
+    le_impl_->set_privacy_policy_for_initiator_address(
+        policy, address, kRotationIrk, kMinimumRotationTime, kMaximumRotationTime);
+  }
+
+  Address local_rpa_;
+  Address remote_address_;
+  Address remote_rpa_;
+  AddressWithType fixed_address_;
+  AddressWithType remote_public_address_;
+  AddressWithType remote_public_address_with_type_;
+
   uint16_t packet_count_;
   std::unique_ptr<std::promise<void>> packet_promise_;
   std::unique_ptr<std::future<void>> packet_future_;
@@ -181,14 +542,75 @@
 
   Thread* thread_;
   Handler* handler_;
-  HciLayer* hci_layer_{nullptr};
+  TestHciLayer* hci_layer_{nullptr};
   TestController* controller_;
   RoundRobinScheduler* round_robin_scheduler_{nullptr};
 
+  MockLeConnectionCallbacks mock_le_connection_callbacks_;
+  MockLeConnectionManagementCallbacks connection_management_callbacks_;
+
   struct le_impl* le_impl_;
 };
 
-TEST_F(LeImplTest, nop) {}
+class LeImplRegisteredWithAddressManagerTest : public LeImplTest {
+ protected:
+  void SetUp() override {
+    LeImplTest::SetUp();
+    set_privacy_policy_for_initiator_address(fixed_address_, LeAddressManager::AddressPolicy::USE_PUBLIC_ADDRESS);
+
+    le_impl_->register_with_address_manager();
+    sync_handler();  // Let |LeAddressManager::register_client| execute on handler
+    ASSERT_TRUE(le_impl_->address_manager_registered);
+    ASSERT_TRUE(le_impl_->pause_connection);
+  }
+
+  void TearDown() override {
+    LeImplTest::TearDown();
+  }
+};
+
+class LeImplWithConnectionTest : public LeImplTest {
+ protected:
+  void SetUp() override {
+    LeImplTest::SetUp();
+    set_random_device_address_policy();
+
+    EXPECT_CALL(mock_le_connection_callbacks_, OnLeConnectSuccess(_, _))
+        .WillOnce([&](AddressWithType addr, std::unique_ptr<LeAclConnection> conn) {
+          remote_address_with_type_ = addr;
+          connection_ = std::move(conn);
+          connection_->RegisterCallbacks(&connection_management_callbacks_, handler_);
+        });
+
+    auto command = LeEnhancedConnectionCompleteBuilder::Create(
+        ErrorCode::SUCCESS,
+        kHciHandle,
+        Role::PERIPHERAL,
+        AddressType::PUBLIC_DEVICE_ADDRESS,
+        remote_address_,
+        local_rpa_,
+        remote_rpa_,
+        0x0024,
+        0x0000,
+        0x0011,
+        ClockAccuracy::PPM_30);
+    auto bytes = Serialize<LeEnhancedConnectionCompleteBuilder>(std::move(command));
+    auto view = CreateLeEventView<hci::LeEnhancedConnectionCompleteView>(bytes);
+    ASSERT_TRUE(view.IsValid());
+    le_impl_->on_le_event(view);
+
+    sync_handler();
+    ASSERT_EQ(remote_public_address_with_type_, remote_address_with_type_);
+  }
+
+  void TearDown() override {
+    connection_.reset();
+    LeImplTest::TearDown();
+  }
+
+  AddressWithType remote_address_with_type_;
+  std::unique_ptr<LeAclConnection> connection_;
+};
 
 TEST_F(LeImplTest, add_device_to_connect_list) {
   le_impl_->add_device_to_connect_list({{0x01, 0x02, 0x03, 0x04, 0x05, 0x06}, AddressType::PUBLIC_DEVICE_ADDRESS});
@@ -228,6 +650,847 @@
   ASSERT_EQ(0UL, le_impl_->connect_list.size());
 }
 
+TEST_F(LeImplTest, connection_complete_with_periperal_role) {
+  set_random_device_address_policy();
+
+  // Create connection
+  ASSERT_NO_FATAL_FAILURE(hci_layer_->SetCommandFuture());
+  le_impl_->create_le_connection(
+      {{0x21, 0x22, 0x23, 0x24, 0x25, 0x26}, AddressType::PUBLIC_DEVICE_ADDRESS}, true, false);
+  hci_layer_->GetCommand(OpCode::LE_ADD_DEVICE_TO_FILTER_ACCEPT_LIST);
+  ASSERT_NO_FATAL_FAILURE(hci_layer_->SetCommandFuture());
+  hci_layer_->CommandCompleteCallback(LeAddDeviceToFilterAcceptListCompleteBuilder::Create(0x01, ErrorCode::SUCCESS));
+  hci_layer_->GetCommand(OpCode::LE_CREATE_CONNECTION);
+  hci_layer_->CommandStatusCallback(LeCreateConnectionStatusBuilder::Create(ErrorCode::SUCCESS, 0x01));
+  sync_handler();
+
+  // Check state is ARMED
+  ASSERT_EQ(ConnectabilityState::ARMED, le_impl_->connectability_state_);
+
+  // Receive connection complete of incoming connection (Role::PERIPHERAL)
+  hci::Address remote_address;
+  Address::FromString("D0:05:04:03:02:01", remote_address);
+  hci::AddressWithType address_with_type(remote_address, hci::AddressType::PUBLIC_DEVICE_ADDRESS);
+  EXPECT_CALL(mock_le_connection_callbacks_, OnLeConnectSuccess(address_with_type, _));
+  hci_layer_->IncomingLeMetaEvent(LeConnectionCompleteBuilder::Create(
+      ErrorCode::SUCCESS,
+      0x0041,
+      Role::PERIPHERAL,
+      AddressType::PUBLIC_DEVICE_ADDRESS,
+      remote_address,
+      0x0024,
+      0x0000,
+      0x0011,
+      ClockAccuracy::PPM_30));
+  sync_handler();
+
+  // Check state is still ARMED
+  ASSERT_EQ(ConnectabilityState::ARMED, le_impl_->connectability_state_);
+}
+
+TEST_F(LeImplTest, enhanced_connection_complete_with_periperal_role) {
+  set_random_device_address_policy();
+
+  controller_->AddSupported(OpCode::LE_EXTENDED_CREATE_CONNECTION);
+  // Create connection
+  ASSERT_NO_FATAL_FAILURE(hci_layer_->SetCommandFuture());
+  le_impl_->create_le_connection(
+      {{0x21, 0x22, 0x23, 0x24, 0x25, 0x26}, AddressType::PUBLIC_DEVICE_ADDRESS}, true, false);
+  hci_layer_->GetCommand(OpCode::LE_ADD_DEVICE_TO_FILTER_ACCEPT_LIST);
+  ASSERT_NO_FATAL_FAILURE(hci_layer_->SetCommandFuture());
+  hci_layer_->CommandCompleteCallback(LeAddDeviceToFilterAcceptListCompleteBuilder::Create(0x01, ErrorCode::SUCCESS));
+  hci_layer_->GetCommand(OpCode::LE_EXTENDED_CREATE_CONNECTION);
+  hci_layer_->CommandStatusCallback(LeExtendedCreateConnectionStatusBuilder::Create(ErrorCode::SUCCESS, 0x01));
+  sync_handler();
+
+  // Check state is ARMED
+  ASSERT_EQ(ConnectabilityState::ARMED, le_impl_->connectability_state_);
+
+  // Receive connection complete of incoming connection (Role::PERIPHERAL)
+  hci::Address remote_address;
+  Address::FromString("D0:05:04:03:02:01", remote_address);
+  hci::AddressWithType address_with_type(remote_address, hci::AddressType::PUBLIC_DEVICE_ADDRESS);
+  EXPECT_CALL(mock_le_connection_callbacks_, OnLeConnectSuccess(address_with_type, _));
+  hci_layer_->IncomingLeMetaEvent(LeEnhancedConnectionCompleteBuilder::Create(
+      ErrorCode::SUCCESS,
+      0x0041,
+      Role::PERIPHERAL,
+      AddressType::PUBLIC_DEVICE_ADDRESS,
+      remote_address,
+      Address::kEmpty,
+      Address::kEmpty,
+      0x0024,
+      0x0000,
+      0x0011,
+      ClockAccuracy::PPM_30));
+  sync_handler();
+
+  // Check state is still ARMED
+  ASSERT_EQ(ConnectabilityState::ARMED, le_impl_->connectability_state_);
+}
+
+TEST_F(LeImplTest, connection_complete_with_central_role) {
+  set_random_device_address_policy();
+
+  hci::Address remote_address;
+  Address::FromString("D0:05:04:03:02:01", remote_address);
+  hci::AddressWithType address_with_type(remote_address, hci::AddressType::PUBLIC_DEVICE_ADDRESS);
+  // Create connection
+  ASSERT_NO_FATAL_FAILURE(hci_layer_->SetCommandFuture());
+  le_impl_->create_le_connection(address_with_type, true, false);
+  hci_layer_->GetCommand(OpCode::LE_ADD_DEVICE_TO_FILTER_ACCEPT_LIST);
+  ASSERT_NO_FATAL_FAILURE(hci_layer_->SetCommandFuture());
+  hci_layer_->CommandCompleteCallback(LeAddDeviceToFilterAcceptListCompleteBuilder::Create(0x01, ErrorCode::SUCCESS));
+  hci_layer_->GetCommand(OpCode::LE_CREATE_CONNECTION);
+  hci_layer_->CommandStatusCallback(LeCreateConnectionStatusBuilder::Create(ErrorCode::SUCCESS, 0x01));
+  sync_handler();
+
+  // Check state is ARMED
+  ASSERT_EQ(ConnectabilityState::ARMED, le_impl_->connectability_state_);
+
+  // Receive connection complete of outgoing connection (Role::CENTRAL)
+  EXPECT_CALL(mock_le_connection_callbacks_, OnLeConnectSuccess(address_with_type, _));
+  hci_layer_->IncomingLeMetaEvent(LeConnectionCompleteBuilder::Create(
+      ErrorCode::SUCCESS,
+      0x0041,
+      Role::CENTRAL,
+      AddressType::PUBLIC_DEVICE_ADDRESS,
+      remote_address,
+      0x0024,
+      0x0000,
+      0x0011,
+      ClockAccuracy::PPM_30));
+  sync_handler();
+
+  // Check state is DISARMED
+  ASSERT_EQ(ConnectabilityState::DISARMED, le_impl_->connectability_state_);
+}
+
+TEST_F(LeImplTest, enhanced_connection_complete_with_central_role) {
+  set_random_device_address_policy();
+
+  controller_->AddSupported(OpCode::LE_EXTENDED_CREATE_CONNECTION);
+  hci::Address remote_address;
+  Address::FromString("D0:05:04:03:02:01", remote_address);
+  hci::AddressWithType address_with_type(remote_address, hci::AddressType::PUBLIC_DEVICE_ADDRESS);
+  // Create connection
+  ASSERT_NO_FATAL_FAILURE(hci_layer_->SetCommandFuture());
+  le_impl_->create_le_connection(address_with_type, true, false);
+  hci_layer_->GetCommand(OpCode::LE_ADD_DEVICE_TO_FILTER_ACCEPT_LIST);
+  ASSERT_NO_FATAL_FAILURE(hci_layer_->SetCommandFuture());
+  hci_layer_->CommandCompleteCallback(LeAddDeviceToFilterAcceptListCompleteBuilder::Create(0x01, ErrorCode::SUCCESS));
+  hci_layer_->GetCommand(OpCode::LE_EXTENDED_CREATE_CONNECTION);
+  hci_layer_->CommandStatusCallback(LeExtendedCreateConnectionStatusBuilder::Create(ErrorCode::SUCCESS, 0x01));
+  sync_handler();
+
+  // Check state is ARMED
+  ASSERT_EQ(ConnectabilityState::ARMED, le_impl_->connectability_state_);
+
+  // Receive connection complete of outgoing connection (Role::CENTRAL)
+  EXPECT_CALL(mock_le_connection_callbacks_, OnLeConnectSuccess(address_with_type, _));
+  hci_layer_->IncomingLeMetaEvent(LeEnhancedConnectionCompleteBuilder::Create(
+      ErrorCode::SUCCESS,
+      0x0041,
+      Role::CENTRAL,
+      AddressType::PUBLIC_DEVICE_ADDRESS,
+      remote_address,
+      Address::kEmpty,
+      Address::kEmpty,
+      0x0024,
+      0x0000,
+      0x0011,
+      ClockAccuracy::PPM_30));
+  sync_handler();
+
+  // Check state is DISARMED
+  ASSERT_EQ(ConnectabilityState::DISARMED, le_impl_->connectability_state_);
+}
+
+// b/260917913
+TEST_F(LeImplTest, DISABLED_register_with_address_manager__AddressPolicyNotSet) {
+  auto log_capture = std::make_unique<LogCapture>();
+
+  std::promise<void> promise;
+  auto future = promise.get_future();
+  handler_->Post(common::BindOnce(
+      [](struct le_impl* le_impl, os::Handler* handler, std::promise<void> promise) {
+        le_impl->register_with_address_manager();
+        handler->Post(common::BindOnce([](std::promise<void> promise) { promise.set_value(); }, std::move(promise)));
+      },
+      le_impl_,
+      handler_,
+      std::move(promise)));
+
+  // Let |LeAddressManager::register_client| execute on handler
+  auto status = future.wait_for(2s);
+  ASSERT_EQ(status, std::future_status::ready);
+
+  handler_->Post(common::BindOnce(
+      [](struct le_impl* le_impl) {
+        ASSERT_TRUE(le_impl->address_manager_registered);
+        ASSERT_TRUE(le_impl->pause_connection);
+      },
+      le_impl_));
+
+  std::promise<void> promise2;
+  auto future2 = promise2.get_future();
+  handler_->Post(common::BindOnce(
+      [](struct le_impl* le_impl, os::Handler* handler, std::promise<void> promise) {
+        le_impl->ready_to_unregister = true;
+        le_impl->check_for_unregister();
+        ASSERT_FALSE(le_impl->address_manager_registered);
+        ASSERT_FALSE(le_impl->pause_connection);
+        handler->Post(common::BindOnce([](std::promise<void> promise) { promise.set_value(); }, std::move(promise)));
+      },
+      le_impl_,
+      handler_,
+      std::move(promise2)));
+
+  // Let |LeAddressManager::unregister_client| execute on handler
+  auto status2 = future2.wait_for(2s);
+  ASSERT_EQ(status2, std::future_status::ready);
+
+  handler_->Post(common::BindOnce(
+      [](std::unique_ptr<LogCapture> log_capture) {
+        log_capture->Sync();
+        ASSERT_TRUE(log_capture->Rewind()->Find("address policy isn't set yet"));
+        ASSERT_TRUE(log_capture->Rewind()->Find("Client unregistered"));
+      },
+      std::move(log_capture)));
+}
+
+// b/260917913
+TEST_F(LeImplTest, DISABLED_disarm_connectability_DISARMED) {
+  std::unique_ptr<LogCapture> log_capture = std::make_unique<LogCapture>();
+
+  le_impl_->connectability_state_ = ConnectabilityState::DISARMED;
+  le_impl_->disarm_connectability();
+  ASSERT_FALSE(le_impl_->disarmed_while_arming_);
+
+  le_impl_->on_create_connection(ReturnCommandStatus(OpCode::LE_CREATE_CONNECTION, ErrorCode::SUCCESS));
+
+  ASSERT_TRUE(log_capture->Rewind()->Find("Attempting to disarm le connection"));
+  ASSERT_TRUE(log_capture->Rewind()->Find("in unexpected state:ConnectabilityState::DISARMED"));
+}
+
+// b/260917913
+TEST_F(LeImplTest, DISABLED_disarm_connectability_DISARMED_extended) {
+  std::unique_ptr<LogCapture> log_capture = std::make_unique<LogCapture>();
+
+  le_impl_->connectability_state_ = ConnectabilityState::DISARMED;
+  le_impl_->disarm_connectability();
+  ASSERT_FALSE(le_impl_->disarmed_while_arming_);
+
+  le_impl_->on_extended_create_connection(
+      ReturnCommandStatus(OpCode::LE_EXTENDED_CREATE_CONNECTION, ErrorCode::SUCCESS));
+
+  ASSERT_TRUE(log_capture->Rewind()->Find("Attempting to disarm le connection"));
+  ASSERT_TRUE(log_capture->Rewind()->Find("in unexpected state:ConnectabilityState::DISARMED"));
+}
+
+// b/260917913
+TEST_F(LeImplTest, DISABLED_disarm_connectability_ARMING) {
+  std::unique_ptr<LogCapture> log_capture = std::make_unique<LogCapture>();
+
+  le_impl_->connectability_state_ = ConnectabilityState::ARMING;
+  le_impl_->disarm_connectability();
+  ASSERT_TRUE(le_impl_->disarmed_while_arming_);
+  le_impl_->on_create_connection(ReturnCommandStatus(OpCode::LE_CREATE_CONNECTION, ErrorCode::SUCCESS));
+
+  ASSERT_TRUE(log_capture->Rewind()->Find("Queueing cancel connect until"));
+  ASSERT_TRUE(log_capture->Rewind()->Find("Le connection state machine armed state"));
+}
+
+// b/260917913
+TEST_F(LeImplTest, DISABLED_disarm_connectability_ARMING_extended) {
+  std::unique_ptr<LogCapture> log_capture = std::make_unique<LogCapture>();
+
+  le_impl_->connectability_state_ = ConnectabilityState::ARMING;
+  le_impl_->disarm_connectability();
+  ASSERT_TRUE(le_impl_->disarmed_while_arming_);
+
+  le_impl_->on_extended_create_connection(
+      ReturnCommandStatus(OpCode::LE_EXTENDED_CREATE_CONNECTION, ErrorCode::SUCCESS));
+
+  ASSERT_TRUE(log_capture->Rewind()->Find("Queueing cancel connect until"));
+  ASSERT_TRUE(log_capture->Rewind()->Find("Le connection state machine armed state"));
+}
+
+// b/260917913
+TEST_F(LeImplTest, DISABLED_disarm_connectability_ARMED) {
+  std::unique_ptr<LogCapture> log_capture = std::make_unique<LogCapture>();
+
+  le_impl_->connectability_state_ = ConnectabilityState::ARMED;
+  le_impl_->disarm_connectability();
+  ASSERT_FALSE(le_impl_->disarmed_while_arming_);
+
+  le_impl_->on_create_connection(ReturnCommandStatus(OpCode::LE_CREATE_CONNECTION, ErrorCode::SUCCESS));
+
+  ASSERT_TRUE(log_capture->Rewind()->Find("Disarming LE connection state machine"));
+  ASSERT_TRUE(log_capture->Rewind()->Find("Disarming LE connection state machine with create connection"));
+}
+
+// b/260917913
+TEST_F(LeImplTest, DISABLED_disarm_connectability_ARMED_extended) {
+  std::unique_ptr<LogCapture> log_capture = std::make_unique<LogCapture>();
+
+  le_impl_->connectability_state_ = ConnectabilityState::ARMED;
+  le_impl_->disarm_connectability();
+  ASSERT_FALSE(le_impl_->disarmed_while_arming_);
+
+  le_impl_->on_extended_create_connection(
+      ReturnCommandStatus(OpCode::LE_EXTENDED_CREATE_CONNECTION, ErrorCode::SUCCESS));
+
+  ASSERT_TRUE(log_capture->Rewind()->Find("Disarming LE connection state machine"));
+  ASSERT_TRUE(log_capture->Rewind()->Find("Disarming LE connection state machine with create connection"));
+}
+
+// b/260917913
+TEST_F(LeImplTest, DISABLED_disarm_connectability_DISARMING) {
+  std::unique_ptr<LogCapture> log_capture = std::make_unique<LogCapture>();
+
+  le_impl_->connectability_state_ = ConnectabilityState::DISARMING;
+  le_impl_->disarm_connectability();
+  ASSERT_FALSE(le_impl_->disarmed_while_arming_);
+
+  le_impl_->on_create_connection(ReturnCommandStatus(OpCode::LE_CREATE_CONNECTION, ErrorCode::SUCCESS));
+
+  ASSERT_TRUE(log_capture->Rewind()->Find("Attempting to disarm le connection"));
+  ASSERT_TRUE(log_capture->Rewind()->Find("in unexpected state:ConnectabilityState::DISARMING"));
+}
+
+// b/260917913
+TEST_F(LeImplTest, DISABLED_disarm_connectability_DISARMING_extended) {
+  std::unique_ptr<LogCapture> log_capture = std::make_unique<LogCapture>();
+
+  le_impl_->connectability_state_ = ConnectabilityState::DISARMING;
+  le_impl_->disarm_connectability();
+  ASSERT_FALSE(le_impl_->disarmed_while_arming_);
+
+  le_impl_->on_extended_create_connection(
+      ReturnCommandStatus(OpCode::LE_EXTENDED_CREATE_CONNECTION, ErrorCode::SUCCESS));
+
+  ASSERT_TRUE(log_capture->Rewind()->Find("Attempting to disarm le connection"));
+  ASSERT_TRUE(log_capture->Rewind()->Find("in unexpected state:ConnectabilityState::DISARMING"));
+}
+
+// b/260917913
+TEST_F(LeImplTest, DISABLED_register_with_address_manager__AddressPolicyPublicAddress) {
+  std::unique_ptr<LogCapture> log_capture = std::make_unique<LogCapture>();
+
+  set_privacy_policy_for_initiator_address(fixed_address_, LeAddressManager::AddressPolicy::USE_PUBLIC_ADDRESS);
+
+  le_impl_->register_with_address_manager();
+  sync_handler();  // Let |eAddressManager::register_client| execute on handler
+  ASSERT_TRUE(le_impl_->address_manager_registered);
+  ASSERT_TRUE(le_impl_->pause_connection);
+
+  le_impl_->ready_to_unregister = true;
+
+  le_impl_->check_for_unregister();
+  sync_handler();  // Let |LeAddressManager::unregister_client| execute on handler
+  ASSERT_FALSE(le_impl_->address_manager_registered);
+  ASSERT_FALSE(le_impl_->pause_connection);
+
+  ASSERT_TRUE(log_capture->Rewind()->Find("SetPrivacyPolicyForInitiatorAddress with policy 1"));
+  ASSERT_TRUE(log_capture->Rewind()->Find("Client unregistered"));
+}
+
+// b/260917913
+TEST_F(LeImplTest, DISABLED_register_with_address_manager__AddressPolicyStaticAddress) {
+  std::unique_ptr<LogCapture> log_capture = std::make_unique<LogCapture>();
+
+  set_privacy_policy_for_initiator_address(fixed_address_, LeAddressManager::AddressPolicy::USE_STATIC_ADDRESS);
+
+  le_impl_->register_with_address_manager();
+  sync_handler();  // Let |LeAddressManager::register_client| execute on handler
+  ASSERT_TRUE(le_impl_->address_manager_registered);
+  ASSERT_TRUE(le_impl_->pause_connection);
+
+  le_impl_->ready_to_unregister = true;
+
+  le_impl_->check_for_unregister();
+  sync_handler();  // Let |LeAddressManager::unregister_client| execute on handler
+  ASSERT_FALSE(le_impl_->address_manager_registered);
+  ASSERT_FALSE(le_impl_->pause_connection);
+
+  ASSERT_TRUE(log_capture->Rewind()->Find("SetPrivacyPolicyForInitiatorAddress with policy 2"));
+  ASSERT_TRUE(log_capture->Rewind()->Find("Client unregistered"));
+}
+
+// b/260917913
+TEST_F(LeImplTest, DISABLED_register_with_address_manager__AddressPolicyNonResolvableAddress) {
+  std::unique_ptr<LogCapture> log_capture = std::make_unique<LogCapture>();
+
+  set_privacy_policy_for_initiator_address(fixed_address_, LeAddressManager::AddressPolicy::USE_NON_RESOLVABLE_ADDRESS);
+
+  le_impl_->register_with_address_manager();
+  sync_handler();  // Let |LeAddressManager::register_client| execute on handler
+  ASSERT_TRUE(le_impl_->address_manager_registered);
+  ASSERT_TRUE(le_impl_->pause_connection);
+
+  le_impl_->ready_to_unregister = true;
+
+  le_impl_->check_for_unregister();
+  sync_handler();  // Let |LeAddressManager::unregister_client| execute on handler
+  ASSERT_FALSE(le_impl_->address_manager_registered);
+  ASSERT_FALSE(le_impl_->pause_connection);
+
+  ASSERT_TRUE(log_capture->Rewind()->Find("SetPrivacyPolicyForInitiatorAddress with policy 3"));
+  ASSERT_TRUE(log_capture->Rewind()->Find("Client unregistered"));
+}
+
+// b/260917913
+TEST_F(LeImplTest, DISABLED_register_with_address_manager__AddressPolicyResolvableAddress) {
+  std::unique_ptr<LogCapture> log_capture = std::make_unique<LogCapture>();
+
+  set_privacy_policy_for_initiator_address(fixed_address_, LeAddressManager::AddressPolicy::USE_RESOLVABLE_ADDRESS);
+
+  le_impl_->register_with_address_manager();
+  sync_handler();  // Let |LeAddressManager::register_client| execute on handler
+  ASSERT_TRUE(le_impl_->address_manager_registered);
+  ASSERT_TRUE(le_impl_->pause_connection);
+
+  le_impl_->ready_to_unregister = true;
+
+  le_impl_->check_for_unregister();
+  sync_handler();  // Let |LeAddressManager::unregister_client| execute on handler
+  ASSERT_FALSE(le_impl_->address_manager_registered);
+  ASSERT_FALSE(le_impl_->pause_connection);
+
+  ASSERT_TRUE(log_capture->Rewind()->Find("SetPrivacyPolicyForInitiatorAddress with policy 4"));
+  ASSERT_TRUE(log_capture->Rewind()->Find("Client unregistered"));
+}
+
+// b/260920739
+TEST_F(LeImplTest, DISABLED_add_device_to_resolving_list) {
+  // Some kind of privacy policy must be set for LeAddressManager to operate properly
+  set_privacy_policy_for_initiator_address(fixed_address_, LeAddressManager::AddressPolicy::USE_PUBLIC_ADDRESS);
+  // Let LeAddressManager::resume_registered_clients execute
+  sync_handler();
+
+  ASSERT_EQ(0UL, hci_layer_->NumberOfQueuedCommands());
+
+  // le_impl should not be registered with address manager
+  ASSERT_FALSE(le_impl_->address_manager_registered);
+  ASSERT_FALSE(le_impl_->pause_connection);
+
+  ASSERT_EQ(0UL, le_impl_->le_address_manager_->NumberCachedCommands());
+  // Acknowledge that the le_impl has quiesced all relevant controller state
+  le_impl_->add_device_to_resolving_list(
+      remote_public_address_with_type_, kPeerIdentityResolvingKey, kLocalIdentityResolvingKey);
+  ASSERT_EQ(3UL, le_impl_->le_address_manager_->NumberCachedCommands());
+
+  sync_handler();  // Let |LeAddressManager::register_client| execute on handler
+  ASSERT_TRUE(le_impl_->address_manager_registered);
+  ASSERT_TRUE(le_impl_->pause_connection);
+
+  le_impl_->le_address_manager_->AckPause(le_impl_);
+  sync_handler();  // Allow |LeAddressManager::ack_pause| to complete
+
+  ASSERT_FALSE(hci_layer_->IsPacketQueueEmpty());
+  {
+    // Inform controller to disable address resolution
+    auto command = CreateLeSecurityCommandView<LeSetAddressResolutionEnableView>(hci_layer_->DequeueCommandBytes());
+    ASSERT_TRUE(command.IsValid());
+    ASSERT_EQ(Enable::DISABLED, command.GetAddressResolutionEnable());
+    le_impl_->le_address_manager_->OnCommandComplete(
+        ReturnCommandComplete(OpCode::LE_SET_ADDRESS_RESOLUTION_ENABLE, ErrorCode::SUCCESS));
+  }
+  sync_handler();  // |LeAddressManager::check_cached_commands|
+
+  ASSERT_FALSE(hci_layer_->IsPacketQueueEmpty());
+  {
+    auto command = CreateLeSecurityCommandView<LeAddDeviceToResolvingListView>(hci_layer_->DequeueCommandBytes());
+    ASSERT_TRUE(command.IsValid());
+    ASSERT_EQ(PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS, command.GetPeerIdentityAddressType());
+    ASSERT_EQ(remote_public_address_with_type_.GetAddress(), command.GetPeerIdentityAddress());
+    ASSERT_EQ(kPeerIdentityResolvingKey, command.GetPeerIrk());
+    ASSERT_EQ(kLocalIdentityResolvingKey, command.GetLocalIrk());
+    le_impl_->le_address_manager_->OnCommandComplete(
+        ReturnCommandComplete(OpCode::LE_ADD_DEVICE_TO_RESOLVING_LIST, ErrorCode::SUCCESS));
+  }
+  sync_handler();  // |LeAddressManager::check_cached_commands|
+
+  ASSERT_FALSE(hci_layer_->IsPacketQueueEmpty());
+  {
+    auto command = CreateLeSecurityCommandView<LeSetAddressResolutionEnableView>(hci_layer_->DequeueCommandBytes());
+    ASSERT_TRUE(command.IsValid());
+    ASSERT_EQ(Enable::ENABLED, command.GetAddressResolutionEnable());
+    le_impl_->le_address_manager_->OnCommandComplete(
+        ReturnCommandComplete(OpCode::LE_SET_ADDRESS_RESOLUTION_ENABLE, ErrorCode::SUCCESS));
+  }
+  sync_handler();  // |LeAddressManager::check_cached_commands|
+
+  ASSERT_TRUE(hci_layer_->IsPacketQueueEmpty());
+  ASSERT_TRUE(le_impl_->address_manager_registered);
+
+  le_impl_->ready_to_unregister = true;
+
+  le_impl_->check_for_unregister();
+  sync_handler();
+  ASSERT_FALSE(le_impl_->address_manager_registered);
+  ASSERT_FALSE(le_impl_->pause_connection);
+}
+
+TEST_F(LeImplTest, add_device_to_resolving_list__SupportsBlePrivacy) {
+  controller_->supports_ble_privacy_ = true;
+
+  // Some kind of privacy policy must be set for LeAddressManager to operate properly
+  set_privacy_policy_for_initiator_address(fixed_address_, LeAddressManager::AddressPolicy::USE_PUBLIC_ADDRESS);
+  // Let LeAddressManager::resume_registered_clients execute
+  sync_handler();
+
+  ASSERT_EQ(0UL, hci_layer_->NumberOfQueuedCommands());
+
+  // le_impl should not be registered with address manager
+  ASSERT_FALSE(le_impl_->address_manager_registered);
+  ASSERT_FALSE(le_impl_->pause_connection);
+
+  ASSERT_EQ(0UL, le_impl_->le_address_manager_->NumberCachedCommands());
+  // Acknowledge that the le_impl has quiesced all relevant controller state
+  le_impl_->add_device_to_resolving_list(
+      remote_public_address_with_type_, kPeerIdentityResolvingKey, kLocalIdentityResolvingKey);
+  ASSERT_EQ(4UL, le_impl_->le_address_manager_->NumberCachedCommands());
+
+  sync_handler();  // Let |LeAddressManager::register_client| execute on handler
+  ASSERT_TRUE(le_impl_->address_manager_registered);
+  ASSERT_TRUE(le_impl_->pause_connection);
+
+  le_impl_->le_address_manager_->AckPause(le_impl_);
+  sync_handler();  // Allow |LeAddressManager::ack_pause| to complete
+
+  ASSERT_FALSE(hci_layer_->IsPacketQueueEmpty());
+  {
+    // Inform controller to disable address resolution
+    auto command = CreateLeSecurityCommandView<LeSetAddressResolutionEnableView>(hci_layer_->DequeueCommandBytes());
+    ASSERT_TRUE(command.IsValid());
+    ASSERT_EQ(Enable::DISABLED, command.GetAddressResolutionEnable());
+    le_impl_->le_address_manager_->OnCommandComplete(
+        ReturnCommandComplete(OpCode::LE_SET_ADDRESS_RESOLUTION_ENABLE, ErrorCode::SUCCESS));
+  }
+  sync_handler();  // |LeAddressManager::check_cached_commands|
+
+  ASSERT_FALSE(hci_layer_->IsPacketQueueEmpty());
+  {
+    auto command = CreateLeSecurityCommandView<LeAddDeviceToResolvingListView>(hci_layer_->DequeueCommandBytes());
+    ASSERT_TRUE(command.IsValid());
+    ASSERT_EQ(PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS, command.GetPeerIdentityAddressType());
+    ASSERT_EQ(remote_public_address_with_type_.GetAddress(), command.GetPeerIdentityAddress());
+    ASSERT_EQ(kPeerIdentityResolvingKey, command.GetPeerIrk());
+    ASSERT_EQ(kLocalIdentityResolvingKey, command.GetLocalIrk());
+    le_impl_->le_address_manager_->OnCommandComplete(
+        ReturnCommandComplete(OpCode::LE_ADD_DEVICE_TO_RESOLVING_LIST, ErrorCode::SUCCESS));
+  }
+  sync_handler();  // |LeAddressManager::check_cached_commands|
+
+  ASSERT_FALSE(hci_layer_->IsPacketQueueEmpty());
+  {
+    auto command = CreateLeSecurityCommandView<LeSetPrivacyModeView>(hci_layer_->DequeueCommandBytes());
+    ASSERT_TRUE(command.IsValid());
+    ASSERT_EQ(PrivacyMode::DEVICE, command.GetPrivacyMode());
+    ASSERT_EQ(remote_public_address_with_type_.GetAddress(), command.GetPeerIdentityAddress());
+    ASSERT_EQ(PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS, command.GetPeerIdentityAddressType());
+    le_impl_->le_address_manager_->OnCommandComplete(
+        ReturnCommandComplete(OpCode::LE_SET_PRIVACY_MODE, ErrorCode::SUCCESS));
+  }
+  sync_handler();  // |LeAddressManager::check_cached_commands|
+
+  ASSERT_FALSE(hci_layer_->IsPacketQueueEmpty());
+  {
+    auto command = CreateLeSecurityCommandView<LeSetAddressResolutionEnableView>(hci_layer_->DequeueCommandBytes());
+    ASSERT_TRUE(command.IsValid());
+    ASSERT_EQ(Enable::ENABLED, command.GetAddressResolutionEnable());
+    le_impl_->le_address_manager_->OnCommandComplete(
+        ReturnCommandComplete(OpCode::LE_SET_ADDRESS_RESOLUTION_ENABLE, ErrorCode::SUCCESS));
+  }
+  sync_handler();  // |LeAddressManager::check_cached_commands|
+
+  ASSERT_TRUE(hci_layer_->IsPacketQueueEmpty());
+  ASSERT_TRUE(le_impl_->address_manager_registered);
+
+  le_impl_->ready_to_unregister = true;
+
+  le_impl_->check_for_unregister();
+  sync_handler();
+  ASSERT_FALSE(le_impl_->address_manager_registered);
+  ASSERT_FALSE(le_impl_->pause_connection);
+}
+
+TEST_F(LeImplTest, connectability_state_machine_text) {
+  ASSERT_STREQ(
+      "ConnectabilityState::DISARMED", connectability_state_machine_text(ConnectabilityState::DISARMED).c_str());
+  ASSERT_STREQ("ConnectabilityState::ARMING", connectability_state_machine_text(ConnectabilityState::ARMING).c_str());
+  ASSERT_STREQ("ConnectabilityState::ARMED", connectability_state_machine_text(ConnectabilityState::ARMED).c_str());
+  ASSERT_STREQ(
+      "ConnectabilityState::DISARMING", connectability_state_machine_text(ConnectabilityState::DISARMING).c_str());
+}
+
+TEST_F(LeImplTest, on_le_event__CONNECTION_COMPLETE_CENTRAL) {
+  EXPECT_CALL(mock_le_connection_callbacks_, OnLeConnectSuccess(_, _)).Times(1);
+  set_random_device_address_policy();
+  auto command = LeConnectionCompleteBuilder::Create(
+      ErrorCode::SUCCESS,
+      kHciHandle,
+      Role::CENTRAL,
+      AddressType::PUBLIC_DEVICE_ADDRESS,
+      remote_address_,
+      0x0024,
+      0x0000,
+      0x0011,
+      ClockAccuracy::PPM_30);
+  auto bytes = Serialize<LeConnectionCompleteBuilder>(std::move(command));
+  auto view = CreateLeEventView<hci::LeConnectionCompleteView>(bytes);
+  ASSERT_TRUE(view.IsValid());
+  le_impl_->on_le_event(view);
+}
+
+TEST_F(LeImplTest, on_le_event__CONNECTION_COMPLETE_PERIPHERAL) {
+  EXPECT_CALL(mock_le_connection_callbacks_, OnLeConnectSuccess(_, _)).Times(1);
+  set_random_device_address_policy();
+  auto command = LeConnectionCompleteBuilder::Create(
+      ErrorCode::SUCCESS,
+      kHciHandle,
+      Role::PERIPHERAL,
+      AddressType::PUBLIC_DEVICE_ADDRESS,
+      remote_address_,
+      0x0024,
+      0x0000,
+      0x0011,
+      ClockAccuracy::PPM_30);
+  auto bytes = Serialize<LeConnectionCompleteBuilder>(std::move(command));
+  auto view = CreateLeEventView<hci::LeConnectionCompleteView>(bytes);
+  ASSERT_TRUE(view.IsValid());
+  le_impl_->on_le_event(view);
+}
+
+TEST_F(LeImplTest, on_le_event__ENHANCED_CONNECTION_COMPLETE_CENTRAL) {
+  EXPECT_CALL(mock_le_connection_callbacks_, OnLeConnectSuccess(_, _)).Times(1);
+  set_random_device_address_policy();
+  auto command = LeEnhancedConnectionCompleteBuilder::Create(
+      ErrorCode::SUCCESS,
+      kHciHandle,
+      Role::CENTRAL,
+      AddressType::PUBLIC_DEVICE_ADDRESS,
+      remote_address_,
+      local_rpa_,
+      remote_rpa_,
+      0x0024,
+      0x0000,
+      0x0011,
+      ClockAccuracy::PPM_30);
+  auto bytes = Serialize<LeEnhancedConnectionCompleteBuilder>(std::move(command));
+  auto view = CreateLeEventView<hci::LeEnhancedConnectionCompleteView>(bytes);
+  ASSERT_TRUE(view.IsValid());
+  le_impl_->on_le_event(view);
+}
+
+TEST_F(LeImplTest, on_le_event__ENHANCED_CONNECTION_COMPLETE_PERIPHERAL) {
+  EXPECT_CALL(mock_le_connection_callbacks_, OnLeConnectSuccess(_, _)).Times(1);
+  set_random_device_address_policy();
+  auto command = LeEnhancedConnectionCompleteBuilder::Create(
+      ErrorCode::SUCCESS,
+      kHciHandle,
+      Role::PERIPHERAL,
+      AddressType::PUBLIC_DEVICE_ADDRESS,
+      remote_address_,
+      local_rpa_,
+      remote_rpa_,
+      0x0024,
+      0x0000,
+      0x0011,
+      ClockAccuracy::PPM_30);
+  auto bytes = Serialize<LeEnhancedConnectionCompleteBuilder>(std::move(command));
+  auto view = CreateLeEventView<hci::LeEnhancedConnectionCompleteView>(bytes);
+  ASSERT_TRUE(view.IsValid());
+  le_impl_->on_le_event(view);
+}
+
+TEST_F(LeImplRegisteredWithAddressManagerTest, ignore_on_pause_on_resume_after_unregistered) {
+  le_impl_->ready_to_unregister = true;
+  le_impl_->check_for_unregister();
+  // OnPause should be ignored
+  le_impl_->OnPause();
+  ASSERT_FALSE(le_impl_->pause_connection);
+  // OnResume should be ignored
+  le_impl_->pause_connection = true;
+  le_impl_->OnResume();
+  ASSERT_TRUE(le_impl_->pause_connection);
+}
+
+TEST_F(LeImplWithConnectionTest, on_le_event__PHY_UPDATE_COMPLETE) {
+  hci::ErrorCode hci_status{ErrorCode::STATUS_UNKNOWN};
+  hci::PhyType tx_phy{0};
+  hci::PhyType rx_phy{0};
+
+  // Send a phy update
+  {
+    EXPECT_CALL(connection_management_callbacks_, OnPhyUpdate(_, _, _))
+        .WillOnce([&](hci::ErrorCode _hci_status, uint8_t _tx_phy, uint8_t _rx_phy) {
+          hci_status = _hci_status;
+          tx_phy = static_cast<PhyType>(_tx_phy);
+          rx_phy = static_cast<PhyType>(_rx_phy);
+        });
+    auto command = LePhyUpdateCompleteBuilder::Create(ErrorCode::SUCCESS, kHciHandle, 0x01, 0x02);
+    auto bytes = Serialize<LePhyUpdateCompleteBuilder>(std::move(command));
+    auto view = CreateLeEventView<hci::LePhyUpdateCompleteView>(bytes);
+    ASSERT_TRUE(view.IsValid());
+    le_impl_->on_le_event(view);
+  }
+
+  sync_handler();
+  ASSERT_EQ(ErrorCode::SUCCESS, hci_status);
+  ASSERT_EQ(PhyType::LE_1M, tx_phy);
+  ASSERT_EQ(PhyType::LE_2M, rx_phy);
+}
+
+TEST_F(LeImplWithConnectionTest, on_le_event__DATA_LENGTH_CHANGE) {
+  uint16_t tx_octets{0};
+  uint16_t tx_time{0};
+  uint16_t rx_octets{0};
+  uint16_t rx_time{0};
+
+  // Send a data length event
+  {
+    EXPECT_CALL(connection_management_callbacks_, OnDataLengthChange(_, _, _, _))
+        .WillOnce([&](uint16_t _tx_octets, uint16_t _tx_time, uint16_t _rx_octets, uint16_t _rx_time) {
+          tx_octets = _tx_octets;
+          tx_time = _tx_time;
+          rx_octets = _rx_octets;
+          rx_time = _rx_time;
+        });
+    auto command = LeDataLengthChangeBuilder::Create(kHciHandle, 0x1234, 0x5678, 0x9abc, 0xdef0);
+    auto bytes = Serialize<LeDataLengthChangeBuilder>(std::move(command));
+    auto view = CreateLeEventView<hci::LeDataLengthChangeView>(bytes);
+    ASSERT_TRUE(view.IsValid());
+    le_impl_->on_le_event(view);
+  }
+
+  sync_handler();
+  ASSERT_EQ(0x1234, tx_octets);
+  ASSERT_EQ(0x5678, tx_time);
+  ASSERT_EQ(0x9abc, rx_octets);
+  ASSERT_EQ(0xdef0, rx_time);
+}
+
+TEST_F(LeImplWithConnectionTest, on_le_event__REMOTE_CONNECTION_PARAMETER_REQUEST) {
+  // Send a remote connection parameter request
+  auto command = hci::LeRemoteConnectionParameterRequestBuilder::Create(
+      kHciHandle, kIntervalMin, kIntervalMax, kLatency, kTimeout);
+  auto bytes = Serialize<LeRemoteConnectionParameterRequestBuilder>(std::move(command));
+  {
+    auto view = CreateLeEventView<hci::LeRemoteConnectionParameterRequestView>(bytes);
+    ASSERT_TRUE(view.IsValid());
+    le_impl_->on_le_event(view);
+  }
+
+  sync_handler();
+
+  ASSERT_FALSE(hci_layer_->IsPacketQueueEmpty());
+
+  auto view = CreateLeConnectionManagementCommandView<LeRemoteConnectionParameterRequestReplyView>(
+      hci_layer_->DequeueCommandBytes());
+  ASSERT_TRUE(view.IsValid());
+
+  ASSERT_EQ(kIntervalMin, view.GetIntervalMin());
+  ASSERT_EQ(kIntervalMax, view.GetIntervalMax());
+  ASSERT_EQ(kLatency, view.GetLatency());
+  ASSERT_EQ(kTimeout, view.GetTimeout());
+}
+
+// b/260920739
+TEST_F(LeImplRegisteredWithAddressManagerTest, DISABLED_clear_resolving_list) {
+  le_impl_->clear_resolving_list();
+  ASSERT_EQ(3UL, le_impl_->le_address_manager_->NumberCachedCommands());
+
+  sync_handler();  // Allow |LeAddressManager::pause_registered_clients| to complete
+  sync_handler();  // Allow |LeAddressManager::handle_next_command| to complete
+
+  ASSERT_EQ(1UL, hci_layer_->NumberOfQueuedCommands());
+  {
+    auto view = CreateLeSecurityCommandView<LeSetAddressResolutionEnableView>(hci_layer_->DequeueCommandBytes());
+    ASSERT_TRUE(view.IsValid());
+    ASSERT_EQ(Enable::DISABLED, view.GetAddressResolutionEnable());
+    le_impl_->le_address_manager_->OnCommandComplete(
+        ReturnCommandComplete(OpCode::LE_SET_ADDRESS_RESOLUTION_ENABLE, ErrorCode::SUCCESS));
+  }
+
+  sync_handler();  // Allow |LeAddressManager::check_cached_commands| to complete
+  ASSERT_EQ(1UL, hci_layer_->NumberOfQueuedCommands());
+  {
+    auto view = CreateLeSecurityCommandView<LeClearResolvingListView>(hci_layer_->DequeueCommandBytes());
+    ASSERT_TRUE(view.IsValid());
+    le_impl_->le_address_manager_->OnCommandComplete(
+        ReturnCommandComplete(OpCode::LE_CLEAR_RESOLVING_LIST, ErrorCode::SUCCESS));
+  }
+
+  sync_handler();  // Allow |LeAddressManager::handle_next_command| to complete
+  ASSERT_EQ(1UL, hci_layer_->NumberOfQueuedCommands());
+  {
+    auto view = CreateLeSecurityCommandView<LeSetAddressResolutionEnableView>(hci_layer_->DequeueCommandBytes());
+    ASSERT_TRUE(view.IsValid());
+    ASSERT_EQ(Enable::ENABLED, view.GetAddressResolutionEnable());
+    le_impl_->le_address_manager_->OnCommandComplete(
+        ReturnCommandComplete(OpCode::LE_SET_ADDRESS_RESOLUTION_ENABLE, ErrorCode::SUCCESS));
+  }
+  ASSERT_TRUE(hci_layer_->IsPacketQueueEmpty());
+}
+
+TEST_F(LeImplWithConnectionTest, HACK_get_handle) {
+  sync_handler();
+
+  ASSERT_EQ(kHciHandle, le_impl_->HACK_get_handle(remote_address_));
+}
+
+TEST_F(LeImplTest, on_le_connection_canceled_on_pause) {
+  set_random_device_address_policy();
+  le_impl_->pause_connection = true;
+  le_impl_->on_le_connection_canceled_on_pause();
+  ASSERT_TRUE(le_impl_->arm_on_resume_);
+  ASSERT_EQ(ConnectabilityState::DISARMED, le_impl_->connectability_state_);
+}
+
+TEST_F(LeImplTest, on_create_connection_timeout) {
+  EXPECT_CALL(mock_le_connection_callbacks_, OnLeConnectFail(_, ErrorCode::CONNECTION_ACCEPT_TIMEOUT)).Times(1);
+  le_impl_->create_connection_timeout_alarms_.emplace(
+      std::piecewise_construct,
+      std::forward_as_tuple(
+          remote_public_address_with_type_.GetAddress(), remote_public_address_with_type_.GetAddressType()),
+      std::forward_as_tuple(handler_));
+  le_impl_->on_create_connection_timeout(remote_public_address_with_type_);
+  sync_handler();
+  ASSERT_TRUE(le_impl_->create_connection_timeout_alarms_.empty());
+}
+
+// b/260917913
+TEST_F(LeImplTest, DISABLED_on_common_le_connection_complete__NoPriorConnection) {
+  auto log_capture = std::make_unique<LogCapture>();
+  le_impl_->on_common_le_connection_complete(remote_public_address_with_type_);
+  ASSERT_TRUE(le_impl_->connecting_le_.empty());
+  ASSERT_TRUE(log_capture->Rewind()->Find("No prior connection request for"));
+}
+
+TEST_F(LeImplTest, cancel_connect) {
+  le_impl_->create_connection_timeout_alarms_.emplace(
+      std::piecewise_construct,
+      std::forward_as_tuple(
+          remote_public_address_with_type_.GetAddress(), remote_public_address_with_type_.GetAddressType()),
+      std::forward_as_tuple(handler_));
+  le_impl_->cancel_connect(remote_public_address_with_type_);
+  sync_handler();
+  ASSERT_TRUE(le_impl_->create_connection_timeout_alarms_.empty());
+}
+
+TEST_F(LeImplTest, set_le_suggested_default_data_parameters) {
+  le_impl_->set_le_suggested_default_data_parameters(kLength, kTime);
+  sync_handler();
+  auto view =
+      CreateLeConnectionManagementCommandView<LeWriteSuggestedDefaultDataLengthView>(hci_layer_->DequeueCommandBytes());
+  ASSERT_TRUE(view.IsValid());
+  ASSERT_EQ(kLength, view.GetTxOctets());
+  ASSERT_EQ(kTime, view.GetTxTime());
+}
+
 }  // namespace acl_manager
 }  // namespace hci
 }  // namespace bluetooth
diff --git a/system/gd/hci/acl_manager/round_robin_scheduler_test.cc b/system/gd/hci/acl_manager/round_robin_scheduler_test.cc
index 9d43c0f..a8bd3d7 100644
--- a/system/gd/hci/acl_manager/round_robin_scheduler_test.cc
+++ b/system/gd/hci/acl_manager/round_robin_scheduler_test.cc
@@ -35,6 +35,7 @@
 namespace bluetooth {
 namespace hci {
 namespace acl_manager {
+namespace {
 
 class TestController : public Controller {
  public:
@@ -136,8 +137,9 @@
 
     packet_count_--;
     if (packet_count_ == 0) {
-      packet_promise_->set_value();
-      packet_promise_ = nullptr;
+      std::promise<void>* prom = packet_promise_.release();
+      prom->set_value();
+      delete prom;
     }
   }
 
@@ -152,7 +154,7 @@
   }
 
   void SetPacketFuture(uint16_t count) {
-    ASSERT_LOG(packet_promise_ == nullptr, "Promises, Promises, ... Only one at a time.");
+    ASSERT_EQ(packet_promise_, nullptr) << "Promises, Promises, ... Only one at a time.";
     packet_count_ = count;
     packet_promise_ = std::make_unique<std::promise<void>>();
     packet_future_ = std::make_unique<std::future<void>>(packet_promise_->get_future());
@@ -185,7 +187,7 @@
   auto connection_queue = std::make_shared<AclConnection::Queue>(10);
   round_robin_scheduler_->Register(RoundRobinScheduler::ConnectionType::CLASSIC, handle, connection_queue);
 
-  SetPacketFuture(2);
+  ASSERT_NO_FATAL_FAILURE(SetPacketFuture(2));
   AclConnection::QueueUpEnd* queue_up_end = connection_queue->GetUpEnd();
   std::vector<uint8_t> packet1 = {0x01, 0x02, 0x03};
   std::vector<uint8_t> packet2 = {0x04, 0x05, 0x06};
@@ -209,7 +211,7 @@
   round_robin_scheduler_->Register(RoundRobinScheduler::ConnectionType::CLASSIC, handle, connection_queue);
   round_robin_scheduler_->Register(RoundRobinScheduler::ConnectionType::LE, le_handle, le_connection_queue);
 
-  SetPacketFuture(2);
+  ASSERT_NO_FATAL_FAILURE(SetPacketFuture(2));
   AclConnection::QueueUpEnd* queue_up_end = connection_queue->GetUpEnd();
   AclConnection::QueueUpEnd* le_queue_up_end = le_connection_queue->GetUpEnd();
   std::vector<uint8_t> packet = {0x01, 0x02, 0x03};
@@ -232,7 +234,7 @@
   auto connection_queue = std::make_shared<AclConnection::Queue>(15);
   round_robin_scheduler_->Register(RoundRobinScheduler::ConnectionType::CLASSIC, handle, connection_queue);
 
-  SetPacketFuture(10);
+  ASSERT_NO_FATAL_FAILURE(SetPacketFuture(10));
   AclConnection::QueueUpEnd* queue_up_end = connection_queue->GetUpEnd();
   for (uint8_t i = 0; i < 15; i++) {
     std::vector<uint8_t> packet = {0x01, 0x02, 0x03, i};
@@ -246,7 +248,7 @@
   }
   ASSERT_EQ(round_robin_scheduler_->GetCredits(), 0);
 
-  SetPacketFuture(5);
+  ASSERT_NO_FATAL_FAILURE(SetPacketFuture(5));
   controller_->SendCompletedAclPacketsCallback(0x01, 10);
   sync_handler();
   packet_future_->wait();
@@ -276,7 +278,7 @@
   auto le_connection_queue1 = std::make_shared<AclConnection::Queue>(10);
   auto le_connection_queue2 = std::make_shared<AclConnection::Queue>(10);
 
-  SetPacketFuture(18);
+  ASSERT_NO_FATAL_FAILURE(SetPacketFuture(18));
   AclConnection::QueueUpEnd* queue_up_end1 = connection_queue1->GetUpEnd();
   AclConnection::QueueUpEnd* queue_up_end2 = connection_queue2->GetUpEnd();
   AclConnection::QueueUpEnd* le_queue_up_end1 = le_connection_queue1->GetUpEnd();
@@ -333,7 +335,7 @@
   round_robin_scheduler_->Register(RoundRobinScheduler::ConnectionType::CLASSIC, handle, connection_queue);
   round_robin_scheduler_->Register(RoundRobinScheduler::ConnectionType::LE, le_handle, le_connection_queue);
 
-  SetPacketFuture(5);
+  ASSERT_NO_FATAL_FAILURE(SetPacketFuture(5));
   AclConnection::QueueUpEnd* queue_up_end = connection_queue->GetUpEnd();
   AclConnection::QueueUpEnd* le_queue_up_end = le_connection_queue->GetUpEnd();
   std::vector<uint8_t> packet(controller_->hci_mtu_, 0xff);
@@ -379,7 +381,8 @@
   round_robin_scheduler_->Register(RoundRobinScheduler::ConnectionType::CLASSIC, handle, connection_queue);
   round_robin_scheduler_->Register(RoundRobinScheduler::ConnectionType::LE, le_handle, le_connection_queue);
 
-  SetPacketFuture(controller_->le_max_acl_packet_credits_ + controller_->max_acl_packet_credits_);
+  ASSERT_NO_FATAL_FAILURE(
+      SetPacketFuture(controller_->le_max_acl_packet_credits_ + controller_->max_acl_packet_credits_));
   AclConnection::QueueUpEnd* queue_up_end = connection_queue->GetUpEnd();
   AclConnection::QueueUpEnd* le_queue_up_end = le_connection_queue->GetUpEnd();
   std::vector<uint8_t> huge_packet(2000);
@@ -410,6 +413,7 @@
   round_robin_scheduler_->Unregister(le_handle);
 }
 
+}  // namespace
 }  // namespace acl_manager
 }  // namespace hci
 }  // namespace bluetooth
diff --git a/system/gd/hci/acl_manager_test.cc b/system/gd/hci/acl_manager_test.cc
index 73e3228..e4cdcae 100644
--- a/system/gd/hci/acl_manager_test.cc
+++ b/system/gd/hci/acl_manager_test.cc
@@ -16,19 +16,20 @@
 
 #include "hci/acl_manager.h"
 
+#include <gmock/gmock.h>
+#include <gtest/gtest.h>
+
 #include <algorithm>
 #include <chrono>
 #include <future>
 #include <map>
 
-#include <gmock/gmock.h>
-#include <gtest/gtest.h>
-
 #include "common/bind.h"
 #include "hci/address.h"
 #include "hci/class_of_device.h"
 #include "hci/controller.h"
 #include "hci/hci_layer.h"
+#include "hci/hci_layer_fake.h"
 #include "os/thread.h"
 #include "packet/raw_builder.h"
 
@@ -43,37 +44,14 @@
 using packet::PacketView;
 using packet::RawBuilder;
 
-constexpr std::chrono::seconds kTimeout = std::chrono::seconds(2);
+constexpr auto kTimeout = std::chrono::seconds(2);
+constexpr auto kShortTimeout = std::chrono::milliseconds(100);
 constexpr uint16_t kScanIntervalFast = 0x0060;
 constexpr uint16_t kScanWindowFast = 0x0030;
 constexpr uint16_t kScanIntervalSlow = 0x0800;
 constexpr uint16_t kScanWindowSlow = 0x0030;
 const AddressWithType empty_address_with_type = hci::AddressWithType();
 
-PacketView<kLittleEndian> GetPacketView(std::unique_ptr<packet::BasePacketBuilder> packet) {
-  auto bytes = std::make_shared<std::vector<uint8_t>>();
-  BitInserter i(*bytes);
-  bytes->reserve(packet->size());
-  packet->Serialize(i);
-  return packet::PacketView<packet::kLittleEndian>(bytes);
-}
-
-std::unique_ptr<BasePacketBuilder> NextPayload(uint16_t handle) {
-  static uint32_t packet_number = 1;
-  auto payload = std::make_unique<RawBuilder>();
-  payload->AddOctets2(6);  // L2CAP PDU size
-  payload->AddOctets2(2);  // L2CAP CID
-  payload->AddOctets2(handle);
-  payload->AddOctets4(packet_number++);
-  return std::move(payload);
-}
-
-std::unique_ptr<AclBuilder> NextAclPacket(uint16_t handle) {
-  PacketBoundaryFlag packet_boundary_flag = PacketBoundaryFlag::FIRST_AUTOMATICALLY_FLUSHABLE;
-  BroadcastFlag broadcast_flag = BroadcastFlag::POINT_TO_POINT;
-  return AclBuilder::Create(handle, packet_boundary_flag, broadcast_flag, NextPayload(handle));
-}
-
 class TestController : public Controller {
  public:
   void RegisterCompletedAclPacketsCallback(
@@ -118,200 +96,6 @@
   void ListDependencies(ModuleList* list) const {}
 };
 
-class TestHciLayer : public HciLayer {
- public:
-  void EnqueueCommand(
-      std::unique_ptr<CommandBuilder> command,
-      common::ContextualOnceCallback<void(CommandStatusView)> on_status) override {
-    command_queue_.push(std::move(command));
-    command_status_callbacks.push_back(std::move(on_status));
-    if (command_promise_ != nullptr) {
-      command_promise_->set_value();
-      command_promise_.reset();
-    }
-  }
-
-  void EnqueueCommand(
-      std::unique_ptr<CommandBuilder> command,
-      common::ContextualOnceCallback<void(CommandCompleteView)> on_complete) override {
-    command_queue_.push(std::move(command));
-    command_complete_callbacks.push_back(std::move(on_complete));
-    if (command_promise_ != nullptr) {
-      command_promise_->set_value();
-      command_promise_.reset();
-    }
-  }
-
-  void SetCommandFuture() {
-    ASSERT_LOG(command_promise_ == nullptr, "Promises, Promises, ... Only one at a time.");
-    command_promise_ = std::make_unique<std::promise<void>>();
-    command_future_ = std::make_unique<std::future<void>>(command_promise_->get_future());
-  }
-
-  CommandView GetLastCommand() {
-    if (command_queue_.size() == 0) {
-      return CommandView::Create(PacketView<kLittleEndian>(std::make_shared<std::vector<uint8_t>>()));
-    }
-    auto last = std::move(command_queue_.front());
-    command_queue_.pop();
-    return CommandView::Create(GetPacketView(std::move(last)));
-  }
-
-  ConnectionManagementCommandView GetCommand(OpCode op_code) {
-    if (command_future_ != nullptr) {
-      auto result = command_future_->wait_for(std::chrono::milliseconds(1000));
-      EXPECT_NE(std::future_status::timeout, result);
-    }
-    if (command_queue_.empty()) {
-      return ConnectionManagementCommandView::Create(AclCommandView::Create(
-          CommandView::Create(PacketView<kLittleEndian>(std::make_shared<std::vector<uint8_t>>()))));
-    }
-    CommandView command_packet_view = GetLastCommand();
-    ConnectionManagementCommandView command =
-        ConnectionManagementCommandView::Create(AclCommandView::Create(command_packet_view));
-    EXPECT_TRUE(command.IsValid());
-    EXPECT_EQ(command.GetOpCode(), op_code);
-
-    return command;
-  }
-
-  ConnectionManagementCommandView GetLastCommand(OpCode op_code) {
-    if (!command_queue_.empty() && command_future_ != nullptr) {
-      command_future_.reset();
-      command_promise_.reset();
-    } else if (command_future_ != nullptr) {
-      auto result = command_future_->wait_for(std::chrono::milliseconds(1000));
-      EXPECT_NE(std::future_status::timeout, result);
-    }
-    if (command_queue_.empty()) {
-      return ConnectionManagementCommandView::Create(AclCommandView::Create(
-          CommandView::Create(PacketView<kLittleEndian>(std::make_shared<std::vector<uint8_t>>()))));
-    }
-    CommandView command_packet_view = GetLastCommand();
-    ConnectionManagementCommandView command =
-        ConnectionManagementCommandView::Create(AclCommandView::Create(command_packet_view));
-    EXPECT_TRUE(command.IsValid());
-    EXPECT_EQ(command.GetOpCode(), op_code);
-
-    return command;
-  }
-
-  void RegisterEventHandler(EventCode event_code, common::ContextualCallback<void(EventView)> event_handler) override {
-    registered_events_[event_code] = event_handler;
-  }
-
-  void UnregisterEventHandler(EventCode event_code) override {
-    registered_events_.erase(event_code);
-  }
-
-  void RegisterLeEventHandler(SubeventCode subevent_code,
-                              common::ContextualCallback<void(LeMetaEventView)> event_handler) override {
-    registered_le_events_[subevent_code] = event_handler;
-  }
-
-  void UnregisterLeEventHandler(SubeventCode subevent_code) override {
-    registered_le_events_.erase(subevent_code);
-  }
-
-  void IncomingEvent(std::unique_ptr<EventBuilder> event_builder) {
-    auto packet = GetPacketView(std::move(event_builder));
-    EventView event = EventView::Create(packet);
-    ASSERT_TRUE(event.IsValid());
-    EventCode event_code = event.GetEventCode();
-    ASSERT_NE(registered_events_.find(event_code), registered_events_.end()) << EventCodeText(event_code);
-    registered_events_[event_code].Invoke(event);
-  }
-
-  void IncomingLeMetaEvent(std::unique_ptr<LeMetaEventBuilder> event_builder) {
-    auto packet = GetPacketView(std::move(event_builder));
-    EventView event = EventView::Create(packet);
-    LeMetaEventView meta_event_view = LeMetaEventView::Create(event);
-    EXPECT_TRUE(meta_event_view.IsValid());
-    SubeventCode subevent_code = meta_event_view.GetSubeventCode();
-    EXPECT_TRUE(registered_le_events_.find(subevent_code) != registered_le_events_.end());
-    registered_le_events_[subevent_code].Invoke(meta_event_view);
-  }
-
-  void IncomingAclData(uint16_t handle) {
-    os::Handler* hci_handler = GetHandler();
-    auto* queue_end = acl_queue_.GetDownEnd();
-    std::promise<void> promise;
-    auto future = promise.get_future();
-    queue_end->RegisterEnqueue(hci_handler,
-                               common::Bind(
-                                   [](decltype(queue_end) queue_end, uint16_t handle, std::promise<void> promise) {
-                                     auto packet = GetPacketView(NextAclPacket(handle));
-                                     AclView acl2 = AclView::Create(packet);
-                                     queue_end->UnregisterEnqueue();
-                                     promise.set_value();
-                                     return std::make_unique<AclView>(acl2);
-                                   },
-                                   queue_end, handle, common::Passed(std::move(promise))));
-    auto status = future.wait_for(kTimeout);
-    ASSERT_EQ(status, std::future_status::ready);
-  }
-
-  void AssertNoOutgoingAclData() {
-    auto queue_end = acl_queue_.GetDownEnd();
-    EXPECT_EQ(queue_end->TryDequeue(), nullptr);
-  }
-
-  void CommandCompleteCallback(EventView event) {
-    CommandCompleteView complete_view = CommandCompleteView::Create(event);
-    ASSERT_TRUE(complete_view.IsValid());
-    std::move(command_complete_callbacks.front()).Invoke(complete_view);
-    command_complete_callbacks.pop_front();
-  }
-
-  void CommandStatusCallback(EventView event) {
-    CommandStatusView status_view = CommandStatusView::Create(event);
-    ASSERT_TRUE(status_view.IsValid());
-    std::move(command_status_callbacks.front()).Invoke(status_view);
-    command_status_callbacks.pop_front();
-  }
-
-  PacketView<kLittleEndian> OutgoingAclData() {
-    auto queue_end = acl_queue_.GetDownEnd();
-    std::unique_ptr<AclBuilder> received;
-    do {
-      received = queue_end->TryDequeue();
-    } while (received == nullptr);
-
-    return GetPacketView(std::move(received));
-  }
-
-  BidiQueueEnd<AclBuilder, AclView>* GetAclQueueEnd() override {
-    return acl_queue_.GetUpEnd();
-  }
-
-  void ListDependencies(ModuleList* list) const {}
-  void Start() override {
-    RegisterEventHandler(EventCode::COMMAND_COMPLETE,
-                         GetHandler()->BindOn(this, &TestHciLayer::CommandCompleteCallback));
-    RegisterEventHandler(EventCode::COMMAND_STATUS, GetHandler()->BindOn(this, &TestHciLayer::CommandStatusCallback));
-  }
-  void Stop() override {}
-
-  void Disconnect(uint16_t handle, ErrorCode reason) override {
-    GetHandler()->Post(common::BindOnce(&TestHciLayer::do_disconnect, common::Unretained(this), handle, reason));
-  }
-
- private:
-  std::map<EventCode, common::ContextualCallback<void(EventView)>> registered_events_;
-  std::map<SubeventCode, common::ContextualCallback<void(LeMetaEventView)>> registered_le_events_;
-  std::list<common::ContextualOnceCallback<void(CommandCompleteView)>> command_complete_callbacks;
-  std::list<common::ContextualOnceCallback<void(CommandStatusView)>> command_status_callbacks;
-  BidiQueue<AclView, AclBuilder> acl_queue_{3 /* TODO: Set queue depth */};
-
-  std::queue<std::unique_ptr<CommandBuilder>> command_queue_;
-  std::unique_ptr<std::promise<void>> command_promise_;
-  std::unique_ptr<std::future<void>> command_future_;
-
-  void do_disconnect(uint16_t handle, ErrorCode reason) {
-    HciLayer::Disconnect(handle, reason);
-  }
-};
-
 class AclManagerNoCallbacksTest : public ::testing::Test {
  protected:
   void SetUp() override {
@@ -321,7 +105,6 @@
     fake_registry_.InjectTestModule(&Controller::Factory, test_controller_);
     client_handler_ = fake_registry_.GetTestModuleHandler(&HciLayer::Factory);
     ASSERT_NE(client_handler_, nullptr);
-    test_hci_layer_->SetCommandFuture();
     fake_registry_.Start<AclManager>(&thread_);
     acl_manager_ = static_cast<AclManager*>(fake_registry_.GetModuleUnderTest(&AclManager::Factory));
     Address::FromString("A1:A2:A3:A4:A5:A6", remote);
@@ -337,21 +120,29 @@
         minimum_rotation_time,
         maximum_rotation_time);
 
-    auto set_random_address_packet = LeSetRandomAddressView::Create(
-        LeAdvertisingCommandView::Create(test_hci_layer_->GetCommand(OpCode::LE_SET_RANDOM_ADDRESS)));
+    auto set_random_address_packet =
+        LeSetRandomAddressView::Create(LeAdvertisingCommandView::Create(
+            GetConnectionManagementCommand(OpCode::LE_SET_RANDOM_ADDRESS)));
     ASSERT_TRUE(set_random_address_packet.IsValid());
-    my_initiating_address =
-        AddressWithType(set_random_address_packet.GetRandomAddress(), AddressType::RANDOM_DEVICE_ADDRESS);
-    // Verify LE Set Random Address was sent during setup
-    test_hci_layer_->GetLastCommand(OpCode::LE_SET_RANDOM_ADDRESS);
+    my_initiating_address = AddressWithType(
+        set_random_address_packet.GetRandomAddress(), AddressType::RANDOM_DEVICE_ADDRESS);
     test_hci_layer_->IncomingEvent(LeSetRandomAddressCompleteBuilder::Create(0x01, ErrorCode::SUCCESS));
   }
 
   void TearDown() override {
+    // Invalid mutex exception is raised if the connections
+    // are cleared after the AclConnectionInterface is deleted
+    // through fake_registry_.
+    mock_connection_callback_.Clear();
+    mock_le_connection_callbacks_.Clear();
     fake_registry_.SynchronizeModuleHandler(&AclManager::Factory, std::chrono::milliseconds(20));
     fake_registry_.StopAll();
   }
 
+  void sync_client_handler() {
+    ASSERT(thread_.GetReactor()->WaitForIdle(std::chrono::seconds(2)));
+  }
+
   TestModuleRegistry fake_registry_;
   TestHciLayer* test_hci_layer_ = nullptr;
   TestController* test_controller_ = nullptr;
@@ -398,6 +189,15 @@
     ASSERT_EQ(status, std::future_status::ready);
   }
 
+  ConnectionManagementCommandView GetConnectionManagementCommand(OpCode op_code) {
+    auto base_command = test_hci_layer_->GetCommand();
+    ConnectionManagementCommandView command =
+        ConnectionManagementCommandView::Create(AclCommandView::Create(base_command));
+    EXPECT_TRUE(command.IsValid());
+    EXPECT_EQ(command.GetOpCode(), op_code);
+    return command;
+  }
+
   class MockConnectionCallback : public ConnectionCallbacks {
    public:
     void OnConnectSuccess(std::unique_ptr<ClassicAclConnection> connection) override {
@@ -408,6 +208,11 @@
         connection_promise_.reset();
       }
     }
+
+    void Clear() {
+      connections_.clear();
+    }
+
     MOCK_METHOD(void, OnConnectFail, (Address, ErrorCode reason), (override));
 
     MOCK_METHOD(void, HACK_OnEscoConnectRequest, (Address, ClassOfDevice), (override));
@@ -426,6 +231,11 @@
         le_connection_promise_.reset();
       }
     }
+
+    void Clear() {
+      le_connections_.clear();
+    }
+
     MOCK_METHOD(void, OnLeConnectFail, (AddressWithType, ErrorCode reason), (override));
 
     std::list<std::shared_ptr<LeAclConnection>> le_connections_;
@@ -451,9 +261,9 @@
     acl_manager_->CreateConnection(remote);
 
     // Wait for the connection request
-    auto last_command = test_hci_layer_->GetCommand(OpCode::CREATE_CONNECTION);
+    auto last_command = GetConnectionManagementCommand(OpCode::CREATE_CONNECTION);
     while (!last_command.IsValid()) {
-      last_command = test_hci_layer_->GetCommand(OpCode::CREATE_CONNECTION);
+      last_command = GetConnectionManagementCommand(OpCode::CREATE_CONNECTION);
     }
 
     EXPECT_CALL(mock_connection_management_callbacks_, OnRoleChange(hci::ErrorCode::SUCCESS, Role::CENTRAL));
@@ -470,19 +280,17 @@
   }
 
   void TearDown() override {
+    // Invalid mutex exception is raised if the connection
+    // is cleared after the AclConnectionInterface is deleted
+    // through fake_registry_.
+    mock_connection_callback_.Clear();
+    mock_le_connection_callbacks_.Clear();
+    connection_.reset();
     fake_registry_.SynchronizeModuleHandler(&HciLayer::Factory, std::chrono::milliseconds(20));
     fake_registry_.SynchronizeModuleHandler(&AclManager::Factory, std::chrono::milliseconds(20));
     fake_registry_.StopAll();
   }
 
-  void sync_client_handler() {
-    std::promise<void> promise;
-    auto future = promise.get_future();
-    client_handler_->Post(common::BindOnce(&std::promise<void>::set_value, common::Unretained(&promise)));
-    auto future_status = future.wait_for(std::chrono::seconds(1));
-    EXPECT_EQ(future_status, std::future_status::ready);
-  }
-
   uint16_t handle_;
   std::shared_ptr<ClassicAclConnection> connection_;
 
@@ -532,30 +340,15 @@
 
 TEST_F(AclManagerTest, startup_teardown) {}
 
-TEST_F(AclManagerNoCallbacksTest, acl_connection_before_registered_callbacks) {
-  ClassOfDevice class_of_device;
-
-  test_hci_layer_->IncomingEvent(
-      ConnectionRequestBuilder::Create(remote, class_of_device, ConnectionRequestLinkType::ACL));
-  fake_registry_.SynchronizeModuleHandler(&HciLayer::Factory, std::chrono::milliseconds(20));
-  fake_registry_.SynchronizeModuleHandler(&AclManager::Factory, std::chrono::milliseconds(20));
-  fake_registry_.SynchronizeModuleHandler(&HciLayer::Factory, std::chrono::milliseconds(20));
-  CommandView command = CommandView::Create(test_hci_layer_->GetLastCommand());
-  EXPECT_TRUE(command.IsValid());
-  OpCode op_code = command.GetOpCode();
-  EXPECT_EQ(op_code, OpCode::REJECT_CONNECTION_REQUEST);
-}
-
 TEST_F(AclManagerTest, invoke_registered_callback_connection_complete_success) {
   uint16_t handle = 1;
 
-  test_hci_layer_->SetCommandFuture();
   acl_manager_->CreateConnection(remote);
 
   // Wait for the connection request
-  auto last_command = test_hci_layer_->GetCommand(OpCode::CREATE_CONNECTION);
+  auto last_command = GetConnectionManagementCommand(OpCode::CREATE_CONNECTION);
   while (!last_command.IsValid()) {
-    last_command = test_hci_layer_->GetCommand(OpCode::CREATE_CONNECTION);
+    last_command = GetConnectionManagementCommand(OpCode::CREATE_CONNECTION);
   }
 
   auto first_connection = GetConnectionFuture();
@@ -573,13 +366,12 @@
 TEST_F(AclManagerTest, invoke_registered_callback_connection_complete_fail) {
   uint16_t handle = 0x123;
 
-  test_hci_layer_->SetCommandFuture();
   acl_manager_->CreateConnection(remote);
 
   // Wait for the connection request
-  auto last_command = test_hci_layer_->GetCommand(OpCode::CREATE_CONNECTION);
+  auto last_command = GetConnectionManagementCommand(OpCode::CREATE_CONNECTION);
   while (!last_command.IsValid()) {
-    last_command = test_hci_layer_->GetCommand(OpCode::CREATE_CONNECTION);
+    last_command = GetConnectionManagementCommand(OpCode::CREATE_CONNECTION);
   }
 
   EXPECT_CALL(mock_connection_callback_, OnConnectFail(remote, ErrorCode::PAGE_TIMEOUT));
@@ -596,12 +388,10 @@
     AclManagerTest::SetUp();
 
     remote_with_type_ = AddressWithType(remote, AddressType::PUBLIC_DEVICE_ADDRESS);
-    test_hci_layer_->SetCommandFuture();
     acl_manager_->CreateLeConnection(remote_with_type_, true);
-    test_hci_layer_->GetCommand(OpCode::LE_ADD_DEVICE_TO_FILTER_ACCEPT_LIST);
+    GetConnectionManagementCommand(OpCode::LE_ADD_DEVICE_TO_FILTER_ACCEPT_LIST);
     test_hci_layer_->IncomingEvent(LeAddDeviceToFilterAcceptListCompleteBuilder::Create(0x01, ErrorCode::SUCCESS));
-    test_hci_layer_->SetCommandFuture();
-    auto packet = test_hci_layer_->GetCommand(OpCode::LE_CREATE_CONNECTION);
+    auto packet = GetConnectionManagementCommand(OpCode::LE_CREATE_CONNECTION);
     auto le_connection_management_command_view =
         LeConnectionManagementCommandView::Create(AclCommandView::Create(packet));
     auto command_view = LeCreateConnectionView::Create(le_connection_management_command_view);
@@ -621,7 +411,7 @@
     test_hci_layer_->IncomingLeMetaEvent(LeConnectionCompleteBuilder::Create(
         ErrorCode::SUCCESS,
         handle_,
-        Role::PERIPHERAL,
+        Role::CENTRAL,
         AddressType::PUBLIC_DEVICE_ADDRESS,
         remote,
         0x0100,
@@ -629,8 +419,7 @@
         0x0C80,
         ClockAccuracy::PPM_30));
 
-    test_hci_layer_->SetCommandFuture();
-    test_hci_layer_->GetCommand(OpCode::LE_REMOVE_DEVICE_FROM_FILTER_ACCEPT_LIST);
+    GetConnectionManagementCommand(OpCode::LE_REMOVE_DEVICE_FROM_FILTER_ACCEPT_LIST);
     test_hci_layer_->IncomingEvent(LeRemoveDeviceFromFilterAcceptListCompleteBuilder::Create(0x01, ErrorCode::SUCCESS));
 
     auto first_connection_status = first_connection.wait_for(kTimeout);
@@ -640,19 +429,17 @@
   }
 
   void TearDown() override {
+    // Invalid mutex exception is raised if the connection
+    // is cleared after the AclConnectionInterface is deleted
+    // through fake_registry_.
+    mock_connection_callback_.Clear();
+    mock_le_connection_callbacks_.Clear();
+    connection_.reset();
     fake_registry_.SynchronizeModuleHandler(&HciLayer::Factory, std::chrono::milliseconds(20));
     fake_registry_.SynchronizeModuleHandler(&AclManager::Factory, std::chrono::milliseconds(20));
     fake_registry_.StopAll();
   }
 
-  void sync_client_handler() {
-    std::promise<void> promise;
-    auto future = promise.get_future();
-    client_handler_->Post(common::BindOnce(&std::promise<void>::set_value, common::Unretained(&promise)));
-    auto future_status = future.wait_for(std::chrono::seconds(1));
-    EXPECT_EQ(future_status, std::future_status::ready);
-  }
-
   uint16_t handle_ = 0x123;
   std::shared_ptr<LeAclConnection> connection_;
   AddressWithType remote_with_type_;
@@ -686,12 +473,10 @@
 
 TEST_F(AclManagerTest, invoke_registered_callback_le_connection_complete_fail) {
   AddressWithType remote_with_type(remote, AddressType::PUBLIC_DEVICE_ADDRESS);
-  test_hci_layer_->SetCommandFuture();
   acl_manager_->CreateLeConnection(remote_with_type, true);
-  test_hci_layer_->GetLastCommand(OpCode::LE_ADD_DEVICE_TO_FILTER_ACCEPT_LIST);
+  GetConnectionManagementCommand(OpCode::LE_ADD_DEVICE_TO_FILTER_ACCEPT_LIST);
   test_hci_layer_->IncomingEvent(LeAddDeviceToFilterAcceptListCompleteBuilder::Create(0x01, ErrorCode::SUCCESS));
-  test_hci_layer_->SetCommandFuture();
-  auto packet = test_hci_layer_->GetLastCommand(OpCode::LE_CREATE_CONNECTION);
+  auto packet = GetConnectionManagementCommand(OpCode::LE_CREATE_CONNECTION);
   auto le_connection_management_command_view =
       LeConnectionManagementCommandView::Create(AclCommandView::Create(packet));
   auto command_view = LeCreateConnectionView::Create(le_connection_management_command_view);
@@ -707,10 +492,11 @@
 
   EXPECT_CALL(mock_le_connection_callbacks_,
               OnLeConnectFail(remote_with_type, ErrorCode::CONNECTION_REJECTED_LIMITED_RESOURCES));
+
   test_hci_layer_->IncomingLeMetaEvent(LeConnectionCompleteBuilder::Create(
       ErrorCode::CONNECTION_REJECTED_LIMITED_RESOURCES,
       0x123,
-      Role::PERIPHERAL,
+      Role::CENTRAL,
       AddressType::PUBLIC_DEVICE_ADDRESS,
       remote,
       0x0100,
@@ -718,8 +504,7 @@
       0x0011,
       ClockAccuracy::PPM_30));
 
-  test_hci_layer_->SetCommandFuture();
-  packet = test_hci_layer_->GetLastCommand(OpCode::LE_REMOVE_DEVICE_FROM_FILTER_ACCEPT_LIST);
+  packet = GetConnectionManagementCommand(OpCode::LE_REMOVE_DEVICE_FROM_FILTER_ACCEPT_LIST);
   le_connection_management_command_view = LeConnectionManagementCommandView::Create(AclCommandView::Create(packet));
   auto remove_command_view = LeRemoveDeviceFromFilterAcceptListView::Create(le_connection_management_command_view);
   ASSERT_TRUE(remove_command_view.IsValid());
@@ -728,16 +513,14 @@
 
 TEST_F(AclManagerTest, cancel_le_connection) {
   AddressWithType remote_with_type(remote, AddressType::PUBLIC_DEVICE_ADDRESS);
-  test_hci_layer_->SetCommandFuture();
   acl_manager_->CreateLeConnection(remote_with_type, true);
-  test_hci_layer_->GetLastCommand(OpCode::LE_ADD_DEVICE_TO_FILTER_ACCEPT_LIST);
+  GetConnectionManagementCommand(OpCode::LE_ADD_DEVICE_TO_FILTER_ACCEPT_LIST);
   test_hci_layer_->IncomingEvent(LeAddDeviceToFilterAcceptListCompleteBuilder::Create(0x01, ErrorCode::SUCCESS));
-  test_hci_layer_->SetCommandFuture();
-  test_hci_layer_->GetLastCommand(OpCode::LE_CREATE_CONNECTION);
+  GetConnectionManagementCommand(OpCode::LE_CREATE_CONNECTION);
+  test_hci_layer_->IncomingEvent(LeCreateConnectionStatusBuilder::Create(ErrorCode::SUCCESS, 0x01));
 
-  test_hci_layer_->SetCommandFuture();
   acl_manager_->CancelLeConnect(remote_with_type);
-  auto packet = test_hci_layer_->GetLastCommand(OpCode::LE_CREATE_CONNECTION_CANCEL);
+  auto packet = GetConnectionManagementCommand(OpCode::LE_CREATE_CONNECTION_CANCEL);
   auto le_connection_management_command_view =
       LeConnectionManagementCommandView::Create(AclCommandView::Create(packet));
   auto command_view = LeCreateConnectionCancelView::Create(le_connection_management_command_view);
@@ -747,7 +530,7 @@
   test_hci_layer_->IncomingLeMetaEvent(LeConnectionCompleteBuilder::Create(
       ErrorCode::UNKNOWN_CONNECTION,
       0x123,
-      Role::PERIPHERAL,
+      Role::CENTRAL,
       AddressType::PUBLIC_DEVICE_ADDRESS,
       remote,
       0x0100,
@@ -755,8 +538,7 @@
       0x0011,
       ClockAccuracy::PPM_30));
 
-  test_hci_layer_->SetCommandFuture();
-  packet = test_hci_layer_->GetLastCommand(OpCode::LE_REMOVE_DEVICE_FROM_FILTER_ACCEPT_LIST);
+  packet = GetConnectionManagementCommand(OpCode::LE_REMOVE_DEVICE_FROM_FILTER_ACCEPT_LIST);
   le_connection_management_command_view = LeConnectionManagementCommandView::Create(AclCommandView::Create(packet));
   auto remove_command_view = LeRemoveDeviceFromFilterAcceptListView::Create(le_connection_management_command_view);
   ASSERT_TRUE(remove_command_view.IsValid());
@@ -766,31 +548,32 @@
 
 TEST_F(AclManagerTest, create_connection_with_fast_mode) {
   AddressWithType remote_with_type(remote, AddressType::PUBLIC_DEVICE_ADDRESS);
-  test_hci_layer_->SetCommandFuture();
   acl_manager_->CreateLeConnection(remote_with_type, true);
-  test_hci_layer_->GetLastCommand(OpCode::LE_ADD_DEVICE_TO_FILTER_ACCEPT_LIST);
-  test_hci_layer_->IncomingEvent(LeAddDeviceToFilterAcceptListCompleteBuilder::Create(0x01, ErrorCode::SUCCESS));
-  test_hci_layer_->SetCommandFuture();
-  auto packet = test_hci_layer_->GetLastCommand(OpCode::LE_CREATE_CONNECTION);
+  GetConnectionManagementCommand(OpCode::LE_ADD_DEVICE_TO_FILTER_ACCEPT_LIST);
+  test_hci_layer_->IncomingEvent(
+      LeAddDeviceToFilterAcceptListCompleteBuilder::Create(0x01, ErrorCode::SUCCESS));
+
+  auto packet = GetConnectionManagementCommand(OpCode::LE_CREATE_CONNECTION);
   auto command_view =
       LeCreateConnectionView::Create(LeConnectionManagementCommandView::Create(AclCommandView::Create(packet)));
   ASSERT_TRUE(command_view.IsValid());
   ASSERT_EQ(command_view.GetLeScanInterval(), kScanIntervalFast);
   ASSERT_EQ(command_view.GetLeScanWindow(), kScanWindowFast);
   test_hci_layer_->IncomingEvent(LeCreateConnectionStatusBuilder::Create(ErrorCode::SUCCESS, 0x01));
+
   auto first_connection = GetLeConnectionFuture();
   test_hci_layer_->IncomingLeMetaEvent(LeConnectionCompleteBuilder::Create(
       ErrorCode::SUCCESS,
       0x00,
-      Role::PERIPHERAL,
+      Role::CENTRAL,
       AddressType::PUBLIC_DEVICE_ADDRESS,
       remote,
       0x0100,
       0x0010,
       0x0C80,
       ClockAccuracy::PPM_30));
-  test_hci_layer_->SetCommandFuture();
-  test_hci_layer_->GetCommand(OpCode::LE_REMOVE_DEVICE_FROM_FILTER_ACCEPT_LIST);
+
+  GetConnectionManagementCommand(OpCode::LE_REMOVE_DEVICE_FROM_FILTER_ACCEPT_LIST);
   test_hci_layer_->IncomingEvent(LeRemoveDeviceFromFilterAcceptListCompleteBuilder::Create(0x01, ErrorCode::SUCCESS));
   auto first_connection_status = first_connection.wait_for(kTimeout);
   ASSERT_EQ(first_connection_status, std::future_status::ready);
@@ -798,12 +581,10 @@
 
 TEST_F(AclManagerTest, create_connection_with_slow_mode) {
   AddressWithType remote_with_type(remote, AddressType::PUBLIC_DEVICE_ADDRESS);
-  test_hci_layer_->SetCommandFuture();
   acl_manager_->CreateLeConnection(remote_with_type, false);
-  test_hci_layer_->GetLastCommand(OpCode::LE_ADD_DEVICE_TO_FILTER_ACCEPT_LIST);
+  GetConnectionManagementCommand(OpCode::LE_ADD_DEVICE_TO_FILTER_ACCEPT_LIST);
   test_hci_layer_->IncomingEvent(LeAddDeviceToFilterAcceptListCompleteBuilder::Create(0x01, ErrorCode::SUCCESS));
-  test_hci_layer_->SetCommandFuture();
-  auto packet = test_hci_layer_->GetLastCommand(OpCode::LE_CREATE_CONNECTION);
+  auto packet = GetConnectionManagementCommand(OpCode::LE_CREATE_CONNECTION);
   auto command_view =
       LeCreateConnectionView::Create(LeConnectionManagementCommandView::Create(AclCommandView::Create(packet)));
   ASSERT_TRUE(command_view.IsValid());
@@ -814,15 +595,14 @@
   test_hci_layer_->IncomingLeMetaEvent(LeConnectionCompleteBuilder::Create(
       ErrorCode::SUCCESS,
       0x00,
-      Role::PERIPHERAL,
+      Role::CENTRAL,
       AddressType::PUBLIC_DEVICE_ADDRESS,
       remote,
       0x0100,
       0x0010,
       0x0C80,
       ClockAccuracy::PPM_30));
-  test_hci_layer_->SetCommandFuture();
-  test_hci_layer_->GetCommand(OpCode::LE_REMOVE_DEVICE_FROM_FILTER_ACCEPT_LIST);
+  GetConnectionManagementCommand(OpCode::LE_REMOVE_DEVICE_FROM_FILTER_ACCEPT_LIST);
   test_hci_layer_->IncomingEvent(LeRemoveDeviceFromFilterAcceptListCompleteBuilder::Create(0x01, ErrorCode::SUCCESS));
   auto first_connection_status = first_connection.wait_for(kTimeout);
   ASSERT_EQ(first_connection_status, std::future_status::ready);
@@ -867,19 +647,25 @@
   uint16_t connection_interval = (connection_interval_max + connection_interval_min) / 2;
   uint16_t connection_latency = 0x0001;
   uint16_t supervision_timeout = 0x0A00;
-  test_hci_layer_->SetCommandFuture();
-  connection_->LeConnectionUpdate(connection_interval_min, connection_interval_max, connection_latency,
-                                  supervision_timeout, 0x10, 0x20);
-  auto update_packet = test_hci_layer_->GetCommand(OpCode::LE_CONNECTION_UPDATE);
+  connection_->LeConnectionUpdate(
+      connection_interval_min,
+      connection_interval_max,
+      connection_latency,
+      supervision_timeout,
+      0x10,
+      0x20);
+  auto update_packet = GetConnectionManagementCommand(OpCode::LE_CONNECTION_UPDATE);
   auto update_view =
       LeConnectionUpdateView::Create(LeConnectionManagementCommandView::Create(AclCommandView::Create(update_packet)));
   ASSERT_TRUE(update_view.IsValid());
   EXPECT_EQ(update_view.GetConnectionHandle(), handle_);
+  test_hci_layer_->IncomingEvent(LeConnectionUpdateStatusBuilder::Create(ErrorCode::SUCCESS, 0x1));
   EXPECT_CALL(
       mock_le_connection_management_callbacks_,
       OnConnectionUpdate(hci_status, connection_interval, connection_latency, supervision_timeout));
   test_hci_layer_->IncomingLeMetaEvent(LeConnectionUpdateCompleteBuilder::Create(
       ErrorCode::SUCCESS, handle_, connection_interval, connection_latency, supervision_timeout));
+  sync_client_handler();
 }
 
 TEST_F(AclManagerWithLeConnectionTest, invoke_registered_callback_le_disconnect) {
@@ -890,9 +676,10 @@
   auto reason = ErrorCode::REMOTE_USER_TERMINATED_CONNECTION;
   EXPECT_CALL(mock_le_connection_management_callbacks_, OnDisconnection(reason));
   test_hci_layer_->Disconnect(handle_, reason);
+  sync_client_handler();
 }
 
-TEST_F(AclManagerWithLeConnectionTest, DISABLED_invoke_registered_callback_le_disconnect_data_race) {
+TEST_F(AclManagerWithLeConnectionTest, invoke_registered_callback_le_disconnect_data_race) {
   ASSERT_EQ(connection_->GetRemoteAddress(), remote_with_type_);
   ASSERT_EQ(connection_->GetHandle(), handle_);
   connection_->RegisterCallbacks(&mock_le_connection_management_callbacks_, client_handler_);
@@ -901,6 +688,7 @@
   auto reason = ErrorCode::REMOTE_USER_TERMINATED_CONNECTION;
   EXPECT_CALL(mock_le_connection_management_callbacks_, OnDisconnection(reason));
   test_hci_layer_->Disconnect(handle_, reason);
+  sync_client_handler();
 }
 
 TEST_F(AclManagerWithLeConnectionTest, invoke_registered_callback_le_queue_disconnect) {
@@ -918,6 +706,7 @@
   auto reason = ErrorCode::REMOTE_USER_TERMINATED_CONNECTION;
   EXPECT_CALL(mock_connection_management_callbacks_, OnDisconnection(reason));
   test_hci_layer_->Disconnect(handle_, reason);
+  sync_client_handler();
 }
 
 TEST_F(AclManagerWithConnectionTest, acl_send_data_one_connection) {
@@ -941,15 +730,15 @@
   SendAclData(handle_, connection_->GetAclQueueEnd());
 
   sent_packet = test_hci_layer_->OutgoingAclData();
-  test_hci_layer_->SetCommandFuture();
   auto reason = ErrorCode::AUTHENTICATION_FAILURE;
   EXPECT_CALL(mock_connection_management_callbacks_, OnDisconnection(reason));
   connection_->Disconnect(DisconnectReason::AUTHENTICATION_FAILURE);
-  auto packet = test_hci_layer_->GetCommand(OpCode::DISCONNECT);
+  auto packet = GetConnectionManagementCommand(OpCode::DISCONNECT);
   auto command_view = DisconnectView::Create(packet);
   ASSERT_TRUE(command_view.IsValid());
   ASSERT_EQ(command_view.GetConnectionHandle(), handle_);
   test_hci_layer_->Disconnect(handle_, reason);
+  sync_client_handler();
 }
 
 TEST_F(AclManagerWithConnectionTest, acl_send_data_credits) {
@@ -969,12 +758,12 @@
   test_controller_->CompletePackets(handle_, 1);
 
   auto after_credits_sent_packet = test_hci_layer_->OutgoingAclData();
+  sync_client_handler();
 }
 
 TEST_F(AclManagerWithConnectionTest, send_switch_role) {
-  test_hci_layer_->SetCommandFuture();
   acl_manager_->SwitchRole(connection_->GetAddress(), Role::PERIPHERAL);
-  auto packet = test_hci_layer_->GetCommand(OpCode::SWITCH_ROLE);
+  auto packet = GetConnectionManagementCommand(OpCode::SWITCH_ROLE);
   auto command_view = SwitchRoleView::Create(packet);
   ASSERT_TRUE(command_view.IsValid());
   ASSERT_EQ(command_view.GetBdAddr(), connection_->GetAddress());
@@ -983,13 +772,13 @@
   EXPECT_CALL(mock_connection_management_callbacks_, OnRoleChange(hci::ErrorCode::SUCCESS, Role::PERIPHERAL));
   test_hci_layer_->IncomingEvent(
       RoleChangeBuilder::Create(ErrorCode::SUCCESS, connection_->GetAddress(), Role::PERIPHERAL));
+  sync_client_handler();
 }
 
 TEST_F(AclManagerWithConnectionTest, send_write_default_link_policy_settings) {
-  test_hci_layer_->SetCommandFuture();
   uint16_t link_policy_settings = 0x05;
   acl_manager_->WriteDefaultLinkPolicySettings(link_policy_settings);
-  auto packet = test_hci_layer_->GetCommand(OpCode::WRITE_DEFAULT_LINK_POLICY_SETTINGS);
+  auto packet = GetConnectionManagementCommand(OpCode::WRITE_DEFAULT_LINK_POLICY_SETTINGS);
   auto command_view = WriteDefaultLinkPolicySettingsView::Create(packet);
   ASSERT_TRUE(command_view.IsValid());
   ASSERT_EQ(command_view.GetDefaultLinkPolicySettings(), 0x05);
@@ -997,49 +786,52 @@
   uint8_t num_packets = 1;
   test_hci_layer_->IncomingEvent(
       WriteDefaultLinkPolicySettingsCompleteBuilder::Create(num_packets, ErrorCode::SUCCESS));
+  sync_client_handler();
 
   ASSERT_EQ(link_policy_settings, acl_manager_->ReadDefaultLinkPolicySettings());
 }
 
 TEST_F(AclManagerWithConnectionTest, send_authentication_requested) {
-  test_hci_layer_->SetCommandFuture();
   connection_->AuthenticationRequested();
-  auto packet = test_hci_layer_->GetCommand(OpCode::AUTHENTICATION_REQUESTED);
+  auto packet = GetConnectionManagementCommand(OpCode::AUTHENTICATION_REQUESTED);
   auto command_view = AuthenticationRequestedView::Create(packet);
   ASSERT_TRUE(command_view.IsValid());
 
   EXPECT_CALL(mock_connection_management_callbacks_, OnAuthenticationComplete);
-  test_hci_layer_->IncomingEvent(AuthenticationCompleteBuilder::Create(ErrorCode::SUCCESS, handle_));
+  test_hci_layer_->IncomingEvent(
+      AuthenticationCompleteBuilder::Create(ErrorCode::SUCCESS, handle_));
+  sync_client_handler();
 }
 
 TEST_F(AclManagerWithConnectionTest, send_read_clock_offset) {
-  test_hci_layer_->SetCommandFuture();
   connection_->ReadClockOffset();
-  auto packet = test_hci_layer_->GetCommand(OpCode::READ_CLOCK_OFFSET);
+  auto packet = GetConnectionManagementCommand(OpCode::READ_CLOCK_OFFSET);
   auto command_view = ReadClockOffsetView::Create(packet);
   ASSERT_TRUE(command_view.IsValid());
 
   EXPECT_CALL(mock_connection_management_callbacks_, OnReadClockOffsetComplete(0x0123));
-  test_hci_layer_->IncomingEvent(ReadClockOffsetCompleteBuilder::Create(ErrorCode::SUCCESS, handle_, 0x0123));
+  test_hci_layer_->IncomingEvent(
+      ReadClockOffsetCompleteBuilder::Create(ErrorCode::SUCCESS, handle_, 0x0123));
+  sync_client_handler();
 }
 
 TEST_F(AclManagerWithConnectionTest, send_hold_mode) {
-  test_hci_layer_->SetCommandFuture();
   connection_->HoldMode(0x0500, 0x0020);
-  auto packet = test_hci_layer_->GetCommand(OpCode::HOLD_MODE);
+  auto packet = GetConnectionManagementCommand(OpCode::HOLD_MODE);
   auto command_view = HoldModeView::Create(packet);
   ASSERT_TRUE(command_view.IsValid());
   ASSERT_EQ(command_view.GetHoldModeMaxInterval(), 0x0500);
   ASSERT_EQ(command_view.GetHoldModeMinInterval(), 0x0020);
 
   EXPECT_CALL(mock_connection_management_callbacks_, OnModeChange(ErrorCode::SUCCESS, Mode::HOLD, 0x0020));
-  test_hci_layer_->IncomingEvent(ModeChangeBuilder::Create(ErrorCode::SUCCESS, handle_, Mode::HOLD, 0x0020));
+  test_hci_layer_->IncomingEvent(
+      ModeChangeBuilder::Create(ErrorCode::SUCCESS, handle_, Mode::HOLD, 0x0020));
+  sync_client_handler();
 }
 
 TEST_F(AclManagerWithConnectionTest, send_sniff_mode) {
-  test_hci_layer_->SetCommandFuture();
   connection_->SniffMode(0x0500, 0x0020, 0x0040, 0x0014);
-  auto packet = test_hci_layer_->GetCommand(OpCode::SNIFF_MODE);
+  auto packet = GetConnectionManagementCommand(OpCode::SNIFF_MODE);
   auto command_view = SniffModeView::Create(packet);
   ASSERT_TRUE(command_view.IsValid());
   ASSERT_EQ(command_view.GetSniffMaxInterval(), 0x0500);
@@ -1048,101 +840,109 @@
   ASSERT_EQ(command_view.GetSniffTimeout(), 0x0014);
 
   EXPECT_CALL(mock_connection_management_callbacks_, OnModeChange(ErrorCode::SUCCESS, Mode::SNIFF, 0x0028));
-  test_hci_layer_->IncomingEvent(ModeChangeBuilder::Create(ErrorCode::SUCCESS, handle_, Mode::SNIFF, 0x0028));
+  test_hci_layer_->IncomingEvent(
+      ModeChangeBuilder::Create(ErrorCode::SUCCESS, handle_, Mode::SNIFF, 0x0028));
+  sync_client_handler();
 }
 
 TEST_F(AclManagerWithConnectionTest, send_exit_sniff_mode) {
-  test_hci_layer_->SetCommandFuture();
   connection_->ExitSniffMode();
-  auto packet = test_hci_layer_->GetCommand(OpCode::EXIT_SNIFF_MODE);
+  auto packet = GetConnectionManagementCommand(OpCode::EXIT_SNIFF_MODE);
   auto command_view = ExitSniffModeView::Create(packet);
   ASSERT_TRUE(command_view.IsValid());
 
   EXPECT_CALL(mock_connection_management_callbacks_, OnModeChange(ErrorCode::SUCCESS, Mode::ACTIVE, 0x00));
-  test_hci_layer_->IncomingEvent(ModeChangeBuilder::Create(ErrorCode::SUCCESS, handle_, Mode::ACTIVE, 0x00));
+  test_hci_layer_->IncomingEvent(
+      ModeChangeBuilder::Create(ErrorCode::SUCCESS, handle_, Mode::ACTIVE, 0x00));
+  sync_client_handler();
 }
 
 TEST_F(AclManagerWithConnectionTest, send_qos_setup) {
-  test_hci_layer_->SetCommandFuture();
   connection_->QosSetup(ServiceType::BEST_EFFORT, 0x1234, 0x1233, 0x1232, 0x1231);
-  auto packet = test_hci_layer_->GetCommand(OpCode::QOS_SETUP);
+  auto packet = GetConnectionManagementCommand(OpCode::QOS_SETUP);
   auto command_view = QosSetupView::Create(packet);
   ASSERT_TRUE(command_view.IsValid());
   ASSERT_EQ(command_view.GetServiceType(), ServiceType::BEST_EFFORT);
-  ASSERT_EQ(command_view.GetTokenRate(), 0x1234);
-  ASSERT_EQ(command_view.GetPeakBandwidth(), 0x1233);
-  ASSERT_EQ(command_view.GetLatency(), 0x1232);
-  ASSERT_EQ(command_view.GetDelayVariation(), 0x1231);
+  ASSERT_EQ(command_view.GetTokenRate(), 0x1234u);
+  ASSERT_EQ(command_view.GetPeakBandwidth(), 0x1233u);
+  ASSERT_EQ(command_view.GetLatency(), 0x1232u);
+  ASSERT_EQ(command_view.GetDelayVariation(), 0x1231u);
 
   EXPECT_CALL(mock_connection_management_callbacks_,
               OnQosSetupComplete(ServiceType::BEST_EFFORT, 0x1234, 0x1233, 0x1232, 0x1231));
-  test_hci_layer_->IncomingEvent(QosSetupCompleteBuilder::Create(ErrorCode::SUCCESS, handle_, ServiceType::BEST_EFFORT,
-                                                                 0x1234, 0x1233, 0x1232, 0x1231));
+  test_hci_layer_->IncomingEvent(QosSetupCompleteBuilder::Create(
+      ErrorCode::SUCCESS, handle_, ServiceType::BEST_EFFORT, 0x1234, 0x1233, 0x1232, 0x1231));
+  sync_client_handler();
 }
 
 TEST_F(AclManagerWithConnectionTest, send_flow_specification) {
-  test_hci_layer_->SetCommandFuture();
-  connection_->FlowSpecification(FlowDirection::OUTGOING_FLOW, ServiceType::BEST_EFFORT, 0x1234, 0x1233, 0x1232,
-                                 0x1231);
-  auto packet = test_hci_layer_->GetCommand(OpCode::FLOW_SPECIFICATION);
+  connection_->FlowSpecification(
+      FlowDirection::OUTGOING_FLOW, ServiceType::BEST_EFFORT, 0x1234, 0x1233, 0x1232, 0x1231);
+  auto packet = GetConnectionManagementCommand(OpCode::FLOW_SPECIFICATION);
   auto command_view = FlowSpecificationView::Create(packet);
   ASSERT_TRUE(command_view.IsValid());
   ASSERT_EQ(command_view.GetFlowDirection(), FlowDirection::OUTGOING_FLOW);
   ASSERT_EQ(command_view.GetServiceType(), ServiceType::BEST_EFFORT);
-  ASSERT_EQ(command_view.GetTokenRate(), 0x1234);
-  ASSERT_EQ(command_view.GetTokenBucketSize(), 0x1233);
-  ASSERT_EQ(command_view.GetPeakBandwidth(), 0x1232);
-  ASSERT_EQ(command_view.GetAccessLatency(), 0x1231);
+  ASSERT_EQ(command_view.GetTokenRate(), 0x1234u);
+  ASSERT_EQ(command_view.GetTokenBucketSize(), 0x1233u);
+  ASSERT_EQ(command_view.GetPeakBandwidth(), 0x1232u);
+  ASSERT_EQ(command_view.GetAccessLatency(), 0x1231u);
 
   EXPECT_CALL(mock_connection_management_callbacks_,
               OnFlowSpecificationComplete(FlowDirection::OUTGOING_FLOW, ServiceType::BEST_EFFORT, 0x1234, 0x1233,
                                           0x1232, 0x1231));
-  test_hci_layer_->IncomingEvent(
-      FlowSpecificationCompleteBuilder::Create(ErrorCode::SUCCESS, handle_, FlowDirection::OUTGOING_FLOW,
-                                               ServiceType::BEST_EFFORT, 0x1234, 0x1233, 0x1232, 0x1231));
+  test_hci_layer_->IncomingEvent(FlowSpecificationCompleteBuilder::Create(
+      ErrorCode::SUCCESS,
+      handle_,
+      FlowDirection::OUTGOING_FLOW,
+      ServiceType::BEST_EFFORT,
+      0x1234,
+      0x1233,
+      0x1232,
+      0x1231));
+  sync_client_handler();
 }
 
 TEST_F(AclManagerWithConnectionTest, send_flush) {
-  test_hci_layer_->SetCommandFuture();
   connection_->Flush();
-  auto packet = test_hci_layer_->GetCommand(OpCode::FLUSH);
+  auto packet = GetConnectionManagementCommand(OpCode::FLUSH);
   auto command_view = FlushView::Create(packet);
   ASSERT_TRUE(command_view.IsValid());
 
   EXPECT_CALL(mock_connection_management_callbacks_, OnFlushOccurred());
   test_hci_layer_->IncomingEvent(FlushOccurredBuilder::Create(handle_));
+  sync_client_handler();
 }
 
 TEST_F(AclManagerWithConnectionTest, send_role_discovery) {
-  test_hci_layer_->SetCommandFuture();
   connection_->RoleDiscovery();
-  auto packet = test_hci_layer_->GetCommand(OpCode::ROLE_DISCOVERY);
+  auto packet = GetConnectionManagementCommand(OpCode::ROLE_DISCOVERY);
   auto command_view = RoleDiscoveryView::Create(packet);
   ASSERT_TRUE(command_view.IsValid());
 
   EXPECT_CALL(mock_connection_management_callbacks_, OnRoleDiscoveryComplete(Role::CENTRAL));
   uint8_t num_packets = 1;
-  test_hci_layer_->IncomingEvent(
-      RoleDiscoveryCompleteBuilder::Create(num_packets, ErrorCode::SUCCESS, handle_, Role::CENTRAL));
+  test_hci_layer_->IncomingEvent(RoleDiscoveryCompleteBuilder::Create(
+      num_packets, ErrorCode::SUCCESS, handle_, Role::CENTRAL));
+  sync_client_handler();
 }
 
 TEST_F(AclManagerWithConnectionTest, send_read_link_policy_settings) {
-  test_hci_layer_->SetCommandFuture();
   connection_->ReadLinkPolicySettings();
-  auto packet = test_hci_layer_->GetCommand(OpCode::READ_LINK_POLICY_SETTINGS);
+  auto packet = GetConnectionManagementCommand(OpCode::READ_LINK_POLICY_SETTINGS);
   auto command_view = ReadLinkPolicySettingsView::Create(packet);
   ASSERT_TRUE(command_view.IsValid());
 
   EXPECT_CALL(mock_connection_management_callbacks_, OnReadLinkPolicySettingsComplete(0x07));
   uint8_t num_packets = 1;
-  test_hci_layer_->IncomingEvent(
-      ReadLinkPolicySettingsCompleteBuilder::Create(num_packets, ErrorCode::SUCCESS, handle_, 0x07));
+  test_hci_layer_->IncomingEvent(ReadLinkPolicySettingsCompleteBuilder::Create(
+      num_packets, ErrorCode::SUCCESS, handle_, 0x07));
+  sync_client_handler();
 }
 
 TEST_F(AclManagerWithConnectionTest, send_write_link_policy_settings) {
-  test_hci_layer_->SetCommandFuture();
   connection_->WriteLinkPolicySettings(0x05);
-  auto packet = test_hci_layer_->GetCommand(OpCode::WRITE_LINK_POLICY_SETTINGS);
+  auto packet = GetConnectionManagementCommand(OpCode::WRITE_LINK_POLICY_SETTINGS);
   auto command_view = WriteLinkPolicySettingsView::Create(packet);
   ASSERT_TRUE(command_view.IsValid());
   ASSERT_EQ(command_view.GetLinkPolicySettings(), 0x05);
@@ -1150,12 +950,12 @@
   uint8_t num_packets = 1;
   test_hci_layer_->IncomingEvent(
       WriteLinkPolicySettingsCompleteBuilder::Create(num_packets, ErrorCode::SUCCESS, handle_));
+  sync_client_handler();
 }
 
 TEST_F(AclManagerWithConnectionTest, send_sniff_subrating) {
-  test_hci_layer_->SetCommandFuture();
   connection_->SniffSubrating(0x1234, 0x1235, 0x1236);
-  auto packet = test_hci_layer_->GetCommand(OpCode::SNIFF_SUBRATING);
+  auto packet = GetConnectionManagementCommand(OpCode::SNIFF_SUBRATING);
   auto command_view = SniffSubratingView::Create(packet);
   ASSERT_TRUE(command_view.IsValid());
   ASSERT_EQ(command_view.GetMaximumLatency(), 0x1234);
@@ -1163,26 +963,27 @@
   ASSERT_EQ(command_view.GetMinimumLocalTimeout(), 0x1236);
 
   uint8_t num_packets = 1;
-  test_hci_layer_->IncomingEvent(SniffSubratingCompleteBuilder::Create(num_packets, ErrorCode::SUCCESS, handle_));
+  test_hci_layer_->IncomingEvent(
+      SniffSubratingCompleteBuilder::Create(num_packets, ErrorCode::SUCCESS, handle_));
+  sync_client_handler();
 }
 
 TEST_F(AclManagerWithConnectionTest, send_read_automatic_flush_timeout) {
-  test_hci_layer_->SetCommandFuture();
   connection_->ReadAutomaticFlushTimeout();
-  auto packet = test_hci_layer_->GetCommand(OpCode::READ_AUTOMATIC_FLUSH_TIMEOUT);
+  auto packet = GetConnectionManagementCommand(OpCode::READ_AUTOMATIC_FLUSH_TIMEOUT);
   auto command_view = ReadAutomaticFlushTimeoutView::Create(packet);
   ASSERT_TRUE(command_view.IsValid());
 
   EXPECT_CALL(mock_connection_management_callbacks_, OnReadAutomaticFlushTimeoutComplete(0x07ff));
   uint8_t num_packets = 1;
-  test_hci_layer_->IncomingEvent(
-      ReadAutomaticFlushTimeoutCompleteBuilder::Create(num_packets, ErrorCode::SUCCESS, handle_, 0x07ff));
+  test_hci_layer_->IncomingEvent(ReadAutomaticFlushTimeoutCompleteBuilder::Create(
+      num_packets, ErrorCode::SUCCESS, handle_, 0x07ff));
+  sync_client_handler();
 }
 
 TEST_F(AclManagerWithConnectionTest, send_write_automatic_flush_timeout) {
-  test_hci_layer_->SetCommandFuture();
   connection_->WriteAutomaticFlushTimeout(0x07FF);
-  auto packet = test_hci_layer_->GetCommand(OpCode::WRITE_AUTOMATIC_FLUSH_TIMEOUT);
+  auto packet = GetConnectionManagementCommand(OpCode::WRITE_AUTOMATIC_FLUSH_TIMEOUT);
   auto command_view = WriteAutomaticFlushTimeoutView::Create(packet);
   ASSERT_TRUE(command_view.IsValid());
   ASSERT_EQ(command_view.GetFlushTimeout(), 0x07FF);
@@ -1190,39 +991,39 @@
   uint8_t num_packets = 1;
   test_hci_layer_->IncomingEvent(
       WriteAutomaticFlushTimeoutCompleteBuilder::Create(num_packets, ErrorCode::SUCCESS, handle_));
+  sync_client_handler();
 }
 
 TEST_F(AclManagerWithConnectionTest, send_read_transmit_power_level) {
-  test_hci_layer_->SetCommandFuture();
   connection_->ReadTransmitPowerLevel(TransmitPowerLevelType::CURRENT);
-  auto packet = test_hci_layer_->GetCommand(OpCode::READ_TRANSMIT_POWER_LEVEL);
+  auto packet = GetConnectionManagementCommand(OpCode::READ_TRANSMIT_POWER_LEVEL);
   auto command_view = ReadTransmitPowerLevelView::Create(packet);
   ASSERT_TRUE(command_view.IsValid());
   ASSERT_EQ(command_view.GetTransmitPowerLevelType(), TransmitPowerLevelType::CURRENT);
 
   EXPECT_CALL(mock_connection_management_callbacks_, OnReadTransmitPowerLevelComplete(0x07));
   uint8_t num_packets = 1;
-  test_hci_layer_->IncomingEvent(
-      ReadTransmitPowerLevelCompleteBuilder::Create(num_packets, ErrorCode::SUCCESS, handle_, 0x07));
+  test_hci_layer_->IncomingEvent(ReadTransmitPowerLevelCompleteBuilder::Create(
+      num_packets, ErrorCode::SUCCESS, handle_, 0x07));
+  sync_client_handler();
 }
 
 TEST_F(AclManagerWithConnectionTest, send_read_link_supervision_timeout) {
-  test_hci_layer_->SetCommandFuture();
   connection_->ReadLinkSupervisionTimeout();
-  auto packet = test_hci_layer_->GetCommand(OpCode::READ_LINK_SUPERVISION_TIMEOUT);
+  auto packet = GetConnectionManagementCommand(OpCode::READ_LINK_SUPERVISION_TIMEOUT);
   auto command_view = ReadLinkSupervisionTimeoutView::Create(packet);
   ASSERT_TRUE(command_view.IsValid());
 
   EXPECT_CALL(mock_connection_management_callbacks_, OnReadLinkSupervisionTimeoutComplete(0x5677));
   uint8_t num_packets = 1;
-  test_hci_layer_->IncomingEvent(
-      ReadLinkSupervisionTimeoutCompleteBuilder::Create(num_packets, ErrorCode::SUCCESS, handle_, 0x5677));
+  test_hci_layer_->IncomingEvent(ReadLinkSupervisionTimeoutCompleteBuilder::Create(
+      num_packets, ErrorCode::SUCCESS, handle_, 0x5677));
+  sync_client_handler();
 }
 
 TEST_F(AclManagerWithConnectionTest, send_write_link_supervision_timeout) {
-  test_hci_layer_->SetCommandFuture();
   connection_->WriteLinkSupervisionTimeout(0x5678);
-  auto packet = test_hci_layer_->GetCommand(OpCode::WRITE_LINK_SUPERVISION_TIMEOUT);
+  auto packet = GetConnectionManagementCommand(OpCode::WRITE_LINK_SUPERVISION_TIMEOUT);
   auto command_view = WriteLinkSupervisionTimeoutView::Create(packet);
   ASSERT_TRUE(command_view.IsValid());
   ASSERT_EQ(command_view.GetLinkSupervisionTimeout(), 0x5678);
@@ -1230,37 +1031,37 @@
   uint8_t num_packets = 1;
   test_hci_layer_->IncomingEvent(
       WriteLinkSupervisionTimeoutCompleteBuilder::Create(num_packets, ErrorCode::SUCCESS, handle_));
+  sync_client_handler();
 }
 
 TEST_F(AclManagerWithConnectionTest, send_read_failed_contact_counter) {
-  test_hci_layer_->SetCommandFuture();
   connection_->ReadFailedContactCounter();
-  auto packet = test_hci_layer_->GetCommand(OpCode::READ_FAILED_CONTACT_COUNTER);
+  auto packet = GetConnectionManagementCommand(OpCode::READ_FAILED_CONTACT_COUNTER);
   auto command_view = ReadFailedContactCounterView::Create(packet);
   ASSERT_TRUE(command_view.IsValid());
 
   EXPECT_CALL(mock_connection_management_callbacks_, OnReadFailedContactCounterComplete(0x00));
   uint8_t num_packets = 1;
-  test_hci_layer_->IncomingEvent(
-      ReadFailedContactCounterCompleteBuilder::Create(num_packets, ErrorCode::SUCCESS, handle_, 0x00));
+  test_hci_layer_->IncomingEvent(ReadFailedContactCounterCompleteBuilder::Create(
+      num_packets, ErrorCode::SUCCESS, handle_, 0x00));
+  sync_client_handler();
 }
 
 TEST_F(AclManagerWithConnectionTest, send_reset_failed_contact_counter) {
-  test_hci_layer_->SetCommandFuture();
   connection_->ResetFailedContactCounter();
-  auto packet = test_hci_layer_->GetCommand(OpCode::RESET_FAILED_CONTACT_COUNTER);
+  auto packet = GetConnectionManagementCommand(OpCode::RESET_FAILED_CONTACT_COUNTER);
   auto command_view = ResetFailedContactCounterView::Create(packet);
   ASSERT_TRUE(command_view.IsValid());
 
   uint8_t num_packets = 1;
   test_hci_layer_->IncomingEvent(
       ResetFailedContactCounterCompleteBuilder::Create(num_packets, ErrorCode::SUCCESS, handle_));
+  sync_client_handler();
 }
 
 TEST_F(AclManagerWithConnectionTest, send_read_link_quality) {
-  test_hci_layer_->SetCommandFuture();
   connection_->ReadLinkQuality();
-  auto packet = test_hci_layer_->GetCommand(OpCode::READ_LINK_QUALITY);
+  auto packet = GetConnectionManagementCommand(OpCode::READ_LINK_QUALITY);
   auto command_view = ReadLinkQualityView::Create(packet);
   ASSERT_TRUE(command_view.IsValid());
 
@@ -1268,12 +1069,12 @@
   uint8_t num_packets = 1;
   test_hci_layer_->IncomingEvent(
       ReadLinkQualityCompleteBuilder::Create(num_packets, ErrorCode::SUCCESS, handle_, 0xa9));
+  sync_client_handler();
 }
 
 TEST_F(AclManagerWithConnectionTest, send_read_afh_channel_map) {
-  test_hci_layer_->SetCommandFuture();
   connection_->ReadAfhChannelMap();
-  auto packet = test_hci_layer_->GetCommand(OpCode::READ_AFH_CHANNEL_MAP);
+  auto packet = GetConnectionManagementCommand(OpCode::READ_AFH_CHANNEL_MAP);
   auto command_view = ReadAfhChannelMapView::Create(packet);
   ASSERT_TRUE(command_view.IsValid());
   std::array<uint8_t, 10> afh_channel_map = {0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09};
@@ -1281,34 +1082,36 @@
   EXPECT_CALL(mock_connection_management_callbacks_,
               OnReadAfhChannelMapComplete(AfhMode::AFH_ENABLED, afh_channel_map));
   uint8_t num_packets = 1;
-  test_hci_layer_->IncomingEvent(ReadAfhChannelMapCompleteBuilder::Create(num_packets, ErrorCode::SUCCESS, handle_,
-                                                                          AfhMode::AFH_ENABLED, afh_channel_map));
+  test_hci_layer_->IncomingEvent(ReadAfhChannelMapCompleteBuilder::Create(
+      num_packets, ErrorCode::SUCCESS, handle_, AfhMode::AFH_ENABLED, afh_channel_map));
+  sync_client_handler();
 }
 
 TEST_F(AclManagerWithConnectionTest, send_read_rssi) {
-  test_hci_layer_->SetCommandFuture();
   connection_->ReadRssi();
-  auto packet = test_hci_layer_->GetCommand(OpCode::READ_RSSI);
+  auto packet = GetConnectionManagementCommand(OpCode::READ_RSSI);
   auto command_view = ReadRssiView::Create(packet);
   ASSERT_TRUE(command_view.IsValid());
   sync_client_handler();
   EXPECT_CALL(mock_connection_management_callbacks_, OnReadRssiComplete(0x00));
   uint8_t num_packets = 1;
-  test_hci_layer_->IncomingEvent(ReadRssiCompleteBuilder::Create(num_packets, ErrorCode::SUCCESS, handle_, 0x00));
+  test_hci_layer_->IncomingEvent(
+      ReadRssiCompleteBuilder::Create(num_packets, ErrorCode::SUCCESS, handle_, 0x00));
+  sync_client_handler();
 }
 
 TEST_F(AclManagerWithConnectionTest, send_read_clock) {
-  test_hci_layer_->SetCommandFuture();
   connection_->ReadClock(WhichClock::LOCAL);
-  auto packet = test_hci_layer_->GetCommand(OpCode::READ_CLOCK);
+  auto packet = GetConnectionManagementCommand(OpCode::READ_CLOCK);
   auto command_view = ReadClockView::Create(packet);
   ASSERT_TRUE(command_view.IsValid());
   ASSERT_EQ(command_view.GetWhichClock(), WhichClock::LOCAL);
 
   EXPECT_CALL(mock_connection_management_callbacks_, OnReadClockComplete(0x00002e6a, 0x0000));
   uint8_t num_packets = 1;
-  test_hci_layer_->IncomingEvent(
-      ReadClockCompleteBuilder::Create(num_packets, ErrorCode::SUCCESS, handle_, 0x00002e6a, 0x0000));
+  test_hci_layer_->IncomingEvent(ReadClockCompleteBuilder::Create(
+      num_packets, ErrorCode::SUCCESS, handle_, 0x00002e6a, 0x0000));
+  sync_client_handler();
 }
 
 class AclManagerWithResolvableAddressTest : public AclManagerNoCallbacksTest {
@@ -1320,7 +1123,6 @@
     fake_registry_.InjectTestModule(&Controller::Factory, test_controller_);
     client_handler_ = fake_registry_.GetTestModuleHandler(&HciLayer::Factory);
     ASSERT_NE(client_handler_, nullptr);
-    test_hci_layer_->SetCommandFuture();
     fake_registry_.Start<AclManager>(&thread_);
     acl_manager_ = static_cast<AclManager*>(fake_registry_.GetModuleUnderTest(&AclManager::Factory));
     Address::FromString("A1:A2:A3:A4:A5:A6", remote);
@@ -1338,28 +1140,22 @@
         minimum_rotation_time,
         maximum_rotation_time);
 
-    test_hci_layer_->GetLastCommand(OpCode::LE_SET_RANDOM_ADDRESS);
+    GetConnectionManagementCommand(OpCode::LE_SET_RANDOM_ADDRESS);
     test_hci_layer_->IncomingEvent(LeSetRandomAddressCompleteBuilder::Create(0x01, ErrorCode::SUCCESS));
   }
 };
 
 TEST_F(AclManagerWithResolvableAddressTest, create_connection_cancel_fail) {
   auto remote_with_type_ = AddressWithType(remote, AddressType::PUBLIC_DEVICE_ADDRESS);
-  test_hci_layer_->SetCommandFuture();
   acl_manager_->CreateLeConnection(remote_with_type_, true);
 
-  // Set random address
-  test_hci_layer_->GetLastCommand(OpCode::LE_SET_RANDOM_ADDRESS);
-  test_hci_layer_->SetCommandFuture();
-  test_hci_layer_->IncomingEvent(LeSetRandomAddressCompleteBuilder::Create(0x01, ErrorCode::SUCCESS));
-
   // Add device to connect list
-  test_hci_layer_->GetLastCommand(OpCode::LE_ADD_DEVICE_TO_FILTER_ACCEPT_LIST);
-  test_hci_layer_->SetCommandFuture();
-  test_hci_layer_->IncomingEvent(LeAddDeviceToFilterAcceptListCompleteBuilder::Create(0x01, ErrorCode::SUCCESS));
+  GetConnectionManagementCommand(OpCode::LE_ADD_DEVICE_TO_FILTER_ACCEPT_LIST);
+  test_hci_layer_->IncomingEvent(
+      LeAddDeviceToFilterAcceptListCompleteBuilder::Create(0x01, ErrorCode::SUCCESS));
 
   // send create connection command
-  test_hci_layer_->GetLastCommand(OpCode::LE_CREATE_CONNECTION);
+  GetConnectionManagementCommand(OpCode::LE_CREATE_CONNECTION);
   test_hci_layer_->IncomingEvent(LeCreateConnectionStatusBuilder::Create(ErrorCode::SUCCESS, 0x01));
 
   fake_registry_.SynchronizeModuleHandler(&HciLayer::Factory, std::chrono::milliseconds(20));
@@ -1370,11 +1166,10 @@
   auto remote_with_type2 = AddressWithType(remote2, AddressType::PUBLIC_DEVICE_ADDRESS);
 
   // create another connection
-  test_hci_layer_->SetCommandFuture();
   acl_manager_->CreateLeConnection(remote_with_type2, true);
 
   // cancel previous connection
-  test_hci_layer_->GetLastCommand(OpCode::LE_CREATE_CONNECTION_CANCEL);
+  GetConnectionManagementCommand(OpCode::LE_CREATE_CONNECTION_CANCEL);
 
   // receive connection complete of first device
   test_hci_layer_->IncomingLeMetaEvent(LeConnectionCompleteBuilder::Create(
@@ -1389,13 +1184,14 @@
       ClockAccuracy::PPM_30));
 
   // receive create connection cancel complete with ErrorCode::CONNECTION_ALREADY_EXISTS
-  test_hci_layer_->SetCommandFuture();
   test_hci_layer_->IncomingEvent(
       LeCreateConnectionCancelCompleteBuilder::Create(0x01, ErrorCode::CONNECTION_ALREADY_EXISTS));
 
   // Add another device to connect list
-  test_hci_layer_->GetLastCommand(OpCode::LE_ADD_DEVICE_TO_FILTER_ACCEPT_LIST);
+  GetConnectionManagementCommand(OpCode::LE_ADD_DEVICE_TO_FILTER_ACCEPT_LIST);
   test_hci_layer_->IncomingEvent(LeAddDeviceToFilterAcceptListCompleteBuilder::Create(0x01, ErrorCode::SUCCESS));
+
+  // Sync events.
 }
 
 class AclManagerLifeCycleTest : public AclManagerNoCallbacksTest {
@@ -1412,9 +1208,8 @@
 
 TEST_F(AclManagerLifeCycleTest, unregister_classic_after_create_connection) {
   // Inject create connection
-  test_hci_layer_->SetCommandFuture();
   acl_manager_->CreateConnection(remote);
-  auto connection_command = test_hci_layer_->GetCommand(OpCode::CREATE_CONNECTION);
+  auto connection_command = GetConnectionManagementCommand(OpCode::CREATE_CONNECTION);
 
   // Unregister callbacks after sending connection request
   auto promise = std::promise<void>();
@@ -1426,38 +1221,19 @@
   auto connection_future = GetConnectionFuture();
   test_hci_layer_->IncomingEvent(
       ConnectionCompleteBuilder::Create(ErrorCode::SUCCESS, handle_, remote, LinkType::ACL, Enable::DISABLED));
-  auto connection_future_status = connection_future.wait_for(kTimeout);
+
+  sync_client_handler();
+  auto connection_future_status = connection_future.wait_for(kShortTimeout);
   ASSERT_NE(connection_future_status, std::future_status::ready);
 }
 
-TEST_F(AclManagerLifeCycleTest, unregister_classic_before_connection_request) {
-  ClassOfDevice class_of_device;
-
-  // Unregister callbacks before receiving connection request
-  auto promise = std::promise<void>();
-  auto future = promise.get_future();
-  acl_manager_->UnregisterCallbacks(&mock_connection_callback_, std::move(promise));
-  future.get();
-
-  // Inject peer sending connection request
-  auto connection_future = GetConnectionFuture();
-  test_hci_layer_->IncomingEvent(
-      ConnectionRequestBuilder::Create(remote, class_of_device, ConnectionRequestLinkType::ACL));
-  auto connection_future_status = connection_future.wait_for(kTimeout);
-  ASSERT_NE(connection_future_status, std::future_status::ready);
-
-  test_hci_layer_->GetLastCommand(OpCode::REJECT_CONNECTION_REQUEST);
-}
-
 TEST_F(AclManagerLifeCycleTest, unregister_le_before_connection_complete) {
   AddressWithType remote_with_type(remote, AddressType::PUBLIC_DEVICE_ADDRESS);
-  test_hci_layer_->SetCommandFuture();
   acl_manager_->CreateLeConnection(remote_with_type, true);
-  test_hci_layer_->GetLastCommand(OpCode::LE_ADD_DEVICE_TO_FILTER_ACCEPT_LIST);
+  GetConnectionManagementCommand(OpCode::LE_ADD_DEVICE_TO_FILTER_ACCEPT_LIST);
   test_hci_layer_->IncomingEvent(LeAddDeviceToFilterAcceptListCompleteBuilder::Create(0x01, ErrorCode::SUCCESS));
 
-  test_hci_layer_->SetCommandFuture();
-  auto packet = test_hci_layer_->GetLastCommand(OpCode::LE_CREATE_CONNECTION);
+  auto packet = GetConnectionManagementCommand(OpCode::LE_CREATE_CONNECTION);
   auto le_connection_management_command_view =
       LeConnectionManagementCommandView::Create(AclCommandView::Create(packet));
   auto command_view = LeCreateConnectionView::Create(le_connection_management_command_view);
@@ -1487,19 +1263,18 @@
       0x0500,
       ClockAccuracy::PPM_30));
 
-  auto connection_future_status = connection_future.wait_for(kTimeout);
+  sync_client_handler();
+  auto connection_future_status = connection_future.wait_for(kShortTimeout);
   ASSERT_NE(connection_future_status, std::future_status::ready);
 }
 
 TEST_F(AclManagerLifeCycleTest, unregister_le_before_enhanced_connection_complete) {
   AddressWithType remote_with_type(remote, AddressType::PUBLIC_DEVICE_ADDRESS);
-  test_hci_layer_->SetCommandFuture();
   acl_manager_->CreateLeConnection(remote_with_type, true);
-  test_hci_layer_->GetLastCommand(OpCode::LE_ADD_DEVICE_TO_FILTER_ACCEPT_LIST);
+  GetConnectionManagementCommand(OpCode::LE_ADD_DEVICE_TO_FILTER_ACCEPT_LIST);
   test_hci_layer_->IncomingEvent(LeAddDeviceToFilterAcceptListCompleteBuilder::Create(0x01, ErrorCode::SUCCESS));
 
-  test_hci_layer_->SetCommandFuture();
-  auto packet = test_hci_layer_->GetLastCommand(OpCode::LE_CREATE_CONNECTION);
+  auto packet = GetConnectionManagementCommand(OpCode::LE_CREATE_CONNECTION);
   auto le_connection_management_command_view =
       LeConnectionManagementCommandView::Create(AclCommandView::Create(packet));
   auto command_view = LeCreateConnectionView::Create(le_connection_management_command_view);
@@ -1531,7 +1306,8 @@
       0x0500,
       ClockAccuracy::PPM_30));
 
-  auto connection_future_status = connection_future.wait_for(kTimeout);
+  sync_client_handler();
+  auto connection_future_status = connection_future.wait_for(kShortTimeout);
   ASSERT_NE(connection_future_status, std::future_status::ready);
 }
 
diff --git a/system/gd/hci/acl_manager_unittest.cc b/system/gd/hci/acl_manager_unittest.cc
index 37d96db..31c71eb 100644
--- a/system/gd/hci/acl_manager_unittest.cc
+++ b/system/gd/hci/acl_manager_unittest.cc
@@ -21,11 +21,15 @@
 
 #include <algorithm>
 #include <chrono>
+#include <deque>
 #include <future>
+#include <list>
 #include <map>
 
 #include "common/bind.h"
+#include "common/init_flags.h"
 #include "hci/address.h"
+#include "hci/address_with_type.h"
 #include "hci/class_of_device.h"
 #include "hci/controller.h"
 #include "hci/hci_layer.h"
@@ -45,9 +49,28 @@
 using packet::PacketView;
 using packet::RawBuilder;
 
-constexpr std::chrono::seconds kTimeout = std::chrono::seconds(2);
+namespace {
+constexpr char kLocalRandomAddressString[] = "D0:05:04:03:02:01";
+constexpr char kRemotePublicDeviceStringA[] = "11:A2:A3:A4:A5:A6";
+constexpr char kRemotePublicDeviceStringB[] = "11:B2:B3:B4:B5:B6";
+constexpr uint16_t kHciHandleA = 123;
+constexpr uint16_t kHciHandleB = 456;
+
+constexpr auto kMinimumRotationTime = std::chrono::milliseconds(7 * 60 * 1000);
+constexpr auto kMaximumRotationTime = std::chrono::milliseconds(15 * 60 * 1000);
+
 const AddressWithType empty_address_with_type = hci::AddressWithType();
 
+struct {
+  Address address;
+  ClassOfDevice class_of_device;
+  const uint16_t handle;
+} remote_device[2] = {
+    {.address = {}, .class_of_device = {}, .handle = kHciHandleA},
+    {.address = {}, .class_of_device = {}, .handle = kHciHandleB},
+};
+}  // namespace
+
 PacketView<kLittleEndian> GetPacketView(std::unique_ptr<packet::BasePacketBuilder> packet) {
   auto bytes = std::make_shared<std::vector<uint8_t>>();
   BitInserter i(*bytes);
@@ -74,15 +97,6 @@
 
 class TestController : public Controller {
  public:
-  void RegisterCompletedAclPacketsCallback(
-      common::ContextualCallback<void(uint16_t /* handle */, uint16_t /* packets */)> cb) override {
-    acl_cb_ = cb;
-  }
-
-  void UnregisterCompletedAclPacketsCallback() override {
-    acl_cb_ = {};
-  }
-
   uint16_t GetAclPacketLength() const override {
     return acl_buffer_length_;
   }
@@ -102,18 +116,15 @@
     return le_buffer_size;
   }
 
-  void CompletePackets(uint16_t handle, uint16_t packets) {
-    acl_cb_.Invoke(handle, packets);
-  }
-
-  uint16_t acl_buffer_length_ = 1024;
-  uint16_t total_acl_buffers_ = 2;
-  common::ContextualCallback<void(uint16_t /* handle */, uint16_t /* packets */)> acl_cb_;
-
  protected:
   void Start() override {}
   void Stop() override {}
   void ListDependencies(ModuleList* list) const {}
+
+ private:
+  uint16_t acl_buffer_length_ = 1024;
+  uint16_t total_acl_buffers_ = 2;
+  common::ContextualCallback<void(uint16_t /* handle */, uint16_t /* packets */)> acl_cb_;
 };
 
 class TestHciLayer : public HciLayer {
@@ -123,10 +134,7 @@
       common::ContextualOnceCallback<void(CommandStatusView)> on_status) override {
     command_queue_.push(std::move(command));
     command_status_callbacks.push_back(std::move(on_status));
-    if (command_promise_ != nullptr) {
-      command_promise_->set_value();
-      command_promise_.reset();
-    }
+    Notify();
   }
 
   void EnqueueCommand(
@@ -134,16 +142,18 @@
       common::ContextualOnceCallback<void(CommandCompleteView)> on_complete) override {
     command_queue_.push(std::move(command));
     command_complete_callbacks.push_back(std::move(on_complete));
-    if (command_promise_ != nullptr) {
-      command_promise_->set_value();
-      command_promise_.reset();
-    }
+    Notify();
   }
 
   void SetCommandFuture() {
-    ASSERT_TRUE(command_promise_ == nullptr) << "Promises, Promises, ... Only one at a time.";
-    command_promise_ = std::make_unique<std::promise<void>>();
-    command_future_ = std::make_unique<std::future<void>>(command_promise_->get_future());
+    ASSERT_EQ(hci_command_promise_, nullptr) << "Promises, Promises, ... Only one at a time.";
+    hci_command_promise_ = std::make_unique<std::promise<void>>();
+    command_future_ = std::make_unique<std::future<void>>(hci_command_promise_->get_future());
+  }
+
+  std::future<void> GetOutgoingCommandFuture() {
+    hci_command_promise_ = std::make_unique<std::promise<void>>();
+    return hci_command_promise_->get_future();
   }
 
   CommandView GetLastCommand() {
@@ -173,9 +183,10 @@
   ConnectionManagementCommandView GetLastCommand(OpCode op_code) {
     if (!command_queue_.empty() && command_future_ != nullptr) {
       command_future_.reset();
-      command_promise_.reset();
+      hci_command_promise_.reset();
     } else if (command_future_ != nullptr) {
       command_future_->wait_for(std::chrono::milliseconds(1000));
+      hci_command_promise_.reset();
     }
     if (command_queue_.empty()) {
       return ConnectionManagementCommandView::Create(AclCommandView::Create(
@@ -188,6 +199,19 @@
     return command;
   }
 
+  ConnectionManagementCommandView GetLastOutgoingCommand() {
+    if (command_queue_.empty()) {
+      // An empty packet will force a failure on |IsValid()| required by all packets before usage
+      return ConnectionManagementCommandView::Create(AclCommandView::Create(
+          CommandView::Create(PacketView<kLittleEndian>(std::make_shared<std::vector<uint8_t>>()))));
+    } else {
+      CommandView command_packet_view = GetLastCommand();
+      ConnectionManagementCommandView command =
+          ConnectionManagementCommandView::Create(AclCommandView::Create(command_packet_view));
+      return command;
+    }
+  }
+
   void RegisterEventHandler(EventCode event_code, common::ContextualCallback<void(EventView)> event_handler) override {
     registered_events_[event_code] = event_handler;
   }
@@ -205,7 +229,7 @@
     registered_le_events_.erase(subevent_code);
   }
 
-  void IncomingEvent(std::unique_ptr<EventBuilder> event_builder) {
+  void SendIncomingEvent(std::unique_ptr<EventBuilder> event_builder) {
     auto packet = GetPacketView(std::move(event_builder));
     EventView event = EventView::Create(packet);
     ASSERT_TRUE(event.IsValid());
@@ -242,7 +266,7 @@
             queue_end,
             handle,
             common::Passed(std::move(promise))));
-    auto status = future.wait_for(kTimeout);
+    auto status = future.wait_for(2s);
     ASSERT_EQ(status, std::future_status::ready);
   }
 
@@ -291,7 +315,17 @@
     GetHandler()->Post(common::BindOnce(&TestHciLayer::do_disconnect, common::Unretained(this), handle, reason));
   }
 
+  std::unique_ptr<std::promise<void>> hci_command_promise_;
+
  private:
+  void Notify() {
+    if (hci_command_promise_ != nullptr) {
+      std::promise<void>* prom = hci_command_promise_.release();
+      prom->set_value();
+      delete prom;
+    }
+  }
+
   std::map<EventCode, common::ContextualCallback<void(EventView)>> registered_events_;
   std::map<SubeventCode, common::ContextualCallback<void(LeMetaEventView)>> registered_le_events_;
   std::list<common::ContextualOnceCallback<void(CommandCompleteView)>> command_complete_callbacks;
@@ -299,7 +333,6 @@
   BidiQueue<AclView, AclBuilder> acl_queue_{3 /* TODO: Set queue depth */};
 
   std::queue<std::unique_ptr<CommandBuilder>> command_queue_;
-  std::unique_ptr<std::promise<void>> command_promise_;
   std::unique_ptr<std::future<void>> command_future_;
 
   void do_disconnect(uint16_t handle, ErrorCode reason) {
@@ -307,90 +340,122 @@
   }
 };
 
-class AclManagerNoCallbacksTest : public ::testing::Test {
+class MockConnectionCallback : public ConnectionCallbacks {
+ public:
+  void OnConnectSuccess(std::unique_ptr<ClassicAclConnection> connection) override {
+    // Convert to std::shared_ptr during push_back()
+    connections_.push_back(std::move(connection));
+    if (is_promise_set_) {
+      is_promise_set_ = false;
+      connection_promise_.set_value(connections_.back());
+    }
+  }
+  MOCK_METHOD(void, OnConnectFail, (Address, ErrorCode reason), (override));
+
+  MOCK_METHOD(void, HACK_OnEscoConnectRequest, (Address, ClassOfDevice), (override));
+  MOCK_METHOD(void, HACK_OnScoConnectRequest, (Address, ClassOfDevice), (override));
+
+  size_t NumberOfConnections() const {
+    return connections_.size();
+  }
+
+ private:
+  friend class AclManagerWithCallbacksTest;
+  friend class AclManagerNoCallbacksTest;
+
+  std::deque<std::shared_ptr<ClassicAclConnection>> connections_;
+  std::promise<std::shared_ptr<ClassicAclConnection>> connection_promise_;
+  bool is_promise_set_{false};
+};
+
+class MockLeConnectionCallbacks : public LeConnectionCallbacks {
+ public:
+  void OnLeConnectSuccess(AddressWithType address_with_type, std::unique_ptr<LeAclConnection> connection) override {
+    le_connections_.push_back(std::move(connection));
+    if (le_connection_promise_ != nullptr) {
+      std::promise<void>* prom = le_connection_promise_.release();
+      prom->set_value();
+      delete prom;
+    }
+  }
+  MOCK_METHOD(void, OnLeConnectFail, (AddressWithType, ErrorCode reason), (override));
+
+  std::deque<std::shared_ptr<LeAclConnection>> le_connections_;
+  std::unique_ptr<std::promise<void>> le_connection_promise_;
+};
+
+class AclManagerBaseTest : public ::testing::Test {
  protected:
   void SetUp() override {
+    common::InitFlags::SetAllForTesting();
     test_hci_layer_ = new TestHciLayer;  // Ownership is transferred to registry
+    ASSERT_TRUE(test_hci_layer_->hci_command_promise_ == nullptr) << "hci command is nullptr";
     test_controller_ = new TestController;
     fake_registry_.InjectTestModule(&HciLayer::Factory, test_hci_layer_);
     fake_registry_.InjectTestModule(&Controller::Factory, test_controller_);
     client_handler_ = fake_registry_.GetTestModuleHandler(&HciLayer::Factory);
     ASSERT_NE(client_handler_, nullptr);
-    test_hci_layer_->SetCommandFuture();
     fake_registry_.Start<AclManager>(&thread_);
-    acl_manager_ = static_cast<AclManager*>(fake_registry_.GetModuleUnderTest(&AclManager::Factory));
-    Address::FromString("A1:A2:A3:A4:A5:A6", remote);
-
-    hci::Address address;
-    Address::FromString("D0:05:04:03:02:01", address);
-    hci::AddressWithType address_with_type(address, hci::AddressType::RANDOM_DEVICE_ADDRESS);
-    auto minimum_rotation_time = std::chrono::milliseconds(7 * 60 * 1000);
-    auto maximum_rotation_time = std::chrono::milliseconds(15 * 60 * 1000);
-    acl_manager_->SetPrivacyPolicyForInitiatorAddress(
-        LeAddressManager::AddressPolicy::USE_STATIC_ADDRESS,
-        address_with_type,
-        minimum_rotation_time,
-        maximum_rotation_time);
-
-    auto set_random_address_packet = LeSetRandomAddressView::Create(
-        LeAdvertisingCommandView::Create(test_hci_layer_->GetCommand(OpCode::LE_SET_RANDOM_ADDRESS)));
-    ASSERT_TRUE(set_random_address_packet.IsValid());
-    my_initiating_address =
-        AddressWithType(set_random_address_packet.GetRandomAddress(), AddressType::RANDOM_DEVICE_ADDRESS);
-    // Verify LE Set Random Address was sent during setup
-    test_hci_layer_->GetLastCommand(OpCode::LE_SET_RANDOM_ADDRESS);
-    test_hci_layer_->IncomingEvent(LeSetRandomAddressCompleteBuilder::Create(0x01, ErrorCode::SUCCESS));
+    ASSERT_TRUE(test_hci_layer_->hci_command_promise_ == nullptr) << "hci command is nullptr";
   }
 
   void TearDown() override {
-    mock_connection_callbacks_.connections_.clear();
-    mock_le_connection_callbacks_.le_connections_.clear();
-
     fake_registry_.SynchronizeModuleHandler(&AclManager::Factory, std::chrono::milliseconds(20));
     fake_registry_.StopAll();
   }
 
-  TestModuleRegistry fake_registry_;
+  void sync_client_handler() {
+    std::promise<void> promise;
+    auto future = promise.get_future();
+    client_handler_->Post(common::BindOnce(&std::promise<void>::set_value, common::Unretained(&promise)));
+    auto future_status = future.wait_for(std::chrono::seconds(1));
+    ASSERT_EQ(future_status, std::future_status::ready);
+  }
+
   TestHciLayer* test_hci_layer_ = nullptr;
   TestController* test_controller_ = nullptr;
+
+  TestModuleRegistry fake_registry_;
   os::Thread& thread_ = fake_registry_.GetTestThread();
   AclManager* acl_manager_ = nullptr;
   os::Handler* client_handler_ = nullptr;
-  Address remote;
-  AddressWithType my_initiating_address;
+};
+
+class AclManagerNoCallbacksTest : public AclManagerBaseTest {
+ protected:
+  void SetUp() override {
+    AclManagerBaseTest::SetUp();
+    ASSERT_TRUE(test_hci_layer_->hci_command_promise_ == nullptr) << "hci command is nullptr";
+
+    acl_manager_ = static_cast<AclManager*>(fake_registry_.GetModuleUnderTest(&AclManager::Factory));
+
+    local_address_with_type_ = AddressWithType(
+        Address::FromString(kLocalRandomAddressString).value(), hci::AddressType::RANDOM_DEVICE_ADDRESS);
+
+    ASSERT_TRUE(test_hci_layer_->hci_command_promise_ == nullptr) << "hci command is nullptr";
+    auto future = test_hci_layer_->GetOutgoingCommandFuture();
+
+    acl_manager_->SetPrivacyPolicyForInitiatorAddress(
+        LeAddressManager::AddressPolicy::USE_STATIC_ADDRESS,
+        local_address_with_type_,
+        kMinimumRotationTime,
+        kMaximumRotationTime);
+
+    ASSERT_EQ(std::future_status::ready, future.wait_for(2s));
+    sync_client_handler();
+    ASSERT_TRUE(test_hci_layer_->hci_command_promise_ == nullptr) << "hci command is nullptr";
+    auto command = test_hci_layer_->GetLastOutgoingCommand();
+    ASSERT_TRUE(command.IsValid());
+    ASSERT_EQ(OpCode::LE_SET_RANDOM_ADDRESS, command.GetOpCode());
+  }
+
+  void TearDown() override {
+    AclManagerBaseTest::TearDown();
+  }
+
+  AddressWithType local_address_with_type_;
   const bool use_connect_list_ = true;  // gd currently only supports connect list
 
-  void check_connection_promise_not_null() {
-    ASSERT_TRUE(mock_connection_callbacks_.connection_promise_ == nullptr)
-        << "Promises promises ... Only one at a time";
-  }
-
-  std::future<void> GetConnectionFuture() {
-    check_connection_promise_not_null();
-    mock_connection_callbacks_.connection_promise_ = std::make_unique<std::promise<void>>();
-    return mock_connection_callbacks_.connection_promise_->get_future();
-  }
-
-  std::future<void> GetLeConnectionFuture() {
-    check_connection_promise_not_null();
-    mock_le_connection_callbacks_.le_connection_promise_ = std::make_unique<std::promise<void>>();
-    return mock_le_connection_callbacks_.le_connection_promise_->get_future();
-  }
-
-  void check_connections_not_empty() {
-    ASSERT_TRUE(!mock_connection_callbacks_.connections_.empty()) << "There are no classic ACL connections";
-  }
-
-  std::shared_ptr<ClassicAclConnection> GetLastConnection() {
-    check_connections_not_empty();
-    return mock_connection_callbacks_.connections_.back();
-  }
-
-  std::shared_ptr<LeAclConnection> GetLastLeConnection() {
-    check_connections_not_empty();
-    return mock_le_connection_callbacks_.le_connections_.back();
-  }
-
   void SendAclData(uint16_t handle, AclConnection::QueueUpEnd* queue_end) {
     std::promise<void> promise;
     auto future = promise.get_future();
@@ -405,51 +470,18 @@
             queue_end,
             handle,
             common::Passed(std::move(promise))));
-    auto status = future.wait_for(kTimeout);
+    auto status = future.wait_for(2s);
     ASSERT_EQ(status, std::future_status::ready);
   }
-
-  class MockConnectionCallback : public ConnectionCallbacks {
-   public:
-    void OnConnectSuccess(std::unique_ptr<ClassicAclConnection> connection) override {
-      // Convert to std::shared_ptr during push_back()
-      connections_.push_back(std::move(connection));
-      if (connection_promise_ != nullptr) {
-        connection_promise_->set_value();
-        connection_promise_.reset();
-      }
-    }
-    MOCK_METHOD(void, OnConnectFail, (Address, ErrorCode reason), (override));
-
-    MOCK_METHOD(void, HACK_OnEscoConnectRequest, (Address, ClassOfDevice), (override));
-    MOCK_METHOD(void, HACK_OnScoConnectRequest, (Address, ClassOfDevice), (override));
-
-    std::list<std::shared_ptr<ClassicAclConnection>> connections_;
-    std::unique_ptr<std::promise<void>> connection_promise_;
-  } mock_connection_callbacks_;
-
-  class MockLeConnectionCallbacks : public LeConnectionCallbacks {
-   public:
-    void OnLeConnectSuccess(AddressWithType address_with_type, std::unique_ptr<LeAclConnection> connection) override {
-      le_connections_.push_back(std::move(connection));
-      if (le_connection_promise_ != nullptr) {
-        le_connection_promise_->set_value();
-        le_connection_promise_.reset();
-      }
-    }
-    MOCK_METHOD(void, OnLeConnectFail, (AddressWithType, ErrorCode reason), (override));
-
-    std::list<std::shared_ptr<LeAclConnection>> le_connections_;
-    std::unique_ptr<std::promise<void>> le_connection_promise_;
-  } mock_le_connection_callbacks_;
 };
 
-class AclManagerTest : public AclManagerNoCallbacksTest {
+class AclManagerWithCallbacksTest : public AclManagerNoCallbacksTest {
  protected:
   void SetUp() override {
     AclManagerNoCallbacksTest::SetUp();
     acl_manager_->RegisterCallbacks(&mock_connection_callbacks_, client_handler_);
     acl_manager_->RegisterLeCallbacks(&mock_le_connection_callbacks_, client_handler_);
+    ASSERT_TRUE(test_hci_layer_->hci_command_promise_ == nullptr) << "hci command is nullptr";
   }
 
   void TearDown() override {
@@ -468,16 +500,53 @@
       acl_manager_->UnregisterCallbacks(&mock_connection_callbacks_, std::move(promise));
       future.wait_for(2s);
     }
+
+    mock_connection_callbacks_.connections_.clear();
+    mock_le_connection_callbacks_.le_connections_.clear();
+
     AclManagerNoCallbacksTest::TearDown();
   }
+
+  std::future<std::shared_ptr<ClassicAclConnection>> GetConnectionFuture() {
+    // Run on main thread
+    mock_connection_callbacks_.connection_promise_ = std::promise<std::shared_ptr<ClassicAclConnection>>();
+    mock_connection_callbacks_.is_promise_set_ = true;
+    return mock_connection_callbacks_.connection_promise_.get_future();
+  }
+
+  std::future<void> GetLeConnectionFuture() {
+    mock_le_connection_callbacks_.le_connection_promise_ = std::make_unique<std::promise<void>>();
+    return mock_le_connection_callbacks_.le_connection_promise_->get_future();
+  }
+
+  std::shared_ptr<ClassicAclConnection> GetLastConnection() {
+    return mock_connection_callbacks_.connections_.back();
+  }
+
+  size_t NumberOfConnections() {
+    return mock_connection_callbacks_.connections_.size();
+  }
+
+  std::shared_ptr<LeAclConnection> GetLastLeConnection() {
+    return mock_le_connection_callbacks_.le_connections_.back();
+  }
+
+  size_t NumberOfLeConnections() {
+    return mock_le_connection_callbacks_.le_connections_.size();
+  }
+
+  MockConnectionCallback mock_connection_callbacks_;
+  MockLeConnectionCallbacks mock_le_connection_callbacks_;
 };
 
-class AclManagerWithConnectionTest : public AclManagerTest {
+class AclManagerWithConnectionTest : public AclManagerWithCallbacksTest {
  protected:
   void SetUp() override {
-    AclManagerTest::SetUp();
+    AclManagerWithCallbacksTest::SetUp();
 
     handle_ = 0x123;
+    Address::FromString("A1:A2:A3:A4:A5:A6", remote);
+
     acl_manager_->CreateConnection(remote);
 
     // Wait for the connection request
@@ -489,10 +558,10 @@
     EXPECT_CALL(mock_connection_management_callbacks_, OnRoleChange(hci::ErrorCode::SUCCESS, Role::CENTRAL));
 
     auto first_connection = GetConnectionFuture();
-    test_hci_layer_->IncomingEvent(
+    test_hci_layer_->SendIncomingEvent(
         ConnectionCompleteBuilder::Create(ErrorCode::SUCCESS, handle_, remote, LinkType::ACL, Enable::DISABLED));
 
-    auto first_connection_status = first_connection.wait_for(kTimeout);
+    auto first_connection_status = first_connection.wait_for(2s);
     ASSERT_EQ(first_connection_status, std::future_status::ready);
 
     connection_ = GetLastConnection();
@@ -505,15 +574,8 @@
     fake_registry_.StopAll();
   }
 
-  void sync_client_handler() {
-    std::promise<void> promise;
-    auto future = promise.get_future();
-    client_handler_->Post(common::BindOnce(&std::promise<void>::set_value, common::Unretained(&promise)));
-    auto future_status = future.wait_for(std::chrono::seconds(1));
-    ASSERT_EQ(future_status, std::future_status::ready);
-  }
-
   uint16_t handle_;
+  Address remote;
   std::shared_ptr<ClassicAclConnection> connection_;
 
   class MockConnectionManagementCallbacks : public ConnectionManagementCallbacks {
@@ -572,19 +634,20 @@
   } mock_connection_management_callbacks_;
 };
 
-TEST_F(AclManagerTest, startup_teardown) {}
+TEST_F(AclManagerWithCallbacksTest, startup_teardown) {}
 
-class AclManagerWithLeConnectionTest : public AclManagerTest {
+class AclManagerWithLeConnectionTest : public AclManagerWithCallbacksTest {
  protected:
   void SetUp() override {
-    AclManagerTest::SetUp();
+    AclManagerWithCallbacksTest::SetUp();
 
-    remote_with_type_ = AddressWithType(remote, AddressType::PUBLIC_DEVICE_ADDRESS);
-    test_hci_layer_->SetCommandFuture();
+    Address remote_public_address = Address::FromString(kRemotePublicDeviceStringA).value();
+    remote_with_type_ = AddressWithType(remote_public_address, AddressType::PUBLIC_DEVICE_ADDRESS);
+    ASSERT_NO_FATAL_FAILURE(test_hci_layer_->SetCommandFuture());
     acl_manager_->CreateLeConnection(remote_with_type_, true);
     test_hci_layer_->GetCommand(OpCode::LE_ADD_DEVICE_TO_FILTER_ACCEPT_LIST);
-    test_hci_layer_->IncomingEvent(LeAddDeviceToFilterAcceptListCompleteBuilder::Create(0x01, ErrorCode::SUCCESS));
-    test_hci_layer_->SetCommandFuture();
+    test_hci_layer_->SendIncomingEvent(LeAddDeviceToFilterAcceptListCompleteBuilder::Create(0x01, ErrorCode::SUCCESS));
+    ASSERT_NO_FATAL_FAILURE(test_hci_layer_->SetCommandFuture());
     auto packet = test_hci_layer_->GetCommand(OpCode::LE_CREATE_CONNECTION);
     auto le_connection_management_command_view =
         LeConnectionManagementCommandView::Create(AclCommandView::Create(packet));
@@ -594,11 +657,11 @@
       ASSERT_EQ(command_view.GetPeerAddress(), empty_address_with_type.GetAddress());
       ASSERT_EQ(command_view.GetPeerAddressType(), empty_address_with_type.GetAddressType());
     } else {
-      ASSERT_EQ(command_view.GetPeerAddress(), remote);
+      ASSERT_EQ(command_view.GetPeerAddress(), remote_public_address);
       ASSERT_EQ(command_view.GetPeerAddressType(), AddressType::PUBLIC_DEVICE_ADDRESS);
     }
 
-    test_hci_layer_->IncomingEvent(LeCreateConnectionStatusBuilder::Create(ErrorCode::SUCCESS, 0x01));
+    test_hci_layer_->SendIncomingEvent(LeCreateConnectionStatusBuilder::Create(ErrorCode::SUCCESS, 0x01));
 
     auto first_connection = GetLeConnectionFuture();
 
@@ -607,17 +670,18 @@
         handle_,
         Role::PERIPHERAL,
         AddressType::PUBLIC_DEVICE_ADDRESS,
-        remote,
+        remote_public_address,
         0x0100,
         0x0010,
         0x0C80,
         ClockAccuracy::PPM_30));
 
-    test_hci_layer_->SetCommandFuture();
+    ASSERT_NO_FATAL_FAILURE(test_hci_layer_->SetCommandFuture());
     test_hci_layer_->GetCommand(OpCode::LE_REMOVE_DEVICE_FROM_FILTER_ACCEPT_LIST);
-    test_hci_layer_->IncomingEvent(LeRemoveDeviceFromFilterAcceptListCompleteBuilder::Create(0x01, ErrorCode::SUCCESS));
+    test_hci_layer_->SendIncomingEvent(
+        LeRemoveDeviceFromFilterAcceptListCompleteBuilder::Create(0x01, ErrorCode::SUCCESS));
 
-    auto first_connection_status = first_connection.wait_for(kTimeout);
+    auto first_connection_status = first_connection.wait_for(2s);
     ASSERT_EQ(first_connection_status, std::future_status::ready);
 
     connection_ = GetLastLeConnection();
@@ -661,7 +725,7 @@
   } mock_le_connection_management_callbacks_;
 };
 
-class AclManagerWithResolvableAddressTest : public AclManagerNoCallbacksTest {
+class AclManagerWithResolvableAddressTest : public AclManagerWithCallbacksTest {
  protected:
   void SetUp() override {
     test_hci_layer_ = new TestHciLayer;  // Ownership is transferred to registry
@@ -670,11 +734,9 @@
     fake_registry_.InjectTestModule(&Controller::Factory, test_controller_);
     client_handler_ = fake_registry_.GetTestModuleHandler(&HciLayer::Factory);
     ASSERT_NE(client_handler_, nullptr);
-    test_hci_layer_->SetCommandFuture();
+    ASSERT_NO_FATAL_FAILURE(test_hci_layer_->SetCommandFuture());
     fake_registry_.Start<AclManager>(&thread_);
     acl_manager_ = static_cast<AclManager*>(fake_registry_.GetModuleUnderTest(&AclManager::Factory));
-    Address::FromString("A1:A2:A3:A4:A5:A6", remote);
-
     hci::Address address;
     Address::FromString("D0:05:04:03:02:01", address);
     hci::AddressWithType address_with_type(address, hci::AddressType::RANDOM_DEVICE_ADDRESS);
@@ -689,25 +751,17 @@
         maximum_rotation_time);
 
     test_hci_layer_->GetLastCommand(OpCode::LE_SET_RANDOM_ADDRESS);
-    test_hci_layer_->IncomingEvent(LeSetRandomAddressCompleteBuilder::Create(0x01, ErrorCode::SUCCESS));
+    test_hci_layer_->SendIncomingEvent(LeSetRandomAddressCompleteBuilder::Create(0x01, ErrorCode::SUCCESS));
   }
 };
 
-class AclManagerLifeCycleTest : public AclManagerNoCallbacksTest {
- protected:
-  void SetUp() override {
-    AclManagerNoCallbacksTest::SetUp();
-    acl_manager_->RegisterCallbacks(&mock_connection_callbacks_, client_handler_);
-    acl_manager_->RegisterLeCallbacks(&mock_le_connection_callbacks_, client_handler_);
-  }
-
-  AddressWithType remote_with_type_;
-  uint16_t handle_{0x123};
-};
-
-TEST_F(AclManagerLifeCycleTest, unregister_classic_before_connection_request) {
+TEST_F(AclManagerNoCallbacksTest, unregister_classic_before_connection_request) {
   ClassOfDevice class_of_device;
 
+  MockConnectionCallback mock_connection_callbacks_;
+
+  acl_manager_->RegisterCallbacks(&mock_connection_callbacks_, client_handler_);
+
   // Unregister callbacks before receiving connection request
   auto promise = std::promise<void>();
   auto future = promise.get_future();
@@ -715,103 +769,126 @@
   future.get();
 
   // Inject peer sending connection request
-  auto connection_future = GetConnectionFuture();
-  test_hci_layer_->IncomingEvent(
-      ConnectionRequestBuilder::Create(remote, class_of_device, ConnectionRequestLinkType::ACL));
-  auto connection_future_status = connection_future.wait_for(kTimeout);
-  ASSERT_NE(connection_future_status, std::future_status::ready);
+  test_hci_layer_->SendIncomingEvent(ConnectionRequestBuilder::Create(
+      local_address_with_type_.GetAddress(), class_of_device, ConnectionRequestLinkType::ACL));
+  sync_client_handler();
 
-  test_hci_layer_->GetLastCommand(OpCode::REJECT_CONNECTION_REQUEST);
+  // There should be no connections
+  ASSERT_EQ(0UL, mock_connection_callbacks_.NumberOfConnections());
+
+  auto command = test_hci_layer_->GetLastOutgoingCommand();
+  ASSERT_TRUE(command.IsValid());
+  ASSERT_EQ(OpCode::REJECT_CONNECTION_REQUEST, command.GetOpCode());
 }
 
-TEST_F(AclManagerTest, two_remote_connection_requests_ABAB) {
-  struct {
-    Address address;
-    ClassOfDevice class_of_device;
-    const uint16_t handle;
-  } remote[2] = {
-      {
-          .address = {},
-          .class_of_device = {},
-          .handle = 123,
-      },
-      {.address = {}, .class_of_device = {}, .handle = 456},
-  };
-  Address::FromString("A1:A2:A3:A4:A5:A6", remote[0].address);
-  Address::FromString("B1:B2:B3:B4:B5:B6", remote[1].address);
-
-  test_hci_layer_->SetCommandFuture();
-  test_hci_layer_->IncomingEvent(
-      ConnectionRequestBuilder::Create(remote[0].address, remote[0].class_of_device, ConnectionRequestLinkType::ACL));
-  test_hci_layer_->GetLastCommand(OpCode::ACCEPT_CONNECTION_REQUEST);
-
-  test_hci_layer_->SetCommandFuture();
-  test_hci_layer_->IncomingEvent(
-      ConnectionRequestBuilder::Create(remote[1].address, remote[1].class_of_device, ConnectionRequestLinkType::ACL));
-  test_hci_layer_->GetLastCommand(OpCode::ACCEPT_CONNECTION_REQUEST);
+TEST_F(AclManagerWithCallbacksTest, two_remote_connection_requests_ABAB) {
+  Address::FromString(kRemotePublicDeviceStringA, remote_device[0].address);
+  Address::FromString(kRemotePublicDeviceStringB, remote_device[1].address);
 
   {
-    auto first_connection = GetConnectionFuture();
-    test_hci_layer_->IncomingEvent(ConnectionCompleteBuilder::Create(
-        ErrorCode::SUCCESS, remote[0].handle, remote[0].address, LinkType::ACL, Enable::DISABLED));
-    auto first_connection_status = first_connection.wait_for(kTimeout);
-    ASSERT_EQ(first_connection_status, std::future_status::ready);
+    // Device A sends connection request
+    auto future = test_hci_layer_->GetOutgoingCommandFuture();
+    test_hci_layer_->SendIncomingEvent(ConnectionRequestBuilder::Create(
+        remote_device[0].address, remote_device[0].class_of_device, ConnectionRequestLinkType::ACL));
+    sync_client_handler();
+    // Verify we accept this connection
+    ASSERT_EQ(std::future_status::ready, future.wait_for(2s));
+    auto command = test_hci_layer_->GetLastOutgoingCommand();
+    ASSERT_TRUE(command.IsValid());
+    ASSERT_EQ(OpCode::ACCEPT_CONNECTION_REQUEST, command.GetOpCode());
   }
-  ASSERT_EQ(GetLastConnection()->GetAddress(), remote[0].address);
 
   {
-    auto first_connection = GetConnectionFuture();
-    test_hci_layer_->IncomingEvent(ConnectionCompleteBuilder::Create(
-        ErrorCode::SUCCESS, remote[1].handle, remote[1].address, LinkType::ACL, Enable::DISABLED));
-    auto first_connection_status = first_connection.wait_for(2s);
-    ASSERT_EQ(first_connection_status, std::future_status::ready);
+    // Device B sends connection request
+    auto future = test_hci_layer_->GetOutgoingCommandFuture();
+    test_hci_layer_->SendIncomingEvent(ConnectionRequestBuilder::Create(
+        remote_device[1].address, remote_device[1].class_of_device, ConnectionRequestLinkType::ACL));
+    sync_client_handler();
+    // Verify we accept this connection
+    ASSERT_EQ(std::future_status::ready, future.wait_for(2s));
+    auto command = test_hci_layer_->GetLastOutgoingCommand();
+    ASSERT_TRUE(command.IsValid());
+    ASSERT_EQ(OpCode::ACCEPT_CONNECTION_REQUEST, command.GetOpCode());
   }
-  ASSERT_EQ(GetLastConnection()->GetAddress(), remote[1].address);
+
+  ASSERT_EQ(0UL, NumberOfConnections());
+
+  {
+    // Device A completes first connection
+    auto future = GetConnectionFuture();
+    test_hci_layer_->SendIncomingEvent(ConnectionCompleteBuilder::Create(
+        ErrorCode::SUCCESS, remote_device[0].handle, remote_device[0].address, LinkType::ACL, Enable::DISABLED));
+    ASSERT_EQ(std::future_status::ready, future.wait_for(2s)) << "Timeout waiting for first connection complete";
+    ASSERT_EQ(1UL, NumberOfConnections());
+    auto connection = future.get();
+    ASSERT_EQ(connection->GetAddress(), remote_device[0].address) << "First connection remote address mismatch";
+  }
+
+  {
+    // Device B completes second connection
+    auto future = GetConnectionFuture();
+    test_hci_layer_->SendIncomingEvent(ConnectionCompleteBuilder::Create(
+        ErrorCode::SUCCESS, remote_device[1].handle, remote_device[1].address, LinkType::ACL, Enable::DISABLED));
+    ASSERT_EQ(std::future_status::ready, future.wait_for(2s)) << "Timeout waiting for second connection complete";
+    ASSERT_EQ(2UL, NumberOfConnections());
+    auto connection = future.get();
+    ASSERT_EQ(connection->GetAddress(), remote_device[1].address) << "Second connection remote address mismatch";
+  }
 }
 
-TEST_F(AclManagerTest, two_remote_connection_requests_ABBA) {
-  struct {
-    Address address;
-    ClassOfDevice class_of_device;
-    const uint16_t handle;
-  } remote[2] = {
-      {
-          .address = {},
-          .class_of_device = {},
-          .handle = 123,
-      },
-      {.address = {}, .class_of_device = {}, .handle = 456},
-  };
-  Address::FromString("A1:A2:A3:A4:A5:A6", remote[0].address);
-  Address::FromString("B1:B2:B3:B4:B5:B6", remote[1].address);
-
-  test_hci_layer_->SetCommandFuture();
-  test_hci_layer_->IncomingEvent(
-      ConnectionRequestBuilder::Create(remote[0].address, remote[0].class_of_device, ConnectionRequestLinkType::ACL));
-  test_hci_layer_->GetLastCommand(OpCode::ACCEPT_CONNECTION_REQUEST);
-
-  test_hci_layer_->SetCommandFuture();
-  test_hci_layer_->IncomingEvent(
-      ConnectionRequestBuilder::Create(remote[1].address, remote[1].class_of_device, ConnectionRequestLinkType::ACL));
-  test_hci_layer_->GetLastCommand(OpCode::ACCEPT_CONNECTION_REQUEST);
+TEST_F(AclManagerWithCallbacksTest, two_remote_connection_requests_ABBA) {
+  Address::FromString(kRemotePublicDeviceStringA, remote_device[0].address);
+  Address::FromString(kRemotePublicDeviceStringB, remote_device[1].address);
 
   {
-    auto first_connection = GetConnectionFuture();
-    test_hci_layer_->IncomingEvent(ConnectionCompleteBuilder::Create(
-        ErrorCode::SUCCESS, remote[1].handle, remote[1].address, LinkType::ACL, Enable::DISABLED));
-    auto first_connection_status = first_connection.wait_for(2s);
-    ASSERT_EQ(first_connection_status, std::future_status::ready);
+    // Device A sends connection request
+    auto future = test_hci_layer_->GetOutgoingCommandFuture();
+    test_hci_layer_->SendIncomingEvent(ConnectionRequestBuilder::Create(
+        remote_device[0].address, remote_device[0].class_of_device, ConnectionRequestLinkType::ACL));
+    sync_client_handler();
+    // Verify we accept this connection
+    ASSERT_EQ(std::future_status::ready, future.wait_for(2s));
+    auto command = test_hci_layer_->GetLastOutgoingCommand();
+    ASSERT_TRUE(command.IsValid());
+    ASSERT_EQ(OpCode::ACCEPT_CONNECTION_REQUEST, command.GetOpCode());
   }
-  ASSERT_EQ(GetLastConnection()->GetAddress(), remote[1].address);
 
   {
-    auto first_connection = GetConnectionFuture();
-    test_hci_layer_->IncomingEvent(ConnectionCompleteBuilder::Create(
-        ErrorCode::SUCCESS, remote[0].handle, remote[0].address, LinkType::ACL, Enable::DISABLED));
-    auto first_connection_status = first_connection.wait_for(kTimeout);
-    ASSERT_EQ(first_connection_status, std::future_status::ready);
+    // Device B sends connection request
+    auto future = test_hci_layer_->GetOutgoingCommandFuture();
+    test_hci_layer_->SendIncomingEvent(ConnectionRequestBuilder::Create(
+        remote_device[1].address, remote_device[1].class_of_device, ConnectionRequestLinkType::ACL));
+    sync_client_handler();
+    // Verify we accept this connection
+    ASSERT_EQ(std::future_status::ready, future.wait_for(2s));
+    auto command = test_hci_layer_->GetLastOutgoingCommand();
+    ASSERT_TRUE(command.IsValid());
+    ASSERT_EQ(OpCode::ACCEPT_CONNECTION_REQUEST, command.GetOpCode());
   }
-  ASSERT_EQ(GetLastConnection()->GetAddress(), remote[0].address);
+
+  ASSERT_EQ(0UL, NumberOfConnections());
+
+  {
+    // Device B completes first connection
+    auto future = GetConnectionFuture();
+    test_hci_layer_->SendIncomingEvent(ConnectionCompleteBuilder::Create(
+        ErrorCode::SUCCESS, remote_device[1].handle, remote_device[1].address, LinkType::ACL, Enable::DISABLED));
+    ASSERT_EQ(std::future_status::ready, future.wait_for(2s)) << "Timeout waiting for first connection complete";
+    ASSERT_EQ(1UL, NumberOfConnections());
+    auto connection = future.get();
+    ASSERT_EQ(connection->GetAddress(), remote_device[1].address) << "First connection remote address mismatch";
+  }
+
+  {
+    // Device A completes second connection
+    auto future = GetConnectionFuture();
+    test_hci_layer_->SendIncomingEvent(ConnectionCompleteBuilder::Create(
+        ErrorCode::SUCCESS, remote_device[0].handle, remote_device[0].address, LinkType::ACL, Enable::DISABLED));
+    ASSERT_EQ(std::future_status::ready, future.wait_for(2s)) << "Timeout waiting for second connection complete";
+    ASSERT_EQ(2UL, NumberOfConnections());
+    auto connection = future.get();
+    ASSERT_EQ(connection->GetAddress(), remote_device[0].address) << "Second connection remote address mismatch";
+  }
 }
 
 }  // namespace
diff --git a/system/gd/hci/address.cc b/system/gd/hci/address.cc
index 3dc013f..7409418 100644
--- a/system/gd/hci/address.cc
+++ b/system/gd/hci/address.cc
@@ -42,10 +42,15 @@
   std::copy(l.begin(), std::min(l.begin() + kLength, l.end()), data());
 }
 
-std::string Address::ToString() const {
+std::string Address::_ToMaskedColonSepHexString(int bytes_to_mask) const {
   std::stringstream ss;
+  int count = 0;
   for (auto it = address.rbegin(); it != address.rend(); it++) {
-    ss << std::nouppercase << std::hex << std::setw(2) << std::setfill('0') << +*it;
+    if (count++ < bytes_to_mask) {
+      ss << "xx";
+    } else {
+      ss << std::nouppercase << std::hex << std::setw(2) << std::setfill('0') << +*it;
+    }
     if (std::next(it) != address.rend()) {
       ss << ':';
     }
@@ -53,6 +58,22 @@
   return ss.str();
 }
 
+std::string Address::ToString() const {
+  return _ToMaskedColonSepHexString(0);
+}
+
+std::string Address::ToColonSepHexString() const {
+  return _ToMaskedColonSepHexString(0);
+}
+
+std::string Address::ToStringForLogging() const {
+  return _ToMaskedColonSepHexString(0);
+}
+
+std::string Address::ToRedactedStringForLogging() const {
+  return _ToMaskedColonSepHexString(4);
+}
+
 std::string Address::ToLegacyConfigString() const {
   return ToString();
 }
diff --git a/system/gd/hci/address.h b/system/gd/hci/address.h
index c5e43d4..2c1dfff 100644
--- a/system/gd/hci/address.h
+++ b/system/gd/hci/address.h
@@ -25,13 +25,16 @@
 #include <ostream>
 #include <string>
 
+#include "common/interfaces/ILoggable.h"
 #include "packet/custom_field_fixed_size_interface.h"
 #include "storage/serializable.h"
 
 namespace bluetooth {
 namespace hci {
 
-class Address final : public packet::CustomFieldFixedSizeInterface<Address>, public storage::Serializable<Address> {
+class Address final : public packet::CustomFieldFixedSizeInterface<Address>,
+                      public storage::Serializable<Address>,
+                      public bluetooth::common::IRedactableLoggable {
  public:
   static constexpr size_t kLength = 6;
 
@@ -51,6 +54,10 @@
 
   // storage::Serializable methods
   std::string ToString() const override;
+  std::string ToColonSepHexString() const;
+  std::string ToStringForLogging() const override;
+  std::string ToRedactedStringForLogging() const override;
+
   static std::optional<Address> FromString(const std::string& from);
   std::string ToLegacyConfigString() const override;
   static std::optional<Address> FromLegacyConfigString(const std::string& str);
@@ -91,8 +98,12 @@
 
   static const Address kEmpty;  // 00:00:00:00:00:00
   static const Address kAny;    // FF:FF:FF:FF:FF:FF
+ private:
+  std::string _ToMaskedColonSepHexString(int bytes_to_mask) const;
 };
 
+// TODO: to fine-tune this.
+// we need an interface between the logger and ILoggable
 inline std::ostream& operator<<(std::ostream& os, const Address& a) {
   os << a.ToString();
   return os;
diff --git a/system/gd/hci/address_unittest.cc b/system/gd/hci/address_unittest.cc
index ae2c2e7..a675682 100644
--- a/system/gd/hci/address_unittest.cc
+++ b/system/gd/hci/address_unittest.cc
@@ -16,12 +16,14 @@
  *
  ******************************************************************************/
 
-#include <unordered_map>
+#include "hci/address.h"
 
 #include <gmock/gmock.h>
 #include <gtest/gtest.h>
 
-#include "hci/address.h"
+#include <cstdint>
+#include <string>
+#include <unordered_map>
 
 using bluetooth::hci::Address;
 
@@ -233,3 +235,14 @@
   struct std::hash<Address> hasher;
   ASSERT_NE(hasher(Address::kEmpty), hasher(Address::kAny));
 }
+
+TEST(AddressTest, ToStringForLoggingTestOutputUnderDebuggablePropAndInitFlag) {
+  Address addr{{0xab, 0x55, 0x44, 0x33, 0x22, 0x11}};
+  const std::string redacted_loggable_str = "xx:xx:xx:xx:55:ab";
+  const std::string loggable_str = "11:22:33:44:55:ab";
+
+  std::string ret1 = addr.ToStringForLogging();
+  ASSERT_STREQ(ret1.c_str(), loggable_str.c_str());
+  std::string ret2 = addr.ToRedactedStringForLogging();
+  ASSERT_STREQ(ret2.c_str(), redacted_loggable_str.c_str());
+}
diff --git a/system/gd/hci/address_with_type.h b/system/gd/hci/address_with_type.h
index 48336ff..75a0b3c 100644
--- a/system/gd/hci/address_with_type.h
+++ b/system/gd/hci/address_with_type.h
@@ -22,6 +22,7 @@
 #include <string>
 #include <utility>
 
+#include "common/interfaces/ILoggable.h"
 #include "crypto_toolbox/crypto_toolbox.h"
 #include "hci/address.h"
 #include "hci/hci_packets.h"
@@ -29,7 +30,7 @@
 namespace bluetooth {
 namespace hci {
 
-class AddressWithType final {
+class AddressWithType final : public bluetooth::common::IRedactableLoggable {
  public:
   AddressWithType(Address address, AddressType address_type)
       : address_(std::move(address)), address_type_(address_type) {}
@@ -73,7 +74,7 @@
   }
 
   bool operator<(const AddressWithType& rhs) const {
-    return address_ < rhs.address_ && address_type_ < rhs.address_type_;
+    return (address_ != rhs.address_) ? address_ < rhs.address_ : address_type_ < rhs.address_type_;
   }
   bool operator==(const AddressWithType& rhs) const {
     return address_ == rhs.address_ && address_type_ == rhs.address_type_;
@@ -119,6 +120,14 @@
     return ss.str();
   }
 
+  std::string ToStringForLogging() const override {
+    return address_.ToStringForLogging() + "[" + AddressTypeText(address_type_) + "]";
+  }
+
+  std::string ToRedactedStringForLogging() const override {
+    return address_.ToStringForLogging() + "[" + AddressTypeText(address_type_) + "]";
+  }
+
  private:
   Address address_;
   AddressType address_type_;
diff --git a/system/gd/hci/address_with_type_test.cc b/system/gd/hci/address_with_type_test.cc
index 37b4ab6..efa2f13 100644
--- a/system/gd/hci/address_with_type_test.cc
+++ b/system/gd/hci/address_with_type_test.cc
@@ -16,12 +16,14 @@
  *
  ******************************************************************************/
 
-#include <unordered_map>
+#include "hci/address_with_type.h"
 
 #include <gtest/gtest.h>
 
+#include <map>
+#include <unordered_map>
+
 #include "hci/address.h"
-#include "hci/address_with_type.h"
 #include "hci/hci_packets.h"
 
 namespace bluetooth {
@@ -97,5 +99,138 @@
   EXPECT_FALSE(address_2.IsRpaThatMatchesIrk(irk_1));
 }
 
+TEST(AddressWithTypeTest, OperatorLessThan) {
+  {
+    AddressWithType address_1 =
+        AddressWithType(Address{{0x50, 0x02, 0x03, 0xC9, 0x12, 0xDE}}, AddressType::RANDOM_DEVICE_ADDRESS);
+    AddressWithType address_2 =
+        AddressWithType(Address{{0x50, 0x02, 0x03, 0xC9, 0x12, 0xDD}}, AddressType::RANDOM_DEVICE_ADDRESS);
+
+    ASSERT_TRUE(address_2 < address_1);
+  }
+
+  {
+    AddressWithType address_1 =
+        AddressWithType(Address{{0x50, 0x02, 0x03, 0xC9, 0x12, 0xDE}}, AddressType::RANDOM_DEVICE_ADDRESS);
+    AddressWithType address_2 =
+        AddressWithType(Address{{0x70, 0x02, 0x03, 0xC9, 0x12, 0xDE}}, AddressType::RANDOM_DEVICE_ADDRESS);
+
+    ASSERT_TRUE(address_1 < address_2);
+  }
+
+  {
+    AddressWithType address_1 =
+        AddressWithType(Address{{0x50, 0x02, 0x03, 0xC9, 0x12, 0xDE}}, AddressType::RANDOM_DEVICE_ADDRESS);
+    AddressWithType address_2 =
+        AddressWithType(Address{{0x70, 0x02, 0x03, 0xC9, 0x12, 0xDD}}, AddressType::RANDOM_DEVICE_ADDRESS);
+
+    ASSERT_TRUE(address_1 < address_2);
+  }
+
+  {
+    AddressWithType address_1 =
+        AddressWithType(Address{{0x11, 0x22, 0x33, 0x44, 0x55, 0x66}}, AddressType::PUBLIC_DEVICE_ADDRESS);
+    AddressWithType address_2 =
+        AddressWithType(Address{{0x11, 0x22, 0x33, 0x44, 0x55, 0x66}}, AddressType::RANDOM_DEVICE_ADDRESS);
+
+    ASSERT_TRUE(address_1 < address_2);
+  }
+
+  {
+    AddressWithType address_1 =
+        AddressWithType(Address{{0x11, 0x22, 0x33, 0x44, 0x55, 0x66}}, AddressType::PUBLIC_DEVICE_ADDRESS);
+    AddressWithType address_2 =
+        AddressWithType(Address{{0x11, 0x22, 0x33, 0x44, 0x55, 0x66}}, AddressType::PUBLIC_DEVICE_ADDRESS);
+
+    ASSERT_FALSE(address_1 < address_2);
+  }
+}
+
+TEST(AddressWithTypeTest, OrderedMap) {
+  std::map<AddressWithType, int> map;
+
+  {
+    AddressWithType address_1 =
+        AddressWithType(Address{{0x50, 0x02, 0x03, 0xC9, 0x12, 0xDE}}, AddressType::RANDOM_DEVICE_ADDRESS);
+    AddressWithType address_2 =
+        AddressWithType(Address{{0x70, 0x02, 0x03, 0xC9, 0x12, 0xDD}}, AddressType::RANDOM_DEVICE_ADDRESS);
+
+    map[address_1] = 1;
+    map[address_2] = 2;
+
+    ASSERT_EQ(2UL, map.size());
+    map.clear();
+  }
+
+  {
+    AddressWithType address_1 =
+        AddressWithType(Address{{0x11, 0x22, 0x33, 0x44, 0x55, 0x66}}, AddressType::RANDOM_DEVICE_ADDRESS);
+    AddressWithType address_2 =
+        AddressWithType(Address{{0x11, 0x22, 0x33, 0x44, 0x55, 0x66}}, AddressType::PUBLIC_DEVICE_ADDRESS);
+
+    map[address_1] = 1;
+    map[address_2] = 2;
+
+    ASSERT_EQ(2UL, map.size());
+    map.clear();
+  }
+
+  {
+    AddressWithType address_1 =
+        AddressWithType(Address{{0x11, 0x22, 0x33, 0x44, 0x55, 0x66}}, AddressType::PUBLIC_DEVICE_ADDRESS);
+    AddressWithType address_2 =
+        AddressWithType(Address{{0x11, 0x22, 0x33, 0x44, 0x55, 0x66}}, AddressType::PUBLIC_DEVICE_ADDRESS);
+
+    map[address_1] = 1;
+    map[address_2] = 2;
+
+    ASSERT_EQ(1UL, map.size());
+    map.clear();
+  }
+}
+
+TEST(AddressWithTypeTest, HashMap) {
+  std::unordered_map<AddressWithType, int> map;
+
+  {
+    AddressWithType address_1 =
+        AddressWithType(Address{{0x50, 0x02, 0x03, 0xC9, 0x12, 0xDE}}, AddressType::RANDOM_DEVICE_ADDRESS);
+    AddressWithType address_2 =
+        AddressWithType(Address{{0x70, 0x02, 0x03, 0xC9, 0x12, 0xDD}}, AddressType::RANDOM_DEVICE_ADDRESS);
+
+    map[address_1] = 1;
+    map[address_2] = 2;
+
+    ASSERT_EQ(2UL, map.size());
+    map.clear();
+  }
+
+  {
+    AddressWithType address_1 =
+        AddressWithType(Address{{0x11, 0x22, 0x33, 0x44, 0x55, 0x66}}, AddressType::RANDOM_DEVICE_ADDRESS);
+    AddressWithType address_2 =
+        AddressWithType(Address{{0x11, 0x22, 0x33, 0x44, 0x55, 0x66}}, AddressType::PUBLIC_DEVICE_ADDRESS);
+
+    map[address_1] = 1;
+    map[address_2] = 2;
+
+    ASSERT_EQ(2UL, map.size());
+    map.clear();
+  }
+
+  {
+    AddressWithType address_1 =
+        AddressWithType(Address{{0x11, 0x22, 0x33, 0x44, 0x55, 0x66}}, AddressType::PUBLIC_DEVICE_ADDRESS);
+    AddressWithType address_2 =
+        AddressWithType(Address{{0x11, 0x22, 0x33, 0x44, 0x55, 0x66}}, AddressType::PUBLIC_DEVICE_ADDRESS);
+
+    map[address_1] = 1;
+    map[address_2] = 2;
+
+    ASSERT_EQ(1UL, map.size());
+    map.clear();
+  }
+}
+
 }  // namespace hci
-}  // namespace bluetooth
\ No newline at end of file
+}  // namespace bluetooth
diff --git a/system/gd/hci/controller.cc b/system/gd/hci/controller.cc
index cd6fa1f..9dac2b6 100644
--- a/system/gd/hci/controller.cc
+++ b/system/gd/hci/controller.cc
@@ -23,6 +23,8 @@
 
 #include "common/init_flags.h"
 #include "hci/hci_layer.h"
+#include "hci_controller_generated.h"
+#include "os/metrics.h"
 
 namespace bluetooth {
 namespace hci {
@@ -244,6 +246,12 @@
     ASSERT_LOG(status == ErrorCode::SUCCESS, "Status 0x%02hhx, %s", status, ErrorCodeText(status).c_str());
 
     local_version_information_ = complete_view.GetLocalVersionInformation();
+    bluetooth::os::LogMetricBluetoothLocalVersions(
+        local_version_information_.manufacturer_name_,
+        static_cast<uint8_t>(local_version_information_.lmp_version_),
+        local_version_information_.lmp_subversion_,
+        static_cast<uint8_t>(local_version_information_.hci_version_),
+        local_version_information_.hci_revision_);
   }
 
   void read_local_supported_commands_complete_handler(CommandCompleteView view) {
@@ -261,7 +269,7 @@
     ASSERT_LOG(status == ErrorCode::SUCCESS, "Status 0x%02hhx, %s", status, ErrorCodeText(status).c_str());
     uint8_t page_number = complete_view.GetPageNumber();
     extended_lmp_features_array_.push_back(complete_view.GetExtendedLmpFeatures());
-
+    bluetooth::os::LogMetricBluetoothLocalSupportedFeatures(page_number, complete_view.GetExtendedLmpFeatures());
     // Query all extended features
     if (page_number < complete_view.GetMaximumPageNumber()) {
       page_number++;
@@ -563,6 +571,9 @@
     return supported;                                                          \
   }
 
+  void Dump(
+      std::promise<flatbuffers::Offset<ControllerData>> promise, flatbuffers::FlatBufferBuilder* fb_builder) const;
+
   bool is_supported(OpCode op_code) {
     switch (op_code) {
       OP_CODE_MAPPING(INQUIRY)
@@ -754,10 +765,10 @@
       OP_CODE_MAPPING(LE_SET_PHY)
       OP_CODE_MAPPING(LE_ENHANCED_RECEIVER_TEST)
       OP_CODE_MAPPING(LE_ENHANCED_TRANSMITTER_TEST)
-      OP_CODE_MAPPING(LE_SET_EXTENDED_ADVERTISING_RANDOM_ADDRESS)
+      OP_CODE_MAPPING(LE_SET_ADVERTISING_SET_RANDOM_ADDRESS)
       OP_CODE_MAPPING(LE_SET_EXTENDED_ADVERTISING_PARAMETERS)
       OP_CODE_MAPPING(LE_SET_EXTENDED_ADVERTISING_DATA)
-      OP_CODE_MAPPING(LE_SET_EXTENDED_ADVERTISING_SCAN_RESPONSE)
+      OP_CODE_MAPPING(LE_SET_EXTENDED_SCAN_RESPONSE_DATA)
       OP_CODE_MAPPING(LE_SET_EXTENDED_ADVERTISING_ENABLE)
       OP_CODE_MAPPING(LE_READ_MAXIMUM_ADVERTISING_DATA_LENGTH)
       OP_CODE_MAPPING(LE_READ_NUMBER_OF_SUPPORTED_ADVERTISING_SETS)
@@ -815,6 +826,10 @@
       OP_CODE_MAPPING(READ_LOCAL_SUPPORTED_CONTROLLER_DELAY)
       OP_CODE_MAPPING(CONFIGURE_DATA_PATH)
       OP_CODE_MAPPING(ENHANCED_FLUSH)
+      OP_CODE_MAPPING(LE_SET_DATA_RELATED_ADDRESS_CHANGES)
+      OP_CODE_MAPPING(LE_SET_DEFAULT_SUBRATE)
+      OP_CODE_MAPPING(LE_SUBRATE_REQUEST)
+      OP_CODE_MAPPING(SET_MIN_ENCRYPTION_KEY_SIZE)
 
       // deprecated
       case OpCode::ADD_SCO_CONNECTION:
@@ -855,27 +870,27 @@
 
   CompletedAclPacketsCallback acl_credits_callback_{};
   CompletedAclPacketsCallback acl_monitor_credits_callback_{};
-  LocalVersionInformation local_version_information_;
-  std::array<uint8_t, 64> local_supported_commands_;
-  std::vector<uint64_t> extended_lmp_features_array_;
-  uint16_t acl_buffer_length_ = 0;
-  uint16_t acl_buffers_ = 0;
-  uint8_t sco_buffer_length_ = 0;
-  uint16_t sco_buffers_ = 0;
-  Address mac_address_;
-  std::string local_name_;
-  LeBufferSize le_buffer_size_;
-  LeBufferSize iso_buffer_size_;
-  uint64_t le_local_supported_features_;
-  uint64_t le_supported_states_;
-  uint8_t le_connect_list_size_;
-  uint8_t le_resolving_list_size_;
-  LeMaximumDataLength le_maximum_data_length_;
-  uint16_t le_maximum_advertising_data_length_;
-  uint16_t le_suggested_default_data_length_;
-  uint8_t le_number_supported_advertising_sets_;
-  uint8_t le_periodic_advertiser_list_size_;
-  VendorCapabilities vendor_capabilities_;
+  LocalVersionInformation local_version_information_{};
+  std::array<uint8_t, 64> local_supported_commands_{};
+  std::vector<uint64_t> extended_lmp_features_array_{};
+  uint16_t acl_buffer_length_{};
+  uint16_t acl_buffers_{};
+  uint8_t sco_buffer_length_{};
+  uint16_t sco_buffers_{};
+  Address mac_address_{};
+  std::string local_name_{};
+  LeBufferSize le_buffer_size_{};
+  LeBufferSize iso_buffer_size_{};
+  uint64_t le_local_supported_features_{};
+  uint64_t le_supported_states_{};
+  uint8_t le_connect_list_size_{};
+  uint8_t le_resolving_list_size_{};
+  LeMaximumDataLength le_maximum_data_length_{};
+  uint16_t le_maximum_advertising_data_length_{};
+  uint16_t le_suggested_default_data_length_{};
+  uint8_t le_number_supported_advertising_sets_{};
+  uint8_t le_periodic_advertiser_list_size_{};
+  VendorCapabilities vendor_capabilities_{};
 };  // namespace hci
 
 Controller::Controller() : impl_(std::make_unique<impl>(*this)) {}
@@ -1159,5 +1174,104 @@
 std::string Controller::ToString() const {
   return "Controller";
 }
+
+void Controller::impl::Dump(
+    std::promise<flatbuffers::Offset<ControllerData>> promise, flatbuffers::FlatBufferBuilder* fb_builder) const {
+  ASSERT(fb_builder != nullptr);
+  auto title = fb_builder->CreateString("----- Hci Controller Dumpsys -----");
+
+  auto local_version_information_data = CreateLocalVersionInformationData(
+      *fb_builder,
+      fb_builder->CreateString(HciVersionText(local_version_information_.hci_version_)),
+      local_version_information_.hci_revision_,
+      fb_builder->CreateString(LmpVersionText(local_version_information_.lmp_version_)),
+      local_version_information_.manufacturer_name_,
+      local_version_information_.lmp_subversion_);
+
+  auto acl_buffer_size_data = BufferSizeData(acl_buffer_length_, acl_buffers_);
+
+  auto sco_buffer_size_data = BufferSizeData(sco_buffer_length_, sco_buffers_);
+
+  auto le_buffer_size_data =
+      BufferSizeData(le_buffer_size_.le_data_packet_length_, le_buffer_size_.total_num_le_packets_);
+
+  auto iso_buffer_size_data =
+      BufferSizeData(iso_buffer_size_.le_data_packet_length_, iso_buffer_size_.total_num_le_packets_);
+
+  auto le_maximum_data_length_data = LeMaximumDataLengthData(
+      le_maximum_data_length_.supported_max_tx_octets_,
+      le_maximum_data_length_.supported_max_tx_time_,
+      le_maximum_data_length_.supported_max_rx_octets_,
+      le_maximum_data_length_.supported_max_rx_time_);
+
+  std::vector<LocalSupportedCommandsData> local_supported_commands_vector;
+  for (uint8_t index = 0; index < local_supported_commands_.size(); index++) {
+    local_supported_commands_vector.push_back(LocalSupportedCommandsData(index, local_supported_commands_[index]));
+  }
+  auto local_supported_commands_data = fb_builder->CreateVectorOfStructs(local_supported_commands_vector);
+
+  auto vendor_capabilities_data = VendorCapabilitiesData(
+      vendor_capabilities_.is_supported_,
+      vendor_capabilities_.max_advt_instances_,
+      vendor_capabilities_.offloaded_resolution_of_private_address_,
+      vendor_capabilities_.total_scan_results_storage_,
+      vendor_capabilities_.max_irk_list_sz_,
+      vendor_capabilities_.filtering_support_,
+      vendor_capabilities_.max_filter_,
+      vendor_capabilities_.activity_energy_info_support_,
+      vendor_capabilities_.version_supported_,
+      vendor_capabilities_.total_num_of_advt_tracked_,
+      vendor_capabilities_.extended_scan_support_,
+      vendor_capabilities_.debug_logging_supported_,
+      vendor_capabilities_.le_address_generation_offloading_support_,
+      vendor_capabilities_.a2dp_source_offload_capability_mask_,
+      vendor_capabilities_.bluetooth_quality_report_support_);
+
+  auto extended_lmp_features_vector = fb_builder->CreateVector(extended_lmp_features_array_);
+
+  // Create the root table
+  ControllerDataBuilder builder(*fb_builder);
+
+  builder.add_title(title);
+  builder.add_local_version_information(local_version_information_data);
+
+  builder.add_acl_buffer_size(&acl_buffer_size_data);
+  builder.add_sco_buffer_size(&sco_buffer_size_data);
+  builder.add_iso_buffer_size(&iso_buffer_size_data);
+  builder.add_le_buffer_size(&le_buffer_size_data);
+
+  builder.add_le_connect_list_size(le_connect_list_size_);
+  builder.add_le_resolving_list_size(le_resolving_list_size_);
+
+  builder.add_le_maximum_data_length(&le_maximum_data_length_data);
+  builder.add_le_maximum_advertising_data_length(le_maximum_advertising_data_length_);
+  builder.add_le_suggested_default_data_length(le_suggested_default_data_length_);
+  builder.add_le_number_supported_advertising_sets(le_number_supported_advertising_sets_);
+  builder.add_le_periodic_advertiser_list_size(le_periodic_advertiser_list_size_);
+
+  builder.add_local_supported_commands(local_supported_commands_data);
+  builder.add_extended_lmp_features_array(extended_lmp_features_vector);
+  builder.add_le_local_supported_features(le_local_supported_features_);
+  builder.add_le_supported_states(le_supported_states_);
+  builder.add_vendor_capabilities(&vendor_capabilities_data);
+
+  flatbuffers::Offset<ControllerData> dumpsys_data = builder.Finish();
+  promise.set_value(dumpsys_data);
+}
+
+DumpsysDataFinisher Controller::GetDumpsysData(flatbuffers::FlatBufferBuilder* fb_builder) const {
+  ASSERT(fb_builder != nullptr);
+
+  std::promise<flatbuffers::Offset<ControllerData>> promise;
+  auto future = promise.get_future();
+  impl_->Dump(std::move(promise), fb_builder);
+
+  auto dumpsys_data = future.get();
+
+  return [dumpsys_data](DumpsysDataBuilder* dumpsys_builder) {
+    dumpsys_builder->add_hci_controller_dumpsys_data(dumpsys_data);
+  };
+}
+
 }  // namespace hci
 }  // namespace bluetooth
diff --git a/system/gd/hci/controller.h b/system/gd/hci/controller.h
index 1539964..056ea0a 100644
--- a/system/gd/hci/controller.h
+++ b/system/gd/hci/controller.h
@@ -19,6 +19,7 @@
 #include "common/contextual_callback.h"
 #include "hci/address.h"
 #include "hci/hci_packets.h"
+#include "hci_controller_generated.h"
 #include "module.h"
 #include "os/handler.h"
 
@@ -193,6 +194,8 @@
 
   std::string ToString() const override;
 
+  DumpsysDataFinisher GetDumpsysData(flatbuffers::FlatBufferBuilder* builder) const override;  // Module
+
  private:
   virtual uint64_t GetLocalFeatures(uint8_t page_number) const;
   virtual uint64_t GetLocalLeFeatures() const;
diff --git a/system/gd/hci/controller_test.cc b/system/gd/hci/controller_test.cc
index 3b1df9d..6353482 100644
--- a/system/gd/hci/controller_test.cc
+++ b/system/gd/hci/controller_test.cc
@@ -16,12 +16,13 @@
 
 #include "hci/controller.h"
 
+#include <gtest/gtest.h>
+
 #include <algorithm>
 #include <chrono>
 #include <future>
 #include <map>
-
-#include <gtest/gtest.h>
+#include <memory>
 
 #include "common/bind.h"
 #include "common/callback.h"
@@ -31,9 +32,8 @@
 #include "os/thread.h"
 #include "packet/raw_builder.h"
 
-namespace bluetooth {
-namespace hci {
-namespace {
+using namespace bluetooth;
+using namespace std::chrono_literals;
 
 using common::BidiQueue;
 using common::BidiQueueEnd;
@@ -41,11 +41,18 @@
 using packet::PacketView;
 using packet::RawBuilder;
 
+namespace bluetooth {
+namespace hci {
+
+namespace {
+
 constexpr uint16_t kHandle1 = 0x123;
 constexpr uint16_t kCredits1 = 0x78;
 constexpr uint16_t kHandle2 = 0x456;
 constexpr uint16_t kCredits2 = 0x9a;
+constexpr uint64_t kRandomNumber = 0x123456789abcdef0;
 uint16_t feature_spec_version = 55;
+constexpr char title[] = "hci_controller_test";
 
 PacketView<kLittleEndian> GetPacketView(std::unique_ptr<packet::BasePacketBuilder> packet) {
   auto bytes = std::make_shared<std::vector<uint8_t>>();
@@ -55,6 +62,10 @@
   return packet::PacketView<packet::kLittleEndian>(bytes);
 }
 
+}  // namespace
+
+namespace {
+
 class TestHciLayer : public HciLayer {
  public:
   void EnqueueCommand(
@@ -67,7 +78,7 @@
   void EnqueueCommand(
       std::unique_ptr<CommandBuilder> command,
       common::ContextualOnceCallback<void(CommandStatusView)> on_status) override {
-    EXPECT_TRUE(false) << "Controller properties should not generate Command Status";
+    FAIL() << "Controller properties should not generate Command Status";
   }
 
   void HandleCommand(
@@ -185,6 +196,12 @@
         event_builder = LeSetEventMaskCompleteBuilder::Create(num_packets, ErrorCode::SUCCESS);
       } break;
 
+      case (OpCode::LE_RAND): {
+        auto view = LeRandView::Create(LeSecurityCommandView::Create(command));
+        ASSERT_TRUE(view.IsValid());
+        event_builder = LeRandCompleteBuilder::Create(num_packets, ErrorCode::SUCCESS, kRandomNumber);
+      } break;
+
       case (OpCode::RESET):
       case (OpCode::SET_EVENT_FILTER):
       case (OpCode::HOST_BUFFER_SIZE):
@@ -204,12 +221,12 @@
   }
 
   void RegisterEventHandler(EventCode event_code, common::ContextualCallback<void(EventView)> event_handler) override {
-    EXPECT_EQ(event_code, EventCode::NUMBER_OF_COMPLETED_PACKETS) << "Only NUMBER_OF_COMPLETED_PACKETS is needed";
+    ASSERT_EQ(event_code, EventCode::NUMBER_OF_COMPLETED_PACKETS) << "Only NUMBER_OF_COMPLETED_PACKETS is needed";
     number_of_completed_packets_callback_ = event_handler;
   }
 
   void UnregisterEventHandler(EventCode event_code) override {
-    EXPECT_EQ(event_code, EventCode::NUMBER_OF_COMPLETED_PACKETS) << "Only NUMBER_OF_COMPLETED_PACKETS is needed";
+    ASSERT_EQ(event_code, EventCode::NUMBER_OF_COMPLETED_PACKETS) << "Only NUMBER_OF_COMPLETED_PACKETS is needed";
     number_of_completed_packets_callback_ = {};
   }
 
@@ -234,17 +251,15 @@
     std::chrono::milliseconds time = std::chrono::milliseconds(3000);
 
     // wait for command
-    while (command_queue_.size() == 0) {
+    while (command_queue_.size() == 0UL) {
       if (not_empty_.wait_for(lock, time) == std::cv_status::timeout) {
         break;
       }
     }
-    EXPECT_TRUE(command_queue_.size() > 0);
     if (command_queue_.empty()) {
       return CommandView::Create(PacketView<kLittleEndian>(std::make_shared<std::vector<uint8_t>>()));
     }
     CommandView command = command_queue_.front();
-    EXPECT_EQ(command.GetOpCode(), op_code);
     command_queue_.pop();
     return command;
   }
@@ -267,9 +282,11 @@
   std::condition_variable not_empty_;
 };
 
+}  // namespace
 class ControllerTest : public ::testing::Test {
  protected:
   void SetUp() override {
+    feature_spec_version = feature_spec_version_;
     bluetooth::common::InitFlags::SetAllForTesting();
     test_hci_layer_ = new TestHciLayer;
     fake_registry_.InjectTestModule(&HciLayer::Factory, test_hci_layer_);
@@ -287,6 +304,31 @@
   os::Thread& thread_ = fake_registry_.GetTestThread();
   Controller* controller_ = nullptr;
   os::Handler* client_handler_ = nullptr;
+  uint16_t feature_spec_version_ = 98;
+};
+
+class Controller055Test : public ControllerTest {
+ protected:
+  void SetUp() override {
+    feature_spec_version_ = 55;
+    ControllerTest::SetUp();
+  }
+};
+
+class Controller095Test : public ControllerTest {
+ protected:
+  void SetUp() override {
+    feature_spec_version_ = 95;
+    ControllerTest::SetUp();
+  }
+};
+
+class Controller096Test : public ControllerTest {
+ protected:
+  void SetUp() override {
+    feature_spec_version_ = 96;
+    ControllerTest::SetUp();
+  }
 };
 
 TEST_F(ControllerTest, startup_teardown) {}
@@ -305,7 +347,7 @@
   ASSERT_EQ(local_version_information.lmp_subversion_, 0x5678);
   ASSERT_EQ(controller_->GetLeBufferSize().le_data_packet_length_, 0x16);
   ASSERT_EQ(controller_->GetLeBufferSize().total_num_le_packets_, 0x08);
-  ASSERT_EQ(controller_->GetLeSupportedStates(), 0x001f123456789abe);
+  ASSERT_EQ(controller_->GetLeSupportedStates(), 0x001f123456789abeUL);
   ASSERT_EQ(controller_->GetLeMaximumDataLength().supported_max_tx_octets_, 0x12);
   ASSERT_EQ(controller_->GetLeMaximumDataLength().supported_max_tx_time_, 0x34);
   ASSERT_EQ(controller_->GetLeMaximumDataLength().supported_max_rx_octets_, 0x56);
@@ -393,35 +435,32 @@
   ASSERT_FALSE(controller_->IsSupported(OpCode::LE_SET_PERIODIC_ADVERTISING_PARAM));
 }
 
-TEST_F(ControllerTest, feature_spec_version_055_test) {
-  EXPECT_EQ(controller_->GetVendorCapabilities().version_supported_, 55);
-  EXPECT_TRUE(controller_->IsSupported(OpCode::LE_MULTI_ADVT));
-  EXPECT_FALSE(controller_->IsSupported(OpCode::CONTROLLER_DEBUG_INFO));
-  EXPECT_FALSE(controller_->IsSupported(OpCode::CONTROLLER_A2DP_OPCODE));
-  feature_spec_version = 95;
+TEST_F(Controller055Test, feature_spec_version_055_test) {
+  ASSERT_EQ(controller_->GetVendorCapabilities().version_supported_, 55);
+  ASSERT_TRUE(controller_->IsSupported(OpCode::LE_MULTI_ADVT));
+  ASSERT_FALSE(controller_->IsSupported(OpCode::CONTROLLER_DEBUG_INFO));
+  ASSERT_FALSE(controller_->IsSupported(OpCode::CONTROLLER_A2DP_OPCODE));
 }
 
-TEST_F(ControllerTest, feature_spec_version_095_test) {
-  EXPECT_EQ(controller_->GetVendorCapabilities().version_supported_, 95);
-  EXPECT_TRUE(controller_->IsSupported(OpCode::LE_MULTI_ADVT));
-  EXPECT_FALSE(controller_->IsSupported(OpCode::CONTROLLER_DEBUG_INFO));
-  EXPECT_FALSE(controller_->IsSupported(OpCode::CONTROLLER_A2DP_OPCODE));
-  feature_spec_version = 96;
+TEST_F(Controller095Test, feature_spec_version_095_test) {
+  ASSERT_EQ(controller_->GetVendorCapabilities().version_supported_, 95);
+  ASSERT_TRUE(controller_->IsSupported(OpCode::LE_MULTI_ADVT));
+  ASSERT_FALSE(controller_->IsSupported(OpCode::CONTROLLER_DEBUG_INFO));
+  ASSERT_FALSE(controller_->IsSupported(OpCode::CONTROLLER_A2DP_OPCODE));
 }
 
-TEST_F(ControllerTest, feature_spec_version_096_test) {
-  EXPECT_EQ(controller_->GetVendorCapabilities().version_supported_, 96);
-  EXPECT_TRUE(controller_->IsSupported(OpCode::LE_MULTI_ADVT));
-  EXPECT_FALSE(controller_->IsSupported(OpCode::CONTROLLER_DEBUG_INFO));
-  EXPECT_FALSE(controller_->IsSupported(OpCode::CONTROLLER_A2DP_OPCODE));
-  feature_spec_version = 98;
+TEST_F(Controller096Test, feature_spec_version_096_test) {
+  ASSERT_EQ(controller_->GetVendorCapabilities().version_supported_, 96);
+  ASSERT_TRUE(controller_->IsSupported(OpCode::LE_MULTI_ADVT));
+  ASSERT_FALSE(controller_->IsSupported(OpCode::CONTROLLER_DEBUG_INFO));
+  ASSERT_FALSE(controller_->IsSupported(OpCode::CONTROLLER_A2DP_OPCODE));
 }
 
 TEST_F(ControllerTest, feature_spec_version_098_test) {
-  EXPECT_EQ(controller_->GetVendorCapabilities().version_supported_, 98);
-  EXPECT_TRUE(controller_->IsSupported(OpCode::LE_MULTI_ADVT));
-  EXPECT_FALSE(controller_->IsSupported(OpCode::CONTROLLER_DEBUG_INFO));
-  EXPECT_TRUE(controller_->IsSupported(OpCode::CONTROLLER_A2DP_OPCODE));
+  ASSERT_EQ(controller_->GetVendorCapabilities().version_supported_, 98);
+  ASSERT_TRUE(controller_->IsSupported(OpCode::LE_MULTI_ADVT));
+  ASSERT_FALSE(controller_->IsSupported(OpCode::CONTROLLER_DEBUG_INFO));
+  ASSERT_TRUE(controller_->IsSupported(OpCode::CONTROLLER_A2DP_OPCODE));
 }
 
 std::promise<void> credits1_set;
@@ -443,12 +482,18 @@
 }
 
 TEST_F(ControllerTest, aclCreditCallbacksTest) {
+  credits1_set = std::promise<void>();
+  credits2_set = std::promise<void>();
+
+  auto credits1_set_future = credits1_set.get_future();
+  auto credits2_set_future = credits2_set.get_future();
+
   controller_->RegisterCompletedAclPacketsCallback(client_handler_->Bind(&CheckReceivedCredits));
 
   test_hci_layer_->IncomingCredit();
 
-  credits1_set.get_future().wait();
-  credits2_set.get_future().wait();
+  ASSERT_EQ(std::future_status::ready, credits1_set_future.wait_for(2s));
+  ASSERT_EQ(std::future_status::ready, credits2_set_future.wait_for(2s));
 }
 
 TEST_F(ControllerTest, aclCreditCallbackListenerUnregistered) {
@@ -462,6 +507,21 @@
 
   test_hci_layer_->IncomingCredit();
 }
-}  // namespace
+
+std::promise<uint64_t> le_rand_set;
+
+void le_rand_callback(uint64_t random) {
+  le_rand_set.set_value(random);
+}
+
+TEST_F(ControllerTest, Dumpsys) {
+  ModuleDumper dumper(fake_registry_, title);
+
+  std::string output;
+  dumper.DumpState(&output);
+
+  ASSERT_TRUE(output.find("Hci Controller Dumpsys") != std::string::npos);
+}
+
 }  // namespace hci
 }  // namespace bluetooth
diff --git a/system/gd/hci/facade/le_advertising_manager_facade.cc b/system/gd/hci/facade/le_advertising_manager_facade.cc
index fabf790..b51974e 100644
--- a/system/gd/hci/facade/le_advertising_manager_facade.cc
+++ b/system/gd/hci/facade/le_advertising_manager_facade.cc
@@ -109,7 +109,7 @@
       config->connectable = true;
       config->scannable = true;
     } break;
-    case AdvertisingType::ADV_DIRECT_IND: {
+    case AdvertisingType::ADV_DIRECT_IND_HIGH: {
       config->connectable = true;
       config->directed = true;
       config->high_duty_directed_connectable = true;
diff --git a/system/gd/hci/facade/le_scanning_manager_facade.cc b/system/gd/hci/facade/le_scanning_manager_facade.cc
index 60f78f4..10ab163 100644
--- a/system/gd/hci/facade/le_scanning_manager_facade.cc
+++ b/system/gd/hci/facade/le_scanning_manager_facade.cc
@@ -124,15 +124,15 @@
       uint16_t periodic_advertising_interval,
       std::vector<uint8_t> advertising_data) {
     AdvertisingReportMsg advertising_report_msg;
-    std::vector<LeExtendedAdvertisingResponse> advertisements;
-    LeExtendedAdvertisingResponse le_extended_advertising_report;
+    std::vector<LeExtendedAdvertisingResponseRaw> advertisements;
+    LeExtendedAdvertisingResponseRaw le_extended_advertising_report;
     le_extended_advertising_report.address_type_ = (DirectAdvertisingAddressType)address_type;
     le_extended_advertising_report.address_ = address;
     le_extended_advertising_report.advertising_data_ = advertising_data;
     le_extended_advertising_report.rssi_ = rssi;
     advertisements.push_back(le_extended_advertising_report);
 
-    auto builder = LeExtendedAdvertisingReportBuilder::Create(advertisements);
+    auto builder = LeExtendedAdvertisingReportRawBuilder::Create(advertisements);
     std::vector<uint8_t> bytes;
     BitInserter bit_inserter(bytes);
     builder->Serialize(bit_inserter);
diff --git a/system/gd/hci/fuzz/acl_manager_fuzz_test.cc b/system/gd/hci/fuzz/acl_manager_fuzz_test.cc
index 106b3bb..baeeabe 100644
--- a/system/gd/hci/fuzz/acl_manager_fuzz_test.cc
+++ b/system/gd/hci/fuzz/acl_manager_fuzz_test.cc
@@ -21,7 +21,7 @@
 #include "hci/fuzz/fuzz_hci_layer.h"
 #include "hci/hci_layer.h"
 #include "module.h"
-#include "os/fuzz/fake_timerfd.h"
+#include "os/fake_timer/fake_timerfd.h"
 #include "os/log.h"
 
 #include <fuzzer/FuzzedDataProvider.h>
@@ -31,9 +31,9 @@
 using bluetooth::hci::AclManager;
 using bluetooth::hci::HciLayer;
 using bluetooth::hci::fuzz::FuzzHciLayer;
-using bluetooth::os::fuzz::fake_timerfd_advance;
-using bluetooth::os::fuzz::fake_timerfd_cap_at;
-using bluetooth::os::fuzz::fake_timerfd_reset;
+using bluetooth::os::fake_timer::fake_timerfd_advance;
+using bluetooth::os::fake_timer::fake_timerfd_cap_at;
+using bluetooth::os::fake_timer::fake_timerfd_reset;
 
 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
   FuzzedDataProvider dataProvider(data, size);
diff --git a/system/gd/hci/fuzz/hci_layer_fuzz_test.cc b/system/gd/hci/fuzz/hci_layer_fuzz_test.cc
index e6e27d8..60d9bab 100644
--- a/system/gd/hci/fuzz/hci_layer_fuzz_test.cc
+++ b/system/gd/hci/fuzz/hci_layer_fuzz_test.cc
@@ -21,7 +21,7 @@
 #include "hci/fuzz/hci_layer_fuzz_client.h"
 #include "hci/hci_layer.h"
 #include "module.h"
-#include "os/fuzz/fake_timerfd.h"
+#include "os/fake_timer/fake_timerfd.h"
 #include "os/log.h"
 
 #include <fuzzer/FuzzedDataProvider.h>
@@ -31,9 +31,9 @@
 using bluetooth::hal::HciHal;
 using bluetooth::hal::fuzz::FuzzHciHal;
 using bluetooth::hci::fuzz::HciLayerFuzzClient;
-using bluetooth::os::fuzz::fake_timerfd_advance;
-using bluetooth::os::fuzz::fake_timerfd_cap_at;
-using bluetooth::os::fuzz::fake_timerfd_reset;
+using bluetooth::os::fake_timer::fake_timerfd_advance;
+using bluetooth::os::fake_timer::fake_timerfd_cap_at;
+using bluetooth::os::fake_timer::fake_timerfd_reset;
 
 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
   FuzzedDataProvider dataProvider(data, size);
diff --git a/system/gd/hci/hci_acl_manager.fbs b/system/gd/hci/hci_acl_manager.fbs
index a8481eb..689a8e5 100644
--- a/system/gd/hci/hci_acl_manager.fbs
+++ b/system/gd/hci/hci_acl_manager.fbs
@@ -4,6 +4,10 @@
 
 table AclManagerData {
     title:string (privacy:"Any");
+    le_filter_accept_list_count:int (privacy:"Any");
+    le_filter_accept_list:[string] (privacy:"Any");
+    le_connectability_state:string (privacy:"Any");
+    le_create_connection_timeout_alarms_count:int (privacy:"Any");
 }
 
 root_type AclManagerData;
diff --git a/system/gd/hci/hci_controller.fbs b/system/gd/hci/hci_controller.fbs
new file mode 100644
index 0000000..ce142b6
--- /dev/null
+++ b/system/gd/hci/hci_controller.fbs
@@ -0,0 +1,69 @@
+namespace bluetooth.hci;
+
+attribute "privacy";
+
+table LocalVersionInformationData {
+  hci_version : string (privacy:"Any");
+  hci_revision : ushort (privacy:"Any");
+  lmp_version : string (privacy:"Any");
+  manufacturer_name : ushort (privacy:"Any");
+  lmp_subversion : ushort (privacy:"Any");
+}
+
+struct BufferSizeData {
+  data_packet_length : ushort (privacy:"Any");
+  total_num_packets : ubyte (privacy:"Any");
+}
+
+struct LeMaximumDataLengthData {
+ supported_max_tx_octets : ushort (privacy:"Any");
+ supported_max_tx_time : ushort (privacy:"Any");
+ supported_max_rx_octets : ushort (privacy:"Any");
+ supported_max_rx_time : ushort (privacy:"Any");
+}
+
+struct VendorCapabilitiesData {
+  is_supported : ubyte (privacy:"Any");
+  max_advt_instances : ubyte (privacy:"Any");
+  offloaded_resolution_of_private_address : ubyte (privacy:"Any");
+  total_scan_results_storage : ushort (privacy:"Any");
+  max_irk_list_sz : ubyte (privacy:"Any");
+  filtering_support : ubyte (privacy:"Any");
+  max_filter : ubyte (privacy:"Any");
+  activity_energy_info_support : ubyte (privacy:"Any");
+  version_supported : ushort (privacy:"Any");
+  total_num_of_advt_tracked : ushort (privacy:"Any");
+  extended_scan_support : ubyte (privacy:"Any");
+  debug_logging_supported : ubyte (privacy:"Any");
+  le_address_generation_offloading_support : ubyte (privacy:"Any");
+  a2dp_source_offload_capability_mask : uint (privacy:"Any");
+  bluetooth_quality_report_support : ubyte (privacy:"Any");
+}
+
+struct LocalSupportedCommandsData {
+  index : ubyte (privacy:"Any");
+  value: ubyte (privacy:"Any");
+}
+
+table ControllerData {
+  title : string (privacy:"Any");
+  local_version_information : LocalVersionInformationData (privacy:"Any");
+  acl_buffer_size : BufferSizeData (privacy:"Any");
+  sco_buffer_size : BufferSizeData (privacy:"Any");
+  iso_buffer_size : BufferSizeData (privacy:"Any");
+  le_buffer_size : BufferSizeData (privacy:"Any");
+  le_connect_list_size : uint64 (privacy:"Any");
+  le_resolving_list_size : uint64 (privacy:"Any");
+  le_maximum_data_length : LeMaximumDataLengthData (privacy:"Any");
+  le_maximum_advertising_data_length : ushort (privacy:"Any");
+  le_suggested_default_data_length : ushort (privacy:"Any");
+  le_number_supported_advertising_sets : ubyte (privacy:"Any");
+  le_periodic_advertiser_list_size : ubyte (privacy:"Any");
+  local_supported_commands : [LocalSupportedCommandsData] (privacy:"Any");
+  extended_lmp_features_array : [uint64] (privacy:"Any");
+  le_local_supported_features : int64 (privacy:"Any");
+  le_supported_states : uint64 (privacy:"Any");
+  vendor_capabilities : VendorCapabilitiesData (privacy:"Any");
+}
+
+root_type ControllerData;
diff --git a/system/gd/hci/hci_layer.cc b/system/gd/hci/hci_layer.cc
index 57d7e55..5def729 100644
--- a/system/gd/hci/hci_layer.cc
+++ b/system/gd/hci/hci_layer.cc
@@ -364,9 +364,9 @@
       auto view = VendorSpecificEventView::Create(event);
       ASSERT(view.IsValid());
       if (view.GetSubeventCode() == VseSubeventCode::BQR_EVENT) {
-        auto bqr_quality_view = BqrLinkQualityEventView::Create(BqrEventView::Create(view));
-        auto inflammation = BqrRootInflammationEventView::Create(bqr_quality_view);
-        if (bqr_quality_view.IsValid() && inflammation.IsValid()) {
+        auto bqr_event = BqrEventView::Create(view);
+        auto inflammation = BqrRootInflammationEventView::Create(bqr_event);
+        if (bqr_event.IsValid() && inflammation.IsValid()) {
           handle_root_inflammation(inflammation.GetVendorSpecificErrorCode());
           return;
         }
@@ -650,8 +650,8 @@
   RegisterEventHandler(EventCode::PAGE_SCAN_REPETITION_MODE_CHANGE, drop_packet);
   RegisterEventHandler(EventCode::MAX_SLOTS_CHANGE, drop_packet);
 
-  EnqueueCommand(ResetBuilder::Create(), handler->BindOnce(&fail_if_reset_complete_not_success));
   hal->registerIncomingPacketCallback(hal_callbacks_);
+  EnqueueCommand(ResetBuilder::Create(), handler->BindOnce(&fail_if_reset_complete_not_success));
 }
 
 void HciLayer::Stop() {
diff --git a/system/gd/hci/hci_layer_fake.cc b/system/gd/hci/hci_layer_fake.cc
new file mode 100644
index 0000000..3000c56
--- /dev/null
+++ b/system/gd/hci/hci_layer_fake.cc
@@ -0,0 +1,229 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "hci/hci_layer_fake.h"
+
+#include <gmock/gmock.h>
+#include <gtest/gtest.h>
+
+#include <algorithm>
+#include <chrono>
+
+namespace bluetooth {
+namespace hci {
+
+using common::BidiQueue;
+using common::BidiQueueEnd;
+using packet::kLittleEndian;
+using packet::PacketView;
+using packet::RawBuilder;
+
+PacketView<packet::kLittleEndian> GetPacketView(std::unique_ptr<packet::BasePacketBuilder> packet) {
+  auto bytes = std::make_shared<std::vector<uint8_t>>();
+  BitInserter i(*bytes);
+  bytes->reserve(packet->size());
+  packet->Serialize(i);
+  return packet::PacketView<packet::kLittleEndian>(bytes);
+}
+
+std::unique_ptr<BasePacketBuilder> NextPayload(uint16_t handle) {
+  static uint32_t packet_number = 1;
+  auto payload = std::make_unique<RawBuilder>();
+  payload->AddOctets2(6);  // L2CAP PDU size
+  payload->AddOctets2(2);  // L2CAP CID
+  payload->AddOctets2(handle);
+  payload->AddOctets4(packet_number++);
+  return std::move(payload);
+}
+
+static std::unique_ptr<AclBuilder> NextAclPacket(uint16_t handle) {
+  PacketBoundaryFlag packet_boundary_flag = PacketBoundaryFlag::FIRST_AUTOMATICALLY_FLUSHABLE;
+  BroadcastFlag broadcast_flag = BroadcastFlag::POINT_TO_POINT;
+  return AclBuilder::Create(handle, packet_boundary_flag, broadcast_flag, NextPayload(handle));
+}
+
+void TestHciLayer::EnqueueCommand(
+    std::unique_ptr<CommandBuilder> command, common::ContextualOnceCallback<void(CommandStatusView)> on_status) {
+  std::lock_guard<std::mutex> lock(mutex_);
+
+  command_queue_.push(std::move(command));
+  command_status_callbacks.push_back(std::move(on_status));
+
+  if (command_queue_.size() == 1) {
+    // since GetCommand may replace this promise, we have to do this inside the lock
+    command_promise_.set_value();
+  }
+}
+
+void TestHciLayer::EnqueueCommand(
+    std::unique_ptr<CommandBuilder> command, common::ContextualOnceCallback<void(CommandCompleteView)> on_complete) {
+  std::lock_guard<std::mutex> lock(mutex_);
+
+  command_queue_.push(std::move(command));
+  command_complete_callbacks.push_back(std::move(on_complete));
+
+  if (command_queue_.size() == 1) {
+    // since GetCommand may replace this promise, we have to do this inside the lock
+    command_promise_.set_value();
+  }
+}
+
+CommandView TestHciLayer::GetCommand() {
+  EXPECT_EQ(command_future_.wait_for(std::chrono::milliseconds(1000)), std::future_status::ready);
+
+  std::lock_guard<std::mutex> lock(mutex_);
+
+  if (command_queue_.empty()) {
+    LOG_ERROR("Command queue is empty");
+    return empty_command_view_;
+  }
+
+  auto last = std::move(command_queue_.front());
+  command_queue_.pop();
+
+  if (command_queue_.empty()) {
+    command_promise_ = {};
+    command_future_ = command_promise_.get_future();
+  }
+
+  CommandView command_packet_view = CommandView::Create(GetPacketView(std::move(last)));
+  ASSERT_LOG(command_packet_view.IsValid(), "Got invalid command");
+  return command_packet_view;
+}
+
+void TestHciLayer::RegisterEventHandler(
+    EventCode event_code, common::ContextualCallback<void(EventView)> event_handler) {
+  registered_events_[event_code] = event_handler;
+}
+
+void TestHciLayer::UnregisterEventHandler(EventCode event_code) {
+  registered_events_.erase(event_code);
+}
+
+void TestHciLayer::RegisterLeEventHandler(
+    SubeventCode subevent_code, common::ContextualCallback<void(LeMetaEventView)> event_handler) {
+  registered_le_events_[subevent_code] = event_handler;
+}
+
+void TestHciLayer::UnregisterLeEventHandler(SubeventCode subevent_code) {
+  registered_le_events_.erase(subevent_code);
+}
+
+void TestHciLayer::IncomingEvent(std::unique_ptr<EventBuilder> event_builder) {
+  auto packet = GetPacketView(std::move(event_builder));
+  EventView event = EventView::Create(packet);
+  ASSERT_TRUE(event.IsValid());
+  EventCode event_code = event.GetEventCode();
+  if (event_code == EventCode::COMMAND_COMPLETE) {
+    CommandCompleteCallback(event);
+  } else if (event_code == EventCode::COMMAND_STATUS) {
+    CommandStatusCallback(event);
+  } else {
+    ASSERT_NE(registered_events_.find(event_code), registered_events_.end()) << EventCodeText(event_code);
+    registered_events_[event_code].Invoke(event);
+  }
+}
+
+void TestHciLayer::IncomingLeMetaEvent(std::unique_ptr<LeMetaEventBuilder> event_builder) {
+  auto packet = GetPacketView(std::move(event_builder));
+  EventView event = EventView::Create(packet);
+  LeMetaEventView meta_event_view = LeMetaEventView::Create(event);
+  ASSERT_TRUE(meta_event_view.IsValid());
+  SubeventCode subevent_code = meta_event_view.GetSubeventCode();
+  ASSERT_TRUE(registered_le_events_.find(subevent_code) != registered_le_events_.end());
+  registered_le_events_[subevent_code].Invoke(meta_event_view);
+}
+
+void TestHciLayer::CommandCompleteCallback(EventView event) {
+  CommandCompleteView complete_view = CommandCompleteView::Create(event);
+  ASSERT_TRUE(complete_view.IsValid());
+  std::move(command_complete_callbacks.front()).Invoke(complete_view);
+  command_complete_callbacks.pop_front();
+}
+
+void TestHciLayer::CommandStatusCallback(EventView event) {
+  CommandStatusView status_view = CommandStatusView::Create(event);
+  ASSERT_TRUE(status_view.IsValid());
+  std::move(command_status_callbacks.front()).Invoke(status_view);
+  command_status_callbacks.pop_front();
+}
+
+void TestHciLayer::InitEmptyCommand() {
+  auto payload = std::make_unique<bluetooth::packet::RawBuilder>();
+  auto command_builder = CommandBuilder::Create(OpCode::NONE, std::move(payload));
+  empty_command_view_ = CommandView::Create(GetPacketView(std::move(command_builder)));
+  ASSERT_TRUE(empty_command_view_.IsValid());
+}
+
+void TestHciLayer::IncomingAclData(uint16_t handle) {
+  os::Handler* hci_handler = GetHandler();
+  auto* queue_end = acl_queue_.GetDownEnd();
+  std::promise<void> promise;
+  auto future = promise.get_future();
+  queue_end->RegisterEnqueue(
+      hci_handler,
+      common::Bind(
+          [](decltype(queue_end) queue_end, uint16_t handle, std::promise<void> promise) {
+            auto packet = GetPacketView(NextAclPacket(handle));
+            AclView acl2 = AclView::Create(packet);
+            queue_end->UnregisterEnqueue();
+            promise.set_value();
+            return std::make_unique<AclView>(acl2);
+          },
+          queue_end,
+          handle,
+          common::Passed(std::move(promise))));
+  auto status = future.wait_for(std::chrono::milliseconds(1000));
+  ASSERT_EQ(status, std::future_status::ready);
+}
+
+void TestHciLayer::AssertNoOutgoingAclData() {
+  auto queue_end = acl_queue_.GetDownEnd();
+  EXPECT_EQ(queue_end->TryDequeue(), nullptr);
+}
+
+PacketView<kLittleEndian> TestHciLayer::OutgoingAclData() {
+  auto queue_end = acl_queue_.GetDownEnd();
+  std::unique_ptr<AclBuilder> received;
+  do {
+    received = queue_end->TryDequeue();
+  } while (received == nullptr);
+
+  return GetPacketView(std::move(received));
+}
+
+BidiQueueEnd<AclBuilder, AclView>* TestHciLayer::GetAclQueueEnd() {
+  return acl_queue_.GetUpEnd();
+}
+
+void TestHciLayer::Disconnect(uint16_t handle, ErrorCode reason) {
+  GetHandler()->Post(
+      common::BindOnce(&TestHciLayer::do_disconnect, common::Unretained(this), handle, reason));
+}
+
+void TestHciLayer::do_disconnect(uint16_t handle, ErrorCode reason) {
+  HciLayer::Disconnect(handle, reason);
+}
+
+void TestHciLayer::ListDependencies(ModuleList* list) const {}
+void TestHciLayer::Start() {
+  std::lock_guard<std::mutex> lock(mutex_);
+  InitEmptyCommand();
+}
+void TestHciLayer::Stop() {}
+
+}  // namespace hci
+}  // namespace bluetooth
\ No newline at end of file
diff --git a/system/gd/hci/hci_layer_fake.h b/system/gd/hci/hci_layer_fake.h
new file mode 100644
index 0000000..a2c3ea1
--- /dev/null
+++ b/system/gd/hci/hci_layer_fake.h
@@ -0,0 +1,111 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <future>
+#include <map>
+
+#include "common/bind.h"
+#include "hci/address.h"
+#include "hci/hci_layer.h"
+#include "packet/raw_builder.h"
+
+namespace bluetooth {
+namespace hci {
+
+packet::PacketView<packet::kLittleEndian> GetPacketView(
+    std::unique_ptr<packet::BasePacketBuilder> packet);
+
+std::unique_ptr<BasePacketBuilder> NextPayload(uint16_t handle);
+
+class TestHciLayer : public HciLayer {
+ public:
+  void EnqueueCommand(
+      std::unique_ptr<CommandBuilder> command,
+      common::ContextualOnceCallback<void(CommandStatusView)> on_status) override;
+
+  void EnqueueCommand(
+      std::unique_ptr<CommandBuilder> command,
+      common::ContextualOnceCallback<void(CommandCompleteView)> on_complete) override;
+
+  CommandView GetCommand();
+
+  void RegisterEventHandler(EventCode event_code, common::ContextualCallback<void(EventView)> event_handler) override;
+
+  void UnregisterEventHandler(EventCode event_code) override;
+
+  void RegisterLeEventHandler(
+      SubeventCode subevent_code, common::ContextualCallback<void(LeMetaEventView)> event_handler) override;
+
+  void UnregisterLeEventHandler(SubeventCode subevent_code) override;
+
+  void IncomingEvent(std::unique_ptr<EventBuilder> event_builder);
+
+  void IncomingLeMetaEvent(std::unique_ptr<LeMetaEventBuilder> event_builder);
+
+  void CommandCompleteCallback(EventView event);
+
+  void CommandStatusCallback(EventView event);
+
+  void IncomingAclData(uint16_t handle);
+
+  void AssertNoOutgoingAclData();
+
+  packet::PacketView<packet::kLittleEndian> OutgoingAclData();
+
+  common::BidiQueueEnd<AclBuilder, AclView>* GetAclQueueEnd() override;
+
+  void Disconnect(uint16_t handle, ErrorCode reason) override;
+
+ protected:
+  void ListDependencies(ModuleList* list) const override;
+  void Start() override;
+  void Stop() override;
+
+ private:
+  void InitEmptyCommand();
+  void do_disconnect(uint16_t handle, ErrorCode reason);
+
+  // Handler-only state. Mutexes are not needed when accessing these fields.
+  std::list<common::ContextualOnceCallback<void(CommandCompleteView)>> command_complete_callbacks;
+  std::list<common::ContextualOnceCallback<void(CommandStatusView)>> command_status_callbacks;
+  std::map<EventCode, common::ContextualCallback<void(EventView)>> registered_events_;
+  std::map<SubeventCode, common::ContextualCallback<void(LeMetaEventView)>> registered_le_events_;
+
+  // thread-safe
+  common::BidiQueue<AclView, AclBuilder> acl_queue_{3 /* TODO: Set queue depth */};
+
+  // Most operations must acquire this mutex before manipulating shared state. The ONLY exception
+  // is blocking on a promise, IF your thread is the only one mutating it. Note that SETTING a
+  // promise REQUIRES a lock, since another thread may replace the promise while you are doing so.
+  mutable std::mutex mutex_{};
+
+  // Shared state between the test and stack threads
+  std::queue<std::unique_ptr<CommandBuilder>> command_queue_;
+
+  // We start with Consumed=Set, Command=Unset.
+  // When a command is enqueued, we set Command=set
+  // When a command is popped, we block until Command=Set, then (if the queue is now empty) we
+  // reset Command=Unset and set Consumed=Set. This way we emulate a blocking queue.
+  std::promise<void> command_promise_{};  // Set when at least one command is in the queue
+  std::future<void> command_future_ =
+      command_promise_.get_future();  // GetCommand() blocks until this is fulfilled
+
+  CommandView empty_command_view_ = CommandView::Create(
+      PacketView<packet::kLittleEndian>(std::make_shared<std::vector<uint8_t>>()));
+};
+
+}  // namespace hci
+}  // namespace bluetooth
\ No newline at end of file
diff --git a/system/gd/hci/hci_layer_test.cc b/system/gd/hci/hci_layer_test.cc
index b0aaeaa..8735dcb 100644
--- a/system/gd/hci/hci_layer_test.cc
+++ b/system/gd/hci/hci_layer_test.cc
@@ -60,6 +60,7 @@
 
 namespace bluetooth {
 namespace hci {
+namespace {
 
 constexpr std::chrono::milliseconds kTimeout = HciLayer::kHciTimeoutMs / 2;
 constexpr std::chrono::milliseconds kAclTimeout = std::chrono::milliseconds(1000);
@@ -83,18 +84,18 @@
   void sendHciCommand(hal::HciPacket command) override {
     outgoing_commands_.push_back(std::move(command));
     if (sent_command_promise_ != nullptr) {
-      auto promise = std::move(sent_command_promise_);
-      sent_command_promise_.reset();
-      promise->set_value();
+      std::promise<void>* prom = sent_command_promise_.release();
+      prom->set_value();
+      delete prom;
     }
   }
 
   void sendAclData(hal::HciPacket data) override {
     outgoing_acl_.push_back(std::move(data));
     if (sent_acl_promise_ != nullptr) {
-      auto promise = std::move(sent_acl_promise_);
-      sent_acl_promise_.reset();
-      promise->set_value();
+      std::promise<void>* prom = sent_acl_promise_.release();
+      prom->set_value();
+      delete prom;
     }
   }
 
@@ -105,9 +106,9 @@
   void sendIsoData(hal::HciPacket data) override {
     outgoing_iso_.push_back(std::move(data));
     if (sent_iso_promise_ != nullptr) {
-      auto promise = std::move(sent_iso_promise_);
-      sent_iso_promise_.reset();
-      promise->set_value();
+      std::promise<void>* prom = sent_iso_promise_.release();
+      prom->set_value();
+      delete prom;
     }
   }
 
@@ -290,7 +291,7 @@
     hci_->GetIsoQueueEnd()->UnregisterDequeue();
   }
 
-  void ListDependencies(ModuleList* list) {
+  void ListDependencies(ModuleList* list) const {
     list->add<HciLayer>();
   }
 
@@ -390,14 +391,14 @@
     ASSERT_EQ(reset_sent_status, std::future_status::ready);
 
     // Verify that reset was received
-    ASSERT_EQ(1, hal->GetNumSentCommands());
+    ASSERT_EQ(1u, hal->GetNumSentCommands());
 
     auto sent_command = hal->GetSentCommand();
     auto reset_view = ResetView::Create(CommandView::Create(sent_command));
     ASSERT_TRUE(reset_view.IsValid());
 
     // Verify that only one was sent
-    ASSERT_EQ(0, hal->GetNumSentCommands());
+    ASSERT_EQ(0u, hal->GetNumSentCommands());
 
     // Send the response event
     uint8_t num_packets = 1;
@@ -457,7 +458,7 @@
   ASSERT_TRUE(LeConnectionCompleteView::Create(LeMetaEventView::Create(EventView::Create(event))).IsValid());
 }
 
-TEST_F(HciTest, hciTimeOut) {
+TEST_F(HciTest, DISABLED_hciTimeOut) {
   auto event_future = upper->GetReceivedEventFuture();
   auto reset_command_future = hal->GetSentCommandFuture();
   upper->SendHciCommandExpectingComplete(ResetBuilder::Create());
@@ -478,7 +479,7 @@
 }
 
 TEST_F(HciTest, noOpCredits) {
-  ASSERT_EQ(0, hal->GetNumSentCommands());
+  ASSERT_EQ(0u, hal->GetNumSentCommands());
 
   // Send 0 credits
   uint8_t num_packets = 0;
@@ -488,7 +489,7 @@
   upper->SendHciCommandExpectingComplete(ReadLocalVersionInformationBuilder::Create());
 
   // Verify that nothing was sent
-  ASSERT_EQ(0, hal->GetNumSentCommands());
+  ASSERT_EQ(0u, hal->GetNumSentCommands());
 
   num_packets = 1;
   hal->callbacks->hciEventReceived(GetPacketBytes(NoCommandCompleteBuilder::Create(num_packets)));
@@ -497,7 +498,7 @@
   ASSERT_EQ(command_sent_status, std::future_status::ready);
 
   // Verify that one was sent
-  ASSERT_EQ(1, hal->GetNumSentCommands());
+  ASSERT_EQ(1u, hal->GetNumSentCommands());
 
   auto event_future = upper->GetReceivedEventFuture();
 
@@ -522,7 +523,7 @@
 }
 
 TEST_F(HciTest, creditsTest) {
-  ASSERT_EQ(0, hal->GetNumSentCommands());
+  ASSERT_EQ(0u, hal->GetNumSentCommands());
 
   auto command_future = hal->GetSentCommandFuture();
 
@@ -535,14 +536,14 @@
   ASSERT_EQ(command_sent_status, std::future_status::ready);
 
   // Verify that the first one is sent
-  ASSERT_EQ(1, hal->GetNumSentCommands());
+  ASSERT_EQ(1u, hal->GetNumSentCommands());
 
   auto sent_command = hal->GetSentCommand();
   auto version_view = ReadLocalVersionInformationView::Create(CommandView::Create(sent_command));
   ASSERT_TRUE(version_view.IsValid());
 
   // Verify that only one was sent
-  ASSERT_EQ(0, hal->GetNumSentCommands());
+  ASSERT_EQ(0u, hal->GetNumSentCommands());
 
   // Get a new future
   auto event_future = upper->GetReceivedEventFuture();
@@ -570,14 +571,14 @@
   // Verify that the second one is sent
   command_sent_status = command_future.wait_for(kTimeout);
   ASSERT_EQ(command_sent_status, std::future_status::ready);
-  ASSERT_EQ(1, hal->GetNumSentCommands());
+  ASSERT_EQ(1u, hal->GetNumSentCommands());
 
   sent_command = hal->GetSentCommand();
   auto supported_commands_view = ReadLocalSupportedCommandsView::Create(CommandView::Create(sent_command));
   ASSERT_TRUE(supported_commands_view.IsValid());
 
   // Verify that only one was sent
-  ASSERT_EQ(0, hal->GetNumSentCommands());
+  ASSERT_EQ(0u, hal->GetNumSentCommands());
   event_future = upper->GetReceivedEventFuture();
   command_future = hal->GetSentCommandFuture();
 
@@ -598,14 +599,14 @@
   // Verify that the third one is sent
   command_sent_status = command_future.wait_for(kTimeout);
   ASSERT_EQ(command_sent_status, std::future_status::ready);
-  ASSERT_EQ(1, hal->GetNumSentCommands());
+  ASSERT_EQ(1u, hal->GetNumSentCommands());
 
   sent_command = hal->GetSentCommand();
   auto supported_features_view = ReadLocalSupportedFeaturesView::Create(CommandView::Create(sent_command));
   ASSERT_TRUE(supported_features_view.IsValid());
 
   // Verify that only one was sent
-  ASSERT_EQ(0, hal->GetNumSentCommands());
+  ASSERT_EQ(0u, hal->GetNumSentCommands());
   event_future = upper->GetReceivedEventFuture();
 
   // Send the response event
@@ -631,7 +632,7 @@
 
   // Check the command
   auto sent_command = hal->GetSentCommand();
-  ASSERT_LT(0, sent_command.size());
+  ASSERT_LT(0u, sent_command.size());
   LeRandView view = LeRandView::Create(LeSecurityCommandView::Create(CommandView::Create(sent_command)));
   ASSERT_TRUE(view.IsValid());
 
@@ -662,7 +663,7 @@
 
   // Check the command
   auto sent_command = hal->GetSentCommand();
-  ASSERT_LT(0, sent_command.size());
+  ASSERT_LT(0u, sent_command.size());
   auto view = WriteSimplePairingModeView::Create(SecurityCommandView::Create(CommandView::Create(sent_command)));
   ASSERT_TRUE(view.IsValid());
 
@@ -699,7 +700,7 @@
 
   // Check the command
   auto sent_command = hal->GetSentCommand();
-  ASSERT_LT(0, sent_command.size());
+  ASSERT_LT(0u, sent_command.size());
   CreateConnectionView view = CreateConnectionView::Create(
       ConnectionManagementCommandView::Create(AclCommandView::Create(CommandView::Create(sent_command))));
   ASSERT_TRUE(view.IsValid());
@@ -776,7 +777,7 @@
   auto sent_acl_status = sent_acl_future.wait_for(kAclTimeout);
   ASSERT_EQ(sent_acl_status, std::future_status::ready);
   auto sent_acl = hal->GetSentAcl();
-  ASSERT_LT(0, sent_acl.size());
+  ASSERT_LT(0u, sent_acl.size());
   AclView sent_acl_view = AclView::Create(sent_acl);
   ASSERT_TRUE(sent_acl_view.IsValid());
   ASSERT_EQ(bd_addr.length() + sizeof(handle), sent_acl_view.GetPayload().size());
@@ -904,5 +905,7 @@
   ASSERT_EQ(handle, itr.extract<uint16_t>());
   ASSERT_EQ(received_packets, itr.extract<uint16_t>());
 }
+
+}  // namespace
 }  // namespace hci
 }  // namespace bluetooth
diff --git a/system/gd/hci/hci_layer_unittest.cc b/system/gd/hci/hci_layer_unittest.cc
new file mode 100644
index 0000000..d4c2423
--- /dev/null
+++ b/system/gd/hci/hci_layer_unittest.cc
@@ -0,0 +1,227 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "hci/hci_layer.h"
+
+#include <gtest/gtest.h>
+
+#include <chrono>
+#include <future>
+
+#include "common/bind.h"
+#include "common/init_flags.h"
+#include "common/testing/log_capture.h"
+#include "hal/hci_hal.h"
+#include "hci/address.h"
+#include "hci/address_with_type.h"
+#include "hci/class_of_device.h"
+#include "hci/controller.h"
+#include "module.h"
+#include "os/fake_timer/fake_timerfd.h"
+#include "os/handler.h"
+#include "os/thread.h"
+#include "packet/raw_builder.h"
+
+using namespace std::chrono_literals;
+
+namespace bluetooth {
+namespace hci {
+
+using common::BidiQueue;
+using common::BidiQueueEnd;
+using common::InitFlags;
+using os::fake_timer::fake_timerfd_advance;
+using packet::kLittleEndian;
+using packet::PacketView;
+using packet::RawBuilder;
+using testing::LogCapture;
+
+std::vector<uint8_t> GetPacketBytes(std::unique_ptr<packet::BasePacketBuilder> packet) {
+  std::vector<uint8_t> bytes;
+  BitInserter i(bytes);
+  bytes.reserve(packet->size());
+  packet->Serialize(i);
+  return bytes;
+}
+
+std::unique_ptr<packet::BasePacketBuilder> CreatePayload(std::vector<uint8_t> payload) {
+  auto raw_builder = std::make_unique<packet::RawBuilder>();
+  raw_builder->AddOctets(payload);
+  return raw_builder;
+}
+
+class TestHciHal : public hal::HciHal {
+ public:
+  TestHciHal() : hal::HciHal() {}
+
+  ~TestHciHal() {
+    ASSERT_LOG(callbacks == nullptr, "unregisterIncomingPacketCallback() must be called");
+  }
+
+  void registerIncomingPacketCallback(hal::HciHalCallbacks* callback) override {
+    callbacks = callback;
+  }
+
+  void unregisterIncomingPacketCallback() override {
+    callbacks = nullptr;
+  }
+
+  void sendHciCommand(hal::HciPacket command) override {
+    outgoing_commands_.push_back(std::move(command));
+    LOG_DEBUG("Enqueued HCI command in HAL.");
+  }
+
+  void sendScoData(hal::HciPacket data) override {}
+  void sendIsoData(hal::HciPacket data) override {}
+  void sendAclData(hal::HciPacket data) override {}
+
+  hal::HciHalCallbacks* callbacks = nullptr;
+
+  PacketView<kLittleEndian> GetPacketView(hal::HciPacket data) {
+    auto shared = std::make_shared<std::vector<uint8_t>>(data);
+    return PacketView<kLittleEndian>(shared);
+  }
+
+  CommandView GetSentCommand() {
+    auto packetview = GetPacketView(std::move(outgoing_commands_.front()));
+    outgoing_commands_.pop_front();
+    return CommandView::Create(packetview);
+  }
+
+  void Start() override {}
+
+  void Stop() override {}
+
+  void ListDependencies(ModuleList*) const override {}
+
+  int GetPendingCommands() {
+    return outgoing_commands_.size();
+  }
+
+  void InjectEvent(std::unique_ptr<packet::BasePacketBuilder> packet) {
+    callbacks->hciEventReceived(GetPacketBytes(std::move(packet)));
+  }
+
+  std::string ToString() const override {
+    return std::string("TestHciHal");
+  }
+
+  static const ModuleFactory Factory;
+
+ private:
+  std::list<hal::HciPacket> outgoing_commands_;
+  std::unique_ptr<std::promise<void>> sent_command_promise_;
+};
+
+const ModuleFactory TestHciHal::Factory = ModuleFactory([]() { return new TestHciHal(); });
+
+class HciLayerTest : public ::testing::Test {
+ protected:
+  void SetUp() override {
+    log_capture_ = std::make_unique<LogCapture>();
+    hal_ = new TestHciHal();
+    fake_registry_.InjectTestModule(&hal::HciHal::Factory, hal_);
+    fake_registry_.Start<HciLayer>(&fake_registry_.GetTestThread());
+    hci_ = static_cast<HciLayer*>(fake_registry_.GetModuleUnderTest(&HciLayer::Factory));
+    hci_handler_ = fake_registry_.GetTestModuleHandler(&HciLayer::Factory);
+    ASSERT_TRUE(fake_registry_.IsStarted<HciLayer>());
+    ::testing::FLAGS_gtest_death_test_style = "threadsafe";
+    InitFlags::SetAllForTesting();
+  }
+
+  void TearDown() override {
+    fake_registry_.SynchronizeModuleHandler(&HciLayer::Factory, std::chrono::milliseconds(20));
+    fake_registry_.StopAll();
+  }
+
+  void FakeTimerAdvance(uint64_t ms) {
+    hci_handler_->Post(common::BindOnce(fake_timerfd_advance, ms));
+  }
+
+  void FailIfResetNotSent() {
+    std::promise<void> promise;
+    log_capture_->WaitUntilLogContains(&promise, "Enqueued HCI command in HAL.");
+    auto sent_command = hal_->GetSentCommand();
+    auto reset_view = ResetView::Create(CommandView::Create(sent_command));
+    ASSERT_TRUE(reset_view.IsValid());
+  }
+
+  TestHciHal* hal_ = nullptr;
+  HciLayer* hci_ = nullptr;
+  os::Handler* hci_handler_ = nullptr;
+  TestModuleRegistry fake_registry_;
+  std::unique_ptr<LogCapture> log_capture_;
+};
+
+TEST_F(HciLayerTest, setup_teardown) {}
+
+// b/260915548
+TEST_F(HciLayerTest, DISABLED_reset_command_sent_on_start) {
+  FailIfResetNotSent();
+}
+
+// b/260915548
+TEST_F(HciLayerTest, DISABLED_controller_debug_info_requested_on_hci_timeout) {
+  FailIfResetNotSent();
+  FakeTimerAdvance(HciLayer::kHciTimeoutMs.count());
+
+  std::promise<void> promise;
+  log_capture_->WaitUntilLogContains(&promise, "Enqueued HCI command in HAL.");
+  auto sent_command = hal_->GetSentCommand();
+  auto debug_info_view = ControllerDebugInfoView::Create(VendorCommandView::Create(sent_command));
+  ASSERT_TRUE(debug_info_view.IsValid());
+}
+
+// b/260915548
+TEST_F(HciLayerTest, DISABLED_abort_after_hci_restart_timeout) {
+  FailIfResetNotSent();
+  FakeTimerAdvance(HciLayer::kHciTimeoutMs.count());
+
+  std::promise<void> promise;
+  log_capture_->WaitUntilLogContains(&promise, "Enqueued HCI command in HAL.");
+  auto sent_command = hal_->GetSentCommand();
+  auto debug_info_view = ControllerDebugInfoView::Create(VendorCommandView::Create(sent_command));
+  ASSERT_TRUE(debug_info_view.IsValid());
+
+  ASSERT_DEATH(
+      {
+        FakeTimerAdvance(HciLayer::kHciTimeoutRestartMs.count());
+        std::promise<void> promise;
+        log_capture_->WaitUntilLogContains(&promise, "Done waiting for debug information after HCI timeout");
+      },
+      "");
+}
+
+// b/260915548
+TEST_F(HciLayerTest, DISABLED_abort_on_root_inflammation_event) {
+  FailIfResetNotSent();
+
+  auto payload = CreatePayload({'0'});
+  auto root_inflammation_event = BqrRootInflammationEventBuilder::Create(0x01, 0x01, std::move(payload));
+  hal_->InjectEvent(std::move(root_inflammation_event));
+  std::promise<void> promise;
+  log_capture_->WaitUntilLogContains(&promise, "Received a Root Inflammation Event");
+  ASSERT_DEATH(
+      {
+        FakeTimerAdvance(HciLayer::kHciTimeoutRestartMs.count());
+        std::promise<void> promise;
+        log_capture_->WaitUntilLogContains(&promise, "Root inflammation with reason");
+      },
+      "");
+}
+
+}  // namespace hci
+}  // namespace bluetooth
diff --git a/system/gd/hci/hci_metrics_logging.cc b/system/gd/hci/hci_metrics_logging.cc
index 9c864ac..fcb4c39 100644
--- a/system/gd/hci/hci_metrics_logging.cc
+++ b/system/gd/hci/hci_metrics_logging.cc
@@ -13,10 +13,12 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
+#include "hci/hci_metrics_logging.h"
+
 #include <frameworks/proto_logging/stats/enums/bluetooth/hci/enums.pb.h>
 
+#include "common/audit_log.h"
 #include "common/strings.h"
-#include "hci/hci_metrics_logging.h"
 #include "os/metrics.h"
 #include "storage/device.h"
 
@@ -517,6 +519,10 @@
           connection_handle,
           status,
           storage_module);
+
+      if (status != ErrorCode::SUCCESS) {
+        common::LogConnectionAdminAuditEvent("Connecting", address, status);
+      }
       break;
     }
     case EventCode::CONNECTION_REQUEST: {
@@ -594,6 +600,12 @@
       static_cast<uint16_t>(leEvt),
       static_cast<uint16_t>(status),
       static_cast<uint16_t>(reason));
+
+  if (status != ErrorCode::SUCCESS && status != ErrorCode::UNKNOWN_CONNECTION) {
+    // ERROR CODE 0x02, unknown connection identifier, means connection attempt was cancelled by host, so probably no
+    // need to log it.
+    common::LogConnectionAdminAuditEvent("Connecting", address, status);
+  }
 }
 
 void log_classic_pairing_other_hci_event(EventView packet) {
diff --git a/system/gd/hci/hci_packets.pdl b/system/gd/hci/hci_packets.pdl
index 626774f..25c19be 100644
--- a/system/gd/hci/hci_packets.pdl
+++ b/system/gd/hci/hci_packets.pdl
@@ -57,6 +57,11 @@
   MANUFACTURER_SPECIFIC_DATA = 0xFF,
 }
 
+struct LengthAndData {
+  _size_(data) : 8,
+  data: 8[],
+}
+
 struct GapData {
   _size_(data) : 8, // Including one byte for data_type
   data_type : GapDataType,
@@ -89,7 +94,7 @@
 enum PacketStatusFlag : 2 {
   CORRECTLY_RECEIVED = 0,
   POSSIBLY_INCOMPLETE = 1,
-  NO_DATA = 2,
+  NO_DATA_RECEIVED = 2,
   PARTIALLY_LOST = 3,
 }
 
@@ -238,6 +243,7 @@
   READ_LOCAL_OOB_EXTENDED_DATA = 0x0C7D,
   SET_ECOSYSTEM_BASE_INTERVAL = 0x0C82,
   CONFIGURE_DATA_PATH = 0x0C83,
+  SET_MIN_ENCRYPTION_KEY_SIZE = 0x0C84,
 
   // INFORMATIONAL_PARAMETERS
   READ_LOCAL_VERSION_INFORMATION = 0x1001,
@@ -321,10 +327,10 @@
   LE_SET_PHY = 0x2032,
   LE_ENHANCED_RECEIVER_TEST = 0x2033,
   LE_ENHANCED_TRANSMITTER_TEST = 0x2034,
-  LE_SET_EXTENDED_ADVERTISING_RANDOM_ADDRESS = 0x2035,
+  LE_SET_ADVERTISING_SET_RANDOM_ADDRESS = 0x2035,
   LE_SET_EXTENDED_ADVERTISING_PARAMETERS = 0x2036,
   LE_SET_EXTENDED_ADVERTISING_DATA = 0x2037,
-  LE_SET_EXTENDED_ADVERTISING_SCAN_RESPONSE = 0x2038,
+  LE_SET_EXTENDED_SCAN_RESPONSE_DATA = 0x2038,
   LE_SET_EXTENDED_ADVERTISING_ENABLE = 0x2039,
   LE_READ_MAXIMUM_ADVERTISING_DATA_LENGTH = 0x203A,
   LE_READ_NUMBER_OF_SUPPORTED_ADVERTISING_SETS = 0x203B,
@@ -376,6 +382,9 @@
   LE_SET_PATH_LOSS_REPORTING_PARAMETERS = 0x2078,
   LE_SET_PATH_LOSS_REPORTING_ENABLE = 0x2079,
   LE_SET_TRANSMIT_POWER_REPORTING_ENABLE = 0x207A,
+  LE_SET_DATA_RELATED_ADDRESS_CHANGES = 0x207C,
+  LE_SET_DEFAULT_SUBRATE = 0x207D,
+  LE_SUBRATE_REQUEST = 0x207E,
 
   // VENDOR_SPECIFIC
   LE_GET_VENDOR_CAPABILITIES = 0xFD53,
@@ -583,10 +592,10 @@
   LE_SET_PHY = 356,
   LE_ENHANCED_RECEIVER_TEST = 357,
   LE_ENHANCED_TRANSMITTER_TEST = 360,
-  LE_SET_EXTENDED_ADVERTISING_RANDOM_ADDRESS = 361,
+  LE_SET_ADVERTISING_SET_RANDOM_ADDRESS = 361,
   LE_SET_EXTENDED_ADVERTISING_PARAMETERS = 362,
   LE_SET_EXTENDED_ADVERTISING_DATA = 363,
-  LE_SET_EXTENDED_ADVERTISING_SCAN_RESPONSE = 364,
+  LE_SET_EXTENDED_SCAN_RESPONSE_DATA = 364,
   LE_SET_EXTENDED_ADVERTISING_ENABLE = 365,
   LE_READ_MAXIMUM_ADVERTISING_DATA_LENGTH = 366,
   LE_READ_NUMBER_OF_SUPPORTED_ADVERTISING_SETS = 367,
@@ -644,6 +653,10 @@
   READ_LOCAL_SUPPORTED_CODEC_CAPABILITIES = 453,
   READ_LOCAL_SUPPORTED_CONTROLLER_DELAY = 454,
   CONFIGURE_DATA_PATH = 455,
+  LE_SET_DATA_RELATED_ADDRESS_CHANGES = 456,
+  SET_MIN_ENCRYPTION_KEY_SIZE = 457,
+  LE_SET_DEFAULT_SUBRATE = 460,
+  LE_SUBRATE_REQUEST = 461,
 }
 
 packet Command {
@@ -767,11 +780,13 @@
   PATH_LOSS_THRESHOLD = 0x20,
   TRANSMIT_POWER_REPORTING = 0x21,
   BIG_INFO_ADVERTISING_REPORT = 0x22,
+  LE_SUBRATE_CHANGE = 0x23,
 }
 
 // Vendor specific events
 enum VseSubeventCode : 8 {
   BLE_THRESHOLD = 0x54,
+  BLE_STCHANGE = 0x55,
   BLE_TRACKING = 0x56,
   DEBUG_INFO = 0x57,
   BQR_EVENT = 0x58,
@@ -824,10 +839,13 @@
   LINK_LAYER_COLLISION = 0x23,
   ENCRYPTION_MODE_NOT_ACCEPTABLE = 0x25,
   ROLE_SWITCH_FAILED = 0x35,
+  HOST_BUSY = 0x38,
   CONTROLLER_BUSY = 0x3A,
   ADVERTISING_TIMEOUT = 0x3C,
   CONNECTION_FAILED_ESTABLISHMENT = 0x3E,
+  UNKNOWN_ADVERTISING_IDENTIFIER = 0x42,
   LIMIT_REACHED = 0x43,
+  PACKET_TOO_LONG = 0x45,
 }
 
 // Events that are defined with their respective commands
@@ -1168,6 +1186,26 @@
   _reserved_ : 32,
 }
 
+enum SynchronousPacketTypeBits : 16 {
+  HV1_ALLOWED = 0x0001,
+  HV2_ALLOWED = 0x0002,
+  HV3_ALLOWED = 0x0004,
+  EV3_ALLOWED = 0x0008,
+  EV4_ALLOWED = 0x0010,
+  EV5_ALLOWED = 0x0020,
+  NO_2_EV3_ALLOWED = 0x0040,
+  NO_3_EV3_ALLOWED = 0x0080,
+  NO_2_EV5_ALLOWED = 0x0100,
+  NO_3_EV5_ALLOWED = 0x0200,
+}
+
+enum RetransmissionEffort : 8 {
+  NO_RETRANSMISSION = 0x00,
+  OPTIMIZED_FOR_POWER = 0x01,
+  OPTIMIZED_FOR_LINK_QUALITY = 0x02,
+  DO_NOT_CARE = 0xFF,
+}
+
 packet SetupSynchronousConnection : ScoConnectionCommand (op_code = SETUP_SYNCHRONOUS_CONNECTION) {
   connection_handle : 12,
   _reserved_ : 4,
@@ -1176,8 +1214,8 @@
   max_latency : 16, // 0-3 reserved, 0xFFFF = don't care
   voice_setting : 10,
   _reserved_ : 6,
-  retransmission_effort : 8,
-  packet_type : 16,
+  retransmission_effort : RetransmissionEffort,
+  packet_type : 16, // See SynchronousPacketTypeBits
 }
 
 packet SetupSynchronousConnectionStatus : CommandStatus (command_op_code = SETUP_SYNCHRONOUS_CONNECTION) {
@@ -1190,8 +1228,8 @@
   max_latency : 16, // 0-3 reserved, 0xFFFF = don't care
   voice_setting : 10,
   _reserved_ : 6,
-  retransmission_effort : 8,
-  packet_type : 16,
+  retransmission_effort : RetransmissionEffort,
+  packet_type : 16, // See SynchronousPacketTypeBits
 }
 
 packet AcceptSynchronousConnectionStatus : CommandStatus (command_op_code = ACCEPT_SYNCHRONOUS_CONNECTION) {
@@ -1342,34 +1380,14 @@
   AUDIO_TEST_MODE = 0xFF,
 }
 
-enum SynchronousPacketTypeBits : 16 {
-  HV1_ALLOWED = 0x0001,
-  HV2_ALLOWED = 0x0002,
-  HV3_ALLOWED = 0x0004,
-  EV3_ALLOWED = 0x0008,
-  EV4_ALLOWED = 0x0010,
-  EV5_ALLOWED = 0x0020,
-  NO_2_EV3_ALLOWED = 0x0040,
-  NO_3_EV3_ALLOWED = 0x0080,
-  NO_2_EV5_ALLOWED = 0x0100,
-  NO_3_EV5_ALLOWED = 0x0200,
-}
-
-enum RetransmissionEffort : 8 {
-  NO_RETRANSMISSION = 0x00,
-  OPTIMIZED_FOR_POWER = 0x01,
-  OPTIMIZED_FOR_LINK_QUALITY = 0x02,
-  DO_NOT_CARE = 0xFF,
-}
-
 packet EnhancedSetupSynchronousConnection : ScoConnectionCommand (op_code = ENHANCED_SETUP_SYNCHRONOUS_CONNECTION) {
   connection_handle: 12,
   _reserved_ : 4,
   // Next two items
   // [0x00000000, 0xFFFFFFFE] Bandwidth in octets per second.
   // [0xFFFFFFFF]: Don't care
-  transmit_bandwidth_octets_per_second : 32,
-  receive_bandwidth_octets_per_second : 32,
+  transmit_bandwidth : 32,
+  receive_bandwidth : 32,
   transmit_coding_format : ScoCodingFormat,
   receive_coding_format : ScoCodingFormat,
   // Next two items
@@ -1379,8 +1397,8 @@
   receive_codec_frame_size : 16,
   // Next two items
   // Host to Controller nominal data rate in octets per second.
-  input_bandwidth_octets_per_second : 32,
-  output_bandwidth_octets_per_second : 32,
+  input_bandwidth : 32,
+  output_bandwidth : 32,
   input_coding_format : ScoCodingFormat,
   output_coding_format : ScoCodingFormat,
   // Next two items
@@ -1407,11 +1425,15 @@
   //     of the eSCO window, where the eSCO window is reserved slots plus the
   //     retransmission window
   // [0xFFFF]: don't care
-  max_latency_ms: 16,
-  packet_type : 16, // Or together SynchronousPacketTypeBits
+  max_latency: 16,
+  packet_type : 16, // See SynchronousPacketTypeBits
   retransmission_effort : RetransmissionEffort,
 }
 
+test EnhancedSetupSynchronousConnection {
+  "\x3d\x04\x3b\x02\x00\x40\x1f\x00\x00\x40\x1f\x00\x00\x05\x00\x00\x00\x00\x05\x00\x00\x00\x00\x3c\x00\x3c\x00\x00\x7d\x00\x00\x00\x7d\x00\x00\x04\x00\x00\x00\x00\x04\x00\x00\x00\x00\x10\x00\x10\x00\x02\x02\x00\x00\x01\x01\x00\x00\x0d\x00\x88\x03\x02",
+}
+
 packet EnhancedSetupSynchronousConnectionStatus : CommandStatus (command_op_code = ENHANCED_SETUP_SYNCHRONOUS_CONNECTION) {
 }
 
@@ -1460,7 +1482,7 @@
   //     retransmission window
   // [0xFFFF]: don't care
   max_latency : 16,
-  packet_type : 16, // Or together SynchronousPacketTypeBits
+  packet_type : 16, // See SynchronousPacketTypeBits
   retransmission_effort : RetransmissionEffort,
 }
 
@@ -2408,6 +2430,14 @@
   bd_addr : Address,
 }
 
+packet SetEventMaskPage2 : Command (op_code = SET_EVENT_MASK_PAGE_2) {
+  event_mask_page_2: 64,
+}
+
+packet SetEventMaskPage2Complete : CommandComplete (command_op_code = SET_EVENT_MASK_PAGE_2) {
+  status: ErrorCode,
+}
+
 packet ReadLeHostSupport : Command (op_code = READ_LE_HOST_SUPPORT) {
 }
 
@@ -2493,6 +2523,14 @@
   status : ErrorCode,
 }
 
+packet SetMinEncryptionKeySize : Command (op_code = SET_MIN_ENCRYPTION_KEY_SIZE) {
+  min_encryption_key_size : 8,
+}
+
+packet SetMinEncryptionKeySizeComplete : CommandComplete (command_op_code = SET_MIN_ENCRYPTION_KEY_SIZE) {
+  status : ErrorCode,
+}
+
 
   // INFORMATIONAL_PARAMETERS
 packet ReadLocalVersionInformation : Command (op_code = READ_LOCAL_VERSION_INFORMATION) {
@@ -2515,6 +2553,7 @@
   V_5_0 = 0x09,
   V_5_1 = 0x0a,
   V_5_2 = 0x0b,
+  V_5_3 = 0x0c,
 }
 
 enum LmpVersion : 8 {
@@ -2530,6 +2569,7 @@
   V_5_0 = 0x09,
   V_5_1 = 0x0a,
   V_5_2 = 0x0b,
+  V_5_3 = 0x0c,
 }
 
 struct LocalVersionInformation {
@@ -3076,7 +3116,7 @@
 
 enum AdvertisingType : 8 {
   ADV_IND = 0x00,
-  ADV_DIRECT_IND = 0x01,
+  ADV_DIRECT_IND_HIGH = 0x01,
   ADV_SCAN_IND = 0x02,
   ADV_NONCONN_IND = 0x03,
   ADV_DIRECT_IND_LOW = 0x04,
@@ -3097,14 +3137,14 @@
 }
 
 packet LeSetAdvertisingParameters : LeAdvertisingCommand (op_code = LE_SET_ADVERTISING_PARAMETERS) {
-  interval_min : 16,
-  interval_max : 16,
-  advt_type : AdvertisingType,
+  advertising_interval_min : 16,
+  advertising_interval_max : 16,
+  advertising_type : AdvertisingType,
   own_address_type : OwnAddressType,
   peer_address_type : PeerAddressType,
   peer_address : Address,
-  channel_map : 8,
-  filter_policy : AdvertisingFilterPolicy,
+  advertising_channel_map : 8,
+  advertising_filter_policy : AdvertisingFilterPolicy,
   _reserved_ : 6,
 }
 
@@ -3640,25 +3680,25 @@
   status : ErrorCode,
 }
 
-packet LeSetExtendedAdvertisingRandomAddress : LeAdvertisingCommand (op_code = LE_SET_EXTENDED_ADVERTISING_RANDOM_ADDRESS) {
+packet LeSetAdvertisingSetRandomAddress : LeAdvertisingCommand (op_code = LE_SET_ADVERTISING_SET_RANDOM_ADDRESS) {
   advertising_handle : 8,
-  advertising_random_address : Address,
+  random_address : Address,
 }
 
-test LeSetExtendedAdvertisingRandomAddress {
+test LeSetAdvertisingSetRandomAddress {
   "\x35\x20\x07\x00\x77\x58\xeb\xd3\x1c\x6e",
 }
 
-packet LeSetExtendedAdvertisingRandomAddressComplete : CommandComplete (command_op_code = LE_SET_EXTENDED_ADVERTISING_RANDOM_ADDRESS) {
+packet LeSetAdvertisingSetRandomAddressComplete : CommandComplete (command_op_code = LE_SET_ADVERTISING_SET_RANDOM_ADDRESS) {
   status : ErrorCode,
 }
 
-test LeSetExtendedAdvertisingRandomAddressComplete {
+test LeSetAdvertisingSetRandomAddressComplete {
   "\x0e\x04\x01\x35\x20\x00",
 }
 
 // The lower 4 bits of the advertising event properties
-enum LegacyAdvertisingProperties : 4 {
+enum LegacyAdvertisingEventProperties : 4 {
   ADV_IND = 0x3,
   ADV_DIRECT_IND_LOW = 0x5,
   ADV_DIRECT_IND_HIGH = 0xD,
@@ -3678,11 +3718,11 @@
   LE_CODED = 0x03,
 }
 
-packet LeSetExtendedAdvertisingLegacyParameters : LeAdvertisingCommand (op_code = LE_SET_EXTENDED_ADVERTISING_PARAMETERS) {
+packet LeSetExtendedAdvertisingParametersLegacy : LeAdvertisingCommand (op_code = LE_SET_EXTENDED_ADVERTISING_PARAMETERS) {
   advertising_handle : 8,
-  advertising_event_legacy_properties : LegacyAdvertisingProperties,
+  legacy_advertising_event_properties : LegacyAdvertisingEventProperties,
   _fixed_ = 0x1 : 1, // legacy bit set
-  _reserved_ : 11, // advertising_event_properties
+  _reserved_ : 11, // advertising_event_properties reserved bits
   primary_advertising_interval_min : 24, // 0x20 - 0xFFFFFF N * 0.625 ms
   primary_advertising_interval_max : 24, // 0x20 - 0xFFFFFF N * 0.625 ms
   primary_advertising_channel_map : 3,  // bit 0 - Channel 37, bit 1 - 38, bit 2 - 39
@@ -3700,17 +3740,25 @@
   scan_request_notification_enable : Enable,
 }
 
-test LeSetExtendedAdvertisingLegacyParameters {
+test LeSetExtendedAdvertisingParametersLegacy {
   "\x36\x20\x19\x00\x13\x00\x90\x01\x00\xc2\x01\x00\x07\x01\x00\x00\x00\x00\x00\x00\x00\x00\xf9\x01\x00\x01\x01\x00",
   "\x36\x20\x19\x01\x13\x00\x90\x01\x00\xc2\x01\x00\x07\x01\x00\x00\x00\x00\x00\x00\x00\x00\xf9\x01\x00\x01\x01\x00",
 }
 
+struct AdvertisingEventProperties {
+  connectable : 1,
+  scannable : 1,
+  directed : 1,
+  high_duty_cycle : 1,
+  legacy : 1,
+  anonymous : 1,
+  tx_power : 1,
+  _reserved_ : 9,
+}
+
 packet LeSetExtendedAdvertisingParameters : LeAdvertisingCommand (op_code = LE_SET_EXTENDED_ADVERTISING_PARAMETERS) {
   advertising_handle : 8,
-  advertising_event_legacy_properties : 4,
-  _fixed_ = 0 : 1, // legacy bit cleared
-  advertising_event_properties : 3,
-  _reserved_ : 8,
+  advertising_event_properties : AdvertisingEventProperties,
   primary_advertising_interval_min : 24, // 0x20 - 0xFFFFFF N * 0.625 ms
   primary_advertising_interval_max : 24, // 0x20 - 0xFFFFFF N * 0.625 ms
   primary_advertising_channel_map : 3,  // bit 0 - Channel 37, bit 1 - 38, bit 2 - 39
@@ -3778,7 +3826,7 @@
   "\x0e\x04\x01\x37\x20\x00",
 }
 
-packet LeSetExtendedAdvertisingScanResponse : LeAdvertisingCommand (op_code = LE_SET_EXTENDED_ADVERTISING_SCAN_RESPONSE) {
+packet LeSetExtendedScanResponseData : LeAdvertisingCommand (op_code = LE_SET_EXTENDED_SCAN_RESPONSE_DATA) {
   advertising_handle : 8,
   operation : Operation,
   _reserved_ : 5,
@@ -3788,7 +3836,7 @@
   scan_response_data : GapData[],
 }
 
-packet LeSetExtendedAdvertisingScanResponseRaw : LeAdvertisingCommand (op_code = LE_SET_EXTENDED_ADVERTISING_SCAN_RESPONSE) {
+packet LeSetExtendedScanResponseDataRaw : LeAdvertisingCommand (op_code = LE_SET_EXTENDED_SCAN_RESPONSE_DATA) {
   advertising_handle : 8,
   operation : Operation,
   _reserved_ : 5,
@@ -3798,7 +3846,7 @@
   scan_response_data : 8[],
 }
 
-packet LeSetExtendedAdvertisingScanResponseComplete : CommandComplete (command_op_code = LE_SET_EXTENDED_ADVERTISING_SCAN_RESPONSE) {
+packet LeSetExtendedScanResponseDataComplete : CommandComplete (command_op_code = LE_SET_EXTENDED_SCAN_RESPONSE_DATA) {
   status : ErrorCode,
 }
 
@@ -4388,7 +4436,7 @@
   packing : Packing,
   framing : Enable,
   encryption : Enable,
-  broadcast_code: 16[],
+  broadcast_code: 8[16],
 }
 
 packet LeCreateBigStatus : CommandStatus (command_op_code = LE_CREATE_BIG) {
@@ -4407,7 +4455,7 @@
   sync_handle : 12,
   _reserved_ : 4,
   encryption : Enable,
-  broadcast_code : 16[],
+  broadcast_code : 8[16],
   mse : 5,
   _reserved_ : 3,
   big_sync_timeout : 16,
@@ -4472,6 +4520,7 @@
 
 enum LeHostFeatureBits : 8 {
   CONNECTED_ISO_STREAM_HOST_SUPPORT = 32,
+  CONNECTION_SUBRATING_HOST_SUPPORT = 38,
 }
 
 packet LeSetHostFeature : Command (op_code = LE_SET_HOST_FEATURE) {
@@ -4573,6 +4622,50 @@
   _reserved_ : 4,
 }
 
+packet LeSetDataRelatedAddressChanges : Command (op_code = LE_SET_DATA_RELATED_ADDRESS_CHANGES) {
+  advertising_handle : 8,
+  change_reasons : 8,
+}
+
+packet LeSetDataRelatedAddressChangesComplete : CommandComplete (command_op_code = LE_SET_DATA_RELATED_ADDRESS_CHANGES) {
+  status : ErrorCode,
+}
+
+packet LeSetDefaultSubrate : Command (op_code = LE_SET_DEFAULT_SUBRATE) {
+  subrate_min : 9,
+  _reserved_ : 7,
+  subrate_max : 9,
+  _reserved_ : 7,
+  max_latency : 9,
+  _reserved_ : 7,
+  continuation_number : 9,
+  _reserved_ : 7,
+  supervision_timeout: 12,
+  _reserved_ : 4,
+}
+
+packet LeSetDefaultSubrateComplete : CommandComplete (command_op_code = LE_SET_DEFAULT_SUBRATE) {
+  status : ErrorCode,
+}
+
+packet LeSubrateRequest : Command (op_code = LE_SUBRATE_REQUEST) {
+  connection_handle : 12,
+  _reserved_ : 4,
+  subrate_min : 9,
+  _reserved_ : 7,
+  subrate_max : 9,
+  _reserved_ : 7,
+  max_latency : 9,
+  _reserved_ : 7,
+  continuation_number : 9,
+  _reserved_ : 7,
+  supervision_timeout: 12,
+  _reserved_ : 4,
+}
+
+packet LeSubrateRequestStatus : CommandStatus (command_op_code = LE_SUBRATE_REQUEST) {
+}
+
   // VENDOR_SPECIFIC
 packet LeGetVendorCapabilities : VendorCommand (op_code = LE_GET_VENDOR_CAPABILITIES) {
 }
@@ -4654,7 +4747,7 @@
 packet LeMultiAdvtParam : LeMultiAdvt (sub_cmd = SET_PARAM) {
   interval_min : 16,
   interval_max : 16,
-  advt_type : AdvertisingType,
+  advertising_type : AdvertisingType,
   own_address_type : OwnAddressType,
   own_address : Address,
   peer_address_type : PeerAddressType,
@@ -4817,6 +4910,9 @@
   LOCAL_NAME = 0x05,
   MANUFACTURER_DATA = 0x06,
   SERVICE_DATA = 0x07,
+  RESERVED = 0x08,
+  AD_TYPE = 0x09,
+  READ_EXTENDED_FEATURES = 0xFF,
 }
 
 // https://source.android.com/devices/bluetooth/hci_requirements#advertising-packet-content-filter
@@ -4860,6 +4956,8 @@
   LOCAL_NAME = 0x04,
   MANUFACTURER_DATA = 0x05,
   SERVICE_DATA = 0x06,
+  RESERVED = 0x07,
+  AD_TYPE = 0x08,
 }
 
 packet LeAdvFilterSetFilteringParameters : LeAdvFilter (apcf_opcode = SET_FILTERING_PARAMETERS) {
@@ -4972,6 +5070,34 @@
   apcf_available_spaces : 8,
 }
 
+packet LeAdvFilterADType : LeAdvFilter (apcf_opcode = AD_TYPE) {
+  apcf_action : ApcfAction,
+  apcf_filter_index : 8,
+  apcf_ad_type_data : 8[],
+}
+
+packet LeAdvFilterADTypeComplete : LeAdvFilterComplete (apcf_opcode = AD_TYPE) {
+  apcf_action : ApcfAction,
+  apcf_available_spaces : 8,
+}
+
+packet LeAdvFilterReadExtendedFeatures : LeAdvFilter (apcf_opcode = READ_EXTENDED_FEATURES) {
+}
+
+test LeAdvFilterReadExtendedFeatures {
+  "\x57\xfd\x01\xff",
+}
+
+packet LeAdvFilterReadExtendedFeaturesComplete : LeAdvFilterComplete (apcf_opcode = READ_EXTENDED_FEATURES) {
+  _reserved_ : 1,
+  ad_type_filter : 1,
+  _reserved_ : 14,
+}
+
+test LeAdvFilterReadExtendedFeaturesComplete {
+  "\x0e\x07\x01\x57\xfd\x00\xff\x02\x00",
+}
+
 packet LeEnergyInfo : VendorCommand (op_code = LE_ENERGY_INFO) {
 }
 
@@ -5336,6 +5462,10 @@
   air_mode : ScoAirMode,
 }
 
+test SynchronousConnectionComplete {
+  "\x2c\x11\x00\x03\x00\x1d\xdf\xed\x2b\x1a\xf8\x02\x0c\x04\x3c\x00\x3c\x00\x03",
+}
+
 packet SynchronousConnectionChanged : Event (event_code = SYNCHRONOUS_CONNECTION_CHANGED) {
   status : ErrorCode,
   connection_handle : 12,
@@ -5377,6 +5507,23 @@
   _padding_[240],
 }
 
+packet ExtendedInquiryResultRaw : Event (event_code = EXTENDED_INQUIRY_RESULT) {
+  _fixed_ = 0x01 : 8,
+  address : Address,
+  page_scan_repetition_mode : PageScanRepetitionMode,
+  _reserved_ : 8,
+  class_of_device : ClassOfDevice,
+  clock_offset : 15,
+  _reserved_ : 1,
+  rssi : 8,
+  extended_inquiry_response : 8[],
+  // Extended inquiry Result is always 255 bytes long
+  // padded GapData with zeroes as necessary
+  // Refer to BLUETOOTH CORE SPECIFICATION Version 5.2 | Vol 3, Part C Section 8 on page 1340
+  _padding_[240],
+}
+
+
 packet EncryptionKeyRefreshComplete : Event (event_code = ENCRYPTION_KEY_REFRESH_COMPLETE) {
   status : ErrorCode,
   connection_handle : 12,
@@ -5429,6 +5576,10 @@
   packet_type : FlushablePacketType,
 }
 
+test EnhancedFlush {
+  "\x5f\x0c\x03\x02\x00\x00",
+}
+
 packet EnhancedFlushStatus : CommandStatus (command_op_code = ENHANCED_FLUSH) {
 }
 
@@ -5437,6 +5588,10 @@
   _reserved_ : 4,
 }
 
+test EnhancedFlushComplete {
+  "\x39\x02\x02\x00",
+}
+
 packet UserPasskeyNotification : Event (event_code = USER_PASSKEY_NOTIFICATION) {
   bd_addr : Address,
   passkey : 20, // 0x00000-0xF423F (000000 - 999999)
@@ -5490,7 +5645,7 @@
   address_type : AddressType,
   address : Address,
   _size_(advertising_data) : 8,
-  advertising_data : GapData[],
+  advertising_data : LengthAndData[],
   rssi : 8,
 }
 
@@ -5585,7 +5740,7 @@
   PUBLIC_IDENTITY_ADDRESS = 0x02,
   RANDOM_IDENTITY_ADDRESS = 0x03,
   CONTROLLER_UNABLE_TO_RESOLVE = 0xFE,
-  NO_ADDRESS = 0xFF,
+  NO_ADDRESS_PROVIDED = 0xFF,
 }
 
 enum DirectAdvertisingEventType : 8 {
@@ -5644,7 +5799,34 @@
   direct_address_type : DirectAdvertisingAddressType,
   direct_address : Address,
   _size_(advertising_data) : 8,
-  advertising_data : 8[],
+  advertising_data: LengthAndData[],
+}
+
+struct LeExtendedAdvertisingResponseRaw {
+  connectable : 1,
+  scannable : 1,
+  directed : 1,
+  scan_response : 1,
+  legacy : 1,
+  data_status : DataStatus,
+  _reserved_ : 9,
+  address_type : DirectAdvertisingAddressType,
+  address : Address,
+  primary_phy : PrimaryPhyType,
+  secondary_phy : SecondaryPhyType,
+  advertising_sid : 8, // SID subfield in the ADI field
+  tx_power : 8,
+  rssi : 8, // -127 to +20 (0x7F means not available)
+  periodic_advertising_interval : 16, // 0x006 to 0xFFFF (7.5 ms to 82s)
+  direct_address_type : DirectAdvertisingAddressType,
+  direct_address : Address,
+  _size_(advertising_data) : 8,
+  advertising_data: 8[],
+}
+
+packet LeExtendedAdvertisingReportRaw : LeMetaEvent (subevent_code = EXTENDED_ADVERTISING_REPORT) {
+  _count_(responses) : 8,
+  responses : LeExtendedAdvertisingResponseRaw[],
 }
 
 packet LeExtendedAdvertisingReport : LeMetaEvent (subevent_code = EXTENDED_ADVERTISING_REPORT) {
@@ -5863,6 +6045,20 @@
   encryption : Enable,
 }
 
+packet LeSubrateChange : LeMetaEvent (subevent_code = LE_SUBRATE_CHANGE) {
+  status : ErrorCode,
+  connection_handle : 12,
+  _reserved_ : 4,
+  subrate_factor : 9,
+  _reserved_ : 7,
+  peripheral_latency : 9,
+  _reserved_ : 7,
+  continuation_number : 9,
+  _reserved_ : 7,
+  supervision_timeout: 12,
+  _reserved_ : 4,
+}
+
 // Vendor specific events
 
 packet VendorSpecificEvent : Event (event_code = VENDOR_SPECIFIC) {
@@ -5887,6 +6083,17 @@
   _body_,
 }
 
+enum VseStateChangeReason : 8 {
+  CONNECTION_RECEIVED = 0x00,
+}
+
+packet LEAdvertiseStateChangeEvent : VendorSpecificEvent (subevent_code = BLE_STCHANGE) {
+  advertising_instance : 8,
+  state_change_reason : VseStateChangeReason,
+  connection_handle : 12,
+  _reserved_ : 4,
+}
+
 packet LEAdvertisementTrackingWithInfoEvent : LEAdvertisementTrackingEvent {
   tx_power : 8,
   rssi : 8,
diff --git a/system/gd/hci/hci_packets_test.cc b/system/gd/hci/hci_packets_test.cc
index 06148c1..f494428 100644
--- a/system/gd/hci/hci_packets_test.cc
+++ b/system/gd/hci/hci_packets_test.cc
@@ -247,16 +247,16 @@
     0x35, 0x20, 0x07, 0x00, 0x77, 0x58, 0xeb, 0xd3, 0x1c, 0x6e,
 };
 
-TEST(HciPacketsTest, testLeSetExtendedAdvertisingRandomAddress) {
+TEST(HciPacketsTest, testLeSetAdvertisingSetRandomAddress) {
   std::shared_ptr<std::vector<uint8_t>> packet_bytes =
       std::make_shared<std::vector<uint8_t>>(le_set_extended_advertising_random_address);
   PacketView<kLittleEndian> packet_bytes_view(packet_bytes);
-  auto view = LeSetExtendedAdvertisingRandomAddressView::Create(
+  auto view = LeSetAdvertisingSetRandomAddressView::Create(
       LeAdvertisingCommandView::Create(CommandView::Create(packet_bytes_view)));
   ASSERT_TRUE(view.IsValid());
   uint8_t random_address_bytes[] = {0x77, 0x58, 0xeb, 0xd3, 0x1c, 0x6e};
   ASSERT_EQ(0, view.GetAdvertisingHandle());
-  ASSERT_EQ(Address(random_address_bytes), view.GetAdvertisingRandomAddress());
+  ASSERT_EQ(Address(random_address_bytes), view.GetRandomAddress());
 }
 
 std::vector<uint8_t> le_set_extended_advertising_data{
@@ -287,7 +287,7 @@
   std::shared_ptr<std::vector<uint8_t>> packet_bytes =
       std::make_shared<std::vector<uint8_t>>(le_set_extended_advertising_parameters_set_0);
   PacketView<kLittleEndian> packet_bytes_view(packet_bytes);
-  auto view = LeSetExtendedAdvertisingLegacyParametersView::Create(
+  auto view = LeSetExtendedAdvertisingParametersLegacyView::Create(
       LeAdvertisingCommandView::Create(CommandView::Create(packet_bytes_view)));
   ASSERT_TRUE(view.IsValid());
   ASSERT_EQ(0, view.GetAdvertisingHandle());
@@ -310,7 +310,7 @@
   std::shared_ptr<std::vector<uint8_t>> packet_bytes =
       std::make_shared<std::vector<uint8_t>>(le_set_extended_advertising_parameters_set_1);
   PacketView<kLittleEndian> packet_bytes_view(packet_bytes);
-  auto view = LeSetExtendedAdvertisingLegacyParametersView::Create(
+  auto view = LeSetExtendedAdvertisingParametersLegacyView::Create(
       LeAdvertisingCommandView::Create(CommandView::Create(packet_bytes_view)));
   ASSERT_TRUE(view.IsValid());
   ASSERT_EQ(1, view.GetAdvertisingHandle());
diff --git a/system/gd/hci/le_address_manager.cc b/system/gd/hci/le_address_manager.cc
index f05050d..3cbc04a 100644
--- a/system/gd/hci/le_address_manager.cc
+++ b/system/gd/hci/le_address_manager.cc
@@ -169,8 +169,10 @@
       address_policy_ == AddressPolicy::USE_NON_RESOLVABLE_ADDRESS) {
       if (registered_clients_.size() == 1) {
         schedule_rotate_random_address();
+        LOG_INFO("Scheduled address rotation for first client registered");
       }
   }
+  LOG_INFO("Client registered");
 }
 
 void LeAddressManager::Unregister(LeAddressManagerCallback* callback) {
@@ -185,9 +187,11 @@
       ack_resume(callback);
     }
     registered_clients_.erase(callback);
+    LOG_INFO("Client unregistered");
   }
   if (registered_clients_.empty() && address_rotation_alarm_ != nullptr) {
     address_rotation_alarm_->Cancel();
+    LOG_INFO("Cancelled address rotation alarm");
   }
 }
 
@@ -223,9 +227,15 @@
 
 void LeAddressManager::pause_registered_clients() {
   for (auto& client : registered_clients_) {
-    if (client.second != ClientState::PAUSED && client.second != ClientState::WAITING_FOR_PAUSE) {
-      client.second = ClientState::WAITING_FOR_PAUSE;
-      client.first->OnPause();
+    switch (client.second) {
+      case ClientState::PAUSED:
+      case ClientState::WAITING_FOR_PAUSE:
+        break;
+      case WAITING_FOR_RESUME:
+      case RESUMED:
+        client.second = ClientState::WAITING_FOR_PAUSE;
+        client.first->OnPause();
+        break;
     }
   }
 }
@@ -237,18 +247,27 @@
 
 void LeAddressManager::ack_pause(LeAddressManagerCallback* callback) {
   if (registered_clients_.find(callback) == registered_clients_.end()) {
+    LOG_INFO("No clients registered to ack pause");
     return;
   }
   registered_clients_.find(callback)->second = ClientState::PAUSED;
   for (auto client : registered_clients_) {
-    if (client.second != ClientState::PAUSED) {
-      // make sure all client paused
-      if (client.second != ClientState::WAITING_FOR_PAUSE) {
+    switch (client.second) {
+      case ClientState::PAUSED:
+        LOG_INFO("Client already in paused state");
+        break;
+      case ClientState::WAITING_FOR_PAUSE:
+        // make sure all client paused
+        LOG_DEBUG("Wait all clients paused, return");
+        return;
+      case WAITING_FOR_RESUME:
+      case RESUMED:
         LOG_DEBUG("Trigger OnPause for client that not paused and not waiting for pause");
         client.second = ClientState::WAITING_FOR_PAUSE;
         client.first->OnPause();
-      }
-      return;
+        return;
+      default:
+        LOG_ERROR("Found client in unexpected state:%u", client.second);
     }
   }
 
@@ -264,6 +283,7 @@
     return;
   }
 
+  LOG_INFO("Resuming registered clients");
   for (auto& client : registered_clients_) {
     client.second = ClientState::WAITING_FOR_RESUME;
     client.first->OnResume();
diff --git a/system/gd/hci/le_address_manager.h b/system/gd/hci/le_address_manager.h
index dcc7b0d..c04a7f5 100644
--- a/system/gd/hci/le_address_manager.h
+++ b/system/gd/hci/le_address_manager.h
@@ -71,9 +71,9 @@
       crypto_toolbox::Octet16 rotation_irk,
       std::chrono::milliseconds minimum_rotation_time,
       std::chrono::milliseconds maximum_rotation_time);
-  AddressPolicy GetAddressPolicy();
-  void AckPause(LeAddressManagerCallback* callback);
-  void AckResume(LeAddressManagerCallback* callback);
+  virtual AddressPolicy GetAddressPolicy();
+  virtual void AckPause(LeAddressManagerCallback* callback);
+  virtual void AckResume(LeAddressManagerCallback* callback);
   virtual AddressPolicy Register(LeAddressManagerCallback* callback);
   virtual void Unregister(LeAddressManagerCallback* callback);
   virtual bool UnregisterSync(
@@ -96,6 +96,11 @@
   void OnCommandComplete(CommandCompleteView view);
   std::chrono::milliseconds GetNextPrivateAddressIntervalMs();
 
+  // Unsynchronized check for testing purposes
+  size_t NumberCachedCommands() const {
+    return cached_commands_.size();
+  }
+
  private:
   enum ClientState {
     WAITING_FOR_PAUSE,
diff --git a/system/gd/hci/le_address_manager_test.cc b/system/gd/hci/le_address_manager_test.cc
index 9e76fec..7f698f0 100644
--- a/system/gd/hci/le_address_manager_test.cc
+++ b/system/gd/hci/le_address_manager_test.cc
@@ -26,21 +26,28 @@
 using ::bluetooth::os::Handler;
 using ::bluetooth::os::Thread;
 
-namespace bluetooth {
-namespace hci {
+namespace {
 
-using packet::kLittleEndian;
-using packet::PacketView;
-using packet::RawBuilder;
+using namespace bluetooth;
 
-PacketView<kLittleEndian> GetPacketView(std::unique_ptr<packet::BasePacketBuilder> packet) {
+packet::PacketView<packet::kLittleEndian> GetPacketView(std::unique_ptr<packet::BasePacketBuilder> packet) {
   auto bytes = std::make_shared<std::vector<uint8_t>>();
-  BitInserter i(*bytes);
+  packet::BitInserter i(*bytes);
   bytes->reserve(packet->size());
   packet->Serialize(i);
   return packet::PacketView<packet::kLittleEndian>(bytes);
 }
 
+}  // namespace
+
+namespace bluetooth {
+namespace hci {
+namespace {
+
+using packet::kLittleEndian;
+using packet::PacketView;
+using packet::RawBuilder;
+
 class TestHciLayer : public HciLayer {
  public:
   void EnqueueCommand(
@@ -50,13 +57,14 @@
     command_queue_.push(std::move(command));
     command_complete_callbacks.push_back(std::move(on_complete));
     if (command_promise_ != nullptr) {
-      command_promise_->set_value();
-      command_promise_.reset();
+      std::promise<void>* prom = command_promise_.release();
+      prom->set_value();
+      delete prom;
     }
   }
 
   void SetCommandFuture() {
-    ASSERT_LOG(command_promise_ == nullptr, "Promises, Promises, ... Only one at a time.");
+    ASSERT_EQ(command_promise_, nullptr) << "Promises, Promises, ... Only one at a time.";
     command_promise_ = std::make_unique<std::promise<void>>();
     command_future_ = std::make_unique<std::future<void>>(command_promise_->get_future());
   }
@@ -129,8 +137,9 @@
     paused = false;
     le_address_manager_->AckResume(this);
     if (resume_promise_ != nullptr) {
-      resume_promise_->set_value();
-      resume_promise_.reset();
+      std::promise<void>* prom = resume_promise_.release();
+      prom->set_value();
+      delete prom;
     }
   }
 
@@ -216,10 +225,11 @@
       LeAddressManager::AddressPolicy::USE_RESOLVABLE_ADDRESS,
       remote_address,
       irk,
+      false,
       minimum_rotation_time,
       maximum_rotation_time);
 
-  test_hci_layer_->SetCommandFuture();
+  ASSERT_NO_FATAL_FAILURE(test_hci_layer_->SetCommandFuture());
   le_address_manager_->Register(clients[0].get());
   sync_handler(handler_);
   test_hci_layer_->GetCommand(OpCode::LE_SET_RANDOM_ADDRESS);
@@ -238,10 +248,11 @@
       LeAddressManager::AddressPolicy::USE_NON_RESOLVABLE_ADDRESS,
       remote_address,
       irk,
+      false,
       minimum_rotation_time,
       maximum_rotation_time);
 
-  test_hci_layer_->SetCommandFuture();
+  ASSERT_NO_FATAL_FAILURE(test_hci_layer_->SetCommandFuture());
   le_address_manager_->Register(clients[0].get());
   sync_handler(handler_);
   test_hci_layer_->GetCommand(OpCode::LE_SET_RANDOM_ADDRESS);
@@ -262,6 +273,7 @@
       LeAddressManager::AddressPolicy::USE_RESOLVABLE_ADDRESS,
       remote_address,
       irk,
+      false,
       minimum_rotation_time,
       maximum_rotation_time);
   le_address_manager_->Register(clients[0].get());
@@ -299,10 +311,11 @@
         LeAddressManager::AddressPolicy::USE_RESOLVABLE_ADDRESS,
         remote_address,
         irk,
+        false,
         minimum_rotation_time,
         maximum_rotation_time);
 
-    test_hci_layer_->SetCommandFuture();
+    ASSERT_NO_FATAL_FAILURE(test_hci_layer_->SetCommandFuture());
     le_address_manager_->Register(clients[0].get());
     sync_handler(handler_);
     test_hci_layer_->GetCommand(OpCode::LE_SET_RANDOM_ADDRESS);
@@ -329,7 +342,7 @@
 TEST_F(LeAddressManagerWithSingleClientTest, add_device_to_connect_list) {
   Address address;
   Address::FromString("01:02:03:04:05:06", address);
-  test_hci_layer_->SetCommandFuture();
+  ASSERT_NO_FATAL_FAILURE(test_hci_layer_->SetCommandFuture());
   le_address_manager_->AddDeviceToFilterAcceptList(FilterAcceptListAddressType::RANDOM, address);
   auto packet = test_hci_layer_->GetCommand(OpCode::LE_ADD_DEVICE_TO_FILTER_ACCEPT_LIST);
   auto packet_view = LeAddDeviceToFilterAcceptListView::Create(
@@ -345,12 +358,12 @@
 TEST_F(LeAddressManagerWithSingleClientTest, remove_device_from_connect_list) {
   Address address;
   Address::FromString("01:02:03:04:05:06", address);
-  test_hci_layer_->SetCommandFuture();
+  ASSERT_NO_FATAL_FAILURE(test_hci_layer_->SetCommandFuture());
   le_address_manager_->AddDeviceToFilterAcceptList(FilterAcceptListAddressType::RANDOM, address);
   test_hci_layer_->GetCommand(OpCode::LE_ADD_DEVICE_TO_FILTER_ACCEPT_LIST);
   test_hci_layer_->IncomingEvent(LeAddDeviceToFilterAcceptListCompleteBuilder::Create(0x01, ErrorCode::SUCCESS));
 
-  test_hci_layer_->SetCommandFuture();
+  ASSERT_NO_FATAL_FAILURE(test_hci_layer_->SetCommandFuture());
   le_address_manager_->RemoveDeviceFromFilterAcceptList(FilterAcceptListAddressType::RANDOM, address);
   auto packet = test_hci_layer_->GetCommand(OpCode::LE_REMOVE_DEVICE_FROM_FILTER_ACCEPT_LIST);
   auto packet_view = LeRemoveDeviceFromFilterAcceptListView::Create(
@@ -365,84 +378,154 @@
 TEST_F(LeAddressManagerWithSingleClientTest, clear_connect_list) {
   Address address;
   Address::FromString("01:02:03:04:05:06", address);
-  test_hci_layer_->SetCommandFuture();
+  ASSERT_NO_FATAL_FAILURE(test_hci_layer_->SetCommandFuture());
   le_address_manager_->AddDeviceToFilterAcceptList(FilterAcceptListAddressType::RANDOM, address);
   test_hci_layer_->GetCommand(OpCode::LE_ADD_DEVICE_TO_FILTER_ACCEPT_LIST);
   test_hci_layer_->IncomingEvent(LeAddDeviceToFilterAcceptListCompleteBuilder::Create(0x01, ErrorCode::SUCCESS));
 
-  test_hci_layer_->SetCommandFuture();
+  ASSERT_NO_FATAL_FAILURE(test_hci_layer_->SetCommandFuture());
   le_address_manager_->ClearFilterAcceptList();
   test_hci_layer_->GetCommand(OpCode::LE_CLEAR_FILTER_ACCEPT_LIST);
   test_hci_layer_->IncomingEvent(LeClearFilterAcceptListCompleteBuilder::Create(0x01, ErrorCode::SUCCESS));
   clients[0].get()->WaitForResume();
 }
 
-TEST_F(LeAddressManagerWithSingleClientTest, add_device_to_resolving_list) {
+// b/260916288
+TEST_F(LeAddressManagerWithSingleClientTest, DISABLED_add_device_to_resolving_list) {
   Address address;
   Address::FromString("01:02:03:04:05:06", address);
   Octet16 peer_irk = {0xec, 0x02, 0x34, 0xa3, 0x57, 0xc8, 0xad, 0x05, 0x34, 0x10, 0x10, 0xa6, 0x0a, 0x39, 0x7d, 0x9b};
   Octet16 local_irk = {0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f, 0x10};
-  test_hci_layer_->SetCommandFuture();
+
+  ASSERT_NO_FATAL_FAILURE(test_hci_layer_->SetCommandFuture());
   le_address_manager_->AddDeviceToResolvingList(
       PeerAddressType::RANDOM_DEVICE_OR_IDENTITY_ADDRESS, address, peer_irk, local_irk);
-  auto packet = test_hci_layer_->GetCommand(OpCode::LE_ADD_DEVICE_TO_RESOLVING_LIST);
-  auto packet_view = LeAddDeviceToResolvingListView::Create(LeSecurityCommandView::Create(packet));
-  ASSERT_TRUE(packet_view.IsValid());
-  ASSERT_EQ(PeerAddressType::RANDOM_DEVICE_OR_IDENTITY_ADDRESS, packet_view.GetPeerIdentityAddressType());
-  ASSERT_EQ(address, packet_view.GetPeerIdentityAddress());
-  ASSERT_EQ(peer_irk, packet_view.GetPeerIrk());
-  ASSERT_EQ(local_irk, packet_view.GetLocalIrk());
-
-  test_hci_layer_->IncomingEvent(LeAddDeviceToResolvingListCompleteBuilder::Create(0x01, ErrorCode::SUCCESS));
+  {
+    auto packet = test_hci_layer_->GetCommand(OpCode::LE_SET_ADDRESS_RESOLUTION_ENABLE);
+    auto packet_view = LeSetAddressResolutionEnableView::Create(LeSecurityCommandView::Create(packet));
+    ASSERT_TRUE(packet_view.IsValid());
+    ASSERT_EQ(Enable::DISABLED, packet_view.GetAddressResolutionEnable());
+    test_hci_layer_->IncomingEvent(LeSetAddressResolutionEnableCompleteBuilder::Create(0x01, ErrorCode::SUCCESS));
+  }
+  {
+    ASSERT_NO_FATAL_FAILURE(test_hci_layer_->SetCommandFuture());
+    auto packet = test_hci_layer_->GetCommand(OpCode::LE_ADD_DEVICE_TO_RESOLVING_LIST);
+    auto packet_view = LeAddDeviceToResolvingListView::Create(LeSecurityCommandView::Create(packet));
+    ASSERT_TRUE(packet_view.IsValid());
+    ASSERT_EQ(PeerAddressType::RANDOM_DEVICE_OR_IDENTITY_ADDRESS, packet_view.GetPeerIdentityAddressType());
+    ASSERT_EQ(address, packet_view.GetPeerIdentityAddress());
+    ASSERT_EQ(peer_irk, packet_view.GetPeerIrk());
+    ASSERT_EQ(local_irk, packet_view.GetLocalIrk());
+    test_hci_layer_->IncomingEvent(LeAddDeviceToResolvingListCompleteBuilder::Create(0x01, ErrorCode::SUCCESS));
+  }
+  {
+    ASSERT_NO_FATAL_FAILURE(test_hci_layer_->SetCommandFuture());
+    auto packet = test_hci_layer_->GetCommand(OpCode::LE_SET_ADDRESS_RESOLUTION_ENABLE);
+    auto packet_view = LeSetAddressResolutionEnableView::Create(LeSecurityCommandView::Create(packet));
+    ASSERT_TRUE(packet_view.IsValid());
+    ASSERT_EQ(Enable::ENABLED, packet_view.GetAddressResolutionEnable());
+    test_hci_layer_->IncomingEvent(LeSetAddressResolutionEnableCompleteBuilder::Create(0x01, ErrorCode::SUCCESS));
+  }
   clients[0].get()->WaitForResume();
 }
 
-TEST_F(LeAddressManagerWithSingleClientTest, remove_device_from_resolving_list) {
+// b/260916288
+TEST_F(LeAddressManagerWithSingleClientTest, DISABLED_remove_device_from_resolving_list) {
   Address address;
   Address::FromString("01:02:03:04:05:06", address);
   Octet16 peer_irk = {0xec, 0x02, 0x34, 0xa3, 0x57, 0xc8, 0xad, 0x05, 0x34, 0x10, 0x10, 0xa6, 0x0a, 0x39, 0x7d, 0x9b};
   Octet16 local_irk = {0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f, 0x10};
-  test_hci_layer_->SetCommandFuture();
+  ASSERT_NO_FATAL_FAILURE(test_hci_layer_->SetCommandFuture());
   le_address_manager_->AddDeviceToResolvingList(
       PeerAddressType::RANDOM_DEVICE_OR_IDENTITY_ADDRESS, address, peer_irk, local_irk);
+  test_hci_layer_->GetCommand(OpCode::LE_SET_ADDRESS_RESOLUTION_ENABLE);
+  test_hci_layer_->IncomingEvent(LeSetAddressResolutionEnableCompleteBuilder::Create(0x01, ErrorCode::SUCCESS));
+  ASSERT_NO_FATAL_FAILURE(test_hci_layer_->SetCommandFuture());
   test_hci_layer_->GetCommand(OpCode::LE_ADD_DEVICE_TO_RESOLVING_LIST);
   test_hci_layer_->IncomingEvent(LeAddDeviceToResolvingListCompleteBuilder::Create(0x01, ErrorCode::SUCCESS));
+  ASSERT_NO_FATAL_FAILURE(test_hci_layer_->SetCommandFuture());
+  test_hci_layer_->GetCommand(OpCode::LE_SET_ADDRESS_RESOLUTION_ENABLE);
+  test_hci_layer_->IncomingEvent(LeSetAddressResolutionEnableCompleteBuilder::Create(0x01, ErrorCode::SUCCESS));
 
-  test_hci_layer_->SetCommandFuture();
+  ASSERT_NO_FATAL_FAILURE(test_hci_layer_->SetCommandFuture());
   le_address_manager_->RemoveDeviceFromResolvingList(PeerAddressType::RANDOM_DEVICE_OR_IDENTITY_ADDRESS, address);
-  auto packet = test_hci_layer_->GetCommand(OpCode::LE_REMOVE_DEVICE_FROM_RESOLVING_LIST);
-  auto packet_view = LeRemoveDeviceFromResolvingListView::Create(LeSecurityCommandView::Create(packet));
-  ASSERT_TRUE(packet_view.IsValid());
-  ASSERT_EQ(PeerAddressType::RANDOM_DEVICE_OR_IDENTITY_ADDRESS, packet_view.GetPeerIdentityAddressType());
-  ASSERT_EQ(address, packet_view.GetPeerIdentityAddress());
-  test_hci_layer_->IncomingEvent(LeRemoveDeviceFromResolvingListCompleteBuilder::Create(0x01, ErrorCode::SUCCESS));
+  {
+    auto packet = test_hci_layer_->GetCommand(OpCode::LE_SET_ADDRESS_RESOLUTION_ENABLE);
+    auto packet_view = LeSetAddressResolutionEnableView::Create(LeSecurityCommandView::Create(packet));
+    ASSERT_TRUE(packet_view.IsValid());
+    ASSERT_EQ(Enable::DISABLED, packet_view.GetAddressResolutionEnable());
+    test_hci_layer_->IncomingEvent(LeSetAddressResolutionEnableCompleteBuilder::Create(0x01, ErrorCode::SUCCESS));
+  }
+  {
+    ASSERT_NO_FATAL_FAILURE(test_hci_layer_->SetCommandFuture());
+    auto packet = test_hci_layer_->GetCommand(OpCode::LE_REMOVE_DEVICE_FROM_RESOLVING_LIST);
+    auto packet_view = LeRemoveDeviceFromResolvingListView::Create(LeSecurityCommandView::Create(packet));
+    ASSERT_TRUE(packet_view.IsValid());
+    ASSERT_EQ(PeerAddressType::RANDOM_DEVICE_OR_IDENTITY_ADDRESS, packet_view.GetPeerIdentityAddressType());
+    ASSERT_EQ(address, packet_view.GetPeerIdentityAddress());
+    test_hci_layer_->IncomingEvent(LeRemoveDeviceFromResolvingListCompleteBuilder::Create(0x01, ErrorCode::SUCCESS));
+  }
+  {
+    ASSERT_NO_FATAL_FAILURE(test_hci_layer_->SetCommandFuture());
+    auto packet = test_hci_layer_->GetCommand(OpCode::LE_SET_ADDRESS_RESOLUTION_ENABLE);
+    auto packet_view = LeSetAddressResolutionEnableView::Create(LeSecurityCommandView::Create(packet));
+    ASSERT_TRUE(packet_view.IsValid());
+    ASSERT_EQ(Enable::ENABLED, packet_view.GetAddressResolutionEnable());
+    test_hci_layer_->IncomingEvent(LeSetAddressResolutionEnableCompleteBuilder::Create(0x01, ErrorCode::SUCCESS));
+  }
   clients[0].get()->WaitForResume();
 }
 
-TEST_F(LeAddressManagerWithSingleClientTest, clear_resolving_list) {
+// b/260916288
+TEST_F(LeAddressManagerWithSingleClientTest, DISABLED_clear_resolving_list) {
   Address address;
   Address::FromString("01:02:03:04:05:06", address);
   Octet16 peer_irk = {0xec, 0x02, 0x34, 0xa3, 0x57, 0xc8, 0xad, 0x05, 0x34, 0x10, 0x10, 0xa6, 0x0a, 0x39, 0x7d, 0x9b};
   Octet16 local_irk = {0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f, 0x10};
-  test_hci_layer_->SetCommandFuture();
+  ASSERT_NO_FATAL_FAILURE(test_hci_layer_->SetCommandFuture());
   le_address_manager_->AddDeviceToResolvingList(
       PeerAddressType::RANDOM_DEVICE_OR_IDENTITY_ADDRESS, address, peer_irk, local_irk);
+  test_hci_layer_->GetCommand(OpCode::LE_SET_ADDRESS_RESOLUTION_ENABLE);
+  test_hci_layer_->IncomingEvent(LeSetAddressResolutionEnableCompleteBuilder::Create(0x01, ErrorCode::SUCCESS));
+  ASSERT_NO_FATAL_FAILURE(test_hci_layer_->SetCommandFuture());
   test_hci_layer_->GetCommand(OpCode::LE_ADD_DEVICE_TO_RESOLVING_LIST);
   test_hci_layer_->IncomingEvent(LeAddDeviceToResolvingListCompleteBuilder::Create(0x01, ErrorCode::SUCCESS));
+  ASSERT_NO_FATAL_FAILURE(test_hci_layer_->SetCommandFuture());
+  test_hci_layer_->GetCommand(OpCode::LE_SET_ADDRESS_RESOLUTION_ENABLE);
+  test_hci_layer_->IncomingEvent(LeSetAddressResolutionEnableCompleteBuilder::Create(0x01, ErrorCode::SUCCESS));
 
-  test_hci_layer_->SetCommandFuture();
+  ASSERT_NO_FATAL_FAILURE(test_hci_layer_->SetCommandFuture());
   le_address_manager_->ClearResolvingList();
-  auto packet = test_hci_layer_->GetCommand(OpCode::LE_CLEAR_RESOLVING_LIST);
-  auto packet_view = LeClearResolvingListView::Create(LeSecurityCommandView::Create(packet));
-  ASSERT_TRUE(packet_view.IsValid());
-  test_hci_layer_->IncomingEvent(LeClearResolvingListCompleteBuilder::Create(0x01, ErrorCode::SUCCESS));
+  {
+    auto packet = test_hci_layer_->GetCommand(OpCode::LE_SET_ADDRESS_RESOLUTION_ENABLE);
+    auto packet_view = LeSetAddressResolutionEnableView::Create(LeSecurityCommandView::Create(packet));
+    ASSERT_TRUE(packet_view.IsValid());
+    ASSERT_EQ(Enable::DISABLED, packet_view.GetAddressResolutionEnable());
+    test_hci_layer_->IncomingEvent(LeSetAddressResolutionEnableCompleteBuilder::Create(0x01, ErrorCode::SUCCESS));
+  }
+  {
+    ASSERT_NO_FATAL_FAILURE(test_hci_layer_->SetCommandFuture());
+    auto packet = test_hci_layer_->GetCommand(OpCode::LE_CLEAR_RESOLVING_LIST);
+    auto packet_view = LeClearResolvingListView::Create(LeSecurityCommandView::Create(packet));
+    ASSERT_TRUE(packet_view.IsValid());
+    test_hci_layer_->IncomingEvent(LeClearResolvingListCompleteBuilder::Create(0x01, ErrorCode::SUCCESS));
+  }
+  {
+    ASSERT_NO_FATAL_FAILURE(test_hci_layer_->SetCommandFuture());
+    auto packet = test_hci_layer_->GetCommand(OpCode::LE_SET_ADDRESS_RESOLUTION_ENABLE);
+    auto packet_view = LeSetAddressResolutionEnableView::Create(LeSecurityCommandView::Create(packet));
+    ASSERT_TRUE(packet_view.IsValid());
+    ASSERT_EQ(Enable::ENABLED, packet_view.GetAddressResolutionEnable());
+    test_hci_layer_->IncomingEvent(LeSetAddressResolutionEnableCompleteBuilder::Create(0x01, ErrorCode::SUCCESS));
+  }
+
   clients[0].get()->WaitForResume();
 }
 
 TEST_F(LeAddressManagerWithSingleClientTest, register_during_command_complete) {
   Address address;
   Address::FromString("01:02:03:04:05:06", address);
-  test_hci_layer_->SetCommandFuture();
+  ASSERT_NO_FATAL_FAILURE(test_hci_layer_->SetCommandFuture());
   le_address_manager_->AddDeviceToFilterAcceptList(FilterAcceptListAddressType::RANDOM, address);
   auto packet = test_hci_layer_->GetCommand(OpCode::LE_ADD_DEVICE_TO_FILTER_ACCEPT_LIST);
   auto packet_view = LeAddDeviceToFilterAcceptListView::Create(
@@ -453,11 +536,12 @@
   test_hci_layer_->IncomingEvent(LeAddDeviceToFilterAcceptListCompleteBuilder::Create(0x01, ErrorCode::SUCCESS));
 
   AllocateClients(1);
-  test_hci_layer_->SetCommandFuture();
+  ASSERT_NO_FATAL_FAILURE(test_hci_layer_->SetCommandFuture());
   le_address_manager_->Register(clients[1].get());
   clients[0].get()->WaitForResume();
   clients[1].get()->WaitForResume();
 }
 
+}  // namespace
 }  // namespace hci
 }  // namespace bluetooth
diff --git a/system/gd/hci/le_advertising_manager.cc b/system/gd/hci/le_advertising_manager.cc
index eca691b..c96b971 100644
--- a/system/gd/hci/le_advertising_manager.cc
+++ b/system/gd/hci/le_advertising_manager.cc
@@ -24,6 +24,7 @@
 #include "hci/hci_layer.h"
 #include "hci/hci_packets.h"
 #include "hci/le_advertising_interface.h"
+#include "hci/vendor_specific_event_manager.h"
 #include "module.h"
 #include "os/handler.h"
 #include "os/log.h"
@@ -34,6 +35,7 @@
 
 const ModuleFactory LeAdvertisingManager::Factory = ModuleFactory([]() { return new LeAdvertisingManager(); });
 constexpr int kIdLocal = 0xff;  // Id for advertiser not register from Java layer
+constexpr uint16_t kLenOfFlags = 0x03;
 
 enum class AdvertisingApiType {
   LEGACY = 1,
@@ -52,8 +54,8 @@
 struct Advertiser {
   os::Handler* handler;
   AddressWithType current_address;
-  base::Callback<void(uint8_t /* status */)> status_callback;
-  base::Callback<void(uint8_t /* status */)> timeout_callback;
+  base::OnceCallback<void(uint8_t /* status */)> status_callback;
+  base::OnceCallback<void(uint8_t /* status */)> timeout_callback;
   common::Callback<void(Address, AddressType)> scan_callback;
   common::Callback<void(ErrorCode, uint8_t, uint8_t)> set_terminated_callback;
   int8_t tx_power;
@@ -72,7 +74,7 @@
       connectable = true;
       scannable = true;
       break;
-    case AdvertisingType::ADV_DIRECT_IND:
+    case AdvertisingType::ADV_DIRECT_IND_HIGH:
       connectable = true;
       directed = true;
       high_duty_directed_connectable = true;
@@ -102,21 +104,25 @@
     advertising_sets_.clear();
   }
 
-  void start(os::Handler* handler, hci::HciLayer* hci_layer, hci::Controller* controller,
-             hci::AclManager* acl_manager) {
+  void start(
+      os::Handler* handler,
+      hci::HciLayer* hci_layer,
+      hci::Controller* controller,
+      hci::AclManager* acl_manager,
+      hci::VendorSpecificEventManager* vendor_specific_event_manager) {
     module_handler_ = handler;
     hci_layer_ = hci_layer;
     controller_ = controller;
     le_maximum_advertising_data_length_ = controller_->GetLeMaximumAdvertisingDataLength();
     acl_manager_ = acl_manager;
     le_address_manager_ = acl_manager->GetLeAddressManager();
+    num_instances_ = controller_->GetLeNumberOfSupportedAdverisingSets();
+
     le_advertising_interface_ =
         hci_layer_->GetLeAdvertisingInterface(module_handler_->BindOn(this, &LeAdvertisingManager::impl::handle_event));
-    num_instances_ = controller_->GetLeNumberOfSupportedAdverisingSets();
-    enabled_sets_ = std::vector<EnabledSet>(num_instances_);
-    for (size_t i = 0; i < enabled_sets_.size(); i++) {
-      enabled_sets_[i].advertising_handle_ = kInvalidHandle;
-    }
+    vendor_specific_event_manager->RegisterEventHandler(
+        hci::VseSubeventCode::BLE_STCHANGE,
+        handler->BindOn(this, &LeAdvertisingManager::impl::multi_advertising_state_change));
 
     if (controller_->SupportsBleExtendedAdvertising()) {
       advertising_api_type_ = AdvertisingApiType::EXTENDED;
@@ -137,6 +143,10 @@
             handler->BindOnceOn(this, &impl::on_read_advertising_physical_channel_tx_power));
       }
     }
+    enabled_sets_ = std::vector<EnabledSet>(num_instances_);
+    for (size_t i = 0; i < enabled_sets_.size(); i++) {
+      enabled_sets_[i].advertising_handle_ = kInvalidHandle;
+    }
   }
 
   size_t GetNumberOfAdvertisingInstances() const {
@@ -151,6 +161,33 @@
     advertising_callbacks_ = advertising_callback;
   }
 
+  void multi_advertising_state_change(hci::VendorSpecificEventView event) {
+    auto view = hci::LEAdvertiseStateChangeEventView::Create(event);
+    ASSERT(view.IsValid());
+
+    auto advertiser_id = view.GetAdvertisingInstance();
+
+    LOG_INFO(
+        "Instance: 0x%x StateChangeReason: 0x%s Handle: 0x%x Address: %s",
+        advertiser_id,
+        VseStateChangeReasonText(view.GetStateChangeReason()).c_str(),
+        view.GetConnectionHandle(),
+        advertising_sets_[view.GetAdvertisingInstance()].current_address.ToString().c_str());
+
+    if (view.GetStateChangeReason() == VseStateChangeReason::CONNECTION_RECEIVED) {
+      acl_manager_->OnAdvertisingSetTerminated(
+          ErrorCode::SUCCESS, view.GetConnectionHandle(), advertising_sets_[advertiser_id].current_address);
+
+      enabled_sets_[advertiser_id].advertising_handle_ = kInvalidHandle;
+
+      if (!advertising_sets_[advertiser_id].directed) {
+        // TODO(250666237) calculate remaining duration and advertising events
+        LOG_INFO("Resuming advertising, since not directed");
+        enable_advertiser(advertiser_id, true, 0, 0);
+      }
+    }
+  }
+
   void handle_event(LeMetaEventView event) {
     switch (event.GetSubeventCode()) {
       case hci::SubeventCode::SCAN_REQUEST_RECEIVED:
@@ -197,7 +234,7 @@
     if (status == ErrorCode::LIMIT_REACHED || status == ErrorCode::ADVERTISING_TIMEOUT) {
       if (id_map_[advertiser_id] == kIdLocal) {
         if (!advertising_sets_[advertiser_id].timeout_callback.is_null()) {
-          advertising_sets_[advertiser_id].timeout_callback.Run((uint8_t)status);
+          std::move(advertising_sets_[advertiser_id].timeout_callback).Run((uint8_t)status);
           advertising_sets_[advertiser_id].timeout_callback.Reset();
         }
       } else {
@@ -271,6 +308,15 @@
       const common::Callback<void(Address, AddressType)>& scan_callback,
       const common::Callback<void(ErrorCode, uint8_t, uint8_t)>& set_terminated_callback,
       os::Handler* handler) {
+    // check advertising data is valid before start advertising
+    ExtendedAdvertisingConfig extended_config = static_cast<ExtendedAdvertisingConfig>(config);
+    if (!check_advertising_data(config.advertisement, extended_config.connectable) ||
+        !check_advertising_data(config.scan_response, false)) {
+      advertising_callbacks_->OnAdvertisingSetStarted(
+          reg_id, id, le_physical_channel_tx_power_, AdvertisingCallback::AdvertisingStatus::DATA_TOO_LARGE);
+      return;
+    }
+
     id_map_[id] = reg_id;
     advertising_sets_[id].scan_callback = scan_callback;
     advertising_sets_[id].set_terminated_callback = set_terminated_callback;
@@ -317,9 +363,11 @@
           set_data(id, true, config.scan_response);
         }
         set_data(id, false, config.advertisement);
-        le_advertising_interface_->EnqueueCommand(
-            hci::LeMultiAdvtSetRandomAddrBuilder::Create(advertising_sets_[id].current_address.GetAddress(), id),
-            module_handler_->BindOnce(impl::check_status<LeMultiAdvtCompleteView>));
+        if (address_policy != LeAddressManager::AddressPolicy::USE_PUBLIC_ADDRESS) {
+          le_advertising_interface_->EnqueueCommand(
+              hci::LeMultiAdvtSetRandomAddrBuilder::Create(advertising_sets_[id].current_address.GetAddress(), id),
+              module_handler_->BindOnce(impl::check_status<LeMultiAdvtCompleteView>));
+        }
         if (!paused) {
           enable_advertiser(id, true, 0, 0);
         } else {
@@ -336,13 +384,13 @@
       AdvertiserId id,
       const ExtendedAdvertisingConfig config,
       uint16_t duration,
-      const base::Callback<void(uint8_t /* status */)>& status_callback,
-      const base::Callback<void(uint8_t /* status */)>& timeout_callback,
+      base::OnceCallback<void(uint8_t /* status */)> status_callback,
+      base::OnceCallback<void(uint8_t /* status */)> timeout_callback,
       const common::Callback<void(Address, AddressType)>& scan_callback,
       const common::Callback<void(ErrorCode, uint8_t, uint8_t)>& set_terminated_callback,
       os::Handler* handler) {
-    advertising_sets_[id].status_callback = status_callback;
-    advertising_sets_[id].timeout_callback = timeout_callback;
+    advertising_sets_[id].status_callback = std::move(status_callback);
+    advertising_sets_[id].timeout_callback = std::move(timeout_callback);
 
     create_extended_advertiser(kIdLocal, id, config, scan_callback, set_terminated_callback, duration, 0, handler);
   }
@@ -364,8 +412,8 @@
     }
 
     // check extended advertising data is valid before start advertising
-    if (!check_extended_advertising_data(config.advertisement) ||
-        !check_extended_advertising_data(config.scan_response)) {
+    if (!check_extended_advertising_data(config.advertisement, config.connectable) ||
+        !check_extended_advertising_data(config.scan_response, false)) {
       advertising_callbacks_->OnAdvertisingSetStarted(
           reg_id, id, le_physical_channel_tx_power_, AdvertisingCallback::AdvertisingStatus::DATA_TOO_LARGE);
       return;
@@ -391,11 +439,10 @@
             address_policy == LeAddressManager::AddressPolicy::USE_RESOLVABLE_ADDRESS) {
           AddressWithType address_with_type = le_address_manager_->GetAnotherAddress();
           le_advertising_interface_->EnqueueCommand(
-              hci::LeSetExtendedAdvertisingRandomAddressBuilder::Create(id, address_with_type.GetAddress()),
+              hci::LeSetAdvertisingSetRandomAddressBuilder::Create(id, address_with_type.GetAddress()),
               module_handler_->BindOnceOn(
                   this,
-                  &impl::on_set_advertising_set_random_address_complete<
-                      LeSetExtendedAdvertisingRandomAddressCompleteView>,
+                  &impl::on_set_advertising_set_random_address_complete<LeSetAdvertisingSetRandomAddressCompleteView>,
                   id,
                   address_with_type));
 
@@ -407,9 +454,9 @@
         } else {
           advertising_sets_[id].current_address = le_address_manager_->GetCurrentAddress();
           le_advertising_interface_->EnqueueCommand(
-              hci::LeSetExtendedAdvertisingRandomAddressBuilder::Create(
+              hci::LeSetAdvertisingSetRandomAddressBuilder::Create(
                   id, advertising_sets_[id].current_address.GetAddress()),
-              module_handler_->BindOnce(impl::check_status<LeSetExtendedAdvertisingRandomAddressCompleteView>));
+              module_handler_->BindOnce(impl::check_status<LeSetAdvertisingSetRandomAddressCompleteView>));
         }
         break;
       case OwnAddressType::PUBLIC_DEVICE_ADDRESS:
@@ -486,10 +533,10 @@
     if (advertising_api_type_ == AdvertisingApiType::EXTENDED) {
       AddressWithType address_with_type = le_address_manager_->GetAnotherAddress();
       le_advertising_interface_->EnqueueCommand(
-          hci::LeSetExtendedAdvertisingRandomAddressBuilder::Create(advertiser_id, address_with_type.GetAddress()),
+          hci::LeSetAdvertisingSetRandomAddressBuilder::Create(advertiser_id, address_with_type.GetAddress()),
           module_handler_->BindOnceOn(
               this,
-              &impl::on_set_advertising_set_random_address_complete<LeSetExtendedAdvertisingRandomAddressCompleteView>,
+              &impl::on_set_advertising_set_random_address_complete<LeSetAdvertisingSetRandomAddressCompleteView>,
               advertiser_id,
               address_with_type));
     }
@@ -590,23 +637,23 @@
         config.sid = advertiser_id % kAdvertisingSetIdMask;
 
         if (config.legacy_pdus) {
-          LegacyAdvertisingProperties legacy_properties = LegacyAdvertisingProperties::ADV_IND;
+          LegacyAdvertisingEventProperties legacy_properties = LegacyAdvertisingEventProperties::ADV_IND;
           if (config.connectable && config.directed) {
             if (config.high_duty_directed_connectable) {
-              legacy_properties = LegacyAdvertisingProperties::ADV_DIRECT_IND_HIGH;
+              legacy_properties = LegacyAdvertisingEventProperties::ADV_DIRECT_IND_HIGH;
             } else {
-              legacy_properties = LegacyAdvertisingProperties::ADV_DIRECT_IND_LOW;
+              legacy_properties = LegacyAdvertisingEventProperties::ADV_DIRECT_IND_LOW;
             }
           }
           if (config.scannable && !config.connectable) {
-            legacy_properties = LegacyAdvertisingProperties::ADV_SCAN_IND;
+            legacy_properties = LegacyAdvertisingEventProperties::ADV_SCAN_IND;
           }
           if (!config.scannable && !config.connectable) {
-            legacy_properties = LegacyAdvertisingProperties::ADV_NONCONN_IND;
+            legacy_properties = LegacyAdvertisingEventProperties::ADV_NONCONN_IND;
           }
 
           le_advertising_interface_->EnqueueCommand(
-              LeSetExtendedAdvertisingLegacyParametersBuilder::Create(
+              LeSetExtendedAdvertisingParametersLegacyBuilder::Create(
                   advertiser_id,
                   legacy_properties,
                   config.interval_min,
@@ -625,16 +672,18 @@
                       LeSetExtendedAdvertisingParametersCompleteView>,
                   advertiser_id));
         } else {
-          uint8_t legacy_properties = (config.connectable ? 0x1 : 0x00) | (config.scannable ? 0x2 : 0x00) |
-                                      (config.directed ? 0x4 : 0x00) |
-                                      (config.high_duty_directed_connectable ? 0x8 : 0x00);
-          uint8_t extended_properties = (config.anonymous ? 0x20 : 0x00) | (config.include_tx_power ? 0x40 : 0x00);
-          extended_properties = extended_properties >> 5;
+          AdvertisingEventProperties extended_properties;
+          extended_properties.connectable_ = config.connectable;
+          extended_properties.scannable_ = config.scannable;
+          extended_properties.directed_ = config.directed;
+          extended_properties.high_duty_cycle_ = config.high_duty_directed_connectable;
+          extended_properties.legacy_ = false;
+          extended_properties.anonymous_ = config.anonymous;
+          extended_properties.tx_power_ = config.include_tx_power;
 
           le_advertising_interface_->EnqueueCommand(
               hci::LeSetExtendedAdvertisingParametersBuilder::Create(
                   advertiser_id,
-                  legacy_properties,
                   extended_properties,
                   config.interval_min,
                   config.interval_max,
@@ -659,7 +708,39 @@
     }
   }
 
-  bool check_extended_advertising_data(std::vector<GapData> data) {
+  bool data_has_flags(std::vector<GapData> data) {
+    for (auto& gap_data : data) {
+      if (gap_data.data_type_ == GapDataType::FLAGS) {
+        return true;
+      }
+    }
+    return false;
+  }
+
+  bool check_advertising_data(std::vector<GapData> data, bool include_flag) {
+    uint16_t data_len = 0;
+    // check data size
+    for (size_t i = 0; i < data.size(); i++) {
+      data_len += data[i].size();
+    }
+
+    // The Flags data type shall be included when any of the Flag bits are non-zero and the advertising packet
+    // is connectable. It will be added by set_data() function, we should count it here.
+    if (include_flag && !data_has_flags(data)) {
+      data_len += kLenOfFlags;
+    }
+
+    if (data_len > le_maximum_advertising_data_length_) {
+      LOG_WARN(
+          "advertising data len %d exceeds le_maximum_advertising_data_length_ %d",
+          data_len,
+          le_maximum_advertising_data_length_);
+      return false;
+    }
+    return true;
+  };
+
+  bool check_extended_advertising_data(std::vector<GapData> data, bool include_flag) {
     uint16_t data_len = 0;
     // check data size
     for (size_t i = 0; i < data.size(); i++) {
@@ -670,16 +751,26 @@
       data_len += data[i].size();
     }
 
+    // The Flags data type shall be included when any of the Flag bits are non-zero and the advertising packet
+    // is connectable. It will be added by set_data() function, we should count it here.
+    if (include_flag && !data_has_flags(data)) {
+      data_len += kLenOfFlags;
+    }
+
     if (data_len > le_maximum_advertising_data_length_) {
       LOG_WARN(
-          "advertising data len exceeds le_maximum_advertising_data_length_ %d", le_maximum_advertising_data_length_);
+          "advertising data len %d exceeds le_maximum_advertising_data_length_ %d",
+          data_len,
+          le_maximum_advertising_data_length_);
       return false;
     }
     return true;
   };
 
   void set_data(AdvertiserId advertiser_id, bool set_scan_rsp, std::vector<GapData> data) {
-    if (!set_scan_rsp && advertising_sets_[advertiser_id].connectable) {
+    // The Flags data type shall be included when any of the Flag bits are non-zero and the advertising packet
+    // is connectable.
+    if (!set_scan_rsp && advertising_sets_[advertiser_id].connectable && !data_has_flags(data)) {
       GapData gap_data;
       gap_data.data_type_ = GapDataType::FLAGS;
       if (advertising_sets_[advertiser_id].duration == 0) {
@@ -698,6 +789,17 @@
       }
     }
 
+    if (advertising_api_type_ != AdvertisingApiType::EXTENDED && !check_advertising_data(data, false)) {
+      if (set_scan_rsp) {
+        advertising_callbacks_->OnScanResponseDataSet(
+            advertiser_id, AdvertisingCallback::AdvertisingStatus::DATA_TOO_LARGE);
+      } else {
+        advertising_callbacks_->OnAdvertisingDataSet(
+            advertiser_id, AdvertisingCallback::AdvertisingStatus::DATA_TOO_LARGE);
+      }
+      return;
+    }
+
     switch (advertising_api_type_) {
       case (AdvertisingApiType::LEGACY): {
         if (set_scan_rsp) {
@@ -787,10 +889,9 @@
     if (operation == Operation::COMPLETE_ADVERTISEMENT || operation == Operation::LAST_FRAGMENT) {
       if (set_scan_rsp) {
         le_advertising_interface_->EnqueueCommand(
-            hci::LeSetExtendedAdvertisingScanResponseBuilder::Create(
-                advertiser_id, operation, kFragment_preference, data),
+            hci::LeSetExtendedScanResponseDataBuilder::Create(advertiser_id, operation, kFragment_preference, data),
             module_handler_->BindOnceOn(
-                this, &impl::check_status_with_id<LeSetExtendedAdvertisingScanResponseCompleteView>, advertiser_id));
+                this, &impl::check_status_with_id<LeSetExtendedScanResponseDataCompleteView>, advertiser_id));
       } else {
         le_advertising_interface_->EnqueueCommand(
             hci::LeSetExtendedAdvertisingDataBuilder::Create(advertiser_id, operation, kFragment_preference, data),
@@ -801,9 +902,8 @@
       // For first and intermediate fragment, do not trigger advertising_callbacks_.
       if (set_scan_rsp) {
         le_advertising_interface_->EnqueueCommand(
-            hci::LeSetExtendedAdvertisingScanResponseBuilder::Create(
-                advertiser_id, operation, kFragment_preference, data),
-            module_handler_->BindOnce(impl::check_status<LeSetExtendedAdvertisingScanResponseCompleteView>));
+            hci::LeSetExtendedScanResponseDataBuilder::Create(advertiser_id, operation, kFragment_preference, data),
+            module_handler_->BindOnce(impl::check_status<LeSetExtendedScanResponseDataCompleteView>));
       } else {
         le_advertising_interface_->EnqueueCommand(
             hci::LeSetExtendedAdvertisingDataBuilder::Create(advertiser_id, operation, kFragment_preference, data),
@@ -829,22 +929,29 @@
                 this,
                 &impl::on_set_advertising_enable_complete<LeSetAdvertisingEnableCompleteView>,
                 enable,
-                enabled_sets));
+                enabled_sets,
+                true /* trigger callbacks */));
       } break;
       case (AdvertisingApiType::ANDROID_HCI): {
         le_advertising_interface_->EnqueueCommand(
             hci::LeMultiAdvtSetEnableBuilder::Create(enable_value, advertiser_id),
             module_handler_->BindOnceOn(
-                this, &impl::on_set_advertising_enable_complete<LeMultiAdvtCompleteView>, enable, enabled_sets));
+                this,
+                &impl::on_set_advertising_enable_complete<LeMultiAdvtCompleteView>,
+                enable,
+                enabled_sets,
+                true /* trigger callbacks */));
       } break;
       case (AdvertisingApiType::EXTENDED): {
         le_advertising_interface_->EnqueueCommand(
             hci::LeSetExtendedAdvertisingEnableBuilder::Create(enable_value, enabled_sets),
             module_handler_->BindOnceOn(
                 this,
-                &impl::on_set_extended_advertising_enable_complete<LeSetExtendedAdvertisingEnableCompleteView>,
+                &impl::on_set_extended_advertising_enable_complete<
+                    LeSetExtendedAdvertisingEnableCompleteView>,
                 enable,
-                enabled_sets));
+                enabled_sets,
+                true /* trigger callbacks */));
       } break;
     }
 
@@ -949,6 +1056,10 @@
   }
 
   void OnPause() override {
+    if (!address_manager_registered) {
+      LOG_WARN("Unregistered!");
+      return;
+    }
     paused = true;
     if (!advertising_sets_.empty()) {
       std::vector<EnabledSet> enabled_sets = {};
@@ -988,6 +1099,10 @@
   }
 
   void OnResume() override {
+    if (!address_manager_registered) {
+      LOG_WARN("Unregistered!");
+      return;
+    }
     paused = false;
     if (!advertising_sets_.empty()) {
       std::vector<EnabledSet> enabled_sets = {};
@@ -1002,7 +1117,17 @@
         case (AdvertisingApiType::LEGACY): {
           le_advertising_interface_->EnqueueCommand(
               hci::LeSetAdvertisingEnableBuilder::Create(Enable::ENABLED),
-              module_handler_->BindOnce(impl::check_status<LeSetAdvertisingEnableCompleteView>));
+              common::init_flags::
+                      trigger_advertising_callbacks_on_first_resume_after_pause_is_enabled()
+                  ? module_handler_->BindOnceOn(
+                        this,
+                        &impl::on_set_advertising_enable_complete<
+                            LeSetAdvertisingEnableCompleteView>,
+                        true,
+                        enabled_sets,
+                        false /* trigger_callbacks */)
+                  : module_handler_->BindOnce(
+                        impl::check_status<LeSetAdvertisingEnableCompleteView>));
         } break;
         case (AdvertisingApiType::ANDROID_HCI): {
           for (size_t i = 0; i < enabled_sets_.size(); i++) {
@@ -1010,7 +1135,15 @@
             if (id != kInvalidHandle) {
               le_advertising_interface_->EnqueueCommand(
                   hci::LeMultiAdvtSetEnableBuilder::Create(Enable::ENABLED, id),
-                  module_handler_->BindOnce(impl::check_status<LeMultiAdvtCompleteView>));
+                  common::init_flags::
+                          trigger_advertising_callbacks_on_first_resume_after_pause_is_enabled()
+                      ? module_handler_->BindOnceOn(
+                            this,
+                            &impl::on_set_advertising_enable_complete<LeMultiAdvtCompleteView>,
+                            true,
+                            enabled_sets,
+                            false /* trigger_callbacks */)
+                      : module_handler_->BindOnce(impl::check_status<LeMultiAdvtCompleteView>));
             }
           }
         } break;
@@ -1018,7 +1151,17 @@
           if (enabled_sets.size() != 0) {
             le_advertising_interface_->EnqueueCommand(
                 hci::LeSetExtendedAdvertisingEnableBuilder::Create(Enable::ENABLED, enabled_sets),
-                module_handler_->BindOnce(impl::check_status<LeSetExtendedAdvertisingEnableCompleteView>));
+                common::init_flags::
+                        trigger_advertising_callbacks_on_first_resume_after_pause_is_enabled()
+                    ? module_handler_->BindOnceOn(
+                          this,
+                          &impl::on_set_extended_advertising_enable_complete<
+                              LeSetExtendedAdvertisingEnableCompleteView>,
+                          true,
+                          enabled_sets,
+                          false /* trigger_callbacks */)
+                    : module_handler_->BindOnce(
+                          impl::check_status<LeSetExtendedAdvertisingEnableCompleteView>));
           }
         } break;
       }
@@ -1085,7 +1228,11 @@
   }
 
   template <class View>
-  void on_set_advertising_enable_complete(bool enable, std::vector<EnabledSet> enabled_sets, CommandCompleteView view) {
+  void on_set_advertising_enable_complete(
+      bool enable,
+      std::vector<EnabledSet> enabled_sets,
+      bool trigger_callbacks,
+      CommandCompleteView view) {
     ASSERT(view.IsValid());
     auto complete_view = View::Create(view);
     ASSERT(complete_view.IsValid());
@@ -1104,18 +1251,20 @@
         continue;
       }
 
-      if (id_map_[id] == kIdLocal) {
+      int reg_id = id_map_[id];
+      if (reg_id == kIdLocal) {
         if (!advertising_sets_[enabled_set.advertising_handle_].status_callback.is_null()) {
-          advertising_sets_[enabled_set.advertising_handle_].status_callback.Run(advertising_status);
+          std::move(advertising_sets_[enabled_set.advertising_handle_].status_callback).Run(advertising_status);
           advertising_sets_[enabled_set.advertising_handle_].status_callback.Reset();
         }
         continue;
       }
 
       if (started) {
-        advertising_callbacks_->OnAdvertisingEnabled(id, enable, advertising_status);
+        if (trigger_callbacks) {
+          advertising_callbacks_->OnAdvertisingEnabled(id, enable, advertising_status);
+        }
       } else {
-        int reg_id = id_map_[id];
         advertising_sets_[enabled_set.advertising_handle_].started = true;
         advertising_callbacks_->OnAdvertisingSetStarted(reg_id, id, le_physical_channel_tx_power_, advertising_status);
       }
@@ -1124,7 +1273,10 @@
 
   template <class View>
   void on_set_extended_advertising_enable_complete(
-      bool enable, std::vector<EnabledSet> enabled_sets, CommandCompleteView view) {
+      bool enable,
+      std::vector<EnabledSet> enabled_sets,
+      bool trigger_callbacks,
+      CommandCompleteView view) {
     ASSERT(view.IsValid());
     auto complete_view = LeSetExtendedAdvertisingEnableCompleteView::Create(view);
     ASSERT(complete_view.IsValid());
@@ -1146,18 +1298,20 @@
         continue;
       }
 
-      if (id_map_[id] == kIdLocal) {
+      int reg_id = id_map_[id];
+      if (reg_id == kIdLocal) {
         if (!advertising_sets_[enabled_set.advertising_handle_].status_callback.is_null()) {
-          advertising_sets_[enabled_set.advertising_handle_].status_callback.Run(advertising_status);
+          std::move(advertising_sets_[enabled_set.advertising_handle_].status_callback).Run(advertising_status);
           advertising_sets_[enabled_set.advertising_handle_].status_callback.Reset();
         }
         continue;
       }
 
       if (started) {
-        advertising_callbacks_->OnAdvertisingEnabled(id, enable, advertising_status);
+        if (trigger_callbacks) {
+          advertising_callbacks_->OnAdvertisingEnabled(id, enable, advertising_status);
+        }
       } else {
-        int reg_id = id_map_[id];
         advertising_sets_[enabled_set.advertising_handle_].started = true;
         advertising_callbacks_->OnAdvertisingSetStarted(reg_id, id, tx_power, advertising_status);
       }
@@ -1203,7 +1357,7 @@
   void on_set_advertising_set_random_address_complete(
       AdvertiserId advertiser_id, AddressWithType address_with_type, CommandCompleteView view) {
     ASSERT(view.IsValid());
-    auto complete_view = LeSetExtendedAdvertisingRandomAddressCompleteView::Create(view);
+    auto complete_view = LeSetAdvertisingSetRandomAddressCompleteView::Create(view);
     ASSERT(complete_view.IsValid());
     if (complete_view.GetStatus() != ErrorCode::SUCCESS) {
       LOG_ERROR("Got a command complete with status %s", ErrorCodeText(complete_view.GetStatus()).c_str());
@@ -1250,7 +1404,7 @@
         advertising_callbacks_->OnAdvertisingDataSet(id, advertising_status);
         break;
       case OpCode::LE_SET_SCAN_RESPONSE_DATA:
-      case OpCode::LE_SET_EXTENDED_ADVERTISING_SCAN_RESPONSE:
+      case OpCode::LE_SET_EXTENDED_SCAN_RESPONSE_DATA:
         advertising_callbacks_->OnScanResponseDataSet(id, advertising_status);
         break;
       case OpCode::LE_SET_PERIODIC_ADVERTISING_PARAM:
@@ -1310,11 +1464,16 @@
   list->add<hci::HciLayer>();
   list->add<hci::Controller>();
   list->add<hci::AclManager>();
+  list->add<hci::VendorSpecificEventManager>();
 }
 
 void LeAdvertisingManager::Start() {
-  pimpl_->start(GetHandler(), GetDependency<hci::HciLayer>(), GetDependency<hci::Controller>(),
-                GetDependency<AclManager>());
+  pimpl_->start(
+      GetHandler(),
+      GetDependency<hci::HciLayer>(),
+      GetDependency<hci::Controller>(),
+      GetDependency<AclManager>(),
+      GetDependency<VendorSpecificEventManager>());
 }
 
 void LeAdvertisingManager::Stop() {
@@ -1343,7 +1502,7 @@
           pimpl_.get(), &impl::start_advertising_fail, reg_id, AdvertisingCallback::AdvertisingStatus::INTERNAL_ERROR);
       return kInvalidId;
     }
-    if (config.advertising_type == hci::AdvertisingType::ADV_DIRECT_IND ||
+    if (config.advertising_type == hci::AdvertisingType::ADV_DIRECT_IND_HIGH ||
         config.advertising_type == hci::AdvertisingType::ADV_DIRECT_IND_LOW) {
       LOG_WARN("Peer address can not be empty for directed advertising");
       CallOn(
@@ -1446,8 +1605,8 @@
     AdvertiserId advertiser_id,
     const ExtendedAdvertisingConfig config,
     uint16_t duration,
-    const base::Callback<void(uint8_t /* status */)>& status_callback,
-    const base::Callback<void(uint8_t /* status */)>& timeout_callback,
+    base::OnceCallback<void(uint8_t /* status */)> status_callback,
+    base::OnceCallback<void(uint8_t /* status */)> timeout_callback,
     const common::Callback<void(Address, AddressType)>& scan_callback,
     const common::Callback<void(ErrorCode, uint8_t, uint8_t)>& set_terminated_callback,
     os::Handler* handler) {
@@ -1457,20 +1616,20 @@
       advertiser_id,
       config,
       duration,
-      status_callback,
-      timeout_callback,
+      std::move(status_callback),
+      std::move(timeout_callback),
       scan_callback,
       set_terminated_callback,
       handler);
 }
 
 void LeAdvertisingManager::RegisterAdvertiser(
-    base::Callback<void(uint8_t /* inst_id */, uint8_t /* status */)> callback) {
+    base::OnceCallback<void(uint8_t /* inst_id */, uint8_t /* status */)> callback) {
   AdvertiserId id = pimpl_->allocate_advertiser();
   if (id == kInvalidId) {
-    callback.Run(kInvalidId, AdvertisingCallback::AdvertisingStatus::TOO_MANY_ADVERTISERS);
+    std::move(callback).Run(kInvalidId, AdvertisingCallback::AdvertisingStatus::TOO_MANY_ADVERTISERS);
   } else {
-    callback.Run(id, AdvertisingCallback::AdvertisingStatus::SUCCESS);
+    std::move(callback).Run(id, AdvertisingCallback::AdvertisingStatus::SUCCESS);
   }
 }
 
diff --git a/system/gd/hci/le_advertising_manager.h b/system/gd/hci/le_advertising_manager.h
index 7394422..b3791a4 100644
--- a/system/gd/hci/le_advertising_manager.h
+++ b/system/gd/hci/le_advertising_manager.h
@@ -120,15 +120,15 @@
       AdvertiserId advertiser_id,
       const ExtendedAdvertisingConfig config,
       uint16_t duration,
-      const base::Callback<void(uint8_t /* status */)>& status_callback,
-      const base::Callback<void(uint8_t /* status */)>& timeout_callback,
+      base::OnceCallback<void(uint8_t /* status */)> status_callback,
+      base::OnceCallback<void(uint8_t /* status */)> timeout_callback,
       const common::Callback<void(Address, AddressType)>& scan_callback,
       const common::Callback<void(ErrorCode, uint8_t, uint8_t)>& set_terminated_callback,
       os::Handler* handler);
 
   void GetOwnAddress(uint8_t advertiser_id);
 
-  void RegisterAdvertiser(base::Callback<void(uint8_t /* inst_id */, uint8_t /* status */)> callback);
+  void RegisterAdvertiser(base::OnceCallback<void(uint8_t /* inst_id */, uint8_t /* status */)> callback);
 
   void SetParameters(AdvertiserId advertiser_id, ExtendedAdvertisingConfig config);
 
diff --git a/system/gd/hci/le_advertising_manager_test.cc b/system/gd/hci/le_advertising_manager_test.cc
index ecb8921..c7621c9 100644
--- a/system/gd/hci/le_advertising_manager_test.cc
+++ b/system/gd/hci/le_advertising_manager_test.cc
@@ -16,19 +16,19 @@
 
 #include "hci/le_advertising_manager.h"
 
+#include <gmock/gmock.h>
+#include <gtest/gtest.h>
+
 #include <algorithm>
 #include <chrono>
 #include <future>
 #include <map>
 
-#include <gmock/gmock.h>
-#include <gtest/gtest.h>
-
 #include "common/bind.h"
 #include "hci/acl_manager.h"
 #include "hci/address.h"
 #include "hci/controller.h"
-#include "hci/hci_layer.h"
+#include "hci/hci_layer_fake.h"
 #include "os/thread.h"
 #include "packet/raw_builder.h"
 
@@ -36,17 +36,12 @@
 namespace hci {
 namespace {
 
-using packet::kLittleEndian;
-using packet::PacketView;
+using namespace std::literals;
+
 using packet::RawBuilder;
 
-PacketView<kLittleEndian> GetPacketView(std::unique_ptr<packet::BasePacketBuilder> packet) {
-  auto bytes = std::make_shared<std::vector<uint8_t>>();
-  BitInserter i(*bytes);
-  bytes->reserve(packet->size());
-  packet->Serialize(i);
-  return packet::PacketView<packet::kLittleEndian>(bytes);
-}
+using testing::_;
+using testing::InSequence;
 
 class TestController : public Controller {
  public:
@@ -59,174 +54,36 @@
   }
 
   uint8_t GetLeNumberOfSupportedAdverisingSets() const override {
-    return num_advertisers;
+    return num_advertisers_;
   }
 
   uint16_t GetLeMaximumAdvertisingDataLength() const override {
     return 0x0672;
   }
 
-  uint8_t num_advertisers{0};
+  bool SupportsBleExtendedAdvertising() const override {
+    return support_ble_extended_advertising_;
+  }
+
+  void SetBleExtendedAdvertisingSupport(bool support) {
+    support_ble_extended_advertising_ = support;
+  }
+
+  VendorCapabilities GetVendorCapabilities() const override {
+    return vendor_capabilities_;
+  }
+
+  uint8_t num_advertisers_{0};
+  VendorCapabilities vendor_capabilities_;
 
  protected:
   void Start() override {}
   void Stop() override {}
-  void ListDependencies(ModuleList* list) override {}
+  void ListDependencies(ModuleList* list) const {}
 
  private:
   std::set<OpCode> supported_opcodes_{};
-};
-
-class TestHciLayer : public HciLayer {
- public:
-  void EnqueueCommand(
-      std::unique_ptr<CommandBuilder> command,
-      common::ContextualOnceCallback<void(CommandStatusView)> on_status) override {
-    auto packet_view = CommandView::Create(GetPacketView(std::move(command)));
-    ASSERT_TRUE(packet_view.IsValid());
-    std::lock_guard<std::mutex> lock(mutex_);
-    command_queue_.push_back(packet_view);
-    command_status_callbacks.push_back(std::move(on_status));
-    if (command_promise_ != nullptr &&
-        (command_op_code_ == OpCode::NONE || command_op_code_ == packet_view.GetOpCode())) {
-      if (command_op_code_ == OpCode::LE_MULTI_ADVT && command_sub_ocf_ != SubOcf::SET_ENABLE) {
-        return;
-      }
-      command_promise_->set_value(command_queue_.size());
-      command_promise_.reset();
-    }
-  }
-
-  void EnqueueCommand(
-      std::unique_ptr<CommandBuilder> command,
-      common::ContextualOnceCallback<void(CommandCompleteView)> on_complete) override {
-    auto packet_view = CommandView::Create(GetPacketView(std::move(command)));
-    ASSERT_TRUE(packet_view.IsValid());
-    std::lock_guard<std::mutex> lock(mutex_);
-    command_queue_.push_back(packet_view);
-    command_complete_callbacks.push_back(std::move(on_complete));
-    if (command_promise_ != nullptr &&
-        (command_op_code_ == OpCode::NONE || command_op_code_ == packet_view.GetOpCode())) {
-      if (command_op_code_ == OpCode::LE_MULTI_ADVT) {
-        auto sub_view = LeMultiAdvtView::Create(LeAdvertisingCommandView::Create(packet_view));
-        ASSERT_TRUE(sub_view.IsValid());
-        if (sub_view.GetSubCmd() != command_sub_ocf_) {
-          return;
-        }
-      }
-      command_promise_->set_value(command_queue_.size());
-      command_promise_.reset();
-    }
-  }
-
-  void SetCommandFuture(OpCode op_code = OpCode::NONE) {
-    ASSERT_LOG(command_promise_ == nullptr, "Promises, Promises, ... Only one at a time.");
-    command_op_code_ = op_code;
-    command_promise_ = std::make_unique<std::promise<size_t>>();
-    command_future_ = std::make_unique<std::future<size_t>>(command_promise_->get_future());
-  }
-
-  void ResetCommandFuture() {
-    if (command_future_ != nullptr) {
-      command_future_.reset();
-      command_promise_.reset();
-    }
-  }
-
-  void SetSubCommandFuture(SubOcf sub_ocf) {
-    ASSERT_LOG(command_promise_ == nullptr, "Promises promises ... Only one at a time");
-    command_op_code_ = OpCode::LE_MULTI_ADVT;
-    command_sub_ocf_ = sub_ocf;
-    command_promise_ = std::make_unique<std::promise<size_t>>();
-    command_future_ = std::make_unique<std::future<size_t>>(command_promise_->get_future());
-  }
-
-  ConnectionManagementCommandView GetCommand(OpCode op_code) {
-    if (!command_queue_.empty()) {
-      std::lock_guard<std::mutex> lock(mutex_);
-      if (command_future_ != nullptr) {
-        command_future_.reset();
-        command_promise_.reset();
-      }
-    } else if (command_future_ != nullptr) {
-      auto result = command_future_->wait_for(std::chrono::milliseconds(1000));
-      EXPECT_NE(std::future_status::timeout, result);
-    }
-    ASSERT_LOG(
-        !command_queue_.empty(), "Expecting command %s but command queue was empty", OpCodeText(op_code).c_str());
-    std::lock_guard<std::mutex> lock(mutex_);
-    CommandView command_packet_view = CommandView::Create(command_queue_.front());
-    command_queue_.pop_front();
-    auto command = ConnectionManagementCommandView::Create(AclCommandView::Create(command_packet_view));
-    EXPECT_TRUE(command.IsValid());
-    EXPECT_EQ(command.GetOpCode(), op_code);
-
-    return command;
-  }
-
-  void RegisterEventHandler(EventCode event_code, common::ContextualCallback<void(EventView)> event_handler) override {
-    registered_events_[event_code] = event_handler;
-  }
-
-  void RegisterLeEventHandler(SubeventCode subevent_code,
-                              common::ContextualCallback<void(LeMetaEventView)> event_handler) override {
-    registered_le_events_[subevent_code] = event_handler;
-  }
-
-  void IncomingEvent(std::unique_ptr<EventBuilder> event_builder) {
-    auto packet = GetPacketView(std::move(event_builder));
-    EventView event = EventView::Create(packet);
-    ASSERT_TRUE(event.IsValid());
-    EventCode event_code = event.GetEventCode();
-    ASSERT_NE(registered_events_.find(event_code), registered_events_.end()) << EventCodeText(event_code);
-    registered_events_[event_code].Invoke(event);
-  }
-
-  void IncomingLeMetaEvent(std::unique_ptr<LeMetaEventBuilder> event_builder) {
-    auto packet = GetPacketView(std::move(event_builder));
-    EventView event = EventView::Create(packet);
-    LeMetaEventView meta_event_view = LeMetaEventView::Create(event);
-    ASSERT_TRUE(meta_event_view.IsValid());
-    SubeventCode subevent_code = meta_event_view.GetSubeventCode();
-    ASSERT_NE(registered_le_events_.find(subevent_code), registered_le_events_.end())
-        << SubeventCodeText(subevent_code);
-    registered_le_events_[subevent_code].Invoke(meta_event_view);
-  }
-
-  void CommandCompleteCallback(EventView event) {
-    CommandCompleteView complete_view = CommandCompleteView::Create(event);
-    ASSERT_TRUE(complete_view.IsValid());
-    std::move(command_complete_callbacks.front()).Invoke(complete_view);
-    command_complete_callbacks.pop_front();
-  }
-
-  void CommandStatusCallback(EventView event) {
-    CommandStatusView status_view = CommandStatusView::Create(event);
-    ASSERT_TRUE(status_view.IsValid());
-    std::move(command_status_callbacks.front()).Invoke(status_view);
-    command_status_callbacks.pop_front();
-  }
-
-  void ListDependencies(ModuleList* list) override {}
-  void Start() override {
-    RegisterEventHandler(EventCode::COMMAND_COMPLETE,
-                         GetHandler()->BindOn(this, &TestHciLayer::CommandCompleteCallback));
-    RegisterEventHandler(EventCode::COMMAND_STATUS, GetHandler()->BindOn(this, &TestHciLayer::CommandStatusCallback));
-  }
-  void Stop() override {}
-
- private:
-  std::map<EventCode, common::ContextualCallback<void(EventView)>> registered_events_;
-  std::map<SubeventCode, common::ContextualCallback<void(LeMetaEventView)>> registered_le_events_;
-  std::list<common::ContextualOnceCallback<void(CommandCompleteView)>> command_complete_callbacks;
-  std::list<common::ContextualOnceCallback<void(CommandStatusView)>> command_status_callbacks;
-
-  std::list<CommandView> command_queue_;
-  mutable std::mutex mutex_;
-  std::unique_ptr<std::promise<size_t>> command_promise_{};
-  std::unique_ptr<std::future<size_t>> command_future_{};
-  OpCode command_op_code_;
-  SubOcf command_sub_ocf_;
+  bool support_ble_extended_advertising_ = false;
 };
 
 class TestLeAddressManager : public LeAddressManager {
@@ -240,10 +97,33 @@
       : LeAddressManager(enqueue_command, handler, public_address, connect_list_size, resolving_list_size) {}
 
   AddressPolicy Register(LeAddressManagerCallback* callback) override {
+    client_ = callback;
+    test_client_state_ = RESUMED;
     return AddressPolicy::USE_STATIC_ADDRESS;
   }
 
-  void Unregister(LeAddressManagerCallback* callback) override {}
+  void Unregister(LeAddressManagerCallback* callback) override {
+    if (!ignore_unregister_for_testing) {
+      client_ = nullptr;
+    }
+    test_client_state_ = UNREGISTERED;
+  }
+
+  void AckPause(LeAddressManagerCallback* callback) override {
+    test_client_state_ = PAUSED;
+  }
+
+  void AckResume(LeAddressManagerCallback* callback) override {
+    test_client_state_ = RESUMED;
+  }
+
+  AddressPolicy GetAddressPolicy() override {
+    return address_policy_;
+  }
+
+  void SetAddressPolicy(AddressPolicy address_policy) {
+    address_policy_ = address_policy;
+  }
 
   AddressWithType GetAnotherAddress() override {
     hci::Address address;
@@ -258,6 +138,16 @@
     auto random_address = AddressWithType(address, AddressType::RANDOM_DEVICE_ADDRESS);
     return random_address;
   }
+
+  AddressPolicy address_policy_ = AddressPolicy::USE_STATIC_ADDRESS;
+  LeAddressManagerCallback* client_;
+  bool ignore_unregister_for_testing = false;
+  enum TestClientState {
+    UNREGISTERED,
+    PAUSED,
+    RESUMED,
+  };
+  TestClientState test_client_state_ = UNREGISTERED;
 };
 
 class TestAclManager : public AclManager {
@@ -266,6 +156,10 @@
     return test_le_address_manager_;
   }
 
+  void SetAddressPolicy(LeAddressManager::AddressPolicy address_policy) {
+    test_le_address_manager_->SetAddressPolicy(address_policy);
+  }
+
  protected:
   void Start() override {
     thread_ = new os::Thread("thread", os::Thread::Priority::NORMAL);
@@ -282,7 +176,7 @@
     delete thread_;
   }
 
-  void ListDependencies(ModuleList* list) override {}
+  void ListDependencies(ModuleList* list) const {}
 
   void SetRandomAddress(Address address) {}
 
@@ -305,12 +199,15 @@
     fake_registry_.InjectTestModule(&AclManager::Factory, test_acl_manager_);
     client_handler_ = fake_registry_.GetTestModuleHandler(&HciLayer::Factory);
     ASSERT_NE(client_handler_, nullptr);
-    test_controller_->num_advertisers = 1;
+    test_controller_->num_advertisers_ = num_instances_;
+    test_controller_->vendor_capabilities_.max_advt_instances_ = num_instances_;
+    test_controller_->SetBleExtendedAdvertisingSupport(support_ble_extended_advertising_);
     le_advertising_manager_ = fake_registry_.Start<LeAdvertisingManager>(&thread_);
     le_advertising_manager_->RegisterAdvertisingCallback(&mock_advertising_callback_);
   }
 
   void TearDown() override {
+    sync_client_handler();
     fake_registry_.SynchronizeModuleHandler(&LeAdvertisingManager::Factory, std::chrono::milliseconds(20));
     fake_registry_.StopAll();
   }
@@ -322,51 +219,23 @@
   os::Thread& thread_ = fake_registry_.GetTestThread();
   LeAdvertisingManager* le_advertising_manager_ = nullptr;
   os::Handler* client_handler_ = nullptr;
+  OpCode param_opcode_{OpCode::LE_SET_ADVERTISING_PARAMETERS};
+  uint8_t num_instances_ = 8;
+  bool support_ble_extended_advertising_ = false;
 
   const common::Callback<void(Address, AddressType)> scan_callback =
       common::Bind(&LeAdvertisingManagerTest::on_scan, common::Unretained(this));
   const common::Callback<void(ErrorCode, uint8_t, uint8_t)> set_terminated_callback =
       common::Bind(&LeAdvertisingManagerTest::on_set_terminated, common::Unretained(this));
 
-  std::future<Address> GetOnScanPromise() {
-    ASSERT_LOG(address_promise_ == nullptr, "Promises promises ... Only one at a time");
-    address_promise_ = std::make_unique<std::promise<Address>>();
-    return address_promise_->get_future();
-  }
-  void on_scan(Address address, AddressType address_type) {
-    if (address_promise_ == nullptr) {
-      return;
-    }
-    address_promise_->set_value(address);
-    address_promise_.reset();
-  }
+  void on_scan(Address address, AddressType address_type) {}
 
-  std::future<ErrorCode> GetSetTerminatedPromise() {
-    ASSERT_LOG(set_terminated_promise_ == nullptr, "Promises promises ... Only one at a time");
-    set_terminated_promise_ = std::make_unique<std::promise<ErrorCode>>();
-    return set_terminated_promise_->get_future();
-  }
-  void on_set_terminated(ErrorCode error_code, uint8_t, uint8_t) {
-    if (set_terminated_promise_ != nullptr) {
-      return;
-    }
-    set_terminated_promise_->set_value(error_code);
-    set_terminated_promise_.reset();
-  }
+  void on_set_terminated(ErrorCode error_code, uint8_t, uint8_t) {}
 
   void sync_client_handler() {
-    std::promise<void> promise;
-    auto future = promise.get_future();
-    client_handler_->Call(common::BindOnce(&std::promise<void>::set_value, common::Unretained(&promise)));
-    auto future_status = future.wait_for(std::chrono::seconds(1));
-    ASSERT_EQ(future_status, std::future_status::ready);
+    ASSERT(thread_.GetReactor()->WaitForIdle(2s));
   }
 
-  std::unique_ptr<std::promise<Address>> address_promise_{};
-  std::unique_ptr<std::promise<ErrorCode>> set_terminated_promise_{};
-
-  OpCode param_opcode_{OpCode::LE_SET_ADVERTISING_PARAMETERS};
-
   class MockAdvertisingCallback : public AdvertisingCallback {
    public:
     MOCK_METHOD4(
@@ -401,14 +270,11 @@
     gap_data.push_back(data_item);
     advertising_config.advertisement = gap_data;
     advertising_config.scan_response = gap_data;
+    advertising_config.channel_map = 1;
 
-    test_hci_layer_->SetCommandFuture();
     advertiser_id_ = le_advertising_manager_->ExtendedCreateAdvertiser(
         0x00, advertising_config, scan_callback, set_terminated_callback, 0, 0, client_handler_);
     ASSERT_NE(LeAdvertisingManager::kInvalidId, advertiser_id_);
-    EXPECT_CALL(
-        mock_advertising_callback_,
-        OnAdvertisingSetStarted(0x00, advertiser_id_, 0x00, AdvertisingCallback::AdvertisingStatus::SUCCESS));
     std::vector<OpCode> adv_opcodes = {
         OpCode::LE_READ_ADVERTISING_PHYSICAL_CHANNEL_TX_POWER,
         OpCode::LE_SET_ADVERTISING_PARAMETERS,
@@ -416,10 +282,12 @@
         OpCode::LE_SET_ADVERTISING_DATA,
         OpCode::LE_SET_ADVERTISING_ENABLE,
     };
+    EXPECT_CALL(
+        mock_advertising_callback_,
+        OnAdvertisingSetStarted(0x00, advertiser_id_, 0x00, AdvertisingCallback::AdvertisingStatus::SUCCESS));
     std::vector<uint8_t> success_vector{static_cast<uint8_t>(ErrorCode::SUCCESS)};
     for (size_t i = 0; i < adv_opcodes.size(); i++) {
-      auto packet_view = test_hci_layer_->GetCommand(adv_opcodes[i]);
-      CommandView command_packet_view = CommandView::Create(packet_view);
+      ASSERT_EQ(adv_opcodes[i], test_hci_layer_->GetCommand().GetOpCode());
       if (adv_opcodes[i] == OpCode::LE_READ_ADVERTISING_PHYSICAL_CHANNEL_TX_POWER) {
         test_hci_layer_->IncomingEvent(
             LeReadAdvertisingPhysicalChannelTxPowerCompleteBuilder::Create(uint8_t{1}, ErrorCode::SUCCESS, 0x00));
@@ -427,10 +295,7 @@
         test_hci_layer_->IncomingEvent(
             CommandCompleteBuilder::Create(uint8_t{1}, adv_opcodes[i], std::make_unique<RawBuilder>(success_vector)));
       }
-      test_hci_layer_->SetCommandFuture();
     }
-    sync_client_handler();
-    test_hci_layer_->ResetCommandFuture();
   }
 
   AdvertiserId advertiser_id_;
@@ -441,7 +306,6 @@
   void SetUp() override {
     param_opcode_ = OpCode::LE_MULTI_ADVT;
     LeAdvertisingManagerTest::SetUp();
-    test_controller_->num_advertisers = 3;
   }
 };
 
@@ -463,15 +327,15 @@
     gap_data.push_back(data_item);
     advertising_config.advertisement = gap_data;
     advertising_config.scan_response = gap_data;
+    advertising_config.channel_map = 1;
 
-    test_hci_layer_->SetSubCommandFuture(SubOcf::SET_PARAM);
     advertiser_id_ = le_advertising_manager_->ExtendedCreateAdvertiser(
         0x00, advertising_config, scan_callback, set_terminated_callback, 0, 0, client_handler_);
     ASSERT_NE(LeAdvertisingManager::kInvalidId, advertiser_id_);
     std::vector<SubOcf> sub_ocf = {
         SubOcf::SET_PARAM,
-        SubOcf::SET_DATA,
         SubOcf::SET_SCAN_RESP,
+        SubOcf::SET_DATA,
         SubOcf::SET_RANDOM_ADDR,
         SubOcf::SET_ENABLE,
     };
@@ -479,15 +343,57 @@
         mock_advertising_callback_,
         OnAdvertisingSetStarted(0, advertiser_id_, 0, AdvertisingCallback::AdvertisingStatus::SUCCESS));
     for (size_t i = 0; i < sub_ocf.size(); i++) {
-      auto packet = test_hci_layer_->GetCommand(OpCode::LE_MULTI_ADVT);
+      auto packet = test_hci_layer_->GetCommand();
       auto sub_packet = LeMultiAdvtView::Create(LeAdvertisingCommandView::Create(packet));
       ASSERT_TRUE(sub_packet.IsValid());
+      ASSERT_EQ(sub_packet.GetSubCmd(), sub_ocf[i]);
       test_hci_layer_->IncomingEvent(LeMultiAdvtCompleteBuilder::Create(uint8_t{1}, ErrorCode::SUCCESS, sub_ocf[i]));
-      if ((i + 1) < sub_ocf.size()) {
-        test_hci_layer_->SetSubCommandFuture(sub_ocf[i + 1]);
-      }
     }
-    sync_client_handler();
+  }
+
+  AdvertiserId advertiser_id_;
+};
+
+class LeAndroidHciAdvertisingAPIPublicAddressTest : public LeAndroidHciAdvertisingManagerTest {
+ protected:
+  void SetUp() override {
+    LeAndroidHciAdvertisingManagerTest::SetUp();
+
+    ExtendedAdvertisingConfig advertising_config{};
+    advertising_config.advertising_type = AdvertisingType::ADV_IND;
+    advertising_config.own_address_type = OwnAddressType::PUBLIC_DEVICE_ADDRESS;
+    std::vector<GapData> gap_data{};
+    GapData data_item{};
+    data_item.data_type_ = GapDataType::FLAGS;
+    data_item.data_ = {0x34};
+    gap_data.push_back(data_item);
+    data_item.data_type_ = GapDataType::COMPLETE_LOCAL_NAME;
+    data_item.data_ = {'r', 'a', 'n', 'd', 'o', 'm', ' ', 'd', 'e', 'v', 'i', 'c', 'e'};
+    gap_data.push_back(data_item);
+    advertising_config.advertisement = gap_data;
+    advertising_config.scan_response = gap_data;
+    advertising_config.channel_map = 1;
+
+    test_acl_manager_->SetAddressPolicy(LeAddressManager::AddressPolicy::USE_PUBLIC_ADDRESS);
+    advertiser_id_ = le_advertising_manager_->ExtendedCreateAdvertiser(
+        0x00, advertising_config, scan_callback, set_terminated_callback, 0, 0, client_handler_);
+    ASSERT_NE(LeAdvertisingManager::kInvalidId, advertiser_id_);
+    std::vector<SubOcf> sub_ocf = {
+        SubOcf::SET_PARAM,
+        SubOcf::SET_SCAN_RESP,
+        SubOcf::SET_DATA,
+        SubOcf::SET_ENABLE,
+    };
+    EXPECT_CALL(
+        mock_advertising_callback_,
+        OnAdvertisingSetStarted(0, advertiser_id_, 0, AdvertisingCallback::AdvertisingStatus::SUCCESS));
+    for (size_t i = 0; i < sub_ocf.size(); i++) {
+      auto packet = test_hci_layer_->GetCommand();
+      auto sub_packet = LeMultiAdvtView::Create(LeAdvertisingCommandView::Create(packet));
+      ASSERT_TRUE(sub_packet.IsValid());
+      ASSERT_EQ(sub_packet.GetSubCmd(), sub_ocf[i]);
+      test_hci_layer_->IncomingEvent(LeMultiAdvtCompleteBuilder::Create(uint8_t{1}, ErrorCode::SUCCESS, sub_ocf[i]));
+    }
   }
 
   AdvertiserId advertiser_id_;
@@ -496,9 +402,9 @@
 class LeExtendedAdvertisingManagerTest : public LeAdvertisingManagerTest {
  protected:
   void SetUp() override {
+    support_ble_extended_advertising_ = true;
     param_opcode_ = OpCode::LE_SET_EXTENDED_ADVERTISING_PARAMETERS;
     LeAdvertisingManagerTest::SetUp();
-    test_controller_->num_advertisers = 5;
   }
 };
 
@@ -524,7 +430,6 @@
     advertising_config.channel_map = 1;
     advertising_config.sid = 0x01;
 
-    test_hci_layer_->SetCommandFuture();
     advertiser_id_ = le_advertising_manager_->ExtendedCreateAdvertiser(
         0x00, advertising_config, scan_callback, set_terminated_callback, 0, 0, client_handler_);
     ASSERT_NE(LeAdvertisingManager::kInvalidId, advertiser_id_);
@@ -533,15 +438,13 @@
         OnAdvertisingSetStarted(0x00, advertiser_id_, -23, AdvertisingCallback::AdvertisingStatus::SUCCESS));
     std::vector<OpCode> adv_opcodes = {
         OpCode::LE_SET_EXTENDED_ADVERTISING_PARAMETERS,
-        OpCode::LE_SET_EXTENDED_ADVERTISING_SCAN_RESPONSE,
+        OpCode::LE_SET_EXTENDED_SCAN_RESPONSE_DATA,
         OpCode::LE_SET_EXTENDED_ADVERTISING_DATA,
         OpCode::LE_SET_EXTENDED_ADVERTISING_ENABLE,
     };
     std::vector<uint8_t> success_vector{static_cast<uint8_t>(ErrorCode::SUCCESS)};
     for (size_t i = 0; i < adv_opcodes.size(); i++) {
-      auto packet_view = test_hci_layer_->GetCommand(adv_opcodes[i]);
-      CommandView command_packet_view = CommandView::Create(packet_view);
-      auto command = ConnectionManagementCommandView::Create(AclCommandView::Create(command_packet_view));
+      ASSERT_EQ(adv_opcodes[i], test_hci_layer_->GetCommand().GetOpCode());
       if (adv_opcodes[i] == OpCode::LE_SET_EXTENDED_ADVERTISING_PARAMETERS) {
         test_hci_layer_->IncomingEvent(LeSetExtendedAdvertisingParametersCompleteBuilder::Create(
             uint8_t{1}, ErrorCode::SUCCESS, static_cast<uint8_t>(-23)));
@@ -549,10 +452,8 @@
         test_hci_layer_->IncomingEvent(
             CommandCompleteBuilder::Create(uint8_t{1}, adv_opcodes[i], std::make_unique<RawBuilder>(success_vector)));
       }
-      test_hci_layer_->SetCommandFuture();
     }
     sync_client_handler();
-    test_hci_layer_->ResetCommandFuture();
   }
 
   AdvertiserId advertiser_id_;
@@ -578,8 +479,8 @@
   gap_data.push_back(data_item);
   advertising_config.advertisement = gap_data;
   advertising_config.scan_response = gap_data;
+  advertising_config.channel_map = 1;
 
-  test_hci_layer_->SetCommandFuture();
   auto id = le_advertising_manager_->ExtendedCreateAdvertiser(
       0x00, advertising_config, scan_callback, set_terminated_callback, 0, 0, client_handler_);
   ASSERT_NE(LeAdvertisingManager::kInvalidId, id);
@@ -595,9 +496,7 @@
       OnAdvertisingSetStarted(0x00, id, 0x00, AdvertisingCallback::AdvertisingStatus::SUCCESS));
   std::vector<uint8_t> success_vector{static_cast<uint8_t>(ErrorCode::SUCCESS)};
   for (size_t i = 0; i < adv_opcodes.size(); i++) {
-    auto packet_view = test_hci_layer_->GetCommand(adv_opcodes[i]);
-    CommandView command_packet_view = CommandView::Create(packet_view);
-    auto command = ConnectionManagementCommandView::Create(AclCommandView::Create(command_packet_view));
+    ASSERT_EQ(adv_opcodes[i], test_hci_layer_->GetCommand().GetOpCode());
     if (adv_opcodes[i] == OpCode::LE_READ_ADVERTISING_PHYSICAL_CHANNEL_TX_POWER) {
       test_hci_layer_->IncomingEvent(
           LeReadAdvertisingPhysicalChannelTxPowerCompleteBuilder::Create(uint8_t{1}, ErrorCode::SUCCESS, 0x00));
@@ -605,14 +504,11 @@
       test_hci_layer_->IncomingEvent(
           CommandCompleteBuilder::Create(uint8_t{1}, adv_opcodes[i], std::make_unique<RawBuilder>(success_vector)));
     }
-    test_hci_layer_->SetCommandFuture();
   }
-  sync_client_handler();
 
   // Disable the advertiser
   le_advertising_manager_->RemoveAdvertiser(id);
-  test_hci_layer_->GetCommand(OpCode::LE_SET_ADVERTISING_ENABLE);
-  sync_client_handler();
+  ASSERT_EQ(OpCode::LE_SET_ADVERTISING_ENABLE, test_hci_layer_->GetCommand().GetOpCode());
 }
 
 TEST_F(LeAndroidHciAdvertisingManagerTest, create_advertiser_test) {
@@ -629,33 +525,32 @@
   gap_data.push_back(data_item);
   advertising_config.advertisement = gap_data;
   advertising_config.scan_response = gap_data;
+  advertising_config.channel_map = 1;
 
-  test_hci_layer_->SetSubCommandFuture(SubOcf::SET_PARAM);
   auto id = le_advertising_manager_->ExtendedCreateAdvertiser(
       0x00, advertising_config, scan_callback, set_terminated_callback, 0, 0, client_handler_);
   ASSERT_NE(LeAdvertisingManager::kInvalidId, id);
   std::vector<SubOcf> sub_ocf = {
-      SubOcf::SET_PARAM, SubOcf::SET_DATA, SubOcf::SET_SCAN_RESP, SubOcf::SET_RANDOM_ADDR, SubOcf::SET_ENABLE,
+      SubOcf::SET_PARAM,
+      SubOcf::SET_SCAN_RESP,
+      SubOcf::SET_DATA,
+      SubOcf::SET_RANDOM_ADDR,
+      SubOcf::SET_ENABLE,
   };
   EXPECT_CALL(
       mock_advertising_callback_, OnAdvertisingSetStarted(0, id, 0, AdvertisingCallback::AdvertisingStatus::SUCCESS));
   for (size_t i = 0; i < sub_ocf.size(); i++) {
-    auto packet = test_hci_layer_->GetCommand(OpCode::LE_MULTI_ADVT);
+    auto packet = test_hci_layer_->GetCommand();
     auto sub_packet = LeMultiAdvtView::Create(LeAdvertisingCommandView::Create(packet));
     ASSERT_TRUE(sub_packet.IsValid());
+    ASSERT_EQ(sub_packet.GetSubCmd(), sub_ocf[i]);
     test_hci_layer_->IncomingEvent(LeMultiAdvtCompleteBuilder::Create(uint8_t{1}, ErrorCode::SUCCESS, sub_ocf[i]));
-    if ((i + 1) < sub_ocf.size()) {
-      test_hci_layer_->SetSubCommandFuture(sub_ocf[i + 1]);
-    }
   }
-  sync_client_handler();
 
   // Disable the advertiser
-  test_hci_layer_->SetSubCommandFuture(SubOcf::SET_ENABLE);
   le_advertising_manager_->RemoveAdvertiser(id);
-  test_hci_layer_->GetCommand(OpCode::LE_MULTI_ADVT);
+  ASSERT_EQ(OpCode::LE_MULTI_ADVT, test_hci_layer_->GetCommand().GetOpCode());
   test_hci_layer_->IncomingEvent(LeMultiAdvtSetEnableCompleteBuilder::Create(uint8_t{1}, ErrorCode::SUCCESS));
-  sync_client_handler();
 }
 
 TEST_F(LeExtendedAdvertisingManagerTest, create_advertiser_test) {
@@ -675,7 +570,6 @@
   advertising_config.channel_map = 1;
   advertising_config.sid = 0x01;
 
-  test_hci_layer_->SetCommandFuture();
   auto id = le_advertising_manager_->ExtendedCreateAdvertiser(
       0x00, advertising_config, scan_callback, set_terminated_callback, 0, 0, client_handler_);
   ASSERT_NE(LeAdvertisingManager::kInvalidId, id);
@@ -684,15 +578,13 @@
       OnAdvertisingSetStarted(0x00, id, -23, AdvertisingCallback::AdvertisingStatus::SUCCESS));
   std::vector<OpCode> adv_opcodes = {
       OpCode::LE_SET_EXTENDED_ADVERTISING_PARAMETERS,
-      OpCode::LE_SET_EXTENDED_ADVERTISING_SCAN_RESPONSE,
+      OpCode::LE_SET_EXTENDED_SCAN_RESPONSE_DATA,
       OpCode::LE_SET_EXTENDED_ADVERTISING_DATA,
       OpCode::LE_SET_EXTENDED_ADVERTISING_ENABLE,
   };
   std::vector<uint8_t> success_vector{static_cast<uint8_t>(ErrorCode::SUCCESS)};
   for (size_t i = 0; i < adv_opcodes.size(); i++) {
-    auto packet_view = test_hci_layer_->GetCommand(adv_opcodes[i]);
-    CommandView command_packet_view = CommandView::Create(packet_view);
-    auto command = ConnectionManagementCommandView::Create(AclCommandView::Create(command_packet_view));
+    ASSERT_EQ(adv_opcodes[i], test_hci_layer_->GetCommand().GetOpCode());
     if (adv_opcodes[i] == OpCode::LE_SET_EXTENDED_ADVERTISING_PARAMETERS) {
       test_hci_layer_->IncomingEvent(LeSetExtendedAdvertisingParametersCompleteBuilder::Create(
           uint8_t{1}, ErrorCode::SUCCESS, static_cast<uint8_t>(-23)));
@@ -700,24 +592,84 @@
       test_hci_layer_->IncomingEvent(
           CommandCompleteBuilder::Create(uint8_t{1}, adv_opcodes[i], std::make_unique<RawBuilder>(success_vector)));
     }
-    test_hci_layer_->SetCommandFuture();
   }
   sync_client_handler();
 
   // Remove the advertiser
   le_advertising_manager_->RemoveAdvertiser(id);
-  test_hci_layer_->GetCommand(OpCode::LE_SET_EXTENDED_ADVERTISING_ENABLE);
-  test_hci_layer_->SetCommandFuture();
-  test_hci_layer_->GetCommand(OpCode::LE_SET_PERIODIC_ADVERTISING_ENABLE);
-  test_hci_layer_->SetCommandFuture();
-  test_hci_layer_->GetCommand(OpCode::LE_REMOVE_ADVERTISING_SET);
+  ASSERT_EQ(OpCode::LE_SET_EXTENDED_ADVERTISING_ENABLE, test_hci_layer_->GetCommand().GetOpCode());
+  ASSERT_EQ(OpCode::LE_SET_PERIODIC_ADVERTISING_ENABLE, test_hci_layer_->GetCommand().GetOpCode());
+  ASSERT_EQ(OpCode::LE_REMOVE_ADVERTISING_SET, test_hci_layer_->GetCommand().GetOpCode());
+}
+
+TEST_F(LeExtendedAdvertisingManagerTest, ignore_on_pause_on_resume_after_unregistered) {
+  TestLeAddressManager* test_le_address_manager = (TestLeAddressManager*)test_acl_manager_->GetLeAddressManager();
+  test_le_address_manager->ignore_unregister_for_testing = true;
+
+  // Register LeAddressManager vai ExtendedCreateAdvertiser
+  ExtendedAdvertisingConfig advertising_config{};
+  advertising_config.advertising_type = AdvertisingType::ADV_IND;
+  advertising_config.own_address_type = OwnAddressType::PUBLIC_DEVICE_ADDRESS;
+  std::vector<GapData> gap_data{};
+  GapData data_item{};
+  data_item.data_type_ = GapDataType::FLAGS;
+  data_item.data_ = {0x34};
+  gap_data.push_back(data_item);
+  data_item.data_type_ = GapDataType::COMPLETE_LOCAL_NAME;
+  data_item.data_ = {'r', 'a', 'n', 'd', 'o', 'm', ' ', 'd', 'e', 'v', 'i', 'c', 'e'};
+  gap_data.push_back(data_item);
+  advertising_config.advertisement = gap_data;
+  advertising_config.scan_response = gap_data;
+  advertising_config.channel_map = 1;
+  advertising_config.sid = 0x01;
+
+  auto id = le_advertising_manager_->ExtendedCreateAdvertiser(
+      0x00, advertising_config, scan_callback, set_terminated_callback, 0, 0, client_handler_);
+  ASSERT_NE(LeAdvertisingManager::kInvalidId, id);
+  EXPECT_CALL(
+      mock_advertising_callback_,
+      OnAdvertisingSetStarted(0x00, id, -23, AdvertisingCallback::AdvertisingStatus::SUCCESS));
+  std::vector<OpCode> adv_opcodes = {
+      OpCode::LE_SET_EXTENDED_ADVERTISING_PARAMETERS,
+      OpCode::LE_SET_EXTENDED_SCAN_RESPONSE_DATA,
+      OpCode::LE_SET_EXTENDED_ADVERTISING_DATA,
+      OpCode::LE_SET_EXTENDED_ADVERTISING_ENABLE,
+  };
+  std::vector<uint8_t> success_vector{static_cast<uint8_t>(ErrorCode::SUCCESS)};
+  for (size_t i = 0; i < adv_opcodes.size(); i++) {
+    ASSERT_EQ(adv_opcodes[i], test_hci_layer_->GetCommand().GetOpCode());
+    if (adv_opcodes[i] == OpCode::LE_SET_EXTENDED_ADVERTISING_PARAMETERS) {
+      test_hci_layer_->IncomingEvent(LeSetExtendedAdvertisingParametersCompleteBuilder::Create(
+          uint8_t{1}, ErrorCode::SUCCESS, static_cast<uint8_t>(-23)));
+    } else {
+      test_hci_layer_->IncomingEvent(
+          CommandCompleteBuilder::Create(uint8_t{1}, adv_opcodes[i], std::make_unique<RawBuilder>(success_vector)));
+    }
+  }
   sync_client_handler();
+
+  // Unregister LeAddressManager vai RemoveAdvertiser
+  le_advertising_manager_->RemoveAdvertiser(id);
+  ASSERT_EQ(OpCode::LE_SET_EXTENDED_ADVERTISING_ENABLE, test_hci_layer_->GetCommand().GetOpCode());
+  ASSERT_EQ(OpCode::LE_SET_PERIODIC_ADVERTISING_ENABLE, test_hci_layer_->GetCommand().GetOpCode());
+  ASSERT_EQ(OpCode::LE_REMOVE_ADVERTISING_SET, test_hci_layer_->GetCommand().GetOpCode());
+  sync_client_handler();
+
+  // Unregistered client should ignore OnPause/OnResume
+  ASSERT_NE(test_le_address_manager->client_, nullptr);
+  ASSERT_EQ(test_le_address_manager->test_client_state_, TestLeAddressManager::TestClientState::UNREGISTERED);
+  test_le_address_manager->client_->OnPause();
+  ASSERT_EQ(test_le_address_manager->test_client_state_, TestLeAddressManager::TestClientState::UNREGISTERED);
+  test_le_address_manager->client_->OnResume();
+  ASSERT_EQ(test_le_address_manager->test_client_state_, TestLeAddressManager::TestClientState::UNREGISTERED);
 }
 
 TEST_F(LeAdvertisingAPITest, startup_teardown) {}
 
 TEST_F(LeAndroidHciAdvertisingAPITest, startup_teardown) {}
 
+TEST_F(LeAndroidHciAdvertisingAPIPublicAddressTest, startup_teardown) {}
+
 TEST_F(LeExtendedAdvertisingAPITest, startup_teardown) {}
 
 TEST_F(LeAdvertisingAPITest, set_parameter) {
@@ -731,14 +683,12 @@
   gap_data.push_back(data_item);
   advertising_config.advertisement = gap_data;
   advertising_config.channel_map = 1;
-  test_hci_layer_->SetCommandFuture();
   le_advertising_manager_->SetParameters(advertiser_id_, advertising_config);
-  test_hci_layer_->GetCommand(OpCode::LE_SET_ADVERTISING_PARAMETERS);
+  ASSERT_EQ(OpCode::LE_SET_ADVERTISING_PARAMETERS, test_hci_layer_->GetCommand().GetOpCode());
   EXPECT_CALL(
       mock_advertising_callback_,
       OnAdvertisingParametersUpdated(advertiser_id_, 0x00, AdvertisingCallback::AdvertisingStatus::SUCCESS));
   test_hci_layer_->IncomingEvent(LeSetAdvertisingParametersCompleteBuilder::Create(uint8_t{1}, ErrorCode::SUCCESS));
-  sync_client_handler();
 }
 
 TEST_F(LeAndroidHciAdvertisingAPITest, set_parameter) {
@@ -752,14 +702,15 @@
   gap_data.push_back(data_item);
   advertising_config.advertisement = gap_data;
   advertising_config.channel_map = 1;
-  test_hci_layer_->SetSubCommandFuture(SubOcf::SET_PARAM);
   le_advertising_manager_->SetParameters(advertiser_id_, advertising_config);
-  test_hci_layer_->GetCommand(OpCode::LE_MULTI_ADVT);
+  auto packet = test_hci_layer_->GetCommand();
+  auto sub_packet = LeMultiAdvtView::Create(LeAdvertisingCommandView::Create(packet));
+  ASSERT_TRUE(sub_packet.IsValid());
+  ASSERT_EQ(sub_packet.GetSubCmd(), SubOcf::SET_PARAM);
   EXPECT_CALL(
       mock_advertising_callback_,
       OnAdvertisingParametersUpdated(advertiser_id_, 0x00, AdvertisingCallback::AdvertisingStatus::SUCCESS));
   test_hci_layer_->IncomingEvent(LeMultiAdvtCompleteBuilder::Create(uint8_t{1}, ErrorCode::SUCCESS, SubOcf::SET_PARAM));
-  sync_client_handler();
 }
 
 TEST_F(LeExtendedAdvertisingAPITest, set_parameter) {
@@ -775,15 +726,13 @@
   advertising_config.channel_map = 1;
   advertising_config.sid = 0x01;
   advertising_config.tx_power = 0x08;
-  test_hci_layer_->SetCommandFuture();
   le_advertising_manager_->SetParameters(advertiser_id_, advertising_config);
-  test_hci_layer_->GetCommand(OpCode::LE_SET_EXTENDED_ADVERTISING_PARAMETERS);
+  ASSERT_EQ(OpCode::LE_SET_EXTENDED_ADVERTISING_PARAMETERS, test_hci_layer_->GetCommand().GetOpCode());
   EXPECT_CALL(
       mock_advertising_callback_,
       OnAdvertisingParametersUpdated(advertiser_id_, 0x08, AdvertisingCallback::AdvertisingStatus::SUCCESS));
   test_hci_layer_->IncomingEvent(
       LeSetExtendedAdvertisingParametersCompleteBuilder::Create(uint8_t{1}, ErrorCode::SUCCESS, 0x08));
-  sync_client_handler();
 }
 
 TEST_F(LeAdvertisingAPITest, set_data_test) {
@@ -793,14 +742,12 @@
   data_item.data_type_ = GapDataType::TX_POWER_LEVEL;
   data_item.data_ = {0x00};
   advertising_data.push_back(data_item);
-  test_hci_layer_->SetCommandFuture();
   le_advertising_manager_->SetData(advertiser_id_, false, advertising_data);
-  test_hci_layer_->GetCommand(OpCode::LE_SET_ADVERTISING_DATA);
+  ASSERT_EQ(OpCode::LE_SET_ADVERTISING_DATA, test_hci_layer_->GetCommand().GetOpCode());
   EXPECT_CALL(
       mock_advertising_callback_,
       OnAdvertisingDataSet(advertiser_id_, AdvertisingCallback::AdvertisingStatus::SUCCESS));
   test_hci_layer_->IncomingEvent(LeSetAdvertisingDataCompleteBuilder::Create(uint8_t{1}, ErrorCode::SUCCESS));
-  sync_client_handler();
 
   // Set scan response data
   std::vector<GapData> response_data{};
@@ -808,14 +755,12 @@
   data_item2.data_type_ = GapDataType::COMPLETE_LOCAL_NAME;
   data_item2.data_ = {'t', 'e', 's', 't', ' ', 'd', 'e', 'v', 'i', 'c', 'e'};
   response_data.push_back(data_item2);
-  test_hci_layer_->SetCommandFuture();
   le_advertising_manager_->SetData(advertiser_id_, true, response_data);
-  test_hci_layer_->GetCommand(OpCode::LE_SET_SCAN_RESPONSE_DATA);
+  ASSERT_EQ(OpCode::LE_SET_SCAN_RESPONSE_DATA, test_hci_layer_->GetCommand().GetOpCode());
   EXPECT_CALL(
       mock_advertising_callback_,
       OnScanResponseDataSet(advertiser_id_, AdvertisingCallback::AdvertisingStatus::SUCCESS));
   test_hci_layer_->IncomingEvent(LeSetScanResponseDataCompleteBuilder::Create(uint8_t{1}, ErrorCode::SUCCESS));
-  sync_client_handler();
 }
 
 TEST_F(LeExtendedAdvertisingAPITest, set_data_test) {
@@ -825,14 +770,12 @@
   data_item.data_type_ = GapDataType::TX_POWER_LEVEL;
   data_item.data_ = {0x00};
   advertising_data.push_back(data_item);
-  test_hci_layer_->SetCommandFuture();
   le_advertising_manager_->SetData(advertiser_id_, false, advertising_data);
-  test_hci_layer_->GetCommand(OpCode::LE_SET_EXTENDED_ADVERTISING_DATA);
+  ASSERT_EQ(OpCode::LE_SET_EXTENDED_ADVERTISING_DATA, test_hci_layer_->GetCommand().GetOpCode());
   EXPECT_CALL(
       mock_advertising_callback_,
       OnAdvertisingDataSet(advertiser_id_, AdvertisingCallback::AdvertisingStatus::SUCCESS));
   test_hci_layer_->IncomingEvent(LeSetExtendedAdvertisingDataCompleteBuilder::Create(uint8_t{1}, ErrorCode::SUCCESS));
-  sync_client_handler();
 
   // Set scan response data
   std::vector<GapData> response_data{};
@@ -840,15 +783,12 @@
   data_item2.data_type_ = GapDataType::COMPLETE_LOCAL_NAME;
   data_item2.data_ = {'t', 'e', 's', 't', ' ', 'd', 'e', 'v', 'i', 'c', 'e'};
   response_data.push_back(data_item2);
-  test_hci_layer_->SetCommandFuture();
   le_advertising_manager_->SetData(advertiser_id_, true, response_data);
-  test_hci_layer_->GetCommand(OpCode::LE_SET_EXTENDED_ADVERTISING_SCAN_RESPONSE);
+  ASSERT_EQ(OpCode::LE_SET_EXTENDED_SCAN_RESPONSE_DATA, test_hci_layer_->GetCommand().GetOpCode());
   EXPECT_CALL(
       mock_advertising_callback_,
       OnScanResponseDataSet(advertiser_id_, AdvertisingCallback::AdvertisingStatus::SUCCESS));
-  test_hci_layer_->IncomingEvent(
-      LeSetExtendedAdvertisingScanResponseCompleteBuilder::Create(uint8_t{1}, ErrorCode::SUCCESS));
-  sync_client_handler();
+  test_hci_layer_->IncomingEvent(LeSetExtendedScanResponseDataCompleteBuilder::Create(uint8_t{1}, ErrorCode::SUCCESS));
 }
 
 TEST_F(LeAndroidHciAdvertisingAPITest, set_data_test) {
@@ -858,14 +798,15 @@
   data_item.data_type_ = GapDataType::TX_POWER_LEVEL;
   data_item.data_ = {0x00};
   advertising_data.push_back(data_item);
-  test_hci_layer_->SetSubCommandFuture(SubOcf::SET_DATA);
   le_advertising_manager_->SetData(advertiser_id_, false, advertising_data);
-  test_hci_layer_->GetCommand(OpCode::LE_MULTI_ADVT);
+  auto packet = test_hci_layer_->GetCommand();
+  auto sub_packet = LeMultiAdvtView::Create(LeAdvertisingCommandView::Create(packet));
+  ASSERT_TRUE(sub_packet.IsValid());
+  ASSERT_EQ(sub_packet.GetSubCmd(), SubOcf::SET_DATA);
   EXPECT_CALL(
       mock_advertising_callback_,
       OnAdvertisingDataSet(advertiser_id_, AdvertisingCallback::AdvertisingStatus::SUCCESS));
   test_hci_layer_->IncomingEvent(LeMultiAdvtCompleteBuilder::Create(uint8_t{1}, ErrorCode::SUCCESS, SubOcf::SET_DATA));
-  sync_client_handler();
 
   // Set scan response data
   std::vector<GapData> response_data{};
@@ -873,15 +814,16 @@
   data_item2.data_type_ = GapDataType::COMPLETE_LOCAL_NAME;
   data_item2.data_ = {'t', 'e', 's', 't', ' ', 'd', 'e', 'v', 'i', 'c', 'e'};
   response_data.push_back(data_item2);
-  test_hci_layer_->SetSubCommandFuture(SubOcf::SET_SCAN_RESP);
   le_advertising_manager_->SetData(advertiser_id_, true, response_data);
-  test_hci_layer_->GetCommand(OpCode::LE_MULTI_ADVT);
+  packet = test_hci_layer_->GetCommand();
+  sub_packet = LeMultiAdvtView::Create(LeAdvertisingCommandView::Create(packet));
+  ASSERT_TRUE(sub_packet.IsValid());
+  ASSERT_EQ(sub_packet.GetSubCmd(), SubOcf::SET_SCAN_RESP);
   EXPECT_CALL(
       mock_advertising_callback_,
       OnScanResponseDataSet(advertiser_id_, AdvertisingCallback::AdvertisingStatus::SUCCESS));
   test_hci_layer_->IncomingEvent(
       LeMultiAdvtCompleteBuilder::Create(uint8_t{1}, ErrorCode::SUCCESS, SubOcf::SET_SCAN_RESP));
-  sync_client_handler();
 }
 
 TEST_F(LeExtendedAdvertisingAPITest, set_data_fragments_test) {
@@ -900,16 +842,11 @@
   le_advertising_manager_->SetData(advertiser_id_, false, advertising_data);
 
   // First fragment
-  test_hci_layer_->SetCommandFuture();
-  test_hci_layer_->GetCommand(OpCode::LE_SET_EXTENDED_ADVERTISING_DATA);
-
+  ASSERT_EQ(OpCode::LE_SET_EXTENDED_ADVERTISING_DATA, test_hci_layer_->GetCommand().GetOpCode());
   // Intermediate fragment
-  test_hci_layer_->SetCommandFuture();
-  test_hci_layer_->GetCommand(OpCode::LE_SET_EXTENDED_ADVERTISING_DATA);
-
+  ASSERT_EQ(OpCode::LE_SET_EXTENDED_ADVERTISING_DATA, test_hci_layer_->GetCommand().GetOpCode());
   // Last fragment
-  test_hci_layer_->SetCommandFuture();
-  test_hci_layer_->GetCommand(OpCode::LE_SET_EXTENDED_ADVERTISING_DATA);
+  ASSERT_EQ(OpCode::LE_SET_EXTENDED_ADVERTISING_DATA, test_hci_layer_->GetCommand().GetOpCode());
 
   EXPECT_CALL(
       mock_advertising_callback_,
@@ -917,8 +854,6 @@
   test_hci_layer_->IncomingEvent(LeSetExtendedAdvertisingDataCompleteBuilder::Create(uint8_t{1}, ErrorCode::SUCCESS));
   test_hci_layer_->IncomingEvent(LeSetExtendedAdvertisingDataCompleteBuilder::Create(uint8_t{1}, ErrorCode::SUCCESS));
   test_hci_layer_->IncomingEvent(LeSetExtendedAdvertisingDataCompleteBuilder::Create(uint8_t{1}, ErrorCode::SUCCESS));
-
-  sync_client_handler();
 }
 
 TEST_F(LeExtendedAdvertisingAPITest, set_scan_response_fragments_test) {
@@ -937,28 +872,18 @@
   le_advertising_manager_->SetData(advertiser_id_, true, advertising_data);
 
   // First fragment
-  test_hci_layer_->SetCommandFuture();
-  test_hci_layer_->GetCommand(OpCode::LE_SET_EXTENDED_ADVERTISING_SCAN_RESPONSE);
-
+  ASSERT_EQ(OpCode::LE_SET_EXTENDED_SCAN_RESPONSE_DATA, test_hci_layer_->GetCommand().GetOpCode());
   // Intermediate fragment
-  test_hci_layer_->SetCommandFuture();
-  test_hci_layer_->GetCommand(OpCode::LE_SET_EXTENDED_ADVERTISING_SCAN_RESPONSE);
-
+  ASSERT_EQ(OpCode::LE_SET_EXTENDED_SCAN_RESPONSE_DATA, test_hci_layer_->GetCommand().GetOpCode());
   // Last fragment
-  test_hci_layer_->SetCommandFuture();
-  test_hci_layer_->GetCommand(OpCode::LE_SET_EXTENDED_ADVERTISING_SCAN_RESPONSE);
+  ASSERT_EQ(OpCode::LE_SET_EXTENDED_SCAN_RESPONSE_DATA, test_hci_layer_->GetCommand().GetOpCode());
 
   EXPECT_CALL(
       mock_advertising_callback_,
       OnScanResponseDataSet(advertiser_id_, AdvertisingCallback::AdvertisingStatus::SUCCESS));
-  test_hci_layer_->IncomingEvent(
-      LeSetExtendedAdvertisingScanResponseCompleteBuilder::Create(uint8_t{1}, ErrorCode::SUCCESS));
-  test_hci_layer_->IncomingEvent(
-      LeSetExtendedAdvertisingScanResponseCompleteBuilder::Create(uint8_t{1}, ErrorCode::SUCCESS));
-  test_hci_layer_->IncomingEvent(
-      LeSetExtendedAdvertisingScanResponseCompleteBuilder::Create(uint8_t{1}, ErrorCode::SUCCESS));
-
-  sync_client_handler();
+  test_hci_layer_->IncomingEvent(LeSetExtendedScanResponseDataCompleteBuilder::Create(uint8_t{1}, ErrorCode::SUCCESS));
+  test_hci_layer_->IncomingEvent(LeSetExtendedScanResponseDataCompleteBuilder::Create(uint8_t{1}, ErrorCode::SUCCESS));
+  test_hci_layer_->IncomingEvent(LeSetExtendedScanResponseDataCompleteBuilder::Create(uint8_t{1}, ErrorCode::SUCCESS));
 }
 
 TEST_F(LeExtendedAdvertisingAPITest, set_data_with_invalid_ad_structure) {
@@ -1016,9 +941,8 @@
 
 TEST_F(LeAdvertisingAPITest, disable_enable_advertiser_test) {
   // disable advertiser
-  test_hci_layer_->SetCommandFuture();
   le_advertising_manager_->EnableAdvertiser(advertiser_id_, false, 0x00, 0x00);
-  test_hci_layer_->GetCommand(OpCode::LE_SET_ADVERTISING_ENABLE);
+  ASSERT_EQ(OpCode::LE_SET_ADVERTISING_ENABLE, test_hci_layer_->GetCommand().GetOpCode());
   EXPECT_CALL(
       mock_advertising_callback_,
       OnAdvertisingEnabled(advertiser_id_, false, AdvertisingCallback::AdvertisingStatus::SUCCESS));
@@ -1026,21 +950,21 @@
   sync_client_handler();
 
   // enable advertiser
-  test_hci_layer_->SetCommandFuture();
   le_advertising_manager_->EnableAdvertiser(advertiser_id_, true, 0x00, 0x00);
-  test_hci_layer_->GetCommand(OpCode::LE_SET_ADVERTISING_ENABLE);
+  ASSERT_EQ(OpCode::LE_SET_ADVERTISING_ENABLE, test_hci_layer_->GetCommand().GetOpCode());
   EXPECT_CALL(
       mock_advertising_callback_,
       OnAdvertisingEnabled(advertiser_id_, true, AdvertisingCallback::AdvertisingStatus::SUCCESS));
   test_hci_layer_->IncomingEvent(LeSetAdvertisingEnableCompleteBuilder::Create(uint8_t{1}, ErrorCode::SUCCESS));
-  sync_client_handler();
 }
 
 TEST_F(LeAndroidHciAdvertisingAPITest, disable_enable_advertiser_test) {
   // disable advertiser
-  test_hci_layer_->SetSubCommandFuture(SubOcf::SET_ENABLE);
   le_advertising_manager_->EnableAdvertiser(advertiser_id_, false, 0x00, 0x00);
-  test_hci_layer_->GetCommand(OpCode::LE_MULTI_ADVT);
+  auto packet = test_hci_layer_->GetCommand();
+  auto sub_packet = LeMultiAdvtView::Create(LeAdvertisingCommandView::Create(packet));
+  ASSERT_TRUE(sub_packet.IsValid());
+  ASSERT_EQ(sub_packet.GetSubCmd(), SubOcf::SET_ENABLE);
   EXPECT_CALL(
       mock_advertising_callback_,
       OnAdvertisingEnabled(advertiser_id_, false, AdvertisingCallback::AdvertisingStatus::SUCCESS));
@@ -1049,22 +973,22 @@
   sync_client_handler();
 
   // enable advertiser
-  test_hci_layer_->SetSubCommandFuture(SubOcf::SET_ENABLE);
   le_advertising_manager_->EnableAdvertiser(advertiser_id_, true, 0x00, 0x00);
-  test_hci_layer_->GetCommand(OpCode::LE_MULTI_ADVT);
+  packet = test_hci_layer_->GetCommand();
+  sub_packet = LeMultiAdvtView::Create(LeAdvertisingCommandView::Create(packet));
+  ASSERT_TRUE(sub_packet.IsValid());
+  ASSERT_EQ(sub_packet.GetSubCmd(), SubOcf::SET_ENABLE);
   EXPECT_CALL(
       mock_advertising_callback_,
       OnAdvertisingEnabled(advertiser_id_, true, AdvertisingCallback::AdvertisingStatus::SUCCESS));
   test_hci_layer_->IncomingEvent(
       LeMultiAdvtCompleteBuilder::Create(uint8_t{1}, ErrorCode::SUCCESS, SubOcf::SET_ENABLE));
-  sync_client_handler();
 }
 
 TEST_F(LeExtendedAdvertisingAPITest, disable_enable_advertiser_test) {
   // disable advertiser
-  test_hci_layer_->SetCommandFuture();
   le_advertising_manager_->EnableAdvertiser(advertiser_id_, false, 0x00, 0x00);
-  test_hci_layer_->GetCommand(OpCode::LE_SET_EXTENDED_ADVERTISING_ENABLE);
+  ASSERT_EQ(OpCode::LE_SET_EXTENDED_ADVERTISING_ENABLE, test_hci_layer_->GetCommand().GetOpCode());
   EXPECT_CALL(
       mock_advertising_callback_,
       OnAdvertisingEnabled(advertiser_id_, false, AdvertisingCallback::AdvertisingStatus::SUCCESS));
@@ -1072,13 +996,52 @@
   sync_client_handler();
 
   // enable advertiser
-  test_hci_layer_->SetCommandFuture();
   le_advertising_manager_->EnableAdvertiser(advertiser_id_, true, 0x00, 0x00);
-  test_hci_layer_->GetCommand(OpCode::LE_SET_EXTENDED_ADVERTISING_ENABLE);
+  ASSERT_EQ(OpCode::LE_SET_EXTENDED_ADVERTISING_ENABLE, test_hci_layer_->GetCommand().GetOpCode());
   EXPECT_CALL(
       mock_advertising_callback_,
       OnAdvertisingEnabled(advertiser_id_, true, AdvertisingCallback::AdvertisingStatus::SUCCESS));
   test_hci_layer_->IncomingEvent(LeSetExtendedAdvertisingEnableCompleteBuilder::Create(uint8_t{1}, ErrorCode::SUCCESS));
+}
+
+TEST_F(LeExtendedAdvertisingAPITest, disable_after_enable) {
+  // we expect Started -> Enable(false) -> Enable(true) -> Enable(false)
+
+  // setup already arranges everything and starts the advertiser
+
+  // expect
+  InSequence s;
+  EXPECT_CALL(mock_advertising_callback_, OnAdvertisingEnabled(_, false, _));
+  EXPECT_CALL(mock_advertising_callback_, OnAdvertisingEnabled(_, true, _));
+  EXPECT_CALL(mock_advertising_callback_, OnAdvertisingEnabled(_, false, _));
+  EXPECT_CALL(mock_advertising_callback_, OnAdvertisingEnabled(_, true, _));
+
+  // act
+
+  // disable
+  le_advertising_manager_->EnableAdvertiser(advertiser_id_, false, 0x00, 0x00);
+  test_hci_layer_->GetCommand();
+  test_hci_layer_->IncomingEvent(
+      LeSetExtendedAdvertisingEnableCompleteBuilder::Create(uint8_t{1}, ErrorCode::SUCCESS));
+
+  // enable
+  le_advertising_manager_->EnableAdvertiser(advertiser_id_, true, 0x00, 0x00);
+  test_hci_layer_->GetCommand();
+  test_hci_layer_->IncomingEvent(
+      LeSetExtendedAdvertisingEnableCompleteBuilder::Create(uint8_t{1}, ErrorCode::SUCCESS));
+
+  // disable
+  le_advertising_manager_->EnableAdvertiser(advertiser_id_, false, 0x00, 0x00);
+  test_hci_layer_->GetCommand();
+  test_hci_layer_->IncomingEvent(
+      LeSetExtendedAdvertisingEnableCompleteBuilder::Create(uint8_t{1}, ErrorCode::SUCCESS));
+
+  // enable
+  le_advertising_manager_->EnableAdvertiser(advertiser_id_, true, 0x00, 0x00);
+  test_hci_layer_->GetCommand();
+  test_hci_layer_->IncomingEvent(
+      LeSetExtendedAdvertisingEnableCompleteBuilder::Create(uint8_t{1}, ErrorCode::SUCCESS));
+
   sync_client_handler();
 }
 
@@ -1086,9 +1049,8 @@
   PeriodicAdvertisingParameters advertising_config{};
   advertising_config.max_interval = 0x1000;
   advertising_config.min_interval = 0x0006;
-  test_hci_layer_->SetCommandFuture();
   le_advertising_manager_->SetPeriodicParameters(advertiser_id_, advertising_config);
-  test_hci_layer_->GetCommand(OpCode::LE_SET_PERIODIC_ADVERTISING_PARAM);
+  ASSERT_EQ(OpCode::LE_SET_PERIODIC_ADVERTISING_PARAM, test_hci_layer_->GetCommand().GetOpCode());
   EXPECT_CALL(
       mock_advertising_callback_,
       OnPeriodicAdvertisingParametersUpdated(advertiser_id_, AdvertisingCallback::AdvertisingStatus::SUCCESS));
@@ -1103,9 +1065,8 @@
   data_item.data_type_ = GapDataType::TX_POWER_LEVEL;
   data_item.data_ = {0x00};
   advertising_data.push_back(data_item);
-  test_hci_layer_->SetCommandFuture();
   le_advertising_manager_->SetPeriodicData(advertiser_id_, advertising_data);
-  test_hci_layer_->GetCommand(OpCode::LE_SET_PERIODIC_ADVERTISING_DATA);
+  ASSERT_EQ(OpCode::LE_SET_PERIODIC_ADVERTISING_DATA, test_hci_layer_->GetCommand().GetOpCode());
   EXPECT_CALL(
       mock_advertising_callback_,
       OnPeriodicAdvertisingDataSet(advertiser_id_, AdvertisingCallback::AdvertisingStatus::SUCCESS));
@@ -1129,16 +1090,11 @@
   le_advertising_manager_->SetPeriodicData(advertiser_id_, advertising_data);
 
   // First fragment
-  test_hci_layer_->SetCommandFuture();
-  test_hci_layer_->GetCommand(OpCode::LE_SET_PERIODIC_ADVERTISING_DATA);
-
+  ASSERT_EQ(OpCode::LE_SET_PERIODIC_ADVERTISING_DATA, test_hci_layer_->GetCommand().GetOpCode());
   // Intermediate fragment
-  test_hci_layer_->SetCommandFuture();
-  test_hci_layer_->GetCommand(OpCode::LE_SET_PERIODIC_ADVERTISING_DATA);
-
+  ASSERT_EQ(OpCode::LE_SET_PERIODIC_ADVERTISING_DATA, test_hci_layer_->GetCommand().GetOpCode());
   // Last fragment
-  test_hci_layer_->SetCommandFuture();
-  test_hci_layer_->GetCommand(OpCode::LE_SET_PERIODIC_ADVERTISING_DATA);
+  ASSERT_EQ(OpCode::LE_SET_PERIODIC_ADVERTISING_DATA, test_hci_layer_->GetCommand().GetOpCode());
 
   EXPECT_CALL(
       mock_advertising_callback_,
@@ -1146,8 +1102,6 @@
   test_hci_layer_->IncomingEvent(LeSetPeriodicAdvertisingDataCompleteBuilder::Create(uint8_t{1}, ErrorCode::SUCCESS));
   test_hci_layer_->IncomingEvent(LeSetPeriodicAdvertisingDataCompleteBuilder::Create(uint8_t{1}, ErrorCode::SUCCESS));
   test_hci_layer_->IncomingEvent(LeSetPeriodicAdvertisingDataCompleteBuilder::Create(uint8_t{1}, ErrorCode::SUCCESS));
-
-  sync_client_handler();
 }
 
 TEST_F(LeExtendedAdvertisingAPITest, set_perodic_data_with_invalid_ad_structure) {
@@ -1167,8 +1121,6 @@
       OnPeriodicAdvertisingDataSet(advertiser_id_, AdvertisingCallback::AdvertisingStatus::INTERNAL_ERROR));
 
   le_advertising_manager_->SetPeriodicData(advertiser_id_, advertising_data);
-
-  sync_client_handler();
 }
 
 TEST_F(LeExtendedAdvertisingAPITest, set_perodic_data_with_invalid_length) {
@@ -1195,9 +1147,8 @@
 
 TEST_F(LeExtendedAdvertisingAPITest, disable_enable_periodic_advertiser_test) {
   // disable advertiser
-  test_hci_layer_->SetCommandFuture();
   le_advertising_manager_->EnablePeriodicAdvertising(advertiser_id_, false);
-  test_hci_layer_->GetCommand(OpCode::LE_SET_PERIODIC_ADVERTISING_ENABLE);
+  ASSERT_EQ(OpCode::LE_SET_PERIODIC_ADVERTISING_ENABLE, test_hci_layer_->GetCommand().GetOpCode());
   EXPECT_CALL(
       mock_advertising_callback_,
       OnPeriodicAdvertisingEnabled(advertiser_id_, false, AdvertisingCallback::AdvertisingStatus::SUCCESS));
@@ -1205,9 +1156,8 @@
   sync_client_handler();
 
   // enable advertiser
-  test_hci_layer_->SetCommandFuture();
   le_advertising_manager_->EnablePeriodicAdvertising(advertiser_id_, true);
-  test_hci_layer_->GetCommand(OpCode::LE_SET_PERIODIC_ADVERTISING_ENABLE);
+  ASSERT_EQ(OpCode::LE_SET_PERIODIC_ADVERTISING_ENABLE, test_hci_layer_->GetCommand().GetOpCode());
   EXPECT_CALL(
       mock_advertising_callback_,
       OnPeriodicAdvertisingEnabled(advertiser_id_, true, AdvertisingCallback::AdvertisingStatus::SUCCESS));
@@ -1215,6 +1165,99 @@
   sync_client_handler();
 }
 
+TEST_F(LeExtendedAdvertisingAPITest, trigger_advertiser_callbacks_if_started_while_paused) {
+  // arrange
+  auto test_le_address_manager = (TestLeAddressManager*)test_acl_manager_->GetLeAddressManager();
+  auto id_promise = std::promise<uint8_t>{};
+  auto id_future = id_promise.get_future();
+  le_advertising_manager_->RegisterAdvertiser(base::BindOnce(
+      [](std::promise<uint8_t> promise, uint8_t id, uint8_t _status) { promise.set_value(id); },
+      std::move(id_promise)));
+  sync_client_handler();
+  auto set_id = id_future.get();
+
+  auto status_promise = std::promise<ErrorCode>{};
+  auto status_future = status_promise.get_future();
+
+  test_le_address_manager->client_->OnPause();
+
+  test_hci_layer_->GetCommand();
+  test_hci_layer_->IncomingEvent(LeSetExtendedAdvertisingEnableCompleteBuilder::Create(1, ErrorCode::SUCCESS));
+  sync_client_handler();
+
+  // act
+  le_advertising_manager_->StartAdvertising(
+      set_id,
+      {},
+      0,
+      base::BindOnce(
+          [](std::promise<ErrorCode> promise, uint8_t status) { promise.set_value((ErrorCode)status); },
+          std::move(status_promise)),
+      base::Bind([](uint8_t _status) {}),
+      base::Bind([](Address _address, AddressType _address_type) {}),
+      base::Bind([](ErrorCode _status, uint8_t _unused_1, uint8_t _unused_2) {}),
+      client_handler_);
+
+  test_hci_layer_->GetCommand();
+  test_hci_layer_->IncomingEvent(LeSetExtendedAdvertisingParametersCompleteBuilder::Create(1, ErrorCode::SUCCESS, 0));
+
+  test_hci_layer_->GetCommand();
+  test_hci_layer_->IncomingEvent(LeSetExtendedScanResponseDataCompleteBuilder::Create(1, ErrorCode::SUCCESS));
+
+  test_hci_layer_->GetCommand();
+  test_hci_layer_->IncomingEvent(LeSetExtendedAdvertisingDataCompleteBuilder::Create(1, ErrorCode::SUCCESS));
+
+  EXPECT_EQ(status_future.wait_for(std::chrono::milliseconds(100)), std::future_status::timeout);
+
+  test_le_address_manager->client_->OnResume();
+
+  test_hci_layer_->GetCommand();
+  test_hci_layer_->IncomingEvent(LeSetExtendedAdvertisingEnableCompleteBuilder::Create(1, ErrorCode::SUCCESS));
+
+  // assert
+  EXPECT_EQ(status_future.get(), ErrorCode::SUCCESS);
+
+  sync_client_handler();
+}
+
+TEST_F(LeExtendedAdvertisingAPITest, no_callbacks_on_pause) {
+  // arrange
+  auto test_le_address_manager = (TestLeAddressManager*)test_acl_manager_->GetLeAddressManager();
+
+  // expect
+  EXPECT_CALL(mock_advertising_callback_, OnAdvertisingEnabled(_, _, _)).Times(0);
+
+  // act
+  LOG_INFO("pause");
+  test_le_address_manager->client_->OnPause();
+  test_hci_layer_->GetCommand();
+  test_hci_layer_->IncomingEvent(
+      LeSetExtendedAdvertisingEnableCompleteBuilder::Create(1, ErrorCode::SUCCESS));
+
+  sync_client_handler();
+}
+
+TEST_F(LeExtendedAdvertisingAPITest, no_callbacks_on_resume) {
+  // arrange
+  auto test_le_address_manager = (TestLeAddressManager*)test_acl_manager_->GetLeAddressManager();
+  test_le_address_manager->client_->OnPause();
+  test_hci_layer_->GetCommand();
+  test_hci_layer_->IncomingEvent(
+      LeSetExtendedAdvertisingEnableCompleteBuilder::Create(1, ErrorCode::SUCCESS));
+  sync_client_handler();
+
+  // expect
+  EXPECT_CALL(mock_advertising_callback_, OnAdvertisingEnabled(_, _, _)).Times(0);
+
+  // act
+  test_le_address_manager->client_->OnResume();
+  test_hci_layer_->GetCommand();
+  test_hci_layer_->IncomingEvent(
+      LeSetExtendedAdvertisingEnableCompleteBuilder::Create(1, ErrorCode::SUCCESS));
+
+  sync_client_handler();
+}
+
 }  // namespace
 }  // namespace hci
 }  // namespace bluetooth
diff --git a/system/gd/hci/le_periodic_sync_manager.h b/system/gd/hci/le_periodic_sync_manager.h
index a1f52be..c44a2a1 100644
--- a/system/gd/hci/le_periodic_sync_manager.h
+++ b/system/gd/hci/le_periodic_sync_manager.h
@@ -272,13 +272,19 @@
     }
 
     auto address_with_type = AddressWithType(event_view.GetAdvertiserAddress(), event_view.GetAdvertiserAddressType());
-
-    auto temp_address_type = address_with_type.GetAddressType();
-    // If the create sync command uses 0x01, Random or Random ID, the result can be 0x01, 0x02, or 0x03,
-    // because a Random Address, if it is an RPA, can be resolved to either Public Identity or Random Identity.
-    if (temp_address_type != AddressType::PUBLIC_DEVICE_ADDRESS) {
-      temp_address_type = AddressType::RANDOM_DEVICE_ADDRESS;
+    auto peer_address_type = address_with_type.GetAddressType();
+    AddressType temp_address_type;
+    switch (peer_address_type) {
+      case AddressType::PUBLIC_DEVICE_ADDRESS:
+      case AddressType::PUBLIC_IDENTITY_ADDRESS:
+        temp_address_type = AddressType::PUBLIC_DEVICE_ADDRESS;
+        break;
+      case AddressType::RANDOM_DEVICE_ADDRESS:
+      case AddressType::RANDOM_IDENTITY_ADDRESS:
+        temp_address_type = AddressType::RANDOM_DEVICE_ADDRESS;
+        break;
     }
+
     auto periodic_sync = GetSyncFromAddressWithTypeAndSid(
         AddressWithType(event_view.GetAdvertiserAddress(), temp_address_type), event_view.GetAdvertisingSid());
     if (periodic_sync == periodic_syncs_.end()) {
diff --git a/system/gd/hci/le_periodic_sync_manager_test.cc b/system/gd/hci/le_periodic_sync_manager_test.cc
index 4651972..da77d18 100644
--- a/system/gd/hci/le_periodic_sync_manager_test.cc
+++ b/system/gd/hci/le_periodic_sync_manager_test.cc
@@ -45,8 +45,9 @@
     command_queue_.push(std::move(command));
     command_complete_callbacks.push_back(std::move(on_complete));
     if (command_promise_ != nullptr) {
-      command_promise_->set_value();
-      command_promise_.reset();
+      std::promise<void>* prom = command_promise_.release();
+      prom->set_value();
+      delete prom;
     }
   }
 
@@ -56,13 +57,14 @@
     command_queue_.push(std::move(command));
     command_status_callbacks.push_back(std::move(on_status));
     if (command_promise_ != nullptr) {
-      command_promise_->set_value();
-      command_promise_.reset();
+      std::promise<void>* prom = command_promise_.release();
+      prom->set_value();
+      delete prom;
     }
   }
 
   void SetCommandFuture() {
-    ASSERT_LOG(command_promise_ == nullptr, "Promises, Promises, ... Only one at a time.");
+    ASSERT_EQ(command_promise_, nullptr) << "Promises, Promises, ... Only one at a time.";
     command_promise_ = std::make_unique<std::promise<void>>();
     command_future_ = std::make_unique<std::future<void>>(command_promise_->get_future());
   }
@@ -224,7 +226,7 @@
   };
   uint16_t skip = 0x04;
   uint16_t sync_timeout = 0x0A;
-  test_le_scanning_interface_->SetCommandFuture();
+  ASSERT_NO_FATAL_FAILURE(test_le_scanning_interface_->SetCommandFuture());
   periodic_sync_manager_->StartSync(request, skip, sync_timeout);
   auto packet = test_le_scanning_interface_->GetCommand(OpCode::LE_PERIODIC_ADVERTISING_CREATE_SYNC);
   auto packet_view = LePeriodicAdvertisingCreateSyncView::Create(LeScanningCommandView::Create(packet));
@@ -251,7 +253,7 @@
       .sync_handle = sync_handle,
       .sync_state = PeriodicSyncState::PERIODIC_SYNC_STATE_IDLE,
   };
-  test_le_scanning_interface_->SetCommandFuture();
+  ASSERT_NO_FATAL_FAILURE(test_le_scanning_interface_->SetCommandFuture());
   periodic_sync_manager_->StartSync(request, 0x04, 0x0A);
   auto packet = test_le_scanning_interface_->GetCommand(OpCode::LE_PERIODIC_ADVERTISING_CREATE_SYNC);
   auto temp_view = LePeriodicAdvertisingCreateSyncView::Create(LeScanningCommandView::Create(packet));
@@ -279,6 +281,48 @@
   sync_handler();
 }
 
+TEST_F(PeriodicSyncManagerTest, handle_advertising_sync_established_with_public_identity_address_test) {
+  uint16_t sync_handle = 0x12;
+  uint8_t advertiser_sid = 0x02;
+  // start scan
+  Address address;
+  Address::FromString("00:11:22:33:44:55", address);
+  AddressWithType address_with_type = AddressWithType(address, AddressType::PUBLIC_DEVICE_ADDRESS);
+  PeriodicSyncStates request{
+      .request_id = 0x01,
+      .advertiser_sid = advertiser_sid,
+      .address_with_type = address_with_type,
+      .sync_handle = sync_handle,
+      .sync_state = PeriodicSyncState::PERIODIC_SYNC_STATE_IDLE,
+  };
+  ASSERT_NO_FATAL_FAILURE(test_le_scanning_interface_->SetCommandFuture());
+  periodic_sync_manager_->StartSync(request, 0x04, 0x0A);
+  auto packet = test_le_scanning_interface_->GetCommand(OpCode::LE_PERIODIC_ADVERTISING_CREATE_SYNC);
+  auto temp_view = LePeriodicAdvertisingCreateSyncView::Create(LeScanningCommandView::Create(packet));
+  ASSERT_TRUE(temp_view.IsValid());
+
+  // Get command status
+  test_le_scanning_interface_->CommandStatusCallback(
+      LePeriodicAdvertisingCreateSyncStatusBuilder::Create(ErrorCode::SUCCESS, 0x00));
+
+  EXPECT_CALL(mock_callbacks_, OnPeriodicSyncStarted);
+
+  // Get LePeriodicAdvertisingSyncEstablished with AddressType::PUBLIC_IDENTITY_ADDRESS
+  auto builder = LePeriodicAdvertisingSyncEstablishedBuilder::Create(
+      ErrorCode::SUCCESS,
+      sync_handle,
+      advertiser_sid,
+      AddressType::PUBLIC_IDENTITY_ADDRESS,
+      address_with_type.GetAddress(),
+      SecondaryPhyType::LE_1M,
+      0xFF,
+      ClockAccuracy::PPM_250);
+  auto event_view = LePeriodicAdvertisingSyncEstablishedView::Create(
+      LeMetaEventView::Create(EventView::Create(GetPacketView(std::move(builder)))));
+  periodic_sync_manager_->HandleLePeriodicAdvertisingSyncEstablished(event_view);
+  sync_handler();
+}
+
 TEST_F(PeriodicSyncManagerTest, stop_sync_test) {
   uint16_t sync_handle = 0x12;
   uint8_t advertiser_sid = 0x02;
@@ -293,7 +337,7 @@
       .sync_handle = sync_handle,
       .sync_state = PeriodicSyncState::PERIODIC_SYNC_STATE_IDLE,
   };
-  test_le_scanning_interface_->SetCommandFuture();
+  ASSERT_NO_FATAL_FAILURE(test_le_scanning_interface_->SetCommandFuture());
   periodic_sync_manager_->StartSync(request, 0x04, 0x0A);
   auto packet = test_le_scanning_interface_->GetCommand(OpCode::LE_PERIODIC_ADVERTISING_CREATE_SYNC);
   auto temp_veiw = LePeriodicAdvertisingCreateSyncView::Create(LeScanningCommandView::Create(packet));
@@ -320,7 +364,7 @@
   periodic_sync_manager_->HandleLePeriodicAdvertisingSyncEstablished(event_view);
 
   // StopSync
-  test_le_scanning_interface_->SetCommandFuture();
+  ASSERT_NO_FATAL_FAILURE(test_le_scanning_interface_->SetCommandFuture());
   periodic_sync_manager_->StopSync(sync_handle);
   packet = test_le_scanning_interface_->GetCommand(OpCode::LE_PERIODIC_ADVERTISING_TERMINATE_SYNC);
   auto packet_view = LePeriodicAdvertisingTerminateSyncView::Create(LeScanningCommandView::Create(packet));
@@ -343,7 +387,7 @@
       .sync_handle = sync_handle,
       .sync_state = PeriodicSyncState::PERIODIC_SYNC_STATE_IDLE,
   };
-  test_le_scanning_interface_->SetCommandFuture();
+  ASSERT_NO_FATAL_FAILURE(test_le_scanning_interface_->SetCommandFuture());
   periodic_sync_manager_->StartSync(request, 0x04, 0x0A);
   auto packet = test_le_scanning_interface_->GetCommand(OpCode::LE_PERIODIC_ADVERTISING_CREATE_SYNC);
   auto temp_veiw = LePeriodicAdvertisingCreateSyncView::Create(LeScanningCommandView::Create(packet));
@@ -354,7 +398,7 @@
       LePeriodicAdvertisingCreateSyncStatusBuilder::Create(ErrorCode::SUCCESS, 0x00));
 
   // Cancel crate sync
-  test_le_scanning_interface_->SetCommandFuture();
+  ASSERT_NO_FATAL_FAILURE(test_le_scanning_interface_->SetCommandFuture());
   periodic_sync_manager_->CancelCreateSync(advertiser_sid, address_with_type.GetAddress());
   packet = test_le_scanning_interface_->GetCommand(OpCode::LE_PERIODIC_ADVERTISING_CREATE_SYNC_CANCEL);
   auto packet_view = LePeriodicAdvertisingCreateSyncCancelView::Create(LeScanningCommandView::Create(packet));
@@ -369,7 +413,7 @@
   uint16_t sync_handle = 0x11;
   uint16_t connection_handle = 0x12;
   int pa_source = 0x01;
-  test_le_scanning_interface_->SetCommandFuture();
+  ASSERT_NO_FATAL_FAILURE(test_le_scanning_interface_->SetCommandFuture());
   periodic_sync_manager_->TransferSync(address, service_data, sync_handle, pa_source, connection_handle);
   auto packet = test_le_scanning_interface_->GetCommand(OpCode::LE_PERIODIC_ADVERTISING_SYNC_TRANSFER);
   auto packet_view = LePeriodicAdvertisingSyncTransferView::Create(LeScanningCommandView::Create(packet));
@@ -394,7 +438,7 @@
   uint16_t advertising_handle = 0x11;
   uint16_t connection_handle = 0x12;
   int pa_source = 0x01;
-  test_le_scanning_interface_->SetCommandFuture();
+  ASSERT_NO_FATAL_FAILURE(test_le_scanning_interface_->SetCommandFuture());
   periodic_sync_manager_->SyncSetInfo(address, service_data, advertising_handle, pa_source, connection_handle);
   auto packet = test_le_scanning_interface_->GetCommand(OpCode::LE_PERIODIC_ADVERTISING_SET_INFO_TRANSFER);
   auto packet_view = LePeriodicAdvertisingSetInfoTransferView::Create(LeScanningCommandView::Create(packet));
@@ -419,7 +463,7 @@
   uint16_t skip = 0x11;
   uint16_t timout = 0x12;
   int reg_id = 0x01;
-  test_le_scanning_interface_->SetCommandFuture();
+  ASSERT_NO_FATAL_FAILURE(test_le_scanning_interface_->SetCommandFuture());
   periodic_sync_manager_->SyncTxParameters(address, mode, skip, timout, reg_id);
   auto packet =
       test_le_scanning_interface_->GetCommand(OpCode::LE_SET_DEFAULT_PERIODIC_ADVERTISING_SYNC_TRANSFER_PARAMETERS);
@@ -448,7 +492,7 @@
       .sync_handle = sync_handle,
       .sync_state = PeriodicSyncState::PERIODIC_SYNC_STATE_IDLE,
   };
-  test_le_scanning_interface_->SetCommandFuture();
+  ASSERT_NO_FATAL_FAILURE(test_le_scanning_interface_->SetCommandFuture());
   periodic_sync_manager_->StartSync(request, 0x04, 0x0A);
   auto packet = test_le_scanning_interface_->GetCommand(OpCode::LE_PERIODIC_ADVERTISING_CREATE_SYNC);
   auto temp_veiw = LePeriodicAdvertisingCreateSyncView::Create(LeScanningCommandView::Create(packet));
@@ -500,7 +544,7 @@
       .sync_handle = sync_handle,
       .sync_state = PeriodicSyncState::PERIODIC_SYNC_STATE_IDLE,
   };
-  test_le_scanning_interface_->SetCommandFuture();
+  ASSERT_NO_FATAL_FAILURE(test_le_scanning_interface_->SetCommandFuture());
   periodic_sync_manager_->StartSync(request, 0x04, 0x0A);
   auto packet = test_le_scanning_interface_->GetCommand(OpCode::LE_PERIODIC_ADVERTISING_CREATE_SYNC);
   auto temp_veiw = LePeriodicAdvertisingCreateSyncView::Create(LeScanningCommandView::Create(packet));
diff --git a/system/gd/hci/le_scanning_callback.h b/system/gd/hci/le_scanning_callback.h
index 9ad0157..03c0491 100644
--- a/system/gd/hci/le_scanning_callback.h
+++ b/system/gd/hci/le_scanning_callback.h
@@ -99,6 +99,7 @@
   std::vector<uint8_t> name;
   uint16_t company;
   uint16_t company_mask;
+  uint8_t ad_type;
   std::vector<uint8_t> data;
   std::vector<uint8_t> data_mask;
   std::array<uint8_t, 16> irk;
diff --git a/system/gd/hci/le_scanning_manager.cc b/system/gd/hci/le_scanning_manager.cc
index 5df7c4a..4b1ccf5 100644
--- a/system/gd/hci/le_scanning_manager.cc
+++ b/system/gd/hci/le_scanning_manager.cc
@@ -136,7 +136,7 @@
 };
 
 class NullScanningCallback : public ScanningCallback {
-  void OnScannerRegistered(const bluetooth::hci::Uuid app_uuid, ScannerId scanner_id, ScanningStatus status) override {
+  void OnScannerRegistered(const Uuid app_uuid, ScannerId scanner_id, ScanningStatus status) override {
     LOG_INFO("OnScannerRegistered in NullScanningCallback");
   }
   void OnSetScannerParameterComplete(ScannerId scanner_id, ScanningStatus status) override {
@@ -222,7 +222,7 @@
   ScannerId ref_value;
 };
 
-struct LeScanningManager::impl : public bluetooth::hci::LeAddressManagerCallback {
+struct LeScanningManager::impl : public LeAddressManagerCallback {
   impl(Module* module) : module_(module), le_scanning_interface_(nullptr) {}
 
   ~impl() {
@@ -233,10 +233,10 @@
 
   void start(
       os::Handler* handler,
-      hci::HciLayer* hci_layer,
-      hci::Controller* controller,
-      hci::AclManager* acl_manager,
-      hci::VendorSpecificEventManager* vendor_specific_event_manager,
+      HciLayer* hci_layer,
+      Controller* controller,
+      AclManager* acl_manager,
+      VendorSpecificEventManager* vendor_specific_event_manager,
       storage::StorageModule* storage_module) {
     module_handler_ = handler;
     hci_layer_ = hci_layer;
@@ -259,12 +259,17 @@
     } else {
       api_type_ = ScanApiType::LEGACY;
     }
-    is_filter_support_ = controller_->IsSupported(OpCode::LE_ADV_FILTER);
-    is_batch_scan_support_ = controller->IsSupported(OpCode::LE_BATCH_SCAN);
-    is_periodic_advertising_sync_transfer_sender_support_ =
+    is_filter_supported_ = controller_->IsSupported(OpCode::LE_ADV_FILTER);
+    if (is_filter_supported_) {
+      le_scanning_interface_->EnqueueCommand(
+          LeAdvFilterReadExtendedFeaturesBuilder::Create(),
+          module_handler_->BindOnceOn(this, &impl::on_apcf_read_extended_features_complete));
+    }
+    is_batch_scan_supported_ = controller->IsSupported(OpCode::LE_BATCH_SCAN);
+    is_periodic_advertising_sync_transfer_sender_supported_ =
         controller_->SupportsBlePeriodicAdvertisingSyncTransferSender();
     total_num_of_advt_tracked_ = controller->GetVendorCapabilities().total_num_of_advt_tracked_;
-    if (is_batch_scan_support_) {
+    if (is_batch_scan_supported_) {
       vendor_specific_event_manager_->RegisterEventHandler(
           VseSubeventCode::BLE_THRESHOLD, handler->BindOn(this, &LeScanningManager::impl::on_storage_threshold_breach));
       vendor_specific_event_manager_->RegisterEventHandler(
@@ -284,7 +289,7 @@
     for (auto subevent_code : LeScanningEvents) {
       hci_layer_->UnregisterLeEventHandler(subevent_code);
     }
-    if (is_batch_scan_support_) {
+    if (is_batch_scan_supported_) {
       // TODO implete vse module
       // hci_layer_->UnregisterVesEventHandler(VseSubeventCode::BLE_THRESHOLD);
       // hci_layer_->UnregisterVesEventHandler(VseSubeventCode::BLE_TRACKING);
@@ -297,35 +302,35 @@
 
   void handle_scan_results(LeMetaEventView event) {
     switch (event.GetSubeventCode()) {
-      case hci::SubeventCode::ADVERTISING_REPORT:
+      case SubeventCode::ADVERTISING_REPORT:
         handle_advertising_report(LeAdvertisingReportView::Create(event));
         break;
-      case hci::SubeventCode::DIRECTED_ADVERTISING_REPORT:
+      case SubeventCode::DIRECTED_ADVERTISING_REPORT:
         handle_directed_advertising_report(LeDirectedAdvertisingReportView::Create(event));
         break;
-      case hci::SubeventCode::EXTENDED_ADVERTISING_REPORT:
+      case SubeventCode::EXTENDED_ADVERTISING_REPORT:
         handle_extended_advertising_report(LeExtendedAdvertisingReportView::Create(event));
         break;
-      case hci::SubeventCode::PERIODIC_ADVERTISING_SYNC_ESTABLISHED:
+      case SubeventCode::PERIODIC_ADVERTISING_SYNC_ESTABLISHED:
         LePeriodicAdvertisingSyncEstablishedView::Create(event);
         periodic_sync_manager_.HandleLePeriodicAdvertisingSyncEstablished(
             LePeriodicAdvertisingSyncEstablishedView::Create(event));
         break;
-      case hci::SubeventCode::PERIODIC_ADVERTISING_REPORT:
+      case SubeventCode::PERIODIC_ADVERTISING_REPORT:
         periodic_sync_manager_.HandleLePeriodicAdvertisingReport(LePeriodicAdvertisingReportView::Create(event));
         break;
-      case hci::SubeventCode::PERIODIC_ADVERTISING_SYNC_LOST:
+      case SubeventCode::PERIODIC_ADVERTISING_SYNC_LOST:
         periodic_sync_manager_.HandleLePeriodicAdvertisingSyncLost(LePeriodicAdvertisingSyncLostView::Create(event));
         break;
-      case hci::SubeventCode::PERIODIC_ADVERTISING_SYNC_TRANSFER_RECEIVED:
+      case SubeventCode::PERIODIC_ADVERTISING_SYNC_TRANSFER_RECEIVED:
         periodic_sync_manager_.HandleLePeriodicAdvertisingSyncTransferReceived(
             LePeriodicAdvertisingSyncTransferReceivedView::Create(event));
         break;
-      case hci::SubeventCode::SCAN_TIMEOUT:
+      case SubeventCode::SCAN_TIMEOUT:
         scanning_callbacks_->OnTimeout();
         break;
       default:
-        LOG_ALWAYS_FATAL("Unknown advertising subevent %s", hci::SubeventCodeText(event.GetSubeventCode()).c_str());
+        LOG_ALWAYS_FATAL("Unknown advertising subevent %s", SubeventCodeText(event.GetSubeventCode()).c_str());
     }
   }
 
@@ -361,21 +366,21 @@
     for (LeAdvertisingResponse report : reports) {
       uint16_t extended_event_type = 0;
       switch (report.event_type_) {
-        case hci::AdvertisingEventType::ADV_IND:
+        case AdvertisingEventType::ADV_IND:
           transform_to_extended_event_type(
               &extended_event_type, {.connectable = true, .scannable = true, .legacy = true});
           break;
-        case hci::AdvertisingEventType::ADV_DIRECT_IND:
+        case AdvertisingEventType::ADV_DIRECT_IND:
           transform_to_extended_event_type(
               &extended_event_type, {.connectable = true, .directed = true, .legacy = true});
           break;
-        case hci::AdvertisingEventType::ADV_SCAN_IND:
+        case AdvertisingEventType::ADV_SCAN_IND:
           transform_to_extended_event_type(&extended_event_type, {.scannable = true, .legacy = true});
           break;
-        case hci::AdvertisingEventType::ADV_NONCONN_IND:
+        case AdvertisingEventType::ADV_NONCONN_IND:
           transform_to_extended_event_type(&extended_event_type, {.legacy = true});
           break;
-        case hci::AdvertisingEventType::SCAN_RESPONSE:
+        case AdvertisingEventType::SCAN_RESPONSE:
           transform_to_extended_event_type(
               &extended_event_type, {.connectable = true, .scannable = true, .scan_response = true, .legacy = true});
           break;
@@ -384,13 +389,6 @@
           return;
       }
 
-      std::vector<uint8_t> advertising_data = {};
-      for (auto gap_data : report.advertising_data_) {
-        advertising_data.push_back((uint8_t)gap_data.size() - 1);
-        advertising_data.push_back((uint8_t)gap_data.data_type_);
-        advertising_data.insert(advertising_data.end(), gap_data.data_.begin(), gap_data.data_.end());
-      }
-
       process_advertising_package_content(
           extended_event_type,
           (uint8_t)report.address_type_,
@@ -401,7 +399,7 @@
           kTxPowerInformationNotPresent,
           report.rssi_,
           kNotPeriodicAdvertisement,
-          advertising_data);
+          report.advertising_data_);
     }
   }
 
@@ -459,12 +457,20 @@
       int8_t tx_power,
       int8_t rssi,
       uint16_t periodic_advertising_interval,
-      std::vector<uint8_t> advertising_data) {
+      std::vector<LengthAndData> advertising_data) {
     bool is_scannable = event_type & (1 << kScannableBit);
     bool is_scan_response = event_type & (1 << kScanResponseBit);
     bool is_legacy = event_type & (1 << kLegacyBit);
 
-    if (address_type == (uint8_t)DirectAdvertisingAddressType::NO_ADDRESS) {
+    auto significant_data = std::vector<uint8_t>{};
+    for (const auto& datum : advertising_data) {
+      if (!datum.data_.empty()) {
+        significant_data.push_back(static_cast<uint8_t>(datum.data_.size()));
+        significant_data.insert(significant_data.end(), datum.data_.begin(), datum.data_.end());
+      }
+    }
+
+    if (address_type == (uint8_t)DirectAdvertisingAddressType::NO_ADDRESS_PROVIDED) {
       scanning_callbacks_->OnScanResult(
           event_type,
           address_type,
@@ -475,7 +481,7 @@
           tx_power,
           rssi,
           periodic_advertising_interval,
-          advertising_data);
+          significant_data);
       return;
     } else if (address == Address::kEmpty) {
       LOG_WARN("Receive non-anonymous advertising report with empty address, skip!");
@@ -490,8 +496,8 @@
 
     bool is_start = is_legacy && is_scannable && !is_scan_response;
 
-    std::vector<uint8_t> const& adv_data = is_start ? advertising_cache_.Set(address_with_type, advertising_data)
-                                                    : advertising_cache_.Append(address_with_type, advertising_data);
+    std::vector<uint8_t> const& adv_data = is_start ? advertising_cache_.Set(address_with_type, significant_data)
+                                                    : advertising_cache_.Append(address_with_type, significant_data);
 
     uint8_t data_status = event_type >> kDataStatusBits;
     if (data_status == (uint8_t)DataStatus::CONTINUING) {
@@ -548,20 +554,21 @@
     switch (api_type_) {
       case ScanApiType::EXTENDED:
         le_scanning_interface_->EnqueueCommand(
-            hci::LeSetExtendedScanParametersBuilder::Create(
+            LeSetExtendedScanParametersBuilder::Create(
                 own_address_type_, filter_policy_, phys_in_use, parameter_vector),
             module_handler_->BindOnceOn(this, &impl::on_set_scan_parameter_complete));
         break;
       case ScanApiType::ANDROID_HCI:
         le_scanning_interface_->EnqueueCommand(
-            hci::LeExtendedScanParamsBuilder::Create(
+            LeExtendedScanParamsBuilder::Create(
                 le_scan_type_, interval_ms_, window_ms_, own_address_type_, filter_policy_),
             module_handler_->BindOnceOn(this, &impl::on_set_scan_parameter_complete));
 
         break;
       case ScanApiType::LEGACY:
         le_scanning_interface_->EnqueueCommand(
-            hci::LeSetScanParametersBuilder::Create(
+
+            LeSetScanParametersBuilder::Create(
                 le_scan_type_, interval_ms_, window_ms_, own_address_type_, filter_policy_),
             module_handler_->BindOnceOn(this, &impl::on_set_scan_parameter_complete));
         break;
@@ -621,7 +628,7 @@
 
   void start_scan() {
     // If we receive start_scan during paused, set scan_on_resume_ to true
-    if (paused_) {
+    if (paused_ && address_manager_registered_) {
       scan_on_resume_ = true;
       return;
     }
@@ -634,14 +641,14 @@
     switch (api_type_) {
       case ScanApiType::EXTENDED:
         le_scanning_interface_->EnqueueCommand(
-            hci::LeSetExtendedScanEnableBuilder::Create(
+            LeSetExtendedScanEnableBuilder::Create(
                 Enable::ENABLED, FilterDuplicates::DISABLED /* filter duplicates */, 0, 0),
             module_handler_->BindOnce(impl::check_status));
         break;
       case ScanApiType::ANDROID_HCI:
       case ScanApiType::LEGACY:
         le_scanning_interface_->EnqueueCommand(
-            hci::LeSetScanEnableBuilder::Create(Enable::ENABLED, Enable::DISABLED /* filter duplicates */),
+            LeSetScanEnableBuilder::Create(Enable::ENABLED, Enable::DISABLED /* filter duplicates */),
             module_handler_->BindOnce(impl::check_status));
         break;
     }
@@ -657,14 +664,14 @@
     switch (api_type_) {
       case ScanApiType::EXTENDED:
         le_scanning_interface_->EnqueueCommand(
-            hci::LeSetExtendedScanEnableBuilder::Create(
+            LeSetExtendedScanEnableBuilder::Create(
                 Enable::DISABLED, FilterDuplicates::DISABLED /* filter duplicates */, 0, 0),
             module_handler_->BindOnce(impl::check_status));
         break;
       case ScanApiType::ANDROID_HCI:
       case ScanApiType::LEGACY:
         le_scanning_interface_->EnqueueCommand(
-            hci::LeSetScanEnableBuilder::Create(Enable::DISABLED, Enable::DISABLED /* filter duplicates */),
+            LeSetScanEnableBuilder::Create(Enable::DISABLED, Enable::DISABLED /* filter duplicates */),
             module_handler_->BindOnce(impl::check_status));
         break;
     }
@@ -703,7 +710,7 @@
   }
 
   void scan_filter_enable(bool enable) {
-    if (!is_filter_support_) {
+    if (!is_filter_supported_) {
       LOG_WARN("Advertising filter is not supported");
       return;
     }
@@ -727,7 +734,7 @@
 
   void scan_filter_parameter_setup(
       ApcfAction action, uint8_t filter_index, AdvertisingFilterParameter advertising_filter_parameter) {
-    if (!is_filter_support_) {
+    if (!is_filter_supported_) {
       LOG_WARN("Advertising filter is not supported");
       return;
     }
@@ -790,7 +797,7 @@
   }
 
   void scan_filter_add(uint8_t filter_index, std::vector<AdvertisingPacketContentFilterCommand> filters) {
-    if (!is_filter_support_) {
+    if (!is_filter_supported_) {
       LOG_WARN("Advertising filter is not supported");
       return;
     }
@@ -826,6 +833,10 @@
           update_service_data_filter(apcf_action, filter_index, filter.data, filter.data_mask);
           break;
         }
+        case ApcfFilterType::AD_TYPE: {
+          update_ad_type_filter(apcf_action, filter_index, filter.ad_type, filter.data, filter.data_mask);
+          break;
+        }
         default:
           LOG_ERROR("Unknown filter type: %d", (uint16_t)filter.filter_type);
           break;
@@ -1016,12 +1027,42 @@
         module_handler_->BindOnceOn(this, &impl::on_advertising_filter_complete));
   }
 
+  void update_ad_type_filter(
+      ApcfAction action,
+      uint8_t filter_index,
+      uint8_t ad_type,
+      std::vector<uint8_t> data,
+      std::vector<uint8_t> data_mask) {
+    if (!is_ad_type_filter_supported_) {
+      LOG_ERROR("AD type filter isn't supported");
+      return;
+    }
+
+    if (data.size() != data_mask.size()) {
+      LOG_ERROR("ad type mask should have the same length as ad type data");
+      return;
+    }
+    std::vector<uint8_t> combined_data = {};
+    if (action != ApcfAction::CLEAR) {
+      combined_data.push_back((uint8_t)ad_type);
+      combined_data.push_back((uint8_t)(data.size()));
+      if (data.size() != 0) {
+        combined_data.insert(combined_data.end(), data.begin(), data.end());
+        combined_data.insert(combined_data.end(), data_mask.begin(), data_mask.end());
+      }
+    }
+
+    le_scanning_interface_->EnqueueCommand(
+        LeAdvFilterADTypeBuilder::Create(action, filter_index, combined_data),
+        module_handler_->BindOnceOn(this, &impl::on_advertising_filter_complete));
+  }
+
   void batch_scan_set_storage_parameter(
       uint8_t batch_scan_full_max,
       uint8_t batch_scan_truncated_max,
       uint8_t batch_scan_notify_threshold,
       ScannerId scanner_id) {
-    if (!is_batch_scan_support_) {
+    if (!is_batch_scan_supported_) {
       LOG_WARN("Batch scan is not supported");
       return;
     }
@@ -1048,7 +1089,7 @@
       uint32_t duty_cycle_scan_window_slots,
       uint32_t duty_cycle_scan_interval_slots,
       BatchScanDiscardRule batch_scan_discard_rule) {
-    if (!is_batch_scan_support_) {
+    if (!is_batch_scan_supported_) {
       LOG_WARN("Batch scan is not supported");
       return;
     }
@@ -1072,7 +1113,7 @@
   }
 
   void batch_scan_disable() {
-    if (!is_batch_scan_support_) {
+    if (!is_batch_scan_supported_) {
       LOG_WARN("Batch scan is not supported");
       return;
     }
@@ -1089,7 +1130,7 @@
       uint32_t duty_cycle_scan_window_slots,
       uint32_t duty_cycle_scan_interval_slots,
       BatchScanDiscardRule batch_scan_discard_rule) {
-    if (!is_batch_scan_support_) {
+    if (!is_batch_scan_supported_) {
       LOG_WARN("Batch scan is not supported");
       return;
     }
@@ -1131,7 +1172,7 @@
   }
 
   void batch_scan_read_results(ScannerId scanner_id, uint16_t total_num_of_records, BatchScanMode scan_mode) {
-    if (!is_batch_scan_support_) {
+    if (!is_batch_scan_supported_) {
       LOG_WARN("Batch scan is not supported");
       int status = static_cast<int>(ErrorCode::UNSUPPORTED_FEATURE_OR_PARAMETER_VALUE);
       scanning_callbacks_->OnBatchScanReports(scanner_id, status, 0, 0, {});
@@ -1157,7 +1198,7 @@
 
   void start_sync(
       uint8_t sid, const AddressWithType& address_with_type, uint16_t skip, uint16_t timeout, int request_id) {
-    if (!is_periodic_advertising_sync_transfer_sender_support_) {
+    if (!is_periodic_advertising_sync_transfer_sender_supported_) {
       LOG_WARN("PAST sender not supported on this device");
       int status = static_cast<int>(ErrorCode::UNSUPPORTED_FEATURE_OR_PARAMETER_VALUE);
       scanning_callbacks_->OnPeriodicSyncStarted(request_id, status, -1, sid, address_with_type, 0, 0);
@@ -1174,7 +1215,7 @@
   }
 
   void stop_sync(uint16_t handle) {
-    if (!is_periodic_advertising_sync_transfer_sender_support_) {
+    if (!is_periodic_advertising_sync_transfer_sender_supported_) {
       LOG_WARN("PAST sender not supported on this device");
       return;
     }
@@ -1182,7 +1223,7 @@
   }
 
   void cancel_create_sync(uint8_t sid, const Address& address) {
-    if (!is_periodic_advertising_sync_transfer_sender_support_) {
+    if (!is_periodic_advertising_sync_transfer_sender_supported_) {
       LOG_WARN("PAST sender not supported on this device");
       return;
     }
@@ -1190,7 +1231,7 @@
   }
 
   void transfer_sync(const Address& address, uint16_t service_data, uint16_t sync_handle, int pa_source) {
-    if (!is_periodic_advertising_sync_transfer_sender_support_) {
+    if (!is_periodic_advertising_sync_transfer_sender_supported_) {
       LOG_WARN("PAST sender not supported on this device");
       int status = static_cast<int>(ErrorCode::UNSUPPORTED_FEATURE_OR_PARAMETER_VALUE);
       scanning_callbacks_->OnPeriodicSyncTransferred(pa_source, status, address);
@@ -1207,7 +1248,7 @@
   }
 
   void transfer_set_info(const Address& address, uint16_t service_data, uint8_t adv_handle, int pa_source) {
-    if (!is_periodic_advertising_sync_transfer_sender_support_) {
+    if (!is_periodic_advertising_sync_transfer_sender_supported_) {
       LOG_WARN("PAST sender not supported on this device");
       int status = static_cast<int>(ErrorCode::UNSUPPORTED_FEATURE_OR_PARAMETER_VALUE);
       scanning_callbacks_->OnPeriodicSyncTransferred(pa_source, status, address);
@@ -1224,7 +1265,7 @@
   }
 
   void sync_tx_parameters(const Address& address, uint8_t mode, uint16_t skip, uint16_t timeout, int reg_id) {
-    if (!is_periodic_advertising_sync_transfer_sender_support_) {
+    if (!is_periodic_advertising_sync_transfer_sender_supported_) {
       LOG_WARN("PAST sender not supported on this device");
       int status = static_cast<int>(ErrorCode::UNSUPPORTED_FEATURE_OR_PARAMETER_VALUE);
       AddressWithType address_with_type(address, AddressType::RANDOM_DEVICE_ADDRESS);
@@ -1258,6 +1299,10 @@
     periodic_sync_manager_.SetScanningCallback(scanning_callbacks_);
   }
 
+  bool is_ad_type_filter_supported() {
+    return is_ad_type_filter_supported_;
+  }
+
   void on_set_scan_parameter_complete(CommandCompleteView view) {
     switch (view.GetCommandOpCode()) {
       case (OpCode::LE_SET_SCAN_PARAMETERS): {
@@ -1369,11 +1414,40 @@
             complete_view.GetApcfAction(),
             (uint8_t)complete_view.GetStatus());
       } break;
+      case ApcfOpcode::AD_TYPE: {
+        auto complete_view = LeAdvFilterADTypeCompleteView::Create(status_view);
+        ASSERT(complete_view.IsValid());
+        scanning_callbacks_->OnFilterConfigCallback(
+            ApcfFilterType::AD_TYPE,
+            complete_view.GetApcfAvailableSpaces(),
+            complete_view.GetApcfAction(),
+            (uint8_t)complete_view.GetStatus());
+      } break;
       default:
         LOG_WARN("Unexpected event type %s", OpCodeText(view.GetCommandOpCode()).c_str());
     }
   }
 
+  void on_apcf_read_extended_features_complete(CommandCompleteView view) {
+    ASSERT(view.IsValid());
+    auto status_view = LeAdvFilterCompleteView::Create(view);
+    if (!status_view.IsValid()) {
+      LOG_WARN("Can not get valid LeAdvFilterCompleteView, return");
+      return;
+    }
+    if (status_view.GetStatus() != ErrorCode::SUCCESS) {
+      LOG_WARN(
+          "Got a Command complete %s, status %s",
+          OpCodeText(view.GetCommandOpCode()).c_str(),
+          ErrorCodeText(status_view.GetStatus()).c_str());
+      return;
+    }
+    auto complete_view = LeAdvFilterReadExtendedFeaturesCompleteView::Create(status_view);
+    ASSERT(complete_view.IsValid());
+    is_ad_type_filter_supported_ = complete_view.GetAdTypeFilter() == 1;
+    LOG_INFO("set is_ad_type_filter_supported_ to %d", is_ad_type_filter_supported_);
+  }
+
   void on_batch_scan_complete(CommandCompleteView view) {
     ASSERT(view.IsValid());
     auto status_view = LeBatchScanCompleteView::Create(view);
@@ -1478,6 +1552,10 @@
   }
 
   void OnPause() override {
+    if (!address_manager_registered_) {
+      LOG_WARN("Unregistered!");
+      return;
+    }
     paused_ = true;
     scan_on_resume_ = is_scanning_;
     stop_scan();
@@ -1489,6 +1567,10 @@
   }
 
   void OnResume() override {
+    if (!address_manager_registered_) {
+      LOG_WARN("Unregistered!");
+      return;
+    }
     paused_ = false;
     if (scan_on_resume_ == true) {
       start_scan();
@@ -1500,13 +1582,13 @@
 
   Module* module_;
   os::Handler* module_handler_;
-  hci::HciLayer* hci_layer_;
-  hci::Controller* controller_;
-  hci::AclManager* acl_manager_;
-  hci::VendorSpecificEventManager* vendor_specific_event_manager_;
+  HciLayer* hci_layer_;
+  Controller* controller_;
+  AclManager* acl_manager_;
+  VendorSpecificEventManager* vendor_specific_event_manager_;
   storage::StorageModule* storage_module_;
-  hci::LeScanningInterface* le_scanning_interface_;
-  hci::LeAddressManager* le_address_manager_;
+  LeScanningInterface* le_scanning_interface_;
+  LeAddressManager* le_address_manager_;
   bool address_manager_registered_ = false;
   NullScanningCallback null_scanning_callback_;
   ScanningCallback* scanning_callbacks_ = &null_scanning_callback_;
@@ -1516,9 +1598,10 @@
   bool scan_on_resume_ = false;
   bool paused_ = false;
   AdvertisingCache advertising_cache_;
-  bool is_filter_support_ = false;
-  bool is_batch_scan_support_ = false;
-  bool is_periodic_advertising_sync_transfer_sender_support_ = false;
+  bool is_filter_supported_ = false;
+  bool is_ad_type_filter_supported_ = false;
+  bool is_batch_scan_supported_ = false;
+  bool is_periodic_advertising_sync_transfer_sender_supported_ = false;
 
   LeScanType le_scan_type_ = LeScanType::ACTIVE;
   uint32_t interval_ms_{1000};
@@ -1559,18 +1642,18 @@
 }
 
 void LeScanningManager::ListDependencies(ModuleList* list) const {
-  list->add<hci::HciLayer>();
-  list->add<hci::VendorSpecificEventManager>();
-  list->add<hci::Controller>();
-  list->add<hci::AclManager>();
+  list->add<HciLayer>();
+  list->add<VendorSpecificEventManager>();
+  list->add<Controller>();
+  list->add<AclManager>();
   list->add<storage::StorageModule>();
 }
 
 void LeScanningManager::Start() {
   pimpl_->start(
       GetHandler(),
-      GetDependency<hci::HciLayer>(),
-      GetDependency<hci::Controller>(),
+      GetDependency<HciLayer>(),
+      GetDependency<Controller>(),
       GetDependency<AclManager>(),
       GetDependency<VendorSpecificEventManager>(),
       GetDependency<storage::StorageModule>());
@@ -1688,5 +1771,9 @@
   CallOn(pimpl_.get(), &impl::register_scanning_callback, scanning_callback);
 }
 
+bool LeScanningManager::IsAdTypeFilterSupported() const {
+  return pimpl_->is_ad_type_filter_supported();
+}
+
 }  // namespace hci
 }  // namespace bluetooth
diff --git a/system/gd/hci/le_scanning_manager.h b/system/gd/hci/le_scanning_manager.h
index d1288e1..a7da113 100644
--- a/system/gd/hci/le_scanning_manager.h
+++ b/system/gd/hci/le_scanning_manager.h
@@ -92,6 +92,8 @@
 
   virtual void RegisterScanningCallback(ScanningCallback* scanning_callback);
 
+  virtual bool IsAdTypeFilterSupported() const;
+
   static const ModuleFactory Factory;
 
  protected:
diff --git a/system/gd/hci/le_scanning_manager_test.cc b/system/gd/hci/le_scanning_manager_test.cc
index bcf0c02..e59c725 100644
--- a/system/gd/hci/le_scanning_manager_test.cc
+++ b/system/gd/hci/le_scanning_manager_test.cc
@@ -14,39 +14,102 @@
  * limitations under the License.
  */
 
+#include "hci/le_scanning_manager.h"
+
 #include <gmock/gmock.h>
 #include <gtest/gtest.h>
 
 #include <algorithm>
 #include <chrono>
 #include <future>
+#include <list>
 #include <map>
+#include <memory>
+#include <mutex>
+#include <queue>
+#include <vector>
 
+#include "hci/hci_layer_fake.h"
 #include "common/bind.h"
 #include "hci/acl_manager.h"
 #include "hci/address.h"
 #include "hci/controller.h"
 #include "hci/hci_layer.h"
-#include "hci/le_scanning_manager.h"
+#include "hci/uuid.h"
 #include "os/thread.h"
 #include "packet/raw_builder.h"
 
-namespace bluetooth {
-namespace hci {
-namespace {
+using ::testing::_;
+using ::testing::Eq;
+
+using namespace bluetooth;
+using namespace std::chrono_literals;
 
 using packet::kLittleEndian;
 using packet::PacketView;
 using packet::RawBuilder;
 
-PacketView<kLittleEndian> GetPacketView(std::unique_ptr<packet::BasePacketBuilder> packet) {
-  auto bytes = std::make_shared<std::vector<uint8_t>>();
-  BitInserter i(*bytes);
-  bytes->reserve(packet->size());
-  packet->Serialize(i);
-  return packet::PacketView<packet::kLittleEndian>(bytes);
+namespace {
+
+hci::AdvertisingPacketContentFilterCommand make_filter(const hci::ApcfFilterType& filter_type) {
+  hci::AdvertisingPacketContentFilterCommand filter{};
+  filter.filter_type = filter_type;
+
+  switch (filter_type) {
+    case hci::ApcfFilterType::AD_TYPE:
+    case hci::ApcfFilterType::SERVICE_DATA:
+      filter.ad_type = 0x09;
+      filter.data = {0x12, 0x34, 0x56, 0x78};
+      filter.data_mask = {0xff, 0xff, 0xff, 0xff};
+      break;
+    case hci::ApcfFilterType::BROADCASTER_ADDRESS:
+      filter.address = hci::Address::kEmpty;
+      filter.application_address_type = hci::ApcfApplicationAddressType::RANDOM;
+      break;
+    case hci::ApcfFilterType::SERVICE_UUID:
+      filter.uuid = hci::Uuid::From32Bit(0x12345678);
+      filter.uuid_mask = hci::Uuid::From32Bit(0xffffffff);
+      break;
+    case hci::ApcfFilterType::LOCAL_NAME:
+      filter.name = {0x01, 0x02, 0x03};
+      break;
+    case hci::ApcfFilterType::MANUFACTURER_DATA:
+      filter.company = 0x12;
+      filter.company_mask = 0xff;
+      filter.data = {0x12, 0x34, 0x56, 0x78};
+      filter.data_mask = {0xff, 0xff, 0xff, 0xff};
+      break;
+    default:
+      break;
+  }
+  return filter;
 }
 
+hci::LeAdvertisingResponse make_advertising_report() {
+  hci::LeAdvertisingResponse report{};
+  report.event_type_ = hci::AdvertisingEventType::ADV_DIRECT_IND;
+  report.address_type_ = hci::AddressType::PUBLIC_DEVICE_ADDRESS;
+  hci::Address::FromString("12:34:56:78:9a:bc", report.address_);
+  std::vector<hci::LengthAndData> adv_data{};
+  hci::LengthAndData data_item{};
+  data_item.data_.push_back(static_cast<uint8_t>(hci::GapDataType::FLAGS));
+  data_item.data_.push_back(0x34);
+  adv_data.push_back(data_item);
+  data_item.data_.push_back(static_cast<uint8_t>(hci::GapDataType::COMPLETE_LOCAL_NAME));
+  for (auto octet : {'r', 'a', 'n', 'd', 'o', 'm', ' ', 'd', 'e', 'v', 'i', 'c', 'e'}) {
+    data_item.data_.push_back(octet);
+  }
+  adv_data.push_back(data_item);
+  report.advertising_data_ = adv_data;
+  return report;
+}
+
+}  // namespace
+
+namespace bluetooth {
+namespace hci {
+namespace {
+
 class TestController : public Controller {
  public:
   bool IsSupported(OpCode op_code) const override {
@@ -57,133 +120,22 @@
     supported_opcodes_.insert(op_code);
   }
 
+  bool SupportsBleExtendedAdvertising() const override {
+    return support_ble_extended_advertising_;
+  }
+
+  void SetBleExtendedAdvertisingSupport(bool support) {
+    support_ble_extended_advertising_ = support;
+  }
+
  protected:
   void Start() override {}
   void Stop() override {}
-  void ListDependencies(ModuleList* list) override {}
+  void ListDependencies(ModuleList* list) const {}
 
  private:
   std::set<OpCode> supported_opcodes_{};
-};
-
-class TestHciLayer : public HciLayer {
- public:
-  void EnqueueCommand(
-      std::unique_ptr<CommandBuilder> command,
-      common::ContextualOnceCallback<void(CommandStatusView)> on_status) override {
-    command_queue_.push(std::move(command));
-    command_status_callbacks.push_back(std::move(on_status));
-    if (command_promise_ != nullptr) {
-      command_promise_->set_value();
-      command_promise_.reset();
-    }
-  }
-
-  void EnqueueCommand(
-      std::unique_ptr<CommandBuilder> command,
-      common::ContextualOnceCallback<void(CommandCompleteView)> on_complete) override {
-    command_queue_.push(std::move(command));
-    command_complete_callbacks.push_back(std::move(on_complete));
-    if (command_promise_ != nullptr) {
-      command_promise_->set_value();
-      command_promise_.reset();
-    }
-  }
-
-  std::future<void> GetCommandFuture() {
-    ASSERT_LOG(command_promise_ == nullptr, "Promises promises ... Only one at a time");
-    command_promise_ = std::make_unique<std::promise<void>>();
-    return command_promise_->get_future();
-  }
-
-  CommandView GetLastCommand() {
-    if (command_queue_.empty()) {
-      return CommandView::Create(GetPacketView(nullptr));
-    } else {
-      auto last = std::move(command_queue_.front());
-      command_queue_.pop();
-      return CommandView::Create(GetPacketView(std::move(last)));
-    }
-  }
-
-  ConnectionManagementCommandView GetCommand(OpCode op_code) {
-    CommandView command_packet_view = GetLastCommand();
-    auto command = ConnectionManagementCommandView::Create(AclCommandView::Create(command_packet_view));
-    EXPECT_TRUE(command.IsValid());
-    EXPECT_EQ(command.GetOpCode(), op_code);
-    return command;
-  }
-
-  void RegisterEventHandler(EventCode event_code, common::ContextualCallback<void(EventView)> event_handler) override {
-    registered_events_[event_code] = event_handler;
-  }
-
-  void UnregisterEventHandler(EventCode event_code) override {
-    registered_events_.erase(event_code);
-  }
-
-  void RegisterLeEventHandler(SubeventCode subevent_code,
-                              common::ContextualCallback<void(LeMetaEventView)> event_handler) override {
-    registered_le_events_[subevent_code] = event_handler;
-  }
-
-  void UnregisterLeEventHandler(SubeventCode subevent_code) override {
-    registered_le_events_.erase(subevent_code);
-  }
-
-  void IncomingEvent(std::unique_ptr<EventBuilder> event_builder) {
-    auto packet = GetPacketView(std::move(event_builder));
-    EventView event = EventView::Create(packet);
-    ASSERT_TRUE(event.IsValid());
-    EventCode event_code = event.GetEventCode();
-    ASSERT_NE(registered_events_.find(event_code), registered_events_.end()) << EventCodeText(event_code);
-    registered_events_[event_code].Invoke(event);
-  }
-
-  void IncomingLeMetaEvent(std::unique_ptr<LeMetaEventBuilder> event_builder) {
-    auto packet = GetPacketView(std::move(event_builder));
-    EventView event = EventView::Create(packet);
-    LeMetaEventView meta_event_view = LeMetaEventView::Create(event);
-    ASSERT_TRUE(meta_event_view.IsValid());
-    SubeventCode subevent_code = meta_event_view.GetSubeventCode();
-    ASSERT_NE(registered_le_events_.find(subevent_code), registered_le_events_.end())
-        << SubeventCodeText(subevent_code);
-    registered_le_events_[subevent_code].Invoke(meta_event_view);
-  }
-
-  void CommandCompleteCallback(EventView event) {
-    CommandCompleteView complete_view = CommandCompleteView::Create(event);
-    ASSERT_TRUE(complete_view.IsValid());
-    ASSERT_NE(command_complete_callbacks.size(), 0);
-    std::move(command_complete_callbacks.front()).Invoke(complete_view);
-    command_complete_callbacks.pop_front();
-  }
-
-  void CommandStatusCallback(EventView event) {
-    CommandStatusView status_view = CommandStatusView::Create(event);
-    ASSERT_TRUE(status_view.IsValid());
-    ASSERT_NE(command_status_callbacks.size(), 0);
-    std::move(command_status_callbacks.front()).Invoke(status_view);
-    command_status_callbacks.pop_front();
-  }
-
-  void ListDependencies(ModuleList* list) override {}
-  void Start() override {
-    RegisterEventHandler(EventCode::COMMAND_COMPLETE,
-                         GetHandler()->BindOn(this, &TestHciLayer::CommandCompleteCallback));
-    RegisterEventHandler(EventCode::COMMAND_STATUS, GetHandler()->BindOn(this, &TestHciLayer::CommandStatusCallback));
-  }
-  void Stop() override {}
-
- private:
-  std::map<EventCode, common::ContextualCallback<void(EventView)>> registered_events_;
-  std::map<SubeventCode, common::ContextualCallback<void(LeMetaEventView)>> registered_le_events_;
-  std::list<common::ContextualOnceCallback<void(CommandCompleteView)>> command_complete_callbacks;
-  std::list<common::ContextualOnceCallback<void(CommandStatusView)>> command_status_callbacks;
-
-  std::queue<std::unique_ptr<CommandBuilder>> command_queue_;
-  mutable std::mutex mutex_;
-  std::unique_ptr<std::promise<void>> command_promise_{};
+  bool support_ble_extended_advertising_ = false;
 };
 
 class TestLeAddressManager : public LeAddressManager {
@@ -197,10 +149,34 @@
       : LeAddressManager(enqueue_command, handler, public_address, connect_list_size, resolving_list_size) {}
 
   AddressPolicy Register(LeAddressManagerCallback* callback) override {
+    client_ = callback;
+    test_client_state_ = RESUMED;
     return AddressPolicy::USE_STATIC_ADDRESS;
   }
 
-  void Unregister(LeAddressManagerCallback* callback) override {}
+  void Unregister(LeAddressManagerCallback* callback) override {
+    if (!ignore_unregister_for_testing) {
+      client_ = nullptr;
+    }
+    test_client_state_ = UNREGISTERED;
+  }
+
+  void AckPause(LeAddressManagerCallback* callback) override {
+    test_client_state_ = PAUSED;
+  }
+
+  void AckResume(LeAddressManagerCallback* callback) override {
+    test_client_state_ = RESUMED;
+  }
+
+  LeAddressManagerCallback* client_;
+  bool ignore_unregister_for_testing = false;
+  enum TestClientState {
+    UNREGISTERED,
+    PAUSED,
+    RESUMED,
+  };
+  TestClientState test_client_state_ = UNREGISTERED;
 };
 
 class TestAclManager : public AclManager {
@@ -225,64 +201,96 @@
     delete thread_;
   }
 
-  void ListDependencies(ModuleList* list) override {}
+  void ListDependencies(ModuleList* list) const {}
 
   void SetRandomAddress(Address address) {}
 
   void enqueue_command(std::unique_ptr<CommandBuilder> command_packet){};
 
+ private:
   os::Thread* thread_;
   os::Handler* handler_;
   TestLeAddressManager* test_le_address_manager_;
 };
 
+class MockCallbacks : public bluetooth::hci::ScanningCallback {
+ public:
+  MOCK_METHOD(
+      void,
+      OnScannerRegistered,
+      (const bluetooth::hci::Uuid app_uuid, ScannerId scanner_id, ScanningStatus status),
+      (override));
+  MOCK_METHOD(void, OnSetScannerParameterComplete, (ScannerId scanner_id, ScanningStatus status), (override));
+  MOCK_METHOD(
+      void,
+      OnScanResult,
+      (uint16_t event_type,
+       uint8_t address_type,
+       Address address,
+       uint8_t primary_phy,
+       uint8_t secondary_phy,
+       uint8_t advertising_sid,
+       int8_t tx_power,
+       int8_t rssi,
+       uint16_t periodic_advertising_interval,
+       std::vector<uint8_t> advertising_data),
+      (override));
+  MOCK_METHOD(
+      void,
+      OnTrackAdvFoundLost,
+      (bluetooth::hci::AdvertisingFilterOnFoundOnLostInfo on_found_on_lost_info),
+      (override));
+  MOCK_METHOD(
+      void,
+      OnBatchScanReports,
+      (int client_if, int status, int report_format, int num_records, std::vector<uint8_t> data),
+      (override));
+  MOCK_METHOD(void, OnBatchScanThresholdCrossed, (int client_if), (override));
+  MOCK_METHOD(void, OnTimeout, (), (override));
+  MOCK_METHOD(void, OnFilterEnable, (Enable enable, uint8_t status), (override));
+  MOCK_METHOD(void, OnFilterParamSetup, (uint8_t available_spaces, ApcfAction action, uint8_t status), (override));
+  MOCK_METHOD(
+      void,
+      OnFilterConfigCallback,
+      (ApcfFilterType filter_type, uint8_t available_spaces, ApcfAction action, uint8_t status),
+      (override));
+  MOCK_METHOD(void, OnPeriodicSyncStarted, (int, uint8_t, uint16_t, uint8_t, AddressWithType, uint8_t, uint16_t));
+  MOCK_METHOD(void, OnPeriodicSyncReport, (uint16_t, int8_t, int8_t, uint8_t, std::vector<uint8_t>));
+  MOCK_METHOD(void, OnPeriodicSyncLost, (uint16_t));
+  MOCK_METHOD(void, OnPeriodicSyncTransferred, (int, uint8_t, Address));
+} mock_callbacks_;
+
 class LeScanningManagerTest : public ::testing::Test {
  protected:
   void SetUp() override {
     test_hci_layer_ = new TestHciLayer;  // Ownership is transferred to registry
     test_controller_ = new TestController;
-    test_controller_->AddSupported(param_opcode_);
-    if (is_filter_support_) {
-      test_controller_->AddSupported(OpCode::LE_ADV_FILTER);
-    }
-    if (is_batch_scan_support_) {
-      test_controller_->AddSupported(OpCode::LE_BATCH_SCAN);
-    }
     test_acl_manager_ = new TestAclManager;
     fake_registry_.InjectTestModule(&HciLayer::Factory, test_hci_layer_);
     fake_registry_.InjectTestModule(&Controller::Factory, test_controller_);
     fake_registry_.InjectTestModule(&AclManager::Factory, test_acl_manager_);
     client_handler_ = fake_registry_.GetTestModuleHandler(&HciLayer::Factory);
-    std::future<void> config_future = test_hci_layer_->GetCommandFuture();
-    fake_registry_.Start<LeScanningManager>(&thread_);
-    le_scanning_manager =
-        static_cast<LeScanningManager*>(fake_registry_.GetModuleUnderTest(&LeScanningManager::Factory));
-    auto result = config_future.wait_for(std::chrono::duration(std::chrono::milliseconds(1000)));
-    ASSERT_EQ(std::future_status::ready, result);
-    auto packet = test_hci_layer_->GetCommand(enable_opcode_);
-    test_hci_layer_->IncomingEvent(LeSetScanEnableCompleteBuilder::Create(1, ErrorCode::SUCCESS));
-    config_future.wait_for(std::chrono::duration(std::chrono::milliseconds(1000)));
-    ASSERT_EQ(std::future_status::ready, result);
-    HandleConfiguration();
-    le_scanning_manager->RegisterScanningCallback(&mock_callbacks_);
+    ASSERT_TRUE(client_handler_ != nullptr);
   }
 
   void TearDown() override {
-    fake_registry_.SynchronizeModuleHandler(&LeScanningManager::Factory, std::chrono::milliseconds(20));
+    sync_client_handler();
+    if (fake_registry_.IsStarted<LeScanningManager>()) {
+      fake_registry_.SynchronizeModuleHandler(&LeScanningManager::Factory, std::chrono::milliseconds(20));
+    }
     fake_registry_.StopAll();
   }
 
-  virtual void HandleConfiguration() {
-    auto packet = test_hci_layer_->GetCommand(OpCode::LE_SET_SCAN_PARAMETERS);
-    test_hci_layer_->IncomingEvent(LeSetScanParametersCompleteBuilder::Create(1, ErrorCode::SUCCESS));
+  void start_le_scanning_manager() {
+    fake_registry_.Start<LeScanningManager>(&thread_);
+    le_scanning_manager =
+        static_cast<LeScanningManager*>(fake_registry_.GetModuleUnderTest(&LeScanningManager::Factory));
+    le_scanning_manager->RegisterScanningCallback(&mock_callbacks_);
+    sync_client_handler();
   }
 
   void sync_client_handler() {
-    std::promise<void> promise;
-    auto future = promise.get_future();
-    client_handler_->Call(common::BindOnce(&std::promise<void>::set_value, common::Unretained(&promise)));
-    auto future_status = future.wait_for(std::chrono::seconds(1));
-    ASSERT_EQ(future_status, std::future_status::ready);
+    ASSERT(thread_.GetReactor()->WaitForIdle(std::chrono::seconds(2)));
   }
 
   TestModuleRegistry fake_registry_;
@@ -293,267 +301,388 @@
   LeScanningManager* le_scanning_manager = nullptr;
   os::Handler* client_handler_ = nullptr;
 
-  class MockCallbacks : public bluetooth::hci::ScanningCallback {
-   public:
-    MOCK_METHOD(
-        void,
-        OnScannerRegistered,
-        (const bluetooth::hci::Uuid app_uuid, ScannerId scanner_id, ScanningStatus status),
-        (override));
-    MOCK_METHOD(void, OnSetScannerParameterComplete, (ScannerId scanner_id, ScanningStatus status), (override));
-    MOCK_METHOD(
-        void,
-        OnScanResult,
-        (uint16_t event_type,
-         uint8_t address_type,
-         Address address,
-         uint8_t primary_phy,
-         uint8_t secondary_phy,
-         uint8_t advertising_sid,
-         int8_t tx_power,
-         int8_t rssi,
-         uint16_t periodic_advertising_interval,
-         std::vector<uint8_t> advertising_data),
-        (override));
-    MOCK_METHOD(
-        void,
-        OnTrackAdvFoundLost,
-        (bluetooth::hci::AdvertisingFilterOnFoundOnLostInfo on_found_on_lost_info),
-        (override));
-    MOCK_METHOD(
-        void,
-        OnBatchScanReports,
-        (int client_if, int status, int report_format, int num_records, std::vector<uint8_t> data),
-        (override));
-    MOCK_METHOD(void, OnBatchScanThresholdCrossed, (int client_if), (override));
-    MOCK_METHOD(void, OnTimeout, (), (override));
-    MOCK_METHOD(void, OnFilterEnable, (Enable enable, uint8_t status), (override));
-    MOCK_METHOD(void, OnFilterParamSetup, (uint8_t available_spaces, ApcfAction action, uint8_t status), (override));
-    MOCK_METHOD(
-        void,
-        OnFilterConfigCallback,
-        (ApcfFilterType filter_type, uint8_t available_spaces, ApcfAction action, uint8_t status),
-        (override));
-  } mock_callbacks_;
-
-  OpCode param_opcode_{OpCode::LE_SET_ADVERTISING_PARAMETERS};
-  OpCode enable_opcode_{OpCode::LE_SET_SCAN_ENABLE};
-  bool is_filter_support_ = false;
-  bool is_batch_scan_support_ = false;
+  MockCallbacks mock_callbacks_;
 };
 
-class LeAndroidHciScanningManagerTest : public LeScanningManagerTest {
+class LeScanningManagerAndroidHciTest : public LeScanningManagerTest {
  protected:
   void SetUp() override {
-    param_opcode_ = OpCode::LE_EXTENDED_SCAN_PARAMS;
-    is_filter_support_ = true;
-    is_batch_scan_support_ = true;
     LeScanningManagerTest::SetUp();
+    test_controller_->AddSupported(OpCode::LE_EXTENDED_SCAN_PARAMS);
     test_controller_->AddSupported(OpCode::LE_ADV_FILTER);
+    test_controller_->AddSupported(OpCode::LE_BATCH_SCAN);
+    start_le_scanning_manager();
+    ASSERT_TRUE(fake_registry_.IsStarted(&HciLayer::Factory));
+
+    ASSERT_EQ(OpCode::LE_ADV_FILTER, test_hci_layer_->GetCommand().GetOpCode());
+    test_hci_layer_->IncomingEvent(LeAdvFilterReadExtendedFeaturesCompleteBuilder::Create(1, ErrorCode::SUCCESS, 0x01));
+
+    // Get the command a second time as the configure_scan is called twice in le_scanning_manager.cc
+    // Fixed on aosp/2242078 but not present on older branches
+    EXPECT_EQ(OpCode::LE_EXTENDED_SCAN_PARAMS, test_hci_layer_->GetCommand().GetOpCode());
+    test_hci_layer_->IncomingEvent(LeExtendedScanParamsCompleteBuilder::Create(uint8_t{1}, ErrorCode::SUCCESS));
   }
 
-  void HandleConfiguration() override {
-    auto packet = test_hci_layer_->GetCommand(OpCode::LE_EXTENDED_SCAN_PARAMS);
-    test_hci_layer_->IncomingEvent(LeExtendedScanParamsCompleteBuilder::Create(1, ErrorCode::SUCCESS));
+  void TearDown() override {
+    LeScanningManagerTest::TearDown();
   }
 };
 
-class LeExtendedScanningManagerTest : public LeScanningManagerTest {
+class LeScanningManagerExtendedTest : public LeScanningManagerTest {
  protected:
   void SetUp() override {
-    param_opcode_ = OpCode::LE_SET_EXTENDED_SCAN_PARAMETERS;
-    enable_opcode_ = OpCode::LE_SET_EXTENDED_SCAN_ENABLE;
     LeScanningManagerTest::SetUp();
-  }
-
-  void HandleConfiguration() override {
-    auto packet = test_hci_layer_->GetCommand(OpCode::LE_SET_EXTENDED_SCAN_PARAMETERS);
-    test_hci_layer_->IncomingEvent(LeSetExtendedScanParametersCompleteBuilder::Create(1, ErrorCode::SUCCESS));
+    test_controller_->AddSupported(OpCode::LE_SET_EXTENDED_SCAN_PARAMETERS);
+    test_controller_->AddSupported(OpCode::LE_SET_EXTENDED_SCAN_ENABLE);
+    test_controller_->SetBleExtendedAdvertisingSupport(true);
+    start_le_scanning_manager();
+    // Get the command a second time as the configure_scan is called twice in le_scanning_manager.cc
+    // Fixed on aosp/2242078 but not present on older branches
+    EXPECT_EQ(OpCode::LE_SET_EXTENDED_SCAN_PARAMETERS, test_hci_layer_->GetCommand().GetOpCode());
+    test_hci_layer_->IncomingEvent(LeSetExtendedScanParametersCompleteBuilder::Create(uint8_t{1}, ErrorCode::SUCCESS));
   }
 };
 
 TEST_F(LeScanningManagerTest, startup_teardown) {}
 
 TEST_F(LeScanningManagerTest, start_scan_test) {
-  auto next_command_future = test_hci_layer_->GetCommandFuture();
-  le_scanning_manager->Scan(true);
+  start_le_scanning_manager();
 
-  auto result = next_command_future.wait_for(std::chrono::duration(std::chrono::milliseconds(100)));
-  ASSERT_EQ(std::future_status::ready, result);
+  // Get the command a second time as the configure_scan is called twice in le_scanning_manager.cc
+  // Fixed on aosp/2242078 but not present on older branches
+  EXPECT_EQ(OpCode::LE_SET_SCAN_PARAMETERS, test_hci_layer_->GetCommand().GetOpCode());
+  test_hci_layer_->IncomingEvent(LeSetScanParametersCompleteBuilder::Create(uint8_t{1}, ErrorCode::SUCCESS));
+
+  // Enable scan
+  le_scanning_manager->Scan(true);
+  EXPECT_EQ(OpCode::LE_SET_SCAN_PARAMETERS, test_hci_layer_->GetCommand().GetOpCode());
+  test_hci_layer_->IncomingEvent(LeSetScanParametersCompleteBuilder::Create(uint8_t{1}, ErrorCode::SUCCESS));
+
+  EXPECT_EQ(OpCode::LE_SET_SCAN_ENABLE, test_hci_layer_->GetCommand().GetOpCode());
   test_hci_layer_->IncomingEvent(LeSetScanEnableCompleteBuilder::Create(uint8_t{1}, ErrorCode::SUCCESS));
 
-  LeAdvertisingResponse report{};
-  report.event_type_ = AdvertisingEventType::ADV_DIRECT_IND;
-  report.address_type_ = AddressType::PUBLIC_DEVICE_ADDRESS;
-  Address::FromString("12:34:56:78:9a:bc", report.address_);
-  std::vector<GapData> gap_data{};
-  GapData data_item{};
-  data_item.data_type_ = GapDataType::FLAGS;
-  data_item.data_ = {0x34};
-  gap_data.push_back(data_item);
-  data_item.data_type_ = GapDataType::COMPLETE_LOCAL_NAME;
-  data_item.data_ = {'r', 'a', 'n', 'd', 'o', 'm', ' ', 'd', 'e', 'v', 'i', 'c', 'e'};
-  gap_data.push_back(data_item);
-  report.advertising_data_ = gap_data;
+  LeAdvertisingResponse report = make_advertising_report();
+  EXPECT_CALL(mock_callbacks_, OnScanResult);
+
+  test_hci_layer_->IncomingLeMetaEvent(LeAdvertisingReportBuilder::Create({report}));
+}
+
+TEST_F(LeScanningManagerTest, is_ad_type_filter_supported_false_test) {
+  start_le_scanning_manager();
+  ASSERT_TRUE(fake_registry_.IsStarted(&HciLayer::Factory));
+  ASSERT_FALSE(le_scanning_manager->IsAdTypeFilterSupported());
+}
+
+TEST_F(LeScanningManagerTest, scan_filter_add_ad_type_not_supported_test) {
+  start_le_scanning_manager();
+  ASSERT_TRUE(fake_registry_.IsStarted(&HciLayer::Factory));
+
+  std::vector<AdvertisingPacketContentFilterCommand> filters = {};
+  filters.push_back(make_filter(hci::ApcfFilterType::AD_TYPE));
+  le_scanning_manager->ScanFilterAdd(0x01, filters);
+}
+
+TEST_F(LeScanningManagerAndroidHciTest, startup_teardown) {}
+
+TEST_F(LeScanningManagerAndroidHciTest, start_scan_test) {
+  // Enable scan
+  le_scanning_manager->Scan(true);
+  ASSERT_EQ(OpCode::LE_EXTENDED_SCAN_PARAMS, test_hci_layer_->GetCommand().GetOpCode());
+
+  LeAdvertisingResponse report = make_advertising_report();
 
   EXPECT_CALL(mock_callbacks_, OnScanResult);
 
   test_hci_layer_->IncomingLeMetaEvent(LeAdvertisingReportBuilder::Create({report}));
 }
 
-TEST_F(LeAndroidHciScanningManagerTest, start_scan_test) {
-  auto next_command_future = test_hci_layer_->GetCommandFuture();
-  le_scanning_manager->Scan(true);
-
-  auto result = next_command_future.wait_for(std::chrono::duration(std::chrono::milliseconds(100)));
-  ASSERT_EQ(std::future_status::ready, result);
-  test_hci_layer_->IncomingEvent(LeSetScanEnableCompleteBuilder::Create(uint8_t{1}, ErrorCode::SUCCESS));
-
-  LeAdvertisingResponse report{};
-  report.event_type_ = AdvertisingEventType::ADV_DIRECT_IND;
-  report.address_type_ = AddressType::PUBLIC_DEVICE_ADDRESS;
-  Address::FromString("12:34:56:78:9a:bc", report.address_);
-  std::vector<GapData> gap_data{};
-  GapData data_item{};
-  data_item.data_type_ = GapDataType::FLAGS;
-  data_item.data_ = {0x34};
-  gap_data.push_back(data_item);
-  data_item.data_type_ = GapDataType::COMPLETE_LOCAL_NAME;
-  data_item.data_ = {'r', 'a', 'n', 'd', 'o', 'm', ' ', 'd', 'e', 'v', 'i', 'c', 'e'};
-  gap_data.push_back(data_item);
-  report.advertising_data_ = gap_data;
-
-  EXPECT_CALL(mock_callbacks_, OnScanResult);
-
-  test_hci_layer_->IncomingLeMetaEvent(LeAdvertisingReportBuilder::Create({report}));
+TEST_F(LeScanningManagerAndroidHciTest, is_ad_type_filter_supported_true_test) {
+  sync_client_handler();
+  client_handler_->Post(common::BindOnce(
+      [](LeScanningManager* le_scanning_manager) { ASSERT_TRUE(le_scanning_manager->IsAdTypeFilterSupported()); },
+      le_scanning_manager));
 }
 
-TEST_F(LeAndroidHciScanningManagerTest, scan_filter_enable_test) {
-  auto next_command_future = test_hci_layer_->GetCommandFuture();
+TEST_F(LeScanningManagerAndroidHciTest, scan_filter_enable_test) {
   le_scanning_manager->ScanFilterEnable(true);
-  auto result = next_command_future.wait_for(std::chrono::duration(std::chrono::milliseconds(100)));
-  ASSERT_EQ(std::future_status::ready, result);
+  sync_client_handler();
+
   EXPECT_CALL(mock_callbacks_, OnFilterEnable);
   test_hci_layer_->IncomingEvent(
       LeAdvFilterEnableCompleteBuilder::Create(uint8_t{1}, ErrorCode::SUCCESS, Enable::ENABLED));
   sync_client_handler();
 }
 
-TEST_F(LeAndroidHciScanningManagerTest, scan_filter_parameter_test) {
-  auto next_command_future = test_hci_layer_->GetCommandFuture();
+TEST_F(LeScanningManagerAndroidHciTest, scan_filter_parameter_test) {
+
   AdvertisingFilterParameter advertising_filter_parameter{};
   advertising_filter_parameter.delivery_mode = DeliveryMode::IMMEDIATE;
   le_scanning_manager->ScanFilterParameterSetup(ApcfAction::ADD, 0x01, advertising_filter_parameter);
-  auto result = next_command_future.wait_for(std::chrono::duration(std::chrono::milliseconds(100)));
-  ASSERT_EQ(std::future_status::ready, result);
+  auto commandView = test_hci_layer_->GetCommand();
+  ASSERT_EQ(OpCode::LE_ADV_FILTER, commandView.GetOpCode());
+  auto filter_command_view = LeAdvFilterSetFilteringParametersView::Create(
+      LeAdvFilterView::Create(LeScanningCommandView::Create(commandView)));
+  ASSERT_TRUE(filter_command_view.IsValid());
+  ASSERT_EQ(filter_command_view.GetApcfOpcode(), ApcfOpcode::SET_FILTERING_PARAMETERS);
+
   EXPECT_CALL(mock_callbacks_, OnFilterParamSetup);
   test_hci_layer_->IncomingEvent(
       LeAdvFilterSetFilteringParametersCompleteBuilder::Create(uint8_t{1}, ErrorCode::SUCCESS, ApcfAction::ADD, 0x0a));
   sync_client_handler();
 }
 
-TEST_F(LeAndroidHciScanningManagerTest, scan_filter_add_test) {
-  auto next_command_future = test_hci_layer_->GetCommandFuture();
+TEST_F(LeScanningManagerAndroidHciTest, scan_filter_add_broadcaster_address_test) {
+
   std::vector<AdvertisingPacketContentFilterCommand> filters = {};
-  AdvertisingPacketContentFilterCommand filter{};
-  filter.filter_type = ApcfFilterType::BROADCASTER_ADDRESS;
-  filter.address = Address::kEmpty;
-  filter.application_address_type = ApcfApplicationAddressType::RANDOM;
-  filters.push_back(filter);
+  filters.push_back(make_filter(ApcfFilterType::BROADCASTER_ADDRESS));
   le_scanning_manager->ScanFilterAdd(0x01, filters);
+  auto commandView = test_hci_layer_->GetCommand();
+  ASSERT_EQ(OpCode::LE_ADV_FILTER, commandView.GetOpCode());
+  auto filter_command_view =
+      LeAdvFilterBroadcasterAddressView::Create(LeAdvFilterView::Create(LeScanningCommandView::Create(commandView)));
+  ASSERT_TRUE(filter_command_view.IsValid());
+  ASSERT_EQ(filter_command_view.GetApcfOpcode(), ApcfOpcode::BROADCASTER_ADDRESS);
+
   EXPECT_CALL(mock_callbacks_, OnFilterConfigCallback);
-  auto result = next_command_future.wait_for(std::chrono::duration(std::chrono::milliseconds(100)));
-  ASSERT_EQ(std::future_status::ready, result);
   test_hci_layer_->IncomingEvent(
       LeAdvFilterBroadcasterAddressCompleteBuilder::Create(uint8_t{1}, ErrorCode::SUCCESS, ApcfAction::ADD, 0x0a));
-  sync_client_handler();
 }
 
-TEST_F(LeAndroidHciScanningManagerTest, read_batch_scan_result) {
-  // Enable batch scan feature
-  auto next_command_future = test_hci_layer_->GetCommandFuture();
+TEST_F(LeScanningManagerAndroidHciTest, scan_filter_add_service_uuid_test) {
+
+  std::vector<AdvertisingPacketContentFilterCommand> filters = {};
+  filters.push_back(make_filter(ApcfFilterType::SERVICE_UUID));
+  le_scanning_manager->ScanFilterAdd(0x01, filters);
+  auto commandView = test_hci_layer_->GetCommand();
+  ASSERT_EQ(OpCode::LE_ADV_FILTER, commandView.GetOpCode());
+  auto filter_command_view =
+      LeAdvFilterServiceUuidView::Create(LeAdvFilterView::Create(LeScanningCommandView::Create(commandView)));
+  ASSERT_TRUE(filter_command_view.IsValid());
+  ASSERT_EQ(filter_command_view.GetApcfOpcode(), ApcfOpcode::SERVICE_UUID);
+
+  EXPECT_CALL(mock_callbacks_, OnFilterConfigCallback);
+  test_hci_layer_->IncomingEvent(
+      LeAdvFilterServiceUuidCompleteBuilder::Create(uint8_t{1}, ErrorCode::SUCCESS, ApcfAction::ADD, 0x0a));
+}
+
+TEST_F(LeScanningManagerAndroidHciTest, scan_filter_add_local_name_test) {
+
+  std::vector<AdvertisingPacketContentFilterCommand> filters = {};
+  filters.push_back(make_filter(ApcfFilterType::LOCAL_NAME));
+  le_scanning_manager->ScanFilterAdd(0x01, filters);
+  auto commandView = test_hci_layer_->GetCommand();
+  ASSERT_EQ(OpCode::LE_ADV_FILTER, commandView.GetOpCode());
+  auto filter_command_view =
+      LeAdvFilterLocalNameView::Create(LeAdvFilterView::Create(LeScanningCommandView::Create(commandView)));
+  ASSERT_TRUE(filter_command_view.IsValid());
+  ASSERT_EQ(filter_command_view.GetApcfOpcode(), ApcfOpcode::LOCAL_NAME);
+
+  EXPECT_CALL(mock_callbacks_, OnFilterConfigCallback);
+  test_hci_layer_->IncomingEvent(
+      LeAdvFilterLocalNameCompleteBuilder::Create(uint8_t{1}, ErrorCode::SUCCESS, ApcfAction::ADD, 0x0a));
+}
+
+TEST_F(LeScanningManagerAndroidHciTest, scan_filter_add_manufacturer_data_test) {
+
+  std::vector<AdvertisingPacketContentFilterCommand> filters = {};
+  filters.push_back(make_filter(ApcfFilterType::MANUFACTURER_DATA));
+  le_scanning_manager->ScanFilterAdd(0x01, filters);
+  auto commandView = test_hci_layer_->GetCommand();
+  ASSERT_EQ(OpCode::LE_ADV_FILTER, commandView.GetOpCode());
+  auto filter_command_view =
+      LeAdvFilterManufacturerDataView::Create(LeAdvFilterView::Create(LeScanningCommandView::Create(commandView)));
+  ASSERT_TRUE(filter_command_view.IsValid());
+  ASSERT_EQ(filter_command_view.GetApcfOpcode(), ApcfOpcode::MANUFACTURER_DATA);
+
+  EXPECT_CALL(mock_callbacks_, OnFilterConfigCallback);
+  test_hci_layer_->IncomingEvent(
+      LeAdvFilterManufacturerDataCompleteBuilder::Create(uint8_t{1}, ErrorCode::SUCCESS, ApcfAction::ADD, 0x0a));
+}
+
+TEST_F(LeScanningManagerAndroidHciTest, scan_filter_add_service_data_test) {
+
+  std::vector<AdvertisingPacketContentFilterCommand> filters = {};
+  filters.push_back(make_filter(hci::ApcfFilterType::SERVICE_DATA));
+  le_scanning_manager->ScanFilterAdd(0x01, filters);
+  auto commandView = test_hci_layer_->GetCommand();
+  ASSERT_EQ(OpCode::LE_ADV_FILTER, commandView.GetOpCode());
+  auto filter_command_view =
+      LeAdvFilterServiceDataView::Create(LeAdvFilterView::Create(LeScanningCommandView::Create(commandView)));
+  ASSERT_TRUE(filter_command_view.IsValid());
+  ASSERT_EQ(filter_command_view.GetApcfOpcode(), ApcfOpcode::SERVICE_DATA);
+
+  EXPECT_CALL(mock_callbacks_, OnFilterConfigCallback);
+  test_hci_layer_->IncomingEvent(
+      LeAdvFilterServiceDataCompleteBuilder::Create(uint8_t{1}, ErrorCode::SUCCESS, ApcfAction::ADD, 0x0a));
+}
+
+TEST_F(LeScanningManagerAndroidHciTest, scan_filter_add_ad_type_test) {
+  sync_client_handler();
+  client_handler_->Post(common::BindOnce(
+      [](LeScanningManager* le_scanning_manager) { ASSERT_TRUE(le_scanning_manager->IsAdTypeFilterSupported()); },
+      le_scanning_manager));
+
+  std::vector<AdvertisingPacketContentFilterCommand> filters = {};
+  hci::AdvertisingPacketContentFilterCommand filter = make_filter(hci::ApcfFilterType::AD_TYPE);
+  filters.push_back(filter);
+  le_scanning_manager->ScanFilterAdd(0x01, filters);
+  sync_client_handler();
+
+  EXPECT_CALL(mock_callbacks_, OnFilterConfigCallback);
+  test_hci_layer_->IncomingEvent(
+      LeAdvFilterADTypeCompleteBuilder::Create(uint8_t{1}, ErrorCode::SUCCESS, ApcfAction::ADD, 0x0a));
+}
+
+TEST_F(LeScanningManagerAndroidHciTest, read_batch_scan_result) {
   le_scanning_manager->BatchScanConifgStorage(100, 0, 95, 0x00);
-  auto result = next_command_future.wait_for(std::chrono::duration(std::chrono::milliseconds(100)));
-  ASSERT_EQ(std::future_status::ready, result);
+  sync_client_handler();
+  ASSERT_EQ(OpCode::LE_BATCH_SCAN, test_hci_layer_->GetCommand().GetOpCode());
   test_hci_layer_->IncomingEvent(LeBatchScanEnableCompleteBuilder::Create(uint8_t{1}, ErrorCode::SUCCESS));
+  ASSERT_EQ(OpCode::LE_BATCH_SCAN, test_hci_layer_->GetCommand().GetOpCode());
   test_hci_layer_->IncomingEvent(
       LeBatchScanSetStorageParametersCompleteBuilder::Create(uint8_t{1}, ErrorCode::SUCCESS));
 
   // Enable batch scan
-  next_command_future = test_hci_layer_->GetCommandFuture();
+
   le_scanning_manager->BatchScanEnable(BatchScanMode::FULL, 2400, 2400, BatchScanDiscardRule::OLDEST);
-  result = next_command_future.wait_for(std::chrono::duration(std::chrono::milliseconds(100)));
-  ASSERT_EQ(std::future_status::ready, result);
-  test_hci_layer_->IncomingEvent(LeBatchScanSetScanParametersCompleteBuilder::Create(uint8_t{1}, ErrorCode::SUCCESS));
+  ASSERT_EQ(OpCode::LE_BATCH_SCAN, test_hci_layer_->GetCommand().GetOpCode());
+  test_hci_layer_->IncomingEvent(LeBatchScanEnableCompleteBuilder::Create(uint8_t{1}, ErrorCode::SUCCESS));
 
   // Read batch scan data
-  next_command_future = test_hci_layer_->GetCommandFuture();
-  le_scanning_manager->BatchScanReadReport(0x01, BatchScanMode::FULL);
-  result = next_command_future.wait_for(std::chrono::duration(std::chrono::milliseconds(100)));
-  ASSERT_EQ(std::future_status::ready, result);
 
-  EXPECT_CALL(mock_callbacks_, OnBatchScanReports);
+  le_scanning_manager->BatchScanReadReport(0x01, BatchScanMode::FULL);
+  ASSERT_EQ(OpCode::LE_BATCH_SCAN, test_hci_layer_->GetCommand().GetOpCode());
+
+  // We will send read command while num_of_record != 0
   std::vector<uint8_t> raw_data = {0x5c, 0x1f, 0xa2, 0xc3, 0x63, 0x5d, 0x01, 0xf5, 0xb3, 0x5e, 0x00, 0x0c, 0x02,
                                    0x01, 0x02, 0x05, 0x09, 0x6d, 0x76, 0x38, 0x76, 0x02, 0x0a, 0xf5, 0x00};
-  next_command_future = test_hci_layer_->GetCommandFuture();
-  // We will send read command while num_of_record != 0
+
   test_hci_layer_->IncomingEvent(LeBatchScanReadResultParametersCompleteRawBuilder::Create(
       uint8_t{1}, ErrorCode::SUCCESS, BatchScanDataRead::FULL_MODE_DATA, 1, raw_data));
-  result = next_command_future.wait_for(std::chrono::duration(std::chrono::milliseconds(100)));
-  ASSERT_EQ(std::future_status::ready, result);
+  ASSERT_EQ(OpCode::LE_BATCH_SCAN, test_hci_layer_->GetCommand().GetOpCode());
 
   // OnBatchScanReports will be trigger when num_of_record == 0
+  EXPECT_CALL(mock_callbacks_, OnBatchScanReports);
   test_hci_layer_->IncomingEvent(LeBatchScanReadResultParametersCompleteRawBuilder::Create(
       uint8_t{1}, ErrorCode::SUCCESS, BatchScanDataRead::FULL_MODE_DATA, 0, {}));
 }
 
-TEST_F(LeExtendedScanningManagerTest, start_scan_test) {
-  auto next_command_future = test_hci_layer_->GetCommandFuture();
+TEST_F(LeScanningManagerExtendedTest, startup_teardown) {}
+
+TEST_F(LeScanningManagerExtendedTest, start_scan_test) {
+  // Enable scan
   le_scanning_manager->Scan(true);
-
-  auto result = next_command_future.wait_for(std::chrono::duration(std::chrono::milliseconds(100)));
-  ASSERT_EQ(std::future_status::ready, result);
-  test_hci_layer_->GetCommand(OpCode::LE_SET_EXTENDED_SCAN_ENABLE);
-  test_hci_layer_->IncomingEvent(LeSetScanEnableCompleteBuilder::Create(uint8_t{1}, ErrorCode::SUCCESS));
-
-  result = next_command_future.wait_for(std::chrono::duration(std::chrono::milliseconds(100)));
-  ASSERT_EQ(std::future_status::ready, result);
-  test_hci_layer_->GetCommand(OpCode::LE_SET_EXTENDED_SCAN_PARAMETERS);
+  ASSERT_EQ(OpCode::LE_SET_EXTENDED_SCAN_PARAMETERS, test_hci_layer_->GetCommand().GetOpCode());
   test_hci_layer_->IncomingEvent(LeSetExtendedScanParametersCompleteBuilder::Create(uint8_t{1}, ErrorCode::SUCCESS));
-
-  result = next_command_future.wait_for(std::chrono::duration(std::chrono::milliseconds(100)));
-  ASSERT_EQ(std::future_status::ready, result);
-  test_hci_layer_->GetCommand(OpCode::LE_SET_EXTENDED_SCAN_ENABLE);
-
-  test_hci_layer_->IncomingEvent(LeSetScanEnableCompleteBuilder::Create(uint8_t{1}, ErrorCode::SUCCESS));
-
+  ASSERT_EQ(OpCode::LE_SET_EXTENDED_SCAN_ENABLE, test_hci_layer_->GetCommand().GetOpCode());
+  test_hci_layer_->IncomingEvent(LeSetExtendedScanEnableCompleteBuilder::Create(uint8_t{1}, ErrorCode::SUCCESS));
   LeExtendedAdvertisingResponse report{};
   report.connectable_ = 1;
   report.scannable_ = 0;
   report.address_type_ = DirectAdvertisingAddressType::PUBLIC_DEVICE_ADDRESS;
   Address::FromString("12:34:56:78:9a:bc", report.address_);
-  std::vector<GapData> gap_data{};
-  GapData data_item{};
-  data_item.data_type_ = GapDataType::FLAGS;
-  data_item.data_ = {0x34};
-  gap_data.push_back(data_item);
-  data_item.data_type_ = GapDataType::COMPLETE_LOCAL_NAME;
-  data_item.data_ = {'r', 'a', 'n', 'd', 'o', 'm', ' ', 'd', 'e', 'v', 'i', 'c', 'e'};
-  gap_data.push_back(data_item);
-  std::vector<uint8_t> advertising_data = {};
-  for (auto data : gap_data) {
-    advertising_data.push_back((uint8_t)data.size() - 1);
-    advertising_data.push_back((uint8_t)data.data_type_);
-    advertising_data.insert(advertising_data.end(), data.data_.begin(), data.data_.end());
+  std::vector<LengthAndData> adv_data{};
+  LengthAndData data_item{};
+  data_item.data_.push_back(static_cast<uint8_t>(GapDataType::FLAGS));
+  data_item.data_.push_back(0x34);
+  adv_data.push_back(data_item);
+  data_item.data_.push_back(static_cast<uint8_t>(GapDataType::COMPLETE_LOCAL_NAME));
+  for (auto octet : {'r', 'a', 'n', 'd', 'o', 'm', ' ', 'd', 'e', 'v', 'i', 'c', 'e'}) {
+    data_item.data_.push_back(octet);
   }
+  adv_data.push_back(data_item);
 
-  report.advertising_data_ = advertising_data;
+  report.advertising_data_ = adv_data;
 
   EXPECT_CALL(mock_callbacks_, OnScanResult);
 
   test_hci_layer_->IncomingLeMetaEvent(LeExtendedAdvertisingReportBuilder::Create({report}));
 }
 
+TEST_F(LeScanningManagerExtendedTest, ignore_on_pause_on_resume_after_unregistered) {
+  TestLeAddressManager* test_le_address_manager = (TestLeAddressManager*)test_acl_manager_->GetLeAddressManager();
+  test_le_address_manager->ignore_unregister_for_testing = true;
+
+  // Register LeAddressManager
+  le_scanning_manager->Scan(true);
+  ASSERT_EQ(OpCode::LE_SET_EXTENDED_SCAN_PARAMETERS, test_hci_layer_->GetCommand().GetOpCode());
+  test_hci_layer_->IncomingEvent(LeSetExtendedScanParametersCompleteBuilder::Create(uint8_t{1}, ErrorCode::SUCCESS));
+  ASSERT_EQ(OpCode::LE_SET_EXTENDED_SCAN_ENABLE, test_hci_layer_->GetCommand().GetOpCode());
+  test_hci_layer_->IncomingEvent(LeSetExtendedScanEnableCompleteBuilder::Create(uint8_t{1}, ErrorCode::SUCCESS));
+  sync_client_handler();
+
+  // Unregister LeAddressManager
+  le_scanning_manager->Scan(false);
+  ASSERT_EQ(OpCode::LE_SET_EXTENDED_SCAN_ENABLE, test_hci_layer_->GetCommand().GetOpCode());
+  test_hci_layer_->IncomingEvent(LeSetExtendedScanEnableCompleteBuilder::Create(uint8_t{1}, ErrorCode::SUCCESS));
+  sync_client_handler();
+
+  // Unregistered client should ignore OnPause/OnResume
+  ASSERT_NE(test_le_address_manager->client_, nullptr);
+  ASSERT_EQ(test_le_address_manager->test_client_state_, TestLeAddressManager::TestClientState::UNREGISTERED);
+  test_le_address_manager->client_->OnPause();
+  ASSERT_EQ(test_le_address_manager->test_client_state_, TestLeAddressManager::TestClientState::UNREGISTERED);
+  test_le_address_manager->client_->OnResume();
+  ASSERT_EQ(test_le_address_manager->test_client_state_, TestLeAddressManager::TestClientState::UNREGISTERED);
+}
+
+TEST_F(LeScanningManagerExtendedTest, drop_insignificant_bytes_test) {
+  // Enable scan
+  le_scanning_manager->Scan(true);
+  ASSERT_EQ(OpCode::LE_SET_EXTENDED_SCAN_PARAMETERS, test_hci_layer_->GetCommand().GetOpCode());
+  test_hci_layer_->IncomingEvent(LeSetExtendedScanParametersCompleteBuilder::Create(uint8_t{1}, ErrorCode::SUCCESS));
+  ASSERT_EQ(OpCode::LE_SET_EXTENDED_SCAN_ENABLE, test_hci_layer_->GetCommand().GetOpCode());
+  test_hci_layer_->IncomingEvent(LeSetExtendedScanEnableCompleteBuilder::Create(uint8_t{1}, ErrorCode::SUCCESS));
+
+  // Prepare advertisement report
+  LeExtendedAdvertisingResponse advertisement_report{};
+  advertisement_report.connectable_ = 1;
+  advertisement_report.scannable_ = 1;
+  advertisement_report.address_type_ = DirectAdvertisingAddressType::PUBLIC_DEVICE_ADDRESS;
+  Address::FromString("12:34:56:78:9a:bc", advertisement_report.address_);
+  std::vector<LengthAndData> adv_data{};
+  LengthAndData flags_data{};
+  flags_data.data_.push_back(static_cast<uint8_t>(GapDataType::FLAGS));
+  flags_data.data_.push_back(0x34);
+  adv_data.push_back(flags_data);
+  LengthAndData name_data{};
+  name_data.data_.push_back(static_cast<uint8_t>(GapDataType::COMPLETE_LOCAL_NAME));
+  for (auto octet : "random device") {
+    name_data.data_.push_back(octet);
+  }
+  adv_data.push_back(name_data);
+  for (int i = 0; i != 5; ++i) {
+    adv_data.push_back({});  // pad with a few insigificant zeros
+  }
+  advertisement_report.advertising_data_ = adv_data;
+
+  // Prepare scan response report
+  auto scan_response_report = advertisement_report;
+  scan_response_report.scan_response_ = true;
+  LengthAndData extra_data{};
+  extra_data.data_.push_back(static_cast<uint8_t>(GapDataType::MANUFACTURER_SPECIFIC_DATA));
+  for (auto octet : "manufacturer specific") {
+    extra_data.data_.push_back(octet);
+  }
+  adv_data = {extra_data};
+  for (int i = 0; i != 5; ++i) {
+    adv_data.push_back({});  // pad with a few insigificant zeros
+  }
+  scan_response_report.advertising_data_ = adv_data;
+
+  // We expect the two reports to be concatenated, excluding the zero-padding
+  auto result = std::vector<uint8_t>();
+  packet::BitInserter it(result);
+  flags_data.Serialize(it);
+  name_data.Serialize(it);
+  extra_data.Serialize(it);
+  EXPECT_CALL(mock_callbacks_, OnScanResult(_, _, _, _, _, _, _, _, _, result));
+
+  // Send both reports
+  test_hci_layer_->IncomingLeMetaEvent(LeExtendedAdvertisingReportBuilder::Create({advertisement_report}));
+  test_hci_layer_->IncomingLeMetaEvent(LeExtendedAdvertisingReportBuilder::Create({scan_response_report}));
+}
+
 }  // namespace
 }  // namespace hci
 }  // namespace bluetooth
diff --git a/system/gd/metrics/Android.bp b/system/gd/metrics/Android.bp
index 2556f89..5ae11f1 100644
--- a/system/gd/metrics/Android.bp
+++ b/system/gd/metrics/Android.bp
@@ -11,6 +11,8 @@
     name: "BluetoothMetricsSources",
     srcs: [
         "counter_metrics.cc",
+        "metrics_state.cc",
+        "utils.cc"
     ],
 }
 
@@ -18,5 +20,6 @@
     name: "BluetoothMetricsTestSources",
     srcs: [
         "counter_metrics_unittest.cc",
+        "metrics_state_unittest.cc"
     ],
 }
diff --git a/system/gd/metrics/BUILD.gn b/system/gd/metrics/BUILD.gn
index 082a961..7a21260 100644
--- a/system/gd/metrics/BUILD.gn
+++ b/system/gd/metrics/BUILD.gn
@@ -15,8 +15,12 @@
 #
 
 source_set("BluetoothMetricsSources") {
-  sources = [ "counter_metrics.cc" ]
+  sources = [
+    "counter_metrics.cc",
+    # TODO(palash, abhishekpandit) - Need to add the changes for metrics_state.cc
+  ]
 
   configs += [ "//bt/system/gd:gd_defaults" ]
-  deps = [ "//bt/system/gd:gd_default_deps" ]
-}
+
+  deps = [ "//bt/system/gd:gd_default_deps"]
+}
\ No newline at end of file
diff --git a/system/gd/metrics/counter_metrics.cc b/system/gd/metrics/counter_metrics.cc
index 4474b39..820990e 100644
--- a/system/gd/metrics/counter_metrics.cc
+++ b/system/gd/metrics/counter_metrics.cc
@@ -49,7 +49,7 @@
   LOG_INFO("Counter metrics canceled");
 }
 
-bool CounterMetrics::Count(int32_t key, int64_t count) {
+bool CounterMetrics::CacheCount(int32_t key, int64_t count) {
   if (!IsInitialized()) {
     LOG_WARN("Counter metrics isn't initialized");
     return false;
@@ -73,8 +73,17 @@
   return true;
 }
 
-void CounterMetrics::WriteCounter(int32_t key, int64_t count) {
+bool CounterMetrics::Count(int32_t key, int64_t count) {
+  if (!IsInitialized()) {
+    LOG_WARN("Counter metrics isn't initialized");
+    return false;
+  }
+  if (count <= 0) {
+    LOG_WARN("count is not larger than 0. count: %s, key: %d", std::to_string(count).c_str(), key);
+    return false;
+  }
   os::LogMetricBluetoothCodePathCounterMetrics(key, count);
+  return true;
 }
 
 void CounterMetrics::DrainBufferedCounters() {
@@ -85,7 +94,7 @@
   std::lock_guard<std::mutex> lock(mutex_);
   LOG_INFO("Draining buffered counters");
   for (auto const& pair : counters_) {
-    WriteCounter(pair.first, pair.second);
+    Count(pair.first, pair.second);
   }
   counters_.clear();
 }
diff --git a/system/gd/metrics/counter_metrics.h b/system/gd/metrics/counter_metrics.h
index c21e9be..8148e63 100644
--- a/system/gd/metrics/counter_metrics.h
+++ b/system/gd/metrics/counter_metrics.h
@@ -25,7 +25,8 @@
 
 class CounterMetrics : public bluetooth::Module {
  public:
-  bool Count(int32_t key, int64_t value);
+  bool CacheCount(int32_t key, int64_t value);
+  virtual bool Count(int32_t key, int64_t count);
   void Stop() override;
   static const ModuleFactory Factory;
 
@@ -36,7 +37,6 @@
     return std::string("BluetoothCounterMetrics");
   }
   void DrainBufferedCounters();
-  virtual void WriteCounter(int32_t key, int64_t count);
   virtual bool IsInitialized() {
     return initialized_;
   }
diff --git a/system/gd/metrics/counter_metrics_unittest.cc b/system/gd/metrics/counter_metrics_unittest.cc
index d9d89a2..f09a6d9 100644
--- a/system/gd/metrics/counter_metrics_unittest.cc
+++ b/system/gd/metrics/counter_metrics_unittest.cc
@@ -33,8 +33,9 @@
     }
     std::unordered_map<int32_t, int64_t> test_counters_;
    private:
-    void WriteCounter(int32_t key, int64_t count) override {
+    bool Count(int32_t key, int64_t count) override {
       test_counters_[key] = count;
+      return true;
     }
     bool IsInitialized() override {
       return true;
@@ -44,26 +45,26 @@
 };
 
 TEST_F(CounterMetricsTest, normal_case) {
-  ASSERT_TRUE(testable_counter_metrics_.Count(1, 2));
-  ASSERT_TRUE(testable_counter_metrics_.Count(1, 3));
-  ASSERT_TRUE(testable_counter_metrics_.Count(2, 4));
+  ASSERT_TRUE(testable_counter_metrics_.CacheCount(1, 2));
+  ASSERT_TRUE(testable_counter_metrics_.CacheCount(1, 3));
+  ASSERT_TRUE(testable_counter_metrics_.CacheCount(2, 4));
   testable_counter_metrics_.DrainBuffer();
   ASSERT_EQ(testable_counter_metrics_.test_counters_[1], 5);
   ASSERT_EQ(testable_counter_metrics_.test_counters_[2], 4);
 }
 
 TEST_F(CounterMetricsTest, multiple_drain) {
-  ASSERT_TRUE(testable_counter_metrics_.Count(1, 2));
-  ASSERT_TRUE(testable_counter_metrics_.Count(1, 3));
-  ASSERT_TRUE(testable_counter_metrics_.Count(2, 4));
+  ASSERT_TRUE(testable_counter_metrics_.CacheCount(1, 2));
+  ASSERT_TRUE(testable_counter_metrics_.CacheCount(1, 3));
+  ASSERT_TRUE(testable_counter_metrics_.CacheCount(2, 4));
   testable_counter_metrics_.DrainBuffer();
   ASSERT_EQ(testable_counter_metrics_.test_counters_[1], 5);
   ASSERT_EQ(testable_counter_metrics_.test_counters_[2], 4);
   testable_counter_metrics_.test_counters_.clear();
-  ASSERT_TRUE(testable_counter_metrics_.Count(1, 20));
-  ASSERT_TRUE(testable_counter_metrics_.Count(1, 30));
-  ASSERT_TRUE(testable_counter_metrics_.Count(2, 40));
-  ASSERT_TRUE(testable_counter_metrics_.Count(3, 100));
+  ASSERT_TRUE(testable_counter_metrics_.CacheCount(1, 20));
+  ASSERT_TRUE(testable_counter_metrics_.CacheCount(1, 30));
+  ASSERT_TRUE(testable_counter_metrics_.CacheCount(2, 40));
+  ASSERT_TRUE(testable_counter_metrics_.CacheCount(3, 100));
   testable_counter_metrics_.DrainBuffer();
   ASSERT_EQ(testable_counter_metrics_.test_counters_[1], 50);
   ASSERT_EQ(testable_counter_metrics_.test_counters_[2], 40);
@@ -71,17 +72,17 @@
 }
 
 TEST_F(CounterMetricsTest, overflow) {
-  ASSERT_TRUE(testable_counter_metrics_.Count(1, LLONG_MAX));
-  ASSERT_FALSE(testable_counter_metrics_.Count(1, 1));
-  ASSERT_FALSE(testable_counter_metrics_.Count(1, 2));
+  ASSERT_TRUE(testable_counter_metrics_.CacheCount(1, LLONG_MAX));
+  ASSERT_FALSE(testable_counter_metrics_.CacheCount(1, 1));
+  ASSERT_FALSE(testable_counter_metrics_.CacheCount(1, 2));
   testable_counter_metrics_.DrainBuffer();
   ASSERT_EQ(testable_counter_metrics_.test_counters_[1], LLONG_MAX);
 }
 
 TEST_F(CounterMetricsTest, non_positive) {
-  ASSERT_TRUE(testable_counter_metrics_.Count(1, 5));
-  ASSERT_FALSE(testable_counter_metrics_.Count(1, 0));
-  ASSERT_FALSE(testable_counter_metrics_.Count(1, -1));
+  ASSERT_TRUE(testable_counter_metrics_.CacheCount(1, 5));
+  ASSERT_FALSE(testable_counter_metrics_.CacheCount(1, 0));
+  ASSERT_FALSE(testable_counter_metrics_.CacheCount(1, -1));
   testable_counter_metrics_.DrainBuffer();
   ASSERT_EQ(testable_counter_metrics_.test_counters_[1], 5);
 }
diff --git a/system/gd/metrics/metrics.h b/system/gd/metrics/metrics.h
new file mode 100644
index 0000000..6e22318
--- /dev/null
+++ b/system/gd/metrics/metrics.h
@@ -0,0 +1,44 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#pragma once
+
+#include <cstdint>
+#include "types/raw_address.h"
+
+namespace bluetooth {
+namespace metrics {
+
+void LogMetricsAdapterStateChanged(uint32_t state);
+void LogMetricsBondCreateAttempt(RawAddress* addr, uint32_t device_type);
+void LogMetricsBondStateChanged(
+    RawAddress* addr, uint32_t device_type, uint32_t status, uint32_t bond_state, int32_t fail_reason);
+void LogMetricsDeviceInfoReport(
+    RawAddress* addr,
+    uint32_t device_type,
+    uint32_t class_of_device,
+    uint32_t appearance,
+    uint32_t vendor_id,
+    uint32_t vendor_id_src,
+    uint32_t product_id,
+    uint32_t version);
+void LogMetricsProfileConnectionStateChanged(RawAddress* addr, uint32_t profile, uint32_t status, uint32_t state);
+void LogMetricsAclConnectAttempt(RawAddress* addr, uint32_t acl_state);
+void LogMetricsAclConnectionStateChanged(
+    RawAddress* addr, uint32_t transport, uint32_t status, uint32_t acl_state, uint32_t direction, uint32_t hci_reason);
+void LogMetricsChipsetInfoReport();
+
+}  // namespace metrics
+}  // namespace bluetooth
diff --git a/system/gd/metrics/metrics_state.cc b/system/gd/metrics/metrics_state.cc
new file mode 100644
index 0000000..9df760b
--- /dev/null
+++ b/system/gd/metrics/metrics_state.cc
@@ -0,0 +1,235 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "metrics_state.h"
+
+#include <frameworks/proto_logging/stats/enums/bluetooth/hci/enums.pb.h>
+#include <frameworks/proto_logging/stats/enums/bluetooth/le/enums.pb.h>
+
+#include <chrono>
+#include <climits>
+#include <memory>
+#include <unordered_map>
+#include <utility>
+
+#include "common/strings.h"
+#include "hci/address.h"
+#include "metrics/utils.h"
+#include "os/log.h"
+#include "os/metrics.h"
+
+namespace bluetooth {
+namespace metrics {
+
+using android::bluetooth::le::LeConnectionOriginType;
+using android::bluetooth::le::LeConnectionState;
+using android::bluetooth::le::LeConnectionType;
+
+// const static ClockTimePoint kInvalidTimePoint{};
+
+/*
+ * This is the device level metrics state, which will be modified based on
+ * incoming state events.
+ *
+ */
+void LEConnectionMetricState::AddStateChangedEvent(
+    LeConnectionOriginType origin_type,
+    LeConnectionType connection_type,
+    LeConnectionState transaction_state,
+    std::vector<std::pair<os::ArgumentType, int>> argument_list) {
+  LOG_INFO(
+      "LEConnectionMetricState:  Origin Type: %s, Connection Type: %s, Transaction State: "
+      "%s",
+      common::ToHexString(origin_type).c_str(),
+      common::ToHexString(connection_type).c_str(),
+      common::ToHexString(transaction_state).c_str());
+
+  ClockTimePoint current_timestamp = std::chrono::high_resolution_clock::now();
+  state = transaction_state;
+
+  // Assign the origin of the connection
+  if (connection_origin_type == LeConnectionOriginType::ORIGIN_UNSPECIFIED) {
+    connection_origin_type = origin_type;
+  }
+
+  if (input_connection_type == LeConnectionType::CONNECTION_TYPE_UNSPECIFIED) {
+    input_connection_type = connection_type;
+  }
+
+  if (start_timepoint == kInvalidTimePoint) {
+    start_timepoint = current_timestamp;
+  }
+  end_timepoint = current_timestamp;
+
+  switch (state) {
+    case LeConnectionState::STATE_LE_ACL_START: {
+      int connection_type_cid = GetArgumentTypeFromList(argument_list, os::ArgumentType::L2CAP_CID);
+      if (connection_type_cid != -1) {
+        LeConnectionType connection_type = GetLeConnectionTypeFromCID(connection_type_cid);
+        if (connection_type != LeConnectionType::CONNECTION_TYPE_UNSPECIFIED) {
+          LOG_INFO("LEConnectionMetricsRemoteDevice: Populating the connection type\n");
+          input_connection_type = connection_type;
+        }
+      }
+      break;
+    }
+    case LeConnectionState::STATE_LE_ACL_END: {
+      int acl_status_code_from_args =
+          GetArgumentTypeFromList(argument_list, os::ArgumentType::ACL_STATUS_CODE);
+      acl_status_code = static_cast<android::bluetooth::hci::StatusEnum>(acl_status_code_from_args);
+      acl_state = LeAclConnectionState::LE_ACL_SUCCESS;
+
+      if (acl_status_code != android::bluetooth::hci::StatusEnum::STATUS_SUCCESS) {
+        acl_state = LeAclConnectionState::LE_ACL_FAILED;
+      }
+      break;
+    }
+    case LeConnectionState::STATE_LE_ACL_TIMEOUT: {
+      int acl_status_code_from_args =
+          GetArgumentTypeFromList(argument_list, os::ArgumentType::ACL_STATUS_CODE);
+      acl_status_code = static_cast<android::bluetooth::hci::StatusEnum>(acl_status_code_from_args);
+      acl_state = LeAclConnectionState::LE_ACL_FAILED;
+      break;
+    }
+    case LeConnectionState::STATE_LE_ACL_CANCEL: {
+      acl_state = LeAclConnectionState::LE_ACL_FAILED;
+      is_cancelled = true;
+      break;
+    }
+      [[fallthrough]];
+    default: {
+      // do nothing
+    }
+  }
+}
+
+bool LEConnectionMetricState::IsEnded() {
+  return acl_state == LeAclConnectionState::LE_ACL_SUCCESS ||
+         acl_state == LeAclConnectionState::LE_ACL_FAILED;
+}
+
+bool LEConnectionMetricState::IsStarted() {
+  return state == LeConnectionState::STATE_LE_ACL_START;
+}
+
+bool LEConnectionMetricState::IsCancelled() {
+  return is_cancelled;
+}
+
+// Initialize the LEConnectionMetricsRemoteDevice
+LEConnectionMetricsRemoteDevice::LEConnectionMetricsRemoteDevice() {
+  metrics_logger_module = new MetricsLoggerModule();
+}
+
+LEConnectionMetricsRemoteDevice::LEConnectionMetricsRemoteDevice(
+    BaseMetricsLoggerModule* baseMetricsLoggerModule) {
+  metrics_logger_module = baseMetricsLoggerModule;
+}
+
+// Uploading the session
+void LEConnectionMetricsRemoteDevice::UploadLEConnectionSession(const hci::Address& address) {
+  auto it = opened_devices.find(address);
+  if (it != opened_devices.end()) {
+    os::LEConnectionSessionOptions session_options;
+    session_options.acl_connection_state = it->second->acl_state;
+    session_options.origin_type = it->second->connection_origin_type;
+    session_options.transaction_type = it->second->input_connection_type;
+    session_options.latency = bluetooth::metrics::get_timedelta_nanos(
+        it->second->start_timepoint, it->second->end_timepoint);
+    session_options.remote_address = address;
+    session_options.status = it->second->acl_status_code;
+    // TODO: keep the acl latency the same as the overall latency for now
+    // When more events are added, we will an overall latency
+    session_options.acl_latency = session_options.latency;
+    session_options.is_cancelled = it->second->is_cancelled;
+    metrics_logger_module->LogMetricBluetoothLESession(session_options);
+    opened_devices.erase(it);
+  }
+}
+
+// Implementation of metrics per remote device
+void LEConnectionMetricsRemoteDevice::AddStateChangedEvent(
+    const hci::Address& address,
+    LeConnectionOriginType origin_type,
+    LeConnectionType connection_type,
+    LeConnectionState transaction_state,
+    std::vector<std::pair<os::ArgumentType, int>> argument_list) {
+  LOG_INFO(
+        "LEConnectionMetricsRemoteDevice: Transaction State %s, Connection Type %s, Origin Type %s\n",
+        common::ToHexString(transaction_state).c_str(),
+        common::ToHexString(connection_type).c_str(),
+        common::ToHexString(origin_type).c_str());
+  if (address.IsEmpty()) {
+    LOG_INFO(
+        "LEConnectionMetricsRemoteDevice: Empty Address Cancellation %s, %s, %s\n",
+        common::ToHexString(transaction_state).c_str(),
+        common::ToHexString(connection_type).c_str(),
+        common::ToHexString(transaction_state).c_str());
+    for (auto& device_metric : device_metrics) {
+      if (device_metric->IsStarted() &&
+          transaction_state == LeConnectionState::STATE_LE_ACL_CANCEL) {
+        LOG_INFO("LEConnectionMetricsRemoteDevice: Cancellation Begin");
+        // cancel the connection
+        device_metric->AddStateChangedEvent(
+            origin_type, connection_type, transaction_state, argument_list);
+        continue;
+      }
+
+      if (device_metric->IsCancelled() &&
+          transaction_state == LeConnectionState::STATE_LE_ACL_END) {
+        LOG_INFO("LEConnectionMetricsRemoteDevice: Session is now complete after cancellation");
+        // complete the connection
+        device_metric->AddStateChangedEvent(
+            origin_type, connection_type, transaction_state, argument_list);
+        UploadLEConnectionSession(address);
+        continue;
+      }
+    }
+    return;
+  }
+
+  auto it = opened_devices.find(address);
+  if (it == opened_devices.end()) {
+    device_metrics.push_back(std::make_unique<LEConnectionMetricState>(address));
+    it = opened_devices.insert(std::begin(opened_devices), {address, device_metrics.back().get()});
+  }
+
+  it->second->AddStateChangedEvent(origin_type, connection_type, transaction_state, argument_list);
+
+  // Connection is finished
+  if (it->second->IsEnded()) {
+    UploadLEConnectionSession(address);
+  }
+}
+
+
+// MetricsLoggerModule class
+void MetricsLoggerModule::LogMetricBluetoothLESession(
+    os::LEConnectionSessionOptions session_options) {
+  os::LogMetricBluetoothLEConnection(session_options);
+}
+
+// Instance of Metrics Collector for LEConnectionMetricsRemoteDeviceImpl
+LEConnectionMetricsRemoteDevice* MetricsCollector::le_connection_metrics_remote_device =
+    new LEConnectionMetricsRemoteDevice();
+
+LEConnectionMetricsRemoteDevice* MetricsCollector::GetLEConnectionMetricsCollector() {
+  return MetricsCollector::le_connection_metrics_remote_device;
+}
+
+}  // namespace metrics
+
+}  // namespace bluetooth
diff --git a/system/gd/metrics/metrics_state.h b/system/gd/metrics/metrics_state.h
new file mode 100644
index 0000000..ca92501
--- /dev/null
+++ b/system/gd/metrics/metrics_state.h
@@ -0,0 +1,122 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include <frameworks/proto_logging/stats/enums/bluetooth/le/enums.pb.h>
+
+#include <chrono>
+#include <cstdint>
+#include <memory>
+#include <unordered_map>
+#include <utility>
+#include <vector>
+
+#include "common/strings.h"
+#include "hci/address.h"
+#include "os/metrics.h"
+
+namespace bluetooth {
+
+namespace metrics {
+
+using android::bluetooth::le::LeAclConnectionState;
+using android::bluetooth::le::LeConnectionOriginType;
+using android::bluetooth::le::LeConnectionState;
+using android::bluetooth::le::LeConnectionType;
+
+using ClockTimePoint = std::chrono::time_point<std::chrono::high_resolution_clock>;
+
+const static ClockTimePoint kInvalidTimePoint{};
+
+inline int64_t get_timedelta_nanos(const ClockTimePoint& t1, const ClockTimePoint& t2) {
+  if (t1 == kInvalidTimePoint || t2 == kInvalidTimePoint) {
+    return -1;
+  }
+  return std::abs(std::chrono::duration_cast<std::chrono::nanoseconds>(t2 - t1).count());
+}
+
+class BaseMetricsLoggerModule {
+ public:
+  BaseMetricsLoggerModule() {}
+  virtual void LogMetricBluetoothLESession(os::LEConnectionSessionOptions session_options) = 0;
+  virtual ~BaseMetricsLoggerModule() {}
+};
+
+class MetricsLoggerModule : public BaseMetricsLoggerModule {
+ public:
+  MetricsLoggerModule() {}
+  void LogMetricBluetoothLESession(os::LEConnectionSessionOptions session_options);
+  virtual ~MetricsLoggerModule() {}
+};
+
+class LEConnectionMetricState {
+ public:
+  hci::Address address;
+  LEConnectionMetricState(const hci::Address address) : address(address) {}
+  LeConnectionState state;
+  LeAclConnectionState acl_state;
+  LeConnectionType input_connection_type = LeConnectionType::CONNECTION_TYPE_UNSPECIFIED;
+  android::bluetooth::hci::StatusEnum acl_status_code;
+  ClockTimePoint start_timepoint = kInvalidTimePoint;
+  ClockTimePoint end_timepoint = kInvalidTimePoint;
+  bool is_cancelled = false;
+  LeConnectionOriginType connection_origin_type = LeConnectionOriginType::ORIGIN_UNSPECIFIED;
+
+  bool IsStarted();
+  bool IsEnded();
+  bool IsCancelled();
+
+  void AddStateChangedEvent(
+      LeConnectionOriginType origin_type,
+      LeConnectionType connection_type,
+      LeConnectionState transaction_state,
+      std::vector<std::pair<os::ArgumentType, int>> argument_list);
+
+};
+
+class LEConnectionMetricsRemoteDevice {
+ public:
+  LEConnectionMetricsRemoteDevice();
+
+  LEConnectionMetricsRemoteDevice(BaseMetricsLoggerModule* baseMetricsLoggerModule);
+
+  void AddStateChangedEvent(
+      const hci::Address& address,
+      LeConnectionOriginType origin_type,
+      LeConnectionType connection_type,
+      LeConnectionState transaction_state,
+      std::vector<std::pair<os::ArgumentType, int>> argument_list);
+
+  void UploadLEConnectionSession(const hci::Address& address);
+
+ private:
+  std::vector<std::unique_ptr<LEConnectionMetricState>> device_metrics;
+  std::unordered_map<hci::Address, LEConnectionMetricState*> opened_devices;
+  BaseMetricsLoggerModule* metrics_logger_module;
+};
+
+class MetricsCollector {
+ public:
+  // getting the LE Connection Metrics Collector
+  static LEConnectionMetricsRemoteDevice* GetLEConnectionMetricsCollector();
+
+ private:
+  static LEConnectionMetricsRemoteDevice* le_connection_metrics_remote_device;
+};
+
+}  // namespace metrics
+}  // namespace bluetooth
diff --git a/system/gd/metrics/metrics_state_unittest.cc b/system/gd/metrics/metrics_state_unittest.cc
new file mode 100644
index 0000000..435e5c0
--- /dev/null
+++ b/system/gd/metrics/metrics_state_unittest.cc
@@ -0,0 +1,196 @@
+#include "metrics_state.h"
+
+#include <gmock/gmock.h>
+
+#include <cstdint>
+#include <vector>
+
+#include "gtest/gtest.h"
+#include "hci/address.h"
+#include "metrics_state.h"
+#include "os/metrics.h"
+
+//
+using android::bluetooth::hci::StatusEnum;
+using android::bluetooth::le::LeAclConnectionState;
+using android::bluetooth::le::LeConnectionOriginType;
+using android::bluetooth::le::LeConnectionState;
+using android::bluetooth::le::LeConnectionType;
+
+LeAclConnectionState le_acl_state = LeAclConnectionState::LE_ACL_UNSPECIFIED;
+LeConnectionOriginType origin_type = LeConnectionOriginType::ORIGIN_UNSPECIFIED;
+LeConnectionType connection_type = LeConnectionType::CONNECTION_TYPE_UNSPECIFIED;
+StatusEnum status = StatusEnum::STATUS_UNKNOWN;
+bluetooth::hci::Address remote_address = bluetooth::hci::Address::kEmpty;
+int latency = 0;
+int acl_latency = 0;
+bool is_cancelled = false;
+
+namespace bluetooth {
+namespace metrics {
+
+const hci::Address address1 = hci::Address({0x11, 0x22, 0x33, 0x44, 0x55, 0x66});
+const hci::Address empty_address = hci::Address::kEmpty;
+
+class TestMetricsLoggerModule : public BaseMetricsLoggerModule {
+ public:
+  TestMetricsLoggerModule() {}
+  void LogMetricBluetoothLESession(os::LEConnectionSessionOptions session_options);
+  virtual ~TestMetricsLoggerModule() {}
+};
+
+void TestMetricsLoggerModule::LogMetricBluetoothLESession(
+    os::LEConnectionSessionOptions session_options) {
+  le_acl_state = session_options.acl_connection_state;
+  origin_type = session_options.origin_type;
+  connection_type = session_options.transaction_type;
+  is_cancelled = session_options.is_cancelled;
+  status = session_options.status;
+  remote_address = session_options.remote_address;
+}
+
+class MockMetricsCollector {
+ public:
+  static LEConnectionMetricsRemoteDevice* GetLEConnectionMetricsCollector();
+
+  static LEConnectionMetricsRemoteDevice* le_connection_metrics_remote_device;
+};
+
+
+
+LEConnectionMetricsRemoteDevice* MockMetricsCollector::le_connection_metrics_remote_device =
+    new LEConnectionMetricsRemoteDevice(new TestMetricsLoggerModule());
+
+LEConnectionMetricsRemoteDevice* MockMetricsCollector::GetLEConnectionMetricsCollector() {
+  return MockMetricsCollector::le_connection_metrics_remote_device;
+}
+
+namespace {
+
+class LEConnectionMetricsRemoteDeviceTest : public ::testing::Test {};
+
+TEST(LEConnectionMetricsRemoteDeviceTest, Initialize) {
+  ASSERT_EQ(0, 0);
+}
+
+TEST(LEConnectionMetricsRemoteDeviceTest, ConnectionSuccess) {
+  auto argument_list = std::vector<std::pair<os::ArgumentType, int>>();
+  argument_list.push_back(std::make_pair(
+      os::ArgumentType::ACL_STATUS_CODE,
+      static_cast<int>(android::bluetooth::hci::StatusEnum::STATUS_SUCCESS)));
+
+  MockMetricsCollector::GetLEConnectionMetricsCollector()->AddStateChangedEvent(
+      address1,
+      LeConnectionOriginType::ORIGIN_NATIVE,
+      LeConnectionType::CONNECTION_TYPE_LE_ACL,
+      LeConnectionState::STATE_LE_ACL_START,
+      argument_list);
+
+  MockMetricsCollector::GetLEConnectionMetricsCollector()->AddStateChangedEvent(
+      address1,
+      LeConnectionOriginType::ORIGIN_NATIVE,
+      LeConnectionType::CONNECTION_TYPE_LE_ACL,
+      LeConnectionState::STATE_LE_ACL_END,
+      argument_list);
+  // assert that these are equal
+  ASSERT_EQ(le_acl_state, LeAclConnectionState::LE_ACL_SUCCESS);
+  ASSERT_EQ(origin_type, LeConnectionOriginType::ORIGIN_NATIVE);
+  ASSERT_EQ(connection_type, LeConnectionType::CONNECTION_TYPE_LE_ACL);
+  ASSERT_EQ(remote_address, address1);
+  ASSERT_EQ(is_cancelled, false);
+}
+
+TEST(LEConnectionMetricsRemoteDeviceTest, ConnectionFailed) {
+  auto argument_list = std::vector<std::pair<os::ArgumentType, int>>();
+  argument_list.push_back(std::make_pair(
+      os::ArgumentType::ACL_STATUS_CODE,
+      static_cast<int>(android::bluetooth::hci::StatusEnum::STATUS_NO_CONNECTION)));
+
+  MockMetricsCollector::GetLEConnectionMetricsCollector()->AddStateChangedEvent(
+      address1,
+      LeConnectionOriginType::ORIGIN_NATIVE,
+      LeConnectionType::CONNECTION_TYPE_LE_ACL,
+      LeConnectionState::STATE_LE_ACL_START,
+      argument_list);
+
+  MockMetricsCollector::GetLEConnectionMetricsCollector()->AddStateChangedEvent(
+      address1,
+      LeConnectionOriginType::ORIGIN_NATIVE,
+      LeConnectionType::CONNECTION_TYPE_LE_ACL,
+      LeConnectionState::STATE_LE_ACL_END,
+      argument_list);
+  // assert that these are equal
+  ASSERT_EQ(le_acl_state, LeAclConnectionState::LE_ACL_FAILED);
+  ASSERT_EQ(origin_type, LeConnectionOriginType::ORIGIN_NATIVE);
+  ASSERT_EQ(connection_type, LeConnectionType::CONNECTION_TYPE_LE_ACL);
+  ASSERT_EQ(remote_address, address1);
+  ASSERT_EQ(is_cancelled, false);
+}
+
+TEST(LEConnectionMetricsRemoteDeviceTest, Cancellation) {
+  auto argument_list = std::vector<std::pair<os::ArgumentType, int>>();
+  auto no_connection_argument_list = std::vector<std::pair<os::ArgumentType, int>>();
+  no_connection_argument_list.push_back(std::make_pair(
+      os::ArgumentType::ACL_STATUS_CODE,
+      static_cast<int>(android::bluetooth::hci::StatusEnum::STATUS_NO_CONNECTION)));
+
+  // Start of the LE-ACL Connection
+  MockMetricsCollector::GetLEConnectionMetricsCollector()->AddStateChangedEvent(
+      address1,
+      LeConnectionOriginType::ORIGIN_NATIVE,
+      LeConnectionType::CONNECTION_TYPE_LE_ACL,
+      LeConnectionState::STATE_LE_ACL_START,
+      argument_list);
+
+  // Cancellation of the LE-ACL Connection
+  MockMetricsCollector::GetLEConnectionMetricsCollector()->AddStateChangedEvent(
+      empty_address,
+      LeConnectionOriginType::ORIGIN_NATIVE,
+      LeConnectionType::CONNECTION_TYPE_LE_ACL,
+      LeConnectionState::STATE_LE_ACL_CANCEL,
+      argument_list);
+
+  // Ending of the LE-ACL Connection
+  MockMetricsCollector::GetLEConnectionMetricsCollector()->AddStateChangedEvent(
+      address1,
+      LeConnectionOriginType::ORIGIN_NATIVE,
+      LeConnectionType::CONNECTION_TYPE_LE_ACL,
+      LeConnectionState::STATE_LE_ACL_END,
+      no_connection_argument_list);
+
+  ASSERT_EQ(le_acl_state, LeAclConnectionState::LE_ACL_FAILED);
+  ASSERT_EQ(origin_type, LeConnectionOriginType::ORIGIN_NATIVE);
+  ASSERT_EQ(connection_type, LeConnectionType::CONNECTION_TYPE_LE_ACL);
+  ASSERT_EQ(remote_address, address1);
+  ASSERT_EQ(is_cancelled, true);
+}
+
+TEST(LEConnectionMetricsRemoteDeviceTest, Timeout) {
+  auto argument_list = std::vector<std::pair<os::ArgumentType, int>>();
+
+  // Start of the LE-ACL Connection
+  MockMetricsCollector::GetLEConnectionMetricsCollector()->AddStateChangedEvent(
+      address1,
+      LeConnectionOriginType::ORIGIN_NATIVE,
+      LeConnectionType::CONNECTION_TYPE_LE_ACL,
+      LeConnectionState::STATE_LE_ACL_START,
+      argument_list);
+
+  // Timeout of the LE-ACL Connection
+  MockMetricsCollector::GetLEConnectionMetricsCollector()->AddStateChangedEvent(
+      address1,
+      LeConnectionOriginType::ORIGIN_NATIVE,
+      LeConnectionType::CONNECTION_TYPE_LE_ACL,
+      LeConnectionState::STATE_LE_ACL_TIMEOUT,
+      argument_list);
+
+  ASSERT_EQ(le_acl_state, LeAclConnectionState::LE_ACL_FAILED);
+  ASSERT_EQ(origin_type, LeConnectionOriginType::ORIGIN_NATIVE);
+  ASSERT_EQ(connection_type, LeConnectionType::CONNECTION_TYPE_LE_ACL);
+  ASSERT_EQ(remote_address, address1);
+  ASSERT_EQ(is_cancelled, false);
+}
+
+}  // namespace
+}  // namespace metrics
+}  // namespace bluetooth
diff --git a/system/gd/metrics/utils.cc b/system/gd/metrics/utils.cc
new file mode 100644
index 0000000..bf970ce
--- /dev/null
+++ b/system/gd/metrics/utils.cc
@@ -0,0 +1,74 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "metrics/utils.h"
+
+#include <base/files/file_util.h>
+#include <base/strings/string_util.h>
+
+namespace bluetooth {
+namespace metrics {
+
+namespace {
+// The path to the kernel's boot_id.
+const char kBootIdPath[] = "/proc/sys/kernel/random/boot_id";
+}  // namespace
+
+bool GetBootId(std::string* boot_id) {
+  if (!base::ReadFileToString(base::FilePath(kBootIdPath), boot_id)) {
+    return false;
+  }
+  base::TrimWhitespaceASCII(*boot_id, base::TRIM_TRAILING, boot_id);
+  return true;
+}
+
+int GetArgumentTypeFromList(
+    std::vector<std::pair<os::ArgumentType, int>>& argument_list, os::ArgumentType argumentType) {
+  for (std::pair<os::ArgumentType, int> argumentPair : argument_list) {
+    if (argumentPair.first == argumentType) {
+      return argumentPair.second;
+    }
+  }
+  return -1;
+}
+
+os::LeConnectionType GetLeConnectionTypeFromCID(int fixed_cid) {
+  switch(fixed_cid) {
+    case 3: {
+      return os::LeConnectionType::CONNECTION_TYPE_L2CAP_FIXED_CHNL_AMP;
+    }
+    case 4: {
+      return os::LeConnectionType::CONNECTION_TYPE_L2CAP_FIXED_CHNL_ATT;
+    }
+    case 5: {
+      return os::LeConnectionType::CONNECTION_TYPE_L2CAP_FIXED_CHNL_LE_SIGNALLING;
+    }
+    case 6: {
+      return os::LeConnectionType::CONNECTION_TYPE_L2CAP_FIXED_CHNL_SMP;
+    }
+    case 7: {
+      return os::LeConnectionType::CONNECTION_TYPE_L2CAP_FIXED_CHNL_SMP_BR_EDR;
+    }
+    default: {
+      return os::LeConnectionType::CONNECTION_TYPE_UNSPECIFIED;
+    }
+  }
+}
+
+
+
+}  // namespace metrics
+}  // namespace bluetooth
diff --git a/system/gd/metrics/utils.h b/system/gd/metrics/utils.h
new file mode 100644
index 0000000..3ada1dc
--- /dev/null
+++ b/system/gd/metrics/utils.h
@@ -0,0 +1,13 @@
+#pragma once
+#include <string>
+#include <utility>
+#include <vector>
+#include "os/metrics.h"
+namespace bluetooth {
+namespace metrics {
+bool GetBootId(std::string* boot_id);
+int GetArgumentTypeFromList(
+    std::vector<std::pair<os::ArgumentType, int>>& argument_list, os::ArgumentType argumentType);
+    os::LeConnectionType GetLeConnectionTypeFromCID(int fixed_cid);
+}  // namespace metrics
+}
diff --git a/system/gd/os/Android.bp b/system/gd/os/Android.bp
index b2916c5..292da06 100644
--- a/system/gd/os/Android.bp
+++ b/system/gd/os/Android.bp
@@ -17,6 +17,7 @@
 filegroup {
     name: "BluetoothOsSources_android",
     srcs: [
+        "system_properties_common.cc",
         "android/metrics.cc",
         "android/parameter_provider.cc",
         "android/system_properties.cc",
@@ -35,6 +36,7 @@
 filegroup {
     name: "BluetoothOsSources_host",
     srcs: [
+        "system_properties_common.cc",
         "host/metrics.cc",
         "host/parameter_provider.cc",
         "host/system_properties.cc",
@@ -93,8 +95,8 @@
 }
 
 filegroup {
-    name: "BluetoothOsSources_fuzz",
+    name: "BluetoothOsSources_fake_timer",
     srcs: [
-        "fuzz/fake_timerfd.cc",
+        "fake_timer/fake_timerfd.cc",
     ],
 }
diff --git a/system/gd/os/BUILD.gn b/system/gd/os/BUILD.gn
index 48337e1..7204ccd 100644
--- a/system/gd/os/BUILD.gn
+++ b/system/gd/os/BUILD.gn
@@ -18,6 +18,7 @@
     "linux/parameter_provider.cc",
     "linux/system_properties.cc",
     "linux/wakelock_native.cc",
+    "system_properties_common.cc",
     "syslog.cc",
   ]
 
diff --git a/system/gd/os/android/metrics.cc b/system/gd/os/android/metrics.cc
index 3be6188..38e68a7 100644
--- a/system/gd/os/android/metrics.cc
+++ b/system/gd/os/android/metrics.cc
@@ -22,8 +22,11 @@
 
 #include <statslog_bt.h>
 
+#include "common/audit_log.h"
+#include "metrics/metrics_state.h"
 #include "common/metric_id_manager.h"
 #include "common/strings.h"
+#include "hci/hci_packets.h"
 #include "os/log.h"
 
 namespace bluetooth {
@@ -32,6 +35,8 @@
 
 using bluetooth::common::MetricIdManager;
 using bluetooth::hci::Address;
+using bluetooth::hci::ErrorCode;
+using bluetooth::hci::EventCode;
 
 /**
  * nullptr and size 0 represent missing value for obfuscated_id
@@ -232,7 +237,7 @@
 }
 
 void LogMetricSmpPairingEvent(
-    const Address& address, uint8_t smp_cmd, android::bluetooth::DirectionEnum direction, uint8_t smp_fail_reason) {
+    const Address& address, uint16_t smp_cmd, android::bluetooth::DirectionEnum direction, uint16_t smp_fail_reason) {
   int metric_id = 0;
   if (!address.IsEmpty()) {
     metric_id = MetricIdManager::GetInstance().AllocateId(address);
@@ -285,6 +290,10 @@
         std::to_string(event_value).c_str(),
         ret);
   }
+
+  if (static_cast<EventCode>(hci_event) == EventCode::SIMPLE_PAIRING_COMPLETE) {
+    common::LogConnectionAdminAuditEvent("Pairing", address, static_cast<ErrorCode>(cmd_status));
+  }
 }
 
 void LogMetricSdpAttribute(
@@ -416,6 +425,81 @@
   }
 }
 
+void LogMetricBluetoothLocalSupportedFeatures(uint32_t page_num, uint64_t features) {
+  int ret = stats_write(BLUETOOTH_LOCAL_SUPPORTED_FEATURES_REPORTED, page_num, features);
+  if (ret < 0) {
+    LOG_WARN(
+        "Failed for LogMetricBluetoothLocalSupportedFeatures, "
+        "page_num %d, features %s, error %d",
+        page_num,
+        std::to_string(features).c_str(),
+        ret);
+  }
+}
+
+void LogMetricBluetoothLocalVersions(
+    uint32_t lmp_manufacturer_name,
+    uint8_t lmp_version,
+    uint32_t lmp_subversion,
+    uint8_t hci_version,
+    uint32_t hci_revision) {
+  int ret = stats_write(
+      BLUETOOTH_LOCAL_VERSIONS_REPORTED,
+      static_cast<int32_t>(lmp_manufacturer_name),
+      static_cast<int32_t>(lmp_version),
+      static_cast<int32_t>(lmp_subversion),
+      static_cast<int32_t>(hci_version),
+      static_cast<int32_t>(hci_revision));
+  if (ret < 0) {
+    LOG_WARN(
+        "Failed for LogMetricBluetoothLocalVersions, "
+        "lmp_manufacturer_name %d, lmp_version %hhu, lmp_subversion %d, hci_version %hhu, hci_revision %d, error %d",
+        lmp_manufacturer_name,
+        lmp_version,
+        lmp_subversion,
+        hci_version,
+        hci_revision,
+        ret);
+  }
+}
+
+void LogMetricBluetoothDisconnectionReasonReported(
+    uint32_t reason, const Address& address, uint32_t connection_handle) {
+  int metric_id = 0;
+  if (!address.IsEmpty()) {
+    metric_id = MetricIdManager::GetInstance().AllocateId(address);
+  }
+  int ret = stats_write(BLUETOOTH_DISCONNECTION_REASON_REPORTED, reason, metric_id, connection_handle);
+  if (ret < 0) {
+    LOG_WARN(
+        "Failed for LogMetricBluetoothDisconnectionReasonReported, "
+        "reason %d, metric_id %d, connection_handle %d, error %d",
+        reason,
+        metric_id,
+        connection_handle,
+        ret);
+  }
+}
+
+void LogMetricBluetoothRemoteSupportedFeatures(
+    const Address& address, uint32_t page, uint64_t features, uint32_t connection_handle) {
+  int metric_id = 0;
+  if (!address.IsEmpty()) {
+    metric_id = MetricIdManager::GetInstance().AllocateId(address);
+  }
+  int ret = stats_write(BLUETOOTH_REMOTE_SUPPORTED_FEATURES_REPORTED, metric_id, page, features, connection_handle);
+  if (ret < 0) {
+    LOG_WARN(
+        "Failed for LogMetricBluetoothRemoteSupportedFeatures, "
+        "metric_id %d, page %d, features %s, connection_handle %d, error %d",
+        metric_id,
+        page,
+        std::to_string(features).c_str(),
+        connection_handle,
+        ret);
+  }
+}
+
 void LogMetricBluetoothCodePathCounterMetrics(int32_t key, int64_t count) {
   int ret = stats_write(BLUETOOTH_CODE_PATH_COUNTER, key, count);
   if (ret < 0) {
@@ -425,5 +509,43 @@
   }
 }
 
+void LogMetricBluetoothLEConnectionMetricEvent(
+    const Address& address,
+    android::bluetooth::le::LeConnectionOriginType origin_type,
+    android::bluetooth::le::LeConnectionType connection_type,
+    android::bluetooth::le::LeConnectionState transaction_state,
+    std::vector<std::pair<os::ArgumentType, int>>& argument_list) {
+  bluetooth::metrics::MetricsCollector::GetLEConnectionMetricsCollector()->AddStateChangedEvent(
+      address, origin_type, connection_type, transaction_state, argument_list);
+}
+
+void LogMetricBluetoothLEConnection(os::LEConnectionSessionOptions session_options) {
+  int metric_id = 0;
+  if (!session_options.remote_address.IsEmpty()) {
+    metric_id = MetricIdManager::GetInstance().AllocateId(session_options.remote_address);
+  }
+  int ret = stats_write(
+      BLUETOOTH_LE_SESSION_CONNECTED,
+      session_options.acl_connection_state,
+      session_options.origin_type,
+      session_options.transaction_type,
+      session_options.transaction_state,
+      session_options.latency,
+      metric_id,
+      session_options.app_uid,
+      session_options.acl_latency,
+      session_options.status,
+      session_options.is_cancelled);
+
+  if (ret < 0) {
+    LOG_WARN(
+        "Failed BluetoothLeSessionConnected - ACL Connection State: %s, Origin Type:  "
+        "%s",
+        common::ToHexString(session_options.acl_connection_state).c_str(),
+        common::ToHexString(session_options.origin_type).c_str());
+  }
+}
+
 }  // namespace os
 }  // namespace bluetooth
+
diff --git a/system/gd/os/android/wakelock_native_test.cc b/system/gd/os/android/wakelock_native_test.cc
index 66be722..36f8af8 100644
--- a/system/gd/os/android/wakelock_native_test.cc
+++ b/system/gd/os/android/wakelock_native_test.cc
@@ -53,8 +53,9 @@
   static void FulfilPromise(std::unique_ptr<std::promise<void>>& promise) {
     std::lock_guard<std::recursive_mutex> lock_guard(mutex);
     if (promise != nullptr) {
-      promise->set_value();
-      promise = nullptr;
+      std::promise<void>* prom = promise.release();
+      prom->set_value();
+      delete prom;
     }
   }
 
diff --git a/system/gd/os/fake_timer/fake_timerfd.cc b/system/gd/os/fake_timer/fake_timerfd.cc
new file mode 100644
index 0000000..f4b240e
--- /dev/null
+++ b/system/gd/os/fake_timer/fake_timerfd.cc
@@ -0,0 +1,143 @@
+/*
+ * Copyright 2020 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "os/fake_timer/fake_timerfd.h"
+
+#include <sys/eventfd.h>
+#include <unistd.h>
+
+#include <map>
+
+namespace bluetooth {
+namespace os {
+namespace fake_timer {
+
+class FakeTimerFd {
+ public:
+  int fd;
+  bool active;
+  uint64_t trigger_ms;
+  uint64_t period_ms;
+};
+
+static std::map<int, FakeTimerFd*> fake_timers;
+static uint64_t clock = 0;
+static uint64_t max_clock = UINT64_MAX;
+
+static uint64_t timespec_to_ms(const timespec* t) {
+  return t->tv_sec * 1000 + t->tv_nsec / 1000000;
+}
+
+int fake_timerfd_create(int clockid, int flags) {
+  int fd = eventfd(0, EFD_SEMAPHORE);
+  if (fd == -1) {
+    return fd;
+  }
+
+  FakeTimerFd* entry = new FakeTimerFd();
+  fake_timers[fd] = entry;
+  entry->fd = fd;
+  return fd;
+}
+
+int fake_timerfd_settime(int fd, int flags, const struct itimerspec* new_value, struct itimerspec* old_value) {
+  if (fake_timers.find(fd) == fake_timers.end()) {
+    return -1;
+  }
+
+  FakeTimerFd* entry = fake_timers[fd];
+
+  uint64_t trigger_delta_ms = timespec_to_ms(&new_value->it_value);
+  entry->active = trigger_delta_ms != 0;
+  if (!entry->active) {
+    return 0;
+  }
+
+  uint64_t period_ms = timespec_to_ms(&new_value->it_interval);
+  entry->trigger_ms = clock + trigger_delta_ms;
+  entry->period_ms = period_ms;
+  return 0;
+}
+
+int fake_timerfd_close(int fd) {
+  auto timer_iterator = fake_timers.find(fd);
+  if (timer_iterator != fake_timers.end()) {
+    delete timer_iterator->second;
+    fake_timers.erase(timer_iterator);
+  }
+  return close(fd);
+}
+
+void fake_timerfd_reset() {
+  clock = 0;
+  max_clock = UINT64_MAX;
+  // if there are entries still here, it is a failure of our users to clean up
+  // so let them leak and trigger errors
+  fake_timers.clear();
+}
+
+static bool fire_next_event(uint64_t new_clock) {
+  uint64_t earliest_time = new_clock;
+  FakeTimerFd* to_fire = nullptr;
+  for (auto it = fake_timers.begin(); it != fake_timers.end(); it++) {
+    FakeTimerFd* entry = it->second;
+    if (!entry->active) {
+      continue;
+    }
+
+    if (entry->trigger_ms > clock && entry->trigger_ms <= new_clock) {
+      if (to_fire == nullptr || entry->trigger_ms < earliest_time) {
+        to_fire = entry;
+        earliest_time = entry->trigger_ms;
+      }
+    }
+  }
+
+  if (to_fire == nullptr) {
+    return false;
+  }
+
+  bool is_periodic = to_fire->period_ms != 0;
+  if (is_periodic) {
+    to_fire->trigger_ms += to_fire->period_ms;
+  }
+  to_fire->active = is_periodic;
+  uint64_t value = 1;
+  write(to_fire->fd, &value, sizeof(uint64_t));
+  return true;
+}
+
+void fake_timerfd_advance(uint64_t ms) {
+  uint64_t new_clock = clock + ms;
+  if (new_clock < clock) {
+    new_clock = max_clock;
+  }
+  while (fire_next_event(new_clock)) {
+  }
+  clock = new_clock;
+}
+
+void fake_timerfd_cap_at(uint64_t ms) {
+  max_clock = ms;
+}
+
+uint64_t fake_timerfd_get_clock() {
+  return clock;
+}
+
+}  // namespace fake_timer
+}  // namespace os
+}  // namespace bluetooth
diff --git a/system/gd/os/fake_timer/fake_timerfd.h b/system/gd/os/fake_timer/fake_timerfd.h
new file mode 100644
index 0000000..fc7940d
--- /dev/null
+++ b/system/gd/os/fake_timer/fake_timerfd.h
@@ -0,0 +1,43 @@
+/*
+ * Copyright 2020 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include <sys/timerfd.h>
+
+#include <cstdint>
+
+namespace bluetooth {
+namespace os {
+namespace fake_timer {
+
+int fake_timerfd_create(int clockid, int flags);
+
+int fake_timerfd_settime(int fd, int flags, const struct itimerspec* new_value, struct itimerspec* old_value);
+
+int fake_timerfd_close(int fd);
+
+void fake_timerfd_reset();
+
+void fake_timerfd_advance(uint64_t ms);
+
+void fake_timerfd_cap_at(uint64_t ms);
+
+uint64_t fake_timerfd_get_clock();
+
+}  // namespace fake_timer
+}  // namespace os
+}  // namespace bluetooth
diff --git a/system/gd/os/fuzz/fake_timerfd.cc b/system/gd/os/fuzz/fake_timerfd.cc
deleted file mode 100644
index 8154e44..0000000
--- a/system/gd/os/fuzz/fake_timerfd.cc
+++ /dev/null
@@ -1,139 +0,0 @@
-/*
- * Copyright 2020 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#include "os/fuzz/fake_timerfd.h"
-
-#include <sys/eventfd.h>
-#include <unistd.h>
-
-#include <map>
-
-namespace bluetooth {
-namespace os {
-namespace fuzz {
-
-class FakeTimerFd {
- public:
-  int fd;
-  bool active;
-  uint64_t trigger_ms;
-  uint64_t period_ms;
-};
-
-static std::map<int, FakeTimerFd*> fake_timers;
-static uint64_t clock = 0;
-static uint64_t max_clock = UINT64_MAX;
-
-static uint64_t timespec_to_ms(const timespec* t) {
-  return t->tv_sec * 1000 + t->tv_nsec / 1000000;
-}
-
-int fake_timerfd_create(int clockid, int flags) {
-  int fd = eventfd(0, 0);
-  if (fd == -1) {
-    return fd;
-  }
-
-  FakeTimerFd* entry = new FakeTimerFd();
-  fake_timers[fd] = entry;
-  entry->fd = fd;
-  return fd;
-}
-
-int fake_timerfd_settime(int fd, int flags, const struct itimerspec* new_value, struct itimerspec* old_value) {
-  if (fake_timers.find(fd) == fake_timers.end()) {
-    return -1;
-  }
-
-  FakeTimerFd* entry = fake_timers[fd];
-
-  uint64_t trigger_delta_ms = timespec_to_ms(&new_value->it_value);
-  entry->active = trigger_delta_ms != 0;
-  if (!entry->active) {
-    return 0;
-  }
-
-  uint64_t period_ms = timespec_to_ms(&new_value->it_value);
-  entry->trigger_ms = clock + trigger_delta_ms;
-  entry->period_ms = period_ms;
-  return 0;
-}
-
-int fake_timerfd_close(int fd) {
-  auto timer_iterator = fake_timers.find(fd);
-  if (timer_iterator != fake_timers.end()) {
-    delete timer_iterator->second;
-    fake_timers.erase(timer_iterator);
-  }
-  return close(fd);
-}
-
-void fake_timerfd_reset() {
-  clock = 0;
-  max_clock = UINT64_MAX;
-  // if there are entries still here, it is a failure of our users to clean up
-  // so let them leak and trigger errors
-  fake_timers.clear();
-}
-
-static bool fire_next_event(uint64_t new_clock) {
-  uint64_t earliest_time = new_clock;
-  FakeTimerFd* to_fire = nullptr;
-  for (auto it = fake_timers.begin(); it != fake_timers.end(); it++) {
-    FakeTimerFd* entry = it->second;
-    if (!entry->active) {
-      continue;
-    }
-
-    if (entry->trigger_ms > clock && entry->trigger_ms <= new_clock) {
-      if (to_fire == nullptr || entry->trigger_ms < earliest_time) {
-        to_fire = entry;
-        earliest_time = entry->trigger_ms;
-      }
-    }
-  }
-
-  if (to_fire == nullptr) {
-    return false;
-  }
-
-  bool is_periodic = to_fire->period_ms != 0;
-  if (is_periodic) {
-    to_fire->trigger_ms += to_fire->period_ms;
-  }
-  to_fire->active = is_periodic;
-  uint64_t value = 1;
-  write(to_fire->fd, &value, sizeof(uint64_t));
-  return true;
-}
-
-void fake_timerfd_advance(uint64_t ms) {
-  uint64_t new_clock = clock + ms;
-  if (new_clock < clock) {
-    new_clock = max_clock;
-  }
-  while (fire_next_event(new_clock)) {
-  }
-  clock = new_clock;
-}
-
-void fake_timerfd_cap_at(uint64_t ms) {
-  max_clock = ms;
-}
-
-}  // namespace fuzz
-}  // namespace os
-}  // namespace bluetooth
diff --git a/system/gd/os/fuzz/fake_timerfd.h b/system/gd/os/fuzz/fake_timerfd.h
deleted file mode 100644
index 069e153..0000000
--- a/system/gd/os/fuzz/fake_timerfd.h
+++ /dev/null
@@ -1,41 +0,0 @@
-/*
- * Copyright 2020 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#pragma once
-
-#include <sys/timerfd.h>
-
-#include <cstdint>
-
-namespace bluetooth {
-namespace os {
-namespace fuzz {
-
-int fake_timerfd_create(int clockid, int flags);
-
-int fake_timerfd_settime(int fd, int flags, const struct itimerspec* new_value, struct itimerspec* old_value);
-
-int fake_timerfd_close(int fd);
-
-void fake_timerfd_reset();
-
-void fake_timerfd_advance(uint64_t ms);
-
-void fake_timerfd_cap_at(uint64_t ms);
-
-}  // namespace fuzz
-}  // namespace os
-}  // namespace bluetooth
diff --git a/system/gd/os/handler_unittest.cc b/system/gd/os/handler_unittest.cc
index b8c580f..04f6347 100644
--- a/system/gd/os/handler_unittest.cc
+++ b/system/gd/os/handler_unittest.cc
@@ -70,19 +70,27 @@
   auto closure_started_future = closure_started.get_future();
   std::promise<void> closure_can_continue;
   auto can_continue_future = closure_can_continue.get_future();
+  std::promise<void> closure_finished;
+  auto closure_finished_future = closure_finished.get_future();
   handler_->Post(common::BindOnce(
-      [](int* val, std::promise<void> closure_started, std::future<void> can_continue_future) {
+      [](int* val,
+         std::promise<void> closure_started,
+         std::future<void> can_continue_future,
+         std::promise<void> closure_finished) {
         closure_started.set_value();
         *val = *val + 1;
         can_continue_future.wait();
+        closure_finished.set_value();
       },
       common::Unretained(&val),
       std::move(closure_started),
-      std::move(can_continue_future)));
+      std::move(can_continue_future),
+      std::move(closure_finished)));
   handler_->Post(common::BindOnce([]() { ASSERT_TRUE(false); }));
   closure_started_future.wait();
   handler_->Clear();
   closure_can_continue.set_value();
+  closure_finished_future.wait();
   ASSERT_EQ(val, 1);
 }
 
diff --git a/system/gd/os/host/metrics.cc b/system/gd/os/host/metrics.cc
index b175714..afbd51b 100644
--- a/system/gd/os/host/metrics.cc
+++ b/system/gd/os/host/metrics.cc
@@ -96,13 +96,38 @@
     const char* attribute_value) {}
 
 void LogMetricSmpPairingEvent(
-    const Address& address, uint8_t smp_cmd, android::bluetooth::DirectionEnum direction, uint8_t smp_fail_reason) {}
+    const Address& address, uint16_t smp_cmd, android::bluetooth::DirectionEnum direction, uint16_t smp_fail_reason) {}
 
 void LogMetricA2dpPlaybackEvent(const Address& address, int playback_state, int audio_coding_mode) {}
 
 void LogMetricBluetoothHalCrashReason(
     const Address& address, uint32_t error_code, uint32_t vendor_error_code) {}
 
+void LogMetricBluetoothLocalSupportedFeatures(uint32_t page_num, uint64_t features) {}
+
+void LogMetricBluetoothLocalVersions(
+    uint32_t lmp_manufacturer_name,
+    uint8_t lmp_version,
+    uint32_t lmp_subversion,
+    uint8_t hci_version,
+    uint32_t hci_reversion) {}
+
+void LogMetricBluetoothDisconnectionReasonReported(
+    uint32_t reason, const Address& address, uint32_t connection_handle) {}
+
+void LogMetricBluetoothRemoteSupportedFeatures(
+    const Address& address, uint32_t page, uint64_t features, uint32_t connection_handle) {}
+
 void LogMetricBluetoothCodePathCounterMetrics(int32_t key, int64_t count) {}
+
+void LogMetricBluetoothLEConnectionMetricEvent(
+    const Address& address,
+    android::bluetooth::le::LeConnectionOriginType origin_type,
+    android::bluetooth::le::LeConnectionType connection_type,
+    android::bluetooth::le::LeConnectionState transaction_state,
+   std::vector<std::pair<os::ArgumentType, int>>& argument_list)  {}
+
+void LogMetricBluetoothLEConnection(os::LEConnectionSessionOptions session_options) {}
+
 }  // namespace os
 }  // namespace bluetooth
diff --git a/system/gd/os/linux/metrics.cc b/system/gd/os/linux/metrics.cc
index 37bd673..e958982 100644
--- a/system/gd/os/linux/metrics.cc
+++ b/system/gd/os/linux/metrics.cc
@@ -96,14 +96,36 @@
     const char* attribute_value) {}
 
 void LogMetricSmpPairingEvent(
-    const Address& address, uint8_t smp_cmd, android::bluetooth::DirectionEnum direction, uint8_t smp_fail_reason) {}
+    const Address& address, uint16_t smp_cmd, android::bluetooth::DirectionEnum direction, uint16_t smp_fail_reason) {}
 
 void LogMetricA2dpPlaybackEvent(const Address& address, int playback_state, int audio_coding_mode) {}
 
 void LogMetricBluetoothHalCrashReason(
     const Address& address, uint32_t error_code, uint32_t vendor_error_code) {}
 
+void LogMetricBluetoothLocalSupportedFeatures(uint32_t page_num, uint64_t features) {}
+
+void LogMetricBluetoothLocalVersions(
+    uint32_t lmp_manufacturer_name,
+    uint8_t lmp_version,
+    uint32_t lmp_subversion,
+    uint8_t hci_version,
+    uint32_t hci_revision) {}
+
+void LogMetricBluetoothDisconnectionReasonReported(
+    uint32_t reason, const Address& address, uint32_t connection_handle) {}
+
+void LogMetricBluetoothRemoteSupportedFeatures(
+    const Address& address, uint32_t page, uint64_t features, uint32_t connection_handle) {}
+
 void LogMetricBluetoothCodePathCounterMetrics(int32_t key, int64_t count) {}
 
+void LogMetricBluetoothLEConnectionMetricEvent(
+    const Address& address,
+    android::bluetooth::le::LeConnectionOriginType origin_type,
+    android::bluetooth::le::LeConnectionType connection_type,
+    android::bluetooth::le::LeConnectionState transaction_state,
+    std::vector<std::pair<os::ArgumentType, int>>& argument_list) {}
+
 }  // namespace os
 }  // namespace bluetooth
diff --git a/system/gd/os/linux_generic/alarm_unittest.cc b/system/gd/os/linux_generic/alarm_unittest.cc
index 9b4a5e5..5615c9d 100644
--- a/system/gd/os/linux_generic/alarm_unittest.cc
+++ b/system/gd/os/linux_generic/alarm_unittest.cc
@@ -20,12 +20,15 @@
 
 #include "common/bind.h"
 #include "gtest/gtest.h"
+#include "os/fake_timer/fake_timerfd.h"
 
 namespace bluetooth {
 namespace os {
 namespace {
 
 using common::BindOnce;
+using fake_timer::fake_timerfd_advance;
+using fake_timer::fake_timerfd_reset;
 
 class AlarmTest : public ::testing::Test {
  protected:
@@ -40,6 +43,11 @@
     handler_->Clear();
     delete handler_;
     delete thread_;
+    fake_timerfd_reset();
+  }
+
+  void fake_timer_advance(uint64_t ms) {
+    handler_->Post(common::BindOnce(fake_timerfd_advance, ms));
   }
   Alarm* alarm_;
 
@@ -55,15 +63,12 @@
 TEST_F(AlarmTest, schedule) {
   std::promise<void> promise;
   auto future = promise.get_future();
-  auto before = std::chrono::steady_clock::now();
   int delay_ms = 10;
-  int delay_error_ms = 3;
   alarm_->Schedule(
       BindOnce(&std::promise<void>::set_value, common::Unretained(&promise)), std::chrono::milliseconds(delay_ms));
+  fake_timer_advance(10);
   future.get();
-  auto after = std::chrono::steady_clock::now();
-  auto duration_ms = std::chrono::duration_cast<std::chrono::milliseconds>(after - before);
-  ASSERT_NEAR(duration_ms.count(), delay_ms, delay_error_ms);
+  ASSERT_FALSE(future.valid());
 }
 
 TEST_F(AlarmTest, cancel_alarm) {
@@ -83,6 +88,7 @@
   auto future = promise.get_future();
   alarm_->Schedule(
       BindOnce(&std::promise<void>::set_value, common::Unretained(&promise)), std::chrono::milliseconds(10));
+  fake_timer_advance(10);
   future.get();
 }
 
diff --git a/system/gd/os/linux_generic/linux.h b/system/gd/os/linux_generic/linux.h
index 69fae6a..b057135 100644
--- a/system/gd/os/linux_generic/linux.h
+++ b/system/gd/os/linux_generic/linux.h
@@ -20,11 +20,11 @@
 #define EFD_SEMAPHORE 1
 #endif
 
-#ifdef FUZZ_TARGET
-#include "os/fuzz/fake_timerfd.h"
-#define TIMERFD_CREATE ::bluetooth::os::fuzz::fake_timerfd_create
-#define TIMERFD_SETTIME ::bluetooth::os::fuzz::fake_timerfd_settime
-#define TIMERFD_CLOSE ::bluetooth::os::fuzz::fake_timerfd_close
+#ifdef USE_FAKE_TIMERS
+#include "os/fake_timer/fake_timerfd.h"
+#define TIMERFD_CREATE ::bluetooth::os::fake_timer::fake_timerfd_create
+#define TIMERFD_SETTIME ::bluetooth::os::fake_timer::fake_timerfd_settime
+#define TIMERFD_CLOSE ::bluetooth::os::fake_timer::fake_timerfd_close
 #else
 #define TIMERFD_CREATE timerfd_create
 #define TIMERFD_SETTIME timerfd_settime
diff --git a/system/gd/os/linux_generic/queue_unittest.cc b/system/gd/os/linux_generic/queue_unittest.cc
index 3739735..706fcd2 100644
--- a/system/gd/os/linux_generic/queue_unittest.cc
+++ b/system/gd/os/linux_generic/queue_unittest.cc
@@ -19,6 +19,7 @@
 #include <sys/eventfd.h>
 
 #include <atomic>
+#include <chrono>
 #include <future>
 #include <unordered_map>
 
@@ -26,6 +27,8 @@
 #include "gtest/gtest.h"
 #include "os/reactor.h"
 
+using namespace std::chrono_literals;
+
 namespace bluetooth {
 namespace os {
 namespace {
@@ -60,6 +63,11 @@
   Handler* enqueue_handler_;
   Thread* dequeue_thread_;
   Handler* dequeue_handler_;
+
+  void sync_enqueue_handler() {
+    ASSERT(enqueue_thread_ != nullptr);
+    ASSERT(enqueue_thread_->GetReactor()->WaitForIdle(2s));
+  }
 };
 
 class TestEnqueueEnd {
@@ -96,11 +104,12 @@
       queue_->UnregisterEnqueue();
     }
 
-    auto pair = promise_map_->find(buffer_.size());
-    if (pair != promise_map_->end()) {
-      pair->second.set_value(pair->first);
-      promise_map_->erase(pair->first);
+    auto key = buffer_.size();
+    auto node = promise_map_->extract(key);
+    if (node) {
+      node.mapped().set_value(key);
     }
+
     return data;
   }
 
@@ -161,10 +170,10 @@
       queue_->UnregisterDequeue();
     }
 
-    auto pair = promise_map_->find(buffer_.size());
-    if (pair != promise_map_->end()) {
-      pair->second.set_value(pair->first);
-      promise_map_->erase(pair->first);
+    auto key = buffer_.size();
+    auto node = promise_map_->extract(key);
+    if (node) {
+      node.mapped().set_value(key);
     }
   }
 
@@ -337,6 +346,7 @@
   test_enqueue_end.RegisterEnqueue(&enqueue_promise_map);
   enqueue_future.wait();
   EXPECT_EQ(enqueue_future.get(), 0);
+  sync_enqueue_handler();
 }
 
 // Enqueue end level : 1
diff --git a/system/gd/os/linux_generic/repeating_alarm_unittest.cc b/system/gd/os/linux_generic/repeating_alarm_unittest.cc
index c7e1022..f8aa958 100644
--- a/system/gd/os/linux_generic/repeating_alarm_unittest.cc
+++ b/system/gd/os/linux_generic/repeating_alarm_unittest.cc
@@ -20,12 +20,14 @@
 
 #include "common/bind.h"
 #include "gtest/gtest.h"
+#include "os/fake_timer/fake_timerfd.h"
 
 namespace bluetooth {
 namespace os {
 namespace {
 
-constexpr int error_ms = 20;
+using fake_timer::fake_timerfd_advance;
+using fake_timer::fake_timerfd_reset;
 
 class RepeatingAlarmTest : public ::testing::Test {
  protected:
@@ -40,6 +42,7 @@
     handler_->Clear();
     delete handler_;
     delete thread_;
+    fake_timerfd_reset();
   }
 
   void VerifyMultipleDelayedTasks(int scheduled_tasks, int task_length_ms, int interval_between_tasks_ms) {
@@ -58,6 +61,7 @@
             task_length_ms,
             interval_between_tasks_ms),
         std::chrono::milliseconds(interval_between_tasks_ms));
+    fake_timer_advance(interval_between_tasks_ms * scheduled_tasks);
     future.get();
     alarm_->Cancel();
   }
@@ -70,13 +74,13 @@
       int task_length_ms,
       int interval_between_tasks_ms) {
     *counter = *counter + 1;
-    auto time_now = std::chrono::steady_clock::now();
-    auto time_delta = time_now - start_time;
     if (*counter == scheduled_tasks) {
       promise->set_value();
     }
-    ASSERT_NEAR(time_delta.count(), interval_between_tasks_ms * 1000000 * *counter, error_ms * 1000000);
-    std::this_thread::sleep_for(std::chrono::milliseconds(task_length_ms));
+  }
+
+  void fake_timer_advance(uint64_t ms) {
+    handler_->Post(common::BindOnce(fake_timerfd_advance, ms));
   }
 
   RepeatingAlarm* alarm_;
@@ -95,15 +99,13 @@
 TEST_F(RepeatingAlarmTest, schedule) {
   std::promise<void> promise;
   auto future = promise.get_future();
-  auto before = std::chrono::steady_clock::now();
   int period_ms = 10;
   alarm_->Schedule(
       common::Bind(&std::promise<void>::set_value, common::Unretained(&promise)), std::chrono::milliseconds(period_ms));
+  fake_timer_advance(period_ms);
   future.get();
   alarm_->Cancel();
-  auto after = std::chrono::steady_clock::now();
-  auto duration = after - before;
-  ASSERT_NEAR(duration.count(), period_ms * 1000000, error_ms * 1000000);
+  ASSERT_FALSE(future.valid());
 }
 
 TEST_F(RepeatingAlarmTest, cancel_alarm) {
@@ -124,6 +126,7 @@
   auto future = promise.get_future();
   alarm_->Schedule(
       common::Bind(&std::promise<void>::set_value, common::Unretained(&promise)), std::chrono::milliseconds(10));
+  fake_timer_advance(10);
   future.get();
   alarm_->Cancel();
 }
diff --git a/system/gd/os/log.h b/system/gd/os/log.h
index 4bc5e26..5125f0a 100644
--- a/system/gd/os/log.h
+++ b/system/gd/os/log.h
@@ -29,6 +29,7 @@
 #if defined(OS_ANDROID)
 
 #include <log/log.h>
+#include <log/log_event_list.h>
 
 #include "common/init_flags.h"
 
@@ -113,15 +114,6 @@
     abort();                                \
   } while (false)
 
-#ifndef android_errorWriteLog
-#define android_errorWriteLog(tag, subTag) LOG_ERROR("ERROR tag: 0x%x, sub_tag: %s", tag, subTag)
-#endif
-
-#ifndef android_errorWriteWithInfoLog
-#define android_errorWriteWithInfoLog(tag, subTag, uid, data, dataLen) \
-  LOG_ERROR("ERROR tag: 0x%x, sub_tag: %s", tag, subTag)
-#endif
-
 #ifndef LOG_EVENT_INT
 #define LOG_EVENT_INT(...)
 #endif
@@ -191,15 +183,6 @@
   } while (false)
 #endif
 
-#ifndef android_errorWriteLog
-#define android_errorWriteLog(tag, subTag) LOG_ERROR("ERROR tag: 0x%x, sub_tag: %s", tag, subTag)
-#endif
-
-#ifndef android_errorWriteWithInfoLog
-#define android_errorWriteWithInfoLog(tag, subTag, uid, data, dataLen) \
-  LOG_ERROR("ERROR tag: 0x%x, sub_tag: %s", tag, subTag)
-#endif
-
 #ifndef LOG_EVENT_INT
 #define LOG_EVENT_INT(...)
 #endif
diff --git a/system/gd/os/metrics.h b/system/gd/os/metrics.h
index 3b1ae51..04e6d3e 100644
--- a/system/gd/os/metrics.h
+++ b/system/gd/os/metrics.h
@@ -20,6 +20,7 @@
 
 #include <frameworks/proto_logging/stats/enums/bluetooth/enums.pb.h>
 #include <frameworks/proto_logging/stats/enums/bluetooth/hci/enums.pb.h>
+#include <frameworks/proto_logging/stats/enums/bluetooth/le/enums.pb.h>
 
 #include "hci/address.h"
 
@@ -166,7 +167,10 @@
  * @param smp_fail_reason SMP pairing failure reason code from SMP spec
  */
 void LogMetricSmpPairingEvent(
-    const hci::Address& address, uint8_t smp_cmd, android::bluetooth::DirectionEnum direction, uint8_t smp_fail_reason);
+    const hci::Address& address,
+    uint16_t smp_cmd,
+    android::bluetooth::DirectionEnum direction,
+    uint16_t smp_fail_reason);
 
 /**
  * Logs there is an event related Bluetooth classic pairing
@@ -265,7 +269,63 @@
     uint32_t error_code,
     uint32_t vendor_error_code);
 
-void LogMetricBluetoothCodePathCounterMetrics(int32_t key, int64_t count);
-}  // namespace os
+void LogMetricBluetoothLocalSupportedFeatures(uint32_t page_num, uint64_t features);
 
+void LogMetricBluetoothLocalVersions(
+    uint32_t lmp_manufacturer_name,
+    uint8_t lmp_version,
+    uint32_t lmp_subversion,
+    uint8_t hci_version,
+    uint32_t hci_revision);
+
+void LogMetricBluetoothDisconnectionReasonReported(
+    uint32_t reason, const hci::Address& address, uint32_t connection_handle);
+
+void LogMetricBluetoothRemoteSupportedFeatures(
+    const hci::Address& address, uint32_t page, uint64_t features, uint32_t connection_handle);
+
+void LogMetricBluetoothCodePathCounterMetrics(int32_t key, int64_t count);
+
+using android::bluetooth::le::LeAclConnectionState;
+using android::bluetooth::le::LeConnectionOriginType;
+using android::bluetooth::le::LeConnectionType;
+using android::bluetooth::le::LeConnectionState;
+// Adding options
+struct LEConnectionSessionOptions {
+  // Contains the state of the LE-ACL Connection
+  LeAclConnectionState acl_connection_state = LeAclConnectionState::LE_ACL_UNSPECIFIED;
+  // Origin of the transaction
+  LeConnectionOriginType origin_type = LeConnectionOriginType::ORIGIN_UNSPECIFIED;
+  // Connection Type
+  LeConnectionType transaction_type = LeConnectionType::CONNECTION_TYPE_UNSPECIFIED;
+  // Transaction State
+  LeConnectionState transaction_state = LeConnectionState::STATE_UNSPECIFIED;
+  // Latency of the entire transaction
+  int64_t latency = 0;
+  // Address of the remote device
+  hci::Address remote_address = hci::Address::kEmpty;
+  // UID associated with the device
+  int app_uid = 0;
+  // Latency of the ACL Transaction
+  int64_t acl_latency = 0;
+  // Contains the error code associated with the ACL Connection if failed
+  android::bluetooth::hci::StatusEnum status = android::bluetooth::hci::StatusEnum::STATUS_UNKNOWN;
+  // Cancelled connection
+  bool is_cancelled = false;
+};
+
+// Argument Type
+enum ArgumentType { GATT_IF, L2CAP_PSM, L2CAP_CID, APP_UID, ACL_STATUS_CODE };
+void LogMetricBluetoothLEConnectionMetricEvent(
+    const hci::Address& address,
+    LeConnectionOriginType origin_type,
+    LeConnectionType connection_type,
+    LeConnectionState transaction_state,
+    std::vector<std::pair<os::ArgumentType, int>>& argument_list);
+
+// Upload LE Session
+void LogMetricBluetoothLEConnection(os::LEConnectionSessionOptions session_options);
+
+}  // namespace os
+   //
 }  // namespace bluetooth
diff --git a/system/gd/os/system_properties.h b/system/gd/os/system_properties.h
index f5a82b8..42ea4e7 100644
--- a/system/gd/os/system_properties.h
+++ b/system/gd/os/system_properties.h
@@ -26,6 +26,21 @@
 // or if the platform does not support system property
 std::optional<std::string> GetSystemProperty(const std::string& property);
 
+// Get |property| keyed system property as uint32_t from supported platform, return |default_value| if the property
+// does not exist or if the platform does not support system property
+uint32_t GetSystemPropertyUint32(const std::string& property, uint32_t default_value);
+
+// Get |property| keyed system property as uint32_t from supported platform, return |default_value|
+// if the property does not exist or if the platform does not support system property if property is
+// found it will call stoul with |base|
+uint32_t GetSystemPropertyUint32Base(
+    const std::string& property, uint32_t default_value, int base = 0);
+
+// Get |property| keyed property as bool from supported platform, return
+// |default_value| if the property does not exist or if the platform
+// does not support system property
+bool GetSystemPropertyBool(const std::string& property, bool default_value);
+
 // Set |property| keyed system property to |value|, return true if the set was successful and false if the set failed
 // Replace existing value if property already exists
 bool SetSystemProperty(const std::string& property, const std::string& value);
diff --git a/system/gd/os/system_properties_common.cc b/system/gd/os/system_properties_common.cc
new file mode 100644
index 0000000..f59560c
--- /dev/null
+++ b/system/gd/os/system_properties_common.cc
@@ -0,0 +1,53 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <string>
+
+#include "common/strings.h"
+#include "os/system_properties.h"
+
+namespace bluetooth {
+namespace os {
+
+uint32_t GetSystemPropertyUint32(const std::string& property, uint32_t default_value) {
+  return GetSystemPropertyUint32Base(property, default_value, 10);
+}
+
+uint32_t GetSystemPropertyUint32Base(
+    const std::string& property, uint32_t default_value, int base) {
+  std::optional<std::string> result = GetSystemProperty(property);
+  if (result.has_value()) {
+    return static_cast<uint32_t>(std::stoul(*result, nullptr, base));
+  }
+  return default_value;
+}
+
+bool GetSystemPropertyBool(const std::string& property, bool default_value) {
+  std::optional<std::string> result = GetSystemProperty(property);
+  if (result.has_value()) {
+    std::string trimmed_val = common::StringTrim(result.value());
+    if (trimmed_val == "true" || trimmed_val == "1") {
+      return true;
+    }
+    if (trimmed_val == "false" || trimmed_val == "0") {
+      return false;
+    }
+  }
+  return default_value;
+}
+
+}  // namespace os
+}  // namespace bluetooth
diff --git a/system/gd/packet/iterator.cc b/system/gd/packet/iterator.cc
index 7551b79..73ad2e7 100644
--- a/system/gd/packet/iterator.cc
+++ b/system/gd/packet/iterator.cc
@@ -33,7 +33,7 @@
 }
 
 template <bool little_endian>
-Iterator<little_endian> Iterator<little_endian>::operator+(int offset) {
+Iterator<little_endian> Iterator<little_endian>::operator+(int offset) const {
   auto itr(*this);
 
   return itr += offset;
@@ -52,14 +52,14 @@
 }
 
 template <bool little_endian>
-Iterator<little_endian> Iterator<little_endian>::operator-(int offset) {
+Iterator<little_endian> Iterator<little_endian>::operator-(int offset) const {
   auto itr(*this);
 
   return itr -= offset;
 }
 
 template <bool little_endian>
-int Iterator<little_endian>::operator-(Iterator<little_endian>& itr) {
+int Iterator<little_endian>::operator-(const Iterator<little_endian>& itr) const {
   return index_ - itr.index_;
 }
 
diff --git a/system/gd/packet/iterator.h b/system/gd/packet/iterator.h
index 13a277d..2fba51d 100644
--- a/system/gd/packet/iterator.h
+++ b/system/gd/packet/iterator.h
@@ -36,12 +36,12 @@
   virtual ~Iterator() = default;
 
   // All addition and subtraction operators are unbounded.
-  Iterator operator+(int offset);
+  Iterator operator+(int offset) const;
   Iterator& operator+=(int offset);
   Iterator& operator++();
 
-  Iterator operator-(int offset);
-  int operator-(Iterator& itr);
+  Iterator operator-(int offset) const;
+  int operator-(const Iterator& itr) const;
   Iterator& operator-=(int offset);
   Iterator& operator--();
 
diff --git a/system/gd/rust/common/src/init_flags.rs b/system/gd/rust/common/src/init_flags.rs
index 07e63f4..b92d65a 100644
--- a/system/gd/rust/common/src/init_flags.rs
+++ b/system/gd/rust/common/src/init_flags.rs
@@ -1,22 +1,105 @@
 use log::{error, info};
 use paste::paste;
+use std::collections::HashMap;
+use std::fmt;
 use std::sync::Mutex;
 
+// Fallback to bool when type is not specified
+macro_rules! type_expand {
+    () => {
+        bool
+    };
+    ($type:ty) => {
+        $type
+    };
+}
+
+macro_rules! default_value {
+    () => {
+        false
+    };
+    ($type:ty) => {
+        <$type>::default()
+    };
+    ($($type:ty)? = $default:tt) => {
+        $default
+    };
+}
+
+macro_rules! test_value {
+    () => {
+        true
+    };
+    ($type:ty) => {
+        <$type>::default()
+    };
+}
+
+#[cfg(test)]
+macro_rules! call_getter_fn {
+    ($flag:ident) => {
+        paste! {
+            [<$flag _is_enabled>]()
+        }
+    };
+    ($flag:ident $type:ty) => {
+        paste! {
+            [<get_ $flag>]()
+        }
+    };
+}
+
+macro_rules! create_getter_fn {
+    ($flag:ident) => {
+        paste! {
+            #[doc = concat!(" Return true if ", stringify!($flag), " is enabled")]
+            pub fn [<$flag _is_enabled>]() -> bool {
+                FLAGS.lock().unwrap().$flag
+            }
+        }
+    };
+    ($flag:ident $type:ty) => {
+        paste! {
+            #[doc = concat!(" Return the flag value of ", stringify!($flag))]
+            pub fn [<get_ $flag>]() -> $type {
+                FLAGS.lock().unwrap().$flag
+            }
+        }
+    };
+}
+
 macro_rules! init_flags {
-    (flags: { $($flag:ident),* }, dependencies: { $($parent:ident => $child:ident),* }) => {
-        #[derive(Default)]
+    (flags: { $($flag:ident $(: $type:ty)? $(= $default:tt)?,)* }
+     extra_fields: { $($extra_field:ident : $extra_field_type:ty $(= $extra_default:tt)?,)* }
+     extra_parsed_flags: { $($extra_flag:tt => $extra_flag_fn:ident(_, _ $(,$extra_args:tt)*),)*}
+     dependencies: { $($parent:ident => $child:ident),* }) => {
+
         struct InitFlags {
-            $($flag: bool,)*
+            $($flag : type_expand!($($type)?),)*
+            $($extra_field : $extra_field_type,)*
         }
 
-        /// Sets all flags to true, for testing
+        impl Default for InitFlags {
+            fn default() -> Self {
+                Self {
+                    $($flag : default_value!($($type)? $(= $default)?),)*
+                    $($extra_field : default_value!($extra_field_type $(= $extra_default)?),)*
+                }
+            }
+        }
+
+        /// Sets all bool flags to true
+        /// Set all other flags and extra fields to their default type value
         pub fn set_all_for_testing() {
-            *FLAGS.lock().unwrap() = InitFlags { $($flag: true,)* };
+            *FLAGS.lock().unwrap() = InitFlags {
+                $($flag: test_value!($($type)?),)*
+                $($extra_field: test_value!($extra_field_type),)*
+            };
         }
 
         impl InitFlags {
             fn parse(flags: Vec<String>) -> Self {
-                $(let mut $flag = false;)*
+                let mut init_flags = Self::default();
 
                 for flag in flags {
                     let values: Vec<&str> = flag.split("=").collect();
@@ -26,26 +109,26 @@
                     }
 
                     match values[0] {
-                        $(concat!("INIT_", stringify!($flag)) => $flag = values[1].parse().unwrap_or(false),)*
-                        _ => {}
+                        $(concat!("INIT_", stringify!($flag)) =>
+                            init_flags.$flag = values[1].parse().unwrap_or_else(|e| {
+                                error!("Parse failure on '{}': {}", flag, e);
+                                default_value!($($type)? $(= $default)?)}),)*
+                        $($extra_flag => $extra_flag_fn(&mut init_flags, values $(, $extra_args)*),)*
+                        _ => error!("Unsaved flag: {} = {}", values[0], values[1])
                     }
                 }
 
-                Self { $($flag,)* }.reconcile()
+                init_flags.reconcile()
             }
 
             fn reconcile(mut self) -> Self {
-                // Loop to ensure dependencies can be specified in any order
                 loop {
-                    let mut any_change = false;
+                    // dependencies can be specified in any order
                     $(if self.$parent && !self.$child {
                         self.$child = true;
-                        any_change = true;
+                        continue;
                     })*
-
-                    if !any_change {
-                        break;
-                    }
+                    break;
                 }
 
                 // TODO: acl should not be off if l2cap is on, but need to reconcile legacy code
@@ -55,35 +138,108 @@
 
                 self
             }
+        }
 
-            fn log(&self) {
-                info!(concat!("Flags loaded: ", $(stringify!($flag), "={} ",)*), $(self.$flag,)*);
+        impl fmt::Display for InitFlags {
+            fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
+                write!(f, concat!(
+                    concat!($(concat!(stringify!($flag), "={}")),*),
+                    $(concat!(stringify!($extra_field), "={}")),*),
+                    $(self.$flag),*,
+                    $(self.$extra_field),*)
             }
         }
 
-        paste! {
-            $(
-                #[allow(missing_docs)]
-                pub fn [<$flag _is_enabled>]() -> bool {
-                    FLAGS.lock().unwrap().$flag
+        $(create_getter_fn!($flag $($type)?);)*
+
+        #[cfg(test)]
+        mod tests_autogenerated {
+            use super::*;
+            $(paste! {
+                #[test]
+                pub fn [<test_get_ $flag>]() {
+                    let _guard = tests::ASYNC_LOCK.lock().unwrap();
+                    tests::test_load(vec![
+                        &*format!(concat!(concat!("INIT_", stringify!($flag)), "={}"), test_value!($($type)?))
+                    ]);
+                    let get_value = call_getter_fn!($flag $($type)?);
+                    drop(_guard); // Prevent poisonning other tests if a panic occurs
+                    assert_eq!(get_value, test_value!($($type)?));
                 }
-            )*
+            })*
         }
-    };
+    }
+}
+
+#[derive(Default)]
+struct ExplicitTagSettings {
+    map: HashMap<String, bool>,
+}
+
+impl fmt::Display for ExplicitTagSettings {
+    fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
+        write!(f, "{:?}", self.map)
+    }
+}
+
+fn parse_logging_tag(flags: &mut InitFlags, values: Vec<&str>, enabled: bool) {
+    for tag in values[1].split(',') {
+        flags.logging_debug_explicit_tag_settings.map.insert(tag.to_string(), enabled);
+    }
+}
+
+/// Return true if `tag` is enabled in the flag
+pub fn is_debug_logging_enabled_for_tag(tag: &str) -> bool {
+    let guard = FLAGS.lock().unwrap();
+    *guard
+        .logging_debug_explicit_tag_settings
+        .map
+        .get(tag)
+        .unwrap_or(&guard.logging_debug_enabled_for_all)
+}
+
+fn parse_hci_adapter(flags: &mut InitFlags, values: Vec<&str>) {
+    flags.hci_adapter = values[1].parse().unwrap_or(0);
 }
 
 init_flags!(
+    // LINT.IfChange
     flags: {
-        gd_core,
-        gd_security,
-        gd_l2cap,
-        gatt_robust_caching_client,
+        always_send_services_if_gatt_disc_done = true,
+        asynchronously_start_l2cap_coc = true,
+        btaa_hci = true,
+        bta_dm_clear_conn_id_on_client_close = true,
+        btm_dm_flush_discovery_queue_on_search_cancel,
+        clear_hidd_interrupt_cid_on_disconnect = true,
+        delay_hidh_cleanup_until_hidh_ready_start = true,
+        finite_att_timeout = true,
+        gatt_robust_caching_client = true,
         gatt_robust_caching_server,
-        btaa_hci,
-        gd_rust,
+        gd_core,
+        gd_l2cap,
         gd_link_policy,
-        irk_rotation
-    },
+        gd_rust,
+        gd_security,
+        hci_adapter: i32,
+        irk_rotation,
+        leaudio_targeted_announcement_reconnection_mode,
+        logging_debug_enabled_for_all,
+        pass_phy_update_callback = true,
+        queue_l2cap_coc_while_encrypting = true,
+        sdp_serialization = true,
+        sdp_skip_rnr_if_known = true,
+        trigger_advertising_callbacks_on_first_resume_after_pause = true,
+    }
+    // extra_fields are not a 1 to 1 match with "INIT_*" flags
+    extra_fields: {
+        logging_debug_explicit_tag_settings: ExplicitTagSettings,
+    }
+    // LINT.ThenChange(/system/gd/common/init_flags.fbs)
+    extra_parsed_flags: {
+        "INIT_logging_debug_enabled_for_tags" => parse_logging_tag(_, _, true),
+        "INIT_logging_debug_disabled_for_tags" => parse_logging_tag(_, _, false),
+        "--hci" => parse_hci_adapter(_, _),
+    }
     dependencies: {
         gd_core => gd_security
     }
@@ -94,10 +250,75 @@
 }
 
 /// Loads the flag values from the passed-in vector of string values
-pub fn load(flags: Vec<String>) {
+pub fn load(raw_flags: Vec<String>) {
     crate::init_logging();
 
-    let flags = InitFlags::parse(flags);
-    flags.log();
+    let flags = InitFlags::parse(raw_flags);
+    info!("Flags loaded: {}", flags);
     *FLAGS.lock().unwrap() = flags;
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    lazy_static! {
+        /// do not run concurrent tests as they all use the same global init_flag struct and
+        /// accessor
+        pub(super) static ref ASYNC_LOCK: Mutex<()> = Mutex::new(());
+    }
+
+    pub(super) fn test_load(raw_flags: Vec<&str>) {
+        let raw_flags = raw_flags.into_iter().map(|x| x.to_string()).collect();
+        load(raw_flags);
+    }
+
+    #[test]
+    fn simple_flag() {
+        let _guard = ASYNC_LOCK.lock().unwrap();
+        test_load(vec![
+            "INIT_btaa_hci=false", //override a default flag
+            "INIT_gatt_robust_caching_server=true",
+        ]);
+        assert!(!btaa_hci_is_enabled());
+        assert!(gatt_robust_caching_server_is_enabled());
+    }
+    #[test]
+    fn parsing_failure() {
+        let _guard = ASYNC_LOCK.lock().unwrap();
+        test_load(vec![
+            "foo=bar=?",                                // vec length
+            "foo=bar",                                  // flag not save
+            "INIT_btaa_hci=not_false",                  // parse error but has default value
+            "INIT_gatt_robust_caching_server=not_true", // parse error
+        ]);
+        assert!(btaa_hci_is_enabled());
+        assert!(!gatt_robust_caching_server_is_enabled());
+    }
+    #[test]
+    fn int_flag() {
+        let _guard = ASYNC_LOCK.lock().unwrap();
+        test_load(vec!["--hci=2"]);
+        assert_eq!(get_hci_adapter(), 2);
+    }
+    #[test]
+    fn explicit_flag() {
+        let _guard = ASYNC_LOCK.lock().unwrap();
+        test_load(vec![
+            "INIT_logging_debug_enabled_for_all=true",
+            "INIT_logging_debug_enabled_for_tags=foo,bar",
+            "INIT_logging_debug_disabled_for_tags=foo,bar2",
+            "INIT_logging_debug_enabled_for_tags=bar2",
+        ]);
+        assert!(!is_debug_logging_enabled_for_tag("foo"));
+        assert!(is_debug_logging_enabled_for_tag("bar"));
+        assert!(is_debug_logging_enabled_for_tag("bar2"));
+        assert!(is_debug_logging_enabled_for_tag("unknown_flag"));
+        assert!(logging_debug_enabled_for_all_is_enabled());
+        FLAGS.lock().unwrap().logging_debug_enabled_for_all = false;
+        assert!(!is_debug_logging_enabled_for_tag("foo"));
+        assert!(is_debug_logging_enabled_for_tag("bar"));
+        assert!(is_debug_logging_enabled_for_tag("bar2"));
+        assert!(!is_debug_logging_enabled_for_tag("unknown_flag"));
+        assert!(!logging_debug_enabled_for_all_is_enabled());
+    }
+}
diff --git a/system/gd/rust/packets/build.rs b/system/gd/rust/packets/build.rs
index 0e58cbf..030fd67 100644
--- a/system/gd/rust/packets/build.rs
+++ b/system/gd/rust/packets/build.rs
@@ -18,7 +18,21 @@
 use std::process::Command;
 
 fn main() {
-    generate_packets();
+    let packets_prebuilt = match env::var("HCI_PACKETS_PREBUILT") {
+        Ok(dir) => PathBuf::from(dir),
+        Err(_) => PathBuf::from("hci_packets.rs"),
+    };
+    if Path::new(packets_prebuilt.as_os_str()).exists() {
+        let out_dir = PathBuf::from(env::var("OUT_DIR").unwrap());
+        let outputted = out_dir.join("../../hci/hci_packets.rs");
+        std::fs::copy(
+            packets_prebuilt.as_os_str().to_str().unwrap(),
+            out_dir.join(outputted.file_name().unwrap()).as_os_str().to_str().unwrap(),
+        )
+        .unwrap();
+    } else {
+        generate_packets();
+    }
 }
 
 fn generate_packets() {
@@ -40,10 +54,14 @@
     };
 
     if !Path::new(packetgen.as_os_str()).exists() {
-        panic!("Unable to locate bluetooth packet generator:{:?}", packetgen.as_os_str().to_str().unwrap());
+        panic!(
+            "Unable to locate bluetooth packet generator:{:?}",
+            packetgen.as_os_str().to_str().unwrap()
+        );
     }
 
     for i in 0..input_files.len() {
+        println!("cargo:rerun-if-changed={}", input_files[i].display());
         let output = Command::new(packetgen.as_os_str().to_str().unwrap())
             .arg("--source_root=".to_owned() + gd_root.as_os_str().to_str().unwrap())
             .arg("--out=".to_owned() + out_dir.as_os_str().to_str().unwrap())
diff --git a/system/gd/rust/shim/src/init_flags.rs b/system/gd/rust/shim/src/init_flags.rs
index 1a1cea1..6132666 100644
--- a/system/gd/rust/shim/src/init_flags.rs
+++ b/system/gd/rust/shim/src/init_flags.rs
@@ -4,15 +4,31 @@
         fn load(flags: Vec<String>);
         fn set_all_for_testing();
 
-        fn gd_core_is_enabled() -> bool;
-        fn gd_security_is_enabled() -> bool;
-        fn gd_l2cap_is_enabled() -> bool;
+        fn always_send_services_if_gatt_disc_done_is_enabled() -> bool;
+        fn asynchronously_start_l2cap_coc_is_enabled() -> bool;
+        fn btaa_hci_is_enabled() -> bool;
+        fn bta_dm_clear_conn_id_on_client_close_is_enabled() -> bool;
+        fn btm_dm_flush_discovery_queue_on_search_cancel_is_enabled() -> bool;
+        fn delay_hidh_cleanup_until_hidh_ready_start_is_enabled() -> bool;
+        fn clear_hidd_interrupt_cid_on_disconnect_is_enabled() -> bool;
+        fn finite_att_timeout_is_enabled() -> bool;
         fn gatt_robust_caching_client_is_enabled() -> bool;
         fn gatt_robust_caching_server_is_enabled() -> bool;
-        fn btaa_hci_is_enabled() -> bool;
-        fn gd_rust_is_enabled() -> bool;
+        fn gd_core_is_enabled() -> bool;
+        fn gd_l2cap_is_enabled() -> bool;
         fn gd_link_policy_is_enabled() -> bool;
+        fn gd_rust_is_enabled() -> bool;
+        fn gd_security_is_enabled() -> bool;
+        fn get_hci_adapter() -> i32;
         fn irk_rotation_is_enabled() -> bool;
+        fn is_debug_logging_enabled_for_tag(tag: &str) -> bool;
+        fn leaudio_targeted_announcement_reconnection_mode_is_enabled() -> bool;
+        fn logging_debug_enabled_for_all_is_enabled() -> bool;
+        fn pass_phy_update_callback_is_enabled() -> bool;
+        fn queue_l2cap_coc_while_encrypting_is_enabled() -> bool;
+        fn sdp_serialization_is_enabled() -> bool;
+        fn sdp_skip_rnr_if_known_is_enabled() -> bool;
+        fn trigger_advertising_callbacks_on_first_resume_after_pause_is_enabled() -> bool;
     }
 }
 
diff --git a/system/gd/rust/topshim/facade/Android.bp b/system/gd/rust/topshim/facade/Android.bp
index 5d2b06b..058b781 100644
--- a/system/gd/rust/topshim/facade/Android.bp
+++ b/system/gd/rust/topshim/facade/Android.bp
@@ -55,6 +55,7 @@
         "libFraunhoferAAC",
         "libg722codec",
         "liblc3",
+        "libopus",
         "libudrv-uipc",
         "libbluetooth_gd", // Gabeldorsche
         "libbluetooth-dumpsys",
diff --git a/system/gd/rust/topshim/gatt/gatt_ble_scanner_shim.cc b/system/gd/rust/topshim/gatt/gatt_ble_scanner_shim.cc
index be14307..9739a7f 100644
--- a/system/gd/rust/topshim/gatt/gatt_ble_scanner_shim.cc
+++ b/system/gd/rust/topshim/gatt/gatt_ble_scanner_shim.cc
@@ -59,6 +59,7 @@
       .name = name,
       .company = command.company,
       .company_mask = command.company_mask,
+      .ad_type = command.ad_type,
       .data = data,
       .data_mask = data_mask,
       .irk = irk,
diff --git a/system/gd/rust/topshim/src/profiles/gatt.rs b/system/gd/rust/topshim/src/profiles/gatt.rs
index d615a85..54e5a83 100644
--- a/system/gd/rust/topshim/src/profiles/gatt.rs
+++ b/system/gd/rust/topshim/src/profiles/gatt.rs
@@ -77,6 +77,7 @@
         name: Vec<u8>,
         company: u16,
         company_mask: u16,
+        ad_type: u8,
         data: Vec<u8>,
         data_mask: Vec<u8>,
         irk: [u8; 16],
diff --git a/system/gd/shim/dumpsys.cc b/system/gd/shim/dumpsys.cc
index a850236..92dcb98 100644
--- a/system/gd/shim/dumpsys.cc
+++ b/system/gd/shim/dumpsys.cc
@@ -102,7 +102,9 @@
     return std::string(buf);
   }
 
-  flatbuffers::Parser parser;
+  flatbuffers::IDLOptions options{};
+  options.output_default_scalars_in_json = true;
+  flatbuffers::Parser parser{options};
   if (!parser.Deserialize(schema)) {
     char buf[255];
     snprintf(buf, sizeof(buf), "ERROR: Unable to deserialize bundle root name:%s\n", root_name.c_str());
diff --git a/system/gd/stack_manager_unittest.cc b/system/gd/stack_manager_unittest.cc
index 824675e..51645ea 100644
--- a/system/gd/stack_manager_unittest.cc
+++ b/system/gd/stack_manager_unittest.cc
@@ -22,7 +22,7 @@
 namespace bluetooth {
 namespace {
 
-TEST(StackManagerTest, start_and_shutdown_no_module) {
+TEST(StackManagerTest, DISABLED_start_and_shutdown_no_module) {
   StackManager stack_manager;
   ModuleList module_list;
   os::Thread thread{"test_thread", os::Thread::Priority::NORMAL};
@@ -45,7 +45,7 @@
 
 const ModuleFactory TestModuleNoDependency::Factory = ModuleFactory([]() { return new TestModuleNoDependency(); });
 
-TEST(StackManagerTest, get_module_instance) {
+TEST(StackManagerTest, DISABLED_get_module_instance) {
   StackManager stack_manager;
   ModuleList module_list;
   module_list.add<TestModuleNoDependency>();
diff --git a/system/gd/storage/adapter_config.h b/system/gd/storage/adapter_config.h
index 228a394..97c8ee8 100644
--- a/system/gd/storage/adapter_config.h
+++ b/system/gd/storage/adapter_config.h
@@ -45,7 +45,13 @@
     return !(*this == other);
   }
   bool operator<(const AdapterConfig& other) const {
-    return config_ < other.config_ && memory_only_config_ < other.memory_only_config_ && section_ < other.section_;
+    if (config_ != other.config_) {
+      return config_ < other.config_;
+    }
+    if (memory_only_config_ != other.memory_only_config_) {
+      return memory_only_config_ < other.memory_only_config_;
+    }
+    return section_ < other.section_;
   }
   bool operator>(const AdapterConfig& rhs) const {
     return (rhs < *this);
diff --git a/system/gd/storage/adapter_config_test.cc b/system/gd/storage/adapter_config_test.cc
index e3c3791..eede771 100644
--- a/system/gd/storage/adapter_config_test.cc
+++ b/system/gd/storage/adapter_config_test.cc
@@ -61,3 +61,99 @@
   ASSERT_NE(adapter_config_1, adapter_config_3);
 }
 
+TEST(AdapterConfigTest, operator_less_than) {
+  ConfigCache config1(10, Device::kLinkKeyProperties);
+  ConfigCache config2(10, Device::kLinkKeyProperties);
+  ASSERT_NE(&config1, &config2);
+  ConfigCache* smaller_config_ptr = &config1;
+  ConfigCache* larger_config_ptr = &config2;
+  if (&config2 < &config1) {
+    smaller_config_ptr = &config2;
+    larger_config_ptr = &config1;
+  }
+
+  ConfigCache memory_only_config1(10, {});
+  ConfigCache memory_only_config2(10, {});
+  ASSERT_NE(&memory_only_config1, &memory_only_config2);
+  ConfigCache* smaller_memory_only_config_ptr = &memory_only_config1;
+  ConfigCache* larger_memory_only_config_ptr = &memory_only_config2;
+  if (&memory_only_config2 < &memory_only_config1) {
+    smaller_memory_only_config_ptr = &memory_only_config2;
+    larger_memory_only_config_ptr = &memory_only_config1;
+  }
+
+  bluetooth::hci::Address smaller_address = {{0x01, 0x02, 0x03, 0x04, 0x05, 0x06}};
+  bluetooth::hci::Address larger_address = {{0x01, 0x02, 0x03, 0x04, 0x05, 0x07}};
+
+  {
+    AdapterConfig adapter_config1(smaller_config_ptr, smaller_memory_only_config_ptr, smaller_address.ToString());
+    AdapterConfig adapter_config2(larger_config_ptr, larger_memory_only_config_ptr, larger_address.ToString());
+    ASSERT_TRUE(adapter_config1 < adapter_config2);
+  }
+
+  {
+    AdapterConfig adapter_config1(larger_config_ptr, smaller_memory_only_config_ptr, smaller_address.ToString());
+    AdapterConfig adapter_config2(smaller_config_ptr, larger_memory_only_config_ptr, larger_address.ToString());
+    ASSERT_FALSE(adapter_config1 < adapter_config2);
+  }
+
+  {
+    AdapterConfig adapter_config1(smaller_config_ptr, larger_memory_only_config_ptr, smaller_address.ToString());
+    AdapterConfig adapter_config2(larger_config_ptr, smaller_memory_only_config_ptr, larger_address.ToString());
+    ASSERT_TRUE(adapter_config1 < adapter_config2);
+  }
+
+  {
+    AdapterConfig adapter_config1(smaller_config_ptr, smaller_memory_only_config_ptr, larger_address.ToString());
+    AdapterConfig adapter_config2(larger_config_ptr, larger_memory_only_config_ptr, smaller_address.ToString());
+    ASSERT_TRUE(adapter_config1 < adapter_config2);
+  }
+
+  {
+    AdapterConfig adapter_config1(larger_config_ptr, larger_memory_only_config_ptr, smaller_address.ToString());
+    AdapterConfig adapter_config2(smaller_config_ptr, smaller_memory_only_config_ptr, larger_address.ToString());
+    ASSERT_FALSE(adapter_config1 < adapter_config2);
+  }
+
+  {
+    AdapterConfig adapter_config1(larger_config_ptr, larger_memory_only_config_ptr, larger_address.ToString());
+    AdapterConfig adapter_config2(smaller_config_ptr, smaller_memory_only_config_ptr, smaller_address.ToString());
+    ASSERT_FALSE(adapter_config1 < adapter_config2);
+  }
+
+  {
+    AdapterConfig adapter_config1(smaller_config_ptr, larger_memory_only_config_ptr, larger_address.ToString());
+    AdapterConfig adapter_config2(larger_config_ptr, smaller_memory_only_config_ptr, smaller_address.ToString());
+    ASSERT_TRUE(adapter_config1 < adapter_config2);
+  }
+
+  {
+    AdapterConfig adapter_config1(larger_config_ptr, smaller_memory_only_config_ptr, larger_address.ToString());
+    AdapterConfig adapter_config2(smaller_config_ptr, larger_memory_only_config_ptr, smaller_address.ToString());
+    ASSERT_FALSE(adapter_config1 < adapter_config2);
+  }
+
+  {
+    AdapterConfig adapter_config1(smaller_config_ptr, smaller_memory_only_config_ptr, smaller_address.ToString());
+    AdapterConfig adapter_config2(smaller_config_ptr, larger_memory_only_config_ptr, smaller_address.ToString());
+    ASSERT_TRUE(adapter_config1 < adapter_config2);
+  }
+
+  {
+    AdapterConfig adapter_config1(smaller_config_ptr, smaller_memory_only_config_ptr, smaller_address.ToString());
+    AdapterConfig adapter_config2(smaller_config_ptr, smaller_memory_only_config_ptr, larger_address.ToString());
+    ASSERT_TRUE(adapter_config1 < adapter_config2);
+  }
+
+  {
+    AdapterConfig adapter_config1(smaller_config_ptr, smaller_memory_only_config_ptr, smaller_address.ToString());
+    AdapterConfig adapter_config2(larger_config_ptr, smaller_memory_only_config_ptr, smaller_address.ToString());
+    ASSERT_TRUE(adapter_config1 < adapter_config2);
+  }
+
+  {
+    AdapterConfig adapter_config1(smaller_config_ptr, smaller_memory_only_config_ptr, smaller_address.ToString());
+    AdapterConfig adapter_config2(smaller_config_ptr, larger_memory_only_config_ptr, larger_address.ToString());
+    ASSERT_TRUE(adapter_config1 < adapter_config2);
+  }
+}
diff --git a/system/gd/storage/classic_device.h b/system/gd/storage/classic_device.h
index 3e98743..e0fad9f 100644
--- a/system/gd/storage/classic_device.h
+++ b/system/gd/storage/classic_device.h
@@ -49,7 +49,13 @@
     return !(*this == other);
   }
   bool operator<(const ClassicDevice& other) const {
-    return config_ < other.config_ && memory_only_config_ < other.memory_only_config_ && section_ < other.section_;
+    if (config_ != other.config_) {
+      return config_ < other.config_;
+    }
+    if (memory_only_config_ != other.memory_only_config_) {
+      return memory_only_config_ < other.memory_only_config_;
+    }
+    return section_ < other.section_;
   }
   bool operator>(const ClassicDevice& rhs) const {
     return (rhs < *this);
diff --git a/system/gd/storage/classic_device_test.cc b/system/gd/storage/classic_device_test.cc
index 751ee79..fd5654a 100644
--- a/system/gd/storage/classic_device_test.cc
+++ b/system/gd/storage/classic_device_test.cc
@@ -65,3 +65,99 @@
   ASSERT_NE(device1, device3);
 }
 
+TEST(ClassicDeviceTest, operator_less_than) {
+  ConfigCache config1(10, Device::kLinkKeyProperties);
+  ConfigCache config2(10, Device::kLinkKeyProperties);
+  ASSERT_NE(&config1, &config2);
+  ConfigCache* smaller_config_ptr = &config1;
+  ConfigCache* larger_config_ptr = &config2;
+  if (&config2 < &config1) {
+    smaller_config_ptr = &config2;
+    larger_config_ptr = &config1;
+  }
+
+  ConfigCache memory_only_config1(10, {});
+  ConfigCache memory_only_config2(10, {});
+  ASSERT_NE(&memory_only_config1, &memory_only_config2);
+  ConfigCache* smaller_memory_only_config_ptr = &memory_only_config1;
+  ConfigCache* larger_memory_only_config_ptr = &memory_only_config2;
+  if (&memory_only_config2 < &memory_only_config1) {
+    smaller_memory_only_config_ptr = &memory_only_config2;
+    larger_memory_only_config_ptr = &memory_only_config1;
+  }
+
+  bluetooth::hci::Address smaller_address = {{0x01, 0x02, 0x03, 0x04, 0x05, 0x06}};
+  bluetooth::hci::Address larger_address = {{0x01, 0x02, 0x03, 0x04, 0x05, 0x07}};
+
+  {
+    ClassicDevice device1(smaller_config_ptr, smaller_memory_only_config_ptr, smaller_address.ToString());
+    ClassicDevice device2(larger_config_ptr, larger_memory_only_config_ptr, larger_address.ToString());
+    ASSERT_TRUE(device1 < device2);
+  }
+
+  {
+    ClassicDevice device1(larger_config_ptr, smaller_memory_only_config_ptr, smaller_address.ToString());
+    ClassicDevice device2(smaller_config_ptr, larger_memory_only_config_ptr, larger_address.ToString());
+    ASSERT_FALSE(device1 < device2);
+  }
+
+  {
+    ClassicDevice device1(smaller_config_ptr, larger_memory_only_config_ptr, smaller_address.ToString());
+    ClassicDevice device2(larger_config_ptr, smaller_memory_only_config_ptr, larger_address.ToString());
+    ASSERT_TRUE(device1 < device2);
+  }
+
+  {
+    ClassicDevice device1(smaller_config_ptr, smaller_memory_only_config_ptr, larger_address.ToString());
+    ClassicDevice device2(larger_config_ptr, larger_memory_only_config_ptr, smaller_address.ToString());
+    ASSERT_TRUE(device1 < device2);
+  }
+
+  {
+    ClassicDevice device1(larger_config_ptr, larger_memory_only_config_ptr, smaller_address.ToString());
+    ClassicDevice device2(smaller_config_ptr, smaller_memory_only_config_ptr, larger_address.ToString());
+    ASSERT_FALSE(device1 < device2);
+  }
+
+  {
+    ClassicDevice device1(larger_config_ptr, larger_memory_only_config_ptr, larger_address.ToString());
+    ClassicDevice device2(smaller_config_ptr, smaller_memory_only_config_ptr, smaller_address.ToString());
+    ASSERT_FALSE(device1 < device2);
+  }
+
+  {
+    ClassicDevice device1(smaller_config_ptr, larger_memory_only_config_ptr, larger_address.ToString());
+    ClassicDevice device2(larger_config_ptr, smaller_memory_only_config_ptr, smaller_address.ToString());
+    ASSERT_TRUE(device1 < device2);
+  }
+
+  {
+    ClassicDevice device1(larger_config_ptr, smaller_memory_only_config_ptr, larger_address.ToString());
+    ClassicDevice device2(smaller_config_ptr, larger_memory_only_config_ptr, smaller_address.ToString());
+    ASSERT_FALSE(device1 < device2);
+  }
+
+  {
+    ClassicDevice device1(smaller_config_ptr, smaller_memory_only_config_ptr, smaller_address.ToString());
+    ClassicDevice device2(smaller_config_ptr, larger_memory_only_config_ptr, smaller_address.ToString());
+    ASSERT_TRUE(device1 < device2);
+  }
+
+  {
+    ClassicDevice device1(smaller_config_ptr, smaller_memory_only_config_ptr, smaller_address.ToString());
+    ClassicDevice device2(smaller_config_ptr, smaller_memory_only_config_ptr, larger_address.ToString());
+    ASSERT_TRUE(device1 < device2);
+  }
+
+  {
+    ClassicDevice device1(smaller_config_ptr, smaller_memory_only_config_ptr, smaller_address.ToString());
+    ClassicDevice device2(larger_config_ptr, smaller_memory_only_config_ptr, smaller_address.ToString());
+    ASSERT_TRUE(device1 < device2);
+  }
+
+  {
+    ClassicDevice device1(smaller_config_ptr, smaller_memory_only_config_ptr, smaller_address.ToString());
+    ClassicDevice device2(smaller_config_ptr, larger_memory_only_config_ptr, larger_address.ToString());
+    ASSERT_TRUE(device1 < device2);
+  }
+}
diff --git a/system/gd/storage/config_cache.cc b/system/gd/storage/config_cache.cc
index b1dc1bd..3ca9120 100644
--- a/system/gd/storage/config_cache.cc
+++ b/system/gd/storage/config_cache.cc
@@ -176,9 +176,9 @@
 
 void ConfigCache::SetProperty(std::string section, std::string property, std::string value) {
   std::lock_guard<std::recursive_mutex> lock(mutex_);
-  if (TrimAfterNewLine(section) || TrimAfterNewLine(property) || TrimAfterNewLine(value)) {
-    android_errorWriteLog(0x534e4554, "70808273");
-  }
+  TrimAfterNewLine(section);
+  TrimAfterNewLine(property);
+  TrimAfterNewLine(value);
   ASSERT_LOG(!section.empty(), "Empty section name not allowed");
   ASSERT_LOG(!property.empty(), "Empty property name not allowed");
   if (!IsDeviceSection(section)) {
@@ -420,6 +420,16 @@
   if (!hci::Address::IsValidAddress(section_name)) {
     return false;
   }
+  auto device_type_iter = device_section_entries.find("DevType");
+  if (device_type_iter != device_section_entries.end() &&
+      device_type_iter->second == std::to_string(hci::DeviceType::DUAL)) {
+    // We might only have one of classic/LE keys for a dual device, but it is still a dual device,
+    // so we should not change the DevType.
+    return false;
+  }
+
+  // we will ignore the existing DevType, since it is not known to be a DUAL device so
+  // the keys we have should be sufficient to infer the correct DevType
   bool is_le = false;
   bool is_classic = false;
   // default
@@ -441,11 +451,10 @@
   }
   bool inconsistent = true;
   std::string device_type_str = std::to_string(device_type);
-  auto it = device_section_entries.find("DevType");
-  if (it != device_section_entries.end()) {
-    inconsistent = device_type_str != it->second;
+  if (device_type_iter != device_section_entries.end()) {
+    inconsistent = device_type_str != device_type_iter->second;
     if (inconsistent) {
-      it->second = std::move(device_type_str);
+      device_type_iter->second = std::move(device_type_str);
     }
   } else {
     device_section_entries.insert_or_assign("DevType", std::move(device_type_str));
diff --git a/system/gd/storage/config_cache_test.cc b/system/gd/storage/config_cache_test.cc
index bec056f..29773db 100644
--- a/system/gd/storage/config_cache_test.cc
+++ b/system/gd/storage/config_cache_test.cc
@@ -275,34 +275,110 @@
   ASSERT_EQ(num_change, 4);
 }
 
-TEST(ConfigCacheTest, fix_device_type_inconsistency_test) {
+TEST(ConfigCacheTest, fix_device_type_inconsistency_missing_devtype_no_keys_test) {
   ConfigCache config(100, Device::kLinkKeyProperties);
   config.SetProperty("A", "B", "C");
   config.SetProperty("AA:BB:CC:DD:EE:FF", "B", "C");
   config.SetProperty("AA:BB:CC:DD:EE:FF", "C", "D");
-  ASSERT_TRUE(config.FixDeviceTypeInconsistencies());
+
+  auto hadInconsistencies = config.FixDeviceTypeInconsistencies();
+
+  ASSERT_TRUE(hadInconsistencies);
   ASSERT_THAT(
       config.GetProperty("AA:BB:CC:DD:EE:FF", "DevType"),
       Optional(StrEq(std::to_string(bluetooth::hci::DeviceType::BR_EDR))));
+}
+
+TEST(ConfigCacheTest, fix_device_type_inconsistency_consistent_devtype_test) {
+  // arrange
+  ConfigCache config(100, Device::kLinkKeyProperties);
+  config.SetProperty("A", "B", "C");
+  config.SetProperty("AA:BB:CC:DD:EE:FF", "B", "C");
+  config.SetProperty("AA:BB:CC:DD:EE:FF", "C", "D");
+  config.SetProperty("AA:BB:CC:DD:EE:FF", "DevType", std::to_string(bluetooth::hci::DeviceType::BR_EDR));
+
   config.SetProperty("CC:DD:EE:FF:00:11", "B", "AABBAABBCCDDEE");
   config.SetProperty("CC:DD:EE:FF:00:11", "DevType", std::to_string(bluetooth::hci::DeviceType::BR_EDR));
   config.SetProperty("CC:DD:EE:FF:00:11", "LinkKey", "AABBAABBCCDDEE");
-  ASSERT_FALSE(config.FixDeviceTypeInconsistencies());
+
+  // act
+  auto hadInconsistencies = config.FixDeviceTypeInconsistencies();
+
+  // assert
+  ASSERT_FALSE(hadInconsistencies);
   ASSERT_THAT(
       config.GetProperty("CC:DD:EE:FF:00:11", "DevType"),
       Optional(StrEq(std::to_string(bluetooth::hci::DeviceType::BR_EDR))));
+}
+
+TEST(ConfigCacheTest, fix_device_type_inconsistency_devtype_should_be_dual_test) {
+  // arrange
+  ConfigCache config(100, Device::kLinkKeyProperties);
+  config.SetProperty("A", "B", "C");
+  config.SetProperty("AA:BB:CC:DD:EE:FF", "B", "C");
+  config.SetProperty("AA:BB:CC:DD:EE:FF", "C", "D");
+  config.SetProperty("AA:BB:CC:DD:EE:FF", "DevType", std::to_string(bluetooth::hci::DeviceType::BR_EDR));
+
+  config.SetProperty("CC:DD:EE:FF:00:11", "B", "AABBAABBCCDDEE");
+  config.SetProperty("CC:DD:EE:FF:00:11", "DevType", std::to_string(bluetooth::hci::DeviceType::BR_EDR));
+  config.SetProperty("CC:DD:EE:FF:00:11", "LinkKey", "AABBAABBCCDDEE");
   config.SetProperty("CC:DD:EE:FF:00:11", "LE_KEY_PENC", "AABBAABBCCDDEE");
-  ASSERT_TRUE(config.FixDeviceTypeInconsistencies());
+
+  // act
+  auto hadInconsistencies = config.FixDeviceTypeInconsistencies();
+
+  // assert
+  ASSERT_TRUE(hadInconsistencies);
   ASSERT_THAT(
       config.GetProperty("CC:DD:EE:FF:00:11", "DevType"),
       Optional(StrEq(std::to_string(bluetooth::hci::DeviceType::DUAL))));
-  config.RemoveProperty("CC:DD:EE:FF:00:11", "LinkKey");
-  ASSERT_TRUE(config.FixDeviceTypeInconsistencies());
+}
+
+TEST(ConfigCacheTest, fix_device_type_inconsistency_devtype_should_be_le_not_classic_test) {
+  // arrange
+  ConfigCache config(100, Device::kLinkKeyProperties);
+  config.SetProperty("A", "B", "C");
+  config.SetProperty("AA:BB:CC:DD:EE:FF", "B", "C");
+  config.SetProperty("AA:BB:CC:DD:EE:FF", "C", "D");
+  config.SetProperty("AA:BB:CC:DD:EE:FF", "DevType", std::to_string(bluetooth::hci::DeviceType::BR_EDR));
+
+  config.SetProperty("CC:DD:EE:FF:00:11", "B", "AABBAABBCCDDEE");
+  config.SetProperty("CC:DD:EE:FF:00:11", "DevType", std::to_string(bluetooth::hci::DeviceType::BR_EDR));
+  config.SetProperty("CC:DD:EE:FF:00:11", "LE_KEY_PENC", "AABBAABBCCDDEE");
+
+  // act
+  auto hadInconsistencies = config.FixDeviceTypeInconsistencies();
+
+  // assert
+  ASSERT_TRUE(hadInconsistencies);
   ASSERT_THAT(
       config.GetProperty("CC:DD:EE:FF:00:11", "DevType"),
       Optional(StrEq(std::to_string(bluetooth::hci::DeviceType::LE))));
 }
 
+TEST(ConfigCacheTest, fix_device_type_inconsistency_devtype_dont_override_dual_test) {
+  // arrange
+  ConfigCache config(100, Device::kLinkKeyProperties);
+  config.SetProperty("A", "B", "C");
+  config.SetProperty("AA:BB:CC:DD:EE:FF", "B", "C");
+  config.SetProperty("AA:BB:CC:DD:EE:FF", "C", "D");
+  config.SetProperty("AA:BB:CC:DD:EE:FF", "DevType", std::to_string(bluetooth::hci::DeviceType::BR_EDR));
+
+  config.SetProperty("CC:DD:EE:FF:00:11", "B", "AABBAABBCCDDEE");
+  config.SetProperty("CC:DD:EE:FF:00:11", "DevType", std::to_string(bluetooth::hci::DeviceType::DUAL));
+  config.SetProperty("CC:DD:EE:FF:00:11", "LinkKey", "AABBAABBCCDDEE");
+  config.SetProperty("CC:DD:EE:FF:00:11", "LE_KEY_PENC", "AABBAABBCCDDEE");
+
+  // act
+  auto hadInconsistencies = config.FixDeviceTypeInconsistencies();
+
+  // assert
+  ASSERT_FALSE(hadInconsistencies);
+  ASSERT_THAT(
+      config.GetProperty("CC:DD:EE:FF:00:11", "DevType"),
+      Optional(StrEq(std::to_string(bluetooth::hci::DeviceType::DUAL))));
+}
+
 TEST(ConfigCacheTest, test_get_section_with_property) {
   ConfigCache config(100, Device::kLinkKeyProperties);
   config.SetProperty("A", "B", "C");
diff --git a/system/gd/storage/device.h b/system/gd/storage/device.h
index e610f57..e1b5fd9 100644
--- a/system/gd/storage/device.h
+++ b/system/gd/storage/device.h
@@ -132,7 +132,13 @@
     return !(*this == other);
   }
   bool operator<(const Device& other) const {
-    return config_ < other.config_ && memory_only_config_ < other.memory_only_config_ && section_ < other.section_;
+    if (config_ != other.config_) {
+      return config_ < other.config_;
+    }
+    if (memory_only_config_ != other.memory_only_config_) {
+      return memory_only_config_ < other.memory_only_config_;
+    }
+    return section_ < other.section_;
   }
   bool operator>(const Device& rhs) const {
     return (rhs < *this);
diff --git a/system/gd/storage/device_test.cc b/system/gd/storage/device_test.cc
index 0706403..307f403 100644
--- a/system/gd/storage/device_test.cc
+++ b/system/gd/storage/device_test.cc
@@ -237,3 +237,99 @@
   ASSERT_FALSE(config.GetProperty(address.ToString(), "Name"));
 }
 
+TEST(DeviceTest, operator_less_than) {
+  ConfigCache config1(10, Device::kLinkKeyProperties);
+  ConfigCache config2(10, Device::kLinkKeyProperties);
+  ASSERT_NE(&config1, &config2);
+  ConfigCache* smaller_config_ptr = &config1;
+  ConfigCache* larger_config_ptr = &config2;
+  if (&config2 < &config1) {
+    smaller_config_ptr = &config2;
+    larger_config_ptr = &config1;
+  }
+
+  ConfigCache memory_only_config1(10, {});
+  ConfigCache memory_only_config2(10, {});
+  ASSERT_NE(&memory_only_config1, &memory_only_config2);
+  ConfigCache* smaller_memory_only_config_ptr = &memory_only_config1;
+  ConfigCache* larger_memory_only_config_ptr = &memory_only_config2;
+  if (&memory_only_config2 < &memory_only_config1) {
+    smaller_memory_only_config_ptr = &memory_only_config2;
+    larger_memory_only_config_ptr = &memory_only_config1;
+  }
+
+  bluetooth::hci::Address smaller_address = {{0x01, 0x02, 0x03, 0x04, 0x05, 0x06}};
+  bluetooth::hci::Address larger_address = {{0x01, 0x02, 0x03, 0x04, 0x05, 0x07}};
+
+  {
+    Device device1(smaller_config_ptr, smaller_memory_only_config_ptr, smaller_address.ToString());
+    Device device2(larger_config_ptr, larger_memory_only_config_ptr, larger_address.ToString());
+    ASSERT_TRUE(device1 < device2);
+  }
+
+  {
+    Device device1(larger_config_ptr, smaller_memory_only_config_ptr, smaller_address.ToString());
+    Device device2(smaller_config_ptr, larger_memory_only_config_ptr, larger_address.ToString());
+    ASSERT_FALSE(device1 < device2);
+  }
+
+  {
+    Device device1(smaller_config_ptr, larger_memory_only_config_ptr, smaller_address.ToString());
+    Device device2(larger_config_ptr, smaller_memory_only_config_ptr, larger_address.ToString());
+    ASSERT_TRUE(device1 < device2);
+  }
+
+  {
+    Device device1(smaller_config_ptr, smaller_memory_only_config_ptr, larger_address.ToString());
+    Device device2(larger_config_ptr, larger_memory_only_config_ptr, smaller_address.ToString());
+    ASSERT_TRUE(device1 < device2);
+  }
+
+  {
+    Device device1(larger_config_ptr, larger_memory_only_config_ptr, smaller_address.ToString());
+    Device device2(smaller_config_ptr, smaller_memory_only_config_ptr, larger_address.ToString());
+    ASSERT_FALSE(device1 < device2);
+  }
+
+  {
+    Device device1(larger_config_ptr, larger_memory_only_config_ptr, larger_address.ToString());
+    Device device2(smaller_config_ptr, smaller_memory_only_config_ptr, smaller_address.ToString());
+    ASSERT_FALSE(device1 < device2);
+  }
+
+  {
+    Device device1(smaller_config_ptr, larger_memory_only_config_ptr, larger_address.ToString());
+    Device device2(larger_config_ptr, smaller_memory_only_config_ptr, smaller_address.ToString());
+    ASSERT_TRUE(device1 < device2);
+  }
+
+  {
+    Device device1(larger_config_ptr, smaller_memory_only_config_ptr, larger_address.ToString());
+    Device device2(smaller_config_ptr, larger_memory_only_config_ptr, smaller_address.ToString());
+    ASSERT_FALSE(device1 < device2);
+  }
+
+  {
+    Device device1(smaller_config_ptr, smaller_memory_only_config_ptr, smaller_address.ToString());
+    Device device2(smaller_config_ptr, larger_memory_only_config_ptr, smaller_address.ToString());
+    ASSERT_TRUE(device1 < device2);
+  }
+
+  {
+    Device device1(smaller_config_ptr, smaller_memory_only_config_ptr, smaller_address.ToString());
+    Device device2(smaller_config_ptr, smaller_memory_only_config_ptr, larger_address.ToString());
+    ASSERT_TRUE(device1 < device2);
+  }
+
+  {
+    Device device1(smaller_config_ptr, smaller_memory_only_config_ptr, smaller_address.ToString());
+    Device device2(larger_config_ptr, smaller_memory_only_config_ptr, smaller_address.ToString());
+    ASSERT_TRUE(device1 < device2);
+  }
+
+  {
+    Device device1(smaller_config_ptr, smaller_memory_only_config_ptr, smaller_address.ToString());
+    Device device2(smaller_config_ptr, larger_memory_only_config_ptr, larger_address.ToString());
+    ASSERT_TRUE(device1 < device2);
+  }
+}
diff --git a/system/gd/storage/le_device.h b/system/gd/storage/le_device.h
index 79e3045..aec4f30 100644
--- a/system/gd/storage/le_device.h
+++ b/system/gd/storage/le_device.h
@@ -48,7 +48,13 @@
     return !(*this == other);
   }
   bool operator<(const LeDevice& other) const {
-    return config_ < other.config_ && memory_only_config_ < other.memory_only_config_ && section_ < other.section_;
+    if (config_ != other.config_) {
+      return config_ < other.config_;
+    }
+    if (memory_only_config_ != other.memory_only_config_) {
+      return memory_only_config_ < other.memory_only_config_;
+    }
+    return section_ < other.section_;
   }
   bool operator>(const LeDevice& rhs) const {
     return (rhs < *this);
diff --git a/system/gd/storage/le_device_test.cc b/system/gd/storage/le_device_test.cc
index 407f489..2641356 100644
--- a/system/gd/storage/le_device_test.cc
+++ b/system/gd/storage/le_device_test.cc
@@ -65,3 +65,99 @@
   ASSERT_NE(device1, device3);
 }
 
+TEST(LeDeviceTest, operator_less_than) {
+  ConfigCache config1(10, Device::kLinkKeyProperties);
+  ConfigCache config2(10, Device::kLinkKeyProperties);
+  ASSERT_NE(&config1, &config2);
+  ConfigCache* smaller_config_ptr = &config1;
+  ConfigCache* larger_config_ptr = &config2;
+  if (&config2 < &config1) {
+    smaller_config_ptr = &config2;
+    larger_config_ptr = &config1;
+  }
+
+  ConfigCache memory_only_config1(10, {});
+  ConfigCache memory_only_config2(10, {});
+  ASSERT_NE(&memory_only_config1, &memory_only_config2);
+  ConfigCache* smaller_memory_only_config_ptr = &memory_only_config1;
+  ConfigCache* larger_memory_only_config_ptr = &memory_only_config2;
+  if (&memory_only_config2 < &memory_only_config1) {
+    smaller_memory_only_config_ptr = &memory_only_config2;
+    larger_memory_only_config_ptr = &memory_only_config1;
+  }
+
+  bluetooth::hci::Address smaller_address = {{0x01, 0x02, 0x03, 0x04, 0x05, 0x06}};
+  bluetooth::hci::Address larger_address = {{0x01, 0x02, 0x03, 0x04, 0x05, 0x07}};
+
+  {
+    LeDevice device1(smaller_config_ptr, smaller_memory_only_config_ptr, smaller_address.ToString());
+    LeDevice device2(larger_config_ptr, larger_memory_only_config_ptr, larger_address.ToString());
+    ASSERT_TRUE(device1 < device2);
+  }
+
+  {
+    LeDevice device1(larger_config_ptr, smaller_memory_only_config_ptr, smaller_address.ToString());
+    LeDevice device2(smaller_config_ptr, larger_memory_only_config_ptr, larger_address.ToString());
+    ASSERT_FALSE(device1 < device2);
+  }
+
+  {
+    LeDevice device1(smaller_config_ptr, larger_memory_only_config_ptr, smaller_address.ToString());
+    LeDevice device2(larger_config_ptr, smaller_memory_only_config_ptr, larger_address.ToString());
+    ASSERT_TRUE(device1 < device2);
+  }
+
+  {
+    LeDevice device1(smaller_config_ptr, smaller_memory_only_config_ptr, larger_address.ToString());
+    LeDevice device2(larger_config_ptr, larger_memory_only_config_ptr, smaller_address.ToString());
+    ASSERT_TRUE(device1 < device2);
+  }
+
+  {
+    LeDevice device1(larger_config_ptr, larger_memory_only_config_ptr, smaller_address.ToString());
+    LeDevice device2(smaller_config_ptr, smaller_memory_only_config_ptr, larger_address.ToString());
+    ASSERT_FALSE(device1 < device2);
+  }
+
+  {
+    LeDevice device1(larger_config_ptr, larger_memory_only_config_ptr, larger_address.ToString());
+    LeDevice device2(smaller_config_ptr, smaller_memory_only_config_ptr, smaller_address.ToString());
+    ASSERT_FALSE(device1 < device2);
+  }
+
+  {
+    LeDevice device1(smaller_config_ptr, larger_memory_only_config_ptr, larger_address.ToString());
+    LeDevice device2(larger_config_ptr, smaller_memory_only_config_ptr, smaller_address.ToString());
+    ASSERT_TRUE(device1 < device2);
+  }
+
+  {
+    LeDevice device1(larger_config_ptr, smaller_memory_only_config_ptr, larger_address.ToString());
+    LeDevice device2(smaller_config_ptr, larger_memory_only_config_ptr, smaller_address.ToString());
+    ASSERT_FALSE(device1 < device2);
+  }
+
+  {
+    LeDevice device1(smaller_config_ptr, smaller_memory_only_config_ptr, smaller_address.ToString());
+    LeDevice device2(smaller_config_ptr, larger_memory_only_config_ptr, smaller_address.ToString());
+    ASSERT_TRUE(device1 < device2);
+  }
+
+  {
+    LeDevice device1(smaller_config_ptr, smaller_memory_only_config_ptr, smaller_address.ToString());
+    LeDevice device2(smaller_config_ptr, smaller_memory_only_config_ptr, larger_address.ToString());
+    ASSERT_TRUE(device1 < device2);
+  }
+
+  {
+    LeDevice device1(smaller_config_ptr, smaller_memory_only_config_ptr, smaller_address.ToString());
+    LeDevice device2(larger_config_ptr, smaller_memory_only_config_ptr, smaller_address.ToString());
+    ASSERT_TRUE(device1 < device2);
+  }
+
+  {
+    LeDevice device1(smaller_config_ptr, smaller_memory_only_config_ptr, smaller_address.ToString());
+    LeDevice device2(smaller_config_ptr, larger_memory_only_config_ptr, larger_address.ToString());
+    ASSERT_TRUE(device1 < device2);
+  }
+}
diff --git a/system/hci/Android.bp b/system/hci/Android.bp
index d9f9542..1553c25 100644
--- a/system/hci/Android.bp
+++ b/system/hci/Android.bp
@@ -91,28 +91,6 @@
     ],
 }
 
-// HCI native unit tests for target
-cc_test {
-    name: "net_test_hci_native",
-    test_suites: ["device-tests"],
-    defaults: [
-        "fluoride_unit_test_defaults",
-        "mts_defaults",
-    ],
-    local_include_dirs: [
-        "include",
-    ],
-    include_dirs: [
-        "packages/modules/Bluetooth/system",
-        "packages/modules/Bluetooth/system/gd",
-        "packages/modules/Bluetooth/system/stack/include",
-    ],
-    srcs: [
-        "test/hci_layer_test.cc",
-        "test/other_stack_stub.cc",
-    ],
-}
-
 cc_test {
     name: "net_test_hci_fragmenter_native",
     test_suites: ["device-tests"],
diff --git a/system/hci/src/packet_fragmenter.cc b/system/hci/src/packet_fragmenter.cc
index 4658676..629652c 100644
--- a/system/hci/src/packet_fragmenter.cc
+++ b/system/hci/src/packet_fragmenter.cc
@@ -412,7 +412,6 @@
 
     if (broadcast_flag != POINT_TO_POINT) {
       LOG_WARN("dropping broadcast packet");
-      android_errorWriteLog(0x534e4554, "169327567");
       buffer_allocator->free(packet);
       return;
     }
diff --git a/system/hci/test/other_stack_stub.cc b/system/hci/test/other_stack_stub.cc
deleted file mode 100644
index e69de29..0000000
--- a/system/hci/test/other_stack_stub.cc
+++ /dev/null
diff --git a/system/include/hardware/bluetooth.h b/system/include/hardware/bluetooth.h
index d8f80ab..4fbc628 100644
--- a/system/include/hardware/bluetooth.h
+++ b/system/include/hardware/bluetooth.h
@@ -788,6 +788,17 @@
    * Set the event filter for the controller
    */
   int (*clear_event_filter)();
+
+  /**
+   * Data passed from BluetoothDevice.metadata_changed
+   *
+   * @param remote_bd_addr remote address
+   * @param key Metadata key
+   * @param value Metadata value
+   */
+  void (*metadata_changed)(const RawAddress& remote_bd_addr, int key,
+                           std::vector<uint8_t> value);
+
 } bt_interface_t;
 
 #define BLUETOOTH_INTERFACE_STRING "bluetoothInterface"
diff --git a/system/include/hardware/bt_av.h b/system/include/hardware/bt_av.h
index 8a7234b..61dbe50 100644
--- a/system/include/hardware/bt_av.h
+++ b/system/include/hardware/bt_av.h
@@ -55,6 +55,8 @@
   BTAV_A2DP_CODEC_INDEX_SOURCE_APTX,
   BTAV_A2DP_CODEC_INDEX_SOURCE_APTX_HD,
   BTAV_A2DP_CODEC_INDEX_SOURCE_LDAC,
+  BTAV_A2DP_CODEC_INDEX_SOURCE_LC3,
+  BTAV_A2DP_CODEC_INDEX_SOURCE_OPUS,
 
   BTAV_A2DP_CODEC_INDEX_SOURCE_MAX,
 
@@ -64,6 +66,7 @@
   BTAV_A2DP_CODEC_INDEX_SINK_SBC = BTAV_A2DP_CODEC_INDEX_SINK_MIN,
   BTAV_A2DP_CODEC_INDEX_SINK_AAC,
   BTAV_A2DP_CODEC_INDEX_SINK_LDAC,
+  BTAV_A2DP_CODEC_INDEX_SINK_OPUS,
 
   BTAV_A2DP_CODEC_INDEX_SINK_MAX,
 
@@ -97,6 +100,14 @@
 } btav_a2dp_codec_sample_rate_t;
 
 typedef enum {
+  BTAV_A2DP_CODEC_FRAME_SIZE_NONE = 0x0,
+  BTAV_A2DP_CODEC_FRAME_SIZE_20MS = 0x1 << 0,
+  BTAV_A2DP_CODEC_FRAME_SIZE_15MS = 0x1 << 1,
+  BTAV_A2DP_CODEC_FRAME_SIZE_10MS = 0x1 << 2,
+  BTAV_A2DP_CODEC_FRAME_SIZE_75MS = 0x1 << 3,
+} btav_a2dp_codec_frame_size_t;
+
+typedef enum {
   BTAV_A2DP_CODEC_BITS_PER_SAMPLE_NONE = 0x0,
   BTAV_A2DP_CODEC_BITS_PER_SAMPLE_16 = 0x1 << 0,
   BTAV_A2DP_CODEC_BITS_PER_SAMPLE_24 = 0x1 << 1,
@@ -164,6 +175,15 @@
       case BTAV_A2DP_CODEC_INDEX_SINK_LDAC:
         codec_name_str = "LDAC (Sink)";
         break;
+      case BTAV_A2DP_CODEC_INDEX_SOURCE_LC3:
+        codec_name_str = "LC3";
+        break;
+      case BTAV_A2DP_CODEC_INDEX_SINK_OPUS:
+        codec_name_str = "Opus (Sink)";
+        break;
+      case BTAV_A2DP_CODEC_INDEX_SOURCE_OPUS:
+        codec_name_str = "Opus";
+        break;
       case BTAV_A2DP_CODEC_INDEX_MAX:
         codec_name_str = "Unknown(CODEC_INDEX_MAX)";
         break;
diff --git a/system/include/hardware/bt_common_types.h b/system/include/hardware/bt_common_types.h
index 9d9a454..243285f 100644
--- a/system/include/hardware/bt_common_types.h
+++ b/system/include/hardware/bt_common_types.h
@@ -101,6 +101,7 @@
   std::vector<uint8_t> name;
   uint16_t company;
   uint16_t company_mask;
+  uint8_t ad_type;
   std::vector<uint8_t> data;
   std::vector<uint8_t> data_mask;
   std::array<uint8_t, 16> irk;  // 128 bit/16 octet IRK
diff --git a/system/include/hardware/bt_hf_client.h b/system/include/hardware/bt_hf_client.h
index 7263805..bf8b1bb 100644
--- a/system/include/hardware/bt_hf_client.h
+++ b/system/include/hardware/bt_hf_client.h
@@ -392,6 +392,9 @@
   /** Send AT Command. */
   bt_status_t (*send_at_cmd)(const RawAddress* bd_addr, int cmd, int val1,
                              int val2, const char* arg);
+
+  /** Send hfp audio policy to remote */
+  bt_status_t (*send_android_at)(const RawAddress* bd_addr, const char* arg);
 } bthf_client_interface_t;
 
 __END_DECLS
diff --git a/system/include/hardware/bt_le_audio.h b/system/include/hardware/bt_le_audio.h
index 87766a3..978008b 100644
--- a/system/include/hardware/bt_le_audio.h
+++ b/system/include/hardware/bt_le_audio.h
@@ -37,6 +37,7 @@
 enum class GroupStatus {
   INACTIVE = 0,
   ACTIVE,
+  TURNED_IDLE_DURING_CALL,
 };
 
 enum class GroupStreamStatus {
@@ -152,6 +153,9 @@
 
   /* Set Ccid for context type */
   virtual void SetCcidInformation(int ccid, int context_type) = 0;
+
+  /* Set In call flag */
+  virtual void SetInCall(bool in_call) = 0;
 };
 
 /* Represents the broadcast source state. */
diff --git a/system/internal_include/Android.bp b/system/internal_include/Android.bp
index aca617f..cbc8c32 100644
--- a/system/internal_include/Android.bp
+++ b/system/internal_include/Android.bp
@@ -12,5 +12,9 @@
     export_include_dirs: ["./"],
     vendor_available: true,
     host_supported: true,
+    apex_available: [
+        "//apex_available:platform",
+        "com.android.bluetooth",
+    ],
     min_sdk_version: "30",
 }
diff --git a/system/internal_include/bt_target.h b/system/internal_include/bt_target.h
index 98787a3..0aab570 100644
--- a/system/internal_include/bt_target.h
+++ b/system/internal_include/bt_target.h
@@ -75,10 +75,6 @@
 #define BTA_HH_ROLE BTA_CENTRAL_ROLE_PREF
 #endif
 
-#ifndef BTA_DISABLE_DELAY
-#define BTA_DISABLE_DELAY 200 /* in milliseconds */
-#endif
-
 #ifndef AVDT_VERSION
 #define AVDT_VERSION 0x0103
 #endif
@@ -818,10 +814,6 @@
 #define PAN_INCLUDED TRUE
 #endif
 
-#ifndef PAN_NAP_DISABLED
-#define PAN_NAP_DISABLED FALSE
-#endif
-
 #ifndef PANU_DISABLED
 #define PANU_DISABLED FALSE
 #endif
@@ -974,10 +966,6 @@
  *
  *****************************************************************************/
 
-#ifndef AVRC_ADV_CTRL_INCLUDED
-#define AVRC_ADV_CTRL_INCLUDED TRUE
-#endif
-
 #ifndef DUMP_PCM_DATA
 #define DUMP_PCM_DATA FALSE
 #endif
@@ -1026,12 +1014,4 @@
 
 #include "bt_trace.h"
 
-#ifndef BTM_DELAY_AUTH_MS
-#define BTM_DELAY_AUTH_MS 0
-#endif
-
-#ifndef BTM_DISABLE_CONCURRENT_PEER_AUTH
-#define BTM_DISABLE_CONCURRENT_PEER_AUTH FALSE
-#endif
-
 #endif /* BT_TARGET_H */
diff --git a/system/internal_include/stack_config.h b/system/internal_include/stack_config.h
index 53dd186..efaec3f 100644
--- a/system/internal_include/stack_config.h
+++ b/system/internal_include/stack_config.h
@@ -38,6 +38,16 @@
   bool (*get_pts_connect_eatt_before_encryption)(void);
   bool (*get_pts_unencrypt_broadcast)(void);
   bool (*get_pts_eatt_peripheral_collision_support)(void);
+  bool (*get_pts_use_eatt_for_all_services)(void);
+  bool (*get_pts_force_le_audio_multiple_contexts_metadata)(void);
+  bool (*get_pts_l2cap_ecoc_upper_tester)(void);
+  int (*get_pts_l2cap_ecoc_min_key_size)(void);
+  int (*get_pts_l2cap_ecoc_initial_chan_cnt)(void);
+  bool (*get_pts_l2cap_ecoc_connect_remaining)(void);
+  int (*get_pts_l2cap_ecoc_send_num_of_sdu)(void);
+  bool (*get_pts_l2cap_ecoc_reconfigure)(void);
+  const std::string* (*get_pts_broadcast_audio_config_options)(void);
+  bool (*get_pts_le_audio_disable_ases_before_stopping)(void);
   config_t* (*get_all)(void);
 } stack_config_t;
 
diff --git a/system/linux_include/log/log.h b/system/linux_include/log/log.h
index 2802f77..b843970 100644
--- a/system/linux_include/log/log.h
+++ b/system/linux_include/log/log.h
@@ -17,17 +17,8 @@
  ******************************************************************************/
 #pragma once
 
-/* This file provides empty implementation of android_errorWriteLog, which is
- * not required on linux. It should be on include path only for linux build. */
-
 #if defined(OS_GENERIC)
 
 #include <cstdint>
 
-inline int android_errorWriteLog(int, const char*) { return 0; };
-inline int android_errorWriteWithInfoLog(int tag, const char* subTag,
-                                         int32_t uid, const char* data,
-                                         uint32_t dataLen) {
-  return 0;
-};
 #endif
diff --git a/system/main/shim/acl.cc b/system/main/shim/acl.cc
index 0d27c7d..e2f517a 100644
--- a/system/main/shim/acl.cc
+++ b/system/main/shim/acl.cc
@@ -33,6 +33,7 @@
 #include "device/include/controller.h"
 #include "gd/common/bidi_queue.h"
 #include "gd/common/bind.h"
+#include "gd/common/init_flags.h"
 #include "gd/common/strings.h"
 #include "gd/common/sync_map_count.h"
 #include "gd/hci/acl_manager.h"
@@ -61,6 +62,7 @@
 #include "stack/include/bt_hdr.h"
 #include "stack/include/btm_api.h"
 #include "stack/include/btm_status.h"
+#include "stack/include/gatt_api.h"
 #include "stack/include/pan_api.h"
 #include "stack/include/sec_hci_link_interface.h"
 #include "stack/l2cap/l2c_int.h"
@@ -753,9 +755,17 @@
 
   void OnPhyUpdate(hci::ErrorCode hci_status, uint8_t tx_phy,
                    uint8_t rx_phy) override {
-    TRY_POSTING_ON_MAIN(interface_.on_phy_update,
-                        ToLegacyHciErrorCode(hci_status), handle_, tx_phy,
-                        rx_phy);
+    if (common::init_flags::pass_phy_update_callback_is_enabled()) {
+      TRY_POSTING_ON_MAIN(
+          interface_.on_phy_update,
+          static_cast<tGATT_STATUS>(ToLegacyHciErrorCode(hci_status)), handle_,
+          tx_phy, rx_phy);
+    } else {
+      LOG_WARN(
+          "Not posting OnPhyUpdate callback since it is disabled: (tx:%x, "
+          "rx:%x, status:%s)",
+          tx_phy, rx_phy, hci::ErrorCodeText(hci_status).c_str());
+    }
   }
 
   void OnLocalAddressUpdate(hci::AddressWithType address_with_type) override {
@@ -1105,7 +1115,9 @@
 
   LOG_DUMPSYS_TITLE(fd, DUMPSYS_TAG);
 
-  shim::Stack::GetInstance()->GetAcl()->DumpConnectionHistory(fd);
+  if (shim::Stack::GetInstance()->IsRunning()) {
+    shim::Stack::GetInstance()->GetAcl()->DumpConnectionHistory(fd);
+  }
 
   for (int i = 0; i < MAX_L2CAP_LINKS; i++) {
     const tACL_CONN& link = acl_cb.acl_db[i];
diff --git a/system/main/shim/acl_legacy_interface.cc b/system/main/shim/acl_legacy_interface.cc
index 4cc2557..5b03a3e 100644
--- a/system/main/shim/acl_legacy_interface.cc
+++ b/system/main/shim/acl_legacy_interface.cc
@@ -15,12 +15,16 @@
  */
 
 #include "main/shim/acl_legacy_interface.h"
+
 #include "stack/include/acl_hci_link_interface.h"
 #include "stack/include/ble_acl_interface.h"
+#include "stack/include/gatt_api.h"
 #include "stack/include/sco_hci_link_interface.h"
 #include "stack/include/sec_hci_link_interface.h"
 
 struct tBTM_ESCO_DATA;
+void gatt_notify_phy_updated(tGATT_STATUS status, uint16_t handle,
+                             uint8_t tx_phy, uint8_t rx_phy);
 
 namespace bluetooth {
 namespace shim {
@@ -78,6 +82,7 @@
       .link.le.on_data_length_change = acl_ble_data_length_change_event,
       .link.le.on_read_remote_version_information_complete =
           btm_read_remote_version_complete,
+      .link.le.on_phy_update = gatt_notify_phy_updated,
   };
   return acl_interface;
 }
diff --git a/system/main/shim/acl_legacy_interface.h b/system/main/shim/acl_legacy_interface.h
index 5172638..5422df8 100644
--- a/system/main/shim/acl_legacy_interface.h
+++ b/system/main/shim/acl_legacy_interface.h
@@ -20,6 +20,7 @@
 
 #include "stack/include/bt_hdr.h"
 #include "stack/include/bt_types.h"
+#include "stack/include/gatt_api.h"
 #include "stack/include/hci_error_code.h"
 #include "stack/include/hci_mode.h"
 #include "stack/include/hcidefs.h"
@@ -122,7 +123,7 @@
   void (*on_read_remote_version_information_complete)(
       tHCI_STATUS status, uint16_t handle, uint8_t lmp_version,
       uint16_t manufacturer_name, uint16_t sub_version);
-  void (*on_phy_update)(tHCI_STATUS status, uint16_t handle, uint8_t tx_phy,
+  void (*on_phy_update)(tGATT_STATUS status, uint16_t handle, uint8_t tx_phy,
                         uint8_t rx_phy);
 } acl_le_link_interface_t;
 
diff --git a/system/main/shim/btm_api.cc b/system/main/shim/btm_api.cc
index 8b761c0..14a97fd 100644
--- a/system/main/shim/btm_api.cc
+++ b/system/main/shim/btm_api.cc
@@ -460,7 +460,7 @@
         LinkKey key;  // Never want to send the key to the stack
         (*bta_callbacks_->p_link_key_callback)(
             bluetooth::ToRawAddress(device.GetAddress()), 0, name, key,
-            BTM_LKEY_TYPE_COMBINATION);
+            BTM_LKEY_TYPE_COMBINATION, false /* is_ctkd */);
       }
       if (*bta_callbacks_->p_auth_complete_callback) {
         (*bta_callbacks_->p_auth_complete_callback)(
@@ -726,6 +726,15 @@
   }
 }
 
+void bluetooth::shim::BTM_BleTargetAnnouncementObserve(
+    bool enable, tBTM_INQ_RESULTS_CB* p_results_cb) {
+  if (enable) {
+    btm_cb.ble_ctr_cb.p_target_announcement_obs_results_cb = p_results_cb;
+  } else {
+    btm_cb.ble_ctr_cb.p_target_announcement_obs_results_cb = nullptr;
+  }
+}
+
 void bluetooth::shim::BTM_EnableInterlacedPageScan() {
   Stack::GetInstance()->GetBtm()->SetInterlacedPageScan();
 }
diff --git a/system/main/shim/btm_api.h b/system/main/shim/btm_api.h
index 1e10849..f05e54b 100644
--- a/system/main/shim/btm_api.h
+++ b/system/main/shim/btm_api.h
@@ -123,6 +123,23 @@
 void BTM_BleOpportunisticObserve(bool enable,
                                  tBTM_INQ_RESULTS_CB* p_results_cb);
 
+/*******************************************************************************
+ *
+ * Function         BTM_BleTargetAnnouncementObserve
+ *
+ * Description      Register/Unregister client interested in the targeted
+ *                  announcements. Not that it is client responsible for parsing
+ *                  advertising data.
+ *
+ * Parameters       start: start or stop observe.
+ *                  p_results_cb: callback for results.
+ *
+ * Returns          void
+ *
+ ******************************************************************************/
+void BTM_BleTargetAnnouncementObserve(bool enable,
+                                      tBTM_INQ_RESULTS_CB* p_results_cb);
+
 void BTM_EnableInterlacedInquiryScan();
 
 void BTM_EnableInterlacedPageScan();
diff --git a/system/main/shim/l2c_api.h b/system/main/shim/l2c_api.h
index 0fe3fbd..c70b913 100644
--- a/system/main/shim/l2c_api.h
+++ b/system/main/shim/l2c_api.h
@@ -428,6 +428,8 @@
  ******************************************************************************/
 bool L2CA_SetLeGattTimeout(const RawAddress& rem_bda, uint16_t idle_tout);
 
+bool L2CA_MarkLeLinkAsActive(const RawAddress& rem_bda);
+
 bool L2CA_UpdateBleConnParams(const RawAddress& rem_bda, uint16_t min_int,
                               uint16_t max_int, uint16_t latency,
                               uint16_t timeout, uint16_t min_ce_len,
diff --git a/system/main/shim/le_advertising_manager.cc b/system/main/shim/le_advertising_manager.cc
index dc8f81a..317d2db 100644
--- a/system/main/shim/le_advertising_manager.cc
+++ b/system/main/shim/le_advertising_manager.cc
@@ -399,9 +399,10 @@
     config.enable_scan_request_notifications =
         static_cast<bluetooth::hci::Enable>(
             params.scan_request_notification_enable);
-
-    // TODO set own_address_type based on address policy
     config.own_address_type = OwnAddressType::RANDOM_DEVICE_ADDRESS;
+    if (params.own_address_type == 0) {
+      config.own_address_type = OwnAddressType::PUBLIC_DEVICE_ADDRESS;
+    }
   }
   std::map<uint8_t, GetAddressCallback> address_callbacks_;
 };
diff --git a/system/main/shim/le_scanning_manager.cc b/system/main/shim/le_scanning_manager.cc
index 18ba1ea..17902c0 100644
--- a/system/main/shim/le_scanning_manager.cc
+++ b/system/main/shim/le_scanning_manager.cc
@@ -51,10 +51,13 @@
 
 namespace {
 constexpr char kBtmLogTag[] = "SCAN";
+constexpr uint16_t kAllowServiceDataFilter = 0x0040;
+constexpr uint16_t kAllowADTypeFilter = 0x80;
+constexpr uint8_t kFilterLogicOr = 0x00;
+constexpr uint8_t kFilterLogicAnd = 0x01;
+constexpr uint8_t kLowestRssiValue = 129;
 constexpr uint16_t kAllowAllFilter = 0x00;
 constexpr uint16_t kListLogicOr = 0x01;
-constexpr uint8_t kFilterLogicOr = 0x00;
-constexpr uint8_t kLowestRssiValue = 129;
 
 class DefaultScanningCallback : public ::ScanningCallbacks {
   void OnScannerRegistered(const bluetooth::Uuid app_uuid, uint8_t scanner_id,
@@ -610,6 +613,7 @@
   advertising_packet_content_filter_command.company = apcf_command.company;
   advertising_packet_content_filter_command.company_mask =
       apcf_command.company_mask;
+  advertising_packet_content_filter_command.ad_type = apcf_command.ad_type;
   advertising_packet_content_filter_command.data.assign(
       apcf_command.data.begin(), apcf_command.data.end());
   advertising_packet_content_filter_command.data_mask.assign(
@@ -726,6 +730,34 @@
       ->Init();
 }
 
+bool bluetooth::shim::is_ad_type_filter_supported() {
+  return bluetooth::shim::GetScanning()->IsAdTypeFilterSupported();
+}
+
+void bluetooth::shim::set_ad_type_rsi_filter(bool enable) {
+  bluetooth::hci::AdvertisingFilterParameter advertising_filter_parameter;
+  bluetooth::shim::GetScanning()->ScanFilterParameterSetup(
+      bluetooth::hci::ApcfAction::DELETE, 0x00, advertising_filter_parameter);
+  if (enable) {
+    std::vector<bluetooth::hci::AdvertisingPacketContentFilterCommand> filters =
+        {};
+    bluetooth::hci::AdvertisingPacketContentFilterCommand filter{};
+    filter.filter_type = bluetooth::hci::ApcfFilterType::AD_TYPE;
+    filter.ad_type = BTM_BLE_AD_TYPE_RSI;
+    filters.push_back(filter);
+    bluetooth::shim::GetScanning()->ScanFilterAdd(0x00, filters);
+
+    advertising_filter_parameter.delivery_mode =
+        bluetooth::hci::DeliveryMode::IMMEDIATE;
+    advertising_filter_parameter.feature_selection = kAllowADTypeFilter;
+    advertising_filter_parameter.list_logic_type = kAllowADTypeFilter;
+    advertising_filter_parameter.filter_logic_type = kFilterLogicOr;
+    advertising_filter_parameter.rssi_high_thresh = kLowestRssiValue;
+    bluetooth::shim::GetScanning()->ScanFilterParameterSetup(
+        bluetooth::hci::ApcfAction::ADD, 0x00, advertising_filter_parameter);
+  }
+}
+
 void bluetooth::shim::set_empty_filter(bool enable) {
   bluetooth::hci::AdvertisingFilterParameter advertising_filter_parameter;
   bluetooth::shim::GetScanning()->ScanFilterParameterSetup(
@@ -742,3 +774,45 @@
         bluetooth::hci::ApcfAction::ADD, 0x00, advertising_filter_parameter);
   }
 }
+
+void bluetooth::shim::set_target_announcements_filter(bool enable) {
+  uint8_t filter_index = 0x03;
+
+  LOG_DEBUG(" enable %d", enable);
+
+  bluetooth::hci::AdvertisingFilterParameter advertising_filter_parameter = {};
+  bluetooth::shim::GetScanning()->ScanFilterParameterSetup(
+      bluetooth::hci::ApcfAction::DELETE, filter_index,
+      advertising_filter_parameter);
+
+  if (!enable) return;
+
+  advertising_filter_parameter.delivery_mode =
+      bluetooth::hci::DeliveryMode::IMMEDIATE;
+  advertising_filter_parameter.feature_selection = kAllowServiceDataFilter;
+  advertising_filter_parameter.list_logic_type = kListLogicOr;
+  advertising_filter_parameter.filter_logic_type = kFilterLogicAnd;
+  advertising_filter_parameter.rssi_high_thresh = kLowestRssiValue;
+
+  /* Add targeted announcements filter on index 4 */
+  std::vector<bluetooth::hci::AdvertisingPacketContentFilterCommand>
+      cap_bap_filter = {};
+
+  bluetooth::hci::AdvertisingPacketContentFilterCommand cap_filter{};
+  cap_filter.filter_type = bluetooth::hci::ApcfFilterType::SERVICE_DATA;
+  cap_filter.data = {0x53, 0x18, 0x01};
+  cap_filter.data_mask = {0x53, 0x18, 0xFF};
+  cap_bap_filter.push_back(cap_filter);
+
+  bluetooth::hci::AdvertisingPacketContentFilterCommand bap_filter{};
+  bap_filter.filter_type = bluetooth::hci::ApcfFilterType::SERVICE_DATA;
+  bap_filter.data = {0x4e, 0x18, 0x01};
+  bap_filter.data_mask = {0x4e, 0x18, 0xFF};
+
+  cap_bap_filter.push_back(bap_filter);
+  bluetooth::shim::GetScanning()->ScanFilterAdd(filter_index, cap_bap_filter);
+
+  bluetooth::shim::GetScanning()->ScanFilterParameterSetup(
+      bluetooth::hci::ApcfAction::ADD, filter_index,
+      advertising_filter_parameter);
+}
diff --git a/system/main/shim/le_scanning_manager.h b/system/main/shim/le_scanning_manager.h
index abc72ee..9d1dee9 100644
--- a/system/main/shim/le_scanning_manager.h
+++ b/system/main/shim/le_scanning_manager.h
@@ -26,7 +26,10 @@
 
 ::BleScannerInterface* get_ble_scanner_instance();
 void init_scanning_manager();
+bool is_ad_type_filter_supported();
+void set_ad_type_rsi_filter(bool enable);
 void set_empty_filter(bool enable);
+void set_target_announcements_filter(bool enable);
 
 }  // namespace shim
 }  // namespace bluetooth
diff --git a/system/main/shim/metrics_api.cc b/system/main/shim/metrics_api.cc
index 99832be..b71cdad 100644
--- a/system/main/shim/metrics_api.cc
+++ b/system/main/shim/metrics_api.cc
@@ -89,9 +89,9 @@
                                                  transmit_power_level);
 }
 
-void LogMetricSmpPairingEvent(const RawAddress& raw_address, uint8_t smp_cmd,
+void LogMetricSmpPairingEvent(const RawAddress& raw_address, uint16_t smp_cmd,
                               android::bluetooth::DirectionEnum direction,
-                              uint8_t smp_fail_reason) {
+                              uint16_t smp_fail_reason) {
   Address address = bluetooth::ToGdAddress(raw_address);
   bluetooth::os::LogMetricSmpPairingEvent(address, smp_cmd, direction,
                                           smp_fail_reason);
@@ -146,5 +146,17 @@
   }
   return counter_metrics->Count(key, count);
 }
+
+void LogMetricBluetoothLEConnectionMetricEvent(
+    const RawAddress& raw_address,
+    android::bluetooth::le::LeConnectionOriginType origin_type,
+    android::bluetooth::le::LeConnectionType connection_type,
+    android::bluetooth::le::LeConnectionState transaction_state,
+    std::vector<std::pair<os::ArgumentType, int>> argument_list) {
+
+  Address address = bluetooth::ToGdAddress(raw_address);
+  bluetooth::os::LogMetricBluetoothLEConnectionMetricEvent(address, origin_type, connection_type, transaction_state, argument_list);
+}
+
 }  // namespace shim
 }  // namespace bluetooth
\ No newline at end of file
diff --git a/system/main/shim/metrics_api.h b/system/main/shim/metrics_api.h
index ce13876..592367e 100644
--- a/system/main/shim/metrics_api.h
+++ b/system/main/shim/metrics_api.h
@@ -18,9 +18,11 @@
 
 #include <frameworks/proto_logging/stats/enums/bluetooth/enums.pb.h>
 #include <frameworks/proto_logging/stats/enums/bluetooth/hci/enums.pb.h>
+#include <frameworks/proto_logging/stats/enums/bluetooth/le/enums.pb.h>
 
 #include <unordered_map>
 #include "types/raw_address.h"
+#include "metrics/metrics_state.h"
 
 namespace bluetooth {
 namespace shim {
@@ -134,9 +136,9 @@
  * @param direction direction of this SMP command
  * @param smp_fail_reason SMP pairing failure reason code from SMP spec
  */
-void LogMetricSmpPairingEvent(const RawAddress& address, uint8_t smp_cmd,
+void LogMetricSmpPairingEvent(const RawAddress& address, uint16_t smp_cmd,
                               android::bluetooth::DirectionEnum direction,
-                              uint8_t smp_fail_reason);
+                              uint16_t smp_fail_reason);
 
 /**
  * Logs there is an event related Bluetooth classic pairing
@@ -209,5 +211,12 @@
     const std::string& software_version);
 
 bool CountCounterMetrics(int32_t key, int64_t count);
+
+void LogMetricBluetoothLEConnectionMetricEvent(
+    const RawAddress& raw_address,
+    android::bluetooth::le::LeConnectionOriginType origin_type,
+    android::bluetooth::le::LeConnectionType connection_type,
+    android::bluetooth::le::LeConnectionState transaction_state,
+    std::vector<std::pair<os::ArgumentType, int>> argument_list);
 }  // namespace shim
 }  // namespace bluetooth
diff --git a/system/main/stack_config.cc b/system/main/stack_config.cc
index fdfe7d6..5c2921f 100644
--- a/system/main/stack_config.cc
+++ b/system/main/stack_config.cc
@@ -38,8 +38,20 @@
     "PTS_ConnectEattUncondictionally";
 const char* PTS_CONNECT_EATT_UNENCRYPTED = "PTS_ConnectEattUnencrypted";
 const char* PTS_BROADCAST_UNENCRYPTED = "PTS_BroadcastUnencrypted";
+const char* PTS_FORCE_LE_AUDIO_MULTIPLE_CONTEXTS_METADATA =
+    "PTS_ForceLeAudioMultipleContextsMetadata";
 const char* PTS_EATT_PERIPHERAL_COLLISION_SUPPORT =
     "PTS_EattPeripheralCollionSupport";
+const char* PTS_EATT_USE_FOR_ALL_SERVICES = "PTS_UseEattForAllServices";
+const char* PTS_L2CAP_ECOC_UPPER_TESTER = "PTS_L2capEcocUpperTester";
+const char* PTS_L2CAP_ECOC_MIN_KEY_SIZE = "PTS_L2capEcocMinKeySize";
+const char* PTS_L2CAP_ECOC_INITIAL_CHAN_CNT = "PTS_L2capEcocInitialChanCnt";
+const char* PTS_L2CAP_ECOC_CONNECT_REMAINING = "PTS_L2capEcocConnectRemaining";
+const char* PTS_L2CAP_ECOC_SEND_NUM_OF_SDU = "PTS_L2capEcocSendNumOfSdu";
+const char* PTS_L2CAP_ECOC_RECONFIGURE = "PTS_L2capEcocReconfigure";
+const char* PTS_BROADCAST_AUDIO_CONFIG_OPTION =
+    "PTS_BroadcastAudioConfigOption";
+const char* PTS_LE_AUDIO_SUSPEND_STREAMING = "PTS_LeAudioSuspendStreaming";
 
 static std::unique_ptr<config_t> config;
 }  // namespace
@@ -142,20 +154,85 @@
                          PTS_EATT_PERIPHERAL_COLLISION_SUPPORT, false);
 }
 
+static bool get_pts_use_eatt_for_all_services(void) {
+  return config_get_bool(*config, CONFIG_DEFAULT_SECTION,
+                         PTS_EATT_USE_FOR_ALL_SERVICES, false);
+}
+
+static bool get_pts_force_le_audio_multiple_contexts_metadata(void) {
+  return config_get_bool(*config, CONFIG_DEFAULT_SECTION,
+                         PTS_FORCE_LE_AUDIO_MULTIPLE_CONTEXTS_METADATA, false);
+}
+
+static bool get_pts_l2cap_ecoc_upper_tester(void) {
+  return config_get_bool(*config, CONFIG_DEFAULT_SECTION,
+                         PTS_L2CAP_ECOC_UPPER_TESTER, false);
+}
+
+static int get_pts_l2cap_ecoc_min_key_size(void) {
+  return config_get_int(*config, CONFIG_DEFAULT_SECTION,
+                        PTS_L2CAP_ECOC_MIN_KEY_SIZE, -1);
+}
+
+static int get_pts_l2cap_ecoc_initial_chan_cnt(void) {
+  return config_get_int(*config, CONFIG_DEFAULT_SECTION,
+                        PTS_L2CAP_ECOC_INITIAL_CHAN_CNT, -1);
+}
+
+static bool get_pts_l2cap_ecoc_connect_remaining(void) {
+  return config_get_bool(*config, CONFIG_DEFAULT_SECTION,
+                         PTS_L2CAP_ECOC_CONNECT_REMAINING, false);
+}
+
+static int get_pts_l2cap_ecoc_send_num_of_sdu(void) {
+  return config_get_int(*config, CONFIG_DEFAULT_SECTION,
+                        PTS_L2CAP_ECOC_SEND_NUM_OF_SDU, -1);
+}
+
+static bool get_pts_l2cap_ecoc_reconfigure(void) {
+  return config_get_bool(*config, CONFIG_DEFAULT_SECTION,
+                         PTS_L2CAP_ECOC_RECONFIGURE, false);
+}
+
+static const std::string* get_pts_broadcast_audio_config_options(void) {
+  if (!config) {
+    LOG_INFO("Config isn't ready, use default option");
+    return NULL;
+  }
+  return config_get_string(*config, CONFIG_DEFAULT_SECTION,
+                           PTS_BROADCAST_AUDIO_CONFIG_OPTION, NULL);
+}
+
+static bool get_pts_le_audio_disable_ases_before_stopping(void) {
+  return config_get_bool(*config, CONFIG_DEFAULT_SECTION,
+                         PTS_LE_AUDIO_SUSPEND_STREAMING, false);
+}
+
 static config_t* get_all(void) { return config.get(); }
 
-const stack_config_t interface = {get_trace_config_enabled,
-                                  get_pts_avrcp_test,
-                                  get_pts_secure_only_mode,
-                                  get_pts_conn_updates_disabled,
-                                  get_pts_crosskey_sdp_disable,
-                                  get_pts_smp_options,
-                                  get_pts_smp_failure_case,
-                                  get_pts_force_eatt_for_notifications,
-                                  get_pts_connect_eatt_unconditionally,
-                                  get_pts_connect_eatt_before_encryption,
-                                  get_pts_unencrypt_broadcast,
-                                  get_pts_eatt_peripheral_collision_support,
-                                  get_all};
+const stack_config_t interface = {
+    get_trace_config_enabled,
+    get_pts_avrcp_test,
+    get_pts_secure_only_mode,
+    get_pts_conn_updates_disabled,
+    get_pts_crosskey_sdp_disable,
+    get_pts_smp_options,
+    get_pts_smp_failure_case,
+    get_pts_force_eatt_for_notifications,
+    get_pts_connect_eatt_unconditionally,
+    get_pts_connect_eatt_before_encryption,
+    get_pts_unencrypt_broadcast,
+    get_pts_eatt_peripheral_collision_support,
+    get_pts_use_eatt_for_all_services,
+    get_pts_force_le_audio_multiple_contexts_metadata,
+    get_pts_l2cap_ecoc_upper_tester,
+    get_pts_l2cap_ecoc_min_key_size,
+    get_pts_l2cap_ecoc_initial_chan_cnt,
+    get_pts_l2cap_ecoc_connect_remaining,
+    get_pts_l2cap_ecoc_send_num_of_sdu,
+    get_pts_l2cap_ecoc_reconfigure,
+    get_pts_broadcast_audio_config_options,
+    get_pts_le_audio_disable_ases_before_stopping,
+    get_all};
 
 const stack_config_t* stack_config_get_interface(void) { return &interface; }
diff --git a/system/main/test/main_shim_dumpsys_test.cc b/system/main/test/main_shim_dumpsys_test.cc
index 318a513..06f89a5 100644
--- a/system/main/test/main_shim_dumpsys_test.cc
+++ b/system/main/test/main_shim_dumpsys_test.cc
@@ -48,7 +48,6 @@
 
     ModuleList modules;
     modules.add<shim::Dumpsys>();
-    modules.add<storage::StorageModule>();
 
     os::Thread* thread = new os::Thread("thread", os::Thread::Priority::NORMAL);
     stack_manager_.StartUp(&modules, thread);
diff --git a/system/main/test/main_shim_test.cc b/system/main/test/main_shim_test.cc
index 80e101d..fd4d108 100644
--- a/system/main/test/main_shim_test.cc
+++ b/system/main/test/main_shim_test.cc
@@ -14,10 +14,12 @@
  *  limitations under the License.
  */
 
+#include <fcntl.h>
 #include <gmock/gmock.h>
 #include <gtest/gtest.h>
 
 #include <cstddef>
+#include <cstdio>
 #include <future>
 #include <map>
 
@@ -87,7 +89,25 @@
 
 namespace {
 std::map<std::string, std::promise<uint16_t>> mock_function_handle_promise_map;
-}
+
+// Utility to provide a file descriptor for /dev/null when possible, but
+// defaulting to STDERR when not possible.
+class DevNullOrStdErr {
+ public:
+  DevNullOrStdErr() { fd_ = open("/dev/null", O_CLOEXEC | O_WRONLY); }
+  ~DevNullOrStdErr() {
+    if (fd_ != -1) {
+      close(fd_);
+    }
+    fd_ = -1;
+  }
+  int Fd() const { return (fd_ == -1) ? STDERR_FILENO : fd_; }
+
+ private:
+  int fd_{-1};
+};
+
+}  // namespace
 
 uint8_t mock_get_ble_acceptlist_size() { return 123; }
 
@@ -728,3 +748,7 @@
 
   raw_connection_->read_remote_extended_features_function_ = {};
 }
+
+TEST_F(MainShimTest, acl_dumpsys) {
+  MakeAcl()->Dump(std::make_unique<DevNullOrStdErr>()->Fd());
+}
diff --git a/system/osi/src/config.cc b/system/osi/src/config.cc
index 9ebe076..038982c 100644
--- a/system/osi/src/config.cc
+++ b/system/osi/src/config.cc
@@ -219,7 +219,6 @@
   std::string value_no_newline;
   size_t newline_position = value.find('\n');
   if (newline_position != std::string::npos) {
-    android_errorWriteLog(0x534e4554, "70808273");
     value_no_newline = value.substr(0, newline_position);
   } else {
     value_no_newline = value;
diff --git a/system/packet/avrcp/get_element_attributes_packet.cc b/system/packet/avrcp/get_element_attributes_packet.cc
index 8634ce0..f08a698 100644
--- a/system/packet/avrcp/get_element_attributes_packet.cc
+++ b/system/packet/avrcp/get_element_attributes_packet.cc
@@ -90,7 +90,7 @@
   return builder;
 }
 
-bool GetElementAttributesResponseBuilder::AddAttributeEntry(
+size_t GetElementAttributesResponseBuilder::AddAttributeEntry(
     AttributeEntry entry) {
   CHECK_LT(entries_.size(), size_t(0xFF))
       << __func__ << ": attribute entry overflow";
@@ -101,15 +101,15 @@
   }
 
   if (entry.empty()) {
-    return false;
+    return 0;
   }
 
   entries_.insert(entry);
-  return true;
+  return entry.size();
 }
 
-bool GetElementAttributesResponseBuilder::AddAttributeEntry(Attribute attribute,
-                                                            std::string value) {
+size_t GetElementAttributesResponseBuilder::AddAttributeEntry(
+    Attribute attribute, const std::string& value) {
   return AddAttributeEntry(AttributeEntry(attribute, value));
 }
 
@@ -120,7 +120,7 @@
     attr_list_size += attribute_entry.size();
   }
 
-  return VendorPacket::kMinSize() + 1 + attr_list_size;
+  return kHeaderSize() + attr_list_size;
 }
 
 bool GetElementAttributesResponseBuilder::Serialize(
diff --git a/system/packet/avrcp/get_element_attributes_packet.h b/system/packet/avrcp/get_element_attributes_packet.h
index e60844c..b1d4c61 100644
--- a/system/packet/avrcp/get_element_attributes_packet.h
+++ b/system/packet/avrcp/get_element_attributes_packet.h
@@ -58,15 +58,21 @@
   using VendorPacket::VendorPacket;
 };
 
+template <class Builder>
+class AttributesResponseBuilderTestUser;
+
 class GetElementAttributesResponseBuilder : public VendorPacketBuilder {
  public:
   virtual ~GetElementAttributesResponseBuilder() = default;
+  using Builder = std::unique_ptr<GetElementAttributesResponseBuilder>;
+  static Builder MakeBuilder(size_t mtu);
 
-  static std::unique_ptr<GetElementAttributesResponseBuilder> MakeBuilder(
-      size_t mtu);
+  size_t AddAttributeEntry(AttributeEntry entry);
+  size_t AddAttributeEntry(Attribute attribute, const std::string& value);
 
-  bool AddAttributeEntry(AttributeEntry entry);
-  bool AddAttributeEntry(Attribute attribute, std::string value);
+  virtual void clear() { entries_.clear(); }
+
+  static constexpr size_t kHeaderSize() { return VendorPacket::kMinSize() + 1; }
 
   virtual size_t size() const override;
   virtual bool Serialize(
@@ -75,6 +81,8 @@
  private:
   std::set<AttributeEntry> entries_;
   size_t mtu_;
+  friend class AttributesResponseBuilderTestUser<
+      GetElementAttributesResponseBuilder>;
 
   GetElementAttributesResponseBuilder(size_t mtu)
       : VendorPacketBuilder(CType::STABLE, CommandPdu::GET_ELEMENT_ATTRIBUTES,
@@ -83,4 +91,4 @@
 };
 
 }  // namespace avrcp
-}  // namespace bluetooth
\ No newline at end of file
+}  // namespace bluetooth
diff --git a/system/packet/avrcp/get_item_attributes.cc b/system/packet/avrcp/get_item_attributes.cc
index fb2ba87..0c7afe4 100644
--- a/system/packet/avrcp/get_item_attributes.cc
+++ b/system/packet/avrcp/get_item_attributes.cc
@@ -27,7 +27,8 @@
   return builder;
 }
 
-bool GetItemAttributesResponseBuilder::AddAttributeEntry(AttributeEntry entry) {
+size_t GetItemAttributesResponseBuilder::AddAttributeEntry(
+    AttributeEntry entry) {
   CHECK(entries_.size() < 0xFF);
 
   size_t remaining_space = mtu_ - size();
@@ -36,24 +37,22 @@
   }
 
   if (entry.empty()) {
-    return false;
+    return 0;
   }
 
   entries_.insert(entry);
-  return true;
+  return entry.size();
 }
 
-bool GetItemAttributesResponseBuilder::AddAttributeEntry(Attribute attribute,
-                                                         std::string value) {
+size_t GetItemAttributesResponseBuilder::AddAttributeEntry(
+    Attribute attribute, const std::string& value) {
   return AddAttributeEntry(AttributeEntry(attribute, value));
 }
 
 size_t GetItemAttributesResponseBuilder::size() const {
-  size_t len = BrowsePacket::kMinSize();
-  len += 1;  // Status
-  if (status_ != Status::NO_ERROR) return len;
+  size_t len = kHeaderSize();
+  if (status_ != Status::NO_ERROR) return kErrorHeaderSize();
 
-  len += 1;  // Number of attributes
   for (const auto& entry : entries_) {
     len += entry.size();
   }
diff --git a/system/packet/avrcp/get_item_attributes.h b/system/packet/avrcp/get_item_attributes.h
index aa1db71..7811909 100644
--- a/system/packet/avrcp/get_item_attributes.h
+++ b/system/packet/avrcp/get_item_attributes.h
@@ -23,15 +23,32 @@
 namespace bluetooth {
 namespace avrcp {
 
+template <class Builder>
+class AttributesResponseBuilderTestUser;
+
 class GetItemAttributesResponseBuilder : public BrowsePacketBuilder {
  public:
   virtual ~GetItemAttributesResponseBuilder() = default;
+  using Builder = std::unique_ptr<GetItemAttributesResponseBuilder>;
+  static Builder MakeBuilder(Status status, size_t mtu);
 
-  static std::unique_ptr<GetItemAttributesResponseBuilder> MakeBuilder(
-      Status status, size_t mtu);
+  size_t AddAttributeEntry(AttributeEntry entry);
+  size_t AddAttributeEntry(Attribute, const std::string&);
 
-  bool AddAttributeEntry(AttributeEntry entry);
-  bool AddAttributeEntry(Attribute, std::string);
+  virtual void clear() { entries_.clear(); }
+
+  static constexpr size_t kHeaderSize() {
+    size_t len = BrowsePacket::kMinSize();
+    len += 1;  // Status
+    len += 1;  // Number of attributes
+    return len;
+  }
+
+  static constexpr size_t kErrorHeaderSize() {
+    size_t len = BrowsePacket::kMinSize();
+    len += 1;  // Status
+    return len;
+  }
 
   virtual size_t size() const override;
   virtual bool Serialize(
@@ -41,6 +58,8 @@
   Status status_;
   size_t mtu_;
   std::set<AttributeEntry> entries_;
+  friend class AttributesResponseBuilderTestUser<
+      GetItemAttributesResponseBuilder>;
 
   GetItemAttributesResponseBuilder(Status status, size_t mtu)
       : BrowsePacketBuilder(BrowsePdu::GET_ITEM_ATTRIBUTES),
@@ -81,4 +100,4 @@
 };
 
 }  // namespace avrcp
-}  // namespace bluetooth
\ No newline at end of file
+}  // namespace bluetooth
diff --git a/system/packet/tests/avrcp/get_element_attributes_packet_test.cc b/system/packet/tests/avrcp/get_element_attributes_packet_test.cc
index 8a05487..96ae1fa 100644
--- a/system/packet/tests/avrcp/get_element_attributes_packet_test.cc
+++ b/system/packet/tests/avrcp/get_element_attributes_packet_test.cc
@@ -103,6 +103,47 @@
   ASSERT_EQ(test_packet->GetData(), get_elements_attributes_response_full);
 }
 
+TEST(GetElementAttributesResponseBuilderTest, builderMtuTest) {
+  std::vector<AttributeEntry> test_data = {
+      {Attribute::TITLE, "Test Song 1"},
+      {Attribute::ARTIST_NAME, "Test Artist"},
+      {Attribute::ALBUM_NAME, "Test Album"},
+      {Attribute::TRACK_NUMBER, "1"},
+      {Attribute::TOTAL_NUMBER_OF_TRACKS, "2"},
+      {Attribute::GENRE, "Test Genre"},
+      {Attribute::PLAYING_TIME, "10 200"},
+      {Attribute::TITLE, "Test Song 2"},
+      {Attribute::ARTIST_NAME, "Test Artist"},
+      {Attribute::ALBUM_NAME, "Test Album"},
+      {Attribute::TRACK_NUMBER, "2"},
+      {Attribute::TOTAL_NUMBER_OF_TRACKS, "2"},
+      {Attribute::GENRE, "Test Genre"},
+      {Attribute::PLAYING_TIME, "1500"},
+  };
+
+  using Builder = GetElementAttributesResponseBuilder;
+  using Helper = FragmentationBuilderHelper<Builder>;
+  size_t mtu = size_t(-1);
+  Helper helper(mtu, [](size_t mtu) { return Builder::MakeBuilder(mtu); });
+
+  EXPECT_NO_FATAL_FAILURE(helper.runTest(test_data, mtu, false, false));
+
+  mtu = test_data[0].size() + Builder::kHeaderSize();
+  EXPECT_NO_FATAL_FAILURE(helper.runTest(test_data, mtu));
+
+  mtu = test_data[0].size() + test_data[1].size() + Builder::kHeaderSize();
+  EXPECT_NO_FATAL_FAILURE(helper.runTest(test_data, mtu));
+
+  mtu = test_data[0].size() + (Builder::kHeaderSize() * 2) + 1;
+  EXPECT_NO_FATAL_FAILURE(helper.runTest(test_data, mtu, true, false));
+
+  mtu = Builder::kHeaderSize() + AttributeEntry::kHeaderSize() + 1;
+  EXPECT_NO_FATAL_FAILURE(helper.runTest(test_data, mtu));
+
+  mtu = Builder::kHeaderSize() + AttributeEntry::kHeaderSize();
+  EXPECT_NO_FATAL_FAILURE(helper.runTest(test_data, mtu, false, false));
+}
+
 TEST(GetElementAttributesResponseBuilderTest, truncateBuilderTest) {
   auto attribute = AttributeEntry(Attribute::TITLE, "1234");
   size_t truncated_size = VendorPacket::kMinSize();
@@ -130,4 +171,4 @@
 }
 
 }  // namespace avrcp
-}  // namespace bluetooth
\ No newline at end of file
+}  // namespace bluetooth
diff --git a/system/packet/tests/avrcp/get_item_attributes_packet_test.cc b/system/packet/tests/avrcp/get_item_attributes_packet_test.cc
index 3d6f691..4f1da7b 100644
--- a/system/packet/tests/avrcp/get_item_attributes_packet_test.cc
+++ b/system/packet/tests/avrcp/get_item_attributes_packet_test.cc
@@ -126,5 +126,48 @@
   ASSERT_FALSE(test_packet->IsValid());
 }
 
+TEST(GetItemAttributesRequestTest, builderMtuTest) {
+  std::vector<AttributeEntry> test_data = {
+      {Attribute::TITLE, "Test Song 1"},
+      {Attribute::ARTIST_NAME, "Test Artist"},
+      {Attribute::ALBUM_NAME, "Test Album"},
+      {Attribute::TRACK_NUMBER, "1"},
+      {Attribute::TOTAL_NUMBER_OF_TRACKS, "2"},
+      {Attribute::GENRE, "Test Genre"},
+      {Attribute::PLAYING_TIME, "10 200"},
+      {Attribute::TITLE, "Test Song 2"},
+      {Attribute::ARTIST_NAME, "Test Artist"},
+      {Attribute::ALBUM_NAME, "Test Album"},
+      {Attribute::TRACK_NUMBER, "2"},
+      {Attribute::TOTAL_NUMBER_OF_TRACKS, "2"},
+      {Attribute::GENRE, "Test Genre"},
+      {Attribute::PLAYING_TIME, "1500"},
+  };
+
+  using Builder = GetItemAttributesResponseBuilder;
+  using Helper = FragmentationBuilderHelper<Builder>;
+  size_t mtu = size_t(-1);
+  Helper helper(mtu, [](size_t mtu) {
+    return Builder::MakeBuilder(Status::NO_ERROR, mtu);
+  });
+
+  EXPECT_NO_FATAL_FAILURE(helper.runTest(test_data, mtu, false, false));
+
+  mtu = test_data[0].size() + Builder::kHeaderSize();
+  EXPECT_NO_FATAL_FAILURE(helper.runTest(test_data, mtu));
+
+  mtu = test_data[0].size() + test_data[1].size() + Builder::kHeaderSize();
+  EXPECT_NO_FATAL_FAILURE(helper.runTest(test_data, mtu));
+
+  mtu = test_data[0].size() + (Builder::kHeaderSize() * 2) + 1;
+  EXPECT_NO_FATAL_FAILURE(helper.runTest(test_data, mtu, true, false));
+
+  mtu = Builder::kHeaderSize() + AttributeEntry::kHeaderSize() + 1;
+  EXPECT_NO_FATAL_FAILURE(helper.runTest(test_data, mtu));
+
+  mtu = Builder::kHeaderSize() + AttributeEntry::kHeaderSize();
+  EXPECT_NO_FATAL_FAILURE(helper.runTest(test_data, mtu, false, false));
+}
+
 }  // namespace avrcp
-}  // namespace bluetooth
\ No newline at end of file
+}  // namespace bluetooth
diff --git a/system/packet/tests/packet_test_helper.h b/system/packet/tests/packet_test_helper.h
index ad3db2c..e03280c 100644
--- a/system/packet/tests/packet_test_helper.h
+++ b/system/packet/tests/packet_test_helper.h
@@ -16,10 +16,11 @@
 
 #pragma once
 
+#include <list>
 #include <memory>
 
+#include "avrcp_common.h"
 #include "packet.h"
-
 namespace bluetooth {
 
 // A helper templated class to access the protected members of Packet to make
@@ -63,4 +64,229 @@
   }
 };
 
-}  // namespace bluetooth
\ No newline at end of file
+namespace avrcp {
+
+inline std::string to_string(const Attribute& a) {
+  switch (a) {
+    case Attribute::TITLE:
+      return "TITLE";
+    case Attribute::ARTIST_NAME:
+      return "ARTIST_NAME";
+    case Attribute::ALBUM_NAME:
+      return "ALBUM_NAME";
+    case Attribute::TRACK_NUMBER:
+      return "TRACK_NUMBER";
+    case Attribute::TOTAL_NUMBER_OF_TRACKS:
+      return "TOTAL_NUMBER_OF_TRACKS";
+    case Attribute::GENRE:
+      return "GENRE";
+    case Attribute::PLAYING_TIME:
+      return "PLAYING_TIME";
+    case Attribute::DEFAULT_COVER_ART:
+      return "DEFAULT_COVER_ART";
+    default:
+      return "UNKNOWN ATTRIBUTE";
+  };
+}
+
+inline std::string to_string(const AttributeEntry& entry) {
+  std::stringstream ss;
+  ss << to_string(entry.attribute()) << ": " << entry.value();
+  return ss.str();
+}
+
+template <class Container>
+std::string to_string(const Container& entries) {
+  std::stringstream ss;
+  for (const auto& el : entries) {
+    ss << to_string(el) << std::endl;
+  }
+  return ss.str();
+}
+
+inline bool operator==(const AttributeEntry& a, const AttributeEntry& b) {
+  return (a.attribute() == b.attribute()) && (a.value() == b.value());
+}
+
+inline bool operator!=(const AttributeEntry& a, const AttributeEntry& b) {
+  return !(a == b);
+}
+
+template <class AttributesResponseBuilder>
+class AttributesResponseBuilderTestUser {
+ public:
+  using Builder = AttributesResponseBuilder;
+  using Maker = std::function<typename Builder::Builder(size_t)>;
+
+ private:
+  Maker maker;
+  typename Builder::Builder _builder;
+  size_t _mtu;
+  size_t _current_size = 0;
+  size_t _entry_counter = 0;
+  std::set<AttributeEntry> _control_set;
+  std::list<AttributeEntry> _order_control;
+  std::list<AttributeEntry> _sended_order;
+  std::stringstream _report;
+  bool _test_result = true;
+  bool _order_test_result = true;
+
+  void reset() {
+    for (const auto& en : _builder->entries_) {
+      _sended_order.push_back(en);
+    }
+    _current_size = 0, _entry_counter = 0;
+    _control_set.clear();
+    _builder->clear();
+  }
+
+  size_t expected_size() { return Builder::kHeaderSize() + _current_size; }
+
+ public:
+  std::string getReport() const { return _report.str(); }
+
+  AttributesResponseBuilderTestUser(size_t m_size, Maker maker)
+      : maker(maker), _builder(maker(m_size)), _mtu(m_size) {
+    _report << __func__ << ": mtu \"" << _mtu << "\"\n";
+  }
+
+  void startTest(size_t m_size) {
+    _builder = maker(m_size);
+    _mtu = m_size;
+    reset();
+    _report.str("");
+    _report.clear();
+    _order_control.clear();
+    _sended_order.clear();
+    _report << __func__ << ": mtu \"" << _mtu << "\"\n";
+    _order_test_result = true;
+    _test_result = true;
+  }
+
+  bool testResult() const { return _test_result; }
+
+  bool testOrder() { return _order_test_result; }
+
+  void finishTest() {
+    reset();
+    if (_order_control.size() != _sended_order.size()) {
+      _report << __func__ << ": testOrder FAIL: "
+              << "the count of entries which should send ("
+              << _order_control.size() << ") is not equal to sended entries("
+              << _sended_order.size() << ")) \n input:\n "
+              << to_string(_order_control) << "\n sended:\n"
+              << to_string(_sended_order) << "\n";
+      _order_test_result = false;
+      return;
+    }
+    auto e = _order_control.begin();
+    auto s = _sended_order.begin();
+    for (; e != _order_control.end(); ++e, ++s) {
+      if (*e != *s) {
+        _report << __func__ << "testOrder FAIL: order of entries was changed\n";
+        _order_test_result = false;
+        break;
+      }
+    }
+    _report << __func__ << ": mtu \"" << _mtu << "\"\n";
+  }
+
+  void AddAttributeEntry(AttributeEntry entry) {
+    auto f = _builder->AddAttributeEntry(entry);
+    if (f != 0) {
+      _current_size += f;
+      ++_entry_counter;
+    }
+    if (f == entry.size()) {
+      wholeEntry(f, std::move(entry));
+    } else {
+      fractionEntry(f, std::move(entry));
+    }
+  }
+
+ private:
+  void wholeEntry(size_t f, AttributeEntry&& entry) {
+    _control_set.insert(entry);
+    _order_control.push_back(entry);
+    if (_builder->size() != expected_size()) {
+      _report << __func__ << "FAIL for \"" << to_string(entry)
+              << "\": not allowed to add.\n";
+      _test_result = false;
+    }
+  }
+
+  void fractionEntry(size_t f, AttributeEntry&& entry) {
+    auto l_value = entry.value().size() - (entry.size() - f);
+    if (f != 0) {
+      auto pushed_entry = AttributeEntry(
+          entry.attribute(), std::string(entry.value(), 0, l_value));
+      _control_set.insert(pushed_entry);
+      _order_control.push_back(pushed_entry);
+    }
+
+    if (expected_size() != _builder->size()) {
+      _test_result = false;
+      _report << __func__ << "FAIL for \"" << to_string(entry)
+              << "\": not allowed to add.\n";
+    }
+
+    if (_builder->size() != expected_size() ||
+        _builder->entries_.size() != _entry_counter) {
+      _report << __func__ << "FAIL for \"" << to_string(entry)
+              << "\": unexpected size of packet\n";
+      _test_result = false;
+    }
+    for (auto dat = _builder->entries_.begin(), ex = _control_set.begin();
+         ex != _control_set.end(); ++dat, ++ex) {
+      if (*dat != *ex) {
+        _report << __func__ << "FAIL for \"" << to_string(entry)
+                << "\": unexpected entry order\n";
+        _test_result = false;
+      }
+    }
+    auto tail = (f == 0) ? entry
+                         : AttributeEntry(entry.attribute(),
+                                          std::string(entry.value(), l_value));
+    if (_builder->entries_.size() != 0) {
+      reset();
+      AddAttributeEntry(tail);
+    }
+    if (_builder->entries_.size() == 0) {
+      _report << __func__ << "FAIL: MTU " << _mtu << " too small\n";
+      _test_result = false;
+      _order_control.push_back(entry);
+      reset();
+    }
+  }
+};
+
+template <class AttributesBuilder>
+class FragmentationBuilderHelper {
+ public:
+  using Builder = AttributesBuilder;
+  using Helper = AttributesResponseBuilderTestUser<Builder>;
+  using Maker = typename Helper::Maker;
+
+  FragmentationBuilderHelper(size_t mtu, Maker m) : _helper(mtu, m) {}
+
+  template <class TestCollection>
+  void runTest(const TestCollection& test_data, size_t mtu,
+               bool expect_fragmentation = true, bool expect_ordering = true) {
+    _helper.startTest(mtu);
+
+    for (auto& i : test_data) {
+      _helper.AddAttributeEntry(i);
+    }
+    _helper.finishTest();
+
+    EXPECT_EQ(expect_fragmentation, _helper.testResult())
+        << "Report: " << _helper.getReport();
+    EXPECT_EQ(expect_ordering, _helper.testOrder())
+        << "Report: " << _helper.getReport();
+  }
+
+ private:
+  Helper _helper;
+};
+}  // namespace avrcp
+}  // namespace bluetooth
diff --git a/system/profile/avrcp/tests/avrcp_device_fuzz/avrcp_device_fuzz.cc b/system/profile/avrcp/tests/avrcp_device_fuzz/avrcp_device_fuzz.cc
index 441bf5c..bca1f6f 100644
--- a/system/profile/avrcp/tests/avrcp_device_fuzz/avrcp_device_fuzz.cc
+++ b/system/profile/avrcp/tests/avrcp_device_fuzz/avrcp_device_fuzz.cc
@@ -60,6 +60,11 @@
                                   nullptr, nullptr,
                                   nullptr, nullptr,
                                   nullptr, nullptr,
+                                  nullptr, nullptr,
+                                  nullptr, nullptr,
+                                  nullptr, nullptr,
+                                  nullptr, nullptr,
+                                  nullptr, nullptr,
                                   nullptr};
 
 void Callback(uint8_t, bool, std::unique_ptr<::bluetooth::PacketBuilder>) {}
diff --git a/system/profile/avrcp/tests/avrcp_device_test.cc b/system/profile/avrcp/tests/avrcp_device_test.cc
index 2bbc39a..e8058aa 100644
--- a/system/profile/avrcp/tests/avrcp_device_test.cc
+++ b/system/profile/avrcp/tests/avrcp_device_test.cc
@@ -56,6 +56,11 @@
                                   nullptr, nullptr,
                                   nullptr, nullptr,
                                   nullptr, nullptr,
+                                  nullptr, nullptr,
+                                  nullptr, nullptr,
+                                  nullptr, nullptr,
+                                  nullptr, nullptr,
+                                  nullptr, nullptr,
                                   nullptr};
 
 // TODO (apanicke): All the tests below are just basic positive unit tests.
diff --git a/system/service/Android.bp b/system/service/Android.bp
index 91dcff0..560ab2b 100644
--- a/system/service/Android.bp
+++ b/system/service/Android.bp
@@ -119,6 +119,7 @@
         "libFraunhoferAAC",
         "libg722codec",
         "liblc3",
+        "libopus",
         "libosi",
         "libudrv-uipc",
     ],
@@ -202,6 +203,7 @@
         "libFraunhoferAAC",
         "libg722codec",
         "liblc3",
+        "libopus",
         "libosi",
         "libudrv-uipc",
     ],
diff --git a/system/service/hal/fake_bluetooth_interface.cc b/system/service/hal/fake_bluetooth_interface.cc
index 33209b4..94355fe 100644
--- a/system/service/hal/fake_bluetooth_interface.cc
+++ b/system/service/hal/fake_bluetooth_interface.cc
@@ -82,6 +82,7 @@
     nullptr, /* generate_local_oob_data */
     nullptr, /* allow_low_latency_audio */
     nullptr, /* clear_event_filter */
+    nullptr, /* metadata_changed */
 };
 
 }  // namespace
diff --git a/system/stack/Android.bp b/system/stack/Android.bp
index 32ac254..3db56b9 100644
--- a/system/stack/Android.bp
+++ b/system/stack/Android.bp
@@ -55,6 +55,7 @@
         "external/aac/libSYS/include",
         "external/libldac/inc",
         "external/libldac/abr/inc",
+        "external/libopus/include",
         "packages/modules/Bluetooth/system",
         "packages/modules/Bluetooth/system/gd",
         "packages/modules/Bluetooth/system/vnd/include",
@@ -85,6 +86,9 @@
         "a2dp/a2dp_vendor_ldac.cc",
         "a2dp/a2dp_vendor_ldac_decoder.cc",
         "a2dp/a2dp_vendor_ldac_encoder.cc",
+        "a2dp/a2dp_vendor_opus.cc",
+        "a2dp/a2dp_vendor_opus_encoder.cc",
+        "a2dp/a2dp_vendor_opus_decoder.cc",
         "avct/avct_api.cc",
         "avct/avct_bcb_act.cc",
         "avct/avct_ccb.cc",
@@ -203,8 +207,11 @@
         "libbt-hci",
     ],
     whole_static_libs: [
+        "libcom.android.sysprop.bluetooth",
         "libldacBT_abr",
         "libldacBT_enc",
+        "libaptx_enc",
+        "libaptxhd_enc",
     ],
     host_supported: true,
     min_sdk_version: "Tiramisu"
@@ -229,6 +236,7 @@
     srcs: [
         "test/stack_a2dp_test.cc",
         "test/stack_avrcp_test.cc",
+        "test/gatt/gatt_api_test.cc",
     ],
     shared_libs: [
         "android.hardware.bluetooth@1.0",
@@ -268,6 +276,7 @@
         "libbtdevice",
         "libg722codec",
         "liblc3",
+        "libopus",
         "libosi",
         "libudrv-uipc",
         "libbt-protos-lite",
@@ -474,27 +483,35 @@
 // Bluetooth stack connection multiplexing
 cc_test {
     name: "net_test_gatt_conn_multiplexing",
-    defaults: ["fluoride_defaults"],
+    defaults: [
+        "fluoride_defaults",
+        "mts_defaults",
+    ],
+    host_supported: true,
+    test_suites: ["general-tests"],
     local_include_dirs: [
         "include",
         "btm",
+        "test/common",
     ],
     include_dirs: [
         "packages/modules/Bluetooth/system",
         "packages/modules/Bluetooth/system/gd",
         "packages/modules/Bluetooth/system/internal_include",
-        "packages/modules/Bluetooth/system/internal_include",
         "packages/modules/Bluetooth/system/utils/include",
     ],
     srcs: [
         "gatt/connection_manager.cc",
+        "test/common/mock_btm_api_layer.cc",
         "test/gatt_connection_manager_test.cc",
+        ":TestCommonMainHandler",
     ],
     shared_libs: [
         "libcutils",
     ],
     static_libs: [
         "libbluetooth-types",
+        "libbt-common",
         "liblog",
         "libgmock",
     ],
@@ -606,6 +623,111 @@
 }
 
 cc_test {
+    name: "net_test_stack_a2dp_codecs_native",
+    defaults: [
+        "fluoride_defaults",
+        "mts_defaults",
+    ],
+    cflags: [
+        "-DUNIT_TESTS",
+    ],
+    test_suites: ["device-tests"],
+    host_supported: true,
+    test_options: {
+        unit_test: true,
+    },
+    include_dirs: [
+        "external/aac/libAACenc/include",
+        "external/aac/libAACdec/include",
+        "external/aac/libSYS/include",
+        "external/libldac/inc",
+        "external/libldac/abr/inc",
+        "external/libopus/include",
+        "packages/modules/Bluetooth/system",
+        "packages/modules/Bluetooth/system/btif/include",
+        "packages/modules/Bluetooth/system/embdrv/encoder_for_aptxhd/include",
+        "packages/modules/Bluetooth/system/gd",
+        "packages/modules/Bluetooth/system/stack/include",
+        "packages/modules/Bluetooth/system/utils/include",
+    ],
+    target: {
+        host: {
+            srcs: [
+                ":BluetoothHostTestingLogCapture",
+            ],
+        },
+        android: {
+            srcs: [
+                ":BluetoothAndroidTestingLogCapture",
+            ],
+            test_config: "test/a2dp/AndroidTest.xml",
+        }
+    },
+    data: [
+        "test/a2dp/raw_data/*",
+    ],
+    srcs: [
+        "a2dp/a2dp_aac.cc",
+        "a2dp/a2dp_aac_decoder.cc",
+        "a2dp/a2dp_aac_encoder.cc",
+        "a2dp/a2dp_codec_config.cc",
+        "a2dp/a2dp_sbc.cc",
+        "a2dp/a2dp_sbc_decoder.cc",
+        "a2dp/a2dp_sbc_encoder.cc",
+        "a2dp/a2dp_sbc_up_sample.cc",
+        "a2dp/a2dp_vendor.cc",
+        "a2dp/a2dp_vendor_aptx.cc",
+        "a2dp/a2dp_vendor_aptx_hd.cc",
+        "a2dp/a2dp_vendor_aptx_encoder.cc",
+        "a2dp/a2dp_vendor_aptx_hd_encoder.cc",
+        "a2dp/a2dp_vendor_ldac.cc",
+        "a2dp/a2dp_vendor_ldac_decoder.cc",
+        "a2dp/a2dp_vendor_ldac_encoder.cc",
+        "a2dp/a2dp_vendor_opus.cc",
+        "a2dp/a2dp_vendor_opus_encoder.cc",
+        "a2dp/a2dp_vendor_opus_decoder.cc",
+        "test/a2dp/a2dp_aac_unittest.cc",
+        "test/a2dp/a2dp_sbc_unittest.cc",
+        "test/a2dp/a2dp_opus_unittest.cc",
+        "test/a2dp/a2dp_vendor_ldac_unittest.cc",
+        "test/a2dp/mock_bta_av_codec.cc",
+        "test/a2dp/test_util.cc",
+        "test/a2dp/wav_reader.cc",
+        "test/a2dp/wav_reader_unittest.cc",
+        ":TestMockBta",
+        ":TestMockStackA2dpApi",
+    ],
+    shared_libs: [
+        "libcrypto",
+        "libcutils",
+        "libprotobuf-cpp-lite",
+    ],
+    static_libs: [
+        "libbt-common",
+        "libbt-protos-lite",
+        "libbt-sbc-decoder",
+        "libbt-sbc-encoder",
+        "libFraunhoferAAC",
+        "libgmock",
+        "liblog",
+        "libopus",
+        "libosi",
+        "libosi-AllocationTestHarness",
+    ],
+    whole_static_libs: [
+        "libaptx_enc",
+        "libaptxhd_enc",
+        "libldacBT_abr",
+        "libldacBT_enc",
+    ],
+    sanitize: {
+        address: true,
+        cfi: true,
+        misc_undefined: ["bounds"],
+    },
+}
+
+cc_test {
     name: "net_test_stack_a2dp_native",
     defaults: [
         "fluoride_defaults",
@@ -623,11 +745,7 @@
         "packages/modules/Bluetooth/system/stack/include",
     ],
     srcs: [
-        "a2dp/a2dp_vendor_aptx_encoder.cc",
-        "a2dp/a2dp_vendor_aptx_hd_encoder.cc",
         "a2dp/a2dp_vendor_ldac_decoder.cc",
-        "test/a2dp/a2dp_vendor_aptx_encoder_test.cc",
-        "test/a2dp/a2dp_vendor_aptx_hd_encoder_test.cc",
         "test/a2dp/a2dp_vendor_ldac_decoder_test.cc",
         "test/a2dp/misc_fake.cc",
     ],
@@ -825,6 +943,7 @@
         ":BluetoothHalSources_hci_host",
         ":BluetoothOsSources_host",
         ":TestCommonMainHandler",
+        ":TestCommonMockFunctions",
         ":TestMockBta",
         ":TestMockBtif",
         ":TestMockDevice",
@@ -1183,6 +1302,7 @@
         "libbt-common",
         "libbt-protos-lite",
         "libbtdevice",
+        "libflatbuffers-cpp",
         "libgmock",
         "liblog",
         "libosi",
@@ -1190,7 +1310,6 @@
     shared_libs: [
         "libbinder_ndk",
         "libcrypto",
-        "libflatbuffers-cpp",
         "libprotobuf-cpp-lite",
     ],
     sanitize: {
@@ -1253,6 +1372,7 @@
     static_libs: [
         "libbt-common",
         "libbt-protos-lite",
+        "libflatbuffers-cpp",
         "libgmock",
         "liblog",
         "libosi",
@@ -1260,7 +1380,6 @@
     shared_libs: [
         "libbinder_ndk",
         "libcrypto",
-        "libflatbuffers-cpp",
         "libprotobuf-cpp-lite",
     ],
     sanitize: {
@@ -1278,7 +1397,12 @@
 // Bluetooth stack connection multiplexing
 cc_test {
     name: "net_test_stack_sdp",
-    defaults: ["fluoride_defaults"],
+    test_suites: ["device-tests"],
+    host_supported: true,
+    defaults: [
+        "fluoride_defaults",
+        "mts_defaults",
+    ],
     local_include_dirs: [
         "include",
         "test/common",
@@ -1292,10 +1416,18 @@
     ],
     srcs: [
         ":TestCommonMockFunctions",
+        ":TestMockBtif",
+        ":TestMockOsi",
+        ":TestMockStackL2cap",
+        ":TestMockStackMetrics",
+        "sdp/sdp_api.cc",
+        "sdp/sdp_discovery.cc",
+        "sdp/sdp_server.cc",
+        "sdp/sdp_db.cc",
         "sdp/sdp_main.cc",
         "sdp/sdp_utils.cc",
-        "test/common/mock_btif_config.cc",
-        "test/stack_sdp_utils_test.cc",
+        "test/sdp/stack_sdp_test.cc",
+        "test/sdp/stack_sdp_utils_test.cc",
     ],
     shared_libs: [
         "libcutils",
diff --git a/system/stack/a2dp/a2dp_codec_config.cc b/system/stack/a2dp/a2dp_codec_config.cc
index 52e0f6f..611531cf 100644
--- a/system/stack/a2dp/a2dp_codec_config.cc
+++ b/system/stack/a2dp/a2dp_codec_config.cc
@@ -33,8 +33,12 @@
 #include "a2dp_vendor_aptx.h"
 #include "a2dp_vendor_aptx_hd.h"
 #include "a2dp_vendor_ldac.h"
+#include "a2dp_vendor_opus.h"
 #endif
 
+#if !defined(UNIT_TESTS)
+#include "audio_hal_interface/a2dp_encoding.h"
+#endif
 #include "bta/av/bta_av_int.h"
 #include "osi/include/log.h"
 #include "osi/include/properties.h"
@@ -43,9 +47,6 @@
 /* The Media Type offset within the codec info byte array */
 #define A2DP_MEDIA_TYPE_OFFSET 1
 
-/* A2DP Offload enabled in stack */
-static bool a2dp_offload_status;
-
 // Initializes the codec config.
 // |codec_config| is the codec config to initialize.
 // |codec_index| and |codec_priority| are the codec type and priority to use
@@ -111,7 +112,7 @@
 A2dpCodecConfig* A2dpCodecConfig::createCodec(
     btav_a2dp_codec_index_t codec_index,
     btav_a2dp_codec_priority_t codec_priority) {
-  LOG_INFO("%s: codec %s", __func__, A2DP_CodecIndexStr(codec_index));
+  LOG_INFO("%s", A2DP_CodecIndexStr(codec_index));
 
   A2dpCodecConfig* codec_config = nullptr;
   switch (codec_index) {
@@ -140,6 +141,12 @@
     case BTAV_A2DP_CODEC_INDEX_SINK_LDAC:
       codec_config = new A2dpCodecConfigLdacSink(codec_priority);
       break;
+    case BTAV_A2DP_CODEC_INDEX_SOURCE_OPUS:
+      codec_config = new A2dpCodecConfigOpusSource(codec_priority);
+      break;
+    case BTAV_A2DP_CODEC_INDEX_SINK_OPUS:
+      codec_config = new A2dpCodecConfigOpusSink(codec_priority);
+      break;
 #endif
     case BTAV_A2DP_CODEC_INDEX_MAX:
     default:
@@ -554,43 +561,9 @@
 bool A2dpCodecs::init() {
   LOG_INFO("%s", __func__);
   std::lock_guard<std::recursive_mutex> lock(codec_mutex_);
-  char* tok = NULL;
-  char* tmp_token = NULL;
-  bool offload_codec_support[BTAV_A2DP_CODEC_INDEX_MAX] = {false};
-  char value_sup[PROPERTY_VALUE_MAX], value_dis[PROPERTY_VALUE_MAX];
 
-  osi_property_get("ro.bluetooth.a2dp_offload.supported", value_sup, "false");
-  osi_property_get("persist.bluetooth.a2dp_offload.disabled", value_dis,
-                   "false");
-  a2dp_offload_status =
-      (strcmp(value_sup, "true") == 0) && (strcmp(value_dis, "false") == 0);
-
-  if (a2dp_offload_status) {
-    char value_cap[PROPERTY_VALUE_MAX];
-    osi_property_get("persist.bluetooth.a2dp_offload.cap", value_cap, "");
-    tok = strtok_r((char*)value_cap, "-", &tmp_token);
-    while (tok != NULL) {
-      if (strcmp(tok, "sbc") == 0) {
-        LOG_INFO("%s: SBC offload supported", __func__);
-        offload_codec_support[BTAV_A2DP_CODEC_INDEX_SOURCE_SBC] = true;
-#if !defined(EXCLUDE_NONSTANDARD_CODECS)
-      } else if (strcmp(tok, "aac") == 0) {
-        LOG_INFO("%s: AAC offload supported", __func__);
-        offload_codec_support[BTAV_A2DP_CODEC_INDEX_SOURCE_AAC] = true;
-      } else if (strcmp(tok, "aptx") == 0) {
-        LOG_INFO("%s: APTX offload supported", __func__);
-        offload_codec_support[BTAV_A2DP_CODEC_INDEX_SOURCE_APTX] = true;
-      } else if (strcmp(tok, "aptxhd") == 0) {
-        LOG_INFO("%s: APTXHD offload supported", __func__);
-        offload_codec_support[BTAV_A2DP_CODEC_INDEX_SOURCE_APTX_HD] = true;
-      } else if (strcmp(tok, "ldac") == 0) {
-        LOG_INFO("%s: LDAC offload supported", __func__);
-        offload_codec_support[BTAV_A2DP_CODEC_INDEX_SOURCE_LDAC] = true;
-#endif
-      }
-      tok = strtok_r(NULL, "-", &tmp_token);
-    };
-  }
+  bool opus_enabled =
+      osi_property_get_bool("persist.bluetooth.opus.enabled", false);
 
   for (int i = BTAV_A2DP_CODEC_INDEX_MIN; i < BTAV_A2DP_CODEC_INDEX_MAX; i++) {
     btav_a2dp_codec_index_t codec_index =
@@ -604,10 +577,21 @@
       codec_priority = cp_iter->second;
     }
 
-    // In offload mode, disable the codecs based on the property
-    if ((codec_index < BTAV_A2DP_CODEC_INDEX_SOURCE_MAX) &&
-        a2dp_offload_status && (offload_codec_support[i] != true)) {
+#if !defined(UNIT_TESTS)
+    if (codec_index == BTAV_A2DP_CODEC_INDEX_SOURCE_OPUS) {
+      if (!bluetooth::audio::a2dp::is_opus_supported()) {
+        // We are using HIDL HAL which does not support OPUS codec
+        // Mark OPUS as disabled
+        opus_enabled = false;
+      }
+    }
+#endif
+
+    // If OPUS is not supported it is disabled
+    if (codec_index == BTAV_A2DP_CODEC_INDEX_SOURCE_OPUS && !opus_enabled) {
       codec_priority = BTAV_A2DP_CODEC_PRIORITY_DISABLED;
+      LOG_INFO("%s: OPUS codec disabled, updated priority to %d", __func__,
+               codec_priority);
     }
 
     A2dpCodecConfig* codec_config =
diff --git a/system/stack/a2dp/a2dp_vendor.cc b/system/stack/a2dp/a2dp_vendor.cc
index 759fc43..d0a4423 100644
--- a/system/stack/a2dp/a2dp_vendor.cc
+++ b/system/stack/a2dp/a2dp_vendor.cc
@@ -25,6 +25,7 @@
 #include "a2dp_vendor_aptx.h"
 #include "a2dp_vendor_aptx_hd.h"
 #include "a2dp_vendor_ldac.h"
+#include "a2dp_vendor_opus.h"
 #include "bt_target.h"
 #include "osi/include/log.h"
 #include "osi/include/osi.h"
@@ -51,6 +52,11 @@
     return A2DP_IsVendorSourceCodecValidLdac(p_codec_info);
   }
 
+  // Check for Opus
+  if (vendor_id == A2DP_OPUS_VENDOR_ID && codec_id == A2DP_OPUS_CODEC_ID) {
+    return A2DP_IsVendorSourceCodecValidOpus(p_codec_info);
+  }
+
   // Add checks based on <vendor_id, codec_id>
 
   return false;
@@ -68,6 +74,11 @@
     return A2DP_IsVendorSinkCodecValidLdac(p_codec_info);
   }
 
+  // Check for Opus
+  if (vendor_id == A2DP_OPUS_VENDOR_ID && codec_id == A2DP_OPUS_CODEC_ID) {
+    return A2DP_IsVendorSinkCodecValidOpus(p_codec_info);
+  }
+
   return false;
 }
 
@@ -83,6 +94,11 @@
     return A2DP_IsVendorPeerSourceCodecValidLdac(p_codec_info);
   }
 
+  // Check for Opus
+  if (vendor_id == A2DP_OPUS_VENDOR_ID && codec_id == A2DP_OPUS_CODEC_ID) {
+    return A2DP_IsVendorPeerSourceCodecValidOpus(p_codec_info);
+  }
+
   return false;
 }
 
@@ -107,6 +123,11 @@
     return A2DP_IsVendorPeerSinkCodecValidLdac(p_codec_info);
   }
 
+  // Check for Opus
+  if (vendor_id == A2DP_OPUS_VENDOR_ID && codec_id == A2DP_OPUS_CODEC_ID) {
+    return A2DP_IsVendorPeerSinkCodecValidOpus(p_codec_info);
+  }
+
   // Add checks based on <vendor_id, codec_id>
 
   return false;
@@ -124,6 +145,11 @@
     return A2DP_IsVendorSinkCodecSupportedLdac(p_codec_info);
   }
 
+  // Check for Opus
+  if (vendor_id == A2DP_OPUS_VENDOR_ID && codec_id == A2DP_OPUS_CODEC_ID) {
+    return A2DP_IsVendorSinkCodecSupportedOpus(p_codec_info);
+  }
+
   return false;
 }
 
@@ -139,6 +165,11 @@
     return A2DP_IsPeerSourceCodecSupportedLdac(p_codec_info);
   }
 
+  // Check for Opus
+  if (vendor_id == A2DP_OPUS_VENDOR_ID && codec_id == A2DP_OPUS_CODEC_ID) {
+    return A2DP_IsPeerSourceCodecSupportedOpus(p_codec_info);
+  }
+
   return false;
 }
 
@@ -185,6 +216,12 @@
                                         p_codec_info);
   }
 
+  // Check for Opus
+  if (vendor_id == A2DP_OPUS_VENDOR_ID && codec_id == A2DP_OPUS_CODEC_ID) {
+    return A2DP_VendorUsesRtpHeaderOpus(content_protection_enabled,
+                                        p_codec_info);
+  }
+
   // Add checks based on <content_protection_enabled, vendor_id, codec_id>
 
   return true;
@@ -211,6 +248,11 @@
     return A2DP_VendorCodecNameLdac(p_codec_info);
   }
 
+  // Check for Opus
+  if (vendor_id == A2DP_OPUS_VENDOR_ID && codec_id == A2DP_OPUS_CODEC_ID) {
+    return A2DP_VendorCodecNameOpus(p_codec_info);
+  }
+
   // Add checks based on <vendor_id, codec_id>
 
   return "UNKNOWN VENDOR CODEC";
@@ -250,6 +292,11 @@
     return A2DP_VendorCodecTypeEqualsLdac(p_codec_info_a, p_codec_info_b);
   }
 
+  // Check for Opus
+  if (vendor_id_a == A2DP_OPUS_VENDOR_ID && codec_id_a == A2DP_OPUS_CODEC_ID) {
+    return A2DP_VendorCodecTypeEqualsOpus(p_codec_info_a, p_codec_info_b);
+  }
+
   // OPTIONAL: Add extra vendor-specific checks based on the
   // vendor-specific data stored in "p_codec_info_a" and "p_codec_info_b".
 
@@ -290,6 +337,11 @@
     return A2DP_VendorCodecEqualsLdac(p_codec_info_a, p_codec_info_b);
   }
 
+  // Check for Opus
+  if (vendor_id_a == A2DP_OPUS_VENDOR_ID && codec_id_a == A2DP_OPUS_CODEC_ID) {
+    return A2DP_VendorCodecEqualsOpus(p_codec_info_a, p_codec_info_b);
+  }
+
   // Add extra vendor-specific checks based on the
   // vendor-specific data stored in "p_codec_info_a" and "p_codec_info_b".
 
@@ -317,6 +369,11 @@
     return A2DP_VendorGetBitRateLdac(p_codec_info);
   }
 
+  // Check for Opus
+  if (vendor_id == A2DP_OPUS_VENDOR_ID && codec_id == A2DP_OPUS_CODEC_ID) {
+    return A2DP_VendorGetBitRateOpus(p_codec_info);
+  }
+
   // Add checks based on <vendor_id, codec_id>
 
   return -1;
@@ -343,6 +400,11 @@
     return A2DP_VendorGetTrackSampleRateLdac(p_codec_info);
   }
 
+  // Check for Opus
+  if (vendor_id == A2DP_OPUS_VENDOR_ID && codec_id == A2DP_OPUS_CODEC_ID) {
+    return A2DP_VendorGetTrackSampleRateOpus(p_codec_info);
+  }
+
   // Add checks based on <vendor_id, codec_id>
 
   return -1;
@@ -369,6 +431,11 @@
     return A2DP_VendorGetTrackBitsPerSampleLdac(p_codec_info);
   }
 
+  // Check for Opus
+  if (vendor_id == A2DP_OPUS_VENDOR_ID && codec_id == A2DP_OPUS_CODEC_ID) {
+    return A2DP_VendorGetTrackBitsPerSampleOpus(p_codec_info);
+  }
+
   // Add checks based on <vendor_id, codec_id>
 
   return -1;
@@ -395,6 +462,11 @@
     return A2DP_VendorGetTrackChannelCountLdac(p_codec_info);
   }
 
+  // Check for Opus
+  if (vendor_id == A2DP_OPUS_VENDOR_ID && codec_id == A2DP_OPUS_CODEC_ID) {
+    return A2DP_VendorGetTrackChannelCountOpus(p_codec_info);
+  }
+
   // Add checks based on <vendor_id, codec_id>
 
   return -1;
@@ -412,6 +484,11 @@
     return A2DP_VendorGetSinkTrackChannelTypeLdac(p_codec_info);
   }
 
+  // Check for Opus
+  if (vendor_id == A2DP_OPUS_VENDOR_ID && codec_id == A2DP_OPUS_CODEC_ID) {
+    return A2DP_VendorGetSinkTrackChannelTypeOpus(p_codec_info);
+  }
+
   return -1;
 }
 
@@ -439,6 +516,11 @@
     return A2DP_VendorGetPacketTimestampLdac(p_codec_info, p_data, p_timestamp);
   }
 
+  // Check for Opus
+  if (vendor_id == A2DP_OPUS_VENDOR_ID && codec_id == A2DP_OPUS_CODEC_ID) {
+    return A2DP_VendorGetPacketTimestampOpus(p_codec_info, p_data, p_timestamp);
+  }
+
   // Add checks based on <vendor_id, codec_id>
 
   return false;
@@ -469,6 +551,12 @@
                                            frames_per_packet);
   }
 
+  // Check for Opus
+  if (vendor_id == A2DP_OPUS_VENDOR_ID && codec_id == A2DP_OPUS_CODEC_ID) {
+    return A2DP_VendorBuildCodecHeaderOpus(p_codec_info, p_buf,
+                                           frames_per_packet);
+  }
+
   // Add checks based on <vendor_id, codec_id>
 
   return false;
@@ -496,6 +584,11 @@
     return A2DP_VendorGetEncoderInterfaceLdac(p_codec_info);
   }
 
+  // Check for Opus
+  if (vendor_id == A2DP_OPUS_VENDOR_ID && codec_id == A2DP_OPUS_CODEC_ID) {
+    return A2DP_VendorGetEncoderInterfaceOpus(p_codec_info);
+  }
+
   // Add checks based on <vendor_id, codec_id>
 
   return NULL;
@@ -514,6 +607,11 @@
     return A2DP_VendorGetDecoderInterfaceLdac(p_codec_info);
   }
 
+  // Check for Opus
+  if (vendor_id == A2DP_OPUS_VENDOR_ID && codec_id == A2DP_OPUS_CODEC_ID) {
+    return A2DP_VendorGetDecoderInterfaceOpus(p_codec_info);
+  }
+
   return NULL;
 }
 
@@ -538,6 +636,11 @@
     return A2DP_VendorAdjustCodecLdac(p_codec_info);
   }
 
+  // Check for Opus
+  if (vendor_id == A2DP_OPUS_VENDOR_ID && codec_id == A2DP_OPUS_CODEC_ID) {
+    return A2DP_VendorAdjustCodecOpus(p_codec_info);
+  }
+
   // Add checks based on <vendor_id, codec_id>
 
   return false;
@@ -565,6 +668,11 @@
     return A2DP_VendorSourceCodecIndexLdac(p_codec_info);
   }
 
+  // Check for Opus
+  if (vendor_id == A2DP_OPUS_VENDOR_ID && codec_id == A2DP_OPUS_CODEC_ID) {
+    return A2DP_VendorSourceCodecIndexOpus(p_codec_info);
+  }
+
   // Add checks based on <vendor_id, codec_id>
 
   return BTAV_A2DP_CODEC_INDEX_MAX;
@@ -582,6 +690,11 @@
     return A2DP_VendorSinkCodecIndexLdac(p_codec_info);
   }
 
+  // Check for Opus
+  if (vendor_id == A2DP_OPUS_VENDOR_ID && codec_id == A2DP_OPUS_CODEC_ID) {
+    return A2DP_VendorSinkCodecIndexOpus(p_codec_info);
+  }
+
   return BTAV_A2DP_CODEC_INDEX_MAX;
 }
 
@@ -601,6 +714,12 @@
       return A2DP_VendorCodecIndexStrLdac();
     case BTAV_A2DP_CODEC_INDEX_SINK_LDAC:
       return A2DP_VendorCodecIndexStrLdacSink();
+    case BTAV_A2DP_CODEC_INDEX_SOURCE_LC3:
+      return "LC3 not implemented";
+    case BTAV_A2DP_CODEC_INDEX_SOURCE_OPUS:
+      return A2DP_VendorCodecIndexStrOpus();
+    case BTAV_A2DP_CODEC_INDEX_SINK_OPUS:
+      return A2DP_VendorCodecIndexStrOpusSink();
     // Add a switch statement for each vendor-specific codec
     case BTAV_A2DP_CODEC_INDEX_MAX:
       break;
@@ -626,6 +745,12 @@
       return A2DP_VendorInitCodecConfigLdac(p_cfg);
     case BTAV_A2DP_CODEC_INDEX_SINK_LDAC:
       return A2DP_VendorInitCodecConfigLdacSink(p_cfg);
+    case BTAV_A2DP_CODEC_INDEX_SOURCE_LC3:
+      break;  // not implemented
+    case BTAV_A2DP_CODEC_INDEX_SOURCE_OPUS:
+      return A2DP_VendorInitCodecConfigOpus(p_cfg);
+    case BTAV_A2DP_CODEC_INDEX_SINK_OPUS:
+      return A2DP_VendorInitCodecConfigOpusSink(p_cfg);
     // Add a switch statement for each vendor-specific codec
     case BTAV_A2DP_CODEC_INDEX_MAX:
       break;
@@ -655,21 +780,13 @@
     return A2DP_VendorCodecInfoStringLdac(p_codec_info);
   }
 
+  // Check for Opus
+  if (vendor_id == A2DP_OPUS_VENDOR_ID && codec_id == A2DP_OPUS_CODEC_ID) {
+    return A2DP_VendorCodecInfoStringOpus(p_codec_info);
+  }
+
   // Add checks based on <vendor_id, codec_id>
 
   return "Unsupported codec vendor_id: " + loghex(vendor_id) +
          " codec_id: " + loghex(codec_id);
 }
-
-void* A2DP_VendorCodecLoadExternalLib(const std::string& lib_name,
-                                      const std::string& friendly_name) {
-  void* lib_handle = dlopen(lib_name.c_str(), RTLD_NOW);
-  if (lib_handle == NULL) {
-    LOG(ERROR) << __func__
-               << ": Failed to load codec library: " << friendly_name
-               << ". Err: [" << dlerror() << "]";
-    return nullptr;
-  }
-  LOG(INFO) << __func__ << ": Codec library loaded: " << friendly_name;
-  return lib_handle;
-}
diff --git a/system/stack/a2dp/a2dp_vendor_aptx_encoder.cc b/system/stack/a2dp/a2dp_vendor_aptx_encoder.cc
index 92463f5..5a3785c 100644
--- a/system/stack/a2dp/a2dp_vendor_aptx_encoder.cc
+++ b/system/stack/a2dp/a2dp_vendor_aptx_encoder.cc
@@ -25,6 +25,7 @@
 
 #include "a2dp_vendor.h"
 #include "a2dp_vendor_aptx.h"
+#include "aptXbtenc.h"
 #include "common/time_util.h"
 #include "osi/include/allocator.h"
 #include "osi/include/log.h"
@@ -35,18 +36,11 @@
 // Encoder for aptX Source Codec
 //
 
-//
-// The aptX encoder shared library, and the functions to use
-//
-const std::string APTX_ENCODER_LIB_NAME = "libaptX_encoder.so";
-static void* aptx_encoder_lib_handle = NULL;
-
-static const std::string APTX_ENCODER_INIT_NAME = "aptxbtenc_init";
-static const std::string APTX_ENCODER_ENCODE_STEREO_NAME =
-    "aptxbtenc_encodestereo";
-static const std::string APTX_ENCODER_SIZEOF_PARAMS_NAME = "SizeofAptxbtenc";
-
-static tAPTX_API aptx_api;
+static const tAPTX_API aptx_api = {
+    .init_func = aptxbtenc_init,
+    .encode_stereo_func = aptxbtenc_encodestereo,
+    .sizeof_params_func = SizeofAptxbtenc,
+};
 
 // offset
 #if (BTA_AV_CO_CP_SCMS_T == TRUE)
@@ -56,10 +50,6 @@
 #define A2DP_APTX_OFFSET (AVDT_MEDIA_OFFSET - AVDT_MEDIA_HDR_SIZE)
 #endif
 
-#define LOAD_APTX_SYMBOL(symbol_name, api_type)      \
-  LOAD_CODEC_SYMBOL("AptX", aptx_encoder_lib_handle, \
-                    A2DP_VendorUnloadEncoderAptx, symbol_name, api_type)
-
 #define A2DP_APTX_MAX_PCM_BYTES_PER_READ 4096
 
 typedef struct {
@@ -120,39 +110,17 @@
  *
  ******************************************************************************/
 tLOADING_CODEC_STATUS A2DP_VendorLoadEncoderAptx(void) {
-  if (aptx_encoder_lib_handle != NULL) return LOAD_SUCCESS;  // Already loaded
-
-  // Open the encoder library
-  aptx_encoder_lib_handle =
-      A2DP_VendorCodecLoadExternalLib(APTX_ENCODER_LIB_NAME, "AptX encoder");
-
-  if (!aptx_encoder_lib_handle) return LOAD_ERROR_MISSING_CODEC;
-
-  aptx_api.init_func =
-      LOAD_APTX_SYMBOL(APTX_ENCODER_INIT_NAME, tAPTX_ENCODER_INIT);
-
-  aptx_api.encode_stereo_func = LOAD_APTX_SYMBOL(
-      APTX_ENCODER_ENCODE_STEREO_NAME, tAPTX_ENCODER_ENCODE_STEREO);
-
-  aptx_api.sizeof_params_func = LOAD_APTX_SYMBOL(
-      APTX_ENCODER_SIZEOF_PARAMS_NAME, tAPTX_ENCODER_SIZEOF_PARAMS);
-
+  // Nothing to do - the library is statically linked
   return LOAD_SUCCESS;
 }
 
 bool A2DP_VendorCopyAptxApi(tAPTX_API& external_api) {
-  if (aptx_encoder_lib_handle == NULL) return false;  // not loaded
   external_api = aptx_api;
   return true;
 }
 
 void A2DP_VendorUnloadEncoderAptx(void) {
-  memset(&aptx_api, 0, sizeof(aptx_api));
-
-  if (aptx_encoder_lib_handle != NULL) {
-    dlclose(aptx_encoder_lib_handle);
-    aptx_encoder_lib_handle = NULL;
-  }
+  // nothing to do
 }
 
 void a2dp_vendor_aptx_encoder_init(
diff --git a/system/stack/a2dp/a2dp_vendor_aptx_hd_encoder.cc b/system/stack/a2dp/a2dp_vendor_aptx_hd_encoder.cc
index f3dd9e4..749ffdf 100644
--- a/system/stack/a2dp/a2dp_vendor_aptx_hd_encoder.cc
+++ b/system/stack/a2dp/a2dp_vendor_aptx_hd_encoder.cc
@@ -25,6 +25,7 @@
 
 #include "a2dp_vendor.h"
 #include "a2dp_vendor_aptx_hd.h"
+#include "aptXHDbtenc.h"
 #include "common/time_util.h"
 #include "osi/include/allocator.h"
 #include "osi/include/log.h"
@@ -35,19 +36,11 @@
 // Encoder for aptX-HD Source Codec
 //
 
-//
-// The aptX-HD encoder shared library, and the functions to use
-//
-static const std::string APTX_HD_ENCODER_LIB_NAME = "libaptXHD_encoder.so";
-static void* aptx_hd_encoder_lib_handle = NULL;
-
-static const std::string APTX_HD_ENCODER_INIT_NAME = "aptxhdbtenc_init";
-static const std::string APTX_HD_ENCODER_ENCODE_STEREO_NAME =
-    "aptxhdbtenc_encodestereo";
-static const std::string APTX_HD_ENCODER_SIZEOF_PARAMS_NAME =
-    "SizeofAptxhdbtenc";
-
-static tAPTX_HD_API aptx_hd_api;
+static const tAPTX_HD_API aptx_hd_api = {
+    .init_func = aptxhdbtenc_init,
+    .encode_stereo_func = aptxhdbtenc_encodestereo,
+    .sizeof_params_func = SizeofAptxhdbtenc,
+};
 
 // offset
 #if (BTA_AV_CO_CP_SCMS_T == TRUE)
@@ -56,10 +49,6 @@
 #define A2DP_APTX_HD_OFFSET AVDT_MEDIA_OFFSET
 #endif
 
-#define LOAD_APTX_HD_SYMBOL(symbol_name, api_type)        \
-  LOAD_CODEC_SYMBOL("AptXHd", aptx_hd_encoder_lib_handle, \
-                    A2DP_VendorUnloadEncoderAptxHd, symbol_name, api_type)
-
 #define A2DP_APTX_HD_MAX_PCM_BYTES_PER_READ 4096
 
 typedef struct {
@@ -121,39 +110,17 @@
  *
  ******************************************************************************/
 tLOADING_CODEC_STATUS A2DP_VendorLoadEncoderAptxHd(void) {
-  if (aptx_hd_encoder_lib_handle != NULL)
-    return LOAD_SUCCESS;  // Already loaded
-
-  // Open the encoder library
-  aptx_hd_encoder_lib_handle = A2DP_VendorCodecLoadExternalLib(
-      APTX_HD_ENCODER_LIB_NAME, "AptX-HD encoder");
-  if (!aptx_hd_encoder_lib_handle) return LOAD_ERROR_MISSING_CODEC;
-
-  aptx_hd_api.init_func =
-      LOAD_APTX_HD_SYMBOL(APTX_HD_ENCODER_INIT_NAME, tAPTX_HD_ENCODER_INIT);
-
-  aptx_hd_api.encode_stereo_func = LOAD_APTX_HD_SYMBOL(
-      APTX_HD_ENCODER_ENCODE_STEREO_NAME, tAPTX_HD_ENCODER_ENCODE_STEREO);
-
-  aptx_hd_api.sizeof_params_func = LOAD_APTX_HD_SYMBOL(
-      APTX_HD_ENCODER_SIZEOF_PARAMS_NAME, tAPTX_HD_ENCODER_SIZEOF_PARAMS);
-
+  // Nothing to do - the library is statically linked
   return LOAD_SUCCESS;
 }
 
 bool A2DP_VendorCopyAptxHdApi(tAPTX_HD_API& external_api) {
-  if (aptx_hd_encoder_lib_handle == NULL) return false;  // not loaded
   external_api = aptx_hd_api;
   return true;
 }
 
 void A2DP_VendorUnloadEncoderAptxHd(void) {
-  memset(&aptx_hd_api, 0, sizeof(aptx_hd_api));
-
-  if (aptx_hd_encoder_lib_handle != NULL) {
-    dlclose(aptx_hd_encoder_lib_handle);
-    aptx_hd_encoder_lib_handle = NULL;
-  }
+  // nothing to do
 }
 
 void a2dp_vendor_aptx_hd_encoder_init(
diff --git a/system/stack/a2dp/a2dp_vendor_opus.cc b/system/stack/a2dp/a2dp_vendor_opus.cc
new file mode 100644
index 0000000..8390035
--- /dev/null
+++ b/system/stack/a2dp/a2dp_vendor_opus.cc
@@ -0,0 +1,1332 @@
+/*
+ * Copyright 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/******************************************************************************
+ *
+ *  Utility functions to help build and parse the Opus Codec Information
+ *  Element and Media Payload.
+ *
+ ******************************************************************************/
+
+#define LOG_TAG "a2dp_vendor_opus"
+
+#include "a2dp_vendor_opus.h"
+
+#include <base/logging.h>
+#include <string.h>
+
+#include "a2dp_vendor.h"
+#include "a2dp_vendor_opus_decoder.h"
+#include "a2dp_vendor_opus_encoder.h"
+#include "bt_target.h"
+#include "bt_utils.h"
+#include "btif_av_co.h"
+#include "osi/include/log.h"
+#include "osi/include/osi.h"
+
+// data type for the Opus Codec Information Element */
+// NOTE: bits_per_sample and frameSize for Opus encoder initialization.
+typedef struct {
+  uint32_t vendorId;
+  uint16_t codecId;    /* Codec ID for Opus */
+  uint8_t sampleRate;  /* Sampling Frequency */
+  uint8_t channelMode; /* STEREO/DUAL/MONO */
+  btav_a2dp_codec_bits_per_sample_t bits_per_sample;
+  uint8_t future1; /* codec_specific_1 framesize */
+  uint8_t future2; /* codec_specific_2 */
+  uint8_t future3; /* codec_specific_3 */
+  uint8_t future4; /* codec_specific_4 */
+} tA2DP_OPUS_CIE;
+
+/* Opus Source codec capabilities */
+static const tA2DP_OPUS_CIE a2dp_opus_source_caps = {
+    A2DP_OPUS_VENDOR_ID,  // vendorId
+    A2DP_OPUS_CODEC_ID,   // codecId
+    // sampleRate
+    (A2DP_OPUS_SAMPLING_FREQ_48000),
+    // channelMode
+    (A2DP_OPUS_CHANNEL_MODE_STEREO),
+    // bits_per_sample
+    (BTAV_A2DP_CODEC_BITS_PER_SAMPLE_16),
+    // future 1 frameSize
+    (A2DP_OPUS_20MS_FRAMESIZE),
+    // future 2
+    0x00,
+    // future 3
+    0x00,
+    // future 4
+    0x00};
+
+/* Opus Sink codec capabilities */
+static const tA2DP_OPUS_CIE a2dp_opus_sink_caps = {
+    A2DP_OPUS_VENDOR_ID,  // vendorId
+    A2DP_OPUS_CODEC_ID,   // codecId
+    // sampleRate
+    (A2DP_OPUS_SAMPLING_FREQ_48000),
+    // channelMode
+    (A2DP_OPUS_CHANNEL_MODE_STEREO),
+    // bits_per_sample
+    (BTAV_A2DP_CODEC_BITS_PER_SAMPLE_16),
+    // future 1 frameSize
+    (A2DP_OPUS_20MS_FRAMESIZE),
+    // future 2
+    0x00,
+    // future 3
+    0x00,
+    // future 4
+    0x00};
+
+/* Default Opus codec configuration */
+static const tA2DP_OPUS_CIE a2dp_opus_default_config = {
+    A2DP_OPUS_VENDOR_ID,                 // vendorId
+    A2DP_OPUS_CODEC_ID,                  // codecId
+    A2DP_OPUS_SAMPLING_FREQ_48000,       // sampleRate
+    A2DP_OPUS_CHANNEL_MODE_STEREO,       // channelMode
+    BTAV_A2DP_CODEC_BITS_PER_SAMPLE_16,  // bits_per_sample
+    A2DP_OPUS_20MS_FRAMESIZE,            // frameSize
+    0x00,                                // future 2
+    0x00,                                // future 3
+    0x00                                 // future 4
+};
+
+static const tA2DP_ENCODER_INTERFACE a2dp_encoder_interface_opus = {
+    a2dp_vendor_opus_encoder_init,
+    a2dp_vendor_opus_encoder_cleanup,
+    a2dp_vendor_opus_feeding_reset,
+    a2dp_vendor_opus_feeding_flush,
+    a2dp_vendor_opus_get_encoder_interval_ms,
+    a2dp_vendor_opus_get_effective_frame_size,
+    a2dp_vendor_opus_send_frames,
+    a2dp_vendor_opus_set_transmit_queue_length};
+
+static const tA2DP_DECODER_INTERFACE a2dp_decoder_interface_opus = {
+    a2dp_vendor_opus_decoder_init,          a2dp_vendor_opus_decoder_cleanup,
+    a2dp_vendor_opus_decoder_decode_packet, a2dp_vendor_opus_decoder_start,
+    a2dp_vendor_opus_decoder_suspend,       a2dp_vendor_opus_decoder_configure,
+};
+
+UNUSED_ATTR static tA2DP_STATUS A2DP_CodecInfoMatchesCapabilityOpus(
+    const tA2DP_OPUS_CIE* p_cap, const uint8_t* p_codec_info,
+    bool is_peer_codec_info);
+
+// Builds the Opus Media Codec Capabilities byte sequence beginning from the
+// LOSC octet. |media_type| is the media type |AVDT_MEDIA_TYPE_*|.
+// |p_ie| is a pointer to the Opus Codec Information Element information.
+// The result is stored in |p_result|. Returns A2DP_SUCCESS on success,
+// otherwise the corresponding A2DP error status code.
+static tA2DP_STATUS A2DP_BuildInfoOpus(uint8_t media_type,
+                                       const tA2DP_OPUS_CIE* p_ie,
+                                       uint8_t* p_result) {
+  if (p_ie == NULL || p_result == NULL) {
+    LOG_ERROR("invalid information element");
+    return A2DP_INVALID_PARAMS;
+  }
+
+  *p_result++ = A2DP_OPUS_CODEC_LEN;
+  *p_result++ = (media_type << 4);
+  *p_result++ = A2DP_MEDIA_CT_NON_A2DP;
+
+  // Vendor ID and Codec ID
+  *p_result++ = (uint8_t)(p_ie->vendorId & 0x000000FF);
+  *p_result++ = (uint8_t)((p_ie->vendorId & 0x0000FF00) >> 8);
+  *p_result++ = (uint8_t)((p_ie->vendorId & 0x00FF0000) >> 16);
+  *p_result++ = (uint8_t)((p_ie->vendorId & 0xFF000000) >> 24);
+  *p_result++ = (uint8_t)(p_ie->codecId & 0x00FF);
+  *p_result++ = (uint8_t)((p_ie->codecId & 0xFF00) >> 8);
+
+  *p_result = 0;
+  *p_result |= (uint8_t)(p_ie->channelMode) & A2DP_OPUS_CHANNEL_MODE_MASK;
+  if ((*p_result & A2DP_OPUS_CHANNEL_MODE_MASK) == 0) {
+    LOG_ERROR("channelmode 0x%X setting failed", (p_ie->channelMode));
+    return A2DP_INVALID_PARAMS;
+  }
+
+  *p_result |= ((uint8_t)(p_ie->future1) & A2DP_OPUS_FRAMESIZE_MASK);
+  if ((*p_result & A2DP_OPUS_FRAMESIZE_MASK) == 0) {
+    LOG_ERROR("frameSize 0x%X setting failed", (p_ie->future1));
+    return A2DP_INVALID_PARAMS;
+  }
+
+  *p_result |= ((uint8_t)(p_ie->sampleRate) & A2DP_OPUS_SAMPLING_FREQ_MASK);
+  if ((*p_result & A2DP_OPUS_SAMPLING_FREQ_MASK) == 0) {
+    LOG_ERROR("samplerate 0x%X setting failed", (p_ie->sampleRate));
+    return A2DP_INVALID_PARAMS;
+  }
+
+  p_result++;
+
+  return A2DP_SUCCESS;
+}
+
+// Parses the Opus Media Codec Capabilities byte sequence beginning from the
+// LOSC octet. The result is stored in |p_ie|. The byte sequence to parse is
+// |p_codec_info|. If |is_capability| is true, the byte sequence is
+// codec capabilities, otherwise is codec configuration.
+// Returns A2DP_SUCCESS on success, otherwise the corresponding A2DP error
+// status code.
+static tA2DP_STATUS A2DP_ParseInfoOpus(tA2DP_OPUS_CIE* p_ie,
+                                       const uint8_t* p_codec_info,
+                                       bool is_capability) {
+  uint8_t losc;
+  uint8_t media_type;
+  tA2DP_CODEC_TYPE codec_type;
+
+  if (p_ie == NULL || p_codec_info == NULL) {
+    LOG_ERROR("unable to parse information element");
+    return A2DP_INVALID_PARAMS;
+  }
+
+  // Check the codec capability length
+  losc = *p_codec_info++;
+  if (losc != A2DP_OPUS_CODEC_LEN) {
+    LOG_ERROR("invalid codec ie length %d", losc);
+    return A2DP_WRONG_CODEC;
+  }
+
+  media_type = (*p_codec_info++) >> 4;
+  codec_type = *p_codec_info++;
+  /* Check the Media Type and Media Codec Type */
+  if (media_type != AVDT_MEDIA_TYPE_AUDIO ||
+      codec_type != A2DP_MEDIA_CT_NON_A2DP) {
+    LOG_ERROR("invalid codec");
+    return A2DP_WRONG_CODEC;
+  }
+
+  // Check the Vendor ID and Codec ID */
+  p_ie->vendorId = (*p_codec_info & 0x000000FF) |
+                   (*(p_codec_info + 1) << 8 & 0x0000FF00) |
+                   (*(p_codec_info + 2) << 16 & 0x00FF0000) |
+                   (*(p_codec_info + 3) << 24 & 0xFF000000);
+  p_codec_info += 4;
+  p_ie->codecId =
+      (*p_codec_info & 0x00FF) | (*(p_codec_info + 1) << 8 & 0xFF00);
+  p_codec_info += 2;
+  if (p_ie->vendorId != A2DP_OPUS_VENDOR_ID ||
+      p_ie->codecId != A2DP_OPUS_CODEC_ID) {
+    LOG_ERROR("wrong vendor or codec id");
+    return A2DP_WRONG_CODEC;
+  }
+
+  p_ie->channelMode = *p_codec_info & A2DP_OPUS_CHANNEL_MODE_MASK;
+  p_ie->future1 = *p_codec_info & A2DP_OPUS_FRAMESIZE_MASK;
+  p_ie->sampleRate = *p_codec_info & A2DP_OPUS_SAMPLING_FREQ_MASK;
+  p_ie->bits_per_sample = BTAV_A2DP_CODEC_BITS_PER_SAMPLE_16;
+
+  if (is_capability) {
+    // NOTE: The checks here are very liberal. We should be using more
+    // pedantic checks specific to the SRC or SNK as specified in the spec.
+    if (A2DP_BitsSet(p_ie->sampleRate) == A2DP_SET_ZERO_BIT) {
+      LOG_ERROR("invalid sample rate 0x%X", p_ie->sampleRate);
+      return A2DP_BAD_SAMP_FREQ;
+    }
+    if (A2DP_BitsSet(p_ie->channelMode) == A2DP_SET_ZERO_BIT) {
+      LOG_ERROR("invalid channel mode");
+      return A2DP_BAD_CH_MODE;
+    }
+
+    return A2DP_SUCCESS;
+  }
+
+  if (A2DP_BitsSet(p_ie->sampleRate) != A2DP_SET_ONE_BIT) {
+    LOG_ERROR("invalid sampling frequency 0x%X", p_ie->sampleRate);
+    return A2DP_BAD_SAMP_FREQ;
+  }
+  if (A2DP_BitsSet(p_ie->channelMode) != A2DP_SET_ONE_BIT) {
+    LOG_ERROR("invalid channel mode.");
+    return A2DP_BAD_CH_MODE;
+  }
+
+  return A2DP_SUCCESS;
+}
+
+// Build the Opus Media Payload Header.
+// |p_dst| points to the location where the header should be written to.
+// If |frag| is true, the media payload frame is fragmented.
+// |start| is true for the first packet of a fragmented frame.
+// |last| is true for the last packet of a fragmented frame.
+// If |frag| is false, |num| is the number of number of frames in the packet,
+// otherwise is the number of remaining fragments (including this one).
+static void A2DP_BuildMediaPayloadHeaderOpus(uint8_t* p_dst, bool frag,
+                                             bool start, bool last,
+                                             uint8_t num) {
+  if (p_dst == NULL) return;
+
+  *p_dst = 0;
+  if (frag) *p_dst |= A2DP_OPUS_HDR_F_MSK;
+  if (start) *p_dst |= A2DP_OPUS_HDR_S_MSK;
+  if (last) *p_dst |= A2DP_OPUS_HDR_L_MSK;
+  *p_dst |= (A2DP_OPUS_HDR_NUM_MSK & num);
+}
+
+bool A2DP_IsVendorSourceCodecValidOpus(const uint8_t* p_codec_info) {
+  tA2DP_OPUS_CIE cfg_cie;
+
+  /* Use a liberal check when parsing the codec info */
+  return (A2DP_ParseInfoOpus(&cfg_cie, p_codec_info, false) == A2DP_SUCCESS) ||
+         (A2DP_ParseInfoOpus(&cfg_cie, p_codec_info, true) == A2DP_SUCCESS);
+}
+
+bool A2DP_IsVendorSinkCodecValidOpus(const uint8_t* p_codec_info) {
+  tA2DP_OPUS_CIE cfg_cie;
+
+  /* Use a liberal check when parsing the codec info */
+  return (A2DP_ParseInfoOpus(&cfg_cie, p_codec_info, false) == A2DP_SUCCESS) ||
+         (A2DP_ParseInfoOpus(&cfg_cie, p_codec_info, true) == A2DP_SUCCESS);
+}
+
+bool A2DP_IsVendorPeerSourceCodecValidOpus(const uint8_t* p_codec_info) {
+  tA2DP_OPUS_CIE cfg_cie;
+
+  /* Use a liberal check when parsing the codec info */
+  return (A2DP_ParseInfoOpus(&cfg_cie, p_codec_info, false) == A2DP_SUCCESS) ||
+         (A2DP_ParseInfoOpus(&cfg_cie, p_codec_info, true) == A2DP_SUCCESS);
+}
+
+bool A2DP_IsVendorPeerSinkCodecValidOpus(const uint8_t* p_codec_info) {
+  tA2DP_OPUS_CIE cfg_cie;
+
+  /* Use a liberal check when parsing the codec info */
+  return (A2DP_ParseInfoOpus(&cfg_cie, p_codec_info, false) == A2DP_SUCCESS) ||
+         (A2DP_ParseInfoOpus(&cfg_cie, p_codec_info, true) == A2DP_SUCCESS);
+}
+
+bool A2DP_IsVendorSinkCodecSupportedOpus(const uint8_t* p_codec_info) {
+  return A2DP_CodecInfoMatchesCapabilityOpus(&a2dp_opus_sink_caps, p_codec_info,
+                                             false) == A2DP_SUCCESS;
+}
+bool A2DP_IsPeerSourceCodecSupportedOpus(const uint8_t* p_codec_info) {
+  return A2DP_CodecInfoMatchesCapabilityOpus(&a2dp_opus_sink_caps, p_codec_info,
+                                             true) == A2DP_SUCCESS;
+}
+
+// Checks whether A2DP Opus codec configuration matches with a device's codec
+// capabilities. |p_cap| is the Opus codec configuration. |p_codec_info| is
+// the device's codec capabilities.
+// If |is_capability| is true, the byte sequence is codec capabilities,
+// otherwise is codec configuration.
+// |p_codec_info| contains the codec capabilities for a peer device that
+// is acting as an A2DP source.
+// Returns A2DP_SUCCESS if the codec configuration matches with capabilities,
+// otherwise the corresponding A2DP error status code.
+static tA2DP_STATUS A2DP_CodecInfoMatchesCapabilityOpus(
+    const tA2DP_OPUS_CIE* p_cap, const uint8_t* p_codec_info,
+    bool is_capability) {
+  tA2DP_STATUS status;
+  tA2DP_OPUS_CIE cfg_cie;
+
+  /* parse configuration */
+  status = A2DP_ParseInfoOpus(&cfg_cie, p_codec_info, is_capability);
+  if (status != A2DP_SUCCESS) {
+    LOG_ERROR("parsing failed %d", status);
+    return status;
+  }
+
+  /* verify that each parameter is in range */
+
+  LOG_VERBOSE("SAMPLING FREQ peer: 0x%x, capability 0x%x", cfg_cie.sampleRate,
+              p_cap->sampleRate);
+  LOG_VERBOSE("CH_MODE peer: 0x%x, capability 0x%x", cfg_cie.channelMode,
+              p_cap->channelMode);
+  LOG_VERBOSE("FRAMESIZE peer: 0x%x, capability 0x%x", cfg_cie.future1,
+              p_cap->future1);
+
+  /* sampling frequency */
+  if ((cfg_cie.sampleRate & p_cap->sampleRate) == 0) return A2DP_NS_SAMP_FREQ;
+
+  /* channel mode */
+  if ((cfg_cie.channelMode & p_cap->channelMode) == 0) return A2DP_NS_CH_MODE;
+
+  /* frameSize */
+  if ((cfg_cie.future1 & p_cap->future1) == 0) return A2DP_NS_FRAMESIZE;
+
+  return A2DP_SUCCESS;
+}
+
+bool A2DP_VendorUsesRtpHeaderOpus(UNUSED_ATTR bool content_protection_enabled,
+                                  UNUSED_ATTR const uint8_t* p_codec_info) {
+  return true;
+}
+
+const char* A2DP_VendorCodecNameOpus(UNUSED_ATTR const uint8_t* p_codec_info) {
+  return "Opus";
+}
+
+bool A2DP_VendorCodecTypeEqualsOpus(const uint8_t* p_codec_info_a,
+                                    const uint8_t* p_codec_info_b) {
+  tA2DP_OPUS_CIE Opus_cie_a;
+  tA2DP_OPUS_CIE Opus_cie_b;
+
+  // Check whether the codec info contains valid data
+  tA2DP_STATUS a2dp_status =
+      A2DP_ParseInfoOpus(&Opus_cie_a, p_codec_info_a, true);
+  if (a2dp_status != A2DP_SUCCESS) {
+    LOG_ERROR("cannot decode codec information: %d", a2dp_status);
+    return false;
+  }
+  a2dp_status = A2DP_ParseInfoOpus(&Opus_cie_b, p_codec_info_b, true);
+  if (a2dp_status != A2DP_SUCCESS) {
+    LOG_ERROR("cannot decode codec information: %d", a2dp_status);
+    return false;
+  }
+
+  return true;
+}
+
+bool A2DP_VendorCodecEqualsOpus(const uint8_t* p_codec_info_a,
+                                const uint8_t* p_codec_info_b) {
+  tA2DP_OPUS_CIE Opus_cie_a;
+  tA2DP_OPUS_CIE Opus_cie_b;
+
+  // Check whether the codec info contains valid data
+  tA2DP_STATUS a2dp_status =
+      A2DP_ParseInfoOpus(&Opus_cie_a, p_codec_info_a, true);
+  if (a2dp_status != A2DP_SUCCESS) {
+    LOG_ERROR("cannot decode codec information: %d", a2dp_status);
+    return false;
+  }
+  a2dp_status = A2DP_ParseInfoOpus(&Opus_cie_b, p_codec_info_b, true);
+  if (a2dp_status != A2DP_SUCCESS) {
+    LOG_ERROR("cannot decode codec information: %d", a2dp_status);
+    return false;
+  }
+
+  return (Opus_cie_a.sampleRate == Opus_cie_b.sampleRate) &&
+         (Opus_cie_a.channelMode == Opus_cie_b.channelMode) &&
+         (Opus_cie_a.future1 == Opus_cie_b.future1);
+}
+
+int A2DP_VendorGetBitRateOpus(const uint8_t* p_codec_info) {
+  int channel_count = A2DP_VendorGetTrackChannelCountOpus(p_codec_info);
+  int framesize = A2DP_VendorGetFrameSizeOpus(p_codec_info);
+  int samplerate = A2DP_VendorGetTrackSampleRateOpus(p_codec_info);
+
+  // in milliseconds
+  switch ((framesize * 1000) / samplerate) {
+    case 20:
+      if (channel_count == 2) {
+        return 256000;
+      } else if (channel_count == 1) {
+        return 128000;
+      } else
+        return -1;
+    default:
+      return -1;
+  }
+}
+
+int A2DP_VendorGetTrackSampleRateOpus(const uint8_t* p_codec_info) {
+  tA2DP_OPUS_CIE Opus_cie;
+
+  // Check whether the codec info contains valid data
+  tA2DP_STATUS a2dp_status = A2DP_ParseInfoOpus(&Opus_cie, p_codec_info, false);
+  if (a2dp_status != A2DP_SUCCESS) {
+    LOG_ERROR("cannot decode codec information: %d", a2dp_status);
+    return -1;
+  }
+
+  switch (Opus_cie.sampleRate) {
+    case A2DP_OPUS_SAMPLING_FREQ_48000:
+      return 48000;
+  }
+
+  return -1;
+}
+
+int A2DP_VendorGetTrackBitsPerSampleOpus(const uint8_t* p_codec_info) {
+  tA2DP_OPUS_CIE Opus_cie;
+
+  // Check whether the codec info contains valid data
+  tA2DP_STATUS a2dp_status = A2DP_ParseInfoOpus(&Opus_cie, p_codec_info, false);
+  if (a2dp_status != A2DP_SUCCESS) {
+    LOG_ERROR("cannot decode codec information: %d", a2dp_status);
+    return -1;
+  }
+
+  switch (Opus_cie.bits_per_sample) {
+    case BTAV_A2DP_CODEC_BITS_PER_SAMPLE_16:
+      return 16;
+    case BTAV_A2DP_CODEC_BITS_PER_SAMPLE_24:
+      return 24;
+    case BTAV_A2DP_CODEC_BITS_PER_SAMPLE_32:
+      return 32;
+    case BTAV_A2DP_CODEC_BITS_PER_SAMPLE_NONE:
+    default:
+      LOG_ERROR("Invalid bit depth setting");
+      return -1;
+  }
+}
+
+int A2DP_VendorGetTrackChannelCountOpus(const uint8_t* p_codec_info) {
+  tA2DP_OPUS_CIE Opus_cie;
+
+  // Check whether the codec info contains valid data
+  tA2DP_STATUS a2dp_status = A2DP_ParseInfoOpus(&Opus_cie, p_codec_info, false);
+  if (a2dp_status != A2DP_SUCCESS) {
+    LOG_ERROR("cannot decode codec information: %d", a2dp_status);
+    return -1;
+  }
+
+  switch (Opus_cie.channelMode) {
+    case A2DP_OPUS_CHANNEL_MODE_MONO:
+      return 1;
+    case A2DP_OPUS_CHANNEL_MODE_STEREO:
+    case A2DP_OPUS_CHANNEL_MODE_DUAL_MONO:
+      return 2;
+    default:
+      LOG_ERROR("Invalid channel setting");
+  }
+
+  return -1;
+}
+
+int A2DP_VendorGetSinkTrackChannelTypeOpus(const uint8_t* p_codec_info) {
+  tA2DP_OPUS_CIE Opus_cie;
+
+  // Check whether the codec info contains valid data
+  tA2DP_STATUS a2dp_status = A2DP_ParseInfoOpus(&Opus_cie, p_codec_info, false);
+  if (a2dp_status != A2DP_SUCCESS) {
+    LOG_ERROR("cannot decode codec information: %d", a2dp_status);
+    return -1;
+  }
+
+  switch (Opus_cie.channelMode) {
+    case A2DP_OPUS_CHANNEL_MODE_MONO:
+      return 1;
+    case A2DP_OPUS_CHANNEL_MODE_STEREO:
+      return 2;
+  }
+
+  return -1;
+}
+
+int A2DP_VendorGetChannelModeCodeOpus(const uint8_t* p_codec_info) {
+  tA2DP_OPUS_CIE Opus_cie;
+
+  // Check whether the codec info contains valid data
+  tA2DP_STATUS a2dp_status = A2DP_ParseInfoOpus(&Opus_cie, p_codec_info, false);
+  if (a2dp_status != A2DP_SUCCESS) {
+    LOG_ERROR("cannot decode codec information: %d", a2dp_status);
+    return -1;
+  }
+
+  switch (Opus_cie.channelMode) {
+    case A2DP_OPUS_CHANNEL_MODE_MONO:
+    case A2DP_OPUS_CHANNEL_MODE_STEREO:
+      return Opus_cie.channelMode;
+    default:
+      break;
+  }
+
+  return -1;
+}
+
+int A2DP_VendorGetFrameSizeOpus(const uint8_t* p_codec_info) {
+  tA2DP_OPUS_CIE Opus_cie;
+
+  // Check whether the codec info contains valid data
+  tA2DP_STATUS a2dp_status = A2DP_ParseInfoOpus(&Opus_cie, p_codec_info, false);
+  if (a2dp_status != A2DP_SUCCESS) {
+    LOG_ERROR("cannot decode codec information: %d", a2dp_status);
+    return -1;
+  }
+  int samplerate = A2DP_VendorGetTrackSampleRateOpus(p_codec_info);
+
+  switch (Opus_cie.future1) {
+    case A2DP_OPUS_20MS_FRAMESIZE:
+      if (samplerate == 48000) {
+        return 960;
+      }
+  }
+
+  return -1;
+}
+
+bool A2DP_VendorGetPacketTimestampOpus(UNUSED_ATTR const uint8_t* p_codec_info,
+                                       const uint8_t* p_data,
+                                       uint32_t* p_timestamp) {
+  *p_timestamp = *(const uint32_t*)p_data;
+  return true;
+}
+
+bool A2DP_VendorBuildCodecHeaderOpus(UNUSED_ATTR const uint8_t* p_codec_info,
+                                     BT_HDR* p_buf,
+                                     uint16_t frames_per_packet) {
+  uint8_t* p;
+
+  p_buf->offset -= A2DP_OPUS_MPL_HDR_LEN;
+  p = (uint8_t*)(p_buf + 1) + p_buf->offset;
+  p_buf->len += A2DP_OPUS_MPL_HDR_LEN;
+
+  A2DP_BuildMediaPayloadHeaderOpus(p, false, false, false,
+                                   (uint8_t)frames_per_packet);
+
+  return true;
+}
+
+std::string A2DP_VendorCodecInfoStringOpus(const uint8_t* p_codec_info) {
+  std::stringstream res;
+  std::string field;
+  tA2DP_STATUS a2dp_status;
+  tA2DP_OPUS_CIE Opus_cie;
+
+  a2dp_status = A2DP_ParseInfoOpus(&Opus_cie, p_codec_info, true);
+  if (a2dp_status != A2DP_SUCCESS) {
+    res << "A2DP_ParseInfoOpus fail: " << loghex(a2dp_status);
+    return res.str();
+  }
+
+  res << "\tname: Opus\n";
+
+  // Sample frequency
+  field.clear();
+  AppendField(&field, (Opus_cie.sampleRate == 0), "NONE");
+  AppendField(&field, (Opus_cie.sampleRate & A2DP_OPUS_SAMPLING_FREQ_48000),
+              "48000");
+  res << "\tsamp_freq: " << field << " (" << loghex(Opus_cie.sampleRate)
+      << ")\n";
+
+  // Channel mode
+  field.clear();
+  AppendField(&field, (Opus_cie.channelMode == 0), "NONE");
+  AppendField(&field, (Opus_cie.channelMode & A2DP_OPUS_CHANNEL_MODE_MONO),
+              "Mono");
+  AppendField(&field, (Opus_cie.channelMode & A2DP_OPUS_CHANNEL_MODE_STEREO),
+              "Stereo");
+  res << "\tch_mode: " << field << " (" << loghex(Opus_cie.channelMode)
+      << ")\n";
+
+  // Framesize
+  field.clear();
+  AppendField(&field, (Opus_cie.future1 == 0), "NONE");
+  AppendField(&field, (Opus_cie.future1 & A2DP_OPUS_20MS_FRAMESIZE), "20ms");
+  AppendField(&field, (Opus_cie.future1 & A2DP_OPUS_10MS_FRAMESIZE), "10ms");
+  res << "\tframesize: " << field << " (" << loghex(Opus_cie.future1) << ")\n";
+
+  return res.str();
+}
+
+const tA2DP_ENCODER_INTERFACE* A2DP_VendorGetEncoderInterfaceOpus(
+    const uint8_t* p_codec_info) {
+  if (!A2DP_IsVendorSourceCodecValidOpus(p_codec_info)) return NULL;
+
+  return &a2dp_encoder_interface_opus;
+}
+
+const tA2DP_DECODER_INTERFACE* A2DP_VendorGetDecoderInterfaceOpus(
+    const uint8_t* p_codec_info) {
+  if (!A2DP_IsVendorSinkCodecValidOpus(p_codec_info)) return NULL;
+
+  return &a2dp_decoder_interface_opus;
+}
+
+bool A2DP_VendorAdjustCodecOpus(uint8_t* p_codec_info) {
+  tA2DP_OPUS_CIE cfg_cie;
+
+  // Nothing to do: just verify the codec info is valid
+  if (A2DP_ParseInfoOpus(&cfg_cie, p_codec_info, true) != A2DP_SUCCESS)
+    return false;
+
+  return true;
+}
+
+btav_a2dp_codec_index_t A2DP_VendorSourceCodecIndexOpus(
+    UNUSED_ATTR const uint8_t* p_codec_info) {
+  return BTAV_A2DP_CODEC_INDEX_SOURCE_OPUS;
+}
+
+btav_a2dp_codec_index_t A2DP_VendorSinkCodecIndexOpus(
+    UNUSED_ATTR const uint8_t* p_codec_info) {
+  return BTAV_A2DP_CODEC_INDEX_SINK_OPUS;
+}
+
+const char* A2DP_VendorCodecIndexStrOpus(void) { return "Opus"; }
+
+const char* A2DP_VendorCodecIndexStrOpusSink(void) { return "Opus SINK"; }
+
+bool A2DP_VendorInitCodecConfigOpus(AvdtpSepConfig* p_cfg) {
+  if (A2DP_BuildInfoOpus(AVDT_MEDIA_TYPE_AUDIO, &a2dp_opus_source_caps,
+                         p_cfg->codec_info) != A2DP_SUCCESS) {
+    return false;
+  }
+
+#if (BTA_AV_CO_CP_SCMS_T == TRUE)
+  /* Content protection info - support SCMS-T */
+  uint8_t* p = p_cfg->protect_info;
+  *p++ = AVDT_CP_LOSC;
+  UINT16_TO_STREAM(p, AVDT_CP_SCMS_T_ID);
+  p_cfg->num_protect = 1;
+#endif
+
+  return true;
+}
+
+bool A2DP_VendorInitCodecConfigOpusSink(AvdtpSepConfig* p_cfg) {
+  return A2DP_BuildInfoOpus(AVDT_MEDIA_TYPE_AUDIO, &a2dp_opus_sink_caps,
+                            p_cfg->codec_info) == A2DP_SUCCESS;
+}
+
+UNUSED_ATTR static void build_codec_config(const tA2DP_OPUS_CIE& config_cie,
+                                           btav_a2dp_codec_config_t* result) {
+  if (config_cie.sampleRate & A2DP_OPUS_SAMPLING_FREQ_48000)
+    result->sample_rate |= BTAV_A2DP_CODEC_SAMPLE_RATE_48000;
+
+  result->bits_per_sample = config_cie.bits_per_sample;
+
+  if (config_cie.channelMode & A2DP_OPUS_CHANNEL_MODE_MONO)
+    result->channel_mode |= BTAV_A2DP_CODEC_CHANNEL_MODE_MONO;
+  if (config_cie.channelMode & A2DP_OPUS_CHANNEL_MODE_STEREO) {
+    result->channel_mode |= BTAV_A2DP_CODEC_CHANNEL_MODE_STEREO;
+  }
+
+  if (config_cie.future1 & A2DP_OPUS_20MS_FRAMESIZE)
+    result->codec_specific_1 |= BTAV_A2DP_CODEC_FRAME_SIZE_20MS;
+  if (config_cie.future1 & A2DP_OPUS_10MS_FRAMESIZE)
+    result->codec_specific_1 |= BTAV_A2DP_CODEC_FRAME_SIZE_10MS;
+}
+
+A2dpCodecConfigOpusSource::A2dpCodecConfigOpusSource(
+    btav_a2dp_codec_priority_t codec_priority)
+    : A2dpCodecConfigOpusBase(BTAV_A2DP_CODEC_INDEX_SOURCE_OPUS,
+                              A2DP_VendorCodecIndexStrOpus(), codec_priority,
+                              true) {
+  // Compute the local capability
+  if (a2dp_opus_source_caps.sampleRate & A2DP_OPUS_SAMPLING_FREQ_48000) {
+    codec_local_capability_.sample_rate |= BTAV_A2DP_CODEC_SAMPLE_RATE_48000;
+  }
+  codec_local_capability_.bits_per_sample =
+      a2dp_opus_source_caps.bits_per_sample;
+  if (a2dp_opus_source_caps.channelMode & A2DP_OPUS_CHANNEL_MODE_MONO) {
+    codec_local_capability_.channel_mode |= BTAV_A2DP_CODEC_CHANNEL_MODE_MONO;
+  }
+  if (a2dp_opus_source_caps.channelMode & A2DP_OPUS_CHANNEL_MODE_STEREO) {
+    codec_local_capability_.channel_mode |= BTAV_A2DP_CODEC_CHANNEL_MODE_STEREO;
+  }
+}
+
+A2dpCodecConfigOpusSource::~A2dpCodecConfigOpusSource() {}
+
+bool A2dpCodecConfigOpusSource::init() {
+  if (!isValid()) return false;
+
+  return true;
+}
+
+bool A2dpCodecConfigOpusSource::useRtpHeaderMarkerBit() const { return false; }
+
+//
+// Selects the best sample rate from |sampleRate|.
+// The result is stored in |p_result| and |p_codec_config|.
+// Returns true if a selection was made, otherwise false.
+//
+static bool select_best_sample_rate(uint8_t sampleRate,
+                                    tA2DP_OPUS_CIE* p_result,
+                                    btav_a2dp_codec_config_t* p_codec_config) {
+  if (sampleRate & A2DP_OPUS_SAMPLING_FREQ_48000) {
+    p_result->sampleRate = A2DP_OPUS_SAMPLING_FREQ_48000;
+    p_codec_config->sample_rate = BTAV_A2DP_CODEC_SAMPLE_RATE_48000;
+    return true;
+  }
+  return false;
+}
+
+//
+// Selects the audio sample rate from |p_codec_audio_config|.
+// |sampleRate| contains the capability.
+// The result is stored in |p_result| and |p_codec_config|.
+// Returns true if a selection was made, otherwise false.
+//
+static bool select_audio_sample_rate(
+    const btav_a2dp_codec_config_t* p_codec_audio_config, uint8_t sampleRate,
+    tA2DP_OPUS_CIE* p_result, btav_a2dp_codec_config_t* p_codec_config) {
+  switch (p_codec_audio_config->sample_rate) {
+    case BTAV_A2DP_CODEC_SAMPLE_RATE_48000:
+      if (sampleRate & A2DP_OPUS_SAMPLING_FREQ_48000) {
+        p_result->sampleRate = A2DP_OPUS_SAMPLING_FREQ_48000;
+        p_codec_config->sample_rate = BTAV_A2DP_CODEC_SAMPLE_RATE_48000;
+        return true;
+      }
+      break;
+    case BTAV_A2DP_CODEC_SAMPLE_RATE_16000:
+    case BTAV_A2DP_CODEC_SAMPLE_RATE_24000:
+    case BTAV_A2DP_CODEC_SAMPLE_RATE_44100:
+    case BTAV_A2DP_CODEC_SAMPLE_RATE_88200:
+    case BTAV_A2DP_CODEC_SAMPLE_RATE_96000:
+    case BTAV_A2DP_CODEC_SAMPLE_RATE_176400:
+    case BTAV_A2DP_CODEC_SAMPLE_RATE_192000:
+    case BTAV_A2DP_CODEC_SAMPLE_RATE_NONE:
+      break;
+  }
+
+  return false;
+}
+
+//
+// Selects the best bits per sample from |bits_per_sample|.
+// |bits_per_sample| contains the capability.
+// The result is stored in |p_result| and |p_codec_config|.
+// Returns true if a selection was made, otherwise false.
+//
+static bool select_best_bits_per_sample(
+    btav_a2dp_codec_bits_per_sample_t bits_per_sample, tA2DP_OPUS_CIE* p_result,
+    btav_a2dp_codec_config_t* p_codec_config) {
+  if (bits_per_sample & BTAV_A2DP_CODEC_BITS_PER_SAMPLE_32) {
+    p_codec_config->bits_per_sample = BTAV_A2DP_CODEC_BITS_PER_SAMPLE_32;
+    p_result->bits_per_sample = BTAV_A2DP_CODEC_BITS_PER_SAMPLE_32;
+    return true;
+  }
+  if (bits_per_sample & BTAV_A2DP_CODEC_BITS_PER_SAMPLE_24) {
+    p_codec_config->bits_per_sample = BTAV_A2DP_CODEC_BITS_PER_SAMPLE_24;
+    p_result->bits_per_sample = BTAV_A2DP_CODEC_BITS_PER_SAMPLE_24;
+    return true;
+  }
+  if (bits_per_sample & BTAV_A2DP_CODEC_BITS_PER_SAMPLE_16) {
+    p_codec_config->bits_per_sample = BTAV_A2DP_CODEC_BITS_PER_SAMPLE_16;
+    p_result->bits_per_sample = BTAV_A2DP_CODEC_BITS_PER_SAMPLE_16;
+    return true;
+  }
+  return false;
+}
+
+//
+// Selects the audio bits per sample from |p_codec_audio_config|.
+// |bits_per_sample| contains the capability.
+// The result is stored in |p_result| and |p_codec_config|.
+// Returns true if a selection was made, otherwise false.
+//
+static bool select_audio_bits_per_sample(
+    const btav_a2dp_codec_config_t* p_codec_audio_config,
+    btav_a2dp_codec_bits_per_sample_t bits_per_sample, tA2DP_OPUS_CIE* p_result,
+    btav_a2dp_codec_config_t* p_codec_config) {
+  switch (p_codec_audio_config->bits_per_sample) {
+    case BTAV_A2DP_CODEC_BITS_PER_SAMPLE_16:
+      if (bits_per_sample & BTAV_A2DP_CODEC_BITS_PER_SAMPLE_16) {
+        p_codec_config->bits_per_sample = BTAV_A2DP_CODEC_BITS_PER_SAMPLE_16;
+        p_result->bits_per_sample = BTAV_A2DP_CODEC_BITS_PER_SAMPLE_16;
+        return true;
+      }
+      break;
+    case BTAV_A2DP_CODEC_BITS_PER_SAMPLE_24:
+      if (bits_per_sample & BTAV_A2DP_CODEC_BITS_PER_SAMPLE_24) {
+        p_codec_config->bits_per_sample = BTAV_A2DP_CODEC_BITS_PER_SAMPLE_24;
+        p_result->bits_per_sample = BTAV_A2DP_CODEC_BITS_PER_SAMPLE_24;
+        return true;
+      }
+      break;
+    case BTAV_A2DP_CODEC_BITS_PER_SAMPLE_32:
+      if (bits_per_sample & BTAV_A2DP_CODEC_BITS_PER_SAMPLE_32) {
+        p_codec_config->bits_per_sample = BTAV_A2DP_CODEC_BITS_PER_SAMPLE_32;
+        p_result->bits_per_sample = BTAV_A2DP_CODEC_BITS_PER_SAMPLE_32;
+        return true;
+      }
+      break;
+    case BTAV_A2DP_CODEC_BITS_PER_SAMPLE_NONE:
+      break;
+  }
+  return false;
+}
+
+//
+// Selects the best channel mode from |channelMode|.
+// The result is stored in |p_result| and |p_codec_config|.
+// Returns true if a selection was made, otherwise false.
+//
+static bool select_best_channel_mode(uint8_t channelMode,
+                                     tA2DP_OPUS_CIE* p_result,
+                                     btav_a2dp_codec_config_t* p_codec_config) {
+  if (channelMode & A2DP_OPUS_CHANNEL_MODE_STEREO) {
+    p_result->channelMode = A2DP_OPUS_CHANNEL_MODE_STEREO;
+    p_codec_config->channel_mode = BTAV_A2DP_CODEC_CHANNEL_MODE_STEREO;
+    return true;
+  }
+  if (channelMode & A2DP_OPUS_CHANNEL_MODE_MONO) {
+    p_result->channelMode = A2DP_OPUS_CHANNEL_MODE_MONO;
+    p_codec_config->channel_mode = BTAV_A2DP_CODEC_CHANNEL_MODE_MONO;
+    return true;
+  }
+  return false;
+}
+
+//
+// Selects the audio channel mode from |p_codec_audio_config|.
+// |channelMode| contains the capability.
+// The result is stored in |p_result| and |p_codec_config|.
+// Returns true if a selection was made, otherwise false.
+//
+static bool select_audio_channel_mode(
+    const btav_a2dp_codec_config_t* p_codec_audio_config, uint8_t channelMode,
+    tA2DP_OPUS_CIE* p_result, btav_a2dp_codec_config_t* p_codec_config) {
+  switch (p_codec_audio_config->channel_mode) {
+    case BTAV_A2DP_CODEC_CHANNEL_MODE_MONO:
+      if (channelMode & A2DP_OPUS_CHANNEL_MODE_MONO) {
+        p_result->channelMode = A2DP_OPUS_CHANNEL_MODE_MONO;
+        p_codec_config->channel_mode = BTAV_A2DP_CODEC_CHANNEL_MODE_MONO;
+        return true;
+      }
+      break;
+    case BTAV_A2DP_CODEC_CHANNEL_MODE_STEREO:
+      if (channelMode & A2DP_OPUS_CHANNEL_MODE_STEREO) {
+        p_result->channelMode = A2DP_OPUS_CHANNEL_MODE_STEREO;
+        p_codec_config->channel_mode = BTAV_A2DP_CODEC_CHANNEL_MODE_STEREO;
+        return true;
+      }
+      break;
+    case BTAV_A2DP_CODEC_CHANNEL_MODE_NONE:
+      break;
+  }
+
+  return false;
+}
+
+bool A2dpCodecConfigOpusBase::setCodecConfig(const uint8_t* p_peer_codec_info,
+                                             bool is_capability,
+                                             uint8_t* p_result_codec_config) {
+  std::lock_guard<std::recursive_mutex> lock(codec_mutex_);
+  tA2DP_OPUS_CIE peer_info_cie;
+  tA2DP_OPUS_CIE result_config_cie;
+  uint8_t channelMode;
+  uint8_t sampleRate;
+  uint8_t frameSize;
+  btav_a2dp_codec_bits_per_sample_t bits_per_sample;
+  const tA2DP_OPUS_CIE* p_a2dp_opus_caps =
+      (is_source_) ? &a2dp_opus_source_caps : &a2dp_opus_sink_caps;
+
+  btav_a2dp_codec_config_t device_codec_config_ = getCodecConfig();
+
+  LOG_INFO(
+      "AudioManager stream config %d sample rate %d bit depth %d channel "
+      "mode",
+      device_codec_config_.sample_rate, device_codec_config_.bits_per_sample,
+      device_codec_config_.channel_mode);
+
+  // Save the internal state
+  btav_a2dp_codec_config_t saved_codec_config = codec_config_;
+  btav_a2dp_codec_config_t saved_codec_capability = codec_capability_;
+  btav_a2dp_codec_config_t saved_codec_selectable_capability =
+      codec_selectable_capability_;
+  btav_a2dp_codec_config_t saved_codec_user_config = codec_user_config_;
+  btav_a2dp_codec_config_t saved_codec_audio_config = codec_audio_config_;
+  uint8_t saved_ota_codec_config[AVDT_CODEC_SIZE];
+  uint8_t saved_ota_codec_peer_capability[AVDT_CODEC_SIZE];
+  uint8_t saved_ota_codec_peer_config[AVDT_CODEC_SIZE];
+  memcpy(saved_ota_codec_config, ota_codec_config_, sizeof(ota_codec_config_));
+  memcpy(saved_ota_codec_peer_capability, ota_codec_peer_capability_,
+         sizeof(ota_codec_peer_capability_));
+  memcpy(saved_ota_codec_peer_config, ota_codec_peer_config_,
+         sizeof(ota_codec_peer_config_));
+
+  tA2DP_STATUS status =
+      A2DP_ParseInfoOpus(&peer_info_cie, p_peer_codec_info, is_capability);
+  if (status != A2DP_SUCCESS) {
+    LOG_ERROR("can't parse peer's capabilities: error = %d", status);
+    goto fail;
+  }
+
+  //
+  // Build the preferred configuration
+  //
+  memset(&result_config_cie, 0, sizeof(result_config_cie));
+  result_config_cie.vendorId = p_a2dp_opus_caps->vendorId;
+  result_config_cie.codecId = p_a2dp_opus_caps->codecId;
+
+  //
+  // Select the sample frequency
+  //
+  sampleRate = p_a2dp_opus_caps->sampleRate & peer_info_cie.sampleRate;
+  codec_config_.sample_rate = BTAV_A2DP_CODEC_SAMPLE_RATE_NONE;
+
+  switch (codec_user_config_.sample_rate) {
+    case BTAV_A2DP_CODEC_SAMPLE_RATE_48000:
+      if (sampleRate & A2DP_OPUS_SAMPLING_FREQ_48000) {
+        result_config_cie.sampleRate = A2DP_OPUS_SAMPLING_FREQ_48000;
+        codec_capability_.sample_rate = codec_user_config_.sample_rate;
+        codec_config_.sample_rate = codec_user_config_.sample_rate;
+      }
+      break;
+    case BTAV_A2DP_CODEC_SAMPLE_RATE_44100:
+    case BTAV_A2DP_CODEC_SAMPLE_RATE_88200:
+    case BTAV_A2DP_CODEC_SAMPLE_RATE_96000:
+    case BTAV_A2DP_CODEC_SAMPLE_RATE_176400:
+    case BTAV_A2DP_CODEC_SAMPLE_RATE_192000:
+    case BTAV_A2DP_CODEC_SAMPLE_RATE_16000:
+    case BTAV_A2DP_CODEC_SAMPLE_RATE_24000:
+    case BTAV_A2DP_CODEC_SAMPLE_RATE_NONE:
+      codec_capability_.sample_rate = BTAV_A2DP_CODEC_SAMPLE_RATE_NONE;
+      codec_config_.sample_rate = BTAV_A2DP_CODEC_SAMPLE_RATE_NONE;
+      break;
+  }
+
+  // Select the sample frequency if there is no user preference
+  do {
+    // Compute the selectable capability
+    if (sampleRate & A2DP_OPUS_SAMPLING_FREQ_48000) {
+      codec_selectable_capability_.sample_rate |=
+          BTAV_A2DP_CODEC_SAMPLE_RATE_48000;
+    }
+
+    if (codec_config_.sample_rate != BTAV_A2DP_CODEC_SAMPLE_RATE_NONE) break;
+
+    // Compute the common capability
+    if (sampleRate & A2DP_OPUS_SAMPLING_FREQ_48000)
+      codec_capability_.sample_rate |= BTAV_A2DP_CODEC_SAMPLE_RATE_48000;
+
+    // No user preference - try the codec audio config
+    if (select_audio_sample_rate(&codec_audio_config_, sampleRate,
+                                 &result_config_cie, &codec_config_)) {
+      break;
+    }
+
+    // No user preference - try the default config
+    if (select_best_sample_rate(
+            a2dp_opus_default_config.sampleRate & peer_info_cie.sampleRate,
+            &result_config_cie, &codec_config_)) {
+      break;
+    }
+
+    // No user preference - use the best match
+    if (select_best_sample_rate(sampleRate, &result_config_cie,
+                                &codec_config_)) {
+      break;
+    }
+  } while (false);
+  if (codec_config_.sample_rate == BTAV_A2DP_CODEC_SAMPLE_RATE_NONE) {
+    LOG_ERROR(
+        "cannot match sample frequency: local caps = 0x%x "
+        "peer info = 0x%x",
+        p_a2dp_opus_caps->sampleRate, peer_info_cie.sampleRate);
+    goto fail;
+  }
+
+  //
+  // Select the bits per sample
+  //
+  // NOTE: this information is NOT included in the Opus A2DP codec description
+  // that is sent OTA.
+  bits_per_sample = p_a2dp_opus_caps->bits_per_sample;
+  codec_config_.bits_per_sample = BTAV_A2DP_CODEC_BITS_PER_SAMPLE_NONE;
+  switch (codec_user_config_.bits_per_sample) {
+    case BTAV_A2DP_CODEC_BITS_PER_SAMPLE_16:
+      if (bits_per_sample & BTAV_A2DP_CODEC_BITS_PER_SAMPLE_16) {
+        result_config_cie.bits_per_sample = codec_user_config_.bits_per_sample;
+        codec_capability_.bits_per_sample = codec_user_config_.bits_per_sample;
+        codec_config_.bits_per_sample = codec_user_config_.bits_per_sample;
+      }
+      break;
+    case BTAV_A2DP_CODEC_BITS_PER_SAMPLE_24:
+      if (bits_per_sample & BTAV_A2DP_CODEC_BITS_PER_SAMPLE_24) {
+        result_config_cie.bits_per_sample = codec_user_config_.bits_per_sample;
+        codec_capability_.bits_per_sample = codec_user_config_.bits_per_sample;
+        codec_config_.bits_per_sample = codec_user_config_.bits_per_sample;
+      }
+      break;
+    case BTAV_A2DP_CODEC_BITS_PER_SAMPLE_32:
+      if (bits_per_sample & BTAV_A2DP_CODEC_BITS_PER_SAMPLE_32) {
+        result_config_cie.bits_per_sample = codec_user_config_.bits_per_sample;
+        codec_capability_.bits_per_sample = codec_user_config_.bits_per_sample;
+        codec_config_.bits_per_sample = codec_user_config_.bits_per_sample;
+      }
+      break;
+    case BTAV_A2DP_CODEC_BITS_PER_SAMPLE_NONE:
+      result_config_cie.bits_per_sample = BTAV_A2DP_CODEC_BITS_PER_SAMPLE_NONE;
+      codec_capability_.bits_per_sample = BTAV_A2DP_CODEC_BITS_PER_SAMPLE_NONE;
+      codec_config_.bits_per_sample = BTAV_A2DP_CODEC_BITS_PER_SAMPLE_NONE;
+      break;
+  }
+
+  // Select the bits per sample if there is no user preference
+  do {
+    // Compute the selectable capability
+    codec_selectable_capability_.bits_per_sample =
+        p_a2dp_opus_caps->bits_per_sample;
+
+    if (codec_config_.bits_per_sample != BTAV_A2DP_CODEC_BITS_PER_SAMPLE_NONE)
+      break;
+
+    // Compute the common capability
+    codec_capability_.bits_per_sample = bits_per_sample;
+
+    // No user preference - try yhe codec audio config
+    if (select_audio_bits_per_sample(&codec_audio_config_,
+                                     p_a2dp_opus_caps->bits_per_sample,
+                                     &result_config_cie, &codec_config_)) {
+      break;
+    }
+
+    // No user preference - try the default config
+    if (select_best_bits_per_sample(a2dp_opus_default_config.bits_per_sample,
+                                    &result_config_cie, &codec_config_)) {
+      break;
+    }
+
+    // No user preference - use the best match
+    if (select_best_bits_per_sample(p_a2dp_opus_caps->bits_per_sample,
+                                    &result_config_cie, &codec_config_)) {
+      break;
+    }
+  } while (false);
+  if (codec_config_.bits_per_sample == BTAV_A2DP_CODEC_BITS_PER_SAMPLE_NONE) {
+    LOG_ERROR(
+        "cannot match bits per sample: default = 0x%x "
+        "user preference = 0x%x",
+        a2dp_opus_default_config.bits_per_sample,
+        codec_user_config_.bits_per_sample);
+    goto fail;
+  }
+
+  //
+  // Select the channel mode
+  //
+  channelMode = p_a2dp_opus_caps->channelMode & peer_info_cie.channelMode;
+  codec_config_.channel_mode = BTAV_A2DP_CODEC_CHANNEL_MODE_NONE;
+  switch (codec_user_config_.channel_mode) {
+    case BTAV_A2DP_CODEC_CHANNEL_MODE_MONO:
+      if (channelMode & A2DP_OPUS_CHANNEL_MODE_MONO) {
+        result_config_cie.channelMode = A2DP_OPUS_CHANNEL_MODE_MONO;
+        codec_capability_.channel_mode = codec_user_config_.channel_mode;
+        codec_config_.channel_mode = codec_user_config_.channel_mode;
+      }
+      break;
+    case BTAV_A2DP_CODEC_CHANNEL_MODE_STEREO:
+      if (channelMode & A2DP_OPUS_CHANNEL_MODE_STEREO) {
+        result_config_cie.channelMode = A2DP_OPUS_CHANNEL_MODE_STEREO;
+        codec_capability_.channel_mode = codec_user_config_.channel_mode;
+        codec_config_.channel_mode = codec_user_config_.channel_mode;
+      }
+      break;
+    case BTAV_A2DP_CODEC_CHANNEL_MODE_NONE:
+      codec_capability_.channel_mode = BTAV_A2DP_CODEC_CHANNEL_MODE_NONE;
+      codec_config_.channel_mode = BTAV_A2DP_CODEC_CHANNEL_MODE_NONE;
+      break;
+  }
+
+  // Select the channel mode if there is no user preference
+  do {
+    // Compute the selectable capability
+    if (channelMode & A2DP_OPUS_CHANNEL_MODE_MONO) {
+      codec_selectable_capability_.channel_mode |=
+          BTAV_A2DP_CODEC_CHANNEL_MODE_MONO;
+    }
+    if (channelMode & A2DP_OPUS_CHANNEL_MODE_STEREO) {
+      codec_selectable_capability_.channel_mode |=
+          BTAV_A2DP_CODEC_CHANNEL_MODE_STEREO;
+    }
+
+    if (codec_config_.channel_mode != BTAV_A2DP_CODEC_CHANNEL_MODE_NONE) break;
+
+    // Compute the common capability
+    if (channelMode & A2DP_OPUS_CHANNEL_MODE_MONO)
+      codec_capability_.channel_mode |= BTAV_A2DP_CODEC_CHANNEL_MODE_MONO;
+    if (channelMode & A2DP_OPUS_CHANNEL_MODE_STEREO) {
+      codec_capability_.channel_mode |= BTAV_A2DP_CODEC_CHANNEL_MODE_STEREO;
+    }
+
+    // No user preference - try the codec audio config
+    if (select_audio_channel_mode(&codec_audio_config_, channelMode,
+                                  &result_config_cie, &codec_config_)) {
+      break;
+    }
+
+    // No user preference - try the default config
+    if (select_best_channel_mode(
+            a2dp_opus_default_config.channelMode & peer_info_cie.channelMode,
+            &result_config_cie, &codec_config_)) {
+      break;
+    }
+
+    // No user preference - use the best match
+    if (select_best_channel_mode(channelMode, &result_config_cie,
+                                 &codec_config_)) {
+      break;
+    }
+  } while (false);
+  if (codec_config_.channel_mode == BTAV_A2DP_CODEC_CHANNEL_MODE_NONE) {
+    LOG_ERROR(
+        "cannot match channel mode: local caps = 0x%x "
+        "peer info = 0x%x",
+        p_a2dp_opus_caps->channelMode, peer_info_cie.channelMode);
+    goto fail;
+  }
+
+  //
+  // Select the frame size
+  //
+  frameSize = p_a2dp_opus_caps->future1 & peer_info_cie.future1;
+  codec_config_.codec_specific_1 = BTAV_A2DP_CODEC_FRAME_SIZE_NONE;
+  switch (codec_user_config_.codec_specific_1) {
+    case BTAV_A2DP_CODEC_FRAME_SIZE_20MS:
+      if (frameSize & A2DP_OPUS_20MS_FRAMESIZE) {
+        result_config_cie.future1 = A2DP_OPUS_20MS_FRAMESIZE;
+        codec_capability_.codec_specific_1 =
+            codec_user_config_.codec_specific_1;
+        codec_config_.codec_specific_1 = codec_user_config_.codec_specific_1;
+      }
+      break;
+    case BTAV_A2DP_CODEC_FRAME_SIZE_10MS:
+      if (frameSize & A2DP_OPUS_10MS_FRAMESIZE) {
+        result_config_cie.future1 = A2DP_OPUS_10MS_FRAMESIZE;
+        codec_capability_.codec_specific_1 =
+            codec_user_config_.codec_specific_1;
+        codec_config_.codec_specific_1 = codec_user_config_.codec_specific_1;
+      }
+      break;
+    case BTAV_A2DP_CODEC_FRAME_SIZE_NONE:
+      codec_capability_.codec_specific_1 = BTAV_A2DP_CODEC_FRAME_SIZE_NONE;
+      codec_config_.codec_specific_1 = BTAV_A2DP_CODEC_FRAME_SIZE_NONE;
+      break;
+  }
+
+  // No user preference - set default value
+  codec_config_.codec_specific_1 = BTAV_A2DP_CODEC_FRAME_SIZE_20MS;
+  result_config_cie.future1 = A2DP_OPUS_20MS_FRAMESIZE;
+  result_config_cie.future3 = 0x00;
+
+  if (codec_config_.codec_specific_1 == BTAV_A2DP_CODEC_FRAME_SIZE_NONE) {
+    LOG_ERROR(
+        "cannot match frame size: local caps = 0x%x "
+        "peer info = 0x%x",
+        p_a2dp_opus_caps->future1, peer_info_cie.future1);
+    goto fail;
+  }
+
+  if (A2DP_BuildInfoOpus(AVDT_MEDIA_TYPE_AUDIO, &result_config_cie,
+                         p_result_codec_config) != A2DP_SUCCESS) {
+    LOG_ERROR("failed to BuildInfoOpus for result_config_cie");
+    goto fail;
+  }
+
+  //
+  // Copy the codec-specific fields if they are not zero
+  //
+  if (codec_user_config_.codec_specific_1 != 0)
+    codec_config_.codec_specific_1 = codec_user_config_.codec_specific_1;
+  if (codec_user_config_.codec_specific_2 != 0)
+    codec_config_.codec_specific_2 = codec_user_config_.codec_specific_2;
+  if (codec_user_config_.codec_specific_3 != 0)
+    codec_config_.codec_specific_3 = codec_user_config_.codec_specific_3;
+  if (codec_user_config_.codec_specific_4 != 0)
+    codec_config_.codec_specific_4 = codec_user_config_.codec_specific_4;
+
+  // Create a local copy of the peer codec capability, and the
+  // result codec config.
+  if (is_capability) {
+    status = A2DP_BuildInfoOpus(AVDT_MEDIA_TYPE_AUDIO, &peer_info_cie,
+                                ota_codec_peer_capability_);
+  } else {
+    status = A2DP_BuildInfoOpus(AVDT_MEDIA_TYPE_AUDIO, &peer_info_cie,
+                                ota_codec_peer_config_);
+  }
+  CHECK(status == A2DP_SUCCESS);
+
+  status = A2DP_BuildInfoOpus(AVDT_MEDIA_TYPE_AUDIO, &result_config_cie,
+                              ota_codec_config_);
+  CHECK(status == A2DP_SUCCESS);
+  return true;
+
+fail:
+  // Restore the internal state
+  codec_config_ = saved_codec_config;
+  codec_capability_ = saved_codec_capability;
+  codec_selectable_capability_ = saved_codec_selectable_capability;
+  codec_user_config_ = saved_codec_user_config;
+  codec_audio_config_ = saved_codec_audio_config;
+  memcpy(ota_codec_config_, saved_ota_codec_config, sizeof(ota_codec_config_));
+  memcpy(ota_codec_peer_capability_, saved_ota_codec_peer_capability,
+         sizeof(ota_codec_peer_capability_));
+  memcpy(ota_codec_peer_config_, saved_ota_codec_peer_config,
+         sizeof(ota_codec_peer_config_));
+  return false;
+}
+
+bool A2dpCodecConfigOpusBase::setPeerCodecCapabilities(
+    const uint8_t* p_peer_codec_capabilities) {
+  std::lock_guard<std::recursive_mutex> lock(codec_mutex_);
+  tA2DP_OPUS_CIE peer_info_cie;
+  uint8_t channelMode;
+  uint8_t sampleRate;
+  const tA2DP_OPUS_CIE* p_a2dp_opus_caps =
+      (is_source_) ? &a2dp_opus_source_caps : &a2dp_opus_sink_caps;
+
+  // Save the internal state
+  btav_a2dp_codec_config_t saved_codec_selectable_capability =
+      codec_selectable_capability_;
+  uint8_t saved_ota_codec_peer_capability[AVDT_CODEC_SIZE];
+  memcpy(saved_ota_codec_peer_capability, ota_codec_peer_capability_,
+         sizeof(ota_codec_peer_capability_));
+
+  tA2DP_STATUS status =
+      A2DP_ParseInfoOpus(&peer_info_cie, p_peer_codec_capabilities, true);
+  if (status != A2DP_SUCCESS) {
+    LOG_ERROR("can't parse peer's capabilities: error = %d", status);
+    goto fail;
+  }
+
+  // Compute the selectable capability - sample rate
+  sampleRate = p_a2dp_opus_caps->sampleRate & peer_info_cie.sampleRate;
+  if (sampleRate & A2DP_OPUS_SAMPLING_FREQ_48000) {
+    codec_selectable_capability_.sample_rate |=
+        BTAV_A2DP_CODEC_SAMPLE_RATE_48000;
+  }
+
+  // Compute the selectable capability - bits per sample
+  codec_selectable_capability_.bits_per_sample =
+      p_a2dp_opus_caps->bits_per_sample;
+
+  // Compute the selectable capability - channel mode
+  channelMode = p_a2dp_opus_caps->channelMode & peer_info_cie.channelMode;
+  if (channelMode & A2DP_OPUS_CHANNEL_MODE_MONO) {
+    codec_selectable_capability_.channel_mode |=
+        BTAV_A2DP_CODEC_CHANNEL_MODE_MONO;
+  }
+  if (channelMode & A2DP_OPUS_CHANNEL_MODE_STEREO) {
+    codec_selectable_capability_.channel_mode |=
+        BTAV_A2DP_CODEC_CHANNEL_MODE_STEREO;
+  }
+
+  LOG_INFO("BuildInfoOpus for peer info cie for ota caps");
+  status = A2DP_BuildInfoOpus(AVDT_MEDIA_TYPE_AUDIO, &peer_info_cie,
+                              ota_codec_peer_capability_);
+  CHECK(status == A2DP_SUCCESS);
+  return true;
+
+fail:
+  // Restore the internal state
+  codec_selectable_capability_ = saved_codec_selectable_capability;
+  memcpy(ota_codec_peer_capability_, saved_ota_codec_peer_capability,
+         sizeof(ota_codec_peer_capability_));
+  return false;
+}
+
+A2dpCodecConfigOpusSink::A2dpCodecConfigOpusSink(
+    btav_a2dp_codec_priority_t codec_priority)
+    : A2dpCodecConfigOpusBase(BTAV_A2DP_CODEC_INDEX_SINK_OPUS,
+                              A2DP_VendorCodecIndexStrOpusSink(),
+                              codec_priority, false) {}
+
+A2dpCodecConfigOpusSink::~A2dpCodecConfigOpusSink() {}
+
+bool A2dpCodecConfigOpusSink::init() {
+  if (!isValid()) return false;
+
+  return true;
+}
+
+bool A2dpCodecConfigOpusSink::useRtpHeaderMarkerBit() const { return false; }
+
+bool A2dpCodecConfigOpusSink::updateEncoderUserConfig(
+    UNUSED_ATTR const tA2DP_ENCODER_INIT_PEER_PARAMS* p_peer_params,
+    UNUSED_ATTR bool* p_restart_input, UNUSED_ATTR bool* p_restart_output,
+    UNUSED_ATTR bool* p_config_updated) {
+  return false;
+}
diff --git a/system/stack/a2dp/a2dp_vendor_opus_decoder.cc b/system/stack/a2dp/a2dp_vendor_opus_decoder.cc
new file mode 100644
index 0000000..fec3520
--- /dev/null
+++ b/system/stack/a2dp/a2dp_vendor_opus_decoder.cc
@@ -0,0 +1,164 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define LOG_TAG "a2dp_opus_decoder"
+
+#include "a2dp_vendor_opus_decoder.h"
+
+#include <base/logging.h>
+#include <opus.h>
+
+#include "a2dp_vendor_opus.h"
+#include "osi/include/allocator.h"
+#include "osi/include/log.h"
+
+typedef struct {
+  OpusDecoder* opus_handle = nullptr;
+  bool has_opus_handle;
+  int16_t* decode_buf = nullptr;
+  decoded_data_callback_t decode_callback;
+} tA2DP_OPUS_DECODER_CB;
+
+static tA2DP_OPUS_DECODER_CB a2dp_opus_decoder_cb;
+
+void a2dp_vendor_opus_decoder_cleanup(void) {
+  if (a2dp_opus_decoder_cb.has_opus_handle) {
+    osi_free(a2dp_opus_decoder_cb.opus_handle);
+
+    if (a2dp_opus_decoder_cb.decode_buf != nullptr) {
+      memset(a2dp_opus_decoder_cb.decode_buf, 0,
+             A2DP_OPUS_DECODE_BUFFER_LENGTH);
+      osi_free(a2dp_opus_decoder_cb.decode_buf);
+      a2dp_opus_decoder_cb.decode_buf = nullptr;
+    }
+    a2dp_opus_decoder_cb.has_opus_handle = false;
+  }
+
+  return;
+}
+
+bool a2dp_vendor_opus_decoder_init(decoded_data_callback_t decode_callback) {
+  a2dp_vendor_opus_decoder_cleanup();
+
+  int32_t err_val = OPUS_OK;
+  int32_t size = 0;
+
+  size = opus_decoder_get_size(A2DP_OPUS_CODEC_OUTPUT_CHS);
+  a2dp_opus_decoder_cb.opus_handle =
+      static_cast<OpusDecoder*>(osi_malloc(size));
+  if (a2dp_opus_decoder_cb.opus_handle == nullptr) {
+    LOG_ERROR("failed to allocate opus decoder handle");
+    return false;
+  }
+  err_val = opus_decoder_init(a2dp_opus_decoder_cb.opus_handle,
+                              A2DP_OPUS_CODEC_DEFAULT_SAMPLERATE,
+                              A2DP_OPUS_CODEC_OUTPUT_CHS);
+  if (err_val == OPUS_OK) {
+    a2dp_opus_decoder_cb.has_opus_handle = true;
+
+    a2dp_opus_decoder_cb.decode_buf =
+        static_cast<int16_t*>(osi_malloc(A2DP_OPUS_DECODE_BUFFER_LENGTH));
+
+    memset(a2dp_opus_decoder_cb.decode_buf, 0, A2DP_OPUS_DECODE_BUFFER_LENGTH);
+
+    a2dp_opus_decoder_cb.decode_callback = decode_callback;
+    LOG_INFO("decoder init success");
+    return true;
+  } else {
+    LOG_ERROR("failed to initialize Opus Decoder");
+    a2dp_opus_decoder_cb.has_opus_handle = false;
+    return false;
+  }
+
+  return false;
+}
+
+void a2dp_vendor_opus_decoder_configure(const uint8_t* p_codec_info) { return; }
+
+bool a2dp_vendor_opus_decoder_decode_packet(BT_HDR* p_buf) {
+  uint32_t frameSize;
+  uint32_t numChannels;
+  uint32_t numFrames;
+  int32_t ret_val = 0;
+  uint32_t frameLen = 0;
+
+  if (p_buf == nullptr) {
+    LOG_ERROR("Dropping packet with nullptr");
+    return false;
+  }
+
+  if (p_buf->len == 0) {
+    LOG_ERROR("Empty packet");
+    return false;
+  }
+
+  auto* pBuffer =
+      reinterpret_cast<unsigned char*>(p_buf->data + p_buf->offset + 1);
+  int32_t bufferSize = p_buf->len - 1;
+
+  numChannels = opus_packet_get_nb_channels(pBuffer);
+  numFrames = opus_packet_get_nb_frames(pBuffer, bufferSize);
+  frameSize = opus_packet_get_samples_per_frame(
+      pBuffer, A2DP_OPUS_CODEC_DEFAULT_SAMPLERATE);
+  frameLen = opus_packet_get_nb_samples(pBuffer, bufferSize,
+                                        A2DP_OPUS_CODEC_DEFAULT_SAMPLERATE);
+  uint32_t num_frames = pBuffer[0] & 0xf;
+
+  LOG_ERROR("numframes %d framesize %d framelen %d bufferSize %d", num_frames,
+            frameSize, frameLen, bufferSize);
+  LOG_ERROR("numChannels %d numFrames %d offset %d", numChannels, numFrames,
+            p_buf->offset);
+
+  for (uint32_t frame = 0; frame < numFrames; ++frame) {
+    {
+      numChannels = opus_packet_get_nb_channels(pBuffer);
+
+      ret_val = opus_decode(a2dp_opus_decoder_cb.opus_handle,
+                            reinterpret_cast<unsigned char*>(pBuffer),
+                            bufferSize, a2dp_opus_decoder_cb.decode_buf,
+                            A2DP_OPUS_DECODE_BUFFER_LENGTH, 0 /* flags */);
+
+      if (ret_val < OPUS_OK) {
+        LOG_ERROR("Opus DecodeFrame failed %d, applying concealment", ret_val);
+        ret_val = opus_decode(a2dp_opus_decoder_cb.opus_handle, NULL, 0,
+                              a2dp_opus_decoder_cb.decode_buf,
+                              A2DP_OPUS_DECODE_BUFFER_LENGTH, 0 /* flags */);
+      }
+
+      size_t frame_len =
+          ret_val * numChannels * sizeof(a2dp_opus_decoder_cb.decode_buf[0]);
+      a2dp_opus_decoder_cb.decode_callback(
+          reinterpret_cast<uint8_t*>(a2dp_opus_decoder_cb.decode_buf),
+          frame_len);
+    }
+  }
+  return true;
+}
+
+void a2dp_vendor_opus_decoder_start(void) { return; }
+
+void a2dp_vendor_opus_decoder_suspend(void) {
+  int32_t err_val = 0;
+
+  if (a2dp_opus_decoder_cb.has_opus_handle) {
+    err_val =
+        opus_decoder_ctl(a2dp_opus_decoder_cb.opus_handle, OPUS_RESET_STATE);
+    if (err_val != OPUS_OK) {
+      LOG_ERROR("failed to reset decoder");
+    }
+  }
+  return;
+}
diff --git a/system/stack/a2dp/a2dp_vendor_opus_encoder.cc b/system/stack/a2dp/a2dp_vendor_opus_encoder.cc
new file mode 100644
index 0000000..8bdf2ef
--- /dev/null
+++ b/system/stack/a2dp/a2dp_vendor_opus_encoder.cc
@@ -0,0 +1,533 @@
+/*
+ * Copyright 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define LOG_TAG "a2dp_vendor_opus_encoder"
+#define ATRACE_TAG ATRACE_TAG_AUDIO
+
+#include "a2dp_vendor_opus_encoder.h"
+
+#ifndef OS_GENERIC
+#include <cutils/trace.h>
+#endif
+#include <dlfcn.h>
+#include <inttypes.h>
+#include <opus.h>
+#include <stdio.h>
+#include <string.h>
+
+#include "a2dp_vendor.h"
+#include "a2dp_vendor_opus.h"
+#include "common/time_util.h"
+#include "osi/include/allocator.h"
+#include "osi/include/log.h"
+#include "osi/include/osi.h"
+#include "stack/include/bt_hdr.h"
+
+typedef struct {
+  uint32_t sample_rate;
+  uint16_t bitrate;
+  uint16_t framesize;
+  uint8_t channel_mode;
+  uint8_t bits_per_sample;
+  uint8_t quality_mode_index;
+  int pcm_wlength;
+  uint8_t pcm_fmt;
+} tA2DP_OPUS_ENCODER_PARAMS;
+
+typedef struct {
+  float counter;
+  uint32_t bytes_per_tick;
+  uint64_t last_frame_us;
+} tA2DP_OPUS_FEEDING_STATE;
+
+typedef struct {
+  uint64_t session_start_us;
+
+  size_t media_read_total_expected_packets;
+  size_t media_read_total_expected_reads_count;
+  size_t media_read_total_expected_read_bytes;
+
+  size_t media_read_total_dropped_packets;
+  size_t media_read_total_actual_reads_count;
+  size_t media_read_total_actual_read_bytes;
+} a2dp_opus_encoder_stats_t;
+
+typedef struct {
+  a2dp_source_read_callback_t read_callback;
+  a2dp_source_enqueue_callback_t enqueue_callback;
+  uint16_t TxAaMtuSize;
+  size_t TxQueueLength;
+
+  bool use_SCMS_T;
+  bool is_peer_edr;          // True if the peer device supports EDR
+  bool peer_supports_3mbps;  // True if the peer device supports 3Mbps EDR
+  uint16_t peer_mtu;         // MTU of the A2DP peer
+  uint32_t timestamp;        // Timestamp for the A2DP frames
+
+  OpusEncoder* opus_handle;
+  bool has_opus_handle;  // True if opus_handle is valid
+
+  tA2DP_FEEDING_PARAMS feeding_params;
+  tA2DP_OPUS_ENCODER_PARAMS opus_encoder_params;
+  tA2DP_OPUS_FEEDING_STATE opus_feeding_state;
+
+  a2dp_opus_encoder_stats_t stats;
+} tA2DP_OPUS_ENCODER_CB;
+
+static tA2DP_OPUS_ENCODER_CB a2dp_opus_encoder_cb;
+
+static bool a2dp_vendor_opus_encoder_update(uint16_t peer_mtu,
+                                            A2dpCodecConfig* a2dp_codec_config,
+                                            bool* p_restart_input,
+                                            bool* p_restart_output,
+                                            bool* p_config_updated);
+static void a2dp_opus_get_num_frame_iteration(uint8_t* num_of_iterations,
+                                              uint8_t* num_of_frames,
+                                              uint64_t timestamp_us);
+static void a2dp_opus_encode_frames(uint8_t nb_frame);
+static bool a2dp_opus_read_feeding(uint8_t* read_buffer, uint32_t* bytes_read);
+
+void a2dp_vendor_opus_encoder_cleanup(void) {
+  if (a2dp_opus_encoder_cb.has_opus_handle) {
+    osi_free(a2dp_opus_encoder_cb.opus_handle);
+    a2dp_opus_encoder_cb.has_opus_handle = false;
+    a2dp_opus_encoder_cb.opus_handle = nullptr;
+  }
+  memset(&a2dp_opus_encoder_cb, 0, sizeof(a2dp_opus_encoder_cb));
+
+  a2dp_opus_encoder_cb.stats.session_start_us =
+      bluetooth::common::time_get_os_boottime_us();
+
+  a2dp_opus_encoder_cb.timestamp = 0;
+
+#if (BTA_AV_CO_CP_SCMS_T == TRUE)
+  a2dp_opus_encoder_cb.use_SCMS_T = true;
+#else
+  a2dp_opus_encoder_cb.use_SCMS_T = false;
+#endif
+  return;
+}
+
+void a2dp_vendor_opus_encoder_init(
+    const tA2DP_ENCODER_INIT_PEER_PARAMS* p_peer_params,
+    A2dpCodecConfig* a2dp_codec_config,
+    a2dp_source_read_callback_t read_callback,
+    a2dp_source_enqueue_callback_t enqueue_callback) {
+  uint32_t error_val;
+
+  a2dp_vendor_opus_encoder_cleanup();
+
+  a2dp_opus_encoder_cb.read_callback = read_callback;
+  a2dp_opus_encoder_cb.enqueue_callback = enqueue_callback;
+  a2dp_opus_encoder_cb.is_peer_edr = p_peer_params->is_peer_edr;
+  a2dp_opus_encoder_cb.peer_supports_3mbps = p_peer_params->peer_supports_3mbps;
+  a2dp_opus_encoder_cb.peer_mtu = p_peer_params->peer_mtu;
+
+  // NOTE: Ignore the restart_input / restart_output flags - this initization
+  // happens when the connection is (re)started.
+  bool restart_input = false;
+  bool restart_output = false;
+  bool config_updated = false;
+
+  uint32_t size = opus_encoder_get_size(A2DP_OPUS_CODEC_OUTPUT_CHS);
+  a2dp_opus_encoder_cb.opus_handle =
+      static_cast<OpusEncoder*>(osi_malloc(size));
+  if (a2dp_opus_encoder_cb.opus_handle == nullptr) {
+    LOG_ERROR("failed to allocate opus encoder handle");
+    return;
+  }
+
+  error_val = opus_encoder_init(
+      a2dp_opus_encoder_cb.opus_handle, A2DP_OPUS_CODEC_DEFAULT_SAMPLERATE,
+      A2DP_OPUS_CODEC_OUTPUT_CHS, OPUS_APPLICATION_AUDIO);
+
+  if (error_val != OPUS_OK) {
+    LOG_ERROR(
+        "failed to init opus encoder (handle size %d, sampling rate %d, "
+        "output chs %d, error %d)",
+        size, A2DP_OPUS_CODEC_DEFAULT_SAMPLERATE, A2DP_OPUS_CODEC_OUTPUT_CHS,
+        error_val);
+    osi_free(a2dp_opus_encoder_cb.opus_handle);
+    return;
+  } else {
+    a2dp_opus_encoder_cb.has_opus_handle = true;
+  }
+
+  a2dp_vendor_opus_encoder_update(a2dp_opus_encoder_cb.peer_mtu,
+                                  a2dp_codec_config, &restart_input,
+                                  &restart_output, &config_updated);
+
+  return;
+}
+
+bool A2dpCodecConfigOpusSource::updateEncoderUserConfig(
+    const tA2DP_ENCODER_INIT_PEER_PARAMS* p_peer_params, bool* p_restart_input,
+    bool* p_restart_output, bool* p_config_updated) {
+  if (a2dp_opus_encoder_cb.peer_mtu == 0) {
+    LOG_ERROR(
+        "Cannot update the codec encoder for %s: "
+        "invalid peer MTU",
+        name().c_str());
+    return false;
+  }
+
+  return a2dp_vendor_opus_encoder_update(a2dp_opus_encoder_cb.peer_mtu, this,
+                                         p_restart_input, p_restart_output,
+                                         p_config_updated);
+}
+
+static bool a2dp_vendor_opus_encoder_update(uint16_t peer_mtu,
+                                            A2dpCodecConfig* a2dp_codec_config,
+                                            bool* p_restart_input,
+                                            bool* p_restart_output,
+                                            bool* p_config_updated) {
+  tA2DP_OPUS_ENCODER_PARAMS* p_encoder_params =
+      &a2dp_opus_encoder_cb.opus_encoder_params;
+  uint8_t codec_info[AVDT_CODEC_SIZE];
+  uint32_t error = 0;
+
+  *p_restart_input = false;
+  *p_restart_output = false;
+  *p_config_updated = false;
+
+  if (!a2dp_opus_encoder_cb.has_opus_handle ||
+      a2dp_opus_encoder_cb.opus_handle == NULL) {
+    LOG_ERROR("Cannot get Opus encoder handle");
+    return false;
+  }
+  CHECK(a2dp_opus_encoder_cb.opus_handle != nullptr);
+
+  if (!a2dp_codec_config->copyOutOtaCodecConfig(codec_info)) {
+    LOG_ERROR(
+        "Cannot update the codec encoder for %s: "
+        "invalid codec config",
+        a2dp_codec_config->name().c_str());
+    return false;
+  }
+  const uint8_t* p_codec_info = codec_info;
+  btav_a2dp_codec_config_t codec_config = a2dp_codec_config->getCodecConfig();
+
+  // The feeding parameters
+  tA2DP_FEEDING_PARAMS* p_feeding_params = &a2dp_opus_encoder_cb.feeding_params;
+  p_feeding_params->sample_rate =
+      A2DP_VendorGetTrackSampleRateOpus(p_codec_info);
+  p_feeding_params->bits_per_sample =
+      a2dp_codec_config->getAudioBitsPerSample();
+  p_feeding_params->channel_count =
+      A2DP_VendorGetTrackChannelCountOpus(p_codec_info);
+  LOG_INFO("sample_rate=%u bits_per_sample=%u channel_count=%u",
+           p_feeding_params->sample_rate, p_feeding_params->bits_per_sample,
+           p_feeding_params->channel_count);
+
+  // The codec parameters
+  p_encoder_params->sample_rate =
+      a2dp_opus_encoder_cb.feeding_params.sample_rate;
+  p_encoder_params->channel_mode =
+      A2DP_VendorGetChannelModeCodeOpus(p_codec_info);
+  p_encoder_params->framesize = A2DP_VendorGetFrameSizeOpus(p_codec_info);
+  p_encoder_params->bitrate = A2DP_VendorGetBitRateOpus(p_codec_info);
+
+  a2dp_vendor_opus_feeding_reset();
+
+  uint16_t mtu_size =
+      BT_DEFAULT_BUFFER_SIZE - A2DP_OPUS_OFFSET - sizeof(BT_HDR);
+  if (mtu_size < peer_mtu) {
+    a2dp_opus_encoder_cb.TxAaMtuSize = mtu_size;
+  } else {
+    a2dp_opus_encoder_cb.TxAaMtuSize = peer_mtu;
+  }
+
+  // Set the bitrate quality mode index
+  if (codec_config.codec_specific_3 != 0) {
+    p_encoder_params->quality_mode_index = codec_config.codec_specific_3 % 10;
+    LOG_INFO("setting bitrate quality mode to %d",
+             p_encoder_params->quality_mode_index);
+  } else {
+    p_encoder_params->quality_mode_index = 5;
+    LOG_INFO("setting bitrate quality mode to default %d",
+             p_encoder_params->quality_mode_index);
+  }
+
+  error = opus_encoder_ctl(
+      a2dp_opus_encoder_cb.opus_handle,
+      OPUS_SET_COMPLEXITY(p_encoder_params->quality_mode_index));
+
+  if (error != OPUS_OK) {
+    LOG_ERROR("failed to set encoder bitrate quality setting");
+    return false;
+  }
+
+  p_encoder_params->pcm_wlength =
+      a2dp_opus_encoder_cb.feeding_params.bits_per_sample >> 3;
+
+  LOG_INFO("setting bitrate to %d", p_encoder_params->bitrate);
+  error = opus_encoder_ctl(a2dp_opus_encoder_cb.opus_handle,
+                           OPUS_SET_BITRATE(p_encoder_params->bitrate));
+
+  if (error != OPUS_OK) {
+    LOG_ERROR("failed to set encoder bitrate");
+    return false;
+  }
+
+  // Set the Audio format from pcm_wlength
+  if (p_encoder_params->pcm_wlength == 2)
+    p_encoder_params->pcm_fmt = 16;
+  else if (p_encoder_params->pcm_wlength == 3)
+    p_encoder_params->pcm_fmt = 24;
+  else if (p_encoder_params->pcm_wlength == 4)
+    p_encoder_params->pcm_fmt = 32;
+
+  return true;
+}
+
+void a2dp_vendor_opus_feeding_reset(void) {
+  memset(&a2dp_opus_encoder_cb.opus_feeding_state, 0,
+         sizeof(a2dp_opus_encoder_cb.opus_feeding_state));
+
+  a2dp_opus_encoder_cb.opus_feeding_state.bytes_per_tick =
+      (a2dp_opus_encoder_cb.feeding_params.sample_rate *
+       a2dp_opus_encoder_cb.feeding_params.bits_per_sample / 8 *
+       a2dp_opus_encoder_cb.feeding_params.channel_count *
+       a2dp_vendor_opus_get_encoder_interval_ms()) /
+      1000;
+
+  return;
+}
+
+void a2dp_vendor_opus_feeding_flush(void) {
+  a2dp_opus_encoder_cb.opus_feeding_state.counter = 0.0f;
+
+  return;
+}
+
+uint64_t a2dp_vendor_opus_get_encoder_interval_ms(void) {
+  return ((a2dp_opus_encoder_cb.opus_encoder_params.framesize * 1000) /
+          a2dp_opus_encoder_cb.opus_encoder_params.sample_rate);
+}
+
+void a2dp_vendor_opus_send_frames(uint64_t timestamp_us) {
+  uint8_t nb_frame = 0;
+  uint8_t nb_iterations = 0;
+
+  a2dp_opus_get_num_frame_iteration(&nb_iterations, &nb_frame, timestamp_us);
+  if (nb_frame == 0) return;
+
+  for (uint8_t counter = 0; counter < nb_iterations; counter++) {
+    // Transcode frame and enqueue
+    a2dp_opus_encode_frames(nb_frame);
+  }
+
+  return;
+}
+
+// Obtains the number of frames to send and number of iterations
+// to be used. |num_of_iterations| and |num_of_frames| parameters
+// are used as output param for returning the respective values.
+static void a2dp_opus_get_num_frame_iteration(uint8_t* num_of_iterations,
+                                              uint8_t* num_of_frames,
+                                              uint64_t timestamp_us) {
+  uint32_t result = 0;
+  uint8_t nof = 0;
+  uint8_t noi = 1;
+
+  uint32_t pcm_bytes_per_frame =
+      a2dp_opus_encoder_cb.opus_encoder_params.framesize *
+      a2dp_opus_encoder_cb.feeding_params.channel_count *
+      a2dp_opus_encoder_cb.feeding_params.bits_per_sample / 8;
+
+  uint32_t us_this_tick = a2dp_vendor_opus_get_encoder_interval_ms() * 1000;
+  uint64_t now_us = timestamp_us;
+  if (a2dp_opus_encoder_cb.opus_feeding_state.last_frame_us != 0)
+    us_this_tick =
+        (now_us - a2dp_opus_encoder_cb.opus_feeding_state.last_frame_us);
+  a2dp_opus_encoder_cb.opus_feeding_state.last_frame_us = now_us;
+
+  a2dp_opus_encoder_cb.opus_feeding_state.counter +=
+      (float)a2dp_opus_encoder_cb.opus_feeding_state.bytes_per_tick *
+      us_this_tick / (a2dp_vendor_opus_get_encoder_interval_ms() * 1000);
+
+  result =
+      a2dp_opus_encoder_cb.opus_feeding_state.counter / pcm_bytes_per_frame;
+  a2dp_opus_encoder_cb.opus_feeding_state.counter -=
+      result * pcm_bytes_per_frame;
+  nof = result;
+
+  *num_of_frames = nof;
+  *num_of_iterations = noi;
+}
+
+static void a2dp_opus_encode_frames(uint8_t nb_frame) {
+  tA2DP_OPUS_ENCODER_PARAMS* p_encoder_params =
+      &a2dp_opus_encoder_cb.opus_encoder_params;
+  unsigned char* packet;
+  uint8_t remain_nb_frame = nb_frame;
+  uint16_t opus_frame_size = p_encoder_params->framesize;
+  uint8_t read_buffer[p_encoder_params->framesize *
+                      p_encoder_params->pcm_wlength *
+                      p_encoder_params->channel_mode];
+
+  int32_t out_frames = 0;
+  int32_t written = 0;
+
+  uint32_t bytes_read = 0;
+  while (nb_frame) {
+    BT_HDR* p_buf = (BT_HDR*)osi_malloc(BT_DEFAULT_BUFFER_SIZE);
+    p_buf->offset = A2DP_OPUS_OFFSET;
+    p_buf->len = 0;
+    p_buf->layer_specific = 0;
+    a2dp_opus_encoder_cb.stats.media_read_total_expected_packets++;
+
+    do {
+      //
+      // Read the PCM data and encode it
+      //
+      uint32_t temp_bytes_read = 0;
+      if (a2dp_opus_read_feeding(read_buffer, &temp_bytes_read)) {
+        bytes_read += temp_bytes_read;
+        packet = (unsigned char*)(p_buf + 1) + p_buf->offset + p_buf->len;
+
+        if (a2dp_opus_encoder_cb.opus_handle == NULL) {
+          LOG_ERROR("invalid OPUS handle");
+          a2dp_opus_encoder_cb.stats.media_read_total_dropped_packets++;
+          osi_free(p_buf);
+          return;
+        }
+
+        written =
+            opus_encode(a2dp_opus_encoder_cb.opus_handle,
+                        (const opus_int16*)&read_buffer[0], opus_frame_size,
+                        packet, (BT_DEFAULT_BUFFER_SIZE - p_buf->offset));
+
+        if (written <= 0) {
+          LOG_ERROR("OPUS encoding error");
+          a2dp_opus_encoder_cb.stats.media_read_total_dropped_packets++;
+          osi_free(p_buf);
+          return;
+        } else {
+          out_frames++;
+        }
+        p_buf->len += written;
+        nb_frame--;
+        p_buf->layer_specific += out_frames;  // added a frame to the buffer
+      } else {
+        LOG_WARN("Opus src buffer underflow %d", nb_frame);
+        a2dp_opus_encoder_cb.opus_feeding_state.counter +=
+            nb_frame * opus_frame_size *
+            a2dp_opus_encoder_cb.feeding_params.channel_count *
+            a2dp_opus_encoder_cb.feeding_params.bits_per_sample / 8;
+
+        // no more pcm to read
+        nb_frame = 0;
+      }
+    } while ((written == 0) && nb_frame);
+
+    if (p_buf->len) {
+      /*
+       * Timestamp of the media packet header represent the TS of the
+       * first frame, i.e. the timestamp before including this frame.
+       */
+      *((uint32_t*)(p_buf + 1)) = a2dp_opus_encoder_cb.timestamp;
+
+      a2dp_opus_encoder_cb.timestamp += p_buf->layer_specific * opus_frame_size;
+
+      uint8_t done_nb_frame = remain_nb_frame - nb_frame;
+      remain_nb_frame = nb_frame;
+
+      if (!a2dp_opus_encoder_cb.enqueue_callback(p_buf, done_nb_frame,
+                                                 bytes_read))
+        return;
+    } else {
+      a2dp_opus_encoder_cb.stats.media_read_total_dropped_packets++;
+      osi_free(p_buf);
+    }
+  }
+}
+
+static bool a2dp_opus_read_feeding(uint8_t* read_buffer, uint32_t* bytes_read) {
+  uint32_t read_size = a2dp_opus_encoder_cb.opus_encoder_params.framesize *
+                       a2dp_opus_encoder_cb.feeding_params.channel_count *
+                       a2dp_opus_encoder_cb.feeding_params.bits_per_sample / 8;
+
+  a2dp_opus_encoder_cb.stats.media_read_total_expected_reads_count++;
+  a2dp_opus_encoder_cb.stats.media_read_total_expected_read_bytes += read_size;
+
+  /* Read Data from UIPC channel */
+  uint32_t nb_byte_read =
+      a2dp_opus_encoder_cb.read_callback(read_buffer, read_size);
+  a2dp_opus_encoder_cb.stats.media_read_total_actual_read_bytes += nb_byte_read;
+
+  if (nb_byte_read < read_size) {
+    if (nb_byte_read == 0) return false;
+
+    /* Fill the unfilled part of the read buffer with silence (0) */
+    memset(((uint8_t*)read_buffer) + nb_byte_read, 0, read_size - nb_byte_read);
+    nb_byte_read = read_size;
+  }
+  a2dp_opus_encoder_cb.stats.media_read_total_actual_reads_count++;
+
+  *bytes_read = nb_byte_read;
+  return true;
+}
+
+void a2dp_vendor_opus_set_transmit_queue_length(size_t transmit_queue_length) {
+  a2dp_opus_encoder_cb.TxQueueLength = transmit_queue_length;
+
+  return;
+}
+
+uint64_t A2dpCodecConfigOpusSource::encoderIntervalMs() const {
+  return a2dp_vendor_opus_get_encoder_interval_ms();
+}
+
+int a2dp_vendor_opus_get_effective_frame_size() {
+  return a2dp_opus_encoder_cb.TxAaMtuSize;
+}
+
+void A2dpCodecConfigOpusSource::debug_codec_dump(int fd) {
+  a2dp_opus_encoder_stats_t* stats = &a2dp_opus_encoder_cb.stats;
+  tA2DP_OPUS_ENCODER_PARAMS* p_encoder_params =
+      &a2dp_opus_encoder_cb.opus_encoder_params;
+
+  A2dpCodecConfig::debug_codec_dump(fd);
+
+  dprintf(fd,
+          "  Packet counts (expected/dropped)                        : %zu / "
+          "%zu\n",
+          stats->media_read_total_expected_packets,
+          stats->media_read_total_dropped_packets);
+
+  dprintf(fd,
+          "  PCM read counts (expected/actual)                       : %zu / "
+          "%zu\n",
+          stats->media_read_total_expected_reads_count,
+          stats->media_read_total_actual_reads_count);
+
+  dprintf(fd,
+          "  PCM read bytes (expected/actual)                        : %zu / "
+          "%zu\n",
+          stats->media_read_total_expected_read_bytes,
+          stats->media_read_total_actual_read_bytes);
+
+  dprintf(fd,
+          "  OPUS transmission bitrate (Kbps)                        : %d\n",
+          p_encoder_params->bitrate);
+
+  dprintf(fd,
+          "  OPUS saved transmit queue length                        : %zu\n",
+          a2dp_opus_encoder_cb.TxQueueLength);
+
+  return;
+}
diff --git a/system/stack/acl/btm_acl.cc b/system/stack/acl/btm_acl.cc
index 11f93a0..4c763f3 100644
--- a/system/stack/acl/btm_acl.cc
+++ b/system/stack/acl/btm_acl.cc
@@ -43,12 +43,14 @@
 #include "common/metrics.h"
 #include "device/include/controller.h"
 #include "device/include/interop.h"
+#include "gd/metrics/metrics_state.h"
 #include "include/l2cap_hci_link_interface.h"
 #include "main/shim/acl_api.h"
 #include "main/shim/btm_api.h"
 #include "main/shim/controller.h"
 #include "main/shim/dumpsys.h"
 #include "main/shim/l2c_api.h"
+#include "main/shim/metrics_api.h"
 #include "main/shim/shim.h"
 #include "os/parameter_provider.h"
 #include "osi/include/allocator.h"
@@ -72,6 +74,7 @@
 #include "stack/include/sco_hci_link_interface.h"
 #include "types/hci_role.h"
 #include "types/raw_address.h"
+#include "os/metrics.h"
 
 void BTM_update_version_info(const RawAddress& bd_addr,
                              const remote_version_info& remote_version_info);
@@ -407,14 +410,14 @@
   p_acl->transport = transport;
   p_acl->switch_role_failed_attempts = 0;
   p_acl->reset_switch_role();
-  BTM_PM_OnConnected(hci_handle, bda);
 
   LOG_DEBUG(
       "Created new ACL connection peer:%s role:%s handle:0x%04x transport:%s",
       PRIVATE_ADDRESS(bda), RoleText(p_acl->link_role).c_str(), hci_handle,
       bt_transport_text(transport).c_str());
 
-  if (transport == BT_TRANSPORT_BR_EDR) {
+  if (p_acl->is_transport_br_edr()) {
+    BTM_PM_OnConnected(hci_handle, bda);
     btm_set_link_policy(p_acl, btm_cb.acl_cb_.DefaultLinkPolicy());
   }
 
@@ -480,8 +483,10 @@
   }
   p_acl->in_use = false;
   NotifyAclLinkDown(*p_acl);
+  if (p_acl->is_transport_br_edr()) {
+    BTM_PM_OnDisconnected(handle);
+  }
   p_acl->Reset();
-  BTM_PM_OnDisconnected(handle);
 }
 
 /*******************************************************************************
@@ -964,7 +969,6 @@
   uint16_t handle;
 
   if (evt_len < HCI_EXT_FEATURES_SUCCESS_EVT_LEN) {
-    android_errorWriteLog(0x534e4554, "141552859");
     LOG_WARN("Remote extended feature length too short. length=%d", evt_len);
     return;
   }
@@ -980,7 +984,6 @@
   }
 
   if (page_num > HCI_EXT_FEATURES_PAGE_MAX) {
-    android_errorWriteLog(0x534e4554, "141552859");
     LOG_WARN("Too many received pages num_page=%d invalid", page_num);
     return;
   }
@@ -2766,9 +2769,18 @@
     return false;
   }
 
-    bluetooth::shim::ACL_AcceptLeConnectionFrom(address_with_type,
-                                                /* is_direct */ true);
-    return true;
+  // argument list
+  auto argument_list = std::vector<std::pair<bluetooth::os::ArgumentType, int>>();
+
+  bluetooth::shim::LogMetricBluetoothLEConnectionMetricEvent(
+      bd_addr, android::bluetooth::le::LeConnectionOriginType::ORIGIN_NATIVE,
+      android::bluetooth::le::LeConnectionType::CONNECTION_TYPE_LE_ACL,
+      android::bluetooth::le::LeConnectionState::STATE_LE_ACL_START,
+      argument_list);
+
+  bluetooth::shim::ACL_AcceptLeConnectionFrom(address_with_type,
+                                              /* is_direct */ true);
+  return true;
 }
 
 bool acl_create_le_connection(const RawAddress& bd_addr) {
@@ -2806,35 +2818,6 @@
                                                                       credits);
 }
 
-static void acl_parse_num_completed_pkts(uint8_t* p, uint8_t evt_len) {
-  if (evt_len == 0) {
-    LOG_ERROR("Received num completed packets with zero length");
-    return;
-  }
-
-  uint8_t num_handles{0};
-  STREAM_TO_UINT8(num_handles, p);
-
-  if (num_handles > evt_len / (2 * sizeof(uint16_t))) {
-    android_errorWriteLog(0x534e4554, "141617601");
-    num_handles = evt_len / (2 * sizeof(uint16_t));
-  }
-
-  for (uint8_t xx = 0; xx < num_handles; xx++) {
-    uint16_t handle{0};
-    uint16_t num_packets{0};
-    STREAM_TO_UINT16(handle, p);
-    handle = HCID_GET_HANDLE(handle);
-    STREAM_TO_UINT16(num_packets, p);
-    acl_packets_completed(handle, num_packets);
-  }
-}
-
-void acl_process_num_completed_pkts(uint8_t* p, uint8_t evt_len) {
-  acl_parse_num_completed_pkts(p, evt_len);
-  bluetooth::hci::IsoManager::GetInstance()->HandleNumComplDataPkts(p, evt_len);
-}
-
 void acl_process_supported_features(uint16_t handle, uint64_t features) {
   tACL_CONN* p_acl = internal_.acl_get_connection_from_handle(handle);
   if (p_acl == nullptr) {
diff --git a/system/stack/acl/btm_pm.cc b/system/stack/acl/btm_pm.cc
index 549d2ae..2cab6bb 100644
--- a/system/stack/acl/btm_pm.cc
+++ b/system/stack/acl/btm_pm.cc
@@ -157,11 +157,18 @@
 }
 
 void BTM_PM_OnConnected(uint16_t handle, const RawAddress& remote_bda) {
+  if (pm_mode_db.find(handle) != pm_mode_db.end()) {
+    LOG_ERROR("Overwriting power mode db entry handle:%hu peer:%s", handle,
+              PRIVATE_ADDRESS(remote_bda));
+  }
   pm_mode_db[handle] = {};
   pm_mode_db[handle].Init(remote_bda, handle);
 }
 
 void BTM_PM_OnDisconnected(uint16_t handle) {
+  if (pm_mode_db.find(handle) == pm_mode_db.end()) {
+    LOG_ERROR("Erasing unknown power mode db entry handle:%hu", handle);
+  }
   pm_mode_db.erase(handle);
   if (handle == pm_pend_link) {
     pm_pend_link = 0;
diff --git a/system/stack/avct/avct_bcb_act.cc b/system/stack/avct/avct_bcb_act.cc
index c278f48..d59c4e8 100644
--- a/system/stack/avct/avct_bcb_act.cc
+++ b/system/stack/avct/avct_bcb_act.cc
@@ -78,7 +78,6 @@
 
   if (p_buf->len == 0) {
     osi_free_and_reset((void**)&p_buf);
-    android_errorWriteLog(0x534e4554, "79944113");
     return nullptr;
   }
 
@@ -532,7 +531,6 @@
     AVCT_TRACE_WARNING("Invalid AVCTP packet length %d: must be at least %d",
                        p_data->p_buf->len, AVCT_HDR_LEN_SINGLE);
     osi_free_and_reset((void**)&p_data->p_buf);
-    android_errorWriteLog(0x534e4554, "79944113");
     return;
   }
 
diff --git a/system/stack/avct/avct_lcb_act.cc b/system/stack/avct/avct_lcb_act.cc
index 58f40b8..2a2f6b2 100644
--- a/system/stack/avct/avct_lcb_act.cc
+++ b/system/stack/avct/avct_lcb_act.cc
@@ -70,10 +70,6 @@
   /* quick sanity check on length */
   if (p_buf->len < avct_lcb_pkt_type_len[pkt_type] ||
       (sizeof(BT_HDR) + p_buf->offset + p_buf->len) > BT_DEFAULT_BUFFER_SIZE) {
-    if ((sizeof(BT_HDR) + p_buf->offset + p_buf->len) >
-        BT_DEFAULT_BUFFER_SIZE) {
-      android_errorWriteWithInfoLog(0x534e4554, "230867224", -1, NULL, 0);
-    }
     osi_free(p_buf);
     AVCT_TRACE_WARNING("Bad length during reassembly");
     p_ret = NULL;
@@ -102,7 +98,6 @@
      * would have allocated smaller buffer.
      */
     if (sizeof(BT_HDR) + p_buf->offset + p_buf->len > BT_DEFAULT_BUFFER_SIZE) {
-      android_errorWriteLog(0x534e4554, "232023771");
       osi_free(p_buf);
       p_ret = NULL;
       return p_ret;
diff --git a/system/stack/avdt/avdt_msg.cc b/system/stack/avdt/avdt_msg.cc
index bfb3909..f9f3f7e 100644
--- a/system/stack/avdt/avdt_msg.cc
+++ b/system/stack/avdt/avdt_msg.cc
@@ -610,7 +610,6 @@
         p_cfg->psc_mask &= ~AVDT_PSC_PROTECT;
         if (p + elem_len > p_end) {
           err = AVDT_ERR_LENGTH;
-          android_errorWriteLog(0x534e4554, "78288378");
           break;
         }
         if ((elem_len + protect_offset) < AVDT_PROTECT_SIZE) {
@@ -639,7 +638,6 @@
         }
         if (p + tmp > p_end) {
           err = AVDT_ERR_LENGTH;
-          android_errorWriteLog(0x534e4554, "78288378");
           break;
         }
         p_cfg->num_codec++;
@@ -1003,7 +1001,6 @@
   }
 
   if (len < 1) {
-    android_errorWriteLog(0x534e4554, "79702484");
     error = AVDT_ERR_LENGTH;
   } else {
     p_msg->hdr.err_code = *p;
@@ -1215,7 +1212,6 @@
 
   /* Check if is valid length */
   if (p_buf->len < 1) {
-    android_errorWriteLog(0x534e4554, "78287084");
     osi_free(p_buf);
     p_ret = NULL;
     return p_ret;
@@ -1252,7 +1248,6 @@
      * would have allocated smaller buffer.
      */
     if (sizeof(BT_HDR) + p_buf->offset + p_buf->len > BT_DEFAULT_BUFFER_SIZE) {
-      android_errorWriteLog(0x534e4554, "232023771");
       osi_free(p_buf);
       p_ret = NULL;
       return p_ret;
diff --git a/system/stack/avdt/avdt_scb.cc b/system/stack/avdt/avdt_scb.cc
index bcb8a1a..f67b396 100644
--- a/system/stack/avdt/avdt_scb.cc
+++ b/system/stack/avdt/avdt_scb.cc
@@ -228,7 +228,7 @@
     /* TC_DATA_EVT */
     {AVDT_SCB_DROP_PKT, AVDT_SCB_IGNORE, AVDT_SCB_IDLE_ST},
     /* CC_CLOSE_EVT */
-    {AVDT_SCB_CLR_VARS, AVDT_SCB_IGNORE, AVDT_SCB_IDLE_ST}};
+    {AVDT_SCB_HDL_TC_CLOSE, AVDT_SCB_CLR_VARS, AVDT_SCB_IDLE_ST}};
 
 /* state table for configured state */
 const uint8_t avdt_scb_st_conf[][AVDT_SCB_NUM_COLS] = {
diff --git a/system/stack/avdt/avdt_scb_act.cc b/system/stack/avdt/avdt_scb_act.cc
index c18d3e5..e654405 100644
--- a/system/stack/avdt/avdt_scb_act.cc
+++ b/system/stack/avdt/avdt_scb_act.cc
@@ -263,7 +263,6 @@
   }
 
   if ((p - p_start) >= len) {
-    android_errorWriteLog(0x534e4554, "142546355");
     osi_free_and_reset((void**)&p_data->p_pkt);
     return;
   }
@@ -297,7 +296,6 @@
   }
   return;
 length_error:
-  android_errorWriteLog(0x534e4554, "111450156");
   AVDT_TRACE_WARNING("%s: hdl packet length %d too short: must be at least %d",
                      __func__, len, offset);
   osi_free_and_reset((void**)&p_data->p_pkt);
@@ -326,7 +324,6 @@
     /* parse report packet header */
     min_len += 8;
     if (min_len > len) {
-      android_errorWriteLog(0x534e4554, "111450156");
       AVDT_TRACE_WARNING(
           "%s: hdl packet length %d too short: must be at least %d", __func__,
           len, min_len);
@@ -341,7 +338,6 @@
       case AVDT_RTCP_PT_SR: /* the packet type - SR (Sender Report) */
         min_len += 20;
         if (min_len > len) {
-          android_errorWriteLog(0x534e4554, "111450156");
           AVDT_TRACE_WARNING(
               "%s: hdl packet length %d too short: must be at least %d",
               __func__, len, min_len);
@@ -357,7 +353,6 @@
       case AVDT_RTCP_PT_RR: /* the packet type - RR (Receiver Report) */
         min_len += 20;
         if (min_len > len) {
-          android_errorWriteLog(0x534e4554, "111450156");
           AVDT_TRACE_WARNING(
               "%s: hdl packet length %d too short: must be at least %d",
               __func__, len, min_len);
@@ -376,7 +371,6 @@
         uint8_t sdes_type;
         min_len += 1;
         if (min_len > len) {
-          android_errorWriteLog(0x534e4554, "111450156");
           AVDT_TRACE_WARNING(
               "%s: hdl packet length %d too short: must be at least %d",
               __func__, len, min_len);
@@ -387,7 +381,6 @@
           uint8_t name_length;
           min_len += 1;
           if (min_len > len) {
-            android_errorWriteLog(0x534e4554, "111450156");
             AVDT_TRACE_WARNING(
                 "%s: hdl packet length %d too short: must be at least %d",
                 __func__, len, min_len);
@@ -402,7 +395,6 @@
           }
         } else {
           if (min_len + 1 > len) {
-            android_errorWriteLog(0x534e4554, "111450156");
             AVDT_TRACE_WARNING(
                 "%s: hdl packet length %d too short: must be at least %d",
                 __func__, len, min_len);
@@ -1024,7 +1016,6 @@
   /* Build a media packet, and add an RTP header if required. */
   if (add_rtp_header) {
     if (p_data->apiwrite.p_buf->offset < AVDT_MEDIA_HDR_SIZE) {
-      android_errorWriteWithInfoLog(0x534e4554, "242535997", -1, NULL, 0);
       return;
     }
 
diff --git a/system/stack/avrc/avrc_api.cc b/system/stack/avrc/avrc_api.cc
index c8f2f1c..dab1d24 100644
--- a/system/stack/avrc/avrc_api.cc
+++ b/system/stack/avrc/avrc_api.cc
@@ -23,6 +23,9 @@
  ******************************************************************************/
 #include "avrc_api.h"
 
+#ifdef OS_ANDROID
+#include <avrcp.sysprop.h>
+#endif
 #include <base/logging.h>
 #include <string.h>
 
@@ -77,6 +80,25 @@
 
 /******************************************************************************
  *
+ * Function         avrcp_absolute_volume_is_enabled
+ *
+ * Description      Check if config support advance control (absolute volume)
+ *
+ * Returns          return true if absolute_volume is enabled
+ *
+ *****************************************************************************/
+bool avrcp_absolute_volume_is_enabled() {
+#ifdef OS_ANDROID
+  static const bool absolute_volume =
+      android::sysprop::bluetooth::Avrcp::absolute_volume().value_or(true);
+  return absolute_volume;
+#else
+  return true;
+#endif
+}
+
+/******************************************************************************
+ *
  * Function         avrc_ctrl_cback
  *
  * Description      This is the callback function used by AVCTP to report
@@ -637,7 +659,6 @@
 
   if (cr == AVCT_CMD && (p_pkt->layer_specific & AVCT_DATA_CTRL &&
                          p_pkt->len > AVRC_PACKET_LEN)) {
-    android_errorWriteLog(0x534e4554, "177611958");
     AVRC_TRACE_WARNING("%s: Command length %d too long: must be at most %d",
                        __func__, p_pkt->len, AVRC_PACKET_LEN);
     osi_free(p_pkt);
@@ -667,7 +688,6 @@
     msg.browse.p_browse_pkt = p_pkt;
   } else {
     if (p_pkt->len < AVRC_AVC_HDR_SIZE) {
-      android_errorWriteLog(0x534e4554, "111803925");
       AVRC_TRACE_WARNING("%s: message length %d too short: must be at least %d",
                          __func__, p_pkt->len, AVRC_AVC_HDR_SIZE);
       osi_free(p_pkt);
@@ -710,7 +730,6 @@
             AVRC_TRACE_WARNING(
                 "%s: message length %d too short: must be at least %d",
                 __func__, p_pkt->len, AVRC_OP_UNIT_INFO_RSP_LEN);
-            android_errorWriteLog(0x534e4554, "79883824");
             drop = true;
             p_drop_msg = "UNIT_INFO_RSP too short";
             break;
@@ -748,7 +767,6 @@
             AVRC_TRACE_WARNING(
                 "%s: message length %d too short: must be at least %d",
                 __func__, p_pkt->len, AVRC_OP_SUB_UNIT_INFO_RSP_LEN);
-            android_errorWriteLog(0x534e4554, "79883824");
             drop = true;
             p_drop_msg = "SUB_UNIT_INFO_RSP too short";
             break;
diff --git a/system/stack/avrc/avrc_bld_ct.cc b/system/stack/avrc/avrc_bld_ct.cc
index deadd29..5eb5d3b 100644
--- a/system/stack/avrc/avrc_bld_ct.cc
+++ b/system/stack/avrc/avrc_bld_ct.cc
@@ -58,7 +58,6 @@
  *  the following commands are introduced in AVRCP 1.4
  ****************************************************************************/
 
-#if (AVRC_ADV_CTRL_INCLUDED == TRUE)
 /*******************************************************************************
  *
  * Function         avrc_bld_set_abs_volume_cmd
@@ -110,7 +109,6 @@
   p_pkt->len = (p_data - p_start);
   return AVRC_STS_NO_ERROR;
 }
-#endif
 
 /*******************************************************************************
  *
@@ -607,16 +605,18 @@
     case AVRC_PDU_ABORT_CONTINUATION_RSP: /*          0x41 */
       status = avrc_bld_next_cmd(&p_cmd->abort, p_pkt);
       break;
-#if (AVRC_ADV_CTRL_INCLUDED == TRUE)
     case AVRC_PDU_SET_ABSOLUTE_VOLUME: /* 0x50 */
+      if (!avrcp_absolute_volume_is_enabled()) {
+        break;
+      }
       status = avrc_bld_set_abs_volume_cmd(&p_cmd->volume, p_pkt);
       break;
-#endif
     case AVRC_PDU_REGISTER_NOTIFICATION: /* 0x31 */
-#if (AVRC_ADV_CTRL_INCLUDED == TRUE)
+      if (!avrcp_absolute_volume_is_enabled()) {
+        break;
+      }
       status = avrc_bld_register_notifn(p_pkt, p_cmd->reg_notif.event_id,
                                         p_cmd->reg_notif.param);
-#endif
       break;
     case AVRC_PDU_GET_CAPABILITIES:
       status =
diff --git a/system/stack/avrc/avrc_pars_ct.cc b/system/stack/avrc/avrc_pars_ct.cc
index 13c3513..9dc8a77 100644
--- a/system/stack/avrc/avrc_pars_ct.cc
+++ b/system/stack/avrc/avrc_pars_ct.cc
@@ -48,16 +48,13 @@
   tAVRC_STS status = AVRC_STS_NO_ERROR;
   uint8_t* p;
   uint16_t len;
-#if (AVRC_ADV_CTRL_INCLUDED == TRUE)
   uint8_t eventid = 0;
-#endif
 
   /* Check the vendor data */
   if (p_msg->vendor_len == 0) return AVRC_STS_NO_ERROR;
   if (p_msg->p_vendor_data == NULL) return AVRC_STS_INTERNAL_ERR;
 
   if (p_msg->vendor_len < 4) {
-    android_errorWriteLog(0x534e4554, "111450531");
     AVRC_TRACE_WARNING("%s: message length %d too short: must be at least 4",
                        __func__, p_msg->vendor_len);
     return AVRC_STS_INTERNAL_ERR;
@@ -70,7 +67,6 @@
                    __func__, p_msg->hdr.ctype, p_result->pdu, len, len,
                    p_msg->vendor_len);
   if (p_msg->vendor_len < len + 4) {
-    android_errorWriteLog(0x534e4554, "111450531");
     AVRC_TRACE_WARNING("%s: message length %d too short: must be at least %d",
                        __func__, p_msg->vendor_len, len + 4);
     return AVRC_STS_INTERNAL_ERR;
@@ -78,7 +74,6 @@
 
   if (p_msg->hdr.ctype == AVRC_RSP_REJ) {
     if (len < 1) {
-      android_errorWriteLog(0x534e4554, "111450531");
       AVRC_TRACE_WARNING("%s: invalid parameter length %d: must be at least 1",
                          __func__, len);
       return AVRC_STS_INTERNAL_ERR;
@@ -91,20 +86,22 @@
 /* case AVRC_PDU_REQUEST_CONTINUATION_RSP: 0x40 */
 /* case AVRC_PDU_ABORT_CONTINUATION_RSP:   0x41 */
 
-#if (AVRC_ADV_CTRL_INCLUDED == TRUE)
     case AVRC_PDU_SET_ABSOLUTE_VOLUME: /* 0x50 */
+      if (!avrcp_absolute_volume_is_enabled()) {
+        break;
+      }
       if (len != 1)
         status = AVRC_STS_INTERNAL_ERR;
       else {
         BE_STREAM_TO_UINT8(p_result->volume.volume, p);
       }
       break;
-#endif /* (AVRC_ADV_CTRL_INCLUDED == TRUE) */
 
     case AVRC_PDU_REGISTER_NOTIFICATION: /* 0x31 */
-#if (AVRC_ADV_CTRL_INCLUDED == TRUE)
+      if (!avrcp_absolute_volume_is_enabled()) {
+        break;
+      }
       if (len < 1) {
-        android_errorWriteLog(0x534e4554, "111450531");
         AVRC_TRACE_WARNING(
             "%s: invalid parameter length %d: must be at least 1", __func__,
             len);
@@ -117,7 +114,6 @@
            AVRC_RSP_REJ == p_msg->hdr.ctype ||
            AVRC_RSP_NOT_IMPL == p_msg->hdr.ctype)) {
         if (len < 2) {
-          android_errorWriteLog(0x534e4554, "111450531");
           AVRC_TRACE_WARNING(
               "%s: invalid parameter length %d: must be at least 2", __func__,
               len);
@@ -129,7 +125,6 @@
       }
       AVRC_TRACE_DEBUG("%s PDU reg notif response:event %x, volume %x",
                        __func__, eventid, p_result->reg_notif.param.volume);
-#endif /* (AVRC_ADV_CTRL_INCLUDED == TRUE) */
       break;
     default:
       status = AVRC_STS_BAD_CMD;
@@ -163,7 +158,6 @@
       if (len < min_len) goto length_error;
       BE_STREAM_TO_UINT8(p_rsp->param.player_setting.num_attr, p_stream);
       if (p_rsp->param.player_setting.num_attr > AVRC_MAX_APP_SETTINGS) {
-        android_errorWriteLog(0x534e4554, "73782082");
         p_rsp->param.player_setting.num_attr = AVRC_MAX_APP_SETTINGS;
       }
       min_len += p_rsp->param.player_setting.num_attr * 2;
@@ -210,7 +204,6 @@
   return AVRC_STS_NO_ERROR;
 
 length_error:
-  android_errorWriteLog(0x534e4554, "111450417");
   AVRC_TRACE_WARNING("%s: invalid parameter length %d: must be at least %d",
                      __func__, len, min_len);
   return AVRC_STS_INTERNAL_ERR;
@@ -230,7 +223,6 @@
 
   /* read the pdu */
   if (p_msg->browse_len < 3) {
-    android_errorWriteLog(0x534e4554, "111451066");
     AVRC_TRACE_WARNING("%s: message length %d too short: must be at least 3",
                        __func__, p_msg->browse_len);
     return AVRC_STS_BAD_PARAM;
@@ -244,7 +236,6 @@
   AVRC_TRACE_DEBUG("%s pdu:%d, pkt_len:%d", __func__, pdu, pkt_len);
 
   if (p_msg->browse_len < (pkt_len + 3)) {
-    android_errorWriteLog(0x534e4554, "111451066");
     AVRC_TRACE_WARNING("%s: message length %d too short: must be at least %d",
                        __func__, p_msg->browse_len, pkt_len + 3);
     return AVRC_STS_INTERNAL_ERR;
@@ -430,7 +421,6 @@
       get_attr_rsp->pdu = pdu;
       min_len += 2;
       if (pkt_len < min_len) {
-        android_errorWriteLog(0x534e4554, "179162665");
         goto browse_length_error;
       }
       BE_STREAM_TO_UINT8(get_attr_rsp->status, p)
@@ -508,7 +498,6 @@
   return status;
 
 browse_length_error:
-  android_errorWriteLog(0x534e4554, "111451066");
   AVRC_TRACE_WARNING("%s: invalid parameter length %d: must be at least %d",
                      __func__, pkt_len, min_len);
   return AVRC_STS_BAD_CMD;
@@ -530,7 +519,6 @@
                                            tAVRC_RESPONSE* p_result,
                                            uint8_t* p_buf, uint16_t* buf_len) {
   if (p_msg->vendor_len < 4) {
-    android_errorWriteLog(0x534e4554, "111450417");
     AVRC_TRACE_WARNING("%s: message length %d too short: must be at least 4",
                        __func__, p_msg->vendor_len);
     return AVRC_STS_INTERNAL_ERR;
@@ -546,7 +534,6 @@
   AVRC_TRACE_DEBUG("%s ctype:0x%x pdu:0x%x, len:%d  vendor_len=0x%x", __func__,
                    p_msg->hdr.ctype, p_result->pdu, len, p_msg->vendor_len);
   if (p_msg->vendor_len < len + 4) {
-    android_errorWriteLog(0x534e4554, "111450417");
     AVRC_TRACE_WARNING("%s: message length %d too short: must be at least %d",
                        __func__, p_msg->vendor_len, len + 4);
     return AVRC_STS_INTERNAL_ERR;
@@ -582,7 +569,6 @@
                        p_result->get_caps.count);
       if (p_result->get_caps.capability_id == AVRC_CAP_COMPANY_ID) {
         if (p_result->get_caps.count > AVRC_CAP_MAX_NUM_COMP_ID) {
-          android_errorWriteLog(0x534e4554, "205837191");
           return AVRC_STS_INTERNAL_ERR;
         }
         min_len += MIN(p_result->get_caps.count, AVRC_CAP_MAX_NUM_COMP_ID) * 3;
@@ -595,7 +581,6 @@
       } else if (p_result->get_caps.capability_id ==
                  AVRC_CAP_EVENTS_SUPPORTED) {
         if (p_result->get_caps.count > AVRC_CAP_MAX_NUM_EVT_ID) {
-          android_errorWriteLog(0x534e4554, "205837191");
           return AVRC_STS_INTERNAL_ERR;
         }
         min_len += MIN(p_result->get_caps.count, AVRC_CAP_MAX_NUM_EVT_ID);
@@ -619,7 +604,6 @@
                        p_result->list_app_attr.num_attr);
 
       if (p_result->list_app_attr.num_attr > AVRC_MAX_APP_ATTR_SIZE) {
-        android_errorWriteLog(0x534e4554, "63146237");
         p_result->list_app_attr.num_attr = AVRC_MAX_APP_ATTR_SIZE;
       }
 
@@ -638,7 +622,6 @@
       min_len += 1;
       BE_STREAM_TO_UINT8(p_result->list_app_values.num_val, p);
       if (p_result->list_app_values.num_val > AVRC_MAX_APP_ATTR_SIZE) {
-        android_errorWriteLog(0x534e4554, "78526423");
         p_result->list_app_values.num_val = AVRC_MAX_APP_ATTR_SIZE;
       }
 
@@ -662,7 +645,6 @@
                        p_result->get_cur_app_val.num_val);
 
       if (p_result->get_cur_app_val.num_val > AVRC_MAX_APP_ATTR_SIZE) {
-        android_errorWriteLog(0x534e4554, "63146237");
         p_result->get_cur_app_val.num_val = AVRC_MAX_APP_ATTR_SIZE;
       }
 
@@ -862,7 +844,6 @@
   return AVRC_STS_NO_ERROR;
 
 length_error:
-  android_errorWriteLog(0x534e4554, "111450417");
   AVRC_TRACE_WARNING("%s: invalid parameter length %d: must be at least %d",
                      __func__, len, min_len);
   return AVRC_STS_INTERNAL_ERR;
diff --git a/system/stack/avrc/avrc_pars_tg.cc b/system/stack/avrc/avrc_pars_tg.cc
index e24db2e..a250af2 100644
--- a/system/stack/avrc/avrc_pars_tg.cc
+++ b/system/stack/avrc/avrc_pars_tg.cc
@@ -46,7 +46,6 @@
   if (p_msg->vendor_len < 4) {  // 4 == pdu + reserved byte + len as uint16
     AVRC_TRACE_WARNING("%s: message length %d too short: must be at least 4",
                        __func__, p_msg->vendor_len);
-    android_errorWriteLog(0x534e4554, "205571133");
     return AVRC_STS_INTERNAL_ERR;
   }
   uint8_t* p = p_msg->p_vendor_data;
@@ -84,7 +83,6 @@
 
       if (p_result->reg_notif.event_id == 0 ||
           p_result->reg_notif.event_id > AVRC_NUM_NOTIF_EVENTS) {
-        android_errorWriteLog(0x534e4554, "181860042");
         status = AVRC_STS_BAD_PARAM;
       }
       break;
@@ -125,7 +123,6 @@
   if (p_msg->p_vendor_data == NULL) return AVRC_STS_INTERNAL_ERR;
 
   if (p_msg->vendor_len < 4) {
-    android_errorWriteLog(0x534e4554, "168712382");
     AVRC_TRACE_WARNING("%s: message length %d too short: must be at least 4",
                        __func__, p_msg->vendor_len);
     return AVRC_STS_INTERNAL_ERR;
@@ -183,7 +180,6 @@
       }
 
       if (p_result->get_cur_app_val.num_attr > AVRC_MAX_APP_ATTR_SIZE) {
-        android_errorWriteLog(0x534e4554, "63146237");
         p_result->get_cur_app_val.num_attr = AVRC_MAX_APP_ATTR_SIZE;
       }
 
@@ -244,7 +240,6 @@
             status = AVRC_STS_INTERNAL_ERR;
           else {
             if (p_result->get_app_val_txt.num_val > AVRC_MAX_APP_ATTR_SIZE) {
-              android_errorWriteLog(0x534e4554, "63146237");
               p_result->get_app_val_txt.num_val = AVRC_MAX_APP_ATTR_SIZE;
             }
 
@@ -326,7 +321,6 @@
       else {
         BE_STREAM_TO_UINT8(p_result->reg_notif.event_id, p);
         if (!AVRC_IS_VALID_EVENT_ID(p_result->reg_notif.event_id)) {
-          android_errorWriteLog(0x534e4554, "168802990");
           AVRC_TRACE_ERROR("%s: Invalid event id: %d", __func__,
                            p_result->reg_notif.event_id);
           return AVRC_STS_BAD_PARAM;
@@ -575,8 +569,6 @@
       if (p_buf) {
         if (p_result->search.string.str_len > buf_len) {
           p_result->search.string.str_len = buf_len;
-        } else {
-          android_errorWriteLog(0x534e4554, "63146237");
         }
         min_len += p_result->search.string.str_len;
         RETURN_STATUS_IF_FALSE(AVRC_STS_BAD_CMD, (p_msg->browse_len >= min_len),
diff --git a/system/stack/bnep/bnep_main.cc b/system/stack/bnep/bnep_main.cc
index 70ca2b7..e918e04 100644
--- a/system/stack/bnep/bnep_main.cc
+++ b/system/stack/bnep/bnep_main.cc
@@ -319,7 +319,6 @@
   uint8_t* p = (uint8_t*)(p_buf + 1) + p_buf->offset;
   uint16_t rem_len = p_buf->len;
   if (rem_len == 0) {
-    android_errorWriteLog(0x534e4554, "78286118");
     osi_free(p_buf);
     return;
   }
@@ -341,7 +340,6 @@
   type &= 0x7f;
   if (type >= sizeof(bnep_frame_hdr_sizes) / sizeof(bnep_frame_hdr_sizes[0])) {
     LOG_INFO("BNEP - rcvd frame, bad type: 0x%02x", type);
-    android_errorWriteLog(0x534e4554, "68818034");
     osi_free(p_buf);
     return;
   }
@@ -371,7 +369,6 @@
       org_len = rem_len;
       do {
         if (org_len < 2) {
-          android_errorWriteLog(0x534e4554, "67863755");
           break;
         }
         ext = *p++;
@@ -379,13 +376,11 @@
 
         new_len = (length + 2);
         if (new_len > org_len) {
-          android_errorWriteLog(0x534e4554, "67863755");
           break;
         }
 
         if ((ext & 0x7F) == BNEP_EXTENSION_FILTER_CONTROL) {
           if (length == 0) {
-            android_errorWriteLog(0x534e4554, "79164722");
             break;
           }
           if (*p > BNEP_FILTER_MULTI_ADDR_RESPONSE_MSG) {
@@ -447,7 +442,6 @@
           /* if unknown extension present stop processing */
           if (ext_type != BNEP_EXTENSION_FILTER_CONTROL) break;
 
-          android_errorWriteLog(0x534e4554, "69271284");
           p = bnep_process_control_packet(p_bcb, p, &rem_len, true);
         }
       }
diff --git a/system/stack/bnep/bnep_utils.cc b/system/stack/bnep/bnep_utils.cc
index a1bc7de..b243de4 100644
--- a/system/stack/bnep/bnep_utils.cc
+++ b/system/stack/bnep/bnep_utils.cc
@@ -756,7 +756,6 @@
         BNEP_TRACE_ERROR(
             "%s: Received BNEP_SETUP_CONNECTION_REQUEST_MSG with bad length",
             __func__);
-        android_errorWriteLog(0x534e4554, "69177292");
         goto bad_packet_length;
       }
       len = *p++;
@@ -788,7 +787,6 @@
         BNEP_TRACE_ERROR(
             "%s: Received BNEP_FILTER_NET_TYPE_SET_MSG with bad length",
             __func__);
-        android_errorWriteLog(0x534e4554, "69177292");
         goto bad_packet_length;
       }
       BE_STREAM_TO_UINT16(len, p);
@@ -820,7 +818,6 @@
         BNEP_TRACE_ERROR(
             "%s: Received BNEP_FILTER_MULTI_ADDR_SET_MSG with bad length",
             __func__);
-        android_errorWriteLog(0x534e4554, "69177292");
         goto bad_packet_length;
       }
       BE_STREAM_TO_UINT16(len, p);
diff --git a/system/stack/btm/ble_advertiser_hci_interface.cc b/system/stack/btm/ble_advertiser_hci_interface.cc
index 15fe4bc..a892ebe 100644
--- a/system/stack/btm/ble_advertiser_hci_interface.cc
+++ b/system/stack/btm/ble_advertiser_hci_interface.cc
@@ -167,7 +167,6 @@
     memset(param, 0, BTM_BLE_MULTI_ADV_WRITE_DATA_LEN);
 
     if (data_length > BTM_BLE_AD_DATA_LEN) {
-      android_errorWriteLog(0x534e4554, "121145627");
       LOG(ERROR) << __func__
                  << ": data_length=" << static_cast<int>(data_length)
                  << ", is longer than size limit " << BTM_BLE_AD_DATA_LEN;
@@ -194,7 +193,6 @@
     memset(param, 0, BTM_BLE_MULTI_ADV_WRITE_DATA_LEN);
 
     if (scan_response_data_length > BTM_BLE_AD_DATA_LEN) {
-      android_errorWriteLog(0x534e4554, "121145627");
       LOG(ERROR) << __func__ << ": scan_response_data_length="
                  << static_cast<int>(scan_response_data_length)
                  << ", is longer than size limit " << BTM_BLE_AD_DATA_LEN;
@@ -393,7 +391,6 @@
     uint8_t param[HCIC_PARAM_SIZE_BLE_WRITE_ADV_DATA + 1];
 
     if (data_length > HCIC_PARAM_SIZE_BLE_WRITE_ADV_DATA) {
-      android_errorWriteLog(0x534e4554, "121145627");
       LOG(ERROR) << __func__
                  << ": data_length=" << static_cast<int>(data_length)
                  << ", is longer than size limit "
@@ -419,7 +416,6 @@
     uint8_t param[HCIC_PARAM_SIZE_BLE_WRITE_ADV_DATA + 1];
 
     if (scan_response_data_length > HCIC_PARAM_SIZE_BLE_WRITE_ADV_DATA) {
-      android_errorWriteLog(0x534e4554, "121145627");
       LOG(ERROR) << __func__ << ": scan_response_data_length="
                  << static_cast<int>(scan_response_data_length)
                  << ", is longer than size limit "
diff --git a/system/stack/btm/btm_ble.cc b/system/stack/btm/btm_ble.cc
index 2d60c59..1227f99 100644
--- a/system/stack/btm/btm_ble.cc
+++ b/system/stack/btm/btm_ble.cc
@@ -62,6 +62,22 @@
 #define PROPERTY_BLE_PRIVACY_ENABLED "bluetooth.core.gap.le.privacy.enabled"
 #endif
 
+// Pairing parameters defined in Vol 3, Part H, Chapter 3.5.1 - 3.5.2
+// All present in the exact decimal values, not hex
+// Ex: bluetooth.core.smp.le.ctkd.initiator_key_distribution 15(0x0f)
+static const char kPropertyCtkdAuthRequest[] =
+    "bluetooth.core.smp.le.ctkd.auth_request";
+static const char kPropertyCtkdIoCapabilities[] =
+    "bluetooth.core.smp.le.ctkd.io_capabilities";
+// Vol 3, Part H, Chapter 3.6.1, Figure 3.11
+// |EncKey(1)|IdKey(1)|SignKey(1)|LinkKey(1)|Reserved(4)|
+static const char kPropertyCtkdInitiatorKeyDistribution[] =
+    "bluetooth.core.smp.le.ctkd.initiator_key_distribution";
+static const char kPropertyCtkdResponderKeyDistribution[] =
+    "bluetooth.core.smp.le.ctkd.responder_key_distribution";
+static const char kPropertyCtkdMaxKeySize[] =
+    "bluetooth.core.smp.le.ctkd.max_key_size";
+
 /******************************************************************************/
 /* External Function to be called by other modules                            */
 /******************************************************************************/
@@ -488,9 +504,9 @@
     }
   } else /* there is a security device record exisitng */
   {
-    /* new inquiry result, overwrite device type in security device record */
+    /* new inquiry result, merge device type in security device record */
     if (p_inq_info) {
-      p_dev_rec->device_type = p_inq_info->results.device_type;
+      p_dev_rec->device_type |= p_inq_info->results.device_type;
       if (is_ble_addr_type_known(p_inq_info->results.ble_addr_type))
         p_dev_rec->ble.SetAddressType(p_inq_info->results.ble_addr_type);
       else
@@ -991,10 +1007,17 @@
   }
 
   if (ble_sec_act == BTM_BLE_SEC_NONE) {
-    return result;
+    if (bluetooth::common::init_flags::queue_l2cap_coc_while_encrypting_is_enabled()) {
+      if (sec_act != BTM_SEC_ENC_PENDING) {
+        return result;
+      }
+    } else {
+      return result;
+    }
+  } else {
+    l2cble_update_sec_act(bd_addr, sec_act);
   }
 
-  l2cble_update_sec_act(bd_addr, sec_act);
   BTM_SetEncryption(bd_addr, BT_TRANSPORT_LE, p_callback, p_ref_data,
                     ble_sec_act);
 
@@ -1600,13 +1623,30 @@
   BTM_TRACE_ERROR("key size = %d", p_rec->ble.keys.key_size);
   if (use_stk) {
     btsnd_hcic_ble_ltk_req_reply(btm_cb.enc_handle, stk);
-  } else /* calculate LTK using peer device  */
-  {
-    if (p_rec->ble.key_type & BTM_LE_KEY_LENC)
-      btsnd_hcic_ble_ltk_req_reply(btm_cb.enc_handle, p_rec->ble.keys.lltk);
-    else
-      btsnd_hcic_ble_ltk_req_neg_reply(btm_cb.enc_handle);
+    return;
   }
+  /* calculate LTK using peer device  */
+  if (p_rec->ble.key_type & BTM_LE_KEY_LENC) {
+    btsnd_hcic_ble_ltk_req_reply(btm_cb.enc_handle, p_rec->ble.keys.lltk);
+    return;
+  }
+
+  p_rec = btm_find_dev_with_lenc(bda);
+  if (!p_rec) {
+    btsnd_hcic_ble_ltk_req_neg_reply(btm_cb.enc_handle);
+    return;
+  }
+
+  LOG_INFO("Found second sec_dev_rec for device that have LTK");
+  /* This can happen when remote established LE connection using RPA to this
+   * device, but then pair with us using Classing transport while still keeping
+   * LE connection. If remote attempts to encrypt the LE connection, we might
+   * end up here. We will eventually consolidate both entries, this is to avoid
+   * race conditions. */
+
+  LOG_ASSERT(p_rec->ble.key_type & BTM_LE_KEY_LENC);
+  p_cb->key_size = p_rec->ble.keys.key_size;
+  btsnd_hcic_ble_ltk_req_reply(btm_cb.enc_handle, p_rec->ble.keys.lltk);
 }
 
 /*******************************************************************************
@@ -1707,11 +1747,18 @@
                             tBTM_LE_IO_REQ* p_data) {
   uint8_t callback_rc = BTM_SUCCESS;
   BTM_TRACE_DEBUG("%s", __func__);
-  if (btm_cb.api.p_le_callback) {
-    /* the callback function implementation may change the IO capability... */
-    callback_rc = (*btm_cb.api.p_le_callback)(
-        BTM_LE_IO_REQ_EVT, p_dev_rec->bd_addr, (tBTM_LE_EVT_DATA*)p_data);
-  }
+  p_data->io_cap =
+      osi_property_get_int32(kPropertyCtkdIoCapabilities, BTM_IO_CAP_UNKNOWN);
+  p_data->auth_req = osi_property_get_int32(kPropertyCtkdAuthRequest,
+                                            BTM_LE_AUTH_REQ_SC_MITM_BOND);
+  p_data->init_keys = osi_property_get_int32(
+      kPropertyCtkdInitiatorKeyDistribution, SMP_BR_SEC_DEFAULT_KEY);
+  p_data->resp_keys = osi_property_get_int32(
+      kPropertyCtkdResponderKeyDistribution, SMP_BR_SEC_DEFAULT_KEY);
+  p_data->max_key_size =
+      osi_property_get_int32(kPropertyCtkdMaxKeySize, BTM_BLE_MAX_KEY_SIZE);
+  // No OOB data for BR/EDR
+  p_data->oob_data = false;
 
   return callback_rc;
 }
@@ -1835,7 +1882,6 @@
           p_dev_rec = btm_find_dev(bd_addr);
           if (p_dev_rec == NULL) {
             BTM_TRACE_ERROR("%s: p_dev_rec is NULL", __func__);
-            android_errorWriteLog(0x534e4554, "120612744");
             return BTM_SUCCESS;
           }
           BTM_TRACE_DEBUG(
diff --git a/system/stack/btm/btm_ble_gap.cc b/system/stack/btm/btm_ble_gap.cc
index ce55cf9..1417440 100644
--- a/system/stack/btm/btm_ble_gap.cc
+++ b/system/stack/btm/btm_ble_gap.cc
@@ -464,6 +464,21 @@
   }
 }
 
+void BTM_BleTargetAnnouncementObserve(bool enable,
+                                      tBTM_INQ_RESULTS_CB* p_results_cb) {
+  if (bluetooth::shim::is_gd_shim_enabled()) {
+    bluetooth::shim::BTM_BleTargetAnnouncementObserve(enable, p_results_cb);
+    // NOTE: passthrough, no return here. GD would send the results back to BTM,
+    // and it needs the callbacks set properly.
+  }
+
+  if (enable) {
+    btm_cb.ble_ctr_cb.p_target_announcement_obs_results_cb = p_results_cb;
+  } else {
+    btm_cb.ble_ctr_cb.p_target_announcement_obs_results_cb = NULL;
+  }
+}
+
 /*******************************************************************************
  *
  * Function         BTM_BleObserve
@@ -691,7 +706,7 @@
   if (btm_cb.cmn_ble_vsc_cb.max_filter > 0) btm_ble_adv_filter_init();
 
   /* VS capability included and non-4.2 device */
-  if (controller_get_interface()->supports_ble() && 
+  if (controller_get_interface()->supports_ble() &&
       controller_get_interface()->supports_ble_privacy() &&
       btm_cb.cmn_ble_vsc_cb.max_irk_list_sz > 0 &&
       controller_get_interface()->get_ble_resolving_list_max_size() == 0)
@@ -2271,8 +2286,13 @@
       dev_class[1] = BTM_COD_MAJOR_AUDIO;
       dev_class[2] = BTM_COD_MINOR_UNCLASSIFIED;
       break;
+    case BTM_BLE_APPEARANCE_GENERIC_WEARABLE_AUDIO_DEVICE:
     case BTM_BLE_APPEARANCE_WEARABLE_AUDIO_DEVICE_EARBUD:
-      dev_class[1] = BTM_COD_MAJOR_AUDIO;
+    case BTM_BLE_APPEARANCE_WEARABLE_AUDIO_DEVICE_HEADSET:
+    case BTM_BLE_APPEARANCE_WEARABLE_AUDIO_DEVICE_HEADPHONES:
+    case BTM_BLE_APPEARANCE_WEARABLE_AUDIO_DEVICE_NECK_BAND:
+      dev_class[0] = (BTM_COD_SERVICE_AUDIO | BTM_COD_SERVICE_RENDERING) >> 8;
+      dev_class[1] = (BTM_COD_MAJOR_AUDIO | BTM_COD_SERVICE_LE_AUDIO);
       dev_class[2] = BTM_COD_MINOR_WEARABLE_HEADSET;
       break;
     case BTM_BLE_APPEARANCE_GENERIC_BARCODE_SCANNER:
@@ -2377,9 +2397,7 @@
       has_advertising_flags = true;
       p_cur->flag = *p_flag;
     }
-  }
 
-  if (!data.empty()) {
     /* Check to see the BLE device has the Appearance UUID in the advertising
      * data.  If it does
      * then try to convert the appearance value to a class of device value
@@ -2409,6 +2427,35 @@
         }
       }
     }
+
+    const uint8_t* p_rsi =
+        AdvertiseDataParser::GetFieldByType(data, BTM_BLE_AD_TYPE_RSI, &len);
+    if (p_rsi != nullptr && len == 6) {
+      STREAM_TO_BDADDR(p_cur->ble_ad_rsi, p_rsi);
+    }
+
+    const uint8_t* p_service_data = data.data();
+    uint8_t service_data_len = 0;
+
+    while ((p_service_data = AdvertiseDataParser::GetFieldByType(
+                p_service_data + service_data_len,
+                data.size() - (p_service_data - data.data()) - service_data_len,
+                BTM_BLE_AD_TYPE_SERVICE_DATA_TYPE, &service_data_len))) {
+      uint16_t uuid;
+      const uint8_t* p_uuid = p_service_data;
+      if (service_data_len < 2) {
+        continue;
+      }
+      STREAM_TO_UINT16(uuid, p_uuid);
+
+      if (uuid == 0x184E /* Audio Stream Control service */ ||
+          uuid == 0x184F /* Broadcast Audio Scan service */ ||
+          uuid == 0x1850 /* Published Audio Capabilities service */ ||
+          uuid == 0x1853 /* Common Audio service */) {
+        p_cur->ble_ad_is_le_audio_capable = true;
+        break;
+      }
+    }
   }
 
   // Non-connectable packets may omit flags entirely, in which case nothing
@@ -2750,6 +2797,14 @@
                                      adv_data.size());
   }
 
+  tBTM_INQ_RESULTS_CB* p_target_announcement_obs_results_cb =
+      btm_cb.ble_ctr_cb.p_target_announcement_obs_results_cb;
+  if (p_target_announcement_obs_results_cb) {
+    (p_target_announcement_obs_results_cb)(
+        (tBTM_INQ_RESULTS*)&p_i->inq_info.results,
+        const_cast<uint8_t*>(adv_data.data()), adv_data.size());
+  }
+
   uint8_t result = btm_ble_is_discoverable(bda, adv_data);
   if (result == 0) {
     // Device no longer discoverable so discard outstanding advertising packet
@@ -2847,6 +2902,14 @@
         const_cast<uint8_t*>(advertising_data.data()), advertising_data.size());
   }
 
+  tBTM_INQ_RESULTS_CB* p_target_announcement_obs_results_cb =
+      btm_cb.ble_ctr_cb.p_target_announcement_obs_results_cb;
+  if (p_target_announcement_obs_results_cb) {
+    (p_target_announcement_obs_results_cb)(
+        (tBTM_INQ_RESULTS*)&p_i->inq_info.results,
+        const_cast<uint8_t*>(advertising_data.data()), advertising_data.size());
+  }
+
   uint8_t result = btm_ble_is_discoverable(bda, advertising_data);
   if (result == 0) {
     return;
diff --git a/system/stack/btm/btm_ble_int_types.h b/system/stack/btm/btm_ble_int_types.h
index 5a09528..56bfb23 100644
--- a/system/stack/btm/btm_ble_int_types.h
+++ b/system/stack/btm/btm_ble_int_types.h
@@ -72,6 +72,24 @@
   BTM_BLE_SEC_REQ_ACT_DISCARD = 3,
 } tBTM_BLE_SEC_REQ_ACT;
 
+#ifndef CASE_RETURN_TEXT
+#define CASE_RETURN_TEXT(code) \
+  case code:                   \
+    return #code
+#endif
+
+inline std::string btm_ble_sec_req_act_text(
+    const tBTM_BLE_SEC_REQ_ACT& action) {
+  switch (action) {
+    CASE_RETURN_TEXT(BTM_BLE_SEC_REQ_ACT_NONE);
+    CASE_RETURN_TEXT(BTM_BLE_SEC_REQ_ACT_ENCRYPT);
+    CASE_RETURN_TEXT(BTM_BLE_SEC_REQ_ACT_PAIR);
+    CASE_RETURN_TEXT(BTM_BLE_SEC_REQ_ACT_DISCARD);
+  }
+}
+
+#undef CASE_RETURN_TEXT
+
 #define BTM_VSC_CHIP_CAPABILITY_L_VERSION 55
 #define BTM_VSC_CHIP_CAPABILITY_M_VERSION 95
 #define BTM_VSC_CHIP_CAPABILITY_S_VERSION 98
@@ -227,6 +245,9 @@
   /* opportunistic observer */
   tBTM_INQ_RESULTS_CB* p_opportunistic_obs_results_cb;
 
+  /* target announcement observer */
+  tBTM_INQ_RESULTS_CB* p_target_announcement_obs_results_cb;
+
   /* background connection procedure cb value */
   uint16_t scan_int;
   uint16_t scan_win;
diff --git a/system/stack/btm/btm_dev.cc b/system/stack/btm/btm_dev.cc
index 4067e3d..10c19d4 100644
--- a/system/stack/btm/btm_dev.cc
+++ b/system/stack/btm/btm_dev.cc
@@ -30,6 +30,7 @@
 #include <string.h>
 
 #include "btm_api.h"
+#include "btm_ble_int.h"
 #include "device/include/controller.h"
 #include "l2c_api.h"
 #include "main/shim/btm_api.h"
@@ -372,6 +373,32 @@
   return NULL;
 }
 
+static bool has_lenc_and_address_is_equal(void* data, void* context) {
+  tBTM_SEC_DEV_REC* p_dev_rec = static_cast<tBTM_SEC_DEV_REC*>(data);
+  if (!(p_dev_rec->ble.key_type & BTM_LE_KEY_LENC)) return true;
+
+  return is_address_equal(data, context);
+}
+
+/*******************************************************************************
+ *
+ * Function         btm_find_dev_with_lenc
+ *
+ * Description      Look for the record in the device database with LTK and
+ *                  specified BD address
+ *
+ * Returns          Pointer to the record or NULL
+ *
+ ******************************************************************************/
+tBTM_SEC_DEV_REC* btm_find_dev_with_lenc(const RawAddress& bd_addr) {
+  if (btm_cb.sec_dev_rec == nullptr) return nullptr;
+
+  list_node_t* n = list_foreach(btm_cb.sec_dev_rec, has_lenc_and_address_is_equal,
+                                (void*)&bd_addr);
+  if (n) return static_cast<tBTM_SEC_DEV_REC*>(list_node(n));
+
+  return NULL;
+}
 /*******************************************************************************
  *
  * Function         btm_consolidate_dev
@@ -429,6 +456,63 @@
   }
 }
 
+/* combine security records of established LE connections after Classic pairing
+ * succeeded. */
+void btm_dev_consolidate_existing_connections(const RawAddress& bd_addr) {
+  tBTM_SEC_DEV_REC* p_target_rec = btm_find_dev(bd_addr);
+  if (!p_target_rec) {
+    LOG_ERROR("No security record for just bonded device!?!?");
+    return;
+  }
+
+  if (p_target_rec->ble_hci_handle != HCI_INVALID_HANDLE) {
+    LOG_INFO("Not consolidating - already have LE connection");
+    return;
+  }
+
+  LOG_INFO("%s", PRIVATE_ADDRESS(bd_addr));
+
+  list_node_t* end = list_end(btm_cb.sec_dev_rec);
+  list_node_t* node = list_begin(btm_cb.sec_dev_rec);
+  while (node != end) {
+    tBTM_SEC_DEV_REC* p_dev_rec =
+        static_cast<tBTM_SEC_DEV_REC*>(list_node(node));
+
+    // we do list_remove in some cases, must grab next before removing
+    node = list_next(node);
+
+    if (p_target_rec == p_dev_rec) continue;
+
+    /* an RPA device entry is a duplicate of the target record */
+    if (btm_ble_addr_resolvable(p_dev_rec->bd_addr, p_target_rec)) {
+      if (p_dev_rec->ble_hci_handle == HCI_INVALID_HANDLE) {
+        LOG_INFO("already disconnected - erasing entry %s",
+                 PRIVATE_ADDRESS(p_dev_rec->bd_addr));
+        wipe_secrets_and_remove(p_dev_rec);
+        continue;
+      }
+
+      LOG_INFO(
+          "Found existing LE connection to just bonded device on %s handle 0x%04x",
+          PRIVATE_ADDRESS(p_dev_rec->bd_addr), p_dev_rec->ble_hci_handle);
+
+      RawAddress ble_conn_addr = p_dev_rec->bd_addr;
+      p_target_rec->ble_hci_handle = p_dev_rec->ble_hci_handle;
+
+      /* remove the old LE record */
+      wipe_secrets_and_remove(p_dev_rec);
+
+      /* To avoid race conditions between central/peripheral starting encryption
+       * at same time, initiate it just from central. */
+      if (L2CA_GetBleConnRole(ble_conn_addr) == HCI_ROLE_CENTRAL) {
+        LOG_INFO("Will encrypt existing connection");
+        BTM_SetEncryption(ble_conn_addr, BT_TRANSPORT_LE, nullptr, nullptr,
+                          BTM_BLE_SEC_ENCRYPT);
+      }
+    }
+  }
+}
+
 /*******************************************************************************
  *
  * Function         btm_find_or_alloc_dev
@@ -566,3 +650,25 @@
   p_dev_rec->bond_type = bond_type;
   return true;
 }
+
+/*******************************************************************************
+ *
+ * Function         btm_get_sec_dev_rec
+ *
+ * Description      Get security device records satisfying given filter
+ *
+ * Returns          A vector containing pointers of security device records
+ *
+ ******************************************************************************/
+std::vector<tBTM_SEC_DEV_REC*> btm_get_sec_dev_rec() {
+  std::vector<tBTM_SEC_DEV_REC*> result{};
+
+  list_node_t* end = list_end(btm_cb.sec_dev_rec);
+  for (list_node_t* node = list_begin(btm_cb.sec_dev_rec); node != end;
+       node = list_next(node)) {
+    tBTM_SEC_DEV_REC* p_dev_rec =
+        static_cast<tBTM_SEC_DEV_REC*>(list_node(node));
+    result.push_back(p_dev_rec);
+  }
+  return result;
+}
diff --git a/system/stack/btm/btm_dev.h b/system/stack/btm/btm_dev.h
index 9da2e89..84d73e7 100644
--- a/system/stack/btm/btm_dev.h
+++ b/system/stack/btm/btm_dev.h
@@ -14,6 +14,8 @@
  * limitations under the License.
  */
 
+#include <functional>
+
 #include "osi/include/log.h"
 #include "stack/btm/btm_ble_int.h"
 #include "stack/btm/security_device_record.h"
@@ -111,8 +113,20 @@
 
 /*******************************************************************************
  *
+ * Function         btm_find_dev_with_lenc
+ *
+ * Description      Look for the record in the device database with LTK and
+ *                  specified BD address
+ *
+ * Returns          Pointer to the record or NULL
+ *
+ ******************************************************************************/
+tBTM_SEC_DEV_REC* btm_find_dev_with_lenc(const RawAddress& bd_addr);
+
+/*******************************************************************************
+ *
  * Function         btm_consolidate_dev
-5**
+ *
  * Description      combine security records if identified as same peer
  *
  * Returns          none
@@ -122,6 +136,20 @@
 
 /*******************************************************************************
  *
+ * Function         btm_consolidate_dev
+ *
+ * Description      When pairing is finished (i.e. on BR/EDR), this function
+ *                  checks if there are existing LE connections to same device
+ *                  that can now be encrypted and used for profiles requiring
+ *                  encryption.
+ *
+ * Returns          none
+ *
+ ******************************************************************************/
+void btm_dev_consolidate_existing_connections(const RawAddress& bd_addr);
+
+/*******************************************************************************
+ *
  * Function         btm_find_or_alloc_dev
  *
  * Description      Look for the record in the device database for the record
@@ -171,3 +199,14 @@
  ******************************************************************************/
 bool btm_set_bond_type_dev(const RawAddress& bd_addr,
                            tBTM_SEC_DEV_REC::tBTM_BOND_TYPE bond_type);
+
+/*******************************************************************************
+ *
+ * Function         btm_get_sec_dev_rec
+ *
+ * Description      Get security device records satisfying given filter
+ *
+ * Returns          A vector containing pointers of security device records
+ *
+ ******************************************************************************/
+std::vector<tBTM_SEC_DEV_REC*> btm_get_sec_dev_rec();
diff --git a/system/stack/btm/btm_inq.cc b/system/stack/btm/btm_inq.cc
index f42b160..8cf637a 100644
--- a/system/stack/btm/btm_inq.cc
+++ b/system/stack/btm/btm_inq.cc
@@ -27,6 +27,7 @@
 
 #define LOG_TAG "bluetooth"
 
+#include <base/logging.h>
 #include <stddef.h>
 #include <stdio.h>
 #include <stdlib.h>
@@ -41,6 +42,7 @@
 #include "osi/include/log.h"
 #include "osi/include/osi.h"
 #include "stack/btm/btm_ble_int.h"
+#include "stack/btm/btm_dev.h"
 #include "stack/btm/btm_int_types.h"
 #include "stack/include/acl_api.h"
 #include "stack/include/bt_hdr.h"
@@ -50,8 +52,6 @@
 #include "types/bluetooth/uuid.h"
 #include "types/raw_address.h"
 
-#include <base/logging.h>
-
 namespace {
 constexpr char kBtmLogTag[] = "SCAN";
 }
@@ -498,17 +498,19 @@
  ******************************************************************************/
 tBTM_STATUS BTM_StartInquiry(tBTM_INQ_RESULTS_CB* p_results_cb,
                              tBTM_CMPL_CB* p_cmpl_cb) {
-  tBTM_INQUIRY_VAR_ST* p_inq = &btm_cb.btm_inq_vars;
-
   if (bluetooth::shim::is_gd_shim_enabled()) {
     return bluetooth::shim::BTM_StartInquiry(p_results_cb, p_cmpl_cb);
   }
 
   /* Only one active inquiry is allowed in this implementation.
      Also do not allow an inquiry if the inquiry filter is being updated */
-  if (p_inq->inq_active) {
-    LOG(ERROR) << __func__ << ": BTM_BUSY";
-    return (BTM_BUSY);
+  if (btm_cb.btm_inq_vars.inq_active) {
+    LOG_WARN(
+        "Active device discovery already in progress inq_active:0x%02x"
+        " state:%hhu counter:%u",
+        btm_cb.btm_inq_vars.inq_active, btm_cb.btm_inq_vars.state,
+        btm_cb.btm_inq_vars.inq_counter);
+    return BTM_BUSY;
   }
 
   /*** Make sure the device is ready ***/
@@ -521,6 +523,8 @@
 
   /* Save the inquiry parameters to be used upon the completion of
    * setting/clearing the inquiry filter */
+  tBTM_INQUIRY_VAR_ST* p_inq = &btm_cb.btm_inq_vars;
+
   p_inq->inqparms = {};
   p_inq->inqparms.mode = BTM_GENERAL_INQUIRY | BTM_BLE_GENERAL_INQUIRY;
   p_inq->inqparms.duration = BTIF_DM_DEFAULT_INQ_MAX_DURATION;
@@ -532,8 +536,8 @@
   p_inq->inq_cmpl_info.num_resp = 0; /* Clear the results counter */
   p_inq->inq_active = p_inq->inqparms.mode;
 
-  BTM_TRACE_DEBUG("BTM_StartInquiry: p_inq->inq_active = 0x%02x",
-                  p_inq->inq_active);
+  LOG_DEBUG("Starting device discovery inq_active:0x%02x",
+            btm_cb.btm_inq_vars.inq_active);
 
   if (controller_get_interface()->supports_ble()) {
     btm_ble_start_inquiry(p_inq->inqparms.duration);
@@ -640,6 +644,11 @@
     return (BTM_WRONG_MODE);
 }
 
+bool BTM_IsRemoteNameKnown(const RawAddress& bd_addr, tBT_TRANSPORT transport) {
+  tBTM_SEC_DEV_REC* p_dev_rec = btm_find_dev(bd_addr);
+  return (p_dev_rec == nullptr) ? false : p_dev_rec->is_name_known();
+}
+
 /*******************************************************************************
  *
  * Function         BTM_InqDbRead
@@ -755,7 +764,7 @@
  *
  ******************************************************************************/
 void btm_inq_db_reset(void) {
-  tBTM_REMOTE_DEV_NAME rem_name;
+  tBTM_REMOTE_DEV_NAME rem_name = {};
   tBTM_INQUIRY_VAR_ST* p_inq = &btm_cb.btm_inq_vars;
   uint8_t num_responses;
   uint8_t temp_inq_active;
@@ -785,6 +794,7 @@
 
     if (p_inq->p_remname_cmpl_cb) {
       rem_name.status = BTM_DEV_RESET;
+      rem_name.hci_status = HCI_SUCCESS;
 
       (*p_inq->p_remname_cmpl_cb)(&rem_name);
       p_inq->p_remname_cmpl_cb = NULL;
@@ -1074,7 +1084,6 @@
 
     constexpr uint16_t extended_inquiry_result_size = 254;
     if (hci_evt_len - 1 != extended_inquiry_result_size) {
-      android_errorWriteLog(0x534e4554, "141620271");
       BTM_TRACE_ERROR("%s: can't fit %d results in %d bytes", __func__,
                       num_resp, hci_evt_len);
       return;
@@ -1083,7 +1092,6 @@
              inq_res_mode == BTM_INQ_RESULT_WITH_RSSI) {
     constexpr uint16_t inquiry_result_size = 14;
     if (hci_evt_len < num_resp * inquiry_result_size) {
-      android_errorWriteLog(0x534e4554, "141620271");
       BTM_TRACE_ERROR("%s: can't fit %d results in %d bytes", __func__,
                       num_resp, hci_evt_len);
       return;
@@ -1440,6 +1448,7 @@
       rem_name.length = (evt_len < BD_NAME_LEN) ? evt_len : BD_NAME_LEN;
       rem_name.remote_bd_name[rem_name.length] = 0;
       rem_name.status = BTM_SUCCESS;
+      rem_name.hci_status = hci_status;
       temp_evt_len = rem_name.length;
 
       while (temp_evt_len > 0) {
@@ -1447,12 +1456,11 @@
         temp_evt_len--;
       }
       rem_name.remote_bd_name[rem_name.length] = 0;
-    }
-
-    /* If processing a stand alone remote name then report the error in the
-       callback */
-    else {
+    } else {
+      /* If processing a stand alone remote name then report the error in the
+         callback */
       rem_name.status = BTM_BAD_VALUE_RET;
+      rem_name.hci_status = hci_status;
       rem_name.length = 0;
       rem_name.remote_bd_name[0] = 0;
     }
diff --git a/system/stack/btm/btm_iso.cc b/system/stack/btm/btm_iso.cc
index 34bde1f..ab92e7a 100644
--- a/system/stack/btm/btm_iso.cc
+++ b/system/stack/btm/btm_iso.cc
@@ -71,8 +71,8 @@
   pimpl_->iso_impl_->reconfigure_cig(cig_id, std::move(cig_params));
 }
 
-void IsoManager::RemoveCig(uint8_t cig_id) {
-  pimpl_->iso_impl_->remove_cig(cig_id);
+void IsoManager::RemoveCig(uint8_t cig_id, bool force) {
+  pimpl_->iso_impl_->remove_cig(cig_id, force);
 }
 
 void IsoManager::EstablishCis(
diff --git a/system/stack/btm/btm_iso_impl.h b/system/stack/btm/btm_iso_impl.h
index 74ab5c6..9559e1d 100644
--- a/system/stack/btm/btm_iso_impl.h
+++ b/system/stack/btm/btm_iso_impl.h
@@ -25,6 +25,7 @@
 #include "base/callback.h"
 #include "base/logging.h"
 #include "bind_helpers.h"
+#include "btm_dev.h"
 #include "btm_iso_api.h"
 #include "common/time_util.h"
 #include "device/include/controller.h"
@@ -33,6 +34,7 @@
 #include "osi/include/allocator.h"
 #include "osi/include/log.h"
 #include "stack/include/bt_hdr.h"
+#include "stack/include/btm_log_history.h"
 #include "stack/include/hci_error_code.h"
 #include "stack/include/hcidefs.h"
 
@@ -49,6 +51,8 @@
 static constexpr uint8_t kStateFlagHasDataPathSet = 0x04;
 static constexpr uint8_t kStateFlagIsBroadcast = 0x10;
 
+constexpr char kBtmLogTag[] = "ISO";
+
 struct iso_sync_info {
   uint32_t first_sync_ts;
   uint16_t seq_nb;
@@ -118,6 +122,12 @@
     uint8_t evt_code = IsCigKnown(cig_id) ? kIsoEventCigOnReconfigureCmpl
                                           : kIsoEventCigOnCreateCmpl;
 
+    BTM_LogHistory(
+        kBtmLogTag, RawAddress::kEmpty, "CIG Create complete",
+        base::StringPrintf(
+            "cig_id:0x%02x, status: %s", evt.cig_id,
+            hci_status_code_text((tHCI_STATUS)(evt.status)).c_str()));
+
     if (evt.status == HCI_SUCCESS) {
       LOG_ASSERT(len >= (3) + (cis_cnt * sizeof(uint16_t)))
           << "Invalid CIS count: " << +cis_cnt;
@@ -164,6 +174,11 @@
         cig_params.cis_cfgs.size(), cig_params.cis_cfgs.data(),
         base::BindOnce(&iso_impl::on_set_cig_params, base::Unretained(this),
                        cig_id, cig_params.sdu_itv_mtos));
+
+    BTM_LogHistory(
+        kBtmLogTag, RawAddress::kEmpty, "CIG Create",
+        base::StringPrintf("cig_id:0x%02x, size: %d", cig_id,
+                           static_cast<int>(cig_params.cis_cfgs.size())));
   }
 
   void reconfigure_cig(uint8_t cig_id,
@@ -188,6 +203,12 @@
     STREAM_TO_UINT8(evt.status, stream);
     STREAM_TO_UINT8(evt.cig_id, stream);
 
+    BTM_LogHistory(
+        kBtmLogTag, RawAddress::kEmpty, "CIG Remove complete",
+        base::StringPrintf(
+            "cig_id:0x%02x, status: %s", evt.cig_id,
+            hci_status_code_text((tHCI_STATUS)(evt.status)).c_str()));
+
     if (evt.status == HCI_SUCCESS) {
       auto cis_it = conn_hdl_to_cis_map_.cbegin();
       while (cis_it != conn_hdl_to_cis_map_.cend()) {
@@ -201,11 +222,17 @@
     cig_callbacks_->OnCigEvent(kIsoEventCigOnRemoveCmpl, &evt);
   }
 
-  void remove_cig(uint8_t cig_id) {
-    LOG_ASSERT(IsCigKnown(cig_id)) << "No such cig: " << +cig_id;
+  void remove_cig(uint8_t cig_id, bool force) {
+    if (!force) {
+      LOG_ASSERT(IsCigKnown(cig_id)) << "No such cig: " << +cig_id;
+    } else {
+      LOG_WARN("Forcing to remove CIG %d", cig_id);
+    }
 
     btsnd_hcic_remove_cig(cig_id, base::BindOnce(&iso_impl::on_remove_cig,
                                                  base::Unretained(this)));
+    BTM_LogHistory(kBtmLogTag, RawAddress::kEmpty, "CIG Remove",
+                   base::StringPrintf("cig_id:0x%02x (f:%d)", cig_id, force));
   }
 
   void on_status_establish_cis(
@@ -230,6 +257,14 @@
         evt.cig_id = 0xFF;
         cis->state_flags &= ~kStateFlagIsConnecting;
         cig_callbacks_->OnCisEvent(kIsoEventCisEstablishCmpl, &evt);
+
+        BTM_LogHistory(
+            kBtmLogTag, cis_hdl_to_addr[evt.cis_conn_hdl],
+            "Establish CIS failed ",
+            base::StringPrintf(
+                "handle:0x%04x, status: %s", evt.cis_conn_hdl,
+                hci_status_code_text((tHCI_STATUS)(status)).c_str()));
+        cis_hdl_to_addr.erase(evt.cis_conn_hdl);
       }
     }
   }
@@ -242,6 +277,13 @@
                    (kStateFlagIsConnected | kStateFlagIsConnecting)))
           << "Already connected or connecting";
       cis->state_flags |= kStateFlagIsConnecting;
+
+      tBTM_SEC_DEV_REC* p_rec = btm_find_dev_by_handle(el.acl_conn_handle);
+      if (p_rec) {
+        cis_hdl_to_addr[el.cis_conn_handle] = p_rec->ble.pseudo_addr;
+        BTM_LogHistory(kBtmLogTag, p_rec->ble.pseudo_addr, "Establish CIS",
+                       base::StringPrintf("handle:0x%04x", el.acl_conn_handle));
+      }
     }
     btsnd_hcic_create_cis(conn_params.conn_pairs.size(),
                           conn_params.conn_pairs.data(),
@@ -257,6 +299,11 @@
         << "Not connected";
     bluetooth::legacy::hci::GetInterface().Disconnect(
         cis_handle, static_cast<tHCI_STATUS>(reason));
+
+    BTM_LogHistory(kBtmLogTag, cis_hdl_to_addr[cis_handle], "Disconnect CIS ",
+                   base::StringPrintf(
+                       "handle:0x%04x, reason:%s", cis_handle,
+                       hci_reason_code_text((tHCI_REASON)(reason)).c_str()));
   }
 
   void on_setup_iso_data_path(uint8_t* stream, uint16_t len) {
@@ -274,6 +321,12 @@
       return;
     }
 
+    BTM_LogHistory(kBtmLogTag, cis_hdl_to_addr[conn_handle],
+                   "Setup data path complete",
+                   base::StringPrintf(
+                       "handle:0x%04x, status:%s", conn_handle,
+                       hci_status_code_text((tHCI_STATUS)(status)).c_str()));
+
     if (status == HCI_SUCCESS) iso->state_flags |= kStateFlagHasDataPathSet;
     if (iso->state_flags & kStateFlagIsBroadcast) {
       LOG_ASSERT(big_callbacks_ != nullptr) << "Invalid BIG callbacks";
@@ -302,6 +355,12 @@
         std::move(path_params.codec_conf),
         base::BindOnce(&iso_impl::on_setup_iso_data_path,
                        base::Unretained(this)));
+    BTM_LogHistory(
+        kBtmLogTag, cis_hdl_to_addr[conn_handle], "Setup data path",
+        base::StringPrintf(
+            "handle:0x%04x, dir:0x%02x, path_id:0x%02x, codec_id:0x%02x",
+            conn_handle, path_params.data_path_dir, path_params.data_path_id,
+            path_params.codec_id_format));
   }
 
   void on_remove_iso_data_path(uint8_t* stream, uint16_t len) {
@@ -323,6 +382,12 @@
       return;
     }
 
+    BTM_LogHistory(kBtmLogTag, cis_hdl_to_addr[conn_handle],
+                   "Remove data path complete",
+                   base::StringPrintf(
+                       "handle:0x%04x, status:%s", conn_handle,
+                       hci_status_code_text((tHCI_STATUS)(status)).c_str()));
+
     if (status == HCI_SUCCESS) iso->state_flags &= ~kStateFlagHasDataPathSet;
 
     if (iso->state_flags & kStateFlagIsBroadcast) {
@@ -345,6 +410,9 @@
         iso_handle, data_path_dir,
         base::BindOnce(&iso_impl::on_remove_iso_data_path,
                        base::Unretained(this)));
+    BTM_LogHistory(kBtmLogTag, cis_hdl_to_addr[iso_handle], "Remove data path",
+                   base::StringPrintf("handle:0x%04x, dir:0x%02x", iso_handle,
+                                      data_path_dir));
   }
 
   void on_iso_link_quality_read(uint8_t* stream, uint16_t len) {
@@ -498,6 +566,12 @@
     auto cis = GetCisIfKnown(evt.cis_conn_hdl);
     LOG_ASSERT(cis != nullptr) << "No such cis: " << +evt.cis_conn_hdl;
 
+    BTM_LogHistory(kBtmLogTag, cis_hdl_to_addr[evt.cis_conn_hdl],
+                   "CIS established event",
+                   base::StringPrintf(
+                       "cis_handle:0x%04x status:%s", evt.cis_conn_hdl,
+                       hci_error_code_text((tHCI_STATUS)(evt.status)).c_str()));
+
     cis->sync_info.first_sync_ts = bluetooth::common::time_get_os_boottime_us();
 
     STREAM_TO_UINT24(evt.cig_sync_delay, data);
@@ -515,7 +589,11 @@
     STREAM_TO_UINT16(evt.max_pdu_stom, data);
     STREAM_TO_UINT16(evt.iso_itv, data);
 
-    if (evt.status == HCI_SUCCESS) cis->state_flags |= kStateFlagIsConnected;
+    if (evt.status == HCI_SUCCESS) {
+      cis->state_flags |= kStateFlagIsConnected;
+    } else {
+      cis_hdl_to_addr.erase(evt.cis_conn_hdl);
+    }
 
     cis->state_flags &= ~kStateFlagIsConnecting;
 
@@ -531,6 +609,13 @@
     LOG_ASSERT(cig_callbacks_ != nullptr) << "Invalid CIG callbacks";
 
     LOG_INFO("%s flags: %d", __func__, +cis->state_flags);
+
+    BTM_LogHistory(
+        kBtmLogTag, cis_hdl_to_addr[handle], "CIS disconnected",
+        base::StringPrintf("cis_handle:0x%04x, reason:%s", handle,
+                           hci_error_code_text((tHCI_REASON)(reason)).c_str()));
+    cis_hdl_to_addr.erase(handle);
+
     if (cis->state_flags & kStateFlagIsConnected) {
       cis_disconnected_evt evt = {
           .reason = reason,
@@ -877,6 +962,7 @@
 
   std::map<uint16_t, std::unique_ptr<iso_cis>> conn_hdl_to_cis_map_;
   std::map<uint16_t, std::unique_ptr<iso_bis>> conn_hdl_to_bis_map_;
+  std::map<uint16_t, RawAddress> cis_hdl_to_addr;
 
   std::atomic_uint16_t iso_credits_;
   uint16_t iso_buffer_size_;
diff --git a/system/stack/btm/btm_sco.h b/system/stack/btm/btm_sco.h
index 8e85f1d..a598f22 100644
--- a/system/stack/btm/btm_sco.h
+++ b/system/stack/btm/btm_sco.h
@@ -54,6 +54,13 @@
 /* Define the structures needed by sco
  */
 
+#ifndef CASE_RETURN_TEXT
+#define CASE_RETURN_TEXT(code) \
+  case code:                   \
+    return #code
+#endif
+
+/* Define the structures needed by sco */
 typedef enum : uint16_t {
   SCO_ST_UNUSED = 0,
   SCO_ST_LISTENING = 1,
@@ -68,27 +75,23 @@
 
 inline std::string sco_state_text(const tSCO_STATE& state) {
   switch (state) {
-    case SCO_ST_UNUSED:
-      return std::string("unused");
-    case SCO_ST_LISTENING:
-      return std::string("listening");
-    case SCO_ST_W4_CONN_RSP:
-      return std::string("connect_response");
-    case SCO_ST_CONNECTING:
-      return std::string("connecting");
-    case SCO_ST_CONNECTED:
-      return std::string("connected");
-    case SCO_ST_DISCONNECTING:
-      return std::string("disconnecting");
-    case SCO_ST_PEND_UNPARK:
-      return std::string("pending_unpark");
-    case SCO_ST_PEND_ROLECHANGE:
-      return std::string("pending_role_change");
-    case SCO_ST_PEND_MODECHANGE:
-      return std::string("pending_mode_change");
+    CASE_RETURN_TEXT(SCO_ST_UNUSED);
+    CASE_RETURN_TEXT(SCO_ST_LISTENING);
+    CASE_RETURN_TEXT(SCO_ST_W4_CONN_RSP);
+    CASE_RETURN_TEXT(SCO_ST_CONNECTING);
+    CASE_RETURN_TEXT(SCO_ST_CONNECTED);
+    CASE_RETURN_TEXT(SCO_ST_DISCONNECTING);
+    CASE_RETURN_TEXT(SCO_ST_PEND_UNPARK);
+    CASE_RETURN_TEXT(SCO_ST_PEND_ROLECHANGE);
+    CASE_RETURN_TEXT(SCO_ST_PEND_MODECHANGE);
+    default:
+      return std::string("unknown_sco_state: ") +
+             std::to_string(static_cast<uint16_t>(state));
   }
 }
 
+#undef CASE_RETURN_TEXT
+
 /* Define the structure that contains (e)SCO data */
 typedef struct {
   tBTM_ESCO_CBACK* p_esco_cback; /* Callback for eSCO events     */
diff --git a/system/stack/btm/btm_sec.cc b/system/stack/btm/btm_sec.cc
index ec30e0e..22d4ad4 100644
--- a/system/stack/btm/btm_sec.cc
+++ b/system/stack/btm/btm_sec.cc
@@ -44,6 +44,7 @@
 #include "osi/include/compat.h"
 #include "osi/include/log.h"
 #include "osi/include/osi.h"
+#include "osi/include/properties.h"
 #include "stack/btm/btm_dev.h"
 #include "stack/btm/security_device_record.h"
 #include "stack/eatt/eatt.h"
@@ -153,6 +154,14 @@
   }
 }
 
+static bool concurrentPeerAuthIsEnabled() {
+  // Was previously named BTM_DISABLE_CONCURRENT_PEER_AUTH.
+  // Renamed to ENABLED for homogeneity with system properties
+  static const bool sCONCURRENT_PEER_AUTH_IS_ENABLED = osi_property_get_bool(
+      "bluetooth.btm.sec.concurrent_peer_auth.enabled", true);
+  return sCONCURRENT_PEER_AUTH_IS_ENABLED;
+}
+
 void NotifyBondingCanceled(tBTM_STATUS btm_status) {
   if (btm_cb.api.p_bond_cancel_cmpl_callback) {
     btm_cb.api.p_bond_cancel_cmpl_callback(BTM_SUCCESS);
@@ -3310,6 +3319,13 @@
   if (status == HCI_SUCCESS) {
     if (encr_enable) {
       if (p_dev_rec->hci_handle == handle) {  // classic
+        if ((p_dev_rec->sec_flags & BTM_SEC_AUTHENTICATED) &&
+            (p_dev_rec->sec_flags & BTM_SEC_ENCRYPTED)) {
+          LOG_INFO(
+              "Link is authenticated & encrypted, ignoring this enc change "
+              "event");
+          return;
+        }
         p_dev_rec->sec_flags |= (BTM_SEC_AUTHENTICATED | BTM_SEC_ENCRYPTED);
         if (p_dev_rec->pin_code_length >= 16 ||
             p_dev_rec->link_key_type == BTM_LKEY_TYPE_AUTH_COMB ||
@@ -3399,11 +3415,9 @@
                       __func__, p_dev_rec, p_dev_rec->p_callback);
       p_dev_rec->p_callback = NULL;
       l2cu_resubmit_pending_sec_req(&p_dev_rec->bd_addr);
-#ifdef BTM_DISABLE_CONCURRENT_PEER_AUTH
-    } else if (BTM_DISABLE_CONCURRENT_PEER_AUTH &&
+    } else if (!concurrentPeerAuthIsEnabled() &&
                p_dev_rec->sec_state == BTM_SEC_STATE_AUTHENTICATING) {
       p_dev_rec->sec_state = BTM_SEC_STATE_IDLE;
-#endif
     }
     return;
   }
@@ -3764,7 +3778,7 @@
 void btm_sec_disconnected(uint16_t handle, tHCI_REASON reason,
                           std::string comment) {
   if ((reason != HCI_ERR_CONN_CAUSE_LOCAL_HOST) &&
-      (reason != HCI_ERR_PEER_USER)) {
+      (reason != HCI_ERR_PEER_USER) && (reason != HCI_ERR_REMOTE_POWER_OFF)) {
     LOG_WARN("Got uncommon disconnection reason:%s handle:0x%04x comment:%s",
              hci_error_code_text(reason).c_str(), handle, comment.c_str());
   }
@@ -3857,7 +3871,6 @@
    * disconnection.
    */
   if (is_sample_ltk(p_dev_rec->ble.keys.pltk)) {
-    android_errorWriteLog(0x534e4554, "128437297");
     LOG(INFO) << __func__ << " removing bond to device that used sample LTK: "
               << p_dev_rec->bd_addr;
 
@@ -3955,9 +3968,9 @@
     if (btm_cb.api.p_link_key_callback) {
       BTM_TRACE_DEBUG("%s() Save LTK derived LK (key_type = %d)", __func__,
                       p_dev_rec->link_key_type);
-      (*btm_cb.api.p_link_key_callback)(p_bda, p_dev_rec->dev_class,
-                                        p_dev_rec->sec_bd_name, link_key,
-                                        p_dev_rec->link_key_type);
+      (*btm_cb.api.p_link_key_callback)(
+          p_bda, p_dev_rec->dev_class, p_dev_rec->sec_bd_name, link_key,
+          p_dev_rec->link_key_type, true /* is_ctkd */);
     }
   } else {
     if ((p_dev_rec->link_key_type == BTM_LKEY_TYPE_UNAUTH_COMB_P_256) ||
@@ -4005,9 +4018,9 @@
             " (key_type = %d)",
             p_dev_rec->link_key_type);
       } else {
-        (*btm_cb.api.p_link_key_callback)(p_bda, p_dev_rec->dev_class,
-                                          p_dev_rec->sec_bd_name, link_key,
-                                          p_dev_rec->link_key_type);
+        (*btm_cb.api.p_link_key_callback)(
+            p_bda, p_dev_rec->dev_class, p_dev_rec->sec_bd_name, link_key,
+            p_dev_rec->link_key_type, false /* is_ctkd */);
       }
     }
   }
@@ -4029,10 +4042,9 @@
   tBTM_SEC_DEV_REC* p_dev_rec = btm_find_or_alloc_dev(bda);
 
   VLOG(2) << __func__ << " bda: " << bda;
-#if (defined(BTM_DISABLE_CONCURRENT_PEER_AUTH) && \
-     (BTM_DISABLE_CONCURRENT_PEER_AUTH == TRUE))
-  p_dev_rec->sec_state = BTM_SEC_STATE_AUTHENTICATING;
-#endif
+  if (!concurrentPeerAuthIsEnabled()) {
+    p_dev_rec->sec_state = BTM_SEC_STATE_AUTHENTICATING;
+  }
 
   if ((btm_cb.pairing_state == BTM_PAIR_STATE_WAIT_PIN_REQ) &&
       (btm_cb.collision_start_time != 0) &&
@@ -4190,7 +4202,6 @@
 
   RawAddress local_bd_addr = *controller_get_interface()->get_address();
   if (p_bda == local_bd_addr) {
-    android_errorWriteLog(0x534e4554, "174626251");
     btsnd_hcic_pin_code_neg_reply(p_bda);
     return;
   }
@@ -4491,14 +4502,17 @@
  *
  ******************************************************************************/
 static void btm_sec_wait_and_start_authentication(tBTM_SEC_DEV_REC* p_dev_rec) {
-  p_dev_rec->sec_state = BTM_SEC_STATE_AUTHENTICATING;
   auto addr = new RawAddress(p_dev_rec->bd_addr);
+
+  static const int32_t delay_auth =
+      osi_property_get_int32("bluetooth.btm.sec.delay_auth_ms.value", 0);
+
   bt_status_t status = do_in_main_thread_delayed(
       FROM_HERE, base::Bind(&btm_sec_auth_timer_timeout, addr),
 #if BASE_VER < 931007
-      base::TimeDelta::FromMilliseconds(BTM_DELAY_AUTH_MS));
+      base::TimeDelta::FromMilliseconds(delay_auth));
 #else
-      base::Milliseconds(BTM_DELAY_AUTH_MS));
+      base::Milliseconds(delay_auth));
 #endif
   if (status != BT_STATUS_SUCCESS) {
     LOG(ERROR) << __func__
@@ -4522,8 +4536,11 @@
     LOG_INFO("%s: invalid device or not found", __func__);
   } else if (btm_dev_authenticated(p_dev_rec)) {
     LOG_INFO("%s: device is already authenticated", __func__);
+  } else if (p_dev_rec->sec_state == BTM_SEC_STATE_AUTHENTICATING) {
+    LOG_INFO("%s: device is in the process of authenticating", __func__);
   } else {
     LOG_INFO("%s: starting authentication", __func__);
+    p_dev_rec->sec_state = BTM_SEC_STATE_AUTHENTICATING;
     btsnd_hcic_auth_request(p_dev_rec->hci_handle);
   }
 }
@@ -4593,7 +4610,7 @@
   if (btm_cb.api.p_link_key_callback)
     (*btm_cb.api.p_link_key_callback)(
         p_dev_rec->bd_addr, p_dev_rec->dev_class, p_dev_rec->sec_bd_name,
-        p_dev_rec->link_key, p_dev_rec->link_key_type);
+        p_dev_rec->link_key, p_dev_rec->link_key_type, false);
 }
 
 /*******************************************************************************
@@ -4759,7 +4776,8 @@
 
   if (btm_status == BTM_SUCCESS && is_le_transport) {
     /* Link is encrypted, start EATT */
-    bluetooth::eatt::EattExtension::GetInstance()->Connect(p_dev_rec->bd_addr);
+    bluetooth::eatt::EattExtension::GetInstance()->Connect(
+        p_dev_rec->ble.pseudo_addr);
   }
 }
 
diff --git a/system/stack/btm/neighbor_inquiry.h b/system/stack/btm/neighbor_inquiry.h
index be8231f..d03ea08 100644
--- a/system/stack/btm/neighbor_inquiry.h
+++ b/system/stack/btm/neighbor_inquiry.h
@@ -116,6 +116,8 @@
   uint8_t ble_advertising_sid;
   int8_t ble_tx_power;
   uint16_t ble_periodic_adv_int;
+  RawAddress ble_ad_rsi; /* Resolvable Set Identifier from advertising */
+  bool ble_ad_is_le_audio_capable;
   uint8_t flag;
   bool include_rsi;
   RawAddress original_bda;
@@ -241,10 +243,11 @@
 
 /* Structure returned with remote name  request */
 typedef struct {
-  uint16_t status;
+  tBTM_STATUS status;
   RawAddress bd_addr;
   uint16_t length;
   BD_NAME remote_bd_name;
+  tHCI_STATUS hci_status;
 } tBTM_REMOTE_DEV_NAME;
 
 typedef union /* contains the inquiry filter condition */
diff --git a/system/stack/btu/btu_hcif.cc b/system/stack/btu/btu_hcif.cc
index 97e8a88..ec05df2 100644
--- a/system/stack/btu/btu_hcif.cc
+++ b/system/stack/btu/btu_hcif.cc
@@ -282,9 +282,6 @@
     case HCI_HARDWARE_ERROR_EVT:
       btu_hcif_hardware_error_evt(p);
       break;
-    case HCI_NUM_COMPL_DATA_PKTS_EVT:
-      acl_process_num_completed_pkts(p, hci_evt_len);
-      break;
     case HCI_MODE_CHANGE_EVT:
       btu_hcif_mode_change_evt(p);
       break;
@@ -423,6 +420,7 @@
       break;
 
       // Events now captured by gd::hci_layer module
+    case HCI_NUM_COMPL_DATA_PKTS_EVT:  // EventCode::NUMBER_OF_COMPLETED_PACKETS
     case HCI_CONNECTION_COMP_EVT:  // EventCode::CONNECTION_COMPLETE
     case HCI_READ_RMT_FEATURES_COMP_EVT:  // EventCode::READ_REMOTE_SUPPORTED_FEATURES_COMPLETE
     case HCI_READ_RMT_VERSION_COMP_EVT:  // EventCode::READ_REMOTE_VERSION_INFORMATION_COMPLETE
@@ -1027,7 +1025,6 @@
   }
 
   if (key_size < MIN_KEY_SIZE) {
-    android_errorWriteLog(0x534e4554, "124301137");
     LOG(ERROR) << __func__ << " encryption key too short, disconnecting. handle: " << loghex(handle)
                << " key_size: " << +key_size;
 
@@ -1602,7 +1599,6 @@
   }
 
   if (key_size < MIN_KEY_SIZE) {
-    android_errorWriteLog(0x534e4554, "124301137");
     LOG(ERROR) << __func__ << " encryption key too short, disconnecting. handle: " << loghex(handle)
                << " key_size: " << +key_size;
 
diff --git a/system/stack/eatt/eatt.cc b/system/stack/eatt/eatt.cc
index a023026..8e88be9 100644
--- a/system/stack/eatt/eatt.cc
+++ b/system/stack/eatt/eatt.cc
@@ -175,7 +175,7 @@
   return pimpl_->eatt_impl_->is_outstanding_msg_in_send_queue(bd_addr);
 }
 
-EattChannel* EattExtension::GetChannelWithQueuedData(
+EattChannel* EattExtension::GetChannelWithQueuedDataToSend(
     const RawAddress& bd_addr) {
   return pimpl_->eatt_impl_->get_channel_with_queued_data(bd_addr);
 }
diff --git a/system/stack/eatt/eatt.h b/system/stack/eatt/eatt.h
index 828d17a..6ef3d33 100644
--- a/system/stack/eatt/eatt.h
+++ b/system/stack/eatt/eatt.h
@@ -17,7 +17,7 @@
 
 #pragma once
 
-#include <queue>
+#include <deque>
 
 #include "stack/gatt/gatt_int.h"
 #include "types/raw_address.h"
@@ -54,7 +54,7 @@
   /* indication confirmation timer */
   alarm_t* ind_confirmation_timer_;
   /* GATT client command queue */
-  std::queue<tGATT_CMD_Q> cl_cmd_q_;
+  std::deque<tGATT_CMD_Q> cl_cmd_q_;
 
   EattChannel(RawAddress& bda, uint16_t cid, uint16_t tx_mtu, uint16_t rx_mtu)
       : bda_(bda),
@@ -64,7 +64,9 @@
         state_(EattChannelState::EATT_CHANNEL_PENDING),
         indicate_handle_(0),
         ind_ack_timer_(NULL),
-        ind_confirmation_timer_(NULL) {}
+        ind_confirmation_timer_(NULL) {
+    cl_cmd_q_ = std::deque<tGATT_CMD_Q>();
+  }
 
   ~EattChannel() {
     if (ind_ack_timer_ != NULL) {
@@ -79,7 +81,6 @@
   void EattChannelSetState(EattChannelState state) {
     if (state_ == EattChannelState::EATT_CHANNEL_PENDING) {
       if (state == EattChannelState::EATT_CHANNEL_OPENED) {
-        cl_cmd_q_ = std::queue<tGATT_CMD_Q>();
         memset(&server_outstanding_cmd_, 0, sizeof(tGATT_SR_CMD));
         char name[64];
         sprintf(name, "eatt_ind_ack_timer_%s_cid_0x%04x",
@@ -224,7 +225,8 @@
    *
    * @return pointer to EATT channel.
    */
-  virtual EattChannel* GetChannelWithQueuedData(const RawAddress& bd_addr);
+  virtual EattChannel* GetChannelWithQueuedDataToSend(
+      const RawAddress& bd_addr);
 
   /**
    * Get EATT channel available to send GATT request.
diff --git a/system/stack/eatt/eatt_impl.h b/system/stack/eatt/eatt_impl.h
index 0a2c2af..998fc10 100644
--- a/system/stack/eatt/eatt_impl.h
+++ b/system/stack/eatt/eatt_impl.h
@@ -93,6 +93,15 @@
     return (it == eatt_dev->eatt_channels.end()) ? nullptr : it->second.get();
   }
 
+  bool is_channel_connection_pending(eatt_device* eatt_dev) {
+    for (const std::pair<uint16_t, std::shared_ptr<EattChannel>>& el :
+         eatt_dev->eatt_channels) {
+      if (el.second->state_ == EattChannelState::EATT_CHANNEL_PENDING)
+        return true;
+    }
+    return false;
+  }
+
   EattChannel* find_channel_by_cid(const RawAddress& bdaddr, uint16_t lcid) {
     eatt_device* eatt_dev = find_device_by_address(bdaddr);
     if (!eatt_dev) return nullptr;
@@ -102,6 +111,13 @@
   }
 
   void remove_channel_by_cid(eatt_device* eatt_dev, uint16_t lcid) {
+    auto channel = eatt_dev->eatt_channels[lcid];
+    if (!channel->cl_cmd_q_.empty()) {
+      LOG_WARN("Channel %c, for device %s is not empty on disconnection.", lcid,
+               channel->bda_.ToString().c_str());
+      channel->cl_cmd_q_.clear();
+    }
+
     eatt_dev->eatt_channels.erase(lcid);
 
     if (eatt_dev->eatt_channels.size() == 0) eatt_dev->eatt_tcb_ = NULL;
@@ -114,23 +130,9 @@
     remove_channel_by_cid(eatt_dev, lcid);
   }
 
-  void eatt_l2cap_connect_ind(const RawAddress& bda,
-                              std::vector<uint16_t>& lcids, uint16_t psm,
-                              uint16_t peer_mtu, uint8_t identifier) {
-    if (!stack_config_get_interface()
-             ->get_pts_connect_eatt_before_encryption() &&
-        !BTM_IsEncrypted(bda, BT_TRANSPORT_LE)) {
-      /* If Link is not encrypted, we shall not accept EATT channel creation. */
-      std::vector<uint16_t> empty;
-      uint16_t result = L2CAP_LE_RESULT_INSUFFICIENT_AUTHENTICATION;
-      if (BTM_IsLinkKeyKnown(bda, BT_TRANSPORT_LE)) {
-        result = L2CAP_LE_RESULT_INSUFFICIENT_ENCRYP;
-      }
-      LOG_ERROR("ACL to device %s is unencrypted.", bda.ToString().c_str());
-      L2CA_ConnectCreditBasedRsp(bda, identifier, empty, result, nullptr);
-      return;
-    }
-
+  bool eatt_l2cap_connect_ind_common(const RawAddress& bda,
+                                     std::vector<uint16_t>& lcids, uint16_t psm,
+                                     uint16_t peer_mtu, uint8_t identifier) {
     /* The assumption is that L2CAP layer already check parameters etc.
      * Get our capabilities and accept all the channels.
      */
@@ -151,11 +153,12 @@
     tL2CAP_LE_CFG_INFO local_coc_cfg = {
         .mtu = eatt_dev->rx_mtu_,
         .mps = eatt_dev->rx_mps_ < max_mps ? eatt_dev->rx_mps_ : max_mps,
-        .credits = L2CAP_LE_CREDIT_DEFAULT};
+        .credits = L2CA_LeCreditDefault(),
+    };
 
     if (!L2CA_ConnectCreditBasedRsp(bda, identifier, lcids, L2CAP_CONN_OK,
                                     &local_coc_cfg))
-      return;
+      return false;
 
     if (!eatt_dev->eatt_tcb_) {
       eatt_dev->eatt_tcb_ =
@@ -177,13 +180,159 @@
       LOG(INFO) << __func__ << " Channel connected CID " << loghex(cid);
     }
 
+    return true;
+  }
+
+  /* This is for the L2CAP ECoC Testing. */
+  void upper_tester_send_data_if_needed(const RawAddress& bda,
+                                        uint16_t cid = 0) {
+    eatt_device* eatt_dev = find_device_by_address(bda);
+    auto num_of_sdu =
+        stack_config_get_interface()->get_pts_l2cap_ecoc_send_num_of_sdu();
+    LOG_INFO(" device %s, num: %d", eatt_dev->bda_.ToString().c_str(),
+             num_of_sdu);
+
+    if (num_of_sdu <= 0) {
+      return;
+    }
+
+    uint16_t mtu = 0;
+    if (cid != 0) {
+      auto chan = find_channel_by_cid(cid);
+      mtu = chan->tx_mtu_;
+    } else {
+      for (const std::pair<uint16_t, std::shared_ptr<EattChannel>>& el :
+           eatt_dev->eatt_channels) {
+        if (el.second->state_ == EattChannelState::EATT_CHANNEL_OPENED) {
+          cid = el.first;
+          mtu = el.second->tx_mtu_;
+          break;
+        }
+      }
+    }
+
+    if (cid == 0 || mtu == 0) {
+      LOG_ERROR("There is no OPEN cid or MTU is 0");
+      return;
+    }
+
+    for (int i = 0; i < num_of_sdu; i++) {
+      BT_HDR* p_buf = (BT_HDR*)osi_malloc(mtu + sizeof(BT_HDR));
+      p_buf->offset = L2CAP_MIN_OFFSET;
+      p_buf->len = mtu;
+
+      auto status = L2CA_DataWrite(cid, p_buf);
+      LOG_INFO("Data num: %d sent with status %d", i, static_cast<int>(status));
+    }
+  }
+
+  /* This is for the L2CAP ECoC Testing. */
+  void upper_tester_delay_connect_cb(const RawAddress& bda) {
+    LOG_INFO("device %s", bda.ToString().c_str());
+    eatt_device* eatt_dev = find_device_by_address(bda);
+    if (eatt_dev == nullptr) {
+      LOG_ERROR(" device is not available");
+      return;
+    }
+
+    connect_eatt_wrap(eatt_dev);
+  }
+
+  void upper_tester_delay_connect(const RawAddress& bda, int timeout_ms) {
+    bt_status_t status = do_in_main_thread_delayed(
+        FROM_HERE,
+        base::BindOnce(&eatt_impl::upper_tester_delay_connect_cb,
+                       base::Unretained(this), bda),
+#if BASE_VER < 931007
+        base::TimeDelta::FromMilliseconds(timeout_ms)
+#else
+        base::Milliseconds(timeout_ms)
+#endif
+    );
+
+    LOG_INFO("Scheduled peripheral connect eatt for device with status: %d",
+             (int)status);
+  }
+
+  void upper_tester_l2cap_connect_ind(const RawAddress& bda,
+                                      std::vector<uint16_t>& lcids,
+                                      uint16_t psm, uint16_t peer_mtu,
+                                      uint8_t identifier) {
+    /* This is just for L2CAP PTS test cases*/
+    auto min_key_size =
+        stack_config_get_interface()->get_pts_l2cap_ecoc_min_key_size();
+    if (min_key_size > 0 && (min_key_size >= 7 && min_key_size <= 16)) {
+      auto key_size = btm_ble_read_sec_key_size(bda);
+      if (key_size < min_key_size) {
+        std::vector<uint16_t> empty;
+        LOG_ERROR("Insufficient key size (%d<%d) for device %s", key_size,
+                  min_key_size, bda.ToString().c_str());
+        L2CA_ConnectCreditBasedRsp(bda, identifier, empty,
+                                   L2CAP_LE_RESULT_INSUFFICIENT_ENCRYP_KEY_SIZE,
+                                   nullptr);
+        return;
+      }
+    }
+
+    if (!eatt_l2cap_connect_ind_common(bda, lcids, psm, peer_mtu, identifier)) {
+      LOG_DEBUG("Reject L2CAP Connection request.");
+      return;
+    }
+
     /* Android let Central to create EATT (PTS initiates EATT). Some PTS test
      * cases wants Android to do it anyway (Android initiates EATT).
      */
     if (stack_config_get_interface()
             ->get_pts_eatt_peripheral_collision_support()) {
-      connect_eatt_wrap(eatt_dev);
+      upper_tester_delay_connect(bda, 500);
+      return;
     }
+
+    upper_tester_send_data_if_needed(bda);
+
+    if (stack_config_get_interface()->get_pts_l2cap_ecoc_reconfigure()) {
+      bt_status_t status = do_in_main_thread_delayed(
+          FROM_HERE,
+          base::BindOnce(&eatt_impl::reconfigure_all, base::Unretained(this),
+                         bda, 300),
+#if BASE_VER < 931007
+          base::TimeDelta::FromMilliseconds(4000)
+#else
+          base::Milliseconds(4000)
+#endif
+      );
+      LOG_INFO("Scheduled ECOC reconfiguration with status: %d", (int)status);
+    }
+  }
+
+  void eatt_l2cap_connect_ind(const RawAddress& bda,
+                              std::vector<uint16_t>& lcids, uint16_t psm,
+                              uint16_t peer_mtu, uint8_t identifier) {
+    LOG_INFO("Device %s, num of cids: %d, psm 0x%04x, peer_mtu %d",
+             bda.ToString().c_str(), static_cast<int>(lcids.size()), psm,
+             peer_mtu);
+
+    if (!stack_config_get_interface()
+             ->get_pts_connect_eatt_before_encryption() &&
+        !BTM_IsEncrypted(bda, BT_TRANSPORT_LE)) {
+      /* If Link is not encrypted, we shall not accept EATT channel creation. */
+      std::vector<uint16_t> empty;
+      uint16_t result = L2CAP_LE_RESULT_INSUFFICIENT_AUTHENTICATION;
+      if (BTM_IsLinkKeyKnown(bda, BT_TRANSPORT_LE)) {
+        result = L2CAP_LE_RESULT_INSUFFICIENT_ENCRYP;
+      }
+      LOG_ERROR("ACL to device %s is unencrypted.", bda.ToString().c_str());
+      L2CA_ConnectCreditBasedRsp(bda, identifier, empty, result, nullptr);
+      return;
+    }
+
+    if (stack_config_get_interface()->get_pts_l2cap_ecoc_upper_tester()) {
+      LOG_INFO(" Upper tester for the L2CAP ECoC enabled");
+      return upper_tester_l2cap_connect_ind(bda, lcids, psm, peer_mtu,
+                                            identifier);
+    }
+
+    eatt_l2cap_connect_ind_common(bda, lcids, psm, peer_mtu, identifier);
   }
 
   void eatt_retry_after_collision_if_needed(eatt_device* eatt_dev) {
@@ -210,17 +359,31 @@
       /* This is only for the PTS. Android does not setup EATT when is a
        * peripheral.
        */
-      bt_status_t status = do_in_main_thread_delayed(
-          FROM_HERE,
-          base::BindOnce(&eatt_impl::connect_eatt_wrap, base::Unretained(this),
-                         std::move(eatt_dev)),
-          base::TimeDelta::FromMilliseconds(500));
-
-      LOG_INFO("Scheduled peripheral connect eatt for device with status: %d",
-               (int)status);
+      upper_tester_delay_connect(eatt_dev->bda_, 500);
     }
   }
 
+  /* This is for the L2CAP ECoC Testing. */
+  void upper_tester_l2cap_connect_cfm(eatt_device* eatt_dev) {
+    LOG_INFO("Upper tester for L2CAP Ecoc %s",
+             eatt_dev->bda_.ToString().c_str());
+    if (is_channel_connection_pending(eatt_dev)) {
+      LOG_INFO(" Waiting for all channels to be connected");
+      return;
+    }
+
+    if (stack_config_get_interface()->get_pts_l2cap_ecoc_connect_remaining() &&
+        (static_cast<int>(eatt_dev->eatt_channels.size()) <
+         L2CAP_CREDIT_BASED_MAX_CIDS)) {
+      LOG_INFO("Connecting remaining channels %d",
+               L2CAP_CREDIT_BASED_MAX_CIDS -
+                   static_cast<int>(eatt_dev->eatt_channels.size()));
+      upper_tester_delay_connect(eatt_dev->bda_, 1000);
+      return;
+    }
+    upper_tester_send_data_if_needed(eatt_dev->bda_);
+  }
+
   void eatt_l2cap_connect_cfm(const RawAddress& bda, uint16_t lcid,
                               uint16_t peer_mtu, uint16_t result) {
     LOG(INFO) << __func__ << " bda: " << bda << " cid: " << +lcid
@@ -242,6 +405,11 @@
       LOG(ERROR) << __func__
                  << " Could not connect CoC result: " << loghex(result);
       remove_channel_by_cid(eatt_dev, lcid);
+
+      /* If there is no channels connected, check if there was collision */
+      if (!is_channel_connection_pending(eatt_dev)) {
+        eatt_retry_after_collision_if_needed(eatt_dev);
+      }
       return;
     }
 
@@ -252,8 +420,11 @@
     CHECK(eatt_dev->bda_ == channel->bda_);
     eatt_dev->eatt_tcb_->eatt++;
 
-    LOG(INFO) << __func__ << " Channel connected CID " << loghex(lcid);
-    eatt_retry_after_collision_if_needed(eatt_dev);
+    LOG_INFO("Channel connected CID 0x%04x", lcid);
+
+    if (stack_config_get_interface()->get_pts_l2cap_ecoc_upper_tester()) {
+      upper_tester_l2cap_connect_cfm(eatt_dev);
+    }
   }
 
   void eatt_l2cap_reconfig_completed(const RawAddress& bda, uint16_t lcid,
@@ -280,6 +451,20 @@
 
     /* Go back to open state */
     channel->EattChannelSetState(EattChannelState::EATT_CHANNEL_OPENED);
+
+    if (stack_config_get_interface()->get_pts_l2cap_ecoc_reconfigure()) {
+      /* Upper tester for L2CAP - schedule sending data */
+      do_in_main_thread_delayed(
+          FROM_HERE,
+          base::BindOnce(&eatt_impl::upper_tester_send_data_if_needed,
+                         base::Unretained(this), bda, lcid),
+#if BASE_VER < 931007
+          base::TimeDelta::FromMilliseconds(1000)
+#else
+          base::Milliseconds(1000)
+#endif
+      );
+    }
   }
 
   void eatt_l2cap_collision_ind(const RawAddress& bda) {
@@ -323,7 +508,9 @@
         break;
     }
 
-    eatt_retry_after_collision_if_needed(eatt_dev);
+    if (!is_channel_connection_pending(eatt_dev)) {
+      eatt_retry_after_collision_if_needed(eatt_dev);
+    }
   }
 
   void eatt_l2cap_disconnect_ind(uint16_t lcid, bool please_confirm) {
@@ -398,7 +585,7 @@
     tL2CAP_LE_CFG_INFO local_coc_cfg = {
         .mtu = eatt_dev->rx_mtu_,
         .mps = eatt_dev->rx_mps_,
-        .credits = L2CAP_LE_CREDIT_DEFAULT,
+        .credits = L2CA_LeCreditDefault(),
         .number_of_channels = num_of_channels,
     };
 
@@ -530,7 +717,10 @@
     auto iter = find_if(
         eatt_dev->eatt_channels.begin(), eatt_dev->eatt_channels.end(),
         [](const std::pair<uint16_t, std::shared_ptr<EattChannel>>& el) {
-          return !el.second->cl_cmd_q_.empty();
+          if (el.second->cl_cmd_q_.empty()) return false;
+
+          tGATT_CMD_Q& cmd = el.second->cl_cmd_q_.front();
+          return cmd.to_send;
         });
     return (iter != eatt_dev->eatt_channels.end());
   }
@@ -542,7 +732,10 @@
     auto iter = find_if(
         eatt_dev->eatt_channels.begin(), eatt_dev->eatt_channels.end(),
         [](const std::pair<uint16_t, std::shared_ptr<EattChannel>>& el) {
-          return !el.second->cl_cmd_q_.empty();
+          if (el.second->cl_cmd_q_.empty()) return false;
+
+          tGATT_CMD_Q& cmd = el.second->cl_cmd_q_.front();
+          return cmd.to_send;
         });
     return (iter == eatt_dev->eatt_channels.end()) ? nullptr
                                                    : iter->second.get();
@@ -640,6 +833,7 @@
   }
 
   void reconfigure_all(const RawAddress& bd_addr, uint16_t new_mtu) {
+    LOG_INFO(" Device %s, new mtu %d", bd_addr.ToString().c_str(), new_mtu);
     eatt_device* eatt_dev = find_device_by_address(bd_addr);
     if (!eatt_dev) {
       LOG(ERROR) << __func__ << "Unknown device " << bd_addr;
@@ -681,7 +875,12 @@
               << " is_eatt_supported = " << int(is_eatt_supported);
     if (!is_eatt_supported) return;
 
-    eatt_device* eatt_dev = add_eatt_device(bd_addr);
+    eatt_device* eatt_dev = this->find_device_by_address(bd_addr);
+    if (!eatt_dev) {
+      LOG(INFO) << __func__ << " Adding device: " << bd_addr
+                << " on supported features callback.";
+      eatt_dev = add_eatt_device(bd_addr);
+    }
 
     if (role != HCI_ROLE_CENTRAL) {
       /* TODO For now do nothing, we could run a timer here and start EATT if
@@ -738,6 +937,44 @@
     eatt_dev->collision = false;
   }
 
+  void upper_tester_connect(const RawAddress& bd_addr, eatt_device* eatt_dev,
+                            uint8_t role) {
+    LOG_INFO(
+        "L2CAP Upper tester enabled, %s (%p), role: %s(%d)",
+        bd_addr.ToString().c_str(), eatt_dev,
+        role == HCI_ROLE_CENTRAL ? "HCI_ROLE_CENTRAL" : "HCI_ROLE_PERIPHERAL",
+        role);
+
+    auto num_of_chan =
+        stack_config_get_interface()->get_pts_l2cap_ecoc_initial_chan_cnt();
+    if (num_of_chan <= 0) {
+      num_of_chan = L2CAP_CREDIT_BASED_MAX_CIDS;
+    }
+
+    /* This is needed for L2CAP test cases */
+    if (stack_config_get_interface()->get_pts_connect_eatt_unconditionally()) {
+      /* Normally eatt_dev exist only if EATT is supported by remote device.
+       * Here it is created unconditionally */
+      if (eatt_dev == nullptr) eatt_dev = add_eatt_device(bd_addr);
+      /* For PTS just start connecting EATT right away */
+      connect_eatt(eatt_dev, num_of_chan);
+      return;
+    }
+
+    if (eatt_dev != nullptr && role == HCI_ROLE_CENTRAL) {
+      connect_eatt(eatt_dev, num_of_chan);
+      return;
+    }
+
+    /* If we don't know yet, read GATT server supported features. */
+    if (gatt_cl_read_sr_supp_feat_req(
+            bd_addr, base::BindOnce(&eatt_impl::supported_features_cb,
+                                    base::Unretained(this), role)) == false) {
+      LOG_INFO("Read server supported features failed for device %s",
+               bd_addr.ToString().c_str());
+    }
+  }
+
   void connect(const RawAddress& bd_addr) {
     eatt_device* eatt_dev = find_device_by_address(bd_addr);
 
@@ -747,6 +984,11 @@
       return;
     }
 
+    if (stack_config_get_interface()->get_pts_l2cap_ecoc_upper_tester()) {
+      upper_tester_connect(bd_addr, eatt_dev, role);
+      return;
+    }
+
     LOG_INFO("Device %s, role %s", bd_addr.ToString().c_str(),
              (role == HCI_ROLE_CENTRAL ? "central" : "peripheral"));
 
@@ -766,13 +1008,7 @@
       return;
     }
 
-    /* This is needed for L2CAP test cases */
-    if (stack_config_get_interface()->get_pts_connect_eatt_unconditionally()) {
-      /* For PTS just start connecting EATT right away */
-      eatt_device* eatt_dev = add_eatt_device(bd_addr);
-      connect_eatt_wrap(eatt_dev);
-      return;
-    }
+    if (role != HCI_ROLE_CENTRAL) return;
 
     if (gatt_profile_get_eatt_support(bd_addr)) {
       LOG_DEBUG("Eatt is supported for device %s", bd_addr.ToString().c_str());
diff --git a/system/stack/gap/gap_ble.cc b/system/stack/gap/gap_ble.cc
index 9d79910..c0518d1 100644
--- a/system/stack/gap/gap_ble.cc
+++ b/system/stack/gap/gap_ble.cc
@@ -385,7 +385,8 @@
                                 BT_TRANSPORT_LE))
     p_clcb->connected = true;
 
-  if (!GATT_Connect(gatt_if, p_clcb->bda, true, BT_TRANSPORT_LE, true))
+  if (!GATT_Connect(gatt_if, p_clcb->bda, BTM_BLE_DIRECT_CONNECTION,
+                    BT_TRANSPORT_LE, true))
     return false;
 
   /* enqueue the request */
diff --git a/system/stack/gap/gap_conn.cc b/system/stack/gap/gap_conn.cc
index d1b8219..23d9589 100644
--- a/system/stack/gap/gap_conn.cc
+++ b/system/stack/gap/gap_conn.cc
@@ -207,7 +207,7 @@
 
   /* Configure L2CAP COC, if transport is LE */
   if (transport == BT_TRANSPORT_LE) {
-    p_ccb->local_coc_cfg.credits = L2CAP_LE_CREDIT_DEFAULT;
+    p_ccb->local_coc_cfg.credits = L2CA_LeCreditDefault();
     p_ccb->local_coc_cfg.mtu = p_cfg->mtu;
 
     uint16_t max_mps = controller_get_interface()->get_acl_data_size_ble();
diff --git a/system/stack/gatt/att_protocol.cc b/system/stack/gatt/att_protocol.cc
index 3683d40..ef4a3a6 100644
--- a/system/stack/gatt/att_protocol.cc
+++ b/system/stack/gatt/att_protocol.cc
@@ -436,7 +436,8 @@
   if (gatt_tcb_is_cid_busy(tcb, p_clcb->cid) &&
       cmd_code != GATT_HANDLE_VALUE_CONF) {
     gatt_cmd_enq(tcb, p_clcb, true, cmd_code, p_cmd);
-    LOG_DEBUG("Enqueued ATT command");
+    LOG_DEBUG("Enqueued ATT command %p conn_id=0x%04x, cid=%d", p_clcb,
+              p_clcb->conn_id, p_clcb->cid);
     return GATT_CMD_STARTED;
   }
 
@@ -445,7 +446,9 @@
       p_clcb->cid, tcb.eatt, bt_transport_text(tcb.transport).c_str());
   tGATT_STATUS att_ret = attp_send_msg_to_l2cap(tcb, p_clcb->cid, p_cmd);
   if (att_ret != GATT_CONGESTED && att_ret != GATT_SUCCESS) {
-    LOG_WARN("Unable to send ATT command to l2cap layer");
+    LOG_WARN(
+        "Unable to send ATT command to l2cap layer %p conn_id=0x%04x, cid=%d",
+        p_clcb, p_clcb->conn_id, p_clcb->cid);
     return GATT_INTERNAL_ERROR;
   }
 
@@ -453,7 +456,8 @@
     return att_ret;
   }
 
-  LOG_DEBUG("Starting ATT response timer");
+  LOG_DEBUG("Starting ATT response timer %p conn_id=0x%04x, cid=%d", p_clcb,
+            p_clcb->conn_id, p_clcb->cid);
   gatt_start_rsp_timer(p_clcb);
   gatt_cmd_enq(tcb, p_clcb, false, cmd_code, NULL);
   return att_ret;
diff --git a/system/stack/gatt/connection_manager.cc b/system/stack/gatt/connection_manager.cc
index fd38bb5..b2f48ff 100644
--- a/system/stack/gatt/connection_manager.cc
+++ b/system/stack/gatt/connection_manager.cc
@@ -27,16 +27,24 @@
 #include <memory>
 #include <set>
 
+#include "bind_helpers.h"
 #include "internal_include/bt_trace.h"
+#include "main/shim/dumpsys.h"
+#include "main/shim/le_scanning_manager.h"
 #include "main/shim/shim.h"
 #include "osi/include/alarm.h"
 #include "osi/include/log.h"
 #include "stack/btm/btm_ble_bgconn.h"
+#include "stack/include/advertise_data_parser.h"
+#include "stack/include/btm_ble_api.h"
+#include "stack/include/btu.h"  // do_in_main_thread
 #include "stack/include/l2c_api.h"
 #include "types/raw_address.h"
 
 #define DIRECT_CONNECT_TIMEOUT (30 * 1000) /* 30 seconds */
 
+constexpr char kBtmLogTag[] = "TA";
+
 struct closure_data {
   base::OnceClosure user_task;
   base::Location posted_from;
@@ -66,6 +74,8 @@
 struct tAPPS_CONNECTING {
   // ids of clients doing background connection to given device
   std::set<tAPP_ID> doing_bg_conn;
+  std::set<tAPP_ID> doing_targeted_announcements_conn;
+  bool is_in_accept_list;
 
   // Apps trying to do direct connection.
   std::map<tAPP_ID, unique_alarm_ptr> doing_direct_conn;
@@ -75,12 +85,30 @@
 // Maps address to apps trying to connect to it
 std::map<RawAddress, tAPPS_CONNECTING> bgconn_dev;
 
-bool anyone_connecting(
+int num_of_targeted_announcements_users(void) {
+  return std::count_if(
+      bgconn_dev.begin(), bgconn_dev.end(), [](const auto& pair) {
+        return (!pair.second.is_in_accept_list &&
+                !pair.second.doing_targeted_announcements_conn.empty());
+      });
+}
+
+bool is_anyone_interested_to_use_accept_list(
     const std::map<RawAddress, tAPPS_CONNECTING>::iterator it) {
+  if (!it->second.doing_targeted_announcements_conn.empty()) {
+    return (!it->second.doing_direct_conn.empty());
+  }
   return (!it->second.doing_bg_conn.empty() ||
           !it->second.doing_direct_conn.empty());
 }
 
+bool is_anyone_connecting(
+    const std::map<RawAddress, tAPPS_CONNECTING>::iterator it) {
+  return (!it->second.doing_bg_conn.empty() ||
+          !it->second.doing_direct_conn.empty() ||
+          !it->second.doing_targeted_announcements_conn.empty());
+}
+
 }  // namespace
 
 /** background connection device from the list. Returns pointer to the device
@@ -92,6 +120,151 @@
                                   : std::set<tAPP_ID>();
 }
 
+bool IsTargetedAnnouncement(const uint8_t* p_eir, uint16_t eir_len) {
+  const uint8_t* p_service_data = p_eir;
+  uint8_t service_data_len = 0;
+
+  while ((p_service_data = AdvertiseDataParser::GetFieldByType(
+              p_service_data + service_data_len,
+              eir_len - (p_service_data - p_eir) - service_data_len,
+              BTM_BLE_AD_TYPE_SERVICE_DATA_TYPE, &service_data_len))) {
+    uint16_t uuid;
+    uint8_t announcement_type;
+    const uint8_t* p_tmp = p_service_data;
+
+    if (service_data_len < 1) {
+      continue;
+    }
+
+    STREAM_TO_UINT16(uuid, p_tmp);
+    LOG_DEBUG("Found UUID 0x%04x", uuid);
+
+    if (uuid != 0x184E && uuid != 0x1853) {
+      continue;
+    }
+
+    STREAM_TO_UINT8(announcement_type, p_tmp);
+    LOG_DEBUG("Found announcement_type 0x%02x", announcement_type);
+    if (announcement_type == 0x01) {
+      return true;
+    }
+  }
+  return false;
+}
+
+static void schedule_direct_connect_add(uint8_t app_id,
+                                        const RawAddress& address);
+
+static void target_announcement_observe_results_cb(tBTM_INQ_RESULTS* p_inq,
+                                                   const uint8_t* p_eir,
+                                                   uint16_t eir_len) {
+  auto addr = p_inq->remote_bd_addr;
+  auto it = bgconn_dev.find(addr);
+  if (it == bgconn_dev.end() ||
+      it->second.doing_targeted_announcements_conn.empty()) {
+    return;
+  }
+
+  if (!IsTargetedAnnouncement(p_eir, eir_len)) {
+    LOG_DEBUG("Not a targeted announcement for device %s",
+              addr.ToString().c_str());
+    return;
+  }
+
+  LOG_INFO("Found targeted announcement for device %s",
+           addr.ToString().c_str());
+
+  if (it->second.is_in_accept_list) {
+    LOG_INFO("Device %s is already connecting", addr.ToString().c_str());
+    return;
+  }
+
+  if (BTM_GetHCIConnHandle(addr, BT_TRANSPORT_LE) != 0xFFFF) {
+    LOG_DEBUG("Device %s already connected", addr.ToString().c_str());
+    return;
+  }
+
+  BTM_LogHistory(kBtmLogTag, addr, "Found TA from");
+
+  /* Take fist app_id and use it for direct_connect */
+  auto app_id = *(it->second.doing_targeted_announcements_conn.begin());
+
+  /* If scan is ongoing lets stop it */
+  do_in_main_thread(FROM_HERE,
+                    base::BindOnce(schedule_direct_connect_add, app_id, addr));
+}
+
+void target_announcements_filtering_set(bool enable) {
+  LOG_DEBUG("enable %d", enable);
+  BTM_LogHistory(kBtmLogTag, RawAddress::kEmpty,
+                 (enable ? "Start filtering" : "Stop filtering"));
+
+  /* Safe to call as if there is no support for filtering, this call will be
+   * ignored. */
+  bluetooth::shim::set_target_announcements_filter(enable);
+  BTM_BleTargetAnnouncementObserve(enable,
+                                   target_announcement_observe_results_cb);
+}
+
+/** Add a device to the background connection list for targeted announcements.
+ * Returns
+ *   true if device added to the list, or already in list,
+ *   false otherwise
+ */
+bool background_connect_targeted_announcement_add(tAPP_ID app_id,
+                                                  const RawAddress& address) {
+  LOG_INFO("app_id=%d, address=%s", static_cast<int>(app_id),
+           address.ToString().c_str());
+
+  bool disable_accept_list = false;
+
+  auto it = bgconn_dev.find(address);
+  if (it != bgconn_dev.end()) {
+    // check if filtering already enabled
+    if (it->second.doing_targeted_announcements_conn.count(app_id)) {
+      LOG_INFO(
+          "app_id=%d, already doing targeted announcement filtering to "
+          "address=%s",
+          static_cast<int>(app_id), address.ToString().c_str());
+      return true;
+    }
+
+    bool targeted_filtering_enabled =
+        !it->second.doing_targeted_announcements_conn.empty();
+
+    // Check if connecting
+    if (!it->second.doing_direct_conn.empty()) {
+      LOG_INFO("app_id=%d, address=%s, already in direct connection",
+               static_cast<int>(app_id), address.ToString().c_str());
+
+    } else if (!targeted_filtering_enabled &&
+               !it->second.doing_bg_conn.empty()) {
+      // device is already in the acceptlist so we would have to remove it
+      LOG_INFO(
+          "already doing background connection to address=%s. Need to disable "
+          "it.",
+          address.ToString().c_str());
+      disable_accept_list = true;
+    }
+  }
+
+  if (disable_accept_list) {
+    BTM_AcceptlistRemove(address);
+    bgconn_dev[address].is_in_accept_list = false;
+  }
+
+  bgconn_dev[address].doing_targeted_announcements_conn.insert(app_id);
+  if (bgconn_dev[address].doing_targeted_announcements_conn.size() == 1) {
+    BTM_LogHistory(kBtmLogTag, address, "Allow connection from");
+  }
+
+  if (num_of_targeted_announcements_users() == 1) {
+    target_announcements_filtering_set(true);
+  }
+
+  return true;
+}
+
 /** Add a device from the background connection list.  Returns true if device
  * added to the list, or already in list, false otherwise */
 bool background_connect_add(uint8_t app_id, const RawAddress& address) {
@@ -103,6 +276,7 @@
 
   auto it = bgconn_dev.find(address);
   bool in_acceptlist = false;
+  bool is_targeted_announcement_enabled = false;
   if (it != bgconn_dev.end()) {
     // device already in the acceptlist, just add interested app to the list
     if (it->second.doing_bg_conn.count(app_id)) {
@@ -112,19 +286,27 @@
     }
 
     // Already in acceptlist ?
-    if (anyone_connecting(it)) {
+    if (it->second.is_in_accept_list) {
       LOG_DEBUG("app_id=%d, address=%s, already in accept list",
                 static_cast<int>(app_id), address.ToString().c_str());
       in_acceptlist = true;
+    } else {
+      is_targeted_announcement_enabled =
+          !it->second.doing_targeted_announcements_conn.empty();
     }
   }
 
   if (!in_acceptlist) {
     // the device is not in the acceptlist
-    if (!BTM_AcceptlistAdd(address)) {
-      LOG_WARN("Failed to add device %s to accept list for app %d",
-               address.ToString().c_str(), static_cast<int>(app_id));
-      return false;
+    if (is_targeted_announcement_enabled) {
+      LOG_DEBUG("Targeted announcement enabled, do not add to AcceptList");
+    } else {
+      if (!BTM_AcceptlistAdd(address)) {
+        LOG_WARN("Failed to add device %s to accept list for app %d",
+                 address.ToString().c_str(), static_cast<int>(app_id));
+        return false;
+      }
+      bgconn_dev[address].is_in_accept_list = true;
     }
   }
 
@@ -161,24 +343,64 @@
     return false;
   }
 
-  if (!it->second.doing_bg_conn.erase(app_id)) {
+  bool accept_list_enabled = it->second.is_in_accept_list;
+  auto num_of_targeted_announcements_before_remove =
+      it->second.doing_targeted_announcements_conn.size();
+
+  bool removed_from_bg_conn = (it->second.doing_bg_conn.erase(app_id) > 0);
+  bool removed_from_ta =
+      (it->second.doing_targeted_announcements_conn.erase(app_id) > 0);
+  if (!removed_from_bg_conn && !removed_from_ta) {
     LOG_WARN("Failed to remove background connection app %d for address %s",
              static_cast<int>(app_id), address.ToString().c_str());
     return false;
   }
 
-  if (anyone_connecting(it)) {
+  if (removed_from_ta &&
+      it->second.doing_targeted_announcements_conn.size() == 0) {
+    BTM_LogHistory(kBtmLogTag, address, "Ignore connection from");
+  }
+
+  if (is_anyone_connecting(it)) {
     LOG_DEBUG("some device is still connecting, app_id=%d, address=%s",
               static_cast<int>(app_id), address.ToString().c_str());
+    /* Check which method should be used now.*/
+    if (!accept_list_enabled) {
+      /* Accept list was not used */
+      if (!it->second.doing_targeted_announcements_conn.empty()) {
+        /* Keep using filtering */
+        LOG_DEBUG(" Keep using target announcement filtering");
+      } else if (!it->second.doing_bg_conn.empty()) {
+        if (!BTM_AcceptlistAdd(address)) {
+          LOG_WARN("Could not re add device to accept list");
+        } else {
+          bgconn_dev[address].is_in_accept_list = true;
+        }
+      }
+    }
     return true;
   }
 
-  // no more apps interested - remove from accept list and delete record
-  BTM_AcceptlistRemove(address);
   bgconn_dev.erase(it);
+
+  // no more apps interested - remove from accept list and delete record
+  if (accept_list_enabled) {
+    BTM_AcceptlistRemove(address);
+    return true;
+  }
+
+  if ((num_of_targeted_announcements_before_remove > 0) &&
+      num_of_targeted_announcements_users() == 0) {
+    target_announcements_filtering_set(true);
+  }
+
   return true;
 }
 
+bool is_background_connection(const RawAddress& address) {
+  return bgconn_dev.find(address) != bgconn_dev.end();
+}
+
 /** deregister all related background connetion device. */
 void on_app_deregistered(uint8_t app_id) {
   LOG_DEBUG("app_id=%d", static_cast<int>(app_id));
@@ -190,7 +412,7 @@
 
     it->second.doing_direct_conn.erase(app_id);
 
-    if (anyone_connecting(it)) {
+    if (is_anyone_connecting(it)) {
       it++;
       continue;
     }
@@ -221,11 +443,14 @@
   on_connection_timed_out(0x00, address);
 }
 
-/** Reset bg device list. If called after controller reset, set |after_reset| to
- * true, as there is no need to wipe controller acceptlist in this case. */
+/** Reset bg device list. If called after controller reset, set |after_reset|
+ * to true, as there is no need to wipe controller acceptlist in this case. */
 void reset(bool after_reset) {
   bgconn_dev.clear();
-  if (!after_reset) BTM_AcceptlistClear();
+  if (!after_reset) {
+    target_announcements_filtering_set(false);
+    BTM_AcceptlistClear();
+  }
 }
 
 void wl_direct_connect_timeout_cb(uint8_t app_id, const RawAddress& address) {
@@ -258,7 +483,7 @@
     }
 
     // are we already in the acceptlist ?
-    if (anyone_connecting(it)) {
+    if (it->second.is_in_accept_list) {
       LOG_WARN("Background connection attempt already in progress app_id=%x",
                app_id);
       in_acceptlist = true;
@@ -274,6 +499,7 @@
       if (params_changed) BTM_SetLeConnectionModeToSlow();
       return false;
     }
+    bgconn_dev[address].is_in_accept_list = true;
   }
 
   // Setup a timer
@@ -284,9 +510,15 @@
 
   bgconn_dev[address].doing_direct_conn.emplace(
       app_id, unique_alarm_ptr(timeout, &alarm_free));
+
   return true;
 }
 
+static void schedule_direct_connect_add(uint8_t app_id,
+                                        const RawAddress& address) {
+  direct_connect_add(app_id, address);
+}
+
 static bool any_direct_connect_left() {
   for (const auto& tmp : bgconn_dev) {
     if (!tmp.second.doing_direct_conn.empty()) return true;
@@ -299,16 +531,22 @@
             address.ToString().c_str());
   auto it = bgconn_dev.find(address);
   if (it == bgconn_dev.end()) {
-    LOG_WARN("Unable to find background connection to remove");
+    LOG_WARN("Unable to find background connection to remove peer:%s",
+             PRIVATE_ADDRESS(address));
     return false;
   }
 
   auto app_it = it->second.doing_direct_conn.find(app_id);
   if (app_it == it->second.doing_direct_conn.end()) {
-    LOG_WARN("Unable to find direct connection to remove");
+    LOG_WARN("Unable to find direct connection to remove peer:%s",
+             PRIVATE_ADDRESS(address));
     return false;
   }
 
+  /* Let see if the device was connected due to Target Announcements.*/
+  bool is_targeted_announcement_enabled =
+      !it->second.doing_targeted_announcements_conn.empty();
+
   // this will free the alarm
   it->second.doing_direct_conn.erase(app_it);
 
@@ -318,13 +556,19 @@
     BTM_SetLeConnectionModeToSlow();
   }
 
-  if (anyone_connecting(it)) {
+  if (is_anyone_interested_to_use_accept_list(it)) {
     return true;
   }
 
   // no more apps interested - remove from acceptlist
   BTM_AcceptlistRemove(address);
-  bgconn_dev.erase(it);
+
+  if (!is_targeted_announcement_enabled) {
+    bgconn_dev.erase(it);
+  } else {
+    it->second.is_in_accept_list = false;
+  }
+
   return true;
 }
 
@@ -352,6 +596,14 @@
         dprintf(fd, "%d, ", id);
       }
     }
+    if (!entry.second.doing_targeted_announcements_conn.empty()) {
+      dprintf(fd, "\n\t\tapps doing cap announcement connect: ");
+      for (const auto& id : entry.second.doing_targeted_announcements_conn) {
+        dprintf(fd, "%d, ", id);
+      }
+    }
+    dprintf(fd, "\n\t\t is in the allow list: %s",
+            entry.second.is_in_accept_list ? "true" : "false");
   }
   dprintf(fd, "\n");
 }
diff --git a/system/stack/gatt/connection_manager.h b/system/stack/gatt/connection_manager.h
index d3eb3e3..0c407c8 100644
--- a/system/stack/gatt/connection_manager.h
+++ b/system/stack/gatt/connection_manager.h
@@ -37,6 +37,8 @@
 using tAPP_ID = uint8_t;
 
 /* for background connection */
+extern bool background_connect_targeted_announcement_add(
+    tAPP_ID app_id, const RawAddress& address);
 extern bool background_connect_add(tAPP_ID app_id, const RawAddress& address);
 extern bool background_connect_remove(tAPP_ID app_id,
                                       const RawAddress& address);
@@ -59,4 +61,6 @@
 extern void on_connection_timed_out(uint8_t app_id, const RawAddress& address);
 extern void on_connection_timed_out_from_shim(const RawAddress& address);
 
+extern bool is_background_connection(const RawAddress& address);
+
 }  // namespace connection_manager
diff --git a/system/stack/gatt/gatt_api.cc b/system/stack/gatt/gatt_api.cc
index 3158f74..9a1152b 100644
--- a/system/stack/gatt/gatt_api.cc
+++ b/system/stack/gatt/gatt_api.cc
@@ -21,7 +21,7 @@
  *  this file contains GATT interface functions
  *
  ******************************************************************************/
-#include "gatt_api.h"
+#include "stack/include/gatt_api.h"
 
 #include <base/logging.h>
 #include <base/strings/string_number_conversions.h>
@@ -31,13 +31,16 @@
 
 #include "bt_target.h"
 #include "device/include/controller.h"
-#include "gatt_int.h"
+#include "gd/os/system_properties.h"
 #include "internal_include/stack_config.h"
 #include "l2c_api.h"
 #include "main/shim/dumpsys.h"
 #include "osi/include/allocator.h"
+#include "osi/include/list.h"
 #include "osi/include/log.h"
+#include "stack/btm/btm_dev.h"
 #include "stack/gatt/connection_manager.h"
+#include "stack/gatt/gatt_int.h"
 #include "stack/include/bt_hdr.h"
 #include "types/bluetooth/uuid.h"
 #include "types/bt_transport.h"
@@ -304,7 +307,7 @@
   elem.type = list.asgn_range.is_primary ? GATT_UUID_PRI_SERVICE
                                          : GATT_UUID_SEC_SERVICE;
 
-  if (elem.type == GATT_UUID_PRI_SERVICE) {
+  if (elem.type == GATT_UUID_PRI_SERVICE && gatt_cb.over_br_enabled) {
     Uuid* p_uuid = gatts_get_service_uuid(elem.p_db);
     if (*p_uuid != Uuid::From16Bit(UUID_SERVCLASS_GMCS_SERVER) &&
         *p_uuid != Uuid::From16Bit(UUID_SERVCLASS_GTBS_SERVER)) {
@@ -702,11 +705,6 @@
     return GATT_ERROR;
   }
 
-  if (gatt_is_clcb_allocated(conn_id)) {
-    LOG_WARN("Connection is already used conn_id:%hu", conn_id);
-    return GATT_BUSY;
-  }
-
   tGATT_CLCB* p_clcb = gatt_clcb_alloc(conn_id);
   if (!p_clcb) {
     LOG_WARN("Unable to allocate connection link control block");
@@ -765,11 +763,6 @@
     return GATT_ILLEGAL_PARAMETER;
   }
 
-  if (gatt_is_clcb_allocated(conn_id)) {
-    LOG(ERROR) << __func__ << "GATT_BUSY conn_id = " << +conn_id;
-    return GATT_BUSY;
-  }
-
   tGATT_CLCB* p_clcb = gatt_clcb_alloc(conn_id);
   if (!p_clcb) {
     LOG(WARNING) << __func__ << " No resources conn_id=" << loghex(conn_id)
@@ -835,11 +828,6 @@
     return GATT_ILLEGAL_PARAMETER;
   }
 
-  if (gatt_is_clcb_allocated(conn_id)) {
-    LOG(ERROR) << "GATT_BUSY conn_id=" << loghex(conn_id);
-    return GATT_BUSY;
-  }
-
   tGATT_CLCB* p_clcb = gatt_clcb_alloc(conn_id);
   if (!p_clcb) return GATT_NO_RESOURCES;
 
@@ -909,7 +897,8 @@
   }
 
   /* start security check */
-  if (gatt_security_check_start(p_clcb)) p_tcb->pending_enc_clcb.push(p_clcb);
+  if (gatt_security_check_start(p_clcb))
+    p_tcb->pending_enc_clcb.push_back(p_clcb);
   return GATT_SUCCESS;
 }
 
@@ -942,11 +931,6 @@
     return GATT_ILLEGAL_PARAMETER;
   }
 
-  if (gatt_is_clcb_allocated(conn_id)) {
-    LOG(ERROR) << "GATT_BUSY conn_id=" << loghex(conn_id);
-    return GATT_BUSY;
-  }
-
   tGATT_CLCB* p_clcb = gatt_clcb_alloc(conn_id);
   if (!p_clcb) return GATT_NO_RESOURCES;
 
@@ -963,7 +947,8 @@
     p->offset = 0;
   }
 
-  if (gatt_security_check_start(p_clcb)) p_tcb->pending_enc_clcb.push(p_clcb);
+  if (gatt_security_check_start(p_clcb))
+    p_tcb->pending_enc_clcb.push_back(p_clcb);
   return GATT_SUCCESS;
 }
 
@@ -995,11 +980,6 @@
     return GATT_ILLEGAL_PARAMETER;
   }
 
-  if (gatt_is_clcb_allocated(conn_id)) {
-    LOG(ERROR) << " GATT_BUSY conn_id=" << loghex(conn_id);
-    return GATT_BUSY;
-  }
-
   tGATT_CLCB* p_clcb = gatt_clcb_alloc(conn_id);
   if (!p_clcb) return GATT_NO_RESOURCES;
 
@@ -1024,8 +1004,7 @@
  *
  ******************************************************************************/
 tGATT_STATUS GATTC_SendHandleValueConfirm(uint16_t conn_id, uint16_t cid) {
-  VLOG(1) << __func__ << " conn_id=" << loghex(conn_id)
-          << ", cid=" << loghex(cid);
+  LOG_INFO(" conn_id=0x%04x , cid=0x%04x", conn_id, cid);
 
   tGATT_TCB* p_tcb = gatt_get_tcb_by_idx(GATT_GET_TCB_IDX(conn_id));
   if (!p_tcb) {
@@ -1034,20 +1013,19 @@
   }
 
   if (p_tcb->ind_count == 0) {
-    VLOG(1) << " conn_id: " << loghex(conn_id)
-            << " ignored not waiting for indicaiton ack";
+    LOG_INFO("conn_id: 0x%04x ignored not waiting for indicaiton ack", conn_id);
     return GATT_SUCCESS;
   }
 
+  LOG_INFO("Received confirmation, ind_count= %d, sending confirmation",
+           p_tcb->ind_count);
+
+  /* Just wait for first confirmation.*/
+  p_tcb->ind_count = 0;
   gatt_stop_ind_ack_timer(p_tcb, cid);
 
-  VLOG(1) << "notif_count= " << p_tcb->ind_count;
   /* send confirmation now */
-  tGATT_STATUS ret = attp_send_cl_confirmation_msg(*p_tcb, cid);
-
-
-
-  return ret;
+  return attp_send_cl_confirmation_msg(*p_tcb, cid);
 }
 
 /******************************************************************************/
@@ -1064,26 +1042,36 @@
  *
  * Parameter        bd_addr:   target device bd address.
  *                  idle_tout: timeout value in seconds.
+ *                  transport: transport option.
+ *                  is_active: whether we should use this as a signal that an
+ *                             active client now exists (which changes link
+ *                             timeout logic, see
+ *                             t_l2c_linkcb.with_active_local_clients for
+ *                             details).
  *
  * Returns          void
  *
  ******************************************************************************/
 void GATT_SetIdleTimeout(const RawAddress& bd_addr, uint16_t idle_tout,
-                         tBT_TRANSPORT transport) {
+                         tBT_TRANSPORT transport, bool is_active) {
   bool status = false;
 
   tGATT_TCB* p_tcb = gatt_find_tcb_by_addr(bd_addr, transport);
   if (p_tcb != nullptr) {
     status = L2CA_SetLeGattTimeout(bd_addr, idle_tout);
 
+    if (is_active) {
+      status &= L2CA_MarkLeLinkAsActive(bd_addr);
+    }
+
     if (idle_tout == GATT_LINK_IDLE_TIMEOUT_WHEN_NO_APP) {
       L2CA_SetIdleTimeoutByBdAddr(
           p_tcb->peer_bda, GATT_LINK_IDLE_TIMEOUT_WHEN_NO_APP, BT_TRANSPORT_LE);
     }
   }
 
-  LOG_INFO("idle_timeout=%d, status=%d, (1-OK 0-not performed)", idle_tout,
-           +status);
+  LOG_INFO("idle_timeout=%d, is_active=%d, status=%d (1-OK 0-not performed)",
+           idle_tout, is_active, +status);
 }
 
 /*******************************************************************************
@@ -1116,6 +1104,11 @@
     }
   }
 
+  if (stack_config_get_interface()->get_pts_use_eatt_for_all_services()) {
+    LOG_INFO("PTS: Force to use EATT for servers");
+    eatt_support = true;
+  }
+
   for (i_gatt_if = 0, p_reg = gatt_cb.cl_rcb; i_gatt_if < GATT_MAX_APPS;
        i_gatt_if++, p_reg++) {
     if (!p_reg->in_use) {
@@ -1182,7 +1175,7 @@
   /* When an application deregisters, check remove the link associated with the
    * app */
   tGATT_TCB* p_tcb;
-  int i, j;
+  int i;
   for (i = 0, p_tcb = gatt_cb.tcb; i < GATT_MAX_PHY_CHANNEL; i++, p_tcb++) {
     if (!p_tcb->in_use) continue;
 
@@ -1190,13 +1183,15 @@
       gatt_update_app_use_link_flag(gatt_if, p_tcb, false, true);
     }
 
-    tGATT_CLCB* p_clcb;
-    for (j = 0, p_clcb = &gatt_cb.clcb[j]; j < GATT_CL_MAX_LCB; j++, p_clcb++) {
-      if (p_clcb->in_use && (p_clcb->p_reg->gatt_if == gatt_if) &&
-          (p_clcb->p_tcb->tcb_idx == p_tcb->tcb_idx)) {
-        alarm_cancel(p_clcb->gatt_rsp_timer_ent);
-        gatt_clcb_dealloc(p_clcb);
-        break;
+    for (auto clcb_it = gatt_cb.clcb_queue.begin();
+         clcb_it != gatt_cb.clcb_queue.end();) {
+      if ((clcb_it->p_reg->gatt_if == gatt_if) &&
+          (clcb_it->p_tcb->tcb_idx == p_tcb->tcb_idx)) {
+        alarm_cancel(clcb_it->gatt_rsp_timer_ent);
+        gatt_clcb_invalidate(p_tcb, &(*clcb_it));
+        clcb_it = gatt_cb.clcb_queue.erase(clcb_it);
+      } else {
+        clcb_it++;
       }
     }
   }
@@ -1259,23 +1254,24 @@
  *
  * Parameters       gatt_if: applicaiton interface
  *                  bd_addr: peer device address.
- *                  is_direct: is a direct conenection or a background auto
- *                             connection
+ *                  connection_type: is a direct conenection or a background
+ *                  auto connection or targeted announcements
  *
  * Returns          true if connection started; false if connection start
  *                  failure.
  *
  ******************************************************************************/
-bool GATT_Connect(tGATT_IF gatt_if, const RawAddress& bd_addr, bool is_direct,
-                  tBT_TRANSPORT transport, bool opportunistic) {
+bool GATT_Connect(tGATT_IF gatt_if, const RawAddress& bd_addr,
+                  tBTM_BLE_CONN_TYPE connection_type, tBT_TRANSPORT transport,
+                  bool opportunistic) {
   uint8_t phy = controller_get_interface()->get_le_all_initiating_phys();
-  return GATT_Connect(gatt_if, bd_addr, is_direct, transport, opportunistic,
-                      phy);
+  return GATT_Connect(gatt_if, bd_addr, connection_type, transport,
+                      opportunistic, phy);
 }
 
-bool GATT_Connect(tGATT_IF gatt_if, const RawAddress& bd_addr, bool is_direct,
-                  tBT_TRANSPORT transport, bool opportunistic,
-                  uint8_t initiating_phys) {
+bool GATT_Connect(tGATT_IF gatt_if, const RawAddress& bd_addr,
+                  tBTM_BLE_CONN_TYPE connection_type, tBT_TRANSPORT transport,
+                  bool opportunistic, uint8_t initiating_phys) {
   /* Make sure app is registered */
   tGATT_REG* p_reg = gatt_get_regcb(gatt_if);
   if (!p_reg) {
@@ -1283,6 +1279,8 @@
     return false;
   }
 
+  bool is_direct = (connection_type == BTM_BLE_DIRECT_CONNECTION);
+
   if (!is_direct && transport != BT_TRANSPORT_LE) {
     LOG_WARN("Unsupported transport for background connection gatt_if=%d",
              +gatt_if);
@@ -1310,8 +1308,14 @@
                bd_addr.ToString().c_str(), +gatt_if);
       ret = false;
     } else {
-      LOG_DEBUG("Adding to accept list device:%s", PRIVATE_ADDRESS(bd_addr));
-      ret = connection_manager::background_connect_add(gatt_if, bd_addr);
+      LOG_DEBUG("Adding to background connect to device:%s",
+                PRIVATE_ADDRESS(bd_addr));
+      if (connection_type == BTM_BLE_BKG_CONNECT_ALLOW_LIST) {
+        ret = connection_manager::background_connect_add(gatt_if, bd_addr);
+      } else {
+        ret = connection_manager::background_connect_targeted_announcement_add(
+            gatt_if, bd_addr);
+      }
     }
   }
 
@@ -1478,3 +1482,48 @@
   LOG_DEBUG("status=%d", status);
   return status;
 }
+
+static void gatt_bonded_check_add_address(const RawAddress& bda) {
+  if (!gatt_is_bda_in_the_srv_chg_clt_list(bda)) {
+    gatt_add_a_bonded_dev_for_srv_chg(bda);
+  }
+}
+
+std::optional<bool> OVERRIDE_GATT_LOAD_BONDED = std::nullopt;
+
+static bool gatt_load_bonded_is_enabled() {
+  static const bool sGATT_LOAD_BONDED = bluetooth::os::GetSystemPropertyBool(
+      "bluetooth.gatt.load_bonded.enabled", false);
+  if (OVERRIDE_GATT_LOAD_BONDED.has_value()) {
+    return OVERRIDE_GATT_LOAD_BONDED.value();
+  }
+  return sGATT_LOAD_BONDED;
+}
+
+/* Initialize GATTS list of bonded device service change updates.
+ *
+ * Addresses for bonded devices (publict for BR/EDR or pseudo for BLE) are added
+ * to GATTS service change control list so that updates are sent to bonded
+ * devices on next connect after any handles for GATTS services change due to
+ * services added/removed.
+ */
+void gatt_load_bonded(void) {
+  const bool load_bonded = gatt_load_bonded_is_enabled();
+  LOG_INFO("load bonded: %s", load_bonded ? "True" : "False");
+  if (!load_bonded) {
+    return;
+  }
+  for (tBTM_SEC_DEV_REC* p_dev_rec : btm_get_sec_dev_rec()) {
+    if (p_dev_rec->is_link_key_known()) {
+      LOG_VERBOSE("Add bonded BR/EDR transport %s",
+                  PRIVATE_ADDRESS(p_dev_rec->bd_addr));
+      gatt_bonded_check_add_address(p_dev_rec->bd_addr);
+    }
+    if (p_dev_rec->is_le_link_key_known()) {
+      VLOG(1) << " add bonded BLE " << p_dev_rec->ble.pseudo_addr;
+      LOG_VERBOSE("Add bonded BLE %s",
+                  PRIVATE_ADDRESS(p_dev_rec->ble.pseudo_addr));
+      gatt_bonded_check_add_address(p_dev_rec->ble.pseudo_addr);
+    }
+  }
+}
diff --git a/system/stack/gatt/gatt_attr.cc b/system/stack/gatt/gatt_attr.cc
index e67d890..d652b5f 100644
--- a/system/stack/gatt/gatt_attr.cc
+++ b/system/stack/gatt/gatt_attr.cc
@@ -79,6 +79,8 @@
 
 static void gatt_cl_start_config_ccc(tGATT_PROFILE_CLCB* p_clcb);
 
+static bool gatt_cl_is_robust_caching_enabled();
+
 static bool gatt_sr_is_robust_caching_enabled();
 
 static bool read_sr_supported_feat_req(
@@ -430,7 +432,7 @@
   gatt_cb.gatt_svr_supported_feat_mask |= BLE_GATT_SVR_SUP_FEAT_EATT_BITMASK;
   gatt_cb.gatt_cl_supported_feat_mask |= BLE_GATT_CL_ANDROID_SUP_FEAT;
 
-  if (gatt_sr_is_robust_caching_enabled())
+  if (gatt_cl_is_robust_caching_enabled())
     gatt_cb.gatt_cl_supported_feat_mask |= BLE_GATT_CL_SUP_FEAT_CACHING_BITMASK;
 
   VLOG(1) << __func__ << ": gatt_if=" << gatt_cb.gatt_if << " EATT supported";
@@ -724,7 +726,8 @@
     p_clcb->connected = true;
   }
   /* hold the link here */
-  GATT_Connect(gatt_cb.gatt_if, remote_bda, true, transport, true);
+  GATT_Connect(gatt_cb.gatt_if, remote_bda, BTM_BLE_DIRECT_CONNECTION,
+               transport, true);
   p_clcb->ccc_stage = GATT_SVC_CHANGED_CONNECTING;
 
   if (!p_clcb->connected) {
@@ -848,6 +851,19 @@
 
 /*******************************************************************************
  *
+ * Function         gatt_cl_is_robust_caching_enabled
+ *
+ * Description      Check if Robust Caching is enabled on client side.
+ *
+ * Returns          true if enabled in gd flag, otherwise false
+ *
+ ******************************************************************************/
+static bool gatt_cl_is_robust_caching_enabled() {
+  return bluetooth::common::init_flags::gatt_robust_caching_client_is_enabled();
+}
+
+/*******************************************************************************
+ *
  * Function         gatt_sr_is_robust_caching_enabled
  *
  * Description      Check if Robust Caching is enabled on server side.
diff --git a/system/stack/gatt/gatt_auth.cc b/system/stack/gatt/gatt_auth.cc
index ab993d6..2329bc5 100644
--- a/system/stack/gatt/gatt_auth.cc
+++ b/system/stack/gatt/gatt_auth.cc
@@ -174,25 +174,28 @@
   }
 
   tGATT_CLCB* p_clcb = p_tcb->pending_enc_clcb.front();
-  p_tcb->pending_enc_clcb.pop();
+  p_tcb->pending_enc_clcb.pop_front();
 
-  bool status = false;
-  if (result == BTM_SUCCESS) {
-    if (gatt_get_sec_act(p_tcb) == GATT_SEC_ENCRYPT_MITM) {
-      status = BTM_IsLinkKeyAuthed(*bd_addr, transport);
-    } else {
-      status = true;
+  if (p_clcb != NULL) {
+    bool status = false;
+    if (result == BTM_SUCCESS) {
+      if (gatt_get_sec_act(p_tcb) == GATT_SEC_ENCRYPT_MITM) {
+        status = BTM_IsLinkKeyAuthed(*bd_addr, transport);
+      } else {
+        status = true;
+      }
     }
+
+    gatt_sec_check_complete(status, p_clcb, p_tcb->sec_act);
   }
 
-  gatt_sec_check_complete(status, p_clcb, p_tcb->sec_act);
-
   /* start all other pending operation in queue */
-  std::queue<tGATT_CLCB*> new_pending_clcbs;
+  std::deque<tGATT_CLCB*> new_pending_clcbs;
   while (!p_tcb->pending_enc_clcb.empty()) {
     tGATT_CLCB* p_clcb = p_tcb->pending_enc_clcb.front();
-    p_tcb->pending_enc_clcb.pop();
-    if (gatt_security_check_start(p_clcb)) new_pending_clcbs.push(p_clcb);
+    p_tcb->pending_enc_clcb.pop_front();
+    if (p_clcb != NULL && gatt_security_check_start(p_clcb))
+      new_pending_clcbs.push_back(p_clcb);
   }
   p_tcb->pending_enc_clcb = new_pending_clcbs;
 }
@@ -225,11 +228,12 @@
   if (gatt_get_sec_act(p_tcb) == GATT_SEC_ENC_PENDING) {
     gatt_set_sec_act(p_tcb, GATT_SEC_NONE);
 
-    std::queue<tGATT_CLCB*> new_pending_clcbs;
+    std::deque<tGATT_CLCB*> new_pending_clcbs;
     while (!p_tcb->pending_enc_clcb.empty()) {
       tGATT_CLCB* p_clcb = p_tcb->pending_enc_clcb.front();
-      p_tcb->pending_enc_clcb.pop();
-      if (gatt_security_check_start(p_clcb)) new_pending_clcbs.push(p_clcb);
+      p_tcb->pending_enc_clcb.pop_front();
+      if (p_clcb != NULL && gatt_security_check_start(p_clcb))
+        new_pending_clcbs.push_back(p_clcb);
     }
     p_tcb->pending_enc_clcb = new_pending_clcbs;
   }
diff --git a/system/stack/gatt/gatt_cl.cc b/system/stack/gatt/gatt_cl.cc
index c5e5c76..d026633 100644
--- a/system/stack/gatt/gatt_cl.cc
+++ b/system/stack/gatt/gatt_cl.cc
@@ -536,7 +536,6 @@
   VLOG(1) << __func__;
 
   if (len < 4) {
-    android_errorWriteLog(0x534e4554, "79591688");
     LOG(ERROR) << "Error response too short";
     // Specification does not clearly define what should happen if error
     // response is too short. General rule in BT Spec 5.0 Vol 3, Part F 3.4.1.1
@@ -862,7 +861,6 @@
     else if (p_clcb->operation == GATTC_OPTYPE_DISCOVERY &&
              p_clcb->op_subtype == GATT_DISC_INC_SRVC) {
       if (value_len < 4) {
-        android_errorWriteLog(0x534e4554, "158833854");
         LOG(ERROR) << __func__ << " Illegal Response length, must be at least 4.";
         gatt_end_operation(p_clcb, GATT_INVALID_PDU, NULL);
         return;
@@ -921,7 +919,6 @@
     } else /* discover characterisitic */
     {
       if (value_len < 3) {
-        android_errorWriteLog(0x534e4554, "158778659");
         LOG(ERROR) << __func__ << " Illegal Response length, must be at least 3.";
         gatt_end_operation(p_clcb, GATT_INVALID_PDU, NULL);
         return;
@@ -1131,15 +1128,17 @@
 
 /** Find next command in queue and sent to server */
 bool gatt_cl_send_next_cmd_inq(tGATT_TCB& tcb) {
-  std::queue<tGATT_CMD_Q>* cl_cmd_q;
+  std::deque<tGATT_CMD_Q>* cl_cmd_q = nullptr;
 
-  while (!tcb.cl_cmd_q.empty() ||
-         EattExtension::GetInstance()->IsOutstandingMsgInSendQueue(tcb.peer_bda)) {
-    if (!tcb.cl_cmd_q.empty()) {
+  while (
+      gatt_is_outstanding_msg_in_att_send_queue(tcb) ||
+      EattExtension::GetInstance()->IsOutstandingMsgInSendQueue(tcb.peer_bda)) {
+    if (gatt_is_outstanding_msg_in_att_send_queue(tcb)) {
       cl_cmd_q = &tcb.cl_cmd_q;
     } else {
       EattChannel* channel =
-          EattExtension::GetInstance()->GetChannelWithQueuedData(tcb.peer_bda);
+          EattExtension::GetInstance()->GetChannelWithQueuedDataToSend(
+              tcb.peer_bda);
       cl_cmd_q = &channel->cl_cmd_q_;
     }
 
@@ -1153,7 +1152,7 @@
 
     if (att_ret != GATT_SUCCESS && att_ret != GATT_CONGESTED) {
       LOG(ERROR) << __func__ << ": L2CAP sent error";
-      cl_cmd_q->pop();
+      cl_cmd_q->pop_front();
       continue;
     }
 
@@ -1185,7 +1184,7 @@
 void gatt_client_handle_server_rsp(tGATT_TCB& tcb, uint16_t cid,
                                    uint8_t op_code, uint16_t len,
                                    uint8_t* p_data) {
-  VLOG(1) << __func__ << " opcode: " << loghex(op_code);
+  VLOG(1) << __func__ << " opcode: " << loghex(op_code) << " cid" << +cid;
 
   uint16_t payload_size = gatt_tcb_get_payload_size_rx(tcb, cid);
 
@@ -1204,20 +1203,26 @@
 
   uint8_t cmd_code = 0;
   tGATT_CLCB* p_clcb = gatt_cmd_dequeue(tcb, cid, &cmd_code);
-  uint8_t rsp_code = gatt_cmd_to_rsp_code(cmd_code);
-  if (!p_clcb || (rsp_code != op_code && op_code != GATT_RSP_ERROR)) {
-    LOG(WARNING) << StringPrintf(
-        "ATT - Ignore wrong response. Receives (%02x) Request(%02x) Ignored",
-        op_code, rsp_code);
+  if (!p_clcb) {
+    LOG_WARN("ATT - clcb already not in use, ignoring response");
+    gatt_cl_send_next_cmd_inq(tcb);
     return;
   }
 
-  if (!p_clcb->in_use) {
-    LOG(WARNING) << "ATT - clcb already not in use, ignoring response";
+  uint8_t rsp_code = gatt_cmd_to_rsp_code(cmd_code);
+  if (!p_clcb) {
+    LOG_WARN("ATT - clcb already not in use, ignoring response");
     gatt_cl_send_next_cmd_inq(tcb);
     return;
   }
 
+  if (rsp_code != op_code && op_code != GATT_RSP_ERROR) {
+    LOG(WARNING) << StringPrintf(
+        "ATT - Ignore wrong response. Receives (%02x) Request(%02x) Ignored",
+        op_code, rsp_code);
+    return;
+  }
+
   gatt_stop_rsp_timer(p_clcb);
   p_clcb->retry_count = 0;
 
diff --git a/system/stack/gatt/gatt_db.cc b/system/stack/gatt/gatt_db.cc
index 453825e..833796c 100644
--- a/system/stack/gatt/gatt_db.cc
+++ b/system/stack/gatt/gatt_db.cc
@@ -239,7 +239,6 @@
     *p_len = 2;
 
     if (mtu < *p_len) {
-      android_errorWriteWithInfoLog(0x534e4554, "228078096", -1, NULL, 0);
       return GATT_NO_RESOURCES;
     }
 
diff --git a/system/stack/gatt/gatt_int.h b/system/stack/gatt/gatt_int.h
index 1e9e7e1..fa173f5 100644
--- a/system/stack/gatt/gatt_int.h
+++ b/system/stack/gatt/gatt_int.h
@@ -23,6 +23,7 @@
 #include <base/strings/stringprintf.h>
 #include <string.h>
 
+#include <deque>
 #include <list>
 #include <queue>
 #include <unordered_set>
@@ -258,6 +259,8 @@
 }
 #undef CASE_RETURN_TEXT
 
+// If you change these values make sure to look at b/262219144 before.
+// Some platform rely on this to never changes
 #define GATT_GATT_START_HANDLE 1
 #define GATT_GAP_START_HANDLE 20
 #define GATT_GMCS_START_HANDLE 40
@@ -265,14 +268,6 @@
 #define GATT_TMAS_START_HANDLE 130
 #define GATT_APP_START_HANDLE 134
 
-#ifndef GATT_DEFAULT_START_HANDLE
-#define GATT_DEFAULT_START_HANDLE GATT_GATT_START_HANDLE
-#endif
-
-#ifndef GATT_LAST_HANDLE
-#define GATT_LAST_HANDLE 0xFFFF
-#endif
-
 typedef struct hdl_cfg {
   uint16_t gatt_start_hdl;
   uint16_t gap_start_hdl;
@@ -303,7 +298,7 @@
 } tGATT_SRV_LIST_ELEM;
 
 typedef struct {
-  std::queue<tGATT_CLCB*> pending_enc_clcb; /* pending encryption channel q */
+  std::deque<tGATT_CLCB*> pending_enc_clcb; /* pending encryption channel q */
   tGATT_SEC_ACTION sec_act;
   RawAddress peer_bda;
   tBT_TRANSPORT transport;
@@ -330,7 +325,7 @@
   uint8_t prep_cnt[GATT_MAX_APPS];
   uint8_t ind_count;
 
-  std::queue<tGATT_CMD_Q> cl_cmd_q;
+  std::deque<tGATT_CMD_Q> cl_cmd_q;
   alarm_t* ind_ack_timer; /* local app confirm to indication timer */
 
   // TODO(hylo): support byte array data
@@ -369,7 +364,6 @@
   tGATT_STATUS status;     /* operation status */
   bool first_read_blob_after_read;
   tGATT_READ_INC_UUID128 read_uuid128;
-  bool in_use;
   alarm_t* gatt_rsp_timer_ent; /* peer response timer */
   uint8_t retry_count;
   uint16_t read_req_current_mtu; /* This is the MTU value that the read was
@@ -416,7 +410,14 @@
 
   fixed_queue_t* srv_chg_clt_q; /* service change clients queue */
   tGATT_REG cl_rcb[GATT_MAX_APPS];
-  tGATT_CLCB clcb[GATT_CL_MAX_LCB]; /* connection link control block*/
+
+  /* list of connection link control blocks.
+   * Since clcbs are also keep in the channels (ATT and EATT) queues while
+   * processing, we want to make sure that references to elements are not
+   * invalidated when elements are added or removed from the list. This is why
+   * std::list is used.
+   */
+  std::list<tGATT_CLCB> clcb_queue;
 
 #if (GATT_CONFORMANCE_TESTING == TRUE)
   bool enable_err_rsp;
@@ -445,6 +446,7 @@
   tGATT_APPL_INFO cb_info;
 
   tGATT_HDL_CFG hdl_cfg;
+  bool over_br_enabled;
 } tGATT_CB;
 
 #define GATT_SIZE_OF_SRV_CHG_HNDL_RANGE 4
@@ -586,6 +588,7 @@
 extern uint16_t gatt_tcb_get_att_cid(tGATT_TCB& tcb, bool eatt_support);
 extern uint16_t gatt_tcb_get_payload_size_tx(tGATT_TCB& tcb, uint16_t cid);
 extern uint16_t gatt_tcb_get_payload_size_rx(tGATT_TCB& tcb, uint16_t cid);
+extern void gatt_clcb_invalidate(tGATT_TCB* p_tcb, const tGATT_CLCB* p_clcb);
 extern void gatt_clcb_dealloc(tGATT_CLCB* p_clcb);
 
 extern void gatt_sr_copy_prep_cnt_to_cback_cnt(tGATT_TCB& p_tcb);
@@ -637,6 +640,7 @@
                                           uint8_t* p_data);
 extern void gatt_send_queue_write_cancel(tGATT_TCB& tcb, tGATT_CLCB* p_clcb,
                                          tGATT_EXEC_FLAG flag);
+extern bool gatt_is_outstanding_msg_in_att_send_queue(const tGATT_TCB& tcb);
 
 /* gatt_auth.cc */
 extern bool gatt_security_check_start(tGATT_CLCB* p_clcb);
diff --git a/system/stack/gatt/gatt_main.cc b/system/stack/gatt/gatt_main.cc
index 6fef443..b9d1120 100644
--- a/system/stack/gatt/gatt_main.cc
+++ b/system/stack/gatt/gatt_main.cc
@@ -22,15 +22,19 @@
  *
  ******************************************************************************/
 
+#include <base/logging.h>
+
 #include "bt_target.h"
 #include "bt_utils.h"
 #include "btif/include/btif_storage.h"
 #include "connection_manager.h"
 #include "device/include/interop.h"
+#include "gd/common/init_flags.h"
 #include "internal_include/stack_config.h"
 #include "l2c_api.h"
 #include "osi/include/allocator.h"
 #include "osi/include/osi.h"
+#include "osi/include/properties.h"
 #include "stack/btm/btm_ble_int.h"
 #include "stack/btm/btm_dev.h"
 #include "stack/btm/btm_sec.h"
@@ -40,8 +44,6 @@
 #include "stack/include/l2cap_acl_interface.h"
 #include "types/raw_address.h"
 
-#include <base/logging.h>
-
 using base::StringPrintf;
 using bluetooth::eatt::EattExtension;
 
@@ -113,12 +115,19 @@
   fixed_reg.pL2CA_FixedConn_Cb = gatt_le_connect_cback;
   fixed_reg.pL2CA_FixedData_Cb = gatt_le_data_ind;
   fixed_reg.pL2CA_FixedCong_Cb = gatt_le_cong_cback; /* congestion callback */
-  fixed_reg.default_idle_tout = 0xffff; /* 0xffff default idle timeout */
+
+  // the GATT timeout is updated after a connection
+  // is established, when we know whether any
+  // clients exist
+  fixed_reg.default_idle_tout = L2CAP_NO_IDLE_TIMEOUT;
 
   L2CA_RegisterFixedChannel(L2CAP_ATT_CID, &fixed_reg);
 
+  gatt_cb.over_br_enabled =
+      osi_property_get_bool("bluetooth.gatt.over_bredr.enabled", true);
   /* Now, register with L2CAP for ATT PSM over BR/EDR */
-  if (!L2CA_Register2(BT_PSM_ATT, dyn_info, false /* enable_snoop */, nullptr,
+  if (gatt_cb.over_br_enabled &&
+      !L2CA_Register2(BT_PSM_ATT, dyn_info, false /* enable_snoop */, nullptr,
                       GATT_MAX_MTU_SIZE, 0, BTM_SEC_NONE)) {
     LOG(ERROR) << "ATT Dynamic Registration failed";
   }
@@ -155,7 +164,7 @@
   fixed_queue_free(gatt_cb.srv_chg_clt_q, NULL);
   gatt_cb.srv_chg_clt_q = NULL;
   for (i = 0; i < GATT_MAX_PHY_CHANNEL; i++) {
-    gatt_cb.tcb[i].pending_enc_clcb = std::queue<tGATT_CLCB*>();
+    gatt_cb.tcb[i].pending_enc_clcb = std::deque<tGATT_CLCB*>();
 
     fixed_queue_free(gatt_cb.tcb[i].pending_ind_q, NULL);
     gatt_cb.tcb[i].pending_ind_q = NULL;
@@ -372,7 +381,7 @@
                p_tcb->peer_bda.ToString().c_str());
       /* acl link is connected disable the idle timeout */
       GATT_SetIdleTimeout(p_tcb->peer_bda, GATT_LINK_NO_IDLE_TIMEOUT,
-                          p_tcb->transport);
+                          p_tcb->transport, true /* is_active */);
     } else {
       LOG_INFO("invalid handle %d or dynamic CID %d", is_valid_handle,
                p_tcb->att_lcid);
@@ -391,7 +400,7 @@
             "%d seconds",
             GATT_LINK_IDLE_TIMEOUT_WHEN_NO_APP);
         GATT_SetIdleTimeout(p_tcb->peer_bda, GATT_LINK_IDLE_TIMEOUT_WHEN_NO_APP,
-                            p_tcb->transport);
+                            p_tcb->transport, false /* is_active */);
       } else {
         // disconnect the dynamic channel
         LOG_INFO("disconnect GATT dynamic channel");
@@ -815,11 +824,18 @@
   /* Remove the direct connection */
   connection_manager::on_connection_complete(p_tcb->peer_bda);
 
-  if (!p_tcb->app_hold_link.empty() && p_tcb->att_lcid == L2CAP_ATT_CID) {
-    /* disable idle timeout if one or more clients are holding the link disable
-     * the idle timer */
-    GATT_SetIdleTimeout(p_tcb->peer_bda, GATT_LINK_NO_IDLE_TIMEOUT,
-                        p_tcb->transport);
+  if (p_tcb->att_lcid == L2CAP_ATT_CID) {
+    if (!p_tcb->app_hold_link.empty()) {
+      /* disable idle timeout if one or more clients are holding the link
+       * disable the idle timer */
+      GATT_SetIdleTimeout(p_tcb->peer_bda, GATT_LINK_NO_IDLE_TIMEOUT,
+                          p_tcb->transport, true /* is_active */);
+    } else {
+      if (bluetooth::common::init_flags::finite_att_timeout_is_enabled()) {
+        GATT_SetIdleTimeout(p_tcb->peer_bda, GATT_LINK_IDLE_TIMEOUT_WHEN_NO_APP,
+                            p_tcb->transport, false /* is_active */);
+      }
+    }
   }
 }
 
@@ -893,6 +909,13 @@
 /** This function is called to send a service chnaged indication to the
  * specified bd address */
 void gatt_send_srv_chg_ind(const RawAddress& peer_bda) {
+  static const uint16_t sGATT_DEFAULT_START_HANDLE =
+      (uint16_t)osi_property_get_int32(
+          "bluetooth.gatt.default_start_handle_for_srvc_change.value",
+          GATT_GATT_START_HANDLE);
+  static const uint16_t sGATT_LAST_HANDLE = (uint16_t)osi_property_get_int32(
+      "bluetooth.gatt.last_handle_for_srvc_change.value", 0xFFFF);
+
   VLOG(1) << __func__;
 
   if (!gatt_cb.handle_of_h_r) return;
@@ -905,8 +928,8 @@
 
   uint8_t handle_range[GATT_SIZE_OF_SRV_CHG_HNDL_RANGE];
   uint8_t* p = handle_range;
-  UINT16_TO_STREAM(p, GATT_DEFAULT_START_HANDLE);
-  UINT16_TO_STREAM(p, GATT_LAST_HANDLE);
+  UINT16_TO_STREAM(p, sGATT_DEFAULT_START_HANDLE);
+  UINT16_TO_STREAM(p, sGATT_LAST_HANDLE);
   GATTS_HandleValueIndication(conn_id, gatt_cb.handle_of_h_r,
                               GATT_SIZE_OF_SRV_CHG_HNDL_RANGE, handle_range);
 }
diff --git a/system/stack/gatt/gatt_sr.cc b/system/stack/gatt/gatt_sr.cc
index 903cdaa..9f48d83 100644
--- a/system/stack/gatt/gatt_sr.cc
+++ b/system/stack/gatt/gatt_sr.cc
@@ -363,7 +363,6 @@
 #endif
 
   if (len < sizeof(flag)) {
-    android_errorWriteLog(0x534e4554, "73172115");
     LOG(ERROR) << __func__ << "invalid length";
     gatt_send_error_rsp(tcb, cid, GATT_INVALID_PDU, GATT_REQ_EXEC_WRITE, 0,
                         false);
@@ -1041,7 +1040,6 @@
     /* Error: packet length is too short */
     LOG(ERROR) << __func__ << ": packet length=" << len
                << " too short. min=" << sizeof(uint16_t);
-    android_errorWriteWithInfoLog(0x534e4554, "73172115", -1, NULL, 0);
     gatt_send_error_rsp(tcb, cid, GATT_INVALID_PDU, op_code, 0, false);
     return;
   }
diff --git a/system/stack/gatt/gatt_utils.cc b/system/stack/gatt/gatt_utils.cc
index 4c5bd49..d65b6d6 100644
--- a/system/stack/gatt/gatt_utils.cc
+++ b/system/stack/gatt/gatt_utils.cc
@@ -27,6 +27,7 @@
 #include <base/strings/stringprintf.h>
 
 #include <cstdint>
+#include <deque>
 
 #include "bt_target.h"  // Must be first to define build configuration
 #include "osi/include/allocator.h"
@@ -948,38 +949,6 @@
 
 /*******************************************************************************
  *
- * Function         gatt_is_clcb_allocated
- *
- * Description      The function check clcb for conn_id is allocated or not
- *
- * Returns           True already allocated
- *
- ******************************************************************************/
-
-bool gatt_is_clcb_allocated(uint16_t conn_id) {
-  uint8_t i = 0;
-  uint8_t num_of_allocated = 0;
-  tGATT_IF gatt_if = GATT_GET_GATT_IF(conn_id);
-  uint8_t tcb_idx = GATT_GET_TCB_IDX(conn_id);
-  tGATT_TCB* p_tcb = gatt_get_tcb_by_idx(tcb_idx);
-  tGATT_REG* p_reg = gatt_get_regcb(gatt_if);
-  int possible_plcb = 1;
-
-  if (p_reg->eatt_support) possible_plcb += p_tcb->eatt;
-
-  /* With eatt number of active clcbs can me up to 1 + number of eatt channels
-   */
-  for (i = 0; i < GATT_CL_MAX_LCB; i++) {
-    if (gatt_cb.clcb[i].in_use && (gatt_cb.clcb[i].conn_id == conn_id)) {
-      if (++num_of_allocated == possible_plcb) return true;
-    }
-  }
-
-  return false;
-}
-
-/*******************************************************************************
- *
  * Function         gatt_tcb_is_cid_busy
  *
  * Description      The function check if channel with given cid is busy
@@ -1008,29 +977,30 @@
  *
  ******************************************************************************/
 tGATT_CLCB* gatt_clcb_alloc(uint16_t conn_id) {
-  uint8_t i = 0;
-  tGATT_CLCB* p_clcb = NULL;
+  tGATT_CLCB clcb = {};
   tGATT_IF gatt_if = GATT_GET_GATT_IF(conn_id);
   uint8_t tcb_idx = GATT_GET_TCB_IDX(conn_id);
   tGATT_TCB* p_tcb = gatt_get_tcb_by_idx(tcb_idx);
   tGATT_REG* p_reg = gatt_get_regcb(gatt_if);
 
-  for (i = 0; i < GATT_CL_MAX_LCB; i++) {
-    if (!gatt_cb.clcb[i].in_use) {
-      p_clcb = &gatt_cb.clcb[i];
+  clcb.conn_id = conn_id;
+  clcb.p_reg = p_reg;
+  clcb.p_tcb = p_tcb;
+  /* Use eatt only when clients wants that */
+  clcb.cid = gatt_tcb_get_att_cid(*p_tcb, p_reg->eatt_support);
 
-      p_clcb->in_use = true;
-      p_clcb->conn_id = conn_id;
-      p_clcb->p_reg = p_reg;
-      p_clcb->p_tcb = p_tcb;
+  gatt_cb.clcb_queue.emplace_back(clcb);
+  auto p_clcb = &(gatt_cb.clcb_queue.back());
 
-      /* Use eatt only when clients wants that */
-      p_clcb->cid = gatt_tcb_get_att_cid(*p_tcb, p_reg->eatt_support);
-
-      break;
-    }
+  if (gatt_cb.clcb_queue.size() > GATT_CL_MAX_LCB) {
+    /* GATT_CL_MAX_LCB is here from the historical reasons. We believe this
+     * limitation is not needed. In addition, number of clcb should not be
+     * bigger than that and also if it is bigger, we  believe it should not
+     * cause the problem. This WARN is just to monitor number of CLCB and will
+     * help in debugging in case we are wrong */
+    LOG_WARN("Number of CLCB: %zu > %d", gatt_cb.clcb_queue.size(),
+             GATT_CL_MAX_LCB);
   }
-
   return p_clcb;
 }
 
@@ -1166,14 +1136,81 @@
  *
  ******************************************************************************/
 void gatt_clcb_dealloc(tGATT_CLCB* p_clcb) {
-  if (p_clcb && p_clcb->in_use) {
+  if (p_clcb) {
     alarm_free(p_clcb->gatt_rsp_timer_ent);
-    memset(p_clcb, 0, sizeof(tGATT_CLCB));
+    gatt_clcb_invalidate(p_clcb->p_tcb, p_clcb);
+    for (auto clcb_it = gatt_cb.clcb_queue.begin();
+         clcb_it != gatt_cb.clcb_queue.end(); clcb_it++) {
+      if (&(*clcb_it) == p_clcb) {
+        gatt_cb.clcb_queue.erase(clcb_it);
+        return;
+      }
+    }
   }
 }
 
 /*******************************************************************************
  *
+ * Function         gatt_clcb_invalidate
+ *
+ * Description      The function invalidates already scheduled p_clcb.
+ *
+ * Returns         None
+ *
+ ******************************************************************************/
+void gatt_clcb_invalidate(tGATT_TCB* p_tcb, const tGATT_CLCB* p_clcb) {
+  std::deque<tGATT_CMD_Q>* cl_cmd_q_p;
+  uint16_t cid = p_clcb->cid;
+
+  if (!p_tcb->pending_enc_clcb.empty()) {
+    for (size_t i = 0; i < p_tcb->pending_enc_clcb.size(); i++) {
+      if (p_tcb->pending_enc_clcb.at(i) == p_clcb) {
+        LOG_WARN("Removing clcb (%p) for conn id=0x%04x from pending_enc_clcb",
+                 p_clcb, p_clcb->conn_id);
+        p_tcb->pending_enc_clcb.at(i) = NULL;
+        break;
+      }
+    }
+  }
+
+  if (cid == p_tcb->att_lcid) {
+    cl_cmd_q_p = &p_tcb->cl_cmd_q;
+  } else {
+    EattChannel* channel = EattExtension::GetInstance()->FindEattChannelByCid(
+        p_tcb->peer_bda, cid);
+    if (channel == nullptr) {
+      return;
+    }
+    cl_cmd_q_p = &channel->cl_cmd_q_;
+  }
+
+  if (cl_cmd_q_p->empty()) {
+    return;
+  }
+
+  auto iter = std::find_if(cl_cmd_q_p->begin(), cl_cmd_q_p->end(),
+                           [p_clcb](auto& el) { return el.p_clcb == p_clcb; });
+
+  if (iter == cl_cmd_q_p->end()) {
+    return;
+  }
+
+  if (iter->to_send) {
+    /* If command was not send, just remove the entire element */
+    cl_cmd_q_p->erase(iter);
+    LOG_WARN("Removing scheduled clcb (%p) for conn_id=0x%04x", p_clcb,
+             p_clcb->conn_id);
+  } else {
+    /* If command has been sent, just invalidate p_clcb pointer for proper
+     * response handling */
+    iter->p_clcb = NULL;
+    LOG_WARN(
+        "Invalidating clcb (%p) for already sent request on conn_id=0x%04x",
+        p_clcb, p_clcb->conn_id);
+  }
+}
+/*******************************************************************************
+ *
  * Function         gatt_find_tcb_by_cid
  *
  * Description      The function searches for an empty entry
@@ -1208,10 +1245,10 @@
  *
  ******************************************************************************/
 uint8_t gatt_num_clcb_by_bd_addr(const RawAddress& bda) {
-  uint8_t i, num = 0;
+  uint8_t num = 0;
 
-  for (i = 0; i < GATT_CL_MAX_LCB; i++) {
-    if (gatt_cb.clcb[i].in_use && gatt_cb.clcb[i].p_tcb->peer_bda == bda) num++;
+  for (auto const& clcb : gatt_cb.clcb_queue) {
+    if (clcb.p_tcb->peer_bda == bda) num++;
   }
   return num;
 }
@@ -1429,11 +1466,18 @@
   }
 
   if (!connection_manager::direct_connect_remove(gatt_if, bda)) {
-    BTM_AcceptlistRemove(bda);
-    LOG_INFO(
-        "GATT connection manager has no record but removed filter acceptlist "
-        "gatt_if:%hhu peer:%s",
-        gatt_if, PRIVATE_ADDRESS(bda));
+    if (!connection_manager::is_background_connection(bda)) {
+      BTM_AcceptlistRemove(bda);
+      LOG_INFO(
+          "Gatt connection manager has no background record but "
+          " removed filter acceptlist gatt_if:%hhu peer:%s",
+          gatt_if, PRIVATE_ADDRESS(bda));
+    } else {
+      LOG_INFO(
+          "Gatt connection manager maintains a background record"
+          " preserving filter acceptlist gatt_if:%hhu peer:%s",
+          gatt_if, PRIVATE_ADDRESS(bda));
+    }
   }
   return true;
 }
@@ -1449,18 +1493,18 @@
   cmd.cid = p_clcb->cid;
 
   if (p_clcb->cid == tcb.att_lcid) {
-    tcb.cl_cmd_q.push(cmd);
+    tcb.cl_cmd_q.push_back(cmd);
   } else {
     EattChannel* channel =
         EattExtension::GetInstance()->FindEattChannelByCid(tcb.peer_bda, cmd.cid);
     CHECK(channel);
-    channel->cl_cmd_q_.push(cmd);
+    channel->cl_cmd_q_.push_back(cmd);
   }
 }
 
 /** dequeue the command in the client CCB command queue */
 tGATT_CLCB* gatt_cmd_dequeue(tGATT_TCB& tcb, uint16_t cid, uint8_t* p_op_code) {
-  std::queue<tGATT_CMD_Q>* cl_cmd_q_p;
+  std::deque<tGATT_CMD_Q>* cl_cmd_q_p;
 
   if (cid == tcb.att_lcid) {
     cl_cmd_q_p = &tcb.cl_cmd_q;
@@ -1476,8 +1520,16 @@
   tGATT_CMD_Q cmd = cl_cmd_q_p->front();
   tGATT_CLCB* p_clcb = cmd.p_clcb;
   *p_op_code = cmd.op_code;
-  p_clcb->cid = cid;
-  cl_cmd_q_p->pop();
+
+  /* Note: If GATT client deregistered while the ATT request was on the way to
+   * peer, device p_clcb will be null.
+   */
+  if (p_clcb && p_clcb->cid != cid) {
+    LOG_WARN(" CID does not match (%d!=%d), conn_id=0x%04x", p_clcb->cid, cid,
+             p_clcb->conn_id);
+  }
+
+  cl_cmd_q_p->pop_front();
 
   return p_clcb;
 }
@@ -1498,6 +1550,18 @@
 
 /*******************************************************************************
  *
+ * Function         gatt_is_outstanding_msg_in_att_send_queue
+ *
+ * Description      checks if there is message on the ATT fixed channel to send
+ *
+ * Returns          true: on success; false otherwise
+ *
+ ******************************************************************************/
+bool gatt_is_outstanding_msg_in_att_send_queue(const tGATT_TCB& tcb) {
+  return (!tcb.cl_cmd_q.empty() && (tcb.cl_cmd_q.front()).to_send);
+}
+/*******************************************************************************
+ *
  * Function         gatt_end_operation
  *
  * Description      This function ends a discovery, send callback and finalize
@@ -1585,20 +1649,32 @@
   }
 
   gatt_set_ch_state(p_tcb, GATT_CH_CLOSE);
-  for (uint8_t i = 0; i < GATT_CL_MAX_LCB; i++) {
-    tGATT_CLCB* p_clcb = &gatt_cb.clcb[i];
-    if (!p_clcb->in_use || p_clcb->p_tcb != p_tcb) continue;
 
-    gatt_stop_rsp_timer(p_clcb);
-    VLOG(1) << "found p_clcb conn_id=" << +p_clcb->conn_id;
-    if (p_clcb->operation == GATTC_OPTYPE_NONE) {
-      gatt_clcb_dealloc(p_clcb);
+  /* Notify EATT about disconnection. */
+  EattExtension::GetInstance()->Disconnect(p_tcb->peer_bda);
+
+  for (auto clcb_it = gatt_cb.clcb_queue.begin();
+       clcb_it != gatt_cb.clcb_queue.end();) {
+    if (clcb_it->p_tcb != p_tcb) {
+      ++clcb_it;
       continue;
     }
 
+    gatt_stop_rsp_timer(&(*clcb_it));
+    VLOG(1) << "found p_clcb conn_id=" << +clcb_it->conn_id;
+    if (clcb_it->operation == GATTC_OPTYPE_NONE) {
+      clcb_it = gatt_cb.clcb_queue.erase(clcb_it);
+      continue;
+    }
+
+    tGATT_CLCB* p_clcb = &(*clcb_it);
+    ++clcb_it;
     gatt_end_operation(p_clcb, GATT_ERROR, NULL);
   }
 
+  /* Remove the outstanding ATT commnads if any */
+  p_tcb->cl_cmd_q.clear();
+
   alarm_free(p_tcb->ind_ack_timer);
   p_tcb->ind_ack_timer = NULL;
   alarm_free(p_tcb->conf_timer);
diff --git a/system/stack/hid/hidd_conn.cc b/system/stack/hid/hidd_conn.cc
index da78d40..fc0a245 100644
--- a/system/stack/hid/hidd_conn.cc
+++ b/system/stack/hid/hidd_conn.cc
@@ -27,6 +27,7 @@
 
 #include "bta/include/bta_api.h"
 #include "btif/include/btif_hd.h"
+#include "gd/common/init_flags.h"
 #include "osi/include/allocator.h"
 #include "stack/hid/hidd_int.h"
 #include "stack/include/bt_hdr.h"
@@ -347,7 +348,6 @@
 static void hidd_l2cif_disconnect(uint16_t cid) {
   L2CA_DisconnectReq(cid);
 
-
   HIDD_TRACE_EVENT("%s: cid=%04x", __func__, cid);
 
   tHID_CONN* p_hcon = &hd_cb.device.conn;
@@ -365,6 +365,10 @@
 
     // now disconnect CTRL
     L2CA_DisconnectReq(p_hcon->ctrl_cid);
+    if (bluetooth::common::init_flags::
+            clear_hidd_interrupt_cid_on_disconnect_is_enabled()) {
+      p_hcon->ctrl_cid = 0;
+    }
   }
 
   if ((p_hcon->ctrl_cid == 0) && (p_hcon->intr_cid == 0)) {
diff --git a/system/stack/hid/hidh_conn.cc b/system/stack/hid/hidh_conn.cc
index 1730a8e..c88409d 100644
--- a/system/stack/hid/hidh_conn.cc
+++ b/system/stack/hid/hidh_conn.cc
@@ -656,7 +656,6 @@
     HIDH_TRACE_WARNING("Rcvd L2CAP data, invalid length %d, should be >= 1",
                        p_msg->len);
     osi_free(p_msg);
-    android_errorWriteLog(0x534e4554, "80493272");
     return;
   }
 
diff --git a/system/stack/include/a2dp_error_codes.h b/system/stack/include/a2dp_error_codes.h
index 0aa7105..ae5e26a 100644
--- a/system/stack/include/a2dp_error_codes.h
+++ b/system/stack/include/a2dp_error_codes.h
@@ -128,6 +128,9 @@
  */
 #define A2DP_BAD_CP_FORMAT 0xE1
 
+/* Invalid framesize */
+#define A2DP_NS_FRAMESIZE 0xE2
+
 typedef uint8_t tA2DP_STATUS;
 
 #endif  // A2DP_ERROR_CODES_H
diff --git a/system/stack/include/a2dp_vendor.h b/system/stack/include/a2dp_vendor.h
index f2b6feb..b8bf9de 100644
--- a/system/stack/include/a2dp_vendor.h
+++ b/system/stack/include/a2dp_vendor.h
@@ -220,25 +220,4 @@
 // Returns a string describing the codec information.
 std::string A2DP_VendorCodecInfoString(const uint8_t* p_codec_info);
 
-// Try to dlopen external codec library
-//
-// |lib_name| is the name of the library to load
-// |friendly_name| is only use for logging purpose
-// Return pointer to the handle if the library is successfully dlopen,
-// nullptr otherwise
-void* A2DP_VendorCodecLoadExternalLib(const std::string& lib_name,
-                                      const std::string& friendly_name);
-
-#define LOAD_CODEC_SYMBOL(codec_name, handle, error_fn, symbol_name, api_type) \
-  ({                                                                           \
-    void* load_sym = dlsym(handle, symbol_name.c_str());                       \
-    if (load_sym == NULL) {                                                    \
-      LOG_ERROR("Cannot find function '%s' in the '%s' encoder library: %s",   \
-                symbol_name.c_str(), codec_name, dlerror());                   \
-      error_fn();                                                              \
-      return LOAD_ERROR_VERSION_MISMATCH;                                      \
-    }                                                                          \
-    (api_type) load_sym;                                                       \
-  })
-
 #endif  // A2DP_VENDOR_H
diff --git a/system/stack/include/a2dp_vendor_opus.h b/system/stack/include/a2dp_vendor_opus.h
new file mode 100644
index 0000000..08a0b7b
--- /dev/null
+++ b/system/stack/include/a2dp_vendor_opus.h
@@ -0,0 +1,255 @@
+/*
+ * Copyright 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+//
+// A2DP Codec API for Opus
+//
+
+#ifndef A2DP_VENDOR_OPUS_H
+#define A2DP_VENDOR_OPUS_H
+
+#include "a2dp_codec_api.h"
+#include "a2dp_vendor_opus_constants.h"
+#include "avdt_api.h"
+
+class A2dpCodecConfigOpusBase : public A2dpCodecConfig {
+ protected:
+  A2dpCodecConfigOpusBase(btav_a2dp_codec_index_t codec_index,
+                          const std::string& name,
+                          btav_a2dp_codec_priority_t codec_priority,
+                          bool is_source)
+      : A2dpCodecConfig(codec_index, name, codec_priority),
+        is_source_(is_source) {}
+  bool setCodecConfig(const uint8_t* p_peer_codec_info, bool is_capability,
+                      uint8_t* p_result_codec_config) override;
+  bool setPeerCodecCapabilities(
+      const uint8_t* p_peer_codec_capabilities) override;
+
+ private:
+  bool is_source_;  // True if local is Source
+};
+
+class A2dpCodecConfigOpusSource : public A2dpCodecConfigOpusBase {
+ public:
+  A2dpCodecConfigOpusSource(btav_a2dp_codec_priority_t codec_priority);
+  virtual ~A2dpCodecConfigOpusSource();
+
+  bool init() override;
+  uint64_t encoderIntervalMs() const;
+
+ private:
+  bool useRtpHeaderMarkerBit() const override;
+  bool updateEncoderUserConfig(
+      const tA2DP_ENCODER_INIT_PEER_PARAMS* p_peer_params,
+      bool* p_restart_input, bool* p_restart_output, bool* p_config_updated);
+  void debug_codec_dump(int fd) override;
+};
+
+class A2dpCodecConfigOpusSink : public A2dpCodecConfigOpusBase {
+ public:
+  A2dpCodecConfigOpusSink(btav_a2dp_codec_priority_t codec_priority);
+  virtual ~A2dpCodecConfigOpusSink();
+
+  bool init() override;
+  uint64_t encoderIntervalMs() const;
+
+ private:
+  bool useRtpHeaderMarkerBit() const override;
+  bool updateEncoderUserConfig(
+      const tA2DP_ENCODER_INIT_PEER_PARAMS* p_peer_params,
+      bool* p_restart_input, bool* p_restart_output, bool* p_config_updated);
+};
+
+// Checks whether the codec capabilities contain a valid A2DP Opus Source
+// codec.
+// NOTE: only codecs that are implemented are considered valid.
+// Returns true if |p_codec_info| contains information about a valid Opus
+// codec, otherwise false.
+bool A2DP_IsVendorSourceCodecValidOpus(const uint8_t* p_codec_info);
+
+// Checks whether the codec capabilities contain a valid A2DP Opus Sink
+// codec.
+// NOTE: only codecs that are implemented are considered valid.
+// Returns true if |p_codec_info| contains information about a valid Opus
+// codec, otherwise false.
+bool A2DP_IsVendorSinkCodecValidOpus(const uint8_t* p_codec_info);
+
+// Checks whether the codec capabilities contain a valid peer A2DP Opus Sink
+// codec.
+// NOTE: only codecs that are implemented are considered valid.
+// Returns true if |p_codec_info| contains information about a valid Opus
+// codec, otherwise false.
+bool A2DP_IsVendorPeerSinkCodecValidOpus(const uint8_t* p_codec_info);
+
+// Checks whether the codec capabilities contain a valid peer A2DP Opus Source
+// codec.
+// NOTE: only codecs that are implemented are considered valid.
+// Returns true if |p_codec_info| contains information about a valid Opus
+// codec, otherwise false.
+bool A2DP_IsVendorPeerSourceCodecValidOpus(const uint8_t* p_codec_info);
+
+// Checks whether A2DP Opus Sink codec is supported.
+// |p_codec_info| contains information about the codec capabilities.
+// Returns true if the A2DP Opus Sink codec is supported, otherwise false.
+bool A2DP_IsVendorSinkCodecSupportedOpus(const uint8_t* p_codec_info);
+
+// Checks whether an A2DP Opus Source codec for a peer Source device is
+// supported.
+// |p_codec_info| contains information about the codec capabilities of the
+// peer device.
+// Returns true if the A2DP Opus Source codec for a peer Source device is
+// supported, otherwise false.
+bool A2DP_IsPeerSourceCodecSupportedOpus(const uint8_t* p_codec_info);
+
+// Checks whether the A2DP data packets should contain RTP header.
+// |content_protection_enabled| is true if Content Protection is
+// enabled. |p_codec_info| contains information about the codec capabilities.
+// Returns true if the A2DP data packets should contain RTP header, otherwise
+// false.
+bool A2DP_VendorUsesRtpHeaderOpus(bool content_protection_enabled,
+                                  const uint8_t* p_codec_info);
+
+// Gets the A2DP Opus codec name for a given |p_codec_info|.
+const char* A2DP_VendorCodecNameOpus(const uint8_t* p_codec_info);
+
+// Checks whether two A2DP Opus codecs |p_codec_info_a| and |p_codec_info_b|
+// have the same type.
+// Returns true if the two codecs have the same type, otherwise false.
+bool A2DP_VendorCodecTypeEqualsOpus(const uint8_t* p_codec_info_a,
+                                    const uint8_t* p_codec_info_b);
+
+// Checks whether two A2DP Opus codecs |p_codec_info_a| and |p_codec_info_b|
+// are exactly the same.
+// Returns true if the two codecs are exactly the same, otherwise false.
+// If the codec type is not Opus, the return value is false.
+bool A2DP_VendorCodecEqualsOpus(const uint8_t* p_codec_info_a,
+                                const uint8_t* p_codec_info_b);
+
+// Gets the track sample rate value for the A2DP Opus codec.
+// |p_codec_info| is a pointer to the Opus codec_info to decode.
+// Returns the track sample rate on success, or -1 if |p_codec_info|
+// contains invalid codec information.
+int A2DP_VendorGetTrackSampleRateOpus(const uint8_t* p_codec_info);
+
+// Gets the track bits per sample value for the A2DP Opus codec.
+// |p_codec_info| is a pointer to the Opus codec_info to decode.
+// Returns the track bits per sample on success, or -1 if |p_codec_info|
+// contains invalid codec information.
+int A2DP_VendorGetTrackBitsPerSampleOpus(const uint8_t* p_codec_info);
+
+// Gets the track bitrate value for the A2DP Opus codec.
+// |p_codec_info| is a pointer to the Opus codec_info to decode.
+// Returns the track sample rate on success, or -1 if |p_codec_info|
+// contains invalid codec information.
+int A2DP_VendorGetBitRateOpus(const uint8_t* p_codec_info);
+
+// Gets the channel count for the A2DP Opus codec.
+// |p_codec_info| is a pointer to the Opus codec_info to decode.
+// Returns the channel count on success, or -1 if |p_codec_info|
+// contains invalid codec information.
+int A2DP_VendorGetTrackChannelCountOpus(const uint8_t* p_codec_info);
+
+// Gets the channel type for the A2DP Opus codec.
+// 1 for mono, or 3 for dual channel/stereo.
+// |p_codec_info| is a pointer to the Opus codec_info to decode.
+// Returns the channel count on success, or -1 if |p_codec_info|
+// contains invalid codec information.
+int A2DP_VendorGetSinkTrackChannelTypeOpus(const uint8_t* p_codec_info);
+
+// Gets the channel mode code for the A2DP Opus codec.
+// The actual value is codec-specific - see |A2DP_OPUS_CHANNEL_MODE_*|.
+// |p_codec_info| is a pointer to the Opus codec_info to decode.
+// Returns the channel mode code on success, or -1 if |p_codec_info|
+// contains invalid codec information.
+int A2DP_VendorGetChannelModeCodeOpus(const uint8_t* p_codec_info);
+
+// Gets the framesize value (in ms) for the A2DP Opus codec.
+// |p_codec_info| is a pointer to the Opus codec_info to decode.
+// Returns the framesize on success, or -1 if |p_codec_info|
+// contains invalid codec information.
+int A2DP_VendorGetFrameSizeOpus(const uint8_t* p_codec_info);
+
+// Gets the A2DP Opus audio data timestamp from an audio packet.
+// |p_codec_info| contains the codec information.
+// |p_data| contains the audio data.
+// The timestamp is stored in |p_timestamp|.
+// Returns true on success, otherwise false.
+bool A2DP_VendorGetPacketTimestampOpus(const uint8_t* p_codec_info,
+                                       const uint8_t* p_data,
+                                       uint32_t* p_timestamp);
+
+// Builds A2DP Opus codec header for audio data.
+// |p_codec_info| contains the codec information.
+// |p_buf| contains the audio data.
+// |frames_per_packet| is the number of frames in this packet.
+// Returns true on success, otherwise false.
+bool A2DP_VendorBuildCodecHeaderOpus(const uint8_t* p_codec_info, BT_HDR* p_buf,
+                                     uint16_t frames_per_packet);
+
+// Decodes A2DP Opus codec info into a human readable string.
+// |p_codec_info| is a pointer to the Opus codec_info to decode.
+// Returns a string describing the codec information.
+std::string A2DP_VendorCodecInfoStringOpus(const uint8_t* p_codec_info);
+
+// Gets the A2DP Opus encoder interface that can be used to encode and prepare
+// A2DP packets for transmission - see |tA2DP_ENCODER_INTERFACE|.
+// |p_codec_info| contains the codec information.
+// Returns the A2DP Opus encoder interface if the |p_codec_info| is valid and
+// supported, otherwise NULL.
+const tA2DP_ENCODER_INTERFACE* A2DP_VendorGetEncoderInterfaceOpus(
+    const uint8_t* p_codec_info);
+
+// Gets the current A2DP Opus decoder interface that can be used to decode
+// received A2DP packets - see |tA2DP_DECODER_INTERFACE|.
+// |p_codec_info| contains the codec information.
+// Returns the A2DP Opus decoder interface if the |p_codec_info| is valid and
+// supported, otherwise NULL.
+const tA2DP_DECODER_INTERFACE* A2DP_VendorGetDecoderInterfaceOpus(
+    const uint8_t* p_codec_info);
+
+// Adjusts the A2DP Opus codec, based on local support and Bluetooth
+// specification.
+// |p_codec_info| contains the codec information to adjust.
+// Returns true if |p_codec_info| is valid and supported, otherwise false.
+bool A2DP_VendorAdjustCodecOpus(uint8_t* p_codec_info);
+
+// Gets the A2DP Opus Source codec index for a given |p_codec_info|.
+// Returns the corresponding |btav_a2dp_codec_index_t| on success,
+// otherwise |BTAV_A2DP_CODEC_INDEX_MAX|.
+btav_a2dp_codec_index_t A2DP_VendorSourceCodecIndexOpus(
+    const uint8_t* p_codec_info);
+
+// Gets the A2DP Opus Sink codec index for a given |p_codec_info|.
+// Returns the corresponding |btav_a2dp_codec_index_t| on success,
+// otherwise |BTAV_A2DP_CODEC_INDEX_MAX|.
+btav_a2dp_codec_index_t A2DP_VendorSinkCodecIndexOpus(
+    const uint8_t* p_codec_info);
+
+// Gets the A2DP Opus Source codec name.
+const char* A2DP_VendorCodecIndexStrOpus(void);
+
+// Gets the A2DP Opus Sink codec name.
+const char* A2DP_VendorCodecIndexStrOpusSink(void);
+
+// Initializes A2DP Opus Source codec information into |AvdtpSepConfig|
+// configuration entry pointed by |p_cfg|.
+bool A2DP_VendorInitCodecConfigOpus(AvdtpSepConfig* p_cfg);
+
+// Initializes A2DP Opus Sink codec information into |AvdtpSepConfig|
+// configuration entry pointed by |p_cfg|.
+bool A2DP_VendorInitCodecConfigOpusSink(AvdtpSepConfig* p_cfg);
+
+#endif  // A2DP_VENDOR_OPUS_H
diff --git a/system/stack/include/a2dp_vendor_opus_constants.h b/system/stack/include/a2dp_vendor_opus_constants.h
new file mode 100644
index 0000000..272b04c
--- /dev/null
+++ b/system/stack/include/a2dp_vendor_opus_constants.h
@@ -0,0 +1,66 @@
+/*
+ * Copyright 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+//
+// A2DP constants for Opus codec
+//
+
+#ifndef A2DP_VENDOR_OPUS_CONSTANTS_H
+#define A2DP_VENDOR_OPUS_CONSTANTS_H
+
+#define A2DP_OPUS_CODEC_LEN 9
+
+#define A2DP_OPUS_CODEC_OUTPUT_CHS 2
+#define A2DP_OPUS_CODEC_DEFAULT_SAMPLERATE 48000
+#define A2DP_OPUS_CODEC_DEFAULT_FRAMESIZE 960
+#define A2DP_OPUS_DECODE_BUFFER_LENGTH \
+  (A2DP_OPUS_CODEC_OUTPUT_CHS * A2DP_OPUS_CODEC_DEFAULT_FRAMESIZE * 4)
+
+// [Octet 0-3] Vendor ID
+#define A2DP_OPUS_VENDOR_ID 0x000000E0
+// [Octet 4-5] Vendor Specific Codec ID
+#define A2DP_OPUS_CODEC_ID 0x0001
+// [Octet 6], [Bits 0,1,2] Channel Mode
+#define A2DP_OPUS_CHANNEL_MODE_MASK 0x07
+#define A2DP_OPUS_CHANNEL_MODE_MONO 0x01
+#define A2DP_OPUS_CHANNEL_MODE_STEREO 0x02
+#define A2DP_OPUS_CHANNEL_MODE_DUAL_MONO 0x04
+// [Octet 6], [Bits 3,4] Future 2, FrameSize
+#define A2DP_OPUS_FRAMESIZE_MASK 0x18
+#define A2DP_OPUS_10MS_FRAMESIZE 0x08
+#define A2DP_OPUS_20MS_FRAMESIZE 0x10
+// [Octet 6], [Bits 5] Sampling Frequency
+#define A2DP_OPUS_SAMPLING_FREQ_MASK 0x80
+#define A2DP_OPUS_SAMPLING_FREQ_48000 0x80
+// [Octet 6], [Bits 6,7] Reserved
+#define A2DP_OPUS_FUTURE_3 0x40
+#define A2DP_OPUS_FUTURE_4 0x80
+
+// Length of the Opus Media Payload header
+#define A2DP_OPUS_MPL_HDR_LEN 1
+
+#if (BTA_AV_CO_CP_SCMS_T == TRUE)
+#define A2DP_OPUS_OFFSET (AVDT_MEDIA_OFFSET + A2DP_OPUS_MPL_HDR_LEN + 1)
+#else
+#define A2DP_OPUS_OFFSET (AVDT_MEDIA_OFFSET + A2DP_OPUS_MPL_HDR_LEN)
+#endif
+
+#define A2DP_OPUS_HDR_F_MSK 0x80
+#define A2DP_OPUS_HDR_S_MSK 0x40
+#define A2DP_OPUS_HDR_L_MSK 0x20
+#define A2DP_OPUS_HDR_NUM_MSK 0x0F
+
+#endif
diff --git a/system/stack/include/a2dp_vendor_opus_decoder.h b/system/stack/include/a2dp_vendor_opus_decoder.h
new file mode 100644
index 0000000..67b5bf7
--- /dev/null
+++ b/system/stack/include/a2dp_vendor_opus_decoder.h
@@ -0,0 +1,45 @@
+/*
+ * Copyright 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+//
+// Interface to the A2DP Opus Decoder
+//
+
+#ifndef A2DP_VENDOR_OPUS_DECODER_H
+#define A2DP_VENDOR_OPUS_DECODER_H
+
+#include "a2dp_codec_api.h"
+
+// Initialize the A2DP Opus decoder.
+bool a2dp_vendor_opus_decoder_init(decoded_data_callback_t decode_callback);
+
+// Cleanup the A2DP Opus decoder.
+void a2dp_vendor_opus_decoder_cleanup(void);
+
+// Decodes |p_buf|. Calls |decode_callback| passed into
+// |a2dp_vendor_opus_decoder_init| if decoded frames are available.
+bool a2dp_vendor_opus_decoder_decode_packet(BT_HDR* p_buf);
+
+// Start the A2DP Opus decoder.
+void a2dp_vendor_opus_decoder_start(void);
+
+// Suspend the A2DP Opus decoder.
+void a2dp_vendor_opus_decoder_suspend(void);
+
+// A2DP Opus decoder configuration.
+void a2dp_vendor_opus_decoder_configure(const uint8_t* p_codec_info);
+
+#endif  // A2DP_VENDOR_OPUS_DECODER_H
diff --git a/system/stack/include/a2dp_vendor_opus_encoder.h b/system/stack/include/a2dp_vendor_opus_encoder.h
new file mode 100644
index 0000000..0f88265
--- /dev/null
+++ b/system/stack/include/a2dp_vendor_opus_encoder.h
@@ -0,0 +1,59 @@
+/*
+ * Copyright 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+//
+// Interface to the A2DP Opus Encoder
+//
+
+#ifndef A2DP_VENDOR_OPUS_ENCODER_H
+#define A2DP_VENDOR_OPUS_ENCODER_H
+
+#include "a2dp_codec_api.h"
+
+// Initialize the A2DP Opus encoder.
+// |p_peer_params| contains the A2DP peer information
+// The current A2DP codec config is in |a2dp_codec_config|.
+// |read_callback| is the callback for reading the input audio data.
+// |enqueue_callback| is the callback for enqueueing the encoded audio data.
+void a2dp_vendor_opus_encoder_init(
+    const tA2DP_ENCODER_INIT_PEER_PARAMS* p_peer_params,
+    A2dpCodecConfig* a2dp_codec_config,
+    a2dp_source_read_callback_t read_callback,
+    a2dp_source_enqueue_callback_t enqueue_callback);
+
+// Cleanup the A2DP Opus encoder.
+void a2dp_vendor_opus_encoder_cleanup(void);
+
+// Reset the feeding for the A2DP Opus encoder.
+void a2dp_vendor_opus_feeding_reset(void);
+
+// Flush the feeding for the A2DP Opus encoder.
+void a2dp_vendor_opus_feeding_flush(void);
+
+// Get the A2DP Opus encoder interval (in milliseconds).
+uint64_t a2dp_vendor_opus_get_encoder_interval_ms(void);
+
+// Prepare and send A2DP Opus encoded frames.
+// |timestamp_us| is the current timestamp (in microseconds).
+void a2dp_vendor_opus_send_frames(uint64_t timestamp_us);
+
+// Set transmit queue length for the A2DP Opus (Dynamic Bit Rate) mechanism.
+void a2dp_vendor_opus_set_transmit_queue_length(size_t transmit_queue_length);
+
+// Get the A2DP Opus encoded maximum frame size
+int a2dp_vendor_opus_get_effective_frame_size();
+
+#endif  // A2DP_VENDOR_OPUS_ENCODER_H
diff --git a/system/stack/include/acl_hci_link_interface.h b/system/stack/include/acl_hci_link_interface.h
index 7b31846..5ce61b7 100644
--- a/system/stack/include/acl_hci_link_interface.h
+++ b/system/stack/include/acl_hci_link_interface.h
@@ -67,7 +67,6 @@
 
 void acl_rcv_acl_data(BT_HDR* p_msg);
 void acl_link_segments_xmitted(BT_HDR* p_msg);
-void acl_process_num_completed_pkts(uint8_t* p, uint8_t evt_len);
 void acl_packets_completed(uint16_t handle, uint16_t num_packets);
 void acl_process_supported_features(uint16_t handle, uint64_t features);
 void acl_process_extended_features(uint16_t handle, uint8_t current_page_number,
diff --git a/system/stack/include/avrc_api.h b/system/stack/include/avrc_api.h
index 877dafe..10a34d1 100644
--- a/system/stack/include/avrc_api.h
+++ b/system/stack/include/avrc_api.h
@@ -236,6 +236,16 @@
 /*****************************************************************************
  *  external function declarations
  ****************************************************************************/
+/******************************************************************************
+ *
+ * Function         avrcp_absolute_volume_is_enabled
+ *
+ * Description      Check if config support advance control (absolute volume)
+ *
+ * Returns          return true if absolute_volume is enabled
+ *
+ *****************************************************************************/
+bool avrcp_absolute_volume_is_enabled();
 
 /******************************************************************************
  *
diff --git a/system/stack/include/btm_api.h b/system/stack/include/btm_api.h
index fb6cd16..774a1f4 100644
--- a/system/stack/include/btm_api.h
+++ b/system/stack/include/btm_api.h
@@ -404,6 +404,22 @@
 
 /*******************************************************************************
  *
+ * Function         BTM_IsRemoteNameKnown
+ *
+ * Description      This function checks if the remote name is known.
+ *
+ * Input Params:    bd_addr: Address of remote
+ *                  transport: Transport, auto if unknown
+ *
+ * Returns
+ *                  true if name is known, false otherwise
+ *
+ ******************************************************************************/
+bool BTM_IsRemoteNameKnown(const RawAddress& remote_bda,
+                           tBT_TRANSPORT transport);
+
+/*******************************************************************************
+ *
  * Function         BTM_ReadRemoteVersion
  *
  * Description      This function is called to read a remote device's version
diff --git a/system/stack/include/btm_api_types.h b/system/stack/include/btm_api_types.h
index 3e68f46..ec49380 100644
--- a/system/stack/include/btm_api_types.h
+++ b/system/stack/include/btm_api_types.h
@@ -283,6 +283,7 @@
   }
 }
 
+/* BTM_SEC security masks */
 enum : uint16_t {
   /* Nothing required */
   BTM_SEC_NONE = 0x0000,
diff --git a/system/stack/include/btm_ble_api.h b/system/stack/include/btm_ble_api.h
index e192680..e980906 100644
--- a/system/stack/include/btm_ble_api.h
+++ b/system/stack/include/btm_ble_api.h
@@ -194,6 +194,23 @@
 extern void BTM_BleOpportunisticObserve(bool enable,
                                         tBTM_INQ_RESULTS_CB* p_results_cb);
 
+/*******************************************************************************
+ *
+ * Function         BTM_BleTargetAnnouncementObserve
+ *
+ * Description      Register/Unregister client interested in the targeted
+ *                  announcements. Not that it is client responsible for parsing
+ *                  advertising data.
+ *
+ * Parameters       start: start or stop observe.
+ *                  p_results_cb: callback for results.
+ *
+ * Returns          void
+ *
+ ******************************************************************************/
+extern void BTM_BleTargetAnnouncementObserve(bool enable,
+                                             tBTM_INQ_RESULTS_CB* p_results_cb);
+
 /** Returns local device encryption root (ER) */
 const Octet16& BTM_GetDeviceEncRoot();
 
diff --git a/system/stack/include/btm_ble_api_types.h b/system/stack/include/btm_ble_api_types.h
index 8de1dcc..6495082 100644
--- a/system/stack/include/btm_ble_api_types.h
+++ b/system/stack/include/btm_ble_api_types.h
@@ -257,7 +257,11 @@
 #define BTM_BLE_APPEARANCE_CYCLING_CADENCE 0x0483
 #define BTM_BLE_APPEARANCE_CYCLING_POWER 0x0484
 #define BTM_BLE_APPEARANCE_CYCLING_SPEED_CADENCE 0x0485
+#define BTM_BLE_APPEARANCE_GENERIC_WEARABLE_AUDIO_DEVICE 0x0940
 #define BTM_BLE_APPEARANCE_WEARABLE_AUDIO_DEVICE_EARBUD 0x0941
+#define BTM_BLE_APPEARANCE_WEARABLE_AUDIO_DEVICE_HEADSET 0x0942
+#define BTM_BLE_APPEARANCE_WEARABLE_AUDIO_DEVICE_HEADPHONES 0x0943
+#define BTM_BLE_APPEARANCE_WEARABLE_AUDIO_DEVICE_NECK_BAND 0x0944
 #define BTM_BLE_APPEARANCE_GENERIC_PULSE_OXIMETER 0x0C40
 #define BTM_BLE_APPEARANCE_PULSE_OXIMETER_FINGERTIP 0x0C41
 #define BTM_BLE_APPEARANCE_PULSE_OXIMETER_WRIST 0x0C42
@@ -350,6 +354,12 @@
 
 typedef uint8_t tGATT_IF;
 
+typedef enum : uint8_t {
+  BTM_BLE_DIRECT_CONNECTION = 0x00,
+  BTM_BLE_BKG_CONNECT_ALLOW_LIST = 0x01,
+  BTM_BLE_BKG_CONNECT_TARGETED_ANNOUNCEMENTS = 0x02,
+} tBTM_BLE_CONN_TYPE;
+
 typedef void(tBTM_BLE_SCAN_THRESHOLD_CBACK)(tBTM_BLE_REF_VALUE ref_value);
 using tBTM_BLE_SCAN_REP_CBACK =
     base::Callback<void(tBTM_STATUS /* status */, uint8_t /* report_format */,
diff --git a/system/stack/include/btm_iso_api.h b/system/stack/include/btm_iso_api.h
index 221dfed..f030036 100644
--- a/system/stack/include/btm_iso_api.h
+++ b/system/stack/include/btm_iso_api.h
@@ -107,8 +107,9 @@
    * Initiates removing of connected isochronous group (CIG).
    *
    * @param cig_id connected isochronous group id
+   * @param force do not check if CIG exist
    */
-  virtual void RemoveCig(uint8_t cig_id);
+  virtual void RemoveCig(uint8_t cig_id, bool force = false);
 
   /**
    * Initiates creation of connected isochronous stream (CIS).
diff --git a/system/stack/include/gatt_api.h b/system/stack/include/gatt_api.h
index 1bb3d07..eb37910 100644
--- a/system/stack/include/gatt_api.h
+++ b/system/stack/include/gatt_api.h
@@ -213,6 +213,8 @@
 
   GATT_CONN_FAILED_ESTABLISHMENT = HCI_ERR_CONN_FAILED_ESTABLISHMENT,
 
+  GATT_CONN_TERMINATED_POWER_OFF = HCI_ERR_REMOTE_POWER_OFF,
+
   BTA_GATT_CONN_NONE = 0x0101, /* 0x0101 no connection to cancel  */
 
 } tGATT_DISCONN_REASON;
@@ -232,6 +234,7 @@
     CASE_RETURN_TEXT(GATT_CONN_LMP_TIMEOUT);
     CASE_RETURN_TEXT(GATT_CONN_FAILED_ESTABLISHMENT);
     CASE_RETURN_TEXT(BTA_GATT_CONN_NONE);
+    CASE_RETURN_TEXT(GATT_CONN_TERMINATED_POWER_OFF);
     default:
       return base::StringPrintf("UNKNOWN[%hu]", reason);
   }
@@ -999,13 +1002,18 @@
  *
  * Parameter        bd_addr:   target device bd address.
  *                  idle_tout: timeout value in seconds.
- *                  transport: trasnport option.
+ *                  transport: transport option.
+ *                  is_active: whether we should use this as a signal that an
+ *                             active client now exists (which changes link
+ *                             timeout logic, see
+ *                             t_l2c_linkcb.with_active_local_clients for
+ *                             details).
  *
  * Returns          void
  *
  ******************************************************************************/
 extern void GATT_SetIdleTimeout(const RawAddress& bd_addr, uint16_t idle_tout,
-                                tBT_TRANSPORT transport);
+                                tBT_TRANSPORT transport, bool is_active);
 
 /*******************************************************************************
  *
@@ -1063,8 +1071,7 @@
  *
  * Parameters       gatt_if: applicaiton interface
  *                  bd_addr: peer device address.
- *                  is_direct: is a direct connection or a background auto
- *                             connection
+ *                  connection_type: connection type
  *                  transport : Physical transport for GATT connection
  *                              (BR/EDR or LE)
  *                  opportunistic: will not keep device connected if other apps
@@ -1075,11 +1082,12 @@
  *
  ******************************************************************************/
 extern bool GATT_Connect(tGATT_IF gatt_if, const RawAddress& bd_addr,
-                         bool is_direct, tBT_TRANSPORT transport,
-                         bool opportunistic);
+                         tBTM_BLE_CONN_TYPE connection_type,
+                         tBT_TRANSPORT transport, bool opportunistic);
 extern bool GATT_Connect(tGATT_IF gatt_if, const RawAddress& bd_addr,
-                         bool is_direct, tBT_TRANSPORT transport,
-                         bool opportunistic, uint8_t initiating_phys);
+                         tBTM_BLE_CONN_TYPE connection_type,
+                         tBT_TRANSPORT transport, bool opportunistic,
+                         uint8_t initiating_phys);
 
 /*******************************************************************************
  *
@@ -1182,4 +1190,7 @@
  * true, as there is no need to wipe controller acceptlist in this case. */
 extern void gatt_reset_bgdev_list(bool after_reset);
 
+// Initialize GATTS list of bonded device service change updates.
+extern void gatt_load_bonded(void);
+
 #endif /* GATT_API_H */
diff --git a/system/stack/include/hci_error_code.h b/system/stack/include/hci_error_code.h
index bbff6a6..c2abb8d 100644
--- a/system/stack/include/hci_error_code.h
+++ b/system/stack/include/hci_error_code.h
@@ -44,6 +44,7 @@
   HCI_ERR_HOST_TIMEOUT = 0x10,  // stack/btm/btm_ble_gap,
   HCI_ERR_ILLEGAL_PARAMETER_FMT = 0x12,
   HCI_ERR_PEER_USER = 0x13,
+  HCI_ERR_REMOTE_POWER_OFF = 0x15,
   HCI_ERR_CONN_CAUSE_LOCAL_HOST = 0x16,
   HCI_ERR_REPEATED_ATTEMPTS = 0x17,
   HCI_ERR_PAIRING_NOT_ALLOWED = 0x18,
diff --git a/system/stack/include/hcidefs.h b/system/stack/include/hcidefs.h
index b6bdae6..55b3e14 100644
--- a/system/stack/include/hcidefs.h
+++ b/system/stack/include/hcidefs.h
@@ -888,15 +888,25 @@
 
 /* Parameter information for HCI_BRCM_SET_ACL_PRIORITY */
 #define HCI_BRCM_ACL_PRIORITY_PARAM_SIZE 3
-#define HCI_BRCM_ACL_PRIORITY_LOW 0x00
-#define HCI_BRCM_ACL_PRIORITY_HIGH 0xFF
 #define HCI_BRCM_SET_ACL_PRIORITY (0x0057 | HCI_GRP_VENDOR_SPECIFIC)
+#define HCI_BRCM_ACL_NORMAL_PRIORITY 0x00
+#define HCI_BRCM_ACL_HIGH_PRIORITY 0xFF
+#define HCI_BRCM_ACL_HIGH_PRIORITY_LOW_LATENCY 0xF3
 
 #define LMP_COMPID_GOOGLE 0xE0
 
 // TODO(zachoverflow): remove this once broadcom specific hacks are removed
 #define LMP_COMPID_BROADCOM 15
 
+// TODO: Remove this once Synaptics specific code is removed
+#define LMP_COMPID_SYNAPTICS 0x0A76
+
+/* Parameter information for HCI_SYNA_SET_ACL_PRIORITY */
+#define HCI_SYNA_ACL_PRIORITY_PARAM_SIZE 3
+#define HCI_SYNA_ACL_PRIORITY_LOW 0x00
+#define HCI_SYNA_ACL_PRIORITY_HIGH 0xFF
+#define HCI_SYNA_SET_ACL_PRIORITY (0x0057 | HCI_GRP_VENDOR_SPECIFIC)
+
 /*
  * Define packet size
 */
diff --git a/system/stack/include/l2c_api.h b/system/stack/include/l2c_api.h
index 92cf17f..c4e452f 100644
--- a/system/stack/include/l2c_api.h
+++ b/system/stack/include/l2c_api.h
@@ -63,6 +63,12 @@
   L2CAP_PRIORITY_HIGH = 1,
 } tL2CAP_PRIORITY;
 
+/* Values for priority parameter to L2CA_SetAclLatency */
+typedef enum : uint8_t {
+  L2CAP_LATENCY_NORMAL = 0,
+  L2CAP_LATENCY_LOW = 1,
+} tL2CAP_LATENCY;
+
 /* Values for priority parameter to L2CA_SetTxPriority */
 #define L2CAP_CHNL_PRIORITY_HIGH 0
 #define L2CAP_CHNL_PRIORITY_LOW 2
@@ -101,6 +107,8 @@
 #define L2C_IS_VALID_PSM(psm) (((psm)&0x0101) == 0x0001)
 #define L2C_IS_VALID_LE_PSM(psm) (((psm) > 0x0000) && ((psm) < 0x0100))
 
+#define L2CAP_NO_IDLE_TIMEOUT 0xFFFF
+
 /*****************************************************************************
  *  Type Definitions
  ****************************************************************************/
@@ -172,14 +180,11 @@
 
 // This is initial amout of credits we send, and amount to which we increase
 // credits once they fall below threshold
-constexpr uint16_t L2CAP_LE_CREDIT_DEFAULT = 0xffff;
+uint16_t L2CA_LeCreditDefault();
 
 // If credit count on remote fall below this value, we send back credits to
 // reach default value.
-constexpr uint16_t L2CAP_LE_CREDIT_THRESHOLD = 0x0040;
-
-static_assert(L2CAP_LE_CREDIT_THRESHOLD < L2CAP_LE_CREDIT_DEFAULT,
-              "Threshold must be smaller than default credits");
+uint16_t L2CA_LeCreditThreshold();
 
 // Max number of CIDs in the L2CAP CREDIT BASED CONNECTION REQUEST
 constexpr uint16_t L2CAP_CREDIT_BASED_MAX_CIDS = 5;
@@ -191,7 +196,7 @@
   uint16_t result; /* Only used in confirm messages */
   uint16_t mtu = 100;
   uint16_t mps = 100;
-  uint16_t credits = L2CAP_LE_CREDIT_DEFAULT;
+  uint16_t credits = L2CA_LeCreditDefault();
   uint8_t number_of_channels = L2CAP_CREDIT_BASED_MAX_CIDS;
 };
 
@@ -636,6 +641,18 @@
 
 /*******************************************************************************
  *
+ * Function         L2CA_UseLatencyMode
+ *
+ * Description      Sets use latency mode for an ACL channel.
+ *
+ * Returns          true if a valid channel, else false
+ *
+ ******************************************************************************/
+extern bool L2CA_UseLatencyMode(const RawAddress& bd_addr,
+                                bool use_latency_mode);
+
+/*******************************************************************************
+ *
  * Function         L2CA_SetAclPriority
  *
  * Description      Sets the transmission priority for an ACL channel.
@@ -650,6 +667,18 @@
 
 /*******************************************************************************
  *
+ * Function         L2CA_SetAclLatency
+ *
+ * Description      Sets the transmission latency for a channel.
+ *
+ * Returns          true if a valid channel, else false
+ *
+ ******************************************************************************/
+extern bool L2CA_SetAclLatency(const RawAddress& bd_addr,
+                               tL2CAP_LATENCY latency);
+
+/*******************************************************************************
+ *
  * Function         L2CA_SetTxPriority
  *
  * Description      Sets the transmission priority for a channel. (FCR Mode)
@@ -810,6 +839,8 @@
 extern bool L2CA_SetLeGattTimeout(const RawAddress& rem_bda,
                                   uint16_t idle_tout);
 
+extern bool L2CA_MarkLeLinkAsActive(const RawAddress& rem_bda);
+
 extern bool L2CA_UpdateBleConnParams(const RawAddress& rem_bda,
                                      uint16_t min_int, uint16_t max_int,
                                      uint16_t latency, uint16_t timeout,
diff --git a/system/stack/include/l2cap_acl_interface.h b/system/stack/include/l2cap_acl_interface.h
index b534f1b..aa0a86c 100644
--- a/system/stack/include/l2cap_acl_interface.h
+++ b/system/stack/include/l2cap_acl_interface.h
@@ -46,6 +46,4 @@
 
 extern void l2cu_resubmit_pending_sec_req(const RawAddress* p_bda);
 
-extern void l2c_link_process_num_completed_pkts(uint8_t* p, uint8_t evt_len);
-
 extern void l2c_packets_completed(uint16_t handle, uint16_t num_sent);
diff --git a/system/stack/include/port_api.h b/system/stack/include/port_api.h
index 832832f..ed4733a 100644
--- a/system/stack/include/port_api.h
+++ b/system/stack/include/port_api.h
@@ -191,13 +191,6 @@
                                                tPORT_CALLBACK* p_mgmt_cb,
                                                uint16_t sec_mask);
 
-extern void RFCOMM_ClearSecurityRecord(uint32_t scn);
-
-extern int RFCOMM_CreateConnection(uint16_t uuid, uint8_t scn, bool is_server,
-                                   uint16_t mtu, const RawAddress& bd_addr,
-                                   uint16_t* p_handle,
-                                   tPORT_CALLBACK* p_mgmt_cb);
-
 /*******************************************************************************
  *
  * Function         RFCOMM_RemoveConnection
@@ -434,4 +427,15 @@
  ******************************************************************************/
 extern const char* PORT_GetResultString(const uint8_t result_code);
 
+/*******************************************************************************
+ *
+ * Function         PORT_GetSecurityMask
+ *
+ * Description      This function returns the security bitmask for a port.
+ *
+ * Returns          the security bitmask.
+ *
+ ******************************************************************************/
+extern int PORT_GetSecurityMask(uint16_t handle, uint16_t* sec_mask);
+
 #endif /* PORT_API_H */
diff --git a/system/stack/include/security_client_callbacks.h b/system/stack/include/security_client_callbacks.h
index de59ff1..d6070cd 100644
--- a/system/stack/include/security_client_callbacks.h
+++ b/system/stack/include/security_client_callbacks.h
@@ -52,7 +52,8 @@
 typedef uint8_t(tBTM_LINK_KEY_CALLBACK)(const RawAddress& bd_addr,
                                         DEV_CLASS dev_class,
                                         tBTM_BD_NAME bd_name,
-                                        const LinkKey& key, uint8_t key_type);
+                                        const LinkKey& key, uint8_t key_type,
+                                        bool is_ctkd);
 
 /* Remote Name Resolved.  Parameters are
  *              BD Address of remote
diff --git a/system/stack/include/smp_api.h b/system/stack/include/smp_api.h
index 8124211..cf23914 100644
--- a/system/stack/include/smp_api.h
+++ b/system/stack/include/smp_api.h
@@ -187,8 +187,11 @@
  * Description      This function is called to generate a public key to be
  *                  passed to a remote device via an Out of Band transport
  *
+ * Returns          true if the request is successfully sent and executed by the
+ *                  state machine, false otherwise
+ *
  ******************************************************************************/
-extern void SMP_CrLocScOobData();
+extern bool SMP_CrLocScOobData();
 
 /*******************************************************************************
  *
diff --git a/system/stack/include/stack_metrics_logging.h b/system/stack/include/stack_metrics_logging.h
index 158c98f..58d869f 100644
--- a/system/stack/include/stack_metrics_logging.h
+++ b/system/stack/include/stack_metrics_logging.h
@@ -34,9 +34,9 @@
     uint32_t hci_cmd, uint16_t hci_event, uint16_t hci_ble_event,
     uint16_t cmd_status, uint16_t reason_code);
 
-void log_smp_pairing_event(const RawAddress& address, uint8_t smp_cmd,
+void log_smp_pairing_event(const RawAddress& address, uint16_t smp_cmd,
                            android::bluetooth::DirectionEnum direction,
-                           uint8_t smp_fail_reason);
+                           uint16_t smp_fail_reason);
 
 void log_sdp_attribute(const RawAddress& address, uint16_t protocol_uuid,
                        uint16_t attribute_id, size_t attribute_size,
diff --git a/system/stack/l2cap/l2c_api.cc b/system/stack/l2cap/l2c_api.cc
index 6eedcbb..e171d7a 100644
--- a/system/stack/l2cap/l2c_api.cc
+++ b/system/stack/l2cap/l2c_api.cc
@@ -33,11 +33,17 @@
 #include <string>
 
 #include "device/include/controller.h"  // TODO Remove
+#include "gd/common/init_flags.h"
+#include "gd/os/system_properties.h"
+#include "gd/os/metrics.h"
+#include "hci/include/btsnoop.h"
 #include "main/shim/shim.h"
+#include "main/shim/metrics_api.h"
 #include "osi/include/allocator.h"
 #include "osi/include/log.h"
 #include "stack/btm/btm_sec.h"
 #include "stack/include/bt_hdr.h"
+#include "stack/include/btu.h"  // do_in_main_thread
 #include "stack/include/l2c_api.h"
 #include "stack/l2cap/l2c_int.h"
 #include "types/raw_address.h"
@@ -63,6 +69,29 @@
   return ret;
 }
 
+uint16_t L2CA_LeCreditDefault() {
+  static const uint16_t sL2CAP_LE_CREDIT_DEFAULT =
+      bluetooth::os::GetSystemPropertyUint32Base(
+          "bluetooth.l2cap.le.credit_default.value", 0xffff);
+  return sL2CAP_LE_CREDIT_DEFAULT;
+}
+
+uint16_t L2CA_LeCreditThreshold() {
+  static const uint16_t sL2CAP_LE_CREDIT_THRESHOLD =
+      bluetooth::os::GetSystemPropertyUint32Base(
+          "bluetooth.l2cap.le.credit_threshold.value", 0x0040);
+  return sL2CAP_LE_CREDIT_THRESHOLD;
+}
+
+static bool check_l2cap_credit() {
+  CHECK(L2CA_LeCreditThreshold() < L2CA_LeCreditDefault())
+      << "Threshold must be smaller than default credits";
+  return true;
+}
+
+// Replace static assert with startup assert depending of the config
+static const bool enforce_assert = check_l2cap_credit();
+
 /*******************************************************************************
  *
  * Function         L2CA_Register
@@ -563,7 +592,16 @@
   if (p_lcb->link_state == LST_CONNECTED) {
     if (p_ccb->p_lcb->transport == BT_TRANSPORT_LE) {
       L2CAP_TRACE_DEBUG("%s LE Link is up", __func__);
-      l2c_csm_execute(p_ccb, L2CEVT_L2CA_CONNECT_REQ, NULL);
+      // post this asynchronously to avoid out-of-order callback invocation
+      // should this operation fail
+      if (bluetooth::common::init_flags::
+              asynchronously_start_l2cap_coc_is_enabled()) {
+        do_in_main_thread(FROM_HERE,
+                          base::Bind(&l2c_csm_execute, base::Unretained(p_ccb),
+                                     L2CEVT_L2CA_CONNECT_REQ, nullptr));
+      } else {
+        l2c_csm_execute(p_ccb, L2CEVT_L2CA_CONNECT_REQ, NULL);
+      }
     }
   }
 
@@ -780,6 +818,12 @@
 
   L2CAP_TRACE_DEBUG("%s LE Link is up", __func__);
 
+  /* Check if there is no ongoing connection request */
+  if (p_lcb->pending_ecoc_conn_cnt > 0) {
+    LOG_WARN("There is ongoing connection request, PSM: 0x%04x", psm);
+    return allocated_cids;
+  }
+
   tL2C_CCB* p_ccb_primary;
 
   /* Make sure user set proper value for number of cids */
@@ -837,8 +881,8 @@
  *
  *  Description      Start reconfigure procedure on Connection Oriented Channel.
  *
- *  Parameters:      Vector of channels for which configuration should be changed
- *                   New local channel configuration
+ *  Parameters:      Vector of channels for which configuration should be
+ *changed New local channel configuration
  *
  *  Return value:    true if peer is connected
  *
@@ -1029,6 +1073,29 @@
 
 /*******************************************************************************
  *
+ * Function         L2CA_UseLatencyMode
+ *
+ * Description      Sets acl use latency mode.
+ *
+ * Returns          true if a valid channel, else false
+ *
+ ******************************************************************************/
+bool L2CA_UseLatencyMode(const RawAddress& bd_addr, bool use_latency_mode) {
+  /* Find the link control block for the acl channel */
+  tL2C_LCB* p_lcb = l2cu_find_lcb_by_bd_addr(bd_addr, BT_TRANSPORT_BR_EDR);
+  if (p_lcb == nullptr) {
+    LOG_WARN("L2CAP - no LCB for L2CA_SetUseLatencyMode, BDA: %s",
+             bd_addr.ToString().c_str());
+    return false;
+  }
+  LOG_INFO("BDA: %s, use_latency_mode: %s", bd_addr.ToString().c_str(),
+           use_latency_mode ? "true" : "false");
+  p_lcb->use_latency_mode = use_latency_mode;
+  return true;
+}
+
+/*******************************************************************************
+ *
  * Function         L2CA_SetAclPriority
  *
  * Description      Sets the transmission priority for a channel.
@@ -1050,6 +1117,21 @@
 
 /*******************************************************************************
  *
+ * Function         L2CA_SetAclLatency
+ *
+ * Description      Sets the transmission latency for a channel.
+ *
+ * Returns          true if a valid channel, else false
+ *
+ ******************************************************************************/
+bool L2CA_SetAclLatency(const RawAddress& bd_addr, tL2CAP_LATENCY latency) {
+  LOG_INFO("BDA: %s, latency: %s", bd_addr.ToString().c_str(),
+           std::to_string(latency).c_str());
+  return l2cu_set_acl_latency(bd_addr, latency);
+}
+
+/*******************************************************************************
+ *
  * Function         L2CA_SetTxPriority
  *
  * Description      Sets the transmission priority for a channel.
@@ -1270,6 +1352,16 @@
   }
 
   if (transport == BT_TRANSPORT_LE) {
+    auto argument_list = std::vector<std::pair<bluetooth::os::ArgumentType, int>>();
+    argument_list.push_back(std::make_pair(bluetooth::os::ArgumentType::L2CAP_CID, fixed_cid));
+
+    bluetooth::shim::LogMetricBluetoothLEConnectionMetricEvent(
+        rem_bda,
+        android::bluetooth::le::LeConnectionOriginType::ORIGIN_NATIVE,
+        android::bluetooth::le::LeConnectionType::CONNECTION_TYPE_LE_ACL,
+        android::bluetooth::le::LeConnectionState::STATE_LE_ACL_START,
+        argument_list);
+
     bool ret = l2cu_create_conn_le(p_lcb);
     if (!ret) {
       LOG_WARN("Unable to create fixed channel le connection fixed_cid:0x%04x",
@@ -1503,6 +1595,16 @@
   return true;
 }
 
+bool L2CA_MarkLeLinkAsActive(const RawAddress& rem_bda) {
+  tL2C_LCB* p_lcb = l2cu_find_lcb_by_bd_addr(rem_bda, BT_TRANSPORT_LE);
+  if (p_lcb == NULL) {
+    return false;
+  }
+  LOG(INFO) << __func__ << "setting link to " << rem_bda << " as active";
+  p_lcb->with_active_local_clients = true;
+  return true;
+}
+
 /*******************************************************************************
  *
  * Function         L2CA_DataWrite
diff --git a/system/stack/l2cap/l2c_ble.cc b/system/stack/l2cap/l2c_ble.cc
index 67ccd01..3d66846 100755
--- a/system/stack/l2cap/l2c_ble.cc
+++ b/system/stack/l2cap/l2c_ble.cc
@@ -411,6 +411,30 @@
 
 /*******************************************************************************
  *
+ * Function         l2cble_handle_connect_rsp_neg
+ *
+ * Description      This function sends error message to all the
+ *                  outstanding channels
+ *
+ * Returns          void
+ *
+ ******************************************************************************/
+static void l2cble_handle_connect_rsp_neg(tL2C_LCB* p_lcb,
+                                          tL2C_CONN_INFO* con_info) {
+  tL2C_CCB* temp_p_ccb = NULL;
+  for (int i = 0; i < p_lcb->pending_ecoc_conn_cnt; i++) {
+    uint16_t cid = p_lcb->pending_ecoc_connection_cids[i];
+    temp_p_ccb = l2cu_find_ccb_by_cid(p_lcb, cid);
+    l2c_csm_execute(temp_p_ccb, L2CEVT_L2CAP_CREDIT_BASED_CONNECT_RSP_NEG,
+                    con_info);
+  }
+
+  p_lcb->pending_ecoc_conn_cnt = 0;
+  memset(p_lcb->pending_ecoc_connection_cids, 0, L2CAP_CREDIT_BASED_MAX_CIDS);
+}
+
+/*******************************************************************************
+ *
  * Function         l2cble_process_sig_cmd
  *
  * Description      This function is called when a signalling packet is received
@@ -434,7 +458,6 @@
   p_pkt_end = p + pkt_len;
 
   if (p + 4 > p_pkt_end) {
-    android_errorWriteLog(0x534e4554, "80261585");
     LOG(ERROR) << "invalid read";
     return;
   }
@@ -452,9 +475,16 @@
   }
 
   switch (cmd_code) {
-    case L2CAP_CMD_REJECT:
-      p += 2;
-      break;
+    case L2CAP_CMD_REJECT: {
+      uint16_t reason;
+      STREAM_TO_UINT16(reason, p);
+
+      if (reason == L2CAP_CMD_REJ_NOT_UNDERSTOOD &&
+          p_lcb->pending_ecoc_conn_cnt > 0) {
+        con_info.l2cap_result = L2CAP_LE_RESULT_NO_PSM;
+        l2cble_handle_connect_rsp_neg(p_lcb, &con_info);
+      }
+    } break;
 
     case L2CAP_CMD_ECHO_REQ:
     case L2CAP_CMD_ECHO_RSP:
@@ -465,7 +495,6 @@
 
     case L2CAP_CMD_BLE_UPDATE_REQ:
       if (p + 8 > p_pkt_end) {
-        android_errorWriteLog(0x534e4554, "80261585");
         LOG(ERROR) << "invalid read";
         return;
       }
@@ -524,7 +553,6 @@
       /* Check how many channels remote side wants. */
       num_of_channels = (p_pkt_end - p) / sizeof(uint16_t);
       if (num_of_channels > L2CAP_CREDIT_BASED_MAX_CIDS) {
-        android_errorWriteLog(0x534e4554, "232256974");
         LOG_WARN("L2CAP - invalid number of channels requested: %d",
                  num_of_channels);
         l2cu_reject_credit_based_conn_req(p_lcb, id,
@@ -673,15 +701,15 @@
        * all the channels has been rejected
        */
       if (con_info.l2cap_result == L2CAP_LE_RESULT_NO_PSM ||
-          con_info.l2cap_result == L2CAP_LE_RESULT_NO_RESOURCES ||
           con_info.l2cap_result ==
               L2CAP_LE_RESULT_INSUFFICIENT_AUTHENTICATION ||
           con_info.l2cap_result == L2CAP_LE_RESULT_INSUFFICIENT_ENCRYP ||
           con_info.l2cap_result == L2CAP_LE_RESULT_INSUFFICIENT_AUTHORIZATION ||
           con_info.l2cap_result == L2CAP_LE_RESULT_UNACCEPTABLE_PARAMETERS ||
           con_info.l2cap_result == L2CAP_LE_RESULT_INVALID_PARAMETERS) {
-        l2c_csm_execute(p_ccb, L2CEVT_L2CAP_CREDIT_BASED_CONNECT_RSP_NEG,
-                        &con_info);
+        L2CAP_TRACE_ERROR("L2CAP - not accepted. Status %d",
+                          con_info.l2cap_result);
+        l2cble_handle_connect_rsp_neg(p_lcb, &con_info);
         return;
       }
 
@@ -690,8 +718,7 @@
           mps < L2CAP_CREDIT_BASED_MIN_MPS || mps > L2CAP_LE_MAX_MPS) {
         L2CAP_TRACE_ERROR("L2CAP - invalid params");
         con_info.l2cap_result = L2CAP_LE_RESULT_INVALID_PARAMETERS;
-        l2c_csm_execute(p_ccb, L2CEVT_L2CAP_CREDIT_BASED_CONNECT_RSP_NEG,
-                        &con_info);
+        l2cble_handle_connect_rsp_neg(p_lcb, &con_info);
         return;
       }
 
@@ -717,8 +744,17 @@
 
       con_info.peer_mtu = mtu;
 
-      for (int i = 0; i < p_lcb->pending_ecoc_conn_cnt; i++) {
-        uint16_t cid = p_lcb->pending_ecoc_connection_cids[i];
+      /* Copy request data and clear it so user can perform another connect if
+       * needed in the callback. */
+      p_lcb->pending_ecoc_conn_cnt = 0;
+      uint16_t cids[L2CAP_CREDIT_BASED_MAX_CIDS];
+      std::copy_n(p_lcb->pending_ecoc_connection_cids,
+                  L2CAP_CREDIT_BASED_MAX_CIDS, cids);
+      std::fill_n(p_lcb->pending_ecoc_connection_cids,
+                  L2CAP_CREDIT_BASED_MAX_CIDS, 0);
+
+      for (int i = 0; i < num_of_channels; i++) {
+        uint16_t cid = cids[i];
         STREAM_TO_UINT16(rcid, p);
 
         if (rcid != 0) {
@@ -773,10 +809,6 @@
         }
       }
 
-      p_lcb->pending_ecoc_conn_cnt = 0;
-      memset(p_lcb->pending_ecoc_connection_cids, 0,
-             L2CAP_CREDIT_BASED_MAX_CIDS);
-
       break;
     case L2CAP_CMD_CREDIT_BASED_RECONFIG_REQ: {
       if (p + 6 > p_pkt_end) {
@@ -859,7 +891,6 @@
     case L2CAP_CMD_CREDIT_BASED_RECONFIG_RES: {
       uint16_t result;
       if (p + sizeof(uint16_t) > p_pkt_end) {
-        android_errorWriteLog(0x534e4554, "212694559");
         LOG(ERROR) << "invalid read";
         return;
       }
@@ -893,7 +924,6 @@
 
     case L2CAP_CMD_BLE_CREDIT_BASED_CONN_REQ:
       if (p + 10 > p_pkt_end) {
-        android_errorWriteLog(0x534e4554, "80261585");
         LOG(ERROR) << "invalid read";
         return;
       }
@@ -959,7 +989,8 @@
       p_ccb->local_conn_cfg.mtu = L2CAP_SDU_LENGTH_LE_MAX;
       p_ccb->local_conn_cfg.mps =
           controller_get_interface()->get_acl_data_size_ble();
-      p_ccb->local_conn_cfg.credits = L2CAP_LE_CREDIT_DEFAULT,
+      p_ccb->local_conn_cfg.credits = L2CA_LeCreditDefault();
+      p_ccb->remote_credit_count = L2CA_LeCreditDefault();
 
       p_ccb->peer_conn_cfg.mtu = mtu;
       p_ccb->peer_conn_cfg.mps = mps;
@@ -989,7 +1020,6 @@
       if (p_ccb) {
         L2CAP_TRACE_DEBUG("I remember the connection req");
         if (p + 10 > p_pkt_end) {
-          android_errorWriteLog(0x534e4554, "80261585");
           LOG(ERROR) << "invalid read";
           return;
         }
@@ -1040,7 +1070,6 @@
 
     case L2CAP_CMD_BLE_FLOW_CTRL_CREDIT:
       if (p + 4 > p_pkt_end) {
-        android_errorWriteLog(0x534e4554, "80261585");
         LOG(ERROR) << "invalid read";
         return;
       }
@@ -1060,7 +1089,6 @@
 
     case L2CAP_CMD_DISC_REQ:
       if (p + 4 > p_pkt_end) {
-        android_errorWriteLog(0x534e4554, "74121659");
         return;
       }
       STREAM_TO_UINT16(lcid, p);
@@ -1079,7 +1107,6 @@
 
     case L2CAP_CMD_DISC_RSP:
       if (p + 4 > p_pkt_end) {
-        android_errorWriteLog(0x534e4554, "80261585");
         LOG(ERROR) << "invalid read";
         return;
       }
diff --git a/system/stack/l2cap/l2c_fcr.cc b/system/stack/l2cap/l2c_fcr.cc
index 4960858..d6d06d9 100644
--- a/system/stack/l2cap/l2c_fcr.cc
+++ b/system/stack/l2cap/l2c_fcr.cc
@@ -694,7 +694,6 @@
     if (p_buf->len < sizeof(sdu_length)) {
       L2CAP_TRACE_ERROR("%s: buffer length=%d too small. Need at least 2.",
                         __func__, p_buf->len);
-      android_errorWriteWithInfoLog(0x534e4554, "120665616", -1, NULL, 0);
       /* Discard the buffer */
       osi_free(p_buf);
       return;
@@ -716,7 +715,6 @@
 
     if (sdu_length < p_buf->len) {
       L2CAP_TRACE_ERROR("%s: Invalid sdu_length: %d", __func__, sdu_length);
-      android_errorWriteWithInfoLog(0x534e4554, "112321180", -1, NULL, 0);
       /* Discard the buffer */
       osi_free(p_buf);
       return;
@@ -736,11 +734,14 @@
 
   } else {
     p_data = p_ccb->ble_sdu;
+    if (p_data == NULL) {
+      osi_free(p_buf);
+      return;
+    }
     if (p_buf->len > (p_ccb->ble_sdu_length - p_data->len)) {
       L2CAP_TRACE_ERROR("%s: buffer length=%d too big. max=%d. Dropped",
                         __func__, p_data->len,
                         (p_ccb->ble_sdu_length - p_data->len));
-      android_errorWriteWithInfoLog(0x534e4554, "75298652", -1, NULL, 0);
       osi_free(p_buf);
 
       /* Throw away all pending fragments and disconnects */
diff --git a/system/stack/l2cap/l2c_int.h b/system/stack/l2cap/l2c_int.h
index 39ba1ec..a5ba258 100644
--- a/system/stack/l2cap/l2c_int.h
+++ b/system/stack/l2cap/l2c_int.h
@@ -49,7 +49,6 @@
 
 constexpr uint16_t L2CAP_CREDIT_BASED_MIN_MTU = 64;
 constexpr uint16_t L2CAP_CREDIT_BASED_MIN_MPS = 64;
-#define L2CAP_NO_IDLE_TIMEOUT 0xFFFF
 
 /*
  * Timeout values (in milliseconds).
@@ -429,6 +428,13 @@
   tL2C_LINK_STATE link_state;
 
   alarm_t* l2c_lcb_timer; /* Timer entry for timeout evt */
+
+  //  This tracks if the link has ever either (a)
+  //  been used for a dynamic channel (EATT or L2CAP CoC), or (b) has been a
+  //  GATT client. If false, the local device is just a GATT server, so for
+  //  backwards compatibility we never do a link timeout.
+  bool with_active_local_clients{false};
+
  private:
   uint16_t handle_; /* The handle used with LM */
   friend void l2cu_set_lcb_handle(struct t_l2c_linkcb& p_lcb, uint16_t handle);
@@ -497,6 +503,19 @@
     return false;
   }
 
+  bool use_latency_mode = false;
+  tL2CAP_LATENCY preset_acl_latency = L2CAP_LATENCY_NORMAL;
+  tL2CAP_LATENCY acl_latency = L2CAP_LATENCY_NORMAL;
+  bool is_normal_latency() const { return acl_latency == L2CAP_LATENCY_NORMAL; }
+  bool is_low_latency() const { return acl_latency == L2CAP_LATENCY_LOW; }
+  bool set_latency(tL2CAP_LATENCY latency) {
+    if (acl_latency != latency) {
+      acl_latency = latency;
+      return true;
+    }
+    return false;
+  }
+
   tL2C_CCB* p_fixed_ccbs[L2CAP_NUM_FIXED_CHNLS];
 
  private:
@@ -680,6 +699,8 @@
 extern bool l2cu_set_acl_priority(const RawAddress& bd_addr,
                                   tL2CAP_PRIORITY priority,
                                   bool reset_after_rs);
+extern bool l2cu_set_acl_latency(const RawAddress& bd_addr,
+                                 tL2CAP_LATENCY latency);
 
 extern void l2cu_enqueue_ccb(tL2C_CCB* p_ccb);
 extern void l2cu_dequeue_ccb(tL2C_CCB* p_ccb);
diff --git a/system/stack/l2cap/l2c_link.cc b/system/stack/l2cap/l2c_link.cc
index ea8dd07..0053cd8 100644
--- a/system/stack/l2cap/l2c_link.cc
+++ b/system/stack/l2cap/l2c_link.cc
@@ -1094,112 +1094,6 @@
   }
 }
 
-/*******************************************************************************
- *
- * Function         l2c_link_process_num_completed_pkts
- *
- * Description      This function is called when a "number-of-completed-packets"
- *                  event is received from the controller. It updates all the
- *                  LCB transmit counts.
- *
- * Returns          void
- *
- ******************************************************************************/
-void l2c_link_process_num_completed_pkts(uint8_t* p, uint8_t evt_len) {
-  if (bluetooth::shim::is_gd_l2cap_enabled()) {
-    return;
-  }
-  uint8_t num_handles, xx;
-  uint16_t handle;
-  uint16_t num_sent;
-  tL2C_LCB* p_lcb;
-
-  if (evt_len > 0) {
-    STREAM_TO_UINT8(num_handles, p);
-  } else {
-    num_handles = 0;
-  }
-
-  if (num_handles > evt_len / (2 * sizeof(uint16_t))) {
-    android_errorWriteLog(0x534e4554, "141617601");
-    num_handles = evt_len / (2 * sizeof(uint16_t));
-  }
-
-  for (xx = 0; xx < num_handles; xx++) {
-    STREAM_TO_UINT16(handle, p);
-    /* Extract the handle */
-    handle = HCID_GET_HANDLE(handle);
-    STREAM_TO_UINT16(num_sent, p);
-
-    p_lcb = l2cu_find_lcb_by_handle(handle);
-
-    if (p_lcb) {
-      if (p_lcb && (p_lcb->transport == BT_TRANSPORT_LE))
-        l2cb.controller_le_xmit_window += num_sent;
-      else {
-        /* Maintain the total window to the controller */
-        l2cb.controller_xmit_window += num_sent;
-      }
-      /* If doing round-robin, adjust communal counts */
-      if (p_lcb->link_xmit_quota == 0) {
-        if (p_lcb->transport == BT_TRANSPORT_LE) {
-          /* Don't go negative */
-          if (l2cb.ble_round_robin_unacked > num_sent)
-            l2cb.ble_round_robin_unacked -= num_sent;
-          else
-            l2cb.ble_round_robin_unacked = 0;
-        } else {
-          /* Don't go negative */
-          if (l2cb.round_robin_unacked > num_sent)
-            l2cb.round_robin_unacked -= num_sent;
-          else
-            l2cb.round_robin_unacked = 0;
-        }
-      }
-
-      /* Don't go negative */
-      if (p_lcb->sent_not_acked > num_sent)
-        p_lcb->sent_not_acked -= num_sent;
-      else
-        p_lcb->sent_not_acked = 0;
-
-      l2c_link_check_send_pkts(p_lcb, 0, NULL);
-
-      /* If we were doing round-robin for low priority links, check 'em */
-      if ((p_lcb->acl_priority == L2CAP_PRIORITY_HIGH) &&
-          (l2cb.check_round_robin) &&
-          (l2cb.round_robin_unacked < l2cb.round_robin_quota)) {
-        l2c_link_check_send_pkts(NULL, 0, NULL);
-      }
-      if ((p_lcb->transport == BT_TRANSPORT_LE) &&
-          (p_lcb->acl_priority == L2CAP_PRIORITY_HIGH) &&
-          ((l2cb.ble_check_round_robin) &&
-           (l2cb.ble_round_robin_unacked < l2cb.ble_round_robin_quota))) {
-        l2c_link_check_send_pkts(NULL, 0, NULL);
-      }
-    }
-
-    if (p_lcb) {
-      if (p_lcb->transport == BT_TRANSPORT_LE) {
-        LOG_DEBUG("TotalWin=%d,LinkUnack(0x%x)=%d,RRCheck=%d,RRUnack=%d",
-                  l2cb.controller_le_xmit_window, p_lcb->Handle(),
-                  p_lcb->sent_not_acked, l2cb.ble_check_round_robin,
-                  l2cb.ble_round_robin_unacked);
-      } else {
-        LOG_DEBUG("TotalWin=%d,LinkUnack(0x%x)=%d,RRCheck=%d,RRUnack=%d",
-                  l2cb.controller_xmit_window, p_lcb->Handle(),
-                  p_lcb->sent_not_acked, l2cb.check_round_robin,
-                  l2cb.round_robin_unacked);
-      }
-    } else {
-      LOG_DEBUG("TotalWin=%d  LE_Win: %d, Handle=0x%x, RRCheck=%d, RRUnack=%d",
-                l2cb.controller_xmit_window, l2cb.controller_le_xmit_window,
-                handle, l2cb.ble_check_round_robin,
-                l2cb.ble_round_robin_unacked);
-    }
-  }
-}
-
 void l2c_packets_completed(uint16_t handle, uint16_t num_sent) {
   tL2C_LCB* p_lcb = l2cu_find_lcb_by_handle(handle);
   if (p_lcb == nullptr) {
diff --git a/system/stack/l2cap/l2c_main.cc b/system/stack/l2cap/l2c_main.cc
index 98b00cd..1d412f7 100644
--- a/system/stack/l2cap/l2c_main.cc
+++ b/system/stack/l2cap/l2c_main.cc
@@ -221,9 +221,9 @@
     --p_ccb->remote_credit_count;
 
     /* If the credits left on the remote device are getting low, send some */
-    if (p_ccb->remote_credit_count <= L2CAP_LE_CREDIT_THRESHOLD) {
-      uint16_t credits = L2CAP_LE_CREDIT_DEFAULT - p_ccb->remote_credit_count;
-      p_ccb->remote_credit_count = L2CAP_LE_CREDIT_DEFAULT;
+    if (p_ccb->remote_credit_count <= L2CA_LeCreditThreshold()) {
+      uint16_t credits = L2CA_LeCreditDefault() - p_ccb->remote_credit_count;
+      p_ccb->remote_credit_count = L2CA_LeCreditDefault();
 
       /* Return back credits */
       l2c_csm_execute(p_ccb, L2CEVT_L2CA_SEND_FLOW_CONTROL_CREDIT, &credits);
@@ -480,11 +480,9 @@
             case L2CAP_CFG_TYPE_MTU:
               cfg_info.mtu_present = true;
               if (cfg_len != 2) {
-                android_errorWriteLog(0x534e4554, "119870451");
                 return;
               }
               if (p + cfg_len > p_next_cmd) {
-                android_errorWriteLog(0x534e4554, "74202041");
                 return;
               }
               STREAM_TO_UINT16(cfg_info.mtu, p);
@@ -493,11 +491,9 @@
             case L2CAP_CFG_TYPE_FLUSH_TOUT:
               cfg_info.flush_to_present = true;
               if (cfg_len != 2) {
-                android_errorWriteLog(0x534e4554, "119870451");
                 return;
               }
               if (p + cfg_len > p_next_cmd) {
-                android_errorWriteLog(0x534e4554, "74202041");
                 return;
               }
               STREAM_TO_UINT16(cfg_info.flush_to, p);
@@ -506,11 +502,9 @@
             case L2CAP_CFG_TYPE_QOS:
               cfg_info.qos_present = true;
               if (cfg_len != 2 + 5 * 4) {
-                android_errorWriteLog(0x534e4554, "119870451");
                 return;
               }
               if (p + cfg_len > p_next_cmd) {
-                android_errorWriteLog(0x534e4554, "74202041");
                 return;
               }
               STREAM_TO_UINT8(cfg_info.qos.qos_flags, p);
@@ -525,11 +519,9 @@
             case L2CAP_CFG_TYPE_FCR:
               cfg_info.fcr_present = true;
               if (cfg_len != 3 + 3 * 2) {
-                android_errorWriteLog(0x534e4554, "119870451");
                 return;
               }
               if (p + cfg_len > p_next_cmd) {
-                android_errorWriteLog(0x534e4554, "74202041");
                 return;
               }
               STREAM_TO_UINT8(cfg_info.fcr.mode, p);
@@ -543,11 +535,9 @@
             case L2CAP_CFG_TYPE_FCS:
               cfg_info.fcs_present = true;
               if (cfg_len != 1) {
-                android_errorWriteLog(0x534e4554, "119870451");
                 return;
               }
               if (p + cfg_len > p_next_cmd) {
-                android_errorWriteLog(0x534e4554, "74202041");
                 return;
               }
               STREAM_TO_UINT8(cfg_info.fcs, p);
@@ -556,11 +546,9 @@
             case L2CAP_CFG_TYPE_EXT_FLOW:
               cfg_info.ext_flow_spec_present = true;
               if (cfg_len != 2 + 2 + 3 * 4) {
-                android_errorWriteLog(0x534e4554, "119870451");
                 return;
               }
               if (p + cfg_len > p_next_cmd) {
-                android_errorWriteLog(0x534e4554, "74202041");
                 return;
               }
               STREAM_TO_UINT8(cfg_info.ext_flow_spec.id, p);
@@ -809,7 +797,6 @@
         if (info_type == L2CAP_FIXED_CHANNELS_INFO_TYPE) {
           if (result == L2CAP_INFO_RESP_RESULT_SUCCESS) {
             if (p + L2CAP_FIXED_CHNL_ARRAY_SIZE > p_next_cmd) {
-              android_errorWriteLog(0x534e4554, "111215173");
               return;
             }
             memcpy(p_lcb->peer_chnl_mask, p, L2CAP_FIXED_CHNL_ARRAY_SIZE);
diff --git a/system/stack/l2cap/l2c_utils.cc b/system/stack/l2cap/l2c_utils.cc
index 9c9d978..d903905 100755
--- a/system/stack/l2cap/l2c_utils.cc
+++ b/system/stack/l2cap/l2c_utils.cc
@@ -37,6 +37,8 @@
 #include "stack/include/bt_hdr.h"
 #include "stack/include/btm_api.h"
 #include "stack/include/hci_error_code.h"
+#include "stack/include/hcidefs.h"
+#include "stack/include/l2c_api.h"
 #include "stack/include/l2cdefs.h"
 #include "stack/l2cap/l2c_int.h"
 #include "types/raw_address.h"
@@ -66,6 +68,7 @@
       p_lcb->remote_bd_addr = p_bd_addr;
 
       p_lcb->in_use = true;
+      p_lcb->with_active_local_clients = false;
       p_lcb->link_state = LST_DISCONNECTED;
       p_lcb->InvalidateHandle();
       p_lcb->l2c_lcb_timer = alarm_new("l2c_lcb.l2c_lcb_timer");
@@ -1348,7 +1351,7 @@
  *
  ******************************************************************************/
 tL2C_CCB* l2cu_allocate_ccb(tL2C_LCB* p_lcb, uint16_t cid) {
-  LOG_DEBUG("cid 0x%04x", cid);
+  LOG_DEBUG("is_dynamic = %d, cid 0x%04x", p_lcb != nullptr, cid);
   if (!l2cb.p_free_ccb_first) {
     LOG_ERROR("First free ccb is null for cid 0x%04x", cid);
     return nullptr;
@@ -1465,6 +1468,11 @@
 
   l2c_link_adjust_chnl_allocation();
 
+  if (p_lcb != NULL) {
+    // once a dynamic channel is opened, timeouts become active
+    p_lcb->with_active_local_clients = true;
+  }
+
   return p_ccb;
 }
 
@@ -2214,6 +2222,73 @@
 
 /*******************************************************************************
  *
+ * Function         l2cu_set_acl_priority_latency_brcm
+ *
+ * Description      Sends a VSC to set the ACL priority and recorded latency on
+ *                  Broadcom chip.
+ *
+ * Returns          void
+ *
+ ******************************************************************************/
+
+static void l2cu_set_acl_priority_latency_brcm(tL2C_LCB* p_lcb,
+                                               tL2CAP_PRIORITY priority) {
+  uint8_t vs_param;
+  if (priority == L2CAP_PRIORITY_HIGH) {
+    // priority to high, if using latency mode check preset latency
+    if (p_lcb->use_latency_mode &&
+        p_lcb->preset_acl_latency == L2CAP_LATENCY_LOW) {
+      LOG_INFO("Set ACL priority: High Priority and Low Latency Mode");
+      vs_param = HCI_BRCM_ACL_HIGH_PRIORITY_LOW_LATENCY;
+      p_lcb->set_latency(L2CAP_LATENCY_LOW);
+    } else {
+      LOG_INFO("Set ACL priority: High Priority Mode");
+      vs_param = HCI_BRCM_ACL_HIGH_PRIORITY;
+    }
+  } else {
+    // priority to normal
+    LOG_INFO("Set ACL priority: Normal Mode");
+    vs_param = HCI_BRCM_ACL_NORMAL_PRIORITY;
+    p_lcb->set_latency(L2CAP_LATENCY_NORMAL);
+  }
+
+  uint8_t command[HCI_BRCM_ACL_PRIORITY_PARAM_SIZE];
+  uint8_t* pp = command;
+  UINT16_TO_STREAM(pp, p_lcb->Handle());
+  UINT8_TO_STREAM(pp, vs_param);
+
+  BTM_VendorSpecificCommand(HCI_BRCM_SET_ACL_PRIORITY,
+                            HCI_BRCM_ACL_PRIORITY_PARAM_SIZE, command, NULL);
+}
+
+/*******************************************************************************
+ *
+ * Function         l2cu_set_acl_priority_syna
+ *
+ * Description      Sends a VSC to set the ACL priority on Synaptics chip.
+ *
+ * Returns          void
+ *
+ ******************************************************************************/
+
+static void l2cu_set_acl_priority_syna(uint16_t handle,
+                                       tL2CAP_PRIORITY priority) {
+  uint8_t* pp;
+  uint8_t command[HCI_SYNA_ACL_PRIORITY_PARAM_SIZE];
+  uint8_t vs_param;
+
+  pp = command;
+  vs_param = (priority == L2CAP_PRIORITY_HIGH) ? HCI_SYNA_ACL_PRIORITY_HIGH
+                                               : HCI_SYNA_ACL_PRIORITY_LOW;
+  UINT16_TO_STREAM(pp, handle);
+  UINT8_TO_STREAM(pp, vs_param);
+
+  BTM_VendorSpecificCommand(HCI_SYNA_SET_ACL_PRIORITY,
+                            HCI_SYNA_ACL_PRIORITY_PARAM_SIZE, command, NULL);
+}
+
+/*******************************************************************************
+ *
  * Function         l2cu_set_acl_priority
  *
  * Description      Sets the transmission priority for a channel.
@@ -2227,9 +2302,6 @@
 bool l2cu_set_acl_priority(const RawAddress& bd_addr, tL2CAP_PRIORITY priority,
                            bool reset_after_rs) {
   tL2C_LCB* p_lcb;
-  uint8_t* pp;
-  uint8_t command[HCI_BRCM_ACL_PRIORITY_PARAM_SIZE];
-  uint8_t vs_param;
 
   APPL_TRACE_EVENT("SET ACL PRIORITY %d", priority);
 
@@ -2240,24 +2312,24 @@
     return (false);
   }
 
-  if (controller_get_interface()->get_bt_version()->manufacturer ==
-      LMP_COMPID_BROADCOM) {
-    /* Called from above L2CAP through API; send VSC if changed */
-    if ((!reset_after_rs && (priority != p_lcb->acl_priority)) ||
-        /* Called because of a central/peripheral role switch; if high resend
-           VSC */
-        (reset_after_rs && p_lcb->acl_priority == L2CAP_PRIORITY_HIGH)) {
-      pp = command;
+  /* Link priority is set if:
+   * 1. Change in priority requested from above L2CAP through API, Or
+   * 2. High priority requested because of central/peripheral role switch */
+  if ((!reset_after_rs && (priority != p_lcb->acl_priority)) ||
+      (reset_after_rs && p_lcb->acl_priority == L2CAP_PRIORITY_HIGH)) {
+    /* Use vendor specific commands to set the link priority */
+    switch (controller_get_interface()->get_bt_version()->manufacturer) {
+      case LMP_COMPID_BROADCOM:
+        l2cu_set_acl_priority_latency_brcm(p_lcb, priority);
+        break;
 
-      vs_param = (priority == L2CAP_PRIORITY_HIGH) ? HCI_BRCM_ACL_PRIORITY_HIGH
-                                                   : HCI_BRCM_ACL_PRIORITY_LOW;
+      case LMP_COMPID_SYNAPTICS:
+        l2cu_set_acl_priority_syna(p_lcb->Handle(), priority);
+        break;
 
-      UINT16_TO_STREAM(pp, p_lcb->Handle());
-      UINT8_TO_STREAM(pp, vs_param);
-
-      BTM_VendorSpecificCommand(HCI_BRCM_SET_ACL_PRIORITY,
-                                HCI_BRCM_ACL_PRIORITY_PARAM_SIZE, command,
-                                NULL);
+      default:
+        /* Not supported/required for other vendors */
+        break;
     }
   }
 
@@ -2269,6 +2341,72 @@
   return (true);
 }
 
+/*******************************************************************************
+ *
+ * Function         l2cu_set_acl_latency_brcm
+ *
+ * Description      Sends a VSC to set the ACL latency on Broadcom chip.
+ *
+ * Returns          void
+ *
+ ******************************************************************************/
+
+static void l2cu_set_acl_latency_brcm(tL2C_LCB* p_lcb, tL2CAP_LATENCY latency) {
+  LOG_INFO("Set ACL latency: %s",
+           latency == L2CAP_LATENCY_LOW ? "Low Latancy" : "Normal Latency");
+
+  uint8_t command[HCI_BRCM_ACL_PRIORITY_PARAM_SIZE];
+  uint8_t* pp = command;
+  uint8_t vs_param = latency == L2CAP_LATENCY_LOW
+                         ? HCI_BRCM_ACL_HIGH_PRIORITY_LOW_LATENCY
+                         : HCI_BRCM_ACL_HIGH_PRIORITY;
+  UINT16_TO_STREAM(pp, p_lcb->Handle());
+  UINT8_TO_STREAM(pp, vs_param);
+
+  BTM_VendorSpecificCommand(HCI_BRCM_SET_ACL_PRIORITY,
+                            HCI_BRCM_ACL_PRIORITY_PARAM_SIZE, command, NULL);
+}
+
+/*******************************************************************************
+ *
+ * Function         l2cu_set_acl_latency
+ *
+ * Description      Sets the transmission latency for a channel.
+ *
+ * Returns          true if a valid channel, else false
+ *
+ ******************************************************************************/
+
+bool l2cu_set_acl_latency(const RawAddress& bd_addr, tL2CAP_LATENCY latency) {
+  LOG_INFO("Set ACL low latency: %d", latency);
+
+  /* Find the link control block for the acl channel */
+  tL2C_LCB* p_lcb = l2cu_find_lcb_by_bd_addr(bd_addr, BT_TRANSPORT_BR_EDR);
+
+  if (p_lcb == nullptr) {
+    LOG_WARN("Set latency failed: LCB is null");
+    return false;
+  }
+  /* only change controller's latency when stream using latency mode */
+  if (p_lcb->use_latency_mode && p_lcb->is_high_priority() &&
+      latency != p_lcb->acl_latency) {
+    switch (controller_get_interface()->get_bt_version()->manufacturer) {
+      case LMP_COMPID_BROADCOM:
+        l2cu_set_acl_latency_brcm(p_lcb, latency);
+        break;
+
+      default:
+        /* Not supported/required for other vendors */
+        break;
+    }
+    p_lcb->set_latency(latency);
+  }
+  /* save the latency mode even if acl does not use latency mode or start*/
+  p_lcb->preset_acl_latency = latency;
+
+  return true;
+}
+
 /******************************************************************************
  *
  * Function         l2cu_set_non_flushable_pbf
@@ -2473,11 +2611,11 @@
   for (xx = 0; xx < L2CAP_NUM_FIXED_CHNLS; xx++) {
     if ((p_lcb->p_fixed_ccbs[xx] != NULL) &&
         (p_lcb->p_fixed_ccbs[xx]->fixed_chnl_idle_tout * 1000 > timeout_ms)) {
-
-      if (p_lcb->p_fixed_ccbs[xx]->fixed_chnl_idle_tout == L2CAP_NO_IDLE_TIMEOUT) {
-         L2CAP_TRACE_DEBUG("%s NO IDLE timeout set for fixed cid 0x%04x", __func__,
-            p_lcb->p_fixed_ccbs[xx]->local_cid);
-         start_timeout = false;
+      if (p_lcb->p_fixed_ccbs[xx]->fixed_chnl_idle_tout ==
+          L2CAP_NO_IDLE_TIMEOUT) {
+        L2CAP_TRACE_DEBUG("%s NO IDLE timeout set for fixed cid 0x%04x",
+                          __func__, p_lcb->p_fixed_ccbs[xx]->local_cid);
+        start_timeout = false;
       }
       timeout_ms = p_lcb->p_fixed_ccbs[xx]->fixed_chnl_idle_tout * 1000;
     }
@@ -2486,6 +2624,24 @@
   /* If the link is pairing, do not mess with the timeouts */
   if (p_lcb->IsBonding()) return;
 
+  L2CAP_TRACE_DEBUG("l2cu_no_dynamic_ccbs() with_active_local_clients=%d",
+                    p_lcb->with_active_local_clients);
+  // Inactive connections should not timeout, since the ATT channel might still
+  // be in use even without a GATT client. We only timeout if either a dynamic
+  // channel or a GATT client was used, since then we expect the client to
+  // manage the lifecycle of the connection.
+
+  // FOR T ONLY: We add the outer safety-check to only do this for LE/ATT, to
+  // minimize behavioral changes outside a dessert release. But for consistency
+  // this should happen throughout on U (i.e. for classic transport + other
+  // fixed channels too)
+  if (p_lcb->p_fixed_ccbs[L2CAP_ATT_CID - L2CAP_FIRST_FIXED_CHNL] != NULL) {
+    if (bluetooth::common::init_flags::finite_att_timeout_is_enabled() &&
+        !p_lcb->with_active_local_clients) {
+      return;
+    }
+  }
+
   if (timeout_ms == 0) {
     L2CAP_TRACE_DEBUG(
         "l2cu_no_dynamic_ccbs() IDLE timer 0, disconnecting link");
diff --git a/system/stack/metrics/stack_metrics_logging.cc b/system/stack/metrics/stack_metrics_logging.cc
index 4e23bd2..d69d54e 100644
--- a/system/stack/metrics/stack_metrics_logging.cc
+++ b/system/stack/metrics/stack_metrics_logging.cc
@@ -42,9 +42,9 @@
       hci_ble_event, cmd_status, reason_code);
 }
 
-void log_smp_pairing_event(const RawAddress& address, uint8_t smp_cmd,
+void log_smp_pairing_event(const RawAddress& address, uint16_t smp_cmd,
                            android::bluetooth::DirectionEnum direction,
-                           uint8_t smp_fail_reason) {
+                           uint16_t smp_fail_reason) {
   bluetooth::shim::LogMetricSmpPairingEvent(address, smp_cmd, direction,
                                             smp_fail_reason);
 }
diff --git a/system/stack/rfcomm/port_api.cc b/system/stack/rfcomm/port_api.cc
index cca0f05..3af79ab 100644
--- a/system/stack/rfcomm/port_api.cc
+++ b/system/stack/rfcomm/port_api.cc
@@ -71,30 +71,13 @@
                                             "Invalid SCN",
                                             "Unknown result code"};
 
-int RFCOMM_CreateConnectionWithSecurity(uint16_t uuid, uint8_t scn,
-                                        bool is_server, uint16_t mtu,
-                                        const RawAddress& bd_addr,
-                                        uint16_t* p_handle,
-                                        tPORT_CALLBACK* p_mgmt_cb,
-                                        uint16_t sec_mask) {
-  rfcomm_security_records[scn] = sec_mask;
-
-  return RFCOMM_CreateConnection(uuid, scn, is_server, mtu, bd_addr, p_handle,
-                                 p_mgmt_cb);
-}
-
-extern void RFCOMM_ClearSecurityRecord(uint32_t scn) {
-  rfcomm_security_records.erase(scn);
-}
-
 /*******************************************************************************
  *
- * Function         RFCOMM_CreateConnection
+ * Function         RFCOMM_CreateConnectionWithSecurity
  *
- * Description      RFCOMM_CreateConnection function is used from the
- *                  application to establish serial port connection to the peer
- *                  device, or allow RFCOMM to accept a connection from the peer
- *                  application.
+ * Description      RFCOMM_CreateConnectionWithSecurity function is used from
+ *the application to establish serial port connection to the peer device, or
+ *allow RFCOMM to accept a connection from the peer application.
  *
  * Parameters:      scn          - Service Channel Number as registered with
  *                                 the SDP (server) or obtained using SDP from
@@ -102,12 +85,12 @@
  *                  is_server    - true if requesting application is a server
  *                  mtu          - Maximum frame size the application can accept
  *                  bd_addr      - address of the peer (client)
- *                  mask         - specifies events to be enabled.  A value
- *                                 of zero disables all events.
  *                  p_handle     - OUT pointer to the handle.
  *                  p_mgmt_cb    - pointer to callback function to receive
  *                                 connection up/down events.
- * Notes:
+ *                  sec_mask     - bitmask of BTM_SEC_* values indicating the
+ *                                 minimum security requirements for this
+ *connection Notes:
  *
  * Server can call this function with the same scn parameter multiple times if
  * it is ready to accept multiple simulteneous connections.
@@ -118,9 +101,12 @@
  * (scn * 2 + 1) dlci.
  *
  ******************************************************************************/
-int RFCOMM_CreateConnection(uint16_t uuid, uint8_t scn, bool is_server,
-                            uint16_t mtu, const RawAddress& bd_addr,
-                            uint16_t* p_handle, tPORT_CALLBACK* p_mgmt_cb) {
+int RFCOMM_CreateConnectionWithSecurity(uint16_t uuid, uint8_t scn,
+                                        bool is_server, uint16_t mtu,
+                                        const RawAddress& bd_addr,
+                                        uint16_t* p_handle,
+                                        tPORT_CALLBACK* p_mgmt_cb,
+                                        uint16_t sec_mask) {
   *p_handle = 0;
 
   if ((scn == 0) || (scn >= PORT_MAX_RFC_PORTS)) {
@@ -176,6 +162,7 @@
                << ", dlci=" << +dlci;
     return PORT_NO_RESOURCES;
   }
+  p_port->sec_mask = sec_mask;
   *p_handle = p_port->handle;
 
   // Get default signal state
@@ -1126,7 +1113,6 @@
  ******************************************************************************/
 void RFCOMM_Init(void) {
   memset(&rfc_cb, 0, sizeof(tRFC_CB)); /* Init RFCOMM control block */
-  rfcomm_security_records = {};
   rfc_lcid_mcb = {};
 
   rfc_cb.rfc.last_mux = MAX_BD_CONNECTIONS;
@@ -1173,3 +1159,23 @@
 
   return result_code_strings[result_code];
 }
+
+/*******************************************************************************
+ *
+ * Function         PORT_GetSecurityMask
+ *
+ * Description      This function returns the security bitmask for a port.
+ *
+ * Returns          A result code, and writes the bitmask into the output
+ *parameter.
+ *
+ ******************************************************************************/
+int PORT_GetSecurityMask(uint16_t handle, uint16_t* sec_mask) {
+  /* Check if handle is valid to avoid crashing */
+  if ((handle == 0) || (handle > MAX_RFC_PORTS)) {
+    return (PORT_BAD_HANDLE);
+  }
+  tPORT* p_port = &rfc_cb.port.port[handle - 1];
+  *sec_mask = p_port->sec_mask;
+  return (PORT_SUCCESS);
+}
diff --git a/system/stack/rfcomm/port_int.h b/system/stack/rfcomm/port_int.h
index e406d4a..61935b1 100644
--- a/system/stack/rfcomm/port_int.h
+++ b/system/stack/rfcomm/port_int.h
@@ -189,6 +189,8 @@
   bool keep_port_handle;    /* true if port is not deallocated when closing */
   /* it is set to true for server when allocating port */
   uint16_t keep_mtu; /* Max MTU that port can receive by server */
+  uint16_t sec_mask; /* Bitmask of security requirements for this port */
+                     /* see the BTM_SEC_* values in btm_api_types.h */
 } tPORT;
 
 /* Define the PORT/RFCOMM control structure
diff --git a/system/stack/rfcomm/rfc_int.h b/system/stack/rfcomm/rfc_int.h
index 61706a2..f07485e 100644
--- a/system/stack/rfcomm/rfc_int.h
+++ b/system/stack/rfcomm/rfc_int.h
@@ -179,9 +179,6 @@
 
 extern tRFC_CB rfc_cb;
 
-extern std::unordered_map<uint32_t /* scn */, uint16_t /* sec_mask */>
-    rfcomm_security_records;
-
 /* MCB based on the L2CAP's lcid */
 extern std::unordered_map<uint16_t /* cid */, tRFC_MCB*> rfc_lcid_mcb;
 
diff --git a/system/stack/rfcomm/rfc_port_fsm.cc b/system/stack/rfcomm/rfc_port_fsm.cc
index 7c751d1..cd5cbb9 100644
--- a/system/stack/rfcomm/rfc_port_fsm.cc
+++ b/system/stack/rfcomm/rfc_port_fsm.cc
@@ -122,18 +122,12 @@
  ******************************************************************************/
 void rfc_port_sm_state_closed(tPORT* p_port, tRFC_PORT_EVENT event,
                               void* p_data) {
-  uint32_t scn = (uint32_t)(p_port->dlci / 2);
   switch (event) {
     case RFC_PORT_EVENT_OPEN:
       p_port->rfc.state = RFC_STATE_ORIG_WAIT_SEC_CHECK;
-      if (rfcomm_security_records.count(scn) == 0) {
-        rfc_sec_check_complete(nullptr, BT_TRANSPORT_BR_EDR, p_port,
-                               BTM_NO_RESOURCES);
-        return;
-      }
       btm_sec_mx_access_request(p_port->rfc.p_mcb->bd_addr, true,
-                                rfcomm_security_records[scn],
-                                &rfc_sec_check_complete, p_port);
+                                p_port->sec_mask, &rfc_sec_check_complete,
+                                p_port);
       return;
 
     case RFC_PORT_EVENT_CLOSE:
@@ -153,14 +147,9 @@
 
       /* Open will be continued after security checks are passed */
       p_port->rfc.state = RFC_STATE_TERM_WAIT_SEC_CHECK;
-      if (rfcomm_security_records.count(scn) == 0) {
-        rfc_sec_check_complete(nullptr, BT_TRANSPORT_BR_EDR, p_port,
-                               BTM_NO_RESOURCES);
-        return;
-      }
       btm_sec_mx_access_request(p_port->rfc.p_mcb->bd_addr, true,
-                                rfcomm_security_records[scn],
-                                &rfc_sec_check_complete, p_port);
+                                p_port->sec_mask, &rfc_sec_check_complete,
+                                p_port);
       return;
 
     case RFC_PORT_EVENT_UA:
diff --git a/system/stack/rfcomm/rfc_port_if.cc b/system/stack/rfcomm/rfc_port_if.cc
index 300d848..5ef820e 100644
--- a/system/stack/rfcomm/rfc_port_if.cc
+++ b/system/stack/rfcomm/rfc_port_if.cc
@@ -33,7 +33,6 @@
 #include "stack/rfcomm/rfc_int.h"
 
 tRFC_CB rfc_cb;
-std::unordered_map<uint32_t, uint16_t> rfcomm_security_records;
 std::unordered_map<uint16_t /* sci */, tRFC_MCB*> rfc_lcid_mcb;
 
 /*******************************************************************************
diff --git a/system/stack/rfcomm/rfc_ts_frames.cc b/system/stack/rfcomm/rfc_ts_frames.cc
index ecd2d74..62fdfe0 100644
--- a/system/stack/rfcomm/rfc_ts_frames.cc
+++ b/system/stack/rfcomm/rfc_ts_frames.cc
@@ -534,12 +534,10 @@
     len += (*(p_data)++ << RFCOMM_SHIFT_LENGTH2);
   } else if (eal == 0) {
     RFCOMM_TRACE_ERROR("Bad Length when EAL = 0: %d", p_buf->len);
-    android_errorWriteLog(0x534e4554, "78288018");
     return RFC_EVENT_BAD_FRAME;
   }
 
   if (p_buf->len < (3 + !ead + !eal + 1)) {
-    android_errorWriteLog(0x534e4554, "120255805");
     RFCOMM_TRACE_ERROR("Bad Length: %d", p_buf->len);
     return RFC_EVENT_BAD_FRAME;
   }
@@ -645,7 +643,6 @@
     RFCOMM_TRACE_ERROR(
         "%s: Illegal MX Frame len when reading EA, C/R. len:%d < 2", __func__,
         length);
-    android_errorWriteLog(0x534e4554, "111937065");
     osi_free(p_buf);
     return;
   }
@@ -674,7 +671,6 @@
     if (length < 1) {
       RFCOMM_TRACE_ERROR("%s: Illegal MX Frame when EA = 0. len:%d < 1",
                          __func__, length);
-      android_errorWriteLog(0x534e4554, "111937065");
       osi_free(p_buf);
       return;
     }
@@ -757,7 +753,6 @@
       if (length != RFCOMM_MX_MSC_LEN_WITH_BREAK &&
           length != RFCOMM_MX_MSC_LEN_NO_BREAK) {
         RFCOMM_TRACE_ERROR("%s: Illegal MX MSC Frame len:%d", __func__, length);
-        android_errorWriteLog(0x534e4554, "111937065");
         osi_free(p_buf);
         return;
       }
diff --git a/system/stack/sdp/sdp_discovery.cc b/system/stack/sdp/sdp_discovery.cc
index 38db635..f025df8 100644
--- a/system/stack/sdp/sdp_discovery.cc
+++ b/system/stack/sdp/sdp_discovery.cc
@@ -245,7 +245,6 @@
   uint8_t* p_end = p + p_msg->len;
 
   if (p_msg->len < 1) {
-    android_errorWriteLog(0x534e4554, "79883568");
     sdp_disconnect(p_ccb, SDP_GENERIC_ERROR);
     return;
   }
@@ -301,7 +300,6 @@
   uint8_t cont_len;
 
   if (p_reply + 8 > p_reply_end) {
-    android_errorWriteLog(0x534e4554, "74249842");
     sdp_disconnect(p_ccb, SDP_GENERIC_ERROR);
     return;
   }
@@ -324,7 +322,6 @@
     p_ccb->num_handles = sdp_cb.max_recs_per_search;
 
   if (p_reply + ((p_ccb->num_handles - orig) * 4) + 1 > p_reply_end) {
-    android_errorWriteLog(0x534e4554, "74249842");
     sdp_disconnect(p_ccb, SDP_GENERIC_ERROR);
     return;
   }
@@ -339,7 +336,6 @@
       return;
     }
     if (p_reply + cont_len > p_reply_end) {
-      android_errorWriteLog(0x534e4554, "68161546");
       sdp_disconnect(p_ccb, SDP_INVALID_CONT_STATE);
       return;
     }
@@ -373,7 +369,7 @@
   uint8_t* p_end;
   uint8_t type;
 
-  if (p_ccb->p_db->raw_data) {
+  if (p_ccb->p_db && p_ccb->p_db->raw_data) {
     cpy_len = p_ccb->p_db->raw_size - p_ccb->p_db->raw_used;
     list_len = p_ccb->list_len;
     p = &p_ccb->rsp_list[0];
@@ -513,8 +509,6 @@
       if ((p_reply + *p_reply + 1) <= p_reply_end) {
         memcpy(p, p_reply, *p_reply + 1);
         p += *p_reply + 1;
-      } else {
-        android_errorWriteLog(0x534e4554, "68161546");
       }
     } else
       UINT8_TO_BE_STREAM(p, 0);
@@ -560,7 +554,6 @@
   if (p_reply) {
     if (p_reply + 4 /* transaction ID and length */ + sizeof(lists_byte_count) >
         p_reply_end) {
-      android_errorWriteLog(0x534e4554, "79884292");
       sdp_disconnect(p_ccb, SDP_INVALID_PDU_SIZE);
       return;
     }
@@ -578,7 +571,6 @@
     }
 
     if (p_reply + lists_byte_count + 1 /* continuation */ > p_reply_end) {
-      android_errorWriteLog(0x534e4554, "79884292");
       sdp_disconnect(p_ccb, SDP_INVALID_PDU_SIZE);
       return;
     }
@@ -650,8 +642,6 @@
       if ((p_reply + *p_reply + 1) <= p_reply_end) {
         memcpy(p, p_reply, *p_reply + 1);
         p += *p_reply + 1;
-      } else {
-        android_errorWriteLog(0x534e4554, "68161546");
       }
     } else
       UINT8_TO_BE_STREAM(p, 0);
@@ -689,7 +679,6 @@
 
   if ((type >> 3) != DATA_ELE_SEQ_DESC_TYPE) {
     LOG_WARN("Wrong element in attr_rsp type:0x%02x", type);
-    android_errorWriteLog(0x534e4554, "224545125");
     sdp_disconnect(p_ccb, SDP_ILLEGAL_PARAMETER);
     return;
   }
@@ -863,7 +852,6 @@
 
   p_attr_end = p + attr_len;
   if (p_attr_end > p_end) {
-    android_errorWriteLog(0x534e4554, "115900043");
     SDP_TRACE_WARNING("%s: SDP - Attribute length beyond p_end", __func__);
     return NULL;
   }
diff --git a/system/stack/sdp/sdp_main.cc b/system/stack/sdp/sdp_main.cc
index 609c22c..9719d0f 100644
--- a/system/stack/sdp/sdp_main.cc
+++ b/system/stack/sdp/sdp_main.cc
@@ -22,8 +22,10 @@
  *
  ******************************************************************************/
 
+#include <base/logging.h>
 #include <string.h>  // memset
 
+#include "gd/common/init_flags.h"
 #include "osi/include/allocator.h"
 #include "osi/include/osi.h"  // UNUSED_ATTR
 #include "stack/include/bt_hdr.h"
@@ -34,8 +36,6 @@
 #include "stack/sdp/sdpint.h"
 #include "types/raw_address.h"
 
-#include <base/logging.h>
-
 /******************************************************************************/
 /*                     G L O B A L      S D P       D A T A                   */
 /******************************************************************************/
@@ -256,20 +256,23 @@
     SDP_TRACE_WARNING("SDP - Rcvd L2CAP disc, unknown CID: 0x%x", l2cap_cid);
     return;
   }
+  tCONN_CB& ccb = *p_ccb;
 
-  SDP_TRACE_EVENT("SDP - Rcvd L2CAP disc, CID: 0x%x", l2cap_cid);
-  /* Tell the user if there is a callback */
-  if (p_ccb->p_cb)
-    (*p_ccb->p_cb)(((p_ccb->con_state == SDP_STATE_CONNECTED)
-                        ? SDP_SUCCESS
-                        : SDP_CONN_FAILED));
-  else if (p_ccb->p_cb2)
-    (*p_ccb->p_cb2)(
-        ((p_ccb->con_state == SDP_STATE_CONNECTED) ? SDP_SUCCESS
-                                                   : SDP_CONN_FAILED),
-        p_ccb->user_data);
+  const tSDP_REASON reason =
+      (ccb.con_state == SDP_STATE_CONNECTED) ? SDP_SUCCESS : SDP_CONN_FAILED;
+  sdpu_callback(ccb, reason);
 
-  sdpu_release_ccb(p_ccb);
+  if (ack_needed) {
+    SDP_TRACE_WARNING("SDP - Rcvd L2CAP disc, process pend sdp ccb: 0x%x",
+                      l2cap_cid);
+    sdpu_process_pend_ccb_new_cid(ccb);
+  } else {
+    SDP_TRACE_WARNING("SDP - Rcvd L2CAP disc, clear pend sdp ccb: 0x%x",
+                      l2cap_cid);
+    sdpu_clear_pend_ccb(ccb);
+  }
+
+  sdpu_release_ccb(ccb);
 }
 
 /*******************************************************************************
@@ -345,13 +348,24 @@
    */
   p_ccb->con_state = SDP_STATE_CONN_SETUP;
 
-  cid = L2CA_ConnectReq2(BT_PSM_SDP, p_bd_addr, BTM_SEC_NONE);
+  // Look for any active sdp connection on the remote device
+  cid = sdpu_get_active_ccb_cid(p_bd_addr);
+
+  if (!bluetooth::common::init_flags::sdp_serialization_is_enabled() ||
+      cid == 0) {
+    p_ccb->con_state = SDP_STATE_CONN_SETUP;
+    cid = L2CA_ConnectReq2(BT_PSM_SDP, p_bd_addr, BTM_SEC_NONE);
+  } else {
+    p_ccb->con_state = SDP_STATE_CONN_PEND;
+    SDP_TRACE_WARNING("SDP already active for peer %s. cid=%#0x",
+                      p_bd_addr.ToString().c_str(), cid);
+  }
 
   /* Check if L2CAP started the connection process */
   if (cid == 0) {
     SDP_TRACE_WARNING("%s: SDP - Originate failed for peer %s", __func__,
                       p_bd_addr.ToString().c_str());
-    sdpu_release_ccb(p_ccb);
+    sdpu_release_ccb(*p_ccb);
     return (NULL);
   }
   p_ccb->connection_id = cid;
@@ -368,24 +382,26 @@
  *
  ******************************************************************************/
 void sdp_disconnect(tCONN_CB* p_ccb, tSDP_REASON reason) {
-  SDP_TRACE_EVENT("SDP - disconnect  CID: 0x%x", p_ccb->connection_id);
+  tCONN_CB& ccb = *p_ccb;
+  SDP_TRACE_EVENT("SDP - disconnect  CID: 0x%x", ccb.connection_id);
 
   /* Check if we have a connection ID */
-  if (p_ccb->connection_id != 0) {
-    L2CA_DisconnectReq(p_ccb->connection_id);
-    p_ccb->disconnect_reason = reason;
+  if (ccb.connection_id != 0) {
+    ccb.disconnect_reason = reason;
+    if (SDP_SUCCESS == reason && sdpu_process_pend_ccb_same_cid(*p_ccb)) {
+      sdpu_callback(ccb, reason);
+      sdpu_release_ccb(ccb);
+      return;
+    } else {
+      L2CA_DisconnectReq(ccb.connection_id);
+    }
   }
 
   /* If at setup state, we may not get callback ind from L2CAP */
   /* Call user callback immediately */
-  if (p_ccb->con_state == SDP_STATE_CONN_SETUP) {
-    /* Tell the user if there is a callback */
-    if (p_ccb->p_cb)
-      (*p_ccb->p_cb)(reason);
-    else if (p_ccb->p_cb2)
-      (*p_ccb->p_cb2)(reason, p_ccb->user_data);
-
-    sdpu_release_ccb(p_ccb);
+  if (ccb.con_state == SDP_STATE_CONN_SETUP) {
+    sdpu_callback(ccb, reason);
+    sdpu_release_ccb(ccb);
   }
 }
 
@@ -409,17 +425,13 @@
                       l2cap_cid);
     return;
   }
+  tCONN_CB& ccb = *p_ccb;
 
   SDP_TRACE_EVENT("SDP - Rcvd L2CAP disc cfm, CID: 0x%x", l2cap_cid);
 
-  /* Tell the user if there is a callback */
-  if (p_ccb->p_cb)
-    (*p_ccb->p_cb)(static_cast<tSDP_STATUS>(p_ccb->disconnect_reason));
-  else if (p_ccb->p_cb2)
-    (*p_ccb->p_cb2)(static_cast<tSDP_STATUS>(p_ccb->disconnect_reason),
-                    p_ccb->user_data);
-
-  sdpu_release_ccb(p_ccb);
+  sdpu_callback(ccb, static_cast<tSDP_STATUS>(ccb.disconnect_reason));
+  sdpu_process_pend_ccb_new_cid(ccb);
+  sdpu_release_ccb(ccb);
 }
 
 /*******************************************************************************
@@ -433,16 +445,14 @@
  *
  ******************************************************************************/
 void sdp_conn_timer_timeout(void* data) {
-  tCONN_CB* p_ccb = (tCONN_CB*)data;
+  tCONN_CB& ccb = *(tCONN_CB*)data;
 
-  SDP_TRACE_EVENT("SDP - CCB timeout in state: %d  CID: 0x%x", p_ccb->con_state,
-                  p_ccb->connection_id);
+  SDP_TRACE_EVENT("SDP - CCB timeout in state: %d  CID: 0x%x", ccb.con_state,
+                  ccb.connection_id);
 
-  L2CA_DisconnectReq(p_ccb->connection_id);
-  /* Tell the user if there is a callback */
-  if (p_ccb->p_cb)
-    (*p_ccb->p_cb)(SDP_CONN_FAILED);
-  else if (p_ccb->p_cb2)
-    (*p_ccb->p_cb2)(SDP_CONN_FAILED, p_ccb->user_data);
-  sdpu_release_ccb(p_ccb);
+  L2CA_DisconnectReq(ccb.connection_id);
+
+  sdpu_callback(ccb, SDP_CONN_FAILED);
+  sdpu_clear_pend_ccb(ccb);
+  sdpu_release_ccb(ccb);
 }
diff --git a/system/stack/sdp/sdp_server.cc b/system/stack/sdp/sdp_server.cc
index 4842ecc..76121f6 100644
--- a/system/stack/sdp/sdp_server.cc
+++ b/system/stack/sdp/sdp_server.cc
@@ -118,8 +118,6 @@
                      sdp_conn_timer_timeout, p_ccb);
 
   if (p_req + sizeof(pdu_id) + sizeof(trans_num) > p_req_end) {
-    android_errorWriteLog(0x534e4554, "69384124");
-    android_errorWriteLog(0x534e4554, "169342531");
     trans_num = 0;
     sdpu_build_n_send_error(p_ccb, trans_num, SDP_INVALID_REQ_SYNTAX,
                             SDP_TEXT_BAD_HEADER);
@@ -133,8 +131,6 @@
   BE_STREAM_TO_UINT16(trans_num, p_req);
 
   if (p_req + sizeof(param_len) > p_req_end) {
-    android_errorWriteLog(0x534e4554, "69384124");
-    android_errorWriteLog(0x534e4554, "169342531");
     sdpu_build_n_send_error(p_ccb, trans_num, SDP_INVALID_REQ_SYNTAX,
                             SDP_TEXT_BAD_HEADER);
     return;
@@ -202,7 +198,6 @@
 
   /* Get the max replies we can send. Cap it at our max anyways. */
   if (p_req + sizeof(max_replies) + sizeof(uint8_t) > p_req_end) {
-    android_errorWriteLog(0x534e4554, "69384124");
     sdpu_build_n_send_error(p_ccb, trans_num, SDP_INVALID_REQ_SYNTAX,
                             SDP_TEXT_BAD_MAX_RECORDS_LIST);
     return;
@@ -329,7 +324,6 @@
   uint16_t attr_len;
 
   if (p_req + sizeof(rec_handle) + sizeof(max_list_len) > p_req_end) {
-    android_errorWriteLog(0x534e4554, "69384124");
     sdpu_build_n_send_error(p_ccb, trans_num, SDP_INVALID_SERV_REC_HDL,
                             SDP_TEXT_BAD_HANDLE);
     return;
@@ -367,7 +361,6 @@
 
   if (max_list_len < 4) {
     sdpu_build_n_send_error(p_ccb, trans_num, SDP_ILLEGAL_PARAMETER, NULL);
-    android_errorWriteLog(0x534e4554, "68776054");
     return;
   }
 
@@ -441,7 +434,6 @@
       /* if there is a partial attribute pending to be sent */
       if (p_ccb->cont_info.attr_offset) {
         if (attr_len < p_ccb->cont_info.attr_offset) {
-          android_errorWriteLog(0x534e4554, "79217770");
           LOG(ERROR) << "offset is bigger than attribute length";
           sdpu_build_n_send_error(p_ccb, trans_num, SDP_INVALID_CONT_STATE,
                                   SDP_TEXT_BAD_CONT_LEN);
@@ -609,7 +601,6 @@
 
   if (max_list_len < 4) {
     sdpu_build_n_send_error(p_ccb, trans_num, SDP_ILLEGAL_PARAMETER, NULL);
-    android_errorWriteLog(0x534e4554, "68817966");
     return;
   }
 
@@ -704,7 +695,6 @@
         /* if there is a partial attribute pending to be sent */
         if (p_ccb->cont_info.attr_offset) {
           if (attr_len < p_ccb->cont_info.attr_offset) {
-            android_errorWriteLog(0x534e4554, "79217770");
             LOG(ERROR) << "offset is bigger than attribute length";
             sdpu_build_n_send_error(p_ccb, trans_num, SDP_INVALID_CONT_STATE,
                                     SDP_TEXT_BAD_CONT_LEN);
diff --git a/system/stack/sdp/sdp_utils.cc b/system/stack/sdp/sdp_utils.cc
index e919298..79bb131 100644
--- a/system/stack/sdp/sdp_utils.cc
+++ b/system/stack/sdp/sdp_utils.cc
@@ -43,6 +43,7 @@
 #include "stack/include/avrc_api.h"
 #include "stack/include/avrc_defs.h"
 #include "stack/include/bt_hdr.h"
+#include "stack/include/btm_api_types.h"
 #include "stack/include/sdp_api.h"
 #include "stack/include/sdpdefs.h"
 #include "stack/include/stack_metrics_logging.h"
@@ -135,7 +136,6 @@
         SDP_DISC_ATTR_TYPE(p_attr->attr_len_type) == DATA_ELE_SEQ_DESC_TYPE) {
       tSDP_DISC_ATTR* p_first_attr = p_attr->attr_value.v.p_sub_attr;
       if (p_first_attr == nullptr) {
-        android_errorWriteLog(0x534e4554, "227203684");
         return 0;
       }
       if (SDP_DISC_ATTR_TYPE(p_first_attr->attr_len_type) == UUID_DESC_TYPE &&
@@ -320,8 +320,11 @@
 
   /* Look through each connection control block */
   for (xx = 0, p_ccb = sdp_cb.ccb; xx < SDP_MAX_CONNECTIONS; xx++, p_ccb++) {
-    if ((p_ccb->con_state != SDP_STATE_IDLE) && (p_ccb->connection_id == cid))
+    if ((p_ccb->con_state != SDP_STATE_IDLE) &&
+        (p_ccb->con_state != SDP_STATE_CONN_PEND) &&
+        (p_ccb->connection_id == cid)) {
       return (p_ccb);
+    }
   }
 
   /* If here, not found */
@@ -382,6 +385,23 @@
 
 /*******************************************************************************
  *
+ * Function         sdpu_callback
+ *
+ * Description      Tell the user if they have a callback
+ *
+ * Returns          void
+ *
+ ******************************************************************************/
+void sdpu_callback(tCONN_CB& ccb, tSDP_REASON reason) {
+  if (ccb.p_cb) {
+    (ccb.p_cb)(reason);
+  } else if (ccb.p_cb2) {
+    (ccb.p_cb2)(reason, ccb.user_data);
+  }
+}
+
+/*******************************************************************************
+ *
  * Function         sdpu_release_ccb
  *
  * Description      This function releases a CCB.
@@ -389,17 +409,149 @@
  * Returns          void
  *
  ******************************************************************************/
-void sdpu_release_ccb(tCONN_CB* p_ccb) {
+void sdpu_release_ccb(tCONN_CB& ccb) {
   /* Ensure timer is stopped */
-  alarm_cancel(p_ccb->sdp_conn_timer);
+  alarm_cancel(ccb.sdp_conn_timer);
 
   /* Drop any response pointer we may be holding */
-  p_ccb->con_state = SDP_STATE_IDLE;
-  p_ccb->is_attr_search = false;
+  ccb.con_state = SDP_STATE_IDLE;
+  ccb.is_attr_search = false;
 
   /* Free the response buffer */
-  if (p_ccb->rsp_list) SDP_TRACE_DEBUG("releasing SDP rsp_list");
-  osi_free_and_reset((void**)&p_ccb->rsp_list);
+  if (ccb.rsp_list) SDP_TRACE_DEBUG("releasing SDP rsp_list");
+  osi_free_and_reset((void**)&ccb.rsp_list);
+}
+
+/*******************************************************************************
+ *
+ * Function         sdpu_get_active_ccb_cid
+ *
+ * Description      This function checks if any sdp connecting is there for
+ *                  same remote and returns cid if its available
+ *
+ *                  RawAddress : Remote address
+ *
+ * Returns          returns cid if any active sdp connection, else 0.
+ *
+ ******************************************************************************/
+uint16_t sdpu_get_active_ccb_cid(const RawAddress& remote_bd_addr) {
+  uint16_t xx;
+  tCONN_CB* p_ccb;
+
+  // Look through each connection control block for active sdp on given remote
+  for (xx = 0, p_ccb = sdp_cb.ccb; xx < SDP_MAX_CONNECTIONS; xx++, p_ccb++) {
+    if ((p_ccb->con_state == SDP_STATE_CONN_SETUP) ||
+        (p_ccb->con_state == SDP_STATE_CFG_SETUP) ||
+        (p_ccb->con_state == SDP_STATE_CONNECTED)) {
+      if (p_ccb->con_flags & SDP_FLAGS_IS_ORIG &&
+          p_ccb->device_address == remote_bd_addr) {
+        return p_ccb->connection_id;
+      }
+    }
+  }
+
+  // No active sdp channel for this remote
+  return 0;
+}
+
+/*******************************************************************************
+ *
+ * Function         sdpu_process_pend_ccb
+ *
+ * Description      This function process if any sdp ccb pending for connection
+ *                  and reuse the same connection id
+ *
+ *                  tCONN_CB&: connection control block that trigget the process
+ *
+ * Returns          returns true if any pending ccb, else false.
+ *
+ ******************************************************************************/
+bool sdpu_process_pend_ccb_same_cid(tCONN_CB& ccb) {
+  uint16_t xx;
+  tCONN_CB* p_ccb;
+
+  // Look through each connection control block for active sdp on given remote
+  for (xx = 0, p_ccb = sdp_cb.ccb; xx < SDP_MAX_CONNECTIONS; xx++, p_ccb++) {
+    if ((p_ccb->con_state == SDP_STATE_CONN_PEND) &&
+        (p_ccb->connection_id == ccb.connection_id) &&
+        (p_ccb->con_flags & SDP_FLAGS_IS_ORIG)) {
+      p_ccb->con_state = SDP_STATE_CONNECTED;
+      sdp_disc_connected(p_ccb);
+      return true;
+    }
+  }
+  // No pending SDP channel for this remote
+  return false;
+}
+
+/*******************************************************************************
+ *
+ * Function         sdpu_process_pend_ccb_new_cid
+ *
+ * Description      This function process if any sdp ccb pending for connection
+ *                  and update their connection id with a new L2CA connection
+ *
+ *                  tCONN_CB&: connection control block that trigget the process
+ *
+ * Returns          returns true if any pending ccb, else false.
+ *
+ ******************************************************************************/
+bool sdpu_process_pend_ccb_new_cid(tCONN_CB& ccb) {
+  uint16_t xx;
+  tCONN_CB* p_ccb;
+  uint16_t new_cid = 0;
+  bool new_conn = false;
+
+  // Look through each ccb to replace the obsolete cid with a new one.
+  for (xx = 0, p_ccb = sdp_cb.ccb; xx < SDP_MAX_CONNECTIONS; xx++, p_ccb++) {
+    if ((p_ccb->con_state == SDP_STATE_CONN_PEND) &&
+        (p_ccb->connection_id == ccb.connection_id) &&
+        (p_ccb->con_flags & SDP_FLAGS_IS_ORIG)) {
+      if (!new_conn) {
+        // Only change state of the first ccb
+        p_ccb->con_state = SDP_STATE_CONN_SETUP;
+        new_cid =
+            L2CA_ConnectReq2(BT_PSM_SDP, p_ccb->device_address, BTM_SEC_NONE);
+        new_conn = true;
+      }
+      // Check if L2CAP started the connection process
+      if (new_cid != 0) {
+        // update alls cid to the new one for future reference
+        p_ccb->connection_id = new_cid;
+      } else {
+        sdpu_callback(*p_ccb, SDP_CONN_FAILED);
+        sdpu_release_ccb(*p_ccb);
+      }
+    }
+  }
+  return new_conn && new_cid != 0;
+}
+
+/*******************************************************************************
+ *
+ * Function         sdpu_clear_pend_ccb
+ *
+ * Description      This function releases if any sdp ccb pending for connection
+ *
+ *                  uint16_t : Remote CID
+ *
+ * Returns          returns none.
+ *
+ ******************************************************************************/
+void sdpu_clear_pend_ccb(tCONN_CB& ccb) {
+  uint16_t xx;
+  tCONN_CB* p_ccb;
+
+  // Look through each connection control block for active sdp on given remote
+  for (xx = 0, p_ccb = sdp_cb.ccb; xx < SDP_MAX_CONNECTIONS; xx++, p_ccb++) {
+    if ((p_ccb->con_state == SDP_STATE_CONN_PEND) &&
+        (p_ccb->connection_id == ccb.connection_id) &&
+        (p_ccb->con_flags & SDP_FLAGS_IS_ORIG)) {
+      sdpu_callback(*p_ccb, SDP_CONN_FAILED);
+      sdpu_release_ccb(*p_ccb);
+    }
+  }
+  return;
 }
 
 /*******************************************************************************
@@ -1277,17 +1429,25 @@
     return;
   }
 
-  // Some remote devices will have interoperation issue when receive AVRCP
-  // version 1.5. If those devices are in IOP database and our version high than
-  // 1.4, we reply version 1.4 to them.
+  // Some remote devices will have interoperation issue when receive higher
+  // AVRCP version. If those devices are in IOP database and our version higher
+  // than device, we reply a lower version to them.
+  uint16_t iop_version = 0;
   if (avrcp_version > AVRC_REV_1_4 &&
       interop_match_addr(INTEROP_AVRCP_1_4_ONLY, bdaddr)) {
+    iop_version = AVRC_REV_1_4;
+  } else if (avrcp_version > AVRC_REV_1_3 &&
+             interop_match_addr(INTEROP_AVRCP_1_3_ONLY, bdaddr)) {
+    iop_version = AVRC_REV_1_3;
+  }
+
+  if (iop_version != 0) {
     LOG_INFO(
         "device=%s is in IOP database. "
-        "Reply AVRC Target version 1.4 instead of %x.",
-        bdaddr->ToString().c_str(), avrcp_version);
+        "Reply AVRC Target version %x instead of %x.",
+        bdaddr->ToString().c_str(), iop_version, avrcp_version);
     uint8_t* p_version = p_attr->value_ptr + 6;
-    UINT16_TO_BE_FIELD(p_version, AVRC_REV_1_4);
+    UINT16_TO_BE_FIELD(p_version, iop_version);
     return;
   }
 
diff --git a/system/stack/sdp/sdpint.h b/system/stack/sdp/sdpint.h
index 7b25bbc..748cb83 100644
--- a/system/stack/sdp/sdpint.h
+++ b/system/stack/sdp/sdpint.h
@@ -123,11 +123,12 @@
 } tSDP_CONT_INFO;
 
 /* Define the SDP Connection Control Block */
-typedef struct {
+struct tCONN_CB {
 #define SDP_STATE_IDLE 0
 #define SDP_STATE_CONN_SETUP 1
 #define SDP_STATE_CFG_SETUP 2
 #define SDP_STATE_CONNECTED 3
+#define SDP_STATE_CONN_PEND 4
   uint8_t con_state;
 
 #define SDP_FLAGS_IS_ORIG 0x01
@@ -166,8 +167,11 @@
   uint16_t cont_offset;     /* Continuation state data in the server response */
   tSDP_CONT_INFO cont_info; /* structure to hold continuation information for
                                the server response */
+  tCONN_CB() = default;
 
-} tCONN_CB;
+ private:
+  tCONN_CB(const tCONN_CB&) = delete;
+};
 
 /*  The main SDP control block */
 typedef struct {
@@ -199,7 +203,7 @@
 extern tCONN_CB* sdpu_find_ccb_by_cid(uint16_t cid);
 extern tCONN_CB* sdpu_find_ccb_by_db(const tSDP_DISCOVERY_DB* p_db);
 extern tCONN_CB* sdpu_allocate_ccb(void);
-extern void sdpu_release_ccb(tCONN_CB* p_ccb);
+extern void sdpu_release_ccb(tCONN_CB& p_ccb);
 
 extern uint8_t* sdpu_build_attrib_seq(uint8_t* p_out, uint16_t* p_attr,
                                       uint16_t num_attrs);
@@ -236,6 +240,11 @@
 extern bool spdu_is_avrcp_version_valid(const uint16_t version);
 extern void sdpu_set_avrc_target_version(const tSDP_ATTRIBUTE* p_attr,
                                          const RawAddress* bdaddr);
+extern uint16_t sdpu_get_active_ccb_cid(const RawAddress& remote_bd_addr);
+extern bool sdpu_process_pend_ccb_same_cid(tCONN_CB& ccb);
+extern bool sdpu_process_pend_ccb_new_cid(tCONN_CB& ccb);
+extern void sdpu_clear_pend_ccb(tCONN_CB& ccb);
+extern void sdpu_callback(tCONN_CB& ccb, tSDP_REASON reason);
 
 /* Functions provided by sdp_db.cc
  */
diff --git a/system/stack/smp/smp_act.cc b/system/stack/smp/smp_act.cc
index 9aa64cf..3c8218e 100644
--- a/system/stack/smp/smp_act.cc
+++ b/system/stack/smp/smp_act.cc
@@ -505,7 +505,6 @@
   SMP_TRACE_DEBUG("%s", __func__);
 
   if (p_cb->rcvd_cmd_len < 2) {
-    android_errorWriteLog(0x534e4554, "111214739");
     SMP_TRACE_WARNING("%s: rcvd_cmd_len %d too short: must be at least 2",
                       __func__, p_cb->rcvd_cmd_len);
     p_cb->status = SMP_INVALID_PARAMETERS;
@@ -537,7 +536,6 @@
   if (smp_command_has_invalid_length(p_cb)) {
     tSMP_INT_DATA smp_int_data;
     smp_int_data.status = SMP_INVALID_PARAMETERS;
-    android_errorWriteLog(0x534e4554, "111850706");
     smp_sm_event(p_cb, SMP_AUTH_CMPL_EVT, &smp_int_data);
     return;
   }
@@ -712,7 +710,6 @@
   memcpy(pt.y, p_cb->peer_publ_key.y, BT_OCTET32_LEN);
 
   if (!memcmp(p_cb->peer_publ_key.x, p_cb->loc_publ_key.x, BT_OCTET32_LEN)) {
-    android_errorWriteLog(0x534e4554, "174886838");
     SMP_TRACE_WARNING("Remote and local public keys can't match");
     tSMP_INT_DATA smp;
     smp.status = SMP_PAIR_AUTH_FAIL;
@@ -721,7 +718,6 @@
   }
 
   if (!ECC_ValidatePoint(pt)) {
-    android_errorWriteLog(0x534e4554, "72377774");
     tSMP_INT_DATA smp;
     smp.status = SMP_PAIR_AUTH_FAIL;
     smp_sm_event(p_cb, SMP_AUTH_CMPL_EVT, &smp);
@@ -832,7 +828,6 @@
   if (smp_command_has_invalid_length(p_cb)) {
     tSMP_INT_DATA smp_int_data;
     smp_int_data.status = SMP_INVALID_PARAMETERS;
-    android_errorWriteLog(0x534e4554, "111213909");
     smp_br_state_machine_event(p_cb, SMP_BR_AUTH_CMPL_EVT, &smp_int_data);
     return;
   }
@@ -971,7 +966,6 @@
   if (smp_command_has_invalid_parameters(p_cb)) {
     tSMP_INT_DATA smp_int_data;
     smp_int_data.status = SMP_INVALID_PARAMETERS;
-    android_errorWriteLog(0x534e4554, "111937065");
     smp_sm_event(p_cb, SMP_AUTH_CMPL_EVT, &smp_int_data);
     return;
   }
@@ -988,7 +982,6 @@
   SMP_TRACE_DEBUG("%s", __func__);
 
   if (p_cb->rcvd_cmd_len < 11) {  // 1(Code) + 2(EDIV) + 8(Rand)
-    android_errorWriteLog(0x534e4554, "111937027");
     SMP_TRACE_ERROR("%s: Invalid command length: %d, should be at least 11",
                     __func__, p_cb->rcvd_cmd_len);
     return;
@@ -1023,7 +1016,6 @@
   if (smp_command_has_invalid_parameters(p_cb)) {
     tSMP_INT_DATA smp_int_data;
     smp_int_data.status = SMP_INVALID_PARAMETERS;
-    android_errorWriteLog(0x534e4554, "111937065");
     smp_sm_event(p_cb, SMP_AUTH_CMPL_EVT, &smp_int_data);
     return;
   }
@@ -1041,7 +1033,6 @@
   if (smp_command_has_invalid_parameters(p_cb)) {
     tSMP_INT_DATA smp_int_data;
     smp_int_data.status = SMP_INVALID_PARAMETERS;
-    android_errorWriteLog(0x534e4554, "111214770");
     smp_sm_event(p_cb, SMP_AUTH_CMPL_EVT, &smp_int_data);
     return;
   }
@@ -1051,7 +1042,7 @@
   tBTM_LE_KEY_VALUE pid_key = {
       .pid_key = {},
   };
-  ;
+
   STREAM_TO_UINT8(pid_key.pid_key.identity_addr_type, p);
   STREAM_TO_BDADDR(pid_key.pid_key.identity_addr, p);
   pid_key.pid_key.irk = p_cb->tk;
@@ -1079,7 +1070,6 @@
   if (smp_command_has_invalid_parameters(p_cb)) {
     tSMP_INT_DATA smp_int_data;
     smp_int_data.status = SMP_INVALID_PARAMETERS;
-    android_errorWriteLog(0x534e4554, "111214470");
     smp_sm_event(p_cb, SMP_AUTH_CMPL_EVT, &smp_int_data);
     return;
   }
@@ -1307,7 +1297,6 @@
               "%s BR key is higher security than existing LE keys, don't "
               "derive LK from LTK",
               __func__);
-          android_errorWriteLog(0x534e4554, "158854097");
         } else {
           smp_derive_link_key_from_long_term_key(p_cb, NULL);
         }
diff --git a/system/stack/smp/smp_api.cc b/system/stack/smp/smp_api.cc
index 05e68db..9355168 100644
--- a/system/stack/smp/smp_api.cc
+++ b/system/stack/smp/smp_api.cc
@@ -567,10 +567,13 @@
  * Description      This function is called to generate a public key to be
  *                  passed to a remote device via Out of Band transport.
  *
+ * Returns          true if the request is successfully sent and executed by the
+ *                  state machine, false otherwise
+ *
  ******************************************************************************/
-void SMP_CrLocScOobData() {
+bool SMP_CrLocScOobData() {
   tSMP_INT_DATA smp_int_data;
-  smp_sm_event(&smp_cb, SMP_CR_LOC_SC_OOB_DATA_EVT, &smp_int_data);
+  return smp_sm_event(&smp_cb, SMP_CR_LOC_SC_OOB_DATA_EVT, &smp_int_data);
 }
 
 /*******************************************************************************
diff --git a/system/stack/smp/smp_br_main.cc b/system/stack/smp/smp_br_main.cc
index b311d9d..d108539 100644
--- a/system/stack/smp/smp_br_main.cc
+++ b/system/stack/smp/smp_br_main.cc
@@ -315,7 +315,6 @@
 
   if (p_cb->role > HCI_ROLE_PERIPHERAL) {
     SMP_TRACE_ERROR("%s: invalid role %d", __func__, p_cb->role);
-    android_errorWriteLog(0x534e4554, "80145946");
     return;
   }
 
diff --git a/system/stack/smp/smp_int.h b/system/stack/smp/smp_int.h
index c4ddf3e..5e73180 100644
--- a/system/stack/smp/smp_int.h
+++ b/system/stack/smp/smp_int.h
@@ -32,6 +32,15 @@
 #include "stack/include/bt_octets.h"
 #include "types/raw_address.h"
 
+typedef enum : uint16_t {
+  SMP_METRIC_COMMAND_LE_FLAG = 0x0000,
+  SMP_METRIC_COMMAND_BR_FLAG = 0x0100,
+  SMP_METRIC_COMMAND_LE_PAIRING_CMPL = 0xFF00,
+  SMP_METRIC_COMMAND_BR_PAIRING_CMPL = 0xFF01,
+} tSMP_METRIC_COMMAND;
+
+constexpr uint16_t SMP_METRIC_STATUS_INTERNAL_FLAG = 0x0100;
+
 typedef enum : uint8_t {
   /* Legacy mode */
   SMP_MODEL_ENCRYPTION_ONLY = 0, /* Just Works model */
@@ -312,7 +321,7 @@
 extern void smp_init(void);
 
 /* smp main */
-extern void smp_sm_event(tSMP_CB* p_cb, tSMP_EVENT event,
+extern bool smp_sm_event(tSMP_CB* p_cb, tSMP_EVENT event,
                          tSMP_INT_DATA* p_data);
 
 extern tSMP_STATE smp_get_state(void);
@@ -414,7 +423,8 @@
 
 /* smp_util.cc */
 extern void smp_log_metrics(const RawAddress& bd_addr, bool is_outgoing,
-                            const uint8_t* p_buf, size_t buf_len);
+                            const uint8_t* p_buf, size_t buf_len,
+                            bool is_over_br);
 extern bool smp_send_cmd(uint8_t cmd_code, tSMP_CB* p_cb);
 extern void smp_cb_cleanup(tSMP_CB* p_cb);
 extern void smp_reset_control_value(tSMP_CB* p_cb);
diff --git a/system/stack/smp/smp_l2c.cc b/system/stack/smp/smp_l2c.cc
index 3aaa479..264cdc3 100644
--- a/system/stack/smp/smp_l2c.cc
+++ b/system/stack/smp/smp_l2c.cc
@@ -24,6 +24,7 @@
 
 #define LOG_TAG "bluetooth"
 
+#include <base/logging.h>
 #include <string.h>
 
 #include "bt_target.h"
@@ -35,11 +36,10 @@
 #include "osi/include/log.h"
 #include "osi/include/osi.h"  // UNUSED_ATTR
 #include "smp_int.h"
+#include "stack/btm/btm_dev.h"
 #include "stack/include/bt_hdr.h"
 #include "types/raw_address.h"
 
-#include <base/logging.h>
-
 static void smp_connect_callback(uint16_t channel, const RawAddress& bd_addr,
                                  bool connected, uint16_t reason,
                                  tBT_TRANSPORT transport);
@@ -157,7 +157,6 @@
   uint8_t cmd;
 
   if (p_buf->len < 1) {
-    android_errorWriteLog(0x534e4554, "111215315");
     SMP_TRACE_WARNING("%s: smp packet length %d too short: must be at least 1",
                       __func__, p_buf->len);
     osi_free(p_buf);
@@ -196,7 +195,8 @@
                        smp_rsp_timeout, NULL);
 
     smp_log_metrics(p_cb->pairing_bda, false /* incoming */,
-                    p_buf->data + p_buf->offset, p_buf->len);
+                    p_buf->data + p_buf->offset, p_buf->len,
+                    false /* is_over_br */);
 
     if (cmd == SMP_OPCODE_CONFIRM) {
       SMP_TRACE_DEBUG(
@@ -249,6 +249,24 @@
 
   if (bd_addr != p_cb->pairing_bda) return;
 
+  /* Check if we already finished SMP pairing over LE, and are waiting to
+   * check if other side returns some errors. Connection/disconnection on
+   * Classic transport shouldn't impact that.
+   */
+  tBTM_SEC_DEV_REC* p_dev_rec = btm_find_dev(p_cb->pairing_bda);
+  if (smp_get_state() == SMP_STATE_BOND_PENDING &&
+      (p_dev_rec && p_dev_rec->is_link_key_known()) &&
+      alarm_is_scheduled(p_cb->delayed_auth_timer_ent)) {
+    /* If we were to not return here, we would reset SMP control block, and
+     * delayed_auth_timer_ent would never be executed. Even though we stored all
+     * keys, stack would consider device as not bonded. It would reappear after
+     * stack restart, when we re-read record from storage. Service discovery
+     * would stay broken.
+     */
+    LOG_INFO("Classic event after CTKD on LE transport");
+    return;
+  }
+
   if (connected) {
     if (!p_cb->connect_initialized) {
       p_cb->connect_initialized = true;
@@ -282,7 +300,6 @@
   SMP_TRACE_EVENT("SMDBG l2c %s", __func__);
 
   if (p_buf->len < 1) {
-    android_errorWriteLog(0x534e4554, "111215315");
     SMP_TRACE_WARNING("%s: smp packet length %d too short: must be at least 1",
                       __func__, p_buf->len);
     osi_free(p_buf);
@@ -318,7 +335,8 @@
                        smp_rsp_timeout, NULL);
 
     smp_log_metrics(p_cb->pairing_bda, false /* incoming */,
-                    p_buf->data + p_buf->offset, p_buf->len);
+                    p_buf->data + p_buf->offset, p_buf->len,
+                    true /* is_over_br */);
 
     p_cb->rcvd_cmd_code = cmd;
     p_cb->rcvd_cmd_len = (uint8_t)p_buf->len;
diff --git a/system/stack/smp/smp_main.cc b/system/stack/smp/smp_main.cc
index b7aaac9..ab30510 100644
--- a/system/stack/smp/smp_main.cc
+++ b/system/stack/smp/smp_main.cc
@@ -973,18 +973,19 @@
  *              not NULL state, adjust the new state to the returned state. If
  *              (api_evt != MAX), call callback function.
  *
- * Returns      void.
+ * Returns      true if the event is executed and a state transition can be
+ *              expected, false if the event is ignored, state is invalid, or
+ *              the role is invalid for the control block.
  *
  ******************************************************************************/
-void smp_sm_event(tSMP_CB* p_cb, tSMP_EVENT event, tSMP_INT_DATA* p_data) {
+bool smp_sm_event(tSMP_CB* p_cb, tSMP_EVENT event, tSMP_INT_DATA* p_data) {
   uint8_t curr_state = p_cb->state;
   tSMP_SM_TBL state_table;
   uint8_t action, entry, i;
 
   if (p_cb->role >= 2) {
     SMP_TRACE_DEBUG("Invalid role: %d", p_cb->role);
-    android_errorWriteLog(0x534e4554, "74121126");
-    return;
+    return false;
   }
 
   tSMP_ENTRY_TBL entry_table = smp_entry_table[p_cb->role];
@@ -992,7 +993,7 @@
   SMP_TRACE_EVENT("main smp_sm_event");
   if (curr_state >= SMP_STATE_MAX) {
     SMP_TRACE_DEBUG("Invalid state: %d", curr_state);
-    return;
+    return false;
   }
 
   SMP_TRACE_DEBUG("SMP Role: %s State: [%s (%d)], Event: [%s (%d)]",
@@ -1015,7 +1016,7 @@
     SMP_TRACE_DEBUG("Ignore event [%s (%d)] in state [%s (%d)]",
                     smp_get_event_name(event), event,
                     smp_get_state_name(curr_state), curr_state);
-    return;
+    return false;
   }
 
   /* Get possible next state from state table. */
@@ -1036,6 +1037,7 @@
     }
   }
   SMP_TRACE_DEBUG("result state = %s", smp_get_state_name(p_cb->state));
+  return true;
 }
 
 /*******************************************************************************
diff --git a/system/stack/smp/smp_utils.cc b/system/stack/smp/smp_utils.cc
index 22fcb71..f2aba5e 100644
--- a/system/stack/smp/smp_utils.cc
+++ b/system/stack/smp/smp_utils.cc
@@ -41,6 +41,8 @@
 #include "stack/include/stack_metrics_logging.h"
 #include "types/raw_address.h"
 
+void btm_dev_consolidate_existing_connections(const RawAddress& bd_addr);
+
 #define SMP_PAIRING_REQ_SIZE 7
 #define SMP_CONFIRM_CMD_SIZE (OCTET16_LEN + 1)
 #define SMP_RAND_CMD_SIZE (OCTET16_LEN + 1)
@@ -314,22 +316,26 @@
  * @param buf_len length available to read for p_buf
  */
 void smp_log_metrics(const RawAddress& bd_addr, bool is_outgoing,
-                     const uint8_t* p_buf, size_t buf_len) {
+                     const uint8_t* p_buf, size_t buf_len, bool is_over_br) {
   if (buf_len < 1) {
     LOG(WARNING) << __func__ << ": buffer is too small, size is " << buf_len;
     return;
   }
-  uint8_t cmd;
-  STREAM_TO_UINT8(cmd, p_buf);
+  uint8_t raw_cmd;
+  STREAM_TO_UINT8(raw_cmd, p_buf);
   buf_len--;
   uint8_t failure_reason = 0;
-  if (cmd == SMP_OPCODE_PAIRING_FAILED && buf_len >= 1) {
+  if (raw_cmd == SMP_OPCODE_PAIRING_FAILED && buf_len >= 1) {
     STREAM_TO_UINT8(failure_reason, p_buf);
   }
+  uint16_t metric_cmd =
+      is_over_br ? SMP_METRIC_COMMAND_BR_FLAG : SMP_METRIC_COMMAND_LE_FLAG;
+  metric_cmd |= static_cast<uint16_t>(raw_cmd);
   android::bluetooth::DirectionEnum direction =
       is_outgoing ? android::bluetooth::DirectionEnum::DIRECTION_OUTGOING
                   : android::bluetooth::DirectionEnum::DIRECTION_INCOMING;
-  log_smp_pairing_event(bd_addr, cmd, direction, failure_reason);
+  log_smp_pairing_event(bd_addr, metric_cmd, direction,
+                        static_cast<uint16_t>(failure_reason));
 }
 
 /*******************************************************************************
@@ -350,7 +356,8 @@
   SMP_TRACE_EVENT("%s", __func__);
 
   smp_log_metrics(rem_bda, true /* outgoing */,
-                  p_toL2CAP->data + p_toL2CAP->offset, p_toL2CAP->len);
+                  p_toL2CAP->data + p_toL2CAP->offset, p_toL2CAP->len,
+                  smp_cb.smp_over_br /* is_over_br */);
 
   l2cap_ret = L2CA_SendFixedChnlData(fixed_cid, rem_bda, p_toL2CAP);
   if (l2cap_ret == L2CAP_DW_FAILED) {
@@ -978,6 +985,27 @@
                            smp_status_text(evt_data.cmplt.reason).c_str()));
   }
 
+  // Log pairing complete event
+  {
+    auto direction =
+        p_cb->flags & SMP_PAIR_FLAGS_WE_STARTED_DD
+            ? android::bluetooth::DirectionEnum::DIRECTION_OUTGOING
+            : android::bluetooth::DirectionEnum::DIRECTION_INCOMING;
+    uint16_t metric_cmd = p_cb->smp_over_br
+                              ? SMP_METRIC_COMMAND_BR_PAIRING_CMPL
+                              : SMP_METRIC_COMMAND_LE_PAIRING_CMPL;
+    uint16_t metric_status = p_cb->status;
+    if (metric_status > SMP_MAX_FAIL_RSN_PER_SPEC) {
+      metric_status |= SMP_METRIC_STATUS_INTERNAL_FLAG;
+    }
+    log_smp_pairing_event(p_cb->pairing_bda, metric_cmd, direction,
+                          metric_status);
+  }
+
+  if (p_cb->status == SMP_SUCCESS && p_cb->smp_over_br) {
+    btm_dev_consolidate_existing_connections(pairing_bda);
+  }
+
   smp_reset_control_value(p_cb);
 
   if (p_callback) (*p_callback)(SMP_COMPLT_EVT, pairing_bda, &evt_data);
diff --git a/system/stack/srvc/srvc_dis.cc b/system/stack/srvc/srvc_dis.cc
index 14b5db8..7087354 100644
--- a/system/stack/srvc/srvc_dis.cc
+++ b/system/stack/srvc/srvc_dis.cc
@@ -461,8 +461,8 @@
   srvc_eng_request_channel(peer_bda, SRVC_ID_DIS);
 
   if (conn_id == GATT_INVALID_CONN_ID) {
-    return GATT_Connect(srvc_eng_cb.gatt_if, peer_bda, true, BT_TRANSPORT_LE,
-                        false);
+    return GATT_Connect(srvc_eng_cb.gatt_if, peer_bda,
+                        BTM_BLE_DIRECT_CONNECTION, BT_TRANSPORT_LE, false);
   }
 
   return dis_gatt_c_read_dis_req(conn_id);
diff --git a/system/stack/test/a2dp/AndroidTest.xml b/system/stack/test/a2dp/AndroidTest.xml
new file mode 100644
index 0000000..71fc46c
--- /dev/null
+++ b/system/stack/test/a2dp/AndroidTest.xml
@@ -0,0 +1,40 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright 2022 The Android Open Source Project
+
+     Licensed under the Apache License, Version 2.0 (the "License");
+     you may not use this file except in compliance with the License.
+     You may obtain a copy of the License at
+
+          http://www.apache.org/licenses/LICENSE-2.0
+
+     Unless required by applicable law or agreed to in writing, software
+     distributed under the License is distributed on an "AS IS" BASIS,
+     WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+     See the License for the specific language governing permissions and
+     limitations under the License.
+-->
+<configuration description="Runs net_test_stack_a2dp_codecs_native.">
+  <target_preparer class="com.android.tradefed.targetprep.RootTargetPreparer" />
+  <target_preparer class="com.android.compatibility.common.tradefed.targetprep.FilePusher">
+        <option name="cleanup" value="true" />
+        <option name="push" value="net_test_stack_a2dp_codecs_native->/data/local/tmp/net_test_stack_a2dp_codecs_native" />
+        <option name="append-bitness" value="true" />
+  </target_preparer>
+  <target_preparer class="com.android.compatibility.common.tradefed.targetprep.FilePusher">
+        <option name="cleanup" value="true" />
+        <option name="push" value="pcm0844s.wav->/data/local/tmp/test/a2dp/raw_data/pcm0844s.wav" />
+        <option name="push" value="pcm1644s.wav->/data/local/tmp/test/a2dp/raw_data/pcm1644s.wav" />
+  </target_preparer>
+  <test class="com.android.tradefed.testtype.GTest" >
+    <option name="native-test-device-path" value="/data/local/tmp" />
+    <option name="module-name" value="net_test_stack_a2dp_codecs_native" />
+    <option name="run-test-as" value="0" />
+  </test>
+
+  <!-- Only run tests in MTS if the Bluetooth Mainline module is installed. -->
+  <object type="module_controller"
+          class="com.android.tradefed.testtype.suite.module.MainlineTestModuleController">
+      <option name="mainline-module-package-name" value="com.android.btservices" />
+      <option name="mainline-module-package-name" value="com.google.android.btservices" />
+  </object>
+</configuration>
diff --git a/system/stack/test/a2dp/a2dp_aac_unittest.cc b/system/stack/test/a2dp/a2dp_aac_unittest.cc
new file mode 100644
index 0000000..a66cf2f
--- /dev/null
+++ b/system/stack/test/a2dp/a2dp_aac_unittest.cc
@@ -0,0 +1,307 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "stack/include/a2dp_aac.h"
+
+#include <base/logging.h>
+#include <gtest/gtest.h>
+#include <stdio.h>
+
+#include <cstdint>
+#include <fstream>
+#include <future>
+#include <iomanip>
+#include <map>
+#include <string>
+
+#include "common/init_flags.h"
+#include "common/testing/log_capture.h"
+#include "common/time_util.h"
+#include "os/log.h"
+#include "osi/include/allocator.h"
+#include "osi/test/AllocationTestHarness.h"
+#include "stack/include/bt_hdr.h"
+#include "stack/include/a2dp_aac_decoder.h"
+#include "stack/include/a2dp_aac_encoder.h"
+#include "stack/include/avdt_api.h"
+#include "test_util.h"
+#include "wav_reader.h"
+
+extern void allocation_tracker_uninit(void);
+namespace {
+constexpr uint32_t kAacReadSize = 1024 * 2 * 2;
+constexpr uint32_t kA2dpTickUs = 23 * 1000;
+constexpr char kDecodedDataCallbackIsInvoked[] =
+    "A2DP decoded data callback is invoked.";
+constexpr char kEnqueueCallbackIsInvoked[] =
+    "A2DP source enqueue callback is invoked.";
+constexpr uint16_t kPeerMtu = 1000;
+constexpr char kWavFile[] = "test/a2dp/raw_data/pcm1644s.wav";
+constexpr uint8_t kCodecInfoAacCapability[AVDT_CODEC_SIZE] = {
+    8,           // Length (A2DP_AAC_INFO_LEN)
+    0,           // Media Type: AVDT_MEDIA_TYPE_AUDIO
+    2,           // Media Codec Type: A2DP_MEDIA_CT_AAC
+    0x80,        // Object Type: A2DP_AAC_OBJECT_TYPE_MPEG2_LC
+    0x01,        // Sampling Frequency: A2DP_AAC_SAMPLING_FREQ_44100
+    0x04,        // Channels: A2DP_AAC_CHANNEL_MODE_STEREO
+    0x00 | 0x4,  // Variable Bit Rate:
+                 // A2DP_AAC_VARIABLE_BIT_RATE_DISABLED
+                 // Bit Rate: 320000 = 0x4e200
+    0xe2,        // Bit Rate: 320000 = 0x4e200
+    0x00,        // Bit Rate: 320000 = 0x4e200
+    7,           // Unused
+    8,           // Unused
+    9            // Unused
+};
+uint8_t* Data(BT_HDR* packet) { return packet->data + packet->offset; }
+}  // namespace
+
+namespace bluetooth {
+namespace testing {
+
+static BT_HDR* packet = nullptr;
+static WavReader wav_reader = WavReader(GetWavFilePath(kWavFile).c_str());
+
+class A2dpAacTest : public AllocationTestHarness {
+ protected:
+  void SetUp() override {
+    AllocationTestHarness::SetUp();
+    common::InitFlags::SetAllForTesting();
+    // Disable our allocation tracker to allow ASAN full range
+    allocation_tracker_uninit();
+    SetCodecConfig();
+    encoder_iface_ = const_cast<tA2DP_ENCODER_INTERFACE*>(
+        A2DP_GetEncoderInterfaceAac(kCodecInfoAacCapability));
+    ASSERT_NE(encoder_iface_, nullptr);
+    decoder_iface_ = const_cast<tA2DP_DECODER_INTERFACE*>(
+        A2DP_GetDecoderInterfaceAac(kCodecInfoAacCapability));
+    ASSERT_NE(decoder_iface_, nullptr);
+  }
+
+  void TearDown() override {
+    if (a2dp_codecs_ != nullptr) {
+      delete a2dp_codecs_;
+    }
+    if (encoder_iface_ != nullptr) {
+      encoder_iface_->encoder_cleanup();
+    }
+    A2DP_UnloadEncoderAac();
+    if (decoder_iface_ != nullptr) {
+      decoder_iface_->decoder_cleanup();
+    }
+    A2DP_UnloadDecoderAac();
+    AllocationTestHarness::TearDown();
+  }
+
+  void SetCodecConfig() {
+    uint8_t codec_info_result[AVDT_CODEC_SIZE];
+    btav_a2dp_codec_index_t peer_codec_index;
+    a2dp_codecs_ = new A2dpCodecs(std::vector<btav_a2dp_codec_config_t>());
+
+    ASSERT_TRUE(a2dp_codecs_->init());
+
+    // Create the codec capability - AAC Sink
+    memset(codec_info_result, 0, sizeof(codec_info_result));
+    ASSERT_TRUE(A2DP_IsSinkCodecSupportedAac(kCodecInfoAacCapability));
+    peer_codec_index = A2DP_SinkCodecIndex(kCodecInfoAacCapability);
+    ASSERT_NE(peer_codec_index, BTAV_A2DP_CODEC_INDEX_MAX);
+    sink_codec_config_ = a2dp_codecs_->findSinkCodecConfig(kCodecInfoAacCapability);
+    ASSERT_NE(sink_codec_config_, nullptr);
+    ASSERT_TRUE(a2dp_codecs_->setSinkCodecConfig(kCodecInfoAacCapability, true,
+                                                 codec_info_result, true));
+    ASSERT_TRUE(a2dp_codecs_->setPeerSinkCodecCapabilities(kCodecInfoAacCapability));
+    // Compare the result codec with the local test codec info
+    for (size_t i = 0; i < kCodecInfoAacCapability[0] + 1; i++) {
+      ASSERT_EQ(codec_info_result[i], kCodecInfoAacCapability[i]);
+    }
+    ASSERT_TRUE(a2dp_codecs_->setCodecConfig(kCodecInfoAacCapability, true, codec_info_result, true));
+    source_codec_config_ = a2dp_codecs_->getCurrentCodecConfig();
+  }
+
+  void InitializeEncoder(bool peer_supports_3mbps, a2dp_source_read_callback_t read_cb,
+                         a2dp_source_enqueue_callback_t enqueue_cb) {
+    tA2DP_ENCODER_INIT_PEER_PARAMS peer_params = {true, peer_supports_3mbps, kPeerMtu};
+    encoder_iface_->encoder_init(&peer_params, sink_codec_config_, read_cb,
+                                 enqueue_cb);
+  }
+
+  void InitializeDecoder(decoded_data_callback_t data_cb) {
+    decoder_iface_->decoder_init(data_cb);
+  }
+
+  BT_HDR* AllocateL2capPacket(const std::vector<uint8_t> data) const {
+    auto packet = AllocatePacket(data.size());
+    std::copy(data.cbegin(), data.cend(), Data(packet));
+    return packet;
+  }
+
+  BT_HDR* AllocatePacket(size_t packet_length) const {
+    BT_HDR* packet =
+        static_cast<BT_HDR*>(osi_calloc(sizeof(BT_HDR) + packet_length));
+    packet->len = packet_length;
+    return packet;
+  }
+  A2dpCodecConfig* sink_codec_config_;
+  A2dpCodecConfig* source_codec_config_;
+  A2dpCodecs* a2dp_codecs_;
+  tA2DP_ENCODER_INTERFACE* encoder_iface_;
+  tA2DP_DECODER_INTERFACE* decoder_iface_;
+  std::unique_ptr<LogCapture> log_capture_;
+};
+
+TEST_F(A2dpAacTest, a2dp_source_read_underflow) {
+  log_capture_ = std::make_unique<LogCapture>();
+  auto read_cb = +[](uint8_t* p_buf, uint32_t len) -> uint32_t {
+    // underflow
+    return 0;
+  };
+  auto enqueue_cb = +[](BT_HDR* p_buf, size_t frames_n, uint32_t len) -> bool {
+    return false;
+  };
+  InitializeEncoder(true, read_cb, enqueue_cb);
+  uint64_t timestamp_us = bluetooth::common::time_gettimeofday_us();
+  encoder_iface_->send_frames(timestamp_us);
+  usleep(kA2dpTickUs);
+  timestamp_us = bluetooth::common::time_gettimeofday_us();
+  encoder_iface_->send_frames(timestamp_us);
+  std::promise<void> promise;
+  log_capture_->WaitUntilLogContains(&promise,
+                                     "a2dp_aac_encode_frames: underflow");
+}
+
+TEST_F(A2dpAacTest, a2dp_enqueue_cb_is_invoked) {
+  log_capture_ = std::make_unique<LogCapture>();
+  auto read_cb = +[](uint8_t* p_buf, uint32_t len) -> uint32_t {
+    ASSERT(kAacReadSize == len);
+    return len;
+  };
+  auto enqueue_cb = +[](BT_HDR* p_buf, size_t frames_n, uint32_t len) -> bool {
+    LOG_DEBUG("%s", kEnqueueCallbackIsInvoked);
+    osi_free(p_buf);
+    return false;
+  };
+  InitializeEncoder(true, read_cb, enqueue_cb);
+  uint64_t timestamp_us = bluetooth::common::time_gettimeofday_us();
+  encoder_iface_->send_frames(timestamp_us);
+  usleep(kA2dpTickUs);
+  timestamp_us = bluetooth::common::time_gettimeofday_us();
+  encoder_iface_->send_frames(timestamp_us);
+  std::promise<void> promise;
+  log_capture_->WaitUntilLogContains(&promise, kEnqueueCallbackIsInvoked);
+}
+
+TEST_F(A2dpAacTest, decoded_data_cb_not_invoked_when_empty_packet) {
+  auto data_cb = +[](uint8_t* p_buf, uint32_t len) { FAIL(); };
+  InitializeDecoder(data_cb);
+  std::vector<uint8_t> data;
+  BT_HDR* packet = AllocateL2capPacket(data);
+  decoder_iface_->decode_packet(packet);
+  osi_free(packet);
+}
+
+TEST_F(A2dpAacTest, decoded_data_cb_invoked) {
+  log_capture_ = std::make_unique<LogCapture>();
+  auto data_cb = +[](uint8_t* p_buf, uint32_t len) {
+    LOG_DEBUG("%s", kDecodedDataCallbackIsInvoked);
+  };
+  InitializeDecoder(data_cb);
+
+  auto read_cb = +[](uint8_t* p_buf, uint32_t len) -> uint32_t {
+    static uint32_t counter = 0;
+    memcpy(p_buf, wav_reader.GetSamples() + counter, len);
+    counter += len;
+    return len;
+  };
+  auto enqueue_cb = +[](BT_HDR* p_buf, size_t frames_n, uint32_t len) -> bool {
+    packet = p_buf;
+    LOG_DEBUG("%s", kEnqueueCallbackIsInvoked);
+    return false;
+  };
+  InitializeEncoder(true, read_cb, enqueue_cb);
+
+  uint64_t timestamp_us = bluetooth::common::time_gettimeofday_us();
+  encoder_iface_->send_frames(timestamp_us);
+  usleep(kA2dpTickUs);
+  timestamp_us = bluetooth::common::time_gettimeofday_us();
+  encoder_iface_->send_frames(timestamp_us);
+
+  std::promise<void> promise;
+  log_capture_->WaitUntilLogContains(&promise, kEnqueueCallbackIsInvoked);
+  decoder_iface_->decode_packet(packet);
+  osi_free(packet);
+  ASSERT_TRUE(log_capture_->Find(kDecodedDataCallbackIsInvoked));
+}
+
+TEST_F(A2dpAacTest, set_source_codec_config_works) {
+  uint8_t codec_info_result[AVDT_CODEC_SIZE];
+  ASSERT_TRUE(a2dp_codecs_->setCodecConfig(kCodecInfoAacCapability, true, codec_info_result, true));
+  ASSERT_TRUE(A2DP_CodecTypeEqualsAac(codec_info_result, kCodecInfoAacCapability));
+  ASSERT_TRUE(A2DP_CodecEqualsAac(codec_info_result, kCodecInfoAacCapability));
+  auto* codec_config = a2dp_codecs_->findSourceCodecConfig(kCodecInfoAacCapability);
+  ASSERT_EQ(codec_config->name(), source_codec_config_->name());
+  ASSERT_EQ(codec_config->getAudioBitsPerSample(), source_codec_config_->getAudioBitsPerSample());
+}
+
+TEST_F(A2dpAacTest, sink_supports_aac) {
+  ASSERT_TRUE(A2DP_IsSinkCodecSupportedAac(kCodecInfoAacCapability));
+}
+
+TEST_F(A2dpAacTest, effective_mtu_when_peer_supports_3mbps) {
+  auto read_cb = +[](uint8_t* p_buf, uint32_t len) -> uint32_t {
+    ASSERT(kAacReadSize == len);
+    return len;
+  };
+  auto enqueue_cb = +[](BT_HDR* p_buf, size_t frames_n, uint32_t len) -> bool {
+    osi_free(p_buf);
+    return false;
+  };
+  InitializeEncoder(true, read_cb, enqueue_cb);
+  ASSERT_EQ(a2dp_aac_get_effective_frame_size(), kPeerMtu);
+}
+
+TEST_F(A2dpAacTest, effective_mtu_when_peer_does_not_support_3mbps) {
+  auto read_cb = +[](uint8_t* p_buf, uint32_t len) -> uint32_t {
+    ASSERT(kAacReadSize == len);
+    return len;
+  };
+  auto enqueue_cb = +[](BT_HDR* p_buf, size_t frames_n, uint32_t len) -> bool {
+    osi_free(p_buf);
+    return false;
+  };
+  InitializeEncoder(false, read_cb, enqueue_cb);
+  ASSERT_EQ(a2dp_aac_get_effective_frame_size(), 663 /* MAX_2MBPS_AVDTP_MTU */);
+}
+
+TEST_F(A2dpAacTest, debug_codec_dump) {
+  log_capture_ = std::make_unique<LogCapture>();
+  a2dp_codecs_->debug_codec_dump(2);
+  std::promise<void> promise;
+  log_capture_->WaitUntilLogContains(&promise,
+                                     "Current Codec: AAC");
+}
+
+TEST_F(A2dpAacTest, codec_info_string) {
+  auto codec_info = A2DP_CodecInfoString(kCodecInfoAacCapability);
+  ASSERT_NE(codec_info.find("samp_freq: 44100"), std::string::npos);
+  ASSERT_NE(codec_info.find("ch_mode: Stereo"), std::string::npos);
+}
+
+TEST_F(A2dpAacTest, get_track_bits_per_sample) {
+  ASSERT_EQ(A2DP_GetTrackBitsPerSampleAac(kCodecInfoAacCapability), 16);
+}
+
+}  // namespace testing
+}  // namespace bluetooth
diff --git a/system/stack/test/a2dp/a2dp_opus_unittest.cc b/system/stack/test/a2dp/a2dp_opus_unittest.cc
new file mode 100644
index 0000000..b4e84d2
--- /dev/null
+++ b/system/stack/test/a2dp/a2dp_opus_unittest.cc
@@ -0,0 +1,245 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "stack/include/a2dp_vendor_opus.h"
+
+#include <base/logging.h>
+#include <gtest/gtest.h>
+#include <stdio.h>
+
+#include <chrono>
+#include <cstdint>
+#include <fstream>
+#include <future>
+#include <iomanip>
+#include <map>
+#include <string>
+
+#include "common/init_flags.h"
+#include "common/time_util.h"
+#include "os/log.h"
+#include "osi/include/allocator.h"
+#include "osi/test/AllocationTestHarness.h"
+#include "stack/include/a2dp_vendor_opus_constants.h"
+#include "stack/include/bt_hdr.h"
+#include "test_util.h"
+#include "wav_reader.h"
+
+extern void allocation_tracker_uninit(void);
+namespace {
+constexpr uint32_t kA2dpTickUs = 23 * 1000;
+constexpr char kWavFile[] = "test/a2dp/raw_data/pcm1644s.wav";
+const uint8_t kCodecInfoOpusCapability[AVDT_CODEC_SIZE] = {
+  A2DP_OPUS_CODEC_LEN,         // Length
+  AVDT_MEDIA_TYPE_AUDIO << 4,  // Media Type
+  A2DP_MEDIA_CT_NON_A2DP,      // Media Codec Type Vendor
+  (A2DP_OPUS_VENDOR_ID & 0x000000FF),
+  (A2DP_OPUS_VENDOR_ID & 0x0000FF00) >> 8,
+  (A2DP_OPUS_VENDOR_ID & 0x00FF0000) >> 16,
+  (A2DP_OPUS_VENDOR_ID & 0xFF000000) >> 24,
+  (A2DP_OPUS_CODEC_ID & 0x00FF),
+  (A2DP_OPUS_CODEC_ID & 0xFF00) >> 8,
+  A2DP_OPUS_CHANNEL_MODE_STEREO | A2DP_OPUS_20MS_FRAMESIZE |
+      A2DP_OPUS_SAMPLING_FREQ_48000
+};
+uint8_t* Data(BT_HDR* packet) { return packet->data + packet->offset; }
+
+uint32_t GetReadSize() {
+  return A2DP_VendorGetFrameSizeOpus(kCodecInfoOpusCapability) * A2DP_VendorGetTrackChannelCountOpus(kCodecInfoOpusCapability) * (A2DP_VendorGetTrackBitsPerSampleOpus(kCodecInfoOpusCapability) / 8);
+}
+}  // namespace
+
+namespace bluetooth {
+namespace testing {
+
+static BT_HDR* packet = nullptr;
+static WavReader wav_reader = WavReader(GetWavFilePath(kWavFile).c_str());
+static std::promise<void> promise;
+
+class A2dpOpusTest : public AllocationTestHarness {
+ protected:
+  void SetUp() override {
+    AllocationTestHarness::SetUp();
+    common::InitFlags::SetAllForTesting();
+    // Disable our allocation tracker to allow ASAN full range
+    allocation_tracker_uninit();
+    SetCodecConfig();
+    encoder_iface_ = const_cast<tA2DP_ENCODER_INTERFACE*>(
+        A2DP_VendorGetEncoderInterfaceOpus(kCodecInfoOpusCapability));
+    ASSERT_NE(encoder_iface_, nullptr);
+    decoder_iface_ = const_cast<tA2DP_DECODER_INTERFACE*>(
+        A2DP_VendorGetDecoderInterfaceOpus(kCodecInfoOpusCapability));
+    ASSERT_NE(decoder_iface_, nullptr);
+  }
+
+  void TearDown() override {
+    if (a2dp_codecs_ != nullptr) {
+      delete a2dp_codecs_;
+    }
+    if (encoder_iface_ != nullptr) {
+      encoder_iface_->encoder_cleanup();
+    }
+    if (decoder_iface_ != nullptr) {
+      decoder_iface_->decoder_cleanup();
+    }
+    AllocationTestHarness::TearDown();
+  }
+
+  void SetCodecConfig() {
+    uint8_t codec_info_result[AVDT_CODEC_SIZE];
+    btav_a2dp_codec_index_t peer_codec_index;
+    a2dp_codecs_ = new A2dpCodecs(std::vector<btav_a2dp_codec_config_t>());
+
+    ASSERT_TRUE(a2dp_codecs_->init());
+
+    // Create the codec capability - SBC Sink
+    memset(codec_info_result, 0, sizeof(codec_info_result));
+    peer_codec_index = A2DP_SinkCodecIndex(kCodecInfoOpusCapability);
+    ASSERT_NE(peer_codec_index, BTAV_A2DP_CODEC_INDEX_MAX);
+    codec_config_ = a2dp_codecs_->findSinkCodecConfig(kCodecInfoOpusCapability);
+    ASSERT_NE(codec_config_, nullptr);
+    ASSERT_TRUE(a2dp_codecs_->setSinkCodecConfig(kCodecInfoOpusCapability, true,
+                                                 codec_info_result, true));
+    ASSERT_EQ(a2dp_codecs_->getCurrentCodecConfig(), codec_config_);
+    // Compare the result codec with the local test codec info
+    for (size_t i = 0; i < kCodecInfoOpusCapability[0] + 1; i++) {
+      ASSERT_EQ(codec_info_result[i], kCodecInfoOpusCapability[i]);
+    }
+    ASSERT_EQ(codec_config_->getAudioBitsPerSample(), 16);
+  }
+
+  void InitializeEncoder(a2dp_source_read_callback_t read_cb,
+                         a2dp_source_enqueue_callback_t enqueue_cb) {
+    tA2DP_ENCODER_INIT_PEER_PARAMS peer_params = {true, true, 1000};
+    encoder_iface_->encoder_init(&peer_params, codec_config_, read_cb,
+                                 enqueue_cb);
+  }
+
+  void InitializeDecoder(decoded_data_callback_t data_cb) {
+    decoder_iface_->decoder_init(data_cb);
+  }
+
+  BT_HDR* AllocateL2capPacket(const std::vector<uint8_t> data) const {
+    auto packet = AllocatePacket(data.size());
+    std::copy(data.cbegin(), data.cend(), Data(packet));
+    return packet;
+  }
+
+  BT_HDR* AllocatePacket(size_t packet_length) const {
+    BT_HDR* packet =
+        static_cast<BT_HDR*>(osi_calloc(sizeof(BT_HDR) + packet_length));
+    packet->len = packet_length;
+    return packet;
+  }
+  A2dpCodecConfig* codec_config_;
+  A2dpCodecs* a2dp_codecs_;
+  tA2DP_ENCODER_INTERFACE* encoder_iface_;
+  tA2DP_DECODER_INTERFACE* decoder_iface_;
+};
+
+TEST_F(A2dpOpusTest, a2dp_source_read_underflow) {
+  promise = {};
+  auto read_cb = +[](uint8_t* p_buf, uint32_t len) -> uint32_t {
+    // underflow
+    return 0;
+  };
+  auto enqueue_cb = +[](BT_HDR* p_buf, size_t frames_n, uint32_t len) -> bool {
+    promise.set_value();
+    osi_free(p_buf);
+    return false;
+  };
+  InitializeEncoder(read_cb, enqueue_cb);
+  uint64_t timestamp_us = bluetooth::common::time_gettimeofday_us();
+  encoder_iface_->send_frames(timestamp_us);
+  usleep(kA2dpTickUs);
+  timestamp_us = bluetooth::common::time_gettimeofday_us();
+  encoder_iface_->send_frames(timestamp_us);
+  ASSERT_EQ(promise.get_future().wait_for(std::chrono::milliseconds(10)),
+            std::future_status::timeout);
+}
+
+TEST_F(A2dpOpusTest, a2dp_enqueue_cb_is_invoked) {
+  promise = {};
+  auto read_cb = +[](uint8_t* p_buf, uint32_t len) -> uint32_t {
+    ASSERT(GetReadSize() == len);
+    return len;
+  };
+  auto enqueue_cb = +[](BT_HDR* p_buf, size_t frames_n, uint32_t len) -> bool {
+    static bool first_invocation = true;
+    if (first_invocation) {
+      promise.set_value();
+    }
+    first_invocation = false;
+    osi_free(p_buf);
+    return false;
+  };
+  InitializeEncoder(read_cb, enqueue_cb);
+  uint64_t timestamp_us = bluetooth::common::time_gettimeofday_us();
+  encoder_iface_->send_frames(timestamp_us);
+  usleep(kA2dpTickUs);
+  timestamp_us = bluetooth::common::time_gettimeofday_us();
+  encoder_iface_->send_frames(timestamp_us);
+  promise.get_future().wait();
+}
+
+TEST_F(A2dpOpusTest, decoded_data_cb_not_invoked_when_empty_packet) {
+  auto data_cb = +[](uint8_t* p_buf, uint32_t len) { FAIL(); };
+  InitializeDecoder(data_cb);
+  std::vector<uint8_t> data;
+  BT_HDR* packet = AllocateL2capPacket(data);
+  decoder_iface_->decode_packet(packet);
+  osi_free(packet);
+}
+
+TEST_F(A2dpOpusTest, decoded_data_cb_invoked) {
+  promise = {};
+  auto data_cb = +[](uint8_t* p_buf, uint32_t len) {};
+  InitializeDecoder(data_cb);
+
+  auto read_cb = +[](uint8_t* p_buf, uint32_t len) -> uint32_t {
+    static uint32_t counter = 0;
+    memcpy(p_buf, wav_reader.GetSamples() + counter, len);
+    counter += len;
+    return len;
+  };
+  auto enqueue_cb = +[](BT_HDR* p_buf, size_t frames_n, uint32_t len) -> bool {
+    static bool first_invocation = true;
+    if (first_invocation) {
+      packet = reinterpret_cast<BT_HDR*>(
+          osi_malloc(sizeof(*p_buf) + p_buf->len + 1));
+      memcpy(packet, p_buf, sizeof(*p_buf));
+      packet->offset = 0;
+      memcpy(packet->data + 1, p_buf->data + p_buf->offset, p_buf->len);
+      packet->data[0] = frames_n;
+      p_buf->len += 1;
+      promise.set_value();
+    }
+    first_invocation = false;
+    osi_free(p_buf);
+    return false;
+  };
+  InitializeEncoder(read_cb, enqueue_cb);
+
+  uint64_t timestamp_us = bluetooth::common::time_gettimeofday_us();
+  encoder_iface_->send_frames(timestamp_us);
+
+  promise.get_future().wait();
+  decoder_iface_->decode_packet(packet);
+  osi_free(packet);
+}
+
+}  // namespace testing
+}  // namespace bluetooth
diff --git a/system/stack/test/a2dp/a2dp_sbc_unittest.cc b/system/stack/test/a2dp/a2dp_sbc_unittest.cc
new file mode 100644
index 0000000..1ead74f
--- /dev/null
+++ b/system/stack/test/a2dp/a2dp_sbc_unittest.cc
@@ -0,0 +1,312 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "stack/include/a2dp_sbc.h"
+
+#include <base/logging.h>
+#include <gtest/gtest.h>
+#include <stdio.h>
+
+#include <chrono>
+#include <cstdint>
+#include <fstream>
+#include <future>
+#include <iomanip>
+#include <map>
+#include <string>
+
+#include "common/init_flags.h"
+#include "common/testing/log_capture.h"
+#include "common/time_util.h"
+#include "os/log.h"
+#include "osi/include/allocator.h"
+#include "osi/test/AllocationTestHarness.h"
+#include "stack/include/bt_hdr.h"
+#include "stack/include/a2dp_sbc_decoder.h"
+#include "stack/include/a2dp_sbc_encoder.h"
+#include "stack/include/avdt_api.h"
+#include "test_util.h"
+#include "wav_reader.h"
+
+extern void allocation_tracker_uninit(void);
+namespace {
+constexpr uint32_t kSbcReadSize = 512;
+constexpr uint32_t kA2dpTickUs = 23 * 1000;
+constexpr char kWavFile[] = "test/a2dp/raw_data/pcm1644s.wav";
+constexpr uint16_t kPeerMtu = 1000;
+const uint8_t kCodecInfoSbcCapability[AVDT_CODEC_SIZE] = {
+    6,                   // Length (A2DP_SBC_INFO_LEN)
+    0,                   // Media Type: AVDT_MEDIA_TYPE_AUDIO
+    0,                   // Media Codec Type: A2DP_MEDIA_CT_SBC
+    0x20 | 0x01,         // Sample Frequency: A2DP_SBC_IE_SAMP_FREQ_44 |
+                         // Channel Mode: A2DP_SBC_IE_CH_MD_JOINT
+    0x10 | 0x04 | 0x01,  // Block Length: A2DP_SBC_IE_BLOCKS_16 |
+                         // Subbands: A2DP_SBC_IE_SUBBAND_8 |
+                         // Allocation Method: A2DP_SBC_IE_ALLOC_MD_L
+    2,                   // MinimumBitpool Value: A2DP_SBC_IE_MIN_BITPOOL
+    53,                  // Maximum Bitpool Value: A2DP_SBC_MAX_BITPOOL
+    7,                   // Fake
+    8,                   // Fake
+    9                    // Fake
+};
+uint8_t* Data(BT_HDR* packet) { return packet->data + packet->offset; }
+}  // namespace
+
+namespace bluetooth {
+namespace testing {
+
+static BT_HDR* packet = nullptr;
+static WavReader wav_reader = WavReader(GetWavFilePath(kWavFile).c_str());
+static std::promise<void> promise;
+
+class A2dpSbcTest : public AllocationTestHarness {
+ protected:
+  void SetUp() override {
+    AllocationTestHarness::SetUp();
+    common::InitFlags::SetAllForTesting();
+    // Disable our allocation tracker to allow ASAN full range
+    allocation_tracker_uninit();
+    SetCodecConfig();
+    encoder_iface_ = const_cast<tA2DP_ENCODER_INTERFACE*>(
+        A2DP_GetEncoderInterfaceSbc(kCodecInfoSbcCapability));
+    ASSERT_NE(encoder_iface_, nullptr);
+    decoder_iface_ = const_cast<tA2DP_DECODER_INTERFACE*>(
+        A2DP_GetDecoderInterfaceSbc(kCodecInfoSbcCapability));
+    ASSERT_NE(decoder_iface_, nullptr);
+  }
+
+  void TearDown() override {
+    if (a2dp_codecs_ != nullptr) {
+      delete a2dp_codecs_;
+    }
+    if (encoder_iface_ != nullptr) {
+      encoder_iface_->encoder_cleanup();
+    }
+    A2DP_UnloadEncoderSbc();
+    if (decoder_iface_ != nullptr) {
+      decoder_iface_->decoder_cleanup();
+    }
+    A2DP_UnloadDecoderSbc();
+    AllocationTestHarness::TearDown();
+  }
+
+  void SetCodecConfig() {
+    uint8_t codec_info_result[AVDT_CODEC_SIZE];
+    btav_a2dp_codec_index_t peer_codec_index;
+    a2dp_codecs_ = new A2dpCodecs(std::vector<btav_a2dp_codec_config_t>());
+
+    ASSERT_TRUE(a2dp_codecs_->init());
+
+    // Create the codec capability - SBC Sink
+    memset(codec_info_result, 0, sizeof(codec_info_result));
+    ASSERT_TRUE(A2DP_IsSinkCodecSupportedSbc(kCodecInfoSbcCapability));
+    peer_codec_index = A2DP_SinkCodecIndex(kCodecInfoSbcCapability);
+    ASSERT_NE(peer_codec_index, BTAV_A2DP_CODEC_INDEX_MAX);
+    sink_codec_config_ = a2dp_codecs_->findSinkCodecConfig(kCodecInfoSbcCapability);
+    ASSERT_NE(sink_codec_config_, nullptr);
+    ASSERT_TRUE(a2dp_codecs_->setSinkCodecConfig(kCodecInfoSbcCapability, true,
+                                                 codec_info_result, true));
+    ASSERT_TRUE(a2dp_codecs_->setPeerSinkCodecCapabilities(kCodecInfoSbcCapability));
+    // Compare the result codec with the local test codec info
+    for (size_t i = 0; i < kCodecInfoSbcCapability[0] + 1; i++) {
+      ASSERT_EQ(codec_info_result[i], kCodecInfoSbcCapability[i]);
+    }
+    ASSERT_TRUE(a2dp_codecs_->setCodecConfig(kCodecInfoSbcCapability, true, codec_info_result, true));
+    source_codec_config_ = a2dp_codecs_->getCurrentCodecConfig();
+  }
+
+  void InitializeEncoder(bool peer_supports_3mbps, a2dp_source_read_callback_t read_cb,
+                         a2dp_source_enqueue_callback_t enqueue_cb) {
+    tA2DP_ENCODER_INIT_PEER_PARAMS peer_params = {true, peer_supports_3mbps, kPeerMtu};
+    encoder_iface_->encoder_init(&peer_params, sink_codec_config_, read_cb,
+                                 enqueue_cb);
+  }
+
+  void InitializeDecoder(decoded_data_callback_t data_cb) {
+    decoder_iface_->decoder_init(data_cb);
+  }
+
+  BT_HDR* AllocateL2capPacket(const std::vector<uint8_t> data) const {
+    auto packet = AllocatePacket(data.size());
+    std::copy(data.cbegin(), data.cend(), Data(packet));
+    return packet;
+  }
+
+  BT_HDR* AllocatePacket(size_t packet_length) const {
+    BT_HDR* packet =
+        static_cast<BT_HDR*>(osi_calloc(sizeof(BT_HDR) + packet_length));
+    packet->len = packet_length;
+    return packet;
+  }
+  A2dpCodecConfig* sink_codec_config_;
+  A2dpCodecConfig* source_codec_config_;
+  A2dpCodecs* a2dp_codecs_;
+  tA2DP_ENCODER_INTERFACE* encoder_iface_;
+  tA2DP_DECODER_INTERFACE* decoder_iface_;
+  std::unique_ptr<LogCapture> log_capture_;
+};
+
+TEST_F(A2dpSbcTest, a2dp_source_read_underflow) {
+  promise = {};
+  auto read_cb = +[](uint8_t* p_buf, uint32_t len) -> uint32_t {
+    // underflow
+    return 0;
+  };
+  auto enqueue_cb = +[](BT_HDR* p_buf, size_t frames_n, uint32_t len) -> bool {
+    promise.set_value();
+    osi_free(p_buf);
+    return false;
+  };
+  InitializeEncoder(true, read_cb, enqueue_cb);
+  uint64_t timestamp_us = bluetooth::common::time_gettimeofday_us();
+  encoder_iface_->send_frames(timestamp_us);
+  usleep(kA2dpTickUs);
+  timestamp_us = bluetooth::common::time_gettimeofday_us();
+  encoder_iface_->send_frames(timestamp_us);
+  ASSERT_EQ(promise.get_future().wait_for(std::chrono::milliseconds(10)),
+            std::future_status::timeout);
+}
+
+TEST_F(A2dpSbcTest, a2dp_enqueue_cb_is_invoked) {
+  promise = {};
+  auto read_cb = +[](uint8_t* p_buf, uint32_t len) -> uint32_t {
+    ASSERT(kSbcReadSize == len);
+    return len;
+  };
+  auto enqueue_cb = +[](BT_HDR* p_buf, size_t frames_n, uint32_t len) -> bool {
+    static bool first_invocation = true;
+    if (first_invocation) {
+      promise.set_value();
+    }
+    first_invocation = false;
+    osi_free(p_buf);
+    return false;
+  };
+  InitializeEncoder(true, read_cb, enqueue_cb);
+  uint64_t timestamp_us = bluetooth::common::time_gettimeofday_us();
+  encoder_iface_->send_frames(timestamp_us);
+  usleep(kA2dpTickUs);
+  timestamp_us = bluetooth::common::time_gettimeofday_us();
+  encoder_iface_->send_frames(timestamp_us);
+  promise.get_future().wait();
+}
+
+TEST_F(A2dpSbcTest, decoded_data_cb_not_invoked_when_empty_packet) {
+  auto data_cb = +[](uint8_t* p_buf, uint32_t len) { FAIL(); };
+  InitializeDecoder(data_cb);
+  std::vector<uint8_t> data;
+  BT_HDR* packet = AllocateL2capPacket(data);
+  decoder_iface_->decode_packet(packet);
+  osi_free(packet);
+}
+
+TEST_F(A2dpSbcTest, decoded_data_cb_invoked) {
+  promise = {};
+  auto data_cb = +[](uint8_t* p_buf, uint32_t len) {};
+  InitializeDecoder(data_cb);
+
+  auto read_cb = +[](uint8_t* p_buf, uint32_t len) -> uint32_t {
+    static uint32_t counter = 0;
+    memcpy(p_buf, wav_reader.GetSamples() + counter, len);
+    counter += len;
+    return len;
+  };
+  auto enqueue_cb = +[](BT_HDR* p_buf, size_t frames_n, uint32_t len) -> bool {
+    static bool first_invocation = true;
+    if (first_invocation) {
+      packet = reinterpret_cast<BT_HDR*>(
+          osi_malloc(sizeof(*p_buf) + p_buf->len + 1));
+      memcpy(packet, p_buf, sizeof(*p_buf));
+      packet->offset = 0;
+      memcpy(packet->data + 1, p_buf->data + p_buf->offset, p_buf->len);
+      packet->data[0] = frames_n;
+      p_buf->len += 1;
+      promise.set_value();
+    }
+    first_invocation = false;
+    osi_free(p_buf);
+    return false;
+  };
+  InitializeEncoder(true, read_cb, enqueue_cb);
+
+  uint64_t timestamp_us = bluetooth::common::time_gettimeofday_us();
+  encoder_iface_->send_frames(timestamp_us);
+
+  promise.get_future().wait();
+  decoder_iface_->decode_packet(packet);
+  osi_free(packet);
+}
+
+TEST_F(A2dpSbcTest, set_source_codec_config_works) {
+  uint8_t codec_info_result[AVDT_CODEC_SIZE];
+  ASSERT_TRUE(a2dp_codecs_->setCodecConfig(kCodecInfoSbcCapability, true, codec_info_result, true));
+  ASSERT_TRUE(A2DP_CodecTypeEqualsSbc(codec_info_result, kCodecInfoSbcCapability));
+  ASSERT_TRUE(A2DP_CodecEqualsSbc(codec_info_result, kCodecInfoSbcCapability));
+  auto* codec_config = a2dp_codecs_->findSourceCodecConfig(kCodecInfoSbcCapability);
+  ASSERT_EQ(codec_config->name(), source_codec_config_->name());
+  ASSERT_EQ(codec_config->getAudioBitsPerSample(), source_codec_config_->getAudioBitsPerSample());
+}
+
+TEST_F(A2dpSbcTest, sink_supports_sbc) {
+  ASSERT_TRUE(A2DP_IsSinkCodecSupportedSbc(kCodecInfoSbcCapability));
+}
+
+TEST_F(A2dpSbcTest, effective_mtu_when_peer_supports_3mbps) {
+  auto read_cb = +[](uint8_t* p_buf, uint32_t len) -> uint32_t {
+    ASSERT(kSbcReadSize == len);
+    return len;
+  };
+  auto enqueue_cb = +[](BT_HDR* p_buf, size_t frames_n, uint32_t len) -> bool {
+    osi_free(p_buf);
+    return false;
+  };
+  InitializeEncoder(true, read_cb, enqueue_cb);
+  ASSERT_EQ(a2dp_sbc_get_effective_frame_size(), kPeerMtu);
+}
+
+TEST_F(A2dpSbcTest, effective_mtu_when_peer_does_not_support_3mbps) {
+  auto read_cb = +[](uint8_t* p_buf, uint32_t len) -> uint32_t {
+    ASSERT(kSbcReadSize == len);
+    return len;
+  };
+  auto enqueue_cb = +[](BT_HDR* p_buf, size_t frames_n, uint32_t len) -> bool {
+    osi_free(p_buf);
+    return false;
+  };
+  InitializeEncoder(false, read_cb, enqueue_cb);
+  ASSERT_EQ(a2dp_sbc_get_effective_frame_size(), 663 /* MAX_2MBPS_AVDTP_MTU */);
+}
+
+TEST_F(A2dpSbcTest, debug_codec_dump) {
+  log_capture_ = std::make_unique<LogCapture>();
+  a2dp_codecs_->debug_codec_dump(2);
+  std::promise<void> promise;
+  log_capture_->WaitUntilLogContains(&promise,
+                                     "Current Codec: SBC");
+}
+
+TEST_F(A2dpSbcTest, codec_info_string) {
+  auto codec_info = A2DP_CodecInfoString(kCodecInfoSbcCapability);
+  ASSERT_NE(codec_info.find("samp_freq: 44100"), std::string::npos);
+  ASSERT_NE(codec_info.find("ch_mode: Joint"), std::string::npos);
+}
+
+TEST_F(A2dpSbcTest, get_track_bits_per_sample) {
+  ASSERT_EQ(A2DP_GetTrackBitsPerSampleSbc(kCodecInfoSbcCapability), 16);
+}
+
+}  // namespace testing
+}  // namespace bluetooth
diff --git a/system/stack/test/a2dp/a2dp_vendor_aptx_encoder_test.cc b/system/stack/test/a2dp/a2dp_vendor_aptx_encoder_test.cc
deleted file mode 100644
index 8e77a96..0000000
--- a/system/stack/test/a2dp/a2dp_vendor_aptx_encoder_test.cc
+++ /dev/null
@@ -1,104 +0,0 @@
-/*
- * Copyright 2022 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#define LOG_TAG "aptx_encoder_test"
-
-#include "a2dp_vendor_aptx_encoder.h"
-
-#include <base/logging.h>
-#include <gtest/gtest.h>
-#include <stdio.h>
-
-#include <cstdint>
-
-#include "osi/include/allocator.h"
-#include "osi/include/log.h"
-#include "osi/test/AllocationTestHarness.h"
-
-extern void allocation_tracker_uninit(void);
-
-class A2dpAptxTest : public AllocationTestHarness {
- protected:
-  void SetUp() override { AllocationTestHarness::SetUp(); }
-
-  void TearDown() override { AllocationTestHarness::TearDown(); }
-};
-
-TEST_F(A2dpAptxTest, CheckLoadLibrary) {
-  tLOADING_CODEC_STATUS aptx_support = A2DP_VendorLoadEncoderAptx();
-  if (aptx_support == LOAD_ERROR_MISSING_CODEC) {
-    LOG_WARN("Aptx library not found, ignored test");
-    return;
-  }
-  // Loading is either success or missing library. Version mismatch is not
-  // allowed
-  ASSERT_EQ(aptx_support, LOAD_SUCCESS);
-}
-
-TEST_F(A2dpAptxTest, EncodePacket) {
-  tLOADING_CODEC_STATUS aptx_support = A2DP_VendorLoadEncoderAptx();
-  if (aptx_support == LOAD_ERROR_MISSING_CODEC) {
-    LOG_WARN("Aptx library not found, ignored test");
-    return;
-  }
-  // Loading is either success or missing library. Wrong symbol is not allowed
-  ASSERT_EQ(aptx_support, LOAD_SUCCESS);
-
-  tAPTX_API aptx_api;
-  ASSERT_TRUE(A2DP_VendorCopyAptxApi(aptx_api));
-
-  ASSERT_EQ(aptx_api.sizeof_params_func(), 5008);
-  void* handle = osi_malloc(aptx_api.sizeof_params_func());
-  ASSERT_TRUE(handle != NULL);
-  aptx_api.init_func(handle, 0);
-
-  size_t pcm_bytes_encoded = 0;
-  size_t frame = 0;
-  const uint16_t *data16_in = (uint16_t *)"01234567890123456789012345678901234567890123456789012345678901234567890123456789";
-  uint8_t data_out[20];
-  const uint8_t expected_data_out[20] = {75,  191, 75,  191, 7,   255, 7,
-                                         255, 39,  255, 39,  249, 76,  79,
-                                         76,  79,  148, 41,  148, 41};
-
-  size_t data_out_index = 0;
-
-  for (size_t samples = 0;
-       samples < strlen((char*)data16_in) / 16;  // 16 bit encode
-       samples++) {
-    uint32_t pcmL[4];
-    uint32_t pcmR[4];
-    uint16_t encoded_sample[2];
-    for (size_t i = 0, j = frame; i < 4; i++, j++) {
-      pcmL[i] = (uint16_t) * (data16_in + (2 * j));
-      pcmR[i] = (uint16_t) * (data16_in + ((2 * j) + 1));
-    }
-
-    aptx_api.encode_stereo_func(handle, &pcmL, &pcmR, &encoded_sample);
-
-    data_out[data_out_index + 0] = (uint8_t)((encoded_sample[0] >> 8) & 0xff);
-    data_out[data_out_index + 1] = (uint8_t)((encoded_sample[0] >> 0) & 0xff);
-    data_out[data_out_index + 2] = (uint8_t)((encoded_sample[1] >> 8) & 0xff);
-    data_out[data_out_index + 3] = (uint8_t)((encoded_sample[1] >> 0) & 0xff);
-    frame += 4;
-    pcm_bytes_encoded += 16;
-    data_out_index += 4;
-  }
-
-  ASSERT_EQ(sizeof(expected_data_out), data_out_index);
-  ASSERT_EQ(0, memcmp(data_out, expected_data_out, sizeof(expected_data_out)));
-
-  osi_free(handle);
-}
diff --git a/system/stack/test/a2dp/a2dp_vendor_aptx_hd_encoder_test.cc b/system/stack/test/a2dp/a2dp_vendor_aptx_hd_encoder_test.cc
deleted file mode 100644
index 9f89bf3..0000000
--- a/system/stack/test/a2dp/a2dp_vendor_aptx_hd_encoder_test.cc
+++ /dev/null
@@ -1,116 +0,0 @@
-/*
- * Copyright 2022 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#define LOG_TAG "aptx_encoder_test"
-
-#include "a2dp_vendor_aptx_hd_encoder.h"
-
-#include <base/logging.h>
-#include <gtest/gtest.h>
-#include <stdio.h>
-
-#include <cstdint>
-
-#include "osi/include/allocator.h"
-#include "osi/include/log.h"
-#include "osi/test/AllocationTestHarness.h"
-
-extern void allocation_tracker_uninit(void);
-
-class A2dpAptxHdTest : public AllocationTestHarness {
- protected:
-  void SetUp() override { AllocationTestHarness::SetUp(); }
-
-  void TearDown() override { AllocationTestHarness::TearDown(); }
-};
-
-TEST_F(A2dpAptxHdTest, CheckLoadLibrary) {
-  tLOADING_CODEC_STATUS aptx_support = A2DP_VendorLoadEncoderAptxHd();
-  if (aptx_support == LOAD_ERROR_MISSING_CODEC) {
-    LOG_WARN("Aptx Hd library not found, ignored test");
-    return;
-  }
-  // Loading is either success or missing library. Version mismatch is not
-  // allowed
-  ASSERT_EQ(aptx_support, LOAD_SUCCESS);
-}
-
-TEST_F(A2dpAptxHdTest, EncodePacket) {
-  tLOADING_CODEC_STATUS aptx_support = A2DP_VendorLoadEncoderAptxHd();
-  if (aptx_support == LOAD_ERROR_MISSING_CODEC) {
-    LOG_WARN("Aptx Hd library not found, ignored test");
-    return;
-  }
-  // Loading is either success or missing library. Wrong symbol is not allowed
-  ASSERT_EQ(aptx_support, LOAD_SUCCESS);
-
-  tAPTX_HD_API aptx_hd_api;
-  ASSERT_TRUE(A2DP_VendorCopyAptxHdApi(aptx_hd_api));
-
-  ASSERT_EQ(aptx_hd_api.sizeof_params_func(), 5256);
-  void* handle = osi_malloc(aptx_hd_api.sizeof_params_func());
-  ASSERT_TRUE(handle != NULL);
-  aptx_hd_api.init_func(handle, 0);
-
-  size_t pcm_bytes_encoded = 0;
-  const uint32_t *data32_in = (uint32_t *)"012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789";
-  const uint8_t* p = (const uint8_t*)(data32_in);
-  uint8_t data_out[30];
-  const uint8_t expected_data_out[30] = {115, 190, 255, 115, 190, 255, 0,   127,
-                                         255, 0,   127, 255, 8,   127, 255, 8,
-                                         127, 227, 115, 193, 57,  115, 193, 61,
-                                         148, 192, 176, 164, 64,  158};
-
-  size_t data_out_index = 0;
-
-  for (size_t samples = 0;
-       samples < strlen((char*)data32_in) / 24;  // 24 bit encode
-       samples++) {
-    uint32_t pcmL[4];
-    uint32_t pcmR[4];
-    uint32_t encoded_sample[2];
-    // Expand from AUDIO_FORMAT_PCM_24_BIT_PACKED data (3 bytes per sample)
-    // into AUDIO_FORMAT_PCM_8_24_BIT (4 bytes per sample).
-    for (size_t i = 0; i < 4; i++) {
-      pcmL[i] = ((p[0] << 0) | (p[1] << 8) | (((int8_t)p[2]) << 16));
-      p += 3;
-      pcmR[i] = ((p[0] << 0) | (p[1] << 8) | (((int8_t)p[2]) << 16));
-      p += 3;
-    }
-
-    aptx_hd_api.encode_stereo_func(handle, &pcmL, &pcmR, &encoded_sample);
-
-    uint8_t* encoded_ptr = (uint8_t*)&encoded_sample[0];
-    data_out[data_out_index + 0] = *(encoded_ptr + 2);
-    data_out[data_out_index + 1] = *(encoded_ptr + 1);
-    data_out[data_out_index + 2] = *(encoded_ptr + 0);
-    data_out[data_out_index + 3] = *(encoded_ptr + 6);
-    data_out[data_out_index + 4] = *(encoded_ptr + 5);
-    data_out[data_out_index + 5] = *(encoded_ptr + 4);
-
-    pcm_bytes_encoded += 24;
-    data_out_index += 6;
-  }
-
-  // for (size_t i =0; i < data_out_index; i++) {
-  //   LOG_ERROR("DATA %zu is %hu", i, data_out[i]);
-  // }
-
-  ASSERT_EQ(sizeof(expected_data_out), data_out_index);
-  ASSERT_EQ(0, memcmp(data_out, expected_data_out, sizeof(expected_data_out)));
-
-  osi_free(handle);
-}
diff --git a/system/stack/test/a2dp/a2dp_vendor_ldac_unittest.cc b/system/stack/test/a2dp/a2dp_vendor_ldac_unittest.cc
new file mode 100644
index 0000000..3852ff1
--- /dev/null
+++ b/system/stack/test/a2dp/a2dp_vendor_ldac_unittest.cc
@@ -0,0 +1,160 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "stack/include/a2dp_vendor_ldac.h"
+
+#include <base/logging.h>
+#include <gtest/gtest.h>
+#include <stdio.h>
+
+#include "common/testing/log_capture.h"
+#include "common/time_util.h"
+#include "osi/include/allocator.h"
+#include "osi/test/AllocationTestHarness.h"
+#include "stack/include/a2dp_vendor_ldac_constants.h"
+#include "stack/include/avdt_api.h"
+#include "stack/include/bt_hdr.h"
+#include "test_util.h"
+#include "wav_reader.h"
+
+extern void allocation_tracker_uninit(void);
+namespace {
+constexpr uint32_t kA2dpTickUs = 23 * 1000;
+constexpr char kWavFile[] = "test/a2dp/raw_data/pcm1644s.wav";
+constexpr uint8_t kCodecInfoLdacCapability[AVDT_CODEC_SIZE] = {
+    A2DP_LDAC_CODEC_LEN,
+    AVDT_MEDIA_TYPE_AUDIO,
+    A2DP_MEDIA_CT_NON_A2DP,
+    0x2D,  // A2DP_LDAC_VENDOR_ID
+    0x01,  // A2DP_LDAC_VENDOR_ID
+    0x00,  // A2DP_LDAC_VENDOR_ID
+    0x00,  // A2DP_LDAC_VENDOR_ID
+    0xAA,  // A2DP_LDAC_CODEC_ID
+    0x00,  // A2DP_LDAC_CODEC_ID,
+    A2DP_LDAC_SAMPLING_FREQ_44100,
+    A2DP_LDAC_CHANNEL_MODE_STEREO,
+};
+uint8_t* Data(BT_HDR* packet) { return packet->data + packet->offset; }
+}  // namespace
+namespace bluetooth {
+namespace testing {
+
+// static BT_HDR* packet = nullptr;
+static WavReader wav_reader = WavReader(GetWavFilePath(kWavFile).c_str());
+
+class A2dpLdacTest : public AllocationTestHarness {
+ protected:
+  void SetUp() override {
+    AllocationTestHarness::SetUp();
+    common::InitFlags::SetAllForTesting();
+    // Disable our allocation tracker to allow ASAN full range
+    allocation_tracker_uninit();
+    SetCodecConfig();
+    encoder_iface_ = const_cast<tA2DP_ENCODER_INTERFACE*>(
+        A2DP_VendorGetEncoderInterfaceLdac(kCodecInfoLdacCapability));
+    ASSERT_NE(encoder_iface_, nullptr);
+    decoder_iface_ = const_cast<tA2DP_DECODER_INTERFACE*>(
+        A2DP_VendorGetDecoderInterfaceLdac(kCodecInfoLdacCapability));
+    ASSERT_NE(decoder_iface_, nullptr);
+  }
+
+  void TearDown() override {
+    if (a2dp_codecs_ != nullptr) {
+      delete a2dp_codecs_;
+    }
+    if (encoder_iface_ != nullptr) {
+      encoder_iface_->encoder_cleanup();
+    }
+    if (decoder_iface_ != nullptr) {
+      decoder_iface_->decoder_cleanup();
+    }
+    AllocationTestHarness::TearDown();
+  }
+
+// NOTE: Make a super func for all codecs
+  void SetCodecConfig() {
+    uint8_t source_codec_info_result[AVDT_CODEC_SIZE];
+    btav_a2dp_codec_index_t peer_codec_index;
+    a2dp_codecs_ = new A2dpCodecs(std::vector<btav_a2dp_codec_config_t>());
+
+    ASSERT_TRUE(a2dp_codecs_->init());
+
+    peer_codec_index = A2DP_SinkCodecIndex(kCodecInfoLdacCapability);
+    ASSERT_NE(peer_codec_index, BTAV_A2DP_CODEC_INDEX_MAX);
+    ASSERT_EQ(peer_codec_index, BTAV_A2DP_CODEC_INDEX_SINK_LDAC);
+    source_codec_config_ =
+        a2dp_codecs_->findSourceCodecConfig(kCodecInfoLdacCapability);
+    ASSERT_NE(source_codec_config_, nullptr);
+    ASSERT_TRUE(a2dp_codecs_->setCodecConfig(kCodecInfoLdacCapability, true,
+                                                source_codec_info_result, true));
+    ASSERT_EQ(a2dp_codecs_->getCurrentCodecConfig(), source_codec_config_);
+    // Compare the result codec with the local test codec info
+    for (size_t i = 0; i < kCodecInfoLdacCapability[0] + 1; i++) {
+      ASSERT_EQ(source_codec_info_result[i], kCodecInfoLdacCapability[i]);
+    }
+    ASSERT_NE(source_codec_config_->getAudioBitsPerSample(), 0);
+  }
+
+  void InitializeEncoder(a2dp_source_read_callback_t read_cb,
+                         a2dp_source_enqueue_callback_t enqueue_cb) {
+    tA2DP_ENCODER_INIT_PEER_PARAMS peer_params = {true, true, 1000};
+    encoder_iface_->encoder_init(&peer_params, source_codec_config_, read_cb,
+                                 enqueue_cb);
+  }
+
+  void InitializeDecoder(decoded_data_callback_t data_cb) {
+    decoder_iface_->decoder_init(data_cb);
+  }
+  BT_HDR* AllocateL2capPacket(const std::vector<uint8_t> data) const {
+    auto packet = AllocatePacket(data.size());
+    std::copy(data.cbegin(), data.cend(), Data(packet));
+    return packet;
+  }
+
+  BT_HDR* AllocatePacket(size_t packet_length) const {
+    BT_HDR* packet =
+        static_cast<BT_HDR*>(osi_calloc(sizeof(BT_HDR) + packet_length));
+    packet->len = packet_length;
+    return packet;
+  }
+  A2dpCodecConfig* source_codec_config_;
+  A2dpCodecs* a2dp_codecs_;
+  tA2DP_ENCODER_INTERFACE* encoder_iface_;
+  tA2DP_DECODER_INTERFACE* decoder_iface_;
+  std::unique_ptr<LogCapture> log_capture_;
+};
+
+TEST_F(A2dpLdacTest, a2dp_source_read_underflow) {
+  // log_capture_ = std::make_unique<LogCapture>();
+  auto read_cb = +[](uint8_t* p_buf, uint32_t len) -> uint32_t {
+    return 0;
+  };
+  auto enqueue_cb = +[](BT_HDR* p_buf, size_t frames_n, uint32_t len) -> bool {
+    return false;
+  };
+  InitializeEncoder(read_cb, enqueue_cb);
+  uint64_t timestamp_us = bluetooth::common::time_gettimeofday_us();
+  encoder_iface_->send_frames(timestamp_us);
+  usleep(kA2dpTickUs);
+  timestamp_us = bluetooth::common::time_gettimeofday_us();
+  encoder_iface_->send_frames(timestamp_us);
+  std::promise<void> promise;
+  // log_capture_->WaitUntilLogContains(&promise,
+  //                                    "a2dp_ldac_encode_frames: underflow");
+}
+
+}  // namespace testing
+}  //namespace bluetooth
diff --git a/system/stack/test/a2dp/mock_bta_av_codec.cc b/system/stack/test/a2dp/mock_bta_av_codec.cc
new file mode 100644
index 0000000..8bb6efa
--- /dev/null
+++ b/system/stack/test/a2dp/mock_bta_av_codec.cc
@@ -0,0 +1,26 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <map>
+#include <string>
+
+#include "service/common/bluetooth/a2dp_codec_config.h"
+
+std::map<std::string, int> mock_function_count_map;
+
+bluetooth::A2dpCodecConfig* bta_av_get_a2dp_current_codec(void) {
+  return nullptr;
+}
diff --git a/system/stack/test/a2dp/raw_data/pcm0844s.wav b/system/stack/test/a2dp/raw_data/pcm0844s.wav
new file mode 100644
index 0000000..4293686
--- /dev/null
+++ b/system/stack/test/a2dp/raw_data/pcm0844s.wav
Binary files differ
diff --git a/system/stack/test/a2dp/raw_data/pcm1644s.wav b/system/stack/test/a2dp/raw_data/pcm1644s.wav
new file mode 100644
index 0000000..183c740
--- /dev/null
+++ b/system/stack/test/a2dp/raw_data/pcm1644s.wav
Binary files differ
diff --git a/system/stack/test/a2dp/test_util.cc b/system/stack/test/a2dp/test_util.cc
new file mode 100644
index 0000000..8e71025
--- /dev/null
+++ b/system/stack/test/a2dp/test_util.cc
@@ -0,0 +1,35 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "test_util.h"
+
+#include <base/files/file_util.h>
+
+namespace bluetooth {
+namespace testing {
+
+base::FilePath GetBinaryPath() {
+  base::FilePath binary_path;
+  base::ReadSymbolicLink(base::FilePath("/proc/self/exe"), &binary_path);
+  return binary_path.DirName();
+}
+
+std::string GetWavFilePath(const std::string& relative_path) {
+  return GetBinaryPath().Append(relative_path).value();
+}
+
+}  // namespace testing
+}  // namespace bluetooth
diff --git a/system/stack/test/a2dp/test_util.h b/system/stack/test/a2dp/test_util.h
new file mode 100644
index 0000000..a8c2731
--- /dev/null
+++ b/system/stack/test/a2dp/test_util.h
@@ -0,0 +1,28 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <string>
+
+#include <base/files/file_path.h>
+
+namespace bluetooth {
+namespace testing {
+
+base::FilePath GetBinaryPath();
+std::string GetWavFilePath(const std::string& relative_path);
+
+}  // namespace testing
+}  // namespace bluetooth
diff --git a/system/stack/test/a2dp/wav_reader.cc b/system/stack/test/a2dp/wav_reader.cc
new file mode 100644
index 0000000..4eb0ac4
--- /dev/null
+++ b/system/stack/test/a2dp/wav_reader.cc
@@ -0,0 +1,56 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "wav_reader.h"
+
+#include <iostream>
+#include <iterator>
+
+#include "gd/os/files.h"
+#include "os/log.h"
+
+namespace bluetooth {
+namespace testing {
+
+WavReader::WavReader(const char* filename) {
+  if (os::FileExists(filename)) {
+    wavFile_.open(filename, std::ios::in | std::ios::binary);
+    wavFile_.read((char*)&header_, kWavHeaderSize);
+    ReadSamples();
+  } else {
+    ASSERT_LOG(false, "File %s does not exist!", filename);
+  }
+}
+
+WavReader::~WavReader() {
+  if (wavFile_.is_open()) {
+    wavFile_.close();
+  }
+}
+
+WavHeader WavReader::GetHeader() const { return header_; }
+
+void WavReader::ReadSamples() {
+  std::istreambuf_iterator<char> start{wavFile_}, end;
+  samples_ = std::vector<uint8_t>(start, end);
+}
+
+uint8_t* WavReader::GetSamples() { return &samples_[0]; }
+
+size_t WavReader::GetSampleCount() { return samples_.size(); }
+
+}  // namespace testing
+}  // namespace bluetooth
diff --git a/system/stack/test/a2dp/wav_reader.h b/system/stack/test/a2dp/wav_reader.h
new file mode 100644
index 0000000..9421d91
--- /dev/null
+++ b/system/stack/test/a2dp/wav_reader.h
@@ -0,0 +1,63 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <fstream>
+#include <vector>
+
+namespace bluetooth {
+namespace testing {
+
+struct WavHeader {
+  // RIFF chunk descriptor
+  uint8_t chunk_id[4];
+  uint32_t chunk_size;
+  uint8_t chunk_format[4];
+  // "fmt" sub-chunk
+  uint8_t subchunk1_id[4];
+  uint32_t subchunk1_size;
+  uint16_t audio_format;
+  uint16_t num_channels;
+  uint32_t sample_rate;
+  uint32_t byte_rate;
+  uint16_t block_align;
+  uint16_t bits_per_sample;
+  // "data" sub-chunk
+  uint8_t subchunk2_id[4];
+  uint32_t subchunk2_size;
+};
+
+namespace {
+constexpr size_t kWavHeaderSize = sizeof(WavHeader);
+}
+
+class WavReader {
+ public:
+  WavReader(const char* filename);
+  ~WavReader();
+  WavHeader GetHeader() const;
+  uint8_t* GetSamples();
+  size_t GetSampleCount();
+
+ private:
+  std::ifstream wavFile_;
+  WavHeader header_;
+  std::vector<uint8_t> samples_;
+
+  void ReadSamples();
+};
+
+}  // namespace testing
+}  // namespace bluetooth
diff --git a/system/stack/test/a2dp/wav_reader_unittest.cc b/system/stack/test/a2dp/wav_reader_unittest.cc
new file mode 100644
index 0000000..4018143
--- /dev/null
+++ b/system/stack/test/a2dp/wav_reader_unittest.cc
@@ -0,0 +1,54 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "wav_reader.h"
+
+#include <gtest/gtest.h>
+
+#include <cstring>
+#include <filesystem>
+#include <memory>
+#include <string>
+
+#include "os/log.h"
+#include "test_util.h"
+
+namespace {
+constexpr uint32_t kSampleRate = 44100;
+constexpr char kWavFile[] = "test/a2dp/raw_data/pcm0844s.wav";
+}  // namespace
+
+namespace bluetooth {
+namespace testing {
+
+class WavReaderTest : public ::testing::Test {
+ protected:
+  void SetUp() override {}
+
+  void TearDown() override {}
+};
+
+TEST_F(WavReaderTest, read_wav_header) {
+  std::unique_ptr<WavReader> wav_file = std::make_unique<WavReader>(GetWavFilePath(kWavFile).c_str());
+  ASSERT_EQ(wav_file->GetHeader().sample_rate, kSampleRate);
+}
+
+TEST_F(WavReaderTest, check_wav_sample_count) {
+  std::unique_ptr<WavReader> wav_file = std::make_unique<WavReader>(GetWavFilePath(kWavFile).c_str());
+  ASSERT_EQ(wav_file->GetHeader().subchunk2_size, wav_file->GetSampleCount());
+}
+}  // namespace testing
+}  // namespace bluetooth
diff --git a/system/stack/test/ad_parser_unittest.cc b/system/stack/test/ad_parser_unittest.cc
index 36cc7f2..1f6eb29 100644
--- a/system/stack/test/ad_parser_unittest.cc
+++ b/system/stack/test/ad_parser_unittest.cc
@@ -174,4 +174,40 @@
   glued.insert(glued.end(), scan_resp.begin(), scan_resp.end());
 
   EXPECT_TRUE(AdvertiseDataParser::IsValid(glued));
+}
+
+TEST(AdvertiseDataParserTest, GetFieldByTypeInLoop) {
+  // Single field.
+  const uint8_t AD_TYPE_SVC_DATA = 0x16;
+  const std::vector<uint8_t> data0{
+    0x02, 0x01, 0x02,
+    0x07, 0x2e, 0x6a, 0xc1, 0x19, 0x52, 0x1e, 0x49,
+    0x09, 0x16, 0x4e, 0x18, 0x00, 0xff, 0x0f, 0x03, 0x00, 0x00,
+    0x02, 0x0a, 0x7f,
+    0x03, 0x16, 0x4f, 0x18,
+    0x04, 0x16, 0x53, 0x18, 0x00,
+    0x0f, 0x09, 0x48, 0x5f, 0x43, 0x33, 0x45, 0x41, 0x31, 0x36, 0x33, 0x46, 0x35, 0x36, 0x34, 0x46 };
+
+  const uint8_t* p_service_data = data0.data();
+  uint8_t service_data_len = 0;
+
+  int match_no = 0;
+  while ((p_service_data = AdvertiseDataParser::GetFieldByType(
+              p_service_data + service_data_len,
+              data0.size() - (p_service_data - data0.data()) - service_data_len,
+              AD_TYPE_SVC_DATA, &service_data_len))) {
+    auto position = (p_service_data - data0.data());
+    if (match_no == 0) {
+      EXPECT_EQ(position, 13);
+      EXPECT_EQ(service_data_len, 8);
+    } else if (match_no == 1) {
+      EXPECT_EQ(position, 26);
+      EXPECT_EQ(service_data_len, 2);
+    } else if (match_no == 2) {
+      EXPECT_EQ(position, 30);
+      EXPECT_EQ(service_data_len, 3);
+    }
+    match_no++;
+  }
+  EXPECT_EQ(match_no, 3);
 }
\ No newline at end of file
diff --git a/system/stack/test/btm/stack_btm_test.cc b/system/stack/test/btm/stack_btm_test.cc
index e278e44..e170664 100644
--- a/system/stack/test/btm/stack_btm_test.cc
+++ b/system/stack/test/btm/stack_btm_test.cc
@@ -22,6 +22,7 @@
 #include <iomanip>
 #include <iostream>
 #include <map>
+#include <sstream>
 #include <vector>
 
 #include "btif/include/btif_hh.h"
@@ -62,6 +63,8 @@
 void LogMsg(uint32_t trace_set_mask, const char* fmt_str, ...) {}
 
 const std::string kSmpOptions("mock smp options");
+const std::string kBroadcastAudioConfigOptions(
+    "mock broadcast audio config options");
 
 bool get_trace_config_enabled(void) { return false; }
 bool get_pts_avrcp_test(void) { return false; }
@@ -75,6 +78,18 @@
 bool get_pts_connect_eatt_before_encryption(void) { return false; }
 bool get_pts_unencrypt_broadcast(void) { return false; }
 bool get_pts_eatt_peripheral_collision_support(void) { return false; }
+bool get_pts_use_eatt_for_all_services(void) { return false; }
+bool get_pts_force_le_audio_multiple_contexts_metadata(void) { return false; }
+bool get_pts_l2cap_ecoc_upper_tester(void) { return false; }
+int get_pts_l2cap_ecoc_min_key_size(void) { return -1; }
+int get_pts_l2cap_ecoc_initial_chan_cnt(void) { return -1; }
+bool get_pts_l2cap_ecoc_connect_remaining(void) { return false; }
+int get_pts_l2cap_ecoc_send_num_of_sdu(void) { return -1; }
+bool get_pts_l2cap_ecoc_reconfigure(void) { return false; }
+const std::string* get_pts_broadcast_audio_config_options(void) {
+  return &kBroadcastAudioConfigOptions;
+}
+bool get_pts_le_audio_disable_ases_before_stopping(void) { return false; }
 config_t* get_all(void) { return nullptr; }
 const packet_fragmenter_t* packet_fragmenter_get_interface() { return nullptr; }
 
@@ -95,14 +110,25 @@
     .get_pts_unencrypt_broadcast = get_pts_unencrypt_broadcast,
     .get_pts_eatt_peripheral_collision_support =
         get_pts_eatt_peripheral_collision_support,
+    .get_pts_l2cap_ecoc_upper_tester = get_pts_l2cap_ecoc_upper_tester,
+    .get_pts_l2cap_ecoc_min_key_size = get_pts_l2cap_ecoc_min_key_size,
+    .get_pts_force_le_audio_multiple_contexts_metadata =
+        get_pts_force_le_audio_multiple_contexts_metadata,
+    .get_pts_l2cap_ecoc_initial_chan_cnt = get_pts_l2cap_ecoc_initial_chan_cnt,
+    .get_pts_l2cap_ecoc_connect_remaining =
+        get_pts_l2cap_ecoc_connect_remaining,
+    .get_pts_l2cap_ecoc_send_num_of_sdu = get_pts_l2cap_ecoc_send_num_of_sdu,
+    .get_pts_l2cap_ecoc_reconfigure = get_pts_l2cap_ecoc_reconfigure,
+    .get_pts_broadcast_audio_config_options =
+        get_pts_broadcast_audio_config_options,
+    .get_pts_le_audio_disable_ases_before_stopping =
+        get_pts_le_audio_disable_ases_before_stopping,
     .get_all = get_all,
 };
 const stack_config_t* stack_config_get_interface(void) {
   return &mock_stack_config;
 }
 
-std::map<std::string, int> mock_function_count_map;
-
 namespace {
 
 using testing::_;
@@ -370,3 +396,37 @@
 
   wipe_secrets_and_remove(device_record);
 }
+
+TEST_F(StackBtmTest, sco_state_text) {
+  std::vector<std::pair<tSCO_STATE, std::string>> states = {
+      std::make_pair(SCO_ST_UNUSED, "SCO_ST_UNUSED"),
+      std::make_pair(SCO_ST_LISTENING, "SCO_ST_LISTENING"),
+      std::make_pair(SCO_ST_W4_CONN_RSP, "SCO_ST_W4_CONN_RSP"),
+      std::make_pair(SCO_ST_CONNECTING, "SCO_ST_CONNECTING"),
+      std::make_pair(SCO_ST_CONNECTED, "SCO_ST_CONNECTED"),
+      std::make_pair(SCO_ST_DISCONNECTING, "SCO_ST_DISCONNECTING"),
+      std::make_pair(SCO_ST_PEND_UNPARK, "SCO_ST_PEND_UNPARK"),
+      std::make_pair(SCO_ST_PEND_ROLECHANGE, "SCO_ST_PEND_ROLECHANGE"),
+      std::make_pair(SCO_ST_PEND_MODECHANGE, "SCO_ST_PEND_MODECHANGE"),
+  };
+  for (const auto& state : states) {
+    ASSERT_STREQ(state.second.c_str(), sco_state_text(state.first).c_str());
+  }
+  std::ostringstream oss;
+  oss << "unknown_sco_state: " << std::numeric_limits<std::uint16_t>::max();
+  ASSERT_STREQ(oss.str().c_str(),
+               sco_state_text(static_cast<tSCO_STATE>(
+                                  std::numeric_limits<std::uint16_t>::max()))
+                   .c_str());
+}
+
+TEST_F(StackBtmTest, btm_ble_sec_req_act_text) {
+  ASSERT_EQ("BTM_BLE_SEC_REQ_ACT_NONE",
+            btm_ble_sec_req_act_text(BTM_BLE_SEC_REQ_ACT_NONE));
+  ASSERT_EQ("BTM_BLE_SEC_REQ_ACT_ENCRYPT",
+            btm_ble_sec_req_act_text(BTM_BLE_SEC_REQ_ACT_ENCRYPT));
+  ASSERT_EQ("BTM_BLE_SEC_REQ_ACT_PAIR",
+            btm_ble_sec_req_act_text(BTM_BLE_SEC_REQ_ACT_PAIR));
+  ASSERT_EQ("BTM_BLE_SEC_REQ_ACT_DISCARD",
+            btm_ble_sec_req_act_text(BTM_BLE_SEC_REQ_ACT_DISCARD));
+}
diff --git a/system/stack/test/btm_iso_test.cc b/system/stack/test/btm_iso_test.cc
index e18932b..5085918 100644
--- a/system/stack/test/btm_iso_test.cc
+++ b/system/stack/test/btm_iso_test.cc
@@ -24,6 +24,7 @@
 #include "mock_controller.h"
 #include "mock_hcic_layer.h"
 #include "osi/include/allocator.h"
+#include "stack/btm/btm_dev.h"
 #include "stack/include/bt_hdr.h"
 #include "stack/include/hci_error_code.h"
 #include "stack/include/hcidefs.h"
@@ -42,6 +43,10 @@
 // Iso Manager currently works on top of the legacy HCI layer
 bool bluetooth::shim::is_gd_shim_enabled() { return false; }
 
+tBTM_SEC_DEV_REC* btm_find_dev_by_handle(uint16_t handle) { return nullptr; }
+void BTM_LogHistory(const std::string& tag, const RawAddress& bd_addr,
+                    const std::string& msg, const std::string& extra) {}
+
 namespace bte {
 class BteInterface {
  public:
@@ -770,6 +775,14 @@
               ::testing::KilledBySignal(SIGABRT), "No such cig");
 }
 
+TEST_F(IsoManagerDeathTest, RemoveCigForceNoSuchCig) {
+  EXPECT_CALL(hcic_interface_,
+              RemoveCig(volatile_test_cig_create_cmpl_evt_.cig_id, _))
+      .Times(1);
+  IsoManager::GetInstance()->RemoveCig(
+      volatile_test_cig_create_cmpl_evt_.cig_id, true);
+}
+
 TEST_F(IsoManagerDeathTest, RemoveSameCigTwice) {
   IsoManager::GetInstance()->CreateCig(
       volatile_test_cig_create_cmpl_evt_.cig_id, kDefaultCigParams);
diff --git a/system/stack/test/common/mock_btif_config.cc b/system/stack/test/common/mock_btif_config.cc
deleted file mode 100644
index 08fc80d..0000000
--- a/system/stack/test/common/mock_btif_config.cc
+++ /dev/null
@@ -1,37 +0,0 @@
-/******************************************************************************
- *
- *  Copyright 2022 The Android Open Source Project
- *
- *  Licensed under the Apache License, Version 2.0 (the "License");
- *  you may not use this file except in compliance with the License.
- *  You may obtain a copy of the License at:
- *
- *  http://www.apache.org/licenses/LICENSE-2.0
- *
- *  Unless required by applicable law or agreed to in writing, software
- *  distributed under the License is distributed on an "AS IS" BASIS,
- *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- *  See the License for the specific language governing permissions and
- *  limitations under the License.
- *
- ******************************************************************************/
-
-#include "mock_btif_config.h"
-
-static bluetooth::manager::MockBtifConfigInterface* btif_config_interface =
-    nullptr;
-
-void bluetooth::manager::SetMockBtifConfigInterface(
-    MockBtifConfigInterface* mock_btif_config_interface) {
-  btif_config_interface = mock_btif_config_interface;
-}
-
-bool btif_config_get_bin(const std::string& section, const std::string& key,
-                         uint8_t* value, size_t* length) {
-  return btif_config_interface->GetBin(section, key, value, length);
-}
-
-size_t btif_config_get_bin_length(const std::string& section,
-                                  const std::string& key) {
-  return btif_config_interface->GetBinLength(section, key);
-}
diff --git a/system/stack/test/common/mock_btm_api_layer.cc b/system/stack/test/common/mock_btm_api_layer.cc
index c1779c5..93c5fdb 100644
--- a/system/stack/test/common/mock_btm_api_layer.cc
+++ b/system/stack/test/common/mock_btm_api_layer.cc
@@ -41,3 +41,7 @@
                         tBT_TRANSPORT transport) {
   return btm_api_interface->IsLinkKeyKnown(remote_bd_addr, transport);
 }
+
+uint8_t btm_ble_read_sec_key_size(const RawAddress& bd_addr) {
+  return btm_api_interface->ReadSecKeySize(bd_addr);
+}
\ No newline at end of file
diff --git a/system/stack/test/common/mock_btm_api_layer.h b/system/stack/test/common/mock_btm_api_layer.h
index 8c92fb3..2dd5659 100644
--- a/system/stack/test/common/mock_btm_api_layer.h
+++ b/system/stack/test/common/mock_btm_api_layer.h
@@ -36,6 +36,7 @@
                            tBT_TRANSPORT transport) = 0;
   virtual bool IsLinkKeyKnown(const RawAddress& remote_bd_addr,
                               tBT_TRANSPORT transport) = 0;
+  virtual uint8_t ReadSecKeySize(const RawAddress& remote_bd_addr) = 0;
   virtual ~BtmApiInterface() = default;
 };
 
@@ -51,6 +52,7 @@
                bool(const RawAddress& remote_bd_addr, tBT_TRANSPORT transport));
   MOCK_METHOD2(IsLinkKeyKnown,
                bool(const RawAddress& remote_bd_addr, tBT_TRANSPORT transport));
+  MOCK_METHOD1(ReadSecKeySize, uint8_t(const RawAddress& remote_bd_addr));
 };
 
 /**
diff --git a/system/stack/test/common/mock_eatt.cc b/system/stack/test/common/mock_eatt.cc
index 6e07bf5..dc9867f 100644
--- a/system/stack/test/common/mock_eatt.cc
+++ b/system/stack/test/common/mock_eatt.cc
@@ -86,9 +86,9 @@
   return pimpl_->IsOutstandingMsgInSendQueue(bd_addr);
 }
 
-EattChannel* EattExtension::GetChannelWithQueuedData(
+EattChannel* EattExtension::GetChannelWithQueuedDataToSend(
     const RawAddress& bd_addr) {
-  return pimpl_->GetChannelWithQueuedData(bd_addr);
+  return pimpl_->GetChannelWithQueuedDataToSend(bd_addr);
 }
 
 EattChannel* EattExtension::GetChannelAvailableForClientRequest(
diff --git a/system/stack/test/common/mock_eatt.h b/system/stack/test/common/mock_eatt.h
index 6d1682b..bbeb502 100644
--- a/system/stack/test/common/mock_eatt.h
+++ b/system/stack/test/common/mock_eatt.h
@@ -52,7 +52,7 @@
               (const RawAddress& bd_addr));
   MOCK_METHOD((void), FreeGattResources, (const RawAddress& bd_addr));
   MOCK_METHOD((bool), IsOutstandingMsgInSendQueue, (const RawAddress& bd_addr));
-  MOCK_METHOD((EattChannel*), GetChannelWithQueuedData,
+  MOCK_METHOD((EattChannel*), GetChannelWithQueuedDataToSend,
               (const RawAddress& bd_addr));
   MOCK_METHOD((EattChannel*), GetChannelAvailableForClientRequest,
               (const RawAddress& bd_addr));
diff --git a/system/stack/test/common/mock_l2cap_layer.cc b/system/stack/test/common/mock_l2cap_layer.cc
index 2892759..d03d143 100644
--- a/system/stack/test/common/mock_l2cap_layer.cc
+++ b/system/stack/test/common/mock_l2cap_layer.cc
@@ -94,3 +94,8 @@
                                       tL2CAP_LE_CFG_INFO* peer_cfg) {
   return l2cap_interface->ReconfigCreditBasedConnsReq(bd_addr, lcids, peer_cfg);
 }
+uint16_t L2CA_LeCreditDefault() { return l2cap_interface->LeCreditDefault(); }
+
+uint16_t L2CA_LeCreditThreshold() {
+  return l2cap_interface->LeCreditThreshold();
+}
diff --git a/system/stack/test/common/mock_l2cap_layer.h b/system/stack/test/common/mock_l2cap_layer.h
index edb662b..cb2b36d 100644
--- a/system/stack/test/common/mock_l2cap_layer.h
+++ b/system/stack/test/common/mock_l2cap_layer.h
@@ -51,6 +51,8 @@
                                 tL2CAP_LE_CFG_INFO* p_cfg) = 0;
   virtual bool ReconfigCreditBasedConnsReq(const RawAddress& bd_addr, std::vector<uint16_t> &lcids,
                                 tL2CAP_LE_CFG_INFO* peer_cfg) = 0;
+  virtual uint16_t LeCreditDefault() = 0;
+  virtual uint16_t LeCreditThreshold() = 0;
   virtual ~L2capInterface() = default;
 };
 
@@ -84,6 +86,8 @@
                     tL2CAP_LE_CFG_INFO* p_cfg));
   MOCK_METHOD3(ReconfigCreditBasedConnsReq,
                bool(const RawAddress& p_bd_addr, std::vector<uint16_t> &lcids, tL2CAP_LE_CFG_INFO* peer_cfg));
+  MOCK_METHOD(uint16_t, LeCreditDefault, ());
+  MOCK_METHOD(uint16_t, LeCreditThreshold, ());
 };
 
 /**
diff --git a/system/stack/test/eatt/eatt_test.cc b/system/stack/test/eatt/eatt_test.cc
index fbd060f..5bc9ef3 100644
--- a/system/stack/test/eatt/eatt_test.cc
+++ b/system/stack/test/eatt/eatt_test.cc
@@ -82,9 +82,13 @@
     eatt_instance_->Connect(test_address);
 
     if (collision) {
-      EXPECT_CALL(l2cap_interface_,
-                  ConnectCreditBasedReq(BT_PSM_EATT, test_address, _))
-          .Times(1);
+      /* Collision should be handled only if all channels has been rejected in
+       * first place.*/
+      if (num_of_accepted_connections == 0) {
+        EXPECT_CALL(l2cap_interface_,
+                    ConnectCreditBasedReq(BT_PSM_EATT, test_address, _))
+            .Times(1);
+      }
 
       l2cap_app_info_.pL2CA_CreditBasedCollisionInd_Cb(test_address);
     }
@@ -116,6 +120,82 @@
     ASSERT_TRUE(test_tcb.eatt == num_of_accepted_connections);
   }
 
+  void ConnectDeviceBothSides(int num_of_accepted_connections,
+                              std::vector<uint16_t>& incoming_cids) {
+    base::OnceCallback<void(const RawAddress&, uint8_t)> eatt_supp_feat_cb;
+
+    ON_CALL(gatt_interface_, ClientReadSupportedFeatures)
+        .WillByDefault(
+            [&eatt_supp_feat_cb](
+                const RawAddress& addr,
+                base::OnceCallback<void(const RawAddress&, uint8_t)> cb) {
+              eatt_supp_feat_cb = std::move(cb);
+              return true;
+            });
+
+    // Return false to trigger supported features request
+    ON_CALL(gatt_interface_, GetEattSupport)
+        .WillByDefault([](const RawAddress& addr) { return false; });
+
+    std::vector<uint16_t> test_local_cids{61, 62, 63, 64, 65};
+    EXPECT_CALL(l2cap_interface_,
+                ConnectCreditBasedReq(BT_PSM_EATT, test_address, _))
+        .WillOnce(Return(test_local_cids));
+
+    eatt_instance_->Connect(test_address);
+
+    // Let the remote connect while we are trying to connect
+    EXPECT_CALL(
+        l2cap_interface_,
+        ConnectCreditBasedRsp(test_address, 1, incoming_cids, L2CAP_CONN_OK, _))
+        .WillOnce(Return(true));
+    l2cap_app_info_.pL2CA_CreditBasedConnectInd_Cb(
+        test_address, incoming_cids, BT_PSM_EATT, EATT_MIN_MTU_MPS, 1);
+
+    // Respond to feature request scheduled by the connect request
+    ASSERT_TRUE(eatt_supp_feat_cb);
+    if (eatt_supp_feat_cb) {
+      std::move(eatt_supp_feat_cb)
+          .Run(test_address, BLE_GATT_SVR_SUP_FEAT_EATT_BITMASK);
+    }
+
+    int i = 0;
+    for (uint16_t cid : test_local_cids) {
+      EattChannel* channel =
+          eatt_instance_->FindEattChannelByCid(test_address, cid);
+      ASSERT_TRUE(channel != nullptr);
+      ASSERT_TRUE(channel->state_ == EattChannelState::EATT_CHANNEL_PENDING);
+
+      if (i < num_of_accepted_connections) {
+        l2cap_app_info_.pL2CA_CreditBasedConnectCfm_Cb(
+            test_address, cid, EATT_MIN_MTU_MPS, L2CAP_CONN_OK);
+        connected_cids_.push_back(cid);
+
+        ASSERT_TRUE(channel->state_ == EattChannelState::EATT_CHANNEL_OPENED);
+        ASSERT_TRUE(channel->tx_mtu_ == EATT_MIN_MTU_MPS);
+      } else {
+        l2cap_app_info_.pL2CA_Error_Cb(cid, L2CAP_CONN_NO_RESOURCES);
+
+        EattChannel* channel =
+            eatt_instance_->FindEattChannelByCid(test_address, cid);
+        ASSERT_TRUE(channel == nullptr);
+      }
+      i++;
+    }
+
+    // Check the incoming CIDs as well
+    for (auto cid : incoming_cids) {
+      EattChannel* channel =
+          eatt_instance_->FindEattChannelByCid(test_address, cid);
+      ASSERT_NE(nullptr, channel);
+      ASSERT_EQ(channel->state_, EattChannelState::EATT_CHANNEL_OPENED);
+      ASSERT_TRUE(channel->tx_mtu_ == EATT_MIN_MTU_MPS);
+    }
+
+    ASSERT_EQ(test_tcb.eatt,
+              num_of_accepted_connections + incoming_cids.size());
+  }
+
   void DisconnectEattByPeer(void) {
     for (uint16_t cid : connected_cids_)
       l2cap_app_info_.pL2CA_DisconnectInd_Cb(cid, true);
@@ -136,6 +216,9 @@
     bluetooth::gatt::SetMockGattInterface(&gatt_interface_);
     controller::SetMockControllerInterface(&controller_interface);
 
+    // Clear the static memory for each test case
+    memset(&test_tcb, 0, sizeof(test_tcb));
+
     EXPECT_CALL(l2cap_interface_, RegisterLECoc(BT_PSM_EATT, _, _))
         .WillOnce(DoAll(SaveArg<1>(&l2cap_app_info_), Return(BT_PSM_EATT)));
 
@@ -313,6 +396,22 @@
   DisconnectEattDevice(incoming_cids);
 }
 
+TEST_F(EattTest, ConnectInitiatedWhenRemoteConnects) {
+  ON_CALL(btm_api_interface_, IsEncrypted)
+      .WillByDefault(
+          [](const RawAddress& addr, tBT_TRANSPORT transport) { return true; });
+
+  std::vector<uint16_t> incoming_cids{71, 72, 73, 74};
+  ConnectDeviceBothSides(1, incoming_cids);
+
+  std::vector<uint16_t> disconnecting_cids;
+  disconnecting_cids.insert(disconnecting_cids.end(), incoming_cids.begin(),
+                            incoming_cids.end());
+  disconnecting_cids.insert(disconnecting_cids.end(), connected_cids_.begin(),
+                            connected_cids_.end());
+  DisconnectEattDevice(disconnecting_cids);
+}
+
 TEST_F(EattTest, ConnectSucceedMultipleChannels) {
   ConnectDeviceEattSupported(5);
   DisconnectEattDevice(connected_cids_);
diff --git a/system/stack/test/fuzzers/Android.bp b/system/stack/test/fuzzers/Android.bp
index 54812c0..376b5ad 100644
--- a/system/stack/test/fuzzers/Android.bp
+++ b/system/stack/test/fuzzers/Android.bp
@@ -35,6 +35,7 @@
         "libbtdevice",
         "libg722codec",
         "liblc3",
+        "libopus",
         "libosi",
         "libudrv-uipc",
         "libbt-protos-lite",
diff --git a/system/stack/test/gatt/gatt_api_test.cc b/system/stack/test/gatt/gatt_api_test.cc
new file mode 100644
index 0000000..7900b77
--- /dev/null
+++ b/system/stack/test/gatt/gatt_api_test.cc
@@ -0,0 +1,88 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "gatt_api.h"
+
+#include <base/logging.h>
+#include <gtest/gtest.h>
+
+#include "btm/btm_dev.h"
+#include "gatt/gatt_int.h"
+
+extern tBTM_CB btm_cb;
+
+static const size_t QUEUE_SIZE_MAX = 10;
+
+static tBTM_SEC_DEV_REC* make_bonded_ble_device(const RawAddress& bda,
+                                                const RawAddress& rra) {
+  tBTM_SEC_DEV_REC* dev = btm_sec_allocate_dev_rec();
+  dev->sec_flags |= BTM_SEC_LE_LINK_KEY_KNOWN;
+  dev->bd_addr = bda;
+  dev->ble.pseudo_addr = rra;
+  dev->ble.key_type = BTM_LE_KEY_PID | BTM_LE_KEY_PENC | BTM_LE_KEY_LENC;
+  return dev;
+}
+
+static tBTM_SEC_DEV_REC* make_bonded_dual_device(const RawAddress& bda,
+                                                 const RawAddress& rra) {
+  tBTM_SEC_DEV_REC* dev = make_bonded_ble_device(bda, rra);
+  dev->sec_flags |= BTM_SEC_LINK_KEY_KNOWN;
+  return dev;
+}
+
+extern std::optional<bool> OVERRIDE_GATT_LOAD_BONDED;
+
+class GattApiTest : public ::testing::Test {
+ protected:
+  GattApiTest() = default;
+
+  virtual ~GattApiTest() = default;
+
+  void SetUp() override {
+    btm_cb.sec_dev_rec = list_new(osi_free);
+    gatt_cb.srv_chg_clt_q = fixed_queue_new(QUEUE_SIZE_MAX);
+    logging::SetMinLogLevel(-2);
+  }
+
+  void TearDown() override { list_free(btm_cb.sec_dev_rec); }
+};
+
+static const RawAddress SAMPLE_PUBLIC_BDA = {
+    {0x00, 0x00, 0x11, 0x22, 0x33, 0x44}};
+
+static const RawAddress SAMPLE_RRA_BDA = {{0xAA, 0xAA, 0x11, 0x22, 0x33, 0x44}};
+
+TEST_F(GattApiTest, test_gatt_load_bonded_ble_only) {
+  OVERRIDE_GATT_LOAD_BONDED = std::optional{true};
+  make_bonded_ble_device(SAMPLE_PUBLIC_BDA, SAMPLE_RRA_BDA);
+
+  gatt_load_bonded();
+
+  ASSERT_TRUE(gatt_is_bda_in_the_srv_chg_clt_list(SAMPLE_RRA_BDA));
+  ASSERT_FALSE(gatt_is_bda_in_the_srv_chg_clt_list(SAMPLE_PUBLIC_BDA));
+  OVERRIDE_GATT_LOAD_BONDED.reset();
+}
+
+TEST_F(GattApiTest, test_gatt_load_bonded_dual) {
+  OVERRIDE_GATT_LOAD_BONDED = std::optional{true};
+  make_bonded_dual_device(SAMPLE_PUBLIC_BDA, SAMPLE_RRA_BDA);
+
+  gatt_load_bonded();
+
+  ASSERT_TRUE(gatt_is_bda_in_the_srv_chg_clt_list(SAMPLE_RRA_BDA));
+  ASSERT_TRUE(gatt_is_bda_in_the_srv_chg_clt_list(SAMPLE_PUBLIC_BDA));
+  OVERRIDE_GATT_LOAD_BONDED.reset();
+}
diff --git a/system/stack/test/gatt/gatt_sr_test.cc b/system/stack/test/gatt/gatt_sr_test.cc
index 7e6ab31..f142bae 100644
--- a/system/stack/test/gatt/gatt_sr_test.cc
+++ b/system/stack/test/gatt/gatt_sr_test.cc
@@ -63,6 +63,8 @@
 bool direct_connect_remove(uint8_t app_id, const RawAddress& address) {
   return false;
 }
+bool is_background_connection(const RawAddress& address) { return false; }
+
 }  // namespace connection_manager
 
 BT_HDR* attp_build_sr_msg(tGATT_TCB& tcb, uint8_t op_code, tGATT_SR_MSG* p_msg,
diff --git a/system/stack/test/gatt/mock_gatt_utils_ref.cc b/system/stack/test/gatt/mock_gatt_utils_ref.cc
index d416e98..59d0022 100644
--- a/system/stack/test/gatt/mock_gatt_utils_ref.cc
+++ b/system/stack/test/gatt/mock_gatt_utils_ref.cc
@@ -29,6 +29,7 @@
 bool direct_connect_remove(uint8_t app_id, const RawAddress& address) {
   return false;
 }
+bool is_background_connection(const RawAddress& address) { return false; }
 }  // namespace connection_manager
 
 /** stack/gatt/att_protocol.cc */
diff --git a/system/stack/test/gatt_connection_manager_test.cc b/system/stack/test/gatt_connection_manager_test.cc
index b5d2864..a073551 100644
--- a/system/stack/test/gatt_connection_manager_test.cc
+++ b/system/stack/test/gatt_connection_manager_test.cc
@@ -1,13 +1,17 @@
-#include "stack/gatt/connection_manager.h"
-
 #include <base/bind.h>
+#include <base/bind_helpers.h>
 #include <base/callback.h>
 #include <base/location.h>
 #include <gmock/gmock.h>
 #include <gtest/gtest.h>
+
 #include <memory>
+
+#include "common/init_flags.h"
 #include "osi/include/alarm.h"
 #include "osi/test/alarm_mock.h"
+#include "stack/gatt/connection_manager.h"
+#include "stack/test/common/mock_btm_api_layer.h"
 
 using testing::_;
 using testing::DoAll;
@@ -17,6 +21,11 @@
 
 using connection_manager::tAPP_ID;
 
+const char* test_flags[] = {
+    "INIT_logging_debug_enabled_for_all=true",
+    nullptr,
+};
+
 namespace {
 // convenience mock, for verifying acceptlist operations on lower layer are
 // actually scheduled
@@ -28,6 +37,10 @@
   MOCK_METHOD0(SetLeConnectionModeToFast, bool());
   MOCK_METHOD0(SetLeConnectionModeToSlow, void());
   MOCK_METHOD2(OnConnectionTimedOut, void(uint8_t, const RawAddress&));
+
+  /* Not really accept list related, btui still BTM - just for testing put it
+   * here. */
+  MOCK_METHOD2(EnableTargetedAnnouncements, void(bool, tBTM_INQ_RESULTS_CB*));
 };
 
 std::unique_ptr<AcceptlistMock> localAcceptlistMock;
@@ -60,19 +73,32 @@
   localAcceptlistMock->SetLeConnectionModeToSlow();
 }
 
+void BTM_BleTargetAnnouncementObserve(bool enable,
+                                      tBTM_INQ_RESULTS_CB* p_results_cb) {
+  localAcceptlistMock->EnableTargetedAnnouncements(enable, p_results_cb);
+}
+
+void BTM_LogHistory(const std::string& tag, const RawAddress& bd_addr,
+                    const std::string& msg){};
+
 namespace bluetooth {
 namespace shim {
 bool is_gd_l2cap_enabled() { return false; }
+void set_target_announcements_filter(bool enable) {}
 }  // namespace shim
 }  // namespace bluetooth
 
 bool L2CA_ConnectFixedChnl(uint16_t fixed_cid, const RawAddress& bd_addr) {
   return false;
 }
+uint16_t BTM_GetHCIConnHandle(RawAddress const&, unsigned char) {
+  return 0xFFFF;
+};
 
 namespace connection_manager {
 class BleConnectionManager : public testing::Test {
   void SetUp() override {
+    bluetooth::common::InitFlags::Load(test_flags);
     localAcceptlistMock = std::make_unique<AcceptlistMock>();
   }
 
@@ -283,4 +309,62 @@
   Mock::VerifyAndClearExpectations(localAcceptlistMock.get());
 }
 
+TEST_F(BleConnectionManager, test_target_announement_connect) {
+  EXPECT_CALL(*localAcceptlistMock, AcceptlistRemove(_)).Times(0);
+  EXPECT_TRUE(background_connect_targeted_announcement_add(CLIENT1, address1));
+  EXPECT_TRUE(background_connect_targeted_announcement_add(CLIENT1, address1));
+}
+
+TEST_F(BleConnectionManager,
+       test_add_targeted_announement_when_allow_list_used) {
+  /* Accept adding to allow list */
+  EXPECT_CALL(*localAcceptlistMock, AcceptlistAdd(address1))
+      .WillOnce(Return(true));
+
+  /* This shall be called when registering announcements */
+  EXPECT_CALL(*localAcceptlistMock, AcceptlistRemove(_)).Times(1);
+  EXPECT_TRUE(background_connect_add(CLIENT1, address1));
+  EXPECT_TRUE(background_connect_targeted_announcement_add(CLIENT2, address1));
+
+  Mock::VerifyAndClearExpectations(localAcceptlistMock.get());
+}
+
+TEST_F(BleConnectionManager,
+       test_add_background_connect_when_targeted_announcement_are_enabled) {
+  /* Accept adding to allow list */
+  EXPECT_CALL(*localAcceptlistMock, AcceptlistAdd(address1)).Times(0);
+
+  /* This shall be called when registering announcements */
+  EXPECT_CALL(*localAcceptlistMock, AcceptlistRemove(_)).Times(0);
+
+  EXPECT_TRUE(background_connect_targeted_announcement_add(CLIENT2, address1));
+
+  EXPECT_TRUE(background_connect_add(CLIENT1, address1));
+  Mock::VerifyAndClearExpectations(localAcceptlistMock.get());
+}
+
+TEST_F(BleConnectionManager, test_re_add_background_connect_to_allow_list) {
+  EXPECT_CALL(*localAcceptlistMock, AcceptlistAdd(address1)).Times(0);
+  EXPECT_CALL(*localAcceptlistMock, AcceptlistRemove(_)).Times(0);
+
+  EXPECT_TRUE(background_connect_targeted_announcement_add(CLIENT2, address1));
+
+  EXPECT_TRUE(background_connect_add(CLIENT1, address1));
+  Mock::VerifyAndClearExpectations(localAcceptlistMock.get());
+
+  /* Now remove app using targeted announcement and expect device
+   * to be added to white list
+   */
+
+  /* Accept adding to allow list */
+  EXPECT_CALL(*localAcceptlistMock, AcceptlistAdd(address1))
+      .WillOnce(Return(true));
+
+  EXPECT_TRUE(background_connect_remove(CLIENT2, address1));
+  Mock::VerifyAndClearExpectations(localAcceptlistMock.get());
+
+  EXPECT_CALL(*localAcceptlistMock, AcceptlistRemove(_)).Times(1);
+  EXPECT_TRUE(background_connect_remove(CLIENT1, address1));
+  Mock::VerifyAndClearExpectations(localAcceptlistMock.get());
+}
 }  // namespace connection_manager
diff --git a/system/stack/test/rfcomm/stack_rfcomm_test.cc b/system/stack/test/rfcomm/stack_rfcomm_test.cc
index 8501674..af8a30d 100644
--- a/system/stack/test/rfcomm/stack_rfcomm_test.cc
+++ b/system/stack/test/rfcomm/stack_rfcomm_test.cc
@@ -135,8 +135,9 @@
                        tPORT_CALLBACK* event_callback,
                        uint16_t* server_handle) {
     VLOG(1) << "Step 1";
-    ASSERT_EQ(RFCOMM_CreateConnection(uuid, scn, true, mtu, RawAddress::kAny,
-                                      server_handle, management_callback),
+    ASSERT_EQ(RFCOMM_CreateConnectionWithSecurity(
+                  uuid, scn, true, mtu, RawAddress::kAny, server_handle,
+                  management_callback, 0),
               PORT_SUCCESS);
     ASSERT_EQ(PORT_SetEventMask(*server_handle, PORT_EV_RXCHAR), PORT_SUCCESS);
     ASSERT_EQ(PORT_SetEventCallback(*server_handle, event_callback),
@@ -280,8 +281,9 @@
                   DataWrite(lcid, BtHdrEqual(uih_pn_channel_3)))
           .WillOnce(Return(L2CAP_DW_SUCCESS));
     }
-    ASSERT_EQ(RFCOMM_CreateConnection(uuid, scn, false, mtu, peer_bd_addr,
-                                      client_handle, management_callback),
+    ASSERT_EQ(RFCOMM_CreateConnectionWithSecurity(uuid, scn, false, mtu,
+                                                  peer_bd_addr, client_handle,
+                                                  management_callback, 0),
               PORT_SUCCESS);
     ASSERT_EQ(PORT_SetEventMask(*client_handle, PORT_EV_RXCHAR), PORT_SUCCESS);
     ASSERT_EQ(PORT_SetEventCallback(*client_handle, event_callback),
@@ -472,7 +474,7 @@
   tL2CAP_APPL_INFO l2cap_appl_info_;
 };
 
-TEST_F(StackRfcommTest, SingleServerConnectionHelloWorld) {
+TEST_F(StackRfcommTest, DISABLED_SingleServerConnectionHelloWorld) {
   // Prepare a server channel at kTestChannelNumber0
   static const uint16_t acl_handle = 0x0009;
   static const uint16_t lcid = 0x0054;
@@ -495,7 +497,7 @@
                                         "\r!dlroW olleH", 4, acl_handle, lcid));
 }
 
-TEST_F(StackRfcommTest, MultiServerPortSameDeviceHelloWorld) {
+TEST_F(StackRfcommTest, DISABLED_MultiServerPortSameDeviceHelloWorld) {
   // Prepare a server channel at kTestChannelNumber0
   static const uint16_t acl_handle = 0x0009;
   static const uint16_t lcid = 0x0054;
@@ -544,7 +546,7 @@
       acl_handle, lcid));
 }
 
-TEST_F(StackRfcommTest, SameServerPortMultiDeviceHelloWorld) {
+TEST_F(StackRfcommTest, DISABLED_SameServerPortMultiDeviceHelloWorld) {
   // Prepare a server channel at kTestChannelNumber0
   static const uint16_t test_mtu = 1600;
   static const uint8_t test_scn = 3;
@@ -594,7 +596,7 @@
       acl_handle_1, lcid_1));
 }
 
-TEST_F(StackRfcommTest, SingleClientConnectionHelloWorld) {
+TEST_F(StackRfcommTest, DISABLED_SingleClientConnectionHelloWorld) {
   static const uint16_t acl_handle = 0x0009;
   static const uint16_t lcid = 0x0054;
   static const uint16_t test_uuid = 0x1112;
@@ -617,7 +619,7 @@
       lcid, 0));
 }
 
-TEST_F(StackRfcommTest, MultiClientPortSameDeviceHelloWorld) {
+TEST_F(StackRfcommTest, DISABLED_MultiClientPortSameDeviceHelloWorld) {
   static const uint16_t acl_handle = 0x0009;
   static const uint16_t lcid = 0x0054;
   static const uint16_t test_mtu = 1600;
@@ -663,7 +665,7 @@
       acl_handle, lcid, 1));
 }
 
-TEST_F(StackRfcommTest, SameClientPortMultiDeviceHelloWorld) {
+TEST_F(StackRfcommTest, DISABLED_SameClientPortMultiDeviceHelloWorld) {
   static const uint16_t test_uuid = 0x1112;
   static const uint8_t test_scn = 8;
   static const uint16_t test_mtu = 1600;
@@ -711,7 +713,7 @@
       acl_handle_1, lcid_1, 1));
 }
 
-TEST_F(StackRfcommTest, TestConnectionCollision) {
+TEST_F(StackRfcommTest, DISABLED_TestConnectionCollision) {
   static const uint16_t acl_handle = 0x0008;
   static const uint16_t old_lcid = 0x004a;
   static const uint16_t new_lcid = 0x005c;
@@ -724,9 +726,9 @@
   uint16_t server_handle = 0;
   VLOG(1) << "Step 1";
   // Prepare a server port
-  int status = RFCOMM_CreateConnection(test_uuid, test_server_scn, true,
-                                       test_mtu, RawAddress::kAny,
-                                       &server_handle, port_mgmt_cback_0);
+  int status = RFCOMM_CreateConnectionWithSecurity(
+      test_uuid, test_server_scn, true, test_mtu, RawAddress::kAny,
+      &server_handle, port_mgmt_cback_0, 0);
   ASSERT_EQ(status, PORT_SUCCESS);
   status = PORT_SetEventMask(server_handle, PORT_EV_RXCHAR);
   ASSERT_EQ(status, PORT_SUCCESS);
@@ -739,9 +741,9 @@
   EXPECT_CALL(l2cap_interface_, ConnectRequest(BT_PSM_RFCOMM, test_address))
       .Times(1)
       .WillOnce(Return(old_lcid));
-  status = RFCOMM_CreateConnection(test_uuid, test_peer_scn, false, test_mtu,
-                                   test_address, &client_handle_1,
-                                   port_mgmt_cback_1);
+  status = RFCOMM_CreateConnectionWithSecurity(
+      test_uuid, test_peer_scn, false, test_mtu, test_address, &client_handle_1,
+      port_mgmt_cback_1, 0);
   ASSERT_EQ(status, PORT_SUCCESS);
   status = PORT_SetEventMask(client_handle_1, PORT_EV_RXCHAR);
   ASSERT_EQ(status, PORT_SUCCESS);
diff --git a/system/stack/test/sdp/stack_sdp_test.cc b/system/stack/test/sdp/stack_sdp_test.cc
new file mode 100644
index 0000000..0251aab
--- /dev/null
+++ b/system/stack/test/sdp/stack_sdp_test.cc
@@ -0,0 +1,174 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#include <frameworks/proto_logging/stats/enums/bluetooth/enums.pb.h>
+#include <gmock/gmock.h>
+#include <gtest/gtest.h>
+#include <stdlib.h>
+
+#include <cstddef>
+
+#include "stack/include/sdp_api.h"
+#include "stack/sdp/sdpint.h"
+#include "test/mock/mock_osi_allocator.h"
+#include "test/mock/mock_stack_l2cap_api.h"
+
+#ifndef BT_DEFAULT_BUFFER_SIZE
+#define BT_DEFAULT_BUFFER_SIZE (4096 + 16)
+#endif
+
+static int L2CA_ConnectReq2_cid = 0x42;
+static RawAddress addr = RawAddress({0xA1, 0xA2, 0xA3, 0xA4, 0xA5, 0xA6});
+static tSDP_DISCOVERY_DB* sdp_db = nullptr;
+
+class StackSdpMainTest : public ::testing::Test {
+ protected:
+  void SetUp() override {
+    sdp_init();
+    test::mock::stack_l2cap_api::L2CA_ConnectReq2.body =
+        [](uint16_t psm, const RawAddress& p_bd_addr, uint16_t sec_level) {
+          return ++L2CA_ConnectReq2_cid;
+        };
+    test::mock::stack_l2cap_api::L2CA_DataWrite.body = [](uint16_t cid,
+                                                          BT_HDR* p_data) {
+      osi_free_and_reset((void**)&p_data);
+      return 0;
+    };
+    test::mock::stack_l2cap_api::L2CA_DisconnectReq.body = [](uint16_t cid) {
+      return true;
+    };
+    test::mock::stack_l2cap_api::L2CA_Register2.body =
+        [](uint16_t psm, const tL2CAP_APPL_INFO& p_cb_info, bool enable_snoop,
+           tL2CAP_ERTM_INFO* p_ertm_info, uint16_t my_mtu,
+           uint16_t required_remote_mtu, uint16_t sec_level) {
+          return 42;  // return non zero
+        };
+    test::mock::osi_allocator::osi_malloc.body = [](size_t size) {
+      return malloc(size);
+    };
+    test::mock::osi_allocator::osi_free.body = [](void* ptr) { free(ptr); };
+    test::mock::osi_allocator::osi_free_and_reset.body = [](void** ptr) {
+      free(*ptr);
+      *ptr = nullptr;
+    };
+    sdp_db = (tSDP_DISCOVERY_DB*)osi_malloc(BT_DEFAULT_BUFFER_SIZE);
+  }
+
+  void TearDown() override {
+    osi_free(sdp_db);
+    test::mock::stack_l2cap_api::L2CA_ConnectReq2 = {};
+    test::mock::stack_l2cap_api::L2CA_Register2 = {};
+    test::mock::stack_l2cap_api::L2CA_DataWrite = {};
+    test::mock::stack_l2cap_api::L2CA_DisconnectReq = {};
+    test::mock::osi_allocator::osi_malloc = {};
+    test::mock::osi_allocator::osi_free = {};
+    test::mock::osi_allocator::osi_free_and_reset = {};
+  }
+};
+
+TEST_F(StackSdpMainTest, sdp_service_search_request) {
+  ASSERT_TRUE(SDP_ServiceSearchRequest(addr, sdp_db, nullptr));
+  int cid = L2CA_ConnectReq2_cid;
+  tCONN_CB* p_ccb = sdpu_find_ccb_by_cid(cid);
+  ASSERT_NE(p_ccb, nullptr);
+  ASSERT_EQ(p_ccb->con_state, SDP_STATE_CONN_SETUP);
+
+  tL2CAP_CFG_INFO cfg;
+  sdp_cb.reg_info.pL2CA_ConfigCfm_Cb(p_ccb->connection_id, 0, &cfg);
+
+  ASSERT_EQ(p_ccb->con_state, SDP_STATE_CONNECTED);
+
+  sdp_disconnect(p_ccb, SDP_SUCCESS);
+  sdp_cb.reg_info.pL2CA_DisconnectCfm_Cb(p_ccb->connection_id, 0);
+
+  ASSERT_EQ(p_ccb->con_state, SDP_STATE_IDLE);
+}
+
+tCONN_CB* find_ccb(uint16_t cid, uint8_t state) {
+  uint16_t xx;
+  tCONN_CB* p_ccb;
+
+  // Look through each connection control block
+  for (xx = 0, p_ccb = sdp_cb.ccb; xx < SDP_MAX_CONNECTIONS; xx++, p_ccb++) {
+    if ((p_ccb->con_state == state) && (p_ccb->connection_id == cid)) {
+      return p_ccb;
+    }
+  }
+  return nullptr;  // not found
+}
+
+TEST_F(StackSdpMainTest, sdp_service_search_request_queuing) {
+  ASSERT_TRUE(SDP_ServiceSearchRequest(addr, sdp_db, nullptr));
+  const int cid = L2CA_ConnectReq2_cid;
+  tCONN_CB* p_ccb1 = find_ccb(cid, SDP_STATE_CONN_SETUP);
+  ASSERT_NE(p_ccb1, nullptr);
+  ASSERT_EQ(p_ccb1->con_state, SDP_STATE_CONN_SETUP);
+
+  ASSERT_TRUE(SDP_ServiceSearchRequest(addr, sdp_db, nullptr));
+  tCONN_CB* p_ccb2 = find_ccb(cid, SDP_STATE_CONN_PEND);
+  ASSERT_NE(p_ccb2, nullptr);
+  ASSERT_NE(p_ccb2, p_ccb1);
+  ASSERT_EQ(p_ccb2->con_state, SDP_STATE_CONN_PEND);
+
+  tL2CAP_CFG_INFO cfg;
+  sdp_cb.reg_info.pL2CA_ConfigCfm_Cb(p_ccb1->connection_id, 0, &cfg);
+
+  ASSERT_EQ(p_ccb1->con_state, SDP_STATE_CONNECTED);
+  ASSERT_EQ(p_ccb2->con_state, SDP_STATE_CONN_PEND);
+
+  p_ccb1->disconnect_reason = SDP_SUCCESS;
+  sdp_disconnect(p_ccb1, SDP_SUCCESS);
+
+  ASSERT_EQ(p_ccb1->con_state, SDP_STATE_IDLE);
+  ASSERT_EQ(p_ccb2->con_state, SDP_STATE_CONNECTED);
+
+  sdp_disconnect(p_ccb2, SDP_SUCCESS);
+  sdp_cb.reg_info.pL2CA_DisconnectCfm_Cb(p_ccb2->connection_id, 0);
+
+  ASSERT_EQ(p_ccb1->con_state, SDP_STATE_IDLE);
+  ASSERT_EQ(p_ccb2->con_state, SDP_STATE_IDLE);
+}
+
+void sdp_callback(tSDP_RESULT result) {
+  if (result == SDP_SUCCESS) {
+    ASSERT_TRUE(SDP_ServiceSearchRequest(addr, sdp_db, nullptr));
+  }
+}
+
+TEST_F(StackSdpMainTest, sdp_service_search_request_queuing_race_condition) {
+  // start first request
+  ASSERT_TRUE(SDP_ServiceSearchRequest(addr, sdp_db, sdp_callback));
+  const int cid1 = L2CA_ConnectReq2_cid;
+  tCONN_CB* p_ccb1 = find_ccb(cid1, SDP_STATE_CONN_SETUP);
+  ASSERT_NE(p_ccb1, nullptr);
+  ASSERT_EQ(p_ccb1->con_state, SDP_STATE_CONN_SETUP);
+
+  tL2CAP_CFG_INFO cfg;
+  sdp_cb.reg_info.pL2CA_ConfigCfm_Cb(p_ccb1->connection_id, 0, &cfg);
+
+  ASSERT_EQ(p_ccb1->con_state, SDP_STATE_CONNECTED);
+
+  sdp_disconnect(p_ccb1, SDP_SUCCESS);
+  sdp_cb.reg_info.pL2CA_DisconnectCfm_Cb(p_ccb1->connection_id, 0);
+
+  const int cid2 = L2CA_ConnectReq2_cid;
+  ASSERT_NE(cid1, cid2);  // The callback a queued a new request
+  tCONN_CB* p_ccb2 = find_ccb(cid2, SDP_STATE_CONN_SETUP);
+  ASSERT_NE(p_ccb2, nullptr);
+  // If race condition, this will be stuck in PEND
+  ASSERT_EQ(p_ccb2->con_state, SDP_STATE_CONN_SETUP);
+
+  sdp_disconnect(p_ccb2, SDP_SUCCESS);
+}
diff --git a/system/stack/test/sdp/stack_sdp_utils_test.cc b/system/stack/test/sdp/stack_sdp_utils_test.cc
new file mode 100644
index 0000000..6db6bb2
--- /dev/null
+++ b/system/stack/test/sdp/stack_sdp_utils_test.cc
@@ -0,0 +1,268 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#include <gmock/gmock.h>
+#include <gtest/gtest.h>
+
+#include <cstddef>
+
+#include "bt_types.h"
+#include "device/include/interop.h"
+#include "mock_btif_config.h"
+#include "stack/include/avrc_defs.h"
+#include "stack/include/sdp_api.h"
+#include "stack/sdp/sdpint.h"
+#include "test/mock/mock_btif_config.h"
+#include "test/mock/mock_osi_properties.h"
+
+using testing::_;
+using testing::DoAll;
+using testing::Return;
+using testing::SetArrayArgument;
+
+// Global trace level referred in the code under test
+uint8_t appl_trace_level = BT_TRACE_LEVEL_VERBOSE;
+
+extern "C" void LogMsg(uint32_t trace_set_mask, const char* fmt_str, ...) {}
+
+namespace {
+// convenience mock
+class IopMock {
+ public:
+  MOCK_METHOD2(InteropMatchAddr,
+               bool(const interop_feature_t, const RawAddress*));
+};
+
+std::unique_ptr<IopMock> localIopMock;
+}  // namespace
+
+bool interop_match_addr(const interop_feature_t feature,
+                        const RawAddress* addr) {
+  return localIopMock->InteropMatchAddr(feature, addr);
+}
+
+uint8_t avrc_value[8] = {
+    ((DATA_ELE_SEQ_DESC_TYPE << 3) | SIZE_IN_NEXT_BYTE),  // data_element
+    6,                                                    // data_len
+    ((UUID_DESC_TYPE << 3) | SIZE_TWO_BYTES),             // uuid_element
+    0,                                                    // uuid
+    0,                                                    // uuid
+    ((UINT_DESC_TYPE << 3) | SIZE_TWO_BYTES),             // version_element
+    0,                                                    // version
+    0                                                     // version
+};
+tSDP_ATTRIBUTE avrcp_attr = {
+    .len = 0,
+    .value_ptr = (uint8_t*)(&avrc_value),
+    .id = 0,
+    .type = 0,
+};
+
+void set_avrcp_attr(uint32_t len, uint16_t id, uint16_t uuid,
+                    uint16_t version) {
+  UINT16_TO_BE_FIELD(avrc_value + 3, uuid);
+  UINT16_TO_BE_FIELD(avrc_value + 6, version);
+  avrcp_attr.len = len;
+  avrcp_attr.id = id;
+}
+
+uint16_t get_avrc_target_version(tSDP_ATTRIBUTE* p_attr) {
+  uint8_t* p_version = p_attr->value_ptr + 6;
+  uint16_t version =
+      (((uint16_t)(*(p_version))) << 8) + ((uint16_t)(*((p_version) + 1)));
+  return version;
+}
+
+class StackSdpUtilsTest : public ::testing::Test {
+ protected:
+  void SetUp() override {
+    test::mock::btif_config::btif_config_get_bin.body =
+        [this](const std::string& section, const std::string& key,
+               uint8_t* value, size_t* length) {
+          return btif_config_interface_.GetBin(section, key, value, length);
+        };
+    test::mock::btif_config::btif_config_get_bin_length.body =
+        [this](const std::string& section, const std::string& key) {
+          return btif_config_interface_.GetBinLength(section, key);
+        };
+    test::mock::osi_properties::osi_property_get_bool.body =
+        [](const char* key, bool default_value) { return true; };
+
+    localIopMock = std::make_unique<IopMock>();
+    set_avrcp_attr(8, ATTR_ID_BT_PROFILE_DESC_LIST,
+                   UUID_SERVCLASS_AV_REMOTE_CONTROL, AVRC_REV_1_5);
+  }
+
+  void TearDown() override {
+    test::mock::btif_config::btif_config_get_bin_length = {};
+    test::mock::btif_config::btif_config_get_bin = {};
+    test::mock::osi_properties::osi_property_get_bool = {};
+
+    localIopMock.reset();
+  }
+  bluetooth::manager::MockBtifConfigInterface btif_config_interface_;
+};
+
+TEST_F(StackSdpUtilsTest,
+       sdpu_set_avrc_target_version_device_in_iop_table_versoin_1_4) {
+  RawAddress bdaddr;
+  EXPECT_CALL(*localIopMock, InteropMatchAddr(INTEROP_AVRCP_1_4_ONLY, &bdaddr))
+      .WillOnce(Return(true));
+  sdpu_set_avrc_target_version(&avrcp_attr, &bdaddr);
+  ASSERT_EQ(get_avrc_target_version(&avrcp_attr), AVRC_REV_1_4);
+}
+
+TEST_F(StackSdpUtilsTest,
+       sdpu_set_avrc_target_version_device_in_iop_table_versoin_1_3) {
+  RawAddress bdaddr;
+  EXPECT_CALL(*localIopMock, InteropMatchAddr(INTEROP_AVRCP_1_4_ONLY, &bdaddr))
+      .WillOnce(Return(false));
+  EXPECT_CALL(*localIopMock, InteropMatchAddr(INTEROP_AVRCP_1_3_ONLY, &bdaddr))
+      .WillOnce(Return(true));
+  sdpu_set_avrc_target_version(&avrcp_attr, &bdaddr);
+  ASSERT_EQ(get_avrc_target_version(&avrcp_attr), AVRC_REV_1_3);
+}
+
+TEST_F(StackSdpUtilsTest, sdpu_set_avrc_target_version_wrong_len) {
+  RawAddress bdaddr;
+  set_avrcp_attr(5, ATTR_ID_BT_PROFILE_DESC_LIST,
+                 UUID_SERVCLASS_AV_REMOTE_CONTROL, AVRC_REV_1_5);
+  sdpu_set_avrc_target_version(&avrcp_attr, &bdaddr);
+  ASSERT_EQ(get_avrc_target_version(&avrcp_attr), AVRC_REV_1_5);
+}
+
+TEST_F(StackSdpUtilsTest, sdpu_set_avrc_target_version_wrong_attribute_id) {
+  RawAddress bdaddr;
+  set_avrcp_attr(8, ATTR_ID_SERVICE_CLASS_ID_LIST,
+                 UUID_SERVCLASS_AV_REMOTE_CONTROL, AVRC_REV_1_5);
+  sdpu_set_avrc_target_version(&avrcp_attr, &bdaddr);
+  ASSERT_EQ(get_avrc_target_version(&avrcp_attr), AVRC_REV_1_5);
+}
+
+TEST_F(StackSdpUtilsTest, sdpu_set_avrc_target_version_wrong_uuid) {
+  RawAddress bdaddr;
+  set_avrcp_attr(8, ATTR_ID_BT_PROFILE_DESC_LIST, UUID_SERVCLASS_AUDIO_SOURCE,
+                 AVRC_REV_1_5);
+  sdpu_set_avrc_target_version(&avrcp_attr, &bdaddr);
+  ASSERT_EQ(get_avrc_target_version(&avrcp_attr), AVRC_REV_1_5);
+}
+
+// device's controller version older than our target version
+TEST_F(StackSdpUtilsTest, sdpu_set_avrc_target_version_device_older_version) {
+  RawAddress bdaddr;
+  uint8_t config_0104[2] = {0x04, 0x01};
+  EXPECT_CALL(*localIopMock, InteropMatchAddr(INTEROP_AVRCP_1_4_ONLY, &bdaddr))
+      .WillOnce(Return(false));
+  EXPECT_CALL(*localIopMock, InteropMatchAddr(INTEROP_AVRCP_1_3_ONLY, &bdaddr))
+      .WillOnce(Return(false));
+  EXPECT_CALL(btif_config_interface_, GetBinLength(bdaddr.ToString(), _))
+      .WillOnce(Return(2));
+  EXPECT_CALL(btif_config_interface_, GetBin(bdaddr.ToString(), _, _, _))
+      .WillOnce(DoAll(SetArrayArgument<2>(config_0104, config_0104 + 2),
+                      Return(true)));
+  sdpu_set_avrc_target_version(&avrcp_attr, &bdaddr);
+  ASSERT_EQ(get_avrc_target_version(&avrcp_attr), AVRC_REV_1_4);
+}
+
+// device's controller version same as our target version
+TEST_F(StackSdpUtilsTest, sdpu_set_avrc_target_version_device_same_version) {
+  RawAddress bdaddr;
+  uint8_t config_0105[2] = {0x05, 0x01};
+  EXPECT_CALL(*localIopMock, InteropMatchAddr(INTEROP_AVRCP_1_4_ONLY, &bdaddr))
+      .WillOnce(Return(false));
+  EXPECT_CALL(*localIopMock, InteropMatchAddr(INTEROP_AVRCP_1_3_ONLY, &bdaddr))
+      .WillOnce(Return(false));
+  EXPECT_CALL(btif_config_interface_, GetBinLength(bdaddr.ToString(), _))
+      .WillOnce(Return(2));
+  EXPECT_CALL(btif_config_interface_, GetBin(bdaddr.ToString(), _, _, _))
+      .WillOnce(DoAll(SetArrayArgument<2>(config_0105, config_0105 + 2),
+                      Return(true)));
+  sdpu_set_avrc_target_version(&avrcp_attr, &bdaddr);
+  ASSERT_EQ(get_avrc_target_version(&avrcp_attr), AVRC_REV_1_5);
+}
+
+// device's controller version higher than our target version
+TEST_F(StackSdpUtilsTest, sdpu_set_avrc_target_version_device_newer_version) {
+  RawAddress bdaddr;
+  uint8_t config_0106[2] = {0x06, 0x01};
+  EXPECT_CALL(*localIopMock, InteropMatchAddr(INTEROP_AVRCP_1_4_ONLY, &bdaddr))
+      .WillOnce(Return(false));
+  EXPECT_CALL(*localIopMock, InteropMatchAddr(INTEROP_AVRCP_1_3_ONLY, &bdaddr))
+      .WillOnce(Return(false));
+  EXPECT_CALL(btif_config_interface_, GetBinLength(bdaddr.ToString(), _))
+      .WillOnce(Return(2));
+  EXPECT_CALL(btif_config_interface_, GetBin(bdaddr.ToString(), _, _, _))
+      .WillOnce(DoAll(SetArrayArgument<2>(config_0106, config_0106 + 2),
+                      Return(true)));
+  sdpu_set_avrc_target_version(&avrcp_attr, &bdaddr);
+  ASSERT_EQ(get_avrc_target_version(&avrcp_attr), AVRC_REV_1_5);
+}
+
+// cannot read device's controller version from bt_config
+TEST_F(StackSdpUtilsTest, sdpu_set_avrc_target_version_no_config_value) {
+  RawAddress bdaddr;
+  EXPECT_CALL(*localIopMock, InteropMatchAddr(INTEROP_AVRCP_1_4_ONLY, &bdaddr))
+      .WillOnce(Return(false));
+  EXPECT_CALL(*localIopMock, InteropMatchAddr(INTEROP_AVRCP_1_3_ONLY, &bdaddr))
+      .WillOnce(Return(false));
+  EXPECT_CALL(btif_config_interface_, GetBinLength(bdaddr.ToString(), _))
+      .WillOnce(Return(0));
+  sdpu_set_avrc_target_version(&avrcp_attr, &bdaddr);
+  ASSERT_EQ(get_avrc_target_version(&avrcp_attr), AVRC_REV_1_5);
+}
+
+// read device's controller version from bt_config return only 1 byte
+TEST_F(StackSdpUtilsTest, sdpu_set_avrc_target_version_config_value_1_byte) {
+  RawAddress bdaddr;
+  EXPECT_CALL(*localIopMock, InteropMatchAddr(INTEROP_AVRCP_1_4_ONLY, &bdaddr))
+      .WillOnce(Return(false));
+  EXPECT_CALL(*localIopMock, InteropMatchAddr(INTEROP_AVRCP_1_3_ONLY, &bdaddr))
+      .WillOnce(Return(false));
+  EXPECT_CALL(btif_config_interface_, GetBinLength(bdaddr.ToString(), _))
+      .WillOnce(Return(1));
+  sdpu_set_avrc_target_version(&avrcp_attr, &bdaddr);
+  ASSERT_EQ(get_avrc_target_version(&avrcp_attr), AVRC_REV_1_5);
+}
+
+// read device's controller version from bt_config return 3 bytes
+TEST_F(StackSdpUtilsTest, sdpu_set_avrc_target_version_config_value_3_bytes) {
+  RawAddress bdaddr;
+  EXPECT_CALL(*localIopMock, InteropMatchAddr(INTEROP_AVRCP_1_4_ONLY, &bdaddr))
+      .WillOnce(Return(false));
+  EXPECT_CALL(*localIopMock, InteropMatchAddr(INTEROP_AVRCP_1_3_ONLY, &bdaddr))
+      .WillOnce(Return(false));
+  EXPECT_CALL(btif_config_interface_, GetBinLength(bdaddr.ToString(), _))
+      .WillOnce(Return(3));
+  sdpu_set_avrc_target_version(&avrcp_attr, &bdaddr);
+  ASSERT_EQ(get_avrc_target_version(&avrcp_attr), AVRC_REV_1_5);
+}
+
+// cached controller version is not valid
+TEST_F(StackSdpUtilsTest, sdpu_set_avrc_target_version_config_value_not_valid) {
+  RawAddress bdaddr;
+  uint8_t config_not_valid[2] = {0x12, 0x34};
+  EXPECT_CALL(*localIopMock, InteropMatchAddr(INTEROP_AVRCP_1_4_ONLY, &bdaddr))
+      .WillOnce(Return(false));
+  EXPECT_CALL(*localIopMock, InteropMatchAddr(INTEROP_AVRCP_1_3_ONLY, &bdaddr))
+      .WillOnce(Return(false));
+  EXPECT_CALL(btif_config_interface_, GetBinLength(bdaddr.ToString(), _))
+      .WillOnce(Return(2));
+  EXPECT_CALL(btif_config_interface_, GetBin(bdaddr.ToString(), _, _, _))
+      .WillOnce(
+          DoAll(SetArrayArgument<2>(config_not_valid, config_not_valid + 2),
+                Return(true)));
+  sdpu_set_avrc_target_version(&avrcp_attr, &bdaddr);
+  ASSERT_EQ(get_avrc_target_version(&avrcp_attr), AVRC_REV_1_5);
+}
diff --git a/system/stack/test/stack_a2dp_test.cc b/system/stack/test/stack_a2dp_test.cc
index 71526e7..8474421 100644
--- a/system/stack/test/stack_a2dp_test.cc
+++ b/system/stack/test/stack_a2dp_test.cc
@@ -27,6 +27,7 @@
 #include "stack/include/a2dp_codec_api.h"
 #include "stack/include/a2dp_sbc.h"
 #include "stack/include/a2dp_vendor.h"
+#include "stack/include/a2dp_vendor_opus_constants.h"
 #include "stack/include/bt_hdr.h"
 
 namespace {
@@ -187,6 +188,47 @@
     9                                  // Fake
 };
 
+const uint8_t codec_info_opus[AVDT_CODEC_SIZE] = {
+    A2DP_OPUS_CODEC_LEN,         // Length
+    AVDT_MEDIA_TYPE_AUDIO << 4,  // Media Type
+    A2DP_MEDIA_CT_NON_A2DP,      // Media Codec Type Vendor
+    (A2DP_OPUS_VENDOR_ID & 0x000000FF),
+    (A2DP_OPUS_VENDOR_ID & 0x0000FF00) >> 8,
+    (A2DP_OPUS_VENDOR_ID & 0x00FF0000) >> 16,
+    (A2DP_OPUS_VENDOR_ID & 0xFF000000) >> 24,
+    (A2DP_OPUS_CODEC_ID & 0x00FF),
+    (A2DP_OPUS_CODEC_ID & 0xFF00) >> 8,
+    A2DP_OPUS_CHANNEL_MODE_STEREO | A2DP_OPUS_20MS_FRAMESIZE |
+        A2DP_OPUS_SAMPLING_FREQ_48000};
+
+const uint8_t codec_info_opus_capability[AVDT_CODEC_SIZE] = {
+    A2DP_OPUS_CODEC_LEN,         // Length
+    AVDT_MEDIA_TYPE_AUDIO << 4,  // Media Type
+    A2DP_MEDIA_CT_NON_A2DP,      // Media Codec Type Vendor
+    (A2DP_OPUS_VENDOR_ID & 0x000000FF),
+    (A2DP_OPUS_VENDOR_ID & 0x0000FF00) >> 8,
+    (A2DP_OPUS_VENDOR_ID & 0x00FF0000) >> 16,
+    (A2DP_OPUS_VENDOR_ID & 0xFF000000) >> 24,
+    (A2DP_OPUS_CODEC_ID & 0x00FF),
+    (A2DP_OPUS_CODEC_ID & 0xFF00) >> 8,
+    A2DP_OPUS_CHANNEL_MODE_MONO | A2DP_OPUS_CHANNEL_MODE_STEREO |
+        A2DP_OPUS_10MS_FRAMESIZE | A2DP_OPUS_20MS_FRAMESIZE |
+        A2DP_OPUS_SAMPLING_FREQ_48000};
+
+const uint8_t codec_info_opus_sink_capability[AVDT_CODEC_SIZE] = {
+    A2DP_OPUS_CODEC_LEN,         // Length
+    AVDT_MEDIA_TYPE_AUDIO << 4,  // Media Type
+    A2DP_MEDIA_CT_NON_A2DP,      // Media Codec Type Vendor
+    (A2DP_OPUS_VENDOR_ID & 0x000000FF),
+    (A2DP_OPUS_VENDOR_ID & 0x0000FF00) >> 8,
+    (A2DP_OPUS_VENDOR_ID & 0x00FF0000) >> 16,
+    (A2DP_OPUS_VENDOR_ID & 0xFF000000) >> 24,
+    (A2DP_OPUS_CODEC_ID & 0x00FF),
+    (A2DP_OPUS_CODEC_ID & 0xFF00) >> 8,
+    A2DP_OPUS_CHANNEL_MODE_MONO | A2DP_OPUS_CHANNEL_MODE_STEREO |
+        A2DP_OPUS_10MS_FRAMESIZE | A2DP_OPUS_20MS_FRAMESIZE |
+        A2DP_OPUS_SAMPLING_FREQ_48000};
+
 const uint8_t codec_info_non_a2dp[AVDT_CODEC_SIZE] = {
     8,              // Length
     0,              // Media Type: AVDT_MEDIA_TYPE_AUDIO
@@ -264,6 +306,12 @@
           // shared library installed.
           supported = has_shared_library(LDAC_DECODER_LIB_NAME);
           break;
+        case BTAV_A2DP_CODEC_INDEX_SOURCE_LC3:
+          break;
+        case BTAV_A2DP_CODEC_INDEX_SOURCE_OPUS:
+        case BTAV_A2DP_CODEC_INDEX_SINK_OPUS:
+          supported = true;
+          break;
         case BTAV_A2DP_CODEC_INDEX_MAX:
           // Needed to avoid using "default:" case so we can capture when
           // a new codec is added, and it can be included here.
@@ -381,6 +429,32 @@
   EXPECT_FALSE(A2DP_IsPeerSinkCodecValid(codec_info_aac_invalid));
 }
 
+TEST_F(StackA2dpTest, test_a2dp_is_codec_valid_opus) {
+  ASSERT_TRUE(A2DP_IsVendorSourceCodecValid(codec_info_opus));
+  ASSERT_TRUE(A2DP_IsVendorSourceCodecValid(codec_info_opus_capability));
+  ASSERT_TRUE(A2DP_IsVendorPeerSourceCodecValid(codec_info_opus));
+  ASSERT_TRUE(A2DP_IsVendorPeerSourceCodecValid(codec_info_opus_capability));
+
+  ASSERT_TRUE(A2DP_IsVendorSinkCodecValid(codec_info_opus_sink_capability));
+  ASSERT_TRUE(A2DP_IsVendorPeerSinkCodecValid(codec_info_opus_sink_capability));
+
+  // Test with invalid Opus configuration
+  uint8_t codec_info_opus_invalid[AVDT_CODEC_SIZE];
+  memcpy(codec_info_opus_invalid, codec_info_opus, sizeof(codec_info_opus));
+  codec_info_opus_invalid[0] = 0;  // Corrupt the Length field
+  ASSERT_FALSE(A2DP_IsVendorSourceCodecValid(codec_info_opus_invalid));
+  ASSERT_FALSE(A2DP_IsVendorSinkCodecValid(codec_info_opus_invalid));
+  ASSERT_FALSE(A2DP_IsVendorPeerSourceCodecValid(codec_info_opus_invalid));
+  ASSERT_FALSE(A2DP_IsVendorPeerSinkCodecValid(codec_info_opus_invalid));
+
+  memcpy(codec_info_opus_invalid, codec_info_opus, sizeof(codec_info_opus));
+  codec_info_opus_invalid[1] = 0xff;  // Corrupt the Media Type field
+  ASSERT_FALSE(A2DP_IsVendorSourceCodecValid(codec_info_opus_invalid));
+  ASSERT_FALSE(A2DP_IsVendorSinkCodecValid(codec_info_opus_invalid));
+  ASSERT_FALSE(A2DP_IsVendorPeerSourceCodecValid(codec_info_opus_invalid));
+  ASSERT_FALSE(A2DP_IsVendorPeerSinkCodecValid(codec_info_opus_invalid));
+}
+
 TEST_F(StackA2dpTest, test_a2dp_get_codec_type) {
   tA2DP_CODEC_TYPE codec_type = A2DP_GetCodecType(codec_info_sbc);
   EXPECT_EQ(codec_type, A2DP_MEDIA_CT_SBC);
@@ -388,6 +462,9 @@
   codec_type = A2DP_GetCodecType(codec_info_aac);
   EXPECT_EQ(codec_type, A2DP_MEDIA_CT_AAC);
 
+  codec_type = A2DP_GetCodecType(codec_info_opus);
+  ASSERT_EQ(codec_type, A2DP_MEDIA_CT_NON_A2DP);
+
   codec_type = A2DP_GetCodecType(codec_info_non_a2dp);
   EXPECT_EQ(codec_type, A2DP_MEDIA_CT_NON_A2DP);
 }
@@ -438,6 +515,9 @@
   EXPECT_TRUE(A2DP_UsesRtpHeader(true, codec_info_aac));
   EXPECT_TRUE(A2DP_UsesRtpHeader(false, codec_info_aac));
 
+  ASSERT_TRUE(A2DP_VendorUsesRtpHeader(true, codec_info_opus));
+  ASSERT_TRUE(A2DP_VendorUsesRtpHeader(false, codec_info_opus));
+
   EXPECT_TRUE(A2DP_UsesRtpHeader(true, codec_info_non_a2dp));
   EXPECT_TRUE(A2DP_UsesRtpHeader(false, codec_info_non_a2dp));
 }
@@ -468,6 +548,9 @@
   EXPECT_STREQ(A2DP_CodecName(codec_info_aac), "AAC");
   EXPECT_STREQ(A2DP_CodecName(codec_info_aac_capability), "AAC");
   EXPECT_STREQ(A2DP_CodecName(codec_info_aac_sink_capability), "AAC");
+  ASSERT_STREQ(A2DP_CodecName(codec_info_opus), "Opus");
+  ASSERT_STREQ(A2DP_CodecName(codec_info_opus_capability), "Opus");
+  ASSERT_STREQ(A2DP_CodecName(codec_info_opus_sink_capability), "Opus");
   EXPECT_STREQ(A2DP_CodecName(codec_info_non_a2dp), "UNKNOWN VENDOR CODEC");
 
   // Test all unknown codecs
@@ -491,11 +574,19 @@
   EXPECT_TRUE(A2DP_CodecTypeEquals(codec_info_sbc, codec_info_sbc_capability));
   EXPECT_TRUE(
       A2DP_CodecTypeEquals(codec_info_sbc, codec_info_sbc_sink_capability));
+
   EXPECT_TRUE(A2DP_CodecTypeEquals(codec_info_aac, codec_info_aac_capability));
   EXPECT_TRUE(
       A2DP_CodecTypeEquals(codec_info_aac, codec_info_aac_sink_capability));
+
+  ASSERT_TRUE(
+      A2DP_VendorCodecTypeEquals(codec_info_opus, codec_info_opus_capability));
+  ASSERT_TRUE(A2DP_VendorCodecTypeEquals(codec_info_opus,
+                                         codec_info_opus_sink_capability));
+
   EXPECT_TRUE(
       A2DP_CodecTypeEquals(codec_info_non_a2dp, codec_info_non_a2dp_fake));
+
   EXPECT_FALSE(A2DP_CodecTypeEquals(codec_info_sbc, codec_info_non_a2dp));
   EXPECT_FALSE(A2DP_CodecTypeEquals(codec_info_aac, codec_info_non_a2dp));
   EXPECT_FALSE(A2DP_CodecTypeEquals(codec_info_sbc, codec_info_aac));
@@ -504,6 +595,7 @@
 TEST_F(StackA2dpTest, test_a2dp_codec_equals) {
   uint8_t codec_info_sbc_test[AVDT_CODEC_SIZE];
   uint8_t codec_info_aac_test[AVDT_CODEC_SIZE];
+  uint8_t codec_info_opus_test[AVDT_CODEC_SIZE];
   uint8_t codec_info_non_a2dp_test[AVDT_CODEC_SIZE];
 
   // Test two identical SBC codecs
@@ -516,6 +608,11 @@
   memcpy(codec_info_aac_test, codec_info_aac, sizeof(codec_info_aac));
   EXPECT_TRUE(A2DP_CodecEquals(codec_info_aac, codec_info_aac_test));
 
+  // Test two identical Opus codecs
+  memset(codec_info_opus_test, 0xAB, sizeof(codec_info_opus_test));
+  memcpy(codec_info_opus_test, codec_info_opus, sizeof(codec_info_opus));
+  ASSERT_TRUE(A2DP_VendorCodecEquals(codec_info_opus, codec_info_opus_test));
+
   // Test two identical non-A2DP codecs that are not recognized
   memset(codec_info_non_a2dp_test, 0xAB, sizeof(codec_info_non_a2dp_test));
   memcpy(codec_info_non_a2dp_test, codec_info_non_a2dp,
@@ -524,7 +621,8 @@
 
   // Test two codecs that have different types
   EXPECT_FALSE(A2DP_CodecEquals(codec_info_sbc, codec_info_non_a2dp));
-  EXPECT_FALSE(A2DP_CodecEquals(codec_info_sbc, codec_info_aac));
+  ASSERT_FALSE(A2DP_CodecEquals(codec_info_sbc, codec_info_aac));
+  ASSERT_FALSE(A2DP_CodecEquals(codec_info_sbc, codec_info_opus));
 
   // Test two SBC codecs that are slightly different
   memset(codec_info_sbc_test, 0xAB, sizeof(codec_info_sbc_test));
@@ -562,12 +660,14 @@
 TEST_F(StackA2dpTest, test_a2dp_get_track_sample_rate) {
   EXPECT_EQ(A2DP_GetTrackSampleRate(codec_info_sbc), 44100);
   EXPECT_EQ(A2DP_GetTrackSampleRate(codec_info_aac), 44100);
+  ASSERT_EQ(A2DP_VendorGetTrackSampleRate(codec_info_opus), 48000);
   EXPECT_EQ(A2DP_GetTrackSampleRate(codec_info_non_a2dp), -1);
 }
 
 TEST_F(StackA2dpTest, test_a2dp_get_track_channel_count) {
   EXPECT_EQ(A2DP_GetTrackChannelCount(codec_info_sbc), 2);
   EXPECT_EQ(A2DP_GetTrackChannelCount(codec_info_aac), 2);
+  ASSERT_EQ(A2DP_VendorGetTrackChannelCount(codec_info_opus), 2);
   EXPECT_EQ(A2DP_GetTrackChannelCount(codec_info_non_a2dp), -1);
 }
 
@@ -620,6 +720,7 @@
 TEST_F(StackA2dpTest, test_a2dp_get_sink_track_channel_type) {
   EXPECT_EQ(A2DP_GetSinkTrackChannelType(codec_info_sbc), 3);
   EXPECT_EQ(A2DP_GetSinkTrackChannelType(codec_info_aac), 3);
+  ASSERT_EQ(A2DP_VendorGetSinkTrackChannelType(codec_info_opus), 2);
   EXPECT_EQ(A2DP_GetSinkTrackChannelType(codec_info_non_a2dp), -1);
 }
 
@@ -667,6 +768,13 @@
   memset(a2dp_data, 0xAB, sizeof(a2dp_data));
   *p_ts = 0x12345678;
   timestamp = 0xFFFFFFFF;
+  ASSERT_TRUE(
+      A2DP_VendorGetPacketTimestamp(codec_info_opus, a2dp_data, &timestamp));
+  ASSERT_EQ(timestamp, static_cast<uint32_t>(0x12345678));
+
+  memset(a2dp_data, 0xAB, sizeof(a2dp_data));
+  *p_ts = 0x12345678;
+  timestamp = 0xFFFFFFFF;
   EXPECT_FALSE(
       A2DP_GetPacketTimestamp(codec_info_non_a2dp, a2dp_data, &timestamp));
 }
@@ -756,6 +864,12 @@
             BTAV_A2DP_CODEC_INDEX_SOURCE_AAC);
   EXPECT_EQ(A2DP_SourceCodecIndex(codec_info_aac_sink_capability),
             BTAV_A2DP_CODEC_INDEX_SOURCE_AAC);
+  ASSERT_EQ(A2DP_VendorSourceCodecIndex(codec_info_opus),
+            BTAV_A2DP_CODEC_INDEX_SOURCE_OPUS);
+  ASSERT_EQ(A2DP_VendorSourceCodecIndex(codec_info_opus_capability),
+            BTAV_A2DP_CODEC_INDEX_SOURCE_OPUS);
+  ASSERT_EQ(A2DP_VendorSourceCodecIndex(codec_info_opus_sink_capability),
+            BTAV_A2DP_CODEC_INDEX_SOURCE_OPUS);
   EXPECT_EQ(A2DP_SourceCodecIndex(codec_info_non_a2dp),
             BTAV_A2DP_CODEC_INDEX_MAX);
 }
@@ -774,6 +888,12 @@
             BTAV_A2DP_CODEC_INDEX_SINK_AAC);
   EXPECT_EQ(A2DP_SinkCodecIndex(codec_info_aac_sink_capability),
             BTAV_A2DP_CODEC_INDEX_SINK_AAC);
+  ASSERT_EQ(A2DP_VendorSinkCodecIndex(codec_info_opus),
+            BTAV_A2DP_CODEC_INDEX_SINK_OPUS);
+  ASSERT_EQ(A2DP_VendorSinkCodecIndex(codec_info_opus_capability),
+            BTAV_A2DP_CODEC_INDEX_SINK_OPUS);
+  ASSERT_EQ(A2DP_VendorSinkCodecIndex(codec_info_opus_sink_capability),
+            BTAV_A2DP_CODEC_INDEX_SINK_OPUS);
   EXPECT_EQ(A2DP_SinkCodecIndex(codec_info_non_a2dp),
             BTAV_A2DP_CODEC_INDEX_MAX);
 }
@@ -783,6 +903,10 @@
   EXPECT_STREQ(A2DP_CodecIndexStr(BTAV_A2DP_CODEC_INDEX_SOURCE_SBC), "SBC");
   EXPECT_STREQ(A2DP_CodecIndexStr(BTAV_A2DP_CODEC_INDEX_SINK_SBC), "SBC SINK");
   EXPECT_STREQ(A2DP_CodecIndexStr(BTAV_A2DP_CODEC_INDEX_SOURCE_AAC), "AAC");
+  ASSERT_STREQ(A2DP_VendorCodecIndexStr(BTAV_A2DP_CODEC_INDEX_SOURCE_OPUS),
+               "Opus");
+  ASSERT_STREQ(A2DP_VendorCodecIndexStr(BTAV_A2DP_CODEC_INDEX_SINK_OPUS),
+               "Opus SINK");
 
   // Test that the unknown codec string has not changed
   EXPECT_STREQ(A2DP_CodecIndexStr(BTAV_A2DP_CODEC_INDEX_MAX),
diff --git a/system/stack/test/stack_l2cap_test.cc b/system/stack/test/stack_l2cap_test.cc
index 2418772..e8a6f1a 100644
--- a/system/stack/test/stack_l2cap_test.cc
+++ b/system/stack/test/stack_l2cap_test.cc
@@ -17,6 +17,7 @@
 #include <gtest/gtest.h>
 
 #include "common/init_flags.h"
+#include "device/include/controller.h"
 #include "internal_include/bt_trace.h"
 #include "stack/btm/btm_int_types.h"
 #include "stack/include/l2cap_hci_link_interface.h"
@@ -26,24 +27,38 @@
 tBTM_CB btm_cb;
 extern tL2C_CB l2cb;
 
+void l2c_link_send_to_lower_br_edr(tL2C_LCB* p_lcb, BT_HDR* p_buf);
+void l2c_link_send_to_lower_ble(tL2C_LCB* p_lcb, BT_HDR* p_buf);
+
 // Global trace level referred in the code under test
 uint8_t appl_trace_level = BT_TRACE_LEVEL_VERBOSE;
 
 extern "C" void LogMsg(uint32_t trace_set_mask, const char* fmt_str, ...) {}
 
-const char* test_flags[] = {
-    "INIT_logging_debug_enabled_for_all=true",
-    nullptr,
-};
+namespace {
+constexpr uint16_t kAclBufferCountClassic = 123;
+constexpr uint8_t kAclBufferCountBle = 45;
+
+}  // namespace
 
 class StackL2capTest : public ::testing::Test {
  protected:
   void SetUp() override {
-    bluetooth::common::InitFlags::Load(test_flags);
-    l2cb = {};  // TODO Use proper init/free APIs
+    bluetooth::common::InitFlags::SetAllForTesting();
+    controller_.get_acl_buffer_count_classic = []() {
+      return kAclBufferCountClassic;
+    };
+    controller_.get_acl_buffer_count_ble = []() { return kAclBufferCountBle; };
+    controller_.supports_ble = []() -> bool { return true; };
+    l2c_init();
   }
 
-  void TearDown() override {}
+  void TearDown() override {
+    l2c_free();
+    controller_ = {};
+  }
+
+  controller_t controller_;
 };
 
 TEST_F(StackL2capTest, l2cble_process_data_length_change_event) {
@@ -65,3 +80,117 @@
   l2cble_process_data_length_change_event(0x1234, 0x001b, 0x001b);
   ASSERT_EQ(0x001b, l2cb.lcb_pool[0].tx_data_len);
 }
+
+class StackL2capChannelTest : public StackL2capTest {
+ protected:
+  void SetUp() override { StackL2capTest::SetUp(); }
+
+  void TearDown() override { StackL2capTest::TearDown(); }
+
+  tL2C_CCB ccb_ = {
+      .in_use = true,
+      .chnl_state = CST_OPEN,  // tL2C_CHNL_STATE
+      .local_conn_cfg =
+          {
+              // tL2CAP_LE_CFG_INFO
+              .result = 0,
+              .mtu = 100,
+              .mps = 100,
+              .credits = L2CA_LeCreditDefault(),
+              .number_of_channels = L2CAP_CREDIT_BASED_MAX_CIDS,
+          },
+      .peer_conn_cfg =
+          {
+              // tL2CAP_LE_CFG_INFO
+              .result = 0,
+              .mtu = 100,
+              .mps = 100,
+              .credits = L2CA_LeCreditDefault(),
+              .number_of_channels = L2CAP_CREDIT_BASED_MAX_CIDS,
+          },
+      .is_first_seg = false,
+      .ble_sdu = nullptr,     // BT_HDR*; Buffer for storing unassembled sdu
+      .ble_sdu_length = 0,    /* Length of unassembled sdu length*/
+      .p_next_ccb = nullptr,  // struct t_l2c_ccb* Next CCB in the chain
+      .p_prev_ccb = nullptr,  // struct t_l2c_ccb* Previous CCB in the chain
+      .p_lcb = nullptr,  // struct t_l2c_linkcb* Link this CCB is assigned to
+      .local_cid = 40,
+      .remote_cid = 80,
+      .l2c_ccb_timer = nullptr,  // alarm_t* CCB Timer Entry
+      .p_rcb = nullptr,          // tL2C_RCB* Registration CB for this Channel
+      .config_done = 0,          // Configuration flag word
+      .remote_config_rsp_result = 0,  // The config rsp result from remote
+      .local_id = 12,                 // Transaction ID for local trans
+      .remote_id = 22,                // Transaction ID for local
+      .flags = 0,
+      .connection_initiator = false,
+      .our_cfg = {},   // tL2CAP_CFG_INFO Our saved configuration options
+      .peer_cfg = {},  // tL2CAP_CFG_INFO Peer's saved configuration options
+      .xmit_hold_q = nullptr,  // fixed_queue_t*  Transmit data hold queue
+      .cong_sent = false,
+      .buff_quota = 0,
+
+      .ccb_priority =
+          L2CAP_CHNL_PRIORITY_HIGH,  // tL2CAP_CHNL_PRIORITY Channel priority
+      .tx_data_rate = 0,  // tL2CAP_CHNL_PRIORITY  Channel Tx data rate
+      .rx_data_rate = 0,  // tL2CAP_CHNL_PRIORITY  Channel Rx data rate
+
+      .ertm_info =
+          {
+              // .tL2CAP_ERTM_INFO
+              .preferred_mode = 0,
+          },
+      .fcrb =
+          {
+              // tL2C_FCRB
+              .next_tx_seq = 0,
+              .last_rx_ack = 0,
+              .next_seq_expected = 0,
+              .last_ack_sent = 0,
+              .num_tries = 0,
+              .max_held_acks = 0,
+              .remote_busy = false,
+              .rej_sent = false,
+              .srej_sent = false,
+              .wait_ack = false,
+              .rej_after_srej = false,
+              .send_f_rsp = false,
+              .rx_sdu_len = 0,
+              .p_rx_sdu =
+                  nullptr,  // BT_HDR* Buffer holding the SDU being received
+              .waiting_for_ack_q = nullptr,  // fixed_queue_t*
+              .srej_rcv_hold_q = nullptr,    // fixed_queue_t*
+              .retrans_q = nullptr,          // fixed_queue_t*
+              .ack_timer = nullptr,          // alarm_t*
+              .mon_retrans_timer = nullptr,  // alarm_t*
+          },
+      .tx_mps = 0,
+      .max_rx_mtu = 0,
+      .fcr_cfg_tries = 0,
+      .peer_cfg_already_rejected = false,
+      .out_cfg_fcr_present = false,
+      .is_flushable = false,
+      .fixed_chnl_idle_tout = 0,
+      .tx_data_len = 0,
+      .remote_credit_count = 0,
+      .ecoc = false,
+      .reconfig_started = false,
+      .metrics = {},
+  };
+};
+
+TEST_F(StackL2capChannelTest, l2c_lcc_proc_pdu__FirstSegment) {
+  ccb_.is_first_seg = true;
+
+  BT_HDR* p_buf = (BT_HDR*)osi_calloc(sizeof(BT_HDR) + 32);
+  p_buf->len = 32;
+
+  l2c_lcc_proc_pdu(&ccb_, p_buf);
+}
+
+TEST_F(StackL2capChannelTest, l2c_lcc_proc_pdu__NextSegment) {
+  BT_HDR* p_buf = (BT_HDR*)osi_calloc(sizeof(BT_HDR) + 32);
+  p_buf->len = 32;
+
+  l2c_lcc_proc_pdu(&ccb_, p_buf);
+}
diff --git a/system/stack/test/stack_sdp_utils_test.cc b/system/stack/test/stack_sdp_utils_test.cc
deleted file mode 100644
index 200a429..0000000
--- a/system/stack/test/stack_sdp_utils_test.cc
+++ /dev/null
@@ -1,228 +0,0 @@
-/*
- * Copyright 2022 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-#include <gmock/gmock.h>
-#include <gtest/gtest.h>
-
-#include <cstddef>
-
-#include "bt_types.h"
-#include "device/include/interop.h"
-#include "mock_btif_config.h"
-#include "stack/include/avrc_defs.h"
-#include "stack/include/sdp_api.h"
-#include "stack/sdp/sdpint.h"
-
-using testing::_;
-using testing::DoAll;
-using testing::Return;
-using testing::SetArrayArgument;
-
-// Global trace level referred in the code under test
-uint8_t appl_trace_level = BT_TRACE_LEVEL_VERBOSE;
-
-extern "C" void LogMsg(uint32_t trace_set_mask, const char* fmt_str, ...) {}
-
-namespace {
-// convenience mock
-class IopMock {
- public:
-  MOCK_METHOD2(InteropMatchAddr,
-               bool(const interop_feature_t, const RawAddress*));
-};
-
-std::unique_ptr<IopMock> localIopMock;
-}  // namespace
-
-bool interop_match_addr(const interop_feature_t feature,
-                        const RawAddress* addr) {
-  return localIopMock->InteropMatchAddr(feature, addr);
-}
-
-bool osi_property_get_bool(const char* key, bool default_value) { return true; }
-
-uint8_t avrc_value[8] = {
-    ((DATA_ELE_SEQ_DESC_TYPE << 3) | SIZE_IN_NEXT_BYTE),  // data_element
-    6,                                                    // data_len
-    ((UUID_DESC_TYPE << 3) | SIZE_TWO_BYTES),             // uuid_element
-    0,                                                    // uuid
-    0,                                                    // uuid
-    ((UINT_DESC_TYPE << 3) | SIZE_TWO_BYTES),             // version_element
-    0,                                                    // version
-    0                                                     // version
-};
-tSDP_ATTRIBUTE avrcp_attr = {
-    .len = 0,
-    .value_ptr = (uint8_t*)(&avrc_value),
-    .id = 0,
-    .type = 0,
-};
-
-void set_avrcp_attr(uint32_t len, uint16_t id, uint16_t uuid,
-                    uint16_t version) {
-  UINT16_TO_BE_FIELD(avrc_value + 3, uuid);
-  UINT16_TO_BE_FIELD(avrc_value + 6, version);
-  avrcp_attr.len = len;
-  avrcp_attr.id = id;
-}
-
-uint16_t get_avrc_target_version(tSDP_ATTRIBUTE* p_attr) {
-  uint8_t* p_version = p_attr->value_ptr + 6;
-  uint16_t version =
-      (((uint16_t)(*(p_version))) << 8) + ((uint16_t)(*((p_version) + 1)));
-  return version;
-}
-
-class StackSdpUtilsTest : public ::testing::Test {
- protected:
-  void SetUp() override {
-    bluetooth::manager::SetMockBtifConfigInterface(&btif_config_interface_);
-    localIopMock = std::make_unique<IopMock>();
-    set_avrcp_attr(8, ATTR_ID_BT_PROFILE_DESC_LIST,
-                   UUID_SERVCLASS_AV_REMOTE_CONTROL, AVRC_REV_1_5);
-  }
-
-  void TearDown() override {
-    bluetooth::manager::SetMockBtifConfigInterface(nullptr);
-    localIopMock.reset();
-  }
-  bluetooth::manager::MockBtifConfigInterface btif_config_interface_;
-};
-
-TEST_F(StackSdpUtilsTest, sdpu_set_avrc_target_version_device_in_iop_table) {
-  RawAddress bdaddr;
-  EXPECT_CALL(*localIopMock, InteropMatchAddr(INTEROP_AVRCP_1_4_ONLY, &bdaddr))
-      .WillOnce(Return(true));
-  sdpu_set_avrc_target_version(&avrcp_attr, &bdaddr);
-  ASSERT_EQ(get_avrc_target_version(&avrcp_attr), AVRC_REV_1_4);
-}
-
-TEST_F(StackSdpUtilsTest, sdpu_set_avrc_target_version_wrong_len) {
-  RawAddress bdaddr;
-  set_avrcp_attr(5, ATTR_ID_BT_PROFILE_DESC_LIST,
-                 UUID_SERVCLASS_AV_REMOTE_CONTROL, AVRC_REV_1_5);
-  sdpu_set_avrc_target_version(&avrcp_attr, &bdaddr);
-  ASSERT_EQ(get_avrc_target_version(&avrcp_attr), AVRC_REV_1_5);
-}
-
-TEST_F(StackSdpUtilsTest, sdpu_set_avrc_target_version_wrong_attribute_id) {
-  RawAddress bdaddr;
-  set_avrcp_attr(8, ATTR_ID_SERVICE_CLASS_ID_LIST,
-                 UUID_SERVCLASS_AV_REMOTE_CONTROL, AVRC_REV_1_5);
-  sdpu_set_avrc_target_version(&avrcp_attr, &bdaddr);
-  ASSERT_EQ(get_avrc_target_version(&avrcp_attr), AVRC_REV_1_5);
-}
-
-TEST_F(StackSdpUtilsTest, sdpu_set_avrc_target_version_wrong_uuid) {
-  RawAddress bdaddr;
-  set_avrcp_attr(8, ATTR_ID_BT_PROFILE_DESC_LIST, UUID_SERVCLASS_AUDIO_SOURCE,
-                 AVRC_REV_1_5);
-  sdpu_set_avrc_target_version(&avrcp_attr, &bdaddr);
-  ASSERT_EQ(get_avrc_target_version(&avrcp_attr), AVRC_REV_1_5);
-}
-
-// device's controller version older than our target version
-TEST_F(StackSdpUtilsTest, sdpu_set_avrc_target_version_device_older_version) {
-  RawAddress bdaddr;
-  uint8_t config_0104[2] = {0x04, 0x01};
-  EXPECT_CALL(*localIopMock, InteropMatchAddr(INTEROP_AVRCP_1_4_ONLY, &bdaddr))
-      .WillOnce(Return(false));
-  EXPECT_CALL(btif_config_interface_, GetBinLength(bdaddr.ToString(), _))
-      .WillOnce(Return(2));
-  EXPECT_CALL(btif_config_interface_, GetBin(bdaddr.ToString(), _, _, _))
-      .WillOnce(DoAll(SetArrayArgument<2>(config_0104, config_0104 + 2),
-                      Return(true)));
-  sdpu_set_avrc_target_version(&avrcp_attr, &bdaddr);
-  ASSERT_EQ(get_avrc_target_version(&avrcp_attr), AVRC_REV_1_4);
-}
-
-// device's controller version same as our target version
-TEST_F(StackSdpUtilsTest, sdpu_set_avrc_target_version_device_same_version) {
-  RawAddress bdaddr;
-  uint8_t config_0105[2] = {0x05, 0x01};
-  EXPECT_CALL(*localIopMock, InteropMatchAddr(INTEROP_AVRCP_1_4_ONLY, &bdaddr))
-      .WillOnce(Return(false));
-  EXPECT_CALL(btif_config_interface_, GetBinLength(bdaddr.ToString(), _))
-      .WillOnce(Return(2));
-  EXPECT_CALL(btif_config_interface_, GetBin(bdaddr.ToString(), _, _, _))
-      .WillOnce(DoAll(SetArrayArgument<2>(config_0105, config_0105 + 2),
-                      Return(true)));
-  sdpu_set_avrc_target_version(&avrcp_attr, &bdaddr);
-  ASSERT_EQ(get_avrc_target_version(&avrcp_attr), AVRC_REV_1_5);
-}
-
-// device's controller version higher than our target version
-TEST_F(StackSdpUtilsTest, sdpu_set_avrc_target_version_device_newer_version) {
-  RawAddress bdaddr;
-  uint8_t config_0106[2] = {0x06, 0x01};
-  EXPECT_CALL(*localIopMock, InteropMatchAddr(INTEROP_AVRCP_1_4_ONLY, &bdaddr))
-      .WillOnce(Return(false));
-  EXPECT_CALL(btif_config_interface_, GetBinLength(bdaddr.ToString(), _))
-      .WillOnce(Return(2));
-  EXPECT_CALL(btif_config_interface_, GetBin(bdaddr.ToString(), _, _, _))
-      .WillOnce(DoAll(SetArrayArgument<2>(config_0106, config_0106 + 2),
-                      Return(true)));
-  sdpu_set_avrc_target_version(&avrcp_attr, &bdaddr);
-  ASSERT_EQ(get_avrc_target_version(&avrcp_attr), AVRC_REV_1_5);
-}
-
-// cannot read device's controller version from bt_config
-TEST_F(StackSdpUtilsTest, sdpu_set_avrc_target_version_no_config_value) {
-  RawAddress bdaddr;
-  EXPECT_CALL(*localIopMock, InteropMatchAddr(INTEROP_AVRCP_1_4_ONLY, &bdaddr))
-      .WillOnce(Return(false));
-  EXPECT_CALL(btif_config_interface_, GetBinLength(bdaddr.ToString(), _))
-      .WillOnce(Return(0));
-  sdpu_set_avrc_target_version(&avrcp_attr, &bdaddr);
-  ASSERT_EQ(get_avrc_target_version(&avrcp_attr), AVRC_REV_1_5);
-}
-
-// read device's controller version from bt_config return only 1 byte
-TEST_F(StackSdpUtilsTest, sdpu_set_avrc_target_version_config_value_1_byte) {
-  RawAddress bdaddr;
-  EXPECT_CALL(*localIopMock, InteropMatchAddr(INTEROP_AVRCP_1_4_ONLY, &bdaddr))
-      .WillOnce(Return(false));
-  EXPECT_CALL(btif_config_interface_, GetBinLength(bdaddr.ToString(), _))
-      .WillOnce(Return(1));
-  sdpu_set_avrc_target_version(&avrcp_attr, &bdaddr);
-  ASSERT_EQ(get_avrc_target_version(&avrcp_attr), AVRC_REV_1_5);
-}
-
-// read device's controller version from bt_config return 3 bytes
-TEST_F(StackSdpUtilsTest, sdpu_set_avrc_target_version_config_value_3_bytes) {
-  RawAddress bdaddr;
-  EXPECT_CALL(*localIopMock, InteropMatchAddr(INTEROP_AVRCP_1_4_ONLY, &bdaddr))
-      .WillOnce(Return(false));
-  EXPECT_CALL(btif_config_interface_, GetBinLength(bdaddr.ToString(), _))
-      .WillOnce(Return(3));
-  sdpu_set_avrc_target_version(&avrcp_attr, &bdaddr);
-  ASSERT_EQ(get_avrc_target_version(&avrcp_attr), AVRC_REV_1_5);
-}
-
-// cached controller version is not valid
-TEST_F(StackSdpUtilsTest, sdpu_set_avrc_target_version_config_value_not_valid) {
-  RawAddress bdaddr;
-  uint8_t config_not_valid[2] = {0x12, 0x34};
-  EXPECT_CALL(*localIopMock, InteropMatchAddr(INTEROP_AVRCP_1_4_ONLY, &bdaddr))
-      .WillOnce(Return(false));
-  EXPECT_CALL(btif_config_interface_, GetBinLength(bdaddr.ToString(), _))
-      .WillOnce(Return(2));
-  EXPECT_CALL(btif_config_interface_, GetBin(bdaddr.ToString(), _, _, _))
-      .WillOnce(
-          DoAll(SetArrayArgument<2>(config_not_valid, config_not_valid + 2),
-                Return(true)));
-  sdpu_set_avrc_target_version(&avrcp_attr, &bdaddr);
-  ASSERT_EQ(get_avrc_target_version(&avrcp_attr), AVRC_REV_1_5);
-}
diff --git a/system/stack/test/stack_smp_test.cc b/system/stack/test/stack_smp_test.cc
index abf10b9..85a16f9 100644
--- a/system/stack/test/stack_smp_test.cc
+++ b/system/stack/test/stack_smp_test.cc
@@ -38,6 +38,8 @@
 std::map<std::string, int> mock_function_count_map;
 
 const std::string kSmpOptions("mock smp options");
+const std::string kBroadcastAudioConfigOptions(
+    "mock broadcast audio config options");
 bool get_trace_config_enabled(void) { return false; }
 bool get_pts_avrcp_test(void) { return false; }
 bool get_pts_secure_only_mode(void) { return false; }
@@ -50,6 +52,18 @@
 bool get_pts_connect_eatt_before_encryption(void) { return false; }
 bool get_pts_unencrypt_broadcast(void) { return false; }
 bool get_pts_eatt_peripheral_collision_support(void) { return false; }
+bool get_pts_use_eatt_for_all_services(void) { return false; }
+bool get_pts_force_le_audio_multiple_contexts_metadata(void) { return false; }
+bool get_pts_l2cap_ecoc_upper_tester(void) { return false; }
+int get_pts_l2cap_ecoc_min_key_size(void) { return -1; }
+int get_pts_l2cap_ecoc_initial_chan_cnt(void) { return -1; }
+bool get_pts_l2cap_ecoc_connect_remaining(void) { return false; }
+int get_pts_l2cap_ecoc_send_num_of_sdu(void) { return -1; }
+bool get_pts_l2cap_ecoc_reconfigure(void) { return false; }
+const std::string* get_pts_broadcast_audio_config_options(void) {
+  return &kBroadcastAudioConfigOptions;
+}
+bool get_pts_le_audio_disable_ases_before_stopping(void) { return false; }
 config_t* get_all(void) { return nullptr; }
 const packet_fragmenter_t* packet_fragmenter_get_interface() { return nullptr; }
 
@@ -70,6 +84,20 @@
     .get_pts_unencrypt_broadcast = get_pts_unencrypt_broadcast,
     .get_pts_eatt_peripheral_collision_support =
         get_pts_eatt_peripheral_collision_support,
+    .get_pts_use_eatt_for_all_services = get_pts_use_eatt_for_all_services,
+    .get_pts_l2cap_ecoc_upper_tester = get_pts_l2cap_ecoc_upper_tester,
+    .get_pts_force_le_audio_multiple_contexts_metadata =
+        get_pts_force_le_audio_multiple_contexts_metadata,
+    .get_pts_l2cap_ecoc_min_key_size = get_pts_l2cap_ecoc_min_key_size,
+    .get_pts_l2cap_ecoc_initial_chan_cnt = get_pts_l2cap_ecoc_initial_chan_cnt,
+    .get_pts_l2cap_ecoc_connect_remaining =
+        get_pts_l2cap_ecoc_connect_remaining,
+    .get_pts_l2cap_ecoc_send_num_of_sdu = get_pts_l2cap_ecoc_send_num_of_sdu,
+    .get_pts_l2cap_ecoc_reconfigure = get_pts_l2cap_ecoc_reconfigure,
+    .get_pts_broadcast_audio_config_options =
+        get_pts_broadcast_audio_config_options,
+    .get_pts_le_audio_disable_ases_before_stopping =
+        get_pts_le_audio_disable_ases_before_stopping,
     .get_all = get_all,
 };
 const stack_config_t* stack_config_get_interface(void) {
diff --git a/system/test/Android.bp b/system/test/Android.bp
index 8c93ff5..d2081a9 100644
--- a/system/test/Android.bp
+++ b/system/test/Android.bp
@@ -192,6 +192,13 @@
 }
 
 filegroup {
+    name: "TestMockStackA2dpApi",
+    srcs: [
+      "mock/mock_stack_a2dp_api.cc",
+    ],
+}
+
+filegroup {
     name: "TestMockStackL2cap",
     srcs: [
       "mock/mock_stack_l2cap_*.cc",
diff --git a/system/test/common/init_flags.cc b/system/test/common/init_flags.cc
index 9b8585b..b7d4223 100644
--- a/system/test/common/init_flags.cc
+++ b/system/test/common/init_flags.cc
@@ -8,7 +8,9 @@
 namespace bluetooth {
 namespace common {
 
+bool InitFlags::btm_dm_flush_discovery_queue_on_search_cancel = false;
 bool InitFlags::logging_debug_enabled_for_all = false;
+bool InitFlags::leaudio_targeted_announcement_reconnection_mode = false;
 std::unordered_map<std::string, bool>
     InitFlags::logging_debug_explicit_tag_settings = {};
 void InitFlags::Load(const char** flags) {}
diff --git a/system/test/common/stack_config.cc b/system/test/common/stack_config.cc
index becbabd..bb783f9 100644
--- a/system/test/common/stack_config.cc
+++ b/system/test/common/stack_config.cc
@@ -23,6 +23,8 @@
 #include <cstring>
 
 const std::string kSmpOptions("mock smp options");
+const std::string kBroadcastAudioConfigOptions(
+    "mock broadcast audio config options");
 bool get_trace_config_enabled(void) { return false; }
 bool get_pts_avrcp_test(void) { return false; }
 bool get_pts_secure_only_mode(void) { return false; }
@@ -35,6 +37,18 @@
 bool get_pts_connect_eatt_before_encryption(void) { return false; }
 bool get_pts_unencrypt_broadcast(void) { return false; }
 bool get_pts_eatt_peripheral_collision_support(void) { return false; }
+bool get_pts_use_eatt_for_all_services(void) { return false; }
+bool get_pts_force_le_audio_multiple_contexts_metadata(void) { return false; }
+bool get_pts_l2cap_ecoc_upper_tester(void) { return false; }
+int get_pts_l2cap_ecoc_min_key_size(void) { return -1; }
+int get_pts_l2cap_ecoc_initial_chan_cnt(void) { return -1; }
+bool get_pts_l2cap_ecoc_connect_remaining(void) { return false; }
+int get_pts_l2cap_ecoc_send_num_of_sdu(void) { return -1; }
+bool get_pts_l2cap_ecoc_reconfigure(void) { return false; }
+const std::string* get_pts_broadcast_audio_config_options(void) {
+  return &kBroadcastAudioConfigOptions;
+}
+bool get_pts_le_audio_disable_ases_before_stopping(void) { return false; }
 struct config_t;
 config_t* get_all(void) { return nullptr; }
 struct packet_fragmenter_t;
@@ -57,6 +71,20 @@
     .get_pts_unencrypt_broadcast = get_pts_unencrypt_broadcast,
     .get_pts_eatt_peripheral_collision_support =
         get_pts_eatt_peripheral_collision_support,
+    .get_pts_use_eatt_for_all_services = get_pts_use_eatt_for_all_services,
+    .get_pts_l2cap_ecoc_upper_tester = get_pts_l2cap_ecoc_upper_tester,
+    .get_pts_force_le_audio_multiple_contexts_metadata =
+        get_pts_force_le_audio_multiple_contexts_metadata,
+    .get_pts_l2cap_ecoc_min_key_size = get_pts_l2cap_ecoc_min_key_size,
+    .get_pts_l2cap_ecoc_initial_chan_cnt = get_pts_l2cap_ecoc_initial_chan_cnt,
+    .get_pts_l2cap_ecoc_connect_remaining =
+        get_pts_l2cap_ecoc_connect_remaining,
+    .get_pts_l2cap_ecoc_send_num_of_sdu = get_pts_l2cap_ecoc_send_num_of_sdu,
+    .get_pts_l2cap_ecoc_reconfigure = get_pts_l2cap_ecoc_reconfigure,
+    .get_pts_broadcast_audio_config_options =
+        get_pts_broadcast_audio_config_options,
+    .get_pts_le_audio_disable_ases_before_stopping =
+        get_pts_le_audio_disable_ases_before_stopping,
     .get_all = get_all,
 };
 
diff --git a/system/test/headless/Android.bp b/system/test/headless/Android.bp
index 92c6302..5e00948 100644
--- a/system/test/headless/Android.bp
+++ b/system/test/headless/Android.bp
@@ -66,6 +66,7 @@
         "libFraunhoferAAC",
         "libg722codec",
         "liblc3",
+        "libopus",
         "libosi",
         "libprotobuf-cpp-lite",
         "libudrv-uipc",
diff --git a/system/test/mock/mock_bluetooth_interface.cc b/system/test/mock/mock_bluetooth_interface.cc
index a245451..c0815ff 100644
--- a/system/test/mock/mock_bluetooth_interface.cc
+++ b/system/test/mock/mock_bluetooth_interface.cc
@@ -151,6 +151,9 @@
 
 static int clear_event_filter(void) { return 0; }
 
+static void metadata_changed(const RawAddress& remote_bd_addr, int key,
+                             std::vector<uint8_t> value) {}
+
 EXPORT_SYMBOL bt_interface_t bluetoothInterface = {
     sizeof(bluetoothInterface),
     init,
@@ -191,7 +194,8 @@
     set_dynamic_audio_buffer_size,
     generate_local_oob_data,
     allow_low_latency_audio,
-    clear_event_filter};
+    clear_event_filter,
+    metadata_changed};
 
 // callback reporting helpers
 
diff --git a/system/test/mock/mock_bta_av_api.cc b/system/test/mock/mock_bta_av_api.cc
index 4c4e93d..6017d03 100644
--- a/system/test/mock/mock_bta_av_api.cc
+++ b/system/test/mock/mock_bta_av_api.cc
@@ -93,7 +93,9 @@
                                  uint8_t buf_len) {
   mock_function_count_map[__func__]++;
 }
-void BTA_AvStart(tBTA_AV_HNDL handle) { mock_function_count_map[__func__]++; }
+void BTA_AvStart(tBTA_AV_HNDL handle, bool use_latency_mode) {
+  mock_function_count_map[__func__]++;
+}
 void BTA_AvStop(tBTA_AV_HNDL handle, bool suspend) {
   mock_function_count_map[__func__]++;
 }
@@ -105,3 +107,6 @@
                      uint8_t* p_data, uint16_t len, uint32_t company_id) {
   mock_function_count_map[__func__]++;
 }
+void BTA_AvSetLatency(tBTA_AV_HNDL handle, bool is_low_latency) {
+  mock_function_count_map[__func__]++;
+}
diff --git a/system/test/mock/mock_bta_gattc_api.cc b/system/test/mock/mock_bta_gattc_api.cc
index 965b2da..148afd3 100644
--- a/system/test/mock/mock_bta_gattc_api.cc
+++ b/system/test/mock/mock_bta_gattc_api.cc
@@ -112,12 +112,12 @@
   mock_function_count_map[__func__]++;
 }
 void BTA_GATTC_Open(tGATT_IF client_if, const RawAddress& remote_bda,
-                    bool is_direct, bool opportunistic) {
+                    tBTM_BLE_CONN_TYPE connection_type, bool opportunistic) {
   mock_function_count_map[__func__]++;
 }
 void BTA_GATTC_Open(tGATT_IF client_if, const RawAddress& remote_bda,
-                    bool is_direct, tBT_TRANSPORT transport, bool opportunistic,
-                    uint8_t initiating_phys) {
+                    tBTM_BLE_CONN_TYPE connection_type, tBT_TRANSPORT transport,
+                    bool opportunistic, uint8_t initiating_phys) {
   mock_function_count_map[__func__]++;
 }
 void BTA_GATTC_PrepareWrite(uint16_t conn_id, uint16_t handle, uint16_t offset,
diff --git a/system/test/mock/mock_bta_gatts_api.cc b/system/test/mock/mock_bta_gatts_api.cc
index 68380e4..ba86ae5 100644
--- a/system/test/mock/mock_bta_gatts_api.cc
+++ b/system/test/mock/mock_bta_gatts_api.cc
@@ -85,3 +85,4 @@
                                 BTA_GATTS_AddServiceCb cb) {
   mock_function_count_map[__func__]++;
 }
+void BTA_GATTS_InitBonded(void) { mock_function_count_map[__func__]++; }
diff --git a/system/test/mock/mock_bta_hearing_aid.cc b/system/test/mock/mock_bta_hearing_aid.cc
index eabcd09..200df2d 100644
--- a/system/test/mock/mock_bta_hearing_aid.cc
+++ b/system/test/mock/mock_bta_hearing_aid.cc
@@ -52,22 +52,39 @@
   mock_function_count_map[__func__]++;
   return 0;
 }
+
 void HearingAid::AddFromStorage(const HearingDevice& dev_info,
                                 uint16_t is_acceptlisted) {
   mock_function_count_map[__func__]++;
 }
+
 void HearingAid::DebugDump(int fd) { mock_function_count_map[__func__]++; }
-HearingAid* HearingAid::Get() {
-  mock_function_count_map[__func__]++;
-  return nullptr;
-}
+
 bool HearingAid::IsHearingAidRunning() {
   mock_function_count_map[__func__]++;
   return false;
 }
+
 void HearingAid::CleanUp() { mock_function_count_map[__func__]++; }
+
 void HearingAid::Initialize(
     bluetooth::hearing_aid::HearingAidCallbacks* callbacks,
     base::Closure initCb) {
   mock_function_count_map[__func__]++;
 }
+
+void HearingAid::Connect(const RawAddress& address) {
+  mock_function_count_map[__func__]++;
+}
+
+void HearingAid::Disconnect(const RawAddress& address) {
+  mock_function_count_map[__func__]++;
+}
+
+void HearingAid::AddToAcceptlist(const RawAddress& address) {
+  mock_function_count_map[__func__]++;
+}
+
+void HearingAid::SetVolume(int8_t volume) {
+  mock_function_count_map[__func__]++;
+}
diff --git a/system/test/mock/mock_bta_hf_client_api.cc b/system/test/mock/mock_bta_hf_client_api.cc
index 19f6913..f5be68a 100644
--- a/system/test/mock/mock_bta_hf_client_api.cc
+++ b/system/test/mock/mock_bta_hf_client_api.cc
@@ -51,10 +51,15 @@
 void BTA_HfClientClose(uint16_t handle) { mock_function_count_map[__func__]++; }
 void BTA_HfClientDisable(void) { mock_function_count_map[__func__]++; }
 void BTA_HfClientDumpStatistics(int fd) { mock_function_count_map[__func__]++; }
-void BTA_HfClientOpen(const RawAddress& bd_addr, uint16_t* p_handle) {
+bt_status_t BTA_HfClientOpen(const RawAddress& bd_addr, uint16_t* p_handle) {
   mock_function_count_map[__func__]++;
+  return BT_STATUS_SUCCESS;
 }
 void BTA_HfClientSendAT(uint16_t handle, tBTA_HF_CLIENT_AT_CMD_TYPE at,
                         uint32_t val1, uint32_t val2, const char* str) {
   mock_function_count_map[__func__]++;
 }
+int get_default_hf_client_features() {
+  mock_function_count_map[__func__]++;
+  return 0;
+}
diff --git a/system/test/mock/mock_bta_hfp_api.cc b/system/test/mock/mock_bta_hfp_api.cc
new file mode 100644
index 0000000..b9dc9dd
--- /dev/null
+++ b/system/test/mock/mock_bta_hfp_api.cc
@@ -0,0 +1,21 @@
+/*
+ * Copyright 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "bta/include/bta_hfp_api.h"
+
+#define DEFAULT_BTA_HFP_VERSION HFP_VERSION_1_7
+
+int get_default_hfp_version() { return DEFAULT_BTA_HFP_VERSION; }
diff --git a/system/test/mock/mock_bta_leaudio.cc b/system/test/mock/mock_bta_leaudio.cc
index ecb0114..a4bf05c 100644
--- a/system/test/mock/mock_bta_leaudio.cc
+++ b/system/test/mock/mock_bta_leaudio.cc
@@ -48,10 +48,39 @@
 }  // namespace audio
 }  // namespace bluetooth
 
-void LeAudioClient::AddFromStorage(const RawAddress& address,
-                                   bool auto_connect) {
+void LeAudioClient::AddFromStorage(
+    const RawAddress& addr, bool autoconnect, int sink_audio_location,
+    int source_audio_location, int sink_supported_context_types,
+    int source_supported_context_types, const std::vector<uint8_t>& handles,
+    const std::vector<uint8_t>& sink_pacs,
+    const std::vector<uint8_t>& source_pacs, const std::vector<uint8_t>& ases) {
   mock_function_count_map[__func__]++;
 }
+
+bool LeAudioClient::GetHandlesForStorage(const RawAddress& addr,
+                                         std::vector<uint8_t>& out) {
+  mock_function_count_map[__func__]++;
+  return false;
+}
+
+bool LeAudioClient::GetSinkPacsForStorage(const RawAddress& addr,
+                                          std::vector<uint8_t>& out) {
+  mock_function_count_map[__func__]++;
+  return false;
+}
+
+bool LeAudioClient::GetSourcePacsForStorage(const RawAddress& addr,
+                                            std::vector<uint8_t>& out) {
+  mock_function_count_map[__func__]++;
+  return false;
+}
+
+bool LeAudioClient::GetAsesForStorage(const RawAddress& addr,
+                                      std::vector<uint8_t>& out) {
+  mock_function_count_map[__func__]++;
+  return false;
+}
+
 void LeAudioClient::Cleanup(base::Callback<void()> cleanupCb) {
   std::move(cleanupCb).Run();
   mock_function_count_map[__func__]++;
diff --git a/system/test/mock/mock_bta_vc_device.cc b/system/test/mock/mock_bta_vc_device.cc
index a143cf7..fe4159a 100644
--- a/system/test/mock/mock_bta_vc_device.cc
+++ b/system/test/mock/mock_bta_vc_device.cc
@@ -28,7 +28,6 @@
 #include <vector>
 
 #include "bta/vc/devices.h"
-#include "stack/btm/btm_sec.h"
 
 using namespace bluetooth::vc::internal;
 
@@ -36,9 +35,8 @@
 #define UNUSED_ATTR
 #endif
 
-bool VolumeControlDevice::EnableEncryption(tBTM_SEC_CALLBACK* callback) {
+void VolumeControlDevice::EnableEncryption() {
   mock_function_count_map[__func__]++;
-  return false;
 }
 bool VolumeControlDevice::EnqueueInitialRequests(
     tGATT_IF gatt_if, GATT_READ_OP_CB chrc_read_cb,
diff --git a/system/test/mock/mock_main_shim.cc b/system/test/mock/mock_main_shim.cc
index 69cd8df..1e997ce 100644
--- a/system/test/mock/mock_main_shim.cc
+++ b/system/test/mock/mock_main_shim.cc
@@ -25,6 +25,7 @@
 extern std::map<std::string, int> mock_function_count_map;
 
 #define LOG_TAG "bt_shim"
+
 #include "gd/common/init_flags.h"
 #include "main/shim/entry.h"
 #include "main/shim/shim.h"
@@ -45,9 +46,14 @@
   mock_function_count_map[__func__]++;
   return false;
 }
+namespace test {
+namespace mock {
+bool bluetooth_shim_is_gd_stack_started_up = false;
+}
+}  // namespace test
 bool bluetooth::shim::is_gd_stack_started_up() {
   mock_function_count_map[__func__]++;
-  return false;
+  return test::mock::bluetooth_shim_is_gd_stack_started_up;
 }
 bool bluetooth::shim::is_gd_link_policy_enabled() {
   mock_function_count_map[__func__]++;
diff --git a/system/test/mock/mock_main_shim_btm_api.cc b/system/test/mock/mock_main_shim_btm_api.cc
index 5b21a76..de0bd19 100644
--- a/system/test/mock/mock_main_shim_btm_api.cc
+++ b/system/test/mock/mock_main_shim_btm_api.cc
@@ -159,6 +159,10 @@
     bool enable, tBTM_INQ_RESULTS_CB* p_results_cb) {
   mock_function_count_map[__func__]++;
 }
+void bluetooth::shim::BTM_BleTargetAnnouncementObserve(
+    bool enable, tBTM_INQ_RESULTS_CB* p_results_cb) {
+  mock_function_count_map[__func__]++;
+}
 tBTM_STATUS bluetooth::shim::BTM_CancelRemoteDeviceName(void) {
   mock_function_count_map[__func__]++;
   return BTM_SUCCESS;
diff --git a/system/test/mock/mock_main_shim_le_scanning_manager.cc b/system/test/mock/mock_main_shim_le_scanning_manager.cc
index a357335..98d8af9 100644
--- a/system/test/mock/mock_main_shim_le_scanning_manager.cc
+++ b/system/test/mock/mock_main_shim_le_scanning_manager.cc
@@ -39,6 +39,19 @@
   mock_function_count_map[__func__]++;
 }
 
+bool bluetooth::shim::is_ad_type_filter_supported() {
+  mock_function_count_map[__func__]++;
+  return false;
+}
+
+void bluetooth::shim::set_ad_type_rsi_filter(bool enable) {
+  mock_function_count_map[__func__]++;
+}
+
 void bluetooth::shim::set_empty_filter(bool enable) {
   mock_function_count_map[__func__]++;
 }
+
+void bluetooth::shim::set_target_announcements_filter(bool enable) {
+  mock_function_count_map[__func__]++;
+}
\ No newline at end of file
diff --git a/system/test/mock/mock_main_shim_metrics_api.cc b/system/test/mock/mock_main_shim_metrics_api.cc
index 30aeeb1..47c6934 100644
--- a/system/test/mock/mock_main_shim_metrics_api.cc
+++ b/system/test/mock/mock_main_shim_metrics_api.cc
@@ -128,8 +128,8 @@
       raw_address, handle, cmd_status, transmit_power_level);
 }
 void bluetooth::shim::LogMetricSmpPairingEvent(
-    const RawAddress& raw_address, uint8_t smp_cmd,
-    android::bluetooth::DirectionEnum direction, uint8_t smp_fail_reason) {
+    const RawAddress& raw_address, uint16_t smp_cmd,
+    android::bluetooth::DirectionEnum direction, uint16_t smp_fail_reason) {
   mock_function_count_map[__func__]++;
   test::mock::main_shim_metrics_api::LogMetricSmpPairingEvent(
       raw_address, smp_cmd, direction, smp_fail_reason);
@@ -178,6 +178,16 @@
 bool bluetooth::shim::CountCounterMetrics(int32_t key, int64_t count) {
   mock_function_count_map[__func__]++;
   return false;
+
+}
+void bluetooth::shim::LogMetricBluetoothLEConnectionMetricEvent(
+    const RawAddress& raw_address,
+    android::bluetooth::le::LeConnectionOriginType origin_type,
+    android::bluetooth::le::LeConnectionType connection_type,
+    android::bluetooth::le::LeConnectionState transaction_state,
+    std::vector<std::pair<bluetooth::os::ArgumentType, int>> argument_list) {
+  mock_function_count_map[__func__]++;
+  // test::mock::main_shim_metrics_api::LogMetricBluetoothLEConnectionMetricEvent(raw_address, origin_type, connection_type, transaction_state, argument_list);
 }
 
 // END mockcify generation
diff --git a/system/test/mock/mock_main_shim_metrics_api.h b/system/test/mock/mock_main_shim_metrics_api.h
index b42529f..4481787 100644
--- a/system/test/mock/mock_main_shim_metrics_api.h
+++ b/system/test/mock/mock_main_shim_metrics_api.h
@@ -39,6 +39,8 @@
 #include "main/shim/helpers.h"
 #include "main/shim/metrics_api.h"
 #include "types/raw_address.h"
+#include <frameworks/proto_logging/stats/enums/bluetooth/le/enums.pb.h>
+
 
 // Mocked compile conditionals, if any
 #ifndef UNUSED_ATTR
@@ -171,19 +173,19 @@
 };
 extern struct LogMetricReadTxPowerLevelResult LogMetricReadTxPowerLevelResult;
 // Name: LogMetricSmpPairingEvent
-// Params: const RawAddress& raw_address, uint8_t smp_cmd,
+// Params: const RawAddress& raw_address, uint16_t smp_cmd,
 // android::bluetooth::DirectionEnum direction, uint8_t smp_fail_reason Returns:
 // void
 struct LogMetricSmpPairingEvent {
-  std::function<void(const RawAddress& raw_address, uint8_t smp_cmd,
+  std::function<void(const RawAddress& raw_address, uint16_t smp_cmd,
                      android::bluetooth::DirectionEnum direction,
-                     uint8_t smp_fail_reason)>
-      body{[](const RawAddress& raw_address, uint8_t smp_cmd,
+                     uint16_t smp_fail_reason)>
+      body{[](const RawAddress& raw_address, uint16_t smp_cmd,
               android::bluetooth::DirectionEnum direction,
-              uint8_t smp_fail_reason) {}};
-  void operator()(const RawAddress& raw_address, uint8_t smp_cmd,
+              uint16_t smp_fail_reason) {}};
+  void operator()(const RawAddress& raw_address, uint16_t smp_cmd,
                   android::bluetooth::DirectionEnum direction,
-                  uint8_t smp_fail_reason) {
+                  uint16_t smp_fail_reason) {
     body(raw_address, smp_cmd, direction, smp_fail_reason);
   };
 };
@@ -283,6 +285,40 @@
 };
 extern struct LogMetricManufacturerInfo LogMetricManufacturerInfo;
 
+// Name: LogMetricBluetoothLEConnectionMetricEvent
+// Params:     const RawAddress& raw_address,
+//    android::bluetooth::le::LeConnectionOriginType origin_type,
+//    android::bluetooth::le::LeConnectionType connection_type,
+//    android::bluetooth::le::LeConnectionState transaction_state,
+//    std::vector<std::pair<bluetooth::metrics::ArgumentType, int>>
+//    argument_list
+struct LogMetricBluetoothLEConnectionMetricEvent {
+  std::function<void(
+      const RawAddress& raw_address,
+      android::bluetooth::le::LeConnectionOriginType origin_type,
+      android::bluetooth::le::LeConnectionType connection_type,
+      android::bluetooth::le::LeConnectionState transaction_state,
+      std::vector<std::pair<bluetooth::os::ArgumentType, int>>
+          argument_list)>
+      body{[](const RawAddress& raw_address,
+              android::bluetooth::le::LeConnectionOriginType origin_type,
+              android::bluetooth::le::LeConnectionType connection_type,
+              android::bluetooth::le::LeConnectionState
+                  transaction_state,
+              std::vector<std::pair<bluetooth::os::ArgumentType, int>>
+                  argument_list) {}};
+  void operator()(
+      const RawAddress& raw_address,
+      android::bluetooth::le::LeConnectionOriginType origin_type,
+      android::bluetooth::le::LeConnectionType connection_type,
+      android::bluetooth::le::LeConnectionState transaction_state,
+      std::vector<std::pair<bluetooth::os::ArgumentType, int>>
+          argument_list) {
+    body(raw_address, origin_type, connection_type, transaction_state,
+         argument_list);
+  };
+};
+
 }  // namespace main_shim_metrics_api
 }  // namespace mock
 }  // namespace test
diff --git a/system/test/mock/mock_stack_a2dp_api.cc b/system/test/mock/mock_stack_a2dp_api.cc
index 97c2206..ae7ee67 100644
--- a/system/test/mock/mock_stack_a2dp_api.cc
+++ b/system/test/mock/mock_stack_a2dp_api.cc
@@ -56,7 +56,7 @@
 }
 uint8_t A2DP_BitsSet(uint64_t num) {
   mock_function_count_map[__func__]++;
-  return 0;
+  return 1;
 }
 uint8_t A2DP_SetTraceLevel(uint8_t new_level) {
   mock_function_count_map[__func__]++;
diff --git a/system/test/mock/mock_stack_acl.cc b/system/test/mock/mock_stack_acl.cc
index 0feb275..771e256 100644
--- a/system/test/mock/mock_stack_acl.cc
+++ b/system/test/mock/mock_stack_acl.cc
@@ -114,7 +114,6 @@
 struct acl_link_segments_xmitted acl_link_segments_xmitted;
 struct acl_packets_completed acl_packets_completed;
 struct acl_process_extended_features acl_process_extended_features;
-struct acl_process_num_completed_pkts acl_process_num_completed_pkts;
 struct acl_process_supported_features acl_process_supported_features;
 struct acl_rcv_acl_data acl_rcv_acl_data;
 struct acl_reject_connection_request acl_reject_connection_request;
@@ -476,10 +475,6 @@
   test::mock::stack_acl::acl_process_extended_features(
       handle, current_page_number, max_page_number, features);
 }
-void acl_process_num_completed_pkts(uint8_t* p, uint8_t evt_len) {
-  mock_function_count_map[__func__]++;
-  test::mock::stack_acl::acl_process_num_completed_pkts(p, evt_len);
-}
 void acl_process_supported_features(uint16_t handle, uint64_t features) {
   mock_function_count_map[__func__]++;
   test::mock::stack_acl::acl_process_supported_features(handle, features);
diff --git a/system/test/mock/mock_stack_acl.h b/system/test/mock/mock_stack_acl.h
index 63d2f7f..d2efb0c 100644
--- a/system/test/mock/mock_stack_acl.h
+++ b/system/test/mock/mock_stack_acl.h
@@ -751,15 +751,6 @@
   };
 };
 extern struct acl_process_extended_features acl_process_extended_features;
-// Name: acl_process_num_completed_pkts
-// Params: uint8_t* p, uint8_t evt_len
-// Returns: void
-struct acl_process_num_completed_pkts {
-  std::function<void(uint8_t* p, uint8_t evt_len)> body{
-      [](uint8_t* p, uint8_t evt_len) { ; }};
-  void operator()(uint8_t* p, uint8_t evt_len) { body(p, evt_len); };
-};
-extern struct acl_process_num_completed_pkts acl_process_num_completed_pkts;
 // Name: acl_process_supported_features
 // Params: uint16_t handle, uint64_t features
 // Returns: void
diff --git a/system/test/mock/mock_stack_avrc_api.cc b/system/test/mock/mock_stack_avrc_api.cc
index c9e58a9..235613b 100644
--- a/system/test/mock/mock_stack_avrc_api.cc
+++ b/system/test/mock/mock_stack_avrc_api.cc
@@ -40,6 +40,10 @@
 #define UNUSED_ATTR
 #endif
 
+bool avrcp_absolute_volume_is_enabled() {
+  mock_function_count_map[__func__]++;
+  return true;
+}
 uint16_t AVRC_Close(uint8_t handle) {
   mock_function_count_map[__func__]++;
   return 0;
diff --git a/system/test/mock/mock_stack_btm_ble_gap.cc b/system/test/mock/mock_stack_btm_ble_gap.cc
index 3975039..aadc5f2 100644
--- a/system/test/mock/mock_stack_btm_ble_gap.cc
+++ b/system/test/mock/mock_stack_btm_ble_gap.cc
@@ -100,6 +100,10 @@
                                  tBTM_INQ_RESULTS_CB* p_results_cb) {
   mock_function_count_map[__func__]++;
 }
+void BTM_BleTargetAnnouncementObserve(bool enable,
+                                      tBTM_INQ_RESULTS_CB* p_results_cb) {
+  mock_function_count_map[__func__]++;
+}
 tBTM_STATUS btm_ble_read_remote_name(const RawAddress& remote_bda,
                                      tBTM_CMPL_CB* p_cb) {
   mock_function_count_map[__func__]++;
diff --git a/system/test/mock/mock_stack_btm_dev.cc b/system/test/mock/mock_stack_btm_dev.cc
index a01217b..cc959d3 100644
--- a/system/test/mock/mock_stack_btm_dev.cc
+++ b/system/test/mock/mock_stack_btm_dev.cc
@@ -109,3 +109,16 @@
 void wipe_secrets_and_remove(tBTM_SEC_DEV_REC* p_dev_rec) {
   mock_function_count_map[__func__]++;
 }
+void btm_dev_consolidate_existing_connections(const RawAddress& bd_addr) {
+  mock_function_count_map[__func__]++;
+}
+void BTM_SecDump(const std::string& label) {
+  mock_function_count_map[__func__]++;
+}
+void BTM_SecDumpDev(const RawAddress& bd_addr) {
+  mock_function_count_map[__func__]++;
+}
+std::vector<tBTM_SEC_DEV_REC*> btm_get_sec_dev_rec() {
+  mock_function_count_map[__func__]++;
+  return {};
+}
diff --git a/system/test/mock/mock_stack_btm_inq.cc b/system/test/mock/mock_stack_btm_inq.cc
index 356fe6d..c010262 100644
--- a/system/test/mock/mock_stack_btm_inq.cc
+++ b/system/test/mock/mock_stack_btm_inq.cc
@@ -177,3 +177,7 @@
   mock_function_count_map[__func__]++;
 }
 void btm_sort_inq_result(void) { mock_function_count_map[__func__]++; }
+bool BTM_IsRemoteNameKnown(const RawAddress& bd_addr, tBT_TRANSPORT transport) {
+  mock_function_count_map[__func__]++;
+  return false;
+}
diff --git a/system/test/mock/mock_stack_btm_iso.cc b/system/test/mock/mock_stack_btm_iso.cc
index 4f99d66..6c5cda3 100644
--- a/system/test/mock/mock_stack_btm_iso.cc
+++ b/system/test/mock/mock_stack_btm_iso.cc
@@ -18,7 +18,7 @@
                            struct iso_manager::cig_create_params cig_params) {}
 void IsoManager::ReconfigureCig(
     uint8_t cig_id, struct iso_manager::cig_create_params cig_params) {}
-void IsoManager::RemoveCig(uint8_t cig_id) {}
+void IsoManager::RemoveCig(uint8_t cig_id, bool force) {}
 void IsoManager::EstablishCis(
     struct iso_manager::cis_establish_params conn_params) {}
 void IsoManager::DisconnectCis(uint16_t cis_handle, uint8_t reason) {}
diff --git a/system/test/mock/mock_stack_gatt_api.cc b/system/test/mock/mock_stack_gatt_api.cc
index 2c40b7c..25700ac 100644
--- a/system/test/mock/mock_stack_gatt_api.cc
+++ b/system/test/mock/mock_stack_gatt_api.cc
@@ -173,12 +173,13 @@
   return test::mock::stack_gatt_api::GATT_CancelConnect(gatt_if, bd_addr,
                                                         is_direct);
 }
-bool GATT_Connect(tGATT_IF gatt_if, const RawAddress& bd_addr, bool is_direct,
-                  tBT_TRANSPORT transport, bool opportunistic,
-                  uint8_t initiating_phys) {
+bool GATT_Connect(tGATT_IF gatt_if, const RawAddress& bd_addr,
+                  tBTM_BLE_CONN_TYPE connection_type, tBT_TRANSPORT transport,
+                  bool opportunistic, uint8_t initiating_phys) {
   mock_function_count_map[__func__]++;
   return test::mock::stack_gatt_api::GATT_Connect(
-      gatt_if, bd_addr, is_direct, transport, opportunistic, initiating_phys);
+      gatt_if, bd_addr, connection_type, transport, opportunistic,
+      initiating_phys);
 }
 void GATT_Deregister(tGATT_IF gatt_if) {
   mock_function_count_map[__func__]++;
@@ -207,10 +208,10 @@
                                                    eatt_support);
 }
 void GATT_SetIdleTimeout(const RawAddress& bd_addr, uint16_t idle_tout,
-                         tBT_TRANSPORT transport) {
+                         tBT_TRANSPORT transport, bool is_active) {
   mock_function_count_map[__func__]++;
-  test::mock::stack_gatt_api::GATT_SetIdleTimeout(bd_addr, idle_tout,
-                                                  transport);
+  test::mock::stack_gatt_api::GATT_SetIdleTimeout(bd_addr, idle_tout, transport,
+                                                  is_active);
 }
 void GATT_StartIf(tGATT_IF gatt_if) {
   mock_function_count_map[__func__]++;
@@ -228,11 +229,12 @@
 }
 // Mocked functions complete
 //
-bool GATT_Connect(tGATT_IF gatt_if, const RawAddress& bd_addr, bool is_direct,
-                  tBT_TRANSPORT transport, bool opportunistic) {
+bool GATT_Connect(tGATT_IF gatt_if, const RawAddress& bd_addr,
+                  tBTM_BLE_CONN_TYPE connection_type, tBT_TRANSPORT transport,
+                  bool opportunistic) {
   mock_function_count_map[__func__]++;
-  return test::mock::stack_gatt_api::GATT_Connect(gatt_if, bd_addr, is_direct,
-                                                  transport, opportunistic, 0);
+  return test::mock::stack_gatt_api::GATT_Connect(
+      gatt_if, bd_addr, connection_type, transport, opportunistic, 0);
 }
 
 // END mockcify generation
diff --git a/system/test/mock/mock_stack_gatt_api.h b/system/test/mock/mock_stack_gatt_api.h
index 2e8a473..0c34693 100644
--- a/system/test/mock/mock_stack_gatt_api.h
+++ b/system/test/mock/mock_stack_gatt_api.h
@@ -365,12 +365,12 @@
 // transport Return: void
 struct GATT_SetIdleTimeout {
   std::function<void(const RawAddress& bd_addr, uint16_t idle_tout,
-                     tBT_TRANSPORT transport)>
+                     tBT_TRANSPORT transport, bool is_active)>
       body{[](const RawAddress& bd_addr, uint16_t idle_tout,
-              tBT_TRANSPORT transport) {}};
+              tBT_TRANSPORT transport, bool is_active) {}};
   void operator()(const RawAddress& bd_addr, uint16_t idle_tout,
-                  tBT_TRANSPORT transport) {
-    body(bd_addr, idle_tout, transport);
+                  tBT_TRANSPORT transport, bool is_active) {
+    body(bd_addr, idle_tout, transport, is_active);
   };
 };
 extern struct GATT_SetIdleTimeout GATT_SetIdleTimeout;
diff --git a/system/test/mock/mock_stack_gatt_connection_manager.cc b/system/test/mock/mock_stack_gatt_connection_manager.cc
index 99f2904..372b4f0 100644
--- a/system/test/mock/mock_stack_gatt_connection_manager.cc
+++ b/system/test/mock/mock_stack_gatt_connection_manager.cc
@@ -92,3 +92,8 @@
 void connection_manager::reset(bool after_reset) {
   mock_function_count_map[__func__]++;
 }
+
+bool connection_manager::is_background_connection(const RawAddress& address) {
+  mock_function_count_map[__func__]++;
+  return false;
+}
diff --git a/system/test/mock/mock_stack_l2cap_api.cc b/system/test/mock/mock_stack_l2cap_api.cc
index 96d4eef..7311b3b 100644
--- a/system/test/mock/mock_stack_l2cap_api.cc
+++ b/system/test/mock/mock_stack_l2cap_api.cc
@@ -83,7 +83,9 @@
 struct L2CA_GetRemoteCid L2CA_GetRemoteCid;
 struct L2CA_SetIdleTimeoutByBdAddr L2CA_SetIdleTimeoutByBdAddr;
 struct L2CA_SetTraceLevel L2CA_SetTraceLevel;
+struct L2CA_UseLatencyMode L2CA_UseLatencyMode;
 struct L2CA_SetAclPriority L2CA_SetAclPriority;
+struct L2CA_SetAclLatency L2CA_SetAclLatency;
 struct L2CA_SetTxPriority L2CA_SetTxPriority;
 struct L2CA_GetPeerFeatures L2CA_GetPeerFeatures;
 struct L2CA_RegisterFixedChannel L2CA_RegisterFixedChannel;
@@ -91,11 +93,14 @@
 struct L2CA_SendFixedChnlData L2CA_SendFixedChnlData;
 struct L2CA_RemoveFixedChnl L2CA_RemoveFixedChnl;
 struct L2CA_SetLeGattTimeout L2CA_SetLeGattTimeout;
+struct L2CA_MarkLeLinkAsActive L2CA_MarkLeLinkAsActive;
 struct L2CA_DataWrite L2CA_DataWrite;
 struct L2CA_LECocDataWrite L2CA_LECocDataWrite;
 struct L2CA_SetChnlFlushability L2CA_SetChnlFlushability;
 struct L2CA_FlushChannel L2CA_FlushChannel;
 struct L2CA_IsLinkEstablished L2CA_IsLinkEstablished;
+struct L2CA_LeCreditDefault L2CA_LeCreditDefault;
+struct L2CA_LeCreditThreshold L2CA_LeCreditThreshold;
 
 }  // namespace stack_l2cap_api
 }  // namespace mock
@@ -210,10 +215,19 @@
   mock_function_count_map[__func__]++;
   return test::mock::stack_l2cap_api::L2CA_SetTraceLevel(new_level);
 }
+bool L2CA_UseLatencyMode(const RawAddress& bd_addr, bool use_latency_mode) {
+  mock_function_count_map[__func__]++;
+  return test::mock::stack_l2cap_api::L2CA_UseLatencyMode(bd_addr,
+                                                          use_latency_mode);
+}
 bool L2CA_SetAclPriority(const RawAddress& bd_addr, tL2CAP_PRIORITY priority) {
   mock_function_count_map[__func__]++;
   return test::mock::stack_l2cap_api::L2CA_SetAclPriority(bd_addr, priority);
 }
+bool L2CA_SetAclLatency(const RawAddress& bd_addr, tL2CAP_LATENCY latency) {
+  mock_function_count_map[__func__]++;
+  return test::mock::stack_l2cap_api::L2CA_SetAclLatency(bd_addr, latency);
+}
 bool L2CA_SetTxPriority(uint16_t cid, tL2CAP_CHNL_PRIORITY priority) {
   mock_function_count_map[__func__]++;
   return test::mock::stack_l2cap_api::L2CA_SetTxPriority(cid, priority);
@@ -248,6 +262,10 @@
   mock_function_count_map[__func__]++;
   return test::mock::stack_l2cap_api::L2CA_SetLeGattTimeout(rem_bda, idle_tout);
 }
+bool L2CA_MarkLeLinkAsActive(const RawAddress& rem_bda) {
+  mock_function_count_map[__func__]++;
+  return test::mock::stack_l2cap_api::L2CA_MarkLeLinkAsActive(rem_bda);
+}
 uint8_t L2CA_DataWrite(uint16_t cid, BT_HDR* p_data) {
   mock_function_count_map[__func__]++;
   return test::mock::stack_l2cap_api::L2CA_DataWrite(cid, p_data);
@@ -271,5 +289,13 @@
   return test::mock::stack_l2cap_api::L2CA_IsLinkEstablished(bd_addr,
                                                              transport);
 }
+uint16_t L2CA_LeCreditDefault() {
+  mock_function_count_map[__func__]++;
+  return test::mock::stack_l2cap_api::L2CA_LeCreditDefault();
+}
+uint16_t L2CA_LeCreditThreshold() {
+  mock_function_count_map[__func__]++;
+  return test::mock::stack_l2cap_api::L2CA_LeCreditThreshold();
+}
 
 // END mockcify generation
diff --git a/system/test/mock/mock_stack_l2cap_api.h b/system/test/mock/mock_stack_l2cap_api.h
index 6f682fc..592485c 100644
--- a/system/test/mock/mock_stack_l2cap_api.h
+++ b/system/test/mock/mock_stack_l2cap_api.h
@@ -302,8 +302,19 @@
   uint8_t operator()(uint8_t new_level) { return body(new_level); };
 };
 extern struct L2CA_SetTraceLevel L2CA_SetTraceLevel;
+// Name: L2CA_UseLatencyMode
+// Params: const RawAddress& bd_addr, bool use_latency_mode
+// Returns: bool
+struct L2CA_UseLatencyMode {
+  std::function<bool(const RawAddress& bd_addr, bool use_latency_mode)> body{
+      [](const RawAddress& bd_addr, bool use_latency_mode) { return false; }};
+  bool operator()(const RawAddress& bd_addr, bool use_latency_mode) {
+    return body(bd_addr, use_latency_mode);
+  };
+};
+extern struct L2CA_UseLatencyMode L2CA_UseLatencyMode;
 // Name: L2CA_SetAclPriority
-// Params: const RawAddress& bd_addr, tL2CAP_PRIORITY priority
+// Params: const RawAddress& bd_addr, tL2CAP_PRIORITY priority,
 // Returns: bool
 struct L2CA_SetAclPriority {
   std::function<bool(const RawAddress& bd_addr, tL2CAP_PRIORITY priority)> body{
@@ -315,6 +326,17 @@
   };
 };
 extern struct L2CA_SetAclPriority L2CA_SetAclPriority;
+// Name: L2CA_SetAclLatency
+// Params: const RawAddress& bd_addr, tL2CAP_LATENCY latency
+// Returns: bool
+struct L2CA_SetAclLatency {
+  std::function<bool(const RawAddress& bd_addr, tL2CAP_LATENCY latency)> body{
+      [](const RawAddress& bd_addr, tL2CAP_LATENCY latency) { return false; }};
+  bool operator()(const RawAddress& bd_addr, tL2CAP_LATENCY latency) {
+    return body(bd_addr, latency);
+  };
+};
+extern struct L2CA_SetAclLatency L2CA_SetAclLatency;
 // Name: L2CA_SetTxPriority
 // Params: uint16_t cid, tL2CAP_CHNL_PRIORITY priority
 // Returns: bool
@@ -399,6 +421,15 @@
   };
 };
 extern struct L2CA_SetLeGattTimeout L2CA_SetLeGattTimeout;
+// Name: L2CA_MarkLeLinkAsActive
+// Params: const RawAddress& rem_bda
+// Returns: bool
+struct L2CA_MarkLeLinkAsActive {
+  std::function<bool(const RawAddress& rem_bda)> body{
+      [](const RawAddress& rem_bda) { return false; }};
+  bool operator()(const RawAddress& rem_bda) { return body(rem_bda); };
+};
+extern struct L2CA_MarkLeLinkAsActive L2CA_MarkLeLinkAsActive;
 // Name: L2CA_DataWrite
 // Params: uint16_t cid, BT_HDR* p_data
 // Returns: uint8_t
@@ -454,6 +485,22 @@
   };
 };
 extern struct L2CA_IsLinkEstablished L2CA_IsLinkEstablished;
+// Name: L2CA_LeCreditDefault
+// Params:
+// Returns: uint16_t
+struct L2CA_LeCreditDefault {
+  std::function<uint16_t()> body{[]() { return 0; }};
+  uint16_t operator()() { return body(); };
+};
+extern struct L2CA_LeCreditDefault L2CA_LeCreditDefault;
+// Name: L2CA_LeCreditThreshold
+// Params:
+// Returns: uint16_t
+struct L2CA_LeCreditThreshold {
+  std::function<uint16_t()> body{[]() { return 0; }};
+  uint16_t operator()() { return body(); };
+};
+extern struct L2CA_LeCreditThreshold L2CA_LeCreditThreshold;
 
 }  // namespace stack_l2cap_api
 }  // namespace mock
diff --git a/system/test/mock/mock_stack_l2cap_link.cc b/system/test/mock/mock_stack_l2cap_link.cc
index 87a6eaa..2f86036 100644
--- a/system/test/mock/mock_stack_l2cap_link.cc
+++ b/system/test/mock/mock_stack_l2cap_link.cc
@@ -67,9 +67,6 @@
   mock_function_count_map[__func__]++;
 }
 void l2c_link_init() { mock_function_count_map[__func__]++; }
-void l2c_link_process_num_completed_pkts(uint8_t* p, uint8_t evt_len) {
-  mock_function_count_map[__func__]++;
-}
 void l2c_link_role_changed(const RawAddress* bd_addr, uint8_t new_role,
                            uint8_t hci_status) {
   mock_function_count_map[__func__]++;
diff --git a/system/test/mock/mock_stack_metrics_logging.cc b/system/test/mock/mock_stack_metrics_logging.cc
index befaade..028636d 100644
--- a/system/test/mock/mock_stack_metrics_logging.cc
+++ b/system/test/mock/mock_stack_metrics_logging.cc
@@ -86,9 +86,9 @@
       address, connection_handle, direction, link_type, hci_cmd, hci_event,
       hci_ble_event, cmd_status, reason_code);
 }
-void log_smp_pairing_event(const RawAddress& address, uint8_t smp_cmd,
+void log_smp_pairing_event(const RawAddress& address, uint16_t smp_cmd,
                            android::bluetooth::DirectionEnum direction,
-                           uint8_t smp_fail_reason) {
+                           uint16_t smp_fail_reason) {
   mock_function_count_map[__func__]++;
   test::mock::stack_metrics_logging::log_smp_pairing_event(
       address, smp_cmd, direction, smp_fail_reason);
@@ -112,6 +112,19 @@
       address, source_type, source_name, manufacturer, model, hardware_version,
       software_version);
 }
+void log_manufacturer_info(const RawAddress& address,
+                           android::bluetooth::AddressTypeEnum address_type,
+                           android::bluetooth::DeviceInfoSrcEnum source_type,
+                           const std::string& source_name,
+                           const std::string& manufacturer,
+                           const std::string& model,
+                           const std::string& hardware_version,
+                           const std::string& software_version) {
+  mock_function_count_map[__func__]++;
+  test::mock::stack_metrics_logging::log_manufacturer_info(
+      address, address_type, source_type, source_name, manufacturer, model,
+      hardware_version, software_version);
+}
 
 void log_counter_metrics(android::bluetooth::CodePathCounterKeyEnum key,
                          int64_t value) {
diff --git a/system/test/mock/mock_stack_metrics_logging.h b/system/test/mock/mock_stack_metrics_logging.h
index 354ee37..8b695f4 100644
--- a/system/test/mock/mock_stack_metrics_logging.h
+++ b/system/test/mock/mock_stack_metrics_logging.h
@@ -34,6 +34,7 @@
 //       may need attention to prune the inclusion set.
 #include <frameworks/proto_logging/stats/enums/bluetooth/enums.pb.h>
 #include <frameworks/proto_logging/stats/enums/bluetooth/hci/enums.pb.h>
+
 #include "common/metrics.h"
 #include "main/shim/metrics_api.h"
 #include "main/shim/shim.h"
@@ -95,19 +96,19 @@
 };
 extern struct log_link_layer_connection_event log_link_layer_connection_event;
 // Name: log_smp_pairing_event
-// Params: const RawAddress& address, uint8_t smp_cmd,
+// Params: const RawAddress& address, uint16_t smp_cmd,
 // android::bluetooth::DirectionEnum direction, uint8_t smp_fail_reason Returns:
 // void
 struct log_smp_pairing_event {
-  std::function<void(const RawAddress& address, uint8_t smp_cmd,
+  std::function<void(const RawAddress& address, uint16_t smp_cmd,
                      android::bluetooth::DirectionEnum direction,
-                     uint8_t smp_fail_reason)>
-      body{[](const RawAddress& address, uint8_t smp_cmd,
+                     uint16_t smp_fail_reason)>
+      body{[](const RawAddress& address, uint16_t smp_cmd,
               android::bluetooth::DirectionEnum direction,
-              uint8_t smp_fail_reason) {}};
-  void operator()(const RawAddress& address, uint8_t smp_cmd,
+              uint16_t smp_fail_reason) {}};
+  void operator()(const RawAddress& address, uint16_t smp_cmd,
                   android::bluetooth::DirectionEnum direction,
-                  uint8_t smp_fail_reason) {
+                  uint16_t smp_fail_reason) {
     body(address, smp_cmd, direction, smp_fail_reason);
   };
 };
@@ -137,6 +138,29 @@
 // std::string& software_version Returns: void
 struct log_manufacturer_info {
   std::function<void(const RawAddress& address,
+                     android::bluetooth::AddressTypeEnum address_type,
+                     android::bluetooth::DeviceInfoSrcEnum source_type,
+                     const std::string& source_name,
+                     const std::string& manufacturer, const std::string& model,
+                     const std::string& hardware_version,
+                     const std::string& software_version)>
+      body2{[](const RawAddress& address,
+               android::bluetooth::AddressTypeEnum address_type,
+               android::bluetooth::DeviceInfoSrcEnum source_type,
+               const std::string& source_name, const std::string& manufacturer,
+               const std::string& model, const std::string& hardware_version,
+               const std::string& software_version) {}};
+  void operator()(const RawAddress& address,
+                  android::bluetooth::AddressTypeEnum address_type,
+                  android::bluetooth::DeviceInfoSrcEnum source_type,
+                  const std::string& source_name,
+                  const std::string& manufacturer, const std::string& model,
+                  const std::string& hardware_version,
+                  const std::string& software_version) {
+    body2(address, address_type, source_type, source_name, manufacturer, model,
+          hardware_version, software_version);
+  };
+  std::function<void(const RawAddress& address,
                      android::bluetooth::DeviceInfoSrcEnum source_type,
                      const std::string& source_name,
                      const std::string& manufacturer, const std::string& model,
diff --git a/system/test/mock/mock_stack_rfcomm_port_api.cc b/system/test/mock/mock_stack_rfcomm_port_api.cc
index ba070c4..ddc169a 100644
--- a/system/test/mock/mock_stack_rfcomm_port_api.cc
+++ b/system/test/mock/mock_stack_rfcomm_port_api.cc
@@ -98,12 +98,6 @@
   mock_function_count_map[__func__]++;
   return 0;
 }
-int RFCOMM_CreateConnection(uint16_t uuid, uint8_t scn, bool is_server,
-                            uint16_t mtu, const RawAddress& bd_addr,
-                            uint16_t* p_handle, tPORT_CALLBACK* p_mgmt_cb) {
-  mock_function_count_map[__func__]++;
-  return 0;
-}
 int RFCOMM_CreateConnectionWithSecurity(uint16_t uuid, uint8_t scn,
                                         bool is_server, uint16_t mtu,
                                         const RawAddress& bd_addr,
@@ -125,7 +119,8 @@
   mock_function_count_map[__func__]++;
   return 0;
 }
-void RFCOMM_ClearSecurityRecord(uint32_t scn) {
+int PORT_GetSecurityMask(uint16_t handle, uint16_t* sec_mask) {
   mock_function_count_map[__func__]++;
+  return 0;
 }
 void RFCOMM_Init(void) { mock_function_count_map[__func__]++; }
diff --git a/system/test/mock/mock_stack_smp_api.cc b/system/test/mock/mock_stack_smp_api.cc
index b3b175c..59f13f9 100644
--- a/system/test/mock/mock_stack_smp_api.cc
+++ b/system/test/mock/mock_stack_smp_api.cc
@@ -84,6 +84,9 @@
   mock_function_count_map[__func__]++;
 }
 
-void SMP_CrLocScOobData() { mock_function_count_map[__func__]++; }
+bool SMP_CrLocScOobData() {
+  mock_function_count_map[__func__]++;
+  return false;
+}
 
 void SMP_ClearLocScOobData() { mock_function_count_map[__func__]++; }
diff --git a/system/test/rootcanal/Android.bp b/system/test/rootcanal/Android.bp
index 38a6cdd..0df5132 100644
--- a/system/test/rootcanal/Android.bp
+++ b/system/test/rootcanal/Android.bp
@@ -51,9 +51,6 @@
     ],
     cflags: [
         "-fvisibility=hidden",
-        "-Wall",
-        "-Wextra",
-        "-Werror",
         "-DHAS_NO_BDROID_BUILDCFG",
     ],
     generated_headers: [
@@ -76,7 +73,6 @@
         "packages/modules/Bluetooth/system/stack/include",
     ],
     init_rc: ["android.hardware.bluetooth@1.1-service.sim.rc"],
-    required: ["bt_controller_properties"],
 }
 
 cc_library_shared {
@@ -106,9 +102,6 @@
         "libprotobuf-cpp-lite",
     ],
     cflags: [
-        "-Wall",
-        "-Wextra",
-        "-Werror",
         "-DHAS_NO_BDROID_BUILDCFG",
     ],
     generated_headers: [
diff --git a/system/test/stub/osi.cc b/system/test/stub/osi.cc
index f5b5602..7041855 100644
--- a/system/test/stub/osi.cc
+++ b/system/test/stub/osi.cc
@@ -51,6 +51,13 @@
 #define UNUSED_ATTR
 #endif
 
+struct StringComparison {
+  bool operator()(char const* lhs, char const* rhs) const {
+    return strcmp(lhs, rhs) < 0;
+  }
+};
+std::map<const char*, bool, StringComparison> fake_osi_bool_props_map;
+
 std::list<entry_t>::iterator section_t::Find(const std::string& key) {
   mock_function_count_map[__func__]++;
   return std::find_if(
@@ -374,7 +381,7 @@
 
 alarm_t* alarm_new(const char* name) {
   mock_function_count_map[__func__]++;
-  return nullptr;
+  return (alarm_t*)new uint8_t[30];
 }
 alarm_t* alarm_new_periodic(const char* name) {
   mock_function_count_map[__func__]++;
@@ -397,7 +404,11 @@
 }
 void alarm_cleanup(void) { mock_function_count_map[__func__]++; }
 void alarm_debug_dump(int fd) { mock_function_count_map[__func__]++; }
-void alarm_free(alarm_t* alarm) { mock_function_count_map[__func__]++; }
+void alarm_free(alarm_t* alarm) {
+  uint8_t* ptr = (uint8_t*)alarm;
+  delete[] ptr;
+  mock_function_count_map[__func__]++;
+}
 void alarm_set(alarm_t* alarm, uint64_t interval_ms, alarm_callback_t cb,
                void* data) {
   mock_function_count_map[__func__]++;
@@ -597,8 +608,15 @@
 
 bool osi_property_get_bool(const char* key, bool default_value) {
   mock_function_count_map[__func__]++;
+  if (fake_osi_bool_props_map.count(key))
+    return fake_osi_bool_props_map.at(key);
   return default_value;
 }
+
+void osi_property_set_bool(const char* key, bool value) {
+  fake_osi_bool_props_map.insert_or_assign(key, value);
+}
+
 int osi_property_get(const char* key, char* value, const char* default_value) {
   mock_function_count_map[__func__]++;
   return 0;
diff --git a/system/test/suite/Android.bp b/system/test/suite/Android.bp
index c39b1eb..85bcb22 100644
--- a/system/test/suite/Android.bp
+++ b/system/test/suite/Android.bp
@@ -85,11 +85,13 @@
         "libbt-sbc-encoder",
         "libbt-stack",
         "libbt-utils",
+        "libcom.android.sysprop.bluetooth",
         "libflatbuffers-cpp",
         "libFraunhoferAAC",
         "libg722codec",
         "libgmock",
         "liblc3",
+        "libopus",
         "libosi",
         "libstatslog_bt",
         "libc++fs",
diff --git a/system/tools/scripts/dump_le_audio.py b/system/tools/scripts/dump_le_audio.py
index 806cdfb..048facb 100755
--- a/system/tools/scripts/dump_le_audio.py
+++ b/system/tools/scripts/dump_le_audio.py
@@ -79,6 +79,13 @@
 # opcode for hci command
 OPCODE_HCI_CREATE_CIS = 0x2064
 OPCODE_REMOVE_ISO_DATA_PATH = 0x206F
+OPCODE_LE_SET_PERIODIC_ADVERTISING_DATA = 0x203F
+OPCODE_LE_CREATE_BIG = 0x2068
+OPCODE_LE_SETUP_ISO_DATA_PATH = 0x206E
+
+# HCI event
+EVENT_CODE_LE_META_EVENT = 0x3E
+SUBEVENT_CODE_LE_CREATE_BIG_COMPLETE = 0x1B
 
 TYPE_STREAMING_AUDIO_CONTEXTS = 0x02
 
@@ -114,6 +121,9 @@
 AUDIO_LOCATION_RIGHT = 0x02
 AUDIO_LOCATION_CENTER = 0x04
 
+AD_TYPE_SERVICE_DATA_16_BIT = 0x16
+BASIC_AUDIO_ANNOUNCEMENT_SERVICE = 0x1851
+
 packet_number = 0
 debug_enable = False
 add_header = False
@@ -158,35 +168,77 @@
         print("octets_per_frame: " + str(self.octets_per_frame))
 
 
+class Broadcast:
+
+    def __init__(self):
+        self.num_of_bis = defaultdict(int)  # subgroup - num_of_bis
+        self.bis = defaultdict(BisStream)  # bis_index - codec_config
+        self.bis_index_handle_map = defaultdict(int)  # bis_index - bis_handle
+        self.bis_index_list = []
+
+    def dump(self):
+        for bis_index, iso_stream in self.bis.items():
+            print("bis_index: " + str(bis_index) + " bis handle: " + str(self.bis_index_handle_map[bis_index]))
+            iso_stream.dump()
+
+
+class BisStream:
+
+    def __init__(self):
+        self.sampling_frequencies = 0xFF
+        self.frame_duration = 0xFF
+        self.channel_allocation = 0xFFFFFFFF
+        self.octets_per_frame = 0xFFFF
+        self.output_dump = []
+        self.start_time = 0xFFFFFFFF
+
+    def dump(self):
+        print("start_time: " + str(self.start_time))
+        print("sampling_frequencies: " + str(self.sampling_frequencies))
+        print("frame_duration: " + str(self.frame_duration))
+        print("channel_allocation: " + str(self.channel_allocation))
+        print("octets_per_frame: " + str(self.octets_per_frame))
+
+
 connection_map = defaultdict(Connection)
 cis_acl_map = defaultdict(int)
+broadcast_map = defaultdict(Broadcast)
+big_adv_map = defaultdict(int)
+bis_stream_map = defaultdict(BisStream)
 
 
-def generate_header(file, connection):
+def generate_header(file, stream, is_cis):
+    sf_case = {
+        SAMPLE_FREQUENCY_8000: 80,
+        SAMPLE_FREQUENCY_11025: 110,
+        SAMPLE_FREQUENCY_16000: 160,
+        SAMPLE_FREQUENCY_22050: 220,
+        SAMPLE_FREQUENCY_24000: 240,
+        SAMPLE_FREQUENCY_32000: 320,
+        SAMPLE_FREQUENCY_44100: 441,
+        SAMPLE_FREQUENCY_48000: 480,
+        SAMPLE_FREQUENCY_88200: 882,
+        SAMPLE_FREQUENCY_96000: 960,
+        SAMPLE_FREQUENCY_176400: 1764,
+        SAMPLE_FREQUENCY_192000: 1920,
+        SAMPLE_FREQUENCY_384000: 2840,
+    }
+    fd_case = {FRAME_DURATION_7_5: 7.5, FRAME_DURATION_10: 10}
+    al_case = {AUDIO_LOCATION_MONO: 1, AUDIO_LOCATION_LEFT: 1, AUDIO_LOCATION_RIGHT: 1, AUDIO_LOCATION_CENTER: 2}
+
     header = bytearray.fromhex('1ccc1200')
-    for ase in connection.ase.values():
-        sf_case = {
-            SAMPLE_FREQUENCY_8000: 80,
-            SAMPLE_FREQUENCY_11025: 110,
-            SAMPLE_FREQUENCY_16000: 160,
-            SAMPLE_FREQUENCY_22050: 220,
-            SAMPLE_FREQUENCY_24000: 240,
-            SAMPLE_FREQUENCY_32000: 320,
-            SAMPLE_FREQUENCY_44100: 441,
-            SAMPLE_FREQUENCY_48000: 480,
-            SAMPLE_FREQUENCY_88200: 882,
-            SAMPLE_FREQUENCY_96000: 960,
-            SAMPLE_FREQUENCY_176400: 1764,
-            SAMPLE_FREQUENCY_192000: 1920,
-            SAMPLE_FREQUENCY_384000: 2840,
-        }
-        header = header + struct.pack("<H", sf_case[ase.sampling_frequencies])
-        fd_case = {FRAME_DURATION_7_5: 7.5, FRAME_DURATION_10: 10}
-        header = header + struct.pack("<H", int(ase.octets_per_frame * 8 * 10 / fd_case[ase.frame_duration]))
-        al_case = {AUDIO_LOCATION_MONO: 1, AUDIO_LOCATION_LEFT: 1, AUDIO_LOCATION_RIGHT: 1, AUDIO_LOCATION_CENTER: 2}
-        header = header + struct.pack("<HHHL", al_case[ase.channel_allocation], fd_case[ase.frame_duration] * 100, 0,
-                                      48000000)
-        break
+    if is_cis:
+        for ase in stream.ase.values():
+            header = header + struct.pack("<H", sf_case[ase.sampling_frequencies])
+            header = header + struct.pack("<H", int(ase.octets_per_frame * 8 * 10 / fd_case[ase.frame_duration]))
+            header = header + struct.pack("<HHHL", al_case[ase.channel_allocation], fd_case[ase.frame_duration] * 100,
+                                          0, 48000000)
+            break
+    else:
+        header = header + struct.pack("<H", sf_case[stream.sampling_frequencies])
+        header = header + struct.pack("<H", int(stream.octets_per_frame * 8 * 10 / fd_case[stream.frame_duration]))
+        header = header + struct.pack("<HHHL", al_case[stream.channel_allocation], fd_case[stream.frame_duration] * 100,
+                                      0, 48000000)
     file.write(header)
 
 
@@ -206,7 +258,7 @@
             ase.frame_duration = value
         elif config_type == TYPE_CHANNEL_ALLOCATION:
             ase.channel_allocation = value
-        elif TYPE_OCTETS_PER_FRAME:
+        elif config_type == TYPE_OCTETS_PER_FRAME:
             ase.octets_per_frame = value
         length -= (config_length + 1)
 
@@ -284,6 +336,64 @@
     packet_handle.get((opcode, flags), lambda x, y, z: None)(packet, connection_handle, timestamp)
 
 
+def parse_big_codec_information(adv_handle, packet):
+    # Ignore presentation delay
+    packet = unpack_data(packet, 3, True)
+    number_of_subgroup, packet = unpack_data(packet, 1, False)
+    for subgroup in range(number_of_subgroup):
+        num_of_bis, packet = unpack_data(packet, 1, False)
+        broadcast_map[adv_handle].num_of_bis[subgroup] = num_of_bis
+        # Ignore codec id
+        packet = unpack_data(packet, 5, True)
+        length, packet = unpack_data(packet, 1, False)
+        if len(packet) < length:
+            print("Invalid subgroup codec information length")
+            return
+
+        while length > 0:
+            config_length, packet = unpack_data(packet, 1, False)
+            config_type, packet = unpack_data(packet, 1, False)
+            value, packet = unpack_data(packet, config_length - 1, False)
+            if config_type == TYPE_SAMPLING_FREQUENCIES:
+                sampling_frequencies = value
+            elif config_type == TYPE_FRAME_DURATION:
+                frame_duration = value
+            elif config_type == TYPE_OCTETS_PER_FRAME:
+                octets_per_frame = value
+            else:
+                print("Unknown config type")
+            length -= (config_length + 1)
+
+        # Ignore metadata
+        metadata_length, packet = unpack_data(packet, 1, False)
+        packet = unpack_data(packet, metadata_length, True)
+
+        for count in range(num_of_bis):
+            bis_index, packet = unpack_data(packet, 1, False)
+            broadcast_map[adv_handle].bis_index_list.append(bis_index)
+            length, packet = unpack_data(packet, 1, False)
+            if len(packet) < length:
+                print("Invalid level 3 codec information length")
+                return
+
+            while length > 0:
+                config_length, packet = unpack_data(packet, 1, False)
+                config_type, packet = unpack_data(packet, 1, False)
+                value, packet = unpack_data(packet, config_length - 1, False)
+                if config_type == TYPE_CHANNEL_ALLOCATION:
+                    channel_allocation = value
+                else:
+                    print("Ignored config type")
+                length -= (config_length + 1)
+
+            broadcast_map[adv_handle].bis[bis_index].sampling_frequencies = sampling_frequencies
+            broadcast_map[adv_handle].bis[bis_index].frame_duration = frame_duration
+            broadcast_map[adv_handle].bis[bis_index].octets_per_frame = octets_per_frame
+            broadcast_map[adv_handle].bis[bis_index].channel_allocation = channel_allocation
+
+    return packet
+
+
 def debug_print(log):
     global packet_number
     print("#" + str(packet_number) + ": " + log)
@@ -303,7 +413,7 @@
     return value, data[byte:]
 
 
-def parse_command_packet(packet):
+def parse_command_packet(packet, timestamp):
     opcode, packet = unpack_data(packet, 2, False)
     if opcode == OPCODE_HCI_CREATE_CIS:
         debug_print("OPCODE_HCI_CREATE_CIS")
@@ -330,9 +440,96 @@
             debug_print("Invalid cmd length")
             return
 
-        cis_handle, packet = unpack_data(packet, 2, False)
-        acl_handle = cis_acl_map[cis_handle]
-        dump_audio_data_to_file(acl_handle)
+        iso_handle, packet = unpack_data(packet, 2, False)
+        # CIS stream
+        if iso_handle in cis_acl_map:
+            acl_handle = cis_acl_map[iso_handle]
+            dump_cis_audio_data_to_file(acl_handle)
+        # To Do: BIS stream
+        elif iso_handle in bis_stream_map:
+            dump_bis_audio_data_to_file(iso_handle)
+    elif opcode == OPCODE_LE_SET_PERIODIC_ADVERTISING_DATA:
+        debug_print("OPCODE_LE_SET_PERIODIC_ADVERTISING_DATA")
+
+        length, packet = unpack_data(packet, 1, False)
+        if length != len(packet):
+            debug_print("Invalid cmd length")
+            return
+
+        if length < 21:
+            debug_print("Ignored. Not basic audio announcement")
+            return
+
+        adv_hdl, packet = unpack_data(packet, 1, False)
+        #ignore operation, advertising_data_length
+        packet = unpack_data(packet, 2, True)
+        length, packet = unpack_data(packet, 1, False)
+        if length != len(packet):
+            debug_print("Invalid AD element length")
+            return
+
+        ad_type, packet = unpack_data(packet, 1, False)
+        service, packet = unpack_data(packet, 2, False)
+        if ad_type != AD_TYPE_SERVICE_DATA_16_BIT or service != BASIC_AUDIO_ANNOUNCEMENT_SERVICE:
+            debug_print("Ignored. Not basic audio announcement")
+            return
+
+        packet = parse_big_codec_information(adv_hdl, packet)
+    elif opcode == OPCODE_LE_CREATE_BIG:
+        debug_print("OPCODE_LE_CREATE_BIG")
+
+        length, packet = unpack_data(packet, 1, False)
+        if length != len(packet) and length < 31:
+            debug_print("Invalid Create BIG command length")
+            return
+
+        big_handle, packet = unpack_data(packet, 1, False)
+        adv_handle, packet = unpack_data(packet, 1, False)
+        big_adv_map[big_handle] = adv_handle
+    elif opcode == OPCODE_LE_SETUP_ISO_DATA_PATH:
+        debug_print("OPCODE_LE_SETUP_ISO_DATA_PATH")
+        length, packet = unpack_data(packet, 1, False)
+        if len(packet) != length:
+            debug_print("Invalid LE SETUP ISO DATA PATH command length")
+            return
+
+        iso_handle, packet = unpack_data(packet, 2, False)
+        if iso_handle in bis_stream_map:
+            bis_stream_map[iso_handle].start_time = timestamp
+
+
+def parse_event_packet(packet):
+    event_code, packet = unpack_data(packet, 1, False)
+    if event_code != EVENT_CODE_LE_META_EVENT:
+        return
+
+    length, packet = unpack_data(packet, 1, False)
+    if len(packet) != length:
+        print("Invalid LE mata event length")
+        return
+
+    subevent_code, packet = unpack_data(packet, 1, False)
+    if subevent_code != SUBEVENT_CODE_LE_CREATE_BIG_COMPLETE:
+        return
+
+    status, packet = unpack_data(packet, 1, False)
+    if status != 0x00:
+        debug_print("Create_BIG failed")
+        return
+
+    big_handle, packet = unpack_data(packet, 1, False)
+    if big_handle not in big_adv_map:
+        print("Invalid BIG handle")
+        return
+    adv_handle = big_adv_map[big_handle]
+    # Ignore, we don't care these parameter
+    packet = unpack_data(packet, 15, True)
+    num_of_bis, packet = unpack_data(packet, 1, False)
+    for count in range(num_of_bis):
+        bis_handle, packet = unpack_data(packet, 2, False)
+        bis_index = broadcast_map[adv_handle].bis_index_list[count]
+        broadcast_map[adv_handle].bis_index_handle_map[bis_index] = bis_handle
+        bis_stream_map[bis_handle] = broadcast_map[adv_handle].bis[bis_index]
 
 
 def convert_time_str(timestamp):
@@ -348,7 +545,7 @@
     return full_str_format
 
 
-def dump_audio_data_to_file(acl_handle):
+def dump_cis_audio_data_to_file(acl_handle):
     if debug_enable:
         connection_map[acl_handle].dump()
     file_name = ""
@@ -389,20 +586,20 @@
         break
 
     if connection_map[acl_handle].input_dump != []:
-        debug_print("Dump input...")
+        debug_print("Dump unicast input...")
         f = open(file_name + "_input.bin", 'wb')
         if add_header == True:
-            generate_header(f, connection_map[acl_handle])
+            generate_header(f, connection_map[acl_handle], True)
         arr = bytearray(connection_map[acl_handle].input_dump)
         f.write(arr)
         f.close()
         connection_map[acl_handle].input_dump = []
 
     if connection_map[acl_handle].output_dump != []:
-        debug_print("Dump output...")
+        debug_print("Dump unicast output...")
         f = open(file_name + "_output.bin", 'wb')
         if add_header == True:
-            generate_header(f, connection_map[acl_handle])
+            generate_header(f, connection_map[acl_handle], True)
         arr = bytearray(connection_map[acl_handle].output_dump)
         f.write(arr)
         f.close()
@@ -411,6 +608,51 @@
     return
 
 
+def dump_bis_audio_data_to_file(iso_handle):
+    if debug_enable:
+        bis_stream_map[iso_handle].dump()
+    file_name = "broadcast"
+    sf_case = {
+        SAMPLE_FREQUENCY_8000: "8000",
+        SAMPLE_FREQUENCY_11025: "11025",
+        SAMPLE_FREQUENCY_16000: "16000",
+        SAMPLE_FREQUENCY_22050: "22050",
+        SAMPLE_FREQUENCY_24000: "24000",
+        SAMPLE_FREQUENCY_32000: "32000",
+        SAMPLE_FREQUENCY_44100: "44100",
+        SAMPLE_FREQUENCY_48000: "48000",
+        SAMPLE_FREQUENCY_88200: "88200",
+        SAMPLE_FREQUENCY_96000: "96000",
+        SAMPLE_FREQUENCY_176400: "176400",
+        SAMPLE_FREQUENCY_192000: "192000",
+        SAMPLE_FREQUENCY_384000: "284000"
+    }
+    file_name += ("_sf" + sf_case[bis_stream_map[iso_handle].sampling_frequencies])
+    fd_case = {FRAME_DURATION_7_5: "7_5", FRAME_DURATION_10: "10"}
+    file_name += ("_fd" + fd_case[bis_stream_map[iso_handle].frame_duration])
+    al_case = {
+        AUDIO_LOCATION_MONO: "mono",
+        AUDIO_LOCATION_LEFT: "left",
+        AUDIO_LOCATION_RIGHT: "right",
+        AUDIO_LOCATION_CENTER: "center"
+    }
+    file_name += ("_" + al_case[bis_stream_map[iso_handle].channel_allocation])
+    file_name += ("_frame" + str(bis_stream_map[iso_handle].octets_per_frame))
+    file_name += ("_" + convert_time_str(bis_stream_map[iso_handle].start_time))
+
+    if bis_stream_map[iso_handle].output_dump != []:
+        debug_print("Dump broadcast output...")
+        f = open(file_name + "_output.bin", 'wb')
+        if add_header == True:
+            generate_header(f, bis_stream_map[iso_handle], False)
+        arr = bytearray(bis_stream_map[iso_handle].output_dump)
+        f.write(arr)
+        f.close()
+        bis_stream_map[iso_handle].output_dump = []
+
+    return
+
+
 def parse_acl_packet(packet, flags, timestamp):
     # Check the minimum acl length, HCI leader (4 bytes)
     # + L2CAP header (4 bytes)
@@ -441,8 +683,8 @@
 
 
 def parse_iso_packet(packet, flags):
-    cis_handle, packet = unpack_data(packet, 2, False)
-    cis_handle &= 0x0EFF
+    iso_handle, packet = unpack_data(packet, 2, False)
+    iso_handle &= 0x0EFF
     iso_data_load_length, packet = unpack_data(packet, 2, False)
     if iso_data_load_length != len(packet):
         debug_print("Invalid iso data load length")
@@ -457,13 +699,18 @@
         debug_print("Invalid iso sdu length")
         return
 
-    acl_handle = cis_acl_map[cis_handle]
-    if flags == SENT:
-        connection_map[acl_handle].output_dump.extend(struct.pack("<H", len(packet)))
-        connection_map[acl_handle].output_dump.extend(list(packet))
-    elif flags == RECEIVED:
-        connection_map[acl_handle].input_dump.extend(struct.pack("<H", len(packet)))
-        connection_map[acl_handle].input_dump.extend(list(packet))
+    # CIS stream
+    if iso_handle in cis_acl_map:
+        acl_handle = cis_acl_map[iso_handle]
+        if flags == SENT:
+            connection_map[acl_handle].output_dump.extend(struct.pack("<H", len(packet)))
+            connection_map[acl_handle].output_dump.extend(list(packet))
+        elif flags == RECEIVED:
+            connection_map[acl_handle].input_dump.extend(struct.pack("<H", len(packet)))
+            connection_map[acl_handle].input_dump.extend(list(packet))
+    elif iso_handle in bis_stream_map:
+        bis_stream_map[iso_handle].output_dump.extend(struct.pack("<H", len(packet)))
+        bis_stream_map[iso_handle].output_dump.extend(list(packet))
 
 
 def parse_next_packet(btsnoop_file):
@@ -490,10 +737,10 @@
         return False
 
     packet_handle = {
-        COMMADN_PACKET: (lambda x, y, z: parse_command_packet(x)),
+        COMMADN_PACKET: (lambda x, y, z: parse_command_packet(x, z)),
         ACL_PACKET: (lambda x, y, z: parse_acl_packet(x, y, z)),
         SCO_PACKET: (lambda x, y, z: None),
-        EVENT_PACKET: (lambda x, y, z: None),
+        EVENT_PACKET: (lambda x, y, z: parse_event_packet(x)),
         ISO_PACKET: (lambda x, y, z: parse_iso_packet(x, y))
     }
     packet_handle.get(type, lambda x, y, z: None)(packet, flags, timestamp)
@@ -535,7 +782,10 @@
                 break
 
     for handle in connection_map.keys():
-        dump_audio_data_to_file(handle)
+        dump_cis_audio_data_to_file(handle)
+
+    for handle in bis_stream_map.keys():
+        dump_bis_audio_data_to_file(handle)
 
 
 if __name__ == "__main__":
diff --git a/system/types/Android.bp b/system/types/Android.bp
index 2009df6..2dfd541 100644
--- a/system/types/Android.bp
+++ b/system/types/Android.bp
@@ -43,6 +43,10 @@
     ],
     header_libs: ["libbluetooth-types-header"],
     export_header_lib_headers: ["libbluetooth-types-header"],
+    apex_available: [
+        "//apex_available:platform",
+        "com.android.bluetooth",
+    ],
     min_sdk_version: "29",
 }
 
diff --git a/system/types/ble_address_with_type.h b/system/types/ble_address_with_type.h
index 38a52cc..250072d 100644
--- a/system/types/ble_address_with_type.h
+++ b/system/types/ble_address_with_type.h
@@ -116,9 +116,19 @@
     return (other & ~kBleAddressIdentityBit) ==
            (type & ~kBleAddressIdentityBit);
   }
+
   std::string ToString() const {
     return std::string(bda.ToString() + "[" + AddressTypeText(type) + "]");
   }
+
+  std::string ToStringForLogging() const {
+    return bda.ToStringForLogging() + "[" + AddressTypeText(type) + "]";
+  }
+
+  std::string ToRedactedStringForLogging() const {
+    return bda.ToRedactedStringForLogging() + "[" + AddressTypeText(type) + "]";
+  }
+
   bool operator==(const tBLE_BD_ADDR rhs) const {
     return rhs.type == type && rhs.bda == bda;
   }
diff --git a/system/types/bluetooth/uuid.cc b/system/types/bluetooth/uuid.cc
index d05f437..40186ae 100644
--- a/system/types/bluetooth/uuid.cc
+++ b/system/types/bluetooth/uuid.cc
@@ -155,6 +155,8 @@
 
 bool Uuid::IsEmpty() const { return *this == kEmpty; }
 
+bool Uuid::IsBase() const { return *this == kBase; }
+
 void Uuid::UpdateUuid(const Uuid& uuid) {
   uu = uuid.uu;
 }
diff --git a/system/types/bluetooth/uuid.h b/system/types/bluetooth/uuid.h
index 893f5d2..f3e6ec2 100644
--- a/system/types/bluetooth/uuid.h
+++ b/system/types/bluetooth/uuid.h
@@ -106,6 +106,9 @@
   // Returns true if this UUID is equal to kEmpty
   bool IsEmpty() const;
 
+  // Returns true if this UUID is equal to kBase
+  bool IsBase() const;
+
   // Update UUID with new value
   void UpdateUuid(const Uuid& uuid);
 
diff --git a/system/types/raw_address.cc b/system/types/raw_address.cc
index afaf4ef..0cd9de0 100644
--- a/system/types/raw_address.cc
+++ b/system/types/raw_address.cc
@@ -38,12 +38,22 @@
   std::copy(mac.begin(), mac.end(), address);
 }
 
-std::string RawAddress::ToString() const {
+std::string RawAddress::ToString() const { return ToColonSepHexString(); }
+
+std::string RawAddress::ToColonSepHexString() const {
   return base::StringPrintf("%02x:%02x:%02x:%02x:%02x:%02x", address[0],
                             address[1], address[2], address[3], address[4],
                             address[5]);
 }
 
+std::string RawAddress::ToStringForLogging() const {
+  return ToColonSepHexString();
+}
+
+std::string RawAddress::ToRedactedStringForLogging() const {
+  return base::StringPrintf("xx:xx:xx:xx:%02x:%02x", address[4], address[5]);
+}
+
 std::array<uint8_t, RawAddress::kLength> RawAddress::ToArray() const {
   std::array<uint8_t, kLength> mac;
   std::copy(std::begin(address), std::end(address), std::begin(mac));
diff --git a/system/types/raw_address.h b/system/types/raw_address.h
index b3e7530..d623b9f 100644
--- a/system/types/raw_address.h
+++ b/system/types/raw_address.h
@@ -46,8 +46,22 @@
 
   bool IsEmpty() const { return *this == kEmpty; }
 
+  // TODO (b/258090765): remove it and
+  // replace its usage with ToColonSepHexString
   std::string ToString() const;
 
+  // Return a string representation in the form of
+  // hexadecimal string separated by colon (:), e.g.,
+  // "12:34:56:ab:cd:ef"
+  std::string ToColonSepHexString() const;
+  // same as ToColonSepHexString
+  std::string ToStringForLogging() const;
+
+  // Similar with ToColonHexString, ToRedactedStringForLogging returns a
+  // colon separated hexadecimal reprentation of the address but, with the
+  // leftmost 4 bytes masked with "xx", e.g., "xx:xx:xx:xx:ab:cd".
+  std::string ToRedactedStringForLogging() const;
+
   // Converts |string| to RawAddress and places it in |to|. If |from| does
   // not represent a Bluetooth address, |to| is not modified and this function
   // returns false. Otherwise, it returns true.
diff --git a/system/types/test/raw_address_unittest.cc b/system/types/test/raw_address_unittest.cc
index 3a34295..513c8b7 100644
--- a/system/types/test/raw_address_unittest.cc
+++ b/system/types/test/raw_address_unittest.cc
@@ -198,3 +198,14 @@
   std::array<uint8_t, 6> mac2 = bdaddr.ToArray();
   ASSERT_EQ(mac, mac2);
 }
+
+TEST(RawAddress, ToStringForLoggingTest) {
+  std::array<uint8_t, 6> addr_bytes = {0x11, 0x22, 0x33, 0x44, 0x55, 0xab};
+  RawAddress addr(addr_bytes);
+  const std::string redacted_loggable_str = "xx:xx:xx:xx:55:ab";
+  const std::string loggbable_str = "11:22:33:44:55:ab";
+  std::string ret1 = addr.ToStringForLogging();
+  ASSERT_STREQ(ret1.c_str(), loggbable_str.c_str());
+  std::string ret2 = addr.ToRedactedStringForLogging();
+  ASSERT_STREQ(ret2.c_str(), redacted_loggable_str.c_str());
+}
diff --git a/system/utils/Android.bp b/system/utils/Android.bp
index ef0d5d2..c6fb8e3 100644
--- a/system/utils/Android.bp
+++ b/system/utils/Android.bp
@@ -28,5 +28,8 @@
         },
     },
     host_supported: true,
+    apex_available: [
+        "com.android.bluetooth",
+    ],
     min_sdk_version: "Tiramisu"
 }
diff --git a/system/vendor_libs/linux/interface/Android.bp b/system/vendor_libs/linux/interface/Android.bp
index 85fde7d..a92124e 100644
--- a/system/vendor_libs/linux/interface/Android.bp
+++ b/system/vendor_libs/linux/interface/Android.bp
@@ -24,6 +24,7 @@
 
 cc_binary {
     name: "android.hardware.bluetooth@1.1-service.btlinux",
+    defaults: ["fluoride_common_options"],
     proprietary: true,
     relative_install_path: "hw",
     srcs: [
@@ -32,10 +33,6 @@
         "bluetooth_hci.cc",
         "service.cc",
     ],
-    cflags: [
-        "-Wall",
-        "-Werror",
-    ],
     header_libs: ["libbluetooth_headers"],
     shared_libs: [
         "android.hardware.bluetooth@1.0",
@@ -57,14 +54,11 @@
 
 cc_library_static {
     name: "async_fd_watcher",
+    defaults: ["fluoride_common_options"],
     proprietary: true,
     srcs: [
         "async_fd_watcher.cc",
     ],
-    cflags: [
-        "-Wall",
-        "-Werror",
-    ],
     shared_libs: [
         "liblog",
     ],
diff --git a/tools/pdl/src/test_utils.rs b/tools/pdl/src/test_utils.rs
new file mode 100644
index 0000000..c228c3b
--- /dev/null
+++ b/tools/pdl/src/test_utils.rs
@@ -0,0 +1,209 @@
+//! Various utility functions used in tests.
+
+// This file is included directly into integration tests in the
+// `tests/` directory. These tests are compiled without access to the
+// rest of the `pdl` crate. To make this work, avoid `use crate::`
+// statements below.
+
+use quote::quote;
+use std::fs;
+use std::io::Write;
+use std::path::Path;
+use std::process::{Command, Stdio};
+use tempfile::NamedTempFile;
+
+/// Search for a binary in `$PATH` or as a sibling to the current
+/// executable (typically the test binary).
+pub fn find_binary(name: &str) -> Result<std::path::PathBuf, String> {
+    let mut current_exe = std::env::current_exe().unwrap();
+    current_exe.pop();
+    let paths = std::env::var_os("PATH").unwrap();
+    for mut path in std::iter::once(current_exe.clone()).chain(std::env::split_paths(&paths)) {
+        path.push(name);
+        if path.exists() {
+            return Ok(path);
+        }
+    }
+
+    Err(format!(
+        "could not find '{}' in the directory of the binary ({}) or in $PATH ({})",
+        name,
+        current_exe.to_string_lossy(),
+        paths.to_string_lossy(),
+    ))
+}
+
+/// Run `input` through `rustfmt`.
+///
+/// # Panics
+///
+/// Panics if `rustfmt` cannot be found in the same directory as the
+/// test executable or if it returns a non-zero exit code.
+pub fn rustfmt(input: &str) -> String {
+    let rustfmt_path = find_binary("rustfmt").expect("cannot find rustfmt");
+    let mut rustfmt = Command::new(&rustfmt_path)
+        .stdin(Stdio::piped())
+        .stdout(Stdio::piped())
+        .spawn()
+        .unwrap_or_else(|_| panic!("failed to start {:?}", &rustfmt_path));
+
+    let mut stdin = rustfmt.stdin.take().unwrap();
+    // Owned copy which we can move into the writing thread.
+    let input = String::from(input);
+    std::thread::spawn(move || {
+        stdin.write_all(input.as_bytes()).expect("could not write to stdin");
+    });
+
+    let output = rustfmt.wait_with_output().expect("error executing rustfmt");
+    assert!(output.status.success(), "rustfmt failed: {}", output.status);
+    String::from_utf8(output.stdout).expect("rustfmt output was not UTF-8")
+}
+
+/// Find the unified diff between two strings using `diff`.
+///
+/// # Panics
+///
+/// Panics if `diff` cannot be found on `$PATH` or if it returns an
+/// error.
+pub fn diff(left_label: &str, left: &str, right_label: &str, right: &str) -> String {
+    let mut temp_left = NamedTempFile::new().unwrap();
+    temp_left.write_all(left.as_bytes()).unwrap();
+    let mut temp_right = NamedTempFile::new().unwrap();
+    temp_right.write_all(right.as_bytes()).unwrap();
+
+    // We expect `diff` to be available on PATH.
+    let output = Command::new("diff")
+        .arg("--unified")
+        .arg("--color=always")
+        .arg("--label")
+        .arg(left_label)
+        .arg("--label")
+        .arg(right_label)
+        .arg(temp_left.path())
+        .arg(temp_right.path())
+        .output()
+        .expect("failed to run diff");
+    let diff_trouble_exit_code = 2; // from diff(1)
+    assert_ne!(
+        output.status.code().unwrap(),
+        diff_trouble_exit_code,
+        "diff failed: {}",
+        output.status
+    );
+    String::from_utf8(output.stdout).expect("diff output was not UTF-8")
+}
+
+/// Compare two strings and output a diff if they are not equal.
+#[track_caller]
+pub fn assert_eq_with_diff(left_label: &str, left: &str, right_label: &str, right: &str) {
+    assert!(
+        left == right,
+        "texts did not match, diff:\n{}\n",
+        diff(left_label, left, right_label, right)
+    );
+}
+
+// Assert that an expression equals the given expression.
+//
+// Both expressions are wrapped in a `main` function (so we can format
+// it with `rustfmt`) and a diff is be shown if they differ.
+#[track_caller]
+pub fn assert_expr_eq(left: proc_macro2::TokenStream, right: proc_macro2::TokenStream) {
+    let left = quote! {
+        fn main() { #left }
+    };
+    let right = quote! {
+        fn main() { #right }
+    };
+    assert_eq_with_diff("left", &rustfmt(&left.to_string()), "right", &rustfmt(&right.to_string()));
+}
+
+/// Check that `haystack` contains `needle`.
+///
+/// Panic with a nice message if not.
+#[track_caller]
+pub fn assert_contains(haystack: &str, needle: &str) {
+    assert!(haystack.contains(needle), "Could not find {:?} in {:?}", needle, haystack);
+}
+
+/// Compare a string with a snapshot file.
+///
+/// The `snapshot_path` is relative to the current working directory
+/// of the test binary. This depends on how you execute the tests:
+///
+/// * When using `atest`: The current working directory is a random
+///   temporary directory. You need to ensure that the snapshot file
+///   is installed into this directory. You do this by adding the
+///   snapshot to the `data` attribute of your test rule
+///
+/// * When using Cargo: The current working directory is set to
+///   `CARGO_MANIFEST_DIR`, which is where the `Cargo.toml` file is
+///   found.
+///
+/// If you run the test with Cargo and the `UPDATE_SNAPSHOTS`
+/// environment variable is set, then the `actual_content` will be
+/// written to `snapshot_path`. Otherwise the content is compared and
+/// a panic is triggered if they differ.
+#[track_caller]
+pub fn assert_snapshot_eq<P: AsRef<Path>>(snapshot_path: P, actual_content: &str) {
+    let snapshot = snapshot_path.as_ref();
+    let snapshot_content = fs::read(snapshot).unwrap_or_else(|err| {
+        panic!("Could not read snapshot from {}: {}", snapshot.display(), err)
+    });
+    let snapshot_content = String::from_utf8(snapshot_content).expect("Snapshot was not UTF-8");
+
+    // Normal comparison if UPDATE_SNAPSHOTS is unset.
+    if std::env::var("UPDATE_SNAPSHOTS").is_err() {
+        return assert_eq_with_diff(
+            snapshot.to_str().unwrap(),
+            &snapshot_content,
+            "actual",
+            actual_content,
+        );
+    }
+
+    // Bail out if we are not using Cargo.
+    if std::env::var("CARGO_MANIFEST_DIR").is_err() {
+        panic!("Please unset UPDATE_SNAPSHOTS if you are not using Cargo");
+    }
+
+    if actual_content != snapshot_content {
+        eprintln!(
+            "Updating snapshot {}: {} -> {} bytes",
+            snapshot.display(),
+            snapshot_content.len(),
+            actual_content.len()
+        );
+        fs::write(&snapshot_path, actual_content).unwrap_or_else(|err| {
+            panic!("Could not write snapshot to {}: {}", snapshot.display(), err)
+        });
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_diff_labels_with_special_chars() {
+        // Check that special characters in labels are passed
+        // correctly to diff.
+        let patch = diff("left 'file'", "foo\nbar\n", "right ~file!", "foo\nnew line\nbar\n");
+        assert_contains(&patch, "left 'file'");
+        assert_contains(&patch, "right ~file!");
+    }
+
+    #[test]
+    #[should_panic]
+    fn test_assert_eq_with_diff_on_diff() {
+        // We use identical labels to check that we haven't
+        // accidentally mixed up the labels with the file content.
+        assert_eq_with_diff("", "foo\nbar\n", "", "foo\nnew line\nbar\n");
+    }
+
+    #[test]
+    fn test_assert_eq_with_diff_on_eq() {
+        // No panic when there is no diff.
+        assert_eq_with_diff("left", "foo\nbar\n", "right", "foo\nbar\n");
+    }
+}
diff --git a/tools/rootcanal/Android.bp b/tools/rootcanal/Android.bp
index 4285628..d0f6f51 100644
--- a/tools/rootcanal/Android.bp
+++ b/tools/rootcanal/Android.bp
@@ -9,33 +9,35 @@
     default_visibility: [
         "//device:__subpackages__",
         "//packages/modules/Bluetooth:__subpackages__",
+        "//tools/netsim:__subpackages__"
     ],
 }
 
 cc_defaults {
     name: "rootcanal_defaults",
     defaults: [
+        "fluoride_common_options",
         "gd_defaults",
         "gd_clang_tidy",
         "gd_clang_tidy_ignore_android",
     ],
     cflags: [
-        "-Wall",
-        "-Wextra",
-        "-Werror",
         "-fvisibility=hidden",
+        "-DROOTCANAL_LMP",
     ],
     local_include_dirs: [
         "include",
     ],
     include_dirs: [
-        "packages/modules/Bluetooth/system",
         "packages/modules/Bluetooth/system/gd",
     ],
+    header_libs: [
+        "libbase_headers",
+    ],
     generated_headers: [
         "RootCanalGeneratedPackets_h",
+        "RootCanalBrEdrBBGeneratedPackets_h",
         "BluetoothGeneratedPackets_h",
-        "libbt_init_flags_bridge_header",
     ],
 }
 
@@ -50,30 +52,26 @@
     srcs: [
         "model/controller/acl_connection.cc",
         "model/controller/acl_connection_handler.cc",
+        "model/controller/controller_properties.cc",
         "model/controller/dual_mode_controller.cc",
         "model/controller/isochronous_connection_handler.cc",
         "model/controller/le_advertiser.cc",
         "model/controller/link_layer_controller.cc",
         "model/controller/sco_connection.cc",
         "model/controller/security_manager.cc",
+        "model/devices/baseband_sniffer.cc",
         "model/devices/beacon.cc",
         "model/devices/beacon_swarm.cc",
-        "model/devices/broken_adv.cc",
-        "model/devices/car_kit.cc",
-        "model/devices/classic.cc",
         "model/devices/device.cc",
-        "model/devices/device_properties.cc",
         "model/devices/hci_device.cc",
-        "model/devices/keyboard.cc",
         "model/devices/link_layer_socket_device.cc",
-        "model/devices/loopback.cc",
-        "model/devices/remote_loopback_device.cc",
         "model/devices/scripted_beacon.cc",
         "model/devices/sniffer.cc",
         "model/hci/h4_data_channel_packetizer.cc",
         "model/hci/h4_packetizer.cc",
         "model/hci/h4_parser.cc",
         "model/hci/hci_protocol.cc",
+        "model/hci/hci_sniffer.cc",
         "model/hci/hci_socket_transport.cc",
         "model/setup/async_manager.cc",
         "model/setup/device_boutique.cc",
@@ -92,8 +90,14 @@
         "include",
         ".",
     ],
+    export_generated_headers: [
+        "BluetoothGeneratedPackets_h"
+    ],
+    whole_static_libs: [
+        "liblmp",
+    ],
     shared_libs: [
-        "liblog",
+        "libbase",
     ],
     static_libs: [
         "libjsoncpp",
@@ -112,13 +116,62 @@
     srcs: ["model/devices/scripted_beacon_ble_payload.proto"],
 }
 
+cc_test_host {
+    name: "rootcanal_hci_test",
+    defaults: [
+        "clang_file_coverage",
+        "clang_coverage_bin",
+        "rootcanal_defaults",
+    ],
+    srcs: [
+        "test/controller/le/le_set_random_address_test.cc",
+        "test/controller/le/le_clear_filter_accept_list_test.cc",
+        "test/controller/le/le_add_device_to_filter_accept_list_test.cc",
+        "test/controller/le/le_remove_device_from_filter_accept_list_test.cc",
+        "test/controller/le/le_add_device_to_resolving_list_test.cc",
+        "test/controller/le/le_clear_resolving_list_test.cc",
+        "test/controller/le/le_create_connection_test.cc",
+        "test/controller/le/le_create_connection_cancel_test.cc",
+        "test/controller/le/le_extended_create_connection_test.cc",
+        "test/controller/le/le_remove_device_from_resolving_list_test.cc",
+        "test/controller/le/le_set_address_resolution_enable_test.cc",
+        "test/controller/le/le_set_advertising_parameters_test.cc",
+        "test/controller/le/le_set_advertising_enable_test.cc",
+        "test/controller/le/le_set_scan_parameters_test.cc",
+        "test/controller/le/le_set_scan_enable_test.cc",
+        "test/controller/le/le_set_extended_scan_parameters_test.cc",
+        "test/controller/le/le_set_extended_scan_enable_test.cc",
+        "test/controller/le/le_set_extended_advertising_parameters_test.cc",
+        "test/controller/le/le_set_extended_advertising_data_test.cc",
+        "test/controller/le/le_set_extended_scan_response_data_test.cc",
+        "test/controller/le/le_set_extended_advertising_enable_test.cc",
+        "test/controller/le/le_scanning_filter_duplicates_test.cc",
+    ],
+    header_libs: [
+        "libbluetooth_headers",
+    ],
+    local_include_dirs: [
+        ".",
+    ],
+    shared_libs: [
+        "libbase",
+    ],
+    static_libs: [
+        "libbt-rootcanal",
+        "libjsoncpp",
+    ],
+}
+
 // test-vendor unit tests for host
 cc_test_host {
     name: "rootcanal_test_host",
     defaults: [
+        "fluoride_common_options",
         "clang_file_coverage",
         "clang_coverage_bin",
     ],
+    // TODO(b/231993739): Reenable isolated:true by deleting the explicit disable below
+    isolated: false,
     srcs: [
         "test/async_manager_unittest.cc",
         "test/h4_parser_unittest.cc",
@@ -132,19 +185,15 @@
         "include",
     ],
     include_dirs: [
-        "packages/modules/Bluetooth/system",
         "packages/modules/Bluetooth/system/gd",
     ],
     shared_libs: [
-        "liblog",
+        "libbase",
     ],
     static_libs: [
         "libbt-rootcanal",
     ],
     cflags: [
-        "-Wall",
-        "-Wextra",
-        "-Werror",
         "-fvisibility=hidden",
         "-DLOG_NDEBUG=1",
     ],
@@ -167,13 +216,14 @@
         "libbluetooth_headers",
     ],
     shared_libs: [
-        "liblog",
-        "libbacktrace",
+        "libbase",
+        "libunwindstack",
     ],
     whole_static_libs: [
         "libbt-rootcanal",
     ],
     static_libs: [
+        "libc++fs",
         "libjsoncpp",
         "libprotobuf-cpp-lite",
         "libscriptedbeaconpayload-protos-lite",
@@ -213,6 +263,20 @@
     ],
 }
 
+genrule {
+    name: "RootCanalBrEdrBBGeneratedPackets_h",
+    tools: [
+        "bluetooth_packetgen",
+    ],
+    cmd: "$(location bluetooth_packetgen) --root_namespace=bredr_bb --include=packages/modules/Bluetooth/tools/rootcanal/packets --out=$(genDir) $(in)",
+    srcs: [
+        "packets/bredr_bb.pdl",
+    ],
+    out: [
+        "bredr_bb.h",
+    ],
+}
+
 // bt_vhci_forwarder in cuttlefish depends on this H4Packetizer implementation.
 cc_library_static {
     name: "h4_packetizer_lib",
@@ -225,7 +289,9 @@
         "model/hci/h4_parser.cc",
         "model/hci/hci_protocol.cc",
     ],
-
+    header_libs: [
+        "libbase_headers",
+    ],
     local_include_dirs: [
         "include",
     ],
@@ -233,11 +299,7 @@
         "include",
         ".",
     ],
-    generated_headers: [
-        "libbt_init_flags_bridge_header",
-    ],
     include_dirs: [
-        "packages/modules/Bluetooth/system",
         "packages/modules/Bluetooth/system/gd",
     ],
 }
diff --git a/tools/rootcanal/Cargo.lock b/tools/rootcanal/Cargo.lock
new file mode 100644
index 0000000..830506f
--- /dev/null
+++ b/tools/rootcanal/Cargo.lock
@@ -0,0 +1,535 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 3
+
+[[package]]
+name = "aho-corasick"
+version = "0.7.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e37cfd5e7657ada45f742d6e99ca5788580b5c529dc78faf11ece6dc702656f"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "ansi_term"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ee49baf6cb617b853aa8d93bf420db2383fab46d314482ca2803b40d5fde979b"
+dependencies = [
+ "winapi",
+]
+
+[[package]]
+name = "atty"
+version = "0.2.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d9b39be18770d11421cdb1b9947a45dd3f37e93092cbf377614828a319d5fee8"
+dependencies = [
+ "hermit-abi",
+ "libc",
+ "winapi",
+]
+
+[[package]]
+name = "autocfg"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d468802bab17cbc0cc575e9b053f41e72aa36bfa6b7f55e3529ffa43161b97fa"
+
+[[package]]
+name = "bindgen"
+version = "0.59.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2bd2a9a458e8f4304c52c43ebb0cfbd520289f8379a52e329a38afda99bf8eb8"
+dependencies = [
+ "bitflags",
+ "cexpr",
+ "clang-sys",
+ "clap",
+ "env_logger",
+ "lazy_static",
+ "lazycell",
+ "log",
+ "peeking_take_while",
+ "proc-macro2",
+ "quote",
+ "regex",
+ "rustc-hash",
+ "shlex",
+ "which",
+]
+
+[[package]]
+name = "bitflags"
+version = "1.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
+
+[[package]]
+name = "bt_packets"
+version = "0.0.1"
+dependencies = [
+ "bindgen",
+ "bytes",
+ "num-derive",
+ "num-traits",
+ "thiserror",
+ "walkdir",
+]
+
+[[package]]
+name = "bytes"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec8a7b6a70fde80372154c65702f00a0f56f3e1c36abbc6c440484be248856db"
+
+[[package]]
+name = "cexpr"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6fac387a98bb7c37292057cffc56d62ecb629900026402633ae9160df93a8766"
+dependencies = [
+ "nom",
+]
+
+[[package]]
+name = "cfg-if"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
+
+[[package]]
+name = "clang-sys"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "853eda514c284c2287f4bf20ae614f8781f40a81d32ecda6e91449304dfe077c"
+dependencies = [
+ "glob",
+ "libc",
+ "libloading",
+]
+
+[[package]]
+name = "clap"
+version = "2.33.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "37e58ac78573c40708d45522f0d80fa2f01cc4f9b4e2bf749807255454312002"
+dependencies = [
+ "ansi_term",
+ "atty",
+ "bitflags",
+ "strsim",
+ "textwrap",
+ "unicode-width",
+ "vec_map",
+]
+
+[[package]]
+name = "either"
+version = "1.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "90e5c1c8368803113bf0c9584fc495a58b86dc8a29edbf8fe877d21d9507e797"
+
+[[package]]
+name = "env_logger"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b2cf0344971ee6c64c31be0d530793fba457d322dfec2810c453d0ef228f9c3"
+dependencies = [
+ "atty",
+ "humantime",
+ "log",
+ "regex",
+ "termcolor",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.2.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4eb1a864a501629691edf6c15a593b7a51eebaa1e8468e9ddc623de7c9b58ec6"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "wasi",
+]
+
+[[package]]
+name = "glob"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b919933a397b79c37e33b77bb2aa3dc8eb6e165ad809e58ff75bc7db2e34574"
+
+[[package]]
+name = "hermit-abi"
+version = "0.1.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "322f4de77956e22ed0e5032c359a0f1273f1f7f0d79bfa3b8ffbc730d7fbcc5c"
+
+[[package]]
+name = "humantime"
+version = "2.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9a3a5bfb195931eeb336b2a7b4d761daec841b97f947d34394601737a7bba5e4"
+
+[[package]]
+name = "lazy_static"
+version = "1.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646"
+
+[[package]]
+name = "lazycell"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "830d08ce1d1d941e6b30645f1a0eb5643013d835ce3779a5fc208261dbe10f55"
+
+[[package]]
+name = "libc"
+version = "0.2.132"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8371e4e5341c3a96db127eb2465ac681ced4c433e01dd0e938adbef26ba93ba5"
+
+[[package]]
+name = "libloading"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6f84d96438c15fcd6c3f244c8fce01d1e2b9c6b5623e9c711dc9286d8fc92d6a"
+dependencies = [
+ "cfg-if",
+ "winapi",
+]
+
+[[package]]
+name = "lmp"
+version = "0.1.0"
+dependencies = [
+ "bt_packets",
+ "bytes",
+ "num-bigint",
+ "num-derive",
+ "num-integer",
+ "num-traits",
+ "paste",
+ "pin-utils",
+ "rand",
+ "thiserror",
+]
+
+[[package]]
+name = "log"
+version = "0.4.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "51b9bbe6c47d51fc3e1a9b945965946b4c44142ab8792c50835a980d362c2710"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "memchr"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2dffe52ecf27772e601905b7522cb4ef790d2cc203488bbd0e2fe85fcb74566d"
+
+[[package]]
+name = "minimal-lexical"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "68354c5c6bd36d73ff3feceb05efa59b6acb7626617f4962be322a825e61f79a"
+
+[[package]]
+name = "nom"
+version = "7.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a8903e5a29a317527874d0402f867152a3d21c908bb0b933e416c65e301d4c36"
+dependencies = [
+ "memchr",
+ "minimal-lexical",
+]
+
+[[package]]
+name = "num-bigint"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f93ab6289c7b344a8a9f60f88d80aa20032336fe78da341afc91c8a2341fc75f"
+dependencies = [
+ "autocfg",
+ "num-integer",
+ "num-traits",
+]
+
+[[package]]
+name = "num-derive"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "876a53fff98e03a936a674b29568b0e605f06b29372c2489ff4de23f1949743d"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "num-integer"
+version = "0.1.45"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "225d3389fb3509a24c93f5c29eb6bde2586b98d9f016636dff58d7c6f7569cd9"
+dependencies = [
+ "autocfg",
+ "num-traits",
+]
+
+[[package]]
+name = "num-traits"
+version = "0.2.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9a64b1ec5cda2586e284722486d802acf1f7dbdc623e2bfc57e65ca1cd099290"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
+name = "once_cell"
+version = "1.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "074864da206b4973b84eb91683020dbefd6a8c3f0f38e054d93954e891935e4e"
+
+[[package]]
+name = "paste"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c5d65c4d95931acda4498f675e332fcbdc9a06705cd07086c510e9b6009cd1c1"
+
+[[package]]
+name = "peeking_take_while"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "19b17cddbe7ec3f8bc800887bab5e717348c95ea2ca0b1bf0837fb964dc67099"
+
+[[package]]
+name = "pin-utils"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b870d8c151b6f2fb93e84a13146138f05d02ed11c7e7c54f8826aaaf7c9f184"
+
+[[package]]
+name = "ppv-lite86"
+version = "0.2.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac74c624d6b2d21f425f752262f42188365d7b8ff1aff74c82e45136510a4857"
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.44"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7bd7356a8122b6c4a24a82b278680c73357984ca2fc79a0f9fa6dea7dced7c58"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3d0b9745dc2debf507c8422de05d7226cc1f0644216dfdfead988f9b1ab32a7"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "rand"
+version = "0.8.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "34af8d1a0e25924bc5b7c43c079c942339d8f0a8b57c39049bef581b46327404"
+dependencies = [
+ "libc",
+ "rand_chacha",
+ "rand_core",
+]
+
+[[package]]
+name = "rand_chacha"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6c10a63a0fa32252be49d21e7709d4d4baf8d231c2dbce1eaa8141b9b127d88"
+dependencies = [
+ "ppv-lite86",
+ "rand_core",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.6.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c"
+dependencies = [
+ "getrandom",
+]
+
+[[package]]
+name = "regex"
+version = "1.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4c4eb3267174b8c6c2f654116623910a0fef09c4753f8dd83db29c48a0df988b"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-syntax",
+]
+
+[[package]]
+name = "regex-syntax"
+version = "0.6.27"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a3f87b73ce11b1619a3c6332f45341e0047173771e8b8b73f87bfeefb7b56244"
+
+[[package]]
+name = "rustc-hash"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "08d43f7aa6b08d49f382cde6a7982047c3426db949b1424bc4b7ec9ae12c6ce2"
+
+[[package]]
+name = "same-file"
+version = "1.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "93fc1dc3aaa9bfed95e02e6eadabb4baf7e3078b0bd1b4d7b6b0b68378900502"
+dependencies = [
+ "winapi-util",
+]
+
+[[package]]
+name = "shlex"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "43b2853a4d09f215c24cc5489c992ce46052d359b5109343cbafbf26bc62f8a3"
+
+[[package]]
+name = "strsim"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ea5119cdb4c55b55d432abb513a0429384878c15dde60cc77b1c99de1a95a6a"
+
+[[package]]
+name = "syn"
+version = "1.0.101"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e90cde112c4b9690b8cbe810cba9ddd8bc1d7472e2cae317b69e9438c1cba7d2"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "termcolor"
+version = "1.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2dfed899f0eb03f32ee8c6a0aabdb8a7949659e3466561fc0adf54e26d88c5f4"
+dependencies = [
+ "winapi-util",
+]
+
+[[package]]
+name = "textwrap"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d326610f408c7a4eb6f51c37c330e496b08506c9457c9d34287ecc38809fb060"
+dependencies = [
+ "unicode-width",
+]
+
+[[package]]
+name = "thiserror"
+version = "1.0.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f5f6586b7f764adc0231f4c79be7b920e766bb2f3e51b3661cdb263828f19994"
+dependencies = [
+ "thiserror-impl",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "1.0.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "12bafc5b54507e0149cdf1b145a5d80ab80a90bcd9275df43d4fff68460f6c21"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dcc811dc4066ac62f84f11307873c4850cb653bfa9b1719cee2bd2204a4bc5dd"
+
+[[package]]
+name = "unicode-width"
+version = "0.1.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c0edd1e5b14653f783770bce4a4dabb4a5108a5370a5f5d8cfe8710c361f6c8b"
+
+[[package]]
+name = "vec_map"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f1bddf1187be692e79c5ffeab891132dfb0f236ed36a43c7ed39f1165ee20191"
+
+[[package]]
+name = "walkdir"
+version = "2.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "808cf2735cd4b6866113f648b791c6adc5714537bc222d9347bb203386ffda56"
+dependencies = [
+ "same-file",
+ "winapi",
+ "winapi-util",
+]
+
+[[package]]
+name = "wasi"
+version = "0.11.0+wasi-snapshot-preview1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423"
+
+[[package]]
+name = "which"
+version = "4.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1c831fbbee9e129a8cf93e7747a82da9d95ba8e16621cae60ec2cdc849bacb7b"
+dependencies = [
+ "either",
+ "libc",
+ "once_cell",
+]
+
+[[package]]
+name = "winapi"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
+dependencies = [
+ "winapi-i686-pc-windows-gnu",
+ "winapi-x86_64-pc-windows-gnu",
+]
+
+[[package]]
+name = "winapi-i686-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
+
+[[package]]
+name = "winapi-util"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "70ec6ce85bb158151cae5e5c87f95a8e97d2c0c4b001223f33a334e3ce5de178"
+
+[[package]]
+name = "winapi-x86_64-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
diff --git a/tools/rootcanal/Cargo.toml b/tools/rootcanal/Cargo.toml
new file mode 100644
index 0000000..d734d14
--- /dev/null
+++ b/tools/rootcanal/Cargo.toml
@@ -0,0 +1,20 @@
+#
+#  Copyright 2022 Google, Inc.
+#
+#  Licensed under the Apache License, Version 2.0 (the "License");
+#  you may not use this file except in compliance with the License.
+#  You may obtain a copy of the License at:
+#
+#  http://www.apache.org/licenses/LICENSE-2.0
+#
+#  Unless required by applicable law or agreed to in writing, software
+#  distributed under the License is distributed on an "AS IS" BASIS,
+#  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#  See the License for the specific language governing permissions and
+#  limitations under the License.
+
+[workspace]
+
+members = [
+  "lmp",
+]
diff --git a/tools/rootcanal/OWNERS b/tools/rootcanal/OWNERS
new file mode 100644
index 0000000..f6a2eac
--- /dev/null
+++ b/tools/rootcanal/OWNERS
@@ -0,0 +1,5 @@
+# Reviewers for /tools/rootcanal
+
+henrichataing@google.com
+licorne@google.com
+mylesgw@google.com
diff --git a/tools/rootcanal/README.md b/tools/rootcanal/README.md
new file mode 100644
index 0000000..a73033a
--- /dev/null
+++ b/tools/rootcanal/README.md
@@ -0,0 +1,57 @@
+# RootCanal
+
+RootCanal is a virtual Bluetooth Controller.
+Its goals include, but are not limited to: Bluetooth Testing and Emulation.
+
+## Usage
+
+RootCanal is usable:
+- With the Cuttlefish Virtual Device.
+- As a Host standalone binary.
+- As a Bluetooth HAL.
+- As a library.
+
+### Cuttlefish Virtual Device
+
+Cuttlefish enables RootCanal by default, refer to the Cuttlefish documentation
+for more informations
+
+### Host standalone binary
+
+```bash
+m root-canal # Build RootCanal
+out/host/linux-x86/bin/root-canal # Run RootCanal
+```
+
+Note: You can also find a prebuilt version inside [cvd-host_package.tar.gz from Android CI][cvd-host_package]
+
+[cvd-host_package]: https://ci.android.com/builds/latest/branches/aosp-master/targets/aosp_cf_x86_64_phone-userdebug/view/cvd-host_package.tar.gz
+
+RootCanal when run as a host tool, exposes 4 ports by default:
+- 6401: Test channel port
+- 6402: HCI port
+- 6403: BR_EDR Phy port
+- 6404: LE Phy port
+
+### Bluetooth HAL
+
+A HAL using RootCanal is available as `android.hardware.bluetooth@1.1-service.sim`
+
+## Channels
+
+### HCI Channel
+
+The HCI channel uses the standard Bluetooth UART transport protocol (also known as H4) over TCP.
+You can refer to Vol 4, Part A, 2 of the Bluetooth Core Specification for more information.
+Each connection on the HCI channel creates a new virtual controller.
+
+### Test Channel
+
+The test channel uses a simple custom protocol to send test commands to RootCanal.
+You can connect to it using [scripts/test_channel.py](scripts/test_channel.py).
+
+### Phy Channels
+
+The physical channels uses a custom protocol described in [packets/link_layer_packets.pdl](packets/link_layer_packets.pdl)
+with a custom framing.
+**Warning:** The protocol can change in backward incompatible ways, be careful when depending on it.
diff --git a/tools/rootcanal/data/Android.bp b/tools/rootcanal/data/Android.bp
deleted file mode 100644
index 7a634af..0000000
--- a/tools/rootcanal/data/Android.bp
+++ /dev/null
@@ -1,22 +0,0 @@
-package {
-    // See: http://go/android-license-faq
-    // A large-scale-change added 'default_applicable_licenses' to import
-    // all of the 'license_kinds' from "system_bt_license"
-    // to get the below license kinds:
-    //   SPDX-license-identifier-Apache-2.0
-    default_applicable_licenses: ["system_bt_license"],
-}
-
-prebuilt_etc_host {
-    name: "controller_properties.json",
-    src: "controller_properties.json",
-    sub_dir: "rootcanal/data",
-}
-
-prebuilt_etc {
-    name: "bt_controller_properties",
-    src: "controller_properties.json",
-    vendor: true,
-    filename_from_src: true,
-    sub_dir: "bluetooth",
-}
diff --git a/tools/rootcanal/data/controller_properties.json b/tools/rootcanal/data/controller_properties.json
deleted file mode 100644
index 814efd3..0000000
--- a/tools/rootcanal/data/controller_properties.json
+++ /dev/null
@@ -1,14 +0,0 @@
-{
-  "AclDataPacketSize": "1024",
-  "EncryptionKeySize": "10",
-  "ScoDataPacketSize": "255",
-  "NumAclDataPackets": "10",
-  "NumScoDataPackets": "10",
-  "Version": "4",
-  "Revision": "0",
-  "LmpPalVersion": "0",
-  "ManufacturerName": "0",
-  "LmpPalSubversion": "0",
-  "MaximumPageNumber": "0",
-  "BdAddress": "123456"
-}
diff --git a/tools/rootcanal/desktop/root_canal_main.cc b/tools/rootcanal/desktop/root_canal_main.cc
index 543a880..eba9e0a 100644
--- a/tools/rootcanal/desktop/root_canal_main.cc
+++ b/tools/rootcanal/desktop/root_canal_main.cc
@@ -13,17 +13,23 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 //
-#include <backtrace/Backtrace.h>
-#include <backtrace/backtrace_constants.h>
+
+// clang-format off
+// This needs to be included before Backtrace.h to avoid a redefinition
+// of DISALLOW_COPY_AND_ASSIGN
+#include "log.h"
+// clang-format on
+
 #include <client/linux/handler/exception_handler.h>
 #include <gflags/gflags.h>
+#include <unwindstack/AndroidUnwinder.h>
 
 #include <future>
+#include <optional>
 
 #include "model/setup/async_manager.h"
 #include "net/posix/posix_async_socket_connector.h"
 #include "net/posix/posix_async_socket_server.h"
-#include "os/log.h"
 #include "test_environment.h"
 
 using ::android::bluetooth::root_canal::TestEnvironment;
@@ -35,6 +41,8 @@
               "controller_properties.json file path");
 DEFINE_string(default_commands_file, "",
               "commands file which root-canal runs it as default");
+DEFINE_bool(enable_hci_sniffer, false, "enable hci sniffer");
+DEFINE_bool(enable_baseband_sniffer, false, "enable baseband sniffer");
 
 constexpr uint16_t kTestPort = 6401;
 constexpr uint16_t kHciServerPort = 6402;
@@ -47,7 +55,7 @@
 
 bool crash_callback(const void* crash_context, size_t crash_context_size,
                     void* /* context */) {
-  pid_t tid = BACKTRACE_CURRENT_THREAD;
+  std::optional<pid_t> tid;
   if (crash_context_size >=
       sizeof(google_breakpad::ExceptionHandler::CrashContext)) {
     auto* ctx =
@@ -60,19 +68,15 @@
   } else {
     LOG_ERROR("Process crashed, signal: unknown, tid: unknown");
   }
-  std::unique_ptr<Backtrace> backtrace(
-      Backtrace::Create(BACKTRACE_CURRENT_PROCESS, tid));
-  if (backtrace == nullptr) {
-    LOG_ERROR("Failed to create backtrace object");
-    return false;
-  }
-  if (!backtrace->Unwind(0)) {
-    LOG_ERROR("backtrace->Unwind failed");
+  unwindstack::AndroidLocalUnwinder unwinder;
+  unwindstack::AndroidUnwinderData data;
+  if (!unwinder.Unwind(tid, data)) {
+    LOG_ERROR("Unwind failed");
     return false;
   }
   LOG_ERROR("Backtrace:");
-  for (size_t i = 0; i < backtrace->NumFrames(); i++) {
-    LOG_ERROR("%s", backtrace->FormatFrameData(i).c_str());
+  for (const auto& frame : data.frames) {
+    LOG_ERROR("%s", unwinder.FormatFrame(frame).c_str());
   }
   return true;
 }
@@ -85,6 +89,7 @@
   eh.set_crash_handler(crash_callback);
 
   gflags::ParseCommandLineFlags(&argc, &argv, true);
+  android::base::InitLogging(argv);
 
   LOG_INFO("main");
   uint16_t test_port = kTestPort;
@@ -125,7 +130,8 @@
       std::make_shared<PosixAsyncSocketServer>(link_server_port, &am),
       std::make_shared<PosixAsyncSocketServer>(link_ble_server_port, &am),
       std::make_shared<PosixAsyncSocketConnector>(&am),
-      FLAGS_controller_properties_file, FLAGS_default_commands_file);
+      FLAGS_controller_properties_file, FLAGS_default_commands_file,
+      FLAGS_enable_hci_sniffer, FLAGS_enable_baseband_sniffer);
   std::promise<void> barrier;
   std::future<void> barrier_future = barrier.get_future();
   root_canal.initialize(std::move(barrier));
diff --git a/tools/rootcanal/desktop/test_environment.cc b/tools/rootcanal/desktop/test_environment.cc
index 261dc43..56ca6fc 100644
--- a/tools/rootcanal/desktop/test_environment.cc
+++ b/tools/rootcanal/desktop/test_environment.cc
@@ -16,22 +16,27 @@
 
 #include "test_environment.h"
 
+#include <filesystem>  // for exists
 #include <type_traits>  // for remove_extent_t
 #include <utility>      // for move
 #include <vector>       // for vector
 
+#include "log.h"  // for LOG_INFO, LOG_ERROR, LOG_WARN
+#include "model/devices/baseband_sniffer.h"
 #include "model/devices/link_layer_socket_device.h"  // for LinkLayerSocketDevice
+#include "model/hci/hci_sniffer.h"                   // for HciSniffer
 #include "model/hci/hci_socket_transport.h"          // for HciSocketTransport
 #include "net/async_data_channel.h"                  // for AsyncDataChannel
 #include "net/async_data_channel_connector.h"  // for AsyncDataChannelConnector
-#include "os/log.h"  // for LOG_INFO, LOG_ERROR, LOG_WARN
 
 namespace android {
 namespace bluetooth {
 namespace root_canal {
 
 using rootcanal::AsyncTaskId;
+using rootcanal::BaseBandSniffer;
 using rootcanal::HciDevice;
+using rootcanal::HciSniffer;
 using rootcanal::HciSocketTransport;
 using rootcanal::LinkLayerSocketDevice;
 using rootcanal::TaskCallback;
@@ -59,13 +64,35 @@
   SetUpHciServer([this](std::shared_ptr<AsyncDataChannel> socket,
                         AsyncDataChannelServer* srv) {
     auto transport = HciSocketTransport::Create(socket);
-    test_model_.AddHciConnection(
-        HciDevice::Create(transport, controller_properties_file_));
+    if (enable_hci_sniffer_) {
+      transport = HciSniffer::Create(transport);
+    }
+    auto device = HciDevice::Create(transport, controller_properties_file_);
+    test_model_.AddHciConnection(device);
+    if (enable_hci_sniffer_) {
+      auto filename = device->GetAddress().ToString() + ".pcap";
+      for (auto i = 0; std::filesystem::exists(filename); i++) {
+        filename =
+            device->GetAddress().ToString() + "_" + std::to_string(i) + ".pcap";
+      }
+      auto file = std::make_shared<std::ofstream>(filename, std::ios::binary);
+      std::static_pointer_cast<HciSniffer>(transport)->SetOutputStream(file);
+    }
     srv->StartListening();
   });
   SetUpLinkLayerServer();
   SetUpLinkBleLayerServer();
 
+  if (enable_baseband_sniffer_) {
+    std::string filename = "baseband.pcap";
+    for (auto i = 0; std::filesystem::exists(filename); i++) {
+      filename = "baseband_" + std::to_string(i) + ".pcap";
+    }
+
+    test_model_.AddLinkLayerConnection(BaseBandSniffer::Create(filename),
+                                       Phy::Type::BR_EDR);
+  }
+
   LOG_INFO("%s: Finished", __func__);
 }
 
diff --git a/tools/rootcanal/desktop/test_environment.h b/tools/rootcanal/desktop/test_environment.h
index fd651e7..f8f67f9 100644
--- a/tools/rootcanal/desktop/test_environment.h
+++ b/tools/rootcanal/desktop/test_environment.h
@@ -54,7 +54,9 @@
                   std::shared_ptr<AsyncDataChannelServer> link_ble_server_port,
                   std::shared_ptr<AsyncDataChannelConnector> connector,
                   const std::string& controller_properties_file = "",
-                  const std::string& default_commands_file = "")
+                  const std::string& default_commands_file = "",
+                  bool enable_hci_sniffer = false,
+                  bool enable_baseband_sniffer = false)
       : test_socket_server_(test_port),
         hci_socket_server_(hci_server_port),
         link_socket_server_(link_server_port),
@@ -62,6 +64,8 @@
         connector_(connector),
         controller_properties_file_(controller_properties_file),
         default_commands_file_(default_commands_file),
+        enable_hci_sniffer_(enable_hci_sniffer),
+        enable_baseband_sniffer_(enable_baseband_sniffer),
         controller_(std::make_shared<rootcanal::DualModeController>(
             controller_properties_file)) {}
 
@@ -78,6 +82,8 @@
   std::shared_ptr<AsyncDataChannelConnector> connector_;
   std::string controller_properties_file_;
   std::string default_commands_file_;
+  bool enable_hci_sniffer_;
+  bool enable_baseband_sniffer_;
   bool test_channel_open_{false};
   std::promise<void> barrier_;
 
diff --git a/tools/rootcanal/include/log.h b/tools/rootcanal/include/log.h
new file mode 100644
index 0000000..f301a32
--- /dev/null
+++ b/tools/rootcanal/include/log.h
@@ -0,0 +1,30 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include <android-base/format.h>
+#include <android-base/logging.h>
+
+// FIXME: remove those shims
+#define LOG_DEBUG(...) LOG(DEBUG) << fmt::sprintf(__VA_ARGS__)
+#define LOG_INFO(...) LOG(INFO) << fmt::sprintf(__VA_ARGS__)
+#define LOG_WARN(...) LOG(WARNING) << fmt::sprintf(__VA_ARGS__)
+#define LOG_ERROR(...) LOG(ERROR) << fmt::sprintf(__VA_ARGS__)
+#define LOG_ALWAYS_FATAL(...) LOG(FATAL) << fmt::sprintf(__VA_ARGS__)
+
+#define ASSERT(cond) CHECK(cond)
+#define ASSERT_LOG(cond, ...) CHECK(cond) << fmt::sprintf(__VA_ARGS__)
diff --git a/tools/rootcanal/include/os/log.h b/tools/rootcanal/include/os/log.h
new file mode 100644
index 0000000..2fbb070
--- /dev/null
+++ b/tools/rootcanal/include/os/log.h
@@ -0,0 +1,20 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+// This header is currently needed for hci_packets.h
+// FIXME: Change hci_packets.h to not depend on os/log.h
+//        and remove this.
+#include "include/log.h"
diff --git a/tools/rootcanal/include/pcap.h b/tools/rootcanal/include/pcap.h
new file mode 100644
index 0000000..a86e52f
--- /dev/null
+++ b/tools/rootcanal/include/pcap.h
@@ -0,0 +1,61 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include <chrono>
+#include <cstdint>
+#include <limits>
+#include <ostream>
+
+namespace rootcanal::pcap {
+
+using namespace std::literals;
+
+static void WriteHeader(std::ostream& output, uint32_t linktype) {
+  // https://tools.ietf.org/id/draft-gharris-opsawg-pcap-00.html#name-file-header
+  uint32_t magic_number = 0xa1b2c3d4;
+  uint16_t major_version = 2;
+  uint16_t minor_version = 4;
+  uint32_t reserved1 = 0;
+  uint32_t reserved2 = 0;
+  uint32_t snaplen = std::numeric_limits<uint32_t>::max();
+
+  output.write((char*)&magic_number, 4);
+  output.write((char*)&major_version, 2);
+  output.write((char*)&minor_version, 2);
+  output.write((char*)&reserved1, 4);
+  output.write((char*)&reserved2, 4);
+  output.write((char*)&snaplen, 4);
+  output.write((char*)&linktype, 4);
+}
+
+static void WriteRecordHeader(std::ostream& output, uint32_t length) {
+  auto time = std::chrono::system_clock::now().time_since_epoch();
+
+  // https://tools.ietf.org/id/draft-gharris-opsawg-pcap-00.html#name-packet-record
+  uint32_t seconds = time / 1s;
+  uint32_t microseconds = (time % 1s) / 1ms;
+  uint32_t captured_packet_length = length;
+  uint32_t original_packet_length = length;
+
+  output.write((char*)&seconds, 4);
+  output.write((char*)&microseconds, 4);
+  output.write((char*)&captured_packet_length, 4);
+  output.write((char*)&original_packet_length, 4);
+}
+
+}  // namespace rootcanal::pcap
diff --git a/tools/rootcanal/lmp/Android.bp b/tools/rootcanal/lmp/Android.bp
new file mode 100644
index 0000000..e438e6a
--- /dev/null
+++ b/tools/rootcanal/lmp/Android.bp
@@ -0,0 +1,68 @@
+package {
+    // See: http://go/android-license-faq
+    // A large-scale-change added 'default_applicable_licenses' to import
+    // all of the 'license_kinds' from "system_bt_license"
+    // to get the below license kinds:
+    //   SPDX-license-identifier-Apache-2.0
+    default_applicable_licenses: ["system_bt_license"],
+}
+
+rust_ffi {
+    name: "liblmp",
+    host_supported: true,
+    vendor_available : true,
+    crate_name: "lmp",
+    srcs: [
+        "src/lib.rs",
+        ":LmpGeneratedPackets_rust",
+    ],
+    edition: "2018",
+    proc_macros: ["libnum_derive"],
+    rustlibs: [
+        "libbt_packets_nonapex",
+        "libbytes",
+        "libnum_bigint",
+        "libnum_integer",
+        "libnum_traits",
+        "libthiserror",
+        "libpin_utils",
+        "librand",
+    ],
+    include_dirs: ["include"],
+}
+
+genrule {
+    name: "LmpGeneratedPackets_rust",
+    tools: [
+        "bluetooth_packetgen",
+    ],
+    cmd: "$(location bluetooth_packetgen) --include=packages/modules/Bluetooth/tools/rootcanal/lmp  --out=$(genDir) $(in) --rust",
+    srcs: [
+        "lmp_packets.pdl",
+    ],
+    out: [
+        "lmp_packets.rs",
+    ],
+}
+
+rust_test_host {
+    name: "liblmp_tests",
+    crate_name: "lmp",
+    srcs: [
+        "src/lib.rs",
+        ":LmpGeneratedPackets_rust",
+    ],
+    auto_gen_config: true,
+    edition: "2018",
+    proc_macros: ["libnum_derive", "libpaste"],
+    rustlibs: [
+        "libbt_packets",
+        "libbytes",
+        "libnum_bigint",
+        "libnum_integer",
+        "libnum_traits",
+        "libthiserror",
+        "libpin_utils",
+        "librand",
+    ],
+}
diff --git a/tools/rootcanal/lmp/Cargo.toml b/tools/rootcanal/lmp/Cargo.toml
new file mode 100644
index 0000000..22f3986
--- /dev/null
+++ b/tools/rootcanal/lmp/Cargo.toml
@@ -0,0 +1,36 @@
+#
+#  Copyright 2021 Google, Inc.
+#
+#  Licensed under the Apache License, Version 2.0 (the "License");
+#  you may not use this file except in compliance with the License.
+#  You may obtain a copy of the License at:
+#
+#  http://www.apache.org/licenses/LICENSE-2.0
+#
+#  Unless required by applicable law or agreed to in writing, software
+#  distributed under the License is distributed on an "AS IS" BASIS,
+#  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#  See the License for the specific language governing permissions and
+#  limitations under the License.
+
+[package]
+name = "lmp"
+version = "0.1.0"
+edition = "2018"
+build="build.rs"
+
+[dependencies]
+bytes = "1.0.1"
+num-bigint = "0.4.3"
+num-derive = "0.3.3"
+num-integer = "0.1.45"
+num-traits = "0.2.14"
+paste = "1.0.4"
+pin-utils = "0.1.0"
+rand = "0.8.3"
+thiserror = "1.0.23"
+bt_packets = { path = "../../../system/gd/rust/packets/" }
+
+[lib]
+path="src/lib.rs"
+crate-type = ["staticlib"]
diff --git a/tools/rootcanal/lmp/build.rs b/tools/rootcanal/lmp/build.rs
new file mode 100644
index 0000000..a7eb2bc
--- /dev/null
+++ b/tools/rootcanal/lmp/build.rs
@@ -0,0 +1,69 @@
+//
+//  Copyright 2022 Google, Inc.
+//
+//  Licensed under the Apache License, Version 2.0 (the "License");
+//  you may not use this file except in compliance with the License.
+//  You may obtain a copy of the License at:
+//
+//  http://www.apache.org/licenses/LICENSE-2.0
+//
+//  Unless required by applicable law or agreed to in writing, software
+//  distributed under the License is distributed on an "AS IS" BASIS,
+//  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+//  See the License for the specific language governing permissions and
+//  limitations under the License.
+
+use std::env;
+use std::path::{Path, PathBuf};
+use std::process::Command;
+
+fn main() {
+    let packets_prebuilt = match env::var("LMP_PACKETS_PREBUILT") {
+        Ok(dir) => PathBuf::from(dir),
+        Err(_) => PathBuf::from("lmp_packets.rs"),
+    };
+    if Path::new(packets_prebuilt.as_os_str()).exists() {
+        let out_dir = PathBuf::from(env::var("OUT_DIR").unwrap());
+        let outputted = out_dir.join("lmp_packets.rs");
+        std::fs::copy(
+            packets_prebuilt.as_os_str().to_str().unwrap(),
+            out_dir.join(outputted.file_name().unwrap()).as_os_str().to_str().unwrap(),
+        )
+        .unwrap();
+    } else {
+        generate_packets();
+    }
+}
+
+fn generate_packets() {
+    let out_dir = PathBuf::from(env::var("OUT_DIR").unwrap());
+
+    // Find the packetgen tool. Expecting it at CARGO_HOME/bin
+    let packetgen = match env::var("CARGO_HOME") {
+        Ok(dir) => PathBuf::from(dir).join("bin").join("bluetooth_packetgen"),
+        Err(_) => PathBuf::from("bluetooth_packetgen"),
+    };
+
+    if !Path::new(packetgen.as_os_str()).exists() {
+        panic!(
+            "Unable to locate bluetooth packet generator:{:?}",
+            packetgen.as_os_str().to_str().unwrap()
+        );
+    }
+
+    println!("cargo:rerun-if-changed=lmp_packets.pdl");
+    let output = Command::new(packetgen.as_os_str().to_str().unwrap())
+        .arg("--out=".to_owned() + out_dir.as_os_str().to_str().unwrap())
+        .arg("--include=.")
+        .arg("--rust")
+        .arg("lmp_packets.pdl")
+        .output()
+        .unwrap();
+
+    println!(
+        "Status: {}, stdout: {}, stderr: {}",
+        output.status,
+        String::from_utf8_lossy(output.stdout.as_slice()),
+        String::from_utf8_lossy(output.stderr.as_slice())
+    );
+}
diff --git a/tools/rootcanal/lmp/cbindgen.toml b/tools/rootcanal/lmp/cbindgen.toml
new file mode 100644
index 0000000..72866f6
--- /dev/null
+++ b/tools/rootcanal/lmp/cbindgen.toml
@@ -0,0 +1,11 @@
+# For documentation, see: https://github.com/eqrion/cbindgen/blob/master/docs.md
+
+language = "C++"
+pragma_once = true
+autogen_warning = '''
+// This file is autogenerated by:
+//   cbindgen --config cbindgen.toml src/ffi.rs -o include/lmp.h
+// Don't modify manually.
+'''
+sys_includes = ["stdint.h"]
+no_includes = true
diff --git a/tools/rootcanal/lmp/include/lmp.h b/tools/rootcanal/lmp/include/lmp.h
new file mode 100644
index 0000000..40c2ec5
--- /dev/null
+++ b/tools/rootcanal/lmp/include/lmp.h
@@ -0,0 +1,92 @@
+#pragma once
+
+// This file is autogenerated by:
+//   cbindgen --config cbindgen.toml src/ffi.rs -o include/lmp.h
+// Don't modify manually.
+
+#include <stdint.h>
+
+/// Link Manager callbacks
+struct LinkManagerOps {
+  void* user_pointer;
+  uint16_t (*get_handle)(void* user, const uint8_t (*address)[6]);
+  void (*get_address)(void* user, uint16_t handle, uint8_t (*result)[6]);
+  uint64_t (*extended_features)(void* user, uint8_t features_page);
+  void (*send_hci_event)(void* user, const uint8_t* data, uintptr_t len);
+  void (*send_lmp_packet)(void* user, const uint8_t (*to)[6],
+                          const uint8_t* data, uintptr_t len);
+};
+
+extern "C" {
+
+/// Create a new link manager instance
+/// # Arguments
+/// * `ops` - Function callbacks required by the link manager
+const LinkManager* link_manager_create(LinkManagerOps ops);
+
+/// Register a new link with a peer inside the link manager
+/// # Arguments
+/// * `lm` - link manager pointer
+/// * `peer` - peer address as array of 6 bytes
+/// # Safety
+/// - This should be called from the thread of creation
+/// - `lm` must be a valid pointer
+/// - `peer` must be valid for reads for 6 bytes
+bool link_manager_add_link(const LinkManager* lm, const uint8_t (*peer)[6]);
+
+/// Unregister a link with a peer inside the link manager
+/// Returns true if successful
+/// # Arguments
+/// * `lm` - link manager pointer
+/// * `peer` - peer address as array of 6 bytes
+/// # Safety
+/// - This should be called from the thread of creation
+/// - `lm` must be a valid pointer
+/// - `peer` must be valid for reads for 6 bytes
+bool link_manager_remove_link(const LinkManager* lm, const uint8_t (*peer)[6]);
+
+/// Run the Link Manager procedures
+/// # Arguments
+/// * `lm` - link manager pointer
+/// # Safety
+/// - This should be called from the thread of creation
+/// - `lm` must be a valid pointer
+void link_manager_tick(const LinkManager* lm);
+
+/// Process an HCI packet with the link manager
+/// Returns true if successful
+/// # Arguments
+/// * `lm` - link manager pointer
+/// * `data` - HCI packet data
+/// * `len` - HCI packet len
+/// # Safety
+/// - This should be called from the thread of creation
+/// - `lm` must be a valid pointer
+/// - `data` must be valid for reads of len `len`
+bool link_manager_ingest_hci(const LinkManager* lm, const uint8_t* data,
+                             uintptr_t len);
+
+/// Process an LMP packet from a peer with the link manager
+/// Returns true if successful
+/// # Arguments
+/// * `lm` - link manager pointer
+/// * `from` - Address of peer as array of 6 bytes
+/// * `data` - HCI packet data
+/// * `len` - HCI packet len
+/// # Safety
+/// - This should be called from the thread of creation
+/// - `lm` must be a valid pointers
+/// - `from` must be valid pointer for reads for 6 bytes
+/// - `data` must be valid for reads of len `len`
+bool link_manager_ingest_lmp(const LinkManager* lm, const uint8_t (*from)[6],
+                             const uint8_t* data, uintptr_t len);
+
+/// Deallocate the link manager instance
+/// # Arguments
+/// * `lm` - link manager pointer
+/// # Safety
+/// - This should be called from the thread of creation
+/// - `lm` must be a valid pointers and must not be reused afterwards
+void link_manager_destroy(const LinkManager* lm);
+
+}  // extern "C"
diff --git a/tools/rootcanal/lmp/lmp_packets.pdl b/tools/rootcanal/lmp/lmp_packets.pdl
new file mode 100644
index 0000000..64e0b1b
--- /dev/null
+++ b/tools/rootcanal/lmp/lmp_packets.pdl
@@ -0,0 +1,211 @@
+little_endian_packets
+
+enum Opcode : 7 {
+  NAME_REQ = 0x1,
+  NAME_RES = 0x2,
+  ACCEPTED = 0x3,
+  NOT_ACCEPTED = 0x4,
+  CLK_OFFSET_REQ = 0x5,
+  CLK_OFFSET_RES = 0x6,
+  DETACH = 0x7,
+  IN_RAND = 0x8,
+  COMB_KEY = 0x9,
+  UNIT_KEY = 10,
+  AU_RAND = 11,
+  SRES = 12,
+  TEMP_RAND = 13,
+  TEMP_KEY = 14,
+  ENCRYPTION_MODE_REQ = 15,
+  ENCRYPTION_KEY_SIZE_REQ = 16,
+  START_ENCRYPTION_REQ = 17,
+  STOP_ENCRYPTION_REQ = 18,
+  SWITCH_REQ = 19,
+  HOLD = 20,
+  HOLD_REQ = 21,
+  SNIFF_REQ = 23,
+  UNSNIFF_REQ = 24,
+  INCR_POWER_REQ = 31,
+  DECR_POWER_REQ = 32,
+  MAX_POWER = 33,
+  MIN_POWER = 34,
+  AUTO_RATE = 35,
+  PREFERRED_RATE = 36,
+  VERSION_REQ = 37,
+  VERSION_RES = 38,
+  FEATURES_REQ = 39,
+  FEATURES_RES = 40,
+  QUALITY_OF_SERVICE = 41,
+  QUALITY_OF_SERVICE_REQ = 42,
+  SCO_LINK_REQ = 43,
+  REMOVE_SCO_LINK_REQ = 44,
+  MAX_SLOT = 45,
+  MAX_SLOT_REQ = 46,
+  TIMING_ACCURACY_REQ = 47,
+  TIMING_ACCURACY_RES = 48,
+  SETYP_COMPLETE = 49,
+  USE_SEMI_PERMANENT_KEY = 50,
+  HOST_CONNECTION_REQ = 51,
+  SLOT_OFFSET = 52,
+  PAGE_MODE_REQ = 53,
+  PAGE_SCAN_MODE_REQ = 54,
+  SUPERVISION_TIMEOUT = 55,
+  TEST_ACTIVATE = 56,
+  TEST_CONTROL = 57,
+  ENCRYPTION_KEY_SIZE_MASK_REQ = 58,
+  ENCRYPTION_KEY_SIZE_MASK_RES = 59,
+  SET_AFH = 60,
+  ENCAPSULATED_HEADER = 61,
+  ENCAPSULATED_PAYLOAD = 62,
+  SIMPLE_PAIRING_CONFIRM = 63,
+  SIMPLE_PAIRING_NUMBER = 64,
+  DHKEY_CHECK = 65,
+  PAUSE_ENCRYPTION_AES_REQ = 66,
+  ESCAPED = 0x7f,
+}
+
+enum ExtendedOpcode : 8 {
+  ACCEPTED = 0x1,
+  NOT_ACCEPTED = 0x2,
+  FEATURES_REQ = 0x3,
+  FEATURES_RES = 0x4,
+  CLK_ADJ = 0x5,
+  CLK_ADJ_ACK = 0x6,
+  CLK_ADJ_REQ = 0x7,
+  PACKET_TYPE_TABLE_REQ = 11,
+  ESCO_LINK_REQ = 12,
+  REMOVE_ESCO_LINK_REQ = 13,
+  CHANNEL_CLASSIFICATION_REQ = 16,
+  CHANNEL_CLASSIFICATION = 17,
+  SNIFF_SUBRATING_REQ = 21,
+  SNIFF_SUBRATING_RES = 22,
+  PAUSE_ENCRYPTION_REQ = 23,
+  RESUME_ENCRYPTION_REQ = 24,
+  IO_CAPABILITY_REQ = 25,
+  IO_CAPABILITY_RES = 26,
+  NUMERIC_COMPARAISON_FAILED = 27,
+  PASSKEY_FAILED = 28,
+  OOB_FAILED = 29,
+  KEYPRESS_NOTIFICATION = 30,
+  POWER_CONTROL_REQ = 31,
+  POWER_CONTROL_RES = 32,
+  PING_REQ = 33,
+  PING_RES = 34,
+  SAM_SET_TYPE0 = 35,
+  SAM_DEFINE_MAP = 36,
+  SAM_SWITCH = 37,
+}
+
+packet Packet {
+  transaction_id: 1,
+  opcode: Opcode,
+  _payload_,
+}
+
+packet ExtendedPacket : Packet(opcode = ESCAPED) {
+  extended_opcode: ExtendedOpcode,
+  _payload_,
+}
+
+packet Accepted : Packet(opcode = ACCEPTED) {
+  accepted_opcode: Opcode,
+  _fixed_ = 0 : 1,
+}
+
+packet NotAccepted : Packet(opcode = NOT_ACCEPTED) {
+  not_accepted_opcode: Opcode,
+  _fixed_ = 0 : 1,
+  error_code: 8,
+}
+
+packet AcceptedExt : ExtendedPacket(extended_opcode = ACCEPTED) {
+  accepted_opcode: ExtendedOpcode,
+}
+
+packet NotAcceptedExt : ExtendedPacket(extended_opcode = NOT_ACCEPTED) {
+  not_accepted_opcode: ExtendedOpcode,
+  error_code: 8,
+}
+
+packet IoCapabilityReq : ExtendedPacket(extended_opcode = IO_CAPABILITY_REQ) {
+  io_capabilities: 8,
+  oob_authentication_data: 8,
+  authentication_requirement: 8,
+}
+
+packet IoCapabilityRes : ExtendedPacket(extended_opcode = IO_CAPABILITY_RES) {
+  io_capabilities: 8,
+  oob_authentication_data: 8,
+  authentication_requirement: 8,
+}
+
+packet EncapsulatedHeader : Packet(opcode = ENCAPSULATED_HEADER) {
+  major_type: 8,
+  minor_type: 8,
+  payload_length: 8,
+}
+
+packet EncapsulatedPayload : Packet(opcode = ENCAPSULATED_PAYLOAD) {
+  data: 8[16],
+}
+
+packet SimplePairingConfirm : Packet(opcode = SIMPLE_PAIRING_CONFIRM) {
+  commitment_value: 8[16],
+}
+
+packet SimplePairingNumber : Packet(opcode = SIMPLE_PAIRING_NUMBER) {
+  nonce: 8[16],
+}
+
+packet DhkeyCheck : Packet(opcode = DHKEY_CHECK) {
+  confirmation_value: 8[16],
+}
+
+packet AuRand : Packet(opcode = AU_RAND) {
+  random_number: 8[16],
+}
+
+packet Sres : Packet(opcode = SRES) {
+  authentication_rsp: 8[4],
+}
+
+packet NumericComparaisonFailed: ExtendedPacket(extended_opcode = NUMERIC_COMPARAISON_FAILED) {}
+
+packet PasskeyFailed: ExtendedPacket(extended_opcode = PASSKEY_FAILED) {}
+
+packet KeypressNotification: ExtendedPacket(extended_opcode = KEYPRESS_NOTIFICATION) {
+  notification_type: 8,
+}
+
+packet InRand : Packet(opcode = IN_RAND) {
+  random_number: 8[16],
+}
+
+packet CombKey : Packet(opcode = COMB_KEY) {
+  random_number: 8[16],
+}
+
+packet EncryptionModeReq : Packet(opcode = ENCRYPTION_MODE_REQ) {
+  encryption_mode: 8,
+}
+
+packet EncryptionKeySizeReq : Packet(opcode = ENCRYPTION_KEY_SIZE_REQ) {
+  key_size: 8,
+}
+
+packet StartEncryptionReq : Packet(opcode = START_ENCRYPTION_REQ) {
+  random_number: 8[16]
+}
+
+packet StopEncryptionReq : Packet(opcode = STOP_ENCRYPTION_REQ) {}
+
+packet FeaturesReqExt : ExtendedPacket(extended_opcode = FEATURES_REQ) {
+  features_page: 8,
+  max_supported_page: 8,
+  extended_features: 8[8],
+}
+
+packet FeaturesResExt : ExtendedPacket(extended_opcode = FEATURES_RES) {
+  features_page: 8,
+  max_supported_page: 8,
+  extended_features: 8[8],
+}
diff --git a/tools/rootcanal/lmp/src/ec.rs b/tools/rootcanal/lmp/src/ec.rs
new file mode 100644
index 0000000..b0b88c1
--- /dev/null
+++ b/tools/rootcanal/lmp/src/ec.rs
@@ -0,0 +1,471 @@
+/******************************************************************************
+ *
+ *  Copyright 2022 The Android Open Source Project
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at:
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ ******************************************************************************/
+
+/******************************************************************************
+ *                                 IMPORTANT
+ *
+ * These cryptography methods do not provide any security or correctness
+ * ensurance.
+ * They should be used only in Bluetooth emulation, not including any production
+ * environment.
+ *
+ ******************************************************************************/
+
+use num_bigint::{BigInt, Sign};
+use num_integer::Integer;
+use num_traits::{One, Signed, Zero};
+use rand::{thread_rng, Rng};
+use std::convert::TryInto;
+use std::marker::PhantomData;
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum PublicKey {
+    P192([u8; P192r1::PUBLIC_KEY_SIZE]),
+    P256([u8; P256r1::PUBLIC_KEY_SIZE]),
+}
+
+impl PublicKey {
+    pub fn new(size: usize) -> Option<Self> {
+        match size {
+            P192r1::PUBLIC_KEY_SIZE => Some(Self::P192([0; P192r1::PUBLIC_KEY_SIZE])),
+            P256r1::PUBLIC_KEY_SIZE => Some(Self::P256([0; P256r1::PUBLIC_KEY_SIZE])),
+            _ => None,
+        }
+    }
+
+    fn from_bytes(bytes: &[u8]) -> Option<Self> {
+        if let Ok(inner) = bytes.try_into() {
+            Some(PublicKey::P192(inner))
+        } else if let Ok(inner) = bytes.try_into() {
+            Some(PublicKey::P256(inner))
+        } else {
+            None
+        }
+    }
+
+    pub fn as_slice(&self) -> &[u8] {
+        match self {
+            PublicKey::P192(inner) => inner,
+            PublicKey::P256(inner) => inner,
+        }
+    }
+
+    pub fn size(&self) -> usize {
+        self.as_slice().len()
+    }
+
+    pub fn as_mut_slice(&mut self) -> &mut [u8] {
+        match self {
+            PublicKey::P192(inner) => inner,
+            PublicKey::P256(inner) => inner,
+        }
+    }
+
+    fn get_x(&self) -> BigInt {
+        BigInt::from_signed_bytes_le(&self.as_slice()[0..self.size() / 2])
+    }
+
+    fn get_y(&self) -> BigInt {
+        BigInt::from_signed_bytes_le(&self.as_slice()[self.size() / 2..self.size()])
+    }
+
+    fn to_point<Curve: EllipticCurve>(&self) -> Point<Curve> {
+        Point::new(&self.get_x(), &self.get_y())
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum PrivateKey {
+    P192([u8; P192r1::PRIVATE_KEY_SIZE]),
+    P256([u8; P256r1::PRIVATE_KEY_SIZE]),
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum DhKey {
+    P192([u8; P192r1::PUBLIC_KEY_SIZE]),
+    P256([u8; P256r1::PUBLIC_KEY_SIZE]),
+}
+
+impl DhKey {
+    fn from_bytes(bytes: &[u8]) -> Option<Self> {
+        if let Ok(inner) = bytes.try_into() {
+            Some(DhKey::P192(inner))
+        } else if let Ok(inner) = bytes.try_into() {
+            Some(DhKey::P256(inner))
+        } else {
+            None
+        }
+    }
+}
+
+impl PrivateKey {
+    // Generate a private key in range[1,2**191]
+    pub fn generate_p192() -> Self {
+        let random_bytes: [u8; P192r1::PRIVATE_KEY_SIZE] = thread_rng().gen();
+        let mut key = BigInt::from_signed_bytes_le(&random_bytes);
+
+        if key.is_negative() {
+            key = -key;
+        }
+        if key < BigInt::one() {
+            key = BigInt::one();
+        }
+        let buf = key.to_signed_bytes_le();
+        let mut inner = [0; P192r1::PRIVATE_KEY_SIZE];
+        inner[0..buf.len()].copy_from_slice(&buf);
+        Self::P192(inner)
+    }
+
+    pub fn generate_p256() -> Self {
+        let random_bytes: [u8; P256r1::PRIVATE_KEY_SIZE] = thread_rng().gen();
+        let mut key = BigInt::from_signed_bytes_le(&random_bytes);
+
+        if key.is_negative() {
+            key = -key;
+        }
+        if key < BigInt::one() {
+            key = BigInt::one();
+        }
+        let buf = key.to_signed_bytes_le();
+        let mut inner = [0; P256r1::PRIVATE_KEY_SIZE];
+        inner[0..buf.len()].copy_from_slice(&buf);
+        Self::P256(inner)
+    }
+
+    pub fn as_slice(&self) -> &[u8] {
+        match self {
+            PrivateKey::P192(inner) => inner,
+            PrivateKey::P256(inner) => inner,
+        }
+    }
+
+    fn to_bigint(&self) -> BigInt {
+        BigInt::from_signed_bytes_le(self.as_slice())
+    }
+
+    pub fn derive(&self) -> PublicKey {
+        let bytes = match self {
+            PrivateKey::P192(_) => {
+                Point::<P192r1>::generate_public_key(&self.to_bigint()).to_bytes()
+            }
+            PrivateKey::P256(_) => {
+                Point::<P256r1>::generate_public_key(&self.to_bigint()).to_bytes()
+            }
+        }
+        .unwrap();
+        PublicKey::from_bytes(&bytes).unwrap()
+    }
+
+    pub fn shared_secret(&self, peer_public_key: PublicKey) -> DhKey {
+        let bytes = match self {
+            PrivateKey::P192(_) => {
+                (&peer_public_key.to_point::<P192r1>() * &self.to_bigint()).to_bytes()
+            }
+            PrivateKey::P256(_) => {
+                (&peer_public_key.to_point::<P256r1>() * &self.to_bigint()).to_bytes()
+            }
+        }
+        .unwrap();
+        DhKey::from_bytes(&bytes).unwrap()
+    }
+}
+
+// Modular Inverse
+fn mod_inv(x: &BigInt, m: &BigInt) -> Option<BigInt> {
+    let egcd = x.extended_gcd(m);
+    if !egcd.gcd.is_one() {
+        None
+    } else {
+        Some(egcd.x % m)
+    }
+}
+
+trait EllipticCurve {
+    type Param: AsRef<[u8]>;
+    const A: i32;
+    const P: Self::Param;
+    const G_X: Self::Param;
+    const G_Y: Self::Param;
+    const PRIVATE_KEY_SIZE: usize;
+    const PUBLIC_KEY_SIZE: usize;
+
+    fn p() -> BigInt {
+        BigInt::from_bytes_be(Sign::Plus, Self::P.as_ref())
+    }
+}
+
+#[derive(Debug, Clone, PartialEq)]
+struct P192r1;
+
+impl EllipticCurve for P192r1 {
+    type Param = [u8; 24];
+
+    const A: i32 = -3;
+    const P: Self::Param = [
+        0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+        0xfe, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    ];
+    const G_X: Self::Param = [
+        0x18, 0x8d, 0xa8, 0x0e, 0xb0, 0x30, 0x90, 0xf6, 0x7c, 0xbf, 0x20, 0xeb, 0x43, 0xa1, 0x88,
+        0x00, 0xf4, 0xff, 0x0a, 0xfd, 0x82, 0xff, 0x10, 0x12,
+    ];
+    const G_Y: Self::Param = [
+        0x07, 0x19, 0x2b, 0x95, 0xff, 0xc8, 0xda, 0x78, 0x63, 0x10, 0x11, 0xed, 0x6b, 0x24, 0xcd,
+        0xd5, 0x73, 0xf9, 0x77, 0xa1, 0x1e, 0x79, 0x48, 0x11,
+    ];
+    const PRIVATE_KEY_SIZE: usize = 24;
+    const PUBLIC_KEY_SIZE: usize = 48;
+}
+
+#[derive(Debug, Clone, PartialEq)]
+struct P256r1;
+
+impl EllipticCurve for P256r1 {
+    type Param = [u8; 32];
+
+    const A: i32 = -3;
+    const P: Self::Param = [
+        0xff, 0xff, 0xff, 0xff, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+        0xff, 0xff,
+    ];
+    const G_X: Self::Param = [
+        0x6b, 0x17, 0xd1, 0xf2, 0xe1, 0x2c, 0x42, 0x47, 0xf8, 0xbc, 0xe6, 0xe5, 0x63, 0xa4, 0x40,
+        0xf2, 0x77, 0x03, 0x7d, 0x81, 0x2d, 0xeb, 0x33, 0xa0, 0xf4, 0xa1, 0x39, 0x45, 0xd8, 0x98,
+        0xc2, 0x96,
+    ];
+    const G_Y: Self::Param = [
+        0x4f, 0xe3, 0x42, 0xe2, 0xfe, 0x1a, 0x7f, 0x9b, 0x8e, 0xe7, 0xeb, 0x4a, 0x7c, 0x0f, 0x9e,
+        0x16, 0x2b, 0xce, 0x33, 0x57, 0x6b, 0x31, 0x5e, 0xce, 0xcb, 0xb6, 0x40, 0x68, 0x37, 0xbf,
+        0x51, 0xf5,
+    ];
+    const PRIVATE_KEY_SIZE: usize = 32;
+    const PUBLIC_KEY_SIZE: usize = 64;
+}
+
+#[derive(Debug, PartialEq)]
+enum Point<Curve> {
+    Infinite(PhantomData<Curve>),
+    Finite { x: BigInt, y: BigInt, _curve: PhantomData<Curve> },
+}
+
+impl<Curve> Point<Curve>
+where
+    Curve: EllipticCurve,
+{
+    fn o() -> Self {
+        Point::Infinite(PhantomData)
+    }
+
+    fn generate_public_key(private_key: &BigInt) -> Self {
+        &Self::g() * private_key
+    }
+
+    fn new(x: &BigInt, y: &BigInt) -> Self {
+        Point::Finite { x: x.clone(), y: y.clone(), _curve: PhantomData }
+    }
+
+    fn g() -> Self {
+        Self::new(
+            &BigInt::from_bytes_be(Sign::Plus, Curve::G_X.as_ref()),
+            &BigInt::from_bytes_be(Sign::Plus, Curve::G_Y.as_ref()),
+        )
+    }
+
+    #[cfg(test)]
+    fn get_x(&self) -> Option<BigInt> {
+        match self {
+            Point::Infinite(_) => None,
+            Point::Finite { x, .. } => Some(x.clone()),
+        }
+    }
+
+    fn to_bytes(&self) -> Option<Vec<u8>> {
+        match self {
+            Point::Infinite(_) => None,
+            Point::Finite { x, y, _curve: _ } => {
+                let mut x = x.to_signed_bytes_le();
+                x.resize(Curve::PRIVATE_KEY_SIZE, 0);
+                let mut y = y.to_signed_bytes_le();
+                y.resize(Curve::PRIVATE_KEY_SIZE, 0);
+                x.append(&mut y);
+                Some(x)
+            }
+        }
+    }
+}
+
+impl<Curve> Clone for Point<Curve>
+where
+    Curve: EllipticCurve,
+{
+    fn clone(&self) -> Self {
+        match self {
+            Point::Infinite(_) => Point::o(),
+            Point::Finite { x, y, .. } => Point::new(x, y),
+        }
+    }
+}
+
+// Elliptic Curve Group Addition
+// https://mathworld.wolfram.com/EllipticCurve.html
+impl<Curve> std::ops::Add<&Point<Curve>> for &Point<Curve>
+where
+    Curve: EllipticCurve,
+{
+    type Output = Point<Curve>;
+
+    fn add(self, rhs: &Point<Curve>) -> Self::Output {
+        // P + O = O + P = P
+        match (self, rhs) {
+            (Point::Infinite(_), Point::Infinite(_)) => Self::Output::o(),
+            (Point::Infinite(_), Point::Finite { .. }) => rhs.clone(),
+            (Point::Finite { .. }, Point::Infinite(_)) => self.clone(),
+            (
+                Point::Finite { _curve: _, x: x1, y: y1 },
+                Point::Finite { _curve: _, x: x2, y: y2 },
+            ) => {
+                // P + (-P) = O
+                if x1 == x2 && y1 == &(-y2) {
+                    return Self::Output::o();
+                }
+                let p = &Curve::p();
+                // d(x^3 + ax + b) / dx = (3x^2 + a) / 2y
+                let slope = if x1 == x2 {
+                    (&(3 * x1.pow(2) + Curve::A) * &mod_inv(&(2 * y1), p).unwrap()) % p
+                } else {
+                    // dy/dx = (y2 - y1) / (x2 - x1)
+                    (&(y2 - y1) * &mod_inv(&(x2 - x1), p).unwrap()) % p
+                };
+                // Solving (x-p)(x-q)(x-r) = x^3 + ax + b
+                // => x = d^2 - x1 - x2
+                let x = (slope.pow(2) - x1 - x2) % p;
+                let y = (slope * (x1 - &x) - y1) % p;
+                Point::new(&x, &y)
+            }
+        }
+    }
+}
+
+impl<Curve> std::ops::Mul<&BigInt> for &Point<Curve>
+where
+    Curve: EllipticCurve,
+{
+    type Output = Point<Curve>;
+
+    fn mul(self, rhs: &BigInt) -> Self::Output {
+        let mut addend = self.clone();
+        let mut result = Point::o();
+        let mut i = rhs.clone();
+
+        // O(logN) double-and-add multiplication
+        while !i.is_zero() {
+            if i.is_odd() {
+                result = &result + &addend;
+            }
+            addend = &addend + &addend;
+            i /= 2;
+        }
+        result
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use crate::ec::*;
+    use num_bigint::BigInt;
+
+    struct EcTestCase<const N: usize> {
+        pub priv_a: [u8; N],
+        pub priv_b: [u8; N],
+        pub pub_a: [u8; N],
+        pub dh_x: [u8; N],
+    }
+
+    // Private A, Private B, Public A(x), DHKey
+    const P192_TEST_CASES: [EcTestCase<48>; 4] = [
+        EcTestCase::<48> {
+            priv_a: *b"07915f86918ddc27005df1d6cf0c142b625ed2eff4a518ff",
+            priv_b: *b"1e636ca790b50f68f15d8dbe86244e309211d635de00e16d",
+            pub_a: *b"15207009984421a6586f9fc3fe7e4329d2809ea51125f8ed",
+            dh_x: *b"fb3ba2012c7e62466e486e229290175b4afebc13fdccee46",
+        },
+        EcTestCase::<48> {
+            priv_a: *b"52ec1ca6e0ec973c29065c3ca10be80057243002f09bb43e",
+            priv_b: *b"57231203533e9efe18cc622fd0e34c6a29c6e0fa3ab3bc53",
+            pub_a: *b"45571f027e0d690795d61560804da5de789a48f94ab4b07e",
+            dh_x: *b"a20a34b5497332aa7a76ab135cc0c168333be309d463c0c0",
+        },
+        EcTestCase::<48> {
+            priv_a: *b"00a0df08eaf51e6e7be519d67c6749ea3f4517cdd2e9e821",
+            priv_b: *b"2bf5e0d1699d50ca5025e8e2d9b13244b4d322a328be1821",
+            pub_a: *b"2ed35b430fa45f9d329186d754eeeb0495f0f653127f613d",
+            dh_x: *b"3b3986ba70790762f282a12a6d3bcae7a2ca01e25b87724e",
+        },
+        EcTestCase::<48> {
+            priv_a: *b"030a4af66e1a4d590a83e0284fca5cdf83292b84f4c71168",
+            priv_b: *b"12448b5c69ecd10c0471060f2bf86345c5e83c03d16bae2c",
+            pub_a: *b"f24a6899218fa912e7e4a8ba9357cb8182958f9fa42c968c",
+            dh_x: *b"4a78f83fba757c35f94abea43e92effdd2bc700723c61939",
+        },
+    ];
+
+    // Private A, Private B, Public A(x), DHKey
+    const P256_TEST_CASES: [EcTestCase<64>; 2] = [
+        EcTestCase::<64> {
+            priv_a: *b"3f49f6d4a3c55f3874c9b3e3d2103f504aff607beb40b7995899b8a6cd3c1abd",
+            priv_b: *b"55188b3d32f6bb9a900afcfbeed4e72a59cb9ac2f19d7cfb6b4fdd49f47fc5fd",
+            pub_a: *b"20b003d2f297be2c5e2c83a7e9f9a5b9eff49111acf4fddbcc0301480e359de6",
+            dh_x: *b"ec0234a357c8ad05341010a60a397d9b99796b13b4f866f1868d34f373bfa698",
+        },
+        EcTestCase::<64> {
+            priv_a: *b"06a516693c9aa31a6084545d0c5db641b48572b97203ddffb7ac73f7d0457663",
+            priv_b: *b"529aa0670d72cd6497502ed473502b037e8803b5c60829a5a3caa219505530ba",
+            pub_a: *b"2c31a47b5779809ef44cb5eaaf5c3e43d5f8faad4a8794cb987e9b03745c78dd",
+            dh_x: *b"ab85843a2f6d883f62e5684b38e307335fe6e1945ecd19604105c6f23221eb69",
+        },
+    ];
+
+    #[test]
+    fn p192() {
+        for test_case in P192_TEST_CASES {
+            let priv_a = BigInt::parse_bytes(&test_case.priv_a, 16).unwrap();
+            let priv_b = BigInt::parse_bytes(&test_case.priv_b, 16).unwrap();
+            let pub_a = Point::<P192r1>::generate_public_key(&priv_a);
+            let pub_b = Point::<P192r1>::generate_public_key(&priv_b);
+            assert_eq!(pub_a.get_x().unwrap(), BigInt::parse_bytes(&test_case.pub_a, 16).unwrap());
+            let shared = &pub_a * &priv_b;
+            assert_eq!(shared.get_x().unwrap(), BigInt::parse_bytes(&test_case.dh_x, 16).unwrap());
+            assert_eq!((&pub_a * &priv_b).get_x().unwrap(), (&pub_b * &priv_a).get_x().unwrap());
+        }
+    }
+
+    #[test]
+    fn p256() {
+        for test_case in P256_TEST_CASES {
+            let priv_a = BigInt::parse_bytes(&test_case.priv_a, 16).unwrap();
+            let priv_b = BigInt::parse_bytes(&test_case.priv_b, 16).unwrap();
+            let pub_a = Point::<P256r1>::generate_public_key(&priv_a);
+            let pub_b = Point::<P256r1>::generate_public_key(&priv_b);
+            assert_eq!(pub_a.get_x().unwrap(), BigInt::parse_bytes(&test_case.pub_a, 16).unwrap());
+            let shared = &pub_a * &priv_b;
+            assert_eq!(shared.get_x().unwrap(), BigInt::parse_bytes(&test_case.dh_x, 16).unwrap());
+            assert_eq!((&pub_a * &priv_b).get_x().unwrap(), (&pub_b * &priv_a).get_x().unwrap());
+        }
+    }
+}
diff --git a/tools/rootcanal/lmp/src/either.rs b/tools/rootcanal/lmp/src/either.rs
new file mode 100644
index 0000000..d1ee92b
--- /dev/null
+++ b/tools/rootcanal/lmp/src/either.rs
@@ -0,0 +1,35 @@
+use std::convert::TryFrom;
+
+use crate::packets::{hci, lmp};
+
+pub enum Either<L, R> {
+    Left(L),
+    Right(R),
+}
+
+macro_rules! impl_try_from {
+    ($T: path) => {
+        impl<L, R> TryFrom<$T> for Either<L, R>
+        where
+            L: TryFrom<$T>,
+            R: TryFrom<$T>,
+        {
+            type Error = ();
+
+            fn try_from(value: $T) -> Result<Self, Self::Error> {
+                let left = L::try_from(value.clone());
+                if let Ok(left) = left {
+                    return Ok(Either::Left(left));
+                }
+                let right = R::try_from(value);
+                if let Ok(right) = right {
+                    return Ok(Either::Right(right));
+                }
+                Err(())
+            }
+        }
+    };
+}
+
+impl_try_from!(lmp::PacketPacket);
+impl_try_from!(hci::CommandPacket);
diff --git a/tools/rootcanal/lmp/src/ffi.rs b/tools/rootcanal/lmp/src/ffi.rs
new file mode 100644
index 0000000..05564ba
--- /dev/null
+++ b/tools/rootcanal/lmp/src/ffi.rs
@@ -0,0 +1,171 @@
+use std::mem::ManuallyDrop;
+use std::rc::Rc;
+use std::slice;
+
+use crate::manager::LinkManager;
+use crate::packets::{hci, lmp};
+
+/// Link Manager callbacks
+#[repr(C)]
+#[derive(Clone)]
+pub struct LinkManagerOps {
+    user_pointer: *mut (),
+    get_handle: unsafe extern "C" fn(user: *mut (), address: *const [u8; 6]) -> u16,
+    get_address: unsafe extern "C" fn(user: *mut (), handle: u16, result: *mut [u8; 6]),
+    extended_features: unsafe extern "C" fn(user: *mut (), features_page: u8) -> u64,
+    send_hci_event: unsafe extern "C" fn(user: *mut (), data: *const u8, len: usize),
+    send_lmp_packet:
+        unsafe extern "C" fn(user: *mut (), to: *const [u8; 6], data: *const u8, len: usize),
+}
+
+impl LinkManagerOps {
+    pub(crate) fn get_address(&self, handle: u16) -> hci::Address {
+        let mut result = hci::EMPTY_ADDRESS;
+        unsafe { (self.get_address)(self.user_pointer, handle, &mut result.bytes as *mut _) };
+        result
+    }
+
+    pub(crate) fn get_handle(&self, addr: hci::Address) -> u16 {
+        unsafe { (self.get_handle)(self.user_pointer, &addr.bytes as *const _) }
+    }
+
+    pub(crate) fn extended_features(&self, features_page: u8) -> u64 {
+        unsafe { (self.extended_features)(self.user_pointer, features_page) }
+    }
+
+    pub(crate) fn send_hci_event(&self, packet: &[u8]) {
+        unsafe { (self.send_hci_event)(self.user_pointer, packet.as_ptr(), packet.len()) }
+    }
+
+    pub(crate) fn send_lmp_packet(&self, to: hci::Address, packet: &[u8]) {
+        unsafe {
+            (self.send_lmp_packet)(
+                self.user_pointer,
+                &to.bytes as *const _,
+                packet.as_ptr(),
+                packet.len(),
+            )
+        }
+    }
+}
+
+/// Create a new link manager instance
+/// # Arguments
+/// * `ops` - Function callbacks required by the link manager
+#[no_mangle]
+pub extern "C" fn link_manager_create(ops: LinkManagerOps) -> *const LinkManager {
+    Rc::into_raw(Rc::new(LinkManager::new(ops)))
+}
+
+/// Register a new link with a peer inside the link manager
+/// # Arguments
+/// * `lm` - link manager pointer
+/// * `peer` - peer address as array of 6 bytes
+/// # Safety
+/// - This should be called from the thread of creation
+/// - `lm` must be a valid pointer
+/// - `peer` must be valid for reads for 6 bytes
+#[no_mangle]
+pub unsafe extern "C" fn link_manager_add_link(
+    lm: *const LinkManager,
+    peer: *const [u8; 6],
+) -> bool {
+    let lm = ManuallyDrop::new(Rc::from_raw(lm));
+    lm.add_link(hci::Address { bytes: *peer }).is_ok()
+}
+
+/// Unregister a link with a peer inside the link manager
+/// Returns true if successful
+/// # Arguments
+/// * `lm` - link manager pointer
+/// * `peer` - peer address as array of 6 bytes
+/// # Safety
+/// - This should be called from the thread of creation
+/// - `lm` must be a valid pointer
+/// - `peer` must be valid for reads for 6 bytes
+#[no_mangle]
+pub unsafe extern "C" fn link_manager_remove_link(
+    lm: *const LinkManager,
+    peer: *const [u8; 6],
+) -> bool {
+    let lm = ManuallyDrop::new(Rc::from_raw(lm));
+    lm.remove_link(hci::Address { bytes: *peer }).is_ok()
+}
+
+/// Run the Link Manager procedures
+/// # Arguments
+/// * `lm` - link manager pointer
+/// # Safety
+/// - This should be called from the thread of creation
+/// - `lm` must be a valid pointer
+#[no_mangle]
+pub unsafe extern "C" fn link_manager_tick(lm: *const LinkManager) {
+    let lm = ManuallyDrop::new(Rc::from_raw(lm));
+    lm.as_ref().tick();
+}
+
+/// Process an HCI packet with the link manager
+/// Returns true if successful
+/// # Arguments
+/// * `lm` - link manager pointer
+/// * `data` - HCI packet data
+/// * `len` - HCI packet len
+/// # Safety
+/// - This should be called from the thread of creation
+/// - `lm` must be a valid pointer
+/// - `data` must be valid for reads of len `len`
+#[no_mangle]
+pub unsafe extern "C" fn link_manager_ingest_hci(
+    lm: *const LinkManager,
+    data: *const u8,
+    len: usize,
+) -> bool {
+    let lm = ManuallyDrop::new(Rc::from_raw(lm));
+    let data = slice::from_raw_parts(data, len);
+
+    if let Ok(packet) = hci::CommandPacket::parse(data) {
+        lm.ingest_hci(packet).is_ok()
+    } else {
+        false
+    }
+}
+
+/// Process an LMP packet from a peer with the link manager
+/// Returns true if successful
+/// # Arguments
+/// * `lm` - link manager pointer
+/// * `from` - Address of peer as array of 6 bytes
+/// * `data` - HCI packet data
+/// * `len` - HCI packet len
+/// # Safety
+/// - This should be called from the thread of creation
+/// - `lm` must be a valid pointers
+/// - `from` must be valid pointer for reads for 6 bytes
+/// - `data` must be valid for reads of len `len`
+#[no_mangle]
+pub unsafe extern "C" fn link_manager_ingest_lmp(
+    lm: *const LinkManager,
+    from: *const [u8; 6],
+    data: *const u8,
+    len: usize,
+) -> bool {
+    let lm = ManuallyDrop::new(Rc::from_raw(lm));
+    let data = slice::from_raw_parts(data, len);
+
+    if let Ok(packet) = lmp::PacketPacket::parse(data) {
+        lm.ingest_lmp(hci::Address { bytes: *from }, packet).is_ok()
+    } else {
+        false
+    }
+}
+
+/// Deallocate the link manager instance
+/// # Arguments
+/// * `lm` - link manager pointer
+/// # Safety
+/// - This should be called from the thread of creation
+/// - `lm` must be a valid pointers and must not be reused afterwards
+#[no_mangle]
+pub unsafe extern "C" fn link_manager_destroy(lm: *const LinkManager) {
+    let _ = Rc::from_raw(lm);
+}
diff --git a/tools/rootcanal/lmp/src/future.rs b/tools/rootcanal/lmp/src/future.rs
new file mode 100644
index 0000000..afe021f
--- /dev/null
+++ b/tools/rootcanal/lmp/src/future.rs
@@ -0,0 +1,17 @@
+use std::sync::Arc;
+use std::task::{Wake, Waker};
+
+pub use pin_utils::pin_mut as pin;
+
+// Create a `Waker` that
+// does nothing when `wake`
+// is called
+pub fn noop_waker() -> Waker {
+    struct NoopWaker;
+
+    impl Wake for NoopWaker {
+        fn wake(self: Arc<Self>) {}
+    }
+
+    Arc::new(NoopWaker).into()
+}
diff --git a/tools/rootcanal/lmp/src/lib.rs b/tools/rootcanal/lmp/src/lib.rs
new file mode 100644
index 0000000..2c2fdb5
--- /dev/null
+++ b/tools/rootcanal/lmp/src/lib.rs
@@ -0,0 +1,15 @@
+//! Link Manager implemented in Rust
+
+mod ec;
+mod either;
+mod ffi;
+mod future;
+mod manager;
+mod packets;
+mod procedure;
+
+#[cfg(test)]
+mod test;
+
+pub use ffi::*;
+pub use manager::num_hci_command_packets;
diff --git a/tools/rootcanal/lmp/src/manager.rs b/tools/rootcanal/lmp/src/manager.rs
new file mode 100644
index 0000000..ca48df9
--- /dev/null
+++ b/tools/rootcanal/lmp/src/manager.rs
@@ -0,0 +1,231 @@
+use std::cell::{Cell, RefCell};
+use std::collections::VecDeque;
+use std::convert::{TryFrom, TryInto};
+use std::future::Future;
+use std::pin::Pin;
+use std::rc::{Rc, Weak};
+use std::task::{Context, Poll};
+
+use thiserror::Error;
+
+use crate::ffi::LinkManagerOps;
+use crate::future::noop_waker;
+use crate::packets::{hci, lmp};
+use crate::procedure;
+
+use hci::Packet as _;
+use lmp::Packet as _;
+
+/// Number of hci command packets used
+/// in Command Complete and Command Status
+#[allow(non_upper_case_globals)]
+pub const num_hci_command_packets: u8 = 1;
+
+struct Link {
+    peer: Cell<hci::Address>,
+    // Only store one HCI packet as our Num_HCI_Command_Packets
+    // is always 1
+    hci: Cell<Option<hci::CommandPacket>>,
+    lmp: RefCell<VecDeque<lmp::PacketPacket>>,
+}
+
+impl Default for Link {
+    fn default() -> Self {
+        Link {
+            peer: Cell::new(hci::EMPTY_ADDRESS),
+            hci: Default::default(),
+            lmp: Default::default(),
+        }
+    }
+}
+
+impl Link {
+    fn ingest_lmp(&self, packet: lmp::PacketPacket) {
+        self.lmp.borrow_mut().push_back(packet);
+    }
+
+    fn ingest_hci(&self, command: hci::CommandPacket) {
+        assert!(self.hci.replace(Some(command)).is_none(), "HCI flow control violation");
+    }
+
+    fn poll_hci_command<C: TryFrom<hci::CommandPacket>>(&self) -> Poll<C> {
+        let command = self.hci.take();
+
+        if let Some(command) = command.clone().and_then(|c| c.try_into().ok()) {
+            Poll::Ready(command)
+        } else {
+            self.hci.set(command);
+            Poll::Pending
+        }
+    }
+
+    fn poll_lmp_packet<P: TryFrom<lmp::PacketPacket>>(&self) -> Poll<P> {
+        let mut queue = self.lmp.borrow_mut();
+        let packet = queue.front().and_then(|packet| packet.clone().try_into().ok());
+
+        if let Some(packet) = packet {
+            queue.pop_front();
+            Poll::Ready(packet)
+        } else {
+            Poll::Pending
+        }
+    }
+
+    fn reset(&self) {
+        self.peer.set(hci::EMPTY_ADDRESS);
+        self.hci.set(None);
+        self.lmp.borrow_mut().clear();
+    }
+}
+
+#[derive(Error, Debug)]
+pub enum LinkManagerError {
+    #[error("Unknown peer")]
+    UnknownPeer,
+    #[error("Unhandled HCI packet")]
+    UnhandledHciPacket,
+    #[error("Maximum number of links reached")]
+    MaxNumberOfLink,
+}
+
+/// Max number of Bluetooth Peers
+pub const MAX_PEER_NUMBER: usize = 7;
+
+pub struct LinkManager {
+    ops: LinkManagerOps,
+    links: [Link; MAX_PEER_NUMBER],
+    procedures: RefCell<[Option<Pin<Box<dyn Future<Output = ()>>>>; MAX_PEER_NUMBER]>,
+}
+
+impl LinkManager {
+    pub fn new(ops: LinkManagerOps) -> Self {
+        Self { ops, links: Default::default(), procedures: Default::default() }
+    }
+
+    fn get_link(&self, peer: hci::Address) -> Option<&Link> {
+        self.links.iter().find(|link| link.peer.get() == peer)
+    }
+
+    pub fn ingest_lmp(
+        &self,
+        from: hci::Address,
+        packet: lmp::PacketPacket,
+    ) -> Result<(), LinkManagerError> {
+        if let Some(link) = self.get_link(from) {
+            link.ingest_lmp(packet);
+        };
+        Ok(())
+    }
+
+    pub fn ingest_hci(&self, command: hci::CommandPacket) -> Result<(), LinkManagerError> {
+        // Try to find the peer address from the command arguments
+        let peer = hci::command_connection_handle(&command)
+            .map(|handle| self.ops.get_address(handle))
+            .or_else(|| hci::command_remote_device_address(&command));
+
+        if let Some(peer) = peer {
+            if let Some(link) = self.get_link(peer) {
+                link.ingest_hci(command);
+            };
+            Ok(())
+        } else {
+            Err(LinkManagerError::UnhandledHciPacket)
+        }
+    }
+
+    pub fn add_link(self: &Rc<Self>, peer: hci::Address) -> Result<(), LinkManagerError> {
+        let index = self.links.iter().position(|link| link.peer.get().is_empty());
+
+        if let Some(index) = index {
+            self.links[index].peer.set(peer);
+            let context = LinkContext { index: index as u8, manager: Rc::downgrade(self) };
+            self.procedures.borrow_mut()[index] = Some(Box::pin(procedure::run(context)));
+            Ok(())
+        } else {
+            Err(LinkManagerError::UnhandledHciPacket)
+        }
+    }
+
+    pub fn remove_link(&self, peer: hci::Address) -> Result<(), LinkManagerError> {
+        let index = self.links.iter().position(|link| link.peer.get() == peer);
+
+        if let Some(index) = index {
+            self.links[index].reset();
+            self.procedures.borrow_mut()[index] = None;
+            Ok(())
+        } else {
+            Err(LinkManagerError::UnknownPeer)
+        }
+    }
+
+    pub fn tick(&self) {
+        let waker = noop_waker();
+
+        for procedures in self.procedures.borrow_mut().iter_mut().filter_map(Option::as_mut) {
+            let _ = procedures.as_mut().poll(&mut Context::from_waker(&waker));
+        }
+    }
+
+    fn link(&self, idx: u8) -> &Link {
+        &self.links[idx as usize]
+    }
+}
+
+struct LinkContext {
+    index: u8,
+    manager: Weak<LinkManager>,
+}
+
+impl procedure::Context for LinkContext {
+    fn poll_hci_command<C: TryFrom<hci::CommandPacket>>(&self) -> Poll<C> {
+        if let Some(manager) = self.manager.upgrade() {
+            manager.link(self.index).poll_hci_command()
+        } else {
+            Poll::Pending
+        }
+    }
+
+    fn poll_lmp_packet<P: TryFrom<lmp::PacketPacket>>(&self) -> Poll<P> {
+        if let Some(manager) = self.manager.upgrade() {
+            manager.link(self.index).poll_lmp_packet()
+        } else {
+            Poll::Pending
+        }
+    }
+
+    fn send_hci_event<E: Into<hci::EventPacket>>(&self, event: E) {
+        if let Some(manager) = self.manager.upgrade() {
+            manager.ops.send_hci_event(&event.into().to_vec())
+        }
+    }
+
+    fn send_lmp_packet<P: Into<lmp::PacketPacket>>(&self, packet: P) {
+        if let Some(manager) = self.manager.upgrade() {
+            manager.ops.send_lmp_packet(self.peer_address(), &packet.into().to_vec())
+        }
+    }
+
+    fn peer_address(&self) -> hci::Address {
+        if let Some(manager) = self.manager.upgrade() {
+            manager.link(self.index).peer.get()
+        } else {
+            hci::EMPTY_ADDRESS
+        }
+    }
+
+    fn peer_handle(&self) -> u16 {
+        if let Some(manager) = self.manager.upgrade() {
+            manager.ops.get_handle(self.peer_address())
+        } else {
+            0
+        }
+    }
+
+    fn extended_features(&self, features_page: u8) -> u64 {
+        if let Some(manager) = self.manager.upgrade() {
+            manager.ops.extended_features(features_page)
+        } else {
+            0
+        }
+    }
+}
diff --git a/tools/rootcanal/lmp/src/packets.rs b/tools/rootcanal/lmp/src/packets.rs
new file mode 100644
index 0000000..250d2dd
--- /dev/null
+++ b/tools/rootcanal/lmp/src/packets.rs
@@ -0,0 +1,58 @@
+pub mod hci {
+    pub use bt_packets::custom_types::*;
+    pub use bt_packets::hci::*;
+
+    pub fn command_remote_device_address(command: &CommandPacket) -> Option<Address> {
+        #[allow(unused_imports)]
+        use Option::None;
+        use SecurityCommandChild::*; // Overwrite `None` variant of `Child` enum
+
+        match command.specialize() {
+            CommandChild::SecurityCommand(command) => match command.specialize() {
+                LinkKeyRequestReply(packet) => Some(packet.get_bd_addr()),
+                LinkKeyRequestNegativeReply(packet) => Some(packet.get_bd_addr()),
+                PinCodeRequestReply(packet) => Some(packet.get_bd_addr()),
+                PinCodeRequestNegativeReply(packet) => Some(packet.get_bd_addr()),
+                IoCapabilityRequestReply(packet) => Some(packet.get_bd_addr()),
+                IoCapabilityRequestNegativeReply(packet) => Some(packet.get_bd_addr()),
+                UserConfirmationRequestReply(packet) => Some(packet.get_bd_addr()),
+                UserConfirmationRequestNegativeReply(packet) => Some(packet.get_bd_addr()),
+                UserPasskeyRequestReply(packet) => Some(packet.get_bd_addr()),
+                UserPasskeyRequestNegativeReply(packet) => Some(packet.get_bd_addr()),
+                RemoteOobDataRequestReply(packet) => Some(packet.get_bd_addr()),
+                RemoteOobDataRequestNegativeReply(packet) => Some(packet.get_bd_addr()),
+                SendKeypressNotification(packet) => Some(packet.get_bd_addr()),
+                _ => None,
+            },
+            _ => None,
+        }
+    }
+
+    pub fn command_connection_handle(command: &CommandPacket) -> Option<u16> {
+        use ConnectionManagementCommandChild::*;
+        #[allow(unused_imports)]
+        use Option::None; // Overwrite `None` variant of `Child` enum
+
+        match command.specialize() {
+            CommandChild::AclCommand(command) => match command.specialize() {
+                AclCommandChild::ConnectionManagementCommand(command) => {
+                    match command.specialize() {
+                        AuthenticationRequested(packet) => Some(packet.get_connection_handle()),
+                        SetConnectionEncryption(packet) => Some(packet.get_connection_handle()),
+                        _ => None,
+                    }
+                }
+                _ => None,
+            },
+            _ => None,
+        }
+    }
+}
+
+pub mod lmp {
+    #![allow(clippy::all)]
+    #![allow(unused)]
+    #![allow(missing_docs)]
+
+    include!(concat!(env!("OUT_DIR"), "/lmp_packets.rs"));
+}
diff --git a/tools/rootcanal/lmp/src/procedure/authentication.rs b/tools/rootcanal/lmp/src/procedure/authentication.rs
new file mode 100644
index 0000000..d5bdc58
--- /dev/null
+++ b/tools/rootcanal/lmp/src/procedure/authentication.rs
@@ -0,0 +1,106 @@
+// Bluetooth Core, Vol 2, Part C, 4.2.1
+
+use crate::either::Either;
+use crate::num_hci_command_packets;
+use crate::packets::{hci, lmp};
+use crate::procedure::features;
+use crate::procedure::legacy_pairing;
+use crate::procedure::secure_simple_pairing;
+use crate::procedure::Context;
+
+pub async fn send_challenge(
+    ctx: &impl Context,
+    transaction_id: u8,
+    _link_key: [u8; 16],
+) -> Result<(), ()> {
+    let random_number = [0; 16];
+    ctx.send_lmp_packet(lmp::AuRandBuilder { transaction_id, random_number }.build());
+
+    match ctx.receive_lmp_packet::<Either<lmp::SresPacket, lmp::NotAcceptedPacket>>().await {
+        Either::Left(_response) => Ok(()),
+        Either::Right(_) => Err(()),
+    }
+}
+
+pub async fn receive_challenge(ctx: &impl Context, _link_key: [u8; 16]) {
+    let _random_number = *ctx.receive_lmp_packet::<lmp::AuRandPacket>().await.get_random_number();
+    ctx.send_lmp_packet(lmp::SresBuilder { transaction_id: 0, authentication_rsp: [0; 4] }.build());
+}
+
+pub async fn initiate(ctx: &impl Context) {
+    let _ = ctx.receive_hci_command::<hci::AuthenticationRequestedPacket>().await;
+    ctx.send_hci_event(
+        hci::AuthenticationRequestedStatusBuilder {
+            num_hci_command_packets,
+            status: hci::ErrorCode::Success,
+        }
+        .build(),
+    );
+
+    ctx.send_hci_event(hci::LinkKeyRequestBuilder { bd_addr: ctx.peer_address() }.build());
+
+    let status = match ctx.receive_hci_command::<Either<
+        hci::LinkKeyRequestReplyPacket,
+        hci::LinkKeyRequestNegativeReplyPacket,
+    >>().await {
+        Either::Left(_reply) => {
+            ctx.send_hci_event(
+                hci::LinkKeyRequestReplyCompleteBuilder {
+                    num_hci_command_packets,
+                    status: hci::ErrorCode::Success,
+                    bd_addr: ctx.peer_address(),
+                }
+                .build(),
+            );
+            hci::ErrorCode::Success
+        },
+        Either::Right(_) => {
+            ctx.send_hci_event(
+                hci::LinkKeyRequestNegativeReplyCompleteBuilder {
+                    num_hci_command_packets,
+                    status: hci::ErrorCode::Success,
+                    bd_addr: ctx.peer_address(),
+                }
+                .build(),
+            );
+
+            let result = if features::supported_on_both_page1(ctx, hci::LMPFeaturesPage1Bits::SecureSimplePairingHostSupport).await {
+                secure_simple_pairing::initiate(ctx).await
+            } else {
+                legacy_pairing::initiate(ctx).await
+            };
+
+            match result {
+                Ok(_) => hci::ErrorCode::Success,
+                Err(_) => hci::ErrorCode::AuthenticationFailure
+            }
+        }
+    };
+
+    ctx.send_hci_event(
+        hci::AuthenticationCompleteBuilder { status, connection_handle: ctx.peer_handle() }.build(),
+    );
+}
+
+pub async fn respond(ctx: &impl Context) {
+    match ctx.receive_lmp_packet::<Either<
+        lmp::AuRandPacket,
+        Either<lmp::IoCapabilityReqPacket, lmp::InRandPacket>
+    >>()
+    .await
+    {
+        Either::Left(_random_number) => {
+            // TODO: Resolve authentication challenge
+            // TODO: Ask for link key
+            ctx.send_lmp_packet(lmp::SresBuilder { transaction_id: 0, authentication_rsp: [0; 4] }.build());
+        },
+        Either::Right(pairing) => {
+            let _result = match pairing {
+                Either::Left(io_capability_request) =>
+                    secure_simple_pairing::respond(ctx, io_capability_request).await,
+                Either::Right(in_rand) =>
+                    legacy_pairing::respond(ctx, in_rand).await,
+            };
+        }
+    }
+}
diff --git a/tools/rootcanal/lmp/src/procedure/encryption.rs b/tools/rootcanal/lmp/src/procedure/encryption.rs
new file mode 100644
index 0000000..841b20f
--- /dev/null
+++ b/tools/rootcanal/lmp/src/procedure/encryption.rs
@@ -0,0 +1,152 @@
+// Bluetooth Core, Vol 2, Part C, 4.2.5
+
+use super::features;
+use crate::num_hci_command_packets;
+use crate::packets::{hci, lmp};
+use crate::procedure::Context;
+
+use hci::LMPFeaturesPage1Bits::SecureConnectionsHostSupport;
+use hci::LMPFeaturesPage2Bits::SecureConnectionsControllerSupport;
+
+pub async fn initiate(ctx: &impl Context) {
+    // TODO: handle turn off
+    let _ = ctx.receive_hci_command::<hci::SetConnectionEncryptionPacket>().await;
+    ctx.send_hci_event(
+        hci::SetConnectionEncryptionStatusBuilder {
+            num_hci_command_packets,
+            status: hci::ErrorCode::Success,
+        }
+        .build(),
+    );
+
+    // TODO: handle failure
+    let _ = ctx
+        .send_accepted_lmp_packet(
+            lmp::EncryptionModeReqBuilder { transaction_id: 0, encryption_mode: 0x1 }.build(),
+        )
+        .await;
+
+    // TODO: handle failure
+    let _ = ctx
+        .send_accepted_lmp_packet(
+            lmp::EncryptionKeySizeReqBuilder { transaction_id: 0, key_size: 16 }.build(),
+        )
+        .await;
+
+    // TODO: handle failure
+    let _ = ctx
+        .send_accepted_lmp_packet(
+            lmp::StartEncryptionReqBuilder { transaction_id: 0, random_number: [0; 16] }.build(),
+        )
+        .await;
+
+    let aes_ccm = features::supported_on_both_page1(ctx, SecureConnectionsHostSupport).await
+        && features::supported_on_both_page2(ctx, SecureConnectionsControllerSupport).await;
+
+    ctx.send_hci_event(
+        hci::EncryptionChangeBuilder {
+            status: hci::ErrorCode::Success,
+            connection_handle: ctx.peer_handle(),
+            encryption_enabled: if aes_ccm {
+                hci::EncryptionEnabled::BrEdrAesCcm
+            } else {
+                hci::EncryptionEnabled::On
+            },
+        }
+        .build(),
+    );
+}
+
+pub async fn respond(ctx: &impl Context) {
+    // TODO: handle
+    let _ = ctx.receive_lmp_packet::<lmp::EncryptionModeReqPacket>().await;
+    ctx.send_lmp_packet(
+        lmp::AcceptedBuilder { transaction_id: 0, accepted_opcode: lmp::Opcode::EncryptionModeReq }
+            .build(),
+    );
+
+    let _ = ctx.receive_lmp_packet::<lmp::EncryptionKeySizeReqPacket>().await;
+    ctx.send_lmp_packet(
+        lmp::AcceptedBuilder {
+            transaction_id: 0,
+            accepted_opcode: lmp::Opcode::EncryptionKeySizeReq,
+        }
+        .build(),
+    );
+
+    let _ = ctx.receive_lmp_packet::<lmp::StartEncryptionReqPacket>().await;
+    ctx.send_lmp_packet(
+        lmp::AcceptedBuilder {
+            transaction_id: 0,
+            accepted_opcode: lmp::Opcode::StartEncryptionReq,
+        }
+        .build(),
+    );
+
+    let aes_ccm = features::supported_on_both_page1(ctx, SecureConnectionsHostSupport).await
+        && features::supported_on_both_page2(ctx, SecureConnectionsControllerSupport).await;
+
+    ctx.send_hci_event(
+        hci::EncryptionChangeBuilder {
+            status: hci::ErrorCode::Success,
+            connection_handle: ctx.peer_handle(),
+            encryption_enabled: if aes_ccm {
+                hci::EncryptionEnabled::BrEdrAesCcm
+            } else {
+                hci::EncryptionEnabled::On
+            },
+        }
+        .build(),
+    );
+}
+
+#[cfg(test)]
+mod tests {
+    use super::initiate;
+    use super::respond;
+    use crate::procedure::Context;
+    use crate::test::{sequence, TestContext};
+
+    use crate::packets::hci::LMPFeaturesPage1Bits::SecureConnectionsHostSupport;
+    use crate::packets::hci::LMPFeaturesPage2Bits::SecureConnectionsControllerSupport;
+
+    #[test]
+    fn accept_encryption() {
+        let context = TestContext::new();
+        let procedure = respond;
+
+        include!("../../test/ENC/BV-01-C.in");
+    }
+
+    #[test]
+    fn initiate_encryption() {
+        let context = TestContext::new();
+        let procedure = initiate;
+
+        include!("../../test/ENC/BV-05-C.in");
+    }
+
+    #[test]
+    fn accept_aes_ccm_encryption_request() {
+        let context = TestContext::new()
+            .with_page_1_feature(SecureConnectionsHostSupport)
+            .with_page_2_feature(SecureConnectionsControllerSupport)
+            .with_peer_page_1_feature(SecureConnectionsHostSupport)
+            .with_peer_page_2_feature(SecureConnectionsControllerSupport);
+        let procedure = respond;
+
+        include!("../../test/ENC/BV-26-C.in");
+    }
+
+    #[test]
+    fn initiate_aes_ccm_encryption() {
+        let context = TestContext::new()
+            .with_page_1_feature(SecureConnectionsHostSupport)
+            .with_page_2_feature(SecureConnectionsControllerSupport)
+            .with_peer_page_1_feature(SecureConnectionsHostSupport)
+            .with_peer_page_2_feature(SecureConnectionsControllerSupport);
+        let procedure = initiate;
+
+        include!("../../test/ENC/BV-34-C.in");
+    }
+}
diff --git a/tools/rootcanal/lmp/src/procedure/features.rs b/tools/rootcanal/lmp/src/procedure/features.rs
new file mode 100644
index 0000000..d5a2eea
--- /dev/null
+++ b/tools/rootcanal/lmp/src/procedure/features.rs
@@ -0,0 +1,65 @@
+// Bluetooth Core, Vol 2, Part C, 4.3.4
+
+use num_traits::ToPrimitive;
+
+use crate::packets::lmp;
+use crate::procedure::Context;
+
+pub async fn initiate(ctx: &impl Context, features_page: u8) -> u64 {
+    ctx.send_lmp_packet(
+        lmp::FeaturesReqExtBuilder {
+            transaction_id: 0,
+            features_page,
+            max_supported_page: 1,
+            extended_features: ctx.extended_features(features_page).to_le_bytes(),
+        }
+        .build(),
+    );
+
+    u64::from_le_bytes(
+        *ctx.receive_lmp_packet::<lmp::FeaturesResExtPacket>().await.get_extended_features(),
+    )
+}
+
+pub async fn respond(ctx: &impl Context) {
+    let req = ctx.receive_lmp_packet::<lmp::FeaturesReqExtPacket>().await;
+    let features_page = req.get_features_page();
+
+    ctx.send_lmp_packet(
+        lmp::FeaturesResExtBuilder {
+            transaction_id: 0,
+            features_page,
+            max_supported_page: 1,
+            extended_features: ctx.extended_features(features_page).to_le_bytes(),
+        }
+        .build(),
+    );
+}
+
+async fn supported_on_both_page(ctx: &impl Context, page_number: u8, feature_mask: u64) -> bool {
+    let local_supported = ctx.extended_features(page_number) & feature_mask != 0;
+    // Lazy peer features
+    let peer_supported = async move {
+        let page = if let Some(page) = ctx.peer_extended_features(page_number) {
+            page
+        } else {
+            crate::procedure::features::initiate(ctx, page_number).await
+        };
+        page & feature_mask != 0
+    };
+    local_supported && peer_supported.await
+}
+
+pub async fn supported_on_both_page1(
+    ctx: &impl Context,
+    feature: crate::packets::hci::LMPFeaturesPage1Bits,
+) -> bool {
+    supported_on_both_page(ctx, 1, feature.to_u64().unwrap()).await
+}
+
+pub async fn supported_on_both_page2(
+    ctx: &impl Context,
+    feature: crate::packets::hci::LMPFeaturesPage2Bits,
+) -> bool {
+    supported_on_both_page(ctx, 2, feature.to_u64().unwrap()).await
+}
diff --git a/tools/rootcanal/lmp/src/procedure/legacy_pairing.rs b/tools/rootcanal/lmp/src/procedure/legacy_pairing.rs
new file mode 100644
index 0000000..5190542
--- /dev/null
+++ b/tools/rootcanal/lmp/src/procedure/legacy_pairing.rs
@@ -0,0 +1,93 @@
+// Bluetooth Core, Vol 2, Part C, 4.2.2
+
+use crate::packets::{hci, lmp};
+use crate::procedure::{authentication, Context};
+
+use crate::num_hci_command_packets;
+
+pub async fn initiate(ctx: &impl Context) -> Result<(), ()> {
+    ctx.send_hci_event(hci::PinCodeRequestBuilder { bd_addr: ctx.peer_address() }.build());
+
+    let _pin_code = ctx.receive_hci_command::<hci::PinCodeRequestReplyPacket>().await;
+
+    ctx.send_hci_event(
+        hci::PinCodeRequestReplyCompleteBuilder {
+            num_hci_command_packets: 1,
+            status: hci::ErrorCode::Success,
+            bd_addr: ctx.peer_address(),
+        }
+        .build(),
+    );
+
+    // TODO: handle result
+    let _ = ctx
+        .send_accepted_lmp_packet(
+            lmp::InRandBuilder { transaction_id: 0, random_number: [0; 16] }.build(),
+        )
+        .await;
+
+    ctx.send_lmp_packet(lmp::CombKeyBuilder { transaction_id: 0, random_number: [0; 16] }.build());
+
+    let _ = ctx.receive_lmp_packet::<lmp::CombKeyPacket>().await;
+
+    // Post pairing authentication
+    let link_key = [0; 16];
+    let auth_result = authentication::send_challenge(ctx, 0, link_key).await;
+    authentication::receive_challenge(ctx, link_key).await;
+
+    if auth_result.is_err() {
+        return Err(());
+    }
+    ctx.send_hci_event(
+        hci::LinkKeyNotificationBuilder {
+            bd_addr: ctx.peer_address(),
+            key_type: hci::KeyType::Combination,
+            link_key,
+        }
+        .build(),
+    );
+
+    Ok(())
+}
+
+pub async fn respond(ctx: &impl Context, _request: lmp::InRandPacket) -> Result<(), ()> {
+    ctx.send_hci_event(hci::PinCodeRequestBuilder { bd_addr: ctx.peer_address() }.build());
+
+    let _pin_code = ctx.receive_hci_command::<hci::PinCodeRequestReplyPacket>().await;
+
+    ctx.send_hci_event(
+        hci::PinCodeRequestReplyCompleteBuilder {
+            num_hci_command_packets,
+            status: hci::ErrorCode::Success,
+            bd_addr: ctx.peer_address(),
+        }
+        .build(),
+    );
+
+    ctx.send_lmp_packet(
+        lmp::AcceptedBuilder { transaction_id: 0, accepted_opcode: lmp::Opcode::InRand }.build(),
+    );
+
+    let _ = ctx.receive_lmp_packet::<lmp::CombKeyPacket>().await;
+
+    ctx.send_lmp_packet(lmp::CombKeyBuilder { transaction_id: 0, random_number: [0; 16] }.build());
+
+    // Post pairing authentication
+    let link_key = [0; 16];
+    authentication::receive_challenge(ctx, link_key).await;
+    let auth_result = authentication::send_challenge(ctx, 0, link_key).await;
+
+    if auth_result.is_err() {
+        return Err(());
+    }
+    ctx.send_hci_event(
+        hci::LinkKeyNotificationBuilder {
+            bd_addr: ctx.peer_address(),
+            key_type: hci::KeyType::Combination,
+            link_key,
+        }
+        .build(),
+    );
+
+    Ok(())
+}
diff --git a/tools/rootcanal/lmp/src/procedure/mod.rs b/tools/rootcanal/lmp/src/procedure/mod.rs
new file mode 100644
index 0000000..91ea084
--- /dev/null
+++ b/tools/rootcanal/lmp/src/procedure/mod.rs
@@ -0,0 +1,141 @@
+use std::convert::TryFrom;
+use std::future::Future;
+use std::pin::Pin;
+use std::task::{self, Poll};
+
+use crate::ec::PrivateKey;
+use crate::packets::{hci, lmp};
+
+pub trait Context {
+    fn poll_hci_command<C: TryFrom<hci::CommandPacket>>(&self) -> Poll<C>;
+    fn poll_lmp_packet<P: TryFrom<lmp::PacketPacket>>(&self) -> Poll<P>;
+
+    fn send_hci_event<E: Into<hci::EventPacket>>(&self, event: E);
+    fn send_lmp_packet<P: Into<lmp::PacketPacket>>(&self, packet: P);
+
+    fn peer_address(&self) -> hci::Address;
+    fn peer_handle(&self) -> u16;
+
+    fn peer_extended_features(&self, _features_page: u8) -> Option<u64> {
+        None
+    }
+
+    fn extended_features(&self, features_page: u8) -> u64;
+
+    fn receive_hci_command<C: TryFrom<hci::CommandPacket>>(&self) -> ReceiveFuture<'_, Self, C> {
+        ReceiveFuture(Self::poll_hci_command, self)
+    }
+
+    fn receive_lmp_packet<P: TryFrom<lmp::PacketPacket>>(&self) -> ReceiveFuture<'_, Self, P> {
+        ReceiveFuture(Self::poll_lmp_packet, self)
+    }
+
+    fn send_accepted_lmp_packet<P: Into<lmp::PacketPacket>>(
+        &self,
+        packet: P,
+    ) -> SendAcceptedLmpPacketFuture<'_, Self> {
+        let packet = packet.into();
+        let opcode = packet.get_opcode();
+        self.send_lmp_packet(packet);
+
+        SendAcceptedLmpPacketFuture(self, opcode)
+    }
+
+    fn get_private_key(&self) -> Option<PrivateKey> {
+        None
+    }
+
+    fn set_private_key(&self, _key: &PrivateKey) {}
+}
+
+/// Future for Context::receive_hci_command and Context::receive_lmp_packet
+pub struct ReceiveFuture<'a, C: ?Sized, P>(fn(&'a C) -> Poll<P>, &'a C);
+
+impl<'a, C, O> Future for ReceiveFuture<'a, C, O>
+where
+    C: Context,
+{
+    type Output = O;
+
+    fn poll(self: Pin<&mut Self>, _cx: &mut task::Context<'_>) -> Poll<Self::Output> {
+        (self.0)(self.1)
+    }
+}
+
+/// Future for Context::receive_hci_command and Context::receive_lmp_packet
+pub struct SendAcceptedLmpPacketFuture<'a, C: ?Sized>(&'a C, lmp::Opcode);
+
+impl<'a, C> Future for SendAcceptedLmpPacketFuture<'a, C>
+where
+    C: Context,
+{
+    type Output = Result<(), u8>;
+
+    fn poll(self: Pin<&mut Self>, _cx: &mut task::Context<'_>) -> Poll<Self::Output> {
+        let accepted = self.0.poll_lmp_packet::<lmp::AcceptedPacket>();
+        if let Poll::Ready(accepted) = accepted {
+            if accepted.get_accepted_opcode() == self.1 {
+                return Poll::Ready(Ok(()));
+            }
+        }
+
+        let not_accepted = self.0.poll_lmp_packet::<lmp::NotAcceptedPacket>();
+        if let Poll::Ready(not_accepted) = not_accepted {
+            if not_accepted.get_not_accepted_opcode() == self.1 {
+                return Poll::Ready(Err(not_accepted.get_error_code()));
+            }
+        }
+
+        Poll::Pending
+    }
+}
+
+pub mod authentication;
+mod encryption;
+pub mod features;
+pub mod legacy_pairing;
+pub mod secure_simple_pairing;
+
+macro_rules! run_procedures {
+    ($(
+        $idx:tt { $procedure:expr }
+    )+) => {{
+        $(
+            let $idx = async { loop { $procedure.await; } };
+            crate::future::pin!($idx);
+        )+
+
+        use std::future::Future;
+        use std::pin::Pin;
+        use std::task::{Poll, Context};
+
+        #[allow(non_camel_case_types)]
+        struct Join<'a, $($idx),+> {
+            $($idx: Pin<&'a mut $idx>),+
+        }
+
+        #[allow(non_camel_case_types)]
+        impl<'a, $($idx: Future<Output = ()>),+> Future for Join<'a, $($idx),+> {
+            type Output = ();
+
+            fn poll(mut self: Pin<&mut Self>, cx: &mut Context<'_>) -> Poll<()> {
+                $(assert!(self.$idx.as_mut().poll(cx).is_pending());)+
+                Poll::Pending
+            }
+        }
+
+        Join {
+            $($idx),+
+        }.await
+    }}
+}
+
+pub async fn run(ctx: impl Context) {
+    run_procedures! {
+        a { authentication::initiate(&ctx) }
+        b { authentication::respond(&ctx) }
+        c { encryption::initiate(&ctx) }
+        d { encryption::respond(&ctx) }
+        e { features::respond(&ctx) }
+    }
+}
diff --git a/tools/rootcanal/lmp/src/procedure/secure_simple_pairing.rs b/tools/rootcanal/lmp/src/procedure/secure_simple_pairing.rs
new file mode 100644
index 0000000..229961d
--- /dev/null
+++ b/tools/rootcanal/lmp/src/procedure/secure_simple_pairing.rs
@@ -0,0 +1,993 @@
+// Bluetooth Core, Vol 2, Part C, 4.2.7
+
+use std::convert::TryInto;
+
+use num_traits::{FromPrimitive, ToPrimitive};
+
+use crate::ec::{DhKey, PrivateKey, PublicKey};
+use crate::either::Either;
+use crate::packets::{hci, lmp};
+use crate::procedure::{authentication, features, Context};
+
+use crate::num_hci_command_packets;
+
+fn has_mitm(requirements: hci::AuthenticationRequirements) -> bool {
+    use hci::AuthenticationRequirements::*;
+
+    match requirements {
+        NoBonding | DedicatedBonding | GeneralBonding => false,
+        NoBondingMitmProtection | DedicatedBondingMitmProtection | GeneralBondingMitmProtection => {
+            true
+        }
+    }
+}
+
+enum AuthenticationMethod {
+    OutOfBand,
+    NumericComparaisonJustWork,
+    NumericComparaisonUserConfirm,
+    PasskeyEntry,
+}
+
+#[derive(Clone, Copy)]
+struct AuthenticationParams {
+    io_capability: hci::IoCapability,
+    oob_data_present: hci::OobDataPresent,
+    authentication_requirements: hci::AuthenticationRequirements,
+}
+
+// Bluetooth Core, Vol 2, Part C, 4.2.7.3
+fn authentication_method(
+    initiator: AuthenticationParams,
+    responder: AuthenticationParams,
+) -> AuthenticationMethod {
+    use hci::IoCapability::*;
+    use hci::OobDataPresent::*;
+
+    if initiator.oob_data_present != NotPresent || responder.oob_data_present != NotPresent {
+        AuthenticationMethod::OutOfBand
+    } else if !has_mitm(initiator.authentication_requirements)
+        && !has_mitm(responder.authentication_requirements)
+    {
+        AuthenticationMethod::NumericComparaisonJustWork
+    } else if (initiator.io_capability == KeyboardOnly
+        && responder.io_capability != NoInputNoOutput)
+        || (responder.io_capability == KeyboardOnly && initiator.io_capability != NoInputNoOutput)
+    {
+        AuthenticationMethod::PasskeyEntry
+    } else if initiator.io_capability == DisplayYesNo && responder.io_capability == DisplayYesNo {
+        AuthenticationMethod::NumericComparaisonUserConfirm
+    } else {
+        AuthenticationMethod::NumericComparaisonJustWork
+    }
+}
+
+// Bluetooth Core, Vol 3, Part C, 5.2.2.6
+fn link_key_type(auth_method: AuthenticationMethod, dh_key: DhKey) -> hci::KeyType {
+    use hci::KeyType::*;
+    use AuthenticationMethod::*;
+
+    match (dh_key, auth_method) {
+        (DhKey::P256(_), OutOfBand | PasskeyEntry | NumericComparaisonUserConfirm) => {
+            AuthenticatedP256
+        }
+        (DhKey::P192(_), OutOfBand | PasskeyEntry | NumericComparaisonUserConfirm) => {
+            AuthenticatedP192
+        }
+        (DhKey::P256(_), NumericComparaisonJustWork) => UnauthenticatedP256,
+        (DhKey::P192(_), NumericComparaisonJustWork) => UnauthenticatedP192,
+    }
+}
+
+async fn send_public_key(ctx: &impl Context, transaction_id: u8, public_key: PublicKey) {
+    // TODO: handle error
+    let _ = ctx
+        .send_accepted_lmp_packet(
+            lmp::EncapsulatedHeaderBuilder {
+                transaction_id,
+                major_type: 1,
+                minor_type: 1,
+                payload_length: public_key.size() as u8,
+            }
+            .build(),
+        )
+        .await;
+
+    for chunk in public_key.as_slice().chunks(16) {
+        // TODO: handle error
+        let _ = ctx
+            .send_accepted_lmp_packet(
+                lmp::EncapsulatedPayloadBuilder { transaction_id, data: chunk.try_into().unwrap() }
+                    .build(),
+            )
+            .await;
+    }
+}
+
+async fn receive_public_key(ctx: &impl Context, transaction_id: u8) -> PublicKey {
+    let key_size: usize =
+        ctx.receive_lmp_packet::<lmp::EncapsulatedHeaderPacket>().await.get_payload_length().into();
+    let mut key = PublicKey::new(key_size).unwrap();
+
+    ctx.send_lmp_packet(
+        lmp::AcceptedBuilder { transaction_id, accepted_opcode: lmp::Opcode::EncapsulatedHeader }
+            .build(),
+    );
+    for chunk in key.as_mut_slice().chunks_mut(16) {
+        let payload = ctx.receive_lmp_packet::<lmp::EncapsulatedPayloadPacket>().await;
+        chunk.copy_from_slice(payload.get_data().as_slice());
+        ctx.send_lmp_packet(
+            lmp::AcceptedBuilder {
+                transaction_id,
+                accepted_opcode: lmp::Opcode::EncapsulatedPayload,
+            }
+            .build(),
+        );
+    }
+
+    key
+}
+
+const COMMITMENT_VALUE_SIZE: usize = 16;
+const NONCE_SIZE: usize = 16;
+
+async fn receive_commitment(ctx: &impl Context, skip_first: bool) {
+    let commitment_value = [0; COMMITMENT_VALUE_SIZE];
+
+    if !skip_first {
+        let confirm = ctx.receive_lmp_packet::<lmp::SimplePairingConfirmPacket>().await;
+        if confirm.get_commitment_value() != &commitment_value {
+            todo!();
+        }
+    }
+
+    ctx.send_lmp_packet(
+        lmp::SimplePairingConfirmBuilder { transaction_id: 0, commitment_value }.build(),
+    );
+
+    let _pairing_number = ctx.receive_lmp_packet::<lmp::SimplePairingNumberPacket>().await;
+    // TODO: check pairing number
+    ctx.send_lmp_packet(
+        lmp::AcceptedBuilder {
+            transaction_id: 0,
+            accepted_opcode: lmp::Opcode::SimplePairingNumber,
+        }
+        .build(),
+    );
+
+    let nonce = [0; NONCE_SIZE];
+
+    // TODO: handle error
+    let _ = ctx
+        .send_accepted_lmp_packet(
+            lmp::SimplePairingNumberBuilder { transaction_id: 0, nonce }.build(),
+        )
+        .await;
+}
+
+async fn send_commitment(ctx: &impl Context, skip_first: bool) {
+    let commitment_value = [0; COMMITMENT_VALUE_SIZE];
+
+    if !skip_first {
+        ctx.send_lmp_packet(
+            lmp::SimplePairingConfirmBuilder { transaction_id: 0, commitment_value }.build(),
+        );
+    }
+
+    let confirm = ctx.receive_lmp_packet::<lmp::SimplePairingConfirmPacket>().await;
+
+    if confirm.get_commitment_value() != &commitment_value {
+        todo!();
+    }
+    let nonce = [0; NONCE_SIZE];
+
+    // TODO: handle error
+    let _ = ctx
+        .send_accepted_lmp_packet(
+            lmp::SimplePairingNumberBuilder { transaction_id: 0, nonce }.build(),
+        )
+        .await;
+
+    let _pairing_number = ctx.receive_lmp_packet::<lmp::SimplePairingNumberPacket>().await;
+    // TODO: check pairing number
+    ctx.send_lmp_packet(
+        lmp::AcceptedBuilder {
+            transaction_id: 0,
+            accepted_opcode: lmp::Opcode::SimplePairingNumber,
+        }
+        .build(),
+    );
+}
+
+async fn user_confirmation_request(ctx: &impl Context) -> Result<(), ()> {
+    ctx.send_hci_event(
+        hci::UserConfirmationRequestBuilder { bd_addr: ctx.peer_address(), numeric_value: 0 }
+            .build(),
+    );
+
+    match ctx
+        .receive_hci_command::<Either<
+            hci::UserConfirmationRequestReplyPacket,
+            hci::UserConfirmationRequestNegativeReplyPacket,
+        >>()
+        .await
+    {
+        Either::Left(_) => {
+            ctx.send_hci_event(
+                hci::UserConfirmationRequestReplyCompleteBuilder {
+                    num_hci_command_packets,
+                    status: hci::ErrorCode::Success,
+                    bd_addr: ctx.peer_address(),
+                }
+                .build(),
+            );
+            Ok(())
+        }
+        Either::Right(_) => {
+            ctx.send_hci_event(
+                hci::UserConfirmationRequestNegativeReplyCompleteBuilder {
+                    num_hci_command_packets,
+                    status: hci::ErrorCode::Success,
+                    bd_addr: ctx.peer_address(),
+                }
+                .build(),
+            );
+            Err(())
+        }
+    }
+}
+
+async fn user_passkey_request(ctx: &impl Context) -> Result<(), ()> {
+    ctx.send_hci_event(hci::UserPasskeyRequestBuilder { bd_addr: ctx.peer_address() }.build());
+
+    loop {
+        match ctx
+            .receive_hci_command::<Either<
+                Either<
+                    hci::UserPasskeyRequestReplyPacket,
+                    hci::UserPasskeyRequestNegativeReplyPacket,
+                >,
+                hci::SendKeypressNotificationPacket,
+            >>()
+            .await
+        {
+            Either::Left(Either::Left(_)) => {
+                ctx.send_hci_event(
+                    hci::UserPasskeyRequestReplyCompleteBuilder {
+                        num_hci_command_packets,
+                        status: hci::ErrorCode::Success,
+                        bd_addr: ctx.peer_address(),
+                    }
+                    .build(),
+                );
+                return Ok(());
+            }
+            Either::Left(Either::Right(_)) => {
+                ctx.send_hci_event(
+                    hci::UserPasskeyRequestNegativeReplyCompleteBuilder {
+                        num_hci_command_packets,
+                        status: hci::ErrorCode::Success,
+                        bd_addr: ctx.peer_address(),
+                    }
+                    .build(),
+                );
+                return Err(());
+            }
+            Either::Right(_) => {
+                ctx.send_hci_event(
+                    hci::SendKeypressNotificationCompleteBuilder {
+                        num_hci_command_packets,
+                        status: hci::ErrorCode::Success,
+                        bd_addr: ctx.peer_address(),
+                    }
+                    .build(),
+                );
+                // TODO: send LmpKeypressNotification
+            }
+        }
+    }
+}
+
+async fn remote_oob_data_request(ctx: &impl Context) -> Result<(), ()> {
+    ctx.send_hci_event(hci::RemoteOobDataRequestBuilder { bd_addr: ctx.peer_address() }.build());
+
+    match ctx
+        .receive_hci_command::<Either<
+            hci::RemoteOobDataRequestReplyPacket,
+            hci::RemoteOobDataRequestNegativeReplyPacket,
+        >>()
+        .await
+    {
+        Either::Left(_) => {
+            ctx.send_hci_event(
+                hci::RemoteOobDataRequestReplyCompleteBuilder {
+                    num_hci_command_packets,
+                    status: hci::ErrorCode::Success,
+                    bd_addr: ctx.peer_address(),
+                }
+                .build(),
+            );
+            Ok(())
+        }
+        Either::Right(_) => {
+            ctx.send_hci_event(
+                hci::RemoteOobDataRequestNegativeReplyCompleteBuilder {
+                    num_hci_command_packets,
+                    status: hci::ErrorCode::Success,
+                    bd_addr: ctx.peer_address(),
+                }
+                .build(),
+            );
+            Err(())
+        }
+    }
+}
+
+const CONFIRMATION_VALUE_SIZE: usize = 16;
+const PASSKEY_ENTRY_REPEAT_NUMBER: usize = 20;
+
+pub async fn initiate(ctx: &impl Context) -> Result<(), ()> {
+    let initiator = {
+        ctx.send_hci_event(hci::IoCapabilityRequestBuilder { bd_addr: ctx.peer_address() }.build());
+        let reply = ctx.receive_hci_command::<hci::IoCapabilityRequestReplyPacket>().await;
+        ctx.send_hci_event(
+            hci::IoCapabilityRequestReplyCompleteBuilder {
+                num_hci_command_packets,
+                status: hci::ErrorCode::Success,
+                bd_addr: ctx.peer_address(),
+            }
+            .build(),
+        );
+
+        ctx.send_lmp_packet(
+            lmp::IoCapabilityReqBuilder {
+                transaction_id: 0,
+                io_capabilities: reply.get_io_capability().to_u8().unwrap(),
+                oob_authentication_data: reply.get_oob_present().to_u8().unwrap(),
+                authentication_requirement: reply
+                    .get_authentication_requirements()
+                    .to_u8()
+                    .unwrap(),
+            }
+            .build(),
+        );
+
+        AuthenticationParams {
+            io_capability: reply.get_io_capability(),
+            oob_data_present: reply.get_oob_present(),
+            authentication_requirements: reply.get_authentication_requirements(),
+        }
+    };
+    let responder = {
+        let response = ctx.receive_lmp_packet::<lmp::IoCapabilityResPacket>().await;
+
+        let io_capability = hci::IoCapability::from_u8(response.get_io_capabilities()).unwrap();
+        let oob_data_present =
+            hci::OobDataPresent::from_u8(response.get_oob_authentication_data()).unwrap();
+        let authentication_requirements =
+            hci::AuthenticationRequirements::from_u8(response.get_authentication_requirement())
+                .unwrap();
+
+        ctx.send_hci_event(
+            hci::IoCapabilityResponseBuilder {
+                bd_addr: ctx.peer_address(),
+                io_capability,
+                oob_data_present,
+                authentication_requirements,
+            }
+            .build(),
+        );
+
+        AuthenticationParams { io_capability, oob_data_present, authentication_requirements }
+    };
+
+    // Public Key Exchange
+    let dh_key = {
+        use hci::LMPFeaturesPage1Bits::SecureConnectionsHostSupport;
+
+        let private_key =
+            if features::supported_on_both_page1(ctx, SecureConnectionsHostSupport).await {
+                PrivateKey::generate_p256()
+            } else {
+                PrivateKey::generate_p192()
+            };
+        ctx.set_private_key(&private_key);
+        let local_public_key = private_key.derive();
+        send_public_key(ctx, 0, local_public_key).await;
+        let peer_public_key = receive_public_key(ctx, 0).await;
+        private_key.shared_secret(peer_public_key)
+    };
+
+    // Authentication Stage 1
+    let auth_method = authentication_method(initiator, responder);
+    let result: Result<(), ()> = async {
+        match auth_method {
+            AuthenticationMethod::NumericComparaisonJustWork
+            | AuthenticationMethod::NumericComparaisonUserConfirm => {
+                send_commitment(ctx, true).await;
+
+                user_confirmation_request(ctx).await?;
+                Ok(())
+            }
+            AuthenticationMethod::PasskeyEntry => {
+                if initiator.io_capability == hci::IoCapability::KeyboardOnly {
+                    user_passkey_request(ctx).await?;
+                } else {
+                    ctx.send_hci_event(
+                        hci::UserPasskeyNotificationBuilder {
+                            bd_addr: ctx.peer_address(),
+                            passkey: 0,
+                        }
+                        .build(),
+                    );
+                }
+                for _ in 0..PASSKEY_ENTRY_REPEAT_NUMBER {
+                    send_commitment(ctx, false).await;
+                }
+                Ok(())
+            }
+            AuthenticationMethod::OutOfBand => {
+                if initiator.oob_data_present != hci::OobDataPresent::NotPresent {
+                    remote_oob_data_request(ctx).await?;
+                }
+
+                send_commitment(ctx, false).await;
+                Ok(())
+            }
+        }
+    }
+    .await;
+
+    if result.is_err() {
+        ctx.send_lmp_packet(lmp::NumericComparaisonFailedBuilder { transaction_id: 0 }.build());
+        ctx.send_hci_event(
+            hci::SimplePairingCompleteBuilder {
+                status: hci::ErrorCode::AuthenticationFailure,
+                bd_addr: ctx.peer_address(),
+            }
+            .build(),
+        );
+        return Err(());
+    }
+
+    // Authentication Stage 2
+    {
+        let confirmation_value = [0; CONFIRMATION_VALUE_SIZE];
+
+        let result = ctx
+            .send_accepted_lmp_packet(
+                lmp::DhkeyCheckBuilder { transaction_id: 0, confirmation_value }.build(),
+            )
+            .await;
+
+        if result.is_err() {
+            ctx.send_hci_event(
+                hci::SimplePairingCompleteBuilder {
+                    status: hci::ErrorCode::AuthenticationFailure,
+                    bd_addr: ctx.peer_address(),
+                }
+                .build(),
+            );
+            return Err(());
+        }
+    }
+
+    {
+        // TODO: check dhkey
+        let _dhkey = ctx.receive_lmp_packet::<lmp::DhkeyCheckPacket>().await;
+        ctx.send_lmp_packet(
+            lmp::AcceptedBuilder { transaction_id: 0, accepted_opcode: lmp::Opcode::DhkeyCheck }
+                .build(),
+        );
+    }
+
+    ctx.send_hci_event(
+        hci::SimplePairingCompleteBuilder {
+            status: hci::ErrorCode::Success,
+            bd_addr: ctx.peer_address(),
+        }
+        .build(),
+    );
+
+    // Link Key Calculation
+    let link_key = [0; 16];
+    let auth_result = authentication::send_challenge(ctx, 0, link_key).await;
+    authentication::receive_challenge(ctx, link_key).await;
+
+    if auth_result.is_err() {
+        return Err(());
+    }
+
+    ctx.send_hci_event(
+        hci::LinkKeyNotificationBuilder {
+            bd_addr: ctx.peer_address(),
+            key_type: link_key_type(auth_method, dh_key),
+            link_key,
+        }
+        .build(),
+    );
+
+    Ok(())
+}
+
+pub async fn respond(ctx: &impl Context, request: lmp::IoCapabilityReqPacket) -> Result<(), ()> {
+    let initiator = {
+        let io_capability = hci::IoCapability::from_u8(request.get_io_capabilities()).unwrap();
+        let oob_data_present =
+            hci::OobDataPresent::from_u8(request.get_oob_authentication_data()).unwrap();
+        let authentication_requirements =
+            hci::AuthenticationRequirements::from_u8(request.get_authentication_requirement())
+                .unwrap();
+
+        ctx.send_hci_event(
+            hci::IoCapabilityResponseBuilder {
+                bd_addr: ctx.peer_address(),
+                io_capability,
+                oob_data_present,
+                authentication_requirements,
+            }
+            .build(),
+        );
+
+        AuthenticationParams { io_capability, oob_data_present, authentication_requirements }
+    };
+
+    let responder = {
+        ctx.send_hci_event(hci::IoCapabilityRequestBuilder { bd_addr: ctx.peer_address() }.build());
+        let reply = ctx.receive_hci_command::<hci::IoCapabilityRequestReplyPacket>().await;
+        ctx.send_hci_event(
+            hci::IoCapabilityRequestReplyCompleteBuilder {
+                num_hci_command_packets,
+                status: hci::ErrorCode::Success,
+                bd_addr: ctx.peer_address(),
+            }
+            .build(),
+        );
+
+        ctx.send_lmp_packet(
+            lmp::IoCapabilityResBuilder {
+                transaction_id: 0,
+                io_capabilities: reply.get_io_capability().to_u8().unwrap(),
+                oob_authentication_data: reply.get_oob_present().to_u8().unwrap(),
+                authentication_requirement: reply
+                    .get_authentication_requirements()
+                    .to_u8()
+                    .unwrap(),
+            }
+            .build(),
+        );
+        AuthenticationParams {
+            io_capability: reply.get_io_capability(),
+            oob_data_present: reply.get_oob_present(),
+            authentication_requirements: reply.get_authentication_requirements(),
+        }
+    };
+
+    // Public Key Exchange
+    let dh_key = {
+        let peer_public_key = receive_public_key(ctx, 0).await;
+        let private_key = match peer_public_key {
+            PublicKey::P192(_) => PrivateKey::generate_p192(),
+            PublicKey::P256(_) => PrivateKey::generate_p256(),
+        };
+        ctx.set_private_key(&private_key);
+        let local_public_key = private_key.derive();
+        send_public_key(ctx, 0, local_public_key).await;
+        private_key.shared_secret(peer_public_key)
+    };
+
+    // Authentication Stage 1
+    let auth_method = authentication_method(initiator, responder);
+    let negative_user_confirmation = match auth_method {
+        AuthenticationMethod::NumericComparaisonJustWork
+        | AuthenticationMethod::NumericComparaisonUserConfirm => {
+            receive_commitment(ctx, true).await;
+
+            let user_confirmation = user_confirmation_request(ctx).await;
+            user_confirmation.is_err()
+        }
+        AuthenticationMethod::PasskeyEntry => {
+            if responder.io_capability == hci::IoCapability::KeyboardOnly {
+                // TODO: handle error
+                let _user_passkey = user_passkey_request(ctx).await;
+            } else {
+                ctx.send_hci_event(
+                    hci::UserPasskeyNotificationBuilder { bd_addr: ctx.peer_address(), passkey: 0 }
+                        .build(),
+                );
+            }
+            for _ in 0..PASSKEY_ENTRY_REPEAT_NUMBER {
+                receive_commitment(ctx, false).await;
+            }
+            false
+        }
+        AuthenticationMethod::OutOfBand => {
+            if responder.oob_data_present != hci::OobDataPresent::NotPresent {
+                // TODO: handle error
+                let _remote_oob_data = remote_oob_data_request(ctx).await;
+            }
+
+            receive_commitment(ctx, false).await;
+            false
+        }
+    };
+
+    let _dhkey = match ctx
+        .receive_lmp_packet::<Either<lmp::NumericComparaisonFailedPacket, lmp::DhkeyCheckPacket>>()
+        .await
+    {
+        Either::Left(_) => {
+            // Numeric comparaison failed
+            ctx.send_hci_event(
+                hci::SimplePairingCompleteBuilder {
+                    status: hci::ErrorCode::AuthenticationFailure,
+                    bd_addr: ctx.peer_address(),
+                }
+                .build(),
+            );
+            return Err(());
+        }
+        Either::Right(dhkey) => dhkey,
+    };
+
+    if negative_user_confirmation {
+        ctx.send_lmp_packet(
+            lmp::NotAcceptedBuilder {
+                transaction_id: 0,
+                not_accepted_opcode: lmp::Opcode::DhkeyCheck,
+                error_code: hci::ErrorCode::AuthenticationFailure.to_u8().unwrap(),
+            }
+            .build(),
+        );
+        ctx.send_hci_event(
+            hci::SimplePairingCompleteBuilder {
+                status: hci::ErrorCode::AuthenticationFailure,
+                bd_addr: ctx.peer_address(),
+            }
+            .build(),
+        );
+        return Err(());
+    }
+    // Authentication Stage 2
+
+    let confirmation_value = [0; CONFIRMATION_VALUE_SIZE];
+
+    ctx.send_lmp_packet(
+        lmp::AcceptedBuilder { transaction_id: 0, accepted_opcode: lmp::Opcode::DhkeyCheck }
+            .build(),
+    );
+
+    // TODO: handle error
+    let _ = ctx
+        .send_accepted_lmp_packet(
+            lmp::DhkeyCheckBuilder { transaction_id: 0, confirmation_value }.build(),
+        )
+        .await;
+
+    ctx.send_hci_event(
+        hci::SimplePairingCompleteBuilder {
+            status: hci::ErrorCode::Success,
+            bd_addr: ctx.peer_address(),
+        }
+        .build(),
+    );
+
+    // Link Key Calculation
+    let link_key = [0; 16];
+    authentication::receive_challenge(ctx, link_key).await;
+    let auth_result = authentication::send_challenge(ctx, 0, link_key).await;
+
+    if auth_result.is_err() {
+        return Err(());
+    }
+
+    ctx.send_hci_event(
+        hci::LinkKeyNotificationBuilder {
+            bd_addr: ctx.peer_address(),
+            key_type: link_key_type(auth_method, dh_key),
+            link_key,
+        }
+        .build(),
+    );
+
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use num_traits::ToPrimitive;
+
+    use crate::ec::PrivateKey;
+    use crate::procedure::Context;
+    use crate::test::{sequence, TestContext};
+    // simple pairing is part of authentication procedure
+    use super::super::authentication::initiate;
+    use super::super::authentication::respond;
+
+    fn local_p192_public_key(context: &crate::test::TestContext) -> [[u8; 16]; 3] {
+        let mut buf = [[0; 16], [0; 16], [0; 16]];
+        if let Some(key) = context.get_private_key() {
+            for (dst, src) in buf.iter_mut().zip(key.derive().as_slice().chunks(16)) {
+                dst.copy_from_slice(src);
+            }
+        }
+        buf
+    }
+
+    fn peer_p192_public_key() -> [[u8; 16]; 3] {
+        let mut buf = [[0; 16], [0; 16], [0; 16]];
+        let key = PrivateKey::generate_p192().derive();
+        for (dst, src) in buf.iter_mut().zip(key.as_slice().chunks(16)) {
+            dst.copy_from_slice(src);
+        }
+        buf
+    }
+
+    #[test]
+    fn initiate_size() {
+        let context = crate::test::TestContext::new();
+        let procedure = super::initiate(&context);
+
+        fn assert_max_size<T>(_value: T, limit: usize) {
+            let type_name = std::any::type_name::<T>();
+            let size = std::mem::size_of::<T>();
+            println!("Size of {}: {}", type_name, size);
+            assert!(size < limit)
+        }
+
+        assert_max_size(procedure, 512);
+    }
+
+    #[test]
+    fn numeric_comparaison_initiator_success() {
+        let context = TestContext::new();
+        let procedure = initiate;
+
+        include!("../../test/SP/BV-06-C.in");
+    }
+
+    #[test]
+    fn numeric_comparaison_responder_success() {
+        let context = TestContext::new();
+        let procedure = respond;
+
+        include!("../../test/SP/BV-07-C.in");
+    }
+
+    #[test]
+    fn numeric_comparaison_initiator_failure_on_initiating_side() {
+        let context = TestContext::new();
+        let procedure = initiate;
+
+        include!("../../test/SP/BV-08-C.in");
+    }
+
+    #[test]
+    fn numeric_comparaison_responder_failure_on_initiating_side() {
+        let context = TestContext::new();
+        let procedure = respond;
+
+        include!("../../test/SP/BV-09-C.in");
+    }
+
+    #[test]
+    fn numeric_comparaison_initiator_failure_on_responding_side() {
+        let context = TestContext::new();
+        let procedure = initiate;
+
+        include!("../../test/SP/BV-10-C.in");
+    }
+
+    #[test]
+    fn numeric_comparaison_responder_failure_on_responding_side() {
+        let context = TestContext::new();
+        let procedure = respond;
+
+        include!("../../test/SP/BV-11-C.in");
+    }
+
+    #[test]
+    fn passkey_entry_initiator_success() {
+        let context = TestContext::new();
+        let procedure = initiate;
+
+        include!("../../test/SP/BV-12-C.in");
+    }
+
+    #[test]
+    fn passkey_entry_responder_success() {
+        let context = TestContext::new();
+        let procedure = respond;
+
+        include!("../../test/SP/BV-13-C.in");
+    }
+
+    #[test]
+    #[should_panic] // TODO: make the test pass
+    fn passkey_entry_initiator_failure_on_initiating_side() {
+        let context = TestContext::new();
+        let procedure = initiate;
+
+        include!("../../test/SP/BV-14-C.in");
+    }
+
+    #[test]
+    #[should_panic] // TODO: make the test pass
+    fn passkey_entry_responder_failure_on_initiating_side() {
+        let context = TestContext::new();
+        let procedure = respond;
+
+        include!("../../test/SP/BV-15-C.in");
+    }
+
+    #[test]
+    #[should_panic] // TODO: make the test pass
+    fn passkey_entry_initiator_failure_on_responding_side() {
+        let context = TestContext::new();
+        let procedure = initiate;
+
+        include!("../../test/SP/BV-16-C.in");
+    }
+
+    #[test]
+    #[should_panic] // TODO: make the test pass
+    fn passkey_entry_responder_failure_on_responding_side() {
+        let context = TestContext::new();
+        let procedure = respond;
+
+        include!("../../test/SP/BV-17-C.in");
+    }
+
+    #[test]
+    #[should_panic] // TODO: make the test pass
+    fn oob_protocol_initiator_iut_with_oob_auth_data_success() {
+        let context = TestContext::new();
+        let procedure = initiate;
+
+        include!("../../test/SP/BV-18-C.in");
+    }
+
+    #[test]
+    #[should_panic] // TODO: make the test pass
+    fn oob_protocol_responder_iut_with_oob_auth_data_success() {
+        let context = TestContext::new();
+        let procedure = respond;
+
+        include!("../../test/SP/BV-19-C.in");
+    }
+
+    #[test]
+    #[should_panic] // TODO: make the test pass
+    fn oob_protocol_initiator_lower_tester_with_oob_auth_data_success() {
+        let context = TestContext::new();
+        let procedure = initiate;
+
+        include!("../../test/SP/BV-20-C.in");
+    }
+
+    #[test]
+    #[should_panic] // TODO: make the test pass
+    fn oob_protocol_responder_lower_tester_with_oob_auth_data_success() {
+        let context = TestContext::new();
+        let procedure = respond;
+
+        include!("../../test/SP/BV-21-C.in");
+    }
+
+    #[test]
+    #[should_panic] // TODO: make the test pass
+    fn oob_protocol_initiator_iut_and_lower_tester_with_oob_auth_data_success() {
+        let context = TestContext::new();
+        let procedure = initiate;
+
+        include!("../../test/SP/BV-22-C.in");
+    }
+
+    #[test]
+    #[should_panic] // TODO: make the test pass
+    fn oob_protocol_responder_iut_and_lower_tester_with_oob_auth_data_success() {
+        let context = TestContext::new();
+        let procedure = respond;
+
+        include!("../../test/SP/BV-23-C.in");
+    }
+
+    #[test]
+    #[should_panic] // TODO: make the test pass
+    fn oob_protocol_initiator_iut_with_oob_auth_data_failure() {
+        let context = TestContext::new();
+        let procedure = initiate;
+
+        include!("../../test/SP/BV-24-C.in");
+    }
+
+    #[test]
+    #[should_panic] // TODO: make the test pass
+    fn oob_protocol_responder_iut_with_oob_auth_data_failure() {
+        let context = TestContext::new();
+        let procedure = respond;
+
+        include!("../../test/SP/BV-25-C.in");
+    }
+
+    #[test]
+    #[should_panic] // TODO: make the test pass
+    fn oob_protocol_initiator_lower_tester_with_oob_auth_data_failure() {
+        let context = TestContext::new();
+        let procedure = initiate;
+
+        include!("../../test/SP/BV-26-C.in");
+    }
+
+    #[test]
+    #[should_panic] // TODO: make the test pass
+    fn oob_protocol_responder_lower_tester_with_oob_auth_data_failure() {
+        let context = TestContext::new();
+        let procedure = respond;
+
+        include!("../../test/SP/BV-27-C.in");
+    }
+
+    #[test]
+    #[should_panic] // TODO: make the test pass
+    fn secure_simple_pairing_failed_responder() {
+        let context = TestContext::new();
+        let procedure = respond;
+
+        include!("../../test/SP/BV-30-C.in");
+    }
+
+    #[test]
+    #[should_panic] // TODO: make the test pass
+    fn host_rejects_secure_simple_pairing_initiator() {
+        let context = TestContext::new();
+        let procedure = initiate;
+
+        include!("../../test/SP/BV-31-C.in");
+    }
+
+    #[test]
+    #[should_panic] // TODO: make the test pass
+    fn host_rejects_secure_simple_pairing_responder() {
+        let context = TestContext::new();
+        let procedure = respond;
+
+        include!("../../test/SP/BV-32-C.in");
+    }
+
+    #[test]
+    #[should_panic] // TODO: make the test pass
+    fn passkey_entry_with_keypress_notification_initiator_success() {
+        let context = TestContext::new();
+        let procedure = initiate;
+
+        include!("../../test/SP/BV-33-C.in");
+    }
+
+    #[test]
+    #[should_panic] // TODO: make the test pass
+    fn passkey_entry_with_keypress_notification_responder_success() {
+        let context = TestContext::new();
+        let procedure = respond;
+
+        include!("../../test/SP/BV-34-C.in");
+    }
+
+    #[test]
+    #[should_panic] // TODO: make the test pass
+    fn passkey_entry_with_keypress_notification_initiator_failure_on_responding_side() {
+        let context = TestContext::new();
+        let procedure = initiate;
+
+        include!("../../test/SP/BV-35-C.in");
+    }
+
+    #[test]
+    #[should_panic] // TODO: make the test pass
+    fn passkey_entry_with_keypress_notificiation_responder_failure_on_responding_side() {
+        let context = TestContext::new();
+        let procedure = respond;
+
+        include!("../../test/SP/BV-36-C.in");
+    }
+}
diff --git a/tools/rootcanal/lmp/src/test/context.rs b/tools/rootcanal/lmp/src/test/context.rs
new file mode 100644
index 0000000..262b97f
--- /dev/null
+++ b/tools/rootcanal/lmp/src/test/context.rs
@@ -0,0 +1,115 @@
+use std::cell::RefCell;
+use std::collections::VecDeque;
+use std::convert::{TryFrom, TryInto};
+use std::future::Future;
+use std::pin::Pin;
+use std::task::{self, Poll};
+
+use num_traits::ToPrimitive;
+
+use crate::ec::PrivateKey;
+use crate::packets::{hci, lmp};
+
+use crate::procedure::Context;
+
+#[derive(Default)]
+pub struct TestContext {
+    pub in_lmp_packets: RefCell<VecDeque<lmp::PacketPacket>>,
+    pub out_lmp_packets: RefCell<VecDeque<lmp::PacketPacket>>,
+    pub hci_events: RefCell<VecDeque<hci::EventPacket>>,
+    pub hci_commands: RefCell<VecDeque<hci::CommandPacket>>,
+    private_key: RefCell<Option<PrivateKey>>,
+    features_pages: [u64; 3],
+    peer_features_pages: [u64; 3],
+}
+
+impl TestContext {
+    pub fn new() -> Self {
+        Self::default()
+            .with_page_1_feature(hci::LMPFeaturesPage1Bits::SecureSimplePairingHostSupport)
+            .with_peer_page_1_feature(hci::LMPFeaturesPage1Bits::SecureSimplePairingHostSupport)
+    }
+
+    pub fn with_page_1_feature(mut self, feature: hci::LMPFeaturesPage1Bits) -> Self {
+        self.features_pages[1] |= feature.to_u64().unwrap();
+        self
+    }
+
+    pub fn with_page_2_feature(mut self, feature: hci::LMPFeaturesPage2Bits) -> Self {
+        self.features_pages[2] |= feature.to_u64().unwrap();
+        self
+    }
+
+    pub fn with_peer_page_1_feature(mut self, feature: hci::LMPFeaturesPage1Bits) -> Self {
+        self.peer_features_pages[1] |= feature.to_u64().unwrap();
+        self
+    }
+
+    pub fn with_peer_page_2_feature(mut self, feature: hci::LMPFeaturesPage2Bits) -> Self {
+        self.peer_features_pages[2] |= feature.to_u64().unwrap();
+        self
+    }
+}
+
+impl Context for TestContext {
+    fn poll_hci_command<C: TryFrom<hci::CommandPacket>>(&self) -> Poll<C> {
+        let command =
+            self.hci_commands.borrow().front().and_then(|command| command.clone().try_into().ok());
+
+        if let Some(command) = command {
+            self.hci_commands.borrow_mut().pop_front();
+            Poll::Ready(command)
+        } else {
+            Poll::Pending
+        }
+    }
+
+    fn poll_lmp_packet<P: TryFrom<lmp::PacketPacket>>(&self) -> Poll<P> {
+        let packet =
+            self.in_lmp_packets.borrow().front().and_then(|packet| packet.clone().try_into().ok());
+
+        if let Some(packet) = packet {
+            self.in_lmp_packets.borrow_mut().pop_front();
+            Poll::Ready(packet)
+        } else {
+            Poll::Pending
+        }
+    }
+
+    fn send_hci_event<E: Into<hci::EventPacket>>(&self, event: E) {
+        self.hci_events.borrow_mut().push_back(event.into());
+    }
+
+    fn send_lmp_packet<P: Into<lmp::PacketPacket>>(&self, packet: P) {
+        self.out_lmp_packets.borrow_mut().push_back(packet.into());
+    }
+
+    fn peer_address(&self) -> hci::Address {
+        hci::Address { bytes: [0; 6] }
+    }
+
+    fn peer_handle(&self) -> u16 {
+        0x42
+    }
+
+    fn peer_extended_features(&self, features_page: u8) -> Option<u64> {
+        Some(self.peer_features_pages[features_page as usize])
+    }
+
+    fn extended_features(&self, features_page: u8) -> u64 {
+        self.features_pages[features_page as usize]
+    }
+
+    fn get_private_key(&self) -> Option<PrivateKey> {
+        self.private_key.borrow().clone()
+    }
+
+    fn set_private_key(&self, key: &PrivateKey) {
+        *self.private_key.borrow_mut() = Some(key.clone())
+    }
+}
+
+pub fn poll(future: Pin<&mut impl Future<Output = ()>>) -> Poll<()> {
+    let waker = crate::future::noop_waker();
+    future.poll(&mut task::Context::from_waker(&waker))
+}
diff --git a/tools/rootcanal/lmp/src/test/mod.rs b/tools/rootcanal/lmp/src/test/mod.rs
new file mode 100644
index 0000000..ad790a1
--- /dev/null
+++ b/tools/rootcanal/lmp/src/test/mod.rs
@@ -0,0 +1,5 @@
+mod context;
+mod sequence;
+
+pub(crate) use context::{poll, TestContext};
+pub(crate) use sequence::{sequence, sequence_body};
diff --git a/tools/rootcanal/lmp/src/test/sequence.rs b/tools/rootcanal/lmp/src/test/sequence.rs
new file mode 100644
index 0000000..589adb5
--- /dev/null
+++ b/tools/rootcanal/lmp/src/test/sequence.rs
@@ -0,0 +1,126 @@
+macro_rules! sequence_body {
+        ($ctx:ident, ) => { None };
+        ($ctx:ident, Lower Tester -> IUT: $packet:ident {
+            $($name:ident: $value:expr),* $(,)?
+        } $($tail:tt)*) => {{
+            use crate::packets::lmp::*;
+
+            let builder = paste! {
+                [<$packet Builder>] {
+                    $($name: $value),*
+                }
+            };
+            $ctx.0.in_lmp_packets.borrow_mut().push_back(builder.build().into());
+
+            let poll = crate::test::poll($ctx.1.as_mut());
+
+            assert!($ctx.0.in_lmp_packets.borrow().is_empty(), "{} was not consumed by procedure", stringify!($packet));
+
+            println!("Lower Tester -> IUT: {}", stringify!($packet));
+
+            sequence_body!($ctx, $($tail)*).or(Some(poll))
+        }};
+        ($ctx:ident, Upper Tester -> IUT: $packet:ident {
+            $($name:ident: $value:expr),* $(,)?
+        } $($tail:tt)*) => {{
+            use crate::packets::hci::*;
+
+            let builder = paste! {
+                [<$packet Builder>] {
+                    $($name: $value),*
+                }
+            };
+            $ctx.0.hci_commands.borrow_mut().push_back(builder.build().into());
+
+            let poll = crate::test::poll($ctx.1.as_mut());
+
+            assert!($ctx.0.hci_commands.borrow().is_empty(), "{} was not consumed by procedure", stringify!($packet));
+
+            println!("Upper Tester -> IUT: {}", stringify!($packet));
+
+            sequence_body!($ctx, $($tail)*).or(Some(poll))
+        }};
+        ($ctx:ident, IUT -> Upper Tester: $packet:ident {
+            $($name:ident: $expected_value:expr),* $(,)?
+        } $($tail:tt)*) => {{
+            use crate::packets::hci::*;
+
+            paste! {
+                let packet: [<$packet Packet>] = $ctx.0.hci_events.borrow_mut().pop_front().expect("No hci packet").try_into().unwrap();
+            }
+
+            $(
+                let value = paste! { packet.[<get_ $name>]() };
+                assert_eq!(value.clone(), $expected_value);
+            )*
+
+            println!("IUT -> Upper Tester: {}", stringify!($packet));
+
+            sequence_body!($ctx, $($tail)*)
+        }};
+        ($ctx:ident, IUT -> Lower Tester: $packet:ident {
+            $($name:ident: $expected_value:expr),* $(,)?
+        } $($tail:tt)*) => {{
+            use crate::packets::lmp::*;
+
+            paste! {
+                let packet: [<$packet Packet>] = $ctx.0.out_lmp_packets.borrow_mut().pop_front().expect("No lmp packet").try_into().unwrap();
+            }
+
+            $(
+                let value = paste! { packet.[<get_ $name>]() };
+                assert_eq!(value.clone(), $expected_value);
+            )*
+
+            println!("IUT -> Lower Tester: {}", stringify!($packet));
+
+            sequence_body!($ctx, $($tail)*)
+        }};
+        ($ctx:ident, repeat $number:literal times with ($var:ident in $iterable:expr) {
+            $($inner:tt)*
+        } $($tail:tt)*) => {{
+            println!("repeat {}", $number);
+            for (_, $var) in (0..$number).into_iter().zip($iterable) {
+                sequence_body!($ctx, $($inner)*);
+            }
+            println!("endrepeat");
+
+            sequence_body!($ctx, $($tail)*)
+        }};
+        ($ctx:ident, repeat $number:literal times {
+            $($inner:tt)*
+        } $($tail:tt)*) => {{
+            println!("repeat {}", $number);
+            for _ in 0..$number {
+                sequence_body!($ctx, $($inner)*);
+            }
+            println!("endrepeat");
+
+            sequence_body!($ctx, $($tail)*)
+        }};
+    }
+
+macro_rules! sequence {
+        ($procedure_fn:path, $context:path, $($tail:tt)*) => ({
+            use paste::paste;
+            use std::convert::TryInto;
+
+            let procedure = $procedure_fn(&$context);
+
+            use crate::future::pin;
+            pin!(procedure);
+
+            let mut ctx = (&$context, procedure);
+            use crate::test::sequence_body;
+            let last_poll = sequence_body!(ctx, $($tail)*).unwrap();
+
+            assert!(last_poll.is_ready());
+            assert!($context.in_lmp_packets.borrow().is_empty());
+            assert!($context.out_lmp_packets.borrow().is_empty());
+            assert!($context.hci_commands.borrow().is_empty());
+            assert!($context.hci_events.borrow().is_empty());
+        });
+    }
+
+pub(crate) use sequence;
+pub(crate) use sequence_body;
diff --git a/tools/rootcanal/lmp/test/ENC/BV-01-C.in b/tools/rootcanal/lmp/test/ENC/BV-01-C.in
new file mode 100644
index 0000000..cee4250
--- /dev/null
+++ b/tools/rootcanal/lmp/test/ENC/BV-01-C.in
@@ -0,0 +1,32 @@
+sequence! { procedure, context,
+    // ACL Connection Established
+    Lower Tester -> IUT: EncryptionModeReq {
+        transaction_id: 0,
+        encryption_mode: 0x01,
+    }
+    IUT ->Lower Tester: Accepted {
+        transaction_id: 0,
+        accepted_opcode: Opcode::EncryptionModeReq,
+    }
+    Lower Tester -> IUT: EncryptionKeySizeReq {
+        transaction_id: 0,
+        key_size: 0x10,
+    }
+    IUT -> Lower Tester: Accepted {
+        transaction_id: 0,
+        accepted_opcode: Opcode::EncryptionKeySizeReq,
+    }
+    Lower Tester -> IUT: StartEncryptionReq {
+        transaction_id: 0,
+        random_number: [0; 16],
+    }
+    IUT -> Lower Tester: Accepted {
+        transaction_id: 0,
+        accepted_opcode: Opcode::StartEncryptionReq,
+    }
+    IUT -> Upper Tester: EncryptionChange {
+        status: ErrorCode::Success,
+        connection_handle: context.peer_handle(),
+        encryption_enabled: EncryptionEnabled::On,
+    }
+}
diff --git a/tools/rootcanal/lmp/test/ENC/BV-05-C.in b/tools/rootcanal/lmp/test/ENC/BV-05-C.in
new file mode 100644
index 0000000..b25d81e
--- /dev/null
+++ b/tools/rootcanal/lmp/test/ENC/BV-05-C.in
@@ -0,0 +1,40 @@
+sequence! { procedure, context,
+    // ACL Connection Established
+    Upper Tester -> IUT: SetConnectionEncryption {
+        connection_handle: context.peer_handle(),
+        encryption_enable: Enable::Enabled
+    }
+    IUT -> Upper Tester: SetConnectionEncryptionStatus {
+       num_hci_command_packets: 1,
+       status: ErrorCode::Success,
+    }
+    IUT -> Lower Tester: EncryptionModeReq {
+        transaction_id: 0,
+        encryption_mode: 0x01,
+    }
+    Lower Tester -> IUT: Accepted {
+        transaction_id: 0,
+        accepted_opcode: Opcode::EncryptionModeReq,
+    }
+    IUT -> Lower Tester: EncryptionKeySizeReq {
+        transaction_id: 0,
+        key_size: 0x10,
+    }
+    Lower Tester -> IUT: Accepted {
+        transaction_id: 0,
+        accepted_opcode: Opcode::EncryptionKeySizeReq,
+    }
+    IUT -> Lower Tester: StartEncryptionReq {
+        transaction_id: 0,
+        random_number: [0; 16],
+    }
+    Lower Tester -> IUT: Accepted {
+        transaction_id: 0,
+        accepted_opcode: Opcode::StartEncryptionReq,
+    }
+    IUT -> Upper Tester: EncryptionChange {
+        status: ErrorCode::Success,
+        connection_handle: context.peer_handle(),
+        encryption_enabled: EncryptionEnabled::On,
+    }
+}
diff --git a/tools/rootcanal/lmp/test/ENC/BV-26-C.in b/tools/rootcanal/lmp/test/ENC/BV-26-C.in
new file mode 100644
index 0000000..01df56e
--- /dev/null
+++ b/tools/rootcanal/lmp/test/ENC/BV-26-C.in
@@ -0,0 +1,32 @@
+sequence! { procedure, context,
+    // ACL Connection Established
+    Lower Tester -> IUT: EncryptionModeReq {
+        transaction_id: 0,
+        encryption_mode: 0x01,
+    }
+    IUT ->Lower Tester: Accepted {
+        transaction_id: 0,
+        accepted_opcode: Opcode::EncryptionModeReq,
+    }
+    Lower Tester -> IUT: EncryptionKeySizeReq {
+        transaction_id: 0,
+        key_size: 0x10,
+    }
+    IUT -> Lower Tester: Accepted {
+        transaction_id: 0,
+        accepted_opcode: Opcode::EncryptionKeySizeReq,
+    }
+    Lower Tester -> IUT: StartEncryptionReq {
+        transaction_id: 0,
+        random_number: [0; 16],
+    }
+    IUT -> Lower Tester: Accepted {
+        transaction_id: 0,
+        accepted_opcode: Opcode::StartEncryptionReq,
+    }
+    IUT -> Upper Tester: EncryptionChange {
+        status: ErrorCode::Success,
+        connection_handle: context.peer_handle(),
+        encryption_enabled: EncryptionEnabled::BrEdrAesCcm,
+    }
+}
diff --git a/tools/rootcanal/lmp/test/ENC/BV-34-C.in b/tools/rootcanal/lmp/test/ENC/BV-34-C.in
new file mode 100644
index 0000000..ea03d98
--- /dev/null
+++ b/tools/rootcanal/lmp/test/ENC/BV-34-C.in
@@ -0,0 +1,40 @@
+sequence! { procedure, context,
+    // ACL Connection Established
+    Upper Tester -> IUT: SetConnectionEncryption {
+        connection_handle: context.peer_handle(),
+        encryption_enable: Enable::Enabled
+    }
+    IUT -> Upper Tester: SetConnectionEncryptionStatus {
+       num_hci_command_packets: 1,
+       status: ErrorCode::Success,
+    }
+    IUT -> Lower Tester: EncryptionModeReq {
+        transaction_id: 0,
+        encryption_mode: 0x01,
+    }
+    Lower Tester -> IUT: Accepted {
+        transaction_id: 0,
+        accepted_opcode: Opcode::EncryptionModeReq,
+    }
+    IUT -> Lower Tester: EncryptionKeySizeReq {
+        transaction_id: 0,
+        key_size: 0x10,
+    }
+    Lower Tester -> IUT: Accepted {
+        transaction_id: 0,
+        accepted_opcode: Opcode::EncryptionKeySizeReq,
+    }
+    IUT -> Lower Tester: StartEncryptionReq {
+        transaction_id: 0,
+        random_number: [0; 16],
+    }
+    Lower Tester -> IUT: Accepted {
+        transaction_id: 0,
+        accepted_opcode: Opcode::StartEncryptionReq,
+    }
+    IUT -> Upper Tester: EncryptionChange {
+        status: ErrorCode::Success,
+        connection_handle: context.peer_handle(),
+        encryption_enabled: EncryptionEnabled::BrEdrAesCcm,
+    }
+}
diff --git a/tools/rootcanal/lmp/test/SP/BV-03-C.in b/tools/rootcanal/lmp/test/SP/BV-03-C.in
new file mode 100644
index 0000000..ed7546c
--- /dev/null
+++ b/tools/rootcanal/lmp/test/SP/BV-03-C.in
@@ -0,0 +1,23 @@
+sequence! { procedure, context,
+    Upper Tester -> IUT: AuthenticationRequested {
+        connection_handle: context.peer_handle()
+    }
+    IUT -> Upper Tester: AuthenticationRequestedStatus {
+       num_hci_command_packets: 1,
+       status: ErrorCode::Success,
+    }
+    IUT -> Upper Tester: LinkKeyRequest {
+        bd_addr: context.peer_address(),
+    }
+    Upper Tester -> IUT: LinkKeyRequestNegativeReply {
+        bd_addr: context.peer_address(),
+    }
+    IUT -> Upper Tester: LinkKeyRequestNegativeReplyComplete {
+       num_hci_command_packets: 1,
+       status: ErrorCode::Success,
+       bd_addr: context.peer_address(),
+    }
+    IUT -> Upper Tester: PinCodeRequest {
+        bd_addr: context.peer_address(),
+    }
+}
diff --git a/tools/rootcanal/lmp/test/SP/BV-04-C.in b/tools/rootcanal/lmp/test/SP/BV-04-C.in
new file mode 100644
index 0000000..c4e2b17
--- /dev/null
+++ b/tools/rootcanal/lmp/test/SP/BV-04-C.in
@@ -0,0 +1,14 @@
+sequence! { procedure, context,
+    // ACL Connection Established
+    Lower Tester -> IUT: IoCapabilityReq {
+        transaction_id: 0,
+        io_capabilities: 0x01,
+        oob_authentication_data: 0x00,
+        authentication_requirement: 0x01,
+    }
+    IUT -> Lower Tester: NotAccepted {
+        transaction_id: 0,
+        not_accepted_opcode: Opcode::IoCapabilityReq,
+        error_code: 0x37,
+    }
+}
diff --git a/tools/rootcanal/lmp/test/SP/BV-05-C.in b/tools/rootcanal/lmp/test/SP/BV-05-C.in
new file mode 100644
index 0000000..7e0a9f7
--- /dev/null
+++ b/tools/rootcanal/lmp/test/SP/BV-05-C.in
@@ -0,0 +1,106 @@
+sequence! { procedure, context,
+    // ACL Connection Established
+    Upper Tester -> IUT: AuthenticationRequested {
+        connection_handle: context.peer_handle()
+    }
+    IUT -> Upper Tester: AuthenticationRequestedStatus {
+       num_hci_command_packets: 1,
+       status: ErrorCode::Success,
+    }
+    IUT -> Upper Tester: LinkKeyRequest {
+        bd_addr: context.peer_address(),
+    }
+    Upper Tester -> IUT: LinkKeyRequestNegativeReply {
+        bd_addr: context.peer_address(),
+    }
+    IUT -> Upper Tester: LinkKeyRequestNegativeReplyComplete {
+       num_hci_command_packets: 1,
+       status: ErrorCode::Success,
+       bd_addr: context.peer_address(),
+    }
+    IUT -> Upper Tester: IoCapabilityRequest {
+        bd_addr: context.peer_address(),
+    }
+    Upper Tester -> IUT: IoCapabilityRequestReply {
+        bd_addr: context.peer_address(),
+        io_capability: IoCapability::DisplayYesNo,
+        oob_present: OobDataPresent::NotPresent,
+        authentication_requirements: AuthenticationRequirements::NoBondingMitmProtection,
+    }
+    IUT -> Upper Tester: IoCapabilityRequestReplyComplete {
+        num_hci_command_packets: 1,
+        status: ErrorCode::Success,
+        bd_addr: context.peer_address(),
+    }
+    IUT -> Lower Tester: IoCapabilityReq {
+        transaction_id: 0,
+        io_capabilities: 0x01,
+        oob_authentication_data: 0x00,
+        authentication_requirement: 0x01,
+    }
+    Lower Tester -> IUT: NotAcceptedExt {
+        transaction_id: 0,
+        not_accepted_opcode: ExtendedOpcode::IoCapabilityReq,
+        error_code: 0x37,
+    }
+    IUT -> Upper Tester: SimplePairingComplete {
+        status: ErrorCode::AuthenticationFailure,
+        bd_addr: context.peer_address(),
+    }
+    IUT -> Upper Tester: PinCodeRequest {
+        bd_addr: context.peer_address(),
+    }
+    IUT -> Upper Tester: PinCodeRequestReply {
+        bd_addr: context.peer_address(),
+        pin_code_length: 1,
+        pin_code: "0".as_bytes(),
+    }
+    IUT -> Upper Tester: PinCodeRequestReplyComplete {
+        num_hci_command_packets: 1,
+        status: ErrorCode::Success,
+        bd_addr: context.peer_address(),
+    }
+    IUT -> Lower Tester: InRand {
+        transaction_id: 0,
+        random_number: [0; 16],
+    }
+    Lower Tester -> IUT: Accepted {
+        transaction_id: 0,
+        accepted_opcode: Opcode::InRand,
+    }
+    IUT -> Lower Tester: CombKey {
+        transaction_id: 0,
+        random_number: [0; 16],
+    }
+    Lower Tester -> IUT: CombKey {
+        transaction_id: 0,
+        random_number: [0; 16],
+    }
+    // TODO: It's also valid to send it just
+    // before AuthenticationComplete
+    IUT -> Upper Tester: LinkKeyNotification {
+        bd_addr: context.peer_address(),
+        key_type: KeyType::AuthenticatedP192,
+        link_key: [0; 16],
+    }
+    IUT -> Lower Tester: AuRand {
+        transaction_id: 0,
+        random_number: [0; 16],
+    }
+    Lower Tester -> IUT: Sres {
+        transaction_id: 0,
+        authentication_rsp: [0; 4],
+    }
+    Lower Tester -> IUT: AuRand {
+        transaction_id: 0,
+        random_number: [0; 16],
+    }
+    IUT -> Lower Tester: Sres {
+        transaction_id: 0,
+        authentication_rsp: [0; 4],
+    }
+    IUT -> Upper Tester: AuthenticationComplete {
+        status: ErrorCode::Success,
+        connection_handle: context.peer_handle(),
+    }
+}
diff --git a/tools/rootcanal/lmp/test/SP/BV-06-C.in b/tools/rootcanal/lmp/test/SP/BV-06-C.in
new file mode 100644
index 0000000..635f7b2
--- /dev/null
+++ b/tools/rootcanal/lmp/test/SP/BV-06-C.in
@@ -0,0 +1,163 @@
+sequence! { procedure, context,
+    // ACL Connection Established
+    Upper Tester -> IUT: AuthenticationRequested {
+        connection_handle: context.peer_handle()
+    }
+    IUT -> Upper Tester: AuthenticationRequestedStatus {
+       num_hci_command_packets: 1,
+       status: ErrorCode::Success,
+    }
+    IUT -> Upper Tester: LinkKeyRequest {
+        bd_addr: context.peer_address(),
+    }
+    Upper Tester -> IUT: LinkKeyRequestNegativeReply {
+        bd_addr: context.peer_address(),
+    }
+    IUT -> Upper Tester: LinkKeyRequestNegativeReplyComplete {
+       num_hci_command_packets: 1,
+       status: ErrorCode::Success,
+       bd_addr: context.peer_address(),
+    }
+    IUT -> Upper Tester: IoCapabilityRequest {
+        bd_addr: context.peer_address(),
+    }
+    Upper Tester -> IUT: IoCapabilityRequestReply {
+        bd_addr: context.peer_address(),
+        io_capability: IoCapability::DisplayYesNo,
+        oob_present: OobDataPresent::NotPresent,
+        authentication_requirements: AuthenticationRequirements::NoBondingMitmProtection,
+    }
+    IUT -> Upper Tester: IoCapabilityRequestReplyComplete {
+        num_hci_command_packets: 1,
+        status: ErrorCode::Success,
+        bd_addr: context.peer_address(),
+    }
+    IUT -> Lower Tester: IoCapabilityReq {
+        transaction_id: 0,
+        io_capabilities: 0x01,
+        oob_authentication_data: 0x00,
+        authentication_requirement: 0x01,
+    }
+    Lower Tester -> IUT: IoCapabilityRes {
+        transaction_id: 0,
+        io_capabilities: 0x01,
+        oob_authentication_data: 0x00,
+        authentication_requirement: 0x01,
+    }
+    IUT -> Upper Tester: IoCapabilityResponse {
+        bd_addr: context.peer_address(),
+        io_capability: IoCapability::DisplayYesNo,
+        oob_data_present: OobDataPresent::NotPresent,
+        authentication_requirements: AuthenticationRequirements::NoBondingMitmProtection,
+    }
+    // Public Key Exchange
+    IUT -> Lower Tester: EncapsulatedHeader {
+        transaction_id: 0,
+        major_type: 1,
+        minor_type: 1,
+        payload_length: 48,
+    }
+    Lower Tester -> IUT: Accepted {
+        transaction_id: 0,
+        accepted_opcode: Opcode::EncapsulatedHeader,
+    }
+    repeat 3 times with (part in local_p192_public_key(&context)) {
+        IUT -> Lower Tester: EncapsulatedPayload {
+            transaction_id: 0,
+            data: part,
+        }
+        Lower Tester -> IUT: Accepted {
+            transaction_id: 0,
+            accepted_opcode: Opcode::EncapsulatedPayload,
+        }
+    }
+    Lower Tester -> IUT: EncapsulatedHeader {
+        transaction_id: 0,
+        major_type: 1,
+        minor_type: 1,
+        payload_length: 48,
+    }
+    IUT -> Lower Tester: Accepted {
+        transaction_id: 0,
+        accepted_opcode: Opcode::EncapsulatedHeader,
+    }
+    repeat 3 times with (part in peer_p192_public_key()) {
+        Lower Tester -> IUT: EncapsulatedPayload {
+            transaction_id: 0,
+            data: part,
+        }
+        IUT -> Lower Tester: Accepted {
+            transaction_id: 0,
+            accepted_opcode: Opcode::EncapsulatedPayload,
+        }
+    }
+    // Authentication Stage 1: Numeric Comparaison Protocol
+    Lower Tester -> IUT: SimplePairingConfirm {
+        transaction_id: 0,
+        commitment_value: [0; 16],
+    }
+    IUT -> Lower Tester: SimplePairingNumber {
+        transaction_id: 0,
+        nonce: [0; 16],
+    }
+    Lower Tester -> IUT: Accepted {
+        transaction_id: 0,
+        accepted_opcode: Opcode::SimplePairingNumber,
+    }
+    Lower Tester -> IUT: SimplePairingNumber {
+        transaction_id: 0,
+        nonce: [0; 16],
+    }
+    IUT -> Upper Tester: UserConfirmationRequest { bd_addr: context.peer_address(), numeric_value: 0 }
+    IUT -> Lower Tester: Accepted {
+        transaction_id: 0,
+        accepted_opcode: Opcode::SimplePairingNumber,
+    }
+    Upper Tester -> IUT: UserConfirmationRequestReply { bd_addr: context.peer_address() }
+    IUT -> Upper Tester: UserConfirmationRequestReplyComplete {
+        num_hci_command_packets: 1,
+        status: ErrorCode::Success,
+        bd_addr: context.peer_address(),
+    }
+    // Authentication Stage 2
+    IUT -> Lower Tester: DhkeyCheck {
+        transaction_id: 0,
+        confirmation_value: [0; 16],
+    }
+    Lower Tester -> IUT: Accepted { transaction_id: 0, accepted_opcode: Opcode::DhkeyCheck }
+    Lower Tester -> IUT: DhkeyCheck {
+        transaction_id: 0,
+        confirmation_value: [0; 16],
+    }
+    IUT -> Lower Tester: Accepted { transaction_id: 0, accepted_opcode: Opcode::DhkeyCheck }
+    IUT -> Upper Tester: SimplePairingComplete {
+        status: ErrorCode::Success,
+        bd_addr: context.peer_address(),
+    }
+    // Link Key Calculation
+    IUT -> Lower Tester: AuRand {
+        transaction_id: 0,
+        random_number: [0; 16],
+    }
+    Lower Tester -> IUT: Sres {
+        transaction_id: 0,
+        authentication_rsp: [0; 4],
+    }
+    Lower Tester -> IUT: AuRand {
+        transaction_id: 0,
+        random_number: [0; 16],
+    }
+    IUT -> Lower Tester: Sres {
+        transaction_id: 0,
+        authentication_rsp: [0; 4],
+    }
+    IUT -> Upper Tester: LinkKeyNotification {
+        bd_addr: context.peer_address(),
+        key_type: KeyType::AuthenticatedP192,
+        link_key: [0; 16],
+    }
+    IUT -> Upper Tester: AuthenticationComplete {
+        status: ErrorCode::Success,
+        connection_handle: context.peer_handle(),
+    }
+}
diff --git a/tools/rootcanal/lmp/test/SP/BV-07-C.in b/tools/rootcanal/lmp/test/SP/BV-07-C.in
new file mode 100644
index 0000000..6c1a79d
--- /dev/null
+++ b/tools/rootcanal/lmp/test/SP/BV-07-C.in
@@ -0,0 +1,141 @@
+sequence! { procedure, context,
+    // ACL Connection Established
+    Lower Tester -> IUT: IoCapabilityReq {
+        transaction_id: 0,
+        io_capabilities: 0x01,
+        oob_authentication_data: 0x00,
+        authentication_requirement: 0x01,
+    }
+    IUT -> Upper Tester: IoCapabilityResponse {
+        bd_addr: context.peer_address(),
+        io_capability: IoCapability::DisplayYesNo,
+        oob_data_present: OobDataPresent::NotPresent,
+        authentication_requirements: AuthenticationRequirements::NoBondingMitmProtection,
+    }
+    IUT -> Upper Tester: IoCapabilityRequest {
+        bd_addr: context.peer_address(),
+    }
+    Upper Tester -> IUT: IoCapabilityRequestReply {
+        bd_addr: context.peer_address(),
+        io_capability: IoCapability::DisplayYesNo,
+        oob_present: OobDataPresent::NotPresent,
+        authentication_requirements: AuthenticationRequirements::NoBondingMitmProtection,
+    }
+    IUT -> Upper Tester: IoCapabilityRequestReplyComplete {
+        num_hci_command_packets: 1,
+        status: ErrorCode::Success,
+        bd_addr: context.peer_address(),
+    }
+    IUT -> Lower Tester: IoCapabilityRes {
+        transaction_id: 0,
+        io_capabilities: 0x01,
+        oob_authentication_data: 0x00,
+        authentication_requirement: 0x01,
+    }
+    // Public Key Exchange
+    Lower Tester -> IUT: EncapsulatedHeader {
+        transaction_id: 0,
+        major_type: 1,
+        minor_type: 1,
+        payload_length: 48,
+    }
+    IUT -> Lower Tester: Accepted {
+        transaction_id: 0,
+        accepted_opcode: Opcode::EncapsulatedHeader,
+    }
+    repeat 3 times with (part in peer_p192_public_key()) {
+        Lower Tester -> IUT: EncapsulatedPayload {
+            transaction_id: 0,
+            data: part,
+        }
+        IUT -> Lower Tester: Accepted {
+            transaction_id: 0,
+            accepted_opcode: Opcode::EncapsulatedPayload,
+        }
+    }
+    IUT -> Lower Tester: EncapsulatedHeader {
+        transaction_id: 0,
+        major_type: 1,
+        minor_type: 1,
+        payload_length: 48,
+    }
+    Lower Tester -> IUT: Accepted {
+        transaction_id: 0,
+        accepted_opcode: Opcode::EncapsulatedHeader,
+    }
+    repeat 3 times with (part in local_p192_public_key(&context)) {
+        IUT -> Lower Tester: EncapsulatedPayload {
+            transaction_id: 0,
+            data: part,
+        }
+        Lower Tester -> IUT: Accepted {
+            transaction_id: 0,
+            accepted_opcode: Opcode::EncapsulatedPayload,
+        }
+    }
+    // Authentication Stage 1: Numeric Comparaison Protocol
+    IUT -> Lower Tester: SimplePairingConfirm {
+        transaction_id: 0,
+        commitment_value: [0; 16],
+    }
+    Lower Tester -> IUT: SimplePairingNumber {
+        transaction_id: 0,
+        nonce: [0; 16],
+    }
+    IUT -> Lower Tester: Accepted {
+        transaction_id: 0,
+        accepted_opcode: Opcode::SimplePairingNumber,
+    }
+    IUT -> Lower Tester: SimplePairingNumber {
+        transaction_id: 0,
+        nonce: [0; 16],
+    }
+    Lower Tester -> IUT: Accepted {
+        transaction_id: 0,
+        accepted_opcode: Opcode::SimplePairingNumber,
+    }
+    IUT -> Upper Tester: UserConfirmationRequest { bd_addr: context.peer_address(), numeric_value: 0 }
+    Upper Tester -> IUT: UserConfirmationRequestReply { bd_addr: context.peer_address() }
+    IUT -> Upper Tester: UserConfirmationRequestReplyComplete {
+        num_hci_command_packets: 1,
+        status: ErrorCode::Success,
+        bd_addr: context.peer_address(),
+    }
+    // Authentication Stage 2
+    Lower Tester -> IUT: DhkeyCheck {
+        transaction_id: 0,
+        confirmation_value: [0; 16],
+    }
+    IUT -> Lower Tester: Accepted { transaction_id: 0, accepted_opcode: Opcode::DhkeyCheck }
+    IUT -> Lower Tester: DhkeyCheck {
+        transaction_id: 0,
+        confirmation_value: [0; 16],
+    }
+    Lower Tester -> IUT: Accepted { transaction_id: 0, accepted_opcode: Opcode::DhkeyCheck }
+    IUT -> Upper Tester: SimplePairingComplete {
+        status: ErrorCode::Success,
+        bd_addr: context.peer_address(),
+    }
+    // Link Key Calculation
+    Lower Tester -> IUT: AuRand {
+        transaction_id: 0,
+        random_number: [0; 16],
+    }
+    IUT -> Lower Tester: Sres {
+        transaction_id: 0,
+        authentication_rsp: [0; 4],
+    }
+    IUT -> Lower Tester: AuRand {
+        transaction_id: 0,
+        random_number: [0; 16],
+    }
+    Lower Tester -> IUT: Sres {
+        transaction_id: 0,
+        authentication_rsp: [0; 4],
+    }
+    IUT -> Upper Tester: LinkKeyNotification {
+        bd_addr: context.peer_address(),
+        key_type: KeyType::AuthenticatedP192,
+        link_key: [0; 16],
+    }
+}
diff --git a/tools/rootcanal/lmp/test/SP/BV-08-C.in b/tools/rootcanal/lmp/test/SP/BV-08-C.in
new file mode 100644
index 0000000..aa24619
--- /dev/null
+++ b/tools/rootcanal/lmp/test/SP/BV-08-C.in
@@ -0,0 +1,133 @@
+sequence! { procedure, context,
+    // ACL Connection Established
+    Upper Tester -> IUT: AuthenticationRequested {
+        connection_handle: context.peer_handle()
+    }
+    IUT -> Upper Tester: AuthenticationRequestedStatus {
+       num_hci_command_packets: 1,
+       status: ErrorCode::Success,
+    }
+    IUT -> Upper Tester: LinkKeyRequest {
+        bd_addr: context.peer_address(),
+    }
+    Upper Tester -> IUT: LinkKeyRequestNegativeReply {
+        bd_addr: context.peer_address(),
+    }
+    IUT -> Upper Tester: LinkKeyRequestNegativeReplyComplete {
+       num_hci_command_packets: 1,
+       status: ErrorCode::Success,
+       bd_addr: context.peer_address(),
+    }
+    IUT -> Upper Tester: IoCapabilityRequest {
+        bd_addr: context.peer_address(),
+    }
+    Upper Tester -> IUT: IoCapabilityRequestReply {
+        bd_addr: context.peer_address(),
+        io_capability: IoCapability::DisplayYesNo,
+        oob_present: OobDataPresent::NotPresent,
+        authentication_requirements: AuthenticationRequirements::NoBondingMitmProtection,
+    }
+    IUT -> Upper Tester: IoCapabilityRequestReplyComplete {
+        num_hci_command_packets: 1,
+        status: ErrorCode::Success,
+        bd_addr: context.peer_address(),
+    }
+    IUT -> Lower Tester: IoCapabilityReq {
+        transaction_id: 0,
+        io_capabilities: 0x01,
+        oob_authentication_data: 0x00,
+        authentication_requirement: 0x01,
+    }
+    Lower Tester -> IUT: IoCapabilityRes {
+        transaction_id: 0,
+        io_capabilities: 0x01,
+        oob_authentication_data: 0x00,
+        authentication_requirement: 0x01,
+    }
+    IUT -> Upper Tester: IoCapabilityResponse {
+        bd_addr: context.peer_address(),
+        io_capability: IoCapability::DisplayYesNo,
+        oob_data_present: OobDataPresent::NotPresent,
+        authentication_requirements: AuthenticationRequirements::NoBondingMitmProtection,
+    }
+    // Public Key Exchange
+    IUT -> Lower Tester: EncapsulatedHeader {
+        transaction_id: 0,
+        major_type: 1,
+        minor_type: 1,
+        payload_length: 48,
+    }
+    Lower Tester -> IUT: Accepted {
+        transaction_id: 0,
+        accepted_opcode: Opcode::EncapsulatedHeader,
+    }
+    repeat 3 times with (part in local_p192_public_key(&context)) {
+        IUT -> Lower Tester: EncapsulatedPayload {
+            transaction_id: 0,
+            data: part,
+        }
+        Lower Tester -> IUT: Accepted {
+            transaction_id: 0,
+            accepted_opcode: Opcode::EncapsulatedPayload,
+        }
+    }
+    Lower Tester -> IUT: EncapsulatedHeader {
+        transaction_id: 0,
+        major_type: 1,
+        minor_type: 1,
+        payload_length: 48,
+    }
+    IUT -> Lower Tester: Accepted {
+        transaction_id: 0,
+        accepted_opcode: Opcode::EncapsulatedHeader,
+    }
+    repeat 3 times with (part in peer_p192_public_key()) {
+        Lower Tester -> IUT: EncapsulatedPayload {
+            transaction_id: 0,
+            data: part,
+        }
+        IUT -> Lower Tester: Accepted {
+            transaction_id: 0,
+            accepted_opcode: Opcode::EncapsulatedPayload,
+        }
+    }
+    // Authentication Stage 1: Numeric Comparaison Protocol
+    Lower Tester -> IUT: SimplePairingConfirm {
+        transaction_id: 0,
+        commitment_value: [0; 16],
+    }
+    IUT -> Lower Tester: SimplePairingNumber {
+        transaction_id: 0,
+        nonce: [0; 16],
+    }
+    Lower Tester -> IUT: Accepted {
+        transaction_id: 0,
+        accepted_opcode: Opcode::SimplePairingNumber,
+    }
+    Lower Tester -> IUT: SimplePairingNumber {
+        transaction_id: 0,
+        nonce: [0; 16],
+    }
+    IUT -> Upper Tester: UserConfirmationRequest { bd_addr: context.peer_address(), numeric_value: 0 }
+    IUT -> Lower Tester: Accepted {
+        transaction_id: 0,
+        accepted_opcode: Opcode::SimplePairingNumber,
+    }
+    Upper Tester -> IUT: UserConfirmationRequestNegativeReply { bd_addr: context.peer_address() }
+    IUT -> Upper Tester: UserConfirmationRequestNegativeReplyComplete {
+        num_hci_command_packets: 1,
+        status: ErrorCode::Success,
+        bd_addr: context.peer_address(),
+    }
+    IUT -> Lower Tester: NumericComparaisonFailed {
+        transaction_id: 0,
+    }
+    IUT -> Upper Tester: SimplePairingComplete {
+        status: ErrorCode::AuthenticationFailure,
+        bd_addr: context.peer_address(),
+    }
+    IUT -> Upper Tester: AuthenticationComplete {
+        status: ErrorCode::AuthenticationFailure,
+        connection_handle: context.peer_handle(),
+    }
+}
diff --git a/tools/rootcanal/lmp/test/SP/BV-09-C.in b/tools/rootcanal/lmp/test/SP/BV-09-C.in
new file mode 100644
index 0000000..b5fa989
--- /dev/null
+++ b/tools/rootcanal/lmp/test/SP/BV-09-C.in
@@ -0,0 +1,111 @@
+sequence! { procedure, context,
+    // ACL Connection Established
+    Lower Tester -> IUT: IoCapabilityReq {
+        transaction_id: 0,
+        io_capabilities: 0x01,
+        oob_authentication_data: 0x00,
+        authentication_requirement: 0x01,
+    }
+    IUT -> Upper Tester: IoCapabilityResponse {
+        bd_addr: context.peer_address(),
+        io_capability: IoCapability::DisplayYesNo,
+        oob_data_present: OobDataPresent::NotPresent,
+        authentication_requirements: AuthenticationRequirements::NoBondingMitmProtection,
+    }
+    IUT -> Upper Tester: IoCapabilityRequest {
+        bd_addr: context.peer_address(),
+    }
+    Upper Tester -> IUT: IoCapabilityRequestReply {
+        bd_addr: context.peer_address(),
+        io_capability: IoCapability::DisplayYesNo,
+        oob_present: OobDataPresent::NotPresent,
+        authentication_requirements: AuthenticationRequirements::NoBondingMitmProtection,
+    }
+    IUT -> Upper Tester: IoCapabilityRequestReplyComplete {
+        num_hci_command_packets: 1,
+        status: ErrorCode::Success,
+        bd_addr: context.peer_address(),
+    }
+    IUT -> Lower Tester: IoCapabilityRes {
+        transaction_id: 0,
+        io_capabilities: 0x01,
+        oob_authentication_data: 0x00,
+        authentication_requirement: 0x01,
+    }
+    // Public Key Exchange
+    Lower Tester -> IUT: EncapsulatedHeader {
+        transaction_id: 0,
+        major_type: 1,
+        minor_type: 1,
+        payload_length: 48,
+    }
+    IUT -> Lower Tester: Accepted {
+        transaction_id: 0,
+        accepted_opcode: Opcode::EncapsulatedHeader,
+    }
+    repeat 3 times with (part in peer_p192_public_key()) {
+        Lower Tester -> IUT: EncapsulatedPayload {
+            transaction_id: 0,
+            data: part,
+        }
+        IUT -> Lower Tester: Accepted {
+            transaction_id: 0,
+            accepted_opcode: Opcode::EncapsulatedPayload,
+        }
+    }
+    IUT -> Lower Tester: EncapsulatedHeader {
+        transaction_id: 0,
+        major_type: 1,
+        minor_type: 1,
+        payload_length: 48,
+    }
+    Lower Tester -> IUT: Accepted {
+        transaction_id: 0,
+        accepted_opcode: Opcode::EncapsulatedHeader,
+    }
+    repeat 3 times with (part in local_p192_public_key(&context)) {
+        IUT -> Lower Tester: EncapsulatedPayload {
+            transaction_id: 0,
+            data: part,
+        }
+        Lower Tester -> IUT: Accepted {
+            transaction_id: 0,
+            accepted_opcode: Opcode::EncapsulatedPayload,
+        }
+    }
+    // Authentication Stage 1: Numeric Comparaison Protocol
+    IUT -> Lower Tester: SimplePairingConfirm {
+        transaction_id: 0,
+        commitment_value: [0; 16],
+    }
+    Lower Tester -> IUT: SimplePairingNumber {
+        transaction_id: 0,
+        nonce: [0; 16],
+    }
+    IUT -> Lower Tester: Accepted {
+        transaction_id: 0,
+        accepted_opcode: Opcode::SimplePairingNumber,
+    }
+    IUT -> Lower Tester: SimplePairingNumber {
+        transaction_id: 0,
+        nonce: [0; 16],
+    }
+    Lower Tester -> IUT: Accepted {
+        transaction_id: 0,
+        accepted_opcode: Opcode::SimplePairingNumber,
+    }
+    IUT -> Upper Tester: UserConfirmationRequest { bd_addr: context.peer_address(), numeric_value: 0 }
+    Upper Tester -> IUT: UserConfirmationRequestReply { bd_addr: context.peer_address() }
+    IUT -> Upper Tester: UserConfirmationRequestReplyComplete {
+        num_hci_command_packets: 1,
+        status: ErrorCode::Success,
+        bd_addr: context.peer_address(),
+    }
+    Lower Tester -> IUT: NumericComparaisonFailed {
+        transaction_id: 0,
+    }
+    IUT -> Upper Tester: SimplePairingComplete {
+        status: ErrorCode::AuthenticationFailure,
+        bd_addr: context.peer_address(),
+    }
+}
diff --git a/tools/rootcanal/lmp/test/SP/BV-10-C.in b/tools/rootcanal/lmp/test/SP/BV-10-C.in
new file mode 100644
index 0000000..ddcd29f
--- /dev/null
+++ b/tools/rootcanal/lmp/test/SP/BV-10-C.in
@@ -0,0 +1,135 @@
+sequence! { procedure, context,
+    // ACL Connection Established
+    Upper Tester -> IUT: AuthenticationRequested {
+        connection_handle: context.peer_handle()
+    }
+    IUT -> Upper Tester: AuthenticationRequestedStatus {
+       num_hci_command_packets: 1,
+       status: ErrorCode::Success,
+    }
+    IUT -> Upper Tester: LinkKeyRequest {
+        bd_addr: context.peer_address(),
+    }
+    Upper Tester -> IUT: LinkKeyRequestNegativeReply {
+        bd_addr: context.peer_address(),
+    }
+    IUT -> Upper Tester: LinkKeyRequestNegativeReplyComplete {
+       num_hci_command_packets: 1,
+       status: ErrorCode::Success,
+       bd_addr: context.peer_address(),
+    }
+    IUT -> Upper Tester: IoCapabilityRequest {
+        bd_addr: context.peer_address(),
+    }
+    Upper Tester -> IUT: IoCapabilityRequestReply {
+        bd_addr: context.peer_address(),
+        io_capability: IoCapability::DisplayYesNo,
+        oob_present: OobDataPresent::NotPresent,
+        authentication_requirements: AuthenticationRequirements::NoBondingMitmProtection,
+    }
+    IUT -> Upper Tester: IoCapabilityRequestReplyComplete {
+        num_hci_command_packets: 1,
+        status: ErrorCode::Success,
+        bd_addr: context.peer_address(),
+    }
+    IUT -> Lower Tester: IoCapabilityReq {
+        transaction_id: 0,
+        io_capabilities: 0x01,
+        oob_authentication_data: 0x00,
+        authentication_requirement: 0x01,
+    }
+    Lower Tester -> IUT: IoCapabilityRes {
+        transaction_id: 0,
+        io_capabilities: 0x01,
+        oob_authentication_data: 0x00,
+        authentication_requirement: 0x01,
+    }
+    IUT -> Upper Tester: IoCapabilityResponse {
+        bd_addr: context.peer_address(),
+        io_capability: IoCapability::DisplayYesNo,
+        oob_data_present: OobDataPresent::NotPresent,
+        authentication_requirements: AuthenticationRequirements::NoBondingMitmProtection,
+    }
+    // Public Key Exchange
+    IUT -> Lower Tester: EncapsulatedHeader {
+        transaction_id: 0,
+        major_type: 1,
+        minor_type: 1,
+        payload_length: 48,
+    }
+    Lower Tester -> IUT: Accepted {
+        transaction_id: 0,
+        accepted_opcode: Opcode::EncapsulatedHeader,
+    }
+    repeat 3 times with (part in local_p192_public_key(&context)) {
+        IUT -> Lower Tester: EncapsulatedPayload {
+            transaction_id: 0,
+            data: part,
+        }
+        Lower Tester -> IUT: Accepted {
+            transaction_id: 0,
+            accepted_opcode: Opcode::EncapsulatedPayload,
+        }
+    }
+    Lower Tester -> IUT: EncapsulatedHeader {
+        transaction_id: 0,
+        major_type: 1,
+        minor_type: 1,
+        payload_length: 48,
+    }
+    IUT -> Lower Tester: Accepted {
+        transaction_id: 0,
+        accepted_opcode: Opcode::EncapsulatedHeader,
+    }
+    repeat 3 times with (part in peer_p192_public_key()) {
+        Lower Tester -> IUT: EncapsulatedPayload {
+            transaction_id: 0,
+            data: part,
+        }
+        IUT -> Lower Tester: Accepted {
+            transaction_id: 0,
+            accepted_opcode: Opcode::EncapsulatedPayload,
+        }
+    }
+    // Authentication Stage 1: Numeric Comparaison Protocol
+    Lower Tester -> IUT: SimplePairingConfirm {
+        transaction_id: 0,
+        commitment_value: [0; 16],
+    }
+    IUT -> Lower Tester: SimplePairingNumber {
+        transaction_id: 0,
+        nonce: [0; 16],
+    }
+    Lower Tester -> IUT: Accepted {
+        transaction_id: 0,
+        accepted_opcode: Opcode::SimplePairingNumber,
+    }
+    Lower Tester -> IUT: SimplePairingNumber {
+        transaction_id: 0,
+        nonce: [0; 16],
+    }
+    IUT -> Upper Tester: UserConfirmationRequest { bd_addr: context.peer_address(), numeric_value: 0 }
+    IUT -> Lower Tester: Accepted {
+        transaction_id: 0,
+        accepted_opcode: Opcode::SimplePairingNumber,
+    }
+    Upper Tester -> IUT: UserConfirmationRequestReply { bd_addr: context.peer_address() }
+    IUT -> Upper Tester: UserConfirmationRequestReplyComplete {
+        num_hci_command_packets: 1,
+        status: ErrorCode::Success,
+        bd_addr: context.peer_address(),
+    }
+    IUT -> Lower Tester: DhkeyCheck {
+        transaction_id: 0,
+        confirmation_value: [0; 16],
+    }
+    Lower Tester -> IUT: NotAccepted { transaction_id: 0, not_accepted_opcode: Opcode::DhkeyCheck, error_code: 0x05 }
+    IUT -> Upper Tester: SimplePairingComplete {
+        status: ErrorCode::AuthenticationFailure,
+        bd_addr: context.peer_address(),
+    }
+    IUT -> Upper Tester: AuthenticationComplete {
+        status: ErrorCode::AuthenticationFailure,
+        connection_handle: context.peer_handle(),
+    }
+}
diff --git a/tools/rootcanal/lmp/test/SP/BV-11-C.in b/tools/rootcanal/lmp/test/SP/BV-11-C.in
new file mode 100644
index 0000000..d874208
--- /dev/null
+++ b/tools/rootcanal/lmp/test/SP/BV-11-C.in
@@ -0,0 +1,113 @@
+sequence! { procedure, context,
+    // ACL Connection Established
+    Lower Tester -> IUT: IoCapabilityReq {
+        transaction_id: 0,
+        io_capabilities: 0x01,
+        oob_authentication_data: 0x00,
+        authentication_requirement: 0x01,
+    }
+    IUT -> Upper Tester: IoCapabilityResponse {
+        bd_addr: context.peer_address(),
+        io_capability: IoCapability::DisplayYesNo,
+        oob_data_present: OobDataPresent::NotPresent,
+        authentication_requirements: AuthenticationRequirements::NoBondingMitmProtection,
+    }
+    IUT -> Upper Tester: IoCapabilityRequest {
+        bd_addr: context.peer_address(),
+    }
+    Upper Tester -> IUT: IoCapabilityRequestReply {
+        bd_addr: context.peer_address(),
+        io_capability: IoCapability::DisplayYesNo,
+        oob_present: OobDataPresent::NotPresent,
+        authentication_requirements: AuthenticationRequirements::NoBondingMitmProtection,
+    }
+    IUT -> Upper Tester: IoCapabilityRequestReplyComplete {
+        num_hci_command_packets: 1,
+        status: ErrorCode::Success,
+        bd_addr: context.peer_address(),
+    }
+    IUT -> Lower Tester: IoCapabilityRes {
+        transaction_id: 0,
+        io_capabilities: 0x01,
+        oob_authentication_data: 0x00,
+        authentication_requirement: 0x01,
+    }
+    // Public Key Exchange
+    Lower Tester -> IUT: EncapsulatedHeader {
+        transaction_id: 0,
+        major_type: 1,
+        minor_type: 1,
+        payload_length: 48,
+    }
+    IUT -> Lower Tester: Accepted {
+        transaction_id: 0,
+        accepted_opcode: Opcode::EncapsulatedHeader,
+    }
+    repeat 3 times with (part in peer_p192_public_key()) {
+        Lower Tester -> IUT: EncapsulatedPayload {
+            transaction_id: 0,
+            data: part,
+        }
+        IUT -> Lower Tester: Accepted {
+            transaction_id: 0,
+            accepted_opcode: Opcode::EncapsulatedPayload,
+        }
+    }
+    IUT -> Lower Tester: EncapsulatedHeader {
+        transaction_id: 0,
+        major_type: 1,
+        minor_type: 1,
+        payload_length: 48,
+    }
+    Lower Tester -> IUT: Accepted {
+        transaction_id: 0,
+        accepted_opcode: Opcode::EncapsulatedHeader,
+    }
+    repeat 3 times with (part in local_p192_public_key(&context)) {
+        IUT -> Lower Tester: EncapsulatedPayload {
+            transaction_id: 0,
+            data: part,
+        }
+        Lower Tester -> IUT: Accepted {
+            transaction_id: 0,
+            accepted_opcode: Opcode::EncapsulatedPayload,
+        }
+    }
+    // Authentication Stage 1: Numeric Comparaison Protocol
+    IUT -> Lower Tester: SimplePairingConfirm {
+        transaction_id: 0,
+        commitment_value: [0; 16],
+    }
+    Lower Tester -> IUT: SimplePairingNumber {
+        transaction_id: 0,
+        nonce: [0; 16],
+    }
+    IUT -> Lower Tester: Accepted {
+        transaction_id: 0,
+        accepted_opcode: Opcode::SimplePairingNumber,
+    }
+    IUT -> Lower Tester: SimplePairingNumber {
+        transaction_id: 0,
+        nonce: [0; 16],
+    }
+    Lower Tester -> IUT: Accepted {
+        transaction_id: 0,
+        accepted_opcode: Opcode::SimplePairingNumber,
+    }
+    IUT -> Upper Tester: UserConfirmationRequest { bd_addr: context.peer_address(), numeric_value: 0 }
+    Upper Tester -> IUT: UserConfirmationRequestNegativeReply { bd_addr: context.peer_address() }
+    IUT -> Upper Tester: UserConfirmationRequestNegativeReplyComplete {
+        num_hci_command_packets: 1,
+        status: ErrorCode::Success,
+        bd_addr: context.peer_address(),
+    }
+    Lower Tester -> IUT: DhkeyCheck {
+        transaction_id: 0,
+        confirmation_value: [0; 16],
+    }
+    IUT -> Lower Tester: NotAccepted { transaction_id: 0, not_accepted_opcode: Opcode::DhkeyCheck }
+    IUT -> Upper Tester: SimplePairingComplete {
+        status: ErrorCode::AuthenticationFailure,
+        bd_addr: context.peer_address(),
+    }
+}
diff --git a/tools/rootcanal/lmp/test/SP/BV-12-C.in b/tools/rootcanal/lmp/test/SP/BV-12-C.in
new file mode 100644
index 0000000..218f3c0
--- /dev/null
+++ b/tools/rootcanal/lmp/test/SP/BV-12-C.in
@@ -0,0 +1,174 @@
+sequence! { procedure, context,
+    // ACL Connection Established
+    Upper Tester -> IUT: AuthenticationRequested {
+        connection_handle: context.peer_handle()
+    }
+    IUT -> Upper Tester: AuthenticationRequestedStatus {
+       num_hci_command_packets: 1,
+       status: ErrorCode::Success,
+    }
+    IUT -> Upper Tester: LinkKeyRequest {
+        bd_addr: context.peer_address(),
+    }
+    Upper Tester -> IUT: LinkKeyRequestNegativeReply {
+        bd_addr: context.peer_address(),
+    }
+    IUT -> Upper Tester: LinkKeyRequestNegativeReplyComplete {
+       num_hci_command_packets: 1,
+       status: ErrorCode::Success,
+       bd_addr: context.peer_address(),
+    }
+    IUT -> Upper Tester: IoCapabilityRequest {
+        bd_addr: context.peer_address(),
+    }
+    Upper Tester -> IUT: IoCapabilityRequestReply {
+        bd_addr: context.peer_address(),
+        io_capability: IoCapability::KeyboardOnly,
+        oob_present: OobDataPresent::NotPresent,
+        authentication_requirements: AuthenticationRequirements::NoBondingMitmProtection,
+    }
+    IUT -> Upper Tester: IoCapabilityRequestReplyComplete {
+        num_hci_command_packets: 1,
+        status: ErrorCode::Success,
+        bd_addr: context.peer_address(),
+    }
+    IUT -> Lower Tester: IoCapabilityReq {
+        transaction_id: 0,
+        io_capabilities: 0x02,
+        oob_authentication_data: 0x00,
+        authentication_requirement: 0x01,
+    }
+    Lower Tester -> IUT: IoCapabilityRes {
+        transaction_id: 0,
+        io_capabilities: 0x00,
+        oob_authentication_data: 0x00,
+        authentication_requirement: 0x01,
+    }
+    IUT -> Upper Tester: IoCapabilityResponse {
+        bd_addr: context.peer_address(),
+        io_capability: IoCapability::DisplayOnly,
+        oob_data_present: OobDataPresent::NotPresent,
+        authentication_requirements: AuthenticationRequirements::NoBondingMitmProtection,
+    }
+    // Public Key Exchange
+    IUT -> Lower Tester: EncapsulatedHeader {
+        transaction_id: 0,
+        major_type: 1,
+        minor_type: 1,
+        payload_length: 48,
+    }
+    Lower Tester -> IUT: Accepted {
+        transaction_id: 0,
+        accepted_opcode: Opcode::EncapsulatedHeader,
+    }
+    repeat 3 times with (part in local_p192_public_key(&context)) {
+        IUT -> Lower Tester: EncapsulatedPayload {
+            transaction_id: 0,
+            data: part,
+        }
+        Lower Tester -> IUT: Accepted {
+            transaction_id: 0,
+            accepted_opcode: Opcode::EncapsulatedPayload,
+        }
+    }
+    Lower Tester -> IUT: EncapsulatedHeader {
+        transaction_id: 0,
+        major_type: 1,
+        minor_type: 1,
+        payload_length: 48,
+    }
+    IUT -> Lower Tester: Accepted {
+        transaction_id: 0,
+        accepted_opcode: Opcode::EncapsulatedHeader,
+    }
+    repeat 3 times with (part in peer_p192_public_key()) {
+        Lower Tester -> IUT: EncapsulatedPayload {
+            transaction_id: 0,
+            data: part,
+        }
+        IUT -> Lower Tester: Accepted {
+            transaction_id: 0,
+            accepted_opcode: Opcode::EncapsulatedPayload,
+        }
+    }
+    // Authentication Stage 1: Passkey Entry Protocol
+    IUT -> Upper Tester: UserPasskeyRequest {
+        bd_addr: context.peer_address(),
+    }
+    Upper Tester -> IUT: UserPasskeyRequestReply {
+        bd_addr: context.peer_address(),
+        numeric_value: 0,
+    }
+    IUT -> Upper Tester: UserPasskeyRequestReplyComplete {
+        num_hci_command_packets: 1,
+        status: ErrorCode::Success,
+        bd_addr: context.peer_address(),
+    }
+    repeat 20 times {
+        IUT -> Lower Tester: SimplePairingConfirm {
+            transaction_id: 0,
+            commitment_value: [0; 16],
+        }
+        Lower Tester -> IUT: SimplePairingConfirm {
+            transaction_id: 0,
+            commitment_value: [0; 16],
+        }
+        IUT -> Lower Tester: SimplePairingNumber {
+            transaction_id: 0,
+            nonce: [0; 16],
+        }
+        Lower Tester -> IUT: Accepted {
+            transaction_id: 0,
+            accepted_opcode: Opcode::SimplePairingNumber,
+        }
+        Lower Tester -> IUT: SimplePairingNumber {
+            transaction_id: 0,
+            nonce: [0; 16],
+        }
+        IUT -> Lower Tester: Accepted {
+            transaction_id: 0,
+            accepted_opcode: Opcode::SimplePairingNumber,
+        }
+    }
+    // Authentication Stage 2
+    IUT -> Lower Tester: DhkeyCheck {
+        transaction_id: 0,
+        confirmation_value: [0; 16],
+    }
+    Lower Tester -> IUT: Accepted { transaction_id: 0, accepted_opcode: Opcode::DhkeyCheck }
+    Lower Tester -> IUT: DhkeyCheck {
+        transaction_id: 0,
+        confirmation_value: [0; 16],
+    }
+    IUT -> Lower Tester: Accepted { transaction_id: 0, accepted_opcode: Opcode::DhkeyCheck }
+    IUT -> Upper Tester: SimplePairingComplete {
+        status: ErrorCode::Success,
+        bd_addr: context.peer_address(),
+    }
+    // Link Key Calculation
+    IUT -> Lower Tester: AuRand {
+        transaction_id: 0,
+        random_number: [0; 16],
+    }
+    Lower Tester -> IUT: Sres {
+        transaction_id: 0,
+        authentication_rsp: [0; 4],
+    }
+    Lower Tester -> IUT: AuRand {
+        transaction_id: 0,
+        random_number: [0; 16],
+    }
+    IUT -> Lower Tester: Sres {
+        transaction_id: 0,
+        authentication_rsp: [0; 4],
+    }
+    IUT -> Upper Tester: LinkKeyNotification {
+        bd_addr: context.peer_address(),
+        key_type: KeyType::AuthenticatedP192,
+        link_key: [0; 16],
+    }
+    IUT -> Upper Tester: AuthenticationComplete {
+        status: ErrorCode::Success,
+        connection_handle: context.peer_handle(),
+    }
+}
diff --git a/tools/rootcanal/lmp/test/SP/BV-13-C.in b/tools/rootcanal/lmp/test/SP/BV-13-C.in
new file mode 100644
index 0000000..28618e3
--- /dev/null
+++ b/tools/rootcanal/lmp/test/SP/BV-13-C.in
@@ -0,0 +1,141 @@
+sequence! { procedure, context,
+    // ACL Connection Established
+    Lower Tester -> IUT: IoCapabilityReq {
+        transaction_id: 0,
+        io_capabilities: 0x02,
+        oob_authentication_data: 0x00,
+        authentication_requirement: 0x01,
+    }
+    IUT -> Upper Tester: IoCapabilityResponse {
+        bd_addr: context.peer_address(),
+        io_capability: IoCapability::KeyboardOnly,
+        oob_data_present: OobDataPresent::NotPresent,
+        authentication_requirements: AuthenticationRequirements::NoBondingMitmProtection,
+    }
+    IUT -> Upper Tester: IoCapabilityRequest {
+        bd_addr: context.peer_address(),
+    }
+    Upper Tester -> IUT: IoCapabilityRequestReply {
+        bd_addr: context.peer_address(),
+        io_capability: IoCapability::DisplayOnly,
+        oob_present: OobDataPresent::NotPresent,
+        authentication_requirements: AuthenticationRequirements::NoBondingMitmProtection,
+    }
+    IUT -> Upper Tester: IoCapabilityRequestReplyComplete {
+        num_hci_command_packets: 1,
+        status: ErrorCode::Success,
+        bd_addr: context.peer_address(),
+    }
+    IUT -> Lower Tester: IoCapabilityRes {
+        transaction_id: 0,
+        io_capabilities: 0x00,
+        oob_authentication_data: 0x00,
+        authentication_requirement: 0x01,
+    }
+    // Public Key Exchange
+    Lower Tester -> IUT: EncapsulatedHeader {
+        transaction_id: 0,
+        major_type: 1,
+        minor_type: 1,
+        payload_length: 48,
+    }
+    IUT -> Lower Tester: Accepted {
+        transaction_id: 0,
+        accepted_opcode: Opcode::EncapsulatedHeader,
+    }
+    repeat 3 times with (part in peer_p192_public_key()) {
+        Lower Tester -> IUT: EncapsulatedPayload {
+            transaction_id: 0,
+            data: part,
+        }
+        IUT -> Lower Tester: Accepted {
+            transaction_id: 0,
+            accepted_opcode: Opcode::EncapsulatedPayload,
+        }
+    }
+    IUT -> Lower Tester: EncapsulatedHeader {
+        transaction_id: 0,
+        major_type: 1,
+        minor_type: 1,
+        payload_length: 48,
+    }
+    Lower Tester -> IUT: Accepted {
+        transaction_id: 0,
+        accepted_opcode: Opcode::EncapsulatedHeader,
+    }
+    repeat 3 times with (part in local_p192_public_key(&context)) {
+        IUT -> Lower Tester: EncapsulatedPayload {
+            transaction_id: 0,
+            data: part,
+        }
+        Lower Tester -> IUT: Accepted {
+            transaction_id: 0,
+            accepted_opcode: Opcode::EncapsulatedPayload,
+        }
+    }
+    // Authentication Stage 1: Passkey Entry Protocol
+    IUT -> Upper Tester: UserPasskeyNotification { bd_addr: context.peer_address(), passkey: 0 }
+    repeat 20 times {
+        Lower Tester -> IUT: SimplePairingConfirm {
+            transaction_id: 0,
+            commitment_value: [0; 16],
+        }
+        IUT -> Lower Tester: SimplePairingConfirm {
+            transaction_id: 0,
+            commitment_value: [0; 16],
+        }
+        Lower Tester -> IUT: SimplePairingNumber {
+            transaction_id: 0,
+            nonce: [0; 16],
+        }
+        IUT -> Lower Tester: Accepted {
+            transaction_id: 0,
+            accepted_opcode: Opcode::SimplePairingNumber,
+        }
+        IUT -> Lower Tester: SimplePairingNumber {
+            transaction_id: 0,
+            nonce: [0; 16],
+        }
+        Lower Tester -> IUT: Accepted {
+            transaction_id: 0,
+            accepted_opcode: Opcode::SimplePairingNumber,
+        }
+    }
+    // Authentication Stage 2
+    Lower Tester -> IUT: DhkeyCheck {
+        transaction_id: 0,
+        confirmation_value: [0; 16],
+    }
+    IUT -> Lower Tester: Accepted { transaction_id: 0, accepted_opcode: Opcode::DhkeyCheck }
+    IUT -> Lower Tester: DhkeyCheck {
+        transaction_id: 0,
+        confirmation_value: [0; 16],
+    }
+    Lower Tester -> IUT: Accepted { transaction_id: 0, accepted_opcode: Opcode::DhkeyCheck }
+    IUT -> Upper Tester: SimplePairingComplete {
+        status: ErrorCode::Success,
+        bd_addr: context.peer_address(),
+    }
+    // Link Key Calculation
+    Lower Tester -> IUT: AuRand {
+        transaction_id: 0,
+        random_number: [0; 16],
+    }
+    IUT -> Lower Tester: Sres {
+        transaction_id: 0,
+        authentication_rsp: [0; 4],
+    }
+    IUT -> Lower Tester: AuRand {
+        transaction_id: 0,
+        random_number: [0; 16],
+    }
+    Lower Tester -> IUT: Sres {
+        transaction_id: 0,
+        authentication_rsp: [0; 4],
+    }
+    IUT -> Upper Tester: LinkKeyNotification {
+        bd_addr: context.peer_address(),
+        key_type: KeyType::AuthenticatedP192,
+        link_key: [0; 16],
+    }
+}
diff --git a/tools/rootcanal/lmp/test/SP/BV-14-C.in b/tools/rootcanal/lmp/test/SP/BV-14-C.in
new file mode 100644
index 0000000..13e4e46
--- /dev/null
+++ b/tools/rootcanal/lmp/test/SP/BV-14-C.in
@@ -0,0 +1,117 @@
+sequence! { procedure, context,
+    // ACL Connection Established
+    Upper Tester -> IUT: AuthenticationRequested {
+        connection_handle: context.peer_handle()
+    }
+    IUT -> Upper Tester: AuthenticationRequestedStatus {
+       num_hci_command_packets: 1,
+       status: ErrorCode::Success,
+    }
+    IUT -> Upper Tester: LinkKeyRequest {
+        bd_addr: context.peer_address(),
+    }
+    Upper Tester -> IUT: LinkKeyRequestNegativeReply {
+        bd_addr: context.peer_address(),
+    }
+    IUT -> Upper Tester: LinkKeyRequestNegativeReplyComplete {
+       num_hci_command_packets: 1,
+       status: ErrorCode::Success,
+       bd_addr: context.peer_address(),
+    }
+    IUT -> Upper Tester: IoCapabilityRequest {
+        bd_addr: context.peer_address(),
+    }
+    Upper Tester -> IUT: IoCapabilityRequestReply {
+        bd_addr: context.peer_address(),
+        io_capability: IoCapability::KeyboardOnly,
+        oob_present: OobDataPresent::NotPresent,
+        authentication_requirements: AuthenticationRequirements::NoBondingMitmProtection,
+    }
+    IUT -> Upper Tester: IoCapabilityRequestReplyComplete {
+        num_hci_command_packets: 1,
+        status: ErrorCode::Success,
+        bd_addr: context.peer_address(),
+    }
+    IUT -> Lower Tester: IoCapabilityReq {
+        transaction_id: 0,
+        io_capabilities: 0x02,
+        oob_authentication_data: 0x00,
+        authentication_requirement: 0x01,
+    }
+    Lower Tester -> IUT: IoCapabilityRes {
+        transaction_id: 0,
+        io_capabilities: 0x00,
+        oob_authentication_data: 0x00,
+        authentication_requirement: 0x01,
+    }
+    IUT -> Upper Tester: IoCapabilityResponse {
+        bd_addr: context.peer_address(),
+        io_capability: IoCapability::DisplayOnly,
+        oob_data_present: OobDataPresent::NotPresent,
+        authentication_requirements: AuthenticationRequirements::NoBondingMitmProtection,
+    }
+    // Public Key Exchange
+    IUT -> Lower Tester: EncapsulatedHeader {
+        transaction_id: 0,
+        major_type: 1,
+        minor_type: 1,
+        payload_length: 48,
+    }
+    Lower Tester -> IUT: Accepted {
+        transaction_id: 0,
+        accepted_opcode: Opcode::EncapsulatedHeader,
+    }
+    repeat 3 times with (part in local_p192_public_key(&context)) {
+        IUT -> Lower Tester: EncapsulatedPayload {
+            transaction_id: 0,
+            data: part,
+        }
+        Lower Tester -> IUT: Accepted {
+            transaction_id: 0,
+            accepted_opcode: Opcode::EncapsulatedPayload,
+        }
+    }
+    Lower Tester -> IUT: EncapsulatedHeader {
+        transaction_id: 0,
+        major_type: 1,
+        minor_type: 1,
+        payload_length: 48,
+    }
+    IUT -> Lower Tester: Accepted {
+        transaction_id: 0,
+        accepted_opcode: Opcode::EncapsulatedHeader,
+    }
+    repeat 3 times with (part in peer_p192_public_key()) {
+        Lower Tester -> IUT: EncapsulatedPayload {
+            transaction_id: 0,
+            data: part,
+        }
+        IUT -> Lower Tester: Accepted {
+            transaction_id: 0,
+            accepted_opcode: Opcode::EncapsulatedPayload,
+        }
+    }
+    // Authentication Stage 1: Passkey Entry Protocol
+    IUT -> Upper Tester: UserPasskeyRequest {
+        bd_addr: context.peer_address(),
+    }
+    Upper Tester -> IUT: UserPasskeyRequestNegativeReply {
+        bd_addr: context.peer_address(),
+    }
+    IUT -> Upper Tester: UserPasskeyRequestNegativeReplyComplete {
+        num_hci_command_packets: 1,
+        status: ErrorCode::Success,
+        bd_addr: context.peer_address(),
+    }
+    IUT -> Lower Tester: PasskeyFailed {
+        transaction_id: 0,
+    }
+    IUT -> Upper Tester: SimplePairingComplete {
+        status: ErrorCode::AuthenticationFailure,
+        bd_addr: context.peer_address(),
+    }
+    IUT -> Upper Tester: AuthenticationComplete {
+        status: ErrorCode::AuthenticationFailure,
+        connection_handle: context.peer_handle(),
+    }
+}
diff --git a/tools/rootcanal/lmp/test/SP/BV-15-C.in b/tools/rootcanal/lmp/test/SP/BV-15-C.in
new file mode 100644
index 0000000..8505005
--- /dev/null
+++ b/tools/rootcanal/lmp/test/SP/BV-15-C.in
@@ -0,0 +1,85 @@
+sequence! { procedure, context,
+    // ACL Connection Established
+    Lower Tester -> IUT: IoCapabilityReq {
+        transaction_id: 0,
+        io_capabilities: 0x02,
+        oob_authentication_data: 0x00,
+        authentication_requirement: 0x01,
+    }
+    IUT -> Upper Tester: IoCapabilityResponse {
+        bd_addr: context.peer_address(),
+        io_capability: IoCapability::KeyboardOnly,
+        oob_data_present: OobDataPresent::NotPresent,
+        authentication_requirements: AuthenticationRequirements::NoBondingMitmProtection,
+    }
+    IUT -> Upper Tester: IoCapabilityRequest {
+        bd_addr: context.peer_address(),
+    }
+    Upper Tester -> IUT: IoCapabilityRequestReply {
+        bd_addr: context.peer_address(),
+        io_capability: IoCapability::DisplayOnly,
+        oob_present: OobDataPresent::NotPresent,
+        authentication_requirements: AuthenticationRequirements::NoBondingMitmProtection,
+    }
+    IUT -> Upper Tester: IoCapabilityRequestReplyComplete {
+        num_hci_command_packets: 1,
+        status: ErrorCode::Success,
+        bd_addr: context.peer_address(),
+    }
+    IUT -> Lower Tester: IoCapabilityRes {
+        transaction_id: 0,
+        io_capabilities: 0x00,
+        oob_authentication_data: 0x00,
+        authentication_requirement: 0x01,
+    }
+    // Public Key Exchange
+    Lower Tester -> IUT: EncapsulatedHeader {
+        transaction_id: 0,
+        major_type: 1,
+        minor_type: 1,
+        payload_length: 48,
+    }
+    IUT -> Lower Tester: Accepted {
+        transaction_id: 0,
+        accepted_opcode: Opcode::EncapsulatedHeader,
+    }
+    repeat 3 times with (part in peer_p192_public_key()) {
+        Lower Tester -> IUT: EncapsulatedPayload {
+            transaction_id: 0,
+            data: part,
+        }
+        IUT -> Lower Tester: Accepted {
+            transaction_id: 0,
+            accepted_opcode: Opcode::EncapsulatedPayload,
+        }
+    }
+    IUT -> Lower Tester: EncapsulatedHeader {
+        transaction_id: 0,
+        major_type: 1,
+        minor_type: 1,
+        payload_length: 48,
+    }
+    Lower Tester -> IUT: Accepted {
+        transaction_id: 0,
+        accepted_opcode: Opcode::EncapsulatedHeader,
+    }
+    repeat 3 times with (part in local_p192_public_key(&context)) {
+        IUT -> Lower Tester: EncapsulatedPayload {
+            transaction_id: 0,
+            data: part,
+        }
+        Lower Tester -> IUT: Accepted {
+            transaction_id: 0,
+            accepted_opcode: Opcode::EncapsulatedPayload,
+        }
+    }
+    // Authentication Stage 1: Passkey Entry Protocol
+    IUT -> Upper Tester: UserPasskeyNotification { bd_addr: context.peer_address(), passkey: 0 }
+    Lower Tester -> IUT: PasskeyFailed {
+      transaction_id: 0,
+    }
+    IUT -> Upper Tester: SimplePairingComplete {
+        status: ErrorCode::AuthenticationFailure,
+        bd_addr: context.peer_address(),
+    }
+}
diff --git a/tools/rootcanal/lmp/test/SP/BV-16-C.in b/tools/rootcanal/lmp/test/SP/BV-16-C.in
new file mode 100644
index 0000000..fc3f014
--- /dev/null
+++ b/tools/rootcanal/lmp/test/SP/BV-16-C.in
@@ -0,0 +1,132 @@
+sequence! { procedure, context,
+    // ACL Connection Established
+    Upper Tester -> IUT: AuthenticationRequested {
+        connection_handle: context.peer_handle()
+    }
+    IUT -> Upper Tester: AuthenticationRequestedStatus {
+       num_hci_command_packets: 1,
+       status: ErrorCode::Success,
+    }
+    IUT -> Upper Tester: LinkKeyRequest {
+        bd_addr: context.peer_address(),
+    }
+    Upper Tester -> IUT: LinkKeyRequestNegativeReply {
+        bd_addr: context.peer_address(),
+    }
+    IUT -> Upper Tester: LinkKeyRequestNegativeReplyComplete {
+       num_hci_command_packets: 1,
+       status: ErrorCode::Success,
+       bd_addr: context.peer_address(),
+    }
+    IUT -> Upper Tester: IoCapabilityRequest {
+        bd_addr: context.peer_address(),
+    }
+    Upper Tester -> IUT: IoCapabilityRequestReply {
+        bd_addr: context.peer_address(),
+        io_capability: IoCapability::KeyboardOnly,
+        oob_present: OobDataPresent::NotPresent,
+        authentication_requirements: AuthenticationRequirements::NoBondingMitmProtection,
+    }
+    IUT -> Upper Tester: IoCapabilityRequestReplyComplete {
+        num_hci_command_packets: 1,
+        status: ErrorCode::Success,
+        bd_addr: context.peer_address(),
+    }
+    IUT -> Lower Tester: IoCapabilityReq {
+        transaction_id: 0,
+        io_capabilities: 0x02,
+        oob_authentication_data: 0x00,
+        authentication_requirement: 0x01,
+    }
+    Lower Tester -> IUT: IoCapabilityRes {
+        transaction_id: 0,
+        io_capabilities: 0x00,
+        oob_authentication_data: 0x00,
+        authentication_requirement: 0x01,
+    }
+    IUT -> Upper Tester: IoCapabilityResponse {
+        bd_addr: context.peer_address(),
+        io_capability: IoCapability::DisplayOnly,
+        oob_data_present: OobDataPresent::NotPresent,
+        authentication_requirements: AuthenticationRequirements::NoBondingMitmProtection,
+    }
+    // Public Key Exchange
+    IUT -> Lower Tester: EncapsulatedHeader {
+        transaction_id: 0,
+        major_type: 1,
+        minor_type: 1,
+        payload_length: 48,
+    }
+    Lower Tester -> IUT: Accepted {
+        transaction_id: 0,
+        accepted_opcode: Opcode::EncapsulatedHeader,
+    }
+    repeat 3 times with (part in local_p192_public_key(&context)) {
+        IUT -> Lower Tester: EncapsulatedPayload {
+            transaction_id: 0,
+            data: part,
+        }
+        Lower Tester -> IUT: Accepted {
+            transaction_id: 0,
+            accepted_opcode: Opcode::EncapsulatedPayload,
+        }
+    }
+    Lower Tester -> IUT: EncapsulatedHeader {
+        transaction_id: 0,
+        major_type: 1,
+        minor_type: 1,
+        payload_length: 48,
+    }
+    IUT -> Lower Tester: Accepted {
+        transaction_id: 0,
+        accepted_opcode: Opcode::EncapsulatedHeader,
+    }
+    repeat 3 times with (part in peer_p192_public_key()) {
+        Lower Tester -> IUT: EncapsulatedPayload {
+            transaction_id: 0,
+            data: part,
+        }
+        IUT -> Lower Tester: Accepted {
+            transaction_id: 0,
+            accepted_opcode: Opcode::EncapsulatedPayload,
+        }
+    }
+    // Authentication Stage 1: Passkey Entry Protocol
+    IUT -> Upper Tester: UserPasskeyRequest {
+        bd_addr: context.peer_address(),
+    }
+    Upper Tester -> IUT: UserPasskeyRequestReply {
+        bd_addr: context.peer_address(),
+        numeric_value: 0,
+    }
+    IUT -> Upper Tester: UserPasskeyRequestReplyComplete {
+        num_hci_command_packets: 1,
+        status: ErrorCode::Success,
+        bd_addr: context.peer_address(),
+    }
+    IUT -> Lower Tester: SimplePairingConfirm {
+        transaction_id: 0,
+        commitment_value: [0; 16],
+    }
+    Lower Tester -> IUT: SimplePairingConfirm {
+        transaction_id: 0,
+        commitment_value: [0; 16],
+    }
+    IUT -> Lower Tester: SimplePairingNumber {
+        transaction_id: 0,
+        nonce: [0; 16],
+    }
+    Lower Tester -> IUT: NotAccepted {
+        transaction_id: 0,
+        not_accepted_opcode: Opcode::SimplePairingNumber,
+        error_code: ErrorCode::AuthenticationFailure.to_u8().unwrap(),
+    }
+    IUT -> Upper Tester: SimplePairingComplete {
+        status: ErrorCode::AuthenticationFailure,
+        bd_addr: context.peer_address(),
+    }
+    IUT -> Upper Tester: AuthenticationComplete {
+        status: ErrorCode::AuthenticationFailure,
+        connection_handle: context.peer_handle(),
+    }
+}
diff --git a/tools/rootcanal/lmp/test/SP/BV-17-C.in b/tools/rootcanal/lmp/test/SP/BV-17-C.in
new file mode 100644
index 0000000..33ea839
--- /dev/null
+++ b/tools/rootcanal/lmp/test/SP/BV-17-C.in
@@ -0,0 +1,99 @@
+sequence! { procedure, context,
+    // ACL Connection Established
+    Lower Tester -> IUT: IoCapabilityReq {
+        transaction_id: 0,
+        io_capabilities: 0x02,
+        oob_authentication_data: 0x00,
+        authentication_requirement: 0x01,
+    }
+    IUT -> Upper Tester: IoCapabilityResponse {
+        bd_addr: context.peer_address(),
+        io_capability: IoCapability::KeyboardOnly,
+        oob_data_present: OobDataPresent::NotPresent,
+        authentication_requirements: AuthenticationRequirements::NoBondingMitmProtection,
+    }
+    IUT -> Upper Tester: IoCapabilityRequest {
+        bd_addr: context.peer_address(),
+    }
+    Upper Tester -> IUT: IoCapabilityRequestReply {
+        bd_addr: context.peer_address(),
+        io_capability: IoCapability::DisplayOnly,
+        oob_present: OobDataPresent::NotPresent,
+        authentication_requirements: AuthenticationRequirements::NoBondingMitmProtection,
+    }
+    IUT -> Upper Tester: IoCapabilityRequestReplyComplete {
+        num_hci_command_packets: 1,
+        status: ErrorCode::Success,
+        bd_addr: context.peer_address(),
+    }
+    IUT -> Lower Tester: IoCapabilityRes {
+        transaction_id: 0,
+        io_capabilities: 0x00,
+        oob_authentication_data: 0x00,
+        authentication_requirement: 0x01,
+    }
+    // Public Key Exchange
+    Lower Tester -> IUT: EncapsulatedHeader {
+        transaction_id: 0,
+        major_type: 1,
+        minor_type: 1,
+        payload_length: 48,
+    }
+    IUT -> Lower Tester: Accepted {
+        transaction_id: 0,
+        accepted_opcode: Opcode::EncapsulatedHeader,
+    }
+    repeat 3 times with (part in peer_p192_public_key()) {
+        Lower Tester -> IUT: EncapsulatedPayload {
+            transaction_id: 0,
+            data: part,
+        }
+        IUT -> Lower Tester: Accepted {
+            transaction_id: 0,
+            accepted_opcode: Opcode::EncapsulatedPayload,
+        }
+    }
+    IUT -> Lower Tester: EncapsulatedHeader {
+        transaction_id: 0,
+        major_type: 1,
+        minor_type: 1,
+        payload_length: 48,
+    }
+    Lower Tester -> IUT: Accepted {
+        transaction_id: 0,
+        accepted_opcode: Opcode::EncapsulatedHeader,
+    }
+    repeat 3 times with (part in local_p192_public_key(&context)) {
+        IUT -> Lower Tester: EncapsulatedPayload {
+            transaction_id: 0,
+            data: part,
+        }
+        Lower Tester -> IUT: Accepted {
+            transaction_id: 0,
+            accepted_opcode: Opcode::EncapsulatedPayload,
+        }
+    }
+    // Authentication Stage 1: Passkey Entry Protocol
+    IUT -> Upper Tester: UserPasskeyNotification { bd_addr: context.peer_address(), passkey: 0 }
+    Lower Tester -> IUT: SimplePairingConfirm {
+        transaction_id: 0,
+        commitment_value: [0; 16],
+    }
+    IUT -> Lower Tester: SimplePairingConfirm {
+        transaction_id: 0,
+        commitment_value: [0; 16],
+    }
+    Lower Tester -> IUT: SimplePairingNumber {
+        transaction_id: 0,
+        nonce: [0; 16],
+    }
+    IUT -> Lower Tester: NotAccepted {
+        transaction_id: 0,
+        not_accepted_opcode: Opcode::SimplePairingNumber,
+        error_code: ErrorCode::AuthenticationFailure.to_u8().unwrap(),
+    }
+    IUT -> Upper Tester: SimplePairingComplete {
+        status: ErrorCode::AuthenticationFailure,
+        bd_addr: context.peer_address(),
+    }
+}
diff --git a/tools/rootcanal/lmp/test/SP/BV-18-C.in b/tools/rootcanal/lmp/test/SP/BV-18-C.in
new file mode 100644
index 0000000..164679b
--- /dev/null
+++ b/tools/rootcanal/lmp/test/SP/BV-18-C.in
@@ -0,0 +1,165 @@
+sequence! { procedure, context,
+    // ACL Connection Established
+    Upper Tester -> IUT: AuthenticationRequested {
+        connection_handle: context.peer_handle()
+    }
+    IUT -> Upper Tester: AuthenticationRequestedStatus {
+       num_hci_command_packets: 1,
+       status: ErrorCode::Success,
+    }
+    IUT -> Upper Tester: LinkKeyRequest {
+        bd_addr: context.peer_address(),
+    }
+    Upper Tester -> IUT: LinkKeyRequestNegativeReply {
+        bd_addr: context.peer_address(),
+    }
+    IUT -> Upper Tester: LinkKeyRequestNegativeReplyComplete {
+       num_hci_command_packets: 1,
+       status: ErrorCode::Success,
+       bd_addr: context.peer_address(),
+    }
+    IUT -> Upper Tester: IoCapabilityRequest {
+        bd_addr: context.peer_address(),
+    }
+    Upper Tester -> IUT: IoCapabilityRequestReply {
+        bd_addr: context.peer_address(),
+        io_capability: IoCapability::DisplayYesNo,
+        oob_present: OobDataPresent::P192Present,
+        authentication_requirements: AuthenticationRequirements::NoBondingMitmProtection,
+    }
+    IUT -> Upper Tester: IoCapabilityRequestReplyComplete {
+        num_hci_command_packets: 1,
+        status: ErrorCode::Success,
+        bd_addr: context.peer_address(),
+    }
+    IUT -> Lower Tester: IoCapabilityReq {
+        transaction_id: 0,
+        io_capabilities: 0x01,
+        oob_authentication_data: 0x01,
+        authentication_requirement: 0x01,
+    }
+    Lower Tester -> IUT: IoCapabilityRes {
+        transaction_id: 0,
+        io_capabilities: 0x01,
+        oob_authentication_data: 0x00,
+        authentication_requirement: 0x01,
+    }
+    IUT -> Upper Tester: IoCapabilityResponse {
+        bd_addr: context.peer_address(),
+        io_capability: IoCapability::DisplayYesNo,
+        oob_data_present: OobDataPresent::NotPresent,
+        authentication_requirements: AuthenticationRequirements::NoBondingMitmProtection,
+    }
+    // Public Key Exchange
+    IUT -> Lower Tester: EncapsulatedHeader {
+        transaction_id: 0,
+        major_type: 1,
+        minor_type: 1,
+        payload_length: 48,
+    }
+    Lower Tester -> IUT: Accepted {
+        transaction_id: 0,
+        accepted_opcode: Opcode::EncapsulatedHeader,
+    }
+    repeat 3 times with (part in local_p192_public_key(&context)) {
+        IUT -> Lower Tester: EncapsulatedPayload {
+            transaction_id: 0,
+            data: part,
+        }
+        Lower Tester -> IUT: Accepted {
+            transaction_id: 0,
+            accepted_opcode: Opcode::EncapsulatedPayload,
+        }
+    }
+    Lower Tester -> IUT: EncapsulatedHeader {
+        transaction_id: 0,
+        major_type: 1,
+        minor_type: 1,
+        payload_length: 48,
+    }
+    IUT -> Lower Tester: Accepted {
+        transaction_id: 0,
+        accepted_opcode: Opcode::EncapsulatedHeader,
+    }
+    repeat 3 times with (part in peer_p192_public_key()) {
+        Lower Tester -> IUT: EncapsulatedPayload {
+            transaction_id: 0,
+            data: part,
+        }
+        IUT -> Lower Tester: Accepted {
+            transaction_id: 0,
+            accepted_opcode: Opcode::EncapsulatedPayload,
+        }
+    }
+    // Authentication Stage 1: OOB Protocol
+    IUT -> Upper Tester: RemoteOobDataRequest {
+        bd_addr: context.peer_address(),
+    }
+    Upper Tester -> IUT: RemoteOobDataRequestReply {
+        bd_addr: context.peer_address(),
+        c: [0; 16],
+        r: [0; 16],
+    }
+    IUT -> Upper Tester: RemoteOobDataRequestReplyComplete {
+        num_hci_command_packets: 1,
+        status: ErrorCode::Success,
+        bd_addr: context.peer_address(),
+    }
+    IUT -> Lower Tester: SimplePairingNumber {
+        transaction_id: 0,
+        nonce: [0; 16],
+    }
+    Lower Tester -> IUT: Accepted {
+        transaction_id: 0,
+        accepted_opcode: Opcode::SimplePairingNumber,
+    }
+    Lower Tester -> IUT: SimplePairingNumber {
+        transaction_id: 0,
+        nonce: [0; 16],
+    }
+    IUT -> Lower Tester: Accepted {
+        transaction_id: 0,
+        accepted_opcode: Opcode::SimplePairingNumber,
+    }
+    // Authentication Stage 2
+    IUT -> Lower Tester: DhkeyCheck {
+        transaction_id: 0,
+        confirmation_value: [0; 16],
+    }
+    Lower Tester -> IUT: Accepted { transaction_id: 0, accepted_opcode: Opcode::DhkeyCheck }
+    Lower Tester -> IUT: DhkeyCheck {
+        transaction_id: 0,
+        confirmation_value: [0; 16],
+    }
+    IUT -> Lower Tester: Accepted { transaction_id: 0, accepted_opcode: Opcode::DhkeyCheck }
+    IUT -> Upper Tester: SimplePairingComplete {
+        status: ErrorCode::Success,
+        bd_addr: context.peer_address(),
+    }
+    // Link Key Calculation
+    IUT -> Lower Tester: AuRand {
+        transaction_id: 0,
+        random_number: [0; 16],
+    }
+    Lower Tester -> IUT: Sres {
+        transaction_id: 0,
+        authentication_rsp: [0; 4],
+    }
+    Lower Tester -> IUT: AuRand {
+        transaction_id: 0,
+        random_number: [0; 16],
+    }
+    IUT -> Lower Tester: Sres {
+        transaction_id: 0,
+        authentication_rsp: [0; 4],
+    }
+    IUT -> Upper Tester: LinkKeyNotification {
+        bd_addr: context.peer_address(),
+        key_type: KeyType::AuthenticatedP192,
+        link_key: [0; 16],
+    }
+    IUT -> Upper Tester: AuthenticationComplete {
+        status: ErrorCode::Success,
+        connection_handle: context.peer_handle(),
+    }
+}
diff --git a/tools/rootcanal/lmp/test/SP/BV-19-C.in b/tools/rootcanal/lmp/test/SP/BV-19-C.in
new file mode 100644
index 0000000..1e9b3e1
--- /dev/null
+++ b/tools/rootcanal/lmp/test/SP/BV-19-C.in
@@ -0,0 +1,143 @@
+sequence! { procedure, context,
+    // ACL Connection Established
+    Lower Tester -> IUT: IoCapabilityReq {
+        transaction_id: 0,
+        io_capabilities: 0x01,
+        oob_authentication_data: 0x00,
+        authentication_requirement: 0x01,
+    }
+    IUT -> Upper Tester: IoCapabilityResponse {
+        bd_addr: context.peer_address(),
+        io_capability: IoCapability::DisplayYesNo,
+        oob_data_present: OobDataPresent::NotPresent,
+        authentication_requirements: AuthenticationRequirements::NoBondingMitmProtection,
+    }
+    IUT -> Upper Tester: IoCapabilityRequest {
+        bd_addr: context.peer_address(),
+    }
+    Upper Tester -> IUT: IoCapabilityRequestReply {
+        bd_addr: context.peer_address(),
+        io_capability: IoCapability::DisplayYesNo,
+        oob_present: OobDataPresent::P192Present,
+        authentication_requirements: AuthenticationRequirements::NoBondingMitmProtection,
+    }
+    IUT -> Upper Tester: IoCapabilityRequestReplyComplete {
+        num_hci_command_packets: 1,
+        status: ErrorCode::Success,
+        bd_addr: context.peer_address(),
+    }
+    IUT -> Lower Tester: IoCapabilityRes {
+        transaction_id: 0,
+        io_capabilities: 0x01,
+        oob_authentication_data: 0x01,
+        authentication_requirement: 0x01,
+    }
+    // Public Key Exchange
+    Lower Tester -> IUT: EncapsulatedHeader {
+        transaction_id: 0,
+        major_type: 1,
+        minor_type: 1,
+        payload_length: 48,
+    }
+    IUT -> Lower Tester: Accepted {
+        transaction_id: 0,
+        accepted_opcode: Opcode::EncapsulatedHeader,
+    }
+    repeat 3 times with (part in peer_p192_public_key()) {
+        Lower Tester -> IUT: EncapsulatedPayload {
+            transaction_id: 0,
+            data: part,
+        }
+        IUT -> Lower Tester: Accepted {
+            transaction_id: 0,
+            accepted_opcode: Opcode::EncapsulatedPayload,
+        }
+    }
+    IUT -> Lower Tester: EncapsulatedHeader {
+        transaction_id: 0,
+        major_type: 1,
+        minor_type: 1,
+        payload_length: 48,
+    }
+    Lower Tester -> IUT: Accepted {
+        transaction_id: 0,
+        accepted_opcode: Opcode::EncapsulatedHeader,
+    }
+    repeat 3 times with (part in local_p192_public_key(&context)) {
+        IUT -> Lower Tester: EncapsulatedPayload {
+            transaction_id: 0,
+            data: part,
+        }
+        Lower Tester -> IUT: Accepted {
+            transaction_id: 0,
+            accepted_opcode: Opcode::EncapsulatedPayload,
+        }
+    }
+    // Authentication Stage 1: OOB Protocol
+    IUT -> Upper Tester: RemoteOobDataRequest {
+        bd_addr: context.peer_address(),
+    }
+    Upper Tester -> IUT: RemoteOobDataRequestReply {
+        bd_addr: context.peer_address(),
+        c: [0; 16],
+        r: [0; 16],
+    }
+    IUT -> Upper Tester: RemoteOobDataRequestReplyComplete {
+        num_hci_command_packets: 1,
+        status: ErrorCode::Success,
+        bd_addr: context.peer_address(),
+    }
+    Lower Tester -> IUT: SimplePairingNumber {
+        transaction_id: 0,
+        nonce: [0; 16],
+    }
+    IUT -> Lower Tester: Accepted {
+        transaction_id: 0,
+        accepted_opcode: Opcode::SimplePairingNumber,
+    }
+    IUT -> Lower Tester: SimplePairingNumber {
+        transaction_id: 0,
+        nonce: [0; 16],
+    }
+    Lower Tester -> IUT: Accepted {
+        transaction_id: 0,
+        accepted_opcode: Opcode::SimplePairingNumber,
+    }
+    // Authentication Stage 2
+    Lower Tester -> IUT: DhkeyCheck {
+        transaction_id: 0,
+        confirmation_value: [0; 16],
+    }
+    IUT -> Lower Tester: Accepted { transaction_id: 0, accepted_opcode: Opcode::DhkeyCheck }
+    IUT -> Lower Tester: DhkeyCheck {
+        transaction_id: 0,
+        confirmation_value: [0; 16],
+    }
+    Lower Tester -> IUT: Accepted { transaction_id: 0, accepted_opcode: Opcode::DhkeyCheck }
+    IUT -> Upper Tester: SimplePairingComplete {
+        status: ErrorCode::Success,
+        bd_addr: context.peer_address(),
+    }
+    // Link Key Calculation
+    Lower Tester -> IUT: AuRand {
+        transaction_id: 0,
+        random_number: [0; 16],
+    }
+    IUT -> Lower Tester: Sres {
+        transaction_id: 0,
+        authentication_rsp: [0; 4],
+    }
+    IUT -> Lower Tester: AuRand {
+        transaction_id: 0,
+        random_number: [0; 16],
+    }
+    Lower Tester -> IUT: Sres {
+        transaction_id: 0,
+        authentication_rsp: [0; 4],
+    }
+    IUT -> Upper Tester: LinkKeyNotification {
+        bd_addr: context.peer_address(),
+        key_type: KeyType::AuthenticatedP192,
+        link_key: [0; 16],
+    }
+}
diff --git a/tools/rootcanal/lmp/test/SP/BV-20-C.in b/tools/rootcanal/lmp/test/SP/BV-20-C.in
new file mode 100644
index 0000000..4cb1186
--- /dev/null
+++ b/tools/rootcanal/lmp/test/SP/BV-20-C.in
@@ -0,0 +1,158 @@
+sequence! { procedure, context,
+    Upper Tester ->IUT: ReadLocalOobData {}
+    IUT -> Upper Tester: ReadLocalOobDataComplete {
+       status: ErrorCode::Success,
+        c: [0; 16],
+        r: [0; 16],
+    }
+    // ACL Connection Established
+    Upper Tester -> IUT: AuthenticationRequested {
+        connection_handle: context.peer_handle()
+    }
+    IUT -> Upper Tester: AuthenticationRequestedStatus {
+       num_hci_command_packets: 1,
+       status: ErrorCode::Success,
+    }
+    IUT -> Upper Tester: LinkKeyRequest {
+        bd_addr: context.peer_address(),
+    }
+    Upper Tester -> IUT: LinkKeyRequestNegativeReply {
+        bd_addr: context.peer_address(),
+    }
+    IUT -> Upper Tester: LinkKeyRequestNegativeReplyComplete {
+       num_hci_command_packets: 1,
+       status: ErrorCode::Success,
+       bd_addr: context.peer_address(),
+    }
+    IUT -> Upper Tester: IoCapabilityRequest {
+        bd_addr: context.peer_address(),
+    }
+    Upper Tester -> IUT: IoCapabilityRequestReply {
+        bd_addr: context.peer_address(),
+        io_capability: IoCapability::DisplayYesNo,
+        oob_present: OobDataPresent::NotPresent,
+        authentication_requirements: AuthenticationRequirements::NoBondingMitmProtection,
+    }
+    IUT -> Upper Tester: IoCapabilityRequestReplyComplete {
+        num_hci_command_packets: 1,
+        status: ErrorCode::Success,
+        bd_addr: context.peer_address(),
+    }
+    IUT -> Lower Tester: IoCapabilityReq {
+        transaction_id: 0,
+        io_capabilities: 0x01,
+        oob_authentication_data: 0x00,
+        authentication_requirement: 0x01,
+    }
+    Lower Tester -> IUT: IoCapabilityRes {
+        transaction_id: 0,
+        io_capabilities: 0x01,
+        oob_authentication_data: 0x01,
+        authentication_requirement: 0x01,
+    }
+    IUT -> Upper Tester: IoCapabilityResponse {
+        bd_addr: context.peer_address(),
+        io_capability: IoCapability::DisplayYesNo,
+        oob_data_present: OobDataPresent::P192Present,
+        authentication_requirements: AuthenticationRequirements::NoBondingMitmProtection,
+    }
+    // Public Key Exchange
+    IUT -> Lower Tester: EncapsulatedHeader {
+        transaction_id: 0,
+        major_type: 1,
+        minor_type: 1,
+        payload_length: 48,
+    }
+    Lower Tester -> IUT: Accepted {
+        transaction_id: 0,
+        accepted_opcode: Opcode::EncapsulatedHeader,
+    }
+    repeat 3 times with (part in local_p192_public_key(&context)) {
+        IUT -> Lower Tester: EncapsulatedPayload {
+            transaction_id: 0,
+            data: part,
+        }
+        Lower Tester -> IUT: Accepted {
+            transaction_id: 0,
+            accepted_opcode: Opcode::EncapsulatedPayload,
+        }
+    }
+    Lower Tester -> IUT: EncapsulatedHeader {
+        transaction_id: 0,
+        major_type: 1,
+        minor_type: 1,
+        payload_length: 48,
+    }
+    IUT -> Lower Tester: Accepted {
+        transaction_id: 0,
+        accepted_opcode: Opcode::EncapsulatedHeader,
+    }
+    repeat 3 times with (part in peer_p192_public_key()) {
+        Lower Tester -> IUT: EncapsulatedPayload {
+            transaction_id: 0,
+            data: part,
+        }
+        IUT -> Lower Tester: Accepted {
+            transaction_id: 0,
+            accepted_opcode: Opcode::EncapsulatedPayload,
+        }
+    }
+    // Authentication Stage 1: OOB Protocol
+    IUT -> Lower Tester: SimplePairingNumber {
+        transaction_id: 0,
+        nonce: [0; 16],
+    }
+    Lower Tester -> IUT: Accepted {
+        transaction_id: 0,
+        accepted_opcode: Opcode::SimplePairingNumber,
+    }
+    Lower Tester -> IUT: SimplePairingNumber {
+        transaction_id: 0,
+        nonce: [0; 16],
+    }
+    IUT -> Lower Tester: Accepted {
+        transaction_id: 0,
+        accepted_opcode: Opcode::SimplePairingNumber,
+    }
+    // Authentication Stage 2
+    IUT -> Lower Tester: DhkeyCheck {
+        transaction_id: 0,
+        confirmation_value: [0; 16],
+    }
+    Lower Tester -> IUT: Accepted { transaction_id: 0, accepted_opcode: Opcode::DhkeyCheck }
+    Lower Tester -> IUT: DhkeyCheck {
+        transaction_id: 0,
+        confirmation_value: [0; 16],
+    }
+    IUT -> Lower Tester: Accepted { transaction_id: 0, accepted_opcode: Opcode::DhkeyCheck }
+    IUT -> Upper Tester: SimplePairingComplete {
+        status: ErrorCode::Success,
+        bd_addr: context.peer_address(),
+    }
+    // Link Key Calculation
+    IUT -> Lower Tester: AuRand {
+        transaction_id: 0,
+        random_number: [0; 16],
+    }
+    Lower Tester -> IUT: Sres {
+        transaction_id: 0,
+        authentication_rsp: [0; 4],
+    }
+    Lower Tester -> IUT: AuRand {
+        transaction_id: 0,
+        random_number: [0; 16],
+    }
+    IUT -> Lower Tester: Sres {
+        transaction_id: 0,
+        authentication_rsp: [0; 4],
+    }
+    IUT -> Upper Tester: LinkKeyNotification {
+        bd_addr: context.peer_address(),
+        key_type: KeyType::AuthenticatedP192,
+        link_key: [0; 16],
+    }
+    IUT -> Upper Tester: AuthenticationComplete {
+        status: ErrorCode::Success,
+        connection_handle: context.peer_handle(),
+    }
+}
diff --git a/tools/rootcanal/lmp/test/SP/BV-21-C.in b/tools/rootcanal/lmp/test/SP/BV-21-C.in
new file mode 100644
index 0000000..fc93935
--- /dev/null
+++ b/tools/rootcanal/lmp/test/SP/BV-21-C.in
@@ -0,0 +1,136 @@
+sequence! { procedure, context,
+    Upper Tester ->IUT: ReadLocalOobData {}
+    IUT -> Upper Tester: ReadLocalOobDataComplete {
+       status: ErrorCode::Success,
+        c: [0; 16],
+        r: [0; 16],
+    }
+    // ACL Connection Established
+    Lower Tester -> IUT: IoCapabilityReq {
+        transaction_id: 0,
+        io_capabilities: 0x01,
+        oob_authentication_data: 0x01,
+        authentication_requirement: 0x01,
+    }
+    IUT -> Upper Tester: IoCapabilityResponse {
+        bd_addr: context.peer_address(),
+        io_capability: IoCapability::DisplayYesNo,
+        oob_data_present: OobDataPresent::P192Present,
+        authentication_requirements: AuthenticationRequirements::NoBondingMitmProtection,
+    }
+    IUT -> Upper Tester: IoCapabilityRequest {
+        bd_addr: context.peer_address(),
+    }
+    Upper Tester -> IUT: IoCapabilityRequestReply {
+        bd_addr: context.peer_address(),
+        io_capability: IoCapability::DisplayYesNo,
+        oob_present: OobDataPresent::NotPresent,
+        authentication_requirements: AuthenticationRequirements::NoBondingMitmProtection,
+    }
+    IUT -> Upper Tester: IoCapabilityRequestReplyComplete {
+        num_hci_command_packets: 1,
+        status: ErrorCode::Success,
+        bd_addr: context.peer_address(),
+    }
+    IUT -> Lower Tester: IoCapabilityRes {
+        transaction_id: 0,
+        io_capabilities: 0x01,
+        oob_authentication_data: 0x00,
+        authentication_requirement: 0x01,
+    }
+    // Public Key Exchange
+    Lower Tester -> IUT: EncapsulatedHeader {
+        transaction_id: 0,
+        major_type: 1,
+        minor_type: 1,
+        payload_length: 48,
+    }
+    IUT -> Lower Tester: Accepted {
+        transaction_id: 0,
+        accepted_opcode: Opcode::EncapsulatedHeader,
+    }
+    repeat 3 times with (part in peer_p192_public_key()) {
+        Lower Tester -> IUT: EncapsulatedPayload {
+            transaction_id: 0,
+            data: part,
+        }
+        IUT -> Lower Tester: Accepted {
+            transaction_id: 0,
+            accepted_opcode: Opcode::EncapsulatedPayload,
+        }
+    }
+    IUT -> Lower Tester: EncapsulatedHeader {
+        transaction_id: 0,
+        major_type: 1,
+        minor_type: 1,
+        payload_length: 48,
+    }
+    Lower Tester -> IUT: Accepted {
+        transaction_id: 0,
+        accepted_opcode: Opcode::EncapsulatedHeader,
+    }
+    repeat 3 times with (part in local_p192_public_key(&context)) {
+        IUT -> Lower Tester: EncapsulatedPayload {
+            transaction_id: 0,
+            data: part,
+        }
+        Lower Tester -> IUT: Accepted {
+            transaction_id: 0,
+            accepted_opcode: Opcode::EncapsulatedPayload,
+        }
+    }
+    // Authentication Stage 1: OOB Protocol
+    Lower Tester -> IUT: SimplePairingNumber {
+        transaction_id: 0,
+        nonce: [0; 16],
+    }
+    IUT -> Lower Tester: Accepted {
+        transaction_id: 0,
+        accepted_opcode: Opcode::SimplePairingNumber,
+    }
+    IUT -> Lower Tester: SimplePairingNumber {
+        transaction_id: 0,
+        nonce: [0; 16],
+    }
+    Lower Tester -> IUT: Accepted {
+        transaction_id: 0,
+        accepted_opcode: Opcode::SimplePairingNumber,
+    }
+    // Authentication Stage 2
+    Lower Tester -> IUT: DhkeyCheck {
+        transaction_id: 0,
+        confirmation_value: [0; 16],
+    }
+    IUT -> Lower Tester: Accepted { transaction_id: 0, accepted_opcode: Opcode::DhkeyCheck }
+    IUT -> Lower Tester: DhkeyCheck {
+        transaction_id: 0,
+        confirmation_value: [0; 16],
+    }
+    Lower Tester -> IUT: Accepted { transaction_id: 0, accepted_opcode: Opcode::DhkeyCheck }
+    IUT -> Upper Tester: SimplePairingComplete {
+        status: ErrorCode::Success,
+        bd_addr: context.peer_address(),
+    }
+    // Link Key Calculation
+    Lower Tester -> IUT: AuRand {
+        transaction_id: 0,
+        random_number: [0; 16],
+    }
+    IUT -> Lower Tester: Sres {
+        transaction_id: 0,
+        authentication_rsp: [0; 4],
+    }
+    IUT -> Lower Tester: AuRand {
+        transaction_id: 0,
+        random_number: [0; 16],
+    }
+    Lower Tester -> IUT: Sres {
+        transaction_id: 0,
+        authentication_rsp: [0; 4],
+    }
+    IUT -> Upper Tester: LinkKeyNotification {
+        bd_addr: context.peer_address(),
+        key_type: KeyType::AuthenticatedP192,
+        link_key: [0; 16],
+    }
+}
diff --git a/tools/rootcanal/lmp/test/SP/BV-22-C.in b/tools/rootcanal/lmp/test/SP/BV-22-C.in
new file mode 100644
index 0000000..74e0c63
--- /dev/null
+++ b/tools/rootcanal/lmp/test/SP/BV-22-C.in
@@ -0,0 +1,171 @@
+sequence! { procedure, context,
+    Upper Tester ->IUT: ReadLocalOobData {}
+    IUT -> Upper Tester: ReadLocalOobDataComplete {
+       status: ErrorCode::Success,
+        c: [0; 16],
+        r: [0; 16],
+    }
+    // ACL Connection Established
+    Upper Tester -> IUT: AuthenticationRequested {
+        connection_handle: context.peer_handle()
+    }
+    IUT -> Upper Tester: AuthenticationRequestedStatus {
+       num_hci_command_packets: 1,
+       status: ErrorCode::Success,
+    }
+    IUT -> Upper Tester: LinkKeyRequest {
+        bd_addr: context.peer_address(),
+    }
+    Upper Tester -> IUT: LinkKeyRequestNegativeReply {
+        bd_addr: context.peer_address(),
+    }
+    IUT -> Upper Tester: LinkKeyRequestNegativeReplyComplete {
+       num_hci_command_packets: 1,
+       status: ErrorCode::Success,
+       bd_addr: context.peer_address(),
+    }
+    IUT -> Upper Tester: IoCapabilityRequest {
+        bd_addr: context.peer_address(),
+    }
+    Upper Tester -> IUT: IoCapabilityRequestReply {
+        bd_addr: context.peer_address(),
+        io_capability: IoCapability::DisplayYesNo,
+        oob_present: OobDataPresent::P192Present,
+        authentication_requirements: AuthenticationRequirements::NoBondingMitmProtection,
+    }
+    IUT -> Upper Tester: IoCapabilityRequestReplyComplete {
+        num_hci_command_packets: 1,
+        status: ErrorCode::Success,
+        bd_addr: context.peer_address(),
+    }
+    IUT -> Lower Tester: IoCapabilityReq {
+        transaction_id: 0,
+        io_capabilities: 0x01,
+        oob_authentication_data: 0x01,
+        authentication_requirement: 0x01,
+    }
+    Lower Tester -> IUT: IoCapabilityRes {
+        transaction_id: 0,
+        io_capabilities: 0x01,
+        oob_authentication_data: 0x01,
+        authentication_requirement: 0x01,
+    }
+    IUT -> Upper Tester: IoCapabilityResponse {
+        bd_addr: context.peer_address(),
+        io_capability: IoCapability::DisplayYesNo,
+        oob_data_present: OobDataPresent::P192Present,
+        authentication_requirements: AuthenticationRequirements::NoBondingMitmProtection,
+    }
+    // Public Key Exchange
+    IUT -> Lower Tester: EncapsulatedHeader {
+        transaction_id: 0,
+        major_type: 1,
+        minor_type: 1,
+        payload_length: 48,
+    }
+    Lower Tester -> IUT: Accepted {
+        transaction_id: 0,
+        accepted_opcode: Opcode::EncapsulatedHeader,
+    }
+    repeat 3 times with (part in local_p192_public_key(&context)) {
+        IUT -> Lower Tester: EncapsulatedPayload {
+            transaction_id: 0,
+            data: part,
+        }
+        Lower Tester -> IUT: Accepted {
+            transaction_id: 0,
+            accepted_opcode: Opcode::EncapsulatedPayload,
+        }
+    }
+    Lower Tester -> IUT: EncapsulatedHeader {
+        transaction_id: 0,
+        major_type: 1,
+        minor_type: 1,
+        payload_length: 48,
+    }
+    IUT -> Lower Tester: Accepted {
+        transaction_id: 0,
+        accepted_opcode: Opcode::EncapsulatedHeader,
+    }
+    repeat 3 times with (part in peer_p192_public_key()) {
+        Lower Tester -> IUT: EncapsulatedPayload {
+            transaction_id: 0,
+            data: part,
+        }
+        IUT -> Lower Tester: Accepted {
+            transaction_id: 0,
+            accepted_opcode: Opcode::EncapsulatedPayload,
+        }
+    }
+    // Authentication Stage 1: OOB Protocol
+    IUT -> Upper Tester: RemoteOobDataRequest {
+        bd_addr: context.peer_address(),
+    }
+    Upper Tester -> IUT: RemoteOobDataRequestReply {
+        bd_addr: context.peer_address(),
+        c: [0; 16],
+        r: [0; 16],
+    }
+    IUT -> Upper Tester: RemoteOobDataRequestReplyComplete {
+        num_hci_command_packets: 1,
+        status: ErrorCode::Success,
+        bd_addr: context.peer_address(),
+    }
+    IUT -> Lower Tester: SimplePairingNumber {
+        transaction_id: 0,
+        nonce: [0; 16],
+    }
+    Lower Tester -> IUT: Accepted {
+        transaction_id: 0,
+        accepted_opcode: Opcode::SimplePairingNumber,
+    }
+    Lower Tester -> IUT: SimplePairingNumber {
+        transaction_id: 0,
+        nonce: [0; 16],
+    }
+    IUT -> Lower Tester: Accepted {
+        transaction_id: 0,
+        accepted_opcode: Opcode::SimplePairingNumber,
+    }
+    // Authentication Stage 2
+    IUT -> Lower Tester: DhkeyCheck {
+        transaction_id: 0,
+        confirmation_value: [0; 16],
+    }
+    Lower Tester -> IUT: Accepted { transaction_id: 0, accepted_opcode: Opcode::DhkeyCheck }
+    Lower Tester -> IUT: DhkeyCheck {
+        transaction_id: 0,
+        confirmation_value: [0; 16],
+    }
+    IUT -> Lower Tester: Accepted { transaction_id: 0, accepted_opcode: Opcode::DhkeyCheck }
+    IUT -> Upper Tester: SimplePairingComplete {
+        status: ErrorCode::Success,
+        bd_addr: context.peer_address(),
+    }
+    // Link Key Calculation
+    IUT -> Lower Tester: AuRand {
+        transaction_id: 0,
+        random_number: [0; 16],
+    }
+    Lower Tester -> IUT: Sres {
+        transaction_id: 0,
+        authentication_rsp: [0; 4],
+    }
+    Lower Tester -> IUT: AuRand {
+        transaction_id: 0,
+        random_number: [0; 16],
+    }
+    IUT -> Lower Tester: Sres {
+        transaction_id: 0,
+        authentication_rsp: [0; 4],
+    }
+    IUT -> Upper Tester: LinkKeyNotification {
+        bd_addr: context.peer_address(),
+        key_type: KeyType::AuthenticatedP192,
+        link_key: [0; 16],
+    }
+    IUT -> Upper Tester: AuthenticationComplete {
+        status: ErrorCode::Success,
+        connection_handle: context.peer_handle(),
+    }
+}
diff --git a/tools/rootcanal/lmp/test/SP/BV-23-C.in b/tools/rootcanal/lmp/test/SP/BV-23-C.in
new file mode 100644
index 0000000..c0f7dd6
--- /dev/null
+++ b/tools/rootcanal/lmp/test/SP/BV-23-C.in
@@ -0,0 +1,149 @@
+sequence! { procedure, context,
+    Upper Tester ->IUT: ReadLocalOobData {}
+    IUT -> Upper Tester: ReadLocalOobDataComplete {
+       status: ErrorCode::Success,
+        c: [0; 16],
+        r: [0; 16],
+    }
+    // ACL Connection Established
+    Lower Tester -> IUT: IoCapabilityReq {
+        transaction_id: 0,
+        io_capabilities: 0x01,
+        oob_authentication_data: 0x01,
+        authentication_requirement: 0x01,
+    }
+    IUT -> Upper Tester: IoCapabilityResponse {
+        bd_addr: context.peer_address(),
+        io_capability: IoCapability::DisplayYesNo,
+        oob_data_present: OobDataPresent::P192Present,
+        authentication_requirements: AuthenticationRequirements::NoBondingMitmProtection,
+    }
+    IUT -> Upper Tester: IoCapabilityRequest {
+        bd_addr: context.peer_address(),
+    }
+    Upper Tester -> IUT: IoCapabilityRequestReply {
+        bd_addr: context.peer_address(),
+        io_capability: IoCapability::DisplayYesNo,
+        oob_present: OobDataPresent::P192Present,
+        authentication_requirements: AuthenticationRequirements::NoBondingMitmProtection,
+    }
+    IUT -> Upper Tester: IoCapabilityRequestReplyComplete {
+        num_hci_command_packets: 1,
+        status: ErrorCode::Success,
+        bd_addr: context.peer_address(),
+    }
+    IUT -> Lower Tester: IoCapabilityRes {
+        transaction_id: 0,
+        io_capabilities: 0x01,
+        oob_authentication_data: 0x01,
+        authentication_requirement: 0x01,
+    }
+    // Public Key Exchange
+    Lower Tester -> IUT: EncapsulatedHeader {
+        transaction_id: 0,
+        major_type: 1,
+        minor_type: 1,
+        payload_length: 48,
+    }
+    IUT -> Lower Tester: Accepted {
+        transaction_id: 0,
+        accepted_opcode: Opcode::EncapsulatedHeader,
+    }
+    repeat 3 times with (part in peer_p192_public_key()) {
+        Lower Tester -> IUT: EncapsulatedPayload {
+            transaction_id: 0,
+            data: part,
+        }
+        IUT -> Lower Tester: Accepted {
+            transaction_id: 0,
+            accepted_opcode: Opcode::EncapsulatedPayload,
+        }
+    }
+    IUT -> Lower Tester: EncapsulatedHeader {
+        transaction_id: 0,
+        major_type: 1,
+        minor_type: 1,
+        payload_length: 48,
+    }
+    Lower Tester -> IUT: Accepted {
+        transaction_id: 0,
+        accepted_opcode: Opcode::EncapsulatedHeader,
+    }
+    repeat 3 times with (part in local_p192_public_key(&context)) {
+        IUT -> Lower Tester: EncapsulatedPayload {
+            transaction_id: 0,
+            data: part,
+        }
+        Lower Tester -> IUT: Accepted {
+            transaction_id: 0,
+            accepted_opcode: Opcode::EncapsulatedPayload,
+        }
+    }
+    // Authentication Stage 1: OOB Protocol
+    IUT -> Upper Tester: RemoteOobDataRequest {
+        bd_addr: context.peer_address(),
+    }
+    Upper Tester -> IUT: RemoteOobDataRequestReply {
+        bd_addr: context.peer_address(),
+        c: [0; 16],
+        r: [0; 16],
+    }
+    IUT -> Upper Tester: RemoteOobDataRequestReplyComplete {
+        num_hci_command_packets: 1,
+        status: ErrorCode::Success,
+        bd_addr: context.peer_address(),
+    }
+    Lower Tester -> IUT: SimplePairingNumber {
+        transaction_id: 0,
+        nonce: [0; 16],
+    }
+    IUT -> Lower Tester: Accepted {
+        transaction_id: 0,
+        accepted_opcode: Opcode::SimplePairingNumber,
+    }
+    IUT -> Lower Tester: SimplePairingNumber {
+        transaction_id: 0,
+        nonce: [0; 16],
+    }
+    Lower Tester -> IUT: Accepted {
+        transaction_id: 0,
+        accepted_opcode: Opcode::SimplePairingNumber,
+    }
+    // Authentication Stage 2
+    Lower Tester -> IUT: DhkeyCheck {
+        transaction_id: 0,
+        confirmation_value: [0; 16],
+    }
+    IUT -> Lower Tester: Accepted { transaction_id: 0, accepted_opcode: Opcode::DhkeyCheck }
+    IUT -> Lower Tester: DhkeyCheck {
+        transaction_id: 0,
+        confirmation_value: [0; 16],
+    }
+    Lower Tester -> IUT: Accepted { transaction_id: 0, accepted_opcode: Opcode::DhkeyCheck }
+    IUT -> Upper Tester: SimplePairingComplete {
+        status: ErrorCode::Success,
+        bd_addr: context.peer_address(),
+    }
+    // Link Key Calculation
+    Lower Tester -> IUT: AuRand {
+        transaction_id: 0,
+        random_number: [0; 16],
+    }
+    IUT -> Lower Tester: Sres {
+        transaction_id: 0,
+        authentication_rsp: [0; 4],
+    }
+    IUT -> Lower Tester: AuRand {
+        transaction_id: 0,
+        random_number: [0; 16],
+    }
+    Lower Tester -> IUT: Sres {
+        transaction_id: 0,
+        authentication_rsp: [0; 4],
+    }
+    IUT -> Upper Tester: LinkKeyNotification {
+        bd_addr: context.peer_address(),
+        key_type: KeyType::AuthenticatedP192,
+        link_key: [0; 16],
+    }
+}
diff --git a/tools/rootcanal/lmp/test/SP/BV-24-C.in b/tools/rootcanal/lmp/test/SP/BV-24-C.in
new file mode 100644
index 0000000..834eb37
--- /dev/null
+++ b/tools/rootcanal/lmp/test/SP/BV-24-C.in
@@ -0,0 +1,133 @@
+sequence! { procedure, context,
+    // ACL Connection Established
+    Upper Tester -> IUT: AuthenticationRequested {
+        connection_handle: context.peer_handle()
+    }
+    IUT -> Upper Tester: AuthenticationRequestedStatus {
+       num_hci_command_packets: 1,
+       status: ErrorCode::Success,
+    }
+    IUT -> Upper Tester: LinkKeyRequest {
+        bd_addr: context.peer_address(),
+    }
+    Upper Tester -> IUT: LinkKeyRequestNegativeReply {
+        bd_addr: context.peer_address(),
+    }
+    IUT -> Upper Tester: LinkKeyRequestNegativeReplyComplete {
+       num_hci_command_packets: 1,
+       status: ErrorCode::Success,
+       bd_addr: context.peer_address(),
+    }
+    IUT -> Upper Tester: IoCapabilityRequest {
+        bd_addr: context.peer_address(),
+    }
+    Upper Tester -> IUT: IoCapabilityRequestReply {
+        bd_addr: context.peer_address(),
+        io_capability: IoCapability::DisplayYesNo,
+        oob_present: OobDataPresent::P192Present,
+        authentication_requirements: AuthenticationRequirements::NoBondingMitmProtection,
+    }
+    IUT -> Upper Tester: IoCapabilityRequestReplyComplete {
+        num_hci_command_packets: 1,
+        status: ErrorCode::Success,
+        bd_addr: context.peer_address(),
+    }
+    IUT -> Lower Tester: IoCapabilityReq {
+        transaction_id: 0,
+        io_capabilities: 0x01,
+        oob_authentication_data: 0x01,
+        authentication_requirement: 0x01,
+    }
+    Lower Tester -> IUT: IoCapabilityRes {
+        transaction_id: 0,
+        io_capabilities: 0x01,
+        oob_authentication_data: 0x00,
+        authentication_requirement: 0x01,
+    }
+    IUT -> Upper Tester: IoCapabilityResponse {
+        bd_addr: context.peer_address(),
+        io_capability: IoCapability::DisplayYesNo,
+        oob_data_present: OobDataPresent::NotPresent,
+        authentication_requirements: AuthenticationRequirements::NoBondingMitmProtection,
+    }
+    // Public Key Exchange
+    IUT -> Lower Tester: EncapsulatedHeader {
+        transaction_id: 0,
+        major_type: 1,
+        minor_type: 1,
+        payload_length: 48,
+    }
+    Lower Tester -> IUT: Accepted {
+        transaction_id: 0,
+        accepted_opcode: Opcode::EncapsulatedHeader,
+    }
+    repeat 3 times with (part in local_p192_public_key(&context)) {
+        IUT -> Lower Tester: EncapsulatedPayload {
+            transaction_id: 0,
+            data: part,
+        }
+        Lower Tester -> IUT: Accepted {
+            transaction_id: 0,
+            accepted_opcode: Opcode::EncapsulatedPayload,
+        }
+    }
+    Lower Tester -> IUT: EncapsulatedHeader {
+        transaction_id: 0,
+        major_type: 1,
+        minor_type: 1,
+        payload_length: 48,
+    }
+    IUT -> Lower Tester: Accepted {
+        transaction_id: 0,
+        accepted_opcode: Opcode::EncapsulatedHeader,
+    }
+    repeat 3 times with (part in peer_p192_public_key()) {
+        Lower Tester -> IUT: EncapsulatedPayload {
+            transaction_id: 0,
+            data: part,
+        }
+        IUT -> Lower Tester: Accepted {
+            transaction_id: 0,
+            accepted_opcode: Opcode::EncapsulatedPayload,
+        }
+    }
+    // Authentication Stage 1: OOB Protocol
+    IUT -> Upper Tester: RemoteOobDataRequest {
+        bd_addr: context.peer_address(),
+    }
+    Upper Tester -> IUT: RemoteOobDataRequestReply {
+        bd_addr: context.peer_address(),
+        c: [0; 16],
+        r: [1; 16],
+    }
+    IUT -> Upper Tester: RemoteOobDataRequestReplyComplete {
+        num_hci_command_packets: 1,
+        status: ErrorCode::Success,
+        bd_addr: context.peer_address(),
+    }
+    IUT -> Lower Tester: SimplePairingNumber {
+        transaction_id: 0,
+        nonce: [0; 16],
+    }
+    Lower Tester -> IUT: Accepted {
+        transaction_id: 0,
+        accepted_opcode: Opcode::SimplePairingNumber,
+    }
+    Lower Tester -> IUT: SimplePairingNumber {
+        transaction_id: 0,
+        nonce: [0; 16],
+    }
+    IUT -> Lower Tester: NotAccepted {
+        transaction_id: 0,
+        not_accepted_opcode: Opcode::SimplePairingNumber,
+        error_code: 0x05,
+    }
+    IUT -> Upper Tester: SimplePairingComplete {
+        status: ErrorCode::AuthenticationFailure,
+        bd_addr: context.peer_address(),
+    }
+    IUT -> Upper Tester: AuthenticationComplete {
+        status: ErrorCode::AuthenticationFailure,
+        connection_handle: context.peer_handle(),
+    }
+}
diff --git a/tools/rootcanal/lmp/test/SP/BV-25-C.in b/tools/rootcanal/lmp/test/SP/BV-25-C.in
new file mode 100644
index 0000000..1b902eb
--- /dev/null
+++ b/tools/rootcanal/lmp/test/SP/BV-25-C.in
@@ -0,0 +1,103 @@
+sequence! { procedure, context,
+    // ACL Connection Established
+    Lower Tester -> IUT: IoCapabilityReq {
+        transaction_id: 0,
+        io_capabilities: 0x01,
+        oob_authentication_data: 0x00,
+        authentication_requirement: 0x01,
+    }
+    IUT -> Upper Tester: IoCapabilityResponse {
+        bd_addr: context.peer_address(),
+        io_capability: IoCapability::DisplayYesNo,
+        oob_data_present: OobDataPresent::NotPresent,
+        authentication_requirements: AuthenticationRequirements::NoBondingMitmProtection,
+    }
+    IUT -> Upper Tester: IoCapabilityRequest {
+        bd_addr: context.peer_address(),
+    }
+    Upper Tester -> IUT: IoCapabilityRequestReply {
+        bd_addr: context.peer_address(),
+        io_capability: IoCapability::DisplayYesNo,
+        oob_present: OobDataPresent::P192Present,
+        authentication_requirements: AuthenticationRequirements::NoBondingMitmProtection,
+    }
+    IUT -> Upper Tester: IoCapabilityRequestReplyComplete {
+        num_hci_command_packets: 1,
+        status: ErrorCode::Success,
+        bd_addr: context.peer_address(),
+    }
+    IUT -> Lower Tester: IoCapabilityRes {
+        transaction_id: 0,
+        io_capabilities: 0x01,
+        oob_authentication_data: 0x01,
+        authentication_requirement: 0x01,
+    }
+    // Public Key Exchange
+    Lower Tester -> IUT: EncapsulatedHeader {
+        transaction_id: 0,
+        major_type: 1,
+        minor_type: 1,
+        payload_length: 48,
+    }
+    IUT -> Lower Tester: Accepted {
+        transaction_id: 0,
+        accepted_opcode: Opcode::EncapsulatedHeader,
+    }
+    repeat 3 times with (part in peer_p192_public_key()) {
+        Lower Tester -> IUT: EncapsulatedPayload {
+            transaction_id: 0,
+            data: part,
+        }
+        IUT -> Lower Tester: Accepted {
+            transaction_id: 0,
+            accepted_opcode: Opcode::EncapsulatedPayload,
+        }
+    }
+    IUT -> Lower Tester: EncapsulatedHeader {
+        transaction_id: 0,
+        major_type: 1,
+        minor_type: 1,
+        payload_length: 48,
+    }
+    Lower Tester -> IUT: Accepted {
+        transaction_id: 0,
+        accepted_opcode: Opcode::EncapsulatedHeader,
+    }
+    repeat 3 times with (part in local_p192_public_key(&context)) {
+        IUT -> Lower Tester: EncapsulatedPayload {
+            transaction_id: 0,
+            data: part,
+        }
+        Lower Tester -> IUT: Accepted {
+            transaction_id: 0,
+            accepted_opcode: Opcode::EncapsulatedPayload,
+        }
+    }
+    // Authentication Stage 1: OOB Protocol
+    IUT -> Upper Tester: RemoteOobDataRequest {
+        bd_addr: context.peer_address(),
+    }
+    Upper Tester -> IUT: RemoteOobDataRequestReply {
+        bd_addr: context.peer_address(),
+        c: [0; 16],
+        r: [1; 16],
+    }
+    IUT -> Upper Tester: RemoteOobDataRequestReplyComplete {
+        num_hci_command_packets: 1,
+        status: ErrorCode::Success,
+        bd_addr: context.peer_address(),
+    }
+    Lower Tester -> IUT: SimplePairingNumber {
+        transaction_id: 0,
+        nonce: [0; 16],
+    }
+    IUT -> Lower Tester: NotAccepted {
+        transaction_id: 0,
+        not_accepted_opcode: Opcode::SimplePairingNumber,
+        error_code: 0x05,
+    }
+    IUT -> Upper Tester: SimplePairingComplete {
+        status: ErrorCode::AuthenticationFailure,
+        bd_addr: context.peer_address(),
+    }
+}
diff --git a/tools/rootcanal/lmp/test/SP/BV-26-C.in b/tools/rootcanal/lmp/test/SP/BV-26-C.in
new file mode 100644
index 0000000..2e8adbc
--- /dev/null
+++ b/tools/rootcanal/lmp/test/SP/BV-26-C.in
@@ -0,0 +1,118 @@
+sequence! { procedure, context,
+    Upper Tester ->IUT: ReadLocalOobData {}
+    IUT -> Upper Tester: ReadLocalOobDataComplete {
+       status: ErrorCode::Success,
+        c: [0; 16],
+        r: [0; 16],
+    }
+    // ACL Connection Established
+    Upper Tester -> IUT: AuthenticationRequested {
+        connection_handle: context.peer_handle()
+    }
+    IUT -> Upper Tester: AuthenticationRequestedStatus {
+       num_hci_command_packets: 1,
+       status: ErrorCode::Success,
+    }
+    IUT -> Upper Tester: LinkKeyRequest {
+        bd_addr: context.peer_address(),
+    }
+    Upper Tester -> IUT: LinkKeyRequestNegativeReply {
+        bd_addr: context.peer_address(),
+    }
+    IUT -> Upper Tester: LinkKeyRequestNegativeReplyComplete {
+       num_hci_command_packets: 1,
+       status: ErrorCode::Success,
+       bd_addr: context.peer_address(),
+    }
+    IUT -> Upper Tester: IoCapabilityRequest {
+        bd_addr: context.peer_address(),
+    }
+    Upper Tester -> IUT: IoCapabilityRequestReply {
+        bd_addr: context.peer_address(),
+        io_capability: IoCapability::DisplayYesNo,
+        oob_present: OobDataPresent::NotPresent,
+        authentication_requirements: AuthenticationRequirements::NoBondingMitmProtection,
+    }
+    IUT -> Upper Tester: IoCapabilityRequestReplyComplete {
+        num_hci_command_packets: 1,
+        status: ErrorCode::Success,
+        bd_addr: context.peer_address(),
+    }
+    IUT -> Lower Tester: IoCapabilityReq {
+        transaction_id: 0,
+        io_capabilities: 0x01,
+        oob_authentication_data: 0x00,
+        authentication_requirement: 0x01,
+    }
+    Lower Tester -> IUT: IoCapabilityRes {
+        transaction_id: 0,
+        io_capabilities: 0x01,
+        oob_authentication_data: 0x01,
+        authentication_requirement: 0x01,
+    }
+    IUT -> Upper Tester: IoCapabilityResponse {
+        bd_addr: context.peer_address(),
+        io_capability: IoCapability::DisplayYesNo,
+        oob_data_present: OobDataPresent::P192Present,
+        authentication_requirements: AuthenticationRequirements::NoBondingMitmProtection,
+    }
+    // Public Key Exchange
+    IUT -> Lower Tester: EncapsulatedHeader {
+        transaction_id: 0,
+        major_type: 1,
+        minor_type: 1,
+        payload_length: 48,
+    }
+    Lower Tester -> IUT: Accepted {
+        transaction_id: 0,
+        accepted_opcode: Opcode::EncapsulatedHeader,
+    }
+    repeat 3 times with (part in local_p192_public_key(&context)) {
+        IUT -> Lower Tester: EncapsulatedPayload {
+            transaction_id: 0,
+            data: part,
+        }
+        Lower Tester -> IUT: Accepted {
+            transaction_id: 0,
+            accepted_opcode: Opcode::EncapsulatedPayload,
+        }
+    }
+    Lower Tester -> IUT: EncapsulatedHeader {
+        transaction_id: 0,
+        major_type: 1,
+        minor_type: 1,
+        payload_length: 48,
+    }
+    IUT -> Lower Tester: Accepted {
+        transaction_id: 0,
+        accepted_opcode: Opcode::EncapsulatedHeader,
+    }
+    repeat 3 times with (part in peer_p192_public_key()) {
+        Lower Tester -> IUT: EncapsulatedPayload {
+            transaction_id: 0,
+            data: part,
+        }
+        IUT -> Lower Tester: Accepted {
+            transaction_id: 0,
+            accepted_opcode: Opcode::EncapsulatedPayload,
+        }
+    }
+    // Authentication Stage 1: OOB Protocol
+    IUT -> Lower Tester: SimplePairingNumber {
+        transaction_id: 0,
+        nonce: [0; 16],
+    }
+    Lower Tester -> IUT: NotAccepted {
+        transaction_id: 0,
+        not_accepted_opcode: Opcode::SimplePairingNumber,
+        error_code: 0x05,
+    }
+    IUT -> Upper Tester: SimplePairingComplete {
+        status: ErrorCode::AuthenticationFailure,
+        bd_addr: context.peer_address(),
+    }
+    IUT -> Upper Tester: AuthenticationComplete {
+        status: ErrorCode::AuthenticationFailure,
+        connection_handle: context.peer_handle(),
+    }
+}
diff --git a/tools/rootcanal/lmp/test/SP/BV-27-C.in b/tools/rootcanal/lmp/test/SP/BV-27-C.in
new file mode 100644
index 0000000..2f1aa9d
--- /dev/null
+++ b/tools/rootcanal/lmp/test/SP/BV-27-C.in
@@ -0,0 +1,104 @@
+sequence! { procedure, context,
+    Upper Tester ->IUT: ReadLocalOobData {}
+    IUT -> Upper Tester: ReadLocalOobDataComplete {
+       status: ErrorCode::Success,
+        c: [0; 16],
+        r: [0; 16],
+    }
+    // ACL Connection Established
+    Lower Tester -> IUT: IoCapabilityReq {
+        transaction_id: 0,
+        io_capabilities: 0x01,
+        oob_authentication_data: 0x01,
+        authentication_requirement: 0x01,
+    }
+    IUT -> Upper Tester: IoCapabilityResponse {
+        bd_addr: context.peer_address(),
+        io_capability: IoCapability::DisplayYesNo,
+        oob_data_present: OobDataPresent::P192Present,
+        authentication_requirements: AuthenticationRequirements::NoBondingMitmProtection,
+    }
+    IUT -> Upper Tester: IoCapabilityRequest {
+        bd_addr: context.peer_address(),
+    }
+    Upper Tester -> IUT: IoCapabilityRequestReply {
+        bd_addr: context.peer_address(),
+        io_capability: IoCapability::DisplayYesNo,
+        oob_present: OobDataPresent::NotPresent,
+        authentication_requirements: AuthenticationRequirements::NoBondingMitmProtection,
+    }
+    IUT -> Upper Tester: IoCapabilityRequestReplyComplete {
+        num_hci_command_packets: 1,
+        status: ErrorCode::Success,
+        bd_addr: context.peer_address(),
+    }
+    IUT -> Lower Tester: IoCapabilityRes {
+        transaction_id: 0,
+        io_capabilities: 0x01,
+        oob_authentication_data: 0x00,
+        authentication_requirement: 0x01,
+    }
+    // Public Key Exchange
+    Lower Tester -> IUT: EncapsulatedHeader {
+        transaction_id: 0,
+        major_type: 1,
+        minor_type: 1,
+        payload_length: 48,
+    }
+    IUT -> Lower Tester: Accepted {
+        transaction_id: 0,
+        accepted_opcode: Opcode::EncapsulatedHeader,
+    }
+    repeat 3 times with (part in peer_p192_public_key()) {
+        Lower Tester -> IUT: EncapsulatedPayload {
+            transaction_id: 0,
+            data: part,
+        }
+        IUT -> Lower Tester: Accepted {
+            transaction_id: 0,
+            accepted_opcode: Opcode::EncapsulatedPayload,
+        }
+    }
+    IUT -> Lower Tester: EncapsulatedHeader {
+        transaction_id: 0,
+        major_type: 1,
+        minor_type: 1,
+        payload_length: 48,
+    }
+    Lower Tester -> IUT: Accepted {
+        transaction_id: 0,
+        accepted_opcode: Opcode::EncapsulatedHeader,
+    }
+    repeat 3 times with (part in local_p192_public_key(&context)) {
+        IUT -> Lower Tester: EncapsulatedPayload {
+            transaction_id: 0,
+            data: part,
+        }
+        Lower Tester -> IUT: Accepted {
+            transaction_id: 0,
+            accepted_opcode: Opcode::EncapsulatedPayload,
+        }
+    }
+    // Authentication Stage 1: OOB Protocol
+    Lower Tester -> IUT: SimplePairingNumber {
+        transaction_id: 0,
+        nonce: [0; 16],
+    }
+    IUT -> Lower Tester: Accepted {
+        transaction_id: 0,
+        accepted_opcode: Opcode::SimplePairingNumber,
+    }
+    IUT -> Lower Tester: SimplePairingNumber {
+        transaction_id: 0,
+        nonce: [0; 16],
+    }
+    Lower Tester -> IUT: NotAccepted {
+        transaction_id: 0,
+        not_accepted_opcode: Opcode::SimplePairingNumber,
+        error_code: 0x05,
+    }
+    IUT -> Upper Tester: SimplePairingComplete {
+        status: ErrorCode::AuthenticationFailure,
+        bd_addr: context.peer_address(),
+    }
+}
diff --git a/tools/rootcanal/lmp/test/SP/BV-30-C.in b/tools/rootcanal/lmp/test/SP/BV-30-C.in
new file mode 100644
index 0000000..29784f0
--- /dev/null
+++ b/tools/rootcanal/lmp/test/SP/BV-30-C.in
@@ -0,0 +1,36 @@
+sequence! { procedure, context,
+    // ACL Connection Established
+    Lower Tester -> IUT: IoCapabilityReq {
+        transaction_id: 0,
+        io_capabilities: 0x01,
+        oob_authentication_data: 0x00,
+        authentication_requirement: 0x01,
+    }
+    IUT -> Upper Tester: IoCapabilityResponse {
+        bd_addr: context.peer_address(),
+        io_capability: IoCapability::DisplayYesNo,
+        oob_data_present: OobDataPresent::NotPresent,
+        authentication_requirements: AuthenticationRequirements::NoBondingMitmProtection,
+    }
+    IUT -> Upper Tester: IoCapabilityRequest {
+        bd_addr: context.peer_address(),
+    }
+    Upper Tester -> IUT: IoCapabilityRequestNegativeReply {
+        bd_addr: context.peer_address(),
+        reason: ErrorCode::PairingNotAllowed,
+    }
+    IUT -> Upper Tester: IoCapabilityRequestNegativeReplyComplete {
+        num_hci_command_packets: 1,
+        status: ErrorCode::Success,
+        bd_addr: context.peer_address(),
+    }
+    IUT -> Lower Tester: NotAcceptedExt {
+        transaction_id: 0,
+        not_accepted_opcode: ExtendedOpcode::IoCapabilityReq,
+        error_code: ErrorCode::PairingNotAllowed.to_u8().unwrap(),
+    }
+    IUT -> Upper Tester: SimplePairingComplete {
+        status: ErrorCode::AuthenticationFailure,
+        bd_addr: context.peer_address(),
+    }
+}
diff --git a/tools/rootcanal/lmp/test/SP/BV-31-C.in b/tools/rootcanal/lmp/test/SP/BV-31-C.in
new file mode 100644
index 0000000..6498a25
--- /dev/null
+++ b/tools/rootcanal/lmp/test/SP/BV-31-C.in
@@ -0,0 +1,41 @@
+sequence! { procedure, context,
+    // ACL Connection Established
+    Upper Tester -> IUT: AuthenticationRequested {
+        connection_handle: context.peer_handle()
+    }
+    IUT -> Upper Tester: AuthenticationRequestedStatus {
+       num_hci_command_packets: 1,
+       status: ErrorCode::Success,
+    }
+    IUT -> Upper Tester: LinkKeyRequest {
+        bd_addr: context.peer_address(),
+    }
+    Upper Tester -> IUT: LinkKeyRequestNegativeReply {
+        bd_addr: context.peer_address(),
+    }
+    IUT -> Upper Tester: LinkKeyRequestNegativeReplyComplete {
+       num_hci_command_packets: 1,
+       status: ErrorCode::Success,
+       bd_addr: context.peer_address(),
+    }
+    IUT -> Upper Tester: IoCapabilityRequest {
+        bd_addr: context.peer_address(),
+    }
+    Upper Tester -> IUT: IoCapabilityRequestNegativeReply {
+        bd_addr: context.peer_address(),
+        reason: ErrorCode::HostBusy,
+    }
+    IUT -> Upper Tester: IoCapabilityRequestNegativeReplyComplete {
+        num_hci_command_packets: 1,
+        status: ErrorCode::Success,
+        bd_addr: context.peer_address(),
+    }
+    IUT -> Upper Tester: SimplePairingComplete {
+        status: ErrorCode::AuthenticationFailure,
+        bd_addr: context.peer_address(),
+    }
+    IUT -> Upper Tester: AuthenticationComplete {
+        status: ErrorCode::AuthenticationFailure,
+        connection_handle: context.peer_handle(),
+    }
+}
diff --git a/tools/rootcanal/lmp/test/SP/BV-32-C.in b/tools/rootcanal/lmp/test/SP/BV-32-C.in
new file mode 100644
index 0000000..bd3017e
--- /dev/null
+++ b/tools/rootcanal/lmp/test/SP/BV-32-C.in
@@ -0,0 +1,36 @@
+sequence! { procedure, context,
+    // ACL Connection Established
+    Lower Tester -> IUT: IoCapabilityReq {
+        transaction_id: 0,
+        io_capabilities: 0x01,
+        oob_authentication_data: 0x00,
+        authentication_requirement: 0x01,
+    }
+    IUT -> Upper Tester: IoCapabilityResponse {
+        bd_addr: context.peer_address(),
+        io_capability: IoCapability::DisplayYesNo,
+        oob_data_present: OobDataPresent::NotPresent,
+        authentication_requirements: AuthenticationRequirements::NoBondingMitmProtection,
+    }
+    IUT -> Upper Tester: IoCapabilityRequest {
+        bd_addr: context.peer_address(),
+    }
+    Upper Tester -> IUT: IoCapabilityRequestNegativeReply {
+        bd_addr: context.peer_address(),
+        reason: ErrorCode::HostBusy,
+    }
+    IUT -> Upper Tester: IoCapabilityRequestNegativeReplyComplete {
+        num_hci_command_packets: 1,
+        status: ErrorCode::Success,
+        bd_addr: context.peer_address(),
+    }
+    IUT -> Lower Tester: NotAcceptedExt {
+        transaction_id: 0,
+        not_accepted_opcode: ExtendedOpcode::IoCapabilityReq,
+        error_code: ErrorCode::HostBusy.to_u8().unwrap(),
+    }
+    IUT -> Upper Tester: SimplePairingComplete {
+        status: ErrorCode::AuthenticationFailure,
+        bd_addr: context.peer_address(),
+    }
+}
diff --git a/tools/rootcanal/lmp/test/SP/BV-33-C.in b/tools/rootcanal/lmp/test/SP/BV-33-C.in
new file mode 100644
index 0000000..90f5029
--- /dev/null
+++ b/tools/rootcanal/lmp/test/SP/BV-33-C.in
@@ -0,0 +1,200 @@
+sequence! { procedure, context,
+    // ACL Connection Established
+    Upper Tester -> IUT: AuthenticationRequested {
+        connection_handle: context.peer_handle()
+    }
+    IUT -> Upper Tester: AuthenticationRequestedStatus {
+       num_hci_command_packets: 1,
+       status: ErrorCode::Success,
+    }
+    IUT -> Upper Tester: LinkKeyRequest {
+        bd_addr: context.peer_address(),
+    }
+    Upper Tester -> IUT: LinkKeyRequestNegativeReply {
+        bd_addr: context.peer_address(),
+    }
+    IUT -> Upper Tester: LinkKeyRequestNegativeReplyComplete {
+       num_hci_command_packets: 1,
+       status: ErrorCode::Success,
+       bd_addr: context.peer_address(),
+    }
+    IUT -> Upper Tester: IoCapabilityRequest {
+        bd_addr: context.peer_address(),
+    }
+    Upper Tester -> IUT: IoCapabilityRequestReply {
+        bd_addr: context.peer_address(),
+        io_capability: IoCapability::KeyboardOnly,
+        oob_present: OobDataPresent::NotPresent,
+        authentication_requirements: AuthenticationRequirements::NoBondingMitmProtection,
+    }
+    IUT -> Upper Tester: IoCapabilityRequestReplyComplete {
+        num_hci_command_packets: 1,
+        status: ErrorCode::Success,
+        bd_addr: context.peer_address(),
+    }
+    IUT -> Lower Tester: IoCapabilityReq {
+        transaction_id: 0,
+        io_capabilities: 0x02,
+        oob_authentication_data: 0x00,
+        authentication_requirement: 0x01,
+    }
+    Lower Tester -> IUT: IoCapabilityRes {
+        transaction_id: 0,
+        io_capabilities: 0x00,
+        oob_authentication_data: 0x00,
+        authentication_requirement: 0x01,
+    }
+    IUT -> Upper Tester: IoCapabilityResponse {
+        bd_addr: context.peer_address(),
+        io_capability: IoCapability::DisplayOnly,
+        oob_data_present: OobDataPresent::NotPresent,
+        authentication_requirements: AuthenticationRequirements::NoBondingMitmProtection,
+    }
+    // Public Key Exchange
+    IUT -> Lower Tester: EncapsulatedHeader {
+        transaction_id: 0,
+        major_type: 1,
+        minor_type: 1,
+        payload_length: 48,
+    }
+    Lower Tester -> IUT: Accepted {
+        transaction_id: 0,
+        accepted_opcode: Opcode::EncapsulatedHeader,
+    }
+    repeat 3 times with (part in local_p192_public_key(&context)) {
+        IUT -> Lower Tester: EncapsulatedPayload {
+            transaction_id: 0,
+            data: part,
+        }
+        Lower Tester -> IUT: Accepted {
+            transaction_id: 0,
+            accepted_opcode: Opcode::EncapsulatedPayload,
+        }
+    }
+    Lower Tester -> IUT: EncapsulatedHeader {
+        transaction_id: 0,
+        major_type: 1,
+        minor_type: 1,
+        payload_length: 48,
+    }
+    IUT -> Lower Tester: Accepted {
+        transaction_id: 0,
+        accepted_opcode: Opcode::EncapsulatedHeader,
+    }
+    repeat 3 times with (part in peer_p192_public_key()) {
+        Lower Tester -> IUT: EncapsulatedPayload {
+            transaction_id: 0,
+            data: part,
+        }
+        IUT -> Lower Tester: Accepted {
+            transaction_id: 0,
+            accepted_opcode: Opcode::EncapsulatedPayload,
+        }
+    }
+    // Authentication Stage 1: Passkey Entry Protocol
+    IUT -> Upper Tester: UserPasskeyRequest {
+        bd_addr: context.peer_address(),
+    }
+    Upper Tester -> IUT: SendKeypressNotification {
+        bd_addr: context.peer_address(),
+        notification_type: KeypressNotificationType::EntryStarted,
+    }
+    IUT -> Lower Tester: KeypressNotification {
+        transaction_id: 0,
+        notification_type: 0x00,
+    }
+    IUT -> Upper Tester: SendKeypressNotificationComplete {
+        num_hci_command_packets: 1,
+        status: ErrorCode::Success,
+        bd_addr: context.peer_address(),
+    }
+    Upper Tester -> IUT: SendKeypressNotification {
+        bd_addr: context.peer_address(),
+        notification_type: KeypressNotificationType::EntryCompleted,
+    }
+    IUT -> Lower Tester: KeypressNotification {
+        transaction_id: 0,
+        notification_type: 0x04,
+    }
+    IUT -> Upper Tester: SendKeypressNotificationComplete {
+        num_hci_command_packets: 1,
+        status: ErrorCode::Success,
+        bd_addr: context.peer_address(),
+    }
+    Upper Tester -> IUT: UserPasskeyRequestReply {
+        bd_addr: context.peer_address(),
+        numeric_value: 0,
+    }
+    IUT -> Upper Tester: UserPasskeyRequestReplyComplete {
+        num_hci_command_packets: 1,
+        status: ErrorCode::Success,
+        bd_addr: context.peer_address(),
+    }
+    repeat 20 times {
+        IUT -> Lower Tester: SimplePairingConfirm {
+            transaction_id: 0,
+            commitment_value: [0; 16],
+        }
+        Lower Tester -> IUT: SimplePairingConfirm {
+            transaction_id: 0,
+            commitment_value: [0; 16],
+        }
+        IUT -> Lower Tester: SimplePairingNumber {
+            transaction_id: 0,
+            nonce: [0; 16],
+        }
+        Lower Tester -> IUT: Accepted {
+            transaction_id: 0,
+            accepted_opcode: Opcode::SimplePairingNumber,
+        }
+        Lower Tester -> IUT: SimplePairingNumber {
+            transaction_id: 0,
+            nonce: [0; 16],
+        }
+        IUT -> Lower Tester: Accepted {
+            transaction_id: 0,
+            accepted_opcode: Opcode::SimplePairingNumber,
+        }
+    }
+    // Authentication Stage 2
+    IUT -> Lower Tester: DhkeyCheck {
+        transaction_id: 0,
+        confirmation_value: [0; 16],
+    }
+    Lower Tester -> IUT: Accepted { transaction_id: 0, accepted_opcode: Opcode::DhkeyCheck }
+    Lower Tester -> IUT: DhkeyCheck {
+        transaction_id: 0,
+        confirmation_value: [0; 16],
+    }
+    IUT -> Lower Tester: Accepted { transaction_id: 0, accepted_opcode: Opcode::DhkeyCheck }
+    IUT -> Upper Tester: SimplePairingComplete {
+        status: ErrorCode::Success,
+        bd_addr: context.peer_address(),
+    }
+    // Link Key Calculation
+    IUT -> Lower Tester: AuRand {
+        transaction_id: 0,
+        random_number: [0; 16],
+    }
+    Lower Tester -> IUT: Sres {
+        transaction_id: 0,
+        authentication_rsp: [0; 4],
+    }
+    Lower Tester -> IUT: AuRand {
+        transaction_id: 0,
+        random_number: [0; 16],
+    }
+    IUT -> Lower Tester: Sres {
+        transaction_id: 0,
+        authentication_rsp: [0; 4],
+    }
+    IUT -> Upper Tester: LinkKeyNotification {
+        bd_addr: context.peer_address(),
+        key_type: KeyType::AuthenticatedP192,
+        link_key: [0; 16],
+    }
+    IUT -> Upper Tester: AuthenticationComplete {
+        status: ErrorCode::Success,
+        connection_handle: context.peer_handle(),
+    }
+}
diff --git a/tools/rootcanal/lmp/test/SP/BV-34-C.in b/tools/rootcanal/lmp/test/SP/BV-34-C.in
new file mode 100644
index 0000000..39233bf
--- /dev/null
+++ b/tools/rootcanal/lmp/test/SP/BV-34-C.in
@@ -0,0 +1,157 @@
+sequence! { procedure, context,
+    // ACL Connection Established
+    Lower Tester -> IUT: IoCapabilityReq {
+        transaction_id: 0,
+        io_capabilities: 0x02,
+        oob_authentication_data: 0x00,
+        authentication_requirement: 0x01,
+    }
+    IUT -> Upper Tester: IoCapabilityResponse {
+        bd_addr: context.peer_address(),
+        io_capability: IoCapability::KeyboardOnly,
+        oob_data_present: OobDataPresent::NotPresent,
+        authentication_requirements: AuthenticationRequirements::NoBondingMitmProtection,
+    }
+    IUT -> Upper Tester: IoCapabilityRequest {
+        bd_addr: context.peer_address(),
+    }
+    Upper Tester -> IUT: IoCapabilityRequestReply {
+        bd_addr: context.peer_address(),
+        io_capability: IoCapability::DisplayOnly,
+        oob_present: OobDataPresent::NotPresent,
+        authentication_requirements: AuthenticationRequirements::NoBondingMitmProtection,
+    }
+    IUT -> Upper Tester: IoCapabilityRequestReplyComplete {
+        num_hci_command_packets: 1,
+        status: ErrorCode::Success,
+        bd_addr: context.peer_address(),
+    }
+    IUT -> Lower Tester: IoCapabilityRes {
+        transaction_id: 0,
+        io_capabilities: 0x00,
+        oob_authentication_data: 0x00,
+        authentication_requirement: 0x01,
+    }
+    // Public Key Exchange
+    Lower Tester -> IUT: EncapsulatedHeader {
+        transaction_id: 0,
+        major_type: 1,
+        minor_type: 1,
+        payload_length: 48,
+    }
+    IUT -> Lower Tester: Accepted {
+        transaction_id: 0,
+        accepted_opcode: Opcode::EncapsulatedHeader,
+    }
+    repeat 3 times with (part in peer_p192_public_key()) {
+        Lower Tester -> IUT: EncapsulatedPayload {
+            transaction_id: 0,
+            data: part,
+        }
+        IUT -> Lower Tester: Accepted {
+            transaction_id: 0,
+            accepted_opcode: Opcode::EncapsulatedPayload,
+        }
+    }
+    IUT -> Lower Tester: EncapsulatedHeader {
+        transaction_id: 0,
+        major_type: 1,
+        minor_type: 1,
+        payload_length: 48,
+    }
+    Lower Tester -> IUT: Accepted {
+        transaction_id: 0,
+        accepted_opcode: Opcode::EncapsulatedHeader,
+    }
+    repeat 3 times with (part in local_p192_public_key(&context)) {
+        IUT -> Lower Tester: EncapsulatedPayload {
+            transaction_id: 0,
+            data: part,
+        }
+        Lower Tester -> IUT: Accepted {
+            transaction_id: 0,
+            accepted_opcode: Opcode::EncapsulatedPayload,
+        }
+    }
+    // Authentication Stage 1: Passkey Entry Protocol
+    IUT -> Upper Tester: UserPasskeyNotification { bd_addr: context.peer_address(), passkey: 0 }
+    Lower Tester -> IUT: KeypressNotification {
+        transaction_id: 0,
+        notification_type: 0x00,
+    }
+    IUT -> Upper Tester: KeypressNotification {
+         bd_addr: context.peer_address(),
+         notification_type: KeypressNotificationType::EntryStarted,
+    }
+    Lower Tester -> IUT: KeypressNotification {
+        transaction_id: 0,
+        notification_type: 0x04,
+    }
+    IUT -> Upper Tester: KeypressNotification {
+         bd_addr: context.peer_address(),
+         notification_type: KeypressNotificationType::EntryCompleted,
+    }
+    repeat 20 times {
+        Lower Tester -> IUT: SimplePairingConfirm {
+            transaction_id: 0,
+            commitment_value: [0; 16],
+        }
+        IUT -> Lower Tester: SimplePairingConfirm {
+            transaction_id: 0,
+            commitment_value: [0; 16],
+        }
+        Lower Tester -> IUT: SimplePairingNumber {
+            transaction_id: 0,
+            nonce: [0; 16],
+        }
+        IUT -> Lower Tester: Accepted {
+            transaction_id: 0,
+            accepted_opcode: Opcode::SimplePairingNumber,
+        }
+        IUT -> Lower Tester: SimplePairingNumber {
+            transaction_id: 0,
+            nonce: [0; 16],
+        }
+        Lower Tester -> IUT: Accepted {
+            transaction_id: 0,
+            accepted_opcode: Opcode::SimplePairingNumber,
+        }
+    }
+    // Authentication Stage 2
+    Lower Tester -> IUT: DhkeyCheck {
+        transaction_id: 0,
+        confirmation_value: [0; 16],
+    }
+    IUT -> Lower Tester: Accepted { transaction_id: 0, accepted_opcode: Opcode::DhkeyCheck }
+    IUT -> Lower Tester: DhkeyCheck {
+        transaction_id: 0,
+        confirmation_value: [0; 16],
+    }
+    Lower Tester -> IUT: Accepted { transaction_id: 0, accepted_opcode: Opcode::DhkeyCheck }
+    IUT -> Upper Tester: SimplePairingComplete {
+        status: ErrorCode::Success,
+        bd_addr: context.peer_address(),
+    }
+    // Link Key Calculation
+    Lower Tester -> IUT: AuRand {
+        transaction_id: 0,
+        random_number: [0; 16],
+    }
+    IUT -> Lower Tester: Sres {
+        transaction_id: 0,
+        authentication_rsp: [0; 4],
+    }
+    IUT -> Lower Tester: AuRand {
+        transaction_id: 0,
+        random_number: [0; 16],
+    }
+    Lower Tester -> IUT: Sres {
+        transaction_id: 0,
+        authentication_rsp: [0; 4],
+    }
+    IUT -> Upper Tester: LinkKeyNotification {
+        bd_addr: context.peer_address(),
+        key_type: KeyType::AuthenticatedP192,
+        link_key: [0; 16],
+    }
+}
diff --git a/tools/rootcanal/lmp/test/SP/BV-35-C.in b/tools/rootcanal/lmp/test/SP/BV-35-C.in
new file mode 100644
index 0000000..999a4ba
--- /dev/null
+++ b/tools/rootcanal/lmp/test/SP/BV-35-C.in
@@ -0,0 +1,158 @@
+sequence! { procedure, context,
+    // ACL Connection Established
+    Upper Tester -> IUT: AuthenticationRequested {
+        connection_handle: context.peer_handle()
+    }
+    IUT -> Upper Tester: AuthenticationRequestedStatus {
+       num_hci_command_packets: 1,
+       status: ErrorCode::Success,
+    }
+    IUT -> Upper Tester: LinkKeyRequest {
+        bd_addr: context.peer_address(),
+    }
+    Upper Tester -> IUT: LinkKeyRequestNegativeReply {
+        bd_addr: context.peer_address(),
+    }
+    IUT -> Upper Tester: LinkKeyRequestNegativeReplyComplete {
+       num_hci_command_packets: 1,
+       status: ErrorCode::Success,
+       bd_addr: context.peer_address(),
+    }
+    IUT -> Upper Tester: IoCapabilityRequest {
+        bd_addr: context.peer_address(),
+    }
+    Upper Tester -> IUT: IoCapabilityRequestReply {
+        bd_addr: context.peer_address(),
+        io_capability: IoCapability::KeyboardOnly,
+        oob_present: OobDataPresent::NotPresent,
+        authentication_requirements: AuthenticationRequirements::NoBondingMitmProtection,
+    }
+    IUT -> Upper Tester: IoCapabilityRequestReplyComplete {
+        num_hci_command_packets: 1,
+        status: ErrorCode::Success,
+        bd_addr: context.peer_address(),
+    }
+    IUT -> Lower Tester: IoCapabilityReq {
+        transaction_id: 0,
+        io_capabilities: 0x02,
+        oob_authentication_data: 0x00,
+        authentication_requirement: 0x01,
+    }
+    Lower Tester -> IUT: IoCapabilityRes {
+        transaction_id: 0,
+        io_capabilities: 0x00,
+        oob_authentication_data: 0x00,
+        authentication_requirement: 0x01,
+    }
+    IUT -> Upper Tester: IoCapabilityResponse {
+        bd_addr: context.peer_address(),
+        io_capability: IoCapability::DisplayOnly,
+        oob_data_present: OobDataPresent::NotPresent,
+        authentication_requirements: AuthenticationRequirements::NoBondingMitmProtection,
+    }
+    // Public Key Exchange
+    IUT -> Lower Tester: EncapsulatedHeader {
+        transaction_id: 0,
+        major_type: 1,
+        minor_type: 1,
+        payload_length: 48,
+    }
+    Lower Tester -> IUT: Accepted {
+        transaction_id: 0,
+        accepted_opcode: Opcode::EncapsulatedHeader,
+    }
+    repeat 3 times with (part in local_p192_public_key(&context)) {
+        IUT -> Lower Tester: EncapsulatedPayload {
+            transaction_id: 0,
+            data: part,
+        }
+        Lower Tester -> IUT: Accepted {
+            transaction_id: 0,
+            accepted_opcode: Opcode::EncapsulatedPayload,
+        }
+    }
+    Lower Tester -> IUT: EncapsulatedHeader {
+        transaction_id: 0,
+        major_type: 1,
+        minor_type: 1,
+        payload_length: 48,
+    }
+    IUT -> Lower Tester: Accepted {
+        transaction_id: 0,
+        accepted_opcode: Opcode::EncapsulatedHeader,
+    }
+    repeat 3 times with (part in peer_p192_public_key()) {
+        Lower Tester -> IUT: EncapsulatedPayload {
+            transaction_id: 0,
+            data: part,
+        }
+        IUT -> Lower Tester: Accepted {
+            transaction_id: 0,
+            accepted_opcode: Opcode::EncapsulatedPayload,
+        }
+    }
+    // Authentication Stage 1: Passkey Entry Protocol
+    IUT -> Upper Tester: UserPasskeyRequest {
+        bd_addr: context.peer_address(),
+    }
+    Upper Tester -> IUT: SendKeypressNotification {
+        bd_addr: context.peer_address(),
+        notification_type: KeypressNotificationType::EntryStarted,
+    }
+    IUT -> Lower Tester: KeypressNotification {
+        transaction_id: 0,
+        notification_type: 0x00,
+    }
+    IUT -> Upper Tester: SendKeypressNotificationComplete {
+        num_hci_command_packets: 1,
+        status: ErrorCode::Success,
+        bd_addr: context.peer_address(),
+    }
+    Upper Tester -> IUT: SendKeypressNotification {
+        bd_addr: context.peer_address(),
+        notification_type: KeypressNotificationType::EntryCompleted,
+    }
+    IUT -> Lower Tester: KeypressNotification {
+        transaction_id: 0,
+        notification_type: 0x04,
+    }
+    IUT -> Upper Tester: SendKeypressNotificationComplete {
+        num_hci_command_packets: 1,
+        status: ErrorCode::Success,
+        bd_addr: context.peer_address(),
+    }
+    Upper Tester -> IUT: UserPasskeyRequestReply {
+        bd_addr: context.peer_address(),
+        numeric_value: 0,
+    }
+    IUT -> Upper Tester: UserPasskeyRequestReplyComplete {
+        num_hci_command_packets: 1,
+        status: ErrorCode::Success,
+        bd_addr: context.peer_address(),
+    }
+    IUT -> Lower Tester: SimplePairingConfirm {
+        transaction_id: 0,
+        commitment_value: [0; 16],
+    }
+    Lower Tester -> IUT: SimplePairingConfirm {
+        transaction_id: 0,
+        commitment_value: [0; 16],
+    }
+    IUT -> Lower Tester: SimplePairingNumber {
+        transaction_id: 0,
+        nonce: [0; 16],
+    }
+    Lower Tester -> IUT: NotAccepted {
+        transaction_id: 0,
+        not_accepted_opcode: Opcode::SimplePairingNumber,
+        error_code: ErrorCode::AuthenticationFailure.to_u8().unwrap(),
+    }
+    IUT -> Upper Tester: SimplePairingComplete {
+        status: ErrorCode::AuthenticationFailure,
+        bd_addr: context.peer_address(),
+    }
+    IUT -> Upper Tester: AuthenticationComplete {
+        status: ErrorCode::AuthenticationFailure,
+        connection_handle: context.peer_handle(),
+    }
+}
diff --git a/tools/rootcanal/lmp/test/SP/BV-36-C.in b/tools/rootcanal/lmp/test/SP/BV-36-C.in
new file mode 100644
index 0000000..f9948d6
--- /dev/null
+++ b/tools/rootcanal/lmp/test/SP/BV-36-C.in
@@ -0,0 +1,115 @@
+sequence! { procedure, context,
+    // ACL Connection Established
+    Lower Tester -> IUT: IoCapabilityReq {
+        transaction_id: 0,
+        io_capabilities: 0x02,
+        oob_authentication_data: 0x00,
+        authentication_requirement: 0x01,
+    }
+    IUT -> Upper Tester: IoCapabilityResponse {
+        bd_addr: context.peer_address(),
+        io_capability: IoCapability::KeyboardOnly,
+        oob_data_present: OobDataPresent::NotPresent,
+        authentication_requirements: AuthenticationRequirements::NoBondingMitmProtection,
+    }
+    IUT -> Upper Tester: IoCapabilityRequest {
+        bd_addr: context.peer_address(),
+    }
+    Upper Tester -> IUT: IoCapabilityRequestReply {
+        bd_addr: context.peer_address(),
+        io_capability: IoCapability::DisplayOnly,
+        oob_present: OobDataPresent::NotPresent,
+        authentication_requirements: AuthenticationRequirements::NoBondingMitmProtection,
+    }
+    IUT -> Upper Tester: IoCapabilityRequestReplyComplete {
+        num_hci_command_packets: 1,
+        status: ErrorCode::Success,
+        bd_addr: context.peer_address(),
+    }
+    IUT -> Lower Tester: IoCapabilityRes {
+        transaction_id: 0,
+        io_capabilities: 0x00,
+        oob_authentication_data: 0x00,
+        authentication_requirement: 0x01,
+    }
+    // Public Key Exchange
+    Lower Tester -> IUT: EncapsulatedHeader {
+        transaction_id: 0,
+        major_type: 1,
+        minor_type: 1,
+        payload_length: 48,
+    }
+    IUT -> Lower Tester: Accepted {
+        transaction_id: 0,
+        accepted_opcode: Opcode::EncapsulatedHeader,
+    }
+    repeat 3 times with (part in peer_p192_public_key()) {
+        Lower Tester -> IUT: EncapsulatedPayload {
+            transaction_id: 0,
+            data: part,
+        }
+        IUT -> Lower Tester: Accepted {
+            transaction_id: 0,
+            accepted_opcode: Opcode::EncapsulatedPayload,
+        }
+    }
+    IUT -> Lower Tester: EncapsulatedHeader {
+        transaction_id: 0,
+        major_type: 1,
+        minor_type: 1,
+        payload_length: 48,
+    }
+    Lower Tester -> IUT: Accepted {
+        transaction_id: 0,
+        accepted_opcode: Opcode::EncapsulatedHeader,
+    }
+    repeat 3 times with (part in local_p192_public_key(&context)) {
+        IUT -> Lower Tester: EncapsulatedPayload {
+            transaction_id: 0,
+            data: part,
+        }
+        Lower Tester -> IUT: Accepted {
+            transaction_id: 0,
+            accepted_opcode: Opcode::EncapsulatedPayload,
+        }
+    }
+    // Authentication Stage 1: Passkey Entry Protocol
+    IUT -> Upper Tester: UserPasskeyNotification { bd_addr: context.peer_address(), passkey: 0 }
+    Lower Tester -> IUT: KeypressNotification {
+        transaction_id: 0,
+        notification_type: 0x00,
+    }
+    IUT -> Upper Tester: KeypressNotification {
+         bd_addr: context.peer_address(),
+         notification_type: KeypressNotificationType::EntryStarted,
+    }
+    Lower Tester -> IUT: KeypressNotification {
+        transaction_id: 0,
+        notification_type: 0x04,
+    }
+    IUT -> Upper Tester: KeypressNotification {
+         bd_addr: context.peer_address(),
+         notification_type: KeypressNotificationType::EntryCompleted,
+    }
+    Lower Tester -> IUT: SimplePairingConfirm {
+        transaction_id: 0,
+        commitment_value: [0; 16],
+    }
+    IUT -> Lower Tester: SimplePairingConfirm {
+        transaction_id: 0,
+        commitment_value: [0; 16],
+    }
+    Lower Tester -> IUT: SimplePairingNumber {
+        transaction_id: 0,
+        nonce: [0; 16],
+    }
+    IUT -> Lower Tester: NotAccepted {
+        transaction_id: 0,
+        not_accepted_opcode: Opcode::SimplePairingNumber,
+        error_code: ErrorCode::AuthenticationFailure.to_u8().unwrap(),
+    }
+    IUT -> Upper Tester: SimplePairingComplete {
+        status: ErrorCode::AuthenticationFailure,
+        bd_addr: context.peer_address(),
+    }
+}
diff --git a/tools/rootcanal/model/controller/acl_connection.cc b/tools/rootcanal/model/controller/acl_connection.cc
index 0f41176..35d2108 100644
--- a/tools/rootcanal/model/controller/acl_connection.cc
+++ b/tools/rootcanal/model/controller/acl_connection.cc
@@ -20,11 +20,14 @@
 AclConnection::AclConnection(AddressWithType address,
                              AddressWithType own_address,
                              AddressWithType resolved_address,
-                             Phy::Type phy_type)
+                             Phy::Type phy_type, bluetooth::hci::Role role)
     : address_(address),
       own_address_(own_address),
       resolved_address_(resolved_address),
-      type_(phy_type) {}
+      type_(phy_type),
+      role_(role),
+      last_packet_timestamp_(std::chrono::steady_clock::now()),
+      timeout_(std::chrono::seconds(1)) {}
 
 void AclConnection::Encrypt() { encrypted_ = true; };
 
@@ -46,4 +49,38 @@
 
 Phy::Type AclConnection::GetPhyType() const { return type_; }
 
+uint16_t AclConnection::GetLinkPolicySettings() const {
+  return link_policy_settings_;
+};
+
+void AclConnection::SetLinkPolicySettings(uint16_t settings) {
+  link_policy_settings_ = settings;
+}
+
+bluetooth::hci::Role AclConnection::GetRole() const { return role_; };
+
+void AclConnection::SetRole(bluetooth::hci::Role role) { role_ = role; }
+
+void AclConnection::ResetLinkTimer() {
+  last_packet_timestamp_ = std::chrono::steady_clock::now();
+}
+
+std::chrono::steady_clock::duration AclConnection::TimeUntilNearExpiring()
+    const {
+  return (last_packet_timestamp_ + timeout_ / 2) -
+         std::chrono::steady_clock::now();
+}
+
+bool AclConnection::IsNearExpiring() const {
+  return TimeUntilNearExpiring() < std::chrono::steady_clock::duration::zero();
+}
+
+std::chrono::steady_clock::duration AclConnection::TimeUntilExpired() const {
+  return (last_packet_timestamp_ + timeout_) - std::chrono::steady_clock::now();
+}
+
+bool AclConnection::HasExpired() const {
+  return TimeUntilExpired() < std::chrono::steady_clock::duration::zero();
+}
+
 }  // namespace rootcanal
diff --git a/tools/rootcanal/model/controller/acl_connection.h b/tools/rootcanal/model/controller/acl_connection.h
index c6e1393..c2c23c7 100644
--- a/tools/rootcanal/model/controller/acl_connection.h
+++ b/tools/rootcanal/model/controller/acl_connection.h
@@ -16,6 +16,7 @@
 
 #pragma once
 
+#include <chrono>
 #include <cstdint>
 
 #include "hci/address_with_type.h"
@@ -29,7 +30,8 @@
 class AclConnection {
  public:
   AclConnection(AddressWithType address, AddressWithType own_address,
-                AddressWithType resolved_address, Phy::Type phy_type);
+                AddressWithType resolved_address, Phy::Type phy_type,
+                bluetooth::hci::Role role);
 
   virtual ~AclConnection() = default;
 
@@ -49,6 +51,24 @@
 
   Phy::Type GetPhyType() const;
 
+  uint16_t GetLinkPolicySettings() const;
+
+  void SetLinkPolicySettings(uint16_t settings);
+
+  bluetooth::hci::Role GetRole() const;
+
+  void SetRole(bluetooth::hci::Role role);
+
+  void ResetLinkTimer();
+
+  std::chrono::steady_clock::duration TimeUntilNearExpiring() const;
+
+  bool IsNearExpiring() const;
+
+  std::chrono::steady_clock::duration TimeUntilExpired() const;
+
+  bool HasExpired() const;
+
  private:
   AddressWithType address_;
   AddressWithType own_address_;
@@ -57,6 +77,10 @@
 
   // State variables
   bool encrypted_{false};
+  uint16_t link_policy_settings_{0};
+  bluetooth::hci::Role role_{bluetooth::hci::Role::CENTRAL};
+  std::chrono::steady_clock::time_point last_packet_timestamp_;
+  std::chrono::steady_clock::duration timeout_;
 };
 
 }  // namespace rootcanal
diff --git a/tools/rootcanal/model/controller/acl_connection_handler.cc b/tools/rootcanal/model/controller/acl_connection_handler.cc
index 28efac8..60bbbe1 100644
--- a/tools/rootcanal/model/controller/acl_connection_handler.cc
+++ b/tools/rootcanal/model/controller/acl_connection_handler.cc
@@ -19,7 +19,7 @@
 #include <hci/hci_packets.h>
 
 #include "hci/address.h"
-#include "os/log.h"
+#include "log.h"
 
 namespace rootcanal {
 
@@ -27,6 +27,12 @@
 using ::bluetooth::hci::AddressType;
 using ::bluetooth::hci::AddressWithType;
 
+void AclConnectionHandler::RegisterTaskScheduler(
+    std::function<AsyncTaskId(std::chrono::milliseconds, const TaskCallback&)>
+        event_scheduler) {
+  schedule_task_ = event_scheduler;
+}
+
 bool AclConnectionHandler::HasHandle(uint16_t handle) const {
   return acl_connections_.count(handle) != 0;
 }
@@ -127,27 +133,31 @@
         AclConnection{
             AddressWithType{addr, AddressType::PUBLIC_DEVICE_ADDRESS},
             AddressWithType{own_addr, AddressType::PUBLIC_DEVICE_ADDRESS},
-            AddressWithType(), Phy::Type::BR_EDR});
+            AddressWithType(), Phy::Type::BR_EDR,
+            bluetooth::hci::Role::CENTRAL});
     return handle;
   }
   return kReservedHandle;
 }
 
 uint16_t AclConnectionHandler::CreateLeConnection(AddressWithType addr,
-                                                  AddressWithType own_addr) {
+                                                  AddressWithType own_addr,
+                                                  bluetooth::hci::Role role) {
   AddressWithType resolved_peer = pending_le_connection_resolved_address_;
   if (CancelPendingLeConnection(addr)) {
     uint16_t handle = GetUnusedHandle();
-    acl_connections_.emplace(
-        handle,
-        AclConnection{addr, own_addr, resolved_peer, Phy::Type::LOW_ENERGY});
+    acl_connections_.emplace(handle,
+                             AclConnection{addr, own_addr, resolved_peer,
+                                           Phy::Type::LOW_ENERGY, role});
     return handle;
   }
   return kReservedHandle;
 }
 
-bool AclConnectionHandler::Disconnect(uint16_t handle) {
+bool AclConnectionHandler::Disconnect(
+    uint16_t handle, std::function<void(AsyncTaskId)> stopStream) {
   if (HasScoHandle(handle)) {
+    sco_connections_.at(handle).StopStream(std::move(stopStream));
     sco_connections_.erase(handle);
     return true;
   }
@@ -223,6 +233,24 @@
   return acl_connections_.at(handle).GetPhyType();
 }
 
+uint16_t AclConnectionHandler::GetAclLinkPolicySettings(uint16_t handle) const {
+  return acl_connections_.at(handle).GetLinkPolicySettings();
+};
+
+void AclConnectionHandler::SetAclLinkPolicySettings(uint16_t handle,
+                                                    uint16_t settings) {
+  acl_connections_.at(handle).SetLinkPolicySettings(settings);
+}
+
+bluetooth::hci::Role AclConnectionHandler::GetAclRole(uint16_t handle) const {
+  return acl_connections_.at(handle).GetRole();
+};
+
+void AclConnectionHandler::SetAclRole(uint16_t handle,
+                                      bluetooth::hci::Role role) {
+  acl_connections_.at(handle).SetRole(role);
+}
+
 std::unique_ptr<bluetooth::hci::LeSetCigParametersCompleteBuilder>
 AclConnectionHandler::SetCigParameters(
     uint8_t id, uint32_t sdu_interval_m_to_s, uint32_t sdu_interval_s_to_m,
@@ -432,10 +460,10 @@
 
 void AclConnectionHandler::CreateScoConnection(
     bluetooth::hci::Address addr, ScoConnectionParameters const& parameters,
-    ScoState state, bool legacy) {
+    ScoState state, ScoDatapath datapath, bool legacy) {
   uint16_t sco_handle = GetUnusedHandle();
-  sco_connections_.emplace(sco_handle,
-                           ScoConnection(addr, parameters, state, legacy));
+  sco_connections_.emplace(
+      sco_handle, ScoConnection(addr, parameters, state, datapath, legacy));
 }
 
 bool AclConnectionHandler::HasPendingScoConnection(
@@ -482,11 +510,13 @@
 }
 
 bool AclConnectionHandler::AcceptPendingScoConnection(
-    bluetooth::hci::Address addr, ScoLinkParameters const& parameters) {
+    bluetooth::hci::Address addr, ScoLinkParameters const& parameters,
+    std::function<AsyncTaskId()> startStream) {
   for (auto& pair : sco_connections_) {
     if (std::get<ScoConnection>(pair).GetAddress() == addr) {
       std::get<ScoConnection>(pair).SetLinkParameters(parameters);
       std::get<ScoConnection>(pair).SetState(ScoState::SCO_STATE_OPENED);
+      std::get<ScoConnection>(pair).StartStream(std::move(startStream));
       return true;
     }
   }
@@ -494,13 +524,17 @@
 }
 
 bool AclConnectionHandler::AcceptPendingScoConnection(
-    bluetooth::hci::Address addr, ScoConnectionParameters const& parameters) {
+    bluetooth::hci::Address addr, ScoConnectionParameters const& parameters,
+    std::function<AsyncTaskId()> startStream) {
   for (auto& pair : sco_connections_) {
     if (std::get<ScoConnection>(pair).GetAddress() == addr) {
       bool ok =
           std::get<ScoConnection>(pair).NegotiateLinkParameters(parameters);
       std::get<ScoConnection>(pair).SetState(ok ? ScoState::SCO_STATE_OPENED
                                                 : ScoState::SCO_STATE_CLOSED);
+      if (ok) {
+        std::get<ScoConnection>(pair).StartStream(std::move(startStream));
+      }
       return ok;
     }
   }
@@ -546,4 +580,26 @@
   return keys;
 }
 
+void AclConnectionHandler::ResetLinkTimer(uint16_t handle) {
+  acl_connections_.at(handle).ResetLinkTimer();
+}
+
+std::chrono::steady_clock::duration
+AclConnectionHandler::TimeUntilLinkNearExpiring(uint16_t handle) const {
+  return acl_connections_.at(handle).TimeUntilNearExpiring();
+}
+
+bool AclConnectionHandler::IsLinkNearExpiring(uint16_t handle) const {
+  return acl_connections_.at(handle).IsNearExpiring();
+}
+
+std::chrono::steady_clock::duration AclConnectionHandler::TimeUntilLinkExpired(
+    uint16_t handle) const {
+  return acl_connections_.at(handle).TimeUntilExpired();
+}
+
+bool AclConnectionHandler::HasLinkExpired(uint16_t handle) const {
+  return acl_connections_.at(handle).HasExpired();
+}
+
 }  // namespace rootcanal
diff --git a/tools/rootcanal/model/controller/acl_connection_handler.h b/tools/rootcanal/model/controller/acl_connection_handler.h
index d5a6b6d..dcffff4 100644
--- a/tools/rootcanal/model/controller/acl_connection_handler.h
+++ b/tools/rootcanal/model/controller/acl_connection_handler.h
@@ -16,6 +16,7 @@
 
 #pragma once
 
+#include <chrono>
 #include <cstdint>
 #include <set>
 #include <unordered_map>
@@ -24,6 +25,7 @@
 #include "hci/address.h"
 #include "hci/address_with_type.h"
 #include "isochronous_connection_handler.h"
+#include "model/setup/async_manager.h"
 #include "phy.h"
 #include "sco_connection.h"
 
@@ -36,6 +38,10 @@
 
   virtual ~AclConnectionHandler() = default;
 
+  void RegisterTaskScheduler(
+      std::function<AsyncTaskId(std::chrono::milliseconds, const TaskCallback&)>
+          event_scheduler);
+
   bool CreatePendingConnection(bluetooth::hci::Address addr,
                                bool authenticate_on_connect);
   bool HasPendingConnection(bluetooth::hci::Address addr) const;
@@ -47,12 +53,15 @@
   bool IsLegacyScoConnection(bluetooth::hci::Address addr) const;
   void CreateScoConnection(bluetooth::hci::Address addr,
                            ScoConnectionParameters const& parameters,
-                           ScoState state, bool legacy = false);
+                           ScoState state, ScoDatapath datapath,
+                           bool legacy = false);
   void CancelPendingScoConnection(bluetooth::hci::Address addr);
   bool AcceptPendingScoConnection(bluetooth::hci::Address addr,
-                                  ScoLinkParameters const& parameters);
+                                  ScoLinkParameters const& parameters,
+                                  std::function<AsyncTaskId()> startStream);
   bool AcceptPendingScoConnection(bluetooth::hci::Address addr,
-                                  ScoConnectionParameters const& parameters);
+                                  ScoConnectionParameters const& parameters,
+                                  std::function<AsyncTaskId()> startStream);
   uint16_t GetScoHandle(bluetooth::hci::Address addr) const;
   ScoConnectionParameters GetScoConnectionParameters(
       bluetooth::hci::Address addr) const;
@@ -67,8 +76,9 @@
   uint16_t CreateConnection(bluetooth::hci::Address addr,
                             bluetooth::hci::Address own_addr);
   uint16_t CreateLeConnection(bluetooth::hci::AddressWithType addr,
-                              bluetooth::hci::AddressWithType own_addr);
-  bool Disconnect(uint16_t handle);
+                              bluetooth::hci::AddressWithType own_addr,
+                              bluetooth::hci::Role role);
+  bool Disconnect(uint16_t handle, std::function<void(AsyncTaskId)> stopStream);
   bool HasHandle(uint16_t handle) const;
   bool HasScoHandle(uint16_t handle) const;
 
@@ -84,6 +94,12 @@
 
   Phy::Type GetPhyType(uint16_t handle) const;
 
+  uint16_t GetAclLinkPolicySettings(uint16_t handle) const;
+  void SetAclLinkPolicySettings(uint16_t handle, uint16_t settings);
+
+  bluetooth::hci::Role GetAclRole(uint16_t handle) const;
+  void SetAclRole(uint16_t handle, bluetooth::hci::Role role);
+
   std::unique_ptr<bluetooth::hci::LeSetCigParametersCompleteBuilder>
   SetCigParameters(uint8_t id, uint32_t sdu_interval_m_to_s,
                    uint32_t sdu_interval_s_to_m,
@@ -124,10 +140,21 @@
 
   std::vector<uint16_t> GetAclHandles() const;
 
+  void ResetLinkTimer(uint16_t handle);
+  std::chrono::steady_clock::duration TimeUntilLinkNearExpiring(
+      uint16_t handle) const;
+  bool IsLinkNearExpiring(uint16_t handle) const;
+  std::chrono::steady_clock::duration TimeUntilLinkExpired(
+      uint16_t handle) const;
+  bool HasLinkExpired(uint16_t handle) const;
+
  private:
   std::unordered_map<uint16_t, AclConnection> acl_connections_;
   std::unordered_map<uint16_t, ScoConnection> sco_connections_;
 
+  std::function<AsyncTaskId(std::chrono::milliseconds, const TaskCallback&)>
+      schedule_task_;
+
   bool classic_connection_pending_{false};
   bluetooth::hci::Address pending_connection_address_{
       bluetooth::hci::Address::kEmpty};
diff --git a/tools/rootcanal/model/controller/controller_properties.cc b/tools/rootcanal/model/controller/controller_properties.cc
new file mode 100644
index 0000000..2171351
--- /dev/null
+++ b/tools/rootcanal/model/controller/controller_properties.cc
@@ -0,0 +1,651 @@
+/*
+ * Copyright 2015 The Android Open Source Project
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "controller_properties.h"
+
+#include <inttypes.h>
+#include <json/json.h>
+
+#include <fstream>
+#include <limits>
+#include <memory>
+
+#include "log.h"
+
+namespace rootcanal {
+using namespace bluetooth::hci;
+
+static constexpr uint64_t Page0LmpFeatures() {
+  LMPFeaturesPage0Bits features[] = {
+      LMPFeaturesPage0Bits::LMP_3_SLOT_PACKETS,
+      LMPFeaturesPage0Bits::LMP_5_SLOT_PACKETS,
+      LMPFeaturesPage0Bits::ENCRYPTION,
+      LMPFeaturesPage0Bits::SLOT_OFFSET,
+      LMPFeaturesPage0Bits::TIMING_ACCURACY,
+      LMPFeaturesPage0Bits::ROLE_SWITCH,
+      LMPFeaturesPage0Bits::HOLD_MODE,
+      LMPFeaturesPage0Bits::SNIFF_MODE,
+      LMPFeaturesPage0Bits::POWER_CONTROL_REQUESTS,
+      LMPFeaturesPage0Bits::CHANNEL_QUALITY_DRIVEN_DATA_RATE,
+      LMPFeaturesPage0Bits::SCO_LINK,
+      LMPFeaturesPage0Bits::HV2_PACKETS,
+      LMPFeaturesPage0Bits::HV3_PACKETS,
+      LMPFeaturesPage0Bits::M_LAW_LOG_SYNCHRONOUS_DATA,
+      LMPFeaturesPage0Bits::A_LAW_LOG_SYNCHRONOUS_DATA,
+      LMPFeaturesPage0Bits::CVSD_SYNCHRONOUS_DATA,
+      LMPFeaturesPage0Bits::PAGING_PARAMETER_NEGOTIATION,
+      LMPFeaturesPage0Bits::POWER_CONTROL,
+      LMPFeaturesPage0Bits::TRANSPARENT_SYNCHRONOUS_DATA,
+      LMPFeaturesPage0Bits::BROADCAST_ENCRYPTION,
+      LMPFeaturesPage0Bits::ENHANCED_DATA_RATE_ACL_2_MB_S_MODE,
+      LMPFeaturesPage0Bits::ENHANCED_DATA_RATE_ACL_3_MB_S_MODE,
+      LMPFeaturesPage0Bits::ENHANCED_INQUIRY_SCAN,
+      LMPFeaturesPage0Bits::INTERLACED_INQUIRY_SCAN,
+      LMPFeaturesPage0Bits::INTERLACED_PAGE_SCAN,
+      LMPFeaturesPage0Bits::RSSI_WITH_INQUIRY_RESULTS,
+      LMPFeaturesPage0Bits::EXTENDED_SCO_LINK,
+      LMPFeaturesPage0Bits::EV4_PACKETS,
+      LMPFeaturesPage0Bits::EV5_PACKETS,
+      LMPFeaturesPage0Bits::AFH_CAPABLE_PERIPHERAL,
+      LMPFeaturesPage0Bits::AFH_CLASSIFICATION_PERIPHERAL,
+      LMPFeaturesPage0Bits::LE_SUPPORTED_CONTROLLER,
+      LMPFeaturesPage0Bits::LMP_3_SLOT_ENHANCED_DATA_RATE_ACL_PACKETS,
+      LMPFeaturesPage0Bits::LMP_5_SLOT_ENHANCED_DATA_RATE_ACL_PACKETS,
+      LMPFeaturesPage0Bits::SNIFF_SUBRATING,
+      LMPFeaturesPage0Bits::PAUSE_ENCRYPTION,
+      LMPFeaturesPage0Bits::AFH_CAPABLE_CENTRAL,
+      LMPFeaturesPage0Bits::AFH_CLASSIFICATION_CENTRAL,
+      LMPFeaturesPage0Bits::ENHANCED_DATA_RATE_ESCO_2_MB_S_MODE,
+      LMPFeaturesPage0Bits::ENHANCED_DATA_RATE_ESCO_3_MB_S_MODE,
+      LMPFeaturesPage0Bits::LMP_3_SLOT_ENHANCED_DATA_RATE_ESCO_PACKETS,
+      LMPFeaturesPage0Bits::EXTENDED_INQUIRY_RESPONSE,
+      LMPFeaturesPage0Bits::SIMULTANEOUS_LE_AND_BR_CONTROLLER,
+      LMPFeaturesPage0Bits::SECURE_SIMPLE_PAIRING_CONTROLLER,
+      LMPFeaturesPage0Bits::ENCAPSULATED_PDU,
+      LMPFeaturesPage0Bits::HCI_LINK_SUPERVISION_TIMEOUT_CHANGED_EVENT,
+      LMPFeaturesPage0Bits::VARIABLE_INQUIRY_TX_POWER_LEVEL,
+      LMPFeaturesPage0Bits::ENHANCED_POWER_CONTROL,
+      LMPFeaturesPage0Bits::EXTENDED_FEATURES};
+
+  uint64_t value = 0;
+  for (auto feature : features) {
+    value |= static_cast<uint64_t>(feature);
+  }
+  return value;
+}
+
+static constexpr uint64_t Page2LmpFeatures() {
+  LMPFeaturesPage2Bits features[] = {
+      LMPFeaturesPage2Bits::SECURE_CONNECTIONS_CONTROLLER_SUPPORT,
+      LMPFeaturesPage2Bits::PING,
+  };
+
+  uint64_t value = 0;
+  for (auto feature : features) {
+    value |= static_cast<uint64_t>(feature);
+  }
+  return value;
+}
+
+static constexpr uint64_t LlFeatures() {
+  LLFeaturesBits features[] = {
+      LLFeaturesBits::LE_ENCRYPTION,
+      LLFeaturesBits::CONNECTION_PARAMETERS_REQUEST_PROCEDURE,
+      LLFeaturesBits::EXTENDED_REJECT_INDICATION,
+      LLFeaturesBits::PERIPHERAL_INITIATED_FEATURES_EXCHANGE,
+      LLFeaturesBits::LE_PING,
+
+      LLFeaturesBits::EXTENDED_SCANNER_FILTER_POLICIES,
+      LLFeaturesBits::LE_EXTENDED_ADVERTISING,
+
+      // TODO: breaks AVD boot tests with LE audio
+      // LLFeaturesBits::CONNECTED_ISOCHRONOUS_STREAM_CENTRAL,
+      // LLFeaturesBits::CONNECTED_ISOCHRONOUS_STREAM_PERIPHERAL,
+  };
+
+  uint64_t value = 0;
+  for (auto feature : features) {
+    value |= static_cast<uint64_t>(feature);
+  }
+  return value;
+}
+
+template <typename T>
+static bool ParseUint(Json::Value root, std::string field_name,
+                      T& output_value) {
+  T max_value = std::numeric_limits<T>::max();
+  Json::Value value = root[field_name];
+
+  if (value.isString()) {
+    unsigned long long parsed_value = std::stoull(value.asString(), nullptr, 0);
+    if (parsed_value > max_value) {
+      LOG_INFO("invalid value for %s is discarded: %llu > %llu",
+               field_name.c_str(), parsed_value,
+               static_cast<unsigned long long>(max_value));
+      return false;
+    } else {
+      output_value = static_cast<T>(parsed_value);
+      return true;
+    }
+  }
+
+  return false;
+}
+
+template <typename T, std::size_t N>
+static bool ParseUintArray(Json::Value root, std::string field_name,
+                           std::array<T, N>& output_value) {
+  T max_value = std::numeric_limits<T>::max();
+  Json::Value value = root[field_name];
+
+  if (value.empty()) {
+    return false;
+  }
+
+  if (!value.isArray()) {
+    LOG_INFO("invalid value for %s is discarded: not an array",
+             field_name.c_str());
+    return false;
+  }
+
+  if (value.size() != N) {
+    LOG_INFO(
+        "invalid value for %s is discarded: incorrect size %u, expected %zu",
+        field_name.c_str(), value.size(), N);
+    return false;
+  }
+
+  for (size_t n = 0; n < N; n++) {
+    unsigned long long parsed_value =
+        std::stoull(value[static_cast<int>(n)].asString(), nullptr, 0);
+    if (parsed_value > max_value) {
+      LOG_INFO("invalid value for %s[%zu] is discarded: %llu > %llu",
+               field_name.c_str(), n, parsed_value,
+               static_cast<unsigned long long>(max_value));
+    } else {
+      output_value[n] = parsed_value;
+    }
+  }
+
+  return false;
+}
+
+template <typename T>
+static bool ParseUintVector(Json::Value root, std::string field_name,
+                            std::vector<T>& output_value) {
+  T max_value = std::numeric_limits<T>::max();
+  Json::Value value = root[field_name];
+
+  if (value.empty()) {
+    return false;
+  }
+
+  if (!value.isArray()) {
+    LOG_INFO("invalid value for %s is discarded: not an array",
+             field_name.c_str());
+    return false;
+  }
+
+  output_value.clear();
+  for (size_t n = 0; n < value.size(); n++) {
+    unsigned long long parsed_value =
+        std::stoull(value[static_cast<int>(n)].asString(), nullptr, 0);
+    if (parsed_value > max_value) {
+      LOG_INFO("invalid value for %s[%zu] is discarded: %llu > %llu",
+               field_name.c_str(), n, parsed_value,
+               static_cast<unsigned long long>(max_value));
+    } else {
+      output_value.push_back(parsed_value);
+    }
+  }
+
+  return false;
+}
+
+static void ParseHex64(Json::Value value, uint64_t* field) {
+  if (value.isString()) {
+    size_t end_char = 0;
+    uint64_t parsed = std::stoll(value.asString(), &end_char, 16);
+    if (end_char > 0) {
+      *field = parsed;
+    }
+  }
+}
+
+ControllerProperties::ControllerProperties(const std::string& file_name)
+    : lmp_features({Page0LmpFeatures(), 0, Page2LmpFeatures()}),
+      le_features(LlFeatures()) {
+  // Set support for all HCI commands by default.
+  // The controller will update the mask with its implemented commands
+  // after the creation of the properties.
+  for (int i = 0; i < 47; i++) {
+    supported_commands[i] = 0xff;
+  }
+
+  // Mark reserved commands as unsupported.
+  for (int i = 47; i < 64; i++) {
+    supported_commands[i] = 0x00;
+  }
+
+  if (!CheckSupportedFeatures()) {
+    LOG_INFO(
+        "Warning: initial LMP and/or LE are not consistent. Please make sure"
+        " that the features are correct w.r.t. the rules described"
+        " in Vol 2, Part C 3.5 Feature requirements");
+  }
+
+  if (file_name.empty()) {
+    return;
+  }
+
+  LOG_INFO("Reading controller properties from %s.", file_name.c_str());
+
+  std::ifstream file(file_name);
+
+  Json::Value root;
+  Json::CharReaderBuilder builder;
+
+  std::string errs;
+  if (!Json::parseFromStream(builder, file, &root, &errs)) {
+    LOG_ERROR("Error reading controller properties from file: %s error: %s",
+              file_name.c_str(), errs.c_str());
+    return;
+  }
+
+  // Legacy configuration options.
+
+  ParseUint(root, "AclDataPacketSize", acl_data_packet_length);
+  ParseUint(root, "ScoDataPacketSize", sco_data_packet_length);
+  ParseUint(root, "NumAclDataPackets", total_num_acl_data_packets);
+  ParseUint(root, "NumScoDataPackets", total_num_sco_data_packets);
+
+  uint8_t hci_version = static_cast<uint8_t>(this->hci_version);
+  uint8_t lmp_version = static_cast<uint8_t>(this->lmp_version);
+  ParseUint(root, "Version", hci_version);
+  ParseUint(root, "Revision", hci_subversion);
+  ParseUint(root, "LmpPalVersion", lmp_version);
+  ParseUint(root, "LmpPalSubversion", lmp_subversion);
+  ParseUint(root, "ManufacturerName", company_identifier);
+
+  ParseHex64(root["LeSupportedFeatures"], &le_features);
+
+  // Configuration options.
+
+  ParseUint(root, "hci_version", hci_version);
+  ParseUint(root, "lmp_version", lmp_version);
+  ParseUint(root, "hci_subversion", hci_subversion);
+  ParseUint(root, "lmp_subversion", lmp_subversion);
+  ParseUint(root, "company_identifier", company_identifier);
+
+  ParseUintArray(root, "supported_commands", supported_commands);
+  ParseUintArray(root, "lmp_features", lmp_features);
+  ParseUint(root, "le_features", le_features);
+
+  ParseUint(root, "acl_data_packet_length", acl_data_packet_length);
+  ParseUint(root, "sco_data_packet_length ", sco_data_packet_length);
+  ParseUint(root, "total_num_acl_data_packets ", total_num_acl_data_packets);
+  ParseUint(root, "total_num_sco_data_packets ", total_num_sco_data_packets);
+  ParseUint(root, "le_acl_data_packet_length ", le_acl_data_packet_length);
+  ParseUint(root, "iso_data_packet_length ", iso_data_packet_length);
+  ParseUint(root, "total_num_le_acl_data_packets ",
+            total_num_le_acl_data_packets);
+  ParseUint(root, "total_num_iso_data_packets ", total_num_iso_data_packets);
+  ParseUint(root, "num_supported_iac", num_supported_iac);
+  ParseUint(root, "le_advertising_physical_channel_tx_power",
+            le_advertising_physical_channel_tx_power);
+
+  ParseUintArray(root, "lmp_features", lmp_features);
+  ParseUintVector(root, "supported_standard_codecs", supported_standard_codecs);
+  ParseUintVector(root, "supported_vendor_specific_codecs",
+                  supported_vendor_specific_codecs);
+
+  ParseUint(root, "le_filter_accept_list_size", le_filter_accept_list_size);
+  ParseUint(root, "le_resolving_list_size", le_resolving_list_size);
+  ParseUint(root, "le_supported_states", le_supported_states);
+
+  ParseUint(root, "le_max_advertising_data_length",
+            le_max_advertising_data_length);
+  ParseUint(root, "le_num_supported_advertising_sets",
+            le_num_supported_advertising_sets);
+
+  ParseUintVector(root, "le_vendor_capabilities", le_vendor_capabilities);
+
+  this->hci_version = static_cast<HciVersion>(hci_version);
+  this->lmp_version = static_cast<LmpVersion>(lmp_version);
+
+  if (!CheckSupportedFeatures()) {
+    LOG_INFO(
+        "Warning: the LMP and/or LE are not consistent. Please make sure"
+        " that the features are correct w.r.t. the rules described"
+        " in Vol 2, Part C 3.5 Feature requirements");
+  } else {
+    LOG_INFO("LMP and LE features successfully validated");
+  }
+}
+
+void ControllerProperties::SetSupportedCommands(
+    std::array<uint8_t, 64> supported_commands) {
+  for (size_t i = 0; i < this->supported_commands.size(); i++) {
+    this->supported_commands[i] &= supported_commands[i];
+  }
+}
+
+bool ControllerProperties::CheckSupportedFeatures() const {
+  // Vol 2, Part C § 3.3 Feature mask definition.
+  // Check for reserved or deprecated feature bits.
+  //
+  // Note: the specification for v1.0 and v1.1 is no longer available for
+  // download, the reserved feature bits are copied over from v1.2.
+  uint64_t lmp_page_0_reserved_bits = 0;
+  uint64_t lmp_page_2_reserved_bits = 0;
+  switch (lmp_version) {
+    case bluetooth::hci::LmpVersion::V_1_0B:
+      lmp_page_0_reserved_bits = UINT64_C(0x7fffe7e407000000);
+      lmp_page_2_reserved_bits = UINT64_C(0xffffffffffffffff);
+      break;
+    case bluetooth::hci::LmpVersion::V_1_1:
+      lmp_page_0_reserved_bits = UINT64_C(0x7fffe7e407000000);
+      lmp_page_2_reserved_bits = UINT64_C(0xffffffffffffffff);
+      break;
+    case bluetooth::hci::LmpVersion::V_1_2:
+      lmp_page_0_reserved_bits = UINT64_C(0x7fffe7e407000000);
+      lmp_page_2_reserved_bits = UINT64_C(0xffffffffffffffff);
+      break;
+    case bluetooth::hci::LmpVersion::V_2_0:
+      lmp_page_0_reserved_bits = UINT64_C(0x7fff066401000000);
+      lmp_page_2_reserved_bits = UINT64_C(0xffffffffffffffff);
+      break;
+    case bluetooth::hci::LmpVersion::V_2_1:
+      lmp_page_0_reserved_bits = UINT64_C(0x7c86006401000000);
+      lmp_page_2_reserved_bits = UINT64_C(0xffffffffffffffff);
+      break;
+    case bluetooth::hci::LmpVersion::V_3_0:
+      lmp_page_0_reserved_bits = UINT64_C(0x7886006401000000);
+      lmp_page_2_reserved_bits = UINT64_C(0xffffffffffffffff);
+      break;
+    case bluetooth::hci::LmpVersion::V_4_0:
+      lmp_page_0_reserved_bits = UINT64_C(0x7884000401000000);
+      lmp_page_2_reserved_bits = UINT64_C(0xffffffffffffffff);
+      break;
+    case bluetooth::hci::LmpVersion::V_4_1:
+      lmp_page_0_reserved_bits = UINT64_C(0x7884000401000000);
+      lmp_page_2_reserved_bits = UINT64_C(0xfffffffffffff480);
+      break;
+    case bluetooth::hci::LmpVersion::V_4_2:
+      lmp_page_0_reserved_bits = UINT64_C(0x7884000401000000);
+      lmp_page_2_reserved_bits = UINT64_C(0xfffffffffffff480);
+      break;
+    case bluetooth::hci::LmpVersion::V_5_0:
+      lmp_page_0_reserved_bits = UINT64_C(0x7884000401000100);
+      lmp_page_2_reserved_bits = UINT64_C(0xfffffffffffff480);
+      break;
+    case bluetooth::hci::LmpVersion::V_5_1:
+      lmp_page_0_reserved_bits = UINT64_C(0x7884000401000100);
+      lmp_page_2_reserved_bits = UINT64_C(0xfffffffffffff080);
+      break;
+    case bluetooth::hci::LmpVersion::V_5_2:
+      lmp_page_0_reserved_bits = UINT64_C(0x7884000401000100);
+      lmp_page_2_reserved_bits = UINT64_C(0xfffffffffffff080);
+      break;
+    case bluetooth::hci::LmpVersion::V_5_3:
+    default:
+      lmp_page_0_reserved_bits = UINT64_C(0x7884000401000100);
+      lmp_page_2_reserved_bits = UINT64_C(0xfffffffffffff080);
+      break;
+  };
+
+  if ((lmp_page_0_reserved_bits & lmp_features[0]) != 0) {
+    LOG_INFO("The page 0 feature bits 0x%016" PRIx64
+             " are reserved in the specification %s",
+             lmp_page_0_reserved_bits & lmp_features[0],
+             LmpVersionText(lmp_version).c_str());
+    return false;
+  }
+
+  if ((lmp_page_2_reserved_bits & lmp_features[2]) != 0) {
+    LOG_INFO("The page 2 feature bits 0x%016" PRIx64
+             " are reserved in the specification %s",
+             lmp_page_2_reserved_bits & lmp_features[2],
+             LmpVersionText(lmp_version).c_str());
+    return false;
+  }
+
+  // Vol 2, Part C § 3.5 Feature requirements.
+  // RootCanal always support BR/EDR mode, this function implements
+  // the feature requirements from the subsection 1. Devices supporting BR/EDR.
+  //
+  // Note: the feature requirements were introduced in version v5.1 of the
+  // specification, for previous versions it is assumed that the same
+  // requirements apply for the subset of defined feature bits.
+
+  // The features listed in Table 3.5 are mandatory in this version of the
+  // specification (see Section 3.1) and these feature bits shall be set.
+  if (!SupportsLMPFeature(LMPFeaturesPage0Bits::ENCRYPTION) ||
+      !SupportsLMPFeature(
+          LMPFeaturesPage0Bits::SECURE_SIMPLE_PAIRING_CONTROLLER) ||
+      !SupportsLMPFeature(LMPFeaturesPage0Bits::ENCAPSULATED_PDU)) {
+    LOG_INFO("Table 3.5 validation failed");
+    return false;
+  }
+
+  // The features listed in Table 3.6 are forbidden in this version of the
+  // specification and these feature bits shall not be set.
+  if (SupportsLMPFeature(LMPFeaturesPage0Bits::BR_EDR_NOT_SUPPORTED)) {
+    LOG_INFO("Table 3.6 validation failed");
+    return false;
+  }
+
+  // For each row of Table 3.7, either every feature named in that row shall be
+  // supported or none of the features named in that row shall be supported.
+  if (SupportsLMPFeature(LMPFeaturesPage0Bits::SNIFF_MODE) !=
+      SupportsLMPFeature(LMPFeaturesPage0Bits::SNIFF_SUBRATING)) {
+    LOG_INFO("Table 3.7 validation failed");
+    return false;
+  }
+
+  // For each row of Table 3.8, not more than one feature in that row shall be
+  // supported.
+  if (SupportsLMPFeature(LMPFeaturesPage0Bits::BROADCAST_ENCRYPTION) &&
+      SupportsLMPFeature(LMPFeaturesPage2Bits::COARSE_CLOCK_ADJUSTMENT)) {
+    LOG_INFO("Table 3.8 validation failed");
+    return false;
+  }
+
+  // For each row of Table 3.9, if the feature named in the first column is
+  // supported then the feature named in the second column shall be supported.
+  if (SupportsLMPFeature(LMPFeaturesPage0Bits::ROLE_SWITCH) &&
+      !SupportsLMPFeature(LMPFeaturesPage0Bits::SLOT_OFFSET)) {
+    LOG_INFO("Table 3.9 validation failed; expected Slot Offset");
+    return false;
+  }
+  if (SupportsLMPFeature(LMPFeaturesPage0Bits::HV2_PACKETS) &&
+      !SupportsLMPFeature(LMPFeaturesPage0Bits::SCO_LINK)) {
+    LOG_INFO("Table 3.9 validation failed; expected Sco Link");
+    return false;
+  }
+  if (SupportsLMPFeature(LMPFeaturesPage0Bits::HV3_PACKETS) &&
+      !SupportsLMPFeature(LMPFeaturesPage0Bits::SCO_LINK)) {
+    LOG_INFO("Table 3.9 validation failed; expected Sco Link");
+    return false;
+  }
+  if (SupportsLMPFeature(LMPFeaturesPage0Bits::M_LAW_LOG_SYNCHRONOUS_DATA) &&
+      !SupportsLMPFeature(LMPFeaturesPage0Bits::SCO_LINK) &&
+      !SupportsLMPFeature(LMPFeaturesPage0Bits::EXTENDED_SCO_LINK)) {
+    LOG_INFO(
+        "Table 3.9 validation failed; expected Sco Link or Extended Sco Link");
+    return false;
+  }
+  if (SupportsLMPFeature(LMPFeaturesPage0Bits::A_LAW_LOG_SYNCHRONOUS_DATA) &&
+      !SupportsLMPFeature(LMPFeaturesPage0Bits::SCO_LINK) &&
+      !SupportsLMPFeature(LMPFeaturesPage0Bits::EXTENDED_SCO_LINK)) {
+    LOG_INFO(
+        "Table 3.9 validation failed; expected Sco Link or Extended Sco Link");
+    return false;
+  }
+  if (SupportsLMPFeature(LMPFeaturesPage0Bits::CVSD_SYNCHRONOUS_DATA) &&
+      !SupportsLMPFeature(LMPFeaturesPage0Bits::SCO_LINK) &&
+      !SupportsLMPFeature(LMPFeaturesPage0Bits::EXTENDED_SCO_LINK)) {
+    LOG_INFO(
+        "Table 3.9 validation failed; expected Sco Link or Extended Sco Link");
+    return false;
+  }
+  if (SupportsLMPFeature(LMPFeaturesPage0Bits::TRANSPARENT_SYNCHRONOUS_DATA) &&
+      !SupportsLMPFeature(LMPFeaturesPage0Bits::SCO_LINK) &&
+      !SupportsLMPFeature(LMPFeaturesPage0Bits::EXTENDED_SCO_LINK)) {
+    LOG_INFO(
+        "Table 3.9 validation failed; expected Sco Link or Extended Sco Link");
+    return false;
+  }
+  if (SupportsLMPFeature(
+          LMPFeaturesPage0Bits::ENHANCED_DATA_RATE_ACL_3_MB_S_MODE) &&
+      !SupportsLMPFeature(
+          LMPFeaturesPage0Bits::ENHANCED_DATA_RATE_ACL_2_MB_S_MODE)) {
+    LOG_INFO(
+        "Table 3.9 validation failed; expected Enhanced Data Rate ACL 2Mb/s "
+        "mode");
+    return false;
+  }
+  if (SupportsLMPFeature(LMPFeaturesPage0Bits::EV4_PACKETS) &&
+      !SupportsLMPFeature(LMPFeaturesPage0Bits::EXTENDED_SCO_LINK)) {
+    LOG_INFO("Table 3.9 validation failed; expected Extended Sco Link");
+    return false;
+  }
+  if (SupportsLMPFeature(LMPFeaturesPage0Bits::EV5_PACKETS) &&
+      !SupportsLMPFeature(LMPFeaturesPage0Bits::EXTENDED_SCO_LINK)) {
+    LOG_INFO("Table 3.9 validation failed; expected Extended Sco Link");
+    return false;
+  }
+  if (SupportsLMPFeature(LMPFeaturesPage0Bits::AFH_CLASSIFICATION_PERIPHERAL) &&
+      !SupportsLMPFeature(LMPFeaturesPage0Bits::AFH_CAPABLE_PERIPHERAL)) {
+    LOG_INFO("Table 3.9 validation failed; expected AFH Capable Peripheral");
+    return false;
+  }
+  if (SupportsLMPFeature(
+          LMPFeaturesPage0Bits::LMP_3_SLOT_ENHANCED_DATA_RATE_ACL_PACKETS) &&
+      !SupportsLMPFeature(
+          LMPFeaturesPage0Bits::ENHANCED_DATA_RATE_ACL_2_MB_S_MODE)) {
+    LOG_INFO(
+        "Table 3.9 validation failed; expected Enhanced Data Rate ACL 2Mb/s "
+        "mode");
+    return false;
+  }
+  if (SupportsLMPFeature(
+          LMPFeaturesPage0Bits::LMP_5_SLOT_ENHANCED_DATA_RATE_ACL_PACKETS) &&
+      !SupportsLMPFeature(
+          LMPFeaturesPage0Bits::ENHANCED_DATA_RATE_ACL_2_MB_S_MODE)) {
+    LOG_INFO(
+        "Table 3.9 validation failed; expected Enhanced Data Rate ACL 2Mb/s "
+        "mode");
+    return false;
+  }
+  if (SupportsLMPFeature(LMPFeaturesPage0Bits::AFH_CLASSIFICATION_CENTRAL) &&
+      !SupportsLMPFeature(LMPFeaturesPage0Bits::AFH_CAPABLE_CENTRAL)) {
+    LOG_INFO("Table 3.9 validation failed; expected AFH Capable Central");
+    return false;
+  }
+  if (SupportsLMPFeature(
+          LMPFeaturesPage0Bits::ENHANCED_DATA_RATE_ESCO_2_MB_S_MODE) &&
+      !SupportsLMPFeature(LMPFeaturesPage0Bits::EXTENDED_SCO_LINK)) {
+    LOG_INFO("Table 3.9 validation failed; expected Extended Sco Link");
+    return false;
+  }
+  if (SupportsLMPFeature(
+          LMPFeaturesPage0Bits::ENHANCED_DATA_RATE_ESCO_3_MB_S_MODE) &&
+      !SupportsLMPFeature(
+          LMPFeaturesPage0Bits::ENHANCED_DATA_RATE_ESCO_2_MB_S_MODE)) {
+    LOG_INFO(
+        "Table 3.9 validation failed; expected Enhanced Data Rate eSCO 2Mb/s "
+        "mode");
+    return false;
+  }
+  if (SupportsLMPFeature(
+          LMPFeaturesPage0Bits::LMP_3_SLOT_ENHANCED_DATA_RATE_ESCO_PACKETS) &&
+      !SupportsLMPFeature(
+          LMPFeaturesPage0Bits::ENHANCED_DATA_RATE_ESCO_2_MB_S_MODE)) {
+    LOG_INFO(
+        "Table 3.9 validation failed; expected Enhanced Data Rate eSCO 2Mb/s "
+        "mode");
+    return false;
+  }
+  if (SupportsLMPFeature(LMPFeaturesPage0Bits::EXTENDED_INQUIRY_RESPONSE) &&
+      !SupportsLMPFeature(LMPFeaturesPage0Bits::RSSI_WITH_INQUIRY_RESULTS)) {
+    LOG_INFO("Table 3.9 validation failed; expected RSSI with Inquiry Results");
+    return false;
+  }
+  if (SupportsLMPFeature(
+          LMPFeaturesPage0Bits::SIMULTANEOUS_LE_AND_BR_CONTROLLER) &&
+      !SupportsLMPFeature(LMPFeaturesPage0Bits::LE_SUPPORTED_CONTROLLER)) {
+    LOG_INFO("Table 3.9 validation failed; expected LE Supported (Controller)");
+    return false;
+  }
+  if (SupportsLMPFeature(LMPFeaturesPage0Bits::ERRONEOUS_DATA_REPORTING) &&
+      !SupportsLMPFeature(LMPFeaturesPage0Bits::SCO_LINK) &&
+      !SupportsLMPFeature(LMPFeaturesPage0Bits::EXTENDED_SCO_LINK)) {
+    LOG_INFO(
+        "Table 3.9 validation failed; expected Sco Link or Extended Sco Link");
+    return false;
+  }
+  if (SupportsLMPFeature(LMPFeaturesPage0Bits::ENHANCED_POWER_CONTROL) &&
+      (!SupportsLMPFeature(LMPFeaturesPage0Bits::POWER_CONTROL_REQUESTS) ||
+       !SupportsLMPFeature(LMPFeaturesPage0Bits::POWER_CONTROL))) {
+    LOG_INFO(
+        "Table 3.9 validation failed; expected Power Control Request and Power "
+        "Control");
+    return false;
+  }
+  if (SupportsLMPFeature(
+          LMPFeaturesPage2Bits::
+              CONNECTIONLESS_PERIPHERAL_BROADCAST_TRANSMITTER_OPERATION) &&
+      !SupportsLMPFeature(LMPFeaturesPage2Bits::SYNCHRONIZATION_TRAIN)) {
+    LOG_INFO("Table 3.9 validation failed; expected Synchronization Train");
+    return false;
+  }
+  if (SupportsLMPFeature(
+          LMPFeaturesPage2Bits::
+              CONNECTIONLESS_PERIPHERAL_BROADCAST_RECEIVER_OPERATION) &&
+      !SupportsLMPFeature(LMPFeaturesPage2Bits::SYNCHRONIZATION_SCAN)) {
+    LOG_INFO("Table 3.9 validation failed; expected Synchronization Scan");
+    return false;
+  }
+  if (SupportsLMPFeature(LMPFeaturesPage2Bits::GENERALIZED_INTERLACED_SCAN) &&
+      !SupportsLMPFeature(LMPFeaturesPage0Bits::INTERLACED_INQUIRY_SCAN) &&
+      !SupportsLMPFeature(LMPFeaturesPage0Bits::INTERLACED_PAGE_SCAN)) {
+    LOG_INFO(
+        "Table 3.9 validation failed; expected Interlaced Inquiry Scan or "
+        "Interlaced Page Scan");
+    return false;
+  }
+  if (SupportsLMPFeature(LMPFeaturesPage2Bits::COARSE_CLOCK_ADJUSTMENT) &&
+      (!SupportsLMPFeature(LMPFeaturesPage0Bits::AFH_CAPABLE_PERIPHERAL) ||
+       !SupportsLMPFeature(LMPFeaturesPage0Bits::AFH_CAPABLE_CENTRAL) ||
+       !SupportsLMPFeature(LMPFeaturesPage2Bits::SYNCHRONIZATION_TRAIN) ||
+       !SupportsLMPFeature(LMPFeaturesPage2Bits::SYNCHRONIZATION_SCAN))) {
+    LOG_INFO(
+        "Table 3.9 validation failed; expected AFH Capable Central/Peripheral "
+        "and Synchronization Train/Scan");
+    return false;
+  }
+  if (SupportsLMPFeature(
+          LMPFeaturesPage2Bits::SECURE_CONNECTIONS_CONTROLLER_SUPPORT) &&
+      (!SupportsLMPFeature(LMPFeaturesPage0Bits::PAUSE_ENCRYPTION) ||
+       !SupportsLMPFeature(LMPFeaturesPage2Bits::PING))) {
+    LOG_INFO("Table 3.9 validation failed; expected Pause Encryption and Ping");
+    return false;
+  }
+
+  return true;
+}
+
+}  // namespace rootcanal
diff --git a/tools/rootcanal/model/controller/controller_properties.h b/tools/rootcanal/model/controller/controller_properties.h
new file mode 100644
index 0000000..04e6b99
--- /dev/null
+++ b/tools/rootcanal/model/controller/controller_properties.h
@@ -0,0 +1,124 @@
+/*
+ * Copyright 2015 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include <array>
+#include <cstdint>
+#include <optional>
+#include <string>
+#include <vector>
+
+#include "hci/address.h"
+#include "hci/hci_packets.h"
+
+namespace rootcanal {
+using bluetooth::hci::HciVersion;
+using bluetooth::hci::LmpVersion;
+
+// Local controller information.
+//
+// Provide the Informational Parameters returned by HCI commands
+// in the range of the same name (cf. [4] E.7.4).
+// The informational parameters are fixed by the manufacturer of the Bluetooth
+// hardware. These parameters provide information about the BR/EDR Controller
+// and the capabilities of the Link Manager and Baseband in the BR/EDR
+// Controller. The Host device cannot modify any of these parameters.
+struct ControllerProperties {
+ public:
+  explicit ControllerProperties(const std::string& filename = "");
+  ~ControllerProperties() = default;
+
+  // Perform a bitwise and operation on the supported commands mask;
+  // the default bit setting is either loaded from the configuration
+  // file or all 1s.
+  void SetSupportedCommands(std::array<uint8_t, 64> supported_commands);
+
+  // Check if the feature masks are valid according to the specification.
+  bool CheckSupportedFeatures() const;
+
+  // Local Version Information (Vol 4, Part E § 7.4.1).
+  HciVersion hci_version{HciVersion::V_5_3};
+  LmpVersion lmp_version{LmpVersion::V_5_3};
+  uint16_t hci_subversion{0};
+  uint16_t lmp_subversion{0};
+  uint16_t company_identifier{0x00E0};  // Google
+
+  // Local Supported Commands (Vol 4, Part E § 7.4.2).
+  std::array<uint8_t, 64> supported_commands;
+
+  // Local Supported Features (Vol 4, Part E § 7.4.3) and
+  // Local Extended Features (Vol 4, Part E § 7.4.3).
+  std::array<uint64_t, 3> lmp_features;
+
+  // LE Local Supported Features (Vol 4, Part E § 7.8.3).
+  uint64_t le_features;
+
+  // Buffer Size (Vol 4, Part E § 7.4.5).
+  uint16_t acl_data_packet_length{1024};
+  uint8_t sco_data_packet_length{255};
+  uint16_t total_num_acl_data_packets{10};
+  uint16_t total_num_sco_data_packets{10};
+
+  // LE Buffer Size (Vol 4, Part E § 7.8.2).
+  uint16_t le_acl_data_packet_length{27};
+  uint16_t iso_data_packet_length{1021};
+  uint8_t total_num_le_acl_data_packets{20};
+  uint8_t total_num_iso_data_packets{12};
+
+  // Number of Supported IAC (Vol 4, Part E § 7.3.43).
+  uint8_t num_supported_iac{4};
+
+  // LE Advertising Physical Channel TX Power (Vol 4, Part E § 7.8.6).
+  uint8_t le_advertising_physical_channel_tx_power{static_cast<uint8_t>(-10)};
+
+  // Supported Codecs (Vol 4, Part E § 7.4.8).
+  // Implements the [v1] version only.
+  std::vector<uint8_t> supported_standard_codecs{0};
+  std::vector<uint32_t> supported_vendor_specific_codecs{};
+
+  // LE Filter Accept List Size (Vol 4, Part E § 7.8.14).
+  uint8_t le_filter_accept_list_size{16};
+
+  // LE Resolving List Size (Vol 4, Part E § 7.8.41).
+  uint8_t le_resolving_list_size{16};
+
+  // LE Supported States (Vol 4, Part E § 7.8.27).
+  uint64_t le_supported_states{0x3ffffffffff};
+
+  // LE Maximum Advertising Data Length (Vol 4, Part E § 7.8.57).
+  // Note: valid range 0x001F to 0x0672.
+  uint16_t le_max_advertising_data_length{512};
+
+  // LE Number of Supported Advertising Sets (Vol 4, Part E § 7.8.58)
+  // Note: the controller can change the number of advertising sets
+  // at any time. This behaviour is not emulated here.
+  uint8_t le_num_supported_advertising_sets{8};
+
+  // Vendor Information.
+  // Provide parameters returned by vendor specific commands.
+  std::vector<uint8_t> le_vendor_capabilities{};
+
+  bool SupportsLMPFeature(bluetooth::hci::LMPFeaturesPage0Bits bit) const {
+    return (lmp_features[0] & static_cast<uint64_t>(bit)) != 0;
+  }
+
+  bool SupportsLMPFeature(bluetooth::hci::LMPFeaturesPage2Bits bit) const {
+    return (lmp_features[2] & static_cast<uint64_t>(bit)) != 0;
+  }
+};
+
+}  // namespace rootcanal
diff --git a/tools/rootcanal/model/controller/dual_mode_controller.cc b/tools/rootcanal/model/controller/dual_mode_controller.cc
index 2a83188..3a0445c 100644
--- a/tools/rootcanal/model/controller/dual_mode_controller.cc
+++ b/tools/rootcanal/model/controller/dual_mode_controller.cc
@@ -16,11 +16,12 @@
 
 #include "dual_mode_controller.h"
 
+#include <algorithm>
 #include <memory>
 #include <random>
 
 #include "crypto_toolbox/crypto_toolbox.h"
-#include "os/log.h"
+#include "log.h"
 #include "packet/raw_builder.h"
 
 namespace gd_hci = ::bluetooth::hci;
@@ -30,8 +31,6 @@
 using std::vector;
 
 namespace rootcanal {
-constexpr char DualModeController::kControllerPropertiesFile[];
-constexpr uint16_t DualModeController::kSecurityManagerNumKeys;
 constexpr uint16_t kNumCommandPackets = 0x01;
 constexpr uint16_t kLeMaximumAdvertisingDataLength = 256;
 constexpr uint16_t kLeMaximumDataLength = 64;
@@ -55,11 +54,11 @@
 }
 
 void DualModeController::SendCommandCompleteUnknownOpCodeEvent(
-    uint16_t command_opcode) const {
+    uint16_t op_code) const {
   std::unique_ptr<bluetooth::packet::RawBuilder> raw_builder_ptr =
       std::make_unique<bluetooth::packet::RawBuilder>();
   raw_builder_ptr->AddOctets1(kNumCommandPackets);
-  raw_builder_ptr->AddOctets2(command_opcode);
+  raw_builder_ptr->AddOctets2(op_code);
   raw_builder_ptr->AddOctets1(
       static_cast<uint8_t>(ErrorCode::UNKNOWN_HCI_COMMAND));
 
@@ -67,14 +66,20 @@
                                            std::move(raw_builder_ptr)));
 }
 
+#ifdef ROOTCANAL_LMP
+DualModeController::DualModeController(const std::string& properties_filename,
+                                       uint16_t)
+    : Device(), properties_(properties_filename) {
+#else
 DualModeController::DualModeController(const std::string& properties_filename,
                                        uint16_t num_keys)
-    : Device(properties_filename), security_manager_(num_keys) {
+    : Device(), properties_(properties_filename), security_manager_(num_keys) {
+#endif
   loopback_mode_ = LoopbackMode::NO_LOOPBACK;
 
   Address public_address{};
   ASSERT(Address::FromString("3C:5A:B4:04:05:06", public_address));
-  properties_.SetAddress(public_address);
+  SetAddress(public_address);
 
   link_layer_controller_.RegisterRemoteChannel(
       [this](std::shared_ptr<model::packets::LinkLayerPacketBuilder> packet,
@@ -82,16 +87,17 @@
         DualModeController::SendLinkLayerPacket(packet, phy_type);
       });
 
-  std::array<uint8_t, 64> supported_commands;
-  for (size_t i = 0; i < 64; i++) {
-    supported_commands[i] = 0;
-  }
+  std::array<uint8_t, 64> supported_commands{0};
 
 #define SET_HANDLER(name, method)                                  \
   active_hci_commands_[OpCode::name] = [this](CommandView param) { \
     method(std::move(param));                                      \
   };
 
+#define SET_VENDOR_HANDLER(op_code, method)                            \
+  active_hci_commands_[static_cast<bluetooth::hci::OpCode>(op_code)] = \
+      [this](CommandView param) { method(std::move(param)); };
+
 #define SET_SUPPORTED(name, method)                                        \
   SET_HANDLER(name, method);                                               \
   {                                                                        \
@@ -120,6 +126,10 @@
   SET_SUPPORTED(SETUP_SYNCHRONOUS_CONNECTION, SetupSynchronousConnection);
   SET_SUPPORTED(ACCEPT_SYNCHRONOUS_CONNECTION, AcceptSynchronousConnection);
   SET_SUPPORTED(REJECT_SYNCHRONOUS_CONNECTION, RejectSynchronousConnection);
+  SET_SUPPORTED(ENHANCED_SETUP_SYNCHRONOUS_CONNECTION,
+                EnhancedSetupSynchronousConnection);
+  SET_SUPPORTED(ENHANCED_ACCEPT_SYNCHRONOUS_CONNECTION,
+                EnhancedAcceptSynchronousConnection);
   SET_SUPPORTED(IO_CAPABILITY_REQUEST_REPLY, IoCapabilityRequestReply);
   SET_SUPPORTED(USER_CONFIRMATION_REQUEST_REPLY, UserConfirmationRequestReply);
   SET_SUPPORTED(USER_CONFIRMATION_REQUEST_NEGATIVE_REPLY,
@@ -139,6 +149,7 @@
   SET_SUPPORTED(READ_INQUIRY_RESPONSE_TRANSMIT_POWER_LEVEL,
                 ReadInquiryResponseTransmitPowerLevel);
   SET_SUPPORTED(SEND_KEYPRESS_NOTIFICATION, SendKeypressNotification);
+  SET_SUPPORTED(ENHANCED_FLUSH, EnhancedFlush);
   SET_HANDLER(SET_EVENT_MASK_PAGE_2, SetEventMaskPage2);
   SET_SUPPORTED(READ_LOCAL_OOB_DATA, ReadLocalOobData);
   SET_SUPPORTED(READ_LOCAL_OOB_EXTENDED_DATA, ReadLocalOobExtendedData);
@@ -173,6 +184,7 @@
   SET_SUPPORTED(WRITE_DEFAULT_LINK_POLICY_SETTINGS,
                 WriteDefaultLinkPolicySettings);
   SET_SUPPORTED(FLOW_SPECIFICATION, FlowSpecification);
+  SET_SUPPORTED(READ_LINK_POLICY_SETTINGS, ReadLinkPolicySettings);
   SET_SUPPORTED(WRITE_LINK_POLICY_SETTINGS, WriteLinkPolicySettings);
   SET_SUPPORTED(CHANGE_CONNECTION_PACKET_TYPE, ChangeConnectionPacketType);
   SET_SUPPORTED(WRITE_LOCAL_NAME, WriteLocalName);
@@ -216,7 +228,7 @@
   SET_SUPPORTED(CREATE_CONNECTION, CreateConnection);
   SET_SUPPORTED(CREATE_CONNECTION_CANCEL, CreateConnectionCancel);
   SET_SUPPORTED(DISCONNECT, Disconnect);
-  SET_SUPPORTED(LE_CREATE_CONNECTION_CANCEL, LeConnectionCancel);
+  SET_SUPPORTED(LE_CREATE_CONNECTION_CANCEL, LeCreateConnectionCancel);
   SET_SUPPORTED(LE_READ_FILTER_ACCEPT_LIST_SIZE, LeReadFilterAcceptListSize);
   SET_SUPPORTED(LE_CLEAR_FILTER_ACCEPT_LIST, LeClearFilterAcceptList);
   SET_SUPPORTED(LE_ADD_DEVICE_TO_FILTER_ACCEPT_LIST,
@@ -227,6 +239,7 @@
   SET_SUPPORTED(LE_RAND, LeRand);
   SET_SUPPORTED(LE_READ_SUPPORTED_STATES, LeReadSupportedStates);
   SET_HANDLER(LE_GET_VENDOR_CAPABILITIES, LeVendorCap);
+  SET_VENDOR_HANDLER(CSR_VENDOR, CsrVendorCommand);
   SET_HANDLER(LE_REMOTE_CONNECTION_PARAMETER_REQUEST_REPLY,
               LeRemoteConnectionParameterRequestReply);
   SET_HANDLER(LE_REMOTE_CONNECTION_PARAMETER_REQUEST_NEGATIVE_REPLY,
@@ -234,13 +247,13 @@
   SET_HANDLER(LE_MULTI_ADVT, LeVendorMultiAdv);
   SET_HANDLER(LE_ADV_FILTER, LeAdvertisingFilter);
   SET_HANDLER(LE_ENERGY_INFO, LeEnergyInfo);
-  SET_SUPPORTED(LE_SET_EXTENDED_ADVERTISING_RANDOM_ADDRESS,
-                LeSetExtendedAdvertisingRandomAddress);
+  SET_SUPPORTED(LE_SET_ADVERTISING_SET_RANDOM_ADDRESS,
+                LeSetAdvertisingSetRandomAddress);
   SET_SUPPORTED(LE_SET_EXTENDED_ADVERTISING_PARAMETERS,
                 LeSetExtendedAdvertisingParameters);
   SET_SUPPORTED(LE_SET_EXTENDED_ADVERTISING_DATA, LeSetExtendedAdvertisingData);
-  SET_SUPPORTED(LE_SET_EXTENDED_ADVERTISING_SCAN_RESPONSE,
-                LeSetExtendedAdvertisingScanResponse);
+  SET_SUPPORTED(LE_SET_EXTENDED_SCAN_RESPONSE_DATA,
+                LeSetExtendedScanResponseData);
   SET_SUPPORTED(LE_SET_EXTENDED_ADVERTISING_ENABLE,
                 LeSetExtendedAdvertisingEnable);
   SET_SUPPORTED(LE_READ_MAXIMUM_ADVERTISING_DATA_LENGTH,
@@ -295,7 +308,7 @@
   SET_SUPPORTED(WRITE_CONNECTION_ACCEPT_TIMEOUT, WriteConnectionAcceptTimeout);
   SET_SUPPORTED(LE_SET_ADDRESS_RESOLUTION_ENABLE, LeSetAddressResolutionEnable);
   SET_SUPPORTED(LE_SET_RESOLVABLE_PRIVATE_ADDRESS_TIMEOUT,
-                LeSetResovalablePrivateAddressTimeout);
+                LeSetResolvablePrivateAddressTimeout);
   SET_SUPPORTED(READ_SYNCHRONOUS_FLOW_CONTROL_ENABLE,
                 ReadSynchronousFlowControlEnable);
   SET_SUPPORTED(WRITE_SYNCHRONOUS_FLOW_CONTROL_ENABLE,
@@ -364,15 +377,15 @@
   if (loopback_mode_ == LoopbackMode::ENABLE_LOCAL) {
     uint16_t handle = sco_packet.GetHandle();
 
-    auto sco_builder = bluetooth::hci::ScoBuilder::Create(
-        handle, sco_packet.GetPacketStatusFlag(), sco_packet.GetData());
-    send_sco_(std::move(sco_builder));
+    send_sco_(bluetooth::hci::ScoBuilder::Create(
+        handle, sco_packet.GetPacketStatusFlag(), sco_packet.GetData()));
+
     std::vector<bluetooth::hci::CompletedPackets> completed_packets;
     bluetooth::hci::CompletedPackets cp;
     cp.connection_handle_ = handle;
     cp.host_num_of_completed_packets_ = 1;
     completed_packets.push_back(cp);
-    if (properties_.GetSynchronousFlowControl()) {
+    if (link_layer_controller_.GetScoFlowControlEnable()) {
       send_event_(bluetooth::hci::NumberOfCompletedPacketsBuilder::Create(
           completed_packets));
     }
@@ -491,10 +504,9 @@
 
   send_event_(bluetooth::hci::ReadBufferSizeCompleteBuilder::Create(
       kNumCommandPackets, ErrorCode::SUCCESS,
-      properties_.GetAclDataPacketSize(),
-      properties_.GetSynchronousDataPacketSize(),
-      properties_.GetTotalNumAclDataPackets(),
-      properties_.GetTotalNumSynchronousDataPackets()));
+      properties_.acl_data_packet_length, properties_.sco_data_packet_length,
+      properties_.total_num_acl_data_packets,
+      properties_.total_num_sco_data_packets));
 }
 
 void DualModeController::ReadEncryptionKeySize(CommandView command) {
@@ -504,7 +516,8 @@
 
   send_event_(bluetooth::hci::ReadEncryptionKeySizeCompleteBuilder::Create(
       kNumCommandPackets, ErrorCode::SUCCESS,
-      command_view.GetConnectionHandle(), properties_.GetEncryptionKeySize()));
+      command_view.GetConnectionHandle(),
+      link_layer_controller_.GetEncryptionKeySize()));
 }
 
 void DualModeController::HostBufferSize(CommandView command) {
@@ -519,14 +532,12 @@
   ASSERT(command_view.IsValid());
 
   bluetooth::hci::LocalVersionInformation local_version_information;
-  local_version_information.hci_version_ =
-      static_cast<bluetooth::hci::HciVersion>(properties_.GetVersion());
-  local_version_information.hci_revision_ = properties_.GetRevision();
-  local_version_information.lmp_version_ =
-      static_cast<bluetooth::hci::LmpVersion>(properties_.GetLmpPalVersion());
-  local_version_information.manufacturer_name_ =
-      properties_.GetManufacturerName();
-  local_version_information.lmp_subversion_ = properties_.GetLmpPalSubversion();
+  local_version_information.hci_version_ = properties_.hci_version;
+  local_version_information.lmp_version_ = properties_.lmp_version;
+  local_version_information.hci_revision_ = properties_.hci_subversion;
+  local_version_information.lmp_subversion_ = properties_.lmp_subversion;
+  local_version_information.manufacturer_name_ = properties_.company_identifier;
+
   send_event_(
       bluetooth::hci::ReadLocalVersionInformationCompleteBuilder::Create(
           kNumCommandPackets, ErrorCode::SUCCESS, local_version_information));
@@ -550,24 +561,14 @@
   auto command_view = gd_hci::ReadBdAddrView::Create(command);
   ASSERT(command_view.IsValid());
   send_event_(bluetooth::hci::ReadBdAddrCompleteBuilder::Create(
-      kNumCommandPackets, ErrorCode::SUCCESS, properties_.GetAddress()));
+      kNumCommandPackets, ErrorCode::SUCCESS, GetAddress()));
 }
 
 void DualModeController::ReadLocalSupportedCommands(CommandView command) {
   auto command_view = gd_hci::ReadLocalSupportedCommandsView::Create(command);
   ASSERT(command_view.IsValid());
-
-  std::array<uint8_t, 64> supported_commands{};
-  supported_commands.fill(0x00);
-  size_t len = properties_.GetSupportedCommands().size();
-  if (len > 64) {
-    len = 64;
-  }
-  std::copy_n(properties_.GetSupportedCommands().begin(), len,
-              supported_commands.begin());
-
   send_event_(bluetooth::hci::ReadLocalSupportedCommandsCompleteBuilder::Create(
-      kNumCommandPackets, ErrorCode::SUCCESS, supported_commands));
+      kNumCommandPackets, ErrorCode::SUCCESS, properties_.supported_commands));
 }
 
 void DualModeController::ReadLocalSupportedFeatures(CommandView command) {
@@ -576,15 +577,16 @@
 
   send_event_(bluetooth::hci::ReadLocalSupportedFeaturesCompleteBuilder::Create(
       kNumCommandPackets, ErrorCode::SUCCESS,
-      properties_.GetSupportedFeatures()));
+      link_layer_controller_.GetLmpFeatures()));
 }
 
 void DualModeController::ReadLocalSupportedCodecs(CommandView command) {
   auto command_view = gd_hci::ReadLocalSupportedCodecsV1View::Create(command);
   ASSERT(command_view.IsValid());
   send_event_(bluetooth::hci::ReadLocalSupportedCodecsV1CompleteBuilder::Create(
-      kNumCommandPackets, ErrorCode::SUCCESS, properties_.GetSupportedCodecs(),
-      properties_.GetVendorSpecificCodecs()));
+      kNumCommandPackets, ErrorCode::SUCCESS,
+      properties_.supported_standard_codecs,
+      properties_.supported_vendor_specific_codecs));
 }
 
 void DualModeController::ReadLocalExtendedFeatures(CommandView command) {
@@ -594,8 +596,8 @@
 
   send_event_(bluetooth::hci::ReadLocalExtendedFeaturesCompleteBuilder::Create(
       kNumCommandPackets, ErrorCode::SUCCESS, page_number,
-      properties_.GetExtendedFeaturesMaximumPageNumber(),
-      properties_.GetExtendedFeatures(page_number)));
+      link_layer_controller_.GetMaxLmpFeaturesPageNumber(),
+      link_layer_controller_.GetLmpFeatures(page_number)));
 }
 
 void DualModeController::ReadRemoteExtendedFeatures(CommandView command) {
@@ -618,8 +620,8 @@
           gd_hci::AclCommandView::Create(command)));
   ASSERT(command_view.IsValid());
 
-  auto status = link_layer_controller_.SwitchRole(
-      command_view.GetBdAddr(), static_cast<uint8_t>(command_view.GetRole()));
+  auto status = link_layer_controller_.SwitchRole(command_view.GetBdAddr(),
+                                                  command_view.GetRole());
 
   send_event_(bluetooth::hci::SwitchRoleStatusBuilder::Create(
       status, kNumCommandPackets));
@@ -663,7 +665,8 @@
   ASSERT(command_view.IsValid());
 
   auto status = link_layer_controller_.AddScoConnection(
-      command_view.GetConnectionHandle(), command_view.GetPacketType());
+      command_view.GetConnectionHandle(), command_view.GetPacketType(),
+      ScoDatapath::NORMAL);
 
   send_event_(bluetooth::hci::AddScoConnectionStatusBuilder::Create(
       status, kNumCommandPackets));
@@ -678,8 +681,9 @@
   auto status = link_layer_controller_.SetupSynchronousConnection(
       command_view.GetConnectionHandle(), command_view.GetTransmitBandwidth(),
       command_view.GetReceiveBandwidth(), command_view.GetMaxLatency(),
-      command_view.GetVoiceSetting(), command_view.GetRetransmissionEffort(),
-      command_view.GetPacketType());
+      command_view.GetVoiceSetting(),
+      static_cast<uint8_t>(command_view.GetRetransmissionEffort()),
+      command_view.GetPacketType(), ScoDatapath::NORMAL);
 
   send_event_(bluetooth::hci::SetupSynchronousConnectionStatusBuilder::Create(
       status, kNumCommandPackets));
@@ -694,13 +698,307 @@
   auto status = link_layer_controller_.AcceptSynchronousConnection(
       command_view.GetBdAddr(), command_view.GetTransmitBandwidth(),
       command_view.GetReceiveBandwidth(), command_view.GetMaxLatency(),
-      command_view.GetVoiceSetting(), command_view.GetRetransmissionEffort(),
+      command_view.GetVoiceSetting(),
+      static_cast<uint8_t>(command_view.GetRetransmissionEffort()),
       command_view.GetPacketType());
 
   send_event_(bluetooth::hci::AcceptSynchronousConnectionStatusBuilder::Create(
       status, kNumCommandPackets));
 }
 
+void DualModeController::EnhancedSetupSynchronousConnection(
+    CommandView command) {
+  auto command_view = gd_hci::EnhancedSetupSynchronousConnectionView::Create(
+      gd_hci::ScoConnectionCommandView::Create(
+          gd_hci::AclCommandView::Create(command)));
+  auto status = ErrorCode::SUCCESS;
+  ASSERT(command_view.IsValid());
+
+  // The Host shall set the Transmit_Coding_Format and Receive_Coding_Formats
+  // to be equal.
+  auto transmit_coding_format = command_view.GetTransmitCodingFormat();
+  auto receive_coding_format = command_view.GetReceiveCodingFormat();
+  if (transmit_coding_format.coding_format_ !=
+          receive_coding_format.coding_format_ ||
+      transmit_coding_format.company_id_ != receive_coding_format.company_id_ ||
+      transmit_coding_format.vendor_specific_codec_id_ !=
+          receive_coding_format.vendor_specific_codec_id_) {
+    LOG_INFO(
+        "EnhancedSetupSynchronousConnection: rejected Transmit_Coding_Format "
+        "(%s)"
+        " and Receive_Coding_Format (%s) as they are not equal",
+        transmit_coding_format.ToString().c_str(),
+        receive_coding_format.ToString().c_str());
+    status = ErrorCode::INVALID_HCI_COMMAND_PARAMETERS;
+  }
+
+  // The Host shall either set the Input_Bandwidth and Output_Bandwidth
+  // to be equal, or shall set one of them to be zero and the other non-zero.
+  auto input_bandwidth = command_view.GetInputBandwidth();
+  auto output_bandwidth = command_view.GetOutputBandwidth();
+  if (input_bandwidth != output_bandwidth && input_bandwidth != 0 &&
+      output_bandwidth != 0) {
+    LOG_INFO(
+        "EnhancedSetupSynchronousConnection: rejected Input_Bandwidth (%u)"
+        " and Output_Bandwidth (%u) as they are not equal and different from 0",
+        input_bandwidth, output_bandwidth);
+    status = ErrorCode::INVALID_HCI_COMMAND_PARAMETERS;
+  }
+
+  // The Host shall set the Input_Coding_Format and Output_Coding_Format
+  // to be equal.
+  auto input_coding_format = command_view.GetInputCodingFormat();
+  auto output_coding_format = command_view.GetOutputCodingFormat();
+  if (input_coding_format.coding_format_ !=
+          output_coding_format.coding_format_ ||
+      input_coding_format.company_id_ != output_coding_format.company_id_ ||
+      input_coding_format.vendor_specific_codec_id_ !=
+          output_coding_format.vendor_specific_codec_id_) {
+    LOG_INFO(
+        "EnhancedSetupSynchronousConnection: rejected Input_Coding_Format (%s)"
+        " and Output_Coding_Format (%s) as they are not equal",
+        input_coding_format.ToString().c_str(),
+        output_coding_format.ToString().c_str());
+    status = ErrorCode::INVALID_HCI_COMMAND_PARAMETERS;
+  }
+
+  // Root-Canal does not implement audio data transport paths other than the
+  // default HCI transport - other transports will receive spoofed data
+  ScoDatapath datapath = ScoDatapath::NORMAL;
+  if (command_view.GetInputDataPath() != bluetooth::hci::ScoDataPath::HCI ||
+      command_view.GetOutputDataPath() != bluetooth::hci::ScoDataPath::HCI) {
+    LOG_WARN(
+        "EnhancedSetupSynchronousConnection: Input_Data_Path (%u)"
+        " and/or Output_Data_Path (%u) are not over HCI, so data will be "
+        "spoofed",
+        static_cast<unsigned>(command_view.GetInputDataPath()),
+        static_cast<unsigned>(command_view.GetOutputDataPath()));
+    datapath = ScoDatapath::SPOOFED;
+  }
+
+  // Either both the Transmit_Coding_Format and Input_Coding_Format shall be
+  // “transparent” or neither shall be. If both are “transparent”, the
+  // Transmit_Bandwidth and the Input_Bandwidth shall be the same and the
+  // Controller shall not modify the data sent to the remote device.
+  auto transmit_bandwidth = command_view.GetTransmitBandwidth();
+  auto receive_bandwidth = command_view.GetReceiveBandwidth();
+  if (transmit_coding_format.coding_format_ ==
+          bluetooth::hci::ScoCodingFormatValues::TRANSPARENT &&
+      input_coding_format.coding_format_ ==
+          bluetooth::hci::ScoCodingFormatValues::TRANSPARENT &&
+      transmit_bandwidth != input_bandwidth) {
+    LOG_INFO(
+        "EnhancedSetupSynchronousConnection: rejected Transmit_Bandwidth (%u)"
+        " and Input_Bandwidth (%u) as they are not equal",
+        transmit_bandwidth, input_bandwidth);
+    LOG_INFO(
+        "EnhancedSetupSynchronousConnection: the Transmit_Bandwidth and "
+        "Input_Bandwidth shall be equal when both Transmit_Coding_Format "
+        "and Input_Coding_Format are 'transparent'");
+    status = ErrorCode::INVALID_HCI_COMMAND_PARAMETERS;
+  }
+  if ((transmit_coding_format.coding_format_ ==
+       bluetooth::hci::ScoCodingFormatValues::TRANSPARENT) !=
+      (input_coding_format.coding_format_ ==
+       bluetooth::hci::ScoCodingFormatValues::TRANSPARENT)) {
+    LOG_INFO(
+        "EnhancedSetupSynchronousConnection: rejected Transmit_Coding_Format "
+        "(%s) and Input_Coding_Format (%s) as they are incompatible",
+        transmit_coding_format.ToString().c_str(),
+        input_coding_format.ToString().c_str());
+    status = ErrorCode::INVALID_HCI_COMMAND_PARAMETERS;
+  }
+
+  // Either both the Receive_Coding_Format and Output_Coding_Format shall
+  // be “transparent” or neither shall be. If both are “transparent”, the
+  // Receive_Bandwidth and the Output_Bandwidth shall be the same and the
+  // Controller shall not modify the data sent to the Host.
+  if (receive_coding_format.coding_format_ ==
+          bluetooth::hci::ScoCodingFormatValues::TRANSPARENT &&
+      output_coding_format.coding_format_ ==
+          bluetooth::hci::ScoCodingFormatValues::TRANSPARENT &&
+      receive_bandwidth != output_bandwidth) {
+    LOG_INFO(
+        "EnhancedSetupSynchronousConnection: rejected Receive_Bandwidth (%u)"
+        " and Output_Bandwidth (%u) as they are not equal",
+        receive_bandwidth, output_bandwidth);
+    LOG_INFO(
+        "EnhancedSetupSynchronousConnection: the Receive_Bandwidth and "
+        "Output_Bandwidth shall be equal when both Receive_Coding_Format "
+        "and Output_Coding_Format are 'transparent'");
+    status = ErrorCode::INVALID_HCI_COMMAND_PARAMETERS;
+  }
+  if ((receive_coding_format.coding_format_ ==
+       bluetooth::hci::ScoCodingFormatValues::TRANSPARENT) !=
+      (output_coding_format.coding_format_ ==
+       bluetooth::hci::ScoCodingFormatValues::TRANSPARENT)) {
+    LOG_INFO(
+        "EnhancedSetupSynchronousConnection: rejected Receive_Coding_Format "
+        "(%s) and Output_Coding_Format (%s) as they are incompatible",
+        receive_coding_format.ToString().c_str(),
+        output_coding_format.ToString().c_str());
+    status = ErrorCode::INVALID_HCI_COMMAND_PARAMETERS;
+  }
+
+  if (status == ErrorCode::SUCCESS) {
+    status = link_layer_controller_.SetupSynchronousConnection(
+        command_view.GetConnectionHandle(), transmit_bandwidth,
+        receive_bandwidth, command_view.GetMaxLatency(),
+        link_layer_controller_.GetVoiceSetting(),
+        static_cast<uint8_t>(command_view.GetRetransmissionEffort()),
+        command_view.GetPacketType(), datapath);
+  }
+
+  send_event_(
+      bluetooth::hci::EnhancedSetupSynchronousConnectionStatusBuilder::Create(
+          status, kNumCommandPackets));
+}
+
+void DualModeController::EnhancedAcceptSynchronousConnection(
+    CommandView command) {
+  auto command_view = gd_hci::EnhancedAcceptSynchronousConnectionView::Create(
+      gd_hci::ScoConnectionCommandView::Create(
+          gd_hci::AclCommandView::Create(command)));
+  auto status = ErrorCode::SUCCESS;
+  ASSERT(command_view.IsValid());
+
+  // The Host shall set the Transmit_Coding_Format and Receive_Coding_Formats
+  // to be equal.
+  auto transmit_coding_format = command_view.GetTransmitCodingFormat();
+  auto receive_coding_format = command_view.GetReceiveCodingFormat();
+  if (transmit_coding_format.coding_format_ !=
+          receive_coding_format.coding_format_ ||
+      transmit_coding_format.company_id_ != receive_coding_format.company_id_ ||
+      transmit_coding_format.vendor_specific_codec_id_ !=
+          receive_coding_format.vendor_specific_codec_id_) {
+    LOG_INFO(
+        "EnhancedAcceptSynchronousConnection: rejected Transmit_Coding_Format "
+        "(%s)"
+        " and Receive_Coding_Format (%s) as they are not equal",
+        transmit_coding_format.ToString().c_str(),
+        receive_coding_format.ToString().c_str());
+    status = ErrorCode::INVALID_HCI_COMMAND_PARAMETERS;
+  }
+
+  // The Host shall either set the Input_Bandwidth and Output_Bandwidth
+  // to be equal, or shall set one of them to be zero and the other non-zero.
+  auto input_bandwidth = command_view.GetInputBandwidth();
+  auto output_bandwidth = command_view.GetOutputBandwidth();
+  if (input_bandwidth != output_bandwidth && input_bandwidth != 0 &&
+      output_bandwidth != 0) {
+    LOG_INFO(
+        "EnhancedAcceptSynchronousConnection: rejected Input_Bandwidth (%u)"
+        " and Output_Bandwidth (%u) as they are not equal and different from 0",
+        input_bandwidth, output_bandwidth);
+    status = ErrorCode::INVALID_HCI_COMMAND_PARAMETERS;
+  }
+
+  // The Host shall set the Input_Coding_Format and Output_Coding_Format
+  // to be equal.
+  auto input_coding_format = command_view.GetInputCodingFormat();
+  auto output_coding_format = command_view.GetOutputCodingFormat();
+  if (input_coding_format.coding_format_ !=
+          output_coding_format.coding_format_ ||
+      input_coding_format.company_id_ != output_coding_format.company_id_ ||
+      input_coding_format.vendor_specific_codec_id_ !=
+          output_coding_format.vendor_specific_codec_id_) {
+    LOG_INFO(
+        "EnhancedAcceptSynchronousConnection: rejected Input_Coding_Format (%s)"
+        " and Output_Coding_Format (%s) as they are not equal",
+        input_coding_format.ToString().c_str(),
+        output_coding_format.ToString().c_str());
+    status = ErrorCode::INVALID_HCI_COMMAND_PARAMETERS;
+  }
+
+  // Root-Canal does not implement audio data transport paths other than the
+  // default HCI transport.
+  if (command_view.GetInputDataPath() != bluetooth::hci::ScoDataPath::HCI ||
+      command_view.GetOutputDataPath() != bluetooth::hci::ScoDataPath::HCI) {
+    LOG_INFO(
+        "EnhancedSetupSynchronousConnection: Input_Data_Path (%u)"
+        " and/or Output_Data_Path (%u) are not over HCI, so data will be "
+        "spoofed",
+        static_cast<unsigned>(command_view.GetInputDataPath()),
+        static_cast<unsigned>(command_view.GetOutputDataPath()));
+  }
+
+  // Either both the Transmit_Coding_Format and Input_Coding_Format shall be
+  // “transparent” or neither shall be. If both are “transparent”, the
+  // Transmit_Bandwidth and the Input_Bandwidth shall be the same and the
+  // Controller shall not modify the data sent to the remote device.
+  auto transmit_bandwidth = command_view.GetTransmitBandwidth();
+  auto receive_bandwidth = command_view.GetReceiveBandwidth();
+  if (transmit_coding_format.coding_format_ ==
+          bluetooth::hci::ScoCodingFormatValues::TRANSPARENT &&
+      input_coding_format.coding_format_ ==
+          bluetooth::hci::ScoCodingFormatValues::TRANSPARENT &&
+      transmit_bandwidth != input_bandwidth) {
+    LOG_INFO(
+        "EnhancedSetupSynchronousConnection: rejected Transmit_Bandwidth (%u)"
+        " and Input_Bandwidth (%u) as they are not equal",
+        transmit_bandwidth, input_bandwidth);
+    LOG_INFO(
+        "EnhancedSetupSynchronousConnection: the Transmit_Bandwidth and "
+        "Input_Bandwidth shall be equal when both Transmit_Coding_Format "
+        "and Input_Coding_Format are 'transparent'");
+    status = ErrorCode::INVALID_HCI_COMMAND_PARAMETERS;
+  }
+  if ((transmit_coding_format.coding_format_ ==
+       bluetooth::hci::ScoCodingFormatValues::TRANSPARENT) !=
+      (input_coding_format.coding_format_ ==
+       bluetooth::hci::ScoCodingFormatValues::TRANSPARENT)) {
+    LOG_INFO(
+        "EnhancedSetupSynchronousConnection: rejected Transmit_Coding_Format "
+        "(%s) and Input_Coding_Format (%s) as they are incompatible",
+        transmit_coding_format.ToString().c_str(),
+        input_coding_format.ToString().c_str());
+    status = ErrorCode::INVALID_HCI_COMMAND_PARAMETERS;
+  }
+
+  // Either both the Receive_Coding_Format and Output_Coding_Format shall
+  // be “transparent” or neither shall be. If both are “transparent”, the
+  // Receive_Bandwidth and the Output_Bandwidth shall be the same and the
+  // Controller shall not modify the data sent to the Host.
+  if (receive_coding_format.coding_format_ ==
+          bluetooth::hci::ScoCodingFormatValues::TRANSPARENT &&
+      output_coding_format.coding_format_ ==
+          bluetooth::hci::ScoCodingFormatValues::TRANSPARENT &&
+      receive_bandwidth != output_bandwidth) {
+    LOG_INFO(
+        "EnhancedSetupSynchronousConnection: rejected Receive_Bandwidth (%u)"
+        " and Output_Bandwidth (%u) as they are not equal",
+        receive_bandwidth, output_bandwidth);
+    LOG_INFO(
+        "EnhancedSetupSynchronousConnection: the Receive_Bandwidth and "
+        "Output_Bandwidth shall be equal when both Receive_Coding_Format "
+        "and Output_Coding_Format are 'transparent'");
+    status = ErrorCode::INVALID_HCI_COMMAND_PARAMETERS;
+  }
+  if ((receive_coding_format.coding_format_ ==
+       bluetooth::hci::ScoCodingFormatValues::TRANSPARENT) !=
+      (output_coding_format.coding_format_ ==
+       bluetooth::hci::ScoCodingFormatValues::TRANSPARENT)) {
+    LOG_INFO(
+        "EnhancedSetupSynchronousConnection: rejected Receive_Coding_Format "
+        "(%s) and Output_Coding_Format (%s) as they are incompatible",
+        receive_coding_format.ToString().c_str(),
+        output_coding_format.ToString().c_str());
+    status = ErrorCode::INVALID_HCI_COMMAND_PARAMETERS;
+  }
+
+  if (status == ErrorCode::SUCCESS) {
+    status = link_layer_controller_.AcceptSynchronousConnection(
+        command_view.GetBdAddr(), transmit_bandwidth, receive_bandwidth,
+        command_view.GetMaxLatency(), link_layer_controller_.GetVoiceSetting(),
+        static_cast<uint8_t>(command_view.GetRetransmissionEffort()),
+        command_view.GetPacketType());
+  }
+
+  send_event_(
+      bluetooth::hci::EnhancedAcceptSynchronousConnectionStatusBuilder::Create(
+          status, kNumCommandPackets));
+}
+
 void DualModeController::RejectSynchronousConnection(CommandView command) {
   auto command_view = gd_hci::RejectSynchronousConnectionView::Create(
       gd_hci::ScoConnectionCommandView::Create(
@@ -715,6 +1013,9 @@
 }
 
 void DualModeController::IoCapabilityRequestReply(CommandView command) {
+#ifdef ROOTCANAL_LMP
+  link_layer_controller_.ForwardToLm(command);
+#else
   auto command_view = gd_hci::IoCapabilityRequestReplyView::Create(
       gd_hci::SecurityCommandView::Create(command));
   ASSERT(command_view.IsValid());
@@ -730,9 +1031,13 @@
       peer, io_capability, oob_data_present_flag, authentication_requirements);
   send_event_(bluetooth::hci::IoCapabilityRequestReplyCompleteBuilder::Create(
       kNumCommandPackets, status, peer));
+#endif /* ROOTCANAL_LMP */
 }
 
 void DualModeController::UserConfirmationRequestReply(CommandView command) {
+#ifdef ROOTCANAL_LMP
+  link_layer_controller_.ForwardToLm(command);
+#else
   auto command_view = gd_hci::UserConfirmationRequestReplyView::Create(
       gd_hci::SecurityCommandView::Create(command));
   ASSERT(command_view.IsValid());
@@ -743,10 +1048,14 @@
   send_event_(
       bluetooth::hci::UserConfirmationRequestReplyCompleteBuilder::Create(
           kNumCommandPackets, status, peer));
+#endif /* ROOTCANAL_LMP */
 }
 
 void DualModeController::UserConfirmationRequestNegativeReply(
     CommandView command) {
+#ifdef ROOTCANAL_LMP
+  link_layer_controller_.ForwardToLm(command);
+#else
   auto command_view = gd_hci::UserConfirmationRequestNegativeReplyView::Create(
       gd_hci::SecurityCommandView::Create(command));
   ASSERT(command_view.IsValid());
@@ -758,13 +1067,17 @@
   send_event_(
       bluetooth::hci::UserConfirmationRequestNegativeReplyCompleteBuilder::
           Create(kNumCommandPackets, status, peer));
+#endif /* ROOTCANAL_LMP */
 }
 
 void DualModeController::PinCodeRequestReply(CommandView command) {
+#ifdef ROOTCANAL_LMP
+  link_layer_controller_.ForwardToLm(command);
+#else
   auto command_view = gd_hci::PinCodeRequestReplyView::Create(
       gd_hci::SecurityCommandView::Create(command));
   ASSERT(command_view.IsValid());
-  LOG_INFO("%s", properties_.GetAddress().ToString().c_str());
+  LOG_INFO("%s", GetAddress().ToString().c_str());
 
   Address peer = command_view.GetBdAddr();
   uint8_t pin_length = command_view.GetPinCodeLength();
@@ -777,13 +1090,17 @@
 
   send_event_(bluetooth::hci::PinCodeRequestReplyCompleteBuilder::Create(
       kNumCommandPackets, status, peer));
+#endif /* ROOTCANAL_LMP */
 }
 
 void DualModeController::PinCodeRequestNegativeReply(CommandView command) {
+#ifdef ROOTCANAL_LMP
+  link_layer_controller_.ForwardToLm(command);
+#else
   auto command_view = gd_hci::PinCodeRequestNegativeReplyView::Create(
       gd_hci::SecurityCommandView::Create(command));
   ASSERT(command_view.IsValid());
-  LOG_INFO("%s", properties_.GetAddress().ToString().c_str());
+  LOG_INFO("%s", GetAddress().ToString().c_str());
 
   Address peer = command_view.GetBdAddr();
 
@@ -791,9 +1108,13 @@
   send_event_(
       bluetooth::hci::PinCodeRequestNegativeReplyCompleteBuilder::Create(
           kNumCommandPackets, status, peer));
+#endif /* ROOTCANAL_LMP */
 }
 
 void DualModeController::UserPasskeyRequestReply(CommandView command) {
+#ifdef ROOTCANAL_LMP
+  link_layer_controller_.ForwardToLm(command);
+#else
   auto command_view = gd_hci::UserPasskeyRequestReplyView::Create(
       gd_hci::SecurityCommandView::Create(command));
   ASSERT(command_view.IsValid());
@@ -805,9 +1126,13 @@
       link_layer_controller_.UserPasskeyRequestReply(peer, numeric_value);
   send_event_(bluetooth::hci::UserPasskeyRequestReplyCompleteBuilder::Create(
       kNumCommandPackets, status, peer));
+#endif /* ROOTCANAL_LMP */
 }
 
 void DualModeController::UserPasskeyRequestNegativeReply(CommandView command) {
+#ifdef ROOTCANAL_LMP
+  link_layer_controller_.ForwardToLm(command);
+#else
   auto command_view = gd_hci::UserPasskeyRequestNegativeReplyView::Create(
       gd_hci::SecurityCommandView::Create(command));
   ASSERT(command_view.IsValid());
@@ -818,9 +1143,13 @@
   send_event_(
       bluetooth::hci::UserPasskeyRequestNegativeReplyCompleteBuilder::Create(
           kNumCommandPackets, status, peer));
+#endif /* ROOTCANAL_LMP */
 }
 
 void DualModeController::RemoteOobDataRequestReply(CommandView command) {
+#ifdef ROOTCANAL_LMP
+  link_layer_controller_.ForwardToLm(command);
+#else
   auto command_view = gd_hci::RemoteOobDataRequestReplyView::Create(
       gd_hci::SecurityCommandView::Create(command));
   ASSERT(command_view.IsValid());
@@ -832,10 +1161,14 @@
 
   send_event_(bluetooth::hci::RemoteOobDataRequestReplyCompleteBuilder::Create(
       kNumCommandPackets, status, peer));
+#endif /* ROOTCANAL_LMP */
 }
 
 void DualModeController::RemoteOobDataRequestNegativeReply(
     CommandView command) {
+#ifdef ROOTCANAL_LMP
+  link_layer_controller_.ForwardToLm(command);
+#else
   auto command_view = gd_hci::RemoteOobDataRequestNegativeReplyView::Create(
       gd_hci::SecurityCommandView::Create(command));
   ASSERT(command_view.IsValid());
@@ -846,9 +1179,13 @@
   send_event_(
       bluetooth::hci::RemoteOobDataRequestNegativeReplyCompleteBuilder::Create(
           kNumCommandPackets, status, peer));
+#endif /* ROOTCANAL_LMP */
 }
 
 void DualModeController::IoCapabilityRequestNegativeReply(CommandView command) {
+#ifdef ROOTCANAL_LMP
+  link_layer_controller_.ForwardToLm(command);
+#else
   auto command_view = gd_hci::IoCapabilityRequestNegativeReplyView::Create(
       gd_hci::SecurityCommandView::Create(command));
   ASSERT(command_view.IsValid());
@@ -861,10 +1198,14 @@
   send_event_(
       bluetooth::hci::IoCapabilityRequestNegativeReplyCompleteBuilder::Create(
           kNumCommandPackets, status, peer));
+#endif /* ROOTCANAL_LMP */
 }
 
 void DualModeController::RemoteOobExtendedDataRequestReply(
     CommandView command) {
+#ifdef ROOTCANAL_LMP
+  link_layer_controller_.ForwardToLm(command);
+#else
   auto command_view = gd_hci::RemoteOobExtendedDataRequestReplyView::Create(
       gd_hci::SecurityCommandView::Create(command));
   ASSERT(command_view.IsValid());
@@ -878,6 +1219,7 @@
   send_event_(
       bluetooth::hci::RemoteOobExtendedDataRequestReplyCompleteBuilder::Create(
           kNumCommandPackets, status, peer));
+#endif /* ROOTCANAL_LMP */
 }
 
 void DualModeController::ReadInquiryResponseTransmitPowerLevel(
@@ -893,6 +1235,9 @@
 }
 
 void DualModeController::SendKeypressNotification(CommandView command) {
+#ifdef ROOTCANAL_LMP
+  link_layer_controller_.ForwardToLm(command);
+#else
   auto command_view = gd_hci::SendKeypressNotificationView::Create(
       gd_hci::SecurityCommandView::Create(command));
   ASSERT(command_view.IsValid());
@@ -903,14 +1248,32 @@
       peer, command_view.GetNotificationType());
   send_event_(bluetooth::hci::SendKeypressNotificationCompleteBuilder::Create(
       kNumCommandPackets, status, peer));
+#endif /* ROOTCANAL_LMP */
+}
+
+void DualModeController::EnhancedFlush(CommandView command) {
+  auto command_view = bluetooth::hci::EnhancedFlushView::Create(command);
+  ASSERT(command_view.IsValid());
+
+  auto handle = command_view.GetConnectionHandle();
+  send_event_(bluetooth::hci::EnhancedFlushStatusBuilder::Create(
+      ErrorCode::SUCCESS, kNumCommandPackets));
+
+  // TODO: When adding a queue of ACL packets.
+  // Send the Enhanced Flush Complete event after discarding
+  // all L2CAP packets identified by the Packet Type.
+  if (link_layer_controller_.IsEventUnmasked(
+          gd_hci::EventCode::ENHANCED_FLUSH_COMPLETE)) {
+    send_event_(bluetooth::hci::EnhancedFlushCompleteBuilder::Create(handle));
+  }
 }
 
 void DualModeController::SetEventMaskPage2(CommandView command) {
-  auto payload =
-      std::make_unique<bluetooth::packet::RawBuilder>(std::vector<uint8_t>(
-          {static_cast<uint8_t>(bluetooth::hci::ErrorCode::SUCCESS)}));
-  send_event_(bluetooth::hci::CommandCompleteBuilder::Create(
-      kNumCommandPackets, command.GetOpCode(), std::move(payload)));
+  auto command_view = bluetooth::hci::SetEventMaskPage2View::Create(command);
+  ASSERT(command_view.IsValid());
+  link_layer_controller_.SetEventMaskPage2(command_view.GetEventMaskPage2());
+  send_event_(bluetooth::hci::SetEventMaskPage2CompleteBuilder::Create(
+      kNumCommandPackets, ErrorCode::SUCCESS));
 }
 
 void DualModeController::ReadLocalOobData(CommandView command) {
@@ -931,7 +1294,7 @@
   ASSERT(command_view.IsValid());
 
   auto enabled = command_view.GetSimplePairingMode() == gd_hci::Enable::ENABLED;
-  properties_.SetSecureSimplePairingSupport(enabled);
+  link_layer_controller_.SetSecureSimplePairingSupport(enabled);
   send_event_(bluetooth::hci::WriteSimplePairingModeCompleteBuilder::Create(
       kNumCommandPackets, ErrorCode::SUCCESS));
 }
@@ -947,7 +1310,6 @@
 
   auto status =
       link_layer_controller_.ChangeConnectionPacketType(handle, packet_type);
-
   send_event_(bluetooth::hci::ChangeConnectionPacketTypeStatusBuilder::Create(
       status, kNumCommandPackets));
 }
@@ -957,7 +1319,7 @@
   ASSERT(command_view.IsValid());
   auto le_support =
       command_view.GetLeSupportedHost() == gd_hci::Enable::ENABLED;
-  properties_.SetLeHostSupport(le_support);
+  link_layer_controller_.SetLeHostSupport(le_support);
   send_event_(bluetooth::hci::WriteLeHostSupportCompleteBuilder::Create(
       kNumCommandPackets, ErrorCode::SUCCESS));
 }
@@ -967,7 +1329,7 @@
   auto command_view = gd_hci::WriteSecureConnectionsHostSupportView::Create(
       gd_hci::SecurityCommandView::Create(command));
   ASSERT(command_view.IsValid());
-  properties_.SetSecureConnections(
+  link_layer_controller_.SetSecureConnectionsSupport(
       command_view.GetSecureConnectionsHostSupport() ==
       bluetooth::hci::Enable::ENABLED);
   send_event_(
@@ -978,7 +1340,7 @@
 void DualModeController::SetEventMask(CommandView command) {
   auto command_view = gd_hci::SetEventMaskView::Create(command);
   ASSERT(command_view.IsValid());
-  properties_.SetEventMask(command_view.GetEventMask());
+  link_layer_controller_.SetEventMask(command_view.GetEventMask());
   send_event_(bluetooth::hci::SetEventMaskCompleteBuilder::Create(
       kNumCommandPackets, ErrorCode::SUCCESS));
 }
@@ -1037,6 +1399,9 @@
 }
 
 void DualModeController::AuthenticationRequested(CommandView command) {
+#ifdef ROOTCANAL_LMP
+  link_layer_controller_.ForwardToLm(command);
+#else
   auto command_view = gd_hci::AuthenticationRequestedView::Create(
       gd_hci::ConnectionManagementCommandView::Create(
           gd_hci::AclCommandView::Create(command)));
@@ -1046,9 +1411,13 @@
 
   send_event_(bluetooth::hci::AuthenticationRequestedStatusBuilder::Create(
       status, kNumCommandPackets));
+#endif /* ROOTCANAL_LMP */
 }
 
 void DualModeController::SetConnectionEncryption(CommandView command) {
+#ifdef ROOTCANAL_LMP
+  link_layer_controller_.ForwardToLm(command);
+#else
   auto command_view = gd_hci::SetConnectionEncryptionView::Create(
       gd_hci::ConnectionManagementCommandView::Create(
           gd_hci::AclCommandView::Create(command)));
@@ -1061,6 +1430,7 @@
 
   send_event_(bluetooth::hci::SetConnectionEncryptionStatusBuilder::Create(
       status, kNumCommandPackets));
+#endif /* ROOTCANAL_LMP */
 }
 
 void DualModeController::ChangeConnectionLinkKey(CommandView command) {
@@ -1093,8 +1463,8 @@
   auto command_view = gd_hci::WriteAuthenticationEnableView::Create(
       gd_hci::SecurityCommandView::Create(command));
   ASSERT(command_view.IsValid());
-  properties_.SetAuthenticationEnable(
-      static_cast<uint8_t>(command_view.GetAuthenticationEnable()));
+  link_layer_controller_.SetAuthenticationEnable(
+      command_view.GetAuthenticationEnable());
   send_event_(bluetooth::hci::WriteAuthenticationEnableCompleteBuilder::Create(
       kNumCommandPackets, ErrorCode::SUCCESS));
 }
@@ -1105,16 +1475,14 @@
   send_event_(bluetooth::hci::ReadAuthenticationEnableCompleteBuilder::Create(
       kNumCommandPackets, ErrorCode::SUCCESS,
       static_cast<bluetooth::hci::AuthenticationEnable>(
-          properties_.GetAuthenticationEnable())));
+          link_layer_controller_.GetAuthenticationEnable())));
 }
 
 void DualModeController::WriteClassOfDevice(CommandView command) {
   auto command_view = gd_hci::WriteClassOfDeviceView::Create(
       gd_hci::DiscoveryCommandView::Create(command));
   ASSERT(command_view.IsValid());
-  ClassOfDevice class_of_device = command_view.GetClassOfDevice();
-  properties_.SetClassOfDevice(class_of_device.cod[0], class_of_device.cod[1],
-                               class_of_device.cod[2]);
+  link_layer_controller_.SetClassOfDevice(command_view.GetClassOfDevice());
   send_event_(bluetooth::hci::WriteClassOfDeviceCompleteBuilder::Create(
       kNumCommandPackets, ErrorCode::SUCCESS));
 }
@@ -1123,7 +1491,7 @@
   auto command_view = gd_hci::ReadPageTimeoutView::Create(
       gd_hci::DiscoveryCommandView::Create(command));
   ASSERT(command_view.IsValid());
-  uint16_t page_timeout = 0x2000;
+  uint16_t page_timeout = link_layer_controller_.GetPageTimeout();
   send_event_(bluetooth::hci::ReadPageTimeoutCompleteBuilder::Create(
       kNumCommandPackets, ErrorCode::SUCCESS, page_timeout));
 }
@@ -1132,6 +1500,7 @@
   auto command_view = gd_hci::WritePageTimeoutView::Create(
       gd_hci::DiscoveryCommandView::Create(command));
   ASSERT(command_view.IsValid());
+  link_layer_controller_.SetPageTimeout(command_view.GetPageTimeout());
   send_event_(bluetooth::hci::WritePageTimeoutCompleteBuilder::Create(
       kNumCommandPackets, ErrorCode::SUCCESS));
 }
@@ -1211,10 +1580,11 @@
   ASSERT(command_view.IsValid());
   uint16_t handle = command_view.GetConnectionHandle();
 
-  auto status = link_layer_controller_.RoleDiscovery(handle);
+  auto role = bluetooth::hci::Role::CENTRAL;
+  auto status = link_layer_controller_.RoleDiscovery(handle, &role);
 
   send_event_(bluetooth::hci::RoleDiscoveryCompleteBuilder::Create(
-      kNumCommandPackets, status, handle, bluetooth::hci::Role::CENTRAL));
+      kNumCommandPackets, status, handle, role));
 }
 
 void DualModeController::ReadDefaultLinkPolicySettings(CommandView command) {
@@ -1262,6 +1632,22 @@
       status, kNumCommandPackets));
 }
 
+void DualModeController::ReadLinkPolicySettings(CommandView command) {
+  auto command_view = gd_hci::ReadLinkPolicySettingsView::Create(
+      gd_hci::ConnectionManagementCommandView::Create(
+          gd_hci::AclCommandView::Create(command)));
+  ASSERT(command_view.IsValid());
+
+  uint16_t handle = command_view.GetConnectionHandle();
+  uint16_t settings;
+
+  auto status =
+      link_layer_controller_.ReadLinkPolicySettings(handle, &settings);
+
+  send_event_(bluetooth::hci::ReadLinkPolicySettingsCompleteBuilder::Create(
+      kNumCommandPackets, status, handle, settings));
+}
+
 void DualModeController::WriteLinkPolicySettings(CommandView command) {
   auto command_view = gd_hci::WriteLinkPolicySettingsView::Create(
       gd_hci::ConnectionManagementCommandView::Create(
@@ -1297,28 +1683,15 @@
 void DualModeController::ReadLocalName(CommandView command) {
   auto command_view = gd_hci::ReadLocalNameView::Create(command);
   ASSERT(command_view.IsValid());
-
-  std::array<uint8_t, 248> local_name{};
-  local_name.fill(0x00);
-  size_t len = properties_.GetName().size();
-  if (len > 247) {
-    len = 247;  // one byte for NULL octet (0x00)
-  }
-  std::copy_n(properties_.GetName().begin(), len, local_name.begin());
-
   send_event_(bluetooth::hci::ReadLocalNameCompleteBuilder::Create(
-      kNumCommandPackets, ErrorCode::SUCCESS, local_name));
+      kNumCommandPackets, ErrorCode::SUCCESS,
+      link_layer_controller_.GetLocalName()));
 }
 
 void DualModeController::WriteLocalName(CommandView command) {
   auto command_view = gd_hci::WriteLocalNameView::Create(command);
   ASSERT(command_view.IsValid());
-  const auto local_name = command_view.GetLocalName();
-  std::vector<uint8_t> name_vec(248);
-  for (size_t i = 0; i < 248; i++) {
-    name_vec[i] = local_name[i];
-  }
-  properties_.SetName(name_vec);
+  link_layer_controller_.SetLocalName(command_view.GetLocalName());
   send_event_(bluetooth::hci::WriteLocalNameCompleteBuilder::Create(
       kNumCommandPackets, ErrorCode::SUCCESS));
 }
@@ -1326,7 +1699,7 @@
 void DualModeController::WriteExtendedInquiryResponse(CommandView command) {
   auto command_view = gd_hci::WriteExtendedInquiryResponseView::Create(command);
   ASSERT(command_view.IsValid());
-  properties_.SetExtendedInquiryData(std::vector<uint8_t>(
+  link_layer_controller_.SetExtendedInquiryResponse(std::vector<uint8_t>(
       command_view.GetPayload().begin() + 1, command_view.GetPayload().end()));
   send_event_(
       bluetooth::hci::WriteExtendedInquiryResponseCompleteBuilder::Create(
@@ -1349,7 +1722,7 @@
   auto command_view = gd_hci::WriteVoiceSettingView::Create(command);
   ASSERT(command_view.IsValid());
 
-  properties_.SetVoiceSetting(command_view.GetVoiceSetting());
+  link_layer_controller_.SetVoiceSetting(command_view.GetVoiceSetting());
 
   send_event_(bluetooth::hci::WriteVoiceSettingCompleteBuilder::Create(
       kNumCommandPackets, ErrorCode::SUCCESS));
@@ -1359,25 +1732,24 @@
   auto command_view = gd_hci::ReadNumberOfSupportedIacView::Create(
       gd_hci::DiscoveryCommandView::Create(command));
   ASSERT(command_view.IsValid());
-  uint8_t num_support_iac = 0x1;
   send_event_(bluetooth::hci::ReadNumberOfSupportedIacCompleteBuilder::Create(
-      kNumCommandPackets, ErrorCode::SUCCESS, num_support_iac));
+      kNumCommandPackets, ErrorCode::SUCCESS, properties_.num_supported_iac));
 }
 
 void DualModeController::ReadCurrentIacLap(CommandView command) {
   auto command_view = gd_hci::ReadCurrentIacLapView::Create(
       gd_hci::DiscoveryCommandView::Create(command));
   ASSERT(command_view.IsValid());
-  gd_hci::Lap lap;
-  lap.lap_ = 0x30;
   send_event_(bluetooth::hci::ReadCurrentIacLapCompleteBuilder::Create(
-      kNumCommandPackets, ErrorCode::SUCCESS, {lap}));
+      kNumCommandPackets, ErrorCode::SUCCESS,
+      link_layer_controller_.ReadCurrentIacLap()));
 }
 
 void DualModeController::WriteCurrentIacLap(CommandView command) {
   auto command_view = gd_hci::WriteCurrentIacLapView::Create(
       gd_hci::DiscoveryCommandView::Create(command));
   ASSERT(command_view.IsValid());
+  link_layer_controller_.WriteCurrentIacLap(command_view.GetLapsToWrite());
   send_event_(bluetooth::hci::WriteCurrentIacLapCompleteBuilder::Create(
       kNumCommandPackets, ErrorCode::SUCCESS));
 }
@@ -1422,8 +1794,19 @@
   auto command_view = gd_hci::ReadScanEnableView::Create(
       gd_hci::DiscoveryCommandView::Create(command));
   ASSERT(command_view.IsValid());
+
+  bool inquiry_scan = link_layer_controller_.GetInquiryScanEnable();
+  bool page_scan = link_layer_controller_.GetPageScanEnable();
+
+  bluetooth::hci::ScanEnable scan_enable =
+      inquiry_scan && page_scan
+          ? bluetooth::hci::ScanEnable::INQUIRY_AND_PAGE_SCAN
+      : inquiry_scan ? bluetooth::hci::ScanEnable::INQUIRY_SCAN_ONLY
+      : page_scan    ? bluetooth::hci::ScanEnable::PAGE_SCAN_ONLY
+                     : bluetooth::hci::ScanEnable::NO_SCANS;
+
   send_event_(bluetooth::hci::ReadScanEnableCompleteBuilder::Create(
-      kNumCommandPackets, ErrorCode::SUCCESS, gd_hci::ScanEnable::NO_SCANS));
+      kNumCommandPackets, ErrorCode::SUCCESS, scan_enable));
 }
 
 void DualModeController::WriteScanEnable(CommandView command) {
@@ -1438,8 +1821,7 @@
   bool page_scan = scan_enable == gd_hci::ScanEnable::INQUIRY_AND_PAGE_SCAN ||
                    scan_enable == gd_hci::ScanEnable::PAGE_SCAN_ONLY;
 
-  LOG_INFO("%s | WriteScanEnable %s",
-           properties_.GetAddress().ToString().c_str(),
+  LOG_INFO("%s | WriteScanEnable %s", GetAddress().ToString().c_str(),
            gd_hci::ScanEnableText(scan_enable).c_str());
 
   link_layer_controller_.SetInquiryScanEnable(inquiry_scan);
@@ -1453,7 +1835,7 @@
       gd_hci::DiscoveryCommandView::Create(command));
   ASSERT(command_view.IsValid());
   auto enabled = bluetooth::hci::Enable::DISABLED;
-  if (properties_.GetSynchronousFlowControl()) {
+  if (link_layer_controller_.GetScoFlowControlEnable()) {
     enabled = bluetooth::hci::Enable::ENABLED;
   }
   send_event_(
@@ -1467,7 +1849,7 @@
       gd_hci::DiscoveryCommandView::Create(command));
   ASSERT(command_view.IsValid());
   auto enabled = command_view.GetEnable() == bluetooth::hci::Enable::ENABLED;
-  properties_.SetSynchronousFlowControl(enabled);
+  link_layer_controller_.SetScoFlowControlEnable(enabled);
   send_event_(
       bluetooth::hci::WriteSynchronousFlowControlEnableCompleteBuilder::Create(
           kNumCommandPackets, ErrorCode::SUCCESS));
@@ -1535,6 +1917,9 @@
 }
 
 void DualModeController::LinkKeyRequestReply(CommandView command) {
+#ifdef ROOTCANAL_LMP
+  link_layer_controller_.ForwardToLm(command);
+#else
   auto command_view = gd_hci::LinkKeyRequestReplyView::Create(
       gd_hci::SecurityCommandView::Create(command));
   ASSERT(command_view.IsValid());
@@ -1543,9 +1928,13 @@
   auto status = link_layer_controller_.LinkKeyRequestReply(addr, key);
   send_event_(bluetooth::hci::LinkKeyRequestReplyCompleteBuilder::Create(
       kNumCommandPackets, status, addr));
+#endif /* ROOTCANAL_LMP */
 }
 
 void DualModeController::LinkKeyRequestNegativeReply(CommandView command) {
+#ifdef ROOTCANAL_LMP
+  link_layer_controller_.ForwardToLm(command);
+#else
   auto command_view = gd_hci::LinkKeyRequestNegativeReplyView::Create(
       gd_hci::SecurityCommandView::Create(command));
   ASSERT(command_view.IsValid());
@@ -1554,6 +1943,7 @@
   send_event_(
       bluetooth::hci::LinkKeyRequestNegativeReplyCompleteBuilder::Create(
           kNumCommandPackets, status, addr));
+#endif /* ROOTCANAL_LMP */
 }
 
 void DualModeController::DeleteStoredLinkKey(CommandView command) {
@@ -1566,11 +1956,15 @@
   auto flag = command_view.GetDeleteAllFlag();
   if (flag == gd_hci::DeleteStoredLinkKeyDeleteAllFlag::SPECIFIED_BD_ADDR) {
     Address addr = command_view.GetBdAddr();
+#ifndef ROOTCANAL_LMP
     deleted_keys = security_manager_.DeleteKey(addr);
+#endif /* !ROOTCANAL_LMP */
   }
 
   if (flag == gd_hci::DeleteStoredLinkKeyDeleteAllFlag::ALL) {
+#ifndef ROOTCANAL_LMP
     security_manager_.DeleteAllKeys();
+#endif /* !ROOTCANAL_LMP */
   }
 
   send_event_(bluetooth::hci::DeleteStoredLinkKeyCompleteBuilder::Create(
@@ -1585,7 +1979,8 @@
   Address remote_addr = command_view.GetBdAddr();
 
   auto status = link_layer_controller_.SendCommandToRemoteByAddress(
-      OpCode::REMOTE_NAME_REQUEST, command_view.GetPayload(), remote_addr);
+      OpCode::REMOTE_NAME_REQUEST, command_view.GetPayload(), GetAddress(),
+      remote_addr);
 
   send_event_(bluetooth::hci::RemoteNameRequestStatusBuilder::Create(
       status, kNumCommandPackets));
@@ -1594,7 +1989,7 @@
 void DualModeController::LeSetEventMask(CommandView command) {
   auto command_view = gd_hci::LeSetEventMaskView::Create(command);
   ASSERT(command_view.IsValid());
-  properties_.SetLeEventMask(command_view.GetLeEventMask());
+  link_layer_controller_.SetLeEventMask(command_view.GetLeEventMask());
   send_event_(bluetooth::hci::LeSetEventMaskCompleteBuilder::Create(
       kNumCommandPackets, ErrorCode::SUCCESS));
 }
@@ -1603,19 +1998,11 @@
   auto command_view = gd_hci::LeSetHostFeatureView::Create(command);
   ASSERT(command_view.IsValid());
 
-  ErrorCode error_code = ErrorCode::SUCCESS;
-  if (link_layer_controller_.HasAclConnection()) {
-    error_code = ErrorCode::COMMAND_DISALLOWED;
-  } else {
-    bool bit_was_set = properties_.SetLeHostFeature(
-        static_cast<uint8_t>(command_view.GetBitNumber()),
-        static_cast<uint8_t>(command_view.GetBitValue()));
-    if (!bit_was_set) {
-      error_code = ErrorCode::UNSUPPORTED_FEATURE_OR_PARAMETER_VALUE;
-    }
-  }
+  ErrorCode status = link_layer_controller_.LeSetHostFeature(
+      static_cast<uint8_t>(command_view.GetBitNumber()),
+      static_cast<uint8_t>(command_view.GetBitValue()));
   send_event_(bluetooth::hci::LeSetHostFeatureCompleteBuilder::Create(
-      kNumCommandPackets, error_code));
+      kNumCommandPackets, status));
 }
 
 void DualModeController::LeReadBufferSize(CommandView command) {
@@ -1623,8 +2010,9 @@
   ASSERT(command_view.IsValid());
 
   bluetooth::hci::LeBufferSize le_buffer_size;
-  le_buffer_size.le_data_packet_length_ = properties_.GetLeDataPacketLength();
-  le_buffer_size.total_num_le_packets_ = properties_.GetTotalNumLeDataPackets();
+  le_buffer_size.le_data_packet_length_ = properties_.le_acl_data_packet_length;
+  le_buffer_size.total_num_le_packets_ =
+      properties_.total_num_le_acl_data_packets;
 
   send_event_(bluetooth::hci::LeReadBufferSizeV1CompleteBuilder::Create(
       kNumCommandPackets, ErrorCode::SUCCESS, le_buffer_size));
@@ -1635,12 +2023,13 @@
   ASSERT(command_view.IsValid());
 
   bluetooth::hci::LeBufferSize le_buffer_size;
-  le_buffer_size.le_data_packet_length_ = properties_.GetLeDataPacketLength();
-  le_buffer_size.total_num_le_packets_ = properties_.GetTotalNumLeDataPackets();
+  le_buffer_size.le_data_packet_length_ = properties_.le_acl_data_packet_length;
+  le_buffer_size.total_num_le_packets_ =
+      properties_.total_num_le_acl_data_packets;
   bluetooth::hci::LeBufferSize iso_buffer_size;
-  iso_buffer_size.le_data_packet_length_ = properties_.GetIsoDataPacketLength();
+  iso_buffer_size.le_data_packet_length_ = properties_.iso_data_packet_length;
   iso_buffer_size.total_num_le_packets_ =
-      properties_.GetTotalNumIsoDataPackets();
+      properties_.total_num_iso_data_packets;
 
   send_event_(bluetooth::hci::LeReadBufferSizeV2CompleteBuilder::Create(
       kNumCommandPackets, ErrorCode::SUCCESS, le_buffer_size, iso_buffer_size));
@@ -1651,7 +2040,7 @@
       gd_hci::LeSecurityCommandView::Create(
           gd_hci::SecurityCommandView::Create(command)));
   ASSERT(command_view.IsValid());
-  auto status = link_layer_controller_.LeSetAddressResolutionEnable(
+  ErrorCode status = link_layer_controller_.LeSetAddressResolutionEnable(
       command_view.GetAddressResolutionEnable() ==
       bluetooth::hci::Enable::ENABLED);
   send_event_(
@@ -1659,59 +2048,55 @@
           kNumCommandPackets, status));
 }
 
-void DualModeController::LeSetResovalablePrivateAddressTimeout(
+void DualModeController::LeSetResolvablePrivateAddressTimeout(
     CommandView command) {
-  // NOP
-  auto payload =
-      std::make_unique<bluetooth::packet::RawBuilder>(std::vector<uint8_t>(
-          {static_cast<uint8_t>(bluetooth::hci::ErrorCode::SUCCESS)}));
-  send_event_(bluetooth::hci::CommandCompleteBuilder::Create(
-      kNumCommandPackets, command.GetOpCode(), std::move(payload)));
+  auto command_view =
+      bluetooth::hci::LeSetResolvablePrivateAddressTimeoutView::Create(
+          bluetooth::hci::LeSecurityCommandView::Create(command));
+  ASSERT(command_view.IsValid());
+  ErrorCode status =
+      link_layer_controller_.LeSetResolvablePrivateAddressTimeout(
+          command_view.GetRpaTimeout());
+  send_event_(
+      bluetooth::hci::LeSetResolvablePrivateAddressTimeoutCompleteBuilder::
+          Create(kNumCommandPackets, status));
 }
 
 void DualModeController::LeReadLocalSupportedFeatures(CommandView command) {
   auto command_view = gd_hci::LeReadLocalSupportedFeaturesView::Create(command);
   ASSERT(command_view.IsValid());
-  LOG_INFO(
-      "%s | LeReadLocalSupportedFeatures (%016llx)",
-      properties_.GetAddress().ToString().c_str(),
-      static_cast<unsigned long long>(properties_.GetLeSupportedFeatures()));
+  LOG_INFO("%s | LeReadLocalSupportedFeatures (%016llx)",
+           GetAddress().ToString().c_str(),
+           static_cast<unsigned long long>(properties_.le_features));
 
   send_event_(
       bluetooth::hci::LeReadLocalSupportedFeaturesCompleteBuilder::Create(
-          kNumCommandPackets, ErrorCode::SUCCESS,
-          properties_.GetLeSupportedFeatures()));
+          kNumCommandPackets, ErrorCode::SUCCESS, properties_.le_features));
 }
 
 void DualModeController::LeSetRandomAddress(CommandView command) {
   auto command_view = gd_hci::LeSetRandomAddressView::Create(
       gd_hci::LeAdvertisingCommandView::Create(command));
   ASSERT(command_view.IsValid());
-  properties_.SetLeAddress(command_view.GetRandomAddress());
+  ErrorCode status = link_layer_controller_.LeSetRandomAddress(
+      command_view.GetRandomAddress());
   send_event_(bluetooth::hci::LeSetRandomAddressCompleteBuilder::Create(
-      kNumCommandPackets, ErrorCode::SUCCESS));
+      kNumCommandPackets, status));
 }
 
 void DualModeController::LeSetAdvertisingParameters(CommandView command) {
   auto command_view = gd_hci::LeSetAdvertisingParametersView::Create(
       gd_hci::LeAdvertisingCommandView::Create(command));
   ASSERT(command_view.IsValid());
-  auto peer_address = command_view.GetPeerAddress();
-  auto type = command_view.GetAdvtType();
-  if (type != bluetooth::hci::AdvertisingType::ADV_DIRECT_IND &&
-      type != bluetooth::hci::AdvertisingType::ADV_DIRECT_IND_LOW) {
-    peer_address = Address::kEmpty;
-  }
-  properties_.SetLeAdvertisingParameters(
-      command_view.GetIntervalMin(), command_view.GetIntervalMax(),
-      static_cast<uint8_t>(type),
-      static_cast<uint8_t>(command_view.GetOwnAddressType()),
-      static_cast<uint8_t>(command_view.GetPeerAddressType()), peer_address,
-      command_view.GetChannelMap(),
-      static_cast<uint8_t>(command_view.GetFilterPolicy()));
-
+  ErrorCode status = link_layer_controller_.LeSetAdvertisingParameters(
+      command_view.GetAdvertisingIntervalMin(),
+      command_view.GetAdvertisingIntervalMax(),
+      command_view.GetAdvertisingType(), command_view.GetOwnAddressType(),
+      command_view.GetPeerAddressType(), command_view.GetPeerAddress(),
+      command_view.GetAdvertisingChannelMap(),
+      command_view.GetAdvertisingFilterPolicy());
   send_event_(bluetooth::hci::LeSetAdvertisingParametersCompleteBuilder::Create(
-      kNumCommandPackets, ErrorCode::SUCCESS));
+      kNumCommandPackets, status));
 }
 
 void DualModeController::LeReadAdvertisingPhysicalChannelTxPower(
@@ -1723,7 +2108,7 @@
   send_event_(
       bluetooth::hci::LeReadAdvertisingPhysicalChannelTxPowerCompleteBuilder::
           Create(kNumCommandPackets, ErrorCode::SUCCESS,
-                 properties_.GetLeAdvertisingPhysicalChannelTxPower()));
+                 properties_.le_advertising_physical_channel_tx_power));
 }
 
 void DualModeController::LeSetAdvertisingData(CommandView command) {
@@ -1732,13 +2117,14 @@
   auto payload = command.GetPayload();
   auto data_size = *payload.begin();
   auto first_data = payload.begin() + 1;
-  std::vector<uint8_t> payload_bytes{first_data, first_data + data_size};
+  std::vector<uint8_t> advertising_data{first_data, first_data + data_size};
   ASSERT_LOG(command_view.IsValid(), "%s command.size() = %zu",
              gd_hci::OpCodeText(command.GetOpCode()).c_str(), command.size());
   ASSERT(command_view.GetPayload().size() == 32);
-  properties_.SetLeAdvertisement(payload_bytes);
+  ErrorCode status =
+      link_layer_controller_.LeSetAdvertisingData(advertising_data);
   send_event_(bluetooth::hci::LeSetAdvertisingDataCompleteBuilder::Create(
-      kNumCommandPackets, ErrorCode::SUCCESS));
+      kNumCommandPackets, status));
 }
 
 void DualModeController::LeSetScanResponseData(CommandView command) {
@@ -1746,10 +2132,11 @@
       gd_hci::LeAdvertisingCommandView::Create(command));
   ASSERT(command_view.IsValid());
   ASSERT(command_view.GetPayload().size() == 32);
-  properties_.SetLeScanResponse(std::vector<uint8_t>(
-      command_view.GetPayload().begin() + 1, command_view.GetPayload().end()));
+  ErrorCode status = link_layer_controller_.LeSetScanResponseData(
+      std::vector<uint8_t>(command_view.GetPayload().begin() + 1,
+                           command_view.GetPayload().end()));
   send_event_(bluetooth::hci::LeSetScanResponseDataCompleteBuilder::Create(
-      kNumCommandPackets, ErrorCode::SUCCESS));
+      kNumCommandPackets, status));
 }
 
 void DualModeController::LeSetAdvertisingEnable(CommandView command) {
@@ -1757,11 +2144,10 @@
       gd_hci::LeAdvertisingCommandView::Create(command));
   ASSERT(command_view.IsValid());
 
-  LOG_INFO("%s | LeSetAdvertisingEnable (%d)",
-           properties_.GetAddress().ToString().c_str(),
+  LOG_INFO("%s | LeSetAdvertisingEnable (%d)", GetAddress().ToString().c_str(),
            command_view.GetAdvertisingEnable() == gd_hci::Enable::ENABLED);
 
-  auto status = link_layer_controller_.SetLeAdvertisingEnable(
+  ErrorCode status = link_layer_controller_.LeSetAdvertisingEnable(
       command_view.GetAdvertisingEnable() == gd_hci::Enable::ENABLED);
   send_event_(bluetooth::hci::LeSetAdvertisingEnableCompleteBuilder::Create(
       kNumCommandPackets, status));
@@ -1771,15 +2157,13 @@
   auto command_view = gd_hci::LeSetScanParametersView::Create(
       gd_hci::LeScanningCommandView::Create(command));
   ASSERT(command_view.IsValid());
-  link_layer_controller_.SetLeScanType(
-      static_cast<uint8_t>(command_view.GetLeScanType()));
-  link_layer_controller_.SetLeScanInterval(command_view.GetLeScanInterval());
-  link_layer_controller_.SetLeScanWindow(command_view.GetLeScanWindow());
-  link_layer_controller_.SetLeAddressType(command_view.GetOwnAddressType());
-  link_layer_controller_.SetLeScanFilterPolicy(
-      static_cast<uint8_t>(command_view.GetScanningFilterPolicy()));
+
+  ErrorCode status = link_layer_controller_.LeSetScanParameters(
+      command_view.GetLeScanType(), command_view.GetLeScanInterval(),
+      command_view.GetLeScanWindow(), command_view.GetOwnAddressType(),
+      command_view.GetScanningFilterPolicy());
   send_event_(bluetooth::hci::LeSetScanParametersCompleteBuilder::Create(
-      kNumCommandPackets, ErrorCode::SUCCESS));
+      kNumCommandPackets, status));
 }
 
 void DualModeController::LeSetScanEnable(CommandView command) {
@@ -1787,19 +2171,14 @@
       gd_hci::LeScanningCommandView::Create(command));
   ASSERT(command_view.IsValid());
 
-  LOG_INFO("%s | LeSetScanEnable (%d)",
-           properties_.GetAddress().ToString().c_str(),
+  LOG_INFO("%s | LeSetScanEnable (%d)", GetAddress().ToString().c_str(),
            command_view.GetLeScanEnable() == gd_hci::Enable::ENABLED);
 
-  if (command_view.GetLeScanEnable() == gd_hci::Enable::ENABLED) {
-    link_layer_controller_.SetLeScanEnable(gd_hci::OpCode::LE_SET_SCAN_ENABLE);
-  } else {
-    link_layer_controller_.SetLeScanEnable(gd_hci::OpCode::NONE);
-  }
-  link_layer_controller_.SetLeFilterDuplicates(
+  ErrorCode status = link_layer_controller_.LeSetScanEnable(
+      command_view.GetLeScanEnable() == gd_hci::Enable::ENABLED,
       command_view.GetFilterDuplicates() == gd_hci::Enable::ENABLED);
   send_event_(bluetooth::hci::LeSetScanEnableCompleteBuilder::Create(
-      kNumCommandPackets, ErrorCode::SUCCESS));
+      kNumCommandPackets, status));
 }
 
 void DualModeController::LeCreateConnection(CommandView command) {
@@ -1807,38 +2186,31 @@
       gd_hci::LeConnectionManagementCommandView::Create(
           gd_hci::AclCommandView::Create(command)));
   ASSERT(command_view.IsValid());
-  link_layer_controller_.SetLeScanInterval(command_view.GetLeScanInterval());
-  link_layer_controller_.SetLeScanWindow(command_view.GetLeScanWindow());
-  uint8_t initiator_filter_policy =
-      static_cast<uint8_t>(command_view.GetInitiatorFilterPolicy());
-  link_layer_controller_.SetLeInitiatorFilterPolicy(initiator_filter_policy);
-
-  if (initiator_filter_policy == 0) {  // Connect list not used
-    uint8_t peer_address_type =
-        static_cast<uint8_t>(command_view.GetPeerAddressType());
-    Address peer_address = command_view.GetPeerAddress();
-    link_layer_controller_.SetLePeerAddressType(peer_address_type);
-    link_layer_controller_.SetLePeerAddress(peer_address);
-  }
-  link_layer_controller_.SetLeAddressType(command_view.GetOwnAddressType());
-  link_layer_controller_.SetLeConnectionIntervalMin(
-      command_view.GetConnIntervalMin());
-  link_layer_controller_.SetLeConnectionIntervalMax(
-      command_view.GetConnIntervalMax());
-  link_layer_controller_.SetLeConnectionLatency(command_view.GetConnLatency());
-  link_layer_controller_.SetLeSupervisionTimeout(
-      command_view.GetSupervisionTimeout());
-  link_layer_controller_.SetLeMinimumCeLength(
-      command_view.GetMinimumCeLength());
-  link_layer_controller_.SetLeMaximumCeLength(
+  ErrorCode status = link_layer_controller_.LeCreateConnection(
+      command_view.GetLeScanInterval(), command_view.GetLeScanWindow(),
+      command_view.GetInitiatorFilterPolicy(),
+      AddressWithType{
+          command_view.GetPeerAddress(),
+          command_view.GetPeerAddressType(),
+      },
+      command_view.GetOwnAddressType(), command_view.GetConnIntervalMin(),
+      command_view.GetConnIntervalMax(), command_view.GetConnLatency(),
+      command_view.GetSupervisionTimeout(), command_view.GetMinimumCeLength(),
       command_view.GetMaximumCeLength());
-
-  auto status = link_layer_controller_.SetLeConnect(true);
-
   send_event_(bluetooth::hci::LeCreateConnectionStatusBuilder::Create(
       status, kNumCommandPackets));
 }
 
+void DualModeController::LeCreateConnectionCancel(CommandView command) {
+  auto command_view = gd_hci::LeCreateConnectionCancelView::Create(
+      gd_hci::LeConnectionManagementCommandView::Create(
+          gd_hci::AclCommandView::Create(command)));
+  ASSERT(command_view.IsValid());
+  ErrorCode status = link_layer_controller_.LeCreateConnectionCancel();
+  send_event_(bluetooth::hci::LeCreateConnectionCancelCompleteBuilder::Create(
+      kNumCommandPackets, status));
+}
+
 void DualModeController::LeConnectionUpdate(CommandView command) {
   auto command_view = gd_hci::LeConnectionUpdateView::Create(
       gd_hci::LeConnectionManagementCommandView::Create(
@@ -1898,32 +2270,14 @@
   ASSERT(command_view.IsValid());
 
   uint16_t handle = command_view.GetConnectionHandle();
-  uint8_t reason = static_cast<uint8_t>(command_view.GetReason());
 
-  auto status = link_layer_controller_.Disconnect(handle, reason);
+  auto status = link_layer_controller_.Disconnect(
+      handle, ErrorCode(command_view.GetReason()));
 
   send_event_(bluetooth::hci::DisconnectStatusBuilder::Create(
       status, kNumCommandPackets));
 }
 
-void DualModeController::LeConnectionCancel(CommandView command) {
-  auto command_view = gd_hci::LeCreateConnectionCancelView::Create(
-      gd_hci::LeConnectionManagementCommandView::Create(
-          gd_hci::AclCommandView::Create(command)));
-  ASSERT(command_view.IsValid());
-  ErrorCode status = link_layer_controller_.SetLeConnect(false);
-  send_event_(bluetooth::hci::LeCreateConnectionCancelCompleteBuilder::Create(
-      kNumCommandPackets, status));
-
-  send_event_(bluetooth::hci::LeConnectionCompleteBuilder::Create(
-      ErrorCode::UNKNOWN_CONNECTION, kReservedHandle,
-      bluetooth::hci::Role::CENTRAL,
-      bluetooth::hci::AddressType::PUBLIC_DEVICE_ADDRESS,
-      bluetooth::hci::Address(), 1 /* connection_interval */,
-      2 /* connection_latency */, 3 /* supervision_timeout*/,
-      static_cast<bluetooth::hci::ClockAccuracy>(0x00)));
-}
-
 void DualModeController::LeReadFilterAcceptListSize(CommandView command) {
   auto command_view = gd_hci::LeReadFilterAcceptListSizeView::Create(
       gd_hci::LeConnectionManagementCommandView::Create(
@@ -1931,7 +2285,7 @@
   ASSERT(command_view.IsValid());
   send_event_(bluetooth::hci::LeReadFilterAcceptListSizeCompleteBuilder::Create(
       kNumCommandPackets, ErrorCode::SUCCESS,
-      properties_.GetLeFilterAcceptListSize()));
+      properties_.le_filter_accept_list_size));
 }
 
 void DualModeController::LeClearFilterAcceptList(CommandView command) {
@@ -1939,9 +2293,9 @@
       gd_hci::LeConnectionManagementCommandView::Create(
           gd_hci::AclCommandView::Create(command)));
   ASSERT(command_view.IsValid());
-  link_layer_controller_.LeFilterAcceptListClear();
+  ErrorCode status = link_layer_controller_.LeClearFilterAcceptList();
   send_event_(bluetooth::hci::LeClearFilterAcceptListCompleteBuilder::Create(
-      kNumCommandPackets, ErrorCode::SUCCESS));
+      kNumCommandPackets, status));
 }
 
 void DualModeController::LeAddDeviceToFilterAcceptList(CommandView command) {
@@ -1949,17 +2303,11 @@
       gd_hci::LeConnectionManagementCommandView::Create(
           gd_hci::AclCommandView::Create(command)));
   ASSERT(command_view.IsValid());
-
-  ErrorCode result = ErrorCode::INVALID_HCI_COMMAND_PARAMETERS;
-  if (command_view.GetAddressType() !=
-      bluetooth::hci::FilterAcceptListAddressType::ANONYMOUS_ADVERTISERS) {
-    result = link_layer_controller_.LeFilterAcceptListAddDevice(
-        command_view.GetAddress(), static_cast<bluetooth::hci::AddressType>(
-                                       command_view.GetAddressType()));
-  }
+  ErrorCode status = link_layer_controller_.LeAddDeviceToFilterAcceptList(
+      command_view.GetAddressType(), command_view.GetAddress());
   send_event_(
       bluetooth::hci::LeAddDeviceToFilterAcceptListCompleteBuilder::Create(
-          kNumCommandPackets, result));
+          kNumCommandPackets, status));
 }
 
 void DualModeController::LeRemoveDeviceFromFilterAcceptList(
@@ -1968,16 +2316,8 @@
       gd_hci::LeConnectionManagementCommandView::Create(
           gd_hci::AclCommandView::Create(command)));
   ASSERT(command_view.IsValid());
-
-  ErrorCode status = ErrorCode::SUCCESS;
-  if (command_view.GetAddressType() !=
-      bluetooth::hci::FilterAcceptListAddressType::ANONYMOUS_ADVERTISERS) {
-    link_layer_controller_.LeFilterAcceptListAddDevice(
-        command_view.GetAddress(), static_cast<bluetooth::hci::AddressType>(
-                                       command_view.GetAddressType()));
-  } else {
-    status = ErrorCode::INVALID_HCI_COMMAND_PARAMETERS;
-  }
+  ErrorCode status = link_layer_controller_.LeRemoveDeviceFromFilterAcceptList(
+      command_view.GetAddressType(), command_view.GetAddress());
   send_event_(
       bluetooth::hci::LeRemoveDeviceFromFilterAcceptListCompleteBuilder::Create(
           kNumCommandPackets, status));
@@ -1987,9 +2327,9 @@
   auto command_view = gd_hci::LeClearResolvingListView::Create(
       gd_hci::LeSecurityCommandView::Create(command));
   ASSERT(command_view.IsValid());
-  link_layer_controller_.LeResolvingListClear();
+  ErrorCode status = link_layer_controller_.LeClearResolvingList();
   send_event_(bluetooth::hci::LeClearResolvingListCompleteBuilder::Create(
-      kNumCommandPackets, ErrorCode::SUCCESS));
+      kNumCommandPackets, status));
 }
 
 void DualModeController::LeReadResolvingListSize(CommandView command) {
@@ -1998,7 +2338,7 @@
   ASSERT(command_view.IsValid());
   send_event_(bluetooth::hci::LeReadResolvingListSizeCompleteBuilder::Create(
       kNumCommandPackets, ErrorCode::SUCCESS,
-      properties_.GetLeResolvingListSize()));
+      properties_.le_resolving_list_size));
 }
 
 void DualModeController::LeReadMaximumDataLength(CommandView command) {
@@ -2022,7 +2362,8 @@
   send_event_(
       bluetooth::hci::LeReadSuggestedDefaultDataLengthCompleteBuilder::Create(
           kNumCommandPackets, ErrorCode::SUCCESS,
-          le_suggested_default_data_bytes_, le_suggested_default_data_time_));
+          link_layer_controller_.GetLeSuggestedMaxTxOctets(),
+          link_layer_controller_.GetLeSuggestedMaxTxTime()));
 }
 
 void DualModeController::LeWriteSuggestedDefaultDataLength(
@@ -2031,38 +2372,31 @@
       gd_hci::LeConnectionManagementCommandView::Create(
           gd_hci::AclCommandView::Create(command)));
   ASSERT(command_view.IsValid());
-  uint16_t bytes = command_view.GetTxOctets();
-  uint16_t time = command_view.GetTxTime();
-  if (bytes > 0xFB || bytes < 0x1B || time < 0x148 || time > 0x4290) {
-    send_event_(
-        bluetooth::hci::LeWriteSuggestedDefaultDataLengthCompleteBuilder::
-            Create(kNumCommandPackets,
-                   ErrorCode::INVALID_HCI_COMMAND_PARAMETERS));
-    return;
+
+  uint16_t max_tx_octets = command_view.GetTxOctets();
+  uint16_t max_tx_time = command_view.GetTxTime();
+  ErrorCode status = ErrorCode::SUCCESS;
+  if (max_tx_octets > 0xFB || max_tx_octets < 0x1B || max_tx_time < 0x148 ||
+      max_tx_time > 0x4290) {
+    status = ErrorCode::INVALID_HCI_COMMAND_PARAMETERS;
+  } else {
+    link_layer_controller_.SetLeSuggestedMaxTxOctets(max_tx_octets);
+    link_layer_controller_.SetLeSuggestedMaxTxTime(max_tx_time);
   }
-  le_suggested_default_data_bytes_ = bytes;
-  le_suggested_default_data_time_ = time;
+
   send_event_(
       bluetooth::hci::LeWriteSuggestedDefaultDataLengthCompleteBuilder::Create(
-          kNumCommandPackets, ErrorCode::SUCCESS));
+          kNumCommandPackets, status));
 }
 
 void DualModeController::LeAddDeviceToResolvingList(CommandView command) {
   auto command_view = gd_hci::LeAddDeviceToResolvingListView::Create(
       gd_hci::LeSecurityCommandView::Create(command));
   ASSERT(command_view.IsValid());
-  AddressType peer_address_type;
-  switch (command_view.GetPeerIdentityAddressType()) {
-    case bluetooth::hci::PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS:
-      peer_address_type = AddressType::PUBLIC_DEVICE_ADDRESS;
-      break;
-    case bluetooth::hci::PeerAddressType::RANDOM_DEVICE_OR_IDENTITY_ADDRESS:
-      peer_address_type = AddressType::RANDOM_DEVICE_ADDRESS;
-      break;
-  }
-  auto status = link_layer_controller_.LeResolvingListAddDevice(
-      command_view.GetPeerIdentityAddress(), peer_address_type,
-      command_view.GetPeerIrk(), command_view.GetLocalIrk());
+  ErrorCode status = link_layer_controller_.LeAddDeviceToResolvingList(
+      command_view.GetPeerIdentityAddressType(),
+      command_view.GetPeerIdentityAddress(), command_view.GetPeerIrk(),
+      command_view.GetLocalIrk());
   send_event_(bluetooth::hci::LeAddDeviceToResolvingListCompleteBuilder::Create(
       kNumCommandPackets, status));
 }
@@ -2071,44 +2405,21 @@
   auto command_view = gd_hci::LeRemoveDeviceFromResolvingListView::Create(
       gd_hci::LeSecurityCommandView::Create(command));
   ASSERT(command_view.IsValid());
-
-  AddressType peer_address_type;
-  switch (command_view.GetPeerIdentityAddressType()) {
-    case bluetooth::hci::PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS:
-      peer_address_type = AddressType::PUBLIC_DEVICE_ADDRESS;
-      break;
-    case bluetooth::hci::PeerAddressType::RANDOM_DEVICE_OR_IDENTITY_ADDRESS:
-      peer_address_type = AddressType::RANDOM_DEVICE_ADDRESS;
-      break;
-  }
-  link_layer_controller_.LeResolvingListRemoveDevice(
-      command_view.GetPeerIdentityAddress(), peer_address_type);
+  ErrorCode status = link_layer_controller_.LeRemoveDeviceFromResolvingList(
+      command_view.GetPeerIdentityAddressType(),
+      command_view.GetPeerIdentityAddress());
   send_event_(
       bluetooth::hci::LeRemoveDeviceFromResolvingListCompleteBuilder::Create(
-          kNumCommandPackets, ErrorCode::SUCCESS));
+          kNumCommandPackets, status));
 }
 
 void DualModeController::LeSetExtendedScanParameters(CommandView command) {
   auto command_view = gd_hci::LeSetExtendedScanParametersView::Create(
       gd_hci::LeScanningCommandView::Create(command));
   ASSERT(command_view.IsValid());
-  auto parameters = command_view.GetParameters();
-  // Multiple phys are not supported.
-  ASSERT(command_view.GetScanningPhys() == 1);
-  ASSERT(parameters.size() == 1);
-
-  auto status = ErrorCode::SUCCESS;
-  if (link_layer_controller_.GetLeScanEnable() == OpCode::NONE) {
-    link_layer_controller_.SetLeScanType(
-        static_cast<uint8_t>(parameters[0].le_scan_type_));
-    link_layer_controller_.SetLeScanInterval(parameters[0].le_scan_interval_);
-    link_layer_controller_.SetLeScanWindow(parameters[0].le_scan_window_);
-    link_layer_controller_.SetLeAddressType(command_view.GetOwnAddressType());
-    link_layer_controller_.SetLeScanFilterPolicy(
-        static_cast<uint8_t>(command_view.GetScanningFilterPolicy()));
-  } else {
-    status = ErrorCode::COMMAND_DISALLOWED;
-  }
+  ErrorCode status = link_layer_controller_.LeSetExtendedScanParameters(
+      command_view.GetOwnAddressType(), command_view.GetScanningFilterPolicy(),
+      command_view.GetScanningPhys(), command_view.GetParameters());
   send_event_(
       bluetooth::hci::LeSetExtendedScanParametersCompleteBuilder::Create(
           kNumCommandPackets, status));
@@ -2118,16 +2429,12 @@
   auto command_view = gd_hci::LeSetExtendedScanEnableView::Create(
       gd_hci::LeScanningCommandView::Create(command));
   ASSERT(command_view.IsValid());
-  if (command_view.GetEnable() == gd_hci::Enable::ENABLED) {
-    link_layer_controller_.SetLeScanEnable(
-        gd_hci::OpCode::LE_SET_EXTENDED_SCAN_ENABLE);
-  } else {
-    link_layer_controller_.SetLeScanEnable(gd_hci::OpCode::NONE);
-  }
-  link_layer_controller_.SetLeFilterDuplicates(
-      command_view.GetFilterDuplicates() == gd_hci::FilterDuplicates::ENABLED);
+  ErrorCode status = link_layer_controller_.LeSetExtendedScanEnable(
+      command_view.GetEnable() == gd_hci::Enable::ENABLED,
+      command_view.GetFilterDuplicates(), command_view.GetDuration(),
+      command_view.GetPeriod());
   send_event_(bluetooth::hci::LeSetExtendedScanEnableCompleteBuilder::Create(
-      kNumCommandPackets, ErrorCode::SUCCESS));
+      kNumCommandPackets, status));
 }
 
 void DualModeController::LeExtendedCreateConnection(CommandView command) {
@@ -2135,33 +2442,13 @@
       gd_hci::LeConnectionManagementCommandView::Create(
           gd_hci::AclCommandView::Create(command)));
   ASSERT(command_view.IsValid());
-  ASSERT_LOG(command_view.GetInitiatingPhys() == 1, "Only LE_1M is supported");
-  auto params = command_view.GetPhyScanParameters();
-  link_layer_controller_.SetLeScanInterval(params[0].scan_interval_);
-  link_layer_controller_.SetLeScanWindow(params[0].scan_window_);
-  auto initiator_filter_policy = command_view.GetInitiatorFilterPolicy();
-  link_layer_controller_.SetLeInitiatorFilterPolicy(
-      static_cast<uint8_t>(initiator_filter_policy));
-
-  if (initiator_filter_policy ==
-      gd_hci::InitiatorFilterPolicy::USE_PEER_ADDRESS) {
-    link_layer_controller_.SetLePeerAddressType(
-        static_cast<uint8_t>(command_view.GetPeerAddressType()));
-    link_layer_controller_.SetLePeerAddress(command_view.GetPeerAddress());
-  }
-  link_layer_controller_.SetLeAddressType(command_view.GetOwnAddressType());
-  link_layer_controller_.SetLeConnectionIntervalMin(
-      params[0].conn_interval_min_);
-  link_layer_controller_.SetLeConnectionIntervalMax(
-      params[0].conn_interval_max_);
-  link_layer_controller_.SetLeConnectionLatency(params[0].conn_latency_);
-  link_layer_controller_.SetLeSupervisionTimeout(
-      params[0].supervision_timeout_);
-  link_layer_controller_.SetLeMinimumCeLength(params[0].min_ce_length_);
-  link_layer_controller_.SetLeMaximumCeLength(params[0].max_ce_length_);
-
-  auto status = link_layer_controller_.SetLeConnect(true);
-
+  ErrorCode status = link_layer_controller_.LeExtendedCreateConnection(
+      command_view.GetInitiatorFilterPolicy(), command_view.GetOwnAddressType(),
+      AddressWithType{
+          command_view.GetPeerAddress(),
+          command_view.GetPeerAddressType(),
+      },
+      command_view.GetInitiatingPhys(), command_view.GetPhyScanParameters());
   send_event_(bluetooth::hci::LeExtendedCreateConnectionStatusBuilder::Create(
       status, kNumCommandPackets));
 }
@@ -2170,43 +2457,23 @@
   auto command_view = gd_hci::LeSetPrivacyModeView::Create(
       gd_hci::LeSecurityCommandView::Create(command));
   ASSERT(command_view.IsValid());
-
-  Address peer_identity_address = command_view.GetPeerIdentityAddress();
-  uint8_t privacy_mode = static_cast<uint8_t>(command_view.GetPrivacyMode());
-
-  AddressType peer_identity_address_type;
-  switch (command_view.GetPeerIdentityAddressType()) {
-    case bluetooth::hci::PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS:
-      peer_identity_address_type = AddressType::PUBLIC_DEVICE_ADDRESS;
-      break;
-    case bluetooth::hci::PeerAddressType::RANDOM_DEVICE_OR_IDENTITY_ADDRESS:
-      peer_identity_address_type = AddressType::RANDOM_DEVICE_ADDRESS;
-      break;
-  }
-  if (link_layer_controller_.LeResolvingListContainsDevice(
-          peer_identity_address, peer_identity_address_type)) {
-    link_layer_controller_.LeSetPrivacyMode(
-        peer_identity_address_type, peer_identity_address, privacy_mode);
-  }
-
+  ErrorCode status = link_layer_controller_.LeSetPrivacyMode(
+      command_view.GetPeerIdentityAddressType(),
+      command_view.GetPeerIdentityAddress(), command_view.GetPrivacyMode());
   send_event_(bluetooth::hci::LeSetPrivacyModeCompleteBuilder::Create(
-      kNumCommandPackets, ErrorCode::SUCCESS));
+      kNumCommandPackets, status));
 }
 
 void DualModeController::LeReadIsoTxSync(CommandView command) {
-  auto iso_command_view = gd_hci::LeIsoCommandView::Create(command);
-  ASSERT(iso_command_view.IsValid());
-  auto command_view =
-      gd_hci::LeReadIsoTxSyncView::Create(std::move(iso_command_view));
+  auto command_view = gd_hci::LeReadIsoTxSyncView::Create(
+      gd_hci::LeIsoCommandView::Create(command));
   ASSERT(command_view.IsValid());
   link_layer_controller_.LeReadIsoTxSync(command_view.GetConnectionHandle());
 }
 
 void DualModeController::LeSetCigParameters(CommandView command) {
-  auto iso_command_view = gd_hci::LeIsoCommandView::Create(command);
-  ASSERT(iso_command_view.IsValid());
-  auto command_view =
-      gd_hci::LeSetCigParametersView::Create(std::move(iso_command_view));
+  auto command_view = gd_hci::LeSetCigParametersView::Create(
+      gd_hci::LeIsoCommandView::Create(command));
   ASSERT(command_view.IsValid());
   link_layer_controller_.LeSetCigParameters(
       command_view.GetCigId(), command_view.GetSduIntervalMToS(),
@@ -2217,10 +2484,8 @@
 }
 
 void DualModeController::LeCreateCis(CommandView command) {
-  auto iso_command_view = gd_hci::LeIsoCommandView::Create(command);
-  ASSERT(iso_command_view.IsValid());
-  auto command_view =
-      gd_hci::LeCreateCisView::Create(std::move(iso_command_view));
+  auto command_view = gd_hci::LeCreateCisView::Create(
+      gd_hci::LeIsoCommandView::Create(command));
   ASSERT(command_view.IsValid());
   ErrorCode status =
       link_layer_controller_.LeCreateCis(command_view.GetCisConfig());
@@ -2229,10 +2494,8 @@
 }
 
 void DualModeController::LeRemoveCig(CommandView command) {
-  auto iso_command_view = gd_hci::LeIsoCommandView::Create(command);
-  ASSERT(iso_command_view.IsValid());
-  auto command_view =
-      gd_hci::LeRemoveCigView::Create(std::move(iso_command_view));
+  auto command_view = gd_hci::LeRemoveCigView::Create(
+      gd_hci::LeIsoCommandView::Create(command));
   ASSERT(command_view.IsValid());
   uint8_t cig = command_view.GetCigId();
   ErrorCode status = link_layer_controller_.LeRemoveCig(cig);
@@ -2241,10 +2504,8 @@
 }
 
 void DualModeController::LeAcceptCisRequest(CommandView command) {
-  auto iso_command_view = gd_hci::LeIsoCommandView::Create(command);
-  ASSERT(iso_command_view.IsValid());
-  auto command_view =
-      gd_hci::LeAcceptCisRequestView::Create(std::move(iso_command_view));
+  auto command_view = gd_hci::LeAcceptCisRequestView::Create(
+      gd_hci::LeIsoCommandView::Create(command));
   ASSERT(command_view.IsValid());
   ErrorCode status = link_layer_controller_.LeAcceptCisRequest(
       command_view.GetConnectionHandle());
@@ -2253,20 +2514,16 @@
 }
 
 void DualModeController::LeRejectCisRequest(CommandView command) {
-  auto iso_command_view = gd_hci::LeIsoCommandView::Create(command);
-  ASSERT(iso_command_view.IsValid());
-  auto command_view =
-      gd_hci::LeRejectCisRequestView::Create(std::move(iso_command_view));
+  auto command_view = gd_hci::LeRejectCisRequestView::Create(
+      gd_hci::LeIsoCommandView::Create(command));
   ASSERT(command_view.IsValid());
   link_layer_controller_.LeRejectCisRequest(command_view.GetConnectionHandle(),
                                             command_view.GetReason());
 }
 
 void DualModeController::LeCreateBig(CommandView command) {
-  auto iso_command_view = gd_hci::LeIsoCommandView::Create(command);
-  ASSERT(iso_command_view.IsValid());
-  auto command_view =
-      gd_hci::LeCreateBigView::Create(std::move(iso_command_view));
+  auto command_view = gd_hci::LeCreateBigView::Create(
+      gd_hci::LeIsoCommandView::Create(command));
   ASSERT(command_view.IsValid());
   ErrorCode status = link_layer_controller_.LeCreateBig(
       command_view.GetBigHandle(), command_view.GetAdvertisingHandle(),
@@ -2280,10 +2537,8 @@
 }
 
 void DualModeController::LeTerminateBig(CommandView command) {
-  auto iso_command_view = gd_hci::LeIsoCommandView::Create(command);
-  ASSERT(iso_command_view.IsValid());
-  auto command_view =
-      gd_hci::LeTerminateBigView::Create(std::move(iso_command_view));
+  auto command_view = gd_hci::LeTerminateBigView::Create(
+      gd_hci::LeIsoCommandView::Create(command));
   ASSERT(command_view.IsValid());
   ErrorCode status = link_layer_controller_.LeTerminateBig(
       command_view.GetBigHandle(), command_view.GetReason());
@@ -2292,10 +2547,8 @@
 }
 
 void DualModeController::LeBigCreateSync(CommandView command) {
-  auto iso_command_view = gd_hci::LeIsoCommandView::Create(command);
-  ASSERT(iso_command_view.IsValid());
-  auto command_view =
-      gd_hci::LeBigCreateSyncView::Create(std::move(iso_command_view));
+  auto command_view = gd_hci::LeBigCreateSyncView::Create(
+      gd_hci::LeIsoCommandView::Create(command));
   ASSERT(command_view.IsValid());
   ErrorCode status = link_layer_controller_.LeBigCreateSync(
       command_view.GetBigHandle(), command_view.GetSyncHandle(),
@@ -2307,16 +2560,14 @@
 }
 
 void DualModeController::LeBigTerminateSync(CommandView command) {
-  auto iso_command_view = gd_hci::LeIsoCommandView::Create(command);
-  ASSERT(iso_command_view.IsValid());
-  auto command_view =
-      gd_hci::LeBigTerminateSyncView::Create(std::move(iso_command_view));
+  auto command_view = gd_hci::LeBigTerminateSyncView::Create(
+      gd_hci::LeIsoCommandView::Create(command));
   ASSERT(command_view.IsValid());
   link_layer_controller_.LeBigTerminateSync(command_view.GetBigHandle());
 }
 
 void DualModeController::LeRequestPeerSca(CommandView command) {
-  auto command_view = gd_hci::LeRequestPeerScaView::Create(std::move(command));
+  auto command_view = gd_hci::LeRequestPeerScaView::Create(command);
   ASSERT(command_view.IsValid());
   ErrorCode status = link_layer_controller_.LeRequestPeerSca(
       command_view.GetConnectionHandle());
@@ -2325,10 +2576,8 @@
 }
 
 void DualModeController::LeSetupIsoDataPath(CommandView command) {
-  auto iso_command_view = gd_hci::LeIsoCommandView::Create(command);
-  ASSERT(iso_command_view.IsValid());
-  auto command_view =
-      gd_hci::LeSetupIsoDataPathView::Create(std::move(iso_command_view));
+  auto command_view = gd_hci::LeSetupIsoDataPathView::Create(
+      gd_hci::LeIsoCommandView::Create(command));
   ASSERT(command_view.IsValid());
   link_layer_controller_.LeSetupIsoDataPath(
       command_view.GetConnectionHandle(), command_view.GetDataPathDirection(),
@@ -2337,10 +2586,8 @@
 }
 
 void DualModeController::LeRemoveIsoDataPath(CommandView command) {
-  auto iso_command_view = gd_hci::LeIsoCommandView::Create(command);
-  ASSERT(iso_command_view.IsValid());
-  auto command_view =
-      gd_hci::LeRemoveIsoDataPathView::Create(std::move(iso_command_view));
+  auto command_view = gd_hci::LeRemoveIsoDataPathView::Create(
+      gd_hci::LeIsoCommandView::Create(command));
   ASSERT(command_view.IsValid());
   link_layer_controller_.LeRemoveIsoDataPath(
       command_view.GetConnectionHandle(),
@@ -2392,8 +2639,7 @@
   auto command_view = gd_hci::LeReadSupportedStatesView::Create(command);
   ASSERT(command_view.IsValid());
   send_event_(bluetooth::hci::LeReadSupportedStatesCompleteBuilder::Create(
-      kNumCommandPackets, ErrorCode::SUCCESS,
-      properties_.GetLeSupportedStates()));
+      kNumCommandPackets, ErrorCode::SUCCESS, properties_.le_supported_states));
 }
 
 void DualModeController::LeRemoteConnectionParameterRequestReply(
@@ -2433,7 +2679,7 @@
   auto command_view = gd_hci::LeGetVendorCapabilitiesView::Create(
       gd_hci::VendorCommandView::Create(command));
   ASSERT(command_view.IsValid());
-  vector<uint8_t> caps = properties_.GetLeVendorCap();
+  vector<uint8_t> caps = properties_.le_vendor_capabilities;
   if (caps.size() == 0) {
     SendCommandCompleteUnknownOpCodeEvent(
         static_cast<uint16_t>(OpCode::LE_GET_VENDOR_CAPABILITIES));
@@ -2443,7 +2689,7 @@
   std::unique_ptr<bluetooth::packet::RawBuilder> raw_builder_ptr =
       std::make_unique<bluetooth::packet::RawBuilder>();
   raw_builder_ptr->AddOctets1(static_cast<uint8_t>(ErrorCode::SUCCESS));
-  raw_builder_ptr->AddOctets(properties_.GetLeVendorCap());
+  raw_builder_ptr->AddOctets(properties_.le_vendor_capabilities);
 
   send_event_(bluetooth::hci::CommandCompleteBuilder::Create(
       kNumCommandPackets, OpCode::LE_GET_VENDOR_CAPABILITIES,
@@ -2474,38 +2720,210 @@
       static_cast<uint16_t>(OpCode::LE_ENERGY_INFO));
 }
 
-void DualModeController::LeSetExtendedAdvertisingRandomAddress(
-    CommandView command) {
-  auto command_view = gd_hci::LeSetExtendedAdvertisingRandomAddressView::Create(
+// CSR vendor command.
+// Implement the command specific to the CSR controller
+// used specifically by the PTS tool to pass certification tests.
+void DualModeController::CsrVendorCommand(CommandView command) {
+  // The byte order is little endian.
+  // The command parameters are formatted as
+  //
+  //  00    | 0xc2
+  //  01 02 | action
+  //          read = 0
+  //          write = 2
+  //  03 04 | (value length / 2) + 5
+  //  04 05 | sequence number
+  //  06 07 | varid
+  //  08 09 | 00 00
+  //  0a .. | value
+  //
+  // BlueZ has a reference implementation of the CSR vendor command.
+
+  std::vector<uint8_t> parameters(command.GetPayload().begin(),
+                                  command.GetPayload().end());
+
+  uint16_t type = 0;
+  uint16_t length = 0;
+  uint16_t varid = 0;
+
+  if (parameters.size() == 0) {
+    LOG_INFO("Empty CSR vendor command");
+    goto complete;
+  }
+
+  if (parameters[0] != 0xc2 || parameters.size() < 11) {
+    LOG_INFO(
+        "Unsupported CSR vendor command with code %02x "
+        "and parameter length %zu",
+        static_cast<int>(parameters[0]), parameters.size());
+    goto complete;
+  }
+
+  type = (uint16_t)parameters[1] | ((uint16_t)parameters[2] << 8);
+  length = (uint16_t)parameters[3] | ((uint16_t)parameters[4] << 8);
+  varid = (uint16_t)parameters[7] | ((uint16_t)parameters[8] << 8);
+  length = 2 * (length - 5);
+
+  if (parameters.size() < (11 + length) ||
+      (varid == CsrVarid::CSR_VARID_PS && length < 6)) {
+    LOG_INFO("Invalid CSR vendor command parameter length %zu, expected %u",
+             parameters.size(), 11 + length);
+    goto complete;
+  }
+
+  if (varid == CsrVarid::CSR_VARID_PS) {
+    // Subcommand to read or write PSKEY of the selected identifier
+    // instead of VARID.
+    uint16_t pskey = (uint16_t)parameters[11] | ((uint16_t)parameters[12] << 8);
+    uint16_t length =
+        (uint16_t)parameters[13] | ((uint16_t)parameters[14] << 8);
+    length = 2 * length;
+
+    if (parameters.size() < (17 + length)) {
+      LOG_INFO("Invalid CSR vendor command parameter length %zu, expected %u",
+               parameters.size(), 17 + length);
+      goto complete;
+    }
+
+    std::vector<uint8_t> value(parameters.begin() + 17,
+                               parameters.begin() + 17 + length);
+
+    LOG_INFO("CSR vendor command type=%04x length=%04x pskey=%04x", type,
+             length, pskey);
+
+    if (type == 0) {
+      CsrReadPskey(static_cast<CsrPskey>(pskey), value);
+      std::copy(value.begin(), value.end(), parameters.begin() + 17);
+    } else {
+      CsrWritePskey(static_cast<CsrPskey>(pskey), value);
+    }
+
+  } else {
+    // Subcommand to read or write VARID of the selected identifier.
+    std::vector<uint8_t> value(parameters.begin() + 11,
+                               parameters.begin() + 11 + length);
+
+    LOG_INFO("CSR vendor command type=%04x length=%04x varid=%04x", type,
+             length, varid);
+
+    if (type == 0) {
+      CsrReadVarid(static_cast<CsrVarid>(varid), value);
+      std::copy(value.begin(), value.end(), parameters.begin() + 11);
+    } else {
+      CsrWriteVarid(static_cast<CsrVarid>(varid), value);
+    }
+  }
+
+complete:
+  // Overwrite the command type.
+  parameters[1] = 0x1;
+  parameters[2] = 0x0;
+  send_event_(bluetooth::hci::EventBuilder::Create(
+      bluetooth::hci::EventCode::VENDOR_SPECIFIC,
+      std::make_unique<bluetooth::packet::RawBuilder>(std::move(parameters))));
+}
+
+void DualModeController::CsrReadVarid(CsrVarid varid,
+                                      std::vector<uint8_t>& value) {
+  switch (varid) {
+    case CsrVarid::CSR_VARID_BUILDID:
+      // Return the extact Build ID returned by the official PTS dongle.
+      ASSERT(value.size() >= 2);
+      value[0] = 0xe8;
+      value[1] = 0x30;
+      break;
+
+    default:
+      LOG_INFO("Unsupported read of CSR varid 0x%04x", varid);
+      break;
+  }
+}
+
+void DualModeController::CsrWriteVarid(CsrVarid varid,
+                                       std::vector<uint8_t> const& value) {
+  LOG_INFO("Unsupported write of CSR varid 0x%04x", varid);
+}
+
+void DualModeController::CsrReadPskey(CsrPskey pskey,
+                                      std::vector<uint8_t>& value) {
+  switch (pskey) {
+    case CsrPskey::CSR_PSKEY_ENC_KEY_LMIN:
+      ASSERT(value.size() >= 1);
+      value[0] = 7;
+      break;
+
+    case CsrPskey::CSR_PSKEY_ENC_KEY_LMAX:
+      ASSERT(value.size() >= 1);
+      value[0] = 16;
+      break;
+
+    case CSR_PSKEY_HCI_LMP_LOCAL_VERSION:
+      // Return the extact version returned by the official PTS dongle.
+      ASSERT(value.size() >= 2);
+      value[0] = 0x08;
+      value[1] = 0x08;
+      break;
+
+    default:
+      LOG_INFO("Unsupported read of CSR pskey 0x%04x", pskey);
+      break;
+  }
+}
+
+void DualModeController::CsrWritePskey(CsrPskey pskey,
+                                       std::vector<uint8_t> const& value) {
+  switch (pskey) {
+    case CsrPskey::CSR_PSKEY_LOCAL_SUPPORTED_FEATURES:
+      ASSERT(value.size() >= 8);
+      LOG_INFO("CSR Vendor updating the Local Supported Features");
+      properties_.lmp_features[0] =
+          ((uint64_t)value[0] << 0) | ((uint64_t)value[1] << 8) |
+          ((uint64_t)value[2] << 16) | ((uint64_t)value[3] << 24) |
+          ((uint64_t)value[4] << 32) | ((uint64_t)value[5] << 40) |
+          ((uint64_t)value[6] << 48) | ((uint64_t)value[7] << 56);
+      break;
+
+    default:
+      LOG_INFO("Unsupported write of CSR pskey 0x%04x", pskey);
+      break;
+  }
+}
+
+void DualModeController::LeSetAdvertisingSetRandomAddress(CommandView command) {
+  auto command_view = gd_hci::LeSetAdvertisingSetRandomAddressView::Create(
       gd_hci::LeAdvertisingCommandView::Create(command));
   ASSERT(command_view.IsValid());
-  link_layer_controller_.SetLeExtendedAddress(
-      command_view.GetAdvertisingHandle(),
-      command_view.GetAdvertisingRandomAddress());
+  ErrorCode status = link_layer_controller_.LeSetAdvertisingSetRandomAddress(
+      command_view.GetAdvertisingHandle(), command_view.GetRandomAddress());
   send_event_(
-      bluetooth::hci::LeSetExtendedAdvertisingRandomAddressCompleteBuilder::
-          Create(kNumCommandPackets, ErrorCode::SUCCESS));
+      bluetooth::hci::LeSetAdvertisingSetRandomAddressCompleteBuilder::Create(
+          kNumCommandPackets, status));
 }
 
 void DualModeController::LeSetExtendedAdvertisingParameters(
     CommandView command) {
-  auto command_view =
-      gd_hci::LeSetExtendedAdvertisingLegacyParametersView::Create(
-          gd_hci::LeAdvertisingCommandView::Create(command));
-  // TODO: Support non-legacy parameters
+  auto command_view = gd_hci::LeSetExtendedAdvertisingParametersView::Create(
+      gd_hci::LeAdvertisingCommandView::Create(command));
   ASSERT(command_view.IsValid());
-  link_layer_controller_.SetLeExtendedAdvertisingParameters(
+  ErrorCode status = link_layer_controller_.LeSetExtendedAdvertisingParameters(
       command_view.GetAdvertisingHandle(),
+      command_view.GetAdvertisingEventProperties(),
       command_view.GetPrimaryAdvertisingIntervalMin(),
       command_view.GetPrimaryAdvertisingIntervalMax(),
-      command_view.GetAdvertisingEventLegacyProperties(),
+      command_view.GetPrimaryAdvertisingChannelMap(),
       command_view.GetOwnAddressType(), command_view.GetPeerAddressType(),
       command_view.GetPeerAddress(), command_view.GetAdvertisingFilterPolicy(),
-      command_view.GetAdvertisingTxPower());
-
+      command_view.GetAdvertisingTxPower(),
+      command_view.GetPrimaryAdvertisingPhy(),
+      command_view.GetSecondaryAdvertisingMaxSkip(),
+      command_view.GetSecondaryAdvertisingPhy(),
+      command_view.GetAdvertisingSid(),
+      command_view.GetScanRequestNotificationEnable() == Enable::ENABLED);
+  // The selected TX power is always the requested TX power
+  // at the moment.
   send_event_(
       bluetooth::hci::LeSetExtendedAdvertisingParametersCompleteBuilder::Create(
-          kNumCommandPackets, ErrorCode::SUCCESS, 0xa5));
+          kNumCommandPackets, status, command_view.GetAdvertisingTxPower()));
 }
 
 void DualModeController::LeSetExtendedAdvertisingData(CommandView command) {
@@ -2515,45 +2933,38 @@
   auto raw_command_view = gd_hci::LeSetExtendedAdvertisingDataRawView::Create(
       gd_hci::LeAdvertisingCommandView::Create(command));
   ASSERT(raw_command_view.IsValid());
-  link_layer_controller_.SetLeExtendedAdvertisingData(
-      command_view.GetAdvertisingHandle(),
+  ErrorCode status = link_layer_controller_.LeSetExtendedAdvertisingData(
+      command_view.GetAdvertisingHandle(), command_view.GetOperation(),
+      command_view.GetFragmentPreference(),
       raw_command_view.GetAdvertisingData());
   send_event_(
       bluetooth::hci::LeSetExtendedAdvertisingDataCompleteBuilder::Create(
-          kNumCommandPackets, ErrorCode::SUCCESS));
+          kNumCommandPackets, status));
 }
 
-void DualModeController::LeSetExtendedAdvertisingScanResponse(
-    CommandView command) {
-  auto command_view = gd_hci::LeSetExtendedAdvertisingScanResponseView::Create(
+void DualModeController::LeSetExtendedScanResponseData(CommandView command) {
+  auto command_view = gd_hci::LeSetExtendedScanResponseDataView::Create(
       gd_hci::LeAdvertisingCommandView::Create(command));
   ASSERT(command_view.IsValid());
-  properties_.SetLeScanResponse(std::vector<uint8_t>(
-      command_view.GetPayload().begin() + 1, command_view.GetPayload().end()));
-  auto raw_command_view =
-      gd_hci::LeSetExtendedAdvertisingScanResponseRawView::Create(
-          gd_hci::LeAdvertisingCommandView::Create(command));
+  auto raw_command_view = gd_hci::LeSetExtendedScanResponseDataRawView::Create(
+      gd_hci::LeAdvertisingCommandView::Create(command));
   ASSERT(raw_command_view.IsValid());
-  link_layer_controller_.SetLeExtendedScanResponseData(
-      command_view.GetAdvertisingHandle(),
+  ErrorCode status = link_layer_controller_.LeSetExtendedScanResponseData(
+      command_view.GetAdvertisingHandle(), command_view.GetOperation(),
+      command_view.GetFragmentPreference(),
       raw_command_view.GetScanResponseData());
   send_event_(
-      bluetooth::hci::LeSetExtendedAdvertisingScanResponseCompleteBuilder::
-          Create(kNumCommandPackets, ErrorCode::SUCCESS));
+      bluetooth::hci::LeSetExtendedScanResponseDataCompleteBuilder::Create(
+          kNumCommandPackets, status));
 }
 
 void DualModeController::LeSetExtendedAdvertisingEnable(CommandView command) {
   auto command_view = gd_hci::LeSetExtendedAdvertisingEnableView::Create(
       gd_hci::LeAdvertisingCommandView::Create(command));
   ASSERT(command_view.IsValid());
-  auto enabled_sets = command_view.GetEnabledSets();
-  ErrorCode status = ErrorCode::SUCCESS;
-  if (enabled_sets.size() == 0) {
-    link_layer_controller_.LeDisableAdvertisingSets();
-  } else {
-    status = link_layer_controller_.SetLeExtendedAdvertisingEnable(
-        command_view.GetEnable(), command_view.GetEnabledSets());
-  }
+  ErrorCode status = link_layer_controller_.LeSetExtendedAdvertisingEnable(
+      command_view.GetEnable() == bluetooth::hci::Enable::ENABLED,
+      command_view.GetEnabledSets());
   send_event_(
       bluetooth::hci::LeSetExtendedAdvertisingEnableCompleteBuilder::Create(
           kNumCommandPackets, status));
@@ -2578,9 +2989,8 @@
   ASSERT(command_view.IsValid());
   send_event_(
       bluetooth::hci::LeReadNumberOfSupportedAdvertisingSetsCompleteBuilder::
-          Create(
-              kNumCommandPackets, ErrorCode::SUCCESS,
-              link_layer_controller_.LeReadNumberOfSupportedAdvertisingSets()));
+          Create(kNumCommandPackets, ErrorCode::SUCCESS,
+                 properties_.le_num_supported_advertising_sets));
 }
 
 void DualModeController::LeRemoveAdvertisingSet(CommandView command) {
@@ -2657,7 +3067,8 @@
   ASSERT(command_view.IsValid());
 
   send_event_(bluetooth::hci::ReadClassOfDeviceCompleteBuilder::Create(
-      kNumCommandPackets, ErrorCode::SUCCESS, properties_.GetClassOfDevice()));
+      kNumCommandPackets, ErrorCode::SUCCESS,
+      link_layer_controller_.GetClassOfDevice()));
 }
 
 void DualModeController::ReadVoiceSetting(CommandView command) {
@@ -2665,7 +3076,8 @@
   ASSERT(command_view.IsValid());
 
   send_event_(bluetooth::hci::ReadVoiceSettingCompleteBuilder::Create(
-      kNumCommandPackets, ErrorCode::SUCCESS, properties_.GetVoiceSetting()));
+      kNumCommandPackets, ErrorCode::SUCCESS,
+      link_layer_controller_.GetVoiceSetting()));
 }
 
 void DualModeController::ReadConnectionAcceptTimeout(CommandView command) {
@@ -2677,7 +3089,7 @@
   send_event_(
       bluetooth::hci::ReadConnectionAcceptTimeoutCompleteBuilder::Create(
           kNumCommandPackets, ErrorCode::SUCCESS,
-          properties_.GetConnectionAcceptTimeout()));
+          link_layer_controller_.GetConnectionAcceptTimeout()));
 }
 
 void DualModeController::WriteConnectionAcceptTimeout(CommandView command) {
@@ -2686,7 +3098,8 @@
           gd_hci::AclCommandView::Create(command)));
   ASSERT(command_view.IsValid());
 
-  properties_.SetConnectionAcceptTimeout(command_view.GetConnAcceptTimeout());
+  link_layer_controller_.SetConnectionAcceptTimeout(
+      command_view.GetConnAcceptTimeout());
 
   send_event_(
       bluetooth::hci::WriteConnectionAcceptTimeoutCompleteBuilder::Create(
@@ -2697,8 +3110,7 @@
   auto command_view = gd_hci::ReadLoopbackModeView::Create(command);
   ASSERT(command_view.IsValid());
   send_event_(bluetooth::hci::ReadLoopbackModeCompleteBuilder::Create(
-      kNumCommandPackets, ErrorCode::SUCCESS,
-      static_cast<LoopbackMode>(loopback_mode_)));
+      kNumCommandPackets, ErrorCode::SUCCESS, loopback_mode_));
 }
 
 void DualModeController::WriteLoopbackMode(CommandView command) {
@@ -2708,19 +3120,15 @@
   // ACL channel
   uint16_t acl_handle = 0x123;
   send_event_(bluetooth::hci::ConnectionCompleteBuilder::Create(
-      ErrorCode::SUCCESS, acl_handle, properties_.GetAddress(),
+      ErrorCode::SUCCESS, acl_handle, GetAddress(),
       bluetooth::hci::LinkType::ACL, bluetooth::hci::Enable::DISABLED));
   // SCO channel
   uint16_t sco_handle = 0x345;
   send_event_(bluetooth::hci::ConnectionCompleteBuilder::Create(
-      ErrorCode::SUCCESS, sco_handle, properties_.GetAddress(),
+      ErrorCode::SUCCESS, sco_handle, GetAddress(),
       bluetooth::hci::LinkType::SCO, bluetooth::hci::Enable::DISABLED));
   send_event_(bluetooth::hci::WriteLoopbackModeCompleteBuilder::Create(
       kNumCommandPackets, ErrorCode::SUCCESS));
 }
 
-void DualModeController::SetAddress(Address address) {
-  properties_.SetAddress(address);
-}
-
 }  // namespace rootcanal
diff --git a/tools/rootcanal/model/controller/dual_mode_controller.h b/tools/rootcanal/model/controller/dual_mode_controller.h
index 59307bf..d28558d 100644
--- a/tools/rootcanal/model/controller/dual_mode_controller.h
+++ b/tools/rootcanal/model/controller/dual_mode_controller.h
@@ -24,12 +24,16 @@
 #include <unordered_map>
 #include <vector>
 
+#include "controller_properties.h"
 #include "hci/address.h"
 #include "hci/hci_packets.h"
 #include "link_layer_controller.h"
+#include "model/controller/vendor/csr.h"
 #include "model/devices/device.h"
 #include "model/setup/async_manager.h"
+#ifndef ROOTCANAL_LMP
 #include "security_manager.h"
+#endif /* !ROOTCANAL_LMP */
 
 namespace rootcanal {
 
@@ -48,15 +52,11 @@
 // corresponding Bluetooth command in the Core Specification with the prefix
 // "Hci" to distinguish it as a controller command.
 class DualModeController : public Device {
-  // The location of the config file loaded to populate controller attributes.
-  static constexpr char kControllerPropertiesFile[] =
-      "/vendor/etc/bluetooth/controller_properties.json";
   static constexpr uint16_t kSecurityManagerNumKeys = 15;
 
  public:
   // Sets all of the methods to be used as callbacks in the HciHandler.
-  DualModeController(const std::string& properties_filename =
-                         std::string(kControllerPropertiesFile),
+  DualModeController(const std::string& properties_filename = "",
                      uint16_t num_keys = kSecurityManagerNumKeys);
 
   ~DualModeController() = default;
@@ -68,7 +68,6 @@
       model::packets::LinkLayerPacketView incoming) override;
 
   virtual void TimerTick() override;
-
   virtual void Close() override;
 
   // Route commands and data from the stack.
@@ -106,9 +105,6 @@
       const std::function<void(std::shared_ptr<std::vector<uint8_t>>)>&
           send_iso);
 
-  // Set the device's address.
-  void SetAddress(Address address) override;
-
   // Controller commands. For error codes, see the Bluetooth Core Specification,
   // Version 4.2, Volume 2, Part D (page 370).
 
@@ -217,6 +213,12 @@
   // 7.1.36
   void IoCapabilityRequestNegativeReply(CommandView args);
 
+  // 7.1.45
+  void EnhancedSetupSynchronousConnection(CommandView args);
+
+  // 7.1.46
+  void EnhancedAcceptSynchronousConnection(CommandView args);
+
   // 7.1.53
   void RemoteOobExtendedDataRequestReply(CommandView args);
 
@@ -238,6 +240,9 @@
   // 7.2.7
   void RoleDiscovery(CommandView args);
 
+  // 7.2.9
+  void ReadLinkPolicySettings(CommandView args);
+
   // 7.2.10
   void WriteLinkPolicySettings(CommandView args);
 
@@ -367,6 +372,9 @@
   // 7.3.63
   void SendKeypressNotification(CommandView args);
 
+  // 7.3.66
+  void EnhancedFlush(CommandView args);
+
   // 7.3.69
   void SetEventMaskPage2(CommandView args);
 
@@ -457,11 +465,8 @@
   // 7.8.12
   void LeCreateConnection(CommandView args);
 
-  // 7.8.18
-  void LeConnectionUpdate(CommandView args);
-
   // 7.8.13
-  void LeConnectionCancel(CommandView args);
+  void LeCreateConnectionCancel(CommandView args);
 
   // 7.8.14
   void LeReadFilterAcceptListSize(CommandView args);
@@ -475,6 +480,9 @@
   // 7.8.17
   void LeRemoveDeviceFromFilterAcceptList(CommandView args);
 
+  // 7.8.18
+  void LeConnectionUpdate(CommandView args);
+
   // 7.8.21
   void LeReadRemoteFeatures(CommandView args);
 
@@ -524,13 +532,13 @@
   void LeSetAddressResolutionEnable(CommandView args);
 
   // 7.8.45
-  void LeSetResovalablePrivateAddressTimeout(CommandView args);
+  void LeSetResolvablePrivateAddressTimeout(CommandView args);
 
   // 7.8.46
   void LeReadMaximumDataLength(CommandView args);
 
   // 7.8.52
-  void LeSetExtendedAdvertisingRandomAddress(CommandView args);
+  void LeSetAdvertisingSetRandomAddress(CommandView args);
 
   // 7.8.53
   void LeSetExtendedAdvertisingParameters(CommandView args);
@@ -539,7 +547,7 @@
   void LeSetExtendedAdvertisingData(CommandView args);
 
   // 7.8.55
-  void LeSetExtendedAdvertisingScanResponse(CommandView args);
+  void LeSetExtendedScanResponseData(CommandView args);
 
   // 7.8.56
   void LeSetExtendedAdvertisingEnable(CommandView args);
@@ -600,6 +608,15 @@
   void LeAdvertisingFilter(CommandView args);
   void LeExtendedScanParams(CommandView args);
 
+  // CSR vendor command.
+  // Implement the command specific to the CSR controller
+  // used specifically by the PTS tool to pass certification tests.
+  void CsrVendorCommand(CommandView args);
+  void CsrReadVarid(CsrVarid varid, std::vector<uint8_t>& value);
+  void CsrWriteVarid(CsrVarid varid, std::vector<uint8_t> const& value);
+  void CsrReadPskey(CsrPskey pskey, std::vector<uint8_t>& value);
+  void CsrWritePskey(CsrPskey pskey, std::vector<uint8_t> const& value);
+
   // Required commands for handshaking with hci driver
   void ReadClassOfDevice(CommandView args);
   void ReadVoiceSetting(CommandView args);
@@ -611,20 +628,16 @@
   void StopTimer();
 
  protected:
-  LinkLayerController link_layer_controller_{properties_};
+  // Controller configuration.
+  ControllerProperties properties_;
+
+  // Link Layer state.
+  LinkLayerController link_layer_controller_{address_, properties_};
 
  private:
-  // Set a timer for a future action
-  void AddControllerEvent(std::chrono::milliseconds,
-                          const TaskCallback& callback);
-
-  void AddConnectionAction(const TaskCallback& callback, uint16_t handle);
-
-  void SendCommandCompleteUnknownOpCodeEvent(uint16_t command_opcode) const;
-
-  // Unused state to maintain consistency for the Host
-  uint16_t le_suggested_default_data_bytes_{0x20};
-  uint16_t le_suggested_default_data_time_{0x148};
+  // Send a HCI_Command_Complete event for the specified op_code with
+  // the error code UNKNOWN_OPCODE.
+  void SendCommandCompleteUnknownOpCodeEvent(uint16_t op_code) const;
 
   // Callbacks to send packets back to the HCI.
   std::function<void(std::shared_ptr<bluetooth::hci::AclBuilder>)> send_acl_;
@@ -633,19 +646,24 @@
   std::function<void(std::shared_ptr<bluetooth::hci::ScoBuilder>)> send_sco_;
   std::function<void(std::shared_ptr<bluetooth::hci::IsoBuilder>)> send_iso_;
 
-  // Maintains the commands to be registered and used in the HciHandler object.
-  // Keys are command opcodes and values are the callbacks to handle each
-  // command.
+  // Map supported opcodes to the function implementing the handler
+  // for the associated command. The map should be a subset of the
+  // supported_command field in the properties_ object.
   std::unordered_map<bluetooth::hci::OpCode,
                      std::function<void(bluetooth::hci::CommandView)>>
       active_hci_commands_;
 
+  // Loopback mode (Vol 4, Part E § 7.6.1).
+  // The local loopback mode is used to pass the android Vendor Test Suite
+  // with RootCanal.
   bluetooth::hci::LoopbackMode loopback_mode_;
 
+#ifndef ROOTCANAL_LMP
   SecurityManager security_manager_;
+#endif /* ROOTCANAL_LMP */
 
-  DualModeController(const DualModeController& cmdPckt) = delete;
-  DualModeController& operator=(const DualModeController& cmdPckt) = delete;
+  DualModeController(const DualModeController& other) = delete;
+  DualModeController& operator=(const DualModeController& other) = delete;
 };
 
 }  // namespace rootcanal
diff --git a/tools/rootcanal/model/controller/isochronous_connection_handler.cc b/tools/rootcanal/model/controller/isochronous_connection_handler.cc
index 0c1ebfc..8b41f7b 100644
--- a/tools/rootcanal/model/controller/isochronous_connection_handler.cc
+++ b/tools/rootcanal/model/controller/isochronous_connection_handler.cc
@@ -17,7 +17,7 @@
 #include "model/controller/isochronous_connection_handler.h"
 
 #include "hci/address.h"
-#include "os/log.h"
+#include "log.h"
 
 namespace rootcanal {
 
diff --git a/tools/rootcanal/model/controller/le_advertiser.cc b/tools/rootcanal/model/controller/le_advertiser.cc
index 3f1d1fd..52746f7 100644
--- a/tools/rootcanal/model/controller/le_advertiser.cc
+++ b/tools/rootcanal/model/controller/le_advertiser.cc
@@ -16,253 +16,1483 @@
 
 #include "le_advertiser.h"
 
+#include "link_layer_controller.h"
+#include "log.h"
+
 using namespace bluetooth::hci;
 using namespace std::literals;
 
 namespace rootcanal {
-void LeAdvertiser::Initialize(AddressWithType address,
-                              AddressWithType peer_address,
-                              LeScanningFilterPolicy filter_policy,
-                              model::packets::AdvertisementType type,
-                              const std::vector<uint8_t>& advertisement,
-                              const std::vector<uint8_t>& scan_response,
-                              std::chrono::steady_clock::duration interval) {
-  address_ = address;
-  peer_address_ = peer_address;
-  filter_policy_ = filter_policy;
-  type_ = type;
-  advertisement_ = advertisement;
-  scan_response_ = scan_response;
-  interval_ = interval;
-  tx_power_ = kTxPowerUnavailable;
+
+namespace chrono {
+using duration = std::chrono::steady_clock::duration;
+using time_point = std::chrono::steady_clock::time_point;
+};  // namespace chrono
+
+slots operator"" _slots(unsigned long long count) { return slots(count); }
+
+// =============================================================================
+//  Constants
+// =============================================================================
+
+// Vol 6, Part B § 4.4.2.4.3 High duty cycle connectable directed advertising.
+const chrono::duration adv_direct_ind_high_timeout = 1280ms;
+const chrono::duration adv_direct_ind_high_interval = 3750us;
+
+// Vol 6, Part B § 2.3.4.9 Host Advertising Data.
+const uint16_t max_legacy_advertising_pdu_size = 31;
+const uint16_t max_extended_advertising_pdu_size = 1650;
+
+// =============================================================================
+//  Legacy Advertising Commands
+// =============================================================================
+
+// HCI command LE_Set_Advertising_Parameters (Vol 4, Part E § 7.8.5).
+ErrorCode LinkLayerController::LeSetAdvertisingParameters(
+    uint16_t advertising_interval_min, uint16_t advertising_interval_max,
+    AdvertisingType advertising_type, OwnAddressType own_address_type,
+    PeerAddressType peer_address_type, Address peer_address,
+    uint8_t advertising_channel_map,
+    AdvertisingFilterPolicy advertising_filter_policy) {
+  // Legacy advertising commands are disallowed when extended advertising
+  // commands were used since the last reset.
+  if (!SelectLegacyAdvertising()) {
+    LOG_INFO(
+        "legacy advertising command rejected because extended advertising"
+        " is being used");
+    return ErrorCode::COMMAND_DISALLOWED;
+  }
+
+  // Clear reserved bits.
+  advertising_channel_map &= 0x7;
+
+  // For high duty cycle directed advertising, i.e. when
+  // Advertising_Type is 0x01 (ADV_DIRECT_IND, high duty cycle),
+  // the Advertising_Interval_Min and Advertising_Interval_Max parameters
+  // are not used and shall be ignored.
+  if (advertising_type == AdvertisingType::ADV_DIRECT_IND_HIGH) {
+    advertising_interval_min = 0x800;  // Default interval value
+    advertising_interval_max = 0x800;
+  }
+
+  // The Host shall not issue this command when advertising is enabled in the
+  // Controller; if it is the Command Disallowed error code shall be used.
+  if (legacy_advertiser_.advertising_enable) {
+    LOG_INFO("legacy advertising is enabled");
+    return ErrorCode::COMMAND_DISALLOWED;
+  }
+
+  // At least one channel bit shall be set in the
+  // Advertising_Channel_Map parameter.
+  if (advertising_channel_map == 0) {
+    LOG_INFO(
+        "advertising_channel_map (0x%04x) does not enable any"
+        " advertising channel",
+        advertising_channel_map);
+    return ErrorCode::INVALID_HCI_COMMAND_PARAMETERS;
+  }
+
+  // If the advertising interval range provided by the Host
+  // (Advertising_Interval_Min, Advertising_Interval_Max) is outside the
+  // advertising interval range supported by the Controller, then the
+  // Controller shall return the Unsupported Feature or Parameter Value (0x11)
+  // error code.
+  if (advertising_interval_min < 0x0020 || advertising_interval_min > 0x4000 ||
+      advertising_interval_max < 0x0020 || advertising_interval_max > 0x4000) {
+    LOG_INFO(
+        "advertising_interval_min (0x%04x) and/or"
+        " advertising_interval_max (0x%04x) are outside the range"
+        " of supported values (0x0020 - 0x4000)",
+        advertising_interval_min, advertising_interval_max);
+    return ErrorCode::UNSUPPORTED_FEATURE_OR_PARAMETER_VALUE;
+  }
+
+  // The Advertising_Interval_Min shall be less than or equal to the
+  // Advertising_Interval_Max.
+  if (advertising_interval_min > advertising_interval_max) {
+    LOG_INFO(
+        "advertising_interval_min (0x%04x) is larger than"
+        " advertising_interval_max (0x%04x)",
+        advertising_interval_min, advertising_interval_max);
+    return ErrorCode::INVALID_HCI_COMMAND_PARAMETERS;
+  }
+
+  legacy_advertiser_.advertising_interval =
+      advertising_type == AdvertisingType::ADV_DIRECT_IND_HIGH
+          ? std::chrono::duration_cast<slots>(adv_direct_ind_high_interval)
+          : slots(advertising_interval_min);
+  legacy_advertiser_.advertising_type = advertising_type;
+  legacy_advertiser_.own_address_type = own_address_type;
+  legacy_advertiser_.peer_address_type = peer_address_type;
+  legacy_advertiser_.peer_address = peer_address;
+  legacy_advertiser_.advertising_channel_map = advertising_channel_map;
+  legacy_advertiser_.advertising_filter_policy = advertising_filter_policy;
+  return ErrorCode::SUCCESS;
 }
 
-void LeAdvertiser::InitializeExtended(
-    unsigned advertising_handle, OwnAddressType address_type,
-    AddressWithType public_address, AddressWithType peer_address,
-    LeScanningFilterPolicy filter_policy,
-    model::packets::AdvertisementType type,
-    std::chrono::steady_clock::duration interval, uint8_t tx_power,
-    const std::function<bluetooth::hci::Address()>& get_address) {
-  get_address_ = get_address;
-  own_address_type_ = address_type;
-  public_address_ = public_address;
-  advertising_handle_ = advertising_handle;
-  peer_address_ = peer_address;
-  filter_policy_ = filter_policy;
-  type_ = type;
-  interval_ = interval;
-  tx_power_ = tx_power;
-  LOG_INFO("%s -> %s type = %hhx interval = %d ms tx_power = 0x%hhx",
-           address_.ToString().c_str(), peer_address.ToString().c_str(), type_,
-           static_cast<int>(interval_.count()), tx_power);
+// HCI command LE_Set_Advertising_Data (Vol 4, Part E § 7.8.7).
+ErrorCode LinkLayerController::LeSetAdvertisingData(
+    const std::vector<uint8_t>& advertising_data) {
+  // Legacy advertising commands are disallowed when extended advertising
+  // commands were used since the last reset.
+  if (!SelectLegacyAdvertising()) {
+    LOG_INFO(
+        "legacy advertising command rejected because extended advertising"
+        " is being used");
+    return ErrorCode::COMMAND_DISALLOWED;
+  }
+
+  legacy_advertiser_.advertising_data = advertising_data;
+  return ErrorCode::SUCCESS;
 }
 
-void LeAdvertiser::Clear() {
-  address_ = AddressWithType{};
-  peer_address_ = AddressWithType{};
-  filter_policy_ = LeScanningFilterPolicy::ACCEPT_ALL;
-  type_ = model::packets::AdvertisementType::ADV_IND;
-  advertisement_.clear();
-  scan_response_.clear();
-  interval_ = 0ms;
-  enabled_ = false;
+// HCI command LE_Set_Scan_Response_Data (Vol 4, Part E § 7.8.8).
+ErrorCode LinkLayerController::LeSetScanResponseData(
+    const std::vector<uint8_t>& scan_response_data) {
+  // Legacy advertising commands are disallowed when extended advertising
+  // commands were used since the last reset.
+  if (!SelectLegacyAdvertising()) {
+    LOG_INFO(
+        "legacy advertising command rejected because extended advertising"
+        " is being used");
+    return ErrorCode::COMMAND_DISALLOWED;
+  }
+
+  legacy_advertiser_.scan_response_data = scan_response_data;
+  return ErrorCode::SUCCESS;
 }
 
-void LeAdvertiser::SetAddress(Address address) {
-  LOG_INFO("set address %s", address_.ToString().c_str());
-  address_ = AddressWithType(address, address_.GetAddressType());
-}
+// HCI command LE_Advertising_Enable (Vol 4, Part E § 7.8.9).
+ErrorCode LinkLayerController::LeSetAdvertisingEnable(bool advertising_enable) {
+  // Legacy advertising commands are disallowed when extended advertising
+  // commands were used since the last reset.
+  if (!SelectLegacyAdvertising()) {
+    LOG_INFO(
+        "legacy advertising command rejected because extended advertising"
+        " is being used");
+    return ErrorCode::COMMAND_DISALLOWED;
+  }
 
-AddressWithType LeAdvertiser::GetAddress() const { return address_; }
+  if (!advertising_enable) {
+    legacy_advertiser_.advertising_enable = false;
+    return ErrorCode::SUCCESS;
+  }
 
-void LeAdvertiser::SetData(const std::vector<uint8_t>& data) {
-  advertisement_ = data;
-}
+  AddressWithType peer_address = PeerDeviceAddress(
+      legacy_advertiser_.peer_address, legacy_advertiser_.peer_address_type);
+  AddressWithType public_address{address_, AddressType::PUBLIC_DEVICE_ADDRESS};
+  AddressWithType random_address{random_address_,
+                                 AddressType::RANDOM_DEVICE_ADDRESS};
+  std::optional<AddressWithType> resolvable_address =
+      GenerateResolvablePrivateAddress(peer_address, IrkSelection::Local);
 
-void LeAdvertiser::SetScanResponse(const std::vector<uint8_t>& data) {
-  scan_response_ = data;
-}
+  // TODO: additional checks would apply in the case of a LE only Controller
+  // with no configured public device address.
 
-void LeAdvertiser::Enable() {
-  EnableExtended(0ms);
-  extended_ = false;
-}
-
-void LeAdvertiser::EnableExtended(std::chrono::milliseconds duration_ms) {
-  enabled_ = true;
-  extended_ = true;
-  num_events_ = 0;
-
-  using Duration = std::chrono::steady_clock::duration;
-  using TimePoint = std::chrono::steady_clock::time_point;
-
-  Duration adv_direct_ind_timeout = 1280ms;        // 1.28s
-  Duration adv_direct_ind_interval_low = 10000us;  // 10ms
-  Duration adv_direct_ind_interval_high = 3750us;  // 3.75ms
-  Duration duration = duration_ms;
-  TimePoint now = std::chrono::steady_clock::now();
-
-  bluetooth::hci::Address resolvable_address = get_address_();
-  switch (own_address_type_) {
-    case bluetooth::hci::OwnAddressType::PUBLIC_DEVICE_ADDRESS:
-      address_ = public_address_;
+  switch (legacy_advertiser_.own_address_type) {
+    case OwnAddressType::PUBLIC_DEVICE_ADDRESS:
+      legacy_advertiser_.advertising_address = public_address;
       break;
-    case bluetooth::hci::OwnAddressType::RANDOM_DEVICE_ADDRESS:
-      address_ = AddressWithType(address_.GetAddress(),
-                                 AddressType::RANDOM_DEVICE_ADDRESS);
-      break;
-    case bluetooth::hci::OwnAddressType::RESOLVABLE_OR_PUBLIC_ADDRESS:
-      if (resolvable_address != Address::kEmpty) {
-        address_ = AddressWithType(resolvable_address,
-                                   AddressType::RANDOM_DEVICE_ADDRESS);
-      } else {
-        address_ = public_address_;
+
+    case OwnAddressType::RANDOM_DEVICE_ADDRESS:
+      // If Advertising_Enable is set to 0x01, the advertising parameters'
+      // Own_Address_Type parameter is set to 0x01, and the random address for
+      // the device has not been initialized using the HCI_LE_Set_Random_Address
+      // command, the Controller shall return the error code
+      // Invalid HCI Command Parameters (0x12).
+      if (random_address.GetAddress() == Address::kEmpty) {
+        LOG_INFO(
+            "own_address_type is Random_Device_Address but the Random_Address"
+            " has not been initialized");
+        return ErrorCode::INVALID_HCI_COMMAND_PARAMETERS;
       }
+      legacy_advertiser_.advertising_address = random_address;
       break;
-    case bluetooth::hci::OwnAddressType::RESOLVABLE_OR_RANDOM_ADDRESS:
-      if (resolvable_address != Address::kEmpty) {
-        address_ = AddressWithType(resolvable_address,
-                                   AddressType::RANDOM_DEVICE_ADDRESS);
+
+    case OwnAddressType::RESOLVABLE_OR_PUBLIC_ADDRESS:
+      legacy_advertiser_.advertising_address =
+          resolvable_address.value_or(public_address);
+      break;
+
+    case OwnAddressType::RESOLVABLE_OR_RANDOM_ADDRESS:
+      // If Advertising_Enable is set to 0x01, the advertising parameters'
+      // Own_Address_Type parameter is set to 0x03, the controller's resolving
+      // list did not contain a matching entry, and the random address for the
+      // device has not been initialized using the HCI_LE_Set_Random_Address
+      // command, the Controller shall return the error code Invalid HCI Command
+      // Parameters (0x12).
+      if (resolvable_address) {
+        legacy_advertiser_.advertising_address = resolvable_address.value();
+      } else if (random_address.GetAddress() == Address::kEmpty) {
+        LOG_INFO(
+            "own_address_type is Resolvable_Or_Random_Address but the"
+            " Resolving_List does not contain a matching entry and the"
+            " Random_Address is not initialized");
+        return ErrorCode::INVALID_HCI_COMMAND_PARAMETERS;
       } else {
-        address_ = AddressWithType(address_.GetAddress(),
-                                   AddressType::RANDOM_DEVICE_ADDRESS);
+        legacy_advertiser_.advertising_address = random_address;
       }
       break;
   }
 
-  switch (type_) {
-    // [Vol 6] Part B. 4.4.2.4.3 High duty cycle connectable directed
-    // advertising
-    case model::packets::AdvertisementType::ADV_DIRECT_IND:
-      duration = duration == 0ms ? adv_direct_ind_timeout
-                                 : std::min(duration, adv_direct_ind_timeout);
-      interval_ = adv_direct_ind_interval_high;
-      break;
+  legacy_advertiser_.timeout = {};
+  legacy_advertiser_.target_address =
+      AddressWithType{Address::kEmpty, AddressType::PUBLIC_DEVICE_ADDRESS};
 
-    // [Vol 6] Part B. 4.4.2.4.2 Low duty cycle connectable directed advertising
-    case model::packets::AdvertisementType::SCAN_RESPONSE:
-      interval_ = adv_direct_ind_interval_low;
-      break;
+  switch (legacy_advertiser_.advertising_type) {
+    case AdvertisingType::ADV_DIRECT_IND_HIGH:
+      // The Link Layer shall exit the Advertising state no later than 1.28 s
+      // after the Advertising state was entered.
+      legacy_advertiser_.timeout =
+          std::chrono::steady_clock::now() + adv_direct_ind_high_timeout;
+      [[fallthrough]];
 
-    // Duration set to parameter,
-    // interval set by Initialize().
+    case AdvertisingType::ADV_DIRECT_IND_LOW: {
+      // Note: Vol 6, Part B § 6.2.2 Connectable directed event type
+      //
+      // If an IRK is available in the Link Layer Resolving
+      // List for the peer device, then the target’s device address
+      // (TargetA field) shall use a resolvable private address. If an IRK is
+      // not available in the Link Layer Resolving List or the IRK is set to
+      // zero for the peer device, then the target’s device address
+      // (TargetA field) shall use the Identity Address when entering the
+      // Advertising State and using connectable directed events.
+      std::optional<AddressWithType> peer_resolvable_address =
+          GenerateResolvablePrivateAddress(peer_address, IrkSelection::Peer);
+      legacy_advertiser_.target_address =
+          peer_resolvable_address.value_or(peer_address);
+      break;
+    }
     default:
       break;
   }
 
-  last_le_advertisement_ = now - interval_;
-  ending_time_ = now + duration;
-  limited_ = duration != 0ms;
-
-  LOG_INFO("%s -> %s type = %hhx ad length %zu, scan length %zu",
-           address_.ToString().c_str(), peer_address_.ToString().c_str(), type_,
-           advertisement_.size(), scan_response_.size());
+  legacy_advertiser_.advertising_enable = true;
+  legacy_advertiser_.next_event = std::chrono::steady_clock::now() +
+                                  legacy_advertiser_.advertising_interval;
+  return ErrorCode::SUCCESS;
 }
 
-void LeAdvertiser::Disable() { enabled_ = false; }
-bool LeAdvertiser::IsEnabled() const { return enabled_; }
-bool LeAdvertiser::IsExtended() const { return extended_; }
+// =============================================================================
+//  Extended Advertising Commands
+// =============================================================================
 
-bool LeAdvertiser::IsConnectable() const {
-  return type_ != model::packets::AdvertisementType::ADV_NONCONN_IND &&
-         type_ != model::packets::AdvertisementType::ADV_SCAN_IND;
-}
-
-uint8_t LeAdvertiser::GetNumAdvertisingEvents() const { return num_events_; }
-
-std::unique_ptr<bluetooth::hci::EventBuilder> LeAdvertiser::GetEvent(
-    std::chrono::steady_clock::time_point now) {
-  // Advertiser disabled.
-  if (!enabled_) {
-    return nullptr;
+// HCI command LE_Set_Advertising_Set_Random_Address (Vol 4, Part E § 7.8.52).
+ErrorCode LinkLayerController::LeSetAdvertisingSetRandomAddress(
+    uint8_t advertising_handle, Address random_address) {
+  // If the advertising set corresponding to the Advertising_Handle parameter
+  // does not exist, then the Controller shall return the error code
+  // Unknown Advertising Identifier (0x42).
+  // TODO(c++20) unordered_map<>::contains
+  if (extended_advertisers_.count(advertising_handle) == 0) {
+    LOG_INFO("no advertising set defined with handle %02x",
+             static_cast<int>(advertising_handle));
+    return ErrorCode::UNKNOWN_ADVERTISING_IDENTIFIER;
   }
 
-  // [Vol 4] Part E 7.8.9   LE Set Advertising Enable command
-  // [Vol 4] Part E 7.8.56  LE Set Extended Advertising Enable command
-  if (type_ == model::packets::AdvertisementType::ADV_DIRECT_IND &&
-      now >= ending_time_ && limited_) {
+  ExtendedAdvertiser& advertiser = extended_advertisers_[advertising_handle];
+
+  // If the Host issues this command while the advertising set identified by the
+  // Advertising_Handle parameter is using connectable advertising and is
+  // enabled, the Controller shall return the error code
+  // Command Disallowed (0x0C).
+  if (advertiser.advertising_enable) {
+    LOG_INFO("advertising is enabled for the specified advertising set");
+    return ErrorCode::COMMAND_DISALLOWED;
+  }
+
+  advertiser.random_address = random_address;
+  return ErrorCode::SUCCESS;
+}
+
+// HCI command LE_Set_Extended_Advertising_Parameters (Vol 4, Part E § 7.8.53).
+ErrorCode LinkLayerController::LeSetExtendedAdvertisingParameters(
+    uint8_t advertising_handle,
+    AdvertisingEventProperties advertising_event_properties,
+    uint16_t primary_advertising_interval_min,
+    uint16_t primary_advertising_interval_max,
+    uint8_t primary_advertising_channel_map, OwnAddressType own_address_type,
+    PeerAddressType peer_address_type, Address peer_address,
+    AdvertisingFilterPolicy advertising_filter_policy,
+    uint8_t advertising_tx_power, PrimaryPhyType primary_advertising_phy,
+    uint8_t secondary_max_skip, SecondaryPhyType secondary_advertising_phy,
+    uint8_t advertising_sid, bool scan_request_notification_enable) {
+  // Extended advertising commands are disallowed when legacy advertising
+  // commands were used since the last reset.
+  if (!SelectExtendedAdvertising()) {
+    LOG_INFO(
+        "extended advertising command rejected because legacy advertising"
+        " is being used");
+    return ErrorCode::COMMAND_DISALLOWED;
+  }
+
+  bool legacy_advertising = advertising_event_properties.legacy_;
+  bool extended_advertising = !advertising_event_properties.legacy_;
+  bool connectable_advertising = advertising_event_properties.connectable_;
+  bool scannable_advertising = advertising_event_properties.scannable_;
+  bool directed_advertising = advertising_event_properties.directed_;
+  bool high_duty_cycle_advertising =
+      advertising_event_properties.high_duty_cycle_;
+  bool anonymous_advertising = advertising_event_properties.anonymous_;
+  uint16_t raw_advertising_event_properties =
+      ExtendedAdvertiser::GetRawAdvertisingEventProperties(
+          advertising_event_properties);
+
+  // Clear reserved bits.
+  primary_advertising_channel_map &= 0x7;
+
+  // If the Advertising_Handle does not identify an existing advertising set
+  // and the Controller is unable to support a new advertising set at present,
+  // the Controller shall return the error code Memory Capacity Exceeded (0x07).
+  ExtendedAdvertiser advertiser(advertising_handle);
+
+  // TODO(c++20) unordered_map<>::contains
+  if (extended_advertisers_.count(advertising_handle) == 0) {
+    if (extended_advertisers_.size() >=
+        properties_.le_num_supported_advertising_sets) {
+      LOG_INFO(
+          "no advertising set defined with handle %02x and"
+          " cannot allocate any more advertisers",
+          static_cast<int>(advertising_handle));
+      return ErrorCode::MEMORY_CAPACITY_EXCEEDED;
+    }
+  } else {
+    advertiser = extended_advertisers_[advertising_handle];
+  }
+
+  // If the Host issues this command when advertising is enabled for the
+  // specified advertising set, the Controller shall return the error code
+  // Command Disallowed (0x0C).
+  if (advertiser.advertising_enable) {
+    LOG_INFO("advertising is enabled for the specified advertising set");
+    return ErrorCode::COMMAND_DISALLOWED;
+  }
+
+  // If legacy advertising PDU types are being used, then the parameter value
+  // shall be one of those specified in Table 7.2.
+  if (legacy_advertising &&
+      (raw_advertising_event_properties & ~0x10) !=
+          static_cast<uint16_t>(LegacyAdvertisingEventProperties::ADV_IND) &&
+      (raw_advertising_event_properties & ~0x10) !=
+          static_cast<uint16_t>(
+              LegacyAdvertisingEventProperties::ADV_DIRECT_IND_LOW) &&
+      (raw_advertising_event_properties & ~0x10) !=
+          static_cast<uint16_t>(
+              LegacyAdvertisingEventProperties::ADV_DIRECT_IND_HIGH) &&
+      (raw_advertising_event_properties & ~0x10) !=
+          static_cast<uint16_t>(
+              LegacyAdvertisingEventProperties::ADV_SCAN_IND) &&
+      (raw_advertising_event_properties & ~0x10) !=
+          static_cast<uint16_t>(
+              LegacyAdvertisingEventProperties::ADV_NONCONN_IND)) {
+    LOG_INFO(
+        "advertising_event_properties (0x%02x) is legacy but does not"
+        " match valid legacy advertising event types",
+        raw_advertising_event_properties);
+    return ErrorCode::INVALID_HCI_COMMAND_PARAMETERS;
+  }
+
+  bool can_have_advertising_data =
+      (legacy_advertising && !directed_advertising) ||
+      (extended_advertising && !scannable_advertising);
+
+  // If the Advertising_Event_Properties parameter [..] specifies a type that
+  // does not support advertising data when the advertising set already
+  // contains some, the Controller shall return the error code
+  // Invalid HCI Command Parameters (0x12).
+  if (!can_have_advertising_data && advertiser.advertising_data.size() > 0) {
+    LOG_INFO(
+        "advertising_event_properties (0x%02x) specifies an event type"
+        " that does not support avertising data but the set contains some",
+        raw_advertising_event_properties);
+    return ErrorCode::INVALID_HCI_COMMAND_PARAMETERS;
+  }
+
+  // Note: not explicitly specified in the specification but makes sense
+  // in the context of the other checks.
+  if (!scannable_advertising && advertiser.scan_response_data.size() > 0) {
+    LOG_INFO(
+        "advertising_event_properties (0x%02x) specifies an event type"
+        " that does not support scan response data but the set contains some",
+        raw_advertising_event_properties);
+    return ErrorCode::INVALID_HCI_COMMAND_PARAMETERS;
+  }
+
+  // If the advertising set already contains data, the type shall be one that
+  // supports advertising data and the amount of data shall not
+  // exceed 31 octets.
+  if (legacy_advertising &&
+      (advertiser.advertising_data.size() > max_legacy_advertising_pdu_size ||
+       advertiser.scan_response_data.size() >
+           max_legacy_advertising_pdu_size)) {
+    LOG_INFO(
+        "advertising_event_properties (0x%02x) is legacy and the"
+        " advertising data or scan response data exceeds the capacity"
+        " of legacy PDUs",
+        raw_advertising_event_properties);
+    return ErrorCode::INVALID_HCI_COMMAND_PARAMETERS;
+  }
+
+  // If extended advertising PDU types are being used (bit 4 = 0) then:
+  // The advertisement shall not be both connectable and scannable.
+  if (extended_advertising && connectable_advertising &&
+      scannable_advertising) {
+    LOG_INFO(
+        "advertising_event_properties (0x%02x) is extended and may not"
+        " be connectable and scannable at the same time",
+        raw_advertising_event_properties);
+    return ErrorCode::INVALID_HCI_COMMAND_PARAMETERS;
+  }
+
+  // High duty cycle directed connectable advertising (≤ 3.75 ms
+  // advertising interval) shall not be used (bit 3 = 0).
+  if (extended_advertising && connectable_advertising && directed_advertising &&
+      high_duty_cycle_advertising) {
+    LOG_INFO(
+        "advertising_event_properties (0x%02x) is extended and may not"
+        " be high-duty cycle directed connectable",
+        raw_advertising_event_properties);
+    return ErrorCode::INVALID_HCI_COMMAND_PARAMETERS;
+  }
+
+  // If the primary advertising interval range provided by the Host
+  // (Primary_Advertising_Interval_Min, Primary_Advertising_Interval_Max) is
+  // outside the advertising interval range supported by the Controller, then
+  // the Controller shall return the error code Unsupported Feature or
+  // Parameter Value (0x11).
+  if (primary_advertising_interval_min < 0x20 ||
+      primary_advertising_interval_max < 0x20) {
+    LOG_INFO(
+        "primary_advertising_interval_min (0x%04x) and/or"
+        " primary_advertising_interval_max (0x%04x) are outside the range"
+        " of supported values (0x0020 - 0xffff)",
+        primary_advertising_interval_min, primary_advertising_interval_max);
+    return ErrorCode::UNSUPPORTED_FEATURE_OR_PARAMETER_VALUE;
+  }
+
+  // The Primary_Advertising_Interval_Min parameter shall be less than or equal
+  // to the Primary_Advertising_Interval_Max parameter.
+  if (primary_advertising_interval_min > primary_advertising_interval_max) {
+    LOG_INFO(
+        "primary_advertising_interval_min (0x%04x) is larger than"
+        " primary_advertising_interval_max (0x%04x)",
+        primary_advertising_interval_min, primary_advertising_interval_max);
+    return ErrorCode::INVALID_HCI_COMMAND_PARAMETERS;
+  }
+
+  // At least one channel bit shall be set in the
+  // Primary_Advertising_Channel_Map parameter.
+  if (primary_advertising_channel_map == 0) {
+    LOG_INFO(
+        "primary_advertising_channel_map does not enable any"
+        " advertising channel");
+    return ErrorCode::INVALID_HCI_COMMAND_PARAMETERS;
+  }
+
+  // If legacy advertising PDUs are being used, the
+  // Primary_Advertising_PHY shall indicate the LE 1M PHY.
+  if (legacy_advertising && primary_advertising_phy != PrimaryPhyType::LE_1M) {
+    LOG_INFO(
+        "advertising_event_properties (0x%04x) is legacy but"
+        " primary_advertising_phy (%02x) is not LE 1M",
+        raw_advertising_event_properties,
+        static_cast<uint8_t>(primary_advertising_phy));
+    return ErrorCode::INVALID_HCI_COMMAND_PARAMETERS;
+  }
+
+  // If Constant Tone Extensions are enabled for the advertising set and
+  // Secondary_Advertising_PHY specifies a PHY that does not allow
+  // Constant Tone Extensions, the Controller shall
+  // return the error code Command Disallowed (0x0C).
+  if (advertiser.constant_tone_extensions &&
+      secondary_advertising_phy == SecondaryPhyType::LE_CODED) {
+    LOG_INFO(
+        "constant tone extensions are enabled but"
+        " secondary_advertising_phy (%02x) does not support them",
+        static_cast<uint8_t>(secondary_advertising_phy));
+    return ErrorCode::COMMAND_DISALLOWED;
+  }
+
+  // If the Host issues this command when periodic advertising is enabled for
+  // the specified advertising set and connectable, scannable, legacy,
+  // or anonymous advertising is specified, the Controller shall return the
+  // error code Invalid HCI Command Parameters (0x12).
+  if (advertiser.periodic_advertising_enable &&
+      (connectable_advertising || scannable_advertising || legacy_advertising ||
+       anonymous_advertising)) {
+    LOG_INFO(
+        "periodic advertising is enabled for the specified advertising set"
+        " and advertising_event_properties (0x%02x) is either"
+        " connectable, scannable, legacy, or anonymous",
+        raw_advertising_event_properties);
+    return ErrorCode::INVALID_HCI_COMMAND_PARAMETERS;
+  }
+
+  // If periodic advertising is enabled for the advertising set and the
+  // Secondary_Advertising_PHY parameter does not specify the PHY currently
+  // being used for the periodic advertising, the Controller shall return the
+  // error code Command Disallowed (0x0C).
+  if (advertiser.periodic_advertising_enable && false) {
+    // TODO
+    LOG_INFO(
+        "periodic advertising is enabled for the specified advertising set"
+        " and the secondary PHY does not match the periodic"
+        " advertising PHY");
+    return ErrorCode::COMMAND_DISALLOWED;
+  }
+
+  // If the advertising set already contains advertising data or scan response
+  // data, extended advertising is being used, and the length of the data is
+  // greater than the maximum that the Controller can transmit within the
+  // longest possible auxiliary advertising segment consistent with the
+  // parameters, the Controller shall return the error code
+  // Packet Too Long (0x45). If advertising on the LE Coded PHY, the S=8
+  // coding shall be assumed.
+  if (extended_advertising &&
+      (advertiser.advertising_data.size() > max_extended_advertising_pdu_size ||
+       advertiser.scan_response_data.size() >
+           max_extended_advertising_pdu_size)) {
+    LOG_INFO(
+        "the advertising data contained in the set is larger than the"
+        " available PDU capacity");
+    return ErrorCode::PACKET_TOO_LONG;
+  }
+
+  advertiser.advertising_event_properties = advertising_event_properties;
+  advertiser.primary_advertising_interval =
+      slots(primary_advertising_interval_min);
+  advertiser.primary_advertising_channel_map = primary_advertising_channel_map;
+  advertiser.own_address_type = own_address_type;
+  advertiser.peer_address_type = peer_address_type;
+  advertiser.peer_address = peer_address;
+  advertiser.advertising_filter_policy = advertising_filter_policy;
+  advertiser.advertising_tx_power = advertising_tx_power;
+  advertiser.primary_advertising_phy = primary_advertising_phy;
+  advertiser.secondary_max_skip = secondary_max_skip;
+  advertiser.secondary_advertising_phy = secondary_advertising_phy;
+  advertiser.advertising_sid = advertising_sid;
+  advertiser.scan_request_notification_enable =
+      scan_request_notification_enable;
+
+  extended_advertisers_.insert_or_assign(advertising_handle,
+                                         std::move(advertiser));
+  return ErrorCode::SUCCESS;
+}
+
+// HCI command LE_Set_Extended_Advertising_Data (Vol 4, Part E § 7.8.54).
+ErrorCode LinkLayerController::LeSetExtendedAdvertisingData(
+    uint8_t advertising_handle, Operation operation,
+    FragmentPreference fragment_preference,
+    const std::vector<uint8_t>& advertising_data) {
+  // Extended advertising commands are disallowed when legacy advertising
+  // commands were used since the last reset.
+  if (!SelectExtendedAdvertising()) {
+    LOG_INFO(
+        "extended advertising command rejected because legacy advertising"
+        " is being used");
+    return ErrorCode::COMMAND_DISALLOWED;
+  }
+
+  // fragment_preference is unused for now.
+  (void)fragment_preference;
+
+  // If the advertising set corresponding to the Advertising_Handle parameter
+  // does not exist, then the Controller shall return the error code
+  // Unknown Advertising Identifier (0x42).
+  // TODO(c++20) unordered_map<>::contains
+  if (extended_advertisers_.count(advertising_handle) == 0) {
+    LOG_INFO("no advertising set defined with handle %02x",
+             static_cast<int>(advertising_handle));
+    return ErrorCode::UNKNOWN_ADVERTISING_IDENTIFIER;
+  }
+
+  ExtendedAdvertiser& advertiser = extended_advertisers_[advertising_handle];
+  const AdvertisingEventProperties& advertising_event_properties =
+      advertiser.advertising_event_properties;
+  uint16_t raw_advertising_event_properties =
+      ExtendedAdvertiser::GetRawAdvertisingEventProperties(
+          advertising_event_properties);
+
+  bool can_have_advertising_data = (advertising_event_properties.legacy_ &&
+                                    !advertising_event_properties.directed_) ||
+                                   (!advertising_event_properties.legacy_ &&
+                                    !advertising_event_properties.scannable_);
+
+  // If the advertising set specifies a type that does not support
+  // advertising data, the Controller shall return the error code
+  // Invalid HCI Command Parameters (0x12).
+  if (!can_have_advertising_data) {
+    LOG_INFO(
+        "advertising_event_properties (%02x) does not support"
+        " advertising data",
+        raw_advertising_event_properties);
+    return ErrorCode::INVALID_HCI_COMMAND_PARAMETERS;
+  }
+
+  // If the advertising set uses legacy advertising PDUs that support
+  // advertising data and either Operation is not 0x03 or the
+  // Advertising_Data_Length parameter exceeds 31 octets, the Controller
+  // shall return the error code Invalid HCI Command Parameters (0x12).
+  if (advertising_event_properties.legacy_ &&
+      (operation != Operation::COMPLETE_ADVERTISEMENT ||
+       advertising_data.size() > max_legacy_advertising_pdu_size)) {
+    LOG_INFO(
+        "advertising_event_properties (%02x) is legacy and"
+        " and an incomplete operation was used or the advertising data"
+        " is larger than 31",
+        raw_advertising_event_properties);
+    return ErrorCode::INVALID_HCI_COMMAND_PARAMETERS;
+  }
+
+  // If Operation is 0x04 and:
+  //    • advertising is currently disabled for the advertising set;
+  //    • the advertising set contains no data;
+  //    • the advertising set uses legacy PDUs; or
+  //    • Advertising_Data_Length is not zero;
+  // then the Controller shall return the error code Invalid HCI Command
+  // Parameters (0x12).
+  if (operation == Operation::UNCHANGED_DATA &&
+      (!advertiser.advertising_enable ||
+       advertiser.advertising_data.size() == 0 ||
+       advertising_event_properties.legacy_ || advertising_data.size() != 0)) {
+    LOG_INFO(
+        "Unchanged_Data operation is used but advertising is disabled;"
+        " or the advertising set contains no data;"
+        " or the advertising set uses legacy PDUs;"
+        " or the advertising data is not empty");
+    return ErrorCode::INVALID_HCI_COMMAND_PARAMETERS;
+  }
+
+  // If Operation is not 0x03 or 0x04 and Advertising_Data_Length is zero,
+  // the Controller shall return the error code Invalid HCI
+  // Command Parameters (0x12).
+  if (operation != Operation::COMPLETE_ADVERTISEMENT &&
+      operation != Operation::UNCHANGED_DATA && advertising_data.size() == 0) {
+    LOG_INFO(
+        "operation (%02x) is not Complete_Advertisement or Unchanged_Data"
+        " but the advertising data is empty",
+        static_cast<int>(operation));
+    return ErrorCode::INVALID_HCI_COMMAND_PARAMETERS;
+  }
+
+  // If advertising is currently enabled for the specified advertising set and
+  // Operation does not have the value 0x03 or 0x04, the Controller shall
+  // return the error code Command Disallowed (0x0C).
+  if (advertiser.advertising_enable &&
+      operation != Operation::COMPLETE_ADVERTISEMENT &&
+      operation != Operation::UNCHANGED_DATA) {
+    LOG_INFO(
+        "operation (%02x) is used but advertising is enabled for the"
+        " specified advertising set",
+        static_cast<int>(operation));
+    return ErrorCode::COMMAND_DISALLOWED;
+  }
+
+  switch (operation) {
+    case Operation::INTERMEDIATE_FRAGMENT:
+      advertiser.advertising_data.insert(advertiser.advertising_data.end(),
+                                         advertising_data.begin(),
+                                         advertising_data.end());
+      advertiser.partial_advertising_data = true;
+      break;
+
+    case Operation::FIRST_FRAGMENT:
+      advertiser.advertising_data = advertising_data;
+      advertiser.partial_advertising_data = true;
+      break;
+
+    case Operation::LAST_FRAGMENT:
+      advertiser.advertising_data.insert(advertiser.advertising_data.end(),
+                                         advertising_data.begin(),
+                                         advertising_data.end());
+      advertiser.partial_advertising_data = false;
+      break;
+
+    case Operation::COMPLETE_ADVERTISEMENT:
+      advertiser.advertising_data = advertising_data;
+      advertiser.partial_advertising_data = false;
+      break;
+
+    case Operation::UNCHANGED_DATA:
+      break;
+
+    default:
+      LOG_INFO("unknown operation (%x)", static_cast<int>(operation));
+      return ErrorCode::INVALID_HCI_COMMAND_PARAMETERS;
+  }
+
+  // If the combined length of the data exceeds the capacity of the
+  // advertising set identified by the Advertising_Handle parameter
+  // (see Section 7.8.57 LE Read Maximum Advertising Data Length command)
+  // or the amount of memory currently available, all the data
+  // shall be discarded and the Controller shall return the error code Memory
+  // Capacity Exceeded (0x07).
+  if (advertiser.advertising_data.size() >
+      properties_.le_max_advertising_data_length) {
+    LOG_INFO(
+        "the combined length %zu of the advertising data exceeds the"
+        " advertising set capacity %d",
+        advertiser.advertising_data.size(),
+        properties_.le_max_advertising_data_length);
+    advertiser.advertising_data.clear();
+    advertiser.partial_advertising_data = false;
+    return ErrorCode::MEMORY_CAPACITY_EXCEEDED;
+  }
+
+  // If advertising is currently enabled for the specified advertising set,
+  // the advertising set uses extended advertising, and the length of the
+  // data is greater than the maximum that the Controller can transmit within
+  // the longest possible auxiliary advertising segment consistent with the
+  // current parameters of the advertising set, the Controller shall return
+  // the error code Packet Too Long (0x45). If advertising on the
+  // LE Coded PHY, the S=8 coding shall be assumed.
+  size_t max_advertising_data_length =
+      ExtendedAdvertiser::GetMaxAdvertisingDataLength(
+          advertising_event_properties);
+  if (advertiser.advertising_enable &&
+      advertiser.advertising_data.size() > max_advertising_data_length) {
+    LOG_INFO(
+        "the advertising data contained in the set is larger than the"
+        " available PDU capacity");
+    advertiser.advertising_data.clear();
+    advertiser.partial_advertising_data = false;
+    return ErrorCode::PACKET_TOO_LONG;
+  }
+
+  return ErrorCode::SUCCESS;
+}
+
+// HCI command LE_Set_Extended_Scan_Response_Data (Vol 4, Part E § 7.8.55).
+ErrorCode LinkLayerController::LeSetExtendedScanResponseData(
+    uint8_t advertising_handle, Operation operation,
+    FragmentPreference fragment_preference,
+    const std::vector<uint8_t>& scan_response_data) {
+  // Extended advertising commands are disallowed when legacy advertising
+  // commands were used since the last reset.
+  if (!SelectExtendedAdvertising()) {
+    LOG_INFO(
+        "extended advertising command rejected because legacy advertising"
+        " is being used");
+    return ErrorCode::COMMAND_DISALLOWED;
+  }
+
+  // fragment_preference is unused for now.
+  (void)fragment_preference;
+
+  // If the advertising set corresponding to the Advertising_Handle parameter
+  // does not exist, then the Controller shall return the error code
+  // Unknown Advertising Identifier (0x42).
+  // TODO(c++20) unordered_map<>::contains
+  if (extended_advertisers_.count(advertising_handle) == 0) {
+    LOG_INFO("no advertising set defined with handle %02x",
+             static_cast<int>(advertising_handle));
+    return ErrorCode::UNKNOWN_ADVERTISING_IDENTIFIER;
+  }
+
+  ExtendedAdvertiser& advertiser = extended_advertisers_[advertising_handle];
+  const AdvertisingEventProperties& advertising_event_properties =
+      advertiser.advertising_event_properties;
+  uint16_t raw_advertising_event_properties =
+      ExtendedAdvertiser::GetRawAdvertisingEventProperties(
+          advertising_event_properties);
+
+  // If the advertising set is non-scannable and the Host uses this
+  // command other than to discard existing data, the Controller shall
+  // return the error code Invalid HCI Command Parameters (0x12).
+  if (!advertising_event_properties.scannable_ &&
+      scan_response_data.size() > 0) {
+    LOG_INFO(
+        "advertising_event_properties (%02x) is not scannable"
+        " but the scan response data is not empty",
+        raw_advertising_event_properties);
+    return ErrorCode::INVALID_HCI_COMMAND_PARAMETERS;
+  }
+
+  // If the advertising set uses scannable legacy advertising PDUs and
+  // either Operation is not 0x03 or the Scan_Response_Data_Length
+  // parameter exceeds 31 octets, the Controller shall
+  // return the error code Invalid HCI Command Parameters (0x12).
+  if (advertising_event_properties.scannable_ &&
+      advertising_event_properties.legacy_ &&
+      (operation != Operation::COMPLETE_ADVERTISEMENT ||
+       scan_response_data.size() > max_legacy_advertising_pdu_size)) {
+    LOG_INFO(
+        "advertising_event_properties (%02x) is scannable legacy"
+        " and an incomplete operation was used or the scan response data"
+        " is larger than 31",
+        raw_advertising_event_properties);
+    return ErrorCode::INVALID_HCI_COMMAND_PARAMETERS;
+  }
+
+  // If Operation is not 0x03 and Scan_Response_Data_Length is zero, the
+  // Controller shall return the error code
+  // Invalid HCI Command Parameters (0x12).
+  if (operation != Operation::COMPLETE_ADVERTISEMENT &&
+      scan_response_data.size() == 0) {
+    LOG_INFO(
+        "operation (%02x) is not Complete_Advertisement but the"
+        " scan response data is empty",
+        static_cast<int>(operation));
+    return ErrorCode::INVALID_HCI_COMMAND_PARAMETERS;
+  }
+
+  // If advertising is currently enabled for the specified advertising set and
+  // Operation does not have the value 0x03, the Controller shall
+  // return the error code Command Disallowed (0x0C).
+  if (advertiser.advertising_enable &&
+      operation != Operation::COMPLETE_ADVERTISEMENT) {
+    LOG_INFO(
+        "operation (%02x) is used but advertising is enabled for the"
+        " specified advertising set",
+        static_cast<int>(operation));
+    return ErrorCode::COMMAND_DISALLOWED;
+  }
+
+  // If the advertising set uses scannable extended advertising PDUs,
+  // advertising is currently enabled for the specified advertising set,
+  // and Scan_Response_Data_Length is zero, the Controller shall return
+  // the error code Command Disallowed (0x0C).
+  if (advertiser.advertising_enable &&
+      advertising_event_properties.scannable_ &&
+      !advertising_event_properties.legacy_ && scan_response_data.size() == 0) {
+    LOG_INFO(
+        "advertising_event_properties (%02x) is scannable extended,"
+        " advertising is enabled for the specified advertising set"
+        " and the scan response data is empty",
+        raw_advertising_event_properties);
+    return ErrorCode::COMMAND_DISALLOWED;
+  }
+
+  switch (operation) {
+    case Operation::INTERMEDIATE_FRAGMENT:
+      advertiser.scan_response_data.insert(advertiser.scan_response_data.end(),
+                                           scan_response_data.begin(),
+                                           scan_response_data.end());
+      advertiser.partial_scan_response_data = true;
+      break;
+
+    case Operation::FIRST_FRAGMENT:
+      advertiser.scan_response_data = scan_response_data;
+      advertiser.partial_scan_response_data = true;
+      break;
+
+    case Operation::LAST_FRAGMENT:
+      advertiser.scan_response_data.insert(advertiser.scan_response_data.end(),
+                                           scan_response_data.begin(),
+                                           scan_response_data.end());
+      advertiser.partial_scan_response_data = false;
+      break;
+
+    case Operation::COMPLETE_ADVERTISEMENT:
+      advertiser.scan_response_data = scan_response_data;
+      advertiser.partial_scan_response_data = false;
+      break;
+
+    case Operation::UNCHANGED_DATA:
+      LOG_INFO(
+          "the operation Unchanged_Data is only allowed"
+          " for Advertising_Data");
+      return ErrorCode::INVALID_HCI_COMMAND_PARAMETERS;
+
+    default:
+      LOG_INFO("unknown operation (%x)", static_cast<int>(operation));
+      return ErrorCode::INVALID_HCI_COMMAND_PARAMETERS;
+  }
+
+  // If the combined length of the data exceeds the capacity of the
+  // advertising set identified by the Advertising_Handle parameter
+  // (see Section 7.8.57 LE Read Maximum Advertising Data Length command)
+  // or the amount of memory currently available, all the data shall be
+  // discarded and the Controller shall return the error code
+  // Memory Capacity Exceeded (0x07).
+  if (advertiser.scan_response_data.size() >
+      properties_.le_max_advertising_data_length) {
+    LOG_INFO(
+        "the combined length of the scan response data exceeds the"
+        " advertising set capacity");
+    advertiser.scan_response_data.clear();
+    advertiser.partial_scan_response_data = false;
+    return ErrorCode::MEMORY_CAPACITY_EXCEEDED;
+  }
+
+  // If the advertising set uses extended advertising and the combined length
+  // of the data is greater than the maximum that the Controller can transmit
+  // within the longest possible auxiliary advertising segment consistent
+  // with the current parameters of the advertising set (using the current
+  // advertising interval if advertising is enabled), all the data shall be
+  // discarded and the Controller shall return the error code
+  // Packet Too Long (0x45). If advertising on the LE Coded PHY,
+  // the S=8 coding shall be assumed.
+  if (advertiser.scan_response_data.size() >
+      max_extended_advertising_pdu_size) {
+    LOG_INFO(
+        "the scan response data contained in the set is larger than the"
+        " available PDU capacity");
+    advertiser.scan_response_data.clear();
+    advertiser.partial_scan_response_data = false;
+    return ErrorCode::PACKET_TOO_LONG;
+  }
+
+  return ErrorCode::SUCCESS;
+}
+
+// HCI command LE_Set_Extended_Advertising_Enable (Vol 4, Part E § 7.8.56).
+ErrorCode LinkLayerController::LeSetExtendedAdvertisingEnable(
+    bool enable, const std::vector<bluetooth::hci::EnabledSet>& sets) {
+  // Extended advertising commands are disallowed when legacy advertising
+  // commands were used since the last reset.
+  if (!SelectExtendedAdvertising()) {
+    LOG_INFO(
+        "extended advertising command rejected because legacy advertising"
+        " is being used");
+    return ErrorCode::COMMAND_DISALLOWED;
+  }
+
+  // Validate the advertising handles.
+  std::array<bool, UINT8_MAX> used_advertising_handles{};
+  for (auto& set : sets) {
+    // If the same advertising set is identified by more than one entry in the
+    // Advertising_Handle[i] arrayed parameter, then the Controller shall return
+    // the error code Invalid HCI Command Parameters (0x12).
+    if (used_advertising_handles[set.advertising_handle_]) {
+      LOG_INFO("advertising handle %02x is added more than once",
+               set.advertising_handle_);
+      return ErrorCode::INVALID_HCI_COMMAND_PARAMETERS;
+    }
+
+    // If the advertising set corresponding to the Advertising_Handle[i]
+    // parameter does not exist, then the Controller shall return the error code
+    // Unknown Advertising Identifier (0x42).
+    if (extended_advertisers_.find(set.advertising_handle_) ==
+        extended_advertisers_.end()) {
+      LOG_INFO("advertising handle %02x is not defined",
+               set.advertising_handle_);
+      return ErrorCode::UNKNOWN_ADVERTISING_IDENTIFIER;
+    }
+
+    used_advertising_handles[set.advertising_handle_] = true;
+  }
+
+  // If Enable and Num_Sets are both set to
+  // 0x00, then all advertising sets are disabled.
+  if (!enable && sets.size() == 0) {
+    for (auto& advertiser : extended_advertisers_) {
+      advertiser.second.advertising_enable = false;
+    }
+    return ErrorCode::SUCCESS;
+  }
+
+  // If Num_Sets is set to 0x00, the Controller shall return the error code
+  // Invalid HCI Command Parameters (0x12).
+  if (sets.size() == 0) {
+    LOG_INFO("enable is true but no advertising set is selected");
+    return ErrorCode::INVALID_HCI_COMMAND_PARAMETERS;
+  }
+
+  // No additional checks for disabling advertising sets.
+  if (!enable) {
+    for (auto& set : sets) {
+      auto& advertiser = extended_advertisers_[set.advertising_handle_];
+      advertiser.advertising_enable = false;
+    }
+    return ErrorCode::SUCCESS;
+  }
+
+  // Validate the advertising parameters before enabling any set.
+  for (auto& set : sets) {
+    ExtendedAdvertiser& advertiser =
+        extended_advertisers_[set.advertising_handle_];
+    const AdvertisingEventProperties& advertising_event_properties =
+        advertiser.advertising_event_properties;
+
+    bool extended_advertising = !advertising_event_properties.legacy_;
+    bool connectable_advertising = advertising_event_properties.connectable_;
+    bool scannable_advertising = advertising_event_properties.scannable_;
+    bool directed_advertising = advertising_event_properties.directed_;
+    bool high_duty_cycle_advertising =
+        advertising_event_properties.high_duty_cycle_;
+
+    // If the advertising is high duty cycle connectable directed advertising,
+    // then Duration[i] shall be less than or equal to 1.28 seconds and shall
+    // not be equal to 0.
+    if (connectable_advertising && directed_advertising &&
+        high_duty_cycle_advertising &&
+        (set.duration_ == 0 ||
+         slots(set.duration_) > adv_direct_ind_high_timeout)) {
+      LOG_INFO(
+          "extended advertising is high duty cycle connectable directed"
+          " but the duration is either 0 or larger than 1.28 seconds");
+      return ErrorCode::INVALID_HCI_COMMAND_PARAMETERS;
+    }
+
+    // If the advertising set contains partial advertising data or partial
+    // scan response data, the Controller shall return the error code
+    // Command Disallowed (0x0C).
+    if (advertiser.partial_advertising_data ||
+        advertiser.partial_scan_response_data) {
+      LOG_INFO(
+          "advertising set contains partial advertising"
+          " or scan response data");
+      return ErrorCode::COMMAND_DISALLOWED;
+    }
+
+    // If the advertising set uses scannable extended advertising PDUs and no
+    // scan response data is currently provided, the Controller shall return the
+    // error code Command Disallowed (0x0C).
+    if (extended_advertising && scannable_advertising &&
+        advertiser.scan_response_data.size() == 0) {
+      LOG_INFO(
+          "advertising set uses scannable extended advertising PDUs"
+          " but no scan response data is provided");
+      return ErrorCode::COMMAND_DISALLOWED;
+    }
+
+    // If the advertising set uses connectable extended advertising PDUs and the
+    // advertising data in the advertising set will not fit in the
+    // AUX_ADV_IND PDU, the Controller shall return the error code
+    // Invalid HCI Command Parameters (0x12).
+    if (extended_advertising && connectable_advertising &&
+        advertiser.advertising_data.size() >
+            ExtendedAdvertiser::GetMaxAdvertisingDataLength(
+                advertising_event_properties)) {
+      LOG_INFO(
+          "advertising set uses connectable extended advertising PDUs"
+          " but the advertising data does not fit in AUX_ADV_IND PDUs");
+      return ErrorCode::INVALID_HCI_COMMAND_PARAMETERS;
+    }
+
+    // If extended advertising is being used and the length of any advertising
+    // data or of any scan response data is greater than the maximum that the
+    // Controller can transmit within the longest possible auxiliary
+    // advertising segment consistent with the chosen advertising interval,
+    // the Controller shall return the error code Packet Too Long (0x45).
+    // If advertising on the LE Coded PHY, the S=8 coding shall be assumed.
+    if (extended_advertising && (advertiser.advertising_data.size() >
+                                     max_extended_advertising_pdu_size ||
+                                 advertiser.scan_response_data.size() >
+                                     max_extended_advertising_pdu_size)) {
+      LOG_INFO(
+          "advertising set uses extended advertising PDUs"
+          " but the advertising data does not fit in advertising PDUs");
+      return ErrorCode::PACKET_TOO_LONG;
+    }
+
+    AddressWithType peer_address = PeerDeviceAddress(
+        advertiser.peer_address, advertiser.peer_address_type);
+    AddressWithType public_address{address_,
+                                   AddressType::PUBLIC_DEVICE_ADDRESS};
+    AddressWithType random_address{
+        advertiser.random_address.value_or(Address::kEmpty),
+        AddressType::RANDOM_DEVICE_ADDRESS};
+    std::optional<AddressWithType> resolvable_address =
+        GenerateResolvablePrivateAddress(peer_address, IrkSelection::Local);
+
+    // TODO: additional checks would apply in the case of a LE only Controller
+    // with no configured public device address.
+
+    switch (advertiser.own_address_type) {
+      case OwnAddressType::PUBLIC_DEVICE_ADDRESS:
+        advertiser.advertising_address = public_address;
+        break;
+
+      case OwnAddressType::RANDOM_DEVICE_ADDRESS:
+        // If the advertising set's Own_Address_Type parameter is set to 0x01
+        // and the random address for the advertising set has not been
+        // initialized using the HCI_LE_Set_Advertising_Set_Random_Address
+        // command, the Controller shall return the error code
+        // Invalid HCI Command Parameters (0x12).
+        if (random_address.GetAddress() == Address::kEmpty) {
+          LOG_INFO(
+              "own_address_type is Random_Device_Address but the Random_Address"
+              " has not been initialized");
+          return ErrorCode::INVALID_HCI_COMMAND_PARAMETERS;
+        }
+        advertiser.advertising_address = random_address;
+        break;
+
+      case OwnAddressType::RESOLVABLE_OR_PUBLIC_ADDRESS:
+        advertiser.advertising_address =
+            resolvable_address.value_or(public_address);
+        break;
+
+      case OwnAddressType::RESOLVABLE_OR_RANDOM_ADDRESS:
+        // If the advertising set's Own_Address_Type parameter is set to 0x03,
+        // the controller's resolving list did not contain a matching entry,
+        // and the random address for the advertising set has not been
+        // initialized using the HCI_LE_Set_Advertising_Set_Random_Address
+        // command, the Controller shall return the error code
+        // Invalid HCI Command Parameters (0x12).
+        if (resolvable_address) {
+          advertiser.advertising_address = resolvable_address.value();
+        } else if (random_address.GetAddress() == Address::kEmpty) {
+          LOG_INFO(
+              "own_address_type is Resolvable_Or_Random_Address but the"
+              " Resolving_List does not contain a matching entry and the"
+              " Random_Address is not initialized");
+          return ErrorCode::INVALID_HCI_COMMAND_PARAMETERS;
+        } else {
+          advertiser.advertising_address = random_address;
+        }
+        break;
+    }
+  }
+
+  for (auto& set : sets) {
+    ExtendedAdvertiser& advertiser =
+        extended_advertisers_[set.advertising_handle_];
+
+    advertiser.num_completed_extended_advertising_events = 0;
+    advertiser.advertising_enable = true;
+    advertiser.next_event = std::chrono::steady_clock::now() +
+                            advertiser.primary_advertising_interval;
+  }
+
+  return ErrorCode::SUCCESS;
+}
+
+// HCI command LE_Remove_Advertising_Set (Vol 4, Part E § 7.8.59).
+ErrorCode LinkLayerController::LeRemoveAdvertisingSet(
+    uint8_t advertising_handle) {
+  // If the advertising set corresponding to the Advertising_Handle parameter
+  // does not exist, then the Controller shall return the error code
+  // Unknown Advertising Identifier (0x42).
+  auto advertiser = extended_advertisers_.find(advertising_handle);
+  if (advertiser == extended_advertisers_.end()) {
+    LOG_INFO("no advertising set defined with handle %02x",
+             static_cast<int>(advertising_handle));
+    return ErrorCode::UNKNOWN_ADVERTISING_IDENTIFIER;
+  }
+
+  // If advertising or periodic advertising on the advertising set is
+  // enabled, then the Controller shall return the error code
+  // Command Disallowed (0x0C).
+  if (advertiser->second.advertising_enable) {
+    LOG_INFO("the advertising set defined with handle %02x is enabled",
+             static_cast<int>(advertising_handle));
+    return ErrorCode::COMMAND_DISALLOWED;
+  }
+
+  extended_advertisers_.erase(advertiser);
+  return ErrorCode::SUCCESS;
+}
+
+// HCI command LE_Clear_Advertising_Sets (Vol 4, Part E § 7.8.60).
+ErrorCode LinkLayerController::LeClearAdvertisingSets() {
+  // If advertising or periodic advertising is enabled on any advertising set,
+  // then the Controller shall return the error code Command Disallowed (0x0C).
+  for (auto& advertiser : extended_advertisers_) {
+    if (advertiser.second.advertising_enable) {
+      LOG_INFO("the advertising set with handle %02x is enabled",
+               static_cast<int>(advertiser.second.advertising_enable));
+      return ErrorCode::COMMAND_DISALLOWED;
+    }
+  }
+
+  extended_advertisers_.clear();
+  return ErrorCode::SUCCESS;
+}
+
+uint16_t ExtendedAdvertiser::GetMaxAdvertisingDataLength(
+    const AdvertisingEventProperties& properties) {
+  // The PDU AdvData size is defined in the following sections:
+  // - Vol 6, Part B § 2.3.1.1 ADV_IND
+  // - Vol 6, Part B § 2.3.1.2 ADV_DIRECT_IND
+  // - Vol 6, Part B § 2.3.1.3 ADV_NONCONN_IND
+  // - Vol 6, Part B § 2.3.1.4 ADV_SCAN_IND
+  // - Vol 6, Part B § 2.3.1.5 ADV_EXT_IND
+  // - Vol 6, Part B § 2.3.1.6 AUX_ADV_IND
+  // - Vol 6, Part B § 2.3.1.8 AUX_CHAIN_IND
+  // - Vol 6, Part B § 2.3.4 Common Extended Advertising Payload Format
+  uint16_t max_advertising_data_length;
+
+  if (properties.legacy_ && properties.directed_) {
+    // Directed legacy advertising PDUs do not have AdvData payload.
+    max_advertising_data_length = 0;
+  } else if (properties.legacy_) {
+    max_advertising_data_length = max_legacy_advertising_pdu_size;
+  } else if (properties.scannable_) {
+    // Scannable extended advertising PDUs do not have AdvData payload.
+    max_advertising_data_length = 0;
+  } else if (!properties.connectable_) {
+    // When extended advertising is non-scannable and non-connectable,
+    // AUX_CHAIN_IND PDUs can be used, and the advertising data may be
+    // fragmented over multiple PDUs; the length is still capped at 1650
+    // as stated in Vol 6, Part B § 2.3.4.9 Host Advertising Data.
+    max_advertising_data_length = max_extended_advertising_pdu_size;
+  } else {
+    // When extended advertising is either scannable or connectable,
+    // AUX_CHAIN_IND PDUs may not be used, and the maximum advertising data
+    // length is 254. Extended payload header fields eat into the
+    // available space.
+    max_advertising_data_length = 254;
+    max_advertising_data_length -= 6;                         // AdvA
+    max_advertising_data_length -= 2;                         // ADI
+    max_advertising_data_length -= 6 * properties.directed_;  // TargetA
+    max_advertising_data_length -= 1 * properties.tx_power_;  // TxPower
+    // TODO(pedantic): configure the ACAD field in order to leave the least
+    // amount of AdvData space to the user (191).
+  }
+
+  return max_advertising_data_length;
+}
+
+uint16_t ExtendedAdvertiser::GetMaxScanResponseDataLength(
+    const AdvertisingEventProperties& properties) {
+  // The PDU AdvData size is defined in the following sections:
+  // - Vol 6, Part B § 2.3.2.2 SCAN_RSP
+  // - Vol 6, Part B § 2.3.2.3 AUX_SCAN_RSP
+  // - Vol 6, Part B § 2.3.1.8 AUX_CHAIN_IND
+  // - Vol 6, Part B § 2.3.4 Common Extended Advertising Payload Format
+  uint16_t max_scan_response_data_length;
+
+  if (!properties.scannable_) {
+    max_scan_response_data_length = 0;
+  } else if (properties.legacy_) {
+    max_scan_response_data_length = max_legacy_advertising_pdu_size;
+  } else {
+    // Extended scan response data may be sent over AUX_CHAIN_PDUs, and
+    // the advertising data may be fragmented over multiple PDUs; the length
+    // is still capped at 1650 as stated in
+    // Vol 6, Part B § 2.3.4.9 Host Advertising Data.
+    max_scan_response_data_length = max_extended_advertising_pdu_size;
+  }
+
+  return max_scan_response_data_length;
+}
+
+uint16_t ExtendedAdvertiser::GetRawAdvertisingEventProperties(
+    const AdvertisingEventProperties& properties) {
+  uint16_t mask = 0;
+  if (properties.connectable_) mask |= 0x1;
+  if (properties.scannable_) mask |= 0x2;
+  if (properties.directed_) mask |= 0x4;
+  if (properties.high_duty_cycle_) mask |= 0x8;
+  if (properties.legacy_) mask |= 0x10;
+  if (properties.anonymous_) mask |= 0x20;
+  if (properties.tx_power_) mask |= 0x40;
+  return mask;
+}
+
+// =============================================================================
+//  Advertising Routines
+// =============================================================================
+
+void LinkLayerController::LeAdvertising() {
+  chrono::time_point now = std::chrono::steady_clock::now();
+
+  // Legacy Advertising Timeout
+
+  // Generate HCI Connection Complete or Enhanced HCI Connection Complete
+  // events with Advertising Timeout error code when the advertising
+  // type is ADV_DIRECT_IND and the connection failed to be established.
+  if (legacy_advertiser_.IsEnabled() && legacy_advertiser_.timeout &&
+      now >= legacy_advertiser_.timeout.value()) {
+    // If the Advertising_Type parameter is 0x01 (ADV_DIRECT_IND, high duty
+    // cycle) and the directed advertising fails to create a connection, an
+    // HCI_LE_Connection_Complete or HCI_LE_Enhanced_Connection_Complete
+    // event shall be generated with the Status code set to
+    // Advertising Timeout (0x3C).
     LOG_INFO("Directed Advertising Timeout");
-    enabled_ = false;
-    return bluetooth::hci::LeConnectionCompleteBuilder::Create(
-        ErrorCode::ADVERTISING_TIMEOUT, 0, bluetooth::hci::Role::CENTRAL,
-        bluetooth::hci::AddressType::PUBLIC_DEVICE_ADDRESS,
-        bluetooth::hci::Address(), 0, 0, 0,
-        bluetooth::hci::ClockAccuracy::PPM_500);
+    legacy_advertiser_.Disable();
+
+    // TODO: The PTS tool expects an LE_Connection_Complete event in this
+    // case and will fail the test GAP/DISC/GENP/BV-05-C if
+    // LE_Enhanced_Connection_Complete is sent instead.
+    //
+    // Note: HCI_LE_Connection_Complete is not sent if the
+    // HCI_LE_Enhanced_Connection_Complete event (see Section 7.7.65.10)
+    // is unmasked.
+#if 0
+    if (IsLeEventUnmasked(SubeventCode::ENHANCED_CONNECTION_COMPLETE)) {
+      send_event_(bluetooth::hci::LeEnhancedConnectionCompleteBuilder::Create(
+          ErrorCode::ADVERTISING_TIMEOUT, 0, Role::CENTRAL,
+          AddressType::PUBLIC_DEVICE_ADDRESS, Address(), Address(), Address(),
+          0, 0, 0, ClockAccuracy::PPM_500));
+    } else
+#endif
+    if (IsLeEventUnmasked(SubeventCode::CONNECTION_COMPLETE)) {
+      send_event_(bluetooth::hci::LeConnectionCompleteBuilder::Create(
+          ErrorCode::ADVERTISING_TIMEOUT, 0, Role::CENTRAL,
+          AddressType::PUBLIC_DEVICE_ADDRESS, Address(), 0, 0, 0,
+          ClockAccuracy::PPM_500));
+    }
   }
 
-  // [Vol 4] Part E 7.8.56  LE Set Extended Advertising Enable command
-  if (extended_ && now >= ending_time_ && limited_) {
-    LOG_INFO("Extended Advertising Timeout");
-    enabled_ = false;
-    return bluetooth::hci::LeAdvertisingSetTerminatedBuilder::Create(
-        ErrorCode::SUCCESS, advertising_handle_, 0, num_events_);
+  // Legacy Advertising Event
+
+  // Generate Link Layer Advertising events when advertising is enabled
+  // and a full interval has passed since the last event.
+  if (legacy_advertiser_.IsEnabled() && now >= legacy_advertiser_.next_event) {
+    legacy_advertiser_.next_event += legacy_advertiser_.advertising_interval;
+    model::packets::LegacyAdvertisingType type;
+    bool attach_advertising_data = true;
+    switch (legacy_advertiser_.advertising_type) {
+      case AdvertisingType::ADV_IND:
+        type = model::packets::LegacyAdvertisingType::ADV_IND;
+        break;
+      case AdvertisingType::ADV_DIRECT_IND_HIGH:
+      case AdvertisingType::ADV_DIRECT_IND_LOW:
+        attach_advertising_data = false;
+        type = model::packets::LegacyAdvertisingType::ADV_DIRECT_IND;
+        break;
+      case AdvertisingType::ADV_SCAN_IND:
+        type = model::packets::LegacyAdvertisingType::ADV_SCAN_IND;
+        break;
+      case AdvertisingType::ADV_NONCONN_IND:
+        type = model::packets::LegacyAdvertisingType::ADV_NONCONN_IND;
+        break;
+    }
+
+    SendLeLinkLayerPacketWithRssi(
+        legacy_advertiser_.advertising_address.GetAddress(),
+        legacy_advertiser_.target_address.GetAddress(),
+        properties_.le_advertising_physical_channel_tx_power,
+        model::packets::LeLegacyAdvertisingPduBuilder::Create(
+            legacy_advertiser_.advertising_address.GetAddress(),
+            legacy_advertiser_.target_address.GetAddress(),
+            static_cast<model::packets::AddressType>(
+                legacy_advertiser_.advertising_address.GetAddressType()),
+            static_cast<model::packets::AddressType>(
+                legacy_advertiser_.target_address.GetAddressType()),
+            type,
+            attach_advertising_data ? legacy_advertiser_.advertising_data
+                                    : std::vector<uint8_t>{}));
   }
 
-  return nullptr;
-}
+  for (auto& [_, advertiser] : extended_advertisers_) {
+    // Extended Advertising Timeouts
 
-std::unique_ptr<model::packets::LinkLayerPacketBuilder>
-LeAdvertiser::GetAdvertisement(std::chrono::steady_clock::time_point now) {
-  if (!enabled_) {
-    return nullptr;
-  }
+    if (advertiser.IsEnabled() && advertiser.timeout &&
+        now >= advertiser.timeout.value()) {
+      // If the Duration[i] parameter is set to a value other than 0x0000, an
+      // HCI_LE_Advertising_Set_Terminated event shall be generated when the
+      // duration specified in the Duration[i] parameter expires.
+      // However, if the advertising set is for high duty cycle connectable
+      // directed advertising and no connection is created before the duration
+      // expires, an HCI_LE_Connection_Complete or
+      // HCI_LE_Enhanced_Connection_Complete event with the Status parameter
+      // set to the error code Advertising Timeout (0x3C) may be generated
+      // instead of or in addition to the HCI_LE_Advertising_Set_Terminated
+      // event.
+      LOG_INFO("Extended Advertising Timeout");
+      advertiser.Disable();
 
-  if (now - last_le_advertisement_ < interval_) {
-    return nullptr;
-  }
+      bool high_duty_cycle_connectable_directed_advertising =
+          advertiser.advertising_event_properties.directed_ &&
+          advertiser.advertising_event_properties.connectable_ &&
+          advertiser.advertising_event_properties.high_duty_cycle_;
 
-  last_le_advertisement_ = now;
-  num_events_ += (num_events_ < 255 ? 1 : 0);
-  if (tx_power_ == kTxPowerUnavailable) {
-    return model::packets::LeAdvertisementBuilder::Create(
-        address_.GetAddress(), peer_address_.GetAddress(),
-        static_cast<model::packets::AddressType>(address_.GetAddressType()),
-        type_, advertisement_);
-  } else {
-    uint8_t tx_power_jittered = 2 + tx_power_ - (num_events_ & 0x03);
-    return model::packets::RssiWrapperBuilder::Create(
-        address_.GetAddress(), peer_address_.GetAddress(), tx_power_jittered,
-        model::packets::LeAdvertisementBuilder::Create(
-            address_.GetAddress(), peer_address_.GetAddress(),
-            static_cast<model::packets::AddressType>(address_.GetAddressType()),
-            type_, advertisement_));
-  }
-}
-
-std::unique_ptr<model::packets::LinkLayerPacketBuilder>
-LeAdvertiser::GetScanResponse(bluetooth::hci::Address scanned,
-                              bluetooth::hci::Address scanner) {
-  if (scanned != address_.GetAddress() || !enabled_) {
-    return nullptr;
-  }
-  switch (filter_policy_) {
-    case bluetooth::hci::LeScanningFilterPolicy::
-        FILTER_ACCEPT_LIST_AND_INITIATORS_IDENTITY:
-    case bluetooth::hci::LeScanningFilterPolicy::FILTER_ACCEPT_LIST_ONLY:
-      LOG_WARN("ScanResponses don't handle connect list filters");
-      return nullptr;
-    case bluetooth::hci::LeScanningFilterPolicy::CHECK_INITIATORS_IDENTITY:
-      if (scanner != peer_address_.GetAddress()) {
-        return nullptr;
+      // Note: HCI_LE_Connection_Complete is not sent if the
+      // HCI_LE_Enhanced_Connection_Complete event (see Section 7.7.65.10)
+      // is unmasked.
+      if (high_duty_cycle_connectable_directed_advertising &&
+          IsLeEventUnmasked(SubeventCode::ENHANCED_CONNECTION_COMPLETE)) {
+        send_event_(bluetooth::hci::LeEnhancedConnectionCompleteBuilder::Create(
+            ErrorCode::ADVERTISING_TIMEOUT, 0, Role::CENTRAL,
+            AddressType::PUBLIC_DEVICE_ADDRESS, Address(), Address(), Address(),
+            0, 0, 0, ClockAccuracy::PPM_500));
+      } else if (high_duty_cycle_connectable_directed_advertising &&
+                 IsLeEventUnmasked(SubeventCode::CONNECTION_COMPLETE)) {
+        send_event_(bluetooth::hci::LeConnectionCompleteBuilder::Create(
+            ErrorCode::ADVERTISING_TIMEOUT, 0, Role::CENTRAL,
+            AddressType::PUBLIC_DEVICE_ADDRESS, Address(), 0, 0, 0,
+            ClockAccuracy::PPM_500));
       }
-      break;
-    case bluetooth::hci::LeScanningFilterPolicy::ACCEPT_ALL:
-      break;
-  }
-  if (tx_power_ == kTxPowerUnavailable) {
-    return model::packets::LeScanResponseBuilder::Create(
-        address_.GetAddress(), peer_address_.GetAddress(),
-        static_cast<model::packets::AddressType>(address_.GetAddressType()),
-        model::packets::AdvertisementType::SCAN_RESPONSE, scan_response_);
-  } else {
-    uint8_t tx_power_jittered = 2 + tx_power_ - (num_events_ & 0x03);
-    return model::packets::RssiWrapperBuilder::Create(
-        address_.GetAddress(), peer_address_.GetAddress(), tx_power_jittered,
-        model::packets::LeScanResponseBuilder::Create(
-            address_.GetAddress(), peer_address_.GetAddress(),
-            static_cast<model::packets::AddressType>(address_.GetAddressType()),
-            model::packets::AdvertisementType::SCAN_RESPONSE, scan_response_));
+
+      if (IsLeEventUnmasked(SubeventCode::ADVERTISING_SET_TERMINATED)) {
+        send_event_(bluetooth::hci::LeAdvertisingSetTerminatedBuilder::Create(
+            ErrorCode::ADVERTISING_TIMEOUT, advertiser.advertising_handle, 0,
+            advertiser.num_completed_extended_advertising_events));
+      }
+    }
+
+    if (advertiser.IsEnabled() && advertiser.max_extended_advertising_events &&
+        advertiser.num_completed_extended_advertising_events >=
+            advertiser.max_extended_advertising_events) {
+      // If the Max_Extended_Advertising_Events[i] parameter is set to a value
+      // other than 0x00, an HCI_LE_Advertising_Set_Terminated event shall be
+      // generated when the maximum number of extended advertising events has
+      // been transmitted by the Controller.
+      LOG_INFO("Max Extended Advertising count reached");
+      advertiser.Disable();
+
+      if (IsLeEventUnmasked(SubeventCode::ADVERTISING_SET_TERMINATED)) {
+        send_event_(bluetooth::hci::LeAdvertisingSetTerminatedBuilder::Create(
+            ErrorCode::ADVERTISING_TIMEOUT, advertiser.advertising_handle, 0,
+            advertiser.num_completed_extended_advertising_events));
+      }
+    }
+
+    // Extended Advertising Event
+
+    // Generate Link Layer Advertising events when advertising is enabled
+    // and a full interval has passed since the last event.
+    if (advertiser.IsEnabled() && now >= advertiser.next_event) {
+      advertiser.next_event += advertiser.primary_advertising_interval;
+      advertiser.num_completed_extended_advertising_events++;
+
+      if (advertiser.advertising_event_properties.legacy_) {
+        model::packets::LegacyAdvertisingType type;
+        uint16_t raw_advertising_event_properties =
+            ExtendedAdvertiser::GetRawAdvertisingEventProperties(
+                advertiser.advertising_event_properties);
+        switch (static_cast<LegacyAdvertisingEventProperties>(
+            raw_advertising_event_properties & 0xf)) {
+          case LegacyAdvertisingEventProperties::ADV_IND:
+            type = model::packets::LegacyAdvertisingType::ADV_IND;
+            break;
+          case LegacyAdvertisingEventProperties::ADV_DIRECT_IND_HIGH:
+          case LegacyAdvertisingEventProperties::ADV_DIRECT_IND_LOW:
+            type = model::packets::LegacyAdvertisingType::ADV_DIRECT_IND;
+            break;
+          case LegacyAdvertisingEventProperties::ADV_SCAN_IND:
+            type = model::packets::LegacyAdvertisingType::ADV_SCAN_IND;
+            break;
+          case LegacyAdvertisingEventProperties::ADV_NONCONN_IND:
+            type = model::packets::LegacyAdvertisingType::ADV_NONCONN_IND;
+            break;
+          default:
+            ASSERT(
+                "unexpected raw advertising event properties;"
+                " please check the extended advertising parameter validation");
+            break;
+        }
+
+        SendLeLinkLayerPacketWithRssi(
+            advertiser.advertising_address.GetAddress(),
+            advertiser.target_address.GetAddress(),
+            advertiser.advertising_tx_power,
+            model::packets::LeLegacyAdvertisingPduBuilder::Create(
+                advertiser.advertising_address.GetAddress(),
+                advertiser.target_address.GetAddress(),
+                static_cast<model::packets::AddressType>(
+                    advertiser.advertising_address.GetAddressType()),
+                static_cast<model::packets::AddressType>(
+                    advertiser.target_address.GetAddressType()),
+                type, advertiser.advertising_data));
+      } else {
+        SendLeLinkLayerPacketWithRssi(
+            advertiser.advertising_address.GetAddress(),
+            advertiser.target_address.GetAddress(),
+            advertiser.advertising_tx_power,
+            model::packets::LeExtendedAdvertisingPduBuilder::Create(
+                advertiser.advertising_address.GetAddress(),
+                advertiser.target_address.GetAddress(),
+                static_cast<model::packets::AddressType>(
+                    advertiser.advertising_address.GetAddressType()),
+                static_cast<model::packets::AddressType>(
+                    advertiser.target_address.GetAddressType()),
+                advertiser.advertising_event_properties.connectable_,
+                advertiser.advertising_event_properties.scannable_,
+                advertiser.advertising_event_properties.directed_,
+                advertiser.advertising_sid, advertiser.advertising_tx_power,
+                static_cast<model::packets::PrimaryPhyType>(
+                    advertiser.primary_advertising_phy),
+                static_cast<model::packets::SecondaryPhyType>(
+                    advertiser.secondary_advertising_phy),
+                advertiser.advertising_data));
+      }
+    }
   }
 }
 
diff --git a/tools/rootcanal/model/controller/le_advertiser.h b/tools/rootcanal/model/controller/le_advertiser.h
index afd1ad1..b5cb8c5 100644
--- a/tools/rootcanal/model/controller/le_advertiser.h
+++ b/tools/rootcanal/model/controller/le_advertiser.h
@@ -19,6 +19,8 @@
 #include <chrono>
 #include <cstdint>
 #include <memory>
+#include <optional>
+#include <ratio>
 
 #include "hci/address_with_type.h"
 #include "hci/hci_packets.h"
@@ -26,84 +28,141 @@
 
 namespace rootcanal {
 
-// Track a single advertising instance
-class LeAdvertiser {
+// Duration type for slots (increments of 625us).
+using slots =
+    std::chrono::duration<unsigned long long, std::ratio<625, 1000000>>;
+
+// User defined literal for slots, e.g. `0x800_slots`
+slots operator"" _slots(unsigned long long count);
+
+using namespace bluetooth::hci;
+
+// Advertising interface common to legacy and extended advertisers.
+class Advertiser {
  public:
-  LeAdvertiser() = default;
-  virtual ~LeAdvertiser() = default;
+  Advertiser() = default;
+  ~Advertiser() = default;
 
-  void Initialize(bluetooth::hci::AddressWithType address,
-                  bluetooth::hci::AddressWithType peer_address,
-                  bluetooth::hci::LeScanningFilterPolicy filter_policy,
-                  model::packets::AdvertisementType type,
-                  const std::vector<uint8_t>& advertisement,
-                  const std::vector<uint8_t>& scan_response,
-                  std::chrono::steady_clock::duration interval);
+  bool IsEnabled() const { return advertising_enable; }
+  void Disable() { advertising_enable = false; }
 
-  void InitializeExtended(
-      unsigned advertising_handle, bluetooth::hci::OwnAddressType address_type,
-      bluetooth::hci::AddressWithType public_address,
-      bluetooth::hci::AddressWithType peer_address,
-      bluetooth::hci::LeScanningFilterPolicy filter_policy,
-      model::packets::AdvertisementType type,
-      std::chrono::steady_clock::duration interval, uint8_t tx_power,
-      const std::function<bluetooth::hci::Address()>& get_address);
+  AddressWithType GetAdvertisingAddress() const { return advertising_address; }
+  AddressWithType GetTargetAddress() const { return target_address; }
 
-  void SetAddress(bluetooth::hci::Address address);
+  // HCI properties.
+  bool advertising_enable{false};
+  AddressWithType advertising_address{Address::kEmpty,
+                                      AddressType::PUBLIC_DEVICE_ADDRESS};
+  AddressWithType target_address{Address::kEmpty,
+                                 AddressType::PUBLIC_DEVICE_ADDRESS};
 
-  void SetData(const std::vector<uint8_t>& data);
+  // Time keeping.
+  std::chrono::steady_clock::time_point next_event{};
+  std::optional<std::chrono::steady_clock::time_point> timeout{};
+};
 
-  void SetScanResponse(const std::vector<uint8_t>& data);
+// Implement the unique legacy advertising instance.
+// For extended advertising check the ExtendedAdvertiser class.
+class LegacyAdvertiser : public Advertiser {
+ public:
+  LegacyAdvertiser() = default;
+  ~LegacyAdvertiser() = default;
 
-  // Generate LE Connection Complete or LE Extended Advertising Set Terminated
-  // events at the end of the advertising period. The advertiser is
-  // automatically disabled.
-  std::unique_ptr<bluetooth::hci::EventBuilder> GetEvent(
-      std::chrono::steady_clock::time_point);
+  bool IsScannable() const {
+    return advertising_type != AdvertisingType::ADV_NONCONN_IND &&
+           advertising_type != AdvertisingType::ADV_DIRECT_IND_HIGH &&
+           advertising_type != AdvertisingType::ADV_DIRECT_IND_LOW;
+  }
 
-  std::unique_ptr<model::packets::LinkLayerPacketBuilder> GetAdvertisement(
-      std::chrono::steady_clock::time_point);
+  bool IsConnectable() const {
+    return advertising_type != AdvertisingType::ADV_NONCONN_IND &&
+           advertising_type != AdvertisingType::ADV_SCAN_IND;
+  }
 
-  std::unique_ptr<model::packets::LinkLayerPacketBuilder> GetScanResponse(
-      bluetooth::hci::Address scanned_address,
-      bluetooth::hci::Address scanner_address);
+  bool IsDirected() const {
+    return advertising_type == AdvertisingType::ADV_DIRECT_IND_HIGH ||
+           advertising_type == AdvertisingType::ADV_DIRECT_IND_LOW;
+  }
 
-  void Clear();
-  void Disable();
-  void Enable();
-  void EnableExtended(std::chrono::milliseconds duration);
+  // Host configuration parameters. Gather the configuration from the
+  // legacy advertising HCI commands. The initial configuration
+  // matches the default values of the parameters of the HCI command
+  // LE Set Advertising Parameters.
+  slots advertising_interval{0x0800};
+  AdvertisingType advertising_type{AdvertisingType::ADV_IND};
+  OwnAddressType own_address_type{OwnAddressType::PUBLIC_DEVICE_ADDRESS};
+  PeerAddressType peer_address_type{
+      PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS};
+  Address peer_address{};
+  uint8_t advertising_channel_map{0x07};
+  AdvertisingFilterPolicy advertising_filter_policy{
+      AdvertisingFilterPolicy::ALL_DEVICES};
+  std::vector<uint8_t> advertising_data{};
+  std::vector<uint8_t> scan_response_data{};
+};
 
-  bool IsEnabled() const;
-  bool IsExtended() const;
-  bool IsConnectable() const;
+// Implement a single extended advertising set.
+// The configuration is set by the extended advertising commands;
+// for the legacy advertiser check the LegacyAdvertiser class.
+class ExtendedAdvertiser : public Advertiser {
+ public:
+  ExtendedAdvertiser(uint8_t advertising_handle = 0)
+      : advertising_handle(advertising_handle) {}
+  ~ExtendedAdvertiser() = default;
 
-  uint8_t GetNumAdvertisingEvents() const;
-  bluetooth::hci::AddressWithType GetAddress() const;
+  bool IsScannable() const { return advertising_event_properties.scannable_; }
 
- private:
-  std::function<bluetooth::hci::Address()> default_get_address_ = []() {
-    return bluetooth::hci::Address::kEmpty;
-  };
-  std::function<bluetooth::hci::Address()>& get_address_ = default_get_address_;
-  bluetooth::hci::AddressWithType address_{};
-  bluetooth::hci::AddressWithType public_address_{};
-  bluetooth::hci::OwnAddressType own_address_type_;
-  bluetooth::hci::AddressWithType
-      peer_address_{};  // For directed advertisements
-  bluetooth::hci::LeScanningFilterPolicy filter_policy_{};
-  model::packets::AdvertisementType type_{};
-  std::vector<uint8_t> advertisement_;
-  std::vector<uint8_t> scan_response_;
-  std::chrono::steady_clock::duration interval_{};
-  std::chrono::steady_clock::time_point ending_time_{};
-  std::chrono::steady_clock::time_point last_le_advertisement_{};
-  static constexpr uint8_t kTxPowerUnavailable = 0x7f;
-  uint8_t tx_power_{kTxPowerUnavailable};
-  uint8_t num_events_{0};
-  bool extended_{false};
-  bool enabled_{false};
-  bool limited_{false};  // Set if the advertising set has a timeout.
-  unsigned advertising_handle_{0};
+  bool IsConnectable() const {
+    return advertising_event_properties.connectable_;
+  }
+
+  bool IsDirected() const { return advertising_event_properties.directed_; }
+
+  // Host configuration parameters. Gather the configuration from the
+  // extended advertising HCI commands.
+  uint8_t advertising_handle;
+  bool periodic_advertising_enable{false};
+  AdvertisingEventProperties advertising_event_properties{};
+  slots primary_advertising_interval{};
+  uint8_t primary_advertising_channel_map{};
+  OwnAddressType own_address_type{};
+  PeerAddressType peer_address_type{};
+  Address peer_address{};
+  std::optional<Address> random_address{};
+  AdvertisingFilterPolicy advertising_filter_policy{};
+  uint8_t advertising_tx_power{};
+  PrimaryPhyType primary_advertising_phy{};
+  uint8_t secondary_max_skip{};
+  SecondaryPhyType secondary_advertising_phy{};
+  uint8_t advertising_sid{};
+  bool scan_request_notification_enable{};
+  std::vector<uint8_t> advertising_data{};
+  std::vector<uint8_t> scan_response_data{};
+  bool partial_advertising_data{false};
+  bool partial_scan_response_data{false};
+
+  // Enabled state.
+  uint8_t max_extended_advertising_events{0};
+  uint8_t num_completed_extended_advertising_events{0};
+
+  // Not implemented at the moment.
+  bool constant_tone_extensions{false};
+
+  // Compute the maximum advertising data payload size for the selected
+  // advertising event properties. The advertising data is not present if
+  // 0 is returned.
+  static uint16_t GetMaxAdvertisingDataLength(
+      const AdvertisingEventProperties& properties);
+
+  // Compute the maximum scan response data payload size for the selected
+  // advertising event properties. The scan response data is not present if
+  // 0 is returned.
+  static uint16_t GetMaxScanResponseDataLength(
+      const AdvertisingEventProperties& properties);
+
+  // Reconstitute the raw Advertising_Event_Properties bitmask.
+  static uint16_t GetRawAdvertisingEventProperties(
+      const AdvertisingEventProperties& properties);
 };
 
 }  // namespace rootcanal
diff --git a/tools/rootcanal/model/controller/link_layer_controller.cc b/tools/rootcanal/model/controller/link_layer_controller.cc
index 780dff6..d03651c 100644
--- a/tools/rootcanal/model/controller/link_layer_controller.cc
+++ b/tools/rootcanal/model/controller/link_layer_controller.cc
@@ -17,9 +17,12 @@
 #include "link_layer_controller.h"
 
 #include <hci/hci_packets.h>
+#ifdef ROOTCANAL_LMP
+#include <lmp.h>
+#endif /* ROOTCANAL_LMP */
 
 #include "crypto_toolbox/crypto_toolbox.h"
-#include "os/log.h"
+#include "log.h"
 #include "packet/raw_builder.h"
 
 using std::vector;
@@ -27,13 +30,18 @@
 using bluetooth::hci::Address;
 using bluetooth::hci::AddressType;
 using bluetooth::hci::AddressWithType;
+using bluetooth::hci::DirectAdvertisingAddressType;
 using bluetooth::hci::EventCode;
+using bluetooth::hci::LLFeaturesBits;
 using bluetooth::hci::SubeventCode;
 
 using namespace model::packets;
 using model::packets::PacketType;
 using namespace std::literals;
 
+// Temporay define, to be replaced when verbose log level is implemented.
+#define LOG_VERB(...) LOG_INFO(__VA_ARGS__)
+
 namespace rootcanal {
 
 constexpr uint16_t kNumCommandPackets = 0x01;
@@ -50,17 +58,1372 @@
   return -(rssi);
 }
 
-void LinkLayerController::SendLeLinkLayerPacketWithRssi(
-    Address source, Address dest, uint8_t rssi,
-    std::unique_ptr<model::packets::LinkLayerPacketBuilder> packet) {
-  std::shared_ptr<model::packets::RssiWrapperBuilder> shared_packet =
-      model::packets::RssiWrapperBuilder::Create(source, dest, rssi,
-                                                 std::move(packet));
-  ScheduleTask(kNoDelayMs, [this, shared_packet]() {
-    send_to_remote_(shared_packet, Phy::Type::LOW_ENERGY);
-  });
+const Address& LinkLayerController::GetAddress() const { return address_; }
+
+AddressWithType PeerDeviceAddress(Address address,
+                                  PeerAddressType peer_address_type) {
+  switch (peer_address_type) {
+    case PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS:
+      return AddressWithType(address, AddressType::PUBLIC_DEVICE_ADDRESS);
+    case PeerAddressType::RANDOM_DEVICE_OR_IDENTITY_ADDRESS:
+      return AddressWithType(address, AddressType::RANDOM_DEVICE_ADDRESS);
+  }
 }
 
+AddressWithType PeerIdentityAddress(Address address,
+                                    PeerAddressType peer_address_type) {
+  switch (peer_address_type) {
+    case PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS:
+      return AddressWithType(address, AddressType::PUBLIC_IDENTITY_ADDRESS);
+    case PeerAddressType::RANDOM_DEVICE_OR_IDENTITY_ADDRESS:
+      return AddressWithType(address, AddressType::RANDOM_IDENTITY_ADDRESS);
+  }
+}
+
+bool LinkLayerController::IsEventUnmasked(EventCode event) const {
+  uint64_t bit = UINT64_C(1) << (static_cast<uint8_t>(event) - 1);
+  return (event_mask_ & bit) != 0;
+}
+
+bool LinkLayerController::IsLeEventUnmasked(SubeventCode subevent) const {
+  uint64_t bit = UINT64_C(1) << (static_cast<uint8_t>(subevent) - 1);
+  return IsEventUnmasked(EventCode::LE_META_EVENT) &&
+         (le_event_mask_ & bit) != 0;
+}
+
+bool LinkLayerController::FilterAcceptListBusy() {
+  // Filter Accept List cannot be modified when
+  //  • any advertising filter policy uses the Filter Accept List and
+  //    advertising is enabled,
+  if (legacy_advertiser_.IsEnabled() &&
+      legacy_advertiser_.advertising_filter_policy !=
+          bluetooth::hci::AdvertisingFilterPolicy::ALL_DEVICES) {
+    return true;
+  }
+
+  for (auto const& [_, advertiser] : extended_advertisers_) {
+    if (advertiser.IsEnabled() &&
+        advertiser.advertising_filter_policy !=
+            bluetooth::hci::AdvertisingFilterPolicy::ALL_DEVICES) {
+      return true;
+    }
+  }
+
+  //  • the scanning filter policy uses the Filter Accept List and scanning
+  //    is enabled,
+  if (scanner_.IsEnabled() &&
+      (scanner_.scan_filter_policy ==
+           bluetooth::hci::LeScanningFilterPolicy::FILTER_ACCEPT_LIST_ONLY ||
+       scanner_.scan_filter_policy ==
+           bluetooth::hci::LeScanningFilterPolicy::
+               FILTER_ACCEPT_LIST_AND_INITIATORS_IDENTITY)) {
+    return true;
+  }
+
+  //  • the initiator filter policy uses the Filter Accept List and an
+  //    HCI_LE_Create_Connection or HCI_LE_Extended_Create_Connection
+  //    command is pending.
+  if (initiator_.IsEnabled() &&
+      initiator_.initiator_filter_policy ==
+          bluetooth::hci::InitiatorFilterPolicy::USE_FILTER_ACCEPT_LIST) {
+    return true;
+  }
+
+  return false;
+}
+
+bool LinkLayerController::LeFilterAcceptListContainsDevice(
+    FilterAcceptListAddressType address_type, Address address) {
+  for (auto const& entry : le_filter_accept_list_) {
+    if (entry.address_type == address_type &&
+        (address_type == FilterAcceptListAddressType::ANONYMOUS_ADVERTISERS ||
+         entry.address == address)) {
+      return true;
+    }
+  }
+
+  return false;
+}
+
+bool LinkLayerController::LeFilterAcceptListContainsDevice(
+    AddressWithType address) {
+  FilterAcceptListAddressType address_type;
+  switch (address.GetAddressType()) {
+    case AddressType::PUBLIC_DEVICE_ADDRESS:
+    case AddressType::PUBLIC_IDENTITY_ADDRESS:
+      address_type = FilterAcceptListAddressType::PUBLIC;
+      break;
+    case AddressType::RANDOM_DEVICE_ADDRESS:
+    case AddressType::RANDOM_IDENTITY_ADDRESS:
+      address_type = FilterAcceptListAddressType::RANDOM;
+      break;
+  }
+
+  return LeFilterAcceptListContainsDevice(address_type, address.GetAddress());
+}
+
+bool LinkLayerController::ResolvingListBusy() {
+  // The resolving list cannot be modified when
+  //  • Advertising (other than periodic advertising) is enabled,
+  if (legacy_advertiser_.IsEnabled()) {
+    return true;
+  }
+
+  for (auto const& [_, advertiser] : extended_advertisers_) {
+    if (advertiser.IsEnabled()) {
+      return true;
+    }
+  }
+
+  //  • Scanning is enabled,
+  if (scanner_.IsEnabled()) {
+    return true;
+  }
+
+  //  • an HCI_LE_Create_Connection, HCI_LE_Extended_Create_Connection, or
+  //    HCI_LE_Periodic_Advertising_Create_Sync command is pending.
+  if (initiator_.IsEnabled()) {
+    return true;
+  }
+
+  return false;
+}
+
+std::optional<AddressWithType> LinkLayerController::ResolvePrivateAddress(
+    AddressWithType address, IrkSelection irk) {
+  if (!address.IsRpa()) {
+    return address;
+  }
+
+  if (!le_resolving_list_enabled_) {
+    return {};
+  }
+
+  for (auto const& entry : le_resolving_list_) {
+    std::array<uint8_t, LinkLayerController::kIrkSize> const& used_irk =
+        irk == IrkSelection::Local ? entry.local_irk : entry.peer_irk;
+
+    if (address.IsRpaThatMatchesIrk(used_irk)) {
+      return PeerIdentityAddress(entry.peer_identity_address,
+                                 entry.peer_identity_address_type);
+    }
+  }
+
+  return {};
+}
+
+static Address generate_rpa(
+    std::array<uint8_t, LinkLayerController::kIrkSize> irk);
+
+std::optional<AddressWithType>
+LinkLayerController::GenerateResolvablePrivateAddress(AddressWithType address,
+                                                      IrkSelection irk) {
+  if (!le_resolving_list_enabled_) {
+    return {};
+  }
+
+  for (auto const& entry : le_resolving_list_) {
+    if (address.GetAddress() == entry.peer_identity_address &&
+        address.ToPeerAddressType() == entry.peer_identity_address_type) {
+      std::array<uint8_t, LinkLayerController::kIrkSize> const& used_irk =
+          irk == IrkSelection::Local ? entry.local_irk : entry.peer_irk;
+
+      return AddressWithType{generate_rpa(used_irk),
+                             AddressType::RANDOM_DEVICE_ADDRESS};
+    }
+  }
+
+  return {};
+}
+
+// =============================================================================
+//  General LE Commands
+// =============================================================================
+
+// HCI LE Set Random Address command (Vol 4, Part E § 7.8.4).
+ErrorCode LinkLayerController::LeSetRandomAddress(Address random_address) {
+  // If the Host issues this command when any of advertising (created using
+  // legacy advertising commands), scanning, or initiating are enabled,
+  // the Controller shall return the error code Command Disallowed (0x0C).
+  if (legacy_advertiser_.IsEnabled() || scanner_.IsEnabled() ||
+      initiator_.IsEnabled()) {
+    LOG_INFO("advertising, scanning or initiating are currently active");
+    return ErrorCode::COMMAND_DISALLOWED;
+  }
+
+  if (random_address == Address::kEmpty) {
+    LOG_INFO("the random address may not be set to 00:00:00:00:00:00");
+    return ErrorCode::INVALID_HCI_COMMAND_PARAMETERS;
+  }
+
+  LOG_INFO("device random address configured to %s",
+           random_address.ToString().c_str());
+  random_address_ = random_address;
+  return ErrorCode::SUCCESS;
+}
+
+// HCI LE Set Host Feature command (Vol 4, Part E § 7.8.45).
+ErrorCode LinkLayerController::LeSetResolvablePrivateAddressTimeout(
+    uint16_t rpa_timeout) {
+  // Note: no documented status code for this case.
+  if (rpa_timeout < 0x1 || rpa_timeout > 0x0e10) {
+    LOG_INFO(
+        "rpa_timeout (0x%04x) is outside the range of supported values "
+        " 0x1 - 0x0e10",
+        rpa_timeout);
+    return ErrorCode::INVALID_HCI_COMMAND_PARAMETERS;
+  }
+
+  resolvable_private_address_timeout_ = seconds(rpa_timeout);
+  return ErrorCode::SUCCESS;
+}
+
+// HCI LE Set Host Feature command (Vol 4, Part E § 7.8.115).
+ErrorCode LinkLayerController::LeSetHostFeature(uint8_t bit_number,
+                                                uint8_t bit_value) {
+  if (bit_number >= 64 || bit_value > 1) {
+    return ErrorCode::INVALID_HCI_COMMAND_PARAMETERS;
+  }
+
+  // If Bit_Value is set to 0x01 and Bit_Number specifies a feature bit that
+  // requires support of a feature that the Controller does not support,
+  // the Controller shall return the error code Unsupported Feature or
+  // Parameter Value (0x11).
+  // TODO
+
+  // If the Host issues this command while the Controller has a connection to
+  // another device, the Controller shall return the error code
+  // Command Disallowed (0x0C).
+  if (HasAclConnection()) {
+    return ErrorCode::COMMAND_DISALLOWED;
+  }
+
+  uint64_t bit_mask = UINT64_C(1) << bit_number;
+  if (bit_mask ==
+      static_cast<uint64_t>(
+          LLFeaturesBits::CONNECTED_ISOCHRONOUS_STREAM_HOST_SUPPORT)) {
+    connected_isochronous_stream_host_support_ = bit_value != 0;
+  } else if (bit_mask ==
+             static_cast<uint64_t>(
+                 LLFeaturesBits::CONNECTION_SUBRATING_HOST_SUPPORT)) {
+    connection_subrating_host_support_ = bit_value != 0;
+  }
+  // If Bit_Number specifies a feature bit that is not controlled by the Host,
+  // the Controller shall return the error code Unsupported Feature or
+  // Parameter Value (0x11).
+  else {
+    return ErrorCode::UNSUPPORTED_FEATURE_OR_PARAMETER_VALUE;
+  }
+
+  if (bit_value != 0) {
+    le_host_supported_features_ |= bit_mask;
+  } else {
+    le_host_supported_features_ &= ~bit_mask;
+  }
+
+  return ErrorCode::SUCCESS;
+}
+
+// =============================================================================
+//  LE Resolving List
+// =============================================================================
+
+// HCI command LE_Add_Device_To_Resolving_List (Vol 4, Part E § 7.8.38).
+ErrorCode LinkLayerController::LeAddDeviceToResolvingList(
+    PeerAddressType peer_identity_address_type, Address peer_identity_address,
+    std::array<uint8_t, kIrkSize> peer_irk,
+    std::array<uint8_t, kIrkSize> local_irk) {
+  // This command shall not be used when address resolution is enabled in the
+  // Controller and:
+  //  • Advertising (other than periodic advertising) is enabled,
+  //  • Scanning is enabled, or
+  //  • an HCI_LE_Create_Connection, HCI_LE_Extended_Create_Connection, or
+  //    HCI_LE_Periodic_Advertising_Create_Sync command is pending.
+  if (le_resolving_list_enabled_ && ResolvingListBusy()) {
+    LOG_INFO(
+        "device is currently advertising, scanning, or establishing an"
+        " LE connection");
+    return ErrorCode::COMMAND_DISALLOWED;
+  }
+
+  // When a Controller cannot add a device to the list because there is no space
+  // available, it shall return the error code Memory Capacity Exceeded (0x07).
+  if (le_resolving_list_.size() >= properties_.le_resolving_list_size) {
+    LOG_INFO("resolving list is full");
+    return ErrorCode::MEMORY_CAPACITY_EXCEEDED;
+  }
+
+  // If there is an existing entry in the resolving list with the same
+  // Peer_Identity_Address and Peer_Identity_Address_Type, or with the same
+  // Peer_IRK, the Controller should return the error code Invalid HCI Command
+  // Parameters (0x12).
+  for (auto const& entry : le_resolving_list_) {
+    if ((entry.peer_identity_address_type == peer_identity_address_type &&
+         entry.peer_identity_address == peer_identity_address) ||
+        entry.peer_irk == peer_irk) {
+      LOG_INFO("device is already present in the resolving list");
+      return ErrorCode::INVALID_HCI_COMMAND_PARAMETERS;
+    }
+  }
+
+  le_resolving_list_.emplace_back(
+      ResolvingListEntry{peer_identity_address_type, peer_identity_address,
+                         peer_irk, local_irk, PrivacyMode::NETWORK});
+  return ErrorCode::SUCCESS;
+}
+
+// HCI command LE_Remove_Device_From_Resolving_List (Vol 4, Part E § 7.8.39).
+ErrorCode LinkLayerController::LeRemoveDeviceFromResolvingList(
+    PeerAddressType peer_identity_address_type, Address peer_identity_address) {
+  // This command shall not be used when address resolution is enabled in the
+  // Controller and:
+  //  • Advertising (other than periodic advertising) is enabled,
+  //  • Scanning is enabled, or
+  //  • an HCI_LE_Create_Connection, HCI_LE_Extended_Create_Connection, or
+  //    HCI_LE_Periodic_Advertising_Create_Sync command is pending.
+  if (le_resolving_list_enabled_ && ResolvingListBusy()) {
+    LOG_INFO(
+        "device is currently advertising, scanning, or establishing an"
+        " LE connection");
+    return ErrorCode::COMMAND_DISALLOWED;
+  }
+
+  for (auto it = le_resolving_list_.begin(); it != le_resolving_list_.end();
+       it++) {
+    if (it->peer_identity_address_type == peer_identity_address_type &&
+        it->peer_identity_address == peer_identity_address) {
+      le_resolving_list_.erase(it);
+      return ErrorCode::SUCCESS;
+    }
+  }
+
+  // When a Controller cannot remove a device from the resolving list because
+  // it is not found, it shall return the error code
+  // Unknown Connection Identifier (0x02).
+  LOG_INFO("peer address not found in the resolving list");
+  return ErrorCode::UNKNOWN_CONNECTION;
+}
+
+// HCI command LE_Clear_Resolving_List (Vol 4, Part E § 7.8.40).
+ErrorCode LinkLayerController::LeClearResolvingList() {
+  // This command shall not be used when address resolution is enabled in the
+  // Controller and:
+  //  • Advertising (other than periodic advertising) is enabled,
+  //  • Scanning is enabled, or
+  //  • an HCI_LE_Create_Connection, HCI_LE_Extended_Create_Connection, or
+  //    HCI_LE_Periodic_Advertising_Create_Sync command is pending.
+  if (le_resolving_list_enabled_ && ResolvingListBusy()) {
+    LOG_INFO(
+        "device is currently advertising, scanning,"
+        " or establishing an LE connection");
+    return ErrorCode::COMMAND_DISALLOWED;
+  }
+
+  le_resolving_list_.clear();
+  return ErrorCode::SUCCESS;
+}
+
+// HCI command LE_Set_Address_Resolution_Enable (Vol 4, Part E § 7.8.44).
+ErrorCode LinkLayerController::LeSetAddressResolutionEnable(bool enable) {
+  // This command shall not be used when:
+  //  • Advertising (other than periodic advertising) is enabled,
+  //  • Scanning is enabled, or
+  //  • an HCI_LE_Create_Connection, HCI_LE_Extended_Create_Connection, or
+  //    HCI_LE_Periodic_Advertising_Create_Sync command is pending.
+  if (ResolvingListBusy()) {
+    LOG_INFO(
+        "device is currently advertising, scanning,"
+        " or establishing an LE connection");
+    return ErrorCode::COMMAND_DISALLOWED;
+  }
+
+  le_resolving_list_enabled_ = enable;
+  return ErrorCode::SUCCESS;
+}
+
+// HCI command LE_Set_Privacy_Mode (Vol 4, Part E § 7.8.77).
+ErrorCode LinkLayerController::LeSetPrivacyMode(
+    PeerAddressType peer_identity_address_type, Address peer_identity_address,
+    bluetooth::hci::PrivacyMode privacy_mode) {
+  // This command shall not be used when address resolution is enabled in the
+  // Controller and:
+  //  • Advertising (other than periodic advertising) is enabled,
+  //  • Scanning is enabled, or
+  //  • an HCI_LE_Create_Connection, HCI_LE_Extended_Create_Connection, or
+  //    HCI_LE_Periodic_Advertising_Create_Sync command is pending.
+  if (le_resolving_list_enabled_ && ResolvingListBusy()) {
+    LOG_INFO(
+        "device is currently advertising, scanning,"
+        " or establishing an LE connection");
+    return ErrorCode::COMMAND_DISALLOWED;
+  }
+
+  for (auto& entry : le_resolving_list_) {
+    if (entry.peer_identity_address_type == peer_identity_address_type &&
+        entry.peer_identity_address == peer_identity_address) {
+      entry.privacy_mode = privacy_mode;
+      return ErrorCode::SUCCESS;
+    }
+  }
+
+  // If the device is not on the resolving list, the Controller shall return
+  // the error code Unknown Connection Identifier (0x02).
+  LOG_INFO("peer address not found in the resolving list");
+  return ErrorCode::UNKNOWN_CONNECTION;
+}
+
+// =============================================================================
+//  LE Filter Accept List
+// =============================================================================
+
+// HCI command LE_Clear_Filter_Accept_List (Vol 4, Part E § 7.8.15).
+ErrorCode LinkLayerController::LeClearFilterAcceptList() {
+  // This command shall not be used when:
+  //  • any advertising filter policy uses the Filter Accept List and
+  //    advertising is enabled,
+  //  • the scanning filter policy uses the Filter Accept List and scanning
+  //    is enabled, or
+  //  • the initiator filter policy uses the Filter Accept List and an
+  //    HCI_LE_Create_Connection or HCI_LE_Extended_Create_Connection
+  //    command is pending.
+  if (FilterAcceptListBusy()) {
+    LOG_INFO(
+        "device is currently advertising, scanning,"
+        " or establishing an LE connection using the filter accept list");
+    return ErrorCode::COMMAND_DISALLOWED;
+  }
+
+  le_filter_accept_list_.clear();
+  return ErrorCode::SUCCESS;
+}
+
+// HCI command LE_Add_Device_To_Filter_Accept_List (Vol 4, Part E § 7.8.16).
+ErrorCode LinkLayerController::LeAddDeviceToFilterAcceptList(
+    FilterAcceptListAddressType address_type, Address address) {
+  // This command shall not be used when:
+  //  • any advertising filter policy uses the Filter Accept List and
+  //    advertising is enabled,
+  //  • the scanning filter policy uses the Filter Accept List and scanning
+  //    is enabled, or
+  //  • the initiator filter policy uses the Filter Accept List and an
+  //    HCI_LE_Create_Connection or HCI_LE_Extended_Create_Connection
+  //    command is pending.
+  if (FilterAcceptListBusy()) {
+    LOG_INFO(
+        "device is currently advertising, scanning,"
+        " or establishing an LE connection using the filter accept list");
+    return ErrorCode::COMMAND_DISALLOWED;
+  }
+
+  // When a Controller cannot add a device to the Filter Accept List
+  // because there is no space available, it shall return the error code
+  // Memory Capacity Exceeded (0x07).
+  if (le_filter_accept_list_.size() >= properties_.le_filter_accept_list_size) {
+    LOG_INFO("filter accept list is full");
+    return ErrorCode::MEMORY_CAPACITY_EXCEEDED;
+  }
+
+  le_filter_accept_list_.emplace_back(
+      FilterAcceptListEntry{address_type, address});
+  return ErrorCode::SUCCESS;
+}
+
+// HCI command LE_Remove_Device_From_Filter_Accept_List (Vol 4, Part E
+// § 7.8.17).
+ErrorCode LinkLayerController::LeRemoveDeviceFromFilterAcceptList(
+    FilterAcceptListAddressType address_type, Address address) {
+  // This command shall not be used when:
+  //  • any advertising filter policy uses the Filter Accept List and
+  //    advertising is enabled,
+  //  • the scanning filter policy uses the Filter Accept List and scanning
+  //    is enabled, or
+  //  • the initiator filter policy uses the Filter Accept List and an
+  //    HCI_LE_Create_Connection or HCI_LE_Extended_Create_Connection
+  //    command is pending.
+  if (FilterAcceptListBusy()) {
+    LOG_INFO(
+        "device is currently advertising, scanning,"
+        " or establishing an LE connection using the filter accept list");
+    return ErrorCode::COMMAND_DISALLOWED;
+  }
+
+  for (auto it = le_filter_accept_list_.begin();
+       it != le_filter_accept_list_.end(); it++) {
+    // Address shall be ignored when Address_Type is set to 0xFF.
+    if (it->address_type == address_type &&
+        (address_type == FilterAcceptListAddressType::ANONYMOUS_ADVERTISERS ||
+         it->address == address)) {
+      le_filter_accept_list_.erase(it);
+      return ErrorCode::SUCCESS;
+    }
+  }
+
+  // Note: this case is not documented.
+  LOG_INFO("address not found in the filter accept list");
+  return ErrorCode::SUCCESS;
+}
+
+// =============================================================================
+//  LE Legacy Scanning
+// =============================================================================
+
+// HCI command LE_Set_Scan_Parameters (Vol 4, Part E § 7.8.10).
+ErrorCode LinkLayerController::LeSetScanParameters(
+    bluetooth::hci::LeScanType scan_type, uint16_t scan_interval,
+    uint16_t scan_window, bluetooth::hci::OwnAddressType own_address_type,
+    bluetooth::hci::LeScanningFilterPolicy scanning_filter_policy) {
+  // Legacy advertising commands are disallowed when extended advertising
+  // commands were used since the last reset.
+  if (!SelectLegacyAdvertising()) {
+    LOG_INFO(
+        "legacy advertising command rejected because extended advertising"
+        " is being used");
+    return ErrorCode::COMMAND_DISALLOWED;
+  }
+
+  // The Host shall not issue this command when scanning is enabled in the
+  // Controller; if it is the Command Disallowed error code shall be used.
+  if (scanner_.IsEnabled()) {
+    LOG_INFO("scanning is currently enabled");
+    return ErrorCode::COMMAND_DISALLOWED;
+  }
+
+  // Note: no explicit error code stated for invalid interval and window
+  // values but assuming Unsupported Feature or Parameter Value (0x11)
+  // error code based on similar advertising command.
+  if (scan_interval < 0x4 || scan_interval > 0x4000 || scan_window < 0x4 ||
+      scan_window > 0x4000) {
+    LOG_INFO(
+        "le_scan_interval (0x%04x) and/or"
+        " le_scan_window (0x%04x) are outside the range"
+        " of supported values (0x0004 - 0x4000)",
+        scan_interval, scan_window);
+    return ErrorCode::UNSUPPORTED_FEATURE_OR_PARAMETER_VALUE;
+  }
+
+  // The LE_Scan_Window parameter shall always be set to a value smaller
+  // or equal to the value set for the LE_Scan_Interval parameter.
+  if (scan_window > scan_interval) {
+    LOG_INFO("le_scan_window (0x%04x) is larger than le_scan_interval (0x%04x)",
+             scan_window, scan_interval);
+    return ErrorCode::INVALID_HCI_COMMAND_PARAMETERS;
+  }
+
+  scanner_.le_1m_phy.enabled = true;
+  scanner_.le_coded_phy.enabled = false;
+  scanner_.le_1m_phy.scan_type = scan_type;
+  scanner_.le_1m_phy.scan_interval = scan_interval;
+  scanner_.le_1m_phy.scan_window = scan_window;
+  scanner_.own_address_type = own_address_type;
+  scanner_.scan_filter_policy = scanning_filter_policy;
+  return ErrorCode::SUCCESS;
+}
+
+// HCI command LE_Set_Scan_Enable (Vol 4, Part E § 7.8.11).
+ErrorCode LinkLayerController::LeSetScanEnable(bool enable,
+                                               bool filter_duplicates) {
+  // Legacy advertising commands are disallowed when extended advertising
+  // commands were used since the last reset.
+  if (!SelectLegacyAdvertising()) {
+    LOG_INFO(
+        "legacy advertising command rejected because extended advertising"
+        " is being used");
+    return ErrorCode::COMMAND_DISALLOWED;
+  }
+
+  if (!enable) {
+    scanner_.scan_enable = false;
+    scanner_.history.clear();
+    return ErrorCode::SUCCESS;
+  }
+
+  // TODO: additional checks would apply in the case of a LE only Controller
+  // with no configured public device address.
+
+  // If LE_Scan_Enable is set to 0x01, the scanning parameters' Own_Address_Type
+  // parameter is set to 0x01 or 0x03, and the random address for the device
+  // has not been initialized using the HCI_LE_Set_Random_Address command,
+  // the Controller shall return the error code
+  // Invalid HCI Command Parameters (0x12).
+  if ((scanner_.own_address_type ==
+           bluetooth::hci::OwnAddressType::RANDOM_DEVICE_ADDRESS ||
+       scanner_.own_address_type ==
+           bluetooth::hci::OwnAddressType::RESOLVABLE_OR_RANDOM_ADDRESS) &&
+      random_address_ == Address::kEmpty) {
+    LOG_INFO(
+        "own_address_type is Random_Device_Address or"
+        " Resolvable_or_Random_Address but the Random_Address"
+        " has not been initialized");
+    return ErrorCode::INVALID_HCI_COMMAND_PARAMETERS;
+  }
+
+  scanner_.scan_enable = true;
+  scanner_.history.clear();
+  scanner_.timeout = {};
+  scanner_.periodical_timeout = {};
+  scanner_.filter_duplicates = filter_duplicates
+                                   ? bluetooth::hci::FilterDuplicates::ENABLED
+                                   : bluetooth::hci::FilterDuplicates::DISABLED;
+  return ErrorCode::SUCCESS;
+}
+
+// =============================================================================
+//  LE Extended Scanning
+// =============================================================================
+
+// HCI command LE_Set_Extended_Scan_Parameters (Vol 4, Part E § 7.8.64).
+ErrorCode LinkLayerController::LeSetExtendedScanParameters(
+    bluetooth::hci::OwnAddressType own_address_type,
+    bluetooth::hci::LeScanningFilterPolicy scanning_filter_policy,
+    uint8_t scanning_phys,
+    std::vector<bluetooth::hci::PhyScanParameters> scanning_phy_parameters) {
+  // Extended advertising commands are disallowed when legacy advertising
+  // commands were used since the last reset.
+  if (!SelectExtendedAdvertising()) {
+    LOG_INFO(
+        "extended advertising command rejected because legacy advertising"
+        " is being used");
+    return ErrorCode::COMMAND_DISALLOWED;
+  }
+
+  // If the Host issues this command when scanning is enabled in the Controller,
+  // the Controller shall return the error code Command Disallowed (0x0C).
+  if (scanner_.IsEnabled()) {
+    LOG_INFO("scanning is currently enabled");
+    return ErrorCode::COMMAND_DISALLOWED;
+  }
+
+  // If the Host specifies a PHY that is not supported by the Controller,
+  // including a bit that is reserved for future use, it should return the
+  // error code Unsupported Feature or Parameter Value (0x11).
+  if ((scanning_phys & 0xfa) != 0) {
+    LOG_INFO(
+        "scanning_phys (%02x) enables PHYs that are not supported by"
+        " the controller",
+        scanning_phys);
+    return ErrorCode::UNSUPPORTED_FEATURE_OR_PARAMETER_VALUE;
+  }
+
+  // TODO(c++20) std::popcount
+  if (__builtin_popcount(scanning_phys) !=
+      int(scanning_phy_parameters.size())) {
+    LOG_INFO(
+        "scanning_phy_parameters (%zu)"
+        " does not match scanning_phys (%02x)",
+        scanning_phy_parameters.size(), scanning_phys);
+    return ErrorCode::INVALID_HCI_COMMAND_PARAMETERS;
+  }
+
+  // Note: no explicit error code stated for empty scanning_phys
+  // but assuming Unsupported Feature or Parameter Value (0x11)
+  // error code based on HCI Extended LE Create Connecton command.
+  if (scanning_phys == 0) {
+    LOG_INFO("scanning_phys is empty");
+    return ErrorCode::INVALID_HCI_COMMAND_PARAMETERS;
+  }
+
+  for (auto const& parameter : scanning_phy_parameters) {
+    //  If the requested scan cannot be supported by the implementation,
+    // the Controller shall return the error code
+    // Invalid HCI Command Parameters (0x12).
+    if (parameter.le_scan_interval_ < 0x4 || parameter.le_scan_window_ < 0x4) {
+      LOG_INFO(
+          "le_scan_interval (0x%04x) and/or"
+          " le_scan_window (0x%04x) are outside the range"
+          " of supported values (0x0004 - 0xffff)",
+          parameter.le_scan_interval_, parameter.le_scan_window_);
+      return ErrorCode::INVALID_HCI_COMMAND_PARAMETERS;
+    }
+
+    if (parameter.le_scan_window_ > parameter.le_scan_interval_) {
+      LOG_INFO(
+          "le_scan_window (0x%04x) is larger than le_scan_interval (0x%04x)",
+          parameter.le_scan_window_, parameter.le_scan_interval_);
+      return ErrorCode::INVALID_HCI_COMMAND_PARAMETERS;
+    }
+  }
+
+  scanner_.own_address_type = own_address_type;
+  scanner_.scan_filter_policy = scanning_filter_policy;
+  scanner_.le_1m_phy.enabled = false;
+  scanner_.le_coded_phy.enabled = false;
+  int offset = 0;
+
+  if (scanning_phys & 0x1) {
+    scanner_.le_1m_phy = Scanner::PhyParameters{
+        .enabled = true,
+        .scan_type = scanning_phy_parameters[offset].le_scan_type_,
+        .scan_interval = scanning_phy_parameters[offset].le_scan_interval_,
+        .scan_window = scanning_phy_parameters[offset].le_scan_window_,
+    };
+    offset++;
+  }
+
+  if (scanning_phys & 0x4) {
+    scanner_.le_coded_phy = Scanner::PhyParameters{
+        .enabled = true,
+        .scan_type = scanning_phy_parameters[offset].le_scan_type_,
+        .scan_interval = scanning_phy_parameters[offset].le_scan_interval_,
+        .scan_window = scanning_phy_parameters[offset].le_scan_window_,
+    };
+    offset++;
+  }
+
+  return ErrorCode::SUCCESS;
+}
+
+// HCI command LE_Set_Extended_Scan_Enable (Vol 4, Part E § 7.8.65).
+ErrorCode LinkLayerController::LeSetExtendedScanEnable(
+    bool enable, bluetooth::hci::FilterDuplicates filter_duplicates,
+    uint16_t duration, uint16_t period) {
+  // Extended advertising commands are disallowed when legacy advertising
+  // commands were used since the last reset.
+  if (!SelectExtendedAdvertising()) {
+    LOG_INFO(
+        "extended advertising command rejected because legacy advertising"
+        " is being used");
+    return ErrorCode::COMMAND_DISALLOWED;
+  }
+
+  if (!enable) {
+    scanner_.scan_enable = false;
+    scanner_.history.clear();
+    return ErrorCode::SUCCESS;
+  }
+
+  // The Period parameter shall be ignored when the Duration parameter is zero.
+  if (duration == 0) {
+    period = 0;
+  }
+
+  // If Filter_Duplicates is set to 0x02 and either Period or Duration to zero,
+  // the Controller shall return the error code
+  // Invalid HCI Command Parameters (0x12).
+  if (filter_duplicates ==
+          bluetooth::hci::FilterDuplicates::RESET_EACH_PERIOD &&
+      (period == 0 || duration == 0)) {
+    LOG_INFO(
+        "filter_duplicates is Reset_Each_Period but either"
+        " the period or duration is 0");
+    return ErrorCode::INVALID_HCI_COMMAND_PARAMETERS;
+  }
+
+  auto duration_ms = std::chrono::milliseconds(10 * duration);
+  auto period_ms = std::chrono::milliseconds(1280 * period);
+
+  // If both the Duration and Period parameters are non-zero and the Duration is
+  // greater than or equal to the Period, the Controller shall return the
+  // error code Invalid HCI Command Parameters (0x12).
+  if (period != 0 && duration != 0 && duration_ms >= period_ms) {
+    LOG_INFO("the period is greater than or equal to the duration");
+    return ErrorCode::INVALID_HCI_COMMAND_PARAMETERS;
+  }
+
+  // TODO: additional checks would apply in the case of a LE only Controller
+  // with no configured public device address.
+
+  // If LE_Scan_Enable is set to 0x01, the scanning parameters' Own_Address_Type
+  // parameter is set to 0x01 or 0x03, and the random address for the device
+  // has not been initialized using the HCI_LE_Set_Random_Address command,
+  // the Controller shall return the error code
+  // Invalid HCI Command Parameters (0x12).
+  if ((scanner_.own_address_type ==
+           bluetooth::hci::OwnAddressType::RANDOM_DEVICE_ADDRESS ||
+       scanner_.own_address_type ==
+           bluetooth::hci::OwnAddressType::RESOLVABLE_OR_RANDOM_ADDRESS) &&
+      random_address_ == Address::kEmpty) {
+    LOG_INFO(
+        "own_address_type is Random_Device_Address or"
+        " Resolvable_or_Random_Address but the Random_Address"
+        " has not been initialized");
+    return ErrorCode::INVALID_HCI_COMMAND_PARAMETERS;
+  }
+
+  scanner_.scan_enable = true;
+  scanner_.history.clear();
+  scanner_.timeout = {};
+  scanner_.periodical_timeout = {};
+  scanner_.filter_duplicates = filter_duplicates;
+  scanner_.duration = duration_ms;
+  scanner_.period = period_ms;
+
+  auto now = std::chrono::steady_clock::now();
+
+  // At the end of a single scan (Duration non-zero but Period zero), an
+  // HCI_LE_Scan_Timeout event shall be generated.
+  if (duration != 0) {
+    scanner_.timeout = now + scanner_.duration;
+  }
+  if (period != 0) {
+    scanner_.periodical_timeout = now + scanner_.period;
+  }
+
+  return ErrorCode::SUCCESS;
+}
+
+// =============================================================================
+//  LE Legacy Connection
+// =============================================================================
+
+// HCI LE Create Connection command (Vol 4, Part E § 7.8.12).
+ErrorCode LinkLayerController::LeCreateConnection(
+    uint16_t scan_interval, uint16_t scan_window,
+    bluetooth::hci::InitiatorFilterPolicy initiator_filter_policy,
+    AddressWithType peer_address,
+    bluetooth::hci::OwnAddressType own_address_type,
+    uint16_t connection_interval_min, uint16_t connection_interval_max,
+    uint16_t max_latency, uint16_t supervision_timeout, uint16_t min_ce_length,
+    uint16_t max_ce_length) {
+  // Legacy advertising commands are disallowed when extended advertising
+  // commands were used since the last reset.
+  if (!SelectLegacyAdvertising()) {
+    LOG_INFO(
+        "legacy advertising command rejected because extended advertising"
+        " is being used");
+    return ErrorCode::COMMAND_DISALLOWED;
+  }
+
+  // If the Host issues this command when another HCI_LE_Create_Connection
+  // command is pending in the Controller, the Controller shall return the
+  // error code Command Disallowed (0x0C).
+  if (initiator_.IsEnabled()) {
+    LOG_INFO("initiator is currently enabled");
+    return ErrorCode::COMMAND_DISALLOWED;
+  }
+
+  // Note: no explicit error code stated for invalid interval and window
+  // values but assuming Unsupported Feature or Parameter Value (0x11)
+  // error code based on similar advertising command.
+  if (scan_interval < 0x4 || scan_interval > 0x4000 || scan_window < 0x4 ||
+      scan_window > 0x4000) {
+    LOG_INFO(
+        "scan_interval (0x%04x) and/or "
+        "scan_window (0x%04x) are outside the range"
+        " of supported values (0x4 - 0x4000)",
+        scan_interval, scan_window);
+    return ErrorCode::UNSUPPORTED_FEATURE_OR_PARAMETER_VALUE;
+  }
+
+  // The LE_Scan_Window parameter shall be set to a value smaller or equal to
+  // the value set for the LE_Scan_Interval parameter.
+  if (scan_interval < scan_window) {
+    LOG_INFO("scan_window (0x%04x) is larger than scan_interval (0x%04x)",
+             scan_window, scan_interval);
+    return ErrorCode::INVALID_HCI_COMMAND_PARAMETERS;
+  }
+
+  // Note: no explicit error code stated for invalid connection interval
+  // values but assuming Unsupported Feature or Parameter Value (0x11)
+  // error code based on similar advertising command.
+  if (connection_interval_min < 0x6 || connection_interval_min > 0x0c80 ||
+      connection_interval_max < 0x6 || connection_interval_max > 0x0c80) {
+    LOG_INFO(
+        "connection_interval_min (0x%04x) and/or "
+        "connection_interval_max (0x%04x) are outside the range"
+        " of supported values (0x6 - 0x0c80)",
+        connection_interval_min, connection_interval_max);
+    return ErrorCode::UNSUPPORTED_FEATURE_OR_PARAMETER_VALUE;
+  }
+
+  // The Connection_Interval_Min parameter shall not be greater than the
+  // Connection_Interval_Max parameter.
+  if (connection_interval_max < connection_interval_min) {
+    LOG_INFO(
+        "connection_interval_min (0x%04x) is larger than"
+        " connection_interval_max (0x%04x)",
+        connection_interval_min, connection_interval_max);
+    return ErrorCode::INVALID_HCI_COMMAND_PARAMETERS;
+  }
+
+  // Note: no explicit error code stated for invalid max_latency
+  // values but assuming Unsupported Feature or Parameter Value (0x11)
+  // error code based on similar advertising command.
+  if (max_latency > 0x01f3) {
+    LOG_INFO(
+        "max_latency (0x%04x) is outside the range"
+        " of supported values (0x0 - 0x01f3)",
+        max_latency);
+    return ErrorCode::UNSUPPORTED_FEATURE_OR_PARAMETER_VALUE;
+  }
+
+  // Note: no explicit error code stated for invalid supervision timeout
+  // values but assuming Unsupported Feature or Parameter Value (0x11)
+  // error code based on similar advertising command.
+  if (supervision_timeout < 0xa || supervision_timeout > 0x0c80) {
+    LOG_INFO(
+        "supervision_timeout (0x%04x) is outside the range"
+        " of supported values (0xa - 0x0c80)",
+        supervision_timeout);
+    return ErrorCode::UNSUPPORTED_FEATURE_OR_PARAMETER_VALUE;
+  }
+
+  // The Supervision_Timeout in milliseconds shall be larger than
+  // (1 + Max_Latency) * Connection_Interval_Max * 2, where
+  // Connection_Interval_Max is given in milliseconds.
+  milliseconds min_supervision_timeout = duration_cast<milliseconds>(
+      (1 + max_latency) * slots(2 * connection_interval_max) * 2);
+  if (supervision_timeout * 10ms < min_supervision_timeout) {
+    LOG_INFO(
+        "supervision_timeout (%d ms) is smaller that the minimal supervision "
+        "timeout allowed by connection_interval_max and max_latency (%u ms)",
+        supervision_timeout * 10,
+        static_cast<unsigned>(min_supervision_timeout / 1ms));
+    return ErrorCode::INVALID_HCI_COMMAND_PARAMETERS;
+  }
+
+  // TODO: additional checks would apply in the case of a LE only Controller
+  // with no configured public device address.
+
+  // If the Own_Address_Type parameter is set to 0x01 and the random
+  // address for the device has not been initialized using the
+  // HCI_LE_Set_Random_Address command, the Controller shall return the
+  // error code Invalid HCI Command Parameters (0x12).
+  if (own_address_type == OwnAddressType::RANDOM_DEVICE_ADDRESS &&
+      random_address_ == Address::kEmpty) {
+    LOG_INFO(
+        "own_address_type is Random_Device_Address but the Random_Address"
+        " has not been initialized");
+    return ErrorCode::INVALID_HCI_COMMAND_PARAMETERS;
+  }
+
+  // If the Own_Address_Type parameter is set to 0x03, the
+  // Initiator_Filter_Policy parameter is set to 0x00, the controller's
+  // resolving list did not contain matching entry, and the random address for
+  // the device has not been initialized using the HCI_LE_Set_Random_Address
+  // command, the Controller shall return the error code
+  // Invalid HCI Command Parameters (0x12).
+  if (own_address_type == OwnAddressType::RESOLVABLE_OR_RANDOM_ADDRESS &&
+      initiator_filter_policy == InitiatorFilterPolicy::USE_PEER_ADDRESS &&
+      !GenerateResolvablePrivateAddress(peer_address, IrkSelection::Local) &&
+      random_address_ == Address::kEmpty) {
+    LOG_INFO(
+        "own_address_type is Resolvable_Or_Random_Address but the"
+        " Resolving_List does not contain a matching entry and the"
+        " Random_Address is not initialized");
+    return ErrorCode::INVALID_HCI_COMMAND_PARAMETERS;
+  }
+
+  initiator_.connect_enable = true;
+  initiator_.initiator_filter_policy = initiator_filter_policy;
+  initiator_.peer_address = peer_address;
+  initiator_.own_address_type = own_address_type;
+  initiator_.le_1m_phy.enabled = true;
+  initiator_.le_1m_phy.scan_interval = scan_interval;
+  initiator_.le_1m_phy.scan_window = scan_window;
+  initiator_.le_1m_phy.connection_interval_min = connection_interval_min;
+  initiator_.le_1m_phy.connection_interval_max = connection_interval_max;
+  initiator_.le_1m_phy.max_latency = max_latency;
+  initiator_.le_1m_phy.supervision_timeout = supervision_timeout;
+  initiator_.le_1m_phy.min_ce_length = min_ce_length;
+  initiator_.le_1m_phy.max_ce_length = max_ce_length;
+  initiator_.le_2m_phy.enabled = false;
+  initiator_.le_coded_phy.enabled = false;
+  initiator_.pending_connect_request = {};
+  return ErrorCode::SUCCESS;
+}
+
+// HCI LE Create Connection Cancel command (Vol 4, Part E § 7.8.12).
+ErrorCode LinkLayerController::LeCreateConnectionCancel() {
+  // If no HCI_LE_Create_Connection or HCI_LE_Extended_Create_Connection
+  // command is pending, then the Controller shall return the error code
+  // Command Disallowed (0x0C).
+  if (!initiator_.IsEnabled()) {
+    LOG_INFO("initiator is currently disabled");
+    return ErrorCode::COMMAND_DISALLOWED;
+  }
+
+  // If the cancellation was successful then, after the HCI_Command_Complete
+  // event for the HCI_LE_Create_Connection_Cancel command, either an LE
+  // Connection Complete or an HCI_LE_Enhanced_Connection_Complete event
+  // shall be generated. In either case, the event shall be sent with the error
+  // code Unknown Connection Identifier (0x02).
+  if (IsLeEventUnmasked(SubeventCode::ENHANCED_CONNECTION_COMPLETE)) {
+    ScheduleTask(0ms, [this] {
+      send_event_(bluetooth::hci::LeEnhancedConnectionCompleteBuilder::Create(
+          ErrorCode::UNKNOWN_CONNECTION, 0, Role::CENTRAL,
+          AddressType::PUBLIC_DEVICE_ADDRESS, Address(), Address(), Address(),
+          0, 0, 0, bluetooth::hci::ClockAccuracy::PPM_500));
+    });
+  } else if (IsLeEventUnmasked(SubeventCode::CONNECTION_COMPLETE)) {
+    ScheduleTask(0ms, [this] {
+      send_event_(bluetooth::hci::LeConnectionCompleteBuilder::Create(
+          ErrorCode::UNKNOWN_CONNECTION, 0, Role::CENTRAL,
+          AddressType::PUBLIC_DEVICE_ADDRESS, Address(), 0, 0, 0,
+          bluetooth::hci::ClockAccuracy::PPM_500));
+    });
+  }
+
+  initiator_.Disable();
+  return ErrorCode::SUCCESS;
+}
+
+// =============================================================================
+//  LE Extended Connection
+// =============================================================================
+
+// HCI LE Extended Create Connection command (Vol 4, Part E § 7.8.66).
+ErrorCode LinkLayerController::LeExtendedCreateConnection(
+    bluetooth::hci::InitiatorFilterPolicy initiator_filter_policy,
+    bluetooth::hci::OwnAddressType own_address_type,
+    AddressWithType peer_address, uint8_t initiating_phys,
+    std::vector<bluetooth::hci::LeCreateConnPhyScanParameters>
+        initiating_phy_parameters) {
+  // Extended advertising commands are disallowed when legacy advertising
+  // commands were used since the last reset.
+  if (!SelectExtendedAdvertising()) {
+    LOG_INFO(
+        "extended advertising command rejected because legacy advertising"
+        " is being used");
+    return ErrorCode::COMMAND_DISALLOWED;
+  }
+
+  // If the Host issues this command when another
+  // HCI_LE_Extended_Create_Connection command is pending in the Controller,
+  // the Controller shall return the error code Command Disallowed (0x0C).
+  if (initiator_.IsEnabled()) {
+    LOG_INFO("initiator is currently enabled");
+    return ErrorCode::COMMAND_DISALLOWED;
+  }
+
+  // If the Host specifies a PHY that is not supported by the Controller,
+  // including a bit that is reserved for future use, the latter should return
+  // the error code Unsupported Feature or Parameter Value (0x11).
+  if ((initiating_phys & 0xf8) != 0) {
+    LOG_INFO(
+        "initiating_phys (%02x) enables PHYs that are not supported by"
+        " the controller",
+        initiating_phys);
+    return ErrorCode::UNSUPPORTED_FEATURE_OR_PARAMETER_VALUE;
+  }
+
+  // TODO(c++20) std::popcount
+  if (__builtin_popcount(initiating_phys) !=
+      int(initiating_phy_parameters.size())) {
+    LOG_INFO(
+        "initiating_phy_parameters (%zu)"
+        " does not match initiating_phys (%02x)",
+        initiating_phy_parameters.size(), initiating_phys);
+    return ErrorCode::INVALID_HCI_COMMAND_PARAMETERS;
+  }
+
+  // If the Initiating_PHYs parameter does not have at least one bit set for a
+  // PHY allowed for scanning on the primary advertising physical channel, the
+  // Controller shall return the error code
+  // Invalid HCI Command Parameters (0x12).
+  if (initiating_phys == 0) {
+    LOG_INFO("initiating_phys is empty");
+    return ErrorCode::INVALID_HCI_COMMAND_PARAMETERS;
+  }
+
+  for (auto const& parameter : initiating_phy_parameters) {
+    // Note: no explicit error code stated for invalid interval and window
+    // values but assuming Unsupported Feature or Parameter Value (0x11)
+    // error code based on similar advertising command.
+    if (parameter.scan_interval_ < 0x4 || parameter.scan_interval_ > 0x4000 ||
+        parameter.scan_window_ < 0x4 || parameter.scan_window_ > 0x4000) {
+      LOG_INFO(
+          "scan_interval (0x%04x) and/or "
+          "scan_window (0x%04x) are outside the range"
+          " of supported values (0x4 - 0x4000)",
+          parameter.scan_interval_, parameter.scan_window_);
+      return ErrorCode::UNSUPPORTED_FEATURE_OR_PARAMETER_VALUE;
+    }
+
+    // The LE_Scan_Window parameter shall be set to a value smaller or equal to
+    // the value set for the LE_Scan_Interval parameter.
+    if (parameter.scan_interval_ < parameter.scan_window_) {
+      LOG_INFO("scan_window (0x%04x) is larger than scan_interval (0x%04x)",
+               parameter.scan_window_, parameter.scan_interval_);
+      return ErrorCode::INVALID_HCI_COMMAND_PARAMETERS;
+    }
+
+    // Note: no explicit error code stated for invalid connection interval
+    // values but assuming Unsupported Feature or Parameter Value (0x11)
+    // error code based on similar advertising command.
+    if (parameter.conn_interval_min_ < 0x6 ||
+        parameter.conn_interval_min_ > 0x0c80 ||
+        parameter.conn_interval_max_ < 0x6 ||
+        parameter.conn_interval_max_ > 0x0c80) {
+      LOG_INFO(
+          "connection_interval_min (0x%04x) and/or "
+          "connection_interval_max (0x%04x) are outside the range"
+          " of supported values (0x6 - 0x0c80)",
+          parameter.conn_interval_min_, parameter.conn_interval_max_);
+      return ErrorCode::UNSUPPORTED_FEATURE_OR_PARAMETER_VALUE;
+    }
+
+    // The Connection_Interval_Min parameter shall not be greater than the
+    // Connection_Interval_Max parameter.
+    if (parameter.conn_interval_max_ < parameter.conn_interval_min_) {
+      LOG_INFO(
+          "connection_interval_min (0x%04x) is larger than"
+          " connection_interval_max (0x%04x)",
+          parameter.conn_interval_min_, parameter.conn_interval_max_);
+      return ErrorCode::INVALID_HCI_COMMAND_PARAMETERS;
+    }
+
+    // Note: no explicit error code stated for invalid max_latency
+    // values but assuming Unsupported Feature or Parameter Value (0x11)
+    // error code based on similar advertising command.
+    if (parameter.conn_latency_ > 0x01f3) {
+      LOG_INFO(
+          "max_latency (0x%04x) is outside the range"
+          " of supported values (0x0 - 0x01f3)",
+          parameter.conn_latency_);
+      return ErrorCode::UNSUPPORTED_FEATURE_OR_PARAMETER_VALUE;
+    }
+
+    // Note: no explicit error code stated for invalid supervision timeout
+    // values but assuming Unsupported Feature or Parameter Value (0x11)
+    // error code based on similar advertising command.
+    if (parameter.supervision_timeout_ < 0xa ||
+        parameter.supervision_timeout_ > 0x0c80) {
+      LOG_INFO(
+          "supervision_timeout (0x%04x) is outside the range"
+          " of supported values (0xa - 0x0c80)",
+          parameter.supervision_timeout_);
+      return ErrorCode::UNSUPPORTED_FEATURE_OR_PARAMETER_VALUE;
+    }
+
+    // The Supervision_Timeout in milliseconds shall be larger than
+    // (1 + Max_Latency) * Connection_Interval_Max * 2, where
+    // Connection_Interval_Max is given in milliseconds.
+    milliseconds min_supervision_timeout = duration_cast<milliseconds>(
+        (1 + parameter.conn_latency_) *
+        slots(2 * parameter.conn_interval_max_) * 2);
+    if (parameter.supervision_timeout_ * 10ms < min_supervision_timeout) {
+      LOG_INFO(
+          "supervision_timeout (%d ms) is smaller that the minimal supervision "
+          "timeout allowed by connection_interval_max and max_latency (%u ms)",
+          parameter.supervision_timeout_ * 10,
+          static_cast<unsigned>(min_supervision_timeout / 1ms));
+      return ErrorCode::INVALID_HCI_COMMAND_PARAMETERS;
+    }
+  }
+
+  // TODO: additional checks would apply in the case of a LE only Controller
+  // with no configured public device address.
+
+  // If the Own_Address_Type parameter is set to 0x01 and the random
+  // address for the device has not been initialized using the
+  // HCI_LE_Set_Random_Address command, the Controller shall return the
+  // error code Invalid HCI Command Parameters (0x12).
+  if (own_address_type == OwnAddressType::RANDOM_DEVICE_ADDRESS &&
+      random_address_ == Address::kEmpty) {
+    LOG_INFO(
+        "own_address_type is Random_Device_Address but the Random_Address"
+        " has not been initialized");
+    return ErrorCode::INVALID_HCI_COMMAND_PARAMETERS;
+  }
+
+  // If the Own_Address_Type parameter is set to 0x03, the
+  // Initiator_Filter_Policy parameter is set to 0x00, the controller's
+  // resolving list did not contain matching entry, and the random address for
+  // the device has not been initialized using the HCI_LE_Set_Random_Address
+  // command, the Controller shall return the error code
+  // Invalid HCI Command Parameters (0x12).
+  if (own_address_type == OwnAddressType::RESOLVABLE_OR_RANDOM_ADDRESS &&
+      initiator_filter_policy == InitiatorFilterPolicy::USE_PEER_ADDRESS &&
+      !GenerateResolvablePrivateAddress(peer_address, IrkSelection::Local) &&
+      random_address_ == Address::kEmpty) {
+    LOG_INFO(
+        "own_address_type is Resolvable_Or_Random_Address but the"
+        " Resolving_List does not contain a matching entry and the"
+        " Random_Address is not initialized");
+    return ErrorCode::INVALID_HCI_COMMAND_PARAMETERS;
+  }
+
+  initiator_.connect_enable = true;
+  initiator_.initiator_filter_policy = initiator_filter_policy;
+  initiator_.peer_address = peer_address;
+  initiator_.own_address_type = own_address_type;
+  initiator_.pending_connect_request = {};
+
+  initiator_.le_1m_phy.enabled = false;
+  initiator_.le_2m_phy.enabled = false;
+  initiator_.le_coded_phy.enabled = false;
+  int offset = 0;
+
+  if (initiating_phys & 0x1) {
+    initiator_.le_1m_phy = Initiator::PhyParameters{
+        .enabled = true,
+        .scan_interval = initiating_phy_parameters[offset].scan_interval_,
+        .scan_window = initiating_phy_parameters[offset].scan_window_,
+        .connection_interval_min =
+            initiating_phy_parameters[offset].conn_interval_min_,
+        .connection_interval_max =
+            initiating_phy_parameters[offset].conn_interval_max_,
+        .max_latency = initiating_phy_parameters[offset].conn_latency_,
+        .supervision_timeout =
+            initiating_phy_parameters[offset].supervision_timeout_,
+        .min_ce_length = initiating_phy_parameters[offset].min_ce_length_,
+        .max_ce_length = initiating_phy_parameters[offset].max_ce_length_,
+    };
+    offset++;
+  }
+
+  if (initiating_phys & 0x2) {
+    initiator_.le_2m_phy = Initiator::PhyParameters{
+        .enabled = true,
+        .scan_interval = initiating_phy_parameters[offset].scan_interval_,
+        .scan_window = initiating_phy_parameters[offset].scan_window_,
+        .connection_interval_min =
+            initiating_phy_parameters[offset].conn_interval_min_,
+        .connection_interval_max =
+            initiating_phy_parameters[offset].conn_interval_max_,
+        .max_latency = initiating_phy_parameters[offset].conn_latency_,
+        .supervision_timeout =
+            initiating_phy_parameters[offset].supervision_timeout_,
+        .min_ce_length = initiating_phy_parameters[offset].min_ce_length_,
+        .max_ce_length = initiating_phy_parameters[offset].max_ce_length_,
+    };
+    offset++;
+  }
+
+  if (initiating_phys & 0x4) {
+    initiator_.le_coded_phy = Initiator::PhyParameters{
+        .enabled = true,
+        .scan_interval = initiating_phy_parameters[offset].scan_interval_,
+        .scan_window = initiating_phy_parameters[offset].scan_window_,
+        .connection_interval_min =
+            initiating_phy_parameters[offset].conn_interval_min_,
+        .connection_interval_max =
+            initiating_phy_parameters[offset].conn_interval_max_,
+        .max_latency = initiating_phy_parameters[offset].conn_latency_,
+        .supervision_timeout =
+            initiating_phy_parameters[offset].supervision_timeout_,
+        .min_ce_length = initiating_phy_parameters[offset].min_ce_length_,
+        .max_ce_length = initiating_phy_parameters[offset].max_ce_length_,
+    };
+    offset++;
+  }
+
+  return ErrorCode::SUCCESS;
+}
+
+void LinkLayerController::SetSecureSimplePairingSupport(bool enable) {
+  uint64_t bit = 0x1;
+  secure_simple_pairing_host_support_ = enable;
+  if (enable) {
+    host_supported_features_ |= bit;
+  } else {
+    host_supported_features_ &= ~bit;
+  }
+}
+
+void LinkLayerController::SetLeHostSupport(bool enable) {
+  // TODO: Vol 2, Part C § 3.5 Feature requirements.
+  // (65) LE Supported (Host)             implies
+  //    (38) LE Supported (Controller)
+  uint64_t bit = 0x2;
+  le_host_support_ = enable;
+  if (enable) {
+    host_supported_features_ |= bit;
+  } else {
+    host_supported_features_ &= ~bit;
+  }
+}
+
+void LinkLayerController::SetSecureConnectionsSupport(bool enable) {
+  // TODO: Vol 2, Part C § 3.5 Feature requirements.
+  // (67) Secure Connections (Host Support)           implies
+  //    (64) Secure Simple Pairing (Host Support)     and
+  //    (136) Secure Connections (Controller Support)
+  uint64_t bit = 0x8;
+  secure_connections_host_support_ = enable;
+  if (enable) {
+    host_supported_features_ |= bit;
+  } else {
+    host_supported_features_ &= ~bit;
+  }
+}
+
+void LinkLayerController::SetLocalName(
+    std::array<uint8_t, 248> const& local_name) {
+  std::copy(local_name.begin(), local_name.end(), local_name_.begin());
+}
+
+void LinkLayerController::SetLocalName(std::vector<uint8_t> const& local_name) {
+  ASSERT(local_name.size() <= local_name_.size());
+  local_name_.fill(0);
+  std::copy(local_name.begin(), local_name.end(), local_name_.begin());
+}
+
+void LinkLayerController::SetExtendedInquiryResponse(
+    std::vector<uint8_t> const& extended_inquiry_response) {
+  ASSERT(extended_inquiry_response.size() <= extended_inquiry_response_.size());
+  extended_inquiry_response_.fill(0);
+  std::copy(extended_inquiry_response.begin(), extended_inquiry_response.end(),
+            extended_inquiry_response_.begin());
+}
+
+#ifdef ROOTCANAL_LMP
+LinkLayerController::LinkLayerController(const Address& address,
+                                         const ControllerProperties& properties)
+    : address_(address),
+      properties_(properties),
+      lm_(nullptr, link_manager_destroy) {
+  ops_ = {
+      .user_pointer = this,
+      .get_handle =
+          [](void* user, const uint8_t(*address)[6]) {
+            auto controller = static_cast<LinkLayerController*>(user);
+
+            return controller->connections_.GetHandleOnlyAddress(
+                Address(*address));
+          },
+
+      .get_address =
+          [](void* user, uint16_t handle, uint8_t(*result)[6]) {
+            auto controller = static_cast<LinkLayerController*>(user);
+
+            auto address =
+                controller->connections_.GetAddress(handle).GetAddress();
+            std::copy(address.data(), address.data() + 6,
+                      reinterpret_cast<uint8_t*>(result));
+          },
+
+      .extended_features =
+          [](void* user, uint8_t features_page) {
+            auto controller = static_cast<LinkLayerController*>(user);
+            return controller->GetLmpFeatures(features_page);
+          },
+
+      .send_hci_event =
+          [](void* user, const uint8_t* data, uintptr_t len) {
+            auto controller = static_cast<LinkLayerController*>(user);
+
+            auto event_code = static_cast<EventCode>(data[0]);
+            auto payload = std::make_unique<bluetooth::packet::RawBuilder>(
+                std::vector(data + 2, data + len));
+
+            controller->send_event_(bluetooth::hci::EventBuilder::Create(
+                event_code, std::move(payload)));
+          },
+
+      .send_lmp_packet =
+          [](void* user, const uint8_t(*to)[6], const uint8_t* data,
+             uintptr_t len) {
+            auto controller = static_cast<LinkLayerController*>(user);
+
+            auto payload = std::make_unique<bluetooth::packet::RawBuilder>(
+                std::vector(data, data + len));
+
+            Address source = controller->GetAddress();
+            Address dest(*to);
+
+            controller->SendLinkLayerPacket(model::packets::LmpBuilder::Create(
+                source, dest, std::move(payload)));
+          }};
+
+  lm_.reset(link_manager_create(ops_));
+}
+#else
+LinkLayerController::LinkLayerController(const Address& address,
+                                         const ControllerProperties& properties)
+    : address_(address), properties_(properties) {}
+#endif
+
 void LinkLayerController::SendLeLinkLayerPacket(
     std::unique_ptr<model::packets::LinkLayerPacketBuilder> packet) {
   std::shared_ptr<model::packets::LinkLayerPacketBuilder> shared_packet =
@@ -79,12 +1442,23 @@
   });
 }
 
+void LinkLayerController::SendLeLinkLayerPacketWithRssi(
+    Address source_address, Address destination_address, uint8_t rssi,
+    std::unique_ptr<model::packets::LinkLayerPacketBuilder> packet) {
+  std::shared_ptr<model::packets::RssiWrapperBuilder> shared_packet =
+      model::packets::RssiWrapperBuilder::Create(
+          source_address, destination_address, rssi, std::move(packet));
+  ScheduleTask(kNoDelayMs, [this, shared_packet]() {
+    send_to_remote_(shared_packet, Phy::Type::LOW_ENERGY);
+  });
+}
+
 ErrorCode LinkLayerController::SendLeCommandToRemoteByAddress(
-    OpCode opcode, const Address& remote, const Address& local) {
+    OpCode opcode, const Address& own_address, const Address& peer_address) {
   switch (opcode) {
     case (OpCode::LE_READ_REMOTE_FEATURES):
-      SendLeLinkLayerPacket(
-          model::packets::LeReadRemoteFeaturesBuilder::Create(local, remote));
+      SendLeLinkLayerPacket(model::packets::LeReadRemoteFeaturesBuilder::Create(
+          own_address, peer_address));
       break;
     default:
       LOG_INFO("Dropping unhandled command 0x%04x",
@@ -97,37 +1471,35 @@
 
 ErrorCode LinkLayerController::SendCommandToRemoteByAddress(
     OpCode opcode, bluetooth::packet::PacketView<true> args,
-    const Address& remote) {
-  Address local_address = properties_.GetAddress();
-
+    const Address& own_address, const Address& peer_address) {
   switch (opcode) {
     case (OpCode::REMOTE_NAME_REQUEST):
       // LMP features get requested with remote name requests.
       SendLinkLayerPacket(model::packets::ReadRemoteLmpFeaturesBuilder::Create(
-          local_address, remote));
+          own_address, peer_address));
       SendLinkLayerPacket(model::packets::RemoteNameRequestBuilder::Create(
-          local_address, remote));
+          own_address, peer_address));
       break;
     case (OpCode::READ_REMOTE_SUPPORTED_FEATURES):
       SendLinkLayerPacket(
           model::packets::ReadRemoteSupportedFeaturesBuilder::Create(
-              local_address, remote));
+              own_address, peer_address));
       break;
     case (OpCode::READ_REMOTE_EXTENDED_FEATURES): {
       uint8_t page_number =
           (args.begin() + 2).extract<uint8_t>();  // skip the handle
       SendLinkLayerPacket(
           model::packets::ReadRemoteExtendedFeaturesBuilder::Create(
-              local_address, remote, page_number));
+              own_address, peer_address, page_number));
     } break;
     case (OpCode::READ_REMOTE_VERSION_INFORMATION):
       SendLinkLayerPacket(
           model::packets::ReadRemoteVersionInformationBuilder::Create(
-              local_address, remote));
+              own_address, peer_address));
       break;
     case (OpCode::READ_CLOCK_OFFSET):
       SendLinkLayerPacket(model::packets::ReadClockOffsetBuilder::Create(
-          local_address, remote));
+          own_address, peer_address));
       break;
     default:
       LOG_INFO("Dropping unhandled command 0x%04x",
@@ -147,11 +1519,12 @@
   switch (opcode) {
     case (OpCode::LE_READ_REMOTE_FEATURES):
       return SendLeCommandToRemoteByAddress(
-          opcode, connections_.GetAddress(handle).GetAddress(),
-          connections_.GetOwnAddress(handle).GetAddress());
+          opcode, connections_.GetOwnAddress(handle).GetAddress(),
+          connections_.GetAddress(handle).GetAddress());
     default:
       return SendCommandToRemoteByAddress(
-          opcode, args, connections_.GetAddress(handle).GetAddress());
+          opcode, args, connections_.GetOwnAddress(handle).GetAddress(),
+          connections_.GetAddress(handle).GetAddress());
   }
 }
 
@@ -213,7 +1586,7 @@
   }
 
   // TODO: SCO flow control
-  Address source = properties_.GetAddress();
+  Address source = GetAddress();
   Address destination = connections_.GetScoAddress(handle);
 
   auto sco_data = sco_packet.GetData();
@@ -247,25 +1620,30 @@
   // Match broadcasts
   bool address_matches = (destination_address == Address::kEmpty);
 
-  // Match addresses from device properties
-  if (destination_address == properties_.GetAddress() ||
-      destination_address == properties_.GetLeAddress()) {
+  // Address match is performed in specific handlers for these PDU types.
+  switch (incoming.GetType()) {
+    case model::packets::PacketType::LE_SCAN:
+    case model::packets::PacketType::LE_SCAN_RESPONSE:
+    case model::packets::PacketType::LE_LEGACY_ADVERTISING_PDU:
+    case model::packets::PacketType::LE_EXTENDED_ADVERTISING_PDU:
+    case model::packets::PacketType::LE_CONNECT:
+      address_matches = true;
+      break;
+    default:
+      break;
+  }
+
+  // Check public address
+  if (destination_address == address_ ||
+      destination_address == random_address_) {
     address_matches = true;
   }
 
   // Check current connection address
-  if (destination_address == le_connecting_rpa_) {
+  if (destination_address == initiator_.initiating_address) {
     address_matches = true;
   }
 
-  // Check advertising addresses
-  for (const auto& advertiser : advertisers_) {
-    if (advertiser.IsEnabled() &&
-        advertiser.GetAddress().GetAddress() == destination_address) {
-      address_matches = true;
-    }
-  }
-
   // Check connection addresses
   auto source_address = incoming.GetSourceAddress();
   auto handle = connections_.GetHandleOnlyAddress(source_address);
@@ -273,14 +1651,18 @@
     if (connections_.GetOwnAddress(handle).GetAddress() ==
         destination_address) {
       address_matches = true;
+
+      // Update link timeout for valid ACL connections
+      connections_.ResetLinkTimer(handle);
     }
   }
 
   // Drop packets not addressed to me
   if (!address_matches) {
-    LOG_INFO("Dropping packet not addressed to me %s->%s",
-             source_address.ToString().c_str(),
-             destination_address.ToString().c_str());
+    LOG_INFO("%s | Dropping packet not addressed to me %s->%s (type 0x%x)",
+             address_.ToString().c_str(), source_address.ToString().c_str(),
+             destination_address.ToString().c_str(),
+             static_cast<int>(incoming.GetType()));
     return;
   }
 
@@ -294,20 +1676,17 @@
     case model::packets::PacketType::DISCONNECT:
       IncomingDisconnectPacket(incoming);
       break;
+#ifdef ROOTCANAL_LMP
+    case model::packets::PacketType::LMP:
+      IncomingLmpPacket(incoming);
+      break;
+#else
     case model::packets::PacketType::ENCRYPT_CONNECTION:
       IncomingEncryptConnection(incoming);
       break;
     case model::packets::PacketType::ENCRYPT_CONNECTION_RESPONSE:
       IncomingEncryptConnectionResponse(incoming);
       break;
-    case model::packets::PacketType::INQUIRY:
-      if (inquiry_scans_enabled_) {
-        IncomingInquiryPacket(incoming, rssi);
-      }
-      break;
-    case model::packets::PacketType::INQUIRY_RESPONSE:
-      IncomingInquiryResponsePacket(incoming);
-      break;
     case model::packets::PacketType::IO_CAPABILITY_REQUEST:
       IncomingIoCapabilityRequestPacket(incoming);
       break;
@@ -317,6 +1696,30 @@
     case model::packets::PacketType::IO_CAPABILITY_NEGATIVE_RESPONSE:
       IncomingIoCapabilityNegativeResponsePacket(incoming);
       break;
+    case PacketType::KEYPRESS_NOTIFICATION:
+      IncomingKeypressNotificationPacket(incoming);
+      break;
+    case (model::packets::PacketType::PASSKEY):
+      IncomingPasskeyPacket(incoming);
+      break;
+    case (model::packets::PacketType::PASSKEY_FAILED):
+      IncomingPasskeyFailedPacket(incoming);
+      break;
+    case (model::packets::PacketType::PIN_REQUEST):
+      IncomingPinRequestPacket(incoming);
+      break;
+    case (model::packets::PacketType::PIN_RESPONSE):
+      IncomingPinResponsePacket(incoming);
+      break;
+#endif /* ROOTCANAL_LMP */
+    case model::packets::PacketType::INQUIRY:
+      if (inquiry_scan_enable_) {
+        IncomingInquiryPacket(incoming, rssi);
+      }
+      break;
+    case model::packets::PacketType::INQUIRY_RESPONSE:
+      IncomingInquiryResponsePacket(incoming);
+      break;
     case PacketType::ISO:
       IncomingIsoPacket(incoming);
       break;
@@ -326,14 +1729,12 @@
     case PacketType::ISO_CONNECTION_RESPONSE:
       IncomingIsoConnectionResponsePacket(incoming);
       break;
-    case PacketType::KEYPRESS_NOTIFICATION:
-      IncomingKeypressNotificationPacket(incoming);
-      break;
-    case model::packets::PacketType::LE_ADVERTISEMENT:
-      if (le_scan_enable_ != bluetooth::hci::OpCode::NONE || le_connect_) {
-        IncomingLeAdvertisementPacket(incoming, rssi);
-      }
-      break;
+    case model::packets::PacketType::LE_LEGACY_ADVERTISING_PDU:
+      IncomingLeLegacyAdvertisingPdu(incoming, rssi);
+      return;
+    case model::packets::PacketType::LE_EXTENDED_ADVERTISING_PDU:
+      IncomingLeExtendedAdvertisingPdu(incoming, rssi);
+      return;
     case model::packets::PacketType::LE_CONNECT:
       IncomingLeConnectPacket(incoming);
       break;
@@ -359,17 +1760,13 @@
       IncomingLeReadRemoteFeaturesResponse(incoming);
       break;
     case model::packets::PacketType::LE_SCAN:
-      // TODO: Check Advertising flags and see if we are scannable.
       IncomingLeScanPacket(incoming);
       break;
     case model::packets::PacketType::LE_SCAN_RESPONSE:
-      if (le_scan_enable_ != bluetooth::hci::OpCode::NONE &&
-          le_scan_type_ == 1) {
-        IncomingLeScanResponsePacket(incoming, rssi);
-      }
+      IncomingLeScanResponsePacket(incoming, rssi);
       break;
     case model::packets::PacketType::PAGE:
-      if (page_scans_enabled_) {
+      if (page_scan_enable_) {
         IncomingPagePacket(incoming);
       }
       break;
@@ -379,18 +1776,6 @@
     case model::packets::PacketType::PAGE_REJECT:
       IncomingPageRejectPacket(incoming);
       break;
-    case (model::packets::PacketType::PASSKEY):
-      IncomingPasskeyPacket(incoming);
-      break;
-    case (model::packets::PacketType::PASSKEY_FAILED):
-      IncomingPasskeyFailedPacket(incoming);
-      break;
-    case (model::packets::PacketType::PIN_REQUEST):
-      IncomingPinRequestPacket(incoming);
-      break;
-    case (model::packets::PacketType::PIN_RESPONSE):
-      IncomingPinResponsePacket(incoming);
-      break;
     case (model::packets::PacketType::REMOTE_NAME_REQUEST):
       IncomingRemoteNameRequest(incoming);
       break;
@@ -439,7 +1824,12 @@
     case model::packets::PacketType::SCO_DISCONNECT:
       IncomingScoDisconnect(incoming);
       break;
-
+    case model::packets::PacketType::PING_REQUEST:
+      IncomingPingRequest(incoming);
+      break;
+    case model::packets::PacketType::PING_RESPONSE:
+      // ping responses require no action
+      break;
     default:
       LOG_WARN("Dropping unhandled packet of type %s",
                model::packets::PacketTypeText(incoming.GetType()).c_str());
@@ -468,7 +1858,7 @@
 
   std::vector<uint8_t> payload_data(acl_view.GetPayload().begin(),
                                     acl_view.GetPayload().end());
-  uint16_t acl_buffer_size = properties_.GetAclDataPacketSize();
+  uint16_t acl_buffer_size = properties_.acl_data_packet_length;
   int num_packets =
       (payload_data.size() + acl_buffer_size - 1) / acl_buffer_size;
 
@@ -525,8 +1915,7 @@
   ASSERT(view.IsValid());
 
   SendLinkLayerPacket(model::packets::RemoteNameRequestResponseBuilder::Create(
-      packet.GetDestinationAddress(), packet.GetSourceAddress(),
-      properties_.GetName()));
+      packet.GetDestinationAddress(), packet.GetSourceAddress(), local_name_));
 }
 
 void LinkLayerController::IncomingRemoteNameRequestResponse(
@@ -534,7 +1923,7 @@
   auto view = model::packets::RemoteNameRequestResponseView::Create(packet);
   ASSERT(view.IsValid());
 
-  if (properties_.IsUnmasked(EventCode::REMOTE_NAME_REQUEST_COMPLETE)) {
+  if (IsEventUnmasked(EventCode::REMOTE_NAME_REQUEST_COMPLETE)) {
     send_event_(bluetooth::hci::RemoteNameRequestCompleteBuilder::Create(
         ErrorCode::SUCCESS, packet.GetSourceAddress(), view.GetName()));
   }
@@ -545,15 +1934,14 @@
   SendLinkLayerPacket(
       model::packets::ReadRemoteLmpFeaturesResponseBuilder::Create(
           packet.GetDestinationAddress(), packet.GetSourceAddress(),
-          properties_.GetExtendedFeatures(1)));
+          host_supported_features_));
 }
 
 void LinkLayerController::IncomingReadRemoteLmpFeaturesResponse(
     model::packets::LinkLayerPacketView packet) {
   auto view = model::packets::ReadRemoteLmpFeaturesResponseView::Create(packet);
   ASSERT(view.IsValid());
-  if (properties_.IsUnmasked(
-          EventCode::REMOTE_HOST_SUPPORTED_FEATURES_NOTIFICATION)) {
+  if (IsEventUnmasked(EventCode::REMOTE_HOST_SUPPORTED_FEATURES_NOTIFICATION)) {
     send_event_(
         bluetooth::hci::RemoteHostSupportedFeaturesNotificationBuilder::Create(
             packet.GetSourceAddress(), view.GetFeatures()));
@@ -565,7 +1953,7 @@
   SendLinkLayerPacket(
       model::packets::ReadRemoteSupportedFeaturesResponseBuilder::Create(
           packet.GetDestinationAddress(), packet.GetSourceAddress(),
-          properties_.GetSupportedFeatures()));
+          properties_.lmp_features[0]));
 }
 
 void LinkLayerController::IncomingReadRemoteSupportedFeaturesResponse(
@@ -580,8 +1968,7 @@
              source.ToString().c_str());
     return;
   }
-  if (properties_.IsUnmasked(
-          EventCode::READ_REMOTE_SUPPORTED_FEATURES_COMPLETE)) {
+  if (IsEventUnmasked(EventCode::READ_REMOTE_SUPPORTED_FEATURES_COMPLETE)) {
     send_event_(
         bluetooth::hci::ReadRemoteSupportedFeaturesCompleteBuilder::Create(
             ErrorCode::SUCCESS, handle, view.GetFeatures()));
@@ -594,14 +1981,14 @@
   ASSERT(view.IsValid());
   uint8_t page_number = view.GetPageNumber();
   uint8_t error_code = static_cast<uint8_t>(ErrorCode::SUCCESS);
-  if (page_number > properties_.GetExtendedFeaturesMaximumPageNumber()) {
+  if (page_number >= properties_.lmp_features.size()) {
     error_code = static_cast<uint8_t>(ErrorCode::INVALID_LMP_OR_LL_PARAMETERS);
   }
   SendLinkLayerPacket(
       model::packets::ReadRemoteExtendedFeaturesResponseBuilder::Create(
           packet.GetDestinationAddress(), packet.GetSourceAddress(), error_code,
-          page_number, properties_.GetExtendedFeaturesMaximumPageNumber(),
-          properties_.GetExtendedFeatures(view.GetPageNumber())));
+          page_number, GetMaxLmpFeaturesPageNumber(),
+          GetLmpFeatures(page_number)));
 }
 
 void LinkLayerController::IncomingReadRemoteExtendedFeaturesResponse(
@@ -616,8 +2003,7 @@
              source.ToString().c_str());
     return;
   }
-  if (properties_.IsUnmasked(
-          EventCode::READ_REMOTE_EXTENDED_FEATURES_COMPLETE)) {
+  if (IsEventUnmasked(EventCode::READ_REMOTE_EXTENDED_FEATURES_COMPLETE)) {
     send_event_(
         bluetooth::hci::ReadRemoteExtendedFeaturesCompleteBuilder::Create(
             static_cast<ErrorCode>(view.GetStatus()), handle,
@@ -630,8 +2016,9 @@
   SendLinkLayerPacket(
       model::packets::ReadRemoteVersionInformationResponseBuilder::Create(
           packet.GetDestinationAddress(), packet.GetSourceAddress(),
-          properties_.GetLmpPalVersion(), properties_.GetLmpPalSubversion(),
-          properties_.GetManufacturerName()));
+          static_cast<uint8_t>(properties_.lmp_version),
+          static_cast<uint16_t>(properties_.lmp_subversion),
+          properties_.company_identifier));
 }
 
 void LinkLayerController::IncomingReadRemoteVersionResponse(
@@ -646,8 +2033,7 @@
              source.ToString().c_str());
     return;
   }
-  if (properties_.IsUnmasked(
-          EventCode::READ_REMOTE_VERSION_INFORMATION_COMPLETE)) {
+  if (IsEventUnmasked(EventCode::READ_REMOTE_VERSION_INFORMATION_COMPLETE)) {
     send_event_(
         bluetooth::hci::ReadRemoteVersionInformationCompleteBuilder::Create(
             ErrorCode::SUCCESS, handle, view.GetLmpVersion(),
@@ -659,7 +2045,7 @@
     model::packets::LinkLayerPacketView packet) {
   SendLinkLayerPacket(model::packets::ReadClockOffsetResponseBuilder::Create(
       packet.GetDestinationAddress(), packet.GetSourceAddress(),
-      properties_.GetClockOffset()));
+      GetClockOffset()));
 }
 
 void LinkLayerController::IncomingReadClockOffsetResponse(
@@ -673,7 +2059,7 @@
              source.ToString().c_str());
     return;
   }
-  if (properties_.IsUnmasked(EventCode::READ_CLOCK_OFFSET_COMPLETE)) {
+  if (IsEventUnmasked(EventCode::READ_CLOCK_OFFSET_COMPLETE)) {
     send_event_(bluetooth::hci::ReadClockOffsetCompleteBuilder::Create(
         ErrorCode::SUCCESS, handle, view.GetOffset()));
   }
@@ -692,13 +2078,23 @@
              peer.ToString().c_str());
     return;
   }
-  ASSERT_LOG(connections_.Disconnect(handle),
+#ifdef ROOTCANAL_LMP
+  auto is_br_edr = connections_.GetPhyType(handle) == Phy::Type::BR_EDR;
+#endif
+  ASSERT_LOG(connections_.Disconnect(handle, cancel_task_),
              "GetHandle() returned invalid handle %hx", handle);
 
   uint8_t reason = disconnect.GetReason();
-  SendDisconnectionCompleteEvent(handle, reason);
+  SendDisconnectionCompleteEvent(handle, ErrorCode(reason));
+#ifdef ROOTCANAL_LMP
+  if (is_br_edr) {
+    ASSERT(link_manager_remove_link(
+        lm_.get(), reinterpret_cast<uint8_t(*)[6]>(peer.data())));
+  }
+#endif
 }
 
+#ifndef ROOTCANAL_LMP
 void LinkLayerController::IncomingEncryptConnection(
     model::packets::LinkLayerPacketView incoming) {
   LOG_INFO("IncomingEncryptConnection");
@@ -710,7 +2106,7 @@
     LOG_INFO("Unknown connection @%s", peer.ToString().c_str());
     return;
   }
-  if (properties_.IsUnmasked(EventCode::ENCRYPTION_CHANGE)) {
+  if (IsEventUnmasked(EventCode::ENCRYPTION_CHANGE)) {
     send_event_(bluetooth::hci::EncryptionChangeBuilder::Create(
         ErrorCode::SUCCESS, handle, bluetooth::hci::EncryptionEnabled::ON));
   }
@@ -723,7 +2119,7 @@
   auto array = security_manager_.GetKey(peer);
   std::vector<uint8_t> key_vec{array.begin(), array.end()};
   SendLinkLayerPacket(model::packets::EncryptConnectionResponseBuilder::Create(
-      properties_.GetAddress(), peer, key_vec));
+      GetAddress(), peer, key_vec));
 }
 
 void LinkLayerController::IncomingEncryptConnectionResponse(
@@ -737,11 +2133,12 @@
              incoming.GetSourceAddress().ToString().c_str());
     return;
   }
-  if (properties_.IsUnmasked(EventCode::ENCRYPTION_CHANGE)) {
+  if (IsEventUnmasked(EventCode::ENCRYPTION_CHANGE)) {
     send_event_(bluetooth::hci::EncryptionChangeBuilder::Create(
         ErrorCode::SUCCESS, handle, bluetooth::hci::EncryptionEnabled::ON));
   }
 }
+#endif /* !ROOTCANAL_LMP */
 
 void LinkLayerController::IncomingInquiryPacket(
     model::packets::LinkLayerPacketView incoming, uint8_t rssi) {
@@ -749,29 +2146,35 @@
   ASSERT(inquiry.IsValid());
 
   Address peer = incoming.GetSourceAddress();
+  uint8_t lap = inquiry.GetLap();
+
+  // Filter out inquiry packets with IAC not present in the
+  // list Current_IAC_LAP.
+  if (std::none_of(current_iac_lap_list_.cbegin(), current_iac_lap_list_.cend(),
+                   [lap](auto iac_lap) { return iac_lap.lap_ == lap; })) {
+    return;
+  }
 
   switch (inquiry.GetInquiryType()) {
     case (model::packets::InquiryType::STANDARD): {
       SendLinkLayerPacket(model::packets::InquiryResponseBuilder::Create(
-          properties_.GetAddress(), peer,
-          properties_.GetPageScanRepetitionMode(),
-          properties_.GetClassOfDevice(), properties_.GetClockOffset()));
+          GetAddress(), peer, static_cast<uint8_t>(GetPageScanRepetitionMode()),
+          class_of_device_, GetClockOffset()));
     } break;
     case (model::packets::InquiryType::RSSI): {
       SendLinkLayerPacket(
           model::packets::InquiryResponseWithRssiBuilder::Create(
-              properties_.GetAddress(), peer,
-              properties_.GetPageScanRepetitionMode(),
-              properties_.GetClassOfDevice(), properties_.GetClockOffset(),
-              rssi));
+              GetAddress(), peer,
+              static_cast<uint8_t>(GetPageScanRepetitionMode()),
+              class_of_device_, GetClockOffset(), rssi));
     } break;
     case (model::packets::InquiryType::EXTENDED): {
       SendLinkLayerPacket(
           model::packets::ExtendedInquiryResponseBuilder::Create(
-              properties_.GetAddress(), peer,
-              properties_.GetPageScanRepetitionMode(),
-              properties_.GetClassOfDevice(), properties_.GetClockOffset(),
-              rssi, properties_.GetExtendedInquiryData()));
+              GetAddress(), peer,
+              static_cast<uint8_t>(GetPageScanRepetitionMode()),
+              class_of_device_, GetClockOffset(), rssi,
+              extended_inquiry_response_));
 
     } break;
     default:
@@ -806,7 +2209,7 @@
       responses.back().page_scan_repetition_mode_ = page_scan_repetition_mode;
       responses.back().class_of_device_ = inquiry_response.GetClassOfDevice();
       responses.back().clock_offset_ = inquiry_response.GetClockOffset();
-      if (properties_.IsUnmasked(EventCode::INQUIRY_RESULT)) {
+      if (IsEventUnmasked(EventCode::INQUIRY_RESULT)) {
         send_event_(bluetooth::hci::InquiryResultBuilder::Create(responses));
       }
     } break;
@@ -828,7 +2231,7 @@
       responses.back().class_of_device_ = inquiry_response.GetClassOfDevice();
       responses.back().clock_offset_ = inquiry_response.GetClockOffset();
       responses.back().rssi_ = inquiry_response.GetRssi();
-      if (properties_.IsUnmasked(EventCode::INQUIRY_RESULT_WITH_RSSI)) {
+      if (IsEventUnmasked(EventCode::INQUIRY_RESULT_WITH_RSSI)) {
         send_event_(
             bluetooth::hci::InquiryResultWithRssiBuilder::Create(responses));
       }
@@ -840,25 +2243,14 @@
               basic_inquiry_response);
       ASSERT(inquiry_response.IsValid());
 
-      std::unique_ptr<bluetooth::packet::RawBuilder> raw_builder_ptr =
-          std::make_unique<bluetooth::packet::RawBuilder>();
-      raw_builder_ptr->AddOctets1(kNumCommandPackets);
-      raw_builder_ptr->AddAddress(inquiry_response.GetSourceAddress());
-      raw_builder_ptr->AddOctets1(inquiry_response.GetPageScanRepetitionMode());
-      raw_builder_ptr->AddOctets1(0x00);  // _reserved_
-      auto class_of_device = inquiry_response.GetClassOfDevice();
-      for (unsigned int i = 0; i < class_of_device.kLength; i++) {
-        raw_builder_ptr->AddOctets1(class_of_device.cod[i]);
-      }
-      raw_builder_ptr->AddOctets2(inquiry_response.GetClockOffset());
-      raw_builder_ptr->AddOctets1(inquiry_response.GetRssi());
-      raw_builder_ptr->AddOctets(inquiry_response.GetExtendedData());
-
-      if (properties_.IsUnmasked(EventCode::EXTENDED_INQUIRY_RESULT)) {
-        send_event_(bluetooth::hci::EventBuilder::Create(
-            bluetooth::hci::EventCode::EXTENDED_INQUIRY_RESULT,
-            std::move(raw_builder_ptr)));
-      }
+      send_event_(bluetooth::hci::ExtendedInquiryResultRawBuilder::Create(
+          inquiry_response.GetSourceAddress(),
+          static_cast<bluetooth::hci::PageScanRepetitionMode>(
+              inquiry_response.GetPageScanRepetitionMode()),
+          inquiry_response.GetClassOfDevice(),
+          inquiry_response.GetClockOffset(), inquiry_response.GetRssi(),
+          std::vector<uint8_t>(extended_inquiry_response_.begin(),
+                               extended_inquiry_response_.end())));
     } break;
     default:
       LOG_WARN("Unhandled Incoming Inquiry Response of type %d",
@@ -866,6 +2258,7 @@
   }
 }
 
+#ifndef ROOTCANAL_LMP
 void LinkLayerController::IncomingIoCapabilityRequestPacket(
     model::packets::LinkLayerPacketView incoming) {
   Address peer = incoming.GetSourceAddress();
@@ -876,7 +2269,7 @@
     return;
   }
 
-  if (!properties_.GetSecureSimplePairingSupported()) {
+  if (!secure_simple_pairing_host_support_) {
     LOG_WARN("Trying PIN pairing for %s",
              incoming.GetDestinationAddress().ToString().c_str());
     SendLinkLayerPacket(
@@ -889,7 +2282,7 @@
                                               handle, false);
     }
     security_manager_.SetPinRequested(peer);
-    if (properties_.IsUnmasked(EventCode::PIN_CODE_REQUEST)) {
+    if (IsEventUnmasked(EventCode::PIN_CODE_REQUEST)) {
       send_event_(bluetooth::hci::PinCodeRequestBuilder::Create(
           incoming.GetSourceAddress()));
     }
@@ -903,7 +2296,7 @@
   uint8_t oob_data_present = request.GetOobDataPresent();
   uint8_t authentication_requirements = request.GetAuthenticationRequirements();
 
-  if (properties_.IsUnmasked(EventCode::IO_CAPABILITY_RESPONSE)) {
+  if (IsEventUnmasked(EventCode::IO_CAPABILITY_RESPONSE)) {
     send_event_(bluetooth::hci::IoCapabilityResponseBuilder::Create(
         peer, static_cast<bluetooth::hci::IoCapability>(io_capability),
         static_cast<bluetooth::hci::OobDataPresent>(oob_data_present),
@@ -935,7 +2328,7 @@
     model::packets::LinkLayerPacketView incoming) {
   auto response = model::packets::IoCapabilityResponseView::Create(incoming);
   ASSERT(response.IsValid());
-  if (!properties_.GetSecureSimplePairingSupported()) {
+  if (!secure_simple_pairing_host_support_) {
     LOG_WARN("Only simple pairing mode is implemented");
     SendLinkLayerPacket(
         model::packets::IoCapabilityNegativeResponseBuilder::Create(
@@ -954,7 +2347,7 @@
   security_manager_.SetPeerIoCapability(peer, io_capability, oob_data_present,
                                         authentication_requirements);
 
-  if (properties_.IsUnmasked(EventCode::IO_CAPABILITY_RESPONSE)) {
+  if (IsEventUnmasked(EventCode::IO_CAPABILITY_RESPONSE)) {
     send_event_(bluetooth::hci::IoCapabilityResponseBuilder::Create(
         peer, static_cast<bluetooth::hci::IoCapability>(io_capability),
         static_cast<bluetooth::hci::OobDataPresent>(oob_data_present),
@@ -982,11 +2375,12 @@
   LOG_INFO("%s doesn't support SSP, try PIN",
            incoming.GetSourceAddress().ToString().c_str());
   security_manager_.SetPinRequested(peer);
-  if (properties_.IsUnmasked(EventCode::PIN_CODE_REQUEST)) {
+  if (IsEventUnmasked(EventCode::PIN_CODE_REQUEST)) {
     send_event_(bluetooth::hci::PinCodeRequestBuilder::Create(
         incoming.GetSourceAddress()));
   }
 }
+#endif /* !ROOTCANAL_LMP */
 
 void LinkLayerController::IncomingIsoPacket(LinkLayerPacketView incoming) {
   auto iso = IsoDataPacketView::Create(incoming);
@@ -1145,7 +2539,7 @@
   connections_.CreatePendingCis(config);
   connections_.SetRemoteCisHandle(config.cis_connection_handle_,
                                   req.GetRequesterCisHandle());
-  if (properties_.IsUnmasked(EventCode::LE_META_EVENT)) {
+  if (IsEventUnmasked(EventCode::LE_META_EVENT)) {
     send_event_(bluetooth::hci::LeCisRequestBuilder::Create(
         config.acl_connection_handle_, config.cis_connection_handle_, group_id,
         req.GetId()));
@@ -1167,7 +2561,7 @@
   }
   ErrorCode status = static_cast<ErrorCode>(response.GetStatus());
   if (status != ErrorCode::SUCCESS) {
-    if (properties_.IsUnmasked(EventCode::LE_META_EVENT)) {
+    if (IsEventUnmasked(EventCode::LE_META_EVENT)) {
       send_event_(bluetooth::hci::LeCisEstablishedBuilder::Create(
           status, config.cis_connection_handle_, 0, 0, 0, 0,
           bluetooth::hci::SecondaryPhyType::NO_PACKETS,
@@ -1196,7 +2590,7 @@
   uint8_t max_pdu_m_to_s = 0x40;
   uint8_t max_pdu_s_to_m = 0x40;
   uint16_t iso_interval = 0x100;
-  if (properties_.IsUnmasked(EventCode::LE_META_EVENT)) {
+  if (IsEventUnmasked(EventCode::LE_META_EVENT)) {
     send_event_(bluetooth::hci::LeCisEstablishedBuilder::Create(
         status, config.cis_connection_handle_, cig_sync_delay, cis_sync_delay,
         latency_m_to_s, latency_s_to_m,
@@ -1206,6 +2600,7 @@
   }
 }
 
+#ifndef ROOTCANAL_LMP
 void LinkLayerController::IncomingKeypressNotificationPacket(
     model::packets::LinkLayerPacketView incoming) {
   auto keypress = model::packets::KeypressNotificationView::Create(incoming);
@@ -1217,26 +2612,14 @@
              static_cast<int>(notification_type));
     return;
   }
-  if (properties_.IsUnmasked(EventCode::KEYPRESS_NOTIFICATION)) {
+  if (IsEventUnmasked(EventCode::KEYPRESS_NOTIFICATION)) {
     send_event_(bluetooth::hci::KeypressNotificationBuilder::Create(
         incoming.GetSourceAddress(),
         static_cast<bluetooth::hci::KeypressNotificationType>(
             notification_type)));
   }
 }
-
-static bool rpa_matches_irk(
-    Address rpa, std::array<uint8_t, LinkLayerController::kIrkSize> irk) {
-  // 1.3.2.3 Private device address resolution
-  uint8_t hash[3] = {rpa.address[0], rpa.address[1], rpa.address[2]};
-  uint8_t prand[3] = {rpa.address[3], rpa.address[4], rpa.address[5]};
-
-  // generate X = E irk(R0, R1, R2) and R is random address 3 LSO
-  auto x = bluetooth::crypto_toolbox::aes_128(irk, &prand[0], 3);
-
-  // If the hashes match, this is the IRK
-  return (memcmp(x.data(), &hash[0], 3) == 0);
-}
+#endif /* !ROOTCANAL_LMP */
 
 static Address generate_rpa(
     std::array<uint8_t, LinkLayerController::kIrkSize> irk) {
@@ -1272,170 +2655,902 @@
   return rpa;
 }
 
-void LinkLayerController::IncomingLeAdvertisementPacket(
-    model::packets::LinkLayerPacketView incoming, uint8_t rssi) {
-  // TODO: Handle multiple advertisements per packet.
-
-  Address address = incoming.GetSourceAddress();
-  auto advertisement = model::packets::LeAdvertisementView::Create(incoming);
-  ASSERT(advertisement.IsValid());
-  auto address_type = advertisement.GetAddressType();
-  auto adv_type = advertisement.GetAdvertisementType();
-
-  if (le_scan_enable_ == bluetooth::hci::OpCode::LE_SET_SCAN_ENABLE) {
-    vector<uint8_t> ad = advertisement.GetData();
-
-    std::unique_ptr<bluetooth::packet::RawBuilder> raw_builder_ptr =
-        std::make_unique<bluetooth::packet::RawBuilder>();
-    raw_builder_ptr->AddOctets1(
-        static_cast<uint8_t>(bluetooth::hci::SubeventCode::ADVERTISING_REPORT));
-    raw_builder_ptr->AddOctets1(0x01);  // num reports
-    raw_builder_ptr->AddOctets1(static_cast<uint8_t>(adv_type));
-    raw_builder_ptr->AddOctets1(static_cast<uint8_t>(address_type));
-    raw_builder_ptr->AddAddress(address);
-    raw_builder_ptr->AddOctets1(ad.size());
-    raw_builder_ptr->AddOctets(ad);
-    raw_builder_ptr->AddOctets1(rssi);
-    if (properties_.IsUnmasked(EventCode::LE_META_EVENT)) {
-      send_event_(bluetooth::hci::EventBuilder::Create(
-          bluetooth::hci::EventCode::LE_META_EVENT,
-          std::move(raw_builder_ptr)));
-    }
+// Handle legacy advertising PDUs while in the Scanning state.
+void LinkLayerController::ScanIncomingLeLegacyAdvertisingPdu(
+    model::packets::LeLegacyAdvertisingPduView& pdu, uint8_t rssi) {
+  if (!scanner_.IsEnabled()) {
+    return;
   }
 
-  if (le_scan_enable_ == bluetooth::hci::OpCode::LE_SET_EXTENDED_SCAN_ENABLE) {
-    vector<uint8_t> ad = advertisement.GetData();
+  auto advertising_type = pdu.GetAdvertisingType();
+  std::vector<uint8_t> advertising_data = pdu.GetAdvertisingData();
 
-    std::unique_ptr<bluetooth::packet::RawBuilder> raw_builder_ptr =
-        std::make_unique<bluetooth::packet::RawBuilder>();
-    raw_builder_ptr->AddOctets1(static_cast<uint8_t>(
-        bluetooth::hci::SubeventCode::EXTENDED_ADVERTISING_REPORT));
-    raw_builder_ptr->AddOctets1(0x01);  // num reports
-    switch (adv_type) {
-      case model::packets::AdvertisementType::ADV_IND:
-        raw_builder_ptr->AddOctets1(0x13);
-        break;
-      case model::packets::AdvertisementType::ADV_DIRECT_IND:
-        raw_builder_ptr->AddOctets1(0x15);
-        break;
-      case model::packets::AdvertisementType::ADV_SCAN_IND:
-        raw_builder_ptr->AddOctets1(0x12);
-        break;
-      case model::packets::AdvertisementType::ADV_NONCONN_IND:
-        raw_builder_ptr->AddOctets1(0x10);
-        break;
-      case model::packets::AdvertisementType::SCAN_RESPONSE:
-        raw_builder_ptr->AddOctets1(0x1b);  // 0x1a for ADV_SCAN_IND scan
+  AddressWithType advertising_address{
+      pdu.GetSourceAddress(),
+      static_cast<AddressType>(pdu.GetAdvertisingAddressType())};
+
+  AddressWithType target_address{
+      pdu.GetDestinationAddress(),
+      static_cast<AddressType>(pdu.GetTargetAddressType())};
+
+  bool scannable_advertising =
+      advertising_type == model::packets::LegacyAdvertisingType::ADV_IND ||
+      advertising_type == model::packets::LegacyAdvertisingType::ADV_SCAN_IND;
+
+  bool directed_advertising =
+      advertising_type == model::packets::LegacyAdvertisingType::ADV_DIRECT_IND;
+
+  bool connectable_advertising =
+      advertising_type == model::packets::LegacyAdvertisingType::ADV_IND ||
+      advertising_type == model::packets::LegacyAdvertisingType::ADV_DIRECT_IND;
+
+  // TODO: check originating PHY, compare against active scanning PHYs
+  // (scanner_.le_1m_phy or scanner_.le_coded_phy).
+
+  // When a scanner receives an advertising packet that contains a resolvable
+  // private address for the advertiser’s device address (AdvA field) and
+  // address resolution is enabled, the Link Layer shall resolve the private
+  // address. The scanner’s filter policy shall then determine if the scanner
+  // responds with a scan request.
+  AddressWithType resolved_advertising_address =
+      ResolvePrivateAddress(advertising_address, IrkSelection::Peer)
+          .value_or(advertising_address);
+
+  std::optional<AddressWithType> resolved_target_address =
+      ResolvePrivateAddress(target_address, IrkSelection::Peer);
+
+  if (resolved_advertising_address != advertising_address) {
+    LOG_VERB("Resolved the advertising address %s(%hhx) to %s(%hhx)",
+             advertising_address.ToString().c_str(),
+             advertising_address.GetAddressType(),
+             resolved_advertising_address.ToString().c_str(),
+             resolved_advertising_address.GetAddressType());
+  }
+
+  // Vol 6, Part B § 4.3.3 Scanner filter policy
+  switch (scanner_.scan_filter_policy) {
+    case bluetooth::hci::LeScanningFilterPolicy::ACCEPT_ALL:
+    case bluetooth::hci::LeScanningFilterPolicy::CHECK_INITIATORS_IDENTITY:
+      break;
+    case bluetooth::hci::LeScanningFilterPolicy::FILTER_ACCEPT_LIST_ONLY:
+    case bluetooth::hci::LeScanningFilterPolicy::
+        FILTER_ACCEPT_LIST_AND_INITIATORS_IDENTITY:
+      if (!LeFilterAcceptListContainsDevice(resolved_advertising_address)) {
+        LOG_VERB(
+            "Legacy advertising ignored by scanner because the advertising "
+            "address %s(%hhx) is not in the filter accept list",
+            resolved_advertising_address.ToString().c_str(),
+            resolved_advertising_address.GetAddressType());
         return;
-    }
-    raw_builder_ptr->AddOctets1(0x00);  // Reserved
-    raw_builder_ptr->AddOctets1(static_cast<uint8_t>(address_type));
-    raw_builder_ptr->AddAddress(address);
-    raw_builder_ptr->AddOctets1(1);     // Primary_PHY
-    raw_builder_ptr->AddOctets1(0);     // Secondary_PHY
-    raw_builder_ptr->AddOctets1(0xFF);  // Advertising_SID - not provided
-    raw_builder_ptr->AddOctets1(0x7F);  // Tx_Power - Not available
-    raw_builder_ptr->AddOctets1(rssi);
-    raw_builder_ptr->AddOctets2(0);  // Periodic_Advertising_Interval - None
-    raw_builder_ptr->AddOctets1(0);  // Direct_Address_Type - PUBLIC
-    raw_builder_ptr->AddAddress(Address::kEmpty);  // Direct_Address
-    raw_builder_ptr->AddOctets1(ad.size());
-    raw_builder_ptr->AddOctets(ad);
-    if (properties_.IsUnmasked(EventCode::LE_META_EVENT)) {
-      send_event_(bluetooth::hci::EventBuilder::Create(
-          bluetooth::hci::EventCode::LE_META_EVENT,
-          std::move(raw_builder_ptr)));
-    }
-  }
-
-  // Active scanning
-  if (le_scan_enable_ != bluetooth::hci::OpCode::NONE && le_scan_type_ == 1) {
-    SendLeLinkLayerPacket(model::packets::LeScanBuilder::Create(
-        properties_.GetLeAddress(), address));
-  }
-
-  if (!le_connect_) {
-    return;
-  }
-  if (!(adv_type == model::packets::AdvertisementType::ADV_IND ||
-        adv_type == model::packets::AdvertisementType::ADV_DIRECT_IND)) {
-    return;
-  }
-  Address resolved_address = Address::kEmpty;
-  AddressType resolved_address_type = AddressType::PUBLIC_DEVICE_ADDRESS;
-  bool resolved = false;
-  Address rpa;
-  if (le_resolving_list_enabled_) {
-    for (const auto& entry : le_resolving_list_) {
-      if (rpa_matches_irk(address, entry.peer_irk)) {
-        LOG_INFO("Matched against IRK for %s",
-                 entry.address.ToString().c_str());
-        resolved = true;
-        resolved_address = entry.address;
-        resolved_address_type = entry.address_type;
-        rpa = generate_rpa(entry.local_irk);
       }
+      break;
+  }
+
+  // When LE_Set_Scan_Enable is used:
+  //
+  // When the Scanning_Filter_Policy is set to 0x02 or 0x03 (see Section 7.8.10)
+  // and a directed advertisement was received where the advertiser used a
+  // resolvable private address which the Controller is unable to resolve, an
+  // HCI_LE_Directed_Advertising_Report event shall be generated instead of an
+  // HCI_LE_Advertising_Report event.
+  bool should_send_directed_advertising_report = false;
+
+  if (directed_advertising) {
+    switch (scanner_.scan_filter_policy) {
+      // In both basic scanner filter policy modes, a directed advertising PDU
+      // shall be ignored unless either:
+      //  • the TargetA field is identical to the scanner's device address, or
+      //  • the TargetA field is a resolvable private address, address
+      //  resolution is
+      //    enabled, and the address is resolved successfully
+      case bluetooth::hci::LeScanningFilterPolicy::ACCEPT_ALL:
+      case bluetooth::hci::LeScanningFilterPolicy::FILTER_ACCEPT_LIST_ONLY:
+        if (!IsLocalPublicOrRandomAddress(target_address) &&
+            !(target_address.IsRpa() && resolved_target_address)) {
+          LOG_VERB(
+              "Legacy advertising ignored by scanner because the directed "
+              "address %s(%hhx) does not match the current device or cannot be "
+              "resolved",
+              target_address.ToString().c_str(),
+              target_address.GetAddressType());
+          return;
+        }
+        break;
+      // These are identical to the basic modes except
+      // that a directed advertising PDU shall be ignored unless either:
+      //  • the TargetA field is identical to the scanner's device address, or
+      //  • the TargetA field is a resolvable private address.
+      case bluetooth::hci::LeScanningFilterPolicy::CHECK_INITIATORS_IDENTITY:
+      case bluetooth::hci::LeScanningFilterPolicy::
+          FILTER_ACCEPT_LIST_AND_INITIATORS_IDENTITY:
+        if (!IsLocalPublicOrRandomAddress(target_address) &&
+            !target_address.IsRpa()) {
+          LOG_VERB(
+              "Legacy advertising ignored by scanner because the directed "
+              "address %s(%hhx) does not match the current device or is not a "
+              "resovable private address",
+              target_address.ToString().c_str(),
+              target_address.GetAddressType());
+          return;
+        }
+        should_send_directed_advertising_report =
+            target_address.IsRpa() && !resolved_target_address;
+        break;
     }
   }
 
-  // Connect
-  if ((le_peer_address_ == address &&
-       le_peer_address_type_ == static_cast<uint8_t>(address_type)) ||
-      (LeFilterAcceptListContainsDevice(
-          address, static_cast<AddressType>(address_type))) ||
-      (resolved && LeFilterAcceptListContainsDevice(resolved_address,
-                                                    resolved_address_type))) {
-    Address own_address;
-    auto own_address_type =
-        static_cast<bluetooth::hci::OwnAddressType>(le_address_type_);
-    switch (own_address_type) {
+  bool should_send_advertising_report = true;
+  if (scanner_.filter_duplicates !=
+      bluetooth::hci::FilterDuplicates::DISABLED) {
+    if (scanner_.IsPacketInHistory(pdu)) {
+      should_send_advertising_report = false;
+    } else {
+      scanner_.AddPacketToHistory(pdu);
+    }
+  }
+
+  // Legacy scanning, directed advertising.
+  if (LegacyAdvertising() && should_send_advertising_report &&
+      should_send_directed_advertising_report &&
+      IsLeEventUnmasked(SubeventCode::DIRECTED_ADVERTISING_REPORT)) {
+    bluetooth::hci::LeDirectedAdvertisingResponse response;
+    response.event_type_ =
+        bluetooth::hci::DirectAdvertisingEventType::ADV_DIRECT_IND;
+    response.address_type_ =
+        static_cast<bluetooth::hci::DirectAdvertisingAddressType>(
+            resolved_advertising_address.GetAddressType());
+    response.address_ = resolved_advertising_address.GetAddress();
+    response.direct_address_type_ =
+        bluetooth::hci::DirectAddressType::RANDOM_DEVICE_ADDRESS;
+    response.direct_address_ = target_address.GetAddress();
+    response.rssi_ = rssi;
+
+    send_event_(
+        bluetooth::hci::LeDirectedAdvertisingReportBuilder::Create({response}));
+  }
+
+  // Legacy scanning, un-directed advertising.
+  if (LegacyAdvertising() && should_send_advertising_report &&
+      !should_send_directed_advertising_report &&
+      IsLeEventUnmasked(SubeventCode::ADVERTISING_REPORT)) {
+    bluetooth::hci::LeAdvertisingResponseRaw response;
+    response.address_type_ = resolved_advertising_address.GetAddressType();
+    response.address_ = resolved_advertising_address.GetAddress();
+    response.advertising_data_ = advertising_data;
+    response.rssi_ = rssi;
+
+    switch (advertising_type) {
+      case model::packets::LegacyAdvertisingType::ADV_IND:
+        response.event_type_ = bluetooth::hci::AdvertisingEventType::ADV_IND;
+        break;
+      case model::packets::LegacyAdvertisingType::ADV_DIRECT_IND:
+        response.event_type_ =
+            bluetooth::hci::AdvertisingEventType::ADV_DIRECT_IND;
+        break;
+      case model::packets::LegacyAdvertisingType::ADV_SCAN_IND:
+        response.event_type_ =
+            bluetooth::hci::AdvertisingEventType::ADV_SCAN_IND;
+        break;
+      case model::packets::LegacyAdvertisingType::ADV_NONCONN_IND:
+        response.event_type_ =
+            bluetooth::hci::AdvertisingEventType::ADV_NONCONN_IND;
+        break;
+    }
+
+    send_event_(
+        bluetooth::hci::LeAdvertisingReportRawBuilder::Create({response}));
+  }
+
+  // Extended scanning.
+  if (ExtendedAdvertising() && should_send_advertising_report &&
+      IsLeEventUnmasked(SubeventCode::EXTENDED_ADVERTISING_REPORT)) {
+    bluetooth::hci::LeExtendedAdvertisingResponseRaw response;
+    response.connectable_ = connectable_advertising;
+    response.scannable_ = scannable_advertising;
+    response.directed_ = directed_advertising;
+    response.scan_response_ = false;
+    response.legacy_ = true;
+    response.data_status_ = bluetooth::hci::DataStatus::COMPLETE;
+    response.address_type_ =
+        static_cast<bluetooth::hci::DirectAdvertisingAddressType>(
+            resolved_advertising_address.GetAddressType());
+    response.address_ = resolved_advertising_address.GetAddress();
+    response.primary_phy_ = bluetooth::hci::PrimaryPhyType::LE_1M;
+    response.secondary_phy_ = bluetooth::hci::SecondaryPhyType::NO_PACKETS;
+    response.advertising_sid_ = 0xff;  // Not ADI field provided.
+    response.tx_power_ = 0x7f;         // TX power information not available.
+    response.rssi_ = rssi;
+    response.periodic_advertising_interval_ = 0;  // No periodic advertising.
+    response.direct_address_type_ =
+        bluetooth::hci::DirectAdvertisingAddressType::NO_ADDRESS_PROVIDED;
+    response.direct_address_ = Address::kEmpty;
+    response.advertising_data_ = advertising_data;
+
+    send_event_(bluetooth::hci::LeExtendedAdvertisingReportRawBuilder::Create(
+        {response}));
+  }
+
+  // Did the user enable Active scanning ?
+  bool active_scanning =
+      (scanner_.le_1m_phy.enabled &&
+       scanner_.le_1m_phy.scan_type == bluetooth::hci::LeScanType::ACTIVE) ||
+      (scanner_.le_coded_phy.enabled &&
+       scanner_.le_coded_phy.scan_type == bluetooth::hci::LeScanType::ACTIVE);
+
+  // Active scanning.
+  // Note: only send SCAN requests in response to scannable advertising
+  // events (ADV_IND, ADV_SCAN_IND).
+  if (!scannable_advertising) {
+    LOG_VERB(
+        "Not sending LE Scan request to advertising address %s(%hhx) because "
+        "it is not scannable",
+        advertising_address.ToString().c_str(),
+        advertising_address.GetAddressType());
+  } else if (!active_scanning) {
+    LOG_VERB(
+        "Not sending LE Scan request to advertising address %s(%hhx) because "
+        "the scanner is passive",
+        advertising_address.ToString().c_str(),
+        advertising_address.GetAddressType());
+  } else if (scanner_.pending_scan_request) {
+    LOG_VERB(
+        "Not sending LE Scan request to advertising address %s(%hhx) because "
+        "an LE Scan request is already pending",
+        advertising_address.ToString().c_str(),
+        advertising_address.GetAddressType());
+  } else if (!should_send_advertising_report) {
+    LOG_VERB(
+        "Not sending LE Scan request to advertising address %s(%hhx) because "
+        "the advertising message was filtered",
+        advertising_address.ToString().c_str(),
+        advertising_address.GetAddressType());
+  } else {
+    // TODO: apply privacy mode in resolving list.
+    // Scan requests with public or random device addresses must be ignored
+    // when the peer has network privacy mode.
+
+    AddressWithType public_address{address_,
+                                   AddressType::PUBLIC_DEVICE_ADDRESS};
+    AddressWithType random_address{random_address_,
+                                   AddressType::RANDOM_DEVICE_ADDRESS};
+    std::optional<AddressWithType> resolvable_scanning_address =
+        GenerateResolvablePrivateAddress(resolved_advertising_address,
+                                         IrkSelection::Local);
+
+    // The ScanA field of the scanning PDU is generated using the
+    // Resolving List’s Local IRK value and the Resolvable Private Address
+    // Generation procedure (see Section 1.3.2.2), or the address is provided
+    // by the Host.
+    AddressWithType scanning_address;
+    switch (scanner_.own_address_type) {
       case bluetooth::hci::OwnAddressType::PUBLIC_DEVICE_ADDRESS:
-        own_address = properties_.GetAddress();
+        scanning_address = public_address;
         break;
       case bluetooth::hci::OwnAddressType::RANDOM_DEVICE_ADDRESS:
-        own_address = properties_.GetLeAddress();
+        // The random address is checked in Le_Set_Scan_Enable or
+        // Le_Set_Extended_Scan_Enable.
+        ASSERT(random_address_ != Address::kEmpty);
+        scanning_address = random_address;
         break;
       case bluetooth::hci::OwnAddressType::RESOLVABLE_OR_PUBLIC_ADDRESS:
-        if (resolved) {
-          own_address = rpa;
-          le_connecting_rpa_ = rpa;
-        } else {
-          own_address = properties_.GetAddress();
-        }
+        scanning_address = resolvable_scanning_address.value_or(public_address);
         break;
       case bluetooth::hci::OwnAddressType::RESOLVABLE_OR_RANDOM_ADDRESS:
-        if (resolved) {
-          own_address = rpa;
-          le_connecting_rpa_ = rpa;
-        } else {
-          own_address = properties_.GetLeAddress();
+        // The random address is checked in Le_Set_Scan_Enable or
+        // Le_Set_Extended_Scan_Enable.
+        ASSERT(random_address_ != Address::kEmpty);
+        scanning_address = resolvable_scanning_address.value_or(random_address);
+        break;
+    }
+
+    // Save the original advertising type to report if the advertising
+    // is connectable in the scan response report.
+    scanner_.connectable_scan_response = connectable_advertising;
+    scanner_.pending_scan_request = advertising_address;
+
+    LOG_INFO(
+        "Sending LE Scan request to advertising address %s(%hhx) with scanning "
+        "address %s(%hhx)",
+        advertising_address.ToString().c_str(),
+        advertising_address.GetAddressType(),
+        scanning_address.ToString().c_str(), scanning_address.GetAddressType());
+
+    // The advertiser’s device address (AdvA field) in the scan request PDU
+    // shall be the same as the advertiser’s device address (AdvA field)
+    // received in the advertising PDU to which the scanner is responding.
+    SendLeLinkLayerPacket(model::packets::LeScanBuilder::Create(
+        scanning_address.GetAddress(), advertising_address.GetAddress(),
+        static_cast<model::packets::AddressType>(
+            scanning_address.GetAddressType()),
+        static_cast<model::packets::AddressType>(
+            advertising_address.GetAddressType())));
+  }
+}
+
+void LinkLayerController::ConnectIncomingLeLegacyAdvertisingPdu(
+    model::packets::LeLegacyAdvertisingPduView& pdu) {
+  if (!initiator_.IsEnabled()) {
+    return;
+  }
+
+  auto advertising_type = pdu.GetAdvertisingType();
+  bool connectable_advertising =
+      advertising_type == model::packets::LegacyAdvertisingType::ADV_IND ||
+      advertising_type == model::packets::LegacyAdvertisingType::ADV_DIRECT_IND;
+  bool directed_advertising =
+      advertising_type == model::packets::LegacyAdvertisingType::ADV_DIRECT_IND;
+
+  // Connection.
+  // Note: only send CONNECT requests in response to connectable advertising
+  // events (ADV_IND, ADV_DIRECT_IND).
+  if (!connectable_advertising) {
+    LOG_VERB(
+        "Legacy advertising ignored by initiator because it is not "
+        "connectable");
+    return;
+  }
+  if (initiator_.pending_connect_request) {
+    LOG_VERB(
+        "Legacy advertising ignored because an LE Connect request is already "
+        "pending");
+    return;
+  }
+
+  AddressWithType advertising_address{
+      pdu.GetSourceAddress(),
+      static_cast<AddressType>(pdu.GetAdvertisingAddressType())};
+
+  AddressWithType target_address{
+      pdu.GetDestinationAddress(),
+      static_cast<AddressType>(pdu.GetTargetAddressType())};
+
+  AddressWithType resolved_advertising_address =
+      ResolvePrivateAddress(advertising_address, IrkSelection::Peer)
+          .value_or(advertising_address);
+
+  AddressWithType resolved_target_address =
+      ResolvePrivateAddress(target_address, IrkSelection::Peer)
+          .value_or(target_address);
+
+  // Vol 6, Part B § 4.3.5 Initiator filter policy.
+  switch (initiator_.initiator_filter_policy) {
+    case bluetooth::hci::InitiatorFilterPolicy::USE_PEER_ADDRESS:
+      if (resolved_advertising_address != initiator_.peer_address) {
+        LOG_VERB(
+            "Legacy advertising ignored by initiator because the "
+            "advertising address %s does not match the peer address %s",
+            resolved_advertising_address.ToString().c_str(),
+            initiator_.peer_address.ToString().c_str());
+        return;
+      }
+      break;
+    case bluetooth::hci::InitiatorFilterPolicy::USE_FILTER_ACCEPT_LIST:
+      if (!LeFilterAcceptListContainsDevice(resolved_advertising_address)) {
+        LOG_VERB(
+            "Legacy advertising ignored by initiator because the "
+            "advertising address %s is not in the filter accept list",
+            resolved_advertising_address.ToString().c_str());
+        return;
+      }
+      break;
+  }
+
+  // When an initiator receives a directed connectable advertising event that
+  // contains a resolvable private address for the target’s address
+  // (TargetA field) and address resolution is enabled, the Link Layer shall
+  // resolve the private address using the resolving list’s Local IRK values.
+  // An initiator that has been instructed by the Host to use Resolvable Private
+  // Addresses shall not respond to directed connectable advertising events that
+  // contain Public or Static addresses for the target’s address (TargetA
+  // field).
+  if (directed_advertising) {
+    if (!IsLocalPublicOrRandomAddress(resolved_target_address)) {
+      LOG_VERB(
+          "Directed legacy advertising ignored by initiator because the "
+          "target address %s does not match the current device addresses",
+          resolved_advertising_address.ToString().c_str());
+      return;
+    }
+    if (resolved_target_address == target_address &&
+        (initiator_.own_address_type ==
+             OwnAddressType::RESOLVABLE_OR_PUBLIC_ADDRESS ||
+         initiator_.own_address_type ==
+             OwnAddressType::RESOLVABLE_OR_RANDOM_ADDRESS)) {
+      LOG_VERB(
+          "Directed legacy advertising ignored by initiator because the "
+          "target address %s is static or public and the initiator is "
+          "configured to use resolvable addresses",
+          resolved_advertising_address.ToString().c_str());
+      return;
+    }
+  }
+
+  AddressWithType public_address{address_, AddressType::PUBLIC_DEVICE_ADDRESS};
+  AddressWithType random_address{random_address_,
+                                 AddressType::RANDOM_DEVICE_ADDRESS};
+  std::optional<AddressWithType> resolvable_initiating_address =
+      GenerateResolvablePrivateAddress(resolved_advertising_address,
+                                       IrkSelection::Local);
+
+  // The Link Layer shall use resolvable private addresses for the initiator’s
+  // device address (InitA field) when initiating connection establishment with
+  // an associated device that exists in the Resolving List.
+  AddressWithType initiating_address;
+  switch (initiator_.own_address_type) {
+    case bluetooth::hci::OwnAddressType::PUBLIC_DEVICE_ADDRESS:
+      initiating_address = public_address;
+      break;
+    case bluetooth::hci::OwnAddressType::RANDOM_DEVICE_ADDRESS:
+      // The random address is checked in Le_Create_Connection or
+      // Le_Extended_Create_Connection.
+      ASSERT(random_address_ != Address::kEmpty);
+      initiating_address = random_address;
+      break;
+    case bluetooth::hci::OwnAddressType::RESOLVABLE_OR_PUBLIC_ADDRESS:
+      initiating_address =
+          resolvable_initiating_address.value_or(public_address);
+      break;
+    case bluetooth::hci::OwnAddressType::RESOLVABLE_OR_RANDOM_ADDRESS:
+      // The random address is checked in Le_Create_Connection or
+      // Le_Extended_Create_Connection.
+      ASSERT(random_address_ != Address::kEmpty);
+      initiating_address =
+          resolvable_initiating_address.value_or(random_address);
+      break;
+  }
+
+  if (!connections_.CreatePendingLeConnection(
+          advertising_address,
+          resolved_advertising_address != advertising_address
+              ? resolved_advertising_address
+              : AddressWithType{},
+          initiating_address)) {
+    LOG_WARN("CreatePendingLeConnection failed for connection to %s",
+             advertising_address.ToString().c_str());
+  }
+
+  initiator_.pending_connect_request = advertising_address;
+
+  LOG_INFO("Sending LE Connect request to %s with initiating address %s",
+           resolved_advertising_address.ToString().c_str(),
+           initiating_address.ToString().c_str());
+
+  // The advertiser’s device address (AdvA field) in the initiating PDU
+  // shall be the same as the advertiser’s device address (AdvA field)
+  // received in the advertising event PDU to which the initiator is
+  // responding.
+  SendLeLinkLayerPacket(model::packets::LeConnectBuilder::Create(
+      initiating_address.GetAddress(), advertising_address.GetAddress(),
+      static_cast<model::packets::AddressType>(
+          initiating_address.GetAddressType()),
+      static_cast<model::packets::AddressType>(
+          advertising_address.GetAddressType()),
+      initiator_.le_1m_phy.connection_interval_min,
+      initiator_.le_1m_phy.connection_interval_max,
+      initiator_.le_1m_phy.max_latency,
+      initiator_.le_1m_phy.supervision_timeout));
+}
+
+void LinkLayerController::IncomingLeLegacyAdvertisingPdu(
+    model::packets::LinkLayerPacketView incoming, uint8_t rssi) {
+  auto pdu = model::packets::LeLegacyAdvertisingPduView::Create(incoming);
+  ASSERT(pdu.IsValid());
+
+  ScanIncomingLeLegacyAdvertisingPdu(pdu, rssi);
+  ConnectIncomingLeLegacyAdvertisingPdu(pdu);
+}
+
+// Handle legacy advertising PDUs while in the Scanning state.
+void LinkLayerController::ScanIncomingLeExtendedAdvertisingPdu(
+    model::packets::LeExtendedAdvertisingPduView& pdu, uint8_t rssi) {
+  if (!scanner_.IsEnabled()) {
+    return;
+  }
+  if (!ExtendedAdvertising()) {
+    LOG_VERB("Extended advertising ignored because the scanner is legacy");
+    return;
+  }
+
+  std::vector<uint8_t> advertising_data = pdu.GetAdvertisingData();
+  AddressWithType advertising_address{
+      pdu.GetSourceAddress(),
+      static_cast<AddressType>(pdu.GetAdvertisingAddressType())};
+
+  AddressWithType target_address{
+      pdu.GetDestinationAddress(),
+      static_cast<AddressType>(pdu.GetTargetAddressType())};
+
+  bool scannable_advertising = pdu.GetScannable();
+  bool connectable_advertising = pdu.GetConnectable();
+  bool directed_advertising = pdu.GetDirected();
+
+  // TODO: check originating PHY, compare against active scanning PHYs
+  // (scanner_.le_1m_phy or scanner_.le_coded_phy).
+
+  // When a scanner receives an advertising packet that contains a resolvable
+  // private address for the advertiser’s device address (AdvA field) and
+  // address resolution is enabled, the Link Layer shall resolve the private
+  // address. The scanner’s filter policy shall then determine if the scanner
+  // responds with a scan request.
+  AddressWithType resolved_advertising_address =
+      ResolvePrivateAddress(advertising_address, IrkSelection::Peer)
+          .value_or(advertising_address);
+
+  std::optional<AddressWithType> resolved_target_address =
+      ResolvePrivateAddress(target_address, IrkSelection::Peer);
+
+  if (resolved_advertising_address != advertising_address) {
+    LOG_VERB("Resolved the advertising address %s(%hhx) to %s(%hhx)",
+             advertising_address.ToString().c_str(),
+             advertising_address.GetAddressType(),
+             resolved_advertising_address.ToString().c_str(),
+             resolved_advertising_address.GetAddressType());
+  }
+
+  // Vol 6, Part B § 4.3.3 Scanner filter policy
+  switch (scanner_.scan_filter_policy) {
+    case bluetooth::hci::LeScanningFilterPolicy::ACCEPT_ALL:
+    case bluetooth::hci::LeScanningFilterPolicy::CHECK_INITIATORS_IDENTITY:
+      break;
+    case bluetooth::hci::LeScanningFilterPolicy::FILTER_ACCEPT_LIST_ONLY:
+    case bluetooth::hci::LeScanningFilterPolicy::
+        FILTER_ACCEPT_LIST_AND_INITIATORS_IDENTITY:
+      if (!LeFilterAcceptListContainsDevice(resolved_advertising_address)) {
+        LOG_VERB(
+            "Extended advertising ignored by scanner because the advertising "
+            "address %s(%hhx) is not in the filter accept list",
+            resolved_advertising_address.ToString().c_str(),
+            resolved_advertising_address.GetAddressType());
+        return;
+      }
+      break;
+  }
+
+  if (directed_advertising) {
+    switch (scanner_.scan_filter_policy) {
+      // In both basic scanner filter policy modes, a directed advertising PDU
+      // shall be ignored unless either:
+      //  • the TargetA field is identical to the scanner's device address, or
+      //  • the TargetA field is a resolvable private address, address
+      //    resolution is enabled, and the address is resolved successfully
+      case bluetooth::hci::LeScanningFilterPolicy::ACCEPT_ALL:
+      case bluetooth::hci::LeScanningFilterPolicy::FILTER_ACCEPT_LIST_ONLY:
+        if (!IsLocalPublicOrRandomAddress(target_address) &&
+            !(target_address.IsRpa() && resolved_target_address)) {
+          LOG_VERB(
+              "Extended advertising ignored by scanner because the directed "
+              "address %s(%hhx) does not match the current device or cannot be "
+              "resolved",
+              target_address.ToString().c_str(),
+              target_address.GetAddressType());
+          return;
+        }
+        break;
+      // These are identical to the basic modes except
+      // that a directed advertising PDU shall be ignored unless either:
+      //  • the TargetA field is identical to the scanner's device address, or
+      //  • the TargetA field is a resolvable private address.
+      case bluetooth::hci::LeScanningFilterPolicy::CHECK_INITIATORS_IDENTITY:
+      case bluetooth::hci::LeScanningFilterPolicy::
+          FILTER_ACCEPT_LIST_AND_INITIATORS_IDENTITY:
+        if (!IsLocalPublicOrRandomAddress(target_address) &&
+            !target_address.IsRpa()) {
+          LOG_VERB(
+              "Extended advertising ignored by scanner because the directed "
+              "address %s(%hhx) does not match the current device or is not a "
+              "resovable private address",
+              target_address.ToString().c_str(),
+              target_address.GetAddressType());
+          return;
         }
         break;
     }
-    LOG_INFO("Connecting to %s (type %hhx) own_address %s (type %hhx)",
-             incoming.GetSourceAddress().ToString().c_str(), address_type,
-             own_address.ToString().c_str(), le_address_type_);
-    le_connect_ = false;
-    le_scan_enable_ = bluetooth::hci::OpCode::NONE;
-
-    if (!connections_.CreatePendingLeConnection(
-            AddressWithType(
-                incoming.GetSourceAddress(),
-                static_cast<bluetooth::hci::AddressType>(address_type)),
-            AddressWithType(resolved_address, resolved_address_type),
-            AddressWithType(
-                own_address,
-                static_cast<bluetooth::hci::AddressType>(own_address_type)))) {
-      LOG_WARN(
-          "CreatePendingLeConnection failed for connection to %s (type %hhx)",
-          incoming.GetSourceAddress().ToString().c_str(), address_type);
-    }
-    SendLeLinkLayerPacket(model::packets::LeConnectBuilder::Create(
-        own_address, incoming.GetSourceAddress(), le_connection_interval_min_,
-        le_connection_interval_max_, le_connection_latency_,
-        le_connection_supervision_timeout_,
-        static_cast<uint8_t>(le_address_type_)));
   }
+
+  bool should_send_advertising_report = true;
+  if (scanner_.filter_duplicates !=
+      bluetooth::hci::FilterDuplicates::DISABLED) {
+    if (scanner_.IsPacketInHistory(pdu)) {
+      should_send_advertising_report = false;
+    } else {
+      scanner_.AddPacketToHistory(pdu);
+    }
+  }
+
+  if (should_send_advertising_report &&
+      IsLeEventUnmasked(SubeventCode::EXTENDED_ADVERTISING_REPORT)) {
+    bluetooth::hci::LeExtendedAdvertisingResponseRaw response;
+    response.connectable_ = connectable_advertising;
+    response.scannable_ = scannable_advertising;
+    response.directed_ = directed_advertising;
+    response.scan_response_ = false;
+    response.legacy_ = false;
+    response.data_status_ = bluetooth::hci::DataStatus::COMPLETE;
+    response.address_type_ =
+        static_cast<bluetooth::hci::DirectAdvertisingAddressType>(
+            resolved_advertising_address.GetAddressType());
+    response.address_ = resolved_advertising_address.GetAddress();
+    response.primary_phy_ = bluetooth::hci::PrimaryPhyType::LE_1M;
+    response.secondary_phy_ = bluetooth::hci::SecondaryPhyType::NO_PACKETS;
+    response.advertising_sid_ = 0xff;  // Not ADI field provided.
+    response.tx_power_ = 0x7f;         // TX power information not available.
+    response.rssi_ = rssi;
+    response.periodic_advertising_interval_ = 0;  // No periodic advertising.
+    response.direct_address_type_ =
+        bluetooth::hci::DirectAdvertisingAddressType::NO_ADDRESS_PROVIDED;
+    response.direct_address_ = Address::kEmpty;
+    response.advertising_data_ = advertising_data;
+
+    send_event_(bluetooth::hci::LeExtendedAdvertisingReportRawBuilder::Create(
+        {response}));
+  }
+
+  // Did the user enable Active scanning ?
+  bool active_scanning =
+      (scanner_.le_1m_phy.enabled &&
+       scanner_.le_1m_phy.scan_type == bluetooth::hci::LeScanType::ACTIVE) ||
+      (scanner_.le_coded_phy.enabled &&
+       scanner_.le_coded_phy.scan_type == bluetooth::hci::LeScanType::ACTIVE);
+
+  // Active scanning.
+  // Note: only send SCAN requests in response to scannable advertising
+  // events (ADV_IND, ADV_SCAN_IND).
+  if (!scannable_advertising) {
+    LOG_VERB(
+        "Not sending LE Scan request to advertising address %s(%hhx) because "
+        "it is not scannable",
+        advertising_address.ToString().c_str(),
+        advertising_address.GetAddressType());
+  } else if (!active_scanning) {
+    LOG_VERB(
+        "Not sending LE Scan request to advertising address %s(%hhx) because "
+        "the scanner is passive",
+        advertising_address.ToString().c_str(),
+        advertising_address.GetAddressType());
+  } else if (scanner_.pending_scan_request) {
+    LOG_VERB(
+        "Not sending LE Scan request to advertising address %s(%hhx) because "
+        "an LE Scan request is already pending",
+        advertising_address.ToString().c_str(),
+        advertising_address.GetAddressType());
+  } else if (!should_send_advertising_report) {
+    LOG_VERB(
+        "Not sending LE Scan request to advertising address %s(%hhx) because "
+        "the advertising message was filtered",
+        advertising_address.ToString().c_str(),
+        advertising_address.GetAddressType());
+  } else {
+    // TODO: apply privacy mode in resolving list.
+    // Scan requests with public or random device addresses must be ignored
+    // when the peer has network privacy mode.
+
+    AddressWithType public_address{address_,
+                                   AddressType::PUBLIC_DEVICE_ADDRESS};
+    AddressWithType random_address{random_address_,
+                                   AddressType::RANDOM_DEVICE_ADDRESS};
+    std::optional<AddressWithType> resolvable_address =
+        GenerateResolvablePrivateAddress(resolved_advertising_address,
+                                         IrkSelection::Local);
+
+    // The ScanA field of the scanning PDU is generated using the
+    // Resolving List’s Local IRK value and the Resolvable Private Address
+    // Generation procedure (see Section 1.3.2.2), or the address is provided
+    // by the Host.
+    AddressWithType scanning_address;
+    std::optional<AddressWithType> resolvable_scanning_address;
+    switch (scanner_.own_address_type) {
+      case bluetooth::hci::OwnAddressType::PUBLIC_DEVICE_ADDRESS:
+        scanning_address = public_address;
+        break;
+      case bluetooth::hci::OwnAddressType::RANDOM_DEVICE_ADDRESS:
+        // The random address is checked in Le_Set_Scan_Enable or
+        // Le_Set_Extended_Scan_Enable.
+        ASSERT(random_address_ != Address::kEmpty);
+        scanning_address = random_address;
+        break;
+      case bluetooth::hci::OwnAddressType::RESOLVABLE_OR_PUBLIC_ADDRESS:
+        scanning_address = resolvable_address.value_or(public_address);
+        break;
+      case bluetooth::hci::OwnAddressType::RESOLVABLE_OR_RANDOM_ADDRESS:
+        // The random address is checked in Le_Set_Scan_Enable or
+        // Le_Set_Extended_Scan_Enable.
+        ASSERT(random_address_ != Address::kEmpty);
+        scanning_address = resolvable_address.value_or(random_address);
+        break;
+    }
+
+    // Save the original advertising type to report if the advertising
+    // is connectable in the scan response report.
+    scanner_.connectable_scan_response = connectable_advertising;
+    scanner_.pending_scan_request = advertising_address;
+
+    LOG_INFO(
+        "Sending LE Scan request to advertising address %s(%hhx) with scanning "
+        "address %s(%hhx)",
+        advertising_address.ToString().c_str(),
+        advertising_address.GetAddressType(),
+        scanning_address.ToString().c_str(), scanning_address.GetAddressType());
+
+    // The advertiser’s device address (AdvA field) in the scan request PDU
+    // shall be the same as the advertiser’s device address (AdvA field)
+    // received in the advertising PDU to which the scanner is responding.
+    SendLeLinkLayerPacket(model::packets::LeScanBuilder::Create(
+        scanning_address.GetAddress(), advertising_address.GetAddress(),
+        static_cast<model::packets::AddressType>(
+            scanning_address.GetAddressType()),
+        static_cast<model::packets::AddressType>(
+            advertising_address.GetAddressType())));
+  }
+}
+
+void LinkLayerController::ConnectIncomingLeExtendedAdvertisingPdu(
+    model::packets::LeExtendedAdvertisingPduView& pdu) {
+  if (!initiator_.IsEnabled()) {
+    return;
+  }
+  if (!ExtendedAdvertising()) {
+    LOG_VERB("Extended advertising ignored because the initiator is legacy");
+    return;
+  }
+
+  // Connection.
+  // Note: only send CONNECT requests in response to connectable advertising
+  // events (ADV_IND, ADV_DIRECT_IND).
+  if (!pdu.GetConnectable()) {
+    LOG_VERB(
+        "Extended advertising ignored by initiator because it is not "
+        "connectable");
+    return;
+  }
+  if (initiator_.pending_connect_request) {
+    LOG_VERB(
+        "Extended advertising ignored because an LE Connect request is already "
+        "pending");
+    return;
+  }
+
+  AddressWithType advertising_address{
+      pdu.GetSourceAddress(),
+      static_cast<AddressType>(pdu.GetAdvertisingAddressType())};
+
+  AddressWithType target_address{
+      pdu.GetDestinationAddress(),
+      static_cast<AddressType>(pdu.GetTargetAddressType())};
+
+  AddressWithType resolved_advertising_address =
+      ResolvePrivateAddress(advertising_address, IrkSelection::Peer)
+          .value_or(advertising_address);
+
+  AddressWithType resolved_target_address =
+      ResolvePrivateAddress(target_address, IrkSelection::Peer)
+          .value_or(target_address);
+
+  // Vol 6, Part B § 4.3.5 Initiator filter policy.
+  switch (initiator_.initiator_filter_policy) {
+    case bluetooth::hci::InitiatorFilterPolicy::USE_PEER_ADDRESS:
+      if (resolved_advertising_address != initiator_.peer_address) {
+        LOG_VERB(
+            "Extended advertising ignored by initiator because the "
+            "advertising address %s does not match the peer address %s",
+            resolved_advertising_address.ToString().c_str(),
+            initiator_.peer_address.ToString().c_str());
+        return;
+      }
+      break;
+    case bluetooth::hci::InitiatorFilterPolicy::USE_FILTER_ACCEPT_LIST:
+      if (!LeFilterAcceptListContainsDevice(resolved_advertising_address)) {
+        LOG_VERB(
+            "Extended advertising ignored by initiator because the "
+            "advertising address %s is not in the filter accept list",
+            resolved_advertising_address.ToString().c_str());
+        return;
+      }
+      break;
+  }
+
+  // When an initiator receives a directed connectable advertising event that
+  // contains a resolvable private address for the target’s address
+  // (TargetA field) and address resolution is enabled, the Link Layer shall
+  // resolve the private address using the resolving list’s Local IRK values.
+  // An initiator that has been instructed by the Host to use Resolvable Private
+  // Addresses shall not respond to directed connectable advertising events that
+  // contain Public or Static addresses for the target’s address (TargetA
+  // field).
+  if (pdu.GetDirected()) {
+    if (!IsLocalPublicOrRandomAddress(resolved_target_address)) {
+      LOG_VERB(
+          "Directed extended advertising ignored by initiator because the "
+          "target address %s does not match the current device addresses",
+          resolved_advertising_address.ToString().c_str());
+      return;
+    }
+    if (resolved_target_address == target_address &&
+        (initiator_.own_address_type ==
+             OwnAddressType::RESOLVABLE_OR_PUBLIC_ADDRESS ||
+         initiator_.own_address_type ==
+             OwnAddressType::RESOLVABLE_OR_RANDOM_ADDRESS)) {
+      LOG_VERB(
+          "Directed extended advertising ignored by initiator because the "
+          "target address %s is static or public and the initiator is "
+          "configured to use resolvable addresses",
+          resolved_advertising_address.ToString().c_str());
+      return;
+    }
+  }
+
+  AddressWithType public_address{address_, AddressType::PUBLIC_DEVICE_ADDRESS};
+  AddressWithType random_address{random_address_,
+                                 AddressType::RANDOM_DEVICE_ADDRESS};
+  std::optional<AddressWithType> resolvable_initiating_address =
+      GenerateResolvablePrivateAddress(resolved_advertising_address,
+                                       IrkSelection::Local);
+
+  // The Link Layer shall use resolvable private addresses for the initiator’s
+  // device address (InitA field) when initiating connection establishment with
+  // an associated device that exists in the Resolving List.
+  AddressWithType initiating_address;
+  switch (initiator_.own_address_type) {
+    case bluetooth::hci::OwnAddressType::PUBLIC_DEVICE_ADDRESS:
+      initiating_address = public_address;
+      break;
+    case bluetooth::hci::OwnAddressType::RANDOM_DEVICE_ADDRESS:
+      // The random address is checked in Le_Create_Connection or
+      // Le_Extended_Create_Connection.
+      ASSERT(random_address_ != Address::kEmpty);
+      initiating_address = random_address;
+      break;
+    case bluetooth::hci::OwnAddressType::RESOLVABLE_OR_PUBLIC_ADDRESS:
+      initiating_address =
+          resolvable_initiating_address.value_or(public_address);
+      break;
+    case bluetooth::hci::OwnAddressType::RESOLVABLE_OR_RANDOM_ADDRESS:
+      // The random address is checked in Le_Create_Connection or
+      // Le_Extended_Create_Connection.
+      ASSERT(random_address_ != Address::kEmpty);
+      initiating_address =
+          resolvable_initiating_address.value_or(random_address);
+      break;
+  }
+
+  if (!connections_.CreatePendingLeConnection(
+          advertising_address,
+          resolved_advertising_address != advertising_address
+              ? resolved_advertising_address
+              : AddressWithType{},
+          initiating_address)) {
+    LOG_WARN("CreatePendingLeConnection failed for connection to %s",
+             advertising_address.ToString().c_str());
+  }
+
+  initiator_.pending_connect_request = advertising_address;
+
+  LOG_INFO("Sending LE Connect request to %s with initiating address %s",
+           resolved_advertising_address.ToString().c_str(),
+           initiating_address.ToString().c_str());
+
+  // The advertiser’s device address (AdvA field) in the initiating PDU
+  // shall be the same as the advertiser’s device address (AdvA field)
+  // received in the advertising event PDU to which the initiator is
+  // responding.
+  SendLeLinkLayerPacket(model::packets::LeConnectBuilder::Create(
+      initiating_address.GetAddress(), advertising_address.GetAddress(),
+      static_cast<model::packets::AddressType>(
+          initiating_address.GetAddressType()),
+      static_cast<model::packets::AddressType>(
+          advertising_address.GetAddressType()),
+      initiator_.le_1m_phy.connection_interval_min,
+      initiator_.le_1m_phy.connection_interval_max,
+      initiator_.le_1m_phy.max_latency,
+      initiator_.le_1m_phy.supervision_timeout));
+}
+
+void LinkLayerController::IncomingLeExtendedAdvertisingPdu(
+    model::packets::LinkLayerPacketView incoming, uint8_t rssi) {
+  auto pdu = model::packets::LeExtendedAdvertisingPduView::Create(incoming);
+  ASSERT(pdu.IsValid());
+
+  ScanIncomingLeExtendedAdvertisingPdu(pdu, rssi);
+  ConnectIncomingLeExtendedAdvertisingPdu(pdu);
 }
 
 void LinkLayerController::IncomingScoConnectionRequest(
@@ -1456,7 +3571,7 @@
         address.ToString().c_str());
 
     SendLinkLayerPacket(model::packets::ScoConnectionResponseBuilder::Create(
-        properties_.GetAddress(), address,
+        GetAddress(), address,
         (uint8_t)ErrorCode::SYNCHRONOUS_CONNECTION_LIMIT_EXCEEDED, 0, 0, 0, 0,
         0, 0));
     return;
@@ -1472,11 +3587,12 @@
   connections_.CreateScoConnection(
       address, connection_parameters,
       extended ? ScoState::SCO_STATE_SENT_ESCO_CONNECTION_REQUEST
-               : ScoState::SCO_STATE_SENT_SCO_CONNECTION_REQUEST);
+               : ScoState::SCO_STATE_SENT_SCO_CONNECTION_REQUEST,
+      ScoDatapath::NORMAL);
 
   // Send connection request event and wait for Accept or Reject command.
   send_event_(bluetooth::hci::ConnectionRequestBuilder::Create(
-      address, ClassOfDevice(),
+      address, request.GetClassOfDevice(),
       extended ? bluetooth::hci::ConnectionRequestLinkType::ESCO
                : bluetooth::hci::ConnectionRequestLinkType::SCO));
 }
@@ -1503,7 +3619,12 @@
         response.GetAirMode(),
         extended,
     };
-    connections_.AcceptPendingScoConnection(address, link_parameters);
+
+    connections_.AcceptPendingScoConnection(
+        address, link_parameters, [this, address] {
+          return LinkLayerController::StartScoStream(address);
+        });
+
     if (is_legacy) {
       send_event_(bluetooth::hci::ConnectionCompleteBuilder::Create(
           ErrorCode::SUCCESS, connections_.GetScoHandle(address), address,
@@ -1552,31 +3673,43 @@
       incoming.GetSourceAddress().ToString().c_str());
 
   if (handle != kReservedHandle) {
-    connections_.Disconnect(handle);
-    SendDisconnectionCompleteEvent(handle, reason);
+    connections_.Disconnect(handle, cancel_task_);
+    SendDisconnectionCompleteEvent(handle, ErrorCode(reason));
   }
 }
 
-uint16_t LinkLayerController::HandleLeConnection(AddressWithType address,
-                                                 AddressWithType own_address,
-                                                 uint8_t role,
-                                                 uint16_t connection_interval,
-                                                 uint16_t connection_latency,
-                                                 uint16_t supervision_timeout) {
+#ifdef ROOTCANAL_LMP
+void LinkLayerController::IncomingLmpPacket(
+    model::packets::LinkLayerPacketView incoming) {
+  Address address = incoming.GetSourceAddress();
+  auto request = model::packets::LmpView::Create(incoming);
+  ASSERT(request.IsValid());
+  auto payload = request.GetPayload();
+  auto packet = std::vector(payload.begin(), payload.end());
+
+  ASSERT(link_manager_ingest_lmp(
+      lm_.get(), reinterpret_cast<uint8_t(*)[6]>(address.data()), packet.data(),
+      packet.size()));
+}
+#endif /* ROOTCANAL_LMP */
+
+uint16_t LinkLayerController::HandleLeConnection(
+    AddressWithType address, AddressWithType own_address,
+    bluetooth::hci::Role role, uint16_t connection_interval,
+    uint16_t connection_latency, uint16_t supervision_timeout,
+    bool send_le_channel_selection_algorithm_event) {
   // Note: the HCI_LE_Connection_Complete event is not sent if the
   // HCI_LE_Enhanced_Connection_Complete event (see Section 7.7.65.10) is
   // unmasked.
 
-  uint16_t handle = connections_.CreateLeConnection(address, own_address);
+  uint16_t handle = connections_.CreateLeConnection(address, own_address, role);
   if (handle == kReservedHandle) {
     LOG_WARN("No pending connection for connection from %s",
              address.ToString().c_str());
     return kReservedHandle;
   }
 
-  if (properties_.IsUnmasked(EventCode::LE_META_EVENT) &&
-      properties_.GetLeEventSupported(
-          SubeventCode::ENHANCED_CONNECTION_COMPLETE)) {
+  if (IsLeEventUnmasked(SubeventCode::ENHANCED_CONNECTION_COMPLETE)) {
     AddressWithType peer_resolved_address =
         connections_.GetResolvedAddress(handle);
     Address peer_resolvable_private_address;
@@ -1598,102 +3731,322 @@
       connection_address = peer_resolved_address.GetAddress();
     }
     Address local_resolved_address = own_address.GetAddress();
-    if (local_resolved_address == properties_.GetAddress() ||
-        local_resolved_address == properties_.GetLeAddress()) {
+    if (local_resolved_address == GetAddress() ||
+        local_resolved_address == random_address_) {
       local_resolved_address = Address::kEmpty;
     }
 
     send_event_(bluetooth::hci::LeEnhancedConnectionCompleteBuilder::Create(
-        ErrorCode::SUCCESS, handle, static_cast<bluetooth::hci::Role>(role),
-        peer_address_type, connection_address, local_resolved_address,
-        peer_resolvable_private_address, connection_interval,
-        connection_latency, supervision_timeout,
+        ErrorCode::SUCCESS, handle, role, peer_address_type, connection_address,
+        local_resolved_address, peer_resolvable_private_address,
+        connection_interval, connection_latency, supervision_timeout,
         static_cast<bluetooth::hci::ClockAccuracy>(0x00)));
-  } else if (properties_.IsUnmasked(EventCode::LE_META_EVENT) &&
-             properties_.GetLeEventSupported(
-                 SubeventCode::CONNECTION_COMPLETE)) {
+  } else if (IsLeEventUnmasked(SubeventCode::CONNECTION_COMPLETE)) {
     send_event_(bluetooth::hci::LeConnectionCompleteBuilder::Create(
-        ErrorCode::SUCCESS, handle, static_cast<bluetooth::hci::Role>(role),
-        address.GetAddressType(), address.GetAddress(), connection_interval,
-        connection_latency, supervision_timeout,
-        static_cast<bluetooth::hci::ClockAccuracy>(0x00)));
+        ErrorCode::SUCCESS, handle, role, address.GetAddressType(),
+        address.GetAddress(), connection_interval, connection_latency,
+        supervision_timeout, static_cast<bluetooth::hci::ClockAccuracy>(0x00)));
   }
 
-  if (own_address.GetAddress() == le_connecting_rpa_) {
-    le_connecting_rpa_ = Address::kEmpty;
+  // Note: the HCI_LE_Connection_Complete event is immediately followed by
+  // an HCI_LE_Channel_Selection_Algorithm event if the connection is created
+  // using the LE_Extended_Create_Connection command (see Section 7.7.8.66).
+  if (send_le_channel_selection_algorithm_event &&
+      IsLeEventUnmasked(SubeventCode::CHANNEL_SELECTION_ALGORITHM)) {
+    // The selection channel algorithm probably will have no impact
+    // on emulation.
+    send_event_(bluetooth::hci::LeChannelSelectionAlgorithmBuilder::Create(
+        handle, bluetooth::hci::ChannelSelectionAlgorithm::ALGORITHM_1));
+  }
+
+  if (own_address.GetAddress() == initiator_.initiating_address) {
+    initiator_.initiating_address = Address::kEmpty;
   }
   return handle;
 }
 
-void LinkLayerController::IncomingLeConnectPacket(
-    model::packets::LinkLayerPacketView incoming) {
-  auto connect = model::packets::LeConnectView::Create(incoming);
-  ASSERT(connect.IsValid());
-  uint16_t connection_interval = (connect.GetLeConnectionIntervalMax() +
-                                  connect.GetLeConnectionIntervalMin()) /
-                                 2;
-  bluetooth::hci::AddressWithType my_address{};
-  bool matched_advertiser = false;
-  size_t set = 0;
-  for (size_t i = 0; i < advertisers_.size(); i++) {
-    AddressWithType advertiser_address = advertisers_[i].GetAddress();
-    if (incoming.GetDestinationAddress() == advertiser_address.GetAddress()) {
-      my_address = advertiser_address;
-      matched_advertiser = true;
-      set = i;
+// Handle CONNECT_IND PDUs for the legacy advertiser.
+bool LinkLayerController::ProcessIncomingLegacyConnectRequest(
+    model::packets::LeConnectView const& connect_ind) {
+  if (!legacy_advertiser_.IsEnabled()) {
+    return false;
+  }
+  if (!legacy_advertiser_.IsConnectable()) {
+    LOG_VERB(
+        "LE Connect request ignored by legacy advertiser because it is not "
+        "connectable");
+    return false;
+  }
+
+  AddressWithType advertising_address{
+      connect_ind.GetDestinationAddress(),
+      static_cast<AddressType>(connect_ind.GetAdvertisingAddressType()),
+  };
+
+  AddressWithType initiating_address{
+      connect_ind.GetSourceAddress(),
+      static_cast<AddressType>(connect_ind.GetInitiatingAddressType()),
+  };
+
+  if (legacy_advertiser_.GetAdvertisingAddress() != advertising_address) {
+    LOG_VERB(
+        "LE Connect request ignored by legacy advertiser because the "
+        "advertising address %s(%hhx) does not match %s(%hhx)",
+        advertising_address.ToString().c_str(),
+        advertising_address.GetAddressType(),
+        legacy_advertiser_.GetAdvertisingAddress().ToString().c_str(),
+        legacy_advertiser_.GetAdvertisingAddress().GetAddressType());
+    return false;
+  }
+
+  // When an advertiser receives a connection request that contains a resolvable
+  // private address for the initiator’s address (InitA field) and address
+  // resolution is enabled, the Link Layer shall resolve the private address.
+  // The advertising filter policy shall then determine if the
+  // advertiser establishes a connection.
+  AddressWithType resolved_initiating_address =
+      ResolvePrivateAddress(initiating_address, IrkSelection::Peer)
+          .value_or(initiating_address);
+
+  if (resolved_initiating_address != initiating_address) {
+    LOG_VERB("Resolved the initiating address %s(%hhx) to %s(%hhx)",
+             initiating_address.ToString().c_str(),
+             initiating_address.GetAddressType(),
+             resolved_initiating_address.ToString().c_str(),
+             resolved_initiating_address.GetAddressType());
+  }
+
+  // When the Link Layer is [...] connectable directed advertising events the
+  // advertising filter policy shall be ignored.
+  if (legacy_advertiser_.IsDirected()) {
+    if (legacy_advertiser_.GetTargetAddress() != resolved_initiating_address) {
+      LOG_VERB(
+          "LE Connect request ignored by legacy advertiser because the "
+          "initiating address %s(%hhx) does not match the target address "
+          "%s(%hhx)",
+          resolved_initiating_address.ToString().c_str(),
+          resolved_initiating_address.GetAddressType(),
+          legacy_advertiser_.GetTargetAddress().ToString().c_str(),
+          legacy_advertiser_.GetTargetAddress().GetAddressType());
+      return false;
+    }
+  } else {
+    // Check if initiator address is in the filter accept list
+    // for this advertiser.
+    switch (legacy_advertiser_.advertising_filter_policy) {
+      case bluetooth::hci::AdvertisingFilterPolicy::ALL_DEVICES:
+      case bluetooth::hci::AdvertisingFilterPolicy::LISTED_SCAN:
+        break;
+      case bluetooth::hci::AdvertisingFilterPolicy::LISTED_CONNECT:
+      case bluetooth::hci::AdvertisingFilterPolicy::LISTED_SCAN_AND_CONNECT:
+        if (!LeFilterAcceptListContainsDevice(resolved_initiating_address)) {
+          LOG_VERB(
+              "LE Connect request ignored by legacy advertiser because the "
+              "initiating address %s(%hhx) is not in the filter accept list",
+              resolved_initiating_address.ToString().c_str(),
+              resolved_initiating_address.GetAddressType());
+          return false;
+        }
+        break;
     }
   }
 
-  if (!matched_advertiser) {
-    LOG_INFO("Dropping unmatched connection request to %s",
-             incoming.GetSourceAddress().ToString().c_str());
-    return;
-  }
-
-  if (!advertisers_[set].IsConnectable()) {
-    LOG_INFO(
-        "Rejecting connection request from %s to non-connectable advertiser",
-        incoming.GetSourceAddress().ToString().c_str());
-    return;
-  }
-
-  // TODO: Implement for Directed Advertisements
-  AddressWithType peer_resolved_address;
+  LOG_INFO(
+      "Accepting LE Connect request to legacy advertiser from initiating "
+      "address %s(%hhx)",
+      resolved_initiating_address.ToString().c_str(),
+      resolved_initiating_address.GetAddressType());
 
   if (!connections_.CreatePendingLeConnection(
-          AddressWithType(incoming.GetSourceAddress(),
-                          static_cast<bluetooth::hci::AddressType>(
-                              connect.GetAddressType())),
-          peer_resolved_address, my_address)) {
+          initiating_address,
+          resolved_initiating_address != initiating_address
+              ? resolved_initiating_address
+              : AddressWithType{},
+          advertising_address)) {
     LOG_WARN(
-        "CreatePendingLeConnection failed for connection from %s (type "
-        "%hhx)",
-        incoming.GetSourceAddress().ToString().c_str(),
-        connect.GetAddressType());
-    return;
+        "CreatePendingLeConnection failed for connection from %s (type %hhx)",
+        initiating_address.GetAddress().ToString().c_str(),
+        initiating_address.GetAddressType());
+    return false;
   }
-  uint16_t handle = HandleLeConnection(
-      AddressWithType(
-          incoming.GetSourceAddress(),
-          static_cast<bluetooth::hci::AddressType>(connect.GetAddressType())),
-      my_address, static_cast<uint8_t>(bluetooth::hci::Role::PERIPHERAL),
-      connection_interval, connect.GetLeConnectionLatency(),
-      connect.GetLeConnectionSupervisionTimeout());
+
+  (void)HandleLeConnection(
+      initiating_address, advertising_address, bluetooth::hci::Role::PERIPHERAL,
+      connect_ind.GetLeConnectionIntervalMax(),
+      connect_ind.GetLeConnectionLatency(),
+      connect_ind.GetLeConnectionSupervisionTimeout(), false);
 
   SendLeLinkLayerPacket(model::packets::LeConnectCompleteBuilder::Create(
-      incoming.GetDestinationAddress(), incoming.GetSourceAddress(),
-      connection_interval, connect.GetLeConnectionLatency(),
-      connect.GetLeConnectionSupervisionTimeout(),
-      static_cast<uint8_t>(my_address.GetAddressType())));
+      advertising_address.GetAddress(), initiating_address.GetAddress(),
+      static_cast<model::packets::AddressType>(
+          initiating_address.GetAddressType()),
+      static_cast<model::packets::AddressType>(
+          advertising_address.GetAddressType()),
+      connect_ind.GetLeConnectionIntervalMax(),
+      connect_ind.GetLeConnectionLatency(),
+      connect_ind.GetLeConnectionSupervisionTimeout()));
 
-  advertisers_[set].Disable();
+  legacy_advertiser_.Disable();
+  return true;
+}
 
-  if (advertisers_[set].IsExtended()) {
-    uint8_t num_advertisements = advertisers_[set].GetNumAdvertisingEvents();
-    if (properties_.GetLeEventSupported(
-            bluetooth::hci::SubeventCode::ADVERTISING_SET_TERMINATED)) {
-      send_event_(bluetooth::hci::LeAdvertisingSetTerminatedBuilder::Create(
-          ErrorCode::SUCCESS, set, handle, num_advertisements));
+// Handle CONNECT_IND PDUs for the selected extended advertiser.
+bool LinkLayerController::ProcessIncomingExtendedConnectRequest(
+    ExtendedAdvertiser& advertiser,
+    model::packets::LeConnectView const& connect_ind) {
+  if (!advertiser.IsEnabled()) {
+    return false;
+  }
+  if (!advertiser.IsConnectable()) {
+    LOG_VERB(
+        "LE Connect request ignored by extended advertiser %d because it is "
+        "not connectable",
+        advertiser.advertising_handle);
+    return false;
+  }
+
+  AddressWithType advertising_address{
+      connect_ind.GetDestinationAddress(),
+      static_cast<AddressType>(connect_ind.GetAdvertisingAddressType()),
+  };
+
+  AddressWithType initiating_address{
+      connect_ind.GetSourceAddress(),
+      static_cast<AddressType>(connect_ind.GetInitiatingAddressType()),
+  };
+
+  if (advertiser.GetAdvertisingAddress() != advertising_address) {
+    LOG_VERB(
+        "LE Connect request ignored by extended advertiser %d because the "
+        "advertising address %s(%hhx) does not match %s(%hhx)",
+        advertiser.advertising_handle, advertising_address.ToString().c_str(),
+        advertising_address.GetAddressType(),
+        advertiser.GetAdvertisingAddress().ToString().c_str(),
+        advertiser.GetAdvertisingAddress().GetAddressType());
+    return false;
+  }
+
+  // When an advertiser receives a connection request that contains a resolvable
+  // private address for the initiator’s address (InitA field) and address
+  // resolution is enabled, the Link Layer shall resolve the private address.
+  // The advertising filter policy shall then determine if the
+  // advertiser establishes a connection.
+  AddressWithType resolved_initiating_address =
+      ResolvePrivateAddress(initiating_address, IrkSelection::Peer)
+          .value_or(initiating_address);
+
+  if (resolved_initiating_address != initiating_address) {
+    LOG_VERB("Resolved the initiating address %s(%hhx) to %s(%hhx)",
+             initiating_address.ToString().c_str(),
+             initiating_address.GetAddressType(),
+             resolved_initiating_address.ToString().c_str(),
+             resolved_initiating_address.GetAddressType());
+  }
+
+  // When the Link Layer is [...] connectable directed advertising events the
+  // advertising filter policy shall be ignored.
+  if (advertiser.IsDirected()) {
+    if (advertiser.GetTargetAddress() != resolved_initiating_address) {
+      LOG_VERB(
+          "LE Connect request ignored by extended advertiser %d because the "
+          "initiating address %s(%hhx) does not match the target address "
+          "%s(%hhx)",
+          advertiser.advertising_handle,
+          resolved_initiating_address.ToString().c_str(),
+          resolved_initiating_address.GetAddressType(),
+          advertiser.GetTargetAddress().ToString().c_str(),
+          advertiser.GetTargetAddress().GetAddressType());
+      return false;
+    }
+  } else {
+    // Check if initiator address is in the filter accept list
+    // for this advertiser.
+    switch (advertiser.advertising_filter_policy) {
+      case bluetooth::hci::AdvertisingFilterPolicy::ALL_DEVICES:
+      case bluetooth::hci::AdvertisingFilterPolicy::LISTED_SCAN:
+        break;
+      case bluetooth::hci::AdvertisingFilterPolicy::LISTED_CONNECT:
+      case bluetooth::hci::AdvertisingFilterPolicy::LISTED_SCAN_AND_CONNECT:
+        if (!LeFilterAcceptListContainsDevice(resolved_initiating_address)) {
+          LOG_VERB(
+              "LE Connect request ignored by extended advertiser %d because "
+              "the initiating address %s(%hhx) is not in the filter accept "
+              "list",
+              advertiser.advertising_handle,
+              resolved_initiating_address.ToString().c_str(),
+              resolved_initiating_address.GetAddressType());
+          return false;
+        }
+        break;
+    }
+  }
+
+  LOG_INFO(
+      "Accepting LE Connect request to extended advertiser %d from initiating "
+      "address %s(%hhx)",
+      advertiser.advertising_handle,
+      resolved_initiating_address.ToString().c_str(),
+      resolved_initiating_address.GetAddressType());
+
+  if (!connections_.CreatePendingLeConnection(
+          initiating_address,
+          resolved_initiating_address != initiating_address
+              ? resolved_initiating_address
+              : AddressWithType{},
+          advertising_address)) {
+    LOG_WARN(
+        "CreatePendingLeConnection failed for connection from %s (type %hhx)",
+        initiating_address.GetAddress().ToString().c_str(),
+        initiating_address.GetAddressType());
+    return false;
+  }
+
+  advertiser.Disable();
+
+  uint16_t connection_handle = HandleLeConnection(
+      initiating_address, advertising_address, bluetooth::hci::Role::PERIPHERAL,
+      connect_ind.GetLeConnectionIntervalMax(),
+      connect_ind.GetLeConnectionLatency(),
+      connect_ind.GetLeConnectionSupervisionTimeout(), false);
+
+  SendLeLinkLayerPacket(model::packets::LeConnectCompleteBuilder::Create(
+      advertising_address.GetAddress(), initiating_address.GetAddress(),
+      static_cast<model::packets::AddressType>(
+          initiating_address.GetAddressType()),
+      static_cast<model::packets::AddressType>(
+          advertising_address.GetAddressType()),
+      connect_ind.GetLeConnectionIntervalMax(),
+      connect_ind.GetLeConnectionLatency(),
+      connect_ind.GetLeConnectionSupervisionTimeout()));
+
+  // If the advertising set is connectable and a connection gets created, an
+  // HCI_LE_Connection_Complete or HCI_LE_Enhanced_Connection_Complete
+  // event shall be generated followed by an HCI_LE_Advertising_Set_Terminated
+  // event with the Status parameter set to 0x00. The Controller should not send
+  // any other events in between these two events
+
+  if (IsLeEventUnmasked(SubeventCode::ADVERTISING_SET_TERMINATED)) {
+    send_event_(bluetooth::hci::LeAdvertisingSetTerminatedBuilder::Create(
+        ErrorCode::SUCCESS, advertiser.advertising_handle, connection_handle,
+        advertiser.num_completed_extended_advertising_events));
+  }
+
+  return true;
+}
+
+void LinkLayerController::IncomingLeConnectPacket(
+    model::packets::LinkLayerPacketView incoming) {
+  model::packets::LeConnectView connect =
+      model::packets::LeConnectView::Create(incoming);
+  ASSERT(connect.IsValid());
+
+  if (ProcessIncomingLegacyConnectRequest(connect)) {
+    return;
+  }
+
+  for (auto& [_, advertiser] : extended_advertisers_) {
+    if (ProcessIncomingExtendedConnectRequest(advertiser, connect)) {
+      return;
     }
   }
 }
@@ -1702,16 +4055,27 @@
     model::packets::LinkLayerPacketView incoming) {
   auto complete = model::packets::LeConnectCompleteView::Create(incoming);
   ASSERT(complete.IsValid());
+
+  AddressWithType advertising_address{
+      incoming.GetSourceAddress(), static_cast<bluetooth::hci::AddressType>(
+                                       complete.GetAdvertisingAddressType())};
+
+  LOG_INFO(
+      "Received LE Connect complete response with advertising address %s(%hhx)",
+      advertising_address.ToString().c_str(),
+      advertising_address.GetAddressType());
+
   HandleLeConnection(
-      AddressWithType(
-          incoming.GetSourceAddress(),
-          static_cast<bluetooth::hci::AddressType>(complete.GetAddressType())),
-      AddressWithType(
-          incoming.GetDestinationAddress(),
-          static_cast<bluetooth::hci::AddressType>(le_address_type_)),
-      static_cast<uint8_t>(bluetooth::hci::Role::CENTRAL),
-      complete.GetLeConnectionInterval(), complete.GetLeConnectionLatency(),
-      complete.GetLeConnectionSupervisionTimeout());
+      advertising_address,
+      AddressWithType(incoming.GetDestinationAddress(),
+                      static_cast<bluetooth::hci::AddressType>(
+                          complete.GetInitiatingAddressType())),
+      bluetooth::hci::Role::CENTRAL, complete.GetLeConnectionInterval(),
+      complete.GetLeConnectionLatency(),
+      complete.GetLeConnectionSupervisionTimeout(), ExtendedAdvertising());
+
+  initiator_.pending_connect_request = {};
+  initiator_.Disable();
 }
 
 void LinkLayerController::IncomingLeConnectionParameterRequest(
@@ -1727,13 +4091,21 @@
              peer.ToString().c_str());
     return;
   }
-  if (properties_.IsUnmasked(EventCode::LE_META_EVENT) &&
-      properties_.GetLeEventSupported(
-          bluetooth::hci::SubeventCode::CONNECTION_UPDATE_COMPLETE)) {
+
+  if (IsLeEventUnmasked(SubeventCode::REMOTE_CONNECTION_PARAMETER_REQUEST)) {
     send_event_(
         bluetooth::hci::LeRemoteConnectionParameterRequestBuilder::Create(
             handle, request.GetIntervalMin(), request.GetIntervalMax(),
             request.GetLatency(), request.GetTimeout()));
+  } else {
+    // If the request is being indicated to the Host and the event to the Host
+    // is masked, then the Link Layer shall issue an LL_REJECT_EXT_IND PDU with
+    // the ErrorCode set to Unsupported Remote Feature (0x1A).
+    SendLeLinkLayerPacket(
+        model::packets::LeConnectionParameterUpdateBuilder::Create(
+            request.GetDestinationAddress(), request.GetSourceAddress(),
+            static_cast<uint8_t>(ErrorCode::UNSUPPORTED_REMOTE_OR_LMP_FEATURE),
+            0, 0, 0));
   }
 }
 
@@ -1750,9 +4122,7 @@
              peer.ToString().c_str());
     return;
   }
-  if (properties_.IsUnmasked(EventCode::LE_META_EVENT) &&
-      properties_.GetLeEventSupported(
-          bluetooth::hci::SubeventCode::CONNECTION_UPDATE_COMPLETE)) {
+  if (IsLeEventUnmasked(SubeventCode::CONNECTION_UPDATE_COMPLETE)) {
     send_event_(bluetooth::hci::LeConnectionUpdateCompleteBuilder::Create(
         static_cast<ErrorCode>(update.GetStatus()), handle,
         update.GetInterval(), update.GetLatency(), update.GetTimeout()));
@@ -1776,7 +4146,7 @@
 
   // TODO: Save keys to check
 
-  if (properties_.IsUnmasked(EventCode::LE_META_EVENT)) {
+  if (IsEventUnmasked(EventCode::LE_META_EVENT)) {
     send_event_(bluetooth::hci::LeLongTermKeyRequestBuilder::Create(
         handle, le_encrypt.GetRand(), le_encrypt.GetEdiv()));
   }
@@ -1805,13 +4175,13 @@
   }
 
   if (connections_.IsEncrypted(handle)) {
-    if (properties_.IsUnmasked(EventCode::ENCRYPTION_KEY_REFRESH_COMPLETE)) {
+    if (IsEventUnmasked(EventCode::ENCRYPTION_KEY_REFRESH_COMPLETE)) {
       send_event_(bluetooth::hci::EncryptionKeyRefreshCompleteBuilder::Create(
           status, handle));
     }
   } else {
     connections_.Encrypt(handle);
-    if (properties_.IsUnmasked(EventCode::ENCRYPTION_CHANGE)) {
+    if (IsEventUnmasked(EventCode::ENCRYPTION_CHANGE)) {
       send_event_(bluetooth::hci::EncryptionChangeBuilder::Create(
           status, handle, bluetooth::hci::EncryptionEnabled::ON));
     }
@@ -1831,7 +4201,7 @@
   SendLeLinkLayerPacket(
       model::packets::LeReadRemoteFeaturesResponseBuilder::Create(
           incoming.GetDestinationAddress(), incoming.GetSourceAddress(),
-          properties_.GetLeSupportedFeatures(), static_cast<uint8_t>(status)));
+          GetLeSupportedFeatures(), static_cast<uint8_t>(status)));
 }
 
 void LinkLayerController::IncomingLeReadRemoteFeaturesResponse(
@@ -1850,20 +4220,201 @@
   } else {
     status = static_cast<ErrorCode>(response.GetStatus());
   }
-  if (properties_.IsUnmasked(EventCode::LE_META_EVENT)) {
+  if (IsEventUnmasked(EventCode::LE_META_EVENT)) {
     send_event_(bluetooth::hci::LeReadRemoteFeaturesCompleteBuilder::Create(
         status, handle, response.GetFeatures()));
   }
 }
 
+void LinkLayerController::ProcessIncomingLegacyScanRequest(
+    AddressWithType scanning_address, AddressWithType resolved_scanning_address,
+    AddressWithType advertising_address) {
+  // Check if the advertising addresses matches the legacy
+  // advertising address.
+  if (!legacy_advertiser_.IsEnabled()) {
+    return;
+  }
+  if (!legacy_advertiser_.IsScannable()) {
+    LOG_VERB(
+        "LE Scan request ignored by legacy advertiser because it is not "
+        "scannable");
+    return;
+  }
+
+  if (advertising_address != legacy_advertiser_.advertising_address) {
+    LOG_VERB(
+        "LE Scan request ignored by legacy advertiser because the advertising "
+        "address %s(%hhx) does not match %s(%hhx)",
+        advertising_address.ToString().c_str(),
+        advertising_address.GetAddressType(),
+        legacy_advertiser_.GetAdvertisingAddress().ToString().c_str(),
+        legacy_advertiser_.GetAdvertisingAddress().GetAddressType());
+    return;
+  }
+
+  // Check if scanner address is in the filter accept list
+  // for this advertiser.
+  switch (legacy_advertiser_.advertising_filter_policy) {
+    case bluetooth::hci::AdvertisingFilterPolicy::ALL_DEVICES:
+    case bluetooth::hci::AdvertisingFilterPolicy::LISTED_CONNECT:
+      break;
+    case bluetooth::hci::AdvertisingFilterPolicy::LISTED_SCAN:
+    case bluetooth::hci::AdvertisingFilterPolicy::LISTED_SCAN_AND_CONNECT:
+      if (!LeFilterAcceptListContainsDevice(resolved_scanning_address)) {
+        LOG_VERB(
+            "LE Scan request ignored by legacy advertiser because the scanning "
+            "address %s(%hhx) is not in the filter accept list",
+            resolved_scanning_address.ToString().c_str(),
+            resolved_scanning_address.GetAddressType());
+        return;
+      }
+      break;
+  }
+
+  LOG_INFO(
+      "Accepting LE Scan request to legacy advertiser from scanning address "
+      "%s(%hhx)",
+      resolved_scanning_address.ToString().c_str(),
+      resolved_scanning_address.GetAddressType());
+
+  // Generate the SCAN_RSP packet.
+  // Note: If the advertiser processes the scan request, the advertiser’s
+  // device address (AdvA field) in the SCAN_RSP PDU shall be the same as
+  // the advertiser’s device address (AdvA field) in the SCAN_REQ PDU to
+  // which it is responding.
+  SendLeLinkLayerPacketWithRssi(
+      advertising_address.GetAddress(), scanning_address.GetAddress(),
+      properties_.le_advertising_physical_channel_tx_power,
+      model::packets::LeScanResponseBuilder::Create(
+          advertising_address.GetAddress(), scanning_address.GetAddress(),
+          static_cast<model::packets::AddressType>(
+              advertising_address.GetAddressType()),
+          legacy_advertiser_.scan_response_data));
+}
+
+void LinkLayerController::ProcessIncomingExtendedScanRequest(
+    ExtendedAdvertiser const& advertiser, AddressWithType scanning_address,
+    AddressWithType resolved_scanning_address,
+    AddressWithType advertising_address) {
+  // Check if the advertising addresses matches the legacy
+  // advertising address.
+  if (!advertiser.IsEnabled()) {
+    return;
+  }
+  if (!advertiser.IsScannable()) {
+    LOG_VERB(
+        "LE Scan request ignored by extended advertiser %d because it is not "
+        "scannable",
+        advertiser.advertising_handle);
+    return;
+  }
+
+  if (advertising_address != advertiser.advertising_address) {
+    LOG_VERB(
+        "LE Scan request ignored by extended advertiser %d because the "
+        "advertising address %s(%hhx) does not match %s(%hhx)",
+        advertiser.advertising_handle, advertising_address.ToString().c_str(),
+        advertising_address.GetAddressType(),
+        advertiser.GetAdvertisingAddress().ToString().c_str(),
+        advertiser.GetAdvertisingAddress().GetAddressType());
+    return;
+  }
+
+  // Check if scanner address is in the filter accept list
+  // for this advertiser.
+  switch (advertiser.advertising_filter_policy) {
+    case bluetooth::hci::AdvertisingFilterPolicy::ALL_DEVICES:
+    case bluetooth::hci::AdvertisingFilterPolicy::LISTED_CONNECT:
+      break;
+    case bluetooth::hci::AdvertisingFilterPolicy::LISTED_SCAN:
+    case bluetooth::hci::AdvertisingFilterPolicy::LISTED_SCAN_AND_CONNECT:
+      if (!LeFilterAcceptListContainsDevice(resolved_scanning_address)) {
+        LOG_VERB(
+            "LE Scan request ignored by extended advertiser %d because the "
+            "scanning address %s(%hhx) is not in the filter accept list",
+            advertiser.advertising_handle,
+            resolved_scanning_address.ToString().c_str(),
+            resolved_scanning_address.GetAddressType());
+        return;
+      }
+      break;
+  }
+
+  // Check if the scanner address is the target address in the case of
+  // scannable directed event types.
+  if (advertiser.IsDirected() &&
+      advertiser.target_address != resolved_scanning_address) {
+    LOG_VERB(
+        "LE Scan request ignored by extended advertiser %d because the "
+        "scanning address %s(%hhx) does not match the target address %s(%hhx)",
+        advertiser.advertising_handle,
+        resolved_scanning_address.ToString().c_str(),
+        resolved_scanning_address.GetAddressType(),
+        advertiser.GetTargetAddress().ToString().c_str(),
+        advertiser.GetTargetAddress().GetAddressType());
+    return;
+  }
+
+  LOG_INFO(
+      "Accepting LE Scan request to extended advertiser %d from scanning "
+      "address %s(%hhx)",
+      advertiser.advertising_handle,
+      resolved_scanning_address.ToString().c_str(),
+      resolved_scanning_address.GetAddressType());
+
+  // Generate the SCAN_RSP packet.
+  // Note: If the advertiser processes the scan request, the advertiser’s
+  // device address (AdvA field) in the SCAN_RSP PDU shall be the same as
+  // the advertiser’s device address (AdvA field) in the SCAN_REQ PDU to
+  // which it is responding.
+  SendLeLinkLayerPacketWithRssi(
+      advertising_address.GetAddress(), scanning_address.GetAddress(),
+      advertiser.advertising_tx_power,
+      model::packets::LeScanResponseBuilder::Create(
+          advertising_address.GetAddress(), scanning_address.GetAddress(),
+          static_cast<model::packets::AddressType>(
+              advertising_address.GetAddressType()),
+          advertiser.scan_response_data));
+}
+
 void LinkLayerController::IncomingLeScanPacket(
     model::packets::LinkLayerPacketView incoming) {
-  for (auto& advertiser : advertisers_) {
-    auto to_send = advertiser.GetScanResponse(incoming.GetDestinationAddress(),
-                                              incoming.GetSourceAddress());
-    if (to_send != nullptr) {
-      SendLeLinkLayerPacket(std::move(to_send));
-    }
+  auto scan_request = model::packets::LeScanView::Create(incoming);
+  ASSERT(scan_request.IsValid());
+
+  AddressWithType scanning_address{
+      scan_request.GetSourceAddress(),
+      static_cast<AddressType>(scan_request.GetScanningAddressType())};
+
+  AddressWithType advertising_address{
+      scan_request.GetDestinationAddress(),
+      static_cast<AddressType>(scan_request.GetAdvertisingAddressType())};
+
+  // Note: Vol 6, Part B § 6.2 Privacy in the Advertising State.
+  //
+  // When an advertiser receives a scan request that contains a resolvable
+  // private address for the scanner’s device address (ScanA field) and
+  // address resolution is enabled, the Link Layer shall resolve the private
+  // address. The advertising filter policy shall then determine if
+  // the advertiser processes the scan request.
+  AddressWithType resolved_scanning_address =
+      ResolvePrivateAddress(scanning_address, IrkSelection::Peer)
+          .value_or(scanning_address);
+
+  if (resolved_scanning_address != scanning_address) {
+    LOG_VERB("Resolved the scanning address %s(%hhx) to %s(%hhx)",
+             scanning_address.ToString().c_str(),
+             scanning_address.GetAddressType(),
+             resolved_scanning_address.ToString().c_str(),
+             resolved_scanning_address.GetAddressType());
+  }
+
+  ProcessIncomingLegacyScanRequest(scanning_address, resolved_scanning_address,
+                                   advertising_address);
+  for (auto& [_, advertiser] : extended_advertisers_) {
+    ProcessIncomingExtendedScanRequest(advertiser, scanning_address,
+                                       resolved_scanning_address,
+                                       advertising_address);
   }
 }
 
@@ -1871,51 +4422,144 @@
     model::packets::LinkLayerPacketView incoming, uint8_t rssi) {
   auto scan_response = model::packets::LeScanResponseView::Create(incoming);
   ASSERT(scan_response.IsValid());
-  vector<uint8_t> ad = scan_response.GetData();
-  auto adv_type = scan_response.GetAdvertisementType();
-  auto address_type = scan_response.GetAddressType();
-  if (le_scan_enable_ == bluetooth::hci::OpCode::LE_SET_SCAN_ENABLE) {
-    if (adv_type != model::packets::AdvertisementType::SCAN_RESPONSE) {
-      return;
-    }
-    bluetooth::hci::LeAdvertisingResponseRaw report;
-    report.event_type_ = bluetooth::hci::AdvertisingEventType::SCAN_RESPONSE;
-    report.address_ = incoming.GetSourceAddress();
-    report.address_type_ =
-        static_cast<bluetooth::hci::AddressType>(address_type);
-    report.advertising_data_ = scan_response.GetData();
-    report.rssi_ = rssi;
 
-    if (properties_.IsUnmasked(EventCode::LE_META_EVENT) &&
-        properties_.GetLeEventSupported(
-            bluetooth::hci::SubeventCode::ADVERTISING_REPORT)) {
-      send_event_(
-          bluetooth::hci::LeAdvertisingReportRawBuilder::Create({report}));
+  if (!scanner_.IsEnabled()) {
+    return;
+  }
+
+  if (!scanner_.pending_scan_request) {
+    LOG_VERB(
+        "LE Scan response ignored by scanner because no request is currently "
+        "pending");
+    return;
+  }
+
+  AddressWithType advertising_address{
+      scan_response.GetSourceAddress(),
+      static_cast<AddressType>(scan_response.GetAdvertisingAddressType())};
+
+  // If the advertiser processes the scan request, the advertiser’s device
+  // address (AdvA field) in the scan response PDU shall be the same as the
+  // advertiser’s device address (AdvA field) in the scan request PDU to which
+  // it is responding.
+  if (advertising_address != scanner_.pending_scan_request) {
+    LOG_VERB(
+        "LE Scan response ignored by scanner because the advertising address "
+        "%s(%hhx) does not match the pending request %s(%hhx)",
+        advertising_address.ToString().c_str(),
+        advertising_address.GetAddressType(),
+        scanner_.pending_scan_request.value().ToString().c_str(),
+        scanner_.pending_scan_request.value().GetAddressType());
+    return;
+  }
+
+  AddressWithType resolved_advertising_address =
+      ResolvePrivateAddress(advertising_address, IrkSelection::Peer)
+          .value_or(advertising_address);
+
+  if (advertising_address != resolved_advertising_address) {
+    LOG_VERB("Resolved the advertising address %s(%hhx) to %s(%hhx)",
+             advertising_address.ToString().c_str(),
+             advertising_address.GetAddressType(),
+             resolved_advertising_address.ToString().c_str(),
+             resolved_advertising_address.GetAddressType());
+    return;
+  }
+
+  LOG_INFO("Accepting LE Scan response from advertising address %s(%hhx)",
+           resolved_advertising_address.ToString().c_str(),
+           resolved_advertising_address.GetAddressType());
+
+  scanner_.pending_scan_request = {};
+
+  bool should_send_advertising_report = true;
+  if (scanner_.filter_duplicates !=
+      bluetooth::hci::FilterDuplicates::DISABLED) {
+    if (scanner_.IsPacketInHistory(incoming)) {
+      should_send_advertising_report = false;
+    } else {
+      scanner_.AddPacketToHistory(incoming);
     }
   }
 
-  if (le_scan_enable_ == bluetooth::hci::OpCode::LE_SET_EXTENDED_SCAN_ENABLE &&
-      properties_.IsUnmasked(EventCode::LE_META_EVENT) &&
-      properties_.GetLeEventSupported(
-          bluetooth::hci::SubeventCode::EXTENDED_ADVERTISING_REPORT)) {
-    bluetooth::hci::LeExtendedAdvertisingResponse report{};
-    report.address_ = incoming.GetSourceAddress();
-    report.address_type_ =
-        static_cast<bluetooth::hci::DirectAdvertisingAddressType>(address_type);
-    report.legacy_ = true;
-    report.scannable_ = true;
-    report.connectable_ = true;  // TODO: false if ADV_SCAN_IND
-    report.scan_response_ = true;
-    report.primary_phy_ = bluetooth::hci::PrimaryPhyType::LE_1M;
-    report.advertising_sid_ = 0xFF;
-    report.tx_power_ = 0x7F;
-    report.advertising_data_ = ad;
-    report.rssi_ = rssi;
+  if (LegacyAdvertising() && should_send_advertising_report &&
+      IsLeEventUnmasked(SubeventCode::ADVERTISING_REPORT)) {
+    bluetooth::hci::LeAdvertisingResponseRaw response;
+    response.event_type_ = bluetooth::hci::AdvertisingEventType::SCAN_RESPONSE;
+    response.address_ = resolved_advertising_address.GetAddress();
+    response.address_type_ = resolved_advertising_address.GetAddressType();
+    response.advertising_data_ = scan_response.GetScanResponseData();
+    response.rssi_ = rssi;
     send_event_(
-        bluetooth::hci::LeExtendedAdvertisingReportBuilder::Create({report}));
+        bluetooth::hci::LeAdvertisingReportRawBuilder::Create({response}));
+  }
+
+  if (ExtendedAdvertising() && should_send_advertising_report &&
+      IsLeEventUnmasked(SubeventCode::EXTENDED_ADVERTISING_REPORT)) {
+    bluetooth::hci::LeExtendedAdvertisingResponseRaw response;
+    response.address_ = resolved_advertising_address.GetAddress();
+    response.address_type_ =
+        static_cast<bluetooth::hci::DirectAdvertisingAddressType>(
+            resolved_advertising_address.GetAddressType());
+    response.connectable_ = scanner_.connectable_scan_response;
+    response.scannable_ = true;
+    response.legacy_ = true;
+    response.scan_response_ = true;
+    response.primary_phy_ = bluetooth::hci::PrimaryPhyType::LE_1M;
+    response.advertising_sid_ = 0xFF;
+    response.tx_power_ = 0x7F;
+    response.advertising_data_ = scan_response.GetScanResponseData();
+    response.rssi_ = rssi;
+    send_event_(bluetooth::hci::LeExtendedAdvertisingReportRawBuilder::Create(
+        {response}));
   }
 }
 
+void LinkLayerController::LeScanning() {
+  if (!scanner_.IsEnabled()) {
+    return;
+  }
+
+  std::chrono::steady_clock::time_point now = std::chrono::steady_clock::now();
+
+  // Extended Scanning Timeout
+
+  // Generate HCI Connection Complete or Enhanced HCI Connection Complete
+  // events with Advertising Timeout error code when the advertising
+  // type is ADV_DIRECT_IND and the connection failed to be established.
+
+  if (scanner_.timeout.has_value() &&
+      !scanner_.periodical_timeout.has_value() &&
+      now >= scanner_.timeout.value()) {
+    // At the end of a single scan (Duration non-zero but Period zero),
+    // an HCI_LE_Scan_Timeout event shall be generated.
+    LOG_INFO("Extended Scan Timeout");
+    scanner_.scan_enable = false;
+    scanner_.history.clear();
+    if (IsLeEventUnmasked(SubeventCode::SCAN_TIMEOUT)) {
+      send_event_(bluetooth::hci::LeScanTimeoutBuilder::Create());
+    }
+  }
+
+  // End of duration with scan enabled
+  if (scanner_.timeout.has_value() && scanner_.periodical_timeout.has_value() &&
+      now >= scanner_.timeout.value()) {
+    scanner_.timeout = {};
+  }
+
+  // End of period
+  if (!scanner_.timeout.has_value() &&
+      scanner_.periodical_timeout.has_value() &&
+      now >= scanner_.periodical_timeout.value()) {
+    if (scanner_.filter_duplicates == FilterDuplicates::RESET_EACH_PERIOD) {
+      scanner_.history.clear();
+    }
+    scanner_.timeout = now + scanner_.duration;
+    scanner_.periodical_timeout = now + scanner_.period;
+  }
+}
+
+#ifndef ROOTCANAL_LMP
 void LinkLayerController::IncomingPasskeyPacket(
     model::packets::LinkLayerPacketView incoming) {
   auto passkey = model::packets::PasskeyView::Create(incoming);
@@ -1930,7 +4574,7 @@
   auto current_peer = incoming.GetSourceAddress();
   security_manager_.AuthenticationRequestFinished();
   ScheduleTask(kNoDelayMs, [this, current_peer]() {
-    if (properties_.IsUnmasked(EventCode::SIMPLE_PAIRING_COMPLETE)) {
+    if (IsEventUnmasked(EventCode::SIMPLE_PAIRING_COMPLETE)) {
       send_event_(bluetooth::hci::SimplePairingCompleteBuilder::Create(
           ErrorCode::AUTHENTICATION_FAILURE, current_peer));
     }
@@ -1949,7 +4593,7 @@
     auto wrong_pin = request.GetPinCode();
     wrong_pin[0] = wrong_pin[0]++;
     SendLinkLayerPacket(model::packets::PinResponseBuilder::Create(
-        properties_.GetAddress(), peer, wrong_pin));
+        GetAddress(), peer, wrong_pin));
     return;
   }
   if (security_manager_.AuthenticationInProgress()) {
@@ -1960,7 +4604,7 @@
       auto wrong_pin = request.GetPinCode();
       wrong_pin[0] = wrong_pin[0]++;
       SendLinkLayerPacket(model::packets::PinResponseBuilder::Create(
-          properties_.GetAddress(), peer, wrong_pin));
+          GetAddress(), peer, wrong_pin));
       return;
     }
   } else {
@@ -1972,14 +4616,14 @@
   if (security_manager_.GetPinRequested(peer)) {
     if (security_manager_.GetLocalPinResponseReceived(peer)) {
       SendLinkLayerPacket(model::packets::PinResponseBuilder::Create(
-          properties_.GetAddress(), peer, request.GetPinCode()));
+          GetAddress(), peer, request.GetPinCode()));
       if (security_manager_.PinCompare()) {
         LOG_INFO("Authenticating %s", peer.ToString().c_str());
         SaveKeyAndAuthenticate('L', peer);  // Legacy
       } else {
         security_manager_.AuthenticationRequestFinished();
         ScheduleTask(kNoDelayMs, [this, peer]() {
-          if (properties_.IsUnmasked(EventCode::SIMPLE_PAIRING_COMPLETE)) {
+          if (IsEventUnmasked(EventCode::SIMPLE_PAIRING_COMPLETE)) {
             send_event_(bluetooth::hci::SimplePairingCompleteBuilder::Create(
                 ErrorCode::AUTHENTICATION_FAILURE, peer));
           }
@@ -1987,10 +4631,10 @@
       }
     }
   } else {
-    LOG_INFO("PIN pairing %s", properties_.GetAddress().ToString().c_str());
+    LOG_INFO("PIN pairing %s", GetAddress().ToString().c_str());
     ScheduleTask(kNoDelayMs, [this, peer]() {
       security_manager_.SetPinRequested(peer);
-      if (properties_.IsUnmasked(EventCode::PIN_CODE_REQUEST)) {
+      if (IsEventUnmasked(EventCode::PIN_CODE_REQUEST)) {
         send_event_(bluetooth::hci::PinCodeRequestBuilder::Create(peer));
       }
     });
@@ -2025,14 +4669,14 @@
   if (security_manager_.GetPinRequested(peer)) {
     if (security_manager_.GetLocalPinResponseReceived(peer)) {
       SendLinkLayerPacket(model::packets::PinResponseBuilder::Create(
-          properties_.GetAddress(), peer, request.GetPinCode()));
+          GetAddress(), peer, request.GetPinCode()));
       if (security_manager_.PinCompare()) {
         LOG_INFO("Authenticating %s", peer.ToString().c_str());
         SaveKeyAndAuthenticate('L', peer);  // Legacy
       } else {
         security_manager_.AuthenticationRequestFinished();
         ScheduleTask(kNoDelayMs, [this, peer]() {
-          if (properties_.IsUnmasked(EventCode::SIMPLE_PAIRING_COMPLETE)) {
+          if (IsEventUnmasked(EventCode::SIMPLE_PAIRING_COMPLETE)) {
             send_event_(bluetooth::hci::SimplePairingCompleteBuilder::Create(
                 ErrorCode::AUTHENTICATION_FAILURE, peer));
           }
@@ -2040,15 +4684,16 @@
       }
     }
   } else {
-    LOG_INFO("PIN pairing %s", properties_.GetAddress().ToString().c_str());
+    LOG_INFO("PIN pairing %s", GetAddress().ToString().c_str());
     ScheduleTask(kNoDelayMs, [this, peer]() {
       security_manager_.SetPinRequested(peer);
-      if (properties_.IsUnmasked(EventCode::PIN_CODE_REQUEST)) {
+      if (IsEventUnmasked(EventCode::PIN_CODE_REQUEST)) {
         send_event_(bluetooth::hci::PinCodeRequestBuilder::Create(peer));
       }
     });
   }
 }
+#endif /* !ROOTCANAL_LMP */
 
 void LinkLayerController::IncomingPagePacket(
     model::packets::LinkLayerPacketView incoming) {
@@ -2057,7 +4702,8 @@
   LOG_INFO("from %s", incoming.GetSourceAddress().ToString().c_str());
 
   if (!connections_.CreatePendingConnection(
-          incoming.GetSourceAddress(), properties_.GetAuthenticationEnable())) {
+          incoming.GetSourceAddress(),
+          authentication_enable_ == AuthenticationEnable::REQUIRED)) {
     // Send a response to indicate that we're busy, or drop the packet?
     LOG_WARN("Failed to create a pending connection for %s",
              incoming.GetSourceAddress().ToString().c_str());
@@ -2067,7 +4713,7 @@
   bluetooth::hci::Address::FromString(page.GetSourceAddress().ToString(),
                                       source_address);
 
-  if (properties_.IsUnmasked(EventCode::CONNECTION_REQUEST)) {
+  if (IsEventUnmasked(EventCode::CONNECTION_REQUEST)) {
     send_event_(bluetooth::hci::ConnectionRequestBuilder::Create(
         source_address, page.GetClassOfDevice(),
         bluetooth::hci::ConnectionRequestLinkType::ACL));
@@ -2080,7 +4726,7 @@
   auto reject = model::packets::PageRejectView::Create(incoming);
   ASSERT(reject.IsValid());
   LOG_INFO("Sending CreateConnectionComplete");
-  if (properties_.IsUnmasked(EventCode::CONNECTION_COMPLETE)) {
+  if (IsEventUnmasked(EventCode::CONNECTION_COMPLETE)) {
     send_event_(bluetooth::hci::ConnectionCompleteBuilder::Create(
         static_cast<ErrorCode>(reject.GetReason()), 0x0eff,
         incoming.GetSourceAddress(), bluetooth::hci::LinkType::ACL,
@@ -2092,49 +4738,50 @@
     model::packets::LinkLayerPacketView incoming) {
   Address peer = incoming.GetSourceAddress();
   LOG_INFO("%s", peer.ToString().c_str());
+#ifndef ROOTCANAL_LMP
   bool awaiting_authentication = connections_.AuthenticatePendingConnection();
+#endif /* !ROOTCANAL_LMP */
   uint16_t handle =
       connections_.CreateConnection(peer, incoming.GetDestinationAddress());
   if (handle == kReservedHandle) {
     LOG_WARN("No free handles");
     return;
   }
-  if (properties_.IsUnmasked(EventCode::CONNECTION_COMPLETE)) {
+  CancelScheduledTask(page_timeout_task_id_);
+#ifdef ROOTCANAL_LMP
+  ASSERT(link_manager_add_link(
+      lm_.get(), reinterpret_cast<const uint8_t(*)[6]>(peer.data())));
+#endif /* ROOTCANAL_LMP */
+
+  CheckExpiringConnection(handle);
+
+  if (IsEventUnmasked(EventCode::CONNECTION_COMPLETE)) {
     send_event_(bluetooth::hci::ConnectionCompleteBuilder::Create(
         ErrorCode::SUCCESS, handle, incoming.GetSourceAddress(),
         bluetooth::hci::LinkType::ACL, bluetooth::hci::Enable::DISABLED));
   }
 
+#ifndef ROOTCANAL_LMP
   if (awaiting_authentication) {
     ScheduleTask(kNoDelayMs, [this, peer, handle]() {
       HandleAuthenticationRequest(peer, handle);
     });
   }
+#endif /* !ROOTCANAL_LMP */
 }
 
 void LinkLayerController::TimerTick() {
   if (inquiry_timer_task_id_ != kInvalidTaskId) Inquiry();
   LeAdvertising();
+  LeScanning();
+#ifdef ROOTCANAL_LMP
+  link_manager_tick(lm_.get());
+#endif /* ROOTCANAL_LMP */
 }
 
 void LinkLayerController::Close() {
   for (auto handle : connections_.GetAclHandles()) {
-    Disconnect(handle, static_cast<uint8_t>(ErrorCode::CONNECTION_TIMEOUT));
-  }
-}
-
-void LinkLayerController::LeAdvertising() {
-  steady_clock::time_point now = steady_clock::now();
-  for (auto& advertiser : advertisers_) {
-    auto event = advertiser.GetEvent(now);
-    if (event != nullptr) {
-      send_event_(std::move(event));
-    }
-
-    auto advertisement = advertiser.GetAdvertisement(now);
-    if (advertisement != nullptr) {
-      SendLeLinkLayerPacket(std::move(advertisement));
-    }
+    Disconnect(handle, ErrorCode::CONNECTION_TIMEOUT);
   }
 }
 
@@ -2179,9 +4826,23 @@
                                               const TaskCallback& callback) {
   if (schedule_task_) {
     return schedule_task_(delay_ms, callback);
-  } else {
+  } else if (delay_ms == milliseconds::zero()) {
     callback();
     return 0;
+  } else {
+    LOG_ERROR("Unable to schedule task on delay");
+    return 0;
+  }
+}
+
+AsyncTaskId LinkLayerController::SchedulePeriodicTask(
+    milliseconds delay_ms, milliseconds period_ms,
+    const TaskCallback& callback) {
+  if (schedule_periodic_task_) {
+    return schedule_periodic_task_(delay_ms, period_ms, callback);
+  } else {
+    LOG_ERROR("Unable to schedule task on delay");
+    return 0;
   }
 }
 
@@ -2202,9 +4863,15 @@
   cancel_task_ = task_cancel;
 }
 
+#ifdef ROOTCANAL_LMP
+void LinkLayerController::ForwardToLm(bluetooth::hci::CommandView command) {
+  auto packet = std::vector(command.begin(), command.end());
+  ASSERT(link_manager_ingest_hci(lm_.get(), packet.data(), packet.size()));
+}
+#else
 void LinkLayerController::StartSimplePairing(const Address& address) {
   // IO Capability Exchange (See the Diagram in the Spec)
-  if (properties_.IsUnmasked(EventCode::IO_CAPABILITY_REQUEST)) {
+  if (IsEventUnmasked(EventCode::IO_CAPABILITY_REQUEST)) {
     send_event_(bluetooth::hci::IoCapabilityRequestBuilder::Create(address));
   }
 
@@ -2220,37 +4887,37 @@
   // TODO: Public key exchange first?
   switch (pairing_type) {
     case PairingType::AUTO_CONFIRMATION:
-      if (properties_.IsUnmasked(EventCode::USER_CONFIRMATION_REQUEST)) {
+      if (IsEventUnmasked(EventCode::USER_CONFIRMATION_REQUEST)) {
         send_event_(bluetooth::hci::UserConfirmationRequestBuilder::Create(
             peer, 123456));
       }
       break;
     case PairingType::CONFIRM_Y_N:
-      if (properties_.IsUnmasked(EventCode::USER_CONFIRMATION_REQUEST)) {
+      if (IsEventUnmasked(EventCode::USER_CONFIRMATION_REQUEST)) {
         send_event_(bluetooth::hci::UserConfirmationRequestBuilder::Create(
             peer, 123456));
       }
       break;
     case PairingType::DISPLAY_PIN:
-      if (properties_.IsUnmasked(EventCode::USER_PASSKEY_NOTIFICATION)) {
+      if (IsEventUnmasked(EventCode::USER_PASSKEY_NOTIFICATION)) {
         send_event_(bluetooth::hci::UserPasskeyNotificationBuilder::Create(
             peer, 123456));
       }
       break;
     case PairingType::DISPLAY_AND_CONFIRM:
-      if (properties_.IsUnmasked(EventCode::USER_CONFIRMATION_REQUEST)) {
+      if (IsEventUnmasked(EventCode::USER_CONFIRMATION_REQUEST)) {
         send_event_(bluetooth::hci::UserConfirmationRequestBuilder::Create(
             peer, 123456));
       }
       break;
     case PairingType::INPUT_PIN:
-      if (properties_.IsUnmasked(EventCode::USER_PASSKEY_REQUEST)) {
+      if (IsEventUnmasked(EventCode::USER_PASSKEY_REQUEST)) {
         send_event_(bluetooth::hci::UserPasskeyRequestBuilder::Create(peer));
       }
       break;
     case PairingType::OUT_OF_BAND:
       LOG_INFO("Oob data request for %s", peer.ToString().c_str());
-      if (properties_.IsUnmasked(EventCode::REMOTE_OOB_DATA_REQUEST)) {
+      if (IsEventUnmasked(EventCode::REMOTE_OOB_DATA_REQUEST)) {
         send_event_(bluetooth::hci::RemoteOobDataRequestBuilder::Create(peer));
       }
       break;
@@ -2269,7 +4936,7 @@
   ASSERT(security_manager_.GetAuthenticationAddress() == peer);
   // Check key in security_manager_ ?
   if (security_manager_.IsInitiator()) {
-    if (properties_.IsUnmasked(EventCode::AUTHENTICATION_COMPLETE)) {
+    if (IsEventUnmasked(EventCode::AUTHENTICATION_COMPLETE)) {
       send_event_(bluetooth::hci::AuthenticationCompleteBuilder::Create(
           ErrorCode::SUCCESS, handle));
     }
@@ -2296,7 +4963,7 @@
     return ErrorCode::UNKNOWN_CONNECTION;
   }
 
-  if (properties_.GetSecureSimplePairingSupported()) {
+  if (secure_simple_pairing_host_support_) {
     if (!security_manager_.AuthenticationInProgress()) {
       security_manager_.AuthenticationRequest(address, handle, false);
     }
@@ -2304,10 +4971,10 @@
     ScheduleTask(kNoDelayMs,
                  [this, address]() { StartSimplePairing(address); });
   } else {
-    LOG_INFO("PIN pairing %s", properties_.GetAddress().ToString().c_str());
+    LOG_INFO("PIN pairing %s", GetAddress().ToString().c_str());
     ScheduleTask(kNoDelayMs, [this, address]() {
       security_manager_.SetPinRequested(address);
-      if (properties_.IsUnmasked(EventCode::PIN_CODE_REQUEST)) {
+      if (IsEventUnmasked(EventCode::PIN_CODE_REQUEST)) {
         send_event_(bluetooth::hci::PinCodeRequestBuilder::Create(address));
       }
     });
@@ -2328,13 +4995,13 @@
       AuthenticateRemoteStage1(peer, pairing_type);
     });
     SendLinkLayerPacket(model::packets::IoCapabilityResponseBuilder::Create(
-        properties_.GetAddress(), peer, io_capability, oob_data_present_flag,
+        GetAddress(), peer, io_capability, oob_data_present_flag,
         authentication_requirements));
   } else {
     LOG_INFO("Requesting remote capability");
 
     SendLinkLayerPacket(model::packets::IoCapabilityRequestBuilder::Create(
-        properties_.GetAddress(), peer, io_capability, oob_data_present_flag,
+        GetAddress(), peer, io_capability, oob_data_present_flag,
         authentication_requirements));
   }
 
@@ -2351,7 +5018,7 @@
 
   SendLinkLayerPacket(
       model::packets::IoCapabilityNegativeResponseBuilder::Create(
-          properties_.GetAddress(), peer, static_cast<uint8_t>(reason)));
+          GetAddress(), peer, static_cast<uint8_t>(reason)));
 
   return ErrorCode::SUCCESS;
 }
@@ -2382,21 +5049,21 @@
   if (key_type == 'L') {
     // Legacy
     ScheduleTask(kNoDelayMs, [this, peer, key_vec]() {
-      if (properties_.IsUnmasked(EventCode::LINK_KEY_NOTIFICATION)) {
+      if (IsEventUnmasked(EventCode::LINK_KEY_NOTIFICATION)) {
         send_event_(bluetooth::hci::LinkKeyNotificationBuilder::Create(
             peer, key_vec, bluetooth::hci::KeyType::AUTHENTICATED_P192));
       }
     });
   } else {
     ScheduleTask(kNoDelayMs, [this, peer]() {
-      if (properties_.IsUnmasked(EventCode::SIMPLE_PAIRING_COMPLETE)) {
+      if (IsEventUnmasked(EventCode::SIMPLE_PAIRING_COMPLETE)) {
         send_event_(bluetooth::hci::SimplePairingCompleteBuilder::Create(
             ErrorCode::SUCCESS, peer));
       }
     });
 
     ScheduleTask(kNoDelayMs, [this, peer, key_vec]() {
-      if (properties_.IsUnmasked(EventCode::LINK_KEY_NOTIFICATION)) {
+      if (IsEventUnmasked(EventCode::LINK_KEY_NOTIFICATION)) {
         send_event_(bluetooth::hci::LinkKeyNotificationBuilder::Create(
             peer, key_vec, bluetooth::hci::KeyType::AUTHENTICATED_P256));
       }
@@ -2408,14 +5075,14 @@
 
 ErrorCode LinkLayerController::PinCodeRequestReply(const Address& peer,
                                                    std::vector<uint8_t> pin) {
-  LOG_INFO("%s", properties_.GetAddress().ToString().c_str());
+  LOG_INFO("%s", GetAddress().ToString().c_str());
   auto current_peer = security_manager_.GetAuthenticationAddress();
   if (peer != current_peer) {
-    LOG_INFO("%s: %s != %s", properties_.GetAddress().ToString().c_str(),
+    LOG_INFO("%s: %s != %s", GetAddress().ToString().c_str(),
              peer.ToString().c_str(), current_peer.ToString().c_str());
     security_manager_.AuthenticationRequestFinished();
     ScheduleTask(kNoDelayMs, [this, current_peer]() {
-      if (properties_.IsUnmasked(EventCode::SIMPLE_PAIRING_COMPLETE)) {
+      if (IsEventUnmasked(EventCode::SIMPLE_PAIRING_COMPLETE)) {
         send_event_(bluetooth::hci::SimplePairingCompleteBuilder::Create(
             ErrorCode::AUTHENTICATION_FAILURE, current_peer));
       }
@@ -2434,15 +5101,15 @@
     } else {
       security_manager_.AuthenticationRequestFinished();
       ScheduleTask(kNoDelayMs, [this, peer]() {
-        if (properties_.IsUnmasked(EventCode::SIMPLE_PAIRING_COMPLETE)) {
+        if (IsEventUnmasked(EventCode::SIMPLE_PAIRING_COMPLETE)) {
           send_event_(bluetooth::hci::SimplePairingCompleteBuilder::Create(
               ErrorCode::AUTHENTICATION_FAILURE, peer));
         }
       });
     }
   } else {
-    SendLinkLayerPacket(model::packets::PinRequestBuilder::Create(
-        properties_.GetAddress(), peer, pin));
+    SendLinkLayerPacket(
+        model::packets::PinRequestBuilder::Create(GetAddress(), peer, pin));
   }
   return ErrorCode::SUCCESS;
 }
@@ -2452,7 +5119,7 @@
   auto current_peer = security_manager_.GetAuthenticationAddress();
   security_manager_.AuthenticationRequestFinished();
   ScheduleTask(kNoDelayMs, [this, current_peer]() {
-    if (properties_.IsUnmasked(EventCode::SIMPLE_PAIRING_COMPLETE)) {
+    if (IsEventUnmasked(EventCode::SIMPLE_PAIRING_COMPLETE)) {
       send_event_(bluetooth::hci::SimplePairingCompleteBuilder::Create(
           ErrorCode::AUTHENTICATION_FAILURE, current_peer));
     }
@@ -2481,7 +5148,7 @@
   auto current_peer = security_manager_.GetAuthenticationAddress();
   security_manager_.AuthenticationRequestFinished();
   ScheduleTask(kNoDelayMs, [this, current_peer]() {
-    if (properties_.IsUnmasked(EventCode::SIMPLE_PAIRING_COMPLETE)) {
+    if (IsEventUnmasked(EventCode::SIMPLE_PAIRING_COMPLETE)) {
       send_event_(bluetooth::hci::SimplePairingCompleteBuilder::Create(
           ErrorCode::AUTHENTICATION_FAILURE, current_peer));
     }
@@ -2497,8 +5164,8 @@
   if (security_manager_.GetAuthenticationAddress() != peer) {
     return ErrorCode::AUTHENTICATION_FAILURE;
   }
-  SendLinkLayerPacket(model::packets::PasskeyBuilder::Create(
-      properties_.GetAddress(), peer, numeric_value));
+  SendLinkLayerPacket(model::packets::PasskeyBuilder::Create(GetAddress(), peer,
+                                                             numeric_value));
   SaveKeyAndAuthenticate('P', peer);
 
   return ErrorCode::SUCCESS;
@@ -2509,7 +5176,7 @@
   auto current_peer = security_manager_.GetAuthenticationAddress();
   security_manager_.AuthenticationRequestFinished();
   ScheduleTask(kNoDelayMs, [this, current_peer]() {
-    if (properties_.IsUnmasked(EventCode::SIMPLE_PAIRING_COMPLETE)) {
+    if (IsEventUnmasked(EventCode::SIMPLE_PAIRING_COMPLETE)) {
       send_event_(bluetooth::hci::SimplePairingCompleteBuilder::Create(
           ErrorCode::AUTHENTICATION_FAILURE, current_peer));
     }
@@ -2537,7 +5204,7 @@
   auto current_peer = security_manager_.GetAuthenticationAddress();
   security_manager_.AuthenticationRequestFinished();
   ScheduleTask(kNoDelayMs, [this, current_peer]() {
-    if (properties_.IsUnmasked(EventCode::SIMPLE_PAIRING_COMPLETE)) {
+    if (IsEventUnmasked(EventCode::SIMPLE_PAIRING_COMPLETE)) {
       send_event_(bluetooth::hci::SimplePairingCompleteBuilder::Create(
           ErrorCode::AUTHENTICATION_FAILURE, current_peer));
     }
@@ -2572,7 +5239,7 @@
   }
 
   SendLinkLayerPacket(model::packets::KeypressNotificationBuilder::Create(
-      properties_.GetAddress(), peer,
+      GetAddress(), peer,
       static_cast<model::packets::PasskeyNotificationType>(notification_type)));
   return ErrorCode::SUCCESS;
 }
@@ -2580,7 +5247,7 @@
 void LinkLayerController::HandleAuthenticationRequest(const Address& address,
                                                       uint16_t handle) {
   security_manager_.AuthenticationRequest(address, handle, true);
-  if (properties_.IsUnmasked(EventCode::LINK_KEY_REQUEST)) {
+  if (IsEventUnmasked(EventCode::LINK_KEY_REQUEST)) {
     send_event_(bluetooth::hci::LinkKeyRequestBuilder::Create(address));
   }
 }
@@ -2605,7 +5272,7 @@
   // TODO: Block ACL traffic or at least guard against it
 
   if (connections_.IsEncrypted(handle) && encryption_enable) {
-    if (properties_.IsUnmasked(EventCode::ENCRYPTION_CHANGE)) {
+    if (IsEventUnmasked(EventCode::ENCRYPTION_CHANGE)) {
       send_event_(bluetooth::hci::EncryptionChangeBuilder::Create(
           ErrorCode::SUCCESS, handle,
           static_cast<bluetooth::hci::EncryptionEnabled>(encryption_enable)));
@@ -2621,7 +5288,7 @@
   auto array = security_manager_.GetKey(peer);
   std::vector<uint8_t> key_vec{array.begin(), array.end()};
   SendLinkLayerPacket(model::packets::EncryptConnectionBuilder::Create(
-      properties_.GetAddress(), peer, key_vec));
+      GetAddress(), peer, key_vec));
 }
 
 ErrorCode LinkLayerController::SetConnectionEncryption(
@@ -2646,6 +5313,23 @@
   });
   return ErrorCode::SUCCESS;
 }
+#endif /* ROOTCANAL_LMP */
+
+std::vector<bluetooth::hci::Lap> const& LinkLayerController::ReadCurrentIacLap()
+    const {
+  return current_iac_lap_list_;
+}
+
+void LinkLayerController::WriteCurrentIacLap(
+    std::vector<bluetooth::hci::Lap> iac_lap) {
+  current_iac_lap_list_.swap(iac_lap);
+
+  //  If Num_Current_IAC is greater than Num_Supported_IAC then only the first
+  //  Num_Supported_IAC shall be stored in the Controller
+  if (current_iac_lap_list_.size() > properties_.num_supported_iac) {
+    current_iac_lap_list_.resize(properties_.num_supported_iac);
+  }
+}
 
 ErrorCode LinkLayerController::AcceptConnectionRequest(const Address& bd_addr,
                                                        bool try_role_switch) {
@@ -2669,8 +5353,10 @@
     ScoConnectionParameters connection_parameters =
         connections_.GetScoConnectionParameters(bd_addr);
 
-    if (!connections_.AcceptPendingScoConnection(bd_addr,
-                                                 connection_parameters)) {
+    if (!connections_.AcceptPendingScoConnection(
+            bd_addr, connection_parameters, [this, bd_addr] {
+              return LinkLayerController::StartScoStream(bd_addr);
+            })) {
       connections_.CancelPendingScoConnection(bd_addr);
       status = ErrorCode::SCO_INTERVAL_REJECTED;  // TODO: proper status code
     } else {
@@ -2680,7 +5366,7 @@
 
     // Send eSCO connection response to peer.
     SendLinkLayerPacket(model::packets::ScoConnectionResponseBuilder::Create(
-        properties_.GetAddress(), bd_addr, (uint8_t)status,
+        GetAddress(), bd_addr, (uint8_t)status,
         link_parameters.transmission_interval,
         link_parameters.retransmission_window, link_parameters.rx_packet_length,
         link_parameters.tx_packet_length, link_parameters.air_mode,
@@ -2704,16 +5390,22 @@
                                                    bool try_role_switch) {
   LOG_INFO("Sending page response to %s", addr.ToString().c_str());
   SendLinkLayerPacket(model::packets::PageResponseBuilder::Create(
-      properties_.GetAddress(), addr, try_role_switch));
+      GetAddress(), addr, try_role_switch));
 
-  uint16_t handle =
-      connections_.CreateConnection(addr, properties_.GetAddress());
+  uint16_t handle = connections_.CreateConnection(addr, GetAddress());
   if (handle == kReservedHandle) {
     LOG_INFO("CreateConnection failed");
     return;
   }
+#ifdef ROOTCANAL_LMP
+  ASSERT(link_manager_add_link(
+      lm_.get(), reinterpret_cast<const uint8_t(*)[6]>(addr.data())));
+#endif /* ROOTCANAL_LMP */
+
+  CheckExpiringConnection(handle);
+
   LOG_INFO("CreateConnection returned handle 0x%x", handle);
-  if (properties_.IsUnmasked(EventCode::CONNECTION_COMPLETE)) {
+  if (IsEventUnmasked(EventCode::CONNECTION_COMPLETE)) {
     send_event_(bluetooth::hci::ConnectionCompleteBuilder::Create(
         ErrorCode::SUCCESS, handle, addr, bluetooth::hci::LinkType::ACL,
         bluetooth::hci::Enable::DISABLED));
@@ -2738,10 +5430,10 @@
                                                      uint8_t reason) {
   LOG_INFO("Sending page reject to %s (reason 0x%02hhx)",
            addr.ToString().c_str(), reason);
-  SendLinkLayerPacket(model::packets::PageRejectBuilder::Create(
-      properties_.GetAddress(), addr, reason));
+  SendLinkLayerPacket(
+      model::packets::PageRejectBuilder::Create(GetAddress(), addr, reason));
 
-  if (properties_.IsUnmasked(EventCode::CONNECTION_COMPLETE)) {
+  if (IsEventUnmasked(EventCode::CONNECTION_COMPLETE)) {
     send_event_(bluetooth::hci::ConnectionCompleteBuilder::Create(
         static_cast<ErrorCode>(reason), 0xeff, addr,
         bluetooth::hci::LinkType::ACL, bluetooth::hci::Enable::DISABLED));
@@ -2752,12 +5444,20 @@
                                                 uint8_t, uint16_t,
                                                 uint8_t allow_role_switch) {
   if (!connections_.CreatePendingConnection(
-          addr, properties_.GetAuthenticationEnable() == 1)) {
+          addr, authentication_enable_ == AuthenticationEnable::REQUIRED)) {
     return ErrorCode::CONTROLLER_BUSY;
   }
+
+  page_timeout_task_id_ = ScheduleTask(
+      duration_cast<milliseconds>(page_timeout_ * microseconds(625)),
+      [this, addr] {
+        send_event_(bluetooth::hci::ConnectionCompleteBuilder::Create(
+            ErrorCode::PAGE_TIMEOUT, 0xeff, addr, bluetooth::hci::LinkType::ACL,
+            bluetooth::hci::Enable::DISABLED));
+      });
+
   SendLinkLayerPacket(model::packets::PageBuilder::Create(
-      properties_.GetAddress(), addr, properties_.GetClassOfDevice(),
-      allow_role_switch));
+      GetAddress(), addr, class_of_device_, allow_role_switch));
 
   return ErrorCode::SUCCESS;
 }
@@ -2766,29 +5466,30 @@
   if (!connections_.CancelPendingConnection(addr)) {
     return ErrorCode::UNKNOWN_CONNECTION;
   }
+  CancelScheduledTask(page_timeout_task_id_);
   return ErrorCode::SUCCESS;
 }
 
 void LinkLayerController::SendDisconnectionCompleteEvent(uint16_t handle,
-                                                         uint8_t reason) {
-  if (properties_.IsUnmasked(EventCode::DISCONNECTION_COMPLETE)) {
+                                                         ErrorCode reason) {
+  if (IsEventUnmasked(EventCode::DISCONNECTION_COMPLETE)) {
     ScheduleTask(kNoDelayMs, [this, handle, reason]() {
       send_event_(bluetooth::hci::DisconnectionCompleteBuilder::Create(
-          ErrorCode::SUCCESS, handle, ErrorCode(reason)));
+          ErrorCode::SUCCESS, handle, reason));
     });
   }
 }
 
-ErrorCode LinkLayerController::Disconnect(uint16_t handle, uint8_t reason) {
+ErrorCode LinkLayerController::Disconnect(uint16_t handle, ErrorCode reason) {
   if (connections_.HasScoHandle(handle)) {
     const Address remote = connections_.GetScoAddress(handle);
     LOG_INFO("Disconnecting eSCO connection with %s",
              remote.ToString().c_str());
 
     SendLinkLayerPacket(model::packets::ScoDisconnectBuilder::Create(
-        properties_.GetAddress(), remote, reason));
+        GetAddress(), remote, static_cast<uint8_t>(reason)));
 
-    connections_.Disconnect(handle);
+    connections_.Disconnect(handle, cancel_task_);
     SendDisconnectionCompleteEvent(handle, reason);
     return ErrorCode::SUCCESS;
   }
@@ -2798,32 +5499,39 @@
   }
 
   const AddressWithType remote = connections_.GetAddress(handle);
+  auto is_br_edr = connections_.GetPhyType(handle) == Phy::Type::BR_EDR;
 
-  if (connections_.GetPhyType(handle) == Phy::Type::BR_EDR) {
+  if (is_br_edr) {
     LOG_INFO("Disconnecting ACL connection with %s", remote.ToString().c_str());
 
     uint16_t sco_handle = connections_.GetScoHandle(remote.GetAddress());
     if (sco_handle != kReservedHandle) {
       SendLinkLayerPacket(model::packets::ScoDisconnectBuilder::Create(
-          properties_.GetAddress(), remote.GetAddress(), reason));
+          GetAddress(), remote.GetAddress(), static_cast<uint8_t>(reason)));
 
-      connections_.Disconnect(sco_handle);
+      connections_.Disconnect(sco_handle, cancel_task_);
       SendDisconnectionCompleteEvent(sco_handle, reason);
     }
 
     SendLinkLayerPacket(model::packets::DisconnectBuilder::Create(
-        properties_.GetAddress(), remote.GetAddress(), reason));
-
+        GetAddress(), remote.GetAddress(), static_cast<uint8_t>(reason)));
   } else {
     LOG_INFO("Disconnecting LE connection with %s", remote.ToString().c_str());
 
     SendLeLinkLayerPacket(model::packets::DisconnectBuilder::Create(
         connections_.GetOwnAddress(handle).GetAddress(), remote.GetAddress(),
-        reason));
+        static_cast<uint8_t>(reason)));
   }
 
-  connections_.Disconnect(handle);
-  SendDisconnectionCompleteEvent(handle, reason);
+  connections_.Disconnect(handle, cancel_task_);
+  SendDisconnectionCompleteEvent(handle, ErrorCode(reason));
+#ifdef ROOTCANAL_LMP
+  if (is_br_edr) {
+    ASSERT(link_manager_remove_link(
+        lm_.get(),
+        reinterpret_cast<uint8_t(*)[6]>(remote.GetAddress().data())));
+  }
+#endif
   return ErrorCode::SUCCESS;
 }
 
@@ -2834,7 +5542,7 @@
   }
 
   ScheduleTask(kNoDelayMs, [this, handle, types]() {
-    if (properties_.IsUnmasked(EventCode::CONNECTION_PACKET_TYPE_CHANGED)) {
+    if (IsEventUnmasked(EventCode::CONNECTION_PACKET_TYPE_CHANGED)) {
       send_event_(bluetooth::hci::ConnectionPacketTypeChangedBuilder::Create(
           ErrorCode::SUCCESS, handle, types));
     }
@@ -2916,26 +5624,47 @@
   return ErrorCode::COMMAND_DISALLOWED;
 }
 
-ErrorCode LinkLayerController::RoleDiscovery(uint16_t handle) {
+ErrorCode LinkLayerController::RoleDiscovery(uint16_t handle,
+                                             bluetooth::hci::Role* role) {
   if (!connections_.HasHandle(handle)) {
     return ErrorCode::UNKNOWN_CONNECTION;
   }
-
-  // TODO: Implement real logic
+  *role = connections_.GetAclRole(handle);
   return ErrorCode::SUCCESS;
 }
 
-ErrorCode LinkLayerController::SwitchRole(Address /* bd_addr */,
-                                          uint8_t /* role */) {
-  // TODO: implement real logic
-  return ErrorCode::COMMAND_DISALLOWED;
+ErrorCode LinkLayerController::SwitchRole(Address addr,
+                                          bluetooth::hci::Role role) {
+  auto handle = connections_.GetHandleOnlyAddress(addr);
+  if (handle == rootcanal::kReservedHandle) {
+    return ErrorCode::UNKNOWN_CONNECTION;
+  }
+  connections_.SetAclRole(handle, role);
+  ScheduleTask(kNoDelayMs, [this, addr, role]() {
+    send_event_(bluetooth::hci::RoleChangeBuilder::Create(ErrorCode::SUCCESS,
+                                                          addr, role));
+  });
+  return ErrorCode::SUCCESS;
 }
 
-ErrorCode LinkLayerController::WriteLinkPolicySettings(uint16_t handle,
-                                                       uint16_t) {
+ErrorCode LinkLayerController::ReadLinkPolicySettings(uint16_t handle,
+                                                      uint16_t* settings) {
   if (!connections_.HasHandle(handle)) {
     return ErrorCode::UNKNOWN_CONNECTION;
   }
+  *settings = connections_.GetAclLinkPolicySettings(handle);
+  return ErrorCode::SUCCESS;
+}
+
+ErrorCode LinkLayerController::WriteLinkPolicySettings(uint16_t handle,
+                                                       uint16_t settings) {
+  if (!connections_.HasHandle(handle)) {
+    return ErrorCode::UNKNOWN_CONNECTION;
+  }
+  if (settings > 7 /* Sniff + Hold + Role switch */) {
+    return ErrorCode::INVALID_HCI_COMMAND_PARAMETERS;
+  }
+  connections_.SetAclLinkPolicySettings(handle, settings);
   return ErrorCode::SUCCESS;
 }
 
@@ -3019,136 +5748,6 @@
   return ErrorCode::SUCCESS;
 }
 
-ErrorCode LinkLayerController::SetLeExtendedAddress(uint8_t set,
-                                                    Address address) {
-  advertisers_[set].SetAddress(address);
-  return ErrorCode::SUCCESS;
-}
-
-ErrorCode LinkLayerController::SetLeExtendedAdvertisingData(
-    uint8_t set, const std::vector<uint8_t>& data) {
-  advertisers_[set].SetData(data);
-  return ErrorCode::SUCCESS;
-}
-
-ErrorCode LinkLayerController::SetLeExtendedScanResponseData(
-    uint8_t set, const std::vector<uint8_t>& data) {
-  advertisers_[set].SetScanResponse(data);
-  return ErrorCode::SUCCESS;
-}
-
-ErrorCode LinkLayerController::SetLeExtendedAdvertisingParameters(
-    uint8_t set, uint16_t interval_min, uint16_t interval_max,
-    bluetooth::hci::LegacyAdvertisingProperties type,
-    bluetooth::hci::OwnAddressType own_address_type,
-    bluetooth::hci::PeerAddressType peer_address_type, Address peer,
-    bluetooth::hci::AdvertisingFilterPolicy filter_policy, uint8_t tx_power) {
-  model::packets::AdvertisementType ad_type;
-
-  AddressWithType peer_address;
-  switch (peer_address_type) {
-    case bluetooth::hci::PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS:
-      peer_address = AddressWithType(
-          peer, bluetooth::hci::AddressType::PUBLIC_DEVICE_ADDRESS);
-      break;
-    case bluetooth::hci::PeerAddressType::RANDOM_DEVICE_OR_IDENTITY_ADDRESS:
-      peer_address = AddressWithType(
-          peer, bluetooth::hci::AddressType::RANDOM_DEVICE_ADDRESS);
-      break;
-  }
-
-  AddressWithType directed_address{};
-  switch (type) {
-    case bluetooth::hci::LegacyAdvertisingProperties::ADV_IND:
-      ad_type = model::packets::AdvertisementType::ADV_IND;
-      break;
-    case bluetooth::hci::LegacyAdvertisingProperties::ADV_NONCONN_IND:
-      ad_type = model::packets::AdvertisementType::ADV_NONCONN_IND;
-      break;
-    case bluetooth::hci::LegacyAdvertisingProperties::ADV_SCAN_IND:
-      ad_type = model::packets::AdvertisementType::ADV_SCAN_IND;
-      break;
-    case bluetooth::hci::LegacyAdvertisingProperties::ADV_DIRECT_IND_HIGH:
-      ad_type = model::packets::AdvertisementType::ADV_DIRECT_IND;
-      directed_address = peer_address;
-      break;
-    case bluetooth::hci::LegacyAdvertisingProperties::ADV_DIRECT_IND_LOW:
-      ad_type = model::packets::AdvertisementType::SCAN_RESPONSE;
-      directed_address = peer_address;
-      break;
-  }
-  auto interval_ms =
-      static_cast<int>((interval_max + interval_min) * 0.625 / 2);
-
-  LOG_INFO("peer %s", peer.ToString().c_str());
-  LOG_INFO("peer_address_type %s",
-           bluetooth::hci::PeerAddressTypeText(peer_address_type).c_str());
-  LOG_INFO("peer_address %s", peer_address.ToString().c_str());
-
-  bluetooth::hci::LeScanningFilterPolicy scanning_filter_policy;
-  switch (filter_policy) {
-    case bluetooth::hci::AdvertisingFilterPolicy::ALL_DEVICES:
-      scanning_filter_policy =
-          bluetooth::hci::LeScanningFilterPolicy::ACCEPT_ALL;
-      break;
-    case bluetooth::hci::AdvertisingFilterPolicy::LISTED_SCAN:
-      scanning_filter_policy =
-          bluetooth::hci::LeScanningFilterPolicy::FILTER_ACCEPT_LIST_ONLY;
-      break;
-    case bluetooth::hci::AdvertisingFilterPolicy::LISTED_CONNECT:
-      scanning_filter_policy =
-          bluetooth::hci::LeScanningFilterPolicy::CHECK_INITIATORS_IDENTITY;
-      break;
-    case bluetooth::hci::AdvertisingFilterPolicy::LISTED_SCAN_AND_CONNECT:
-      scanning_filter_policy = bluetooth::hci::LeScanningFilterPolicy::
-          FILTER_ACCEPT_LIST_AND_INITIATORS_IDENTITY;
-      break;
-  }
-
-  advertisers_[set].InitializeExtended(
-      set, own_address_type,
-      bluetooth::hci::AddressWithType(
-          properties_.GetAddress(),
-          bluetooth::hci::AddressType::PUBLIC_DEVICE_ADDRESS),
-      directed_address, scanning_filter_policy, ad_type,
-      std::chrono::milliseconds(interval_ms), tx_power,
-      [this, own_address_type, peer_address]() {
-        if (own_address_type ==
-                bluetooth::hci::OwnAddressType::RESOLVABLE_OR_PUBLIC_ADDRESS ||
-            own_address_type ==
-                bluetooth::hci::OwnAddressType::RESOLVABLE_OR_RANDOM_ADDRESS) {
-          for (const auto& entry : le_resolving_list_) {
-            if (entry.address == peer_address.GetAddress() &&
-                entry.address_type == peer_address.GetAddressType()) {
-              return generate_rpa(entry.local_irk);
-            }
-          }
-        }
-        return bluetooth::hci::Address::kEmpty;
-      });
-  return ErrorCode::SUCCESS;
-}
-
-ErrorCode LinkLayerController::LeRemoveAdvertisingSet(uint8_t set) {
-  if (set >= advertisers_.size()) {
-    return ErrorCode::INVALID_HCI_COMMAND_PARAMETERS;
-  }
-  advertisers_[set].Disable();
-  return ErrorCode::SUCCESS;
-}
-
-ErrorCode LinkLayerController::LeClearAdvertisingSets() {
-  for (auto& advertiser : advertisers_) {
-    if (advertiser.IsEnabled()) {
-      return ErrorCode::COMMAND_DISALLOWED;
-    }
-  }
-  for (auto& advertiser : advertisers_) {
-    advertiser.Clear();
-  }
-  return ErrorCode::SUCCESS;
-}
-
 void LinkLayerController::LeConnectionUpdateComplete(
     uint16_t handle, uint16_t interval_min, uint16_t interval_max,
     uint16_t latency, uint16_t supervision_timeout) {
@@ -3173,9 +5772,7 @@
       static_cast<uint8_t>(ErrorCode::SUCCESS), interval, latency,
       supervision_timeout));
 
-  if (properties_.IsUnmasked(EventCode::LE_META_EVENT) &&
-      properties_.GetLeEventSupported(
-          bluetooth::hci::SubeventCode::CONNECTION_UPDATE_COMPLETE)) {
+  if (IsLeEventUnmasked(SubeventCode::CONNECTION_UPDATE_COMPLETE)) {
     send_event_(bluetooth::hci::LeConnectionUpdateCompleteBuilder::Create(
         status, handle, interval, latency, supervision_timeout));
   }
@@ -3188,10 +5785,30 @@
     return ErrorCode::UNKNOWN_CONNECTION;
   }
 
-  SendLeLinkLayerPacket(LeConnectionParameterRequestBuilder::Create(
-      connections_.GetOwnAddress(handle).GetAddress(),
-      connections_.GetAddress(handle).GetAddress(), interval_min, interval_max,
-      latency, supervision_timeout));
+  bluetooth::hci::Role role = connections_.GetAclRole(handle);
+
+  if (role == bluetooth::hci::Role::CENTRAL) {
+    // As Central, it is allowed to directly send
+    // LL_CONNECTION_PARAM_UPDATE_IND to update the parameters.
+    SendLeLinkLayerPacket(LeConnectionParameterUpdateBuilder::Create(
+        connections_.GetOwnAddress(handle).GetAddress(),
+        connections_.GetAddress(handle).GetAddress(),
+        static_cast<uint8_t>(ErrorCode::SUCCESS), interval_max, latency,
+        supervision_timeout));
+
+    if (IsLeEventUnmasked(SubeventCode::CONNECTION_UPDATE_COMPLETE)) {
+      send_event_(bluetooth::hci::LeConnectionUpdateCompleteBuilder::Create(
+          ErrorCode::SUCCESS, handle, interval_max, latency,
+          supervision_timeout));
+    }
+  } else {
+    // Send LL_CONNECTION_PARAM_REQ and wait for LL_CONNECTION_PARAM_RSP
+    // in return.
+    SendLeLinkLayerPacket(LeConnectionParameterRequestBuilder::Create(
+        connections_.GetOwnAddress(handle).GetAddress(),
+        connections_.GetAddress(handle).GetAddress(), interval_min,
+        interval_max, latency, supervision_timeout));
+  }
 
   return ErrorCode::SUCCESS;
 }
@@ -3233,76 +5850,10 @@
   return ErrorCode::SUCCESS;
 }
 
-ErrorCode LinkLayerController::LeFilterAcceptListClear() {
-  if (FilterAcceptListBusy()) {
-    return ErrorCode::COMMAND_DISALLOWED;
-  }
-
-  le_connect_list_.clear();
-  return ErrorCode::SUCCESS;
-}
-
-ErrorCode LinkLayerController::LeSetAddressResolutionEnable(bool enable) {
-  if (ResolvingListBusy()) {
-    return ErrorCode::COMMAND_DISALLOWED;
-  }
-
-  le_resolving_list_enabled_ = enable;
-  return ErrorCode::SUCCESS;
-}
-
-ErrorCode LinkLayerController::LeResolvingListClear() {
-  if (ResolvingListBusy()) {
-    return ErrorCode::COMMAND_DISALLOWED;
-  }
-
-  le_resolving_list_.clear();
-  return ErrorCode::SUCCESS;
-}
-
-ErrorCode LinkLayerController::LeFilterAcceptListAddDevice(
-    Address addr, AddressType addr_type) {
-  if (FilterAcceptListBusy()) {
-    return ErrorCode::COMMAND_DISALLOWED;
-  }
-  for (auto dev : le_connect_list_) {
-    if (dev.address == addr && dev.address_type == addr_type) {
-      return ErrorCode::SUCCESS;
-    }
-  }
-  if (LeFilterAcceptListFull()) {
-    return ErrorCode::MEMORY_CAPACITY_EXCEEDED;
-  }
-  le_connect_list_.emplace_back(ConnectListEntry{addr, addr_type});
-  return ErrorCode::SUCCESS;
-}
-
-ErrorCode LinkLayerController::LeResolvingListAddDevice(
-    Address addr, AddressType addr_type, std::array<uint8_t, kIrkSize> peerIrk,
-    std::array<uint8_t, kIrkSize> localIrk) {
-  if (ResolvingListBusy()) {
-    return ErrorCode::COMMAND_DISALLOWED;
-  }
-  if (LeResolvingListFull()) {
-    return ErrorCode::MEMORY_CAPACITY_EXCEEDED;
-  }
-  le_resolving_list_.emplace_back(
-      ResolvingListEntry{addr, addr_type, peerIrk, localIrk});
-  return ErrorCode::SUCCESS;
-}
-
 bool LinkLayerController::HasAclConnection() {
   return (connections_.GetAclHandles().size() > 0);
 }
 
-void LinkLayerController::LeSetPrivacyMode(AddressType address_type,
-                                           Address addr, uint8_t mode) {
-  // set mode for addr
-  LOG_INFO("address type = %s ", AddressTypeText(address_type).c_str());
-  LOG_INFO("address = %s ", addr.ToString().c_str());
-  LOG_INFO("mode = %d ", mode);
-}
-
 void LinkLayerController::LeReadIsoTxSync(uint16_t /* handle */) {}
 
 void LinkLayerController::LeSetCigParameters(
@@ -3312,7 +5863,7 @@
     uint16_t max_transport_latency_m_to_s,
     uint16_t max_transport_latency_s_to_m,
     std::vector<bluetooth::hci::CisParametersConfig> cis_config) {
-  if (properties_.IsUnmasked(EventCode::LE_META_EVENT)) {
+  if (IsEventUnmasked(EventCode::LE_META_EVENT)) {
     send_event_(connections_.SetCigParameters(
         cig_id, sdu_interval_m_to_s, sdu_interval_s_to_m, clock_accuracy,
         packing, framing, max_transport_latency_m_to_s,
@@ -3390,7 +5941,7 @@
   uint8_t max_pdu_m_to_s = 0x40;
   uint8_t max_pdu_s_to_m = 0x40;
   uint16_t iso_interval = 0x100;
-  if (properties_.IsUnmasked(EventCode::LE_META_EVENT)) {
+  if (IsEventUnmasked(EventCode::LE_META_EVENT)) {
     send_event_(bluetooth::hci::LeCisEstablishedBuilder::Create(
         ErrorCode::SUCCESS, cis_handle, cig_sync_delay, cis_sync_delay,
         latency_m_to_s, latency_s_to_m,
@@ -3423,7 +5974,7 @@
     bluetooth::hci::SecondaryPhyType /* phy */,
     bluetooth::hci::Packing /* packing */, bluetooth::hci::Enable /* framing */,
     bluetooth::hci::Enable /* encryption */,
-    std::vector<uint16_t> /* broadcast_code */) {
+    std::array<uint8_t, 16> /* broadcast_code */) {
   return ErrorCode::SUCCESS;
 }
 
@@ -3435,7 +5986,7 @@
 ErrorCode LinkLayerController::LeBigCreateSync(
     uint8_t /* big_handle */, uint16_t /* sync_handle */,
     bluetooth::hci::Enable /* encryption */,
-    std::vector<uint16_t> /* broadcast_code */, uint8_t /* mse */,
+    std::array<uint8_t, 16> /* broadcast_code */, uint8_t /* mse */,
     uint16_t /* big_sync_timeout */, std::vector<uint8_t> /* bis */) {
   return ErrorCode::SUCCESS;
 }
@@ -3494,13 +6045,13 @@
 
   // TODO: Check keys
   if (connections_.IsEncrypted(handle)) {
-    if (properties_.IsUnmasked(EventCode::ENCRYPTION_KEY_REFRESH_COMPLETE)) {
+    if (IsEventUnmasked(EventCode::ENCRYPTION_KEY_REFRESH_COMPLETE)) {
       send_event_(bluetooth::hci::EncryptionKeyRefreshCompleteBuilder::Create(
           ErrorCode::SUCCESS, handle));
     }
   } else {
     connections_.Encrypt(handle);
-    if (properties_.IsUnmasked(EventCode::ENCRYPTION_CHANGE)) {
+    if (IsEventUnmasked(EventCode::ENCRYPTION_CHANGE)) {
       send_event_(bluetooth::hci::EncryptionChangeBuilder::Create(
           ErrorCode::SUCCESS, handle, bluetooth::hci::EncryptionEnabled::ON));
     }
@@ -3529,189 +6080,75 @@
   return ErrorCode::SUCCESS;
 }
 
-ErrorCode LinkLayerController::SetLeAdvertisingEnable(
-    uint8_t le_advertising_enable) {
-  if (!le_advertising_enable) {
-    advertisers_[0].Disable();
-    return ErrorCode::SUCCESS;
-  }
-  auto interval_ms = (properties_.GetLeAdvertisingIntervalMax() +
-                      properties_.GetLeAdvertisingIntervalMin()) *
-                     0.625 / 2;
-
-  Address own_address = properties_.GetAddress();
-  if (properties_.GetLeAdvertisingOwnAddressType() ==
-          static_cast<uint8_t>(
-              bluetooth::hci::AddressType::RANDOM_DEVICE_ADDRESS) ||
-      properties_.GetLeAdvertisingOwnAddressType() ==
-          static_cast<uint8_t>(
-              bluetooth::hci::AddressType::RANDOM_IDENTITY_ADDRESS)) {
-    if (properties_.GetLeAddress().ToString() == "bb:bb:bb:ba:d0:1e" ||
-        properties_.GetLeAddress() == Address::kEmpty) {
-      return ErrorCode::INVALID_HCI_COMMAND_PARAMETERS;
-    }
-    own_address = properties_.GetLeAddress();
-  }
-  auto own_address_with_type = AddressWithType(
-      own_address, static_cast<bluetooth::hci::AddressType>(
-                       properties_.GetLeAdvertisingOwnAddressType()));
-
-  auto interval = std::chrono::milliseconds(static_cast<uint64_t>(interval_ms));
-  if (interval < std::chrono::milliseconds(20)) {
-    return ErrorCode::INVALID_HCI_COMMAND_PARAMETERS;
-  }
-  advertisers_[0].Initialize(
-      own_address_with_type,
-      bluetooth::hci::AddressWithType(
-          properties_.GetLeAdvertisingPeerAddress(),
-          static_cast<bluetooth::hci::AddressType>(
-              properties_.GetLeAdvertisingPeerAddressType())),
-      static_cast<bluetooth::hci::LeScanningFilterPolicy>(
-          properties_.GetLeAdvertisingFilterPolicy()),
-      static_cast<model::packets::AdvertisementType>(
-          properties_.GetLeAdvertisementType()),
-      properties_.GetLeAdvertisement(), properties_.GetLeScanResponse(),
-      interval);
-  advertisers_[0].Enable();
-  return ErrorCode::SUCCESS;
-}
-
-void LinkLayerController::LeDisableAdvertisingSets() {
-  for (auto& advertiser : advertisers_) {
-    advertiser.Disable();
-  }
-}
-
-uint8_t LinkLayerController::LeReadNumberOfSupportedAdvertisingSets() {
-  return advertisers_.size();
-}
-
-ErrorCode LinkLayerController::SetLeExtendedAdvertisingEnable(
-    bluetooth::hci::Enable enable,
-    const std::vector<bluetooth::hci::EnabledSet>& enabled_sets) {
-  for (const auto& set : enabled_sets) {
-    if (set.advertising_handle_ > advertisers_.size()) {
-      return ErrorCode::INVALID_HCI_COMMAND_PARAMETERS;
-    }
-  }
-  for (const auto& set : enabled_sets) {
-    auto handle = set.advertising_handle_;
-    if (enable == bluetooth::hci::Enable::ENABLED) {
-      advertisers_[handle].EnableExtended(10ms * set.duration_);
-    } else {
-      advertisers_[handle].Disable();
-    }
-  }
-  return ErrorCode::SUCCESS;
-}
-
-bool LinkLayerController::ListBusy(uint16_t ignore) {
-  if (le_connect_) {
-    LOG_INFO("le_connect_");
-    if (!(ignore & DeviceProperties::kLeListIgnoreConnections)) {
-      return true;
-    }
-  }
-  if (le_scan_enable_ != bluetooth::hci::OpCode::NONE) {
-    LOG_INFO("le_scan_enable");
-    if (!(ignore & DeviceProperties::kLeListIgnoreScanEnable)) {
-      return true;
-    }
-  }
-  for (auto advertiser : advertisers_) {
-    if (advertiser.IsEnabled()) {
-      LOG_INFO("Advertising");
-      if (!(ignore & DeviceProperties::kLeListIgnoreAdvertising)) {
-        return true;
-      }
-    }
-  }
-  // TODO: Add HCI_LE_Periodic_Advertising_Create_Sync
-  return false;
-}
-
-bool LinkLayerController::FilterAcceptListBusy() {
-  return ListBusy(properties_.GetLeFilterAcceptListIgnoreReasons());
-}
-
-bool LinkLayerController::ResolvingListBusy() {
-  return ListBusy(properties_.GetLeResolvingListIgnoreReasons());
-}
-
-ErrorCode LinkLayerController::LeFilterAcceptListRemoveDevice(
-    Address addr, AddressType addr_type) {
-  if (FilterAcceptListBusy()) {
-    return ErrorCode::COMMAND_DISALLOWED;
-  }
-  for (size_t i = 0; i < le_connect_list_.size(); i++) {
-    if (le_connect_list_[i].address == addr &&
-        le_connect_list_[i].address_type == addr_type) {
-      le_connect_list_.erase(le_connect_list_.begin() + i);
-    }
-  }
-  return ErrorCode::SUCCESS;
-}
-
-ErrorCode LinkLayerController::LeResolvingListRemoveDevice(
-    Address addr, AddressType addr_type) {
-  if (ResolvingListBusy()) {
-    return ErrorCode::COMMAND_DISALLOWED;
-  }
-  for (size_t i = 0; i < le_resolving_list_.size(); i++) {
-    auto curr = le_resolving_list_[i];
-    if (curr.address == addr && curr.address_type == addr_type) {
-      le_resolving_list_.erase(le_resolving_list_.begin() + i);
-    }
-  }
-  return ErrorCode::SUCCESS;
-}
-
-bool LinkLayerController::LeFilterAcceptListContainsDevice(
-    Address addr, AddressType addr_type) {
-  for (size_t i = 0; i < le_connect_list_.size(); i++) {
-    if (le_connect_list_[i].address == addr &&
-        le_connect_list_[i].address_type == addr_type) {
-      return true;
-    }
-  }
-  return false;
-}
-
-bool LinkLayerController::LeResolvingListContainsDevice(Address addr,
-                                                        AddressType addr_type) {
-  for (size_t i = 0; i < le_connect_list_.size(); i++) {
-    auto curr = le_connect_list_[i];
-    if (curr.address == addr && curr.address_type == addr_type) {
-      return true;
-    }
-  }
-  return false;
-}
-
-bool LinkLayerController::LeFilterAcceptListFull() {
-  return le_connect_list_.size() >= properties_.GetLeFilterAcceptListSize();
-}
-
-bool LinkLayerController::LeResolvingListFull() {
-  return le_resolving_list_.size() >= properties_.GetLeResolvingListSize();
-}
-
 void LinkLayerController::Reset() {
+  host_supported_features_ = 0;
+  le_host_support_ = false;
+  secure_simple_pairing_host_support_ = false;
+  secure_connections_host_support_ = false;
+  le_host_supported_features_ = 0;
+  connected_isochronous_stream_host_support_ = false;
+  connection_subrating_host_support_ = false;
+  random_address_ = Address::kEmpty;
+  page_scan_enable_ = false;
+  inquiry_scan_enable_ = false;
+  inquiry_scan_interval_ = 0x1000;
+  inquiry_scan_window_ = 0x0012;
+  page_timeout_ = 0x2000;
+  connection_accept_timeout_ = 0x1FA0;
+  page_scan_interval_ = 0x0800;
+  page_scan_window_ = 0x0012;
+  voice_setting_ = 0x0060;
+  authentication_enable_ = AuthenticationEnable::NOT_REQUIRED;
+  default_link_policy_settings_ = 0x0000;
+  sco_flow_control_enable_ = false;
+  local_name_.fill(0);
+  extended_inquiry_response_.fill(0);
+  class_of_device_ = ClassOfDevice({0, 0, 0});
+  min_encryption_key_size_ = 16;
+  event_mask_ = 0x00001fffffffffff;
+  event_mask_page_2_ = 0x0;
+  le_event_mask_ = 0x01f;
+  le_suggested_max_tx_octets_ = 0x001b;
+  le_suggested_max_tx_time_ = 0x0148;
+  resolvable_private_address_timeout_ = std::chrono::seconds(0x0384);
+  page_scan_repetition_mode_ = PageScanRepetitionMode::R0;
   connections_ = AclConnectionHandler();
-  le_connect_list_.clear();
+  oob_id_ = 1;
+  key_id_ = 1;
+  le_filter_accept_list_.clear();
   le_resolving_list_.clear();
   le_resolving_list_enabled_ = false;
-  le_connecting_rpa_ = Address();
-  LeDisableAdvertisingSets();
-  le_scan_enable_ = bluetooth::hci::OpCode::NONE;
-  le_connect_ = false;
+  legacy_advertising_in_use_ = false;
+  extended_advertising_in_use_ = false;
+  legacy_advertiser_ = LegacyAdvertiser{};
+  extended_advertisers_.clear();
+  scanner_ = Scanner{};
+  initiator_ = Initiator{};
+  last_inquiry_ = steady_clock::now();
+  inquiry_mode_ = InquiryType::STANDARD;
+  inquiry_lap_ = 0;
+  inquiry_max_responses_ = 0;
+
+  bluetooth::hci::Lap general_iac;
+  general_iac.lap_ = 0x33;  // 0x9E8B33
+  current_iac_lap_list_.clear();
+  current_iac_lap_list_.emplace_back(general_iac);
+
   if (inquiry_timer_task_id_ != kInvalidTaskId) {
     CancelScheduledTask(inquiry_timer_task_id_);
     inquiry_timer_task_id_ = kInvalidTaskId;
   }
-  last_inquiry_ = steady_clock::now();
-  page_scans_enabled_ = false;
-  inquiry_scans_enabled_ = false;
+
+  if (page_timeout_task_id_ != kInvalidTaskId) {
+    CancelScheduledTask(page_timeout_task_id_);
+    page_timeout_task_id_ = kInvalidTaskId;
+  }
+
+#ifdef ROOTCANAL_LMP
+  lm_.reset(link_manager_create(ops_));
+#else
+  security_manager_ = SecurityManager(10);
+#endif
 }
 
 void LinkLayerController::StartInquiry(milliseconds timeout) {
@@ -3729,7 +6166,7 @@
 void LinkLayerController::InquiryTimeout() {
   if (inquiry_timer_task_id_ != kInvalidTaskId) {
     inquiry_timer_task_id_ = kInvalidTaskId;
-    if (properties_.IsUnmasked(EventCode::INQUIRY_COMPLETE)) {
+    if (IsEventUnmasked(EventCode::INQUIRY_COMPLETE)) {
       send_event_(
           bluetooth::hci::InquiryCompleteBuilder::Create(ErrorCode::SUCCESS));
     }
@@ -3753,20 +6190,27 @@
   }
 
   SendLinkLayerPacket(model::packets::InquiryBuilder::Create(
-      properties_.GetAddress(), Address::kEmpty, inquiry_mode_));
+      GetAddress(), Address::kEmpty, inquiry_mode_, inquiry_lap_));
   last_inquiry_ = now;
 }
 
 void LinkLayerController::SetInquiryScanEnable(bool enable) {
-  inquiry_scans_enabled_ = enable;
+  inquiry_scan_enable_ = enable;
 }
 
 void LinkLayerController::SetPageScanEnable(bool enable) {
-  page_scans_enabled_ = enable;
+  page_scan_enable_ = enable;
+}
+
+uint16_t LinkLayerController::GetPageTimeout() { return page_timeout_; }
+
+void LinkLayerController::SetPageTimeout(uint16_t page_timeout) {
+  page_timeout_ = page_timeout;
 }
 
 ErrorCode LinkLayerController::AddScoConnection(uint16_t connection_handle,
-                                                uint16_t packet_type) {
+                                                uint16_t packet_type,
+                                                ScoDatapath datapath) {
   if (!connections_.HasHandle(connection_handle)) {
     return ErrorCode::UNKNOWN_CONNECTION;
   }
@@ -3796,23 +6240,23 @@
                      NO_3_EV5_ALLOWED)};
   connections_.CreateScoConnection(
       connections_.GetAddress(connection_handle).GetAddress(),
-      connection_parameters, SCO_STATE_PENDING, true);
+      connection_parameters, SCO_STATE_PENDING, datapath, true);
 
   // Send SCO connection request to peer.
   SendLinkLayerPacket(model::packets::ScoConnectionRequestBuilder::Create(
-      properties_.GetAddress(), bd_addr,
-      connection_parameters.transmit_bandwidth,
+      GetAddress(), bd_addr, connection_parameters.transmit_bandwidth,
       connection_parameters.receive_bandwidth,
       connection_parameters.max_latency, connection_parameters.voice_setting,
       connection_parameters.retransmission_effort,
-      connection_parameters.packet_type));
+      connection_parameters.packet_type, class_of_device_));
   return ErrorCode::SUCCESS;
 }
 
 ErrorCode LinkLayerController::SetupSynchronousConnection(
     uint16_t connection_handle, uint32_t transmit_bandwidth,
     uint32_t receive_bandwidth, uint16_t max_latency, uint16_t voice_setting,
-    uint8_t retransmission_effort, uint16_t packet_types) {
+    uint8_t retransmission_effort, uint16_t packet_types,
+    ScoDatapath datapath) {
   if (!connections_.HasHandle(connection_handle)) {
     return ErrorCode::UNKNOWN_CONNECTION;
   }
@@ -3833,12 +6277,12 @@
       voice_setting,      retransmission_effort, packet_types};
   connections_.CreateScoConnection(
       connections_.GetAddress(connection_handle).GetAddress(),
-      connection_parameters, SCO_STATE_PENDING);
+      connection_parameters, SCO_STATE_PENDING, datapath);
 
   // Send eSCO connection request to peer.
   SendLinkLayerPacket(model::packets::ScoConnectionRequestBuilder::Create(
-      properties_.GetAddress(), bd_addr, transmit_bandwidth, receive_bandwidth,
-      max_latency, voice_setting, retransmission_effort, packet_types));
+      GetAddress(), bd_addr, transmit_bandwidth, receive_bandwidth, max_latency,
+      voice_setting, retransmission_effort, packet_types, class_of_device_));
   return ErrorCode::SUCCESS;
 }
 
@@ -3861,8 +6305,10 @@
       transmit_bandwidth, receive_bandwidth,     max_latency,
       voice_setting,      retransmission_effort, packet_types};
 
-  if (!connections_.AcceptPendingScoConnection(bd_addr,
-                                               connection_parameters)) {
+  if (!connections_.AcceptPendingScoConnection(
+          bd_addr, connection_parameters, [this, bd_addr] {
+            return LinkLayerController::StartScoStream(bd_addr);
+          })) {
     connections_.CancelPendingScoConnection(bd_addr);
     status = ErrorCode::STATUS_UNKNOWN;  // TODO: proper status code
   } else {
@@ -3872,7 +6318,7 @@
 
   // Send eSCO connection response to peer.
   SendLinkLayerPacket(model::packets::ScoConnectionResponseBuilder::Create(
-      properties_.GetAddress(), bd_addr, (uint8_t)status,
+      GetAddress(), bd_addr, (uint8_t)status,
       link_parameters.transmission_interval,
       link_parameters.retransmission_window, link_parameters.rx_packet_length,
       link_parameters.tx_packet_length, link_parameters.air_mode,
@@ -3911,7 +6357,7 @@
 
   // Send eSCO connection response to peer.
   SendLinkLayerPacket(model::packets::ScoConnectionResponseBuilder::Create(
-      properties_.GetAddress(), bd_addr, reason, 0, 0, 0, 0, 0, 0));
+      GetAddress(), bd_addr, reason, 0, 0, 0, 0, 0, 0));
 
   // Schedule HCI Synchronous Connection Complete event.
   ScheduleTask(kNoDelayMs, [this, reason, bd_addr]() {
@@ -3923,4 +6369,56 @@
   return ErrorCode::SUCCESS;
 }
 
+void LinkLayerController::CheckExpiringConnection(uint16_t handle) {
+  if (!connections_.HasHandle(handle)) {
+    return;
+  }
+
+  if (connections_.HasLinkExpired(handle)) {
+    Disconnect(handle, ErrorCode::CONNECTION_TIMEOUT);
+    return;
+  }
+
+  if (connections_.IsLinkNearExpiring(handle)) {
+    AddressWithType my_address = connections_.GetOwnAddress(handle);
+    AddressWithType destination = connections_.GetAddress(handle);
+    SendLinkLayerPacket(model::packets::PingRequestBuilder::Create(
+        my_address.GetAddress(), destination.GetAddress()));
+    ScheduleTask(std::chrono::duration_cast<milliseconds>(
+                     connections_.TimeUntilLinkExpired(handle)),
+                 [this, handle] { CheckExpiringConnection(handle); });
+    return;
+  }
+
+  ScheduleTask(std::chrono::duration_cast<milliseconds>(
+                   connections_.TimeUntilLinkNearExpiring(handle)),
+               [this, handle] { CheckExpiringConnection(handle); });
+}
+
+void LinkLayerController::IncomingPingRequest(
+    model::packets::LinkLayerPacketView packet) {
+  auto view = model::packets::PingRequestView::Create(packet);
+  ASSERT(view.IsValid());
+  SendLinkLayerPacket(model::packets::PingResponseBuilder::Create(
+      packet.GetDestinationAddress(), packet.GetSourceAddress()));
+}
+
+AsyncTaskId LinkLayerController::StartScoStream(Address address) {
+  auto sco_builder = bluetooth::hci::ScoBuilder::Create(
+      connections_.GetScoHandle(address), PacketStatusFlag::CORRECTLY_RECEIVED,
+      {0, 0, 0, 0, 0});
+
+  auto bytes = std::make_shared<std::vector<uint8_t>>();
+  bluetooth::packet::BitInserter bit_inserter(*bytes);
+  sco_builder->Serialize(bit_inserter);
+  auto raw_view =
+      bluetooth::hci::PacketView<bluetooth::hci::kLittleEndian>(bytes);
+  auto sco_view = bluetooth::hci::ScoView::Create(raw_view);
+  ASSERT(sco_view.IsValid());
+
+  return SchedulePeriodicTask(0ms, 20ms, [this, address, sco_view]() {
+    LOG_INFO("SCO sending...");
+    SendScoToRemote(sco_view);
+  });
+}
 }  // namespace rootcanal
diff --git a/tools/rootcanal/model/controller/link_layer_controller.h b/tools/rootcanal/model/controller/link_layer_controller.h
index 4643e7b..e01511c 100644
--- a/tools/rootcanal/model/controller/link_layer_controller.h
+++ b/tools/rootcanal/model/controller/link_layer_controller.h
@@ -16,39 +16,69 @@
 
 #pragma once
 
+#include <algorithm>
+#include <chrono>
+#include <map>
+#include <vector>
+
 #include "hci/address.h"
 #include "hci/hci_packets.h"
 #include "include/phy.h"
 #include "model/controller/acl_connection_handler.h"
+#include "model/controller/controller_properties.h"
 #include "model/controller/le_advertiser.h"
-#include "model/devices/device_properties.h"
 #include "model/setup/async_manager.h"
 #include "packets/link_layer_packets.h"
+
+#ifdef ROOTCANAL_LMP
+extern "C" {
+struct LinkManager;
+}
+#include "lmp.h"
+#else
 #include "security_manager.h"
+#endif /* ROOTCANAL_LMP */
 
 namespace rootcanal {
 
 using ::bluetooth::hci::Address;
 using ::bluetooth::hci::AddressType;
+using ::bluetooth::hci::AuthenticationEnable;
+using ::bluetooth::hci::ClassOfDevice;
 using ::bluetooth::hci::ErrorCode;
+using ::bluetooth::hci::FilterAcceptListAddressType;
 using ::bluetooth::hci::OpCode;
+using ::bluetooth::hci::PageScanRepetitionMode;
+
+// Create an address with type Public Device Address or Random Device Address.
+AddressWithType PeerDeviceAddress(Address address,
+                                  PeerAddressType peer_address_type);
+// Create an address with type Public Identity Address or Random Identity
+// address.
+AddressWithType PeerIdentityAddress(Address address,
+                                    PeerAddressType peer_address_type);
 
 class LinkLayerController {
  public:
   static constexpr size_t kIrkSize = 16;
 
-  LinkLayerController(const DeviceProperties& properties)
-      : properties_(properties) {}
+  LinkLayerController(const Address& address,
+                      const ControllerProperties& properties);
+
   ErrorCode SendCommandToRemoteByAddress(
       OpCode opcode, bluetooth::packet::PacketView<true> args,
-      const Address& remote);
-  ErrorCode SendLeCommandToRemoteByAddress(OpCode opcode, const Address& remote,
-                                           const Address& local);
+      const Address& own_address, const Address& peer_address);
+  ErrorCode SendLeCommandToRemoteByAddress(OpCode opcode,
+                                           const Address& own_address,
+                                           const Address& peer_address);
   ErrorCode SendCommandToRemoteByHandle(
       OpCode opcode, bluetooth::packet::PacketView<true> args, uint16_t handle);
   ErrorCode SendScoToRemote(bluetooth::hci::ScoView sco_packet);
   ErrorCode SendAclToRemote(bluetooth::hci::AclView acl_packet);
 
+#ifdef ROOTCANAL_LMP
+  void ForwardToLm(bluetooth::hci::CommandView command);
+#else
   void StartSimplePairing(const Address& address);
   void AuthenticateRemoteStage1(const Address& address,
                                 PairingType pairing_type);
@@ -86,6 +116,10 @@
   ErrorCode SetConnectionEncryption(uint16_t handle, uint8_t encryption_enable);
   void HandleAuthenticationRequest(const Address& address, uint16_t handle);
   ErrorCode AuthenticationRequested(uint16_t handle);
+#endif /* ROOTCANAL_LMP */
+
+  std::vector<bluetooth::hci::Lap> const& ReadCurrentIacLap() const;
+  void WriteCurrentIacLap(std::vector<bluetooth::hci::Lap> iac_lap);
 
   ErrorCode AcceptConnectionRequest(const Address& addr, bool try_role_switch);
   void MakePeripheralConnection(const Address& addr, bool try_role_switch);
@@ -95,15 +129,17 @@
                              uint8_t page_scan_mode, uint16_t clock_offset,
                              uint8_t allow_role_switch);
   ErrorCode CreateConnectionCancel(const Address& addr);
-  ErrorCode Disconnect(uint16_t handle, uint8_t reason);
+  ErrorCode Disconnect(uint16_t handle, ErrorCode reason);
 
  private:
-  void SendDisconnectionCompleteEvent(uint16_t handle, uint8_t reason);
+  void SendDisconnectionCompleteEvent(uint16_t handle, ErrorCode reason);
 
   void IncomingPacketWithRssi(model::packets::LinkLayerPacketView incoming,
                               uint8_t rssi);
 
  public:
+  const Address& GetAddress() const;
+
   void IncomingPacket(model::packets::LinkLayerPacketView incoming);
 
   void TimerTick();
@@ -113,6 +149,10 @@
   AsyncTaskId ScheduleTask(std::chrono::milliseconds delay_ms,
                            const TaskCallback& task);
 
+  AsyncTaskId SchedulePeriodicTask(std::chrono::milliseconds delay_ms,
+                                   std::chrono::milliseconds period_ms,
+                                   const TaskCallback& callback);
+
   void CancelScheduledTask(AsyncTaskId task);
 
   // Set the callbacks for sending packets to the HCI.
@@ -151,23 +191,8 @@
   void Reset();
 
   void LeAdvertising();
+  void LeScanning();
 
-  ErrorCode SetLeExtendedAddress(uint8_t handle, Address address);
-
-  ErrorCode SetLeExtendedAdvertisingData(uint8_t handle,
-                                         const std::vector<uint8_t>& data);
-
-  ErrorCode SetLeExtendedScanResponseData(uint8_t handle,
-                                          const std::vector<uint8_t>& data);
-
-  ErrorCode SetLeExtendedAdvertisingParameters(
-      uint8_t set, uint16_t interval_min, uint16_t interval_max,
-      bluetooth::hci::LegacyAdvertisingProperties type,
-      bluetooth::hci::OwnAddressType own_address_type,
-      bluetooth::hci::PeerAddressType peer_address_type, Address peer,
-      bluetooth::hci::AdvertisingFilterPolicy filter_policy, uint8_t tx_power);
-  ErrorCode LeRemoveAdvertisingSet(uint8_t set);
-  ErrorCode LeClearAdvertisingSets();
   void LeConnectionUpdateComplete(uint16_t handle, uint16_t interval_min,
                                   uint16_t interval_max, uint16_t latency,
                                   uint16_t supervision_timeout);
@@ -181,28 +206,50 @@
   ErrorCode LeRemoteConnectionParameterRequestNegativeReply(
       uint16_t connection_handle, bluetooth::hci::ErrorCode reason);
   uint16_t HandleLeConnection(AddressWithType addr, AddressWithType own_addr,
-                              uint8_t role, uint16_t connection_interval,
+                              bluetooth::hci::Role role,
+                              uint16_t connection_interval,
                               uint16_t connection_latency,
-                              uint16_t supervision_timeout);
+                              uint16_t supervision_timeout,
+                              bool send_le_channel_selection_algorithm_event);
 
-  bool ListBusy(uint16_t ignore_mask);
-
-  bool FilterAcceptListBusy();
-  ErrorCode LeFilterAcceptListClear();
-  ErrorCode LeFilterAcceptListAddDevice(Address addr, AddressType addr_type);
-  ErrorCode LeFilterAcceptListRemoveDevice(Address addr, AddressType addr_type);
-  bool LeFilterAcceptListContainsDevice(Address addr, AddressType addr_type);
-  bool LeFilterAcceptListFull();
   bool ResolvingListBusy();
-  ErrorCode LeSetAddressResolutionEnable(bool enable);
-  ErrorCode LeResolvingListClear();
-  ErrorCode LeResolvingListAddDevice(Address addr, AddressType addr_type,
-                                     std::array<uint8_t, kIrkSize> peerIrk,
-                                     std::array<uint8_t, kIrkSize> localIrk);
-  ErrorCode LeResolvingListRemoveDevice(Address addr, AddressType addr_type);
-  bool LeResolvingListContainsDevice(Address addr, AddressType addr_type);
-  bool LeResolvingListFull();
-  void LeSetPrivacyMode(AddressType address_type, Address addr, uint8_t mode);
+  bool FilterAcceptListBusy();
+
+  bool LeFilterAcceptListContainsDevice(
+      FilterAcceptListAddressType address_type, Address address);
+  bool LeFilterAcceptListContainsDevice(AddressWithType address);
+
+  enum IrkSelection {
+    Peer,  // Use Peer IRK for RPA resolution or generation.
+    Local  // Use Local IRK for RPA resolution or generation.
+  };
+
+  // If the selected address is a Resolvable Private Address, then
+  // resolve the address using the resolving list. If the address cannot
+  // be resolved none is returned. If the address is not a Resolvable
+  // Private Address, the original address is returned.
+  std::optional<AddressWithType> ResolvePrivateAddress(AddressWithType address,
+                                                       IrkSelection irk);
+
+  // Generate a Resolvable Private for the selected peer.
+  // If the address is not found in the resolving list none is returned.
+  // `local` indicates whether to use the local (true) or peer (false) IRK when
+  // generating the Resolvable Private Address.
+  std::optional<AddressWithType> GenerateResolvablePrivateAddress(
+      AddressWithType address, IrkSelection irk);
+
+  // Check if the selected address matches one of the controller's device
+  // addresses (public or random static).
+  bool IsLocalPublicOrRandomAddress(AddressWithType address) {
+    switch (address.GetAddressType()) {
+      case AddressType::PUBLIC_DEVICE_ADDRESS:
+        return address.GetAddress() == address_;
+      case AddressType::RANDOM_DEVICE_ADDRESS:
+        return address.GetAddress() == random_address_;
+      default:
+        return false;
+    }
+  }
 
   void LeReadIsoTxSync(uint16_t handle);
   void LeSetCigParameters(
@@ -224,12 +271,13 @@
       uint32_t sdu_interval, uint16_t max_sdu, uint16_t max_transport_latency,
       uint8_t rtn, bluetooth::hci::SecondaryPhyType phy,
       bluetooth::hci::Packing packing, bluetooth::hci::Enable framing,
-      bluetooth::hci::Enable encryption, std::vector<uint16_t> broadcast_code);
+      bluetooth::hci::Enable encryption,
+      std::array<uint8_t, 16> broadcast_code);
   bluetooth::hci::ErrorCode LeTerminateBig(uint8_t big_handle,
                                            bluetooth::hci::ErrorCode reason);
   bluetooth::hci::ErrorCode LeBigCreateSync(
       uint8_t big_handle, uint16_t sync_handle,
-      bluetooth::hci::Enable encryption, std::vector<uint16_t> broadcast_code,
+      bluetooth::hci::Enable encryption, std::array<uint8_t, 16> broadcast_code,
       uint8_t mse, uint16_t big_syunc_timeout, std::vector<uint8_t> bis);
   void LeBigTerminateSync(uint8_t big_handle);
   bluetooth::hci::ErrorCode LeRequestPeerSca(uint16_t request_handle);
@@ -253,72 +301,8 @@
 
   ErrorCode LeLongTermKeyRequestNegativeReply(uint16_t handle);
 
-  ErrorCode SetLeAdvertisingEnable(uint8_t le_advertising_enable);
-
-  void LeDisableAdvertisingSets();
-
   uint8_t LeReadNumberOfSupportedAdvertisingSets();
 
-  ErrorCode SetLeExtendedAdvertisingEnable(
-      bluetooth::hci::Enable enable,
-      const std::vector<bluetooth::hci::EnabledSet>& enabled_sets);
-
-  bluetooth::hci::OpCode GetLeScanEnable() { return le_scan_enable_; }
-
-  void SetLeScanEnable(bluetooth::hci::OpCode enabling_opcode) {
-    le_scan_enable_ = enabling_opcode;
-  }
-  void SetLeScanType(uint8_t le_scan_type) { le_scan_type_ = le_scan_type; }
-  void SetLeScanInterval(uint16_t le_scan_interval) {
-    le_scan_interval_ = le_scan_interval;
-  }
-  void SetLeScanWindow(uint16_t le_scan_window) {
-    le_scan_window_ = le_scan_window;
-  }
-  void SetLeScanFilterPolicy(uint8_t le_scan_filter_policy) {
-    le_scan_filter_policy_ = le_scan_filter_policy;
-  }
-  void SetLeFilterDuplicates(uint8_t le_scan_filter_duplicates) {
-    le_scan_filter_duplicates_ = le_scan_filter_duplicates;
-  }
-  void SetLeAddressType(bluetooth::hci::OwnAddressType le_address_type) {
-    le_address_type_ = le_address_type;
-  }
-  ErrorCode SetLeConnect(bool le_connect) {
-    if (le_connect_ == le_connect) {
-      return ErrorCode::COMMAND_DISALLOWED;
-    }
-    le_connect_ = le_connect;
-    return ErrorCode::SUCCESS;
-  }
-  void SetLeConnectionIntervalMin(uint16_t min) {
-    le_connection_interval_min_ = min;
-  }
-  void SetLeConnectionIntervalMax(uint16_t max) {
-    le_connection_interval_max_ = max;
-  }
-  void SetLeConnectionLatency(uint16_t latency) {
-    le_connection_latency_ = latency;
-  }
-  void SetLeSupervisionTimeout(uint16_t timeout) {
-    le_connection_supervision_timeout_ = timeout;
-  }
-  void SetLeMinimumCeLength(uint16_t min) {
-    le_connection_minimum_ce_length_ = min;
-  }
-  void SetLeMaximumCeLength(uint16_t max) {
-    le_connection_maximum_ce_length_ = max;
-  }
-  void SetLeInitiatorFilterPolicy(uint8_t le_initiator_filter_policy) {
-    le_initiator_filter_policy_ = le_initiator_filter_policy;
-  }
-  void SetLePeerAddressType(uint8_t peer_address_type) {
-    le_peer_address_type_ = peer_address_type;
-  }
-  void SetLePeerAddress(const Address& peer_address) {
-    le_peer_address_ = peer_address;
-  }
-
   // Classic
   void StartInquiry(std::chrono::milliseconds timeout);
   void InquiryCancel();
@@ -328,9 +312,15 @@
   void SetInquiryMaxResponses(uint8_t max);
   void Inquiry();
 
+  bool GetInquiryScanEnable() { return inquiry_scan_enable_; }
   void SetInquiryScanEnable(bool enable);
+
+  bool GetPageScanEnable() { return page_scan_enable_; }
   void SetPageScanEnable(bool enable);
 
+  uint16_t GetPageTimeout();
+  void SetPageTimeout(uint16_t page_timeout);
+
   ErrorCode ChangeConnectionPacketType(uint16_t handle, uint16_t types);
   ErrorCode ChangeConnectionLinkKey(uint16_t handle);
   ErrorCode CentralLinkKey(uint8_t key_flag);
@@ -343,8 +333,9 @@
   ErrorCode QosSetup(uint16_t handle, uint8_t service_type, uint32_t token_rate,
                      uint32_t peak_bandwidth, uint32_t latency,
                      uint32_t delay_variation);
-  ErrorCode RoleDiscovery(uint16_t handle);
-  ErrorCode SwitchRole(Address bd_addr, uint8_t role);
+  ErrorCode RoleDiscovery(uint16_t handle, bluetooth::hci::Role* role);
+  ErrorCode SwitchRole(Address bd_addr, bluetooth::hci::Role role);
+  ErrorCode ReadLinkPolicySettings(uint16_t handle, uint16_t* settings);
   ErrorCode WriteLinkPolicySettings(uint16_t handle, uint16_t settings);
   ErrorCode FlowSpecification(uint16_t handle, uint8_t flow_direction,
                               uint8_t service_type, uint32_t token_rate,
@@ -352,16 +343,19 @@
                               uint32_t peak_bandwidth, uint32_t access_latency);
   ErrorCode WriteLinkSupervisionTimeout(uint16_t handle, uint16_t timeout);
   ErrorCode WriteDefaultLinkPolicySettings(uint16_t settings);
+  void CheckExpiringConnection(uint16_t handle);
   uint16_t ReadDefaultLinkPolicySettings();
 
   void ReadLocalOobData();
   void ReadLocalOobExtendedData();
 
-  ErrorCode AddScoConnection(uint16_t connection_handle, uint16_t packet_type);
+  ErrorCode AddScoConnection(uint16_t connection_handle, uint16_t packet_type,
+                             ScoDatapath datapath);
   ErrorCode SetupSynchronousConnection(
       uint16_t connection_handle, uint32_t transmit_bandwidth,
       uint32_t receive_bandwidth, uint16_t max_latency, uint16_t voice_setting,
-      uint8_t retransmission_effort, uint16_t packet_types);
+      uint8_t retransmission_effort, uint16_t packet_types,
+      ScoDatapath datapath);
   ErrorCode AcceptSynchronousConnection(
       Address bd_addr, uint32_t transmit_bandwidth, uint32_t receive_bandwidth,
       uint16_t max_latency, uint16_t voice_setting,
@@ -372,14 +366,180 @@
 
   void HandleIso(bluetooth::hci::IsoView iso);
 
+  // LE Commands
+
+  // HCI LE Set Random Address command (Vol 4, Part E § 7.8.4).
+  ErrorCode LeSetRandomAddress(Address random_address);
+
+  // HCI LE Set Resolvable Private Address Timeout command
+  // (Vol 4, Part E § 7.8.45).
+  ErrorCode LeSetResolvablePrivateAddressTimeout(uint16_t rpa_timeout);
+
+  // HCI LE Set Host Feature command (Vol 4, Part E § 7.8.115).
+  ErrorCode LeSetHostFeature(uint8_t bit_number, uint8_t bit_value);
+
+  // LE Filter Accept List
+
+  // HCI command LE_Clear_Filter_Accept_List (Vol 4, Part E § 7.8.15).
+  ErrorCode LeClearFilterAcceptList();
+
+  // HCI command LE_Add_Device_To_Filter_Accept_List (Vol 4, Part E § 7.8.16).
+  ErrorCode LeAddDeviceToFilterAcceptList(
+      FilterAcceptListAddressType address_type, Address address);
+
+  // HCI command LE_Remove_Device_From_Filter_Accept_List (Vol 4, Part E
+  // § 7.8.17).
+  ErrorCode LeRemoveDeviceFromFilterAcceptList(
+      FilterAcceptListAddressType address_type, Address address);
+
+  // LE Address Resolving
+
+  // HCI command LE_Add_Device_To_Resolving_List (Vol 4, Part E § 7.8.38).
+  ErrorCode LeAddDeviceToResolvingList(
+      PeerAddressType peer_identity_address_type, Address peer_identity_address,
+      std::array<uint8_t, kIrkSize> peer_irk,
+      std::array<uint8_t, kIrkSize> local_irk);
+
+  // HCI command LE_Remove_Device_From_Resolving_List (Vol 4, Part E § 7.8.39).
+  ErrorCode LeRemoveDeviceFromResolvingList(
+      PeerAddressType peer_identity_address_type,
+      Address peer_identity_address);
+
+  // HCI command LE_Clear_Resolving_List (Vol 4, Part E § 7.8.40).
+  ErrorCode LeClearResolvingList();
+
+  // HCI command LE_Set_Address_Resolution_Enable (Vol 4, Part E § 7.8.44).
+  ErrorCode LeSetAddressResolutionEnable(bool enable);
+
+  // HCI command LE_Set_Privacy_Mode (Vol 4, Part E § 7.8.77).
+  ErrorCode LeSetPrivacyMode(PeerAddressType peer_identity_address_type,
+                             Address peer_identity_address,
+                             bluetooth::hci::PrivacyMode privacy_mode);
+
+  // Legacy Advertising
+
+  // HCI command LE_Set_Advertising_Parameters (Vol 4, Part E § 7.8.5).
+  ErrorCode LeSetAdvertisingParameters(
+      uint16_t advertising_interval_min, uint16_t advertising_interval_max,
+      bluetooth::hci::AdvertisingType advertising_type,
+      bluetooth::hci::OwnAddressType own_address_type,
+      bluetooth::hci::PeerAddressType peer_address_type, Address peer_address,
+      uint8_t advertising_channel_map,
+      bluetooth::hci::AdvertisingFilterPolicy advertising_filter_policy);
+
+  // HCI command LE_Set_Advertising_Data (Vol 4, Part E § 7.8.7).
+  ErrorCode LeSetAdvertisingData(const std::vector<uint8_t>& advertising_data);
+
+  // HCI command LE_Set_Scan_Response_Data (Vol 4, Part E § 7.8.8).
+  ErrorCode LeSetScanResponseData(
+      const std::vector<uint8_t>& scan_response_data);
+
+  // HCI command LE_Advertising_Enable (Vol 4, Part E § 7.8.9).
+  ErrorCode LeSetAdvertisingEnable(bool advertising_enable);
+
+  // Extended Advertising
+
+  // HCI command LE_Set_Advertising_Set_Random_Address (Vol 4, Part E § 7.8.52).
+  ErrorCode LeSetAdvertisingSetRandomAddress(uint8_t advertising_handle,
+                                             Address random_address);
+
+  // HCI command LE_Set_Advertising_Parameters (Vol 4, Part E § 7.8.53).
+  ErrorCode LeSetExtendedAdvertisingParameters(
+      uint8_t advertising_handle,
+      AdvertisingEventProperties advertising_event_properties,
+      uint16_t primary_advertising_interval_min,
+      uint16_t primary_advertising_interval_max,
+      uint8_t primary_advertising_channel_map,
+      bluetooth::hci::OwnAddressType own_address_type,
+      bluetooth::hci::PeerAddressType peer_address_type, Address peer_address,
+      bluetooth::hci::AdvertisingFilterPolicy advertising_filter_policy,
+      uint8_t advertising_tx_power,
+      bluetooth::hci::PrimaryPhyType primary_advertising_phy,
+      uint8_t secondary_max_skip,
+      bluetooth::hci::SecondaryPhyType secondary_advertising_phy,
+      uint8_t advertising_sid, bool scan_request_notification_enable);
+
+  // HCI command LE_Set_Extended_Advertising_Data (Vol 4, Part E § 7.8.54).
+  ErrorCode LeSetExtendedAdvertisingData(
+      uint8_t advertising_handle, bluetooth::hci::Operation operation,
+      bluetooth::hci::FragmentPreference fragment_preference,
+      const std::vector<uint8_t>& advertising_data);
+
+  // HCI command LE_Set_Extended_Scan_Response_Data (Vol 4, Part E § 7.8.55).
+  ErrorCode LeSetExtendedScanResponseData(
+      uint8_t advertising_handle, bluetooth::hci::Operation operation,
+      bluetooth::hci::FragmentPreference fragment_preference,
+      const std::vector<uint8_t>& scan_response_data);
+
+  // HCI command LE_Set_Extended_Advertising_Enable (Vol 4, Part E § 7.8.56).
+  ErrorCode LeSetExtendedAdvertisingEnable(
+      bool enable, const std::vector<bluetooth::hci::EnabledSet>& sets);
+
+  // HCI command LE_Remove_Advertising_Set (Vol 4, Part E § 7.8.59).
+  ErrorCode LeRemoveAdvertisingSet(uint8_t advertising_handle);
+
+  // HCI command LE_Clear_Advertising_Sets (Vol 4, Part E § 7.8.60).
+  ErrorCode LeClearAdvertisingSets();
+
+  // Legacy Scanning
+
+  // HCI command LE_Set_Scan_Parameters (Vol 4, Part E § 7.8.10).
+  ErrorCode LeSetScanParameters(
+      bluetooth::hci::LeScanType scan_type, uint16_t scan_interval,
+      uint16_t scan_window, bluetooth::hci::OwnAddressType own_address_type,
+      bluetooth::hci::LeScanningFilterPolicy scanning_filter_policy);
+
+  // HCI command LE_Set_Scan_Enable (Vol 4, Part E § 7.8.11).
+  ErrorCode LeSetScanEnable(bool enable, bool filter_duplicates);
+
+  // Extended Scanning
+
+  // HCI command LE_Set_Extended_Scan_Parameters (Vol 4, Part E § 7.8.64).
+  ErrorCode LeSetExtendedScanParameters(
+      bluetooth::hci::OwnAddressType own_address_type,
+      bluetooth::hci::LeScanningFilterPolicy scanning_filter_policy,
+      uint8_t scanning_phys,
+      std::vector<bluetooth::hci::PhyScanParameters> scanning_phy_parameters);
+
+  // HCI command LE_Set_Extended_Scan_Enable (Vol 4, Part E § 7.8.65).
+  ErrorCode LeSetExtendedScanEnable(
+      bool enable, bluetooth::hci::FilterDuplicates filter_duplicates,
+      uint16_t duration, uint16_t period);
+
+  // Legacy Connection
+
+  // HCI LE Create Connection command (Vol 4, Part E § 7.8.12).
+  ErrorCode LeCreateConnection(
+      uint16_t scan_interval, uint16_t scan_window,
+      bluetooth::hci::InitiatorFilterPolicy initiator_filter_policy,
+      AddressWithType peer_address,
+      bluetooth::hci::OwnAddressType own_address_type,
+      uint16_t connection_interval_min, uint16_t connection_interval_max,
+      uint16_t max_latency, uint16_t supervision_timeout,
+      uint16_t min_ce_length, uint16_t max_ce_length);
+
+  // HCI LE Create Connection Cancel command (Vol 4, Part E § 7.8.12).
+  ErrorCode LeCreateConnectionCancel();
+
+  // Extended Connection
+
+  // HCI LE Extended Create Connection command (Vol 4, Part E § 7.8.66).
+  ErrorCode LeExtendedCreateConnection(
+      bluetooth::hci::InitiatorFilterPolicy initiator_filter_policy,
+      bluetooth::hci::OwnAddressType own_address_type,
+      AddressWithType peer_address, uint8_t initiating_phys,
+      std::vector<bluetooth::hci::LeCreateConnPhyScanParameters>
+          initiating_phy_parameters);
+
  protected:
-  void SendLeLinkLayerPacketWithRssi(
-      Address source, Address dest, uint8_t rssi,
+  void SendLinkLayerPacket(
       std::unique_ptr<model::packets::LinkLayerPacketBuilder> packet);
   void SendLeLinkLayerPacket(
       std::unique_ptr<model::packets::LinkLayerPacketBuilder> packet);
-  void SendLinkLayerPacket(
+  void SendLeLinkLayerPacketWithRssi(
+      Address source_address, Address destination_address, uint8_t rssi,
       std::unique_ptr<model::packets::LinkLayerPacketBuilder> packet);
+
   void IncomingAclPacket(model::packets::LinkLayerPacketView packet);
   void IncomingScoPacket(model::packets::LinkLayerPacketView packet);
   void IncomingDisconnectPacket(model::packets::LinkLayerPacketView packet);
@@ -390,21 +550,42 @@
                              uint8_t rssi);
   void IncomingInquiryResponsePacket(
       model::packets::LinkLayerPacketView packet);
+#ifdef ROOTCANAL_LMP
+  void IncomingLmpPacket(model::packets::LinkLayerPacketView packet);
+#else
   void IncomingIoCapabilityRequestPacket(
       model::packets::LinkLayerPacketView packet);
   void IncomingIoCapabilityResponsePacket(
       model::packets::LinkLayerPacketView packet);
   void IncomingIoCapabilityNegativeResponsePacket(
       model::packets::LinkLayerPacketView packet);
+  void IncomingKeypressNotificationPacket(
+      model::packets::LinkLayerPacketView packet);
+  void IncomingPasskeyPacket(model::packets::LinkLayerPacketView packet);
+  void IncomingPasskeyFailedPacket(model::packets::LinkLayerPacketView packet);
+  void IncomingPinRequestPacket(model::packets::LinkLayerPacketView packet);
+  void IncomingPinResponsePacket(model::packets::LinkLayerPacketView packet);
+#endif /* ROOTCANAL_LMP */
   void IncomingIsoPacket(model::packets::LinkLayerPacketView packet);
   void IncomingIsoConnectionRequestPacket(
       model::packets::LinkLayerPacketView packet);
   void IncomingIsoConnectionResponsePacket(
       model::packets::LinkLayerPacketView packet);
-  void IncomingKeypressNotificationPacket(
-      model::packets::LinkLayerPacketView packet);
-  void IncomingLeAdvertisementPacket(model::packets::LinkLayerPacketView packet,
-                                     uint8_t rssi);
+
+  void ScanIncomingLeLegacyAdvertisingPdu(
+      model::packets::LeLegacyAdvertisingPduView& pdu, uint8_t rssi);
+  void ScanIncomingLeExtendedAdvertisingPdu(
+      model::packets::LeExtendedAdvertisingPduView& pdu, uint8_t rssi);
+  void ConnectIncomingLeLegacyAdvertisingPdu(
+      model::packets::LeLegacyAdvertisingPduView& pdu);
+  void ConnectIncomingLeExtendedAdvertisingPdu(
+      model::packets::LeExtendedAdvertisingPduView& pdu);
+
+  void IncomingLeLegacyAdvertisingPdu(
+      model::packets::LinkLayerPacketView packet, uint8_t rssi);
+  void IncomingLeExtendedAdvertisingPdu(
+      model::packets::LinkLayerPacketView packet, uint8_t rssi);
+
   void IncomingLeConnectPacket(model::packets::LinkLayerPacketView packet);
   void IncomingLeConnectCompletePacket(
       model::packets::LinkLayerPacketView packet);
@@ -418,16 +599,29 @@
   void IncomingLeReadRemoteFeatures(model::packets::LinkLayerPacketView packet);
   void IncomingLeReadRemoteFeaturesResponse(
       model::packets::LinkLayerPacketView packet);
+
+  void ProcessIncomingLegacyScanRequest(
+      AddressWithType scanning_address,
+      AddressWithType resolved_scanning_address,
+      AddressWithType advertising_address);
+  void ProcessIncomingExtendedScanRequest(
+      ExtendedAdvertiser const& advertiser, AddressWithType scanning_address,
+      AddressWithType resolved_scanning_address,
+      AddressWithType advertising_address);
+
+  bool ProcessIncomingLegacyConnectRequest(
+      model::packets::LeConnectView const& connect_ind);
+  bool ProcessIncomingExtendedConnectRequest(
+      ExtendedAdvertiser& advertiser,
+      model::packets::LeConnectView const& connect_ind);
+
   void IncomingLeScanPacket(model::packets::LinkLayerPacketView packet);
+
   void IncomingLeScanResponsePacket(model::packets::LinkLayerPacketView packet,
                                     uint8_t rssi);
   void IncomingPagePacket(model::packets::LinkLayerPacketView packet);
   void IncomingPageRejectPacket(model::packets::LinkLayerPacketView packet);
   void IncomingPageResponsePacket(model::packets::LinkLayerPacketView packet);
-  void IncomingPasskeyPacket(model::packets::LinkLayerPacketView packet);
-  void IncomingPasskeyFailedPacket(model::packets::LinkLayerPacketView packet);
-  void IncomingPinRequestPacket(model::packets::LinkLayerPacketView packet);
-  void IncomingPinResponsePacket(model::packets::LinkLayerPacketView packet);
   void IncomingReadRemoteLmpFeatures(
       model::packets::LinkLayerPacketView packet);
   void IncomingReadRemoteLmpFeaturesResponse(
@@ -455,8 +649,226 @@
       model::packets::LinkLayerPacketView packet);
   void IncomingScoDisconnect(model::packets::LinkLayerPacketView packet);
 
+  void IncomingPingRequest(model::packets::LinkLayerPacketView packet);
+
+ public:
+  bool IsEventUnmasked(bluetooth::hci::EventCode event) const;
+  bool IsLeEventUnmasked(bluetooth::hci::SubeventCode subevent) const;
+
+  // TODO
+  // The Clock Offset should be specific to an ACL connection.
+  // Returning a proper value is not that important.
+  uint32_t GetClockOffset() const { return 0; }
+
+  // TODO
+  // The Page Scan Repetition Mode should be specific to an ACL connection or
+  // a paging session.
+  PageScanRepetitionMode GetPageScanRepetitionMode() const {
+    return page_scan_repetition_mode_;
+  }
+
+  // TODO
+  // The Encryption Key Size should be specific to an ACL connection.
+  uint8_t GetEncryptionKeySize() const { return min_encryption_key_size_; }
+
+  bool GetScoFlowControlEnable() const { return sco_flow_control_enable_; }
+
+  AuthenticationEnable GetAuthenticationEnable() {
+    return authentication_enable_;
+  }
+
+  std::array<uint8_t, 248> const& GetLocalName() { return local_name_; }
+
+  uint64_t GetLeSupportedFeatures() const {
+    return properties_.le_features | le_host_supported_features_;
+  }
+
+  uint16_t GetConnectionAcceptTimeout() const {
+    return connection_accept_timeout_;
+  }
+
+  uint16_t GetVoiceSetting() const { return voice_setting_; }
+  const ClassOfDevice& GetClassOfDevice() const { return class_of_device_; }
+
+  uint8_t GetMaxLmpFeaturesPageNumber() {
+    return properties_.lmp_features.size() - 1;
+  }
+
+  uint64_t GetLmpFeatures(uint8_t page_number = 0) {
+    return page_number == 1 ? host_supported_features_
+                            : properties_.lmp_features[page_number];
+  }
+
+  void SetLocalName(std::vector<uint8_t> const& local_name);
+  void SetLocalName(std::array<uint8_t, 248> const& local_name);
+  void SetExtendedInquiryResponse(
+      std::vector<uint8_t> const& extended_inquiry_response);
+
+  void SetClassOfDevice(ClassOfDevice class_of_device) {
+    class_of_device_ = class_of_device;
+  }
+
+  void SetClassOfDevice(uint32_t class_of_device) {
+    class_of_device_.cod[0] = class_of_device & 0xff;
+    class_of_device_.cod[1] = (class_of_device >> 8) & 0xff;
+    class_of_device_.cod[2] = (class_of_device >> 16) & 0xff;
+  }
+
+  void SetAuthenticationEnable(AuthenticationEnable enable) {
+    authentication_enable_ = enable;
+  }
+
+  void SetScoFlowControlEnable(bool enable) {
+    sco_flow_control_enable_ = enable;
+  }
+  void SetVoiceSetting(uint16_t voice_setting) {
+    voice_setting_ = voice_setting;
+  }
+  void SetEventMask(uint64_t event_mask) { event_mask_ = event_mask; }
+
+  void SetEventMaskPage2(uint64_t event_mask) {
+    event_mask_page_2_ = event_mask;
+  }
+  void SetLeEventMask(uint64_t le_event_mask) {
+    le_event_mask_ = le_event_mask;
+  }
+
+  void SetLeHostSupport(bool enable);
+  void SetSecureSimplePairingSupport(bool enable);
+  void SetSecureConnectionsSupport(bool enable);
+
+  void SetConnectionAcceptTimeout(uint16_t timeout) {
+    connection_accept_timeout_ = timeout;
+  }
+
+  bool LegacyAdvertising() const { return legacy_advertising_in_use_; }
+  bool ExtendedAdvertising() const { return extended_advertising_in_use_; }
+
+  bool SelectLegacyAdvertising() {
+    if (extended_advertising_in_use_) {
+      return false;
+    } else {
+      legacy_advertising_in_use_ = true;
+      return true;
+    }
+  }
+
+  bool SelectExtendedAdvertising() {
+    if (legacy_advertising_in_use_) {
+      return false;
+    } else {
+      extended_advertising_in_use_ = true;
+      return true;
+    }
+  }
+
+  uint16_t GetLeSuggestedMaxTxOctets() const {
+    return le_suggested_max_tx_octets_;
+  }
+  uint16_t GetLeSuggestedMaxTxTime() const { return le_suggested_max_tx_time_; }
+
+  void SetLeSuggestedMaxTxOctets(uint16_t max_tx_octets) {
+    le_suggested_max_tx_octets_ = max_tx_octets;
+  }
+  void SetLeSuggestedMaxTxTime(uint16_t max_tx_time) {
+    le_suggested_max_tx_time_ = max_tx_time;
+  }
+
+  AsyncTaskId StartScoStream(Address address);
+
  private:
-  const DeviceProperties& properties_;
+  const Address& address_;
+  const ControllerProperties& properties_;
+
+  // Host Supported Features (Vol 2, Part C § 3.3 Feature Mask Definition).
+  // Page 1 of the LMP feature mask.
+  uint64_t host_supported_features_{0};
+  bool le_host_support_{false};
+  bool secure_simple_pairing_host_support_{false};
+  bool secure_connections_host_support_{false};
+
+  // Le Host Supported Features (Vol 4, Part E § 7.8.3).
+  // Specifies the bits indicating Host support.
+  uint64_t le_host_supported_features_{0};
+  bool connected_isochronous_stream_host_support_{false};
+  bool connection_subrating_host_support_{false};
+
+  // LE Random Address (Vol 4, Part E § 7.8.4).
+  Address random_address_{Address::kEmpty};
+
+  // HCI configuration parameters.
+  //
+  // Provide the current HCI Configuration Parameters as defined in section
+  // Vol 4, Part E § 6 of the core specification.
+
+  // Scan Enable (Vol 4, Part E § 6.1).
+  bool page_scan_enable_{false};
+  bool inquiry_scan_enable_{false};
+
+  // Inquiry Scan Interval and Window
+  // (Vol 4, Part E § 6.2, 6.3).
+  uint16_t inquiry_scan_interval_{0x1000};
+  uint16_t inquiry_scan_window_{0x0012};
+
+  // Page Timeout (Vol 4, Part E § 6.6).
+  uint16_t page_timeout_{0x2000};
+
+  // Connection Accept Timeout (Vol 4, Part E § 6.7).
+  uint16_t connection_accept_timeout_{0x1FA0};
+
+  // Page Scan Interval and Window
+  // (Vol 4, Part E § 6.8, 6.9).
+  uint16_t page_scan_interval_{0x0800};
+  uint16_t page_scan_window_{0x0012};
+
+  // Voice Setting (Vol 4, Part E § 6.12).
+  uint16_t voice_setting_{0x0060};
+
+  // Authentication Enable (Vol 4, Part E § 6.16).
+  AuthenticationEnable authentication_enable_{
+      AuthenticationEnable::NOT_REQUIRED};
+
+  // Default Link Policy Settings (Vol 4, Part E § 6.18).
+  uint8_t default_link_policy_settings_{0x0000};
+
+  // Synchronous Flow Control Enable (Vol 4, Part E § 6.22).
+  bool sco_flow_control_enable_{false};
+
+  // Local Name (Vol 4, Part E § 6.23).
+  std::array<uint8_t, 248> local_name_{};
+
+  // Extended Inquiry Response (Vol 4, Part E § 6.24).
+  std::array<uint8_t, 240> extended_inquiry_response_{};
+
+  // Class of Device (Vol 4, Part E § 6.26).
+  ClassOfDevice class_of_device_{{0, 0, 0}};
+
+  // Other configuration parameters.
+
+  // Current IAC LAP (Vol 4, Part E § 7.3.44).
+  std::vector<bluetooth::hci::Lap> current_iac_lap_list_{};
+
+  // Min Encryption Key Size (Vol 4, Part E § 7.3.102).
+  uint8_t min_encryption_key_size_{16};
+
+  // Event Mask (Vol 4, Part E § 7.3.1) and
+  // Event Mask Page 2 (Vol 4, Part E § 7.3.69) and
+  // LE Event Mask (Vol 4, Part E § 7.8.1).
+  uint64_t event_mask_{0x00001fffffffffff};
+  uint64_t event_mask_page_2_{0x0};
+  uint64_t le_event_mask_{0x01f};
+
+  // Suggested Default Data Length (Vol 4, Part E § 7.8.34).
+  uint16_t le_suggested_max_tx_octets_{0x001b};
+  uint16_t le_suggested_max_tx_time_{0x0148};
+
+  // Resolvable Private Address Timeout (Vol 4, Part E § 7.8.45).
+  std::chrono::seconds resolvable_private_address_timeout_{0x0384};
+
+  // Page Scan Repetition Mode (Vol 2 Part B § 8.3.1 Page Scan substate).
+  // The Page Scan Repetition Mode depends on the selected Page Scan Interval.
+  PageScanRepetitionMode page_scan_repetition_mode_{PageScanRepetitionMode::R0};
+
   AclConnectionHandler connections_;
 
   // Callbacks to schedule tasks.
@@ -479,61 +891,147 @@
                      Phy::Type phy_type)>
       send_to_remote_;
 
-  uint32_t oob_id_ = 1;
-  uint32_t key_id_ = 1;
+  uint32_t oob_id_{1};
+  uint32_t key_id_{1};
 
-  // LE state
-  struct ConnectListEntry {
+  struct FilterAcceptListEntry {
+    FilterAcceptListAddressType address_type;
     Address address;
-    AddressType address_type;
   };
-  std::vector<ConnectListEntry> le_connect_list_;
+
+  std::vector<FilterAcceptListEntry> le_filter_accept_list_;
+
   struct ResolvingListEntry {
-    Address address;
-    AddressType address_type;
+    PeerAddressType peer_identity_address_type;
+    Address peer_identity_address;
     std::array<uint8_t, kIrkSize> peer_irk;
     std::array<uint8_t, kIrkSize> local_irk;
+    bluetooth::hci::PrivacyMode privacy_mode;
   };
+
   std::vector<ResolvingListEntry> le_resolving_list_;
   bool le_resolving_list_enabled_{false};
 
-  Address le_connecting_rpa_;
+  // Flag set when any legacy advertising command has been received
+  // since the last power-on-reset.
+  // From Vol 4, Part E § 3.1.1 Legacy and extended advertising,
+  // extended advertising are rejected when this bit is set.
+  bool legacy_advertising_in_use_{false};
 
-  std::array<LeAdvertiser, 7> advertisers_;
+  // Flag set when any extended advertising command has been received
+  // since the last power-on-reset.
+  // From Vol 4, Part E § 3.1.1 Legacy and extended advertising,
+  // legacy advertising are rejected when this bit is set.
+  bool extended_advertising_in_use_{false};
 
-  bluetooth::hci::OpCode le_scan_enable_{bluetooth::hci::OpCode::NONE};
-  uint8_t le_scan_type_{};
-  uint16_t le_scan_interval_{};
-  uint16_t le_scan_window_{};
-  uint8_t le_scan_filter_policy_{};
-  uint8_t le_scan_filter_duplicates_{};
-  bluetooth::hci::OwnAddressType le_address_type_{};
+  // Legacy advertising state.
+  LegacyAdvertiser legacy_advertiser_{};
 
-  bool le_connect_{false};
-  uint16_t le_connection_interval_min_{};
-  uint16_t le_connection_interval_max_{};
-  uint16_t le_connection_latency_{};
-  uint16_t le_connection_supervision_timeout_{};
-  uint16_t le_connection_minimum_ce_length_{};
-  uint16_t le_connection_maximum_ce_length_{};
-  uint8_t le_initiator_filter_policy_{};
+  // Extended advertising sets.
+  std::unordered_map<uint8_t, ExtendedAdvertiser> extended_advertisers_{};
 
-  Address le_peer_address_{};
-  uint8_t le_peer_address_type_{};
+  struct Scanner {
+    bool scan_enable;
+    std::chrono::steady_clock::duration period;
+    std::chrono::steady_clock::duration duration;
+    bluetooth::hci::FilterDuplicates filter_duplicates;
+    bluetooth::hci::OwnAddressType own_address_type;
+    bluetooth::hci::LeScanningFilterPolicy scan_filter_policy;
+
+    struct PhyParameters {
+      bool enabled;
+      bluetooth::hci::LeScanType scan_type;
+      uint16_t scan_interval;
+      uint16_t scan_window;
+    };
+
+    PhyParameters le_1m_phy;
+    PhyParameters le_coded_phy;
+
+    // Save information about the advertising PDU being scanned.
+    bool connectable_scan_response;
+    std::optional<AddressWithType> pending_scan_request{};
+
+    // Time keeping
+    std::optional<std::chrono::steady_clock::time_point> timeout;
+    std::optional<std::chrono::steady_clock::time_point> periodical_timeout;
+
+    // Packet History
+    std::vector<model::packets::LinkLayerPacketView> history;
+
+    bool IsEnabled() const { return scan_enable; }
+
+    bool IsPacketInHistory(model::packets::LinkLayerPacketView packet) const {
+      return std::any_of(
+          history.begin(), history.end(),
+          [packet](model::packets::LinkLayerPacketView const& a) {
+            return a.size() == packet.size() &&
+                   std::equal(a.begin(), a.end(), packet.begin());
+          });
+    }
+    void AddPacketToHistory(model::packets::LinkLayerPacketView packet) {
+      history.push_back(packet);
+    }
+  };
+
+  // Legacy and extended scanning properties.
+  // Legacy and extended scanning are disambiguated by the use
+  // of legacy_advertising_in_use_ and extended_advertising_in_use_ flags.
+  // Only one type of advertising may be used during a controller session.
+  Scanner scanner_{};
+
+  struct Initiator {
+    bool connect_enable;
+    bluetooth::hci::InitiatorFilterPolicy initiator_filter_policy;
+    bluetooth::hci::AddressWithType peer_address{};
+    bluetooth::hci::OwnAddressType own_address_type;
+
+    struct PhyParameters {
+      bool enabled;
+      uint16_t scan_interval;
+      uint16_t scan_window;
+      uint16_t connection_interval_min;
+      uint16_t connection_interval_max;
+      uint16_t max_latency;
+      uint16_t supervision_timeout;
+      uint16_t min_ce_length;
+      uint16_t max_ce_length;
+    };
+
+    PhyParameters le_1m_phy;
+    PhyParameters le_2m_phy;
+    PhyParameters le_coded_phy;
+
+    // Save information about the ongoing connection.
+    Address initiating_address{};  // TODO: AddressWithType
+    std::optional<AddressWithType> pending_connect_request{};
+
+    bool IsEnabled() const { return connect_enable; }
+    void Disable() { connect_enable = false; }
+  };
+
+  // Legacy and extended initiating properties.
+  // Legacy and extended initiating are disambiguated by the use
+  // of legacy_advertising_in_use_ and extended_advertising_in_use_ flags.
+  // Only one type of advertising may be used during a controller session.
+  Initiator initiator_{};
 
   // Classic state
-
+#ifdef ROOTCANAL_LMP
+  std::unique_ptr<const LinkManager, void (*)(const LinkManager*)> lm_;
+  struct LinkManagerOps ops_;
+#else
   SecurityManager security_manager_{10};
+#endif /* ROOTCANAL_LMP */
+
+  AsyncTaskId page_timeout_task_id_ = kInvalidTaskId;
+
   std::chrono::steady_clock::time_point last_inquiry_;
   model::packets::InquiryType inquiry_mode_{
       model::packets::InquiryType::STANDARD};
   AsyncTaskId inquiry_timer_task_id_ = kInvalidTaskId;
   uint64_t inquiry_lap_{};
   uint8_t inquiry_max_responses_{};
-  uint16_t default_link_policy_settings_ = 0;
-
-  bool page_scans_enabled_{false};
-  bool inquiry_scans_enabled_{false};
 };
 
 }  // namespace rootcanal
diff --git a/tools/rootcanal/model/controller/sco_connection.cc b/tools/rootcanal/model/controller/sco_connection.cc
index 2b73b58..6cff42d 100644
--- a/tools/rootcanal/model/controller/sco_connection.cc
+++ b/tools/rootcanal/model/controller/sco_connection.cc
@@ -17,7 +17,7 @@
 #include "sco_connection.h"
 
 #include <hci/hci_packets.h>
-#include <os/log.h>
+#include <log.h>
 
 #include <vector>
 
@@ -185,14 +185,8 @@
 
   uint8_t transmission_interval;
   uint16_t packet_length;
-  unsigned latency = 1250;
   uint8_t air_coding = voice_setting & 0x3;
 
-  if (max_latency != 0xffff && max_latency < latency) {
-    LOG_WARN("SCO Max latency must be less than 1250 us");
-    return {};
-  }
-
   if (packet_type & (uint16_t)SynchronousPacketTypeBits::HV3_ALLOWED) {
     transmission_interval = 6;
     packet_length = 30;
@@ -233,7 +227,9 @@
     return false;
   }
 
-  if (peer.voice_setting != parameters_.voice_setting) {
+  // mask out the air coding format bits before comparison, as per 5.3 Vol
+  // 4E 6.12
+  if ((peer.voice_setting & ~0x3) != (parameters_.voice_setting & ~0x3)) {
     LOG_WARN("Voice setting requirements cannot be met");
     LOG_WARN("Remote voice setting: 0x%04x",
              static_cast<unsigned>(parameters_.voice_setting));
@@ -311,3 +307,17 @@
   }
   return link_parameters.has_value();
 }
+
+void ScoConnection::StartStream(std::function<AsyncTaskId()> startStream) {
+  ASSERT(!stream_handle_.has_value());
+  if (datapath_ == ScoDatapath::SPOOFED) {
+    stream_handle_ = startStream();
+  }
+}
+
+void ScoConnection::StopStream(std::function<void(AsyncTaskId)> stopStream) {
+  if (stream_handle_.has_value()) {
+    stopStream(*stream_handle_);
+  }
+  stream_handle_ = std::nullopt;
+}
diff --git a/tools/rootcanal/model/controller/sco_connection.h b/tools/rootcanal/model/controller/sco_connection.h
index eae1629..2482291 100644
--- a/tools/rootcanal/model/controller/sco_connection.h
+++ b/tools/rootcanal/model/controller/sco_connection.h
@@ -20,6 +20,7 @@
 #include <optional>
 
 #include "hci/address.h"
+#include "model/setup/async_manager.h"
 
 namespace rootcanal {
 
@@ -74,14 +75,20 @@
   SCO_STATE_OPENED,
 };
 
+enum ScoDatapath {
+  NORMAL = 0,   // data is provided by the host over HCI
+  SPOOFED = 1,  // rootcanal generates data itself
+};
+
 class ScoConnection {
  public:
   ScoConnection(Address address, ScoConnectionParameters const& parameters,
-                ScoState state, bool legacy = false)
+                ScoState state, ScoDatapath datapath, bool legacy)
       : address_(address),
         parameters_(parameters),
         link_parameters_(),
         state_(state),
+        datapath_(datapath),
         legacy_(legacy) {}
 
   virtual ~ScoConnection() = default;
@@ -91,6 +98,9 @@
   ScoState GetState() const { return state_; }
   void SetState(ScoState state) { state_ = state; }
 
+  void StartStream(std::function<AsyncTaskId()> startStream);
+  void StopStream(std::function<void(AsyncTaskId)> stopStream);
+
   ScoConnectionParameters GetConnectionParameters() const {
     return parameters_;
   }
@@ -104,12 +114,21 @@
   // Return true if the negotiation was successful, false otherwise.
   bool NegotiateLinkParameters(ScoConnectionParameters const& peer);
 
+  ScoDatapath GetDatapath() const { return datapath_; }
+
  private:
   Address address_;
   ScoConnectionParameters parameters_;
   ScoLinkParameters link_parameters_;
   ScoState state_;
 
+  // whether we use HCI, spoof the data, or potential future datapaths
+  ScoDatapath datapath_;
+
+  // The handle of the async task managing the SCO stream, used to simulate
+  // offloaded input. None if HCI is used for input packets.
+  std::optional<AsyncTaskId> stream_handle_{};
+
   // Mark connections opened with the HCI command Add SCO Connection.
   // The connection status is reported with HCI Connection Complete event
   // rather than HCI Synchronous Connection Complete event.
diff --git a/tools/rootcanal/model/controller/security_manager.cc b/tools/rootcanal/model/controller/security_manager.cc
index 72ba38a..fcd4c17 100644
--- a/tools/rootcanal/model/controller/security_manager.cc
+++ b/tools/rootcanal/model/controller/security_manager.cc
@@ -16,7 +16,7 @@
 
 #include "security_manager.h"
 
-#include "os/log.h"
+#include "log.h"
 
 using std::vector;
 
diff --git a/tools/rootcanal/model/controller/vendor/csr.h b/tools/rootcanal/model/controller/vendor/csr.h
new file mode 100644
index 0000000..20aa832
--- /dev/null
+++ b/tools/rootcanal/model/controller/vendor/csr.h
@@ -0,0 +1,38 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include <cstdint>
+
+namespace rootcanal {
+
+// CSR Vendor command opcode.
+static constexpr uint16_t CSR_VENDOR = 0xfc00;
+
+enum CsrVarid : uint16_t {
+  CSR_VARID_BUILDID = 0x2819,
+  CSR_VARID_PS = 0x7003,
+};
+
+enum CsrPskey : uint16_t {
+  CSR_PSKEY_ENC_KEY_LMIN = 0x00da,
+  CSR_PSKEY_ENC_KEY_LMAX = 0x00db,
+  CSR_PSKEY_LOCAL_SUPPORTED_FEATURES = 0x00ef,
+  CSR_PSKEY_HCI_LMP_LOCAL_VERSION = 0x010d,
+};
+
+}  // namespace rootcanal
diff --git a/tools/rootcanal/model/devices/baseband_sniffer.cc b/tools/rootcanal/model/devices/baseband_sniffer.cc
new file mode 100644
index 0000000..17cee65
--- /dev/null
+++ b/tools/rootcanal/model/devices/baseband_sniffer.cc
@@ -0,0 +1,173 @@
+/*
+ * Copyright 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "baseband_sniffer.h"
+
+#include "log.h"
+#include "packet/raw_builder.h"
+#include "pcap.h"
+
+using std::vector;
+
+namespace rootcanal {
+
+#include "bredr_bb.h"
+
+BaseBandSniffer::BaseBandSniffer(const std::string& filename) {
+  output_.open(filename, std::ios::binary);
+
+  uint32_t linktype = 255;  // http://www.tcpdump.org/linktypes.html
+                            // LINKTYPE_BLUETOOTH_BREDR_BB
+
+  pcap::WriteHeader(output_, linktype);
+  output_.flush();
+}
+
+void BaseBandSniffer::TimerTick() {}
+
+void BaseBandSniffer::AppendRecord(
+    std::unique_ptr<bredr_bb::BaseBandPacketBuilder> packet) {
+  auto bytes = std::vector<uint8_t>();
+  bytes.reserve(packet->size());
+  bluetooth::packet::BitInserter i(bytes);
+  packet->Serialize(i);
+
+  pcap::WriteRecordHeader(output_, bytes.size());
+  output_.write((char*)bytes.data(), bytes.size());
+  output_.flush();
+}
+
+static uint8_t ReverseByte(uint8_t b) {
+  static uint8_t lookup[16] = {
+      [0b0000] = 0b0000, [0b0001] = 0b1000, [0b0010] = 0b0100,
+      [0b0011] = 0b1100, [0b0100] = 0b0010, [0b0101] = 0b1010,
+      [0b0110] = 0b0110, [0b0111] = 0b1110, [0b1000] = 0b0001,
+      [0b1001] = 0b1001, [0b1010] = 0b0101, [0b1011] = 0b1101,
+      [0b1100] = 0b0011, [0b1101] = 0b1011, [0b1110] = 0b0111,
+      [0b1111] = 0b1111,
+  };
+
+  return (lookup[b & 0xF] << 4) | lookup[b >> 4];
+}
+
+static uint8_t HeaderErrorCheck(uint8_t uap, uint32_t data) {
+  // See Bluetooth Core, Vol 2, Part B, 7.1.1
+
+  uint8_t value = ReverseByte(uap);
+
+  for (auto i = 0; i < 10; i++) {
+    bool bit = (value ^ data) & 1;
+    data >>= 1;
+    value >>= 1;
+    if (bit) value ^= 0xe5;
+  }
+
+  return value;
+}
+
+static uint32_t BuildBtPacketHeader(uint8_t uap, uint8_t lt_addr,
+                                    uint8_t packet_type, bool flow, bool arqn,
+                                    bool seqn) {
+  // See Bluetooth Core, Vol2, Part B, 6.4
+
+  uint32_t header = (lt_addr & 0x7) | ((packet_type & 0xF) << 3) | (flow << 7) |
+                    (arqn << 8) | (seqn << 9);
+
+  header |= (HeaderErrorCheck(uap, header) << 10);
+
+  return header;
+}
+
+void BaseBandSniffer::IncomingPacket(
+    model::packets::LinkLayerPacketView packet) {
+  auto packet_type = packet.GetType();
+  auto address = packet.GetSourceAddress();
+
+  // Bluetooth Core, Vol2, Part B, 1.2, Figure 1.5
+  uint32_t lap =
+      address.data()[0] | (address.data()[1] << 8) | (address.data()[2] << 16);
+  uint8_t uap = address.data()[3];
+  uint16_t nap = address.data()[4] | (address.data()[5] << 8);
+
+  // http://www.whiterocker.com/bt/LINKTYPE_BLUETOOTH_BREDR_BB.html
+  uint16_t flags =
+      /* BT Packet Header and BR or EDR Payload are de-whitened */ 0x0001 |
+      /* BR or EDR Payload is decrypted */ 0x0008 |
+      /* Reference LAP is valid and led to this packet being captured */
+      0x0010 |
+      /* BR or EDR Payload is present and follows this field */ 0x0020 |
+      /* Reference UAP field is valid for HEC and CRC checking */ 0x0080 |
+      /* CRC portion of the BR or EDR Payload was checked */ 0x0400 |
+      /* CRC portion of the BR or EDR Payload passed its check */ 0x0800;
+
+  uint8_t lt_addr = 0;
+
+  uint8_t rf_channel = 0;
+  uint8_t signal_power = 0;
+  uint8_t noise_power = 0;
+  uint8_t access_code_offenses = 0;
+  uint8_t corrected_header_bits = 0;
+  uint16_t corrected_payload_bits = 0;
+  uint8_t lower_address_part = lap;
+  uint8_t reference_lap = lap;
+  uint8_t reference_uap = uap;
+
+  if (packet_type == model::packets::PacketType::PAGE) {
+    auto page_view = model::packets::PageView::Create(packet);
+    ASSERT(page_view.IsValid());
+
+    uint8_t bt_packet_type = 0b0010;  // FHS
+
+    AppendRecord(bredr_bb::FHSAclPacketBuilder::Create(
+        rf_channel, signal_power, noise_power, access_code_offenses,
+        corrected_header_bits, corrected_payload_bits, lower_address_part,
+        reference_lap, reference_uap,
+        BuildBtPacketHeader(uap, lt_addr, bt_packet_type, true, true, true),
+        flags,
+        0,  // parity_bits
+        lap,
+        0,  // eir
+        0,  // sr
+        0,  // sp
+        uap, nap, page_view.GetClassOfDevice().ToUint32Legacy(),
+        1,  // lt_addr
+        0,  // clk
+        0,  // page_scan_mode
+        0   // crc
+        ));
+  } else if (packet_type == model::packets::PacketType::LMP) {
+    auto lmp_view = model::packets::LmpView::Create(packet);
+    ASSERT(lmp_view.IsValid());
+    auto lmp_bytes = std::vector<uint8_t>(lmp_view.GetPayload().begin(),
+                                          lmp_view.GetPayload().end());
+
+    uint8_t bt_packet_type = 0b0011;  // DM1
+
+    AppendRecord(bredr_bb::DM1AclPacketBuilder::Create(
+        rf_channel, signal_power, noise_power, access_code_offenses,
+        corrected_header_bits, corrected_payload_bits, lower_address_part,
+        reference_lap, reference_uap,
+        BuildBtPacketHeader(uap, lt_addr, bt_packet_type, true, true, true),
+        flags,
+        0x3,  // llid
+        1,    // flow
+        std::make_unique<bluetooth::packet::RawBuilder>(lmp_bytes),
+        0  // crc
+        ));
+  }
+}
+
+}  // namespace rootcanal
diff --git a/tools/rootcanal/model/devices/baseband_sniffer.h b/tools/rootcanal/model/devices/baseband_sniffer.h
new file mode 100644
index 0000000..be66a31
--- /dev/null
+++ b/tools/rootcanal/model/devices/baseband_sniffer.h
@@ -0,0 +1,58 @@
+/*
+ * Copyright 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include <cstdint>
+#include <fstream>
+
+#include "device.h"
+
+namespace rootcanal {
+
+namespace bredr_bb {
+namespace {
+class BaseBandPacketBuilder;
+}
+}  // namespace bredr_bb
+
+using ::bluetooth::hci::Address;
+
+class BaseBandSniffer : public Device {
+ public:
+  BaseBandSniffer(const std::string& filename);
+  ~BaseBandSniffer() = default;
+
+  static std::shared_ptr<BaseBandSniffer> Create(const std::string& filename) {
+    return std::make_shared<BaseBandSniffer>(filename);
+  }
+
+  // Return a string representation of the type of device.
+  virtual std::string GetTypeString() const override {
+    return "baseband_sniffer";
+  }
+
+  virtual void IncomingPacket(
+      model::packets::LinkLayerPacketView packet) override;
+
+  virtual void TimerTick() override;
+
+ private:
+  void AppendRecord(std::unique_ptr<bredr_bb::BaseBandPacketBuilder> record);
+  std::ofstream output_;
+};
+
+}  // namespace rootcanal
diff --git a/tools/rootcanal/model/devices/beacon.cc b/tools/rootcanal/model/devices/beacon.cc
index 00a6983..60fa91d 100644
--- a/tools/rootcanal/model/devices/beacon.cc
+++ b/tools/rootcanal/model/devices/beacon.cc
@@ -18,76 +18,58 @@
 
 #include "model/setup/device_boutique.h"
 
-using std::vector;
-
 namespace rootcanal {
+using namespace model::packets;
+using namespace std::chrono_literals;
 
 bool Beacon::registered_ = DeviceBoutique::Register("beacon", &Beacon::Create);
 
-Beacon::Beacon() {
-  advertising_interval_ms_ = std::chrono::milliseconds(1280);
-  properties_.SetLeAdvertisementType(0x03 /* NON_CONNECT */);
-  properties_.SetLeAdvertisement(
-      {0x0F,  // Length
-       0x09 /* TYPE_NAME_CMPL */, 'g', 'D', 'e', 'v', 'i', 'c', 'e', '-', 'b',
-       'e', 'a', 'c', 'o', 'n',
-       0x02,  // Length
-       0x01 /* TYPE_FLAG */,
-       0x4 /* BREDR_NOT_SPT */ | 0x2 /* GEN_DISC_FLAG */});
+Beacon::Beacon()
+    : advertising_type_(LegacyAdvertisingType::ADV_NONCONN_IND),
+      advertising_data_({
+          0x0F /* Length */, 0x09 /* TYPE_NAME_COMPLETE */, 'g', 'D', 'e', 'v',
+          'i', 'c', 'e', '-', 'b', 'e', 'a', 'c', 'o', 'n', 0x02 /* Length */,
+          0x01 /* TYPE_FLAG */,
+          0x4 /* BREDR_NOT_SUPPORTED */ | 0x2 /* GENERAL_DISCOVERABLE */
+      }),
+      scan_response_data_(
+          {0x05 /* Length */, 0x08 /* TYPE_NAME_SHORT */, 'b', 'e', 'a', 'c'}),
+      advertising_interval_(1280ms) {}
 
-  properties_.SetLeScanResponse({0x05,  // Length
-                                 0x08 /* TYPE_NAME_SHORT */, 'b', 'e', 'a',
-                                 'c'});
-}
-
-Beacon::Beacon(const vector<std::string>& args) : Beacon() {
+Beacon::Beacon(const std::vector<std::string>& args) : Beacon() {
   if (args.size() >= 2) {
-    Address addr{};
-    if (Address::FromString(args[1], addr)) properties_.SetLeAddress(addr);
+    Address::FromString(args[1], address_);
   }
 
   if (args.size() >= 3) {
-    SetAdvertisementInterval(std::chrono::milliseconds(std::stoi(args[2])));
+    advertising_interval_ = std::chrono::milliseconds(std::stoi(args[2]));
   }
 }
 
-std::string Beacon::GetTypeString() const { return "beacon"; }
-
-std::string Beacon::ToString() const {
-  std::string dev =
-      GetTypeString() + "@" + properties_.GetLeAddress().ToString();
-
-  return dev;
-}
-
 void Beacon::TimerTick() {
-  if (IsAdvertisementAvailable()) {
-    last_advertisement_ = std::chrono::steady_clock::now();
-    auto ad = model::packets::LeAdvertisementBuilder::Create(
-        properties_.GetLeAddress(), Address::kEmpty,
-        model::packets::AddressType::PUBLIC,
-        static_cast<model::packets::AdvertisementType>(
-            properties_.GetLeAdvertisementType()),
-        properties_.GetLeAdvertisement());
-    std::shared_ptr<model::packets::LinkLayerPacketBuilder> to_send =
-        std::move(ad);
-
-    SendLinkLayerPacket(to_send, Phy::Type::LOW_ENERGY);
+  std::chrono::steady_clock::time_point now = std::chrono::steady_clock::now();
+  if ((now - advertising_last_) >= advertising_interval_) {
+    advertising_last_ = now;
+    SendLinkLayerPacket(
+        std::move(LeLegacyAdvertisingPduBuilder::Create(
+            address_, Address::kEmpty, AddressType::PUBLIC, AddressType::PUBLIC,
+            advertising_type_,
+            std::vector(advertising_data_.begin(), advertising_data_.end()))),
+        Phy::Type::LOW_ENERGY);
   }
 }
 
-void Beacon::IncomingPacket(model::packets::LinkLayerPacketView packet) {
-  if (packet.GetDestinationAddress() == properties_.GetLeAddress() &&
-      packet.GetType() == model::packets::PacketType::LE_SCAN) {
-    auto scan_response = model::packets::LeScanResponseBuilder::Create(
-        properties_.GetLeAddress(), packet.GetSourceAddress(),
-        model::packets::AddressType::PUBLIC,
-        model::packets::AdvertisementType::SCAN_RESPONSE,
-        properties_.GetLeScanResponse());
-    std::shared_ptr<model::packets::LinkLayerPacketBuilder> to_send =
-        std::move(scan_response);
-
-    SendLinkLayerPacket(to_send, Phy::Type::LOW_ENERGY);
+void Beacon::IncomingPacket(LinkLayerPacketView packet) {
+  if (packet.GetDestinationAddress() == address_ &&
+      packet.GetType() == PacketType::LE_SCAN &&
+      (advertising_type_ == LegacyAdvertisingType::ADV_IND ||
+       advertising_type_ == LegacyAdvertisingType::ADV_SCAN_IND)) {
+    SendLinkLayerPacket(
+        std::move(LeScanResponseBuilder::Create(
+            address_, packet.GetSourceAddress(), AddressType::PUBLIC,
+            std::vector(scan_response_data_.begin(),
+                        scan_response_data_.end()))),
+        Phy::Type::LOW_ENERGY);
   }
 }
 
diff --git a/tools/rootcanal/model/devices/beacon.h b/tools/rootcanal/model/devices/beacon.h
index fc6af5c..5b3a258 100644
--- a/tools/rootcanal/model/devices/beacon.h
+++ b/tools/rootcanal/model/devices/beacon.h
@@ -16,6 +16,7 @@
 
 #pragma once
 
+#include <chrono>
 #include <cstdint>
 #include <vector>
 
@@ -23,7 +24,8 @@
 
 namespace rootcanal {
 
-// A simple device that advertises periodically and is not connectable.
+// Simple device that advertises with non-connectable advertising in general
+// discoverable mode, and responds to LE scan requests.
 class Beacon : public Device {
  public:
   Beacon();
@@ -34,16 +36,18 @@
     return std::make_shared<Beacon>(args);
   }
 
-  // Return a string representation of the type of device.
-  virtual std::string GetTypeString() const override;
+  virtual std::string GetTypeString() const override { return "beacon"; }
 
-  // Return a string representation of the device.
-  virtual std::string ToString() const override;
-
+  virtual void TimerTick() override;
   virtual void IncomingPacket(
       model::packets::LinkLayerPacketView packet) override;
 
-  virtual void TimerTick() override;
+ protected:
+  model::packets::LegacyAdvertisingType advertising_type_{};
+  std::array<uint8_t, 31> advertising_data_{};
+  std::array<uint8_t, 31> scan_response_data_{};
+  std::chrono::steady_clock::duration advertising_interval_{};
+  std::chrono::steady_clock::time_point advertising_last_{};
 
  private:
   static bool registered_;
diff --git a/tools/rootcanal/model/devices/beacon_swarm.cc b/tools/rootcanal/model/devices/beacon_swarm.cc
index f47df40..82b4e62 100644
--- a/tools/rootcanal/model/devices/beacon_swarm.cc
+++ b/tools/rootcanal/model/devices/beacon_swarm.cc
@@ -21,15 +21,18 @@
 using std::vector;
 
 namespace rootcanal {
+using namespace model::packets;
+using namespace std::chrono_literals;
+
 bool BeaconSwarm::registered_ =
     DeviceBoutique::Register("beacon_swarm", &BeaconSwarm::Create);
 
 BeaconSwarm::BeaconSwarm(const vector<std::string>& args) : Beacon(args) {
-  advertising_interval_ms_ = std::chrono::milliseconds(1280);
-  properties_.SetLeAdvertisementType(0x03 /* NON_CONNECT */);
-  properties_.SetLeAdvertisement({
-      0x15,  // Length
-      0x09 /* TYPE_NAME_CMPL */,
+  advertising_interval_ = 1280ms;
+  advertising_type_ = LegacyAdvertisingType::ADV_NONCONN_IND;
+  advertising_data_ = {
+      0x15 /* Length */,
+      0x09 /* TYPE_NAME_COMPLETE */,
       'g',
       'D',
       'e',
@@ -50,21 +53,19 @@
       'a',
       'r',
       'm',
-      0x02,  // Length
+      0x02 /* Length */,
       0x01 /* TYPE_FLAG */,
-      0x4 /* BREDR_NOT_SPT */ | 0x2 /* GEN_DISC_FLAG */,
-  });
+      0x4 /* BREDR_NOT_SUPPORTED */ | 0x2 /* GENERAL_DISCOVERABLE */,
+  };
 
-  properties_.SetLeScanResponse({0x06,  // Length
-                                 0x08 /* TYPE_NAME_SHORT */, 'c', 'b', 'e', 'a',
-                                 'c'});
+  scan_response_data_ = {
+      0x06 /* Length */, 0x08 /* TYPE_NAME_SHORT */, 'c', 'b', 'e', 'a', 'c'};
 }
 
 void BeaconSwarm::TimerTick() {
-  Address beacon_addr = properties_.GetLeAddress();
-  uint8_t* low_order_byte = (uint8_t*)(&beacon_addr);
+  // Rotate the advertising address.
+  uint8_t* low_order_byte = address_.data();
   *low_order_byte += 1;
-  properties_.SetLeAddress(beacon_addr);
   Beacon::TimerTick();
 }
 
diff --git a/tools/rootcanal/model/devices/broken_adv.cc b/tools/rootcanal/model/devices/broken_adv.cc
deleted file mode 100644
index 5190f99..0000000
--- a/tools/rootcanal/model/devices/broken_adv.cc
+++ /dev/null
@@ -1,162 +0,0 @@
-/*
- * Copyright 2016 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#include "broken_adv.h"
-
-#include "model/setup/device_boutique.h"
-
-using std::vector;
-
-namespace rootcanal {
-
-bool BrokenAdv::registered_ =
-    DeviceBoutique::Register("broken_adv", &BrokenAdv::Create);
-
-BrokenAdv::BrokenAdv() {
-  advertising_interval_ms_ = std::chrono::milliseconds(1280);
-  properties_.SetLeAdvertisementType(0x03 /* NON_CONNECT */);
-  constant_adv_data_ = {
-      0x02,       // Length
-      0x01,       // TYPE_FLAG
-      0x4 | 0x2,  // BREDR_NOT_SPT |  GEN_DISC_FLAG
-      0x13,       // Length
-      0x09,       // TYPE_NAME_CMPL
-      'g',       'D', 'e', 'v', 'i', 'c', 'e', '-', 'b',
-      'r',       'o', 'k', 'e', 'n', '_', 'a', 'd', 'v',
-  };
-  properties_.SetLeAdvertisement(constant_adv_data_);
-
-  properties_.SetLeScanResponse({0x0b,  // Length
-                                 0x08,  // TYPE_NAME_SHORT
-                                 'b', 'r', 'o', 'k', 'e', 'n', 'n', 'e', 's',
-                                 's'});
-
-  properties_.SetExtendedInquiryData({0x07,  // Length
-                                      0x09,  // TYPE_NAME_COMPLETE
-                                      'B', 'R', '0', 'K', '3', 'N'});
-  properties_.SetPageScanRepetitionMode(0);
-  page_scan_delay_ms_ = std::chrono::milliseconds(600);
-}
-
-BrokenAdv::BrokenAdv(const vector<std::string>& args) : BrokenAdv() {
-  if (args.size() >= 2) {
-    Address addr{};
-    if (Address::FromString(args[1], addr)) properties_.SetLeAddress(addr);
-  }
-
-  if (args.size() >= 3) {
-    SetAdvertisementInterval(std::chrono::milliseconds(std::stoi(args[2])));
-  }
-}
-
-// Mostly return the correct length
-static uint8_t random_length(size_t bytes_remaining) {
-  uint32_t randomness = rand();
-
-  switch ((randomness & 0xf000000) >> 24) {
-    case (0):
-      return bytes_remaining + (randomness & 0xff);
-    case (1):
-      return bytes_remaining - (randomness & 0xff);
-    case (2):
-      return bytes_remaining + (randomness & 0xf);
-    case (3):
-      return bytes_remaining - (randomness & 0xf);
-    case (5):
-    case (6):
-      return bytes_remaining + (randomness & 0x3);
-    case (7):
-    case (8):
-      return bytes_remaining - (randomness & 0x3);
-    default:
-      return bytes_remaining;
-  }
-}
-
-static size_t random_adv_type() {
-  uint32_t randomness = rand();
-
-  switch ((randomness & 0xf000000) >> 24) {
-    case (0):
-      return 0xff;  // TYPE_MANUFACTURER_SPECIFIC
-    case (1):
-      return (randomness & 0xff);
-    default:
-      return (randomness & 0x1f);
-  }
-}
-
-static size_t random_data_length(size_t length, size_t bytes_remaining) {
-  uint32_t randomness = rand();
-
-  switch ((randomness & 0xf000000) >> 24) {
-    case (0):
-      return bytes_remaining;
-    case (1):
-      return (length + (randomness & 0xff)) % bytes_remaining;
-    default:
-      return (length <= bytes_remaining ? length : bytes_remaining);
-  }
-}
-
-static void RandomizeAdvertisement(vector<uint8_t>& ad, size_t max) {
-  uint8_t length = random_length(max);
-  uint8_t data_length = random_data_length(length, max);
-
-  ad.push_back(random_adv_type());
-  ad.push_back(length);
-  for (size_t i = 0; i < data_length; i++) ad.push_back(rand() & 0xff);
-}
-
-void BrokenAdv::UpdateAdvertisement() {
-  std::vector<uint8_t> adv_data;
-  for (size_t i = 0; i < constant_adv_data_.size(); i++)
-    adv_data.push_back(constant_adv_data_[i]);
-
-  RandomizeAdvertisement(adv_data, 31 - adv_data.size());
-  properties_.SetLeAdvertisement(adv_data);
-
-  adv_data.clear();
-  RandomizeAdvertisement(adv_data, 31);
-  properties_.SetLeScanResponse(adv_data);
-
-  Address le_addr = properties_.GetLeAddress();
-  uint8_t* low_order_byte = (uint8_t*)(&le_addr);
-  *low_order_byte += 1;
-  properties_.SetLeAddress(le_addr);
-}
-
-std::string BrokenAdv::ToString() const {
-  std::string str = Device::ToString() + std::string(": Interval = ") +
-                    std::to_string(advertising_interval_ms_.count());
-  return str;
-}
-
-void BrokenAdv::UpdatePageScan() {
-  RandomizeAdvertisement(constant_scan_data_, 31);
-
-  Address page_addr = properties_.GetAddress();
-  uint8_t* low_order_byte = (uint8_t*)(&page_addr);
-  *low_order_byte += 1;
-  properties_.SetAddress(page_addr);
-}
-
-void BrokenAdv::TimerTick() {
-  UpdatePageScan();
-  UpdateAdvertisement();
-}
-
-}  // namespace rootcanal
diff --git a/tools/rootcanal/model/devices/broken_adv.h b/tools/rootcanal/model/devices/broken_adv.h
deleted file mode 100644
index e551ea2..0000000
--- a/tools/rootcanal/model/devices/broken_adv.h
+++ /dev/null
@@ -1,57 +0,0 @@
-/*
- * Copyright 2016 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#pragma once
-
-#include <cstdint>
-#include <vector>
-
-#include "device.h"
-
-namespace rootcanal {
-
-class BrokenAdv : public Device {
- public:
-  BrokenAdv();
-  BrokenAdv(const std::vector<std::string>& args);
-  ~BrokenAdv() = default;
-
-  static std::shared_ptr<Device> Create(const std::vector<std::string>& args) {
-    return std::make_shared<BrokenAdv>(args);
-  }
-
-  // Return a string representation of the type of device.
-  virtual std::string GetTypeString() const override { return "broken_adv"; }
-
-  // Return the string representation of the device.
-  virtual std::string ToString() const override;
-
-  // Use the timer tick to update advertisements.
-  void TimerTick() override;
-
-  // Change which advertisements are broken and the address of the device.
-  void UpdateAdvertisement();
-
-  // Change which data is broken and the address of the device.
-  void UpdatePageScan();
-
- private:
-  std::vector<uint8_t> constant_adv_data_;
-  std::vector<uint8_t> constant_scan_data_;
-  static bool registered_;
-};
-
-}  // namespace rootcanal
diff --git a/tools/rootcanal/model/devices/car_kit.cc b/tools/rootcanal/model/devices/car_kit.cc
deleted file mode 100644
index ef92980..0000000
--- a/tools/rootcanal/model/devices/car_kit.cc
+++ /dev/null
@@ -1,103 +0,0 @@
-/*
- * Copyright 2018 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#include "car_kit.h"
-
-#include "model/setup/device_boutique.h"
-#include "os/log.h"
-
-using std::vector;
-
-namespace rootcanal {
-
-bool CarKit::registered_ = DeviceBoutique::Register("car_kit", &CarKit::Create);
-const std::string kCarKitPropertiesFile =
-    "/etc/bluetooth/car_kit_controller_properties.json";
-
-CarKit::CarKit() : Device(kCarKitPropertiesFile) {
-  advertising_interval_ms_ = std::chrono::milliseconds(0);
-
-  page_scan_delay_ms_ = std::chrono::milliseconds(600);
-
-  // Stub in packet handling for now
-  link_layer_controller_.RegisterAclChannel(
-      [](std::shared_ptr<bluetooth::hci::AclBuilder>) {});
-  link_layer_controller_.RegisterEventChannel(
-      [](std::shared_ptr<bluetooth::hci::EventBuilder>) {});
-  link_layer_controller_.RegisterScoChannel(
-      [](std::shared_ptr<bluetooth::hci::ScoBuilder>) {});
-  link_layer_controller_.RegisterRemoteChannel(
-      [this](std::shared_ptr<model::packets::LinkLayerPacketBuilder> packet,
-             Phy::Type phy_type) {
-        CarKit::SendLinkLayerPacket(packet, phy_type);
-      });
-
-  properties_.SetPageScanRepetitionMode(0);
-  properties_.SetClassOfDevice(0x600420);
-  properties_.SetExtendedFeatures(0x8779ff9bfe8defff, 0);
-  properties_.SetExtendedInquiryData({
-      16,  // length
-      9,   // Type: Device Name
-      'g',  'D', 'e', 'v', 'i', 'c', 'e', '-',
-      'c',  'a', 'r', '_', 'k', 'i', 't',
-      7,     // length
-      3,     // Type: 16-bit UUIDs
-      0x0e,  // AVRC
-      0x11,
-      0x0B,  // Audio Sink
-      0x11,
-      0x00,  // PnP Information
-      0x12,
-  });
-  properties_.SetName({
-      'g',
-      'D',
-      'e',
-      'v',
-      'i',
-      'c',
-      'e',
-      '-',
-      'C',
-      'a',
-      'r',
-      '_',
-      'K',
-      'i',
-      't',
-  });
-}
-
-CarKit::CarKit(const vector<std::string>& args) : CarKit() {
-  if (args.size() >= 2) {
-    Address addr{};
-    if (Address::FromString(args[1], addr)) properties_.SetAddress(addr);
-    LOG_INFO("%s SetAddress %s", ToString().c_str(), addr.ToString().c_str());
-  }
-
-  if (args.size() >= 3) {
-    properties_.SetClockOffset(std::stoi(args[2]));
-  }
-}
-
-void CarKit::TimerTick() { link_layer_controller_.TimerTick(); }
-
-void CarKit::IncomingPacket(model::packets::LinkLayerPacketView packet) {
-  LOG_WARN("Incoming Packet");
-  link_layer_controller_.IncomingPacket(packet);
-}
-
-}  // namespace rootcanal
diff --git a/tools/rootcanal/model/devices/car_kit.h b/tools/rootcanal/model/devices/car_kit.h
deleted file mode 100644
index f793e49..0000000
--- a/tools/rootcanal/model/devices/car_kit.h
+++ /dev/null
@@ -1,51 +0,0 @@
-/*
- * Copyright 2018 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#pragma once
-
-#include <cstdint>
-#include <vector>
-
-#include "device.h"
-#include "hci/hci_packets.h"
-#include "model/controller/link_layer_controller.h"
-
-namespace rootcanal {
-
-class CarKit : public Device {
- public:
-  CarKit();
-  CarKit(const std::vector<std::string>& args);
-  ~CarKit() = default;
-
-  static std::shared_ptr<CarKit> Create(const std::vector<std::string>& args) {
-    return std::make_shared<CarKit>(args);
-  }
-
-  // Return a string representation of the type of device.
-  virtual std::string GetTypeString() const override { return "car_kit"; }
-
-  virtual void IncomingPacket(
-      model::packets::LinkLayerPacketView packet) override;
-
-  virtual void TimerTick() override;
-
- private:
-  LinkLayerController link_layer_controller_{properties_};
-  static bool registered_;
-};
-
-}  // namespace rootcanal
diff --git a/tools/rootcanal/model/devices/classic.cc b/tools/rootcanal/model/devices/classic.cc
deleted file mode 100644
index 60866c9..0000000
--- a/tools/rootcanal/model/devices/classic.cc
+++ /dev/null
@@ -1,54 +0,0 @@
-/*
- * Copyright 2016 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#include "classic.h"
-
-#include "model/setup/device_boutique.h"
-
-using std::vector;
-
-namespace rootcanal {
-
-bool Classic::registered_ =
-    DeviceBoutique::Register("classic", &Classic::Create);
-
-Classic::Classic() {
-  advertising_interval_ms_ = std::chrono::milliseconds(0);
-  properties_.SetClassOfDevice(0x30201);
-
-  properties_.SetExtendedInquiryData({0x10,  // Length
-                                      0x09,  // TYPE_NAME_CMPL
-                                      'g', 'D', 'e', 'v', 'i', 'c', 'e', '-',
-                                      'c', 'l', 'a', 's', 's', 'i', 'c',
-                                      '\0'});  // End of data
-  properties_.SetPageScanRepetitionMode(0);
-  properties_.SetExtendedFeatures(0x87593F9bFE8FFEFF, 0);
-
-  page_scan_delay_ms_ = std::chrono::milliseconds(600);
-}
-
-Classic::Classic(const vector<std::string>& args) : Classic() {
-  if (args.size() >= 2) {
-    Address addr{};
-    if (Address::FromString(args[1], addr)) properties_.SetAddress(addr);
-  }
-
-  if (args.size() >= 3) {
-    properties_.SetClockOffset(std::stoi(args[2]));
-  }
-}
-
-}  // namespace rootcanal
diff --git a/tools/rootcanal/model/devices/classic.h b/tools/rootcanal/model/devices/classic.h
deleted file mode 100644
index b3f6b65..0000000
--- a/tools/rootcanal/model/devices/classic.h
+++ /dev/null
@@ -1,43 +0,0 @@
-/*
- * Copyright 2016 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#pragma once
-
-#include <cstdint>
-#include <vector>
-
-#include "device.h"
-
-namespace rootcanal {
-
-class Classic : public Device {
- public:
-  Classic();
-  Classic(const std::vector<std::string>& args);
-  ~Classic() = default;
-
-  static std::shared_ptr<Device> Create(const std::vector<std::string>& args) {
-    return std::make_shared<Classic>(args);
-  }
-
-  // Return a string representation of the type of device.
-  virtual std::string GetTypeString() const override { return "classic"; }
-
- private:
-  static bool registered_;
-};
-
-}  // namespace rootcanal
diff --git a/tools/rootcanal/model/devices/device.cc b/tools/rootcanal/model/devices/device.cc
index 3bcf30b..79f93bc 100644
--- a/tools/rootcanal/model/devices/device.cc
+++ b/tools/rootcanal/model/devices/device.cc
@@ -21,9 +21,7 @@
 namespace rootcanal {
 
 std::string Device::ToString() const {
-  std::string dev = GetTypeString() + "@" + properties_.GetAddress().ToString();
-
-  return dev;
+  return GetTypeString() + "@" + address_.ToString();
 }
 
 void Device::RegisterPhyLayer(std::shared_ptr<PhyLayer> phy) {
@@ -50,12 +48,6 @@
   }
 }
 
-bool Device::IsAdvertisementAvailable() const {
-  return (advertising_interval_ms_ > std::chrono::milliseconds(0)) &&
-         (std::chrono::steady_clock::now() >=
-          last_advertisement_ + advertising_interval_ms_);
-}
-
 void Device::SendLinkLayerPacket(
     std::shared_ptr<model::packets::LinkLayerPacketBuilder> to_send,
     Phy::Type phy_type) {
@@ -85,8 +77,4 @@
   close_callback_ = close_callback;
 }
 
-void Device::SetAddress(Address) {
-  LOG_INFO("%s does not implement %s", GetTypeString().c_str(), __func__);
-}
-
 }  // namespace rootcanal
diff --git a/tools/rootcanal/model/devices/device.h b/tools/rootcanal/model/devices/device.h
index 25d1024..e881e9f 100644
--- a/tools/rootcanal/model/devices/device.h
+++ b/tools/rootcanal/model/devices/device.h
@@ -23,7 +23,6 @@
 #include <vector>
 
 #include "hci/address.h"
-#include "model/devices/device_properties.h"
 #include "model/setup/phy_layer.h"
 #include "packets/link_layer_packets.h"
 
@@ -35,9 +34,7 @@
 //  - Provide Get*() and Set*() functions for device attributes.
 class Device {
  public:
-  Device(const std::string properties_filename = "")
-      : last_advertisement_(std::chrono::steady_clock::now()),
-        properties_(properties_filename) {}
+  Device() { ASSERT(Address::FromString("BB:BB:BB:BB:BB:AD", address_)); }
   virtual ~Device() = default;
 
   // Return a string representation of the type of device.
@@ -46,22 +43,11 @@
   // Return the string representation of the device.
   virtual std::string ToString() const;
 
-  // Decide whether to accept a connection request
-  // May need to be extended to check peer address & type, and other
-  // connection parameters.
-  // Return true if the device accepts the connection request.
-  virtual bool LeConnect() { return false; }
-
   // Set the device's Bluetooth address.
-  virtual void SetAddress(Address address);
+  void SetAddress(Address address) { address_ = address; }
 
-  // Set the advertisement interval in milliseconds.
-  void SetAdvertisementInterval(std::chrono::milliseconds ms) {
-    advertising_interval_ms_ = ms;
-  }
-
-  // Returns true if the host could see an advertisement about now.
-  virtual bool IsAdvertisementAvailable() const;
+  // Get the device's Bluetooth address.
+  const Address& GetAddress() const { return address_; }
 
   // Let the device know that time has passed.
   virtual void TimerTick() {}
@@ -77,6 +63,7 @@
   virtual void SendLinkLayerPacket(
       std::shared_ptr<model::packets::LinkLayerPacketBuilder> packet,
       Phy::Type phy_type);
+
   virtual void SendLinkLayerPacket(model::packets::LinkLayerPacketView packet,
                                    Phy::Type phy_type);
 
@@ -85,18 +72,12 @@
   void RegisterCloseCallback(std::function<void()>);
 
  protected:
+  // List phy layers this device is listening on.
   std::vector<std::shared_ptr<PhyLayer>> phy_layers_;
 
-  std::chrono::steady_clock::time_point last_advertisement_;
-
-  // The time between page scans.
-  std::chrono::milliseconds page_scan_delay_ms_{};
-
-  // The spec defines the advertising interval as a 16-bit value, but since it
-  // is never sent in packets, we use std::chrono::milliseconds.
-  std::chrono::milliseconds advertising_interval_ms_{};
-
-  DeviceProperties properties_;
+  // Unique device address. Used as public device address for
+  // Bluetooth activities.
+  Address address_;
 
   // Callback to be invoked when this device is closed.
   std::function<void()> close_callback_;
diff --git a/tools/rootcanal/model/devices/device_properties.cc b/tools/rootcanal/model/devices/device_properties.cc
deleted file mode 100644
index a2bade6..0000000
--- a/tools/rootcanal/model/devices/device_properties.cc
+++ /dev/null
@@ -1,143 +0,0 @@
-/*
- * Copyright 2015 The Android Open Source Project
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#include "device_properties.h"
-
-#include <fstream>
-#include <memory>
-
-#include "json/json.h"
-#include "os/log.h"
-#include "osi/include/osi.h"
-
-static void ParseUint8t(Json::Value value, uint8_t* field) {
-  if (value.isString()) {
-    *field = std::stoi(value.asString(), nullptr, 0);
-  }
-}
-
-static void ParseUint16t(Json::Value value, uint16_t* field) {
-  if (value.isString()) {
-    *field = std::stoi(value.asString(), nullptr, 0);
-  }
-}
-
-static void ParseHex64(Json::Value value, uint64_t* field) {
-  if (value.isString()) {
-    size_t end_char = 0;
-    uint64_t parsed = std::stoll(value.asString(), &end_char, 16);
-    if (end_char > 0) {
-      *field = parsed;
-    }
-  }
-}
-
-namespace rootcanal {
-
-DeviceProperties::DeviceProperties(const std::string& file_name)
-    : acl_data_packet_size_(1024),
-      sco_data_packet_size_(255),
-      num_acl_data_packets_(10),
-      num_sco_data_packets_(10),
-      version_(static_cast<uint8_t>(bluetooth::hci::HciVersion::V_4_1)),
-      revision_(0),
-      lmp_pal_version_(static_cast<uint8_t>(bluetooth::hci::LmpVersion::V_4_1)),
-      manufacturer_name_(0),
-      lmp_pal_subversion_(0),
-      le_data_packet_length_(27),
-      num_le_data_packets_(20),
-      le_connect_list_size_(15),
-      le_resolving_list_size_(15) {
-  std::string properties_raw;
-
-  ASSERT(Address::FromString("BB:BB:BB:BB:BB:AD", address_));
-  ASSERT(Address::FromString("BB:BB:BB:BB:AD:1E", le_address_));
-  name_ = {'D', 'e', 'f', 'a', 'u', 'l', 't'};
-
-  supported_codecs_ = {0};  // Only SBC is supported.
-  vendor_specific_codecs_ = {};
-
-  for (int i = 0; i < 35; i++) supported_commands_[i] = 0xff;
-  // Mark HCI_LE_Transmitter_Test[v2] and newer commands as unsupported
-  // Use SetSupportedComands() to change what's supported.
-  for (int i = 35; i < 64; i++) supported_commands_[i] = 0x00;
-
-  le_supported_states_ = 0x3ffffffffff;
-  le_vendor_cap_ = {};
-
-  if (file_name.empty()) {
-    return;
-  }
-
-  LOG_INFO("Reading controller properties from %s.", file_name.c_str());
-
-  std::ifstream file(file_name);
-
-  Json::Value root;
-  Json::CharReaderBuilder builder;
-
-  std::string errs;
-  if (!Json::parseFromStream(builder, file, &root, &errs)) {
-    LOG_ERROR("Error reading controller properties from file: %s error: %s",
-              file_name.c_str(), errs.c_str());
-    return;
-  }
-
-  ParseUint16t(root["AclDataPacketSize"], &acl_data_packet_size_);
-  ParseUint8t(root["ScoDataPacketSize"], &sco_data_packet_size_);
-  ParseUint8t(root["EncryptionKeySize"], &encryption_key_size_);
-  ParseUint16t(root["NumAclDataPackets"], &num_acl_data_packets_);
-  ParseUint16t(root["NumScoDataPackets"], &num_sco_data_packets_);
-  ParseUint8t(root["Version"], &version_);
-  ParseUint16t(root["Revision"], &revision_);
-  ParseUint8t(root["LmpPalVersion"], &lmp_pal_version_);
-  ParseUint16t(root["ManufacturerName"], &manufacturer_name_);
-  ParseUint16t(root["LmpPalSubversion"], &lmp_pal_subversion_);
-  Json::Value supported_commands = root["supported_commands"];
-  if (!supported_commands.empty()) {
-    use_supported_commands_from_file_ = true;
-    for (unsigned i = 0; i < supported_commands.size(); i++) {
-      std::string out = supported_commands[i].asString();
-      uint8_t number = stoi(out, nullptr, 16);
-      supported_commands_[i] = number;
-    }
-  }
-  ParseHex64(root["LeSupportedFeatures"], &le_supported_features_);
-  ParseUint16t(root["LeConnectListIgnoreReasons"],
-               &le_connect_list_ignore_reasons_);
-  ParseUint16t(root["LeResolvingListIgnoreReasons"],
-               &le_resolving_list_ignore_reasons_);
-}
-
-bool DeviceProperties::SetLeHostFeature(uint8_t bit_number, uint8_t bit_value) {
-  if (bit_number >= 64 || bit_value > 1) return false;
-
-  uint64_t bit_mask = UINT64_C(1) << bit_number;
-  if (bit_mask !=
-          static_cast<uint64_t>(
-              LLFeaturesBits::CONNECTED_ISOCHRONOUS_STREAM_HOST_SUPPORT) &&
-      bit_mask != static_cast<uint64_t>(
-                      LLFeaturesBits::CONNECTION_SUBRATING_HOST_SUPPORT))
-    return false;
-
-  if (bit_value == 0)
-    le_supported_features_ &= ~bit_mask;
-  else if (bit_value == 1)
-    le_supported_features_ |= bit_mask;
-
-  return true;
-}
-
-}  // namespace rootcanal
diff --git a/tools/rootcanal/model/devices/device_properties.h b/tools/rootcanal/model/devices/device_properties.h
deleted file mode 100644
index 3f61c3b..0000000
--- a/tools/rootcanal/model/devices/device_properties.h
+++ /dev/null
@@ -1,504 +0,0 @@
-/*
- * Copyright 2015 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#pragma once
-
-#include <array>
-#include <cstdint>
-#include <string>
-#include <vector>
-
-#include "hci/address.h"
-#include "hci/hci_packets.h"
-#include "os/log.h"
-
-namespace rootcanal {
-
-using ::bluetooth::hci::Address;
-using ::bluetooth::hci::ClassOfDevice;
-using ::bluetooth::hci::EventCode;
-using ::bluetooth::hci::LLFeaturesBits;
-using ::bluetooth::hci::LMPFeaturesPage0Bits;
-using ::bluetooth::hci::LMPFeaturesPage1Bits;
-
-static constexpr uint64_t Page0LmpFeatures() {
-  LMPFeaturesPage0Bits features[] = {
-      LMPFeaturesPage0Bits::LMP_3_SLOT_PACKETS,
-      LMPFeaturesPage0Bits::LMP_5_SLOT_PACKETS,
-      LMPFeaturesPage0Bits::ENCRYPTION,
-      LMPFeaturesPage0Bits::SLOT_OFFSET,
-      LMPFeaturesPage0Bits::TIMING_ACCURACY,
-      LMPFeaturesPage0Bits::ROLE_SWITCH,
-      LMPFeaturesPage0Bits::HOLD_MODE,
-      LMPFeaturesPage0Bits::SNIFF_MODE,
-      LMPFeaturesPage0Bits::POWER_CONTROL_REQUESTS,
-      LMPFeaturesPage0Bits::CHANNEL_QUALITY_DRIVEN_DATA_RATE,
-      LMPFeaturesPage0Bits::SCO_LINK,
-      LMPFeaturesPage0Bits::HV2_PACKETS,
-      LMPFeaturesPage0Bits::HV3_PACKETS,
-      LMPFeaturesPage0Bits::M_LAW_LOG_SYNCHRONOUS_DATA,
-      LMPFeaturesPage0Bits::A_LAW_LOG_SYNCHRONOUS_DATA,
-      LMPFeaturesPage0Bits::CVSD_SYNCHRONOUS_DATA,
-      LMPFeaturesPage0Bits::PAGING_PARAMETER_NEGOTIATION,
-      LMPFeaturesPage0Bits::POWER_CONTROL,
-      LMPFeaturesPage0Bits::TRANSPARENT_SYNCHRONOUS_DATA,
-      LMPFeaturesPage0Bits::BROADCAST_ENCRYPTION,
-      LMPFeaturesPage0Bits::ENHANCED_DATA_RATE_ACL_2_MB_S_MODE,
-      LMPFeaturesPage0Bits::ENHANCED_DATA_RATE_ACL_3_MB_S_MODE,
-      LMPFeaturesPage0Bits::ENHANCED_INQUIRY_SCAN,
-      LMPFeaturesPage0Bits::INTERLACED_INQUIRY_SCAN,
-      LMPFeaturesPage0Bits::INTERLACED_PAGE_SCAN,
-      LMPFeaturesPage0Bits::RSSI_WITH_INQUIRY_RESULTS,
-      LMPFeaturesPage0Bits::EXTENDED_SCO_LINK,
-      LMPFeaturesPage0Bits::EV4_PACKETS,
-      LMPFeaturesPage0Bits::EV5_PACKETS,
-      LMPFeaturesPage0Bits::AFH_CAPABLE_PERIPHERAL,
-      LMPFeaturesPage0Bits::AFH_CLASSIFICATION_PERIPHERAL,
-      LMPFeaturesPage0Bits::LE_SUPPORTED_CONTROLLER,
-      LMPFeaturesPage0Bits::LMP_3_SLOT_ENHANCED_DATA_RATE_ACL_PACKETS,
-      LMPFeaturesPage0Bits::LMP_5_SLOT_ENHANCED_DATA_RATE_ACL_PACKETS,
-      LMPFeaturesPage0Bits::SNIFF_SUBRATING,
-      LMPFeaturesPage0Bits::PAUSE_ENCRYPTION,
-      LMPFeaturesPage0Bits::AFH_CAPABLE_CENTRAL,
-      LMPFeaturesPage0Bits::AFH_CLASSIFICATION_CENTRAL,
-      LMPFeaturesPage0Bits::ENHANCED_DATA_RATE_ESCO_2_MB_S_MODE,
-      LMPFeaturesPage0Bits::ENHANCED_DATA_RATE_ESCO_3_MB_S_MODE,
-      LMPFeaturesPage0Bits::LMP_3_SLOT_ENHANCED_DATA_RATE_ESCO_PACKETS,
-      LMPFeaturesPage0Bits::EXTENDED_INQUIRY_RESPONSE,
-      LMPFeaturesPage0Bits::SIMULTANEOUS_LE_AND_BR_CONTROLLER,
-      LMPFeaturesPage0Bits::SECURE_SIMPLE_PAIRING_CONTROLLER,
-      LMPFeaturesPage0Bits::ENCAPSULATED_PDU,
-      LMPFeaturesPage0Bits::HCI_LINK_SUPERVISION_TIMEOUT_CHANGED_EVENT,
-      LMPFeaturesPage0Bits::VARIABLE_INQUIRY_TX_POWER_LEVEL,
-      LMPFeaturesPage0Bits::ENHANCED_POWER_CONTROL,
-      LMPFeaturesPage0Bits::EXTENDED_FEATURES};
-
-  uint64_t value = 0;
-  for (unsigned i = 0; i < sizeof(features) / sizeof(*features); i++)
-    value |= static_cast<uint64_t>(features[i]);
-  return value;
-}
-
-static constexpr uint64_t Page1LmpFeatures() {
-  LMPFeaturesPage1Bits features[] = {
-      LMPFeaturesPage1Bits::SIMULTANEOUS_LE_AND_BR_HOST,
-  };
-
-  uint64_t value = 0;
-  for (unsigned i = 0; i < sizeof(features) / sizeof(*features); i++)
-    value |= static_cast<uint64_t>(features[i]);
-  return value;
-}
-
-static constexpr uint64_t LlFeatures() {
-  LLFeaturesBits features[] = {
-      LLFeaturesBits::LE_ENCRYPTION,
-      LLFeaturesBits::CONNECTION_PARAMETERS_REQUEST_PROCEDURE,
-      LLFeaturesBits::EXTENDED_REJECT_INDICATION,
-      LLFeaturesBits::PERIPHERAL_INITIATED_FEATURES_EXCHANGE,
-      LLFeaturesBits::LE_PING,
-
-      LLFeaturesBits::EXTENDED_SCANNER_FILTER_POLICIES,
-      LLFeaturesBits::LE_EXTENDED_ADVERTISING,
-
-      // TODO: breaks AVD boot tests with LE audio
-      // LLFeaturesBits::CONNECTED_ISOCHRONOUS_STREAM_CENTRAL,
-      // LLFeaturesBits::CONNECTED_ISOCHRONOUS_STREAM_PERIPHERAL,
-  };
-
-  uint64_t value = 0;
-  for (unsigned i = 0; i < sizeof(features) / sizeof(*features); i++)
-    value |= static_cast<uint64_t>(features[i]);
-  return value;
-}
-
-class DeviceProperties {
- public:
-  explicit DeviceProperties(const std::string& file_name = "");
-
-  // Access private configuration data
-
-  // Specification Version 4.2, Volume 2, Part E, Section 7.4.1
-  const std::vector<uint8_t>& GetVersionInformation() const;
-
-  // Specification Version 4.2, Volume 2, Part E, Section 7.4.2
-  const std::array<uint8_t, 64>& GetSupportedCommands() const {
-    return supported_commands_;
-  }
-
-  void SetSupportedCommands(const std::array<uint8_t, 64>& commands) {
-    if (!use_supported_commands_from_file_) {
-      supported_commands_ = commands;
-    }
-  }
-
-  // Specification Version 4.2, Volume 2, Part E, Section 7.4.3
-  uint64_t GetSupportedFeatures() const { return extended_features_[0]; }
-
-  void SetExtendedFeatures(uint64_t features, uint8_t page_number) {
-    ASSERT(page_number < extended_features_.size());
-    extended_features_[page_number] = features;
-  }
-
-  bool GetSecureSimplePairingSupported() const {
-    uint64_t ssp_bit = 0x1;
-    return extended_features_[1] & ssp_bit;
-  }
-
-  void SetSecureSimplePairingSupport(bool supported) {
-    uint64_t ssp_bit = 0x1;
-    extended_features_[1] &= ~ssp_bit;
-    if (supported) {
-      extended_features_[1] = extended_features_[1] | ssp_bit;
-    }
-  }
-
-  void SetLeHostSupport(bool le_supported) {
-    uint64_t le_bit = 0x2;
-    extended_features_[1] &= ~le_bit;
-    if (le_supported) {
-      extended_features_[1] = extended_features_[1] | le_bit;
-    }
-  }
-
-  void SetSecureConnections(bool supported) {
-    uint64_t secure_bit = 0x8;
-    extended_features_[1] &= ~secure_bit;
-    if (supported) {
-      extended_features_[1] = extended_features_[1] | secure_bit;
-    }
-  }
-
-  // Specification Version 4.2, Volume 2, Part E, Section 7.4.4
-  uint8_t GetExtendedFeaturesMaximumPageNumber() const {
-    return extended_features_.size() - 1;
-  }
-
-  uint64_t GetExtendedFeatures(uint8_t page_number) const {
-    ASSERT(page_number < extended_features_.size());
-    return extended_features_[page_number];
-  }
-
-  // Specification Version 4.2, Volume 2, Part E, Section 7.4.5
-  uint16_t GetAclDataPacketSize() const { return acl_data_packet_size_; }
-
-  uint8_t GetSynchronousDataPacketSize() const { return sco_data_packet_size_; }
-
-  uint8_t GetEncryptionKeySize() const { return encryption_key_size_; }
-
-  uint16_t GetVoiceSetting() const { return voice_setting_; }
-
-  void SetVoiceSetting(uint16_t voice_setting) {
-    voice_setting_ = voice_setting;
-  }
-
-  uint16_t GetConnectionAcceptTimeout() const {
-    return connection_accept_timeout_;
-  }
-
-  void SetConnectionAcceptTimeout(uint16_t connection_accept_timeout) {
-    connection_accept_timeout_ = connection_accept_timeout;
-  }
-
-  uint16_t GetTotalNumAclDataPackets() const { return num_acl_data_packets_; }
-
-  uint16_t GetTotalNumSynchronousDataPackets() const {
-    return num_sco_data_packets_;
-  }
-
-  bool GetSynchronousFlowControl() const { return sco_flow_control_; }
-
-  void SetSynchronousFlowControl(bool sco_flow_control) {
-    sco_flow_control_ = sco_flow_control;
-  }
-
-  const Address& GetAddress() const { return address_; }
-
-  void SetAddress(const Address& address) { address_ = address; }
-
-  // Specification Version 4.2, Volume 2, Part E, Section 7.4.8
-  const std::vector<uint8_t>& GetSupportedCodecs() const {
-    return supported_codecs_;
-  }
-
-  const std::vector<uint32_t>& GetVendorSpecificCodecs() const {
-    return vendor_specific_codecs_;
-  }
-
-  uint8_t GetVersion() const { return version_; }
-
-  uint16_t GetRevision() const { return revision_; }
-
-  uint8_t GetLmpPalVersion() const { return lmp_pal_version_; }
-
-  uint16_t GetLmpPalSubversion() const { return lmp_pal_subversion_; }
-
-  uint16_t GetManufacturerName() const { return manufacturer_name_; }
-
-  uint8_t GetAuthenticationEnable() const { return authentication_enable_; }
-
-  void SetAuthenticationEnable(uint8_t enable) {
-    authentication_enable_ = enable;
-  }
-
-  ClassOfDevice GetClassOfDevice() const { return class_of_device_; }
-
-  void SetClassOfDevice(uint8_t b0, uint8_t b1, uint8_t b2) {
-    class_of_device_.cod[0] = b0;
-    class_of_device_.cod[1] = b1;
-    class_of_device_.cod[2] = b2;
-  }
-
-  void SetClassOfDevice(uint32_t class_of_device) {
-    class_of_device_.cod[0] = class_of_device & 0xff;
-    class_of_device_.cod[1] = (class_of_device >> 8) & 0xff;
-    class_of_device_.cod[2] = (class_of_device >> 16) & 0xff;
-  }
-
-  void SetName(const std::vector<uint8_t>& name) {
-    name_.fill(0);
-    for (size_t i = 0; i < 248 && i < name.size(); i++) {
-      name_[i] = name[i];
-    }
-  }
-
-  const std::array<uint8_t, 248>& GetName() const { return name_; }
-
-  void SetExtendedInquiryData(const std::vector<uint8_t>& eid) {
-    extended_inquiry_data_ = eid;
-  }
-
-  const std::vector<uint8_t>& GetExtendedInquiryData() const {
-    return extended_inquiry_data_;
-  }
-
-  uint8_t GetPageScanRepetitionMode() const {
-    return page_scan_repetition_mode_;
-  }
-
-  void SetPageScanRepetitionMode(uint8_t mode) {
-    page_scan_repetition_mode_ = mode;
-  }
-
-  uint16_t GetClockOffset() const { return clock_offset_; }
-
-  void SetClockOffset(uint16_t offset) { clock_offset_ = offset; }
-
-  uint64_t GetEventMask() const { return event_mask_; }
-
-  void SetEventMask(uint64_t mask) { event_mask_ = mask; }
-
-  bool SetLeHostFeature(uint8_t bit_number, uint8_t bit_value);
-
-  bool IsUnmasked(EventCode event) const {
-    uint64_t bit = UINT64_C(1) << (static_cast<uint8_t>(event) - 1);
-    return (event_mask_ & bit) != 0;
-  }
-
-  // Low-Energy functions
-  const Address& GetLeAddress() const { return le_address_; }
-
-  void SetLeAddress(const Address& address) { le_address_ = address; }
-
-  uint8_t GetLeAddressType() const { return le_address_type_; }
-
-  void SetLeAddressType(uint8_t addr_type) { le_address_type_ = addr_type; }
-
-  uint8_t GetLeAdvertisementType() const { return le_advertisement_type_; }
-
-  uint16_t GetLeAdvertisingIntervalMin() const {
-    return le_advertising_interval_min_;
-  }
-
-  uint16_t GetLeAdvertisingIntervalMax() const {
-    return le_advertising_interval_max_;
-  }
-
-  uint8_t GetLeAdvertisingOwnAddressType() const {
-    return le_advertising_own_address_type_;
-  }
-
-  uint8_t GetLeAdvertisingPeerAddressType() const {
-    return le_advertising_peer_address_type_;
-  }
-
-  Address GetLeAdvertisingPeerAddress() const {
-    return le_advertising_peer_address_;
-  }
-
-  uint8_t GetLeAdvertisingChannelMap() const {
-    return le_advertising_channel_map_;
-  }
-
-  uint8_t GetLeAdvertisingFilterPolicy() const {
-    return le_advertising_filter_policy_;
-  }
-
-  void SetLeAdvertisingParameters(uint16_t interval_min, uint16_t interval_max,
-                                  uint8_t ad_type, uint8_t own_address_type,
-                                  uint8_t peer_address_type,
-                                  Address peer_address, uint8_t channel_map,
-                                  uint8_t filter_policy) {
-    le_advertisement_type_ = ad_type;
-    le_advertising_interval_min_ = interval_min;
-    le_advertising_interval_max_ = interval_max;
-    le_advertising_own_address_type_ = own_address_type;
-    le_advertising_peer_address_type_ = peer_address_type;
-    le_advertising_peer_address_ = peer_address;
-    le_advertising_channel_map_ = channel_map;
-    le_advertising_filter_policy_ = filter_policy;
-  }
-
-  void SetLeAdvertisementType(uint8_t ad_type) {
-    le_advertisement_type_ = ad_type;
-  }
-
-  void SetLeAdvertisement(const std::vector<uint8_t>& ad) {
-    le_advertisement_ = ad;
-  }
-
-  const std::vector<uint8_t>& GetLeAdvertisement() const {
-    return le_advertisement_;
-  }
-
-  void SetLeScanResponse(const std::vector<uint8_t>& response) {
-    le_scan_response_ = response;
-  }
-
-  const std::vector<uint8_t>& GetLeScanResponse() const {
-    return le_scan_response_;
-  }
-
-  // Specification Version 4.2, Volume 2, Part E, Section 7.8.2
-  uint16_t GetLeDataPacketLength() const { return le_data_packet_length_; }
-
-  uint8_t GetTotalNumLeDataPackets() const { return num_le_data_packets_; }
-
-  uint16_t GetIsoDataPacketLength() const { return iso_data_packet_length_; }
-
-  uint8_t GetTotalNumIsoDataPackets() const { return num_iso_data_packets_; }
-
-  // Specification Version 4.2, Volume 2, Part E, Section 7.8.3
-  uint64_t GetLeSupportedFeatures() const { return le_supported_features_; }
-
-  // Specification Version 5.2, Volume 4, Part E, Section 7.8.6
-  int8_t GetLeAdvertisingPhysicalChannelTxPower() const {
-    return le_advertising_physical_channel_tx_power_;
-  }
-
-  void SetLeSupportedFeatures(uint64_t features) {
-    le_supported_features_ = features;
-  }
-
-  bool GetLeEventSupported(bluetooth::hci::SubeventCode subevent_code) const {
-    return le_event_mask_ & (1u << (static_cast<uint64_t>(subevent_code) - 1));
-  }
-
-  uint64_t GetLeEventMask() const { return le_event_mask_; }
-
-  void SetLeEventMask(uint64_t mask) { le_event_mask_ = mask; }
-
-  // Specification Version 4.2, Volume 2, Part E, Section 7.8.14
-  uint8_t GetLeFilterAcceptListSize() const { return le_connect_list_size_; }
-
-  // Specification Version 4.2, Volume 2, Part E, Section 7.8.27
-  uint64_t GetLeSupportedStates() const { return le_supported_states_; }
-
-  // Specification Version 4.2, Volume 2, Part E, Section 7.8.41
-  uint8_t GetLeResolvingListSize() const { return le_resolving_list_size_; }
-
-  // Workaround for misbehaving stacks
-  static constexpr uint8_t kLeListIgnoreScanEnable = 0x1;
-  static constexpr uint8_t kLeListIgnoreConnections = 0x2;
-  static constexpr uint8_t kLeListIgnoreAdvertising = 0x4;
-
-  uint16_t GetLeResolvingListIgnoreReasons() const {
-    return le_resolving_list_ignore_reasons_;
-  }
-  uint16_t GetLeFilterAcceptListIgnoreReasons() const {
-    return le_connect_list_ignore_reasons_;
-  }
-
-  // Vendor-specific commands
-  const std::vector<uint8_t>& GetLeVendorCap() const { return le_vendor_cap_; }
-
- private:
-  // Classic
-  uint16_t acl_data_packet_size_;
-  uint8_t sco_data_packet_size_;
-  uint16_t num_acl_data_packets_;
-  uint16_t num_sco_data_packets_;
-  bool sco_flow_control_{false};
-  uint8_t version_;
-  uint16_t revision_;
-  uint8_t lmp_pal_version_;
-  uint16_t manufacturer_name_;
-  uint16_t lmp_pal_subversion_;
-  uint64_t event_mask_{0x00001fffffffffff};
-  uint8_t authentication_enable_{};
-  std::vector<uint8_t> supported_codecs_;
-  std::vector<uint32_t> vendor_specific_codecs_;
-  std::array<uint8_t, 64> supported_commands_;
-  std::array<uint64_t, 2> extended_features_{
-      {Page0LmpFeatures(), Page1LmpFeatures()}};
-  ClassOfDevice class_of_device_{{0, 0, 0}};
-  std::vector<uint8_t> extended_inquiry_data_;
-  std::array<uint8_t, 248> name_{};
-  Address address_{};
-  uint8_t page_scan_repetition_mode_{};
-  uint16_t clock_offset_{};
-  uint8_t encryption_key_size_{10};
-  uint16_t voice_setting_{0x0060};
-  uint16_t connection_accept_timeout_{0x7d00};
-  bool use_supported_commands_from_file_ = false;
-
-  // Low Energy
-  uint16_t le_data_packet_length_;
-  uint8_t num_le_data_packets_;
-  uint8_t le_connect_list_size_;
-  uint8_t le_resolving_list_size_;
-  uint64_t le_supported_features_{LlFeatures()};
-  int8_t le_advertising_physical_channel_tx_power_{0x00};
-  uint64_t le_supported_states_;
-  uint64_t le_event_mask_{0x01f};
-  std::vector<uint8_t> le_vendor_cap_;
-  Address le_address_{};
-  uint8_t le_address_type_{};
-
-  // Note: the advertising parameters are initially set to the default
-  // values of the parameters of the HCI command LE Set Advertising Parameters.
-  uint16_t le_advertising_interval_min_{0x0800}; // 1.28s
-  uint16_t le_advertising_interval_max_{0x0800}; // 1.28s
-  uint8_t le_advertisement_type_{0x0}; // ADV_IND
-  uint8_t le_advertising_own_address_type_{0x0}; // Public Device Address
-  uint8_t le_advertising_peer_address_type_{0x0}; // Public Device Address
-  Address le_advertising_peer_address_{};
-  uint8_t le_advertising_channel_map_{0x7}; // All channels enabled
-  uint8_t le_advertising_filter_policy_{0x0}; // Process scan and connection
-                                              // requests from all devices
-  std::vector<uint8_t> le_advertisement_;
-  std::vector<uint8_t> le_scan_response_;
-
-  // LE Workarounds
-  uint16_t le_connect_list_ignore_reasons_{0};
-  uint16_t le_resolving_list_ignore_reasons_{0};
-
-  // ISO
-  uint16_t iso_data_packet_length_{1021};
-  uint8_t num_iso_data_packets_{12};
-};
-
-}  // namespace rootcanal
diff --git a/tools/rootcanal/model/devices/hci_device.cc b/tools/rootcanal/model/devices/hci_device.cc
index a6e48c3..bcc5c5c 100644
--- a/tools/rootcanal/model/devices/hci_device.cc
+++ b/tools/rootcanal/model/devices/hci_device.cc
@@ -16,21 +16,28 @@
 
 #include "hci_device.h"
 
-#include "os/log.h"
+#include "log.h"
 
 namespace rootcanal {
 
 HciDevice::HciDevice(std::shared_ptr<HciTransport> transport,
                      const std::string& properties_filename)
     : DualModeController(properties_filename), transport_(transport) {
-  advertising_interval_ms_ = std::chrono::milliseconds(1000);
-
-  page_scan_delay_ms_ = std::chrono::milliseconds(600);
-
-  properties_.SetPageScanRepetitionMode(0);
-  properties_.SetClassOfDevice(0x600420);
-  properties_.SetExtendedInquiryData({
-      12,  // length
+  link_layer_controller_.SetLocalName(std::vector<uint8_t>({
+      'g',
+      'D',
+      'e',
+      'v',
+      'i',
+      'c',
+      'e',
+      '-',
+      'H',
+      'C',
+      'I',
+  }));
+  link_layer_controller_.SetExtendedInquiryResponse(std::vector<uint8_t>({
+      12,  // Length
       9,   // Type: Device Name
       'g',
       'D',
@@ -43,21 +50,7 @@
       'h',
       'c',
       'i',
-
-  });
-  properties_.SetName({
-      'g',
-      'D',
-      'e',
-      'v',
-      'i',
-      'c',
-      'e',
-      '-',
-      'H',
-      'C',
-      'I',
-  });
+  }));
 
   RegisterEventChannel([this](std::shared_ptr<std::vector<uint8_t>> packet) {
     transport_->SendEvent(*packet);
diff --git a/tools/rootcanal/model/devices/keyboard.cc b/tools/rootcanal/model/devices/keyboard.cc
deleted file mode 100644
index 9d219de..0000000
--- a/tools/rootcanal/model/devices/keyboard.cc
+++ /dev/null
@@ -1,78 +0,0 @@
-/*
- * Copyright 2016 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#include "keyboard.h"
-
-#include "model/setup/device_boutique.h"
-
-using std::vector;
-
-namespace rootcanal {
-bool Keyboard::registered_ =
-    DeviceBoutique::Register("keyboard", &Keyboard::Create);
-
-Keyboard::Keyboard(const vector<std::string>& args) : Beacon(args) {
-  properties_.SetLeAdvertisementType(0x00 /* CONNECTABLE */);
-  properties_.SetLeAdvertisement(
-      {0x11,  // Length
-       0x09 /* TYPE_NAME_CMPL */,
-       'g',
-       'D',
-       'e',
-       'v',
-       'i',
-       'c',
-       'e',
-       '-',
-       'k',
-       'e',
-       'y',
-       'b',
-       'o',
-       'a',
-       'r',
-       'd',
-       0x03,  // Length
-       0x19,
-       0xC1,
-       0x03,
-       0x03,  // Length
-       0x03,
-       0x12,
-       0x18,
-       0x02,  // Length
-       0x01 /* TYPE_FLAGS */,
-       0x04 /* BREDR_NOT_SPT */ | 0x02 /* GEN_DISC_FLAG */});
-
-  properties_.SetLeScanResponse({0x04,  // Length
-                                 0x08 /* TYPE_NAME_SHORT */, 'k', 'e', 'y'});
-}
-
-std::string Keyboard::GetTypeString() const { return "keyboard"; }
-
-void Keyboard::TimerTick() {
-  if (!connected_) {
-    Beacon::TimerTick();
-  }
-}
-
-void Keyboard::IncomingPacket(model::packets::LinkLayerPacketView packet) {
-  if (!connected_) {
-    Beacon::IncomingPacket(packet);
-  }
-}
-
-}  // namespace rootcanal
diff --git a/tools/rootcanal/model/devices/keyboard.h b/tools/rootcanal/model/devices/keyboard.h
deleted file mode 100644
index 65620f3..0000000
--- a/tools/rootcanal/model/devices/keyboard.h
+++ /dev/null
@@ -1,48 +0,0 @@
-/*
- * Copyright 2016 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#pragma once
-
-#include <cstdint>
-#include <vector>
-
-#include "beacon.h"
-#include "device.h"
-
-namespace rootcanal {
-
-class Keyboard : public Beacon {
- public:
-  Keyboard(const std::vector<std::string>& args);
-  virtual ~Keyboard() = default;
-
-  static std::shared_ptr<Device> Create(const std::vector<std::string>& args) {
-    return std::make_shared<Keyboard>(args);
-  }
-
-  // Return a string representation of the type of device.
-  virtual std::string GetTypeString() const override;
-
-  virtual void IncomingPacket(
-      model::packets::LinkLayerPacketView packet) override;
-
-  virtual void TimerTick() override;
-
- private:
-  bool connected_{false};
-  static bool registered_;
-};
-}  // namespace rootcanal
diff --git a/tools/rootcanal/model/devices/link_layer_socket_device.cc b/tools/rootcanal/model/devices/link_layer_socket_device.cc
index 0acf25b..b10f64d 100644
--- a/tools/rootcanal/model/devices/link_layer_socket_device.cc
+++ b/tools/rootcanal/model/devices/link_layer_socket_device.cc
@@ -18,7 +18,7 @@
 
 #include <type_traits>  // for remove_extent_t
 
-#include "os/log.h"               // for ASSERT, LOG_INFO, LOG_ERROR, LOG_WARN
+#include "log.h"                  // for ASSERT, LOG_INFO, LOG_ERROR, LOG_WARN
 #include "packet/bit_inserter.h"  // for BitInserter
 #include "packet/iterator.h"      // for Iterator
 #include "packet/packet_view.h"   // for PacketView, kLittleEndian
diff --git a/tools/rootcanal/model/devices/loopback.cc b/tools/rootcanal/model/devices/loopback.cc
deleted file mode 100644
index 59c0959..0000000
--- a/tools/rootcanal/model/devices/loopback.cc
+++ /dev/null
@@ -1,87 +0,0 @@
-/*
- * Copyright 2016 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#include "loopback.h"
-
-#include "model/setup/device_boutique.h"
-#include "os/log.h"
-
-using std::vector;
-
-namespace rootcanal {
-
-bool Loopback::registered_ =
-    DeviceBoutique::Register("loopback", &Loopback::Create);
-
-Loopback::Loopback() {
-  advertising_interval_ms_ = std::chrono::milliseconds(1280);
-  properties_.SetLeAdvertisementType(0x03);  // NON_CONNECT
-  properties_.SetLeAdvertisement({
-      0x11,  // Length
-      0x09,  // NAME_CMPL
-      'g',         'D', 'e', 'v', 'i', 'c', 'e', '-',
-      'l',         'o', 'o', 'p', 'b', 'a', 'c', 'k',
-      0x02,         // Length
-      0x01,         // TYPE_FLAG
-      0x04 | 0x02,  // BREDR_NOT_SPT | GEN_DISC
-  });
-
-  properties_.SetLeScanResponse({0x05,  // Length
-                                 0x08,  // NAME_SHORT
-                                 'l', 'o', 'o', 'p'});
-}
-
-Loopback::Loopback(const vector<std::string>& args) : Loopback() {
-  if (args.size() >= 2) {
-    Address addr{};
-    if (Address::FromString(args[1], addr)) properties_.SetLeAddress(addr);
-  }
-
-  if (args.size() >= 3) {
-    SetAdvertisementInterval(std::chrono::milliseconds(std::stoi(args[2])));
-  }
-}
-
-std::string Loopback::GetTypeString() const { return "loopback"; }
-
-std::string Loopback::ToString() const {
-  std::string dev =
-      GetTypeString() + "@" + properties_.GetLeAddress().ToString();
-
-  return dev;
-}
-
-void Loopback::TimerTick() {}
-
-void Loopback::IncomingPacket(model::packets::LinkLayerPacketView packet) {
-  LOG_INFO("Got a packet of type %d", static_cast<int>(packet.GetType()));
-  if (packet.GetDestinationAddress() == properties_.GetLeAddress() &&
-      packet.GetType() == model::packets::PacketType::LE_SCAN) {
-    LOG_INFO("Got a scan");
-
-    auto scan_response = model::packets::LeScanResponseBuilder::Create(
-        properties_.GetLeAddress(), packet.GetSourceAddress(),
-        model::packets::AddressType::PUBLIC,
-        model::packets::AdvertisementType::SCAN_RESPONSE,
-        properties_.GetLeScanResponse());
-    std::shared_ptr<model::packets::LinkLayerPacketBuilder> to_send =
-        std::move(scan_response);
-
-    SendLinkLayerPacket(to_send, Phy::Type::LOW_ENERGY);
-  }
-}
-
-}  // namespace rootcanal
diff --git a/tools/rootcanal/model/devices/loopback.h b/tools/rootcanal/model/devices/loopback.h
deleted file mode 100644
index d6af78d..0000000
--- a/tools/rootcanal/model/devices/loopback.h
+++ /dev/null
@@ -1,52 +0,0 @@
-/*
- * Copyright 2016 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#pragma once
-
-#include <cstdint>
-#include <vector>
-
-#include "device.h"
-
-namespace rootcanal {
-
-// A simple device that advertises periodically and is not connectable.
-class Loopback : public Device {
- public:
-  Loopback();
-  Loopback(const std::vector<std::string>& args);
-  virtual ~Loopback() = default;
-
-  static std::shared_ptr<Device> Create(const std::vector<std::string>& args) {
-    return std::make_shared<Loopback>(args);
-  }
-
-  // Return a string representation of the type of device.
-  virtual std::string GetTypeString() const override;
-
-  // Return a string representation of the device.
-  virtual std::string ToString() const override;
-
-  virtual void IncomingPacket(
-      model::packets::LinkLayerPacketView packet) override;
-
-  virtual void TimerTick() override;
-
- private:
-  static bool registered_;
-};
-
-}  // namespace rootcanal
diff --git a/tools/rootcanal/model/devices/remote_loopback_device.cc b/tools/rootcanal/model/devices/remote_loopback_device.cc
deleted file mode 100644
index afe2754..0000000
--- a/tools/rootcanal/model/devices/remote_loopback_device.cc
+++ /dev/null
@@ -1,59 +0,0 @@
-/*
- * Copyright 2018 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#include "remote_loopback_device.h"
-
-#include "model/setup/device_boutique.h"
-#include "os/log.h"
-
-using std::vector;
-
-namespace rootcanal {
-
-using model::packets::LinkLayerPacketView;
-using model::packets::PageResponseBuilder;
-
-bool RemoteLoopbackDevice::registered_ =
-    DeviceBoutique::Register("remote_loopback", &RemoteLoopbackDevice::Create);
-
-RemoteLoopbackDevice::RemoteLoopbackDevice() {}
-
-std::string RemoteLoopbackDevice::ToString() const {
-  return GetTypeString() + " (no address)";
-}
-
-void RemoteLoopbackDevice::IncomingPacket(
-    model::packets::LinkLayerPacketView packet) {
-  // TODO: Check sender?
-  // TODO: Handle other packet types
-  Phy::Type phy_type = Phy::Type::BR_EDR;
-
-  model::packets::PacketType type = packet.GetType();
-  switch (type) {
-    case model::packets::PacketType::PAGE:
-      SendLinkLayerPacket(
-          PageResponseBuilder::Create(packet.GetSourceAddress(),
-                                      packet.GetSourceAddress(), true),
-          Phy::Type::BR_EDR);
-      break;
-    default: {
-      LOG_WARN("Resend = %d", static_cast<int>(packet.size()));
-      SendLinkLayerPacket(packet, phy_type);
-    }
-  }
-}
-
-}  // namespace rootcanal
diff --git a/tools/rootcanal/model/devices/remote_loopback_device.h b/tools/rootcanal/model/devices/remote_loopback_device.h
deleted file mode 100644
index 496093b..0000000
--- a/tools/rootcanal/model/devices/remote_loopback_device.h
+++ /dev/null
@@ -1,48 +0,0 @@
-/*
- * Copyright 2018 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#pragma once
-
-#include <cstdint>
-#include <vector>
-
-#include "device.h"
-
-namespace rootcanal {
-
-class RemoteLoopbackDevice : public Device {
- public:
-  RemoteLoopbackDevice();
-  virtual ~RemoteLoopbackDevice() = default;
-
-  static std::shared_ptr<Device> Create(const std::vector<std::string>&) {
-    return std::make_shared<RemoteLoopbackDevice>();
-  }
-
-  virtual std::string GetTypeString() const override {
-    return "remote_loopback_device";
-  }
-
-  virtual std::string ToString() const override;
-
-  virtual void IncomingPacket(
-      model::packets::LinkLayerPacketView packet) override;
-
- private:
-  static bool registered_;
-};
-
-}  // namespace rootcanal
diff --git a/tools/rootcanal/model/devices/scripted_beacon.cc b/tools/rootcanal/model/devices/scripted_beacon.cc
index 9c04be7..4fdaf5b 100644
--- a/tools/rootcanal/model/devices/scripted_beacon.cc
+++ b/tools/rootcanal/model/devices/scripted_beacon.cc
@@ -21,9 +21,9 @@
 #include <cstdint>
 #include <fstream>
 
+#include "log.h"
 #include "model/devices/scripted_beacon_ble_payload.pb.h"
 #include "model/setup/device_boutique.h"
-#include "os/log.h"
 
 #ifdef _WIN32
 #define F_OK 00
@@ -35,14 +35,17 @@
 using std::chrono::system_clock;
 
 namespace rootcanal {
+using namespace model::packets;
+using namespace std::chrono_literals;
+
 bool ScriptedBeacon::registered_ =
     DeviceBoutique::Register("scripted_beacon", &ScriptedBeacon::Create);
 
 ScriptedBeacon::ScriptedBeacon(const vector<std::string>& args) : Beacon(args) {
-  advertising_interval_ms_ = std::chrono::milliseconds(1280);
-  properties_.SetLeAdvertisementType(0x02 /* SCANNABLE */);
-  properties_.SetLeAdvertisement({
-      0x18,  // Length
+  advertising_interval_ = 1280ms;
+  advertising_type_ = LegacyAdvertisingType::ADV_SCAN_IND;
+  advertising_data_ = {
+      0x18 /* Length */,
       0x09 /* TYPE_NAME_CMPL */,
       'g',
       'D',
@@ -67,14 +70,14 @@
       'c',
       'o',
       'n',
-      0x02,  // Length
+      0x02 /* Length */,
       0x01 /* TYPE_FLAG */,
       0x4 /* BREDR_NOT_SPT */ | 0x2 /* GEN_DISC_FLAG */,
-  });
+  };
 
-  properties_.SetLeScanResponse({0x05,  // Length
-                                 0x08,  // TYPE_NAME_SHORT
-                                 'g', 'b', 'e', 'a'});
+  scan_response_data_ = {
+      0x05 /* Length */, 0x08 /* TYPE_NAME_SHORT */, 'g', 'b', 'e', 'a'};
+
   LOG_INFO("Scripted_beacon registered %s", registered_ ? "true" : "false");
 
   if (args.size() >= 4) {
@@ -164,10 +167,10 @@
     } break;
     case PlaybackEvent::PLAYBACK_STARTED: {
       while (has_time_elapsed(next_ad_.ad_time)) {
-        auto ad = model::packets::LeAdvertisementBuilder::Create(
+        auto ad = model::packets::LeLegacyAdvertisingPduBuilder::Create(
             next_ad_.address, Address::kEmpty /* Destination */,
-            model::packets::AddressType::RANDOM,
-            model::packets::AdvertisementType::ADV_NONCONN_IND, next_ad_.ad);
+            AddressType::RANDOM, AddressType::PUBLIC,
+            LegacyAdvertisingType::ADV_NONCONN_IND, next_ad_.ad);
         SendLinkLayerPacket(std::move(ad), Phy::Type::LOW_ENERGY);
         if (packet_num_ < ble_ad_list_.advertisements().size()) {
           get_next_advertisement();
@@ -194,16 +197,15 @@
 void ScriptedBeacon::IncomingPacket(
     model::packets::LinkLayerPacketView packet) {
   if (current_state_ == PlaybackEvent::INITIALIZED) {
-    if (packet.GetDestinationAddress() == properties_.GetLeAddress() &&
-        packet.GetType() == model::packets::PacketType::LE_SCAN) {
-      auto scan_response = model::packets::LeScanResponseBuilder::Create(
-          properties_.GetLeAddress(), packet.GetSourceAddress(),
-          static_cast<model::packets::AddressType>(
-              properties_.GetLeAddressType()),
-          model::packets::AdvertisementType::SCAN_RESPONSE,
-          properties_.GetLeScanResponse());
+    if (packet.GetDestinationAddress() == address_ &&
+        packet.GetType() == PacketType::LE_SCAN) {
       set_state(PlaybackEvent::SCANNED_ONCE);
-      SendLinkLayerPacket(std::move(scan_response), Phy::Type::LOW_ENERGY);
+      SendLinkLayerPacket(
+          std::move(model::packets::LeScanResponseBuilder::Create(
+              address_, packet.GetSourceAddress(), AddressType::PUBLIC,
+              std::vector(scan_response_data_.begin(),
+                          scan_response_data_.end()))),
+          Phy::Type::LOW_ENERGY);
     }
   }
 }
diff --git a/tools/rootcanal/model/devices/sniffer.cc b/tools/rootcanal/model/devices/sniffer.cc
index a38607b..3fafdc7 100644
--- a/tools/rootcanal/model/devices/sniffer.cc
+++ b/tools/rootcanal/model/devices/sniffer.cc
@@ -16,8 +16,8 @@
 
 #include "sniffer.h"
 
+#include "log.h"
 #include "model/setup/device_boutique.h"
-#include "os/log.h"
 
 using std::vector;
 
@@ -28,23 +28,20 @@
 
 Sniffer::Sniffer(const vector<std::string>& args) {
   if (args.size() >= 2) {
-    if (Address::FromString(args[1], device_to_sniff_)) {
-      properties_.SetAddress(device_to_sniff_);
-    }
+    Address::FromString(args[1], address_);
   }
 }
 
-void Sniffer::TimerTick() {}
-
 void Sniffer::IncomingPacket(model::packets::LinkLayerPacketView packet) {
   Address source = packet.GetSourceAddress();
   Address dest = packet.GetDestinationAddress();
-  bool match_source = device_to_sniff_ == source;
-  bool match_dest = device_to_sniff_ == dest;
+  model::packets::PacketType packet_type = packet.GetType();
+
+  bool match_source = address_ == source;
+  bool match_dest = address_ == dest;
   if (!match_source && !match_dest) {
     return;
   }
-  model::packets::PacketType packet_type = packet.GetType();
 
   if (packet_type == model::packets::PacketType::RSSI_WRAPPER) {
     auto wrapper_view = model::packets::RssiWrapperView::Create(packet);
diff --git a/tools/rootcanal/model/devices/sniffer.h b/tools/rootcanal/model/devices/sniffer.h
index 2688655..61f7022 100644
--- a/tools/rootcanal/model/devices/sniffer.h
+++ b/tools/rootcanal/model/devices/sniffer.h
@@ -36,17 +36,13 @@
     return std::make_shared<Sniffer>(args);
   }
 
-  // Return a string representation of the type of device.
   virtual std::string GetTypeString() const override { return "sniffer"; }
 
   virtual void IncomingPacket(
       model::packets::LinkLayerPacketView packet) override;
 
-  virtual void TimerTick() override;
-
  private:
   static bool registered_;
-  Address device_to_sniff_{};
 };
 
 }  // namespace rootcanal
diff --git a/tools/rootcanal/model/hci/h4.h b/tools/rootcanal/model/hci/h4.h
new file mode 100644
index 0000000..e05a129
--- /dev/null
+++ b/tools/rootcanal/model/hci/h4.h
@@ -0,0 +1,32 @@
+//
+// Copyright 2021 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+#pragma once
+
+#include <cstdint>  // for uint8_t
+
+namespace rootcanal {
+
+enum class PacketType : uint8_t {
+  UNKNOWN = 0,
+  COMMAND = 1,
+  ACL = 2,
+  SCO = 3,
+  EVENT = 4,
+  ISO = 5,
+};
+
+}  // namespace rootcanal
diff --git a/tools/rootcanal/model/hci/h4_data_channel_packetizer.cc b/tools/rootcanal/model/hci/h4_data_channel_packetizer.cc
index 99f8875..3f73949 100644
--- a/tools/rootcanal/model/hci/h4_data_channel_packetizer.cc
+++ b/tools/rootcanal/model/hci/h4_data_channel_packetizer.cc
@@ -26,10 +26,10 @@
 #include <utility>      // for move
 #include <vector>       // for vector
 
+#include "log.h"                     // for LOG_ERROR, LOG_ALWAYS_FATAL
 #include "model/hci/h4_parser.h"     // for H4Parser, ClientDisconnectCa...
 #include "model/hci/hci_protocol.h"  // for PacketReadCallback, AsyncDataChannel
 #include "net/async_data_channel.h"  // for AsyncDataChannel
-#include "os/log.h"                  // for LOG_ERROR, LOG_ALWAYS_FATAL
 
 namespace rootcanal {
 
@@ -39,7 +39,7 @@
     PacketReadCallback sco_cb, PacketReadCallback iso_cb,
     ClientDisconnectCallback disconnect_cb)
     : uart_socket_(socket),
-      h4_parser_(command_cb, event_cb, acl_cb, sco_cb, iso_cb),
+      h4_parser_(command_cb, event_cb, acl_cb, sco_cb, iso_cb, true),
       disconnect_cb_(std::move(disconnect_cb)) {}
 
 size_t H4DataChannelPacketizer::Send(uint8_t type, const uint8_t* data,
diff --git a/tools/rootcanal/model/hci/h4_packetizer.cc b/tools/rootcanal/model/hci/h4_packetizer.cc
index 0394d61..c781dd4 100644
--- a/tools/rootcanal/model/hci/h4_packetizer.cc
+++ b/tools/rootcanal/model/hci/h4_packetizer.cc
@@ -23,8 +23,7 @@
 
 #include <cerrno>
 
-#include "os/log.h"
-#include "osi/include/osi.h"
+#include "log.h"
 
 namespace rootcanal {
 
@@ -42,8 +41,8 @@
                         {const_cast<uint8_t*>(data), length}};
   ssize_t ret = 0;
   do {
-    OSI_NO_INTR(ret = writev(uart_fd_, iov, sizeof(iov) / sizeof(iov[0])));
-  } while (-1 == ret && EAGAIN == errno);
+    ret = writev(uart_fd_, iov, sizeof(iov) / sizeof(iov[0]));
+  } while (-1 == ret && (EINTR == errno || EAGAIN == errno));
 
   if (ret == -1) {
     LOG_ERROR("Error writing to UART (%s)", strerror(errno));
@@ -60,7 +59,10 @@
   std::vector<uint8_t> buffer(bytes_to_read);
 
   ssize_t bytes_read;
-  OSI_NO_INTR(bytes_read = read(fd, buffer.data(), bytes_to_read));
+  do {
+    bytes_read = read(fd, buffer.data(), bytes_to_read);
+  } while (bytes_read == -1 && errno == EINTR);
+
   if (bytes_read == 0) {
     LOG_INFO("remote disconnected!");
     disconnected_ = true;
diff --git a/tools/rootcanal/model/hci/h4_parser.cc b/tools/rootcanal/model/hci/h4_parser.cc
index f55be5c..0498c99 100644
--- a/tools/rootcanal/model/hci/h4_parser.cc
+++ b/tools/rootcanal/model/hci/h4_parser.cc
@@ -16,15 +16,15 @@
 
 #include "model/hci/h4_parser.h"  // for H4Parser, PacketType, H4Pars...
 
-#include <stddef.h>  // for size_t
-
+#include <array>
+#include <cstddef>     // for size_t
 #include <cstdint>     // for uint8_t, int32_t
 #include <functional>  // for function
 #include <utility>     // for move
 #include <vector>      // for vector
 
+#include "log.h"                     // for LOG_ALWAYS_FATAL, LOG_INFO
 #include "model/hci/hci_protocol.h"  // for PacketReadCallback
-#include "os/log.h"                  // for LOG_ALWAYS_FATAL, LOG_INFO
 
 namespace rootcanal {
 
@@ -60,12 +60,13 @@
 
 H4Parser::H4Parser(PacketReadCallback command_cb, PacketReadCallback event_cb,
                    PacketReadCallback acl_cb, PacketReadCallback sco_cb,
-                   PacketReadCallback iso_cb)
+                   PacketReadCallback iso_cb, bool enable_recovery_state)
     : command_cb_(std::move(command_cb)),
       event_cb_(std::move(event_cb)),
       acl_cb_(std::move(acl_cb)),
       sco_cb_(std::move(sco_cb)),
-      iso_cb_(std::move(iso_cb)) {}
+      iso_cb_(std::move(iso_cb)),
+      enable_recovery_state_(enable_recovery_state) {}
 
 void H4Parser::OnPacketReady() {
   switch (hci_packet_type_) {
@@ -95,6 +96,7 @@
 size_t H4Parser::BytesRequested() {
   switch (state_) {
     case HCI_TYPE:
+    case HCI_RECOVERY:
       return 1;
     case HCI_PREAMBLE:
     case HCI_PAYLOAD:
@@ -102,7 +104,7 @@
   }
 }
 
-bool H4Parser::Consume(uint8_t* buffer, int32_t bytes_read) {
+bool H4Parser::Consume(const uint8_t* buffer, int32_t bytes_read) {
   size_t bytes_to_read = BytesRequested();
   if (bytes_read <= 0) {
     LOG_INFO("remote disconnected, or unhandled error?");
@@ -128,6 +130,36 @@
       packet_type_ = *buffer;
       packet_.clear();
       break;
+
+    case HCI_RECOVERY: {
+      // Skip all received bytes until the HCI Reset command is received.
+      // The parser can end up in a bad state when the host is restarted.
+      const std::array<uint8_t, 4> reset_command{0x01, 0x03, 0x0c, 0x00};
+      size_t offset = packet_.size();
+      LOG_WARN("Received byte in recovery state : 0x%x",
+               static_cast<unsigned>(*buffer));
+      packet_.push_back(*buffer);
+
+      // Last byte does not match expected byte in the sequence.
+      // Drop all the bytes and start over.
+      if (packet_[offset] != reset_command[offset]) {
+        packet_.clear();
+        // The mismatched byte can also be the first of the correct sequence.
+        if (*buffer == reset_command[0]) {
+          packet_.push_back(*buffer);
+        }
+      }
+
+      // Received full reset command.
+      if (packet_.size() == reset_command.size()) {
+        LOG_INFO("Received HCI Reset command, exiting recovery state");
+        // Pop the Idc from the received packet.
+        packet_.erase(packet_.begin());
+        bytes_wanted_ = 0;
+      }
+      break;
+    }
+
     case HCI_PREAMBLE:
     case HCI_PAYLOAD:
       packet_.insert(packet_.end(), buffer, buffer + bytes_read);
@@ -143,13 +175,21 @@
           hci_packet_type_ != PacketType::COMMAND &&
           hci_packet_type_ != PacketType::EVENT &&
           hci_packet_type_ != PacketType::ISO) {
-        LOG_ALWAYS_FATAL("Unimplemented packet type %hhd", packet_type_);
+        if (!enable_recovery_state_) {
+          LOG_ALWAYS_FATAL("Received invalid packet type 0x%x",
+                           static_cast<unsigned>(packet_type_));
+        }
+        LOG_ERROR("Received invalid packet type 0x%x, entering recovery state",
+                  static_cast<unsigned>(packet_type_));
+        state_ = HCI_RECOVERY;
+        hci_packet_type_ = PacketType::COMMAND;
+        bytes_wanted_ = 1;
+      } else {
+        state_ = HCI_PREAMBLE;
+        bytes_wanted_ = preamble_size[static_cast<size_t>(hci_packet_type_)];
       }
-      state_ = HCI_PREAMBLE;
-      bytes_wanted_ = preamble_size[static_cast<size_t>(hci_packet_type_)];
       break;
     case HCI_PREAMBLE:
-
       if (bytes_wanted_ == 0) {
         size_t payload_size =
             HciGetPacketLengthForType(hci_packet_type_, packet_.data());
@@ -162,6 +202,7 @@
         }
       }
       break;
+    case HCI_RECOVERY:
     case HCI_PAYLOAD:
       if (bytes_wanted_ == 0) {
         OnPacketReady();
diff --git a/tools/rootcanal/model/hci/h4_parser.h b/tools/rootcanal/model/hci/h4_parser.h
index 8a8802c..1a85760 100644
--- a/tools/rootcanal/model/hci/h4_parser.h
+++ b/tools/rootcanal/model/hci/h4_parser.h
@@ -23,6 +23,7 @@
 #include <ostream>     // for operator<<, ostream
 #include <vector>      // for vector
 
+#include "model/hci/h4.h"            // for PacketType
 #include "model/hci/hci_protocol.h"  // for PacketReadCallback
 
 namespace rootcanal {
@@ -30,15 +31,6 @@
 using HciPacketReadyCallback = std::function<void(void)>;
 using ClientDisconnectCallback = std::function<void()>;
 
-enum class PacketType : uint8_t {
-  UNKNOWN = 0,
-  COMMAND = 1,
-  ACL = 2,
-  SCO = 3,
-  EVENT = 4,
-  ISO = 5,
-};
-
 // An H4 Parser can parse H4 Packets and will invoke the proper callback
 // once a packet has been parsed.
 //
@@ -53,14 +45,14 @@
 // The parser keeps internal state and is not thread safe.
 class H4Parser {
  public:
-  enum State { HCI_TYPE, HCI_PREAMBLE, HCI_PAYLOAD };
+  enum State { HCI_TYPE, HCI_PREAMBLE, HCI_PAYLOAD, HCI_RECOVERY };
 
   H4Parser(PacketReadCallback command_cb, PacketReadCallback event_cb,
            PacketReadCallback acl_cb, PacketReadCallback sco_cb,
-           PacketReadCallback iso_cb);
+           PacketReadCallback iso_cb, bool enable_recovery_state = false);
 
   // Consumes the given number of bytes, returns true on success.
-  bool Consume(uint8_t* buffer, int32_t bytes);
+  bool Consume(const uint8_t* buffer, int32_t bytes);
 
   // The maximum number of bytes the parser can consume in the current state.
   size_t BytesRequested();
@@ -70,13 +62,15 @@
 
   State CurrentState() { return state_; };
 
+  void EnableRecovery() { enable_recovery_state_ = true; }
+  void DisableRecovery() { enable_recovery_state_ = false; }
+
  private:
   void OnPacketReady();
 
   // 2 bytes for opcode, 1 byte for parameter length (Volume 2, Part E, 5.4.1)
   static constexpr size_t COMMAND_PREAMBLE_SIZE = 3;
   static constexpr size_t COMMAND_LENGTH_OFFSET = 2;
-
   // 2 bytes for handle, 2 bytes for data length (Volume 2, Part E, 5.4.2)
   static constexpr size_t ACL_PREAMBLE_SIZE = 4;
   static constexpr size_t ACL_LENGTH_OFFSET = 2;
@@ -109,13 +103,28 @@
   uint8_t packet_type_{};
   std::vector<uint8_t> packet_;
   size_t bytes_wanted_{0};
+  bool enable_recovery_state_{false};
 };
 
 inline std::ostream& operator<<(std::ostream& os,
                                 H4Parser::State const& state_) {
-  os << (state_ == H4Parser::State::HCI_TYPE       ? "HCI_TYPE"
-         : state_ == H4Parser::State::HCI_PREAMBLE ? "HCI_PREAMBLE"
-                                                   : "HCI_PAYLOAD");
+  switch (state_) {
+    case H4Parser::State::HCI_TYPE:
+      os << "HCI_TYPE";
+      break;
+    case H4Parser::State::HCI_PREAMBLE:
+      os << "HCI_PREAMBLE";
+      break;
+    case H4Parser::State::HCI_PAYLOAD:
+      os << "HCI_PAYLOAD";
+      break;
+    case H4Parser::State::HCI_RECOVERY:
+      os << "HCI_RECOVERY";
+      break;
+    default:
+      os << "unknown state " << static_cast<int>(state_);
+      break;
+  }
   return os;
 }
 
diff --git a/tools/rootcanal/model/hci/hci_protocol.cc b/tools/rootcanal/model/hci/hci_protocol.cc
index 6a9b474..a14d2e5 100644
--- a/tools/rootcanal/model/hci/hci_protocol.cc
+++ b/tools/rootcanal/model/hci/hci_protocol.cc
@@ -21,7 +21,7 @@
 #include <string.h>
 #include <unistd.h>
 
-#include "os/log.h"
+#include "log.h"
 
 namespace rootcanal {
 
diff --git a/tools/rootcanal/model/hci/hci_sniffer.cc b/tools/rootcanal/model/hci/hci_sniffer.cc
new file mode 100644
index 0000000..4b71008
--- /dev/null
+++ b/tools/rootcanal/model/hci/hci_sniffer.cc
@@ -0,0 +1,113 @@
+/*
+ * Copyright 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "hci_sniffer.h"
+
+#include "pcap.h"
+
+namespace rootcanal {
+
+HciSniffer::HciSniffer(std::shared_ptr<HciTransport> transport,
+                       std::shared_ptr<std::ostream> outputStream)
+    : transport_(transport) {
+  SetOutputStream(outputStream);
+}
+
+void HciSniffer::SetOutputStream(std::shared_ptr<std::ostream> outputStream) {
+  output_ = outputStream;
+  if (output_) {
+    uint32_t linktype = 201;  // http://www.tcpdump.org/linktypes.html
+                              // LINKTYPE_BLUETOOTH_HCI_H4_WITH_PHDR
+
+    pcap::WriteHeader(*output_, linktype);
+  }
+}
+
+void HciSniffer::AppendRecord(PacketDirection packet_direction,
+                              PacketType packet_type,
+                              const std::vector<uint8_t>& packet) {
+  if (output_ == nullptr) {
+    return;
+  }
+  pcap::WriteRecordHeader(*output_, 4 + 1 + packet.size());
+
+  // http://www.tcpdump.org/linktypes.html LINKTYPE_BLUETOOTH_HCI_H4_WITH_PHDR
+  char direction[4] = {0, 0, 0, static_cast<char>(packet_direction)};
+  uint8_t idc = static_cast<uint8_t>(packet_type);
+
+  output_->write(direction, sizeof(direction));
+  output_->write((char*)&idc, 1);
+  output_->write((char*)packet.data(), packet.size());
+  output_->flush();
+}
+
+void HciSniffer::RegisterCallbacks(PacketCallback command_callback,
+                                   PacketCallback acl_callback,
+                                   PacketCallback sco_callback,
+                                   PacketCallback iso_callback,
+                                   CloseCallback close_callback) {
+  transport_->RegisterCallbacks(
+      [this,
+       command_callback](const std::shared_ptr<std::vector<uint8_t>> command) {
+        AppendRecord(PacketDirection::HOST_TO_CONTROLLER, PacketType::COMMAND,
+                     *command);
+        command_callback(command);
+      },
+      [this, acl_callback](const std::shared_ptr<std::vector<uint8_t>> acl) {
+        AppendRecord(PacketDirection::HOST_TO_CONTROLLER, PacketType::ACL,
+                     *acl);
+        acl_callback(acl);
+      },
+      [this, sco_callback](const std::shared_ptr<std::vector<uint8_t>> sco) {
+        AppendRecord(PacketDirection::HOST_TO_CONTROLLER, PacketType::SCO,
+                     *sco);
+        sco_callback(sco);
+      },
+      [this, iso_callback](const std::shared_ptr<std::vector<uint8_t>> iso) {
+        AppendRecord(PacketDirection::HOST_TO_CONTROLLER, PacketType::ISO,
+                     *iso);
+        iso_callback(iso);
+      },
+      close_callback);
+}
+
+void HciSniffer::TimerTick() { transport_->TimerTick(); }
+
+void HciSniffer::Close() {
+  transport_->Close();
+  output_->flush();
+}
+
+void HciSniffer::SendEvent(const std::vector<uint8_t>& packet) {
+  AppendRecord(PacketDirection::CONTROLLER_TO_HOST, PacketType::EVENT, packet);
+  transport_->SendEvent(packet);
+}
+
+void HciSniffer::SendAcl(const std::vector<uint8_t>& packet) {
+  AppendRecord(PacketDirection::CONTROLLER_TO_HOST, PacketType::ACL, packet);
+  transport_->SendAcl(packet);
+}
+
+void HciSniffer::SendSco(const std::vector<uint8_t>& packet) {
+  AppendRecord(PacketDirection::CONTROLLER_TO_HOST, PacketType::SCO, packet);
+  transport_->SendSco(packet);
+}
+
+void HciSniffer::SendIso(const std::vector<uint8_t>& packet) {
+  AppendRecord(PacketDirection::CONTROLLER_TO_HOST, PacketType::ISO, packet);
+  transport_->SendIso(packet);
+}
+}  // namespace rootcanal
diff --git a/tools/rootcanal/model/hci/hci_sniffer.h b/tools/rootcanal/model/hci/hci_sniffer.h
new file mode 100644
index 0000000..1b5cc97
--- /dev/null
+++ b/tools/rootcanal/model/hci/hci_sniffer.h
@@ -0,0 +1,77 @@
+/*
+ * Copyright 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include <cstdint>
+#include <fstream>
+#include <memory>
+#include <ostream>
+
+#include "model/hci/h4.h"
+#include "model/hci/hci_transport.h"
+
+namespace rootcanal {
+
+enum class PacketDirection : uint8_t {
+  CONTROLLER_TO_HOST = 0,
+  HOST_TO_CONTROLLER = 1,
+};
+
+// A Hci Transport that logs all the in and out going
+// packets to a stream.
+class HciSniffer : public HciTransport {
+ public:
+  HciSniffer(std::shared_ptr<HciTransport> transport,
+             std::shared_ptr<std::ostream> outputStream = nullptr);
+  ~HciSniffer() = default;
+
+  static std::shared_ptr<HciTransport> Create(
+      std::shared_ptr<HciTransport> transport,
+      std::shared_ptr<std::ostream> outputStream = nullptr) {
+    return std::make_shared<HciSniffer>(transport, outputStream);
+  }
+
+  // Sets and initializes the output stream
+  void SetOutputStream(std::shared_ptr<std::ostream> outputStream);
+
+  void SendEvent(const std::vector<uint8_t>& packet) override;
+
+  void SendAcl(const std::vector<uint8_t>& packet) override;
+
+  void SendSco(const std::vector<uint8_t>& packet) override;
+
+  void SendIso(const std::vector<uint8_t>& packet) override;
+
+  void RegisterCallbacks(PacketCallback command_callback,
+                         PacketCallback acl_callback,
+                         PacketCallback sco_callback,
+                         PacketCallback iso_callback,
+                         CloseCallback close_callback) override;
+
+  void TimerTick() override;
+
+  void Close() override;
+
+ private:
+  void AppendRecord(PacketDirection direction, PacketType type,
+                    const std::vector<uint8_t>& packet);
+
+  std::shared_ptr<std::ostream> output_;
+  std::shared_ptr<HciTransport> transport_;
+};
+
+}  // namespace rootcanal
diff --git a/tools/rootcanal/model/hci/hci_socket_transport.cc b/tools/rootcanal/model/hci/hci_socket_transport.cc
index 0d6f0c8..572a785 100644
--- a/tools/rootcanal/model/hci/hci_socket_transport.cc
+++ b/tools/rootcanal/model/hci/hci_socket_transport.cc
@@ -16,7 +16,7 @@
 
 #include "hci_socket_transport.h"
 
-#include "os/log.h"  // for LOG_INFO, LOG_ALWAYS_FATAL
+#include "log.h"  // for LOG_INFO, LOG_ALWAYS_FATAL
 
 namespace rootcanal {
 
diff --git a/tools/rootcanal/model/hci/hci_socket_transport.h b/tools/rootcanal/model/hci/hci_socket_transport.h
index f3f42f4..30817d0 100644
--- a/tools/rootcanal/model/hci/hci_socket_transport.h
+++ b/tools/rootcanal/model/hci/hci_socket_transport.h
@@ -31,7 +31,7 @@
   HciSocketTransport(std::shared_ptr<AsyncDataChannel> socket);
   ~HciSocketTransport() = default;
 
-  static std::shared_ptr<HciSocketTransport> Create(
+  static std::shared_ptr<HciTransport> Create(
       std::shared_ptr<AsyncDataChannel> socket) {
     return std::make_shared<HciSocketTransport>(socket);
   }
diff --git a/tools/rootcanal/model/hci/hci_transport.h b/tools/rootcanal/model/hci/hci_transport.h
index 8ffb349..bf4769c 100644
--- a/tools/rootcanal/model/hci/hci_transport.h
+++ b/tools/rootcanal/model/hci/hci_transport.h
@@ -17,6 +17,7 @@
 #pragma once
 
 #include <functional>
+#include <memory>
 #include <vector>
 
 namespace rootcanal {
diff --git a/tools/rootcanal/model/setup/async_manager.cc b/tools/rootcanal/model/setup/async_manager.cc
index 01447ec..2ae3744 100644
--- a/tools/rootcanal/model/setup/async_manager.cc
+++ b/tools/rootcanal/model/setup/async_manager.cc
@@ -24,7 +24,7 @@
 #include <vector>
 
 #include "fcntl.h"
-#include "os/log.h"
+#include "log.h"
 #include "sys/select.h"
 #include "unistd.h"
 
@@ -364,6 +364,7 @@
     std::chrono::steady_clock::time_point time;
     bool periodic;
     std::chrono::milliseconds period{};
+    std::mutex in_callback; // Taken when the callback is active
     TaskCallback callback;
     AsyncTaskId task_id;
     AsyncUserId user_id;
@@ -381,8 +382,22 @@
     if (tasks_by_id_.count(async_task_id) == 0) {
       return false;
     }
-    task_queue_.erase(tasks_by_id_[async_task_id]);
-    tasks_by_id_.erase(async_task_id);
+
+    // Now make sure we are not running this task.
+    // 2 cases:
+    // - This is called from thread_, this means a running
+    //   scheduled task is actually unregistering. All bets are off.
+    // - Another thread is calling us, let's make sure the task is not active.
+    if (thread_.get_id() != std::this_thread::get_id()) {
+      auto task = tasks_by_id_[async_task_id];
+      const std::lock_guard<std::mutex> lock(task->in_callback);
+      task_queue_.erase(task);
+      tasks_by_id_.erase(async_task_id);
+    } else {
+      task_queue_.erase(tasks_by_id_[async_task_id]);
+      tasks_by_id_.erase(async_task_id);
+    }
+
     return true;
   }
 
@@ -437,11 +452,12 @@
   void ThreadRoutine() {
     while (running_) {
       TaskCallback callback;
+      std::shared_ptr<Task> task_p;
       bool run_it = false;
       {
         std::unique_lock<std::mutex> guard(internal_mutex_);
         if (!task_queue_.empty()) {
-          std::shared_ptr<Task> task_p = *(task_queue_.begin());
+          task_p = *(task_queue_.begin());
           if (task_p->time < std::chrono::steady_clock::now()) {
             run_it = true;
             callback = task_p->callback;
@@ -458,6 +474,7 @@
         }
       }
       if (run_it) {
+        const std::lock_guard<std::mutex> lock(task_p->in_callback);
         callback();
       }
       {
diff --git a/tools/rootcanal/model/setup/async_manager.h b/tools/rootcanal/model/setup/async_manager.h
index f6603c4..e82fa37 100644
--- a/tools/rootcanal/model/setup/async_manager.h
+++ b/tools/rootcanal/model/setup/async_manager.h
@@ -77,18 +77,18 @@
                                     std::chrono::milliseconds period,
                                     const TaskCallback& callback);
 
-  // Cancels the/every future occurrence of the action specified by this id. It
-  // is guaranteed that the associated callback will not be called after this
-  // method returns (it could be called during the execution of the method).
-  // The calling thread may block until the scheduling thread acknowledges the
-  // cancellation.
+  // Cancels the/every future occurrence of the action specified by this id.
+  // The following invariants will hold:
+  // - The task will not be invoked after this method returns
+  // - If the task is currently running it will block until the task is
+  //   completed, unless cancel is called from the running task.
   bool CancelAsyncTask(AsyncTaskId async_task_id);
 
-  // Cancels the/every future occurrence of the action specified by this id. It
-  // is guaranteed that the associated callback will not be called after this
-  // method returns (it could be called during the execution of the method).
-  // The calling thread may block until the scheduling thread acknowledges the
-  // cancellation.
+  // Cancels the/every future occurrence of the action specified by this id.
+  // The following invariants will hold:
+  // - The task will not be invoked after this method returns
+  // - If the task is currently running it will block until the task is
+  //   completed, unless cancel is called from the running task.
   bool CancelAsyncTasksFromUser(AsyncUserId user_id);
 
   // Execs the given code in a synchronized manner. It is guaranteed that code
diff --git a/tools/rootcanal/model/setup/device_boutique.cc b/tools/rootcanal/model/setup/device_boutique.cc
index 3acb5b5..0b5a830 100644
--- a/tools/rootcanal/model/setup/device_boutique.cc
+++ b/tools/rootcanal/model/setup/device_boutique.cc
@@ -16,7 +16,7 @@
 
 #include "device_boutique.h"
 
-#include "os/log.h"
+#include "log.h"
 
 using std::vector;
 
diff --git a/tools/rootcanal/model/setup/phy_layer_factory.cc b/tools/rootcanal/model/setup/phy_layer_factory.cc
index 5c76d8a..b92092b 100644
--- a/tools/rootcanal/model/setup/phy_layer_factory.cc
+++ b/tools/rootcanal/model/setup/phy_layer_factory.cc
@@ -57,7 +57,7 @@
 
 void PhyLayerFactory::Send(
     const std::shared_ptr<model::packets::LinkLayerPacketBuilder> packet,
-    uint32_t id) {
+    uint32_t id, [[maybe_unused]] uint32_t device_id) {
   // Convert from a Builder to a View
   auto bytes = std::make_shared<std::vector<uint8_t>>();
   bluetooth::packet::BitInserter i(*bytes);
@@ -69,11 +69,11 @@
       model::packets::LinkLayerPacketView::Create(packet_view);
   ASSERT(link_layer_packet_view.IsValid());
 
-  Send(link_layer_packet_view, id);
+  Send(link_layer_packet_view, id, device_id);
 }
 
 void PhyLayerFactory::Send(model::packets::LinkLayerPacketView packet,
-                           uint32_t id) {
+                           uint32_t id, [[maybe_unused]] uint32_t device_id) {
   for (const auto& phy : phy_layers_) {
     if (id != phy->GetId()) {
       phy->Receive(packet);
@@ -118,11 +118,11 @@
 
 void PhyLayerImpl::Send(
     const std::shared_ptr<model::packets::LinkLayerPacketBuilder> packet) {
-  factory_->Send(packet, GetId());
+  factory_->Send(packet, GetId(), GetDeviceId());
 }
 
 void PhyLayerImpl::Send(model::packets::LinkLayerPacketView packet) {
-  factory_->Send(packet, GetId());
+  factory_->Send(packet, GetId(), GetDeviceId());
 }
 
 void PhyLayerImpl::Unregister() { factory_->UnregisterPhyLayer(GetId()); }
diff --git a/tools/rootcanal/model/setup/phy_layer_factory.h b/tools/rootcanal/model/setup/phy_layer_factory.h
index 1955bf2..81baf07 100644
--- a/tools/rootcanal/model/setup/phy_layer_factory.h
+++ b/tools/rootcanal/model/setup/phy_layer_factory.h
@@ -54,12 +54,14 @@
  protected:
   virtual void Send(
       std::shared_ptr<model::packets::LinkLayerPacketBuilder> packet,
-      uint32_t id);
-  virtual void Send(model::packets::LinkLayerPacketView packet, uint32_t id);
+      uint32_t phy_id, uint32_t device_id);
+  virtual void Send(
+      model::packets::LinkLayerPacketView packet,
+      uint32_t phy_id, uint32_t device_id);
+  std::list<std::shared_ptr<PhyLayer>> phy_layers_;
 
  private:
   Phy::Type phy_type_;
-  std::list<std::shared_ptr<PhyLayer>> phy_layers_;
   uint32_t next_id_{1};
   const uint32_t factory_id_;
 };
diff --git a/tools/rootcanal/model/setup/test_channel_transport.cc b/tools/rootcanal/model/setup/test_channel_transport.cc
index 47a3a41..29fa6f5 100644
--- a/tools/rootcanal/model/setup/test_channel_transport.cc
+++ b/tools/rootcanal/model/setup/test_channel_transport.cc
@@ -23,8 +23,8 @@
 #include <cstring>      // for strerror
 #include <type_traits>  // for remove_extent_t
 
+#include "log.h"                     // for LOG_INFO, ASSERT_LOG, LOG_WARN
 #include "net/async_data_channel.h"  // for AsyncDataChannel
-#include "os/log.h"                  // for LOG_INFO, ASSERT_LOG, LOG_WARN
 
 using std::vector;
 
diff --git a/tools/rootcanal/model/setup/test_command_handler.cc b/tools/rootcanal/model/setup/test_command_handler.cc
index 5c95931..a4a1d79 100644
--- a/tools/rootcanal/model/setup/test_command_handler.cc
+++ b/tools/rootcanal/model/setup/test_command_handler.cc
@@ -23,8 +23,7 @@
 #include <regex>
 
 #include "device_boutique.h"
-#include "os/log.h"
-#include "osi/include/osi.h"
+#include "log.h"
 #include "phy.h"
 
 using std::vector;
@@ -63,25 +62,16 @@
   AddDeviceToPhy({"1", "2"});
 
   // Add default test devices and add the devices to the phys
+  //
   // Add({"beacon", "be:ac:10:00:00:01", "1000"});
   // AddDeviceToPhy({"2", "1"});
-
-  // Add({"keyboard", "cc:1c:eb:0a:12:d1", "500"});
-  // AddDeviceToPhy({"3", "1"});
-
-  // Add({"classic", "c1:a5:51:c0:00:01", "22"});
+  //
+  // Add({"sniffer", "ca:12:1c:17:00:01"});
+  // AddDeviceToPhy({"3", "2"});
+  //
+  // Add({"sniffer", "3c:5a:b4:04:05:06"});
   // AddDeviceToPhy({"4", "2"});
 
-  // Add({"car_kit", "ca:12:1c:17:00:01", "238"});
-  // AddDeviceToPhy({"5", "2"});
-
-  // Add({"sniffer", "ca:12:1c:17:00:01"});
-  // AddDeviceToPhy({"6", "2"});
-
-  // Add({"sniffer", "3c:5a:b4:04:05:06"});
-  // AddDeviceToPhy({"7", "2"});
-  // Add({"remote_loopback_device", "10:0d:00:ba:c1:06"});
-  // AddDeviceToPhy({"8", "2"});
   List({});
 
   SetTimerPeriod({"10"});
@@ -188,15 +178,19 @@
 }
 
 void TestCommandHandler::AddPhy(const vector<std::string>& args) {
-  if (args[0] == "LOW_ENERGY") {
+  if (args.size() != 1) {
+    response_string_ = "TestCommandHandler 'add_phy' takes one argument";
+  } else if (args[0] == "LOW_ENERGY") {
     model_.AddPhy(Phy::Type::LOW_ENERGY);
+    response_string_ = "TestCommandHandler 'add_phy' called with LOW_ENERGY";
   } else if (args[0] == "BR_EDR") {
     model_.AddPhy(Phy::Type::BR_EDR);
+    response_string_ = "TestCommandHandler 'add_phy' called with BR_EDR";
   } else {
     response_string_ =
         "TestCommandHandler 'add_phy' with unrecognized type " + args[0];
-    send_response_(response_string_);
   }
+  send_response_(response_string_);
 }
 
 void TestCommandHandler::DelPhy(const vector<std::string>& args) {
diff --git a/tools/rootcanal/model/setup/test_model.cc b/tools/rootcanal/model/setup/test_model.cc
index 2746180..1b4c998 100644
--- a/tools/rootcanal/model/setup/test_model.cc
+++ b/tools/rootcanal/model/setup/test_model.cc
@@ -25,7 +25,7 @@
 #include <utility>      // for move
 
 #include "include/phy.h"  // for Phy, Phy::Type
-#include "os/log.h"       // for LOG_WARN, LOG_INFO
+#include "log.h"          // for LOG_WARN, LOG_INFO
 
 namespace rootcanal {
 
@@ -42,8 +42,10 @@
     std::function<void(AsyncUserId)> cancel_tasks_from_user,
     std::function<void(AsyncTaskId)> cancel,
     std::function<std::shared_ptr<Device>(const std::string&, int, Phy::Type)>
-        connect_to_remote)
-    : get_user_id_(std::move(get_user_id)),
+        connect_to_remote,
+    std::array<uint8_t, 5> bluetooth_address_prefix)
+    : bluetooth_address_prefix_(std::move(bluetooth_address_prefix)),
+      get_user_id_(std::move(get_user_id)),
       schedule_task_(std::move(event_scheduler)),
       schedule_periodic_task_(std::move(periodic_event_scheduler)),
       cancel_task_(std::move(cancel)),
@@ -52,6 +54,10 @@
   model_user_id_ = get_user_id_();
 }
 
+TestModel::~TestModel() {
+  StopTimer();
+}
+
 void TestModel::SetTimerPeriod(std::chrono::milliseconds new_period) {
   timer_period_ = new_period;
 
@@ -94,10 +100,14 @@
 
 size_t TestModel::AddPhy(Phy::Type phy_type) {
   size_t factory_id = phys_.size();
-  phys_.emplace_back(phy_type, factory_id);
+  phys_.push_back(std::move(CreatePhy(phy_type, factory_id)));
   return factory_id;
 }
 
+std::unique_ptr<PhyLayerFactory> TestModel::CreatePhy(Phy::Type phy_type, size_t factory_id) {
+  return std::make_unique<PhyLayerFactory>(phy_type, factory_id);
+}
+
 void TestModel::DelPhy(size_t phy_index) {
   if (phy_index >= phys_.size()) {
     LOG_WARN("Unknown phy at index %zu", phy_index);
@@ -105,7 +115,7 @@
   }
   schedule_task_(
       model_user_id_, std::chrono::milliseconds(0),
-      [this, phy_index]() { phys_[phy_index].UnregisterAllPhyLayers(); });
+      [this, phy_index]() { phys_[phy_index]->UnregisterAllPhyLayers(); });
 }
 
 void TestModel::AddDeviceToPhy(size_t dev_index, size_t phy_index) {
@@ -118,7 +128,7 @@
     return;
   }
   auto dev = devices_[dev_index];
-  dev->RegisterPhyLayer(phys_[phy_index].GetPhyLayer(
+  dev->RegisterPhyLayer(phys_[phy_index]->GetPhyLayer(
       [dev](model::packets::LinkLayerPacketView packet) {
         dev->IncomingPacket(std::move(packet));
       },
@@ -137,8 +147,8 @@
   schedule_task_(model_user_id_, std::chrono::milliseconds(0),
                  [this, dev_index, phy_index]() {
                    devices_[dev_index]->UnregisterPhyLayer(
-                       phys_[phy_index].GetType(),
-                       phys_[phy_index].GetFactoryId());
+                       phys_[phy_index]->GetType(),
+                       phys_[phy_index]->GetFactoryId());
                  });
 }
 
@@ -150,7 +160,7 @@
   AsyncUserId user_id = get_user_id_();
 
   for (size_t i = 0; i < phys_.size(); i++) {
-    if (phy_type == phys_[i].GetType()) {
+    if (phy_type == phys_[i]->GetType()) {
       AddDeviceToPhy(index, i);
     }
   }
@@ -171,17 +181,25 @@
   AddLinkLayerConnection(dev, phy_type);
 }
 
-void TestModel::AddHciConnection(std::shared_ptr<HciDevice> dev) {
+size_t TestModel::AddHciConnection(std::shared_ptr<HciDevice> dev) {
   size_t index = Add(std::static_pointer_cast<Device>(dev));
+  auto bluetooth_address = Address{{
+      uint8_t(index),
+      bluetooth_address_prefix_[4],
+      bluetooth_address_prefix_[3],
+      bluetooth_address_prefix_[2],
+      bluetooth_address_prefix_[1],
+      bluetooth_address_prefix_[0],
+  }};
+  dev->SetAddress(bluetooth_address);
 
-  uint8_t raw[] = {0xda, 0x4c, 0x10, 0xde, 0x17, uint8_t(index)};  // Da HCI dev
-  auto addr = Address{{raw[5], raw[4], raw[3], raw[2], raw[1], raw[0]}};
-  dev->SetAddress(addr);
+  LOG_INFO("Initialized device with address %s",
+           bluetooth_address.ToString().c_str());
 
-  LOG_INFO("initialized %s", addr.ToString().c_str());
   for (size_t i = 0; i < phys_.size(); i++) {
     AddDeviceToPhy(index, i);
   }
+
   AsyncUserId user_id = get_user_id_();
   dev->RegisterTaskScheduler([user_id, this](std::chrono::milliseconds delay,
                                              TaskCallback task_callback) {
@@ -193,6 +211,7 @@
         user_id, std::chrono::milliseconds(0),
         [this, index, user_id]() { OnConnectionClosed(index, user_id); });
   });
+  return index;
 }
 
 void TestModel::OnConnectionClosed(size_t index, AsyncUserId user_id) {
@@ -228,7 +247,7 @@
   list_string_ += " Phys: \r\n";
   for (size_t i = 0; i < phys_.size(); i++) {
     list_string_ += "  " + std::to_string(i) + ":";
-    list_string_ += phys_[i].ToString() + " \r\n";
+    list_string_ += phys_[i]->ToString() + " \r\n";
   }
   return list_string_;
 }
diff --git a/tools/rootcanal/model/setup/test_model.h b/tools/rootcanal/model/setup/test_model.h
index 263346c..afdb66d 100644
--- a/tools/rootcanal/model/setup/test_model.h
+++ b/tools/rootcanal/model/setup/test_model.h
@@ -48,8 +48,10 @@
       std::function<void(AsyncUserId)> cancel_user_tasks,
       std::function<void(AsyncTaskId)> cancel,
       std::function<std::shared_ptr<Device>(const std::string&, int, Phy::Type)>
-          connect_to_remote);
-  ~TestModel() = default;
+          connect_to_remote,
+      std::array<uint8_t, 5> bluetooth_address_prefix = {0xda, 0x4c, 0x10, 0xde,
+                                                         0x17});
+  virtual ~TestModel();
 
   TestModel(TestModel& model) = delete;
   TestModel& operator=(const TestModel& model) = delete;
@@ -65,6 +67,9 @@
   // Add phy, return its index
   size_t AddPhy(Phy::Type phy_type);
 
+  // Allow derived classes to use custom phy layer
+  virtual std::unique_ptr<PhyLayerFactory> CreatePhy(Phy::Type phy_type, size_t phy_index);
+
   // Remove phy by index
   void DelPhy(size_t phy_index);
 
@@ -76,7 +81,8 @@
 
   // Handle incoming remote connections
   void AddLinkLayerConnection(std::shared_ptr<Device> dev, Phy::Type phy_type);
-  void AddHciConnection(std::shared_ptr<HciDevice> dev);
+  // Add an HCI device, return its index
+  size_t AddHciConnection(std::shared_ptr<HciDevice> dev);
 
   // Handle closed remote connections (both hci & link layer)
   void OnConnectionClosed(size_t index, AsyncUserId user_id);
@@ -100,10 +106,14 @@
   void Reset();
 
  private:
-  std::vector<PhyLayerFactory> phys_;
+  std::vector<std::unique_ptr<PhyLayerFactory>> phys_;
   std::vector<std::shared_ptr<Device>> devices_;
   std::string list_string_;
 
+  // Prefix used to generate public device addresses for hosts
+  // connecting over TCP.
+  std::array<uint8_t, 5> bluetooth_address_prefix_;
+
   // Callbacks to schedule tasks.
   std::function<AsyncUserId()> get_user_id_;
   std::function<AsyncTaskId(AsyncUserId, std::chrono::milliseconds,
diff --git a/tools/rootcanal/net/async_data_channel.h b/tools/rootcanal/net/async_data_channel.h
index 8d358ea..3cd3441 100644
--- a/tools/rootcanal/net/async_data_channel.h
+++ b/tools/rootcanal/net/async_data_channel.h
@@ -12,9 +12,6 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 #pragma once
-#ifdef _WIN32
-#include "msvc-posix.h"
-#endif
 
 #include <sys/types.h>
 
@@ -22,6 +19,13 @@
 #include <functional>
 #include <memory>
 
+#ifdef _WIN32
+#include <BaseTsd.h>
+typedef SSIZE_T ssize_t;
+#else
+#include <unistd.h>
+#endif
+
 namespace android {
 namespace net {
 
diff --git a/tools/rootcanal/net/posix/posix_async_socket.cc b/tools/rootcanal/net/posix/posix_async_socket.cc
index 1d57d10..38059c7 100644
--- a/tools/rootcanal/net/posix/posix_async_socket.cc
+++ b/tools/rootcanal/net/posix/posix_async_socket.cc
@@ -21,9 +21,12 @@
 
 #include <functional>  // for __base
 
+#include "log.h"                        // for LOG_INFO
 #include "model/setup/async_manager.h"  // for AsyncManager
-#include "os/log.h"                     // for LOG_INFO
-#include "osi/include/osi.h"            // for OSI_NO_INTR
+
+#ifdef _WIN32
+#include "msvc-posix.h"
+#endif
 
 /* set  for very verbose debugging */
 #ifndef DEBUG
@@ -63,9 +66,15 @@
 PosixAsyncSocket::~PosixAsyncSocket() { Close(); }
 
 ssize_t PosixAsyncSocket::Recv(uint8_t* buffer, uint64_t bufferSize) {
+  if (fd_ == -1) {
+    // Socket was closed locally.
+    return 0;
+  }
+
   errno = 0;
   ssize_t res = 0;
-  OSI_NO_INTR(res = read(fd_, buffer, bufferSize));
+  REPEAT_UNTIL_NO_INTR(res = read(fd_, buffer, bufferSize));
+
   if (res < 0) {
     DD("Recv < 0: %s (%d)", strerror(errno), fd_);
   }
@@ -85,7 +94,8 @@
   // the socket.
   const int sendFlags = 0;
 #endif
-  OSI_NO_INTR(res = send(fd_, buffer, bufferSize, sendFlags));
+
+  REPEAT_UNTIL_NO_INTR(res = send(fd_, buffer, bufferSize, sendFlags));
 
   DD("%zd bytes (%d)", res, fd_);
   return res;
@@ -122,7 +132,7 @@
              &error_code_size);
 
   // shutdown sockets if possible,
-  OSI_NO_INTR(shutdown(fd_, SHUT_RDWR));
+  REPEAT_UNTIL_NO_INTR(shutdown(fd_, SHUT_RDWR));
 
   error_code = ::close(fd_);
   if (error_code == -1) {
diff --git a/tools/rootcanal/net/posix/posix_async_socket.h b/tools/rootcanal/net/posix/posix_async_socket.h
index 0dbc878..8317d9f 100644
--- a/tools/rootcanal/net/posix/posix_async_socket.h
+++ b/tools/rootcanal/net/posix/posix_async_socket.h
@@ -85,3 +85,8 @@
 };
 }  // namespace net
 }  // namespace android
+
+// Re-run |fn| system call until the system call doesn't cause EINTR.
+#define REPEAT_UNTIL_NO_INTR(fn) \
+  do {                           \
+  } while ((fn) == -1 && errno == EINTR)
diff --git a/tools/rootcanal/net/posix/posix_async_socket_connector.cc b/tools/rootcanal/net/posix/posix_async_socket_connector.cc
index 4e7531b..0a754d4 100644
--- a/tools/rootcanal/net/posix/posix_async_socket_connector.cc
+++ b/tools/rootcanal/net/posix/posix_async_socket_connector.cc
@@ -24,9 +24,8 @@
 
 #include <type_traits>  // for remove_extent_t
 
+#include "log.h"                           // for LOG_INFO
 #include "net/posix/posix_async_socket.h"  // for PosixAsyncSocket
-#include "os/log.h"                        // for LOG_INFO
-#include "osi/include/osi.h"               // for OSI_NO_INTR
 
 namespace android {
 namespace net {
@@ -83,8 +82,10 @@
           .revents = 0,
       },
   };
+
   int numFdsReady = 0;
-  OSI_NO_INTR(numFdsReady = ::poll(fds, 1, timeout.count()));
+  REPEAT_UNTIL_NO_INTR(numFdsReady = ::poll(fds, 1, timeout.count()));
+
   if (numFdsReady <= 0) {
     LOG_INFO("Failed to connect to %s:%d, error:  %s", server.c_str(), port,
              strerror(errno));
diff --git a/tools/rootcanal/net/posix/posix_async_socket_server.cc b/tools/rootcanal/net/posix/posix_async_socket_server.cc
index 0615fda..0b6919d 100644
--- a/tools/rootcanal/net/posix/posix_async_socket_server.cc
+++ b/tools/rootcanal/net/posix/posix_async_socket_server.cc
@@ -23,9 +23,8 @@
 #include <functional>   // for __base, function
 #include <type_traits>  // for remove_extent_t
 
+#include "log.h"                           // for LOG_INFO, LOG_ERROR
 #include "net/posix/posix_async_socket.h"  // for PosixAsyncSocket, AsyncMan...
-#include "os/log.h"                        // for LOG_INFO, LOG_ERROR
-#include "osi/include/osi.h"               // for OSI_NO_INTR
 
 namespace android {
 namespace net {
@@ -37,7 +36,10 @@
   struct sockaddr_in listen_address {};
   socklen_t sockaddr_in_size = sizeof(struct sockaddr_in);
 
-  OSI_NO_INTR(listen_fd = socket(AF_INET, SOCK_STREAM, 0));
+  do {
+    listen_fd = socket(AF_INET, SOCK_STREAM, 0);
+  } while (listen_fd == -1 && errno == EAGAIN);
+
   if (listen_fd < 0) {
     LOG_INFO("Error creating socket for test channel.");
     return;
@@ -100,7 +102,7 @@
 
 void PosixAsyncSocketServer::AcceptSocket() {
   int accept_fd = 0;
-  OSI_NO_INTR(accept_fd = accept(server_socket_->fd(), NULL, NULL));
+  REPEAT_UNTIL_NO_INTR(accept_fd = accept(server_socket_->fd(), NULL, NULL));
 
   if (accept_fd < 0) {
     LOG_INFO("Error accepting test channel connection errno=%d (%s).", errno,
diff --git a/tools/rootcanal/packets/bredr_bb.pdl b/tools/rootcanal/packets/bredr_bb.pdl
new file mode 100644
index 0000000..3d85920
--- /dev/null
+++ b/tools/rootcanal/packets/bredr_bb.pdl
@@ -0,0 +1,60 @@
+// http://www.whiterocker.com/bt/LINKTYPE_BLUETOOTH_BREDR_BB.html
+
+little_endian_packets
+
+enum Rate: 4 {
+  BR_GFSK = 0x0,
+  EDR_PI_2_DQPSK = 0x1,
+  EDR_8DPSK = 0x2,
+  ID_PACKET = 0xf,
+}
+
+enum Transport: 4 {
+  ANY = 0x0,
+  SCO = 0x1,
+  ESCO = 0x2,
+  ACL = 0x3,
+  CSB = 0x4,
+  ID_PACKET = 0xf,
+}
+
+packet BaseBandPacket {
+  rf_channel: 8,
+  signal_power: 8,
+  noise_power: 8,
+  access_code_offenses: 8,
+  payload_rate: Rate,
+  payload_transport: Transport,
+  corrected_header_bits: 8,
+  corrected_payload_bits: 16,
+  lower_address_part: 32,
+  reference_lap: 24,
+  reference_uap: 8,
+  bt_packet_header: 32,
+  flags: 16,
+  _payload_
+}
+
+packet DM1AclPacket : BaseBandPacket(payload_rate = BR_GFSK, payload_transport = ACL) {
+  llid: 2,
+  flow: 1,
+  _size_(_payload_) : 5,
+  _payload_,
+  crc: 16
+}
+
+packet FHSAclPacket : BaseBandPacket(payload_rate = BR_GFSK, payload_transport = ACL) {
+  parity_bits: 34,
+  lap: 24,
+  eir: 1,
+  _reserved_: 1,
+  sr: 2,
+  sp: 2,
+  uap: 8,
+  nap: 16,
+  class_of_device: 24,
+  lt_addr: 3,
+  clk: 26,
+  page_scan_mode: 3,
+  crc: 16
+}
diff --git a/tools/rootcanal/packets/link_layer_packets.pdl b/tools/rootcanal/packets/link_layer_packets.pdl
index c1336e7..5e7425d 100644
--- a/tools/rootcanal/packets/link_layer_packets.pdl
+++ b/tools/rootcanal/packets/link_layer_packets.pdl
@@ -15,7 +15,8 @@
     IO_CAPABILITY_REQUEST = 0x08,
     IO_CAPABILITY_RESPONSE = 0x09,
     IO_CAPABILITY_NEGATIVE_RESPONSE = 0x0A,
-    LE_ADVERTISEMENT = 0x0B,
+    LE_LEGACY_ADVERTISING_PDU = 0x0B,
+    LE_EXTENDED_ADVERTISING_PDU = 0x37,
     LE_CONNECT = 0x0C,
     LE_CONNECT_COMPLETE = 0x0D,
     LE_SCAN = 0x0E,
@@ -57,6 +58,11 @@
     SCO_CONNECTION_RESPONSE = 0x31,
     SCO_DISCONNECT = 0x32,
     RSSI_WRAPPER = 0x33,
+
+    LMP = 0x34,
+
+    PING_REQUEST = 0x35,
+    PING_RESPONSE = 0x36,
 }
 
 packet LinkLayerPacket {
@@ -95,6 +101,7 @@
 
 packet Inquiry : LinkLayerPacket (type = INQUIRY) {
   inquiry_type : InquiryType,
+  lap : 8, // The IAC is derived from the LAP
 }
 
 packet BasicInquiryResponse : LinkLayerPacket(type = INQUIRY_RESPONSE) {
@@ -115,7 +122,7 @@
 
 packet ExtendedInquiryResponse : BasicInquiryResponse (inquiry_type = EXTENDED)  {
   rssi: 8,
-  extended_data : 8[],
+  extended_inquiry_response : 8[240],
 }
 
 packet IoCapabilityRequest : LinkLayerPacket (type = IO_CAPABILITY_REQUEST) {
@@ -141,42 +148,73 @@
   RANDOM_IDENTITY = 3,
 }
 
-enum AdvertisementType : 8 {
+// Legacy advertising PDU types.
+// Vol 6, Part B § 2.3.1 Advertising PDUs.
+enum LegacyAdvertisingType : 8 {
   ADV_IND = 0,          // Connectable and scannable
   ADV_DIRECT_IND = 1,   // Connectable directed, high duty cycle
   ADV_SCAN_IND = 2,     // Scannable undirected
   ADV_NONCONN_IND = 3,  // Non connectable undirected
-  SCAN_RESPONSE = 4,    // Aliased with connectable directed, low duty cycle
 }
 
-packet LeAdvertisement : LinkLayerPacket (type = LE_ADVERTISEMENT) {
-  address_type : AddressType,
-  advertisement_type : AdvertisementType,
-  data : 8[],
+packet LeLegacyAdvertisingPdu : LinkLayerPacket (type = LE_LEGACY_ADVERTISING_PDU) {
+  advertising_address_type: AddressType,
+  target_address_type: AddressType,
+  advertising_type: LegacyAdvertisingType,
+  advertising_data: 8[],
+}
+
+enum PrimaryPhyType : 8 {
+  LE_1M = 0x01,
+  LE_CODED = 0x03,
+}
+
+enum SecondaryPhyType : 8 {
+  NO_PACKETS = 0x00,
+  LE_1M = 0x01,
+  LE_2M = 0x02,
+  LE_CODED = 0x03,
+}
+
+packet LeExtendedAdvertisingPdu : LinkLayerPacket (type = LE_EXTENDED_ADVERTISING_PDU) {
+  advertising_address_type: AddressType,
+  target_address_type: AddressType,
+  connectable: 1,
+  scannable: 1,
+  directed: 1,
+  sid: 4,
+  _reserved_: 1,
+  tx_power: 8,
+  primary_phy: PrimaryPhyType,
+  secondary_phy: SecondaryPhyType,
+  advertising_data: 8[],
 }
 
 packet LeConnect : LinkLayerPacket (type = LE_CONNECT) {
+  initiating_address_type : AddressType,
+  advertising_address_type : AddressType,
   le_connection_interval_min : 16,
   le_connection_interval_max : 16,
   le_connection_latency : 16,
   le_connection_supervision_timeout : 16,
-  address_type : 8,
 }
 
 packet LeConnectComplete : LinkLayerPacket (type = LE_CONNECT_COMPLETE) {
+  initiating_address_type : AddressType,
+  advertising_address_type : AddressType,
   le_connection_interval : 16,
   le_connection_latency : 16,
   le_connection_supervision_timeout : 16,
-  address_type : 8,
 }
 
 packet LeScan : LinkLayerPacket (type = LE_SCAN) {
+  scanning_address_type : AddressType,
+  advertising_address_type : AddressType,
 }
 
 packet LeScanResponse : LinkLayerPacket (type = LE_SCAN_RESPONSE) {
-  address_type : AddressType,
-  advertisement_type : AdvertisementType,
-  data : 8[],
+  advertising_address_type : AddressType,
+  scan_response_data : 8[],
 }
 
 packet Page : LinkLayerPacket (type = PAGE) {
@@ -391,6 +429,7 @@
   _reserved_ : 6,
   retransmission_effort : 8,
   packet_type : 16,
+  class_of_device : ClassOfDevice,
 }
 
 packet ScoConnectionResponse : LinkLayerPacket (type = SCO_CONNECTION_RESPONSE) {
@@ -412,3 +451,13 @@
   rssi : 8,
   _payload_,
 }
+
+packet Lmp : LinkLayerPacket (type = LMP) {
+  _payload_,
+}
+
+packet PingRequest : LinkLayerPacket (type = PING_REQUEST) {
+}
+
+packet PingResponse : LinkLayerPacket (type = PING_RESPONSE) {
+}
diff --git a/tools/rootcanal/test/async_manager_unittest.cc b/tools/rootcanal/test/async_manager_unittest.cc
index a0a33d4..032ec4f 100644
--- a/tools/rootcanal/test/async_manager_unittest.cc
+++ b/tools/rootcanal/test/async_manager_unittest.cc
@@ -32,9 +32,8 @@
 #include <mutex>               // for mutex
 #include <ratio>               // for ratio
 #include <string>              // for string
-#include <tuple>               // for tuple
-
-#include "osi/include/osi.h"  // for OSI_NO_INTR
+#include <thread>
+#include <tuple>  // for tuple
 
 namespace rootcanal {
 
@@ -110,7 +109,9 @@
 
   void ReadIncomingMessage(int fd) {
     int n;
-    OSI_NO_INTR(n = read(fd, server_buffer_, kBufferSize - 1));
+    do {
+      n = read(fd, server_buffer_, kBufferSize - 1);
+    } while (n == -1 && errno == EAGAIN);
     ASSERT_GE(n, 0) << strerror(errno);
 
     if (n == 0) {  // got EOF
@@ -123,6 +124,9 @@
 
   void SetUp() override {
     memset(server_buffer_, 0, kBufferSize);
+    memset(client_buffer_, 0, kBufferSize);
+    socket_fd_ = -1;
+    connection_fd_ = -1;
 
     socket_fd_ = StartServer();
 
@@ -137,7 +141,9 @@
   void TearDown() override {
     async_manager_.StopWatchingFileDescriptor(socket_fd_);
     close(socket_fd_);
-    ASSERT_TRUE(CheckBufferEquals());
+    close(connection_fd_);
+    ASSERT_EQ(std::string_view(server_buffer_, kBufferSize),
+              std::string_view(client_buffer_, kBufferSize));
   }
 
   int ConnectClient() {
@@ -191,6 +197,8 @@
 }
 
 TEST_F(AsyncManagerSocketTest, CanUnsubscribeInCallback) {
+  using namespace std::chrono_literals;
+
   int socket_cli_fd = ConnectClient();
   WriteFromClient(socket_cli_fd);
   AwaitServerResponse(socket_cli_fd);
@@ -209,12 +217,58 @@
 
   while (!stopped) {
     write(socket_cli_fd, data.data(), data.size());
+    std::this_thread::sleep_for(5ms);
   }
 
   SUCCEED();
   close(socket_cli_fd);
 }
 
+TEST_F(AsyncManagerSocketTest, CanUnsubscribeTaskFromWithinTask) {
+  Event running;
+  using namespace std::chrono_literals;
+  async_manager_.ExecAsyncPeriodically(1, 1ms, 2ms, [&running, this]() {
+    EXPECT_TRUE(async_manager_.CancelAsyncTask(1))
+        << "We were scheduled, so cancel should return true";
+    EXPECT_FALSE(async_manager_.CancelAsyncTask(1))
+        << "We were not scheduled, so cancel should return false";
+    running.set(true);
+  });
+
+  EXPECT_TRUE(running.wait_for(10ms));
+}
+
+TEST_F(AsyncManagerSocketTest, UnsubScribeWaitsUntilCompletion) {
+  using namespace std::chrono_literals;
+  Event running;
+  bool cancel_done = false;
+  bool task_complete = false;
+  async_manager_.ExecAsyncPeriodically(
+      1, 1ms, 2ms, [&running, &cancel_done, &task_complete]() {
+        // Let the other thread now we are in the callback..
+        running.set(true);
+        // Wee bit of a hack that relies on timing..
+        std::this_thread::sleep_for(20ms);
+        EXPECT_FALSE(cancel_done)
+            << "Task cancellation did not wait for us to complete!";
+        task_complete = true;
+      });
+
+  EXPECT_TRUE(running.wait_for(10ms));
+  auto start = std::chrono::system_clock::now();
+
+  // There is a 20ms wait.. so we know that this should take some time.
+  EXPECT_TRUE(async_manager_.CancelAsyncTask(1))
+      << "We were scheduled, so cancel should return true";
+  cancel_done = true;
+  EXPECT_TRUE(task_complete)
+      << "We managed to cancel a task while it was not yet finished.";
+  auto end = std::chrono::system_clock::now();
+  auto passed_ms =
+      std::chrono::duration_cast<std::chrono::milliseconds>(end - start);
+  EXPECT_GT(passed_ms.count(), 10);
+}
+
 TEST_F(AsyncManagerSocketTest, NoEventsAfterUnsubscribe) {
   // This tests makes sure the AsyncManager never fires an event
   // after calling StopWatchingFileDescriptor.
diff --git a/tools/rootcanal/test/controller/le/le_add_device_to_filter_accept_list_test.cc b/tools/rootcanal/test/controller/le/le_add_device_to_filter_accept_list_test.cc
new file mode 100644
index 0000000..e999308
--- /dev/null
+++ b/tools/rootcanal/test/controller/le/le_add_device_to_filter_accept_list_test.cc
@@ -0,0 +1,107 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <gtest/gtest.h>
+
+#include "model/controller/link_layer_controller.h"
+#include "test_helpers.h"
+
+namespace rootcanal {
+
+using namespace bluetooth::hci;
+
+class LeAddDeviceToFilterAcceptListTest : public ::testing::Test {
+ public:
+  LeAddDeviceToFilterAcceptListTest() {
+    // Reduce the size of the filter accept list to simplify testing.
+    properties_.le_filter_accept_list_size = 2;
+  }
+
+  ~LeAddDeviceToFilterAcceptListTest() override = default;
+
+ protected:
+  Address address_{0};
+  ControllerProperties properties_{};
+  LinkLayerController controller_{address_, properties_};
+};
+
+TEST_F(LeAddDeviceToFilterAcceptListTest, Success) {
+  ASSERT_EQ(controller_.LeAddDeviceToFilterAcceptList(
+                FilterAcceptListAddressType::PUBLIC, Address{1}),
+            ErrorCode::SUCCESS);
+
+  ASSERT_EQ(controller_.LeAddDeviceToFilterAcceptList(
+                FilterAcceptListAddressType::RANDOM, Address{1}),
+            ErrorCode::SUCCESS);
+}
+
+TEST_F(LeAddDeviceToFilterAcceptListTest, ListFull) {
+  ASSERT_EQ(controller_.LeAddDeviceToFilterAcceptList(
+                FilterAcceptListAddressType::PUBLIC, Address{1}),
+            ErrorCode::SUCCESS);
+
+  ASSERT_EQ(controller_.LeAddDeviceToFilterAcceptList(
+                FilterAcceptListAddressType::PUBLIC, Address{2}),
+            ErrorCode::SUCCESS);
+
+  ASSERT_EQ(controller_.LeAddDeviceToFilterAcceptList(
+                FilterAcceptListAddressType::PUBLIC, Address{3}),
+            ErrorCode::MEMORY_CAPACITY_EXCEEDED);
+}
+
+TEST_F(LeAddDeviceToFilterAcceptListTest, ScanningActive) {
+  controller_.LeSetScanParameters(
+      LeScanType::PASSIVE, 0x400, 0x200, OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+      LeScanningFilterPolicy::FILTER_ACCEPT_LIST_ONLY);
+  controller_.LeSetScanEnable(true, false);
+
+  ASSERT_EQ(controller_.LeAddDeviceToFilterAcceptList(
+                FilterAcceptListAddressType::PUBLIC, Address{1}),
+            ErrorCode::COMMAND_DISALLOWED);
+}
+
+TEST_F(LeAddDeviceToFilterAcceptListTest, LegacyAdvertisingActive) {
+  ASSERT_EQ(controller_.LeSetAdvertisingParameters(
+                0x0800, 0x0800, AdvertisingType::ADV_IND,
+                OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+                PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS,
+                Address::kEmpty, 0x7, AdvertisingFilterPolicy::LISTED_SCAN),
+            ErrorCode::SUCCESS);
+  ASSERT_EQ(controller_.LeSetAdvertisingEnable(true), ErrorCode::SUCCESS);
+
+  ASSERT_EQ(controller_.LeAddDeviceToFilterAcceptList(
+                FilterAcceptListAddressType::PUBLIC, Address{1}),
+            ErrorCode::COMMAND_DISALLOWED);
+}
+
+TEST_F(LeAddDeviceToFilterAcceptListTest, ExtendedAdvertisingActive) {
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingParameters(
+                0, MakeAdvertisingEventProperties(CONNECTABLE), 0x0800, 0x0800,
+                0x7, OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+                PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS,
+                Address::kEmpty, AdvertisingFilterPolicy::LISTED_SCAN, 0x70,
+                PrimaryPhyType::LE_1M, 0, SecondaryPhyType::LE_2M, 0x0, false),
+            ErrorCode::SUCCESS);
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingEnable(
+                true, {MakeEnabledSet(0, 0, 0)}),
+            ErrorCode::SUCCESS);
+
+  ASSERT_EQ(controller_.LeAddDeviceToFilterAcceptList(
+                FilterAcceptListAddressType::PUBLIC, Address{1}),
+            ErrorCode::COMMAND_DISALLOWED);
+}
+
+}  // namespace rootcanal
diff --git a/tools/rootcanal/test/controller/le/le_add_device_to_resolving_list_test.cc b/tools/rootcanal/test/controller/le/le_add_device_to_resolving_list_test.cc
new file mode 100644
index 0000000..427861e
--- /dev/null
+++ b/tools/rootcanal/test/controller/le/le_add_device_to_resolving_list_test.cc
@@ -0,0 +1,133 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <gtest/gtest.h>
+
+#include "model/controller/link_layer_controller.h"
+#include "test_helpers.h"
+
+namespace rootcanal {
+
+using namespace bluetooth::hci;
+
+class LeAddDeviceToResolvingListTest : public ::testing::Test {
+ public:
+  LeAddDeviceToResolvingListTest() {
+    // Reduce the size of the resolving list to simplify testing.
+    properties_.le_resolving_list_size = 2;
+  }
+
+  ~LeAddDeviceToResolvingListTest() override = default;
+
+ protected:
+  Address address_{0};
+  ControllerProperties properties_{};
+  LinkLayerController controller_{address_, properties_};
+};
+
+TEST_F(LeAddDeviceToResolvingListTest, Success) {
+  ASSERT_EQ(controller_.LeAddDeviceToResolvingList(
+                PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS, Address{1},
+                std::array<uint8_t, 16>{1}, std::array<uint8_t, 16>{1}),
+            ErrorCode::SUCCESS);
+
+  ASSERT_EQ(controller_.LeAddDeviceToResolvingList(
+                PeerAddressType::RANDOM_DEVICE_OR_IDENTITY_ADDRESS, Address{1},
+                std::array<uint8_t, 16>{2}, std::array<uint8_t, 16>{2}),
+            ErrorCode::SUCCESS);
+}
+
+TEST_F(LeAddDeviceToResolvingListTest, ListFull) {
+  ASSERT_EQ(controller_.LeAddDeviceToResolvingList(
+                PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS, Address{1},
+                std::array<uint8_t, 16>{1}, std::array<uint8_t, 16>{1}),
+            ErrorCode::SUCCESS);
+
+  ASSERT_EQ(controller_.LeAddDeviceToResolvingList(
+                PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS, Address{2},
+                std::array<uint8_t, 16>{2}, std::array<uint8_t, 16>{2}),
+            ErrorCode::SUCCESS);
+
+  ASSERT_EQ(controller_.LeAddDeviceToResolvingList(
+                PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS, Address{3},
+                std::array<uint8_t, 16>{3}, std::array<uint8_t, 16>{3}),
+            ErrorCode::MEMORY_CAPACITY_EXCEEDED);
+}
+
+TEST_F(LeAddDeviceToResolvingListTest, ScanningActive) {
+  ASSERT_EQ(controller_.LeSetAddressResolutionEnable(true), ErrorCode::SUCCESS);
+  controller_.LeSetScanEnable(true, false);
+
+  ASSERT_EQ(controller_.LeAddDeviceToResolvingList(
+                PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS, Address{1},
+                std::array<uint8_t, 16>{1}, std::array<uint8_t, 16>{1}),
+            ErrorCode::COMMAND_DISALLOWED);
+}
+
+TEST_F(LeAddDeviceToResolvingListTest, LegacyAdvertisingActive) {
+  ASSERT_EQ(controller_.LeSetAddressResolutionEnable(true), ErrorCode::SUCCESS);
+  ASSERT_EQ(controller_.LeSetAdvertisingEnable(true), ErrorCode::SUCCESS);
+
+  ASSERT_EQ(controller_.LeAddDeviceToResolvingList(
+                PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS, Address{1},
+                std::array<uint8_t, 16>{1}, std::array<uint8_t, 16>{1}),
+            ErrorCode::COMMAND_DISALLOWED);
+}
+
+TEST_F(LeAddDeviceToResolvingListTest, ExtendedAdvertisingActive) {
+  ASSERT_EQ(controller_.LeSetAddressResolutionEnable(true), ErrorCode::SUCCESS);
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingParameters(
+                0, MakeAdvertisingEventProperties(CONNECTABLE), 0x0800, 0x0800,
+                0x7, OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+                PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS,
+                Address::kEmpty, AdvertisingFilterPolicy::LISTED_SCAN, 0x70,
+                PrimaryPhyType::LE_1M, 0, SecondaryPhyType::LE_2M, 0x0, false),
+            ErrorCode::SUCCESS);
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingEnable(
+                true, {MakeEnabledSet(0, 0, 0)}),
+            ErrorCode::SUCCESS);
+
+  ASSERT_EQ(controller_.LeAddDeviceToResolvingList(
+                PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS, Address{1},
+                std::array<uint8_t, 16>{1}, std::array<uint8_t, 16>{1}),
+            ErrorCode::COMMAND_DISALLOWED);
+}
+
+TEST_F(LeAddDeviceToResolvingListTest, PeerAddressDuplicate) {
+  ASSERT_EQ(controller_.LeAddDeviceToResolvingList(
+                PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS, Address{1},
+                std::array<uint8_t, 16>{1}, std::array<uint8_t, 16>{1}),
+            ErrorCode::SUCCESS);
+
+  ASSERT_EQ(controller_.LeAddDeviceToResolvingList(
+                PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS, Address{1},
+                std::array<uint8_t, 16>{2}, std::array<uint8_t, 16>{2}),
+            ErrorCode::INVALID_HCI_COMMAND_PARAMETERS);
+}
+
+TEST_F(LeAddDeviceToResolvingListTest, PeerIrkDuplicate) {
+  ASSERT_EQ(controller_.LeAddDeviceToResolvingList(
+                PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS, Address{1},
+                std::array<uint8_t, 16>{1}, std::array<uint8_t, 16>{1}),
+            ErrorCode::SUCCESS);
+
+  ASSERT_EQ(controller_.LeAddDeviceToResolvingList(
+                PeerAddressType::RANDOM_DEVICE_OR_IDENTITY_ADDRESS, Address{1},
+                std::array<uint8_t, 16>{1}, std::array<uint8_t, 16>{1}),
+            ErrorCode::INVALID_HCI_COMMAND_PARAMETERS);
+}
+
+}  // namespace rootcanal
diff --git a/tools/rootcanal/test/controller/le/le_clear_filter_accept_list_test.cc b/tools/rootcanal/test/controller/le/le_clear_filter_accept_list_test.cc
new file mode 100644
index 0000000..30eb1b0
--- /dev/null
+++ b/tools/rootcanal/test/controller/le/le_clear_filter_accept_list_test.cc
@@ -0,0 +1,100 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <gtest/gtest.h>
+
+#include "model/controller/link_layer_controller.h"
+#include "test_helpers.h"
+
+namespace rootcanal {
+
+using namespace bluetooth::hci;
+
+class LeClearFilterAcceptListTest : public ::testing::Test {
+ public:
+  LeClearFilterAcceptListTest() {
+    // Reduce the size of the filter accept list to simplify testing.
+    properties_.le_filter_accept_list_size = 2;
+  }
+
+  ~LeClearFilterAcceptListTest() override = default;
+
+ protected:
+  Address address_{0};
+  ControllerProperties properties_{};
+  LinkLayerController controller_{address_, properties_};
+};
+
+TEST_F(LeClearFilterAcceptListTest, Success) {
+  ASSERT_EQ(controller_.LeAddDeviceToFilterAcceptList(
+                FilterAcceptListAddressType::PUBLIC, Address{1}),
+            ErrorCode::SUCCESS);
+
+  ASSERT_EQ(controller_.LeClearFilterAcceptList(), ErrorCode::SUCCESS);
+}
+
+TEST_F(LeClearFilterAcceptListTest, ScanningActive) {
+  ASSERT_EQ(controller_.LeAddDeviceToFilterAcceptList(
+                FilterAcceptListAddressType::PUBLIC, Address{1}),
+            ErrorCode::SUCCESS);
+
+  controller_.LeSetScanParameters(
+      LeScanType::PASSIVE, 0x400, 0x200, OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+      LeScanningFilterPolicy::FILTER_ACCEPT_LIST_ONLY);
+  controller_.LeSetScanEnable(true, false);
+
+  ASSERT_EQ(controller_.LeClearFilterAcceptList(),
+            ErrorCode::COMMAND_DISALLOWED);
+}
+
+TEST_F(LeClearFilterAcceptListTest, LegacyAdvertisingActive) {
+  ASSERT_EQ(controller_.LeAddDeviceToFilterAcceptList(
+                FilterAcceptListAddressType::PUBLIC, Address{1}),
+            ErrorCode::SUCCESS);
+
+  ASSERT_EQ(controller_.LeSetAdvertisingParameters(
+                0x0800, 0x0800, AdvertisingType::ADV_IND,
+                OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+                PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS,
+                Address::kEmpty, 0x7, AdvertisingFilterPolicy::LISTED_SCAN),
+            ErrorCode::SUCCESS);
+  ASSERT_EQ(controller_.LeSetAdvertisingEnable(true), ErrorCode::SUCCESS);
+
+  ASSERT_EQ(controller_.LeClearFilterAcceptList(),
+            ErrorCode::COMMAND_DISALLOWED);
+}
+
+TEST_F(LeClearFilterAcceptListTest, ExtendedAdvertisingActive) {
+  ASSERT_EQ(controller_.LeAddDeviceToFilterAcceptList(
+                FilterAcceptListAddressType::PUBLIC, Address{1}),
+            ErrorCode::SUCCESS);
+
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingParameters(
+                0, MakeAdvertisingEventProperties(CONNECTABLE), 0x0800, 0x0800,
+                0x7, OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+                PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS,
+                Address::kEmpty, AdvertisingFilterPolicy::LISTED_SCAN, 0x70,
+                PrimaryPhyType::LE_1M, 0, SecondaryPhyType::LE_2M, 0x0, false),
+            ErrorCode::SUCCESS);
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingEnable(
+                true, {MakeEnabledSet(0, 0, 0)}),
+            ErrorCode::SUCCESS);
+
+  ASSERT_EQ(controller_.LeClearFilterAcceptList(),
+            ErrorCode::COMMAND_DISALLOWED);
+}
+
+}  // namespace rootcanal
diff --git a/tools/rootcanal/test/controller/le/le_clear_resolving_list_test.cc b/tools/rootcanal/test/controller/le/le_clear_resolving_list_test.cc
new file mode 100644
index 0000000..ea37d1c
--- /dev/null
+++ b/tools/rootcanal/test/controller/le/le_clear_resolving_list_test.cc
@@ -0,0 +1,95 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <gtest/gtest.h>
+
+#include "model/controller/link_layer_controller.h"
+#include "test_helpers.h"
+
+namespace rootcanal {
+
+using namespace bluetooth::hci;
+
+class LeClearResolvingListTest : public ::testing::Test {
+ public:
+  LeClearResolvingListTest() {
+    // Reduce the size of the resolving list to simplify testing.
+    properties_.le_resolving_list_size = 2;
+  }
+
+  ~LeClearResolvingListTest() override = default;
+
+ protected:
+  Address address_{0};
+  ControllerProperties properties_{};
+  LinkLayerController controller_{address_, properties_};
+};
+
+TEST_F(LeClearResolvingListTest, Success) {
+  ASSERT_EQ(controller_.LeAddDeviceToResolvingList(
+                PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS, Address{1},
+                std::array<uint8_t, 16>{1}, std::array<uint8_t, 16>{1}),
+            ErrorCode::SUCCESS);
+
+  ASSERT_EQ(controller_.LeClearResolvingList(), ErrorCode::SUCCESS);
+}
+
+TEST_F(LeClearResolvingListTest, ScanningActive) {
+  ASSERT_EQ(controller_.LeAddDeviceToResolvingList(
+                PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS, Address{1},
+                std::array<uint8_t, 16>{1}, std::array<uint8_t, 16>{1}),
+            ErrorCode::SUCCESS);
+
+  ASSERT_EQ(controller_.LeSetAddressResolutionEnable(true), ErrorCode::SUCCESS);
+  controller_.LeSetScanEnable(true, false);
+
+  ASSERT_EQ(controller_.LeClearResolvingList(), ErrorCode::COMMAND_DISALLOWED);
+}
+
+TEST_F(LeClearResolvingListTest, LegacyAdvertisingActive) {
+  ASSERT_EQ(controller_.LeAddDeviceToResolvingList(
+                PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS, Address{1},
+                std::array<uint8_t, 16>{1}, std::array<uint8_t, 16>{1}),
+            ErrorCode::SUCCESS);
+
+  ASSERT_EQ(controller_.LeSetAddressResolutionEnable(true), ErrorCode::SUCCESS);
+  ASSERT_EQ(controller_.LeSetAdvertisingEnable(true), ErrorCode::SUCCESS);
+
+  ASSERT_EQ(controller_.LeClearResolvingList(), ErrorCode::COMMAND_DISALLOWED);
+}
+
+TEST_F(LeClearResolvingListTest, ExtendedAdvertisingActive) {
+  ASSERT_EQ(controller_.LeAddDeviceToResolvingList(
+                PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS, Address{1},
+                std::array<uint8_t, 16>{1}, std::array<uint8_t, 16>{1}),
+            ErrorCode::SUCCESS);
+
+  ASSERT_EQ(controller_.LeSetAddressResolutionEnable(true), ErrorCode::SUCCESS);
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingParameters(
+                0, MakeAdvertisingEventProperties(CONNECTABLE), 0x0800, 0x0800,
+                0x7, OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+                PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS,
+                Address::kEmpty, AdvertisingFilterPolicy::LISTED_SCAN, 0x70,
+                PrimaryPhyType::LE_1M, 0, SecondaryPhyType::LE_2M, 0x0, false),
+            ErrorCode::SUCCESS);
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingEnable(
+                true, {MakeEnabledSet(0, 0, 0)}),
+            ErrorCode::SUCCESS);
+
+  ASSERT_EQ(controller_.LeClearResolvingList(), ErrorCode::COMMAND_DISALLOWED);
+}
+
+}  // namespace rootcanal
diff --git a/tools/rootcanal/test/controller/le/le_create_connection_cancel_test.cc b/tools/rootcanal/test/controller/le/le_create_connection_cancel_test.cc
new file mode 100644
index 0000000..995186e
--- /dev/null
+++ b/tools/rootcanal/test/controller/le/le_create_connection_cancel_test.cc
@@ -0,0 +1,64 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <gtest/gtest.h>
+
+#include "model/controller/link_layer_controller.h"
+#include "test_helpers.h"
+
+namespace rootcanal {
+
+using namespace bluetooth::hci;
+
+class LeCreateConnectionCancelTest : public ::testing::Test {
+ public:
+  LeCreateConnectionCancelTest() = default;
+  ~LeCreateConnectionCancelTest() override = default;
+
+ protected:
+  Address address_{0};
+  ControllerProperties properties_{};
+  LinkLayerController controller_{address_, properties_};
+};
+
+TEST_F(LeCreateConnectionCancelTest, CancelLegacyConnection) {
+  ASSERT_EQ(controller_.LeCreateConnection(
+                0x200, 0x200, InitiatorFilterPolicy::USE_PEER_ADDRESS,
+                AddressWithType{Address{1}, AddressType::PUBLIC_DEVICE_ADDRESS},
+                OwnAddressType::PUBLIC_DEVICE_ADDRESS, 0x100, 0x200, 0x010,
+                0x0c80, 0x0, 0x0),
+            ErrorCode::SUCCESS);
+  ASSERT_EQ(controller_.LeCreateConnectionCancel(), ErrorCode::SUCCESS);
+}
+
+TEST_F(LeCreateConnectionCancelTest, CancelExtendedConnection) {
+  ASSERT_EQ(
+      controller_.LeExtendedCreateConnection(
+          InitiatorFilterPolicy::USE_PEER_ADDRESS,
+          OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+          AddressWithType{Address{1}, AddressType::PUBLIC_DEVICE_ADDRESS}, 0x1,
+          {MakeInitiatingPhyParameters(0x200, 0x200, 0x100, 0x200, 0x010,
+                                       0x0c80, 0x0, 0x0)}),
+      ErrorCode::SUCCESS);
+  ASSERT_EQ(controller_.LeCreateConnectionCancel(), ErrorCode::SUCCESS);
+}
+
+TEST_F(LeCreateConnectionCancelTest, NoPendingConnection) {
+  ASSERT_EQ(controller_.LeCreateConnectionCancel(),
+            ErrorCode::COMMAND_DISALLOWED);
+}
+
+}  // namespace rootcanal
diff --git a/tools/rootcanal/test/controller/le/le_create_connection_test.cc b/tools/rootcanal/test/controller/le/le_create_connection_test.cc
new file mode 100644
index 0000000..0c68ea9
--- /dev/null
+++ b/tools/rootcanal/test/controller/le/le_create_connection_test.cc
@@ -0,0 +1,205 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <gtest/gtest.h>
+
+#include "model/controller/link_layer_controller.h"
+
+namespace rootcanal {
+
+using namespace bluetooth::hci;
+
+class LeCreateConnectionTest : public ::testing::Test {
+ public:
+  LeCreateConnectionTest() = default;
+  ~LeCreateConnectionTest() override = default;
+
+ protected:
+  Address address_{0};
+  ControllerProperties properties_{};
+  LinkLayerController controller_{address_, properties_};
+};
+
+TEST_F(LeCreateConnectionTest, ConnectUsingPublicAddress) {
+  ASSERT_EQ(controller_.LeCreateConnection(
+                0x200, 0x200, InitiatorFilterPolicy::USE_PEER_ADDRESS,
+                AddressWithType{Address{1}, AddressType::PUBLIC_DEVICE_ADDRESS},
+                OwnAddressType::PUBLIC_DEVICE_ADDRESS, 0x100, 0x200, 0x010,
+                0x0c80, 0x0, 0x0),
+            ErrorCode::SUCCESS);
+}
+
+TEST_F(LeCreateConnectionTest, ConnectUsingRandomAddress) {
+  ASSERT_EQ(controller_.LeSetRandomAddress(Address{1}), ErrorCode::SUCCESS);
+  ASSERT_EQ(controller_.LeCreateConnection(
+                0x200, 0x200, InitiatorFilterPolicy::USE_PEER_ADDRESS,
+                AddressWithType{Address{1}, AddressType::PUBLIC_DEVICE_ADDRESS},
+                OwnAddressType::RANDOM_DEVICE_ADDRESS, 0x100, 0x200, 0x010,
+                0x0c80, 0x0, 0x0),
+            ErrorCode::SUCCESS);
+}
+
+TEST_F(LeCreateConnectionTest, ConnectUsingResolvableAddress) {
+  ASSERT_EQ(controller_.LeSetRandomAddress(Address{1}), ErrorCode::SUCCESS);
+  ASSERT_EQ(controller_.LeCreateConnection(
+                0x200, 0x200, InitiatorFilterPolicy::USE_PEER_ADDRESS,
+                AddressWithType{Address{1}, AddressType::PUBLIC_DEVICE_ADDRESS},
+                OwnAddressType::RESOLVABLE_OR_RANDOM_ADDRESS, 0x100, 0x200,
+                0x010, 0x0c80, 0x0, 0x0),
+            ErrorCode::SUCCESS);
+}
+
+TEST_F(LeCreateConnectionTest, InitiatingActive) {
+  ASSERT_EQ(controller_.LeCreateConnection(
+                0x200, 0x200, InitiatorFilterPolicy::USE_PEER_ADDRESS,
+                AddressWithType{Address{1}, AddressType::PUBLIC_DEVICE_ADDRESS},
+                OwnAddressType::PUBLIC_DEVICE_ADDRESS, 0x100, 0x200, 0x010,
+                0x0c80, 0x0, 0x0),
+            ErrorCode::SUCCESS);
+
+  ASSERT_EQ(controller_.LeCreateConnection(
+                0x200, 0x200, InitiatorFilterPolicy::USE_PEER_ADDRESS,
+                AddressWithType{Address{2}, AddressType::PUBLIC_DEVICE_ADDRESS},
+                OwnAddressType::PUBLIC_DEVICE_ADDRESS, 0x100, 0x200, 0x010,
+                0x0c80, 0x0, 0x0),
+            ErrorCode::COMMAND_DISALLOWED);
+}
+
+TEST_F(LeCreateConnectionTest, InvalidScanInterval) {
+  ASSERT_EQ(controller_.LeCreateConnection(
+                0x3, 0x200, InitiatorFilterPolicy::USE_PEER_ADDRESS,
+                AddressWithType{Address{1}, AddressType::PUBLIC_DEVICE_ADDRESS},
+                OwnAddressType::PUBLIC_DEVICE_ADDRESS, 0x100, 0x200, 0x010,
+                0x0c80, 0x0, 0x0),
+            ErrorCode::UNSUPPORTED_FEATURE_OR_PARAMETER_VALUE);
+
+  ASSERT_EQ(controller_.LeCreateConnection(
+                0x4001, 0x200, InitiatorFilterPolicy::USE_PEER_ADDRESS,
+                AddressWithType{Address{1}, AddressType::PUBLIC_DEVICE_ADDRESS},
+                OwnAddressType::PUBLIC_DEVICE_ADDRESS, 0x100, 0x200, 0x010,
+                0x0c80, 0x0, 0x0),
+            ErrorCode::UNSUPPORTED_FEATURE_OR_PARAMETER_VALUE);
+}
+
+TEST_F(LeCreateConnectionTest, InvalidScanWindow) {
+  ASSERT_EQ(controller_.LeCreateConnection(
+                0x200, 0x3, InitiatorFilterPolicy::USE_PEER_ADDRESS,
+                AddressWithType{Address{1}, AddressType::PUBLIC_DEVICE_ADDRESS},
+                OwnAddressType::PUBLIC_DEVICE_ADDRESS, 0x100, 0x200, 0x010,
+                0x0c80, 0x0, 0x0),
+            ErrorCode::UNSUPPORTED_FEATURE_OR_PARAMETER_VALUE);
+
+  ASSERT_EQ(controller_.LeCreateConnection(
+                0x200, 0x4001, InitiatorFilterPolicy::USE_PEER_ADDRESS,
+                AddressWithType{Address{1}, AddressType::PUBLIC_DEVICE_ADDRESS},
+                OwnAddressType::PUBLIC_DEVICE_ADDRESS, 0x100, 0x200, 0x010,
+                0x0c80, 0x0, 0x0),
+            ErrorCode::UNSUPPORTED_FEATURE_OR_PARAMETER_VALUE);
+
+  ASSERT_EQ(controller_.LeCreateConnection(
+                0x100, 0x200, InitiatorFilterPolicy::USE_PEER_ADDRESS,
+                AddressWithType{Address{1}, AddressType::PUBLIC_DEVICE_ADDRESS},
+                OwnAddressType::PUBLIC_DEVICE_ADDRESS, 0x100, 0x200, 0x010,
+                0x0c80, 0x0, 0x0),
+            ErrorCode::INVALID_HCI_COMMAND_PARAMETERS);
+}
+
+TEST_F(LeCreateConnectionTest, InvalidConnectionInterval) {
+  ASSERT_EQ(controller_.LeCreateConnection(
+                0x200, 0x200, InitiatorFilterPolicy::USE_PEER_ADDRESS,
+                AddressWithType{Address{1}, AddressType::PUBLIC_DEVICE_ADDRESS},
+                OwnAddressType::PUBLIC_DEVICE_ADDRESS, 0x5, 0x200, 0x010,
+                0x0c80, 0x0, 0x0),
+            ErrorCode::UNSUPPORTED_FEATURE_OR_PARAMETER_VALUE);
+
+  ASSERT_EQ(controller_.LeCreateConnection(
+                0x200, 0x200, InitiatorFilterPolicy::USE_PEER_ADDRESS,
+                AddressWithType{Address{1}, AddressType::PUBLIC_DEVICE_ADDRESS},
+                OwnAddressType::PUBLIC_DEVICE_ADDRESS, 0x0c81, 0x200, 0x010,
+                0x0c80, 0x0, 0x0),
+            ErrorCode::UNSUPPORTED_FEATURE_OR_PARAMETER_VALUE);
+
+  ASSERT_EQ(controller_.LeCreateConnection(
+                0x200, 0x200, InitiatorFilterPolicy::USE_PEER_ADDRESS,
+                AddressWithType{Address{1}, AddressType::PUBLIC_DEVICE_ADDRESS},
+                OwnAddressType::PUBLIC_DEVICE_ADDRESS, 0x200, 0x5, 0x010,
+                0x0c80, 0x0, 0x0),
+            ErrorCode::UNSUPPORTED_FEATURE_OR_PARAMETER_VALUE);
+
+  ASSERT_EQ(controller_.LeCreateConnection(
+                0x200, 0x200, InitiatorFilterPolicy::USE_PEER_ADDRESS,
+                AddressWithType{Address{1}, AddressType::PUBLIC_DEVICE_ADDRESS},
+                OwnAddressType::PUBLIC_DEVICE_ADDRESS, 0x200, 0x0c81, 0x010,
+                0x0c80, 0x0, 0x0),
+            ErrorCode::UNSUPPORTED_FEATURE_OR_PARAMETER_VALUE);
+
+  ASSERT_EQ(controller_.LeCreateConnection(
+                0x4001, 0x200, InitiatorFilterPolicy::USE_PEER_ADDRESS,
+                AddressWithType{Address{1}, AddressType::PUBLIC_DEVICE_ADDRESS},
+                OwnAddressType::PUBLIC_DEVICE_ADDRESS, 0x200, 0x100, 0x010,
+                0x0c80, 0x0, 0x0),
+            ErrorCode::UNSUPPORTED_FEATURE_OR_PARAMETER_VALUE);
+}
+
+TEST_F(LeCreateConnectionTest, InvalidMaxLatency) {
+  ASSERT_EQ(controller_.LeCreateConnection(
+                0x200, 0x200, InitiatorFilterPolicy::USE_PEER_ADDRESS,
+                AddressWithType{Address{1}, AddressType::PUBLIC_DEVICE_ADDRESS},
+                OwnAddressType::PUBLIC_DEVICE_ADDRESS, 0x100, 0x200, 0x01f4,
+                0x0c80, 0x0, 0x0),
+            ErrorCode::UNSUPPORTED_FEATURE_OR_PARAMETER_VALUE);
+}
+
+TEST_F(LeCreateConnectionTest, InvalidSupervisionTimeout) {
+  ASSERT_EQ(controller_.LeCreateConnection(
+                0x200, 0x200, InitiatorFilterPolicy::USE_PEER_ADDRESS,
+                AddressWithType{Address{1}, AddressType::PUBLIC_DEVICE_ADDRESS},
+                OwnAddressType::PUBLIC_DEVICE_ADDRESS, 0x100, 0x200, 0x010, 0x9,
+                0x0, 0x0),
+            ErrorCode::UNSUPPORTED_FEATURE_OR_PARAMETER_VALUE);
+
+  ASSERT_EQ(controller_.LeCreateConnection(
+                0x200, 0x200, InitiatorFilterPolicy::USE_PEER_ADDRESS,
+                AddressWithType{Address{1}, AddressType::PUBLIC_DEVICE_ADDRESS},
+                OwnAddressType::PUBLIC_DEVICE_ADDRESS, 0x100, 0x200, 0x010,
+                0x0c81, 0x0, 0x0),
+            ErrorCode::UNSUPPORTED_FEATURE_OR_PARAMETER_VALUE);
+
+  ASSERT_EQ(controller_.LeCreateConnection(
+                0x200, 0x200, InitiatorFilterPolicy::USE_PEER_ADDRESS,
+                AddressWithType{Address{1}, AddressType::PUBLIC_DEVICE_ADDRESS},
+                OwnAddressType::PUBLIC_DEVICE_ADDRESS, 0x100, 0x200, 0x1f3,
+                0x0c80, 0x0, 0x0),
+            ErrorCode::INVALID_HCI_COMMAND_PARAMETERS);
+}
+
+TEST_F(LeCreateConnectionTest, NoRandomAddress) {
+  ASSERT_EQ(controller_.LeCreateConnection(
+                0x200, 0x200, InitiatorFilterPolicy::USE_PEER_ADDRESS,
+                AddressWithType{Address{1}, AddressType::PUBLIC_DEVICE_ADDRESS},
+                OwnAddressType::RANDOM_DEVICE_ADDRESS, 0x100, 0x200, 0x010,
+                0x0c80, 0x0, 0x0),
+            ErrorCode::INVALID_HCI_COMMAND_PARAMETERS);
+
+  ASSERT_EQ(controller_.LeCreateConnection(
+                0x200, 0x200, InitiatorFilterPolicy::USE_PEER_ADDRESS,
+                AddressWithType{Address{1}, AddressType::PUBLIC_DEVICE_ADDRESS},
+                OwnAddressType::RESOLVABLE_OR_RANDOM_ADDRESS, 0x100, 0x200,
+                0x010, 0x0c80, 0x0, 0x0),
+            ErrorCode::INVALID_HCI_COMMAND_PARAMETERS);
+}
+
+}  // namespace rootcanal
diff --git a/tools/rootcanal/test/controller/le/le_extended_create_connection_test.cc b/tools/rootcanal/test/controller/le/le_extended_create_connection_test.cc
new file mode 100644
index 0000000..c5f4f63
--- /dev/null
+++ b/tools/rootcanal/test/controller/le/le_extended_create_connection_test.cc
@@ -0,0 +1,290 @@
+
+
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <gtest/gtest.h>
+
+#include "model/controller/link_layer_controller.h"
+#include "test_helpers.h"
+
+namespace rootcanal {
+
+using namespace bluetooth::hci;
+
+class LeExtendedCreateConnectionTest : public ::testing::Test {
+ public:
+  LeExtendedCreateConnectionTest() = default;
+  ~LeExtendedCreateConnectionTest() override = default;
+
+ protected:
+  Address address_{0};
+  ControllerProperties properties_{};
+  LinkLayerController controller_{address_, properties_};
+};
+
+TEST_F(LeExtendedCreateConnectionTest, ConnectUsingPublicAddress) {
+  ASSERT_EQ(
+      controller_.LeExtendedCreateConnection(
+          InitiatorFilterPolicy::USE_PEER_ADDRESS,
+          OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+          AddressWithType{Address{1}, AddressType::PUBLIC_DEVICE_ADDRESS}, 0x1,
+          {MakeInitiatingPhyParameters(0x200, 0x200, 0x100, 0x200, 0x010,
+                                       0x0c80, 0x0, 0x0)}),
+      ErrorCode::SUCCESS);
+}
+
+TEST_F(LeExtendedCreateConnectionTest, ConnectUsingRandomAddress) {
+  ASSERT_EQ(controller_.LeSetRandomAddress(Address{1}), ErrorCode::SUCCESS);
+  ASSERT_EQ(
+      controller_.LeExtendedCreateConnection(
+          InitiatorFilterPolicy::USE_PEER_ADDRESS,
+          OwnAddressType::RANDOM_DEVICE_ADDRESS,
+          AddressWithType{Address{1}, AddressType::PUBLIC_DEVICE_ADDRESS}, 0x1,
+          {MakeInitiatingPhyParameters(0x200, 0x200, 0x100, 0x200, 0x010,
+                                       0x0c80, 0x0, 0x0)}),
+      ErrorCode::SUCCESS);
+}
+
+TEST_F(LeExtendedCreateConnectionTest, ConnectUsingResolvableAddress) {
+  ASSERT_EQ(controller_.LeSetRandomAddress(Address{1}), ErrorCode::SUCCESS);
+  ASSERT_EQ(
+      controller_.LeExtendedCreateConnection(
+          InitiatorFilterPolicy::USE_PEER_ADDRESS,
+          OwnAddressType::RESOLVABLE_OR_RANDOM_ADDRESS,
+          AddressWithType{Address{1}, AddressType::PUBLIC_DEVICE_ADDRESS}, 0x1,
+          {MakeInitiatingPhyParameters(0x200, 0x200, 0x100, 0x200, 0x010,
+                                       0x0c80, 0x0, 0x0)}),
+      ErrorCode::SUCCESS);
+}
+
+TEST_F(LeExtendedCreateConnectionTest, InitiatingActive) {
+  ASSERT_EQ(
+      controller_.LeExtendedCreateConnection(
+          InitiatorFilterPolicy::USE_PEER_ADDRESS,
+          OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+          AddressWithType{Address{1}, AddressType::PUBLIC_DEVICE_ADDRESS}, 0x1,
+          {MakeInitiatingPhyParameters(0x200, 0x200, 0x100, 0x200, 0x010,
+                                       0x0c80, 0x0, 0x0)}),
+      ErrorCode::SUCCESS);
+
+  ASSERT_EQ(
+      controller_.LeExtendedCreateConnection(
+          InitiatorFilterPolicy::USE_PEER_ADDRESS,
+          OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+          AddressWithType{Address{1}, AddressType::PUBLIC_DEVICE_ADDRESS}, 0x1,
+          {MakeInitiatingPhyParameters(0x200, 0x200, 0x100, 0x200, 0x010,
+                                       0x0c80, 0x0, 0x0)}),
+      ErrorCode::COMMAND_DISALLOWED);
+}
+
+TEST_F(LeExtendedCreateConnectionTest, NoPhy) {
+  ASSERT_EQ(controller_.LeExtendedCreateConnection(
+                InitiatorFilterPolicy::USE_PEER_ADDRESS,
+                OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+                AddressWithType{Address{1}, AddressType::PUBLIC_DEVICE_ADDRESS},
+                0x0, {}),
+            ErrorCode::INVALID_HCI_COMMAND_PARAMETERS);
+}
+
+TEST_F(LeExtendedCreateConnectionTest, ReservedPhy) {
+  ASSERT_EQ(
+      controller_.LeExtendedCreateConnection(
+          InitiatorFilterPolicy::USE_PEER_ADDRESS,
+          OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+          AddressWithType{Address{1}, AddressType::PUBLIC_DEVICE_ADDRESS}, 0x8,
+          {MakeInitiatingPhyParameters(0x200, 0x200, 0x100, 0x200, 0x010,
+                                       0x0c80, 0x0, 0x0)}),
+      ErrorCode::UNSUPPORTED_FEATURE_OR_PARAMETER_VALUE);
+}
+
+TEST_F(LeExtendedCreateConnectionTest, InvalidPhyParameters) {
+  ASSERT_EQ(controller_.LeExtendedCreateConnection(
+                InitiatorFilterPolicy::USE_PEER_ADDRESS,
+                OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+                AddressWithType{Address{1}, AddressType::PUBLIC_DEVICE_ADDRESS},
+                0x1, {}),
+            ErrorCode::INVALID_HCI_COMMAND_PARAMETERS);
+
+  ASSERT_EQ(
+      controller_.LeExtendedCreateConnection(
+          InitiatorFilterPolicy::USE_PEER_ADDRESS,
+          OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+          AddressWithType{Address{1}, AddressType::PUBLIC_DEVICE_ADDRESS}, 0x1,
+          {MakeInitiatingPhyParameters(0x200, 0x200, 0x100, 0x200, 0x010,
+                                       0x0c80, 0x0, 0x0),
+           MakeInitiatingPhyParameters(0x200, 0x200, 0x100, 0x200, 0x010,
+                                       0x0c80, 0x0, 0x0)}),
+      ErrorCode::INVALID_HCI_COMMAND_PARAMETERS);
+}
+
+TEST_F(LeExtendedCreateConnectionTest, InvalidScanInterval) {
+  ASSERT_EQ(
+      controller_.LeExtendedCreateConnection(
+          InitiatorFilterPolicy::USE_PEER_ADDRESS,
+          OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+          AddressWithType{Address{1}, AddressType::PUBLIC_DEVICE_ADDRESS}, 0x1,
+          {MakeInitiatingPhyParameters(0x3, 0x200, 0x100, 0x200, 0x010, 0x0c80,
+                                       0x0, 0x0)}),
+      ErrorCode::UNSUPPORTED_FEATURE_OR_PARAMETER_VALUE);
+
+  ASSERT_EQ(
+      controller_.LeExtendedCreateConnection(
+          InitiatorFilterPolicy::USE_PEER_ADDRESS,
+          OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+          AddressWithType{Address{1}, AddressType::PUBLIC_DEVICE_ADDRESS}, 0x1,
+          {MakeInitiatingPhyParameters(0x4001, 0x200, 0x100, 0x200, 0x010,
+                                       0x0c80, 0x0, 0x0)}),
+      ErrorCode::UNSUPPORTED_FEATURE_OR_PARAMETER_VALUE);
+}
+
+TEST_F(LeExtendedCreateConnectionTest, InvalidScanWindow) {
+  ASSERT_EQ(
+      controller_.LeExtendedCreateConnection(
+          InitiatorFilterPolicy::USE_PEER_ADDRESS,
+          OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+          AddressWithType{Address{1}, AddressType::PUBLIC_DEVICE_ADDRESS}, 0x1,
+          {MakeInitiatingPhyParameters(0x200, 0x3, 0x100, 0x200, 0x010, 0x0c80,
+                                       0x0, 0x0)}),
+      ErrorCode::UNSUPPORTED_FEATURE_OR_PARAMETER_VALUE);
+
+  ASSERT_EQ(
+      controller_.LeExtendedCreateConnection(
+          InitiatorFilterPolicy::USE_PEER_ADDRESS,
+          OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+          AddressWithType{Address{1}, AddressType::PUBLIC_DEVICE_ADDRESS}, 0x1,
+          {MakeInitiatingPhyParameters(0x200, 0x4001, 0x100, 0x200, 0x010,
+                                       0x0c80, 0x0, 0x0)}),
+      ErrorCode::UNSUPPORTED_FEATURE_OR_PARAMETER_VALUE);
+
+  ASSERT_EQ(
+      controller_.LeExtendedCreateConnection(
+          InitiatorFilterPolicy::USE_PEER_ADDRESS,
+          OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+          AddressWithType{Address{1}, AddressType::PUBLIC_DEVICE_ADDRESS}, 0x1,
+          {MakeInitiatingPhyParameters(0x100, 0x200, 0x100, 0x200, 0x010,
+                                       0x0c80, 0x0, 0x0)}),
+      ErrorCode::INVALID_HCI_COMMAND_PARAMETERS);
+}
+
+TEST_F(LeExtendedCreateConnectionTest, InvalidConnectionInterval) {
+  ASSERT_EQ(
+      controller_.LeExtendedCreateConnection(
+          InitiatorFilterPolicy::USE_PEER_ADDRESS,
+          OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+          AddressWithType{Address{1}, AddressType::PUBLIC_DEVICE_ADDRESS}, 0x1,
+          {MakeInitiatingPhyParameters(0x200, 0x200, 0x5, 0x200, 0x010, 0x0c80,
+                                       0x0, 0x0)}),
+      ErrorCode::UNSUPPORTED_FEATURE_OR_PARAMETER_VALUE);
+
+  ASSERT_EQ(
+      controller_.LeExtendedCreateConnection(
+          InitiatorFilterPolicy::USE_PEER_ADDRESS,
+          OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+          AddressWithType{Address{1}, AddressType::PUBLIC_DEVICE_ADDRESS}, 0x1,
+          {MakeInitiatingPhyParameters(0x200, 0x200, 0x0c81, 0x200, 0x010,
+                                       0x0c80, 0x0, 0x0)}),
+      ErrorCode::UNSUPPORTED_FEATURE_OR_PARAMETER_VALUE);
+
+  ASSERT_EQ(
+      controller_.LeExtendedCreateConnection(
+          InitiatorFilterPolicy::USE_PEER_ADDRESS,
+          OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+          AddressWithType{Address{1}, AddressType::PUBLIC_DEVICE_ADDRESS}, 0x1,
+          {MakeInitiatingPhyParameters(0x200, 0x200, 0x200, 0x5, 0x010, 0x0c80,
+                                       0x0, 0x0)}),
+      ErrorCode::UNSUPPORTED_FEATURE_OR_PARAMETER_VALUE);
+
+  ASSERT_EQ(
+      controller_.LeExtendedCreateConnection(
+          InitiatorFilterPolicy::USE_PEER_ADDRESS,
+          OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+          AddressWithType{Address{1}, AddressType::PUBLIC_DEVICE_ADDRESS}, 0x1,
+          {MakeInitiatingPhyParameters(0x200, 0x200, 0x200, 0x0c81, 0x010,
+                                       0x0c80, 0x0, 0x0)}),
+      ErrorCode::UNSUPPORTED_FEATURE_OR_PARAMETER_VALUE);
+
+  ASSERT_EQ(
+      controller_.LeExtendedCreateConnection(
+          InitiatorFilterPolicy::USE_PEER_ADDRESS,
+          OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+          AddressWithType{Address{1}, AddressType::PUBLIC_DEVICE_ADDRESS}, 0x1,
+          {MakeInitiatingPhyParameters(0x200, 0x200, 0x200, 0x100, 0x010,
+                                       0x0c80, 0x0, 0x0)}),
+      ErrorCode::INVALID_HCI_COMMAND_PARAMETERS);
+}
+
+TEST_F(LeExtendedCreateConnectionTest, InvalidMaxLatency) {
+  ASSERT_EQ(
+      controller_.LeExtendedCreateConnection(
+          InitiatorFilterPolicy::USE_PEER_ADDRESS,
+          OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+          AddressWithType{Address{1}, AddressType::PUBLIC_DEVICE_ADDRESS}, 0x1,
+          {MakeInitiatingPhyParameters(0x200, 0x200, 0x100, 0x200, 0x01f4,
+                                       0x0c80, 0x0, 0x0)}),
+      ErrorCode::UNSUPPORTED_FEATURE_OR_PARAMETER_VALUE);
+}
+
+TEST_F(LeExtendedCreateConnectionTest, InvalidSupervisionTimeout) {
+  ASSERT_EQ(
+      controller_.LeExtendedCreateConnection(
+          InitiatorFilterPolicy::USE_PEER_ADDRESS,
+          OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+          AddressWithType{Address{1}, AddressType::PUBLIC_DEVICE_ADDRESS}, 0x1,
+          {MakeInitiatingPhyParameters(0x200, 0x200, 0x100, 0x200, 0x010, 0x9,
+                                       0x0, 0x0)}),
+      ErrorCode::UNSUPPORTED_FEATURE_OR_PARAMETER_VALUE);
+
+  ASSERT_EQ(
+      controller_.LeExtendedCreateConnection(
+          InitiatorFilterPolicy::USE_PEER_ADDRESS,
+          OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+          AddressWithType{Address{1}, AddressType::PUBLIC_DEVICE_ADDRESS}, 0x1,
+          {MakeInitiatingPhyParameters(0x200, 0x200, 0x100, 0x200, 0x010,
+                                       0x0c81, 0x0, 0x0)}),
+      ErrorCode::UNSUPPORTED_FEATURE_OR_PARAMETER_VALUE);
+
+  ASSERT_EQ(
+      controller_.LeExtendedCreateConnection(
+          InitiatorFilterPolicy::USE_PEER_ADDRESS,
+          OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+          AddressWithType{Address{1}, AddressType::PUBLIC_DEVICE_ADDRESS}, 0x1,
+          {MakeInitiatingPhyParameters(0x200, 0x200, 0x100, 0x200, 0x1f3,
+                                       0x0c80, 0x0, 0x0)}),
+      ErrorCode::INVALID_HCI_COMMAND_PARAMETERS);
+}
+
+TEST_F(LeExtendedCreateConnectionTest, NoRandomAddress) {
+  ASSERT_EQ(
+      controller_.LeExtendedCreateConnection(
+          InitiatorFilterPolicy::USE_PEER_ADDRESS,
+          OwnAddressType::RANDOM_DEVICE_ADDRESS,
+          AddressWithType{Address{1}, AddressType::PUBLIC_DEVICE_ADDRESS}, 0x1,
+          {MakeInitiatingPhyParameters(0x200, 0x200, 0x100, 0x200, 0x010,
+                                       0x0c80, 0x0, 0x0)}),
+      ErrorCode::INVALID_HCI_COMMAND_PARAMETERS);
+
+  ASSERT_EQ(
+      controller_.LeExtendedCreateConnection(
+          InitiatorFilterPolicy::USE_PEER_ADDRESS,
+          OwnAddressType::RESOLVABLE_OR_RANDOM_ADDRESS,
+          AddressWithType{Address{1}, AddressType::PUBLIC_DEVICE_ADDRESS}, 0x1,
+          {MakeInitiatingPhyParameters(0x200, 0x200, 0x100, 0x200, 0x010,
+                                       0x0c80, 0x0, 0x0)}),
+      ErrorCode::INVALID_HCI_COMMAND_PARAMETERS);
+}
+
+}  // namespace rootcanal
diff --git a/tools/rootcanal/test/controller/le/le_remove_device_from_filter_accept_list_test.cc b/tools/rootcanal/test/controller/le/le_remove_device_from_filter_accept_list_test.cc
new file mode 100644
index 0000000..b3e41b6
--- /dev/null
+++ b/tools/rootcanal/test/controller/le/le_remove_device_from_filter_accept_list_test.cc
@@ -0,0 +1,115 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <gtest/gtest.h>
+
+#include "model/controller/link_layer_controller.h"
+#include "test_helpers.h"
+
+namespace rootcanal {
+
+using namespace bluetooth::hci;
+
+class LeRemoveDeviceFromFilterAcceptListTest : public ::testing::Test {
+ public:
+  LeRemoveDeviceFromFilterAcceptListTest() {
+    // Reduce the size of the resolving list to simplify testing.
+    properties_.le_resolving_list_size = 2;
+  }
+
+  ~LeRemoveDeviceFromFilterAcceptListTest() override = default;
+
+ protected:
+  Address address_{0};
+  ControllerProperties properties_{};
+  LinkLayerController controller_{address_, properties_};
+};
+
+TEST_F(LeRemoveDeviceFromFilterAcceptListTest, Success) {
+  ASSERT_EQ(controller_.LeAddDeviceToFilterAcceptList(
+                FilterAcceptListAddressType::PUBLIC, Address{1}),
+            ErrorCode::SUCCESS);
+
+  ASSERT_EQ(controller_.LeRemoveDeviceFromFilterAcceptList(
+                FilterAcceptListAddressType::PUBLIC, Address{1}),
+            ErrorCode::SUCCESS);
+}
+
+TEST_F(LeRemoveDeviceFromFilterAcceptListTest, NotFound) {
+  ASSERT_EQ(controller_.LeAddDeviceToFilterAcceptList(
+                FilterAcceptListAddressType::PUBLIC, Address{1}),
+            ErrorCode::SUCCESS);
+
+  ASSERT_EQ(controller_.LeRemoveDeviceFromFilterAcceptList(
+                FilterAcceptListAddressType::RANDOM, Address{1}),
+            ErrorCode::SUCCESS);
+}
+
+TEST_F(LeRemoveDeviceFromFilterAcceptListTest, ScanningActive) {
+  ASSERT_EQ(controller_.LeAddDeviceToFilterAcceptList(
+                FilterAcceptListAddressType::PUBLIC, Address{1}),
+            ErrorCode::SUCCESS);
+
+  controller_.LeSetScanParameters(
+      LeScanType::PASSIVE, 0x400, 0x200, OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+      LeScanningFilterPolicy::FILTER_ACCEPT_LIST_ONLY);
+  controller_.LeSetScanEnable(true, false);
+
+  ASSERT_EQ(controller_.LeRemoveDeviceFromFilterAcceptList(
+                FilterAcceptListAddressType::PUBLIC, Address{1}),
+            ErrorCode::COMMAND_DISALLOWED);
+}
+
+TEST_F(LeRemoveDeviceFromFilterAcceptListTest, LegacyAdvertisingActive) {
+  ASSERT_EQ(controller_.LeAddDeviceToFilterAcceptList(
+                FilterAcceptListAddressType::PUBLIC, Address{1}),
+            ErrorCode::SUCCESS);
+
+  ASSERT_EQ(controller_.LeSetAdvertisingParameters(
+                0x0800, 0x0800, AdvertisingType::ADV_IND,
+                OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+                PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS,
+                Address::kEmpty, 0x7, AdvertisingFilterPolicy::LISTED_SCAN),
+            ErrorCode::SUCCESS);
+  ASSERT_EQ(controller_.LeSetAdvertisingEnable(true), ErrorCode::SUCCESS);
+
+  ASSERT_EQ(controller_.LeRemoveDeviceFromFilterAcceptList(
+                FilterAcceptListAddressType::PUBLIC, Address{1}),
+            ErrorCode::COMMAND_DISALLOWED);
+}
+
+TEST_F(LeRemoveDeviceFromFilterAcceptListTest, ExtendedAdvertisingActive) {
+  ASSERT_EQ(controller_.LeAddDeviceToFilterAcceptList(
+                FilterAcceptListAddressType::PUBLIC, Address{1}),
+            ErrorCode::SUCCESS);
+
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingParameters(
+                0, MakeAdvertisingEventProperties(CONNECTABLE), 0x0800, 0x0800,
+                0x7, OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+                PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS,
+                Address::kEmpty, AdvertisingFilterPolicy::LISTED_SCAN, 0x70,
+                PrimaryPhyType::LE_1M, 0, SecondaryPhyType::LE_2M, 0x0, false),
+            ErrorCode::SUCCESS);
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingEnable(
+                true, {MakeEnabledSet(0, 0, 0)}),
+            ErrorCode::SUCCESS);
+
+  ASSERT_EQ(controller_.LeRemoveDeviceFromFilterAcceptList(
+                FilterAcceptListAddressType::PUBLIC, Address{1}),
+            ErrorCode::COMMAND_DISALLOWED);
+}
+
+}  // namespace rootcanal
diff --git a/tools/rootcanal/test/controller/le/le_remove_device_from_resolving_list_test.cc b/tools/rootcanal/test/controller/le/le_remove_device_from_resolving_list_test.cc
new file mode 100644
index 0000000..2f9d9f5
--- /dev/null
+++ b/tools/rootcanal/test/controller/le/le_remove_device_from_resolving_list_test.cc
@@ -0,0 +1,114 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <gtest/gtest.h>
+
+#include "model/controller/link_layer_controller.h"
+#include "test_helpers.h"
+
+namespace rootcanal {
+
+using namespace bluetooth::hci;
+
+class LeRemoveDeviceFromResolvingListTest : public ::testing::Test {
+ public:
+  LeRemoveDeviceFromResolvingListTest() {
+    // Reduce the size of the resolving list to simplify testing.
+    properties_.le_resolving_list_size = 2;
+  }
+
+  ~LeRemoveDeviceFromResolvingListTest() override = default;
+
+ protected:
+  Address address_{0};
+  ControllerProperties properties_{};
+  LinkLayerController controller_{address_, properties_};
+};
+
+TEST_F(LeRemoveDeviceFromResolvingListTest, Success) {
+  ASSERT_EQ(controller_.LeAddDeviceToResolvingList(
+                PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS, Address{1},
+                std::array<uint8_t, 16>{1}, std::array<uint8_t, 16>{1}),
+            ErrorCode::SUCCESS);
+
+  ASSERT_EQ(controller_.LeRemoveDeviceFromResolvingList(
+                PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS, Address{1}),
+            ErrorCode::SUCCESS);
+}
+
+TEST_F(LeRemoveDeviceFromResolvingListTest, NotFound) {
+  ASSERT_EQ(controller_.LeAddDeviceToResolvingList(
+                PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS, Address{1},
+                std::array<uint8_t, 16>{1}, std::array<uint8_t, 16>{1}),
+            ErrorCode::SUCCESS);
+
+  ASSERT_EQ(controller_.LeRemoveDeviceFromResolvingList(
+                PeerAddressType::RANDOM_DEVICE_OR_IDENTITY_ADDRESS, Address{1}),
+            ErrorCode::UNKNOWN_CONNECTION);
+}
+
+TEST_F(LeRemoveDeviceFromResolvingListTest, ScanningActive) {
+  ASSERT_EQ(controller_.LeAddDeviceToResolvingList(
+                PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS, Address{1},
+                std::array<uint8_t, 16>{1}, std::array<uint8_t, 16>{1}),
+            ErrorCode::SUCCESS);
+
+  ASSERT_EQ(controller_.LeSetAddressResolutionEnable(true), ErrorCode::SUCCESS);
+  controller_.LeSetScanEnable(true, false);
+
+  ASSERT_EQ(controller_.LeRemoveDeviceFromResolvingList(
+                PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS, Address{1}),
+            ErrorCode::COMMAND_DISALLOWED);
+}
+
+TEST_F(LeRemoveDeviceFromResolvingListTest, LegacyAdvertisingActive) {
+  ASSERT_EQ(controller_.LeAddDeviceToResolvingList(
+                PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS, Address{1},
+                std::array<uint8_t, 16>{1}, std::array<uint8_t, 16>{1}),
+            ErrorCode::SUCCESS);
+
+  ASSERT_EQ(controller_.LeSetAddressResolutionEnable(true), ErrorCode::SUCCESS);
+  ASSERT_EQ(controller_.LeSetAdvertisingEnable(true), ErrorCode::SUCCESS);
+
+  ASSERT_EQ(controller_.LeRemoveDeviceFromResolvingList(
+                PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS, Address{1}),
+            ErrorCode::COMMAND_DISALLOWED);
+}
+
+TEST_F(LeRemoveDeviceFromResolvingListTest, ExtendedAdvertisingActive) {
+  ASSERT_EQ(controller_.LeAddDeviceToResolvingList(
+                PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS, Address{1},
+                std::array<uint8_t, 16>{1}, std::array<uint8_t, 16>{1}),
+            ErrorCode::SUCCESS);
+
+  ASSERT_EQ(controller_.LeSetAddressResolutionEnable(true), ErrorCode::SUCCESS);
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingParameters(
+                0, MakeAdvertisingEventProperties(CONNECTABLE), 0x0800, 0x0800,
+                0x7, OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+                PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS,
+                Address::kEmpty, AdvertisingFilterPolicy::LISTED_SCAN, 0x70,
+                PrimaryPhyType::LE_1M, 0, SecondaryPhyType::LE_2M, 0x0, false),
+            ErrorCode::SUCCESS);
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingEnable(
+                true, {MakeEnabledSet(0, 0, 0)}),
+            ErrorCode::SUCCESS);
+
+  ASSERT_EQ(controller_.LeRemoveDeviceFromResolvingList(
+                PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS, Address{1}),
+            ErrorCode::COMMAND_DISALLOWED);
+}
+
+}  // namespace rootcanal
diff --git a/tools/rootcanal/test/controller/le/le_scanning_filter_duplicates_test.cc b/tools/rootcanal/test/controller/le/le_scanning_filter_duplicates_test.cc
new file mode 100644
index 0000000..9f22ebc
--- /dev/null
+++ b/tools/rootcanal/test/controller/le/le_scanning_filter_duplicates_test.cc
@@ -0,0 +1,395 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <gtest/gtest.h>
+
+#include <chrono>
+#include <cstdint>
+#include <memory>
+#include <thread>
+#include <vector>
+
+#include "hci/address.h"
+#include "hci/hci_packets.h"
+#include "model/controller/link_layer_controller.h"
+#include "packet/bit_inserter.h"
+#include "packet/packet_view.h"
+#include "packets/link_layer_packets.h"
+
+namespace rootcanal {
+
+using namespace bluetooth::hci;
+
+class LeScanningFilterDuplicates : public ::testing::Test {
+ public:
+  LeScanningFilterDuplicates() {}
+
+  ~LeScanningFilterDuplicates() override = default;
+
+  void SetUp() override {
+    event_listener_called_ = 0;
+    controller_.RegisterEventChannel(event_listener_);
+    controller_.RegisterRemoteChannel(remote_listener_);
+
+    auto to_mask = [](auto event) -> uint64_t {
+      return UINT64_C(1) << (static_cast<uint8_t>(event) - 1);
+    };
+
+    // Set event mask to receive (extended) Advertising Reports
+    controller_.SetEventMask(to_mask(EventCode::LE_META_EVENT));
+
+    controller_.SetLeEventMask(
+        to_mask(SubeventCode::ADVERTISING_REPORT) |
+        to_mask(SubeventCode::EXTENDED_ADVERTISING_REPORT) |
+        to_mask(SubeventCode::DIRECTED_ADVERTISING_REPORT));
+  }
+
+  void StartScan(FilterDuplicates filter_duplicates) {
+    ASSERT_EQ(ErrorCode::SUCCESS, controller_.LeSetScanParameters(
+                                      LeScanType::ACTIVE, 0x4, 0x4,
+                                      OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+                                      LeScanningFilterPolicy::ACCEPT_ALL));
+    ASSERT_EQ(ErrorCode::SUCCESS,
+              controller_.LeSetScanEnable(
+                  true, filter_duplicates == FilterDuplicates::ENABLED));
+  }
+
+  void StopScan(void) {
+    ASSERT_EQ(ErrorCode::SUCCESS, controller_.LeSetScanEnable(false, false));
+  }
+
+  void StartExtendedScan(FilterDuplicates filter_duplicates,
+                         uint16_t duration = 0, uint16_t period = 0) {
+    bluetooth::hci::PhyScanParameters param;
+    param.le_scan_type_ = LeScanType::ACTIVE;
+    param.le_scan_interval_ = 0x4;
+    param.le_scan_window_ = 0x4;
+
+    ASSERT_EQ(ErrorCode::SUCCESS,
+              controller_.LeSetExtendedScanParameters(
+                  OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+                  LeScanningFilterPolicy::ACCEPT_ALL, 0x1, {param}));
+    ASSERT_EQ(ErrorCode::SUCCESS,
+              controller_.LeSetExtendedScanEnable(true, filter_duplicates,
+                                                  duration, period));
+  }
+
+  void StopExtendedScan(void) {
+    ASSERT_EQ(ErrorCode::SUCCESS, controller_.LeSetExtendedScanEnable(
+                                      false, FilterDuplicates::DISABLED, 0, 0));
+  }
+
+  /// Helper for building ScanResponse packets
+  static model::packets::LinkLayerPacketView LeScanResponse(
+      std::vector<uint8_t> const data = {}) {
+    return FromBuilder(*model::packets::LeScanResponseBuilder::Create(
+        Address::kEmpty, Address::kEmpty, model::packets::AddressType::PUBLIC,
+        data));
+  }
+
+  /// Helper for building LeLegacyAdvertisingPdu packets
+  static model::packets::LinkLayerPacketView LeLegacyAdvertisingPdu(
+      std::vector<uint8_t> const data = {}) {
+    return FromBuilder(*model::packets::LeLegacyAdvertisingPduBuilder::Create(
+        Address::kEmpty, Address::kEmpty, model::packets::AddressType::PUBLIC,
+        model::packets::AddressType::PUBLIC,
+        model::packets::LegacyAdvertisingType::ADV_IND, data));
+  }
+
+  /// Helper for building LeExtendedAdvertisingPdu packets
+  static model::packets::LinkLayerPacketView LeExtendedAdvertisingPdu(
+      std::vector<uint8_t> const data = {}) {
+    return FromBuilder(*model::packets::LeExtendedAdvertisingPduBuilder::Create(
+        Address::kEmpty, Address::kEmpty, model::packets::AddressType::PUBLIC,
+        model::packets::AddressType::PUBLIC, 0, 1, 0, 0, 0,
+        model::packets::PrimaryPhyType::LE_1M,
+        model::packets::SecondaryPhyType::LE_1M, data));
+  }
+
+  enum Filtered {
+    kFiltered,
+    kReported,
+  };
+
+  void SendPacket(model::packets::LinkLayerPacketView packet) {
+    controller_.IncomingPacket(packet);
+  }
+
+  /// Helper for sending the provided packet to the controller then checking if
+  /// it was reported or filtered
+  enum Filtered SendPacketAndCheck(model::packets::LinkLayerPacketView packet) {
+    unsigned const before = event_listener_called_;
+    SendPacket(packet);
+
+    if (before == event_listener_called_) {
+      return kFiltered;
+    }
+    return kReported;
+  }
+
+ protected:
+  Address address_{};
+  ControllerProperties properties_{};
+  LinkLayerController controller_{address_, properties_};
+  static unsigned event_listener_called_;
+
+ private:
+  static void event_listener_(std::shared_ptr<EventBuilder> /* event */) {
+    event_listener_called_++;
+  }
+
+  static void remote_listener_(
+      std::shared_ptr<model::packets::LinkLayerPacketBuilder> /* packet */,
+      Phy::Type /* phy */) {}
+
+  /// Helper for building packet view from packet builder
+  static model::packets::LinkLayerPacketView FromBuilder(
+      model::packets::LinkLayerPacketBuilder& builder) {
+    std::shared_ptr<std::vector<uint8_t>> buffer(new std::vector<uint8_t>);
+    auto bit_inserter = bluetooth::packet::BitInserter(*buffer);
+
+    builder.Serialize(bit_inserter);
+
+    return model::packets::LinkLayerPacketView::Create(
+        PacketView<kLittleEndian>(buffer));
+  }
+};
+
+unsigned LeScanningFilterDuplicates::event_listener_called_ = 0;
+
+TEST_F(LeScanningFilterDuplicates, LegacyAdvertisingPduDuringLegacyScan) {
+  StopScan();
+  ASSERT_EQ(kFiltered, SendPacketAndCheck(LeLegacyAdvertisingPdu()));
+
+  StartScan(FilterDuplicates::DISABLED);
+  ASSERT_EQ(kReported, SendPacketAndCheck(LeLegacyAdvertisingPdu()));
+  ASSERT_EQ(kReported, SendPacketAndCheck(LeLegacyAdvertisingPdu()));
+
+  StopScan();
+  StartScan(FilterDuplicates::ENABLED);
+  ASSERT_EQ(kReported, SendPacketAndCheck(LeLegacyAdvertisingPdu()));
+  ASSERT_EQ(kFiltered, SendPacketAndCheck(LeLegacyAdvertisingPdu()));
+  ASSERT_EQ(kReported, SendPacketAndCheck(LeLegacyAdvertisingPdu({0})));
+  ASSERT_EQ(kFiltered, SendPacketAndCheck(LeLegacyAdvertisingPdu({0})));
+  ASSERT_EQ(kReported, SendPacketAndCheck(LeLegacyAdvertisingPdu({0, 1})));
+  ASSERT_EQ(kFiltered, SendPacketAndCheck(LeLegacyAdvertisingPdu({0, 1})));
+}
+
+TEST_F(LeScanningFilterDuplicates, LegacyAdvertisingPduDuringExtendedScan) {
+  StopExtendedScan();
+  ASSERT_EQ(kFiltered, SendPacketAndCheck(LeLegacyAdvertisingPdu()));
+
+  StartExtendedScan(FilterDuplicates::DISABLED);
+  ASSERT_EQ(kReported, SendPacketAndCheck(LeLegacyAdvertisingPdu()));
+  ASSERT_EQ(kReported, SendPacketAndCheck(LeLegacyAdvertisingPdu()));
+
+  StopExtendedScan();
+  StartExtendedScan(FilterDuplicates::ENABLED);
+  ASSERT_EQ(kReported, SendPacketAndCheck(LeLegacyAdvertisingPdu()));
+  ASSERT_EQ(kFiltered, SendPacketAndCheck(LeLegacyAdvertisingPdu()));
+  ASSERT_EQ(kReported, SendPacketAndCheck(LeLegacyAdvertisingPdu({0})));
+  ASSERT_EQ(kFiltered, SendPacketAndCheck(LeLegacyAdvertisingPdu({0})));
+  ASSERT_EQ(kReported, SendPacketAndCheck(LeLegacyAdvertisingPdu({0, 1})));
+  ASSERT_EQ(kFiltered, SendPacketAndCheck(LeLegacyAdvertisingPdu({0, 1})));
+}
+
+TEST_F(LeScanningFilterDuplicates, ExtendedAdvertisingPduDuringLegacyScan) {
+  StopScan();
+  ASSERT_EQ(kFiltered, SendPacketAndCheck(LeExtendedAdvertisingPdu()));
+
+  StartScan(FilterDuplicates::DISABLED);
+  ASSERT_EQ(kFiltered, SendPacketAndCheck(LeExtendedAdvertisingPdu()));
+}
+
+TEST_F(LeScanningFilterDuplicates, ExtendedAdvertisingPduDuringExtendedScan) {
+  StopExtendedScan();
+  ASSERT_EQ(kFiltered, SendPacketAndCheck(LeExtendedAdvertisingPdu()));
+
+  StartExtendedScan(FilterDuplicates::DISABLED);
+  ASSERT_EQ(kReported, SendPacketAndCheck(LeExtendedAdvertisingPdu()));
+  ASSERT_EQ(kReported, SendPacketAndCheck(LeExtendedAdvertisingPdu()));
+
+  StopExtendedScan();
+  StartExtendedScan(FilterDuplicates::ENABLED);
+  ASSERT_EQ(kReported, SendPacketAndCheck(LeExtendedAdvertisingPdu()));
+  ASSERT_EQ(kFiltered, SendPacketAndCheck(LeExtendedAdvertisingPdu()));
+  ASSERT_EQ(kReported, SendPacketAndCheck(LeExtendedAdvertisingPdu({0})));
+  ASSERT_EQ(kFiltered, SendPacketAndCheck(LeExtendedAdvertisingPdu({0})));
+  ASSERT_EQ(kReported, SendPacketAndCheck(LeExtendedAdvertisingPdu({0, 1})));
+  ASSERT_EQ(kFiltered, SendPacketAndCheck(LeExtendedAdvertisingPdu({0, 1})));
+}
+
+TEST_F(LeScanningFilterDuplicates,
+       LeScanResponseToLegacyAdvertisingDuringLegacyScan) {
+  StopScan();
+  SendPacket(LeLegacyAdvertisingPdu());
+  ASSERT_EQ(kFiltered, SendPacketAndCheck(LeScanResponse()));
+
+  StartScan(FilterDuplicates::DISABLED);
+  SendPacket(LeLegacyAdvertisingPdu());
+  ASSERT_EQ(kReported, SendPacketAndCheck(LeScanResponse()));
+  ASSERT_EQ(kFiltered, SendPacketAndCheck(LeScanResponse()));
+  SendPacket(LeLegacyAdvertisingPdu());
+  ASSERT_EQ(kReported, SendPacketAndCheck(LeScanResponse()));
+  ASSERT_EQ(kFiltered, SendPacketAndCheck(LeScanResponse()));
+
+  StopScan();
+  StartScan(FilterDuplicates::ENABLED);
+  SendPacket(LeLegacyAdvertisingPdu());
+  ASSERT_EQ(kReported, SendPacketAndCheck(LeScanResponse()));
+  SendPacket(LeLegacyAdvertisingPdu());  // Duplicate
+  ASSERT_EQ(kFiltered, SendPacketAndCheck(LeScanResponse()));
+  SendPacket(LeLegacyAdvertisingPdu({0}));
+  ASSERT_EQ(kReported, SendPacketAndCheck(LeScanResponse({0})));
+  SendPacket(LeLegacyAdvertisingPdu({0}));  // Duplicate
+  ASSERT_EQ(kFiltered, SendPacketAndCheck(LeScanResponse({0})));
+  SendPacket(LeLegacyAdvertisingPdu({0, 1}));
+  ASSERT_EQ(kReported, SendPacketAndCheck(LeScanResponse({0, 1})));
+  SendPacket(LeLegacyAdvertisingPdu({0, 1}));  // Duplicate
+  ASSERT_EQ(kFiltered, SendPacketAndCheck(LeScanResponse({0, 1})));
+}
+
+TEST_F(LeScanningFilterDuplicates,
+       LeScanResponseToLegacyAdvertisingDuringExtendedScan) {
+  StopExtendedScan();
+  SendPacket(LeLegacyAdvertisingPdu());
+  ASSERT_EQ(kFiltered, SendPacketAndCheck(LeScanResponse()));
+
+  StartExtendedScan(FilterDuplicates::DISABLED);
+  SendPacket(LeLegacyAdvertisingPdu());
+  ASSERT_EQ(kReported, SendPacketAndCheck(LeScanResponse()));
+  ASSERT_EQ(kFiltered, SendPacketAndCheck(LeScanResponse()));
+  SendPacket(LeLegacyAdvertisingPdu());
+  ASSERT_EQ(kReported, SendPacketAndCheck(LeScanResponse()));
+  ASSERT_EQ(kFiltered, SendPacketAndCheck(LeScanResponse()));
+
+  StopExtendedScan();
+  StartExtendedScan(FilterDuplicates::ENABLED);
+  SendPacket(LeLegacyAdvertisingPdu());
+  ASSERT_EQ(kReported, SendPacketAndCheck(LeScanResponse()));
+  SendPacket(LeLegacyAdvertisingPdu());  // Duplicate
+  ASSERT_EQ(kFiltered, SendPacketAndCheck(LeScanResponse()));
+  SendPacket(LeLegacyAdvertisingPdu({0}));
+  ASSERT_EQ(kReported, SendPacketAndCheck(LeScanResponse({0})));
+  SendPacket(LeLegacyAdvertisingPdu({0}));  // Duplicate
+  ASSERT_EQ(kFiltered, SendPacketAndCheck(LeScanResponse({0})));
+  SendPacket(LeLegacyAdvertisingPdu({0, 1}));
+  ASSERT_EQ(kReported, SendPacketAndCheck(LeScanResponse({0, 1})));
+  SendPacket(LeLegacyAdvertisingPdu({0, 1}));  // Duplicate
+  ASSERT_EQ(kFiltered, SendPacketAndCheck(LeScanResponse({0, 1})));
+}
+
+TEST_F(LeScanningFilterDuplicates,
+       LeScanResponseToExtendedAdvertisingDuringLegacyScan) {
+  StopScan();
+  SendPacket(LeExtendedAdvertisingPdu());
+  ASSERT_EQ(kFiltered, SendPacketAndCheck(LeScanResponse()));
+
+  StartScan(FilterDuplicates::DISABLED);
+  SendPacket(LeExtendedAdvertisingPdu());
+  ASSERT_EQ(kFiltered, SendPacketAndCheck(LeScanResponse()));
+  SendPacket(LeExtendedAdvertisingPdu());
+  ASSERT_EQ(kFiltered, SendPacketAndCheck(LeScanResponse()));
+}
+
+TEST_F(LeScanningFilterDuplicates,
+       LeScanResponseToExtendedAdvertisingDuringExtendedScan) {
+  StopExtendedScan();
+  SendPacket(LeExtendedAdvertisingPdu());
+  ASSERT_EQ(kFiltered, SendPacketAndCheck(LeScanResponse()));
+
+  StartExtendedScan(FilterDuplicates::DISABLED);
+  SendPacket(LeExtendedAdvertisingPdu());
+  ASSERT_EQ(kReported, SendPacketAndCheck(LeScanResponse()));
+  ASSERT_EQ(kFiltered, SendPacketAndCheck(LeScanResponse()));
+  SendPacket(LeExtendedAdvertisingPdu());
+  ASSERT_EQ(kReported, SendPacketAndCheck(LeScanResponse()));
+  ASSERT_EQ(kFiltered, SendPacketAndCheck(LeScanResponse()));
+
+  StopExtendedScan();
+  StartExtendedScan(FilterDuplicates::ENABLED);
+  SendPacket(LeExtendedAdvertisingPdu());
+  ASSERT_EQ(kReported, SendPacketAndCheck(LeScanResponse()));
+  SendPacket(LeExtendedAdvertisingPdu());  // Duplicate
+  ASSERT_EQ(kFiltered, SendPacketAndCheck(LeScanResponse()));
+  SendPacket(LeExtendedAdvertisingPdu({0}));
+  ASSERT_EQ(kReported, SendPacketAndCheck(LeScanResponse({0})));
+  SendPacket(LeExtendedAdvertisingPdu({0}));  // Duplicate
+  ASSERT_EQ(kFiltered, SendPacketAndCheck(LeScanResponse({0})));
+  SendPacket(LeExtendedAdvertisingPdu({0, 1}));
+  ASSERT_EQ(kReported, SendPacketAndCheck(LeScanResponse({0, 1})));
+  SendPacket(LeExtendedAdvertisingPdu({0, 1}));  // Duplicate
+  ASSERT_EQ(kFiltered, SendPacketAndCheck(LeScanResponse({0, 1})));
+}
+
+TEST_F(LeScanningFilterDuplicates, HistoryClearedBetweenLegacyScans) {
+  StopScan();
+  StartScan(FilterDuplicates::ENABLED);
+  ASSERT_EQ(kReported, SendPacketAndCheck(LeLegacyAdvertisingPdu()));
+  ASSERT_EQ(kReported, SendPacketAndCheck(LeScanResponse()));
+  ASSERT_EQ(kFiltered, SendPacketAndCheck(LeLegacyAdvertisingPdu()));
+  ASSERT_EQ(kFiltered, SendPacketAndCheck(LeScanResponse()));
+
+  StopScan();
+  StartScan(FilterDuplicates::ENABLED);
+  ASSERT_EQ(kReported, SendPacketAndCheck(LeLegacyAdvertisingPdu()));
+  ASSERT_EQ(kReported, SendPacketAndCheck(LeScanResponse()));
+  ASSERT_EQ(kFiltered, SendPacketAndCheck(LeLegacyAdvertisingPdu()));
+  ASSERT_EQ(kFiltered, SendPacketAndCheck(LeScanResponse()));
+}
+
+TEST_F(LeScanningFilterDuplicates, HistoryClearedBetweenExtendedScans) {
+  StopExtendedScan();
+  StartExtendedScan(FilterDuplicates::ENABLED);
+  ASSERT_EQ(kReported, SendPacketAndCheck(LeLegacyAdvertisingPdu()));
+  ASSERT_EQ(kReported, SendPacketAndCheck(LeScanResponse()));
+  ASSERT_EQ(kFiltered, SendPacketAndCheck(LeLegacyAdvertisingPdu()));
+  ASSERT_EQ(kFiltered, SendPacketAndCheck(LeScanResponse()));
+  ASSERT_EQ(kReported, SendPacketAndCheck(LeExtendedAdvertisingPdu()));
+  ASSERT_EQ(kReported, SendPacketAndCheck(LeScanResponse({0})));
+  ASSERT_EQ(kFiltered, SendPacketAndCheck(LeExtendedAdvertisingPdu()));
+  ASSERT_EQ(kFiltered, SendPacketAndCheck(LeScanResponse({0})));
+
+  StopExtendedScan();
+  StartExtendedScan(FilterDuplicates::ENABLED);
+  ASSERT_EQ(kReported, SendPacketAndCheck(LeLegacyAdvertisingPdu()));
+  ASSERT_EQ(kReported, SendPacketAndCheck(LeScanResponse()));
+  ASSERT_EQ(kFiltered, SendPacketAndCheck(LeLegacyAdvertisingPdu()));
+  ASSERT_EQ(kFiltered, SendPacketAndCheck(LeScanResponse()));
+  ASSERT_EQ(kReported, SendPacketAndCheck(LeExtendedAdvertisingPdu()));
+  ASSERT_EQ(kReported, SendPacketAndCheck(LeScanResponse({0})));
+  ASSERT_EQ(kFiltered, SendPacketAndCheck(LeExtendedAdvertisingPdu()));
+  ASSERT_EQ(kFiltered, SendPacketAndCheck(LeScanResponse({0})));
+}
+
+TEST_F(LeScanningFilterDuplicates, ResetHistoryAfterEachPeriod) {
+  StopExtendedScan();
+  // Minimal period is 1.28 seconds
+  StartExtendedScan(FilterDuplicates::RESET_EACH_PERIOD, 100, 1);
+  ASSERT_EQ(kReported, SendPacketAndCheck(LeExtendedAdvertisingPdu()));
+  ASSERT_EQ(kReported, SendPacketAndCheck(LeScanResponse({0})));
+  ASSERT_EQ(kFiltered, SendPacketAndCheck(LeExtendedAdvertisingPdu()));
+  ASSERT_EQ(kFiltered, SendPacketAndCheck(LeScanResponse({0})));
+
+  std::this_thread::sleep_for(std::chrono::milliseconds(1300));
+  controller_.TimerTick();
+
+  ASSERT_EQ(kReported, SendPacketAndCheck(LeExtendedAdvertisingPdu()));
+  ASSERT_EQ(kReported, SendPacketAndCheck(LeScanResponse({0})));
+  ASSERT_EQ(kFiltered, SendPacketAndCheck(LeExtendedAdvertisingPdu()));
+  ASSERT_EQ(kFiltered, SendPacketAndCheck(LeScanResponse({0})));
+}
+}  // namespace rootcanal
diff --git a/tools/rootcanal/test/controller/le/le_set_address_resolution_enable_test.cc b/tools/rootcanal/test/controller/le/le_set_address_resolution_enable_test.cc
new file mode 100644
index 0000000..edfc6b8
--- /dev/null
+++ b/tools/rootcanal/test/controller/le/le_set_address_resolution_enable_test.cc
@@ -0,0 +1,77 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <gtest/gtest.h>
+
+#include "model/controller/link_layer_controller.h"
+#include "test_helpers.h"
+
+namespace rootcanal {
+
+using namespace bluetooth::hci;
+
+class LeSetAddressResolutionEnableTest : public ::testing::Test {
+ public:
+  LeSetAddressResolutionEnableTest() = default;
+  ~LeSetAddressResolutionEnableTest() override = default;
+
+ protected:
+  Address address_{0};
+  ControllerProperties properties_{};
+  LinkLayerController controller_{address_, properties_};
+};
+
+TEST_F(LeSetAddressResolutionEnableTest, Success) {
+  ASSERT_EQ(controller_.LeSetAddressResolutionEnable(true), ErrorCode::SUCCESS);
+  ASSERT_EQ(controller_.LeSetAddressResolutionEnable(false),
+            ErrorCode::SUCCESS);
+}
+
+TEST_F(LeSetAddressResolutionEnableTest, ScanningActive) {
+  controller_.LeSetScanEnable(true, false);
+  ASSERT_EQ(controller_.LeSetAddressResolutionEnable(true),
+            ErrorCode::COMMAND_DISALLOWED);
+  ASSERT_EQ(controller_.LeSetAddressResolutionEnable(false),
+            ErrorCode::COMMAND_DISALLOWED);
+}
+
+TEST_F(LeSetAddressResolutionEnableTest, LegacyAdvertisingActive) {
+  ASSERT_EQ(controller_.LeSetAdvertisingEnable(true), ErrorCode::SUCCESS);
+  ASSERT_EQ(controller_.LeSetAddressResolutionEnable(true),
+            ErrorCode::COMMAND_DISALLOWED);
+  ASSERT_EQ(controller_.LeSetAddressResolutionEnable(false),
+            ErrorCode::COMMAND_DISALLOWED);
+}
+
+TEST_F(LeSetAddressResolutionEnableTest, ExtendedAdvertisingActive) {
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingParameters(
+                0, MakeAdvertisingEventProperties(CONNECTABLE), 0x0800, 0x0800,
+                0x7, OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+                PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS,
+                Address::kEmpty, AdvertisingFilterPolicy::LISTED_SCAN, 0x70,
+                PrimaryPhyType::LE_1M, 0, SecondaryPhyType::LE_2M, 0x0, false),
+            ErrorCode::SUCCESS);
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingEnable(
+                true, {MakeEnabledSet(0, 0, 0)}),
+            ErrorCode::SUCCESS);
+
+  ASSERT_EQ(controller_.LeSetAddressResolutionEnable(true),
+            ErrorCode::COMMAND_DISALLOWED);
+  ASSERT_EQ(controller_.LeSetAddressResolutionEnable(false),
+            ErrorCode::COMMAND_DISALLOWED);
+}
+
+}  // namespace rootcanal
diff --git a/tools/rootcanal/test/controller/le/le_set_advertising_enable_test.cc b/tools/rootcanal/test/controller/le/le_set_advertising_enable_test.cc
new file mode 100644
index 0000000..d9ffb2a
--- /dev/null
+++ b/tools/rootcanal/test/controller/le/le_set_advertising_enable_test.cc
@@ -0,0 +1,104 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <gtest/gtest.h>
+
+#include "model/controller/link_layer_controller.h"
+
+namespace rootcanal {
+
+using namespace bluetooth::hci;
+
+class LeSetAdvertisingEnableTest : public ::testing::Test {
+ public:
+  LeSetAdvertisingEnableTest() = default;
+  ~LeSetAdvertisingEnableTest() override = default;
+
+ protected:
+  Address address_{0};
+  ControllerProperties properties_{};
+  LinkLayerController controller_{address_, properties_};
+};
+
+TEST_F(LeSetAdvertisingEnableTest, EnableUsingPublicAddress) {
+  ASSERT_EQ(controller_.LeSetAdvertisingParameters(
+                0x0800, 0x0800, AdvertisingType::ADV_IND,
+                OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+                PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS,
+                Address::kEmpty, 0x7, AdvertisingFilterPolicy::ALL_DEVICES),
+            ErrorCode::SUCCESS);
+  ASSERT_EQ(controller_.LeSetAdvertisingEnable(true), ErrorCode::SUCCESS);
+}
+
+TEST_F(LeSetAdvertisingEnableTest, EnableUsingRandomAddress) {
+  ASSERT_EQ(controller_.LeSetAdvertisingParameters(
+                0x0800, 0x0800, AdvertisingType::ADV_IND,
+                OwnAddressType::RANDOM_DEVICE_ADDRESS,
+                PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS,
+                Address::kEmpty, 0x7, AdvertisingFilterPolicy::ALL_DEVICES),
+            ErrorCode::SUCCESS);
+  ASSERT_EQ(controller_.LeSetRandomAddress(Address{1}), ErrorCode::SUCCESS);
+  ASSERT_EQ(controller_.LeSetAdvertisingEnable(true), ErrorCode::SUCCESS);
+}
+
+TEST_F(LeSetAdvertisingEnableTest, EnableUsingResolvableAddress) {
+  ASSERT_EQ(controller_.LeSetAdvertisingParameters(
+                0x0800, 0x0800, AdvertisingType::ADV_IND,
+                OwnAddressType::RESOLVABLE_OR_RANDOM_ADDRESS,
+                PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS, Address{1},
+                0x7, AdvertisingFilterPolicy::ALL_DEVICES),
+            ErrorCode::SUCCESS);
+  ASSERT_EQ(controller_.LeAddDeviceToResolvingList(
+                PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS, Address{1},
+                std::array<uint8_t, 16>{1}, std::array<uint8_t, 16>{1}),
+            ErrorCode::SUCCESS);
+  ASSERT_EQ(controller_.LeSetAddressResolutionEnable(true), ErrorCode::SUCCESS);
+  // Note: the command will fail if the peer address is not in the resolvable
+  // address list and the random address is not set.
+  // Success here signifies that the RPA was successfully generated.
+  ASSERT_EQ(controller_.LeSetAdvertisingEnable(true), ErrorCode::SUCCESS);
+}
+
+TEST_F(LeSetAdvertisingEnableTest, Disable) {
+  ASSERT_EQ(controller_.LeSetAdvertisingEnable(false), ErrorCode::SUCCESS);
+}
+
+TEST_F(LeSetAdvertisingEnableTest, NoRandomAddress) {
+  ASSERT_EQ(controller_.LeSetAdvertisingParameters(
+                0x0800, 0x0800, AdvertisingType::ADV_IND,
+                OwnAddressType::RANDOM_DEVICE_ADDRESS,
+                PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS,
+                Address::kEmpty, 0x7, AdvertisingFilterPolicy::ALL_DEVICES),
+            ErrorCode::SUCCESS);
+
+  ASSERT_EQ(controller_.LeSetAdvertisingEnable(true),
+            ErrorCode::INVALID_HCI_COMMAND_PARAMETERS);
+}
+
+TEST_F(LeSetAdvertisingEnableTest, NoResolvableOrRandomAddress) {
+  ASSERT_EQ(controller_.LeSetAddressResolutionEnable(true), ErrorCode::SUCCESS);
+  ASSERT_EQ(controller_.LeSetAdvertisingParameters(
+                0x0800, 0x0800, AdvertisingType::ADV_IND,
+                OwnAddressType::RESOLVABLE_OR_RANDOM_ADDRESS,
+                PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS,
+                Address::kEmpty, 0x7, AdvertisingFilterPolicy::ALL_DEVICES),
+            ErrorCode::SUCCESS);
+
+  ASSERT_EQ(controller_.LeSetAdvertisingEnable(true),
+            ErrorCode::INVALID_HCI_COMMAND_PARAMETERS);
+}
+
+}  // namespace rootcanal
diff --git a/tools/rootcanal/test/controller/le/le_set_advertising_parameters_test.cc b/tools/rootcanal/test/controller/le/le_set_advertising_parameters_test.cc
new file mode 100644
index 0000000..56f85bc
--- /dev/null
+++ b/tools/rootcanal/test/controller/le/le_set_advertising_parameters_test.cc
@@ -0,0 +1,102 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <gtest/gtest.h>
+
+#include "model/controller/link_layer_controller.h"
+
+namespace rootcanal {
+
+using namespace bluetooth::hci;
+
+class LeSetAdvertisingParametersTest : public ::testing::Test {
+ public:
+  LeSetAdvertisingParametersTest() = default;
+  ~LeSetAdvertisingParametersTest() override = default;
+
+ protected:
+  Address address_{0};
+  ControllerProperties properties_{};
+  LinkLayerController controller_{address_, properties_};
+};
+
+TEST_F(LeSetAdvertisingParametersTest, Success) {
+  ASSERT_EQ(controller_.LeSetAdvertisingParameters(
+                0x0800, 0x0800, AdvertisingType::ADV_IND,
+                OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+                PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS,
+                Address::kEmpty, 0x7, AdvertisingFilterPolicy::ALL_DEVICES),
+            ErrorCode::SUCCESS);
+}
+
+TEST_F(LeSetAdvertisingParametersTest, AdvertisingActive) {
+  ASSERT_EQ(controller_.LeSetAdvertisingEnable(true), ErrorCode::SUCCESS);
+
+  ASSERT_EQ(controller_.LeSetAdvertisingParameters(
+                0x0800, 0x0800, AdvertisingType::ADV_IND,
+                OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+                PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS,
+                Address::kEmpty, 0x7, AdvertisingFilterPolicy::ALL_DEVICES),
+            ErrorCode::COMMAND_DISALLOWED);
+}
+
+TEST_F(LeSetAdvertisingParametersTest, InvalidChannelMap) {
+  ASSERT_EQ(controller_.LeSetAdvertisingParameters(
+                0x0800, 0x0800, AdvertisingType::ADV_IND,
+                OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+                PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS,
+                Address::kEmpty, 0x0, AdvertisingFilterPolicy::ALL_DEVICES),
+            ErrorCode::INVALID_HCI_COMMAND_PARAMETERS);
+}
+
+TEST_F(LeSetAdvertisingParametersTest, InvalidAdvertisingInterval) {
+  ASSERT_EQ(controller_.LeSetAdvertisingParameters(
+                0x0, 0x0800, AdvertisingType::ADV_IND,
+                OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+                PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS,
+                Address::kEmpty, 0x7, AdvertisingFilterPolicy::ALL_DEVICES),
+            ErrorCode::UNSUPPORTED_FEATURE_OR_PARAMETER_VALUE);
+
+  ASSERT_EQ(controller_.LeSetAdvertisingParameters(
+                0x0800, 0x0, AdvertisingType::ADV_IND,
+                OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+                PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS,
+                Address::kEmpty, 0x7, AdvertisingFilterPolicy::ALL_DEVICES),
+            ErrorCode::UNSUPPORTED_FEATURE_OR_PARAMETER_VALUE);
+
+  ASSERT_EQ(controller_.LeSetAdvertisingParameters(
+                0x4001, 0x0800, AdvertisingType::ADV_IND,
+                OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+                PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS,
+                Address::kEmpty, 0x7, AdvertisingFilterPolicy::ALL_DEVICES),
+            ErrorCode::UNSUPPORTED_FEATURE_OR_PARAMETER_VALUE);
+
+  ASSERT_EQ(controller_.LeSetAdvertisingParameters(
+                0x0800, 0x4001, AdvertisingType::ADV_IND,
+                OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+                PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS,
+                Address::kEmpty, 0x7, AdvertisingFilterPolicy::ALL_DEVICES),
+            ErrorCode::UNSUPPORTED_FEATURE_OR_PARAMETER_VALUE);
+
+  ASSERT_EQ(controller_.LeSetAdvertisingParameters(
+                0x0900, 0x0800, AdvertisingType::ADV_IND,
+                OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+                PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS,
+                Address::kEmpty, 0x7, AdvertisingFilterPolicy::ALL_DEVICES),
+            ErrorCode::INVALID_HCI_COMMAND_PARAMETERS);
+}
+
+}  // namespace rootcanal
diff --git a/tools/rootcanal/test/controller/le/le_set_extended_advertising_data_test.cc b/tools/rootcanal/test/controller/le/le_set_extended_advertising_data_test.cc
new file mode 100644
index 0000000..ed27f12
--- /dev/null
+++ b/tools/rootcanal/test/controller/le/le_set_extended_advertising_data_test.cc
@@ -0,0 +1,356 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <gtest/gtest.h>
+
+#include "model/controller/link_layer_controller.h"
+#include "test_helpers.h"
+
+namespace rootcanal {
+
+using namespace bluetooth::hci;
+
+class LeSetExtendedAdvertisingDataTest : public ::testing::Test {
+ public:
+  LeSetExtendedAdvertisingDataTest() {
+    // Reduce the number of advertising sets to simplify testing.
+    properties_.le_num_supported_advertising_sets = 2;
+    properties_.le_max_advertising_data_length = 300;
+  };
+  ~LeSetExtendedAdvertisingDataTest() override = default;
+
+ protected:
+  Address address_{0};
+  ControllerProperties properties_{};
+  LinkLayerController controller_{address_, properties_};
+};
+
+TEST_F(LeSetExtendedAdvertisingDataTest, Complete) {
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingParameters(
+                0, MakeAdvertisingEventProperties(CONNECTABLE), 0x0800, 0x0800,
+                0x7, OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+                PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS,
+                Address::kEmpty, AdvertisingFilterPolicy::ALL_DEVICES, 0x70,
+                PrimaryPhyType::LE_1M, 0, SecondaryPhyType::LE_2M, 0x0, false),
+            ErrorCode::SUCCESS);
+
+  std::vector<uint8_t> advertising_data = {1, 2, 3};
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingData(
+                0, Operation::COMPLETE_ADVERTISEMENT,
+                FragmentPreference::CONTROLLER_MAY_FRAGMENT, advertising_data),
+            ErrorCode::SUCCESS);
+}
+
+TEST_F(LeSetExtendedAdvertisingDataTest, Unchanged) {
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingParameters(
+                0, MakeAdvertisingEventProperties(CONNECTABLE), 0x0800, 0x0800,
+                0x7, OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+                PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS,
+                Address::kEmpty, AdvertisingFilterPolicy::ALL_DEVICES, 0x70,
+                PrimaryPhyType::LE_1M, 0, SecondaryPhyType::LE_2M, 0x0, false),
+            ErrorCode::SUCCESS);
+
+  std::vector<uint8_t> advertising_data = {1, 2, 3};
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingData(
+                0, Operation::COMPLETE_ADVERTISEMENT,
+                FragmentPreference::CONTROLLER_MAY_FRAGMENT, advertising_data),
+            ErrorCode::SUCCESS);
+
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingEnable(
+                true, {MakeEnabledSet(0, 0, 0)}),
+            ErrorCode::SUCCESS);
+
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingData(
+                0, Operation::UNCHANGED_DATA,
+                FragmentPreference::CONTROLLER_MAY_FRAGMENT, {}),
+            ErrorCode::SUCCESS);
+}
+
+TEST_F(LeSetExtendedAdvertisingDataTest, Fragmented) {
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingParameters(
+                0, MakeAdvertisingEventProperties(CONNECTABLE), 0x0800, 0x0800,
+                0x7, OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+                PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS,
+                Address::kEmpty, AdvertisingFilterPolicy::ALL_DEVICES, 0x70,
+                PrimaryPhyType::LE_1M, 0, SecondaryPhyType::LE_2M, 0x0, false),
+            ErrorCode::SUCCESS);
+
+  std::vector<uint8_t> first_advertising_data_fragment = {1, 2, 3};
+  std::vector<uint8_t> intermediate_advertising_data_fragment = {4, 5, 6};
+  std::vector<uint8_t> last_advertising_data_fragment = {7, 8, 9};
+
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingData(
+                0, Operation::FIRST_FRAGMENT,
+                FragmentPreference::CONTROLLER_MAY_FRAGMENT,
+                first_advertising_data_fragment),
+            ErrorCode::SUCCESS);
+
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingData(
+                0, Operation::INTERMEDIATE_FRAGMENT,
+                FragmentPreference::CONTROLLER_MAY_FRAGMENT,
+                intermediate_advertising_data_fragment),
+            ErrorCode::SUCCESS);
+
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingData(
+                0, Operation::LAST_FRAGMENT,
+                FragmentPreference::CONTROLLER_MAY_FRAGMENT,
+                last_advertising_data_fragment),
+            ErrorCode::SUCCESS);
+}
+
+TEST_F(LeSetExtendedAdvertisingDataTest, UnknownAdvertisingHandle) {
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingParameters(
+                0, MakeAdvertisingEventProperties(CONNECTABLE), 0x0800, 0x0800,
+                0x7, OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+                PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS,
+                Address::kEmpty, AdvertisingFilterPolicy::ALL_DEVICES, 0x70,
+                PrimaryPhyType::LE_1M, 0, SecondaryPhyType::LE_2M, 0x0, false),
+            ErrorCode::SUCCESS);
+
+  std::vector<uint8_t> advertising_data = {1, 2, 3};
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingData(
+                1, Operation::COMPLETE_ADVERTISEMENT,
+                FragmentPreference::CONTROLLER_MAY_FRAGMENT, advertising_data),
+            ErrorCode::UNKNOWN_ADVERTISING_IDENTIFIER);
+}
+
+TEST_F(LeSetExtendedAdvertisingDataTest, UnexpectedAdvertisingData) {
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingParameters(
+                0, MakeAdvertisingEventProperties(SCANNABLE), 0x0800, 0x0800,
+                0x7, OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+                PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS,
+                Address::kEmpty, AdvertisingFilterPolicy::ALL_DEVICES, 0x70,
+                PrimaryPhyType::LE_1M, 0, SecondaryPhyType::LE_2M, 0x0, false),
+            ErrorCode::SUCCESS);
+
+  std::vector<uint8_t> advertising_data = {1, 2, 3};
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingData(
+                0, Operation::COMPLETE_ADVERTISEMENT,
+                FragmentPreference::CONTROLLER_MAY_FRAGMENT, advertising_data),
+            ErrorCode::INVALID_HCI_COMMAND_PARAMETERS);
+}
+
+TEST_F(LeSetExtendedAdvertisingDataTest, IncompleteLegacyAdvertisingData) {
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingParameters(
+                0, MakeAdvertisingEventProperties(LEGACY | SCANNABLE), 0x0800,
+                0x0800, 0x7, OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+                PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS,
+                Address::kEmpty, AdvertisingFilterPolicy::ALL_DEVICES, 0x70,
+                PrimaryPhyType::LE_1M, 0, SecondaryPhyType::LE_2M, 0x0, false),
+            ErrorCode::SUCCESS);
+
+  std::vector<uint8_t> first_advertising_data_fragment = {1, 2, 3};
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingData(
+                0, Operation::FIRST_FRAGMENT,
+                FragmentPreference::CONTROLLER_MAY_FRAGMENT,
+                first_advertising_data_fragment),
+            ErrorCode::INVALID_HCI_COMMAND_PARAMETERS);
+}
+
+TEST_F(LeSetExtendedAdvertisingDataTest, InvalidLegacyAdvertisingData) {
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingParameters(
+                0, MakeAdvertisingEventProperties(LEGACY | SCANNABLE), 0x0800,
+                0x0800, 0x7, OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+                PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS,
+                Address::kEmpty, AdvertisingFilterPolicy::ALL_DEVICES, 0x70,
+                PrimaryPhyType::LE_1M, 0, SecondaryPhyType::LE_2M, 0x0, false),
+            ErrorCode::SUCCESS);
+
+  std::vector<uint8_t> advertising_data = {1, 2, 3};
+  advertising_data.resize(32);
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingData(
+                0, Operation::COMPLETE_ADVERTISEMENT,
+                FragmentPreference::CONTROLLER_MAY_FRAGMENT, advertising_data),
+            ErrorCode::INVALID_HCI_COMMAND_PARAMETERS);
+}
+
+TEST_F(LeSetExtendedAdvertisingDataTest, UnchangedWhenDisabled) {
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingParameters(
+                0, MakeAdvertisingEventProperties(CONNECTABLE), 0x0800, 0x0800,
+                0x7, OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+                PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS,
+                Address::kEmpty, AdvertisingFilterPolicy::ALL_DEVICES, 0x70,
+                PrimaryPhyType::LE_1M, 0, SecondaryPhyType::LE_2M, 0x0, false),
+            ErrorCode::SUCCESS);
+
+  std::vector<uint8_t> advertising_data = {1, 2, 3};
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingData(
+                0, Operation::COMPLETE_ADVERTISEMENT,
+                FragmentPreference::CONTROLLER_MAY_FRAGMENT, advertising_data),
+            ErrorCode::SUCCESS);
+
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingData(
+                0, Operation::UNCHANGED_DATA,
+                FragmentPreference::CONTROLLER_MAY_FRAGMENT, advertising_data),
+            ErrorCode::INVALID_HCI_COMMAND_PARAMETERS);
+}
+
+TEST_F(LeSetExtendedAdvertisingDataTest, UnchangedWhenAdvertisingDataEmpty) {
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingParameters(
+                0, MakeAdvertisingEventProperties(CONNECTABLE), 0x0800, 0x0800,
+                0x7, OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+                PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS,
+                Address::kEmpty, AdvertisingFilterPolicy::ALL_DEVICES, 0x70,
+                PrimaryPhyType::LE_1M, 0, SecondaryPhyType::LE_2M, 0x0, false),
+            ErrorCode::SUCCESS);
+
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingEnable(
+                true, {MakeEnabledSet(0, 0, 0)}),
+            ErrorCode::SUCCESS);
+
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingData(
+                0, Operation::UNCHANGED_DATA,
+                FragmentPreference::CONTROLLER_MAY_FRAGMENT, {}),
+            ErrorCode::INVALID_HCI_COMMAND_PARAMETERS);
+}
+
+TEST_F(LeSetExtendedAdvertisingDataTest, UnchangedWhenUsingLegacyAdvertising) {
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingParameters(
+                0, MakeAdvertisingEventProperties(LEGACY | SCANNABLE), 0x0800,
+                0x0800, 0x7, OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+                PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS,
+                Address::kEmpty, AdvertisingFilterPolicy::ALL_DEVICES, 0x70,
+                PrimaryPhyType::LE_1M, 0, SecondaryPhyType::LE_2M, 0x0, false),
+            ErrorCode::SUCCESS);
+
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingEnable(
+                true, {MakeEnabledSet(0, 0, 0)}),
+            ErrorCode::SUCCESS);
+
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingData(
+                0, Operation::UNCHANGED_DATA,
+                FragmentPreference::CONTROLLER_MAY_FRAGMENT, {}),
+            ErrorCode::INVALID_HCI_COMMAND_PARAMETERS);
+}
+
+TEST_F(LeSetExtendedAdvertisingDataTest, EmptyAdvertisingDataFragment) {
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingParameters(
+                0, MakeAdvertisingEventProperties(CONNECTABLE), 0x0800, 0x0800,
+                0x7, OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+                PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS,
+                Address::kEmpty, AdvertisingFilterPolicy::ALL_DEVICES, 0x70,
+                PrimaryPhyType::LE_1M, 0, SecondaryPhyType::LE_2M, 0x0, false),
+            ErrorCode::SUCCESS);
+
+  std::vector<uint8_t> first_advertising_data_fragment = {1, 2, 3};
+  std::vector<uint8_t> intermediate_advertising_data_fragment = {4, 5, 6};
+  std::vector<uint8_t> last_advertising_data_fragment = {7, 8, 9};
+
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingData(
+                0, Operation::FIRST_FRAGMENT,
+                FragmentPreference::CONTROLLER_MAY_FRAGMENT, {}),
+            ErrorCode::INVALID_HCI_COMMAND_PARAMETERS);
+
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingData(
+                0, Operation::FIRST_FRAGMENT,
+                FragmentPreference::CONTROLLER_MAY_FRAGMENT,
+                first_advertising_data_fragment),
+            ErrorCode::SUCCESS);
+
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingData(
+                0, Operation::INTERMEDIATE_FRAGMENT,
+                FragmentPreference::CONTROLLER_MAY_FRAGMENT, {}),
+            ErrorCode::INVALID_HCI_COMMAND_PARAMETERS);
+
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingData(
+                0, Operation::INTERMEDIATE_FRAGMENT,
+                FragmentPreference::CONTROLLER_MAY_FRAGMENT,
+                intermediate_advertising_data_fragment),
+            ErrorCode::SUCCESS);
+
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingData(
+                0, Operation::LAST_FRAGMENT,
+                FragmentPreference::CONTROLLER_MAY_FRAGMENT, {}),
+            ErrorCode::INVALID_HCI_COMMAND_PARAMETERS);
+
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingData(
+                0, Operation::LAST_FRAGMENT,
+                FragmentPreference::CONTROLLER_MAY_FRAGMENT,
+                last_advertising_data_fragment),
+            ErrorCode::SUCCESS);
+}
+
+TEST_F(LeSetExtendedAdvertisingDataTest, AdvertisingEnabled) {
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingParameters(
+                0, MakeAdvertisingEventProperties(CONNECTABLE), 0x0800, 0x0800,
+                0x7, OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+                PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS,
+                Address::kEmpty, AdvertisingFilterPolicy::ALL_DEVICES, 0x70,
+                PrimaryPhyType::LE_1M, 0, SecondaryPhyType::LE_2M, 0x0, false),
+            ErrorCode::SUCCESS);
+
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingEnable(
+                true, {MakeEnabledSet(0, 0, 0)}),
+            ErrorCode::SUCCESS);
+
+  std::vector<uint8_t> first_advertising_data_fragment = {1, 2, 3};
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingData(
+                0, Operation::FIRST_FRAGMENT,
+                FragmentPreference::CONTROLLER_MAY_FRAGMENT,
+                first_advertising_data_fragment),
+            ErrorCode::COMMAND_DISALLOWED);
+}
+
+TEST_F(LeSetExtendedAdvertisingDataTest,
+       AdvertisingDataLargerThanMemoryCapacity) {
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingParameters(
+                0, MakeAdvertisingEventProperties(CONNECTABLE), 0x0800, 0x0800,
+                0x7, OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+                PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS,
+                Address::kEmpty, AdvertisingFilterPolicy::ALL_DEVICES, 0x70,
+                PrimaryPhyType::LE_1M, 0, SecondaryPhyType::LE_2M, 0x0, false),
+            ErrorCode::SUCCESS);
+
+  std::vector<uint8_t> advertising_data_fragment = {1, 2, 3};
+  advertising_data_fragment.resize(properties_.le_max_advertising_data_length);
+
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingData(
+                0, Operation::FIRST_FRAGMENT,
+                FragmentPreference::CONTROLLER_MAY_FRAGMENT,
+                advertising_data_fragment),
+            ErrorCode::SUCCESS);
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingData(
+                0, Operation::LAST_FRAGMENT,
+                FragmentPreference::CONTROLLER_MAY_FRAGMENT,
+                advertising_data_fragment),
+            ErrorCode::MEMORY_CAPACITY_EXCEEDED);
+}
+
+TEST_F(LeSetExtendedAdvertisingDataTest, AdvertisingDataLargerThanPduCapacity) {
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingParameters(
+                0, MakeAdvertisingEventProperties(CONNECTABLE), 0x0800, 0x0800,
+                0x7, OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+                PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS,
+                Address::kEmpty, AdvertisingFilterPolicy::ALL_DEVICES, 0x70,
+                PrimaryPhyType::LE_1M, 0, SecondaryPhyType::LE_2M, 0x0, false),
+            ErrorCode::SUCCESS);
+
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingEnable(
+                true, {MakeEnabledSet(0, 0, 0)}),
+            ErrorCode::SUCCESS);
+
+  // No AUX chain possible for connectable advertising PDUs,
+  // the advertising data is limited to one PDU's payload.
+  std::vector<uint8_t> advertising_data = {1, 2, 3};
+  advertising_data.resize(254);
+
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingData(
+                0, Operation::COMPLETE_ADVERTISEMENT,
+                FragmentPreference::CONTROLLER_MAY_FRAGMENT, advertising_data),
+            ErrorCode::PACKET_TOO_LONG);
+}
+
+}  // namespace rootcanal
diff --git a/tools/rootcanal/test/controller/le/le_set_extended_advertising_enable_test.cc b/tools/rootcanal/test/controller/le/le_set_extended_advertising_enable_test.cc
new file mode 100644
index 0000000..a83e726
--- /dev/null
+++ b/tools/rootcanal/test/controller/le/le_set_extended_advertising_enable_test.cc
@@ -0,0 +1,313 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <gtest/gtest.h>
+
+#include "model/controller/link_layer_controller.h"
+#include "test_helpers.h"
+
+namespace rootcanal {
+
+using namespace bluetooth::hci;
+
+class LeSetExtendedAdvertisingEnableTest : public ::testing::Test {
+ public:
+  LeSetExtendedAdvertisingEnableTest() {
+    // Reduce the number of advertising sets to simplify testing.
+    properties_.le_num_supported_advertising_sets = 2;
+    properties_.le_max_advertising_data_length = 2000;
+  };
+  ~LeSetExtendedAdvertisingEnableTest() override = default;
+
+ protected:
+  Address address_{0};
+  ControllerProperties properties_{};
+  LinkLayerController controller_{address_, properties_};
+};
+
+TEST_F(LeSetExtendedAdvertisingEnableTest, DisableAll) {
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingEnable(false, {}),
+            ErrorCode::SUCCESS);
+}
+
+TEST_F(LeSetExtendedAdvertisingEnableTest, DisableSelected) {
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingParameters(
+                0, MakeAdvertisingEventProperties(CONNECTABLE), 0x0800, 0x0800,
+                0x7, OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+                PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS,
+                Address::kEmpty, AdvertisingFilterPolicy::ALL_DEVICES, 0x70,
+                PrimaryPhyType::LE_1M, 0, SecondaryPhyType::LE_2M, 0x0, false),
+            ErrorCode::SUCCESS);
+
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingEnable(
+                false, {MakeEnabledSet(0, 0, 0)}),
+            ErrorCode::SUCCESS);
+}
+
+TEST_F(LeSetExtendedAdvertisingEnableTest, EnableUsingPublicAddress) {
+  ASSERT_EQ(
+      controller_.LeSetExtendedAdvertisingParameters(
+          0, MakeAdvertisingEventProperties(LEGACY | CONNECTABLE | SCANNABLE),
+          0x0800, 0x0800, 0x7, OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+          PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS, Address::kEmpty,
+          AdvertisingFilterPolicy::ALL_DEVICES, 0x70, PrimaryPhyType::LE_1M, 0,
+          SecondaryPhyType::LE_2M, 0x0, false),
+      ErrorCode::SUCCESS);
+
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingEnable(
+                true, {MakeEnabledSet(0, 0, 0)}),
+            ErrorCode::SUCCESS);
+}
+
+TEST_F(LeSetExtendedAdvertisingEnableTest, EnableUsingTimeout) {
+  ASSERT_EQ(
+      controller_.LeSetExtendedAdvertisingParameters(
+          0, MakeAdvertisingEventProperties(LEGACY | CONNECTABLE | SCANNABLE),
+          0x0800, 0x0800, 0x7, OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+          PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS, Address::kEmpty,
+          AdvertisingFilterPolicy::ALL_DEVICES, 0x70, PrimaryPhyType::LE_1M, 0,
+          SecondaryPhyType::LE_2M, 0x0, false),
+      ErrorCode::SUCCESS);
+
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingEnable(
+                true, {MakeEnabledSet(0, 0x40, 0)}),
+            ErrorCode::SUCCESS);
+}
+
+TEST_F(LeSetExtendedAdvertisingEnableTest, EnableUsingRandomAddress) {
+  ASSERT_EQ(
+      controller_.LeSetExtendedAdvertisingParameters(
+          0, MakeAdvertisingEventProperties(LEGACY | CONNECTABLE | SCANNABLE),
+          0x0800, 0x0800, 0x7, OwnAddressType::RANDOM_DEVICE_ADDRESS,
+          PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS, Address::kEmpty,
+          AdvertisingFilterPolicy::ALL_DEVICES, 0x70, PrimaryPhyType::LE_1M, 0,
+          SecondaryPhyType::LE_2M, 0x0, false),
+      ErrorCode::SUCCESS);
+
+  ASSERT_EQ(controller_.LeSetAdvertisingSetRandomAddress(0, Address{1}),
+            ErrorCode::SUCCESS);
+
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingEnable(
+                true, {MakeEnabledSet(0, 0x40, 0)}),
+            ErrorCode::SUCCESS);
+}
+
+TEST_F(LeSetExtendedAdvertisingEnableTest, EnableUsingResolvableAddress) {
+  ASSERT_EQ(
+      controller_.LeSetExtendedAdvertisingParameters(
+          0, MakeAdvertisingEventProperties(LEGACY | CONNECTABLE | SCANNABLE),
+          0x0800, 0x0800, 0x7, OwnAddressType::RESOLVABLE_OR_RANDOM_ADDRESS,
+          PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS, Address{1},
+          AdvertisingFilterPolicy::ALL_DEVICES, 0x70, PrimaryPhyType::LE_1M, 0,
+          SecondaryPhyType::LE_2M, 0x0, false),
+      ErrorCode::SUCCESS);
+  ASSERT_EQ(controller_.LeAddDeviceToResolvingList(
+                PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS, Address{1},
+                std::array<uint8_t, 16>{1}, std::array<uint8_t, 16>{1}),
+            ErrorCode::SUCCESS);
+  ASSERT_EQ(controller_.LeSetAddressResolutionEnable(true), ErrorCode::SUCCESS);
+  // Note: the command will fail if the peer address is not in the resolvable
+  // address list and the random address is not set.
+  // Success here signifies that the RPA was successfully generated.
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingEnable(
+                true, {MakeEnabledSet(0, 0x40, 0)}),
+            ErrorCode::SUCCESS);
+}
+
+TEST_F(LeSetExtendedAdvertisingEnableTest, DuplicateAdvertisingHandle) {
+  ASSERT_EQ(
+      controller_.LeSetExtendedAdvertisingParameters(
+          0, MakeAdvertisingEventProperties(LEGACY | CONNECTABLE | SCANNABLE),
+          0x0800, 0x0800, 0x7, OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+          PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS, Address::kEmpty,
+          AdvertisingFilterPolicy::ALL_DEVICES, 0x70, PrimaryPhyType::LE_1M, 0,
+          SecondaryPhyType::LE_2M, 0x0, false),
+      ErrorCode::SUCCESS);
+
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingEnable(
+                true, {MakeEnabledSet(0, 0, 0), MakeEnabledSet(0, 0, 0)}),
+            ErrorCode::INVALID_HCI_COMMAND_PARAMETERS);
+}
+
+TEST_F(LeSetExtendedAdvertisingEnableTest, UnknownAdvertisingHandle) {
+  ASSERT_EQ(
+      controller_.LeSetExtendedAdvertisingParameters(
+          0, MakeAdvertisingEventProperties(LEGACY | CONNECTABLE | SCANNABLE),
+          0x0800, 0x0800, 0x7, OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+          PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS, Address::kEmpty,
+          AdvertisingFilterPolicy::ALL_DEVICES, 0x70, PrimaryPhyType::LE_1M, 0,
+          SecondaryPhyType::LE_2M, 0x0, false),
+      ErrorCode::SUCCESS);
+
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingEnable(
+                true, {MakeEnabledSet(0, 0, 0), MakeEnabledSet(1, 0, 0)}),
+            ErrorCode::UNKNOWN_ADVERTISING_IDENTIFIER);
+}
+
+TEST_F(LeSetExtendedAdvertisingEnableTest, MissingAdvertisingHandle) {
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingEnable(true, {}),
+            ErrorCode::INVALID_HCI_COMMAND_PARAMETERS);
+}
+
+TEST_F(LeSetExtendedAdvertisingEnableTest, InvalidDuration) {
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingParameters(
+                0,
+                MakeAdvertisingEventProperties(LEGACY | DIRECTED | CONNECTABLE |
+                                               HIGH_DUTY_CYCLE),
+                0x0800, 0x0800, 0x7, OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+                PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS,
+                Address::kEmpty, AdvertisingFilterPolicy::ALL_DEVICES, 0x70,
+                PrimaryPhyType::LE_1M, 0, SecondaryPhyType::LE_2M, 0x0, false),
+            ErrorCode::SUCCESS);
+
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingEnable(
+                true, {MakeEnabledSet(0, 0, 0)}),
+            ErrorCode::INVALID_HCI_COMMAND_PARAMETERS);
+
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingEnable(
+                true, {MakeEnabledSet(0, 0x801, 0)}),
+            ErrorCode::INVALID_HCI_COMMAND_PARAMETERS);
+}
+
+TEST_F(LeSetExtendedAdvertisingEnableTest, PartialAdvertisingData) {
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingParameters(
+                0, MakeAdvertisingEventProperties(CONNECTABLE), 0x0800, 0x0800,
+                0x7, OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+                PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS,
+                Address::kEmpty, AdvertisingFilterPolicy::ALL_DEVICES, 0x70,
+                PrimaryPhyType::LE_1M, 0, SecondaryPhyType::LE_2M, 0x0, false),
+            ErrorCode::SUCCESS);
+
+  std::vector<uint8_t> first_advertising_data_fragment = {1, 2, 3};
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingData(
+                0, Operation::FIRST_FRAGMENT,
+                FragmentPreference::CONTROLLER_MAY_FRAGMENT,
+                first_advertising_data_fragment),
+            ErrorCode::SUCCESS);
+
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingEnable(
+                true, {MakeEnabledSet(0, 0, 0)}),
+            ErrorCode::COMMAND_DISALLOWED);
+}
+
+TEST_F(LeSetExtendedAdvertisingEnableTest, PartialScanResponseData) {
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingParameters(
+                0, MakeAdvertisingEventProperties(SCANNABLE), 0x0800, 0x0800,
+                0x7, OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+                PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS,
+                Address::kEmpty, AdvertisingFilterPolicy::ALL_DEVICES, 0x70,
+                PrimaryPhyType::LE_1M, 0, SecondaryPhyType::LE_2M, 0x0, false),
+            ErrorCode::SUCCESS);
+
+  std::vector<uint8_t> first_scan_response_data_fragment = {1, 2, 3};
+  ASSERT_EQ(controller_.LeSetExtendedScanResponseData(
+                0, Operation::FIRST_FRAGMENT,
+                FragmentPreference::CONTROLLER_MAY_FRAGMENT,
+                first_scan_response_data_fragment),
+            ErrorCode::SUCCESS);
+
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingEnable(
+                true, {MakeEnabledSet(0, 0, 0)}),
+            ErrorCode::COMMAND_DISALLOWED);
+}
+
+TEST_F(LeSetExtendedAdvertisingEnableTest, EmptyScanResponseData) {
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingParameters(
+                0, MakeAdvertisingEventProperties(SCANNABLE), 0x0800, 0x0800,
+                0x7, OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+                PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS,
+                Address::kEmpty, AdvertisingFilterPolicy::ALL_DEVICES, 0x70,
+                PrimaryPhyType::LE_1M, 0, SecondaryPhyType::LE_2M, 0x0, false),
+            ErrorCode::SUCCESS);
+
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingEnable(
+                true, {MakeEnabledSet(0, 0, 0)}),
+            ErrorCode::COMMAND_DISALLOWED);
+}
+
+TEST_F(LeSetExtendedAdvertisingEnableTest,
+       AdvertisingDataLargerThanPduCapacity) {
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingParameters(
+                0, MakeAdvertisingEventProperties(CONNECTABLE), 0x0800, 0x0800,
+                0x7, OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+                PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS,
+                Address::kEmpty, AdvertisingFilterPolicy::ALL_DEVICES, 0x70,
+                PrimaryPhyType::LE_1M, 0, SecondaryPhyType::LE_2M, 0x0, false),
+            ErrorCode::SUCCESS);
+
+  std::vector<uint8_t> advertising_data = {1, 2, 3};
+  advertising_data.resize(254);
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingData(
+                0, Operation::COMPLETE_ADVERTISEMENT,
+                FragmentPreference::CONTROLLER_MAY_FRAGMENT, advertising_data),
+            ErrorCode::SUCCESS);
+
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingEnable(
+                true, {MakeEnabledSet(0, 0, 0)}),
+            ErrorCode::INVALID_HCI_COMMAND_PARAMETERS);
+}
+
+TEST_F(LeSetExtendedAdvertisingEnableTest,
+       AdvertisingDataLargerThanMaxPduCapacity) {
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingParameters(
+                0, MakeAdvertisingEventProperties(0), 0x0800, 0x0800, 0x7,
+                OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+                PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS,
+                Address::kEmpty, AdvertisingFilterPolicy::ALL_DEVICES, 0x70,
+                PrimaryPhyType::LE_1M, 0, SecondaryPhyType::LE_2M, 0x0, false),
+            ErrorCode::SUCCESS);
+
+  std::vector<uint8_t> advertising_data = {1, 2, 3};
+  advertising_data.resize(1651);
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingData(
+                0, Operation::COMPLETE_ADVERTISEMENT,
+                FragmentPreference::CONTROLLER_MAY_FRAGMENT, advertising_data),
+            ErrorCode::SUCCESS);
+
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingEnable(
+                true, {MakeEnabledSet(0, 0, 0)}),
+            ErrorCode::PACKET_TOO_LONG);
+}
+
+TEST_F(LeSetExtendedAdvertisingEnableTest, NoRandomAddress) {
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingParameters(
+                0, MakeAdvertisingEventProperties(CONNECTABLE), 0x0800, 0x0800,
+                0x7, OwnAddressType::RANDOM_DEVICE_ADDRESS,
+                PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS,
+                Address::kEmpty, AdvertisingFilterPolicy::ALL_DEVICES, 0x70,
+                PrimaryPhyType::LE_1M, 0, SecondaryPhyType::LE_2M, 0x0, false),
+            ErrorCode::SUCCESS);
+
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingEnable(
+                true, {MakeEnabledSet(0, 0, 0)}),
+            ErrorCode::INVALID_HCI_COMMAND_PARAMETERS);
+}
+
+TEST_F(LeSetExtendedAdvertisingEnableTest, NoResolvableOrRandomAddress) {
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingParameters(
+                0, MakeAdvertisingEventProperties(CONNECTABLE), 0x0800, 0x0800,
+                0x7, OwnAddressType::RESOLVABLE_OR_RANDOM_ADDRESS,
+                PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS,
+                Address::kEmpty, AdvertisingFilterPolicy::ALL_DEVICES, 0x70,
+                PrimaryPhyType::LE_1M, 0, SecondaryPhyType::LE_2M, 0x0, false),
+            ErrorCode::SUCCESS);
+
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingEnable(
+                true, {MakeEnabledSet(0, 0, 0)}),
+            ErrorCode::INVALID_HCI_COMMAND_PARAMETERS);
+}
+
+}  // namespace rootcanal
diff --git a/tools/rootcanal/test/controller/le/le_set_extended_advertising_parameters_test.cc b/tools/rootcanal/test/controller/le/le_set_extended_advertising_parameters_test.cc
new file mode 100644
index 0000000..f6a73b6
--- /dev/null
+++ b/tools/rootcanal/test/controller/le/le_set_extended_advertising_parameters_test.cc
@@ -0,0 +1,297 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <gtest/gtest.h>
+
+#include "model/controller/link_layer_controller.h"
+#include "test_helpers.h"
+
+namespace rootcanal {
+
+using namespace bluetooth::hci;
+
+class LeSetExtendedAdvertisingParametersTest : public ::testing::Test {
+ public:
+  LeSetExtendedAdvertisingParametersTest() {
+    // Reduce the number of advertising sets to simplify testing.
+    properties_.le_num_supported_advertising_sets = 2;
+  };
+  ~LeSetExtendedAdvertisingParametersTest() override = default;
+
+ protected:
+  Address address_{0};
+  ControllerProperties properties_{};
+  LinkLayerController controller_{address_, properties_};
+};
+
+TEST_F(LeSetExtendedAdvertisingParametersTest, Success) {
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingParameters(
+                0, MakeAdvertisingEventProperties(CONNECTABLE), 0x0800, 0x0800,
+                0x7, OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+                PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS,
+                Address::kEmpty, AdvertisingFilterPolicy::ALL_DEVICES, 0x70,
+                PrimaryPhyType::LE_1M, 0, SecondaryPhyType::LE_2M, 0x0, false),
+            ErrorCode::SUCCESS);
+}
+
+TEST_F(LeSetExtendedAdvertisingParametersTest, LegacyUsed) {
+  ASSERT_EQ(
+      controller_.LeSetScanParameters(LeScanType::PASSIVE, 0x2000, 0x200,
+                                      OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+                                      LeScanningFilterPolicy::ACCEPT_ALL),
+      ErrorCode::SUCCESS);
+
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingParameters(
+                0, MakeAdvertisingEventProperties(CONNECTABLE), 0x0800, 0x0800,
+                0x7, OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+                PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS,
+                Address::kEmpty, AdvertisingFilterPolicy::ALL_DEVICES, 0x70,
+                PrimaryPhyType::LE_1M, 0, SecondaryPhyType::LE_2M, 0x0, false),
+            ErrorCode::COMMAND_DISALLOWED);
+}
+
+TEST_F(LeSetExtendedAdvertisingParametersTest, AdvertisingSetsFull) {
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingParameters(
+                0, MakeAdvertisingEventProperties(CONNECTABLE), 0x0800, 0x0800,
+                0x7, OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+                PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS,
+                Address::kEmpty, AdvertisingFilterPolicy::ALL_DEVICES, 0x70,
+                PrimaryPhyType::LE_1M, 0, SecondaryPhyType::LE_2M, 0x0, false),
+            ErrorCode::SUCCESS);
+
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingParameters(
+                1, MakeAdvertisingEventProperties(CONNECTABLE), 0x0800, 0x0800,
+                0x7, OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+                PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS,
+                Address::kEmpty, AdvertisingFilterPolicy::ALL_DEVICES, 0x70,
+                PrimaryPhyType::LE_1M, 0, SecondaryPhyType::LE_2M, 0x0, false),
+            ErrorCode::SUCCESS);
+
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingParameters(
+                2, MakeAdvertisingEventProperties(CONNECTABLE), 0x0800, 0x0800,
+                0x7, OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+                PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS,
+                Address::kEmpty, AdvertisingFilterPolicy::ALL_DEVICES, 0x70,
+                PrimaryPhyType::LE_1M, 0, SecondaryPhyType::LE_2M, 0x0, false),
+            ErrorCode::MEMORY_CAPACITY_EXCEEDED);
+}
+
+TEST_F(LeSetExtendedAdvertisingParametersTest,
+       InvalidLegacyAdvertisingEventProperties) {
+  ASSERT_EQ(
+      controller_.LeSetExtendedAdvertisingParameters(
+          0, MakeAdvertisingEventProperties(LEGACY | DIRECTED | SCANNABLE),
+          0x0800, 0x0800, 0x7, OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+          PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS, Address::kEmpty,
+          AdvertisingFilterPolicy::ALL_DEVICES, 0x70, PrimaryPhyType::LE_1M, 0,
+          SecondaryPhyType::LE_2M, 0x0, false),
+      ErrorCode::INVALID_HCI_COMMAND_PARAMETERS);
+}
+
+TEST_F(LeSetExtendedAdvertisingParametersTest, UnexpectedAdvertisingData) {
+  ASSERT_EQ(
+      controller_.LeSetExtendedAdvertisingParameters(
+          0, MakeAdvertisingEventProperties(LEGACY | CONNECTABLE | SCANNABLE),
+          0x0800, 0x0800, 0x7, OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+          PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS, Address::kEmpty,
+          AdvertisingFilterPolicy::ALL_DEVICES, 0x70, PrimaryPhyType::LE_1M, 0,
+          SecondaryPhyType::LE_2M, 0x0, false),
+      ErrorCode::SUCCESS);
+
+  std::vector<uint8_t> advertising_data = {1, 2, 3};
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingData(
+                0, Operation::COMPLETE_ADVERTISEMENT,
+                FragmentPreference::CONTROLLER_MAY_FRAGMENT, advertising_data),
+            ErrorCode::SUCCESS);
+
+  ASSERT_EQ(
+      controller_.LeSetExtendedAdvertisingParameters(
+          0, MakeAdvertisingEventProperties(LEGACY | DIRECTED | CONNECTABLE),
+          0x0800, 0x0800, 0x7, OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+          PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS, Address::kEmpty,
+          AdvertisingFilterPolicy::ALL_DEVICES, 0x70, PrimaryPhyType::LE_1M, 0,
+          SecondaryPhyType::LE_2M, 0x0, false),
+      ErrorCode::INVALID_HCI_COMMAND_PARAMETERS);
+}
+
+TEST_F(LeSetExtendedAdvertisingParametersTest, UnexpectedScanResponseData) {
+  ASSERT_EQ(
+      controller_.LeSetExtendedAdvertisingParameters(
+          0, MakeAdvertisingEventProperties(LEGACY | CONNECTABLE | SCANNABLE),
+          0x0800, 0x0800, 0x7, OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+          PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS, Address::kEmpty,
+          AdvertisingFilterPolicy::ALL_DEVICES, 0x70, PrimaryPhyType::LE_1M, 0,
+          SecondaryPhyType::LE_2M, 0x0, false),
+      ErrorCode::SUCCESS);
+
+  std::vector<uint8_t> scan_response_data = {1, 2, 3};
+  ASSERT_EQ(
+      controller_.LeSetExtendedScanResponseData(
+          0, Operation::COMPLETE_ADVERTISEMENT,
+          FragmentPreference::CONTROLLER_MAY_FRAGMENT, scan_response_data),
+      ErrorCode::SUCCESS);
+
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingParameters(
+                0, MakeAdvertisingEventProperties(LEGACY | CONNECTABLE), 0x0800,
+                0x0800, 0x7, OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+                PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS,
+                Address::kEmpty, AdvertisingFilterPolicy::ALL_DEVICES, 0x70,
+                PrimaryPhyType::LE_1M, 0, SecondaryPhyType::LE_2M, 0x0, false),
+            ErrorCode::INVALID_HCI_COMMAND_PARAMETERS);
+}
+
+TEST_F(LeSetExtendedAdvertisingParametersTest, InvalidLegacyAdvertisingData) {
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingParameters(
+                0, MakeAdvertisingEventProperties(CONNECTABLE), 0x0800, 0x0800,
+                0x7, OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+                PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS,
+                Address::kEmpty, AdvertisingFilterPolicy::ALL_DEVICES, 0x70,
+                PrimaryPhyType::LE_1M, 0, SecondaryPhyType::LE_2M, 0x0, false),
+            ErrorCode::SUCCESS);
+
+  std::vector<uint8_t> advertising_data = {1, 2, 3};
+  advertising_data.resize(32);
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingData(
+                0, Operation::COMPLETE_ADVERTISEMENT,
+                FragmentPreference::CONTROLLER_MAY_FRAGMENT, advertising_data),
+            ErrorCode::SUCCESS);
+
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingParameters(
+                0, MakeAdvertisingEventProperties(LEGACY | CONNECTABLE), 0x0800,
+                0x0800, 0x7, OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+                PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS,
+                Address::kEmpty, AdvertisingFilterPolicy::ALL_DEVICES, 0x70,
+                PrimaryPhyType::LE_1M, 0, SecondaryPhyType::LE_2M, 0x0, false),
+            ErrorCode::INVALID_HCI_COMMAND_PARAMETERS);
+}
+
+TEST_F(LeSetExtendedAdvertisingParametersTest, InvalidLegacyScanResponseData) {
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingParameters(
+                0, MakeAdvertisingEventProperties(SCANNABLE), 0x0800, 0x0800,
+                0x7, OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+                PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS,
+                Address::kEmpty, AdvertisingFilterPolicy::ALL_DEVICES, 0x70,
+                PrimaryPhyType::LE_1M, 0, SecondaryPhyType::LE_2M, 0x0, false),
+            ErrorCode::SUCCESS);
+
+  std::vector<uint8_t> scan_response_data = {1, 2, 3};
+  scan_response_data.resize(32);
+  ASSERT_EQ(
+      controller_.LeSetExtendedScanResponseData(
+          0, Operation::COMPLETE_ADVERTISEMENT,
+          FragmentPreference::CONTROLLER_MAY_FRAGMENT, scan_response_data),
+      ErrorCode::SUCCESS);
+
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingParameters(
+                0, MakeAdvertisingEventProperties(LEGACY | SCANNABLE), 0x0800,
+                0x0800, 0x7, OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+                PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS,
+                Address::kEmpty, AdvertisingFilterPolicy::ALL_DEVICES, 0x70,
+                PrimaryPhyType::LE_1M, 0, SecondaryPhyType::LE_2M, 0x0, false),
+            ErrorCode::INVALID_HCI_COMMAND_PARAMETERS);
+}
+
+TEST_F(LeSetExtendedAdvertisingParametersTest,
+       InvalidExtendedAdvertisingEventProperties) {
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingParameters(
+                0, MakeAdvertisingEventProperties(CONNECTABLE | SCANNABLE),
+                0x0800, 0x0800, 0x7, OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+                PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS,
+                Address::kEmpty, AdvertisingFilterPolicy::ALL_DEVICES, 0x70,
+                PrimaryPhyType::LE_1M, 0, SecondaryPhyType::LE_2M, 0x0, false),
+            ErrorCode::INVALID_HCI_COMMAND_PARAMETERS);
+
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingParameters(
+                0,
+                MakeAdvertisingEventProperties(CONNECTABLE | DIRECTED |
+                                               HIGH_DUTY_CYCLE),
+                0x0800, 0x0800, 0x7, OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+                PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS,
+                Address::kEmpty, AdvertisingFilterPolicy::ALL_DEVICES, 0x70,
+                PrimaryPhyType::LE_1M, 0, SecondaryPhyType::LE_2M, 0x0, false),
+            ErrorCode::INVALID_HCI_COMMAND_PARAMETERS);
+}
+
+TEST_F(LeSetExtendedAdvertisingParametersTest,
+       InvalidPrimaryAdvertisingInterval) {
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingParameters(
+                0, MakeAdvertisingEventProperties(CONNECTABLE), 0x10, 0x0800,
+                0x7, OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+                PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS,
+                Address::kEmpty, AdvertisingFilterPolicy::ALL_DEVICES, 0x70,
+                PrimaryPhyType::LE_1M, 0, SecondaryPhyType::LE_2M, 0x0, false),
+            ErrorCode::UNSUPPORTED_FEATURE_OR_PARAMETER_VALUE);
+
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingParameters(
+                0, MakeAdvertisingEventProperties(CONNECTABLE), 0x0800, 0x10,
+                0x7, OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+                PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS,
+                Address::kEmpty, AdvertisingFilterPolicy::ALL_DEVICES, 0x70,
+                PrimaryPhyType::LE_1M, 0, SecondaryPhyType::LE_2M, 0x0, false),
+            ErrorCode::UNSUPPORTED_FEATURE_OR_PARAMETER_VALUE);
+
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingParameters(
+                0, MakeAdvertisingEventProperties(CONNECTABLE), 0x0800, 0x0400,
+                0x7, OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+                PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS,
+                Address::kEmpty, AdvertisingFilterPolicy::ALL_DEVICES, 0x70,
+                PrimaryPhyType::LE_1M, 0, SecondaryPhyType::LE_2M, 0x0, false),
+            ErrorCode::INVALID_HCI_COMMAND_PARAMETERS);
+}
+
+TEST_F(LeSetExtendedAdvertisingParametersTest, InvalidChannelMap) {
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingParameters(
+                0, MakeAdvertisingEventProperties(CONNECTABLE), 0x0800, 0x0800,
+                0x0, OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+                PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS,
+                Address::kEmpty, AdvertisingFilterPolicy::ALL_DEVICES, 0x70,
+                PrimaryPhyType::LE_1M, 0, SecondaryPhyType::LE_2M, 0x0, false),
+            ErrorCode::INVALID_HCI_COMMAND_PARAMETERS);
+}
+
+TEST_F(LeSetExtendedAdvertisingParametersTest, InvalidPrimaryPhy) {
+  ASSERT_EQ(
+      controller_.LeSetExtendedAdvertisingParameters(
+          0, MakeAdvertisingEventProperties(LEGACY | CONNECTABLE), 0x0800,
+          0x0800, 0x7, OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+          PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS, Address::kEmpty,
+          AdvertisingFilterPolicy::ALL_DEVICES, 0x70, PrimaryPhyType::LE_CODED,
+          0, SecondaryPhyType::LE_2M, 0x0, false),
+      ErrorCode::INVALID_HCI_COMMAND_PARAMETERS);
+}
+
+TEST_F(LeSetExtendedAdvertisingParametersTest, AdvertisingActive) {
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingParameters(
+                0, MakeAdvertisingEventProperties(CONNECTABLE), 0x0800, 0x0800,
+                0x7, OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+                PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS,
+                Address::kEmpty, AdvertisingFilterPolicy::ALL_DEVICES, 0x70,
+                PrimaryPhyType::LE_1M, 0, SecondaryPhyType::LE_2M, 0x0, false),
+            ErrorCode::SUCCESS);
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingEnable(
+                true, {MakeEnabledSet(0, 0, 0)}),
+            ErrorCode::SUCCESS);
+
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingParameters(
+                0, MakeAdvertisingEventProperties(0), 0x0800, 0x0800, 0x7,
+                OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+                PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS,
+                Address::kEmpty, AdvertisingFilterPolicy::ALL_DEVICES, 0x70,
+                PrimaryPhyType::LE_1M, 0, SecondaryPhyType::LE_2M, 0x0, false),
+            ErrorCode::COMMAND_DISALLOWED);
+}
+
+}  // namespace rootcanal
diff --git a/tools/rootcanal/test/controller/le/le_set_extended_scan_enable_test.cc b/tools/rootcanal/test/controller/le/le_set_extended_scan_enable_test.cc
new file mode 100644
index 0000000..79b9663
--- /dev/null
+++ b/tools/rootcanal/test/controller/le/le_set_extended_scan_enable_test.cc
@@ -0,0 +1,145 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <gtest/gtest.h>
+
+#include "model/controller/link_layer_controller.h"
+
+namespace rootcanal {
+
+using namespace bluetooth::hci;
+
+class LeSetExtendedScanEnableTest : public ::testing::Test {
+ public:
+  LeSetExtendedScanEnableTest() = default;
+  ~LeSetExtendedScanEnableTest() override = default;
+
+ protected:
+  Address address_{0};
+  ControllerProperties properties_{};
+  LinkLayerController controller_{address_, properties_};
+};
+
+static PhyScanParameters MakePhyScanParameters(LeScanType scan_type,
+                                               uint16_t scan_interval,
+                                               uint16_t scan_window) {
+  PhyScanParameters parameters;
+  parameters.le_scan_type_ = scan_type;
+  parameters.le_scan_interval_ = scan_interval;
+  parameters.le_scan_window_ = scan_window;
+  return parameters;
+}
+
+TEST_F(LeSetExtendedScanEnableTest, EnableUsingPublicAddress) {
+  ASSERT_EQ(controller_.LeSetExtendedScanParameters(
+                OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+                LeScanningFilterPolicy::ACCEPT_ALL, 0x1,
+                {MakePhyScanParameters(LeScanType::PASSIVE, 0x2000, 0x200)}),
+            ErrorCode::SUCCESS);
+  ASSERT_EQ(controller_.LeSetExtendedScanEnable(
+                true, FilterDuplicates::DISABLED, 0, 0),
+            ErrorCode::SUCCESS);
+}
+
+TEST_F(LeSetExtendedScanEnableTest, EnableUsingRandomAddress) {
+  ASSERT_EQ(controller_.LeSetExtendedScanParameters(
+                OwnAddressType::RANDOM_DEVICE_ADDRESS,
+                LeScanningFilterPolicy::ACCEPT_ALL, 0x1,
+                {MakePhyScanParameters(LeScanType::PASSIVE, 0x2000, 0x200)}),
+            ErrorCode::SUCCESS);
+  ASSERT_EQ(controller_.LeSetRandomAddress(Address{1}), ErrorCode::SUCCESS);
+  ASSERT_EQ(controller_.LeSetExtendedScanEnable(
+                true, FilterDuplicates::DISABLED, 0, 0),
+            ErrorCode::SUCCESS);
+}
+
+TEST_F(LeSetExtendedScanEnableTest, EnableUsingResolvableAddress) {
+  ASSERT_EQ(controller_.LeSetExtendedScanParameters(
+                OwnAddressType::RESOLVABLE_OR_RANDOM_ADDRESS,
+                LeScanningFilterPolicy::ACCEPT_ALL, 0x1,
+                {MakePhyScanParameters(LeScanType::PASSIVE, 0x2000, 0x200)}),
+            ErrorCode::SUCCESS);
+  ASSERT_EQ(controller_.LeSetRandomAddress(Address{1}), ErrorCode::SUCCESS);
+  ASSERT_EQ(controller_.LeSetExtendedScanEnable(
+                true, FilterDuplicates::DISABLED, 0, 0),
+            ErrorCode::SUCCESS);
+}
+
+TEST_F(LeSetExtendedScanEnableTest, ResetEachPeriod) {
+  ASSERT_EQ(controller_.LeSetExtendedScanParameters(
+                OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+                LeScanningFilterPolicy::ACCEPT_ALL, 0x1,
+                {MakePhyScanParameters(LeScanType::PASSIVE, 0x2000, 0x200)}),
+            ErrorCode::SUCCESS);
+  ASSERT_EQ(controller_.LeSetExtendedScanEnable(
+                true, FilterDuplicates::RESET_EACH_PERIOD, 100, 1000),
+            ErrorCode::SUCCESS);
+}
+
+TEST_F(LeSetExtendedScanEnableTest, Disable) {
+  ASSERT_EQ(controller_.LeSetExtendedScanEnable(
+                false, FilterDuplicates::DISABLED, 0, 0),
+            ErrorCode::SUCCESS);
+}
+
+TEST_F(LeSetExtendedScanEnableTest, ValidDuration) {
+  ASSERT_EQ(controller_.LeSetExtendedScanParameters(
+                OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+                LeScanningFilterPolicy::ACCEPT_ALL, 0x1,
+                {MakePhyScanParameters(LeScanType::PASSIVE, 0x2000, 0x200)}),
+            ErrorCode::SUCCESS);
+
+  ASSERT_EQ(controller_.LeSetExtendedScanEnable(
+                true, FilterDuplicates::DISABLED, 127, 1),
+            ErrorCode::SUCCESS);
+}
+
+TEST_F(LeSetExtendedScanEnableTest, InvalidDuration) {
+  ASSERT_EQ(controller_.LeSetExtendedScanParameters(
+                OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+                LeScanningFilterPolicy::ACCEPT_ALL, 0x1,
+                {MakePhyScanParameters(LeScanType::PASSIVE, 0x2000, 0x200)}),
+            ErrorCode::SUCCESS);
+
+  ASSERT_EQ(controller_.LeSetExtendedScanEnable(
+                true, FilterDuplicates::RESET_EACH_PERIOD, 0, 0),
+            ErrorCode::INVALID_HCI_COMMAND_PARAMETERS);
+  ASSERT_EQ(controller_.LeSetExtendedScanEnable(
+                true, FilterDuplicates::DISABLED, 128, 1),
+            ErrorCode::INVALID_HCI_COMMAND_PARAMETERS);
+}
+
+TEST_F(LeSetExtendedScanEnableTest, NoRandomAddress) {
+  ASSERT_EQ(controller_.LeSetExtendedScanParameters(
+                OwnAddressType::RANDOM_DEVICE_ADDRESS,
+                LeScanningFilterPolicy::ACCEPT_ALL, 0x1,
+                {MakePhyScanParameters(LeScanType::PASSIVE, 0x2000, 0x200)}),
+            ErrorCode::SUCCESS);
+  ASSERT_EQ(controller_.LeSetExtendedScanEnable(
+                true, FilterDuplicates::DISABLED, 0, 0),
+            ErrorCode::INVALID_HCI_COMMAND_PARAMETERS);
+
+  ASSERT_EQ(controller_.LeSetExtendedScanParameters(
+                OwnAddressType::RESOLVABLE_OR_RANDOM_ADDRESS,
+                LeScanningFilterPolicy::ACCEPT_ALL, 0x1,
+                {MakePhyScanParameters(LeScanType::PASSIVE, 0x2000, 0x200)}),
+            ErrorCode::SUCCESS);
+  ASSERT_EQ(controller_.LeSetExtendedScanEnable(
+                true, FilterDuplicates::DISABLED, 0, 0),
+            ErrorCode::INVALID_HCI_COMMAND_PARAMETERS);
+}
+
+}  // namespace rootcanal
diff --git a/tools/rootcanal/test/controller/le/le_set_extended_scan_parameters_test.cc b/tools/rootcanal/test/controller/le/le_set_extended_scan_parameters_test.cc
new file mode 100644
index 0000000..0c153ea
--- /dev/null
+++ b/tools/rootcanal/test/controller/le/le_set_extended_scan_parameters_test.cc
@@ -0,0 +1,118 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <gtest/gtest.h>
+
+#include "model/controller/link_layer_controller.h"
+
+namespace rootcanal {
+
+using namespace bluetooth::hci;
+
+class LeSetExtendedScanParametersTest : public ::testing::Test {
+ public:
+  LeSetExtendedScanParametersTest() = default;
+  ~LeSetExtendedScanParametersTest() override = default;
+
+ protected:
+  Address address_{0};
+  ControllerProperties properties_{};
+  LinkLayerController controller_{address_, properties_};
+};
+
+static PhyScanParameters MakePhyScanParameters(LeScanType scan_type,
+                                               uint16_t scan_interval,
+                                               uint16_t scan_window) {
+  PhyScanParameters parameters;
+  parameters.le_scan_type_ = scan_type;
+  parameters.le_scan_interval_ = scan_interval;
+  parameters.le_scan_window_ = scan_window;
+  return parameters;
+}
+
+TEST_F(LeSetExtendedScanParametersTest, Success) {
+  ASSERT_EQ(controller_.LeSetExtendedScanParameters(
+                OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+                LeScanningFilterPolicy::ACCEPT_ALL, 0x5,
+                {MakePhyScanParameters(LeScanType::PASSIVE, 0x2000, 0x200),
+                 MakePhyScanParameters(LeScanType::ACTIVE, 0x2000, 0x200)}),
+            ErrorCode::SUCCESS);
+}
+
+TEST_F(LeSetExtendedScanParametersTest, ScanningActive) {
+  ASSERT_EQ(controller_.LeSetExtendedScanParameters(
+                OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+                LeScanningFilterPolicy::ACCEPT_ALL, 0x5,
+                {MakePhyScanParameters(LeScanType::PASSIVE, 0x2000, 0x200),
+                 MakePhyScanParameters(LeScanType::ACTIVE, 0x2000, 0x200)}),
+            ErrorCode::SUCCESS);
+  ASSERT_EQ(controller_.LeSetExtendedScanEnable(
+                true, FilterDuplicates::DISABLED, 0, 0),
+            ErrorCode::SUCCESS);
+
+  ASSERT_EQ(controller_.LeSetExtendedScanParameters(
+                OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+                LeScanningFilterPolicy::ACCEPT_ALL, 0x5,
+                {MakePhyScanParameters(LeScanType::PASSIVE, 0x2000, 0x200),
+                 MakePhyScanParameters(LeScanType::ACTIVE, 0x2000, 0x200)}),
+            ErrorCode::COMMAND_DISALLOWED);
+}
+
+TEST_F(LeSetExtendedScanParametersTest, ReservedPhy) {
+  ASSERT_EQ(controller_.LeSetExtendedScanParameters(
+                OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+                LeScanningFilterPolicy::ACCEPT_ALL, 0x80,
+                {MakePhyScanParameters(LeScanType::PASSIVE, 0x2000, 0x200)}),
+            ErrorCode::UNSUPPORTED_FEATURE_OR_PARAMETER_VALUE);
+}
+
+TEST_F(LeSetExtendedScanParametersTest, InvalidPhyParameters) {
+  ASSERT_EQ(controller_.LeSetExtendedScanParameters(
+                OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+                LeScanningFilterPolicy::ACCEPT_ALL, 0x1, {}),
+            ErrorCode::INVALID_HCI_COMMAND_PARAMETERS);
+
+  ASSERT_EQ(controller_.LeSetExtendedScanParameters(
+                OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+                LeScanningFilterPolicy::ACCEPT_ALL, 0x1,
+                {MakePhyScanParameters(LeScanType::PASSIVE, 0x2000, 0x200),
+                 MakePhyScanParameters(LeScanType::PASSIVE, 0x2000, 0x200)}),
+            ErrorCode::INVALID_HCI_COMMAND_PARAMETERS);
+}
+
+TEST_F(LeSetExtendedScanParametersTest, InvalidScanInterval) {
+  ASSERT_EQ(controller_.LeSetExtendedScanParameters(
+                OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+                LeScanningFilterPolicy::ACCEPT_ALL, 0x1,
+                {MakePhyScanParameters(LeScanType::PASSIVE, 0x0, 0x200)}),
+            ErrorCode::INVALID_HCI_COMMAND_PARAMETERS);
+}
+
+TEST_F(LeSetExtendedScanParametersTest, InvalidScanWindow) {
+  ASSERT_EQ(controller_.LeSetExtendedScanParameters(
+                OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+                LeScanningFilterPolicy::ACCEPT_ALL, 0x1,
+                {MakePhyScanParameters(LeScanType::PASSIVE, 0x2000, 0x0)}),
+            ErrorCode::INVALID_HCI_COMMAND_PARAMETERS);
+
+  ASSERT_EQ(controller_.LeSetExtendedScanParameters(
+                OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+                LeScanningFilterPolicy::ACCEPT_ALL, 0x1,
+                {MakePhyScanParameters(LeScanType::PASSIVE, 0x2000, 0x2001)}),
+            ErrorCode::INVALID_HCI_COMMAND_PARAMETERS);
+}
+
+}  // namespace rootcanal
diff --git a/tools/rootcanal/test/controller/le/le_set_extended_scan_response_data_test.cc b/tools/rootcanal/test/controller/le/le_set_extended_scan_response_data_test.cc
new file mode 100644
index 0000000..fde4680
--- /dev/null
+++ b/tools/rootcanal/test/controller/le/le_set_extended_scan_response_data_test.cc
@@ -0,0 +1,362 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <gtest/gtest.h>
+
+#include "model/controller/link_layer_controller.h"
+#include "test_helpers.h"
+
+namespace rootcanal {
+
+using namespace bluetooth::hci;
+
+class LeSetExtendedScanResponseDataTest : public ::testing::Test {
+ public:
+  LeSetExtendedScanResponseDataTest() {
+    // Reduce the number of advertising sets to simplify testing.
+    properties_.le_num_supported_advertising_sets = 2;
+    properties_.le_max_advertising_data_length = 300;
+  };
+  ~LeSetExtendedScanResponseDataTest() override = default;
+
+ protected:
+  Address address_{0};
+  ControllerProperties properties_{};
+  LinkLayerController controller_{address_, properties_};
+};
+
+TEST_F(LeSetExtendedScanResponseDataTest, Complete) {
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingParameters(
+                0, MakeAdvertisingEventProperties(SCANNABLE), 0x0800, 0x0800,
+                0x7, OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+                PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS,
+                Address::kEmpty, AdvertisingFilterPolicy::ALL_DEVICES, 0x70,
+                PrimaryPhyType::LE_1M, 0, SecondaryPhyType::LE_2M, 0x0, false),
+            ErrorCode::SUCCESS);
+
+  std::vector<uint8_t> scan_response_data = {1, 2, 3};
+  ASSERT_EQ(
+      controller_.LeSetExtendedScanResponseData(
+          0, Operation::COMPLETE_ADVERTISEMENT,
+          FragmentPreference::CONTROLLER_MAY_FRAGMENT, scan_response_data),
+      ErrorCode::SUCCESS);
+}
+
+TEST_F(LeSetExtendedScanResponseDataTest, Discard) {
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingParameters(
+                0, MakeAdvertisingEventProperties(CONNECTABLE), 0x0800, 0x0800,
+                0x7, OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+                PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS,
+                Address::kEmpty, AdvertisingFilterPolicy::ALL_DEVICES, 0x70,
+                PrimaryPhyType::LE_1M, 0, SecondaryPhyType::LE_2M, 0x0, false),
+            ErrorCode::SUCCESS);
+
+  ASSERT_EQ(controller_.LeSetExtendedScanResponseData(
+                0, Operation::COMPLETE_ADVERTISEMENT,
+                FragmentPreference::CONTROLLER_MAY_FRAGMENT, {}),
+            ErrorCode::SUCCESS);
+}
+
+TEST_F(LeSetExtendedScanResponseDataTest, Unchanged) {
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingParameters(
+                0, MakeAdvertisingEventProperties(SCANNABLE), 0x0800, 0x0800,
+                0x7, OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+                PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS,
+                Address::kEmpty, AdvertisingFilterPolicy::ALL_DEVICES, 0x70,
+                PrimaryPhyType::LE_1M, 0, SecondaryPhyType::LE_2M, 0x0, false),
+            ErrorCode::SUCCESS);
+
+  std::vector<uint8_t> scan_response_data = {1, 2, 3};
+  ASSERT_EQ(
+      controller_.LeSetExtendedScanResponseData(
+          0, Operation::COMPLETE_ADVERTISEMENT,
+          FragmentPreference::CONTROLLER_MAY_FRAGMENT, scan_response_data),
+      ErrorCode::SUCCESS);
+
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingEnable(
+                true, {MakeEnabledSet(0, 0, 0)}),
+            ErrorCode::SUCCESS);
+
+  ASSERT_EQ(controller_.LeSetExtendedScanResponseData(
+                0, Operation::UNCHANGED_DATA,
+                FragmentPreference::CONTROLLER_MAY_FRAGMENT, {}),
+            ErrorCode::INVALID_HCI_COMMAND_PARAMETERS);
+}
+
+TEST_F(LeSetExtendedScanResponseDataTest, Fragmented) {
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingParameters(
+                0, MakeAdvertisingEventProperties(SCANNABLE), 0x0800, 0x0800,
+                0x7, OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+                PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS,
+                Address::kEmpty, AdvertisingFilterPolicy::ALL_DEVICES, 0x70,
+                PrimaryPhyType::LE_1M, 0, SecondaryPhyType::LE_2M, 0x0, false),
+            ErrorCode::SUCCESS);
+
+  std::vector<uint8_t> first_scan_response_data_fragment = {1, 2, 3};
+  std::vector<uint8_t> intermediate_scan_response_data_fragment = {4, 5, 6};
+  std::vector<uint8_t> last_scan_response_data_fragment = {7, 8, 9};
+
+  ASSERT_EQ(controller_.LeSetExtendedScanResponseData(
+                0, Operation::FIRST_FRAGMENT,
+                FragmentPreference::CONTROLLER_MAY_FRAGMENT,
+                first_scan_response_data_fragment),
+            ErrorCode::SUCCESS);
+
+  ASSERT_EQ(controller_.LeSetExtendedScanResponseData(
+                0, Operation::INTERMEDIATE_FRAGMENT,
+                FragmentPreference::CONTROLLER_MAY_FRAGMENT,
+                intermediate_scan_response_data_fragment),
+            ErrorCode::SUCCESS);
+
+  ASSERT_EQ(controller_.LeSetExtendedScanResponseData(
+                0, Operation::LAST_FRAGMENT,
+                FragmentPreference::CONTROLLER_MAY_FRAGMENT,
+                last_scan_response_data_fragment),
+            ErrorCode::SUCCESS);
+}
+
+TEST_F(LeSetExtendedScanResponseDataTest, UnknownAdvertisingHandle) {
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingParameters(
+                0, MakeAdvertisingEventProperties(SCANNABLE), 0x0800, 0x0800,
+                0x7, OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+                PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS,
+                Address::kEmpty, AdvertisingFilterPolicy::ALL_DEVICES, 0x70,
+                PrimaryPhyType::LE_1M, 0, SecondaryPhyType::LE_2M, 0x0, false),
+            ErrorCode::SUCCESS);
+
+  std::vector<uint8_t> scan_response_data = {1, 2, 3};
+  ASSERT_EQ(
+      controller_.LeSetExtendedScanResponseData(
+          1, Operation::COMPLETE_ADVERTISEMENT,
+          FragmentPreference::CONTROLLER_MAY_FRAGMENT, scan_response_data),
+      ErrorCode::UNKNOWN_ADVERTISING_IDENTIFIER);
+}
+
+TEST_F(LeSetExtendedScanResponseDataTest, UnexpectedScanResponseData) {
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingParameters(
+                0, MakeAdvertisingEventProperties(CONNECTABLE), 0x0800, 0x0800,
+                0x7, OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+                PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS,
+                Address::kEmpty, AdvertisingFilterPolicy::ALL_DEVICES, 0x70,
+                PrimaryPhyType::LE_1M, 0, SecondaryPhyType::LE_2M, 0x0, false),
+            ErrorCode::SUCCESS);
+
+  std::vector<uint8_t> scan_response_data = {1, 2, 3};
+  ASSERT_EQ(
+      controller_.LeSetExtendedScanResponseData(
+          0, Operation::COMPLETE_ADVERTISEMENT,
+          FragmentPreference::CONTROLLER_MAY_FRAGMENT, scan_response_data),
+      ErrorCode::INVALID_HCI_COMMAND_PARAMETERS);
+}
+
+TEST_F(LeSetExtendedScanResponseDataTest, IncompleteLegacyScanResponseData) {
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingParameters(
+                0, MakeAdvertisingEventProperties(LEGACY | SCANNABLE), 0x0800,
+                0x0800, 0x7, OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+                PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS,
+                Address::kEmpty, AdvertisingFilterPolicy::ALL_DEVICES, 0x70,
+                PrimaryPhyType::LE_1M, 0, SecondaryPhyType::LE_2M, 0x0, false),
+            ErrorCode::SUCCESS);
+
+  std::vector<uint8_t> first_scan_response_data_fragment = {1, 2, 3};
+  ASSERT_EQ(controller_.LeSetExtendedScanResponseData(
+                0, Operation::FIRST_FRAGMENT,
+                FragmentPreference::CONTROLLER_MAY_FRAGMENT,
+                first_scan_response_data_fragment),
+            ErrorCode::INVALID_HCI_COMMAND_PARAMETERS);
+}
+
+TEST_F(LeSetExtendedScanResponseDataTest, InvalidLegacyScanResponseData) {
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingParameters(
+                0, MakeAdvertisingEventProperties(LEGACY | SCANNABLE), 0x0800,
+                0x0800, 0x7, OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+                PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS,
+                Address::kEmpty, AdvertisingFilterPolicy::ALL_DEVICES, 0x70,
+                PrimaryPhyType::LE_1M, 0, SecondaryPhyType::LE_2M, 0x0, false),
+            ErrorCode::SUCCESS);
+
+  std::vector<uint8_t> scan_response_data = {1, 2, 3};
+  scan_response_data.resize(32);
+  ASSERT_EQ(
+      controller_.LeSetExtendedScanResponseData(
+          0, Operation::COMPLETE_ADVERTISEMENT,
+          FragmentPreference::CONTROLLER_MAY_FRAGMENT, scan_response_data),
+      ErrorCode::INVALID_HCI_COMMAND_PARAMETERS);
+}
+
+TEST_F(LeSetExtendedScanResponseDataTest, EmptyScanResponseDataFragment) {
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingParameters(
+                0, MakeAdvertisingEventProperties(SCANNABLE), 0x0800, 0x0800,
+                0x7, OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+                PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS,
+                Address::kEmpty, AdvertisingFilterPolicy::ALL_DEVICES, 0x70,
+                PrimaryPhyType::LE_1M, 0, SecondaryPhyType::LE_2M, 0x0, false),
+            ErrorCode::SUCCESS);
+
+  std::vector<uint8_t> first_scan_response_data_fragment = {1, 2, 3};
+  std::vector<uint8_t> intermediate_scan_response_data_fragment = {4, 5, 6};
+  std::vector<uint8_t> last_scan_response_data_fragment = {7, 8, 9};
+
+  ASSERT_EQ(controller_.LeSetExtendedScanResponseData(
+                0, Operation::FIRST_FRAGMENT,
+                FragmentPreference::CONTROLLER_MAY_FRAGMENT, {}),
+            ErrorCode::INVALID_HCI_COMMAND_PARAMETERS);
+
+  ASSERT_EQ(controller_.LeSetExtendedScanResponseData(
+                0, Operation::FIRST_FRAGMENT,
+                FragmentPreference::CONTROLLER_MAY_FRAGMENT,
+                first_scan_response_data_fragment),
+            ErrorCode::SUCCESS);
+
+  ASSERT_EQ(controller_.LeSetExtendedScanResponseData(
+                0, Operation::INTERMEDIATE_FRAGMENT,
+                FragmentPreference::CONTROLLER_MAY_FRAGMENT, {}),
+            ErrorCode::INVALID_HCI_COMMAND_PARAMETERS);
+
+  ASSERT_EQ(controller_.LeSetExtendedScanResponseData(
+                0, Operation::INTERMEDIATE_FRAGMENT,
+                FragmentPreference::CONTROLLER_MAY_FRAGMENT,
+                intermediate_scan_response_data_fragment),
+            ErrorCode::SUCCESS);
+
+  ASSERT_EQ(controller_.LeSetExtendedScanResponseData(
+                0, Operation::LAST_FRAGMENT,
+                FragmentPreference::CONTROLLER_MAY_FRAGMENT, {}),
+            ErrorCode::INVALID_HCI_COMMAND_PARAMETERS);
+
+  ASSERT_EQ(controller_.LeSetExtendedScanResponseData(
+                0, Operation::LAST_FRAGMENT,
+                FragmentPreference::CONTROLLER_MAY_FRAGMENT,
+                last_scan_response_data_fragment),
+            ErrorCode::SUCCESS);
+}
+
+TEST_F(LeSetExtendedScanResponseDataTest, AdvertisingEnabled) {
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingParameters(
+                0, MakeAdvertisingEventProperties(SCANNABLE), 0x0800, 0x0800,
+                0x7, OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+                PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS,
+                Address::kEmpty, AdvertisingFilterPolicy::ALL_DEVICES, 0x70,
+                PrimaryPhyType::LE_1M, 0, SecondaryPhyType::LE_2M, 0x0, false),
+            ErrorCode::SUCCESS);
+
+  std::vector<uint8_t> scan_response_data = {1, 2, 3};
+  ASSERT_EQ(
+      controller_.LeSetExtendedScanResponseData(
+          0, Operation::COMPLETE_ADVERTISEMENT,
+          FragmentPreference::CONTROLLER_MAY_FRAGMENT, scan_response_data),
+      ErrorCode::SUCCESS);
+
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingEnable(
+                true, {MakeEnabledSet(0, 0, 0)}),
+            ErrorCode::SUCCESS);
+
+  ASSERT_EQ(
+      controller_.LeSetExtendedScanResponseData(
+          0, Operation::FIRST_FRAGMENT,
+          FragmentPreference::CONTROLLER_MAY_FRAGMENT, scan_response_data),
+      ErrorCode::COMMAND_DISALLOWED);
+}
+
+TEST_F(LeSetExtendedScanResponseDataTest, EmptyExtendedScanResponseData) {
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingParameters(
+                0, MakeAdvertisingEventProperties(SCANNABLE), 0x0800, 0x0800,
+                0x7, OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+                PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS,
+                Address::kEmpty, AdvertisingFilterPolicy::ALL_DEVICES, 0x70,
+                PrimaryPhyType::LE_1M, 0, SecondaryPhyType::LE_2M, 0x0, false),
+            ErrorCode::SUCCESS);
+
+  std::vector<uint8_t> scan_response_data = {1, 2, 3};
+  ASSERT_EQ(
+      controller_.LeSetExtendedScanResponseData(
+          0, Operation::COMPLETE_ADVERTISEMENT,
+          FragmentPreference::CONTROLLER_MAY_FRAGMENT, scan_response_data),
+      ErrorCode::SUCCESS);
+
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingEnable(
+                true, {MakeEnabledSet(0, 0, 0)}),
+            ErrorCode::SUCCESS);
+
+  ASSERT_EQ(controller_.LeSetExtendedScanResponseData(
+                0, Operation::COMPLETE_ADVERTISEMENT,
+                FragmentPreference::CONTROLLER_MAY_FRAGMENT, {}),
+            ErrorCode::COMMAND_DISALLOWED);
+}
+
+TEST_F(LeSetExtendedScanResponseDataTest,
+       ScanResponseDataLargerThanMemoryCapacity) {
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingParameters(
+                0, MakeAdvertisingEventProperties(SCANNABLE), 0x0800, 0x0800,
+                0x7, OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+                PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS,
+                Address::kEmpty, AdvertisingFilterPolicy::ALL_DEVICES, 0x70,
+                PrimaryPhyType::LE_1M, 0, SecondaryPhyType::LE_2M, 0x0, false),
+            ErrorCode::SUCCESS);
+
+  std::vector<uint8_t> scan_response_data_fragment = {1, 2, 3};
+  scan_response_data_fragment.resize(
+      properties_.le_max_advertising_data_length);
+
+  ASSERT_EQ(controller_.LeSetExtendedScanResponseData(
+                0, Operation::FIRST_FRAGMENT,
+                FragmentPreference::CONTROLLER_MAY_FRAGMENT,
+                scan_response_data_fragment),
+            ErrorCode::SUCCESS);
+  ASSERT_EQ(controller_.LeSetExtendedScanResponseData(
+                0, Operation::LAST_FRAGMENT,
+                FragmentPreference::CONTROLLER_MAY_FRAGMENT,
+                scan_response_data_fragment),
+            ErrorCode::MEMORY_CAPACITY_EXCEEDED);
+}
+
+TEST_F(LeSetExtendedScanResponseDataTest,
+       ScanResponseDataLargerThanPduCapacity) {
+  // Overwrite le_max_advertising_data_length to make sure that the correct
+  // check is triggered.
+  properties_.le_max_advertising_data_length = 5000;
+
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingParameters(
+                0, MakeAdvertisingEventProperties(SCANNABLE), 0x0800, 0x0800,
+                0x7, OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+                PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS,
+                Address::kEmpty, AdvertisingFilterPolicy::ALL_DEVICES, 0x70,
+                PrimaryPhyType::LE_1M, 0, SecondaryPhyType::LE_2M, 0x0, false),
+            ErrorCode::SUCCESS);
+
+  std::vector<uint8_t> scan_response_data = {1, 2, 3};
+  ASSERT_EQ(
+      controller_.LeSetExtendedScanResponseData(
+          0, Operation::COMPLETE_ADVERTISEMENT,
+          FragmentPreference::CONTROLLER_MAY_FRAGMENT, scan_response_data),
+      ErrorCode::SUCCESS);
+
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingEnable(
+                true, {MakeEnabledSet(0, 0, 0)}),
+            ErrorCode::SUCCESS);
+
+  // No AUX chain possible for connectable advertising PDUs,
+  // the advertising data is limited to one PDU's payload.
+  scan_response_data.resize(1651);
+
+  ASSERT_EQ(
+      controller_.LeSetExtendedScanResponseData(
+          0, Operation::COMPLETE_ADVERTISEMENT,
+          FragmentPreference::CONTROLLER_MAY_FRAGMENT, scan_response_data),
+      ErrorCode::PACKET_TOO_LONG);
+}
+
+}  // namespace rootcanal
diff --git a/tools/rootcanal/test/controller/le/le_set_random_address_test.cc b/tools/rootcanal/test/controller/le/le_set_random_address_test.cc
new file mode 100644
index 0000000..63a60b6
--- /dev/null
+++ b/tools/rootcanal/test/controller/le/le_set_random_address_test.cc
@@ -0,0 +1,73 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <gtest/gtest.h>
+
+#include "model/controller/link_layer_controller.h"
+#include "test_helpers.h"
+
+namespace rootcanal {
+
+using namespace bluetooth::hci;
+
+class LeSetRandomAddressTest : public ::testing::Test {
+ public:
+  LeSetRandomAddressTest() = default;
+  ~LeSetRandomAddressTest() override = default;
+
+ protected:
+  Address address_{0};
+  ControllerProperties properties_{};
+  LinkLayerController controller_{address_, properties_};
+};
+
+TEST_F(LeSetRandomAddressTest, Success) {
+  ASSERT_EQ(controller_.LeSetRandomAddress(Address{1}), ErrorCode::SUCCESS);
+}
+
+TEST_F(LeSetRandomAddressTest, ScanningActive) {
+  controller_.LeSetScanEnable(true, false);
+  ASSERT_EQ(controller_.LeSetRandomAddress(Address{1}),
+            ErrorCode::COMMAND_DISALLOWED);
+}
+
+TEST_F(LeSetRandomAddressTest, LegacyAdvertisingActive) {
+  ASSERT_EQ(controller_.LeSetAdvertisingEnable(true), ErrorCode::SUCCESS);
+  ASSERT_EQ(controller_.LeSetRandomAddress(Address{1}),
+            ErrorCode::COMMAND_DISALLOWED);
+}
+
+TEST_F(LeSetRandomAddressTest, ExtendedAdvertisingActive) {
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingParameters(
+                0, MakeAdvertisingEventProperties(CONNECTABLE), 0x0800, 0x0800,
+                0x7, OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+                PeerAddressType::PUBLIC_DEVICE_OR_IDENTITY_ADDRESS,
+                Address::kEmpty, AdvertisingFilterPolicy::LISTED_SCAN, 0x70,
+                PrimaryPhyType::LE_1M, 0, SecondaryPhyType::LE_2M, 0x0, false),
+            ErrorCode::SUCCESS);
+  ASSERT_EQ(controller_.LeSetExtendedAdvertisingEnable(
+                true, {MakeEnabledSet(0, 0, 0)}),
+            ErrorCode::SUCCESS);
+
+  // The Random Address is not used for extended advertising,
+  // each set has its own address configured using the command
+  // LE_Set_Advertising_Set_Random_Address.
+  // It is allowed to modify the Random Address while extended advertising
+  // is active.
+  ASSERT_EQ(controller_.LeSetRandomAddress(Address{1}), ErrorCode::SUCCESS);
+}
+
+}  // namespace rootcanal
diff --git a/tools/rootcanal/test/controller/le/le_set_scan_enable_test.cc b/tools/rootcanal/test/controller/le/le_set_scan_enable_test.cc
new file mode 100644
index 0000000..a522af2
--- /dev/null
+++ b/tools/rootcanal/test/controller/le/le_set_scan_enable_test.cc
@@ -0,0 +1,87 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <gtest/gtest.h>
+
+#include "model/controller/link_layer_controller.h"
+
+namespace rootcanal {
+
+using namespace bluetooth::hci;
+
+class LeSetScanEnableTest : public ::testing::Test {
+ public:
+  LeSetScanEnableTest() = default;
+  ~LeSetScanEnableTest() override = default;
+
+ protected:
+  Address address_{0};
+  ControllerProperties properties_{};
+  LinkLayerController controller_{address_, properties_};
+};
+
+TEST_F(LeSetScanEnableTest, EnableUsingPublicAddress) {
+  ASSERT_EQ(
+      controller_.LeSetScanParameters(LeScanType::PASSIVE, 0x2000, 0x200,
+                                      OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+                                      LeScanningFilterPolicy::ACCEPT_ALL),
+      ErrorCode::SUCCESS);
+  ASSERT_EQ(controller_.LeSetScanEnable(true, false), ErrorCode::SUCCESS);
+}
+
+TEST_F(LeSetScanEnableTest, EnableUsingRandomAddress) {
+  ASSERT_EQ(
+      controller_.LeSetScanParameters(LeScanType::PASSIVE, 0x2000, 0x200,
+                                      OwnAddressType::RANDOM_DEVICE_ADDRESS,
+                                      LeScanningFilterPolicy::ACCEPT_ALL),
+      ErrorCode::SUCCESS);
+  ASSERT_EQ(controller_.LeSetRandomAddress(Address{1}), ErrorCode::SUCCESS);
+  ASSERT_EQ(controller_.LeSetScanEnable(true, false), ErrorCode::SUCCESS);
+}
+
+TEST_F(LeSetScanEnableTest, EnableUsingResolvableAddress) {
+  ASSERT_EQ(controller_.LeSetScanParameters(
+                LeScanType::PASSIVE, 0x2000, 0x200,
+                OwnAddressType::RESOLVABLE_OR_RANDOM_ADDRESS,
+                LeScanningFilterPolicy::ACCEPT_ALL),
+            ErrorCode::SUCCESS);
+  ASSERT_EQ(controller_.LeSetRandomAddress(Address{1}), ErrorCode::SUCCESS);
+  ASSERT_EQ(controller_.LeSetScanEnable(true, false), ErrorCode::SUCCESS);
+}
+
+TEST_F(LeSetScanEnableTest, Disable) {
+  ASSERT_EQ(controller_.LeSetScanEnable(false, false), ErrorCode::SUCCESS);
+}
+
+TEST_F(LeSetScanEnableTest, NoRandomAddress) {
+  ASSERT_EQ(
+      controller_.LeSetScanParameters(LeScanType::PASSIVE, 0x2000, 0x200,
+                                      OwnAddressType::RANDOM_DEVICE_ADDRESS,
+                                      LeScanningFilterPolicy::ACCEPT_ALL),
+      ErrorCode::SUCCESS);
+  ASSERT_EQ(controller_.LeSetScanEnable(true, false),
+            ErrorCode::INVALID_HCI_COMMAND_PARAMETERS);
+
+  ASSERT_EQ(controller_.LeSetScanParameters(
+                LeScanType::PASSIVE, 0x2000, 0x200,
+                OwnAddressType::RESOLVABLE_OR_RANDOM_ADDRESS,
+                LeScanningFilterPolicy::ACCEPT_ALL),
+            ErrorCode::SUCCESS);
+  ASSERT_EQ(controller_.LeSetScanEnable(true, false),
+            ErrorCode::INVALID_HCI_COMMAND_PARAMETERS);
+}
+
+}  // namespace rootcanal
diff --git a/tools/rootcanal/test/controller/le/le_set_scan_parameters_test.cc b/tools/rootcanal/test/controller/le/le_set_scan_parameters_test.cc
new file mode 100644
index 0000000..5a27b65
--- /dev/null
+++ b/tools/rootcanal/test/controller/le/le_set_scan_parameters_test.cc
@@ -0,0 +1,88 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <gtest/gtest.h>
+
+#include "model/controller/link_layer_controller.h"
+
+namespace rootcanal {
+
+using namespace bluetooth::hci;
+
+class LeSetScanParametersTest : public ::testing::Test {
+ public:
+  LeSetScanParametersTest() = default;
+  ~LeSetScanParametersTest() override = default;
+
+ protected:
+  Address address_{0};
+  ControllerProperties properties_{};
+  LinkLayerController controller_{address_, properties_};
+};
+
+TEST_F(LeSetScanParametersTest, Success) {
+  ASSERT_EQ(
+      controller_.LeSetScanParameters(LeScanType::PASSIVE, 0x2000, 0x200,
+                                      OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+                                      LeScanningFilterPolicy::ACCEPT_ALL),
+      ErrorCode::SUCCESS);
+}
+
+TEST_F(LeSetScanParametersTest, ScanningActive) {
+  ASSERT_EQ(controller_.LeSetScanEnable(true, false), ErrorCode::SUCCESS);
+
+  ASSERT_EQ(
+      controller_.LeSetScanParameters(LeScanType::PASSIVE, 0x2000, 0x200,
+                                      OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+                                      LeScanningFilterPolicy::ACCEPT_ALL),
+      ErrorCode::COMMAND_DISALLOWED);
+}
+
+TEST_F(LeSetScanParametersTest, InvalidScanInterval) {
+  ASSERT_EQ(
+      controller_.LeSetScanParameters(LeScanType::PASSIVE, 0x0, 0x200,
+                                      OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+                                      LeScanningFilterPolicy::ACCEPT_ALL),
+      ErrorCode::UNSUPPORTED_FEATURE_OR_PARAMETER_VALUE);
+
+  ASSERT_EQ(
+      controller_.LeSetScanParameters(LeScanType::PASSIVE, 0x4001, 0x200,
+                                      OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+                                      LeScanningFilterPolicy::ACCEPT_ALL),
+      ErrorCode::UNSUPPORTED_FEATURE_OR_PARAMETER_VALUE);
+}
+
+TEST_F(LeSetScanParametersTest, InvalidScanWindow) {
+  ASSERT_EQ(
+      controller_.LeSetScanParameters(LeScanType::PASSIVE, 0x2000, 0x0,
+                                      OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+                                      LeScanningFilterPolicy::ACCEPT_ALL),
+      ErrorCode::UNSUPPORTED_FEATURE_OR_PARAMETER_VALUE);
+
+  ASSERT_EQ(
+      controller_.LeSetScanParameters(LeScanType::PASSIVE, 0x2000, 0x4001,
+                                      OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+                                      LeScanningFilterPolicy::ACCEPT_ALL),
+      ErrorCode::UNSUPPORTED_FEATURE_OR_PARAMETER_VALUE);
+
+  ASSERT_EQ(
+      controller_.LeSetScanParameters(LeScanType::PASSIVE, 0x2000, 0x2001,
+                                      OwnAddressType::PUBLIC_DEVICE_ADDRESS,
+                                      LeScanningFilterPolicy::ACCEPT_ALL),
+      ErrorCode::INVALID_HCI_COMMAND_PARAMETERS);
+}
+
+}  // namespace rootcanal
diff --git a/tools/rootcanal/test/controller/le/test_helpers.h b/tools/rootcanal/test/controller/le/test_helpers.h
new file mode 100644
index 0000000..8b23774
--- /dev/null
+++ b/tools/rootcanal/test/controller/le/test_helpers.h
@@ -0,0 +1,68 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "model/controller/link_layer_controller.h"
+
+enum : unsigned {
+  CONNECTABLE = 0x1,
+  SCANNABLE = 0x2,
+  DIRECTED = 0x4,
+  HIGH_DUTY_CYCLE = 0x8,
+  LEGACY = 0x10,
+  ANONYMOUS = 0x20,
+  TX_POWER = 0x40,
+};
+
+[[maybe_unused]] static bluetooth::hci::AdvertisingEventProperties
+MakeAdvertisingEventProperties(unsigned mask) {
+  bluetooth::hci::AdvertisingEventProperties properties;
+  properties.connectable_ = (mask & CONNECTABLE) != 0;
+  properties.scannable_ = (mask & SCANNABLE) != 0;
+  properties.directed_ = (mask & DIRECTED) != 0;
+  properties.high_duty_cycle_ = (mask & HIGH_DUTY_CYCLE) != 0;
+  properties.legacy_ = (mask & LEGACY) != 0;
+  properties.anonymous_ = (mask & ANONYMOUS) != 0;
+  properties.tx_power_ = (mask & TX_POWER) != 0;
+  return properties;
+}
+
+[[maybe_unused]] static bluetooth::hci::EnabledSet MakeEnabledSet(
+    uint8_t advertising_handle, uint16_t duration,
+    uint8_t max_extended_advertising_events) {
+  bluetooth::hci::EnabledSet set;
+  set.advertising_handle_ = advertising_handle;
+  set.duration_ = duration;
+  set.max_extended_advertising_events_ = max_extended_advertising_events;
+  return set;
+}
+
+[[maybe_unused]] static bluetooth::hci::LeCreateConnPhyScanParameters
+MakeInitiatingPhyParameters(uint16_t scan_interval, uint16_t scan_window,
+                            uint16_t connection_interval_min,
+                            uint16_t connection_interval_max,
+                            uint16_t max_latency, uint16_t supervision_timeout,
+                            uint16_t min_ce_length, uint16_t max_ce_length) {
+  bluetooth::hci::LeCreateConnPhyScanParameters parameters;
+  parameters.scan_interval_ = scan_interval;
+  parameters.scan_window_ = scan_window;
+  parameters.conn_interval_min_ = connection_interval_min;
+  parameters.conn_interval_max_ = connection_interval_max;
+  parameters.conn_latency_ = max_latency;
+  parameters.supervision_timeout_ = supervision_timeout;
+  parameters.min_ce_length_ = min_ce_length;
+  parameters.max_ce_length_ = max_ce_length;
+  return parameters;
+}
diff --git a/tools/rootcanal/test/h4_parser_unittest.cc b/tools/rootcanal/test/h4_parser_unittest.cc
index 9b74c1c..9e4b59e 100644
--- a/tools/rootcanal/test/h4_parser_unittest.cc
+++ b/tools/rootcanal/test/h4_parser_unittest.cc
@@ -18,7 +18,7 @@
 
 #include <gtest/gtest.h>
 
-#include "osi/include/osi.h"  // for OSI_NO_INTR
+#include <array>
 
 namespace rootcanal {
 using PacketData = std::vector<uint8_t>;
@@ -59,6 +59,7 @@
         type_ = PacketType::ISO;
         PacketReadCallback(p);
       },
+      true,
   };
   PacketData packet_;
   PacketType type_;
@@ -111,9 +112,10 @@
 }
 
 TEST_F(H4ParserTest, WrongTypeIsDeath) {
+  parser_.DisableRecovery();
   PacketData bad_bit({0xfd});
   ASSERT_DEATH(parser_.Consume(bad_bit.data(), bad_bit.size()),
-               "Unimplemented packet type.*");
+               "Received invalid packet type.*");
 }
 
 TEST_F(H4ParserTest, CallsTheRightCallbacks) {
@@ -141,4 +143,43 @@
   }
 }
 
+TEST_F(H4ParserTest, Recovery) {
+  // Validate that the recovery state is exited only after receiving the
+  // HCI Reset command.
+  parser_.EnableRecovery();
+
+  // Enter recovery state after receiving an invalid packet type.
+  uint8_t invalid_packet_type = 0xfd;
+  ASSERT_TRUE(parser_.Consume(&invalid_packet_type, 1));
+  ASSERT_EQ(parser_.CurrentState(), H4Parser::State::HCI_RECOVERY);
+
+  const std::array<uint8_t, 4> reset_command{0x01, 0x03, 0x0c, 0x00};
+
+  // Send prefixes of the HCI Reset command, restarting over from the start.
+  for (size_t n = 1; n < 4; n++) {
+    for (size_t i = 0; i < n; i++) {
+      ASSERT_TRUE(parser_.Consume(&reset_command[i], 1));
+      ASSERT_EQ(parser_.CurrentState(), H4Parser::State::HCI_RECOVERY);
+    }
+  }
+
+  // Finally send the full HCI Reset command.
+  for (size_t i = 0; i < 4; i++) {
+    ASSERT_EQ(parser_.CurrentState(), H4Parser::State::HCI_RECOVERY);
+    ASSERT_TRUE(parser_.Consume(&reset_command[i], 1));
+  }
+
+  // Validate that the HCI recovery state is exited,
+  // and the HCI Reset command correctly received on the command callback.
+  ASSERT_EQ(parser_.CurrentState(), H4Parser::State::HCI_TYPE);
+  ASSERT_LT(0, (int)packet_.size());
+
+  // Validate that the HCI Reset command was correctly received.
+  ASSERT_EQ(type_, PacketType::COMMAND);
+  ASSERT_EQ(packet_.size(), reset_command.size() - 1);
+  for (size_t i = 1; i < packet_.size(); i++) {
+    ASSERT_EQ(packet_[i - 1], reset_command[i]);
+  }
+}
+
 }  // namespace rootcanal
diff --git a/tools/rootcanal/test/posix_socket_unittest.cc b/tools/rootcanal/test/posix_socket_unittest.cc
index afcfea7..64cffad 100644
--- a/tools/rootcanal/test/posix_socket_unittest.cc
+++ b/tools/rootcanal/test/posix_socket_unittest.cc
@@ -31,10 +31,10 @@
 #include <random>
 #include <vector>
 
+#include "log.h"  // for LOG_INFO
 #include "model/setup/async_manager.h"
 #include "net/posix/posix_async_socket_connector.h"
 #include "net/posix/posix_async_socket_server.h"
-#include "os/log.h"  // for LOG_INFO
 
 namespace android {
 namespace net {